diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index 3b3f4f651..693c19c36 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -55,4 +55,4 @@ body:
   - type: input
     attributes:
       label: NestJS version
-      placeholder: "^11.0.0"
+      placeholder: "12.0.0-alpha.5"
diff --git a/.github/workflows/ci-pr-test.yml b/.github/workflows/ci-pr-test.yml
index d6aa3ff32..3dbfe056b 100644
--- a/.github/workflows/ci-pr-test.yml
+++ b/.github/workflows/ci-pr-test.yml
@@ -37,6 +37,8 @@ jobs:
         run: yarn lint:all
       - name: Typecheck tests
         run: yarn typecheck:spec
+      - name: Verify native Vitest config loading
+        run: yarn test:config-native
       - name: Unit tests
         run: yarn test:ci
       - name: E2E coverage
diff --git a/.github/workflows/release-readiness.yml b/.github/workflows/release-readiness.yml
new file mode 100644
index 000000000..62bd79a8f
--- /dev/null
+++ b/.github/workflows/release-readiness.yml
@@ -0,0 +1,32 @@
+name: release-readiness
+
+on:
+  pull_request:
+    branches: ['main']
+  push:
+    branches: ['main']
+
+jobs:
+  release-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Enable Corepack
+        run: corepack enable
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20.x
+          cache: yarn
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '21'
+      - name: Cache Firestore emulator
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/firebase/emulators
+          key: firestore-emulator-${{ runner.os }}-${{ hashFiles('yarn.lock') }}
+      - name: Install
+        run: corepack yarn install --immutable
+      - name: Release readiness
+        run: corepack yarn release:check
diff --git a/CHANGELOG.md b/CHANGELOG.md
index be8beb5ae..a2bec985e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,9 +20,9 @@ Vitest 4. What this deletes, permanently:
   dependency. The root `scripts/` directory no longer exists.
 
 The setup follows Vitest 4's official monorepo guidance — the
-`projects` model: the root `vitest.config.ts` declares every project
+`projects` model: the root `vitest.config.mts` declares every project
 (`unit`, `e2e-packages`, one per example workspace) and
-`vitest.shared.ts` carries the shared plugin/settings (deliberately not
+`vitest.shared.mts` carries the shared plugin/settings (deliberately not
 the root config — merging a projects-bearing config into a project is a
 documented pitfall). Example configs are `defineProject` +
 `mergeConfig(shared, …)`; one SWC block exists instead of five.
diff --git a/CONFIGURATION.md b/CONFIGURATION.md
index d35552996..1e4ca5aa8 100644
--- a/CONFIGURATION.md
+++ b/CONFIGURATION.md
@@ -1,7 +1,7 @@
 # Rockets — Configuration Entry Point
 
-> Configuration reference for the **v2 DSL** (shipped). Field names below match
-> the current `packages/*/src/**` (code wins over READMEs). The v2 redesign
+> Configuration reference for the **1.0-preview DSL**. Field names below match
+> the current `packages/*/src/**` (code wins over prose). The original DSL
 > rationale, convertibility proof, and change-set live in §12.
 > Diagrams are Mermaid — they render on GitHub and in most Markdown viewers.
 
@@ -11,10 +11,11 @@
 
 You never hand NestJS a tree of modules. You write **declarative bundles**
 (`defineResource`, `defineSubResource`, `defineModuleResource`) and a few
-top-level fields (`repository`, `userMetadata`, `auth`), pass them to **one**
-`RocketsModule.forRoot({...})`, and the module-definition transform converts
-that into a single global `DynamicModule` (controllers, providers, repository
-tokens, CQRS handlers, Swagger).
+top-level fields (`repository`, `userMetadata`, `auth`), pass them to
+`createServer({...})`, and the module-definition transform converts that into a
+single global `DynamicModule` (controllers, providers, repository tokens, CQRS
+handlers, Swagger). Use `RocketsModule.forRoot({...})` directly when a larger
+Nest host module must compose Rockets with other imports or providers.
 
 ```mermaid
 flowchart LR
@@ -24,7 +25,8 @@ flowchart LR
     M["defineModuleResource()"]
     OPT["repository / userMetadata / auth / swagger"]
   end
-  YOU --> FORROOT["RocketsModule.forRoot( ... )"]
+  YOU --> CREATE["createServer( ... )"]
+  CREATE --> FORROOT["RocketsModule.forRoot( ... )"]
   FORROOT --> XFORM["definitionTransform\n(build time)"]
   XFORM --> PLAN["buildAppRegistrationPlan()"]
   PLAN --> DM["one global DynamicModule\nimports / providers / controllers / exports"]
@@ -34,12 +36,13 @@ flowchart LR
 **Two layers, one surface.** `@concepta/rockets` (server) is a thin presentation
 layer over `@concepta/rockets-core`. Server adds the `MeController`, the global
 guard opt-in, and the `auth` chain; core does the actual resource→module
-conversion. You only ever call `RocketsModule.forRoot` (server). Core's
-`forRootAsync` is called internally.
+conversion. `createServer` is the canonical definition-first facade;
+`RocketsModule.forRoot` is the lower-level composition surface. Core's
+`forRootAsync` is called internally in either case.
 
 ---
 
-## 1. The entry point — `RocketsModule.forRoot` / `forRootAsync`
+## 1. The entry point — `createServer` and `RocketsModule`
 
 The options object is split by NestJS's `ConfigurableModuleBuilder` into two
 buckets with very different lifecycles:
@@ -58,20 +61,24 @@ buckets with very different lifecycles:
 | Field | Type | Req? | Default | Purpose |
 |---|---|---|---|---|
 | `resources` | `ReadonlyArray<ResourceInput>` | optional | `[]` | The feature bundles (CRUD + module + sub flattened). |
-| `repository` | `RepositoryModuleInterface \| RepositoryBootstrap` | optional* | — | Root persistence adapter (TypeORM/Firestore/…). |
-| `userMetadata` | `RocketsUserMetadataConfig` | **required at runtime** | — | `/me` entity + DTOs. Omit → throws when the metadata DTO token resolves. |
+| `repository` | `RepositoryModuleInterface \| RepositoryBootstrap` | optional† | — | Root persistence adapter (TypeORM/Firestore/…). |
+| `userMetadata` | `RocketsUserMetadataConfig` | optional | — | `/me` entity + DTOs. When omitted, Rockets does not mount `/me` or register metadata handlers/providers. |
 | `auth` | `AuthBootstrap \| AuthBootstrap[]` | optional | `[]` | Auth chain (external adapter and/or built-in). |
 | `swagger` | `SwaggerUiOptionsInterface` | optional | — | Doc builder + UI. The **only** runtime field forwarded to core. |
 | `settings` | `RocketsSettingsInterface` (empty today) | optional | — | Reserved; no fields yet. |
 | `handlers` | `{ upsertUserMetadata?, getUserMetadata? }` | optional | built-ins | Override the user-metadata CQRS handlers. |
-| `enableGlobalGuard` | `boolean` | optional | **on** (opt-out) | Register `AuthServerGuard` as `APP_GUARD` unless `=== false`. |
+| `enableGlobalGuard` | `boolean` | optional | **on‡** | Register `AuthServerGuard` as `APP_GUARD` unless `=== false`. |
 | `disableController` | `{ me?: boolean }` | optional | `{}` | Disable built-in `MeController`. |
 | `controllers` | `DynamicModule['controllers']` | optional | — | Replace the auto controller set. |
 | `global` | `boolean` | optional | **forced `true`** | `forRoot` always makes the module global. |
 
-\* `repository` is optional in the type but persistence resolution throws if an
+† `repository` is optional in the type but persistence resolution throws if an
 entity has neither a per-entity override nor a root adapter.
 
+‡ The built-in `defineRocketsAuth()` integration contributes `false` because
+its upstream authentication module already owns a JWT global guard. Explicit
+server options always win; mixed-auth hosts can opt the Rockets chain back in.
+
 `*-server` / `*-core` split — what server forwards vs keeps:
 
 ```mermaid
@@ -436,9 +443,19 @@ accepts one bootstrap or a **chain** (array, tried in order).
 interface AuthBootstrap<A extends AuthAdapterInterface = AuthAdapterInterface> {
   adapter: Type<A>;
   forRoot?: () => DynamicModule;   // host module: provides+exports the adapter
+  contributes?: {                 // integration-owned app defaults
+    resources?: ReadonlyArray<ResourceInput>;
+    userMetadata?: RocketsUserMetadataConfig;
+    repository?: RepositoryModuleInterface | RepositoryBootstrap;
+    enableGlobalGuard?: boolean;
+  };
 }
 ```
 
+Explicit server options override contributed defaults. Resource contributions
+are prepended to application resources; incompatible single-value defaults from
+multiple auth integrations fail fast instead of depending on import order.
+
 ```mermaid
 flowchart TD
   REQ["incoming request"] --> GUARD["AuthServerGuard (APP_GUARD)"]
@@ -469,33 +486,26 @@ interface AuthAdapterInterface {
 ```
 
 **Global guard (default-on / opt-out):** `AuthServerGuard` is registered as
-`APP_GUARD` **unless `enableGlobalGuard === false`** — enabled by default; you
-opt **out**, never in. Routes are guarded unless explicitly made public
-(`@AuthPublic()`) or the global guard is disabled.
+`APP_GUARD` **unless `enableGlobalGuard === false`**. Auth integrations may
+contribute a different default; explicit app configuration wins. Routes are
+guarded unless explicitly made public (`@AuthPublic()`) or the global guard is
+disabled.
 
 ### 7a. External auth (`@concepta/rockets`) — you own `authenticate()`
 
-Minimum (core stub shape):
+Minimum:
 
 ```ts
-function createStubAuthBootstrap(adapter) {
-  return { adapter, forRoot: () => ({ module: class {}, providers: [adapter], exports: [adapter] }) };
-}
+const auth = defineAuthAdapter(MyAuthAdapter);
 ```
 
 Complete (`examples/sample-server/src/auth/define-sample-auth.ts`):
 
 ```ts
 export function defineSampleAuth(): AuthBootstrap<SampleAuthAdapter> {
-  return {
-    adapter: SampleAuthAdapter,
-    forRoot: () => ({
-      module: class SampleAuthHostModule {},
-      providers: [SampleAuthAdapter],
-      controllers: [AuthController],
-      exports: [SampleAuthAdapter],   // controller + entity stay internal
-    }),
-  };
+  return defineAuthAdapter(SampleAuthAdapter, {
+    controllers: [AuthController], // controller stays integration-private
+  });
 }
 
 RocketsModule.forRoot({
@@ -533,10 +543,10 @@ Concept → field map:
 |---|---|
 | JWT secrets/signing | `authentication.settings.jwt.{access,refresh}` |
 | login/strategies | `authentication.settings.strategies` |
-| recovery | `authentication.ports.recoveryNotification` (**required**) + `verifyNotification` |
+| recovery | `/recovery/*` controllers (enabled by default) + required `authentication.ports.recoveryNotification`; verification uses `verifyNotification` |
 | otp | `otp` block + `settings.otp` + `disableController.otp` |
 | signup / admin | `userCrud` (+ `handlers.*`) + `disableController.{signup,admin}` |
-| oauth / federated | `federated` block — **OAuth provider modules are NOT in v8 yet (G1 gap)** |
+| oauth / federated | `federated` persistence block; OAuth provider routes are deferred from the current 1.0 scope |
 
 Complete (`examples/sample-server-auth/src/app.module.ts`):
 
@@ -558,20 +568,20 @@ const rocketsAuthInput: DefineRocketsAuthInput = {
 };
 
 const rocketsAuth = defineRocketsAuth(rocketsAuthInput);
-const rocketsAuthResources = buildRocketsAuthResources(rocketsAuthInput.persistence, rocketsAuthInput.invitationEntity);
 
 RocketsModule.forRoot({
   auth: rocketsAuth,
-  userMetadata: rocketsAuthInput.userMetadata,
-  enableGlobalGuard: false,                 // auth uses per-controller guards
-  repository: repo,                         // SAME instance as persistence.module (reference equality!)
-  resources: [ ...rocketsAuthResources, createPetResource(), /* … */ ],
+  resources: [createPetResource(), /* … */],
 });
 ```
 
-> **Reference-equality trap:** the `repo` passed to `RocketsModule.repository`
-> and to `defineRocketsAuth({ persistence: { module: repo } })` must be the
-> **same object** — entities are grouped per adapter by identity.
+`defineRocketsAuth` contributes its persistence resources, metadata contract,
+repository bootstrap, and guard preference to the surrounding server. The host
+only declares application-owned resources. Explicit server options remain the
+escape hatch and take precedence over those contributed defaults. Its Rockets
+guard preference is `false` because `AuthenticationModule` already owns the JWT
+global guard; mixed-auth hosts can set `rocketsDefaults.enableGlobalGuard: true`
+and `auth.appGuard: false` to make the ordered Rockets adapter chain the owner.
 
 ---
 
@@ -596,16 +606,16 @@ Minimum:
 repository: defineTypeOrmRepository({ type: 'sqlite', database: ':memory:', synchronize: true })
 ```
 
-Selecting TypeORM (`examples/sample-server/src/repository/define-typeorm-repository.ts`):
+Selecting TypeORM:
 
 ```ts
-export function defineTypeOrmRepository(connection): RepositoryBootstrap {
-  return {
-    name: 'typeorm-bootstrap',
-    forFeature: (entities) => TypeOrmRepositoryModule.forFeature(entities),   // one repo token per key
-    forRoot:    (entities) => TypeOrmModule.forRoot({ ...connection, entities: [...entities] }),
-  };
-}
+import { defineTypeOrmRepository } from '@concepta/rockets-repository-typeorm';
+
+const repository = defineTypeOrmRepository({
+  type: 'sqlite',
+  database: ':memory:',
+  synchronize: true,
+});
 ```
 
 Swap to Firestore = pass a `defineFirestoreRepository(...)` instead — **no
@@ -631,7 +641,7 @@ interface RocketsUserMetadataConfig {
 }
 ```
 
-Minimum (required at runtime — omit and the metadata DTO token throws):
+Enable the optional `/me` surface by supplying:
 
 ```ts
 userMetadata: {
@@ -681,13 +691,10 @@ flowchart TD
    `sampleAuthUserResource` + `defineSampleAuth`).
 3. **`SafeCrudContextInterceptor`** — a live workaround replacing upstream's
    global `CrudContextOverlay`; flagged for removal once upstream is mixed-app safe.
-4. **OAuth (G1)** — federated/OAuth provider modules are not ported to v8 yet.
+4. **OAuth** — federated identity persistence exists, but provider-specific
+   OAuth routes are deferred from the current 1.0 scope.
 5. **`settings`** — both server and core `settings` are empty interfaces today
    (reserved slot).
-6. **Pre-existing e2e/typecheck gaps on this branch** (independent of the v2
-   work): `rockets-crud` photo-CRUD e2e ×2 + `rockets-server-auth` password e2e
-   ×2 fail (31/35); `sample-server` has 2 `CrudCommandHandler` ctor typecheck
-   errors and `sample-server-auth` 1 deep crud-import error.
 
 ---
 
@@ -697,11 +704,12 @@ flowchart TD
 
 ## 12. Signature v2 — design rationale & change-set (SHIPPED)
 
-> **Status: implemented.** The v2 DSL described in §1–§10 is live in
-> `packages/rockets-core/src/**`, with both sample apps migrated. Verified:
-> build green, core unit 296/296, core e2e 47/47, package e2e 31/35 (the 4
-> failures pre-date this work). This section keeps the *why* — the constraint,
-> the convertibility proof, the locked naming, and the change-set.
+> **Status: implemented.** The DSL described in §1–§10 is live in
+> `packages/rockets-core/src/**`, with all sample apps migrated. The root
+> `release:check` gate verifies builds, spec typechecking, code and Markdown
+> linting, unit and package E2E tests, sample builds/E2E tests, and dry-run
+> package artifacts. This section keeps the *why* — the constraint, the
+> convertibility proof, the locked naming, and the change-set.
 >
 > **Constraint:** "no breaking" meant **no functional / feature regression** —
 > NOT "cannot change the entry config". The input DSL was ours to redesign; the
@@ -746,8 +754,9 @@ do not present join as the parent-child association mechanism.
 - **Per-operation DTOs: `input` / `output`.** Not `body` (write-only word) and not
   `request` — `request` is already the `{ params, body, bodyBatch, validation }`
   envelope in crud, so it is taken. `input → request.body`, `output → response.resource`.
-- **`repository` everywhere.** Single name for "which adapter": root, per-resource,
-  per-entity, `userMetadata`. Replaces `persistence.module`.
+- **`repository` at the application/resource layer.** Single name for "which
+  adapter": root, per-resource, per-entity, and `userMetadata`. Built-in auth
+  retains `persistence.module` because that input also owns the auth entity map.
 
 ### 12.3 Final signatures
 
diff --git a/MIGRATION-SUMMARY.md b/MIGRATION-SUMMARY.md
deleted file mode 100644
index fffa2ea76..000000000
--- a/MIGRATION-SUMMARY.md
+++ /dev/null
@@ -1,123 +0,0 @@
-# @bitwild Self-Contained Migration — Session Summary
-
-**Branch:** `feature/module-migration`
-**Date:** 2026-06-04
-**Status:** build GREEN · lint PASS · e2e 31/35 suites (248 tests) · NOT committed
-
----
-
-## Goal
-
-Turn the `@bitwild` repository / crud / app packages from **thin wrappers over
-upstream `@concepta/nestjs-*`** into **self-contained source**, by adopting the
-original concepta source packages (copied in as `*-concepta` folders) and
-deleting the wrappers. Consolidate `rockets-common` into `rockets-app`.
-
-## End-state package layout
-
-```text
-app  ←  repository  ←  crud         (lowest → highest layer)
-              ↑                ↖
-        repository-typeorm      core ← server / server-auth
-```
-
-| Package | What it is now |
-|---|---|
-| `@concepta/rockets-app` | **Foundation/kernel.** Context overlay (`AppContextHost`, `getAppContext`, `OverlayRef`, `Ctx`, `ContextOverlayInterceptor`), `RuntimeException`, hooks (`HookResolverService`, `Spec`), references, audit, `DomainAggregate`, `AuthUser`, SwaggerUi module, utils (`deriveEntityKey`/`resolveEntityKey`, `createRepositoryContext`, `whitelistedFromDto`, `stripUndefined`). **Replaced `rockets-common` (deleted).** Zero `@concepta/nestjs-*` deps. |
-| `@concepta/rockets-repository` | Self-contained dynamic repository (module, adapter, transactions, federation, hooks, query helpers). DB-agnostic. `@InjectDynamicRepository(string \| Type)`. |
-| `@concepta/rockets-repository-typeorm` | TypeORM implementation. |
-| `@concepta/rockets-crud` | Self-contained CRUD module + builder + CQRS handlers. `@InjectCrudAdapter(string \| Type)`. |
-
-## What changed (the 5 phases)
-
-- **Phase 0** — Recorded baseline: `@bitwild` ecosystem was green; the copied
-  concepta packages had real TS compile errors.
-- **Phase 1** — `rockets-app` became the self-contained superset of `common`.
-  Ported 7 utils + `AuthUser` (5 lines) + a **fresh** SwaggerUi module +
-  model interfaces. Renamed `@concepta/rockets-app` → `@concepta/rockets-app`.
-- **Phase 2** — Adopted repository: merged `InjectDynamicRepository` to
-  `string | Type`, fixed `super.context` → `this.context` + `declare context`.
-- **Phase 3** — Adopted crud + repository-typeorm: fixed the TypeORM `upsert`
-  typing (normalize `DeepPartial` via `repo.create()` — no cast), fixed a
-  union-narrowing bug that only fails under `strict:false` (distributive
-  conditional structural view), merged `InjectCrudAdapter`, fixed fixture
-  generic inference, aligned tsconfigs to exclude test files (project convention).
-- **Phase 4** — Atomic cutover:
-  - Deleted wrappers: `rockets-common`, old `rockets-repository`, old `rockets-crud`.
-  - Renamed concepta folders/packages → `@concepta/*`.
-  - Swapped consumer imports: `rockets-common`→`rockets-app` (72 files);
-    upstream `@concepta/nestjs-repository`/`-typeorm`/`-crud` → `@bitwild` (93 files);
-    `@concepta/nestjs-common` kernel symbols split to app (52 files, 7 upstream-only
-    symbols kept).
-  - Rewired core `HookModule.forRoot({})` → `RocketsAppModule.forRoot()`.
-  - This resolved the silent `AppContextHost`-identity bug (the #1 risk
-    flagged up front).
-
-## Why the `@bitwild` repository now DIVERGES from upstream (important)
-
-The OLD `@concepta/rockets-repository` was a wrapper that re-exported upstream
-`@concepta/nestjs-repository`, so they shared the **same** `AppContextHost` /
-`TransactionScope` classes. The NEW `@concepta/rockets-repository` is independent
-source — **different classes**. Anything that mixes the new `@bitwild` stack with
-upstream `@concepta/nestjs-*` packages hits a cross-identity mismatch
-("Expected AppContextHost, got object").
-
-## The 4 failing e2e suites (both are documented boundaries, not bugs introduced)
-
-1. **`rockets-crud`: `crud.operations`, `crud.adapter`** — PRE-EXISTING
-   crud-internal test infra (dist-module `DataSource` DI wiring; ctx-overlay
-   generics in the test helper). Never passed in this repo's baseline. Source
-     is clean.
-
-2. **`rockets-server-auth`: `me-password`, `password-history`** — ARCHITECTURAL
-   BOUNDARY. server-auth composes `@bitwild` core (→ forces the `@bitwild`
-   repository for its resource layer + global `SafeCrudContextInterceptor`)
-   **and** upstream `@concepta/nestjs-invitation` / `nestjs-user` (→ need upstream
-   `TransactionScope`). One app cannot provide both repository identities.
-   This worked before only because the wrapper === upstream.
-
-## OPEN DECISION for next session (server-auth)
-
-Closing the server-auth boundary needs one of:
-
-- **(A)** Migrate the upstream auth stack (`nestjs-invitation`, `nestjs-user`,
-  `nestjs-otp`, `nestjs-role`, `nestjs-password`, `nestjs-federated`) to the
-  `@bitwild` stack. Large, separate effort — makes server-auth fully self-contained.
-- **(B)** Re-introduce a repository compat layer so `@bitwild` repository stays
-  upstream-identity-compatible. Defeats the self-contained goal; also a "bridge"
-  (forbidden by AGENTS.md rule #9).
-- **(C)** Accept the 2 suites as a known boundary and ship the rest.
-
-> You picked "keep auth on upstream" last session, but that is **structurally
-> unachievable** while server-auth uses `@bitwild` core. Needs a real call between
-> A / B / C.
-
-## How to reproduce the current state
-
-```bash
-yarn install
-yarn build          # GREEN
-yarn lint           # PASS (4 warnings)
-yarn test:e2e       # 31/35 suites, 248 tests pass; 4 fail (above)
-```
-
-## Notes / gotchas discovered
-
-- Build is `tsc --build` (incremental) — it does NOT delete orphaned `dist`
-  outputs. After renames, `rm -rf packages/*/dist *.tsbuildinfo` before a build,
-  or stale `.js` files reference deleted packages at runtime.
-- Tests historically transpiled with `strict:false` (now via the Vitest/SWC
-pipeline); some adopted code had
-  bugs that only surface there (union narrowing). Fixes must pass BOTH modes.
-- Adding `reflect-metadata` as a dep to `rockets-app` made yarn nest a
-  redundant `@nestjs/common` under `packages/rockets-app/node_modules`, which
-  broke a portable-type emit (`TS2742`). Reverted; the spec's `import
-  'reflect-metadata'` was redundant (it's a hoisted root dep).
-- Upstream `@concepta/nestjs-user`/`invitation` peer-depend on
-  `@concepta/nestjs-crud`/`-repository`; those deps were restored to package.json
-  (source uses `@bitwild`, upstream auth packages keep their upstream peer).
-
-## Detailed step-by-step log
-
-See `.context/migration-baseline.md` (gitignored) for the full Phase 0→4 record
-with exact files, errors, and fixes.
diff --git a/README.md b/README.md
index 37f8d2a64..0a7ed080a 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
 
 [![CI](https://img.shields.io/github/actions/workflow/status/conceptadev/rockets/ci-merge.yml?branch=main&label=CI)](https://github.com/conceptadev/rockets/actions/workflows/ci-merge.yml)
 [![Codecov](https://codecov.io/gh/conceptadev/rockets/branch/main/graph/badge.svg)](https://codecov.io/gh/conceptadev/rockets)
-[![NestJS](https://img.shields.io/badge/NestJS-11-ea2845?logo=nestjs&logoColor=white)](https://nestjs.com/)
+[![NestJS](https://img.shields.io/badge/NestJS-12-ea2845?logo=nestjs&logoColor=white)](https://nestjs.com/)
 [![TypeScript](https://img.shields.io/badge/TypeScript-5.0+-3178c6?logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
 [![License](https://img.shields.io/badge/license-BSD--3--Clause-green.svg)](LICENSE.txt)
 
@@ -13,9 +13,9 @@
 
 **Status:** pre-1.0 (`0.0.1-dev.0`, on npm under `@concepta/*` with dist-tag
 `alpha`). The public surface (`AuthAdapterInterface`, `defineResource`,
-`defineModuleResource`, `RepositoryInterface`, the `RocketsModule.forRoot`
-options shape) is stable; field renames are still possible before 1.0. Pin exact
-versions in production.
+`defineModuleResource`, `RepositoryInterface`, `createServer`) is being
+prepared for 1.0; breaking refinements are still possible until that release.
+Pin exact versions in production.
 
 ## Table of contents
 
@@ -257,7 +257,7 @@ access-control rules. Rockets does not pretend to write those for you.
 
 ### Prerequisites
 
-- Node 18+.
+- Node 20+ (required by NestJS 12).
 - A package manager (yarn 4 / npm / pnpm — examples below use yarn).
 - A database adapter — TypeORM with any supported driver is the most common.
   Firestore works via `@concepta/rockets-repository-firestore`.
@@ -307,7 +307,7 @@ yarn add @concepta/rockets@alpha \
 
 | Pulled in for you      | Packages                                                                                                              |
 | ---------------------- | ---------------------------------------------------------------------------------------------------------------------- |
-| Other `@concepta/*`     | `rockets-core`, `rockets-repository-typeorm`                                                                          |
+| Other `@concepta/*`     | `rockets-core`                                                                                                        |
 | Upstream motor         | `@concepta/nestjs-{core,repository,crud,authentication,access-control}` (via `@concepta/rockets-core` re-exports)      |
 | Nest (Rockets runtime) | `@nestjs/common`, `@nestjs/core`, `@nestjs/cqrs`, `@nestjs/swagger`, `@nestjs/config`                                 |
 
@@ -342,6 +342,7 @@ import {
   AuthAdapterInterface,
   AuthAttemptResult,
   AuthRequest,
+  defineAuthAdapter,
   extractBearerToken,
 } from '@concepta/rockets';
 
@@ -364,6 +365,8 @@ export class JwtAdapter implements AuthAdapterInterface {
     }
   }
 }
+
+export const jwtAuth = defineAuthAdapter(JwtAdapter);
 ```
 
 Declare a resource — this is the entire CRUD definition:
@@ -381,42 +384,24 @@ export class PetEntity {
 }
 ```
 
-Add a small TypeORM bootstrap helper in your app — the adapter is
-`@concepta/rockets-repository-typeorm`, but the connection-options wrapper stays
-app-local so core never takes a TypeORM dependency. It implements
-`RepositoryBootstrap` so the planner calls `forRoot(entities)` once from
-`resources[]` + `userMetadata`, without a hand-maintained entity list:
+Create the TypeORM bootstrap at the boundary. The adapter owns the wrapper, so
+applications do not copy infrastructure helpers:
 
 ```typescript
-// src/repository/define-typeorm-repository.ts
-import type { DynamicModule, PlainLiteralObject, Type } from '@nestjs/common';
-import { TypeOrmModule, TypeOrmModuleOptions } from '@nestjs/typeorm';
-import { TypeOrmRepositoryModule } from '@concepta/rockets-repository-typeorm';
-import type { RepositoryBootstrap } from '@concepta/rockets-core';
-import type {
-  DynamicRepositoryModule,
-  RepositoryProviderOptions,
-} from '@concepta/nestjs-repository';
-
-export function defineTypeOrmRepository<
-  Connection extends TypeOrmModuleOptions,
->(connection: Connection): RepositoryBootstrap {
-  return {
-    name: 'typeorm-bootstrap',
-    forFeature(entities: RepositoryProviderOptions[]): DynamicRepositoryModule {
-      return TypeOrmRepositoryModule.forFeature(entities);
-    },
-    forRoot(entities: ReadonlyArray<Type<PlainLiteralObject>>): DynamicModule {
-      return TypeOrmModule.forRoot({ ...connection, entities: [...entities] });
-    },
-  };
-}
+import { defineTypeOrmRepository } from '@concepta/rockets-repository-typeorm';
+
+const repository = defineTypeOrmRepository({
+  type: 'sqlite',
+  database: ':memory:',
+  synchronize: true,
+  dropSchema: true,
+});
 ```
 
 **Why this exists:** you pass only connection options (`type`, `database`,
 `synchronize`, …). You never maintain
 `entities: [PetEntity, UserMetadataEntity, …]` on `TypeOrmModule.forRoot`. When
-`RocketsModule` boots, the registration planner walks `resources[]`,
+the server boots, the registration planner walks `resources[]`,
 `userMetadata.entity`, and any entities contributed by auth integrations, then
 calls `forRoot(mergedEntities)` once and `forFeature` per table. Services use
 `@InjectDynamicRepository(PetEntity)` and get a `RepositoryInterface<PetEntity>`
@@ -425,41 +410,41 @@ calls `forRoot(mergedEntities)` once and `forFeature` per table. Services use
 Compose the app:
 
 ```typescript
-// src/app.module.ts
-import { Module } from '@nestjs/common';
-import { RocketsModule, defineResource } from '@concepta/rockets';
+// src/server.ts
+import { NestFactory } from '@nestjs/core';
+import { createServer, defineResource } from '@concepta/rockets';
+import { defineTypeOrmRepository } from '@concepta/rockets-repository-typeorm';
 import { OwnerStampHook, OwnerScopeHook } from '@concepta/rockets-core';
-import { JwtAdapter } from './auth/jwt.adapter';
+import { jwtAuth } from './auth/jwt.adapter';
 import { PetEntity } from './pet/pet.entity';
 import { UserMetadataEntity } from './user/user-metadata.entity';
 import { UserMetadataCreateDto, UserMetadataUpdateDto } from './user/dto';
-import { defineTypeOrmRepository } from './repository/define-typeorm-repository';
 
-@Module({
-  imports: [
-    RocketsModule.forRoot({
-      auth: JwtAdapter,
-      userMetadata: {
-        entity: UserMetadataEntity,
-        createDto: UserMetadataCreateDto,
-        updateDto: UserMetadataUpdateDto,
-      },
-      repository: defineTypeOrmRepository({
-        type: 'sqlite',
-        database: ':memory:',
-        synchronize: true,
-        dropSchema: true,
-      }),
-      resources: [
-        defineResource({
-          entity: PetEntity,
-          hooks: [OwnerStampHook.for(PetEntity), OwnerScopeHook.for(PetEntity)],
-        }),
-      ],
+const repository = defineTypeOrmRepository({
+  type: 'sqlite',
+  database: ':memory:',
+  synchronize: true,
+  dropSchema: true,
+});
+
+export const server = createServer({
+  auth: jwtAuth,
+  userMetadata: {
+    entity: UserMetadataEntity,
+    createDto: UserMetadataCreateDto,
+    updateDto: UserMetadataUpdateDto,
+  },
+  repository,
+  resources: [
+    defineResource({
+      entity: PetEntity,
+      hooks: [OwnerStampHook.for(PetEntity), OwnerScopeHook.for(PetEntity)],
     }),
   ],
-})
-export class AppModule {}
+});
+
+const app = await NestFactory.create(server);
+await app.listen(3000);
 ```
 
 Run it:
@@ -486,20 +471,15 @@ Install the same packages as above plus `@concepta/rockets-auth` and the upstrea
 `@concepta/nestjs-*` line (most are transitive dependencies; `yarn install` will
 pull them).
 
-Compose with `defineRocketsAuth()`. Reuse the same `defineTypeOrmRepository`
-helper from path A and pass the **same instance** to both
-`defineRocketsAuth({ persistence: { module: repo } })` and
-`RocketsModule.forRoot({ repository: repo })`. Register auth persistence rows
-via `buildRocketsAuthResources()` on `resources`:
+Compose with `defineRocketsAuth()`. Give it the TypeORM bootstrap once; the
+integration contributes its auth rows, root repository, metadata contract, and
+guard preference to the surrounding server:
 
 ```typescript
 import { Module } from '@nestjs/common';
-import {
-  defineRocketsAuth,
-  buildRocketsAuthResources,
-} from '@concepta/rockets-auth';
+import { defineRocketsAuth } from '@concepta/rockets-auth';
 import { RocketsModule } from '@concepta/rockets';
-import { defineTypeOrmRepository } from './repository/define-typeorm-repository';
+import { defineTypeOrmRepository } from '@concepta/rockets-repository-typeorm';
 
 const repo = defineTypeOrmRepository({
   type: 'sqlite',
@@ -542,18 +522,11 @@ const rocketsAuthInput = {
   }),
 };
 
-const rocketsAuth = defineRocketsAuth(rocketsAuthInput);
-const rocketsAuthResources = buildRocketsAuthResources(
-  rocketsAuthInput.persistence,
-  rocketsAuthInput.invitationEntity,
-);
-
 @Module({
   imports: [
     RocketsModule.forRoot({
-      auth: rocketsAuth,
-      repository: repo,
-      resources: [...rocketsAuthResources /* your defineResource bundles */],
+      auth: defineRocketsAuth(rocketsAuthInput),
+      resources: [/* your application defineResource bundles */],
     }),
   ],
 })
@@ -575,16 +548,17 @@ The monorepo ships runnable sample apps for both paths (`yarn sample:dev` and
 
 `auth` accepts a single `AuthBootstrap` or an array. Each entry is one of:
 
-- `defineFirebaseAuth({ forRoot | forRootAsync })` — Firebase Admin +
+- `defineFirebaseAuth({ firebaseApp })` or the explicit `{ forRootAsync }`
+  variant — Firebase Admin +
   `FirebaseAuthAdapter` (`@concepta/rockets-adapter-firebase`).
-- `defineRocketsAuth(...)` — built-in signup/login stack
-  (`@concepta/rockets-auth`); pair with `buildRocketsAuthResources()` on
-  `resources`.
-- App-local `AuthBootstrap` — `{ adapter, forRoot? }` for custom adapters (see
+- `defineRocketsAuth(...)` — complete built-in signup/login stack and its owned
+  persistence contributions (`@concepta/rockets-auth`).
+- `defineAuthAdapter(Adapter, options?)` — complete host wiring for a custom
+  adapter (see
   `defineApiKeyAuth()` in sample-code-review).
 
-Entity rows for auth-owned tables belong on `resources[]`, not inside the auth
-helper.
+Explicit server options override integration-contributed defaults. Conflicting
+defaults from two integrations fail at startup instead of depending on order.
 
 ```typescript
 import { defineFirebaseAuth } from '@concepta/rockets-adapter-firebase';
@@ -668,11 +642,10 @@ the caller owns the parent via `PathScopeGuard`.
 
 ### Wire TypeORM without hand-registering entities
 
-Use a small app-local `defineTypeOrmRepository` helper (full sample in **Path
-A** above). It implements `RepositoryBootstrap` from `@concepta/rockets-core`
-and wraps `TypeOrmRepositoryModule` from `@concepta/rockets-repository-typeorm`;
-only the helper (your connection options) lives in the app, so core never takes
-a TypeORM dependency. Firestore-only apps skip it and use
+Import `defineTypeOrmRepository` from
+`@concepta/rockets-repository-typeorm`. It implements `RepositoryBootstrap`
+and keeps TypeORM connection concerns in the adapter package while core stays
+storage-agnostic. Firestore-only apps skip it and use
 `@concepta/rockets-repository-firestore` instead.
 
 #### What you declare vs what the framework registers
@@ -737,8 +710,8 @@ No `TypeOrmModule.forFeature([PetEntity])` in feature modules. No
 `@InjectRepository`. If the entity is in the registration plan,
 `@InjectDynamicRepository` resolves at runtime.
 
-**Built-in auth (path B):** pass the **same** `repository` instance to both
-entry points so one connection serves app tables and auth tables:
+**Built-in auth (path B):** pass the repository to `defineRocketsAuth`; its
+composition contribution makes the same connection serve app and auth tables:
 
 ```typescript
 const repository = defineTypeOrmRepository({
@@ -758,7 +731,6 @@ const rocketsAuth = defineRocketsAuth({
 @Module({
   imports: [
     RocketsModule.forRoot({
-      repository,
       auth: rocketsAuth,
       resources: [
         /* pet resources — no per-resource persistence block */
@@ -956,20 +928,20 @@ it: one `RocketsModule.forRoot({ ... })` object is split by
 | `@concepta/nestjs-crud`                                                                         | `@concepta/rockets-core` (re-export)                            | Generated controllers, CQRS commands/queries, default handlers        |
 | `@concepta/nestjs-core`, `@concepta/nestjs-authentication`                                      | `@concepta/rockets-core`                                        | Hook resolution (`CoreModule`), shared exceptions, auth primitives    |
 | `@concepta/nestjs-access-control`                                                               | opt-in `accessControl` option (import symbols from upstream)   | Grant table, `AccessControlGuard`, route decorators                   |
-| `@concepta/nestjs-repository-typeorm`                                                           | `@concepta/rockets-repository-typeorm` (thin wrapper) + app-local bootstrap | SQL adapter — `@concepta/rockets-repository-typeorm`'s main entry re-exports the upstream package verbatim; wrapped by `defineTypeOrmRepository` |
+| `@concepta/nestjs-repository-typeorm`                                                           | `@concepta/rockets-repository-typeorm`                         | SQL adapter plus `defineTypeOrmRepository`, which supplies connection options and accepts the planner-derived entity list |
 | `@concepta/nestjs-user`, `role`, `otp`, `password`, `invitation`, `federated`, `email`, `event` | wired inside `@concepta/rockets-auth`                           | Built-in auth HTTP + persistence rows (path B only)                   |
 
 | Rockets layer               | Role                                                                                                                               |
 | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
 | `@concepta/rockets-core`     | **Planner and contracts**: `defineResource`, `buildAppRegistrationPlan`, `AuthServerGuard`, owner/path hooks, swagger registration |
 | `@concepta/rockets` (server) | **External-auth presentation**: `MeController`, default `APP_GUARD`, `auth` chain merge                                            |
-| `@concepta/rockets-auth`     | **Built-in identity bundle**: `defineRocketsAuth()` + `buildRocketsAuthResources()`                                                |
+| `@concepta/rockets-auth`     | **Built-in identity bundle**: `defineRocketsAuth()` with owned composition contributions                                          |
 
 **Path B uses both** `@concepta/rockets` and `@concepta/rockets-auth`:
-`defineRocketsAuth()` supplies the auth bootstrap; spread
-`buildRocketsAuthResources()` into `resources`;
-`RocketsModule.forRoot({ auth, repository, resources })` still comes from the
-server package. They are sibling packages over core, not parent/child.
+`defineRocketsAuth()` supplies the auth bootstrap plus its persistence,
+metadata, and guard defaults; `createServer({ auth, resources })` (or the
+lower-level `RocketsModule.forRoot`) still comes from the server package. They
+are sibling packages over core, not parent/child.
 
 **Repository injection (upstream contract, Rockets-local decorator):**
 
@@ -995,7 +967,7 @@ configuration façade** — not a fork.
 | **Core re-exports (former `@concepta/rockets-common`)** | `@concepta/rockets-common` was deleted; its helpers (`AuthUser`, `InjectDynamicRepository`, `SwaggerUiModule`, `deriveEntityKey`, …) and upstream re-exports now live inside `@concepta/rockets-core`. This is **not** a replacement for the upstream **app-module** composition pattern — that wiring still lives in Concepta; Rockets adds a **second** entry point (`RocketsModule.forRoot`) that feeds the same motors. |
 | **Port backlog (server path)**  | On v8 today: `core`, `repository`, `crud`, `hook`, `common`, `authentication`, `access-control`. Still on v7 in this monorepo: `swagger-ui` (and `email` / `event` on the auth path) — version-mismatched intentionally and tested in CI.                                                                                                                                                                          |
 | **Repo migration**              | Moving all of `nestjs-modules` into this git repo is **optional** for product validation. Shipping fixes against published `@concepta/*` alphas is fine; monorepo colocation is for AI context and version lock, not a prerequisite to use Rockets.                                                                                                                                             |
-| **Safe to keep building on**    | These are intentional, tested surfaces — not throwaway experiments: `AuthAdapterInterface.authenticate`, `RepositoryInterface` + dynamic repository keys (class **or** string token), `defineResource` / planner-driven entity registration, `defineRocketsAuth({ persistence: { module } })` sharing one `repository` instance with `RocketsModule.forRoot`.                                   |
+| **Safe to keep building on**    | These are intentional, tested surfaces — not throwaway experiments: `createServer`, `AuthAdapterInterface.authenticate`, `RepositoryInterface` + dynamic repository keys (class **or** string token), `defineResource` / planner-driven entity registration, and complete `defineRocketsAuth({ persistence })` contributions.                                   |
 
 **Custom validation / business rules:** use `defineHook` from
 `@concepta/rockets-core` for simple entity lifecycle rules, upstream
@@ -1008,12 +980,12 @@ to 4xx — a bare `Error` in a hook often surfaces as 500.
 
 | Package                                 | npm name                                | Purpose                                                                                                                                                                                                                            | Docs                                                      | Status  |
 | --------------------------------------- | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------- | ------- |
-| `packages/rockets-core`                 | `@concepta/rockets-core`                 | Composition planner. Auth chain, `buildAppRegistrationPlan`, `defineResource` / `defineModuleResource` / `defineSubResource`, `defineHook`, owner/path hooks, swagger registration, shared helpers, zod layer at `@concepta/rockets-core/zod`, opt-in `accessControl`. | [README](packages/rockets-core/README.md)                 | stable  |
-| `packages/rockets-repository-typeorm`   | `@concepta/rockets-repository-typeorm`   | TypeORM adapter for the dynamic repository contract — a thin wrapper whose main entry re-exports upstream `@concepta/nestjs-repository-typeorm` verbatim, plus the zod `SchemaEntityCompiler` at `@concepta/rockets-repository-typeorm/zod`.                              | [README](packages/rockets-repository-typeorm/README.md)   | stable  |
+| `packages/rockets-core`                 | `@concepta/rockets-core`                 | Composition planner. Auth chain, `buildAppRegistrationPlan`, `defineResource` / `defineModuleResource` / `defineSubResource`, `defineHook`, owner/path hooks, swagger registration, shared helpers, zod layer at `@concepta/rockets-core/zod`, opt-in `accessControl`. | [README](packages/rockets-core/README.md)                 | preview |
+| `packages/rockets-repository-typeorm`   | `@concepta/rockets-repository-typeorm`   | TypeORM adapter and `defineTypeOrmRepository` bootstrap for planner-derived entity registration, plus the zod `SchemaEntityCompiler` at `@concepta/rockets-repository-typeorm/zod`.                                                                                   | [README](packages/rockets-repository-typeorm/README.md)   | preview |
 | `packages/rockets-repository-firestore` | `@concepta/rockets-repository-firestore` | Firestore adapter implementing `RepositoryAdapter`. Per-entity opt-in.                                                                                                                                                             | [README](packages/rockets-repository-firestore/README.md) | preview |
 | `packages/rockets-adapter-firebase`     | `@concepta/rockets-adapter-firebase`     | Firebase Auth adapter implementing `AuthAdapterInterface`.                                                                                                                                                                         | [README](packages/rockets-adapter-firebase/README.md)     | preview |
-| `packages/rockets-server`               | `@concepta/rockets`                      | External-auth presentation layer. `MeController`, `APP_GUARD` opt-in, `auth` chain.                                                                                                                                                | [README](packages/rockets-server/README.md)               | stable  |
-| `packages/rockets-server-auth`          | `@concepta/rockets-auth`                 | Built-in auth: signup, login, OTP, recovery, invitations, roles, admin user CRUD. `defineRocketsAuth()`.                                                                                                                           | [README](packages/rockets-server-auth/README.md)          | alpha   |
+| `packages/rockets-server`               | `@concepta/rockets`                      | Launch-facing `createServer`, external-auth presentation, optional `/me`, default guard, and auth chain.                                                                                                                            | [README](packages/rockets-server/README.md)               | preview |
+| `packages/rockets-server-auth`          | `@concepta/rockets-auth`                 | Built-in auth: signup, login, recovery, OTP, invitations, roles, throttling, and admin user CRUD.                                                                                                                                   | [README](packages/rockets-server-auth/README.md)          | preview |
 
 ### Repository layout
 
@@ -1035,8 +1007,9 @@ rockets/
 - **Rockets packages**: `0.0.1-dev.0` on npm
   (`yarn add @concepta/rockets@alpha`, or pin `0.0.1-dev.0`). Monorepo packages
   keep `workspace:^` for local development.
-- **Upstream Concepta packages**: v8 line at `8.0.0-alpha.7` (`nestjs-common` /
-  `nestjs-hook` at `8.0.0-alpha.6`). Two modules still on v7
+- **Upstream Concepta packages**: v8 modules are pinned to `8.0.0-alpha.8`;
+  `@concepta/nestjs-common` remains at its latest published v8 build,
+  `8.0.0-alpha.6`. Two modules remain on v7
   (`@concepta/nestjs-email`, `@concepta/nestjs-event`) pending the v8 port.
   Swagger UI ships from `@concepta/rockets-core`. Auth persistence entities are
   app-owned TypeORM classes — do not use `@concepta/nestjs-typeorm-ext`.
@@ -1044,13 +1017,14 @@ rockets/
   `testing`); satellite packages (`cqrs`, `typeorm`, `jwt`, `passport`,
   `config`, `throttler`) remain on their current stable majors until a Nest 12
   line is published.
-- **Node**: `>=18.0.0`.
+- **Node**: `>=20.0.0` (the minimum supported by NestJS 12).
 
 ### Common scripts (from the monorepo root)
 
 | Command                       | Purpose                                                                                                    |
 | ----------------------------- | ---------------------------------------------------------------------------------------------------------- |
-| `yarn publish:conceptadev`    | Build + publish all `@concepta/*` packages to npm (`--tag alpha`).                                      |
+| `yarn release:check`          | Run the complete build, package, type, lint, unit, e2e, and sample release gate.                           |
+| `yarn release:dry`            | Build publish archives for every public `@concepta/*` workspace without publishing.                       |
 | `yarn install && yarn build`  | Bootstrap + compile every local `@concepta/*` package.                                                      |
 | `yarn test`                   | Unit tests (Vitest).                                                                                       |
 | `yarn typecheck:spec`         | Type-checks test files — the runner only transpiles them.                                                  |
@@ -1060,7 +1034,6 @@ rockets/
 | `yarn sample:dev`             | Run `sample-server` in watch mode.                                                                         |
 | `yarn sample-auth:dev`        | Run `sample-server-auth` in watch mode.                                                                    |
 | `yarn sample-code-review:dev` | Build + run the full-stack example.                                                                        |
-| `yarn generate-swagger`       | Dump the OpenAPI spec from `sample-server-auth`.                                                           |
 
 ---
 
diff --git a/examples/sample-code-review/README.md b/examples/sample-code-review/README.md
index 27973cd04..32c69f604 100644
--- a/examples/sample-code-review/README.md
+++ b/examples/sample-code-review/README.md
@@ -75,7 +75,7 @@ chain so server-to-server callers can authenticate with `X-Api-Key`.
 
 ### Prerequisites
 
-- Node 18+, Yarn 4.
+- Node 20+, Yarn 4.
 - A Firebase project for real auth (or `FIREBASE_USE_FAKE=true` for
   in-process verification).
 - A GitHub OAuth App if you want the GitHub connect flow to work.
@@ -227,7 +227,7 @@ examples/sample-code-review
 │   │       ├── auth-firebase/                   defineFirebaseAuth wiring
 │   │       ├── auth-api-key/                    Second AuthBootstrap in the chain — ApiKeyEntity + POST /api-keys (mint) + adapter
 │   │       ├── github/                          GitHub OAuth + repo browse
-│   │       ├── repository/                      defineTypeOrmRepository + Firestore persistence helpers
+│   │       ├── repository/                      Firestore persistence helper
 │   │       ├── config/                          GithubConfig / OpenaiConfig (env-var readers)
 │   │       ├── zod-bindings.ts                   bindZodResources(typeOrmZodEntityCompiler)
 │   │       ├── user-metadata.schema.ts           zod schema -> { entity, createDto, updateDto, responseDto }
diff --git a/examples/sample-code-review/apps/api/package.json b/examples/sample-code-review/apps/api/package.json
index 5ac77ea54..fa819b786 100644
--- a/examples/sample-code-review/apps/api/package.json
+++ b/examples/sample-code-review/apps/api/package.json
@@ -10,8 +10,8 @@
     "type-check": "tsc --noEmit -p tsconfig.json",
     "lint": "echo \"lint: configure eslint when needed\"",
     "clean": "rm -rf dist",
-    "test:e2e": "vitest run --config vitest.e2e.config.ts",
-    "test:e2e:auth": "vitest run --config vitest.e2e.config.ts test/auth-connection.e2e-spec.ts"
+    "test:e2e": "vitest run --config vitest.e2e.config.mts",
+    "test:e2e:auth": "vitest run --config vitest.e2e.config.mts test/auth-connection.e2e-spec.ts"
   },
   "dependencies": {
     "@concepta/nestjs-core": "8.0.0-alpha.8",
@@ -43,7 +43,7 @@
     "@nestjs/cli": "12.0.0-alpha.6",
     "@nestjs/testing": "12.0.0-alpha.5",
     "@swc/core": "^1.15.47",
-    "@types/node": "^18.19.44",
+    "@types/node": "^20.19.0",
     "@types/supertest": "^6.0.2",
     "supertest": "^6.3.4",
     "ts-node": "^10.9.2",
diff --git a/examples/sample-code-review/apps/api/src/app.module.ts b/examples/sample-code-review/apps/api/src/app.module.ts
index 402d0c5e6..f207213ca 100644
--- a/examples/sample-code-review/apps/api/src/app.module.ts
+++ b/examples/sample-code-review/apps/api/src/app.module.ts
@@ -1,6 +1,7 @@
 import { Module } from '@nestjs/common';
 import { ConfigModule } from '@nestjs/config';
 import { RocketsModule } from '@concepta/rockets';
+import { defineTypeOrmRepository } from '@concepta/rockets-repository-typeorm';
 import { defineFirebaseAuth } from '@concepta/rockets-adapter-firebase';
 import { defineModuleResource } from '@concepta/rockets-core';
 import { createFirebaseAdminApp } from './auth-firebase';
@@ -13,7 +14,6 @@ import {
   UserMetadataCreateDto,
   UserMetadataUpdateDto,
 } from './user-metadata.schema';
-import { defineTypeOrmRepository } from './repository/define-typeorm-repository';
 import { githubFeature } from './github';
 import { analysisFeature } from './analysis';
 
diff --git a/examples/sample-code-review/apps/api/src/auth-api-key/define-api-key-auth.ts b/examples/sample-code-review/apps/api/src/auth-api-key/define-api-key-auth.ts
index 6188de25d..c05fc54c1 100644
--- a/examples/sample-code-review/apps/api/src/auth-api-key/define-api-key-auth.ts
+++ b/examples/sample-code-review/apps/api/src/auth-api-key/define-api-key-auth.ts
@@ -1,4 +1,4 @@
-import { defineModuleResource } from '@concepta/rockets-core';
+import { defineAuthAdapter, defineModuleResource } from '@concepta/rockets-core';
 import type { AuthBootstrap } from '@concepta/rockets-core';
 import { ApiKeyAuthAdapter } from './api-key.adapter';
 import { ApiKeyController } from './api-key.controller';
@@ -12,13 +12,7 @@ export const apiKeyAuthResource = defineModuleResource({
  * API key auth chain entry. Pair with `apiKeyAuthResource` in `resources[]`.
  */
 export function defineApiKeyAuth(): AuthBootstrap<ApiKeyAuthAdapter> {
-  return {
-    adapter: ApiKeyAuthAdapter,
-    forRoot: () => ({
-      module: class ApiKeyAuthHostModule {},
-      providers: [ApiKeyAuthAdapter],
-      controllers: [ApiKeyController],
-      exports: [ApiKeyAuthAdapter],
-    }),
-  };
+  return defineAuthAdapter(ApiKeyAuthAdapter, {
+    controllers: [ApiKeyController],
+  });
 }
diff --git a/examples/sample-code-review/apps/api/src/repository/define-typeorm-repository.ts b/examples/sample-code-review/apps/api/src/repository/define-typeorm-repository.ts
deleted file mode 100644
index 38fed55b7..000000000
--- a/examples/sample-code-review/apps/api/src/repository/define-typeorm-repository.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-import type { DynamicModule, PlainLiteralObject, Type } from '@nestjs/common';
-import { TypeOrmModule, TypeOrmModuleOptions } from '@nestjs/typeorm';
-import { TypeOrmRepositoryModule } from '@concepta/rockets-repository-typeorm';
-import type { RepositoryBootstrap } from '@concepta/rockets-core';
-import type {
-  DynamicRepositoryModule,
-  RepositoryProviderOptions,
-} from '@concepta/nestjs-repository';
-
-export function defineTypeOrmRepository<Connection extends TypeOrmModuleOptions>(
-  connection: Connection,
-): RepositoryBootstrap {
-  return {
-    name: 'typeorm-bootstrap',
-    forFeature(entities: RepositoryProviderOptions[]): DynamicRepositoryModule {
-      return TypeOrmRepositoryModule.forFeature(entities);
-    },
-    forRoot(
-      entities: ReadonlyArray<Type<PlainLiteralObject>>,
-    ): DynamicModule {
-      return TypeOrmModule.forRoot({
-        ...connection,
-        entities: [...entities],
-      });
-    },
-  };
-}
diff --git a/examples/sample-code-review/apps/api/vitest.e2e.config.ts b/examples/sample-code-review/apps/api/vitest.e2e.config.mts
similarity index 84%
rename from examples/sample-code-review/apps/api/vitest.e2e.config.ts
rename to examples/sample-code-review/apps/api/vitest.e2e.config.mts
index 65de1ad8a..8a78e0004 100644
--- a/examples/sample-code-review/apps/api/vitest.e2e.config.ts
+++ b/examples/sample-code-review/apps/api/vitest.e2e.config.mts
@@ -1,10 +1,11 @@
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { defineProject, mergeConfig } from 'vitest/config';
-import shared from '../../../../vitest.shared';
+import shared from '../../../../vitest.shared.mts';
 
 /**
  * E2E project for the sample-code-review API — registered in the root
- * `vitest.config.ts` `projects` list and runnable standalone via
+ * `vitest.config.mts` `projects` list and runnable standalone via
  * `--config` from the workspace. The Jest `moduleNameMapper` stub swap (real
  * Firestore persistence -> in-memory backend stub) is ported as a regex
  * alias below.
@@ -20,7 +21,7 @@ export default mergeConfig(
         // moduleNameMapper).
         find: /^\.\.\/repository\/code-review-reports\.persistence$/,
         replacement: path.resolve(
-          __dirname,
+          path.dirname(fileURLToPath(import.meta.url)),
           'test/stubs/code-review-reports.persistence.stub.ts',
         ),
       },
diff --git a/examples/sample-server-auth/README.md b/examples/sample-server-auth/README.md
index 6640f9ed8..8ee4feff5 100644
--- a/examples/sample-server-auth/README.md
+++ b/examples/sample-server-auth/README.md
@@ -103,11 +103,11 @@ authenticated as an admin.
 
 The three roles in `src/app.acl.ts`:
 
-| Role | Pet / Vaccination / Appointment |
-|---|---|
-| `admin` | `createAny`, `readAny`, `updateAny`, `deleteAny` |
-| `manager` | `createAny`, `readAny`, `updateAny` (no delete) |
-| `user` | `createOwn`, `readOwn`, `updateOwn`, `deleteOwn` (ownership-checked by `PetAccessQueryService`) |
+| Role      | Pet / Vaccination / Appointment                                                                 |
+| --------- | ----------------------------------------------------------------------------------------------- |
+| `admin`   | `createAny`, `readAny`, `updateAny`, `deleteAny`                                                |
+| `manager` | `createAny`, `readAny`, `updateAny` (no delete)                                                 |
+| `user`    | `createOwn`, `readOwn`, `updateOwn`, `deleteOwn` (ownership-checked by `PetAccessQueryService`) |
 
 The `PetAccessQueryService.canAccess()` runs **after** the grant table
 matches — it refines `:own` rules by comparing `pet.userId` to the
@@ -169,7 +169,6 @@ examples/sample-server-auth
 │   ├── app.acl.ts                   Role + resource enums + accesscontrol grants
 │   ├── access-control.service.ts    AccessControlServiceInterface impl
 │   ├── main.ts                      Bootstrap (helmet, validation, swagger)
-│   ├── repository/                  defineTypeOrmRepository bootstrap (shared with defineRocketsAuth)
 │   ├── shared/persistence/          AuditedSqliteEntity (app-owned audit columns)
 │   ├── modules/
 │   │   ├── user/                    UserEntity + credential / otp / role-link entities + DTOs
@@ -181,36 +180,37 @@ examples/sample-server-auth
 
 ### Auth surface (exposed by the bundle)
 
-| Route | Purpose |
-|---|---|
-| `POST /signup` | New user signup. Wired through `userCrud`. |
-| `POST /token/password` | Login (username + password → access + refresh token). |
-| `POST /token/refresh` | Refresh the access token. |
-| `GET /me`, `PATCH /me` | From `@concepta/rockets`. |
-| `PATCH /me/password` | Password change. |
-| `POST /otp`, `PATCH /otp` | OTP issue / verify. |
-| `POST /recovery/*` | Password recovery flow (wired to notification handlers). |
-| `/admin/users`, `/admin/users/:userId/roles` | Admin user CRUD + role assignment. |
-| `/admin/roles` | Role CRUD (`roleCrud` config). |
-| `/admin/invitations`, `/invitation-acceptance`, … | Invitation flow. |
+| Route                                                                     | Purpose                                               |
+| ------------------------------------------------------------------------- | ----------------------------------------------------- |
+| `POST /signup`                                                            | New user signup. Wired through `userCrud`.            |
+| `POST /token/password`                                                    | Login (username + password → access + refresh token). |
+| `POST /token/refresh`                                                     | Refresh the access token.                             |
+| `GET /me`, `PATCH /me`                                                    | From `@concepta/rockets`.                             |
+| `PATCH /me/password`                                                      | Password change.                                      |
+| `POST /otp`, `PATCH /otp`                                                 | OTP issue / verify.                                   |
+| `POST /recovery/login`, `POST /recovery/password`                         | Enumeration-safe recovery initiation.                 |
+| `POST /recovery/passcode` with `{ passcode }`, `PATCH /recovery/password` | Passcode validation and password reset.               |
+| `/admin/users`, `/admin/users/:userId/roles`                              | Admin user CRUD + role assignment.                    |
+| `/admin/roles`                                                            | Role CRUD (`roleCrud` config).                        |
+| `/admin/invitations`, `/invitation-acceptance`, …                         | Invitation flow.                                      |
 
 ### Environment variables
 
-| Var | Default | Purpose |
-|---|---|---|
-| `ADMIN_EMAIL` | **required** | Email for the admin user seeded on every boot (`main.ts`). No default — the app exits if unset. |
-| `ADMIN_PASSWORD` | **required** | Password for the seeded admin user. No default — the app exits if unset. |
-| `PORT` | `3001` | HTTP port (`process.env.PORT \|\| 3001`). |
-| `ALLOWED_ORIGINS` | `*` | Comma-separated CORS allowlist. |
-| `SWAGGER_UI_PATH` | `api` | Swagger UI mount path. |
+| Var               | Default      | Purpose                                                                                         |
+| ----------------- | ------------ | ----------------------------------------------------------------------------------------------- |
+| `ADMIN_EMAIL`     | **required** | Email for the admin user seeded on every boot (`main.ts`). No default — the app exits if unset. |
+| `ADMIN_PASSWORD`  | **required** | Password for the seeded admin user. No default — the app exits if unset.                        |
+| `PORT`            | `3001`       | HTTP port (`process.env.PORT \|\| 3001`).                                                       |
+| `ALLOWED_ORIGINS` | `*`          | Comma-separated CORS allowlist.                                                                 |
+| `SWAGGER_UI_PATH` | `api`        | Swagger UI mount path.                                                                          |
 
 ### Persistence wiring
 
-A single `defineTypeOrmRepository({...})` bootstrap is shared by
-`RocketsModule.forRoot({ repository })` and `defineRocketsAuth({
-persistence: { module } })`. The planner derives the full entity list
-from `resources[]`, `userMetadata.entity`, and the auth
-`persistence.entities` map — there is no top-level
+A single `defineTypeOrmRepository({...})` bootstrap is passed to
+`defineRocketsAuth({ persistence: { module } })`. That integration contributes
+the root repository, auth resources, and metadata contract to
+`RocketsModule`. The planner derives the full entity list from app resources
+and the auth `persistence.entities` map — there is no top-level
 `TypeOrmModule.forRoot({ entities: [...] })` to keep in sync. Pet
 resources omit per-resource `persistence` so they inherit the root
 adapter.
diff --git a/examples/sample-server-auth/package.json b/examples/sample-server-auth/package.json
index 3cb358205..e8d2225bc 100644
--- a/examples/sample-server-auth/package.json
+++ b/examples/sample-server-auth/package.json
@@ -9,7 +9,7 @@
     "build": "cd ../.. && ./node_modules/.bin/tsc -p examples/sample-server-auth/tsconfig.json",
     "lint": "cd ../.. && eslint \"examples/sample-server-auth/{src,test}/**/*.{ts,js}\"",
     "pretest:e2e": "cd ../.. && yarn workspace @concepta/rockets build && yarn workspace @concepta/rockets-auth build && ./node_modules/.bin/tsc -p examples/sample-server-auth/tsconfig.json",
-    "test:e2e": "vitest run --config vitest.e2e.config.ts"
+    "test:e2e": "vitest run --config vitest.e2e.config.mts"
   },
   "dependencies": {
     "@concepta/nestjs-access-control": "8.0.0-alpha.8",
@@ -46,7 +46,7 @@
     "@nestjs/testing": "12.0.0-alpha.5",
     "@swc/core": "^1.15.47",
     "@types/jsonwebtoken": "^9.0.3",
-    "@types/node": "^18.19.44",
+    "@types/node": "^20.19.0",
     "@types/supertest": "^6.0.2",
     "supertest": "^6.3.4",
     "ts-node": "^10.9.2",
diff --git a/examples/sample-server-auth/src/app.module.ts b/examples/sample-server-auth/src/app.module.ts
index 72db99bcb..4ede232b5 100644
--- a/examples/sample-server-auth/src/app.module.ts
+++ b/examples/sample-server-auth/src/app.module.ts
@@ -1,12 +1,12 @@
 import { Global, Logger, Module } from '@nestjs/common';
 import { EventModule } from '@concepta/nestjs-event';
 import {
-  buildRocketsAuthResources,
   defineRocketsAuth,
   type DefineRocketsAuthInput,
   type EmailSendOptionsInterface,
 } from '@concepta/rockets-auth';
 import { RocketsModule } from '@concepta/rockets';
+import { defineTypeOrmRepository } from '@concepta/rockets-repository-typeorm';
 
 import { ACService } from './access-control.service';
 import { acRules } from './app.acl';
@@ -42,9 +42,8 @@ import {
 } from './modules/user';
 import { RoleEntity, RoleDto, RoleUpdateDto } from './modules/role';
 import { RoleCreateDto } from './modules/role/role.dto';
-import { defineTypeOrmRepository } from './repository/define-typeorm-repository';
 
-// Single TypeORM bootstrap shared by every persistence consumer below.
+// Single TypeORM bootstrap owned by the auth integration below.
 // `defineTypeOrmRepository` returns a `RepositoryBootstrap`, which the
 // planner uses for both:
 //   - `forRoot(planEntities)` — DB connection + the union of every
@@ -52,9 +51,8 @@ import { defineTypeOrmRepository } from './repository/define-typeorm-repository'
 //     `defineRocketsAuth({ persistence })`.
 //   - `forFeature(entities)` — one `DYNAMIC_REPOSITORY_TOKEN_<key>`
 //     provider per registered entity.
-// Reference equality matters: pass the SAME `repo` instance everywhere,
-// otherwise the planner splits the entity list across two adapters and
-// `TypeOrmModule.forRoot` boots with an incomplete entity set.
+// `defineRocketsAuth` contributes this same bootstrap to Rockets, so the host
+// does not need to repeat it in `RocketsModule.forRoot`.
 const repo = defineTypeOrmRepository({
   type: 'sqlite',
   database: ':memory:',
@@ -171,10 +169,6 @@ const rocketsAuthInput: DefineRocketsAuthInput = {
 };
 
 const rocketsAuth = defineRocketsAuth(rocketsAuthInput);
-const rocketsAuthResources = buildRocketsAuthResources(
-  rocketsAuthInput.persistence,
-  rocketsAuthInput.invitationEntity,
-);
 
 @Global()
 @Module({
@@ -183,11 +177,7 @@ const rocketsAuthResources = buildRocketsAuthResources(
     PetModule,
     RocketsModule.forRoot({
       auth: rocketsAuth,
-      userMetadata: rocketsAuthInput.userMetadata,
-      enableGlobalGuard: false,
-      repository: repo,
       resources: [
-        ...rocketsAuthResources,
         createPetResource(),
         createPetVaccinationResource(),
         createPetAppointmentResource(),
diff --git a/examples/sample-server-auth/src/main.ts b/examples/sample-server-auth/src/main.ts
index 112c80515..bb83fa61a 100644
--- a/examples/sample-server-auth/src/main.ts
+++ b/examples/sample-server-auth/src/main.ts
@@ -25,7 +25,7 @@ import { SwaggerUiService } from '@concepta/rockets-core';
 
 // v8 commands/queries call `AppContextHost.from(ctx)` which only accepts
 // an `AppContextHost`, `null`, `undefined`, or an empty object `{}`.
-// The previous `createRepositoryContext(KEY)` produced `{ entity: KEY }`
+// Repository calls receive the request AppContextHost
 // which now throws `Expected AppContextHost or nullish value, got object`.
 // rockets-server-auth's internal handlers pass `{}` — match that.
 const emptyCtx = {};
diff --git a/examples/sample-server-auth/src/repository/define-typeorm-repository.ts b/examples/sample-server-auth/src/repository/define-typeorm-repository.ts
deleted file mode 100644
index 4cbb1cc9c..000000000
--- a/examples/sample-server-auth/src/repository/define-typeorm-repository.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-import type { DynamicModule, PlainLiteralObject, Type } from '@nestjs/common';
-import { TypeOrmModule, TypeOrmModuleOptions } from '@nestjs/typeorm';
-import { TypeOrmRepositoryModule } from '@concepta/rockets-repository-typeorm';
-import type { RepositoryBootstrap } from '@concepta/rockets-core';
-import type {
-  DynamicRepositoryModule,
-  RepositoryProviderOptions,
-} from '@concepta/nestjs-repository';
-
-/**
- * Returns a `RepositoryBootstrap` that:
- * - Forwards `forFeature(entities)` to upstream `TypeOrmRepositoryModule`.
- * - Implements `forRoot(entities)` by wrapping `TypeOrmModule.forRoot`
- *   with the connection options the caller passed in plus the entity set
- *   the Rockets planner derived from `resources[]`, `userMetadata`, and
- *   `defineRocketsAuth({ persistence })`.
- *
- * Pass the SAME instance to every persistence consumer in the app:
- *  - `RocketsModule.forRoot({ repository: repo })` (root adapter)
- *  - `defineRocketsAuth({ persistence: { module: repo } })`
- *
- * The planner uses reference equality to group entities per adapter and
- * to decide whether to call `forRoot`. Splitting `repo` into two
- * distinct objects would split the entity list and break the connection.
- *
- * Identical to the helper in `examples/sample-server` — duplicated here so
- * each sample app boots without depending on the other's source tree.
- *
- */
-export function defineTypeOrmRepository<
-  Connection extends TypeOrmModuleOptions,
->(connection: Connection): RepositoryBootstrap {
-  return {
-    name: 'typeorm-bootstrap',
-
-    forFeature(entities: RepositoryProviderOptions[]): DynamicRepositoryModule {
-      return TypeOrmRepositoryModule.forFeature(entities);
-    },
-
-    forRoot(entities: ReadonlyArray<Type<PlainLiteralObject>>): DynamicModule {
-      return TypeOrmModule.forRoot({
-        ...connection,
-        entities: [...entities],
-      });
-    },
-  };
-}
diff --git a/examples/sample-server-auth/test/role-based-access.e2e-spec.ts b/examples/sample-server-auth/test/role-based-access.e2e-spec.ts
index cb596690e..5a15059cc 100644
--- a/examples/sample-server-auth/test/role-based-access.e2e-spec.ts
+++ b/examples/sample-server-auth/test/role-based-access.e2e-spec.ts
@@ -19,7 +19,7 @@ import {
 import { acRules } from '../src/app.acl';
 
 // `AppContextHost.from()` only accepts `AppContextHost | null | undefined | {}`.
-// `createRepositoryContext({entity: ...})` returns a non-empty plain object,
+// Request contexts are AppContextHost instances,
 // which the upstream context validator rejects with "Expected AppContextHost
 // or nullish value, got object". The command signatures type `ctx` as
 // `PlainLiteralObject`, so pass `{}` — `AppContextHost.from({})` yields the
diff --git a/examples/sample-server-auth/vitest.e2e.config.ts b/examples/sample-server-auth/vitest.e2e.config.mts
similarity index 87%
rename from examples/sample-server-auth/vitest.e2e.config.ts
rename to examples/sample-server-auth/vitest.e2e.config.mts
index 69e67b0f9..5acaa6214 100644
--- a/examples/sample-server-auth/vitest.e2e.config.ts
+++ b/examples/sample-server-auth/vitest.e2e.config.mts
@@ -1,9 +1,9 @@
 import { defineProject, mergeConfig } from 'vitest/config';
-import shared from '../../vitest.shared';
+import shared from '../../vitest.shared.mts';
 
 /**
  * E2E project for the sample-server-auth example — registered in the root
- * `vitest.config.ts` `projects` list and runnable standalone via
+ * `vitest.config.mts` `projects` list and runnable standalone via
  * `--config` from the workspace. The former Jest `moduleNameMapper`
  * entries are not ported: workspace packages (`@concepta/*`) resolve to their built `dist`
  * through normal node resolution, and the `@nestjs/*` / `@concepta/*` /
diff --git a/examples/sample-server/README.md b/examples/sample-server/README.md
index d01a3c961..4d12fc3e4 100644
--- a/examples/sample-server/README.md
+++ b/examples/sample-server/README.md
@@ -139,7 +139,6 @@ Handwritten entity + DTO path still demonstrated in `pet-vaccination/` for compa
 examples/sample-server
 ├── src/
 │   ├── auth/                       AuthBootstrap + JWT signup/login
-│   ├── repository/                 defineTypeOrmRepository bootstrap
 │   ├── zod-bindings.ts             bindZodResources(typeOrmZodEntityCompiler)
 │   ├── user-metadata.schema.ts     zod schema -> { entity, createDto, updateDto, responseDto }
 │   ├── resources/                  CRUD + sub-resource + module bundles
diff --git a/examples/sample-server/package.json b/examples/sample-server/package.json
index c6a6ce8fd..24b021c1f 100644
--- a/examples/sample-server/package.json
+++ b/examples/sample-server/package.json
@@ -7,7 +7,7 @@
     "start:dev": "nest start --watch",
     "start:debug": "nest start --debug --watch",
     "build": "tsc -p tsconfig.json",
-    "test:e2e": "vitest run --config vitest.e2e.config.ts"
+    "test:e2e": "vitest run --config vitest.e2e.config.mts"
   },
   "dependencies": {
     "@concepta/nestjs-core": "8.0.0-alpha.8",
@@ -39,7 +39,7 @@
     "@nestjs/testing": "12.0.0-alpha.5",
     "@swc/core": "^1.15.47",
     "@types/jsonwebtoken": "^9.0.3",
-    "@types/node": "^18.19.44",
+    "@types/node": "^20.19.0",
     "@types/supertest": "^6.0.2",
     "supertest": "^6.3.4",
     "ts-loader": "^9.5.1",
diff --git a/examples/sample-server/src/app.module.ts b/examples/sample-server/src/app.module.ts
index 494fb5d90..6b907411f 100644
--- a/examples/sample-server/src/app.module.ts
+++ b/examples/sample-server/src/app.module.ts
@@ -1,8 +1,8 @@
 import { Module } from '@nestjs/common';
-import { RocketsModule } from '@concepta/rockets';
+import { createServer } from '@concepta/rockets';
+import { defineTypeOrmRepository } from '@concepta/rockets-repository-typeorm';
 import { userMetadataConfig } from './user-metadata.schema';
 import { defineSampleAuth, sampleAuthUserResource } from './auth';
-import { defineTypeOrmRepository } from './repository/define-typeorm-repository';
 import { petResource } from './resources/pet';
 import { petVaccinationResource } from './resources/pet-vaccination';
 // `/tags` is fully zod-driven (nestjs-zod DTOs + generated entity from
@@ -26,33 +26,33 @@ import { adminFeature } from './admin';
 import { auditFeature } from './audit';
 import { eventsFeature } from './events';
 
-@Module({
-  imports: [
-    RocketsModule.forRoot({
-      auth: defineSampleAuth(),
-      userMetadata: userMetadataConfig,
-      repository: defineTypeOrmRepository({
-        type: 'sqlite',
-        database: ':memory:',
-        synchronize: true,
-        dropSchema: true,
-      }),
-      resources: [
-        sampleAuthUserResource,
-        petResource,
-        petVaccinationResource,
-        tagZodResource,
-        authorZodResource,
-        bookZodResource,
-        appointmentResource,
-        reminderZodResource,
-        petShareFeature,
-        petTransferFeature,
-        adminFeature,
-        auditFeature,
-        eventsFeature,
-      ],
-    }),
+export const server = createServer({
+  auth: defineSampleAuth(),
+  userMetadata: userMetadataConfig,
+  repository: defineTypeOrmRepository({
+    type: 'sqlite',
+    database: ':memory:',
+    synchronize: true,
+    dropSchema: true,
+  }),
+  resources: [
+    sampleAuthUserResource,
+    petResource,
+    petVaccinationResource,
+    tagZodResource,
+    authorZodResource,
+    bookZodResource,
+    appointmentResource,
+    reminderZodResource,
+    petShareFeature,
+    petTransferFeature,
+    adminFeature,
+    auditFeature,
+    eventsFeature,
   ],
+});
+
+@Module({
+  imports: [server],
 })
 export class AppModule {}
diff --git a/examples/sample-server/src/auth/define-sample-auth.ts b/examples/sample-server/src/auth/define-sample-auth.ts
index f8f5bc18c..25921639d 100644
--- a/examples/sample-server/src/auth/define-sample-auth.ts
+++ b/examples/sample-server/src/auth/define-sample-auth.ts
@@ -1,5 +1,5 @@
 import type { AuthBootstrap } from '@concepta/rockets-core';
-import { defineModuleResource } from '@concepta/rockets-core';
+import { defineAuthAdapter, defineModuleResource } from '@concepta/rockets-core';
 import { UserEntity } from './user.entity';
 import { AuthController } from './auth.controller';
 import { SampleAuthAdapter } from './auth.adapter';
@@ -14,13 +14,7 @@ export const sampleAuthUserResource = defineModuleResource({
  * `RocketsModule.forRoot({ resources: [...] })`.
  */
 export function defineSampleAuth(): AuthBootstrap<SampleAuthAdapter> {
-  return {
-    adapter: SampleAuthAdapter,
-    forRoot: () => ({
-      module: class SampleAuthHostModule {},
-      providers: [SampleAuthAdapter],
-      controllers: [AuthController],
-      exports: [SampleAuthAdapter],
-    }),
-  };
+  return defineAuthAdapter(SampleAuthAdapter, {
+    controllers: [AuthController],
+  });
 }
diff --git a/examples/sample-server/src/main.ts b/examples/sample-server/src/main.ts
index 82347c744..21d6c3973 100644
--- a/examples/sample-server/src/main.ts
+++ b/examples/sample-server/src/main.ts
@@ -3,7 +3,7 @@ import { HttpAdapterHost, NestFactory } from '@nestjs/core';
 import { StandardSchemaValidationPipe, ValidationPipe } from '@nestjs/common';
 import { SwaggerModule } from '@nestjs/swagger';
 import { cleanupOpenApiDoc } from 'nestjs-zod';
-import { AppModule } from './app.module';
+import { server } from './app.module';
 import { ExceptionsFilter } from '@concepta/rockets';
 
 import helmet from 'helmet';
@@ -12,7 +12,7 @@ import { patchMePatchOpenApi } from './swagger/patch-me-openapi';
 import { SwaggerUiService } from '@concepta/rockets-core';
 
 async function bootstrap() {
-  const app = await NestFactory.create(AppModule);
+  const app = await NestFactory.create(server);
 
   app.use(helmet());
   app.enableCors({
diff --git a/examples/sample-server/src/repository/define-typeorm-repository.ts b/examples/sample-server/src/repository/define-typeorm-repository.ts
deleted file mode 100644
index 196818d75..000000000
--- a/examples/sample-server/src/repository/define-typeorm-repository.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-import type { DynamicModule, PlainLiteralObject, Type } from '@nestjs/common';
-import { TypeOrmModule, TypeOrmModuleOptions } from '@nestjs/typeorm';
-import { TypeOrmRepositoryModule } from '@concepta/rockets-repository-typeorm';
-import type { RepositoryBootstrap } from '@concepta/rockets-core';
-import type {
-  DynamicRepositoryModule,
-  RepositoryProviderOptions,
-} from '@concepta/nestjs-repository';
-
-/**
- * Returns a `RepositoryBootstrap` that:
- * - Forwards `forFeature(entities)` to upstream `TypeOrmRepositoryModule`.
- * - Implements `forRoot(entities)` by wrapping `TypeOrmModule.forRoot`
- *   with the connection options the user passed in plus the entity set
- *   the Rockets registration plan derived from `resources[]` and
- *   `userMetadata`.
- *
- * The user passes one factory call to `RocketsModule.forRoot(...)`; the
- * connection and the per-entity registration come out of a single
- * source of truth. Any `entities` key on the supplied connection is
- * overridden with the registration plan's entity list.
- *
- * The `Connection` generic carries the concrete union member (e.g.
- * `SqliteConnectionOptions`) chosen at the callsite, preserving
- * driver-specific discrimination through the spread.
- */
-export function defineTypeOrmRepository<Connection extends TypeOrmModuleOptions>(
-  connection: Connection,
-): RepositoryBootstrap {
-  return {
-    name: 'typeorm-bootstrap',
-
-    forFeature(entities: RepositoryProviderOptions[]): DynamicRepositoryModule {
-      return TypeOrmRepositoryModule.forFeature(entities);
-    },
-
-    forRoot(
-      entities: ReadonlyArray<Type<PlainLiteralObject>>,
-    ): DynamicModule {
-      return TypeOrmModule.forRoot({
-        ...connection,
-        entities: [...entities],
-      });
-    },
-  };
-}
diff --git a/examples/sample-server/test/zod-full-coverage.e2e-spec.ts b/examples/sample-server/test/zod-full-coverage.e2e-spec.ts
index 958b0cb50..5ed5e63d2 100644
--- a/examples/sample-server/test/zod-full-coverage.e2e-spec.ts
+++ b/examples/sample-server/test/zod-full-coverage.e2e-spec.ts
@@ -18,8 +18,8 @@ import { z } from 'zod';
 import {
   ExceptionsFilter,
   RocketsModule,
-  defineTypeOrmRepository,
 } from '@concepta/rockets';
+import { defineTypeOrmRepository } from '@concepta/rockets-repository-typeorm';
 import type {
   RocketsRepositoryModuleInterface,
   SchemaEntityCompiler,
diff --git a/examples/sample-server/test/zod-parity.e2e-spec.ts b/examples/sample-server/test/zod-parity.e2e-spec.ts
index 51b731477..e879c0a94 100644
--- a/examples/sample-server/test/zod-parity.e2e-spec.ts
+++ b/examples/sample-server/test/zod-parity.e2e-spec.ts
@@ -11,8 +11,8 @@ import request from 'supertest';
 import {
   ExceptionsFilter,
   RocketsModule,
-  defineTypeOrmRepository,
 } from '@concepta/rockets';
+import { defineTypeOrmRepository } from '@concepta/rockets-repository-typeorm';
 import type { ResourceInput } from '@concepta/rockets';
 import {
   UserMetadataCreateDto,
diff --git a/examples/sample-server/test/zod-swagger-golden.e2e-spec.ts b/examples/sample-server/test/zod-swagger-golden.e2e-spec.ts
index 7e6995356..25ba6ccd3 100644
--- a/examples/sample-server/test/zod-swagger-golden.e2e-spec.ts
+++ b/examples/sample-server/test/zod-swagger-golden.e2e-spec.ts
@@ -7,7 +7,8 @@ import {
   SwaggerModule,
 } from '@nestjs/swagger';
 import { cleanupOpenApiDoc } from 'nestjs-zod';
-import { RocketsModule, defineTypeOrmRepository } from '@concepta/rockets';
+import { RocketsModule } from '@concepta/rockets';
+import { defineTypeOrmRepository } from '@concepta/rockets-repository-typeorm';
 import type { ResourceInput } from '@concepta/rockets';
 import {
   UserMetadataCreateDto,
diff --git a/examples/sample-server/vitest.e2e.config.ts b/examples/sample-server/vitest.e2e.config.mts
similarity index 84%
rename from examples/sample-server/vitest.e2e.config.ts
rename to examples/sample-server/vitest.e2e.config.mts
index 62e44af8c..a131ff13f 100644
--- a/examples/sample-server/vitest.e2e.config.ts
+++ b/examples/sample-server/vitest.e2e.config.mts
@@ -1,9 +1,9 @@
 import { defineProject, mergeConfig } from 'vitest/config';
-import shared from '../../vitest.shared';
+import shared from '../../vitest.shared.mts';
 
 /**
  * E2E project for the sample-server example — registered in the root
- * `vitest.config.ts` `projects` list and runnable standalone via
+ * `vitest.config.mts` `projects` list and runnable standalone via
  * `--config` from the workspace.
  */
 export default mergeConfig(
diff --git a/firebase.json b/firebase.json
new file mode 100644
index 000000000..ecfc838f2
--- /dev/null
+++ b/firebase.json
@@ -0,0 +1,14 @@
+{
+  "firestore": {
+    "rules": "firestore.rules"
+  },
+  "emulators": {
+    "firestore": {
+      "port": 8088
+    },
+    "ui": {
+      "enabled": false
+    },
+    "singleProjectMode": true
+  }
+}
diff --git a/firestore.rules b/firestore.rules
new file mode 100644
index 000000000..b9dd67c55
--- /dev/null
+++ b/firestore.rules
@@ -0,0 +1,8 @@
+rules_version = '2';
+service cloud.firestore {
+  match /databases/{database}/documents {
+    match /{document=**} {
+      allow read, write: if false;
+    }
+  }
+}
diff --git a/package.json b/package.json
index aa0321827..da2a6c4e8 100644
--- a/package.json
+++ b/package.json
@@ -3,6 +3,9 @@
   "version": "0.0.1-dev.0",
   "license": "BSD-3-Clause",
   "private": true,
+  "engines": {
+    "node": ">=20.0.0"
+  },
   "workspaces": {
     "packages": [
       "packages/*",
@@ -22,7 +25,6 @@
     "@nestjs/swagger": "12.0.0-alpha.2",
     "jws": "3.2.3",
     "qs": "6.15.2",
-    "path-to-regexp": "8.4.0",
     "form-data": "4.0.6",
     "multer": "2.2.0",
     "tar-fs": "2.1.4",
@@ -66,7 +68,7 @@
     "@nestjs/testing": "12.0.0-alpha.5",
     "@swc/core": "^1.15.47",
     "@types/express": "^4.17.21",
-    "@types/node": "^18.19.44",
+    "@types/node": "^20.19.0",
     "@types/nodemailer": "^6.4.15",
     "@types/supertest": "^6.0.3",
     "@typescript-eslint/eslint-plugin": "^5.62.0",
@@ -81,6 +83,7 @@
     "eslint-plugin-node": "^11.1.0",
     "eslint-plugin-prettier": "^4.2.1",
     "eslint-plugin-tsdoc": "^0.3.0",
+    "firebase-tools": "15.15.0",
     "husky": "^7.0.4",
     "istanbul-lib-coverage": "^3.2.2",
     "istanbul-lib-report": "^3.0.1",
@@ -116,15 +119,16 @@
     "lint:all": "yarn lint && yarn lint:md",
     "test": "vitest run --project unit",
     "test:watch": "vitest --project unit",
+    "test:config-native": "vitest list --project unit --configLoader native",
     "test:cov": "vitest run --project unit --coverage --coverage.thresholds.statements=50 --coverage.thresholds.branches=50 --coverage.thresholds.functions=40 --coverage.thresholds.lines=50",
     "test:ci": "vitest run --project unit --coverage --coverage.thresholds.statements=50 --coverage.thresholds.branches=50 --coverage.thresholds.functions=40 --coverage.thresholds.lines=50 --reporter=default --reporter=junit --outputFile=junit.xml",
     "test:debug": "vitest --inspect-brk --no-file-parallelism",
     "test:e2e": "vitest run --project e2e-packages",
+    "test:firestore-emulator": "firebase emulators:exec --only firestore --project demo-rockets --config firebase.json 'vitest run --config vitest.firestore.config.mts'",
     "test:e2e:cov": "vitest run --project e2e-packages --coverage --coverage.reportsDirectory=coverage-e2e --maxWorkers=1",
     "test:all": "vitest run",
     "doc": "rimraf ./docs && typedoc",
     "doc:cov": "yarn doc --coverageOutputType all",
-    "generate-swagger": "cd packages/rockets-server-auth && yarn generate-swagger",
     "sample:start": "yarn workspace sample-server start:dev",
     "sample:go": "yarn build && yarn workspace sample-server start:dev",
     "sample:once": "yarn workspace sample-server start",
@@ -140,14 +144,15 @@
     "sample-code-review:dev": "yarn build && yarn workspace sample-code-review dev",
     "sample-code-review:build": "yarn build && yarn workspace sample-code-review build",
     "sample-code-review:test:e2e": "yarn build && yarn workspace sample-code-review test:e2e",
-    "samples:build": "yarn sample:build && yarn sample-auth:build",
-    "samples:test:e2e": "yarn sample:test:e2e && yarn sample-auth:test:e2e",
+    "samples:build": "yarn sample:build && yarn sample-auth:build && yarn workspace sample-code-review build",
+    "samples:test:e2e": "yarn sample:test:e2e && yarn sample-auth:test:e2e && yarn workspace sample-code-review test:e2e",
     "codacy:analyze": ".codacy/cli.sh analyze",
     "codacy:analyze:fix": ".codacy/cli.sh analyze --fix",
     "codacy:analyze:file": ".codacy/cli.sh analyze",
     "codacy:analyze:security": ".codacy/cli.sh analyze -t trivy",
     "typecheck:spec": "tsc --noEmit -p tsconfig.spec.json && yarn workspace @concepta/rockets-core test:typetests",
-    "release:check": "node -e \"const v=process.env.npm_config_user_agent||'';if(!/yarn\\\\/4/.test(v)){console.error('\\\\n  Release commands require Yarn 4. Run them via: corepack yarn <script>\\\\n');process.exit(1)}\" && yarn build && yarn typecheck:spec && yarn lint:all && yarn test && yarn test:e2e",
+    "release:packages": "node scripts/verify-package-artifacts.mjs && yarn release:dry",
+    "release:check": "node -e \"const v=process.env.npm_config_user_agent||'';if(!/yarn\\\\/4/.test(v)){console.error('\\\\n  Release commands require Yarn 4. Run them via: corepack yarn <script>\\\\n');process.exit(1)}\" && yarn build && yarn release:packages && yarn typecheck:spec && yarn lint:all && yarn test && yarn test:e2e && yarn test:firestore-emulator && yarn samples:build && yarn samples:test:e2e",
     "release:audit": "node -e \"const v=process.env.npm_config_user_agent||'';if(!/yarn\\\\/4/.test(v)){console.error('\\\\n  Release commands require Yarn 4. Run them via: corepack yarn <script>\\\\n');process.exit(1)}\" && yarn npm audit --severity high",
     "release:dry": "node -e \"const v=process.env.npm_config_user_agent||'';if(!/yarn\\\\/4/.test(v)){console.error('\\\\n  Release commands require Yarn 4. Run them via: corepack yarn <script>\\\\n');process.exit(1)}\" && yarn workspaces foreach -A --include '@concepta/*' --no-private --topological pack --dry-run",
     "version:alpha": "node -e \"const v=process.env.npm_config_user_agent||'';if(!/yarn\\\\/4/.test(v)){console.error('\\\\n  Release commands require Yarn 4. Run them via: corepack yarn <script>\\\\n');process.exit(1)}\" && yarn workspaces foreach -A --no-private version prerelease --deferred && yarn version apply --all",
diff --git a/packages/rockets-adapter-firebase/CHANGELOG.md b/packages/rockets-adapter-firebase/CHANGELOG.md
index 37fc481ea..8d4cded7b 100644
--- a/packages/rockets-adapter-firebase/CHANGELOG.md
+++ b/packages/rockets-adapter-firebase/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## Unreleased
+
+### Changed
+
+- Synchronous `defineFirebaseAuth()` options are now flat
+  (`defineFirebaseAuth({ firebaseApp })`); asynchronous wiring remains the
+  explicit `{ forRootAsync }` variant.
+- Node.js 20 is the minimum supported runtime.
+
 ## 1.0.0-alpha.0
 
 - Initial public alpha release of the Firebase auth adapter.
diff --git a/packages/rockets-adapter-firebase/README.md b/packages/rockets-adapter-firebase/README.md
index e8bc633c0..6615790db 100644
--- a/packages/rockets-adapter-firebase/README.md
+++ b/packages/rockets-adapter-firebase/README.md
@@ -8,8 +8,8 @@
 > maps the decoded payload to `AuthorizedUser`, and plugs into the standard
 > `auth` chain.
 
-**Status:** preview (`0.0.1-dev.0` on npm, dist-tag `alpha`). API expected to
-stay shape-compatible through 1.0.
+**Status:** pre-1.0 preview (`0.0.1-dev.0`, npm dist-tag `alpha`). Public
+shapes may still change before 1.0.
 
 ---
 
@@ -62,8 +62,8 @@ module wrap the SDK (the common case).
 ### Wire it into a Rockets app
 
 Use the `defineFirebaseAuth()` helper. It returns an `AuthBootstrap` that
-`RocketsModule.forRoot({ auth })` consumes directly. When `forRoot()` /
-`forRootAsync()` is set, core imports `FirebaseAuthModule` and injects
+`createServer({ auth })` or `RocketsModule.forRoot({ auth })` consumes
+directly. Core imports `FirebaseAuthModule` and injects
 `FirebaseAuthAdapter` from that module — the adapter is not double-registered.
 
 ```typescript
@@ -80,7 +80,7 @@ const firebaseApp = initializeApp({ credential: applicationDefault() });
   imports: [
     RocketsModule.forRoot({
       auth: defineFirebaseAuth({
-        forRoot: { firebaseApp },
+        firebaseApp,
       }),
       userMetadata: {
         /* entity, createDto, updateDto */
@@ -93,8 +93,8 @@ const firebaseApp = initializeApp({ credential: applicationDefault() });
 export class AppModule {}
 ```
 
-Pass `forRootAsync` instead of `forRoot` to build options asynchronously (e.g.
-inject `ConfigService`). See
+Pass `{ forRootAsync: ... }` instead of flat sync options to build options
+asynchronously (e.g. inject `ConfigService`). See
 [How-to › Build options asynchronously](#build-options-asynchronously).
 
 ---
@@ -203,8 +203,8 @@ export class ProfileController {
 
 | Member | Purpose |
 |---|---|
-| `defineFirebaseAuth(input)` | Returns an `AuthBootstrap` for `RocketsModule.forRoot({ auth })`. Accepts `{ forRoot }` for sync or `{ forRootAsync }` for async wiring. Auth-owned entities belong on app `resources[]`, not on this helper. |
-| `DefineFirebaseAuthInput` | Discriminated input type — pass exactly one of `forRoot` / `forRootAsync`. |
+| `defineFirebaseAuth(input)` | Returns an `AuthBootstrap` for `createServer({ auth })` or `RocketsModule.forRoot({ auth })`. Pass module options directly for sync wiring, or `{ forRootAsync }` for async wiring. |
+| `DefineFirebaseAuthInput` | Input type for either flat sync options or the explicit `{ forRootAsync }` variant. |
 
 ### Module
 
diff --git a/packages/rockets-adapter-firebase/package.json b/packages/rockets-adapter-firebase/package.json
index 0aa5310b2..155cc19d1 100644
--- a/packages/rockets-adapter-firebase/package.json
+++ b/packages/rockets-adapter-firebase/package.json
@@ -24,8 +24,7 @@
     "directory": "packages/rockets-adapter-firebase"
   },
   "engines": {
-    "node": ">=18.0.0",
-    "npm": ">=8.0.0"
+    "node": ">=20.0.0"
   },
   "files": [
     "dist/**/!(*.spec|*.e2e-spec|*.fixture).{js,d.ts}",
diff --git a/packages/rockets-adapter-firebase/src/__tests__/define-firebase-auth.spec.ts b/packages/rockets-adapter-firebase/src/__tests__/define-firebase-auth.spec.ts
index b66d08b03..61bc37248 100644
--- a/packages/rockets-adapter-firebase/src/__tests__/define-firebase-auth.spec.ts
+++ b/packages/rockets-adapter-firebase/src/__tests__/define-firebase-auth.spec.ts
@@ -14,7 +14,7 @@ class FakeVerifier implements FirebaseTokenVerifierInterface {
 describe('defineFirebaseAuth', () => {
   it('returns AuthBootstrap with FirebaseAuthAdapter and forRoot (sync path)', () => {
     const bootstrap = defineFirebaseAuth({
-      forRoot: { verifier: FakeVerifier },
+      verifier: FakeVerifier,
     });
 
     expect(bootstrap.adapter).toBe(FirebaseAuthAdapter);
diff --git a/packages/rockets-adapter-firebase/src/__tests__/firebase-auth-guard.integration.spec.ts b/packages/rockets-adapter-firebase/src/__tests__/firebase-auth-guard.integration.spec.ts
index ee97adee7..489480d7a 100644
--- a/packages/rockets-adapter-firebase/src/__tests__/firebase-auth-guard.integration.spec.ts
+++ b/packages/rockets-adapter-firebase/src/__tests__/firebase-auth-guard.integration.spec.ts
@@ -50,7 +50,7 @@ describe('FirebaseAuthAdapter + AuthServerGuard (integration)', () => {
 
   beforeAll(async () => {
     const bootstrap = defineFirebaseAuth({
-      forRoot: { verifier: StubVerifier },
+      verifier: StubVerifier,
     });
 
     const moduleRef = await Test.createTestingModule({
diff --git a/packages/rockets-adapter-firebase/src/integration/define-firebase-auth.ts b/packages/rockets-adapter-firebase/src/integration/define-firebase-auth.ts
index da1f04a9d..45b3e3e9f 100644
--- a/packages/rockets-adapter-firebase/src/integration/define-firebase-auth.ts
+++ b/packages/rockets-adapter-firebase/src/integration/define-firebase-auth.ts
@@ -9,19 +9,21 @@ import { FirebaseAuthModule } from '../modules/firebase-auth.module';
  * Input for {@link defineFirebaseAuth}.
  *
  * Choose exactly one wiring shape:
- *  - `forRoot` — sync options (`FirebaseAuthModule.forRoot` payload).
+ *  - flat sync options (`FirebaseAuthModule.forRoot` payload).
  *  - `forRootAsync` — async options (`FirebaseAuthModule.forRootAsync` payload).
  *
  * Auth-owned entities belong in app `resources[]`, not here.
  */
 export type DefineFirebaseAuthInput =
-  | Readonly<{
-      forRoot: FirebaseAuthModuleOptions;
+  | (Readonly<FirebaseAuthModuleOptions> & {
       forRootAsync?: never;
-    }>
+    })
   | Readonly<{
       forRootAsync: FirebaseAuthModuleAsyncOptions;
-      forRoot?: never;
+      firebaseApp?: never;
+      verifier?: never;
+      userResolver?: never;
+      checkRevoked?: never;
     }>;
 
 /**
@@ -33,8 +35,8 @@ export function defineFirebaseAuth(
   return {
     adapter: FirebaseAuthAdapter,
     forRoot: () =>
-      input.forRootAsync !== undefined
+      'forRootAsync' in input && input.forRootAsync !== undefined
         ? FirebaseAuthModule.forRootAsync(input.forRootAsync)
-        : FirebaseAuthModule.forRoot(input.forRoot),
+        : FirebaseAuthModule.forRoot(input),
   };
 }
diff --git a/packages/rockets-core/CHANGELOG.md b/packages/rockets-core/CHANGELOG.md
new file mode 100644
index 000000000..c24603e78
--- /dev/null
+++ b/packages/rockets-core/CHANGELOG.md
@@ -0,0 +1,15 @@
+# Changelog
+
+## Unreleased
+
+### Added
+
+- `AuthBootstrapContributions`, allowing an auth integration to carry its owned
+  resources, metadata contract, repository, and guard preference.
+- `defineAuthAdapter()`, which registers and exports a custom auth adapter from
+  a generated host module.
+
+### Changed
+
+- `AuthServerGuard` recognizes the upstream class-level public-route sentinel.
+- Node.js 20 is the minimum supported runtime.
diff --git a/packages/rockets-core/README.md b/packages/rockets-core/README.md
index 62b937edf..d424a5cd3 100644
--- a/packages/rockets-core/README.md
+++ b/packages/rockets-core/README.md
@@ -7,7 +7,7 @@
 > Configuration-driven composition layer: one options object → planner →
 > upstream `@concepta/nestjs-*` modules registered as Nest imports.
 
-**Status:** stable (`0.0.1-dev.0` on npm, dist-tag `alpha`).
+**Status:** pre-1.0 preview (`0.0.1-dev.0`, npm dist-tag `alpha`).
 
 ---
 
@@ -105,16 +105,17 @@ import { APP_GUARD } from '@nestjs/core';
 import {
   RocketsCoreModule,
   AuthServerGuard,
+  defineAuthAdapter,
   defineResource,
 } from '@concepta/rockets-core';
 import { JwtAdapter } from './auth/jwt.adapter';
 import { PetEntity } from './pet.entity';
-import { defineTypeOrmRepository } from './repository/define-typeorm-repository';
+import { defineTypeOrmRepository } from '@concepta/rockets-repository-typeorm';
 
 @Module({
   imports: [
     RocketsCoreModule.forRoot({
-      auth: JwtAdapter,
+      auth: defineAuthAdapter(JwtAdapter),
       repository: defineTypeOrmRepository({
         type: 'sqlite',
         database: ':memory:',
@@ -130,18 +131,15 @@ export class AppModule {}
 
 ### What just happened
 
-- `auth: JwtAdapter` registered the adapter as a provider; core exposes the
-  ordered chain on `AUTH_ADAPTERS_TOKEN` for `AuthServerGuard`.
+- `defineAuthAdapter(JwtAdapter)` registered and exported the adapter; core
+  exposes the ordered chain on `AUTH_ADAPTERS_TOKEN` for `AuthServerGuard`.
 - `repository: defineTypeOrmRepository(...)` is the only place that mentions
   TypeORM. The planner collects entities from `resources[]` and registers them.
 - `defineResource({ entity: PetEntity })` produced `GET/POST/PATCH/DELETE /pets`
   with validation and Swagger schema. No controller was written.
 
-`defineTypeOrmRepository` is a small app-local `RepositoryBootstrap` wrapper
-(TypeORM connection options + planner-derived entity list) around
-`TypeOrmRepositoryModule` from `@concepta/rockets-repository-typeorm`. Keep the
-helper in the sample app (or copy into yours) — do not pull TypeORM into
-`@concepta/rockets-core` itself.
+`defineTypeOrmRepository` is owned by
+`@concepta/rockets-repository-typeorm`; core remains storage-agnostic.
 
 ---
 
@@ -487,7 +485,7 @@ expect.
 
 | Option         | Type                                                 | Required  | Description                                                                                                                                                                                                                          |
 | -------------- | ---------------------------------------------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `auth`         | `AuthBootstrap` or array                             | optional† | Auth wiring from `defineFirebaseAuth()`, `defineRocketsAuth()`, or app-local helpers. Each entry supplies `adapter` and optional `forRoot()` for external Nest modules. Entity rows belong in `resources[]`, not on the auth helper. |
+| `auth`         | `AuthBootstrap` or array                             | optional† | Auth wiring from `defineFirebaseAuth()`, `defineRocketsAuth()`, or app-local helpers. Each entry supplies an `adapter`, optional `forRoot()`, and optional integration-owned defaults through `contributes`; explicit app options win. |
 | `repository`   | `RepositoryModuleInterface` or `RepositoryBootstrap` | optional  | Default persistence adapter. A bootstrap owns both `forRoot(entities)` and `forFeature(entities)`.                                                                                                                                   |
 | `userMetadata` | `RocketsUserMetadataConfig`                          | optional  | Entity + DTOs for the metadata table joined to external users.                                                                                                                                                                       |
 | `resources`    | `ReadonlyArray<ResourceInput>`                       | optional  | Mix of `defineResource`, `defineModuleResource`, and manual `RocketsResourceConfig`.                                                                                                                                                 |
diff --git a/packages/rockets-core/package.json b/packages/rockets-core/package.json
index f409cc097..ba732c60d 100644
--- a/packages/rockets-core/package.json
+++ b/packages/rockets-core/package.json
@@ -36,8 +36,7 @@
     "directory": "packages/rockets-core"
   },
   "engines": {
-    "node": ">=18.0.0",
-    "npm": ">=8.0.0"
+    "node": ">=20.0.0"
   },
   "files": [
     "dist/**/!(*.spec|*.e2e-spec|*.fixture).{js,d.ts}",
diff --git a/packages/rockets-core/src/__e2e__/rockets-core.e2e-spec.ts b/packages/rockets-core/src/__e2e__/rockets-core.e2e-spec.ts
index 190024251..bec83eb89 100644
--- a/packages/rockets-core/src/__e2e__/rockets-core.e2e-spec.ts
+++ b/packages/rockets-core/src/__e2e__/rockets-core.e2e-spec.ts
@@ -13,6 +13,7 @@ import { APP_GUARD } from '@nestjs/core';
 import { ApiTags, ApiOkResponse } from '@nestjs/swagger';
 import request from 'supertest';
 import { getDynamicRepositoryToken } from '@concepta/nestjs-repository';
+import { AuthPublic as ConceptaAuthPublic } from '@concepta/nestjs-authentication';
 import type {
   AuthAdapterInterface,
   AuthAttemptResult,
@@ -28,7 +29,9 @@ import {
   USER_METADATA_MODULE_ENTITY_KEY,
 } from '../rockets-core.constants';
 import { UpsertUserMetadataCommand } from '../application/commands/impl/upsert-user-metadata.command';
+import { UpsertUserMetadataHandler } from '../application/commands/handlers/upsert-user-metadata.handler';
 import { GetUserMetadataQuery } from '../application/queries/impl/get-user-metadata.query';
+import { GetUserMetadataHandler } from '../application/queries/handlers/get-user-metadata.handler';
 
 import { CommandBus, QueryBus } from '@nestjs/cqrs';
 import { createStubAuthBootstrap } from '../infrastructure/auth/create-stub-auth-bootstrap';
@@ -161,6 +164,17 @@ class TestController {
   }
 }
 
+@ApiTags('test')
+@Controller('class-public')
+@ConceptaAuthPublic({ classLevel: true })
+class ClassPublicController {
+  @Get()
+  @ApiOkResponse({ description: 'Controller-wide public route ping' })
+  getPublic() {
+    return { message: 'class public' };
+  }
+}
+
 // ────────────────────────────────────────────────────────────────────
 // Tests
 // ────────────────────────────────────────────────────────────────────
@@ -175,10 +189,14 @@ describe('RocketsCoreModule (e2e)', () => {
         RocketsCoreModule.forRoot({
           auth: createStubAuthBootstrap(MockAuthAdapter),
           providers: [MockAuthAdapter],
+          handlers: {
+            upsertUserMetadata: UpsertUserMetadataHandler,
+            getUserMetadata: GetUserMetadataHandler,
+          },
           global: true,
         }),
       ],
-      controllers: [TestController],
+      controllers: [TestController, ClassPublicController],
       providers: [{ provide: APP_GUARD, useClass: AuthServerGuard }],
     }).compile();
 
@@ -226,6 +244,12 @@ describe('RocketsCoreModule (e2e)', () => {
         .get('/test/public')
         .expect(200)
         .expect({ message: 'public' }));
+
+    it('supports the upstream controller-wide public marker', () =>
+      request(app.getHttpServer())
+        .get('/class-public')
+        .expect(200)
+        .expect({ message: 'class public' }));
   });
 
   describe('@AuthUser decorator', () => {
diff --git a/packages/rockets-core/src/common/index.ts b/packages/rockets-core/src/common/index.ts
index f1ac68513..5d3a50825 100644
--- a/packages/rockets-core/src/common/index.ts
+++ b/packages/rockets-core/src/common/index.ts
@@ -13,8 +13,6 @@ export {
   getErrorDetails,
 } from './utils/error-logging.helper';
 export type { ErrorDetails } from './utils/error-logging.helper';
-export { createRepositoryContext } from './utils/repository-context.helper';
-export type { RepositoryContextInterface } from './utils/repository-context.helper';
 export { stripUndefined } from './utils/strip-undefined.helper';
 export { whitelistedFromDto } from './utils/whitelisted-from-dto.util';
 export { deriveEntityKey } from './utils/derive-entity-key.util';
diff --git a/packages/rockets-core/src/common/utils/repository-context.helper.ts b/packages/rockets-core/src/common/utils/repository-context.helper.ts
deleted file mode 100644
index 978502c6f..000000000
--- a/packages/rockets-core/src/common/utils/repository-context.helper.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-import type { PlainLiteralObject } from '@nestjs/common';
-
-/**
- * Minimal repository-context shape consumed by upstream CQRS commands
- * (`UpdateUserCommand`, `RemoveUserCommand`, `CrudListQuery`, …) as their
- * first argument.
- *
- * Structurally equivalent to the upstream `RepositoryContextInterface`
- * declared in `@concepta/rockets-repository@v8.0.0-alpha.5` — kept local
- * because the upstream type is not exported on the public barrel
- * (only the `RepoCtx` overlay ref is). Defining it here avoids a deep
- * `/dist/` import.
- */
-export interface RepositoryContextInterface extends PlainLiteralObject {
-  entity: string;
-}
-
-/**
- * Builds a minimal `RepositoryContextInterface` for CQRS delegation.
- * Used by every Rockets handler that delegates to upstream Concepta
- * commands/queries which require a context as their first argument.
- */
-export function createRepositoryContext(
-  entityKey: string,
-): RepositoryContextInterface {
-  return { entity: entityKey };
-}
diff --git a/packages/rockets-core/src/decorators/auth-public.decorator.ts b/packages/rockets-core/src/decorators/auth-public.decorator.ts
index 7e3dfcd3a..06e9ebee3 100644
--- a/packages/rockets-core/src/decorators/auth-public.decorator.ts
+++ b/packages/rockets-core/src/decorators/auth-public.decorator.ts
@@ -1,4 +1,14 @@
 import { SetMetadata } from '@nestjs/common';
 import { ROCKETS_DISABLE_GUARDS_TOKEN } from '../rockets-core.constants';
 
-export const AuthPublic = () => SetMetadata(ROCKETS_DISABLE_GUARDS_TOKEN, true);
+export interface AuthPublicOptions {
+  classLevel?: boolean;
+}
+
+export type AuthPublicMetadata = true | 'classLevel';
+
+export const AuthPublic = (options?: AuthPublicOptions) =>
+  SetMetadata(
+    ROCKETS_DISABLE_GUARDS_TOKEN,
+    options?.classLevel ? 'classLevel' : true,
+  );
diff --git a/packages/rockets-core/src/domain/interfaces/auth-bootstrap.interface.ts b/packages/rockets-core/src/domain/interfaces/auth-bootstrap.interface.ts
index d26bf8974..4fbdc1461 100644
--- a/packages/rockets-core/src/domain/interfaces/auth-bootstrap.interface.ts
+++ b/packages/rockets-core/src/domain/interfaces/auth-bootstrap.interface.ts
@@ -1,5 +1,20 @@
 import type { DynamicModule, Type } from '@nestjs/common';
+import type { RepositoryModuleInterface } from '@concepta/nestjs-repository';
 import type { AuthAdapterInterface } from './auth-adapter.interface';
+import type { RepositoryBootstrap } from './repository-bootstrap.interface';
+import type { RocketsUserMetadataConfig } from './rockets-user-metadata-config.interface';
+import type { ResourceInput } from '../../infrastructure/resource/planner/app-registration-plan.types';
+
+/**
+ * Defaults an auth integration can contribute to the surrounding Rockets app.
+ * Explicit options on `RocketsModule` take precedence over every contribution.
+ */
+export interface AuthBootstrapContributions {
+  readonly resources?: ReadonlyArray<ResourceInput>;
+  readonly userMetadata?: RocketsUserMetadataConfig;
+  readonly repository?: RepositoryModuleInterface | RepositoryBootstrap;
+  readonly enableGlobalGuard?: boolean;
+}
 
 /**
  * Light / external auth wiring. When `forRoot` is set, core imports the
@@ -10,4 +25,6 @@ export interface AuthBootstrap<
 > {
   readonly adapter: Type<Adapter>;
   readonly forRoot?: () => DynamicModule;
+  /** Composition defaults owned by this integration; explicit app options win. */
+  readonly contributes?: AuthBootstrapContributions;
 }
diff --git a/packages/rockets-core/src/index.ts b/packages/rockets-core/src/index.ts
index e6b713c49..1d804c80c 100644
--- a/packages/rockets-core/src/index.ts
+++ b/packages/rockets-core/src/index.ts
@@ -21,7 +21,11 @@ export { AuthServerGuard } from './infrastructure/guards/auth-server.guard';
 export { PathScopeGuard } from './infrastructure/guards/path-scope.guard';
 
 // Decorators
-export { AuthPublic } from './decorators/auth-public.decorator';
+export {
+  AuthPublic,
+  type AuthPublicMetadata,
+  type AuthPublicOptions,
+} from './decorators/auth-public.decorator';
 // Canonical authenticated-user param decorator (reads `request.user`).
 
 // Auth user-context overlay — re-exported so downstream layers consume it
@@ -104,6 +108,11 @@ export {
   Where,
   getDynamicRepositoryToken,
 } from '@concepta/nestjs-repository';
+export {
+  AppContextHost,
+  getAppContext,
+  type AppContextLike,
+} from '@concepta/nestjs-core';
 
 // Module resource (non-CRUD persistence + Nest module slice)
 export type {
@@ -118,8 +127,13 @@ export {
 export type { DefineModuleResourceInput } from './infrastructure/resource/define-module-resource';
 
 // Auth bootstrap (light / external auth wiring)
-export type { AuthBootstrap } from './domain/interfaces/auth-bootstrap.interface';
+export type {
+  AuthBootstrap,
+  AuthBootstrapContributions,
+} from './domain/interfaces/auth-bootstrap.interface';
 export { createStubAuthBootstrap } from './infrastructure/auth/create-stub-auth-bootstrap';
+export { defineAuthAdapter } from './infrastructure/auth/define-auth-adapter';
+export type { DefineAuthAdapterOptions } from './infrastructure/auth/define-auth-adapter';
 
 // Resource config & definition API
 export type { RocketsResourceConfig } from './domain/interfaces/rockets-resource.interface';
diff --git a/packages/rockets-core/src/infrastructure/auth/create-stub-auth-bootstrap.ts b/packages/rockets-core/src/infrastructure/auth/create-stub-auth-bootstrap.ts
index b043e1088..9d433c3c1 100644
--- a/packages/rockets-core/src/infrastructure/auth/create-stub-auth-bootstrap.ts
+++ b/packages/rockets-core/src/infrastructure/auth/create-stub-auth-bootstrap.ts
@@ -1,17 +1,11 @@
 import type { Type } from '@nestjs/common';
 import type { AuthAdapterInterface } from '../../domain/interfaces/auth-adapter.interface';
 import type { AuthBootstrap } from '../../domain/interfaces/auth-bootstrap.interface';
+import { defineAuthAdapter } from './define-auth-adapter';
 
 /** Minimal AuthBootstrap for core e2e tests — exports adapter from a host module. */
 export function createStubAuthBootstrap<Adapter extends AuthAdapterInterface>(
   adapter: Type<Adapter>,
 ): AuthBootstrap<Adapter> {
-  return {
-    adapter,
-    forRoot: () => ({
-      module: class StubAuthHostModule {},
-      providers: [adapter],
-      exports: [adapter],
-    }),
-  };
+  return defineAuthAdapter(adapter);
 }
diff --git a/packages/rockets-core/src/infrastructure/auth/define-auth-adapter.spec.ts b/packages/rockets-core/src/infrastructure/auth/define-auth-adapter.spec.ts
new file mode 100644
index 000000000..e26fecfb3
--- /dev/null
+++ b/packages/rockets-core/src/infrastructure/auth/define-auth-adapter.spec.ts
@@ -0,0 +1,49 @@
+import { describe, expect, it } from 'vitest';
+import { Injectable } from '@nestjs/common';
+
+import type {
+  AuthAdapterInterface,
+  AuthAttemptResult,
+  AuthRequest,
+} from '../../domain/interfaces/auth-adapter.interface';
+import * as RocketsCore from '../../index';
+
+@Injectable()
+class SpecAuthAdapter implements AuthAdapterInterface {
+  async authenticate(_request: AuthRequest): Promise<AuthAttemptResult> {
+    return { matched: false };
+  }
+}
+
+describe('defineAuthAdapter', () => {
+  it('exports a complete bootstrap for a custom adapter', () => {
+    const defineAuthAdapter = (
+      RocketsCore as unknown as {
+        defineAuthAdapter: (
+          adapter: typeof SpecAuthAdapter,
+          options?: { providers?: unknown[]; contributes?: { resources: [] } },
+        ) => {
+          adapter: unknown;
+          contributes?: unknown;
+          forRoot?: () => {
+            providers?: unknown[];
+            exports?: unknown[];
+          };
+        };
+      }
+    ).defineAuthAdapter;
+    const dependency = { provide: 'AUTH_DEPENDENCY', useValue: true };
+    const contributes = { resources: [] as [] };
+
+    const bootstrap = defineAuthAdapter(SpecAuthAdapter, {
+      providers: [dependency],
+      contributes,
+    });
+    const module = bootstrap.forRoot!();
+
+    expect(bootstrap.adapter).toBe(SpecAuthAdapter);
+    expect(bootstrap.contributes).toBe(contributes);
+    expect(module.providers).toEqual([dependency, SpecAuthAdapter]);
+    expect(module.exports).toEqual([SpecAuthAdapter]);
+  });
+});
diff --git a/packages/rockets-core/src/infrastructure/auth/define-auth-adapter.ts b/packages/rockets-core/src/infrastructure/auth/define-auth-adapter.ts
new file mode 100644
index 000000000..8788aa67c
--- /dev/null
+++ b/packages/rockets-core/src/infrastructure/auth/define-auth-adapter.ts
@@ -0,0 +1,40 @@
+import type { DynamicModule, Provider, Type } from '@nestjs/common';
+
+import type { AuthAdapterInterface } from '../../domain/interfaces/auth-adapter.interface';
+import type {
+  AuthBootstrap,
+  AuthBootstrapContributions,
+} from '../../domain/interfaces/auth-bootstrap.interface';
+
+/** Optional Nest wiring and server defaults owned by a custom auth adapter. */
+export interface DefineAuthAdapterOptions {
+  readonly imports?: NonNullable<DynamicModule['imports']>;
+  readonly controllers?: NonNullable<DynamicModule['controllers']>;
+  readonly providers?: ReadonlyArray<Provider>;
+  readonly exports?: NonNullable<DynamicModule['exports']>;
+  readonly contributes?: AuthBootstrapContributions;
+}
+
+/**
+ * Turn a custom adapter into a complete auth integration.
+ *
+ * The generated host module registers and exports the adapter so Rockets can
+ * inject it into the ordered guard chain. Additional Nest wiring remains
+ * private to that integration unless explicitly exported.
+ */
+export function defineAuthAdapter<Adapter extends AuthAdapterInterface>(
+  adapter: Type<Adapter>,
+  options: DefineAuthAdapterOptions = {},
+): AuthBootstrap<Adapter> {
+  return {
+    adapter,
+    contributes: options.contributes,
+    forRoot: () => ({
+      module: class AuthAdapterHostModule {},
+      imports: [...(options.imports ?? [])],
+      controllers: [...(options.controllers ?? [])],
+      providers: [...(options.providers ?? []), adapter],
+      exports: [adapter, ...(options.exports ?? [])],
+    }),
+  };
+}
diff --git a/packages/rockets-core/src/infrastructure/filters/exceptions.filter.ts b/packages/rockets-core/src/infrastructure/filters/exceptions.filter.ts
index 1036bf740..5cdc022a9 100644
--- a/packages/rockets-core/src/infrastructure/filters/exceptions.filter.ts
+++ b/packages/rockets-core/src/infrastructure/filters/exceptions.filter.ts
@@ -84,13 +84,9 @@ export class RocketsCoreExceptionsFilter implements ExceptionFilter {
     // validation failure), surface that exception directly so the client
     // sees the intended status (401/403/400) instead of an opaque 500.
     //
-    // NOTE: in upstream `@concepta/nestjs-common@8.0.0-alpha.4`, the
-    // descendants of `RuntimeException` lose `context.originalError`
-    // when their constructors do `Object.assign({}, super.context, …)`
-    // (`super.context` resolves on the prototype, not on `this`). For
-    // pre-handler validation that must surface as 4xx, prefer a NestJS
-    // Guard or Pipe over a `Before*` repo hook so the `HttpException`
-    // never enters the wrapping pipeline in the first place.
+    // Upstream RuntimeException subclasses currently lose `originalError`
+    // while rebuilding their context. Guards and pipes avoid that wrapping for
+    // pre-handler validation that must preserve a 4xx response.
     const unwrapped =
       this.unwrapToHttpException(rawException) ??
       this.unwrapToClientRuntimeException(rawException);
diff --git a/packages/rockets-core/src/infrastructure/guards/auth-server.guard.ts b/packages/rockets-core/src/infrastructure/guards/auth-server.guard.ts
index ec4776ed2..e1deac6ce 100644
--- a/packages/rockets-core/src/infrastructure/guards/auth-server.guard.ts
+++ b/packages/rockets-core/src/infrastructure/guards/auth-server.guard.ts
@@ -7,7 +7,8 @@ import {
   Logger,
 } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
-import {
+import type { AuthPublicMetadata } from '@concepta/nestjs-authentication';
+import type {
   AuthAdapterInterface,
   AuthRequest,
 } from '../../domain/interfaces/auth-adapter.interface';
@@ -39,12 +40,13 @@ export class AuthServerGuard implements CanActivate {
   ) {}
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
-    const isDisabled = this.reflector.getAllAndOverride<boolean>(
+    const isDisabled = this.reflector.getAllAndOverride<AuthPublicMetadata>(
       ROCKETS_DISABLE_GUARDS_TOKEN,
       [context.getHandler(), context.getClass()],
     );
 
-    if (isDisabled === true) {
+    // Upstream uses this sentinel for explicit controller-wide public access.
+    if (isDisabled === true || isDisabled === 'classLevel') {
       return true;
     }
 
diff --git a/packages/rockets-core/src/infrastructure/interceptors/safe-crud-context.interceptor.ts b/packages/rockets-core/src/infrastructure/interceptors/safe-crud-context.interceptor.ts
index 928423b98..a01713f4a 100644
--- a/packages/rockets-core/src/infrastructure/interceptors/safe-crud-context.interceptor.ts
+++ b/packages/rockets-core/src/infrastructure/interceptors/safe-crud-context.interceptor.ts
@@ -33,13 +33,9 @@ import {
  * This preserves upstream semantics for CRUD controllers while letting
  * mixed-controller apps coexist without a 500.
  */
-// TODO(upstream: concepta/nestjs-crud) — the upstream master branch has
-// already fixed CrudContextOverlay.attach() to no-op on handlers without
-// @CrudOperation metadata (commit 5249672f), but the fix is NOT yet
-// shipped in the published alpha we consume. Once a release includes that
-// behavior, delete this file,
-// delete createSafeCrudRootModule() in rockets-core.module-definition.ts,
-// and the bare CrudModule.forRoot({}) will be safe for mixed apps.
+// TODO(upstream: concepta/nestjs-crud) — remove this interceptor and
+// createSafeCrudRootModule() once the published overlay safely ignores handlers
+// without @CrudOperation metadata.
 @Injectable()
 export class SafeCrudContextInterceptor implements NestInterceptor {
   constructor(private readonly overlay: CrudContextOverlay) {}
diff --git a/packages/rockets-core/src/rockets-core.constants.ts b/packages/rockets-core/src/rockets-core.constants.ts
index 391ad9edc..1919f13c6 100644
--- a/packages/rockets-core/src/rockets-core.constants.ts
+++ b/packages/rockets-core/src/rockets-core.constants.ts
@@ -8,8 +8,7 @@ export const ROCKETS_CORE_SETTINGS_TOKEN =
  */
 export const AUTH_ADAPTERS_TOKEN = Symbol('ROCKETS_AUTH_ADAPTERS');
 
-// Use the same string value as @concepta/nestjs-authentication for backward compatibility
-// with existing @AuthPublic() decorators from concepta packages
+/** Must match the upstream AuthPublic metadata key for interoperability. */
 export const ROCKETS_DISABLE_GUARDS_TOKEN =
   'AUTHENTICATION_MODULE_DISABLE_GUARDS_TOKEN';
 
diff --git a/packages/rockets-core/src/rockets-core.module-definition.ts b/packages/rockets-core/src/rockets-core.module-definition.ts
index 1a6979e33..832484902 100644
--- a/packages/rockets-core/src/rockets-core.module-definition.ts
+++ b/packages/rockets-core/src/rockets-core.module-definition.ts
@@ -201,6 +201,15 @@ function createCoreProviders(options: {
     providers.push(...buildAuthChainProviders(authBootstraps));
   }
 
+  const userMetadataProviders: Provider[] =
+    options.extras?.userMetadata || options.extras?.handlers
+      ? [
+          options.extras?.handlers?.upsertUserMetadata ??
+            UpsertUserMetadataHandler,
+          options.extras?.handlers?.getUserMetadata ?? GetUserMetadataHandler,
+        ]
+      : [];
+
   return [
     ...providers,
     AuthServerGuard,
@@ -214,8 +223,7 @@ function createCoreProviders(options: {
     // zod constraints — this interceptor fills the gap without importing nestjs-zod.
     { provide: APP_INTERCEPTOR, useClass: ZodBodyValidationInterceptor },
     // Built-in user-metadata CQRS (override in `extras.handlers` if you need to customize storage)
-    options.extras?.handlers?.upsertUserMetadata ?? UpsertUserMetadataHandler,
-    options.extras?.handlers?.getUserMetadata ?? GetUserMetadataHandler,
+    ...userMetadataProviders,
     ...(options.extras?.providers ?? []),
     ...extractResourceProviders(options.plan.crudResources),
   ];
diff --git a/packages/rockets-repository-firestore/CHANGELOG.md b/packages/rockets-repository-firestore/CHANGELOG.md
index 700029d12..197d8abc3 100644
--- a/packages/rockets-repository-firestore/CHANGELOG.md
+++ b/packages/rockets-repository-firestore/CHANGELOG.md
@@ -10,10 +10,11 @@
 - `skip` / `take` pagination — `orderBy` + `limit(skip + take)` pushed to the
   Firestore Admin SDK so reads scale with the page, not the collection.
 - Efficient `count` / `findAndCount` (aggregation when possible).
-- Soft delete / restore when `dateRemoved` or `deletedAt` is configured on the
-  entity (or via `softDeleteField` option).
+- Soft delete / restore when `dateRemoved` or `deletedAt` exists on the entity.
 - `withDeleted` on find options.
 - Exported `ensureFirebaseAdminApp()` for shared Admin bootstrap with auth.
+- Atomic create semantics: duplicate document ids are rejected instead of
+  silently overwritten.
 
 ### Changed
 
@@ -22,4 +23,10 @@
   `defineFirestoreRepository().forRoot()` delegates here.
 - Backend API: `query()` replaced by `queryBranch()` / `countBranch()` with
   structured query plans.
+- Document-id `EQ` / `IN` predicates compose with ownership and other filters;
+  contradictory id predicates resolve to an empty result.
+- Generated ids are persisted and returned from `upsert`, and every order
+  clause participates in deterministic sorting.
+- Admin SDK and in-memory backends share the same local filter and sort
+  semantics for direct document lookups and post-filtered queries.
 - README documents supported features and Firestore platform limits.
diff --git a/packages/rockets-repository-firestore/README.md b/packages/rockets-repository-firestore/README.md
index fb454045e..6ebf54e1d 100644
--- a/packages/rockets-repository-firestore/README.md
+++ b/packages/rockets-repository-firestore/README.md
@@ -8,8 +8,8 @@
 > Firestore-backed entities with a TypeORM (or any other) default adapter, per
 > entity.
 
-**Status:** preview (`0.0.1-dev.0` on npm, dist-tag `alpha`). API stable
-enough to use; expect refinements before 1.0.
+**Status:** pre-1.0 preview (`0.0.1-dev.0`, npm dist-tag `alpha`). Public
+shapes may still change before 1.0.
 
 ---
 
@@ -33,7 +33,7 @@ Other entities continue on the default adapter (TypeORM, in most apps).
 - `FirestoreRepositoryModule.forFeature(entities, options?)` — registers dynamic
   repository providers per entity row.
 - `defineFirestoreRepository()` — `RepositoryBootstrap` with the same shape as
-  app-local `defineTypeOrmRepository` (thin delegate, no env sniffing).
+  `defineTypeOrmRepository` from `@concepta/rockets-repository-typeorm`.
 - `FirestoreRepository<Entity>` — adapter class implementing
   `RepositoryAdapter<Entity>`.
 - `ensureFirebaseAdminApp(packageRoot)` — singleton Admin initialisation for
@@ -177,6 +177,15 @@ override — name the column `dateRemoved` or `deletedAt` on the entity class.
 If neither name is present, `delete()` calls throw at runtime with a message
 naming both supported column names.
 
+### Local query parity
+
+The in-memory backend and Admin SDK direct-document/post-filter paths match
+Firestore for missing versus explicit `null`, nested field paths, structural
+equality, and range type checks. Local `orderBy` parity is guaranteed for
+`null`, boolean, number, timestamp/`Date`, and string values. Ordering any
+other Firestore value type fails with a descriptive error instead of returning
+a misleading order.
+
 ---
 
 ## 4. Reference
diff --git a/packages/rockets-repository-firestore/package.json b/packages/rockets-repository-firestore/package.json
index 59359afcd..d0a4d6ffa 100644
--- a/packages/rockets-repository-firestore/package.json
+++ b/packages/rockets-repository-firestore/package.json
@@ -24,13 +24,13 @@
     "directory": "packages/rockets-repository-firestore"
   },
   "engines": {
-    "node": ">=18.0.0",
-    "npm": ">=8.0.0"
+    "node": ">=20.0.0"
   },
   "files": [
     "dist/**/!(*.spec|*.e2e-spec|*.fixture).{js,d.ts}",
     "README.md",
-    "LICENSE.txt"
+    "LICENSE.txt",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "clean": "rimraf dist tsconfig.tsbuildinfo",
diff --git a/packages/rockets-repository-firestore/src/__tests__/firestore-backend.emulator-spec.ts b/packages/rockets-repository-firestore/src/__tests__/firestore-backend.emulator-spec.ts
new file mode 100644
index 000000000..0d6648d74
--- /dev/null
+++ b/packages/rockets-repository-firestore/src/__tests__/firestore-backend.emulator-spec.ts
@@ -0,0 +1,76 @@
+import { randomUUID } from 'node:crypto';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { deleteApp, getApps, initializeApp } from 'firebase-admin/app';
+
+import { AdminFirestoreBackend } from '../backends/admin-firestore.backend';
+import { InMemoryFirestoreBackend } from '../backends/in-memory-firestore.backend';
+import type { FirestoreBackend } from '../interfaces/firestore-backend.interface';
+import type { FirestoreBranchQueryOptions } from '../interfaces/firestore-backend.interface';
+
+describe('Firestore backend emulator parity', () => {
+  const collection = `parity-${randomUUID()}`;
+  const admin = new AdminFirestoreBackend();
+  const memory = new InMemoryFirestoreBackend();
+  const backends: FirestoreBackend[] = [admin, memory];
+
+  beforeAll(async () => {
+    if (!process.env.FIRESTORE_EMULATOR_HOST) {
+      throw new Error(
+        'Run this suite with `corepack yarn test:firestore-emulator`.',
+      );
+    }
+    if (getApps().length === 0) initializeApp({ projectId: 'demo-rockets' });
+    const rows: Array<[string, Record<string, unknown>]> = [
+      ['missing', { profile: {}, kind: 'missing' }],
+      ['null', { profile: { score: null }, kind: 'null' }],
+      ['number', { profile: { score: 2 }, kind: 'number', at: new Date(10) }],
+      ['string', { profile: { score: '2' }, kind: 'string' }],
+    ];
+    for (const backend of backends) {
+      for (const [id, row] of rows) await backend.set(collection, id, row);
+    }
+  });
+
+  afterAll(async () => {
+    for (const app of getApps()) await deleteApp(app);
+  });
+
+  async function compare(options: FirestoreBranchQueryOptions) {
+    const [adminRows, memoryRows] = await Promise.all(
+      backends.map((backend) => backend.queryBranch(collection, options)),
+    );
+    expect(adminRows.map((row) => row.id)).toEqual(
+      memoryRows.map((row) => row.id),
+    );
+    return adminRows;
+  }
+
+  it('matches explicit null without matching missing nested fields', async () => {
+    const rows = await compare({
+      branch: {
+        filters: [{ field: 'profile.score', op: '==', value: null }],
+        postFilters: [],
+      },
+    });
+    expect(rows.map((row) => row.id)).toEqual(['null']);
+  });
+
+  it('excludes cross-type values from range comparisons', async () => {
+    const rows = await compare({
+      branch: {
+        filters: [{ field: 'profile.score', op: '>', value: 1 }],
+        postFilters: [],
+      },
+    });
+    expect(rows.map((row) => row.id)).toEqual(['number']);
+  });
+
+  it('matches nested ordering and recursively normalizes timestamps', async () => {
+    const rows = await compare({
+      branch: { filters: [], postFilters: [] },
+      orderBy: [{ field: 'profile.score', direction: 'asc' }],
+    });
+    expect(rows.map((row) => row.id)).toEqual(['null', 'number', 'string']);
+    expect((await admin.get(collection, 'number'))?.at).toBeInstanceOf(Date);
+  });
+});
diff --git a/packages/rockets-repository-firestore/src/__tests__/firestore-repository.module.spec.ts b/packages/rockets-repository-firestore/src/__tests__/firestore-repository.module.spec.ts
index a00ae9aa1..9b94b6c47 100644
--- a/packages/rockets-repository-firestore/src/__tests__/firestore-repository.module.spec.ts
+++ b/packages/rockets-repository-firestore/src/__tests__/firestore-repository.module.spec.ts
@@ -22,6 +22,18 @@ class SoftWidgetEntity {
   dateRemoved!: Date | null;
 }
 
+class OwnedWidgetEntity {
+  id!: string;
+  title!: string;
+  userId!: string;
+}
+
+class OrderedWidgetEntity {
+  id!: string;
+  group!: string;
+  rank!: number;
+}
+
 describe(FirestoreRepositoryModule.name, () => {
   const backend = new InMemoryFirestoreBackend();
 
@@ -193,4 +205,161 @@ describe(FirestoreRepositoryModule.name, () => {
     expect(rows).toHaveLength(1);
     expect(total).toBe(2);
   });
+
+  it('applies every predicate when a branch also targets a document id', async () => {
+    const moduleRef = await Test.createTestingModule({
+      imports: [
+        FirestoreRepositoryModule.forFeature(
+          [
+            {
+              key: 'owned-widget',
+              entity: OwnedWidgetEntity,
+              collection: 'owned-widgets-id-filter',
+            },
+          ],
+          { backend: new InMemoryFirestoreBackend() },
+        ),
+      ],
+    }).compile();
+
+    const repo = moduleRef.get<RepositoryInterface<OwnedWidgetEntity>>(
+      getDynamicRepositoryToken('owned-widget'),
+    );
+
+    await repo.create({ id: 'private-1', title: 'Private', userId: 'actor-a' });
+
+    const hidden = await repo.findOne({
+      where: Where.and(
+        Where.eq<OwnedWidgetEntity>('id', 'private-1'),
+        Where.eq<OwnedWidgetEntity>('userId', 'actor-b'),
+      ),
+    });
+
+    expect(hidden).toBeNull();
+  });
+
+  it('supports id IN together with additional predicates', async () => {
+    const moduleRef = await Test.createTestingModule({
+      imports: [
+        FirestoreRepositoryModule.forFeature(
+          [
+            {
+              key: 'owned-widget',
+              entity: OwnedWidgetEntity,
+              collection: 'owned-widgets-id-in',
+            },
+          ],
+          { backend: new InMemoryFirestoreBackend() },
+        ),
+      ],
+    }).compile();
+
+    const repo = moduleRef.get<RepositoryInterface<OwnedWidgetEntity>>(
+      getDynamicRepositoryToken('owned-widget'),
+    );
+
+    await repo.create({ id: 'owned-a', title: 'A', userId: 'actor-a' });
+    await repo.create({ id: 'owned-b', title: 'B', userId: 'actor-b' });
+    await repo.create({ id: 'outside-set', title: 'C', userId: 'actor-a' });
+
+    const rows = await repo.find({
+      where: Where.and(
+        Where.in<OwnedWidgetEntity>('id', ['owned-a', 'owned-b']),
+        Where.eq<OwnedWidgetEntity>('userId', 'actor-a'),
+      ),
+    });
+
+    expect(rows.map((row) => row.id)).toEqual(['owned-a']);
+  });
+
+  it('returns the generated id from upsert', async () => {
+    const moduleRef = await Test.createTestingModule({
+      imports: [
+        FirestoreRepositoryModule.forFeature(
+          [
+            {
+              key: 'widget',
+              entity: WidgetEntity,
+              collection: 'widget-upsert',
+            },
+          ],
+          { backend: new InMemoryFirestoreBackend() },
+        ),
+      ],
+    }).compile();
+
+    const repo = moduleRef.get<RepositoryInterface<WidgetEntity>>(
+      getDynamicRepositoryToken('widget'),
+    );
+
+    const result = await repo.upsert({ title: 'Generated id' });
+
+    expect(result.id).toEqual(expect.any(String));
+    await expect(
+      repo.findOne({ where: Where.eq('id', result.id) }),
+    ).resolves.toMatchObject({ id: result.id, title: 'Generated id' });
+  });
+
+  it('rejects create when the document id already exists', async () => {
+    const moduleRef = await Test.createTestingModule({
+      imports: [
+        FirestoreRepositoryModule.forFeature(
+          [
+            {
+              key: 'widget',
+              entity: WidgetEntity,
+              collection: 'widget-duplicate-create',
+            },
+          ],
+          { backend: new InMemoryFirestoreBackend() },
+        ),
+      ],
+    }).compile();
+
+    const repo = moduleRef.get<RepositoryInterface<WidgetEntity>>(
+      getDynamicRepositoryToken('widget'),
+    );
+
+    await repo.create({ id: 'same-id', title: 'Original' });
+
+    await expect(
+      repo.create({ id: 'same-id', title: 'Replacement' }),
+    ).rejects.toThrow();
+    await expect(
+      repo.findOne({ where: Where.eq('id', 'same-id') }),
+    ).resolves.toMatchObject({ title: 'Original' });
+  });
+
+  it('uses every order clause as a deterministic tie-breaker', async () => {
+    const moduleRef = await Test.createTestingModule({
+      imports: [
+        FirestoreRepositoryModule.forFeature(
+          [
+            {
+              key: 'ordered-widget',
+              entity: OrderedWidgetEntity,
+              collection: 'ordered-widgets',
+            },
+          ],
+          { backend: new InMemoryFirestoreBackend() },
+        ),
+      ],
+    }).compile();
+
+    const repo = moduleRef.get<RepositoryInterface<OrderedWidgetEntity>>(
+      getDynamicRepositoryToken('ordered-widget'),
+    );
+
+    await repo.create({ id: 'rank-2', group: 'same', rank: 2 });
+    await repo.create({ id: 'rank-1', group: 'same', rank: 1 });
+
+    const rows = await repo.find({
+      order: [
+        { field: 'group', order: SortOrder.ASC },
+        { field: 'rank', order: SortOrder.ASC },
+      ],
+    });
+
+    expect(rows.map((row) => row.id)).toEqual(['rank-1', 'rank-2']);
+  });
 });
diff --git a/packages/rockets-repository-firestore/src/__tests__/firestore-value.spec.ts b/packages/rockets-repository-firestore/src/__tests__/firestore-value.spec.ts
new file mode 100644
index 000000000..8dfe101df
--- /dev/null
+++ b/packages/rockets-repository-firestore/src/__tests__/firestore-value.spec.ts
@@ -0,0 +1,87 @@
+import { describe, expect, it } from 'vitest';
+
+import { applyFirestoreFilters } from '../repository/firestore-row-filter';
+import { sortFirestoreRows } from '../repository/firestore-sort';
+import {
+  firestoreValuesEqual,
+  normalizeFirestoreValue,
+  readFirestoreField,
+} from '../repository/firestore-value';
+
+describe('local Firestore value semantics', () => {
+  it('distinguishes missing nested fields from explicit null', () => {
+    expect(
+      readFirestoreField({ profile: { name: null } }, 'profile.name'),
+    ).toEqual({
+      exists: true,
+      value: null,
+    });
+    expect(readFirestoreField({ profile: {} }, 'profile.name')).toEqual({
+      exists: false,
+      value: undefined,
+    });
+    expect(
+      applyFirestoreFilters(
+        [{ id: 'missing' }, { id: 'null', value: null }],
+        [{ field: 'value', op: '==', value: null }],
+      ).map((row) => row.id),
+    ).toEqual(['null']);
+  });
+
+  it('excludes missing, null, and cross-type values from inequalities', () => {
+    const rows = [
+      { id: 'missing' },
+      { id: 'null', value: null },
+      { id: 'string', value: '2' },
+      { id: 'number', value: 2 },
+    ];
+    expect(
+      applyFirestoreFilters(rows, [{ field: 'value', op: '>', value: 1 }]).map(
+        (row) => row.id,
+      ),
+    ).toEqual(['number']);
+    expect(
+      applyFirestoreFilters(rows, [{ field: 'value', op: '!=', value: 3 }]).map(
+        (row) => row.id,
+      ),
+    ).toEqual(['string', 'number']);
+  });
+
+  it('compares arrays, maps, bytes, dates, and SDK values structurally', () => {
+    expect(firestoreValuesEqual([1, { ok: true }], [1, { ok: true }])).toBe(
+      true,
+    );
+    expect(
+      firestoreValuesEqual(new Uint8Array([1, 2]), new Uint8Array([1, 2])),
+    ).toBe(true);
+    expect(firestoreValuesEqual(new Date(10), new Date(10))).toBe(true);
+    expect(
+      firestoreValuesEqual(
+        { isEqual: (other: unknown) => other === 'same' },
+        'same',
+      ),
+    ).toBe(true);
+  });
+
+  it('orders supported scalars and excludes missing ordered fields', () => {
+    const rows = [
+      { id: 'missing' },
+      { id: 'string', value: 'a' },
+      { id: 'number', value: 1 },
+      { id: 'true', value: true },
+      { id: 'null', value: null },
+    ];
+    expect(
+      sortFirestoreRows(rows, [{ field: 'value', direction: 'asc' }]).map(
+        (row) => row.id,
+      ),
+    ).toEqual(['null', 'true', 'number', 'string']);
+  });
+
+  it('normalizes timestamps recursively', () => {
+    const date = new Date('2026-01-01T00:00:00.000Z');
+    expect(
+      normalizeFirestoreValue({ nested: [{ at: { toDate: () => date } }] }),
+    ).toEqual({ nested: [{ at: date }] });
+  });
+});
diff --git a/packages/rockets-repository-firestore/src/__tests__/firestore-where.translator.spec.ts b/packages/rockets-repository-firestore/src/__tests__/firestore-where.translator.spec.ts
index c757cb80a..10def99c7 100644
--- a/packages/rockets-repository-firestore/src/__tests__/firestore-where.translator.spec.ts
+++ b/packages/rockets-repository-firestore/src/__tests__/firestore-where.translator.spec.ts
@@ -25,6 +25,33 @@ describe('firestore-where.translator', () => {
     ]);
   });
 
+  it('maps id IN to direct document lookups', () => {
+    const branch = translateDnfBranch([Where.in('id', ['doc-1', 'doc-2'])]);
+
+    expect(branch.documentIds).toEqual(['doc-1', 'doc-2']);
+    expect(branch.filters).toEqual([]);
+  });
+
+  it('intersects multiple document-id predicates in an AND branch', () => {
+    const branch = translateDnfBranch([
+      Where.in('id', ['doc-1', 'doc-2']),
+      Where.eq('id', 'doc-2'),
+    ]);
+
+    expect(branch.documentId).toBe('doc-2');
+    expect(branch.documentIds).toBeUndefined();
+  });
+
+  it('represents a contradictory document-id branch as an empty lookup', () => {
+    const branch = translateDnfBranch([
+      Where.in('id', ['doc-1']),
+      Where.eq('id', 'doc-2'),
+    ]);
+
+    expect(branch.documentIds).toEqual([]);
+    expect(branch.documentId).toBeUndefined();
+  });
+
   it('maps IS_NULL to post-filter', () => {
     const branch = translateDnfBranch([Where.isNull('note')]);
     expect(branch.postFilters).toEqual([{ kind: 'is_null', field: 'note' }]);
diff --git a/packages/rockets-repository-firestore/src/backends/admin-firestore.backend.ts b/packages/rockets-repository-firestore/src/backends/admin-firestore.backend.ts
index 282877862..76607aa65 100644
--- a/packages/rockets-repository-firestore/src/backends/admin-firestore.backend.ts
+++ b/packages/rockets-repository-firestore/src/backends/admin-firestore.backend.ts
@@ -1,7 +1,6 @@
 import { getApp } from 'firebase-admin/app';
 import {
   getFirestore,
-  Timestamp,
   type DocumentData,
   type Query,
 } from 'firebase-admin/firestore';
@@ -16,6 +15,9 @@ import type {
   FirestoreQueryBranch,
 } from '../interfaces/firestore-query.interface';
 import { applyFirestorePostFilters } from '../repository/firestore-post-filter';
+import { applyFirestoreFilters } from '../repository/firestore-row-filter';
+import { sortFirestoreRows } from '../repository/firestore-sort';
+import { normalizeFirestoreValue } from '../repository/firestore-value';
 
 export class AdminFirestoreBackend implements FirestoreBackend {
   private db() {
@@ -45,6 +47,17 @@ export class AdminFirestoreBackend implements FirestoreBackend {
       .set(this.serialise(data), { merge });
   }
 
+  async create(
+    collection: string,
+    documentId: string,
+    data: Record<string, unknown>,
+  ): Promise<void> {
+    await this.db()
+      .collection(collection)
+      .doc(documentId)
+      .create(this.serialise(data));
+  }
+
   async delete(collection: string, documentId: string): Promise<void> {
     await this.db().collection(collection).doc(documentId).delete();
   }
@@ -57,13 +70,13 @@ export class AdminFirestoreBackend implements FirestoreBackend {
     const skip = options.skip ?? 0;
     const take = options.take;
 
-    if (
-      branch.documentId ||
-      (branch.documentIds && branch.documentIds.length > 0)
-    ) {
+    if (branch.documentId || branch.documentIds !== undefined) {
       const rows = await this.loadBranchRows(collection, branch);
-      const filtered = applyFirestorePostFilters(rows, branch.postFilters);
-      const ordered = this.sortRows(filtered, options.orderBy);
+      const filtered = applyFirestorePostFilters(
+        applyFirestoreFilters(rows, branch.filters),
+        branch.postFilters,
+      );
+      const ordered = sortFirestoreRows(filtered, options.orderBy);
       const sliced = ordered.slice(skip);
       return typeof take === 'number' && take > 0
         ? sliced.slice(0, take)
@@ -103,10 +116,13 @@ export class AdminFirestoreBackend implements FirestoreBackend {
     if (
       branch.postFilters.length > 0 ||
       branch.documentId ||
-      (branch.documentIds && branch.documentIds.length > 0)
+      branch.documentIds !== undefined
     ) {
       const rows = await this.loadBranchRows(collection, branch);
-      return applyFirestorePostFilters(rows, branch.postFilters).length;
+      return applyFirestorePostFilters(
+        applyFirestoreFilters(rows, branch.filters),
+        branch.postFilters,
+      ).length;
     }
 
     const query = this.buildCollectionQuery(collection, branch);
@@ -123,7 +139,7 @@ export class AdminFirestoreBackend implements FirestoreBackend {
       return row ? [row] : [];
     }
 
-    if (branch.documentIds && branch.documentIds.length > 0) {
+    if (branch.documentIds !== undefined) {
       const rows: Record<string, unknown>[] = [];
       for (const documentId of branch.documentIds) {
         const row = await this.get(collection, documentId);
@@ -170,41 +186,6 @@ export class AdminFirestoreBackend implements FirestoreBackend {
     return query;
   }
 
-  private sortRows(
-    rows: Record<string, unknown>[],
-    orderBy?: readonly FirestoreOrderBy[],
-  ): Record<string, unknown>[] {
-    if (!orderBy || orderBy.length === 0) {
-      return rows;
-    }
-
-    const clause = orderBy[0];
-    const desc = clause.direction === 'desc';
-
-    return [...rows].sort((left, right) => {
-      const a = left[clause.field];
-      const b = right[clause.field];
-      if (a === b) {
-        return 0;
-      }
-      if (a === undefined || a === null) {
-        return 1;
-      }
-      if (b === undefined || b === null) {
-        return -1;
-      }
-      const aTime = toSortableTime(a);
-      const bTime = toSortableTime(b);
-      if (!Number.isNaN(aTime) && !Number.isNaN(bTime)) {
-        return desc ? bTime - aTime : aTime - bTime;
-      }
-      if (typeof a === 'string' && typeof b === 'string') {
-        return desc ? b.localeCompare(a) : a.localeCompare(b);
-      }
-      return desc ? (a < b ? 1 : -1) : a > b ? 1 : -1;
-    });
-  }
-
   /**
    * `Date` goes to the SDK untouched: Firestore stores it as a native
    * `Timestamp`, which {@link normalise} converts straight back to a
@@ -224,18 +205,8 @@ export class AdminFirestoreBackend implements FirestoreBackend {
     }
     const next: Record<string, unknown> = { id: documentId };
     for (const [key, value] of Object.entries(data)) {
-      next[key] = value instanceof Timestamp ? value.toDate() : value;
+      next[key] = normalizeFirestoreValue(value);
     }
     return next;
   }
 }
-
-function toSortableTime(value: unknown): number {
-  if (value instanceof Date) {
-    return value.getTime();
-  }
-  if (typeof value === 'string') {
-    return Date.parse(value);
-  }
-  return Number.NaN;
-}
diff --git a/packages/rockets-repository-firestore/src/backends/in-memory-firestore.backend.ts b/packages/rockets-repository-firestore/src/backends/in-memory-firestore.backend.ts
index eeaaba3d8..24b979ec0 100644
--- a/packages/rockets-repository-firestore/src/backends/in-memory-firestore.backend.ts
+++ b/packages/rockets-repository-firestore/src/backends/in-memory-firestore.backend.ts
@@ -2,11 +2,10 @@ import type {
   FirestoreBackend,
   FirestoreBranchQueryOptions,
 } from '../interfaces/firestore-backend.interface';
-import type {
-  FirestoreQueryBranch,
-  FirestoreQueryFilter,
-} from '../interfaces/firestore-query.interface';
+import type { FirestoreQueryBranch } from '../interfaces/firestore-query.interface';
 import { applyFirestorePostFilters } from '../repository/firestore-post-filter';
+import { applyFirestoreFilters } from '../repository/firestore-row-filter';
+import { sortFirestoreRows } from '../repository/firestore-sort';
 
 /**
  * In-memory Firestore backend for unit tests and explicit test harnesses.
@@ -55,6 +54,20 @@ export class InMemoryFirestoreBackend implements FirestoreBackend {
     );
   }
 
+  async create(
+    collection: string,
+    documentId: string,
+    data: Record<string, unknown>,
+  ): Promise<void> {
+    const store = this.collectionStore(collection);
+    if (store.has(documentId)) {
+      throw new Error(
+        `Firestore document "${collection}/${documentId}" already exists.`,
+      );
+    }
+    store.set(documentId, { ...data, id: documentId });
+  }
+
   async delete(collection: string, documentId: string): Promise<void> {
     this.collectionStore(collection).delete(documentId);
   }
@@ -65,10 +78,10 @@ export class InMemoryFirestoreBackend implements FirestoreBackend {
   ): Promise<Record<string, unknown>[]> {
     const rows = await this.loadBranchRows(collection, options.branch);
     const filtered = applyFirestorePostFilters(
-      rows,
+      applyFirestoreFilters(rows, options.branch.filters),
       options.branch.postFilters,
     );
-    const ordered = sortInMemory(filtered, options.orderBy);
+    const ordered = sortFirestoreRows(filtered, options.orderBy);
 
     const sliced = ordered.slice(options.skip ?? 0);
     if (typeof options.take === 'number' && options.take > 0) {
@@ -82,7 +95,10 @@ export class InMemoryFirestoreBackend implements FirestoreBackend {
     branch: FirestoreQueryBranch,
   ): Promise<number> {
     const rows = await this.loadBranchRows(collection, branch);
-    const filtered = applyFirestorePostFilters(rows, branch.postFilters);
+    const filtered = applyFirestorePostFilters(
+      applyFirestoreFilters(rows, branch.filters),
+      branch.postFilters,
+    );
     return filtered.length;
   }
 
@@ -95,7 +111,7 @@ export class InMemoryFirestoreBackend implements FirestoreBackend {
       return row ? [row] : [];
     }
 
-    if (branch.documentIds && branch.documentIds.length > 0) {
+    if (branch.documentIds !== undefined) {
       const rows: Record<string, unknown>[] = [];
       for (const documentId of branch.documentIds) {
         const row = await this.get(collection, documentId);
@@ -106,97 +122,6 @@ export class InMemoryFirestoreBackend implements FirestoreBackend {
       return rows;
     }
 
-    const rows = [...this.collectionStore(collection).values()];
-    return rows.filter((row) =>
-      branch.filters.every((filter) => matchesFilter(row, filter)),
-    );
-  }
-}
-
-function matchesFilter(
-  row: Record<string, unknown>,
-  filter: FirestoreQueryFilter,
-): boolean {
-  const value = row[filter.field];
-  switch (filter.op) {
-    case '==':
-      return value === filter.value;
-    case '!=':
-      return value !== filter.value;
-    case '<':
-      return compare(value, filter.value) < 0;
-    case '<=':
-      return compare(value, filter.value) <= 0;
-    case '>':
-      return compare(value, filter.value) > 0;
-    case '>=':
-      return compare(value, filter.value) >= 0;
-    case 'in':
-      return (
-        Array.isArray(filter.value) &&
-        filter.value.some((candidate) => candidate === value)
-      );
-    case 'not-in':
-      return (
-        Array.isArray(filter.value) &&
-        !filter.value.some((candidate) => candidate === value)
-      );
-    case 'array-contains':
-      return Array.isArray(value) && value.includes(filter.value);
-    default: {
-      const _exhaustive: never = filter.op;
-      return _exhaustive;
-    }
-  }
-}
-
-function compare(left: unknown, right: unknown): number {
-  const a = toComparable(left);
-  const b = toComparable(right);
-  if (a === undefined || b === undefined) {
-    return -1;
+    return [...this.collectionStore(collection).values()];
   }
-  if (a < b) {
-    return -1;
-  }
-  if (a > b) {
-    return 1;
-  }
-  return 0;
-}
-
-function toComparable(value: unknown): number | string | undefined {
-  if (value instanceof Date) {
-    return value.getTime();
-  }
-  if (typeof value === 'number' || typeof value === 'string') {
-    return value;
-  }
-  return undefined;
-}
-
-function sortInMemory(
-  rows: Record<string, unknown>[],
-  orderBy?: FirestoreBranchQueryOptions['orderBy'],
-): Record<string, unknown>[] {
-  if (!orderBy || orderBy.length === 0) {
-    return rows;
-  }
-  const clause = orderBy[0];
-  const desc = clause.direction === 'desc';
-  return [...rows].sort((left, right) => {
-    const a = left[clause.field];
-    const b = right[clause.field];
-    if (a === b) {
-      return 0;
-    }
-    if (a === undefined || a === null) {
-      return 1;
-    }
-    if (b === undefined || b === null) {
-      return -1;
-    }
-    const cmp = compare(a, b);
-    return desc ? -cmp : cmp;
-  });
 }
diff --git a/packages/rockets-repository-firestore/src/integration/define-firestore-repository.ts b/packages/rockets-repository-firestore/src/integration/define-firestore-repository.ts
index 1ebace977..b3b343f50 100644
--- a/packages/rockets-repository-firestore/src/integration/define-firestore-repository.ts
+++ b/packages/rockets-repository-firestore/src/integration/define-firestore-repository.ts
@@ -9,7 +9,7 @@ import { FirestoreRepositoryModule } from '../firestore-repository.module';
 import type { DefineFirestoreRepositoryOptions } from './define-firestore-repository.config';
 
 /**
- * Same contract as app-local `defineTypeOrmRepository`: returns a
+ * Same contract as `defineTypeOrmRepository` from the TypeORM adapter: returns a
  * {@link RepositoryBootstrap} Rockets calls `forRoot` / `forFeature`.
  *
  * Does not read environment variables or pick a backend — the app must
diff --git a/packages/rockets-repository-firestore/src/interfaces/firestore-backend.interface.ts b/packages/rockets-repository-firestore/src/interfaces/firestore-backend.interface.ts
index 9f8767851..73b2376dd 100644
--- a/packages/rockets-repository-firestore/src/interfaces/firestore-backend.interface.ts
+++ b/packages/rockets-repository-firestore/src/interfaces/firestore-backend.interface.ts
@@ -21,6 +21,12 @@ export interface FirestoreBackend {
     collection: string,
     documentId: string,
   ): Promise<Record<string, unknown> | null>;
+  /** Atomically create a document and reject when its id already exists. */
+  create(
+    collection: string,
+    documentId: string,
+    data: Record<string, unknown>,
+  ): Promise<void>;
   set(
     collection: string,
     documentId: string,
diff --git a/packages/rockets-repository-firestore/src/repository/firestore-post-filter.ts b/packages/rockets-repository-firestore/src/repository/firestore-post-filter.ts
index cee3a927c..128bf270d 100644
--- a/packages/rockets-repository-firestore/src/repository/firestore-post-filter.ts
+++ b/packages/rockets-repository-firestore/src/repository/firestore-post-filter.ts
@@ -1,4 +1,10 @@
 import type { FirestorePostFilter } from '../interfaces/firestore-query.interface';
+import {
+  compareFirestoreValues,
+  firestoreValuesEqual,
+  readFirestoreField,
+  sameFirestoreRangeType,
+} from './firestore-value';
 
 export function applyFirestorePostFilters(
   rows: readonly Record<string, unknown>[],
@@ -17,13 +23,14 @@ function matchesPostFilter(
   row: Record<string, unknown>,
   filter: FirestorePostFilter,
 ): boolean {
-  const value = row[filter.field];
+  const field = readFirestoreField(row, filter.field);
+  const value = field.value;
 
   switch (filter.kind) {
     case 'is_null':
-      return value === null || value === undefined;
+      return field.exists && value === null;
     case 'is_not_null':
-      return value !== null && value !== undefined;
+      return field.exists && value !== null;
     case 'contains':
       return containsValue(value, filter.value);
     case 'not_contains':
@@ -37,7 +44,13 @@ function matchesPostFilter(
     case 'not_ends':
       return typeof value !== 'string' || !value.endsWith(filter.value);
     case 'nin':
-      return !filter.values.some((candidate) => candidate === value);
+      return (
+        field.exists &&
+        value !== null &&
+        !filter.values.some((candidate) =>
+          firestoreValuesEqual(candidate, value),
+        )
+      );
     case 'between':
       return compareBetween(value, filter.min, filter.max);
     case 'soft_delete_excluded':
@@ -59,25 +72,11 @@ function containsValue(fieldValue: unknown, needle: string): boolean {
 }
 
 function compareBetween(value: unknown, min: unknown, max: unknown): boolean {
-  const sortable = toComparable(value);
-  const minComparable = toComparable(min);
-  const maxComparable = toComparable(max);
-  if (
-    sortable === undefined ||
-    minComparable === undefined ||
-    maxComparable === undefined
-  ) {
-    return false;
-  }
-  return sortable >= minComparable && sortable <= maxComparable;
-}
-
-function toComparable(value: unknown): number | string | undefined {
-  if (value instanceof Date) {
-    return value.getTime();
-  }
-  if (typeof value === 'number' || typeof value === 'string') {
-    return value;
-  }
-  return undefined;
+  return (
+    value !== null &&
+    sameFirestoreRangeType(value, min) &&
+    sameFirestoreRangeType(value, max) &&
+    compareFirestoreValues(value, min) >= 0 &&
+    compareFirestoreValues(value, max) <= 0
+  );
 }
diff --git a/packages/rockets-repository-firestore/src/repository/firestore-query-runner.ts b/packages/rockets-repository-firestore/src/repository/firestore-query-runner.ts
index d27a622a0..dfb4d840a 100644
--- a/packages/rockets-repository-firestore/src/repository/firestore-query-runner.ts
+++ b/packages/rockets-repository-firestore/src/repository/firestore-query-runner.ts
@@ -1,10 +1,10 @@
 import type { FirestoreBackend } from '../interfaces/firestore-backend.interface';
 import type {
-  FirestoreOrderBy,
   FirestorePostFilter,
   FirestoreQueryBranch,
   FirestoreQueryRequest,
 } from '../interfaces/firestore-query.interface';
+import { sortFirestoreRows } from './firestore-sort';
 
 export async function runFirestoreQuery(
   backend: FirestoreBackend,
@@ -43,7 +43,7 @@ export async function runFirestoreQuery(
   let results = [...merged.values()];
 
   if (!pushToServer) {
-    results = sortRows(results, request.orderBy);
+    results = sortFirestoreRows(results, request.orderBy);
     if (typeof request.skip === 'number' && request.skip > 0) {
       results = results.slice(request.skip);
     }
@@ -107,48 +107,3 @@ function readDocumentId(row: Record<string, unknown>): string | undefined {
   const id = row.id;
   return typeof id === 'string' && id.length > 0 ? id : undefined;
 }
-
-function sortRows(
-  rows: Record<string, unknown>[],
-  orderBy?: readonly FirestoreOrderBy[],
-): Record<string, unknown>[] {
-  if (!orderBy || orderBy.length === 0) {
-    return rows;
-  }
-
-  const clause = orderBy[0];
-  const desc = clause.direction === 'desc';
-
-  return [...rows].sort((left, right) => {
-    const a = left[clause.field];
-    const b = right[clause.field];
-    if (a === b) {
-      return 0;
-    }
-    if (a === undefined || a === null) {
-      return 1;
-    }
-    if (b === undefined || b === null) {
-      return -1;
-    }
-    const aTime = toSortableTime(a);
-    const bTime = toSortableTime(b);
-    if (!Number.isNaN(aTime) && !Number.isNaN(bTime)) {
-      return desc ? bTime - aTime : aTime - bTime;
-    }
-    if (typeof a === 'string' && typeof b === 'string') {
-      return desc ? b.localeCompare(a) : a.localeCompare(b);
-    }
-    return desc ? (a < b ? 1 : -1) : a > b ? 1 : -1;
-  });
-}
-
-function toSortableTime(value: unknown): number {
-  if (value instanceof Date) {
-    return value.getTime();
-  }
-  if (typeof value === 'string') {
-    return Date.parse(value);
-  }
-  return Number.NaN;
-}
diff --git a/packages/rockets-repository-firestore/src/repository/firestore-repository.ts b/packages/rockets-repository-firestore/src/repository/firestore-repository.ts
index c583b3301..e3f79f633 100644
--- a/packages/rockets-repository-firestore/src/repository/firestore-repository.ts
+++ b/packages/rockets-repository-firestore/src/repository/firestore-repository.ts
@@ -98,7 +98,7 @@ export class FirestoreRepository<
   ): Promise<Entity> {
     const id = this.resolveId(entity);
     const stored = this.toStore({ ...entity, id } as DeepPartial<Entity>);
-    await this.options.backend.set(this.options.collection, id, stored, false);
+    await this.options.backend.create(this.options.collection, id, stored);
     return this.fromStore(stored);
   }
 
@@ -129,7 +129,7 @@ export class FirestoreRepository<
     _options?: RepositoryUpsertOptions,
   ): Promise<Entity> {
     const id = this.resolveId(entity);
-    const stored = this.toStore(entity);
+    const stored = this.toStore({ ...entity, id } as DeepPartial<Entity>);
     await this.options.backend.set(this.options.collection, id, stored, true);
     return this.fromStore(stored);
   }
diff --git a/packages/rockets-repository-firestore/src/repository/firestore-row-filter.ts b/packages/rockets-repository-firestore/src/repository/firestore-row-filter.ts
new file mode 100644
index 000000000..b304c58b0
--- /dev/null
+++ b/packages/rockets-repository-firestore/src/repository/firestore-row-filter.ts
@@ -0,0 +1,102 @@
+import type { FirestoreQueryFilter } from '../interfaces/firestore-query.interface';
+import {
+  compareFirestoreValues,
+  firestoreValuesEqual,
+  readFirestoreField,
+  sameFirestoreRangeType,
+} from './firestore-value';
+
+/** Apply the non-post-filter predicates that Firestore would normally execute. */
+export function applyFirestoreFilters(
+  rows: readonly Record<string, unknown>[],
+  filters: readonly FirestoreQueryFilter[],
+): Record<string, unknown>[] {
+  if (filters.length === 0) return [...rows];
+  return rows.filter((row) => filters.every((filter) => matches(row, filter)));
+}
+
+function matches(
+  row: Record<string, unknown>,
+  filter: FirestoreQueryFilter,
+): boolean {
+  const field = readFirestoreField(row, filter.field);
+  const value = field.value;
+  switch (filter.op) {
+    case '==':
+      return field.exists && firestoreValuesEqual(value, filter.value);
+    case '!=':
+      return (
+        field.exists &&
+        value !== null &&
+        !firestoreValuesEqual(value, filter.value)
+      );
+    case '<':
+      return rangeMatch(
+        field.exists,
+        value,
+        filter.value,
+        (result) => result < 0,
+      );
+    case '<=':
+      return rangeMatch(
+        field.exists,
+        value,
+        filter.value,
+        (result) => result <= 0,
+      );
+    case '>':
+      return rangeMatch(
+        field.exists,
+        value,
+        filter.value,
+        (result) => result > 0,
+      );
+    case '>=':
+      return rangeMatch(
+        field.exists,
+        value,
+        filter.value,
+        (result) => result >= 0,
+      );
+    case 'in':
+      return (
+        field.exists &&
+        Array.isArray(filter.value) &&
+        filter.value.some((candidate) => firestoreValuesEqual(value, candidate))
+      );
+    case 'not-in':
+      return (
+        field.exists &&
+        value !== null &&
+        Array.isArray(filter.value) &&
+        !filter.value.some((candidate) =>
+          firestoreValuesEqual(value, candidate),
+        )
+      );
+    case 'array-contains':
+      return (
+        field.exists &&
+        Array.isArray(value) &&
+        value.some((candidate) => firestoreValuesEqual(candidate, filter.value))
+      );
+    default: {
+      const exhaustive: never = filter.op;
+      return exhaustive;
+    }
+  }
+}
+
+function rangeMatch(
+  exists: boolean,
+  value: unknown,
+  candidate: unknown,
+  predicate: (result: number) => boolean,
+): boolean {
+  return (
+    exists &&
+    value !== null &&
+    candidate !== null &&
+    sameFirestoreRangeType(value, candidate) &&
+    predicate(compareFirestoreValues(value, candidate))
+  );
+}
diff --git a/packages/rockets-repository-firestore/src/repository/firestore-sort.ts b/packages/rockets-repository-firestore/src/repository/firestore-sort.ts
new file mode 100644
index 000000000..2a2e903d3
--- /dev/null
+++ b/packages/rockets-repository-firestore/src/repository/firestore-sort.ts
@@ -0,0 +1,26 @@
+import type { FirestoreOrderBy } from '../interfaces/firestore-query.interface';
+import { compareFirestoreValues, readFirestoreField } from './firestore-value';
+
+/** Sort rows by every declared clause, in order, so later clauses break ties. */
+export function sortFirestoreRows(
+  rows: readonly Record<string, unknown>[],
+  orderBy?: readonly FirestoreOrderBy[],
+): Record<string, unknown>[] {
+  if (!orderBy || orderBy.length === 0) return [...rows];
+
+  const present = rows.filter((row) =>
+    orderBy.every((clause) => readFirestoreField(row, clause.field).exists),
+  );
+
+  return [...present].sort((left, right) => {
+    for (const clause of orderBy) {
+      const leftValue = readFirestoreField(left, clause.field).value;
+      const rightValue = readFirestoreField(right, clause.field).value;
+      const result = compareFirestoreValues(leftValue, rightValue);
+      if (result !== 0) {
+        return clause.direction === 'desc' ? -result : result;
+      }
+    }
+    return 0;
+  });
+}
diff --git a/packages/rockets-repository-firestore/src/repository/firestore-value.ts b/packages/rockets-repository-firestore/src/repository/firestore-value.ts
new file mode 100644
index 000000000..f6356f6de
--- /dev/null
+++ b/packages/rockets-repository-firestore/src/repository/firestore-value.ts
@@ -0,0 +1,158 @@
+export interface FirestoreFieldValue {
+  readonly exists: boolean;
+  readonly value: unknown;
+}
+
+/** Read a dotted Firestore field path while preserving missing-vs-null. */
+export function readFirestoreField(
+  row: Record<string, unknown>,
+  field: string,
+): FirestoreFieldValue {
+  let current: unknown = row;
+  for (const segment of field.split('.')) {
+    if (
+      !isPlainMap(current) ||
+      !Object.prototype.hasOwnProperty.call(current, segment)
+    ) {
+      return { exists: false, value: undefined };
+    }
+    current = current[segment];
+    if (current === undefined) return { exists: false, value: undefined };
+  }
+  return { exists: true, value: current };
+}
+
+/** Compare values in the scalar subset supported by local ordering. */
+export function compareFirestoreValues(left: unknown, right: unknown): number {
+  const a = sortable(left);
+  const b = sortable(right);
+  if (!a || !b) {
+    throw new Error(
+      `Firestore local ordering supports only null, boolean, number, timestamp, and string values; received ${describeValue(
+        !a ? left : right,
+      )}.`,
+    );
+  }
+  if (a.rank !== b.rank) return a.rank < b.rank ? -1 : 1;
+  if (a.value === b.value) return 0;
+  return a.value < b.value ? -1 : 1;
+}
+
+/** Structural equality for Firestore values used by local query paths. */
+export function firestoreValuesEqual(left: unknown, right: unknown): boolean {
+  if (Object.is(left, right)) return true;
+  if (isEqualValue(left)) return left.isEqual(right);
+  if (isEqualValue(right)) return right.isEqual(left);
+
+  const leftDate = asDate(left);
+  const rightDate = asDate(right);
+  if (leftDate && rightDate) return leftDate.getTime() === rightDate.getTime();
+
+  if (isBytes(left) && isBytes(right)) {
+    if (left.byteLength !== right.byteLength) return false;
+    return left.every((value, index) => value === right[index]);
+  }
+  if (Array.isArray(left) && Array.isArray(right)) {
+    return (
+      left.length === right.length &&
+      left.every((value, index) => firestoreValuesEqual(value, right[index]))
+    );
+  }
+  if (isPlainMap(left) && isPlainMap(right)) {
+    const leftKeys = Object.keys(left).sort();
+    const rightKeys = Object.keys(right).sort();
+    return (
+      leftKeys.length === rightKeys.length &&
+      leftKeys.every(
+        (key, index) =>
+          key === rightKeys[index] &&
+          firestoreValuesEqual(left[key], right[key]),
+      )
+    );
+  }
+  return false;
+}
+
+/** Recursively convert Firestore timestamp-like SDK values to Date. */
+export function normalizeFirestoreValue(value: unknown): unknown {
+  const date = asDate(value);
+  if (date) return date;
+  if (Array.isArray(value)) return value.map(normalizeFirestoreValue);
+  if (isPlainMap(value)) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, child]) => [
+        key,
+        normalizeFirestoreValue(child),
+      ]),
+    );
+  }
+  return value;
+}
+
+export function sameFirestoreRangeType(left: unknown, right: unknown): boolean {
+  return (
+    scalarKind(left) !== undefined && scalarKind(left) === scalarKind(right)
+  );
+}
+
+function sortable(
+  value: unknown,
+): { rank: number; value: number | string } | undefined {
+  if (value === null) return { rank: 0, value: 0 };
+  if (typeof value === 'boolean') return { rank: 1, value: value ? 1 : 0 };
+  if (typeof value === 'number') return { rank: 2, value };
+  const date = asDate(value);
+  if (date) return { rank: 3, value: date.getTime() };
+  if (typeof value === 'string') return { rank: 4, value };
+  return undefined;
+}
+
+function scalarKind(value: unknown): string | undefined {
+  if (typeof value === 'boolean') return 'boolean';
+  if (typeof value === 'number') return 'number';
+  if (asDate(value)) return 'timestamp';
+  if (typeof value === 'string') return 'string';
+  return undefined;
+}
+
+function asDate(value: unknown): Date | undefined {
+  if (value instanceof Date) return value;
+  if (
+    typeof value === 'object' &&
+    value !== null &&
+    'toDate' in value &&
+    typeof value.toDate === 'function'
+  ) {
+    const date = value.toDate();
+    return date instanceof Date ? date : undefined;
+  }
+  return undefined;
+}
+
+function isPlainMap(value: unknown): value is Record<string, unknown> {
+  if (typeof value !== 'object' || value === null || Array.isArray(value))
+    return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+function isBytes(value: unknown): value is Uint8Array {
+  return value instanceof Uint8Array;
+}
+
+function isEqualValue(
+  value: unknown,
+): value is { isEqual(other: unknown): boolean } {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    'isEqual' in value &&
+    typeof value.isEqual === 'function'
+  );
+}
+
+function describeValue(value: unknown): string {
+  if (value === null) return 'null';
+  if (Array.isArray(value)) return 'array';
+  return typeof value;
+}
diff --git a/packages/rockets-repository-firestore/src/repository/firestore-where.translator.ts b/packages/rockets-repository-firestore/src/repository/firestore-where.translator.ts
index 4792e5703..e6edbbbdc 100644
--- a/packages/rockets-repository-firestore/src/repository/firestore-where.translator.ts
+++ b/packages/rockets-repository-firestore/src/repository/firestore-where.translator.ts
@@ -73,17 +73,18 @@ function mergeAndBranch(
 ): FirestoreQueryBranch {
   const merged: FirestoreQueryFilter[] = [];
   const postFilters: FirestorePostFilter[] = [];
-  let documentId: string | undefined;
+  let candidateDocumentIds: string[] | undefined;
 
   for (const child of conditions) {
     if (isWhereCondition(child)) {
       const branch = translateCondition(child);
-      if (branch.documentId) {
-        documentId = branch.documentId;
-      }
-      if (branch.documentIds) {
-        throw new Error(
-          'Firestore adapter: documentIds in an AND branch is not supported — restructure the where clause.',
+      const childDocumentIds = branch.documentId
+        ? [branch.documentId]
+        : branch.documentIds;
+      if (childDocumentIds !== undefined) {
+        candidateDocumentIds = intersectDocumentIds(
+          candidateDocumentIds,
+          childDocumentIds,
         );
       }
       merged.push(...branch.filters);
@@ -97,13 +98,30 @@ function mergeAndBranch(
 
   assertFirestoreFilterRules(merged);
 
+  const documentSelector =
+    candidateDocumentIds === undefined
+      ? {}
+      : candidateDocumentIds.length === 1
+      ? { documentId: candidateDocumentIds[0] }
+      : { documentIds: candidateDocumentIds };
+
   return {
-    documentId,
+    ...documentSelector,
     filters: merged,
     postFilters,
   };
 }
 
+function intersectDocumentIds(
+  current: readonly string[] | undefined,
+  incoming: readonly string[],
+): string[] {
+  const uniqueIncoming = [...new Set(incoming)];
+  if (current === undefined) return uniqueIncoming;
+  const allowed = new Set(uniqueIncoming);
+  return current.filter((id) => allowed.has(id));
+}
+
 function readScalarValue(condition: WhereConditionScalar): unknown {
   return condition.value;
 }
diff --git a/packages/rockets-repository-firestore/tsconfig.json b/packages/rockets-repository-firestore/tsconfig.json
index 440e70a25..70a676311 100644
--- a/packages/rockets-repository-firestore/tsconfig.json
+++ b/packages/rockets-repository-firestore/tsconfig.json
@@ -8,7 +8,7 @@
     "composite": true
   },
   "include": ["src/**/*.ts"],
-  "exclude": ["**/*.spec.ts"],
+  "exclude": ["**/*.spec.ts", "**/*.emulator-spec.ts"],
   "references": [
     { "path": "../rockets-core" }
   ]
diff --git a/packages/rockets-repository-typeorm/CHANGELOG.md b/packages/rockets-repository-typeorm/CHANGELOG.md
new file mode 100644
index 000000000..862b1deea
--- /dev/null
+++ b/packages/rockets-repository-typeorm/CHANGELOG.md
@@ -0,0 +1,12 @@
+# Changelog
+
+## Unreleased
+
+### Added
+
+- `defineTypeOrmRepository()`, the adapter-owned `RepositoryBootstrap` that
+  combines connection options with the Rockets planner's entity list.
+
+### Changed
+
+- Node.js 20 is the minimum supported runtime.
diff --git a/packages/rockets-repository-typeorm/README.md b/packages/rockets-repository-typeorm/README.md
index 55825a37a..1c33daa40 100644
--- a/packages/rockets-repository-typeorm/README.md
+++ b/packages/rockets-repository-typeorm/README.md
@@ -8,10 +8,11 @@ TypeORM implementation of the Rockets dynamic repository contract.
 
 This is a **thin wrapper** over
 [`@concepta/nestjs-repository-typeorm`](https://www.npmjs.com/package/@concepta/nestjs-repository-typeorm):
-the main entry re-exports the upstream package verbatim, so consumers depend
-on a single `@concepta/*` package instead of reaching for the upstream one
-directly. The Rockets-specific addition — the zod `SchemaEntityCompiler` —
-lives at the `/zod` subpath and is the only code this package owns.
+the main entry re-exports the upstream package, so consumers depend on a single
+`@concepta/*` package instead of reaching for the upstream one directly. It
+also owns the Rockets bootstrap that combines TypeORM connection options with
+the planner-derived entity list. The zod `SchemaEntityCompiler` lives at the
+`/zod` subpath.
 
 ## Install
 
@@ -19,7 +20,24 @@ lives at the `/zod` subpath and is the only code this package owns.
 npm install @concepta/rockets-repository-typeorm typeorm
 ```
 
-## Repository module
+## Repository bootstrap
+
+Use one bootstrap at the server boundary. Rockets derives the entity list from
+the resources, so the connection never repeats it:
+
+```ts
+import { createServer } from '@concepta/rockets';
+import { defineTypeOrmRepository } from '@concepta/rockets-repository-typeorm';
+
+const repository = defineTypeOrmRepository({
+  type: 'postgres',
+  url: process.env.DATABASE_URL,
+});
+
+createServer({ repository, resources });
+```
+
+For lower-level module registration, the upstream exports remain available:
 
 ```ts
 import { TypeOrmRepositoryModule } from '@concepta/rockets-repository-typeorm';
@@ -47,6 +65,8 @@ export const { zodResource, zodSubResource } =
 `zod` and `nestjs-zod` are **optional peers** — you only pay for them if you
 import the `/zod` subpath.
 
+Requires Node.js 20 or newer.
+
 ## License
 
 BSD-3-Clause
diff --git a/packages/rockets-repository-typeorm/package.json b/packages/rockets-repository-typeorm/package.json
index 780aeebfc..8ed8a8ff3 100644
--- a/packages/rockets-repository-typeorm/package.json
+++ b/packages/rockets-repository-typeorm/package.json
@@ -36,13 +36,13 @@
     "directory": "packages/rockets-repository-typeorm"
   },
   "engines": {
-    "node": ">=18.0.0",
-    "npm": ">=8.0.0"
+    "node": ">=20.0.0"
   },
   "files": [
     "dist/**/!(*.spec|*.e2e-spec|*.fixture).{js,d.ts}",
     "README.md",
-    "LICENSE.txt"
+    "LICENSE.txt",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "clean": "rimraf dist tsconfig.tsbuildinfo",
@@ -65,6 +65,7 @@
   },
   "peerDependencies": {
     "@nestjs/common": "^12.0.0-alpha.0",
+    "@nestjs/typeorm": "^11.0.0",
     "nestjs-zod": "^5.0.0",
     "reflect-metadata": "^0.1.13 || ^0.2.0",
     "typeorm": "^0.3.0",
diff --git a/packages/rockets-server/src/repository/define-typeorm-repository.spec.ts b/packages/rockets-repository-typeorm/src/define-typeorm-repository.spec.ts
similarity index 60%
rename from packages/rockets-server/src/repository/define-typeorm-repository.spec.ts
rename to packages/rockets-repository-typeorm/src/define-typeorm-repository.spec.ts
index 5465430d4..e3cfd4802 100644
--- a/packages/rockets-server/src/repository/define-typeorm-repository.spec.ts
+++ b/packages/rockets-repository-typeorm/src/define-typeorm-repository.spec.ts
@@ -1,7 +1,8 @@
-import { vi, describe, it, expect, afterEach } from 'vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
 import { TypeOrmModule, type TypeOrmModuleOptions } from '@nestjs/typeorm';
-import { TypeOrmRepositoryModule } from '@concepta/rockets-repository-typeorm';
-import { defineTypeOrmRepository } from './define-typeorm-repository';
+import { TypeOrmRepositoryModule } from '@concepta/nestjs-repository-typeorm';
+
+import * as TypeOrmAdapter from './index';
 
 type TypeOrmRepositoryFeatureInput = Parameters<
   typeof TypeOrmRepositoryModule.forFeature
@@ -15,15 +16,23 @@ class TypeOrmRepositorySpecEntity {
 }
 
 describe('defineTypeOrmRepository', () => {
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
+  afterEach(() => vi.restoreAllMocks());
 
-  it('delegates feature registration to TypeOrmRepositoryModule', () => {
-    const repository = defineTypeOrmRepository({
-      type: 'sqlite',
-      database: ':memory:',
-    });
+  function define(connection: TypeOrmModuleOptions) {
+    return (
+      TypeOrmAdapter as unknown as {
+        defineTypeOrmRepository: (options: TypeOrmModuleOptions) => {
+          forFeature: typeof TypeOrmRepositoryModule.forFeature;
+          forRoot: (
+            entities: ReadonlyArray<typeof TypeOrmRepositorySpecEntity>,
+          ) => unknown;
+        };
+      }
+    ).defineTypeOrmRepository(connection);
+  }
+
+  it('is owned by the TypeORM adapter package and delegates feature registration', () => {
+    const repository = define({ type: 'sqlite', database: ':memory:' });
     const entities: TypeOrmRepositoryFeatureInput = [
       { key: 'typeormRepositorySpec', entity: TypeOrmRepositorySpecEntity },
     ];
@@ -44,7 +53,7 @@ describe('defineTypeOrmRepository', () => {
       database: ':memory:',
       synchronize: true,
     };
-    const repository = defineTypeOrmRepository(connection);
+    const repository = define(connection);
     const forRoot = vi.spyOn(TypeOrmModule, 'forRoot');
 
     repository.forRoot([TypeOrmRepositorySpecEntity]);
diff --git a/packages/rockets-server/src/repository/define-typeorm-repository.ts b/packages/rockets-repository-typeorm/src/define-typeorm-repository.ts
similarity index 72%
rename from packages/rockets-server/src/repository/define-typeorm-repository.ts
rename to packages/rockets-repository-typeorm/src/define-typeorm-repository.ts
index 08e22075d..919c5aee9 100644
--- a/packages/rockets-server/src/repository/define-typeorm-repository.ts
+++ b/packages/rockets-repository-typeorm/src/define-typeorm-repository.ts
@@ -1,12 +1,16 @@
 import type { DynamicModule, PlainLiteralObject, Type } from '@nestjs/common';
-import { TypeOrmModule, TypeOrmModuleOptions } from '@nestjs/typeorm';
-import { TypeOrmRepositoryModule } from '@concepta/rockets-repository-typeorm';
+import { TypeOrmModule, type TypeOrmModuleOptions } from '@nestjs/typeorm';
+import { TypeOrmRepositoryModule } from '@concepta/nestjs-repository-typeorm';
 import type { RepositoryBootstrap } from '@concepta/rockets-core';
 import type {
   DynamicRepositoryModule,
   RepositoryProviderOptions,
 } from '@concepta/nestjs-repository';
 
+/**
+ * TypeORM repository bootstrap whose root entity list is derived by the
+ * Rockets planner from resources and integration contributions.
+ */
 export function defineTypeOrmRepository<
   Connection extends TypeOrmModuleOptions,
 >(connection: Connection): RepositoryBootstrap {
diff --git a/packages/rockets-repository-typeorm/src/index.ts b/packages/rockets-repository-typeorm/src/index.ts
index eef064d01..386c01ee4 100644
--- a/packages/rockets-repository-typeorm/src/index.ts
+++ b/packages/rockets-repository-typeorm/src/index.ts
@@ -4,3 +4,4 @@
 // `@concepta/*` package. The Rockets-specific addition — the zod
 // `SchemaEntityCompiler` — lives at the `/zod` subpath, not here.
 export * from '@concepta/nestjs-repository-typeorm';
+export { defineTypeOrmRepository } from './define-typeorm-repository';
diff --git a/packages/rockets-server-auth/CHANGELOG.md b/packages/rockets-server-auth/CHANGELOG.md
index 10eb55b6b..5dbaf5881 100644
--- a/packages/rockets-server-auth/CHANGELOG.md
+++ b/packages/rockets-server-auth/CHANGELOG.md
@@ -9,20 +9,37 @@ and this project adheres to
 
 ## [Unreleased]
 
-### Breaking
+### Added
 
-- **`repositoryPersistence` removed** from `RocketsAuthOptionsExtrasInterface`.
-  Use **`defineRocketsAuth()`** from this package: it registers auth entities
-  through `@concepta/rockets-core`’s planner (`resources[]`) and returns a
-  **`RocketsAuthIntegration`** for `RocketsModule.forRoot({ auth: ... })`.
-  `RocketsModule` loads **`RocketsCoreModule` before `RocketsAuthModule`** when
-  `auth` is an integration bundle so dynamic repositories exist at auth boot.
+- Complete public account-recovery HTTP flow: enumeration-safe initiation,
+  passcode validation, and OTP-authorized password rotation.
+- Default global throttling with stricter login and recovery limits; hosts can
+  configure it or explicitly opt out.
+- End-to-end readiness coverage for duplicate CQRS ownership, recovery,
+  password reuse policy, and login throttling.
 
-### Added
+### Changed
 
-- **`defineRocketsAuth`** and **`DefineRocketsAuthInput`** — single entry for
-  persistence manifest + `userMetadata` + `RocketsAuthModule.forRootAsync`
-  options.
+- `defineRocketsAuth()` now returns a complete composition: auth persistence
+  rows, root repository, user-metadata contract, and guard preference travel
+  with the integration. Its Rockets guard defaults off because the built-in
+  authentication module already owns a JWT global guard; mixed-auth hosts can
+  explicitly reverse that ownership.
+- CQRS handlers have one owner. Signup and password-validation registrations no
+  longer compete with upstream handlers for the same command.
+- Admin role handler overrides now apply consistently to list, read, create,
+  update, and delete operations.
+- Generated controller factories share one typed decorator path, and the
+  controller extras contract no longer advertises the unsupported `useHooks`
+  option or an unused handler-override alias.
+- Recovery password rotation preserves history, strength validation,
+  transactions, and credential lifecycle events.
+- Node.js 20 is the minimum supported runtime.
+
+### Removed
+
+- The nonfunctional `rockets-auth-swagger` manifest entry. Applications
+  generate OpenAPI from their own complete Nest entry module.
 
 ## [1.0.0-alpha.7] - 2026-02-19
 
diff --git a/packages/rockets-server-auth/README.md b/packages/rockets-server-auth/README.md
index 8796f742e..4156dc95a 100644
--- a/packages/rockets-server-auth/README.md
+++ b/packages/rockets-server-auth/README.md
@@ -8,18 +8,18 @@
 > OTP, invitations, roles, admin user CRUD — wired as a single
 > `defineRocketsAuth()` integration.
 
-**Status:** alpha (`0.0.1-dev.0`, published on npm as
-`@concepta/rockets-auth@alpha`). API on the `defineRocketsAuth()` surface is
-stable; the OAuth submodule is parked pending upstream v8 ports (see
+**Status:** pre-1.0 preview (`0.0.1-dev.0`, published on npm as
+`@concepta/rockets-auth@alpha`). Public shapes may still change before 1.0;
+the OAuth submodule is parked pending upstream v8 ports (see
 [Known limitations](#known-limitations)).
 
 ---
 
 ## 1. Introduction
 
-`@concepta/rockets-auth` is what you reach for when your application owns its
-users. It is the alternative to `@concepta/rockets` for the case where you do
-**not** delegate authentication to an external IdP.
+`@concepta/rockets-auth` is what you compose with `@concepta/rockets` when your
+application owns its users instead of delegating authentication to an external
+IdP.
 
 It composes the v8 line of `@concepta/nestjs-*` **identity motors** (`user`,
 `password`, `otp`, `role`, `invitation`, `federated`, `email`, `event`, plus
@@ -32,6 +32,9 @@ still come from core (which re-exports the `@concepta/nestjs-*` motors).
 
 - **HTTP routes** (mounted by the bundle):
   - `POST /token/password` — login. `POST /token/refresh` — refresh.
+  - `POST /recovery/login`, `POST /recovery/password`,
+    `POST /recovery/passcode`, `PATCH /recovery/password` —
+    enumeration-safe login/password recovery and password reset.
   - `PATCH /me` (password change) and the rest of `/me` from `@concepta/rockets`.
   - `POST /otp`, `PATCH /otp` — OTP issue / verify.
   - `POST /signup` — user signup (wired through `userCrud`).
@@ -83,11 +86,8 @@ app supports (e.g. `@concepta/rockets-repository-typeorm` + `typeorm`).
 import { Module } from '@nestjs/common';
 import { EventModule } from '@concepta/nestjs-event';
 import { RocketsModule } from '@concepta/rockets';
-import {
-  defineRocketsAuth,
-  buildRocketsAuthResources,
-} from '@concepta/rockets-auth';
-import { defineTypeOrmRepository } from './repository/define-typeorm-repository';
+import { defineRocketsAuth } from '@concepta/rockets-auth';
+import { defineTypeOrmRepository } from '@concepta/rockets-repository-typeorm';
 
 import {
   UserEntity,
@@ -108,7 +108,7 @@ import {
 } from './user/metadata';
 import { RoleDto, RoleCreateDto, RoleUpdateDto } from './role';
 
-// One bootstrap instance — same reference on `repository` and `persistence.module`.
+// The auth integration contributes this repository and all auth-owned rows.
 const repo = defineTypeOrmRepository({
   type: 'sqlite',
   database: ':memory:',
@@ -182,28 +182,26 @@ const rocketsAuthInput = {
 };
 
 const rocketsAuth = defineRocketsAuth(rocketsAuthInput);
-const rocketsAuthResources = buildRocketsAuthResources(
-  rocketsAuthInput.persistence,
-  rocketsAuthInput.invitationEntity,
-);
 
 @Module({
   imports: [
     EventModule.forRoot({}),
     RocketsModule.forRoot({
       auth: rocketsAuth,
-      repository: repo,
-      resources: [...rocketsAuthResources /* your defineResource bundles */],
+      resources: [
+        /* your application defineResource bundles */
+      ],
     }),
   ],
 })
 export class AppModule {}
 ```
 
-`defineTypeOrmRepository` is the same app-local `RepositoryBootstrap` helper
-used with `@concepta/rockets` (wrap `TypeOrmModule.forRoot` +
-`TypeOrmRepositoryModule.forFeature`). Run `yarn sample-auth:dev` from the
-monorepo root for a full working app.
+`defineRocketsAuth()` owns its composition boundary: it contributes the auth
+resources, root repository, `/me` metadata contract, and guard preference.
+Explicit options on `RocketsModule` or `createServer()` override contributed
+defaults. Run `yarn sample-auth:dev` from the monorepo root for a full working
+app.
 
 ---
 
@@ -278,39 +276,37 @@ Available slots: `signupHandler`, `adminList`, `adminRead`, `adminUpdate`,
 
 ### Disable specific controllers
 
-When you ship your own variant, opt the built-in out via
-`extras.disableController`:
+When you ship your own variant, opt the built-in out through the
+`defineRocketsAuth` input:
 
 ```typescript
-RocketsModule.forRoot({
-  auth: rocketsAuth,
+defineRocketsAuth({
+  // ...
   disableController: { admin: true, invitation: true },
 });
 ```
 
 Available flags: `otp`, `signup`, `admin`, `adminRoles`, `invitation`,
 `invitationAcceptance`, `invitationRevocation`, `invitationReattempt`,
-`mePassword`, `token`. (The `disableController` field on
+`mePassword`, `token`, `recovery`. (The `disableController` field on
 `RocketsAuthModule.forRootAsync` directly accepts the same shape;
 `defineRocketsAuth` propagates it.)
 
 ### Skip the global guard
 
-By default, `RocketsModule` opts in `AuthServerGuard` as `APP_GUARD`. To leave
-the guard wholly to the upstream `@concepta/nestjs-authentication` (recommended
-when you use this package's full stack):
+`defineRocketsAuth` defaults the Rockets guard off because the upstream
+`AuthenticationModule` already installs its own JWT `APP_GUARD`. For a mixed
+auth chain, make Rockets own the ordered adapters and turn the upstream guard
+off:
 
 ```typescript
 defineRocketsAuth({
   // ...
-  rocketsDefaults: { enableGlobalGuard: false },
+  rocketsDefaults: { enableGlobalGuard: true },
+  auth: { appGuard: false },
 });
 ```
 
-The upstream `AuthenticationModule` registers its own `APP_GUARD` (`JwtGuard`).
-Forward extras through `extras.auth.appGuard: false` if you want zero global
-guard.
-
 ### Customise a controller without subclassing
 
 Every factory-built controller accepts a `controller.classDecorators` array and
@@ -362,25 +358,25 @@ when you need built-in auth HTTP and `/me`.
 
 ### Entry points
 
-| Symbol                                                         | Purpose                                                                                                                                                                                                            |
-| -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `defineRocketsAuth(input)`                                     | Returns an `AuthBootstrap` for `RocketsModule.forRoot({ auth })`. Pair with `buildRocketsAuthResources()` on `resources` for auth persistence rows; `RocketsAuthModule` mounts via the bootstrap's adapter wiring. |
-| `buildRocketsAuthResources(persistence, invitationEntity?)`    | Converts auth `persistence` config into `defineModuleResource` rows for `resources[]`.                                                                                                                             |
-| `RocketsAuthModule.forRoot(options)` / `forRootAsync(options)` | Direct registration. Use only when you need to mount the auth module outside the `RocketsModule` composition.                                                                                                      |
-| `RocketsJwtAuthAdapter`                                        | The default JWT adapter validated by the chain. Picked by `defineRocketsAuth` unless `authAdapter` is overridden.                                                                                                  |
+| Symbol                                                         | Purpose                                                                                                                                                                           |
+| -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `defineRocketsAuth(input)`                                     | Returns a complete `AuthBootstrap` for `createServer({ auth })` or `RocketsModule.forRoot({ auth })`, including owned persistence rows, repository, metadata, and guard defaults. |
+| `buildRocketsAuthResources(persistence, invitationEntity?)`    | Advanced helper used internally by `defineRocketsAuth`; exposed for lower-level core composition.                                                                                 |
+| `RocketsAuthModule.forRoot(options)` / `forRootAsync(options)` | Direct registration. Use only when you need to mount the auth module outside the `RocketsModule` composition.                                                                     |
+| `RocketsJwtAuthAdapter`                                        | The default JWT adapter validated by the chain. Picked by `defineRocketsAuth` unless `authAdapter` is overridden.                                                                 |
 
 ### `defineRocketsAuth` input
 
 | Field                               | Type                                                                         | Required | Purpose                                                                                                                                                                                                    |
 | ----------------------------------- | ---------------------------------------------------------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `persistence.module`                | `RepositoryModuleInterface`                                                  | yes      | Same adapter instance as `RocketsModule.forRoot({ repository })` — typically a `defineTypeOrmRepository(...)` bootstrap, not raw `TypeOrmRepositoryModule` alone.                                          |
-| `persistence.entities`              | `{ user, userCredentials?, userOtp?, role?, userRole?, federatedIdentity? }` | yes      | **Your** TypeORM entity classes for auth tables. No `@concepta/nestjs-typeorm-ext` — declare columns explicitly (see `examples/sample-server-auth`). |
+| `persistence.module`                | `RepositoryModuleInterface`                                                  | yes      | Repository contributed to the surrounding Rockets server — typically `defineTypeOrmRepository(...)`, or a lower-level repository module when the host owns root registration.                              |
+| `persistence.entities`              | `{ user, userCredentials?, userOtp?, role?, userRole?, federatedIdentity? }` | yes      | **Your** TypeORM entity classes for auth tables. No `@concepta/nestjs-typeorm-ext` — declare columns explicitly (see `examples/sample-server-auth`).                                                       |
 | `invitationEntity`                  | `Type`                                                                       | optional | Adds an `invitation` repository row + enables invitation routes.                                                                                                                                           |
 | `userMetadata`                      | `RocketsUserMetadataConfig`                                                  | yes      | Forwarded to `/me`; also used as the default `userCrud.userMetadataConfig`.                                                                                                                                |
 | `userCrud`                          | `UserCrudOptionsExtrasInterface`                                             | yes      | `model`, `dto.createOne` / `updateOne`, `handlers`, controller extras.                                                                                                                                     |
 | `roleCrud`                          | `RoleCrudOptionsExtrasInterface`                                             | optional | Same shape, for the role admin routes.                                                                                                                                                                     |
 | `authAdapter`                       | `Type<AuthAdapterInterface>`                                                 | optional | Override the JWT adapter (e.g. inject a custom claim transformer).                                                                                                                                         |
-| `rocketsDefaults.enableGlobalGuard` | `boolean`                                                                    | optional | Hint to `RocketsModule` about the global guard default.                                                                                                                                                    |
+| `rocketsDefaults.enableGlobalGuard` | `boolean`                                                                    | optional | Override the contributed Rockets guard default (`false`; upstream JWT guard owns built-in-auth requests).                                                                                                  |
 | All other fields                    | inherited from `RocketsAuthOptionsInterface`                                 | optional | `useFactory` / `useExisting`, plus `settings`, `authentication`, `user`, `password`, `otp`, `email`, `crud`, `role`, `invitation`, `federated`, `services`, `accessControl`, `disableController`, `ports`. |
 
 ### `RocketsAuthModule.forRoot(options)` — top-level options
@@ -392,17 +388,18 @@ when you need built-in auth HTTP and `/me`.
 | `user`, `password`, `otp`, `email`, `crud`, `role`, `federated`, `invitation` | Per-module config blocks, forwarded as-is to upstream modules.                                                                                                             |
 | `services.mailerService`                                                      | Required mailer adapter. Use a logger fallback for dev.                                                                                                                    |
 | `services.userAccessQueryService`                                             | Optional `CanAccess` for access-control queries.                                                                                                                           |
-| `swagger`                                                                     | Forwarded to `SwaggerUiModule` from `@concepta/rockets-core`.                                                                                                                                            |
+| `swagger`                                                                     | Forwarded to `SwaggerUiModule` from `@concepta/rockets-core`.                                                                                                              |
 
 ### Module-level extras
 
-| Field                                                                                 | Purpose                                                                                                                                                                         |
-| ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `accessControl`                                                                       | `AccessControlOptionsInterface` + `imports` + `queryServices` — enables the global ACL guard wiring.                                                                            |
-| `disableController`                                                                   | Drop built-in controllers (`otp`, `signup`, `admin`, `adminRoles`, `invitation`, `invitationAcceptance`, `invitationRevocation`, `invitationReattempt`, `mePassword`, `token`). |
-| `ports`                                                                               | `RocketsAuthPortsConfigInterface` — per-handler overrides for cross-module Command/Query plumbing.                                                                              |
-| `auth.appGuard`                                                                       | Override the global `APP_GUARD` from `AuthenticationModule`.                                                                                                                    |
-| `auth.controller` / `otp.controller` / `invitation.controllers.*` / `role.controller` | Per-controller decorator extras (`classDecorators`, `routes[*].decorators`).                                                                                                    |
+| Field                                                                                 | Purpose                                                                                                                                                                                     |
+| ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `accessControl`                                                                       | `AccessControlOptionsInterface` + `imports` + `queryServices` — enables the global ACL guard wiring.                                                                                        |
+| `disableController`                                                                   | Drop built-in controllers (`recovery`, `otp`, `signup`, `admin`, `adminRoles`, `invitation`, `invitationAcceptance`, `invitationRevocation`, `invitationReattempt`, `mePassword`, `token`). |
+| `throttling`                                                                          | Default request-throttling options, or `false` to opt out. Login and recovery routes are protected by the global throttler guard.                                                           |
+| `ports`                                                                               | `RocketsAuthPortsConfigInterface` — per-handler overrides for cross-module Command/Query plumbing.                                                                                          |
+| `auth.appGuard`                                                                       | Override the global `APP_GUARD` from `AuthenticationModule`.                                                                                                                                |
+| `auth.controller` / `otp.controller` / `invitation.controllers.*` / `role.controller` | Per-controller decorator extras (`classDecorators`, `routes[*].decorators`).                                                                                                                |
 
 ### Domain re-exports
 
@@ -439,9 +436,8 @@ re-exported — import them directly from `@concepta/nestjs-access-control`.
 
 - **OAuth providers (Apple, Google, GitHub)** are deferred — upstream
   `@concepta/nestjs-auth-{apple,google,github,router}` have not been ported to
-  v8. The folder `src/domains/oauth/` is parked with the v7 wiring preserved as
-  a comment and `TODO(upstream:)` markers. `extras.auth.guards` exists for
-  forward-compat plumbing but routes resolve only after the upstream ports ship.
+  v8. `extras.auth.guards` remains as forward-compatible plumbing, but Rockets
+  does not register OAuth routes until compatible upstream providers ship.
 - **Email and event modules** are on v7 (`@concepta/nestjs-email@7.0.0-alpha.10`,
   `@concepta/nestjs-event@7.0.0-alpha.10`) while the rest of the stack —
   including `@concepta/nestjs-access-control` — is on v8. The cross-version mix
@@ -453,8 +449,10 @@ re-exported — import them directly from `@concepta/nestjs-access-control`.
   `examples/sample-server-auth/src/shared/persistence/` and
   `src/modules/user/entities/`.
 
-Dump OpenAPI from a running auth app: `yarn generate-swagger` at the monorepo
-root (uses the `rockets-auth-swagger` CLI bin).
+Generate OpenAPI from the application entry module with Nest's
+`SwaggerModule.createDocument()`. The package cannot infer a consumer's full
+module graph, prefixes, or document settings, so it intentionally ships no
+standalone generator CLI.
 
 ---
 
diff --git a/packages/rockets-server-auth/SWAGGER.md b/packages/rockets-server-auth/SWAGGER.md
deleted file mode 100644
index 12db06598..000000000
--- a/packages/rockets-server-auth/SWAGGER.md
+++ /dev/null
@@ -1,87 +0,0 @@
-# Swagger Documentation Generator
-
-This module provides a script to automatically generate Swagger (OpenAPI)
-documentation from the controllers in the Rockets Server.
-
-## Usage
-
-### Using the NPM script
-
-The easiest way to generate Swagger documentation is to use the provided npm
-script:
-
-```bash
-# From the rockets-server package directory
-npm run generate-swagger
-
-# Or using yarn
-yarn generate-swagger
-```
-
-This will generate a `swagger.json` file in the `swagger` directory at the root
-of your project.
-
-### Programmatic Usage
-
-You can also use the generator programmatically in your own code:
-
-```typescript
-import { generateSwaggerJson } from '@concepta/rockets-server-auth';
-
-// Generate the Swagger documentation
-generateSwaggerJson()
-  .then(() => console.log('Swagger generation complete'))
-  .catch((err) => console.error('Error generating Swagger:', err));
-```
-
-## Output
-
-The generator will create a `swagger.json` file in the `swagger` directory. This
-file can be used with Swagger UI or other OpenAPI tools to visualize and
-interact with your API documentation.
-
-## Customization
-
-The generator uses NestJS's `SwaggerModule` and `DocumentBuilder` to create the
-documentation. If you need to customize the output, you can modify the
-`generate-swagger.ts` file in the `src` directory.
-
-Key customization points:
-
-```typescript
-// Change the API userMetadata
-const options = new DocumentBuilder()
-  .setTitle('Rockets API')
-  .setDescription('API documentation for Rockets Server')
-  .setVersion('1.0')
-  .addBearerAuth()
-  // Add tags, security definitions, etc.
-  .build();
-```
-
-## Adding Documentation to Controllers and DTOs
-
-The quality of the generated documentation depends on the annotations in your
-controllers and DTOs. Make sure to use NestJS Swagger decorators to properly
-document your API:
-
-```typescript
-import { Controller, Post, Body } from '@nestjs/common';
-import { ApiTags, ApiOperation, ApiResponse, ApiBody } from '@nestjs/swagger';
-
-@ApiTags('users')
-@Controller('users')
-export class UsersController {
-  @Post()
-  @ApiOperation({ summary: 'Create user' })
-  @ApiResponse({ status: 201, description: 'User created successfully.' })
-  @ApiResponse({ status: 400, description: 'Bad request.' })
-  @ApiBody({ type: CreateUserDto })
-  async create(@Body() createUserDto: CreateUserDto) {
-    // ...
-  }
-}
-```
-
-For more information on how to document your API, see the
-[NestJS Swagger documentation](https://docs.nestjs.com/openapi/introduction).
diff --git a/packages/rockets-server-auth/bin/generate-swagger.js b/packages/rockets-server-auth/bin/generate-swagger.js
deleted file mode 100755
index 331bc0919..000000000
--- a/packages/rockets-server-auth/bin/generate-swagger.js
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * CLI script to generate Swagger documentation for Rockets Server
- */
-
-// Register ts-node to allow running TypeScript files directly
-require('ts-node/register');
-
-// Run the generator
-require('../src/generate-swagger');
-
-console.log('For more information about the Swagger generator, see SWAGGER.md'); 
\ No newline at end of file
diff --git a/packages/rockets-server-auth/package.json b/packages/rockets-server-auth/package.json
index 08a586601..1ac64eb56 100644
--- a/packages/rockets-server-auth/package.json
+++ b/packages/rockets-server-auth/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@concepta/rockets-auth",
   "version": "0.0.1-dev.0",
-  "description": "Rockets Auth - Complete authentication and authorization solution for NestJS with JWT, OAuth, OTP, role-based access control, and more",
+  "description": "Rockets Auth - JWT authentication, account recovery, OTP, invitations, and role-based access control for NestJS",
   "author": "Thiago Ramalho <thiago.ramalho@concepta.com>",
   "license": "BSD-3-Clause",
   "main": "dist/index.js",
@@ -45,16 +45,10 @@
     "typescript"
   ],
   "engines": {
-    "node": ">=18.0.0",
-    "npm": ">=8.0.0"
-  },
-  "bin": {
-    "rockets-auth-swagger": "./bin/generate-swagger.js"
+    "node": ">=20.0.0"
   },
   "files": [
     "dist/**/!(*.spec|*.e2e-spec|*.fixture).{js,d.ts}",
-    "bin/generate-swagger.js",
-    "SWAGGER.md",
     "README.md",
     "LICENSE.txt",
     "CHANGELOG.md"
@@ -68,8 +62,7 @@
     "test:watch": "cd ../.. && ./node_modules/.bin/vitest --project unit packages/rockets-server-auth",
     "test:e2e": "cd ../.. && ./node_modules/.bin/vitest run --project e2e-packages packages/rockets-server-auth",
     "test:e2e:cov": "cd ../.. && ./node_modules/.bin/vitest run --project e2e-packages --coverage packages/rockets-server-auth",
-    "test:cov": "cd ../.. && ./node_modules/.bin/vitest run --project unit --coverage packages/rockets-server-auth",
-    "generate-swagger": "ts-node src/generate-swagger.ts"
+    "test:cov": "cd ../.. && ./node_modules/.bin/vitest run --project unit --coverage packages/rockets-server-auth"
   },
   "dependencies": {
     "@concepta/nestjs-access-control": "8.0.0-alpha.8",
@@ -116,7 +109,6 @@
     "express-serve-static-core": "^0.1.1",
     "sqlite3": "^5.1.4",
     "supertest": "^6.3.4",
-    "ts-node": "^10.9.2",
     "typeorm": "^0.3.31",
     "vitest": "^4.1.10"
   },
diff --git a/packages/rockets-server-auth/src/__e2e__/helpers/rockets-auth-e2e-app.factory.ts b/packages/rockets-server-auth/src/__e2e__/helpers/rockets-auth-e2e-app.factory.ts
index 379779988..8e4efa0c7 100644
--- a/packages/rockets-server-auth/src/__e2e__/helpers/rockets-auth-e2e-app.factory.ts
+++ b/packages/rockets-server-auth/src/__e2e__/helpers/rockets-auth-e2e-app.factory.ts
@@ -30,10 +30,7 @@ import { RocketsAuthUserMetadataDto } from '../../domains/user/infrastructure/dt
 import { RocketsAuthUserCreateDto } from '../../domains/user/infrastructure/dto/rockets-auth-user-create.dto';
 import { RocketsAuthUserUpdateDto } from '../../domains/user/infrastructure/dto/rockets-auth-user-update.dto';
 import { ROCKETS_AUTH_OTP_ASSIGNMENT } from '../../shared/constants/rockets-auth.constants';
-import {
-  buildRocketsAuthResources,
-  defineRocketsAuth,
-} from '../../define-rockets-auth';
+import { defineRocketsAuth } from '../../define-rockets-auth';
 import type { DefineRocketsAuthInput } from '../../define-rockets-auth';
 import {
   E2E_NOTIFICATION_HANDLERS,
@@ -225,10 +222,6 @@ export async function createRocketsAuthStandardE2eTestingModule(
   };
 
   const rocketsAuth = defineRocketsAuth(mergedInput);
-  const authResources = buildRocketsAuthResources(
-    mergedInput.persistence,
-    mergedInput.invitationEntity,
-  );
 
   const imports: DynamicModule['imports'] = [
     RocketsAuthE2eMockConfigModule,
@@ -249,9 +242,6 @@ export async function createRocketsAuthStandardE2eTestingModule(
     ]),
     RocketsModule.forRoot({
       auth: rocketsAuth,
-      userMetadata: mergedInput.userMetadata,
-      repository: TypeOrmRepositoryModule,
-      resources: [...authResources],
     }),
   ];
 
diff --git a/packages/rockets-server-auth/src/__fixtures__/services/otp.service.fixture.ts b/packages/rockets-server-auth/src/__fixtures__/services/otp.service.fixture.ts
index 2feeb83b9..800aaa6ac 100644
--- a/packages/rockets-server-auth/src/__fixtures__/services/otp.service.fixture.ts
+++ b/packages/rockets-server-auth/src/__fixtures__/services/otp.service.fixture.ts
@@ -1,15 +1,16 @@
 import { ReferenceIdInterface } from '@concepta/nestjs-core';
-import { Injectable } from '@nestjs/common';
+import { Injectable, type PlainLiteralObject } from '@nestjs/common';
 import { RocketsAuthOtpServiceInterface } from '../../domains/otp/interfaces/rockets-auth-otp-service.interface';
 
 @Injectable()
 export class OtpServiceFixture implements RocketsAuthOtpServiceInterface {
-  async sendOtp(_email: string): Promise<void> {
+  async sendOtp(_ctx: PlainLiteralObject, _email: string): Promise<void> {
     // In a fixture, we don't need to actually send an email
     return Promise.resolve();
   }
 
   async confirmOtp(
+    _ctx: PlainLiteralObject,
     _email: string,
     passcode: string,
   ): Promise<ReferenceIdInterface> {
diff --git a/packages/rockets-server-auth/src/define-rockets-auth.spec.ts b/packages/rockets-server-auth/src/define-rockets-auth.spec.ts
new file mode 100644
index 000000000..6d6354a65
--- /dev/null
+++ b/packages/rockets-server-auth/src/define-rockets-auth.spec.ts
@@ -0,0 +1,54 @@
+import { describe, expect, it, vi } from 'vitest';
+import type { RepositoryModuleInterface } from '@concepta/nestjs-repository';
+
+import {
+  defineRocketsAuth,
+  type DefineRocketsAuthInput,
+} from './define-rockets-auth';
+
+class UserEntity {}
+class UserMetadataEntity {}
+class UserMetadataCreateDto {
+  userId!: string;
+}
+class UserMetadataUpdateDto {
+  id!: string;
+}
+
+const repository = {
+  name: 'test-repository',
+  forFeature: vi.fn(),
+} as unknown as RepositoryModuleInterface;
+
+function input(
+  rocketsDefaults?: DefineRocketsAuthInput['rocketsDefaults'],
+): DefineRocketsAuthInput {
+  return {
+    persistence: {
+      module: repository,
+      entities: { user: UserEntity },
+    },
+    userMetadata: {
+      entity: UserMetadataEntity,
+      createDto: UserMetadataCreateDto,
+      updateDto: UserMetadataUpdateDto,
+    },
+    userCrud: { model: UserEntity },
+    useFactory: () => ({}),
+    rocketsDefaults,
+  } as DefineRocketsAuthInput;
+}
+
+describe('defineRocketsAuth', () => {
+  it('defaults the Rockets guard off because built-in auth owns a JWT app guard', () => {
+    const bootstrap = defineRocketsAuth(input());
+
+    expect(bootstrap.contributes?.enableGlobalGuard).toBe(false);
+  });
+
+  it('allows mixed-auth hosts to opt back into the Rockets guard chain', () => {
+    const bootstrap = defineRocketsAuth(input({ enableGlobalGuard: true }));
+
+    expect(bootstrap.contributes?.enableGlobalGuard).toBe(true);
+  });
+});
diff --git a/packages/rockets-server-auth/src/define-rockets-auth.ts b/packages/rockets-server-auth/src/define-rockets-auth.ts
index f252a37e4..21978383e 100644
--- a/packages/rockets-server-auth/src/define-rockets-auth.ts
+++ b/packages/rockets-server-auth/src/define-rockets-auth.ts
@@ -49,8 +49,8 @@ function toUserMetadataConfig(
 }
 
 /**
- * Planner rows for auth persistence tables. Pass on `RocketsModule.forRoot({ resources })`
- * together with {@link defineRocketsAuth}.
+ * Planner rows for auth persistence tables. {@link defineRocketsAuth} includes
+ * these automatically; this helper remains public for lower-level composition.
  */
 export function buildRocketsAuthResources(
   persistence: RocketsAuthRepositoryPersistenceOptions,
@@ -121,8 +121,9 @@ function buildAsyncOptionsForAuthModule(
 }
 
 /**
- * Built-in auth: returns an {@link AuthBootstrap} for `RocketsModule.forRoot({ auth })`.
- * Also pass {@link buildRocketsAuthResources} on `resources` and `userMetadata` explicitly.
+ * Built-in auth: returns a complete {@link AuthBootstrap} for
+ * `RocketsModule.forRoot({ auth })`, including its persistence resources,
+ * user-metadata contract, root repository default, and guard preference.
  */
 export type DefineRocketsAuthInput = RocketsAuthAsyncOptions & {
   /**
@@ -146,5 +147,17 @@ export function defineRocketsAuth(
   return {
     adapter: input.authAdapter ?? RocketsJwtAuthAdapter,
     forRoot: () => RocketsAuthModule.forRootAsync(asyncOptions),
+    contributes: {
+      resources: buildRocketsAuthResources(
+        input.persistence,
+        input.invitationEntity,
+      ),
+      userMetadata: input.userMetadata,
+      repository: input.persistence.module,
+      // AuthenticationModule installs its own JwtGuard by default. Avoid two
+      // global authentication guards unless a mixed-auth host explicitly asks
+      // Rockets to own the ordered adapter chain.
+      enableGlobalGuard: input.rocketsDefaults?.enableGlobalGuard ?? false,
+    },
   };
 }
diff --git a/packages/rockets-server-auth/src/domains/auth/__tests__/auth-readiness.e2e-spec.ts b/packages/rockets-server-auth/src/domains/auth/__tests__/auth-readiness.e2e-spec.ts
new file mode 100644
index 000000000..5b12dfde6
--- /dev/null
+++ b/packages/rockets-server-auth/src/domains/auth/__tests__/auth-readiness.e2e-spec.ts
@@ -0,0 +1,135 @@
+import 'reflect-metadata';
+
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
+import { INestApplication, Logger } from '@nestjs/common';
+import { TestingModule } from '@nestjs/testing';
+import { DataSource } from 'typeorm';
+import request from 'supertest';
+
+import { UserOtpEntityFixture } from '../../../__fixtures__/user/user-otp-entity.fixture';
+import {
+  applyRocketsAuthE2eAppGlobals,
+  createRocketsAuthStandardE2eTestingModule,
+} from '../../../__e2e__/helpers/rockets-auth-e2e-app.factory';
+
+const originalCredentials = {
+  email: 'auth-readiness@example.com',
+  username: 'auth-readiness',
+  active: true,
+  password: 'OriginalP@ssw0rd!',
+};
+
+describe.sequential('Rockets Auth 1.0 readiness (e2e)', () => {
+  describe('recovery and handler ownership', () => {
+    let app: INestApplication;
+    let module: TestingModule;
+    let registrationWarnings: string[] = [];
+    const mockEmail = { sendMail: vi.fn().mockResolvedValue(undefined) };
+
+    beforeAll(async () => {
+      const warn = vi.spyOn(Logger.prototype, 'warn');
+
+      module = await createRocketsAuthStandardE2eTestingModule({
+        mockEmailService: mockEmail,
+      });
+      app = module.createNestApplication();
+      applyRocketsAuthE2eAppGlobals(app);
+      await app.init();
+
+      registrationWarnings = warn.mock.calls
+        .flatMap((args) => args)
+        .map(String)
+        .filter((message) => message.includes('already registered'));
+      warn.mockRestore();
+
+      await request(app.getHttpServer())
+        .post('/signup')
+        .send(originalCredentials)
+        .expect(201);
+    });
+
+    afterAll(async () => {
+      await app.close();
+    });
+
+    it('registers every CQRS handler exactly once', () => {
+      expect(registrationWarnings).toEqual([]);
+    });
+
+    it('supports the complete account-recovery flow without disclosing unknown emails', async () => {
+      await request(app.getHttpServer())
+        .post('/recovery/login')
+        .send({ email: originalCredentials.email })
+        .expect(200);
+
+      await request(app.getHttpServer())
+        .post('/recovery/login')
+        .send({ email: 'unknown@example.com' })
+        .expect(200);
+
+      await request(app.getHttpServer())
+        .post('/recovery/password')
+        .send({ email: originalCredentials.email })
+        .expect(200);
+
+      const otp = await module
+        .get(DataSource)
+        .getRepository(UserOtpEntityFixture)
+        .findOneByOrFail({ active: true });
+
+      await request(app.getHttpServer())
+        .post('/recovery/passcode')
+        .send({ passcode: otp.passcode })
+        .expect(200);
+
+      await request(app.getHttpServer())
+        .get(`/recovery/passcode/${otp.passcode}`)
+        .expect(404);
+
+      const newPassword = 'RecoveredP@ssw0rd!';
+      const resetResponse = await request(app.getHttpServer())
+        .patch('/recovery/password')
+        .send({ passcode: otp.passcode, newPassword });
+      expect(resetResponse.status, JSON.stringify(resetResponse.body)).toBe(
+        200,
+      );
+
+      await request(app.getHttpServer())
+        .post('/token/password')
+        .send({ username: originalCredentials.username, password: newPassword })
+        .expect(200);
+    });
+  });
+
+  describe('request throttling', () => {
+    let app: INestApplication;
+    const mockEmail = { sendMail: vi.fn().mockResolvedValue(undefined) };
+
+    beforeAll(async () => {
+      const module = await createRocketsAuthStandardE2eTestingModule({
+        mockEmailService: mockEmail,
+      });
+      app = module.createNestApplication();
+      applyRocketsAuthE2eAppGlobals(app);
+      await app.init();
+    });
+
+    afterAll(async () => {
+      await app.close();
+    });
+
+    it('enforces the declared login limit', async () => {
+      for (let attempt = 1; attempt <= 10; attempt += 1) {
+        await request(app.getHttpServer())
+          .post('/token/password')
+          .send({ username: 'missing-user', password: 'wrong-password' })
+          .expect(401);
+      }
+
+      await request(app.getHttpServer())
+        .post('/token/password')
+        .send({ username: 'missing-user', password: 'wrong-password' })
+        .expect(429);
+    });
+  });
+});
diff --git a/packages/rockets-server-auth/src/domains/auth/application/services/rockets-recovery.service.spec.ts b/packages/rockets-server-auth/src/domains/auth/application/services/rockets-recovery.service.spec.ts
new file mode 100644
index 000000000..cc5d476f1
--- /dev/null
+++ b/packages/rockets-server-auth/src/domains/auth/application/services/rockets-recovery.service.spec.ts
@@ -0,0 +1,86 @@
+import { describe, expect, it, vi } from 'vitest';
+
+import { RocketsRecoveryService } from './rockets-recovery.service';
+
+const ctx = { requestId: 'request-1' };
+const policy = {
+  otpCategory: 'recovery',
+  otpNamespace: 'auth',
+  otpType: 'uuid',
+  otpExpiresIn: '1h',
+  otpDuplicateStrategy: 'DEACTIVATE' as const,
+  otpRateSeconds: 60,
+  otpRateThreshold: 5,
+};
+
+function createSubject() {
+  const otpPort = {
+    create: vi.fn(),
+    validate: vi.fn(),
+    clear: vi.fn(),
+  };
+  const userPort = { getByEmail: vi.fn(), getById: vi.fn() };
+  const passwordPort = { setPassword: vi.fn() };
+  const commandBus = { execute: vi.fn() };
+  const notifications = {
+    sendRecoverLoginNotificationCommand: class {},
+    sendRecoverPasswordNotificationCommand: class {},
+    sendPasswordUpdatedNotificationCommand: class {},
+  };
+  const subject = new RocketsRecoveryService(
+    policy,
+    otpPort as never,
+    userPort as never,
+    passwordPort as never,
+    notifications as never,
+    commandBus as never,
+  );
+  return { subject, otpPort, userPort, passwordPort, commandBus };
+}
+
+describe('RocketsRecoveryService', () => {
+  it('awaits recovery notifications', async () => {
+    const { subject, userPort, commandBus } = createSubject();
+    userPort.getByEmail.mockResolvedValue({ id: 'u1', username: 'leo' });
+    let release!: () => void;
+    commandBus.execute.mockReturnValue(
+      new Promise<void>((resolve) => (release = resolve)),
+    );
+
+    let settled = false;
+    const pending = subject.recoverLogin(ctx, 'person@example.com').then(() => {
+      settled = true;
+    });
+    await Promise.resolve();
+    expect(settled).toBe(false);
+    release();
+    await pending;
+    expect(commandBus.execute).toHaveBeenCalledOnce();
+  });
+
+  it('revokes recovery OTPs before best-effort password-updated notification', async () => {
+    const { subject, otpPort, userPort, passwordPort, commandBus } =
+      createSubject();
+    otpPort.validate.mockResolvedValue({ assigneeId: 'u1' });
+    userPort.getById.mockResolvedValue({
+      id: 'u1',
+      email: 'person@example.com',
+    });
+    commandBus.execute.mockRejectedValue(
+      new Error('mail provider included secret'),
+    );
+
+    await expect(
+      subject.updatePassword(ctx, 'otp-secret', 'password-secret'),
+    ).resolves.toMatchObject({ id: 'u1' });
+    expect(passwordPort.setPassword).toHaveBeenCalledWith(
+      ctx,
+      'password-secret',
+      'u1',
+    );
+    expect(otpPort.clear).toHaveBeenCalledWith(ctx, 'auth', {
+      category: 'recovery',
+      assigneeId: 'u1',
+    });
+  });
+});
diff --git a/packages/rockets-server-auth/src/domains/auth/application/services/rockets-recovery.service.ts b/packages/rockets-server-auth/src/domains/auth/application/services/rockets-recovery.service.ts
new file mode 100644
index 000000000..5eb2fba85
--- /dev/null
+++ b/packages/rockets-server-auth/src/domains/auth/application/services/rockets-recovery.service.ts
@@ -0,0 +1,108 @@
+import { Logger } from '@nestjs/common';
+import { CommandBus } from '@nestjs/cqrs';
+import {
+  OtpPort,
+  PasswordPort,
+  RecoveryPolicy,
+  type RecoveryNotificationPortSettings,
+  UserPort,
+} from '@concepta/nestjs-authentication';
+import type {
+  AppContextLike,
+  AssigneeRelationInterface,
+  ReferenceIdInterface,
+} from '@concepta/nestjs-core';
+
+/** Rockets-owned recovery implementation that never launches detached commands. */
+export class RocketsRecoveryService {
+  private readonly logger = new Logger(RocketsRecoveryService.name);
+
+  constructor(
+    private readonly policy: RecoveryPolicy,
+    private readonly otpPort: OtpPort,
+    private readonly userPort: UserPort,
+    private readonly passwordPort: PasswordPort,
+    private readonly notifications: RecoveryNotificationPortSettings,
+    private readonly commandBus: CommandBus,
+  ) {}
+
+  async recoverLogin(ctx: AppContextLike, email: string): Promise<void> {
+    const user = await this.userPort.getByEmail(ctx ?? {}, email);
+    if (!user) return;
+    const Command = this.notifications.sendRecoverLoginNotificationCommand;
+    await this.commandBus.execute(new Command(ctx, email, user.username));
+  }
+
+  async recoverPassword(ctx: AppContextLike, email: string): Promise<void> {
+    const user = await this.userPort.getByEmail(ctx ?? {}, email);
+    if (!user) return;
+    const otp = await this.otpPort.create(
+      ctx ?? {},
+      this.policy.otpNamespace,
+      {
+        category: this.policy.otpCategory,
+        type: this.policy.otpType,
+        expiresIn: this.policy.otpExpiresIn,
+        assigneeId: user.id,
+        rateSeconds: this.policy.otpRateSeconds,
+        rateThreshold: this.policy.otpRateThreshold,
+      },
+      {
+        duplicateStrategy: this.policy.otpDuplicateStrategy,
+        rateSeconds: this.policy.otpRateSeconds,
+        rateThreshold: this.policy.otpRateThreshold,
+      },
+    );
+    const Command = this.notifications.sendRecoverPasswordNotificationCommand;
+    await this.commandBus.execute(
+      new Command(ctx, email, otp.passcode, otp.expirationDate),
+    );
+  }
+
+  validatePasscode(
+    ctx: AppContextLike,
+    passcode: string,
+  ): Promise<AssigneeRelationInterface | null> {
+    return this.otpPort.validate(ctx ?? {}, this.policy.otpNamespace, {
+      category: this.policy.otpCategory,
+      passcode,
+    });
+  }
+
+  async updatePassword(
+    ctx: AppContextLike,
+    passcode: string,
+    newPassword: string,
+  ): Promise<ReferenceIdInterface | null> {
+    const otp = await this.validatePasscode(ctx, passcode);
+    if (!otp) return null;
+    const user = await this.userPort.getById(ctx ?? {}, otp.assigneeId);
+    if (!user) return null;
+
+    await this.passwordPort.setPassword(ctx ?? {}, newPassword, user.id);
+    await this.otpPort.clear(ctx ?? {}, this.policy.otpNamespace, {
+      category: this.policy.otpCategory,
+      assigneeId: user.id,
+    });
+
+    const Command = this.notifications.sendPasswordUpdatedNotificationCommand;
+    try {
+      await this.commandBus.execute(new Command(ctx, user.email));
+    } catch {
+      this.logger.error('Password-updated recovery notification failed');
+    }
+    return user;
+  }
+
+  async revokeAllUserPasswordRecoveries(
+    ctx: AppContextLike,
+    email: string,
+  ): Promise<void> {
+    const user = await this.userPort.getByEmail(ctx ?? {}, email);
+    if (!user) return;
+    await this.otpPort.clear(ctx ?? {}, this.policy.otpNamespace, {
+      category: this.policy.otpCategory,
+      assigneeId: user.id,
+    });
+  }
+}
diff --git a/packages/rockets-server-auth/src/domains/auth/gateways/http/controllers/rockets-auth-recovery.controller.ts b/packages/rockets-server-auth/src/domains/auth/gateways/http/controllers/rockets-auth-recovery.controller.ts
new file mode 100644
index 000000000..a28b6e0e1
--- /dev/null
+++ b/packages/rockets-server-auth/src/domains/auth/gateways/http/controllers/rockets-auth-recovery.controller.ts
@@ -0,0 +1,146 @@
+import {
+  AuthPublic,
+  RecoveryOtpInvalidException,
+  RecoveryRecoverLoginDto,
+  RecoveryRecoverPasswordDto,
+  RecoveryUpdatePasswordDto,
+  RecoveryValidatePasscodeDto,
+  RecoveryService,
+} from '@concepta/nestjs-authentication';
+import {
+  Body,
+  Controller,
+  HttpCode,
+  Inject,
+  Logger,
+  Patch,
+  Post,
+  Req,
+} from '@nestjs/common';
+import { Throttle } from '@nestjs/throttler';
+import {
+  ApiBadRequestResponse,
+  ApiBody,
+  ApiOkResponse,
+  ApiOperation,
+  ApiTags,
+} from '@nestjs/swagger';
+import { getAppContext } from '@concepta/rockets-core';
+import type { Request } from 'express';
+
+/** Public, enumeration-safe account recovery endpoints. */
+@Controller('recovery')
+@AuthPublic({ classLevel: true })
+@ApiTags('Authentication')
+export class RocketsAuthRecoveryController {
+  private readonly logger = new Logger(RocketsAuthRecoveryController.name);
+
+  constructor(
+    @Inject(RecoveryService)
+    private readonly recoveryService: RecoveryService,
+  ) {}
+
+  @Post('login')
+  @HttpCode(200)
+  @Throttle({ default: { limit: 5, ttl: 60000 } })
+  @ApiOperation({
+    summary: 'Recover username',
+    description:
+      'Sends the username associated with an email address when an account exists.',
+  })
+  @ApiBody({ type: RecoveryRecoverLoginDto })
+  @ApiOkResponse({
+    description:
+      'The request was accepted, whether or not the email belongs to an account.',
+  })
+  @ApiBadRequestResponse({ description: 'Invalid email format' })
+  async recoverLogin(
+    @Body() dto: RecoveryRecoverLoginDto,
+    @Req() req: Request,
+  ): Promise<void> {
+    const ctx = getAppContext(req);
+    await this.runEnumerationSafe('login', () =>
+      this.recoveryService.recoverLogin(ctx, dto.email),
+    );
+  }
+
+  @Post('password')
+  @HttpCode(200)
+  @Throttle({ default: { limit: 5, ttl: 60000 } })
+  @ApiOperation({
+    summary: 'Request password reset',
+    description:
+      'Sends a password-recovery code when the supplied account exists.',
+  })
+  @ApiBody({ type: RecoveryRecoverPasswordDto })
+  @ApiOkResponse({
+    description:
+      'The request was accepted, whether or not the email belongs to an account.',
+  })
+  @ApiBadRequestResponse({ description: 'Invalid email format' })
+  async recoverPassword(
+    @Body() dto: RecoveryRecoverPasswordDto,
+    @Req() req: Request,
+  ): Promise<void> {
+    const ctx = getAppContext(req);
+    await this.runEnumerationSafe('password', () =>
+      this.recoveryService.recoverPassword(ctx, dto.email),
+    );
+  }
+
+  @Post('passcode')
+  @HttpCode(200)
+  @Throttle({ default: { limit: 10, ttl: 60000 } })
+  @ApiOperation({
+    summary: 'Validate recovery passcode',
+    description: 'Checks whether a recovery code is valid and unexpired.',
+  })
+  @ApiBody({ type: RecoveryValidatePasscodeDto })
+  @ApiOkResponse({ description: 'Passcode is valid' })
+  @ApiBadRequestResponse({ description: 'Passcode is invalid or expired' })
+  async validatePasscode(
+    @Body() dto: RecoveryValidatePasscodeDto,
+    @Req() req: Request,
+  ): Promise<void> {
+    const ctx = getAppContext(req);
+    const otp = await this.recoveryService.validatePasscode(ctx, dto.passcode);
+    if (!otp) throw new RecoveryOtpInvalidException();
+  }
+
+  @Patch('password')
+  @HttpCode(200)
+  @Throttle({ default: { limit: 5, ttl: 60000 } })
+  @ApiOperation({
+    summary: 'Reset password',
+    description: 'Updates an account password using a valid recovery code.',
+  })
+  @ApiBody({ type: RecoveryUpdatePasswordDto })
+  @ApiOkResponse({ description: 'Password updated successfully' })
+  @ApiBadRequestResponse({
+    description: 'Passcode is invalid or expired, or password is invalid',
+  })
+  async updatePassword(
+    @Body() dto: RecoveryUpdatePasswordDto,
+    @Req() req: Request,
+  ): Promise<void> {
+    const ctx = getAppContext(req);
+    const user = await this.recoveryService.updatePassword(
+      ctx,
+      dto.passcode,
+      dto.newPassword,
+    );
+    if (!user) throw new RecoveryOtpInvalidException();
+  }
+
+  private async runEnumerationSafe(
+    operation: 'login' | 'password',
+    work: () => Promise<void>,
+  ): Promise<void> {
+    try {
+      await work();
+    } catch {
+      this.logger.error(`Account ${operation} recovery notification failed`);
+      // A uniform success response prevents account-existence disclosure.
+    }
+  }
+}
diff --git a/packages/rockets-server-auth/src/domains/auth/gateways/http/controllers/rockets-auth-token.controller.ts b/packages/rockets-server-auth/src/domains/auth/gateways/http/controllers/rockets-auth-token.controller.ts
index 994024733..4b814d4ca 100644
--- a/packages/rockets-server-auth/src/domains/auth/gateways/http/controllers/rockets-auth-token.controller.ts
+++ b/packages/rockets-server-auth/src/domains/auth/gateways/http/controllers/rockets-auth-token.controller.ts
@@ -28,6 +28,7 @@ import {
   ApiUnauthorizedResponse,
 } from '@nestjs/swagger';
 import type { Request } from 'express';
+import { getAppContext } from '@concepta/rockets-core';
 
 type RequestWithPassportUser = Request & {
   readonly user?: ReferenceIdInterface;
@@ -42,7 +43,7 @@ type RequestWithPassportUser = Request & {
  * before `AuthUserContextOverlay` runs on some Nest versions).
  */
 @Controller('token')
-@AuthPublic()
+@AuthPublic({ classLevel: true })
 @ApiTags('Authentication')
 export class RocketsAuthTokenController {
   constructor(private readonly commandBus: CommandBus) {}
@@ -78,8 +79,9 @@ export class RocketsAuthTokenController {
     if (!user?.id) {
       throw new UnauthorizedException();
     }
+    const ctx = getAppContext(req);
     return this.commandBus.execute(
-      new IssueAuthenticatedResponseCommand({}, user.id),
+      new IssueAuthenticatedResponseCommand(ctx, user.id),
     );
   }
 
@@ -114,8 +116,9 @@ export class RocketsAuthTokenController {
     if (!user?.id) {
       throw new UnauthorizedException();
     }
+    const ctx = getAppContext(req);
     return this.commandBus.execute(
-      new IssueAuthenticatedResponseCommand({}, user.id),
+      new IssueAuthenticatedResponseCommand(ctx, user.id),
     );
   }
 }
diff --git a/packages/rockets-server-auth/src/domains/auth/gateways/http/factories/build-me-password-controller.ts b/packages/rockets-server-auth/src/domains/auth/gateways/http/factories/build-me-password-controller.ts
index cbb4ae8fa..c0af3ca06 100644
--- a/packages/rockets-server-auth/src/domains/auth/gateways/http/factories/build-me-password-controller.ts
+++ b/packages/rockets-server-auth/src/domains/auth/gateways/http/factories/build-me-password-controller.ts
@@ -2,12 +2,11 @@ import {
   Body,
   Controller,
   HttpCode,
-  Logger,
   Patch,
   Req,
-  Type,
   UseGuards,
 } from '@nestjs/common';
+import type { Type } from '@nestjs/common';
 import { CommandBus } from '@nestjs/cqrs';
 import { Throttle } from '@nestjs/throttler';
 import {
@@ -25,17 +24,11 @@ import type { Request } from 'express';
 
 import { ChangeMyPasswordCommand } from '../../../application/commands/impl/change-my-password.command';
 import { RocketsAuthChangePasswordDto } from '../../../infrastructure/dto/rockets-auth-change-password.dto';
-import { MePasswordControllerExtras } from '../../../interfaces/me-password-controller-extras.interface';
-import { RocketsAuthUserInterface } from '../../../../user/interfaces/rockets-auth-user.interface';
-/**
- * Build the `MePassword` HTTP controller, applying any consumer-supplied
- * `extras.classDecorators` and `extras.routes.changePassword.decorators`.
- *
- * The controller delegates to {@link ChangeMyPasswordCommand} via
- * `CommandBus`. To customise behavior (filters, side effects, persistence),
- * subclass `AbstractChangeMyPasswordHandler` and register the override —
- * do NOT replace the controller.
- */
+import type { MePasswordControllerExtras } from '../../../interfaces/me-password-controller-extras.interface';
+import type { RocketsAuthUserInterface } from '../../../../user/interfaces/rockets-auth-user.interface';
+import { applyControllerExtras } from '../../../../../shared/utils/apply-controller-extras.helper';
+
+/** Build the password-change controller and apply consumer decorators. */
 export function buildMePasswordController(
   extras: MePasswordControllerExtras = {},
 ): Type<unknown> {
@@ -44,8 +37,6 @@ export function buildMePasswordController(
   @ApiBearerAuth()
   @UseGuards(JwtGuard)
   class MePasswordController {
-    private readonly logger = new Logger(MePasswordController.name);
-
     constructor(private readonly commandBus: CommandBus) {}
 
     @Patch('password')
@@ -94,40 +85,8 @@ export function buildMePasswordController(
     }
   }
 
-  applyExtras(MePasswordController, extras);
-  return MePasswordController;
-}
-
-/**
- * Apply consumer-supplied decorators to the built controller. Stays
- * private to this factory — every domain has its own factory + a copy of
- * this helper to avoid coupling factories to a shared file (§2.8 keeps
- * factories self-contained for clarity).
- */
-function applyExtras(
-  controllerClass: Type<unknown>,
-  extras: MePasswordControllerExtras,
-): void {
-  for (const decorator of extras.classDecorators ?? []) {
-    decorator(controllerClass);
-  }
-
-  const routeMap: Record<keyof NonNullable<typeof extras.routes>, string> = {
+  applyControllerExtras(MePasswordController, extras, {
     changePassword: 'changePassword',
-  };
-
-  for (const [routeKey, methodName] of Object.entries(routeMap) as Array<
-    [keyof typeof routeMap, string]
-  >) {
-    const cfg = extras.routes?.[routeKey];
-    if (!cfg?.decorators) continue;
-
-    const proto = controllerClass.prototype as Record<string, unknown>;
-    const descriptor = Object.getOwnPropertyDescriptor(proto, methodName);
-    if (!descriptor) continue;
-
-    for (const decorator of cfg.decorators) {
-      decorator(proto, methodName, descriptor);
-    }
-  }
+  });
+  return MePasswordController;
 }
diff --git a/packages/rockets-server-auth/src/domains/auth/index.ts b/packages/rockets-server-auth/src/domains/auth/index.ts
index 46204fb6b..b60de502e 100644
--- a/packages/rockets-server-auth/src/domains/auth/index.ts
+++ b/packages/rockets-server-auth/src/domains/auth/index.ts
@@ -7,6 +7,7 @@
 // Gateway controllers
 export { buildMePasswordController } from './gateways/http/factories/build-me-password-controller';
 export { RocketsAuthTokenController } from './gateways/http/controllers/rockets-auth-token.controller';
+export { RocketsAuthRecoveryController } from './gateways/http/controllers/rockets-auth-recovery.controller';
 
 // Application — Commands
 export { ChangeMyPasswordCommand } from './application/commands/impl/change-my-password.command';
@@ -25,5 +26,4 @@ export type {
   MePasswordRouteExtras,
   RocketsAuthClassDecorator,
   RocketsAuthMethodDecorator,
-  RocketsAuthRouteHandlerOverride,
 } from './interfaces/me-password-controller-extras.interface';
diff --git a/packages/rockets-server-auth/src/domains/auth/interfaces/me-password-controller-extras.interface.ts b/packages/rockets-server-auth/src/domains/auth/interfaces/me-password-controller-extras.interface.ts
index 2024c41d0..9f7679ea6 100644
--- a/packages/rockets-server-auth/src/domains/auth/interfaces/me-password-controller-extras.interface.ts
+++ b/packages/rockets-server-auth/src/domains/auth/interfaces/me-password-controller-extras.interface.ts
@@ -1,5 +1,3 @@
-import { Type } from '@nestjs/common';
-
 /**
  * Decorator factory shape — anything compatible with `@SetMetadata`,
  * `@UseGuards`, `@Throttle`, `@ApiTags`, custom decorators, etc.
@@ -31,17 +29,3 @@ export interface MePasswordControllerExtras {
     changePassword?: MePasswordRouteExtras;
   };
 }
-
-/**
- * Phase-1 acceptance: every gateway controller in this package SHOULD
- * accept this same triplet shape — `classDecorators`, `routes[*].decorators`,
- * and (where a backing handler exists) `routes[*].useHandler: Type<...>`.
- *
- * The `useHandler` slot is reserved for controllers whose request handlers
- * are factored into separate `@Injectable()` classes (the canonical pattern
- * documented in `.context/v8-ddd-refactor-plan.md` §2.8). The auth domain
- * keeps its handler logic in the CQRS command, so `useHandler` is unused
- * here — but the field is part of the contract for symmetry across
- * controllers.
- */
-export type RocketsAuthRouteHandlerOverride = Type<unknown>;
diff --git a/packages/rockets-server-auth/src/domains/invitation/__tests__/invitation-user-acceptance.listener.spec.ts b/packages/rockets-server-auth/src/domains/invitation/__tests__/invitation-user-acceptance.listener.spec.ts
index a8d85dacb..0e26a5082 100644
--- a/packages/rockets-server-auth/src/domains/invitation/__tests__/invitation-user-acceptance.listener.spec.ts
+++ b/packages/rockets-server-auth/src/domains/invitation/__tests__/invitation-user-acceptance.listener.spec.ts
@@ -120,7 +120,8 @@ describe('InvitationUserAcceptanceListener', () => {
     // outer catch in the listener receives the error.
     const txScopeMock = {
       run: vi.fn(
-        async (_ctx: unknown, fn: () => Promise<unknown>) => await fn(),
+        async (ctx: unknown, fn: (txCtx: unknown) => Promise<unknown>) =>
+          await fn(ctx),
       ),
     } as unknown as TransactionScope;
 
@@ -194,14 +195,20 @@ describe('InvitationUserAcceptanceListener', () => {
 
       await listener.handle(event);
 
-      expect(mockUserPortService.byId).toHaveBeenCalledWith('user-123');
+      expect(mockUserPortService.byId).toHaveBeenCalledWith(
+        expect.anything(),
+        'user-123',
+      );
       expect(mockPasswordService.create).toHaveBeenCalledWith('Test123!');
-      expect(mockUserPortService.update).toHaveBeenCalledWith({
-        id: 'user-123',
-        passwordHash: 'hashed-password',
-        passwordSalt: 'salt',
-        active: true,
-      });
+      expect(mockUserPortService.update).toHaveBeenCalledWith(
+        expect.anything(),
+        {
+          id: 'user-123',
+          passwordHash: 'hashed-password',
+          passwordSalt: 'salt',
+          active: true,
+        },
+      );
       expect(mockCommandBus.execute).toHaveBeenCalledWith(
         expect.any(AssignDefaultRoleCommand),
       );
@@ -220,10 +227,10 @@ describe('InvitationUserAcceptanceListener', () => {
       await listener.handle(event);
 
       expect(mockPasswordService.create).not.toHaveBeenCalled();
-      expect(mockUserPortService.update).toHaveBeenCalledWith({
-        id: 'user-123',
-        active: true,
-      });
+      expect(mockUserPortService.update).toHaveBeenCalledWith(
+        expect.anything(),
+        { id: 'user-123', active: true },
+      );
     });
 
     it('should create user metadata when provided', async () => {
@@ -338,7 +345,10 @@ describe('InvitationUserAcceptanceListener', () => {
 
       await listener.handle(event);
 
-      expect(mockUserPortService.byId).toHaveBeenCalledWith('user-123');
+      expect(mockUserPortService.byId).toHaveBeenCalledWith(
+        expect.anything(),
+        'user-123',
+      );
       expect(mockPasswordService.create).not.toHaveBeenCalled();
       expect(mockUserPortService.update).not.toHaveBeenCalled();
     });
diff --git a/packages/rockets-server-auth/src/domains/invitation/application/commands/handlers/send-invitation-email.handler.ts b/packages/rockets-server-auth/src/domains/invitation/application/commands/handlers/send-invitation-email.handler.ts
index 7dc7344fb..bf33575be 100644
--- a/packages/rockets-server-auth/src/domains/invitation/application/commands/handlers/send-invitation-email.handler.ts
+++ b/packages/rockets-server-auth/src/domains/invitation/application/commands/handlers/send-invitation-email.handler.ts
@@ -1,5 +1,5 @@
 import { CommandHandler, ICommandHandler, QueryBus } from '@nestjs/cqrs';
-import { Inject, Logger } from '@nestjs/common';
+import { Inject, Logger, type PlainLiteralObject } from '@nestjs/common';
 import { EmailService } from '@concepta/nestjs-email';
 import { GetUserQuery } from '@concepta/nestjs-user';
 import { InvitationUserUndefinedException } from '@concepta/nestjs-invitation';
@@ -15,9 +15,10 @@ import type { RocketsAuthSettingsInterface } from '../../../../../shared/interfa
  */
 async function resolveUserEmail(
   queryBus: QueryBus,
+  ctx: PlainLiteralObject,
   userId: string,
 ): Promise<string> {
-  const user = await queryBus.execute(new GetUserQuery({}, userId));
+  const user = await queryBus.execute(new GetUserQuery(ctx, userId));
   if (!user?.email) {
     throw new InvitationUserUndefinedException();
   }
@@ -48,7 +49,11 @@ export class SendInvitationEmailHandler
 
   async execute(command: SendInvitationEmailCommand): Promise<void> {
     const { invitation, passcode, tokenExp } = command;
-    const email = await resolveUserEmail(this.queryBus, invitation.userId);
+    const email = await resolveUserEmail(
+      this.queryBus,
+      command.ctx,
+      invitation.userId,
+    );
     const { from, baseUrl, templates } = this.settings.email;
     const template = templates.invitation;
     this.logger.debug(`Sending invitation email to ${email}`);
@@ -89,7 +94,11 @@ export class SendAcceptedEmailHandler
 
   async execute(command: SendAcceptedEmailCommand): Promise<void> {
     const { invitation } = command;
-    const email = await resolveUserEmail(this.queryBus, invitation.userId);
+    const email = await resolveUserEmail(
+      this.queryBus,
+      command.ctx,
+      invitation.userId,
+    );
     const { from, templates } = this.settings.email;
     const template = templates.invitationAccepted;
     this.logger.debug(`Sending accepted email to ${email}`);
diff --git a/packages/rockets-server-auth/src/domains/invitation/application/listeners/invitation-user-acceptance.listener.ts b/packages/rockets-server-auth/src/domains/invitation/application/listeners/invitation-user-acceptance.listener.ts
index a963136bf..31e08b26b 100644
--- a/packages/rockets-server-auth/src/domains/invitation/application/listeners/invitation-user-acceptance.listener.ts
+++ b/packages/rockets-server-auth/src/domains/invitation/application/listeners/invitation-user-acceptance.listener.ts
@@ -24,6 +24,8 @@ import {
   INVITATION_ACCEPTANCE_CONFIG_TOKEN,
 } from '../../infrastructure/config/invitation-acceptance.config';
 import { whitelistedFromDto } from '@concepta/rockets-core';
+import { AppContextHost } from '@concepta/rockets-core';
+import type { PlainLiteralObject } from '@nestjs/common';
 
 /**
  * Invitation User Acceptance Listener
@@ -72,18 +74,14 @@ export class InvitationUserAcceptanceListener
     // than leaving the user half-onboarded (active=true, no metadata, no
     // role). The outer catch keeps the event-listener contract (don't
     // re-throw — other listeners on the same event still get to run).
-    const txCtx = {
-      source: 'invitation-acceptance',
-      invitationId: invitation.id,
-      userId: invitation.userId,
-      category: invitation.category,
-    };
+    const ctx = new AppContextHost();
     try {
-      await this.txScope.run(txCtx, async () => {
+      await this.txScope.run(ctx, async (txCtx) => {
         const { password, userMetadata } =
           this.extractAcceptedData(acceptanceData);
 
         const userExists = await this.ensureUserExists({
+          ctx: txCtx,
           userId: invitation.userId,
           invitationId: invitation.id,
         });
@@ -93,9 +91,14 @@ export class InvitationUserAcceptanceListener
           password,
           invitation.userId,
         );
-        await this.updateUserActivation(invitation.userId, passwordFields);
+        await this.updateUserActivation(
+          txCtx,
+          invitation.userId,
+          passwordFields,
+        );
 
         await this.updateUserMetadata({
+          ctx: txCtx,
           userId: invitation.userId,
           userMetadata,
         });
@@ -103,7 +106,7 @@ export class InvitationUserAcceptanceListener
         const allowedRoleId = invitation.constraints?.roleId as
           | string
           | undefined;
-        await this.assignUserRole(invitation.userId, allowedRoleId);
+        await this.assignUserRole(txCtx, invitation.userId, allowedRoleId);
         this.logAcceptanceSuccess({
           invitationId: invitation.id,
           userId: invitation.userId,
@@ -126,10 +129,11 @@ export class InvitationUserAcceptanceListener
   }
 
   private async ensureUserExists(options: {
+    ctx: PlainLiteralObject;
     userId: string;
     invitationId: string;
   }): Promise<boolean> {
-    const user = await this.userModelService.byId(options.userId);
+    const user = await this.userModelService.byId(options.ctx, options.userId);
     if (!user) {
       this.logger.error('User not found for invitation', {
         userId: options.userId,
@@ -151,10 +155,11 @@ export class InvitationUserAcceptanceListener
   }
 
   private async updateUserActivation(
+    ctx: PlainLiteralObject,
     userId: string,
     passwordFields: Record<string, unknown>,
   ): Promise<void> {
-    await this.userModelService.update({
+    await this.userModelService.update(ctx, {
       id: userId,
       ...passwordFields,
       active: true,
@@ -163,10 +168,11 @@ export class InvitationUserAcceptanceListener
   }
 
   private async updateUserMetadata(options: {
+    ctx: PlainLiteralObject;
     userId: string;
     userMetadata?: InvitationAcceptanceDataInterface['userMetadata'];
   }): Promise<void> {
-    const { userId, userMetadata } = options;
+    const { ctx, userId, userMetadata } = options;
     if (!userMetadata || Object.keys(userMetadata).length === 0) return;
 
     const MetadataUpdateDto = this.config.userMetadataUpdateDto;
@@ -180,21 +186,22 @@ export class InvitationUserAcceptanceListener
     }
 
     await this.commandBus.execute(
-      new SaveUserMetadataCommand(userId, metadata),
+      new SaveUserMetadataCommand(ctx, userId, metadata),
     );
     this.logger.log('User metadata created/updated successfully', { userId });
   }
 
   private async assignUserRole(
+    ctx: PlainLiteralObject,
     userId: string,
     allowedRoleId?: string,
   ): Promise<void> {
     if (allowedRoleId) {
       await this.commandBus.execute(
-        new AssignRoleCommand({}, USER_ROLE_ENTITY_KEY, allowedRoleId, userId),
+        new AssignRoleCommand(ctx, USER_ROLE_ENTITY_KEY, allowedRoleId, userId),
       );
     } else {
-      await this.commandBus.execute(new AssignDefaultRoleCommand(userId));
+      await this.commandBus.execute(new AssignDefaultRoleCommand(ctx, userId));
     }
   }
 
diff --git a/packages/rockets-server-auth/src/domains/invitation/gateways/http/factories/build-invitation-controllers.ts b/packages/rockets-server-auth/src/domains/invitation/gateways/http/factories/build-invitation-controllers.ts
index 3a18d5c0e..5dd861896 100644
--- a/packages/rockets-server-auth/src/domains/invitation/gateways/http/factories/build-invitation-controllers.ts
+++ b/packages/rockets-server-auth/src/domains/invitation/gateways/http/factories/build-invitation-controllers.ts
@@ -6,9 +6,10 @@ import {
   Param,
   Patch,
   Post,
-  Type,
+  Req,
   UseGuards,
 } from '@nestjs/common';
+import type { Type } from '@nestjs/common';
 import {
   ApiBearerAuth,
   ApiCreatedResponse,
@@ -24,11 +25,13 @@ import {
   AcceptInvitationCommand,
   CreateInvitationByEmailCommand,
   FindInvitationByCodeQuery,
-  Invitation,
   InvitationNotFoundException,
   RevokeInvitationsCommand,
   SendInvitationCommand,
+  type Invitation,
 } from '@concepta/nestjs-invitation';
+import { getAppContext } from '@concepta/rockets-core';
+import type { Request } from 'express';
 
 import { AdminGuard } from '../../../../../guards/admin.guard';
 import { applyControllerExtras } from '../../../../../shared/utils/apply-controller-extras.helper';
@@ -37,18 +40,14 @@ import { RocketsAuthInvitationCreateDto } from '../../../infrastructure/dto/rock
 import { RocketsAuthInvitationResponseDto } from '../../../infrastructure/dto/rockets-auth-invitation-response.dto';
 import { RocketsAuthInvitationRevokeDto } from '../../../infrastructure/dto/rockets-auth-invitation-revoke.dto';
 import { RocketsAuthInvitationNotAcceptedException } from '../../../domain/exceptions/invitation.exception';
-import {
+import type {
   InvitationAcceptanceControllerExtras,
   InvitationControllerExtras,
   InvitationReattemptControllerExtras,
   InvitationRevocationControllerExtras,
 } from '../../../interfaces/invitation-controller-extras.interface';
 
-/**
- * Build `POST /admin/invitations` (create + send).
- * Replaces the cast `} as RocketsAuthInvitationResponseDto` (W4) by
- * constructing the response DTO via `plainToInstance`.
- */
+/** Build `POST /admin/invitations` and materialize its response DTO. */
 export function buildInvitationController(
   extras: InvitationControllerExtras = {},
 ): Type<unknown> {
@@ -75,14 +74,16 @@ export function buildInvitationController(
     })
     async create(
       @Body() dto: RocketsAuthInvitationCreateDto,
+      @Req() req: Request,
     ): Promise<RocketsAuthInvitationResponseDto> {
+      const ctx = getAppContext(req);
       const invitation: Invitation = await this.commandBus.execute(
-        new CreateInvitationByEmailCommand({}, dto),
+        new CreateInvitationByEmailCommand(ctx, dto),
       );
       let emailError: string | undefined;
       try {
         await this.commandBus.execute(
-          new SendInvitationCommand({}, invitation.id),
+          new SendInvitationCommand(ctx, invitation.id),
         );
         this.logger.log('Invitation sent successfully', {
           invitationId: invitation.id,
@@ -114,7 +115,7 @@ export function buildInvitationAcceptanceController(
   extras: InvitationAcceptanceControllerExtras = {},
 ): Type<unknown> {
   @Controller('invitation-acceptance')
-  @AuthPublic()
+  @AuthPublic({ classLevel: true })
   @ApiTags('auth')
   class InvitationAcceptanceController {
     constructor(private readonly commandBus: CommandBus) {}
@@ -135,10 +136,12 @@ export function buildInvitationAcceptanceController(
     async accept(
       @Param('code') code: string,
       @Body() dto: RocketsAuthInvitationAcceptDto,
+      @Req() req: Request,
     ): Promise<void> {
+      const ctx = getAppContext(req);
       const { passcode, payload } = dto;
       const result: Invitation | null = await this.commandBus.execute(
-        new AcceptInvitationCommand({}, code, { passcode, payload }),
+        new AcceptInvitationCommand(ctx, code, { passcode, payload }),
       );
       if (!result) {
         throw new RocketsAuthInvitationNotAcceptedException();
@@ -170,9 +173,13 @@ export function buildInvitationRevocationController(
         'Revoke all active invitations for a specific email and category',
     })
     @ApiCreatedResponse({ description: 'Invitations revoked successfully' })
-    async revoke(@Body() dto: RocketsAuthInvitationRevokeDto): Promise<void> {
+    async revoke(
+      @Body() dto: RocketsAuthInvitationRevokeDto,
+      @Req() req: Request,
+    ): Promise<void> {
+      const ctx = getAppContext(req);
       await this.commandBus.execute(
-        new RevokeInvitationsCommand({}, dto.email, dto.category),
+        new RevokeInvitationsCommand(ctx, dto.email, dto.category),
       );
     }
   }
@@ -210,15 +217,19 @@ export function buildInvitationReattemptController(
     @ApiCreatedResponse({
       description: 'Invitation email re-sent successfully',
     })
-    async reattempt(@Param('code') code: string): Promise<void> {
+    async reattempt(
+      @Param('code') code: string,
+      @Req() req: Request,
+    ): Promise<void> {
+      const ctx = getAppContext(req);
       const invitation: Invitation | null = await this.queryBus.execute(
-        new FindInvitationByCodeQuery({}, code),
+        new FindInvitationByCodeQuery(ctx, code),
       );
       if (!invitation) {
         throw new InvitationNotFoundException(code);
       }
       await this.commandBus.execute(
-        new SendInvitationCommand({}, invitation.id),
+        new SendInvitationCommand(ctx, invitation.id),
       );
     }
   }
diff --git a/packages/rockets-server-auth/src/domains/invitation/interfaces/invitation-controller-extras.interface.ts b/packages/rockets-server-auth/src/domains/invitation/interfaces/invitation-controller-extras.interface.ts
index 14bbc9345..2ad0bea22 100644
--- a/packages/rockets-server-auth/src/domains/invitation/interfaces/invitation-controller-extras.interface.ts
+++ b/packages/rockets-server-auth/src/domains/invitation/interfaces/invitation-controller-extras.interface.ts
@@ -1,4 +1,4 @@
-import {
+import type {
   RocketsAuthControllerExtrasBase,
   RocketsAuthRouteExtrasBase,
 } from '../../../shared/interfaces/controller/rockets-auth-controller-extras.interface';
diff --git a/packages/rockets-server-auth/src/domains/oauth/controllers/auth-oauth.controller.ts b/packages/rockets-server-auth/src/domains/oauth/controllers/auth-oauth.controller.ts
deleted file mode 100644
index 00ededddb..000000000
--- a/packages/rockets-server-auth/src/domains/oauth/controllers/auth-oauth.controller.ts
+++ /dev/null
@@ -1,111 +0,0 @@
-// TODO(upstream: concepta/nestjs-auth-apple|github|google) — re-enable this
-// controller when v8 OAuth provider packages ship.
-//
-// As of @concepta/nestjs-authentication@8.0.0-alpha.5, the v7 OAuth provider
-// packages (`nestjs-auth-apple`, `nestjs-auth-github`, `nestjs-auth-google`)
-// have HARD `dependencies` on `@concepta/nestjs-authentication@^7.0.0-alpha.10`.
-// Installing them alongside v8 produces two parallel `nestjs-authentication`
-// trees in node_modules with separate guard/strategy registries, so the v8
-// `AuthRouterGuard` cannot dispatch to v7-registered providers at runtime.
-//
-// Until upstream publishes v8 of those three OAuth provider packages, the
-// entire OAuth flow is parked. The original implementation is preserved
-// below in a block comment for fast restore once the upstream blocker
-// clears. To re-enable:
-//
-//  1. Restore the imports + class body below.
-//  2. Update the imports: replace `IssueTokenService`/`IssueTokenServiceInterface`
-//     with the v8 equivalents (the v8 module dispatches via
-//     `IssueAccessTokenCommand` / `IssueAuthenticatedResponseCommand`).
-//     Replace `AuthenticationJwtResponseDto` with `AuthenticationResponseDto`.
-//     Source `AuthenticatedUserInterface` from
-//     `@concepta/nestjs-authentication` (it lives there in v8) instead of
-//     `@concepta/nestjs-common`.
-//     `AuthRouterGuard` is exported from `@concepta/nestjs-authentication` v8.
-//  3. Re-add `AuthOAuthController` to `module-definition`'s controllers list.
-//  4. Re-export from `domains/oauth/index.ts`.
-//  5. Restore the controller in `examples/sample-server-auth` if needed.
-
-export {};
-
-/* original implementation kept verbatim for restoration ---
-
-import { Controller, Inject, Get, UseGuards, Post } from '@nestjs/common';
-import { ApiOkResponse, ApiTags, ApiQuery, ApiResponse } from '@nestjs/swagger';
-import {
-  AuthenticatedUserInterface,
-  AuthenticationResponseInterface,
-} from '@concepta/nestjs-common';
-import {
-  AuthUser,
-  IssueTokenServiceInterface,
-  AuthenticationJwtResponseDto,
-  AuthPublic,
-  IssueTokenService,
-} from '@concepta/nestjs-authentication';
-import { AuthRouterGuard } from '@concepta/nestjs-auth-router';
-
-@Controller('oauth')
-@UseGuards(AuthRouterGuard)
-@AuthPublic()
-@ApiTags('Authentication')
-export class AuthOAuthController {
-  constructor(
-    @Inject(IssueTokenService)
-    private issueTokenService: IssueTokenServiceInterface,
-  ) {}
-
-  @ApiResponse({
-    status: 302,
-    description:
-      "HTTP Redirect to the OAuth identity provider's authorization URL.",
-    headers: {
-      Location: {
-        description:
-          'URL to which the user agent should redirect (or open in a browser for mobile apps).',
-        schema: { type: 'string', format: 'uri' },
-      },
-    },
-  })
-  @ApiQuery({
-    name: 'provider',
-    description:
-      'Name of the OAuth provider. Supported providers: google, github, apple',
-    example: 'google',
-    required: true,
-    schema: { type: 'string', enum: ['google', 'github', 'apple'] },
-  })
-  @ApiQuery({
-    name: 'scopes',
-    required: true,
-    description:
-      'Space-separated list of OAuth scopes to pass on to the provider. Common scopes: email, profile, openid.',
-    example: 'email profile',
-    schema: { type: 'string', pattern: '[^ ]+( +[^ ]+)*' },
-  })
-  @Get('authorize')
-  authorize(): void { return; }
-
-  @ApiOkResponse({
-    type: AuthenticationJwtResponseDto,
-    description: 'DTO containing an access token and a refresh token.',
-  })
-  @Get('callback')
-  async callback(
-    @AuthUser() user: AuthenticatedUserInterface,
-  ): Promise<AuthenticationResponseInterface> {
-    return this.issueTokenService.responsePayload(user.id);
-  }
-
-  @ApiOkResponse({
-    type: AuthenticationJwtResponseDto,
-    description: 'DTO containing an access token and a refresh token.',
-  })
-  @Post('callback')
-  async callbackPost(
-    @AuthUser() user: AuthenticatedUserInterface,
-  ): Promise<AuthenticationResponseInterface> {
-    return this.issueTokenService.responsePayload(user.id);
-  }
-}
---- end original implementation */
diff --git a/packages/rockets-server-auth/src/domains/oauth/index.ts b/packages/rockets-server-auth/src/domains/oauth/index.ts
deleted file mode 100644
index 037b591f0..000000000
--- a/packages/rockets-server-auth/src/domains/oauth/index.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-// OAuth Domain Public API
-//
-// TODO(upstream: concepta/nestjs-auth-apple|github|google) — re-export
-// `AuthOAuthController` once v8 OAuth provider packages ship. The
-// controller body is preserved (commented) in
-// `./controllers/auth-oauth.controller.ts` for fast restore.
-
-export {};
diff --git a/packages/rockets-server-auth/src/domains/otp/application/commands/handlers/rockets-clear-otps.handler.ts b/packages/rockets-server-auth/src/domains/otp/application/commands/handlers/rockets-clear-otps.handler.ts
index 17dedb4ea..410593562 100644
--- a/packages/rockets-server-auth/src/domains/otp/application/commands/handlers/rockets-clear-otps.handler.ts
+++ b/packages/rockets-server-auth/src/domains/otp/application/commands/handlers/rockets-clear-otps.handler.ts
@@ -11,7 +11,7 @@ export class RocketsClearOtpsHandler
   async execute(command: RocketsClearOtpsCommand): Promise<void> {
     const namespace = String(command.assignment);
     await this.commandBus.execute(
-      new ClearOtpsCommand({}, namespace, {
+      new ClearOtpsCommand(command.ctx, namespace, {
         category: command.otp.category,
         assigneeId: command.otp.assigneeId,
       }),
diff --git a/packages/rockets-server-auth/src/domains/otp/application/commands/handlers/rockets-create-otp.handler.ts b/packages/rockets-server-auth/src/domains/otp/application/commands/handlers/rockets-create-otp.handler.ts
index f5914fed5..da8817578 100644
--- a/packages/rockets-server-auth/src/domains/otp/application/commands/handlers/rockets-create-otp.handler.ts
+++ b/packages/rockets-server-auth/src/domains/otp/application/commands/handlers/rockets-create-otp.handler.ts
@@ -12,7 +12,7 @@ export class RocketsCreateOtpHandler
     const { assignment, otp } = command.params;
     const namespace = String(assignment);
     return this.commandBus.execute(
-      new CreateOtpCommand({}, namespace, {
+      new CreateOtpCommand(command.ctx, namespace, {
         category: otp.category,
         type: otp.type,
         assigneeId: otp.assigneeId,
diff --git a/packages/rockets-server-auth/src/domains/otp/application/commands/impl/rockets-clear-otps.command.ts b/packages/rockets-server-auth/src/domains/otp/application/commands/impl/rockets-clear-otps.command.ts
index 273b4265b..167af3240 100644
--- a/packages/rockets-server-auth/src/domains/otp/application/commands/impl/rockets-clear-otps.command.ts
+++ b/packages/rockets-server-auth/src/domains/otp/application/commands/impl/rockets-clear-otps.command.ts
@@ -1,8 +1,10 @@
 import { ReferenceAssignment } from '@concepta/nestjs-core';
 import { OtpInterface } from '@concepta/nestjs-otp';
+import type { PlainLiteralObject } from '@nestjs/common';
 
 export class RocketsClearOtpsCommand {
   constructor(
+    public readonly ctx: PlainLiteralObject,
     public readonly assignment: ReferenceAssignment,
     public readonly otp: Pick<OtpInterface, 'assigneeId' | 'category'>,
   ) {}
diff --git a/packages/rockets-server-auth/src/domains/otp/application/commands/impl/rockets-create-otp.command.ts b/packages/rockets-server-auth/src/domains/otp/application/commands/impl/rockets-create-otp.command.ts
index 2728ec3ba..b4727f76e 100644
--- a/packages/rockets-server-auth/src/domains/otp/application/commands/impl/rockets-create-otp.command.ts
+++ b/packages/rockets-server-auth/src/domains/otp/application/commands/impl/rockets-create-otp.command.ts
@@ -1,5 +1,6 @@
 import { ReferenceAssignment } from '@concepta/nestjs-core';
 import { OtpCreatableInterface } from '@concepta/nestjs-otp';
+import type { PlainLiteralObject } from '@nestjs/common';
 
 /**
  * Parameters for creating an OTP through the Rockets Auth port.
@@ -19,5 +20,8 @@ export interface RocketsCreateOtpParams {
 }
 
 export class RocketsCreateOtpCommand {
-  constructor(public readonly params: RocketsCreateOtpParams) {}
+  constructor(
+    public readonly ctx: PlainLiteralObject,
+    public readonly params: RocketsCreateOtpParams,
+  ) {}
 }
diff --git a/packages/rockets-server-auth/src/domains/otp/application/handlers.spec.ts b/packages/rockets-server-auth/src/domains/otp/application/handlers.spec.ts
index 83cf4c16d..39a6120bf 100644
--- a/packages/rockets-server-auth/src/domains/otp/application/handlers.spec.ts
+++ b/packages/rockets-server-auth/src/domains/otp/application/handlers.spec.ts
@@ -37,6 +37,7 @@ describe('OTP application handlers', () => {
       queryBus.execute.mockResolvedValueOnce(null);
       const out = await handler.execute(
         new RocketsValidateOtpQuery(
+          {},
           'user-otp',
           { category: 'recovery', passcode: 'abc' },
           true,
@@ -54,6 +55,7 @@ describe('OTP application handlers', () => {
       queryBus.execute.mockResolvedValueOnce(assignee);
       const out = await handler.execute(
         new RocketsValidateOtpQuery(
+          {},
           'user-otp',
           { category: 'recovery', passcode: 'abc' },
           true,
@@ -70,6 +72,7 @@ describe('OTP application handlers', () => {
       queryBus.execute.mockResolvedValueOnce(assignee);
       const out = await handler.execute(
         new RocketsValidateOtpQuery(
+          {},
           'user-otp',
           { category: 'recovery', passcode: 'abc' },
           false,
@@ -89,15 +92,18 @@ describe('OTP application handlers', () => {
       commandBus.execute.mockResolvedValueOnce(created);
 
       const out = await handler.execute(
-        new RocketsCreateOtpCommand({
-          assignment: 'user-otp',
-          otp: {
-            category: 'recovery',
-            type: 'uuid',
-            assigneeId: 'u1',
-            expiresIn: '1h',
+        new RocketsCreateOtpCommand(
+          {},
+          {
+            assignment: 'user-otp',
+            otp: {
+              category: 'recovery',
+              type: 'uuid',
+              assigneeId: 'u1',
+              expiresIn: '1h',
+            },
           },
-        }),
+        ),
       );
 
       expect(out).toBe(created);
@@ -115,7 +121,7 @@ describe('OTP application handlers', () => {
       commandBus.execute.mockResolvedValueOnce(undefined);
 
       await handler.execute(
-        new RocketsClearOtpsCommand('user-otp', {
+        new RocketsClearOtpsCommand({}, 'user-otp', {
           category: 'recovery',
           assigneeId: 'u1',
         }),
diff --git a/packages/rockets-server-auth/src/domains/otp/application/queries/handlers/rockets-validate-otp.handler.ts b/packages/rockets-server-auth/src/domains/otp/application/queries/handlers/rockets-validate-otp.handler.ts
index 1ccac61e8..1646ddc90 100644
--- a/packages/rockets-server-auth/src/domains/otp/application/queries/handlers/rockets-validate-otp.handler.ts
+++ b/packages/rockets-server-auth/src/domains/otp/application/queries/handlers/rockets-validate-otp.handler.ts
@@ -26,14 +26,14 @@ export class RocketsValidateOtpHandler
       ValidateOtpQuery,
       AssigneeRelationInterface | null
     >(
-      new ValidateOtpQuery({}, namespace, {
+      new ValidateOtpQuery(query.ctx, namespace, {
         category: query.otp.category,
         passcode: query.otp.passcode,
       }),
     );
     if (result && query.deleteIfValid) {
       await this.commandBus.execute(
-        new ConsumeOtpCommand({}, namespace, {
+        new ConsumeOtpCommand(query.ctx, namespace, {
           category: query.otp.category,
           passcode: query.otp.passcode,
         }),
diff --git a/packages/rockets-server-auth/src/domains/otp/application/queries/impl/rockets-validate-otp.query.ts b/packages/rockets-server-auth/src/domains/otp/application/queries/impl/rockets-validate-otp.query.ts
index f2322dacd..0608a03a9 100644
--- a/packages/rockets-server-auth/src/domains/otp/application/queries/impl/rockets-validate-otp.query.ts
+++ b/packages/rockets-server-auth/src/domains/otp/application/queries/impl/rockets-validate-otp.query.ts
@@ -1,8 +1,10 @@
 import { ReferenceAssignment } from '@concepta/nestjs-core';
 import { OtpInterface } from '@concepta/nestjs-otp';
+import type { PlainLiteralObject } from '@nestjs/common';
 
 export class RocketsValidateOtpQuery {
   constructor(
+    public readonly ctx: PlainLiteralObject,
     public readonly assignment: ReferenceAssignment,
     public readonly otp: Pick<OtpInterface, 'category' | 'passcode'>,
     public readonly deleteIfValid: boolean,
diff --git a/packages/rockets-server-auth/src/domains/otp/gateways/http/factories/build-rockets-auth-otp-controller.ts b/packages/rockets-server-auth/src/domains/otp/gateways/http/factories/build-rockets-auth-otp-controller.ts
index 31c798f51..1a91fcf76 100644
--- a/packages/rockets-server-auth/src/domains/otp/gateways/http/factories/build-rockets-auth-otp-controller.ts
+++ b/packages/rockets-server-auth/src/domains/otp/gateways/http/factories/build-rockets-auth-otp-controller.ts
@@ -3,9 +3,10 @@ import {
   Controller,
   Patch,
   Post,
-  Type,
+  Req,
   UnauthorizedException,
 } from '@nestjs/common';
+import type { Type } from '@nestjs/common';
 import { CommandBus } from '@nestjs/cqrs';
 import { Throttle } from '@nestjs/throttler';
 import {
@@ -18,31 +19,26 @@ import {
 } from '@nestjs/swagger';
 import {
   AuthPublic,
-  AuthenticatedResponseInterface,
   AuthenticationResponseDto,
   IssueAuthenticatedResponseCommand,
+  type AuthenticatedResponseInterface,
 } from '@concepta/nestjs-authentication';
 import { OtpException } from '@concepta/nestjs-otp';
 
 import { RocketsAuthOtpConfirmDto } from '../../../infrastructure/dto/rockets-auth-otp-confirm.dto';
 import { RocketsAuthOtpSendDto } from '../../../infrastructure/dto/rockets-auth-otp-send.dto';
 import { RocketsAuthOtpService } from '../../../infrastructure/services/rockets-auth-otp.service';
-import { OtpControllerExtras } from '../../../interfaces/otp-controller-extras.interface';
+import type { OtpControllerExtras } from '../../../interfaces/otp-controller-extras.interface';
+import { applyControllerExtras } from '../../../../../shared/utils/apply-controller-extras.helper';
+import { getAppContext } from '@concepta/rockets-core';
+import type { Request } from 'express';
 
-/**
- * Build the OTP controller, applying any consumer-supplied
- * `extras.classDecorators`, `routes.send.decorators`, and
- * `routes.confirm.decorators`.
- *
- * Business logic lives in {@link RocketsAuthOtpService} (overrideable via
- * its per-method seams). To customise transport, swap the service via DI;
- * to add guards / throttling / ACL, append decorators via extras.
- */
+/** Build the OTP controller and apply consumer-supplied decorators. */
 export function buildRocketsAuthOtpController(
   extras: OtpControllerExtras = {},
 ): Type<unknown> {
   @Controller('otp')
-  @AuthPublic()
+  @AuthPublic({ classLevel: true })
   @ApiTags('Authentication')
   class RocketsAuthOtpController {
     constructor(
@@ -69,8 +65,12 @@ export function buildRocketsAuthOtpController(
     @ApiBadRequestResponse({ description: 'Invalid email format' })
     @Throttle({ default: { limit: 3, ttl: 60000 } })
     @Post()
-    async sendOtp(@Body() dto: RocketsAuthOtpSendDto): Promise<void> {
-      return this.otpService.sendOtp(dto.email);
+    async sendOtp(
+      @Body() dto: RocketsAuthOtpSendDto,
+      @Req() req: Request,
+    ): Promise<void> {
+      const ctx = getAppContext(req);
+      return this.otpService.sendOtp(ctx, dto.email);
     }
 
     @ApiOperation({
@@ -102,11 +102,17 @@ export function buildRocketsAuthOtpController(
     @Patch()
     async confirmOtp(
       @Body() dto: RocketsAuthOtpConfirmDto,
+      @Req() req: Request,
     ): Promise<AuthenticatedResponseInterface> {
+      const ctx = getAppContext(req);
       try {
-        const user = await this.otpService.confirmOtp(dto.email, dto.passcode);
+        const user = await this.otpService.confirmOtp(
+          ctx,
+          dto.email,
+          dto.passcode,
+        );
         return this.commandBus.execute(
-          new IssueAuthenticatedResponseCommand({}, user.id),
+          new IssueAuthenticatedResponseCommand(ctx, user.id),
         );
       } catch (error) {
         if (error instanceof OtpException) {
@@ -117,33 +123,9 @@ export function buildRocketsAuthOtpController(
     }
   }
 
-  applyExtras(RocketsAuthOtpController, extras);
-  return RocketsAuthOtpController;
-}
-
-function applyExtras(
-  controllerClass: Type<unknown>,
-  extras: OtpControllerExtras,
-): void {
-  for (const decorator of extras.classDecorators ?? []) {
-    decorator(controllerClass);
-  }
-
-  const routeMap: Record<string, string> = {
+  applyControllerExtras(RocketsAuthOtpController, extras, {
     send: 'sendOtp',
     confirm: 'confirmOtp',
-  };
-
-  for (const [routeKey, methodName] of Object.entries(routeMap)) {
-    const cfg = extras.routes?.[routeKey as keyof typeof extras.routes];
-    if (!cfg?.decorators) continue;
-
-    const proto = controllerClass.prototype as Record<string, unknown>;
-    const descriptor = Object.getOwnPropertyDescriptor(proto, methodName);
-    if (!descriptor) continue;
-
-    for (const decorator of cfg.decorators) {
-      decorator(proto, methodName, descriptor);
-    }
-  }
+  });
+  return RocketsAuthOtpController;
 }
diff --git a/packages/rockets-server-auth/src/domains/otp/infrastructure/services/rockets-auth-otp.service.spec.ts b/packages/rockets-server-auth/src/domains/otp/infrastructure/services/rockets-auth-otp.service.spec.ts
index 322c181b0..886728807 100644
--- a/packages/rockets-server-auth/src/domains/otp/infrastructure/services/rockets-auth-otp.service.spec.ts
+++ b/packages/rockets-server-auth/src/domains/otp/infrastructure/services/rockets-auth-otp.service.spec.ts
@@ -66,6 +66,7 @@ function makeService() {
 }
 
 describe(RocketsAuthOtpService.name, () => {
+  const ctx = {};
   describe('sendOtp default flow', () => {
     it('resolves user, issues otp, delivers email', async () => {
       const { service, userPort, otpPort, notif } = makeService();
@@ -76,10 +77,11 @@ describe(RocketsAuthOtpService.name, () => {
         passcode: '123-abc',
       } as OtpInterface);
 
-      await service.sendOtp('a@b.com');
+      await service.sendOtp(ctx, 'a@b.com');
 
-      expect(userPort.byEmail).toHaveBeenCalledWith('a@b.com');
+      expect(userPort.byEmail).toHaveBeenCalledWith(ctx, 'a@b.com');
       expect(otpPort.create).toHaveBeenCalledWith(
+        ctx,
         expect.objectContaining({
           assignment: ROCKETS_AUTH_OTP_ASSIGNMENT,
           otp: expect.objectContaining({ assigneeId: 'u1' }),
@@ -95,7 +97,7 @@ describe(RocketsAuthOtpService.name, () => {
       const { service, userPort, otpPort, notif } = makeService();
       userPort.byEmail.mockResolvedValueOnce(null);
 
-      await service.sendOtp('unknown@b.com');
+      await service.sendOtp(ctx, 'unknown@b.com');
 
       expect(otpPort.create).not.toHaveBeenCalled();
       expect(notif.sendOtpEmail).not.toHaveBeenCalled();
@@ -128,7 +130,7 @@ describe(RocketsAuthOtpService.name, () => {
         notif,
       );
 
-      await sub.sendOtp('a@b.com');
+      await sub.sendOtp(ctx, 'a@b.com');
 
       expect(sms).toHaveBeenCalledWith('a@b.com', 'sms-001');
       expect(notif.sendOtpEmail).not.toHaveBeenCalled();
@@ -152,7 +154,7 @@ describe(RocketsAuthOtpService.name, () => {
         notif,
       );
 
-      await expect(sub.sendOtp('a@b.com')).rejects.toThrow(
+      await expect(sub.sendOtp(ctx, 'a@b.com')).rejects.toThrow(
         RocketsAuthOtpException,
       );
       expect(notif.sendOtpEmail).not.toHaveBeenCalled();
@@ -176,7 +178,7 @@ describe(RocketsAuthOtpService.name, () => {
         notif,
       );
 
-      await expect(sub.confirmOtp('a@b.com', 'whatever')).rejects.toThrow(
+      await expect(sub.confirmOtp(ctx, 'a@b.com', 'whatever')).rejects.toThrow(
         RocketsAuthOtpException,
       );
     });
diff --git a/packages/rockets-server-auth/src/domains/otp/infrastructure/services/rockets-auth-otp.service.ts b/packages/rockets-server-auth/src/domains/otp/infrastructure/services/rockets-auth-otp.service.ts
index 2a3cab19b..921fd6b25 100644
--- a/packages/rockets-server-auth/src/domains/otp/infrastructure/services/rockets-auth-otp.service.ts
+++ b/packages/rockets-server-auth/src/domains/otp/infrastructure/services/rockets-auth-otp.service.ts
@@ -4,7 +4,12 @@ import {
   RocketsAuthOtpPortService,
   ROCKETS_AUTH_OTP_PORT_TOKEN,
 } from '../../../../shared/ports/rockets-auth-otp-port.service';
-import { Inject, Injectable, Logger } from '@nestjs/common';
+import {
+  Inject,
+  Injectable,
+  Logger,
+  type PlainLiteralObject,
+} from '@nestjs/common';
 import { OtpInterface } from '@concepta/nestjs-otp';
 import {
   RocketsAuthUserPortService,
@@ -35,8 +40,6 @@ import { RocketsAuthOtpException } from '../../domain/exceptions/rockets-auth-ot
  *
  * Register an override via
  * `{ provide: RocketsAuthOtpService, useClass: MyOtpService }`.
- *
- * See `.context/v8-ddd-refactor-plan.md` §3.3.
  */
 @Injectable()
 export class RocketsAuthOtpService implements RocketsAuthOtpServiceInterface {
@@ -53,15 +56,15 @@ export class RocketsAuthOtpService implements RocketsAuthOtpServiceInterface {
     protected readonly otpNotificationService: RocketsAuthOtpNotificationServiceInterface,
   ) {}
 
-  async sendOtp(email: string): Promise<void> {
+  async sendOtp(ctx: PlainLiteralObject, email: string): Promise<void> {
     try {
-      const user = await this.resolveUser(email);
+      const user = await this.resolveUser(ctx, email);
       if (!user) {
         this.logger.log('OTP request for non-existent user');
         return;
       }
 
-      const otp = await this.issueOtp(user);
+      const otp = await this.issueOtp(ctx, user);
       await this.deliver(email, otp);
 
       const { category, expiresIn } = this.settings.otp;
@@ -89,15 +92,16 @@ export class RocketsAuthOtpService implements RocketsAuthOtpServiceInterface {
   }
 
   async confirmOtp(
+    ctx: PlainLiteralObject,
     email: string,
     passcode: string,
   ): Promise<ReferenceIdInterface> {
-    const user = await this.resolveUser(email);
+    const user = await this.resolveUser(ctx, email);
     if (!user) {
       throw new RocketsAuthOtpException();
     }
 
-    const valid = await this.validatePasscode(user, passcode);
+    const valid = await this.validatePasscode(ctx, user, passcode);
     if (!valid) {
       throw new RocketsAuthOtpException();
     }
@@ -106,15 +110,19 @@ export class RocketsAuthOtpService implements RocketsAuthOtpServiceInterface {
 
   /** Look up the user by email. Override to add caching, fallbacks, etc. */
   protected async resolveUser(
+    ctx: PlainLiteralObject,
     email: string,
   ): Promise<ReferenceIdInterface | null> {
-    return this.userPort.byEmail(email);
+    return this.userPort.byEmail(ctx, email);
   }
 
   /** Issue an OTP for the given user. Override to add cooldown / rate limit. */
-  protected async issueOtp(user: ReferenceIdInterface): Promise<OtpInterface> {
+  protected async issueOtp(
+    ctx: PlainLiteralObject,
+    user: ReferenceIdInterface,
+  ): Promise<OtpInterface> {
     const { assignment, category, expiresIn } = this.settings.otp;
-    return this.otpService.create({
+    return this.otpService.create(ctx, {
       assignment,
       otp: {
         category,
@@ -138,11 +146,13 @@ export class RocketsAuthOtpService implements RocketsAuthOtpServiceInterface {
 
   /** Validate a passcode for the given user. Override for alternate flows. */
   protected async validatePasscode(
+    ctx: PlainLiteralObject,
     user: ReferenceIdInterface,
     passcode: string,
   ): Promise<boolean> {
     const { assignment, category } = this.settings.otp;
     const result = await this.otpService.validate(
+      ctx,
       assignment,
       { category, passcode },
       true,
diff --git a/packages/rockets-server-auth/src/domains/otp/interfaces/otp-controller-extras.interface.ts b/packages/rockets-server-auth/src/domains/otp/interfaces/otp-controller-extras.interface.ts
index 3c4813fb2..354ccc6fd 100644
--- a/packages/rockets-server-auth/src/domains/otp/interfaces/otp-controller-extras.interface.ts
+++ b/packages/rockets-server-auth/src/domains/otp/interfaces/otp-controller-extras.interface.ts
@@ -1,4 +1,4 @@
-import {
+import type {
   RocketsAuthControllerExtrasBase,
   RocketsAuthRouteExtrasBase,
 } from '../../../shared/interfaces/controller/rockets-auth-controller-extras.interface';
diff --git a/packages/rockets-server-auth/src/domains/otp/interfaces/rockets-auth-otp-service.interface.ts b/packages/rockets-server-auth/src/domains/otp/interfaces/rockets-auth-otp-service.interface.ts
index cb240ebb7..2c1685250 100644
--- a/packages/rockets-server-auth/src/domains/otp/interfaces/rockets-auth-otp-service.interface.ts
+++ b/packages/rockets-server-auth/src/domains/otp/interfaces/rockets-auth-otp-service.interface.ts
@@ -1,7 +1,12 @@
 import { ReferenceIdInterface } from '@concepta/nestjs-core';
+import type { PlainLiteralObject } from '@nestjs/common';
 
 export interface RocketsAuthOtpServiceInterface {
-  sendOtp(email: string): Promise<void>;
+  sendOtp(ctx: PlainLiteralObject, email: string): Promise<void>;
 
-  confirmOtp(email: string, passcode: string): Promise<ReferenceIdInterface>;
+  confirmOtp(
+    ctx: PlainLiteralObject,
+    email: string,
+    passcode: string,
+  ): Promise<ReferenceIdInterface>;
 }
diff --git a/packages/rockets-server-auth/src/domains/role/application/queries/handlers/abstract-rockets-get-role-by-name.handler.ts b/packages/rockets-server-auth/src/domains/role/application/queries/handlers/abstract-rockets-get-role-by-name.handler.ts
index 7177d7028..41de57ce5 100644
--- a/packages/rockets-server-auth/src/domains/role/application/queries/handlers/abstract-rockets-get-role-by-name.handler.ts
+++ b/packages/rockets-server-auth/src/domains/role/application/queries/handlers/abstract-rockets-get-role-by-name.handler.ts
@@ -35,7 +35,7 @@ export abstract class AbstractRocketsGetRoleByNameHandler
     query: RocketsGetRoleByNameQuery,
   ): Promise<RoleEntityInterface | null> {
     const where = this.buildFilter(query);
-    const entity = await this.fetch(where);
+    const entity = await this.fetch(query, where);
     return this.mapResponse(entity);
   }
 
@@ -44,9 +44,10 @@ export abstract class AbstractRocketsGetRoleByNameHandler
   }
 
   protected async fetch(
+    query: RocketsGetRoleByNameQuery,
     where: ReturnType<AbstractRocketsGetRoleByNameHandler['buildFilter']>,
   ): Promise<RoleEntityInterface | null> {
-    return this.roleRepo.findOne({ where });
+    return this.roleRepo.findOne({ where, ctx: query.ctx });
   }
 
   protected mapResponse(
diff --git a/packages/rockets-server-auth/src/domains/role/application/queries/handlers/abstract-rockets-get-roles-by-ids.handler.ts b/packages/rockets-server-auth/src/domains/role/application/queries/handlers/abstract-rockets-get-roles-by-ids.handler.ts
index f50d173dc..5a53b9af6 100644
--- a/packages/rockets-server-auth/src/domains/role/application/queries/handlers/abstract-rockets-get-roles-by-ids.handler.ts
+++ b/packages/rockets-server-auth/src/domains/role/application/queries/handlers/abstract-rockets-get-roles-by-ids.handler.ts
@@ -1,9 +1,9 @@
-import { QueryHandler, IQueryHandler } from '@nestjs/cqrs';
+import { QueryHandler, type IQueryHandler } from '@nestjs/cqrs';
 import { Inject } from '@nestjs/common';
-import { RoleEntityInterface } from '@concepta/nestjs-role';
+import type { RoleEntityInterface } from '@concepta/nestjs-role';
 import {
   getDynamicRepositoryToken,
-  RepositoryInterface,
+  type RepositoryInterface,
   Where,
 } from '@concepta/nestjs-repository';
 
@@ -13,9 +13,7 @@ import { RocketsGetRolesByIdsQuery } from '../impl/rockets-get-roles-by-ids.quer
 /**
  * Template-method query handler for `RocketsGetRolesByIdsQuery`.
  *
- * Seams: `buildFilter / fetch / mapResponse` (same shape as every other
- * read handler in this package — see `.context/v8-ddd-refactor-plan.md`
- * §2.7).
+ * Override `buildFilter`, `fetch`, or `mapResponse` for targeted behavior.
  */
 @QueryHandler(RocketsGetRolesByIdsQuery)
 export abstract class AbstractRocketsGetRolesByIdsHandler
@@ -32,7 +30,7 @@ export abstract class AbstractRocketsGetRolesByIdsHandler
     if (query.ids.length === 0) return this.mapResponse([]);
 
     const where = this.buildFilter(query);
-    const entities = await this.fetch(where);
+    const entities = await this.fetch(query, where);
     return this.mapResponse(entities);
   }
 
@@ -41,9 +39,10 @@ export abstract class AbstractRocketsGetRolesByIdsHandler
   }
 
   protected async fetch(
+    query: RocketsGetRolesByIdsQuery,
     where: ReturnType<AbstractRocketsGetRolesByIdsHandler['buildFilter']>,
   ): Promise<RoleEntityInterface[]> {
-    return this.roleRepo.find({ where });
+    return this.roleRepo.find({ where, ctx: query.ctx });
   }
 
   protected mapResponse(
diff --git a/packages/rockets-server-auth/src/domains/role/application/queries/handlers/role-query-handlers.spec.ts b/packages/rockets-server-auth/src/domains/role/application/queries/handlers/role-query-handlers.spec.ts
index 984d1ab6b..dd8a38c2f 100644
--- a/packages/rockets-server-auth/src/domains/role/application/queries/handlers/role-query-handlers.spec.ts
+++ b/packages/rockets-server-auth/src/domains/role/application/queries/handlers/role-query-handlers.spec.ts
@@ -35,7 +35,9 @@ describe('Role query handlers', () => {
       repo.findOne.mockResolvedValueOnce(null);
       const handler = new RocketsGetRoleByNameHandler(repo);
 
-      const out = await handler.execute(new RocketsGetRoleByNameQuery('admin'));
+      const out = await handler.execute(
+        new RocketsGetRoleByNameQuery({}, 'admin'),
+      );
       expect(out).toBeNull();
       const callArg = repo.findOne.mock.calls[0][0] as {
         where: ReturnType<typeof WhereType.eq>;
@@ -50,7 +52,7 @@ describe('Role query handlers', () => {
       const handler = new RocketsGetRoleByNameHandler(repo);
 
       await expect(
-        handler.execute(new RocketsGetRoleByNameQuery('admin')),
+        handler.execute(new RocketsGetRoleByNameQuery({}, 'admin')),
       ).resolves.toBe(role);
     });
   });
@@ -61,7 +63,7 @@ describe('Role query handlers', () => {
       const handler = new RocketsGetRolesByIdsHandler(repo);
 
       await expect(
-        handler.execute(new RocketsGetRolesByIdsQuery([])),
+        handler.execute(new RocketsGetRolesByIdsQuery({}, [])),
       ).resolves.toEqual([]);
       expect(repo.find).not.toHaveBeenCalled();
     });
@@ -76,7 +78,7 @@ describe('Role query handlers', () => {
       const handler = new RocketsGetRolesByIdsHandler(repo);
 
       const out = await handler.execute(
-        new RocketsGetRolesByIdsQuery(['r1', 'r2']),
+        new RocketsGetRolesByIdsQuery({}, ['r1', 'r2']),
       );
       expect(out).toBe(roles);
       expect(repo.find).toHaveBeenCalledTimes(1);
@@ -98,7 +100,9 @@ describe('Role query handlers', () => {
       }
 
       const handler = new RedactedName(repo);
-      const out = await handler.execute(new RocketsGetRoleByNameQuery('admin'));
+      const out = await handler.execute(
+        new RocketsGetRoleByNameQuery({}, 'admin'),
+      );
       expect(out?.name).toBe('REDACTED');
       expect(repo.findOne).toHaveBeenCalledTimes(1);
     });
@@ -114,7 +118,9 @@ describe('Role query handlers', () => {
       }
 
       const handler = new WithCache(repo);
-      const out = await handler.execute(new RocketsGetRoleByNameQuery('admin'));
+      const out = await handler.execute(
+        new RocketsGetRoleByNameQuery({}, 'admin'),
+      );
       expect(out).toBe(cached);
       expect(repo.findOne).not.toHaveBeenCalled();
     });
@@ -138,7 +144,7 @@ describe('Role query handlers', () => {
 
       const handler = new DropDeleted(repo);
       const out = await handler.execute(
-        new RocketsGetRolesByIdsQuery(['r1', 'r2']),
+        new RocketsGetRolesByIdsQuery({}, ['r1', 'r2']),
       );
       expect(out).toHaveLength(1);
       expect(out[0].id).toBe('r1');
diff --git a/packages/rockets-server-auth/src/domains/role/application/queries/impl/rockets-get-role-by-name.query.ts b/packages/rockets-server-auth/src/domains/role/application/queries/impl/rockets-get-role-by-name.query.ts
index 5158a202d..a78f3cc26 100644
--- a/packages/rockets-server-auth/src/domains/role/application/queries/impl/rockets-get-role-by-name.query.ts
+++ b/packages/rockets-server-auth/src/domains/role/application/queries/impl/rockets-get-role-by-name.query.ts
@@ -1,3 +1,8 @@
+import type { PlainLiteralObject } from '@nestjs/common';
+
 export class RocketsGetRoleByNameQuery {
-  constructor(public readonly name: string) {}
+  constructor(
+    public readonly ctx: PlainLiteralObject,
+    public readonly name: string,
+  ) {}
 }
diff --git a/packages/rockets-server-auth/src/domains/role/application/queries/impl/rockets-get-roles-by-ids.query.ts b/packages/rockets-server-auth/src/domains/role/application/queries/impl/rockets-get-roles-by-ids.query.ts
index 4f8379587..1ef75b12e 100644
--- a/packages/rockets-server-auth/src/domains/role/application/queries/impl/rockets-get-roles-by-ids.query.ts
+++ b/packages/rockets-server-auth/src/domains/role/application/queries/impl/rockets-get-roles-by-ids.query.ts
@@ -1,3 +1,8 @@
+import type { PlainLiteralObject } from '@nestjs/common';
+
 export class RocketsGetRolesByIdsQuery {
-  constructor(public readonly ids: readonly string[]) {}
+  constructor(
+    public readonly ctx: PlainLiteralObject,
+    public readonly ids: readonly string[],
+  ) {}
 }
diff --git a/packages/rockets-server-auth/src/domains/role/gateways/http/factories/build-admin-user-roles-controller.ts b/packages/rockets-server-auth/src/domains/role/gateways/http/factories/build-admin-user-roles-controller.ts
index 47c0a5003..8febf001e 100644
--- a/packages/rockets-server-auth/src/domains/role/gateways/http/factories/build-admin-user-roles-controller.ts
+++ b/packages/rockets-server-auth/src/domains/role/gateways/http/factories/build-admin-user-roles-controller.ts
@@ -5,9 +5,10 @@ import {
   Logger,
   Param,
   Post,
-  Type,
+  Req,
   UseGuards,
 } from '@nestjs/common';
+import type { Type } from '@nestjs/common';
 import { CommandBus, QueryBus } from '@nestjs/cqrs';
 import {
   ApiBadRequestResponse,
@@ -26,10 +27,13 @@ import {
   AssignRoleCommand,
   GetAssignedRolesQuery,
 } from '@concepta/nestjs-role';
+import { getAppContext } from '@concepta/rockets-core';
+import type { Request } from 'express';
 
 import { AdminGuard } from '../../../../../guards/admin.guard';
 import { USER_ROLE_ENTITY_KEY } from '../../../../../shared/constants/repository-entity-keys.constants';
-import { AdminUserRolesControllerExtras } from '../../../interfaces/role-controller-extras.interface';
+import type { AdminUserRolesControllerExtras } from '../../../interfaces/role-controller-extras.interface';
+import { applyControllerExtras } from '../../../../../shared/utils/apply-controller-extras.helper';
 
 class AdminAssignUserRoleDto {
   @ApiProperty({
@@ -42,14 +46,7 @@ class AdminAssignUserRoleDto {
   roleId!: string;
 }
 
-/**
- * Build the `admin/users/:userId/roles` controller, applying any
- * consumer-supplied extras (`classDecorators`, per-route `decorators`).
- *
- * The two routes (`list`, `assign`) are thin shells around the upstream
- * `@concepta/nestjs-role` query/command classes via CQRS buses — no
- * business logic lives in the controller.
- */
+/** Build the admin user-role controller and apply consumer decorators. */
 export function buildAdminUserRolesController(
   extras: AdminUserRolesControllerExtras = {},
 ): Type<unknown> {
@@ -70,9 +67,10 @@ export function buildAdminUserRolesController(
     @ApiOkResponse({ description: 'Roles for the user' })
     @ApiUnauthorizedResponse({ description: 'Unauthorized' })
     @Get()
-    async list(@Param('userId') userId: string) {
+    async list(@Param('userId') userId: string, @Req() req: Request) {
+      const ctx = getAppContext(req);
       return this.queryBus.execute(
-        new GetAssignedRolesQuery({}, USER_ROLE_ENTITY_KEY, userId),
+        new GetAssignedRolesQuery(ctx, USER_ROLE_ENTITY_KEY, userId),
       );
     }
 
@@ -85,41 +83,19 @@ export function buildAdminUserRolesController(
     async assign(
       @Param('userId') userId: string,
       @Body() dto: AdminAssignUserRoleDto,
+      @Req() req: Request,
     ) {
+      const ctx = getAppContext(req);
       await this.commandBus.execute(
-        new AssignRoleCommand({}, USER_ROLE_ENTITY_KEY, dto.roleId, userId),
+        new AssignRoleCommand(ctx, USER_ROLE_ENTITY_KEY, dto.roleId, userId),
       );
       this.logger.log(`Role ${dto.roleId} assigned to user ${userId}`);
     }
   }
 
-  applyExtras(AdminUserRolesController, extras);
-  return AdminUserRolesController;
-}
-
-function applyExtras(
-  controllerClass: Type<unknown>,
-  extras: AdminUserRolesControllerExtras,
-): void {
-  for (const decorator of extras.classDecorators ?? []) {
-    decorator(controllerClass);
-  }
-
-  const routeMap: Record<string, string> = {
+  applyControllerExtras(AdminUserRolesController, extras, {
     list: 'list',
     assign: 'assign',
-  };
-
-  for (const [routeKey, methodName] of Object.entries(routeMap)) {
-    const cfg = extras.routes?.[routeKey as keyof typeof extras.routes];
-    if (!cfg?.decorators) continue;
-
-    const proto = controllerClass.prototype as Record<string, unknown>;
-    const descriptor = Object.getOwnPropertyDescriptor(proto, methodName);
-    if (!descriptor) continue;
-
-    for (const decorator of cfg.decorators) {
-      decorator(proto, methodName, descriptor);
-    }
-  }
+  });
+  return AdminUserRolesController;
 }
diff --git a/packages/rockets-server-auth/src/domains/role/interfaces/role-controller-extras.interface.ts b/packages/rockets-server-auth/src/domains/role/interfaces/role-controller-extras.interface.ts
index 3c41ca4f1..403505864 100644
--- a/packages/rockets-server-auth/src/domains/role/interfaces/role-controller-extras.interface.ts
+++ b/packages/rockets-server-auth/src/domains/role/interfaces/role-controller-extras.interface.ts
@@ -1,22 +1,16 @@
-import { Type } from '@nestjs/common';
-import {
+import type { Type } from '@nestjs/common';
+import type {
   RocketsAuthControllerExtrasBase,
   RocketsAuthRouteExtrasBase,
 } from '../../../shared/interfaces/controller/rockets-auth-controller-extras.interface';
 
 /**
- * Extras for the **admin/roles** declarative CRUD controller. Forwarded into
- * `CrudModule.forFeature` as additional `controller.extraDecorators` and
- * `controller.useHooks`. Per-operation decorators / handler overrides are
- * applied per `Operation` key.
+ * Extras for the admin role CRUD resource. Class and route decorators are
+ * forwarded to the generated controller; each route can replace its handler.
  */
 export interface AdminRoleResourceRouteExtras
   extends RocketsAuthRouteExtrasBase {
-  /**
-   * Replace the CommandHandler for this operation. Must be a Type<unknown>
-   * registered as a Nest provider — the resource builder resolves it from
-   * the DI container.
-   */
+  /** Replace the operation handler with a Nest provider class. */
   handler?: Type<unknown>;
 }
 
diff --git a/packages/rockets-server-auth/src/domains/role/modules/rockets-auth-role-admin.module.ts b/packages/rockets-server-auth/src/domains/role/modules/rockets-auth-role-admin.module.ts
index 51105b2b3..900e82719 100644
--- a/packages/rockets-server-auth/src/domains/role/modules/rockets-auth-role-admin.module.ts
+++ b/packages/rockets-server-auth/src/domains/role/modules/rockets-auth-role-admin.module.ts
@@ -1,9 +1,9 @@
 import { CrudResponsePaginatedDto, CrudModule } from '@concepta/nestjs-crud';
 import {
   applyDecorators,
-  DynamicModule,
+  type DynamicModule,
   Module,
-  Type,
+  type Type,
   UseGuards,
 } from '@nestjs/common';
 import { Operation } from '@concepta/nestjs-core';
@@ -15,11 +15,11 @@ import { RocketsAuthRoleDto } from '../infrastructure/dto/rockets-auth-role.dto'
 import { RocketsAuthRoleCreateDto } from '../infrastructure/dto/rockets-auth-role-create.dto';
 import { AdminGuard } from '../../../guards/admin.guard';
 import { ROLE_CRUD_ENTITY_KEY } from '../../../shared/constants/repository-entity-keys.constants';
-import { RoleCrudOptionsExtrasInterface } from '../../../shared/interfaces/rockets-auth-options-extras.interface';
-import { RocketsAuthRoleEntityInterface } from '../interfaces/rockets-auth-role-entity.interface';
-import { RocketsAuthRoleInterface } from '../interfaces/rockets-auth-role.interface';
+import type { RoleCrudOptionsExtrasInterface } from '../../../shared/interfaces/rockets-auth-options-extras.interface';
+import type { RocketsAuthRoleEntityInterface } from '../interfaces/rockets-auth-role-entity.interface';
+import type { RocketsAuthRoleInterface } from '../interfaces/rockets-auth-role.interface';
 import { buildAdminUserRolesController } from '../gateways/http/factories/build-admin-user-roles-controller';
-import {
+import type {
   AdminRoleResourceExtras,
   AdminUserRolesControllerExtras,
 } from '../interfaces/role-controller-extras.interface';
@@ -52,10 +52,12 @@ function buildOperations(
     {
       operation: Operation.List,
       ...operationExtraDecorators(routes.list?.decorators),
+      ...(routes.list?.handler ? { queryHandler: routes.list.handler } : {}),
     },
     {
       operation: Operation.Read,
       ...operationExtraDecorators(routes.read?.decorators),
+      ...(routes.read?.handler ? { queryHandler: routes.read.handler } : {}),
     },
     {
       operation: Operation.Create,
@@ -103,6 +105,9 @@ function buildOperations(
     {
       operation: Operation.Delete,
       ...operationExtraDecorators(routes.delete?.decorators),
+      ...(routes.delete?.handler
+        ? { commandHandler: routes.delete.handler }
+        : {}),
     },
   ];
 }
diff --git a/packages/rockets-server-auth/src/domains/role/modules/rockets-auth-role-admin.register.spec.ts b/packages/rockets-server-auth/src/domains/role/modules/rockets-auth-role-admin.register.spec.ts
index ca184185d..1443b975b 100644
--- a/packages/rockets-server-auth/src/domains/role/modules/rockets-auth-role-admin.register.spec.ts
+++ b/packages/rockets-server-auth/src/domains/role/modules/rockets-auth-role-admin.register.spec.ts
@@ -1,7 +1,17 @@
-import { describe, it, expect } from 'vitest';
+import { CrudModule } from '@concepta/nestjs-crud';
+import { Operation } from '@concepta/nestjs-core';
+import { afterEach, describe, it, expect, vi } from 'vitest';
 import { RocketsAuthRoleAdminModule } from './rockets-auth-role-admin.module';
 import { RocketsAuthRoleDto } from '../infrastructure/dto/rockets-auth-role.dto';
 
+class ListHandler {}
+class ReadHandler {}
+class CreateHandler {}
+class UpdateHandler {}
+class DeleteHandler {}
+
+afterEach(() => vi.restoreAllMocks());
+
 describe('RocketsAuthRoleAdminModule.register', () => {
   it('builds CrudModule feature with paginated admin DTO', () => {
     const dynamic = RocketsAuthRoleAdminModule.register({
@@ -12,4 +22,53 @@ describe('RocketsAuthRoleAdminModule.register', () => {
     expect(Array.isArray(dynamic.imports)).toBe(true);
     expect((dynamic.imports ?? []).length).toBeGreaterThan(0);
   });
+
+  it('forwards every route handler override to CrudModule', () => {
+    const forFeature = vi.spyOn(CrudModule, 'forFeature');
+
+    RocketsAuthRoleAdminModule.register({
+      imports: [],
+      model: RocketsAuthRoleDto,
+      controller: {
+        adminResource: {
+          routes: {
+            list: { handler: ListHandler },
+            read: { handler: ReadHandler },
+            create: { handler: CreateHandler },
+            update: { handler: UpdateHandler },
+            delete: { handler: DeleteHandler },
+          },
+        },
+      },
+    });
+
+    expect(forFeature).toHaveBeenCalledOnce();
+    const config = forFeature.mock.calls.at(-1)?.[0] as {
+      crud: {
+        operations: Array<{
+          operation: Operation;
+          queryHandler?: unknown;
+          commandHandler?: unknown;
+        }>;
+      };
+    };
+    const operations = new Map(
+      config.crud.operations.map((operation) => [
+        operation.operation,
+        operation,
+      ]),
+    );
+
+    expect(operations.get(Operation.List)?.queryHandler).toBe(ListHandler);
+    expect(operations.get(Operation.Read)?.queryHandler).toBe(ReadHandler);
+    expect(operations.get(Operation.Create)?.commandHandler).toBe(
+      CreateHandler,
+    );
+    expect(operations.get(Operation.Update)?.commandHandler).toBe(
+      UpdateHandler,
+    );
+    expect(operations.get(Operation.Delete)?.commandHandler).toBe(
+      DeleteHandler,
+    );
+  });
 });
diff --git a/packages/rockets-server-auth/src/domains/user/application/commands/handlers/assign-default-role.handler.spec.ts b/packages/rockets-server-auth/src/domains/user/application/commands/handlers/assign-default-role.handler.spec.ts
index 96accb361..c0753dbed 100644
--- a/packages/rockets-server-auth/src/domains/user/application/commands/handlers/assign-default-role.handler.spec.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/commands/handlers/assign-default-role.handler.spec.ts
@@ -31,7 +31,7 @@ describe('AssignDefaultRoleHandler', () => {
       commandBus as unknown as CommandBus,
       buildSettings(),
     );
-    const out = await handler.execute(new AssignDefaultRoleCommand('u1'));
+    const out = await handler.execute(new AssignDefaultRoleCommand({}, 'u1'));
     expect(out).toBe(false);
     expect(queryBus.execute).not.toHaveBeenCalled();
     expect(commandBus.execute).not.toHaveBeenCalled();
@@ -45,7 +45,7 @@ describe('AssignDefaultRoleHandler', () => {
       buildSettings({ defaultUserRoleName: 'user' }),
     );
     await expect(
-      handler.execute(new AssignDefaultRoleCommand('u1')),
+      handler.execute(new AssignDefaultRoleCommand({}, 'u1')),
     ).rejects.toBeInstanceOf(InternalServerErrorException);
     expect(queryBus.execute).toHaveBeenCalledWith(
       expect.any(RocketsGetRoleByNameQuery),
@@ -61,7 +61,7 @@ describe('AssignDefaultRoleHandler', () => {
       commandBus as unknown as CommandBus,
       buildSettings({ defaultUserRoleName: 'user' }),
     );
-    const out = await handler.execute(new AssignDefaultRoleCommand('u1'));
+    const out = await handler.execute(new AssignDefaultRoleCommand({}, 'u1'));
     expect(out).toBe(true);
     expect(commandBus.execute).toHaveBeenCalledWith(
       expect.any(AssignRoleCommand),
@@ -77,7 +77,7 @@ describe('AssignDefaultRoleHandler', () => {
       buildSettings({ defaultUserRoleName: 'user' }),
     );
     await expect(
-      handler.execute(new AssignDefaultRoleCommand('u1')),
+      handler.execute(new AssignDefaultRoleCommand({}, 'u1')),
     ).rejects.toThrow('db down');
   });
 });
diff --git a/packages/rockets-server-auth/src/domains/user/application/commands/handlers/assign-default-role.handler.ts b/packages/rockets-server-auth/src/domains/user/application/commands/handlers/assign-default-role.handler.ts
index 8a6aff41c..83465c3f6 100644
--- a/packages/rockets-server-auth/src/domains/user/application/commands/handlers/assign-default-role.handler.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/commands/handlers/assign-default-role.handler.ts
@@ -27,7 +27,7 @@ export class AssignDefaultRoleHandler
   ) {}
 
   async execute(command: AssignDefaultRoleCommand): Promise<boolean> {
-    const { userId } = command;
+    const { ctx, userId } = command;
     const roleName = this.settings.role.defaultUserRoleName;
 
     // Valid scenario — app intentionally skips default-role assignment.
@@ -41,7 +41,7 @@ export class AssignDefaultRoleHandler
     const role = await this.queryBus.execute<
       RocketsGetRoleByNameQuery,
       RoleEntityInterface | null
-    >(new RocketsGetRoleByNameQuery(roleName));
+    >(new RocketsGetRoleByNameQuery(ctx, roleName));
 
     // Misconfiguration — role was named in settings but doesn't exist in DB.
     // Failing closed prevents users from being created without their expected
@@ -60,7 +60,7 @@ export class AssignDefaultRoleHandler
     }
 
     await this.commandBus.execute(
-      new AssignRoleCommand({}, RocketsEntity.userRole, role.id, userId),
+      new AssignRoleCommand(ctx, RocketsEntity.userRole, role.id, userId),
     );
     return true;
   }
diff --git a/packages/rockets-server-auth/src/domains/user/application/commands/handlers/rockets-create-user.handler.ts b/packages/rockets-server-auth/src/domains/user/application/commands/handlers/rockets-create-user.handler.ts
index af4e0fa70..8361c7ec4 100644
--- a/packages/rockets-server-auth/src/domains/user/application/commands/handlers/rockets-create-user.handler.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/commands/handlers/rockets-create-user.handler.ts
@@ -3,9 +3,7 @@ import { UserInterface } from '@concepta/nestjs-user';
 import { DomainAggregate } from '@concepta/nestjs-core/aggregate';
 import { CreateUserCommand } from '@concepta/nestjs-user';
 
-import { RocketsEntity } from '../../../../../shared/constants/repository-entity-keys.constants';
 import { RocketsCreateUserCommand } from '../impl/rockets-create-user.command';
-import { createRepositoryContext } from '@concepta/rockets-core';
 
 @CommandHandler(RocketsCreateUserCommand)
 export class RocketsCreateUserHandler
@@ -20,12 +18,11 @@ export class RocketsCreateUserHandler
   async execute(
     command: RocketsCreateUserCommand,
   ): Promise<DomainAggregate<UserInterface> | null> {
-    const ctx = createRepositoryContext(RocketsEntity.user);
     const dto = {
       username: command.data.username ?? command.data.email ?? '',
       email: command.data.email ?? '',
       active: command.data.active,
     };
-    return this.commandBus.execute(new CreateUserCommand(ctx, dto));
+    return this.commandBus.execute(new CreateUserCommand(command.ctx, dto));
   }
 }
diff --git a/packages/rockets-server-auth/src/domains/user/application/commands/handlers/rockets-update-user.handler.ts b/packages/rockets-server-auth/src/domains/user/application/commands/handlers/rockets-update-user.handler.ts
index 9bc09546a..4ae9b3c56 100644
--- a/packages/rockets-server-auth/src/domains/user/application/commands/handlers/rockets-update-user.handler.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/commands/handlers/rockets-update-user.handler.ts
@@ -2,10 +2,8 @@ import { CommandHandler, ICommandHandler, CommandBus } from '@nestjs/cqrs';
 import { UserInterface } from '@concepta/nestjs-user';
 import { DomainAggregate } from '@concepta/nestjs-core/aggregate';
 import { UpdateUserCommand } from '@concepta/nestjs-user';
-import { RocketsEntity } from '../../../../../shared/constants/repository-entity-keys.constants';
 
 import { RocketsUpdateUserCommand } from '../impl/rockets-update-user.command';
-import { createRepositoryContext } from '@concepta/rockets-core';
 
 @CommandHandler(RocketsUpdateUserCommand)
 export class RocketsUpdateUserHandler
@@ -20,9 +18,8 @@ export class RocketsUpdateUserHandler
   async execute(
     command: RocketsUpdateUserCommand,
   ): Promise<DomainAggregate<UserInterface> | null> {
-    const ctx = createRepositoryContext(RocketsEntity.user);
     return this.commandBus.execute(
-      new UpdateUserCommand(ctx, command.id, command.data),
+      new UpdateUserCommand(command.ctx, command.id, command.data),
     );
   }
 }
diff --git a/packages/rockets-server-auth/src/domains/user/application/commands/handlers/save-user-metadata.handler.ts b/packages/rockets-server-auth/src/domains/user/application/commands/handlers/save-user-metadata.handler.ts
index 6bda724d8..5ee35159c 100644
--- a/packages/rockets-server-auth/src/domains/user/application/commands/handlers/save-user-metadata.handler.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/commands/handlers/save-user-metadata.handler.ts
@@ -5,9 +5,7 @@ import { TransactionScope } from '@concepta/nestjs-repository';
 import { SaveUserMetadataCommand } from '../impl/save-user-metadata.command';
 import { UserMetadataRepositoryInterface } from '../../../domain/repositories/user-metadata-repository.interface';
 import { USER_METADATA_REPOSITORY_TOKEN } from '../../../domain/constants/user-domain.tokens';
-import { USER_METADATA_MODULE_ENTITY_KEY } from '../../../../../shared/constants/repository-entity-keys.constants';
 import { RocketsAuthUserMetadataEntityInterface } from '../../../interfaces/rockets-auth-user-metadata-entity.interface';
-import { createRepositoryContext } from '@concepta/rockets-core';
 
 @CommandHandler(SaveUserMetadataCommand)
 export class SaveUserMetadataHandler
@@ -28,15 +26,11 @@ export class SaveUserMetadataHandler
   async execute(
     command: SaveUserMetadataCommand,
   ): Promise<RocketsAuthUserMetadataEntityInterface> {
-    const { userId, data } = command;
+    const { ctx, userId, data } = command;
 
-    const metadataCtx = createRepositoryContext(
-      USER_METADATA_MODULE_ENTITY_KEY,
-    );
-
-    return this.txScope.run(metadataCtx, async () => {
+    return this.txScope.run(ctx, async (txCtx) => {
       this.logger.debug(`Creating/updating metadata for user ${userId}`);
-      return this.metadataRepository.save(metadataCtx, userId, data);
+      return this.metadataRepository.save(txCtx, userId, data);
     });
   }
 }
diff --git a/packages/rockets-server-auth/src/domains/user/application/commands/handlers/signup-user.handler.ts b/packages/rockets-server-auth/src/domains/user/application/commands/handlers/signup-user.handler.ts
index dfe023633..13c5d71b3 100644
--- a/packages/rockets-server-auth/src/domains/user/application/commands/handlers/signup-user.handler.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/commands/handlers/signup-user.handler.ts
@@ -15,7 +15,7 @@ import { RocketsAuthUserEntityInterface } from '../../../interfaces/rockets-auth
 import { AbstractSignupUserHandler } from './abstract-signup-user.handler';
 import { SignupUserCommand } from '../impl/signup-user.command';
 import { userAggregateToEntity } from '../../../../../shared/utils/aggregate-mappers';
-import { RepositoryContextInterface } from '@concepta/rockets-core';
+import type { PlainLiteralObject } from '@nestjs/common';
 
 /**
  * Drop server-controlled identity fields from a user-supplied metadata
@@ -47,9 +47,9 @@ export class SignupUserHandler extends AbstractSignupUserHandler {
     // Uniqueness check (read-only, before TX)
     await this.ensureUnique(context, dto.email, dto.username);
 
-    return this.txScope.run(context, async () => {
+    return this.txScope.run(context, async (txCtx) => {
       const userAggregate = await this.commandBus.execute(
-        new CreateUserCommand(context, {
+        new CreateUserCommand(txCtx, {
           email: dto.email,
           username: dto.username,
           active: dto.active ?? true,
@@ -63,13 +63,16 @@ export class SignupUserHandler extends AbstractSignupUserHandler {
       if (dto.userMetadata) {
         userMetadata = await this.commandBus.execute(
           new SaveUserMetadataCommand(
+            txCtx,
             userId,
             stripIdentityFields(dto.userMetadata),
           ),
         );
       }
 
-      await this.commandBus.execute(new AssignDefaultRoleCommand(userId));
+      await this.commandBus.execute(
+        new AssignDefaultRoleCommand(txCtx, userId),
+      );
 
       return {
         ...userAggregateToEntity(userAggregate),
@@ -79,7 +82,7 @@ export class SignupUserHandler extends AbstractSignupUserHandler {
   }
 
   private async ensureUnique(
-    ctx: RepositoryContextInterface,
+    ctx: PlainLiteralObject,
     email: string,
     username: string,
   ): Promise<void> {
diff --git a/packages/rockets-server-auth/src/domains/user/application/commands/handlers/update-user.handler.ts b/packages/rockets-server-auth/src/domains/user/application/commands/handlers/update-user.handler.ts
index e58f298ab..a1a8d4221 100644
--- a/packages/rockets-server-auth/src/domains/user/application/commands/handlers/update-user.handler.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/commands/handlers/update-user.handler.ts
@@ -38,14 +38,14 @@ export class UpdateUserHandler implements ICommandHandler<UpdateUserCommand> {
     let metadata: RocketsAuthUserEntityInterface['userMetadata'];
     if (userMetadata && Object.keys(userMetadata).length > 0) {
       metadata = await this.commandBus.execute(
-        new SaveUserMetadataCommand(userId, userMetadata),
+        new SaveUserMetadataCommand(ctx, userId, userMetadata),
       );
     } else {
       metadata =
         (await this.queryBus.execute<
           GetUserMetadataQuery,
           RocketsAuthUserMetadataEntityInterface | null
-        >(new GetUserMetadataQuery(userId))) ?? undefined;
+        >(new GetUserMetadataQuery(ctx, userId))) ?? undefined;
     }
 
     return {
diff --git a/packages/rockets-server-auth/src/domains/user/application/commands/impl/assign-default-role.command.ts b/packages/rockets-server-auth/src/domains/user/application/commands/impl/assign-default-role.command.ts
index e093941bc..56825a48b 100644
--- a/packages/rockets-server-auth/src/domains/user/application/commands/impl/assign-default-role.command.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/commands/impl/assign-default-role.command.ts
@@ -1,3 +1,8 @@
+import type { PlainLiteralObject } from '@nestjs/common';
+
 export class AssignDefaultRoleCommand {
-  constructor(public readonly userId: string) {}
+  constructor(
+    public readonly ctx: PlainLiteralObject,
+    public readonly userId: string,
+  ) {}
 }
diff --git a/packages/rockets-server-auth/src/domains/user/application/commands/impl/rockets-create-user.command.ts b/packages/rockets-server-auth/src/domains/user/application/commands/impl/rockets-create-user.command.ts
index 11fcf2540..6b02911a7 100644
--- a/packages/rockets-server-auth/src/domains/user/application/commands/impl/rockets-create-user.command.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/commands/impl/rockets-create-user.command.ts
@@ -1,5 +1,9 @@
 import { UserEntityInterface } from '@concepta/nestjs-user';
+import type { PlainLiteralObject } from '@nestjs/common';
 
 export class RocketsCreateUserCommand {
-  constructor(public readonly data: Partial<UserEntityInterface>) {}
+  constructor(
+    public readonly ctx: PlainLiteralObject,
+    public readonly data: Partial<UserEntityInterface>,
+  ) {}
 }
diff --git a/packages/rockets-server-auth/src/domains/user/application/commands/impl/rockets-update-user.command.ts b/packages/rockets-server-auth/src/domains/user/application/commands/impl/rockets-update-user.command.ts
index 635394ec5..9afb0bb80 100644
--- a/packages/rockets-server-auth/src/domains/user/application/commands/impl/rockets-update-user.command.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/commands/impl/rockets-update-user.command.ts
@@ -1,7 +1,9 @@
 import { UserEntityInterface } from '@concepta/nestjs-user';
+import type { PlainLiteralObject } from '@nestjs/common';
 
 export class RocketsUpdateUserCommand {
   constructor(
+    public readonly ctx: PlainLiteralObject,
     public readonly id: string,
     public readonly data: Partial<UserEntityInterface>,
   ) {}
diff --git a/packages/rockets-server-auth/src/domains/user/application/commands/impl/save-user-metadata.command.ts b/packages/rockets-server-auth/src/domains/user/application/commands/impl/save-user-metadata.command.ts
index 3248fd5a6..aa8738c0a 100644
--- a/packages/rockets-server-auth/src/domains/user/application/commands/impl/save-user-metadata.command.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/commands/impl/save-user-metadata.command.ts
@@ -1,8 +1,10 @@
+import type { PlainLiteralObject } from '@nestjs/common';
 import { ReferenceId } from '@concepta/nestjs-core';
 import { RocketsAuthUserMetadataUpdatableInterface } from '../../../interfaces/rockets-auth-user-metadata-updatable.interface';
 
 export class SaveUserMetadataCommand {
   constructor(
+    public readonly ctx: PlainLiteralObject,
     public readonly userId: ReferenceId,
     public readonly data: RocketsAuthUserMetadataUpdatableInterface,
   ) {}
diff --git a/packages/rockets-server-auth/src/domains/user/application/commands/impl/update-user.command.ts b/packages/rockets-server-auth/src/domains/user/application/commands/impl/update-user.command.ts
index a6f1669c1..999f6e1af 100644
--- a/packages/rockets-server-auth/src/domains/user/application/commands/impl/update-user.command.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/commands/impl/update-user.command.ts
@@ -1,10 +1,10 @@
+import type { PlainLiteralObject } from '@nestjs/common';
 import { ReferenceId } from '@concepta/nestjs-core';
 import { RocketsAuthUserUpdatableInterface } from '../../../interfaces/rockets-auth-user-updatable.interface';
-import { RepositoryContextInterface } from '@concepta/rockets-core';
 
 export class UpdateUserCommand {
   constructor(
-    public readonly ctx: RepositoryContextInterface,
+    public readonly ctx: PlainLiteralObject,
     public readonly id: ReferenceId,
     public readonly dto: RocketsAuthUserUpdatableInterface,
   ) {}
diff --git a/packages/rockets-server-auth/src/domains/user/application/handlers.spec.ts b/packages/rockets-server-auth/src/domains/user/application/handlers.spec.ts
index 286a5c1ae..a62bf9095 100644
--- a/packages/rockets-server-auth/src/domains/user/application/handlers.spec.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/handlers.spec.ts
@@ -37,7 +37,7 @@ describe('User application handlers', () => {
       queryBus.execute
         .mockResolvedValueOnce(null) // upstream get-user
         .mockResolvedValueOnce(null); // get-user-metadata
-      await expect(handler.execute(new GetUserQuery('u1'))).rejects.toThrow(
+      await expect(handler.execute(new GetUserQuery({}, 'u1'))).rejects.toThrow(
         UserException,
       );
     });
@@ -47,7 +47,7 @@ describe('User application handlers', () => {
       queryBus.execute
         .mockResolvedValueOnce(aggregate)
         .mockResolvedValueOnce(meta);
-      const out = await handler.execute(new GetUserQuery('u1'));
+      const out = await handler.execute(new GetUserQuery({}, 'u1'));
       expect(out).toEqual({ ...userPlain, userMetadata: meta });
       expect(queryBus.execute).toHaveBeenCalledWith(
         expect.any(UpstreamGetUserQuery),
@@ -61,14 +61,14 @@ describe('User application handlers', () => {
       queryBus.execute
         .mockResolvedValueOnce(aggregate)
         .mockResolvedValueOnce(null);
-      const out = await handler.execute(new GetUserQuery('u1'));
+      const out = await handler.execute(new GetUserQuery({}, 'u1'));
       expect(out.userMetadata).toBeUndefined();
     });
 
     it('UserException carries 404 httpStatus', async () => {
       queryBus.execute.mockResolvedValueOnce(null).mockResolvedValueOnce(null);
       try {
-        await handler.execute(new GetUserQuery('u1'));
+        await handler.execute(new GetUserQuery({}, 'u1'));
         expect.fail('expected throw');
       } catch (err) {
         expect(err).toBeInstanceOf(UserException);
diff --git a/packages/rockets-server-auth/src/domains/user/application/queries/handlers/get-user-metadata.handler.ts b/packages/rockets-server-auth/src/domains/user/application/queries/handlers/get-user-metadata.handler.ts
index d19b19bfe..8b78241ed 100644
--- a/packages/rockets-server-auth/src/domains/user/application/queries/handlers/get-user-metadata.handler.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/queries/handlers/get-user-metadata.handler.ts
@@ -4,9 +4,7 @@ import { QueryHandler, IQueryHandler } from '@nestjs/cqrs';
 import { GetUserMetadataQuery } from '../impl/get-user-metadata.query';
 import { UserMetadataRepositoryInterface } from '../../../domain/repositories/user-metadata-repository.interface';
 import { USER_METADATA_REPOSITORY_TOKEN } from '../../../domain/constants/user-domain.tokens';
-import { USER_METADATA_MODULE_ENTITY_KEY } from '../../../../../shared/constants/repository-entity-keys.constants';
 import { RocketsAuthUserMetadataEntityInterface } from '../../../interfaces/rockets-auth-user-metadata-entity.interface';
-import { createRepositoryContext } from '@concepta/rockets-core';
 
 @QueryHandler(GetUserMetadataQuery)
 export class GetUserMetadataHandler
@@ -24,10 +22,6 @@ export class GetUserMetadataHandler
   async execute(
     query: GetUserMetadataQuery,
   ): Promise<RocketsAuthUserMetadataEntityInterface | null> {
-    const metadataCtx = createRepositoryContext(
-      USER_METADATA_MODULE_ENTITY_KEY,
-    );
-
-    return this.metadataRepository.findByUserId(metadataCtx, query.userId);
+    return this.metadataRepository.findByUserId(query.ctx, query.userId);
   }
 }
diff --git a/packages/rockets-server-auth/src/domains/user/application/queries/handlers/get-user.handler.ts b/packages/rockets-server-auth/src/domains/user/application/queries/handlers/get-user.handler.ts
index 49f53b6bf..bad42eacd 100644
--- a/packages/rockets-server-auth/src/domains/user/application/queries/handlers/get-user.handler.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/queries/handlers/get-user.handler.ts
@@ -4,7 +4,6 @@ import {
   GetUserQuery as UpstreamGetUserQuery,
   User,
 } from '@concepta/nestjs-user';
-import { RocketsEntity } from '../../../../../shared/constants/repository-entity-keys.constants';
 
 import { userAggregateToEntity } from '../../../../../shared/utils/aggregate-mappers';
 
@@ -13,7 +12,6 @@ import { RocketsAuthUserMetadataEntityInterface } from '../../../interfaces/rock
 import { UserException } from '../../../domain/exceptions/user.exception';
 import { GetUserQuery } from '../impl/get-user.query';
 import { GetUserMetadataQuery } from '../impl/get-user-metadata.query';
-import { createRepositoryContext } from '@concepta/rockets-core';
 
 @QueryHandler(GetUserQuery)
 export class GetUserHandler implements IQueryHandler<GetUserQuery> {
@@ -21,7 +19,7 @@ export class GetUserHandler implements IQueryHandler<GetUserQuery> {
 
   async execute(query: GetUserQuery): Promise<RocketsAuthUserEntityInterface> {
     const userId = String(query.id);
-    const ctx = createRepositoryContext(RocketsEntity.user);
+    const { ctx } = query;
 
     const [user, userMetadata] = await Promise.all([
       this.queryBus.execute<UpstreamGetUserQuery, User | null>(
@@ -30,7 +28,7 @@ export class GetUserHandler implements IQueryHandler<GetUserQuery> {
       this.queryBus.execute<
         GetUserMetadataQuery,
         RocketsAuthUserMetadataEntityInterface | null
-      >(new GetUserMetadataQuery(userId)),
+      >(new GetUserMetadataQuery(ctx, userId)),
     ]);
 
     if (!user) {
diff --git a/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-auth-user-port-get-by-username.handler.ts b/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-auth-user-port-get-by-username.handler.ts
index ffb6cc6c6..8ab0e96ec 100644
--- a/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-auth-user-port-get-by-username.handler.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-auth-user-port-get-by-username.handler.ts
@@ -9,8 +9,7 @@ import { RocketsAuthUserPortGetByUsernameQuery } from '../impl/rockets-auth-user
 /**
  * Dispatches upstream `GetUserByUsernameQuery` with the HTTP request repository
  * context from `UserPort#getByUsername` (`query.ctx`, i.e. `getAppContext(req)`).
- * Using `createRepositoryContext()` here breaks TypeORM adapters: they expect
- * an `AppContextHost`, not a plain object.
+ * The same request context must reach TypeORM adapters unchanged.
  */
 @QueryHandler(RocketsAuthUserPortGetByUsernameQuery)
 export class RocketsAuthUserPortGetByUsernameHandler
diff --git a/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-get-user-by-email.handler.ts b/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-get-user-by-email.handler.ts
index 2c56916dc..7fede227c 100644
--- a/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-get-user-by-email.handler.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-get-user-by-email.handler.ts
@@ -2,10 +2,8 @@ import { QueryHandler, IQueryHandler, QueryBus } from '@nestjs/cqrs';
 import { UserInterface } from '@concepta/nestjs-user';
 import { DomainAggregate } from '@concepta/nestjs-core/aggregate';
 import { GetUserByEmailQuery } from '@concepta/nestjs-user';
-import { RocketsEntity } from '../../../../../shared/constants/repository-entity-keys.constants';
 
 import { RocketsGetUserByEmailQuery } from '../impl/rockets-get-user-by-email.query';
-import { createRepositoryContext } from '@concepta/rockets-core';
 
 @QueryHandler(RocketsGetUserByEmailQuery)
 export class RocketsGetUserByEmailHandler
@@ -20,7 +18,8 @@ export class RocketsGetUserByEmailHandler
   async execute(
     query: RocketsGetUserByEmailQuery,
   ): Promise<DomainAggregate<UserInterface> | null> {
-    const ctx = createRepositoryContext(RocketsEntity.user);
-    return this.queryBus.execute(new GetUserByEmailQuery(ctx, query.email));
+    return this.queryBus.execute(
+      new GetUserByEmailQuery(query.ctx, query.email),
+    );
   }
 }
diff --git a/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-get-user-by-id.handler.ts b/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-get-user-by-id.handler.ts
index 02ed3a9c6..6caef736c 100644
--- a/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-get-user-by-id.handler.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-get-user-by-id.handler.ts
@@ -2,10 +2,8 @@ import { QueryHandler, IQueryHandler, QueryBus } from '@nestjs/cqrs';
 import { UserInterface } from '@concepta/nestjs-user';
 import { DomainAggregate } from '@concepta/nestjs-core/aggregate';
 import { GetUserQuery } from '@concepta/nestjs-user';
-import { RocketsEntity } from '../../../../../shared/constants/repository-entity-keys.constants';
 
 import { RocketsGetUserByIdQuery } from '../impl/rockets-get-user-by-id.query';
-import { createRepositoryContext } from '@concepta/rockets-core';
 
 @QueryHandler(RocketsGetUserByIdQuery)
 export class RocketsGetUserByIdHandler
@@ -20,7 +18,6 @@ export class RocketsGetUserByIdHandler
   async execute(
     query: RocketsGetUserByIdQuery,
   ): Promise<DomainAggregate<UserInterface> | null> {
-    const ctx = createRepositoryContext(RocketsEntity.user);
-    return this.queryBus.execute(new GetUserQuery(ctx, query.id));
+    return this.queryBus.execute(new GetUserQuery(query.ctx, query.id));
   }
 }
diff --git a/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-get-user-by-subject.handler.ts b/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-get-user-by-subject.handler.ts
index 238956e98..7cd5adb63 100644
--- a/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-get-user-by-subject.handler.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-get-user-by-subject.handler.ts
@@ -54,7 +54,11 @@ export class RocketsGetUserBySubjectHandler
     }
 
     const plain = aggregate.toPlain();
-    const userRoles = await resolveUserRoles(this.queryBus, plain.id);
+    const userRoles = await resolveUserRoles(
+      this.queryBus,
+      query.ctx,
+      plain.id,
+    );
 
     return {
       id: plain.id,
diff --git a/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-get-user-by-username.handler.ts b/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-get-user-by-username.handler.ts
index 353e7cc84..57b9508fc 100644
--- a/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-get-user-by-username.handler.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/queries/handlers/rockets-get-user-by-username.handler.ts
@@ -2,10 +2,8 @@ import { QueryHandler, IQueryHandler, QueryBus } from '@nestjs/cqrs';
 import { UserInterface } from '@concepta/nestjs-user';
 import { DomainAggregate } from '@concepta/nestjs-core/aggregate';
 import { GetUserByUsernameQuery } from '@concepta/nestjs-user';
-import { RocketsEntity } from '../../../../../shared/constants/repository-entity-keys.constants';
 
 import { RocketsGetUserByUsernameQuery } from '../impl/rockets-get-user-by-username.query';
-import { createRepositoryContext } from '@concepta/rockets-core';
 
 @QueryHandler(RocketsGetUserByUsernameQuery)
 export class RocketsGetUserByUsernameHandler
@@ -20,9 +18,8 @@ export class RocketsGetUserByUsernameHandler
   async execute(
     query: RocketsGetUserByUsernameQuery,
   ): Promise<DomainAggregate<UserInterface> | null> {
-    const ctx = createRepositoryContext(RocketsEntity.user);
     return this.queryBus.execute(
-      new GetUserByUsernameQuery(ctx, query.username),
+      new GetUserByUsernameQuery(query.ctx, query.username),
     );
   }
 }
diff --git a/packages/rockets-server-auth/src/domains/user/application/queries/impl/get-user-metadata.query.ts b/packages/rockets-server-auth/src/domains/user/application/queries/impl/get-user-metadata.query.ts
index 3741c2ebf..69d29e753 100644
--- a/packages/rockets-server-auth/src/domains/user/application/queries/impl/get-user-metadata.query.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/queries/impl/get-user-metadata.query.ts
@@ -1,3 +1,8 @@
+import type { PlainLiteralObject } from '@nestjs/common';
+
 export class GetUserMetadataQuery {
-  constructor(public readonly userId: string) {}
+  constructor(
+    public readonly ctx: PlainLiteralObject,
+    public readonly userId: string,
+  ) {}
 }
diff --git a/packages/rockets-server-auth/src/domains/user/application/queries/impl/get-user.query.ts b/packages/rockets-server-auth/src/domains/user/application/queries/impl/get-user.query.ts
index 44e5c6b6e..bfacfc153 100644
--- a/packages/rockets-server-auth/src/domains/user/application/queries/impl/get-user.query.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/queries/impl/get-user.query.ts
@@ -1,5 +1,9 @@
+import type { PlainLiteralObject } from '@nestjs/common';
 import { ReferenceId } from '@concepta/nestjs-core';
 
 export class GetUserQuery {
-  constructor(public readonly id: ReferenceId) {}
+  constructor(
+    public readonly ctx: PlainLiteralObject,
+    public readonly id: ReferenceId,
+  ) {}
 }
diff --git a/packages/rockets-server-auth/src/domains/user/application/queries/impl/rockets-get-user-by-email.query.ts b/packages/rockets-server-auth/src/domains/user/application/queries/impl/rockets-get-user-by-email.query.ts
index edf33e064..c1d55bc55 100644
--- a/packages/rockets-server-auth/src/domains/user/application/queries/impl/rockets-get-user-by-email.query.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/queries/impl/rockets-get-user-by-email.query.ts
@@ -1,3 +1,8 @@
+import type { PlainLiteralObject } from '@nestjs/common';
+
 export class RocketsGetUserByEmailQuery {
-  constructor(public readonly email: string) {}
+  constructor(
+    public readonly ctx: PlainLiteralObject,
+    public readonly email: string,
+  ) {}
 }
diff --git a/packages/rockets-server-auth/src/domains/user/application/queries/impl/rockets-get-user-by-id.query.ts b/packages/rockets-server-auth/src/domains/user/application/queries/impl/rockets-get-user-by-id.query.ts
index 0bc1acb3e..0a8868761 100644
--- a/packages/rockets-server-auth/src/domains/user/application/queries/impl/rockets-get-user-by-id.query.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/queries/impl/rockets-get-user-by-id.query.ts
@@ -1,3 +1,8 @@
+import type { PlainLiteralObject } from '@nestjs/common';
+
 export class RocketsGetUserByIdQuery {
-  constructor(public readonly id: string) {}
+  constructor(
+    public readonly ctx: PlainLiteralObject,
+    public readonly id: string,
+  ) {}
 }
diff --git a/packages/rockets-server-auth/src/domains/user/application/queries/impl/rockets-get-user-by-username.query.ts b/packages/rockets-server-auth/src/domains/user/application/queries/impl/rockets-get-user-by-username.query.ts
index 530f21eb1..351d9b4c4 100644
--- a/packages/rockets-server-auth/src/domains/user/application/queries/impl/rockets-get-user-by-username.query.ts
+++ b/packages/rockets-server-auth/src/domains/user/application/queries/impl/rockets-get-user-by-username.query.ts
@@ -1,3 +1,8 @@
+import type { PlainLiteralObject } from '@nestjs/common';
+
 export class RocketsGetUserByUsernameQuery {
-  constructor(public readonly username: string) {}
+  constructor(
+    public readonly ctx: PlainLiteralObject,
+    public readonly username: string,
+  ) {}
 }
diff --git a/packages/rockets-server-auth/src/domains/user/domain/repositories/user-metadata-repository.interface.ts b/packages/rockets-server-auth/src/domains/user/domain/repositories/user-metadata-repository.interface.ts
index 411ab2d56..fbeeff7f2 100644
--- a/packages/rockets-server-auth/src/domains/user/domain/repositories/user-metadata-repository.interface.ts
+++ b/packages/rockets-server-auth/src/domains/user/domain/repositories/user-metadata-repository.interface.ts
@@ -1,15 +1,15 @@
 import { RocketsAuthUserMetadataEntityInterface } from '../../interfaces/rockets-auth-user-metadata-entity.interface';
 import { RocketsAuthUserMetadataUpdatableInterface } from '../../interfaces/rockets-auth-user-metadata-updatable.interface';
-import { RepositoryContextInterface } from '@concepta/rockets-core';
+import type { PlainLiteralObject } from '@nestjs/common';
 
 export interface UserMetadataRepositoryInterface {
   findByUserId(
-    ctx: RepositoryContextInterface,
+    ctx: PlainLiteralObject,
     userId: string,
   ): Promise<RocketsAuthUserMetadataEntityInterface | null>;
 
   save(
-    ctx: RepositoryContextInterface,
+    ctx: PlainLiteralObject,
     userId: string,
     data: RocketsAuthUserMetadataUpdatableInterface,
   ): Promise<RocketsAuthUserMetadataEntityInterface>;
diff --git a/packages/rockets-server-auth/src/domains/user/infrastructure/persistence/user-metadata.repository.ts b/packages/rockets-server-auth/src/domains/user/infrastructure/persistence/user-metadata.repository.ts
index efafe7bf5..1556ae648 100644
--- a/packages/rockets-server-auth/src/domains/user/infrastructure/persistence/user-metadata.repository.ts
+++ b/packages/rockets-server-auth/src/domains/user/infrastructure/persistence/user-metadata.repository.ts
@@ -6,7 +6,7 @@ import { UserMetadataRepositoryInterface } from '../../domain/repositories/user-
 import { RocketsAuthUserMetadataEntityInterface } from '../../interfaces/rockets-auth-user-metadata-entity.interface';
 import { RocketsAuthUserMetadataUpdatableInterface } from '../../interfaces/rockets-auth-user-metadata-updatable.interface';
 import { USER_METADATA_MODULE_ENTITY_KEY } from '../../../../shared/constants/repository-entity-keys.constants';
-import { RepositoryContextInterface } from '@concepta/rockets-core';
+import type { PlainLiteralObject } from '@nestjs/common';
 import { InjectDynamicRepository } from '@concepta/rockets-core';
 
 @Injectable()
@@ -17,7 +17,7 @@ export class UserMetadataRepository implements UserMetadataRepositoryInterface {
   ) {}
 
   async findByUserId(
-    ctx: RepositoryContextInterface,
+    ctx: PlainLiteralObject,
     userId: string,
   ): Promise<RocketsAuthUserMetadataEntityInterface | null> {
     return this.repo.findOne({
@@ -27,7 +27,7 @@ export class UserMetadataRepository implements UserMetadataRepositoryInterface {
   }
 
   async save(
-    ctx: RepositoryContextInterface,
+    ctx: PlainLiteralObject,
     userId: string,
     data: RocketsAuthUserMetadataUpdatableInterface,
   ): Promise<RocketsAuthUserMetadataEntityInterface> {
@@ -35,7 +35,7 @@ export class UserMetadataRepository implements UserMetadataRepositoryInterface {
   }
 
   async createOrUpdate(
-    ctx: RepositoryContextInterface,
+    ctx: PlainLiteralObject,
     userId: string,
     data: RocketsAuthUserMetadataUpdatableInterface,
   ): Promise<RocketsAuthUserMetadataEntityInterface> {
diff --git a/packages/rockets-server-auth/src/domains/user/modules/rockets-auth-handler-overrides.spec.ts b/packages/rockets-server-auth/src/domains/user/modules/rockets-auth-handler-overrides.spec.ts
index 0e1d678fb..d536abe1d 100644
--- a/packages/rockets-server-auth/src/domains/user/modules/rockets-auth-handler-overrides.spec.ts
+++ b/packages/rockets-server-auth/src/domains/user/modules/rockets-auth-handler-overrides.spec.ts
@@ -69,28 +69,39 @@ describe('Handler Override Pattern', () => {
       }
     }
 
-    it('should use default handler when signupHandler not provided', () => {
-      const config: UserCrudOptionsExtrasInterface = {};
-      const module = RocketsAuthSignUpModule.register(config);
-      const providerClasses = (module.providers as { useClass?: unknown }[])
-        ?.map((p) =>
-          typeof p === 'function' ? p : (p as { useClass?: unknown }).useClass,
+    function crudProviderClasses(
+      module: ReturnType<typeof RocketsAuthSignUpModule.register>,
+    ) {
+      return (module.imports ?? [])
+        .flatMap((entry) =>
+          typeof entry === 'object' && entry !== null && 'providers' in entry
+            ? (entry as { providers?: unknown[] }).providers ?? []
+            : [],
+        )
+        .map((provider) =>
+          typeof provider === 'function'
+            ? provider
+            : (provider as { useClass?: unknown }).useClass,
         )
         .filter(Boolean);
-      expect(providerClasses).toContain(SignupUserHandler);
+    }
+
+    it('lets CrudModule own the default signup handler exactly once', () => {
+      const config: UserCrudOptionsExtrasInterface = {};
+      const module = RocketsAuthSignUpModule.register(config);
+      expect(crudProviderClasses(module)).toContain(SignupUserHandler);
+      expect(module.providers).not.toContain(SignupUserHandler);
     });
 
-    it('should use custom handler when signupHandler provided', () => {
+    it('lets CrudModule own the custom signup handler exactly once', () => {
       const config: UserCrudOptionsExtrasInterface = {
         handlers: {
           signupHandler: CustomSignupHandler,
         },
       };
       const module = RocketsAuthSignUpModule.register(config);
-      const providerClasses = (module.providers as unknown[])?.filter(
-        (p) => p === CustomSignupHandler || p === SignupUserHandler,
-      );
-      expect(providerClasses).toContain(CustomSignupHandler);
+      expect(crudProviderClasses(module)).toContain(CustomSignupHandler);
+      expect(module.providers).not.toContain(CustomSignupHandler);
     });
 
     it('should not include default handler when custom handler provided', () => {
diff --git a/packages/rockets-server-auth/src/domains/user/modules/rockets-auth-signup.module.ts b/packages/rockets-server-auth/src/domains/user/modules/rockets-auth-signup.module.ts
index 7826e108b..c994215b7 100644
--- a/packages/rockets-server-auth/src/domains/user/modules/rockets-auth-signup.module.ts
+++ b/packages/rockets-server-auth/src/domains/user/modules/rockets-auth-signup.module.ts
@@ -96,8 +96,7 @@ export class RocketsAuthSignUpModule {
         }),
       ],
       providers: [
-        // Application: command handlers
-        SignupHandler,
+        // SignupHandler is owned by CrudModule.forFeature above.
         AssignDefaultRoleHandler,
         // Application: query handlers
         GetUserHandler,
diff --git a/packages/rockets-server-auth/src/guards/admin.guard.ts b/packages/rockets-server-auth/src/guards/admin.guard.ts
index 1a35afed8..ada754f69 100644
--- a/packages/rockets-server-auth/src/guards/admin.guard.ts
+++ b/packages/rockets-server-auth/src/guards/admin.guard.ts
@@ -16,6 +16,7 @@ import { RocketsEntity } from '../shared/constants/repository-entity-keys.consta
 import { ROCKETS_AUTH_MODULE_OPTIONS_DEFAULT_SETTINGS_TOKEN } from '../shared/constants/rockets-auth.constants';
 import { logAndGetErrorDetails } from '../shared/utils/error-logging.helper';
 import { RocketsGetRoleByNameQuery } from '../domains/role/application/queries/impl/rockets-get-role-by-name.query';
+import { getAppContext } from '@concepta/rockets-core';
 
 @Injectable()
 export class AdminGuard implements CanActivate {
@@ -29,6 +30,7 @@ export class AdminGuard implements CanActivate {
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
     const request = context.switchToHttp().getRequest();
+    const ctx = getAppContext(request);
     const user = request.user;
 
     const ADMIN_ROLE = this.settings.role.adminRoleName;
@@ -43,14 +45,14 @@ export class AdminGuard implements CanActivate {
       const role = await this.queryBus.execute<
         RocketsGetRoleByNameQuery,
         RoleEntityInterface | null
-      >(new RocketsGetRoleByNameQuery(ADMIN_ROLE));
+      >(new RocketsGetRoleByNameQuery(ctx, ADMIN_ROLE));
 
       if (!role) {
         throw new ForbiddenException();
       }
 
       return await this.queryBus.execute<IsAssignedRoleQuery, boolean>(
-        new IsAssignedRoleQuery({}, RocketsEntity.userRole, role.id, user.id),
+        new IsAssignedRoleQuery(ctx, RocketsEntity.userRole, role.id, user.id),
       );
     } catch (error) {
       if (error instanceof ForbiddenException) {
diff --git a/packages/rockets-server-auth/src/index.ts b/packages/rockets-server-auth/src/index.ts
index f2b284279..f61d5864d 100644
--- a/packages/rockets-server-auth/src/index.ts
+++ b/packages/rockets-server-auth/src/index.ts
@@ -7,10 +7,8 @@ export type { DefineRocketsAuthInput } from './define-rockets-auth';
 
 export * from './domains/auth';
 export * from './domains/user';
-// TODO(upstream: concepta/nestjs-auth-apple|github|google) — re-add
-// `export * from './domains/oauth'` once v8 OAuth provider packages ship.
-// The domain is parked under `domains/oauth/` (controller body preserved
-// in a block comment for fast restore).
+// TODO(upstream: concepta/nestjs-auth-apple|github|google) — export the OAuth
+// domain once compatible v8 provider packages ship.
 export * from './domains/otp';
 export * from './domains/role';
 export * from './domains/invitation';
@@ -22,7 +20,7 @@ export { RocketsJwtAuthAdapter } from './provider/rockets-jwt-auth.adapter';
 export { ROCKETS_AUTH_MODULE_OPTIONS_DEFAULT_SETTINGS_TOKEN } from './shared/constants/rockets-auth.constants';
 
 // Access-control re-exports — so consumers single-source from
-// `@concepta/rockets-server-auth` instead of dual-importing from
+// `@concepta/rockets-auth` instead of dual-importing from
 // `@concepta/nestjs-access-control`. Mirrors what `RocketsAuthModule`
 // actually wires when `extras.accessControl` is provided.
 export {
diff --git a/packages/rockets-server-auth/src/provider/rockets-jwt-auth.adapter.ts b/packages/rockets-server-auth/src/provider/rockets-jwt-auth.adapter.ts
index 6a7e2fb02..f8ee37ad2 100644
--- a/packages/rockets-server-auth/src/provider/rockets-jwt-auth.adapter.ts
+++ b/packages/rockets-server-auth/src/provider/rockets-jwt-auth.adapter.ts
@@ -11,6 +11,7 @@ import type {
   AuthorizedUser,
 } from '@concepta/rockets-core';
 import { extractBearerToken } from '@concepta/rockets-core';
+import { getAppContext } from '@concepta/rockets-core';
 import { userAggregateToEntity } from '../shared/utils/aggregate-mappers';
 import { resolveUserRoles } from '../shared/utils/resolve-user-role-names';
 
@@ -25,7 +26,8 @@ export class RocketsJwtAuthAdapter implements AuthAdapterInterface {
     if (token === null) return { matched: false };
 
     try {
-      const user = await this.validateToken(token);
+      const ctx = getAppContext(request.raw as object);
+      const user = await this.validateToken(ctx, token);
       return { matched: true, user };
     } catch (error) {
       this.logger.error(`Token validation failed: ${error || 'Unknown error'}`);
@@ -39,12 +41,15 @@ export class RocketsJwtAuthAdapter implements AuthAdapterInterface {
     }
   }
 
-  private async validateToken(token: string): Promise<AuthorizedUser> {
+  private async validateToken(
+    ctx: import('@nestjs/common').PlainLiteralObject,
+    token: string,
+  ): Promise<AuthorizedUser> {
     // v8: signature-verify + payload-validate is one query handler now,
     // wired internally by AuthenticationModule. The v7 `VerifyTokenService`
     // is gone.
     const payload = (await this.queryBus.execute(
-      new ValidateAndVerifyAccessTokenQuery({}, token),
+      new ValidateAndVerifyAccessTokenQuery(ctx, token),
     )) as { sub?: string; roles?: string[] };
 
     if (!payload?.sub) {
@@ -55,7 +60,7 @@ export class RocketsJwtAuthAdapter implements AuthAdapterInterface {
     const userResult = await this.queryBus.execute<
       GetUserBySubjectQuery,
       DomainAggregate<UserInterface> | null
-    >(new GetUserBySubjectQuery({}, payload.sub));
+    >(new GetUserBySubjectQuery(ctx, payload.sub));
 
     if (!userResult) {
       this.logger.warn(`User not found for subject: ${payload.sub}`);
@@ -63,7 +68,7 @@ export class RocketsJwtAuthAdapter implements AuthAdapterInterface {
     }
 
     const user = userAggregateToEntity(userResult);
-    const userRoles = await resolveUserRoles(this.queryBus, user.id);
+    const userRoles = await resolveUserRoles(this.queryBus, ctx, user.id);
 
     this.logger.log(`Successfully validated token for user: ${payload.sub}`);
 
diff --git a/packages/rockets-server-auth/src/rockets-auth.module-definition.ts b/packages/rockets-server-auth/src/rockets-auth.module-definition.ts
index bf8a93ff5..99375beba 100644
--- a/packages/rockets-server-auth/src/rockets-auth.module-definition.ts
+++ b/packages/rockets-server-auth/src/rockets-auth.module-definition.ts
@@ -12,12 +12,18 @@ import {
   SwaggerUiModule,
 } from '@concepta/rockets-core';
 import { PassportModule } from '@nestjs/passport';
-import { APP_INTERCEPTOR } from '@nestjs/core';
-import { CqrsModule } from '@nestjs/cqrs';
+import { APP_GUARD, APP_INTERCEPTOR } from '@nestjs/core';
+import { CommandBus, CqrsModule, QueryBus } from '@nestjs/cqrs';
+import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
 import { ConfigModule } from '@nestjs/config';
 import {
   AuthenticationModule,
   AuthenticationOptionsInterface,
+  OtpPort,
+  PasswordPort,
+  RecoveryPolicy,
+  RecoveryService,
+  UserPort,
 } from '@concepta/nestjs-authentication';
 import { createSettingsProvider } from '@concepta/nestjs-core';
 import { CrudContextOverlay, CrudModule } from '@concepta/nestjs-crud';
@@ -45,7 +51,6 @@ import {
 import {
   CreatePasswordCommand,
   PasswordModule,
-  ValidateCurrentPasswordCommand,
   ValidatePasswordHistoryCommand,
 } from '@concepta/nestjs-password';
 import { RepositoryModule } from '@concepta/nestjs-repository';
@@ -98,9 +103,14 @@ import {
   RocketsAuthSetPasswordPortHandler,
   RocketsAuthValidatePasswordPortHandler,
 } from './shared/authentication/rockets-auth-password-port.handlers';
-import { RocketsValidateCurrentPasswordOverrideModule } from './shared/authentication/rockets-validate-current-password-override.module';
+import {
+  RocketsValidateCurrentPasswordCommand,
+  RocketsValidateCurrentPasswordHandler,
+} from './shared/authentication/rockets-validate-current-password.handler';
 import { RocketsAuthCreateOtpPortHandler } from './shared/authentication/rockets-auth-create-otp-port.handler';
 import { ConceptaRepositoryCompatModule } from './shared/compatibility/concepta-repository-compat.module';
+import { RocketsAuthRecoveryController } from './domains/auth/gateways/http/controllers/rockets-auth-recovery.controller';
+import { RocketsRecoveryService } from './domains/auth/application/services/rockets-recovery.service';
 
 export { RAW_OPTIONS_TOKEN } from './shared/constants/rockets-auth-raw-options.token';
 
@@ -281,6 +291,7 @@ export function createRocketsAuthControllers(options: {
   // `AuthenticationModule`; HTTP routes for `/token/password` and
   // `/token/refresh` are composed in {@link RocketsAuthTokenController}.
   if (!disableController.token) list.push(RocketsAuthTokenController);
+  if (!disableController.recovery) list.push(RocketsAuthRecoveryController);
   if (!disableController.otp) {
     list.push(buildRocketsAuthOtpController(options.extras?.otp?.controller));
   }
@@ -334,6 +345,15 @@ export function createRocketsAuthImports(importOptions: {
     RocketsAuthPortsModule.forRoot(importOptions.extras?.ports),
     ConfigModule.forFeature(rocketsAuthOptionsDefaultConfig),
     createSafeCrudRootModule(),
+    ...(importOptions.extras?.throttling === false
+      ? []
+      : [
+          ThrottlerModule.forRoot(
+            importOptions.extras?.throttling ?? [
+              { name: 'default', limit: 1000, ttl: 60000 },
+            ],
+          ),
+        ]),
     SwaggerUiModule.registerAsync({
       inject: [RAW_OPTIONS_TOKEN],
       useFactory: (options: RocketsAuthOptionsInterface) => ({
@@ -364,6 +384,23 @@ export function createRocketsAuthImports(importOptions: {
           settings: {
             ...authSettings,
             jwt: resolveJwtSettings(authSettings?.jwt),
+            mfa: {
+              ...authSettings?.mfa,
+              // Mounting the recovery controller implies that the upstream
+              // RecoveryService must be active. Its built-in defaults supply
+              // the OTP policy when the consumer does not override it.
+              recovery: authSettings?.mfa?.recovery ?? {
+                otp: {
+                  namespace: ROCKETS_AUTH_OTP_ASSIGNMENT,
+                  category: 'auth-recovery',
+                  type: 'uuid',
+                  expiresIn: '1h',
+                  duplicateStrategy: 'DEACTIVATE',
+                  rateSeconds: 60,
+                  rateThreshold: 5,
+                },
+              },
+            },
             strategies: {
               local: {},
               jwt: {},
@@ -405,8 +442,6 @@ export function createRocketsAuthImports(importOptions: {
       }),
     }),
 
-    RocketsValidateCurrentPasswordOverrideModule,
-
     UserModule.forRootAsync({
       inject: [RAW_OPTIONS_TOKEN],
       entities: {
@@ -414,6 +449,7 @@ export function createRocketsAuthImports(importOptions: {
         credentials: USER_CREDENTIALS_ENTITY_KEY,
       },
       imports: [...(importOptions.extras?.user?.imports || [])],
+      providers: [RocketsAuthSetPasswordPortHandler],
       useFactory: (options: RocketsAuthOptionsInterface) => {
         const userSettings = options.user?.settings;
         warnOrThrowOnRequireCurrentOverride(userSettings?.password);
@@ -429,7 +465,7 @@ export function createRocketsAuthImports(importOptions: {
           ports: {
             password: {
               createCommand: CreatePasswordCommand,
-              validateCurrentCommand: ValidateCurrentPasswordCommand,
+              validateCurrentCommand: RocketsValidateCurrentPasswordCommand,
               // Default-on: prevents silent password reuse. Without this,
               // `UserPasswordPort.validateHistory()` no-ops and returns
               // true for every reused password — even when the consumer
@@ -594,8 +630,7 @@ export function createRocketsAuthProviders(options: {
   providers?: Provider[];
   extras?: RocketsAuthOptionsExtrasInterface;
 }): Provider[] {
-  return [
-    ...(options.providers ?? []),
+  const providers: Provider[] = [
     createRocketsAuthSettingsProvider(),
     RocketsAuthOtpService,
     RocketsAuthNotificationService,
@@ -605,7 +640,48 @@ export function createRocketsAuthProviders(options: {
     RocketsGetRolesByIdsHandler,
     ChangeMyPasswordHandler,
     RocketsAuthValidatePasswordPortHandler,
-    RocketsAuthSetPasswordPortHandler,
     RocketsAuthCreateOtpPortHandler,
+    RocketsValidateCurrentPasswordHandler,
+    {
+      provide: RecoveryService,
+      inject: [RAW_OPTIONS_TOKEN, CommandBus, QueryBus],
+      useFactory: (
+        authOptions: RocketsAuthOptionsInterface,
+        commandBus: CommandBus,
+        queryBus: QueryBus,
+      ) => {
+        const ports = buildRocketsAuthenticationPorts(authOptions);
+        const recoverySettings = authOptions.authentication?.settings?.mfa
+          ?.recovery ?? {
+          otp: {
+            namespace: ROCKETS_AUTH_OTP_ASSIGNMENT,
+            category: 'auth-recovery',
+            type: 'uuid',
+            expiresIn: '1h',
+            duplicateStrategy: 'DEACTIVATE' as const,
+            rateSeconds: 60,
+            rateThreshold: 5,
+          },
+        };
+        return new RocketsRecoveryService(
+          new RecoveryPolicy(recoverySettings),
+          new OtpPort(ports.otp, commandBus, queryBus),
+          new UserPort(ports.user, queryBus, commandBus),
+          new PasswordPort(ports.password, commandBus),
+          ports.recoveryNotification,
+          commandBus,
+        );
+      },
+    },
   ];
+
+  if (options.extras?.throttling !== false) {
+    providers.push({ provide: APP_GUARD, useClass: ThrottlerGuard });
+  }
+
+  // Nest resolves later providers for the same token, so consumer overrides
+  // must follow Rockets defaults (including RecoveryService).
+  providers.push(...(options.providers ?? []));
+
+  return providers;
 }
diff --git a/packages/rockets-server-auth/src/shared/authentication/rockets-auth-create-otp-port.command.ts b/packages/rockets-server-auth/src/shared/authentication/rockets-auth-create-otp-port.command.ts
index 7399f2e0e..d3dcaf32c 100644
--- a/packages/rockets-server-auth/src/shared/authentication/rockets-auth-create-otp-port.command.ts
+++ b/packages/rockets-server-auth/src/shared/authentication/rockets-auth-create-otp-port.command.ts
@@ -1,4 +1,4 @@
-import { PlainLiteralObject } from '@nestjs/common';
+import type { PlainLiteralObject } from '@nestjs/common';
 import { Command } from '@nestjs/cqrs';
 import type {
   AuthenticationOtpCreatableInterface,
@@ -6,21 +6,10 @@ import type {
   CreateOtpCommandInterface,
 } from '@concepta/nestjs-authentication';
 
-// TODO(upstream: concepta/nestjs-otp + nestjs-authentication) — upstream
-// `CreateOtpCommand` constructor stores the payload on `dto`
-// (`create-otp.command.ts:21`), but `CreateOtpCommandInterface` (the auth
-// `OtpPort.createCommand` contract) requires the field name `otp`. The
-// `AuthenticationOtpCreatableInterface` shape also differs slightly from
-// `OtpCreatableInterface`. This bridge command + its handler exist solely
-// to translate. Tracked in: .context/upstream-gaps.md (G10). Restore when:
-// upstream renames `CreateOtpCommand.dto` → `otp` (or aligns the interfaces
-// so the upstream class satisfies `CreateOtpCommandInterface` directly).
-// Then this command + `RocketsAuthCreateOtpPortHandler` can be deleted and
-// `buildRocketsAuthenticationPorts` can wire `CreateOtpCommand` directly.
 /**
- * CQRS command implementing {@link CreateOtpCommandInterface} so {@link OtpPort#create}
- * (`new createCommand(ctx, namespace, otp, options)`) matches the authentication contract.
- * The upstream {@link CreateOtpCommand} stores the payload on `dto`; this type exposes it as `otp`.
+ * Bridges an upstream contract mismatch: authentication expects an `otp`
+ * field while `CreateOtpCommand` stores the same payload as `dto`. Remove this
+ * command when those contracts align.
  */
 export class RocketsAuthCreateOtpPortCommand
   extends Command<AuthenticationOtpInterface>
diff --git a/packages/rockets-server-auth/src/shared/authentication/rockets-auth-password-port.commands.ts b/packages/rockets-server-auth/src/shared/authentication/rockets-auth-password-port.commands.ts
index f23f51e52..8e5573816 100644
--- a/packages/rockets-server-auth/src/shared/authentication/rockets-auth-password-port.commands.ts
+++ b/packages/rockets-server-auth/src/shared/authentication/rockets-auth-password-port.commands.ts
@@ -35,7 +35,8 @@ export class RocketsAuthValidatePasswordPortCommand
 
 /**
  * CQRS command shape required by {@link PasswordPort} (`setPassword(ctx, password, assigneeId)`).
- * Bridges to {@link UpdateUserPasswordCommand} via {@link RocketsAuthSetPasswordPortHandler}.
+ * The handler enforces configured history policy, rotates the active
+ * credential transactionally, and preserves the caller's context.
  */
 export class RocketsAuthSetPasswordPortCommand
   extends Command<void>
diff --git a/packages/rockets-server-auth/src/shared/authentication/rockets-auth-password-port.handlers.spec.ts b/packages/rockets-server-auth/src/shared/authentication/rockets-auth-password-port.handlers.spec.ts
new file mode 100644
index 000000000..40a48c465
--- /dev/null
+++ b/packages/rockets-server-auth/src/shared/authentication/rockets-auth-password-port.handlers.spec.ts
@@ -0,0 +1,42 @@
+import { describe, expect, it, vi } from 'vitest';
+import { UserPasswordHistoryViolationException } from '@concepta/nestjs-user';
+import { AppContextHost } from '@concepta/nestjs-core';
+
+import { RocketsAuthSetPasswordPortHandler } from './rockets-auth-password-port.handlers';
+import { RocketsAuthSetPasswordPortCommand } from './rockets-auth-password-port.commands';
+
+describe('RocketsAuthSetPasswordPortHandler', () => {
+  it('rejects a reused password before creating or saving credentials', async () => {
+    const repository = {
+      findActiveByUserId: vi.fn().mockResolvedValue(null),
+      findByUserId: vi.fn().mockResolvedValue([{}]),
+      save: vi.fn(),
+    };
+    const passwordPort = {
+      validateHistory: vi.fn().mockResolvedValue(false),
+      create: vi.fn().mockResolvedValue({ passwordHash: 'hash' }),
+    };
+    const txCtx = {
+      trx: { onCommit: vi.fn(), onRollback: vi.fn() },
+    };
+    const handler = new RocketsAuthSetPasswordPortHandler(
+      repository as never,
+      { password: { reuseAfterDays: 30 } } as never,
+      passwordPort as never,
+      { run: vi.fn((_ctx, work) => work(txCtx)) } as never,
+      { mergeObjectContext: vi.fn() } as never,
+    );
+
+    await expect(
+      handler.execute(
+        new RocketsAuthSetPasswordPortCommand(
+          new AppContextHost(),
+          'ReusedP@ssword1',
+          'u1',
+        ),
+      ),
+    ).rejects.toBeInstanceOf(UserPasswordHistoryViolationException);
+    expect(passwordPort.create).not.toHaveBeenCalled();
+    expect(repository.save).not.toHaveBeenCalled();
+  });
+});
diff --git a/packages/rockets-server-auth/src/shared/authentication/rockets-auth-password-port.handlers.ts b/packages/rockets-server-auth/src/shared/authentication/rockets-auth-password-port.handlers.ts
index ccd7eef2b..a506ebf3c 100644
--- a/packages/rockets-server-auth/src/shared/authentication/rockets-auth-password-port.handlers.ts
+++ b/packages/rockets-server-auth/src/shared/authentication/rockets-auth-password-port.handlers.ts
@@ -1,12 +1,22 @@
 import {
   CommandBus,
   CommandHandler,
-  ICommandHandler,
+  EventPublisher,
+  type ICommandHandler,
   QueryBus,
 } from '@nestjs/cqrs';
-import type { UserCredentialEntityInterface } from '@concepta/nestjs-user';
+import { Inject } from '@nestjs/common';
+import {
+  UserCredentials,
+  UserPasswordHistoryViolationException,
+  UserPasswordPort,
+  type UserCredentialEntityInterface,
+  type UserCredentialsRepositoryInterface,
+  type UserSettingsInterface,
+} from '@concepta/nestjs-user';
 import { ValidateCurrentPasswordCommand } from '@concepta/nestjs-password';
-import { UpdateUserPasswordCommand } from '@concepta/nestjs-user';
+import { EventContextHost } from '@concepta/nestjs-core';
+import { TransactionScope } from '@concepta/nestjs-repository';
 
 import { GetActiveCredentialQuery } from '../../domains/user/application/queries/impl/get-active-credential.query';
 import { resolveConceptadevAppContext } from '../compatibility/resolve-conceptadev-app-context';
@@ -15,6 +25,11 @@ import {
   RocketsAuthValidatePasswordPortCommand,
 } from './rockets-auth-password-port.commands';
 
+// Upstream exposes these types but not their DI tokens. Keep the compatibility
+// strings isolated until @concepta/nestjs-user exports the constants.
+const USER_CREDENTIALS_REPOSITORY_TOKEN = 'USER_CREDENTIALS_REPOSITORY_TOKEN';
+const USER_MODULE_SETTINGS_TOKEN = 'USER_MODULE_SETTINGS_TOKEN';
+
 /**
  * Dispatches upstream password validation with the constructor shape {@link PasswordPort} uses.
  *
@@ -58,17 +73,65 @@ export class RocketsAuthValidatePasswordPortHandler
 export class RocketsAuthSetPasswordPortHandler
   implements ICommandHandler<RocketsAuthSetPasswordPortCommand, void>
 {
-  constructor(private readonly commandBus: CommandBus) {}
+  constructor(
+    @Inject(USER_CREDENTIALS_REPOSITORY_TOKEN)
+    private readonly credentialsRepository: UserCredentialsRepositoryInterface,
+    @Inject(USER_MODULE_SETTINGS_TOKEN)
+    private readonly userSettings: UserSettingsInterface,
+    @Inject(UserPasswordPort)
+    private readonly passwordPort: UserPasswordPort,
+    private readonly txScope: TransactionScope,
+    private readonly eventPublisher: EventPublisher,
+  ) {}
 
   async execute(command: RocketsAuthSetPasswordPortCommand): Promise<void> {
-    await this.commandBus.execute(
-      new UpdateUserPasswordCommand(
-        resolveConceptadevAppContext(command.ctx),
+    const ctx = resolveConceptadevAppContext(command.ctx);
+
+    await this.txScope.run(ctx, async (txCtx) => {
+      const eventContext = new EventContextHost({}, {});
+      const active = await this.credentialsRepository.findActiveByUserId(
+        txCtx,
         command.assigneeId,
-        {
-          password: command.password,
-        },
-      ),
-    );
+      );
+
+      const reuseAfterDays = this.userSettings.password?.reuseAfterDays;
+      if (reuseAfterDays !== undefined && reuseAfterDays > 0) {
+        const limitDate = new Date(
+          Date.now() - reuseAfterDays * 24 * 60 * 60 * 1000,
+        );
+        const history = await this.credentialsRepository.findByUserId(
+          txCtx,
+          command.assigneeId,
+          limitDate,
+        );
+        const valid = await this.passwordPort.validateHistory(
+          command.password,
+          history,
+        );
+        if (!valid) {
+          throw new UserPasswordHistoryViolationException();
+        }
+      }
+
+      const passwordStorage = await this.passwordPort.create(command.password);
+
+      if (active) {
+        const previous = this.eventPublisher.mergeObjectContext(active);
+        previous.deactivate(eventContext);
+        await this.credentialsRepository.save(txCtx, previous);
+        txCtx.trx.onCommit(() => previous.commit());
+        txCtx.trx.onRollback(() => previous.uncommit());
+      }
+
+      const next = this.eventPublisher.mergeObjectContext(
+        UserCredentials.create(eventContext, {
+          userId: command.assigneeId,
+          passwordHash: passwordStorage.passwordHash,
+        }),
+      );
+      await this.credentialsRepository.save(txCtx, next);
+      txCtx.trx.onCommit(() => next.commit());
+      txCtx.trx.onRollback(() => next.uncommit());
+    });
   }
 }
diff --git a/packages/rockets-server-auth/src/shared/authentication/rockets-validate-current-password-override.module.ts b/packages/rockets-server-auth/src/shared/authentication/rockets-validate-current-password-override.module.ts
deleted file mode 100644
index 71b9c9716..000000000
--- a/packages/rockets-server-auth/src/shared/authentication/rockets-validate-current-password-override.module.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import { Global, Module } from '@nestjs/common';
-import { ValidateCurrentPasswordHandler } from '@concepta/nestjs-password';
-
-import { RocketsValidateCurrentPasswordHandler } from './rockets-validate-current-password.handler';
-
-/**
- * Overrides upstream {@link ValidateCurrentPasswordHandler} so bcrypt receives a
- * plain `{ passwordHash }` for domain aggregates. Import after {@link PasswordModule}.
- */
-@Global()
-@Module({
-  providers: [
-    {
-      provide: ValidateCurrentPasswordHandler,
-      useClass: RocketsValidateCurrentPasswordHandler,
-    },
-  ],
-})
-export class RocketsValidateCurrentPasswordOverrideModule {}
diff --git a/packages/rockets-server-auth/src/shared/authentication/rockets-validate-current-password.handler.spec.ts b/packages/rockets-server-auth/src/shared/authentication/rockets-validate-current-password.handler.spec.ts
index 9733c6300..ac52e1932 100644
--- a/packages/rockets-server-auth/src/shared/authentication/rockets-validate-current-password.handler.spec.ts
+++ b/packages/rockets-server-auth/src/shared/authentication/rockets-validate-current-password.handler.spec.ts
@@ -1,28 +1,6 @@
 /**
- * Regression test pair for G9 (`.context/upstream-gaps.md`).
- *
- * The two tests are intentionally adjacent so the bug + workaround are
- * self-documenting: anyone removing `RocketsValidateCurrentPasswordHandler`
- * (or `RocketsValidateCurrentPasswordOverrideModule`) immediately sees the
- * upstream behavior they would re-expose.
- *
- * - **Test 1 (bug demonstration):** the upstream `PasswordCreationService.validateCurrent`
- *   does `{ password, ...target }`. When `target` is a v8 aggregate that exposes
- *   `passwordHash` via a getter on the prototype (not as an own enumerable
- *   property), the spread silently drops the field. bcrypt then compares
- *   the supplied password against `undefined` and returns `false` for a
- *   valid password.
- *
- * - **Test 2 (workaround in action):** our `RocketsValidateCurrentPasswordHandler`
- *   normalizes the target via `toPlain()` / `.props` / direct property read
- *   into a plain `PasswordStorageInterface` before delegating to the same
- *   upstream service. Same input, correct result.
- *
- * When upstream ships the spread fix:
- *   1. Test 1 will flip to returning `true` (delete it; the assertion
- *      becomes meaningless and would silently hide future regressions).
- *   2. Test 2 stays useful as a structural-contract test until the override
- *      module is removed.
+ * The upstream spread drops prototype getters; these tests preserve that
+ * compatibility constraint and verify Rockets' aggregate normalization.
  */
 import { describe, it, expect, beforeAll } from 'vitest';
 import {
@@ -31,20 +9,18 @@ import {
   PasswordStrengthService,
   PasswordValidationService,
   PasswordPolicy,
-  ValidateCurrentPasswordCommand,
 } from '@concepta/nestjs-password';
 
-import { RocketsValidateCurrentPasswordHandler } from './rockets-validate-current-password.handler';
-
-// --- Fixtures ---------------------------------------------------------
+import {
+  RocketsValidateCurrentPasswordCommand,
+  RocketsValidateCurrentPasswordHandler,
+} from './rockets-validate-current-password.handler';
 
 /**
- * Mimics the shape of a v8 `UserCredentials` aggregate:
- * `passwordHash` is exposed as a **prototype getter** plus a `toPlain()`
- * snapshot — neither of which survives `{ ...target }`.
+ * Mimics a credentials aggregate whose password hash is exposed by a getter
+ * and `toPlain()`, rather than an own enumerable property.
  */
 class AggregateLikeCredential {
-  // Stored privately on the instance; the getter is on the prototype.
   constructor(private readonly _passwordHash: string) {}
 
   get passwordHash(): string {
@@ -67,9 +43,7 @@ function buildPasswordCreationService(): PasswordCreationService {
   return new PasswordCreationService(policy, storage, validation, strength);
 }
 
-// --- Tests ------------------------------------------------------------
-
-describe('G9 — validateCurrent aggregate-spread bug', () => {
+describe('current-password aggregate compatibility', () => {
   const plainPassword = 'CorrectHorseBatteryStaple1!';
   let service: PasswordCreationService;
   let aggregate: AggregateLikeCredential;
@@ -80,8 +54,7 @@ describe('G9 — validateCurrent aggregate-spread bug', () => {
     aggregate = new AggregateLikeCredential(stored.passwordHash);
   });
 
-  it('Sanity — upstream `validateCurrent` returns true when given a plain POJO target', async () => {
-    // Baseline so the next test isn't blamed on hash/strength config.
+  it('validates a plain password-storage object upstream', async () => {
     const pojo = { passwordHash: aggregate.passwordHash };
     const result = await service.validateCurrent({
       password: plainPassword,
@@ -90,12 +63,7 @@ describe('G9 — validateCurrent aggregate-spread bug', () => {
     expect(result).toBe(true);
   });
 
-  it('BUG — upstream `validateCurrent` throws when target is an aggregate (passwordHash via getter)', async () => {
-    // Exact same hash, exact same plain password — only the target shape
-    // differs. The spread `{password, ...target}` drops the prototype
-    // getter and bcrypt then receives `hash: undefined` and throws
-    // `data and hash arguments required` — surfacing as HTTP 500 in
-    // production at the `PATCH /me/password` endpoint.
+  it('documents the upstream failure for aggregate credential targets', async () => {
     await expect(
       service.validateCurrent({
         password: plainPassword,
@@ -104,24 +72,23 @@ describe('G9 — validateCurrent aggregate-spread bug', () => {
     ).rejects.toThrow(/data and hash arguments required/);
   });
 
-  it('FIX — RocketsValidateCurrentPasswordHandler normalizes the aggregate and validates correctly', async () => {
-    // Same aggregate that the upstream service silently rejected above.
+  it('normalizes aggregate credentials before validation', async () => {
     const handler = new RocketsValidateCurrentPasswordHandler(service);
-    const command = new ValidateCurrentPasswordCommand(
+    const command = new RocketsValidateCurrentPasswordCommand(
       plainPassword,
       aggregate as unknown as { passwordHash: string },
     );
     const result = await handler.execute(command);
-    expect(result).toBe(true); // Correctly validates the right password.
+    expect(result).toBe(true);
   });
 
-  it('FIX — RocketsValidateCurrentPasswordHandler also rejects a wrong password against the same aggregate', async () => {
+  it('rejects an incorrect password after normalization', async () => {
     const handler = new RocketsValidateCurrentPasswordHandler(service);
-    const command = new ValidateCurrentPasswordCommand(
+    const command = new RocketsValidateCurrentPasswordCommand(
       'totally-wrong-password',
       aggregate as unknown as { passwordHash: string },
     );
     const result = await handler.execute(command);
-    expect(result).toBe(false); // Proves the fix isn't just blanket-accepting.
+    expect(result).toBe(false);
   });
 });
diff --git a/packages/rockets-server-auth/src/shared/authentication/rockets-validate-current-password.handler.ts b/packages/rockets-server-auth/src/shared/authentication/rockets-validate-current-password.handler.ts
index 9a11728b0..a6a4a2d68 100644
--- a/packages/rockets-server-auth/src/shared/authentication/rockets-validate-current-password.handler.ts
+++ b/packages/rockets-server-auth/src/shared/authentication/rockets-validate-current-password.handler.ts
@@ -1,31 +1,22 @@
 import { Injectable, InternalServerErrorException } from '@nestjs/common';
-import { CommandHandler, ICommandHandler } from '@nestjs/cqrs';
+import { Command, CommandHandler, type ICommandHandler } from '@nestjs/cqrs';
 import type { PasswordStorageInterface } from '@concepta/nestjs-common';
-import {
-  PasswordCreationService,
-  ValidateCurrentPasswordCommand,
-} from '@concepta/nestjs-password';
+import { PasswordCreationService } from '@concepta/nestjs-password';
+
+/** A distinct CQRS route avoids competing with the upstream command handler. */
+export class RocketsValidateCurrentPasswordCommand extends Command<boolean> {
+  constructor(
+    readonly password: string,
+    readonly target: PasswordStorageInterface,
+  ) {
+    super();
+  }
+}
 
-// TODO(upstream: concepta/nestjs-password) — `PasswordCreationService.validateCurrent`
-// flattens the target with `{ password, ...object }` (`password-creation.service.ts:51`),
-// which only copies own enumerable fields. v8 `UserCredentials` aggregates expose
-// `passwordHash` via getter / `toPlain()` / `.props` — none survive the spread, so the
-// upstream check always sees `passwordHash: undefined` and returns `false` for valid
-// passwords. Tracked in: .context/upstream-gaps.md (G9). Restore when: upstream
-// replaces the spread with `{ password, ...(target?.toPlain?.() ?? target) }` or
-// reshapes the contract to require `PasswordStorageInterface` strictly. Then this
-// override module + handler can be deleted.
 /**
- * Upstream `PasswordCreationService.validateCurrent` flattens the target with
- * `Object.assign({ password }, target)`, which only copies own enumerable
- * fields — getters on the prototype chain and nested `target.props.*` are
- * dropped. v8 `UserCredentials` aggregates expose `passwordHash` exactly that
- * way (getter / nested props), so the upstream check always sees
- * `passwordHash: undefined` and returns `false` for valid passwords.
- *
- * This helper normalizes any of the three known shapes (POJO, aggregate with
- * `toPlain()`, aggregate with `.props`) into a plain
- * `PasswordStorageInterface` before delegating.
+ * Normalize credential aggregates before delegating. Upstream currently
+ * spreads the target, which drops prototype getters and nested `props`; remove
+ * this adapter when it preserves aggregate `passwordHash` values.
  */
 function toPasswordStorageInterface(
   target: unknown,
@@ -52,24 +43,23 @@ function toPasswordStorageInterface(
   return undefined;
 }
 
-/**
- * Replaces upstream {@link ValidateCurrentPasswordHandler} so current-password
- * checks work when `target` is a credentials aggregate (see `toPlain` / `props`).
- */
+/** Validate a current password after normalizing the credential shape. */
 @Injectable()
-@CommandHandler(ValidateCurrentPasswordCommand)
+@CommandHandler(RocketsValidateCurrentPasswordCommand)
 export class RocketsValidateCurrentPasswordHandler
-  implements ICommandHandler<ValidateCurrentPasswordCommand, boolean>
+  implements ICommandHandler<RocketsValidateCurrentPasswordCommand, boolean>
 {
   constructor(
     private readonly passwordCreationService: PasswordCreationService,
   ) {}
 
-  async execute(command: ValidateCurrentPasswordCommand): Promise<boolean> {
+  async execute(
+    command: RocketsValidateCurrentPasswordCommand,
+  ): Promise<boolean> {
     const normalized = toPasswordStorageInterface(command.target);
     if (!normalized) {
       throw new InternalServerErrorException(
-        'ValidateCurrentPasswordCommand received a target without a ' +
+        'RocketsValidateCurrentPasswordCommand received a target without a ' +
           'reachable passwordHash (POJO, aggregate.toPlain(), or .props). ' +
           'Check the upstream caller that built the command.',
       );
diff --git a/packages/rockets-server-auth/src/shared/interfaces/controller/rockets-auth-controller-extras.interface.ts b/packages/rockets-server-auth/src/shared/interfaces/controller/rockets-auth-controller-extras.interface.ts
index 5731b2f2b..956691082 100644
--- a/packages/rockets-server-auth/src/shared/interfaces/controller/rockets-auth-controller-extras.interface.ts
+++ b/packages/rockets-server-auth/src/shared/interfaces/controller/rockets-auth-controller-extras.interface.ts
@@ -1,17 +1,4 @@
-import { Type } from '@nestjs/common';
-
-/**
- * Canonical controller-extras shape used across every domain in
- * `rockets-server-auth`. Documented in
- * `.context/v8-ddd-refactor-plan.md` §2.8.
- *
- * `ClassDecorator` / `MethodDecorator` are TypeScript built-in types — any
- * NestJS decorator (`UseGuards`, `Throttle`, `ApiTags`, `SetMetadata`, …)
- * matches them.
- *
- * Each domain defines its own `<Domain>ControllerExtras` interface that
- * names its concrete `routes` keys; this base captures the contract.
- */
+/** Shared customization contract for generated HTTP controllers. */
 export interface RocketsAuthRouteExtrasBase {
   /** Method decorators applied to the route handler. */
   decorators?: MethodDecorator[];
@@ -26,12 +13,4 @@ export interface RocketsAuthControllerExtrasBase<RouteMap = unknown> {
    * `RouteMap` to their own enum / string literal union.
    */
   routes?: RouteMap;
-
-  /**
-   * Repo / lifecycle hooks to attach to the resource the controller drives.
-   * Forwarded to `defineResource()` / `CrudModule.forFeature()` as
-   * `controller.useHooks` for declarative resources, or applied at the
-   * service layer for hand-built controllers.
-   */
-  useHooks?: Type<unknown>[];
 }
diff --git a/packages/rockets-server-auth/src/shared/interfaces/rockets-auth-options-extras.interface.ts b/packages/rockets-server-auth/src/shared/interfaces/rockets-auth-options-extras.interface.ts
index 5cb4a9801..016d11423 100644
--- a/packages/rockets-server-auth/src/shared/interfaces/rockets-auth-options-extras.interface.ts
+++ b/packages/rockets-server-auth/src/shared/interfaces/rockets-auth-options-extras.interface.ts
@@ -1,24 +1,31 @@
-import { AccessControlOptionsInterface } from '@concepta/nestjs-access-control';
-import type { CanAccess } from '@concepta/nestjs-access-control';
-import type { CanActivate } from '@nestjs/common';
+import type {
+  AccessControlOptionsInterface,
+  CanAccess,
+} from '@concepta/nestjs-access-control';
+import type {
+  CanActivate,
+  DynamicModule,
+  Provider,
+  Type,
+} from '@nestjs/common';
 import type { AuthenticationOptionsExtrasInterface } from '@concepta/nestjs-authentication';
-import { RocketsAuthUserMetadataCreatableInterface } from '../../domains/user/interfaces/rockets-auth-user-metadata-creatable.interface';
-import { DynamicModule, Provider, Type } from '@nestjs/common';
-import { RocketsAuthUserCreatableInterface } from '../../domains/user/interfaces/rockets-auth-user-creatable.interface';
-import { RocketsAuthUserUpdatableInterface } from '../../domains/user/interfaces/rockets-auth-user-updatable.interface';
-import { RocketsAuthRoleCreatableInterface } from '../../domains/role/interfaces/rockets-auth-role-creatable.interface';
-import { RocketsAuthRoleUpdatableInterface } from '../../domains/role/interfaces/rockets-auth-role-updatable.interface';
-import { RocketsAuthUserMetadataModelUpdatableInterface } from '../../domains/user/interfaces/rockets-auth-user-metadata-updatable.interface';
-import { RoleExtrasInterface } from '@concepta/nestjs-role';
-import { RocketsAuthPortsConfigInterface } from './rockets-auth-ports-config.interface';
-import {
+import type { ThrottlerModuleOptions } from '@nestjs/throttler';
+import type { RoleExtrasInterface } from '@concepta/nestjs-role';
+import type { RocketsAuthUserMetadataCreatableInterface } from '../../domains/user/interfaces/rockets-auth-user-metadata-creatable.interface';
+import type { RocketsAuthUserCreatableInterface } from '../../domains/user/interfaces/rockets-auth-user-creatable.interface';
+import type { RocketsAuthUserUpdatableInterface } from '../../domains/user/interfaces/rockets-auth-user-updatable.interface';
+import type { RocketsAuthRoleCreatableInterface } from '../../domains/role/interfaces/rockets-auth-role-creatable.interface';
+import type { RocketsAuthRoleUpdatableInterface } from '../../domains/role/interfaces/rockets-auth-role-updatable.interface';
+import type { RocketsAuthUserMetadataModelUpdatableInterface } from '../../domains/user/interfaces/rockets-auth-user-metadata-updatable.interface';
+import type { RocketsAuthPortsConfigInterface } from './rockets-auth-ports-config.interface';
+import type {
   AbstractSignupUserHandler,
   SignupUserCommand,
 } from '../../domains/user';
-import { AbstractAdminUserListHandler } from '../../domains/user/application/commands/handlers/abstract-admin-user-list.handler';
-import { AbstractAdminUserReadHandler } from '../../domains/user/application/commands/handlers/abstract-admin-user-read.handler';
-import { AbstractAdminUserUpdateHandler } from '../../domains/user/application/commands/handlers/abstract-admin-user-update.handler';
-import { AbstractAdminDeleteUserHandler } from '../../domains/user/application/commands/handlers/abstract-admin-delete-user.handler';
+import type { AbstractAdminUserListHandler } from '../../domains/user/application/commands/handlers/abstract-admin-user-list.handler';
+import type { AbstractAdminUserReadHandler } from '../../domains/user/application/commands/handlers/abstract-admin-user-read.handler';
+import type { AbstractAdminUserUpdateHandler } from '../../domains/user/application/commands/handlers/abstract-admin-user-update.handler';
+import type { AbstractAdminDeleteUserHandler } from '../../domains/user/application/commands/handlers/abstract-admin-delete-user.handler';
 
 /**
  * Generic userMetadata configuration interface
@@ -81,21 +88,11 @@ export interface UserCrudOptionsExtrasInterface {
     createOne?: Type<RocketsAuthUserCreatableInterface>;
     updateOne?: Type<RocketsAuthUserUpdatableInterface>;
   };
-  /**
-   * Optional custom signup command handler.
-   * Must extend AbstractSignupUserHandler.
-   * Overrides the default SignupUserHandler business logic
-   * while keeping all HTTP routing, swagger, and validation intact.
-   */
-  /**
-   * Optional custom admin operation handlers.
-   * Each must extend the corresponding abstract base class.
-   * Overrides the default handler for List, Read, or Update
-   * while keeping all HTTP routing, swagger, guards, and serialization intact.
-   */
+  /** Optional signup command constructor. */
   command?: {
     signupCommand?: Type<SignupUserCommand>;
   };
+  /** Optional signup and admin CQRS handler overrides. */
   handlers?: {
     signupHandler?: Type<AbstractSignupUserHandler>;
     /** Custom admin list handler. Must extend AbstractAdminUserListHandler. */
@@ -117,11 +114,7 @@ export interface RoleCrudOptionsExtrasInterface {
     createOne?: Type<RocketsAuthRoleCreatableInterface>;
     updateOne?: Type<RocketsAuthRoleUpdatableInterface>;
   };
-  /**
-   * Controller customization seams (decorators, hooks, per-route handler
-   * overrides). See `domains/role/interfaces/role-controller-extras.interface.ts`
-   * and `.context/v8-ddd-refactor-plan.md` §2.8.
-   */
+  /** Controller decorators and per-route handler overrides. */
   controller?: import('../../domains/role/interfaces/role-controller-extras.interface').RoleControllerExtras;
 }
 
@@ -158,19 +151,15 @@ export interface DisableControllerOptionsInterface {
 
   /** Disable `/token/password` and `/token/refresh`. */
   token?: boolean;
+
+  /** Disable account-recovery routes under `/recovery`. */
+  recovery?: boolean;
 }
 
 export interface RocketsAuthOptionsExtrasInterface
   extends Pick<DynamicModule, 'global' | 'controllers'> {
   user?: { imports: DynamicModule['imports'] };
-  /**
-   * Auth domain extras. `controller` accepts the standard triplet
-   * documented in `.context/v8-ddd-refactor-plan.md` §2.8:
-   * `classDecorators`, `routes[*].decorators`. The `MePasswordController`
-   * is factory-built; the `auth.controller` extras are forwarded to that
-   * factory so consumers can append guards / throttling / ACL without
-   * subclassing the controller.
-   */
+  /** Auth module imports, guards, and password-controller decorators. */
   auth?: {
     imports?: DynamicModule['imports'];
     controller?: import('../../domains/auth/interfaces/me-password-controller-extras.interface').MePasswordControllerExtras;
@@ -187,10 +176,9 @@ export interface RocketsAuthOptionsExtrasInterface
      * Forwarded to `AuthenticationModule.forRootAsync({ guards })` — registers
      * route-named guards for the auth-router feature (multi-strategy routing).
      *
-     * Note: the implementations of these guards live in the v7 OAuth provider
-     * packages (`@concepta/nestjs-auth-{google,github,apple,router}`), which
-     * are blocked by upstream gap G1. Until those ship v8, the plumbing exists
-     * but the feature is unusable. Safe to leave undefined.
+     * Compatible implementations are not yet available from the upstream
+     * OAuth provider packages, so leave this undefined unless the host supplies
+     * its own guards.
      */
     guards?: AuthenticationOptionsExtrasInterface['guards'];
   };
@@ -210,9 +198,6 @@ export interface RocketsAuthOptionsExtrasInterface
   // package which has been removed.
   userCrud?: UserCrudOptionsExtrasInterface;
   roleCrud?: RoleCrudOptionsExtrasInterface;
-  /**
-   * Optional access control configuration.
-   */
   /**
    * Optional `imports` / `queryServices` are forwarded to AccessControlModule.forRoot
    * so route guards can resolve domain `CanAccess` query services.
@@ -222,6 +207,12 @@ export interface RocketsAuthOptionsExtrasInterface
     queryServices?: Provider<CanAccess>[];
   };
   disableController?: DisableControllerOptionsInterface;
+  /**
+   * Global request-throttling configuration. Route-specific limits declared by
+   * Rockets Auth use the `default` throttler. Pass `false` only when the host
+   * application already owns the global throttler module and guard.
+   */
+  throttling?: false | ThrottlerModuleOptions;
   invitation?: {
     imports?: DynamicModule['imports'];
     /**
diff --git a/packages/rockets-server-auth/src/shared/interfaces/rockets-auth-options.interface.ts b/packages/rockets-server-auth/src/shared/interfaces/rockets-auth-options.interface.ts
index 989dc55fb..275b3bea9 100644
--- a/packages/rockets-server-auth/src/shared/interfaces/rockets-auth-options.interface.ts
+++ b/packages/rockets-server-auth/src/shared/interfaces/rockets-auth-options.interface.ts
@@ -33,7 +33,7 @@ import { RocketsAuthSettingsInterface } from './rockets-auth-settings.interface'
 /**
  * Options accepted by `CrudModule.forRoot()` (the upstream interface
  * `CrudModuleOptionsInterface` is not exported publicly in
- * `@concepta/rockets-crud@v8.0.0-alpha.5`, so we extract it via TS
+ * `@concepta/nestjs-crud`, so we extract it via TypeScript
  * inference instead of deep-importing).
  */
 type CrudModuleOptions = Parameters<typeof CrudModule.forRoot>[0];
@@ -49,8 +49,7 @@ type CrudModuleOptions = Parameters<typeof CrudModule.forRoot>[0];
  * are CQRS Command/Query class types (NOT service instances).
  *
  * The OAuth provider modules (`auth-apple`, `auth-github`, `auth-google`) are
- * intentionally absent here — they have not been ported to v8 yet upstream.
- * See `domains/oauth/` for the deferred wiring with `TODO(upstream:)` markers.
+ * intentionally absent until upstream ships compatible v8 releases.
  */
 export interface RocketsAuthOptionsInterface {
   /**
@@ -82,8 +81,8 @@ export interface RocketsAuthOptionsInterface {
    *   Defaulted to all-enabled; pass `{ jwt: {} }` etc. to override.
    * - `mfa` — `recovery` / `verify` MFA policy overrides
    *   (`RecoveryPolicySettingsInterface` / `VerifyPolicySettingsInterface`).
-   *   Typed-reachable; no rockets default — upstream supplies defaults
-   *   when omitted.
+   *   Recovery defaults to Rockets' OTP namespace/category/rate policy when
+   *   omitted so the mounted recovery controller is always operational.
    * - `guards` — guard enable/disable policy
    *   (`GuardsPolicySettingsInterface`). Typed-reachable; no rockets
    *   default.
diff --git a/packages/rockets-server-auth/src/shared/ports/rockets-auth-otp-port.service.spec.ts b/packages/rockets-server-auth/src/shared/ports/rockets-auth-otp-port.service.spec.ts
index 2654fa6ee..62d2aa6a8 100644
--- a/packages/rockets-server-auth/src/shared/ports/rockets-auth-otp-port.service.spec.ts
+++ b/packages/rockets-server-auth/src/shared/ports/rockets-auth-otp-port.service.spec.ts
@@ -23,15 +23,18 @@ describe('RocketsAuthOtpPortService', () => {
   it('create dispatches RocketsCreateOtpCommand', async () => {
     const created = { id: 'otp1' };
     commandBus.execute.mockResolvedValueOnce(created);
-    const out = await service.create({
-      assignment: 'user-otp',
-      otp: {
-        category: 'recovery',
-        type: 'uuid',
-        assigneeId: 'u1',
-        expiresIn: '1h',
+    const out = await service.create(
+      {},
+      {
+        assignment: 'user-otp',
+        otp: {
+          category: 'recovery',
+          type: 'uuid',
+          assigneeId: 'u1',
+          expiresIn: '1h',
+        },
       },
-    });
+    );
     expect(out).toBe(created);
     expect(commandBus.execute).toHaveBeenCalledWith(
       expect.any(RocketsCreateOtpCommand),
@@ -42,6 +45,7 @@ describe('RocketsAuthOtpPortService', () => {
     const assignee = { assigneeId: 'u1' };
     queryBus.execute.mockResolvedValueOnce(assignee);
     const out = await service.validate(
+      {},
       'user-otp',
       { category: 'recovery', passcode: '123' },
       false,
@@ -54,7 +58,7 @@ describe('RocketsAuthOtpPortService', () => {
 
   it('clear dispatches RocketsClearOtpsCommand', async () => {
     commandBus.execute.mockResolvedValueOnce(undefined);
-    await service.clear('user-otp', {
+    await service.clear({}, 'user-otp', {
       category: 'recovery',
       assigneeId: 'u1',
     });
diff --git a/packages/rockets-server-auth/src/shared/ports/rockets-auth-otp-port.service.ts b/packages/rockets-server-auth/src/shared/ports/rockets-auth-otp-port.service.ts
index 8c433310a..5fb3f9046 100644
--- a/packages/rockets-server-auth/src/shared/ports/rockets-auth-otp-port.service.ts
+++ b/packages/rockets-server-auth/src/shared/ports/rockets-auth-otp-port.service.ts
@@ -1,4 +1,4 @@
-import { Injectable } from '@nestjs/common';
+import { Injectable, type PlainLiteralObject } from '@nestjs/common';
 import { CommandBus, QueryBus } from '@nestjs/cqrs';
 import {
   AssigneeRelationInterface,
@@ -34,24 +34,31 @@ export class RocketsAuthOtpPortService {
     private readonly queryBus: QueryBus,
   ) {}
 
-  async create(params: RocketsCreateOtpParams): Promise<OtpInterface> {
-    return this.commandBus.execute(new RocketsCreateOtpCommand(params));
+  async create(
+    ctx: PlainLiteralObject,
+    params: RocketsCreateOtpParams,
+  ): Promise<OtpInterface> {
+    return this.commandBus.execute(new RocketsCreateOtpCommand(ctx, params));
   }
 
   async validate(
+    ctx: PlainLiteralObject,
     assignment: ReferenceAssignment,
     otp: Pick<OtpInterface, 'category' | 'passcode'>,
     deleteIfValid: boolean,
   ): Promise<AssigneeRelationInterface | null> {
     return this.queryBus.execute(
-      new RocketsValidateOtpQuery(assignment, otp, deleteIfValid),
+      new RocketsValidateOtpQuery(ctx, assignment, otp, deleteIfValid),
     );
   }
 
   async clear(
+    ctx: PlainLiteralObject,
     assignment: ReferenceAssignment,
     otp: Pick<OtpInterface, 'assigneeId' | 'category'>,
   ): Promise<void> {
-    await this.commandBus.execute(new RocketsClearOtpsCommand(assignment, otp));
+    await this.commandBus.execute(
+      new RocketsClearOtpsCommand(ctx, assignment, otp),
+    );
   }
 }
diff --git a/packages/rockets-server-auth/src/shared/ports/rockets-auth-user-port.service.spec.ts b/packages/rockets-server-auth/src/shared/ports/rockets-auth-user-port.service.spec.ts
index 7caf62946..611fd3fcc 100644
--- a/packages/rockets-server-auth/src/shared/ports/rockets-auth-user-port.service.spec.ts
+++ b/packages/rockets-server-auth/src/shared/ports/rockets-auth-user-port.service.spec.ts
@@ -11,6 +11,7 @@ import { RocketsUpdateUserCommand } from '../../domains/user/application/command
 import { GetActiveCredentialQuery } from '../../domains/user/application/queries/impl/get-active-credential.query';
 
 describe('RocketsAuthUserPortService', () => {
+  const ctx = {};
   let service: RocketsAuthUserPortService;
   let queryBus: { execute: Mock };
   let commandBus: { execute: Mock };
@@ -30,7 +31,7 @@ describe('RocketsAuthUserPortService', () => {
   describe('bySubject', () => {
     it('returns null when no result', async () => {
       queryBus.execute.mockResolvedValueOnce(null);
-      await expect(service.bySubject('s1')).resolves.toBeNull();
+      await expect(service.bySubject(ctx, 's1')).resolves.toBeNull();
       expect(queryBus.execute).toHaveBeenCalledWith(
         expect.any(RocketsGetUserBySubjectQuery),
       );
@@ -38,29 +39,29 @@ describe('RocketsAuthUserPortService', () => {
 
     it('returns { id } when result has id', async () => {
       queryBus.execute.mockResolvedValueOnce({ id: 'u1' });
-      await expect(service.bySubject('s1')).resolves.toEqual({ id: 'u1' });
+      await expect(service.bySubject(ctx, 's1')).resolves.toEqual({ id: 'u1' });
     });
 
     it('returns null when result has no id field', async () => {
       queryBus.execute.mockResolvedValueOnce({});
-      await expect(service.bySubject('s1')).resolves.toBeNull();
+      await expect(service.bySubject(ctx, 's1')).resolves.toBeNull();
     });
 
     it('propagates query bus errors instead of swallowing', async () => {
       queryBus.execute.mockRejectedValueOnce(new Error('db down'));
-      await expect(service.bySubject('s1')).rejects.toThrow('db down');
+      await expect(service.bySubject(ctx, 's1')).rejects.toThrow('db down');
     });
   });
 
   describe('byId', () => {
     it('returns null when handler returns null', async () => {
       queryBus.execute.mockResolvedValueOnce(null);
-      await expect(service.byId('u1')).resolves.toBeNull();
+      await expect(service.byId(ctx, 'u1')).resolves.toBeNull();
     });
 
     it('returns plain user from aggregate.toPlain()', async () => {
       queryBus.execute.mockResolvedValueOnce(aggregate);
-      await expect(service.byId('u1')).resolves.toEqual(userPlain);
+      await expect(service.byId(ctx, 'u1')).resolves.toEqual(userPlain);
       expect(queryBus.execute).toHaveBeenCalledWith(
         expect.any(RocketsGetUserByIdQuery),
       );
@@ -68,21 +69,21 @@ describe('RocketsAuthUserPortService', () => {
 
     it('propagates errors', async () => {
       queryBus.execute.mockRejectedValueOnce(new Error('boom'));
-      await expect(service.byId('u1')).rejects.toThrow('boom');
+      await expect(service.byId(ctx, 'u1')).rejects.toThrow('boom');
     });
   });
 
   describe('byEmail (with credential enrichment)', () => {
     it('returns null when no user', async () => {
       queryBus.execute.mockResolvedValueOnce(null);
-      await expect(service.byEmail('a@b.com')).resolves.toBeNull();
+      await expect(service.byEmail(ctx, 'a@b.com')).resolves.toBeNull();
     });
 
     it('enriches user with passwordHash when credential exists', async () => {
       queryBus.execute
         .mockResolvedValueOnce(aggregate)
         .mockResolvedValueOnce({ passwordHash: 'hash1' });
-      await expect(service.byEmail('a@b.com')).resolves.toEqual({
+      await expect(service.byEmail(ctx, 'a@b.com')).resolves.toEqual({
         ...userPlain,
         passwordHash: 'hash1',
       });
@@ -100,21 +101,21 @@ describe('RocketsAuthUserPortService', () => {
       queryBus.execute
         .mockResolvedValueOnce(aggregate)
         .mockResolvedValueOnce(null);
-      await expect(service.byEmail('a@b.com')).resolves.toEqual(userPlain);
+      await expect(service.byEmail(ctx, 'a@b.com')).resolves.toEqual(userPlain);
     });
   });
 
   describe('byUsername', () => {
     it('returns null when no user', async () => {
       queryBus.execute.mockResolvedValueOnce(null);
-      await expect(service.byUsername('alice')).resolves.toBeNull();
+      await expect(service.byUsername(ctx, 'alice')).resolves.toBeNull();
     });
 
     it('enriches with credential', async () => {
       queryBus.execute
         .mockResolvedValueOnce(aggregate)
         .mockResolvedValueOnce({ passwordHash: 'hash2' });
-      await expect(service.byUsername('alice')).resolves.toEqual({
+      await expect(service.byUsername(ctx, 'alice')).resolves.toEqual({
         ...userPlain,
         passwordHash: 'hash2',
       });
@@ -128,13 +129,13 @@ describe('RocketsAuthUserPortService', () => {
   describe('update', () => {
     it('returns null when handler returns null', async () => {
       commandBus.execute.mockResolvedValueOnce(null);
-      await expect(service.update({ id: 'u1' })).resolves.toBeNull();
+      await expect(service.update(ctx, { id: 'u1' })).resolves.toBeNull();
     });
 
     it('returns plain user from updated aggregate', async () => {
       commandBus.execute.mockResolvedValueOnce(aggregate);
       await expect(
-        service.update({ id: 'u1', email: 'new@b.com' }),
+        service.update(ctx, { id: 'u1', email: 'new@b.com' }),
       ).resolves.toEqual(userPlain);
       expect(commandBus.execute).toHaveBeenCalledWith(
         expect.any(RocketsUpdateUserCommand),
@@ -145,12 +146,14 @@ describe('RocketsAuthUserPortService', () => {
   describe('create', () => {
     it('returns null when handler returns null', async () => {
       commandBus.execute.mockResolvedValueOnce(null);
-      await expect(service.create({ email: 'a@b.com' })).resolves.toBeNull();
+      await expect(
+        service.create(ctx, { email: 'a@b.com' }),
+      ).resolves.toBeNull();
     });
 
     it('returns plain user from created aggregate', async () => {
       commandBus.execute.mockResolvedValueOnce(aggregate);
-      await expect(service.create({ email: 'a@b.com' })).resolves.toEqual(
+      await expect(service.create(ctx, { email: 'a@b.com' })).resolves.toEqual(
         userPlain,
       );
       expect(commandBus.execute).toHaveBeenCalledWith(
diff --git a/packages/rockets-server-auth/src/shared/ports/rockets-auth-user-port.service.ts b/packages/rockets-server-auth/src/shared/ports/rockets-auth-user-port.service.ts
index 6bfc4fef5..08053e5d7 100644
--- a/packages/rockets-server-auth/src/shared/ports/rockets-auth-user-port.service.ts
+++ b/packages/rockets-server-auth/src/shared/ports/rockets-auth-user-port.service.ts
@@ -1,4 +1,4 @@
-import { Injectable } from '@nestjs/common';
+import { Injectable, type PlainLiteralObject } from '@nestjs/common';
 import { CommandBus, QueryBus } from '@nestjs/cqrs';
 import { ReferenceIdInterface, ReferenceSubject } from '@concepta/nestjs-core';
 import {
@@ -33,64 +33,77 @@ export class RocketsAuthUserPortService {
   ) {}
 
   async bySubject(
+    ctx: PlainLiteralObject,
     subject: ReferenceSubject,
   ): Promise<ReferenceIdInterface | null> {
     const result = await this.queryBus.execute<
       RocketsGetUserBySubjectQuery,
       DomainAggregate<UserInterface> | ReferenceIdInterface | null
-    >(new RocketsGetUserBySubjectQuery({}, subject));
+    >(new RocketsGetUserBySubjectQuery(ctx, subject));
     if (!result) return null;
     return 'id' in result ? { id: result.id } : null;
   }
 
-  async byId(id: string): Promise<UserEntityInterface | null> {
+  async byId(
+    ctx: PlainLiteralObject,
+    id: string,
+  ): Promise<UserEntityInterface | null> {
     const result = await this.queryBus.execute<
       RocketsGetUserByIdQuery,
       DomainAggregate<UserInterface> | null
-    >(new RocketsGetUserByIdQuery(id));
+    >(new RocketsGetUserByIdQuery(ctx, id));
     return result ? userAggregateToEntity(result) : null;
   }
 
-  async byEmail(email: string): Promise<UserWithCredentials | null> {
+  async byEmail(
+    ctx: PlainLiteralObject,
+    email: string,
+  ): Promise<UserWithCredentials | null> {
     const result = await this.queryBus.execute<
       RocketsGetUserByEmailQuery,
       DomainAggregate<UserInterface> | null
-    >(new RocketsGetUserByEmailQuery(email));
+    >(new RocketsGetUserByEmailQuery(ctx, email));
     if (!result) return null;
-    return this.enrichWithCredentials(result);
+    return this.enrichWithCredentials(ctx, result);
   }
 
-  async byUsername(username: string): Promise<UserWithCredentials | null> {
+  async byUsername(
+    ctx: PlainLiteralObject,
+    username: string,
+  ): Promise<UserWithCredentials | null> {
     const result = await this.queryBus.execute<
       RocketsGetUserByUsernameQuery,
       DomainAggregate<UserInterface> | null
-    >(new RocketsGetUserByUsernameQuery(username));
+    >(new RocketsGetUserByUsernameQuery(ctx, username));
     if (!result) return null;
-    return this.enrichWithCredentials(result);
+    return this.enrichWithCredentials(ctx, result);
   }
 
   async update(
+    ctx: PlainLiteralObject,
     data: Partial<UserEntityInterface> & { id: string },
   ): Promise<UserEntityInterface | null> {
     const result = await this.commandBus.execute<
       RocketsUpdateUserCommand,
       DomainAggregate<UserInterface> | null
-    >(new RocketsUpdateUserCommand(data.id, data));
+    >(new RocketsUpdateUserCommand(ctx, data.id, data));
     return result ? userAggregateToEntity(result) : null;
   }
 
   async create(
+    ctx: PlainLiteralObject,
     data: Partial<UserEntityInterface>,
   ): Promise<UserEntityInterface | null> {
     const result = await this.commandBus.execute<
       RocketsCreateUserCommand,
       DomainAggregate<UserInterface> | null
-    >(new RocketsCreateUserCommand(data));
+    >(new RocketsCreateUserCommand(ctx, data));
     return result ? userAggregateToEntity(result) : null;
   }
 
   /** auth-local expects passwordHash/passwordSalt on the user object. */
   private async enrichWithCredentials(
+    ctx: PlainLiteralObject,
     userAggregate: DomainAggregate<UserInterface>,
   ): Promise<UserWithCredentials> {
     const plain: UserWithCredentials = userAggregateToEntity(userAggregate);
@@ -98,7 +111,7 @@ export class RocketsAuthUserPortService {
     const credential = await this.queryBus.execute<
       GetActiveCredentialQuery,
       UserCredentialEntityInterface | null
-    >(new GetActiveCredentialQuery(userAggregate.id));
+    >(new GetActiveCredentialQuery(userAggregate.id, ctx));
 
     if (credential) {
       plain.passwordHash = credential.passwordHash;
diff --git a/packages/rockets-server-auth/src/shared/utils/apply-controller-extras.helper.spec.ts b/packages/rockets-server-auth/src/shared/utils/apply-controller-extras.helper.spec.ts
new file mode 100644
index 000000000..96d1efffc
--- /dev/null
+++ b/packages/rockets-server-auth/src/shared/utils/apply-controller-extras.helper.spec.ts
@@ -0,0 +1,40 @@
+import { describe, expect, it, vi } from 'vitest';
+import { applyControllerExtras } from './apply-controller-extras.helper';
+
+describe('applyControllerExtras', () => {
+  it('applies class and route decorators to a generated controller', () => {
+    const classDecorator = vi.fn((_target: Function) => undefined);
+    const methodDecorator = vi.fn(
+      (
+        _target: object,
+        _propertyKey: string | symbol,
+        _descriptor: PropertyDescriptor,
+      ) => undefined,
+    );
+
+    class TestController {
+      ping(): void {}
+    }
+
+    const descriptor = Object.getOwnPropertyDescriptor(
+      TestController.prototype,
+      'ping',
+    );
+
+    applyControllerExtras(
+      TestController,
+      {
+        classDecorators: [classDecorator],
+        routes: { ping: { decorators: [methodDecorator] } },
+      },
+      { ping: 'ping' },
+    );
+
+    expect(classDecorator).toHaveBeenCalledWith(TestController);
+    expect(methodDecorator).toHaveBeenCalledWith(
+      TestController.prototype,
+      'ping',
+      descriptor,
+    );
+  });
+});
diff --git a/packages/rockets-server-auth/src/shared/utils/apply-controller-extras.helper.ts b/packages/rockets-server-auth/src/shared/utils/apply-controller-extras.helper.ts
index df8a301c0..2a6c4d65c 100644
--- a/packages/rockets-server-auth/src/shared/utils/apply-controller-extras.helper.ts
+++ b/packages/rockets-server-auth/src/shared/utils/apply-controller-extras.helper.ts
@@ -1,30 +1,30 @@
-import { Type } from '@nestjs/common';
-import { RocketsAuthControllerExtrasBase } from '../interfaces/controller/rockets-auth-controller-extras.interface';
+import type { Type } from '@nestjs/common';
+import type {
+  RocketsAuthControllerExtrasBase,
+  RocketsAuthRouteExtrasBase,
+} from '../interfaces/controller/rockets-auth-controller-extras.interface';
 
-/**
- * Apply consumer-supplied class- and per-route decorators to a freshly
- * built controller class. Used by every domain factory in
- * `gateways/http/factories/`.
- *
- * `routeMap` maps the public route key (consumer-facing — `accept`,
- * `revoke`, `changePassword`) to the actual method name on the class.
- */
-export function applyControllerExtras<RouteMap extends Record<string, string>>(
-  controllerClass: Type<unknown>,
-  extras: RocketsAuthControllerExtrasBase<unknown>,
-  routeMap: RouteMap,
+/** Apply consumer class and route decorators to a generated controller. */
+export function applyControllerExtras<
+  ControllerClass extends Type<unknown>,
+  RouteKey extends string,
+>(
+  controllerClass: ControllerClass,
+  extras: RocketsAuthControllerExtrasBase<
+    Partial<Record<RouteKey, RocketsAuthRouteExtrasBase>>
+  >,
+  routeMap: Record<
+    RouteKey,
+    Extract<keyof InstanceType<ControllerClass>, string>
+  >,
 ): void {
   for (const decorator of extras.classDecorators ?? []) {
     decorator(controllerClass);
   }
 
-  const routes =
-    (extras.routes as
-      | Record<string, { decorators?: MethodDecorator[] }>
-      | undefined) ?? {};
-
-  for (const [routeKey, methodName] of Object.entries(routeMap)) {
-    const cfg = routes[routeKey];
+  for (const routeKey in routeMap) {
+    const methodName = routeMap[routeKey];
+    const cfg = extras.routes?.[routeKey];
     if (!cfg?.decorators?.length) continue;
 
     const proto = controllerClass.prototype as Record<string, unknown>;
diff --git a/packages/rockets-server-auth/src/shared/utils/resolve-user-role-names.ts b/packages/rockets-server-auth/src/shared/utils/resolve-user-role-names.ts
index eaf71719e..3121af171 100644
--- a/packages/rockets-server-auth/src/shared/utils/resolve-user-role-names.ts
+++ b/packages/rockets-server-auth/src/shared/utils/resolve-user-role-names.ts
@@ -1,4 +1,5 @@
 import { QueryBus } from '@nestjs/cqrs';
+import type { PlainLiteralObject } from '@nestjs/common';
 import {
   GetAssignedRolesQuery,
   RoleAssignment,
@@ -31,12 +32,13 @@ export interface UserRolesView {
  */
 export async function resolveUserRoles(
   queryBus: QueryBus,
+  ctx: PlainLiteralObject,
   userId: string,
 ): Promise<UserRolesView['userRoles']> {
   const assignments = await queryBus.execute<
     GetAssignedRolesQuery,
     RoleAssignment[]
-  >(new GetAssignedRolesQuery({}, RocketsEntity.userRole, userId));
+  >(new GetAssignedRolesQuery(ctx, RocketsEntity.userRole, userId));
 
   if (!assignments?.length) {
     return [];
@@ -46,7 +48,7 @@ export async function resolveUserRoles(
   const roles = await queryBus.execute<
     RocketsGetRolesByIdsQuery,
     RoleEntityInterface[]
-  >(new RocketsGetRolesByIdsQuery(roleIds));
+  >(new RocketsGetRolesByIdsQuery(ctx, roleIds));
 
   return roles.map((role) => ({ role: { name: role.name } }));
 }
diff --git a/packages/rockets-server-auth/swagger/swagger.json b/packages/rockets-server-auth/swagger/swagger.json
deleted file mode 100644
index 4f4e03361..000000000
--- a/packages/rockets-server-auth/swagger/swagger.json
+++ /dev/null
@@ -1,1982 +0,0 @@
-{
-  "openapi": "3.0.0",
-  "paths": {
-    "/token/password": {
-      "post": {
-        "operationId": "AuthPasswordController_login",
-        "summary": "Authenticate with username/email and password",
-        "description": "Validates credentials and returns authentication tokens on success",
-        "parameters": [],
-        "requestBody": {
-          "required": true,
-          "description": "User credentials",
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RocketsAuthLoginDto"
-              },
-              "examples": {
-                "standard": {
-                  "value": {
-                    "username": "user@example.com",
-                    "password": "StrongP@ssw0rd"
-                  },
-                  "summary": "Standard login request"
-                }
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Authentication successful, tokens provided",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/RocketsAuthJwtResponseDto"
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Invalid credentials or inactive account"
-          }
-        },
-        "tags": [
-          "Authentication"
-        ]
-      }
-    },
-    "/token/refresh": {
-      "post": {
-        "operationId": "AuthTokenRefreshController_refresh",
-        "summary": "Refresh access token",
-        "description": "Generates a new access token using a valid refresh token",
-        "parameters": [],
-        "requestBody": {
-          "required": true,
-          "description": "Refresh token information",
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RocketsAuthRefreshDto"
-              },
-              "examples": {
-                "standard": {
-                  "value": {
-                    "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
-                  },
-                  "summary": "Standard refresh token request"
-                }
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "New access and refresh tokens",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/RocketsAuthJwtResponseDto"
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Invalid or expired refresh token"
-          }
-        },
-        "tags": [
-          "Authentication"
-        ],
-        "security": [
-          {
-            "bearer": []
-          }
-        ]
-      }
-    },
-    "/recovery/login": {
-      "post": {
-        "operationId": "RocketsAuthRecoveryController_recoverLogin",
-        "summary": "Recover username",
-        "description": "Sends an email with the username associated with the provided email address",
-        "parameters": [],
-        "requestBody": {
-          "required": true,
-          "description": "Email address for username recovery",
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RocketsAuthRecoverLoginDto"
-              },
-              "examples": {
-                "standard": {
-                  "value": {
-                    "email": "user@example.com"
-                  },
-                  "summary": "Standard username recovery request"
-                }
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Recovery email sent successfully (returns regardless of whether email exists)"
-          },
-          "400": {
-            "description": "Invalid email format"
-          }
-        },
-        "tags": [
-          "Authentication"
-        ]
-      }
-    },
-    "/recovery/password": {
-      "post": {
-        "operationId": "RocketsAuthRecoveryController_recoverPassword",
-        "summary": "Request password reset",
-        "description": "Sends an email with a password reset link to the provided email address",
-        "parameters": [],
-        "requestBody": {
-          "required": true,
-          "description": "Email address for password reset",
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RocketsAuthRecoverPasswordDto"
-              },
-              "examples": {
-                "standard": {
-                  "value": {
-                    "email": "user@example.com"
-                  },
-                  "summary": "Standard password reset request"
-                }
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Recovery email sent successfully (returns regardless of whether email exists)"
-          },
-          "400": {
-            "description": "Invalid email format"
-          }
-        },
-        "tags": [
-          "Authentication"
-        ]
-      },
-      "patch": {
-        "operationId": "RocketsAuthRecoveryController_updatePassword",
-        "summary": "Reset password",
-        "description": "Updates the user password using a valid recovery passcode",
-        "parameters": [],
-        "requestBody": {
-          "required": true,
-          "description": "Passcode and new password information",
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RocketsAuthUpdatePasswordDto"
-              },
-              "examples": {
-                "standard": {
-                  "value": {
-                    "passcode": "abc123def456",
-                    "newPassword": "NewSecureP@ssw0rd"
-                  },
-                  "summary": "Standard password reset"
-                }
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Password updated successfully"
-          },
-          "400": {
-            "description": "Invalid passcode, password requirements not met, or passcode expired"
-          }
-        },
-        "tags": [
-          "Authentication"
-        ]
-      }
-    },
-    "/recovery/passcode/{passcode}": {
-      "get": {
-        "operationId": "RocketsAuthRecoveryController_validatePasscode",
-        "summary": "Validate recovery passcode",
-        "description": "Checks if the provided passcode is valid and not expired",
-        "parameters": [
-          {
-            "name": "passcode",
-            "required": true,
-            "in": "path",
-            "description": "Recovery passcode to validate",
-            "schema": {
-              "example": "abc123def456",
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Passcode is valid"
-          },
-          "404": {
-            "description": "Passcode is invalid or expired"
-          }
-        },
-        "tags": [
-          "Authentication"
-        ]
-      }
-    },
-    "/otp": {
-      "post": {
-        "operationId": "RocketsAuthOtpController_sendOtp",
-        "summary": "Send OTP to the provided email",
-        "description": "Generates a one-time passcode and sends it to the specified email address",
-        "parameters": [],
-        "requestBody": {
-          "required": true,
-          "description": "Email to receive the OTP",
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RocketsAuthOtpSendDto"
-              },
-              "examples": {
-                "standard": {
-                  "value": {
-                    "email": "user@example.com"
-                  },
-                  "summary": "Standard OTP request"
-                }
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "OTP sent successfully"
-          },
-          "400": {
-            "description": "Invalid email format"
-          }
-        },
-        "tags": [
-          "Authentication"
-        ]
-      },
-      "patch": {
-        "operationId": "RocketsAuthOtpController_confirmOtp",
-        "summary": "Confirm OTP for a given email and passcode",
-        "description": "Validates the OTP passcode for the specified email and returns authentication tokens on success",
-        "parameters": [],
-        "requestBody": {
-          "required": true,
-          "description": "Email and passcode for OTP verification",
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RocketsAuthOtpConfirmDto"
-              },
-              "examples": {
-                "standard": {
-                  "value": {
-                    "email": "user@example.com",
-                    "passcode": "123456"
-                  },
-                  "summary": "Standard OTP confirmation"
-                }
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "OTP confirmed successfully, authentication tokens provided",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/RocketsAuthJwtResponseDto"
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "Invalid email format or missing required fields"
-          },
-          "401": {
-            "description": "Invalid OTP or expired passcode"
-          }
-        },
-        "tags": [
-          "Authentication"
-        ]
-      }
-    },
-    "/oauth/authorize": {
-      "get": {
-        "operationId": "AuthOAuthController_authorize",
-        "parameters": [
-          {
-            "name": "scopes",
-            "required": true,
-            "in": "query",
-            "description": "Space separated list of OAuth scopes to pass on to the provider. Common scopes: email, userMetadata, openid",
-            "schema": {
-              "type": "string",
-              "pattern": "[^ ]+( +[^ ]+)*"
-            }
-          },
-          {
-            "name": "provider",
-            "required": true,
-            "in": "query",
-            "description": "Name of the OAuth provider. Supported providers: google, github, apple",
-            "schema": {
-              "type": "string",
-              "enum": [
-                "google",
-                "github",
-                "apple"
-              ]
-            }
-          }
-        ],
-        "responses": {
-          "302": {
-            "description": "HTTP Redirect to the OAuth identity provider's authorization URL.",
-            "headers": {
-              "Location": {
-                "description": "URL to which the user agent should redirect (or open in a browser for mobile apps).",
-                "schema": {
-                  "type": "string",
-                  "format": "uri"
-                }
-              }
-            }
-          }
-        },
-        "tags": [
-          "Authentication"
-        ]
-      }
-    },
-    "/oauth/callback": {
-      "get": {
-        "operationId": "AuthOAuthController_callback",
-        "parameters": [],
-        "responses": {
-          "200": {
-            "description": "DTO containing an access token and a refresh token.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/AuthenticationJwtResponseDto"
-                }
-              }
-            }
-          }
-        },
-        "tags": [
-          "Authentication"
-        ]
-      },
-      "post": {
-        "operationId": "AuthOAuthController_callbackPost",
-        "parameters": [],
-        "responses": {
-          "200": {
-            "description": "DTO containing an access token and a refresh token.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/AuthenticationJwtResponseDto"
-                }
-              }
-            }
-          }
-        },
-        "tags": [
-          "Authentication"
-        ]
-      }
-    },
-    "/admin/invitations": {
-      "post": {
-        "operationId": "InvitationController_create",
-        "summary": "Create and send invitation (Admin only)",
-        "description": "Creates a new user invitation and sends an email with OTP for acceptance. If email sending fails, the invitation is still returned. Check emailSent field and use POST /admin/invitations/:code/reattempt to retry.",
-        "parameters": [],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RocketsAuthInvitationCreateDto"
-              }
-            }
-          }
-        },
-        "responses": {
-          "201": {
-            "description": "Invitation created. Check emailSent field to verify if email was sent successfully.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/RocketsAuthInvitationResponseDto"
-                }
-              }
-            }
-          }
-        },
-        "tags": [
-          "admin"
-        ],
-        "security": [
-          {
-            "bearer": []
-          }
-        ]
-      }
-    },
-    "/admin/invitations/revoke": {
-      "post": {
-        "operationId": "InvitationRevocationController_revoke",
-        "summary": "Revoke invitations (Admin only)",
-        "description": "Revoke all active invitations for a specific email and category",
-        "parameters": [],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RocketsAuthInvitationRevokeDto"
-              }
-            }
-          }
-        },
-        "responses": {
-          "201": {
-            "description": "Invitations revoked successfully"
-          }
-        },
-        "tags": [
-          "admin"
-        ],
-        "security": [
-          {
-            "bearer": []
-          }
-        ]
-      }
-    },
-    "/admin/invitations/{code}/reattempt": {
-      "post": {
-        "operationId": "InvitationReattemptController_reattempt",
-        "summary": "Re-send invitation email (Admin only)",
-        "description": "Generates a new OTP and re-sends the invitation email",
-        "parameters": [
-          {
-            "name": "code",
-            "required": true,
-            "in": "path",
-            "description": "Invitation code",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "201": {
-            "description": "Invitation email re-sent successfully"
-          }
-        },
-        "tags": [
-          "admin"
-        ],
-        "security": [
-          {
-            "bearer": []
-          }
-        ]
-      }
-    },
-    "/me/password": {
-      "patch": {
-        "operationId": "changeMyPassword",
-        "summary": "Change password",
-        "description": "Allows authenticated user to change their own password by providing current and new password",
-        "parameters": [],
-        "requestBody": {
-          "required": true,
-          "description": "Current and new password",
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RocketsAuthChangePasswordDto"
-              },
-              "examples": {
-                "standard": {
-                  "value": {
-                    "currentPassword": "CurrentP@ssw0rd",
-                    "newPassword": "NewSecureP@ssw0rd"
-                  },
-                  "summary": "Standard password change"
-                }
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Password changed successfully"
-          },
-          "400": {
-            "description": "New password does not meet requirements"
-          },
-          "401": {
-            "description": "Invalid current password or authentication token"
-          }
-        },
-        "tags": [
-          "Me"
-        ],
-        "security": [
-          {
-            "bearer": []
-          }
-        ]
-      }
-    },
-    "/admin/users": {
-      "get": {
-        "operationId": "admin_users_getMany",
-        "summary": "",
-        "parameters": [
-          {
-            "name": "fields",
-            "required": false,
-            "in": "query",
-            "description": "Selects resource fields. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#select\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              }
-            },
-            "style": "form",
-            "explode": false
-          },
-          {
-            "name": "s",
-            "required": false,
-            "in": "query",
-            "description": "Adds search condition. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#search\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "filter",
-            "required": false,
-            "in": "query",
-            "description": "Adds filter condition. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#filter\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              }
-            },
-            "style": "form",
-            "explode": true
-          },
-          {
-            "name": "or",
-            "required": false,
-            "in": "query",
-            "description": "Adds OR condition. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#or\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              }
-            },
-            "style": "form",
-            "explode": true
-          },
-          {
-            "name": "sort",
-            "required": false,
-            "in": "query",
-            "description": "Adds sort by field. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#sort\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              }
-            },
-            "style": "form",
-            "explode": true
-          },
-          {
-            "name": "",
-            "required": false,
-            "in": "query",
-            "description": "Adds relational resources. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#join\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              }
-            },
-            "style": "form",
-            "explode": true
-          },
-          {
-            "name": "limit",
-            "required": false,
-            "in": "query",
-            "description": "Limit amount of resources. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#limit\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "integer"
-            }
-          },
-          {
-            "name": "offset",
-            "required": false,
-            "in": "query",
-            "description": "Offset amount of resources. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#offset\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "integer"
-            }
-          },
-          {
-            "name": "page",
-            "required": false,
-            "in": "query",
-            "description": "Page portion of resources. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#page\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "integer"
-            }
-          },
-          {
-            "name": "cache",
-            "required": false,
-            "in": "query",
-            "description": "Reset cache (if was enabled). <a href=\"https://github.com/nestjsx/crud/wiki/Requests#cache\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 1
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Read-All ExtendedUserDto as paginated response.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PaginatedDto"
-                }
-              }
-            }
-          }
-        },
-        "tags": [
-          "admin"
-        ],
-        "security": [
-          {
-            "bearer": []
-          }
-        ]
-      }
-    },
-    "/admin/users/{id}": {
-      "get": {
-        "operationId": "admin_users_getOne",
-        "summary": "",
-        "parameters": [
-          {
-            "name": "fields",
-            "required": false,
-            "in": "query",
-            "description": "Selects resource fields. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#select\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              }
-            },
-            "style": "form",
-            "explode": false
-          },
-          {
-            "name": "",
-            "required": false,
-            "in": "query",
-            "description": "Adds relational resources. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#join\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              }
-            },
-            "style": "form",
-            "explode": true
-          },
-          {
-            "name": "cache",
-            "required": false,
-            "in": "query",
-            "description": "Reset cache (if was enabled). <a href=\"https://github.com/nestjsx/crud/wiki/Requests#cache\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 1
-            }
-          },
-          {
-            "name": "id",
-            "required": true,
-            "in": "path",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Read-One ExtendedUserDto",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ExtendedUserDto"
-                }
-              }
-            }
-          }
-        },
-        "tags": [
-          "admin"
-        ],
-        "security": [
-          {
-            "bearer": []
-          }
-        ]
-      },
-      "patch": {
-        "operationId": "admin_users_updateOne",
-        "summary": "",
-        "parameters": [
-          {
-            "name": "id",
-            "required": true,
-            "in": "path",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/ExtendedUserUpdateDto"
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Update-One ExtendedUserDto",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ExtendedUserDto"
-                }
-              }
-            }
-          }
-        },
-        "tags": [
-          "admin"
-        ],
-        "security": [
-          {
-            "bearer": []
-          }
-        ]
-      }
-    },
-    "/signup": {
-      "post": {
-        "operationId": "signup_createOne",
-        "summary": "Create a new user account",
-        "description": "Registers a new user in the system with email, username, password and optional metadata",
-        "parameters": [],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/ExtendedUserCreateDto"
-              }
-            }
-          }
-        },
-        "responses": {
-          "201": {
-            "description": "User created successfully",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ExtendedUserDto"
-                }
-              }
-            }
-          }
-        },
-        "tags": [
-          "auth"
-        ]
-      }
-    },
-    "/invitation-acceptance/{code}": {
-      "patch": {
-        "operationId": "InvitationAcceptanceController_accept",
-        "summary": "Accept invitation (Public with OTP)",
-        "description": "Accept an invitation by providing the code and OTP passcode. Include user data in the payload.",
-        "parameters": [
-          {
-            "name": "code",
-            "required": true,
-            "in": "path",
-            "description": "Invitation code from email",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RocketsAuthInvitationAcceptDto"
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Invitation accepted successfully"
-          }
-        },
-        "tags": [
-          "auth"
-        ]
-      }
-    },
-    "/admin/roles/{id}": {
-      "patch": {
-        "operationId": "admin_roles_updateOne",
-        "summary": "",
-        "description": "Updates role information",
-        "parameters": [
-          {
-            "name": "id",
-            "required": true,
-            "in": "path",
-            "description": "Role id",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "required": true,
-          "description": "Role information to update",
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RocketsAuthRoleUpdateDto"
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Role updated successfully",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/RocketsAuthRoleDto"
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "Bad request - Invalid input data"
-          },
-          "401": {
-            "description": "Unauthorized - User not authenticated"
-          }
-        },
-        "tags": [
-          "admin"
-        ],
-        "security": [
-          {
-            "bearer": []
-          }
-        ]
-      },
-      "get": {
-        "operationId": "admin_roles_getOne",
-        "summary": "",
-        "parameters": [
-          {
-            "name": "fields",
-            "required": false,
-            "in": "query",
-            "description": "Selects resource fields. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#select\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              }
-            },
-            "style": "form",
-            "explode": false
-          },
-          {
-            "name": "",
-            "required": false,
-            "in": "query",
-            "description": "Adds relational resources. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#join\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              }
-            },
-            "style": "form",
-            "explode": true
-          },
-          {
-            "name": "cache",
-            "required": false,
-            "in": "query",
-            "description": "Reset cache (if was enabled). <a href=\"https://github.com/nestjsx/crud/wiki/Requests#cache\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 1
-            }
-          },
-          {
-            "name": "id",
-            "required": true,
-            "in": "path",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Read-One RocketsAuthRoleDto",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/RocketsAuthRoleDto"
-                }
-              }
-            }
-          }
-        },
-        "tags": [
-          "admin"
-        ],
-        "security": [
-          {
-            "bearer": []
-          }
-        ]
-      },
-      "delete": {
-        "operationId": "admin_roles_deleteOne",
-        "summary": "",
-        "parameters": [
-          {
-            "name": "id",
-            "required": true,
-            "in": "path",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Delete-One RocketsAuthRoleDto",
-            "content": {
-              "application/json": {
-                "schema": {}
-              }
-            }
-          }
-        },
-        "tags": [
-          "admin"
-        ],
-        "security": [
-          {
-            "bearer": []
-          }
-        ]
-      }
-    },
-    "/admin/roles": {
-      "get": {
-        "operationId": "admin_roles_getMany",
-        "summary": "",
-        "parameters": [
-          {
-            "name": "fields",
-            "required": false,
-            "in": "query",
-            "description": "Selects resource fields. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#select\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              }
-            },
-            "style": "form",
-            "explode": false
-          },
-          {
-            "name": "s",
-            "required": false,
-            "in": "query",
-            "description": "Adds search condition. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#search\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "filter",
-            "required": false,
-            "in": "query",
-            "description": "Adds filter condition. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#filter\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              }
-            },
-            "style": "form",
-            "explode": true
-          },
-          {
-            "name": "or",
-            "required": false,
-            "in": "query",
-            "description": "Adds OR condition. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#or\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              }
-            },
-            "style": "form",
-            "explode": true
-          },
-          {
-            "name": "sort",
-            "required": false,
-            "in": "query",
-            "description": "Adds sort by field. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#sort\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              }
-            },
-            "style": "form",
-            "explode": true
-          },
-          {
-            "name": "",
-            "required": false,
-            "in": "query",
-            "description": "Adds relational resources. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#join\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              }
-            },
-            "style": "form",
-            "explode": true
-          },
-          {
-            "name": "limit",
-            "required": false,
-            "in": "query",
-            "description": "Limit amount of resources. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#limit\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "integer"
-            }
-          },
-          {
-            "name": "offset",
-            "required": false,
-            "in": "query",
-            "description": "Offset amount of resources. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#offset\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "integer"
-            }
-          },
-          {
-            "name": "page",
-            "required": false,
-            "in": "query",
-            "description": "Page portion of resources. <a href=\"https://github.com/nestjsx/crud/wiki/Requests#page\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "integer"
-            }
-          },
-          {
-            "name": "cache",
-            "required": false,
-            "in": "query",
-            "description": "Reset cache (if was enabled). <a href=\"https://github.com/nestjsx/crud/wiki/Requests#cache\" target=\"_blank\">Docs</a>",
-            "schema": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 1
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Read-All RocketsAuthRoleDto as paginated response.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PaginatedDto"
-                }
-              }
-            }
-          }
-        },
-        "tags": [
-          "admin"
-        ],
-        "security": [
-          {
-            "bearer": []
-          }
-        ]
-      },
-      "post": {
-        "operationId": "admin_roles_createOne",
-        "summary": "",
-        "parameters": [],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RocketsAuthRoleCreateDto"
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Create-One RocketsAuthRoleDto",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/RocketsAuthRoleDto"
-                }
-              }
-            }
-          }
-        },
-        "tags": [
-          "admin"
-        ],
-        "security": [
-          {
-            "bearer": []
-          }
-        ]
-      }
-    },
-    "/admin/users/{userId}/roles": {
-      "get": {
-        "operationId": "AdminUserRolesController_list",
-        "summary": "List roles assigned to a user",
-        "parameters": [
-          {
-            "name": "userId",
-            "required": true,
-            "in": "path",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Roles for the user"
-          },
-          "401": {
-            "description": "Unauthorized"
-          }
-        },
-        "tags": [
-          "admin"
-        ],
-        "security": [
-          {
-            "bearer": []
-          }
-        ]
-      },
-      "post": {
-        "operationId": "AdminUserRolesController_assign",
-        "summary": "Assign a role to a user",
-        "parameters": [
-          {
-            "name": "userId",
-            "required": true,
-            "in": "path",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/AdminAssignUserRoleDto"
-              }
-            }
-          }
-        },
-        "responses": {
-          "201": {
-            "description": "Role assigned"
-          },
-          "400": {
-            "description": "Invalid payload"
-          },
-          "401": {
-            "description": "Unauthorized"
-          }
-        },
-        "tags": [
-          "admin"
-        ],
-        "security": [
-          {
-            "bearer": []
-          }
-        ]
-      }
-    }
-  },
-  "info": {
-    "title": "Rockets API",
-    "description": "API documentation for Rockets Server",
-    "version": "1.0",
-    "contact": {
-      "name": "Rockets API Team",
-      "url": "",
-      "email": "api@rockets.dev"
-    },
-    "license": {
-      "name": "BSD-3-Clause",
-      "url": ""
-    }
-  },
-  "tags": [],
-  "servers": [],
-  "components": {
-    "securitySchemes": {
-      "bearer": {
-        "scheme": "bearer",
-        "bearerFormat": "JWT",
-        "type": "http"
-      }
-    },
-    "schemas": {
-      "RocketsAuthLoginDto": {
-        "type": "object",
-        "properties": {
-          "username": {
-            "type": "string",
-            "description": "Username"
-          },
-          "password": {
-            "type": "string",
-            "description": "Password"
-          }
-        },
-        "required": [
-          "username",
-          "password"
-        ]
-      },
-      "RocketsAuthJwtResponseDto": {
-        "type": "object",
-        "properties": {
-          "accessToken": {
-            "type": "string",
-            "description": "JWT access token to use for request authorization."
-          },
-          "refreshToken": {
-            "type": "string",
-            "description": "JWT refresh token to use for obtaining a new access token."
-          }
-        },
-        "required": [
-          "accessToken",
-          "refreshToken"
-        ]
-      },
-      "RocketsAuthRefreshDto": {
-        "type": "object",
-        "properties": {
-          "refreshToken": {
-            "type": "string",
-            "description": "JWT access token to use for request authorization."
-          }
-        },
-        "required": [
-          "refreshToken"
-        ]
-      },
-      "RocketsAuthRecoverLoginDto": {
-        "type": "object",
-        "properties": {
-          "email": {
-            "type": "string",
-            "title": "user email",
-            "description": "Recover email login by providing an email that will receive an username"
-          }
-        },
-        "required": [
-          "email"
-        ]
-      },
-      "RocketsAuthRecoverPasswordDto": {
-        "type": "object",
-        "properties": {
-          "email": {
-            "type": "string",
-            "title": "user email",
-            "description": "Recover email password by providing an email that will receive a password reset link"
-          }
-        },
-        "required": [
-          "email"
-        ]
-      },
-      "RocketsAuthUpdatePasswordDto": {
-        "type": "object",
-        "properties": {
-          "passcode": {
-            "type": "string",
-            "title": "account reset passcode",
-            "description": "Passcode used to reset account password"
-          },
-          "newPassword": {
-            "type": "string",
-            "title": "account new password",
-            "description": "New password account"
-          }
-        },
-        "required": [
-          "passcode",
-          "newPassword"
-        ]
-      },
-      "RocketsAuthOtpSendDto": {
-        "type": "object",
-        "properties": {
-          "email": {
-            "type": "string",
-            "description": "Email to send OTP to",
-            "example": "user@example.com"
-          }
-        },
-        "required": [
-          "email"
-        ]
-      },
-      "RocketsAuthOtpConfirmDto": {
-        "type": "object",
-        "properties": {
-          "email": {
-            "type": "string",
-            "description": "Email associated with the OTP",
-            "example": "user@example.com"
-          },
-          "passcode": {
-            "type": "string",
-            "description": "OTP passcode to verify",
-            "example": "123456"
-          }
-        },
-        "required": [
-          "email",
-          "passcode"
-        ]
-      },
-      "AuthenticationJwtResponseDto": {
-        "type": "object",
-        "properties": {
-          "accessToken": {
-            "type": "string",
-            "description": "JWT access token to use for request authorization."
-          },
-          "refreshToken": {
-            "type": "string",
-            "description": "JWT refresh token to use for obtaining a new access token."
-          }
-        },
-        "required": [
-          "accessToken",
-          "refreshToken"
-        ]
-      },
-      "RocketsAuthInvitationCreateDto": {
-        "type": "object",
-        "properties": {
-          "category": {
-            "type": "string",
-            "description": "Category of invitation that refers the following table name: user, org..."
-          },
-          "constraints": {
-            "type": "object",
-            "title": "Payload",
-            "description": "payload content that will be passed through another module ir order to complete the invitation. This payload will have necessary info to target module complete the invitation e.g. new password or what ever required info. The object not have any strong type defined on purpose because the target moules will have object different signatures"
-          },
-          "email": {
-            "type": "string",
-            "description": "Email that the invitation will be sent to"
-          }
-        },
-        "required": [
-          "category",
-          "email"
-        ]
-      },
-      "RocketsAuthInvitationResponseDto": {
-        "type": "object",
-        "properties": {
-          "dateCreated": {
-            "type": "string",
-            "format": "date-time",
-            "description": "Date created"
-          },
-          "dateUpdated": {
-            "type": "string",
-            "format": "date-time",
-            "description": "Date updated"
-          },
-          "dateDeleted": {
-            "type": "string",
-            "format": "date-time",
-            "description": "Date deleted",
-            "nullable": true
-          },
-          "version": {
-            "type": "number",
-            "description": "Version of the data"
-          },
-          "id": {
-            "type": "string",
-            "description": "Unique identifier"
-          },
-          "active": {
-            "type": "boolean",
-            "description": "True if Invitation is active"
-          },
-          "code": {
-            "type": "string",
-            "description": "Code claim invitation"
-          },
-          "category": {
-            "type": "string",
-            "description": "Category of invitation that refers the following table name: user, org..."
-          },
-          "constraints": {
-            "type": "object",
-            "title": "Payload",
-            "description": "payload content that will be passed through another module ir order to complete the invitation. This payload will have necessary info to target module complete the invitation e.g. new password or what ever required info. The object not have any strong type defined on purpose because the target moules will have object different signatures"
-          },
-          "userId": {
-            "type": "string",
-            "description": "The invited user ID."
-          },
-          "emailSent": {
-            "type": "boolean",
-            "description": "Whether the invitation email was sent successfully",
-            "example": true
-          },
-          "emailError": {
-            "type": "string",
-            "description": "Error message if email sending failed. Use POST /admin/invitations/:code/reattempt to retry.",
-            "example": "SMTP connection timeout"
-          }
-        },
-        "required": [
-          "dateCreated",
-          "dateUpdated",
-          "dateDeleted",
-          "version",
-          "id",
-          "active",
-          "code",
-          "category",
-          "constraints",
-          "userId",
-          "emailSent"
-        ]
-      },
-      "RocketsAuthInvitationRevokeDto": {
-        "type": "object",
-        "properties": {
-          "email": {
-            "type": "string",
-            "description": "Email address to revoke invitations for",
-            "example": "user@example.com"
-          },
-          "category": {
-            "type": "string",
-            "description": "Category of invitations to revoke (implementation-specific, e.g., \"user\", \"admin\")",
-            "example": "user"
-          }
-        },
-        "required": [
-          "email",
-          "category"
-        ]
-      },
-      "RocketsAuthChangePasswordDto": {
-        "type": "object",
-        "properties": {
-          "currentPassword": {
-            "type": "string",
-            "title": "Current Password",
-            "description": "The user current password for verification",
-            "example": "CurrentP@ssw0rd"
-          },
-          "newPassword": {
-            "type": "string",
-            "title": "New Password",
-            "description": "The new password to set (minimum 8 characters)",
-            "example": "NewSecureP@ssw0rd",
-            "minLength": 8
-          }
-        },
-        "required": [
-          "currentPassword",
-          "newPassword"
-        ]
-      },
-      "ExtendedUserMetadataDto": {
-        "type": "object",
-        "properties": {
-          "id": {
-            "type": "string",
-            "description": "Metadata ID"
-          },
-          "userId": {
-            "type": "string",
-            "description": "User ID"
-          },
-          "dateCreated": {
-            "format": "date-time",
-            "type": "string",
-            "description": "Date created"
-          },
-          "dateUpdated": {
-            "format": "date-time",
-            "type": "string",
-            "description": "Date updated"
-          },
-          "dateDeleted": {
-            "type": "object",
-            "description": "Date deleted"
-          },
-          "version": {
-            "type": "number",
-            "description": "Version"
-          },
-          "firstName": {
-            "type": "string",
-            "description": "First name",
-            "minLength": 1,
-            "maxLength": 100
-          },
-          "lastName": {
-            "type": "string",
-            "description": "Last name",
-            "minLength": 1,
-            "maxLength": 100
-          },
-          "bio": {
-            "type": "string",
-            "description": "User bio",
-            "maxLength": 500
-          },
-          "age": {
-            "type": "number",
-            "description": "User age",
-            "minimum": 18
-          }
-        },
-        "required": [
-          "id",
-          "userId",
-          "dateCreated",
-          "dateUpdated",
-          "version"
-        ]
-      },
-      "ExtendedUserDto": {
-        "type": "object",
-        "properties": {
-          "dateCreated": {
-            "type": "string",
-            "format": "date-time",
-            "description": "Date created"
-          },
-          "dateUpdated": {
-            "type": "string",
-            "format": "date-time",
-            "description": "Date updated"
-          },
-          "dateDeleted": {
-            "type": "string",
-            "format": "date-time",
-            "description": "Date deleted",
-            "nullable": true
-          },
-          "version": {
-            "type": "number",
-            "description": "Version of the data"
-          },
-          "id": {
-            "type": "string",
-            "description": "Unique identifier"
-          },
-          "email": {
-            "type": "string",
-            "description": "Email"
-          },
-          "username": {
-            "type": "string",
-            "description": "Username"
-          },
-          "active": {
-            "type": "boolean",
-            "description": "Active"
-          },
-          "userMetadata": {
-            "description": "User metadata containing additional profile information",
-            "allOf": [
-              {
-                "$ref": "#/components/schemas/ExtendedUserMetadataDto"
-              }
-            ]
-          }
-        },
-        "required": [
-          "dateCreated",
-          "dateUpdated",
-          "dateDeleted",
-          "version",
-          "id",
-          "email",
-          "username",
-          "active"
-        ]
-      },
-      "PaginatedDto": {
-        "type": "object",
-        "properties": {
-          "data": {
-            "description": "Array of Roles",
-            "type": "array",
-            "items": {
-              "$ref": "#/components/schemas/RocketsAuthRoleDto"
-            }
-          },
-          "limit": {
-            "type": "number",
-            "description": "Limit number of items"
-          },
-          "count": {
-            "type": "number",
-            "description": "Count of all records"
-          },
-          "total": {
-            "type": "number",
-            "description": "Count of records on current page"
-          },
-          "page": {
-            "type": "number",
-            "description": "Current page number"
-          },
-          "pageCount": {
-            "type": "number",
-            "description": "Total number of pages"
-          }
-        },
-        "required": [
-          "data",
-          "limit",
-          "count",
-          "total",
-          "page",
-          "pageCount"
-        ]
-      },
-      "UserMetadataInputDto": {
-        "type": "object",
-        "properties": {
-          "firstName": {
-            "type": "string",
-            "description": "First name",
-            "minLength": 1,
-            "maxLength": 100
-          },
-          "lastName": {
-            "type": "string",
-            "description": "Last name",
-            "minLength": 1,
-            "maxLength": 100
-          },
-          "bio": {
-            "type": "string",
-            "description": "User bio",
-            "maxLength": 500
-          },
-          "age": {
-            "type": "number",
-            "description": "User age",
-            "minimum": 18
-          }
-        }
-      },
-      "ExtendedUserUpdateDto": {
-        "type": "object",
-        "properties": {
-          "id": {
-            "type": "string",
-            "description": "User ID"
-          },
-          "username": {
-            "type": "string",
-            "description": "Username"
-          },
-          "email": {
-            "type": "string",
-            "description": "Email address"
-          },
-          "active": {
-            "type": "boolean",
-            "description": "Whether the user is active"
-          },
-          "userMetadata": {
-            "description": "User metadata updates",
-            "allOf": [
-              {
-                "$ref": "#/components/schemas/UserMetadataInputDto"
-              }
-            ]
-          }
-        },
-        "required": [
-          "id"
-        ]
-      },
-      "ExtendedUserCreateDto": {
-        "type": "object",
-        "properties": {
-          "email": {
-            "type": "string",
-            "description": "Email"
-          },
-          "username": {
-            "type": "string",
-            "description": "Username"
-          },
-          "active": {
-            "type": "boolean",
-            "description": "Active"
-          },
-          "password": {
-            "type": "string",
-            "description": "Plain text password to set"
-          },
-          "userMetadata": {
-            "description": "Initial user metadata",
-            "allOf": [
-              {
-                "$ref": "#/components/schemas/UserMetadataInputDto"
-              }
-            ]
-          }
-        },
-        "required": [
-          "email",
-          "username",
-          "active",
-          "password"
-        ]
-      },
-      "RocketsAuthInvitationAcceptDto": {
-        "type": "object",
-        "properties": {
-          "passcode": {
-            "type": "string",
-            "title": "passcode activate invitation",
-            "description": "Passcode used to activate account"
-          },
-          "payload": {
-            "type": "object",
-            "title": "Payload",
-            "description": "payload content that will be passed through another module ir order to complete the activation. This payload will have necessary info to target module complete the activation e.g. new password or what ever required info. The object not have any strong type defined on purpose because the target moules will have object different signatures"
-          }
-        },
-        "required": [
-          "passcode"
-        ]
-      },
-      "RocketsAuthRoleUpdateDto": {
-        "type": "object",
-        "properties": {
-          "id": {
-            "type": "string",
-            "description": "Unique identifier"
-          },
-          "name": {
-            "type": "string",
-            "description": "Name of the role"
-          },
-          "description": {
-            "type": "string",
-            "description": "Description of the role"
-          }
-        },
-        "required": [
-          "id"
-        ]
-      },
-      "RocketsAuthRoleDto": {
-        "type": "object",
-        "properties": {
-          "dateCreated": {
-            "type": "string",
-            "format": "date-time",
-            "description": "Date created"
-          },
-          "dateUpdated": {
-            "type": "string",
-            "format": "date-time",
-            "description": "Date updated"
-          },
-          "dateDeleted": {
-            "type": "string",
-            "format": "date-time",
-            "description": "Date deleted",
-            "nullable": true
-          },
-          "version": {
-            "type": "number",
-            "description": "Version of the data"
-          },
-          "id": {
-            "type": "string",
-            "description": "Unique identifier"
-          },
-          "name": {
-            "type": "string",
-            "description": "Name of the role"
-          },
-          "description": {
-            "type": "string",
-            "description": "Description of the role"
-          }
-        },
-        "required": [
-          "dateCreated",
-          "dateUpdated",
-          "dateDeleted",
-          "version",
-          "id",
-          "name",
-          "description"
-        ]
-      },
-      "RocketsAuthRoleCreateDto": {
-        "type": "object",
-        "properties": {
-          "name": {
-            "type": "string",
-            "description": "Name of the role"
-          },
-          "description": {
-            "type": "string",
-            "description": "Description of the role"
-          }
-        },
-        "required": [
-          "name",
-          "description"
-        ]
-      },
-      "AdminAssignUserRoleDto": {
-        "type": "object",
-        "properties": {
-          "roleId": {
-            "type": "string",
-            "description": "Role ID to assign to the user",
-            "example": "08a82592-714e-4da0-ace5-45ed3b4eb795"
-          }
-        },
-        "required": [
-          "roleId"
-        ]
-      }
-    }
-  }
-}
\ No newline at end of file
diff --git a/packages/rockets-server/CHANGELOG.md b/packages/rockets-server/CHANGELOG.md
index 6374cc5e2..51734770e 100644
--- a/packages/rockets-server/CHANGELOG.md
+++ b/packages/rockets-server/CHANGELOG.md
@@ -11,132 +11,34 @@ and this project adheres to
 
 ### Added
 
-- **`RocketsAuthIntegration`** (`ROCKETS_AUTH_INTEGRATION_KIND`,
-  `isRocketsAuthIntegration`) in `@concepta/rockets-core` for bundles
-  returned by `@concepta/rockets-auth` **`defineRocketsAuth()`**.
-
-- **Auth adapter chain** — `auth` in `RocketsModule.forRoot` / `forRootAsync`
-  now accepts an array: `auth: [AdapterA, AdapterB]`. The `AuthServerGuard`
-  iterates the chain and stops on the first conclusive result. Single `Type`
-  inputs continue to work (normalised to a one-element chain).
-
-- **`extractBearerToken(request: AuthRequest): string | null`** exported from
-  `@concepta/rockets-core` (and re-exported from `@concepta/rockets`). Replaces
-  the removed `BearerTokenAuthAdapter` helper.
-
-- **`AUTH_ADAPTERS_TOKEN`** exported from `@concepta/rockets-core`. Injects the
-  full ordered adapter chain as `ReadonlyArray<AuthAdapterInterface>`.
-
-- **`collectAdapters`** and **`resolveAuthChain`** exported from the respective
-  module-definition files for unit-testing.
+- `createServer(definition)`, the canonical launch-facing facade that returns a
+  Nest entry module for direct use with `NestFactory.create()`.
+- `defineAuthAdapter(Adapter, options?)`, a complete host module for custom
+  authentication adapters.
+- Auth integrations can contribute owned resources, user metadata, a root
+  repository, and a default guard preference through `AuthBootstrap`.
+- Executable coverage for direct server launch, ordered multi-credential auth,
+  private-by-default routes, and metadata-free micro apps.
 
 ### Changed
 
-- **`RocketsModule`**: when `extras.auth` is a `RocketsAuthIntegration`, merges
-  `resources` and appends `nestImports` **after**
-  `RocketsCoreModule.forRootAsync` so repository rows exist before
-  `RocketsAuthModule` boots. Merges `userMetadata` /
-  `rocketsDefaults.enableGlobalGuard` from the integration when not set on
-  extras.
-
-- **`AuthAdapterInterface`** — the contract now has a single method
-  `authenticate(request: AuthRequest): Promise<AuthAttemptResult>`.
-  `AuthAttemptResult` is a discriminated union; see below.
-
-- **`AuthAttemptResult.error`** is now `HttpException` instead of
-  `UnauthorizedException`, allowing adapters to return 403 and other status
-  codes.
-
-- **`AuthServerGuard`** now logs every adapter decision at `debug` level and
-  wraps unexpected thrown errors in a generic `401` (details are only emitted to
-  the server-side `Logger`).
-
-- **`authExternallyProvided`** is no longer a user-facing config field. The flag
-  is inferred internally by `resolveAuthChain` based on entry type
-  (`RocketsAuthIntegration` → externally provided; bare `Type` /
-  `AuthFeatureBundle` → auto-registered).
+- `RocketsModule` resolves auth contributions before module registration.
+  Explicit app options win; conflicting integration defaults fail during
+  composition.
+- `userMetadata` is optional. The `/me` controller and default metadata
+  handlers are registered only when a metadata contract exists.
+- Class-wide `@AuthPublic({ classLevel: true })` metadata is honored by
+  `AuthServerGuard`.
+- TypeORM bootstrap ownership moved to
+  `@concepta/rockets-repository-typeorm`; the server no longer depends on
+  TypeORM.
+- Node.js 20 is the minimum supported runtime.
 
 ### Removed
 
-- **`BearerTokenAuthAdapter`** abstract class — use `extractBearerToken` and
-  implement `AuthAdapterInterface` directly.
-
-- **`AUTH_ADAPTER_TOKEN`** (singular) — replaced by `AUTH_ADAPTERS_TOKEN` (the
-  full chain). `RocketsAuthProvider` alias on `@concepta/rockets` is also
-  removed.
-
-- **`AuthorizeUserInterface`** and **`ValidateTokenInterface`** — removed.
-
-### Migration guide
-
-#### Implement `authenticate` instead of `validateToken`
-
-**Before:**
-
-```typescript
-@Injectable()
-export class MyAdapter extends BearerTokenAuthAdapter {
-  async validateToken(token: string): Promise<AuthorizedUser> {
-    const decoded = await verify(token);
-    return {
-      id: decoded.sub,
-      sub: decoded.sub,
-      email: decoded.email,
-      userRoles: [],
-      claims: {},
-    };
-  }
-}
-```
-
-**After:**
-
-```typescript
-import { extractBearerToken } from '@concepta/rockets-core';
-
-@Injectable()
-export class MyAdapter implements AuthAdapterInterface {
-  async authenticate(request: AuthRequest): Promise<AuthAttemptResult> {
-    const token = extractBearerToken(request);
-    if (token === null) return { matched: false };
-
-    try {
-      const decoded = await verify(token);
-      return {
-        matched: true,
-        user: {
-          id: decoded.sub,
-          sub: decoded.sub,
-          email: decoded.email,
-          userRoles: [],
-          claims: {},
-        },
-      };
-    } catch {
-      return {
-        matched: true,
-        error: new UnauthorizedException('Authentication failed'),
-      };
-    }
-  }
-}
-```
-
-#### Replace `AUTH_ADAPTER_TOKEN` with `AUTH_ADAPTERS_TOKEN`
-
-**Before:**
-
-```typescript
-providers: [{ provide: AUTH_ADAPTER_TOKEN, useClass: MyAdapter }];
-```
-
-**After:**
-
-```typescript
-// Remove the manual provider — Rockets registers adapters automatically via
-// the `auth` option. Inject AUTH_ADAPTERS_TOKEN to read the chain.
-const adapters = app.get<AuthAdapterInterface[]>(AUTH_ADAPTERS_TOKEN);
-```
+- The `rockets-swagger` manifest entry. OpenAPI generation belongs to the
+  consumer application because only it owns the complete Nest graph and
+  document settings.
 
 ## [1.0.0-alpha.7] - 2026-02-19
 
diff --git a/packages/rockets-server/README.md b/packages/rockets-server/README.md
index 15cb035d1..b104551e0 100644
--- a/packages/rockets-server/README.md
+++ b/packages/rockets-server/README.md
@@ -7,7 +7,7 @@
 > External-auth NestJS server. One options object → adapter chain, global guard,
 > `/me`, declarative CRUD resources, swagger.
 
-**Status:** stable (`0.0.1-dev.0` on npm, dist-tag `alpha`).
+**Status:** pre-1.0 preview (`0.0.1-dev.0`, npm dist-tag `alpha`).
 
 **Stack context:**
 [Repository README](../../README.md#what-problem-each-layer-solves) — Concepta
@@ -62,7 +62,8 @@ repositories, swagger registration) is re-exported from core.
 ### When NOT to use this package
 
 - You want a **complete built-in auth system** (signup, login, password
-  recovery, OTP, oauth, admin user CRUD) → use `@concepta/rockets-server-auth`.
+  recovery, OTP, invitations, admin user CRUD) → use
+  `@concepta/rockets-auth` alongside this package.
 - You want full composition control (no `/me`, no global guard) → drop to
   `@concepta/rockets-core`.
 
@@ -124,8 +125,9 @@ them directly.
 
 ### Minimal working app
 
-A single CRUD resource (`pets`) and a single JWT adapter. The `auth`,
-`userMetadata`, and `resources` are the three options most apps care about.
+A single CRUD resource (`pets`) and a single JWT adapter. `createServer()` is
+the canonical launch-facing API; it returns a Nest entry module that can be
+passed straight to `NestFactory.create()`.
 
 ```typescript
 // src/auth/jwt.adapter.ts
@@ -135,6 +137,7 @@ import {
   AuthAdapterInterface,
   AuthAttemptResult,
   AuthRequest,
+  defineAuthAdapter,
   extractBearerToken,
 } from '@concepta/rockets';
 
@@ -157,37 +160,38 @@ export class JwtAdapter implements AuthAdapterInterface {
     }
   }
 }
+
+export const jwtAuth = defineAuthAdapter(JwtAdapter);
 ```
 
 ```typescript
-// src/app.module.ts
-import { Module } from '@nestjs/common';
-import { RocketsModule, defineResource } from '@concepta/rockets';
-import { JwtAdapter } from './auth/jwt.adapter';
+// src/server.ts
+import { NestFactory } from '@nestjs/core';
+import { createServer, defineResource } from '@concepta/rockets';
+import { defineTypeOrmRepository } from '@concepta/rockets-repository-typeorm';
+import { jwtAuth } from './auth/jwt.adapter';
 import { PetEntity } from './pet.entity';
 import { UserMetadataEntity } from './user/user-metadata.entity';
 import { UserMetadataCreateDto, UserMetadataUpdateDto } from './user/dto';
-import { defineTypeOrmRepository } from './repository/define-typeorm-repository';
-
-@Module({
-  imports: [
-    RocketsModule.forRoot({
-      auth: JwtAdapter,
-      userMetadata: {
-        entity: UserMetadataEntity,
-        createDto: UserMetadataCreateDto,
-        updateDto: UserMetadataUpdateDto,
-      },
-      repository: defineTypeOrmRepository({
-        type: 'sqlite',
-        database: ':memory:',
-        synchronize: true,
-      }),
-      resources: [defineResource({ entity: PetEntity })],
-    }),
-  ],
-})
-export class AppModule {}
+
+export const server = createServer({
+  auth: jwtAuth,
+  userMetadata: {
+    entity: UserMetadataEntity,
+    createDto: UserMetadataCreateDto,
+    updateDto: UserMetadataUpdateDto,
+  },
+  repository: defineTypeOrmRepository({
+    type: 'sqlite',
+    database: ':memory:',
+    synchronize: true,
+  }),
+  resources: [defineResource({ entity: PetEntity })],
+});
+
+// main.ts
+const app = await NestFactory.create(server);
+await app.listen(3000);
 ```
 
 You now have:
@@ -311,9 +315,7 @@ import { defineModuleResource } from '@concepta/rockets-core';
 
 RocketsModule.forRoot({
   auth: defineFirebaseAuth({
-    forRoot: {
-      firebaseApp: admin.initializeApp({ credential: applicationDefault() }),
-    },
+    firebaseApp: admin.initializeApp({ credential: applicationDefault() }),
     // forRootAsync: { useFactory: resolveFirebaseOptions, inject: [ConfigService] },
   }),
   userMetadata,
@@ -359,15 +361,24 @@ defineModuleResource({
 | **This package**           | `@concepta/rockets`                               | `RocketsModule`, `MeController`, `APP_GUARD` wiring                                     |
 | Built-in identity (path B) | `@concepta/rockets-auth`                          | `defineRocketsAuth()` — **sibling**, not a dependency of this package; apps import both |
 
-Path B:
-`RocketsModule.forRoot({ auth: defineRocketsAuth(...), repository, resources })`.
+Path B: `createServer({ auth: defineRocketsAuth(...), resources })`. The auth
+integration contributes its persistence rows, root repository, metadata
+contract, and guard preference; explicit server options still win.
+
+### `createServer(definition)`
+
+The canonical public facade. It accepts the same static definition as
+`RocketsModule.forRoot()` and returns a Nest `DynamicModule`. Pass it directly
+to `NestFactory.create()` or import it into a larger host module. Use
+`RocketsModule.forRootAsync()` only when the host itself must build the whole
+definition asynchronously.
 
 ### `RocketsModule.forRoot(options)` / `forRootAsync(options)`
 
 | Option              | Type                                               | Required                  | Description                                                                                                              |
 | ------------------- | -------------------------------------------------- | ------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
-| `auth`              | `AuthBootstrap \| ReadonlyArray<AuthBootstrap>`    | yes                       | From `defineFirebaseAuth()`, `defineRocketsAuth()`, or app-local helpers. Pair entity rows on `resources[]`.             |
-| `userMetadata`      | `RocketsUserMetadataConfig`                        | yes when `/me` is enabled | `{ entity, createDto, updateDto, responseDto?, repository? }`. Used by `MeController` and the default metadata handlers. |
+| `auth`              | `AuthBootstrap \| ReadonlyArray<AuthBootstrap>`    | yes                       | From `defineFirebaseAuth()`, `defineRocketsAuth()`, or app-local helpers. Integrations may contribute owned defaults.    |
+| `userMetadata`      | `RocketsUserMetadataConfig`                        | optional                  | When present, mounts `/me` and its metadata handlers. Explicit configuration overrides an auth contribution.            |
 | `repository`        | `RepositoryModuleInterface \| RepositoryBootstrap` | optional                  | Default persistence adapter forwarded to core. Omit if the auth integration registers everything.                        |
 | `resources`         | `ReadonlyArray<ResourceInput>`                     | optional                  | Bundles from `defineResource` / `defineModuleResource` / hand-built `RocketsResourceConfig`.                             |
 | `enableGlobalGuard` | `boolean` (default `true`)                         | optional                  | Set `false` to skip the `APP_GUARD: AuthServerGuard` provider.                                                           |
@@ -416,16 +427,13 @@ Everything most apps need:
   for back-compat).
 - Error helpers: `logAndGetErrorDetails`, `getErrorDetails`, `ErrorDetails`.
 
-### Swagger generation
-
-The package ships a CLI helper to dump the OpenAPI spec to disk:
-
-```bash
-yarn rockets-swagger > swagger.json
-```
+### OpenAPI generation
 
-Driven by the same `RocketsModule` so the spec reflects the running app's
-resources.
+OpenAPI is app-owned because only the application knows its complete entry
+module, global prefixes, and document settings. Build the document from the
+same `server` definition with Nest's `SwaggerModule.createDocument(app,
+config)`. The runnable samples demonstrate both Swagger UI and document
+post-processing; the packages do not expose a misleading standalone CLI.
 
 ---
 
diff --git a/packages/rockets-server/SWAGGER.md b/packages/rockets-server/SWAGGER.md
deleted file mode 100644
index 838a323fa..000000000
--- a/packages/rockets-server/SWAGGER.md
+++ /dev/null
@@ -1,20 +0,0 @@
-# Rockets Server API Documentation
-
-This document describes the API endpoints available in the Rockets Server
-module.
-
-## Base URL
-
-- Development: `http://localhost:3000`
-
-## Endpoints
-
-_Endpoints will be added as the module is extended with specific functionality._
-
-## Authentication
-
-_Authentication details will be added when auth modules are integrated._
-
-## Error Handling
-
-_Error handling details will be added as the module is extended._
diff --git a/packages/rockets-server/package.json b/packages/rockets-server/package.json
index e5a6142e5..ecf540b92 100644
--- a/packages/rockets-server/package.json
+++ b/packages/rockets-server/package.json
@@ -12,12 +12,7 @@
       "require": "./dist/index.js",
       "import": "./dist/index.js"
     },
-    "./package.json": "./package.json",
-    "./typeorm": {
-      "types": "./dist/typeorm.d.ts",
-      "require": "./dist/typeorm.js",
-      "import": "./dist/typeorm.js"
-    }
+    "./package.json": "./package.json"
   },
   "sideEffects": false,
   "publishConfig": {
@@ -45,16 +40,10 @@
     "rest-api"
   ],
   "engines": {
-    "node": ">=18.0.0",
-    "npm": ">=8.0.0"
-  },
-  "bin": {
-    "rockets-swagger": "./bin/generate-swagger.js"
+    "node": ">=20.0.0"
   },
   "files": [
     "dist/**/!(*.spec|*.e2e-spec|*.fixture).{js,d.ts}",
-    "bin/generate-swagger.js",
-    "SWAGGER.md",
     "README.md",
     "LICENSE.txt",
     "CHANGELOG.md"
@@ -68,36 +57,32 @@
     "test:watch": "cd ../.. && ./node_modules/.bin/vitest --project unit packages/rockets-server",
     "test:e2e": "cd ../.. && ./node_modules/.bin/vitest run --project e2e-packages packages/rockets-server",
     "test:e2e:cov": "cd ../.. && ./node_modules/.bin/vitest run --project e2e-packages --coverage packages/rockets-server",
-    "test:cov": "cd ../.. && ./node_modules/.bin/vitest run --project unit --coverage packages/rockets-server",
-    "generate-swagger": "ts-node src/generate-swagger.ts"
+    "test:cov": "cd ../.. && ./node_modules/.bin/vitest run --project unit --coverage packages/rockets-server"
   },
   "dependencies": {
     "@concepta/nestjs-core": "8.0.0-alpha.8",
     "@concepta/rockets-core": "workspace:^",
-    "@concepta/rockets-repository-typeorm": "workspace:^",
     "@nestjs/common": "12.0.0-alpha.5",
     "@nestjs/config": "^4.0.4",
     "@nestjs/core": "12.0.0-alpha.5",
     "@nestjs/cqrs": "^11.0.0",
-    "@nestjs/swagger": "12.0.0-alpha.2",
-    "@nestjs/typeorm": "^11.0.0"
+    "@nestjs/swagger": "12.0.0-alpha.2"
   },
   "devDependencies": {
     "@concepta/nestjs-crud": "8.0.0-alpha.8",
+    "@concepta/rockets-repository-typeorm": "workspace:^",
     "@nestjs/platform-express": "12.0.0-alpha.5",
     "@nestjs/testing": "12.0.0-alpha.5",
     "@nestjs/typeorm": "^11.0.0",
     "@types/supertest": "^6.0.2",
     "sqlite3": "^5.1.6",
     "supertest": "^6.3.4",
-    "ts-node": "^10.9.2",
     "typeorm": "^0.3.31",
     "vitest": "^4.1.10"
   },
   "peerDependencies": {
     "class-transformer": "*",
     "class-validator": "*",
-    "rxjs": "^7.1.0",
-    "typeorm": "^0.3.0"
+    "rxjs": "^7.1.0"
   }
 }
diff --git a/packages/rockets-server/src/__e2e__/create-server.e2e-spec.ts b/packages/rockets-server/src/__e2e__/create-server.e2e-spec.ts
new file mode 100644
index 000000000..bc0ca085b
--- /dev/null
+++ b/packages/rockets-server/src/__e2e__/create-server.e2e-spec.ts
@@ -0,0 +1,108 @@
+import { afterAll, beforeAll, describe, it } from 'vitest';
+import {
+  Controller,
+  Get,
+  INestApplication,
+  Injectable,
+  Req,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { NestFactory } from '@nestjs/core';
+import { ApiOkResponse, ApiTags } from '@nestjs/swagger';
+import request from 'supertest';
+
+import {
+  defineModuleResource,
+  defineAuthAdapter,
+  extractBearerToken,
+  type AuthAdapterInterface,
+  type AuthAttemptResult,
+  type AuthBootstrap,
+  type AuthRequest,
+} from '@concepta/rockets-core';
+import { createServer } from '../create-server';
+
+@Injectable()
+class SharedIdentityAdapter implements AuthAdapterInterface {
+  async authenticate(request: AuthRequest): Promise<AuthAttemptResult> {
+    const token = extractBearerToken(request);
+    if (token === null) return { matched: false };
+    if (token !== 'shared-user-token') {
+      return { matched: true, error: new UnauthorizedException() };
+    }
+    return {
+      matched: true,
+      user: { id: 'user-1', sub: 'user-1', email: 'user@example.com' },
+    };
+  }
+}
+
+@Injectable()
+class ServiceKeyAdapter implements AuthAdapterInterface {
+  async authenticate(request: AuthRequest): Promise<AuthAttemptResult> {
+    const key = request.headers['x-api-key'];
+    if (key === undefined) return { matched: false };
+    if (key !== 'workflow-service-key') {
+      return { matched: true, error: new UnauthorizedException() };
+    }
+    return {
+      matched: true,
+      user: { id: 'service-1', sub: 'service-1', claims: { type: 'service' } },
+    };
+  }
+}
+
+function authBootstrap(
+  adapter: typeof SharedIdentityAdapter | typeof ServiceKeyAdapter,
+): AuthBootstrap {
+  return defineAuthAdapter(adapter);
+}
+
+@Controller('workflow')
+@ApiTags('Workflow')
+class WorkflowController {
+  @Get('actor')
+  @ApiOkResponse({ description: 'The authenticated workflow actor.' })
+  actor(@Req() request: { user?: { id?: string } }): { actorId?: string } {
+    return { actorId: request.user?.id };
+  }
+}
+
+describe('createServer — launch-facing composition (e2e)', () => {
+  let app: INestApplication;
+
+  beforeAll(async () => {
+    const entryModule = createServer({
+      auth: [
+        authBootstrap(SharedIdentityAdapter),
+        authBootstrap(ServiceKeyAdapter),
+      ],
+      resources: [defineModuleResource({ controllers: [WorkflowController] })],
+    });
+
+    app = await NestFactory.create(entryModule, { logger: false });
+    await app.init();
+  });
+
+  afterAll(async () => {
+    await app?.close();
+  });
+
+  it('boots directly from one server definition without user metadata', async () => {
+    await request(app.getHttpServer())
+      .get('/workflow/actor')
+      .set('Authorization', 'Bearer shared-user-token')
+      .expect(200, { actorId: 'user-1' });
+  });
+
+  it('tries auth integrations in order and accepts a service credential fallback', async () => {
+    await request(app.getHttpServer())
+      .get('/workflow/actor')
+      .set('x-api-key', 'workflow-service-key')
+      .expect(200, { actorId: 'service-1' });
+  });
+
+  it('keeps the workflow private by default', async () => {
+    await request(app.getHttpServer()).get('/workflow/actor').expect(401);
+  });
+});
diff --git a/packages/rockets-server/src/create-server.spec.ts b/packages/rockets-server/src/create-server.spec.ts
new file mode 100644
index 000000000..a69059794
--- /dev/null
+++ b/packages/rockets-server/src/create-server.spec.ts
@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest';
+
+import * as Rockets from './index';
+import { RocketsModule } from './rockets.module';
+
+describe('createServer', () => {
+  it('is the canonical server-definition export', () => {
+    expect(
+      (Rockets as unknown as Record<string, unknown>).createServer,
+    ).toBeTypeOf('function');
+  });
+
+  it('materializes a Nest entry module from one Rockets definition', () => {
+    const createServer = (
+      Rockets as unknown as {
+        createServer: (definition: Record<string, unknown>) => {
+          module: unknown;
+        };
+      }
+    ).createServer;
+
+    const entryModule = createServer({
+      enableGlobalGuard: false,
+      disableController: { me: true },
+    });
+
+    expect(entryModule.module).toBe(RocketsModule);
+  });
+});
diff --git a/packages/rockets-server/src/create-server.ts b/packages/rockets-server/src/create-server.ts
new file mode 100644
index 000000000..b07f6c8dc
--- /dev/null
+++ b/packages/rockets-server/src/create-server.ts
@@ -0,0 +1,21 @@
+import type { DynamicModule } from '@nestjs/common';
+
+import { RocketsModule } from './rockets.module';
+import type { RocketsOptions } from './rockets.module-definition';
+
+/** The typed domain definition consumed by {@link createServer}. */
+export type RocketsServerDefinition = RocketsOptions;
+
+/**
+ * Turn one Rockets definition into the Nest entry module for the server.
+ *
+ * The result can be passed directly to `NestFactory.create()` or imported by a
+ * larger host module. `RocketsModule.forRoot()` remains available as the
+ * lower-level registration surface; this is the canonical definition-first
+ * facade used by launchers and platform tooling.
+ */
+export function createServer(
+  definition: RocketsServerDefinition,
+): DynamicModule {
+  return RocketsModule.forRoot(definition);
+}
diff --git a/packages/rockets-server/src/index.ts b/packages/rockets-server/src/index.ts
index fc20f95ff..ff7295952 100644
--- a/packages/rockets-server/src/index.ts
+++ b/packages/rockets-server/src/index.ts
@@ -32,6 +32,7 @@ export {
   Where,
   getDynamicRepositoryToken,
   RepositoryModule,
+  defineAuthAdapter,
   createStubAuthBootstrap,
   AuthUser,
   ActorCtx,
@@ -74,6 +75,7 @@ export type {
   WithActor,
   EntityHookContext,
   RocketsCrudContext,
+  DefineAuthAdapterOptions,
 } from '@concepta/rockets-core';
 
 export { isRepositoryBootstrap } from '@concepta/rockets-core';
@@ -88,6 +90,8 @@ export { ExceptionsFilter } from './infrastructure/filters/exceptions.filter';
 
 // ── Server's own exports ──
 export { RocketsModule } from './rockets.module';
+export { createServer } from './create-server';
+export type { RocketsServerDefinition } from './create-server';
 export type {
   RocketsOptions,
   RocketsAsyncOptions,
@@ -100,7 +104,6 @@ export type {
 } from './infrastructure/config/interfaces/rockets-options-extras.interface';
 export { UserModule } from './user.module';
 export { MeController } from './gateways/http/me.controller';
-export { defineTypeOrmRepository } from './repository/define-typeorm-repository';
 export {
   logAndGetErrorDetails,
   getErrorDetails,
diff --git a/packages/rockets-server/src/rockets.module-definition.spec.ts b/packages/rockets-server/src/rockets.module-definition.spec.ts
index 42b500dca..489fc9c21 100644
--- a/packages/rockets-server/src/rockets.module-definition.spec.ts
+++ b/packages/rockets-server/src/rockets.module-definition.spec.ts
@@ -1,42 +1,97 @@
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, vi } from 'vitest';
 import { APP_GUARD } from '@nestjs/core';
-import { ROCKETS_CORE_SETTINGS_TOKEN } from '@concepta/rockets-core';
+import {
+  RocketsCoreModule,
+  ROCKETS_CORE_SETTINGS_TOKEN,
+  type AuthAdapterInterface,
+  type AuthAttemptResult,
+  type AuthBootstrap,
+  type AuthRequest,
+  type RepositoryModuleInterface,
+  type ResourceInput,
+  type RocketsUserMetadataConfig,
+  type UserMetadataCreatableInterface,
+  type UserMetadataModelUpdatableInterface,
+} from '@concepta/rockets-core';
 import { MeController } from './gateways/http/me.controller';
 import {
   createRocketsControllers,
+  createRocketsImports,
   createRocketsProviders,
   createRocketsExports,
 } from './rockets.module-definition';
-import { RAW_OPTIONS_TOKEN } from './rockets.tokens';
+import {
+  RAW_OPTIONS_TOKEN,
+  ROCKETS_USER_METADATA_DTO_TOKEN,
+} from './rockets.tokens';
+
+class ContributedAuthAdapter implements AuthAdapterInterface {
+  authenticate(_request: AuthRequest): Promise<AuthAttemptResult> {
+    return Promise.resolve({ matched: false });
+  }
+}
+class ContributedMetadataEntity {}
+class ContributedMetadataCreateDto implements UserMetadataCreatableInterface {
+  userId!: string;
+}
+class ContributedMetadataUpdateDto
+  implements UserMetadataModelUpdatableInterface
+{
+  id!: string;
+}
+
+const contributedRepository = {
+  forFeature: vi.fn(),
+} as unknown as RepositoryModuleInterface;
+const contributedResource = {
+  key: 'auth-resource',
+} as unknown as ResourceInput;
+const contributedUserMetadata = {
+  entity: ContributedMetadataEntity,
+  createDto: ContributedMetadataCreateDto,
+  updateDto: ContributedMetadataUpdateDto,
+} as RocketsUserMetadataConfig;
+
+function contributedAuth(
+  overrides: Record<string, unknown> = {},
+): AuthBootstrap {
+  return {
+    adapter: ContributedAuthAdapter,
+    contributes: {
+      repository: contributedRepository,
+      resources: [contributedResource],
+      userMetadata: contributedUserMetadata,
+      enableGlobalGuard: false,
+      ...overrides,
+    },
+  } as AuthBootstrap;
+}
 
 describe('RocketsModuleDefinition', () => {
   describe('createRocketsControllers', () => {
-    it('should return MeController by default when no options provided', () => {
+    it('does not mount /me when no user-metadata contract is provided', () => {
       const result = createRocketsControllers({});
 
-      expect(result).toContain(MeController);
-      expect(result).toHaveLength(1);
+      expect(result).toEqual([]);
     });
 
-    it('should return MeController when extras is empty object', () => {
+    it('does not mount /me for empty extras', () => {
       const result = createRocketsControllers({ extras: {} });
 
-      expect(result).toContain(MeController);
-      expect(result).toHaveLength(1);
+      expect(result).toEqual([]);
     });
 
-    it('should return MeController when disableController is empty object', () => {
+    it('does not mount /me from disableController alone', () => {
       const result = createRocketsControllers({
         extras: { disableController: {} },
       });
 
-      expect(result).toContain(MeController);
-      expect(result).toHaveLength(1);
+      expect(result).toEqual([]);
     });
 
-    it('should return MeController when disableController.me is false', () => {
+    it('mounts /me when user metadata is configured', () => {
       const result = createRocketsControllers({
-        extras: { disableController: { me: false } },
+        extras: { userMetadata: contributedUserMetadata },
       });
 
       expect(result).toContain(MeController);
@@ -45,7 +100,10 @@ describe('RocketsModuleDefinition', () => {
 
     it('should exclude MeController when disableController.me is true', () => {
       const result = createRocketsControllers({
-        extras: { disableController: { me: true } },
+        extras: {
+          disableController: { me: true },
+          userMetadata: contributedUserMetadata,
+        },
       });
 
       expect(result).not.toContain(MeController);
@@ -124,6 +182,84 @@ describe('RocketsModuleDefinition', () => {
       });
       expect(result).toContain(CustomProvider);
     });
+
+    it('uses auth-contributed metadata and guard defaults', () => {
+      const result = createRocketsProviders({
+        extras: { auth: contributedAuth() },
+      });
+      const metadataProvider = result.find(
+        (provider) =>
+          typeof provider === 'object' &&
+          'provide' in provider &&
+          provider.provide === ROCKETS_USER_METADATA_DTO_TOKEN,
+      ) as { useValue: unknown };
+      const guardProvider = result.find(
+        (provider) =>
+          typeof provider === 'object' &&
+          'provide' in provider &&
+          provider.provide === APP_GUARD,
+      );
+
+      expect(metadataProvider.useValue).toEqual({
+        updateDto: ContributedMetadataUpdateDto,
+      });
+      expect(guardProvider).toBeUndefined();
+    });
+  });
+
+  describe('createRocketsImports', () => {
+    it('forwards auth-contributed persistence defaults to core', () => {
+      const forRootAsync = vi
+        .spyOn(RocketsCoreModule, 'forRootAsync')
+        .mockReturnValue({ module: RocketsCoreModule });
+
+      createRocketsImports({
+        imports: [],
+        extras: { auth: contributedAuth() },
+      });
+
+      expect(forRootAsync).toHaveBeenCalledWith(
+        expect.objectContaining({
+          repository: contributedRepository,
+          resources: [contributedResource],
+          userMetadata: contributedUserMetadata,
+        }),
+      );
+      forRootAsync.mockRestore();
+    });
+
+    it('lets explicit app settings override auth defaults while retaining auth resources', () => {
+      const appRepository = {
+        forFeature: vi.fn(),
+      } as unknown as RepositoryModuleInterface;
+      const appResource = { key: 'app-resource' } as unknown as ResourceInput;
+      const appUserMetadata = {
+        ...contributedUserMetadata,
+        updateDto: class AppMetadataUpdateDto extends ContributedMetadataUpdateDto {},
+      };
+      const forRootAsync = vi
+        .spyOn(RocketsCoreModule, 'forRootAsync')
+        .mockReturnValue({ module: RocketsCoreModule });
+
+      createRocketsImports({
+        imports: [],
+        extras: {
+          auth: contributedAuth(),
+          repository: appRepository,
+          resources: [appResource],
+          userMetadata: appUserMetadata,
+        },
+      });
+
+      expect(forRootAsync).toHaveBeenCalledWith(
+        expect.objectContaining({
+          repository: appRepository,
+          resources: [contributedResource, appResource],
+          userMetadata: appUserMetadata,
+        }),
+      );
+      forRootAsync.mockRestore();
+    });
   });
 
   describe('createRocketsExports', () => {
diff --git a/packages/rockets-server/src/rockets.module-definition.ts b/packages/rockets-server/src/rockets.module-definition.ts
index afb57169c..ab02c404a 100644
--- a/packages/rockets-server/src/rockets.module-definition.ts
+++ b/packages/rockets-server/src/rockets.module-definition.ts
@@ -5,7 +5,14 @@ import {
   Provider,
 } from '@nestjs/common';
 import { APP_GUARD } from '@nestjs/core';
-import type { AuthBootstrap } from '@concepta/rockets-core';
+import type {
+  AuthBootstrap,
+  AuthBootstrapContributions,
+  RepositoryBootstrap,
+  RepositoryModuleInterface,
+  ResourceInput,
+  RocketsUserMetadataConfig,
+} from '@concepta/rockets-core';
 import {
   RocketsCoreModule,
   AuthServerGuard,
@@ -40,6 +47,62 @@ export function normalizeAuthBootstraps(
   return [auth];
 }
 
+export interface ResolvedRocketsComposition {
+  readonly auth: ReadonlyArray<AuthBootstrap>;
+  readonly resources: ReadonlyArray<ResourceInput>;
+  readonly userMetadata?: RocketsUserMetadataConfig;
+  readonly repository?: RepositoryModuleInterface | RepositoryBootstrap;
+  readonly enableGlobalGuard?: boolean;
+}
+
+function resolveSingleContribution<
+  Key extends Exclude<keyof AuthBootstrapContributions, 'resources'>,
+>(
+  bootstraps: ReadonlyArray<AuthBootstrap>,
+  key: Key,
+): AuthBootstrapContributions[Key] | undefined {
+  const values = bootstraps
+    .map((bootstrap) => bootstrap.contributes?.[key])
+    .filter(
+      (value): value is NonNullable<AuthBootstrapContributions[Key]> =>
+        value !== undefined,
+    );
+  if (values.length === 0) return undefined;
+
+  const first = values[0];
+  if (values.some((value) => value !== first)) {
+    throw new Error(
+      `RocketsModule: auth integrations contributed conflicting ${String(
+        key,
+      )} defaults. Set extras.${String(
+        key,
+      )} explicitly to resolve the conflict.`,
+    );
+  }
+  return first;
+}
+
+/** Resolve explicit app options and integration-owned defaults. */
+export function resolveRocketsComposition(
+  extras: RocketsOptionsExtrasInterface = {},
+): ResolvedRocketsComposition {
+  const auth = normalizeAuthBootstraps(extras.auth);
+  return {
+    auth,
+    resources: [
+      ...auth.flatMap((bootstrap) => bootstrap.contributes?.resources ?? []),
+      ...(extras.resources ?? []),
+    ],
+    userMetadata:
+      extras.userMetadata ?? resolveSingleContribution(auth, 'userMetadata'),
+    repository:
+      extras.repository ?? resolveSingleContribution(auth, 'repository'),
+    enableGlobalGuard:
+      extras.enableGlobalGuard ??
+      resolveSingleContribution(auth, 'enableGlobalGuard'),
+  };
+}
+
 export const {
   ConfigurableModuleClass: RocketsModuleClass,
   OPTIONS_TYPE: ROCKETS_MODULE_OPTIONS_TYPE,
@@ -92,6 +155,7 @@ export function createRocketsImports(options: {
   imports: NonNullable<DynamicModule['imports']>;
   extras?: RocketsOptionsExtrasInterface;
 }): NonNullable<DynamicModule['imports']> {
+  const composition = resolveRocketsComposition(options.extras);
   return [
     ...options.imports,
     RocketsCoreModule.forRootAsync({
@@ -99,10 +163,10 @@ export function createRocketsImports(options: {
       useFactory: (opts: RocketsOptionsInterface) => ({
         swagger: opts.swagger,
       }),
-      auth: normalizeAuthBootstraps(options.extras?.auth),
-      userMetadata: options.extras?.userMetadata,
-      repository: options.extras?.repository,
-      resources: options.extras?.resources ?? [],
+      auth: composition.auth,
+      userMetadata: composition.userMetadata,
+      repository: composition.repository,
+      resources: composition.resources,
       handlers: options.extras?.handlers,
       accessControl: options.extras?.accessControl,
       global: true,
@@ -119,9 +183,10 @@ export function createRocketsControllers(options: {
   }
 
   const disableController = options.extras?.disableController ?? {};
+  const composition = resolveRocketsComposition(options.extras);
   const controllers: DynamicModule['controllers'] = [];
 
-  if (!disableController.me) {
+  if (composition.userMetadata && !disableController.me) {
     controllers.push(MeController);
   }
 
@@ -156,28 +221,21 @@ export function createRocketsProviders(options: {
   providers?: Provider[];
   extras?: RocketsOptionsExtrasInterface;
 }): Provider[] {
-  const extrasUserMetadata = options.extras?.userMetadata;
+  const composition = resolveRocketsComposition(options.extras);
+  const extrasUserMetadata = composition.userMetadata;
   const providers: Provider[] = [
     ...(options.providers ?? []),
     createRocketsSettingsProvider(),
-    {
-      provide: ROCKETS_USER_METADATA_DTO_TOKEN,
-      useFactory: () => {
-        if (extrasUserMetadata) {
-          return {
-            updateDto: extrasUserMetadata.updateDto,
-          };
-        }
-        throw new Error(
-          'RocketsModule: user-metadata config is required. Set ' +
-            '`extras.userMetadata` to a `RocketsUserMetadataConfig` with `entity`, ' +
-            '`createDto`, and `updateDto`.',
-        );
-      },
-    },
   ];
 
-  if (options.extras?.enableGlobalGuard !== false) {
+  if (extrasUserMetadata) {
+    providers.push({
+      provide: ROCKETS_USER_METADATA_DTO_TOKEN,
+      useValue: { updateDto: extrasUserMetadata.updateDto },
+    });
+  }
+
+  if (composition.enableGlobalGuard !== false) {
     providers.push({
       provide: APP_GUARD,
       useClass: AuthServerGuard,
diff --git a/packages/rockets-server/src/typeorm.ts b/packages/rockets-server/src/typeorm.ts
deleted file mode 100644
index fdb40e56b..000000000
--- a/packages/rockets-server/src/typeorm.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { defineTypeOrmRepository } from './repository/define-typeorm-repository';
diff --git a/packages/rockets-server/tsconfig.json b/packages/rockets-server/tsconfig.json
index 22195f4bb..b6ecbb26f 100644
--- a/packages/rockets-server/tsconfig.json
+++ b/packages/rockets-server/tsconfig.json
@@ -23,7 +23,6 @@
     "src/**/__e2e__/**"
   ],
   "references": [
-    { "path": "../rockets-core" },
-    { "path": "../rockets-repository-typeorm" }
+    { "path": "../rockets-core" }
   ]
 }
diff --git a/scripts/verify-package-artifacts.mjs b/scripts/verify-package-artifacts.mjs
new file mode 100644
index 000000000..78cdc07b9
--- /dev/null
+++ b/scripts/verify-package-artifacts.mjs
@@ -0,0 +1,103 @@
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const packagesRoot = join(repositoryRoot, 'packages');
+const failures = [];
+let checkedArtifacts = 0;
+
+function fail(packageName, message) {
+  failures.push(`${packageName}: ${message}`);
+}
+
+function checkTarget(packageName, packageRoot, label, target) {
+  if (target.includes('/src/') || target.startsWith('./src/')) {
+    fail(packageName, `${label} points at unpublished source: ${target}`);
+    return;
+  }
+
+  const artifact = resolve(packageRoot, target);
+  if (!existsSync(artifact)) {
+    fail(packageName, `${label} target does not exist: ${target}`);
+    return;
+  }
+  checkedArtifacts += 1;
+}
+
+function walkExportTargets(packageName, packageRoot, label, value) {
+  if (typeof value === 'string') {
+    checkTarget(packageName, packageRoot, label, value);
+    return;
+  }
+  if (value === null || typeof value !== 'object') return;
+
+  for (const [condition, target] of Object.entries(value)) {
+    walkExportTargets(
+      packageName,
+      packageRoot,
+      `${label}.${condition}`,
+      target,
+    );
+  }
+}
+
+for (const directory of readdirSync(packagesRoot, { withFileTypes: true })) {
+  if (!directory.isDirectory()) continue;
+  const packageRoot = join(packagesRoot, directory.name);
+  const manifestPath = join(packageRoot, 'package.json');
+  if (!existsSync(manifestPath)) continue;
+
+  const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+  if (manifest.private === true || !manifest.name?.startsWith('@concepta/')) {
+    continue;
+  }
+
+  const nodeEngine = manifest.engines?.node;
+  const minimumMajor = /^>=\s*(\d+)/.exec(nodeEngine ?? '')?.[1];
+  if (minimumMajor === undefined || Number(minimumMajor) < 20) {
+    fail(manifest.name, 'engines.node must declare a minimum of Node.js 20');
+  }
+  if (manifest.publishConfig?.access !== 'public') {
+    fail(manifest.name, 'publishConfig.access must be public');
+  }
+
+  for (const entry of manifest.files ?? []) {
+    if (typeof entry !== 'string' || /[*?!{[]/.test(entry)) continue;
+    checkTarget(manifest.name, packageRoot, 'files', entry);
+  }
+
+  if (typeof manifest.main === 'string') {
+    checkTarget(manifest.name, packageRoot, 'main', manifest.main);
+  } else {
+    fail(manifest.name, 'main is not declared');
+  }
+  if (typeof manifest.types === 'string') {
+    checkTarget(manifest.name, packageRoot, 'types', manifest.types);
+  } else {
+    fail(manifest.name, 'types is not declared');
+  }
+
+  walkExportTargets(manifest.name, packageRoot, 'exports', manifest.exports);
+
+  const bins =
+    typeof manifest.bin === 'string'
+      ? { [manifest.name]: manifest.bin }
+      : (manifest.bin ?? {});
+  for (const [name, target] of Object.entries(bins)) {
+    checkTarget(manifest.name, packageRoot, `bin.${name}`, target);
+    if (typeof target !== 'string') continue;
+    const contents = readFileSync(resolve(packageRoot, target), 'utf8');
+    if (contents.includes('ts-node/register') || contents.includes('../src/')) {
+      fail(manifest.name, `bin.${name} depends on unpublished TypeScript source`);
+    }
+  }
+}
+
+if (failures.length > 0) {
+  console.error('Package artifact verification failed:\n');
+  for (const failure of failures) console.error(`- ${failure}`);
+  process.exitCode = 1;
+} else {
+  console.log(`Verified ${checkedArtifacts} public package artifact targets.`);
+}
diff --git a/vitest.config.ts b/vitest.config.mts
similarity index 88%
rename from vitest.config.ts
rename to vitest.config.mts
index 71a1a7185..240e5be83 100644
--- a/vitest.config.ts
+++ b/vitest.config.mts
@@ -1,5 +1,5 @@
 import { defineConfig, mergeConfig } from 'vitest/config';
-import shared from './vitest.shared';
+import shared from './vitest.shared.mts';
 
 /**
  * Root config: declares every test project (Vitest 4 `projects` model).
@@ -22,7 +22,12 @@ export default defineConfig({
           // projects with different maxWorkers must not share a group.
           sequence: { groupOrder: 0 },
           include: ['packages/**/*.spec.ts'],
-          exclude: ['**/*.e2e-spec.ts', '**/node_modules/**', '**/dist/**'],
+          exclude: [
+            '**/*.e2e-spec.ts',
+            '**/*.emulator-spec.ts',
+            '**/node_modules/**',
+            '**/dist/**',
+          ],
         },
       }),
       mergeConfig(shared, {
@@ -43,9 +48,9 @@ export default defineConfig({
           maxWorkers: 4,
         },
       }),
-      'examples/sample-server/vitest.e2e.config.ts',
-      'examples/sample-server-auth/vitest.e2e.config.ts',
-      'examples/sample-code-review/apps/api/vitest.e2e.config.ts',
+      'examples/sample-server/vitest.e2e.config.mts',
+      'examples/sample-server-auth/vitest.e2e.config.mts',
+      'examples/sample-code-review/apps/api/vitest.e2e.config.mts',
     ],
     coverage: {
       provider: 'v8',
diff --git a/vitest.firestore.config.mts b/vitest.firestore.config.mts
new file mode 100644
index 000000000..74a4a8117
--- /dev/null
+++ b/vitest.firestore.config.mts
@@ -0,0 +1,16 @@
+import { defineConfig, mergeConfig } from 'vitest/config';
+
+import shared from './vitest.shared.mts';
+
+export default mergeConfig(
+  shared,
+  defineConfig({
+    test: {
+      name: 'firestore-emulator',
+      include: ['packages/**/*.emulator-spec.ts'],
+      testTimeout: 30_000,
+      hookTimeout: 30_000,
+      maxWorkers: 1,
+    },
+  }),
+);
diff --git a/vitest.shared.ts b/vitest.shared.mts
similarity index 100%
rename from vitest.shared.ts
rename to vitest.shared.mts
diff --git a/yarn.lock b/yarn.lock
index e8fa009c0..be77854c0 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -50,6 +50,48 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@apidevtools/json-schema-ref-parser@npm:^9.0.3":
+  version: 9.1.2
+  resolution: "@apidevtools/json-schema-ref-parser@npm:9.1.2"
+  dependencies:
+    "@jsdevtools/ono": "npm:^7.1.3"
+    "@types/json-schema": "npm:^7.0.6"
+    call-me-maybe: "npm:^1.0.1"
+    js-yaml: "npm:^4.1.0"
+  checksum: 10c0/ebf952eb2e00bf0919f024e72897e047fd5012f0a9e47ac361873f6de0a733b9334513cdbc73205a6b43ac4a652b8c87f55e489c39b2d60bd0bc1cb2b411e218
+  languageName: node
+  linkType: hard
+
+"@apphosting/build@npm:^0.1.7":
+  version: 0.1.7
+  resolution: "@apphosting/build@npm:0.1.7"
+  dependencies:
+    "@apphosting/common": "npm:^0.0.9"
+    "@npmcli/promise-spawn": "npm:^3.0.0"
+    colorette: "npm:^2.0.20"
+    commander: "npm:^11.1.0"
+    npm-pick-manifest: "npm:^9.0.0"
+    ts-node: "npm:^10.9.1"
+  bin:
+    apphosting-local-build: dist/bin/localbuild.js
+  checksum: 10c0/f4b23c5c4005eb3b2c655fb9c9dc67782935eb2b65c09217f0942e3dcd62bf0f520de6c53216984277bf572c9d49d99a938eb4418d3ade35385eca62b9e571e1
+  languageName: node
+  linkType: hard
+
+"@apphosting/common@npm:^0.0.8":
+  version: 0.0.8
+  resolution: "@apphosting/common@npm:0.0.8"
+  checksum: 10c0/8f0b63c18f181575594858d9125a50ff2c3a0523dc98a14d2834ee164634613c98c42c62a6202cc1215a1143ec07b4e5e8c67844f6bf20d35d8af5f22358bb85
+  languageName: node
+  linkType: hard
+
+"@apphosting/common@npm:^0.0.9":
+  version: 0.0.9
+  resolution: "@apphosting/common@npm:0.0.9"
+  checksum: 10c0/a0a148170b92a1d9037db3027b2ae5231458cc5bf3b861bdb4c10c116a2ddc8651f8056fc1aa8f23077691654825ea3cae90d548584923eb3584a5ac4df5ecb3
+  languageName: node
+  linkType: hard
+
 "@babel/code-frame@npm:^7.0.0, @babel/code-frame@npm:^7.28.6, @babel/code-frame@npm:^7.29.0":
   version: 7.29.0
   resolution: "@babel/code-frame@npm:7.29.0"
@@ -310,6 +352,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@colors/colors@npm:1.6.0, @colors/colors@npm:^1.6.0":
+  version: 1.6.0
+  resolution: "@colors/colors@npm:1.6.0"
+  checksum: 10c0/9328a0778a5b0db243af54455b79a69e3fb21122d6c15ef9e9fcc94881d8d17352d8b2b2590f9bdd46fac5c2d6c1636dcfc14358a20c70e22daf89e1a759b629
+  languageName: node
+  linkType: hard
+
 "@commitlint/cli@npm:^19.4.0":
   version: 19.8.1
   resolution: "@commitlint/cli@npm:19.8.1"
@@ -919,15 +968,12 @@ __metadata:
     reflect-metadata: "npm:^0.1.14"
     sqlite3: "npm:^5.1.4"
     supertest: "npm:^6.3.4"
-    ts-node: "npm:^10.9.2"
     typeorm: "npm:^0.3.31"
     vitest: "npm:^4.1.10"
   peerDependencies:
     class-transformer: "*"
     class-validator: "*"
     rxjs: ^7.1.0
-  bin:
-    rockets-auth-swagger: ./bin/generate-swagger.js
   languageName: unknown
   linkType: soft
 
@@ -1006,6 +1052,7 @@ __metadata:
     zod: "npm:^4.4.3"
   peerDependencies:
     "@nestjs/common": ^12.0.0-alpha.0
+    "@nestjs/typeorm": ^11.0.0
     nestjs-zod: ^5.0.0
     reflect-metadata: ^0.1.13 || ^0.2.0
     typeorm: ^0.3.0
@@ -1037,16 +1084,12 @@ __metadata:
     "@types/supertest": "npm:^6.0.2"
     sqlite3: "npm:^5.1.6"
     supertest: "npm:^6.3.4"
-    ts-node: "npm:^10.9.2"
     typeorm: "npm:^0.3.31"
     vitest: "npm:^4.1.10"
   peerDependencies:
     class-transformer: "*"
     class-validator: "*"
     rxjs: ^7.1.0
-    typeorm: ^0.3.0
-  bin:
-    rockets-swagger: ./bin/generate-swagger.js
   languageName: unknown
   linkType: soft
 
@@ -1059,6 +1102,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@dabh/diagnostics@npm:^2.0.8":
+  version: 2.0.8
+  resolution: "@dabh/diagnostics@npm:2.0.8"
+  dependencies:
+    "@so-ric/colorspace": "npm:^1.1.6"
+    enabled: "npm:2.0.x"
+    kuler: "npm:^2.0.0"
+  checksum: 10c0/64701c272f7de02800039fea99796507670fe5f67d4eb7718599351ec156936efd123fcab7ee18f9d7874939caaacc08e7c7a6bb05ff8cda6d930ad041cc555c
+  languageName: node
+  linkType: hard
+
 "@darraghor/eslint-plugin-nestjs-typed@npm:^3.22.6":
   version: 3.22.6
   resolution: "@darraghor/eslint-plugin-nestjs-typed@npm:3.22.6"
@@ -1075,6 +1129,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@electric-sql/pglite-tools@npm:^0.2.8":
+  version: 0.2.21
+  resolution: "@electric-sql/pglite-tools@npm:0.2.21"
+  peerDependencies:
+    "@electric-sql/pglite": 0.3.16
+  checksum: 10c0/298779988f4485d3ed52ce0739cfe4888e69307e2c82b987074966ade6f7a7a8896242a2007b37ed09872ede6701b66d942e98c571181922c129b18977f817ab
+  languageName: node
+  linkType: hard
+
+"@electric-sql/pglite@npm:^0.3.3":
+  version: 0.3.16
+  resolution: "@electric-sql/pglite@npm:0.3.16"
+  checksum: 10c0/fba05c2f8d225dc19b6582005b06ba1ae806549fea6b88404b0cbc6ee776ae9976f323130f03c5e74baeedf58d3566fd97a521cd7ed26a9f5c524c86c3123e1f
+  languageName: node
+  linkType: hard
+
 "@emnapi/core@npm:^1.10.0":
   version: 1.10.0
   resolution: "@emnapi/core@npm:1.10.0"
@@ -2048,6 +2118,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@google-cloud/cloud-sql-connector@npm:^1.3.3":
+  version: 1.11.3
+  resolution: "@google-cloud/cloud-sql-connector@npm:1.11.3"
+  dependencies:
+    "@googleapis/sqladmin": "npm:^37.0.0"
+    gaxios: "npm:^7.1.4"
+    google-auth-library: "npm:^10.6.2"
+    p-throttle: "npm:^8.1.0"
+  checksum: 10c0/f97266705d5519a1d6052b1f11761c17b759e102f40e9888c483990e0012c7a1d2c519bfb82eccacd7353994c56d947a72e343101003d71ee08c15cd8ba8a6c4
+  languageName: node
+  linkType: hard
+
 "@google-cloud/firestore@npm:^7.11.0, @google-cloud/firestore@npm:^7.7.0":
   version: 7.11.6
   resolution: "@google-cloud/firestore@npm:7.11.6"
@@ -2071,6 +2153,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@google-cloud/paginator@npm:^6.0.0":
+  version: 6.1.0
+  resolution: "@google-cloud/paginator@npm:6.1.0"
+  dependencies:
+    extend: "npm:^3.0.2"
+  checksum: 10c0/0b16cd5a8f13290bebde960aed43f1eaadc6817b52d4ee57cbcafdfd567863d1c8f63e5f93c30cf3871bc71aa24e041f1903b1de014deeb35b341f364955ac8c
+  languageName: node
+  linkType: hard
+
+"@google-cloud/precise-date@npm:^5.0.0":
+  version: 5.2.0
+  resolution: "@google-cloud/precise-date@npm:5.2.0"
+  checksum: 10c0/c61912caa220b4487d7b0863bbce296f8ee42c84b10ec8aa4d1faef648d2b32ea790bc8408d59841b530194b64f3f48d0ae143007852beea57a3fd9eb74517ad
+  languageName: node
+  linkType: hard
+
 "@google-cloud/projectify@npm:^4.0.0":
   version: 4.0.0
   resolution: "@google-cloud/projectify@npm:4.0.0"
@@ -2078,6 +2176,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@google-cloud/projectify@npm:^5.0.0":
+  version: 5.2.0
+  resolution: "@google-cloud/projectify@npm:5.2.0"
+  checksum: 10c0/77fa431a8b68ba88e5ce17e5d50a5db99b1d6b1b26c9f83196038c39ba8d35aad0dcf6788d78ef1bba6cb802c37ecbec83c2a2151ab5687c491a485c54f85674
+  languageName: node
+  linkType: hard
+
 "@google-cloud/promisify@npm:<4.1.0":
   version: 4.0.0
   resolution: "@google-cloud/promisify@npm:4.0.0"
@@ -2085,6 +2190,38 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@google-cloud/promisify@npm:^5.0.0":
+  version: 5.1.0
+  resolution: "@google-cloud/promisify@npm:5.1.0"
+  checksum: 10c0/ed60e724efcd47e35c2a47dd226ea9791b0afcedd963a70f0ac072bbd9e82b72fd06e528242fd505d2de9743178aca76e11e2bea42bd435b020fa8d0f44ee5c2
+  languageName: node
+  linkType: hard
+
+"@google-cloud/pubsub@npm:^5.2.0":
+  version: 5.3.1
+  resolution: "@google-cloud/pubsub@npm:5.3.1"
+  dependencies:
+    "@google-cloud/paginator": "npm:^6.0.0"
+    "@google-cloud/precise-date": "npm:^5.0.0"
+    "@google-cloud/projectify": "npm:^5.0.0"
+    "@google-cloud/promisify": "npm:^5.0.0"
+    "@opentelemetry/api": "npm:~1.9.0"
+    "@opentelemetry/core": "npm:^1.30.1"
+    "@opentelemetry/semantic-conventions": "npm:~1.39.0"
+    arrify: "npm:^2.0.0"
+    extend: "npm:^3.0.2"
+    google-auth-library: "npm:^10.5.0"
+    google-gax: "npm:^5.0.5"
+    google-logging-utils: "npm:^1.1.3"
+    heap-js: "npm:^2.6.0"
+    is-stream-ended: "npm:^0.1.4"
+    lodash.snakecase: "npm:^4.1.1"
+    long: "npm:^5.3.1"
+    p-defer: "npm:^3.0.0"
+  checksum: 10c0/79df3a75c950e93d3ce344d27300dd63fe92d8eff43bbe8e54b6b3c10ec0830ca8e13517035754e5d42ab72d98d70cdb2498ebbbbd7303851f7ee58f2ba951e0
+  languageName: node
+  linkType: hard
+
 "@google-cloud/storage@npm:^7.19.0, @google-cloud/storage@npm:^7.7.0":
   version: 7.19.0
   resolution: "@google-cloud/storage@npm:7.19.0"
@@ -2108,6 +2245,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@googleapis/sqladmin@npm:^37.0.0":
+  version: 37.0.0
+  resolution: "@googleapis/sqladmin@npm:37.0.0"
+  dependencies:
+    googleapis-common: "npm:^8.0.0"
+  checksum: 10c0/60b2521d24c9e2fc45db65cf8f33b08d8c024dddde188549d96d23ce3955e85c74348074f1ea191de89b3c7ac789e59c0cf8b4c0cc77a72892479b675d6cb458
+  languageName: node
+  linkType: hard
+
 "@grpc/grpc-js@npm:^1.10.9":
   version: 1.14.3
   resolution: "@grpc/grpc-js@npm:1.14.3"
@@ -2118,6 +2264,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@grpc/grpc-js@npm:^1.12.6":
+  version: 1.14.4
+  resolution: "@grpc/grpc-js@npm:1.14.4"
+  dependencies:
+    "@grpc/proto-loader": "npm:^0.8.0"
+    "@js-sdsl/ordered-map": "npm:^4.4.2"
+  checksum: 10c0/0ff6395e8112ad30e8f99dbb684b997ebc3264e770b8e354f23effeedf181a380e0ecef8bca466cbbf3e9141968656144851de1da50f840a1efd9314c9812449
+  languageName: node
+  linkType: hard
+
 "@grpc/grpc-js@npm:~1.9.0":
   version: 1.9.15
   resolution: "@grpc/grpc-js@npm:1.9.15"
@@ -2156,6 +2312,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@hono/node-server@npm:^1.19.9 || ^2.0.5":
+  version: 2.1.0
+  resolution: "@hono/node-server@npm:2.1.0"
+  peerDependencies:
+    hono: ^4
+  checksum: 10c0/907aa2cabb804cf6f9c6bc329a898803b0794992d1c2d1bea7e4ae803f5d205fd2733d684c9c87b28338964dc437341e3bee1544b4d504a6b19f9e65ba28b198
+  languageName: node
+  linkType: hard
+
 "@humanwhocodes/config-array@npm:^0.13.0":
   version: 0.13.0
   resolution: "@humanwhocodes/config-array@npm:0.13.0"
@@ -2500,7 +2665,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@inquirer/prompts@npm:7.10.1":
+"@inquirer/prompts@npm:7.10.1, @inquirer/prompts@npm:^7.10.1":
   version: 7.10.1
   resolution: "@inquirer/prompts@npm:7.10.1"
   dependencies:
@@ -2760,6 +2925,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@jsdevtools/ono@npm:^7.1.3":
+  version: 7.1.3
+  resolution: "@jsdevtools/ono@npm:7.1.3"
+  checksum: 10c0/a9f7e3e8e3bc315a34959934a5e2f874c423cf4eae64377d3fc9de0400ed9f36cb5fd5ebce3300d2e8f4085f557c4a8b591427a583729a87841fda46e6c216b9
+  languageName: node
+  linkType: hard
+
 "@lukeed/csprng@npm:^1.0.0":
   version: 1.1.0
   resolution: "@lukeed/csprng@npm:1.1.0"
@@ -2812,6 +2984,39 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@modelcontextprotocol/sdk@npm:^1.24.0":
+  version: 1.30.0
+  resolution: "@modelcontextprotocol/sdk@npm:1.30.0"
+  dependencies:
+    "@hono/node-server": "npm:^1.19.9 || ^2.0.5"
+    ajv: "npm:^8.17.1"
+    ajv-formats: "npm:^3.0.1"
+    content-type: "npm:^1.0.5"
+    cors: "npm:^2.8.5"
+    cross-spawn: "npm:^7.0.5"
+    eventsource: "npm:^3.0.2"
+    eventsource-parser: "npm:^3.0.0"
+    express: "npm:^5.2.1"
+    express-rate-limit: "npm:^8.2.1"
+    hono: "npm:^4.11.4"
+    jose: "npm:^6.1.3"
+    json-schema-typed: "npm:^8.0.2"
+    pkce-challenge: "npm:^5.0.0"
+    raw-body: "npm:^3.0.0"
+    zod: "npm:^3.25 || ^4.0"
+    zod-to-json-schema: "npm:^3.25.1"
+  peerDependencies:
+    "@cfworker/json-schema": ^4.1.1
+    zod: ^3.25 || ^4.0
+  peerDependenciesMeta:
+    "@cfworker/json-schema":
+      optional: true
+    zod:
+      optional: false
+  checksum: 10c0/6d12d5c88048b42b0d64906222f804eecbfc0aae02fc42a200d2438f037276cc7863510a8ce649e82c96d5972f62a58bfbdedf79624b0558a607738f5e58b97e
+  languageName: node
+  linkType: hard
+
 "@napi-rs/wasm-runtime@npm:^1.1.4":
   version: 1.1.4
   resolution: "@napi-rs/wasm-runtime@npm:1.1.4"
@@ -3180,6 +3385,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@npmcli/promise-spawn@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "@npmcli/promise-spawn@npm:3.0.0"
+  dependencies:
+    infer-owner: "npm:^1.0.4"
+  checksum: 10c0/934225972d7b3e456e76b2eae40b3ece2478a361d99aa56c79f65ef7c66aa83cd55330ee44daf43174b76649b25d722b9f85120a4591cac53d884423f315465c
+  languageName: node
+  linkType: hard
+
 "@nuxt/opencollective@npm:0.4.1":
   version: 0.4.1
   resolution: "@nuxt/opencollective@npm:0.4.1"
@@ -3191,13 +3405,38 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@opentelemetry/api@npm:^1.3.0":
+"@opentelemetry/api@npm:^1.3.0, @opentelemetry/api@npm:~1.9.0":
   version: 1.9.1
   resolution: "@opentelemetry/api@npm:1.9.1"
   checksum: 10c0/c608485fc8b5a91e1f7e05e843b45b509307456b31cd2ad365933d90813e40ebfedf179f1451c762037e82d7c76aa8500e95d2da3609f640a1206cde5322cd14
   languageName: node
   linkType: hard
 
+"@opentelemetry/core@npm:^1.30.1":
+  version: 1.30.1
+  resolution: "@opentelemetry/core@npm:1.30.1"
+  dependencies:
+    "@opentelemetry/semantic-conventions": "npm:1.28.0"
+  peerDependencies:
+    "@opentelemetry/api": ">=1.0.0 <1.10.0"
+  checksum: 10c0/4c25ba50a6137c2ba9ca563fb269378f3c9ca6fd1b3f15dbb6eff78eebf5656f281997cbb7be8e51c01649fd6ad091083fcd8a42dd9b5dfac907dc06d7cfa092
+  languageName: node
+  linkType: hard
+
+"@opentelemetry/semantic-conventions@npm:1.28.0":
+  version: 1.28.0
+  resolution: "@opentelemetry/semantic-conventions@npm:1.28.0"
+  checksum: 10c0/deb8a0f744198071e70fea27143cf7c9f7ecb7e4d7b619488c917834ea09b31543c1c2bcea4ec5f3cf68797f0ef3549609c14e859013d9376400ac1499c2b9cb
+  languageName: node
+  linkType: hard
+
+"@opentelemetry/semantic-conventions@npm:~1.39.0":
+  version: 1.39.0
+  resolution: "@opentelemetry/semantic-conventions@npm:1.39.0"
+  checksum: 10c0/1a8cc16e83ccd80aeb910e78146e8cde8482ac45feb3693348eec5983d8ad254f977f2b61db76f043ab0fa6009a27df610a9cff286a217d6cd4c114216861d0f
+  languageName: node
+  linkType: hard
+
 "@oxc-project/types@npm:=0.143.0":
   version: 0.143.0
   resolution: "@oxc-project/types@npm:0.143.0"
@@ -3239,6 +3478,33 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@pnpm/config.env-replace@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "@pnpm/config.env-replace@npm:1.1.0"
+  checksum: 10c0/4cfc4a5c49ab3d0c6a1f196cfd4146374768b0243d441c7de8fa7bd28eaab6290f514b98490472cc65dbd080d34369447b3e9302585e1d5c099befd7c8b5e55f
+  languageName: node
+  linkType: hard
+
+"@pnpm/network.ca-file@npm:^1.0.1":
+  version: 1.0.2
+  resolution: "@pnpm/network.ca-file@npm:1.0.2"
+  dependencies:
+    graceful-fs: "npm:4.2.10"
+  checksum: 10c0/95f6e0e38d047aca3283550719155ce7304ac00d98911e4ab026daedaf640a63bd83e3d13e17c623fa41ac72f3801382ba21260bcce431c14fbbc06430ecb776
+  languageName: node
+  linkType: hard
+
+"@pnpm/npm-conf@npm:^3.0.2":
+  version: 3.0.3
+  resolution: "@pnpm/npm-conf@npm:3.0.3"
+  dependencies:
+    "@pnpm/config.env-replace": "npm:^1.1.0"
+    "@pnpm/network.ca-file": "npm:^1.0.1"
+    config-chain: "npm:^1.1.11"
+  checksum: 10c0/74a276b4acf609edd60300afef3e5c632ecf9f3e9b9da486314edd0478964815f4a03e9c9b1e0cb1f38e2acfef07e5c2d3211527b8f97a0c44cbb040f2755e5c
+  languageName: node
+  linkType: hard
+
 "@protobufjs/aspromise@npm:^1.1.1, @protobufjs/aspromise@npm:^1.1.2":
   version: 1.1.2
   resolution: "@protobufjs/aspromise@npm:1.1.2"
@@ -3267,6 +3533,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@protobufjs/eventemitter@npm:^1.1.1":
+  version: 1.1.1
+  resolution: "@protobufjs/eventemitter@npm:1.1.1"
+  checksum: 10c0/8e06193d4629c5e7c09d4f8c2ddba8fc4dfa739f0149f33a1d901568d35bb7b8b5277a4e8452baf3bdd0b302fd599cf255d193267aa93a0a4747e23cd073c4ac
+  languageName: node
+  linkType: hard
+
 "@protobufjs/fetch@npm:^1.1.1":
   version: 1.1.1
   resolution: "@protobufjs/fetch@npm:1.1.1"
@@ -3642,6 +3915,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@so-ric/colorspace@npm:^1.1.6":
+  version: 1.1.6
+  resolution: "@so-ric/colorspace@npm:1.1.6"
+  dependencies:
+    color: "npm:^5.0.2"
+    text-hex: "npm:1.0.x"
+  checksum: 10c0/f3ad26afefbb8d6101ea7c385cd5f402d4291c2ffc9cabe37030d5fdb8bda980ee534a0d7c250f8233fc3a59b99272410177cd98b219f6b3770f91a0fdb6eb3e
+  languageName: node
+  linkType: hard
+
 "@sqltools/formatter@npm:^1.2.5":
   version: 1.2.5
   resolution: "@sqltools/formatter@npm:1.2.5"
@@ -4003,6 +4286,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@tootallnate/quickjs-emscripten@npm:^0.23.0":
+  version: 0.23.0
+  resolution: "@tootallnate/quickjs-emscripten@npm:0.23.0"
+  checksum: 10c0/2a939b781826fb5fd3edd0f2ec3b321d259d760464cf20611c9877205aaca3ccc0b7304dea68416baa0d568e82cd86b17d29548d1e5139fa3155a4a86a2b4b49
+  languageName: node
+  linkType: hard
+
 "@tsconfig/node10@npm:^1.0.7":
   version: 1.0.12
   resolution: "@tsconfig/node10@npm:1.0.12"
@@ -4215,7 +4505,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@types/json-schema@npm:^7.0.9":
+"@types/json-schema@npm:^7.0.6, @types/json-schema@npm:^7.0.9":
   version: 7.0.15
   resolution: "@types/json-schema@npm:7.0.15"
   checksum: 10c0/a996a745e6c5d60292f36731dd41341339d4eeed8180bb09226e5c8d23759067692b1d88e5d91d72ee83dfc00d3aca8e7bd43ea120516c17922cbcb7c3e252db
@@ -4303,12 +4593,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@types/node@npm:^18.19.44":
-  version: 18.19.130
-  resolution: "@types/node@npm:18.19.130"
+"@types/node@npm:^20.19.0":
+  version: 20.19.43
+  resolution: "@types/node@npm:20.19.43"
   dependencies:
-    undici-types: "npm:~5.26.4"
-  checksum: 10c0/22ba2bc9f8863101a7e90a56aaeba1eb3ebdc51e847cef4a6d188967ab1acbce9b4f92251372fd0329ecb924bbf610509e122c3dfe346c04dbad04013d4ad7d0
+    undici-types: "npm:~6.21.0"
+  checksum: 10c0/9bcec3b5295bdd77ff0b44a528a69f7e22028c347507ba2c69be47ec84e30299f45043b222e9c86c510e138c9c53b2419dd5cd34920602a4a5a381c288075318
   languageName: node
   linkType: hard
 
@@ -4495,6 +4785,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/triple-beam@npm:^1.3.2":
+  version: 1.3.5
+  resolution: "@types/triple-beam@npm:1.3.5"
+  checksum: 10c0/d5d7f25da612f6d79266f4f1bb9c1ef8f1684e9f60abab251e1261170631062b656ba26ff22631f2760caeafd372abc41e64867cde27fba54fafb73a35b9056a
+  languageName: node
+  linkType: hard
+
 "@types/validator@npm:^13.15.3":
   version: 13.15.10
   resolution: "@types/validator@npm:13.15.10"
@@ -4956,6 +5253,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"abbrev@npm:^5.0.0":
+  version: 5.0.0
+  resolution: "abbrev@npm:5.0.0"
+  checksum: 10c0/8e88f5c798ea4562d28c5a3e9ad69e3879890bc5d695d8f2dffb8609be4c890aacc8f80ef4553fdd2c6a62d70c2ce8bc57b38074e383beb7487bdafa9ed42ea5
+  languageName: node
+  linkType: hard
+
 "abort-controller@npm:^3.0.0":
   version: 3.0.0
   resolution: "abort-controller@npm:3.0.0"
@@ -4975,6 +5279,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"accepts@npm:~1.3.8":
+  version: 1.3.8
+  resolution: "accepts@npm:1.3.8"
+  dependencies:
+    mime-types: "npm:~2.1.34"
+    negotiator: "npm:0.6.3"
+  checksum: 10c0/3a35c5f5586cfb9a21163ca47a5f77ac34fa8ceb5d17d2fa2c0d81f41cbd7f8c6fa52c77e2c039acc0f4d09e71abdc51144246900f6bef5e3c4b333f77d89362
+  languageName: node
+  linkType: hard
+
 "accesscontrol@npm:^2.2.1":
   version: 2.2.1
   resolution: "accesscontrol@npm:2.2.1"
@@ -5046,7 +5360,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ajv-formats@npm:3.0.1":
+"ajv-formats@npm:3.0.1, ajv-formats@npm:^3.0.1":
   version: 3.0.1
   resolution: "ajv-formats@npm:3.0.1"
   dependencies:
@@ -5060,6 +5374,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"ajv-formats@npm:^2.1.0":
+  version: 2.1.1
+  resolution: "ajv-formats@npm:2.1.1"
+  dependencies:
+    ajv: "npm:^8.0.0"
+  peerDependencies:
+    ajv: ^8.0.0
+  peerDependenciesMeta:
+    ajv:
+      optional: true
+  checksum: 10c0/e43ba22e91b6a48d96224b83d260d3a3a561b42d391f8d3c6d2c1559f9aa5b253bfb306bc94bbeca1d967c014e15a6efe9a207309e95b3eaae07fcbcdc2af662
+  languageName: node
+  linkType: hard
+
 "ajv@npm:8.18.0, ajv@npm:^8.0.0, ajv@npm:^8.11.0":
   version: 8.18.0
   resolution: "ajv@npm:8.18.0"
@@ -5084,6 +5412,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"ajv@npm:^8.17.1, ajv@npm:^8.3.0":
+  version: 8.20.0
+  resolution: "ajv@npm:8.20.0"
+  dependencies:
+    fast-deep-equal: "npm:^3.1.3"
+    fast-uri: "npm:^3.0.1"
+    json-schema-traverse: "npm:^1.0.0"
+    require-from-string: "npm:^2.0.2"
+  checksum: 10c0/5df9a1c8f83863cde1bd3a9ddb426f599718f88e3dc9153616c79fb28e0be455335830d7f21d745576519f057b371352daa31047b6a33d7036fe08777d60cf2a
+  languageName: node
+  linkType: hard
+
 "ajv@npm:~8.12.0":
   version: 8.12.0
   resolution: "ajv@npm:8.12.0"
@@ -5096,6 +5436,24 @@ __metadata:
   languageName: node
   linkType: hard
 
+"ansi-align@npm:^3.0.0":
+  version: 3.0.1
+  resolution: "ansi-align@npm:3.0.1"
+  dependencies:
+    string-width: "npm:^4.1.0"
+  checksum: 10c0/ad8b755a253a1bc8234eb341e0cec68a857ab18bf97ba2bda529e86f6e30460416523e0ec58c32e5c21f0ca470d779503244892873a5895dbd0c39c788e82467
+  languageName: node
+  linkType: hard
+
+"ansi-escapes@npm:^7.0.0":
+  version: 7.3.0
+  resolution: "ansi-escapes@npm:7.3.0"
+  dependencies:
+    environment: "npm:^1.0.0"
+  checksum: 10c0/068961d99f0ef28b661a4a9f84a5d645df93ccf3b9b93816cc7d46bbe1913321d4cdf156bb842a4e1e4583b7375c631fa963efb43001c4eb7ff9ab8f78fc0679
+  languageName: node
+  linkType: hard
+
 "ansi-regex@npm:^5.0.1":
   version: 5.0.1
   resolution: "ansi-regex@npm:5.0.1"
@@ -5103,7 +5461,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ansi-regex@npm:^6.0.1, ansi-regex@npm:^6.2.2":
+"ansi-regex@npm:^6.0.1, ansi-regex@npm:^6.1.0, ansi-regex@npm:^6.2.2":
   version: 6.2.2
   resolution: "ansi-regex@npm:6.2.2"
   checksum: 10c0/05d4acb1d2f59ab2cf4b794339c7b168890d44dda4bf0ce01152a8da0213aca207802f930442ce8cd22d7a92f44907664aac6508904e75e038fa944d2601b30f
@@ -5147,6 +5505,23 @@ __metadata:
   languageName: node
   linkType: hard
 
+"any-promise@npm:^1.0.0":
+  version: 1.3.0
+  resolution: "any-promise@npm:1.3.0"
+  checksum: 10c0/60f0298ed34c74fef50daab88e8dab786036ed5a7fad02e012ab57e376e0a0b4b29e83b95ea9b5e7d89df762f5f25119b83e00706ecaccb22cfbacee98d74889
+  languageName: node
+  linkType: hard
+
+"anymatch@npm:~3.1.2":
+  version: 3.1.3
+  resolution: "anymatch@npm:3.1.3"
+  dependencies:
+    normalize-path: "npm:^3.0.0"
+    picomatch: "npm:^2.0.4"
+  checksum: 10c0/57b06ae984bc32a0d22592c87384cd88fe4511b1dd7581497831c56d41939c8a001b28e7b853e1450f2bf61992dfcaa8ae2d0d161a0a90c4fb631ef07098fbac
+  languageName: node
+  linkType: hard
+
 "api@workspace:examples/sample-code-review/apps/api":
   version: 0.0.0-use.local
   resolution: "api@workspace:examples/sample-code-review/apps/api"
@@ -5168,7 +5543,7 @@ __metadata:
     "@nestjs/testing": "npm:12.0.0-alpha.5"
     "@nestjs/typeorm": "npm:11.0.3"
     "@swc/core": "npm:^1.15.47"
-    "@types/node": "npm:^18.19.44"
+    "@types/node": "npm:^20.19.0"
     "@types/supertest": "npm:^6.0.2"
     class-transformer: "npm:^0.5.1"
     class-validator: "npm:^0.14.1"
@@ -5209,6 +5584,36 @@ __metadata:
   languageName: node
   linkType: hard
 
+"archiver-utils@npm:^5.0.0, archiver-utils@npm:^5.0.2":
+  version: 5.0.2
+  resolution: "archiver-utils@npm:5.0.2"
+  dependencies:
+    glob: "npm:^10.0.0"
+    graceful-fs: "npm:^4.2.0"
+    is-stream: "npm:^2.0.1"
+    lazystream: "npm:^1.0.0"
+    lodash: "npm:^4.17.15"
+    normalize-path: "npm:^3.0.0"
+    readable-stream: "npm:^4.0.0"
+  checksum: 10c0/3782c5fa9922186aa1a8e41ed0c2867569faa5f15c8e5e6418ea4c1b730b476e21bd68270b3ea457daf459ae23aaea070b2b9f90cf90a59def8dc79b9e4ef538
+  languageName: node
+  linkType: hard
+
+"archiver@npm:^7.0.0":
+  version: 7.0.1
+  resolution: "archiver@npm:7.0.1"
+  dependencies:
+    archiver-utils: "npm:^5.0.2"
+    async: "npm:^3.2.4"
+    buffer-crc32: "npm:^1.0.0"
+    readable-stream: "npm:^4.0.0"
+    readdir-glob: "npm:^1.1.2"
+    tar-stream: "npm:^3.0.0"
+    zip-stream: "npm:^6.0.1"
+  checksum: 10c0/02afd87ca16f6184f752db8e26884e6eff911c476812a0e7f7b26c4beb09f06119807f388a8e26ed2558aa8ba9db28646ebd147a4f99e46813b8b43158e1438e
+  languageName: node
+  linkType: hard
+
 "are-docs-informative@npm:^0.0.2":
   version: 0.0.2
   resolution: "are-docs-informative@npm:0.0.2"
@@ -5260,6 +5665,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"array-flatten@npm:1.1.1":
+  version: 1.1.1
+  resolution: "array-flatten@npm:1.1.1"
+  checksum: 10c0/806966c8abb2f858b08f5324d9d18d7737480610f3bd5d3498aaae6eb5efdc501a884ba019c9b4a8f02ff67002058749d05548fd42fa8643f02c9c7f22198b91
+  languageName: node
+  linkType: hard
+
 "array-ify@npm:^1.0.0":
   version: 1.0.0
   resolution: "array-ify@npm:1.0.0"
@@ -5358,6 +5770,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"as-array@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "as-array@npm:2.0.0"
+  checksum: 10c0/8f7583187d401a6958452acc324104241ad11c385d9f1a995c769f0d3eab6e32277b5a37c3192d490b0729d9cfeb2f35e94efa6ba90dc7178f4c21d0cfede5c1
+  languageName: node
+  linkType: hard
+
 "asap@npm:^2.0.0":
   version: 2.0.6
   resolution: "asap@npm:2.0.6"
@@ -5372,6 +5791,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"ast-types@npm:^0.13.4":
+  version: 0.13.4
+  resolution: "ast-types@npm:0.13.4"
+  dependencies:
+    tslib: "npm:^2.0.1"
+  checksum: 10c0/3a1a409764faa1471601a0ad01b3aa699292991aa9c8a30c7717002cabdf5d98008e7b53ae61f6e058f757fc6ba965e147967a93c13e62692c907d79cfb245f8
+  languageName: node
+  linkType: hard
+
 "ast-v8-to-istanbul@npm:^1.0.0":
   version: 1.0.5
   resolution: "ast-v8-to-istanbul@npm:1.0.5"
@@ -5397,6 +5825,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"async-lock@npm:1.4.1":
+  version: 1.4.1
+  resolution: "async-lock@npm:1.4.1"
+  checksum: 10c0/f696991c7d894af1dc91abc81cc4f14b3785190a35afb1646d8ab91138238d55cabd83bfdd56c42663a008d72b3dc39493ff83797e550effc577d1ccbde254af
+  languageName: node
+  linkType: hard
+
 "async-retry@npm:^1.3.3":
   version: 1.3.3
   resolution: "async-retry@npm:1.3.3"
@@ -5406,6 +5841,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"async@npm:^3.2.3, async@npm:^3.2.4, async@npm:^3.2.6":
+  version: 3.2.6
+  resolution: "async@npm:3.2.6"
+  checksum: 10c0/36484bb15ceddf07078688d95e27076379cc2f87b10c03b6dd8a83e89475a3c8df5848859dd06a4c95af1e4c16fc973de0171a77f18ea00be899aca2a4f85e70
+  languageName: node
+  linkType: hard
+
 "asynckit@npm:^0.4.0":
   version: 0.4.0
   resolution: "asynckit@npm:0.4.0"
@@ -5422,6 +5864,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"b4a@npm:^1.6.4, b4a@npm:^1.8.1":
+  version: 1.8.1
+  resolution: "b4a@npm:1.8.1"
+  peerDependencies:
+    react-native-b4a: "*"
+  peerDependenciesMeta:
+    react-native-b4a:
+      optional: true
+  checksum: 10c0/344d8c94b244ec7a9cb516ea43a98216312454cb72478e4b7628a679ee343be237564c53bbe73995ab10ea9bc923b420236081b180b3cf78fd0c945bfc886798
+  languageName: node
+  linkType: hard
+
 "balanced-match@npm:^4.0.2":
   version: 4.0.2
   resolution: "balanced-match@npm:4.0.2"
@@ -5431,39 +5885,139 @@ __metadata:
   languageName: node
   linkType: hard
 
-"base64-js@npm:^1.3.0, base64-js@npm:^1.3.1":
-  version: 1.5.1
-  resolution: "base64-js@npm:1.5.1"
-  checksum: 10c0/f23823513b63173a001030fae4f2dabe283b99a9d324ade3ad3d148e218134676f1ee8568c877cd79ec1c53158dcf2d2ba527a97c606618928ba99dd930102bf
+"bare-events@npm:^2.5.4, bare-events@npm:^2.7.0":
+  version: 2.9.1
+  resolution: "bare-events@npm:2.9.1"
+  peerDependencies:
+    bare-abort-controller: "*"
+  peerDependenciesMeta:
+    bare-abort-controller:
+      optional: true
+  checksum: 10c0/576fba522bdd2167f35e86791e6c881fdaaf542aa5fca0acfaf8fac7a2c0789340f1cafa0b63e216808efb5cc710887c0cf683f1783293bf98a215d8555ecc36
   languageName: node
   linkType: hard
 
-"baseline-browser-mapping@npm:^2.9.0":
-  version: 2.9.19
-  resolution: "baseline-browser-mapping@npm:2.9.19"
-  bin:
-    baseline-browser-mapping: dist/cli.js
-  checksum: 10c0/569928db78bcd081953d7db79e4243a59a579a34b4ae1806b9b42d3b7f84e5bc40e6e82ae4fa06e7bef8291bf747b33b3f9ef5d3c6e1e420cb129d9295536129
+"bare-fs@npm:^4.5.5":
+  version: 4.8.0
+  resolution: "bare-fs@npm:4.8.0"
+  dependencies:
+    bare-events: "npm:^2.5.4"
+    bare-path: "npm:^3.0.0"
+    bare-stream: "npm:^2.6.4"
+    bare-url: "npm:^2.2.2"
+    fast-fifo: "npm:^1.3.2"
+  peerDependencies:
+    bare-buffer: "*"
+  peerDependenciesMeta:
+    bare-buffer:
+      optional: true
+  checksum: 10c0/27e3361b8b2129770e21043ccedd28881d052b38b33d2e909f63484875dc52556aaa514e072ff2172d8372c81447719a9018f28d2f74ce5e1f93cc7aa5df7971
   languageName: node
   linkType: hard
 
-"bcrypt@npm:^5.1.1":
-  version: 5.1.1
-  resolution: "bcrypt@npm:5.1.1"
-  dependencies:
-    "@mapbox/node-pre-gyp": "npm:^1.0.11"
-    node-addon-api: "npm:^5.0.0"
-  checksum: 10c0/743231158c866bddc46f25eb8e9617fe38bc1a6f5f3052aba35e361d349b7f8fb80e96b45c48a4c23c45c29967ccd11c81cf31166454fc0ab019801c336cab40
+"bare-path@npm:^3.0.0":
+  version: 3.1.1
+  resolution: "bare-path@npm:3.1.1"
+  checksum: 10c0/833f0fe2df164e518878b9c71646228d7841c2e35bd3fc428e432b512317ce7fdbd2a127649366f34db3312778d12a83f2fff5485004bbbdcdd15975fce73f4c
   languageName: node
   linkType: hard
 
-"bignumber.js@npm:^9.0.0":
-  version: 9.3.1
-  resolution: "bignumber.js@npm:9.3.1"
+"bare-stream@npm:^2.6.4":
+  version: 2.13.3
+  resolution: "bare-stream@npm:2.13.3"
+  dependencies:
+    b4a: "npm:^1.8.1"
+    streamx: "npm:^2.25.0"
+    teex: "npm:^1.0.1"
+  peerDependencies:
+    bare-abort-controller: "*"
+    bare-buffer: "*"
+    bare-events: "*"
+  peerDependenciesMeta:
+    bare-abort-controller:
+      optional: true
+    bare-buffer:
+      optional: true
+    bare-events:
+      optional: true
+  checksum: 10c0/1867ca2e89042a7a9c53e8415a0be6e958bdc7231bc0858a793ec35614419eb6e57ad7a27db2de3dc75a799f7432494e27029b3805eee53693629ff64cae16c9
+  languageName: node
+  linkType: hard
+
+"bare-url@npm:^2.2.2":
+  version: 2.5.1
+  resolution: "bare-url@npm:2.5.1"
+  dependencies:
+    bare-path: "npm:^3.0.0"
+  checksum: 10c0/ed28e8c8b022f6180fbd6ee8b90c46022a00991bc82216fa90d48c328161450dda1cab7f328402ca2d23e68eba71884ebdb48e897e8bcbf2d1d02ed414e8a2be
+  languageName: node
+  linkType: hard
+
+"base64-js@npm:^1.3.0, base64-js@npm:^1.3.1":
+  version: 1.5.1
+  resolution: "base64-js@npm:1.5.1"
+  checksum: 10c0/f23823513b63173a001030fae4f2dabe283b99a9d324ade3ad3d148e218134676f1ee8568c877cd79ec1c53158dcf2d2ba527a97c606618928ba99dd930102bf
+  languageName: node
+  linkType: hard
+
+"baseline-browser-mapping@npm:^2.9.0":
+  version: 2.9.19
+  resolution: "baseline-browser-mapping@npm:2.9.19"
+  bin:
+    baseline-browser-mapping: dist/cli.js
+  checksum: 10c0/569928db78bcd081953d7db79e4243a59a579a34b4ae1806b9b42d3b7f84e5bc40e6e82ae4fa06e7bef8291bf747b33b3f9ef5d3c6e1e420cb129d9295536129
+  languageName: node
+  linkType: hard
+
+"basic-auth-connect@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "basic-auth-connect@npm:1.1.0"
+  dependencies:
+    tsscmp: "npm:^1.0.6"
+  checksum: 10c0/bd229e1339d9025c6cd08371860160072c97eb0323b79330daae51ef4d7fe9768b46c730779516d835ceb3f6295bc1fd73594100cc295dc2d0405724cdc3a7e6
+  languageName: node
+  linkType: hard
+
+"basic-auth@npm:~2.0.1":
+  version: 2.0.1
+  resolution: "basic-auth@npm:2.0.1"
+  dependencies:
+    safe-buffer: "npm:5.1.2"
+  checksum: 10c0/05f56db3a0fc31c89c86b605231e32ee143fb6ae38dc60616bc0970ae6a0f034172def99e69d3aed0e2c9e7cac84e2d63bc51a0b5ff6ab5fc8808cc8b29923c1
+  languageName: node
+  linkType: hard
+
+"basic-ftp@npm:^5.0.2":
+  version: 5.3.1
+  resolution: "basic-ftp@npm:5.3.1"
+  checksum: 10c0/03511b488cd292abfa82a8c0ea3b9573b40d12d2f1518d6f41a9461b012b3376d3e6d50679b38d9b2b4f48fd6e8e0418ac196312ee7e2da13cb801169940d1c3
+  languageName: node
+  linkType: hard
+
+"bcrypt@npm:^5.1.1":
+  version: 5.1.1
+  resolution: "bcrypt@npm:5.1.1"
+  dependencies:
+    "@mapbox/node-pre-gyp": "npm:^1.0.11"
+    node-addon-api: "npm:^5.0.0"
+  checksum: 10c0/743231158c866bddc46f25eb8e9617fe38bc1a6f5f3052aba35e361d349b7f8fb80e96b45c48a4c23c45c29967ccd11c81cf31166454fc0ab019801c336cab40
+  languageName: node
+  linkType: hard
+
+"bignumber.js@npm:^9.0.0":
+  version: 9.3.1
+  resolution: "bignumber.js@npm:9.3.1"
   checksum: 10c0/61342ba5fe1c10887f0ecf5be02ff6709271481aff48631f86b4d37d55a99b87ce441cfd54df3d16d10ee07ceab7e272fc0be430c657ffafbbbf7b7d631efb75
   languageName: node
   linkType: hard
 
+"binary-extensions@npm:^2.0.0":
+  version: 2.3.0
+  resolution: "binary-extensions@npm:2.3.0"
+  checksum: 10c0/75a59cafc10fb12a11d510e77110c6c7ae3f4ca22463d52487709ca7f18f69d886aa387557cc9864fbdb10153d0bdb4caacabf11541f55e89ed6e18d12ece2b5
+  languageName: node
+  linkType: hard
+
 "bindings@npm:^1.5.0":
   version: 1.5.0
   resolution: "bindings@npm:1.5.0"
@@ -5473,7 +6027,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"bl@npm:^4.0.3":
+"bl@npm:^4.0.3, bl@npm:^4.1.0":
   version: 4.1.0
   resolution: "bl@npm:4.1.0"
   dependencies:
@@ -5484,6 +6038,26 @@ __metadata:
   languageName: node
   linkType: hard
 
+"body-parser@npm:^1.18.3, body-parser@npm:^1.19.0, body-parser@npm:~1.20.5":
+  version: 1.20.6
+  resolution: "body-parser@npm:1.20.6"
+  dependencies:
+    bytes: "npm:~3.1.2"
+    content-type: "npm:~1.0.5"
+    debug: "npm:2.6.9"
+    depd: "npm:2.0.0"
+    destroy: "npm:~1.2.0"
+    http-errors: "npm:~2.0.1"
+    iconv-lite: "npm:~0.4.24"
+    on-finished: "npm:~2.4.1"
+    qs: "npm:~6.15.1"
+    raw-body: "npm:~2.5.3"
+    type-is: "npm:~1.6.18"
+    unpipe: "npm:~1.0.0"
+  checksum: 10c0/ad477209f1e714c41fa892a7d2fe22e10b23262103cc25cc6492dd3e6f7869cd2d8b00928b543a1a14d3c3663432452a192efd00422fad6f3687b0e38f7e3b07
+  languageName: node
+  linkType: hard
+
 "body-parser@npm:^2.2.1":
   version: 2.3.0
   resolution: "body-parser@npm:2.3.0"
@@ -5501,6 +6075,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"boxen@npm:^5.0.0":
+  version: 5.1.2
+  resolution: "boxen@npm:5.1.2"
+  dependencies:
+    ansi-align: "npm:^3.0.0"
+    camelcase: "npm:^6.2.0"
+    chalk: "npm:^4.1.0"
+    cli-boxes: "npm:^2.2.1"
+    string-width: "npm:^4.2.2"
+    type-fest: "npm:^0.20.2"
+    widest-line: "npm:^3.1.0"
+    wrap-ansi: "npm:^7.0.0"
+  checksum: 10c0/71f31c2eb3dcacd5fce524ae509e0cc90421752e0bfbd0281fd3352871d106c462a0f810c85f2fdb02f3a9fab2d7a84e9718b4999384d651b76104ebe5d2c024
+  languageName: node
+  linkType: hard
+
 "brace-expansion@npm:5.0.8":
   version: 5.0.8
   resolution: "brace-expansion@npm:5.0.8"
@@ -5519,7 +6109,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"braces@npm:^3.0.3":
+"braces@npm:^3.0.3, braces@npm:~3.0.2":
   version: 3.0.3
   resolution: "braces@npm:3.0.3"
   dependencies:
@@ -5543,6 +6133,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"buffer-crc32@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "buffer-crc32@npm:1.0.0"
+  checksum: 10c0/8b86e161cee4bb48d5fa622cbae4c18f25e4857e5203b89e23de59e627ab26beb82d9d7999f2b8de02580165f61f83f997beaf02980cdf06affd175b651921ab
+  languageName: node
+  linkType: hard
+
 "buffer-equal-constant-time@npm:^1.0.1":
   version: 1.0.1
   resolution: "buffer-equal-constant-time@npm:1.0.1"
@@ -5586,7 +6183,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"bytes@npm:^3.1.2, bytes@npm:~3.1.2":
+"bytes@npm:3.1.2, bytes@npm:^3.1.2, bytes@npm:~3.1.2":
   version: 3.1.2
   resolution: "bytes@npm:3.1.2"
   checksum: 10c0/76d1c43cbd602794ad8ad2ae94095cddeb1de78c5dddaa7005c51af10b0176c69971a6d88e805a90c2b6550d76636e43c40d8427a808b8645ede885de4a0358e
@@ -5670,6 +6267,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"call-me-maybe@npm:^1.0.1":
+  version: 1.0.2
+  resolution: "call-me-maybe@npm:1.0.2"
+  checksum: 10c0/8eff5dbb61141ebb236ed71b4e9549e488bcb5451c48c11e5667d5c75b0532303788a1101e6978cafa2d0c8c1a727805599c2741e3e0982855c9f1d78cd06c9f
+  languageName: node
+  linkType: hard
+
 "callsites@npm:^3.0.0":
   version: 3.1.0
   resolution: "callsites@npm:3.1.0"
@@ -5677,6 +6281,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"camelcase@npm:^6.2.0":
+  version: 6.3.0
+  resolution: "camelcase@npm:6.3.0"
+  checksum: 10c0/0d701658219bd3116d12da3eab31acddb3f9440790c0792e0d398f0a520a6a4058018e546862b6fba89d7ae990efaeb97da71e1913e9ebf5a8b5621a3d55c710
+  languageName: node
+  linkType: hard
+
 "caniuse-lite@npm:^1.0.30001759":
   version: 1.0.30001770
   resolution: "caniuse-lite@npm:1.0.30001770"
@@ -5701,7 +6312,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"chalk@npm:^5.3.0, chalk@npm:^5.6.2":
+"chalk@npm:^5.3.0, chalk@npm:^5.4.1, chalk@npm:^5.6.2":
   version: 5.6.2
   resolution: "chalk@npm:5.6.2"
   checksum: 10c0/99a4b0f0e7991796b1e7e3f52dceb9137cae2a9dfc8fc0784a550dc4c558e15ab32ed70b14b21b52beb2679b4892b41a0aa44249bcb996f01e125d58477c6976
@@ -5731,6 +6342,25 @@ __metadata:
   languageName: node
   linkType: hard
 
+"chokidar@npm:^3.6.0":
+  version: 3.6.0
+  resolution: "chokidar@npm:3.6.0"
+  dependencies:
+    anymatch: "npm:~3.1.2"
+    braces: "npm:~3.0.2"
+    fsevents: "npm:~2.3.2"
+    glob-parent: "npm:~5.1.2"
+    is-binary-path: "npm:~2.1.0"
+    is-glob: "npm:~4.0.1"
+    normalize-path: "npm:~3.0.0"
+    readdirp: "npm:~3.6.0"
+  dependenciesMeta:
+    fsevents:
+      optional: true
+  checksum: 10c0/8361dcd013f2ddbe260eacb1f3cb2f2c6f2b0ad118708a343a5ed8158941a39cb8fb1d272e0f389712e74ee90ce8ba864eece9e0e62b9705cb468a2f6d917462
+  languageName: node
+  linkType: hard
+
 "chownr@npm:^1.1.1":
   version: 1.1.4
   resolution: "chownr@npm:1.1.4"
@@ -5752,6 +6382,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"ci-info@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "ci-info@npm:2.0.0"
+  checksum: 10c0/8c5fa3830a2bcee2b53c2e5018226f0141db9ec9f7b1e27a5c57db5512332cde8a0beb769bcbaf0d8775a78afbf2bb841928feca4ea6219638a5b088f9884b46
+  languageName: node
+  linkType: hard
+
 "ci-info@npm:^3.7.0":
   version: 3.9.0
   resolution: "ci-info@npm:3.9.0"
@@ -5759,6 +6396,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"cjson@npm:^0.3.1":
+  version: 0.3.3
+  resolution: "cjson@npm:0.3.3"
+  dependencies:
+    json-parse-helpfulerror: "npm:^1.0.3"
+  checksum: 10c0/a753f1ace13feecbf685f05d461d202c900dbe027993987f8bd28f4fce1b65d414fad6f9d2e2c88107c4743dc5ac0a8c608c32d06ceee2bf9f59869942f2b0c3
+  languageName: node
+  linkType: hard
+
 "class-transformer@npm:^0.5.1":
   version: 0.5.1
   resolution: "class-transformer@npm:0.5.1"
@@ -5784,6 +6430,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"cli-boxes@npm:^2.2.1":
+  version: 2.2.1
+  resolution: "cli-boxes@npm:2.2.1"
+  checksum: 10c0/6111352edbb2f62dbc7bfd58f2d534de507afed7f189f13fa894ce5a48badd94b2aa502fda28f1d7dd5f1eb456e7d4033d09a76660013ef50c7f66e7a034f050
+  languageName: node
+  linkType: hard
+
+"cli-cursor@npm:^3.1.0":
+  version: 3.1.0
+  resolution: "cli-cursor@npm:3.1.0"
+  dependencies:
+    restore-cursor: "npm:^3.1.0"
+  checksum: 10c0/92a2f98ff9037d09be3dfe1f0d749664797fb674bf388375a2207a1203b69d41847abf16434203e0089212479e47a358b13a0222ab9fccfe8e2644a7ccebd111
+  languageName: node
+  linkType: hard
+
 "cli-cursor@npm:^5.0.0":
   version: 5.0.0
   resolution: "cli-cursor@npm:5.0.0"
@@ -5793,6 +6455,29 @@ __metadata:
   languageName: node
   linkType: hard
 
+"cli-highlight@npm:^2.1.11":
+  version: 2.1.11
+  resolution: "cli-highlight@npm:2.1.11"
+  dependencies:
+    chalk: "npm:^4.0.0"
+    highlight.js: "npm:^10.7.1"
+    mz: "npm:^2.4.0"
+    parse5: "npm:^5.1.1"
+    parse5-htmlparser2-tree-adapter: "npm:^6.0.0"
+    yargs: "npm:^16.0.0"
+  bin:
+    highlight: bin/highlight
+  checksum: 10c0/b5b4af3b968aa9df77eee449a400fbb659cf47c4b03a395370bd98d5554a00afaa5819b41a9a8a1ca0d37b0b896a94e57c65289b37359a25b700b1f56eb04852
+  languageName: node
+  linkType: hard
+
+"cli-spinners@npm:^2.5.0":
+  version: 2.9.2
+  resolution: "cli-spinners@npm:2.9.2"
+  checksum: 10c0/907a1c227ddf0d7a101e7ab8b300affc742ead4b4ebe920a5bf1bc6d45dce2958fcd195eb28fa25275062fe6fa9b109b93b63bc8033396ed3bcb50297008b3a3
+  languageName: node
+  linkType: hard
+
 "cli-spinners@npm:^3.2.0":
   version: 3.4.0
   resolution: "cli-spinners@npm:3.4.0"
@@ -5800,7 +6485,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"cli-table3@npm:0.6.5":
+"cli-table3@npm:0.6.5, cli-table3@npm:^0.6.5":
   version: 0.6.5
   resolution: "cli-table3@npm:0.6.5"
   dependencies:
@@ -5820,6 +6505,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"cliui@npm:^7.0.2":
+  version: 7.0.4
+  resolution: "cliui@npm:7.0.4"
+  dependencies:
+    string-width: "npm:^4.2.0"
+    strip-ansi: "npm:^6.0.0"
+    wrap-ansi: "npm:^7.0.0"
+  checksum: 10c0/6035f5daf7383470cef82b3d3db00bec70afb3423538c50394386ffbbab135e26c3689c41791f911fa71b62d13d3863c712fdd70f0fbdffd938a1e6fd09aac00
+  languageName: node
+  linkType: hard
+
 "cliui@npm:^8.0.1":
   version: 8.0.1
   resolution: "cliui@npm:8.0.1"
@@ -5831,6 +6527,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"clone@npm:^1.0.2":
+  version: 1.0.4
+  resolution: "clone@npm:1.0.4"
+  checksum: 10c0/2176952b3649293473999a95d7bebfc9dc96410f6cbd3d2595cf12fd401f63a4bf41a7adbfd3ab2ff09ed60cb9870c58c6acdd18b87767366fabfc163700f13b
+  languageName: node
+  linkType: hard
+
 "color-convert@npm:^2.0.1":
   version: 2.0.1
   resolution: "color-convert@npm:2.0.1"
@@ -5840,6 +6543,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"color-convert@npm:^3.1.3":
+  version: 3.1.3
+  resolution: "color-convert@npm:3.1.3"
+  dependencies:
+    color-name: "npm:^2.0.0"
+  checksum: 10c0/427648b442c6ea6dab5ba03f4962201ee59f128c80b25d5a0f7d9aab0ef52519a9db8a9bb3cf40b73f86eb19b5ca6aeb0ab930665f3d14973ce776d7d0448a15
+  languageName: node
+  linkType: hard
+
+"color-name@npm:^2.0.0":
+  version: 2.1.1
+  resolution: "color-name@npm:2.1.1"
+  checksum: 10c0/6a1096d761b84ad18bdf1464d449800dbb1e613c914aafd9551514884f5e0cc47b5478fea32048188ec7a28424c6ded55fd4a81f39ca351e2ca4dd7729e05128
+  languageName: node
+  linkType: hard
+
 "color-name@npm:~1.1.4":
   version: 1.1.4
   resolution: "color-name@npm:1.1.4"
@@ -5847,6 +6566,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"color-string@npm:^2.1.3":
+  version: 2.1.4
+  resolution: "color-string@npm:2.1.4"
+  dependencies:
+    color-name: "npm:^2.0.0"
+  checksum: 10c0/18a9fefec153d885e0dbfb076f3a65cdcd19f52d96c719f2f261e90e5b7dafd13c51baac399d7099eac290f004d340045ab9467312dcc8afefe6f877ec5c4428
+  languageName: node
+  linkType: hard
+
 "color-support@npm:^1.1.2, color-support@npm:^1.1.3":
   version: 1.1.3
   resolution: "color-support@npm:1.1.3"
@@ -5856,6 +6584,23 @@ __metadata:
   languageName: node
   linkType: hard
 
+"color@npm:^5.0.2":
+  version: 5.0.3
+  resolution: "color@npm:5.0.3"
+  dependencies:
+    color-convert: "npm:^3.1.3"
+    color-string: "npm:^2.1.3"
+  checksum: 10c0/f08a03c5113ae4aa36dba9d2438596b194b897e18b961310643cb63872add1da507cd238df264eb434bbdbe3a377ec41f90d877531acca611523cfcd365db1b6
+  languageName: node
+  linkType: hard
+
+"colorette@npm:^2.0.19, colorette@npm:^2.0.20":
+  version: 2.0.20
+  resolution: "colorette@npm:2.0.20"
+  checksum: 10c0/e94116ff33b0ff56f3b83b9ace895e5bf87c2a7a47b3401b8c3f3226e050d5ef76cf4072fb3325f9dc24d1698f9b730baf4e05eeaf861d74a1883073f4c98a40
+  languageName: node
+  linkType: hard
+
 "combined-stream@npm:^1.0.8":
   version: 1.0.8
   resolution: "combined-stream@npm:1.0.8"
@@ -5872,6 +6617,34 @@ __metadata:
   languageName: node
   linkType: hard
 
+"commander@npm:^10.0.0":
+  version: 10.0.1
+  resolution: "commander@npm:10.0.1"
+  checksum: 10c0/53f33d8927758a911094adadda4b2cbac111a5b377d8706700587650fd8f45b0bbe336de4b5c3fe47fd61f420a3d9bd452b6e0e6e5600a7e74d7bf0174f6efe3
+  languageName: node
+  linkType: hard
+
+"commander@npm:^11.1.0":
+  version: 11.1.0
+  resolution: "commander@npm:11.1.0"
+  checksum: 10c0/13cc6ac875e48780250f723fb81c1c1178d35c5decb1abb1b628b3177af08a8554e76b2c0f29de72d69eef7c864d12613272a71fabef8047922bc622ab75a179
+  languageName: node
+  linkType: hard
+
+"commander@npm:^2.19.0":
+  version: 2.20.3
+  resolution: "commander@npm:2.20.3"
+  checksum: 10c0/74c781a5248c2402a0a3e966a0a2bba3c054aad144f5c023364be83265e796b20565aa9feff624132ff629aa64e16999fa40a743c10c12f7c61e96a794b99288
+  languageName: node
+  linkType: hard
+
+"commander@npm:^5.1.0":
+  version: 5.1.0
+  resolution: "commander@npm:5.1.0"
+  checksum: 10c0/da9d71dbe4ce039faf1fe9eac3771dca8c11d66963341f62602f7b66e36d2a3f8883407af4f9a37b1db1a55c59c0c1325f186425764c2e963dc1d67aec2a4b6d
+  languageName: node
+  linkType: hard
+
 "commander@npm:~12.1.0":
   version: 12.1.0
   resolution: "commander@npm:12.1.0"
@@ -5913,6 +6686,43 @@ __metadata:
   languageName: node
   linkType: hard
 
+"compress-commons@npm:^6.0.2":
+  version: 6.0.2
+  resolution: "compress-commons@npm:6.0.2"
+  dependencies:
+    crc-32: "npm:^1.2.0"
+    crc32-stream: "npm:^6.0.0"
+    is-stream: "npm:^2.0.1"
+    normalize-path: "npm:^3.0.0"
+    readable-stream: "npm:^4.0.0"
+  checksum: 10c0/2347031b7c92c8ed5011b07b93ec53b298fa2cd1800897532ac4d4d1aeae06567883f481b6e35f13b65fc31b190c751df6635434d525562f0203fde76f1f0814
+  languageName: node
+  linkType: hard
+
+"compressible@npm:~2.0.18":
+  version: 2.0.18
+  resolution: "compressible@npm:2.0.18"
+  dependencies:
+    mime-db: "npm:>= 1.43.0 < 2"
+  checksum: 10c0/8a03712bc9f5b9fe530cc5a79e164e665550d5171a64575d7dcf3e0395d7b4afa2d79ab176c61b5b596e28228b350dd07c1a2a6ead12fd81d1b6cd632af2fef7
+  languageName: node
+  linkType: hard
+
+"compression@npm:^1.7.0":
+  version: 1.8.1
+  resolution: "compression@npm:1.8.1"
+  dependencies:
+    bytes: "npm:3.1.2"
+    compressible: "npm:~2.0.18"
+    debug: "npm:2.6.9"
+    negotiator: "npm:~0.6.4"
+    on-headers: "npm:~1.1.0"
+    safe-buffer: "npm:5.2.1"
+    vary: "npm:~1.1.2"
+  checksum: 10c0/85114b0b91c16594dc8c671cd9b05ef5e465066a60e5a4ed8b4551661303559a896ed17bb72c4234c04064e078f6ca86a34b8690349499a43f6fc4b844475da4
+  languageName: node
+  linkType: hard
+
 "concat-stream@npm:^2.0.0":
   version: 2.0.0
   resolution: "concat-stream@npm:2.0.0"
@@ -5942,6 +6752,42 @@ __metadata:
   languageName: node
   linkType: hard
 
+"config-chain@npm:^1.1.11":
+  version: 1.1.13
+  resolution: "config-chain@npm:1.1.13"
+  dependencies:
+    ini: "npm:^1.3.4"
+    proto-list: "npm:~1.2.1"
+  checksum: 10c0/39d1df18739d7088736cc75695e98d7087aea43646351b028dfabd5508d79cf6ef4c5bcd90471f52cd87ae470d1c5490c0a8c1a292fbe6ee9ff688061ea0963e
+  languageName: node
+  linkType: hard
+
+"configstore@npm:^5.0.1":
+  version: 5.0.1
+  resolution: "configstore@npm:5.0.1"
+  dependencies:
+    dot-prop: "npm:^5.2.0"
+    graceful-fs: "npm:^4.1.2"
+    make-dir: "npm:^3.0.0"
+    unique-string: "npm:^2.0.0"
+    write-file-atomic: "npm:^3.0.0"
+    xdg-basedir: "npm:^4.0.0"
+  checksum: 10c0/5af23830e78bdc56cbe92a2f81e87f1d3a39e96e51a0ab2a8bc79bbbc5d4440a48d92833b3fd9c6d34b4a9c4c5853c8487b8e6e68593e7ecbc7434822f7aced3
+  languageName: node
+  linkType: hard
+
+"connect@npm:^3.7.0":
+  version: 3.7.0
+  resolution: "connect@npm:3.7.0"
+  dependencies:
+    debug: "npm:2.6.9"
+    finalhandler: "npm:1.1.2"
+    parseurl: "npm:~1.3.3"
+    utils-merge: "npm:1.0.1"
+  checksum: 10c0/f120c6116bb16a0a7d2703c0b4a0cd7ed787dc5ec91978097bf62aa967289020a9f41a9cd3c3276a7b92aaa36f382d2cd35fed7138fd466a55c8e9fdbed11ca8
+  languageName: node
+  linkType: hard
+
 "consola@npm:^3.2.3":
   version: 3.4.2
   resolution: "consola@npm:3.4.2"
@@ -5963,7 +6809,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"content-type@npm:^1.0.5":
+"content-disposition@npm:~0.5.4":
+  version: 0.5.4
+  resolution: "content-disposition@npm:0.5.4"
+  dependencies:
+    safe-buffer: "npm:5.2.1"
+  checksum: 10c0/bac0316ebfeacb8f381b38285dc691c9939bf0a78b0b7c2d5758acadad242d04783cee5337ba7d12a565a19075af1b3c11c728e1e4946de73c6ff7ce45f3f1bb
+  languageName: node
+  linkType: hard
+
+"content-type@npm:^1.0.4, content-type@npm:^1.0.5, content-type@npm:~1.0.4, content-type@npm:~1.0.5":
   version: 1.0.5
   resolution: "content-type@npm:1.0.5"
   checksum: 10c0/b76ebed15c000aee4678c3707e0860cb6abd4e680a598c0a26e17f0bfae723ec9cc2802f0ff1bc6e4d80603719010431d2231018373d4dde10f9ccff9dadf5af
@@ -6023,7 +6878,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"cookie@npm:^0.7.1":
+"cookie-signature@npm:~1.0.6":
+  version: 1.0.7
+  resolution: "cookie-signature@npm:1.0.7"
+  checksum: 10c0/e7731ad2995ae2efeed6435ec1e22cdd21afef29d300c27281438b1eab2bae04ef0d1a203928c0afec2cee72aa36540b8747406ebe308ad23c8e8cc3c26c9c51
+  languageName: node
+  linkType: hard
+
+"cookie@npm:^0.7.1, cookie@npm:~0.7.1":
   version: 0.7.2
   resolution: "cookie@npm:0.7.2"
   checksum: 10c0/9596e8ccdbf1a3a88ae02cf5ee80c1c50959423e1022e4e60b91dd87c622af1da309253d8abdb258fb5e3eacb4f08e579dc58b4897b8087574eee0fd35dfa5d2
@@ -6037,7 +6899,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"cors@npm:2.8.6":
+"core-util-is@npm:~1.0.0":
+  version: 1.0.3
+  resolution: "core-util-is@npm:1.0.3"
+  checksum: 10c0/90a0e40abbddfd7618f8ccd63a74d88deea94e77d0e8dbbea059fa7ebebb8fbb4e2909667fe26f3a467073de1a542ebe6ae4c73a73745ac5833786759cd906c9
+  languageName: node
+  linkType: hard
+
+"cors@npm:2.8.6, cors@npm:^2.8.5":
   version: 2.8.6
   resolution: "cors@npm:2.8.6"
   dependencies:
@@ -6077,6 +6946,25 @@ __metadata:
   languageName: node
   linkType: hard
 
+"crc-32@npm:^1.2.0":
+  version: 1.2.2
+  resolution: "crc-32@npm:1.2.2"
+  bin:
+    crc32: bin/crc32.njs
+  checksum: 10c0/11dcf4a2e77ee793835d49f2c028838eae58b44f50d1ff08394a610bfd817523f105d6ae4d9b5bef0aad45510f633eb23c903e9902e4409bed1ce70cb82b9bf0
+  languageName: node
+  linkType: hard
+
+"crc32-stream@npm:^6.0.0":
+  version: 6.0.0
+  resolution: "crc32-stream@npm:6.0.0"
+  dependencies:
+    crc-32: "npm:^1.2.0"
+    readable-stream: "npm:^4.0.0"
+  checksum: 10c0/bf9c84571ede2d119c2b4f3a9ef5eeb9ff94b588493c0d3862259af86d3679dcce1c8569dd2b0a6eff2f35f5e2081cc1263b846d2538d4054da78cf34f262a3d
+  languageName: node
+  linkType: hard
+
 "create-require@npm:^1.1.0":
   version: 1.1.1
   resolution: "create-require@npm:1.1.1"
@@ -6084,7 +6972,19 @@ __metadata:
   languageName: node
   linkType: hard
 
-"cross-spawn@npm:^7.0.2, cross-spawn@npm:^7.0.3, cross-spawn@npm:^7.0.6":
+"cross-env@npm:^7.0.3":
+  version: 7.0.3
+  resolution: "cross-env@npm:7.0.3"
+  dependencies:
+    cross-spawn: "npm:^7.0.1"
+  bin:
+    cross-env: src/bin/cross-env.js
+    cross-env-shell: src/bin/cross-env-shell.js
+  checksum: 10c0/f3765c25746c69fcca369655c442c6c886e54ccf3ab8c16847d5ad0e91e2f337d36eedc6599c1227904bf2a228d721e690324446876115bc8e7b32a866735ecf
+  languageName: node
+  linkType: hard
+
+"cross-spawn@npm:^7.0.1, cross-spawn@npm:^7.0.2, cross-spawn@npm:^7.0.3, cross-spawn@npm:^7.0.5, cross-spawn@npm:^7.0.6":
   version: 7.0.6
   resolution: "cross-spawn@npm:7.0.6"
   dependencies:
@@ -6095,6 +6995,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"crypto-random-string@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "crypto-random-string@npm:2.0.0"
+  checksum: 10c0/288589b2484fe787f9e146f56c4be90b940018f17af1b152e4dde12309042ff5a2bf69e949aab8b8ac253948381529cc6f3e5a2427b73643a71ff177fa122b37
+  languageName: node
+  linkType: hard
+
 "csstype@npm:^3.2.2":
   version: 3.2.3
   resolution: "csstype@npm:3.2.3"
@@ -6102,6 +7009,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"csv-parse@npm:^5.0.4":
+  version: 5.6.0
+  resolution: "csv-parse@npm:5.6.0"
+  checksum: 10c0/52f5e6c45359902e0c8e57fc2eeed41366dc6b6d283b495b538dd50c8e8510413d6f924096ea056319cbbb8ed26e111c3a3485d7985c021bcf5abaa9e92425c7
+  languageName: node
+  linkType: hard
+
 "dargs@npm:^8.0.0":
   version: 8.1.0
   resolution: "dargs@npm:8.1.0"
@@ -6116,6 +7030,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"data-uri-to-buffer@npm:^6.0.2":
+  version: 6.0.2
+  resolution: "data-uri-to-buffer@npm:6.0.2"
+  checksum: 10c0/f76922bf895b3d7d443059ff278c9cc5efc89d70b8b80cd9de0aa79b3adc6d7a17948eefb8692e30398c43635f70ece1673d6085cc9eba2878dbc6c6da5292ac
+  languageName: node
+  linkType: hard
+
 "data-view-buffer@npm:^1.0.2":
   version: 1.0.2
   resolution: "data-view-buffer@npm:1.0.2"
@@ -6156,7 +7077,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"debug@npm:4, debug@npm:^4.1.0, debug@npm:^4.3.1, debug@npm:^4.3.2, debug@npm:^4.3.3, debug@npm:^4.3.4, debug@npm:^4.3.5, debug@npm:^4.3.7, debug@npm:^4.4.0, debug@npm:^4.4.3":
+"debug@npm:2.6.9":
+  version: 2.6.9
+  resolution: "debug@npm:2.6.9"
+  dependencies:
+    ms: "npm:2.0.0"
+  checksum: 10c0/121908fb839f7801180b69a7e218a40b5a0b718813b886b7d6bdb82001b931c938e2941d1e4450f33a1b1df1da653f5f7a0440c197f29fbf8a6e9d45ff6ef589
+  languageName: node
+  linkType: hard
+
+"debug@npm:4, debug@npm:^4.1.0, debug@npm:^4.3.1, debug@npm:^4.3.2, debug@npm:^4.3.3, debug@npm:^4.3.4, debug@npm:^4.3.5, debug@npm:^4.3.6, debug@npm:^4.3.7, debug@npm:^4.4.0, debug@npm:^4.4.3":
   version: 4.4.3
   resolution: "debug@npm:4.4.3"
   dependencies:
@@ -6168,6 +7098,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"debug@npm:4.3.1":
+  version: 4.3.1
+  resolution: "debug@npm:4.3.1"
+  dependencies:
+    ms: "npm:2.1.2"
+  peerDependenciesMeta:
+    supports-color:
+      optional: true
+  checksum: 10c0/610bcc2eb07c533d6a9964478422f7d741095d67301888ee0b77b8f2ad0a15d115c93fb2adb13d10a9eda3d81f2d4d335405540b09596fb23aca070e77497d95
+  languageName: node
+  linkType: hard
+
 "debug@npm:^3.2.7":
   version: 3.2.7
   resolution: "debug@npm:3.2.7"
@@ -6198,6 +7140,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"deep-equal-in-any-order@npm:^2.0.6":
+  version: 2.2.0
+  resolution: "deep-equal-in-any-order@npm:2.2.0"
+  dependencies:
+    sort-any: "npm:^4.0.0"
+  checksum: 10c0/eb81198a100fd96c5f7a33935aeada6beedbfb1dffdecfcb52319f53cf55ef0cfd8d8e9845ef089d9328cc9602fd88235808dc74cdb73273e46c6770ab3a6a78
+  languageName: node
+  linkType: hard
+
 "deep-extend@npm:^0.6.0":
   version: 0.6.0
   resolution: "deep-extend@npm:0.6.0"
@@ -6205,6 +7156,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"deep-freeze@npm:0.0.1":
+  version: 0.0.1
+  resolution: "deep-freeze@npm:0.0.1"
+  checksum: 10c0/b32c878395df6ca0e07d065750e14bc1651ec76e99490bca25e5844f7321676d7045d4eb4123892a0d4f08c38e4b7fa46d6e834782c095723447c0ee2ad0340b
+  languageName: node
+  linkType: hard
+
 "deep-is@npm:^0.1.3":
   version: 0.1.4
   resolution: "deep-is@npm:0.1.4"
@@ -6226,6 +7184,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"defaults@npm:^1.0.3":
+  version: 1.0.4
+  resolution: "defaults@npm:1.0.4"
+  dependencies:
+    clone: "npm:^1.0.2"
+  checksum: 10c0/9cfbe498f5c8ed733775db62dfd585780387d93c17477949e1670bfcfb9346e0281ce8c4bf9f4ac1fc0f9b851113bd6dc9e41182ea1644ccd97de639fa13c35a
+  languageName: node
+  linkType: hard
+
 "define-data-property@npm:^1.0.1, define-data-property@npm:^1.1.4":
   version: 1.1.4
   resolution: "define-data-property@npm:1.1.4"
@@ -6248,6 +7215,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"degenerator@npm:^5.0.0":
+  version: 5.0.1
+  resolution: "degenerator@npm:5.0.1"
+  dependencies:
+    ast-types: "npm:^0.13.4"
+    escodegen: "npm:^2.1.0"
+    esprima: "npm:^4.0.1"
+  checksum: 10c0/e48d8a651edeb512a648711a09afec269aac6de97d442a4bb9cf121a66877e0eec11b9727100a10252335c0666ae1c84a8bc1e3a3f47788742c975064d2c7b1c
+  languageName: node
+  linkType: hard
+
 "delayed-stream@npm:~1.0.0":
   version: 1.0.0
   resolution: "delayed-stream@npm:1.0.0"
@@ -6262,13 +7240,20 @@ __metadata:
   languageName: node
   linkType: hard
 
-"depd@npm:^2.0.0, depd@npm:~2.0.0":
+"depd@npm:2.0.0, depd@npm:^2.0.0, depd@npm:~2.0.0":
   version: 2.0.0
   resolution: "depd@npm:2.0.0"
   checksum: 10c0/58bd06ec20e19529b06f7ad07ddab60e504d9e0faca4bd23079fac2d279c3594334d736508dc350e06e510aba5e22e4594483b3a6562ce7c17dd797f4cc4ad2c
   languageName: node
   linkType: hard
 
+"destroy@npm:1.2.0, destroy@npm:^1.0.4, destroy@npm:~1.2.0":
+  version: 1.2.0
+  resolution: "destroy@npm:1.2.0"
+  checksum: 10c0/bd7633942f57418f5a3b80d5cb53898127bcf53e24cdf5d5f4396be471417671f0fee48a4ebe9a1e9defbde2a31280011af58a57e090ff822f589b443ed4e643
+  languageName: node
+  linkType: hard
+
 "detect-libc@npm:^2.0.0, detect-libc@npm:^2.0.3":
   version: 2.1.2
   resolution: "detect-libc@npm:2.1.2"
@@ -6302,6 +7287,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"discontinuous-range@npm:1.0.0":
+  version: 1.0.0
+  resolution: "discontinuous-range@npm:1.0.0"
+  checksum: 10c0/487b105f83c1cc528e25e65d3c4b73958ec79769b7bd0e264414702a23a7e2b282c72982b4bef4af29fcab53f47816c3f0a5c40d85a99a490f4bc35b83dc00f8
+  languageName: node
+  linkType: hard
+
 "doctrine@npm:^2.1.0":
   version: 2.1.0
   resolution: "doctrine@npm:2.1.0"
@@ -6320,7 +7312,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"dot-prop@npm:^5.1.0":
+"dot-prop@npm:^5.1.0, dot-prop@npm:^5.2.0":
   version: 5.3.0
   resolution: "dot-prop@npm:5.3.0"
   dependencies:
@@ -6426,13 +7418,27 @@ __metadata:
   languageName: node
   linkType: hard
 
-"encodeurl@npm:^2.0.0":
+"enabled@npm:2.0.x":
+  version: 2.0.0
+  resolution: "enabled@npm:2.0.0"
+  checksum: 10c0/3b2c2af9bc7f8b9e291610f2dde4a75cf6ee52a68f4dd585482fbdf9a55d65388940e024e56d40bb03e05ef6671f5f53021fa8b72a20e954d7066ec28166713f
+  languageName: node
+  linkType: hard
+
+"encodeurl@npm:^2.0.0, encodeurl@npm:~2.0.0":
   version: 2.0.0
   resolution: "encodeurl@npm:2.0.0"
   checksum: 10c0/5d317306acb13e6590e28e27924c754163946a2480de11865c991a3a7eed4315cd3fba378b543ca145829569eefe9b899f3d84bb09870f675ae60bc924b01ceb
   languageName: node
   linkType: hard
 
+"encodeurl@npm:~1.0.2":
+  version: 1.0.2
+  resolution: "encodeurl@npm:1.0.2"
+  checksum: 10c0/f6c2387379a9e7c1156c1c3d4f9cb7bb11cf16dd4c1682e1f6746512564b053df5781029b6061296832b59fb22f459dbe250386d217c2f6e203601abb2ee0bec
+  languageName: node
+  linkType: hard
+
 "encoding@npm:^0.1.12, encoding@npm:^0.1.13":
   version: 0.1.13
   resolution: "encoding@npm:0.1.13"
@@ -6485,6 +7491,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"environment@npm:^1.0.0":
+  version: 1.1.0
+  resolution: "environment@npm:1.1.0"
+  checksum: 10c0/fb26434b0b581ab397039e51ff3c92b34924a98b2039dcb47e41b7bca577b9dbf134a8eadb364415c74464b682e2d3afe1a4c0eb9873dc44ea814c5d3103331d
+  languageName: node
+  linkType: hard
+
 "err-code@npm:^2.0.2":
   version: 2.0.3
   resolution: "err-code@npm:2.0.3"
@@ -6731,7 +7744,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"escape-html@npm:^1.0.3":
+"escape-goat@npm:^2.0.0":
+  version: 2.1.1
+  resolution: "escape-goat@npm:2.1.1"
+  checksum: 10c0/fc0ad656f89c05e86a9641a21bdc5ea37b258714c057430b68a834854fa3e5770cda7d41756108863fc68b1e36a0946463017b7553ac39eaaf64815be07816fc
+  languageName: node
+  linkType: hard
+
+"escape-html@npm:^1.0.3, escape-html@npm:~1.0.3":
   version: 1.0.3
   resolution: "escape-html@npm:1.0.3"
   checksum: 10c0/524c739d776b36c3d29fa08a22e03e8824e3b2fd57500e5e44ecf3cc4707c34c60f9ca0781c0e33d191f2991161504c295e98f68c78fe7baa6e57081ec6ac0a3
@@ -6745,6 +7765,24 @@ __metadata:
   languageName: node
   linkType: hard
 
+"escodegen@npm:^2.1.0":
+  version: 2.1.0
+  resolution: "escodegen@npm:2.1.0"
+  dependencies:
+    esprima: "npm:^4.0.1"
+    estraverse: "npm:^5.2.0"
+    esutils: "npm:^2.0.2"
+    source-map: "npm:~0.6.1"
+  dependenciesMeta:
+    source-map:
+      optional: true
+  bin:
+    escodegen: bin/escodegen.js
+    esgenerate: bin/esgenerate.js
+  checksum: 10c0/e1450a1f75f67d35c061bf0d60888b15f62ab63aef9df1901cffc81cffbbb9e8b3de237c5502cf8613a017c1df3a3003881307c78835a1ab54d8c8d2206e01d3
+  languageName: node
+  linkType: hard
+
 "eslint-config-prettier@npm:^8.10.0, eslint-config-prettier@npm:^8.3.0":
   version: 8.10.2
   resolution: "eslint-config-prettier@npm:8.10.2"
@@ -7079,24 +8117,96 @@ __metadata:
   languageName: node
   linkType: hard
 
-"etag@npm:^1.8.1":
+"etag@npm:^1.8.1, etag@npm:~1.8.1":
   version: 1.8.1
   resolution: "etag@npm:1.8.1"
   checksum: 10c0/12be11ef62fb9817314d790089a0a49fae4e1b50594135dcb8076312b7d7e470884b5100d249b28c18581b7fd52f8b485689ffae22a11ed9ec17377a33a08f84
   languageName: node
   linkType: hard
 
-"event-target-shim@npm:^5.0.0":
-  version: 5.0.1
-  resolution: "event-target-shim@npm:5.0.1"
-  checksum: 10c0/0255d9f936215fd206156fd4caa9e8d35e62075d720dc7d847e89b417e5e62cf1ce6c9b4e0a1633a9256de0efefaf9f8d26924b1f3c8620cffb9db78e7d3076b
+"event-target-shim@npm:^5.0.0":
+  version: 5.0.1
+  resolution: "event-target-shim@npm:5.0.1"
+  checksum: 10c0/0255d9f936215fd206156fd4caa9e8d35e62075d720dc7d847e89b417e5e62cf1ce6c9b4e0a1633a9256de0efefaf9f8d26924b1f3c8620cffb9db78e7d3076b
+  languageName: node
+  linkType: hard
+
+"eventemitter2@npm:^6.4.9":
+  version: 6.4.9
+  resolution: "eventemitter2@npm:6.4.9"
+  checksum: 10c0/b2adf7d9f1544aa2d95ee271b0621acaf1e309d85ebcef1244fb0ebc7ab0afa6ffd5e371535d0981bc46195ad67fd6ff57a8d1db030584dee69aa5e371a27ea7
+  languageName: node
+  linkType: hard
+
+"events-listener@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "events-listener@npm:1.1.0"
+  checksum: 10c0/85a2be3d27cef22edb6e8bccfd2d87c9f9f6854a834129958c7a0410284b6c9c69efff40554ba8ae3f4c1dc9b036c5a07c5d5df8b31041b3b93722c91dc3b140
+  languageName: node
+  linkType: hard
+
+"events-universal@npm:^1.0.0":
+  version: 1.0.1
+  resolution: "events-universal@npm:1.0.1"
+  dependencies:
+    bare-events: "npm:^2.7.0"
+  checksum: 10c0/a1d9a5e9f95843650f8ec240dd1221454c110189a9813f32cdf7185759b43f1f964367ac7dca4ebc69150b59043f2d77c7e122b0d03abf7c25477ea5494785a5
+  languageName: node
+  linkType: hard
+
+"events@npm:^3.3.0":
+  version: 3.3.0
+  resolution: "events@npm:3.3.0"
+  checksum: 10c0/d6b6f2adbccbcda74ddbab52ed07db727ef52e31a61ed26db9feb7dc62af7fc8e060defa65e5f8af9449b86b52cc1a1f6a79f2eafcf4e62add2b7a1fa4a432f6
+  languageName: node
+  linkType: hard
+
+"eventsource-parser@npm:^3.0.0, eventsource-parser@npm:^3.0.1":
+  version: 3.1.0
+  resolution: "eventsource-parser@npm:3.1.0"
+  checksum: 10c0/5ab4c6c9a2a042be0b387b6d03810eb580bac4ce90e299ede56458125a97ffe3af8145b2740089fc898a96cfa5aae792ee79f2a06257fba2776b0e7bce037071
+  languageName: node
+  linkType: hard
+
+"eventsource@npm:^3.0.2":
+  version: 3.0.7
+  resolution: "eventsource@npm:3.0.7"
+  dependencies:
+    eventsource-parser: "npm:^3.0.1"
+  checksum: 10c0/c48a73c38f300e33e9f11375d4ee969f25cbb0519608a12378a38068055ae8b55b6e0e8a49c3f91c784068434efe1d9f01eb49b6315b04b0da9157879ce2f67d
+  languageName: node
+  linkType: hard
+
+"exegesis-express@npm:^4.0.0":
+  version: 4.0.0
+  resolution: "exegesis-express@npm:4.0.0"
+  dependencies:
+    exegesis: "npm:^4.1.0"
+  checksum: 10c0/09e32a03f0bbafc09cc19d213fdc61584cda52f7f465b1cd4faba55a8c87eb956c00bb0a72f53770799669e95c4d6af525983c639ab920333d3b0397592e8241
   languageName: node
   linkType: hard
 
-"eventemitter2@npm:^6.4.9":
-  version: 6.4.9
-  resolution: "eventemitter2@npm:6.4.9"
-  checksum: 10c0/b2adf7d9f1544aa2d95ee271b0621acaf1e309d85ebcef1244fb0ebc7ab0afa6ffd5e371535d0981bc46195ad67fd6ff57a8d1db030584dee69aa5e371a27ea7
+"exegesis@npm:^4.1.0, exegesis@npm:^4.2.0":
+  version: 4.3.0
+  resolution: "exegesis@npm:4.3.0"
+  dependencies:
+    "@apidevtools/json-schema-ref-parser": "npm:^9.0.3"
+    ajv: "npm:^8.3.0"
+    ajv-formats: "npm:^2.1.0"
+    body-parser: "npm:^1.18.3"
+    content-type: "npm:^1.0.4"
+    deep-freeze: "npm:0.0.1"
+    events-listener: "npm:^1.1.0"
+    glob: "npm:^10.3.10"
+    json-ptr: "npm:^3.0.1"
+    json-schema-traverse: "npm:^1.0.0"
+    lodash: "npm:^4.17.11"
+    openapi3-ts: "npm:^3.1.1"
+    promise-breaker: "npm:^6.0.0"
+    qs: "npm:^6.6.0"
+    raw-body: "npm:^2.3.3"
+    semver: "npm:^7.0.0"
+  checksum: 10c0/944ec9df00378ef19eb37a52aff60244e3bb98878e5979d7efb98b8454b144d9bb7ec08ea8d23e54430d97e2d0bf9e59341f85a471e1288a607cf13ceabfdbe1
   languageName: node
   linkType: hard
 
@@ -7121,6 +8231,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"express-rate-limit@npm:^8.2.1":
+  version: 8.6.2
+  resolution: "express-rate-limit@npm:8.6.2"
+  dependencies:
+    debug: "npm:^4.4.3"
+    ip-address: "npm:^10.2.0"
+  peerDependencies:
+    express: ">= 4.11"
+  checksum: 10c0/34dba96f7daa01fe9f73a965c0ddaa73bf83d2cb1691ed5e060451ddacebc10fda211a3cf0c34592cf0360bf00d6d9354f3e11ccda7c899705ec1e43383c3144
+  languageName: node
+  linkType: hard
+
 "express-serve-static-core@npm:^0.1.1":
   version: 0.1.1
   resolution: "express-serve-static-core@npm:0.1.1"
@@ -7128,7 +8250,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"express@npm:5.2.1":
+"express@npm:5.2.1, express@npm:^5.2.1":
   version: 5.2.1
   resolution: "express@npm:5.2.1"
   dependencies:
@@ -7164,6 +8286,45 @@ __metadata:
   languageName: node
   linkType: hard
 
+"express@npm:^4.16.4":
+  version: 4.22.2
+  resolution: "express@npm:4.22.2"
+  dependencies:
+    accepts: "npm:~1.3.8"
+    array-flatten: "npm:1.1.1"
+    body-parser: "npm:~1.20.5"
+    content-disposition: "npm:~0.5.4"
+    content-type: "npm:~1.0.4"
+    cookie: "npm:~0.7.1"
+    cookie-signature: "npm:~1.0.6"
+    debug: "npm:2.6.9"
+    depd: "npm:2.0.0"
+    encodeurl: "npm:~2.0.0"
+    escape-html: "npm:~1.0.3"
+    etag: "npm:~1.8.1"
+    finalhandler: "npm:~1.3.1"
+    fresh: "npm:~0.5.2"
+    http-errors: "npm:~2.0.0"
+    merge-descriptors: "npm:1.0.3"
+    methods: "npm:~1.1.2"
+    on-finished: "npm:~2.4.1"
+    parseurl: "npm:~1.3.3"
+    path-to-regexp: "npm:~0.1.12"
+    proxy-addr: "npm:~2.0.7"
+    qs: "npm:~6.15.1"
+    range-parser: "npm:~1.2.1"
+    safe-buffer: "npm:5.2.1"
+    send: "npm:~0.19.0"
+    serve-static: "npm:~1.16.2"
+    setprototypeof: "npm:1.2.0"
+    statuses: "npm:~2.0.1"
+    type-is: "npm:~1.6.18"
+    utils-merge: "npm:1.0.1"
+    vary: "npm:~1.1.2"
+  checksum: 10c0/d06dd4379fd217440b30f8abbe45f0e74931114c1395034f03e7d635196ecdab530d4835a1962a6aa34838d61967dc6f1f77846999bba3032373e9e714222c44
+  languageName: node
+  linkType: hard
+
 "extend@npm:^3.0.2":
   version: 3.0.2
   resolution: "extend@npm:3.0.2"
@@ -7192,6 +8353,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"fast-fifo@npm:^1.2.0, fast-fifo@npm:^1.3.2":
+  version: 1.3.2
+  resolution: "fast-fifo@npm:1.3.2"
+  checksum: 10c0/d53f6f786875e8b0529f784b59b4b05d4b5c31c651710496440006a398389a579c8dbcd2081311478b5bf77f4b0b21de69109c5a4eabea9d8e8783d1eb864e4c
+  languageName: node
+  linkType: hard
+
 "fast-glob@npm:^3.2.9":
   version: 3.3.3
   resolution: "fast-glob@npm:3.3.3"
@@ -7313,6 +8481,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"fecha@npm:^4.2.0":
+  version: 4.2.3
+  resolution: "fecha@npm:4.2.3"
+  checksum: 10c0/0e895965959cf6a22bb7b00f0bf546f2783836310f510ddf63f463e1518d4c96dec61ab33fdfd8e79a71b4856a7c865478ce2ee8498d560fe125947703c9b1cf
+  languageName: node
+  linkType: hard
+
 "fetch-blob@npm:^3.1.2, fetch-blob@npm:^3.1.4":
   version: 3.2.0
   resolution: "fetch-blob@npm:3.2.0"
@@ -7351,6 +8526,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"filesize@npm:^6.1.0":
+  version: 6.4.0
+  resolution: "filesize@npm:6.4.0"
+  checksum: 10c0/1c317e59636d2079e64fcd38a69d415d5713a328496e0e5f1889b83e8adea8b47ceb9eb14726013b7cca02e76f5bd041eeab94edad8bed35d4ab1ecad55144d9
+  languageName: node
+  linkType: hard
+
 "fill-range@npm:^7.1.1":
   version: 7.1.1
   resolution: "fill-range@npm:7.1.1"
@@ -7360,6 +8542,21 @@ __metadata:
   languageName: node
   linkType: hard
 
+"finalhandler@npm:1.1.2":
+  version: 1.1.2
+  resolution: "finalhandler@npm:1.1.2"
+  dependencies:
+    debug: "npm:2.6.9"
+    encodeurl: "npm:~1.0.2"
+    escape-html: "npm:~1.0.3"
+    on-finished: "npm:~2.3.0"
+    parseurl: "npm:~1.3.3"
+    statuses: "npm:~1.5.0"
+    unpipe: "npm:~1.0.0"
+  checksum: 10c0/6a96e1f5caab085628c11d9fdceb82ba608d5e426c6913d4d918409baa271037a47f28fbba73279e8ad614f0b8fa71ea791d265e408d760793829edd8c2f4584
+  languageName: node
+  linkType: hard
+
 "finalhandler@npm:^2.1.0":
   version: 2.1.1
   resolution: "finalhandler@npm:2.1.1"
@@ -7374,6 +8571,21 @@ __metadata:
   languageName: node
   linkType: hard
 
+"finalhandler@npm:~1.3.1":
+  version: 1.3.2
+  resolution: "finalhandler@npm:1.3.2"
+  dependencies:
+    debug: "npm:2.6.9"
+    encodeurl: "npm:~2.0.0"
+    escape-html: "npm:~1.0.3"
+    on-finished: "npm:~2.4.1"
+    parseurl: "npm:~1.3.3"
+    statuses: "npm:~2.0.2"
+    unpipe: "npm:~1.0.0"
+  checksum: 10c0/435a4fd65e4e4e4c71bb5474980090b73c353a123dd415583f67836bdd6516e528cf07298e219a82b94631dee7830eae5eece38d3c178073cf7df4e8c182f413
+  languageName: node
+  linkType: hard
+
 "find-up@npm:^5.0.0":
   version: 5.0.0
   resolution: "find-up@npm:5.0.0"
@@ -7451,6 +8663,92 @@ __metadata:
   languageName: node
   linkType: hard
 
+"firebase-tools@npm:15.15.0":
+  version: 15.15.0
+  resolution: "firebase-tools@npm:15.15.0"
+  dependencies:
+    "@apphosting/build": "npm:^0.1.7"
+    "@apphosting/common": "npm:^0.0.8"
+    "@electric-sql/pglite": "npm:^0.3.3"
+    "@electric-sql/pglite-tools": "npm:^0.2.8"
+    "@google-cloud/cloud-sql-connector": "npm:^1.3.3"
+    "@google-cloud/pubsub": "npm:^5.2.0"
+    "@inquirer/prompts": "npm:^7.10.1"
+    "@modelcontextprotocol/sdk": "npm:^1.24.0"
+    abort-controller: "npm:^3.0.0"
+    ajv: "npm:^8.17.1"
+    ajv-formats: "npm:3.0.1"
+    archiver: "npm:^7.0.0"
+    async-lock: "npm:1.4.1"
+    body-parser: "npm:^1.19.0"
+    chokidar: "npm:^3.6.0"
+    cjson: "npm:^0.3.1"
+    cli-table3: "npm:0.6.5"
+    colorette: "npm:^2.0.19"
+    commander: "npm:^5.1.0"
+    configstore: "npm:^5.0.1"
+    cors: "npm:^2.8.5"
+    cross-env: "npm:^7.0.3"
+    cross-spawn: "npm:^7.0.5"
+    csv-parse: "npm:^5.0.4"
+    deep-equal-in-any-order: "npm:^2.0.6"
+    exegesis: "npm:^4.2.0"
+    exegesis-express: "npm:^4.0.0"
+    express: "npm:^4.16.4"
+    filesize: "npm:^6.1.0"
+    form-data: "npm:^4.0.1"
+    fs-extra: "npm:^10.1.0"
+    fuzzy: "npm:^0.1.3"
+    gaxios: "npm:^6.7.0"
+    glob: "npm:^10.5.0"
+    google-auth-library: "npm:^9.11.0"
+    ignore: "npm:^7.0.4"
+    js-yaml: "npm:^3.14.2"
+    jsonwebtoken: "npm:^9.0.2"
+    leven: "npm:^3.1.0"
+    libsodium-wrappers: "npm:^0.7.10"
+    lodash: "npm:^4.18.0"
+    lsofi: "npm:^2.0.0"
+    marked: "npm:^13.0.2"
+    marked-terminal: "npm:^7.0.0"
+    mime: "npm:^2.5.2"
+    minimatch: "npm:^3.0.4"
+    morgan: "npm:^1.10.0"
+    node-fetch: "npm:^2.6.7"
+    open: "npm:^6.3.0"
+    ora: "npm:^5.4.1"
+    p-limit: "npm:^3.0.1"
+    pg: "npm:^8.11.3"
+    pg-gateway: "npm:^0.3.0-beta.4"
+    pglite-2: "npm:@electric-sql/pglite@0.2.17"
+    portfinder: "npm:^1.0.32"
+    progress: "npm:^2.0.3"
+    proxy-agent: "npm:^6.3.0"
+    retry: "npm:^0.13.1"
+    semver: "npm:^7.5.2"
+    sql-formatter: "npm:^15.3.0"
+    stream-chain: "npm:^2.2.4"
+    stream-json: "npm:^1.7.3"
+    superstatic: "npm:^10.0.0"
+    tar: "npm:^7.5.11"
+    tcp-port-used: "npm:^1.0.2"
+    tmp: "npm:^0.2.3"
+    triple-beam: "npm:^1.3.0"
+    universal-analytics: "npm:^0.5.3"
+    update-notifier-cjs: "npm:^5.1.6"
+    uuid: "npm:^8.3.2"
+    winston: "npm:^3.0.0"
+    winston-transport: "npm:^4.4.0"
+    ws: "npm:^7.5.10"
+    yaml: "npm:^2.8.3"
+    zod: "npm:^3.24.3"
+    zod-to-json-schema: "npm:^3.24.5"
+  bin:
+    firebase: lib/bin/firebase.js
+  checksum: 10c0/b14ee580ce05da9e878df408e98647503a1acf0f5414c68b3635ab0d70d9c307322558cf4750bb386abcdc05085c6eb51b8e649ead2631bfd77aba19d7dadbdd
+  languageName: node
+  linkType: hard
+
 "firebase@npm:^11.0.0":
   version: 11.10.0
   resolution: "firebase@npm:11.10.0"
@@ -7505,6 +8803,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"fn.name@npm:1.x.x":
+  version: 1.1.0
+  resolution: "fn.name@npm:1.1.0"
+  checksum: 10c0/8ad62aa2d4f0b2a76d09dba36cfec61c540c13a0fd72e5d94164e430f987a7ce6a743112bbeb14877c810ef500d1f73d7f56e76d029d2e3413f20d79e3460a9a
+  languageName: node
+  linkType: hard
+
 "for-each@npm:^0.3.3, for-each@npm:^0.3.5":
   version: 0.3.5
   resolution: "for-each@npm:0.3.5"
@@ -7583,6 +8888,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"fresh@npm:~0.5.2":
+  version: 0.5.2
+  resolution: "fresh@npm:0.5.2"
+  checksum: 10c0/c6d27f3ed86cc5b601404822f31c900dd165ba63fff8152a3ef714e2012e7535027063bc67ded4cb5b3a49fa596495d46cacd9f47d6328459cf570f08b7d9e5a
+  languageName: node
+  linkType: hard
+
 "fs-constants@npm:^1.0.0":
   version: 1.0.0
   resolution: "fs-constants@npm:1.0.0"
@@ -7590,7 +8902,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fs-extra@npm:^10.0.0":
+"fs-extra@npm:^10.0.0, fs-extra@npm:^10.1.0":
   version: 10.1.0
   resolution: "fs-extra@npm:10.1.0"
   dependencies:
@@ -7699,6 +9011,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"fuzzy@npm:^0.1.3":
+  version: 0.1.3
+  resolution: "fuzzy@npm:0.1.3"
+  checksum: 10c0/584fcd57a03431707a6d0c1c4a41f17368cdb23d37dcb176d6cbbeeaecaac51be15dec229b3547acfb7db052cb066fcd86db907d40112ac4a3d3a368f88e7105
+  languageName: node
+  linkType: hard
+
 "gauge@npm:^3.0.0":
   version: 3.0.2
   resolution: "gauge@npm:3.0.2"
@@ -7732,7 +9051,19 @@ __metadata:
   languageName: node
   linkType: hard
 
-"gaxios@npm:^6.0.0, gaxios@npm:^6.0.2, gaxios@npm:^6.1.1":
+"gaxios@npm:7.1.3":
+  version: 7.1.3
+  resolution: "gaxios@npm:7.1.3"
+  dependencies:
+    extend: "npm:^3.0.2"
+    https-proxy-agent: "npm:^7.0.1"
+    node-fetch: "npm:^3.3.2"
+    rimraf: "npm:^5.0.1"
+  checksum: 10c0/a4a1cdf9a392c0c22e9734a40dca5a77a2903f505b939a50f1e68e312458b1289b7993d2f72d011426e89657cae77a3aa9fc62fb140e8ba90a1faa31fdbde4d2
+  languageName: node
+  linkType: hard
+
+"gaxios@npm:^6.0.0, gaxios@npm:^6.0.2, gaxios@npm:^6.1.1, gaxios@npm:^6.7.0":
   version: 6.7.1
   resolution: "gaxios@npm:6.7.1"
   dependencies:
@@ -7778,6 +9109,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"gcp-metadata@npm:^8.0.0":
+  version: 8.1.4
+  resolution: "gcp-metadata@npm:8.1.4"
+  dependencies:
+    gaxios: "npm:7.1.3"
+    google-logging-utils: "npm:1.1.3"
+    json-bigint: "npm:^1.0.0"
+  checksum: 10c0/dffba44f5192d73c515f04fd9ce7da89e5d05403d75c93d308bb3909044721038eac581cd08652679eaf570b232c65fae8591ba06ec8370945e1ca94609ab8aa
+  languageName: node
+  linkType: hard
+
 "generator-function@npm:^2.0.0":
   version: 2.0.1
   resolution: "generator-function@npm:2.0.1"
@@ -7855,6 +9197,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"get-uri@npm:^6.0.1":
+  version: 6.0.5
+  resolution: "get-uri@npm:6.0.5"
+  dependencies:
+    basic-ftp: "npm:^5.0.2"
+    data-uri-to-buffer: "npm:^6.0.2"
+    debug: "npm:^4.3.4"
+  checksum: 10c0/c7ff5d5d55de53d23ecce7c5108cc3ed0db1174db43c9aa15506d640283d36ee0956fd8ba1fc50b06a718466cc85794ae9d8860193f91318afe846e3e7010f3a
+  languageName: node
+  linkType: hard
+
 "git-raw-commits@npm:^4.0.0":
   version: 4.0.0
   resolution: "git-raw-commits@npm:4.0.0"
@@ -7875,7 +9228,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"glob-parent@npm:^5.1.2":
+"glob-parent@npm:^5.1.2, glob-parent@npm:~5.1.2":
   version: 5.1.2
   resolution: "glob-parent@npm:5.1.2"
   dependencies:
@@ -7893,6 +9246,24 @@ __metadata:
   languageName: node
   linkType: hard
 
+"glob-slash@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "glob-slash@npm:1.0.0"
+  checksum: 10c0/ef39ce78883e8afc0cced9ec816a9323345eca0484ad143602bd44bca6379df6ea2544680c455cc4da1b24509c451a09bc860871c86142271c7ba3d06c1f8fc1
+  languageName: node
+  linkType: hard
+
+"glob-slasher@npm:^1.0.1":
+  version: 1.0.1
+  resolution: "glob-slasher@npm:1.0.1"
+  dependencies:
+    glob-slash: "npm:^1.0.0"
+    lodash.isobject: "npm:^2.4.1"
+    toxic: "npm:^1.0.0"
+  checksum: 10c0/9d83a388382a971da0945ac23d0d45b8da329d9397f548cfb37929b0d088788c54878685bb0d843ddab99941a122623efe0b329756340dddb6ee04dd4f0c77e9
+  languageName: node
+  linkType: hard
+
 "glob@npm:13.0.6":
   version: 13.0.6
   resolution: "glob@npm:13.0.6"
@@ -7904,7 +9275,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"glob@npm:^10.5.0":
+"glob@npm:^10.0.0, glob@npm:^10.3.10, glob@npm:^10.3.7, glob@npm:^10.5.0":
   version: 10.5.0
   resolution: "glob@npm:10.5.0"
   dependencies:
@@ -7970,6 +9341,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"global-dirs@npm:^3.0.0":
+  version: 3.0.1
+  resolution: "global-dirs@npm:3.0.1"
+  dependencies:
+    ini: "npm:2.0.0"
+  checksum: 10c0/ef65e2241a47ff978f7006a641302bc7f4c03dfb98783d42bf7224c136e3a06df046e70ee3a010cf30214114755e46c9eb5eb1513838812fbbe0d92b14c25080
+  languageName: node
+  linkType: hard
+
 "globals@npm:^13.19.0":
   version: 13.24.0
   resolution: "globals@npm:13.24.0"
@@ -8003,6 +9383,35 @@ __metadata:
   languageName: node
   linkType: hard
 
+"google-auth-library@npm:10.5.0":
+  version: 10.5.0
+  resolution: "google-auth-library@npm:10.5.0"
+  dependencies:
+    base64-js: "npm:^1.3.0"
+    ecdsa-sig-formatter: "npm:^1.0.11"
+    gaxios: "npm:^7.0.0"
+    gcp-metadata: "npm:^8.0.0"
+    google-logging-utils: "npm:^1.0.0"
+    gtoken: "npm:^8.0.0"
+    jws: "npm:^4.0.0"
+  checksum: 10c0/49d3931d20b1f4a4d075216bf5518e2b3396dcf441a8f1952611cf3b6080afb1261c3d32009609047ee4a1cc545269a74b4957e6bba9cce840581df309c4b145
+  languageName: node
+  linkType: hard
+
+"google-auth-library@npm:^10.5.0, google-auth-library@npm:^10.6.2":
+  version: 10.9.1
+  resolution: "google-auth-library@npm:10.9.1"
+  dependencies:
+    base64-js: "npm:^1.3.0"
+    ecdsa-sig-formatter: "npm:^1.0.11"
+    gaxios: "npm:^7.1.4"
+    gcp-metadata: "npm:8.1.2"
+    google-logging-utils: "npm:1.1.3"
+    jws: "npm:^4.0.0"
+  checksum: 10c0/46babe840d295ad94044bdba763bd41b10dc50d60f00e3e7b441465db171dc54c8f33ba44212db40e84aba3a72c23d642fa5a807e778e60049ad7d860d100680
+  languageName: node
+  linkType: hard
+
 "google-auth-library@npm:^10.6.1":
   version: 10.6.2
   resolution: "google-auth-library@npm:10.6.2"
@@ -8017,7 +9426,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"google-auth-library@npm:^9.3.0, google-auth-library@npm:^9.6.3":
+"google-auth-library@npm:^9.11.0, google-auth-library@npm:^9.3.0, google-auth-library@npm:^9.6.3":
   version: 9.15.1
   resolution: "google-auth-library@npm:9.15.1"
   dependencies:
@@ -8051,6 +9460,25 @@ __metadata:
   languageName: node
   linkType: hard
 
+"google-gax@npm:^5.0.5":
+  version: 5.0.8
+  resolution: "google-gax@npm:5.0.8"
+  dependencies:
+    "@grpc/grpc-js": "npm:^1.12.6"
+    "@grpc/proto-loader": "npm:^0.8.0"
+    duplexify: "npm:^4.1.3"
+    google-auth-library: "npm:10.5.0"
+    google-logging-utils: "npm:1.1.3"
+    node-fetch: "npm:^3.3.2"
+    object-hash: "npm:^3.0.0"
+    proto3-json-serializer: "npm:3.0.4"
+    protobufjs: "npm:^7.5.4"
+    retry-request: "npm:^8.0.2"
+    rimraf: "npm:^5.0.1"
+  checksum: 10c0/dbeed0a959c7628393888e2b6da19767e265b803b19f92b5c35b3e776c123e359673da8b832387958012c70956c01f5bb8b19468405531cb7e2dd9aa28088fb7
+  languageName: node
+  linkType: hard
+
 "google-logging-utils@npm:1.1.3, google-logging-utils@npm:^1.0.0":
   version: 1.1.3
   resolution: "google-logging-utils@npm:1.1.3"
@@ -8065,6 +9493,27 @@ __metadata:
   languageName: node
   linkType: hard
 
+"google-logging-utils@npm:^1.1.3":
+  version: 1.2.0
+  resolution: "google-logging-utils@npm:1.2.0"
+  checksum: 10c0/a5bceaa13ef6ed7e84a4dd96d8acb5ca895c7777a35629921096c53b1740518d3a8aa35d808697488ecf0416f2e72d462148ecbbbec34a805b5eacc136171a53
+  languageName: node
+  linkType: hard
+
+"googleapis-common@npm:^8.0.0":
+  version: 8.0.3
+  resolution: "googleapis-common@npm:8.0.3"
+  dependencies:
+    extend: "npm:^3.0.2"
+    gaxios: "npm:7.1.3"
+    google-auth-library: "npm:10.5.0"
+    google-logging-utils: "npm:1.1.3"
+    qs: "npm:^6.7.0"
+    url-template: "npm:^2.0.8"
+  checksum: 10c0/8cda8ab8c300fc63fcabfd3b9ca35529dcbd9bdb9106db6bc460e33541d5bcd8f62b7051ae15129f98cddcddc964c35e59c671523a1eb5da8edf4c88a4cf3326
+  languageName: node
+  linkType: hard
+
 "gopd@npm:^1.0.1, gopd@npm:^1.2.0":
   version: 1.2.0
   resolution: "gopd@npm:1.2.0"
@@ -8072,7 +9521,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"graceful-fs@npm:^4.1.11, graceful-fs@npm:^4.1.6, graceful-fs@npm:^4.2.0, graceful-fs@npm:^4.2.4, graceful-fs@npm:^4.2.6":
+"graceful-fs@npm:4.2.10":
+  version: 4.2.10
+  resolution: "graceful-fs@npm:4.2.10"
+  checksum: 10c0/4223a833e38e1d0d2aea630c2433cfb94ddc07dfc11d511dbd6be1d16688c5be848acc31f9a5d0d0ddbfb56d2ee5a6ae0278aceeb0ca6a13f27e06b9956fb952
+  languageName: node
+  linkType: hard
+
+"graceful-fs@npm:^4.1.11, graceful-fs@npm:^4.1.2, graceful-fs@npm:^4.1.6, graceful-fs@npm:^4.2.0, graceful-fs@npm:^4.2.4, graceful-fs@npm:^4.2.6":
   version: 4.2.11
   resolution: "graceful-fs@npm:4.2.11"
   checksum: 10c0/386d011a553e02bc594ac2ca0bd6d9e4c22d7fa8cfbfc448a6d148c59ea881b092db9dbe3547ae4b88e55f1b01f7c4a2ecc53b310c042793e63aa44cf6c257f2
@@ -8096,6 +9552,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"gtoken@npm:^8.0.0":
+  version: 8.0.0
+  resolution: "gtoken@npm:8.0.0"
+  dependencies:
+    gaxios: "npm:^7.0.0"
+    jws: "npm:^4.0.0"
+  checksum: 10c0/058538e5bbe081d30ada5f1fd34d3a8194357c2e6ecbf7c8a98daeefbf13f7e06c15649c7dace6a1d4cc3bc6dc5483bd484d6d7adc5852021896d7c05c439f37
+  languageName: node
+  linkType: hard
+
 "has-bigints@npm:^1.0.2":
   version: 1.1.0
   resolution: "has-bigints@npm:1.1.0"
@@ -8151,6 +9617,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"has-yarn@npm:^2.1.0":
+  version: 2.1.0
+  resolution: "has-yarn@npm:2.1.0"
+  checksum: 10c0/b5cab61b4129c2fc0474045b59705371b7f5ddf2aab8ba8725011e52269f017e06f75059a2c8a1d8011e9779c2885ad987263cfc6d1280f611c396b45fd5d74a
+  languageName: node
+  linkType: hard
+
 "hasown@npm:^2.0.2":
   version: 2.0.2
   resolution: "hasown@npm:2.0.2"
@@ -8169,6 +9642,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"heap-js@npm:^2.6.0":
+  version: 2.7.1
+  resolution: "heap-js@npm:2.7.1"
+  checksum: 10c0/a1e4ec7624487f198158599a04b73f5e72f3e805b2ee7dc18ae5340be035a8e5c9e6ee01d8ed4eb81a8bcb6c03b0342f57af386b2552825777a1d7c64adedbd4
+  languageName: node
+  linkType: hard
+
 "helmet@npm:^8.0.0, helmet@npm:^8.1.0":
   version: 8.1.0
   resolution: "helmet@npm:8.1.0"
@@ -8176,6 +9656,29 @@ __metadata:
   languageName: node
   linkType: hard
 
+"highlight.js@npm:^10.7.1":
+  version: 10.7.3
+  resolution: "highlight.js@npm:10.7.3"
+  checksum: 10c0/073837eaf816922427a9005c56c42ad8786473dc042332dfe7901aa065e92bc3d94ebf704975257526482066abb2c8677cc0326559bb8621e046c21c5991c434
+  languageName: node
+  linkType: hard
+
+"hono@npm:^4.11.4":
+  version: 4.13.1
+  resolution: "hono@npm:4.13.1"
+  checksum: 10c0/83524961f806293464e6c3b31a7fd2ab8cd8e9cb66e65dea1fbbefb70744844c13b7409ed9b49b43e8543e5c0f1b851f2586fa759eea9da0b69503b58cd0d985
+  languageName: node
+  linkType: hard
+
+"hosted-git-info@npm:^7.0.0":
+  version: 7.0.2
+  resolution: "hosted-git-info@npm:7.0.2"
+  dependencies:
+    lru-cache: "npm:^10.0.1"
+  checksum: 10c0/b19dbd92d3c0b4b0f1513cf79b0fc189f54d6af2129eeb201de2e9baaa711f1936929c848b866d9c8667a0f956f34bf4f07418c12be1ee9ca74fd9246335ca1f
+  languageName: node
+  linkType: hard
+
 "html-entities@npm:^2.5.2":
   version: 2.6.0
   resolution: "html-entities@npm:2.6.0"
@@ -8197,7 +9700,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"http-errors@npm:^2.0.0, http-errors@npm:^2.0.1, http-errors@npm:~2.0.1":
+"http-errors@npm:^2.0.0, http-errors@npm:^2.0.1, http-errors@npm:~2.0.0, http-errors@npm:~2.0.1":
   version: 2.0.1
   resolution: "http-errors@npm:2.0.1"
   dependencies:
@@ -8239,7 +9742,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"http-proxy-agent@npm:^7.0.0":
+"http-proxy-agent@npm:^7.0.0, http-proxy-agent@npm:^7.0.1":
   version: 7.0.2
   resolution: "http-proxy-agent@npm:7.0.2"
   dependencies:
@@ -8259,7 +9762,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"https-proxy-agent@npm:^7.0.1":
+"https-proxy-agent@npm:^7.0.1, https-proxy-agent@npm:^7.0.6":
   version: 7.0.6
   resolution: "https-proxy-agent@npm:7.0.6"
   dependencies:
@@ -8314,6 +9817,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"iconv-lite@npm:~0.4.24":
+  version: 0.4.24
+  resolution: "iconv-lite@npm:0.4.24"
+  dependencies:
+    safer-buffer: "npm:>= 2.1.2 < 3"
+  checksum: 10c0/c6886a24cc00f2a059767440ec1bc00d334a89f250db8e0f7feb4961c8727118457e27c495ba94d082e51d3baca378726cd110aaf7ded8b9bbfd6a44760cf1d4
+  languageName: node
+  linkType: hard
+
 "idb@npm:7.1.1":
   version: 7.1.1
   resolution: "idb@npm:7.1.1"
@@ -8335,6 +9847,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"ignore@npm:^7.0.4":
+  version: 7.0.6
+  resolution: "ignore@npm:7.0.6"
+  checksum: 10c0/fc01ef1d14efbe003439b60538726351e81483d1b6f55bdbb3a4465c6346d9481afad5b350dfbd604ddd7049618ef9093ff26dc147984aabc303c56ba53ea3b5
+  languageName: node
+  linkType: hard
+
 "import-fresh@npm:^3.2.1, import-fresh@npm:^3.3.0":
   version: 3.3.1
   resolution: "import-fresh@npm:3.3.1"
@@ -8345,6 +9864,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"import-lazy@npm:^2.1.0":
+  version: 2.1.0
+  resolution: "import-lazy@npm:2.1.0"
+  checksum: 10c0/c5e5f507d26ee23c5b2ed64577155810361ac37863b322cae0c17f16b6a8cdd15adf370288384ddd95ef9de05602fb8d87bf76ff835190eb037333c84db8062c
+  languageName: node
+  linkType: hard
+
 "import-meta-resolve@npm:^4.0.0":
   version: 4.2.0
   resolution: "import-meta-resolve@npm:4.2.0"
@@ -8383,13 +9909,20 @@ __metadata:
   languageName: node
   linkType: hard
 
-"inherits@npm:2, inherits@npm:^2.0.3, inherits@npm:^2.0.4, inherits@npm:~2.0.4":
+"inherits@npm:2, inherits@npm:^2.0.3, inherits@npm:^2.0.4, inherits@npm:~2.0.3, inherits@npm:~2.0.4":
   version: 2.0.4
   resolution: "inherits@npm:2.0.4"
   checksum: 10c0/4e531f648b29039fb7426fb94075e6545faa1eb9fe83c29f0b6d9e7263aceb4289d2d4557db0d428188eeb449cc7c5e77b0a0b2c4e248ff2a65933a0dee49ef2
   languageName: node
   linkType: hard
 
+"ini@npm:2.0.0":
+  version: 2.0.0
+  resolution: "ini@npm:2.0.0"
+  checksum: 10c0/2e0c8f386369139029da87819438b20a1ff3fe58372d93fb1a86e9d9344125ace3a806b8ec4eb160a46e64cbc422fe68251869441676af49b7fc441af2389c25
+  languageName: node
+  linkType: hard
+
 "ini@npm:4.1.1":
   version: 4.1.1
   resolution: "ini@npm:4.1.1"
@@ -8397,7 +9930,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ini@npm:~1.3.0":
+"ini@npm:^1.3.4, ini@npm:~1.3.0":
   version: 1.3.8
   resolution: "ini@npm:1.3.8"
   checksum: 10c0/ec93838d2328b619532e4f1ff05df7909760b6f66d9c9e2ded11e5c1897d6f2f9980c54dd638f88654b00919ce31e827040631eab0a3969e4d1abefa0719516a
@@ -8411,6 +9944,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"install-artifact-from-github@npm:^1.7.0":
+  version: 1.7.0
+  resolution: "install-artifact-from-github@npm:1.7.0"
+  bin:
+    hash-github-cache: bin/hash-github-cache.js
+    install-from-cache: bin/install-from-cache.js
+    save-to-github-cache: bin/save-to-github-cache.js
+  checksum: 10c0/f820cedab97ad57c4185c51f9e5c652e8e9531af33ce617a631bb9c0d42d73c648ff26c8a97114a96c9f108b0e7505257052262357bd449e90c446b64f7ded6e
+  languageName: node
+  linkType: hard
+
 "internal-slot@npm:^1.1.0":
   version: 1.1.0
   resolution: "internal-slot@npm:1.1.0"
@@ -8429,6 +9973,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"ip-address@npm:^10.2.0":
+  version: 10.4.0
+  resolution: "ip-address@npm:10.4.0"
+  checksum: 10c0/d7b0bd2624fd861afbae6e49036a9b56f9506eaff7ff38592b7b4492dd5c272b53f5356dc8cc019e318acf29a96c90a3d1af1df761960267d23efa96858270fa
+  languageName: node
+  linkType: hard
+
+"ip-regex@npm:^2.1.0":
+  version: 2.1.0
+  resolution: "ip-regex@npm:2.1.0"
+  checksum: 10c0/3ce2d8307fa0373ca357eba7504e66e73b8121805fd9eba6a343aeb077c64c30659fa876b11ac7a75635b7529d2ce87723f208a5b9d51571513b5c68c0cc1541
+  languageName: node
+  linkType: hard
+
 "ipaddr.js@npm:1.9.1":
   version: 1.9.1
   resolution: "ipaddr.js@npm:1.9.1"
@@ -8476,6 +10034,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"is-binary-path@npm:~2.1.0":
+  version: 2.1.0
+  resolution: "is-binary-path@npm:2.1.0"
+  dependencies:
+    binary-extensions: "npm:^2.0.0"
+  checksum: 10c0/a16eaee59ae2b315ba36fad5c5dcaf8e49c3e27318f8ab8fa3cdb8772bf559c8d1ba750a589c2ccb096113bb64497084361a25960899cb6172a6925ab6123d38
+  languageName: node
+  linkType: hard
+
 "is-boolean-object@npm:^1.2.1":
   version: 1.2.2
   resolution: "is-boolean-object@npm:1.2.2"
@@ -8493,6 +10060,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"is-ci@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "is-ci@npm:2.0.0"
+  dependencies:
+    ci-info: "npm:^2.0.0"
+  bin:
+    is-ci: bin.js
+  checksum: 10c0/17de4e2cd8f993c56c86472dd53dd9e2c7f126d0ee55afe610557046cdd64de0e8feadbad476edc9eeff63b060523b8673d9094ed2ab294b59efb5a66dd05a9a
+  languageName: node
+  linkType: hard
+
 "is-core-module@npm:^2.13.0, is-core-module@npm:^2.16.1":
   version: 2.16.1
   resolution: "is-core-module@npm:2.16.1"
@@ -8568,7 +10146,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-glob@npm:^4.0.0, is-glob@npm:^4.0.1, is-glob@npm:^4.0.3":
+"is-glob@npm:^4.0.0, is-glob@npm:^4.0.1, is-glob@npm:^4.0.3, is-glob@npm:~4.0.1":
   version: 4.0.3
   resolution: "is-glob@npm:4.0.3"
   dependencies:
@@ -8577,6 +10155,23 @@ __metadata:
   languageName: node
   linkType: hard
 
+"is-installed-globally@npm:^0.4.0":
+  version: 0.4.0
+  resolution: "is-installed-globally@npm:0.4.0"
+  dependencies:
+    global-dirs: "npm:^3.0.0"
+    is-path-inside: "npm:^3.0.2"
+  checksum: 10c0/f3e6220ee5824b845c9ed0d4b42c24272701f1f9926936e30c0e676254ca5b34d1b92c6205cae11b283776f9529212c0cdabb20ec280a6451677d6493ca9c22d
+  languageName: node
+  linkType: hard
+
+"is-interactive@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "is-interactive@npm:1.0.0"
+  checksum: 10c0/dd47904dbf286cd20aa58c5192161be1a67138485b9836d5a70433b21a45442e9611b8498b8ab1f839fc962c7620667a50535fdfb4a6bc7989b8858645c06b4d
+  languageName: node
+  linkType: hard
+
 "is-interactive@npm:^2.0.0":
   version: 2.0.0
   resolution: "is-interactive@npm:2.0.0"
@@ -8605,6 +10200,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"is-npm@npm:^5.0.0":
+  version: 5.0.0
+  resolution: "is-npm@npm:5.0.0"
+  checksum: 10c0/8ded3ae1119bbbda22395fe1c64d2d79d3b3baeb2635c90f9a9dca4b8ce19a67b55fda178269b63421b257b361892fd545807fb5ac212f06776f544d9fcc3ab0
+  languageName: node
+  linkType: hard
+
 "is-number-object@npm:^1.1.1":
   version: 1.1.1
   resolution: "is-number-object@npm:1.1.1"
@@ -8629,7 +10231,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-path-inside@npm:^3.0.3":
+"is-path-inside@npm:^3.0.2, is-path-inside@npm:^3.0.3":
   version: 3.0.3
   resolution: "is-path-inside@npm:3.0.3"
   checksum: 10c0/cf7d4ac35fb96bab6a1d2c3598fe5ebb29aafb52c0aaa482b5a3ed9d8ba3edc11631e3ec2637660c44b3ce0e61a08d54946e8af30dec0b60a7c27296c68ffd05
@@ -8671,7 +10273,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-stream@npm:^2.0.0":
+"is-stream-ended@npm:^0.1.4":
+  version: 0.1.4
+  resolution: "is-stream-ended@npm:0.1.4"
+  checksum: 10c0/fa4136d91d44f54aabeedd7b8072e03e0e4a6dac4cd47000152781ccad6451787e39ae5db15e7400a261e4d8ef976713237d49c773856548dbf171cc82893afc
+  languageName: node
+  linkType: hard
+
+"is-stream@npm:^2.0.0, is-stream@npm:^2.0.1":
   version: 2.0.1
   resolution: "is-stream@npm:2.0.1"
   checksum: 10c0/7c284241313fc6efc329b8d7f08e16c0efeb6baab1b4cd0ba579eb78e5af1aa5da11e68559896a2067cd6c526bd29241dda4eb1225e627d5aa1a89a76d4635a5
@@ -8717,6 +10326,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"is-typedarray@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "is-typedarray@npm:1.0.0"
+  checksum: 10c0/4c096275ba041a17a13cca33ac21c16bc4fd2d7d7eb94525e7cd2c2f2c1a3ab956e37622290642501ff4310601e413b675cf399ad6db49855527d2163b3eeeec
+  languageName: node
+  linkType: hard
+
+"is-unicode-supported@npm:^0.1.0":
+  version: 0.1.0
+  resolution: "is-unicode-supported@npm:0.1.0"
+  checksum: 10c0/00cbe3455c3756be68d2542c416cab888aebd5012781d6819749fefb15162ff23e38501fe681b3d751c73e8ff561ac09a5293eba6f58fdf0178462ce6dcb3453
+  languageName: node
+  linkType: hard
+
 "is-unicode-supported@npm:^2.0.0, is-unicode-supported@npm:^2.1.0":
   version: 2.1.0
   resolution: "is-unicode-supported@npm:2.1.0"
@@ -8724,6 +10347,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"is-url@npm:^1.2.2":
+  version: 1.2.4
+  resolution: "is-url@npm:1.2.4"
+  checksum: 10c0/0157a79874f8f95fdd63540e3f38c8583c2ef572661cd0693cda80ae3e42dfe8e9a4a972ec1b827f861d9a9acf75b37f7d58a37f94a8a053259642912c252bc3
+  languageName: node
+  linkType: hard
+
 "is-weakmap@npm:^2.0.2":
   version: 2.0.2
   resolution: "is-weakmap@npm:2.0.2"
@@ -8750,6 +10380,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"is-wsl@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "is-wsl@npm:1.1.0"
+  checksum: 10c0/7ad0012f21092d6f586c7faad84755a8ef0da9b9ec295e4dc82313cce4e1a93a3da3c217265016461f9b141503fe55fa6eb1fd5457d3f05e8d1bdbb48e50c13a
+  languageName: node
+  linkType: hard
+
 "is-wsl@npm:^2.1.1":
   version: 2.2.0
   resolution: "is-wsl@npm:2.2.0"
@@ -8759,6 +10396,31 @@ __metadata:
   languageName: node
   linkType: hard
 
+"is-yarn-global@npm:^0.3.0":
+  version: 0.3.0
+  resolution: "is-yarn-global@npm:0.3.0"
+  checksum: 10c0/9f1ab6f28e6e7961c4b97e564791d1decf2886a0dbe9b92b2176d76156adbb42b4c06c0f33d7107b270c207cbcfe0b2293b7cc4a0ec6774ac6d37af9503d51e1
+  languageName: node
+  linkType: hard
+
+"is2@npm:2.0.1":
+  version: 2.0.1
+  resolution: "is2@npm:2.0.1"
+  dependencies:
+    deep-is: "npm:^0.1.3"
+    ip-regex: "npm:^2.1.0"
+    is-url: "npm:^1.2.2"
+  checksum: 10c0/f8f11258890c1b0c38d1dff02742b06218518ca94ef389022b32b43442149b23d5b17d3d264c22e0cd18447196b48d26b74190deb59ae219fb6506d53fc7f2d3
+  languageName: node
+  linkType: hard
+
+"isarray@npm:0.0.1":
+  version: 0.0.1
+  resolution: "isarray@npm:0.0.1"
+  checksum: 10c0/ed1e62da617f71fe348907c71743b5ed550448b455f8d269f89a7c7ddb8ae6e962de3dab6a74a237b06f5eb7f6ece7a45ada8ce96d87fe972926530f91ae3311
+  languageName: node
+  linkType: hard
+
 "isarray@npm:^2.0.5":
   version: 2.0.5
   resolution: "isarray@npm:2.0.5"
@@ -8766,6 +10428,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"isarray@npm:~1.0.0":
+  version: 1.0.0
+  resolution: "isarray@npm:1.0.0"
+  checksum: 10c0/18b5be6669be53425f0b84098732670ed4e727e3af33bc7f948aac01782110eb9a18b3b329c5323bcdd3acdaae547ee077d3951317e7f133bff7105264b3003d
+  languageName: node
+  linkType: hard
+
 "isexe@npm:^2.0.0":
   version: 2.0.0
   resolution: "isexe@npm:2.0.0"
@@ -8780,6 +10449,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"isomorphic-fetch@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "isomorphic-fetch@npm:3.0.0"
+  dependencies:
+    node-fetch: "npm:^2.6.1"
+    whatwg-fetch: "npm:^3.4.1"
+  checksum: 10c0/511b1135c6d18125a07de661091f5e7403b7640060355d2d704ce081e019bc1862da849482d079ce5e2559b8976d3de7709566063aec1b908369c0b98a2b075b
+  languageName: node
+  linkType: hard
+
 "istanbul-lib-coverage@npm:^3.0.0, istanbul-lib-coverage@npm:^3.2.2":
   version: 3.2.2
   resolution: "istanbul-lib-coverage@npm:3.2.2"
@@ -8846,13 +10525,24 @@ __metadata:
   languageName: node
   linkType: hard
 
-"jju@npm:~1.4.0":
+"jju@npm:^1.1.0, jju@npm:~1.4.0":
   version: 1.4.0
   resolution: "jju@npm:1.4.0"
   checksum: 10c0/f3f444557e4364cfc06b1abf8331bf3778b26c0c8552ca54429bc0092652172fdea26cbffe33e1017b303d5aa506f7ede8571857400efe459cb7439180e2acad
   languageName: node
   linkType: hard
 
+"join-path@npm:^1.1.1":
+  version: 1.1.1
+  resolution: "join-path@npm:1.1.1"
+  dependencies:
+    as-array: "npm:^2.0.0"
+    url-join: "npm:0.0.1"
+    valid-url: "npm:^1"
+  checksum: 10c0/16b3e1a97e4fe18406ff069df5b11c262ebb06c3ffa2accb25f71721fc8aefbfbf3e6bf94b9b1c58639b80d9046d5eb4c2e6bdc26c9d8d9d605003061e29ab6f
+  languageName: node
+  linkType: hard
+
 "jose@npm:^4.15.4":
   version: 4.15.9
   resolution: "jose@npm:4.15.9"
@@ -8860,6 +10550,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"jose@npm:^6.1.3":
+  version: 6.2.8
+  resolution: "jose@npm:6.2.8"
+  checksum: 10c0/fe4c6a7197a1adab2251b000c1eaaa8b40b6cb7cfbef43dbc9e959dacd43bf2532827b2d5e0f4069731da79d26e4d9e4368ccb26559a42a884b3fe036927e6e1
+  languageName: node
+  linkType: hard
+
 "js-tokens@npm:^10.0.0":
   version: 10.0.0
   resolution: "js-tokens@npm:10.0.0"
@@ -8924,6 +10621,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"json-parse-helpfulerror@npm:^1.0.3":
+  version: 1.0.3
+  resolution: "json-parse-helpfulerror@npm:1.0.3"
+  dependencies:
+    jju: "npm:^1.1.0"
+  checksum: 10c0/5104d0c41792179370c59e3a82760e952bb8ecd83075f76a1eaab90719292aea0072fed6d3efb1b4a2e9b7e88930c378aa4e6e29ca67d0c9e9826331499eb822
+  languageName: node
+  linkType: hard
+
+"json-ptr@npm:^3.0.1":
+  version: 3.1.1
+  resolution: "json-ptr@npm:3.1.1"
+  checksum: 10c0/f5fd7eb60a8ad52e3531eea8285d22a67bf67a16249da032cd42fabcac386135adbe8c64a5588f5b755e77b9e646ca5cc97782fe09c5cef0b6d24ebdd1e1c277
+  languageName: node
+  linkType: hard
+
 "json-schema-traverse@npm:^0.4.1":
   version: 0.4.1
   resolution: "json-schema-traverse@npm:0.4.1"
@@ -8938,6 +10651,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"json-schema-typed@npm:^8.0.2":
+  version: 8.0.2
+  resolution: "json-schema-typed@npm:8.0.2"
+  checksum: 10c0/89f5e2fb1495483b705c027203c07277ee6bf2665165ad25a9cb55de5af7f72570326d13d32565180781e4083ad5c9688102f222baed7b353c2f39c1e02b0428
+  languageName: node
+  linkType: hard
+
 "json-stable-stringify-without-jsonify@npm:^1.0.1":
   version: 1.0.1
   resolution: "json-stable-stringify-without-jsonify@npm:1.0.1"
@@ -9108,6 +10828,29 @@ __metadata:
   languageName: node
   linkType: hard
 
+"kuler@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "kuler@npm:2.0.0"
+  checksum: 10c0/0a4e99d92ca373f8f74d1dc37931909c4d0d82aebc94cf2ba265771160fc12c8df34eaaac80805efbda367e2795cb1f1dd4c3d404b6b1cf38aec94035b503d2d
+  languageName: node
+  linkType: hard
+
+"lazystream@npm:^1.0.0":
+  version: 1.0.1
+  resolution: "lazystream@npm:1.0.1"
+  dependencies:
+    readable-stream: "npm:^2.0.5"
+  checksum: 10c0/ea4e509a5226ecfcc303ba6782cc269be8867d372b9bcbd625c88955df1987ea1a20da4643bf9270336415a398d33531ebf0d5f0d393b9283dc7c98bfcbd7b69
+  languageName: node
+  linkType: hard
+
+"leven@npm:^3.1.0":
+  version: 3.1.0
+  resolution: "leven@npm:3.1.0"
+  checksum: 10c0/cd778ba3fbab0f4d0500b7e87d1f6e1f041507c56fdcd47e8256a3012c98aaee371d4c15e0a76e0386107af2d42e2b7466160a2d80688aaa03e66e49949f42df
+  languageName: node
+  linkType: hard
+
 "levn@npm:^0.4.1":
   version: 0.4.1
   resolution: "levn@npm:0.4.1"
@@ -9125,6 +10868,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"libsodium-wrappers@npm:^0.7.10":
+  version: 0.7.16
+  resolution: "libsodium-wrappers@npm:0.7.16"
+  dependencies:
+    libsodium: "npm:^0.7.16"
+  checksum: 10c0/7e6b5f3db8b8a3181e713b5017e000384142137a1712cd4c966f11f03e53ee5169c3277b80c3f2b68676f7e9a6ad141e58ce8b6a71728538b42d1201a566faf6
+  languageName: node
+  linkType: hard
+
+"libsodium@npm:^0.7.16":
+  version: 0.7.16
+  resolution: "libsodium@npm:0.7.16"
+  checksum: 10c0/4f1edd4d5d703c20505bbed74bf0dea22db7b9787cfbe4ab9572f0f4ca16f7a5d1d90e18a822ee4d91058a7c9701f82a24a5f22d0a29be5203b9ab9d8c037bda
+  languageName: node
+  linkType: hard
+
 "lightningcss-android-arm64@npm:1.32.0":
   version: 1.32.0
   resolution: "lightningcss-android-arm64@npm:1.32.0"
@@ -9420,6 +11179,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"lodash._objecttypes@npm:~2.4.1":
+  version: 2.4.1
+  resolution: "lodash._objecttypes@npm:2.4.1"
+  checksum: 10c0/edb72879107c6072d67aa733eebf534c67a1963118f961e18d46834ed33e1d58f11b491b1709f1217cc1b8d4ca5336618ed3994f4f7d89dbd4cef5cc11d7bf73
+  languageName: node
+  linkType: hard
+
 "lodash.camelcase@npm:^4.3.0":
   version: 4.3.0
   resolution: "lodash.camelcase@npm:4.3.0"
@@ -9462,6 +11228,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"lodash.isobject@npm:^2.4.1":
+  version: 2.4.1
+  resolution: "lodash.isobject@npm:2.4.1"
+  dependencies:
+    lodash._objecttypes: "npm:~2.4.1"
+  checksum: 10c0/836a7567947bb01c054bdf4f1c8cc533d5dd053362368f16e5e5cdd1c5cfcf0ff219929e911b671cd9ae536f48318e41abb13a3557e5ec33fd400e262cf58792
+  languageName: node
+  linkType: hard
+
 "lodash.isplainobject@npm:^4.0.6":
   version: 4.0.6
   resolution: "lodash.isplainobject@npm:4.0.6"
@@ -9539,6 +11314,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"log-symbols@npm:^4.1.0":
+  version: 4.1.0
+  resolution: "log-symbols@npm:4.1.0"
+  dependencies:
+    chalk: "npm:^4.1.0"
+    is-unicode-supported: "npm:^0.1.0"
+  checksum: 10c0/67f445a9ffa76db1989d0fa98586e5bc2fd5247260dafb8ad93d9f0ccd5896d53fb830b0e54dade5ad838b9de2006c826831a3c528913093af20dff8bd24aca6
+  languageName: node
+  linkType: hard
+
 "log-symbols@npm:^7.0.1":
   version: 7.0.1
   resolution: "log-symbols@npm:7.0.1"
@@ -9549,7 +11334,21 @@ __metadata:
   languageName: node
   linkType: hard
 
-"long@npm:^5.0.0":
+"logform@npm:^2.7.0":
+  version: 2.7.0
+  resolution: "logform@npm:2.7.0"
+  dependencies:
+    "@colors/colors": "npm:1.6.0"
+    "@types/triple-beam": "npm:^1.3.2"
+    fecha: "npm:^4.2.0"
+    ms: "npm:^2.1.1"
+    safe-stable-stringify: "npm:^2.3.1"
+    triple-beam: "npm:^1.3.0"
+  checksum: 10c0/4789b4b37413c731d1835734cb799240d31b865afde6b7b3e06051d6a4127bfda9e88c99cfbf296d084a315ccbed2647796e6a56b66e725bcb268c586f57558f
+  languageName: node
+  linkType: hard
+
+"long@npm:^5.0.0, long@npm:^5.3.1, long@npm:^5.3.2":
   version: 5.3.2
   resolution: "long@npm:5.3.2"
   checksum: 10c0/7130fe1cbce2dca06734b35b70d380ca3f70271c7f8852c922a7c62c86c4e35f0c39290565eca7133c625908d40e126ac57c02b1b1a4636b9457d77e1e60b981
@@ -9576,7 +11375,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lru-cache@npm:^10.2.0":
+"lru-cache@npm:^10.0.1, lru-cache@npm:^10.2.0":
   version: 10.4.3
   resolution: "lru-cache@npm:10.4.3"
   checksum: 10c0/ebd04fbca961e6c1d6c0af3799adcc966a1babe798f685bb84e6599266599cd95d94630b10262f5424539bc4640107e8a33aa28585374abf561d30d16f4b39fb
@@ -9599,6 +11398,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"lru-cache@npm:^7.14.1":
+  version: 7.18.3
+  resolution: "lru-cache@npm:7.18.3"
+  checksum: 10c0/b3a452b491433db885beed95041eb104c157ef7794b9c9b4d647be503be91769d11206bb573849a16b4cc0d03cbd15ffd22df7960997788b74c1d399ac7a4fed
+  languageName: node
+  linkType: hard
+
 "lru-memoizer@npm:^2.2.0":
   version: 2.3.0
   resolution: "lru-memoizer@npm:2.3.0"
@@ -9609,6 +11415,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"lsofi@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "lsofi@npm:2.0.0"
+  checksum: 10c0/4f6d08a39a2cbcb595d7f801bbe37ab16959278f4d317bc58715d0edb038ed33036106d4e3e74fde413c162c8f782a3de2e10dfa98f859b8e1e6b56e84d85b6e
+  languageName: node
+  linkType: hard
+
 "lunr@npm:^2.3.9":
   version: 2.3.9
   resolution: "lunr@npm:2.3.9"
@@ -9636,7 +11449,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"make-dir@npm:^3.1.0":
+"make-dir@npm:^3.0.0, make-dir@npm:^3.1.0":
   version: 3.1.0
   resolution: "make-dir@npm:3.1.0"
   dependencies:
@@ -9758,6 +11571,32 @@ __metadata:
   languageName: node
   linkType: hard
 
+"marked-terminal@npm:^7.0.0":
+  version: 7.3.0
+  resolution: "marked-terminal@npm:7.3.0"
+  dependencies:
+    ansi-escapes: "npm:^7.0.0"
+    ansi-regex: "npm:^6.1.0"
+    chalk: "npm:^5.4.1"
+    cli-highlight: "npm:^2.1.11"
+    cli-table3: "npm:^0.6.5"
+    node-emoji: "npm:^2.2.0"
+    supports-hyperlinks: "npm:^3.1.0"
+  peerDependencies:
+    marked: ">=1 <16"
+  checksum: 10c0/59d23c2ed9488c40856d828f431ae1d5d57426e791bbce8f05ec5a7d3a1f848cdb3b8d8880d76ae45570415f8b48ae459f50bbbd88ece5a31306f1e3de57f021
+  languageName: node
+  linkType: hard
+
+"marked@npm:^13.0.2":
+  version: 13.0.3
+  resolution: "marked@npm:13.0.3"
+  bin:
+    marked: bin/marked.js
+  checksum: 10c0/b1121f420f815206ae5ae109b9b0eb6c21f84d8d459cbe38ffa00543652e091f36a55c2c96ff1414821d8752682af8c0de3f44f0a2a5bd9c8612a4ef520e9b3d
+  languageName: node
+  linkType: hard
+
 "marked@npm:^4.3.0":
   version: 4.3.0
   resolution: "marked@npm:4.3.0"
@@ -9802,6 +11641,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"merge-descriptors@npm:1.0.3":
+  version: 1.0.3
+  resolution: "merge-descriptors@npm:1.0.3"
+  checksum: 10c0/866b7094afd9293b5ea5dcd82d71f80e51514bed33b4c4e9f516795dc366612a4cbb4dc94356e943a8a6914889a914530badff27f397191b9b75cda20b6bae93
+  languageName: node
+  linkType: hard
+
 "merge-descriptors@npm:^2.0.0":
   version: 2.0.0
   resolution: "merge-descriptors@npm:2.0.0"
@@ -9816,7 +11662,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"methods@npm:^1.1.2":
+"methods@npm:^1.1.2, methods@npm:~1.1.2":
   version: 1.1.2
   resolution: "methods@npm:1.1.2"
   checksum: 10c0/bdf7cc72ff0a33e3eede03708c08983c4d7a173f91348b4b1e4f47d4cdbf734433ad971e7d1e8c77247d9e5cd8adb81ea4c67b0a2db526b758b2233d7814b8b2
@@ -9840,14 +11686,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"mime-db@npm:^1.54.0":
+"mime-db@npm:>= 1.43.0 < 2, mime-db@npm:^1.54.0":
   version: 1.54.0
   resolution: "mime-db@npm:1.54.0"
   checksum: 10c0/8d907917bc2a90fa2df842cdf5dfeaf509adc15fe0531e07bb2f6ab15992416479015828d6a74200041c492e42cce3ebf78e5ce714388a0a538ea9c53eece284
   languageName: node
   linkType: hard
 
-"mime-types@npm:^2.1.35, mime-types@npm:~2.1.24":
+"mime-types@npm:^2.1.35, mime-types@npm:~2.1.24, mime-types@npm:~2.1.34":
   version: 2.1.35
   resolution: "mime-types@npm:2.1.35"
   dependencies:
@@ -9865,7 +11711,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"mime@npm:2.6.0":
+"mime@npm:1.6.0":
+  version: 1.6.0
+  resolution: "mime@npm:1.6.0"
+  bin:
+    mime: cli.js
+  checksum: 10c0/b92cd0adc44888c7135a185bfd0dddc42c32606401c72896a842ae15da71eb88858f17669af41e498b463cd7eb998f7b48939a25b08374c7924a9c8a6f8a81b0
+  languageName: node
+  linkType: hard
+
+"mime@npm:2.6.0, mime@npm:^2.5.2":
   version: 2.6.0
   resolution: "mime@npm:2.6.0"
   bin:
@@ -9883,6 +11738,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"mimic-fn@npm:^2.1.0":
+  version: 2.1.0
+  resolution: "mimic-fn@npm:2.1.0"
+  checksum: 10c0/b26f5479d7ec6cc2bce275a08f146cf78f5e7b661b18114e2506dd91ec7ec47e7a25bf4360e5438094db0560bcc868079fb3b1fb3892b833c1ecbf63f80c95a4
+  languageName: node
+  linkType: hard
+
 "mimic-function@npm:^5.0.0":
   version: 5.0.1
   resolution: "mimic-function@npm:5.0.1"
@@ -9924,6 +11786,24 @@ __metadata:
   languageName: node
   linkType: hard
 
+"minimatch@npm:^5.1.0":
+  version: 5.1.9
+  resolution: "minimatch@npm:5.1.9"
+  dependencies:
+    brace-expansion: "npm:^2.0.1"
+  checksum: 10c0/4202718683815a7288b13e470160a4f9560cf392adef4f453927505817e01ef6b3476ecde13cfcaed17e7326dd3b69ad44eb2daeb19a217c5500f9277893f1d6
+  languageName: node
+  linkType: hard
+
+"minimatch@npm:^6.1.6":
+  version: 6.2.3
+  resolution: "minimatch@npm:6.2.3"
+  dependencies:
+    brace-expansion: "npm:^2.0.1"
+  checksum: 10c0/c3490c52588183770f77a3924a1e9c6c6e34938f750670cd524e073f3f5698423b2004b2883262e46648448bc3a52249121d85d795f86bb4122e3a595169d61e
+  languageName: node
+  linkType: hard
+
 "minimatch@npm:^9.0.3, minimatch@npm:^9.0.4, minimatch@npm:~9.0.4":
   version: 9.0.5
   resolution: "minimatch@npm:9.0.5"
@@ -10082,7 +11962,41 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ms@npm:^2.0.0, ms@npm:^2.1.1, ms@npm:^2.1.3":
+"moo@npm:^0.5.0":
+  version: 0.5.3
+  resolution: "moo@npm:0.5.3"
+  checksum: 10c0/5c5e00d7c57a69ce1cc2f21a90655ff10556481cc10fa70528c01e91f00deff8a65fa8da6dc7b27d136d66085055aab238fd1b19a75070263e0028e8f07c8213
+  languageName: node
+  linkType: hard
+
+"morgan@npm:^1.10.0, morgan@npm:^1.8.2":
+  version: 1.11.0
+  resolution: "morgan@npm:1.11.0"
+  dependencies:
+    basic-auth: "npm:~2.0.1"
+    debug: "npm:2.6.9"
+    depd: "npm:~2.0.0"
+    on-finished: "npm:~2.4.1"
+    on-headers: "npm:~1.1.0"
+  checksum: 10c0/1d8c67bdeb34dc4112f5b6cbff0d5b4ef14bfdcb9f67a7ae67fc7a77282c18dd493a11dc8dff1ff2e285c1846947cfdc3698fdceb1fa7bea2a09fe6cb754455d
+  languageName: node
+  linkType: hard
+
+"ms@npm:2.0.0":
+  version: 2.0.0
+  resolution: "ms@npm:2.0.0"
+  checksum: 10c0/f8fda810b39fd7255bbdc451c46286e549794fcc700dc9cd1d25658bbc4dc2563a5de6fe7c60f798a16a60c6ceb53f033cb353f493f0cf63e5199b702943159d
+  languageName: node
+  linkType: hard
+
+"ms@npm:2.1.2":
+  version: 2.1.2
+  resolution: "ms@npm:2.1.2"
+  checksum: 10c0/a437714e2f90dbf881b5191d35a6db792efbca5badf112f87b9e1c712aace4b4b9b742dd6537f3edf90fd6f684de897cec230abde57e87883766712ddda297cc
+  languageName: node
+  linkType: hard
+
+"ms@npm:2.1.3, ms@npm:^2.0.0, ms@npm:^2.1.1, ms@npm:^2.1.3":
   version: 2.1.3
   resolution: "ms@npm:2.1.3"
   checksum: 10c0/d924b57e7312b3b63ad21fc5b3dc0af5e78d61a1fc7cfb5457edaf26326bf62be5307cc87ffb6862ef1c2b33b0233cdb5d4f01c4c958cc0d660948b65a287a48
@@ -10115,6 +12029,26 @@ __metadata:
   languageName: node
   linkType: hard
 
+"mz@npm:^2.4.0":
+  version: 2.7.0
+  resolution: "mz@npm:2.7.0"
+  dependencies:
+    any-promise: "npm:^1.0.0"
+    object-assign: "npm:^4.0.1"
+    thenify-all: "npm:^1.0.0"
+  checksum: 10c0/103114e93f87362f0b56ab5b2e7245051ad0276b646e3902c98397d18bb8f4a77f2ea4a2c9d3ad516034ea3a56553b60d3f5f78220001ca4c404bd711bd0af39
+  languageName: node
+  linkType: hard
+
+"nan@npm:^2.28.0":
+  version: 2.28.0
+  resolution: "nan@npm:2.28.0"
+  dependencies:
+    node-gyp: "npm:latest"
+  checksum: 10c0/84e45fbb6a249df751bba657728792a8d93e3b10bad9774200c858d1ff38723c988c3e4cef50b3742fa8a05da2e49fa16806f6d768405382d8b1094d10d42fa5
+  languageName: node
+  linkType: hard
+
 "nanoid@npm:^3.3.12":
   version: 3.3.12
   resolution: "nanoid@npm:3.3.12"
@@ -10154,7 +12088,31 @@ __metadata:
   languageName: node
   linkType: hard
 
-"negotiator@npm:^0.6.2":
+"nearley@npm:^2.20.1":
+  version: 2.20.1
+  resolution: "nearley@npm:2.20.1"
+  dependencies:
+    commander: "npm:^2.19.0"
+    moo: "npm:^0.5.0"
+    railroad-diagrams: "npm:^1.0.0"
+    randexp: "npm:0.4.6"
+  bin:
+    nearley-railroad: bin/nearley-railroad.js
+    nearley-test: bin/nearley-test.js
+    nearley-unparse: bin/nearley-unparse.js
+    nearleyc: bin/nearleyc.js
+  checksum: 10c0/d25e1fd40b19c53a0ada6a688670f4a39063fd9553ab62885e81a82927d51572ce47193b946afa3d85efa608ba2c68f433c421f69b854bfb7f599eacb5fae37e
+  languageName: node
+  linkType: hard
+
+"negotiator@npm:0.6.3":
+  version: 0.6.3
+  resolution: "negotiator@npm:0.6.3"
+  checksum: 10c0/3ec9fd413e7bf071c937ae60d572bc67155262068ed522cf4b3be5edbe6ddf67d095ec03a3a14ebf8fc8e95f8e1d61be4869db0dbb0de696f6b837358bd43fc2
+  languageName: node
+  linkType: hard
+
+"negotiator@npm:^0.6.2, negotiator@npm:~0.6.4":
   version: 0.6.4
   resolution: "negotiator@npm:0.6.4"
   checksum: 10c0/3e677139c7fb7628a6f36335bf11a885a62c21d5390204590a1a214a5631fcbe5ea74ef6a610b60afe84b4d975cbe0566a23f20ee17c77c73e74b80032108dea
@@ -10185,6 +12143,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"netmask@npm:^2.0.2":
+  version: 2.1.1
+  resolution: "netmask@npm:2.1.1"
+  checksum: 10c0/c78e31869b0578fb0a9874a0c0fdf0e1f8b3492392d1043355fb11d9ea42ef94e0216c6aee7d8e15db39d1a8caf331f9b144ae3ee43fd951b73a66837711fb09
+  languageName: node
+  linkType: hard
+
 "node-abi@npm:^3.3.0":
   version: 3.87.0
   resolution: "node-abi@npm:3.87.0"
@@ -10219,7 +12184,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"node-emoji@npm:2.2.0":
+"node-emoji@npm:2.2.0, node-emoji@npm:^2.2.0":
   version: 2.2.0
   resolution: "node-emoji@npm:2.2.0"
   dependencies:
@@ -10231,7 +12196,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"node-fetch@npm:^2.6.7, node-fetch@npm:^2.6.9, node-fetch@npm:^2.7.0":
+"node-fetch@npm:^2.6.1, node-fetch@npm:^2.6.7, node-fetch@npm:^2.6.9, node-fetch@npm:^2.7.0":
   version: 2.7.0
   resolution: "node-fetch@npm:2.7.0"
   dependencies:
@@ -10283,6 +12248,26 @@ __metadata:
   languageName: node
   linkType: hard
 
+"node-gyp@npm:^13.0.1":
+  version: 13.0.1
+  resolution: "node-gyp@npm:13.0.1"
+  dependencies:
+    env-paths: "npm:^2.2.0"
+    exponential-backoff: "npm:^3.1.1"
+    graceful-fs: "npm:^4.2.6"
+    nopt: "npm:^10.0.0"
+    proc-log: "npm:^7.0.0"
+    semver: "npm:^7.3.5"
+    tar: "npm:^7.5.4"
+    tinyglobby: "npm:^0.2.12"
+    undici: "npm:^8.4.1"
+    which: "npm:^7.0.0"
+  bin:
+    node-gyp: bin/node-gyp.js
+  checksum: 10c0/424077bc9e9bbe953a8e86db473ba818cbc6a121714008c977fd589e21e5f0c811fbf22faac730dc7182450b5e52df301811d01ae3373898658d999b7710f4e6
+  languageName: node
+  linkType: hard
+
 "node-gyp@npm:latest":
   version: 12.2.0
   resolution: "node-gyp@npm:12.2.0"
@@ -10310,6 +12295,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"nopt@npm:^10.0.0":
+  version: 10.0.1
+  resolution: "nopt@npm:10.0.1"
+  dependencies:
+    abbrev: "npm:^5.0.0"
+  bin:
+    nopt: bin/nopt.js
+  checksum: 10c0/980d89257f9587f3e1f77877ddbf905d6aa3b738ec33e49a4fa1a059a0dd82eb28063982b150654a7ae9de386f2ead60e56172db7d37cf56de545f7392a2a26a
+  languageName: node
+  linkType: hard
+
 "nopt@npm:^5.0.0":
   version: 5.0.0
   resolution: "nopt@npm:5.0.0"
@@ -10332,6 +12328,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"normalize-path@npm:^3.0.0, normalize-path@npm:~3.0.0":
+  version: 3.0.0
+  resolution: "normalize-path@npm:3.0.0"
+  checksum: 10c0/e008c8142bcc335b5e38cf0d63cfd39d6cf2d97480af9abdbe9a439221fd4d749763bab492a8ee708ce7a194bb00c9da6d0a115018672310850489137b3da046
+  languageName: node
+  linkType: hard
+
 "notation@npm:^1.3.6":
   version: 1.3.6
   resolution: "notation@npm:1.3.6"
@@ -10339,6 +12342,46 @@ __metadata:
   languageName: node
   linkType: hard
 
+"npm-install-checks@npm:^6.0.0":
+  version: 6.3.0
+  resolution: "npm-install-checks@npm:6.3.0"
+  dependencies:
+    semver: "npm:^7.1.1"
+  checksum: 10c0/b046ef1de9b40f5d3a9831ce198e1770140a1c3f253dae22eb7b06045191ef79f18f1dcc15a945c919b3c161426861a28050abd321bf439190185794783b6452
+  languageName: node
+  linkType: hard
+
+"npm-normalize-package-bin@npm:^3.0.0":
+  version: 3.0.1
+  resolution: "npm-normalize-package-bin@npm:3.0.1"
+  checksum: 10c0/f1831a7f12622840e1375c785c3dab7b1d82dd521211c17ee5e9610cd1a34d8b232d3fdeebf50c170eddcb321d2c644bf73dbe35545da7d588c6b3fa488db0a5
+  languageName: node
+  linkType: hard
+
+"npm-package-arg@npm:^11.0.0":
+  version: 11.0.3
+  resolution: "npm-package-arg@npm:11.0.3"
+  dependencies:
+    hosted-git-info: "npm:^7.0.0"
+    proc-log: "npm:^4.0.0"
+    semver: "npm:^7.3.5"
+    validate-npm-package-name: "npm:^5.0.0"
+  checksum: 10c0/e18333485e05c3a8774f4b5701ef74f4799533e650b70a68ca8dd697666c9a8d46932cb765fc593edce299521033bd4025a40323d5240cea8a393c784c0c285a
+  languageName: node
+  linkType: hard
+
+"npm-pick-manifest@npm:^9.0.0":
+  version: 9.1.0
+  resolution: "npm-pick-manifest@npm:9.1.0"
+  dependencies:
+    npm-install-checks: "npm:^6.0.0"
+    npm-normalize-package-bin: "npm:^3.0.0"
+    npm-package-arg: "npm:^11.0.0"
+    semver: "npm:^7.3.5"
+  checksum: 10c0/8765f4199755b381323da2bff2202b4b15b59f59dba0d1be3f2f793b591321cd19e1b5a686ef48d9753a6bd4868550da632541a45dfb61809d55664222d73e44
+  languageName: node
+  linkType: hard
+
 "npmlog@npm:^5.0.1":
   version: 5.0.1
   resolution: "npmlog@npm:5.0.1"
@@ -10363,7 +12406,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"object-assign@npm:^4, object-assign@npm:^4.1.1":
+"object-assign@npm:^4, object-assign@npm:^4.0.1, object-assign@npm:^4.1.1":
   version: 4.1.1
   resolution: "object-assign@npm:4.1.1"
   checksum: 10c0/1f4df9945120325d041ccf7b86f31e8bcc14e73d29171e37a7903050e96b81323784ec59f93f102ec635bcf6fa8034ba3ea0a8c7e69fa202b87ae3b6cec5a414
@@ -10447,7 +12490,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"on-finished@npm:^2.4.1":
+"on-finished@npm:^2.2.0, on-finished@npm:^2.4.1, on-finished@npm:~2.4.1":
   version: 2.4.1
   resolution: "on-finished@npm:2.4.1"
   dependencies:
@@ -10456,6 +12499,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"on-finished@npm:~2.3.0":
+  version: 2.3.0
+  resolution: "on-finished@npm:2.3.0"
+  dependencies:
+    ee-first: "npm:1.1.1"
+  checksum: 10c0/c904f9e518b11941eb60279a3cbfaf1289bd0001f600a950255b1dede9fe3df8cd74f38483550b3bb9485165166acb5db500c3b4c4337aec2815c88c96fcc2ea
+  languageName: node
+  linkType: hard
+
+"on-headers@npm:^1.0.0, on-headers@npm:~1.1.0":
+  version: 1.1.0
+  resolution: "on-headers@npm:1.1.0"
+  checksum: 10c0/2c3b6b0d68ec9adbd561dc2d61c9b14da8ac03d8a2f0fd9e97bdf0600c887d5d97f664ff3be6876cf40cda6e3c587d73a4745e10b426ac50c7664fc5a0dfc0a1
+  languageName: node
+  linkType: hard
+
 "once@npm:^1.3.0, once@npm:^1.3.1, once@npm:^1.4.0":
   version: 1.4.0
   resolution: "once@npm:1.4.0"
@@ -10465,6 +12524,24 @@ __metadata:
   languageName: node
   linkType: hard
 
+"one-time@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "one-time@npm:1.0.0"
+  dependencies:
+    fn.name: "npm:1.x.x"
+  checksum: 10c0/6e4887b331edbb954f4e915831cbec0a7b9956c36f4feb5f6de98c448ac02ff881fd8d9b55a6b1b55030af184c6b648f340a76eb211812f4ad8c9b4b8692fdaa
+  languageName: node
+  linkType: hard
+
+"onetime@npm:^5.1.0":
+  version: 5.1.2
+  resolution: "onetime@npm:5.1.2"
+  dependencies:
+    mimic-fn: "npm:^2.1.0"
+  checksum: 10c0/ffcef6fbb2692c3c40749f31ea2e22677a876daea92959b8a80b521d95cca7a668c884d8b2045d1d8ee7d56796aa405c405462af112a1477594cc63531baeb8f
+  languageName: node
+  linkType: hard
+
 "onetime@npm:^7.0.0":
   version: 7.0.0
   resolution: "onetime@npm:7.0.0"
@@ -10474,6 +12551,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"open@npm:^6.3.0":
+  version: 6.4.0
+  resolution: "open@npm:6.4.0"
+  dependencies:
+    is-wsl: "npm:^1.1.0"
+  checksum: 10c0/447115632b4f3939fa0d973c33e17f28538fd268fd8257fc49763f7de6e76d29d65585b15998bbd2137337cfb70a92084a0e1b183a466e53a4829f704f295823
+  languageName: node
+  linkType: hard
+
 "open@npm:^7.4.2":
   version: 7.4.2
   resolution: "open@npm:7.4.2"
@@ -10484,6 +12570,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"openapi3-ts@npm:^3.1.1":
+  version: 3.2.0
+  resolution: "openapi3-ts@npm:3.2.0"
+  dependencies:
+    yaml: "npm:^2.2.1"
+  checksum: 10c0/3b9a663bf71f9292880c970a80f6f1a8db0ee475451c03b4fd336da957a24372349594d7868ce0a60b3a0875844a1f0e906e8fec8ef4220c06aa70670bfa3148
+  languageName: node
+  linkType: hard
+
 "optionator@npm:^0.9.3":
   version: 0.9.4
   resolution: "optionator@npm:0.9.4"
@@ -10514,6 +12609,23 @@ __metadata:
   languageName: node
   linkType: hard
 
+"ora@npm:^5.4.1":
+  version: 5.4.1
+  resolution: "ora@npm:5.4.1"
+  dependencies:
+    bl: "npm:^4.1.0"
+    chalk: "npm:^4.1.0"
+    cli-cursor: "npm:^3.1.0"
+    cli-spinners: "npm:^2.5.0"
+    is-interactive: "npm:^1.0.0"
+    is-unicode-supported: "npm:^0.1.0"
+    log-symbols: "npm:^4.1.0"
+    strip-ansi: "npm:^6.0.0"
+    wcwidth: "npm:^1.0.1"
+  checksum: 10c0/10ff14aace236d0e2f044193362b22edce4784add08b779eccc8f8ef97195cae1248db8ec1ec5f5ff076f91acbe573f5f42a98c19b78dba8c54eefff983cae85
+  languageName: node
+  linkType: hard
+
 "own-keys@npm:^1.0.1":
   version: 1.0.1
   resolution: "own-keys@npm:1.0.1"
@@ -10525,6 +12637,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"p-defer@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "p-defer@npm:3.0.0"
+  checksum: 10c0/848eb9821785b9a203def23618217ddbfa5cd909574ad0d66aae61a1981c4dcfa084804d6f97abe027bd004643471ddcdc823aa8df60198f791a9bd985e01bee
+  languageName: node
+  linkType: hard
+
 "p-limit@npm:^3.0.1, p-limit@npm:^3.0.2":
   version: 3.1.0
   resolution: "p-limit@npm:3.1.0"
@@ -10561,19 +12680,52 @@ __metadata:
   languageName: node
   linkType: hard
 
-"p-map@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "p-map@npm:4.0.0"
+"p-map@npm:^4.0.0":
+  version: 4.0.0
+  resolution: "p-map@npm:4.0.0"
+  dependencies:
+    aggregate-error: "npm:^3.0.0"
+  checksum: 10c0/592c05bd6262c466ce269ff172bb8de7c6975afca9b50c975135b974e9bdaafbfe80e61aaaf5be6d1200ba08b30ead04b88cfa7e25ff1e3b93ab28c9f62a2c75
+  languageName: node
+  linkType: hard
+
+"p-map@npm:^7.0.2":
+  version: 7.0.4
+  resolution: "p-map@npm:7.0.4"
+  checksum: 10c0/a5030935d3cb2919d7e89454d1ce82141e6f9955413658b8c9403cfe379283770ed3048146b44cde168aa9e8c716505f196d5689db0ae3ce9a71521a2fef3abd
+  languageName: node
+  linkType: hard
+
+"p-throttle@npm:^8.1.0":
+  version: 8.1.0
+  resolution: "p-throttle@npm:8.1.0"
+  checksum: 10c0/884e0424ee64eae1456840fdfc5eac09368ede4d725734c51b0a3ddb12419b78c7bdbf9c6741410563b9bafa9cedb239da540c0e9c58981c590b15d59c18f0ee
+  languageName: node
+  linkType: hard
+
+"pac-proxy-agent@npm:^7.1.0":
+  version: 7.2.0
+  resolution: "pac-proxy-agent@npm:7.2.0"
   dependencies:
-    aggregate-error: "npm:^3.0.0"
-  checksum: 10c0/592c05bd6262c466ce269ff172bb8de7c6975afca9b50c975135b974e9bdaafbfe80e61aaaf5be6d1200ba08b30ead04b88cfa7e25ff1e3b93ab28c9f62a2c75
+    "@tootallnate/quickjs-emscripten": "npm:^0.23.0"
+    agent-base: "npm:^7.1.2"
+    debug: "npm:^4.3.4"
+    get-uri: "npm:^6.0.1"
+    http-proxy-agent: "npm:^7.0.0"
+    https-proxy-agent: "npm:^7.0.6"
+    pac-resolver: "npm:^7.0.1"
+    socks-proxy-agent: "npm:^8.0.5"
+  checksum: 10c0/0265c17c9401c2ea735697931a6553a0c6d8b20c4d7d4e3b3a0506080ba69a8d5ad656e2a6be875411212e2b6ed7a4d9526dd3997e08581fdfb1cbcad454c296
   languageName: node
   linkType: hard
 
-"p-map@npm:^7.0.2":
-  version: 7.0.4
-  resolution: "p-map@npm:7.0.4"
-  checksum: 10c0/a5030935d3cb2919d7e89454d1ce82141e6f9955413658b8c9403cfe379283770ed3048146b44cde168aa9e8c716505f196d5689db0ae3ce9a71521a2fef3abd
+"pac-resolver@npm:^7.0.1":
+  version: 7.0.1
+  resolution: "pac-resolver@npm:7.0.1"
+  dependencies:
+    degenerator: "npm:^5.0.0"
+    netmask: "npm:^2.0.2"
+  checksum: 10c0/5f3edd1dd10fded31e7d1f95776442c3ee51aa098c28b74ede4927d9677ebe7cebb2636750c24e945f5b84445e41ae39093d3a1014a994e5ceb9f0b1b88ebff5
   languageName: node
   linkType: hard
 
@@ -10615,7 +12767,30 @@ __metadata:
   languageName: node
   linkType: hard
 
-"parseurl@npm:^1.3.3":
+"parse5-htmlparser2-tree-adapter@npm:^6.0.0":
+  version: 6.0.1
+  resolution: "parse5-htmlparser2-tree-adapter@npm:6.0.1"
+  dependencies:
+    parse5: "npm:^6.0.1"
+  checksum: 10c0/dfa5960e2aaf125707e19a4b1bc333de49232eba5a6ffffb95d313a7d6087c3b7a274b58bee8d3bd41bdf150638815d1d601a42bbf2a0345208c3c35b1279556
+  languageName: node
+  linkType: hard
+
+"parse5@npm:^5.1.1":
+  version: 5.1.1
+  resolution: "parse5@npm:5.1.1"
+  checksum: 10c0/b0f87a77a7fea5f242e3d76917c983bbea47703b9371801d51536b78942db6441cbda174bf84eb30e47315ddc6f8a0b57d68e562c790154430270acd76c1fa03
+  languageName: node
+  linkType: hard
+
+"parse5@npm:^6.0.1":
+  version: 6.0.1
+  resolution: "parse5@npm:6.0.1"
+  checksum: 10c0/595821edc094ecbcfb9ddcb46a3e1fe3a718540f8320eff08b8cf6742a5114cce2d46d45f95c26191c11b184dcaf4e2960abcd9c5ed9eb9393ac9a37efcfdecb
+  languageName: node
+  linkType: hard
+
+"parseurl@npm:^1.3.3, parseurl@npm:~1.3.3":
   version: 1.3.3
   resolution: "parseurl@npm:1.3.3"
   checksum: 10c0/90dd4760d6f6174adb9f20cf0965ae12e23879b5f5464f38e92fce8073354341e4b3b76fa3d878351efe7d01e617121955284cfd002ab087fba1a0726ec0b4f5
@@ -10755,10 +12930,26 @@ __metadata:
   languageName: node
   linkType: hard
 
-"path-to-regexp@npm:8.4.0":
-  version: 8.4.0
-  resolution: "path-to-regexp@npm:8.4.0"
-  checksum: 10c0/171a540aed2a5dff3da6e7584f263ae65d868daea382ea3bd1ddeb828912661133d5a94fce83bd3125f0799df8dfd4924b270e2987a31930901cfd94ae164b45
+"path-to-regexp@npm:8.4.2, path-to-regexp@npm:^8.0.0":
+  version: 8.4.2
+  resolution: "path-to-regexp@npm:8.4.2"
+  checksum: 10c0/05b115c49b47ad252ce05faa32930f643f23769c68b8bcfe78ad833545140c48bbffb3266986d6c8d5db13a64cf12e07e0d72d9882cab830efeefa553533ebaf
+  languageName: node
+  linkType: hard
+
+"path-to-regexp@npm:^1.9.0":
+  version: 1.9.0
+  resolution: "path-to-regexp@npm:1.9.0"
+  dependencies:
+    isarray: "npm:0.0.1"
+  checksum: 10c0/de9ddb01b84d9c2c8e2bed18630d8d039e2d6f60a6538595750fa08c7a6482512257464c8da50616f266ab2cdd2428387e85f3b089e4c3f25d0c537e898a0751
+  languageName: node
+  linkType: hard
+
+"path-to-regexp@npm:~0.1.12":
+  version: 0.1.13
+  resolution: "path-to-regexp@npm:0.1.13"
+  checksum: 10c0/1cae3921739c154a8926e136185a10c916f79a249b9072a5001b266d96e193860ca03867e8e8cc808b786862d750f427ed93686bc259355442c3407a62deab1a
   languageName: node
   linkType: hard
 
@@ -10783,6 +12974,101 @@ __metadata:
   languageName: node
   linkType: hard
 
+"pg-cloudflare@npm:^1.4.0":
+  version: 1.4.0
+  resolution: "pg-cloudflare@npm:1.4.0"
+  checksum: 10c0/553764d00055052648393cda53c1feb065991d6f9fbfdeb56cf8396c5b33377ab2897aaf5dc9cd3933d09023a1f01e8b1ca755431dcf5fd71c92ea277e2888f1
+  languageName: node
+  linkType: hard
+
+"pg-connection-string@npm:^2.14.0":
+  version: 2.14.0
+  resolution: "pg-connection-string@npm:2.14.0"
+  checksum: 10c0/c26d85970f782de72b90aa45b4acfa34df90242fc08bc676e8827297164044dbfb40a2cf20b0646bd02662a6b14c5ed27f322db627e41e582f2b705bc41e8b47
+  languageName: node
+  linkType: hard
+
+"pg-gateway@npm:^0.3.0-beta.4":
+  version: 0.3.0-beta.4
+  resolution: "pg-gateway@npm:0.3.0-beta.4"
+  checksum: 10c0/28c5dd9b6f56de97c84d9e69418106ca60ee23dada4fd1cc61d6db43add118008f1c7aed50167b60b71c0e546d35c794cbd7e465bfc3d3e6f709dd04f3018103
+  languageName: node
+  linkType: hard
+
+"pg-int8@npm:1.0.1":
+  version: 1.0.1
+  resolution: "pg-int8@npm:1.0.1"
+  checksum: 10c0/be6a02d851fc2a4ae3e9de81710d861de3ba35ac927268973eb3cb618873a05b9424656df464dd43bd7dc3fc5295c3f5b3c8349494f87c7af50ec59ef14e0b98
+  languageName: node
+  linkType: hard
+
+"pg-pool@npm:^3.14.0":
+  version: 3.14.0
+  resolution: "pg-pool@npm:3.14.0"
+  peerDependencies:
+    pg: ">=8.0"
+  checksum: 10c0/3dd706e67e3b317e29409d9eb3bd44e960eabd86db2a9711a9391bbd43881f8ce7a5f7054a341509558ee05e9bf0a3cc7aef037039da0790ce1e16762ade3ba6
+  languageName: node
+  linkType: hard
+
+"pg-protocol@npm:^1.15.0":
+  version: 1.15.0
+  resolution: "pg-protocol@npm:1.15.0"
+  checksum: 10c0/f1acad1e693d23ce70f8a5fec108cb960d6b8546b3a3fb2cf9113211069ef0f8890e2cc26b5f94e11bf81ff6d851b11c0643de12327cd07e0d1127ae1cb80791
+  languageName: node
+  linkType: hard
+
+"pg-types@npm:2.2.0":
+  version: 2.2.0
+  resolution: "pg-types@npm:2.2.0"
+  dependencies:
+    pg-int8: "npm:1.0.1"
+    postgres-array: "npm:~2.0.0"
+    postgres-bytea: "npm:~1.0.0"
+    postgres-date: "npm:~1.0.4"
+    postgres-interval: "npm:^1.1.0"
+  checksum: 10c0/ab3f8069a323f601cd2d2279ca8c425447dab3f9b61d933b0601d7ffc00d6200df25e26a4290b2b0783b59278198f7dd2ed03e94c4875797919605116a577c65
+  languageName: node
+  linkType: hard
+
+"pg@npm:^8.11.3":
+  version: 8.22.0
+  resolution: "pg@npm:8.22.0"
+  dependencies:
+    pg-cloudflare: "npm:^1.4.0"
+    pg-connection-string: "npm:^2.14.0"
+    pg-pool: "npm:^3.14.0"
+    pg-protocol: "npm:^1.15.0"
+    pg-types: "npm:2.2.0"
+    pgpass: "npm:1.0.5"
+  peerDependencies:
+    pg-native: ">=3.0.1"
+  dependenciesMeta:
+    pg-cloudflare:
+      optional: true
+  peerDependenciesMeta:
+    pg-native:
+      optional: true
+  checksum: 10c0/f26fe81c8146b802ac58b2a67570ab4f64cbd57d0752d0a6d1b2b1d12168adb241948e6129301b771a359bede6767181c5ac1a584a36bcfcd38ffe955237ee26
+  languageName: node
+  linkType: hard
+
+"pglite-2@npm:@electric-sql/pglite@0.2.17":
+  version: 0.2.17
+  resolution: "@electric-sql/pglite@npm:0.2.17"
+  checksum: 10c0/4358eccb2a3de5148b8995c7dbf3cad2d80a2a193885838ec19e0381ca204c0e37f721d006ad23fcad0b694ec6089a6786b82f2ad87f18344c82e059ff37017f
+  languageName: node
+  linkType: hard
+
+"pgpass@npm:1.0.5":
+  version: 1.0.5
+  resolution: "pgpass@npm:1.0.5"
+  dependencies:
+    split2: "npm:^4.1.0"
+  checksum: 10c0/5ea6c9b2de04c33abb08d33a2dded303c4a3c7162a9264519cbe85c0a9857d712463140ba42fad0c7cd4b21f644dd870b45bb2e02fcbe505b4de0744fd802c1d
+  languageName: node
+  linkType: hard
+
 "picocolors@npm:^1.1.1":
   version: 1.1.1
   resolution: "picocolors@npm:1.1.1"
@@ -10797,6 +13083,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"picomatch@npm:^2.0.4, picomatch@npm:^2.2.1":
+  version: 2.3.2
+  resolution: "picomatch@npm:2.3.2"
+  checksum: 10c0/a554d1709e59be97d1acb9eaedbbc700a5c03dbd4579807baed95100b00420bc729335440ef15004ae2378984e2487a7c1cebd743cfdb72b6fa9ab69223c0d61
+  languageName: node
+  linkType: hard
+
 "picomatch@npm:^2.3.1":
   version: 2.3.1
   resolution: "picomatch@npm:2.3.1"
@@ -10811,6 +13104,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"pkce-challenge@npm:^5.0.0":
+  version: 5.0.1
+  resolution: "pkce-challenge@npm:5.0.1"
+  checksum: 10c0/207f4cb976682f27e8324eb49cf71937c98fbb8341a0b8f6142bc6f664825b30e049a54a21b5c034e823ee3c3d412f10d74bd21de78e17452a6a496c2991f57c
+  languageName: node
+  linkType: hard
+
 "playwright-core@npm:1.60.0":
   version: 1.60.0
   resolution: "playwright-core@npm:1.60.0"
@@ -10842,6 +13142,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"portfinder@npm:^1.0.32":
+  version: 1.0.38
+  resolution: "portfinder@npm:1.0.38"
+  dependencies:
+    async: "npm:^3.2.6"
+    debug: "npm:^4.3.6"
+  checksum: 10c0/59b2f2aa0b620c90ce0d477241e62c277f38bfd4fb6074106c23560248dd5e5c2c629dd048ef721f32b19df4213d09b77234880e4f0ab04abf1ab70b6d8048fa
+  languageName: node
+  linkType: hard
+
 "possible-typed-array-names@npm:^1.0.0":
   version: 1.1.0
   resolution: "possible-typed-array-names@npm:1.1.0"
@@ -10871,6 +13181,36 @@ __metadata:
   languageName: node
   linkType: hard
 
+"postgres-array@npm:~2.0.0":
+  version: 2.0.0
+  resolution: "postgres-array@npm:2.0.0"
+  checksum: 10c0/cbd56207e4141d7fbf08c86f2aebf21fa7064943d3f808ec85f442ff94b48d891e7a144cc02665fb2de5dbcb9b8e3183a2ac749959e794b4a4cfd379d7a21d08
+  languageName: node
+  linkType: hard
+
+"postgres-bytea@npm:~1.0.0":
+  version: 1.0.1
+  resolution: "postgres-bytea@npm:1.0.1"
+  checksum: 10c0/10b28a27c9d703d5befd97c443e62b551096d1014bc59ab574c65bf0688de7f3f068003b2aea8dcff83cf0f6f9a35f9f74457c38856cf8eb81b00cf3fb44f164
+  languageName: node
+  linkType: hard
+
+"postgres-date@npm:~1.0.4":
+  version: 1.0.7
+  resolution: "postgres-date@npm:1.0.7"
+  checksum: 10c0/0ff91fccc64003e10b767fcfeefb5eaffbc522c93aa65d5051c49b3c4ce6cb93ab091a7d22877a90ad60b8874202c6f1d0f935f38a7235ed3b258efd54b97ca9
+  languageName: node
+  linkType: hard
+
+"postgres-interval@npm:^1.1.0":
+  version: 1.2.0
+  resolution: "postgres-interval@npm:1.2.0"
+  dependencies:
+    xtend: "npm:^4.0.0"
+  checksum: 10c0/c1734c3cb79e7f22579af0b268a463b1fa1d084e742a02a7a290c4f041e349456f3bee3b4ee0bb3f226828597f7b76deb615c1b857db9a742c45520100456272
+  languageName: node
+  linkType: hard
+
 "prebuild-install@npm:^7.1.1":
   version: 7.1.3
   resolution: "prebuild-install@npm:7.1.3"
@@ -10918,6 +13258,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"proc-log@npm:^4.0.0":
+  version: 4.2.0
+  resolution: "proc-log@npm:4.2.0"
+  checksum: 10c0/17db4757c2a5c44c1e545170e6c70a26f7de58feb985091fb1763f5081cab3d01b181fb2dd240c9f4a4255a1d9227d163d5771b7e69c9e49a561692db865efb9
+  languageName: node
+  linkType: hard
+
 "proc-log@npm:^6.0.0":
   version: 6.1.0
   resolution: "proc-log@npm:6.1.0"
@@ -10925,6 +13272,41 @@ __metadata:
   languageName: node
   linkType: hard
 
+"proc-log@npm:^7.0.0":
+  version: 7.0.0
+  resolution: "proc-log@npm:7.0.0"
+  checksum: 10c0/b89c2d862604f35fec795477b0c7e376feab3ba0d4f4d291c4e959567442697cf451ac557d0623c1cc38af45a78128b983410f397a10c5d3a67f76c33de4754b
+  languageName: node
+  linkType: hard
+
+"process-nextick-args@npm:~2.0.0":
+  version: 2.0.1
+  resolution: "process-nextick-args@npm:2.0.1"
+  checksum: 10c0/bec089239487833d46b59d80327a1605e1c5287eaad770a291add7f45fda1bb5e28b38e0e061add0a1d0ee0984788ce74fa394d345eed1c420cacf392c554367
+  languageName: node
+  linkType: hard
+
+"process@npm:^0.11.10":
+  version: 0.11.10
+  resolution: "process@npm:0.11.10"
+  checksum: 10c0/40c3ce4b7e6d4b8c3355479df77aeed46f81b279818ccdc500124e6a5ab882c0cc81ff7ea16384873a95a74c4570b01b120f287abbdd4c877931460eca6084b3
+  languageName: node
+  linkType: hard
+
+"progress@npm:^2.0.3":
+  version: 2.0.3
+  resolution: "progress@npm:2.0.3"
+  checksum: 10c0/1697e07cb1068055dbe9fe858d242368ff5d2073639e652b75a7eb1f2a1a8d4afd404d719de23c7b48481a6aa0040686310e2dac2f53d776daa2176d3f96369c
+  languageName: node
+  linkType: hard
+
+"promise-breaker@npm:^6.0.0":
+  version: 6.0.0
+  resolution: "promise-breaker@npm:6.0.0"
+  checksum: 10c0/fcd00836dd96d34d3376964bc3a9482251248cef00f0dcf1f2485e7d9af44f9c48b0431cf4dc780fd5a7137b8e0861e3c6557667811522e93978f6bffab66cfe
+  languageName: node
+  linkType: hard
+
 "promise-inflight@npm:^1.0.1":
   version: 1.0.1
   resolution: "promise-inflight@npm:1.0.1"
@@ -10942,6 +13324,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"proto-list@npm:~1.2.1":
+  version: 1.2.4
+  resolution: "proto-list@npm:1.2.4"
+  checksum: 10c0/b9179f99394ec8a68b8afc817690185f3b03933f7b46ce2e22c1930dc84b60d09f5ad222beab4e59e58c6c039c7f7fcf620397235ef441a356f31f9744010e12
+  languageName: node
+  linkType: hard
+
+"proto3-json-serializer@npm:3.0.4":
+  version: 3.0.4
+  resolution: "proto3-json-serializer@npm:3.0.4"
+  dependencies:
+    protobufjs: "npm:^7.4.0"
+  checksum: 10c0/59150d5e6b396e00c0374e71eb4ebd6f33acd4212c0ad2acdda12181b08f923b733559d74ad78455085223efe24168d4d42887a8b8f15f7663f20debe5796081
+  languageName: node
+  linkType: hard
+
 "proto3-json-serializer@npm:^2.0.2":
   version: 2.0.2
   resolution: "proto3-json-serializer@npm:2.0.2"
@@ -10971,7 +13369,26 @@ __metadata:
   languageName: node
   linkType: hard
 
-"proxy-addr@npm:^2.0.7":
+"protobufjs@npm:^7.4.0, protobufjs@npm:^7.5.4":
+  version: 7.6.5
+  resolution: "protobufjs@npm:7.6.5"
+  dependencies:
+    "@protobufjs/aspromise": "npm:^1.1.2"
+    "@protobufjs/base64": "npm:^1.1.2"
+    "@protobufjs/codegen": "npm:^2.0.5"
+    "@protobufjs/eventemitter": "npm:^1.1.1"
+    "@protobufjs/fetch": "npm:^1.1.1"
+    "@protobufjs/float": "npm:^1.0.2"
+    "@protobufjs/path": "npm:^1.1.2"
+    "@protobufjs/pool": "npm:^1.1.0"
+    "@protobufjs/utf8": "npm:^1.1.1"
+    "@types/node": "npm:>=13.7.0"
+    long: "npm:^5.3.2"
+  checksum: 10c0/863eaca9c6f45bfcfb8787c545f53e9c6696507e328e3981b4643c12d35df7f2826021c10e3fd30bef342c13a8e9d306547bac9c0849ee3bf50f770a12f01dc5
+  languageName: node
+  linkType: hard
+
+"proxy-addr@npm:^2.0.7, proxy-addr@npm:~2.0.7":
   version: 2.0.7
   resolution: "proxy-addr@npm:2.0.7"
   dependencies:
@@ -10981,6 +13398,29 @@ __metadata:
   languageName: node
   linkType: hard
 
+"proxy-agent@npm:^6.3.0":
+  version: 6.5.0
+  resolution: "proxy-agent@npm:6.5.0"
+  dependencies:
+    agent-base: "npm:^7.1.2"
+    debug: "npm:^4.3.4"
+    http-proxy-agent: "npm:^7.0.1"
+    https-proxy-agent: "npm:^7.0.6"
+    lru-cache: "npm:^7.14.1"
+    pac-proxy-agent: "npm:^7.1.0"
+    proxy-from-env: "npm:^1.1.0"
+    socks-proxy-agent: "npm:^8.0.5"
+  checksum: 10c0/7fd4e6f36bf17098a686d4aee3b8394abfc0b0537c2174ce96b0a4223198b9fafb16576c90108a3fcfc2af0168bd7747152bfa1f58e8fee91d3780e79aab7fd8
+  languageName: node
+  linkType: hard
+
+"proxy-from-env@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "proxy-from-env@npm:1.1.0"
+  checksum: 10c0/fe7dd8b1bdbbbea18d1459107729c3e4a2243ca870d26d34c2c1bcd3e4425b7bcc5112362df2d93cc7fb9746f6142b5e272fd1cc5c86ddf8580175186f6ad42b
+  languageName: node
+  linkType: hard
+
 "pump@npm:^3.0.0":
   version: 3.0.3
   resolution: "pump@npm:3.0.3"
@@ -11005,6 +13445,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"pupa@npm:^2.1.1":
+  version: 2.1.1
+  resolution: "pupa@npm:2.1.1"
+  dependencies:
+    escape-goat: "npm:^2.0.0"
+  checksum: 10c0/d2346324780ebae4be847cad052b830e004d816851dd4750fc73faa6cd360f443e358f6b1c83641fd4c904c6055dcb545807f55259a20a52ad86d9477746c724
+  languageName: node
+  linkType: hard
+
 "qs@npm:6.15.2":
   version: 6.15.2
   resolution: "qs@npm:6.15.2"
@@ -11021,14 +13470,43 @@ __metadata:
   languageName: node
   linkType: hard
 
-"range-parser@npm:^1.2.1":
+"railroad-diagrams@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "railroad-diagrams@npm:1.0.0"
+  checksum: 10c0/81bf8f86870a69fb9ed243102db9ad6416d09c4cb83964490d44717690e07dd982f671503236a1f8af28f4cb79d5d7a87613930f10ac08defa845ceb6764e364
+  languageName: node
+  linkType: hard
+
+"randexp@npm:0.4.6":
+  version: 0.4.6
+  resolution: "randexp@npm:0.4.6"
+  dependencies:
+    discontinuous-range: "npm:1.0.0"
+    ret: "npm:~0.1.10"
+  checksum: 10c0/14ee14b6d7f5ce69609b51cc914fb7a7c82ad337820a141c5f762c5ad1fe868f5191ea6e82359aee019b625ee1359486628fa833909d12c3b5dd9571908c3345
+  languageName: node
+  linkType: hard
+
+"range-parser@npm:^1.2.1, range-parser@npm:~1.2.1":
   version: 1.2.1
   resolution: "range-parser@npm:1.2.1"
   checksum: 10c0/96c032ac2475c8027b7a4e9fe22dc0dfe0f6d90b85e496e0f016fbdb99d6d066de0112e680805075bd989905e2123b3b3d002765149294dce0c1f7f01fcc2ea0
   languageName: node
   linkType: hard
 
-"raw-body@npm:^3.0.2":
+"raw-body@npm:^2.3.3, raw-body@npm:~2.5.3":
+  version: 2.5.3
+  resolution: "raw-body@npm:2.5.3"
+  dependencies:
+    bytes: "npm:~3.1.2"
+    http-errors: "npm:~2.0.1"
+    iconv-lite: "npm:~0.4.24"
+    unpipe: "npm:~1.0.0"
+  checksum: 10c0/449844344fc90547fb994383a494b83300e4f22199f146a79f68d78a199a8f2a923ea9fd29c3be979bfd50291a3884733619ffc15ba02a32e703b612f8d3f74a
+  languageName: node
+  linkType: hard
+
+"raw-body@npm:^3.0.0, raw-body@npm:^3.0.2":
   version: 3.0.2
   resolution: "raw-body@npm:3.0.2"
   dependencies:
@@ -11040,7 +13518,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"rc@npm:^1.2.7":
+"rc@npm:^1.2.7, rc@npm:^1.2.8":
   version: 1.2.8
   resolution: "rc@npm:1.2.8"
   dependencies:
@@ -11054,6 +13532,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"re2@npm:^1.17.7":
+  version: 1.26.1
+  resolution: "re2@npm:1.26.1"
+  dependencies:
+    install-artifact-from-github: "npm:^1.7.0"
+    nan: "npm:^2.28.0"
+    node-gyp: "npm:^13.0.1"
+  checksum: 10c0/6204450f56e7b65772c02491c5c04b9264d3a95a5e635519b0f4f98623aef958d57d23b8c738c433a668d6a75166f03ae1ce3ee8ae7fe0bb2913fb2dcde4100f
+  languageName: node
+  linkType: hard
+
 "react-dom@npm:^18.3.1":
   version: 18.3.1
   resolution: "react-dom@npm:18.3.1"
@@ -11106,7 +13595,22 @@ __metadata:
   languageName: node
   linkType: hard
 
-"readable-stream@npm:^3.0.2, readable-stream@npm:^3.1.1, readable-stream@npm:^3.4.0, readable-stream@npm:^3.6.0":
+"readable-stream@npm:^2.0.5":
+  version: 2.3.8
+  resolution: "readable-stream@npm:2.3.8"
+  dependencies:
+    core-util-is: "npm:~1.0.0"
+    inherits: "npm:~2.0.3"
+    isarray: "npm:~1.0.0"
+    process-nextick-args: "npm:~2.0.0"
+    safe-buffer: "npm:~5.1.1"
+    string_decoder: "npm:~1.1.1"
+    util-deprecate: "npm:~1.0.1"
+  checksum: 10c0/7efdb01f3853bc35ac62ea25493567bf588773213f5f4a79f9c365e1ad13bab845ac0dae7bc946270dc40c3929483228415e92a3fc600cc7e4548992f41ee3fa
+  languageName: node
+  linkType: hard
+
+"readable-stream@npm:^3.0.2, readable-stream@npm:^3.1.1, readable-stream@npm:^3.4.0, readable-stream@npm:^3.6.0, readable-stream@npm:^3.6.2":
   version: 3.6.2
   resolution: "readable-stream@npm:3.6.2"
   dependencies:
@@ -11117,6 +13621,28 @@ __metadata:
   languageName: node
   linkType: hard
 
+"readable-stream@npm:^4.0.0":
+  version: 4.7.0
+  resolution: "readable-stream@npm:4.7.0"
+  dependencies:
+    abort-controller: "npm:^3.0.0"
+    buffer: "npm:^6.0.3"
+    events: "npm:^3.3.0"
+    process: "npm:^0.11.10"
+    string_decoder: "npm:^1.3.0"
+  checksum: 10c0/fd86d068da21cfdb10f7a4479f2e47d9c0a9b0c862fc0c840a7e5360201580a55ac399c764b12a4f6fa291f8cee74d9c4b7562e0d53b3c4b2769f2c98155d957
+  languageName: node
+  linkType: hard
+
+"readdir-glob@npm:^1.1.2":
+  version: 1.1.3
+  resolution: "readdir-glob@npm:1.1.3"
+  dependencies:
+    minimatch: "npm:^5.1.0"
+  checksum: 10c0/a37e0716726650845d761f1041387acd93aa91b28dd5381950733f994b6c349ddc1e21e266ec7cc1f9b92e205a7a972232f9b89d5424d07361c2c3753d5dbace
+  languageName: node
+  linkType: hard
+
 "readdirp@npm:^5.0.0":
   version: 5.0.0
   resolution: "readdirp@npm:5.0.0"
@@ -11124,6 +13650,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"readdirp@npm:~3.6.0":
+  version: 3.6.0
+  resolution: "readdirp@npm:3.6.0"
+  dependencies:
+    picomatch: "npm:^2.2.1"
+  checksum: 10c0/6fa848cf63d1b82ab4e985f4cf72bd55b7dcfd8e0a376905804e48c3634b7e749170940ba77b32804d5fe93b3cc521aa95a8d7e7d725f830da6d93f3669ce66b
+  languageName: node
+  linkType: hard
+
 "reflect-metadata@npm:0.1.13":
   version: 0.1.13
   resolution: "reflect-metadata@npm:0.1.13"
@@ -11182,6 +13717,24 @@ __metadata:
   languageName: node
   linkType: hard
 
+"registry-auth-token@npm:^5.0.1":
+  version: 5.1.1
+  resolution: "registry-auth-token@npm:5.1.1"
+  dependencies:
+    "@pnpm/npm-conf": "npm:^3.0.2"
+  checksum: 10c0/86b0f7fd87d327cb4177fee69bcf96563147ea72e206bc9c7a6a50a51c785a31b83a6c45956a489ed292d23b908b2755a075d0b2f7fec1ba91b1fb800b24cee3
+  languageName: node
+  linkType: hard
+
+"registry-url@npm:^5.1.0":
+  version: 5.1.0
+  resolution: "registry-url@npm:5.1.0"
+  dependencies:
+    rc: "npm:^1.2.8"
+  checksum: 10c0/c2c455342b5836cbed5162092eba075c7a02c087d9ce0fde8aeb4dc87a8f4a34a542e58bf4d8ec2d4cb73f04408cb3148ceb1f76647f76b978cfec22047dc6d6
+  languageName: node
+  linkType: hard
+
 "require-directory@npm:^2.1.1":
   version: 2.1.1
   resolution: "require-directory@npm:2.1.1"
@@ -11236,6 +13789,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"restore-cursor@npm:^3.1.0":
+  version: 3.1.0
+  resolution: "restore-cursor@npm:3.1.0"
+  dependencies:
+    onetime: "npm:^5.1.0"
+    signal-exit: "npm:^3.0.2"
+  checksum: 10c0/8051a371d6aa67ff21625fa94e2357bd81ffdc96267f3fb0fc4aaf4534028343836548ef34c240ffa8c25b280ca35eb36be00b3cb2133fa4f51896d7e73c6b4f
+  languageName: node
+  linkType: hard
+
 "restore-cursor@npm:^5.0.0":
   version: 5.1.0
   resolution: "restore-cursor@npm:5.1.0"
@@ -11246,6 +13809,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"ret@npm:~0.1.10":
+  version: 0.1.15
+  resolution: "ret@npm:0.1.15"
+  checksum: 10c0/01f77cad0f7ea4f955852c03d66982609893edc1240c0c964b4c9251d0f9fb6705150634060d169939b096d3b77f4c84d6b6098a5b5d340160898c8581f1f63f
+  languageName: node
+  linkType: hard
+
 "retry-request@npm:^7.0.0":
   version: 7.0.2
   resolution: "retry-request@npm:7.0.2"
@@ -11257,7 +13827,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"retry@npm:0.13.1":
+"retry-request@npm:^8.0.2":
+  version: 8.0.4
+  resolution: "retry-request@npm:8.0.4"
+  dependencies:
+    extend: "npm:^3.0.2"
+    teeny-request: "npm:^10.0.0"
+  checksum: 10c0/b215cb986c30e12fccd163f819cd8c185344387ef6c5e55ef1d20e23b72f619dde6506c1cfd89d94b0bbba56658ea621ad6be769acedb43ef11710eeccf7758f
+  languageName: node
+  linkType: hard
+
+"retry@npm:0.13.1, retry@npm:^0.13.1":
   version: 0.13.1
   resolution: "retry@npm:0.13.1"
   checksum: 10c0/9ae822ee19db2163497e074ea919780b1efa00431d197c7afdb950e42bf109196774b92a49fc9821f0b8b328a98eea6017410bfc5e8a0fc19c85c6d11adb3772
@@ -11289,6 +13869,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"rimraf@npm:^5.0.1":
+  version: 5.0.10
+  resolution: "rimraf@npm:5.0.10"
+  dependencies:
+    glob: "npm:^10.3.7"
+  bin:
+    rimraf: dist/esm/bin.mjs
+  checksum: 10c0/7da4fd0e15118ee05b918359462cfa1e7fe4b1228c7765195a45b55576e8c15b95db513b8466ec89129666f4af45ad978a3057a02139afba1a63512a2d9644cc
+  languageName: node
+  linkType: hard
+
 "rolldown@npm:~1.2.0":
   version: 1.2.3
   resolution: "rolldown@npm:1.2.3"
@@ -11450,7 +14041,7 @@ __metadata:
     "@nestjs/throttler": "npm:^6.5.0"
     "@swc/core": "npm:^1.15.47"
     "@types/express": "npm:^4.17.21"
-    "@types/node": "npm:^18.19.44"
+    "@types/node": "npm:^20.19.0"
     "@types/nodemailer": "npm:^6.4.15"
     "@types/supertest": "npm:^6.0.3"
     "@typescript-eslint/eslint-plugin": "npm:^5.62.0"
@@ -11465,6 +14056,7 @@ __metadata:
     eslint-plugin-node: "npm:^11.1.0"
     eslint-plugin-prettier: "npm:^4.2.1"
     eslint-plugin-tsdoc: "npm:^0.3.0"
+    firebase-tools: "npm:15.15.0"
     helmet: "npm:^8.1.0"
     husky: "npm:^7.0.4"
     istanbul-lib-coverage: "npm:^3.2.2"
@@ -11491,7 +14083,7 @@ __metadata:
   languageName: unknown
   linkType: soft
 
-"router@npm:^2.2.0":
+"router@npm:^2.0.0, router@npm:^2.2.0":
   version: 2.2.0
   resolution: "router@npm:2.2.0"
   dependencies:
@@ -11549,7 +14141,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"safe-buffer@npm:>=5.1.0, safe-buffer@npm:^5.0.1, safe-buffer@npm:^5.2.1, safe-buffer@npm:~5.2.0":
+"safe-buffer@npm:5.1.2, safe-buffer@npm:~5.1.0, safe-buffer@npm:~5.1.1":
+  version: 5.1.2
+  resolution: "safe-buffer@npm:5.1.2"
+  checksum: 10c0/780ba6b5d99cc9a40f7b951d47152297d0e260f0df01472a1b99d4889679a4b94a13d644f7dbc4f022572f09ae9005fa2fbb93bbbd83643316f365a3e9a45b21
+  languageName: node
+  linkType: hard
+
+"safe-buffer@npm:5.2.1, safe-buffer@npm:>=5.1.0, safe-buffer@npm:^5.0.1, safe-buffer@npm:^5.2.1, safe-buffer@npm:~5.2.0":
   version: 5.2.1
   resolution: "safe-buffer@npm:5.2.1"
   checksum: 10c0/6501914237c0a86e9675d4e51d89ca3c21ffd6a31642efeba25ad65720bce6921c9e7e974e5be91a786b25aa058b5303285d3c15dbabf983a919f5f630d349f3
@@ -11577,7 +14176,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"safer-buffer@npm:>= 2.1.2 < 3.0.0":
+"safe-stable-stringify@npm:^2.3.1":
+  version: 2.5.0
+  resolution: "safe-stable-stringify@npm:2.5.0"
+  checksum: 10c0/baea14971858cadd65df23894a40588ed791769db21bafb7fd7608397dbdce9c5aac60748abae9995e0fc37e15f2061980501e012cd48859740796bea2987f49
+  languageName: node
+  linkType: hard
+
+"safer-buffer@npm:>= 2.1.2 < 3, safer-buffer@npm:>= 2.1.2 < 3.0.0":
   version: 2.1.2
   resolution: "safer-buffer@npm:2.1.2"
   checksum: 10c0/7e3c8b2e88a1841c9671094bbaeebd94448111dd90a81a1f606f3f67708a6ec57763b3b47f06da09fc6054193e0e6709e77325415dc8422b04497a8070fa02d4
@@ -11618,7 +14224,7 @@ __metadata:
     "@nestjs/typeorm": "npm:11.0.3"
     "@swc/core": "npm:^1.15.47"
     "@types/jsonwebtoken": "npm:^9.0.3"
-    "@types/node": "npm:^18.19.44"
+    "@types/node": "npm:^20.19.0"
     "@types/supertest": "npm:^6.0.2"
     accesscontrol: "npm:^2.2.1"
     class-transformer: "npm:^0.5.1"
@@ -11660,7 +14266,7 @@ __metadata:
     "@nestjs/typeorm": "npm:11.0.3"
     "@swc/core": "npm:^1.15.47"
     "@types/jsonwebtoken": "npm:^9.0.3"
-    "@types/node": "npm:^18.19.44"
+    "@types/node": "npm:^20.19.0"
     "@types/supertest": "npm:^6.0.2"
     class-transformer: "npm:^0.5.1"
     class-validator: "npm:^0.14.1"
@@ -11691,12 +14297,30 @@ __metadata:
   languageName: node
   linkType: hard
 
-"semver@npm:^6.0.0, semver@npm:^6.1.0, semver@npm:^6.3.1":
+"semver-diff@npm:^3.1.1":
+  version: 3.1.1
+  resolution: "semver-diff@npm:3.1.1"
+  dependencies:
+    semver: "npm:^6.3.0"
+  checksum: 10c0/7d350f1450b9577d538ef866a9bc4cd97bfbf1f1d92070291495a31d0ec3aa808e826c223e5454ea9877cc06eaa886ffd71bb3a1f331b44bc210f9ff525c68d2
+  languageName: node
+  linkType: hard
+
+"semver@npm:^6.0.0, semver@npm:^6.1.0, semver@npm:^6.3.0, semver@npm:^6.3.1":
   version: 6.3.1
   resolution: "semver@npm:6.3.1"
   bin:
     semver: bin/semver.js
-  checksum: 10c0/e3d79b609071caa78bcb6ce2ad81c7966a46a7431d9d58b8800cfa9cb6a63699b3899a0e4bcce36167a284578212d9ae6942b6929ba4aa5015c079a67751d42d
+  checksum: 10c0/e3d79b609071caa78bcb6ce2ad81c7966a46a7431d9d58b8800cfa9cb6a63699b3899a0e4bcce36167a284578212d9ae6942b6929ba4aa5015c079a67751d42d
+  languageName: node
+  linkType: hard
+
+"semver@npm:^7.0.0, semver@npm:^7.1.1, semver@npm:^7.5.2":
+  version: 7.8.5
+  resolution: "semver@npm:7.8.5"
+  bin:
+    semver: bin/semver.js
+  checksum: 10c0/b1f3127a5be8125a94f37188b361c212466c292c6910adce3ec106cff5dc211ccaedc4739c11bb70fda59d6fc1f040a9bca289f4e093451521a2372e5231fe0c
   languageName: node
   linkType: hard
 
@@ -11728,6 +14352,27 @@ __metadata:
   languageName: node
   linkType: hard
 
+"send@npm:~0.19.0, send@npm:~0.19.1":
+  version: 0.19.2
+  resolution: "send@npm:0.19.2"
+  dependencies:
+    debug: "npm:2.6.9"
+    depd: "npm:2.0.0"
+    destroy: "npm:1.2.0"
+    encodeurl: "npm:~2.0.0"
+    escape-html: "npm:~1.0.3"
+    etag: "npm:~1.8.1"
+    fresh: "npm:~0.5.2"
+    http-errors: "npm:~2.0.1"
+    mime: "npm:1.6.0"
+    ms: "npm:2.1.3"
+    on-finished: "npm:~2.4.1"
+    range-parser: "npm:~1.2.1"
+    statuses: "npm:~2.0.2"
+  checksum: 10c0/20c2389fe0fdf3fc499938cac598bc32272287e993c4960717381a10de8550028feadfb9076f959a3a3ebdea42e1f690e116f0d16468fa56b9fd41866d3dc267
+  languageName: node
+  linkType: hard
+
 "serve-static@npm:^2.2.0":
   version: 2.2.1
   resolution: "serve-static@npm:2.2.1"
@@ -11740,6 +14385,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"serve-static@npm:~1.16.2":
+  version: 1.16.3
+  resolution: "serve-static@npm:1.16.3"
+  dependencies:
+    encodeurl: "npm:~2.0.0"
+    escape-html: "npm:~1.0.3"
+    parseurl: "npm:~1.3.3"
+    send: "npm:~0.19.1"
+  checksum: 10c0/36320397a073c71bedf58af48a4a100fe6d93f07459af4d6f08b9a7217c04ce2a4939e0effd842dc7bece93ffcd59eb52f58c4fff2a8e002dc29ae6b219cd42b
+  languageName: node
+  linkType: hard
+
 "set-blocking@npm:^2.0.0":
   version: 2.0.0
   resolution: "set-blocking@npm:2.0.0"
@@ -11784,7 +14441,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"setprototypeof@npm:~1.2.0":
+"setprototypeof@npm:1.2.0, setprototypeof@npm:~1.2.0":
   version: 1.2.0
   resolution: "setprototypeof@npm:1.2.0"
   checksum: 10c0/68733173026766fa0d9ecaeb07f0483f4c2dc70ca376b3b7c40b7cda909f94b0918f6c5ad5ce27a9160bdfb475efaa9d5e705a11d8eaae18f9835d20976028bc
@@ -11894,7 +14551,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"signal-exit@npm:^3.0.0, signal-exit@npm:^3.0.7":
+"signal-exit@npm:^3.0.0, signal-exit@npm:^3.0.2, signal-exit@npm:^3.0.7":
   version: 3.0.7
   resolution: "signal-exit@npm:3.0.7"
   checksum: 10c0/25d272fa73e146048565e08f3309d5b942c1979a6f4a58a8c59d5fa299728e9c2fcd1a759ec870863b1fd38653670240cd420dad2ad9330c71f36608a6a1c912
@@ -11981,7 +14638,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"socks-proxy-agent@npm:^8.0.3":
+"socks-proxy-agent@npm:^8.0.3, socks-proxy-agent@npm:^8.0.5":
   version: 8.0.5
   resolution: "socks-proxy-agent@npm:8.0.5"
   dependencies:
@@ -12002,6 +14659,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"sort-any@npm:^4.0.0":
+  version: 4.0.7
+  resolution: "sort-any@npm:4.0.7"
+  checksum: 10c0/fef92e659a516c05555286c35286ad84c5103f5e70210da5aaba8ca13121c4b17242e48428349e4d2e3b97c5536fdb913d49ca085e2b94d818e556e8389be310
+  languageName: node
+  linkType: hard
+
 "source-map-js@npm:^1.2.1":
   version: 1.2.1
   resolution: "source-map-js@npm:1.2.1"
@@ -12016,6 +14680,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"source-map@npm:~0.6.1":
+  version: 0.6.1
+  resolution: "source-map@npm:0.6.1"
+  checksum: 10c0/ab55398007c5e5532957cb0beee2368529618ac0ab372d789806f5718123cc4367d57de3904b4e6a4170eb5a0b0f41373066d02ca0735a0c4d75c7d328d3e011
+  languageName: node
+  linkType: hard
+
 "spdx-exceptions@npm:^2.1.0":
   version: 2.5.0
   resolution: "spdx-exceptions@npm:2.5.0"
@@ -12040,13 +14711,25 @@ __metadata:
   languageName: node
   linkType: hard
 
-"split2@npm:^4.0.0":
+"split2@npm:^4.0.0, split2@npm:^4.1.0":
   version: 4.2.0
   resolution: "split2@npm:4.2.0"
   checksum: 10c0/b292beb8ce9215f8c642bb68be6249c5a4c7f332fc8ecadae7be5cbdf1ea95addc95f0459ef2e7ad9d45fd1064698a097e4eb211c83e772b49bc0ee423e91534
   languageName: node
   linkType: hard
 
+"sql-formatter@npm:^15.3.0":
+  version: 15.8.2
+  resolution: "sql-formatter@npm:15.8.2"
+  dependencies:
+    argparse: "npm:^2.0.1"
+    nearley: "npm:^2.20.1"
+  bin:
+    sql-formatter: bin/sql-formatter-cli.cjs
+  checksum: 10c0/5ed8c5927f2ad20300a47397567749658411ff3813be9c4b989746e8e84465fc801b445685f218f5906e07b9ffd80b10a27b41fbd3c55fa4dd1ecfc2ad4dd759
+  languageName: node
+  linkType: hard
+
 "sql-highlight@npm:^6.1.0":
   version: 6.1.0
   resolution: "sql-highlight@npm:6.1.0"
@@ -12093,6 +14776,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"stack-trace@npm:0.0.x":
+  version: 0.0.10
+  resolution: "stack-trace@npm:0.0.10"
+  checksum: 10c0/9ff3dabfad4049b635a85456f927a075c9d0c210e3ea336412d18220b2a86cbb9b13ec46d6c37b70a302a4ea4d49e30e5d4944dd60ae784073f1cde778ac8f4b
+  languageName: node
+  linkType: hard
+
 "stackback@npm:0.0.2":
   version: 0.0.2
   resolution: "stackback@npm:0.0.2"
@@ -12100,13 +14790,20 @@ __metadata:
   languageName: node
   linkType: hard
 
-"statuses@npm:^2.0.1, statuses@npm:^2.0.2, statuses@npm:~2.0.2":
+"statuses@npm:^2.0.1, statuses@npm:^2.0.2, statuses@npm:~2.0.1, statuses@npm:~2.0.2":
   version: 2.0.2
   resolution: "statuses@npm:2.0.2"
   checksum: 10c0/a9947d98ad60d01f6b26727570f3bcceb6c8fa789da64fe6889908fe2e294d57503b14bf2b5af7605c2d36647259e856635cd4c49eab41667658ec9d0080ec3f
   languageName: node
   linkType: hard
 
+"statuses@npm:~1.5.0":
+  version: 1.5.0
+  resolution: "statuses@npm:1.5.0"
+  checksum: 10c0/e433900956357b3efd79b1c547da4d291799ac836960c016d10a98f6a810b1b5c0dcc13b5a7aa609a58239b5190e1ea176ad9221c2157d2fd1c747393e6b2940
+  languageName: node
+  linkType: hard
+
 "std-env@npm:^4.0.0-rc.1":
   version: 4.2.0
   resolution: "std-env@npm:4.2.0"
@@ -12131,6 +14828,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"stream-chain@npm:^2.2.4, stream-chain@npm:^2.2.5":
+  version: 2.2.5
+  resolution: "stream-chain@npm:2.2.5"
+  checksum: 10c0/c512f50190d7c92d688fa64e7af540c51b661f9c2b775fc72bca38ea9bca515c64c22c2197b1be463741daacbaaa2dde8a8ea24ebda46f08391224f15249121a
+  languageName: node
+  linkType: hard
+
 "stream-events@npm:^1.0.5":
   version: 1.0.5
   resolution: "stream-events@npm:1.0.5"
@@ -12140,6 +14844,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"stream-json@npm:^1.7.3":
+  version: 1.9.1
+  resolution: "stream-json@npm:1.9.1"
+  dependencies:
+    stream-chain: "npm:^2.2.5"
+  checksum: 10c0/0521e5cb3fb6b0e2561d715975e891bd81fa77d0239c8d0b1756846392bc3c7cdd7f1ddb0fe7ed77e6fdef58daab9e665d3b39f7d677bd0859e65a2bff59b92c
+  languageName: node
+  linkType: hard
+
 "stream-shift@npm:^1.0.2":
   version: 1.0.3
   resolution: "stream-shift@npm:1.0.3"
@@ -12154,7 +14867,18 @@ __metadata:
   languageName: node
   linkType: hard
 
-"string-width-cjs@npm:string-width@^4.2.0, string-width@npm:^1.0.2 || 2 || 3 || 4, string-width@npm:^4.1.0, string-width@npm:^4.2.0, string-width@npm:^4.2.3":
+"streamx@npm:^2.12.5, streamx@npm:^2.15.0, streamx@npm:^2.25.0":
+  version: 2.28.0
+  resolution: "streamx@npm:2.28.0"
+  dependencies:
+    events-universal: "npm:^1.0.0"
+    fast-fifo: "npm:^1.3.2"
+    text-decoder: "npm:^1.1.0"
+  checksum: 10c0/1cd5647c4dbdaadf4623b48183bab1d71bdc251e24c8f3baddf9fb9fa75096a7d446aba2c58a4f71964eeb5753f514b59e97bfdf94a60ce2c1b33594410b0342
+  languageName: node
+  linkType: hard
+
+"string-width-cjs@npm:string-width@^4.2.0, string-width@npm:^1.0.2 || 2 || 3 || 4, string-width@npm:^4.0.0, string-width@npm:^4.1.0, string-width@npm:^4.2.0, string-width@npm:^4.2.2, string-width@npm:^4.2.3":
   version: 4.2.3
   resolution: "string-width@npm:4.2.3"
   dependencies:
@@ -12224,7 +14948,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"string_decoder@npm:^1.1.1":
+"string_decoder@npm:^1.1.1, string_decoder@npm:^1.3.0":
   version: 1.3.0
   resolution: "string_decoder@npm:1.3.0"
   dependencies:
@@ -12233,6 +14957,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"string_decoder@npm:~1.1.1":
+  version: 1.1.1
+  resolution: "string_decoder@npm:1.1.1"
+  dependencies:
+    safe-buffer: "npm:~5.1.0"
+  checksum: 10c0/b4f89f3a92fd101b5653ca3c99550e07bdf9e13b35037e9e2a1c7b47cec4e55e06ff3fc468e314a0b5e80bfbaf65c1ca5a84978764884ae9413bec1fc6ca924e
+  languageName: node
+  linkType: hard
+
 "strip-ansi-cjs@npm:strip-ansi@^6.0.1, strip-ansi@npm:^6.0.0, strip-ansi@npm:^6.0.1":
   version: 6.0.1
   resolution: "strip-ansi@npm:6.0.1"
@@ -12339,6 +15072,37 @@ __metadata:
   languageName: node
   linkType: hard
 
+"superstatic@npm:^10.0.0":
+  version: 10.0.0
+  resolution: "superstatic@npm:10.0.0"
+  dependencies:
+    basic-auth-connect: "npm:^1.1.0"
+    commander: "npm:^10.0.0"
+    compression: "npm:^1.7.0"
+    connect: "npm:^3.7.0"
+    destroy: "npm:^1.0.4"
+    glob-slasher: "npm:^1.0.1"
+    is-url: "npm:^1.2.2"
+    join-path: "npm:^1.1.1"
+    lodash: "npm:^4.17.19"
+    mime-types: "npm:^2.1.35"
+    minimatch: "npm:^6.1.6"
+    morgan: "npm:^1.8.2"
+    on-finished: "npm:^2.2.0"
+    on-headers: "npm:^1.0.0"
+    path-to-regexp: "npm:^1.9.0"
+    re2: "npm:^1.17.7"
+    router: "npm:^2.0.0"
+    update-notifier-cjs: "npm:^5.1.6"
+  dependenciesMeta:
+    re2:
+      optional: true
+  bin:
+    superstatic: lib/bin/server.js
+  checksum: 10c0/af83480c2b46e8b6098791a327c1520a8a2813dfc624ac29d91fa08d60019f257b400f1af5152d8d8d63fb5267ce58c1e2a5dca143b04f4ec5d2f686a2b51aff
+  languageName: node
+  linkType: hard
+
 "supertest@npm:^6.3.4":
   version: 6.3.4
   resolution: "supertest@npm:6.3.4"
@@ -12369,7 +15133,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"supports-color@npm:^7.1.0":
+"supports-color@npm:^7.0.0, supports-color@npm:^7.1.0":
   version: 7.2.0
   resolution: "supports-color@npm:7.2.0"
   dependencies:
@@ -12378,6 +15142,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"supports-hyperlinks@npm:^3.1.0":
+  version: 3.2.0
+  resolution: "supports-hyperlinks@npm:3.2.0"
+  dependencies:
+    has-flag: "npm:^4.0.0"
+    supports-color: "npm:^7.0.0"
+  checksum: 10c0/bca527f38d4c45bc95d6a24225944675746c515ddb91e2456d00ae0b5c537658e9dd8155b996b191941b0c19036195a098251304b9082bbe00cd1781f3cd838e
+  languageName: node
+  linkType: hard
+
 "supports-preserve-symlinks-flag@npm:^1.0.0":
   version: 1.0.0
   resolution: "supports-preserve-symlinks-flag@npm:1.0.0"
@@ -12470,6 +15244,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"tar-stream@npm:^3.0.0":
+  version: 3.2.0
+  resolution: "tar-stream@npm:3.2.0"
+  dependencies:
+    b4a: "npm:^1.6.4"
+    bare-fs: "npm:^4.5.5"
+    fast-fifo: "npm:^1.2.0"
+    streamx: "npm:^2.15.0"
+  checksum: 10c0/8a06c915f93c9b0906e79867e36a9cfe197da4d41b72e89ec0de99577ae755505d14815c1346b70c2410aa09d3145c3e3af2ff5802b6af84990cdd6c60dbb997
+  languageName: node
+  linkType: hard
+
 "tar@npm:7.5.16":
   version: 7.5.16
   resolution: "tar@npm:7.5.16"
@@ -12483,6 +15269,28 @@ __metadata:
   languageName: node
   linkType: hard
 
+"tcp-port-used@npm:^1.0.2":
+  version: 1.0.3
+  resolution: "tcp-port-used@npm:1.0.3"
+  dependencies:
+    debug: "npm:4.3.1"
+    is2: "npm:2.0.1"
+  checksum: 10c0/23a330e9f59fb6e2dffe67263d518ac31566632092a5b78394add56bd3706f63a80851dea4f519eb3689051b0bfa6d23b0ff52798f1b56f75b3b0dbf1b589885
+  languageName: node
+  linkType: hard
+
+"teeny-request@npm:^10.0.0":
+  version: 10.1.4
+  resolution: "teeny-request@npm:10.1.4"
+  dependencies:
+    http-proxy-agent: "npm:^7.0.0"
+    https-proxy-agent: "npm:^7.0.1"
+    node-fetch: "npm:^3.3.2"
+    stream-events: "npm:^1.0.5"
+  checksum: 10c0/18b5228feff52a011f601a394bb65f3f2b66e3818618b78de1df80761506e359f4252328f6672763804414041a383ea5a31cc8ccd6dc258c170eb1eaa52c5822
+  languageName: node
+  linkType: hard
+
 "teeny-request@npm:^9.0.0":
   version: 9.0.0
   resolution: "teeny-request@npm:9.0.0"
@@ -12496,6 +15304,24 @@ __metadata:
   languageName: node
   linkType: hard
 
+"teex@npm:^1.0.1":
+  version: 1.0.1
+  resolution: "teex@npm:1.0.1"
+  dependencies:
+    streamx: "npm:^2.12.5"
+  checksum: 10c0/8df9166c037ba694b49d32a49858e314c60e513d55ac5e084dbf1ddbb827c5fa43cc389a81e87684419c21283308e9d68bb068798189c767ec4c252f890b8a77
+  languageName: node
+  linkType: hard
+
+"text-decoder@npm:^1.1.0":
+  version: 1.2.7
+  resolution: "text-decoder@npm:1.2.7"
+  dependencies:
+    b4a: "npm:^1.6.4"
+  checksum: 10c0/929938ed154fbadb660a7f3d1aca30b7e53649a731af7583168fcfba0c158046325d35d945926e2a512bb62d1a49a7818151c987ea38b48853f01e1615722fc5
+  languageName: node
+  linkType: hard
+
 "text-extensions@npm:^2.0.0":
   version: 2.4.0
   resolution: "text-extensions@npm:2.4.0"
@@ -12503,6 +15329,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"text-hex@npm:1.0.x":
+  version: 1.0.0
+  resolution: "text-hex@npm:1.0.0"
+  checksum: 10c0/57d8d320d92c79d7c03ffb8339b825bb9637c2cbccf14304309f51d8950015c44464b6fd1b6820a3d4821241c68825634f09f5a2d9d501e84f7c6fd14376860d
+  languageName: node
+  linkType: hard
+
 "text-table@npm:^0.2.0":
   version: 0.2.0
   resolution: "text-table@npm:0.2.0"
@@ -12510,6 +15343,24 @@ __metadata:
   languageName: node
   linkType: hard
 
+"thenify-all@npm:^1.0.0":
+  version: 1.6.0
+  resolution: "thenify-all@npm:1.6.0"
+  dependencies:
+    thenify: "npm:>= 3.1.0 < 4"
+  checksum: 10c0/9b896a22735e8122754fe70f1d65f7ee691c1d70b1f116fda04fea103d0f9b356e3676cb789506e3909ae0486a79a476e4914b0f92472c2e093d206aed4b7d6b
+  languageName: node
+  linkType: hard
+
+"thenify@npm:>= 3.1.0 < 4":
+  version: 3.3.1
+  resolution: "thenify@npm:3.3.1"
+  dependencies:
+    any-promise: "npm:^1.0.0"
+  checksum: 10c0/f375aeb2b05c100a456a30bc3ed07ef03a39cbdefe02e0403fb714b8c7e57eeaad1a2f5c4ecfb9ce554ce3db9c2b024eba144843cd9e344566d9fcee73b04767
+  languageName: node
+  linkType: hard
+
 "through@npm:>=2.2.7 <3":
   version: 2.3.8
   resolution: "through@npm:2.3.8"
@@ -12565,6 +15416,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"tmp@npm:^0.2.3":
+  version: 0.2.7
+  resolution: "tmp@npm:0.2.7"
+  checksum: 10c0/59eb55584f2f07210d3231b6a1f6b5c2b9794d8a7b509c8ee867ed2acad6d2245ee2448b7937b676ffbff3155a70077edde8a69f9d7cf0f90c86a62e8910c357
+  languageName: node
+  linkType: hard
+
 "tmp@npm:^0.2.4":
   version: 0.2.5
   resolution: "tmp@npm:0.2.5"
@@ -12610,6 +15468,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"toxic@npm:^1.0.0":
+  version: 1.0.1
+  resolution: "toxic@npm:1.0.1"
+  dependencies:
+    lodash: "npm:^4.17.10"
+  checksum: 10c0/c741731885ffc75e8f955899fb378c1fafde71ea3556d4526a2357d82639066d5ab01d54d10d3d099ec9886649be7a500ac51e50439cf8feda95b2ecffaad839
+  languageName: node
+  linkType: hard
+
 "tr46@npm:~0.0.3":
   version: 0.0.3
   resolution: "tr46@npm:0.0.3"
@@ -12626,6 +15493,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"triple-beam@npm:^1.3.0":
+  version: 1.4.1
+  resolution: "triple-beam@npm:1.4.1"
+  checksum: 10c0/4bf1db71e14fe3ff1c3adbe3c302f1fdb553b74d7591a37323a7badb32dc8e9c290738996cbb64f8b10dc5a3833645b5d8c26221aaaaa12e50d1251c9aba2fea
+  languageName: node
+  linkType: hard
+
 "ts-api-utils@npm:^1.3.0":
   version: 1.4.3
   resolution: "ts-api-utils@npm:1.4.3"
@@ -12651,7 +15525,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ts-node@npm:^10.9.2":
+"ts-node@npm:^10.9.1, ts-node@npm:^10.9.2":
   version: 10.9.2
   resolution: "ts-node@npm:10.9.2"
   dependencies:
@@ -12712,7 +15586,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tslib@npm:2.8.1, tslib@npm:^2.1.0, tslib@npm:^2.4.0, tslib@npm:^2.6.2, tslib@npm:^2.8.1":
+"tslib@npm:2.8.1, tslib@npm:^2.0.1, tslib@npm:^2.1.0, tslib@npm:^2.4.0, tslib@npm:^2.6.2, tslib@npm:^2.8.1":
   version: 2.8.1
   resolution: "tslib@npm:2.8.1"
   checksum: 10c0/9c4759110a19c53f992d9aae23aac5ced636e99887b51b9e61def52611732872ff7668757d4e4c61f19691e36f4da981cd9485e869b4a7408d689f6bf1f14e62
@@ -12726,6 +15600,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"tsscmp@npm:^1.0.6":
+  version: 1.0.6
+  resolution: "tsscmp@npm:1.0.6"
+  checksum: 10c0/2f79a9455e7e3e8071995f98cdf3487ccfc91b760bec21a9abb4d90519557eafaa37246e87c92fa8bf3fef8fd30cfd0cc3c4212bb929baa9fb62494bfa4d24b2
+  languageName: node
+  linkType: hard
+
 "tsutils@npm:^3.21.0":
   version: 3.21.0
   resolution: "tsutils@npm:3.21.0"
@@ -12762,7 +15643,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"type-is@npm:^1.6.18":
+"type-is@npm:^1.6.18, type-is@npm:~1.6.18":
   version: 1.6.18
   resolution: "type-is@npm:1.6.18"
   dependencies:
@@ -12847,6 +15728,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"typedarray-to-buffer@npm:^3.1.5":
+  version: 3.1.5
+  resolution: "typedarray-to-buffer@npm:3.1.5"
+  dependencies:
+    is-typedarray: "npm:^1.0.0"
+  checksum: 10c0/4ac5b7a93d604edabf3ac58d3a2f7e07487e9f6e98195a080e81dbffdc4127817f470f219d794a843b87052cedef102b53ac9b539855380b8c2172054b7d5027
+  languageName: node
+  linkType: hard
+
 "typedarray@npm:^0.0.6":
   version: 0.0.6
   resolution: "typedarray@npm:0.0.6"
@@ -13044,13 +15934,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"undici-types@npm:~5.26.4":
-  version: 5.26.5
-  resolution: "undici-types@npm:5.26.5"
-  checksum: 10c0/bb673d7876c2d411b6eb6c560e0c571eef4a01c1c19925175d16e3a30c4c428181fb8d7ae802a261f283e4166a0ac435e2f505743aa9e45d893f9a3df017b501
-  languageName: node
-  linkType: hard
-
 "undici-types@npm:~6.21.0":
   version: 6.21.0
   resolution: "undici-types@npm:6.21.0"
@@ -13065,6 +15948,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"undici@npm:^8.4.1":
+  version: 8.10.0
+  resolution: "undici@npm:8.10.0"
+  checksum: 10c0/37ae2b1db8f65c3a003504e2040e96887b99f9db16ba07dcf49c37ed8b7f8c72f4452f2d46f52f7c9e49518fe8325e3b5e7e02ac3a2424886bd67d4b62a0ecab
+  languageName: node
+  linkType: hard
+
 "unicode-emoji-modifier-base@npm:^1.0.0":
   version: 1.0.0
   resolution: "unicode-emoji-modifier-base@npm:1.0.0"
@@ -13115,6 +16005,25 @@ __metadata:
   languageName: node
   linkType: hard
 
+"unique-string@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "unique-string@npm:2.0.0"
+  dependencies:
+    crypto-random-string: "npm:^2.0.0"
+  checksum: 10c0/11820db0a4ba069d174bedfa96c588fc2c96b083066fafa186851e563951d0de78181ac79c744c1ed28b51f9d82ac5b8196ff3e4560d0178046ef455d8c2244b
+  languageName: node
+  linkType: hard
+
+"universal-analytics@npm:^0.5.3":
+  version: 0.5.4
+  resolution: "universal-analytics@npm:0.5.4"
+  dependencies:
+    debug: "npm:^4.3.1"
+    uuid: "npm:^14.0.0"
+  checksum: 10c0/3e4aed50e38a70b7ddf29ce3e16233c84e4b72d7aa2b79db3cce6dacc0459075f291a0d76ce3f5f65b7d72f2236700246dd1361e1c02b62955ca07057f442269
+  languageName: node
+  linkType: hard
+
 "universalify@npm:^2.0.0":
   version: 2.0.1
   resolution: "universalify@npm:2.0.1"
@@ -13168,6 +16077,30 @@ __metadata:
   languageName: node
   linkType: hard
 
+"update-notifier-cjs@npm:^5.1.6":
+  version: 5.1.7
+  resolution: "update-notifier-cjs@npm:5.1.7"
+  dependencies:
+    boxen: "npm:^5.0.0"
+    chalk: "npm:^4.1.0"
+    configstore: "npm:^5.0.1"
+    has-yarn: "npm:^2.1.0"
+    import-lazy: "npm:^2.1.0"
+    is-ci: "npm:^2.0.0"
+    is-installed-globally: "npm:^0.4.0"
+    is-npm: "npm:^5.0.0"
+    is-yarn-global: "npm:^0.3.0"
+    isomorphic-fetch: "npm:^3.0.0"
+    pupa: "npm:^2.1.1"
+    registry-auth-token: "npm:^5.0.1"
+    registry-url: "npm:^5.1.0"
+    semver: "npm:^7.3.7"
+    semver-diff: "npm:^3.1.1"
+    xdg-basedir: "npm:^4.0.0"
+  checksum: 10c0/6b264940deb485be8892615d5c17c6dff8b2f820a03079f083b635a589327b7876a83e5cd9b32e392cd2e7f73282d9834130debbce190a176ce268c612979e32
+  languageName: node
+  linkType: hard
+
 "uri-js@npm:^4.2.2":
   version: 4.4.1
   resolution: "uri-js@npm:4.4.1"
@@ -13177,14 +16110,28 @@ __metadata:
   languageName: node
   linkType: hard
 
-"util-deprecate@npm:^1.0.1":
+"url-join@npm:0.0.1":
+  version: 0.0.1
+  resolution: "url-join@npm:0.0.1"
+  checksum: 10c0/2d45954bd78dfa12d4de1bfb7fe4fedb3bfa8ac12eadc0c3171078bf54b1bbb31999b996d4d23553e9da95a0e047574486733842f679c51d04965e189c5a6840
+  languageName: node
+  linkType: hard
+
+"url-template@npm:^2.0.8":
+  version: 2.0.8
+  resolution: "url-template@npm:2.0.8"
+  checksum: 10c0/56a15057eacbcf05d52b0caed8279c8451b3dd9d32856a1fdd91c6dc84dcb1646f12bafc756b7ade62ca5b1564da8efd7baac5add35868bafb43eb024c62805b
+  languageName: node
+  linkType: hard
+
+"util-deprecate@npm:^1.0.1, util-deprecate@npm:~1.0.1":
   version: 1.0.2
   resolution: "util-deprecate@npm:1.0.2"
   checksum: 10c0/41a5bdd214df2f6c3ecf8622745e4a366c4adced864bc3c833739791aeeeb1838119af7daed4ba36428114b5c67dcda034a79c882e97e43c03e66a4dd7389942
   languageName: node
   linkType: hard
 
-"utils-merge@npm:^1.0.1":
+"utils-merge@npm:1.0.1, utils-merge@npm:^1.0.1":
   version: 1.0.1
   resolution: "utils-merge@npm:1.0.1"
   checksum: 10c0/02ba649de1b7ca8854bfe20a82f1dfbdda3fb57a22ab4a8972a63a34553cf7aa51bc9081cf7e001b035b88186d23689d69e71b510e610a09a4c66f68aa95b672
@@ -13209,6 +16156,24 @@ __metadata:
   languageName: node
   linkType: hard
 
+"uuid@npm:^14.0.0":
+  version: 14.0.1
+  resolution: "uuid@npm:14.0.1"
+  bin:
+    uuid: dist-node/bin/uuid
+  checksum: 10c0/2d961289097cb68c37d93d1da0b5c3aafc1eb9948a455cca8d0ae53a099b2fe583b8933254a84097f700e6bac2e23033364904df0467c22551d5d9611febcaf6
+  languageName: node
+  linkType: hard
+
+"uuid@npm:^8.3.2":
+  version: 8.3.2
+  resolution: "uuid@npm:8.3.2"
+  bin:
+    uuid: dist/bin/uuid
+  checksum: 10c0/bcbb807a917d374a49f475fae2e87fdca7da5e5530820ef53f65ba1d12131bd81a92ecf259cc7ce317cbe0f289e7d79fdfebcef9bfa3087c8c8a2fa304c9be54
+  languageName: node
+  linkType: hard
+
 "uuid@npm:^9.0.0, uuid@npm:^9.0.1":
   version: 9.0.1
   resolution: "uuid@npm:9.0.1"
@@ -13225,6 +16190,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"valid-url@npm:^1":
+  version: 1.0.9
+  resolution: "valid-url@npm:1.0.9"
+  checksum: 10c0/3995e65f9942dbcb1621754c0f9790335cec61e9e9310c0a809e9ae0e2ae91bb7fc6a471fba788e979db0418d9806639f681ecebacc869bc8c3de88efa562ee6
+  languageName: node
+  linkType: hard
+
+"validate-npm-package-name@npm:^5.0.0":
+  version: 5.0.1
+  resolution: "validate-npm-package-name@npm:5.0.1"
+  checksum: 10c0/903e738f7387404bb72f7ac34e45d7010c877abd2803dc2d614612527927a40a6d024420033132e667b1bade94544b8a1f65c9431a4eb30d0ce0d80093cd1f74
+  languageName: node
+  linkType: hard
+
 "validator@npm:^13.15.20":
   version: 13.15.26
   resolution: "validator@npm:13.15.26"
@@ -13232,7 +16211,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"vary@npm:^1, vary@npm:^1.1.2":
+"vary@npm:^1, vary@npm:^1.1.2, vary@npm:~1.1.2":
   version: 1.1.2
   resolution: "vary@npm:1.1.2"
   checksum: 10c0/f15d588d79f3675135ba783c91a4083dcd290a2a5be9fcb6514220a1634e23df116847b1cc51f66bfb0644cf9353b2abb7815ae499bab06e46dd33c1a6bf1f4f
@@ -13421,6 +16400,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"wcwidth@npm:^1.0.1":
+  version: 1.0.1
+  resolution: "wcwidth@npm:1.0.1"
+  dependencies:
+    defaults: "npm:^1.0.3"
+  checksum: 10c0/5b61ca583a95e2dd85d7078400190efd452e05751a64accb8c06ce4db65d7e0b0cde9917d705e826a2e05cc2548f61efde115ffa374c3e436d04be45c889e5b4
+  languageName: node
+  linkType: hard
+
 "web-streams-polyfill@npm:^3.0.3":
   version: 3.3.3
   resolution: "web-streams-polyfill@npm:3.3.3"
@@ -13486,6 +16474,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"whatwg-fetch@npm:^3.4.1":
+  version: 3.6.20
+  resolution: "whatwg-fetch@npm:3.6.20"
+  checksum: 10c0/fa972dd14091321d38f36a4d062298df58c2248393ef9e8b154493c347c62e2756e25be29c16277396046d6eaa4b11bd174f34e6403fff6aaca9fb30fa1ff46d
+  languageName: node
+  linkType: hard
+
 "whatwg-url@npm:^5.0.0":
   version: 5.0.0
   resolution: "whatwg-url@npm:5.0.0"
@@ -13579,6 +16574,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"which@npm:^7.0.0":
+  version: 7.0.0
+  resolution: "which@npm:7.0.0"
+  dependencies:
+    isexe: "npm:^4.0.0"
+  bin:
+    node-which: bin/which.js
+  checksum: 10c0/ca0b54f198f78bbc4b7c02e34bda8d335cb352e0adb4cbca1c37b1a957af3a879a82c4c27ca6525bc942f548d8b64f816ef6528360af9f3de55ffb9b979b620d
+  languageName: node
+  linkType: hard
+
 "why-is-node-running@npm:^2.3.0":
   version: 2.3.0
   resolution: "why-is-node-running@npm:2.3.0"
@@ -13600,6 +16606,45 @@ __metadata:
   languageName: node
   linkType: hard
 
+"widest-line@npm:^3.1.0":
+  version: 3.1.0
+  resolution: "widest-line@npm:3.1.0"
+  dependencies:
+    string-width: "npm:^4.0.0"
+  checksum: 10c0/b1e623adcfb9df35350dd7fc61295d6d4a1eaa65a406ba39c4b8360045b614af95ad10e05abf704936ed022569be438c4bfa02d6d031863c4166a238c301119f
+  languageName: node
+  linkType: hard
+
+"winston-transport@npm:^4.4.0, winston-transport@npm:^4.9.0":
+  version: 4.9.0
+  resolution: "winston-transport@npm:4.9.0"
+  dependencies:
+    logform: "npm:^2.7.0"
+    readable-stream: "npm:^3.6.2"
+    triple-beam: "npm:^1.3.0"
+  checksum: 10c0/e2990a172e754dbf27e7823772214a22dc8312f7ec9cfba831e5ef30a5d5528792e5ea8f083c7387ccfc5b2af20e3691f64738546c8869086110a26f98671095
+  languageName: node
+  linkType: hard
+
+"winston@npm:^3.0.0":
+  version: 3.19.0
+  resolution: "winston@npm:3.19.0"
+  dependencies:
+    "@colors/colors": "npm:^1.6.0"
+    "@dabh/diagnostics": "npm:^2.0.8"
+    async: "npm:^3.2.3"
+    is-stream: "npm:^2.0.0"
+    logform: "npm:^2.7.0"
+    one-time: "npm:^1.0.0"
+    readable-stream: "npm:^3.4.0"
+    safe-stable-stringify: "npm:^2.3.1"
+    stack-trace: "npm:0.0.x"
+    triple-beam: "npm:^1.3.0"
+    winston-transport: "npm:^4.9.0"
+  checksum: 10c0/341a8ccfb726120209d34e2466040e2ca72cadb1a3402c4fc90425facad002b81275675b4ab9b4432a624311bc47ef7c9fb7652c86fca454d2be2f2ee1882226
+  languageName: node
+  linkType: hard
+
 "word-wrap@npm:^1.2.5":
   version: 1.2.5
   resolution: "word-wrap@npm:1.2.5"
@@ -13647,6 +16692,40 @@ __metadata:
   languageName: node
   linkType: hard
 
+"write-file-atomic@npm:^3.0.0":
+  version: 3.0.3
+  resolution: "write-file-atomic@npm:3.0.3"
+  dependencies:
+    imurmurhash: "npm:^0.1.4"
+    is-typedarray: "npm:^1.0.0"
+    signal-exit: "npm:^3.0.2"
+    typedarray-to-buffer: "npm:^3.1.5"
+  checksum: 10c0/7fb67affd811c7a1221bed0c905c26e28f0041e138fb19ccf02db57a0ef93ea69220959af3906b920f9b0411d1914474cdd90b93a96e5cd9e8368d9777caac0e
+  languageName: node
+  linkType: hard
+
+"ws@npm:^7.5.10":
+  version: 7.5.13
+  resolution: "ws@npm:7.5.13"
+  peerDependencies:
+    bufferutil: ^4.0.1
+    utf-8-validate: ^5.0.2
+  peerDependenciesMeta:
+    bufferutil:
+      optional: true
+    utf-8-validate:
+      optional: true
+  checksum: 10c0/e223726bbda5768ed58ec9252d04eda7018ef380ea122bb94e595a4d7a02b5baeb423933936576fddb8fa51b642375f7ae814bf0f6f5d9a3ce290566578a8c5a
+  languageName: node
+  linkType: hard
+
+"xdg-basedir@npm:^4.0.0":
+  version: 4.0.0
+  resolution: "xdg-basedir@npm:4.0.0"
+  checksum: 10c0/1b5d70d58355af90363a4e0a51c992e77fc5a1d8de5822699c7d6e96a6afea9a1e048cb93312be6870f338ca45ebe97f000425028fa149c1e87d1b5b8b212a06
+  languageName: node
+  linkType: hard
+
 "xml-naming@npm:^0.1.0":
   version: 0.1.0
   resolution: "xml-naming@npm:0.1.0"
@@ -13654,6 +16733,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"xtend@npm:^4.0.0":
+  version: 4.0.2
+  resolution: "xtend@npm:4.0.2"
+  checksum: 10c0/366ae4783eec6100f8a02dff02ac907bf29f9a00b82ac0264b4d8b832ead18306797e283cf19de776538babfdcb2101375ec5646b59f08c52128ac4ab812ed0e
+  languageName: node
+  linkType: hard
+
 "y18n@npm:^5.0.5":
   version: 5.0.8
   resolution: "y18n@npm:5.0.8"
@@ -13682,6 +16768,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"yaml@npm:^2.2.1, yaml@npm:^2.8.3":
+  version: 2.9.0
+  resolution: "yaml@npm:2.9.0"
+  bin:
+    yaml: bin.mjs
+  checksum: 10c0/f340718df45e97a9551b9bf9dac61c80050bc464513b710debfb5067c380c8472e3b67809cffacb4ab5ffb5e66ef9310816c88b05f371cec60abfedd8c88e0a2
+  languageName: node
+  linkType: hard
+
 "yaml@npm:^2.2.2":
   version: 2.8.3
   resolution: "yaml@npm:2.8.3"
@@ -13691,6 +16786,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"yargs-parser@npm:^20.2.2":
+  version: 20.2.9
+  resolution: "yargs-parser@npm:20.2.9"
+  checksum: 10c0/0685a8e58bbfb57fab6aefe03c6da904a59769bd803a722bb098bd5b0f29d274a1357762c7258fb487512811b8063fb5d2824a3415a0a4540598335b3b086c72
+  languageName: node
+  linkType: hard
+
 "yargs-parser@npm:^21.1.1":
   version: 21.1.1
   resolution: "yargs-parser@npm:21.1.1"
@@ -13713,6 +16815,21 @@ __metadata:
   languageName: node
   linkType: hard
 
+"yargs@npm:^16.0.0":
+  version: 16.2.2
+  resolution: "yargs@npm:16.2.2"
+  dependencies:
+    cliui: "npm:^7.0.2"
+    escalade: "npm:^3.1.1"
+    get-caller-file: "npm:^2.0.5"
+    require-directory: "npm:^2.1.1"
+    string-width: "npm:^4.2.0"
+    y18n: "npm:^5.0.5"
+    yargs-parser: "npm:^20.2.2"
+  checksum: 10c0/1ca2152581ee7c9c9fb4174767ff7294b1c272d2d0a1f6eb13c39ce177fded85eb9c96711e00cd7913c0a9b88b6e763713ee11cae81b9b62fd97bdd0b03d5549
+  languageName: node
+  linkType: hard
+
 "yargs@npm:^17.7.3":
   version: 17.7.3
   resolution: "yargs@npm:17.7.3"
@@ -13763,7 +16880,34 @@ __metadata:
   languageName: node
   linkType: hard
 
-"zod@npm:^4.4.3":
+"zip-stream@npm:^6.0.1":
+  version: 6.0.1
+  resolution: "zip-stream@npm:6.0.1"
+  dependencies:
+    archiver-utils: "npm:^5.0.0"
+    compress-commons: "npm:^6.0.2"
+    readable-stream: "npm:^4.0.0"
+  checksum: 10c0/50f2fb30327fb9d09879abf7ae2493705313adf403e794b030151aaae00009162419d60d0519e807673ec04d442e140c8879ca14314df0a0192de3b233e8f28b
+  languageName: node
+  linkType: hard
+
+"zod-to-json-schema@npm:^3.24.5, zod-to-json-schema@npm:^3.25.1":
+  version: 3.25.2
+  resolution: "zod-to-json-schema@npm:3.25.2"
+  peerDependencies:
+    zod: ^3.25.28 || ^4
+  checksum: 10c0/dd300554393903022487688af14fbda5c719ba8179702bb55b3aa86318830467f0f7beb7d654036975ac963dc4843b72e59636448bfff9a0608f277bb6a14939
+  languageName: node
+  linkType: hard
+
+"zod@npm:^3.24.3":
+  version: 3.25.76
+  resolution: "zod@npm:3.25.76"
+  checksum: 10c0/5718ec35e3c40b600316c5b4c5e4976f7fee68151bc8f8d90ec18a469be9571f072e1bbaace10f1e85cf8892ea12d90821b200e980ab46916a6166a4260a983c
+  languageName: node
+  linkType: hard
+
+"zod@npm:^3.25 || ^4.0, zod@npm:^4.4.3":
   version: 4.4.3
   resolution: "zod@npm:4.4.3"
   checksum: 10c0/7ea31b558e88f9faf44f31dd185e2e1cbf51fed3081787fb96cc2534749b50c0acfc6da7f0922a7353ed092dd358c7d50c28ea96c94d04af64191bd33152eca3