diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
new file mode 100644
index 00000000..e186c933
--- /dev/null
+++ b/.github/workflows/integration-tests.yml
@@ -0,0 +1,179 @@
+name: "Integration Tests"
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  pull_request_review:
+    types: [submitted]
+  workflow_dispatch:
+
+env:
+  ORIGIN_PORT: 8888
+
+jobs:
+  integration-tests:
+    name: integration tests
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name == 'push' ||
+      github.event_name == 'pull_request' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request_review' && github.event.review.state == 'approved')
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Retrieve Rust version
+        id: rust-version
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        shell: bash
+
+      - name: Set up Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: ${{ steps.rust-version.outputs.rust-version }}
+          target: wasm32-wasip1
+          cache-shared-key: cargo-${{ runner.os }}
+
+      - name: Get Viceroy cache key
+        id: viceroy-rev
+        run: echo "sha=$(git ls-remote https://github.com/fastly/Viceroy HEAD | cut -f1)" >> $GITHUB_OUTPUT
+
+      - name: Cache Viceroy binary
+        id: cache-viceroy
+        uses: actions/cache@v4
+        with:
+          path: ~/.cargo/bin/viceroy
+          key: viceroy-${{ runner.os }}-${{ steps.viceroy-rev.outputs.sha }}
+
+      - name: Install Viceroy
+        if: steps.cache-viceroy.outputs.cache-hit != 'true'
+        run: cargo install --git https://github.com/fastly/Viceroy viceroy
+
+      - name: Build WASM binary
+        run: cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
+        env:
+          TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: "http://127.0.0.1:${{ env.ORIGIN_PORT }}"
+          TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
+
+      - name: Build WordPress test container
+        run: |
+          docker build -t test-wordpress:latest \
+            crates/integration-tests/fixtures/frameworks/wordpress/
+
+      - name: Build Next.js test container
+        run: |
+          docker build -t test-nextjs:latest \
+            crates/integration-tests/fixtures/frameworks/nextjs/
+
+      - name: Run integration tests
+        run: >-
+          cargo test
+          --manifest-path crates/integration-tests/Cargo.toml
+          --target x86_64-unknown-linux-gnu
+          -- --include-ignored --test-threads=1
+        env:
+          INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
+          RUST_LOG: info
+
+  browser-tests:
+    name: browser integration tests
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name == 'push' ||
+      github.event_name == 'pull_request' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request_review' && github.event.review.state == 'approved')
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Retrieve Rust version
+        id: rust-version
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        shell: bash
+
+      - name: Set up Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: ${{ steps.rust-version.outputs.rust-version }}
+          target: wasm32-wasip1
+          cache-shared-key: cargo-${{ runner.os }}
+
+      - name: Get Viceroy cache key
+        id: viceroy-rev
+        run: echo "sha=$(git ls-remote https://github.com/fastly/Viceroy HEAD | cut -f1)" >> $GITHUB_OUTPUT
+
+      - name: Cache Viceroy binary
+        id: cache-viceroy
+        uses: actions/cache@v4
+        with:
+          path: ~/.cargo/bin/viceroy
+          key: viceroy-${{ runner.os }}-${{ steps.viceroy-rev.outputs.sha }}
+
+      - name: Install Viceroy
+        if: steps.cache-viceroy.outputs.cache-hit != 'true'
+        run: cargo install --git https://github.com/fastly/Viceroy viceroy
+
+      - name: Build WASM binary
+        run: cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
+        env:
+          TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: "http://127.0.0.1:${{ env.ORIGIN_PORT }}"
+          TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
+
+      - name: Build WordPress test container
+        run: |
+          docker build -t test-wordpress:latest \
+            crates/integration-tests/fixtures/frameworks/wordpress/
+
+      - name: Build Next.js test container
+        run: |
+          docker build -t test-nextjs:latest \
+            crates/integration-tests/fixtures/frameworks/nextjs/
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+
+      - name: Install Playwright
+        working-directory: crates/integration-tests/browser
+        run: |
+          npm ci
+          npx playwright install --with-deps chromium
+
+      - name: Run browser tests (Next.js)
+        working-directory: crates/integration-tests/browser
+        env:
+          WASM_BINARY_PATH: ${{ github.workspace }}/target/wasm32-wasip1/release/trusted-server-fastly.wasm
+          INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
+          VICEROY_CONFIG_PATH: ${{ github.workspace }}/crates/integration-tests/fixtures/configs/viceroy-template.toml
+          TEST_FRAMEWORK: nextjs
+        run: npx playwright test
+
+      - name: Run browser tests (WordPress)
+        working-directory: crates/integration-tests/browser
+        env:
+          WASM_BINARY_PATH: ${{ github.workspace }}/target/wasm32-wasip1/release/trusted-server-fastly.wasm
+          INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
+          VICEROY_CONFIG_PATH: ${{ github.workspace }}/crates/integration-tests/fixtures/configs/viceroy-template.toml
+          TEST_FRAMEWORK: wordpress
+        run: npx playwright test
+
+      - name: Upload Playwright HTML report
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: playwright-report
+          path: crates/integration-tests/browser/playwright-report/
+          retention-days: 7
+
+      - name: Upload Playwright traces and screenshots
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: playwright-traces
+          path: crates/integration-tests/browser/test-results/
+          retention-days: 7
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 93d5525e..5eea36a7 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -44,7 +44,7 @@ jobs:
         run: cargo install --git https://github.com/fastly/Viceroy viceroy
 
       - name: Run tests
-        run: cargo test
+        run: cargo test --workspace
 
   test-typescript:
     name: vitest
diff --git a/.gitignore b/.gitignore
index be5a49f8..864be6a1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,6 +2,7 @@
 /bin
 /pkg
 /target
+/crates/integration-tests/target
 
 # env
 .env*
@@ -28,4 +29,10 @@ src/*.html
 *.pem
 
 /guest-profiles
-/benchmark-results/**
\ No newline at end of file
+/benchmark-results/**
+
+# Playwright browser tests
+/crates/integration-tests/browser/node_modules/
+/crates/integration-tests/browser/test-results/
+/crates/integration-tests/browser/playwright-report/
+/crates/integration-tests/browser/.browser-test-state.json
\ No newline at end of file
diff --git a/Cargo.lock b/Cargo.lock
index 94ec4c24..15fb9706 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1266,9 +1266,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.177"
+version = "0.2.182"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
+checksum = "6800badb6cb2082ffd7b6a67e6125bb39f18782f793520caee8cb8846be06112"
 
 [[package]]
 name = "libm"
diff --git a/Cargo.toml b/Cargo.toml
index 032cbaa7..a3ed76b6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,11 +2,16 @@
 resolver = "2"
 members = [
     "crates/common",
-    "crates/fastly", 
+    "crates/fastly",
     "crates/js",
 ]
+# integration-tests is intentionally excluded from workspace members because it
+# requires a native target (testcontainers, reqwest) while the workspace default
+# is wasm32-wasip1. Run it via: ./scripts/integration-tests.sh
+exclude = [
+    "crates/integration-tests",
+]
 
-# Build defaults exclude the web-only tsjs crate, which is compiled via wasm-pack.
 default-members = [
     "crates/common",
     "crates/fastly",
diff --git a/crates/fastly/src/main.rs b/crates/fastly/src/main.rs
index 77b37649..17b7e987 100644
--- a/crates/fastly/src/main.rs
+++ b/crates/fastly/src/main.rs
@@ -80,6 +80,12 @@ async fn route_request(
 
     // Match known routes and handle them
     let result = match (method, path.as_str()) {
+        // Health check endpoint for integration tests and monitoring.
+        // Namespaced to avoid shadowing publisher routes.
+        (Method::GET, "/__trusted-server/health") => {
+            Ok(Response::from_status(200).with_body_text_plain("ok"))
+        }
+
         // Serve the tsjs library
         (Method::GET, path) if path.starts_with("/static/tsjs=") => {
             handle_tsjs_dynamic(&req, integration_registry)
@@ -176,7 +182,7 @@ fn init_logger() {
         .echo_stdout(true)
         .max_level(log::LevelFilter::Debug)
         .build()
-        .expect("Failed to build Logger");
+        .expect("should build Logger");
 
     fern::Dispatch::new()
         .format(|out, message, record| {
@@ -194,5 +200,5 @@ fn init_logger() {
         })
         .chain(Box::new(logger) as Box<dyn log::Log>)
         .apply()
-        .expect("Failed to initialize logger");
+        .expect("should initialize logger");
 }
diff --git a/crates/integration-tests/.dockerignore b/crates/integration-tests/.dockerignore
new file mode 100644
index 00000000..1004a143
--- /dev/null
+++ b/crates/integration-tests/.dockerignore
@@ -0,0 +1,6 @@
+target/
+*.rs
+Cargo.toml
+Cargo.lock
+tests/
+README.md
diff --git a/crates/integration-tests/Cargo.lock b/crates/integration-tests/Cargo.lock
new file mode 100644
index 00000000..ac3a2460
--- /dev/null
+++ b/crates/integration-tests/Cargo.lock
@@ -0,0 +1,3422 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "getrandom 0.3.4",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anstream"
+version = "0.6.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43d5b281e737544384e969a5ccad3f1cdd24b48086a0fc1b2a5262a26b8f4f4a"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
+[[package]]
+name = "astral-tokio-tar"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec179a06c1769b1e42e1e2cbe74c7dcdb3d6383c838454d063eaac5bbb7ebbe5"
+dependencies = [
+ "filetime",
+ "futures-core",
+ "libc",
+ "portable-atomic",
+ "rustc-hash",
+ "tokio",
+ "tokio-stream",
+ "xattr",
+]
+
+[[package]]
+name = "async-stream"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b5a71a6f37880a80d1d7f19efd781e4b5de42c88f0722cc13bcb6cc2cfe8476"
+dependencies = [
+ "async-stream-impl",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream-impl"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "async-trait"
+version = "0.1.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
+[[package]]
+name = "axum"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b52af3cb4058c895d37317bb27508dccc8e5f2d39454016b297bf4a400597b8"
+dependencies = [
+ "axum-core",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "sync_wrapper",
+ "tower",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "base64"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bitflags"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
+
+[[package]]
+name = "bollard"
+version = "0.19.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87a52479c9237eb04047ddb94788c41ca0d26eaff8b697ecfbb4c32f7fdc3b1b"
+dependencies = [
+ "async-stream",
+ "base64 0.22.1",
+ "bitflags",
+ "bollard-buildkit-proto",
+ "bollard-stubs",
+ "bytes",
+ "chrono",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "home",
+ "http",
+ "http-body-util",
+ "hyper",
+ "hyper-named-pipe",
+ "hyper-rustls",
+ "hyper-util",
+ "hyperlocal",
+ "log",
+ "num",
+ "pin-project-lite",
+ "rand 0.9.2",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-pemfile",
+ "rustls-pki-types",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "serde_repr",
+ "serde_urlencoded",
+ "thiserror",
+ "tokio",
+ "tokio-stream",
+ "tokio-util",
+ "tonic",
+ "tower-service",
+ "url",
+ "winapi",
+]
+
+[[package]]
+name = "bollard-buildkit-proto"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85a885520bf6249ab931a764ffdb87b0ceef48e6e7d807cfdb21b751e086e1ad"
+dependencies = [
+ "prost",
+ "prost-types",
+ "tonic",
+ "tonic-prost",
+ "ureq",
+]
+
+[[package]]
+name = "bollard-stubs"
+version = "1.49.1-rc.28.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5731fe885755e92beff1950774068e0cae67ea6ec7587381536fca84f1779623"
+dependencies = [
+ "base64 0.22.1",
+ "bollard-buildkit-proto",
+ "bytes",
+ "chrono",
+ "prost",
+ "serde",
+ "serde_json",
+ "serde_repr",
+ "serde_with",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+
+[[package]]
+name = "cc"
+version = "1.2.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aebf35691d1bfb0ac386a69bac2fde4dd276fb618cf8bf4f5318fe285e821bb2"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "chrono"
+version = "0.4.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+dependencies = [
+ "iana-time-zone",
+ "num-traits",
+ "serde",
+ "windows-link",
+]
+
+[[package]]
+name = "colorchoice"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+
+[[package]]
+name = "convert_case"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "633458d4ef8c78b72454de2d54fd6ab2e60f9e02be22f3c6104cdc8a4e0fceb9"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cssparser"
+version = "0.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c66d1cd8ed61bf80b38432613a7a2f09401ab8d0501110655f8b341484a3e3"
+dependencies = [
+ "cssparser-macros",
+ "dtoa-short",
+ "itoa",
+ "phf",
+ "smallvec",
+]
+
+[[package]]
+name = "cssparser-macros"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331"
+dependencies = [
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "darling"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "powerfmt",
+ "serde_core",
+]
+
+[[package]]
+name = "derive_more"
+version = "0.99.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6edb4b64a43d977b8e99788fe3a04d483834fba1215a7e02caa415b626497f7f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "derive_more"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
+dependencies = [
+ "derive_more-impl",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
+dependencies = [
+ "convert_case",
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "syn",
+ "unicode-xid",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "docker_credential"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d89dfcba45b4afad7450a99b39e751590463e45c04728cf555d36bb66940de8"
+dependencies = [
+ "base64 0.21.7",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "dtoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
+
+[[package]]
+name = "dtoa-short"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87"
+dependencies = [
+ "dtoa",
+]
+
+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
+[[package]]
+name = "ego-tree"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c6ba7d4eec39eaa9ab24d44a0e73a7949a1095a8b3f3abb11eddf27dbb56a53"
+
+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "env_filter"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a1c3cc8e57274ec99de65301228b537f1e4eedc1b8e0f9411c6caac8ae7308f"
+dependencies = [
+ "log",
+ "regex",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2daee4ea451f429a58296525ddf28b45a3b64f1acf6587e2067437bb11e218d"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "env_filter",
+ "jiff",
+ "log",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "error-stack"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b878b3fac9613c3c7f22eb70bc8a3c6ebdc03cc11479ee60fde1692d747fd45f"
+dependencies = [
+ "anyhow",
+ "rustc_version",
+]
+
+[[package]]
+name = "etcetera"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26c7b13d0780cb82722fd59f6f57f925e143427e4a75313a6c77243bf5326ae6"
+dependencies = [
+ "cfg-if",
+ "home",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+
+[[package]]
+name = "filetime"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f98844151eee8917efc50bd9e8318cb963ae8b297431495d3f758616ea5c57db"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "libredox",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df420e2e84819663797d1ec6544b13c5be84629e7bb00dc960d6917db2987843"
+dependencies = [
+ "mac",
+ "new_debug_unreachable",
+]
+
+[[package]]
+name = "futures"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "fxhash"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c31b6d751ae2c7f11320402d34e41349dd1016f8d5d45e48c4312bc8625af50c"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "getopts"
+version = "0.2.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfe4fbac503b8d1f88e6676011885f34b7174f46e59956bba534ba83abded4df"
+dependencies = [
+ "unicode-width",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "wasip2",
+ "wasip3",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap 2.13.0",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "html5ever"
+version = "0.29.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b7410cae13cbc75623c98ac4cbfd1f0bedddf3227afc24f370cf0f50a44a11c"
+dependencies = [
+ "log",
+ "mac",
+ "markup5ever",
+ "match_token",
+]
+
+[[package]]
+name = "http"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "pin-utils",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-named-pipe"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73b7d8abf35697b81a825e386fc151e0d503e8cb5fcb93cc8669c376dfd6f278"
+dependencies = [
+ "hex",
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+ "winapi",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-timeout"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
+dependencies = [
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-tls"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
+dependencies = [
+ "bytes",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "system-configuration",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "windows-registry",
+]
+
+[[package]]
+name = "hyperlocal"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7"
+dependencies = [
+ "hex",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
+
+[[package]]
+name = "icu_properties"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
+
+[[package]]
+name = "icu_provider"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.16.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "integration-tests"
+version = "0.1.0"
+dependencies = [
+ "derive_more 2.1.1",
+ "env_logger",
+ "error-stack",
+ "log",
+ "reqwest",
+ "scraper",
+ "serde_json",
+ "testcontainers",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+
+[[package]]
+name = "iri-string"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c91338f0783edbd6195decb37bae672fd3b165faffb89bf7b9e6942f8b1a731a"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+
+[[package]]
+name = "jiff"
+version = "0.2.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a3546dc96b6d42c5f24902af9e2538e82e39ad350b0c766eb3fbf2d8f3d8359"
+dependencies = [
+ "jiff-static",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a8c8b344124222efd714b73bb41f8b5120b27a7cc1c75593a6ff768d9d05aa4"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.91"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b49715b7073f385ba4bc528e5747d02e66cb39c6146efb66b781f131f0fb399c"
+dependencies = [
+ "once_cell",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "libc"
+version = "0.2.182"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6800badb6cb2082ffd7b6a67e6125bb39f18782f793520caee8cb8846be06112"
+
+[[package]]
+name = "libredox"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1744e39d1d6a9948f4f388969627434e31128196de472883b39f148769bfe30a"
+dependencies = [
+ "bitflags",
+ "libc",
+ "plain",
+ "redox_syscall 0.7.3",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6373607a59f0be73a39b6fe456b8192fcc3585f602af20751600e974dd455e77"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+
+[[package]]
+name = "mac"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4"
+
+[[package]]
+name = "markup5ever"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7a7213d12e1864c0f002f52c2923d4556935a43dec5e71355c2760e0f6e7a18"
+dependencies = [
+ "log",
+ "phf",
+ "phf_codegen",
+ "string_cache",
+ "string_cache_codegen",
+ "tendril",
+]
+
+[[package]]
+name = "match_token"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88a9689d8d44bf9964484516275f5cd4c9b59457a6940c1d5d0ecbb94510a36b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
+[[package]]
+name = "memchr"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "mio"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "native-tls"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "465500e14ea162429d264d44189adc38b199b62b1c21eea9f69e4b73cb03bbf2"
+dependencies = [
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework",
+ "security-framework-sys",
+ "tempfile",
+]
+
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+
+[[package]]
+name = "num"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
+dependencies = [
+ "num-bigint",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-complex"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050"
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
+dependencies = [
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "openssl"
+version = "0.10.75"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08838db121398ad17ab8531ce9de97b244589089e290a384c900cb9ff7434328"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.111"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82cab2d520aa75e3c58898289429321eb788c3106963d0dc886ec7a5f4adc321"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall 0.5.18",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "parse-display"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "914a1c2265c98e2446911282c6ac86d8524f495792c38c5bd884f80499c7538a"
+dependencies = [
+ "parse-display-derive",
+ "regex",
+ "regex-syntax",
+]
+
+[[package]]
+name = "parse-display-derive"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ae7800a4c974efd12df917266338e79a7a74415173caf7e70aa0a0707345281"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "regex",
+ "regex-syntax",
+ "structmeta",
+ "syn",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "phf"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
+dependencies = [
+ "phf_macros",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
+dependencies = [
+ "phf_shared",
+ "rand 0.8.5",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f84ac04429c13a7ff43785d75ad27569f2951ce0ffd30a3321230db2fc727216"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pin-project"
+version = "1.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1749c7ed4bcaf4c3d0a3efc28538844fb29bcdd7d2b67b2be7e20ba861ff517"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b20ed30f105399776b9c883e68e536ef602a16ae6f596d2c473591d6ad64c6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a9db96d7fa8782dd8c15ce32ffe8680bbd1e978a43bf51a34d39483540495f5"
+dependencies = [
+ "portable-atomic",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b73949432f5e2a09657003c25bca5e19a0e9c84f8058ca374f49e0ebe605af77"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "prost"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2ea70524a2f82d518bce41317d0fae74151505651af45faf1ffbd6fd33f0568"
+dependencies = [
+ "bytes",
+ "prost-derive",
+]
+
+[[package]]
+name = "prost-derive"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
+dependencies = [
+ "anyhow",
+ "itertools",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "prost-types"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8991c4cbdb8bc5b11f0b074ffe286c30e523de90fee5ba8132f1399f23cb3dd7"
+dependencies = [
+ "prost",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+dependencies = [
+ "rand_chacha",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce70a74e890531977d37e532c34d45e9055d2409ed08ddba14529471ed0be16"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "regex"
+version = "1.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+
+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "encoding_rs",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-tls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "mime",
+ "native-tls",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-native-tls",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4"
+dependencies = [
+ "log",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "schannel"
+version = "0.1.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "891d81b926048e76efe18581bf793546b4c0eaf8448d72be8de2bbee5fd166e1"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "schemars"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "scraper"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0e749d29b2064585327af5038a5a8eb73aeebad4a3472e83531a436563f7208"
+dependencies = [
+ "ahash",
+ "cssparser",
+ "ego-tree",
+ "getopts",
+ "html5ever",
+ "precomputed-hash",
+ "selectors",
+ "tendril",
+]
+
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags",
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "selectors"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd568a4c9bb598e291a08244a5c1f5a8a6650bee243b5b0f8dbb3d9cc1d87fe8"
+dependencies = [
+ "bitflags",
+ "cssparser",
+ "derive_more 0.99.20",
+ "fxhash",
+ "log",
+ "new_debug_unreachable",
+ "phf",
+ "phf_codegen",
+ "precomputed-hash",
+ "servo_arc",
+ "smallvec",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.149"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_repr"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_with"
+version = "3.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "381b283ce7bc6b476d903296fb59d0d36633652b633b27f64db4fb46dcbfc3b9"
+dependencies = [
+ "base64 0.22.1",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.13.0",
+ "schemars 0.9.0",
+ "schemars 1.2.1",
+ "serde_core",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6d4e30573c8cb306ed6ab1dca8423eec9a463ea0e155f45399455e0368b27e0"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "servo_arc"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "170fb83ab34de17dc69aa7c67482b22218ddb85da56546f9bd6b929e32a05930"
+dependencies = [
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "siphasher"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2aa850e253778c88a04c3d7323b043aeda9d3e30d5971937c1855769763678e"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+
+[[package]]
+name = "socket2"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "string_cache"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf776ba3fa74f83bf4b63c3dcbbf82173db2632ed8452cb2d891d33f459de70f"
+dependencies = [
+ "new_debug_unreachable",
+ "parking_lot",
+ "phf_shared",
+ "precomputed-hash",
+ "serde",
+]
+
+[[package]]
+name = "string_cache_codegen"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c711928715f1fe0fe509c53b43e993a9a557babc2d0a3567d0a3006f1ac931a0"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "structmeta"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e1575d8d40908d70f6fd05537266b90ae71b15dbbe7a8b7dffa2b759306d329"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "structmeta-derive",
+ "syn",
+]
+
+[[package]]
+name = "structmeta-derive"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "152a0b65a590ff6c3da95cabe2353ee04e6167c896b28e3b14478c2636c922fc"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
+dependencies = [
+ "bitflags",
+ "core-foundation 0.9.4",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82a72c767771b47409d2345987fda8628641887d5466101319899796367354a0"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.2",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tendril"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d24a120c5fc464a3458240ee02c299ebcb9d67b5249c8848b09d639dca8d7bb0"
+dependencies = [
+ "futf",
+ "mac",
+ "utf-8",
+]
+
+[[package]]
+name = "testcontainers"
+version = "0.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f3ac71069f20ecfa60c396316c283fbf35e6833a53dff551a31b5458da05edc"
+dependencies = [
+ "astral-tokio-tar",
+ "async-trait",
+ "bollard",
+ "bytes",
+ "docker_credential",
+ "either",
+ "etcetera",
+ "futures",
+ "log",
+ "memchr",
+ "parse-display",
+ "pin-project-lite",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "thiserror",
+ "tokio",
+ "tokio-stream",
+ "tokio-util",
+ "ulid",
+ "url",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "time"
+version = "0.3.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+
+[[package]]
+name = "time-macros"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tokio"
+version = "1.50.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27ad5e34374e03cfffefc301becb44e9dc3c17584f414349ebe29ed26661822d"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c55a2eff8b69ce66c84f85e1da1c233edc36ceb85a2058d11b0d6a3c7e7569c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tokio-native-tls"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
+dependencies = [
+ "native-tls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tonic"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fec7c61a0695dc1887c1b53952990f3ad2e3a31453e1f49f10e75424943a93ec"
+dependencies = [
+ "async-trait",
+ "axum",
+ "base64 0.22.1",
+ "bytes",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-timeout",
+ "hyper-util",
+ "percent-encoding",
+ "pin-project",
+ "socket2",
+ "sync_wrapper",
+ "tokio",
+ "tokio-stream",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tonic-prost"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a55376a0bbaa4975a3f10d009ad763d8f4108f067c7c2e74f3001fb49778d309"
+dependencies = [
+ "bytes",
+ "prost",
+ "tonic",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "indexmap 2.13.0",
+ "pin-project-lite",
+ "slab",
+ "sync_wrapper",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "iri-string",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "ulid"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "470dbf6591da1b39d43c14523b2b469c86879a53e8b758c8e090a470fe7b1fbe"
+dependencies = [
+ "rand 0.9.2",
+ "web-time",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "ureq"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdc97a28575b85cfedf2a7e7d3cc64b3e11bd8ac766666318003abbacc7a21fc"
+dependencies = [
+ "base64 0.22.1",
+ "log",
+ "percent-encoding",
+ "rustls",
+ "rustls-pki-types",
+ "ureq-proto",
+ "utf-8",
+]
+
+[[package]]
+name = "ureq-proto"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d81f9efa9df032be5934a46a068815a10a042b494b6a58cb0a1a97bb5467ed6f"
+dependencies = [
+ "base64 0.22.1",
+ "http",
+ "httparse",
+ "log",
+]
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+ "serde_derive",
+]
+
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.2+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.114"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6532f9a5c1ece3798cb1c2cfdba640b9b3ba884f5db45973a6f442510a87d38e"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.64"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9c5522b3a28661442748e09d40924dfb9ca614b21c00d3fd135720e48b67db8"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "js-sys",
+ "once_cell",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.114"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18a2d50fcf105fb33bb15f00e7a77b772945a2ee45dcf454961fd843e74c18e6"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.114"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03ce4caeaac547cdf713d280eda22a730824dd11e6b8c3ca9e42247b25c631e3"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.114"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75a326b8c223ee17883a4251907455a2431acc2791c98c26279376490c378c16"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap 2.13.0",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.15.5",
+ "indexmap 2.13.0",
+ "semver",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.91"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "854ba17bb104abfb26ba36da9729addc7ce7f06f5c0f90f3c391f8461cca21f9"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap 2.13.0",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap 2.13.0",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap 2.13.0",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
+
+[[package]]
+name = "xattr"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
+dependencies = [
+ "libc",
+ "rustix",
+]
+
+[[package]]
+name = "yoke"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a789c6e490b576db9f7e6b6d661bcc9799f7c0ac8352f56ea20193b2681532e5"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f65c489a7071a749c849713807783f70672b28094011623e200cb86dcb835953"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c28719294829477f525be0186d13efa9a3c602f7ec202ca9e353d310fb9a002"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/crates/integration-tests/Cargo.toml b/crates/integration-tests/Cargo.toml
new file mode 100644
index 00000000..d0f8369d
--- /dev/null
+++ b/crates/integration-tests/Cargo.toml
@@ -0,0 +1,20 @@
+[package]
+name = "integration-tests"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[[test]]
+name = "integration"
+path = "tests/integration.rs"
+harness = true
+
+[dev-dependencies]
+testcontainers = { version = "0.25", features = ["blocking"] }
+reqwest = { version = "0.12", features = ["blocking"] }
+scraper = "0.21"
+log = "0.4"
+serde_json = "1"
+error-stack = "0.6"
+derive_more = { version = "2.0", features = ["display"] }
+env_logger = "0.11"
diff --git a/crates/integration-tests/README.md b/crates/integration-tests/README.md
new file mode 100644
index 00000000..0c7e3b05
--- /dev/null
+++ b/crates/integration-tests/README.md
@@ -0,0 +1,208 @@
+# Integration Tests
+
+End-to-end tests that verify the trusted server against real frontend
+containers using [Testcontainers](https://testcontainers.com/) and
+[Playwright](https://playwright.dev/).
+
+## Prerequisites
+
+- **Docker** — running and accessible
+- **Viceroy** — Fastly local simulator (`cargo install viceroy`)
+- **wasm32-wasip1 target** — `rustup target add wasm32-wasip1`
+- **Node.js** (LTS) — for browser tests only
+
+## Quick start
+
+### HTTP-level tests
+
+```bash
+./scripts/integration-tests.sh
+```
+
+This script handles everything:
+
+1. Builds the WASM binary with test-specific config (origin URL pointing to
+   Docker containers)
+2. Builds the WordPress and Next.js Docker images
+3. Runs all integration tests sequentially
+
+### Browser tests
+
+```bash
+./scripts/integration-tests-browser.sh
+```
+
+This script:
+
+1. Builds the WASM binary and Docker images (same as above)
+2. Installs Playwright and Chromium
+3. Runs browser tests for Next.js and WordPress sequentially
+
+### Run a single test
+
+```bash
+# HTTP-level
+./scripts/integration-tests.sh test_wordpress_fastly
+./scripts/integration-tests.sh test_nextjs_fastly
+
+# Browser — single framework
+cd crates/integration-tests/browser
+TEST_FRAMEWORK=nextjs npx playwright test
+TEST_FRAMEWORK=wordpress npx playwright test
+```
+
+### Verbose output
+
+```bash
+./scripts/integration-tests.sh --nocapture
+```
+
+## Docker images
+
+Two test images are built from fixtures in `fixtures/frameworks/`:
+
+| Image | Dockerfile | Description |
+|---|---|---|
+| `test-wordpress:latest` | `fixtures/frameworks/wordpress/Dockerfile` | PHP built-in server with a minimal test theme |
+| `test-nextjs:latest` | `fixtures/frameworks/nextjs/Dockerfile` | Next.js 14 standalone app with 4 pages, API routes, forms, shared navigation, and deferred scripts |
+
+Both images include test fixtures with absolute origin URLs (`ORIGIN_HOST` env
+var) so the trusted server's URL rewriting can be verified.
+
+### Build images manually
+
+```bash
+docker build -t test-wordpress:latest \
+  crates/integration-tests/fixtures/frameworks/wordpress/
+
+docker build -t test-nextjs:latest \
+  crates/integration-tests/fixtures/frameworks/nextjs/
+```
+
+## Test scenarios
+
+### HTTP-level — standard (all frameworks)
+
+| Scenario | What it tests |
+|---|---|
+| `HtmlInjection` | Exactly one `<script id="trustedserver-js" src="/static/tsjs=...">` in proxied HTML |
+| `ScriptServing` | `/static/tsjs=tsjs-unified.min.js` returns JavaScript with bundle markers |
+| `AttributeRewriting` | `href`/`src` URLs with origin host are rewritten to proxy host (including inside ad slots) |
+| `ScriptServingUnknownFile404` | Unknown `/static/tsjs=...` paths return 404, not HTML fallback |
+
+### HTTP-level — Next.js custom
+
+| Scenario | What it tests |
+|---|---|
+| `NextJsRscFlight` | RSC Flight responses are not corrupted (no HTML, no script injection) |
+| `NextJsServerActions` | POST requests pass through proxy; unknown actions return 404/soft-404 |
+| `NextJsApiRoute` | API routes (`/api/hello`) return JSON without HTML injection |
+| `NextJsFormAction` | `<form action>` URLs rewritten from origin host to proxy host |
+
+### HTTP-level — WordPress custom
+
+| Scenario | What it tests |
+|---|---|
+| `WordPressAdminInjection` | `/wp-admin/` pages receive script injection (documents current behavior) |
+
+### Browser-level — shared (all frameworks)
+
+| Spec | What it tests |
+|---|---|
+| `script-injection` | `script#trustedserver-js` present in live DOM, no console errors |
+| `script-bundle` | JS bundle loads with 200, no parse/runtime errors, correct content type |
+
+### Browser-level — Next.js
+
+| Spec | What it tests |
+|---|---|
+| `navigation` | 4-page SPA navigation chain preserves injection without full reload, back button works, deferred route script executes after SPA transition |
+| `api-passthrough` | API routes return JSON without script injection (`/api/hello`, `/api/data`) |
+| `form-rewriting` | `<form action>` URL rewritten from origin to proxy on `/contact` page |
+
+### Browser-level — WordPress
+
+| Spec | What it tests |
+|---|---|
+| `admin-injection` | `/wp-admin/` has script tag in live DOM |
+
+## Architecture
+
+```
+tests/
+  integration.rs       # Test entry point — runs framework x runtime matrix
+  common/
+    assertions.rs      # HTML assertion helpers (script tag, attribute rewriting)
+    runtime.rs         # Error types, RuntimeEnvironment trait, env var helpers
+  environments/
+    mod.rs             # Runtime registry, port allocation, health checking
+    fastly.rs          # Viceroy-based Fastly Compute runtime
+  frameworks/
+    mod.rs             # Framework registry and FrontendFramework trait
+    scenarios.rs       # Standard and custom test scenarios
+    wordpress.rs       # WordPress container config
+    nextjs.rs          # Next.js container config
+browser/
+  playwright.config.ts # Playwright configuration (chromium, workers: 1)
+  global-setup.ts      # Starts Docker container + Viceroy before tests
+  global-teardown.ts   # Stops container + Viceroy after tests
+  helpers/
+    infra.ts           # Docker + Viceroy spawn/kill logic
+    wait-for-ready.ts  # Health check polling
+    state.ts           # Reads shared state file between setup/tests/teardown
+  tests/
+    shared/            # Tests that run for all frameworks
+    nextjs/            # Next.js-specific browser tests
+    wordpress/         # WordPress-specific browser tests
+fixtures/
+  configs/
+    viceroy-template.toml  # Viceroy local_server config (KV stores, secrets)
+  frameworks/
+    wordpress/             # WordPress Docker image source
+    nextjs/                # Next.js Docker image source
+```
+
+### How it works
+
+1. A Docker container starts for the frontend framework, mapped to a fixed
+   origin port (default 8888)
+2. The WASM binary is pre-built with `TRUSTED_SERVER__PUBLISHER__ORIGIN_URL`
+   pointing to `http://127.0.0.1:8888` so the proxy knows where to forward
+3. Viceroy spawns with the WASM binary on a random port
+4. **HTTP tests**: reqwest sends requests to Viceroy and asserts on responses
+5. **Browser tests**: Playwright opens Chromium pointing at Viceroy and verifies
+   script injection, bundle loading, and client-side navigation in a real browser
+
+### Why `--test-threads=1` / `workers: 1`
+
+All tests share the same fixed origin port (8888). The trusted server config is
+baked into the WASM binary at compile time with this port, so only one Docker
+container can be bound to it at a time.
+
+## CI
+
+Integration tests run in a separate workflow (`.github/workflows/integration-tests.yml`)
+triggered by:
+
+- Push to `main`
+- PR approval
+- Manual dispatch
+
+Two jobs run in parallel:
+
+1. **integration-tests** — HTTP-level tests (Rust + testcontainers)
+2. **browser-tests** — Playwright tests (Node.js + Chromium)
+
+They are **not** part of `cargo test --workspace` because the integration-tests
+crate requires a native target while the workspace default is `wasm32-wasip1`.
+
+## Known gaps
+
+- **GDPR consent propagation** — the consent field exists in `AuctionRequest`
+  but is not yet populated or forwarded. Requires implementation first.
+- **Next.js integration features** — the WASM binary is built without
+  `integrations.nextjs` enabled, so Next.js-specific rewriters/post-processors
+  are not exercised. RSC Flight/Server Actions tests are compatibility smoke
+  tests only.
+- **GTM integration** — not enabled in test config. Has unit coverage in
+  `google_tag_manager.rs`.
diff --git a/crates/integration-tests/browser/global-setup.ts b/crates/integration-tests/browser/global-setup.ts
new file mode 100644
index 00000000..b47d9772
--- /dev/null
+++ b/crates/integration-tests/browser/global-setup.ts
@@ -0,0 +1,80 @@
+import { writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import {
+  startContainer,
+  startViceroy,
+  stopContainer,
+  stopViceroy,
+} from "./helpers/infra.js";
+
+const STATE_FILE = resolve(__dirname, ".browser-test-state.json");
+
+const WASM_PATH =
+  process.env.WASM_BINARY_PATH ||
+  resolve(
+    __dirname,
+    "../../../target/wasm32-wasip1/release/trusted-server-fastly.wasm",
+  );
+
+const VICEROY_CONFIG =
+  process.env.VICEROY_CONFIG_PATH ||
+  resolve(__dirname, "../fixtures/configs/viceroy-template.toml");
+
+/** Persist current state so global-teardown can always clean up. */
+function writeState(state: {
+  baseUrl?: string;
+  containerId?: string;
+  viceroyPid?: number;
+  framework: string;
+}): void {
+  writeFileSync(STATE_FILE, JSON.stringify(state, null, 2));
+}
+
+async function globalSetup(): Promise<void> {
+  const framework = process.env.TEST_FRAMEWORK || "nextjs";
+  let containerId: string | undefined;
+  let viceroyPid: number | undefined;
+
+  try {
+    console.log(`[global-setup] Starting ${framework} container...`);
+    containerId = await startContainer(framework);
+
+    // Write partial state immediately so teardown can stop the container
+    // even if Viceroy startup fails below.
+    writeState({ containerId, framework });
+
+    console.log(`[global-setup] Starting Viceroy (WASM: ${WASM_PATH})...`);
+    const viceroy = await startViceroy(WASM_PATH, VICEROY_CONFIG);
+    viceroyPid = viceroy.process.pid;
+
+    console.log(`[global-setup] Viceroy ready at ${viceroy.baseUrl}`);
+
+    // Expose the base URL so playwright.config.ts picks it up via env var
+    process.env.VICEROY_BASE_URL = viceroy.baseUrl;
+
+    // Write complete state for tests and teardown
+    writeState({
+      baseUrl: viceroy.baseUrl,
+      containerId,
+      viceroyPid,
+      framework,
+    });
+  } catch (err) {
+    // Clean up any resources that were started before re-throwing
+    console.error("[global-setup] Setup failed, cleaning up...");
+    if (viceroyPid) stopViceroy(viceroyPid);
+    if (containerId) stopContainer(containerId);
+
+    // Remove partial state file since we cleaned up manually
+    try {
+      const { unlinkSync } = await import("node:fs");
+      unlinkSync(STATE_FILE);
+    } catch {
+      // State file may not exist
+    }
+
+    throw err;
+  }
+}
+
+export default globalSetup;
diff --git a/crates/integration-tests/browser/global-teardown.ts b/crates/integration-tests/browser/global-teardown.ts
new file mode 100644
index 00000000..adb1b1c7
--- /dev/null
+++ b/crates/integration-tests/browser/global-teardown.ts
@@ -0,0 +1,33 @@
+import { readFileSync, unlinkSync } from "node:fs";
+import { resolve } from "node:path";
+import { stopContainer, stopViceroy } from "./helpers/infra.js";
+
+const STATE_FILE = resolve(__dirname, ".browser-test-state.json");
+
+async function globalTeardown(): Promise<void> {
+  let state: { containerId?: string; viceroyPid?: number };
+  try {
+    state = JSON.parse(readFileSync(STATE_FILE, "utf-8"));
+  } catch {
+    console.warn("[global-teardown] No state file found, nothing to clean up");
+    return;
+  }
+
+  if (state.viceroyPid) {
+    console.log(`[global-teardown] Stopping Viceroy (pid: ${state.viceroyPid})`);
+    stopViceroy(state.viceroyPid);
+  }
+
+  if (state.containerId) {
+    console.log(`[global-teardown] Stopping container ${state.containerId.slice(0, 12)}...`);
+    stopContainer(state.containerId);
+  }
+
+  try {
+    unlinkSync(STATE_FILE);
+  } catch {
+    // Already removed
+  }
+}
+
+export default globalTeardown;
diff --git a/crates/integration-tests/browser/helpers/infra.ts b/crates/integration-tests/browser/helpers/infra.ts
new file mode 100644
index 00000000..6577ddab
--- /dev/null
+++ b/crates/integration-tests/browser/helpers/infra.ts
@@ -0,0 +1,128 @@
+import { execSync, spawn, type ChildProcess } from "node:child_process";
+import { createServer } from "node:net";
+import { waitForReady } from "./wait-for-ready.js";
+
+const ORIGIN_PORT = process.env.INTEGRATION_ORIGIN_PORT || "8888";
+
+/** Framework-specific container configuration. */
+const FRAMEWORK_CONFIG: Record<string, { image: string; port: number }> = {
+  nextjs: { image: "test-nextjs:latest", port: 3000 },
+  wordpress: { image: "test-wordpress:latest", port: 80 },
+};
+
+/** Find an available TCP port by briefly binding to port 0. */
+export async function findAvailablePort(): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const server = createServer();
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      if (addr && typeof addr === "object") {
+        const port = addr.port;
+        server.close(() => resolve(port));
+      } else {
+        server.close(() => reject(new Error("Failed to get port")));
+      }
+    });
+    server.on("error", reject);
+  });
+}
+
+/**
+ * Start a Docker container for the given framework.
+ *
+ * Uses `docker run -d` (detached) with `--rm` for auto-cleanup on stop.
+ * The container is mapped to the fixed origin port so the WASM binary
+ * (which has this port baked in) can proxy to it.
+ *
+ * @returns The container ID.
+ */
+export async function startContainer(framework: string): Promise<string> {
+  const config = FRAMEWORK_CONFIG[framework];
+  if (!config) {
+    throw new Error(
+      `Unknown framework: ${framework}. Expected one of: ${Object.keys(FRAMEWORK_CONFIG).join(", ")}`,
+    );
+  }
+
+  const containerId = execSync(
+    [
+      "docker run -d --rm",
+      `-p ${ORIGIN_PORT}:${config.port}`,
+      `-e ORIGIN_HOST=127.0.0.1:${ORIGIN_PORT}`,
+      config.image,
+    ].join(" "),
+    { encoding: "utf-8" },
+  ).trim();
+
+  try {
+    await waitForReady(`http://127.0.0.1:${ORIGIN_PORT}`, "/");
+  } catch (err) {
+    // Container started but never became ready — stop it before propagating.
+    stopContainer(containerId);
+    throw err;
+  }
+
+  return containerId;
+}
+
+/** Stop a Docker container by ID. */
+export function stopContainer(containerId: string): void {
+  try {
+    execSync(`docker stop ${containerId}`, { timeout: 10_000 });
+  } catch {
+    // Container may have already stopped (--rm flag)
+  }
+}
+
+/**
+ * Spawn a Viceroy process with the given WASM binary on a random port.
+ *
+ * Mirrors the Rust `FastlyEnvironment::spawn` in `tests/environments/fastly.rs`.
+ *
+ * @returns The child process and the base URL.
+ */
+export async function startViceroy(
+  wasmPath: string,
+  configPath: string,
+): Promise<{ process: ChildProcess; baseUrl: string }> {
+  const port = await findAvailablePort();
+
+  const child = spawn(
+    "viceroy",
+    [wasmPath, "-C", configPath, "--addr", `127.0.0.1:${port}`],
+    // stdin: ignore, stdout: pipe (drained), stderr: pipe (logged).
+    // IMPORTANT: stdout MUST be drained to prevent pipe buffer deadlock.
+    // If the OS pipe buffer (~64KB) fills, Viceroy blocks on write.
+    { stdio: ["ignore", "pipe", "pipe"] },
+  );
+
+  // Drain stdout to prevent pipe buffer deadlock
+  child.stdout?.resume();
+
+  // Surface Viceroy stderr for debugging
+  child.stderr?.on("data", (data: Buffer) => {
+    const line = data.toString().trim();
+    if (line) console.error(`[viceroy] ${line}`);
+  });
+
+  const baseUrl = `http://127.0.0.1:${port}`;
+
+  try {
+    await waitForReady(baseUrl, "/__trusted-server/health");
+  } catch (err) {
+    // Viceroy spawned but never became ready — kill it before propagating.
+    if (child.pid) stopViceroy(child.pid);
+    throw err;
+  }
+
+  return { process: child, baseUrl };
+}
+
+/** Kill a Viceroy process. */
+export function stopViceroy(pid: number): void {
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch {
+    // Already exited
+  }
+}
diff --git a/crates/integration-tests/browser/helpers/state.ts b/crates/integration-tests/browser/helpers/state.ts
new file mode 100644
index 00000000..72167bd1
--- /dev/null
+++ b/crates/integration-tests/browser/helpers/state.ts
@@ -0,0 +1,16 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+export interface TestState {
+  baseUrl: string;
+  containerId: string;
+  viceroyPid: number;
+  framework: string;
+}
+
+const STATE_FILE = resolve(__dirname, "../.browser-test-state.json");
+
+/** Read the state written by global-setup.ts. */
+export function readState(): TestState {
+  return JSON.parse(readFileSync(STATE_FILE, "utf-8"));
+}
diff --git a/crates/integration-tests/browser/helpers/wait-for-ready.ts b/crates/integration-tests/browser/helpers/wait-for-ready.ts
new file mode 100644
index 00000000..8b7ec803
--- /dev/null
+++ b/crates/integration-tests/browser/helpers/wait-for-ready.ts
@@ -0,0 +1,30 @@
+/**
+ * Poll a URL until it returns a successful response.
+ *
+ * Mirrors the Rust `wait_for_ready` implementation in
+ * `tests/environments/mod.rs` — 30 attempts with 500ms intervals.
+ */
+export async function waitForReady(
+  baseUrl: string,
+  path: string,
+  {
+    maxAttempts = 30,
+    intervalMs = 500,
+  }: { maxAttempts?: number; intervalMs?: number } = {},
+): Promise<void> {
+  const url = `${baseUrl}${path}`;
+
+  for (let i = 0; i < maxAttempts; i++) {
+    try {
+      const resp = await fetch(url);
+      if (resp.ok) return;
+    } catch {
+      // Connection refused — server not ready yet
+    }
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+  }
+
+  throw new Error(
+    `Service at ${url} not ready after ${maxAttempts} attempts (${(maxAttempts * intervalMs) / 1000}s)`,
+  );
+}
diff --git a/crates/integration-tests/browser/package-lock.json b/crates/integration-tests/browser/package-lock.json
new file mode 100644
index 00000000..39b512a1
--- /dev/null
+++ b/crates/integration-tests/browser/package-lock.json
@@ -0,0 +1,78 @@
+{
+  "name": "integration-tests-browser",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "integration-tests-browser",
+      "version": "1.0.0",
+      "devDependencies": {
+        "@playwright/test": "^1.49.0"
+      }
+    },
+    "node_modules/@playwright/test": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.58.2.tgz",
+      "integrity": "sha512-akea+6bHYBBfA9uQqSYmlJXn61cTa+jbO87xVLCWbTqbWadRVmhxlXATaOjOgcBaWU4ePo0wB41KMFv3o35IXA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright": "1.58.2"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/playwright": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz",
+      "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright-core": "1.58.2"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz",
+      "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    }
+  }
+}
diff --git a/crates/integration-tests/browser/package.json b/crates/integration-tests/browser/package.json
new file mode 100644
index 00000000..13282f28
--- /dev/null
+++ b/crates/integration-tests/browser/package.json
@@ -0,0 +1,13 @@
+{
+  "name": "integration-tests-browser",
+  "version": "1.0.0",
+  "private": true,
+  "scripts": {
+    "test": "npx playwright test",
+    "test:nextjs": "TEST_FRAMEWORK=nextjs npx playwright test",
+    "test:wordpress": "TEST_FRAMEWORK=wordpress npx playwright test"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.49.0"
+  }
+}
diff --git a/crates/integration-tests/browser/playwright.config.ts b/crates/integration-tests/browser/playwright.config.ts
new file mode 100644
index 00000000..1eb232d5
--- /dev/null
+++ b/crates/integration-tests/browser/playwright.config.ts
@@ -0,0 +1,25 @@
+import { defineConfig } from "@playwright/test";
+
+export default defineConfig({
+  testDir: "./tests",
+  globalSetup: "./global-setup.ts",
+  globalTeardown: "./global-teardown.ts",
+  timeout: 30_000,
+  retries: 1,
+  // Sequential execution: all tests share a single origin port (8888)
+  workers: 1,
+  use: {
+    baseURL: process.env.VICEROY_BASE_URL || "http://127.0.0.1:7878",
+    headless: true,
+    screenshot: "only-on-failure",
+    trace: "retain-on-failure",
+  },
+  projects: [
+    {
+      name: "chromium",
+      use: { browserName: "chromium" },
+    },
+  ],
+  reporter: [["list"], ["html", { open: "never" }]],
+  outputDir: "./test-results",
+});
diff --git a/crates/integration-tests/browser/tests/nextjs/api-passthrough.spec.ts b/crates/integration-tests/browser/tests/nextjs/api-passthrough.spec.ts
new file mode 100644
index 00000000..22299191
--- /dev/null
+++ b/crates/integration-tests/browser/tests/nextjs/api-passthrough.spec.ts
@@ -0,0 +1,40 @@
+import { test, expect } from "@playwright/test";
+import { readState } from "../../helpers/state.js";
+
+test.beforeEach(async ({}, testInfo) => {
+  const state = readState();
+  if (state.framework !== "nextjs") {
+    testInfo.skip();
+  }
+});
+
+test.describe("Next.js API route passthrough", () => {
+  test("API route returns JSON without script injection", async ({
+    request,
+  }) => {
+    const resp = await request.get("/api/hello");
+    expect(resp.status()).toBe(200);
+
+    const contentType = resp.headers()["content-type"] || "";
+    expect(contentType).toContain("application/json");
+
+    const text = await resp.text();
+    const body = JSON.parse(text);
+    expect(body.message).toBe("Hello from the API!");
+    expect(body.status).toBe("success");
+
+    // JSON must not contain HTML injection
+    expect(text).not.toContain("<script");
+    expect(text).not.toContain("/static/tsjs=");
+  });
+
+  test("data API route returns structured JSON", async ({ request }) => {
+    const resp = await request.get("/api/data");
+    expect(resp.status()).toBe(200);
+
+    const body = await resp.json();
+    expect(body.users).toHaveLength(2);
+    expect(body.users[0].name).toBe("Alice");
+    expect(body.metadata.version).toBe("1.0.0");
+  });
+});
diff --git a/crates/integration-tests/browser/tests/nextjs/form-rewriting.spec.ts b/crates/integration-tests/browser/tests/nextjs/form-rewriting.spec.ts
new file mode 100644
index 00000000..ac5927e1
--- /dev/null
+++ b/crates/integration-tests/browser/tests/nextjs/form-rewriting.spec.ts
@@ -0,0 +1,34 @@
+import { test, expect } from "@playwright/test";
+import { readState } from "../../helpers/state.js";
+
+test.beforeEach(async ({}, testInfo) => {
+  const state = readState();
+  if (state.framework !== "nextjs") {
+    testInfo.skip();
+  }
+});
+
+test.describe("Next.js form action rewriting", () => {
+  test("form action URL is rewritten from origin to proxy", async ({
+    page,
+  }) => {
+    await page.goto("/contact", { waitUntil: "domcontentloaded" });
+
+    const form = page.locator("form#contact-form");
+    await expect(form).toHaveCount(1);
+
+    const action = await form.getAttribute("action");
+    expect(action).toBeTruthy();
+
+    // Origin host should be rewritten to proxy host
+    const originPort = process.env.INTEGRATION_ORIGIN_PORT || "8888";
+    expect(action).not.toContain(`127.0.0.1:${originPort}`);
+    // The path should be preserved
+    expect(action).toContain("/api/contact");
+  });
+
+  test("contact page has script injection", async ({ page }) => {
+    await page.goto("/contact", { waitUntil: "domcontentloaded" });
+    await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
+  });
+});
diff --git a/crates/integration-tests/browser/tests/nextjs/navigation.spec.ts b/crates/integration-tests/browser/tests/nextjs/navigation.spec.ts
new file mode 100644
index 00000000..2244e032
--- /dev/null
+++ b/crates/integration-tests/browser/tests/nextjs/navigation.spec.ts
@@ -0,0 +1,139 @@
+import { test, expect, type Page } from "@playwright/test";
+import { readState } from "../../helpers/state.js";
+
+test.beforeEach(async ({}, testInfo) => {
+  const state = readState();
+  if (state.framework !== "nextjs") {
+    testInfo.skip();
+  }
+});
+
+/**
+ * Wait for the Next.js client router to hydrate.
+ *
+ * The Navigation component sets `data-hydrated="true"` on `<html>` inside a
+ * `useEffect`, which only fires after React hydration completes. Waiting for
+ * this attribute prevents clicking `<Link>` elements before the client router
+ * is ready (which would cause a full-page navigation instead of SPA).
+ */
+async function waitForHydration(page: Page): Promise<void> {
+  await page.waitForSelector("html[data-hydrated='true']", {
+    timeout: 10_000,
+  });
+}
+
+test.describe("Next.js client-side navigation", () => {
+  test("4-page SPA navigation chain preserves script injection without full reload", async ({
+    page,
+  }) => {
+    const jsErrors: string[] = [];
+    page.on("pageerror", (error) => jsErrors.push(error.message));
+
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+
+    // Script present on initial load
+    await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
+
+    // Wait for the client router to hydrate before clicking any links.
+    await waitForHydration(page);
+
+    // Track document-level navigations after initial load.
+    // A full page reload triggers a new "document" request; SPA navigation does not.
+    const documentRequests: string[] = [];
+    page.on("request", (req) => {
+      if (req.resourceType() === "document") {
+        documentRequests.push(req.url());
+      }
+    });
+
+    // Navigate: Home → About
+    await page.click('#site-nav a[href="/about"]');
+    await page.waitForURL("**/about", { waitUntil: "domcontentloaded" });
+    await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
+
+    // Navigate: About → Dashboard
+    await page.click('#site-nav a[href="/dashboard"]');
+    await page.waitForURL("**/dashboard", { waitUntil: "domcontentloaded" });
+    await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
+
+    // Navigate: Dashboard → Contact
+    await page.click('#site-nav a[href="/contact"]');
+    await page.waitForURL("**/contact", { waitUntil: "domcontentloaded" });
+    await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
+
+    // Prove all navigations were true SPA — no document-level requests fired
+    expect(documentRequests).toEqual([]);
+
+    // No JS errors during the entire navigation chain
+    expect(jsErrors).toEqual([]);
+  });
+
+  test("navigating back preserves script injection", async ({ page }) => {
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+    await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
+
+    // Wait for hydration before navigating
+    await waitForHydration(page);
+
+    // Navigate forward
+    await page.click('#site-nav a[href="/about"]');
+    await page.waitForURL("**/about", { waitUntil: "domcontentloaded" });
+
+    // Navigate back
+    await page.goBack({ waitUntil: "domcontentloaded" });
+
+    await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
+  });
+
+  test("deferred route script executes after SPA transition to dashboard", async ({
+    page,
+  }) => {
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+    await waitForHydration(page);
+
+    // No route script marker on home page
+    const before = await page.evaluate(
+      () => (window as any).__routeScriptExecuted,
+    );
+    expect(before).toBeUndefined();
+
+    // Track document requests to prove this is a true SPA transition
+    const documentRequests: string[] = [];
+    page.on("request", (req) => {
+      if (req.resourceType() === "document") {
+        documentRequests.push(req.url());
+      }
+    });
+
+    // SPA navigate to dashboard
+    await page.click('#site-nav a[href="/dashboard"]');
+    await page.waitForURL("**/dashboard", { waitUntil: "domcontentloaded" });
+
+    // Wait for the deferred script to execute
+    await page.waitForFunction(
+      () => (window as any).__routeScriptExecuted === "dashboard",
+      { timeout: 5_000 },
+    );
+
+    // Script executed exactly once
+    const count = await page.evaluate(
+      () => (window as any).__routeScriptExecutionCount,
+    );
+    expect(count).toBe(1);
+
+    // Prove this was an SPA transition, not a full reload
+    expect(documentRequests).toEqual([]);
+  });
+
+  test("about page has script injection via direct navigation", async ({
+    page,
+  }) => {
+    await page.goto("/about", { waitUntil: "domcontentloaded" });
+    await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
+
+    const src = await page
+      .locator("script#trustedserver-js")
+      .getAttribute("src");
+    expect(src).toContain("/static/tsjs=");
+  });
+});
diff --git a/crates/integration-tests/browser/tests/shared/script-bundle.spec.ts b/crates/integration-tests/browser/tests/shared/script-bundle.spec.ts
new file mode 100644
index 00000000..8c10974d
--- /dev/null
+++ b/crates/integration-tests/browser/tests/shared/script-bundle.spec.ts
@@ -0,0 +1,53 @@
+import { test, expect } from "@playwright/test";
+
+test.describe("Script bundle", () => {
+  test("JS bundle loads with 200 and executes without parse errors", async ({
+    page,
+  }) => {
+    const bundleResponses: { url: string; status: number }[] = [];
+    page.on("response", (response) => {
+      if (response.url().includes("/static/tsjs=")) {
+        bundleResponses.push({
+          url: response.url(),
+          status: response.status(),
+        });
+      }
+    });
+
+    const jsErrors: string[] = [];
+    page.on("pageerror", (error) => jsErrors.push(error.message));
+
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+
+    // Wait for the bundle response specifically (up to 10s)
+    if (bundleResponses.length === 0) {
+      await page.waitForResponse(
+        (resp) => resp.url().includes("/static/tsjs="),
+        { timeout: 10_000 },
+      );
+    }
+
+    // Bundle was requested and returned 200
+    expect(bundleResponses.length).toBeGreaterThan(0);
+    expect(bundleResponses[0].status).toBe(200);
+
+    // No JS parse/runtime errors from the bundle
+    expect(jsErrors).toEqual([]);
+  });
+
+  test("bundle response has correct content type", async ({ page }) => {
+    let bundleContentType = "";
+
+    const bundlePromise = page.waitForResponse(
+      (resp) => resp.url().includes("/static/tsjs="),
+      { timeout: 10_000 },
+    );
+
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+
+    const bundleResp = await bundlePromise;
+    bundleContentType = bundleResp.headers()["content-type"] || "";
+
+    expect(bundleContentType).toContain("javascript");
+  });
+});
diff --git a/crates/integration-tests/browser/tests/shared/script-injection.spec.ts b/crates/integration-tests/browser/tests/shared/script-injection.spec.ts
new file mode 100644
index 00000000..f67bf06b
--- /dev/null
+++ b/crates/integration-tests/browser/tests/shared/script-injection.spec.ts
@@ -0,0 +1,36 @@
+import { test, expect } from "@playwright/test";
+
+test.describe("Script injection", () => {
+  test("injected script tag is present in the live DOM", async ({ page }) => {
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+    const scriptTag = page.locator("script#trustedserver-js");
+    await expect(scriptTag).toHaveCount(1);
+
+    const src = await scriptTag.getAttribute("src");
+    expect(src).toContain("/static/tsjs=");
+  });
+
+  test("no unexpected console errors on page load", async ({ page }) => {
+    const errors: string[] = [];
+    page.on("console", (msg) => {
+      if (msg.type() === "error") errors.push(msg.text());
+    });
+
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+
+    // Give scripts a moment to execute and log errors
+    await page.waitForTimeout(2000);
+
+    // Suppress benign errors:
+    // - favicon: not served by test containers
+    // - "Failed to load resource": test fixture pages reference images/assets
+    //   at origin URLs purely for attribute-rewriting tests; the resources
+    //   don't need to exist on the server
+    const unexpected = errors.filter(
+      (e) =>
+        !e.includes("favicon") &&
+        !e.includes("Failed to load resource"),
+    );
+    expect(unexpected).toEqual([]);
+  });
+});
diff --git a/crates/integration-tests/browser/tests/wordpress/admin-injection.spec.ts b/crates/integration-tests/browser/tests/wordpress/admin-injection.spec.ts
new file mode 100644
index 00000000..6b6e57c3
--- /dev/null
+++ b/crates/integration-tests/browser/tests/wordpress/admin-injection.spec.ts
@@ -0,0 +1,22 @@
+import { test, expect } from "@playwright/test";
+import { readState } from "../../helpers/state.js";
+
+test.beforeEach(async ({}, testInfo) => {
+  const state = readState();
+  if (state.framework !== "wordpress") {
+    testInfo.skip();
+  }
+});
+
+test.describe("WordPress admin injection", () => {
+  test("admin page has script tag in live DOM", async ({ page }) => {
+    // Documents current behavior: the trusted-server injects the script
+    // on ALL pages, including /wp-admin/. This test captures that behavior
+    // so any future change (e.g. excluding admin pages) is intentional.
+    await page.goto("/wp-admin/", { waitUntil: "domcontentloaded" });
+    await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
+
+    const src = await page.locator("script#trustedserver-js").getAttribute("src");
+    expect(src).toContain("/static/tsjs=");
+  });
+});
diff --git a/crates/integration-tests/browser/tsconfig.json b/crates/integration-tests/browser/tsconfig.json
new file mode 100644
index 00000000..aa2ca675
--- /dev/null
+++ b/crates/integration-tests/browser/tsconfig.json
@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "outDir": "dist"
+  },
+  "include": ["**/*.ts"]
+}
diff --git a/crates/integration-tests/fixtures/configs/viceroy-template.toml b/crates/integration-tests/fixtures/configs/viceroy-template.toml
new file mode 100644
index 00000000..3129c3f5
--- /dev/null
+++ b/crates/integration-tests/fixtures/configs/viceroy-template.toml
@@ -0,0 +1,38 @@
+# Viceroy local server configuration template for integration tests.
+# This configures the Viceroy runtime itself (backends, KV stores, etc.),
+# separate from the application config (trusted-server.toml).
+
+[local_server]
+
+    [local_server.backends]
+
+    [local_server.kv_stores]
+        [[local_server.kv_stores.counter_store]]
+            key = "placeholder"
+            data = "placeholder"
+
+        [[local_server.kv_stores.opid_store]]
+            key = "placeholder"
+            data = "placeholder"
+
+        [[local_server.kv_stores.creative_store]]
+            key = "placeholder"
+            data = "placeholder"
+
+    [local_server.secret_stores]
+        [[local_server.secret_stores.signing_keys]]
+            key = "ts-2025-10-A"
+            data = "NVnTYrw5xoyTJDOwoUWoPJO3A6UCCXOJJUzgGTxxx7k="
+
+        [[local_server.secret_stores.api-keys]]
+            key = "api_key"
+            data = "test-api-key"
+
+    [local_server.config_stores]
+        [local_server.config_stores.jwks_store]
+            format = "inline-toml"
+        [local_server.config_stores.jwks_store.contents]
+            ts-2025-10-A = "{\"kty\":\"OKP\",\"crv\":\"Ed25519\",\"kid\":\"ts-2025-10-A\",\"use\":\"sig\",\"x\":\"UVTi04QLrIuB7jXpVfHjUTVN5aIdcbPNr50umTtN8pw\"}"
+            ts-2025-10-B = "{\"kty\":\"OKP\",\"crv\":\"Ed25519\",\"kid\":\"ts-2025-10-B\",\"use\":\"sig\",\"x\":\"HVTi04QLrIuB7jXpVfHjUTVN5aIdcbPNr50umTtN8pw\"}"
+            current-kid = "ts-2025-10-A"
+            active-kids = "ts-2025-10-A,ts-2025-10-B"
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile b/crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile
new file mode 100644
index 00000000..ab580ce0
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile
@@ -0,0 +1,37 @@
+# Next.js container for integration testing.
+# Builds a standalone Next.js 14 app with pages, API routes, forms, and ad slots.
+#
+# Build:
+#   docker build -t test-nextjs:latest \
+#     crates/integration-tests/fixtures/frameworks/nextjs/
+#
+# Run manually:
+#   docker run -p 3000:3000 test-nextjs:latest
+
+# --- Build stage ---
+FROM node:20-alpine AS builder
+
+WORKDIR /app
+
+COPY package.json ./
+RUN npm install
+
+COPY next.config.mjs ./
+COPY app/ ./app/
+
+RUN npm run build
+
+# --- Runtime stage ---
+FROM node:20-alpine AS runner
+
+WORKDIR /app
+
+ENV NODE_ENV=production
+
+# Copy standalone output from builder
+COPY --from=builder /app/.next/standalone ./
+COPY --from=builder /app/.next/static ./.next/static
+
+EXPOSE 3000
+
+CMD ["node", "server.js"]
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/about/page.tsx b/crates/integration-tests/fixtures/frameworks/nextjs/app/about/page.tsx
new file mode 100644
index 00000000..bc36c76c
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/about/page.tsx
@@ -0,0 +1,18 @@
+export default function About() {
+  const originHost = process.env.ORIGIN_HOST || "127.0.0.1:8888";
+
+  return (
+    <main>
+      <h1>About Page</h1>
+      <p>This is the about page for client-side navigation testing.</p>
+
+      <a id="origin-link-about" href={`http://${originHost}/contact`}>
+        Origin Link (About)
+      </a>
+
+      <div id="ad-slot-about" data-ad-unit="/test/about-banner">
+        <a href={`http://${originHost}/ad/about-landing`}>About ad</a>
+      </div>
+    </main>
+  );
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/api/data/route.ts b/crates/integration-tests/fixtures/frameworks/nextjs/app/api/data/route.ts
new file mode 100644
index 00000000..cb3ebc0e
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/api/data/route.ts
@@ -0,0 +1,11 @@
+import { NextResponse } from "next/server";
+
+export async function GET() {
+  return NextResponse.json({
+    users: [
+      { id: 1, name: "Alice", email: "alice@example.com" },
+      { id: 2, name: "Bob", email: "bob@example.com" },
+    ],
+    metadata: { version: "1.0.0" },
+  });
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/api/hello/route.ts b/crates/integration-tests/fixtures/frameworks/nextjs/app/api/hello/route.ts
new file mode 100644
index 00000000..1c8a43ec
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/api/hello/route.ts
@@ -0,0 +1,9 @@
+import { NextResponse } from "next/server";
+
+export async function GET() {
+  return NextResponse.json({
+    message: "Hello from the API!",
+    timestamp: new Date().toISOString(),
+    status: "success",
+  });
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/components/Navigation.tsx b/crates/integration-tests/fixtures/frameworks/nextjs/app/components/Navigation.tsx
new file mode 100644
index 00000000..e4f3ce4d
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/components/Navigation.tsx
@@ -0,0 +1,21 @@
+"use client";
+
+import { useEffect } from "react";
+import Link from "next/link";
+
+export default function Navigation() {
+  useEffect(() => {
+    // Signal that the client router has hydrated and is ready to handle
+    // SPA navigations. Browser tests wait for this before clicking links.
+    document.documentElement.dataset.hydrated = "true";
+  }, []);
+
+  return (
+    <nav id="site-nav">
+      <Link href="/">Home</Link>
+      <Link href="/about">About</Link>
+      <Link href="/dashboard">Dashboard</Link>
+      <Link href="/contact">Contact</Link>
+    </nav>
+  );
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/components/RouteScript.tsx b/crates/integration-tests/fixtures/frameworks/nextjs/app/components/RouteScript.tsx
new file mode 100644
index 00000000..ae479549
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/components/RouteScript.tsx
@@ -0,0 +1,18 @@
+"use client";
+
+import Script from "next/script";
+
+export default function RouteScript({ marker }: { marker: string }) {
+  return (
+    <Script
+      id={`route-deferred-script-${marker}`}
+      strategy="afterInteractive"
+      dangerouslySetInnerHTML={{
+        __html: [
+          `window.__routeScriptExecuted = "${marker}";`,
+          `window.__routeScriptExecutionCount = (window.__routeScriptExecutionCount ?? 0) + 1;`,
+        ].join("\n"),
+      }}
+    />
+  );
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/contact/page.tsx b/crates/integration-tests/fixtures/frameworks/nextjs/app/contact/page.tsx
new file mode 100644
index 00000000..8986fab8
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/contact/page.tsx
@@ -0,0 +1,28 @@
+export default function Contact() {
+  const originHost = process.env.ORIGIN_HOST || "127.0.0.1:8888";
+
+  return (
+    <main>
+      <h1>Contact Us</h1>
+      <p>Send us a message using the form below.</p>
+
+      {/* Form with action URL pointing to origin — the proxy should rewrite it. */}
+      <form id="contact-form" action={`http://${originHost}/api/contact`} method="POST">
+        <label htmlFor="name">Name</label>
+        <input type="text" id="name" name="name" required />
+
+        <label htmlFor="email">Email</label>
+        <input type="email" id="email" name="email" required />
+
+        <label htmlFor="message">Message</label>
+        <textarea id="message" name="message" required rows={5} />
+
+        <button type="submit">Send Message</button>
+      </form>
+
+      <div id="ad-slot-contact" data-ad-unit="/test/contact-sidebar">
+        <a href={`http://${originHost}/ad/contact-landing`}>Contact ad</a>
+      </div>
+    </main>
+  );
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/dashboard/page.tsx b/crates/integration-tests/fixtures/frameworks/nextjs/app/dashboard/page.tsx
new file mode 100644
index 00000000..e1249bf0
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/dashboard/page.tsx
@@ -0,0 +1,34 @@
+import RouteScript from "../components/RouteScript";
+
+export default function Dashboard() {
+  const originHost = process.env.ORIGIN_HOST || "127.0.0.1:8888";
+
+  const stats = [
+    { label: "Total Users", value: "1,234" },
+    { label: "Active Sessions", value: "56" },
+    { label: "API Calls", value: "12,345" },
+    { label: "Success Rate", value: "99.9%" },
+  ];
+
+  return (
+    <main>
+      <h1>Dashboard</h1>
+      <p>Sample dashboard page for testing script injection on content-heavy pages.</p>
+
+      <ul id="stats-list">
+        {stats.map((stat) => (
+          <li key={stat.label}>
+            <strong>{stat.label}:</strong> {stat.value}
+          </li>
+        ))}
+      </ul>
+
+      <div id="ad-slot-dashboard" data-ad-unit="/test/dashboard-leaderboard">
+        <a href={`http://${originHost}/ad/dashboard-landing`}>Dashboard ad</a>
+        <img src={`http://${originHost}/ad/leaderboard.png`} alt="leaderboard" />
+      </div>
+
+      <RouteScript marker="dashboard" />
+    </main>
+  );
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/layout.tsx b/crates/integration-tests/fixtures/frameworks/nextjs/app/layout.tsx
new file mode 100644
index 00000000..4a91c9df
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/layout.tsx
@@ -0,0 +1,22 @@
+import Navigation from "./components/Navigation";
+
+export const metadata = {
+  title: "Test Publisher - Next.js",
+  description: "Integration test page for trusted server",
+};
+
+export default function RootLayout({
+  children,
+}: {
+  children: React.ReactNode;
+}) {
+  return (
+    <html lang="en">
+      <head />
+      <body>
+        <Navigation />
+        {children}
+      </body>
+    </html>
+  );
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx b/crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx
new file mode 100644
index 00000000..2769d104
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx
@@ -0,0 +1,36 @@
+export default function Home() {
+  // Server component — process.env is available at render time
+  const originHost = process.env.ORIGIN_HOST || "127.0.0.1:8888";
+
+  return (
+    <main>
+      <h1>Integration Test Publisher</h1>
+      <p>This is a test page for integration testing of the trusted server.</p>
+
+      {/* Links with absolute origin URLs for attribute rewriting tests.
+          The trusted server should rewrite these from origin host to proxy host. */}
+      <a id="origin-link" href={`http://${originHost}/page`}>
+        Origin Link
+      </a>
+      <img
+        id="origin-img"
+        src={`http://${originHost}/images/test.png`}
+        alt="test"
+      />
+
+      {/* Ad slots with both data-ad-unit (preserved) and URL attributes (rewritten).
+          This tests that URL rewriting works inside ad markup, not just outside it. */}
+      <div id="ad-slot-1" data-ad-unit="/test/banner">
+        <a href={`http://${originHost}/ad/banner-landing`}>Banner ad</a>
+        <img src={`http://${originHost}/ad/banner.png`} alt="banner" />
+      </div>
+
+      <p>More page content follows the ad slot.</p>
+
+      {/* Second ad slot */}
+      <div id="ad-slot-2" data-ad-unit="/test/sidebar">
+        <a href={`http://${originHost}/ad/sidebar-landing`}>Sidebar ad</a>
+      </div>
+    </main>
+  );
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/next.config.mjs b/crates/integration-tests/fixtures/frameworks/nextjs/next.config.mjs
new file mode 100644
index 00000000..8c8bab67
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/next.config.mjs
@@ -0,0 +1,6 @@
+/** @type {import('next').NextConfig} */
+const nextConfig = {
+  output: "standalone",
+};
+
+export default nextConfig;
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/package.json b/crates/integration-tests/fixtures/frameworks/nextjs/package.json
new file mode 100644
index 00000000..8bdf3217
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/package.json
@@ -0,0 +1,20 @@
+{
+  "name": "integration-test-nextjs",
+  "version": "1.0.0",
+  "private": true,
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start -p 3000"
+  },
+  "dependencies": {
+    "next": "^14.0.0",
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0"
+  },
+  "devDependencies": {
+    "typescript": "^5",
+    "@types/react": "^18",
+    "@types/node": "^20"
+  }
+}
diff --git a/crates/integration-tests/fixtures/frameworks/wordpress/Dockerfile b/crates/integration-tests/fixtures/frameworks/wordpress/Dockerfile
new file mode 100644
index 00000000..c913cfa5
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/wordpress/Dockerfile
@@ -0,0 +1,22 @@
+# Minimal WordPress container for integration testing.
+# Uses PHP built-in server with a simple test theme that outputs HTML
+# with ad slot divs — no MySQL or full WordPress stack required.
+#
+# Build:
+#   docker build -t test-wordpress:latest \
+#     crates/integration-tests/fixtures/frameworks/wordpress/
+#
+# Run manually:
+#   docker run -p 8080:80 test-wordpress:latest
+
+FROM php:8.3-cli-alpine
+
+WORKDIR /var/www/html
+
+# Copy test theme files that simulate WordPress HTML output
+COPY theme/ /var/www/html/
+
+EXPOSE 80
+
+# Serve with PHP built-in server
+CMD ["php", "-S", "0.0.0.0:80", "-t", "/var/www/html"]
diff --git a/crates/integration-tests/fixtures/frameworks/wordpress/theme/index.php b/crates/integration-tests/fixtures/frameworks/wordpress/theme/index.php
new file mode 100644
index 00000000..0a9fed1b
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/wordpress/theme/index.php
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Test Publisher - WordPress</title>
+    <link rel="stylesheet" href="/wp-content/themes/test/style.css">
+</head>
+<body>
+    <header>
+        <h1>Integration Test Publisher</h1>
+        <nav>
+            <a href="/">Home</a>
+            <a href="/about">About</a>
+        </nav>
+    </header>
+
+    <main>
+        <article>
+            <h2>Test Article</h2>
+            <p>This is a test article for integration testing of the trusted server.</p>
+
+            <!-- Links with absolute origin URLs for attribute rewriting tests.
+                 The trusted server should rewrite these from origin host to proxy host. -->
+            <?php $origin = getenv('ORIGIN_HOST') ?: '127.0.0.1:8888'; ?>
+            <a id="origin-link" href="http://<?= $origin ?>/page">Origin Link</a>
+            <img id="origin-img" src="http://<?= $origin ?>/images/test.png" alt="test">
+
+            <!-- Ad slots with both data-ad-unit (preserved) and URL attributes (rewritten).
+                 This tests that URL rewriting works inside ad markup, not just outside it. -->
+            <div id="ad-slot-1" data-ad-unit="/test/banner">
+                <a href="http://<?= $origin ?>/ad/banner-landing">Banner ad</a>
+                <img src="http://<?= $origin ?>/ad/banner.png" alt="banner">
+            </div>
+
+            <p>More article content follows the ad slot.</p>
+
+            <!-- Second ad slot -->
+            <div id="ad-slot-2" data-ad-unit="/test/sidebar">
+                <a href="http://<?= $origin ?>/ad/sidebar-landing">Sidebar ad</a>
+            </div>
+        </article>
+    </main>
+
+    <footer>
+        <p>&copy; 2026 Test Publisher</p>
+    </footer>
+</body>
+</html>
diff --git a/crates/integration-tests/fixtures/frameworks/wordpress/theme/wp-admin/index.php b/crates/integration-tests/fixtures/frameworks/wordpress/theme/wp-admin/index.php
new file mode 100644
index 00000000..f619a973
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/wordpress/theme/wp-admin/index.php
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>WordPress Admin - Dashboard</title>
+</head>
+<body class="wp-admin">
+    <div id="wpwrap">
+        <h1>Dashboard</h1>
+        <p>WordPress admin area — scripts ARE injected here (current behavior — update this if admin exclusion is added).</p>
+    </div>
+</body>
+</html>
diff --git a/crates/integration-tests/tests/common/assertions.rs b/crates/integration-tests/tests/common/assertions.rs
new file mode 100644
index 00000000..b462cb6e
--- /dev/null
+++ b/crates/integration-tests/tests/common/assertions.rs
@@ -0,0 +1,580 @@
+use super::runtime::{TestError, TestResult};
+use error_stack::Report;
+use scraper::{Html, Selector};
+
+/// Parse a CSS selector, mapping the error to [`TestError::InvalidSelector`]
+fn parse_selector(selector: &str) -> TestResult<Selector> {
+    Selector::parse(selector).map_err(|_| Report::new(TestError::InvalidSelector))
+}
+
+/// Assert that HTML contains the trustedserver-js script tag.
+///
+/// Looks for `<script src="/static/tsjs=...">` injected by the trusted-server
+/// HTML processor. The URL format is `/static/tsjs=tsjs-unified.min.js?v={hash}`.
+///
+/// # Errors
+///
+/// Returns [`TestError::ScriptTagNotFound`] if no matching script tag exists.
+pub fn assert_script_tag_present(html: &str) -> TestResult<()> {
+    let document = Html::parse_document(html);
+    let selector = parse_selector("script[src*='/static/tsjs=']")?;
+
+    if document.select(&selector).next().is_some() {
+        return Ok(());
+    }
+
+    Err(Report::new(TestError::ScriptTagNotFound))
+}
+
+/// Assert that exactly one `<script id="trustedserver-js">` exists in the HTML.
+///
+/// This is a stricter variant of [`assert_script_tag_present`] that verifies
+/// uniqueness: the trusted-server must inject exactly one script tag with
+/// `id="trustedserver-js"` and a `src` containing `/static/tsjs=`.
+///
+/// # Errors
+///
+/// Returns [`TestError::ScriptTagNotFound`] if zero or more than one matching
+/// script tag is found.
+pub fn assert_unique_script_tag(html: &str) -> TestResult<()> {
+    let document = Html::parse_document(html);
+    let selector = parse_selector("script#trustedserver-js[src*='/static/tsjs=']")?;
+
+    let count = document.select(&selector).count();
+
+    if count == 0 {
+        return Err(Report::new(TestError::ScriptTagNotFound)
+            .attach("No script#trustedserver-js[src*='/static/tsjs='] found"));
+    }
+
+    if count > 1 {
+        return Err(Report::new(TestError::ScriptTagNotFound).attach(format!(
+            "Expected exactly 1 script#trustedserver-js, found {count}"
+        )));
+    }
+
+    Ok(())
+}
+
+/// Assert that origin host URLs in `href`/`src` attributes have been rewritten.
+///
+/// Checks that the proxied HTML no longer contains the origin host in `href`
+/// or `src` attributes, and that at least one attribute now contains the proxy
+/// host. This verifies the HTML processor's URL rewriting behavior.
+///
+/// # Errors
+///
+/// Returns [`TestError::AttributeNotRewritten`] if origin URLs remain or if
+/// no proxy URLs are found.
+pub fn assert_attributes_rewritten(
+    html: &str,
+    origin_host: &str,
+    proxy_base_url: &str,
+) -> TestResult<()> {
+    let document = Html::parse_document(html);
+
+    // Extract proxy host from base_url (e.g. "http://127.0.0.1:12345" -> "127.0.0.1:12345")
+    let proxy_host = proxy_base_url
+        .strip_prefix("http://")
+        .or_else(|| proxy_base_url.strip_prefix("https://"))
+        .unwrap_or(proxy_base_url);
+
+    // Check all elements with href or src attributes
+    let all_selector = parse_selector("[href], [src]")?;
+    let mut found_proxy_url = false;
+
+    for element in document.select(&all_selector) {
+        for attr in ["href", "src"] {
+            if let Some(value) = element.value().attr(attr) {
+                // Origin host should NOT appear in any attribute
+                if value.contains(origin_host) {
+                    return Err(Report::new(TestError::AttributeNotRewritten)
+                        .attach(format!("Origin host still present in {attr}=\"{value}\"")));
+                }
+
+                // Track whether we find at least one rewritten proxy URL
+                if value.contains(proxy_host) {
+                    found_proxy_url = true;
+                }
+            }
+        }
+    }
+
+    if !found_proxy_url {
+        return Err(
+            Report::new(TestError::AttributeNotRewritten).attach(format!(
+                "No attributes rewritten to proxy host ({proxy_host}). \
+                 Check that the origin HTML contains absolute URLs with {origin_host}"
+            )),
+        );
+    }
+
+    Ok(())
+}
+
+/// Assert that URL attributes inside ad-slot elements are rewritten.
+///
+/// Specifically checks that `href`/`src` attributes on elements *within*
+/// `[data-ad-unit]` containers have been rewritten from origin to proxy host.
+/// This catches regressions limited to ad markup that a page-wide scan might miss.
+///
+/// # Errors
+///
+/// Returns [`TestError::AttributeNotRewritten`] if origin URLs remain inside
+/// ad slots or if no rewritten proxy URLs are found inside ad slots.
+pub fn assert_ad_slot_urls_rewritten(
+    html: &str,
+    origin_host: &str,
+    proxy_base_url: &str,
+) -> TestResult<()> {
+    let document = Html::parse_document(html);
+
+    let proxy_host = proxy_base_url
+        .strip_prefix("http://")
+        .or_else(|| proxy_base_url.strip_prefix("https://"))
+        .unwrap_or(proxy_base_url);
+
+    // Select elements with href/src that are descendants of [data-ad-unit]
+    let ad_link_selector = parse_selector("[data-ad-unit] [href], [data-ad-unit] [src]")?;
+    let mut found_proxy_url = false;
+
+    for element in document.select(&ad_link_selector) {
+        for attr in ["href", "src"] {
+            if let Some(value) = element.value().attr(attr) {
+                if value.contains(origin_host) {
+                    return Err(
+                        Report::new(TestError::AttributeNotRewritten).attach(format!(
+                            "Origin host still present inside ad slot: {attr}=\"{value}\""
+                        )),
+                    );
+                }
+                if value.contains(proxy_host) {
+                    found_proxy_url = true;
+                }
+            }
+        }
+    }
+
+    if !found_proxy_url {
+        return Err(
+            Report::new(TestError::AttributeNotRewritten).attach(format!(
+                "No URL attributes inside ad slots rewritten to proxy host ({proxy_host}). \
+                 Ensure ad-slot fixtures contain href/src with origin host"
+            )),
+        );
+    }
+
+    Ok(())
+}
+
+/// Assert that `data-ad-unit` attribute values are preserved unchanged.
+///
+/// The trusted-server rewrites URL-bearing attributes (`href`, `src`) but must
+/// NOT modify non-URL attributes like `data-ad-unit`. This assertion verifies
+/// that ad-slot markup passes through the proxy intact.
+///
+/// # Arguments
+///
+/// * `html` - The proxied HTML response body.
+/// * `expected_units` - The `data-ad-unit` values that must be present unchanged.
+///
+/// # Errors
+///
+/// Returns [`TestError::AttributeNotRewritten`] if any expected `data-ad-unit`
+/// value is missing from the proxied HTML.
+pub fn assert_data_ad_units_preserved(html: &str, expected_units: &[&str]) -> TestResult<()> {
+    let document = Html::parse_document(html);
+    let selector = parse_selector("[data-ad-unit]")?;
+
+    let found_units: Vec<String> = document
+        .select(&selector)
+        .filter_map(|el| el.value().attr("data-ad-unit").map(String::from))
+        .collect();
+
+    for expected in expected_units {
+        if !found_units.iter().any(|u| u == expected) {
+            return Err(
+                Report::new(TestError::AttributeNotRewritten).attach(format!(
+                    "data-ad-unit=\"{expected}\" not found in proxied HTML. \
+                     Found units: {found_units:?}"
+                )),
+            );
+        }
+    }
+
+    Ok(())
+}
+
+/// Assert that a form's `action` attribute has been rewritten from origin to proxy.
+///
+/// Finds a `<form>` matching the given CSS selector and verifies its `action`
+/// attribute no longer contains the origin host and instead points to the proxy.
+///
+/// # Errors
+///
+/// Returns [`TestError::AttributeNotRewritten`] if the form is not found, has
+/// no `action`, or the `action` still contains the origin host.
+pub fn assert_form_action_rewritten(
+    html: &str,
+    form_selector: &str,
+    origin_host: &str,
+    proxy_base_url: &str,
+) -> TestResult<()> {
+    let document = Html::parse_document(html);
+    let selector = parse_selector(form_selector)?;
+
+    let proxy_host = proxy_base_url
+        .strip_prefix("http://")
+        .or_else(|| proxy_base_url.strip_prefix("https://"))
+        .unwrap_or(proxy_base_url);
+
+    let form = document.select(&selector).next().ok_or_else(|| {
+        Report::new(TestError::AttributeNotRewritten)
+            .attach(format!("No form matching '{form_selector}' found in HTML"))
+    })?;
+
+    let action = form.value().attr("action").ok_or_else(|| {
+        Report::new(TestError::AttributeNotRewritten)
+            .attach(format!("Form '{form_selector}' has no action attribute"))
+    })?;
+
+    if action.contains(origin_host) {
+        return Err(
+            Report::new(TestError::AttributeNotRewritten).attach(format!(
+                "Form action still contains origin host: action=\"{action}\""
+            )),
+        );
+    }
+
+    if !action.contains(proxy_host) {
+        return Err(
+            Report::new(TestError::AttributeNotRewritten).attach(format!(
+                "Form action not rewritten to proxy host ({proxy_host}): action=\"{action}\""
+            )),
+        );
+    }
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn script_tag_present_with_unified_url() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <head>
+                <script src="/static/tsjs=tsjs-unified.min.js?v=abc123" id="trustedserver-js"></script>
+            </head>
+            <body></body>
+            </html>
+        "#;
+
+        assert_script_tag_present(html).expect("should find trustedserver-js script tag");
+    }
+
+    #[test]
+    fn script_tag_present_fails_when_no_script() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html><head></head><body></body></html>
+        "#;
+
+        let result = assert_script_tag_present(html);
+        assert!(result.is_err(), "should fail when no script tag exists");
+    }
+
+    #[test]
+    fn attributes_rewritten_detects_proxy_host() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <head></head>
+            <body>
+                <a id="origin-link" href="http://127.0.0.1:9999/page">Link</a>
+                <img id="origin-img" src="http://127.0.0.1:9999/images/test.png">
+            </body>
+            </html>
+        "#;
+
+        assert_attributes_rewritten(html, "127.0.0.1:8888", "http://127.0.0.1:9999")
+            .expect("should detect rewritten proxy URLs");
+    }
+
+    #[test]
+    fn attributes_rewritten_fails_when_origin_remains() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <head></head>
+            <body>
+                <a href="http://127.0.0.1:8888/page">Link</a>
+            </body>
+            </html>
+        "#;
+
+        let result = assert_attributes_rewritten(html, "127.0.0.1:8888", "http://127.0.0.1:9999");
+        assert!(
+            result.is_err(),
+            "should fail when origin host is still in attributes"
+        );
+    }
+
+    #[test]
+    fn attributes_rewritten_fails_when_no_proxy_urls() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <head></head>
+            <body>
+                <a href="/relative/path">Link</a>
+            </body>
+            </html>
+        "#;
+
+        let result = assert_attributes_rewritten(html, "127.0.0.1:8888", "http://127.0.0.1:9999");
+        assert!(
+            result.is_err(),
+            "should fail when no attributes contain proxy host"
+        );
+    }
+
+    #[test]
+    fn ad_slot_urls_rewritten_passes() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <body>
+                <div data-ad-unit="/test/banner">
+                    <a href="http://127.0.0.1:9999/ad/banner-landing">Banner</a>
+                    <img src="http://127.0.0.1:9999/ad/banner.png">
+                </div>
+            </body>
+            </html>
+        "#;
+
+        assert_ad_slot_urls_rewritten(html, "127.0.0.1:8888", "http://127.0.0.1:9999")
+            .expect("should detect rewritten URLs inside ad slots");
+    }
+
+    #[test]
+    fn ad_slot_urls_rewritten_fails_when_origin_remains() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <body>
+                <div data-ad-unit="/test/banner">
+                    <a href="http://127.0.0.1:8888/ad/banner-landing">Banner</a>
+                </div>
+            </body>
+            </html>
+        "#;
+
+        let result = assert_ad_slot_urls_rewritten(html, "127.0.0.1:8888", "http://127.0.0.1:9999");
+        assert!(
+            result.is_err(),
+            "should fail when origin host remains inside ad slot"
+        );
+    }
+
+    #[test]
+    fn ad_slot_urls_rewritten_fails_when_no_urls_in_slots() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <body>
+                <div data-ad-unit="/test/banner">
+                    <p>No links here</p>
+                </div>
+            </body>
+            </html>
+        "#;
+
+        let result = assert_ad_slot_urls_rewritten(html, "127.0.0.1:8888", "http://127.0.0.1:9999");
+        assert!(
+            result.is_err(),
+            "should fail when no URL attributes exist inside ad slots"
+        );
+    }
+
+    #[test]
+    fn unique_script_tag_passes_with_exactly_one() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <head>
+                <script src="/static/tsjs=tsjs-unified.min.js?v=abc123" id="trustedserver-js"></script>
+            </head>
+            <body></body>
+            </html>
+        "#;
+
+        assert_unique_script_tag(html).expect("should find exactly one trustedserver-js");
+    }
+
+    #[test]
+    fn unique_script_tag_fails_when_missing() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html><head></head><body></body></html>
+        "#;
+
+        let result = assert_unique_script_tag(html);
+        assert!(
+            result.is_err(),
+            "should fail when no trustedserver-js exists"
+        );
+    }
+
+    #[test]
+    fn unique_script_tag_fails_when_duplicated() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <head>
+                <script src="/static/tsjs=tsjs-unified.min.js?v=abc" id="trustedserver-js"></script>
+                <script src="/static/tsjs=tsjs-unified.min.js?v=abc" id="trustedserver-js"></script>
+            </head>
+            <body></body>
+            </html>
+        "#;
+
+        let result = assert_unique_script_tag(html);
+        assert!(
+            result.is_err(),
+            "should fail when multiple trustedserver-js exist"
+        );
+    }
+
+    #[test]
+    fn unique_script_tag_fails_when_no_id() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <head>
+                <script src="/static/tsjs=tsjs-unified.min.js?v=abc"></script>
+            </head>
+            <body></body>
+            </html>
+        "#;
+
+        let result = assert_unique_script_tag(html);
+        assert!(result.is_err(), "should fail when script has no id");
+    }
+
+    #[test]
+    fn data_ad_units_preserved_passes() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <body>
+                <div data-ad-unit="/test/banner">Ad</div>
+                <div data-ad-unit="/test/sidebar">Ad</div>
+            </body>
+            </html>
+        "#;
+
+        assert_data_ad_units_preserved(html, &["/test/banner", "/test/sidebar"])
+            .expect("should find both ad units");
+    }
+
+    #[test]
+    fn data_ad_units_preserved_fails_when_missing() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <body>
+                <div data-ad-unit="/test/banner">Ad</div>
+            </body>
+            </html>
+        "#;
+
+        let result = assert_data_ad_units_preserved(html, &["/test/banner", "/test/sidebar"]);
+        assert!(
+            result.is_err(),
+            "should fail when expected ad unit is missing"
+        );
+    }
+
+    #[test]
+    fn form_action_rewritten_passes() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <body>
+                <form id="contact-form" action="http://127.0.0.1:9999/api/contact" method="POST">
+                    <input name="name" />
+                </form>
+            </body>
+            </html>
+        "#;
+
+        assert_form_action_rewritten(
+            html,
+            "form#contact-form",
+            "127.0.0.1:8888",
+            "http://127.0.0.1:9999",
+        )
+        .expect("should detect rewritten form action");
+    }
+
+    #[test]
+    fn form_action_rewritten_fails_when_origin_remains() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <body>
+                <form id="contact-form" action="http://127.0.0.1:8888/api/contact" method="POST">
+                    <input name="name" />
+                </form>
+            </body>
+            </html>
+        "#;
+
+        let result = assert_form_action_rewritten(
+            html,
+            "form#contact-form",
+            "127.0.0.1:8888",
+            "http://127.0.0.1:9999",
+        );
+        assert!(
+            result.is_err(),
+            "should fail when origin host remains in form action"
+        );
+    }
+
+    #[test]
+    fn form_action_rewritten_fails_when_no_form() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html><body><p>No form here</p></body></html>
+        "#;
+
+        let result = assert_form_action_rewritten(
+            html,
+            "form#contact-form",
+            "127.0.0.1:8888",
+            "http://127.0.0.1:9999",
+        );
+        assert!(result.is_err(), "should fail when form is not found");
+    }
+
+    #[test]
+    fn script_tag_present_fails_when_wrong_script() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <head>
+                <script src="/some/other/script.js"></script>
+            </head>
+            <body></body>
+            </html>
+        "#;
+
+        let result = assert_script_tag_present(html);
+        assert!(result.is_err(), "should fail when script tag is not tsjs");
+    }
+}
diff --git a/crates/integration-tests/tests/common/mod.rs b/crates/integration-tests/tests/common/mod.rs
new file mode 100644
index 00000000..61fb404e
--- /dev/null
+++ b/crates/integration-tests/tests/common/mod.rs
@@ -0,0 +1,2 @@
+pub mod assertions;
+pub mod runtime;
diff --git a/crates/integration-tests/tests/common/runtime.rs b/crates/integration-tests/tests/common/runtime.rs
new file mode 100644
index 00000000..c7ae0e22
--- /dev/null
+++ b/crates/integration-tests/tests/common/runtime.rs
@@ -0,0 +1,118 @@
+use error_stack::Report;
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+
+/// Test error types (platform-agnostic)
+#[derive(Debug, derive_more::Display)]
+pub enum TestError {
+    // Runtime environment errors
+    #[display("Failed to spawn runtime process")]
+    RuntimeSpawn,
+
+    #[display("Runtime not ready after timeout")]
+    RuntimeNotReady,
+
+    #[display("Failed to kill runtime process")]
+    RuntimeKill,
+
+    #[display("Failed to wait for runtime process")]
+    RuntimeWait,
+
+    // Container errors
+    #[display("Container failed to start: {reason}")]
+    ContainerStart { reason: String },
+
+    #[display("Container operation timed out")]
+    ContainerTimeout,
+
+    // HTTP errors
+    #[display("HTTP request failed")]
+    HttpRequest,
+
+    #[display("Failed to parse response")]
+    ResponseParse,
+
+    // Assertion errors
+    #[display("Script tag not found in HTML")]
+    ScriptTagNotFound,
+
+    #[display("Response body did not match expected content")]
+    UnexpectedContent,
+
+    #[display("Invalid CSS selector")]
+    InvalidSelector,
+
+    #[display("Origin URL not rewritten in HTML attributes")]
+    AttributeNotRewritten,
+
+    // Resource errors
+    #[display("No available port found")]
+    NoPortAvailable,
+}
+
+impl core::error::Error for TestError {}
+
+/// Result type used across integration tests.
+pub type TestResult<T> = core::result::Result<T, Report<TestError>>;
+
+/// Platform-agnostic process handle
+pub struct RuntimeProcess {
+    pub inner: Box<dyn RuntimeProcessHandle>,
+    pub base_url: String,
+}
+
+/// Trait for runtime process lifecycle management
+pub trait RuntimeProcessHandle: Send + Sync {
+    fn kill(&mut self) -> TestResult<()>;
+    fn wait(&mut self) -> TestResult<()>;
+}
+
+/// Trait defining how to run the trusted-server on different platforms.
+///
+/// The application configuration (origin URL, integrations, etc.) is baked
+/// into the WASM binary at build time via `build.rs`. The runtime environment
+/// only needs the WASM binary path and its own platform-specific config
+/// (e.g. Viceroy's `fastly.toml` for KV stores and secret stores).
+pub trait RuntimeEnvironment: Send + Sync {
+    /// Platform identifier (e.g., "fastly", "cloudflare")
+    fn id(&self) -> &'static str;
+
+    /// Spawn runtime with the given WASM binary.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TestError::RuntimeSpawn`] if the process cannot be started.
+    /// Returns [`TestError::RuntimeNotReady`] if the health check times out.
+    fn spawn(&self, wasm_path: &Path) -> TestResult<RuntimeProcess>;
+
+    /// Health check endpoint (may differ by platform)
+    fn health_check_path(&self) -> &str {
+        "/health"
+    }
+
+    /// Platform-specific environment variables
+    fn env_vars(&self) -> HashMap<String, String> {
+        HashMap::new()
+    }
+}
+
+/// Get path to WASM binary, respecting environment variable.
+pub fn wasm_binary_path() -> PathBuf {
+    std::env::var("WASM_BINARY_PATH")
+        .map(PathBuf::from)
+        .unwrap_or_else(|_| {
+            PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+                .join("../../target/wasm32-wasip1/release/trusted-server-fastly.wasm")
+        })
+}
+
+/// Get the fixed origin port used for Docker container port mapping.
+///
+/// This must match the port baked into the WASM binary via
+/// `TRUSTED_SERVER__PUBLISHER__ORIGIN_URL` at build time.
+pub fn origin_port() -> u16 {
+    std::env::var("INTEGRATION_ORIGIN_PORT")
+        .ok()
+        .and_then(|s| s.parse().ok())
+        .unwrap_or(8888)
+}
diff --git a/crates/integration-tests/tests/environments/fastly.rs b/crates/integration-tests/tests/environments/fastly.rs
new file mode 100644
index 00000000..5f055201
--- /dev/null
+++ b/crates/integration-tests/tests/environments/fastly.rs
@@ -0,0 +1,95 @@
+use crate::common::runtime::{
+    RuntimeEnvironment, RuntimeProcess, RuntimeProcessHandle, TestError, TestResult,
+};
+use error_stack::ResultExt as _;
+use std::path::Path;
+use std::process::{Child, Command};
+
+/// Fastly Compute runtime using Viceroy local simulator.
+///
+/// Spawns a `viceroy` child process with the WASM binary and the
+/// Viceroy-specific `fastly.toml` config (KV stores, secrets).
+/// The application config (origin URL, integrations) is baked into
+/// the WASM binary at build time.
+pub struct FastlyViceroy;
+
+impl RuntimeEnvironment for FastlyViceroy {
+    fn id(&self) -> &'static str {
+        "fastly"
+    }
+
+    fn spawn(&self, wasm_path: &Path) -> TestResult<RuntimeProcess> {
+        let port = super::find_available_port()?;
+
+        let viceroy_config = self.viceroy_config_path();
+
+        let child = Command::new("viceroy")
+            .arg(wasm_path)
+            .arg("-C")
+            .arg(&viceroy_config)
+            .arg("--addr")
+            .arg(format!("127.0.0.1:{port}"))
+            .spawn()
+            .change_context(TestError::RuntimeSpawn)
+            .attach("Failed to spawn viceroy process")?;
+
+        // Wrap immediately so Drop::drop kills the process if readiness check fails
+        let handle = ViceroyHandle { child };
+        let base_url = format!("http://127.0.0.1:{port}");
+
+        super::wait_for_ready(&base_url, self.health_check_path())?;
+
+        Ok(RuntimeProcess {
+            inner: Box::new(handle),
+            base_url,
+        })
+    }
+
+    fn health_check_path(&self) -> &str {
+        "/__trusted-server/health"
+    }
+}
+
+impl FastlyViceroy {
+    /// Path to the Viceroy-specific `fastly.toml` template.
+    ///
+    /// This contains `[local_server]` configuration (backends, KV stores,
+    /// secret stores) that Viceroy needs, separate from the application config.
+    fn viceroy_config_path(&self) -> std::path::PathBuf {
+        std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .join("fixtures/configs/viceroy-template.toml")
+    }
+}
+
+/// Process handle for a running Viceroy instance.
+///
+/// Implements [`Drop`] to ensure the process is killed on test cleanup,
+/// preventing orphaned Viceroy processes.
+struct ViceroyHandle {
+    child: Child,
+}
+
+impl RuntimeProcessHandle for ViceroyHandle {
+    fn kill(&mut self) -> TestResult<()> {
+        self.child
+            .kill()
+            .change_context(TestError::RuntimeKill)
+            .attach("Failed to kill viceroy process")?;
+        Ok(())
+    }
+
+    fn wait(&mut self) -> TestResult<()> {
+        self.child
+            .wait()
+            .change_context(TestError::RuntimeWait)
+            .attach("Failed to wait on viceroy process")?;
+        Ok(())
+    }
+}
+
+impl Drop for ViceroyHandle {
+    fn drop(&mut self) {
+        let _ = self.child.kill();
+        let _ = self.child.wait();
+    }
+}
diff --git a/crates/integration-tests/tests/environments/mod.rs b/crates/integration-tests/tests/environments/mod.rs
new file mode 100644
index 00000000..8eeb98a9
--- /dev/null
+++ b/crates/integration-tests/tests/environments/mod.rs
@@ -0,0 +1,71 @@
+pub mod fastly;
+
+use crate::common::runtime::{RuntimeEnvironment, TestError, TestResult};
+use error_stack::Report;
+
+/// Runtime factory function type — avoids trait object static initialization issues.
+type RuntimeFactory = fn() -> Box<dyn RuntimeEnvironment>;
+
+/// Registry of all supported runtime environments.
+///
+/// Uses function pointers instead of `&[&dyn RuntimeEnvironment]` because trait
+/// objects cannot be constructed in `const` context for types with non-trivial
+/// constructors.
+///
+/// # Adding a new runtime
+///
+/// 1. Create `tests/environments/<platform>.rs`
+/// 2. Implement [`RuntimeEnvironment`] trait
+/// 3. Add factory closure here
+pub static RUNTIME_ENVIRONMENTS: &[RuntimeFactory] = &[|| Box::new(fastly::FastlyViceroy)];
+
+/// Find an available TCP port for the runtime to bind to.
+///
+/// Binds to port 0, which asks the OS to assign a random available port,
+/// then immediately closes the listener and returns the assigned port.
+///
+/// # Errors
+///
+/// Returns [`TestError::NoPortAvailable`] if no port can be allocated.
+pub fn find_available_port() -> TestResult<u16> {
+    let listener = std::net::TcpListener::bind("127.0.0.1:0")
+        .map_err(|_| Report::new(TestError::NoPortAvailable))?;
+
+    let port = listener
+        .local_addr()
+        .map_err(|_| Report::new(TestError::NoPortAvailable))?
+        .port();
+
+    Ok(port)
+}
+
+/// Poll a runtime's health endpoint until it responds with success.
+///
+/// Retries up to 30 times with 500ms delay between attempts (total ~15s).
+/// Falls back to checking the root path if the health endpoint is not available.
+///
+/// # Errors
+///
+/// Returns [`TestError::RuntimeNotReady`] if the runtime does not respond within timeout.
+pub fn wait_for_ready(base_url: &str, health_path: &str) -> TestResult<()> {
+    let health_url = format!("{}{}", base_url, health_path);
+
+    for _ in 0..30 {
+        if let Ok(resp) = reqwest::blocking::get(&health_url)
+            && resp.status().is_success()
+        {
+            return Ok(());
+        }
+
+        // Fallback: try root path — a 404 means the server is responsive
+        if let Ok(resp) = reqwest::blocking::get(base_url)
+            && (resp.status().is_success() || resp.status().as_u16() == 404)
+        {
+            return Ok(());
+        }
+
+        std::thread::sleep(std::time::Duration::from_millis(500));
+    }
+
+    Err(Report::new(TestError::RuntimeNotReady))
+}
diff --git a/crates/integration-tests/tests/frameworks/mod.rs b/crates/integration-tests/tests/frameworks/mod.rs
new file mode 100644
index 00000000..0d8d86ae
--- /dev/null
+++ b/crates/integration-tests/tests/frameworks/mod.rs
@@ -0,0 +1,68 @@
+pub mod nextjs;
+pub mod scenarios;
+pub mod wordpress;
+
+use crate::common::runtime::TestResult;
+use scenarios::{CustomScenario, TestScenario};
+use testcontainers::GenericImage;
+use testcontainers::core::ContainerRequest;
+
+/// Trait defining how to test a frontend framework.
+///
+/// Each framework provides a Docker container image and declares which
+/// test scenarios apply to it. The matrix test runner uses this trait
+/// to test every framework against every runtime environment.
+///
+/// # Adding a new framework
+///
+/// 1. Create `fixtures/frameworks/<name>/` with a Dockerfile
+/// 2. Create `tests/frameworks/<name>.rs` implementing this trait
+/// 3. Register in [`FRAMEWORKS`] below
+pub trait FrontendFramework: Send + Sync {
+    /// Framework identifier (e.g. "wordpress", "nextjs").
+    fn id(&self) -> &'static str;
+
+    /// Build a Docker container request mapped to the given origin port.
+    ///
+    /// The `origin_port` is the fixed host port that the WASM binary
+    /// expects the origin to be running on (baked in at build time).
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TestError::ContainerStart`] if the image cannot be created.
+    fn build_container(&self, origin_port: u16) -> TestResult<ContainerRequest<GenericImage>>;
+
+    /// Port the framework serves on inside the container.
+    fn container_port(&self) -> u16;
+
+    /// HTTP path to use for container health checks.
+    fn health_check_path(&self) -> &str {
+        "/"
+    }
+
+    /// Standard test scenarios applicable to this framework.
+    fn standard_scenarios(&self) -> Vec<TestScenario>;
+
+    /// Framework-specific test scenarios (optional).
+    fn custom_scenarios(&self) -> Vec<CustomScenario> {
+        vec![]
+    }
+}
+
+/// Framework factory function type.
+type FrameworkFactory = fn() -> Box<dyn FrontendFramework>;
+
+/// Registry of all supported frontend frameworks.
+///
+/// Uses function pointers to avoid trait object static initialization issues.
+///
+/// # Adding a new framework
+///
+/// 1. Create `fixtures/frameworks/<name>/`
+/// 2. Create `tests/frameworks/<name>.rs`
+/// 3. Implement [`FrontendFramework`] trait
+/// 4. Add factory here: `|| Box::new(<name>::<Struct>)`
+pub static FRAMEWORKS: &[FrameworkFactory] = &[
+    || Box::new(wordpress::WordPress),
+    || Box::new(nextjs::NextJs),
+];
diff --git a/crates/integration-tests/tests/frameworks/nextjs.rs b/crates/integration-tests/tests/frameworks/nextjs.rs
new file mode 100644
index 00000000..09038e30
--- /dev/null
+++ b/crates/integration-tests/tests/frameworks/nextjs.rs
@@ -0,0 +1,57 @@
+use super::FrontendFramework;
+use super::scenarios::{CustomScenario, TestScenario};
+use crate::common::runtime::TestResult;
+use testcontainers::core::{ContainerRequest, IntoContainerPort};
+use testcontainers::{GenericImage, ImageExt as _};
+
+/// Next.js frontend framework for integration testing.
+///
+/// Uses a pre-built Docker image (`test-nextjs:latest`) that serves
+/// a minimal Next.js 14 app. The image must be built before running tests:
+///
+/// ```bash
+/// docker build -t test-nextjs:latest \
+///   crates/integration-tests/fixtures/frameworks/nextjs/
+/// ```
+pub struct NextJs;
+
+impl FrontendFramework for NextJs {
+    fn id(&self) -> &'static str {
+        "nextjs"
+    }
+
+    fn build_container(&self, origin_port: u16) -> TestResult<ContainerRequest<GenericImage>> {
+        let container_port = self.container_port();
+        let origin_host = format!("127.0.0.1:{origin_port}");
+        Ok(GenericImage::new("test-nextjs", "latest")
+            .with_exposed_port(container_port.tcp())
+            .with_mapped_port(origin_port, container_port.tcp())
+            .with_env_var("ORIGIN_HOST", origin_host))
+    }
+
+    fn container_port(&self) -> u16 {
+        3000
+    }
+
+    fn health_check_path(&self) -> &str {
+        "/"
+    }
+
+    fn standard_scenarios(&self) -> Vec<TestScenario> {
+        vec![
+            TestScenario::HtmlInjection,
+            TestScenario::ScriptServing,
+            TestScenario::AttributeRewriting,
+            TestScenario::ScriptServingUnknownFile404,
+        ]
+    }
+
+    fn custom_scenarios(&self) -> Vec<CustomScenario> {
+        vec![
+            CustomScenario::NextJsRscFlight,
+            CustomScenario::NextJsServerActions,
+            CustomScenario::NextJsApiRoute,
+            CustomScenario::NextJsFormAction,
+        ]
+    }
+}
diff --git a/crates/integration-tests/tests/frameworks/scenarios.rs b/crates/integration-tests/tests/frameworks/scenarios.rs
new file mode 100644
index 00000000..2a171b60
--- /dev/null
+++ b/crates/integration-tests/tests/frameworks/scenarios.rs
@@ -0,0 +1,419 @@
+use crate::common::assertions;
+use crate::common::runtime::{TestError, TestResult, origin_port};
+use error_stack::Report;
+use error_stack::ResultExt as _;
+
+/// Standard test scenarios applicable to all frontend frameworks.
+///
+/// Each scenario tests a core trusted-server behavior that should work
+/// regardless of the underlying framework serving HTML.
+#[derive(Debug, Clone)]
+pub enum TestScenario {
+    /// Verify `<script>` tag is injected into the HTML response.
+    HtmlInjection,
+
+    /// Verify `/static/tsjs=tsjs-unified.min.js` endpoint serves the JS bundle.
+    ScriptServing,
+
+    /// Verify origin host URLs in `href`/`src` attributes are rewritten to the proxy host.
+    AttributeRewriting,
+
+    /// Verify `/static/tsjs=unknown.js` returns 404, not HTML or a fallback.
+    ScriptServingUnknownFile404,
+}
+
+/// Framework-specific custom scenarios that test framework-unique behaviors.
+#[derive(Debug, Clone)]
+pub enum CustomScenario {
+    /// Next.js: React Server Components Flight format is preserved.
+    NextJsRscFlight,
+
+    /// Next.js: Server Actions POST requests pass through correctly.
+    NextJsServerActions,
+
+    /// Next.js: API routes return JSON without HTML injection.
+    NextJsApiRoute,
+
+    /// Next.js: Form action URLs are rewritten from origin to proxy.
+    NextJsFormAction,
+
+    /// WordPress: Admin pages (`/wp-admin/`) receive script injection.
+    ///
+    /// The trusted server currently injects into ALL HTML responses
+    /// regardless of path. This test documents that behavior and guards
+    /// against unintended changes.
+    WordPressAdminInjection,
+}
+
+impl TestScenario {
+    /// Execute this scenario against a running runtime.
+    ///
+    /// # Arguments
+    ///
+    /// * `base_url` - The base URL of the running runtime (e.g. `http://127.0.0.1:12345`)
+    /// * `framework_id` - Identifier for the framework (used in error context)
+    ///
+    /// # Errors
+    ///
+    /// Returns a [`TestError`] variant depending on which assertion fails.
+    pub fn run(&self, base_url: &str, framework_id: &str) -> TestResult<()> {
+        match self {
+            Self::HtmlInjection => {
+                let resp = reqwest::blocking::get(base_url)
+                    .change_context(TestError::HttpRequest)
+                    .attach(format!(
+                        "scenario: HtmlInjection, framework: {framework_id}"
+                    ))?;
+
+                let html = resp
+                    .text()
+                    .change_context(TestError::ResponseParse)
+                    .attach(format!("framework: {framework_id}"))?;
+
+                assertions::assert_unique_script_tag(&html)
+                    .attach(format!("framework: {framework_id}"))?;
+
+                Ok(())
+            }
+
+            Self::AttributeRewriting => {
+                // Verify that absolute origin URLs in href/src attributes are
+                // rewritten to the proxy host. The test fixtures embed links
+                // like `http://127.0.0.1:8888/page` which the HTML processor
+                // should rewrite to `http://127.0.0.1:{proxy_port}/page`.
+                let resp = reqwest::blocking::get(base_url)
+                    .change_context(TestError::HttpRequest)
+                    .attach(format!(
+                        "scenario: AttributeRewriting, framework: {framework_id}"
+                    ))?;
+
+                let html = resp
+                    .text()
+                    .change_context(TestError::ResponseParse)
+                    .attach(format!("framework: {framework_id}"))?;
+
+                let origin_host = format!("127.0.0.1:{}", origin_port());
+
+                assertions::assert_attributes_rewritten(&html, &origin_host, base_url)
+                    .attach(format!("framework: {framework_id}"))?;
+
+                // Verify URL attributes inside ad-slot elements are also rewritten
+                assertions::assert_ad_slot_urls_rewritten(&html, &origin_host, base_url)
+                    .attach(format!("framework: {framework_id}"))?;
+
+                // Verify non-URL attributes like data-ad-unit are preserved unchanged
+                assertions::assert_data_ad_units_preserved(
+                    &html,
+                    &["/test/banner", "/test/sidebar"],
+                )
+                .attach(format!("framework: {framework_id}"))?;
+
+                Ok(())
+            }
+
+            Self::ScriptServing => {
+                let url = format!("{base_url}/static/tsjs=tsjs-unified.min.js");
+
+                let resp = reqwest::blocking::get(&url)
+                    .change_context(TestError::HttpRequest)
+                    .attach(format!(
+                        "scenario: ScriptServing, framework: {framework_id}"
+                    ))?;
+
+                if !resp.status().is_success() {
+                    return Err(Report::new(TestError::HttpRequest).attach(format!(
+                        "Script serving returned {}, expected 2xx",
+                        resp.status()
+                    )));
+                }
+
+                // Verify content type is JavaScript
+                let content_type = resp
+                    .headers()
+                    .get("content-type")
+                    .and_then(|v| v.to_str().ok())
+                    .unwrap_or("")
+                    .to_string();
+
+                let body = resp
+                    .text()
+                    .change_context(TestError::ResponseParse)
+                    .attach(format!("framework: {framework_id}"))?;
+
+                if !content_type.contains("javascript") {
+                    return Err(Report::new(TestError::ResponseParse).attach(format!(
+                        "Expected JavaScript content-type, got: {content_type}"
+                    )));
+                }
+
+                // Verify body is non-empty and contains expected bundle markers
+                if body.is_empty() {
+                    return Err(
+                        Report::new(TestError::ResponseParse).attach("Script bundle body is empty")
+                    );
+                }
+
+                // The unified bundle should contain the TSJS core initialization
+                if !body.contains("trustedserver") && !body.contains("tsjs") {
+                    return Err(Report::new(TestError::ResponseParse).attach(
+                        "Script bundle does not contain expected trustedserver/tsjs markers",
+                    ));
+                }
+
+                Ok(())
+            }
+
+            Self::ScriptServingUnknownFile404 => {
+                let url = format!("{base_url}/static/tsjs=unknown.js");
+
+                let resp = reqwest::blocking::get(&url)
+                    .change_context(TestError::HttpRequest)
+                    .attach(format!(
+                        "scenario: ScriptServingUnknownFile404, framework: {framework_id}"
+                    ))?;
+
+                let status = resp.status().as_u16();
+
+                if status != 404 {
+                    return Err(Report::new(TestError::HttpRequest)
+                        .attach(format!("Expected 404 for unknown tsjs file, got {status}")));
+                }
+
+                // Response should not be HTML (which would indicate a fallback to origin)
+                let content_type = resp
+                    .headers()
+                    .get("content-type")
+                    .and_then(|v| v.to_str().ok())
+                    .unwrap_or("");
+
+                if content_type.contains("text/html") {
+                    return Err(Report::new(TestError::ResponseParse)
+                        .attach("Unknown tsjs file returned HTML instead of a proper 404"));
+                }
+
+                Ok(())
+            }
+        }
+    }
+}
+
+impl CustomScenario {
+    /// Execute this custom scenario against a running runtime.
+    ///
+    /// # Errors
+    ///
+    /// Returns a [`TestError`] variant depending on which assertion fails.
+    pub fn run(&self, base_url: &str, framework_id: &str) -> TestResult<()> {
+        match self {
+            Self::NextJsRscFlight => {
+                // Verify RSC Flight format responses are not corrupted.
+                // When the proxy mishandles the RSC header, it returns text/html
+                // instead of the expected Flight payload — so we fail on HTML.
+                let client = reqwest::blocking::Client::new();
+                let resp = client
+                    .get(base_url)
+                    .header("RSC", "1")
+                    .header("Next-Router-State-Tree", "%5B%22%22%5D")
+                    .send()
+                    .change_context(TestError::HttpRequest)
+                    .attach(format!(
+                        "scenario: NextJsRscFlight, framework: {framework_id}"
+                    ))?;
+
+                let content_type = resp
+                    .headers()
+                    .get("content-type")
+                    .and_then(|v| v.to_str().ok())
+                    .unwrap_or("")
+                    .to_string();
+
+                let body = resp.text().change_context(TestError::ResponseParse)?;
+
+                // RSC responses must NOT be HTML — that means the proxy
+                // swallowed the RSC header and treated it as a page request
+                if content_type.contains("text/html") {
+                    return Err(Report::new(TestError::ResponseParse).attach(format!(
+                            "RSC request returned text/html instead of Flight payload (content-type: {content_type})"
+                        )));
+                }
+
+                // If the response is a Flight payload, it must not contain injected scripts
+                if body.contains("/static/tsjs=") {
+                    return Err(Report::new(TestError::ScriptTagNotFound)
+                        .attach("Script tag should NOT be injected in RSC Flight responses"));
+                }
+
+                Ok(())
+            }
+
+            Self::NextJsServerActions => {
+                // Verify POST requests pass through the proxy to the origin.
+                // The minimal Next.js app has no real server actions, so
+                // Next.js returns 404 for the unknown action ID. This proves
+                // the proxy forwarded the POST to the origin rather than
+                // rejecting or mishandling it.
+                let client = reqwest::blocking::Client::builder()
+                    .redirect(reqwest::redirect::Policy::none())
+                    .build()
+                    .change_context(TestError::HttpRequest)?;
+
+                let resp = client
+                    .post(base_url)
+                    .header("Next-Action", "test-action-id")
+                    .header("Content-Type", "text/plain;charset=UTF-8")
+                    .body("[]")
+                    .send()
+                    .change_context(TestError::HttpRequest)
+                    .attach(format!(
+                        "scenario: NextJsServerActions, framework: {framework_id}"
+                    ))?;
+
+                let status = resp.status().as_u16();
+                let body = resp.text().unwrap_or_default();
+
+                // Next.js returns 404 for unknown server action IDs.
+                // With App Router client components in the layout, Next.js
+                // may return a "soft 404" (HTTP 200 with a not-found page).
+                // Accept 200, 404, or 405 — all prove the proxy forwarded
+                // the POST to the origin rather than rejecting it.
+                match status {
+                    404 | 405 => {}
+                    200 => {
+                        // Soft 404: verify the body is a Next.js not-found page
+                        if !body.contains("404")
+                            && !body.contains("not found")
+                            && !body.contains("Not Found")
+                        {
+                            return Err(Report::new(TestError::UnexpectedContent).attach(format!(
+                                "Soft-404 body should contain a 404 indicator; \
+                                     framework: {framework_id}, body: {body}"
+                            )));
+                        }
+                    }
+                    _ => {
+                        return Err(
+                            Report::new(TestError::HttpRequest).attach(
+                                format!(
+                                    "Expected 200/404/405 for unknown server action, got {status}; body: {body}"
+                                ),
+                            ),
+                        );
+                    }
+                }
+
+                Ok(())
+            }
+
+            Self::NextJsApiRoute => {
+                // Verify API routes return JSON without HTML injection.
+                // The proxy should pass JSON responses through unchanged.
+                let url = format!("{base_url}/api/hello");
+
+                let resp = reqwest::blocking::get(&url)
+                    .change_context(TestError::HttpRequest)
+                    .attach(format!(
+                        "scenario: NextJsApiRoute, framework: {framework_id}"
+                    ))?;
+
+                let status = resp.status().as_u16();
+                if status != 200 {
+                    return Err(Report::new(TestError::HttpRequest)
+                        .attach(format!("Expected 200 for API route, got {status}")));
+                }
+
+                let content_type = resp
+                    .headers()
+                    .get("content-type")
+                    .and_then(|v| v.to_str().ok())
+                    .unwrap_or("")
+                    .to_string();
+
+                if !content_type.contains("application/json") {
+                    return Err(Report::new(TestError::ResponseParse).attach(format!(
+                        "Expected application/json content-type, got: {content_type}"
+                    )));
+                }
+
+                let body = resp
+                    .text()
+                    .change_context(TestError::ResponseParse)
+                    .attach(format!("framework: {framework_id}"))?;
+
+                // JSON responses must not contain HTML injection
+                if body.contains("<script") || body.contains("/static/tsjs=") {
+                    return Err(Report::new(TestError::ResponseParse).attach(
+                            "API route response contains script injection — JSON should pass through unchanged",
+                        ));
+                }
+
+                // Verify it's valid JSON with expected structure
+                let json: serde_json::Value = serde_json::from_str(&body).map_err(|e| {
+                    Report::new(TestError::ResponseParse)
+                        .attach(format!("API response is not valid JSON: {e}"))
+                })?;
+
+                if json.get("message").is_none() {
+                    return Err(Report::new(TestError::ResponseParse)
+                        .attach("API response missing expected 'message' field"));
+                }
+
+                Ok(())
+            }
+
+            Self::NextJsFormAction => {
+                // Verify form action URLs are rewritten from origin to proxy.
+                let url = format!("{base_url}/contact");
+
+                let resp = reqwest::blocking::get(&url)
+                    .change_context(TestError::HttpRequest)
+                    .attach(format!(
+                        "scenario: NextJsFormAction, framework: {framework_id}"
+                    ))?;
+
+                let html = resp
+                    .text()
+                    .change_context(TestError::ResponseParse)
+                    .attach(format!("framework: {framework_id}"))?;
+
+                let origin_host = format!("127.0.0.1:{}", origin_port());
+
+                assertions::assert_form_action_rewritten(
+                    &html,
+                    "form#contact-form",
+                    &origin_host,
+                    base_url,
+                )
+                .attach(format!("framework: {framework_id}"))?;
+
+                Ok(())
+            }
+
+            Self::WordPressAdminInjection => {
+                // Verify that /wp-admin/ pages also receive script injection.
+                // The trusted server injects into ALL HTML responses regardless
+                // of path. This test documents that behavior — if admin-path
+                // exclusion is added in the future, this test should be updated
+                // to assert NO injection instead.
+                let url = format!("{base_url}/wp-admin/");
+
+                let resp = reqwest::blocking::get(&url)
+                    .change_context(TestError::HttpRequest)
+                    .attach(format!(
+                        "scenario: WordPressAdminInjection, framework: {framework_id}"
+                    ))?;
+
+                let html = resp
+                    .text()
+                    .change_context(TestError::ResponseParse)
+                    .attach(format!("framework: {framework_id}"))?;
+
+                assertions::assert_script_tag_present(&html).attach(format!(
+                    "Admin page should receive injection (current behavior). \
+                         framework: {framework_id}"
+                ))?;
+
+                Ok(())
+            }
+        }
+    }
+}
diff --git a/crates/integration-tests/tests/frameworks/wordpress.rs b/crates/integration-tests/tests/frameworks/wordpress.rs
new file mode 100644
index 00000000..00996ce9
--- /dev/null
+++ b/crates/integration-tests/tests/frameworks/wordpress.rs
@@ -0,0 +1,53 @@
+use super::FrontendFramework;
+use super::scenarios::{CustomScenario, TestScenario};
+use crate::common::runtime::TestResult;
+use testcontainers::core::{ContainerRequest, IntoContainerPort};
+use testcontainers::{GenericImage, ImageExt as _};
+
+/// WordPress frontend framework for integration testing.
+///
+/// Uses a pre-built Docker image (`test-wordpress:latest`) that serves
+/// a minimal WordPress site with a test theme. The image must be built
+/// before running tests:
+///
+/// ```bash
+/// docker build -t test-wordpress:latest \
+///   crates/integration-tests/fixtures/frameworks/wordpress/
+/// ```
+pub struct WordPress;
+
+impl FrontendFramework for WordPress {
+    fn id(&self) -> &'static str {
+        "wordpress"
+    }
+
+    fn build_container(&self, origin_port: u16) -> TestResult<ContainerRequest<GenericImage>> {
+        let container_port = self.container_port();
+        let origin_host = format!("127.0.0.1:{origin_port}");
+        Ok(GenericImage::new("test-wordpress", "latest")
+            .with_exposed_port(container_port.tcp())
+            .with_mapped_port(origin_port, container_port.tcp())
+            .with_env_var("ORIGIN_HOST", origin_host))
+    }
+
+    fn container_port(&self) -> u16 {
+        80
+    }
+
+    fn health_check_path(&self) -> &str {
+        "/"
+    }
+
+    fn standard_scenarios(&self) -> Vec<TestScenario> {
+        vec![
+            TestScenario::HtmlInjection,
+            TestScenario::ScriptServing,
+            TestScenario::AttributeRewriting,
+            TestScenario::ScriptServingUnknownFile404,
+        ]
+    }
+
+    fn custom_scenarios(&self) -> Vec<CustomScenario> {
+        vec![CustomScenario::WordPressAdminInjection]
+    }
+}
diff --git a/crates/integration-tests/tests/integration.rs b/crates/integration-tests/tests/integration.rs
new file mode 100644
index 00000000..168a2ba4
--- /dev/null
+++ b/crates/integration-tests/tests/integration.rs
@@ -0,0 +1,161 @@
+// Many items in common/environments/frameworks are defined for use by
+// Docker-dependent integration tests that only run when Docker is available.
+// The compiler sees them as unused when analysing the test binary alone.
+#![allow(dead_code, unused_imports)]
+
+mod common;
+mod environments;
+mod frameworks;
+
+use common::runtime::{TestError, origin_port, wasm_binary_path};
+use environments::RUNTIME_ENVIRONMENTS;
+use error_stack::{Report, ResultExt as _};
+use frameworks::{FRAMEWORKS, FrontendFramework};
+use std::time::Duration;
+use testcontainers::runners::SyncRunner as _;
+
+/// Initialize the logger once for the test binary.
+///
+/// Called at the start of each test function. `try_init` is used so that
+/// repeated calls (one per test) are harmless — only the first succeeds.
+fn init_logger() {
+    let _ = env_logger::try_init();
+}
+
+/// Test all combinations: frameworks x runtimes (matrix testing).
+///
+/// Iterates every registered runtime and framework, running all standard
+/// and custom scenarios for each combination. Uses `--test-threads=1`
+/// because all containers share the same fixed origin port.
+#[test]
+#[ignore = "requires Docker, Viceroy, and pre-built WASM binary"]
+fn test_all_combinations() {
+    init_logger();
+    for runtime_factory in RUNTIME_ENVIRONMENTS {
+        let runtime = runtime_factory();
+        log::info!("Testing runtime: {}", runtime.id());
+
+        for framework_factory in FRAMEWORKS {
+            let framework = framework_factory();
+            log::info!("  Testing framework: {}", framework.id());
+
+            test_combination(runtime.as_ref(), framework.as_ref())
+                .expect("should pass all scenarios for this combination");
+        }
+    }
+}
+
+/// Test a specific framework x runtime combination.
+///
+/// # Steps
+///
+/// 1. Start the frontend container mapped to the fixed origin port
+/// 2. Spawn the runtime process (e.g. Viceroy) with the pre-built WASM binary
+/// 3. Run standard scenarios (HTML injection, script serving, etc.)
+/// 4. Run framework-specific custom scenarios
+/// 5. Cleanup is automatic via [`Drop`] on both container and runtime
+///
+/// # Errors
+///
+/// Propagates any [`TestError`] from container startup, runtime spawn,
+/// or scenario assertions, with full context chain.
+fn test_combination(
+    runtime: &dyn common::runtime::RuntimeEnvironment,
+    framework: &dyn FrontendFramework,
+) -> common::runtime::TestResult<()> {
+    init_logger();
+    let runtime_id = runtime.id();
+    let framework_id = framework.id();
+    let port = origin_port();
+
+    // 1. Start frontend container mapped to the fixed origin port
+    let container = framework
+        .build_container(port)
+        .attach(format!("runtime: {runtime_id}, framework: {framework_id}"))?
+        .start()
+        .change_context(TestError::ContainerStart {
+            reason: format!("framework: {framework_id}"),
+        })
+        .attach(format!("runtime: {runtime_id}, framework: {framework_id}"))?;
+
+    let origin_url = format!("http://127.0.0.1:{port}");
+
+    // Wait for container to be ready
+    wait_for_container(&origin_url, framework.health_check_path())?;
+
+    // 2. Spawn runtime process with the pre-built WASM binary
+    let wasm_path = wasm_binary_path();
+    let process = runtime
+        .spawn(&wasm_path)
+        .attach(format!("runtime: {runtime_id}, framework: {framework_id}"))?;
+
+    // 3. Run standard scenarios
+    for scenario in framework.standard_scenarios() {
+        scenario
+            .run(&process.base_url, framework_id)
+            .attach(format!(
+                "runtime: {runtime_id}, framework: {framework_id}, scenario: {scenario:?}"
+            ))?;
+    }
+
+    // 4. Run custom scenarios
+    for scenario in framework.custom_scenarios() {
+        scenario
+            .run(&process.base_url, framework_id)
+            .attach(format!(
+                "runtime: {runtime_id}, framework: {framework_id}, custom scenario: {scenario:?}"
+            ))?;
+    }
+
+    // Explicitly drop container to free the origin port for the next test
+    drop(container);
+
+    Ok(())
+}
+
+/// Wait for a Docker container's health endpoint to respond successfully.
+///
+/// Retries up to 60 times with 500ms delay (total ~30s). Uses a longer
+/// budget than `wait_for_ready` because container cold-starts
+/// include image pull, filesystem setup, and application init time.
+///
+/// Unlike `wait_for_ready`, this function does not fall back to the root path —
+/// containers are expected to expose a reliable health endpoint.
+///
+/// # Errors
+///
+/// Returns [`TestError::ContainerTimeout`] if the health endpoint does not
+/// respond with a success status within the timeout.
+fn wait_for_container(base_url: &str, health_path: &str) -> common::runtime::TestResult<()> {
+    let url = format!("{base_url}{health_path}");
+
+    for _ in 0..60 {
+        if let Ok(resp) = reqwest::blocking::get(&url)
+            && resp.status().is_success()
+        {
+            return Ok(());
+        }
+        std::thread::sleep(Duration::from_millis(500));
+    }
+
+    Err(Report::new(TestError::ContainerTimeout)
+        .attach(format!("Container at {base_url} not ready after 30s")))
+}
+
+// Individual test functions for faster iteration during development.
+
+#[test]
+#[ignore = "requires Docker, Viceroy, and pre-built WASM binary"]
+fn test_wordpress_fastly() {
+    let runtime = environments::fastly::FastlyViceroy;
+    let framework = frameworks::wordpress::WordPress;
+    test_combination(&runtime, &framework).expect("should pass WordPress on Fastly");
+}
+
+#[test]
+#[ignore = "requires Docker, Viceroy, and pre-built WASM binary"]
+fn test_nextjs_fastly() {
+    let runtime = environments::fastly::FastlyViceroy;
+    let framework = frameworks::nextjs::NextJs;
+    test_combination(&runtime, &framework).expect("should pass Next.js on Fastly");
+}
diff --git a/scripts/integration-tests-browser.sh b/scripts/integration-tests-browser.sh
new file mode 100755
index 00000000..90e20a7d
--- /dev/null
+++ b/scripts/integration-tests-browser.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+#
+# Run browser-level integration tests using Playwright.
+#
+# Builds the WASM binary, Docker test images, and runs Playwright tests
+# against both Next.js and WordPress frontends.
+#
+# Prerequisites:
+#   - Docker running
+#   - Viceroy installed: cargo install viceroy
+#   - wasm32-wasip1 target: rustup target add wasm32-wasip1
+#   - Node.js with npx available
+#
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$REPO_ROOT"
+
+ORIGIN_PORT="${INTEGRATION_ORIGIN_PORT:-8888}"
+BROWSER_DIR="crates/integration-tests/browser"
+
+# --- Build WASM binary ---
+echo "==> Building WASM binary (origin=http://127.0.0.1:$ORIGIN_PORT)..."
+TRUSTED_SERVER__PUBLISHER__ORIGIN_URL="http://127.0.0.1:$ORIGIN_PORT" \
+TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK=false \
+    cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
+
+# --- Build Docker images ---
+echo "==> Building WordPress test container..."
+docker build -t test-wordpress:latest \
+    crates/integration-tests/fixtures/frameworks/wordpress/
+
+echo "==> Building Next.js test container..."
+docker build -t test-nextjs:latest \
+    crates/integration-tests/fixtures/frameworks/nextjs/
+
+# --- Install Playwright ---
+echo "==> Installing Playwright dependencies..."
+cd "$REPO_ROOT/$BROWSER_DIR"
+npm ci
+npx playwright install chromium
+
+# --- Export env vars for global-setup.ts ---
+export WASM_BINARY_PATH="$REPO_ROOT/target/wasm32-wasip1/release/trusted-server-fastly.wasm"
+export INTEGRATION_ORIGIN_PORT="$ORIGIN_PORT"
+export VICEROY_CONFIG_PATH="$REPO_ROOT/crates/integration-tests/fixtures/configs/viceroy-template.toml"
+
+# Cleanup trap: stop any leftover containers on failure
+cleanup() {
+    docker ps -q \
+        --filter ancestor=test-nextjs:latest \
+        --filter ancestor=test-wordpress:latest \
+        2>/dev/null | xargs -r docker stop 2>/dev/null || true
+}
+trap cleanup EXIT
+
+# --- Run tests for each framework ---
+for framework in nextjs wordpress; do
+    echo "==> Running Playwright tests for $framework..."
+    TEST_FRAMEWORK="$framework" npx playwright test "$@"
+done
+
+echo "==> All browser tests passed."
diff --git a/scripts/integration-tests.sh b/scripts/integration-tests.sh
new file mode 100755
index 00000000..316d416c
--- /dev/null
+++ b/scripts/integration-tests.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+#
+# Run integration tests locally.
+#
+# Builds the WASM binary with test-specific config overrides,
+# Docker test images, and runs all integration tests.
+#
+# Prerequisites:
+#   - Docker running
+#   - Viceroy installed: cargo install viceroy
+#   - wasm32-wasip1 target: rustup target add wasm32-wasip1
+#
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$REPO_ROOT"
+
+# Fixed origin port — must match the port baked into the WASM binary.
+# Docker containers are mapped to this port so the trusted-server
+# can proxy requests to them.
+ORIGIN_PORT="${INTEGRATION_ORIGIN_PORT:-8888}"
+
+# Detect native target from rustc (handles all OS + arch combinations correctly)
+TARGET="$(rustc -vV | sed -n 's/^host: //p')"
+if [ -z "$TARGET" ]; then
+    echo "Failed to detect host target from rustc -vV" >&2
+    exit 1
+fi
+
+echo "==> Building WASM binary (origin=http://127.0.0.1:$ORIGIN_PORT)..."
+TRUSTED_SERVER__PUBLISHER__ORIGIN_URL="http://127.0.0.1:$ORIGIN_PORT" \
+TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK=false \
+    cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
+
+echo "==> Building WordPress test container..."
+docker build -t test-wordpress:latest \
+    crates/integration-tests/fixtures/frameworks/wordpress/
+
+echo "==> Building Next.js test container..."
+docker build -t test-nextjs:latest \
+    crates/integration-tests/fixtures/frameworks/nextjs/
+
+echo "==> Running integration tests (target: $TARGET, origin port: $ORIGIN_PORT)..."
+WASM_BINARY_PATH="$REPO_ROOT/target/wasm32-wasip1/release/trusted-server-fastly.wasm" \
+INTEGRATION_ORIGIN_PORT="$ORIGIN_PORT" \
+RUST_LOG=info \
+    cargo test \
+        --manifest-path crates/integration-tests/Cargo.toml \
+        --target "$TARGET" \
+        -- --include-ignored --test-threads=1 "$@"