diff --git a/.github/workflows/refresh-lockfile.yml b/.github/workflows/refresh-lockfile.yml
index ecc0c73ebee..59f47b01531 100644
--- a/.github/workflows/refresh-lockfile.yml
+++ b/.github/workflows/refresh-lockfile.yml
@@ -39,6 +39,9 @@ jobs:
       - name: Refresh pnpm lockfile
         run: pnpm install --resolution-only --ignore-scripts --no-frozen-lockfile
 
+      - name: Refresh reviewed eval report dependency proof
+        run: node tests/runner-e2e/prepare-report-lock.mjs --refresh
+
       - name: Fail on unexpected file changes
         run: |
           changed="$(git status --porcelain)"
@@ -46,7 +49,8 @@ jobs:
             echo "Lockfile is already up to date."
             exit 0
           fi
-          if printf '%s\n' "$changed" | grep -Fvq ' pnpm-lock.yaml'; then
+          unexpected="$(printf '%s\n' "$changed" | awk '$2 != "pnpm-lock.yaml" && $2 != "tests/runner-e2e/report-lock.json" && $2 != "tests/runner-e2e/report-lock.patch" { print }')"
+          if [ -n "$unexpected" ]; then
             echo "Unexpected files changed during lockfile refresh:"
             echo "$changed"
             exit 1
@@ -69,7 +73,7 @@ jobs:
           git config user.email "lockfile-bot@users.noreply.github.com"
 
           git checkout -B "$BRANCH"
-          git add pnpm-lock.yaml
+          git add pnpm-lock.yaml tests/runner-e2e/report-lock.json tests/runner-e2e/report-lock.patch
           git commit -m "chore(lockfile): refresh pnpm-lock.yaml"
           git push --force origin "$BRANCH"
 
@@ -80,10 +84,59 @@ jobs:
             head -n 1
           )"
           if [ -z "$pr_url" ]; then
+            pr_body_file="$RUNNER_TEMP/lockfile-pr-body.md"
+            cat > "$pr_body_file" <<'PR_BODY'
+          ## Thinking Path
+
+          > - Paperclip uses a dependency lock for reproducible builds.
+          > - Dependency changes on master need matching lock entries.
+          > - Paid eval reports also pin a reviewed offline correction.
+          > - Reports must install before paid model work starts.
+          > - This automated PR keeps the lock and report proof together.
+
+          ## Linked Issues or Issue Description
+
+          **What happened?**
+
+          Dependency manifests on master changed after the last committed lock refresh.
+
+          **Expected behavior**
+
+          Frozen installs must match those manifests. Eval reports must retain matching offline lock proof.
+
+          **Steps to reproduce**
+
+          Run a frozen install before and after this lock refresh.
+
+          ## What Changed
+
+          - Refresh the dependency lock from the manifests on master.
+          - Include the matching offline report correction and hashes.
+
+          ## Verification
+
+          - Pinned pnpm resolution completed with lifecycle scripts disabled.
+          - The report proof refresh accepted the reviewed committed baseline.
+          - Required PR checks and reviews must pass before merge.
+
+          ## Risks
+
+          Dependency changes require review. Unknown report lock baselines remain blocked. This update changes no permissions or paid enable gates.
+
+          ## Model Used
+
+          None — generated by pnpm and the deterministic report-lock updater.
+
+          ## Checklist
+
+          - [x] Thinking path and problem description included
+          - [x] Generated lock and matching report proof included
+          - [ ] Required CI checks and reviews pass
+          PR_BODY
             pr_url="$(gh pr create \
               --head "$BRANCH" \
               --title "chore(lockfile): refresh pnpm-lock.yaml" \
-              --body "Auto-generated lockfile refresh after dependencies changed on master. This PR only updates pnpm-lock.yaml.")"
+              --body-file "$pr_body_file")"
             echo "Created new PR: $pr_url"
           else
             echo "PR already exists: $pr_url"
diff --git a/.github/workflows/runner-full-stack-e2e.yml b/.github/workflows/runner-full-stack-e2e.yml
index c1a402d1a4c..fcac6ebf260 100644
--- a/.github/workflows/runner-full-stack-e2e.yml
+++ b/.github/workflows/runner-full-stack-e2e.yml
@@ -196,9 +196,21 @@ jobs:
         with:
           node-version: 24
 
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
+        env:
+          NPM_CONFIG_AUDIT: "false"
+          NPM_CONFIG_FUND: "false"
+          NPM_CONFIG_UPDATE_NOTIFIER: "false"
+        with:
+          version: 9.15.4
+          run_install: false
+
       - name: Preflight reviewed report dependencies before paid admission
         run: node tests/runner-e2e/prepare-report-lock.mjs
 
+      - name: Validate report dependency manifests offline
+        run: pnpm install --lockfile-only --frozen-lockfile --ignore-scripts --offline
+
   target_lock:
     name: Resolve target pnpm lockfile
     needs: authorize
diff --git a/tests/runner-e2e/OPERATIONS.md b/tests/runner-e2e/OPERATIONS.md
index e193652ba13..732ef2ca680 100644
--- a/tests/runner-e2e/OPERATIONS.md
+++ b/tests/runner-e2e/OPERATIONS.md
@@ -976,11 +976,17 @@ install. `report-lock.json` pins the input lock, patch and resulting lock hashes
 This updates existing patch identities and the already declared yaml dependency
 without registry resolution. The worker target and its lock artifact never
 control report dependencies. An already-reviewed output lock is used unchanged. An unknown committed lock fails before install;
-update and review this correction when dependency inputs change. The original
+review the correction with dependency changes. The existing lockfile-refresh bot runs
+`prepare-report-lock.mjs --refresh` and includes the correction and hashes in its
+lockfile PR. The PR includes the root lock, which is owned by CODEOWNERS;
+the bot requests normal auto-merge and cannot bypass required code-owner review
+or checks. It refuses to bless an unrecognized committed lock. Paid authorization
+and report jobs still apply only the reviewed offline correction. The original
 failed run remains failed when retained evidence gets a new presentation.
 
-The trusted authorization job checks this correction before catalog/build and
-paid work. Unknown dependency locks fail before model admission. Manual history
+The trusted authorization job checks this correction and validates the frozen
+lock against current dependency manifests offline before catalog/build and paid
+work. This check resolves no packages and runs no lifecycle scripts. Unknown dependency locks fail before model admission. Manual history
 publication applies the same correction before its frozen install. Qualification
 image builds apply it only when target and workflow revisions match; a different
 target keeps its own lock and does not require these reporting helper files.
diff --git a/tests/runner-e2e/prepare-report-lock.d.mts b/tests/runner-e2e/prepare-report-lock.d.mts
index a6314304c3f..c69a6f0e43a 100644
--- a/tests/runner-e2e/prepare-report-lock.d.mts
+++ b/tests/runner-e2e/prepare-report-lock.d.mts
@@ -1 +1,2 @@
 export function prepareReportLock(root?: string): Promise<'already-reviewed' | 'reviewed-correction'>;
+export function refreshReportLock(root?: string): Promise<'unchanged' | 'refreshed'>;
diff --git a/tests/runner-e2e/prepare-report-lock.mjs b/tests/runner-e2e/prepare-report-lock.mjs
index 587a1428592..2916e1d4b52 100644
--- a/tests/runner-e2e/prepare-report-lock.mjs
+++ b/tests/runner-e2e/prepare-report-lock.mjs
@@ -26,6 +26,29 @@ export async function prepareReportLock(root = path.resolve(import.meta.dirname,
     return 'reviewed-correction';
   } finally { await rm(temporary, { recursive: true, force: true }); }
 }
+export async function refreshReportLock(root = path.resolve(import.meta.dirname, '../..')) {
+  const directory = path.join(root, 'tests/runner-e2e');
+  const policyPath = path.join(directory, 'report-lock.json');
+  const policy = JSON.parse(await readFile(policyPath, 'utf8'));
+  const committed = execFileSync('git', ['show', 'HEAD:pnpm-lock.yaml'], { cwd: root });
+  const inputSha256 = sha256(committed);
+  if (![policy.inputSha256, policy.outputSha256].includes(inputSha256)) {
+    throw new Error('Committed report lock is not reviewed; refusing to refresh its proof');
+  }
+  const resolved = await readFile(path.join(root, 'pnpm-lock.yaml'));
+  if (resolved.equals(committed)) return 'unchanged';
+  const patch = execFileSync('git', ['diff', '--no-ext-diff', '--no-textconv', '--no-color', 'HEAD', '--', 'pnpm-lock.yaml'], { cwd: root });
+  const changed = execFileSync('git', ['apply', '--numstat', '-'], { cwd: root, input: patch, encoding: 'utf8' });
+  if (!/^\d+\s+\d+\s+pnpm-lock\.yaml\n$/.test(changed)) throw new Error('Report correction must change only the lockfile');
+  await writeFile(path.join(directory, 'report-lock.patch'), patch);
+  await writeFile(policyPath, JSON.stringify({ inputSha256, outputSha256: sha256(resolved), patchSha256: sha256(patch),
+    basis: 'Generated with the trusted master lockfile refresh. Review this offline correction and its hashes with the dependency changes.' }, null, 2) + '\n');
+  return 'refreshed';
+}
+
 if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
-  console.log(await prepareReportLock());
+  const args = process.argv.slice(2);
+  if (args.length === 0) console.log(await prepareReportLock());
+  else if (args.length === 1 && args[0] === '--refresh') console.log(await refreshReportLock());
+  else throw new Error('Usage: prepare-report-lock.mjs [--refresh]');
 }
diff --git a/tests/runner-e2e/prepare-report-lock.test.ts b/tests/runner-e2e/prepare-report-lock.test.ts
index a13b064ec48..463a841bf26 100644
--- a/tests/runner-e2e/prepare-report-lock.test.ts
+++ b/tests/runner-e2e/prepare-report-lock.test.ts
@@ -1,11 +1,11 @@
-import { mkdtemp, mkdir, readFile, writeFile, copyFile, rm } from 'node:fs/promises';
+import { mkdtemp, mkdir, readFile, writeFile, copyFile, realpath, rm } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { expect, it } from 'vitest';
 import { parse } from 'yaml';
-import { prepareReportLock } from './prepare-report-lock.mjs';
+import { prepareReportLock, refreshReportLock } from './prepare-report-lock.mjs';
 
 it.each(['valid', 'unknown-lock', 'changed-patch', 'wrong-output'])(
   'installs only the reviewed dependency correction: %s', async variant => {
@@ -37,12 +37,15 @@ it.each(['valid', 'unknown-lock', 'changed-patch', 'wrong-output'])(
         expect(await prepareReportLock(root)).toBe('reviewed-correction');
         expect(createHash('sha256').update(await readFile(lock)).digest('hex')).toBe(policy.outputSha256);
         expect(await prepareReportLock(root)).toBe('already-reviewed');
-        const before = parse(input.toString()).packages;
-        const after = parse(await readFile(lock, 'utf8')).packages;
-        expect(Object.keys(after).filter(key => !Object.hasOwn(before, key))).toEqual(['yaml@2.9.1']);
-        for (const [key, value] of Object.entries(before)) expect(after[key]).toEqual(value);
-        expect(after['yaml@2.9.1'].resolution.integrity).toBe('sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==');
-
+        const reviewed = parse(await readFile(lock, 'utf8'));
+        const ui = JSON.parse(await readFile(path.resolve(here, '../../ui/package.json'), 'utf8'));
+        for (const [name, specifier] of Object.entries(ui.dependencies)) {
+          const entry = reviewed.importers.ui.dependencies[name];
+          expect(entry.specifier).toBe(specifier);
+          if (entry.version.startsWith('link:')) continue;
+          expect(reviewed.packages, name).toHaveProperty(`${name}@${entry.version.split('(')[0]}`);
+          expect(reviewed.snapshots, name).toHaveProperty(`${name}@${entry.version}`);
+        }
       } else {
         await expect(prepareReportLock(root)).rejects.toThrow();
         expect(await readFile(lock)).toEqual(variant === 'unknown-lock' ? Buffer.from('unknown\n') : input);
@@ -50,3 +53,50 @@ it.each(['valid', 'unknown-lock', 'changed-patch', 'wrong-output'])(
     } finally { await rm(root, { recursive: true, force: true }); }
   },
 );
+
+
+it.each(['input', 'output', 'unknown'])('refreshes dependency proof only from a %s committed lock', async variant => {
+  const root = await realpath(await mkdtemp(path.join(tmpdir(), 'eval-report-lock-refresh-')));
+  const relative = path.join(root, 'tests/runner-e2e');
+  const original = "lockfileVersion: '9.0'\nimporters: {}\npackages:\n  old@1.0.0: {resolution: {integrity: fixture-old}}\n";
+  const resolved = "lockfileVersion: '9.0'\nimporters:\n  ui: {}\npackages:\n  added@2.0.0: {resolution: {integrity: fixture-new}}\n";
+  const hash = (value: string) => createHash('sha256').update(value).digest('hex');
+  try {
+    await mkdir(relative, { recursive: true });
+    await writeFile(path.join(root, 'pnpm-lock.yaml'), original);
+    const initial = { inputSha256: variant === 'input' ? hash(original) : '0'.repeat(64),
+      outputSha256: variant === 'output' ? hash(original) : '1'.repeat(64), patchSha256: hash('historical') };
+    await writeFile(path.join(relative, 'report-lock.json'), JSON.stringify(initial));
+    await writeFile(path.join(relative, 'report-lock.patch'), 'historical');
+    execFileSync('git', ['init', '-q'], { cwd: root });
+    execFileSync('git', ['add', '.'], { cwd: root });
+    execFileSync('git', ['-c', 'user.name=Fixture', '-c', 'user.email=fixture@example.invalid', 'commit', '-qm', 'fixture'], { cwd: root });
+    await writeFile(path.join(root, 'pnpm-lock.yaml'), resolved);
+    if (variant === 'unknown') {
+      await expect(refreshReportLock(root)).rejects.toThrow('not reviewed');
+      expect(await readFile(path.join(relative, 'report-lock.patch'), 'utf8')).toBe('historical');
+      expect(JSON.parse(await readFile(path.join(relative, 'report-lock.json'), 'utf8'))).toEqual(initial);
+      expect(await readFile(path.join(root, 'pnpm-lock.yaml'), 'utf8')).toBe(resolved);
+      return;
+    }
+    if (variant === 'output') {
+      const cli = path.join(relative, 'prepare-report-lock.mjs');
+      await copyFile(path.join(import.meta.dirname, 'prepare-report-lock.mjs'), cli);
+      expect(execFileSync(process.execPath, [cli, '--refresh'], { cwd: root, encoding: 'utf8' }).trim()).toBe('refreshed');
+    } else {
+      expect(await refreshReportLock(root)).toBe('refreshed');
+    }
+    const policy = JSON.parse(await readFile(path.join(relative, 'report-lock.json'), 'utf8'));
+    const patch = await readFile(path.join(relative, 'report-lock.patch'), 'utf8');
+    expect(policy).toMatchObject({ inputSha256: hash(original), outputSha256: hash(resolved), patchSha256: hash(patch) });
+    await writeFile(path.join(root, 'pnpm-lock.yaml'), original);
+    expect(await prepareReportLock(root)).toBe('reviewed-correction');
+    expect(await readFile(path.join(root, 'pnpm-lock.yaml'), 'utf8')).toBe(resolved);
+    expect(parse(await readFile(path.join(root, 'pnpm-lock.yaml'), 'utf8')).packages).toEqual(parse(resolved).packages);
+    expect(await prepareReportLock(root)).toBe('already-reviewed');
+    execFileSync('git', ['add', '.'], { cwd: root });
+    execFileSync('git', ['-c', 'user.name=Fixture', '-c', 'user.email=fixture@example.invalid', 'commit', '-qm', 'refresh'], { cwd: root });
+    expect(await refreshReportLock(root)).toBe('unchanged');
+    expect(await readFile(path.join(relative, 'report-lock.patch'), 'utf8')).toBe(patch);
+  } finally { await rm(root, { recursive: true, force: true }); }
+});
diff --git a/tests/runner-e2e/report-lock.json b/tests/runner-e2e/report-lock.json
index 4dd5d2bdeff..0872fa1593a 100644
--- a/tests/runner-e2e/report-lock.json
+++ b/tests/runner-e2e/report-lock.json
@@ -1,6 +1,6 @@
 {
-  "inputSha256": "893496dddc21c31bd812ea106ac30d1515dda305eb1dd183007d89cf5b1bab4d",
-  "outputSha256": "c7f23021335b60da0cff1dd4c75cf8b948333ef3165d7d1703eb79a589edb798",
-  "patchSha256": "c7c11e899c12e6a030fe1554a8ceee5f21689a3a4f19956746e852050049cc49",
-  "basis": "Reviewed corrections to existing patch hashes and the already declared yaml workspace dependency. Existing package tarball integrity entries are unchanged. The only added package is yaml@2.9.1 with its exact integrity pinned by this reviewed correction."
+  "inputSha256": "c7f23021335b60da0cff1dd4c75cf8b948333ef3165d7d1703eb79a589edb798",
+  "outputSha256": "a2606a8218799ac96e841d1f3008053df4f4fca24d5db2941ad10b3d62c0e14a",
+  "patchSha256": "ee382a42cb5738d85068a4cd1ab5ba42db05f6477936d0c0efa65f182ea70f17",
+  "basis": "Generated with the trusted master lockfile refresh. Review this offline correction and its hashes with the dependency changes."
 }
diff --git a/tests/runner-e2e/report-lock.patch b/tests/runner-e2e/report-lock.patch
index 84a0bcac131..9367b5d3ced 100644
--- a/tests/runner-e2e/report-lock.patch
+++ b/tests/runner-e2e/report-lock.patch
@@ -1,612 +1,53 @@
+diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
+index 7f3361f73c..b074b7f305 100644
 --- a/pnpm-lock.yaml
 +++ b/pnpm-lock.yaml
-@@ -16,7 +16,7 @@
- 
- patchedDependencies:
-   '@agentclientprotocol/claude-agent-acp@0.73.0':
--    hash: riqgguivxjxydoydnzpedjy5au
-+    hash: xjlrz3rllh2ztafbdiywpfh2rq
-     path: patches/@agentclientprotocol__claude-agent-acp@0.73.0.patch
-   '@agentclientprotocol/codex-acp@1.6.2':
-     hash: 2iynuypg76nxmydiylgtffhr7e
-@@ -49,7 +49,7 @@
-     hash: 55uhvnotpqyiy37rn3pqpukhei
-     path: patches/embedded-postgres@18.1.0-beta.16.patch
-   postgres@3.4.9:
--    hash: sryle6qd5qfmnxvoebal4gashi
-+    hash: 6q4cic6qawywsyeo2spgnjamda
-     path: patches/postgres@3.4.9.patch
- 
- importers:
-@@ -73,7 +73,10 @@
-         version: 7.0.2
-       vitest:
-         specifier: ^5.0.3
--        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
+@@ -1183,6 +1183,18 @@ importers:
+       '@base-ui/react':
+         specifier: ^1.7.0
+         version: 1.7.0(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
++      '@codemirror/lang-yaml':
++        specifier: ^6.1.3
++        version: 6.1.3
++      '@codemirror/language':
++        specifier: ^6.12.4
++        version: 6.12.4
++      '@codemirror/state':
++        specifier: ^6.7.2
++        version: 6.7.6
++      '@codemirror/view':
++        specifier: ^6.43.11
++        version: 6.43.11
+       '@dnd-kit/core':
+         specifier: ^6.3.1
+         version: 6.3.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+@@ -1195,6 +1207,9 @@ importers:
+       '@lexical/link':
+         specifier: 0.48.0
+         version: 0.48.0(typescript@7.0.2)
++      '@lezer/highlight':
++        specifier: ^1.2.3
++        version: 1.2.3
+       '@mdxeditor/editor':
+         specifier: ^4.2.3
+         version: 4.2.3(@codemirror/language@6.12.4)(@lezer/highlight@1.2.3)(@types/react-dom@19.2.5(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2)(yjs@13.6.32)
+@@ -1264,6 +1279,9 @@ importers:
+       cmdk:
+         specifier: ^1.1.1
+         version: 1.1.1(@types/react-dom@19.2.5(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
++      codemirror:
++        specifier: ^6.0.2
++        version: 6.0.2
+       i18next:
+         specifier: ^26.4.2
+         version: 26.4.2(typescript@7.0.2)
+@@ -1306,6 +1324,9 @@ importers:
+       tailwind-merge:
+         specifier: ^3.6.0
+         version: 3.6.0
 +      yaml:
 +        specifier: ^2.8.1
 +        version: 2.9.1
- 
-   cli:
-     dependencies:
-@@ -133,7 +136,7 @@
-         version: 17.4.2
-       drizzle-orm:
-         specifier: 0.45.2
--        version: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi))
-+        version: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda))
-       embedded-postgres:
-         specifier: ^18.1.0-beta.16
-         version: 18.1.0-beta.16(patch_hash=55uhvnotpqyiy37rn3pqpukhei)
-@@ -180,7 +183,7 @@
-     dependencies:
-       '@agentclientprotocol/claude-agent-acp':
-         specifier: ^0.73.0
--        version: 0.73.0(patch_hash=riqgguivxjxydoydnzpedjy5au)(@anthropic-ai/sdk@0.129.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.31.0(zod@4.6.5))
-+        version: 0.73.0(patch_hash=xjlrz3rllh2ztafbdiywpfh2rq)(@anthropic-ai/sdk@0.129.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.31.0(zod@4.6.5))
-       '@anthropic-ai/sdk':
-         specifier: 0.129.0
-         version: 0.129.0(zod@4.6.5)
-@@ -310,7 +313,7 @@
-         version: 7.0.2
-       vitest:
-         specifier: ^5.0.3
--        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
- 
-   packages/adapters/hermes-gateway:
-     dependencies:
-@@ -326,7 +329,7 @@
-         version: 7.0.2
-       vitest:
-         specifier: ^5.0.3
--        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
- 
-   packages/adapters/kimi-local:
-     dependencies:
-@@ -405,13 +408,13 @@
-         version: link:../shared
-       drizzle-orm:
-         specifier: ^0.45.2
--        version: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi))
-+        version: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda))
-       embedded-postgres:
-         specifier: ^18.1.0-beta.16
-         version: 18.1.0-beta.16(patch_hash=55uhvnotpqyiy37rn3pqpukhei)
-       postgres:
-         specifier: ^3.4.9
--        version: 3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)
-+        version: 3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)
-     devDependencies:
-       '@types/node':
-         specifier: ^24.0.0
-@@ -427,7 +430,7 @@
-         version: 7.0.2
-       vitest:
-         specifier: ^5.0.3
--        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
- 
-   packages/google-sheets-mcp-server:
-     dependencies:
-@@ -449,7 +452,7 @@
-         version: 7.0.2
-       vitest:
-         specifier: ^5.0.3
--        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
- 
-   packages/kv-demo-mcp-server:
-     dependencies:
-@@ -468,7 +471,7 @@
-         version: 7.0.2
-       vitest:
-         specifier: ^5.0.3
--        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
- 
-   packages/mcp-server:
-     dependencies:
-@@ -490,7 +493,7 @@
-         version: 7.0.2
-       vitest:
-         specifier: ^5.0.3
--        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
- 
-   packages/paperclip-eval-kernel:
-     devDependencies:
-@@ -505,7 +508,7 @@
-     dependencies:
-       '@agentclientprotocol/claude-agent-acp':
-         specifier: 0.73.0
--        version: 0.73.0(patch_hash=riqgguivxjxydoydnzpedjy5au)(@anthropic-ai/sdk@0.129.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.31.0(zod@4.6.5))
-+        version: 0.73.0(patch_hash=xjlrz3rllh2ztafbdiywpfh2rq)(@anthropic-ai/sdk@0.129.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.31.0(zod@4.6.5))
-       '@agentclientprotocol/codex-acp':
-         specifier: 1.6.2
-         version: 1.6.2(patch_hash=2iynuypg76nxmydiylgtffhr7e)
-@@ -561,7 +564,7 @@
-         version: 19.2.5(@types/react@19.2.18)
-       '@vitejs/plugin-react':
-         specifier: ^4.7.0
--        version: 4.7.0(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15))
-+        version: 4.7.0(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1))
-       axe-core:
-         specifier: ^4.12.1
-         version: 4.13.0
-@@ -579,10 +582,10 @@
-         version: 7.0.2
-       vite:
-         specifier: ^6.1.0
--        version: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)
-+        version: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1)
-       vitest:
-         specifier: ^5.0.3
--        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15))
-+        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1))
- 
-   packages/plugins/create-paperclip-plugin:
-     dependencies:
-@@ -629,7 +632,7 @@
-         version: 7.0.2
-       vitest:
-         specifier: ^5.0.3
--        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
- 
-   packages/plugins/examples/plugin-file-browser-example:
-     dependencies:
-@@ -747,7 +750,7 @@
-         version: 7.0.2
-       vitest:
-         specifier: ^5.0.3
--        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
- 
-   packages/plugins/plugin-llm-wiki:
-     devDependencies:
-@@ -786,7 +789,7 @@
-         version: 7.0.2
-       vitest:
-         specifier: ^5.0.3
--        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
- 
-   packages/plugins/plugin-workspace-diff:
-     dependencies:
-@@ -820,7 +823,7 @@
-         version: 7.0.2
-       vitest:
-         specifier: ^5.0.3
--        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
- 
-   packages/plugins/sdk:
-     dependencies:
-@@ -880,7 +883,7 @@
-         version: 7.0.2
-       vitest:
-         specifier: ^5.0.3
--        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
- 
-   packages/teams-catalog:
-     devDependencies:
-@@ -895,7 +898,7 @@
-         version: 0.5.0
-       '@agentclientprotocol/claude-agent-acp':
-         specifier: 0.73.0
--        version: 0.73.0(patch_hash=riqgguivxjxydoydnzpedjy5au)(@anthropic-ai/sdk@0.129.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.31.0(zod@4.4.3))
-+        version: 0.73.0(patch_hash=xjlrz3rllh2ztafbdiywpfh2rq)(@anthropic-ai/sdk@0.129.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.31.0(zod@4.4.3))
-       '@agentclientprotocol/codex-acp':
-         specifier: 1.6.2
-         version: 1.6.2(patch_hash=2iynuypg76nxmydiylgtffhr7e)
-@@ -1006,7 +1009,7 @@
-         version: 2.1.0(@grpc/grpc-js@1.14.5)(nice-grpc-common@2.0.4)(nice-grpc@2.1.17)
-       '@vercel/connect':
-         specifier: 2.3.3
--        version: 2.3.3(@chat-adapter/slack@4.39.0(patch_hash=226jj24akljccsfbw7bcxujz4u)(ai@7.0.130(zod@4.4.3))(zod@4.4.3))(@modelcontextprotocol/sdk@1.31.0(zod@4.4.3))(ai@7.0.130(zod@4.4.3))(better-auth@1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))))
-+        version: 2.3.3(@chat-adapter/slack@4.39.0(patch_hash=226jj24akljccsfbw7bcxujz4u)(ai@7.0.130(zod@4.4.3))(zod@4.4.3))(@modelcontextprotocol/sdk@1.31.0(zod@4.4.3))(ai@7.0.130(zod@4.4.3))(better-auth@1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))))
-       acorn:
-         specifier: 8.18.0
-         version: 8.18.0
-@@ -1024,7 +1027,7 @@
-         version: 3.0.1(ajv@8.20.0)
-       better-auth:
-         specifier: 1.7.2
--        version: 1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)))
-+        version: 1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)))
-       chat:
-         specifier: 4.39.0
-         version: 4.39.0(ai@7.0.130(zod@4.4.3))(zod@4.4.3)
-@@ -1045,7 +1048,7 @@
-         version: 17.4.2
-       drizzle-orm:
-         specifier: ^0.45.2
--        version: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi))
-+        version: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda))
-       embedded-postgres:
-         specifier: ^18.1.0-beta.16
-         version: 18.1.0-beta.16(patch_hash=55uhvnotpqyiy37rn3pqpukhei)
-@@ -1167,10 +1170,10 @@
-         version: 7.0.2
-       vite:
-         specifier: ^8.2.2
--        version: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)
-+        version: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
-       vitest:
-         specifier: ^5.0.3
--        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
- 
-   ui:
-     dependencies:
-@@ -1321,10 +1324,10 @@
-         version: 10.6.0(@types/react-dom@19.2.5(@types/react@19.2.18))(@types/react@19.2.18)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))
-       '@storybook/react-vite':
-         specifier: 10.5.10
--        version: 10.5.10(@types/react-dom@19.2.5(@types/react@19.2.18))(@types/react@19.2.18)(esbuild@0.28.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(typescript@7.0.2)(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+        version: 10.5.10(@types/react-dom@19.2.5(@types/react@19.2.18))(@types/react@19.2.18)(esbuild@0.28.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(typescript@7.0.2)(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
-       '@tailwindcss/vite':
-         specifier: ^4.3.3
--        version: 4.3.3(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+        version: 4.3.3(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
-       '@types/node':
-         specifier: ^24.0.0
-         version: 24.13.3
-@@ -1336,7 +1339,7 @@
-         version: 19.2.5(@types/react@19.2.18)
-       '@vitejs/plugin-react':
-         specifier: ^6.1.1
--        version: 6.1.1(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+        version: 6.1.1(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
-       storybook:
-         specifier: 10.6.0
-         version: 10.6.0(@types/react@19.2.18)(react@19.2.8)
-@@ -1348,10 +1351,10 @@
-         version: 7.0.2
-       vite:
-         specifier: ^8.2.2
--        version: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)
-+        version: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
-       vitest:
-         specifier: ^5.0.3
--        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+        version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
- 
- packages:
- 
-@@ -9256,6 +9259,11 @@
-   yallist@4.0.0:
-     resolution: {integrity: sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==}
- 
-+  yaml@2.9.1:
-+    resolution: {integrity: sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==}
-+    engines: {node: '>= 14.6'}
-+    hasBin: true
-+
-   yargs-parser@21.1.1:
-     resolution: {integrity: sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==}
-     engines: {node: '>=12'}
-@@ -9316,7 +9324,7 @@
- 
-   '@adobe/css-tools@4.5.0': {}
- 
--  '@agentclientprotocol/claude-agent-acp@0.73.0(patch_hash=riqgguivxjxydoydnzpedjy5au)(@anthropic-ai/sdk@0.129.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.31.0(zod@4.4.3))':
-+  '@agentclientprotocol/claude-agent-acp@0.73.0(patch_hash=xjlrz3rllh2ztafbdiywpfh2rq)(@anthropic-ai/sdk@0.129.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.31.0(zod@4.4.3))':
-     dependencies:
-       '@agentclientprotocol/sdk': 1.4.0(zod@4.4.3)
-       '@anthropic-ai/claude-agent-sdk': 0.3.286(@anthropic-ai/sdk@0.129.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.31.0(zod@4.4.3))(zod@4.4.3)
-@@ -9325,7 +9333,7 @@
-       - '@anthropic-ai/sdk'
-       - '@modelcontextprotocol/sdk'
- 
--  '@agentclientprotocol/claude-agent-acp@0.73.0(patch_hash=riqgguivxjxydoydnzpedjy5au)(@anthropic-ai/sdk@0.129.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.31.0(zod@4.6.5))':
-+  '@agentclientprotocol/claude-agent-acp@0.73.0(patch_hash=xjlrz3rllh2ztafbdiywpfh2rq)(@anthropic-ai/sdk@0.129.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.31.0(zod@4.6.5))':
-     dependencies:
-       '@agentclientprotocol/sdk': 1.4.0(zod@4.4.3)
-       '@anthropic-ai/claude-agent-sdk': 0.3.286(@anthropic-ai/sdk@0.129.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.31.0(zod@4.6.5))(zod@4.4.3)
-@@ -9907,12 +9915,12 @@
-     optionalDependencies:
-       '@opentelemetry/api': 1.9.1
- 
--  '@better-auth/drizzle-adapter@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)))':
-+  '@better-auth/drizzle-adapter@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)))':
-     dependencies:
-       '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3)
-       '@better-auth/utils': 0.4.2
-     optionalDependencies:
--      drizzle-orm: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi))
-+      drizzle-orm: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda))
- 
-   '@better-auth/kysely-adapter@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3))(@better-auth/utils@0.4.2)(kysely@0.29.5)':
-     dependencies:
-@@ -10974,11 +10982,11 @@
-   '@img/sharp-win32-x64@0.35.4':
-     optional: true
- 
--  '@joshwooding/vite-plugin-react-docgen-typescript@0.7.0(typescript@7.0.2)(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))':
-+  '@joshwooding/vite-plugin-react-docgen-typescript@0.7.0(typescript@7.0.2)(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))':
-     dependencies:
-       glob: 13.0.6
-       react-docgen-typescript: 2.4.0(typescript@7.0.2)
--      vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)
-+      vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
-     optionalDependencies:
-       typescript: 7.0.2
- 
-@@ -13184,25 +13192,25 @@
-     transitivePeerDependencies:
-       - '@types/react-dom'
- 
--  '@storybook/builder-vite@10.5.10(esbuild@0.28.2)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))':
--    dependencies:
--      '@storybook/csf-plugin': 10.5.10(esbuild@0.28.2)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+  '@storybook/builder-vite@10.5.10(esbuild@0.28.2)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))':
-+    dependencies:
-+      '@storybook/csf-plugin': 10.5.10(esbuild@0.28.2)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
-       storybook: 10.6.0(@types/react@19.2.18)(react@19.2.8)
-       ts-dedent: 2.3.0
--      vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)
-+      vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
-     transitivePeerDependencies:
-       - esbuild
-       - rollup
-       - webpack
- 
--  '@storybook/csf-plugin@10.5.10(esbuild@0.28.2)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))':
-+  '@storybook/csf-plugin@10.5.10(esbuild@0.28.2)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))':
-     dependencies:
-       storybook: 10.6.0(@types/react@19.2.18)(react@19.2.8)
-       unplugin: 2.3.11
-     optionalDependencies:
-       esbuild: 0.28.2
-       rollup: 4.63.1
--      vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)
-+      vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
- 
-   '@storybook/global@5.0.0': {}
- 
-@@ -13228,11 +13236,11 @@
-       '@types/react': 19.2.18
-       '@types/react-dom': 19.2.5(@types/react@19.2.18)
- 
--  '@storybook/react-vite@10.5.10(@types/react-dom@19.2.5(@types/react@19.2.18))(@types/react@19.2.18)(esbuild@0.28.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(typescript@7.0.2)(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))':
--    dependencies:
--      '@joshwooding/vite-plugin-react-docgen-typescript': 0.7.0(typescript@7.0.2)(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+  '@storybook/react-vite@10.5.10(@types/react-dom@19.2.5(@types/react@19.2.18))(@types/react@19.2.18)(esbuild@0.28.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(typescript@7.0.2)(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))':
-+    dependencies:
-+      '@joshwooding/vite-plugin-react-docgen-typescript': 0.7.0(typescript@7.0.2)(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
-       '@rollup/pluginutils': 5.4.0(rollup@4.63.1)
--      '@storybook/builder-vite': 10.5.10(esbuild@0.28.2)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+      '@storybook/builder-vite': 10.5.10(esbuild@0.28.2)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
-       '@storybook/react': 10.5.10(@types/react-dom@19.2.5(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(typescript@7.0.2)
-       empathic: 2.0.1
-       magic-string: 0.30.21
-@@ -13242,7 +13250,7 @@
-       resolve: 1.22.12
-       storybook: 10.6.0(@types/react@19.2.18)(react@19.2.8)
-       tsconfig-paths: 4.2.0
--      vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)
-+      vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
-     optionalDependencies:
-       typescript: 7.0.2
-     transitivePeerDependencies:
-@@ -13335,12 +13343,12 @@
-       postcss-selector-parser: 6.0.10
-       tailwindcss: 4.3.3
- 
--  '@tailwindcss/vite@4.3.3(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))':
-+  '@tailwindcss/vite@4.3.3(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))':
-     dependencies:
-       '@tailwindcss/node': 4.3.3
-       '@tailwindcss/oxide': 4.3.3
-       tailwindcss: 4.3.3
--      vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)
-+      vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
- 
-   '@tanstack/query-core@5.102.8': {}
- 
-@@ -13758,14 +13766,14 @@
-     dependencies:
-       execa: 5.1.1
- 
--  '@vercel/connect@2.3.3(@chat-adapter/slack@4.39.0(patch_hash=226jj24akljccsfbw7bcxujz4u)(ai@7.0.130(zod@4.4.3))(zod@4.4.3))(@modelcontextprotocol/sdk@1.31.0(zod@4.4.3))(ai@7.0.130(zod@4.4.3))(better-auth@1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))))':
-+  '@vercel/connect@2.3.3(@chat-adapter/slack@4.39.0(patch_hash=226jj24akljccsfbw7bcxujz4u)(ai@7.0.130(zod@4.4.3))(zod@4.4.3))(@modelcontextprotocol/sdk@1.31.0(zod@4.4.3))(ai@7.0.130(zod@4.4.3))(better-auth@1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))))':
-     dependencies:
-       '@vercel/oidc': 3.8.9
-     optionalDependencies:
-       '@chat-adapter/slack': 4.39.0(patch_hash=226jj24akljccsfbw7bcxujz4u)(ai@7.0.130(zod@4.4.3))(zod@4.4.3)
-       '@modelcontextprotocol/sdk': 1.31.0(zod@4.4.3)
-       ai: 7.0.130(zod@4.4.3)
--      better-auth: 1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)))
-+      better-auth: 1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)))
- 
-   '@vercel/oidc@3.2.0': {}
- 
-@@ -13775,7 +13783,7 @@
-       '@vercel/cli-exec': 1.0.1
-       jose: 5.10.0
- 
--  '@vitejs/plugin-react@4.7.0(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15))':
-+  '@vitejs/plugin-react@4.7.0(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1))':
-     dependencies:
-       '@babel/core': 7.29.7
-       '@babel/plugin-transform-react-jsx-self': 7.29.7(@babel/core@7.29.7)
-@@ -13783,14 +13791,14 @@
-       '@rolldown/pluginutils': 1.0.0-beta.27
-       '@types/babel__core': 7.20.5
-       react-refresh: 0.17.0
--      vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)
-+      vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1)
-     transitivePeerDependencies:
-       - supports-color
- 
--  '@vitejs/plugin-react@6.1.1(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))':
-+  '@vitejs/plugin-react@6.1.1(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))':
-     dependencies:
-       '@rolldown/pluginutils': 1.0.1
--      vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)
-+      vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
- 
-   '@vitest/expect@3.2.4':
-     dependencies:
-@@ -13800,23 +13808,23 @@
-       chai: 5.3.3
-       tinyrainbow: 2.0.0
- 
--  '@vitest/mocker@5.0.3(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15))':
-+  '@vitest/mocker@5.0.3(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1))':
-     dependencies:
-       '@jridgewell/trace-mapping': 0.3.31
-       '@vitest/spy': 5.0.3
-       estree-walker: 3.0.3
-       magic-string: 1.4.3
-     optionalDependencies:
--      vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)
--
--  '@vitest/mocker@5.0.3(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))':
-+      vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1)
-+
-+  '@vitest/mocker@5.0.3(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))':
-     dependencies:
-       '@jridgewell/trace-mapping': 0.3.31
-       '@vitest/spy': 5.0.3
-       estree-walker: 3.0.3
-       magic-string: 1.4.3
-     optionalDependencies:
--      vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)
-+      vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
- 
-   '@vitest/pretty-format@3.2.4':
-     dependencies:
-@@ -14042,10 +14050,10 @@
- 
-   before-after-hook@4.0.0: {}
- 
--  better-auth@1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))):
-+  better-auth@1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))):
-     dependencies:
-       '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3)
--      '@better-auth/drizzle-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)))
-+      '@better-auth/drizzle-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)))
-       '@better-auth/kysely-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3))(@better-auth/utils@0.4.2)(kysely@0.29.5)
-       '@better-auth/memory-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3))(@better-auth/utils@0.4.2)
-       '@better-auth/mongo-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3))(@better-auth/utils@0.4.2)
-@@ -14063,11 +14071,11 @@
-       zod: 4.4.3
-     optionalDependencies:
-       drizzle-kit: 0.31.10
--      drizzle-orm: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi))
-+      drizzle-orm: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda))
-       pg: 8.18.0
-       react: 19.2.8
-       react-dom: 19.2.8(react@19.2.8)
--      vitest: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+      vitest: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
-     transitivePeerDependencies:
-       - '@cloudflare/workers-types'
-       - '@opentelemetry/api'
-@@ -14654,12 +14662,12 @@
-       esbuild: 0.25.12
-       tsx: 4.23.15
- 
--  drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)):
-+  drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)):
-     optionalDependencies:
-       '@opentelemetry/api': 1.9.1
-       kysely: 0.29.5
-       pg: 8.18.0
--      postgres: 3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)
-+      postgres: 3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)
- 
-   dunder-proto@1.0.1:
-     dependencies:
-@@ -16542,7 +16550,7 @@
-     dependencies:
-       xtend: 4.0.2
- 
--  postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi): {}
-+  postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda): {}
- 
-   powershell-utils@0.1.0: {}
- 
-@@ -17587,7 +17595,7 @@
-       '@types/unist': 3.0.3
-       vfile-message: 4.0.3
- 
--  vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15):
-+  vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1):
-     dependencies:
-       esbuild: 0.25.12
-       fdir: 6.5.0(picomatch@4.0.7)
-@@ -17601,8 +17609,9 @@
-       jiti: 2.7.0
-       lightningcss: 1.33.0
-       tsx: 4.23.15
--
--  vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15):
-+      yaml: 2.9.1
-+
-+  vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1):
-     dependencies:
-       lightningcss: 1.33.0
-       picomatch: 4.0.7
-@@ -17615,11 +17624,12 @@
-       fsevents: 2.3.3
-       jiti: 2.7.0
-       tsx: 4.23.15
--
--  vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)):
-+      yaml: 2.9.1
-+
-+  vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1)):
-     dependencies:
-       '@types/chai': 5.2.3
--      '@vitest/mocker': 5.0.3(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15))
-+      '@vitest/mocker': 5.0.3(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1))
-       chai: 6.3.0
-       es-module-lexer: 2.3.2
-       expect-type: 1.4.0
-@@ -17630,7 +17640,7 @@
-       tinybench: 6.2.0
-       tinyexec: 1.3.1
-       tinyglobby: 0.2.17
--      vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)
-+      vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1)
-       why-is-node-running: 3.2.1
-     optionalDependencies:
-       '@opentelemetry/api': 1.9.1
-@@ -17639,10 +17649,10 @@
-     transitivePeerDependencies:
-       - msw
- 
--  vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)):
-+  vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)):
-     dependencies:
-       '@types/chai': 5.2.3
--      '@vitest/mocker': 5.0.3(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))
-+      '@vitest/mocker': 5.0.3(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
-       chai: 6.3.0
-       es-module-lexer: 2.3.2
-       expect-type: 1.4.0
-@@ -17653,7 +17663,7 @@
-       tinybench: 6.2.0
-       tinyexec: 1.3.1
-       tinyglobby: 0.2.17
--      vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)
-+      vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
-       why-is-node-running: 3.2.1
-     optionalDependencies:
-       '@opentelemetry/api': 1.9.1
-@@ -17748,6 +17758,8 @@
-   yallist@3.1.1: {}
- 
-   yallist@4.0.0: {}
-+
-+  yaml@2.9.1: {}
- 
-   yargs-parser@21.1.1: {}
- 
+       yjs:
+         specifier: 13.6.32
+         version: 13.6.32
diff --git a/tests/runner-e2e/workflow-security.test.ts b/tests/runner-e2e/workflow-security.test.ts
index 698f7e71575..d4a577b9f2c 100644
--- a/tests/runner-e2e/workflow-security.test.ts
+++ b/tests/runner-e2e/workflow-security.test.ts
@@ -95,9 +95,7 @@ describe("public repository paid workflow security", () => {
         .split(/\n(?= {6}- )/u)
         .filter((step) => step.includes("uses: pnpm/action-setup@"));
 
-      expect(pnpmSetupSteps, workflowName).toHaveLength(
-        workflowName === "pr-trusted.yml" ? 8 : 7,
-      );
+      expect(pnpmSetupSteps, workflowName).toHaveLength(8);
       for (const step of pnpmSetupSteps) {
         expect(step, workflowName).toContain('NPM_CONFIG_AUDIT: "false"');
         expect(step, workflowName).toContain('NPM_CONFIG_FUND: "false"');
@@ -141,9 +139,7 @@ describe("public repository paid workflow security", () => {
         step.includes("uses: pnpm/action-setup@") ? [index] : [],
       );
 
-      expect(pnpmSetupStepIndexes, name).toHaveLength(
-        name === "pr-trusted.yml" ? 8 : 7,
-      );
+      expect(pnpmSetupStepIndexes, name).toHaveLength(8);
       for (const pnpmSetupStepIndex of pnpmSetupStepIndexes) {
         const pnpmSetupStep = steps[pnpmSetupStepIndex]!;
         const nodeBootstrapStep = steps[pnpmSetupStepIndex - 1]!;
@@ -282,7 +278,9 @@ describe("public repository paid workflow security", () => {
     expect(authorizeJob.match(/actions\/checkout@/gu)).toHaveLength(1);
     expect(authorizeJob).toContain("ref: ${{ github.sha }}");
     expect(authorizeJob).not.toContain("ref: ${{ needs.authorize.outputs.target_sha }}");
-    expect(authorizeJob).not.toContain("pnpm install");
+    expect(authorizeJob.match(/run: pnpm install.*$/gmu)).toEqual([
+      "run: pnpm install --lockfile-only --frozen-lockfile --ignore-scripts --offline",
+    ]);
     expect(targetLockJob).toContain("name: Resolve target pnpm lockfile");
     expect(targetLockJob).toContain("needs: authorize");
     expect(targetLockJob).toContain(