diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
new file mode 100644
index 0000000..de0a007
--- /dev/null
+++ b/.github/workflows/deploy-docs.yml
@@ -0,0 +1,67 @@
+name: Deploy VitePress Docs
+
+on:
+  push:
+    branches: [main, feature/docs-site]
+    paths:
+      - 'docs/**'
+      - '.github/workflows/deploy-docs.yml'
+  workflow_dispatch:  # Allow manual triggers
+
+# Sets permissions for GitHub Pages deployment
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Prevent concurrent deployments
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # For lastUpdated feature
+
+      - name: Retrieve Node.js version
+        id: node-version
+        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ steps.node-version.outputs.node-version }}
+          cache: 'npm'
+          cache-dependency-path: docs/package-lock.json
+
+      - name: Setup Pages
+        uses: actions/configure-pages@v4
+
+      - name: Install dependencies
+        working-directory: docs
+        run: npm ci
+
+      - name: Build with VitePress
+        working-directory: docs
+        run: npm run build
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: docs/.vitepress/dist
+
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4
diff --git a/docs/.gitignore b/docs/.gitignore
new file mode 100644
index 0000000..57a09c3
--- /dev/null
+++ b/docs/.gitignore
@@ -0,0 +1,3 @@
+node_modules
+.vitepress/dist
+.vitepress/cache
diff --git a/docs/.vitepress/config.mts b/docs/.vitepress/config.mts
new file mode 100644
index 0000000..561ba29
--- /dev/null
+++ b/docs/.vitepress/config.mts
@@ -0,0 +1,60 @@
+import { defineConfig } from 'vitepress'
+
+// https://vitepress.dev/reference/site-config
+export default defineConfig({
+  title: "Trusted Server",
+  description: "Privacy-preserving edge computing for ad serving and synthetic ID generation",
+  themeConfig: {
+    // https://vitepress.dev/reference/default-theme-config
+    nav: [
+      { text: 'Home', link: '/' },
+      { text: 'Guide', link: '/guide/getting-started' },
+    ],
+
+    sidebar: [
+      {
+        text: 'Introduction',
+        items: [
+          { text: 'What is Trusted Server?', link: '/guide/what-is-trusted-server' },
+          { text: 'Getting Started', link: '/guide/getting-started' }
+        ]
+      },
+      {
+        text: 'Core Concepts',
+        items: [
+          { text: 'Synthetic IDs', link: '/guide/synthetic-ids' },
+          { text: 'GDPR Compliance', link: '/guide/gdpr-compliance' },
+          { text: 'Ad Serving', link: '/guide/ad-serving' },
+          { text: 'First-Party Proxy', link: '/guide/first-party-proxy' },
+          { text: 'Creative Processing', link: '/guide/creative-processing' }
+        ]
+      },
+      {
+        text: 'Security',
+        items: [
+          { text: 'Request Signing', link: '/guide/request-signing' },
+          { text: 'Key Rotation', link: '/guide/key-rotation' }
+        ]
+      },
+      {
+        text: 'Development',
+        items: [
+          { text: 'Architecture', link: '/guide/architecture' },
+          { text: 'Configuration', link: '/guide/configuration' },
+          { text: 'Configuration Reference', link: '/guide/configuration-reference' },
+          { text: 'Testing', link: '/guide/testing' },
+          { text: 'Integration Guide', link: '/guide/integration-guide' }
+        ]
+      }
+    ],
+
+    socialLinks: [
+      { icon: 'github', link: 'https://github.com/IABTechLab/trusted-server' }
+    ],
+
+    footer: {
+      message: 'Released under the Apache License 2.0.',
+      copyright: 'Copyright © 2018-present IAB Technology Laboratory'
+    }
+  }
+})
diff --git a/docs/README.md b/docs/README.md
new file mode 100644
index 0000000..b25785a
--- /dev/null
+++ b/docs/README.md
@@ -0,0 +1,163 @@
+# Trusted Server Documentation
+
+VitePress documentation site for Trusted Server.
+
+## Local Development
+
+### Prerequisites
+
+- Node.js 24.10.0 (or version specified in `.tool-versions`)
+- npm
+
+### Setup
+
+```bash
+# Install dependencies
+npm install
+
+# Start dev server (available at localhost:5173)
+npm run dev
+```
+
+### Build
+
+```bash
+# Build for production
+npm run build
+
+# Preview production build
+npm run preview
+```
+
+## GitHub Pages Deployment
+
+The documentation is automatically deployed to GitHub Pages when changes are pushed to the `main` branch.
+
+### Setup GitHub Pages
+
+1. Go to repository **Settings** → **Pages**
+2. Under **Source**, select **GitHub Actions**
+3. The workflow in `.github/workflows/deploy-docs.yml` will automatically deploy on push to `main`
+
+### Custom Domain Setup
+
+1. **Update CNAME file**: Edit `docs/public/CNAME` with your domain:
+   ```
+   docs.yourdomain.com
+   ```
+
+2. **Configure DNS**: Add DNS records at your domain provider:
+   
+   **Option A - CNAME Record** (recommended for subdomains):
+   ```
+   Type: CNAME
+   Name: docs
+   Value: iabtechlab.github.io
+   ```
+
+   **Option B - A Records** (for apex domains):
+   ```
+   Type: A
+   Name: @
+   Value: 185.199.108.153
+   Value: 185.199.109.153
+   Value: 185.199.110.153
+   Value: 185.199.111.153
+   ```
+
+3. **Verify in GitHub**:
+   - Go to **Settings** → **Pages**
+   - Enter your custom domain
+   - Wait for DNS check to pass
+   - Enable "Enforce HTTPS"
+
+### Workflow Details
+
+**Trigger**: 
+- Push to `main` branch (only when `docs/**` changes)
+- Manual trigger via Actions tab
+
+**Build Process**:
+1. Checkout repository with full history (for `lastUpdated` feature)
+2. Setup Node.js (version from `.tool-versions`)
+3. Install dependencies (`npm ci`)
+4. Build VitePress site (`npm run build`)
+5. Upload build artifact
+6. Deploy to GitHub Pages
+
+**Permissions Required**:
+- `contents: read` - Read repository
+- `pages: write` - Deploy to Pages
+- `id-token: write` - OIDC token for deployment
+
+## Troubleshooting
+
+### Build Fails in GitHub Actions
+
+**Check**:
+- Node.js version matches `.tool-versions`
+- All dependencies in `package.json` are correct
+- Build succeeds locally (`npm run build`)
+
+**View Logs**:
+1. Go to **Actions** tab in GitHub
+2. Click on failed workflow run
+3. Review build logs
+
+### Custom Domain Not Working
+
+**Check**:
+- DNS records propagated (use `dig docs.yourdomain.com`)
+- CNAME file exists in `docs/public/CNAME`
+- Custom domain verified in GitHub Pages settings
+- HTTPS enforced (may take up to 24 hours)
+
+**DNS Verification**:
+```bash
+# Check CNAME record
+dig docs.yourdomain.com CNAME
+
+# Check A records (for apex domain)
+dig yourdomain.com A
+```
+
+### 404 Errors
+
+**Check**:
+- VitePress `base` config (should not be set for custom domains)
+- Links use correct paths (start with `/`)
+- Build output in `docs/.vitepress/dist` is correct
+
+## Project Structure
+
+```
+docs/
+├── .vitepress/
+│   ├── config.mts          # VitePress configuration
+│   └── dist/               # Build output (gitignored)
+├── guide/                  # Documentation pages
+│   ├── getting-started.md
+│   ├── configuration.md
+│   └── ...
+├── public/                 # Static assets
+│   └── CNAME              # Custom domain file
+├── index.md               # Homepage
+├── package.json           # Dependencies
+└── README.md             # This file
+```
+
+## Contributing
+
+When adding new documentation:
+
+1. Create `.md` files in `docs/guide/`
+2. Update sidebar in `docs/.vitepress/config.mts`
+3. Test locally with `npm run dev`
+4. Build and verify with `npm run build && npm run preview`
+5. Commit and push to trigger deployment
+
+## Links
+
+- **Production**: (Configure your custom domain)
+- **GitHub Repo**: https://github.com/IABTechLab/trusted-server
+- **VitePress Docs**: https://vitepress.dev
diff --git a/docs/guide/ad-serving.md b/docs/guide/ad-serving.md
new file mode 100644
index 0000000..6a05ed6
--- /dev/null
+++ b/docs/guide/ad-serving.md
@@ -0,0 +1,115 @@
+# Ad Serving
+
+Learn how Trusted Server handles privacy-compliant ad serving.
+
+## Overview
+
+Trusted Server provides edge-based ad serving with built-in GDPR compliance and real-time bidding support.
+
+## Supported Integrations
+
+### Equativ
+
+Primary ad server integration with support for:
+- Direct ad requests
+- Creative proxying
+- Click tracking
+- Impression tracking
+
+### Prebid
+
+Real-time bidding integration:
+- Header bidding support
+- Bid caching
+- Timeout management
+- Winner selection
+
+## Ad Request Flow
+
+1. Request validation
+2. GDPR consent check
+3. Synthetic ID generation (if consented)
+4. Ad server request
+5. Response processing
+6. Creative delivery
+
+## Configuration
+
+Configure ad servers in `trusted-server.toml`:
+
+```toml
+[ad_servers.equativ]
+endpoint = "https://ad-server.example.com"
+timeout_ms = 1000
+enabled = true
+
+[prebid]
+timeout_ms = 1500
+cache_ttl = 300
+```
+
+## Creative Handling
+
+### Proxy Mode
+
+Creatives can be proxied through Trusted Server for:
+- Security scanning
+- Content modification
+- Click tracking injection
+- GDPR compliance
+
+### Direct Mode
+
+Creatives served directly from ad server:
+- Lower latency
+- Reduced edge load
+- Less control over content
+
+## Tracking
+
+### Impression Tracking
+
+```javascript
+// Placeholder example
+trustedServer.trackImpression({
+    adId: 'ad-123',
+    syntheticId: 'synthetic-xyz',
+    consent: true
+});
+```
+
+### Click Tracking
+
+Click tracking with privacy preservation:
+- No PII in URLs
+- Synthetic ID only (with consent)
+- Encrypted parameters
+
+## Performance
+
+### Edge Caching
+
+- Bid responses cached at edge
+- Creative assets cached
+- Configuration cached
+- Reduced origin requests
+
+### Timeouts
+
+Configurable timeouts for:
+- Ad server requests
+- Prebid auctions
+- Creative fetching
+
+## Best Practices
+
+1. Set appropriate timeouts for your use case
+2. Enable caching for frequently requested ads
+3. Monitor ad server response times
+4. Use proxy mode for security-sensitive content
+5. Implement fallback ads
+
+## Next Steps
+
+- Review [Architecture](/guide/architecture)
+- Configure [Testing](/guide/testing)
diff --git a/docs/guide/architecture.md b/docs/guide/architecture.md
new file mode 100644
index 0000000..822b302
--- /dev/null
+++ b/docs/guide/architecture.md
@@ -0,0 +1,122 @@
+# Architecture
+
+Understanding the architecture of Trusted Server.
+
+## High-Level Overview
+
+Trusted Server is built as a Rust-based edge computing application that runs on Fastly Compute platform.
+
+```
+┌─────────────┐
+│   Browser   │
+└──────┬──────┘
+       │
+       ▼
+┌─────────────────────┐
+│  Trusted Server     │
+│  (Fastly Edge)      │
+│  ┌───────────────┐  │
+│  │ GDPR Check    │  │
+│  │ Synthetic IDs │  │
+│  │ Ad Serving    │  │
+│  └───────────────┘  │
+└──────┬──────────────┘
+       │
+       ▼
+┌─────────────────────┐
+│   Ad Servers        │
+│   KV Stores         │
+│   External APIs     │
+└─────────────────────┘
+```
+
+## Core Components
+
+### trusted-server-common
+
+Core library containing shared functionality:
+- Synthetic ID generation
+- Cookie handling
+- HTTP abstractions
+- GDPR consent management
+- Ad server integrations
+
+### trusted-server-fastly
+
+Fastly-specific implementation:
+- Main application entry point
+- Fastly SDK integration
+- Request/response handling
+- KV store access
+
+## Design Patterns
+
+### RequestWrapper Trait
+
+Abstracts HTTP request handling to support different backends:
+
+```rust
+// Placeholder example
+pub trait RequestWrapper {
+    fn get_header(&self, name: &str) -> Option<String>;
+    fn get_cookie(&self, name: &str) -> Option<String>;
+    // ...
+}
+```
+
+### Settings-Driven Configuration
+
+External configuration via `trusted-server.toml` allows deployment-time customization without code changes.
+
+### Privacy-First Design
+
+All tracking operations require explicit GDPR consent checks before execution.
+
+## Data Flow
+
+1. **Request Ingress** - Request arrives at Fastly edge
+2. **Consent Validation** - GDPR consent checked
+3. **ID Generation** - Synthetic ID generated (if consented)
+4. **Ad Request** - Backend ad server called
+5. **Response Processing** - Creative processed and modified
+6. **Response Egress** - Response sent to browser
+
+## Storage
+
+### Fastly KV Store
+
+Used for:
+- Counter storage
+- Domain mappings
+- Configuration cache
+- Synthetic ID state
+
+### No User Data Persistence
+
+User data is not persisted in storage - only processed in-flight at the edge.
+
+## Performance Characteristics
+
+- **Low Latency** - Edge execution near users
+- **High Throughput** - Parallel request processing
+- **Global Distribution** - Fastly's global network
+- **Caching** - Aggressive edge caching
+
+## Security
+
+- **HMAC-based IDs** - Cryptographically secure identifiers
+- **No PII Storage** - Privacy by design
+- **Request Signing** - Optional request authentication
+- **Content Security** - Creative scanning and modification
+
+## WebAssembly Target
+
+Compiled to `wasm32-wasip1` for Fastly Compute:
+- Sandboxed execution
+- Fast cold starts
+- Efficient resource usage
+
+## Next Steps
+
+- Learn about [Configuration](/guide/configuration)
+- Set up [Testing](/guide/testing)
diff --git a/docs/guide/configuration-reference.md b/docs/guide/configuration-reference.md
new file mode 100644
index 0000000..c820ca7
--- /dev/null
+++ b/docs/guide/configuration-reference.md
@@ -0,0 +1,855 @@
+# Configuration Reference
+
+Complete reference for all configuration options in Trusted Server.
+
+## Overview
+
+Trusted Server uses a TOML-based configuration system with environment variable overrides. Configuration is loaded from:
+
+1. **`trusted-server.toml`** - Base configuration file
+2. **Environment Variables** - Runtime overrides with `TRUSTED_SERVER__` prefix
+
+### Quick Example
+
+```toml
+# trusted-server.toml
+[publisher]
+domain = "publisher.com"
+cookie_domain = ".publisher.com"
+origin_url = "https://origin.publisher.com"
+proxy_secret = "your-secure-secret-here"
+
+[synthetic]
+counter_store = "counter_store"
+opid_store = "opid_store"
+secret_key = "your-hmac-secret-here"
+template = "{{ client_ip }}:{{ user_agent }}"
+```
+
+## Environment Variable Overrides
+
+### Format
+
+```
+TRUSTED_SERVER__SECTION__SUBSECTION__FIELD
+```
+
+**Rules**:
+- Prefix: `TRUSTED_SERVER`
+- Separator: `__` (double underscore)
+- Case: UPPERCASE
+- Sections: Match TOML hierarchy
+
+### Examples
+
+**Simple Field**:
+```bash
+TRUSTED_SERVER__PUBLISHER__DOMAIN=publisher.com
+```
+
+**Nested Field**:
+```bash
+TRUSTED_SERVER__INTEGRATIONS__PREBID__SERVER_URL=https://prebid.example/auction
+```
+
+**Array Field (JSON)**:
+```bash
+TRUSTED_SERVER__INTEGRATIONS__PREBID__BIDDERS='["kargo","rubicon"]'
+```
+
+**Array Field (Indexed)**:
+```bash
+TRUSTED_SERVER__INTEGRATIONS__PREBID__BIDDERS__0=kargo
+TRUSTED_SERVER__INTEGRATIONS__PREBID__BIDDERS__1=rubicon
+```
+
+**Array Field (Comma-Separated)**:
+```bash
+TRUSTED_SERVER__INTEGRATIONS__PREBID__BIDDERS=kargo,rubicon,appnexus
+```
+
+## Publisher Configuration
+
+Core publisher settings for domain, origin, and proxy configuration.
+
+### `[publisher]`
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `domain` | String | Yes | Publisher's domain name |
+| `cookie_domain` | String | Yes | Domain for setting cookies (typically with leading dot) |
+| `origin_url` | String | Yes | Full URL of publisher origin server |
+| `proxy_secret` | String | Yes | Secret key for encrypting/signing proxy URLs |
+
+**Example**:
+```toml
+[publisher]
+domain = "publisher.com"
+cookie_domain = ".publisher.com"  # Includes subdomains
+origin_url = "https://origin.publisher.com"
+proxy_secret = "change-me-to-secure-random-value"
+```
+
+**Environment Override**:
+```bash
+TRUSTED_SERVER__PUBLISHER__DOMAIN=publisher.com
+TRUSTED_SERVER__PUBLISHER__COOKIE_DOMAIN=.publisher.com
+TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=https://origin.publisher.com
+TRUSTED_SERVER__PUBLISHER__PROXY_SECRET=your-secret-here
+```
+
+### Field Details
+
+#### `domain`
+
+**Purpose**: Primary domain for the publisher.
+
+**Usage**:
+- Displayed in synthetic ID generation
+- Used in template variables (`publisher_domain`)
+- Part of request context
+
+**Format**: Hostname without protocol or path
+- ✅ `publisher.com`
+- ✅ `www.publisher.com`  
+- ❌ `https://publisher.com`
+- ❌ `publisher.com/path`
+
+#### `cookie_domain`
+
+**Purpose**: Domain scope for synthetic ID cookies.
+
+**Usage**:
+- Set on `synthetic_id` cookie
+- Controls cookie sharing across subdomains
+
+**Format**: Domain with optional leading dot
+- `.publisher.com` - Shares across all subdomains
+- `publisher.com` - Exact domain only
+
+**Best Practice**: Use leading dot (`.publisher.com`) for subdomain sharing.
+
+#### `origin_url`
+
+**Purpose**: Backend origin server URL for publisher content.
+
+**Usage**:
+- Fallback proxy target for non-integration requests
+- HTML processing rewrites origin URLs to request host
+- Base for relative URL resolution
+
+**Format**: Full URL with protocol
+- ✅ `https://origin.publisher.com`
+- ✅ `https://origin.publisher.com:8080`
+- ✅ `http://192.168.1.1:9000`
+- ❌ `origin.publisher.com` (missing protocol)
+
+**Port Handling**: Includes port if non-standard (not 80/443).
+
+#### `proxy_secret`
+
+**Purpose**: Secret key for HMAC-SHA256 signing of proxy URLs.
+
+**Security**:
+- Keep confidential and secure
+- Rotate periodically (90 days recommended)
+- Use cryptographically random values (32+ bytes)
+- Never commit to version control
+
+**Generation**:
+```bash
+# Generate secure random secret
+openssl rand -base64 32
+```
+
+**Usage**:
+- Signs `/first-party/proxy` URLs
+- Signs `/first-party/click` URLs
+- Validates incoming proxy requests
+- Prevents URL tampering
+
+::: danger Security Warning
+Changing `proxy_secret` invalidates all existing signed URLs. Plan rotations carefully and use graceful transition periods.
+:::
+
+## Synthetic ID Configuration
+
+Settings for generating privacy-preserving synthetic identifiers.
+
+### `[synthetic]`
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `counter_store` | String | Yes | Fastly KV store name for counters |
+| `opid_store` | String | Yes | Fastly KV store name for publisher ID mappings |
+| `secret_key` | String | Yes | HMAC secret for ID generation |
+| `template` | String | Yes | Handlebars template for ID composition |
+
+**Example**:
+```toml
+[synthetic]
+counter_store = "counter_store"
+opid_store = "opid_store"
+secret_key = "your-secure-hmac-secret"
+template = "{{ client_ip }}:{{ user_agent }}:{{ first_party_id }}"
+```
+
+**Environment Override**:
+```bash
+TRUSTED_SERVER__SYNTHETIC__COUNTER_STORE=counter_store
+TRUSTED_SERVER__SYNTHETIC__OPID_STORE=opid_store
+TRUSTED_SERVER__SYNTHETIC__SECRET_KEY=your-secret
+TRUSTED_SERVER__SYNTHETIC__TEMPLATE="{{ client_ip }}:{{ user_agent }}"
+```
+
+### Field Details
+
+#### `counter_store`
+
+**Purpose**: Fastly KV store for synthetic ID counters.
+
+**Usage**:
+- Stores incrementing counters per domain
+- Ensures ID uniqueness
+- Accessed via Fastly KV Store API
+
+**Setup**:
+```bash
+# Create KV store
+fastly kv-store create --name=counter_store
+```
+
+**Data Format**:
+```json
+{
+  "publisher.com": 12345,
+  "another.com": 67890
+}
+```
+
+#### `opid_store`
+
+**Purpose**: Fastly KV store for publisher-provided ID mappings.
+
+**Usage**:
+- Maps publisher IDs to synthetic IDs
+- Enables first-party ID integration
+- Optional (used if publisher provides IDs)
+
+**Setup**:
+```bash
+# Create KV store
+fastly kv-store create --name=opid_store
+```
+
+**Data Format**:
+```json
+{
+  "publisher-id-123": "synthetic-abc",
+  "publisher-id-456": "synthetic-def"
+}
+```
+
+#### `secret_key`
+
+**Purpose**: HMAC secret for deterministic ID generation.
+
+**Security**:
+- Minimum 8 bytes (validation enforced)
+- Cannot be `"secret-key"` (reserved/invalid)
+- Rotate periodically for security
+- Store securely (environment variable recommended)
+
+**Generation**:
+```bash
+# Generate secure random key
+openssl rand -hex 32
+```
+
+**Validation**: Application startup fails if:
+- Empty string
+- Exactly `"secret-key"` (default placeholder)
+- Less than 1 character
+
+#### `template`
+
+**Purpose**: Handlebars template defining ID composition.
+
+**Available Variables**:
+
+| Variable | Description | Example |
+|----------|-------------|---------|
+| `client_ip` | Client IP address | `192.168.1.1` |
+| `user_agent` | User-Agent header | `Mozilla/5.0...` |
+| `first_party_id` | Publisher-provided ID | `user-123` |
+| `auth_user_id` | Authenticated user ID | `auth-456` |
+| `publisher_domain` | Publisher domain | `publisher.com` |
+| `accept_language` | Accept-Language header | `en-US,en;q=0.9` |
+
+**Template Examples**:
+
+**Simple (IP + UA)**:
+```toml
+template = "{{ client_ip }}:{{ user_agent }}"
+```
+
+**With First-Party ID**:
+```toml
+template = "{{ first_party_id }}:{{ client_ip }}"
+```
+
+**Comprehensive**:
+```toml
+template = "{{ client_ip }}:{{ user_agent }}:{{ first_party_id }}:{{ auth_user_id }}:{{ publisher_domain }}:{{ accept_language }}"
+```
+
+**Validation**: Must be non-empty string.
+
+::: tip Template Design
+Choose template variables based on your privacy and uniqueness requirements:
+- **More variables** = More unique IDs, less privacy
+- **Fewer variables** = More privacy, potential collisions
+- **Include `first_party_id`** for publisher ID integration
+:::
+
+## Response Headers
+
+Custom headers added to all responses.
+
+### `[response_headers]`
+
+**Purpose**: Add custom HTTP headers to every response.
+
+**Format**: Key-value pairs
+
+**Example**:
+```toml
+[response_headers]
+X-Custom-Header = "custom value"
+X-Publisher-ID = "pub-12345"
+X-Environment = "production"
+Cache-Control = "public, max-age=3600"
+```
+
+**Environment Override**:
+```bash
+TRUSTED_SERVER__RESPONSE_HEADERS__X_CUSTOM_HEADER="custom value"
+```
+
+**Use Cases**:
+- Custom tracking headers
+- Cache control overrides
+- Debugging identifiers
+- CORS headers (if needed)
+
+::: warning Header Precedence
+Custom headers may be overwritten by application logic. Standard headers (`Content-Type`, `Content-Length`) are controlled by the application.
+:::
+
+## Request Signing
+
+Configuration for Ed25519 request signing and JWKS management.
+
+### `[request_signing]`
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `enabled` | Boolean | No (default: false) | Enable request signing features |
+| `config_store_id` | String | If enabled | Fastly Config Store ID for JWKS |
+| `secret_store_id` | String | If enabled | Fastly Secret Store ID for private keys |
+
+**Example**:
+```toml
+[request_signing]
+enabled = true
+config_store_id = "01GXXX"  # From Fastly dashboard
+secret_store_id = "01GYYY"  # From Fastly dashboard
+```
+
+**Environment Override**:
+```bash
+TRUSTED_SERVER__REQUEST_SIGNING__ENABLED=true
+TRUSTED_SERVER__REQUEST_SIGNING__CONFIG_STORE_ID=01GXXX
+TRUSTED_SERVER__REQUEST_SIGNING__SECRET_STORE_ID=01GYYY
+```
+
+### Store Setup
+
+**Config Store** (for public keys):
+```bash
+# Create store
+fastly config-store create --name=jwks_store
+
+# Get store ID
+fastly config-store list
+```
+
+**Secret Store** (for private keys):
+```bash
+# Create store
+fastly secret-store create --name=signing_keys
+
+# Get store ID
+fastly secret-store list
+```
+
+**Link to Service** (`fastly.toml`):
+```toml
+[setup.config_stores.jwks_store]
+
+[setup.secret_stores.signing_keys]
+```
+
+See [Request Signing](/guide/request-signing) and [Key Rotation](/guide/key-rotation) for usage.
+
+## Basic Authentication Handlers
+
+Path-based HTTP Basic Authentication.
+
+### `[[handlers]]`
+
+**Purpose**: Protect specific paths with username/password authentication.
+
+**Format**: Array of handler objects
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `path` | String (Regex) | Yes | Regular expression matching paths |
+| `username` | String | Yes | HTTP Basic Auth username |
+| `password` | String | Yes | HTTP Basic Auth password |
+
+**Example**:
+```toml
+# Single handler
+[[handlers]]
+path = "^/admin"
+username = "admin"
+password = "secure-password"
+
+# Multiple handlers
+[[handlers]]
+path = "^/secure"
+username = "user1"
+password = "pass1"
+
+[[handlers]]
+path = "^/api/private"
+username = "api-user"
+password = "api-pass"
+```
+
+**Environment Override**:
+```bash
+# Handler 0
+TRUSTED_SERVER__HANDLERS__0__PATH="^/admin"
+TRUSTED_SERVER__HANDLERS__0__USERNAME="admin"
+TRUSTED_SERVER__HANDLERS__0__PASSWORD="secure-password"
+
+# Handler 1
+TRUSTED_SERVER__HANDLERS__1__PATH="^/api/private"
+TRUSTED_SERVER__HANDLERS__1__USERNAME="api-user"
+TRUSTED_SERVER__HANDLERS__1__PASSWORD="api-pass"
+```
+
+### Path Patterns
+
+**Regex Syntax**: Standard Rust regex patterns
+
+**Examples**:
+
+```toml
+# Exact path
+path = "^/admin$"  # Only /admin
+
+# Prefix match
+path = "^/admin"   # /admin, /admin/users, /admin/settings
+
+# Multiple paths
+path = "^/(admin|secure|private)"
+
+# File extension
+path = "\\.pdf$"   # All PDF files
+
+# Complex pattern
+path = "^/api/v[0-9]+/private"  # /api/v1/private, /api/v2/private
+```
+
+**Validation**: Application startup fails if regex is invalid.
+
+### Security Considerations
+
+**Password Storage**:
+- Stored in plain text in config
+- Use environment variables in production
+- Rotate passwords regularly
+- Consider using Fastly Secret Store
+
+**Limitations**:
+- HTTP Basic Auth (not OAuth/JWT)
+- Single username/password per path
+- No role-based access control
+- No rate limiting (add at edge)
+
+::: warning Production Use
+For production, store credentials in environment variables:
+```bash
+TRUSTED_SERVER__HANDLERS__0__PASSWORD=$(cat /run/secrets/admin_password)
+```
+:::
+
+## URL Rewrite Configuration
+
+Control which domains are excluded from first-party rewriting.
+
+### `[rewrite]`
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `exclude_domains` | Array[String] | No (default: []) | Domains to skip rewriting |
+
+**Example**:
+```toml
+[rewrite]
+exclude_domains = [
+    "*.cdn.trusted-partner.com",  # Wildcard
+    "first-party.publisher.com",  # Exact match
+    "localhost",                  # Development
+]
+```
+
+**Environment Override**:
+```bash
+# JSON array
+TRUSTED_SERVER__REWRITE__EXCLUDE_DOMAINS='["*.cdn.example.com","localhost"]'
+
+# Indexed
+TRUSTED_SERVER__REWRITE__EXCLUDE_DOMAINS__0="*.cdn.example.com"
+TRUSTED_SERVER__REWRITE__EXCLUDE_DOMAINS__1="localhost"
+
+# Comma-separated
+TRUSTED_SERVER__REWRITE__EXCLUDE_DOMAINS="*.cdn.example.com,localhost"
+```
+
+### Pattern Matching
+
+**Wildcard Patterns** (`*`):
+```toml
+"*.cdn.example.com"
+```
+Matches:
+- ✅ `assets.cdn.example.com`
+- ✅ `images.cdn.example.com`
+- ✅ `cdn.example.com` (base domain)
+- ❌ `cdn.example.com.evil.com` (different domain)
+
+**Exact Patterns** (no `*`):
+```toml
+"api.example.com"
+```
+Matches:
+- ✅ `api.example.com`
+- ❌ `www.api.example.com`
+- ❌ `api.example.com.evil.com`
+
+### Use Cases
+
+**Trusted Partners**:
+```toml
+exclude_domains = ["*.approved-cdn.com"]
+```
+
+**First-Party Resources**:
+```toml
+exclude_domains = ["assets.publisher.com", "static.publisher.com"]
+```
+
+**Development**:
+```toml
+exclude_domains = ["localhost", "127.0.0.1", "*.local"]
+```
+
+**Performance** (already first-party):
+```toml
+exclude_domains = ["*.publisher.com"]  # Skip unnecessary proxying
+```
+
+See [Creative Processing](/guide/creative-processing#exclude-domains) for details.
+
+## Integration Configurations
+
+Settings for built-in integrations (Prebid, Next.js, Permutive, Testlight).
+
+### Common Fields
+
+All integrations support:
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `enabled` | Boolean | Enable/disable integration (default: false) |
+
+### Prebid Integration
+
+**Section**: `[integrations.prebid]`
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `enabled` | Boolean | `false` | Enable Prebid integration |
+| `server_url` | String | Required | Prebid Server endpoint URL |
+| `timeout_ms` | Integer | `1000` | Request timeout in milliseconds |
+| `bidders` | Array[String] | `[]` | List of enabled bidders |
+| `auto_configure` | Boolean | `false` | Auto-inject Prebid.js shim |
+| `debug` | Boolean | `false` | Enable debug logging |
+| `script_handler` | String | Optional | Custom script endpoint path |
+
+**Example**:
+```toml
+[integrations.prebid]
+enabled = true
+server_url = "https://prebid-server.example/openrtb2/auction"
+timeout_ms = 1200
+bidders = ["kargo", "rubicon", "appnexus", "openx"]
+auto_configure = true
+debug = false
+```
+
+**Environment Override**:
+```bash
+TRUSTED_SERVER__INTEGRATIONS__PREBID__ENABLED=true
+TRUSTED_SERVER__INTEGRATIONS__PREBID__SERVER_URL=https://prebid.example/auction
+TRUSTED_SERVER__INTEGRATIONS__PREBID__TIMEOUT_MS=1200
+TRUSTED_SERVER__INTEGRATIONS__PREBID__BIDDERS=kargo,rubicon,appnexus
+TRUSTED_SERVER__INTEGRATIONS__PREBID__AUTO_CONFIGURE=true
+TRUSTED_SERVER__INTEGRATIONS__PREBID__DEBUG=false
+```
+
+### Next.js Integration
+
+**Section**: `[integrations.nextjs]`
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `enabled` | Boolean | `false` | Enable Next.js integration |
+| `rewrite_attributes` | Array[String] | `["href","link","url"]` | Attributes to rewrite |
+
+**Example**:
+```toml
+[integrations.nextjs]
+enabled = true
+rewrite_attributes = ["href", "link", "url", "src"]
+```
+
+**Environment Override**:
+```bash
+TRUSTED_SERVER__INTEGRATIONS__NEXTJS__ENABLED=true
+TRUSTED_SERVER__INTEGRATIONS__NEXTJS__REWRITE_ATTRIBUTES=href,link,url,src
+```
+
+### Permutive Integration
+
+**Section**: `[integrations.permutive]`
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `enabled` | Boolean | `false` | Enable Permutive integration |
+| `organization_id` | String | Required | Permutive organization ID |
+| `workspace_id` | String | Required | Permutive workspace ID |
+| `project_id` | String | Required | Permutive project ID |
+| `api_endpoint` | String | `https://api.permutive.com` | Permutive API URL |
+| `secure_signals_endpoint` | String | `https://secure-signals.permutive.app` | Secure signals URL |
+| `cache_ttl_seconds` | Integer | `3600` | Cache TTL in seconds |
+| `rewrite_sdk` | Boolean | `true` | Rewrite Permutive SDK references |
+
+**Example**:
+```toml
+[integrations.permutive]
+enabled = true
+organization_id = "org-12345"
+workspace_id = "ws-67890"
+project_id = "proj-abcde"
+api_endpoint = "https://api.permutive.com"
+secure_signals_endpoint = "https://secure-signals.permutive.app"
+cache_ttl_seconds = 7200
+rewrite_sdk = true
+```
+
+### Testlight Integration
+
+**Section**: `[integrations.testlight]`
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `enabled` | Boolean | `false` | Enable Testlight integration |
+| `endpoint` | String | Required | Testlight auction endpoint |
+| `timeout_ms` | Integer | `1000` | Request timeout in milliseconds |
+| `rewrite_scripts` | Boolean | `true` | Rewrite Testlight script references |
+
+**Example**:
+```toml
+[integrations.testlight]
+enabled = true
+endpoint = "https://testlight.example/openrtb2/auction"
+timeout_ms = 1500
+rewrite_scripts = true
+```
+
+## Validation
+
+### Automatic Validation
+
+Configuration is validated at startup:
+
+**Publisher Validation**:
+- All fields non-empty
+- `origin_url` is valid URL
+
+**Synthetic Validation**:
+- `secret_key` ≥ 1 character
+- `secret_key` ≠ `"secret-key"`
+- `template` non-empty
+
+**Handler Validation**:
+- `path` is valid regex
+- `username` non-empty
+- `password` non-empty
+
+**Integration Validation**:
+- Each integration implements `Validate` trait
+- Custom rules per integration
+
+### Validation Errors
+
+**Startup Failure** if:
+- Required fields missing
+- Invalid data types
+- Regex compilation fails
+- Secret key is default value
+- Integration config fails validation
+
+**Error Format**:
+```
+Configuration error: Integration 'prebid' configuration failed validation: 
+server_url: must not be empty
+```
+
+## Best Practices
+
+### Configuration Management
+
+**Development**:
+```toml
+# trusted-server.dev.toml
+[publisher]
+domain = "localhost"
+origin_url = "http://localhost:3000"
+proxy_secret = "dev-secret"
+```
+
+**Staging**:
+```bash
+# .env.staging
+TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=https://staging.publisher.com
+TRUSTED_SERVER__PUBLISHER__PROXY_SECRET=$(cat /run/secrets/proxy_secret_staging)
+```
+
+**Production**:
+```bash
+# All secrets from environment
+TRUSTED_SERVER__PUBLISHER__PROXY_SECRET=$(cat /run/secrets/proxy_secret)
+TRUSTED_SERVER__SYNTHETIC__SECRET_KEY=$(cat /run/secrets/synthetic_secret)
+TRUSTED_SERVER__HANDLERS__0__PASSWORD=$(cat /run/secrets/admin_password)
+```
+
+### Secret Management
+
+**Do**:
+✅ Use environment variables for secrets  
+✅ Rotate secrets periodically  
+✅ Generate cryptographically random values  
+✅ Store in secure secret management (Fastly Secret Store, Vault)  
+✅ Use different secrets per environment  
+
+**Don't**:
+❌ Commit secrets to version control  
+❌ Use default/placeholder values  
+❌ Share secrets across environments  
+❌ Log secret values  
+❌ Expose in error messages  
+
+### File Organization
+
+**Recommended Structure**:
+```
+trusted-server.toml          # Base config
+trusted-server.dev.toml      # Development overrides
+.env.development             # Dev environment vars
+.env.staging                 # Staging environment vars
+.env.production              # Production environment vars (not in git)
+.env.example                 # Example template (in git)
+```
+
+**.gitignore**:
+```
+.env.production
+.env.staging
+.env.local
+*.secret
+```
+
+## Troubleshooting
+
+### Common Issues
+
+**"Failed to build configuration"**:
+- Check TOML syntax (trailing commas, quotes)
+- Verify all required fields present
+- Check environment variable format
+
+**"Secret key is not valid"**:
+- Cannot use `"secret-key"` (placeholder)
+- Must be non-empty
+- Change to secure random value
+
+**"Invalid regex"**:
+- Handler `path` must be valid regex
+- Test pattern: `echo "^/admin" | grep -E "^/admin"`
+- Escape special characters: `\.`, `\$`, etc.
+
+**"Integration configuration could not be parsed"**:
+- Check JSON syntax in env vars
+- Verify indexed arrays (0, 1, 2...)
+- Check field names match exactly
+
+**Environment Variables Not Applied**:
+- Verify prefix: `TRUSTED_SERVER__`
+- Check separator: `__` (double underscore)
+- Confirm variable is exported: `echo $VARIABLE_NAME`
+- Try explicit string: `VARIABLE='value'` not `VARIABLE=value`
+
+### Debug Configuration
+
+**Print Loaded Config** (test only):
+```rust
+use trusted_server_common::settings::Settings;
+
+let settings = Settings::new()?;
+println!("{:#?}", settings);
+```
+
+**Check Environment**:
+```bash
+# List all TRUSTED_SERVER variables
+env | grep TRUSTED_SERVER
+```
+
+**Validate TOML**:
+```bash
+# Use any TOML validator
+cat trusted-server.toml | npx toml-cli validate
+```
+
+## Next Steps
+
+- Learn about [First-Party Proxy](/guide/first-party-proxy) for URL proxying
+- Set up [Request Signing](/guide/request-signing) for secure API calls
+- Configure [Creative Processing](/guide/creative-processing) rewrites
+- Explore [Integration Guide](/guide/integration-guide) for custom integrations
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
new file mode 100644
index 0000000..962e440
--- /dev/null
+++ b/docs/guide/configuration.md
@@ -0,0 +1,505 @@
+# Configuration
+
+Learn how to configure Trusted Server for your deployment.
+
+## Overview
+
+Trusted Server uses a flexible configuration system based on:
+
+1. **TOML Files** - `trusted-server.toml` for base configuration
+2. **Environment Variables** - Runtime overrides with `TRUSTED_SERVER__` prefix
+3. **Fastly Stores** - KV/Config/Secret stores for runtime data
+
+::: tip Complete Reference
+See [Configuration Reference](/guide/configuration-reference) for detailed documentation of all configuration options.
+:::
+
+## Quick Start
+
+### Basic Configuration
+
+Create `trusted-server.toml` in your project root:
+
+```toml
+[publisher]
+domain = "publisher.com"
+cookie_domain = ".publisher.com"
+origin_url = "https://origin.publisher.com"
+proxy_secret = "your-secure-secret-here"
+
+[synthetic]
+counter_store = "counter_store"
+opid_store = "opid_store"
+secret_key = "your-hmac-secret"
+template = "{{ client_ip }}:{{ user_agent }}"
+```
+
+### Environment Overrides
+
+Override any setting with environment variables:
+
+```bash
+# Publisher settings
+export TRUSTED_SERVER__PUBLISHER__DOMAIN=publisher.com
+export TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=https://origin.publisher.com
+
+# Synthetic ID settings
+export TRUSTED_SERVER__SYNTHETIC__SECRET_KEY=your-secret
+export TRUSTED_SERVER__SYNTHETIC__TEMPLATE="{{ client_ip }}:{{ user_agent }}"
+```
+
+## Configuration Files
+
+### `trusted-server.toml`
+
+Main application configuration file.
+
+**Location**: Project root directory
+
+**Format**: TOML (Tom's Obvious, Minimal Language)
+
+**Sections**:
+- `[publisher]` - Publisher domain and origin settings
+- `[synthetic]` - Synthetic ID generation
+- `[request_signing]` - Request signing and JWKS
+- `[response_headers]` - Custom response headers
+- `[rewrite]` - URL rewriting rules
+- `[[handlers]]` - Basic auth handlers
+- `[integrations.*]` - Integration configs (Prebid, Next.js, etc.)
+
+**Example**:
+```toml
+[publisher]
+domain = "publisher.com"
+cookie_domain = ".publisher.com"
+origin_url = "https://origin.publisher.com"
+proxy_secret = "change-me-to-secure-value"
+
+[synthetic]
+counter_store = "counter_store"
+opid_store = "opid_store"
+secret_key = "your-hmac-secret-key"
+template = "{{ client_ip }}:{{ user_agent }}:{{ first_party_id }}"
+
+[response_headers]
+X-Publisher-ID = "pub-12345"
+X-Environment = "production"
+
+[request_signing]
+enabled = false
+config_store_id = "<your-config-store-id>"
+secret_store_id = "<your-secret-store-id>"
+
+[integrations.prebid]
+enabled = true
+server_url = "https://prebid-server.com/openrtb2/auction"
+timeout_ms = 1200
+bidders = ["kargo", "rubicon", "appnexus"]
+auto_configure = false
+```
+
+### `fastly.toml`
+
+Fastly Compute service configuration.
+
+**Purpose**: Build settings, local development, store links
+
+**Example**:
+```toml
+manifest_version = 2
+name = "trusted-server"
+description = "Privacy-preserving ad serving"
+authors = ["Your Team"]
+language = "rust"
+
+[local_server]
+  [local_server.kv_stores.counter_store]
+    file = "test-data/counter_store.json"
+  
+  [local_server.kv_stores.opid_store]
+    file = "test-data/opid_store.json"
+
+[setup]
+  [setup.config_stores.jwks_store]
+  [setup.secret_stores.signing_keys]
+```
+
+### `.env.*` Files
+
+Environment-specific variable files.
+
+**`.env.dev`** - Local development:
+```bash
+TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=http://localhost:3000
+TRUSTED_SERVER__SYNTHETIC__SECRET_KEY=dev-secret
+LOG_LEVEL=debug
+```
+
+**`.env.staging`** - Staging environment:
+```bash
+TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=https://staging.publisher.com
+TRUSTED_SERVER__SYNTHETIC__SECRET_KEY=$(cat /run/secrets/synthetic_key_staging)
+```
+
+**`.env.production`** - Production (secrets from secure store):
+```bash
+TRUSTED_SERVER__PUBLISHER__PROXY_SECRET=$(cat /run/secrets/proxy_secret)
+TRUSTED_SERVER__SYNTHETIC__SECRET_KEY=$(cat /run/secrets/synthetic_secret)
+TRUSTED_SERVER__REQUEST_SIGNING__ENABLED=true
+```
+
+## Environment Variables
+
+### Format
+
+```
+TRUSTED_SERVER__SECTION__FIELD=value
+```
+
+**Rules**:
+- Prefix: `TRUSTED_SERVER`
+- Separator: `__` (double underscore)
+- Case: UPPERCASE
+- Nested: Use additional `__` for each level
+
+### Examples
+
+**Simple Field**:
+```bash
+TRUSTED_SERVER__PUBLISHER__DOMAIN=publisher.com
+```
+
+**Array (JSON)**:
+```bash
+TRUSTED_SERVER__INTEGRATIONS__PREBID__BIDDERS='["kargo","rubicon"]'
+```
+
+**Array (Indexed)**:
+```bash
+TRUSTED_SERVER__INTEGRATIONS__PREBID__BIDDERS__0=kargo
+TRUSTED_SERVER__INTEGRATIONS__PREBID__BIDDERS__1=rubicon
+```
+
+**Array (Comma-Separated)**:
+```bash
+TRUSTED_SERVER__INTEGRATIONS__PREBID__BIDDERS=kargo,rubicon,appnexus
+```
+
+## Key Configuration Sections
+
+### Publisher Settings
+
+Core settings for your publisher domain and origin.
+
+```toml
+[publisher]
+domain = "publisher.com"
+cookie_domain = ".publisher.com"
+origin_url = "https://origin.publisher.com"
+proxy_secret = "secure-random-secret"
+```
+
+**Key Fields**:
+- `domain` - Your publisher domain
+- `cookie_domain` - Domain for synthetic ID cookies (use `.domain.com` for subdomains)
+- `origin_url` - Backend origin server URL
+- `proxy_secret` - Secret for signing proxy URLs (HMAC-SHA256)
+
+::: warning Security
+Generate `proxy_secret` with cryptographically random values:
+```bash
+openssl rand -base64 32
+```
+:::
+
+### Synthetic IDs
+
+Configure privacy-preserving ID generation.
+
+```toml
+[synthetic]
+counter_store = "counter_store"
+opid_store = "opid_store"
+secret_key = "your-hmac-secret"
+template = "{{ client_ip }}:{{ user_agent }}:{{ first_party_id }}"
+```
+
+**Template Variables**:
+- `client_ip` - Client IP address
+- `user_agent` - User-Agent header
+- `first_party_id` - Publisher-provided ID
+- `auth_user_id` - Authenticated user ID
+- `publisher_domain` - Publisher domain
+- `accept_language` - Accept-Language header
+
+See [Synthetic IDs](/guide/synthetic-ids) for details.
+
+### Request Signing
+
+Enable Ed25519 request signing and JWKS management.
+
+```toml
+[request_signing]
+enabled = true
+config_store_id = "01GXXX"  # From Fastly dashboard
+secret_store_id = "01GYYY"  # From Fastly dashboard
+```
+
+**Setup**:
+1. Create Fastly Config Store for JWKS
+2. Create Fastly Secret Store for private keys
+3. Copy store IDs to configuration
+4. Enable request signing
+
+See [Request Signing](/guide/request-signing) and [Key Rotation](/guide/key-rotation) for setup.
+
+### Integrations
+
+Configure built-in integrations.
+
+**Prebid**:
+```toml
+[integrations.prebid]
+enabled = true
+server_url = "https://prebid-server.com/openrtb2/auction"
+timeout_ms = 1200
+bidders = ["kargo", "rubicon", "appnexus"]
+auto_configure = false
+```
+
+**Next.js**:
+```toml
+[integrations.nextjs]
+enabled = true
+rewrite_attributes = ["href", "link", "url"]
+```
+
+**Permutive**:
+```toml
+[integrations.permutive]
+enabled = true
+organization_id = "org-12345"
+workspace_id = "ws-67890"
+project_id = "proj-abcde"
+```
+
+See [Integration Guide](/guide/integration-guide) for custom integrations.
+
+## Fastly Store Setup
+
+### KV Stores
+
+Create stores for synthetic ID data:
+
+```bash
+# Create counter store
+fastly kv-store create --name=counter_store
+
+# Create publisher ID mapping store
+fastly kv-store create --name=opid_store
+```
+
+**Link to Service** (`fastly.toml`):
+```toml
+[local_server.kv_stores.counter_store]
+  file = "test-data/counter_store.json"
+
+[local_server.kv_stores.opid_store]
+  file = "test-data/opid_store.json"
+```
+
+### Config Stores
+
+For JWKS public keys:
+
+```bash
+# Create config store
+fastly config-store create --name=jwks_store
+
+# Get store ID
+fastly config-store list
+```
+
+### Secret Stores
+
+For private signing keys:
+
+```bash
+# Create secret store
+fastly secret-store create --name=signing_keys
+
+# Get store ID
+fastly secret-store list
+```
+
+## Validation
+
+### Automatic Validation
+
+Configuration is validated at application startup:
+
+**Checks**:
+- Required fields present
+- Data types correct
+- Regex patterns valid
+- Secret keys not default values
+- Integration configs valid
+
+**Failure Behavior**: Application exits with error message.
+
+### Manual Validation
+
+Validate before deployment:
+
+```bash
+# Test TOML syntax
+fastly compute validate
+
+# Test with local server
+fastly compute serve
+```
+
+## Secrets Management
+
+### Best Practices
+
+**Development**:
+```bash
+# Use simple secrets for local dev
+TRUSTED_SERVER__PUBLISHER__PROXY_SECRET=dev-secret
+```
+
+**Staging/Production**:
+```bash
+# Load from secure sources
+TRUSTED_SERVER__PUBLISHER__PROXY_SECRET=$(cat /run/secrets/proxy_secret)
+TRUSTED_SERVER__SYNTHETIC__SECRET_KEY=$(vault kv get -field=value secret/synthetic_key)
+```
+
+**Do**:
+✅ Use environment variables for secrets  
+✅ Generate cryptographically random values  
+✅ Rotate secrets periodically  
+✅ Store in Fastly Secret Store or Vault  
+✅ Use different secrets per environment  
+
+**Don't**:
+❌ Commit secrets to version control  
+❌ Use default placeholder values  
+❌ Share secrets across environments  
+❌ Log secret values  
+
+### `.gitignore`
+
+Protect secret files:
+
+```
+.env.production
+.env.staging
+.env.local
+*.secret
+trusted-server.production.toml
+```
+
+## Configuration Patterns
+
+### Multi-Environment Setup
+
+**Directory Structure**:
+```
+project/
+├── trusted-server.toml           # Base config
+├── trusted-server.dev.toml       # Development overrides
+├── .env.development              # Dev environment vars
+├── .env.staging                  # Staging environment vars
+├── .env.production               # Production (not in git)
+├── .env.example                  # Template (in git)
+└── .gitignore
+```
+
+**Base Config** (`trusted-server.toml`):
+```toml
+# Shared across all environments
+[synthetic]
+template = "{{ client_ip }}:{{ user_agent }}"
+
+[integrations.prebid]
+timeout_ms = 1200
+bidders = ["kargo", "rubicon"]
+```
+
+**Environment Overrides**:
+```bash
+# Development
+export TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=http://localhost:3000
+
+# Staging
+export TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=https://staging.publisher.com
+
+# Production
+export TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=https://origin.publisher.com
+```
+
+### Dynamic Configuration
+
+Use environment variables for runtime changes:
+
+```bash
+# Enable/disable features
+TRUSTED_SERVER__REQUEST_SIGNING__ENABLED=true
+
+# Adjust timeouts
+TRUSTED_SERVER__INTEGRATIONS__PREBID__TIMEOUT_MS=1500
+
+# Update endpoints
+TRUSTED_SERVER__INTEGRATIONS__PREBID__SERVER_URL=https://new-prebid.com/auction
+```
+
+## Troubleshooting
+
+### Common Issues
+
+**"Failed to build configuration"**:
+- Check TOML syntax (commas, quotes, brackets)
+- Verify all required fields present
+- Check environment variable format
+
+**"Secret key is not valid"**:
+- Cannot use `"secret-key"` placeholder
+- Must be non-empty
+- Change to secure random value
+
+**"Invalid regex"**:
+- Handler `path` must be valid regex
+- Escape special characters: `\.`, `\$`
+- Test with: `echo "pattern" | grep -E "pattern"`
+
+**Environment variables not applied**:
+- Verify prefix: `TRUSTED_SERVER__`
+- Check separator: `__` (double underscore)
+- Confirm exported: `echo $VAR_NAME`
+
+### Debug Commands
+
+**Check environment**:
+```bash
+env | grep TRUSTED_SERVER
+```
+
+**Validate TOML**:
+```bash
+cat trusted-server.toml | npx toml-cli validate
+```
+
+**Test local server**:
+```bash
+fastly compute serve --verbose
+```
+
+## Next Steps
+
+- See [Configuration Reference](/guide/configuration-reference) for complete options
+- Set up [Request Signing](/guide/request-signing) for secure API calls
+- Configure [First-Party Proxy](/guide/first-party-proxy) for URL proxying
+- Learn about [Integration Guide](/guide/integration-guide) for custom integrations
+- Review [Testing](/guide/testing) for validation strategies
diff --git a/docs/guide/creative-processing.md b/docs/guide/creative-processing.md
new file mode 100644
index 0000000..f7bca18
--- /dev/null
+++ b/docs/guide/creative-processing.md
@@ -0,0 +1,817 @@
+# Creative Processing
+
+Learn how Trusted Server automatically rewrites ad creative HTML and CSS to route all resources through first-party domains.
+
+## Overview
+
+Creative processing transforms third-party ad creatives by rewriting URLs to go through your first-party domain. This provides:
+
+- **Privacy Control** - All resources load through your domain
+- **First-Party Context** - Cookies and storage use your domain
+- **Synthetic ID Integration** - Automatic ID forwarding to trackers
+- **Security** - Validated, signed URLs prevent tampering
+- **GDPR Compliance** - Controlled data sharing
+
+## How It Works
+
+```
+┌──────────────────────────────────────────────────────┐
+│  Original Creative HTML                              │
+│  <img src="https://tracker.com/pixel.gif">          │
+│  <iframe src="https://cdn.com/ad.html">             │
+│  <style> .bg { background: url(cdn.com/bg.jpg); }   │
+└──────────────────────────────────────────────────────┘
+                        ↓
+┌──────────────────────────────────────────────────────┐
+│  Trusted Server Processing                           │
+│  1. Parse HTML with streaming processor              │
+│  2. Detect absolute/protocol-relative URLs           │
+│  3. Generate signed proxy URLs                       │
+│  4. Rewrite in-place                                 │
+│  5. Inject TSJS library                              │
+└──────────────────────────────────────────────────────┘
+                        ↓
+┌──────────────────────────────────────────────────────┐
+│  Rewritten Creative HTML                             │
+│  <img src="/first-party/proxy?tsurl=...&tstoken=sig">│
+│  <iframe src="/first-party/proxy?tsurl=...&token=sig">│
+│  <style> .bg { background: url(/first-party/proxy...) }│
+└──────────────────────────────────────────────────────┘
+```
+
+## Processing Triggers
+
+Creative processing is automatically triggered when:
+
+1. **Content-Type Header**: Response is `text/html` or `text/css`
+2. **Proxy Mode**: Request goes through `/first-party/proxy` (not streaming)
+3. **Integration Response**: Integration returns HTML content
+
+::: info Streaming Mode
+When `with_streaming()` is enabled in `ProxyRequestConfig`, HTML/CSS processing is **skipped** to preserve origin compression and reduce latency. Use for binary files, large responses, or when rewriting isn't needed.
+:::
+
+## Rewritten Elements
+
+### Images
+
+**Elements**: `<img>`, `<input type="image">`
+
+**Attributes**:
+- `src` - Primary image source
+- `data-src` - Lazy-loading source
+- `srcset` - Responsive image sources
+- `imagesrcset` - Image set (used in `<link>`)
+
+**Example**:
+```html
+<!-- Original -->
+<img src="https://cdn.example.com/banner.jpg" 
+     srcset="https://cdn.example.com/banner@1x.jpg 1x,
+             https://cdn.example.com/banner@2x.jpg 2x">
+
+<!-- Rewritten -->
+<img src="/first-party/proxy?tsurl=https://cdn.example.com/banner.jpg&tstoken=sig1"
+     srcset="/first-party/proxy?tsurl=https://cdn.example.com/banner@1x.jpg&tstoken=sig2 1x,
+             /first-party/proxy?tsurl=https://cdn.example.com/banner@2x.jpg&tstoken=sig3 2x">
+```
+
+### Scripts
+
+**Elements**: `<script>`
+
+**Attributes**:
+- `src` - Script source URL
+
+**Example**:
+```html
+<!-- Original -->
+<script src="https://cdn.example.com/tracker.js"></script>
+
+<!-- Rewritten -->
+<script src="/first-party/proxy?tsurl=https://cdn.example.com/tracker.js&tstoken=sig"></script>
+```
+
+### Media Elements
+
+**Elements**: `<video>`, `<audio>`, `<source>`
+
+**Attributes**:
+- `src` - Media source URL
+
+**Example**:
+```html
+<!-- Original -->
+<video>
+  <source src="https://cdn.example.com/video.mp4" type="video/mp4">
+</video>
+
+<!-- Rewritten -->
+<video>
+  <source src="/first-party/proxy?tsurl=https://cdn.example.com/video.mp4&tstoken=sig" type="video/mp4">
+</video>
+```
+
+### Embedded Objects
+
+**Elements**: `<object>`, `<embed>`
+
+**Attributes**:
+- `data` - Object data source (`<object>`)
+- `src` - Embed source (`<embed>`)
+
+**Example**:
+```html
+<!-- Original -->
+<object data="https://example.com/flash.swf"></object>
+<embed src="https://example.com/media.swf">
+
+<!-- Rewritten -->
+<object data="/first-party/proxy?tsurl=https://example.com/flash.swf&tstoken=sig"></object>
+<embed src="/first-party/proxy?tsurl=https://example.com/media.swf&tstoken=sig">
+```
+
+### Iframes
+
+**Elements**: `<iframe>`
+
+**Attributes**:
+- `src` - Frame source URL
+
+**Example**:
+```html
+<!-- Original -->
+<iframe src="https://advertiser.com/creative.html"></iframe>
+
+<!-- Rewritten -->
+<iframe src="/first-party/proxy?tsurl=https://advertiser.com/creative.html&tstoken=sig"></iframe>
+```
+
+::: warning Nested Iframes
+If the iframe content itself contains HTML, it will be processed recursively. Each level of nesting gets its own URL rewriting pass.
+:::
+
+### Links
+
+**Elements**: `<link>`
+
+**Attributes**:
+- `href` - Link target (stylesheets, preload, prefetch)
+- `imagesrcset` - Responsive images in link preload
+
+**Conditions**: Only rewritten when `rel` attribute matches:
+- `stylesheet`
+- `preload`
+- `prefetch`
+
+**Example**:
+```html
+<!-- Original -->
+<link rel="stylesheet" href="https://cdn.example.com/styles.css">
+<link rel="preload" href="https://cdn.example.com/font.woff2" as="font">
+
+<!-- Rewritten -->
+<link rel="stylesheet" href="/first-party/proxy?tsurl=https://cdn.example.com/styles.css&tstoken=sig">
+<link rel="preload" href="/first-party/proxy?tsurl=https://cdn.example.com/font.woff2&tstoken=sig" as="font">
+```
+
+### Anchors (Click Tracking)
+
+**Elements**: `<a>`, `<area>`
+
+**Attributes**:
+- `href` - Link destination
+
+**Rewrite Mode**: Uses `/first-party/click` for direct redirects
+
+**Example**:
+```html
+<!-- Original -->
+<a href="https://advertiser.com/product?id=123">Buy Now</a>
+
+<!-- Rewritten -->
+<a href="/first-party/click?tsurl=https://advertiser.com/product&id=123&tstoken=sig">Buy Now</a>
+```
+
+::: tip Click vs Proxy
+Anchors (`<a>`) use `/first-party/click` for 302 redirects, avoiding content downloads. Other elements use `/first-party/proxy` to fetch and potentially rewrite content.
+:::
+
+### SVG Elements
+
+**Elements**: SVG `<image>`, `<use>`
+
+**Attributes**:
+- `href` - SVG 2.0 syntax
+- `xlink:href` - SVG 1.1 legacy syntax
+
+**Example**:
+```html
+<!-- Original -->
+<svg>
+  <image href="https://cdn.example.com/icon.svg" />
+  <use xlink:href="https://cdn.example.com/sprite.svg#icon" />
+</svg>
+
+<!-- Rewritten -->
+<svg>
+  <image href="/first-party/proxy?tsurl=https://cdn.example.com/icon.svg&tstoken=sig" />
+  <use xlink:href="/first-party/proxy?tsurl=https://cdn.example.com/sprite.svg&tstoken=sig#icon" />
+</svg>
+```
+
+### Inline Styles
+
+**Attributes**: `style` attribute on any element
+
+**Patterns**: Rewrites `url(...)` values in CSS
+
+**Example**:
+```html
+<!-- Original -->
+<div style="background: url(https://cdn.example.com/bg.png) no-repeat;">
+
+<!-- Rewritten -->
+<div style="background: url(/first-party/proxy?tsurl=https://cdn.example.com/bg.png&tstoken=sig) no-repeat;">
+```
+
+### Style Blocks
+
+**Elements**: `<style>`
+
+**Patterns**: Rewrites all `url(...)` occurrences in CSS
+
+**Example**:
+```html
+<!-- Original -->
+<style>
+  .header { background-image: url(https://cdn.example.com/header.jpg); }
+  .logo { background: url('https://cdn.example.com/logo.png'); }
+</style>
+
+<!-- Rewritten -->
+<style>
+  .header { background-image: url(/first-party/proxy?tsurl=https://cdn.example.com/header.jpg&tstoken=sig); }
+  .logo { background: url('/first-party/proxy?tsurl=https://cdn.example.com/logo.png&tstoken=sig'); }
+</style>
+```
+
+## URL Detection Rules
+
+### Absolute URLs
+
+**Pattern**: Starts with `http://` or `https://`
+
+**Rewritten**: ✅ Yes
+
+**Examples**:
+```
+✅ https://cdn.example.com/image.png
+✅ http://tracker.example.com/pixel.gif
+❌ /relative/path.jpg (relative)
+❌ ../images/logo.png (relative)
+```
+
+### Protocol-Relative URLs
+
+**Pattern**: Starts with `//`
+
+**Rewritten**: ✅ Yes (normalized to `https://`)
+
+**Examples**:
+```
+Original: //cdn.example.com/script.js
+Normalized: https://cdn.example.com/script.js
+Rewritten: /first-party/proxy?tsurl=https://cdn.example.com/script.js&tstoken=sig
+```
+
+### Relative URLs
+
+**Patterns**:
+- Starts with `/` (absolute path)
+- Starts with `./` or `../` (relative path)
+- No scheme prefix (relative)
+
+**Rewritten**: ❌ No
+
+**Examples**:
+```
+❌ /assets/image.png
+❌ ./local.jpg
+❌ ../parent/file.css
+❌ image.png
+```
+
+::: info Why Skip Relative URLs?
+Relative URLs already point to your domain (publisher origin). Rewriting them would create unnecessary proxy loops and break functionality.
+:::
+
+### Non-Network Schemes
+
+**Skipped Schemes**:
+- `data:` - Data URIs (inline content)
+- `javascript:` - JavaScript execution
+- `mailto:` - Email links
+- `tel:` - Phone numbers
+- `blob:` - Blob objects
+- `about:` - Browser internal pages
+
+**Rewritten**: ❌ No
+
+**Examples**:
+```
+❌ data:image/png;base64,iVBORw0KGgo...
+❌ javascript:void(0)
+❌ mailto:contact@example.com
+❌ tel:+1234567890
+❌ blob:https://example.com/uuid
+❌ about:blank
+```
+
+## Srcset Processing
+
+### Srcset Syntax
+
+Srcset attributes contain comma-separated candidates with optional descriptors:
+
+**Format**: `url descriptor, url descriptor, ...`
+
+**Descriptors**:
+- `1x`, `2x`, `3x` - Pixel density
+- `100w`, `200w` - Width in pixels
+
+### Parsing Rules
+
+**Robust Comma Handling**:
+- Splits on commas with or without spaces
+- Preserves `data:` URIs (doesn't split on internal commas)
+- Handles irregular spacing
+
+**Example**:
+```html
+<!-- Various spacing patterns -->
+srcset="url1.jpg 1x, url2.jpg 2x"  <!-- standard -->
+srcset="url1.jpg 1x,url2.jpg 2x"   <!-- no space after comma -->
+srcset="url1.jpg   1x  ,  url2.jpg  2x"  <!-- extra spaces -->
+```
+
+### Descriptor Preservation
+
+Descriptors are preserved exactly as written:
+
+```html
+<!-- Original -->
+<img srcset="
+  https://cdn.com/small.jpg 480w,
+  https://cdn.com/medium.jpg 800w,
+  https://cdn.com/large.jpg 1200w
+">
+
+<!-- Rewritten -->
+<img srcset="
+  /first-party/proxy?tsurl=https://cdn.com/small.jpg&tstoken=sig1 480w,
+  /first-party/proxy?tsurl=https://cdn.com/medium.jpg&tstoken=sig2 800w,
+  /first-party/proxy?tsurl=https://cdn.com/large.jpg&tstoken=sig3 1200w
+">
+```
+
+### Mixed URL Types
+
+Srcset can mix absolute and relative URLs:
+
+```html
+<!-- Original -->
+<img srcset="
+  /local/small.jpg 1x,
+  https://cdn.com/large.jpg 2x
+">
+
+<!-- Rewritten (only absolute URL) -->
+<img srcset="
+  /local/small.jpg 1x,
+  /first-party/proxy?tsurl=https://cdn.com/large.jpg&tstoken=sig 2x
+">
+```
+
+## CSS URL Rewriting
+
+### url() Syntax Variations
+
+CSS `url()` values support multiple quote styles:
+
+```css
+/* No quotes */
+url(https://example.com/image.png)
+
+/* Single quotes */
+url('https://example.com/image.png')
+
+/* Double quotes */
+url("https://example.com/image.png")
+
+/* With spaces */
+url(  "https://example.com/image.png"  )
+```
+
+**All are rewritten correctly**, preserving the original quote style.
+
+### CSS Properties
+
+Common properties with `url()` values:
+
+```css
+/* Background images */
+background: url(https://cdn.com/bg.jpg);
+background-image: url(https://cdn.com/pattern.png);
+
+/* Borders */
+border-image: url(https://cdn.com/border.svg);
+
+/* List styles */
+list-style-image: url(https://cdn.com/bullet.png);
+
+/* Cursors */
+cursor: url(https://cdn.com/cursor.cur), pointer;
+
+/* Masks */
+mask-image: url(https://cdn.com/mask.svg);
+
+/* Filters */
+filter: url(https://cdn.com/filter.svg#blur);
+```
+
+**All `url()` occurrences are rewritten** regardless of property.
+
+### Multiple url() Values
+
+Properties can have multiple `url()` values:
+
+```css
+/* Original */
+.element {
+  background: 
+    url(https://cdn.com/top.png) top,
+    url(https://cdn.com/bottom.png) bottom;
+}
+
+/* Rewritten */
+.element {
+  background: 
+    url(/first-party/proxy?tsurl=https://cdn.com/top.png&tstoken=sig1) top,
+    url(/first-party/proxy?tsurl=https://cdn.com/bottom.png&tstoken=sig2) bottom;
+}
+```
+
+### @import Rules
+
+CSS `@import` with URLs:
+
+```css
+/* Original */
+@import url(https://fonts.googleapis.com/css?family=Roboto);
+
+/* Rewritten */
+@import url(/first-party/proxy?tsurl=https://fonts.googleapis.com/css?family=Roboto&tstoken=sig);
+```
+
+## Exclude Domains
+
+### Configuration
+
+Prevent specific domains from being rewritten:
+
+```toml
+[rewrite]
+exclude_domains = [
+  "*.cdn.trusted-partner.com",  # Wildcard pattern
+  "first-party.example.com",    # Exact match
+  "localhost",                  # Development
+]
+```
+
+### Pattern Matching
+
+**Wildcard Patterns**: `*` matches any subdomain
+
+```
+Pattern: *.cdn.example.com
+Matches:
+  ✅ assets.cdn.example.com
+  ✅ images.cdn.example.com
+  ❌ cdn.example.com (no subdomain)
+  ❌ cdn.example.com.evil.com (different domain)
+```
+
+**Exact Patterns**: No `*` requires exact host match
+
+```
+Pattern: api.example.com
+Matches:
+  ✅ api.example.com
+  ❌ www.api.example.com
+  ❌ api.example.com.evil.com
+```
+
+### Use Cases
+
+**Trusted Partners**:
+```toml
+exclude_domains = ["*.trusted-cdn.com"]
+```
+Skip rewriting for partners already providing first-party scripts.
+
+**Development**:
+```toml
+exclude_domains = ["localhost", "127.0.0.1"]
+```
+Avoid proxying local development servers.
+
+**Same-Origin Resources**:
+```toml
+exclude_domains = ["assets.publisher.com"]
+```
+Skip resources already on your domain.
+
+## Integration Hooks
+
+### Attribute Rewriters
+
+Integrations can override attribute rewriting:
+
+**Example**: Next.js integration rewrites origin URLs
+
+```rust
+impl IntegrationAttributeRewriter for NextJsIntegration {
+    fn rewrite(&self, attr_name: &str, attr_value: &str, ctx: &Context) 
+        -> AttributeRewriteAction 
+    {
+        if attr_name == "href" && attr_value.contains(&ctx.origin_host) {
+            let rewritten = attr_value.replace(&ctx.origin_host, &ctx.request_host);
+            return AttributeRewriteAction::replace(rewritten);
+        }
+        AttributeRewriteAction::keep()
+    }
+}
+```
+
+**Actions**:
+- `keep()` - Leave attribute unchanged
+- `replace(value)` - Change attribute value
+- `remove_element()` - Delete entire element
+
+### Script Rewriters
+
+Integrations can modify `<script>` content:
+
+**Example**: Next.js rewrites `__NEXT_DATA__` JSON
+
+```rust
+impl IntegrationScriptRewriter for NextJsIntegration {
+    fn selector(&self) -> &'static str {
+        "script#__NEXT_DATA__"
+    }
+    
+    fn rewrite(&self, content: &str, ctx: &Context) -> ScriptRewriteAction {
+        let rewritten = rewrite_next_data_urls(content, ctx);
+        ScriptRewriteAction::replace(rewritten)
+    }
+}
+```
+
+**Actions**:
+- `keep()` - Leave script unchanged
+- `replace(content)` - Replace script content
+- `remove_node()` - Delete script element
+
+See [Integration Guide](/guide/integration-guide) for creating custom rewriters.
+
+## TSJS Injection
+
+### Automatic Injection
+
+The Trusted Server JavaScript (TSJS) library is automatically injected:
+
+**Location**: Start of `<head>` element
+
+**Tag**:
+```html
+<script async src="/static/tsjs-core.min.js" data-tsjs-integration="core"></script>
+```
+
+**Timing**: Injected **once per HTML response** before any other scripts.
+
+### Integration Bundles
+
+Integrations can request additional bundles:
+
+```rust
+IntegrationRegistration::builder("my_integration")
+    .with_asset("my_integration")  // Requests tsjs-my_integration.min.js
+    .build()
+```
+
+**Result**:
+```html
+<head>
+  <script async src="/static/tsjs-core.min.js" data-tsjs-integration="core"></script>
+  <script async src="/static/tsjs-my_integration.min.js" data-tsjs-integration="my_integration"></script>
+  <!-- Rest of head content -->
+</head>
+```
+
+### Bundle Types
+
+Available bundles (from `crates/js/lib/src/integrations/`):
+
+- `tsjs-core.min.js` - Core API (always included)
+- `tsjs-ext.min.js` - Extensions (Prebid integration)
+- `tsjs-creative.min.js` - Creative tracking utilities
+- `tsjs-permutive.min.js` - Permutive integration
+- `tsjs-testlight.min.js` - Testlight integration
+
+## Performance Optimization
+
+### Streaming Processing
+
+HTML is processed in **chunks** (default 8192 bytes):
+
+**Benefits**:
+- Low memory footprint
+- Handles large creatives
+- Incremental output
+- Fast first byte
+
+**Trade-offs**:
+- Cannot access full DOM
+- Element-by-element processing
+- No look-ahead
+
+### Compression
+
+**Buffered Mode** (with rewriting):
+```
+Origin Response (gzipped)
+  ↓ Decompress
+Processing
+  ↓ Rewrite URLs
+Response (uncompressed)
+  ↓ Fastly edge can re-compress
+Client
+```
+
+**Streaming Mode** (no rewriting):
+```
+Origin Response (gzipped)
+  ↓ Passthrough
+Client (stays gzipped)
+```
+
+Use streaming for binary/large files to preserve compression.
+
+### Caching
+
+Rewritten creatives can be cached:
+
+**Cache Key Components**:
+- Original creative URL
+- Publisher domain
+- Integration configuration
+
+**Headers to Set**:
+```http
+Cache-Control: public, max-age=3600
+Vary: Accept-Encoding
+```
+
+## Debugging
+
+### Logging
+
+Enable debug logging for rewrite operations:
+
+```rust
+log::debug!("creative: rewriting {} -> {}", original_url, proxy_url);
+log::debug!("creative: excluded domain {}", url);
+log::debug!("creative: skipped non-network scheme {}", url);
+```
+
+### Testing Rewrites
+
+**Manual Testing**:
+1. Save original creative HTML to file
+2. Pass through rewrite function
+3. Compare output
+
+```rust
+let original = "<img src=\"https://tracker.com/pixel.gif\">";
+let rewritten = rewrite_creative_html(original, &settings);
+assert!(rewritten.contains("/first-party/proxy"));
+```
+
+**Integration Tests**:
+```rust
+#[test]
+fn test_image_src_rewrite() {
+    let html = r#"<img src="https://cdn.example.com/banner.jpg">"#;
+    let result = rewrite_creative_html(html, &test_settings());
+    assert!(result.contains("/first-party/proxy?tsurl="));
+    assert!(result.contains("&tstoken="));
+}
+```
+
+### Common Issues
+
+**Relative URLs Not Working**:
+- Ensure origin response includes proper `<base>` tag
+- Or convert to absolute URLs before rewriting
+
+**Data URIs Being Rewritten**:
+- Should be automatically skipped
+- Check for malformed `data:` scheme
+
+**Srcset Parsing Errors**:
+- Verify comma-separated format
+- Check for unclosed quotes
+
+## Security Considerations
+
+### URL Validation
+
+All rewritten URLs are validated:
+
+1. **Scheme Check**: Only `http://` and `https://`
+2. **Signature**: HMAC-SHA256 token required
+3. **Expiration**: Optional `tsexp` timestamp
+4. **Exclusion List**: Configurable domain blacklist
+
+### Content Security Policy
+
+Recommended CSP headers for rewritten creatives:
+
+```http
+Content-Security-Policy: 
+  default-src 'self';
+  img-src 'self' /first-party/proxy;
+  script-src 'self' /static/tsjs;
+  style-src 'self' 'unsafe-inline';
+  frame-src 'self' /first-party/proxy;
+```
+
+### Injection Prevention
+
+**Automatic Protection**:
+- URLs are properly encoded
+- No raw user input in rewrites
+- Signature prevents tampering
+
+**Manual Checks**:
+- Validate origin creative sources
+- Sanitize user-generated content
+- Monitor for suspicious patterns
+
+## Best Practices
+
+### Configuration
+
+✅ **Do**:
+- Use strong `proxy_secret` (32+ bytes random)
+- Exclude trusted first-party domains
+- Set appropriate cache headers
+- Test rewrites before production
+
+❌ **Don't**:
+- Hardcode secrets in source
+- Rewrite same-origin URLs unnecessarily
+- Skip signature validation
+- Disable TSJS injection without reason
+
+### Performance
+
+✅ **Do**:
+- Use streaming for large/binary responses
+- Enable compression at edge
+- Cache rewritten creatives
+- Monitor rewrite latency
+
+❌ **Don't**:
+- Buffer entire response unnecessarily
+- Rewrite on every request (cache!)
+- Process non-HTML/CSS with rewriter
+- Chain multiple rewrites
+
+### Monitoring
+
+Track these metrics:
+
+- **Rewrite operations** - Count of rewrites per request
+- **Excluded domains** - Frequency of exclusions
+- **Processing time** - Latency added by rewriting
+- **Cache hit rate** - Effectiveness of caching
+- **TSJS injection** - Verify library loads
+
+## Next Steps
+
+- Learn about [First-Party Proxy](/guide/first-party-proxy) for URL handling
+- Review [Integration Guide](/guide/integration-guide) for custom rewriters
+- Set up [Configuration](/guide/configuration) for your creatives
+- Explore [Synthetic IDs](/guide/synthetic-ids) for identity management
diff --git a/docs/guide/first-party-proxy.md b/docs/guide/first-party-proxy.md
new file mode 100644
index 0000000..c3f1167
--- /dev/null
+++ b/docs/guide/first-party-proxy.md
@@ -0,0 +1,651 @@
+# First-Party Proxy
+
+Learn how Trusted Server proxies third-party assets through first-party domains to improve privacy, security, and ad performance.
+
+## Overview
+
+The First-Party Proxy system rewrites third-party URLs in ad creatives to route through your domain, providing:
+
+- **Privacy Protection** - No direct third-party cookies or tracking
+- **Synthetic ID Forwarding** - Controlled identity propagation
+- **Creative Rewrites** - Automatic HTML/CSS URL transformation  
+- **Click Tracking** - First-party click redirects
+- **Content Security** - Validated, signed URLs prevent tampering
+
+## How It Works
+
+```
+┌──────────────────────────────────────────────────┐
+│  Ad Creative (Original)                          │
+│  <img src="https://tracker.com/pixel.gif">      │
+└──────────────────────────────────────────────────┘
+                     ↓ Rewrite
+┌──────────────────────────────────────────────────┐
+│  Ad Creative (Rewritten)                         │
+│  <img src="/first-party/proxy?                   │
+│    tsurl=https://tracker.com/pixel.gif&          │
+│    tstoken=abc123...">                           │
+└──────────────────────────────────────────────────┘
+                     ↓ Browser Request
+┌──────────────────────────────────────────────────┐
+│  Trusted Server                                  │
+│  1. Validate tstoken signature                   │
+│  2. Append synthetic_id parameter                │
+│  3. Proxy to tracker.com                         │
+│  4. Return response                              │
+└──────────────────────────────────────────────────┘
+```
+
+## Core Endpoints
+
+### `/first-party/proxy` - Asset Proxy
+
+Proxies third-party assets with automatic HTML/CSS rewriting.
+
+**Request**:
+```
+GET /first-party/proxy?tsurl=https://example.com/ad.html&tstoken=signature
+```
+
+**Query Parameters**:
+| Parameter | Required | Description |
+|-----------|----------|-------------|
+| `tsurl` | Yes | Base URL of the resource (without query params) |
+| `tstoken` | Yes | HMAC-SHA256 signature of the full URL |
+| `tsexp` | No | Unix timestamp expiration (30s default from signing) |
+| *(others)* | No | Original query parameters from target URL |
+
+**Behavior**:
+
+1. **Validates** the `tstoken` signature against reconstructed URL
+2. **Appends** `synthetic_id` query parameter (if available)
+3. **Proxies** request to target URL with forwarded headers:
+   - `User-Agent`
+   - `Accept`
+   - `Accept-Language`
+   - `Accept-Encoding`
+   - `Referer`
+   - `X-Forwarded-For`
+4. **Processes** response based on content type:
+   - **HTML** (`text/html`) - Rewrites all URLs, returns `text/html`
+   - **CSS** (`text/css`) - Rewrites `url()` values, returns `text/css`
+   - **Images** - Detects pixels, sets `image/*` if missing
+   - **Other** - Passthrough without modification
+
+**Example**:
+
+Original URL:
+```
+https://tracker.com/pixel.gif?campaign=123&uid=abc
+```
+
+Signed proxy URL:
+```
+/first-party/proxy?
+  tsurl=https://tracker.com/pixel.gif&
+  campaign=123&
+  uid=abc&
+  tstoken=HmacSha256Signature
+```
+
+Final proxied request:
+```
+https://tracker.com/pixel.gif?campaign=123&uid=abc&synthetic_id=xyz
+```
+
+### `/first-party/click` - Click Redirects
+
+Handles click tracking with first-party redirects.
+
+**Request**:
+```
+GET /first-party/click?tsurl=https://advertiser.com/landing&tstoken=signature
+```
+
+**Query Parameters**: Same as `/first-party/proxy`
+
+**Behavior**:
+
+1. **Validates** the `tstoken` signature
+2. **Appends** `synthetic_id` parameter to target URL
+3. **Issues** 302 redirect to target (browser navigates directly)
+4. **Logs** click metadata:
+   - Target URL base (`tsurl`)
+   - Whether parameters were present
+   - Full reconstructed URL
+   - Referer, User-Agent
+   - Synthetic ID (if available)
+
+**Example**:
+
+Click URL in creative:
+```html
+<a href="/first-party/click?
+  tsurl=https://advertiser.com/buy&
+  product=widget&
+  tstoken=signature">
+  Buy Now
+</a>
+```
+
+User clicks → Server responds:
+```
+HTTP/1.1 302 Found
+Location: https://advertiser.com/buy?product=widget&synthetic_id=xyz
+```
+
+::: tip Click vs Proxy
+Use `/first-party/click` for navigational links (anchors) since it avoids downloading content. Use `/first-party/proxy` for embedded resources (images, scripts, iframes) that need to be rendered inline.
+:::
+
+### `/first-party/sign` - URL Signing
+
+Generates signed proxy URLs for dynamic use cases.
+
+**Request (GET)**:
+```
+GET /first-party/sign?url=https://example.com/resource.jpg
+```
+
+**Request (POST)**:
+```json
+POST /first-party/sign
+{
+  "url": "https://example.com/resource.jpg?param=value"
+}
+```
+
+**Response**:
+```json
+{
+  "href": "/first-party/proxy?tsurl=https://example.com/resource.jpg&param=value&tstoken=signature&tsexp=1234567890",
+  "base": "https://example.com/resource.jpg"
+}
+```
+
+**Response Fields**:
+| Field | Description |
+|-------|-------------|
+| `href` | Complete signed proxy URL ready to use |
+| `base` | Original base URL (without query parameters) |
+
+**Expiration**:
+- Default: 30 seconds from signing
+- `tsexp` parameter included in signed URL
+- Validation fails after expiration
+
+**Example Usage**:
+
+```javascript
+// Client-side JavaScript dynamically signing URLs
+fetch('/first-party/sign?url=' + encodeURIComponent(imageUrl))
+  .then(r => r.json())
+  .then(data => {
+    img.src = data.href; // Use signed URL
+  });
+```
+
+### `/first-party/proxy-rebuild` - URL Modification
+
+Modifies existing signed URLs by adding or removing parameters.
+
+**Request**:
+```
+POST /first-party/proxy-rebuild?tsclick=encoded_click_url&add=key:value&del=key
+```
+
+**Query Parameters**:
+| Parameter | Required | Description |
+|-----------|----------|-------------|
+| `tsclick` | Yes | Base64-encoded original click/proxy URL |
+| `add` | No | Parameter to add (format: `key:value`) |
+| `del` | No | Parameter key to remove |
+
+**Behavior**:
+
+1. **Decodes** the `tsclick` base64 URL
+2. **Parses** existing parameters
+3. **Adds** specified parameters (`add`)
+4. **Removes** specified parameters (`del`)
+5. **Re-signs** the modified URL
+6. **Returns** new signed URL
+
+**Example**:
+
+Original click URL:
+```
+/first-party/click?tsurl=https://example.com&product=A&tstoken=sig1
+```
+
+Modify URL (add `variant=red`, remove `product`):
+```
+POST /first-party/proxy-rebuild?
+  tsclick=L2ZpcnN0LXBhcnR5L2NsaWNrP3RzdXJsPWh0dHBzOi8vZXhhbXBsZS5jb20mcHJvZHVjdD1BJnRzdG9rZW49c2lnMQ==&
+  add=variant:red&
+  del=product
+```
+
+Response:
+```json
+{
+  "href": "/first-party/click?tsurl=https://example.com&variant=red&tstoken=sig2"
+}
+```
+
+::: warning Use Cases
+This endpoint is designed for advanced scenarios like A/B testing where you need to modify URLs without re-signing from scratch. Most implementations won't need this.
+:::
+
+## URL Signing & Validation
+
+### Signature Generation
+
+Signatures use HMAC-SHA256 with the publisher's `proxy_secret`:
+
+```
+1. Reconstruct full URL: tsurl + query params (sorted)
+2. Encrypt with XChaCha20-Poly1305 (deterministic nonce)
+3. Hash encrypted bytes with SHA-256
+4. Base64 URL-safe encode (no padding)
+5. Result = tstoken
+```
+
+**Configuration**:
+```toml
+[publisher]
+proxy_secret = "your-secret-key-here"  # Must be secure random string
+```
+
+### Signature Validation
+
+On incoming requests:
+
+```
+1. Extract tsurl and all query params (except tstoken, tsexp)
+2. Reconstruct full URL in same order
+3. Compute expected tstoken using proxy_secret
+4. Compare with provided tstoken (constant-time)
+5. Check tsexp hasn't passed (if present)
+6. Reject if mismatch or expired
+```
+
+::: danger Security
+- Keep `proxy_secret` confidential and secure
+- Rotate secrets periodically
+- Never expose in client-side code
+- Use strong random values (32+ bytes)
+:::
+
+## Content Type Handling
+
+### HTML Rewriting
+
+**Triggers**: Response `Content-Type: text/html`
+
+**Process**:
+1. Parse HTML with streaming processor
+2. Rewrite absolute URLs to `/first-party/proxy` or `/first-party/click`
+3. Preserve relative URLs unchanged
+4. Sign all rewritten URLs with `tstoken`
+5. Return as `text/html; charset=utf-8`
+
+**Rewritten Elements**: See [Creative Processing](/guide/creative-processing) for full list.
+
+### CSS Rewriting
+
+**Triggers**: Response `Content-Type: text/css`
+
+**Process**:
+1. Parse CSS for `url(...)` values
+2. Rewrite absolute URLs to `/first-party/proxy`
+3. Sign URLs with `tstoken`
+4. Return as `text/css; charset=utf-8`
+
+**Example**:
+```css
+/* Original */
+.banner { background: url(https://cdn.com/bg.jpg); }
+
+/* Rewritten */
+.banner { background: url(/first-party/proxy?tsurl=https://cdn.com/bg.jpg&tstoken=sig); }
+```
+
+### Image Handling
+
+**Triggers**: 
+- Response `Content-Type: image/*`, OR
+- Request `Accept` header contains `image/`
+
+**Process**:
+1. Set `Content-Type: image/*` if missing
+2. Detect likely pixels with heuristics:
+   - `Content-Length` ≤ 256 bytes
+   - URL contains `/pixel`, `/p.gif`, `/1x1`, `/track`
+3. Log pixel detection (no response alteration)
+4. Passthrough image data
+
+**Logging**:
+```
+proxy: likely pixel detected size=43 url=https://tracker.com/p.gif
+```
+
+### Passthrough (Other Types)
+
+**Triggers**: Any other `Content-Type`
+
+**Process**:
+- Forward response without modification
+- Preserve original `Content-Type`
+- No HTML/CSS/URL rewriting
+- Useful for: JSON, JavaScript, binary files, etc.
+
+## Redirect Handling
+
+The proxy automatically follows HTTP redirects:
+
+**Supported Status Codes**:
+- `301` - Moved Permanently
+- `302` - Found
+- `303` - See Other (switches to GET)
+- `307` - Temporary Redirect
+- `308` - Permanent Redirect
+
+**Behavior**:
+1. Follow up to **4 redirect hops**
+2. Re-apply `synthetic_id` on each hop
+3. Switch to `GET` after `303` response
+4. Log when redirect limit reached
+5. Preserve request headers across hops
+
+**Example Flow**:
+```
+Request: /first-party/proxy?tsurl=https://short.link&tstoken=sig
+  → 302 to https://cdn.com/ad.html
+  → 200 with HTML content
+  → Rewrite HTML and return
+```
+
+## Synthetic ID Propagation
+
+### Automatic Forwarding
+
+When proxying, Trusted Server automatically appends the `synthetic_id` parameter:
+
+**Source Priority**:
+1. `x-psid-ts` request header
+2. `synthetic_id` cookie
+3. Generate new ID if missing
+
+**Example**:
+```
+Original request to proxy:
+  /first-party/proxy?tsurl=https://tracker.com/pixel.gif&tstoken=sig
+  Cookie: synthetic_id=user123
+
+Proxied backend request:
+  https://tracker.com/pixel.gif?synthetic_id=user123
+```
+
+### Redirect Propagation
+
+Synthetic IDs are re-applied on **every redirect hop**:
+
+```
+/first-party/proxy?tsurl=https://redirect1.com&tstoken=sig
+  → https://redirect1.com?synthetic_id=user123
+  → 302 to https://redirect2.com
+  → https://redirect2.com?synthetic_id=user123
+  → 302 to https://final.com
+  → https://final.com?synthetic_id=user123
+  → 200 response
+```
+
+This ensures downstream trackers receive consistent IDs even through redirect chains.
+
+### Click ID Forwarding
+
+Click redirects also forward synthetic IDs:
+
+```html
+<a href="/first-party/click?tsurl=https://advertiser.com&tstoken=sig">
+```
+
+User clicks → redirect includes ID:
+```
+302 Found
+Location: https://advertiser.com?synthetic_id=user123
+```
+
+::: tip Privacy Control
+Synthetic IDs are only forwarded when:
+1. User has given GDPR consent (if required)
+2. ID exists in request (header/cookie)
+3. Integration hasn't disabled forwarding (`forward_synthetic_id: false`)
+:::
+
+## Configuration
+
+### Publisher Settings
+
+Configure proxy behavior in `trusted-server.toml`:
+
+```toml
+[publisher]
+domain = "publisher.com"
+origin_url = "https://origin.publisher.com"
+proxy_secret = "your-secure-random-secret"
+cookie_domain = ".publisher.com"  # For synthetic_id cookies
+```
+
+### URL Rewrite Exclusions
+
+Exclude specific domains from rewriting:
+
+```toml
+[rewrite]
+exclude_domains = [
+  "*.cdn.trusted.com",      # Wildcard pattern
+  "first-party.example.com" # Exact match
+]
+```
+
+URLs matching these patterns will NOT be rewritten to `/first-party/proxy`.
+
+### Streaming vs Buffered
+
+Control whether responses are streamed or buffered:
+
+```rust
+// Integration code example
+ProxyRequestConfig::new(url)
+    .with_streaming()  // Enable streaming (no HTML/CSS rewrites)
+```
+
+**Streaming** (buffered rewrites disabled):
+- Preserves origin compression (gzip/brotli)
+- Lower memory usage
+- No HTML/CSS URL rewriting
+- Best for: large files, images, videos
+
+**Buffered** (default):
+- Enables HTML/CSS rewriting
+- Decompresses response
+- Higher memory usage  
+- Best for: ad creatives, landing pages
+
+## Performance Optimization
+
+### Compression
+
+**Buffered Mode**:
+- Decompresses origin response
+- Processes content
+- Returns uncompressed (Fastly can re-compress)
+
+**Streaming Mode**:
+- Preserves origin `Content-Encoding`
+- No decompression/recompression overhead
+- Passes through gzip/brotli/deflate
+
+### Caching
+
+Proxy responses respect origin cache headers:
+- `Cache-Control`
+- `Expires`
+- `ETag`
+- `Last-Modified`
+
+**Best Practices**:
+```http
+Cache-Control: public, max-age=3600
+Vary: Accept-Encoding
+```
+
+### Header Forwarding
+
+Only essential headers are forwarded to reduce overhead:
+
+**Forwarded Headers**:
+- `User-Agent` - Client identification
+- `Accept` - Content negotiation
+- `Accept-Language` - Language preferences
+- `Accept-Encoding` - Compression support
+- `Referer` - Page context
+- `X-Forwarded-For` - Client IP chain
+
+**Not Forwarded**:
+- Authentication headers (unless explicitly added)
+- Cookies (except synthetic ID appended as query param)
+- Custom headers (unless added via `ProxyRequestConfig`)
+
+## Error Handling
+
+### Common Errors
+
+**Invalid Signature**:
+```
+HTTP 403 Forbidden
+tstoken validation failed: signature mismatch
+```
+
+**Solutions**:
+- Verify `proxy_secret` matches signing configuration
+- Check URL reconstruction includes all parameters in correct order
+- Ensure no URL encoding issues
+
+**Expired URL**:
+```
+HTTP 403 Forbidden
+tstoken expired
+```
+
+**Solutions**:
+- URLs signed with `/first-party/sign` expire in 30s
+- Re-sign URL if needed
+- Check client/server clock sync
+
+**Missing Parameters**:
+```
+HTTP 400 Bad Request
+Missing required parameter: tsurl
+```
+
+**Solutions**:
+- Ensure `tsurl` parameter is present
+- Include `tstoken` in request
+- Verify URL encoding is correct
+
+### Redirect Limit
+
+When redirect limit (4 hops) is reached:
+
+```
+Log: proxy: redirect limit reached for url=https://...
+```
+
+Response: Returns last redirect response (302/307/308) without following.
+
+**Solutions**:
+- Contact origin to reduce redirect chain
+- Increase limit in code (modify `MAX_REDIRECTS` constant)
+
+## Security Considerations
+
+### Token Security
+
+**Do**:
+✅ Use cryptographically strong `proxy_secret` (32+ bytes random)  
+✅ Rotate secrets periodically  
+✅ Validate expiration on all requests  
+✅ Use constant-time comparison for signatures  
+
+**Don't**:
+❌ Expose `proxy_secret` in client-side code  
+❌ Reuse secrets across environments  
+❌ Accept unsigned URLs  
+❌ Skip validation for "trusted" domains  
+
+### URL Injection Prevention
+
+Signed URLs prevent injection attacks:
+
+```
+Attacker tries:
+  /first-party/proxy?tsurl=https://evil.com&tstoken=forged
+
+Trusted Server:
+  1. Computes expected token for https://evil.com
+  2. Compares with provided token
+  3. Rejects if mismatch (403 Forbidden)
+```
+
+### Content Security
+
+**Automatic Protection**:
+- HTML/CSS rewriting removes malicious URLs
+- Data URIs are skipped (`data:`, `javascript:`, `blob:`)
+- Protocol validation (only `http://` and `https://`)
+
+**Considerations**:
+- Origin content is still served (validate trusted sources)
+- Streaming mode bypasses HTML inspection
+- Enable CSP headers for additional protection
+
+## Monitoring & Debugging
+
+### Logging
+
+Proxy requests emit detailed logs:
+
+```
+proxy: origin response status=200 ct=text/html cl=1234 accept=text/html url=https://...
+proxy: likely pixel detected size=43 url=https://tracker.com/p.gif
+click: tsurl=https://advertiser.com had_params=true target=... referer=... ua=... tsid=...
+```
+
+### Diagnostic Headers
+
+Add custom headers for debugging:
+
+```toml
+[response_headers]
+X-Proxy-Mode = "rewrite"
+X-TS-Version = "1.0"
+```
+
+### Metrics to Track
+
+**Key Metrics**:
+- Proxy request count (total)
+- Signature validation failures (rate)
+- Redirect hops (average/max)
+- Response time (p50/p95/p99)
+- Content type distribution
+- Pixel detection rate
+
+## Next Steps
+
+- Learn about [Creative Processing](/guide/creative-processing) for HTML rewriting details
+- Review [Synthetic IDs](/guide/synthetic-ids) for identity management
+- Set up [Configuration](/guide/configuration) for your deployment
+- Explore [Integration Guide](/guide/integration-guide) for custom integrations
diff --git a/docs/guide/gdpr-compliance.md b/docs/guide/gdpr-compliance.md
new file mode 100644
index 0000000..b2d564e
--- /dev/null
+++ b/docs/guide/gdpr-compliance.md
@@ -0,0 +1,96 @@
+# GDPR Compliance
+
+Understanding GDPR compliance and consent management in Trusted Server.
+
+## Overview
+
+Trusted Server enforces GDPR compliance at the edge, ensuring all tracking and data collection activities require explicit user consent.
+
+## Consent Management
+
+### Consent Validation
+
+All requests are validated for proper GDPR consent before any tracking occurs:
+
+```rust
+// Placeholder example
+if !validate_gdpr_consent(&request) {
+    return reject_tracking();
+}
+```
+
+### Consent Sources
+
+Trusted Server supports multiple consent frameworks:
+
+- TCF (Transparency & Consent Framework)
+- Custom consent signals
+- First-party consent cookies
+
+## Implementation
+
+### Checking Consent
+
+```javascript
+// Placeholder example
+const hasConsent = await trustedServer.checkConsent({
+    purposes: ['storage', 'personalization'],
+    vendors: [vendor_id]
+});
+```
+
+### Consent Storage
+
+Consent signals are:
+- Validated on every request
+- Not persisted without explicit consent
+- Respected across all operations
+
+## Privacy Controls
+
+### User Rights
+
+Trusted Server supports:
+
+- Right to access
+- Right to erasure
+- Right to data portability
+- Right to object
+
+### Data Minimization
+
+Only essential data is collected:
+- Synthetic IDs (with consent)
+- Minimal request metadata
+- No PII storage
+
+## Configuration
+
+Configure GDPR settings in `trusted-server.toml`:
+
+```toml
+[gdpr]
+require_consent = true
+tcf_version = "2.2"
+default_action = "reject"
+```
+
+## Compliance Features
+
+- Consent checks before ID generation
+- Automatic rejection without consent
+- Audit logging for compliance
+- Regional enforcement rules
+
+## Best Practices
+
+1. Always require explicit consent
+2. Respect user withdrawal of consent
+3. Document consent mechanisms
+4. Regular compliance audits
+5. Keep consent records
+
+## Next Steps
+
+- Configure [Ad Serving](/guide/ad-serving)
+- Review [Architecture](/guide/architecture)
diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
new file mode 100644
index 0000000..a1bc57f
--- /dev/null
+++ b/docs/guide/getting-started.md
@@ -0,0 +1,81 @@
+# Getting Started
+
+Get up and running with Trusted Server quickly.
+
+## Prerequisites
+
+Before you begin, ensure you have:
+
+- Rust 1.91.1 or later
+- Fastly CLI installed
+- A Fastly account
+- Basic familiarity with WebAssembly
+
+## Installation
+
+### Clone the Repository
+
+```bash
+git clone https://github.com/yourusername/trusted-server.git
+cd trusted-server
+```
+
+### Install Fastly CLI
+
+```bash
+# macOS
+brew install fastly/tap/fastly
+
+# Or download from fastly.com/cli
+```
+
+### Install Viceroy (Test Runtime)
+
+```bash
+cargo install viceroy
+```
+
+## Local Development
+
+### Build the Project
+
+```bash
+cargo build
+```
+
+### Run Tests
+
+```bash
+cargo test
+```
+
+### Start Local Server
+
+```bash
+fastly compute serve
+```
+
+The server will be available at `http://localhost:7676`.
+
+## Configuration
+
+Edit `trusted-server.toml` to configure:
+
+- Ad server integrations
+- KV store mappings
+- Synthetic ID templates
+- GDPR settings
+
+See [Configuration](/guide/configuration) for details.
+
+## Deploy to Fastly
+
+```bash
+fastly compute publish
+```
+
+## Next Steps
+
+- Learn about [Synthetic IDs](/guide/synthetic-ids)
+- Understand [GDPR Compliance](/guide/gdpr-compliance)
+- Configure [Ad Serving](/guide/ad-serving)
diff --git a/docs/guide/index.md b/docs/guide/index.md
new file mode 100644
index 0000000..e69de29
diff --git a/docs/guide/integration-guide.md b/docs/guide/integration-guide.md
new file mode 100644
index 0000000..74f46cf
--- /dev/null
+++ b/docs/guide/integration-guide.md
@@ -0,0 +1,315 @@
+# Integration Guide
+
+This document explains how to integrate a new integration module with the Trusted Server runtime. The workflow mirrors the built-in `testlight` sample in `crates/common/src/integrations/testlight.rs`.
+
+## Architecture Overview
+
+| Component | Purpose |
+| --- | --- |
+| `crates/common/src/integrations/registry.rs` | Defines the `IntegrationProxy`, `IntegrationAttributeRewriter`, and `IntegrationScriptRewriter` traits and hosts the `IntegrationRegistry`, which drives proxy routing and HTML/text rewrites. |
+| `Settings::integrations` (`crates/common/src/settings.rs`) | Free-form JSON blob keyed by integration ID. Use `IntegrationSettings::insert_config` to seed configs; each module deserializes and validates (`validator::Validate`) its own config and exposes an `enabled` flag so the core settings schema stays stable. |
+| Fastly entrypoint (`crates/fastly/src/main.rs`) | Instantiates the registry once per request, routes `/integrations/<id>/…` requests to the appropriate proxy, and passes the registry to the publisher origin proxy so HTML rewriting remains integration-aware. |
+| `html_processor.rs` | Applies first-party URL rewrites, injects the Trusted Server JS shim, and lets integrations override attribute values (for example to swap script URLs). |
+
+## Step-by-Step Integration
+
+### 1. Define Integration Configuration
+
+Add a `trusted-server.toml` block and any environment overrides under `TRUSTED_SERVER__INTEGRATIONS__<ID>__*`. Configuration values are exposed to your module via `Settings::integration_config(<id>)`.
+
+```toml
+[integrations.my_integration]
+endpoint = "https://example.com/api"
+timeout_ms = 1000
+rewrite_scripts = true
+```
+
+### 2. Create the Integration Module
+
+Add a module under `crates/common/src/integrations/<id>/mod.rs` (see `crates/common/src/integrations/testlight.rs` for reference) and expose it in `crates/common/src/integrations/mod.rs`.
+
+Key pieces:
+
+```rust
+#[derive(Deserialize, Validate)]
+struct MyIntegrationConfig {
+    #[serde(default = "default_enabled")]
+    enabled: bool,
+    // …
+}
+
+impl IntegrationConfig for MyIntegrationConfig {
+    fn is_enabled(&self) -> bool { self.enabled }
+}
+
+pub struct MyIntegration {
+    config: MyIntegrationConfig,
+}
+
+pub fn build(settings: &Settings) -> Option<Arc<MyIntegration>> {
+    let config = settings
+        .integration_config::<MyIntegrationConfig>("my_integration")
+        .ok()
+        .flatten()?;
+    Some(Arc::new(MyIntegration { config }))
+}
+
+// Tests or scaffolding code can seed configs without hand-writing JSON:
+settings
+    .integrations
+    .insert_config(
+        "my_integration",
+        &serde_json::json!({
+            "enabled": true,
+            "endpoint": "https://example.com/api"
+        }),
+    )?;
+```
+
+`Settings::integration_config::<T>` automatically deserializes the raw JSON blob, runs [`validator`](https://docs.rs/validator/latest/validator/) on the type, and drops configs whose `is_enabled` returns `false`. Always derive/implement `Validate` for schema enforcement and implement `IntegrationConfig` (typically wrapping a `#[serde(default)] enabled` flag) so operators can toggle integrations without code changes.
+
+### 3. Return an IntegrationRegistration
+
+Each integration registers itself via a `register` function that returns an `IntegrationRegistration`. This object describes which HTTP proxies and HTML rewrites the integration exposes:
+
+```rust
+pub fn register(settings: &Settings) -> Option<IntegrationRegistration> {
+    let integration = build(settings)?;
+    Some(
+        IntegrationRegistration::builder("my_integration")
+            .with_proxy(integration.clone())
+            .with_attribute_rewriter(integration.clone())
+            .with_script_rewriter(integration)
+            .with_asset("my_integration")
+            .build(),
+    )
+}
+```
+
+Any combination of the three vectors may be populated. Modules that only need HTML rewrites can skip the `proxies` field altogether, and vice versa. The registry automatically iterates over the static builder list in `crates/common/src/integrations/mod.rs`, so adding the new `register` function is enough to make the integration discoverable.
+
+### 4. Implement IntegrationProxy for Endpoints
+
+Implement the trait from `registry.rs` when your integration needs its own HTTP entrypoint:
+
+```rust
+#[async_trait(?Send)]
+impl IntegrationProxy for MyIntegration {
+    fn integration_name(&self) -> &'static str {
+        "my_integration"
+    }
+
+    fn routes(&self) -> Vec<IntegrationEndpoint> {
+        vec![
+            self.post("/auction"),
+            self.get("/status"),
+        ]
+    }
+
+    async fn handle(
+        &self,
+        settings: &Settings,
+        req: Request,
+    ) -> Result<Response, Report<TrustedServerError>> {
+        // Parse/generate synthetic IDs, forward upstream, and return the response.
+    }
+}
+```
+
+::: tip Route Helpers
+Use the provided helper methods to automatically namespace your routes under `/integrations/{integration_name()}/`. Available helpers: `get()`, `post()`, `put()`, `delete()`, and `patch()`. This lets you define routes with just their relative paths (e.g., `self.post("/auction")` becomes `"/integrations/my_integration/auction"`).
+:::
+
+Routes are matched verbatim in `crates/fastly/src/main.rs`, so stick to stable paths and register whichever HTTP methods you need. **New integrations should namespace their routes under `/integrations/{INTEGRATION_NAME}/`** using the helper methods for consistency, but you can define routes manually if needed (e.g., for backwards compatibility).
+
+The shared context already injects Trusted Server logging, headers, and error handling; the handler only needs to deserialize the request, call the upstream endpoint, and stamp integration-specific headers.
+
+#### Proxying Upstream Requests
+
+Use the shared helper in `crates/common/src/proxy.rs` to forward requests so you automatically get the same header copying, redirect handling, HTML/CSS rewrite behavior, and synthetic ID handling the first-party proxy uses:
+
+```rust
+use crate::proxy::{proxy_request, ProxyRequestConfig};
+use fastly::http::{header, HeaderValue};
+
+let payload = serde_json::to_vec(&my_body)?;
+let response = proxy_request(
+    settings,
+    req,
+    ProxyRequestConfig::new(&self.config.endpoint)
+        .with_body(payload)
+        .with_header(header::CONTENT_TYPE, HeaderValue::from_static("application/json"))
+        .with_streaming(), // stream passthrough; disable if you need HTML rewrites
+)
+.await?;
+```
+
+Set `forward_synthetic_id` to `false` if the upstream should not receive the caller's synthetic ID (`Testlight` does this), and disable `follow_redirects` if you need to surface redirects directly to the caller.
+
+**Streaming passthrough example:**
+
+```rust
+let response = proxy_request(
+    settings,
+    req,
+    ProxyRequestConfig::new("https://example.com/pixel")
+        .with_streaming() // no HTML/CSS rewrites; preserves origin compression
+);
+```
+
+::: info When to Use Streaming
+Use streaming when the upstream response is binary or large and you do not need creative rewrites. Keep the default (non-streaming) mode when you want HTML/CSS content rewritten through the existing creative pipeline.
+:::
+
+### 5. Implement HTML Rewrite Hooks (Optional)
+
+If the integration needs to rewrite script/link tags or inject HTML, implement `IntegrationAttributeRewriter` for attribute mutation and `IntegrationScriptRewriter` for inline `<script>` or text content rewrites. Both traits return typed actions (`AttributeRewriteAction`, `ScriptRewriteAction`) so you can keep existing markup, swap values, or drop elements entirely.
+
+```rust
+impl IntegrationAttributeRewriter for MyIntegration {
+    fn integration_id(&self) -> &'static str { "my_integration" }
+
+    fn handles_attribute(&self, attribute: &str) -> bool {
+        attribute == "src" || attribute == "href"
+    }
+
+    fn rewrite(
+        &self,
+        attr_name: &str,
+        attr_value: &str,
+        ctx: &IntegrationAttributeContext<'_>,
+    ) -> AttributeRewriteAction {
+        if attr_value.contains("cdn.example.com/legacy.js") {
+            // Drop remote script entirely – unified bundle already contains the logic.
+            AttributeRewriteAction::remove_element()
+        } else if attr_name == "src" {
+            AttributeRewriteAction::replace(tsjs::unified_script_src())
+        } else {
+            AttributeRewriteAction::keep()
+        }
+    }
+}
+
+impl IntegrationScriptRewriter for MyIntegration {
+    fn integration_id(&self) -> &'static str { "my_integration" }
+    fn selector(&self) -> &'static str { "script#__NEXT_DATA__" }
+
+    fn rewrite(
+        &self,
+        content: &str,
+        ctx: &IntegrationScriptContext<'_>,
+    ) -> ScriptRewriteAction {
+        if let Some(rewritten) = try_rewrite_next_payload(content) {
+            ScriptRewriteAction::replace(rewritten)
+        } else {
+            ScriptRewriteAction::keep()
+        }
+    }
+}
+```
+
+`html_processor.rs` calls these hooks after applying the standard origin→first-party rewrite, so you can simply swap URLs, append query parameters, or mutate inline JSON. Use this to point `<script>` tags at your own tsjs-managed bundle (for example, `/static/tsjs=tsjs-testlight.min.js`) or to rewrite embedded Next.js payloads.
+
+::: warning Removing Elements
+Returning `AttributeRewriteAction::remove_element()` (or `ScriptRewriteAction::RemoveNode` for inline content) removes the element entirely, so integrations can drop publisher-provided markup when the Trusted Server already injects a safe alternative. Prebid, for example, simply removes `prebid.js` because the unified TSJS bundle is injected automatically at the start of `<head>`.
+:::
+
+### 6. Register the Module
+
+Add the module to `crates/common/src/integrations/mod.rs`'s builder list. The registry will call its `register` function automatically. Once registered:
+
+- `crates/fastly/src/main.rs` automatically exposes the declared route(s).
+- `handle_publisher_request` receives the same registry so HTML responses get integration shims without further code changes.
+- `IntegrationRegistry::registered_integrations()` exposes a machine-readable summary of hooks for tests, tooling, or diagnostics.
+- Declared assets are injected automatically into `<head>`; the runtime emits `<script async data-tsjs-integration="<name>">` tags for every bundle discovered through `.with_asset(...)`.
+
+### 7. Provide Static Assets (If Needed)
+
+Place any integration-specific JavaScript entrypoint under `crates/js/lib/src/integrations/` (for example, `crates/js/lib/src/integrations/testlight.ts`). The shared `npm run build` script automatically discovers every file in that directory and produces a bundle named `tsjs-<entry>.js`, which the Rust crate embeds as `/static/tsjs=tsjs-<entry>.min.js`.
+
+Integrations that ship additional JS (such as Testlight) typically expose a `shim_src` config and rewrite publisher tags to point at that URL. Others (like Prebid) can simply drop the legacy tag because the unified bundle is injected automatically at the start of `<head>`.
+
+### 8. Test Locally
+
+1. Add minimal config (`trusted-server.toml` + `.env.*` overrides).
+2. Run `cargo fmt && cargo clippy --all-targets --all-features`.
+3. Execute targeted tests, e.g. `cargo test -p trusted-server-common html_processor`.
+4. Use `fastly compute serve` (with Viceroy installed) to hit `/integrations/<id>/…` and fetch HTML from your origin to confirm rewrites are applied.
+
+::: tip Testing Strategy
+For unit tests, prefer exposing helper constructors that accept a synthetic `shim_src` so your tests can point rewriters at a deterministic URL without touching the Tsjs build artifacts.
+:::
+
+By following these steps you can ship independent integration modules that plug into the Trusted Server runtime without modifying the Fastly entrypoint or HTML processor each time.
+
+## Existing Integrations
+
+Two built-in integrations demonstrate how the framework pieces fit together:
+
+### Testlight
+
+**Purpose**: Sample partner stub showing request proxying, attribute rewrites, and asset injection.
+
+**Key files**:
+- `crates/common/src/integrations/testlight.rs` - Rust implementation
+- `crates/js/lib/src/integrations/testlight.ts` - TypeScript shim
+
+### Prebid
+
+**Purpose**: Production Prebid Server bridge that owns `/first-party/ad` & `/third-party/ad`, injects synthetic IDs, rewrites creatives/notification URLs, and removes publisher-supplied Prebid scripts because the shim already ships in the unified TSJS build.
+
+**Key files**:
+- `crates/common/src/integrations/prebid.rs` - Rust implementation  
+- `crates/js/lib/src/ext/prebidjs.ts` - TypeScript shim
+
+#### Prebid Integration Details
+
+Prebid applies the same steps outlined above with a few notable patterns:
+
+**1. Typed Configuration**
+
+`PrebidIntegrationConfig` lives alongside the integration module (`crates/common/src/integrations/prebid.rs`), implements `IntegrationConfig + Validate`, and exposes an `enabled` flag so operators can toggle it without code changes. Configuration lives under `[integrations.prebid]`:
+
+```toml
+[integrations.prebid]
+enabled = true
+server_url = "https://prebid.example/openrtb2/auction"
+timeout_ms = 1200
+bidders = ["equativ", "sampleBidder"]
+auto_configure = true
+```
+
+Tests or scaffolding can inject configs by calling `settings.integrations.insert_config("prebid", &serde_json::json!({...}))`, the same helper that other integrations use.
+
+**2. Routes Owned by the Integration**
+
+`IntegrationProxy::routes` declares the `/integrations/prebid/first-party/ad` (GET) and `/integrations/prebid/third-party/ad` (POST) endpoints. Both handlers share helpers that shape OpenRTB payloads, inject synthetic IDs + geo/request-signing context, forward requests via `ensure_backend_from_url`, and run the HTML creative rewrites before responding. All routes are properly namespaced under `/integrations/prebid/` to follow the integration routing pattern.
+
+**3. HTML Rewrites Through the Registry**
+
+When `auto_configure` is enabled, the integration's `IntegrationAttributeRewriter` removes any `<script src="prebid*.js">` or `<link href=…>` references outright. The unified TSJS bundle is injected at the start of `<head>`, so dropping the publisher assets prevents duplicate downloads and still runs before any inline `pbjs` config.
+
+**4. TSJS Assets & Testing**
+
+The shim implementation lives in `crates/js/lib/src/ext/prebidjs.ts`. Tests typically assert that publisher references disappear, relying on the html processor's unified bundle injection to deliver the shim.
+
+Reusing these patterns makes it straightforward to convert additional legacy flows (for example, Next.js rewrites) into first-class integrations.
+
+## Future Improvements
+
+We plan to expand integration capabilities in several areas:
+
+1. **Declarative Routing & Middleware** - Richer endpoints (path params, shared middleware, structured context) beyond simple method/path matching.
+2. **Granular HTML Hooks** - Ordered selectors, head/body injection points, and DOM-aware helpers so multiple integrations can safely collaborate.
+3. **Integration Manifest** - Schema describing required bundles, routes, config validation, and feature flags to keep registration data-driven.
+4. **Shared Request Utilities** - Reusable building blocks for synthetic ID injection, consent enforcement, and OpenRTB shaping.
+5. **tsjs Tooling** - Auto-generated integration bundles, scaffolding for TS shims/tests, and metadata surfaced back to Rust.
+6. **Testing & Observability Hooks** - Integration-focused mocks, local harnesses, and telemetry emitters for easier validation and monitoring.
+
+Contributions toward these enhancements are welcome.
+
+## Next Steps
+
+- Learn about [Request Signing](/guide/request-signing) for secure communication
+- Review [Architecture](/guide/architecture) for system design
+- Set up [Testing](/guide/testing) for your integration
diff --git a/docs/integration_guide.md b/docs/guide/integration_guide.md
similarity index 100%
rename from docs/integration_guide.md
rename to docs/guide/integration_guide.md
diff --git a/docs/guide/key-rotation.md b/docs/guide/key-rotation.md
new file mode 100644
index 0000000..c191fb9
--- /dev/null
+++ b/docs/guide/key-rotation.md
@@ -0,0 +1,481 @@
+# Key Rotation
+
+Learn how to rotate signing keys to maintain security and manage the lifecycle of cryptographic keys in Trusted Server.
+
+## Overview
+
+Key rotation is the process of generating new signing keys and transitioning from old keys to new ones. Trusted Server provides automated key rotation with:
+
+- **Zero-downtime rotation** - Old and new keys work simultaneously
+- **Automatic key generation** - Date-based key identifiers
+- **Grace period support** - Multiple active keys during transition
+- **Safe deactivation** - Prevents removing the last active key
+
+## Why Rotate Keys?
+
+### Security Reasons
+
+1. **Limit key exposure** - Reduce impact if a key is compromised
+2. **Cryptographic hygiene** - Follow security best practices
+3. **Compliance requirements** - Meet regulatory rotation schedules
+4. **Incident response** - Quickly invalidate potentially compromised keys
+
+### Recommended Schedule
+
+- **Regular rotation**: Every 90 days minimum
+- **Incident-based**: Immediately if compromise suspected
+- **Before major releases**: Ensure fresh keys for new deployments
+
+## Key Rotation Process
+
+### Architecture
+
+```
+┌──────────────────────────────────────┐
+│  Key Rotation Flow                   │
+├──────────────────────────────────────┤
+│                                      │
+│  1. Generate new Ed25519 keypair     │
+│     ↓                                │
+│  2. Store private key (Secret Store) │
+│     ↓                                │
+│  3. Store public JWK (Config Store)  │
+│     ↓                                │
+│  4. Update current-kid pointer       │
+│     ↓                                │
+│  5. Update active-kids list          │
+│     ↓                                │
+│  6. Both keys now active             │
+│                                      │
+└──────────────────────────────────────┘
+```
+
+### State During Rotation
+
+**Before Rotation**:
+- Current key: `ts-2024-01-15`
+- Active keys: `["ts-2024-01-15"]`
+
+**After Rotation**:
+- Current key: `ts-2024-02-15` (new)
+- Active keys: `["ts-2024-01-15", "ts-2024-02-15"]`
+
+**After Grace Period**:
+- Current key: `ts-2024-02-15`
+- Active keys: `["ts-2024-02-15"]`
+
+## Rotating Keys
+
+### Using the Rotation Endpoint
+
+**Endpoint**: `POST /admin/keys/rotate`
+
+#### Automatic Key ID (Recommended)
+
+Let Trusted Server generate a date-based key ID:
+
+```bash
+curl -X POST https://your-domain/admin/keys/rotate \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+**Response**:
+```json
+{
+  "success": true,
+  "message": "Key rotated successfully",
+  "new_kid": "ts-2024-02-15",
+  "previous_kid": "ts-2024-01-15",
+  "active_kids": ["ts-2024-01-15", "ts-2024-02-15"],
+  "jwk": {
+    "kty": "OKP",
+    "crv": "Ed25519",
+    "x": "new-public-key-base64url",
+    "kid": "ts-2024-02-15",
+    "alg": "EdDSA"
+  }
+}
+```
+
+#### Custom Key ID
+
+Specify a custom key identifier:
+
+```bash
+curl -X POST https://your-domain/admin/keys/rotate \
+  -H "Content-Type: application/json" \
+  -d '{"kid": "production-2024-q1"}'
+```
+
+**Response**:
+```json
+{
+  "success": true,
+  "message": "Key rotated successfully",
+  "new_kid": "production-2024-q1",
+  "previous_kid": "ts-2024-01-15",
+  "active_kids": ["ts-2024-01-15", "production-2024-q1"],
+  "jwk": { ... }
+}
+```
+
+### Using the Rust API
+
+```rust
+use trusted_server_common::request_signing::KeyRotationManager;
+
+// Initialize rotation manager
+let manager = KeyRotationManager::new("jwks_store", "signing_keys")?;
+
+// Rotate with automatic kid
+let result = manager.rotate_key(None)?;
+
+println!("New key: {}", result.new_kid);
+println!("Previous key: {:?}", result.previous_kid);
+println!("Active keys: {:?}", result.active_kids);
+
+// Or rotate with custom kid
+let custom_result = manager.rotate_key(Some("my-custom-key".to_string()))?;
+```
+
+## Managing Active Keys
+
+### Listing Active Keys
+
+**Rust API**:
+```rust
+let manager = KeyRotationManager::new("jwks_store", "signing_keys")?;
+let active_keys = manager.list_active_keys()?;
+
+for kid in active_keys {
+    println!("Active key: {}", kid);
+}
+```
+
+**Config Store**:
+Keys are stored as comma-separated values in the `active-kids` config item:
+```
+ts-2024-01-15,ts-2024-02-15,ts-2024-03-15
+```
+
+### Multiple Active Keys
+
+You can have multiple active keys for:
+- **Gradual rollout**: Different services adopt new key at different times
+- **Geographic distribution**: Different regions rotate independently
+- **A/B testing**: Test new keys with subset of traffic
+
+## Deactivating Keys
+
+### When to Deactivate
+
+Deactivate old keys after:
+1. All services have adopted the new key
+2. Grace period has elapsed (recommended: 7-30 days)
+3. No more requests using the old key
+4. Old signatures no longer need verification
+
+### Deactivation Endpoint
+
+**Endpoint**: `POST /admin/keys/deactivate`
+
+#### Deactivate (Keep in Storage)
+
+Remove from active rotation but keep in storage:
+
+```bash
+curl -X POST https://your-domain/admin/keys/deactivate \
+  -H "Content-Type: application/json" \
+  -d '{
+    "kid": "ts-2024-01-15",
+    "delete": false
+  }'
+```
+
+**Response**:
+```json
+{
+  "success": true,
+  "message": "Key deactivated successfully",
+  "deactivated_kid": "ts-2024-01-15",
+  "deleted": false,
+  "remaining_active_kids": ["ts-2024-02-15"]
+}
+```
+
+#### Delete Permanently
+
+Remove from storage completely:
+
+```bash
+curl -X POST https://your-domain/admin/keys/deactivate \
+  -H "Content-Type: application/json" \
+  -d '{
+    "kid": "ts-2024-01-15",
+    "delete": true
+  }'
+```
+
+**Response**:
+```json
+{
+  "success": true,
+  "message": "Key deleted successfully",
+  "deactivated_kid": "ts-2024-01-15",
+  "deleted": true,
+  "remaining_active_kids": ["ts-2024-02-15"]
+}
+```
+
+### Using the Rust API
+
+```rust
+let manager = KeyRotationManager::new("jwks_store", "signing_keys")?;
+
+// Deactivate (keep in storage)
+manager.deactivate_key("ts-2024-01-15")?;
+
+// Delete completely
+manager.delete_key("ts-2024-01-15")?;
+```
+
+### Safety Checks
+
+The system prevents:
+- **Deleting the last active key** - At least one key must remain active
+- **Invalid key IDs** - Returns error for non-existent keys
+
+## Key Naming Conventions
+
+### Date-Based Keys (Default)
+
+Format: `ts-YYYY-MM-DD`
+
+Examples:
+- `ts-2024-01-15`
+- `ts-2024-02-15`
+- `ts-2024-12-31`
+
+**Advantages**:
+- Easy to identify key age
+- Automatic chronological sorting
+- Clear rotation history
+
+### Custom Key IDs
+
+Use descriptive names for specific purposes:
+
+- `production-2024-q1` - Quarterly rotation
+- `staging-dev` - Development environment
+- `emergency-2024-01` - Emergency rotation
+- `service-a-v1` - Service-specific keys
+
+**Advantages**:
+- Meaningful identifiers
+- Environment separation
+- Service isolation
+
+## Rotation Strategies
+
+### Strategy 1: Scheduled Rotation
+
+Regular rotation on a fixed schedule:
+
+```bash
+# Cron job: Rotate every 90 days
+0 0 1 */3 * /usr/local/bin/rotate-keys.sh
+```
+
+**rotate-keys.sh**:
+```bash
+#!/bin/bash
+# Rotate signing keys
+curl -X POST https://your-domain/admin/keys/rotate
+
+# Wait 30 days grace period
+sleep $((30 * 24 * 60 * 60))
+
+# Deactivate old key
+OLD_KEY=$(date -d '90 days ago' +ts-%Y-%m-%d)
+curl -X POST https://your-domain/admin/keys/deactivate \
+  -d "{\"kid\": \"$OLD_KEY\", \"delete\": true}"
+```
+
+### Strategy 2: On-Demand Rotation
+
+Manual rotation when needed:
+
+1. Generate new key
+2. Monitor adoption in logs
+3. Deactivate when safe
+4. Delete after retention period
+
+### Strategy 3: Blue-Green Rotation
+
+Immediate switchover with rollback capability:
+
+1. **Rotate** to new key (both active)
+2. **Monitor** for issues
+3. **Rollback** if needed (keep old as current)
+4. **Commit** if successful (deactivate old)
+
+## Monitoring Key Usage
+
+### Track Current Key
+
+```rust
+use trusted_server_common::request_signing::get_current_key_id;
+
+let current_kid = get_current_key_id()?;
+println!("Current signing key: {}", current_kid);
+```
+
+### Audit Key Usage
+
+Log which keys are used for signing:
+
+```rust
+let signer = RequestSigner::from_config()?;
+log::info!("Signing request with key: {}", signer.kid);
+```
+
+Log which keys are used for verification:
+
+```rust
+log::info!("Verifying signature with key: {}", kid);
+let verified = verify_signature(payload, signature, kid)?;
+```
+
+### Metrics to Track
+
+- **Keys per environment**: Active key count
+- **Signature failures**: Failed verification attempts
+- **Key age**: Time since last rotation
+- **Verification latency**: Performance impact
+
+## Best Practices
+
+### 1. Grace Period
+
+Always maintain a grace period:
+- **Minimum**: 7 days
+- **Recommended**: 30 days
+- **Conservative**: 90 days
+
+This allows:
+- Partner systems to update cached keys
+- In-flight requests to complete
+- Troubleshooting signature issues
+
+### 2. Communication
+
+Before rotation, notify partners:
+- Send advance notice (7-14 days)
+- Publish new key in JWKS endpoint
+- Document rotation schedule
+
+### 3. Rollback Plan
+
+Always have a rollback strategy:
+- Keep previous key active initially
+- Test new key before deactivating old key
+- Document reactivation procedure
+
+### 4. Documentation
+
+Document your rotation:
+- Record rotation dates
+- Track key identifiers
+- Note any issues or rollbacks
+- Update runbooks
+
+### 5. Testing
+
+Test rotation in staging first:
+- Verify new key generation
+- Test signature verification
+- Validate JWKS endpoint
+- Check partner integrations
+
+## Troubleshooting
+
+### Rotation Failed
+
+**Error**: `Failed to create KeyRotationManager`
+
+**Solutions**:
+- Check Fastly API token is configured
+- Verify config_store_id and secret_store_id settings
+- Ensure stores exist in Fastly dashboard
+
+### Cannot Deactivate Key
+
+**Error**: `Cannot deactivate the last active key`
+
+**Solutions**:
+- Rotate to generate a new key first
+- Verify multiple keys are active
+- Check active-kids list
+
+### Signature Verification Fails After Rotation
+
+**Symptoms**: 
+- Old signatures fail to verify
+- `Key not found` errors
+
+**Solutions**:
+- Verify old key is still in active-kids
+- Check JWKS endpoint includes old key
+- Wait for partner caches to update
+
+### Key Not in JWKS
+
+**Symptoms**:
+- New key missing from `.well-known/trusted-server.json`
+
+**Solutions**:
+- Check active-kids includes new key
+- Verify JWK stored in Config Store
+- Check Config Store cache expiration
+
+## Security Considerations
+
+### Key Compromise Response
+
+If a key is compromised:
+
+1. **Immediate**: Rotate to new key
+```bash
+curl -X POST /admin/keys/rotate
+```
+
+2. **Urgent**: Deactivate compromised key
+```bash
+curl -X POST /admin/keys/deactivate \
+  -d '{"kid": "compromised-key", "delete": false}'
+```
+
+3. **Investigation**: Review logs for misuse
+
+4. **Communication**: Notify partners of compromise
+
+5. **Cleanup**: Delete compromised key after investigation
+```bash
+curl -X POST /admin/keys/deactivate \
+  -d '{"kid": "compromised-key", "delete": true}'
+```
+
+### Access Control
+
+Restrict rotation endpoints:
+- Require authentication/authorization
+- Use admin-only API keys
+- Implement rate limiting
+- Audit all rotation attempts
+
+## Next Steps
+
+- Learn about [Request Signing](/guide/request-signing) for using keys
+- Review [Configuration](/guide/configuration) for store setup
+- Set up [Testing](/guide/testing) for rotation procedures
diff --git a/docs/guide/request-signing.md b/docs/guide/request-signing.md
new file mode 100644
index 0000000..289cde5
--- /dev/null
+++ b/docs/guide/request-signing.md
@@ -0,0 +1,334 @@
+# Request Signing
+
+Learn how to implement cryptographic request signing using Ed25519 keys for secure communication with Trusted Server.
+
+## Overview
+
+Trusted Server provides Ed25519-based request signing capabilities to ensure authenticity and integrity of HTTP requests. This feature uses:
+
+- **Ed25519 signatures** - Modern, fast, and secure elliptic curve cryptography
+- **JWKS (JSON Web Key Set)** - Standard format for public key distribution
+- **Fastly storage** - Private keys in Secret Store, public keys in Config Store
+- **Automatic key rotation** - Date-based key identifiers and rotation support
+
+## Architecture
+
+### Key Storage
+
+Keys are stored in two separate Fastly stores:
+
+**Secret Store** (`signing_keys`):
+- Private signing keys (Ed25519 private keys)
+- Base64-encoded 32-byte keys
+- Only accessible to the edge application
+
+**Config Store** (`jwks_store`):
+- Public verification keys (JWK format)
+- Current key identifier (`current-kid`)
+- Active key identifiers (`active-kids`)
+- Public JWKS documents
+
+### Key Components
+
+```
+┌─────────────────────┐
+│  RequestSigner      │  ← Signs outgoing requests
+│  - Loads private key│
+│  - Signs payload    │
+└─────────────────────┘
+
+┌─────────────────────┐
+│  verify_signature() │  ← Verifies incoming requests
+│  - Loads public key │
+│  - Validates sig    │
+└─────────────────────┘
+
+┌─────────────────────┐
+│  JWKS Endpoint      │  ← Publishes public keys
+│  - Discovery doc    │
+│  - Active keys only │
+└─────────────────────┘
+```
+
+## Signing Requests
+
+### Basic Usage
+
+```rust
+use trusted_server_common::request_signing::RequestSigner;
+
+// Initialize signer (loads current key from config)
+let signer = RequestSigner::from_config()?;
+
+// Sign a payload
+let payload = b"request data to sign";
+let signature = signer.sign(payload)?;
+
+// Signature is base64url-encoded
+println!("Signature: {}", signature);
+println!("Key ID: {}", signer.kid);
+```
+
+### Signing HTTP Requests
+
+Include the signature and key ID in request headers:
+
+```rust
+// Sign the request body
+let body = serde_json::to_string(&request_data)?;
+let signature = signer.sign(body.as_bytes())?;
+
+// Add headers
+request.set_header("X-Signature", signature);
+request.set_header("X-Signature-Kid", signer.kid);
+```
+
+### Recommended Headers
+
+- `X-Signature` - Base64url-encoded signature
+- `X-Signature-Kid` - Key identifier used for signing
+- `X-Signature-Timestamp` - Unix timestamp (recommended for replay protection)
+
+## Verifying Signatures
+
+### Basic Verification
+
+```rust
+use trusted_server_common::request_signing::verify_signature;
+
+// Extract signature and kid from request
+let signature = request.get_header("X-Signature")?;
+let kid = request.get_header("X-Signature-Kid")?;
+
+// Verify the signature
+let payload = request.get_body_bytes();
+let is_valid = verify_signature(payload, signature, kid)?;
+
+if !is_valid {
+    return Err("Invalid signature");
+}
+```
+
+### Verification Endpoint
+
+Trusted Server provides a built-in endpoint for testing signatures:
+
+**Endpoint**: `POST /admin/verify-signature`
+
+**Request**:
+```json
+{
+  "payload": "message to verify",
+  "signature": "base64url-encoded-signature",
+  "kid": "ts-2024-01-15"
+}
+```
+
+**Response**:
+```json
+{
+  "verified": true,
+  "kid": "ts-2024-01-15",
+  "message": "Signature verified successfully",
+  "error": null
+}
+```
+
+## Discovery Endpoint
+
+Public keys are published via a standardized discovery endpoint following IAB patterns.
+
+### Accessing the Discovery Document
+
+**Endpoint**: `GET /.well-known/trusted-server.json`
+
+**Response**:
+```json
+{
+  "version": "1.0",
+  "jwks": {
+    "keys": [
+      {
+        "kty": "OKP",
+        "crv": "Ed25519",
+        "x": "base64url-encoded-public-key",
+        "kid": "ts-2024-01-15",
+        "alg": "EdDSA"
+      }
+    ]
+  }
+}
+```
+
+### Using Discovery for Verification
+
+Partners can fetch and cache your public keys:
+
+```javascript
+// Fetch discovery document
+const discovery = await fetch('https://your-domain/.well-known/trusted-server.json')
+  .then(r => r.json());
+
+// Extract JWKS
+const jwks = discovery.jwks;
+
+// Verify signatures using JWKS
+const publicKey = jwks.keys.find(k => k.kid === signatureKid);
+```
+
+## Key Format
+
+### Ed25519 Keys
+
+**Private Key**:
+- 32 bytes
+- Stored base64-encoded in Secret Store
+- Never exposed via API
+
+**Public Key**:
+- 32 bytes
+- Stored as JWK in Config Store
+- Published in JWKS endpoint
+
+### JWK Format
+
+```json
+{
+  "kty": "OKP",           // Key type: Octet Key Pair
+  "crv": "Ed25519",       // Curve: Ed25519
+  "x": "public_key_b64",  // Public key (base64url)
+  "kid": "ts-2024-01-15", // Key identifier
+  "alg": "EdDSA"          // Algorithm: EdDSA
+}
+```
+
+## Configuration
+
+Configure request signing in `trusted-server.toml`:
+
+```toml
+[request_signing]
+config_store_id = "jwks_store"
+secret_store_id = "signing_keys"
+```
+
+### Fastly Config Store Setup
+
+Create the Config Store in Fastly:
+
+```bash
+# Create config store
+fastly config-store create --name=jwks_store
+
+# Create secret store
+fastly secret-store create --name=signing_keys
+```
+
+Link stores to your service in `fastly.toml`:
+
+```toml
+[local_server.config_stores]
+  [local_server.config_stores.jwks_store]
+    file = "test-data/jwks_store.json"
+
+[local_server.secret_stores]
+  [local_server.secret_stores.signing_keys]
+    file = "test-data/signing_keys.json"
+```
+
+## Security Best Practices
+
+### 1. Protect Private Keys
+
+- Store private keys only in Fastly Secret Store
+- Never log or expose private keys
+- Rotate keys regularly (see [Key Rotation](/guide/key-rotation))
+
+### 2. Validate Signatures
+
+Always verify:
+- Signature authenticity
+- Key ID exists in active keys
+- Timestamp freshness (if using timestamps)
+
+### 3. Key Lifecycle
+
+- Generate new keys periodically
+- Keep previous key active during transition
+- Deactivate old keys after grace period
+- Delete deprecated keys
+
+### 4. Transport Security
+
+- Always use HTTPS
+- Consider additional authentication (API keys, mutual TLS)
+- Implement rate limiting on verification endpoints
+
+## Error Handling
+
+Common errors and solutions:
+
+**Invalid key length**:
+```
+Error: Invalid key length (expected 32 bytes for Ed25519)
+```
+- Ensure key is exactly 32 bytes
+- Check base64 encoding is correct
+
+**Missing key**:
+```
+Error: Key not found: ts-2024-01-15
+```
+- Verify kid exists in Config Store
+- Check active-kids list includes the kid
+
+**Signature verification failed**:
+```
+verified: false
+```
+- Ensure payload matches exactly (no modifications)
+- Verify correct kid is used
+- Check signature encoding (base64url vs standard)
+
+## Testing
+
+### Unit Tests
+
+Test signing and verification:
+
+```rust
+#[test]
+fn test_sign_and_verify() {
+    let payload = b"test message";
+    let signer = RequestSigner::from_config().unwrap();
+    let signature = signer.sign(payload).unwrap();
+    
+    // Verify the signature
+    let verified = verify_signature(payload, &signature, &signer.kid).unwrap();
+    assert!(verified);
+}
+```
+
+### Integration Testing
+
+Use the verification endpoint:
+
+```bash
+# Sign a payload
+SIGNATURE=$(sign-payload "test message")
+
+# Verify via API
+curl -X POST https://your-domain/admin/verify-signature \
+  -H "Content-Type: application/json" \
+  -d '{
+    "payload": "test message",
+    "signature": "'$SIGNATURE'",
+    "kid": "ts-2024-01-15"
+  }'
+```
+
+## Next Steps
+
+- Learn about [Key Rotation](/guide/key-rotation) for managing key lifecycle
+- Review [Architecture](/guide/architecture) for system design
+- Configure [Testing](/guide/testing) for your deployment
diff --git a/docs/guide/synthetic-ids.md b/docs/guide/synthetic-ids.md
new file mode 100644
index 0000000..901a525
--- /dev/null
+++ b/docs/guide/synthetic-ids.md
@@ -0,0 +1,66 @@
+# Synthetic IDs
+
+Learn about privacy-preserving synthetic ID generation in Trusted Server.
+
+## What are Synthetic IDs?
+
+Synthetic IDs are privacy-safe identifiers generated using HMAC-based templates that allow tracking with user consent while protecting user privacy.
+
+## How They Work
+
+### HMAC-Based Generation
+
+Synthetic IDs use HMAC (Hash-based Message Authentication Code) to generate deterministic but privacy-safe identifiers.
+
+```rust
+// Example placeholder
+synthetic_id = hmac_sha256(secret_key, template_data)
+```
+
+### Template System
+
+Templates define how synthetic IDs are constructed from various input sources:
+
+- User consent signals
+- Domain information
+- Temporal data
+- Custom parameters
+
+## Configuration
+
+Configure synthetic ID templates in `trusted-server.toml`:
+
+```toml
+[synthetic_ids]
+template = "{{domain}}-{{timestamp}}-{{consent_hash}}"
+secret_key = "your-secret-key"
+```
+
+## Privacy Considerations
+
+- IDs are only generated with explicit user consent
+- No personally identifiable information (PII) is included
+- Templates are configurable per-deployment
+- IDs can be rotated on schedule
+
+## Usage Example
+
+```javascript
+// Placeholder example
+const syntheticId = await trustedServer.generateSyntheticId({
+  domain: 'example.com',
+  consent: true
+});
+```
+
+## Best Practices
+
+1. Always verify GDPR consent before generating IDs
+2. Rotate secret keys periodically
+3. Use appropriate template complexity for your use case
+4. Monitor ID collision rates
+
+## Next Steps
+
+- Learn about [GDPR Compliance](/guide/gdpr-compliance)
+- Configure [Ad Serving](/guide/ad-serving)
diff --git a/docs/guide/testing.md b/docs/guide/testing.md
new file mode 100644
index 0000000..c42e4aa
--- /dev/null
+++ b/docs/guide/testing.md
@@ -0,0 +1,209 @@
+# Testing
+
+Learn how to test Trusted Server locally and in CI/CD.
+
+## Test Infrastructure
+
+### Viceroy
+
+Viceroy is the local test runtime for Fastly Compute applications.
+
+```bash
+# Install viceroy
+cargo install viceroy
+
+# Run tests
+cargo test
+```
+
+### Test Organization
+
+Tests are organized alongside source code in `#[cfg(test)]` modules:
+
+```rust
+#[cfg(test)]
+mod tests {
+    use super::*;
+    
+    #[test]
+    fn test_synthetic_id_generation() {
+        // Test implementation
+    }
+}
+```
+
+## Running Tests
+
+### Unit Tests
+
+```bash
+# Run all tests
+cargo test
+
+# Run specific test
+cargo test test_name
+
+# Run tests with output
+cargo test -- --nocapture
+
+# Run tests for specific crate
+cargo test -p trusted-server-common
+```
+
+### Integration Tests
+
+```bash
+# Run integration tests
+cargo test --test '*'
+```
+
+### Local Server Testing
+
+```bash
+# Start local server
+fastly compute serve
+
+# Test with curl
+curl http://localhost:7676/health
+```
+
+## Test Categories
+
+### Synthetic ID Tests
+
+Test ID generation, validation, and rotation:
+
+```rust
+#[test]
+fn test_id_generation_with_consent() {
+    // Placeholder test
+}
+```
+
+### GDPR Compliance Tests
+
+Test consent validation and enforcement:
+
+```rust
+#[test]
+fn test_reject_without_consent() {
+    // Placeholder test
+}
+```
+
+### Ad Serving Tests
+
+Test ad server integration and creative processing:
+
+```rust
+#[test]
+fn test_ad_request_flow() {
+    // Placeholder test
+}
+```
+
+## Mock Data
+
+Test fixtures located in:
+- `tests/fixtures/` - Test data files
+- `tests/kv_store/` - Mock KV store data
+
+## CI/CD Testing
+
+### GitHub Actions
+
+Tests run automatically on:
+- Pull requests
+- Main branch commits
+- Release tags
+
+```yaml
+# .github/workflows/test.yml
+name: Test
+on: [push, pull_request]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Run tests
+        run: cargo test
+```
+
+## Code Quality
+
+### Formatting
+
+```bash
+# Check formatting
+cargo fmt --check
+
+# Auto-format code
+cargo fmt
+```
+
+### Linting
+
+```bash
+# Run clippy
+cargo clippy --all-targets --all-features
+
+# Fix clippy warnings
+cargo clippy --fix
+```
+
+### Code Coverage
+
+```bash
+# Generate coverage report (requires cargo-tarpaulin)
+cargo tarpaulin --out Html
+```
+
+## Performance Testing
+
+### Load Testing
+
+Use tools like:
+- `wrk` - HTTP benchmarking
+- `hey` - Load generator
+- `k6` - Modern load testing
+
+```bash
+# Example with wrk
+wrk -t12 -c400 -d30s http://localhost:7676/
+```
+
+## Debugging Tests
+
+### Enable Debug Logging
+
+```bash
+RUST_LOG=debug cargo test -- --nocapture
+```
+
+### Running Single Tests
+
+```bash
+cargo test test_name -- --nocapture --test-threads=1
+```
+
+## Best Practices
+
+1. Write tests for all new features
+2. Maintain high test coverage
+3. Use descriptive test names
+4. Test edge cases and error conditions
+5. Keep tests fast and isolated
+6. Mock external dependencies
+
+## Continuous Integration
+
+All tests must pass before:
+- Merging pull requests
+- Deploying to staging
+- Releasing to production
+
+## Next Steps
+
+- Review [Architecture](/guide/architecture)
+- Configure your [Deployment](/guide/configuration)
diff --git a/docs/guide/what-is-trusted-server.md b/docs/guide/what-is-trusted-server.md
new file mode 100644
index 0000000..08c5071
--- /dev/null
+++ b/docs/guide/what-is-trusted-server.md
@@ -0,0 +1,37 @@
+# What is Trusted Server?
+
+Trusted Server is a privacy-preserving edge computing platform built on Fastly Compute that enables GDPR-compliant ad serving and synthetic ID generation.
+
+## Overview
+
+Trusted Server provides a privacy-first approach to digital advertising by:
+
+- Generating synthetic IDs that preserve user privacy
+- Enforcing GDPR consent checks before any tracking
+- Running at the edge for low-latency performance
+- Supporting real-time bidding workflows
+
+## Key Features
+
+### Privacy-Preserving
+All tracking and data collection requires explicit user consent through GDPR compliance checks.
+
+### Edge Computing
+Runs on Fastly Compute platform, providing global low-latency performance.
+
+### Synthetic ID Generation
+Uses HMAC-based templates to generate privacy-safe identifiers.
+
+### Real-Time Bidding
+Integrates with Prebid for seamless RTB workflows.
+
+## Use Cases
+
+- GDPR-compliant ad serving
+- Privacy-safe user tracking
+- Real-time bidding integration
+- Edge-based ad delivery
+
+## Next Steps
+
+Continue to [Getting Started](/guide/getting-started) to begin using Trusted Server.
diff --git a/docs/index.md b/docs/index.md
new file mode 100644
index 0000000..5945f9d
--- /dev/null
+++ b/docs/index.md
@@ -0,0 +1,28 @@
+---
+layout: home
+
+hero:
+  name: "Trusted Server"
+  text: "Privacy-Preserving Edge Computing"
+  tagline: GDPR-compliant ad serving and synthetic ID generation at the edge
+  actions:
+    - theme: brand
+      text: Get Started
+      link: /guide/getting-started
+    - theme: alt
+      text: View on GitHub
+      link: https://github.com/IABTechLab/trusted-server 
+features:
+  - title: Synthetic ID Generation
+    details: HMAC-based synthetic IDs that preserve privacy while enabling tracking with user consent
+  - title: GDPR Compliant
+    details: Built-in consent management and validation to ensure compliance with privacy regulations
+  - title: Edge Computing
+    details: Runs on Fastly Compute for low-latency, high-performance ad serving at the edge
+  - title: Real-Time Bidding
+    details: Prebid integration for seamless real-time bidding workflows
+  - title: Flexible Configuration
+    details: External configuration via TOML files for easy customization and deployment
+  - title: Privacy-First
+    details: All tracking requires explicit GDPR consent checks before any data collection
+---
diff --git a/docs/package-lock.json b/docs/package-lock.json
new file mode 100644
index 0000000..e0ed92a
--- /dev/null
+++ b/docs/package-lock.json
@@ -0,0 +1,2469 @@
+{
+  "name": "trusted-server-docs",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "trusted-server-docs",
+      "version": "1.0.0",
+      "license": "ISC",
+      "devDependencies": {
+        "vitepress": "^1.5.0"
+      }
+    },
+    "node_modules/@algolia/abtesting": {
+      "version": "1.12.0",
+      "resolved": "https://registry.npmjs.org/@algolia/abtesting/-/abtesting-1.12.0.tgz",
+      "integrity": "sha512-EfW0bfxjPs+C7ANkJDw2TATntfBKsFiy7APh+KO0pQ8A6HYa5I0NjFuCGCXWfzzzLXNZta3QUl3n5Kmm6aJo9Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@algolia/client-common": "5.46.0",
+        "@algolia/requester-browser-xhr": "5.46.0",
+        "@algolia/requester-fetch": "5.46.0",
+        "@algolia/requester-node-http": "5.46.0"
+      },
+      "engines": {
+        "node": ">= 14.0.0"
+      }
+    },
+    "node_modules/@algolia/autocomplete-core": {
+      "version": "1.17.7",
+      "resolved": "https://registry.npmjs.org/@algolia/autocomplete-core/-/autocomplete-core-1.17.7.tgz",
+      "integrity": "sha512-BjiPOW6ks90UKl7TwMv7oNQMnzU+t/wk9mgIDi6b1tXpUek7MW0lbNOUHpvam9pe3lVCf4xPFT+lK7s+e+fs7Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@algolia/autocomplete-plugin-algolia-insights": "1.17.7",
+        "@algolia/autocomplete-shared": "1.17.7"
+      }
+    },
+    "node_modules/@algolia/autocomplete-plugin-algolia-insights": {
+      "version": "1.17.7",
+      "resolved": "https://registry.npmjs.org/@algolia/autocomplete-plugin-algolia-insights/-/autocomplete-plugin-algolia-insights-1.17.7.tgz",
+      "integrity": "sha512-Jca5Ude6yUOuyzjnz57og7Et3aXjbwCSDf/8onLHSQgw1qW3ALl9mrMWaXb5FmPVkV3EtkD2F/+NkT6VHyPu9A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@algolia/autocomplete-shared": "1.17.7"
+      },
+      "peerDependencies": {
+        "search-insights": ">= 1 < 3"
+      }
+    },
+    "node_modules/@algolia/autocomplete-preset-algolia": {
+      "version": "1.17.7",
+      "resolved": "https://registry.npmjs.org/@algolia/autocomplete-preset-algolia/-/autocomplete-preset-algolia-1.17.7.tgz",
+      "integrity": "sha512-ggOQ950+nwbWROq2MOCIL71RE0DdQZsceqrg32UqnhDz8FlO9rL8ONHNsI2R1MH0tkgVIDKI/D0sMiUchsFdWA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@algolia/autocomplete-shared": "1.17.7"
+      },
+      "peerDependencies": {
+        "@algolia/client-search": ">= 4.9.1 < 6",
+        "algoliasearch": ">= 4.9.1 < 6"
+      }
+    },
+    "node_modules/@algolia/autocomplete-shared": {
+      "version": "1.17.7",
+      "resolved": "https://registry.npmjs.org/@algolia/autocomplete-shared/-/autocomplete-shared-1.17.7.tgz",
+      "integrity": "sha512-o/1Vurr42U/qskRSuhBH+VKxMvkkUVTLU6WZQr+L5lGZZLYWyhdzWjW0iGXY7EkwRTjBqvN2EsR81yCTGV/kmg==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "@algolia/client-search": ">= 4.9.1 < 6",
+        "algoliasearch": ">= 4.9.1 < 6"
+      }
+    },
+    "node_modules/@algolia/client-abtesting": {
+      "version": "5.46.0",
+      "resolved": "https://registry.npmjs.org/@algolia/client-abtesting/-/client-abtesting-5.46.0.tgz",
+      "integrity": "sha512-eG5xV8rujK4ZIHXrRshvv9O13NmU/k42Rnd3w43iKH5RaQ2zWuZO6Q7XjaoJjAFVCsJWqRbXzbYyPGrbF3wGNg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@algolia/client-common": "5.46.0",
+        "@algolia/requester-browser-xhr": "5.46.0",
+        "@algolia/requester-fetch": "5.46.0",
+        "@algolia/requester-node-http": "5.46.0"
+      },
+      "engines": {
+        "node": ">= 14.0.0"
+      }
+    },
+    "node_modules/@algolia/client-analytics": {
+      "version": "5.46.0",
+      "resolved": "https://registry.npmjs.org/@algolia/client-analytics/-/client-analytics-5.46.0.tgz",
+      "integrity": "sha512-AYh2uL8IUW9eZrbbT+wZElyb7QkkeV3US2NEKY7doqMlyPWE8lErNfkVN1NvZdVcY4/SVic5GDbeDz2ft8YIiQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@algolia/client-common": "5.46.0",
+        "@algolia/requester-browser-xhr": "5.46.0",
+        "@algolia/requester-fetch": "5.46.0",
+        "@algolia/requester-node-http": "5.46.0"
+      },
+      "engines": {
+        "node": ">= 14.0.0"
+      }
+    },
+    "node_modules/@algolia/client-common": {
+      "version": "5.46.0",
+      "resolved": "https://registry.npmjs.org/@algolia/client-common/-/client-common-5.46.0.tgz",
+      "integrity": "sha512-0emZTaYOeI9WzJi0TcNd2k3SxiN6DZfdWc2x2gHt855Jl9jPUOzfVTL6gTvCCrOlT4McvpDGg5nGO+9doEjjig==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14.0.0"
+      }
+    },
+    "node_modules/@algolia/client-insights": {
+      "version": "5.46.0",
+      "resolved": "https://registry.npmjs.org/@algolia/client-insights/-/client-insights-5.46.0.tgz",
+      "integrity": "sha512-wrBJ8fE+M0TDG1As4DDmwPn2TXajrvmvAN72Qwpuv8e2JOKNohF7+JxBoF70ZLlvP1A1EiH8DBu+JpfhBbNphQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@algolia/client-common": "5.46.0",
+        "@algolia/requester-browser-xhr": "5.46.0",
+        "@algolia/requester-fetch": "5.46.0",
+        "@algolia/requester-node-http": "5.46.0"
+      },
+      "engines": {
+        "node": ">= 14.0.0"
+      }
+    },
+    "node_modules/@algolia/client-personalization": {
+      "version": "5.46.0",
+      "resolved": "https://registry.npmjs.org/@algolia/client-personalization/-/client-personalization-5.46.0.tgz",
+      "integrity": "sha512-LnkeX4p0ENt0DoftDJJDzQQJig/sFQmD1eQifl/iSjhUOGUIKC/7VTeXRcKtQB78naS8njUAwpzFvxy1CDDXDQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@algolia/client-common": "5.46.0",
+        "@algolia/requester-browser-xhr": "5.46.0",
+        "@algolia/requester-fetch": "5.46.0",
+        "@algolia/requester-node-http": "5.46.0"
+      },
+      "engines": {
+        "node": ">= 14.0.0"
+      }
+    },
+    "node_modules/@algolia/client-query-suggestions": {
+      "version": "5.46.0",
+      "resolved": "https://registry.npmjs.org/@algolia/client-query-suggestions/-/client-query-suggestions-5.46.0.tgz",
+      "integrity": "sha512-aF9tc4ex/smypXw+W3lBPB1jjKoaGHpZezTqofvDOI/oK1dR2sdTpFpK2Ru+7IRzYgwtRqHF3znmTlyoNs9dpA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@algolia/client-common": "5.46.0",
+        "@algolia/requester-browser-xhr": "5.46.0",
+        "@algolia/requester-fetch": "5.46.0",
+        "@algolia/requester-node-http": "5.46.0"
+      },
+      "engines": {
+        "node": ">= 14.0.0"
+      }
+    },
+    "node_modules/@algolia/client-search": {
+      "version": "5.46.0",
+      "resolved": "https://registry.npmjs.org/@algolia/client-search/-/client-search-5.46.0.tgz",
+      "integrity": "sha512-22SHEEVNjZfFWkFks3P6HilkR3rS7a6GjnCIqR22Zz4HNxdfT0FG+RE7efTcFVfLUkTTMQQybvaUcwMrHXYa7Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@algolia/client-common": "5.46.0",
+        "@algolia/requester-browser-xhr": "5.46.0",
+        "@algolia/requester-fetch": "5.46.0",
+        "@algolia/requester-node-http": "5.46.0"
+      },
+      "engines": {
+        "node": ">= 14.0.0"
+      }
+    },
+    "node_modules/@algolia/ingestion": {
+      "version": "1.46.0",
+      "resolved": "https://registry.npmjs.org/@algolia/ingestion/-/ingestion-1.46.0.tgz",
+      "integrity": "sha512-2LT0/Z+/sFwEpZLH6V17WSZ81JX2uPjgvv5eNlxgU7rPyup4NXXfuMbtCJ+6uc4RO/LQpEJd3Li59ke3wtyAsA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@algolia/client-common": "5.46.0",
+        "@algolia/requester-browser-xhr": "5.46.0",
+        "@algolia/requester-fetch": "5.46.0",
+        "@algolia/requester-node-http": "5.46.0"
+      },
+      "engines": {
+        "node": ">= 14.0.0"
+      }
+    },
+    "node_modules/@algolia/monitoring": {
+      "version": "1.46.0",
+      "resolved": "https://registry.npmjs.org/@algolia/monitoring/-/monitoring-1.46.0.tgz",
+      "integrity": "sha512-uivZ9wSWZ8mz2ZU0dgDvQwvVZV8XBv6lYBXf8UtkQF3u7WeTqBPeU8ZoeTyLpf0jAXCYOvc1mAVmK0xPLuEwOQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@algolia/client-common": "5.46.0",
+        "@algolia/requester-browser-xhr": "5.46.0",
+        "@algolia/requester-fetch": "5.46.0",
+        "@algolia/requester-node-http": "5.46.0"
+      },
+      "engines": {
+        "node": ">= 14.0.0"
+      }
+    },
+    "node_modules/@algolia/recommend": {
+      "version": "5.46.0",
+      "resolved": "https://registry.npmjs.org/@algolia/recommend/-/recommend-5.46.0.tgz",
+      "integrity": "sha512-O2BB8DuySuddgOAbhyH4jsGbL+KyDGpzJRtkDZkv091OMomqIA78emhhMhX9d/nIRrzS1wNLWB/ix7Hb2eV5rg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@algolia/client-common": "5.46.0",
+        "@algolia/requester-browser-xhr": "5.46.0",
+        "@algolia/requester-fetch": "5.46.0",
+        "@algolia/requester-node-http": "5.46.0"
+      },
+      "engines": {
+        "node": ">= 14.0.0"
+      }
+    },
+    "node_modules/@algolia/requester-browser-xhr": {
+      "version": "5.46.0",
+      "resolved": "https://registry.npmjs.org/@algolia/requester-browser-xhr/-/requester-browser-xhr-5.46.0.tgz",
+      "integrity": "sha512-eW6xyHCyYrJD0Kjk9Mz33gQ40LfWiEA51JJTVfJy3yeoRSw/NXhAL81Pljpa0qslTs6+LO/5DYPZddct6HvISQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@algolia/client-common": "5.46.0"
+      },
+      "engines": {
+        "node": ">= 14.0.0"
+      }
+    },
+    "node_modules/@algolia/requester-fetch": {
+      "version": "5.46.0",
+      "resolved": "https://registry.npmjs.org/@algolia/requester-fetch/-/requester-fetch-5.46.0.tgz",
+      "integrity": "sha512-Vn2+TukMGHy4PIxmdvP667tN/MhS7MPT8EEvEhS6JyFLPx3weLcxSa1F9gVvrfHWCUJhLWoMVJVB2PT8YfRGcw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@algolia/client-common": "5.46.0"
+      },
+      "engines": {
+        "node": ">= 14.0.0"
+      }
+    },
+    "node_modules/@algolia/requester-node-http": {
+      "version": "5.46.0",
+      "resolved": "https://registry.npmjs.org/@algolia/requester-node-http/-/requester-node-http-5.46.0.tgz",
+      "integrity": "sha512-xaqXyna5yBZ+r1SJ9my/DM6vfTqJg9FJgVydRJ0lnO+D5NhqGW/qaRG/iBGKr/d4fho34el6WakV7BqJvrl/HQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@algolia/client-common": "5.46.0"
+      },
+      "engines": {
+        "node": ">= 14.0.0"
+      }
+    },
+    "node_modules/@babel/helper-string-parser": {
+      "version": "7.27.1",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
+      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-identifier": {
+      "version": "7.28.5",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
+      "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/parser": {
+      "version": "7.28.5",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.28.5.tgz",
+      "integrity": "sha512-KKBU1VGYR7ORr3At5HAtUQ+TV3SzRCXmA/8OdDZiLDBIZxVyzXuztPjfLd3BV1PRAQGCMWWSHYhL0F8d5uHBDQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.28.5"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@babel/types": {
+      "version": "7.28.5",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.28.5.tgz",
+      "integrity": "sha512-qQ5m48eI/MFLQ5PxQj4PFaprjyCTLI37ElWMmNs0K8Lk3dVeOdNpB3ks8jc7yM5CDmVC73eMVk/trk3fgmrUpA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^7.27.1",
+        "@babel/helper-validator-identifier": "^7.28.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@docsearch/css": {
+      "version": "3.8.2",
+      "resolved": "https://registry.npmjs.org/@docsearch/css/-/css-3.8.2.tgz",
+      "integrity": "sha512-y05ayQFyUmCXze79+56v/4HpycYF3uFqB78pLPrSV5ZKAlDuIAAJNhaRi8tTdRNXh05yxX/TyNnzD6LwSM89vQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@docsearch/js": {
+      "version": "3.8.2",
+      "resolved": "https://registry.npmjs.org/@docsearch/js/-/js-3.8.2.tgz",
+      "integrity": "sha512-Q5wY66qHn0SwA7Taa0aDbHiJvaFJLOJyHmooQ7y8hlwwQLQ/5WwCcoX0g7ii04Qi2DJlHsd0XXzJ8Ypw9+9YmQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@docsearch/react": "3.8.2",
+        "preact": "^10.0.0"
+      }
+    },
+    "node_modules/@docsearch/react": {
+      "version": "3.8.2",
+      "resolved": "https://registry.npmjs.org/@docsearch/react/-/react-3.8.2.tgz",
+      "integrity": "sha512-xCRrJQlTt8N9GU0DG4ptwHRkfnSnD/YpdeaXe02iKfqs97TkZJv60yE+1eq/tjPcVnTW8dP5qLP7itifFVV5eg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@algolia/autocomplete-core": "1.17.7",
+        "@algolia/autocomplete-preset-algolia": "1.17.7",
+        "@docsearch/css": "3.8.2",
+        "algoliasearch": "^5.14.2"
+      },
+      "peerDependencies": {
+        "@types/react": ">= 16.8.0 < 19.0.0",
+        "react": ">= 16.8.0 < 19.0.0",
+        "react-dom": ">= 16.8.0 < 19.0.0",
+        "search-insights": ">= 1 < 3"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "react": {
+          "optional": true
+        },
+        "react-dom": {
+          "optional": true
+        },
+        "search-insights": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.21.5.tgz",
+      "integrity": "sha512-1SDgH6ZSPTlggy1yI6+Dbkiz8xzpHJEVAlF/AM1tHPLsf5STom9rwtjE4hKAF20FfXXNTFqEYXyJNWh1GiZedQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.21.5.tgz",
+      "integrity": "sha512-vCPvzSjpPHEi1siZdlvAlsPxXl7WbOVUBBAowWug4rJHb68Ox8KualB+1ocNvT5fjv6wpkX6o/iEpbDrf68zcg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.21.5.tgz",
+      "integrity": "sha512-c0uX9VAUBQ7dTDCjq+wdyGLowMdtR/GoC2U5IYk/7D1H1JYC0qseD7+11iMP2mRLN9RcCMRcjC4YMclCzGwS/A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.21.5.tgz",
+      "integrity": "sha512-D7aPRUUNHRBwHxzxRvp856rjUHRFW1SdQATKXH2hqA0kAZb1hKmi02OpYRacl0TxIGz/ZmXWlbZgjwWYaCakTA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.21.5.tgz",
+      "integrity": "sha512-DwqXqZyuk5AiWWf3UfLiRDJ5EDd49zg6O9wclZ7kUMv2WRFr4HKjXp/5t8JZ11QbQfUS6/cRCKGwYhtNAY88kQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.21.5.tgz",
+      "integrity": "sha512-se/JjF8NlmKVG4kNIuyWMV/22ZaerB+qaSi5MdrXtd6R08kvs2qCN4C09miupktDitvh8jRFflwGFBQcxZRjbw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.21.5.tgz",
+      "integrity": "sha512-5JcRxxRDUJLX8JXp/wcBCy3pENnCgBR9bN6JsY4OmhfUtIHe3ZW0mawA7+RDAcMLrMIZaf03NlQiX9DGyB8h4g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.21.5.tgz",
+      "integrity": "sha512-J95kNBj1zkbMXtHVH29bBriQygMXqoVQOQYA+ISs0/2l3T9/kj42ow2mpqerRBxDJnmkUDCaQT/dfNXWX/ZZCQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.21.5.tgz",
+      "integrity": "sha512-bPb5AHZtbeNGjCKVZ9UGqGwo8EUu4cLq68E95A53KlxAPRmUyYv2D6F0uUI65XisGOL1hBP5mTronbgo+0bFcA==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.21.5.tgz",
+      "integrity": "sha512-ibKvmyYzKsBeX8d8I7MH/TMfWDXBF3db4qM6sy+7re0YXya+K1cem3on9XgdT2EQGMu4hQyZhan7TeQ8XkGp4Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.21.5.tgz",
+      "integrity": "sha512-YvjXDqLRqPDl2dvRODYmmhz4rPeVKYvppfGYKSNGdyZkA01046pLWyRKKI3ax8fbJoK5QbxblURkwK/MWY18Tg==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.21.5.tgz",
+      "integrity": "sha512-uHf1BmMG8qEvzdrzAqg2SIG/02+4/DHB6a9Kbya0XDvwDEKCoC8ZRWI5JJvNdUjtciBGFQ5PuBlpEOXQj+JQSg==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.21.5.tgz",
+      "integrity": "sha512-IajOmO+KJK23bj52dFSNCMsz1QP1DqM6cwLUv3W1QwyxkyIWecfafnI555fvSGqEKwjMXVLokcV5ygHW5b3Jbg==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.21.5.tgz",
+      "integrity": "sha512-1hHV/Z4OEfMwpLO8rp7CvlhBDnjsC3CttJXIhBi+5Aj5r+MBvy4egg7wCbe//hSsT+RvDAG7s81tAvpL2XAE4w==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.21.5.tgz",
+      "integrity": "sha512-2HdXDMd9GMgTGrPWnJzP2ALSokE/0O5HhTUvWIbD3YdjME8JwvSCnNGBnTThKGEB91OZhzrJ4qIIxk/SBmyDDA==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.21.5.tgz",
+      "integrity": "sha512-zus5sxzqBJD3eXxwvjN1yQkRepANgxE9lgOW2qLnmr8ikMTphkjgXu1HR01K4FJg8h1kEEDAqDcZQtbrRnB41A==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.21.5.tgz",
+      "integrity": "sha512-1rYdTpyv03iycF1+BhzrzQJCdOuAOtaqHTWJZCWvijKD2N5Xu0TtVC8/+1faWqcP9iBCWOmjmhoH94dH82BxPQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.21.5.tgz",
+      "integrity": "sha512-Woi2MXzXjMULccIwMnLciyZH4nCIMpWQAs049KEeMvOcNADVxo0UBIQPfSmxB3CWKedngg7sWZdLvLczpe0tLg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.21.5.tgz",
+      "integrity": "sha512-HLNNw99xsvx12lFBUwoT8EVCsSvRNDVxNpjZ7bPn947b8gJPzeHWyNVhFsaerc0n3TsbOINvRP2byTZ5LKezow==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.21.5.tgz",
+      "integrity": "sha512-6+gjmFpfy0BHU5Tpptkuh8+uw3mnrvgs+dSPQXQOv3ekbordwnzTVEb4qnIvQcYXq6gzkyTnoZ9dZG+D4garKg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.21.5.tgz",
+      "integrity": "sha512-Z0gOTd75VvXqyq7nsl93zwahcTROgqvuAcYDUr+vOv8uHhNSKROyU961kgtCD1e95IqPKSQKH7tBTslnS3tA8A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.21.5.tgz",
+      "integrity": "sha512-SWXFF1CL2RVNMaVs+BBClwtfZSvDgtL//G/smwAc5oVK/UPu2Gu9tIaRgFmYFFKrmg3SyAjSrElf0TiJ1v8fYA==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.21.5.tgz",
+      "integrity": "sha512-tQd/1efJuzPC6rCFwEvLtci/xNFcTZknmXs98FYDfGE4wP9ClFV98nyKrzJKVPMhdDnjzLhdUyMX4PsQAPjwIw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@iconify-json/simple-icons": {
+      "version": "1.2.62",
+      "resolved": "https://registry.npmjs.org/@iconify-json/simple-icons/-/simple-icons-1.2.62.tgz",
+      "integrity": "sha512-GpWQ294d4lraB3D2eBSSMROh1x9uKgpmyereLlGzVQjGZ7lbeFzby2ywXxyp4vEODmTDyf1/4WcOYs/yH4rJ5Q==",
+      "dev": true,
+      "license": "CC0-1.0",
+      "dependencies": {
+        "@iconify/types": "*"
+      }
+    },
+    "node_modules/@iconify/types": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@iconify/types/-/types-2.0.0.tgz",
+      "integrity": "sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.5.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
+      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@rollup/rollup-android-arm-eabi": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.53.3.tgz",
+      "integrity": "sha512-mRSi+4cBjrRLoaal2PnqH82Wqyb+d3HsPUN/W+WslCXsZsyHa9ZeQQX/pQsZaVIWDkPcpV6jJ+3KLbTbgnwv8w==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
+    },
+    "node_modules/@rollup/rollup-android-arm64": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.53.3.tgz",
+      "integrity": "sha512-CbDGaMpdE9sh7sCmTrTUyllhrg65t6SwhjlMJsLr+J8YjFuPmCEjbBSx4Z/e4SmDyH3aB5hGaJUP2ltV/vcs4w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
+    },
+    "node_modules/@rollup/rollup-darwin-arm64": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.53.3.tgz",
+      "integrity": "sha512-Nr7SlQeqIBpOV6BHHGZgYBuSdanCXuw09hon14MGOLGmXAFYjx1wNvquVPmpZnl0tLjg25dEdr4IQ6GgyToCUA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@rollup/rollup-darwin-x64": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.53.3.tgz",
+      "integrity": "sha512-DZ8N4CSNfl965CmPktJ8oBnfYr3F8dTTNBQkRlffnUarJ2ohudQD17sZBa097J8xhQ26AwhHJ5mvUyQW8ddTsQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@rollup/rollup-freebsd-arm64": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.53.3.tgz",
+      "integrity": "sha512-yMTrCrK92aGyi7GuDNtGn2sNW+Gdb4vErx4t3Gv/Tr+1zRb8ax4z8GWVRfr3Jw8zJWvpGHNpss3vVlbF58DZ4w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ]
+    },
+    "node_modules/@rollup/rollup-freebsd-x64": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.53.3.tgz",
+      "integrity": "sha512-lMfF8X7QhdQzseM6XaX0vbno2m3hlyZFhwcndRMw8fbAGUGL3WFMBdK0hbUBIUYcEcMhVLr1SIamDeuLBnXS+Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.53.3.tgz",
+      "integrity": "sha512-k9oD15soC/Ln6d2Wv/JOFPzZXIAIFLp6B+i14KhxAfnq76ajt0EhYc5YPeX6W1xJkAdItcVT+JhKl1QZh44/qw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm-musleabihf": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.53.3.tgz",
+      "integrity": "sha512-vTNlKq+N6CK/8UktsrFuc+/7NlEYVxgaEgRXVUVK258Z5ymho29skzW1sutgYjqNnquGwVUObAaxae8rZ6YMhg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm64-gnu": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.53.3.tgz",
+      "integrity": "sha512-RGrFLWgMhSxRs/EWJMIFM1O5Mzuz3Xy3/mnxJp/5cVhZ2XoCAxJnmNsEyeMJtpK+wu0FJFWz+QF4mjCA7AUQ3w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm64-musl": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.53.3.tgz",
+      "integrity": "sha512-kASyvfBEWYPEwe0Qv4nfu6pNkITLTb32p4yTgzFCocHnJLAHs+9LjUu9ONIhvfT/5lv4YS5muBHyuV84epBo/A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-loong64-gnu": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.53.3.tgz",
+      "integrity": "sha512-JiuKcp2teLJwQ7vkJ95EwESWkNRFJD7TQgYmCnrPtlu50b4XvT5MOmurWNrCj3IFdyjBQ5p9vnrX4JM6I8OE7g==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-ppc64-gnu": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.53.3.tgz",
+      "integrity": "sha512-EoGSa8nd6d3T7zLuqdojxC20oBfNT8nexBbB/rkxgKj5T5vhpAQKKnD+h3UkoMuTyXkP5jTjK/ccNRmQrPNDuw==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-riscv64-gnu": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.53.3.tgz",
+      "integrity": "sha512-4s+Wped2IHXHPnAEbIB0YWBv7SDohqxobiiPA1FIWZpX+w9o2i4LezzH/NkFUl8LRci/8udci6cLq+jJQlh+0g==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-riscv64-musl": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.53.3.tgz",
+      "integrity": "sha512-68k2g7+0vs2u9CxDt5ktXTngsxOQkSEV/xBbwlqYcUrAVh6P9EgMZvFsnHy4SEiUl46Xf0IObWVbMvPrr2gw8A==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-s390x-gnu": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.53.3.tgz",
+      "integrity": "sha512-VYsFMpULAz87ZW6BVYw3I6sWesGpsP9OPcyKe8ofdg9LHxSbRMd7zrVrr5xi/3kMZtpWL/wC+UIJWJYVX5uTKg==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-x64-gnu": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.53.3.tgz",
+      "integrity": "sha512-3EhFi1FU6YL8HTUJZ51imGJWEX//ajQPfqWLI3BQq4TlvHy4X0MOr5q3D2Zof/ka0d5FNdPwZXm3Yyib/UEd+w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-x64-musl": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.53.3.tgz",
+      "integrity": "sha512-eoROhjcc6HbZCJr+tvVT8X4fW3/5g/WkGvvmwz/88sDtSJzO7r/blvoBDgISDiCjDRZmHpwud7h+6Q9JxFwq1Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-openharmony-arm64": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.53.3.tgz",
+      "integrity": "sha512-OueLAWgrNSPGAdUdIjSWXw+u/02BRTcnfw9PN41D2vq/JSEPnJnVuBgw18VkN8wcd4fjUs+jFHVM4t9+kBSNLw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-arm64-msvc": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.53.3.tgz",
+      "integrity": "sha512-GOFuKpsxR/whszbF/bzydebLiXIHSgsEUp6M0JI8dWvi+fFa1TD6YQa4aSZHtpmh2/uAlj/Dy+nmby3TJ3pkTw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-ia32-msvc": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.53.3.tgz",
+      "integrity": "sha512-iah+THLcBJdpfZ1TstDFbKNznlzoxa8fmnFYK4V67HvmuNYkVdAywJSoteUszvBQ9/HqN2+9AZghbajMsFT+oA==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-x64-gnu": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.53.3.tgz",
+      "integrity": "sha512-J9QDiOIZlZLdcot5NXEepDkstocktoVjkaKUtqzgzpt2yWjGlbYiKyp05rWwk4nypbYUNoFAztEgixoLaSETkg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-x64-msvc": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.53.3.tgz",
+      "integrity": "sha512-UhTd8u31dXadv0MopwGgNOBpUVROFKWVQgAg5N1ESyCz8AuBcMqm4AuTjrwgQKGDfoFuz02EuMRHQIw/frmYKQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@shikijs/core": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-2.5.0.tgz",
+      "integrity": "sha512-uu/8RExTKtavlpH7XqnVYBrfBkUc20ngXiX9NSrBhOVZYv/7XQRKUyhtkeflY5QsxC0GbJThCerruZfsUaSldg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@shikijs/engine-javascript": "2.5.0",
+        "@shikijs/engine-oniguruma": "2.5.0",
+        "@shikijs/types": "2.5.0",
+        "@shikijs/vscode-textmate": "^10.0.2",
+        "@types/hast": "^3.0.4",
+        "hast-util-to-html": "^9.0.4"
+      }
+    },
+    "node_modules/@shikijs/engine-javascript": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-2.5.0.tgz",
+      "integrity": "sha512-VjnOpnQf8WuCEZtNUdjjwGUbtAVKuZkVQ/5cHy/tojVVRIRtlWMYVjyWhxOmIq05AlSOv72z7hRNRGVBgQOl0w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@shikijs/types": "2.5.0",
+        "@shikijs/vscode-textmate": "^10.0.2",
+        "oniguruma-to-es": "^3.1.0"
+      }
+    },
+    "node_modules/@shikijs/engine-oniguruma": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-2.5.0.tgz",
+      "integrity": "sha512-pGd1wRATzbo/uatrCIILlAdFVKdxImWJGQ5rFiB5VZi2ve5xj3Ax9jny8QvkaV93btQEwR/rSz5ERFpC5mKNIw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@shikijs/types": "2.5.0",
+        "@shikijs/vscode-textmate": "^10.0.2"
+      }
+    },
+    "node_modules/@shikijs/langs": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-2.5.0.tgz",
+      "integrity": "sha512-Qfrrt5OsNH5R+5tJ/3uYBBZv3SuGmnRPejV9IlIbFH3HTGLDlkqgHymAlzklVmKBjAaVmkPkyikAV/sQ1wSL+w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@shikijs/types": "2.5.0"
+      }
+    },
+    "node_modules/@shikijs/themes": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-2.5.0.tgz",
+      "integrity": "sha512-wGrk+R8tJnO0VMzmUExHR+QdSaPUl/NKs+a4cQQRWyoc3YFbUzuLEi/KWK1hj+8BfHRKm2jNhhJck1dfstJpiw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@shikijs/types": "2.5.0"
+      }
+    },
+    "node_modules/@shikijs/transformers": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@shikijs/transformers/-/transformers-2.5.0.tgz",
+      "integrity": "sha512-SI494W5X60CaUwgi8u4q4m4s3YAFSxln3tzNjOSYqq54wlVgz0/NbbXEb3mdLbqMBztcmS7bVTaEd2w0qMmfeg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@shikijs/core": "2.5.0",
+        "@shikijs/types": "2.5.0"
+      }
+    },
+    "node_modules/@shikijs/types": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-2.5.0.tgz",
+      "integrity": "sha512-ygl5yhxki9ZLNuNpPitBWvcy9fsSKKaRuO4BAlMyagszQidxcpLAr0qiW/q43DtSIDxO6hEbtYLiFZNXO/hdGw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@shikijs/vscode-textmate": "^10.0.2",
+        "@types/hast": "^3.0.4"
+      }
+    },
+    "node_modules/@shikijs/vscode-textmate": {
+      "version": "10.0.2",
+      "resolved": "https://registry.npmjs.org/@shikijs/vscode-textmate/-/vscode-textmate-10.0.2.tgz",
+      "integrity": "sha512-83yeghZ2xxin3Nj8z1NMd/NCuca+gsYXswywDy5bHvwlWL8tpTQmzGeUuHd9FC3E/SBEMvzJRwWEOz5gGes9Qg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/estree": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
+      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/hast": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@types/hast/-/hast-3.0.4.tgz",
+      "integrity": "sha512-WPs+bbQw5aCj+x6laNGWLH3wviHtoCv/P3+otBhbOhJgG8qtpdAMlTCxLtsTWA7LH1Oh/bFCHsBn0TPS5m30EQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "*"
+      }
+    },
+    "node_modules/@types/linkify-it": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/@types/linkify-it/-/linkify-it-5.0.0.tgz",
+      "integrity": "sha512-sVDA58zAw4eWAffKOaQH5/5j3XeayukzDk+ewSsnv3p4yJEZHCCzMDiZM8e0OUrRvmpGZ85jf4yDHkHsgBNr9Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/markdown-it": {
+      "version": "14.1.2",
+      "resolved": "https://registry.npmjs.org/@types/markdown-it/-/markdown-it-14.1.2.tgz",
+      "integrity": "sha512-promo4eFwuiW+TfGxhi+0x3czqTYJkG8qB17ZUJiVF10Xm7NLVRSLUsfRTU/6h1e24VvRnXCx+hG7li58lkzog==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/linkify-it": "^5",
+        "@types/mdurl": "^2"
+      }
+    },
+    "node_modules/@types/mdast": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/@types/mdast/-/mdast-4.0.4.tgz",
+      "integrity": "sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "*"
+      }
+    },
+    "node_modules/@types/mdurl": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@types/mdurl/-/mdurl-2.0.0.tgz",
+      "integrity": "sha512-RGdgjQUZba5p6QEFAVx2OGb8rQDL/cPRG7GiedRzMcJ1tYnUANBncjbSB1NRGwbvjcPeikRABz2nshyPk1bhWg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/unist": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
+      "integrity": "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/web-bluetooth": {
+      "version": "0.0.21",
+      "resolved": "https://registry.npmjs.org/@types/web-bluetooth/-/web-bluetooth-0.0.21.tgz",
+      "integrity": "sha512-oIQLCGWtcFZy2JW77j9k8nHzAOpqMHLQejDA48XXMWH6tjCQHz5RCFz1bzsmROyL6PUm+LLnUiI4BCn221inxA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@ungap/structured-clone": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.0.tgz",
+      "integrity": "sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/@vitejs/plugin-vue": {
+      "version": "5.2.4",
+      "resolved": "https://registry.npmjs.org/@vitejs/plugin-vue/-/plugin-vue-5.2.4.tgz",
+      "integrity": "sha512-7Yx/SXSOcQq5HiiV3orevHUFn+pmMB4cgbEkDYgnkUWb0WfeQ/wa2yFv6D5ICiCQOVpjA7vYDXrC7AGO8yjDHA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.0.0 || >=20.0.0"
+      },
+      "peerDependencies": {
+        "vite": "^5.0.0 || ^6.0.0",
+        "vue": "^3.2.25"
+      }
+    },
+    "node_modules/@vue/compiler-core": {
+      "version": "3.5.25",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.5.25.tgz",
+      "integrity": "sha512-vay5/oQJdsNHmliWoZfHPoVZZRmnSWhug0BYT34njkYTPqClh3DNWLkZNJBVSjsNMrg0CCrBfoKkjZQPM/QVUw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.28.5",
+        "@vue/shared": "3.5.25",
+        "entities": "^4.5.0",
+        "estree-walker": "^2.0.2",
+        "source-map-js": "^1.2.1"
+      }
+    },
+    "node_modules/@vue/compiler-dom": {
+      "version": "3.5.25",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.5.25.tgz",
+      "integrity": "sha512-4We0OAcMZsKgYoGlMjzYvaoErltdFI2/25wqanuTu+S4gismOTRTBPi4IASOjxWdzIwrYSjnqONfKvuqkXzE2Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vue/compiler-core": "3.5.25",
+        "@vue/shared": "3.5.25"
+      }
+    },
+    "node_modules/@vue/compiler-sfc": {
+      "version": "3.5.25",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.5.25.tgz",
+      "integrity": "sha512-PUgKp2rn8fFsI++lF2sO7gwO2d9Yj57Utr5yEsDf3GNaQcowCLKL7sf+LvVFvtJDXUp/03+dC6f2+LCv5aK1ag==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.28.5",
+        "@vue/compiler-core": "3.5.25",
+        "@vue/compiler-dom": "3.5.25",
+        "@vue/compiler-ssr": "3.5.25",
+        "@vue/shared": "3.5.25",
+        "estree-walker": "^2.0.2",
+        "magic-string": "^0.30.21",
+        "postcss": "^8.5.6",
+        "source-map-js": "^1.2.1"
+      }
+    },
+    "node_modules/@vue/compiler-ssr": {
+      "version": "3.5.25",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-ssr/-/compiler-ssr-3.5.25.tgz",
+      "integrity": "sha512-ritPSKLBcParnsKYi+GNtbdbrIE1mtuFEJ4U1sWeuOMlIziK5GtOL85t5RhsNy4uWIXPgk+OUdpnXiTdzn8o3A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vue/compiler-dom": "3.5.25",
+        "@vue/shared": "3.5.25"
+      }
+    },
+    "node_modules/@vue/devtools-api": {
+      "version": "7.7.9",
+      "resolved": "https://registry.npmjs.org/@vue/devtools-api/-/devtools-api-7.7.9.tgz",
+      "integrity": "sha512-kIE8wvwlcZ6TJTbNeU2HQNtaxLx3a84aotTITUuL/4bzfPxzajGBOoqjMhwZJ8L9qFYDU/lAYMEEm11dnZOD6g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vue/devtools-kit": "^7.7.9"
+      }
+    },
+    "node_modules/@vue/devtools-kit": {
+      "version": "7.7.9",
+      "resolved": "https://registry.npmjs.org/@vue/devtools-kit/-/devtools-kit-7.7.9.tgz",
+      "integrity": "sha512-PyQ6odHSgiDVd4hnTP+aDk2X4gl2HmLDfiyEnn3/oV+ckFDuswRs4IbBT7vacMuGdwY/XemxBoh302ctbsptuA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vue/devtools-shared": "^7.7.9",
+        "birpc": "^2.3.0",
+        "hookable": "^5.5.3",
+        "mitt": "^3.0.1",
+        "perfect-debounce": "^1.0.0",
+        "speakingurl": "^14.0.1",
+        "superjson": "^2.2.2"
+      }
+    },
+    "node_modules/@vue/devtools-shared": {
+      "version": "7.7.9",
+      "resolved": "https://registry.npmjs.org/@vue/devtools-shared/-/devtools-shared-7.7.9.tgz",
+      "integrity": "sha512-iWAb0v2WYf0QWmxCGy0seZNDPdO3Sp5+u78ORnyeonS6MT4PC7VPrryX2BpMJrwlDeaZ6BD4vP4XKjK0SZqaeA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "rfdc": "^1.4.1"
+      }
+    },
+    "node_modules/@vue/reactivity": {
+      "version": "3.5.25",
+      "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.5.25.tgz",
+      "integrity": "sha512-5xfAypCQepv4Jog1U4zn8cZIcbKKFka3AgWHEFQeK65OW+Ys4XybP6z2kKgws4YB43KGpqp5D/K3go2UPPunLA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vue/shared": "3.5.25"
+      }
+    },
+    "node_modules/@vue/runtime-core": {
+      "version": "3.5.25",
+      "resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.5.25.tgz",
+      "integrity": "sha512-Z751v203YWwYzy460bzsYQISDfPjHTl+6Zzwo/a3CsAf+0ccEjQ8c+0CdX1WsumRTHeywvyUFtW6KvNukT/smA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vue/reactivity": "3.5.25",
+        "@vue/shared": "3.5.25"
+      }
+    },
+    "node_modules/@vue/runtime-dom": {
+      "version": "3.5.25",
+      "resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.5.25.tgz",
+      "integrity": "sha512-a4WrkYFbb19i9pjkz38zJBg8wa/rboNERq3+hRRb0dHiJh13c+6kAbgqCPfMaJ2gg4weWD3APZswASOfmKwamA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vue/reactivity": "3.5.25",
+        "@vue/runtime-core": "3.5.25",
+        "@vue/shared": "3.5.25",
+        "csstype": "^3.1.3"
+      }
+    },
+    "node_modules/@vue/server-renderer": {
+      "version": "3.5.25",
+      "resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.5.25.tgz",
+      "integrity": "sha512-UJaXR54vMG61i8XNIzTSf2Q7MOqZHpp8+x3XLGtE3+fL+nQd+k7O5+X3D/uWrnQXOdMw5VPih+Uremcw+u1woQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vue/compiler-ssr": "3.5.25",
+        "@vue/shared": "3.5.25"
+      },
+      "peerDependencies": {
+        "vue": "3.5.25"
+      }
+    },
+    "node_modules/@vue/shared": {
+      "version": "3.5.25",
+      "resolved": "https://registry.npmjs.org/@vue/shared/-/shared-3.5.25.tgz",
+      "integrity": "sha512-AbOPdQQnAnzs58H2FrrDxYj/TJfmeS2jdfEEhgiKINy+bnOANmVizIEgq1r+C5zsbs6l1CCQxtcj71rwNQ4jWg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@vueuse/core": {
+      "version": "12.8.2",
+      "resolved": "https://registry.npmjs.org/@vueuse/core/-/core-12.8.2.tgz",
+      "integrity": "sha512-HbvCmZdzAu3VGi/pWYm5Ut+Kd9mn1ZHnn4L5G8kOQTPs/IwIAmJoBrmYk2ckLArgMXZj0AW3n5CAejLUO+PhdQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/web-bluetooth": "^0.0.21",
+        "@vueuse/metadata": "12.8.2",
+        "@vueuse/shared": "12.8.2",
+        "vue": "^3.5.13"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
+    "node_modules/@vueuse/integrations": {
+      "version": "12.8.2",
+      "resolved": "https://registry.npmjs.org/@vueuse/integrations/-/integrations-12.8.2.tgz",
+      "integrity": "sha512-fbGYivgK5uBTRt7p5F3zy6VrETlV9RtZjBqd1/HxGdjdckBgBM4ugP8LHpjolqTj14TXTxSK1ZfgPbHYyGuH7g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vueuse/core": "12.8.2",
+        "@vueuse/shared": "12.8.2",
+        "vue": "^3.5.13"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      },
+      "peerDependencies": {
+        "async-validator": "^4",
+        "axios": "^1",
+        "change-case": "^5",
+        "drauu": "^0.4",
+        "focus-trap": "^7",
+        "fuse.js": "^7",
+        "idb-keyval": "^6",
+        "jwt-decode": "^4",
+        "nprogress": "^0.2",
+        "qrcode": "^1.5",
+        "sortablejs": "^1",
+        "universal-cookie": "^7"
+      },
+      "peerDependenciesMeta": {
+        "async-validator": {
+          "optional": true
+        },
+        "axios": {
+          "optional": true
+        },
+        "change-case": {
+          "optional": true
+        },
+        "drauu": {
+          "optional": true
+        },
+        "focus-trap": {
+          "optional": true
+        },
+        "fuse.js": {
+          "optional": true
+        },
+        "idb-keyval": {
+          "optional": true
+        },
+        "jwt-decode": {
+          "optional": true
+        },
+        "nprogress": {
+          "optional": true
+        },
+        "qrcode": {
+          "optional": true
+        },
+        "sortablejs": {
+          "optional": true
+        },
+        "universal-cookie": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vueuse/metadata": {
+      "version": "12.8.2",
+      "resolved": "https://registry.npmjs.org/@vueuse/metadata/-/metadata-12.8.2.tgz",
+      "integrity": "sha512-rAyLGEuoBJ/Il5AmFHiziCPdQzRt88VxR+Y/A/QhJ1EWtWqPBBAxTAFaSkviwEuOEZNtW8pvkPgoCZQ+HxqW1A==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
+    "node_modules/@vueuse/shared": {
+      "version": "12.8.2",
+      "resolved": "https://registry.npmjs.org/@vueuse/shared/-/shared-12.8.2.tgz",
+      "integrity": "sha512-dznP38YzxZoNloI0qpEfpkms8knDtaoQ6Y/sfS0L7Yki4zh40LFHEhur0odJC6xTHG5dxWVPiUWBXn+wCG2s5w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "vue": "^3.5.13"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
+    "node_modules/algoliasearch": {
+      "version": "5.46.0",
+      "resolved": "https://registry.npmjs.org/algoliasearch/-/algoliasearch-5.46.0.tgz",
+      "integrity": "sha512-7ML6fa2K93FIfifG3GMWhDEwT5qQzPTmoHKCTvhzGEwdbQ4n0yYUWZlLYT75WllTGJCJtNUI0C1ybN4BCegqvg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@algolia/abtesting": "1.12.0",
+        "@algolia/client-abtesting": "5.46.0",
+        "@algolia/client-analytics": "5.46.0",
+        "@algolia/client-common": "5.46.0",
+        "@algolia/client-insights": "5.46.0",
+        "@algolia/client-personalization": "5.46.0",
+        "@algolia/client-query-suggestions": "5.46.0",
+        "@algolia/client-search": "5.46.0",
+        "@algolia/ingestion": "1.46.0",
+        "@algolia/monitoring": "1.46.0",
+        "@algolia/recommend": "5.46.0",
+        "@algolia/requester-browser-xhr": "5.46.0",
+        "@algolia/requester-fetch": "5.46.0",
+        "@algolia/requester-node-http": "5.46.0"
+      },
+      "engines": {
+        "node": ">= 14.0.0"
+      }
+    },
+    "node_modules/birpc": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/birpc/-/birpc-2.9.0.tgz",
+      "integrity": "sha512-KrayHS5pBi69Xi9JmvoqrIgYGDkD6mcSe/i6YKi3w5kekCLzrX4+nawcXqrj2tIp50Kw/mT/s3p+GVK0A0sKxw==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
+    "node_modules/ccount": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/ccount/-/ccount-2.0.1.tgz",
+      "integrity": "sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/character-entities-html4": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/character-entities-html4/-/character-entities-html4-2.1.0.tgz",
+      "integrity": "sha512-1v7fgQRj6hnSwFpq1Eu0ynr/CDEw0rXo2B61qXrLNdHZmPKgb7fqS1a2JwF0rISo9q77jDI8VMEHoApn8qDoZA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/character-entities-legacy": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/character-entities-legacy/-/character-entities-legacy-3.0.0.tgz",
+      "integrity": "sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/comma-separated-tokens": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/comma-separated-tokens/-/comma-separated-tokens-2.0.3.tgz",
+      "integrity": "sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/copy-anything": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/copy-anything/-/copy-anything-4.0.5.tgz",
+      "integrity": "sha512-7Vv6asjS4gMOuILabD3l739tsaxFQmC+a7pLZm02zyvs8p977bL3zEgq3yDk5rn9B0PbYgIv++jmHcuUab4RhA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-what": "^5.2.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/mesqueeb"
+      }
+    },
+    "node_modules/csstype": {
+      "version": "3.2.3",
+      "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
+      "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/dequal": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
+      "integrity": "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/devlop": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/devlop/-/devlop-1.1.0.tgz",
+      "integrity": "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "dequal": "^2.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/emoji-regex-xs": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex-xs/-/emoji-regex-xs-1.0.0.tgz",
+      "integrity": "sha512-LRlerrMYoIDrT6jgpeZ2YYl/L8EulRTt5hQcYjy5AInh7HWXKimpqx68aknBFpGL2+/IcogTcaydJEgaTmOpDg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/entities": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
+      "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
+    "node_modules/esbuild": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.21.5.tgz",
+      "integrity": "sha512-mg3OPMV4hXywwpoDxu3Qda5xCKQi+vCTZq8S9J/EpkhB2HzKXq4SNFZE3+NK93JYxc8VMSep+lOUSC/RVKaBqw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.21.5",
+        "@esbuild/android-arm": "0.21.5",
+        "@esbuild/android-arm64": "0.21.5",
+        "@esbuild/android-x64": "0.21.5",
+        "@esbuild/darwin-arm64": "0.21.5",
+        "@esbuild/darwin-x64": "0.21.5",
+        "@esbuild/freebsd-arm64": "0.21.5",
+        "@esbuild/freebsd-x64": "0.21.5",
+        "@esbuild/linux-arm": "0.21.5",
+        "@esbuild/linux-arm64": "0.21.5",
+        "@esbuild/linux-ia32": "0.21.5",
+        "@esbuild/linux-loong64": "0.21.5",
+        "@esbuild/linux-mips64el": "0.21.5",
+        "@esbuild/linux-ppc64": "0.21.5",
+        "@esbuild/linux-riscv64": "0.21.5",
+        "@esbuild/linux-s390x": "0.21.5",
+        "@esbuild/linux-x64": "0.21.5",
+        "@esbuild/netbsd-x64": "0.21.5",
+        "@esbuild/openbsd-x64": "0.21.5",
+        "@esbuild/sunos-x64": "0.21.5",
+        "@esbuild/win32-arm64": "0.21.5",
+        "@esbuild/win32-ia32": "0.21.5",
+        "@esbuild/win32-x64": "0.21.5"
+      }
+    },
+    "node_modules/estree-walker": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-2.0.2.tgz",
+      "integrity": "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/focus-trap": {
+      "version": "7.6.6",
+      "resolved": "https://registry.npmjs.org/focus-trap/-/focus-trap-7.6.6.tgz",
+      "integrity": "sha512-v/Z8bvMCajtx4mEXmOo7QEsIzlIOqRXTIwgUfsFOF9gEsespdbD0AkPIka1bSXZ8Y8oZ+2IVDQZePkTfEHZl7Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tabbable": "^6.3.0"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/hast-util-to-html": {
+      "version": "9.0.5",
+      "resolved": "https://registry.npmjs.org/hast-util-to-html/-/hast-util-to-html-9.0.5.tgz",
+      "integrity": "sha512-OguPdidb+fbHQSU4Q4ZiLKnzWo8Wwsf5bZfbvu7//a9oTYoqD/fWpe96NuHkoS9h0ccGOTe0C4NGXdtS0iObOw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/hast": "^3.0.0",
+        "@types/unist": "^3.0.0",
+        "ccount": "^2.0.0",
+        "comma-separated-tokens": "^2.0.0",
+        "hast-util-whitespace": "^3.0.0",
+        "html-void-elements": "^3.0.0",
+        "mdast-util-to-hast": "^13.0.0",
+        "property-information": "^7.0.0",
+        "space-separated-tokens": "^2.0.0",
+        "stringify-entities": "^4.0.0",
+        "zwitch": "^2.0.4"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/hast-util-whitespace": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/hast-util-whitespace/-/hast-util-whitespace-3.0.0.tgz",
+      "integrity": "sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/hast": "^3.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/hookable": {
+      "version": "5.5.3",
+      "resolved": "https://registry.npmjs.org/hookable/-/hookable-5.5.3.tgz",
+      "integrity": "sha512-Yc+BQe8SvoXH1643Qez1zqLRmbA5rCL+sSmk6TVos0LWVfNIB7PGncdlId77WzLGSIB5KaWgTaNTs2lNVEI6VQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/html-void-elements": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/html-void-elements/-/html-void-elements-3.0.0.tgz",
+      "integrity": "sha512-bEqo66MRXsUGxWHV5IP0PUiAWwoEjba4VCzg0LjFJBpchPaTfyfCKTG6bc5F8ucKec3q5y6qOdGyYTSBEvhCrg==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/is-what": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/is-what/-/is-what-5.5.0.tgz",
+      "integrity": "sha512-oG7cgbmg5kLYae2N5IVd3jm2s+vldjxJzK1pcu9LfpGuQ93MQSzo0okvRna+7y5ifrD+20FE8FvjusyGaz14fw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/mesqueeb"
+      }
+    },
+    "node_modules/magic-string": {
+      "version": "0.30.21",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
+      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.5"
+      }
+    },
+    "node_modules/mark.js": {
+      "version": "8.11.1",
+      "resolved": "https://registry.npmjs.org/mark.js/-/mark.js-8.11.1.tgz",
+      "integrity": "sha512-1I+1qpDt4idfgLQG+BNWmrqku+7/2bi5nLf4YwF8y8zXvmfiTBY3PV3ZibfrjBueCByROpuBjLLFCajqkgYoLQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/mdast-util-to-hast": {
+      "version": "13.2.1",
+      "resolved": "https://registry.npmjs.org/mdast-util-to-hast/-/mdast-util-to-hast-13.2.1.tgz",
+      "integrity": "sha512-cctsq2wp5vTsLIcaymblUriiTcZd0CwWtCbLvrOzYCDZoWyMNV8sZ7krj09FSnsiJi3WVsHLM4k6Dq/yaPyCXA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "@ungap/structured-clone": "^1.0.0",
+        "devlop": "^1.0.0",
+        "micromark-util-sanitize-uri": "^2.0.0",
+        "trim-lines": "^3.0.0",
+        "unist-util-position": "^5.0.0",
+        "unist-util-visit": "^5.0.0",
+        "vfile": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-util-character": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-character/-/micromark-util-character-2.1.1.tgz",
+      "integrity": "sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-encode": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-encode/-/micromark-util-encode-2.0.1.tgz",
+      "integrity": "sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/micromark-util-sanitize-uri": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-sanitize-uri/-/micromark-util-sanitize-uri-2.0.1.tgz",
+      "integrity": "sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-encode": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-symbol": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-symbol/-/micromark-util-symbol-2.0.1.tgz",
+      "integrity": "sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/micromark-util-types": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/micromark-util-types/-/micromark-util-types-2.0.2.tgz",
+      "integrity": "sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/minisearch": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/minisearch/-/minisearch-7.2.0.tgz",
+      "integrity": "sha512-dqT2XBYUOZOiC5t2HRnwADjhNS2cecp9u+TJRiJ1Qp/f5qjkeT5APcGPjHw+bz89Ms8Jp+cG4AlE+QZ/QnDglg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/mitt": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/mitt/-/mitt-3.0.1.tgz",
+      "integrity": "sha512-vKivATfr97l2/QBCYAkXYDbrIWPM2IIKEl7YPhjCvKlG3kE2gm+uBo6nEXK3M5/Ffh/FLpKExzOQ3JJoJGFKBw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/nanoid": {
+      "version": "3.3.11",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
+      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
+    "node_modules/oniguruma-to-es": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/oniguruma-to-es/-/oniguruma-to-es-3.1.1.tgz",
+      "integrity": "sha512-bUH8SDvPkH3ho3dvwJwfonjlQ4R80vjyvrU8YpxuROddv55vAEJrTuCuCVUhhsHbtlD9tGGbaNApGQckXhS8iQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex-xs": "^1.0.0",
+        "regex": "^6.0.1",
+        "regex-recursion": "^6.0.2"
+      }
+    },
+    "node_modules/perfect-debounce": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/perfect-debounce/-/perfect-debounce-1.0.0.tgz",
+      "integrity": "sha512-xCy9V055GLEqoFaHoC1SoLIaLmWctgCUaBaWxDZ7/Zx4CTyX7cJQLJOok/orfjZAh9kEYpjJa4d0KcJmCbctZA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/picocolors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/postcss": {
+      "version": "8.5.6",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
+      "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.11",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
+    "node_modules/preact": {
+      "version": "10.28.0",
+      "resolved": "https://registry.npmjs.org/preact/-/preact-10.28.0.tgz",
+      "integrity": "sha512-rytDAoiXr3+t6OIP3WGlDd0ouCUG1iCWzkcY3++Nreuoi17y6T5i/zRhe6uYfoVcxq6YU+sBtJouuRDsq8vvqA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/preact"
+      }
+    },
+    "node_modules/property-information": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/property-information/-/property-information-7.1.0.tgz",
+      "integrity": "sha512-TwEZ+X+yCJmYfL7TPUOcvBZ4QfoT5YenQiJuX//0th53DE6w0xxLEtfK3iyryQFddXuvkIk51EEgrJQ0WJkOmQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/regex": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/regex/-/regex-6.1.0.tgz",
+      "integrity": "sha512-6VwtthbV4o/7+OaAF9I5L5V3llLEsoPyq9P1JVXkedTP33c7MfCG0/5NOPcSJn0TzXcG9YUrR0gQSWioew3LDg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "regex-utilities": "^2.3.0"
+      }
+    },
+    "node_modules/regex-recursion": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/regex-recursion/-/regex-recursion-6.0.2.tgz",
+      "integrity": "sha512-0YCaSCq2VRIebiaUviZNs0cBz1kg5kVS2UKUfNIx8YVs1cN3AV7NTctO5FOKBA+UT2BPJIWZauYHPqJODG50cg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "regex-utilities": "^2.3.0"
+      }
+    },
+    "node_modules/regex-utilities": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/regex-utilities/-/regex-utilities-2.3.0.tgz",
+      "integrity": "sha512-8VhliFJAWRaUiVvREIiW2NXXTmHs4vMNnSzuJVhscgmGav3g9VDxLrQndI3dZZVVdp0ZO/5v0xmX516/7M9cng==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/rfdc": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/rfdc/-/rfdc-1.4.1.tgz",
+      "integrity": "sha512-q1b3N5QkRUWUl7iyylaaj3kOpIT0N2i9MqIEQXP73GVsN9cw3fdx8X63cEmWhJGi2PPCF23Ijp7ktmd39rawIA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/rollup": {
+      "version": "4.53.3",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.53.3.tgz",
+      "integrity": "sha512-w8GmOxZfBmKknvdXU1sdM9NHcoQejwF/4mNgj2JuEEdRaHwwF12K7e9eXn1nLZ07ad+du76mkVsyeb2rKGllsA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "1.0.8"
+      },
+      "bin": {
+        "rollup": "dist/bin/rollup"
+      },
+      "engines": {
+        "node": ">=18.0.0",
+        "npm": ">=8.0.0"
+      },
+      "optionalDependencies": {
+        "@rollup/rollup-android-arm-eabi": "4.53.3",
+        "@rollup/rollup-android-arm64": "4.53.3",
+        "@rollup/rollup-darwin-arm64": "4.53.3",
+        "@rollup/rollup-darwin-x64": "4.53.3",
+        "@rollup/rollup-freebsd-arm64": "4.53.3",
+        "@rollup/rollup-freebsd-x64": "4.53.3",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.53.3",
+        "@rollup/rollup-linux-arm-musleabihf": "4.53.3",
+        "@rollup/rollup-linux-arm64-gnu": "4.53.3",
+        "@rollup/rollup-linux-arm64-musl": "4.53.3",
+        "@rollup/rollup-linux-loong64-gnu": "4.53.3",
+        "@rollup/rollup-linux-ppc64-gnu": "4.53.3",
+        "@rollup/rollup-linux-riscv64-gnu": "4.53.3",
+        "@rollup/rollup-linux-riscv64-musl": "4.53.3",
+        "@rollup/rollup-linux-s390x-gnu": "4.53.3",
+        "@rollup/rollup-linux-x64-gnu": "4.53.3",
+        "@rollup/rollup-linux-x64-musl": "4.53.3",
+        "@rollup/rollup-openharmony-arm64": "4.53.3",
+        "@rollup/rollup-win32-arm64-msvc": "4.53.3",
+        "@rollup/rollup-win32-ia32-msvc": "4.53.3",
+        "@rollup/rollup-win32-x64-gnu": "4.53.3",
+        "@rollup/rollup-win32-x64-msvc": "4.53.3",
+        "fsevents": "~2.3.2"
+      }
+    },
+    "node_modules/search-insights": {
+      "version": "2.17.3",
+      "resolved": "https://registry.npmjs.org/search-insights/-/search-insights-2.17.3.tgz",
+      "integrity": "sha512-RQPdCYTa8A68uM2jwxoY842xDhvx3E5LFL1LxvxCNMev4o5mLuokczhzjAgGwUZBAmOKZknArSxLKmXtIi2AxQ==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/shiki": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/shiki/-/shiki-2.5.0.tgz",
+      "integrity": "sha512-mI//trrsaiCIPsja5CNfsyNOqgAZUb6VpJA+340toL42UpzQlXpwRV9nch69X6gaUxrr9kaOOa6e3y3uAkGFxQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@shikijs/core": "2.5.0",
+        "@shikijs/engine-javascript": "2.5.0",
+        "@shikijs/engine-oniguruma": "2.5.0",
+        "@shikijs/langs": "2.5.0",
+        "@shikijs/themes": "2.5.0",
+        "@shikijs/types": "2.5.0",
+        "@shikijs/vscode-textmate": "^10.0.2",
+        "@types/hast": "^3.0.4"
+      }
+    },
+    "node_modules/source-map-js": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/space-separated-tokens": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/space-separated-tokens/-/space-separated-tokens-2.0.2.tgz",
+      "integrity": "sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/speakingurl": {
+      "version": "14.0.1",
+      "resolved": "https://registry.npmjs.org/speakingurl/-/speakingurl-14.0.1.tgz",
+      "integrity": "sha512-1POYv7uv2gXoyGFpBCmpDVSNV74IfsWlDW216UPjbWufNf+bSU6GdbDsxdcxtfwb4xlI3yxzOTKClUosxARYrQ==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/stringify-entities": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/stringify-entities/-/stringify-entities-4.0.4.tgz",
+      "integrity": "sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "character-entities-html4": "^2.0.0",
+        "character-entities-legacy": "^3.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/superjson": {
+      "version": "2.2.6",
+      "resolved": "https://registry.npmjs.org/superjson/-/superjson-2.2.6.tgz",
+      "integrity": "sha512-H+ue8Zo4vJmV2nRjpx86P35lzwDT3nItnIsocgumgr0hHMQ+ZGq5vrERg9kJBo5AWGmxZDhzDo+WVIJqkB0cGA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "copy-anything": "^4"
+      },
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/tabbable": {
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/tabbable/-/tabbable-6.3.0.tgz",
+      "integrity": "sha512-EIHvdY5bPLuWForiR/AN2Bxngzpuwn1is4asboytXtpTgsArc+WmSJKVLlhdh71u7jFcryDqB2A8lQvj78MkyQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/trim-lines": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/trim-lines/-/trim-lines-3.0.1.tgz",
+      "integrity": "sha512-kRj8B+YHZCc9kQYdWfJB2/oUl9rA99qbowYYBtr4ui4mZyAQ2JpvVBd/6U2YloATfqBhBTSMhTpgBHtU0Mf3Rg==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/unist-util-is": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/unist-util-is/-/unist-util-is-6.0.1.tgz",
+      "integrity": "sha512-LsiILbtBETkDz8I9p1dQ0uyRUWuaQzd/cuEeS1hoRSyW5E5XGmTzlwY1OrNzzakGowI9Dr/I8HVaw4hTtnxy8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/unist-util-position": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/unist-util-position/-/unist-util-position-5.0.0.tgz",
+      "integrity": "sha512-fucsC7HjXvkB5R3kTCO7kUjRdrS0BJt3M/FPxmHMBOm8JQi2BsHAHFsy27E0EolP8rp0NzXsJ+jNPyDWvOJZPA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/unist-util-stringify-position": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-4.0.0.tgz",
+      "integrity": "sha512-0ASV06AAoKCDkS2+xw5RXJywruurpbC4JZSm7nr7MOt1ojAzvyyaO+UxZf18j8FCF6kmzCZKcAgN/yu2gm2XgQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/unist-util-visit": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/unist-util-visit/-/unist-util-visit-5.0.0.tgz",
+      "integrity": "sha512-MR04uvD+07cwl/yhVuVWAtw+3GOR/knlL55Nd/wAdblk27GCVt3lqpTivy/tkJcZoNPzTwS1Y+KMojlLDhoTzg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0",
+        "unist-util-is": "^6.0.0",
+        "unist-util-visit-parents": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/unist-util-visit-parents": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/unist-util-visit-parents/-/unist-util-visit-parents-6.0.2.tgz",
+      "integrity": "sha512-goh1s1TBrqSqukSc8wrjwWhL0hiJxgA8m4kFxGlQ+8FYQ3C/m11FcTs4YYem7V664AhHVvgoQLk890Ssdsr2IQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0",
+        "unist-util-is": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/vfile": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/vfile/-/vfile-6.0.3.tgz",
+      "integrity": "sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0",
+        "vfile-message": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/vfile-message": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-4.0.3.tgz",
+      "integrity": "sha512-QTHzsGd1EhbZs4AsQ20JX1rC3cOlt/IWJruk893DfLRr57lcnOeMaWG4K0JrRta4mIJZKth2Au3mM3u03/JWKw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0",
+        "unist-util-stringify-position": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/vite": {
+      "version": "5.4.21",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-5.4.21.tgz",
+      "integrity": "sha512-o5a9xKjbtuhY6Bi5S3+HvbRERmouabWbyUcpXXUA1u+GNUKoROi9byOJ8M0nHbHYHkYICiMlqxkg1KkYmm25Sw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "esbuild": "^0.21.3",
+        "postcss": "^8.4.43",
+        "rollup": "^4.20.0"
+      },
+      "bin": {
+        "vite": "bin/vite.js"
+      },
+      "engines": {
+        "node": "^18.0.0 || >=20.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/vitejs/vite?sponsor=1"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      },
+      "peerDependencies": {
+        "@types/node": "^18.0.0 || >=20.0.0",
+        "less": "*",
+        "lightningcss": "^1.21.0",
+        "sass": "*",
+        "sass-embedded": "*",
+        "stylus": "*",
+        "sugarss": "*",
+        "terser": "^5.4.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        },
+        "less": {
+          "optional": true
+        },
+        "lightningcss": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        },
+        "sass-embedded": {
+          "optional": true
+        },
+        "stylus": {
+          "optional": true
+        },
+        "sugarss": {
+          "optional": true
+        },
+        "terser": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vitepress": {
+      "version": "1.6.4",
+      "resolved": "https://registry.npmjs.org/vitepress/-/vitepress-1.6.4.tgz",
+      "integrity": "sha512-+2ym1/+0VVrbhNyRoFFesVvBvHAVMZMK0rw60E3X/5349M1GuVdKeazuksqopEdvkKwKGs21Q729jX81/bkBJg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@docsearch/css": "3.8.2",
+        "@docsearch/js": "3.8.2",
+        "@iconify-json/simple-icons": "^1.2.21",
+        "@shikijs/core": "^2.1.0",
+        "@shikijs/transformers": "^2.1.0",
+        "@shikijs/types": "^2.1.0",
+        "@types/markdown-it": "^14.1.2",
+        "@vitejs/plugin-vue": "^5.2.1",
+        "@vue/devtools-api": "^7.7.0",
+        "@vue/shared": "^3.5.13",
+        "@vueuse/core": "^12.4.0",
+        "@vueuse/integrations": "^12.4.0",
+        "focus-trap": "^7.6.4",
+        "mark.js": "8.11.1",
+        "minisearch": "^7.1.1",
+        "shiki": "^2.1.0",
+        "vite": "^5.4.14",
+        "vue": "^3.5.13"
+      },
+      "bin": {
+        "vitepress": "bin/vitepress.js"
+      },
+      "peerDependencies": {
+        "markdown-it-mathjax3": "^4",
+        "postcss": "^8"
+      },
+      "peerDependenciesMeta": {
+        "markdown-it-mathjax3": {
+          "optional": true
+        },
+        "postcss": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vue": {
+      "version": "3.5.25",
+      "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.25.tgz",
+      "integrity": "sha512-YLVdgv2K13WJ6n+kD5owehKtEXwdwXuj2TTyJMsO7pSeKw2bfRNZGjhB7YzrpbMYj5b5QsUebHpOqR3R3ziy/g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vue/compiler-dom": "3.5.25",
+        "@vue/compiler-sfc": "3.5.25",
+        "@vue/runtime-dom": "3.5.25",
+        "@vue/server-renderer": "3.5.25",
+        "@vue/shared": "3.5.25"
+      },
+      "peerDependencies": {
+        "typescript": "*"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/zwitch": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/zwitch/-/zwitch-2.0.4.tgz",
+      "integrity": "sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    }
+  }
+}
diff --git a/docs/package.json b/docs/package.json
new file mode 100644
index 0000000..f61f78c
--- /dev/null
+++ b/docs/package.json
@@ -0,0 +1,16 @@
+{
+  "name": "trusted-server-docs",
+  "version": "1.0.0",
+  "description": "Documentation site for Trusted Server",
+  "license": "ISC",
+  "author": "",
+  "type": "module",
+  "scripts": {
+    "dev": "vitepress dev",
+    "build": "vitepress build",
+    "preview": "vitepress preview"
+  },
+  "devDependencies": {
+    "vitepress": "^1.5.0"
+  }
+}
diff --git a/docs/public/CNAME b/docs/public/CNAME
new file mode 100644
index 0000000..dead23e
--- /dev/null
+++ b/docs/public/CNAME
@@ -0,0 +1 @@
+your-custom-domain.com