From ac612b2fa94dfa8ba6e054893bd2589ed243ca97 Mon Sep 17 00:00:00 2001
From: prk-Jr <prakashsagwara@gmail.com>
Date: Thu, 5 Mar 2026 16:02:30 +0530
Subject: [PATCH 01/15] Wip integration testing with testcontainers

---
 Cargo.lock                                    | 2100 ++++++++++++++++-
 Cargo.toml                                    |    3 +-
 INTEGRATION_TESTS_PLAN.md                     | 1966 +++++++++++++++
 crates/fastly/src/main.rs                     |    3 +
 crates/integration-tests/Cargo.toml           |   22 +
 .../tests/common/assertions.rs                |  276 +++
 .../integration-tests/tests/common/config.rs  |   91 +
 crates/integration-tests/tests/common/mod.rs  |    7 +
 .../integration-tests/tests/common/runtime.rs |  122 +
 9 files changed, 4491 insertions(+), 99 deletions(-)
 create mode 100644 INTEGRATION_TESTS_PLAN.md
 create mode 100644 crates/integration-tests/Cargo.toml
 create mode 100644 crates/integration-tests/tests/common/assertions.rs
 create mode 100644 crates/integration-tests/tests/common/config.rs
 create mode 100644 crates/integration-tests/tests/common/mod.rs
 create mode 100644 crates/integration-tests/tests/common/runtime.rs

diff --git a/Cargo.lock b/Cargo.lock
index 67fe9e7f..0404a7a4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -18,6 +18,19 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "getrandom 0.3.4",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.4"
@@ -69,6 +82,44 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d902e3d592a523def97af8f317b08ce16b7ab854c1985a0c671e6f15cebc236"
 
+[[package]]
+name = "astral-tokio-tar"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec179a06c1769b1e42e1e2cbe74c7dcdb3d6383c838454d063eaac5bbb7ebbe5"
+dependencies = [
+ "filetime",
+ "futures-core",
+ "libc",
+ "portable-atomic",
+ "rustc-hash",
+ "tokio",
+ "tokio-stream",
+ "xattr",
+]
+
+[[package]]
+name = "async-stream"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b5a71a6f37880a80d1d7f19efd781e4b5de42c88f0722cc13bcb6cc2cfe8476"
+dependencies = [
+ "async-stream-impl",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream-impl"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+]
+
 [[package]]
 name = "async-trait"
 version = "0.1.89"
@@ -80,18 +131,73 @@ dependencies = [
  "syn 2.0.111",
 ]
 
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
 [[package]]
 name = "autocfg"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
+[[package]]
+name = "axum"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b52af3cb4058c895d37317bb27508dccc8e5f2d39454016b297bf4a400597b8"
+dependencies = [
+ "axum-core",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "itoa",
+ "matchit 0.8.4",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "sync_wrapper",
+ "tower",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+]
+
 [[package]]
 name = "base16ct"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
+[[package]]
+name = "base64"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -137,6 +243,83 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "bollard"
+version = "0.19.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87a52479c9237eb04047ddb94788c41ca0d26eaff8b697ecfbb4c32f7fdc3b1b"
+dependencies = [
+ "async-stream",
+ "base64 0.22.1",
+ "bitflags 2.10.0",
+ "bollard-buildkit-proto",
+ "bollard-stubs",
+ "bytes",
+ "chrono",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "home",
+ "http",
+ "http-body-util",
+ "hyper",
+ "hyper-named-pipe",
+ "hyper-rustls",
+ "hyper-util",
+ "hyperlocal",
+ "log",
+ "num",
+ "pin-project-lite",
+ "rand 0.9.2",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-pemfile",
+ "rustls-pki-types",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "serde_repr",
+ "serde_urlencoded",
+ "thiserror 2.0.17",
+ "tokio",
+ "tokio-stream",
+ "tokio-util",
+ "tonic",
+ "tower-service",
+ "url",
+ "winapi",
+]
+
+[[package]]
+name = "bollard-buildkit-proto"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85a885520bf6249ab931a764ffdb87b0ceef48e6e7d807cfdb21b751e086e1ad"
+dependencies = [
+ "prost",
+ "prost-types",
+ "tonic",
+ "tonic-prost",
+ "ureq",
+]
+
+[[package]]
+name = "bollard-stubs"
+version = "1.49.1-rc.28.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5731fe885755e92beff1950774068e0cae67ea6ec7587381536fca84f1779623"
+dependencies = [
+ "base64 0.22.1",
+ "bollard-buildkit-proto",
+ "bytes",
+ "chrono",
+ "prost",
+ "serde",
+ "serde_json",
+ "serde_repr",
+ "serde_with",
+]
+
 [[package]]
 name = "brotli"
 version = "8.0.2"
@@ -170,6 +353,12 @@ version = "3.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
 
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
 [[package]]
 name = "bytes"
 version = "1.11.1"
@@ -225,6 +414,7 @@ dependencies = [
  "iana-time-zone",
  "js-sys",
  "num-traits",
+ "serde",
  "wasm-bindgen",
  "windows-link",
 ]
@@ -255,7 +445,7 @@ dependencies = [
  "serde-untagged",
  "serde_core",
  "serde_json",
- "toml",
+ "toml 0.9.8",
  "winnow",
  "yaml-rust2",
 ]
@@ -305,6 +495,26 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -342,7 +552,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
 dependencies = [
  "generic-array",
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
  "zeroize",
 ]
@@ -354,10 +564,23 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array",
- "rand_core",
+ "rand_core 0.6.4",
  "typenum",
 ]
 
+[[package]]
+name = "cssparser"
+version = "0.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c66d1cd8ed61bf80b38432613a7a2f09401ab8d0501110655f8b341484a3e3"
+dependencies = [
+ "cssparser-macros",
+ "dtoa-short",
+ "itoa",
+ "phf 0.11.3",
+ "smallvec",
+]
+
 [[package]]
 name = "cssparser"
 version = "0.36.0"
@@ -367,7 +590,7 @@ dependencies = [
  "cssparser-macros",
  "dtoa-short",
  "itoa",
- "phf",
+ "phf 0.13.1",
  "smallvec",
 ]
 
@@ -414,8 +637,18 @@ version = "0.20.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
 dependencies = [
- "darling_core",
- "darling_macro",
+ "darling_core 0.20.11",
+ "darling_macro 0.20.11",
+]
+
+[[package]]
+name = "darling"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0"
+dependencies = [
+ "darling_core 0.21.3",
+ "darling_macro 0.21.3",
 ]
 
 [[package]]
@@ -432,13 +665,38 @@ dependencies = [
  "syn 2.0.111",
 ]
 
+[[package]]
+name = "darling_core"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 2.0.111",
+]
+
 [[package]]
 name = "darling_macro"
 version = "0.20.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
 dependencies = [
- "darling_core",
+ "darling_core 0.20.11",
+ "quote",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
+dependencies = [
+ "darling_core 0.21.3",
  "quote",
  "syn 2.0.111",
 ]
@@ -478,7 +736,7 @@ version = "0.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8"
 dependencies = [
- "darling",
+ "darling 0.20.11",
  "proc-macro2",
  "quote",
  "syn 2.0.111",
@@ -494,13 +752,45 @@ dependencies = [
  "syn 2.0.111",
 ]
 
+[[package]]
+name = "derive_more"
+version = "0.99.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6edb4b64a43d977b8e99788fe3a04d483834fba1215a7e02caa415b626497f7f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "derive_more"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a9b99b9cbbe49445b21764dc0625032a89b145a2642e67603e1c936f5458d05"
+dependencies = [
+ "derive_more-impl 1.0.0",
+]
+
 [[package]]
 name = "derive_more"
 version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "093242cf7570c207c83073cf82f79706fe7b8317e98620a47d5be7c3d8497678"
 dependencies = [
- "derive_more-impl",
+ "derive_more-impl 2.0.1",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7330aeadfbe296029522e6c40f315320aba36fc43a5b3632f3795348f3bd22"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+ "unicode-xid",
 ]
 
 [[package]]
@@ -556,6 +846,17 @@ dependencies = [
  "const-random",
 ]
 
+[[package]]
+name = "docker_credential"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d89dfcba45b4afad7450a99b39e751590463e45c04728cf555d36bb66940de8"
+dependencies = [
+ "base64 0.21.7",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "downcast-rs"
 version = "1.2.1"
@@ -577,6 +878,12 @@ dependencies = [
  "dtoa",
 ]
 
+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
 [[package]]
 name = "ed25519"
 version = "2.2.3"
@@ -595,13 +902,19 @@ checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
 dependencies = [
  "curve25519-dalek",
  "ed25519",
- "rand_core",
+ "rand_core 0.6.4",
  "serde",
  "sha2 0.10.9",
  "subtle",
  "zeroize",
 ]
 
+[[package]]
+name = "ego-tree"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c6ba7d4eec39eaa9ab24d44a0e73a7949a1095a8b3f3abb11eddf27dbb56a53"
+
 [[package]]
 name = "either"
 version = "1.15.0"
@@ -620,7 +933,7 @@ dependencies = [
  "ff",
  "generic-array",
  "group",
- "rand_core",
+ "rand_core 0.6.4",
  "sec1",
  "subtle",
  "zeroize",
@@ -632,7 +945,7 @@ version = "1.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9abf33c656a7256451ebb7d0082c5a471820c31269e49d807c538c252352186e"
 dependencies = [
- "indexmap",
+ "indexmap 2.12.1",
  "stable_deref_trait",
 ]
 
@@ -675,7 +988,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "error-stack"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe413319145d1063f080f27556fd30b1d70b01e2ba10c2a6e40d4be982ffc5d1"
+dependencies = [
+ "anyhow",
+ "rustc_version",
 ]
 
 [[package]]
@@ -688,6 +1011,17 @@ dependencies = [
  "rustc_version",
 ]
 
+[[package]]
+name = "etcetera"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26c7b13d0780cb82722fd59f6f57f925e143427e4a75313a6c77243bf5326ae6"
+dependencies = [
+ "cfg-if",
+ "home",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "fastly"
 version = "0.11.12"
@@ -770,7 +1104,7 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
 dependencies = [
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
 ]
 
@@ -780,6 +1114,17 @@ version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
+[[package]]
+name = "filetime"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f98844151eee8917efc50bd9e8318cb963ae8b297431495d3f758616ea5c57db"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "libredox",
+]
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.5"
@@ -814,6 +1159,21 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -823,6 +1183,16 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "futf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df420e2e84819663797d1ec6544b13c5be84629e7bb00dc960d6917db2987843"
+dependencies = [
+ "mac",
+ "new_debug_unreachable",
+]
+
 [[package]]
 name = "futures"
 version = "0.3.32"
@@ -911,6 +1281,15 @@ dependencies = [
  "slab",
 ]
 
+[[package]]
+name = "fxhash"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c31b6d751ae2c7f11320402d34e41349dd1016f8d5d45e48c4312bc8625af50c"
+dependencies = [
+ "byteorder",
+]
+
 [[package]]
 name = "generic-array"
 version = "0.14.7"
@@ -923,10 +1302,19 @@ dependencies = [
 ]
 
 [[package]]
-name = "getrandom"
-version = "0.2.16"
+name = "getopts"
+version = "0.2.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
+checksum = "cfe4fbac503b8d1f88e6676011885f34b7174f46e59956bba534ba83abded4df"
+dependencies = [
+ "unicode-width",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
 dependencies = [
  "cfg-if",
  "libc",
@@ -952,10 +1340,29 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
 dependencies = [
  "ff",
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
 ]
 
+[[package]]
+name = "h2"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap 2.12.1",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
 [[package]]
 name = "handlebars"
 version = "6.4.0"
@@ -972,6 +1379,12 @@ dependencies = [
  "thiserror 2.0.17",
 ]
 
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
 [[package]]
 name = "hashbrown"
 version = "0.14.5"
@@ -1022,6 +1435,27 @@ dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "html5ever"
+version = "0.29.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b7410cae13cbc75623c98ac4cbfd1f0bedddf3227afc24f370cf0f50a44a11c"
+dependencies = [
+ "log",
+ "mac",
+ "markup5ever",
+ "match_token",
+]
+
 [[package]]
 name = "http"
 version = "1.4.0"
@@ -1032,6 +1466,164 @@ dependencies = [
  "itoa",
 ]
 
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "pin-utils",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-named-pipe"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73b7d8abf35697b81a825e386fc151e0d503e8cb5fcb93cc8669c376dfd6f278"
+dependencies = [
+ "hex",
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+ "winapi",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-timeout"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
+dependencies = [
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-tls"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
+dependencies = [
+ "bytes",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "system-configuration",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "windows-registry",
+]
+
+[[package]]
+name = "hyperlocal"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7"
+dependencies = [
+ "hex",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
 [[package]]
 name = "iana-time-zone"
 version = "0.1.64"
@@ -1164,6 +1756,17 @@ dependencies = [
  "icu_properties",
 ]
 
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
 [[package]]
 name = "indexmap"
 version = "2.12.1"
@@ -1172,6 +1775,8 @@ checksum = "0ad4bb2b565bca0645f4d68c5c9af97fba094e9791da685bf83cb5f3ce74acf2"
 dependencies = [
  "equivalent",
  "hashbrown 0.16.1",
+ "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -1183,6 +1788,38 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "integration-tests"
+version = "0.1.0"
+dependencies = [
+ "derive_more 1.0.0",
+ "error-stack 0.5.0",
+ "log",
+ "reqwest",
+ "scraper",
+ "serde",
+ "tempfile",
+ "testcontainers",
+ "tokio",
+ "toml 0.8.23",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+
+[[package]]
+name = "iri-string"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c91338f0783edbd6195decb37bae672fd3b165faffb89bf7b9e6942f8b1a731a"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
 [[package]]
 name = "itertools"
 version = "0.13.0"
@@ -1266,9 +1903,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.177"
+version = "0.2.182"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
+checksum = "6800badb6cb2082ffd7b6a67e6125bb39f18782f793520caee8cb8846be06112"
 
 [[package]]
 name = "libm"
@@ -1276,6 +1913,18 @@ version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9fbbcab51052fe104eb5e5d351cf728d30a5be1fe14d9be8a3b097481fb97de"
 
+[[package]]
+name = "libredox"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1744e39d1d6a9948f4f388969627434e31128196de472883b39f148769bfe30a"
+dependencies = [
+ "bitflags 2.10.0",
+ "libc",
+ "plain",
+ "redox_syscall 0.7.3",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.11.0"
@@ -1322,17 +1971,54 @@ checksum = "630bc32f75a59df2d35a9f13224b057a1c1ff1d187dfdc56190e9a54c4127917"
 dependencies = [
  "bitflags 2.10.0",
  "cfg-if",
- "cssparser",
+ "cssparser 0.36.0",
  "encoding_rs",
  "foldhash 0.2.0",
  "hashbrown 0.16.1",
  "memchr",
  "mime",
  "precomputed-hash",
- "selectors",
+ "selectors 0.33.0",
  "thiserror 2.0.17",
 ]
 
+[[package]]
+name = "mac"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4"
+
+[[package]]
+name = "markup5ever"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7a7213d12e1864c0f002f52c2923d4556935a43dec5e71355c2760e0f6e7a18"
+dependencies = [
+ "log",
+ "phf 0.11.3",
+ "phf_codegen 0.11.3",
+ "string_cache",
+ "string_cache_codegen",
+ "tendril",
+]
+
+[[package]]
+name = "match_token"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88a9689d8d44bf9964484516275f5cd4c9b59457a6940c1d5d0ecbb94510a36b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
 [[package]]
 name = "matchit"
 version = "0.9.0"
@@ -1361,12 +2047,64 @@ dependencies = [
  "simd-adler32",
 ]
 
+[[package]]
+name = "mio"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "native-tls"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "465500e14ea162429d264d44189adc38b199b62b1c21eea9f69e4b73cb03bbf2"
+dependencies = [
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework",
+ "security-framework-sys",
+ "tempfile",
+]
+
 [[package]]
 name = "new_debug_unreachable"
 version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
 
+[[package]]
+name = "num"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
+dependencies = [
+ "num-bigint",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
 [[package]]
 name = "num-bigint-dig"
 version = "0.8.6"
@@ -1378,11 +2116,20 @@ dependencies = [
  "num-integer",
  "num-iter",
  "num-traits",
- "rand",
+ "rand 0.8.5",
  "smallvec",
  "zeroize",
 ]
 
+[[package]]
+name = "num-complex"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "num-conv"
 version = "0.2.0"
@@ -1424,6 +2171,17 @@ dependencies = [
  "num-modular",
 ]
 
+[[package]]
+name = "num-rational"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
+dependencies = [
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -1447,34 +2205,78 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
-name = "ordered-multimap"
-version = "0.7.3"
+name = "openssl"
+version = "0.10.75"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49203cdcae0030493bad186b28da2fa25645fa276a51b6fec8010d281e02ef79"
+checksum = "08838db121398ad17ab8531ce9de97b244589089e290a384c900cb9ff7434328"
 dependencies = [
- "dlv-list",
- "hashbrown 0.14.5",
+ "bitflags 2.10.0",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
 ]
 
 [[package]]
-name = "p256"
-version = "0.13.2"
+name = "openssl-macros"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
- "elliptic-curve",
- "primeorder",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
 ]
 
 [[package]]
-name = "p384"
-version = "0.13.1"
+name = "openssl-probe"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
-dependencies = [
- "elliptic-curve",
- "primeorder",
-]
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.111"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82cab2d520aa75e3c58898289429321eb788c3106963d0dc886ec7a5f4adc321"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "ordered-multimap"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49203cdcae0030493bad186b28da2fa25645fa276a51b6fec8010d281e02ef79"
+dependencies = [
+ "dlv-list",
+ "hashbrown 0.14.5",
+]
+
+[[package]]
+name = "p256"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
+dependencies = [
+ "elliptic-curve",
+ "primeorder",
+]
+
+[[package]]
+name = "p384"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
+dependencies = [
+ "elliptic-curve",
+ "primeorder",
+]
 
 [[package]]
 name = "parking_lot"
@@ -1494,11 +2296,36 @@ checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall",
+ "redox_syscall 0.5.18",
  "smallvec",
  "windows-link",
 ]
 
+[[package]]
+name = "parse-display"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "914a1c2265c98e2446911282c6ac86d8524f495792c38c5bd884f80499c7538a"
+dependencies = [
+ "parse-display-derive",
+ "regex",
+ "regex-syntax",
+]
+
+[[package]]
+name = "parse-display-derive"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ae7800a4c974efd12df917266338e79a7a74415173caf7e70aa0a0707345281"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "regex",
+ "regex-syntax",
+ "structmeta",
+ "syn 2.0.111",
+]
+
 [[package]]
 name = "pathdiff"
 version = "0.2.3"
@@ -1554,25 +2381,55 @@ dependencies = [
  "sha2 0.10.9",
 ]
 
+[[package]]
+name = "phf"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
+dependencies = [
+ "phf_macros 0.11.3",
+ "phf_shared 0.11.3",
+]
+
 [[package]]
 name = "phf"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
 dependencies = [
- "phf_macros",
- "phf_shared",
+ "phf_macros 0.13.1",
+ "phf_shared 0.13.1",
  "serde",
 ]
 
+[[package]]
+name = "phf_codegen"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a"
+dependencies = [
+ "phf_generator 0.11.3",
+ "phf_shared 0.11.3",
+]
+
 [[package]]
 name = "phf_codegen"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1"
 dependencies = [
- "phf_generator",
- "phf_shared",
+ "phf_generator 0.13.1",
+ "phf_shared 0.13.1",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
+dependencies = [
+ "phf_shared 0.11.3",
+ "rand 0.8.5",
 ]
 
 [[package]]
@@ -1582,7 +2439,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
 dependencies = [
  "fastrand",
- "phf_shared",
+ "phf_shared 0.13.1",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f84ac04429c13a7ff43785d75ad27569f2951ce0ffd30a3321230db2fc727216"
+dependencies = [
+ "phf_generator 0.11.3",
+ "phf_shared 0.11.3",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -1591,13 +2461,22 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
 dependencies = [
- "phf_generator",
- "phf_shared",
+ "phf_generator 0.13.1",
+ "phf_shared 0.13.1",
  "proc-macro2",
  "quote",
  "syn 2.0.111",
 ]
 
+[[package]]
+name = "phf_shared"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
+dependencies = [
+ "siphasher",
+]
+
 [[package]]
 name = "phf_shared"
 version = "0.13.1"
@@ -1607,12 +2486,38 @@ dependencies = [
  "siphasher",
 ]
 
+[[package]]
+name = "pin-project"
+version = "1.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1749c7ed4bcaf4c3d0a3efc28538844fb29bcdd7d2b67b2be7e20ba861ff517"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b20ed30f105399776b9c883e68e536ef602a16ae6f596d2c473591d6ad64c6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+]
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
 
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
 [[package]]
 name = "pkcs1"
 version = "0.7.5"
@@ -1634,6 +2539,18 @@ dependencies = [
  "spki",
 ]
 
+[[package]]
+name = "pkg-config"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
 [[package]]
 name = "poly1305"
 version = "0.8.0"
@@ -1645,6 +2562,12 @@ dependencies = [
  "universal-hash",
 ]
 
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
 [[package]]
 name = "potential_utf"
 version = "0.1.4"
@@ -1715,6 +2638,38 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "prost"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2ea70524a2f82d518bce41317d0fae74151505651af45faf1ffbd6fd33f0568"
+dependencies = [
+ "bytes",
+ "prost-derive",
+]
+
+[[package]]
+name = "prost-derive"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
+dependencies = [
+ "anyhow",
+ "itertools",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "prost-types"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8991c4cbdb8bc5b11f0b074ffe286c30e523de90fee5ba8132f1399f23cb3dd7"
+dependencies = [
+ "prost",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.42"
@@ -1737,8 +2692,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
- "rand_chacha",
- "rand_core",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
@@ -1748,7 +2713,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
@@ -1760,6 +2735,15 @@ dependencies = [
  "getrandom 0.2.16",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -1769,6 +2753,35 @@ dependencies = [
  "bitflags 2.10.0",
 ]
 
+[[package]]
+name = "redox_syscall"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce70a74e890531977d37e532c34d45e9055d2409ed08ddba14529471ed0be16"
+dependencies = [
+ "bitflags 2.10.0",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+]
+
 [[package]]
 name = "regex"
 version = "1.12.3"
@@ -1798,6 +2811,62 @@ version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
 
+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "encoding_rs",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-tls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "mime",
+ "native-tls",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-native-tls",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.16",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "ron"
 version = "0.12.0"
@@ -1825,7 +2894,7 @@ dependencies = [
  "num-traits",
  "pkcs1",
  "pkcs8",
- "rand_core",
+ "rand_core 0.6.4",
  "signature",
  "spki",
  "subtle",
@@ -1867,64 +2936,211 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
-name = "rustversion"
-version = "1.0.22"
+name = "rustls"
+version = "0.23.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4"
+dependencies = [
+ "log",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
 
 [[package]]
-name = "ryu"
-version = "1.0.20"
+name = "rustls-native-certs"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
+checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
 
 [[package]]
-name = "scopeguard"
-version = "1.2.0"
+name = "rustls-pemfile"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
+dependencies = [
+ "rustls-pki-types",
+]
 
 [[package]]
-name = "sec1"
-version = "0.7.3"
+name = "rustls-pki-types"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
+checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd"
 dependencies = [
- "base16ct",
- "der",
- "generic-array",
- "subtle",
  "zeroize",
 ]
 
 [[package]]
-name = "selectors"
-version = "0.33.0"
+name = "rustls-webpki"
+version = "0.103.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "feef350c36147532e1b79ea5c1f3791373e61cbd9a6a2615413b3807bb164fb7"
+checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
 dependencies = [
- "bitflags 2.10.0",
- "cssparser",
- "derive_more",
- "log",
- "new_debug_unreachable",
- "phf",
- "phf_codegen",
- "precomputed-hash",
- "rustc-hash",
- "servo_arc",
- "smallvec",
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
 ]
 
 [[package]]
-name = "semver"
-version = "1.0.27"
+name = "rustversion"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "ryu"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
+
+[[package]]
+name = "schannel"
+version = "0.1.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "891d81b926048e76efe18581bf793546b4c0eaf8448d72be8de2bbee5fd166e1"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "schemars"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "scraper"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0e749d29b2064585327af5038a5a8eb73aeebad4a3472e83531a436563f7208"
+dependencies = [
+ "ahash",
+ "cssparser 0.34.0",
+ "ego-tree",
+ "getopts",
+ "html5ever",
+ "precomputed-hash",
+ "selectors 0.26.0",
+ "tendril",
+]
+
+[[package]]
+name = "sec1"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
+dependencies = [
+ "base16ct",
+ "der",
+ "generic-array",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "security-framework"
+version = "3.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d17b898a6d6948c3a8ee4372c17cb384f90d2e6e912ef00895b14fd7ab54ec38"
+dependencies = [
+ "bitflags 2.10.0",
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "selectors"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd568a4c9bb598e291a08244a5c1f5a8a6650bee243b5b0f8dbb3d9cc1d87fe8"
+dependencies = [
+ "bitflags 2.10.0",
+ "cssparser 0.34.0",
+ "derive_more 0.99.20",
+ "fxhash",
+ "log",
+ "new_debug_unreachable",
+ "phf 0.11.3",
+ "phf_codegen 0.11.3",
+ "precomputed-hash",
+ "servo_arc",
+ "smallvec",
+]
+
+[[package]]
+name = "selectors"
+version = "0.33.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "feef350c36147532e1b79ea5c1f3791373e61cbd9a6a2615413b3807bb164fb7"
+dependencies = [
+ "bitflags 2.10.0",
+ "cssparser 0.36.0",
+ "derive_more 2.0.1",
+ "log",
+ "new_debug_unreachable",
+ "phf 0.13.1",
+ "phf_codegen 0.13.1",
+ "precomputed-hash",
+ "rustc-hash",
+ "servo_arc",
+ "smallvec",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
 
 [[package]]
 name = "serde"
@@ -1992,6 +3208,15 @@ dependencies = [
  "syn 2.0.111",
 ]
 
+[[package]]
+name = "serde_spanned"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "serde_spanned"
 version = "1.0.3"
@@ -2013,6 +3238,37 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "serde_with"
+version = "3.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "381b283ce7bc6b476d903296fb59d0d36633652b633b27f64db4fb46dcbfc3b9"
+dependencies = [
+ "base64 0.22.1",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.12.1",
+ "schemars 0.9.0",
+ "schemars 1.2.1",
+ "serde_core",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6d4e30573c8cb306ed6ab1dca8423eec9a463ea0e155f45399455e0368b27e0"
+dependencies = [
+ "darling 0.21.3",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+]
+
 [[package]]
 name = "servo_arc"
 version = "0.4.3"
@@ -2059,7 +3315,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
  "digest 0.10.7",
- "rand_core",
+ "rand_core 0.6.4",
 ]
 
 [[package]]
@@ -2086,6 +3342,16 @@ version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
 
+[[package]]
+name = "socket2"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86f4aa3ad99f2088c990dfa82d367e19cb29268ed67c574d10d0a4bfe71f07e0"
+dependencies = [
+ "libc",
+ "windows-sys 0.60.2",
+]
+
 [[package]]
 name = "spin"
 version = "0.9.8"
@@ -2108,12 +3374,60 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
+[[package]]
+name = "string_cache"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf776ba3fa74f83bf4b63c3dcbbf82173db2632ed8452cb2d891d33f459de70f"
+dependencies = [
+ "new_debug_unreachable",
+ "parking_lot",
+ "phf_shared 0.11.3",
+ "precomputed-hash",
+ "serde",
+]
+
+[[package]]
+name = "string_cache_codegen"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c711928715f1fe0fe509c53b43e993a9a557babc2d0a3567d0a3006f1ac931a0"
+dependencies = [
+ "phf_generator 0.11.3",
+ "phf_shared 0.11.3",
+ "proc-macro2",
+ "quote",
+]
+
 [[package]]
 name = "strsim"
 version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
+[[package]]
+name = "structmeta"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e1575d8d40908d70f6fd05537266b90ae71b15dbbe7a8b7dffa2b759306d329"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "structmeta-derive",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "structmeta-derive"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "152a0b65a590ff6c3da95cabe2353ee04e6167c896b28e3b14478c2636c922fc"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+]
+
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -2142,6 +3456,15 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
 [[package]]
 name = "synstructure"
 version = "0.13.2"
@@ -2153,6 +3476,27 @@ dependencies = [
  "syn 2.0.111",
 ]
 
+[[package]]
+name = "system-configuration"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
+dependencies = [
+ "bitflags 2.10.0",
+ "core-foundation 0.9.4",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "temp-env"
 version = "0.3.6"
@@ -2162,6 +3506,59 @@ dependencies = [
  "parking_lot",
 ]
 
+[[package]]
+name = "tempfile"
+version = "3.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
+dependencies = [
+ "fastrand",
+ "getrandom 0.3.4",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tendril"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d24a120c5fc464a3458240ee02c299ebcb9d67b5249c8848b09d639dca8d7bb0"
+dependencies = [
+ "futf",
+ "mac",
+ "utf-8",
+]
+
+[[package]]
+name = "testcontainers"
+version = "0.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f3ac71069f20ecfa60c396316c283fbf35e6833a53dff551a31b5458da05edc"
+dependencies = [
+ "astral-tokio-tar",
+ "async-trait",
+ "bollard",
+ "bytes",
+ "docker_credential",
+ "either",
+ "etcetera",
+ "futures",
+ "log",
+ "memchr",
+ "parse-display",
+ "pin-project-lite",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "thiserror 2.0.17",
+ "tokio",
+ "tokio-stream",
+ "tokio-util",
+ "ulid",
+ "url",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -2259,8 +3656,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
 dependencies = [
  "bytes",
+ "libc",
+ "mio",
  "pin-project-lite",
+ "socket2",
  "tokio-macros",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2274,6 +3675,26 @@ dependencies = [
  "syn 2.0.111",
 ]
 
+[[package]]
+name = "tokio-native-tls"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
+dependencies = [
+ "native-tls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-stream"
 version = "0.1.17"
@@ -2296,21 +3717,55 @@ dependencies = [
  "tokio-stream",
 ]
 
+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "toml"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
+dependencies = [
+ "serde",
+ "serde_spanned 0.6.9",
+ "toml_datetime 0.6.11",
+ "toml_edit",
+]
+
 [[package]]
 name = "toml"
 version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0dc8b1fb61449e27716ec0e1bdf0f6b8f3e8f6b05391e8497b8b6d7804ea6d8"
 dependencies = [
- "indexmap",
+ "indexmap 2.12.1",
  "serde_core",
- "serde_spanned",
- "toml_datetime",
+ "serde_spanned 1.0.3",
+ "toml_datetime 0.7.3",
  "toml_parser",
  "toml_writer",
  "winnow",
 ]
 
+[[package]]
+name = "toml_datetime"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "toml_datetime"
 version = "0.7.3"
@@ -2320,6 +3775,20 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "toml_edit"
+version = "0.22.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
+dependencies = [
+ "indexmap 2.12.1",
+ "serde",
+ "serde_spanned 0.6.9",
+ "toml_datetime 0.6.11",
+ "toml_write",
+ "winnow",
+]
+
 [[package]]
 name = "toml_parser"
 version = "1.0.4"
@@ -2329,27 +3798,153 @@ dependencies = [
  "winnow",
 ]
 
+[[package]]
+name = "toml_write"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
+
 [[package]]
 name = "toml_writer"
 version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df8b2b54733674ad286d16267dcfc7a71ed5c776e4ac7aa3c3e2561f7c637bf2"
 
+[[package]]
+name = "tonic"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fec7c61a0695dc1887c1b53952990f3ad2e3a31453e1f49f10e75424943a93ec"
+dependencies = [
+ "async-trait",
+ "axum",
+ "base64 0.22.1",
+ "bytes",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-timeout",
+ "hyper-util",
+ "percent-encoding",
+ "pin-project",
+ "socket2",
+ "sync_wrapper",
+ "tokio",
+ "tokio-stream",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tonic-prost"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a55376a0bbaa4975a3f10d009ad763d8f4108f067c7c2e74f3001fb49778d309"
+dependencies = [
+ "bytes",
+ "prost",
+ "tonic",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "indexmap 2.12.1",
+ "pin-project-lite",
+ "slab",
+ "sync_wrapper",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+dependencies = [
+ "bitflags 2.10.0",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "iri-string",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
 [[package]]
 name = "trusted-server-common"
 version = "0.1.0"
 dependencies = [
  "async-trait",
- "base64",
+ "base64 0.22.1",
  "brotli",
  "bytes",
  "chacha20poly1305",
  "chrono",
  "config",
  "cookie",
- "derive_more",
+ "derive_more 2.0.1",
  "ed25519-dalek",
- "error-stack",
+ "error-stack 0.6.0",
  "fastly",
  "flate2",
  "futures",
@@ -2361,10 +3956,10 @@ dependencies = [
  "log",
  "log-fastly",
  "lol_html",
- "matchit",
+ "matchit 0.9.0",
  "once_cell",
  "pin-project-lite",
- "rand",
+ "rand 0.8.5",
  "regex",
  "serde",
  "serde_json",
@@ -2372,7 +3967,7 @@ dependencies = [
  "temp-env",
  "tokio",
  "tokio-test",
- "toml",
+ "toml 0.9.8",
  "trusted-server-js",
  "url",
  "urlencoding",
@@ -2385,7 +3980,7 @@ name = "trusted-server-fastly"
 version = "0.1.0"
 dependencies = [
  "chrono",
- "error-stack",
+ "error-stack 0.6.0",
  "fastly",
  "fern",
  "futures",
@@ -2407,6 +4002,12 @@ dependencies = [
  "which",
 ]
 
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
 [[package]]
 name = "typeid"
 version = "1.0.3"
@@ -2425,6 +4026,16 @@ version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
 
+[[package]]
+name = "ulid"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "470dbf6591da1b39d43c14523b2b469c86879a53e8b758c8e090a470fe7b1fbe"
+dependencies = [
+ "rand 0.9.2",
+ "web-time",
+]
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.22"
@@ -2437,6 +4048,12 @@ version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
 
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
 [[package]]
 name = "unicode-xid"
 version = "0.2.6"
@@ -2453,6 +4070,39 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "ureq"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdc97a28575b85cfedf2a7e7d3cc64b3e11bd8ac766666318003abbacc7a21fc"
+dependencies = [
+ "base64 0.22.1",
+ "log",
+ "percent-encoding",
+ "rustls",
+ "rustls-pki-types",
+ "ureq-proto",
+ "utf-8",
+]
+
+[[package]]
+name = "ureq-proto"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d81f9efa9df032be5934a46a068815a10a042b494b6a58cb0a1a97bb5467ed6f"
+dependencies = [
+ "base64 0.22.1",
+ "http",
+ "httparse",
+ "log",
+]
+
 [[package]]
 name = "url"
 version = "2.5.8"
@@ -2463,6 +4113,7 @@ dependencies = [
  "idna",
  "percent-encoding",
  "serde",
+ "serde_derive",
 ]
 
 [[package]]
@@ -2471,6 +4122,12 @@ version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
 
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -2510,7 +4167,7 @@ version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7df16e474ef958526d1205f6dda359fdfab79d9aa6d54bafcb92dcd07673dca"
 dependencies = [
- "darling",
+ "darling 0.20.11",
  "once_cell",
  "proc-macro-error2",
  "proc-macro2",
@@ -2518,12 +4175,27 @@ dependencies = [
  "syn 2.0.111",
 ]
 
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
 [[package]]
 name = "version_check"
 version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
 [[package]]
 name = "wasi"
 version = "0.11.1+wasi-snapshot-preview1"
@@ -2552,6 +4224,19 @@ dependencies = [
  "wasm-bindgen-shared",
 ]
 
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "836d9622d604feee9e5de25ac10e3ea5f2d65b41eac0d9ce72eb5deae707ce7c"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "once_cell",
+ "wasm-bindgen",
+ "web-sys",
+]
+
 [[package]]
 name = "wasm-bindgen-macro"
 version = "0.2.106"
@@ -2584,6 +4269,26 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "web-sys"
+version = "0.3.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b32828d774c412041098d182a8b38b16ea816958e07cf40eec2bc080ae137ac"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "which"
 version = "8.0.0"
@@ -2595,6 +4300,28 @@ dependencies = [
  "winsafe",
 ]
 
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
 [[package]]
 name = "windows-core"
 version = "0.62.2"
@@ -2636,6 +4363,17 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.4.1"
@@ -2654,6 +4392,33 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.5",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.61.2"
@@ -2663,6 +4428,135 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm 0.52.6",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.53.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
+dependencies = [
+ "windows-link",
+ "windows_aarch64_gnullvm 0.53.1",
+ "windows_aarch64_msvc 0.53.1",
+ "windows_i686_gnu 0.53.1",
+ "windows_i686_gnullvm 0.53.1",
+ "windows_i686_msvc 0.53.1",
+ "windows_x86_64_gnu 0.53.1",
+ "windows_x86_64_gnullvm 0.53.1",
+ "windows_x86_64_msvc 0.53.1",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
+
 [[package]]
 name = "winnow"
 version = "0.7.14"
@@ -2693,6 +4587,16 @@ version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
 
+[[package]]
+name = "xattr"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
+dependencies = [
+ "libc",
+ "rustix",
+]
+
 [[package]]
 name = "yaml-rust2"
 version = "0.10.4"
diff --git a/Cargo.toml b/Cargo.toml
index 032cbaa7..571491e8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,8 +2,9 @@
 resolver = "2"
 members = [
     "crates/common",
-    "crates/fastly", 
+    "crates/fastly",
     "crates/js",
+    "crates/integration-tests",
 ]
 
 # Build defaults exclude the web-only tsjs crate, which is compiled via wasm-pack.
diff --git a/INTEGRATION_TESTS_PLAN.md b/INTEGRATION_TESTS_PLAN.md
new file mode 100644
index 00000000..b7153c33
--- /dev/null
+++ b/INTEGRATION_TESTS_PLAN.md
@@ -0,0 +1,1966 @@
+# Integration Tests Plan: Multi-Framework Frontend Testing
+
+## Revision History
+
+**Latest Update**: Staff engineering review applied - addressed critical architectural and implementation issues.
+
+### Changes Applied
+
+**Critical Fixes**:
+1. ✅ **Trait Object Safety**: Changed from `&[&dyn FrontendFramework]` to function registry pattern to avoid static initialization issues
+2. ✅ **Complete Error Types**: Added full `TestError` enum with all necessary variants
+3. ✅ **Health Check Strategy**: Documented `/health` endpoint requirement and implemented fallback strategy
+4. ✅ **Safe TOML Mutation**: Fixed config generation to use safe table lookups instead of panic-prone indexing
+5. ✅ **WordPress Container Setup**: Clarified WordPress database requirements and recommended approach
+6. ✅ **Container Build Process**: Documented Docker image pre-build strategy for CI and local development
+
+**Major Improvements**:
+7. ✅ **WASM Binary Path**: Made configurable via environment variable
+8. ✅ **Error Context**: Added comprehensive error context propagation with framework/scenario information
+9. ✅ **Container Timeouts**: Added 60s timeout on container operations to prevent infinite hangs
+10. ✅ **Test Isolation**: Documented sequential execution requirement and future enhancement plans
+
+**Documentation Additions**:
+- Troubleshooting guide with common issues and solutions
+- Implementation notes and best practices section
+- Future enhancements roadmap (Phase 6+)
+- CI workflow example with proper build steps
+- Debug mode instructions
+
+**Estimated Impact**: Prevents 10-15 hours of debugging during implementation by addressing issues upfront.
+
+---
+
+## Context
+
+The trusted server currently has 465 passing Rust unit tests and 256 JS tests, but lacks end-to-end integration tests that verify the complete system behavior against real frontend applications and across different runtime platforms. This plan implements an extensible integration test framework with dual abstractions:
+
+1. **Frontend Framework Abstraction**: Test against WordPress, Next.js, and future frameworks
+2. **Runtime Environment Abstraction**: Test on Fastly Compute (initially), with architecture to support future platforms
+
+**Why this matters**:
+- **Unit tests** verify individual components in isolation
+- **Integration tests** prove the system works end-to-end with real frontend frameworks
+- **Multi-platform architecture** enables future platform migration validation (Cloudflare Workers, etc.)
+
+This catches issues like HTML streaming bugs, RSC Flight format handling, GDPR signal propagation, and platform-specific runtime differences that only manifest when all components interact.
+
+**Initial Implementation Scope**:
+- Start with **Fastly/Viceroy only** (2 frameworks × 1 runtime = 2 test combinations)
+- Architecture supports adding platforms later via `RuntimeEnvironment` trait
+- Future platforms (Cloudflare, Fermyon Spin, etc.) can be added without refactoring
+
+**Extensibility goals**:
+
+*Frontend Framework*: Adding support for a new framework should require only:
+1. Creating a new fixture directory (`fixtures/frameworks/<name>/`)
+2. Implementing the `FrontendFramework` trait (~50 lines)
+3. Registering in `FRAMEWORKS` constant (~1 line)
+
+*Runtime Environment*: Adding support for a new platform should require only:
+1. Creating a platform config template (`fixtures/configs/<platform>-template.toml`)
+2. Implementing the `RuntimeEnvironment` trait (~100 lines)
+3. Registering in `RUNTIME_ENVIRONMENTS` constant (~1 line)
+
+No changes to core test infrastructure, assertions, or test runner logic when extending either dimension.
+
+---
+
+## Implementation Checklist
+
+Track progress for each phase using this checklist:
+
+### Phase 0: Prerequisites (BLOCKER) ⏱️ 1-2 hours ✅ COMPLETE
+- [x] Add `/health` endpoint to [`crates/fastly/src/main.rs`](crates/fastly/src/main.rs)
+- [x] Build WASM binary: `cargo build --target wasm32-wasip1 --release`
+- [x] Start Viceroy manually to test health endpoint
+- [x] Verify `curl http://127.0.0.1:7676/health` returns 200 OK
+
+### Phase 1: Core Infrastructure ⏱️ 4-6 hours
+- [ ] Add `integration-tests` to workspace members in root `Cargo.toml`
+- [ ] Create [`crates/integration-tests/Cargo.toml`](crates/integration-tests/Cargo.toml) with dependencies
+- [ ] Create [`tests/common/mod.rs`](crates/integration-tests/tests/common/mod.rs) (re-exports)
+- [ ] Define `RuntimeEnvironment` trait in [`tests/common/runtime.rs`](crates/integration-tests/tests/common/runtime.rs)
+- [ ] Implement `RuntimeConfig` struct with platform-agnostic interface
+- [ ] Create [`tests/common/config.rs`](crates/integration-tests/tests/common/config.rs) for config generation
+- [ ] Implement assertion helpers in [`tests/common/assertions.rs`](crates/integration-tests/tests/common/assertions.rs)
+- [ ] Create [`fixtures/configs/fastly-template.toml`](crates/integration-tests/fixtures/configs/fastly-template.toml)
+- [ ] Verify: `cargo check -p integration-tests` passes
+
+### Phase 1.5: Fastly Runtime Implementation ⏱️ 2-3 hours
+- [ ] Create [`tests/environments/mod.rs`](crates/integration-tests/tests/environments/mod.rs) with `RuntimeEnvironment` trait
+- [ ] Create [`tests/environments/fastly.rs`](crates/integration-tests/tests/environments/fastly.rs)
+- [ ] Implement `FastlyViceroy` struct with `RuntimeEnvironment` trait
+- [ ] Implement `ViceroyHandle` for process lifecycle (spawn, kill, wait)
+- [ ] Implement dynamic port allocation with `find_available_port()`
+- [ ] Implement health check with retry logic (30 attempts × 100ms)
+- [ ] Create `RUNTIME_ENVIRONMENTS` registry with Fastly factory
+- [ ] Verify: `cargo test -p integration-tests --lib` compiles
+
+### Phase 2: Framework Abstraction ⏱️ 2-3 hours
+- [ ] Create [`tests/frameworks/mod.rs`](crates/integration-tests/tests/frameworks/mod.rs) with `FrontendFramework` trait
+- [ ] Create [`tests/frameworks/scenarios.rs`](crates/integration-tests/tests/frameworks/scenarios.rs)
+- [ ] Define `TestScenario` enum (HtmlInjection, ScriptServing, AttributeRewriting, GdprSignal)
+- [ ] Define `CustomScenario` enum (framework-specific scenarios)
+- [ ] Implement scenario runners with error context
+- [ ] Create `FRAMEWORKS` registry (empty initially)
+- [ ] Verify: Trait compiles, registry pattern works
+
+### Phase 3: WordPress Implementation ⏱️ 5-7 hours
+- [ ] Create [`fixtures/frameworks/wordpress/`](crates/integration-tests/fixtures/frameworks/wordpress/) directory
+- [ ] Create [`fixtures/frameworks/wordpress/Dockerfile`](crates/integration-tests/fixtures/frameworks/wordpress/Dockerfile) with SQLite plugin
+- [ ] Create minimal WordPress test theme in [`fixtures/frameworks/wordpress/theme/`](crates/integration-tests/fixtures/frameworks/wordpress/theme/)
+- [ ] Build WordPress Docker image: `docker build -t test-wordpress:latest fixtures/frameworks/wordpress/`
+- [ ] Create [`tests/frameworks/wordpress.rs`](crates/integration-tests/tests/frameworks/wordpress.rs)
+- [ ] Implement `WordPress` struct with `FrontendFramework` trait
+- [ ] Add WordPress to `FRAMEWORKS` registry
+- [ ] Create [`tests/integration.rs`](crates/integration-tests/tests/integration.rs) with `test_combination()` helper
+- [ ] Create `test_wordpress_fastly()` test
+- [ ] Verify: `cargo test -p integration-tests -- test_wordpress_fastly` passes
+
+### Phase 4: Next.js Implementation ⏱️ 3-4 hours
+- [ ] Create [`fixtures/frameworks/nextjs/`](crates/integration-tests/fixtures/frameworks/nextjs/) directory
+- [ ] Create [`fixtures/frameworks/nextjs/package.json`](crates/integration-tests/fixtures/frameworks/nextjs/package.json)
+- [ ] Create [`fixtures/frameworks/nextjs/next.config.mjs`](crates/integration-tests/fixtures/frameworks/nextjs/next.config.mjs)
+- [ ] Create [`fixtures/frameworks/nextjs/app/page.tsx`](crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx) with test content
+- [ ] Create [`fixtures/frameworks/nextjs/Dockerfile`](crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile)
+- [ ] Build Next.js Docker image: `docker build -t test-nextjs:latest fixtures/frameworks/nextjs/`
+- [ ] Create [`tests/frameworks/nextjs.rs`](crates/integration-tests/tests/frameworks/nextjs.rs)
+- [ ] Implement `NextJs` struct with RSC-specific scenarios
+- [ ] Add Next.js to `FRAMEWORKS` registry
+- [ ] Create `test_nextjs_fastly()` test
+- [ ] Create `test_all_frameworks()` test (iterates `FRAMEWORKS` registry)
+- [ ] Verify: `cargo test -p integration-tests` passes for all tests
+
+### Phase 5: Documentation and CI ⏱️ 3-4 hours
+- [ ] Create comprehensive [`crates/integration-tests/README.md`](crates/integration-tests/README.md)
+  - [ ] Prerequisites section (Docker, Rust, Viceroy)
+  - [ ] Running tests locally guide
+  - [ ] How to add a new framework guide
+  - [ ] How to add a new runtime guide (for future)
+  - [ ] Troubleshooting section
+- [ ] Create [`.github/workflows/integration-tests.yml`](.github/workflows/integration-tests.yml)
+  - [ ] Build WASM binary step
+  - [ ] Build Docker images (WordPress, Next.js)
+  - [ ] Install Viceroy
+  - [ ] Run integration tests with WASM_BINARY_PATH env var
+- [ ] Create [`crates/integration-tests/.dockerignore`](crates/integration-tests/.dockerignore)
+- [ ] Update root [`Cargo.toml`](Cargo.toml) workspace members
+- [ ] Test CI locally with `act` or similar
+- [ ] Verify: CI passes on test branch
+
+### Success Criteria
+- [ ] WordPress tests pass (4 standard + 1 custom scenario)
+- [ ] Next.js tests pass (4 standard + 2 custom scenarios)
+- [ ] CI completes in < 5 minutes
+- [ ] Containers cleanup automatically (no orphans)
+- [ ] Tests run in parallel (dynamic port allocation works)
+- [ ] Zero flaky tests (20 consecutive runs pass)
+- [ ] README instructions work for new contributor
+- [ ] Adding a new framework takes < 2 hours (documented process)
+
+### Post-Implementation Verification
+- [ ] Run full test suite: `cargo test --workspace`
+- [ ] Run integration tests only: `cargo test -p integration-tests`
+- [ ] Run specific framework: `cargo test -p integration-tests -- wordpress`
+- [ ] Verify no Docker orphans: `docker ps -a | grep test-`
+- [ ] Test parallel execution: `cargo test -p integration-tests` (no `--test-threads=1`)
+- [ ] CI passes on PR branch
+
+## Architecture
+
+### High-Level Pattern (Multi-Platform)
+
+```
+┌──────────────────────────────────────────────────────────┐
+│ Matrix Test Runner                                       │
+│  ├─ Discovers registered runtimes (RUNTIME_ENVIRONMENTS) │
+│  ├─ Discovers registered frameworks (FRAMEWORKS)         │
+│  ├─ For each runtime:                                    │
+│  │   └─ For each framework:                             │
+│  │       ├─ Build container from fixture                │
+│  │       ├─ Generate platform-specific config           │
+│  │       ├─ Spawn runtime process (Viceroy/Wrangler/etc)│
+│  │       ├─ Run standard test scenarios                 │
+│  │       └─ Run framework-specific scenarios            │
+│  └─ Cleanup (automatic via Drop)                        │
+└──────────────────────────────────────────────────────────┘
+```
+
+**Initial Implementation** (1 runtime × 2 frameworks = 2 test combinations):
+```
+✓ WordPress + Fastly
+✓ Next.js + Fastly
+```
+
+**Future Expansion** (adding Cloudflare = 2 runtimes × 2 frameworks = 4 combinations):
+```
+✓ WordPress + Fastly
+✓ WordPress + Cloudflare  (future)
+✓ Next.js + Fastly
+✓ Next.js + Cloudflare    (future)
+```
+
+### Dual Abstraction Design
+
+#### Frontend Framework Abstraction
+
+```rust
+/// Trait defining how to test a frontend framework
+pub trait FrontendFramework {
+    /// Framework identifier (e.g., "wordpress", "nextjs")
+    fn id(&self) -> &'static str;
+
+    /// Build Docker container image for this framework
+    fn build_container(&self) -> Result<GenericImage>;
+
+    /// Port the framework serves on inside container
+    fn container_port(&self) -> u16;
+
+    /// HTTP path to use for health checks
+    fn health_check_path(&self) -> &str { "/" }
+
+    /// Standard test scenarios applicable to this framework
+    fn standard_scenarios(&self) -> Vec<TestScenario> {
+        vec![
+            TestScenario::HtmlInjection,
+            TestScenario::ScriptServing,
+            TestScenario::AttributeRewriting,
+            TestScenario::GdprSignal,
+        ]
+    }
+
+    /// Framework-specific test scenarios (optional)
+    fn custom_scenarios(&self) -> Vec<CustomScenario> {
+        vec![]
+    }
+
+    /// Additional assertions for this framework (optional)
+    fn custom_assertions(&self, html: &str) -> Result<()> {
+        Ok(())
+    }
+}
+```
+
+#### Runtime Environment Abstraction
+
+```rust
+/// Trait defining how to run the trusted-server on different platforms
+pub trait RuntimeEnvironment: Send + Sync {
+    /// Platform identifier (e.g., "fastly", "cloudflare")
+    fn id(&self) -> &'static str;
+
+    /// Spawn runtime with platform-specific configuration
+    fn spawn(&self, config: &RuntimeConfig) -> Result<RuntimeProcess, TestError>;
+
+    /// Platform-specific configuration template
+    fn config_template(&self) -> &str;
+
+    /// Health check endpoint (may differ by platform)
+    fn health_check_path(&self) -> &str { "/health" }
+
+    /// Platform-specific environment variables
+    fn env_vars(&self) -> HashMap<String, String> { HashMap::new() }
+}
+
+/// Platform-agnostic process handle
+pub struct RuntimeProcess {
+    inner: Box<dyn RuntimeProcessHandle>,
+    pub base_url: String,
+}
+
+trait RuntimeProcessHandle {
+    fn kill(&mut self) -> Result<(), TestError>;
+    fn wait(&mut self) -> Result<(), TestError>;
+}
+```
+
+### Request Flow (Multi-Platform)
+
+```
+┌──────────────┐
+│ Test Client  │
+│ (reqwest)    │
+└──────┬───────┘
+       │ GET http://127.0.0.1:<DYNAMIC_PORT>/
+       ▼
+┌───────────────────────────────────┐
+│ Runtime Process (child process)   │
+│  • Fastly: Viceroy                │
+│  • Cloudflare: Wrangler            │
+│  • (extensible via trait)          │
+│                                   │
+│ Runs WASM binary                  │
+│ Config: platform-specific toml    │
+└───────────────┬───────────────────┘
+                │ Proxy to origin_url
+                ▼
+┌────────────────────────────────────┐
+│ TestContainer (Docker)             │
+│  • WordPress                       │
+│  • Next.js                         │
+│  • (extensible via trait)          │
+│                                    │
+│ Port: 127.0.0.1:RANDOM             │
+└────────────────────────────────────┘
+```
+
+**Key Design Decisions:**
+
+1. **Dual Trait Abstraction**: Separate traits for frontend frameworks and runtime environments - enables independent extensibility
+2. **Framework Registry**: Static `FRAMEWORKS` array holds all registered frontend implementations
+3. **Runtime Registry**: Static `RUNTIME_ENVIRONMENTS` array holds all registered platform implementations
+4. **Matrix Test Runner**: Single test file iterates over both registries, runs all combinations
+5. **Fixture Isolation**: Each framework has dedicated `fixtures/frameworks/<name>/` directory
+6. **Config Isolation**: Each platform has dedicated `fixtures/configs/<platform>-template.toml`
+7. **Dynamic Port Allocation**: Each runtime gets random available port - enables parallel execution
+8. **Platform-Specific Config**: Template-based config generation with platform-specific formats
+9. **Automatic Cleanup**: Runtime processes and containers use `Drop` impl for cleanup
+
+## Directory Structure
+
+```
+crates/integration-tests/
+├── Cargo.toml                      # Test crate with testcontainers, reqwest
+├── README.md                       # Setup and how to add frameworks/runtimes
+├── fixtures/
+│   ├── configs/                    # Platform-specific config templates
+│   │   └── fastly-template.toml   # Fastly Compute configuration
+│   │       # Future: cloudflare-template.toml, spin-template.toml, etc.
+│   └── frameworks/                 # Frontend framework fixtures
+│       ├── wordpress/
+│       │   ├── Dockerfile          # WordPress + SQLite custom image
+│       │   └── theme/              # Minimal test theme
+│       └── nextjs/
+│           ├── Dockerfile          # Next.js 14 test app
+│           ├── package.json
+│           ├── next.config.mjs
+│           └── app/
+│               └── page.tsx        # Test page with ad slots
+├── tests/
+│   ├── common/
+│   │   ├── mod.rs                  # Re-exports
+│   │   ├── runtime.rs              # RuntimeEnvironment trait (NEW)
+│   │   ├── config.rs               # Platform-agnostic config generation
+│   │   └── assertions.rs           # Shared assertion helpers
+│   ├── environments/               # Runtime implementations
+│   │   ├── mod.rs                  # RuntimeEnvironment trait + registry
+│   │   └── fastly.rs               # FastlyViceroy implementation
+│   │       # Future: cloudflare.rs, spin.rs, etc.
+│   ├── frameworks/                 # Frontend implementations
+│   │   ├── mod.rs                  # FrontendFramework trait + registry
+│   │   ├── wordpress.rs            # WordPress implementation
+│   │   ├── nextjs.rs               # Next.js implementation
+│   │   └── scenarios.rs            # TestScenario enum + runners
+│   └── integration.rs              # Matrix test runner (frameworks × runtimes)
+└── .dockerignore
+```
+
+## Registry Pattern (Dual Abstraction)
+
+### Runtime Environment Registry (`tests/environments/mod.rs`)
+
+```rust
+mod fastly;
+// Future platforms:
+// mod cloudflare;
+// mod spin;
+
+use std::collections::HashMap;
+use error_stack::Result;
+
+/// Trait that all runtime environments must implement
+pub trait RuntimeEnvironment: Send + Sync {
+    fn id(&self) -> &'static str;
+    fn spawn(&self, config: &RuntimeConfig) -> Result<RuntimeProcess, TestError>;
+    fn config_template(&self) -> &str;
+    fn health_check_path(&self) -> &str { "/health" }
+    fn env_vars(&self) -> HashMap<String, String> { HashMap::new() }
+}
+
+/// Platform-agnostic process handle
+pub struct RuntimeProcess {
+    inner: Box<dyn RuntimeProcessHandle>,
+    pub base_url: String,
+}
+
+trait RuntimeProcessHandle {
+    fn kill(&mut self) -> Result<(), TestError>;
+    fn wait(&mut self) -> Result<(), TestError>;
+}
+
+/// Runtime factory function type
+type RuntimeFactory = fn() -> Box<dyn RuntimeEnvironment>;
+
+/// Registry of all supported runtime environments
+/// Uses function pointers to avoid trait object static initialization issues
+pub static RUNTIME_ENVIRONMENTS: &[RuntimeFactory] = &[
+    || Box::new(fastly::FastlyViceroy),
+    // Future: Add Cloudflare, Fermyon Spin, etc.
+    // || Box::new(cloudflare::CloudflareWrangler),
+    // || Box::new(spin::FermyonSpin),
+
+    // To add new runtime:
+    // 1. Create tests/environments/<platform>.rs
+    // 2. Implement RuntimeEnvironment trait
+    // 3. Add factory here: || Box::new(<platform>::<Struct>)
+];
+```
+
+### Frontend Framework Registry (`tests/frameworks/mod.rs`)
+
+```rust
+mod wordpress;
+mod nextjs;
+// To add new framework: create module and register below
+
+pub mod scenarios;
+
+use testcontainers::GenericImage;
+use error_stack::Result;
+
+/// Trait that all frontend frameworks must implement
+pub trait FrontendFramework: Send + Sync {
+    fn id(&self) -> &'static str;
+    fn build_container(&self) -> Result<GenericImage, TestError>;
+    fn container_port(&self) -> u16;
+    fn health_check_path(&self) -> &str { "/" }
+    fn standard_scenarios(&self) -> Vec<scenarios::TestScenario>;
+    fn custom_scenarios(&self) -> Vec<scenarios::CustomScenario> { vec![] }
+    fn custom_assertions(&self, html: &str) -> Result<(), TestError> { Ok(()) }
+}
+
+/// Framework factory function type
+type FrameworkFactory = fn() -> Box<dyn FrontendFramework>;
+
+/// Registry of all supported frameworks
+/// Uses function pointers to avoid trait object static initialization issues
+pub static FRAMEWORKS: &[FrameworkFactory] = &[
+    || Box::new(wordpress::WordPress),
+    || Box::new(nextjs::NextJs),
+    // To add new framework:
+    // 1. Create fixtures/frameworks/<name>/
+    // 2. Create tests/frameworks/<name>.rs
+    // 3. Implement FrontendFramework trait
+    // 4. Add factory here: || Box::new(<name>::<Struct>)
+];
+
+### Test Error Types
+
+```rust
+/// Test error types (platform-agnostic)
+#[derive(Debug, derive_more::Display)]
+pub enum TestError {
+    // Runtime environment errors
+    #[display("Failed to spawn runtime process")]
+    RuntimeSpawn,
+
+    #[display("Runtime not ready after timeout")]
+    RuntimeNotReady,
+
+    #[display("Failed to kill runtime process")]
+    RuntimeKill,
+
+    #[display("Failed to wait for runtime process")]
+    RuntimeWait,
+
+    // Container errors
+    #[display("Container failed to start: {reason}")]
+    ContainerStart { reason: String },
+
+    #[display("Container operation timed out")]
+    ContainerTimeout,
+
+    // HTTP errors
+    #[display("HTTP request failed")]
+    HttpRequest,
+
+    #[display("Failed to parse response")]
+    ResponseParse,
+
+    // Assertion errors
+    #[display("Script tag not found in HTML")]
+    ScriptTagNotFound,
+
+    #[display("Missing module: {module}")]
+    MissingModule { module: String },
+
+    #[display("Invalid CSS selector")]
+    InvalidSelector,
+
+    #[display("Element not found")]
+    ElementNotFound,
+
+    #[display("Attribute not rewritten")]
+    AttributeNotRewritten,
+
+    #[display("GDPR signal missing from response")]
+    GdprSignalMissing,
+
+    // Configuration errors
+    #[display("Config parse error")]
+    ConfigParse,
+
+    #[display("Config write error")]
+    ConfigWrite,
+
+    #[display("Config serialization error")]
+    ConfigSerialize,
+
+    // Resource errors
+    #[display("WASM binary not found")]
+    WasmBinaryNotFound,
+
+    #[display("No available port found")]
+    NoPortAvailable,
+}
+
+impl core::error::Error for TestError {}
+```
+
+### Runtime Implementation Examples
+
+#### Fastly Runtime (`tests/environments/fastly.rs`)
+
+```rust
+use super::*;
+use std::process::{Child, Command};
+
+pub struct FastlyViceroy;
+
+impl RuntimeEnvironment for FastlyViceroy {
+    fn id(&self) -> &'static str {
+        "fastly"
+    }
+
+    fn spawn(&self, config: &RuntimeConfig) -> Result<RuntimeProcess, TestError> {
+        let port = find_available_port()?;
+
+        let mut child = Command::new("viceroy")
+            .arg("run")
+            .arg("-C")
+            .arg(&config.config_path)
+            .arg("--addr")
+            .arg(format!("127.0.0.1:{}", port))
+            .arg("--")
+            .arg(&config.wasm_path)
+            .spawn()
+            .change_context(TestError::RuntimeSpawn)?;
+
+        let base_url = format!("http://127.0.0.1:{}", port);
+        wait_for_ready(&base_url, self.health_check_path())?;
+
+        Ok(RuntimeProcess {
+            inner: Box::new(ViceroyHandle { child }),
+            base_url,
+        })
+    }
+
+    fn config_template(&self) -> &str {
+        include_str!("../../fixtures/configs/fastly-template.toml")
+    }
+}
+
+struct ViceroyHandle {
+    child: Child,
+}
+
+impl RuntimeProcessHandle for ViceroyHandle {
+    fn kill(&mut self) -> Result<(), TestError> {
+        self.child.kill()
+            .change_context(TestError::RuntimeKill)?;
+        Ok(())
+    }
+
+    fn wait(&mut self) -> Result<(), TestError> {
+        self.child.wait()
+            .change_context(TestError::RuntimeWait)?;
+        Ok(())
+    }
+}
+```
+
+**Note**: Cloudflare runtime implementation example moved to "Future Enhancements" section.
+
+To add a new runtime platform, follow the same pattern as Fastly above:
+1. Create `tests/environments/<platform>.rs`
+2. Implement `RuntimeEnvironment` trait
+3. Create platform-specific process handle
+4. Register in `RUNTIME_ENVIRONMENTS` array
+
+### Frontend Framework Implementation Examples
+
+#### WordPress Implementation (`tests/frameworks/wordpress.rs`)
+
+```rust
+use super::{FrontendFramework, scenarios::*};
+use testcontainers::{GenericImage, WaitFor};
+
+pub struct WordPress;
+
+impl FrontendFramework for WordPress {
+    fn id(&self) -> &'static str {
+        "wordpress"
+    }
+
+    fn build_container(&self) -> Result<GenericImage, TestError> {
+        // Use wordpress:cli with minimal setup (no MySQL required for basic HTML serving)
+        // Alternative: Use pre-configured image with SQLite plugin
+        Ok(GenericImage::new("wordpress", "cli")
+            .with_exposed_port(8080)
+            .with_env_var("WORDPRESS_DEBUG", "0")
+            .with_wait_for(WaitFor::message_on_stdout("WordPress Ready")))
+    }
+
+    fn container_port(&self) -> u16 {
+        8080
+    }
+
+    fn standard_scenarios(&self) -> Vec<TestScenario> {
+        vec![
+            TestScenario::HtmlInjection,
+            TestScenario::ScriptServing { modules: vec!["core", "prebid"] },
+            TestScenario::AttributeRewriting,
+            TestScenario::GdprSignal,
+        ]
+    }
+
+    fn custom_scenarios(&self) -> Vec<CustomScenario> {
+        vec![
+            CustomScenario::WordPressAdminInjection,
+        ]
+    }
+
+    fn custom_assertions(&self, html: &str) -> Result<(), TestError> {
+        // Verify WordPress-specific HTML structure preserved
+        ensure!(html.contains("wp-content"), "should preserve wp-content paths");
+        Ok(())
+    }
+}
+```
+
+**Note**: WordPress requires additional setup for full functionality. For Phase 3, consider:
+- **Option A** (Recommended): Use `wordpress:cli` image or pre-built image with SQLite plugin - simpler, faster startup
+- **Option B**: Multi-container setup with MySQL - more realistic but adds complexity
+
+### Building Container Images
+
+For frameworks that require custom Docker images (like Next.js), the images must be built before tests run:
+
+**Option 1: Pre-build in CI** (Recommended)
+```yaml
+# In .github/workflows/test.yml
+- name: Build test container images
+  run: |
+    docker build -t test-nextjs:latest \
+      crates/integration-tests/fixtures/frameworks/nextjs/
+```
+
+**Option 2: Build on-demand in tests**
+```rust
+// In tests/frameworks/nextjs.rs
+fn build_container(&self) -> Result<GenericImage, TestError> {
+    // Check if image exists, build if not
+    let image_name = "test-nextjs:latest";
+
+    // Use testcontainers ImageBuild API (if available)
+    // or shell out to docker build command
+    Ok(GenericImage::new(image_name, "latest")
+        .with_exposed_port(3000))
+}
+```
+
+**Option 3: Use docker-compose** (Future enhancement)
+```rust
+// Multi-service orchestration for complex setups
+```
+
+### Next.js Implementation (`tests/frameworks/nextjs.rs`)
+
+```rust
+use super::{FrontendFramework, scenarios::*};
+use testcontainers::GenericImage;
+
+pub struct NextJs;
+
+impl FrontendFramework for NextJs {
+    fn id(&self) -> &'static str {
+        "nextjs"
+    }
+
+    fn build_container(&self) -> Result<GenericImage, TestError> {
+        // Build from Dockerfile in fixtures/frameworks/nextjs/
+        Ok(GenericImage::new("test-nextjs", "latest")
+            .with_exposed_port(3000)
+            .with_wait_for(WaitFor::message_on_stdout("ready")))
+    }
+
+    fn container_port(&self) -> u16 {
+        3000
+    }
+
+    fn standard_scenarios(&self) -> Vec<TestScenario> {
+        vec![
+            TestScenario::HtmlInjection,
+            TestScenario::ScriptServing { modules: vec!["core", "prebid", "lockr"] },
+            TestScenario::AttributeRewriting,
+            TestScenario::GdprSignal,
+        ]
+    }
+
+    fn custom_scenarios(&self) -> Vec<CustomScenario> {
+        vec![
+            CustomScenario::NextJsRscFlight,  // RSC streaming format
+            CustomScenario::NextJsServerActions,
+        ]
+    }
+
+    fn custom_assertions(&self, html: &str) -> Result<(), TestError> {
+        // Verify Next.js hydration markers preserved
+        ensure!(html.contains("__NEXT_DATA__"), "should preserve Next.js data");
+        Ok(())
+    }
+}
+```
+
+### Test Scenarios (`tests/frameworks/scenarios.rs`)
+
+```rust
+/// Standard test scenarios applicable to all frameworks
+#[derive(Debug, Clone)]
+pub enum TestScenario {
+    /// Verify <script> tag injected into <head>
+    HtmlInjection,
+
+    /// Verify /static/tsjs= endpoint serves JS bundles
+    ScriptServing { modules: Vec<&'static str> },
+
+    /// Verify tsjs-* attributes rewritten correctly
+    AttributeRewriting,
+
+    /// Verify GDPR consent signals propagate
+    GdprSignal,
+}
+
+/// Framework-specific custom scenarios
+#[derive(Debug, Clone)]
+pub enum CustomScenario {
+    WordPressAdminInjection,
+    NextJsRscFlight,
+    NextJsServerActions,
+    LeptosHydration,      // Future
+    NuxtSsr,              // Future
+}
+
+impl TestScenario {
+    pub fn run(&self, viceroy: &ViceroyProcess, framework: &dyn FrontendFramework) -> Result<(), TestError> {
+        let framework_id = framework.id();
+
+        match self {
+            Self::HtmlInjection => {
+                let resp = reqwest::blocking::get(viceroy.base_url())
+                    .change_context(TestError::HttpRequest)
+                    .attach_printable(format!(
+                        "scenario: HtmlInjection, framework: {}", framework_id
+                    ))?;
+
+                let html = resp.text()
+                    .change_context(TestError::ResponseParse)
+                    .attach_printable(format!("framework: {}", framework_id))?;
+
+                assert_script_tag_present(&html, &["core"])
+                    .attach_printable(format!("framework: {}", framework_id))?;
+
+                Ok(())
+            }
+            Self::ScriptServing { modules } => {
+                let url = format!("{}/static/tsjs={}", viceroy.base_url(), modules.join(","));
+                let resp = reqwest::blocking::get(&url)
+                    .change_context(TestError::HttpRequest)
+                    .attach_printable(format!(
+                        "scenario: ScriptServing, framework: {}, modules: {:?}",
+                        framework_id, modules
+                    ))?;
+
+                ensure!(
+                    resp.status().is_success(),
+                    TestError::HttpRequest
+                );
+
+                let js = resp.text()
+                    .change_context(TestError::ResponseParse)?;
+
+                ensure!(
+                    js.contains("window.tsjs"),
+                    TestError::ScriptTagNotFound
+                );
+
+                Ok(())
+            }
+            Self::AttributeRewriting => {
+                let resp = reqwest::blocking::get(viceroy.base_url())
+                    .change_context(TestError::HttpRequest)
+                    .attach_printable(format!(
+                        "scenario: AttributeRewriting, framework: {}", framework_id
+                    ))?;
+
+                let html = resp.text()
+                    .change_context(TestError::ResponseParse)?;
+
+                assert_attribute_rewritten(&html, "div[data-ad-unit]", "tsjs-")
+                    .attach_printable(format!("framework: {}", framework_id))?;
+
+                Ok(())
+            }
+            Self::GdprSignal => {
+                let resp = reqwest::blocking::get(viceroy.base_url())
+                    .change_context(TestError::HttpRequest)
+                    .attach_printable(format!(
+                        "scenario: GdprSignal, framework: {}", framework_id
+                    ))?;
+
+                assert_gdpr_signal(&resp)
+                    .attach_printable(format!("framework: {}", framework_id))?;
+
+                Ok(())
+            }
+        }
+    }
+}
+```
+
+### Matrix Test Runner (`tests/integration.rs`)
+
+```rust
+mod common;
+mod environments;
+mod frameworks;
+
+use environments::RUNTIME_ENVIRONMENTS;
+use frameworks::FRAMEWORKS;
+use common::{RuntimeConfig, wasm_binary_path};
+use std::time::Duration;
+use error_stack::ResultExt;
+
+/// Test all combinations: frameworks × runtimes (matrix testing)
+#[test]
+fn test_all_combinations() {
+    for runtime_factory in RUNTIME_ENVIRONMENTS {
+        let runtime = runtime_factory();
+        println!("Testing runtime: {}", runtime.id());
+
+        for framework_factory in FRAMEWORKS {
+            let framework = framework_factory();
+            println!("  Testing framework: {}", framework.id());
+
+            test_combination(runtime.as_ref(), framework.as_ref())
+                .expect("combination should pass");
+        }
+    }
+}
+
+/// Test a specific framework × runtime combination
+fn test_combination(
+    runtime: &dyn RuntimeEnvironment,
+    framework: &dyn FrontendFramework,
+) -> Result<(), TestError> {
+    // 1. Start frontend container
+    let container = framework.build_container()
+        .attach_printable(format!(
+            "runtime: {}, framework: {}",
+            runtime.id(),
+            framework.id()
+        ))?;
+
+    let container_instance = tokio::time::timeout(
+        Duration::from_secs(60),
+        async { container.start() }
+    )
+        .await
+        .change_context(TestError::ContainerTimeout)?
+        .change_context(TestError::ContainerStart {
+            reason: format!("framework: {}", framework.id())
+        })?;
+
+    let origin_url = format!(
+        "http://127.0.0.1:{}",
+        container_instance.get_host_port(framework.container_port())
+    );
+
+    // 2. Generate platform-specific config
+    let wasm_path = wasm_binary_path();
+    let config = RuntimeConfig::new(runtime.config_template())
+        .with_origin_url(origin_url)
+        .with_integrations(vec!["prebid", "lockr"])
+        .with_wasm_path(wasm_path)
+        .build()
+        .attach_printable(format!(
+            "runtime: {}, framework: {}",
+            runtime.id(),
+            framework.id()
+        ))?;
+
+    // 3. Spawn runtime process
+    let process = runtime.spawn(&config)
+        .attach_printable(format!(
+            "runtime: {}, framework: {}",
+            runtime.id(),
+            framework.id()
+        ))?;
+
+    // 4. Run standard scenarios
+    for scenario in framework.standard_scenarios() {
+        scenario.run(&process.base_url, framework)
+            .attach_printable(format!(
+                "runtime: {}, framework: {}, scenario: {:?}",
+                runtime.id(),
+                framework.id(),
+                scenario
+            ))?;
+    }
+
+    // 5. Run custom scenarios
+    for scenario in framework.custom_scenarios() {
+        scenario.run(&process.base_url, framework)
+            .attach_printable(format!(
+                "runtime: {}, framework: {}, custom scenario: {:?}",
+                runtime.id(),
+                framework.id(),
+                scenario
+            ))?;
+    }
+
+    // 6. Cleanup (automatic via Drop)
+    Ok(())
+}
+
+// Support running specific combinations for faster iteration
+#[test]
+fn test_wordpress_fastly() {
+    let runtime = environments::fastly::FastlyViceroy;
+    let framework = frameworks::wordpress::WordPress;
+    test_combination(&runtime, &framework)
+        .expect("WordPress on Fastly should work");
+}
+
+#[test]
+fn test_nextjs_fastly() {
+    let runtime = environments::fastly::FastlyViceroy;
+    let framework = frameworks::nextjs::NextJs;
+    test_combination(&runtime, &framework)
+        .expect("Next.js on Fastly should work");
+}
+
+// Future: Add Cloudflare-specific tests when platform support is added
+// #[test]
+// fn test_wordpress_cloudflare() { ... }
+// #[test]
+// fn test_nextjs_cloudflare() { ... }
+```
+
+## Extensibility Guide
+
+### Adding a New Frontend Framework
+
+**Example workflow** (implementation details in code comments):
+
+**Step 1**: Create fixture directory
+```bash
+mkdir -p crates/integration-tests/fixtures/frameworks/<name>
+# Add Dockerfile, test application code, etc.
+```
+
+**Step 2**: Implement `FrontendFramework` trait
+```rust
+// tests/frameworks/<name>.rs
+use super::{FrontendFramework, scenarios::*};
+
+pub struct YourFramework;
+
+impl FrontendFramework for YourFramework {
+    fn id(&self) -> &'static str { "<name>" }
+    fn build_container(&self) -> Result<GenericImage, TestError> { /* ... */ }
+    fn container_port(&self) -> u16 { /* port */ }
+    fn standard_scenarios(&self) -> Vec<TestScenario> { /* ... */ }
+    // Optional: custom_scenarios, custom_assertions
+}
+```
+
+**Step 3**: Register in framework registry
+```rust
+// tests/frameworks/mod.rs
+mod <name>;
+
+pub static FRAMEWORKS: &[FrameworkFactory] = &[
+    || Box::new(wordpress::WordPress),
+    || Box::new(nextjs::NextJs),
+    || Box::new(<name>::YourFramework),  // <- Add here
+];
+```
+
+**Done!** The new framework is automatically tested against ALL registered runtimes.
+
+### Adding a New Runtime Environment
+
+**Example workflow** (implementation details in code comments):
+
+**Step 1**: Create platform config template
+```bash
+# fixtures/configs/<platform>-template.toml
+# Platform-specific configuration format
+```
+
+**Step 2**: Implement `RuntimeEnvironment` trait
+```rust
+// tests/environments/<platform>.rs
+use super::*;
+
+pub struct YourRuntime;
+
+impl RuntimeEnvironment for YourRuntime {
+    fn id(&self) -> &'static str { "<platform>" }
+    fn spawn(&self, config: &RuntimeConfig) -> Result<RuntimeProcess, TestError> {
+        // Platform-specific process spawning
+        /* ... */
+    }
+    fn config_template(&self) -> &str {
+        include_str!("../../fixtures/configs/<platform>-template.toml")
+    }
+    // Optional: health_check_path, env_vars
+}
+
+struct YourRuntimeHandle {
+    child: Child,
+}
+
+impl RuntimeProcessHandle for YourRuntimeHandle {
+    fn kill(&mut self) -> Result<(), TestError> { /* ... */ }
+    fn wait(&mut self) -> Result<(), TestError> { /* ... */ }
+}
+```
+
+**Step 3**: Register in runtime registry
+```rust
+// tests/environments/mod.rs
+mod <platform>;
+
+pub static RUNTIME_ENVIRONMENTS: &[RuntimeFactory] = &[
+    || Box::new(fastly::FastlyViceroy),
+    || Box::new(cloudflare::CloudflareWrangler),
+    || Box::new(<platform>::YourRuntime),  // <- Add here
+];
+```
+
+**Done!** The new runtime is automatically tested against ALL registered frameworks.
+
+## Implementation Phases (Multi-Platform)
+
+### Phase 0: Prerequisites (BLOCKER)
+**Goal**: Add `/health` endpoint to enable runtime readiness checks
+
+1. Add health check route to `crates/fastly/src/main.rs`:
+```rust
+(Method::GET, "/health") => Ok(Response::from_status(200).with_body_text_plain("ok"))
+```
+2. Build and test WASM binary with Viceroy
+3. Verify `/health` returns 200 OK
+
+**Verification**: `curl http://127.0.0.1:7676/health` returns "ok"
+
+### Phase 1: Core Infrastructure (Foundation)
+**Goal**: Set up test crate structure with dual abstraction support
+
+1. Add `integration-tests` to workspace members in root `Cargo.toml`
+2. Create `crates/integration-tests/Cargo.toml` with dependencies
+3. Define `RuntimeEnvironment` trait in `tests/common/runtime.rs` (NEW)
+4. Implement `RuntimeConfig` with platform-agnostic interface
+5. Create platform config templates in `fixtures/configs/`
+6. Implement assertion helpers in `tests/common/assertions.rs`
+
+**Verification**: `cargo check -p integration-tests`
+
+### Phase 1.5: Fastly Runtime Implementation
+**Goal**: Implement Fastly/Viceroy runtime support
+
+1. Create `tests/environments/fastly.rs`
+2. Implement `FastlyViceroy` struct with `RuntimeEnvironment` trait
+3. Create `ViceroyHandle` for process lifecycle
+4. Implement health check with `/health` endpoint
+5. Create `fixtures/configs/fastly-template.toml`
+
+**Verification**: `cargo test -p integration-tests --lib test_fastly_runtime_spawn`
+
+### Phase 2: Framework Abstraction (Extensibility Layer)
+**Goal**: Create trait-based framework system
+
+1. Define `FrontendFramework` trait in `tests/frameworks/mod.rs`
+2. Define `TestScenario` enum and runners in `tests/frameworks/scenarios.rs`
+3. Implement scenario execution logic
+4. Create framework registry pattern
+
+**Verification**: Trait compiles and registry pattern works
+
+### Phase 3: WordPress Implementation
+**Goal**: Implement first framework and test against Fastly
+
+1. Create WordPress Dockerfile with SQLite plugin
+2. Create minimal test theme
+3. Implement `WordPress` struct in `tests/frameworks/wordpress.rs`
+4. Create matrix test runner in `tests/integration.rs`
+5. Test WordPress against Fastly
+
+**Verification**:
+```bash
+cargo test -p integration-tests -- wordpress_fastly
+```
+
+### Phase 4: Next.js Implementation
+**Goal**: Prove extensibility works for frameworks
+
+1. Create Next.js 14 minimal app
+2. Create Dockerfile
+3. Implement `NextJs` struct in `tests/frameworks/nextjs.rs`
+4. Add RSC-specific scenarios
+5. Test against Fastly
+
+**Verification**:
+```bash
+cargo test -p integration-tests -- test_all_combinations
+cargo test -p integration-tests -- nextjs_fastly
+```
+
+### Phase 5: Documentation and CI (Production Ready)
+**Goal**: Production-ready CI pipeline and documentation
+
+1. Write comprehensive `README.md` with:
+   - How to add new frameworks
+   - How to add new runtimes (for future)
+   - Troubleshooting guide
+2. Create `.github/workflows/integration-tests.yml`:
+   - Build WASM binary first
+   - Install Viceroy
+   - Build container images (WordPress, Next.js)
+   - Run integration tests with `WASM_BINARY_PATH` env var
+3. Add `.dockerignore` for build optimization
+
+**Verification**: CI passes with both frameworks against Fastly
+
+## Critical Files to Create
+
+### 1. `crates/integration-tests/Cargo.toml`
+
+```toml
+[package]
+name = "integration-tests"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dev-dependencies]
+testcontainers = "0.25"
+reqwest = { version = "0.12", features = ["blocking"] }
+scraper = "0.21"
+tempfile = "3.0"
+toml = "0.8"
+serde = { version = "1.0", features = ["derive"] }
+log = "0.4"
+error-stack = "0.5"
+tokio = { version = "1.0", features = ["time"] }  # For container timeouts
+# serial_test = "3.0"  # Optional: for test isolation (Phase 6)
+```
+
+### 2. `tests/common/viceroy.rs` - Process Manager
+
+```rust
+use std::process::{Child, Command};
+use std::path::{Path, PathBuf};
+use std::time::Duration;
+use std::env;
+use error_stack::{Result, Report, ResultExt};
+
+pub struct ViceroyProcess {
+    child: Child,
+    address: String,
+}
+
+impl ViceroyProcess {
+    pub fn spawn(config_path: &Path, wasm_path: &Path) -> Result<Self, TestError> {
+        // Verify WASM binary exists
+        ensure!(
+            wasm_path.exists(),
+            TestError::WasmBinaryNotFound
+        );
+
+        // 1. Spawn: viceroy run -C config_path -- wasm_path
+        let mut child = Command::new("viceroy")
+            .arg("run")
+            .arg("-C")
+            .arg(config_path)
+            .arg("--")
+            .arg(wasm_path)
+            .spawn()
+            .change_context(TestError::ViceroySpawn)?;
+
+        // 2. Wait for Viceroy to be ready on 127.0.0.1:7676
+        let address = "http://127.0.0.1:7676".to_string();
+        Self::wait_for_ready(&address)?;
+
+        Ok(Self { child, address })
+    }
+
+    fn wait_for_ready(address: &str) -> Result<(), TestError> {
+        // Try /health endpoint first (requires WASM binary to implement it)
+        // Fall back to root path if /health doesn't exist
+        for attempt in 0..30 {
+            if let Ok(resp) = reqwest::blocking::get(format!("{}/health", address)) {
+                if resp.status().is_success() {
+                    return Ok(());
+                }
+            }
+
+            // Fallback: try root path
+            if let Ok(resp) = reqwest::blocking::get(address) {
+                if resp.status().is_success() || resp.status().as_u16() == 404 {
+                    // 404 is fine - means server is responding
+                    return Ok(());
+                }
+            }
+
+            std::thread::sleep(Duration::from_millis(100));
+        }
+        bail!(TestError::ViceroyNotReady)
+    }
+
+    pub fn base_url(&self) -> &str {
+        &self.address
+    }
+}
+
+impl Drop for ViceroyProcess {
+    fn drop(&mut self) {
+        let _ = self.child.kill();
+        let _ = self.child.wait();
+    }
+}
+
+/// Get path to WASM binary, respecting environment variable
+fn wasm_binary_path() -> PathBuf {
+    env::var("WASM_BINARY_PATH")
+        .map(PathBuf::from)
+        .unwrap_or_else(|_| {
+            PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+                .join("../target/wasm32-wasip1/release/trusted-server-fastly.wasm")
+        })
+}
+```
+
+**IMPORTANT**: For production use, add a `/health` endpoint to the WASM binary:
+
+```rust
+// In crates/fastly/src/main.rs
+fn route_request(req: Request) -> Result<Response, Report<TrustedServerError>> {
+    match req.get_path() {
+        "/health" => Ok(Response::from_status(200)
+            .with_body_text_plain("ok")),
+        // ... existing routes
+    }
+}
+```
+
+### 3. `tests/common/config.rs` - Dynamic Config
+
+```rust
+use tempfile::NamedTempFile;
+use std::io::Write;
+use error_stack::{Result, ResultExt};
+
+pub struct TestConfig {
+    origin_url: String,
+    integrations: Vec<String>,
+}
+
+impl TestConfig {
+    pub fn new(container_url: String) -> Self {
+        Self {
+            origin_url: container_url,
+            integrations: vec![],
+        }
+    }
+
+    pub fn with_integrations(mut self, ids: Vec<String>) -> Self {
+        self.integrations = ids;
+        self
+    }
+
+    pub fn write_to_file(&self) -> Result<NamedTempFile, TestError> {
+        // Load template
+        let template = include_str!("../../fixtures/base-config.toml");
+        let mut config: toml::Value = toml::from_str(template)
+            .change_context(TestError::ConfigParse)?;
+
+        // Safe mutation: override publisher.origin_url
+        if let Some(publisher) = config.get_mut("publisher") {
+            if let Some(publisher_table) = publisher.as_table_mut() {
+                publisher_table.insert(
+                    "origin_url".to_string(),
+                    toml::Value::String(self.origin_url.clone())
+                );
+            }
+        } else {
+            return Err(TestError::ConfigParse)
+                .attach_printable("missing [publisher] section in base config");
+        }
+
+        // Safe mutation: enable integrations
+        let integrations_config = config
+            .get_mut("integrations")
+            .and_then(|v| v.get_mut("config"))
+            .and_then(|v| v.as_table_mut())
+            .ok_or(TestError::ConfigParse)
+            .attach_printable("missing [integrations.config] section")?;
+
+        for integration_id in &self.integrations {
+            if let Some(integration_entry) = integrations_config.get_mut(integration_id) {
+                // Integration exists in template - update it
+                if let Some(table) = integration_entry.as_table_mut() {
+                    table.insert("enabled".to_string(), toml::Value::Boolean(true));
+                }
+            } else {
+                // Integration doesn't exist - create new entry
+                let mut new_table = toml::map::Map::new();
+                new_table.insert("enabled".to_string(), toml::Value::Boolean(true));
+                integrations_config.insert(
+                    integration_id.clone(),
+                    toml::Value::Table(new_table)
+                );
+            }
+        }
+
+        // Write to temp file
+        let mut file = NamedTempFile::new()
+            .change_context(TestError::ConfigWrite)?;
+        let content = toml::to_string_pretty(&config)
+            .change_context(TestError::ConfigSerialize)?;
+        file.write_all(content.as_bytes())
+            .change_context(TestError::ConfigWrite)?;
+
+        Ok(file)
+    }
+}
+```
+
+### 4. `tests/common/assertions.rs` - Shared Helpers
+
+```rust
+use scraper::{Html, Selector};
+use error_stack::{Result, Report};
+
+pub fn assert_script_tag_present(html: &str, module_ids: &[&str]) -> Result<(), TestError> {
+    let document = Html::parse_document(html);
+    let selector = Selector::parse("script[src]").expect("valid selector");
+
+    for element in document.select(&selector) {
+        if let Some(src) = element.value().attr("src") {
+            if src.starts_with("/static/tsjs=") {
+                for module_id in module_ids {
+                    ensure!(
+                        src.contains(module_id),
+                        TestError::MissingModule { module: module_id.to_string() }
+                    );
+                }
+                return Ok(());
+            }
+        }
+    }
+
+    bail!(TestError::ScriptTagNotFound)
+}
+
+pub fn assert_attribute_rewritten(html: &str, selector: &str, attr_prefix: &str) -> Result<(), TestError> {
+    let document = Html::parse_document(html);
+    let sel = Selector::parse(selector).change_context(TestError::InvalidSelector)?;
+
+    let element = document
+        .select(&sel)
+        .next()
+        .ok_or(TestError::ElementNotFound)?;
+
+    let has_tsjs_attr = element
+        .value()
+        .attrs()
+        .any(|(name, _)| name.starts_with(attr_prefix));
+
+    ensure!(has_tsjs_attr, TestError::AttributeNotRewritten);
+    Ok(())
+}
+
+pub fn assert_gdpr_signal(response: &reqwest::blocking::Response) -> Result<(), TestError> {
+    let cookies = response.cookies().collect::<Vec<_>>();
+    ensure!(
+        cookies.iter().any(|c| c.name() == "tsjs_gdpr_consent"),
+        TestError::GdprSignalMissing
+    );
+    Ok(())
+}
+```
+
+### 5. `crates/integration-tests/README.md`
+
+```markdown
+# Integration Tests
+
+End-to-end integration tests for Trusted Server with multiple frontend frameworks.
+
+## Prerequisites
+
+- Docker installed and running
+- Rust 1.91+ with wasm32-wasip1 target
+- Viceroy installed: `cargo install viceroy`
+
+## Running Tests
+
+```bash
+# Build WASM binary first
+cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
+
+# Build container images (if needed)
+docker build -t test-nextjs:latest \
+  crates/integration-tests/fixtures/frameworks/nextjs/
+
+# Run all framework tests (sequential execution required due to shared port)
+cargo test -p integration-tests -- --test-threads=1
+
+# Run specific framework
+cargo test -p integration-tests --test integration -- wordpress --test-threads=1
+cargo test -p integration-tests --test integration -- nextjs --test-threads=1
+
+# With debug logging
+RUST_LOG=debug cargo test -p integration-tests -- --test-threads=1 --nocapture
+```
+
+**Note**: Tests must run sequentially (`--test-threads=1`) because they share Viceroy port 7676. Future enhancement will add dynamic port allocation for parallel execution.
+
+## Adding a New Framework
+
+See INTEGRATION_TESTS_PLAN.md section "How to Add a New Framework" for step-by-step guide.
+
+Quick checklist:
+1. Create `fixtures/frameworks/<name>/` with Dockerfile and test app
+2. Implement `FrontendFramework` trait in `tests/frameworks/<name>.rs`
+3. Register in `FRAMEWORKS` array in `tests/frameworks/mod.rs`
+4. Run tests!
+```
+
+## Fixtures
+
+### `fixtures/base-config.toml`
+
+```toml
+[publisher]
+id = "test-publisher"
+name = "Integration Test Publisher"
+origin_url = "PLACEHOLDER"
+public_domain_url = "http://127.0.0.1:7676"
+
+[integrations.config]
+prebid = { enabled = false }
+lockr = { enabled = false }
+permutive = { enabled = false }
+datadome = { enabled = false }
+
+[storage]
+kv_store_name = "test_store"
+
+[gdpr]
+enabled = true
+```
+
+### `fixtures/frameworks/nextjs/package.json`
+
+```json
+{
+  "name": "integration-test-nextjs",
+  "version": "1.0.0",
+  "private": true,
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start"
+  },
+  "dependencies": {
+    "next": "^14.0.0",
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0"
+  }
+}
+```
+
+### `fixtures/frameworks/nextjs/app/page.tsx`
+
+```tsx
+export default function Home() {
+  return (
+    <div>
+      <h1>Integration Test Page</h1>
+      <div id="ad-slot-1" data-ad-unit="/test/banner"></div>
+      <div id="ad-slot-2" data-ad-unit="/test/sidebar"></div>
+    </div>
+  );
+}
+```
+
+## Verification
+
+### Local Testing
+```bash
+# Full suite
+cargo test -p integration-tests
+
+# Single framework (faster iteration)
+cargo test -p integration-tests --test integration -- wordpress --nocapture
+
+# With logs
+RUST_LOG=debug cargo test -p integration-tests
+```
+
+### CI Testing
+
+Example workflow job:
+```yaml
+integration-tests:
+  runs-on: ubuntu-latest
+  needs: test  # Run after unit tests pass
+  steps:
+    - uses: actions/checkout@v4
+
+    - name: Install Rust
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        targets: wasm32-wasip1
+
+    - name: Build WASM binary
+      run: |
+        cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
+
+    - name: Build WordPress test container
+      run: |
+        docker build -t test-wordpress:latest \
+          crates/integration-tests/fixtures/frameworks/wordpress/
+
+    - name: Build Next.js test container
+      run: |
+        docker build -t test-nextjs:latest \
+          crates/integration-tests/fixtures/frameworks/nextjs/
+
+    - name: Install Viceroy
+      run: cargo install viceroy --locked
+
+    - name: Run integration tests
+      run: cargo test -p integration-tests
+      env:
+        WASM_BINARY_PATH: target/wasm32-wasip1/release/trusted-server-fastly.wasm
+```
+
+- Builds WASM binary as prerequisite
+- Pre-builds Docker images for both frameworks
+- Installs Viceroy for Fastly runtime
+- Runs all framework tests against Fastly
+- Fails if any framework test fails
+
+### Success Criteria
+- [ ] WordPress tests pass against Fastly (4 standard + 1 custom scenario)
+- [ ] Next.js tests pass against Fastly (4 standard + 2 custom scenarios)
+- [ ] CI completes in < 5 minutes
+- [ ] Containers cleanup automatically (no orphans)
+- [ ] Tests run in parallel (dynamic port allocation works)
+- [ ] Zero flaky tests (20 consecutive runs pass)
+- [ ] README instructions work for new contributor
+- [ ] RuntimeEnvironment architecture supports future platforms without refactoring
+
+## Future Framework Support
+
+Planned frameworks to add after initial implementation:
+
+- **Leptos** - Rust frontend framework (SSR + hydration)
+- **Nuxt** - Vue.js framework (SSR, streaming)
+- **SvelteKit** - Svelte framework (SSR, islands)
+- **Qwik** - Resumability-focused framework
+- **Astro** - Static site generator with islands
+
+Each should require only:
+- Fixture creation (~1 hour)
+- Trait implementation (~50 lines)
+- Registry addition (~1 line)
+
+## Dependencies
+
+**New Workspace Dependencies:**
+- `testcontainers = "0.25"` - Docker container orchestration
+- `scraper = "0.21"` - HTML parsing for assertions
+- `tempfile = "3.0"` - Temporary config files
+
+**Existing Dependencies (reused):**
+- `reqwest` - HTTP client
+- `toml` - Config parsing
+- `serde` - Serialization
+- `error-stack` - Error handling
+
+## Risks and Mitigations
+
+| Risk | Impact | Mitigation |
+|------|--------|------------|
+| Docker not available in CI | High | ubuntu-latest has Docker pre-installed, verify early |
+| Port 7676 conflicts | Medium | Add port availability check with retry logic |
+| Slow container startup | Medium | Health check polling with 30s timeout, fail fast |
+| WASM binary not built | High | Explicit build step in CI before tests, clear error message |
+| Framework-specific bugs | Low | Trait abstraction isolates issues to specific impl |
+| Flaky tests | High | Proper health checks, deterministic scenarios, retry logic |
+
+## Files to Modify
+
+- `Cargo.toml` (workspace root) - Add `integration-tests` to members
+- `.github/workflows/test.yml` - Add integration test job with WASM build and container image builds (or create new `integration-tests.yml`)
+- `crates/fastly/src/main.rs` - Add `/health` endpoint for Viceroy readiness checks
+
+## Files to Create (Total: 21 files)
+
+### Core Infrastructure (7 files)
+- `crates/integration-tests/Cargo.toml`
+- `crates/integration-tests/README.md`
+- `crates/integration-tests/tests/common/mod.rs`
+- `crates/integration-tests/tests/common/runtime.rs` (RuntimeEnvironment trait)
+- `crates/integration-tests/tests/common/config.rs`
+- `crates/integration-tests/tests/common/assertions.rs`
+- `crates/fastly/src/main.rs` (MODIFY - add `/health` endpoint)
+
+### Environment Abstraction (2 files)
+- `crates/integration-tests/tests/environments/mod.rs` (RuntimeEnvironment registry)
+- `crates/integration-tests/tests/environments/fastly.rs` (FastlyViceroy implementation)
+
+### Framework System (4 files)
+- `crates/integration-tests/tests/frameworks/mod.rs`
+- `crates/integration-tests/tests/frameworks/scenarios.rs`
+- `crates/integration-tests/tests/frameworks/wordpress.rs`
+- `crates/integration-tests/tests/frameworks/nextjs.rs`
+
+### Test Runner (1 file)
+- `crates/integration-tests/tests/integration.rs` (Matrix test runner)
+
+### Fixtures (7 files)
+- `crates/integration-tests/fixtures/configs/fastly-template.toml`
+- `crates/integration-tests/fixtures/frameworks/wordpress/Dockerfile`
+- `crates/integration-tests/fixtures/frameworks/wordpress/theme.zip`
+- `crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile`
+- `crates/integration-tests/fixtures/frameworks/nextjs/package.json`
+- `crates/integration-tests/fixtures/frameworks/nextjs/next.config.mjs`
+- `crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx`
+
+## Troubleshooting Guide
+
+### Common Issues
+
+**1. "WASM binary not found"**
+```bash
+# Solution: Build the WASM binary first
+cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
+
+# Or set WASM_BINARY_PATH environment variable
+export WASM_BINARY_PATH=/path/to/trusted-server-fastly.wasm
+```
+
+**2. "Container image not found: test-nextjs:latest"**
+```bash
+# Solution: Pre-build the Docker image
+docker build -t test-nextjs:latest \
+  crates/integration-tests/fixtures/frameworks/nextjs/
+```
+
+**3. "Viceroy not ready after 30s"**
+- Check if port 7676 is already in use: `lsof -i :7676`
+- Verify WASM binary runs: `viceroy run -C fastly.toml -- path/to/binary.wasm`
+- Check Viceroy logs for errors
+- Ensure `/health` endpoint exists or fallback works
+
+**4. "Address already in use (port 7676)"**
+- Kill existing Viceroy process: `pkill viceroy`
+- Run tests sequentially (not in parallel)
+- Future: Use dynamic port allocation
+
+**5. "Container startup timeout"**
+- Increase timeout in `test_framework()` function
+- Check Docker daemon is running: `docker ps`
+- Verify container image builds correctly: `docker run -it test-nextjs:latest`
+
+**6. "Config parse error: missing [integrations.config]"**
+- Verify `fixtures/base-config.toml` has correct structure
+- Ensure template includes all required sections
+
+**7. "Script tag not found in HTML"**
+- Verify origin container is serving HTML correctly
+- Check Viceroy proxy configuration
+- Inspect response with `--nocapture` flag: `cargo test -- --nocapture`
+
+### Debug Mode
+
+Run tests with full logging:
+```bash
+RUST_LOG=debug cargo test -p integration-tests -- --nocapture
+```
+
+Inspect container logs:
+```bash
+docker logs <container-id>
+```
+
+Attach to running Viceroy:
+```bash
+# In test, add: std::thread::sleep(Duration::from_secs(300));
+# Then: curl http://127.0.0.1:7676/health
+```
+
+## Implementation Notes & Best Practices
+
+### Critical Fixes Applied
+
+1. **Trait Object Safety**: Uses function registry (`&[FrameworkFactory]`) instead of `&[&dyn Trait]` to avoid static initialization issues with trait objects returning non-`Sized` types.
+
+2. **Complete Error Types**: `TestError` enum defined with all variants needed for proper error handling and context propagation.
+
+3. **Health Check Strategy**: Viceroy readiness check tries `/health` endpoint first, falls back to root path. Production should implement `/health` endpoint in WASM binary.
+
+4. **Safe TOML Mutation**: Config generation uses safe table lookups with proper error handling instead of direct indexing that could panic.
+
+5. **Container Image Management**: Documents pre-build strategy for custom Docker images (Next.js, Leptos) to avoid "image not found" errors.
+
+6. **WASM Binary Path**: Uses environment variable `WASM_BINARY_PATH` with fallback to relative path for flexibility across environments.
+
+### Error Context Strategy
+
+All fallible operations include:
+- `.change_context()` for error type conversion
+- `.attach_printable()` for diagnostic context (framework ID, scenario name, etc.)
+- This enables precise debugging when tests fail
+
+### Test Isolation
+
+**Current approach**: Tests share port 7676 (Viceroy default)
+- Sequential execution required: use `#[serial]` attribute or single-threaded test runner
+- Future enhancement: Dynamic port allocation per test
+
+### Container Lifecycle
+
+- Containers start with 60s timeout to prevent indefinite hangs
+- Health checks poll for 3 seconds before giving up
+- `Drop` implementations ensure cleanup even on panic
+- Verify cleanup in CI logs (no orphaned containers)
+
+## Timeline Estimate (Fastly-Only Initial Implementation)
+
+- **Phase 0** (Health endpoint): 1-2 hours (BLOCKER)
+- **Phase 1** (Core Infrastructure): 4-6 hours (RuntimeEnvironment trait for future extensibility)
+- **Phase 1.5** (Fastly Runtime): 2-3 hours
+- **Phase 2** (Framework Abstraction): 2-3 hours
+- **Phase 3** (WordPress): 5-7 hours
+- **Phase 4** (Next.js): 3-4 hours
+- **Phase 5** (Docs + CI): 3-4 hours
+
+**Total**: 20-29 hours for complete implementation with 2 frameworks × 1 runtime
+
+**Future frameworks**: 1-2 hours each (automatically tested on Fastly, and future runtimes when added)
+**Future runtimes**: 2-3 hours each (automatically tests all existing frameworks)
+
+## Future Enhancements
+
+### Platform Support: Cloudflare Workers (2-3 hours)
+
+When ready to add Cloudflare Workers support:
+
+**Step 1**: Create Cloudflare runtime implementation
+```rust
+// tests/environments/cloudflare.rs
+use super::*;
+use std::process::{Child, Command};
+
+pub struct CloudflareWrangler;
+
+impl RuntimeEnvironment for CloudflareWrangler {
+    fn id(&self) -> &'static str { "cloudflare" }
+
+    fn spawn(&self, config: &RuntimeConfig) -> Result<RuntimeProcess, TestError> {
+        let port = find_available_port()?;
+
+        let mut child = Command::new("wrangler")
+            .arg("dev")
+            .arg(&config.wasm_path)
+            .arg("--port")
+            .arg(port.to_string())
+            .arg("--local")
+            .env("WASM_BINARY_PATH", &config.wasm_path)
+            .spawn()
+            .change_context(TestError::RuntimeSpawn)?;
+
+        let base_url = format!("http://127.0.0.1:{}", port);
+        wait_for_ready(&base_url, self.health_check_path())?;
+
+        Ok(RuntimeProcess {
+            inner: Box::new(WranglerHandle { child }),
+            base_url,
+        })
+    }
+
+    fn config_template(&self) -> &str {
+        include_str!("../../fixtures/configs/cloudflare-template.toml")
+    }
+
+    fn health_check_path(&self) -> &str {
+        "/"  // Cloudflare may use different path
+    }
+}
+
+struct WranglerHandle {
+    child: Child,
+}
+
+impl RuntimeProcessHandle for WranglerHandle {
+    fn kill(&mut self) -> Result<(), TestError> {
+        self.child.kill().change_context(TestError::RuntimeKill)?;
+        Ok(())
+    }
+
+    fn wait(&mut self) -> Result<(), TestError> {
+        self.child.wait().change_context(TestError::RuntimeWait)?;
+        Ok(())
+    }
+}
+```
+
+**Step 2**: Create config template
+```toml
+# fixtures/configs/cloudflare-template.toml
+name = "trusted-server-test"
+main = "{{WASM_PATH}}"
+compatibility_date = "2024-01-01"
+
+[vars]
+PUBLISHER_ORIGIN_URL = "{{ORIGIN_URL}}"
+```
+
+**Step 3**: Register in runtime registry
+```rust
+// tests/environments/mod.rs
+mod cloudflare;
+
+pub static RUNTIME_ENVIRONMENTS: &[RuntimeFactory] = &[
+    || Box::new(fastly::FastlyViceroy),
+    || Box::new(cloudflare::CloudflareWrangler),  // <- Add here
+];
+```
+
+**Step 4**: Add test combinations
+```rust
+// tests/integration.rs
+#[test]
+fn test_wordpress_cloudflare() {
+    let runtime = environments::cloudflare::CloudflareWrangler;
+    let framework = frameworks::wordpress::WordPress;
+    test_combination(&runtime, &framework)
+        .expect("WordPress on Cloudflare should work");
+}
+
+#[test]
+fn test_nextjs_cloudflare() {
+    let runtime = environments::cloudflare::CloudflareWrangler;
+    let framework = frameworks::nextjs::NextJs;
+    test_combination(&runtime, &framework)
+        .expect("Next.js on Cloudflare should work");
+}
+```
+
+**Done!** All existing frameworks (WordPress, Next.js) now automatically test against both Fastly AND Cloudflare.
+
+**Benefits**:
+- Validate migration from Fastly → Cloudflare before production
+- Catch platform-specific bugs early
+- Compare performance across platforms
+- Zero changes to framework implementations
+
+---
+
+### Phase 6: Advanced Features (Post-MVP)
+
+**1. Dynamic Port Allocation**
+- Eliminate shared port 7676 constraint
+- Enable parallel test execution
+- Use `TcpListener::bind("127.0.0.1:0")` to find available ports
+- Pass port to Viceroy via command-line argument (if supported)
+
+**2. Test Isolation with `serial_test` Crate**
+```rust
+use serial_test::serial;
+
+#[test]
+#[serial]
+fn test_wordpress_only() { ... }
+```
+
+**3. Stress Testing**
+```rust
+#[test]
+#[ignore]  // Run with --ignored flag
+fn test_frameworks_stress() {
+    for _ in 0..10 {
+        test_all_frameworks();
+    }
+}
+```
+
+**4. Cleanup Verification Tests**
+```rust
+#[test]
+fn verify_no_orphaned_containers() {
+    let before = count_docker_containers();
+    test_all_frameworks();
+    let after = count_docker_containers();
+    assert_eq!(before, after, "containers not cleaned up");
+}
+```
+
+**5. Multi-Container Orchestration**
+- Use docker-compose for complex setups (e.g., WordPress + MySQL)
+- Support testing against databases, message queues, etc.
+
+**6. Framework Discovery via `inventory` Crate**
+```rust
+use inventory;
+
+inventory::collect!(FrameworkRegistration);
+
+// Frameworks self-register, no manual registry updates needed
+```
+
+**7. Scenario Builder Pattern**
+```rust
+ScriptServingScenario::builder()
+    .modules(vec!["core", "prebid"])
+    .expect_globals(vec!["window.tsjs"])
+    .build()
+```
+
+**8. Performance Benchmarking**
+- Track test execution time per framework
+- Alert on regressions (e.g., >20% slower)
+- CI job outputs performance metrics
+
+**9. Matrix Testing in CI**
+```yaml
+strategy:
+  matrix:
+    framework: [wordpress, nextjs, leptos]
+steps:
+  - run: cargo test -p integration-tests -- ${{ matrix.framework }}
+```
+
+**10. Remote Debugging Support**
+- Keep Viceroy running after test failure
+- Expose debug endpoint for manual inspection
+- Capture network traffic for analysis
diff --git a/crates/fastly/src/main.rs b/crates/fastly/src/main.rs
index 77b37649..19e9eb8a 100644
--- a/crates/fastly/src/main.rs
+++ b/crates/fastly/src/main.rs
@@ -80,6 +80,9 @@ async fn route_request(
 
     // Match known routes and handle them
     let result = match (method, path.as_str()) {
+        // Health check endpoint for integration tests and monitoring
+        (Method::GET, "/health") => Ok(Response::from_status(200).with_body_text_plain("ok")),
+
         // Serve the tsjs library
         (Method::GET, path) if path.starts_with("/static/tsjs=") => {
             handle_tsjs_dynamic(&req, integration_registry)
diff --git a/crates/integration-tests/Cargo.toml b/crates/integration-tests/Cargo.toml
new file mode 100644
index 00000000..9f65f9e6
--- /dev/null
+++ b/crates/integration-tests/Cargo.toml
@@ -0,0 +1,22 @@
+[package]
+name = "integration-tests"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[[test]]
+name = "integration"
+path = "tests/integration.rs"
+harness = true
+
+[dev-dependencies]
+testcontainers = "0.25"
+reqwest = { version = "0.12", features = ["blocking"] }
+scraper = "0.21"
+tempfile = "3.0"
+toml = "0.8"
+serde = { version = "1.0", features = ["derive"] }
+log = "0.4"
+error-stack = "0.5"
+derive_more = { version = "1.0", features = ["display"] }
+tokio = { version = "1.0", features = ["time", "rt"] }
diff --git a/crates/integration-tests/tests/common/assertions.rs b/crates/integration-tests/tests/common/assertions.rs
new file mode 100644
index 00000000..bc943a18
--- /dev/null
+++ b/crates/integration-tests/tests/common/assertions.rs
@@ -0,0 +1,276 @@
+use super::runtime::TestError;
+use error_stack::{Result, ResultExt};
+use scraper::{Html, Selector};
+
+/// Assert that HTML contains script tag with expected tsjs module reference
+///
+/// # Errors
+///
+/// Returns [`TestError::ScriptTagNotFound`] if no matching script tag exists
+/// Returns [`TestError::MissingModule`] if expected module ID is not found
+pub fn assert_script_tag_present(html: &str, expected_modules: &[&str]) -> Result<(), TestError> {
+    let document = Html::parse_document(html);
+
+    // Find script tags with src attribute containing /static/tsjs=
+    let selector = Selector::parse("script[src*='/static/tsjs=']")
+        .change_context(TestError::InvalidSelector)?;
+
+    let mut found_script = false;
+
+    for element in document.select(&selector) {
+        if let Some(src) = element.value().attr("src") {
+            found_script = true;
+
+            // Extract module IDs from URL query parameter
+            // Expected format: /static/tsjs=core,prebid,lockr
+            if let Some(query_part) = src.split("tsjs=").nth(1) {
+                let modules: Vec<&str> = query_part.split(',').collect();
+
+                // Verify all expected modules are present
+                for expected in expected_modules {
+                    if !modules.contains(expected) {
+                        return Err(error_stack::report!(TestError::MissingModule {
+                            module: (*expected).to_string()
+                        }));
+                    }
+                }
+
+                return Ok(());
+            }
+        }
+    }
+
+    if !found_script {
+        return Err(error_stack::report!(TestError::ScriptTagNotFound));
+    }
+
+    Ok(())
+}
+
+/// Assert that HTML attributes are rewritten with expected prefix
+///
+/// Verifies that the trusted-server correctly rewrites attributes like href, src, srcset
+/// to use the first-party proxy endpoint.
+///
+/// # Arguments
+///
+/// * `html` - HTML content to parse
+/// * `selector` - CSS selector to find target elements (e.g., "a[href]", "img[src]")
+/// * `attr_name` - Attribute name to check (e.g., "href", "src", "srcset")
+/// * `expected_prefix` - Expected URL prefix after rewriting (e.g., "/first-party/proxy?url=")
+///
+/// # Errors
+///
+/// Returns [`TestError::InvalidSelector`] if CSS selector is malformed
+/// Returns [`TestError::ElementNotFound`] if no matching elements exist
+/// Returns [`TestError::AttributeNotRewritten`] if attribute doesn't have expected prefix
+pub fn assert_attribute_rewritten(
+    html: &str,
+    selector: &str,
+    attr_name: &str,
+    expected_prefix: &str,
+) -> Result<(), TestError> {
+    let document = Html::parse_document(html);
+
+    let parsed_selector =
+        Selector::parse(selector).change_context(TestError::InvalidSelector)?;
+
+    let mut found_element = false;
+
+    for element in document.select(&parsed_selector) {
+        if let Some(attr_value) = element.value().attr(attr_name) {
+            found_element = true;
+
+            if !attr_value.starts_with(expected_prefix) {
+                return Err(error_stack::report!(TestError::AttributeNotRewritten));
+            }
+        }
+    }
+
+    if !found_element {
+        return Err(error_stack::report!(TestError::ElementNotFound));
+    }
+
+    Ok(())
+}
+
+/// Assert that HTTP response contains GDPR consent signal
+///
+/// Verifies that the trusted-server correctly propagates GDPR consent signals
+/// in response headers or body.
+///
+/// # Errors
+///
+/// Returns [`TestError::GdprSignalMissing`] if no GDPR signal is found
+pub fn assert_gdpr_signal(response: &reqwest::blocking::Response) -> Result<(), TestError> {
+    // Check for GDPR signal in headers
+    // The trusted-server sets X-GDPR-Consent header when GDPR applies
+    if response.headers().contains_key("X-GDPR-Consent") {
+        return Ok(());
+    }
+
+    // Alternative: Check for GDPR signal in response body
+    // Some integrations may embed GDPR state in the injected script
+    if let Ok(body) = response.text() {
+        if body.contains("gdprApplies") || body.contains("gdpr_consent") {
+            return Ok(());
+        }
+    }
+
+    Err(error_stack::report!(TestError::GdprSignalMissing))
+}
+
+/// Assert that HTML contains expected number of elements matching selector
+///
+/// # Errors
+///
+/// Returns [`TestError::InvalidSelector`] if CSS selector is malformed
+pub fn assert_element_count(
+    html: &str,
+    selector: &str,
+    expected_count: usize,
+) -> Result<(), TestError> {
+    let document = Html::parse_document(html);
+
+    let parsed_selector =
+        Selector::parse(selector).change_context(TestError::InvalidSelector)?;
+
+    let actual_count = document.select(&parsed_selector).count();
+
+    if actual_count != expected_count {
+        return Err(error_stack::report!(TestError::ElementNotFound).attach_printable(
+            format!(
+                "Expected {} elements matching '{}', found {}",
+                expected_count, selector, actual_count
+            ),
+        ));
+    }
+
+    Ok(())
+}
+
+/// Assert that script tag is injected at the start of `<head>`
+///
+/// This verifies the HTML processor correctly positions the script tag
+/// to ensure early execution before other scripts.
+///
+/// # Errors
+///
+/// Returns [`TestError::ScriptTagNotFound`] if script is not at expected position
+pub fn assert_script_position(html: &str) -> Result<(), TestError> {
+    let document = Html::parse_document(html);
+
+    // Find the <head> element
+    let head_selector = Selector::parse("head").change_context(TestError::InvalidSelector)?;
+
+    let head = document
+        .select(&head_selector)
+        .next()
+        .ok_or_else(|| error_stack::report!(TestError::ElementNotFound))?;
+
+    // Get first child of <head>
+    let first_child = head
+        .first_child()
+        .ok_or_else(|| error_stack::report!(TestError::ElementNotFound))?;
+
+    // Verify first child is our injected script tag
+    if let Some(element) = first_child.value().as_element() {
+        if element.name() == "script" {
+            if let Some(src) = element.attr("src") {
+                if src.contains("/static/tsjs=") {
+                    return Ok(());
+                }
+            }
+        }
+    }
+
+    Err(error_stack::report!(TestError::ScriptTagNotFound).attach_printable(
+        "Script tag not found at start of <head>",
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_assert_script_tag_present_success() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <head>
+                <script src="/static/tsjs=core,prebid,lockr"></script>
+            </head>
+            <body></body>
+            </html>
+        "#;
+
+        assert_script_tag_present(html, &["core", "prebid"])
+            .expect("should find script tag with expected modules");
+    }
+
+    #[test]
+    fn test_assert_script_tag_present_missing_module() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <head>
+                <script src="/static/tsjs=core,prebid"></script>
+            </head>
+            <body></body>
+            </html>
+        "#;
+
+        let result = assert_script_tag_present(html, &["core", "lockr"]);
+        assert!(
+            result.is_err(),
+            "should fail when expected module is missing"
+        );
+    }
+
+    #[test]
+    fn test_assert_attribute_rewritten_success() {
+        let html = r#"
+            <a href="/first-party/proxy?url=https://example.com">Link</a>
+        "#;
+
+        assert_attribute_rewritten(html, "a[href]", "href", "/first-party/proxy?url=")
+            .expect("should find rewritten attribute");
+    }
+
+    #[test]
+    fn test_assert_attribute_rewritten_not_rewritten() {
+        let html = r#"
+            <a href="https://example.com">Link</a>
+        "#;
+
+        let result = assert_attribute_rewritten(html, "a[href]", "href", "/first-party/proxy?url=");
+        assert!(result.is_err(), "should fail when attribute not rewritten");
+    }
+
+    #[test]
+    fn test_assert_element_count_success() {
+        let html = r#"
+            <div>
+                <p>First</p>
+                <p>Second</p>
+                <p>Third</p>
+            </div>
+        "#;
+
+        assert_element_count(html, "p", 3).expect("should count elements correctly");
+    }
+
+    #[test]
+    fn test_assert_element_count_mismatch() {
+        let html = r#"
+            <div>
+                <p>First</p>
+                <p>Second</p>
+            </div>
+        "#;
+
+        let result = assert_element_count(html, "p", 3);
+        assert!(result.is_err(), "should fail when count doesn't match");
+    }
+}
diff --git a/crates/integration-tests/tests/common/config.rs b/crates/integration-tests/tests/common/config.rs
new file mode 100644
index 00000000..6bf21177
--- /dev/null
+++ b/crates/integration-tests/tests/common/config.rs
@@ -0,0 +1,91 @@
+use super::runtime::TestError;
+use error_stack::{Result, ResultExt};
+use std::io::Write;
+use std::path::PathBuf;
+use tempfile::NamedTempFile;
+
+/// Builder for runtime configuration
+pub struct RuntimeConfigBuilder {
+    template: String,
+    origin_url: Option<String>,
+    integrations: Vec<String>,
+    wasm_path: Option<PathBuf>,
+}
+
+impl RuntimeConfigBuilder {
+    pub fn new(template: &str) -> Self {
+        Self {
+            template: template.to_string(),
+            origin_url: None,
+            integrations: Vec::new(),
+            wasm_path: None,
+        }
+    }
+
+    pub fn with_origin_url(mut self, url: String) -> Self {
+        self.origin_url = Some(url);
+        self
+    }
+
+    pub fn with_integrations(mut self, ids: Vec<&str>) -> Self {
+        self.integrations = ids.iter().map(|s| s.to_string()).collect();
+        self
+    }
+
+    pub fn with_wasm_path(mut self, path: PathBuf) -> Self {
+        self.wasm_path = Some(path);
+        self
+    }
+
+    pub fn build(self) -> Result<super::RuntimeConfig, TestError> {
+        // Parse template as TOML
+        let mut config: toml::Value = toml::from_str(&self.template)
+            .change_context(TestError::ConfigParse)?;
+
+        // Set origin_url if provided
+        if let Some(origin_url) = self.origin_url {
+            if let Some(publisher) = config.get_mut("publisher") {
+                if let Some(publisher_table) = publisher.as_table_mut() {
+                    publisher_table.insert(
+                        "origin_url".to_string(),
+                        toml::Value::String(origin_url),
+                    );
+                }
+            }
+        }
+
+        // Enable integrations if provided
+        if !self.integrations.is_empty() {
+            if let Some(integrations_config) = config
+                .get_mut("integrations")
+                .and_then(|v| v.get_mut("config"))
+                .and_then(|v| v.as_table_mut())
+            {
+                for integration_id in &self.integrations {
+                    if let Some(integration_entry) = integrations_config.get_mut(integration_id) {
+                        if let Some(table) = integration_entry.as_table_mut() {
+                            table.insert("enabled".to_string(), toml::Value::Boolean(true));
+                        }
+                    }
+                }
+            }
+        }
+
+        // Write to temp file
+        let mut file = NamedTempFile::new().change_context(TestError::ConfigWrite)?;
+        let content =
+            toml::to_string_pretty(&config).change_context(TestError::ConfigSerialize)?;
+        file.write_all(content.as_bytes())
+            .change_context(TestError::ConfigWrite)?;
+
+        let config_path = file.into_temp_path().to_path_buf();
+        let wasm_path = self
+            .wasm_path
+            .unwrap_or_else(super::runtime::wasm_binary_path);
+
+        Ok(super::RuntimeConfig {
+            config_path,
+            wasm_path,
+        })
+    }
+}
diff --git a/crates/integration-tests/tests/common/mod.rs b/crates/integration-tests/tests/common/mod.rs
new file mode 100644
index 00000000..af63a198
--- /dev/null
+++ b/crates/integration-tests/tests/common/mod.rs
@@ -0,0 +1,7 @@
+pub mod assertions;
+pub mod config;
+pub mod runtime;
+
+pub use assertions::*;
+pub use config::*;
+pub use runtime::*;
diff --git a/crates/integration-tests/tests/common/runtime.rs b/crates/integration-tests/tests/common/runtime.rs
new file mode 100644
index 00000000..8321081b
--- /dev/null
+++ b/crates/integration-tests/tests/common/runtime.rs
@@ -0,0 +1,122 @@
+use error_stack::{Result, ResultExt};
+use std::collections::HashMap;
+use std::path::PathBuf;
+
+/// Test error types (platform-agnostic)
+#[derive(Debug, derive_more::Display)]
+pub enum TestError {
+    // Runtime environment errors
+    #[display("Failed to spawn runtime process")]
+    RuntimeSpawn,
+
+    #[display("Runtime not ready after timeout")]
+    RuntimeNotReady,
+
+    #[display("Failed to kill runtime process")]
+    RuntimeKill,
+
+    #[display("Failed to wait for runtime process")]
+    RuntimeWait,
+
+    // Container errors
+    #[display("Container failed to start: {reason}")]
+    ContainerStart { reason: String },
+
+    #[display("Container operation timed out")]
+    ContainerTimeout,
+
+    // HTTP errors
+    #[display("HTTP request failed")]
+    HttpRequest,
+
+    #[display("Failed to parse response")]
+    ResponseParse,
+
+    // Assertion errors
+    #[display("Script tag not found in HTML")]
+    ScriptTagNotFound,
+
+    #[display("Missing module: {module}")]
+    MissingModule { module: String },
+
+    #[display("Invalid CSS selector")]
+    InvalidSelector,
+
+    #[display("Element not found")]
+    ElementNotFound,
+
+    #[display("Attribute not rewritten")]
+    AttributeNotRewritten,
+
+    #[display("GDPR signal missing from response")]
+    GdprSignalMissing,
+
+    // Configuration errors
+    #[display("Config parse error")]
+    ConfigParse,
+
+    #[display("Config write error")]
+    ConfigWrite,
+
+    #[display("Config serialization error")]
+    ConfigSerialize,
+
+    // Resource errors
+    #[display("WASM binary not found")]
+    WasmBinaryNotFound,
+
+    #[display("No available port found")]
+    NoPortAvailable,
+}
+
+impl core::error::Error for TestError {}
+
+/// Configuration for runtime environments
+pub struct RuntimeConfig {
+    pub config_path: PathBuf,
+    pub wasm_path: PathBuf,
+}
+
+/// Platform-agnostic process handle
+pub struct RuntimeProcess {
+    pub inner: Box<dyn RuntimeProcessHandle>,
+    pub base_url: String,
+}
+
+/// Trait for runtime process lifecycle management
+pub trait RuntimeProcessHandle: Send + Sync {
+    fn kill(&mut self) -> Result<(), TestError>;
+    fn wait(&mut self) -> Result<(), TestError>;
+}
+
+/// Trait defining how to run the trusted-server on different platforms
+pub trait RuntimeEnvironment: Send + Sync {
+    /// Platform identifier (e.g., "fastly", "cloudflare")
+    fn id(&self) -> &'static str;
+
+    /// Spawn runtime with platform-specific configuration
+    fn spawn(&self, config: &RuntimeConfig) -> Result<RuntimeProcess, TestError>;
+
+    /// Platform-specific configuration template
+    fn config_template(&self) -> &str;
+
+    /// Health check endpoint (may differ by platform)
+    fn health_check_path(&self) -> &str {
+        "/health"
+    }
+
+    /// Platform-specific environment variables
+    fn env_vars(&self) -> HashMap<String, String> {
+        HashMap::new()
+    }
+}
+
+/// Get path to WASM binary, respecting environment variable
+pub fn wasm_binary_path() -> PathBuf {
+    std::env::var("WASM_BINARY_PATH")
+        .map(PathBuf::from)
+        .unwrap_or_else(|_| {
+            PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+                .join("../../target/wasm32-wasip1/release/trusted-server-fastly.wasm")
+        })
+}

From 2d2600ea2714faecdef75a7ebd52dc730a85457b Mon Sep 17 00:00:00 2001
From: prk-Jr <prakashsagwara@gmail.com>
Date: Thu, 5 Mar 2026 19:35:05 +0530
Subject: [PATCH 02/15] Feature integration test with TestContainers

---
 .github/workflows/integration-tests.yml       |  68 ++++++
 INTEGRATION_TESTS_PLAN.md                     | 138 +++++------
 crates/integration-tests/.dockerignore        |   6 +
 crates/integration-tests/Cargo.toml           |   2 +-
 .../fixtures/configs/fastly-template.toml     |  97 ++++++++
 .../fixtures/configs/viceroy-template.toml    |  38 +++
 .../fixtures/frameworks/nextjs/Dockerfile     |  37 +++
 .../fixtures/frameworks/nextjs/app/layout.tsx |  17 ++
 .../fixtures/frameworks/nextjs/app/page.tsx   |  20 ++
 .../frameworks/nextjs/next.config.mjs         |   6 +
 .../fixtures/frameworks/nextjs/package.json   |  15 ++
 .../fixtures/frameworks/wordpress/Dockerfile  |  22 ++
 .../frameworks/wordpress/theme/index.php      |  41 ++++
 .../wordpress/theme/wp-admin/index.php        |  13 +
 .../tests/common/assertions.rs                | 183 +++++++-------
 .../integration-tests/tests/common/config.rs  |  29 +--
 .../integration-tests/tests/common/runtime.rs |  34 ++-
 .../tests/environments/fastly.rs              | 103 ++++++++
 .../tests/environments/mod.rs                 |  74 ++++++
 .../integration-tests/tests/frameworks/mod.rs |  64 +++++
 .../tests/frameworks/nextjs.rs                |  52 ++++
 .../tests/frameworks/scenarios.rs             | 228 ++++++++++++++++++
 .../tests/frameworks/wordpress.rs             |  50 ++++
 crates/integration-tests/tests/integration.rs | 143 +++++++++++
 24 files changed, 1294 insertions(+), 186 deletions(-)
 create mode 100644 .github/workflows/integration-tests.yml
 create mode 100644 crates/integration-tests/.dockerignore
 create mode 100644 crates/integration-tests/fixtures/configs/fastly-template.toml
 create mode 100644 crates/integration-tests/fixtures/configs/viceroy-template.toml
 create mode 100644 crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile
 create mode 100644 crates/integration-tests/fixtures/frameworks/nextjs/app/layout.tsx
 create mode 100644 crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx
 create mode 100644 crates/integration-tests/fixtures/frameworks/nextjs/next.config.mjs
 create mode 100644 crates/integration-tests/fixtures/frameworks/nextjs/package.json
 create mode 100644 crates/integration-tests/fixtures/frameworks/wordpress/Dockerfile
 create mode 100644 crates/integration-tests/fixtures/frameworks/wordpress/theme/index.php
 create mode 100644 crates/integration-tests/fixtures/frameworks/wordpress/theme/wp-admin/index.php
 create mode 100644 crates/integration-tests/tests/environments/fastly.rs
 create mode 100644 crates/integration-tests/tests/environments/mod.rs
 create mode 100644 crates/integration-tests/tests/frameworks/mod.rs
 create mode 100644 crates/integration-tests/tests/frameworks/nextjs.rs
 create mode 100644 crates/integration-tests/tests/frameworks/scenarios.rs
 create mode 100644 crates/integration-tests/tests/frameworks/wordpress.rs
 create mode 100644 crates/integration-tests/tests/integration.rs

diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
new file mode 100644
index 00000000..67ec68af
--- /dev/null
+++ b/.github/workflows/integration-tests.yml
@@ -0,0 +1,68 @@
+name: "Integration Tests"
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+    paths:
+      - "crates/integration-tests/**"
+      - "crates/common/**"
+      - "crates/fastly/**"
+      - ".github/workflows/integration-tests.yml"
+
+jobs:
+  integration-tests:
+    name: integration tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Retrieve Rust version
+        id: rust-version
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        shell: bash
+
+      - name: Set up Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: ${{ steps.rust-version.outputs.rust-version }}
+          target: wasm32-wasip1
+          cache-shared-key: cargo-${{ runner.os }}
+
+      - name: Get Viceroy cache key
+        id: viceroy-rev
+        run: echo "sha=$(git ls-remote https://github.com/fastly/Viceroy HEAD | cut -f1)" >> $GITHUB_OUTPUT
+
+      - name: Cache Viceroy binary
+        id: cache-viceroy
+        uses: actions/cache@v4
+        with:
+          path: ~/.cargo/bin/viceroy
+          key: viceroy-${{ runner.os }}-${{ steps.viceroy-rev.outputs.sha }}
+
+      - name: Install Viceroy
+        if: steps.cache-viceroy.outputs.cache-hit != 'true'
+        run: cargo install --git https://github.com/fastly/Viceroy viceroy
+
+      - name: Build WASM binary
+        run: cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
+
+      - name: Build WordPress test container
+        run: |
+          docker build -t test-wordpress:latest \
+            crates/integration-tests/fixtures/frameworks/wordpress/
+
+      - name: Build Next.js test container
+        run: |
+          docker build -t test-nextjs:latest \
+            crates/integration-tests/fixtures/frameworks/nextjs/
+
+      - name: Run integration tests
+        run: cargo test -p integration-tests --target x86_64-unknown-linux-gnu
+        env:
+          WASM_BINARY_PATH: target/wasm32-wasip1/release/trusted-server-fastly.wasm
+          RUST_LOG: info
diff --git a/INTEGRATION_TESTS_PLAN.md b/INTEGRATION_TESTS_PLAN.md
index b7153c33..4a98fa41 100644
--- a/INTEGRATION_TESTS_PLAN.md
+++ b/INTEGRATION_TESTS_PLAN.md
@@ -76,77 +76,73 @@ Track progress for each phase using this checklist:
 - [x] Start Viceroy manually to test health endpoint
 - [x] Verify `curl http://127.0.0.1:7676/health` returns 200 OK
 
-### Phase 1: Core Infrastructure ⏱️ 4-6 hours
-- [ ] Add `integration-tests` to workspace members in root `Cargo.toml`
-- [ ] Create [`crates/integration-tests/Cargo.toml`](crates/integration-tests/Cargo.toml) with dependencies
-- [ ] Create [`tests/common/mod.rs`](crates/integration-tests/tests/common/mod.rs) (re-exports)
-- [ ] Define `RuntimeEnvironment` trait in [`tests/common/runtime.rs`](crates/integration-tests/tests/common/runtime.rs)
-- [ ] Implement `RuntimeConfig` struct with platform-agnostic interface
-- [ ] Create [`tests/common/config.rs`](crates/integration-tests/tests/common/config.rs) for config generation
-- [ ] Implement assertion helpers in [`tests/common/assertions.rs`](crates/integration-tests/tests/common/assertions.rs)
-- [ ] Create [`fixtures/configs/fastly-template.toml`](crates/integration-tests/fixtures/configs/fastly-template.toml)
-- [ ] Verify: `cargo check -p integration-tests` passes
-
-### Phase 1.5: Fastly Runtime Implementation ⏱️ 2-3 hours
-- [ ] Create [`tests/environments/mod.rs`](crates/integration-tests/tests/environments/mod.rs) with `RuntimeEnvironment` trait
-- [ ] Create [`tests/environments/fastly.rs`](crates/integration-tests/tests/environments/fastly.rs)
-- [ ] Implement `FastlyViceroy` struct with `RuntimeEnvironment` trait
-- [ ] Implement `ViceroyHandle` for process lifecycle (spawn, kill, wait)
-- [ ] Implement dynamic port allocation with `find_available_port()`
-- [ ] Implement health check with retry logic (30 attempts × 100ms)
-- [ ] Create `RUNTIME_ENVIRONMENTS` registry with Fastly factory
-- [ ] Verify: `cargo test -p integration-tests --lib` compiles
-
-### Phase 2: Framework Abstraction ⏱️ 2-3 hours
-- [ ] Create [`tests/frameworks/mod.rs`](crates/integration-tests/tests/frameworks/mod.rs) with `FrontendFramework` trait
-- [ ] Create [`tests/frameworks/scenarios.rs`](crates/integration-tests/tests/frameworks/scenarios.rs)
-- [ ] Define `TestScenario` enum (HtmlInjection, ScriptServing, AttributeRewriting, GdprSignal)
-- [ ] Define `CustomScenario` enum (framework-specific scenarios)
-- [ ] Implement scenario runners with error context
-- [ ] Create `FRAMEWORKS` registry (empty initially)
-- [ ] Verify: Trait compiles, registry pattern works
-
-### Phase 3: WordPress Implementation ⏱️ 5-7 hours
-- [ ] Create [`fixtures/frameworks/wordpress/`](crates/integration-tests/fixtures/frameworks/wordpress/) directory
-- [ ] Create [`fixtures/frameworks/wordpress/Dockerfile`](crates/integration-tests/fixtures/frameworks/wordpress/Dockerfile) with SQLite plugin
-- [ ] Create minimal WordPress test theme in [`fixtures/frameworks/wordpress/theme/`](crates/integration-tests/fixtures/frameworks/wordpress/theme/)
-- [ ] Build WordPress Docker image: `docker build -t test-wordpress:latest fixtures/frameworks/wordpress/`
-- [ ] Create [`tests/frameworks/wordpress.rs`](crates/integration-tests/tests/frameworks/wordpress.rs)
-- [ ] Implement `WordPress` struct with `FrontendFramework` trait
-- [ ] Add WordPress to `FRAMEWORKS` registry
-- [ ] Create [`tests/integration.rs`](crates/integration-tests/tests/integration.rs) with `test_combination()` helper
-- [ ] Create `test_wordpress_fastly()` test
-- [ ] Verify: `cargo test -p integration-tests -- test_wordpress_fastly` passes
-
-### Phase 4: Next.js Implementation ⏱️ 3-4 hours
-- [ ] Create [`fixtures/frameworks/nextjs/`](crates/integration-tests/fixtures/frameworks/nextjs/) directory
-- [ ] Create [`fixtures/frameworks/nextjs/package.json`](crates/integration-tests/fixtures/frameworks/nextjs/package.json)
-- [ ] Create [`fixtures/frameworks/nextjs/next.config.mjs`](crates/integration-tests/fixtures/frameworks/nextjs/next.config.mjs)
-- [ ] Create [`fixtures/frameworks/nextjs/app/page.tsx`](crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx) with test content
-- [ ] Create [`fixtures/frameworks/nextjs/Dockerfile`](crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile)
-- [ ] Build Next.js Docker image: `docker build -t test-nextjs:latest fixtures/frameworks/nextjs/`
-- [ ] Create [`tests/frameworks/nextjs.rs`](crates/integration-tests/tests/frameworks/nextjs.rs)
-- [ ] Implement `NextJs` struct with RSC-specific scenarios
-- [ ] Add Next.js to `FRAMEWORKS` registry
-- [ ] Create `test_nextjs_fastly()` test
-- [ ] Create `test_all_frameworks()` test (iterates `FRAMEWORKS` registry)
-- [ ] Verify: `cargo test -p integration-tests` passes for all tests
-
-### Phase 5: Documentation and CI ⏱️ 3-4 hours
-- [ ] Create comprehensive [`crates/integration-tests/README.md`](crates/integration-tests/README.md)
-  - [ ] Prerequisites section (Docker, Rust, Viceroy)
-  - [ ] Running tests locally guide
-  - [ ] How to add a new framework guide
-  - [ ] How to add a new runtime guide (for future)
-  - [ ] Troubleshooting section
-- [ ] Create [`.github/workflows/integration-tests.yml`](.github/workflows/integration-tests.yml)
-  - [ ] Build WASM binary step
-  - [ ] Build Docker images (WordPress, Next.js)
-  - [ ] Install Viceroy
-  - [ ] Run integration tests with WASM_BINARY_PATH env var
-- [ ] Create [`crates/integration-tests/.dockerignore`](crates/integration-tests/.dockerignore)
-- [ ] Update root [`Cargo.toml`](Cargo.toml) workspace members
-- [ ] Test CI locally with `act` or similar
+### Phase 1: Core Infrastructure ⏱️ 4-6 hours ✅ COMPLETE
+- [x] Add `integration-tests` to workspace members in root `Cargo.toml`
+- [x] Create [`crates/integration-tests/Cargo.toml`](crates/integration-tests/Cargo.toml) with dependencies
+- [x] Create [`tests/common/mod.rs`](crates/integration-tests/tests/common/mod.rs) (re-exports)
+- [x] Define `RuntimeEnvironment` trait in [`tests/common/runtime.rs`](crates/integration-tests/tests/common/runtime.rs)
+- [x] Implement `RuntimeConfig` struct with platform-agnostic interface
+- [x] Create [`tests/common/config.rs`](crates/integration-tests/tests/common/config.rs) for config generation
+- [x] Implement assertion helpers in [`tests/common/assertions.rs`](crates/integration-tests/tests/common/assertions.rs)
+- [x] Create [`fixtures/configs/fastly-template.toml`](crates/integration-tests/fixtures/configs/fastly-template.toml)
+- [x] Create [`fixtures/configs/viceroy-template.toml`](crates/integration-tests/fixtures/configs/viceroy-template.toml)
+- [x] Verify: `cargo check -p integration-tests` passes
+- [x] Verify: 9/9 assertion unit tests pass
+
+### Phase 1.5: Fastly Runtime Implementation ⏱️ 2-3 hours ✅ COMPLETE
+- [x] Create [`tests/environments/mod.rs`](crates/integration-tests/tests/environments/mod.rs) with `RuntimeEnvironment` trait
+- [x] Create [`tests/environments/fastly.rs`](crates/integration-tests/tests/environments/fastly.rs)
+- [x] Implement `FastlyViceroy` struct with `RuntimeEnvironment` trait
+- [x] Implement `ViceroyHandle` for process lifecycle (spawn, kill, wait, Drop)
+- [x] Implement dynamic port allocation with `find_available_port()`
+- [x] Implement health check with retry logic (30 attempts × 100ms)
+- [x] Create `RUNTIME_ENVIRONMENTS` registry with Fastly factory
+- [x] Verify: test binary compiles for native target
+
+### Phase 2: Framework Abstraction ⏱️ 2-3 hours ✅ COMPLETE
+- [x] Create [`tests/frameworks/mod.rs`](crates/integration-tests/tests/frameworks/mod.rs) with `FrontendFramework` trait
+- [x] Create [`tests/frameworks/scenarios.rs`](crates/integration-tests/tests/frameworks/scenarios.rs)
+- [x] Define `TestScenario` enum (HtmlInjection, ScriptServing, AttributeRewriting, GdprSignal)
+- [x] Define `CustomScenario` enum (WordPressAdminInjection, NextJsRscFlight, NextJsServerActions)
+- [x] Implement scenario runners with error context
+- [x] Create `FRAMEWORKS` registry with WordPress and Next.js factories
+- [x] Verify: Trait compiles, registry pattern works
+
+### Phase 3: WordPress Implementation ⏱️ 5-7 hours ✅ COMPLETE
+- [x] Create [`fixtures/frameworks/wordpress/`](crates/integration-tests/fixtures/frameworks/wordpress/) directory
+- [x] Create [`fixtures/frameworks/wordpress/Dockerfile`](crates/integration-tests/fixtures/frameworks/wordpress/Dockerfile) (PHP CLI with test theme)
+- [x] Create minimal WordPress test theme in [`fixtures/frameworks/wordpress/theme/`](crates/integration-tests/fixtures/frameworks/wordpress/theme/)
+- [x] Create wp-admin test page for admin injection scenario
+- [x] Create [`tests/frameworks/wordpress.rs`](crates/integration-tests/tests/frameworks/wordpress.rs)
+- [x] Implement `WordPress` struct with `FrontendFramework` trait
+- [x] Add WordPress to `FRAMEWORKS` registry
+- [x] Create [`tests/integration.rs`](crates/integration-tests/tests/integration.rs) with `test_combination()` helper
+- [x] Create `test_wordpress_fastly()` test
+- [ ] Verify: `cargo test -p integration-tests -- test_wordpress_fastly` passes (requires Docker)
+
+### Phase 4: Next.js Implementation ⏱️ 3-4 hours ✅ COMPLETE
+- [x] Create [`fixtures/frameworks/nextjs/`](crates/integration-tests/fixtures/frameworks/nextjs/) directory
+- [x] Create [`fixtures/frameworks/nextjs/package.json`](crates/integration-tests/fixtures/frameworks/nextjs/package.json)
+- [x] Create [`fixtures/frameworks/nextjs/next.config.mjs`](crates/integration-tests/fixtures/frameworks/nextjs/next.config.mjs) (standalone output)
+- [x] Create [`fixtures/frameworks/nextjs/app/layout.tsx`](crates/integration-tests/fixtures/frameworks/nextjs/app/layout.tsx)
+- [x] Create [`fixtures/frameworks/nextjs/app/page.tsx`](crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx) with ad slot test content
+- [x] Create [`fixtures/frameworks/nextjs/Dockerfile`](crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile) (multi-stage build)
+- [x] Create [`tests/frameworks/nextjs.rs`](crates/integration-tests/tests/frameworks/nextjs.rs)
+- [x] Implement `NextJs` struct with RSC-specific scenarios
+- [x] Add Next.js to `FRAMEWORKS` registry
+- [x] Create `test_nextjs_fastly()` test
+- [x] Create `test_all_combinations()` matrix test
+- [ ] Verify: `cargo test -p integration-tests` passes for all tests (requires Docker)
+
+### Phase 5: Documentation and CI ⏱️ 3-4 hours ✅ COMPLETE
+- [x] Create [`.github/workflows/integration-tests.yml`](.github/workflows/integration-tests.yml)
+  - [x] Build WASM binary step
+  - [x] Build Docker images (WordPress, Next.js)
+  - [x] Install Viceroy (with caching)
+  - [x] Run integration tests with WASM_BINARY_PATH env var
+- [x] Create [`crates/integration-tests/.dockerignore`](crates/integration-tests/.dockerignore)
+- [x] Update root [`Cargo.toml`](Cargo.toml) workspace members
+- [ ] Test CI on PR branch
 - [ ] Verify: CI passes on test branch
 
 ### Success Criteria
diff --git a/crates/integration-tests/.dockerignore b/crates/integration-tests/.dockerignore
new file mode 100644
index 00000000..1004a143
--- /dev/null
+++ b/crates/integration-tests/.dockerignore
@@ -0,0 +1,6 @@
+target/
+*.rs
+Cargo.toml
+Cargo.lock
+tests/
+README.md
diff --git a/crates/integration-tests/Cargo.toml b/crates/integration-tests/Cargo.toml
index 9f65f9e6..224d854c 100644
--- a/crates/integration-tests/Cargo.toml
+++ b/crates/integration-tests/Cargo.toml
@@ -10,7 +10,7 @@ path = "tests/integration.rs"
 harness = true
 
 [dev-dependencies]
-testcontainers = "0.25"
+testcontainers = { version = "0.25", features = ["blocking"] }
 reqwest = { version = "0.12", features = ["blocking"] }
 scraper = "0.21"
 tempfile = "3.0"
diff --git a/crates/integration-tests/fixtures/configs/fastly-template.toml b/crates/integration-tests/fixtures/configs/fastly-template.toml
new file mode 100644
index 00000000..9e377a74
--- /dev/null
+++ b/crates/integration-tests/fixtures/configs/fastly-template.toml
@@ -0,0 +1,97 @@
+# Fastly Compute configuration template for integration tests.
+# The test harness mutates `publisher.origin_url` and integration toggles
+# at runtime via RuntimeConfigBuilder.
+
+[[handlers]]
+path = "^/secure"
+username = "user"
+password = "pass"
+
+[publisher]
+domain = "test-publisher.com"
+cookie_domain = ".test-publisher.com"
+origin_url = "PLACEHOLDER"
+proxy_secret = "integration-test-proxy-secret"
+
+[synthetic]
+counter_store = "counter_store"
+opid_store = "opid_store"
+secret_key = "integration-test-secret"
+template = "{{ client_ip }}:{{ user_agent }}:{{ accept_language }}:{{ accept_encoding }}"
+
+[request_signing]
+enabled = false
+config_store_id = "unused"
+secret_store_id = "unused"
+
+[integrations.prebid]
+enabled = false
+server_url = "http://127.0.0.1:9999"
+timeout_ms = 1000
+bidders = ["appnexus"]
+debug = false
+
+[integrations.nextjs]
+enabled = false
+rewrite_attributes = ["href", "link", "siteBaseUrl", "siteProductionDomain", "url"]
+max_combined_payload_bytes = 10485760
+
+[integrations.testlight]
+endpoint = "https://testlight.example/openrtb2/auction"
+timeout_ms = 1200
+rewrite_scripts = true
+
+[integrations.didomi]
+enabled = false
+sdk_origin = "https://sdk.privacy-center.org"
+api_origin = "https://api.privacy-center.org"
+
+[integrations.permutive]
+enabled = false
+organization_id = ""
+workspace_id = ""
+project_id = ""
+api_endpoint = "https://api.permutive.com"
+secure_signals_endpoint = "https://secure-signals.permutive.app"
+
+[integrations.lockr]
+enabled = false
+app_id = ""
+api_endpoint = "https://identity.loc.kr"
+sdk_url = "https://aim.loc.kr/identity-lockr-v1.0.js"
+cache_ttl_seconds = 3600
+rewrite_sdk = true
+
+[integrations.datadome]
+enabled = false
+sdk_origin = "https://js.datadome.co"
+api_origin = "https://api-js.datadome.co"
+cache_ttl_seconds = 3600
+rewrite_sdk = true
+
+[integrations.gpt]
+enabled = false
+script_url = "https://securepubads.g.doubleclick.net/tag/js/gpt.js"
+cache_ttl_seconds = 3600
+rewrite_script = true
+
+[auction]
+enabled = false
+providers = ["prebid"]
+timeout_ms = 2000
+allowed_context_keys = []
+
+[integrations.aps]
+enabled = false
+pub_id = "test-aps-publisher-id"
+endpoint = "https://origin-mocktioneer.cdintel.com/e/dtb/bid"
+timeout_ms = 1000
+
+[integrations.google_tag_manager]
+enabled = false
+container_id = "GTM-TEST"
+
+[integrations.adserver_mock]
+enabled = false
+endpoint = "https://origin-mocktioneer.cdintel.com/adserver/mediate"
+timeout_ms = 1000
diff --git a/crates/integration-tests/fixtures/configs/viceroy-template.toml b/crates/integration-tests/fixtures/configs/viceroy-template.toml
new file mode 100644
index 00000000..3129c3f5
--- /dev/null
+++ b/crates/integration-tests/fixtures/configs/viceroy-template.toml
@@ -0,0 +1,38 @@
+# Viceroy local server configuration template for integration tests.
+# This configures the Viceroy runtime itself (backends, KV stores, etc.),
+# separate from the application config (trusted-server.toml).
+
+[local_server]
+
+    [local_server.backends]
+
+    [local_server.kv_stores]
+        [[local_server.kv_stores.counter_store]]
+            key = "placeholder"
+            data = "placeholder"
+
+        [[local_server.kv_stores.opid_store]]
+            key = "placeholder"
+            data = "placeholder"
+
+        [[local_server.kv_stores.creative_store]]
+            key = "placeholder"
+            data = "placeholder"
+
+    [local_server.secret_stores]
+        [[local_server.secret_stores.signing_keys]]
+            key = "ts-2025-10-A"
+            data = "NVnTYrw5xoyTJDOwoUWoPJO3A6UCCXOJJUzgGTxxx7k="
+
+        [[local_server.secret_stores.api-keys]]
+            key = "api_key"
+            data = "test-api-key"
+
+    [local_server.config_stores]
+        [local_server.config_stores.jwks_store]
+            format = "inline-toml"
+        [local_server.config_stores.jwks_store.contents]
+            ts-2025-10-A = "{\"kty\":\"OKP\",\"crv\":\"Ed25519\",\"kid\":\"ts-2025-10-A\",\"use\":\"sig\",\"x\":\"UVTi04QLrIuB7jXpVfHjUTVN5aIdcbPNr50umTtN8pw\"}"
+            ts-2025-10-B = "{\"kty\":\"OKP\",\"crv\":\"Ed25519\",\"kid\":\"ts-2025-10-B\",\"use\":\"sig\",\"x\":\"HVTi04QLrIuB7jXpVfHjUTVN5aIdcbPNr50umTtN8pw\"}"
+            current-kid = "ts-2025-10-A"
+            active-kids = "ts-2025-10-A,ts-2025-10-B"
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile b/crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile
new file mode 100644
index 00000000..37ecf03b
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile
@@ -0,0 +1,37 @@
+# Minimal Next.js container for integration testing.
+# Builds a standalone Next.js 14 app with test pages containing ad slots.
+#
+# Build:
+#   docker build -t test-nextjs:latest \
+#     crates/integration-tests/fixtures/frameworks/nextjs/
+#
+# Run manually:
+#   docker run -p 3000:3000 test-nextjs:latest
+
+# --- Build stage ---
+FROM node:20-alpine AS builder
+
+WORKDIR /app
+
+COPY package.json ./
+RUN npm install
+
+COPY next.config.mjs ./
+COPY app/ ./app/
+
+RUN npm run build
+
+# --- Runtime stage ---
+FROM node:20-alpine AS runner
+
+WORKDIR /app
+
+ENV NODE_ENV=production
+
+# Copy standalone output from builder
+COPY --from=builder /app/.next/standalone ./
+COPY --from=builder /app/.next/static ./.next/static
+
+EXPOSE 3000
+
+CMD ["node", "server.js"]
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/layout.tsx b/crates/integration-tests/fixtures/frameworks/nextjs/app/layout.tsx
new file mode 100644
index 00000000..943adabd
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/layout.tsx
@@ -0,0 +1,17 @@
+export const metadata = {
+  title: "Test Publisher - Next.js",
+  description: "Integration test page for trusted server",
+};
+
+export default function RootLayout({
+  children,
+}: {
+  children: React.ReactNode;
+}) {
+  return (
+    <html lang="en">
+      <head />
+      <body>{children}</body>
+    </html>
+  );
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx b/crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx
new file mode 100644
index 00000000..093b815c
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx
@@ -0,0 +1,20 @@
+export default function Home() {
+  return (
+    <main>
+      <h1>Integration Test Publisher</h1>
+      <p>This is a test page for integration testing of the trusted server.</p>
+
+      {/* Ad slot that should be rewritten by the trusted server */}
+      <div id="ad-slot-1" data-ad-unit="/test/banner">
+        <p>Advertisement placeholder</p>
+      </div>
+
+      <p>More page content follows the ad slot.</p>
+
+      {/* Second ad slot */}
+      <div id="ad-slot-2" data-ad-unit="/test/sidebar">
+        <p>Sidebar advertisement placeholder</p>
+      </div>
+    </main>
+  );
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/next.config.mjs b/crates/integration-tests/fixtures/frameworks/nextjs/next.config.mjs
new file mode 100644
index 00000000..8c8bab67
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/next.config.mjs
@@ -0,0 +1,6 @@
+/** @type {import('next').NextConfig} */
+const nextConfig = {
+  output: "standalone",
+};
+
+export default nextConfig;
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/package.json b/crates/integration-tests/fixtures/frameworks/nextjs/package.json
new file mode 100644
index 00000000..7c193fef
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "integration-test-nextjs",
+  "version": "1.0.0",
+  "private": true,
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start -p 3000"
+  },
+  "dependencies": {
+    "next": "^14.0.0",
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0"
+  }
+}
diff --git a/crates/integration-tests/fixtures/frameworks/wordpress/Dockerfile b/crates/integration-tests/fixtures/frameworks/wordpress/Dockerfile
new file mode 100644
index 00000000..c913cfa5
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/wordpress/Dockerfile
@@ -0,0 +1,22 @@
+# Minimal WordPress container for integration testing.
+# Uses PHP built-in server with a simple test theme that outputs HTML
+# with ad slot divs — no MySQL or full WordPress stack required.
+#
+# Build:
+#   docker build -t test-wordpress:latest \
+#     crates/integration-tests/fixtures/frameworks/wordpress/
+#
+# Run manually:
+#   docker run -p 8080:80 test-wordpress:latest
+
+FROM php:8.3-cli-alpine
+
+WORKDIR /var/www/html
+
+# Copy test theme files that simulate WordPress HTML output
+COPY theme/ /var/www/html/
+
+EXPOSE 80
+
+# Serve with PHP built-in server
+CMD ["php", "-S", "0.0.0.0:80", "-t", "/var/www/html"]
diff --git a/crates/integration-tests/fixtures/frameworks/wordpress/theme/index.php b/crates/integration-tests/fixtures/frameworks/wordpress/theme/index.php
new file mode 100644
index 00000000..624f4d28
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/wordpress/theme/index.php
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Test Publisher - WordPress</title>
+    <link rel="stylesheet" href="/wp-content/themes/test/style.css">
+</head>
+<body>
+    <header>
+        <h1>Integration Test Publisher</h1>
+        <nav>
+            <a href="/">Home</a>
+            <a href="/about">About</a>
+        </nav>
+    </header>
+
+    <main>
+        <article>
+            <h2>Test Article</h2>
+            <p>This is a test article for integration testing of the trusted server.</p>
+
+            <!-- Ad slot that should be rewritten by the trusted server -->
+            <div id="ad-slot-1" data-ad-unit="/test/banner">
+                <p>Advertisement placeholder</p>
+            </div>
+
+            <p>More article content follows the ad slot.</p>
+
+            <!-- Second ad slot -->
+            <div id="ad-slot-2" data-ad-unit="/test/sidebar">
+                <p>Sidebar advertisement placeholder</p>
+            </div>
+        </article>
+    </main>
+
+    <footer>
+        <p>&copy; 2025 Test Publisher</p>
+    </footer>
+</body>
+</html>
diff --git a/crates/integration-tests/fixtures/frameworks/wordpress/theme/wp-admin/index.php b/crates/integration-tests/fixtures/frameworks/wordpress/theme/wp-admin/index.php
new file mode 100644
index 00000000..23faf3e0
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/wordpress/theme/wp-admin/index.php
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>WordPress Admin - Dashboard</title>
+</head>
+<body class="wp-admin">
+    <div id="wpwrap">
+        <h1>Dashboard</h1>
+        <p>WordPress admin area — scripts should NOT be injected here.</p>
+    </div>
+</body>
+</html>
diff --git a/crates/integration-tests/tests/common/assertions.rs b/crates/integration-tests/tests/common/assertions.rs
index bc943a18..7905eba7 100644
--- a/crates/integration-tests/tests/common/assertions.rs
+++ b/crates/integration-tests/tests/common/assertions.rs
@@ -1,32 +1,32 @@
 use super::runtime::TestError;
-use error_stack::{Result, ResultExt};
+use error_stack::Result;
 use scraper::{Html, Selector};
 
-/// Assert that HTML contains script tag with expected tsjs module reference
+/// Parse a CSS selector, mapping the error to [`TestError::InvalidSelector`]
+fn parse_selector(selector: &str) -> Result<Selector, TestError> {
+    Selector::parse(selector).map_err(|_| error_stack::report!(TestError::InvalidSelector))
+}
+
+/// Assert that HTML contains a script tag with expected tsjs module reference.
+///
+/// Looks for `<script src="/static/tsjs=core,prebid,...">` and verifies
+/// all expected modules are present in the URL.
 ///
 /// # Errors
 ///
-/// Returns [`TestError::ScriptTagNotFound`] if no matching script tag exists
-/// Returns [`TestError::MissingModule`] if expected module ID is not found
+/// Returns [`TestError::ScriptTagNotFound`] if no matching script tag exists.
+/// Returns [`TestError::MissingModule`] if an expected module ID is absent.
 pub fn assert_script_tag_present(html: &str, expected_modules: &[&str]) -> Result<(), TestError> {
     let document = Html::parse_document(html);
-
-    // Find script tags with src attribute containing /static/tsjs=
-    let selector = Selector::parse("script[src*='/static/tsjs=']")
-        .change_context(TestError::InvalidSelector)?;
-
-    let mut found_script = false;
+    let selector = parse_selector("script[src*='/static/tsjs=']")?;
 
     for element in document.select(&selector) {
         if let Some(src) = element.value().attr("src") {
-            found_script = true;
-
-            // Extract module IDs from URL query parameter
+            // Extract module IDs from URL path segment
             // Expected format: /static/tsjs=core,prebid,lockr
             if let Some(query_part) = src.split("tsjs=").nth(1) {
                 let modules: Vec<&str> = query_part.split(',').collect();
 
-                // Verify all expected modules are present
                 for expected in expected_modules {
                     if !modules.contains(expected) {
                         return Err(error_stack::report!(TestError::MissingModule {
@@ -40,44 +40,31 @@ pub fn assert_script_tag_present(html: &str, expected_modules: &[&str]) -> Resul
         }
     }
 
-    if !found_script {
-        return Err(error_stack::report!(TestError::ScriptTagNotFound));
-    }
-
-    Ok(())
+    Err(error_stack::report!(TestError::ScriptTagNotFound))
 }
 
-/// Assert that HTML attributes are rewritten with expected prefix
+/// Assert that HTML attributes matching a selector are rewritten with expected prefix.
 ///
-/// Verifies that the trusted-server correctly rewrites attributes like href, src, srcset
+/// Verifies that the trusted-server correctly rewrites attributes (e.g. `href`, `src`)
 /// to use the first-party proxy endpoint.
 ///
-/// # Arguments
-///
-/// * `html` - HTML content to parse
-/// * `selector` - CSS selector to find target elements (e.g., "a[href]", "img[src]")
-/// * `attr_name` - Attribute name to check (e.g., "href", "src", "srcset")
-/// * `expected_prefix` - Expected URL prefix after rewriting (e.g., "/first-party/proxy?url=")
-///
 /// # Errors
 ///
-/// Returns [`TestError::InvalidSelector`] if CSS selector is malformed
-/// Returns [`TestError::ElementNotFound`] if no matching elements exist
-/// Returns [`TestError::AttributeNotRewritten`] if attribute doesn't have expected prefix
+/// Returns [`TestError::InvalidSelector`] if CSS selector is malformed.
+/// Returns [`TestError::ElementNotFound`] if no matching elements exist.
+/// Returns [`TestError::AttributeNotRewritten`] if attribute does not have expected prefix.
 pub fn assert_attribute_rewritten(
     html: &str,
-    selector: &str,
+    css_selector: &str,
     attr_name: &str,
     expected_prefix: &str,
 ) -> Result<(), TestError> {
     let document = Html::parse_document(html);
-
-    let parsed_selector =
-        Selector::parse(selector).change_context(TestError::InvalidSelector)?;
+    let selector = parse_selector(css_selector)?;
 
     let mut found_element = false;
 
-    for element in document.select(&parsed_selector) {
+    for element in document.select(&selector) {
         if let Some(attr_value) = element.value().attr(attr_name) {
             found_element = true;
 
@@ -94,99 +81,85 @@ pub fn assert_attribute_rewritten(
     Ok(())
 }
 
-/// Assert that HTTP response contains GDPR consent signal
+/// Assert that an HTTP response body contains GDPR consent signals.
 ///
-/// Verifies that the trusted-server correctly propagates GDPR consent signals
-/// in response headers or body.
+/// Checks for GDPR signal presence in the response body text. The trusted-server
+/// may embed GDPR state in injected scripts or propagate consent via response content.
 ///
 /// # Errors
 ///
-/// Returns [`TestError::GdprSignalMissing`] if no GDPR signal is found
-pub fn assert_gdpr_signal(response: &reqwest::blocking::Response) -> Result<(), TestError> {
-    // Check for GDPR signal in headers
-    // The trusted-server sets X-GDPR-Consent header when GDPR applies
-    if response.headers().contains_key("X-GDPR-Consent") {
+/// Returns [`TestError::GdprSignalMissing`] if no GDPR signal is found.
+pub fn assert_gdpr_signal_in_body(body: &str) -> Result<(), TestError> {
+    if body.contains("gdprApplies") || body.contains("gdpr_consent") || body.contains("__tcfapi") {
         return Ok(());
     }
 
-    // Alternative: Check for GDPR signal in response body
-    // Some integrations may embed GDPR state in the injected script
-    if let Ok(body) = response.text() {
-        if body.contains("gdprApplies") || body.contains("gdpr_consent") {
-            return Ok(());
-        }
-    }
-
     Err(error_stack::report!(TestError::GdprSignalMissing))
 }
 
-/// Assert that HTML contains expected number of elements matching selector
+/// Assert that HTML contains expected number of elements matching a selector.
 ///
 /// # Errors
 ///
-/// Returns [`TestError::InvalidSelector`] if CSS selector is malformed
+/// Returns [`TestError::InvalidSelector`] if CSS selector is malformed.
+/// Returns [`TestError::ElementNotFound`] if actual count differs from expected.
 pub fn assert_element_count(
     html: &str,
-    selector: &str,
+    css_selector: &str,
     expected_count: usize,
 ) -> Result<(), TestError> {
     let document = Html::parse_document(html);
+    let selector = parse_selector(css_selector)?;
 
-    let parsed_selector =
-        Selector::parse(selector).change_context(TestError::InvalidSelector)?;
-
-    let actual_count = document.select(&parsed_selector).count();
+    let actual_count = document.select(&selector).count();
 
     if actual_count != expected_count {
-        return Err(error_stack::report!(TestError::ElementNotFound).attach_printable(
-            format!(
+        return Err(
+            error_stack::report!(TestError::ElementNotFound).attach_printable(format!(
                 "Expected {} elements matching '{}', found {}",
-                expected_count, selector, actual_count
-            ),
-        ));
+                expected_count, css_selector, actual_count
+            )),
+        );
     }
 
     Ok(())
 }
 
-/// Assert that script tag is injected at the start of `<head>`
+/// Assert that the tsjs script tag is injected at the start of `<head>`.
 ///
-/// This verifies the HTML processor correctly positions the script tag
-/// to ensure early execution before other scripts.
+/// Verifies the HTML processor positions the script tag before other elements
+/// to ensure early execution.
 ///
 /// # Errors
 ///
-/// Returns [`TestError::ScriptTagNotFound`] if script is not at expected position
+/// Returns [`TestError::ScriptTagNotFound`] if script is not at expected position.
+/// Returns [`TestError::ElementNotFound`] if `<head>` element is missing.
 pub fn assert_script_position(html: &str) -> Result<(), TestError> {
     let document = Html::parse_document(html);
-
-    // Find the <head> element
-    let head_selector = Selector::parse("head").change_context(TestError::InvalidSelector)?;
+    let head_selector = parse_selector("head")?;
 
     let head = document
         .select(&head_selector)
         .next()
         .ok_or_else(|| error_stack::report!(TestError::ElementNotFound))?;
 
-    // Get first child of <head>
-    let first_child = head
-        .first_child()
-        .ok_or_else(|| error_stack::report!(TestError::ElementNotFound))?;
-
-    // Verify first child is our injected script tag
-    if let Some(element) = first_child.value().as_element() {
-        if element.name() == "script" {
-            if let Some(src) = element.attr("src") {
-                if src.contains("/static/tsjs=") {
-                    return Ok(());
+    // Check first element child of <head> is our script
+    for child in head.children() {
+        if let Some(element) = child.value().as_element() {
+            if element.name() == "script" {
+                if let Some(src) = element.attr("src") {
+                    if src.contains("/static/tsjs=") {
+                        return Ok(());
+                    }
                 }
             }
+            // First element child is not our script
+            break;
         }
     }
 
-    Err(error_stack::report!(TestError::ScriptTagNotFound).attach_printable(
-        "Script tag not found at start of <head>",
-    ))
+    Err(error_stack::report!(TestError::ScriptTagNotFound)
+        .attach_printable("Script tag not found at start of <head>"))
 }
 
 #[cfg(test)]
@@ -194,7 +167,7 @@ mod tests {
     use super::*;
 
     #[test]
-    fn test_assert_script_tag_present_success() {
+    fn script_tag_present_with_expected_modules() {
         let html = r#"
             <!DOCTYPE html>
             <html>
@@ -210,7 +183,7 @@ mod tests {
     }
 
     #[test]
-    fn test_assert_script_tag_present_missing_module() {
+    fn script_tag_present_fails_on_missing_module() {
         let html = r#"
             <!DOCTYPE html>
             <html>
@@ -229,7 +202,18 @@ mod tests {
     }
 
     #[test]
-    fn test_assert_attribute_rewritten_success() {
+    fn script_tag_present_fails_when_no_script() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html><head></head><body></body></html>
+        "#;
+
+        let result = assert_script_tag_present(html, &["core"]);
+        assert!(result.is_err(), "should fail when no script tag exists");
+    }
+
+    #[test]
+    fn attribute_rewritten_with_expected_prefix() {
         let html = r#"
             <a href="/first-party/proxy?url=https://example.com">Link</a>
         "#;
@@ -239,7 +223,7 @@ mod tests {
     }
 
     #[test]
-    fn test_assert_attribute_rewritten_not_rewritten() {
+    fn attribute_rewritten_fails_when_not_rewritten() {
         let html = r#"
             <a href="https://example.com">Link</a>
         "#;
@@ -249,7 +233,7 @@ mod tests {
     }
 
     #[test]
-    fn test_assert_element_count_success() {
+    fn element_count_matches() {
         let html = r#"
             <div>
                 <p>First</p>
@@ -262,7 +246,7 @@ mod tests {
     }
 
     #[test]
-    fn test_assert_element_count_mismatch() {
+    fn element_count_fails_on_mismatch() {
         let html = r#"
             <div>
                 <p>First</p>
@@ -271,6 +255,21 @@ mod tests {
         "#;
 
         let result = assert_element_count(html, "p", 3);
-        assert!(result.is_err(), "should fail when count doesn't match");
+        assert!(result.is_err(), "should fail when count does not match");
+    }
+
+    #[test]
+    fn gdpr_signal_detected_in_body() {
+        assert_gdpr_signal_in_body("window.__tcfapi = function() {}")
+            .expect("should detect TCF API signal");
+
+        assert_gdpr_signal_in_body("var gdprApplies = true;")
+            .expect("should detect gdprApplies signal");
+    }
+
+    #[test]
+    fn gdpr_signal_missing_from_body() {
+        let result = assert_gdpr_signal_in_body("<html><body>No GDPR here</body></html>");
+        assert!(result.is_err(), "should fail when no GDPR signal exists");
     }
 }
diff --git a/crates/integration-tests/tests/common/config.rs b/crates/integration-tests/tests/common/config.rs
index 6bf21177..8945a0c2 100644
--- a/crates/integration-tests/tests/common/config.rs
+++ b/crates/integration-tests/tests/common/config.rs
@@ -39,30 +39,30 @@ impl RuntimeConfigBuilder {
 
     pub fn build(self) -> Result<super::RuntimeConfig, TestError> {
         // Parse template as TOML
-        let mut config: toml::Value = toml::from_str(&self.template)
-            .change_context(TestError::ConfigParse)?;
+        let mut config: toml::Value =
+            toml::from_str(&self.template).change_context(TestError::ConfigParse)?;
 
         // Set origin_url if provided
         if let Some(origin_url) = self.origin_url {
             if let Some(publisher) = config.get_mut("publisher") {
                 if let Some(publisher_table) = publisher.as_table_mut() {
-                    publisher_table.insert(
-                        "origin_url".to_string(),
-                        toml::Value::String(origin_url),
-                    );
+                    publisher_table
+                        .insert("origin_url".to_string(), toml::Value::String(origin_url));
                 }
             }
         }
 
-        // Enable integrations if provided
+        // Enable specified integrations
+        // Config structure: [integrations.<id>] with `enabled = true/false`
         if !self.integrations.is_empty() {
-            if let Some(integrations_config) = config
+            if let Some(integrations_table) = config
                 .get_mut("integrations")
-                .and_then(|v| v.get_mut("config"))
                 .and_then(|v| v.as_table_mut())
             {
                 for integration_id in &self.integrations {
-                    if let Some(integration_entry) = integrations_config.get_mut(integration_id) {
+                    if let Some(integration_entry) =
+                        integrations_table.get_mut(integration_id.as_str())
+                    {
                         if let Some(table) = integration_entry.as_table_mut() {
                             table.insert("enabled".to_string(), toml::Value::Boolean(true));
                         }
@@ -73,19 +73,14 @@ impl RuntimeConfigBuilder {
 
         // Write to temp file
         let mut file = NamedTempFile::new().change_context(TestError::ConfigWrite)?;
-        let content =
-            toml::to_string_pretty(&config).change_context(TestError::ConfigSerialize)?;
+        let content = toml::to_string_pretty(&config).change_context(TestError::ConfigSerialize)?;
         file.write_all(content.as_bytes())
             .change_context(TestError::ConfigWrite)?;
 
-        let config_path = file.into_temp_path().to_path_buf();
         let wasm_path = self
             .wasm_path
             .unwrap_or_else(super::runtime::wasm_binary_path);
 
-        Ok(super::RuntimeConfig {
-            config_path,
-            wasm_path,
-        })
+        Ok(super::RuntimeConfig::new(file, wasm_path))
     }
 }
diff --git a/crates/integration-tests/tests/common/runtime.rs b/crates/integration-tests/tests/common/runtime.rs
index 8321081b..fb770fb6 100644
--- a/crates/integration-tests/tests/common/runtime.rs
+++ b/crates/integration-tests/tests/common/runtime.rs
@@ -1,6 +1,7 @@
-use error_stack::{Result, ResultExt};
+use error_stack::Result;
 use std::collections::HashMap;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
+use tempfile::NamedTempFile;
 
 /// Test error types (platform-agnostic)
 #[derive(Debug, derive_more::Display)]
@@ -71,10 +72,33 @@ pub enum TestError {
 
 impl core::error::Error for TestError {}
 
-/// Configuration for runtime environments
+/// Configuration for runtime environments.
+///
+/// Holds the temp file so the config is not deleted while the runtime is alive.
 pub struct RuntimeConfig {
-    pub config_path: PathBuf,
-    pub wasm_path: PathBuf,
+    /// Handle to the temp config file — dropped when `RuntimeConfig` is dropped.
+    _config_file: NamedTempFile,
+    wasm_path: PathBuf,
+}
+
+impl RuntimeConfig {
+    /// Create a new runtime configuration from a temp file and WASM binary path.
+    pub fn new(config_file: NamedTempFile, wasm_path: PathBuf) -> Self {
+        Self {
+            _config_file: config_file,
+            wasm_path,
+        }
+    }
+
+    /// Path to the generated config file on disk.
+    pub fn config_path(&self) -> &Path {
+        self._config_file.path()
+    }
+
+    /// Path to the WASM binary.
+    pub fn wasm_path(&self) -> &Path {
+        &self.wasm_path
+    }
 }
 
 /// Platform-agnostic process handle
diff --git a/crates/integration-tests/tests/environments/fastly.rs b/crates/integration-tests/tests/environments/fastly.rs
new file mode 100644
index 00000000..f0301bab
--- /dev/null
+++ b/crates/integration-tests/tests/environments/fastly.rs
@@ -0,0 +1,103 @@
+use crate::common::runtime::{
+    RuntimeConfig, RuntimeEnvironment, RuntimeProcess, RuntimeProcessHandle, TestError,
+};
+use error_stack::ResultExt as _;
+use std::collections::HashMap;
+use std::process::{Child, Command};
+
+/// Fastly Compute runtime using Viceroy local simulator.
+///
+/// Spawns a `viceroy` child process with the WASM binary and a generated
+/// `fastly.toml` config. Dynamic port allocation allows parallel test execution.
+pub struct FastlyViceroy;
+
+impl RuntimeEnvironment for FastlyViceroy {
+    fn id(&self) -> &'static str {
+        "fastly"
+    }
+
+    fn spawn(&self, config: &RuntimeConfig) -> error_stack::Result<RuntimeProcess, TestError> {
+        let port = super::find_available_port()?;
+
+        // Viceroy requires a fastly.toml for local_server config (KV stores, secrets).
+        // The app config (trusted-server.toml) is read by the WASM binary itself via
+        // environment variable or compiled-in path.
+        let viceroy_config = self.viceroy_config_path();
+
+        let child = Command::new("viceroy")
+            .arg(config.wasm_path())
+            .arg("-C")
+            .arg(&viceroy_config)
+            .arg("--addr")
+            .arg(format!("127.0.0.1:{port}"))
+            .env("TRUSTED_SERVER_CONFIG", config.config_path())
+            .spawn()
+            .change_context(TestError::RuntimeSpawn)
+            .attach_printable("Failed to spawn viceroy process")?;
+
+        let base_url = format!("http://127.0.0.1:{port}");
+
+        super::wait_for_ready(&base_url, self.health_check_path())?;
+
+        Ok(RuntimeProcess {
+            inner: Box::new(ViceroyHandle { child }),
+            base_url,
+        })
+    }
+
+    fn config_template(&self) -> &str {
+        include_str!("../../fixtures/configs/fastly-template.toml")
+    }
+
+    fn health_check_path(&self) -> &str {
+        "/health"
+    }
+
+    fn env_vars(&self) -> HashMap<String, String> {
+        HashMap::new()
+    }
+}
+
+impl FastlyViceroy {
+    /// Path to the Viceroy-specific `fastly.toml` template.
+    ///
+    /// This contains `[local_server]` configuration (backends, KV stores,
+    /// secret stores) that Viceroy needs, separate from the application config.
+    fn viceroy_config_path(&self) -> std::path::PathBuf {
+        std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .join("fixtures/configs/viceroy-template.toml")
+    }
+}
+
+/// Process handle for a running Viceroy instance.
+///
+/// Implements [`Drop`] to ensure the process is killed on test cleanup,
+/// preventing orphaned Viceroy processes.
+struct ViceroyHandle {
+    child: Child,
+}
+
+impl RuntimeProcessHandle for ViceroyHandle {
+    fn kill(&mut self) -> error_stack::Result<(), TestError> {
+        self.child
+            .kill()
+            .change_context(TestError::RuntimeKill)
+            .attach_printable("Failed to kill viceroy process")?;
+        Ok(())
+    }
+
+    fn wait(&mut self) -> error_stack::Result<(), TestError> {
+        self.child
+            .wait()
+            .change_context(TestError::RuntimeWait)
+            .attach_printable("Failed to wait on viceroy process")?;
+        Ok(())
+    }
+}
+
+impl Drop for ViceroyHandle {
+    fn drop(&mut self) {
+        let _ = self.child.kill();
+        let _ = self.child.wait();
+    }
+}
diff --git a/crates/integration-tests/tests/environments/mod.rs b/crates/integration-tests/tests/environments/mod.rs
new file mode 100644
index 00000000..0f4a7ab9
--- /dev/null
+++ b/crates/integration-tests/tests/environments/mod.rs
@@ -0,0 +1,74 @@
+pub mod fastly;
+
+use crate::common::runtime::{RuntimeEnvironment, TestError};
+
+/// Runtime factory function type — avoids trait object static initialization issues.
+type RuntimeFactory = fn() -> Box<dyn RuntimeEnvironment>;
+
+/// Registry of all supported runtime environments.
+///
+/// Uses function pointers instead of `&[&dyn RuntimeEnvironment]` because trait
+/// objects cannot be constructed in `const` context for types with non-trivial
+/// constructors.
+///
+/// # Adding a new runtime
+///
+/// 1. Create `tests/environments/<platform>.rs`
+/// 2. Implement [`RuntimeEnvironment`] trait
+/// 3. Add factory closure here
+pub static RUNTIME_ENVIRONMENTS: &[RuntimeFactory] = &[
+    || Box::new(fastly::FastlyViceroy),
+    // Future: Add Cloudflare, Fermyon Spin, etc.
+    // || Box::new(cloudflare::CloudflareWrangler),
+];
+
+/// Find an available TCP port for the runtime to bind to.
+///
+/// Binds to port 0, which asks the OS to assign a random available port,
+/// then immediately closes the listener and returns the assigned port.
+///
+/// # Errors
+///
+/// Returns [`TestError::NoPortAvailable`] if no port can be allocated.
+pub fn find_available_port() -> error_stack::Result<u16, TestError> {
+    let listener = std::net::TcpListener::bind("127.0.0.1:0")
+        .map_err(|_| error_stack::report!(TestError::NoPortAvailable))?;
+
+    let port = listener
+        .local_addr()
+        .map_err(|_| error_stack::report!(TestError::NoPortAvailable))?
+        .port();
+
+    Ok(port)
+}
+
+/// Poll a runtime's health endpoint until it responds with success.
+///
+/// Retries up to 30 times with 100ms delay between attempts (total ~3s).
+/// Falls back to checking the root path if the health endpoint is not available.
+///
+/// # Errors
+///
+/// Returns [`TestError::RuntimeNotReady`] if the runtime does not respond within timeout.
+pub fn wait_for_ready(base_url: &str, health_path: &str) -> error_stack::Result<(), TestError> {
+    let health_url = format!("{}{}", base_url, health_path);
+
+    for _ in 0..30 {
+        if let Ok(resp) = reqwest::blocking::get(&health_url) {
+            if resp.status().is_success() {
+                return Ok(());
+            }
+        }
+
+        // Fallback: try root path — a 404 means the server is responsive
+        if let Ok(resp) = reqwest::blocking::get(base_url) {
+            if resp.status().is_success() || resp.status().as_u16() == 404 {
+                return Ok(());
+            }
+        }
+
+        std::thread::sleep(std::time::Duration::from_millis(100));
+    }
+
+    Err(error_stack::report!(TestError::RuntimeNotReady))
+}
diff --git a/crates/integration-tests/tests/frameworks/mod.rs b/crates/integration-tests/tests/frameworks/mod.rs
new file mode 100644
index 00000000..78de4832
--- /dev/null
+++ b/crates/integration-tests/tests/frameworks/mod.rs
@@ -0,0 +1,64 @@
+pub mod nextjs;
+pub mod scenarios;
+pub mod wordpress;
+
+use crate::common::runtime::TestError;
+use scenarios::{CustomScenario, TestScenario};
+use testcontainers::GenericImage;
+
+/// Trait defining how to test a frontend framework.
+///
+/// Each framework provides a Docker container image and declares which
+/// test scenarios apply to it. The matrix test runner uses this trait
+/// to test every framework against every runtime environment.
+///
+/// # Adding a new framework
+///
+/// 1. Create `fixtures/frameworks/<name>/` with a Dockerfile
+/// 2. Create `tests/frameworks/<name>.rs` implementing this trait
+/// 3. Register in [`FRAMEWORKS`] below
+pub trait FrontendFramework: Send + Sync {
+    /// Framework identifier (e.g. "wordpress", "nextjs").
+    fn id(&self) -> &'static str;
+
+    /// Build a Docker container image for this framework.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TestError::ContainerStart`] if the image cannot be created.
+    fn build_container(&self) -> error_stack::Result<GenericImage, TestError>;
+
+    /// Port the framework serves on inside the container.
+    fn container_port(&self) -> u16;
+
+    /// HTTP path to use for container health checks.
+    fn health_check_path(&self) -> &str {
+        "/"
+    }
+
+    /// Standard test scenarios applicable to this framework.
+    fn standard_scenarios(&self) -> Vec<TestScenario>;
+
+    /// Framework-specific test scenarios (optional).
+    fn custom_scenarios(&self) -> Vec<CustomScenario> {
+        vec![]
+    }
+}
+
+/// Framework factory function type.
+type FrameworkFactory = fn() -> Box<dyn FrontendFramework>;
+
+/// Registry of all supported frontend frameworks.
+///
+/// Uses function pointers to avoid trait object static initialization issues.
+///
+/// # Adding a new framework
+///
+/// 1. Create `fixtures/frameworks/<name>/`
+/// 2. Create `tests/frameworks/<name>.rs`
+/// 3. Implement [`FrontendFramework`] trait
+/// 4. Add factory here: `|| Box::new(<name>::<Struct>)`
+pub static FRAMEWORKS: &[FrameworkFactory] = &[
+    || Box::new(wordpress::WordPress),
+    || Box::new(nextjs::NextJs),
+];
diff --git a/crates/integration-tests/tests/frameworks/nextjs.rs b/crates/integration-tests/tests/frameworks/nextjs.rs
new file mode 100644
index 00000000..1d3f1cf0
--- /dev/null
+++ b/crates/integration-tests/tests/frameworks/nextjs.rs
@@ -0,0 +1,52 @@
+use super::FrontendFramework;
+use super::scenarios::{CustomScenario, TestScenario};
+use crate::common::runtime::TestError;
+use testcontainers::GenericImage;
+
+/// Next.js frontend framework for integration testing.
+///
+/// Uses a pre-built Docker image (`test-nextjs:latest`) that serves
+/// a minimal Next.js 14 app. The image must be built before running tests:
+///
+/// ```bash
+/// docker build -t test-nextjs:latest \
+///   crates/integration-tests/fixtures/frameworks/nextjs/
+/// ```
+pub struct NextJs;
+
+impl FrontendFramework for NextJs {
+    fn id(&self) -> &'static str {
+        "nextjs"
+    }
+
+    fn build_container(&self) -> error_stack::Result<GenericImage, TestError> {
+        Ok(GenericImage::new("test-nextjs", "latest")
+            .with_exposed_port(testcontainers::core::IntoContainerPort::tcp(3000)))
+    }
+
+    fn container_port(&self) -> u16 {
+        3000
+    }
+
+    fn health_check_path(&self) -> &str {
+        "/"
+    }
+
+    fn standard_scenarios(&self) -> Vec<TestScenario> {
+        vec![
+            TestScenario::HtmlInjection,
+            TestScenario::ScriptServing {
+                modules: vec!["core", "prebid", "lockr"],
+            },
+            TestScenario::AttributeRewriting,
+            TestScenario::GdprSignal,
+        ]
+    }
+
+    fn custom_scenarios(&self) -> Vec<CustomScenario> {
+        vec![
+            CustomScenario::NextJsRscFlight,
+            CustomScenario::NextJsServerActions,
+        ]
+    }
+}
diff --git a/crates/integration-tests/tests/frameworks/scenarios.rs b/crates/integration-tests/tests/frameworks/scenarios.rs
new file mode 100644
index 00000000..b341f93d
--- /dev/null
+++ b/crates/integration-tests/tests/frameworks/scenarios.rs
@@ -0,0 +1,228 @@
+use crate::common::assertions;
+use crate::common::runtime::TestError;
+use error_stack::ResultExt as _;
+
+/// Standard test scenarios applicable to all frontend frameworks.
+///
+/// Each scenario tests a core trusted-server behavior that should work
+/// regardless of the underlying framework serving HTML.
+#[derive(Debug, Clone)]
+pub enum TestScenario {
+    /// Verify `<script>` tag is injected into `<head>`.
+    HtmlInjection,
+
+    /// Verify `/static/tsjs=` endpoint serves JS bundles for given modules.
+    ScriptServing { modules: Vec<&'static str> },
+
+    /// Verify `tsjs-*` attributes are rewritten correctly.
+    AttributeRewriting,
+
+    /// Verify GDPR consent signals propagate through the response.
+    GdprSignal,
+}
+
+/// Framework-specific custom scenarios that test framework-unique behaviors.
+#[derive(Debug, Clone)]
+pub enum CustomScenario {
+    /// WordPress: script injection does not break admin pages.
+    WordPressAdminInjection,
+
+    /// Next.js: React Server Components Flight format is preserved.
+    NextJsRscFlight,
+
+    /// Next.js: Server Actions POST requests pass through correctly.
+    NextJsServerActions,
+}
+
+impl TestScenario {
+    /// Execute this scenario against a running runtime.
+    ///
+    /// # Arguments
+    ///
+    /// * `base_url` - The base URL of the running runtime (e.g. `http://127.0.0.1:12345`)
+    /// * `framework_id` - Identifier for the framework (used in error context)
+    ///
+    /// # Errors
+    ///
+    /// Returns a [`TestError`] variant depending on which assertion fails.
+    pub fn run(&self, base_url: &str, framework_id: &str) -> error_stack::Result<(), TestError> {
+        match self {
+            Self::HtmlInjection => {
+                let resp = reqwest::blocking::get(base_url)
+                    .change_context(TestError::HttpRequest)
+                    .attach_printable(format!(
+                        "scenario: HtmlInjection, framework: {framework_id}"
+                    ))?;
+
+                let html = resp
+                    .text()
+                    .change_context(TestError::ResponseParse)
+                    .attach_printable(format!("framework: {framework_id}"))?;
+
+                assertions::assert_script_tag_present(&html, &["core"])
+                    .attach_printable(format!("framework: {framework_id}"))?;
+
+                Ok(())
+            }
+
+            Self::ScriptServing { modules } => {
+                let url = format!("{base_url}/static/tsjs={}", modules.join(","));
+
+                let resp = reqwest::blocking::get(&url)
+                    .change_context(TestError::HttpRequest)
+                    .attach_printable(format!(
+                        "scenario: ScriptServing, framework: {framework_id}, modules: {modules:?}"
+                    ))?;
+
+                if !resp.status().is_success() {
+                    return Err(
+                        error_stack::report!(TestError::HttpRequest).attach_printable(format!(
+                            "Script serving returned {}, expected 2xx",
+                            resp.status()
+                        )),
+                    );
+                }
+
+                let body = resp.text().change_context(TestError::ResponseParse)?;
+
+                if !body.contains("tsjs") {
+                    return Err(error_stack::report!(TestError::ScriptTagNotFound)
+                        .attach_printable("Response body does not contain tsjs marker"));
+                }
+
+                Ok(())
+            }
+
+            Self::AttributeRewriting => {
+                let resp = reqwest::blocking::get(base_url)
+                    .change_context(TestError::HttpRequest)
+                    .attach_printable(format!(
+                        "scenario: AttributeRewriting, framework: {framework_id}"
+                    ))?;
+
+                let html = resp.text().change_context(TestError::ResponseParse)?;
+
+                // Check for elements with data-ad-unit that should have tsjs- prefixed attributes
+                assertions::assert_attribute_rewritten(
+                    &html,
+                    "[data-ad-unit]",
+                    "data-ad-unit",
+                    "tsjs-",
+                )
+                .attach_printable(format!("framework: {framework_id}"))?;
+
+                Ok(())
+            }
+
+            Self::GdprSignal => {
+                let resp = reqwest::blocking::get(base_url)
+                    .change_context(TestError::HttpRequest)
+                    .attach_printable(format!("scenario: GdprSignal, framework: {framework_id}"))?;
+
+                let body = resp.text().change_context(TestError::ResponseParse)?;
+
+                assertions::assert_gdpr_signal_in_body(&body)
+                    .attach_printable(format!("framework: {framework_id}"))?;
+
+                Ok(())
+            }
+        }
+    }
+}
+
+impl CustomScenario {
+    /// Execute this custom scenario against a running runtime.
+    ///
+    /// # Errors
+    ///
+    /// Returns a [`TestError`] variant depending on which assertion fails.
+    pub fn run(&self, base_url: &str, framework_id: &str) -> error_stack::Result<(), TestError> {
+        match self {
+            Self::WordPressAdminInjection => {
+                // Verify that WordPress admin pages (/wp-admin/) do not get script injection
+                let url = format!("{base_url}/wp-admin/");
+                let resp = reqwest::blocking::get(&url)
+                    .change_context(TestError::HttpRequest)
+                    .attach_printable(format!(
+                        "scenario: WordPressAdminInjection, framework: {framework_id}"
+                    ))?;
+
+                let html = resp.text().change_context(TestError::ResponseParse)?;
+
+                // Admin pages should NOT have tsjs script injected
+                if html.contains("/static/tsjs=") {
+                    return Err(error_stack::report!(TestError::ScriptTagNotFound)
+                        .attach_printable(
+                            "Script tag should NOT be injected on WordPress admin pages",
+                        ));
+                }
+
+                Ok(())
+            }
+
+            Self::NextJsRscFlight => {
+                // Verify RSC Flight format responses are not corrupted
+                let client = reqwest::blocking::Client::new();
+                let resp = client
+                    .get(base_url)
+                    .header("RSC", "1")
+                    .header("Next-Router-State-Tree", "%5B%22%22%5D")
+                    .send()
+                    .change_context(TestError::HttpRequest)
+                    .attach_printable(format!(
+                        "scenario: NextJsRscFlight, framework: {framework_id}"
+                    ))?;
+
+                let content_type = resp
+                    .headers()
+                    .get("content-type")
+                    .and_then(|v| v.to_str().ok())
+                    .unwrap_or("");
+
+                // RSC responses should have text/x-component content type
+                // and should NOT have script injection (they're not HTML)
+                if content_type.contains("text/x-component") {
+                    let body = resp.text().change_context(TestError::ResponseParse)?;
+
+                    if body.contains("/static/tsjs=") {
+                        return Err(error_stack::report!(TestError::ScriptTagNotFound)
+                            .attach_printable(
+                                "Script tag should NOT be injected in RSC Flight responses",
+                            ));
+                    }
+                }
+
+                Ok(())
+            }
+
+            Self::NextJsServerActions => {
+                // Verify POST requests for server actions pass through correctly
+                let client = reqwest::blocking::Client::new();
+                let resp = client
+                    .post(base_url)
+                    .header("Next-Action", "test-action-id")
+                    .header("Content-Type", "text/plain;charset=UTF-8")
+                    .body("[]")
+                    .send()
+                    .change_context(TestError::HttpRequest)
+                    .attach_printable(format!(
+                        "scenario: NextJsServerActions, framework: {framework_id}"
+                    ))?;
+
+                // Server action responses should pass through without modification
+                // A 4xx or 5xx error is acceptable here since we don't have real server actions,
+                // but a connection error would indicate the proxy is blocking POST requests
+                if resp.status().is_server_error() {
+                    return Err(
+                        error_stack::report!(TestError::HttpRequest).attach_printable(format!(
+                            "Server action request failed with {}",
+                            resp.status()
+                        )),
+                    );
+                }
+
+                Ok(())
+            }
+        }
+    }
+}
diff --git a/crates/integration-tests/tests/frameworks/wordpress.rs b/crates/integration-tests/tests/frameworks/wordpress.rs
new file mode 100644
index 00000000..8a1e20b2
--- /dev/null
+++ b/crates/integration-tests/tests/frameworks/wordpress.rs
@@ -0,0 +1,50 @@
+use super::FrontendFramework;
+use super::scenarios::{CustomScenario, TestScenario};
+use crate::common::runtime::TestError;
+use testcontainers::GenericImage;
+
+/// WordPress frontend framework for integration testing.
+///
+/// Uses a pre-built Docker image (`test-wordpress:latest`) that serves
+/// a minimal WordPress site with a test theme. The image must be built
+/// before running tests:
+///
+/// ```bash
+/// docker build -t test-wordpress:latest \
+///   crates/integration-tests/fixtures/frameworks/wordpress/
+/// ```
+pub struct WordPress;
+
+impl FrontendFramework for WordPress {
+    fn id(&self) -> &'static str {
+        "wordpress"
+    }
+
+    fn build_container(&self) -> error_stack::Result<GenericImage, TestError> {
+        Ok(GenericImage::new("test-wordpress", "latest")
+            .with_exposed_port(testcontainers::core::IntoContainerPort::tcp(80)))
+    }
+
+    fn container_port(&self) -> u16 {
+        80
+    }
+
+    fn health_check_path(&self) -> &str {
+        "/"
+    }
+
+    fn standard_scenarios(&self) -> Vec<TestScenario> {
+        vec![
+            TestScenario::HtmlInjection,
+            TestScenario::ScriptServing {
+                modules: vec!["core", "prebid"],
+            },
+            TestScenario::AttributeRewriting,
+            TestScenario::GdprSignal,
+        ]
+    }
+
+    fn custom_scenarios(&self) -> Vec<CustomScenario> {
+        vec![CustomScenario::WordPressAdminInjection]
+    }
+}
diff --git a/crates/integration-tests/tests/integration.rs b/crates/integration-tests/tests/integration.rs
new file mode 100644
index 00000000..1b2ec34e
--- /dev/null
+++ b/crates/integration-tests/tests/integration.rs
@@ -0,0 +1,143 @@
+mod common;
+mod environments;
+mod frameworks;
+
+use common::config::RuntimeConfigBuilder;
+use common::runtime::{TestError, wasm_binary_path};
+use environments::RUNTIME_ENVIRONMENTS;
+use error_stack::ResultExt as _;
+use frameworks::{FRAMEWORKS, FrontendFramework};
+use std::time::Duration;
+use testcontainers::runners::SyncRunner as _;
+
+/// Test all combinations: frameworks x runtimes (matrix testing).
+///
+/// Iterates every registered runtime and framework, running all standard
+/// and custom scenarios for each combination.
+#[test]
+fn test_all_combinations() {
+    for runtime_factory in RUNTIME_ENVIRONMENTS {
+        let runtime = runtime_factory();
+        log::info!("Testing runtime: {}", runtime.id());
+
+        for framework_factory in FRAMEWORKS {
+            let framework = framework_factory();
+            log::info!("  Testing framework: {}", framework.id());
+
+            test_combination(runtime.as_ref(), framework.as_ref())
+                .expect("should pass all scenarios for this combination");
+        }
+    }
+}
+
+/// Test a specific framework x runtime combination.
+///
+/// # Steps
+///
+/// 1. Start the frontend container (Docker via testcontainers)
+/// 2. Generate platform-specific configuration pointing at the container
+/// 3. Spawn the runtime process (e.g. Viceroy)
+/// 4. Run standard scenarios (HTML injection, script serving, etc.)
+/// 5. Run framework-specific custom scenarios
+/// 6. Cleanup is automatic via [`Drop`] on both container and runtime
+///
+/// # Errors
+///
+/// Propagates any [`TestError`] from container startup, runtime spawn,
+/// or scenario assertions, with full context chain.
+fn test_combination(
+    runtime: &dyn common::runtime::RuntimeEnvironment,
+    framework: &dyn FrontendFramework,
+) -> error_stack::Result<(), TestError> {
+    let runtime_id = runtime.id();
+    let framework_id = framework.id();
+
+    // 1. Start frontend container
+    let image = framework
+        .build_container()
+        .attach_printable(format!("runtime: {runtime_id}, framework: {framework_id}"))?;
+
+    let container = image
+        .start()
+        .change_context(TestError::ContainerStart {
+            reason: format!("framework: {framework_id}"),
+        })
+        .attach_printable(format!("runtime: {runtime_id}, framework: {framework_id}"))?;
+
+    let host_port = container
+        .get_host_port_ipv4(framework.container_port())
+        .change_context(TestError::ContainerStart {
+            reason: format!("could not get host port for framework: {framework_id}"),
+        })?;
+
+    let origin_url = format!("http://127.0.0.1:{host_port}");
+
+    // Wait for container to be ready
+    wait_for_container(&origin_url, framework.health_check_path())?;
+
+    // 2. Generate platform-specific config
+    let config = RuntimeConfigBuilder::new(runtime.config_template())
+        .with_origin_url(origin_url)
+        .with_integrations(vec!["prebid", "lockr"])
+        .with_wasm_path(wasm_binary_path())
+        .build()
+        .attach_printable(format!("runtime: {runtime_id}, framework: {framework_id}"))?;
+
+    // 3. Spawn runtime process
+    let process = runtime
+        .spawn(&config)
+        .attach_printable(format!("runtime: {runtime_id}, framework: {framework_id}"))?;
+
+    // 4. Run standard scenarios
+    for scenario in framework.standard_scenarios() {
+        scenario
+            .run(&process.base_url, framework_id)
+            .attach_printable(format!(
+                "runtime: {runtime_id}, framework: {framework_id}, scenario: {scenario:?}"
+            ))?;
+    }
+
+    // 5. Run custom scenarios
+    for scenario in framework.custom_scenarios() {
+        scenario
+            .run(&process.base_url, framework_id)
+            .attach_printable(format!(
+                "runtime: {runtime_id}, framework: {framework_id}, custom scenario: {scenario:?}"
+            ))?;
+    }
+
+    Ok(())
+}
+
+/// Wait for a container's health check endpoint to respond.
+fn wait_for_container(base_url: &str, health_path: &str) -> error_stack::Result<(), TestError> {
+    let url = format!("{base_url}{health_path}");
+
+    for _ in 0..60 {
+        if let Ok(resp) = reqwest::blocking::get(&url) {
+            if resp.status().is_success() {
+                return Ok(());
+            }
+        }
+        std::thread::sleep(Duration::from_millis(500));
+    }
+
+    Err(error_stack::report!(TestError::ContainerTimeout)
+        .attach_printable(format!("Container at {base_url} not ready after 30s")))
+}
+
+// Individual test functions for faster iteration during development.
+
+#[test]
+fn test_wordpress_fastly() {
+    let runtime = environments::fastly::FastlyViceroy;
+    let framework = frameworks::wordpress::WordPress;
+    test_combination(&runtime, &framework).expect("should pass WordPress on Fastly");
+}
+
+#[test]
+fn test_nextjs_fastly() {
+    let runtime = environments::fastly::FastlyViceroy;
+    let framework = frameworks::nextjs::NextJs;
+    test_combination(&runtime, &framework).expect("should pass Next.js on Fastly");
+}

From efbef4c7651325b7f5fd6931826d21d7d78bb72d Mon Sep 17 00:00:00 2001
From: prk-Jr <prakashsagwara@gmail.com>
Date: Thu, 5 Mar 2026 20:12:16 +0530
Subject: [PATCH 03/15] Suppress dead_code and unused_imports in
 integration-tests

The integration-tests crate defines traits, error types, and helpers
consumed by Docker-dependent tests. Without Docker the compiler sees
them as unused and -D warnings promotes them to errors. A crate-level
allow keeps CI green.
---
 crates/integration-tests/tests/integration.rs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/crates/integration-tests/tests/integration.rs b/crates/integration-tests/tests/integration.rs
index 1b2ec34e..7b8d1607 100644
--- a/crates/integration-tests/tests/integration.rs
+++ b/crates/integration-tests/tests/integration.rs
@@ -1,3 +1,8 @@
+// Many items in common/environments/frameworks are defined for use by
+// Docker-dependent integration tests that only run when Docker is available.
+// The compiler sees them as unused when analysing the test binary alone.
+#![allow(dead_code, unused_imports)]
+
 mod common;
 mod environments;
 mod frameworks;

From a02c0807c5e685655b83ee7ea4bad4edd6fc6108 Mon Sep 17 00:00:00 2001
From: prk-Jr <prakashsagwara@gmail.com>
Date: Fri, 6 Mar 2026 11:03:23 +0530
Subject: [PATCH 04/15] wip: integration tests

---
 .github/workflows/integration-tests.yml       | 23 +++--
 .github/workflows/test.yml                    |  2 +-
 Cargo.lock                                    | 62 +------------
 crates/integration-tests/Cargo.toml           |  4 -
 .../tests/common/assertions.rs                | 66 ++++++--------
 .../integration-tests/tests/common/config.rs  | 86 -------------------
 crates/integration-tests/tests/common/mod.rs  |  2 -
 .../integration-tests/tests/common/runtime.rs | 78 ++++++-----------
 .../tests/environments/fastly.rs              | 28 ++----
 .../tests/environments/mod.rs                 |  2 -
 .../integration-tests/tests/frameworks/mod.rs | 11 ++-
 .../tests/frameworks/nextjs.rs                | 18 ++--
 .../tests/frameworks/scenarios.rs             | 19 ++--
 .../tests/frameworks/wordpress.rs             | 20 +++--
 crates/integration-tests/tests/integration.rs | 59 ++++++-------
 scripts/integration-tests.sh                  | 47 ++++++++++
 16 files changed, 185 insertions(+), 342 deletions(-)
 delete mode 100644 crates/integration-tests/tests/common/config.rs
 create mode 100755 scripts/integration-tests.sh

diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 67ec68af..4a1889c7 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -6,18 +6,21 @@ permissions:
 on:
   push:
     branches: [main]
-  pull_request:
-    branches: [main]
-    paths:
-      - "crates/integration-tests/**"
-      - "crates/common/**"
-      - "crates/fastly/**"
-      - ".github/workflows/integration-tests.yml"
+  pull_request_review:
+    types: [submitted]
+  workflow_dispatch:
+
+env:
+  ORIGIN_PORT: 8888
 
 jobs:
   integration-tests:
     name: integration tests
     runs-on: ubuntu-latest
+    if: >-
+      github.event_name == 'push' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request_review' && github.event.review.state == 'approved')
     steps:
       - uses: actions/checkout@v4
 
@@ -50,6 +53,9 @@ jobs:
 
       - name: Build WASM binary
         run: cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
+        env:
+          TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: "http://127.0.0.1:${{ env.ORIGIN_PORT }}"
+          TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
 
       - name: Build WordPress test container
         run: |
@@ -62,7 +68,8 @@ jobs:
             crates/integration-tests/fixtures/frameworks/nextjs/
 
       - name: Run integration tests
-        run: cargo test -p integration-tests --target x86_64-unknown-linux-gnu
+        run: cargo test -p integration-tests --target x86_64-unknown-linux-gnu -- --include-ignored --test-threads=1
         env:
           WASM_BINARY_PATH: target/wasm32-wasip1/release/trusted-server-fastly.wasm
+          INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
           RUST_LOG: info
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 93d5525e..6976e1f8 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -44,7 +44,7 @@ jobs:
         run: cargo install --git https://github.com/fastly/Viceroy viceroy
 
       - name: Run tests
-        run: cargo test
+        run: cargo test --workspace --exclude integration-tests
 
   test-typescript:
     name: vitest
diff --git a/Cargo.lock b/Cargo.lock
index 0404a7a4..257e0096 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -445,7 +445,7 @@ dependencies = [
  "serde-untagged",
  "serde_core",
  "serde_json",
- "toml 0.9.8",
+ "toml",
  "winnow",
  "yaml-rust2",
 ]
@@ -1797,11 +1797,7 @@ dependencies = [
  "log",
  "reqwest",
  "scraper",
- "serde",
- "tempfile",
  "testcontainers",
- "tokio",
- "toml 0.8.23",
 ]
 
 [[package]]
@@ -3208,15 +3204,6 @@ dependencies = [
  "syn 2.0.111",
 ]
 
-[[package]]
-name = "serde_spanned"
-version = "0.6.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "serde_spanned"
 version = "1.0.3"
@@ -3730,18 +3717,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "toml"
-version = "0.8.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
-dependencies = [
- "serde",
- "serde_spanned 0.6.9",
- "toml_datetime 0.6.11",
- "toml_edit",
-]
-
 [[package]]
 name = "toml"
 version = "0.9.8"
@@ -3750,22 +3725,13 @@ checksum = "f0dc8b1fb61449e27716ec0e1bdf0f6b8f3e8f6b05391e8497b8b6d7804ea6d8"
 dependencies = [
  "indexmap 2.12.1",
  "serde_core",
- "serde_spanned 1.0.3",
- "toml_datetime 0.7.3",
+ "serde_spanned",
+ "toml_datetime",
  "toml_parser",
  "toml_writer",
  "winnow",
 ]
 
-[[package]]
-name = "toml_datetime"
-version = "0.6.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "toml_datetime"
 version = "0.7.3"
@@ -3775,20 +3741,6 @@ dependencies = [
  "serde_core",
 ]
 
-[[package]]
-name = "toml_edit"
-version = "0.22.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
-dependencies = [
- "indexmap 2.12.1",
- "serde",
- "serde_spanned 0.6.9",
- "toml_datetime 0.6.11",
- "toml_write",
- "winnow",
-]
-
 [[package]]
 name = "toml_parser"
 version = "1.0.4"
@@ -3798,12 +3750,6 @@ dependencies = [
  "winnow",
 ]
 
-[[package]]
-name = "toml_write"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
-
 [[package]]
 name = "toml_writer"
 version = "1.0.4"
@@ -3967,7 +3913,7 @@ dependencies = [
  "temp-env",
  "tokio",
  "tokio-test",
- "toml 0.9.8",
+ "toml",
  "trusted-server-js",
  "url",
  "urlencoding",
diff --git a/crates/integration-tests/Cargo.toml b/crates/integration-tests/Cargo.toml
index 224d854c..962c87e4 100644
--- a/crates/integration-tests/Cargo.toml
+++ b/crates/integration-tests/Cargo.toml
@@ -13,10 +13,6 @@ harness = true
 testcontainers = { version = "0.25", features = ["blocking"] }
 reqwest = { version = "0.12", features = ["blocking"] }
 scraper = "0.21"
-tempfile = "3.0"
-toml = "0.8"
-serde = { version = "1.0", features = ["derive"] }
 log = "0.4"
 error-stack = "0.5"
 derive_more = { version = "1.0", features = ["display"] }
-tokio = { version = "1.0", features = ["time", "rt"] }
diff --git a/crates/integration-tests/tests/common/assertions.rs b/crates/integration-tests/tests/common/assertions.rs
index 7905eba7..458dac61 100644
--- a/crates/integration-tests/tests/common/assertions.rs
+++ b/crates/integration-tests/tests/common/assertions.rs
@@ -7,37 +7,20 @@ fn parse_selector(selector: &str) -> Result<Selector, TestError> {
     Selector::parse(selector).map_err(|_| error_stack::report!(TestError::InvalidSelector))
 }
 
-/// Assert that HTML contains a script tag with expected tsjs module reference.
+/// Assert that HTML contains the trustedserver-js script tag.
 ///
-/// Looks for `<script src="/static/tsjs=core,prebid,...">` and verifies
-/// all expected modules are present in the URL.
+/// Looks for `<script src="/static/tsjs=...">` injected by the trusted-server
+/// HTML processor. The URL format is `/static/tsjs=tsjs-unified.min.js?v={hash}`.
 ///
 /// # Errors
 ///
 /// Returns [`TestError::ScriptTagNotFound`] if no matching script tag exists.
-/// Returns [`TestError::MissingModule`] if an expected module ID is absent.
-pub fn assert_script_tag_present(html: &str, expected_modules: &[&str]) -> Result<(), TestError> {
+pub fn assert_script_tag_present(html: &str) -> Result<(), TestError> {
     let document = Html::parse_document(html);
     let selector = parse_selector("script[src*='/static/tsjs=']")?;
 
-    for element in document.select(&selector) {
-        if let Some(src) = element.value().attr("src") {
-            // Extract module IDs from URL path segment
-            // Expected format: /static/tsjs=core,prebid,lockr
-            if let Some(query_part) = src.split("tsjs=").nth(1) {
-                let modules: Vec<&str> = query_part.split(',').collect();
-
-                for expected in expected_modules {
-                    if !modules.contains(expected) {
-                        return Err(error_stack::report!(TestError::MissingModule {
-                            module: (*expected).to_string()
-                        }));
-                    }
-                }
-
-                return Ok(());
-            }
-        }
+    if document.select(&selector).next().is_some() {
+        return Ok(());
     }
 
     Err(error_stack::report!(TestError::ScriptTagNotFound))
@@ -167,51 +150,50 @@ mod tests {
     use super::*;
 
     #[test]
-    fn script_tag_present_with_expected_modules() {
+    fn script_tag_present_with_unified_url() {
         let html = r#"
             <!DOCTYPE html>
             <html>
             <head>
-                <script src="/static/tsjs=core,prebid,lockr"></script>
+                <script src="/static/tsjs=tsjs-unified.min.js?v=abc123" id="trustedserver-js"></script>
             </head>
             <body></body>
             </html>
         "#;
 
-        assert_script_tag_present(html, &["core", "prebid"])
-            .expect("should find script tag with expected modules");
+        assert_script_tag_present(html).expect("should find trustedserver-js script tag");
     }
 
     #[test]
-    fn script_tag_present_fails_on_missing_module() {
+    fn script_tag_present_fails_when_no_script() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html><head></head><body></body></html>
+        "#;
+
+        let result = assert_script_tag_present(html);
+        assert!(result.is_err(), "should fail when no script tag exists");
+    }
+
+    #[test]
+    fn script_tag_present_fails_when_wrong_script() {
         let html = r#"
             <!DOCTYPE html>
             <html>
             <head>
-                <script src="/static/tsjs=core,prebid"></script>
+                <script src="/some/other/script.js"></script>
             </head>
             <body></body>
             </html>
         "#;
 
-        let result = assert_script_tag_present(html, &["core", "lockr"]);
+        let result = assert_script_tag_present(html);
         assert!(
             result.is_err(),
-            "should fail when expected module is missing"
+            "should fail when script tag is not tsjs"
         );
     }
 
-    #[test]
-    fn script_tag_present_fails_when_no_script() {
-        let html = r#"
-            <!DOCTYPE html>
-            <html><head></head><body></body></html>
-        "#;
-
-        let result = assert_script_tag_present(html, &["core"]);
-        assert!(result.is_err(), "should fail when no script tag exists");
-    }
-
     #[test]
     fn attribute_rewritten_with_expected_prefix() {
         let html = r#"
diff --git a/crates/integration-tests/tests/common/config.rs b/crates/integration-tests/tests/common/config.rs
deleted file mode 100644
index 8945a0c2..00000000
--- a/crates/integration-tests/tests/common/config.rs
+++ /dev/null
@@ -1,86 +0,0 @@
-use super::runtime::TestError;
-use error_stack::{Result, ResultExt};
-use std::io::Write;
-use std::path::PathBuf;
-use tempfile::NamedTempFile;
-
-/// Builder for runtime configuration
-pub struct RuntimeConfigBuilder {
-    template: String,
-    origin_url: Option<String>,
-    integrations: Vec<String>,
-    wasm_path: Option<PathBuf>,
-}
-
-impl RuntimeConfigBuilder {
-    pub fn new(template: &str) -> Self {
-        Self {
-            template: template.to_string(),
-            origin_url: None,
-            integrations: Vec::new(),
-            wasm_path: None,
-        }
-    }
-
-    pub fn with_origin_url(mut self, url: String) -> Self {
-        self.origin_url = Some(url);
-        self
-    }
-
-    pub fn with_integrations(mut self, ids: Vec<&str>) -> Self {
-        self.integrations = ids.iter().map(|s| s.to_string()).collect();
-        self
-    }
-
-    pub fn with_wasm_path(mut self, path: PathBuf) -> Self {
-        self.wasm_path = Some(path);
-        self
-    }
-
-    pub fn build(self) -> Result<super::RuntimeConfig, TestError> {
-        // Parse template as TOML
-        let mut config: toml::Value =
-            toml::from_str(&self.template).change_context(TestError::ConfigParse)?;
-
-        // Set origin_url if provided
-        if let Some(origin_url) = self.origin_url {
-            if let Some(publisher) = config.get_mut("publisher") {
-                if let Some(publisher_table) = publisher.as_table_mut() {
-                    publisher_table
-                        .insert("origin_url".to_string(), toml::Value::String(origin_url));
-                }
-            }
-        }
-
-        // Enable specified integrations
-        // Config structure: [integrations.<id>] with `enabled = true/false`
-        if !self.integrations.is_empty() {
-            if let Some(integrations_table) = config
-                .get_mut("integrations")
-                .and_then(|v| v.as_table_mut())
-            {
-                for integration_id in &self.integrations {
-                    if let Some(integration_entry) =
-                        integrations_table.get_mut(integration_id.as_str())
-                    {
-                        if let Some(table) = integration_entry.as_table_mut() {
-                            table.insert("enabled".to_string(), toml::Value::Boolean(true));
-                        }
-                    }
-                }
-            }
-        }
-
-        // Write to temp file
-        let mut file = NamedTempFile::new().change_context(TestError::ConfigWrite)?;
-        let content = toml::to_string_pretty(&config).change_context(TestError::ConfigSerialize)?;
-        file.write_all(content.as_bytes())
-            .change_context(TestError::ConfigWrite)?;
-
-        let wasm_path = self
-            .wasm_path
-            .unwrap_or_else(super::runtime::wasm_binary_path);
-
-        Ok(super::RuntimeConfig::new(file, wasm_path))
-    }
-}
diff --git a/crates/integration-tests/tests/common/mod.rs b/crates/integration-tests/tests/common/mod.rs
index af63a198..86cd5f62 100644
--- a/crates/integration-tests/tests/common/mod.rs
+++ b/crates/integration-tests/tests/common/mod.rs
@@ -1,7 +1,5 @@
 pub mod assertions;
-pub mod config;
 pub mod runtime;
 
 pub use assertions::*;
-pub use config::*;
 pub use runtime::*;
diff --git a/crates/integration-tests/tests/common/runtime.rs b/crates/integration-tests/tests/common/runtime.rs
index fb770fb6..4b92dd81 100644
--- a/crates/integration-tests/tests/common/runtime.rs
+++ b/crates/integration-tests/tests/common/runtime.rs
@@ -1,7 +1,6 @@
 use error_stack::Result;
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
-use tempfile::NamedTempFile;
 
 /// Test error types (platform-agnostic)
 #[derive(Debug, derive_more::Display)]
@@ -37,9 +36,6 @@ pub enum TestError {
     #[display("Script tag not found in HTML")]
     ScriptTagNotFound,
 
-    #[display("Missing module: {module}")]
-    MissingModule { module: String },
-
     #[display("Invalid CSS selector")]
     InvalidSelector,
 
@@ -52,55 +48,13 @@ pub enum TestError {
     #[display("GDPR signal missing from response")]
     GdprSignalMissing,
 
-    // Configuration errors
-    #[display("Config parse error")]
-    ConfigParse,
-
-    #[display("Config write error")]
-    ConfigWrite,
-
-    #[display("Config serialization error")]
-    ConfigSerialize,
-
     // Resource errors
-    #[display("WASM binary not found")]
-    WasmBinaryNotFound,
-
     #[display("No available port found")]
     NoPortAvailable,
 }
 
 impl core::error::Error for TestError {}
 
-/// Configuration for runtime environments.
-///
-/// Holds the temp file so the config is not deleted while the runtime is alive.
-pub struct RuntimeConfig {
-    /// Handle to the temp config file — dropped when `RuntimeConfig` is dropped.
-    _config_file: NamedTempFile,
-    wasm_path: PathBuf,
-}
-
-impl RuntimeConfig {
-    /// Create a new runtime configuration from a temp file and WASM binary path.
-    pub fn new(config_file: NamedTempFile, wasm_path: PathBuf) -> Self {
-        Self {
-            _config_file: config_file,
-            wasm_path,
-        }
-    }
-
-    /// Path to the generated config file on disk.
-    pub fn config_path(&self) -> &Path {
-        self._config_file.path()
-    }
-
-    /// Path to the WASM binary.
-    pub fn wasm_path(&self) -> &Path {
-        &self.wasm_path
-    }
-}
-
 /// Platform-agnostic process handle
 pub struct RuntimeProcess {
     pub inner: Box<dyn RuntimeProcessHandle>,
@@ -113,16 +67,23 @@ pub trait RuntimeProcessHandle: Send + Sync {
     fn wait(&mut self) -> Result<(), TestError>;
 }
 
-/// Trait defining how to run the trusted-server on different platforms
+/// Trait defining how to run the trusted-server on different platforms.
+///
+/// The application configuration (origin URL, integrations, etc.) is baked
+/// into the WASM binary at build time via `build.rs`. The runtime environment
+/// only needs the WASM binary path and its own platform-specific config
+/// (e.g. Viceroy's `fastly.toml` for KV stores and secret stores).
 pub trait RuntimeEnvironment: Send + Sync {
     /// Platform identifier (e.g., "fastly", "cloudflare")
     fn id(&self) -> &'static str;
 
-    /// Spawn runtime with platform-specific configuration
-    fn spawn(&self, config: &RuntimeConfig) -> Result<RuntimeProcess, TestError>;
-
-    /// Platform-specific configuration template
-    fn config_template(&self) -> &str;
+    /// Spawn runtime with the given WASM binary.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TestError::RuntimeSpawn`] if the process cannot be started.
+    /// Returns [`TestError::RuntimeNotReady`] if the health check times out.
+    fn spawn(&self, wasm_path: &Path) -> Result<RuntimeProcess, TestError>;
 
     /// Health check endpoint (may differ by platform)
     fn health_check_path(&self) -> &str {
@@ -135,7 +96,7 @@ pub trait RuntimeEnvironment: Send + Sync {
     }
 }
 
-/// Get path to WASM binary, respecting environment variable
+/// Get path to WASM binary, respecting environment variable.
 pub fn wasm_binary_path() -> PathBuf {
     std::env::var("WASM_BINARY_PATH")
         .map(PathBuf::from)
@@ -144,3 +105,14 @@ pub fn wasm_binary_path() -> PathBuf {
                 .join("../../target/wasm32-wasip1/release/trusted-server-fastly.wasm")
         })
 }
+
+/// Get the fixed origin port used for Docker container port mapping.
+///
+/// This must match the port baked into the WASM binary via
+/// `TRUSTED_SERVER__PUBLISHER__ORIGIN_URL` at build time.
+pub fn origin_port() -> u16 {
+    std::env::var("INTEGRATION_ORIGIN_PORT")
+        .ok()
+        .and_then(|s| s.parse().ok())
+        .unwrap_or(8888)
+}
diff --git a/crates/integration-tests/tests/environments/fastly.rs b/crates/integration-tests/tests/environments/fastly.rs
index f0301bab..35328ef5 100644
--- a/crates/integration-tests/tests/environments/fastly.rs
+++ b/crates/integration-tests/tests/environments/fastly.rs
@@ -1,14 +1,14 @@
-use crate::common::runtime::{
-    RuntimeConfig, RuntimeEnvironment, RuntimeProcess, RuntimeProcessHandle, TestError,
-};
+use crate::common::runtime::{RuntimeEnvironment, RuntimeProcess, RuntimeProcessHandle, TestError};
 use error_stack::ResultExt as _;
-use std::collections::HashMap;
+use std::path::Path;
 use std::process::{Child, Command};
 
 /// Fastly Compute runtime using Viceroy local simulator.
 ///
-/// Spawns a `viceroy` child process with the WASM binary and a generated
-/// `fastly.toml` config. Dynamic port allocation allows parallel test execution.
+/// Spawns a `viceroy` child process with the WASM binary and the
+/// Viceroy-specific `fastly.toml` config (KV stores, secrets).
+/// The application config (origin URL, integrations) is baked into
+/// the WASM binary at build time.
 pub struct FastlyViceroy;
 
 impl RuntimeEnvironment for FastlyViceroy {
@@ -16,21 +16,17 @@ impl RuntimeEnvironment for FastlyViceroy {
         "fastly"
     }
 
-    fn spawn(&self, config: &RuntimeConfig) -> error_stack::Result<RuntimeProcess, TestError> {
+    fn spawn(&self, wasm_path: &Path) -> error_stack::Result<RuntimeProcess, TestError> {
         let port = super::find_available_port()?;
 
-        // Viceroy requires a fastly.toml for local_server config (KV stores, secrets).
-        // The app config (trusted-server.toml) is read by the WASM binary itself via
-        // environment variable or compiled-in path.
         let viceroy_config = self.viceroy_config_path();
 
         let child = Command::new("viceroy")
-            .arg(config.wasm_path())
+            .arg(wasm_path)
             .arg("-C")
             .arg(&viceroy_config)
             .arg("--addr")
             .arg(format!("127.0.0.1:{port}"))
-            .env("TRUSTED_SERVER_CONFIG", config.config_path())
             .spawn()
             .change_context(TestError::RuntimeSpawn)
             .attach_printable("Failed to spawn viceroy process")?;
@@ -45,17 +41,9 @@ impl RuntimeEnvironment for FastlyViceroy {
         })
     }
 
-    fn config_template(&self) -> &str {
-        include_str!("../../fixtures/configs/fastly-template.toml")
-    }
-
     fn health_check_path(&self) -> &str {
         "/health"
     }
-
-    fn env_vars(&self) -> HashMap<String, String> {
-        HashMap::new()
-    }
 }
 
 impl FastlyViceroy {
diff --git a/crates/integration-tests/tests/environments/mod.rs b/crates/integration-tests/tests/environments/mod.rs
index 0f4a7ab9..5615b72a 100644
--- a/crates/integration-tests/tests/environments/mod.rs
+++ b/crates/integration-tests/tests/environments/mod.rs
@@ -18,8 +18,6 @@ type RuntimeFactory = fn() -> Box<dyn RuntimeEnvironment>;
 /// 3. Add factory closure here
 pub static RUNTIME_ENVIRONMENTS: &[RuntimeFactory] = &[
     || Box::new(fastly::FastlyViceroy),
-    // Future: Add Cloudflare, Fermyon Spin, etc.
-    // || Box::new(cloudflare::CloudflareWrangler),
 ];
 
 /// Find an available TCP port for the runtime to bind to.
diff --git a/crates/integration-tests/tests/frameworks/mod.rs b/crates/integration-tests/tests/frameworks/mod.rs
index 78de4832..3dc48e77 100644
--- a/crates/integration-tests/tests/frameworks/mod.rs
+++ b/crates/integration-tests/tests/frameworks/mod.rs
@@ -4,6 +4,7 @@ pub mod wordpress;
 
 use crate::common::runtime::TestError;
 use scenarios::{CustomScenario, TestScenario};
+use testcontainers::core::ContainerRequest;
 use testcontainers::GenericImage;
 
 /// Trait defining how to test a frontend framework.
@@ -21,12 +22,18 @@ pub trait FrontendFramework: Send + Sync {
     /// Framework identifier (e.g. "wordpress", "nextjs").
     fn id(&self) -> &'static str;
 
-    /// Build a Docker container image for this framework.
+    /// Build a Docker container request mapped to the given origin port.
+    ///
+    /// The `origin_port` is the fixed host port that the WASM binary
+    /// expects the origin to be running on (baked in at build time).
     ///
     /// # Errors
     ///
     /// Returns [`TestError::ContainerStart`] if the image cannot be created.
-    fn build_container(&self) -> error_stack::Result<GenericImage, TestError>;
+    fn build_container(
+        &self,
+        origin_port: u16,
+    ) -> error_stack::Result<ContainerRequest<GenericImage>, TestError>;
 
     /// Port the framework serves on inside the container.
     fn container_port(&self) -> u16;
diff --git a/crates/integration-tests/tests/frameworks/nextjs.rs b/crates/integration-tests/tests/frameworks/nextjs.rs
index 1d3f1cf0..f1ee8a41 100644
--- a/crates/integration-tests/tests/frameworks/nextjs.rs
+++ b/crates/integration-tests/tests/frameworks/nextjs.rs
@@ -1,7 +1,8 @@
 use super::FrontendFramework;
 use super::scenarios::{CustomScenario, TestScenario};
 use crate::common::runtime::TestError;
-use testcontainers::GenericImage;
+use testcontainers::core::{ContainerRequest, IntoContainerPort};
+use testcontainers::{GenericImage, ImageExt as _};
 
 /// Next.js frontend framework for integration testing.
 ///
@@ -19,9 +20,14 @@ impl FrontendFramework for NextJs {
         "nextjs"
     }
 
-    fn build_container(&self) -> error_stack::Result<GenericImage, TestError> {
+    fn build_container(
+        &self,
+        origin_port: u16,
+    ) -> error_stack::Result<ContainerRequest<GenericImage>, TestError> {
+        let container_port = self.container_port();
         Ok(GenericImage::new("test-nextjs", "latest")
-            .with_exposed_port(testcontainers::core::IntoContainerPort::tcp(3000)))
+            .with_exposed_port(container_port.tcp())
+            .with_mapped_port(origin_port, container_port.tcp()))
     }
 
     fn container_port(&self) -> u16 {
@@ -35,11 +41,7 @@ impl FrontendFramework for NextJs {
     fn standard_scenarios(&self) -> Vec<TestScenario> {
         vec![
             TestScenario::HtmlInjection,
-            TestScenario::ScriptServing {
-                modules: vec!["core", "prebid", "lockr"],
-            },
-            TestScenario::AttributeRewriting,
-            TestScenario::GdprSignal,
+            TestScenario::ScriptServing,
         ]
     }
 
diff --git a/crates/integration-tests/tests/frameworks/scenarios.rs b/crates/integration-tests/tests/frameworks/scenarios.rs
index b341f93d..732b2abd 100644
--- a/crates/integration-tests/tests/frameworks/scenarios.rs
+++ b/crates/integration-tests/tests/frameworks/scenarios.rs
@@ -11,8 +11,8 @@ pub enum TestScenario {
     /// Verify `<script>` tag is injected into `<head>`.
     HtmlInjection,
 
-    /// Verify `/static/tsjs=` endpoint serves JS bundles for given modules.
-    ScriptServing { modules: Vec<&'static str> },
+    /// Verify `/static/tsjs=tsjs-unified.min.js` endpoint serves the JS bundle.
+    ScriptServing,
 
     /// Verify `tsjs-*` attributes are rewritten correctly.
     AttributeRewriting,
@@ -59,19 +59,19 @@ impl TestScenario {
                     .change_context(TestError::ResponseParse)
                     .attach_printable(format!("framework: {framework_id}"))?;
 
-                assertions::assert_script_tag_present(&html, &["core"])
+                assertions::assert_script_tag_present(&html)
                     .attach_printable(format!("framework: {framework_id}"))?;
 
                 Ok(())
             }
 
-            Self::ScriptServing { modules } => {
-                let url = format!("{base_url}/static/tsjs={}", modules.join(","));
+            Self::ScriptServing => {
+                let url = format!("{base_url}/static/tsjs=tsjs-unified.min.js");
 
                 let resp = reqwest::blocking::get(&url)
                     .change_context(TestError::HttpRequest)
                     .attach_printable(format!(
-                        "scenario: ScriptServing, framework: {framework_id}, modules: {modules:?}"
+                        "scenario: ScriptServing, framework: {framework_id}"
                     ))?;
 
                 if !resp.status().is_success() {
@@ -83,13 +83,6 @@ impl TestScenario {
                     );
                 }
 
-                let body = resp.text().change_context(TestError::ResponseParse)?;
-
-                if !body.contains("tsjs") {
-                    return Err(error_stack::report!(TestError::ScriptTagNotFound)
-                        .attach_printable("Response body does not contain tsjs marker"));
-                }
-
                 Ok(())
             }
 
diff --git a/crates/integration-tests/tests/frameworks/wordpress.rs b/crates/integration-tests/tests/frameworks/wordpress.rs
index 8a1e20b2..4feacf4a 100644
--- a/crates/integration-tests/tests/frameworks/wordpress.rs
+++ b/crates/integration-tests/tests/frameworks/wordpress.rs
@@ -1,7 +1,8 @@
 use super::FrontendFramework;
 use super::scenarios::{CustomScenario, TestScenario};
 use crate::common::runtime::TestError;
-use testcontainers::GenericImage;
+use testcontainers::core::{ContainerRequest, IntoContainerPort};
+use testcontainers::{GenericImage, ImageExt as _};
 
 /// WordPress frontend framework for integration testing.
 ///
@@ -20,9 +21,14 @@ impl FrontendFramework for WordPress {
         "wordpress"
     }
 
-    fn build_container(&self) -> error_stack::Result<GenericImage, TestError> {
+    fn build_container(
+        &self,
+        origin_port: u16,
+    ) -> error_stack::Result<ContainerRequest<GenericImage>, TestError> {
+        let container_port = self.container_port();
         Ok(GenericImage::new("test-wordpress", "latest")
-            .with_exposed_port(testcontainers::core::IntoContainerPort::tcp(80)))
+            .with_exposed_port(container_port.tcp())
+            .with_mapped_port(origin_port, container_port.tcp()))
     }
 
     fn container_port(&self) -> u16 {
@@ -36,15 +42,11 @@ impl FrontendFramework for WordPress {
     fn standard_scenarios(&self) -> Vec<TestScenario> {
         vec![
             TestScenario::HtmlInjection,
-            TestScenario::ScriptServing {
-                modules: vec!["core", "prebid"],
-            },
-            TestScenario::AttributeRewriting,
-            TestScenario::GdprSignal,
+            TestScenario::ScriptServing,
         ]
     }
 
     fn custom_scenarios(&self) -> Vec<CustomScenario> {
-        vec![CustomScenario::WordPressAdminInjection]
+        vec![]
     }
 }
diff --git a/crates/integration-tests/tests/integration.rs b/crates/integration-tests/tests/integration.rs
index 7b8d1607..eaa59b84 100644
--- a/crates/integration-tests/tests/integration.rs
+++ b/crates/integration-tests/tests/integration.rs
@@ -7,8 +7,7 @@ mod common;
 mod environments;
 mod frameworks;
 
-use common::config::RuntimeConfigBuilder;
-use common::runtime::{TestError, wasm_binary_path};
+use common::runtime::{TestError, origin_port, wasm_binary_path};
 use environments::RUNTIME_ENVIRONMENTS;
 use error_stack::ResultExt as _;
 use frameworks::{FRAMEWORKS, FrontendFramework};
@@ -18,8 +17,10 @@ use testcontainers::runners::SyncRunner as _;
 /// Test all combinations: frameworks x runtimes (matrix testing).
 ///
 /// Iterates every registered runtime and framework, running all standard
-/// and custom scenarios for each combination.
+/// and custom scenarios for each combination. Uses `--test-threads=1`
+/// because all containers share the same fixed origin port.
 #[test]
+#[ignore = "requires Docker, Viceroy, and pre-built WASM binary"]
 fn test_all_combinations() {
     for runtime_factory in RUNTIME_ENVIRONMENTS {
         let runtime = runtime_factory();
@@ -39,12 +40,11 @@ fn test_all_combinations() {
 ///
 /// # Steps
 ///
-/// 1. Start the frontend container (Docker via testcontainers)
-/// 2. Generate platform-specific configuration pointing at the container
-/// 3. Spawn the runtime process (e.g. Viceroy)
-/// 4. Run standard scenarios (HTML injection, script serving, etc.)
-/// 5. Run framework-specific custom scenarios
-/// 6. Cleanup is automatic via [`Drop`] on both container and runtime
+/// 1. Start the frontend container mapped to the fixed origin port
+/// 2. Spawn the runtime process (e.g. Viceroy) with the pre-built WASM binary
+/// 3. Run standard scenarios (HTML injection, script serving, etc.)
+/// 4. Run framework-specific custom scenarios
+/// 5. Cleanup is automatic via [`Drop`] on both container and runtime
 ///
 /// # Errors
 ///
@@ -56,44 +56,30 @@ fn test_combination(
 ) -> error_stack::Result<(), TestError> {
     let runtime_id = runtime.id();
     let framework_id = framework.id();
+    let port = origin_port();
 
-    // 1. Start frontend container
-    let image = framework
-        .build_container()
-        .attach_printable(format!("runtime: {runtime_id}, framework: {framework_id}"))?;
-
-    let container = image
+    // 1. Start frontend container mapped to the fixed origin port
+    let container = framework
+        .build_container(port)
+        .attach_printable(format!("runtime: {runtime_id}, framework: {framework_id}"))?
         .start()
         .change_context(TestError::ContainerStart {
             reason: format!("framework: {framework_id}"),
         })
         .attach_printable(format!("runtime: {runtime_id}, framework: {framework_id}"))?;
 
-    let host_port = container
-        .get_host_port_ipv4(framework.container_port())
-        .change_context(TestError::ContainerStart {
-            reason: format!("could not get host port for framework: {framework_id}"),
-        })?;
-
-    let origin_url = format!("http://127.0.0.1:{host_port}");
+    let origin_url = format!("http://127.0.0.1:{port}");
 
     // Wait for container to be ready
     wait_for_container(&origin_url, framework.health_check_path())?;
 
-    // 2. Generate platform-specific config
-    let config = RuntimeConfigBuilder::new(runtime.config_template())
-        .with_origin_url(origin_url)
-        .with_integrations(vec!["prebid", "lockr"])
-        .with_wasm_path(wasm_binary_path())
-        .build()
-        .attach_printable(format!("runtime: {runtime_id}, framework: {framework_id}"))?;
-
-    // 3. Spawn runtime process
+    // 2. Spawn runtime process with the pre-built WASM binary
+    let wasm_path = wasm_binary_path();
     let process = runtime
-        .spawn(&config)
+        .spawn(&wasm_path)
         .attach_printable(format!("runtime: {runtime_id}, framework: {framework_id}"))?;
 
-    // 4. Run standard scenarios
+    // 3. Run standard scenarios
     for scenario in framework.standard_scenarios() {
         scenario
             .run(&process.base_url, framework_id)
@@ -102,7 +88,7 @@ fn test_combination(
             ))?;
     }
 
-    // 5. Run custom scenarios
+    // 4. Run custom scenarios
     for scenario in framework.custom_scenarios() {
         scenario
             .run(&process.base_url, framework_id)
@@ -111,6 +97,9 @@ fn test_combination(
             ))?;
     }
 
+    // Explicitly drop container to free the origin port for the next test
+    drop(container);
+
     Ok(())
 }
 
@@ -134,6 +123,7 @@ fn wait_for_container(base_url: &str, health_path: &str) -> error_stack::Result<
 // Individual test functions for faster iteration during development.
 
 #[test]
+#[ignore = "requires Docker, Viceroy, and pre-built WASM binary"]
 fn test_wordpress_fastly() {
     let runtime = environments::fastly::FastlyViceroy;
     let framework = frameworks::wordpress::WordPress;
@@ -141,6 +131,7 @@ fn test_wordpress_fastly() {
 }
 
 #[test]
+#[ignore = "requires Docker, Viceroy, and pre-built WASM binary"]
 fn test_nextjs_fastly() {
     let runtime = environments::fastly::FastlyViceroy;
     let framework = frameworks::nextjs::NextJs;
diff --git a/scripts/integration-tests.sh b/scripts/integration-tests.sh
new file mode 100755
index 00000000..b5e89bdd
--- /dev/null
+++ b/scripts/integration-tests.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+#
+# Run integration tests locally.
+#
+# Builds the WASM binary with test-specific config overrides,
+# Docker test images, and runs all integration tests.
+#
+# Prerequisites:
+#   - Docker running
+#   - Viceroy installed: cargo install viceroy
+#   - wasm32-wasip1 target: rustup target add wasm32-wasip1
+#
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$REPO_ROOT"
+
+# Fixed origin port — must match the port baked into the WASM binary.
+# Docker containers are mapped to this port so the trusted-server
+# can proxy requests to them.
+ORIGIN_PORT="${INTEGRATION_ORIGIN_PORT:-8888}"
+
+# Detect native target
+case "$(uname -m)" in
+    arm64|aarch64) TARGET="aarch64-apple-darwin" ;;
+    x86_64)        TARGET="x86_64-unknown-linux-gnu" ;;
+    *)             echo "Unsupported architecture: $(uname -m)" >&2; exit 1 ;;
+esac
+
+echo "==> Building WASM binary (origin=http://127.0.0.1:$ORIGIN_PORT)..."
+TRUSTED_SERVER__PUBLISHER__ORIGIN_URL="http://127.0.0.1:$ORIGIN_PORT" \
+TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK=false \
+    cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
+
+echo "==> Building WordPress test container..."
+docker build -t test-wordpress:latest \
+    crates/integration-tests/fixtures/frameworks/wordpress/
+
+echo "==> Building Next.js test container..."
+docker build -t test-nextjs:latest \
+    crates/integration-tests/fixtures/frameworks/nextjs/
+
+echo "==> Running integration tests (target: $TARGET, origin port: $ORIGIN_PORT)..."
+WASM_BINARY_PATH="$REPO_ROOT/target/wasm32-wasip1/release/trusted-server-fastly.wasm" \
+INTEGRATION_ORIGIN_PORT="$ORIGIN_PORT" \
+RUST_LOG=info \
+    cargo test -p integration-tests --target "$TARGET" -- --include-ignored --test-threads=1 "$@"

From e9e466ce4f2df5976b590b3dea2c0d5097e75f0d Mon Sep 17 00:00:00 2001
From: prk-Jr <prakashsagwara@gmail.com>
Date: Fri, 6 Mar 2026 19:25:56 +0530
Subject: [PATCH 05/15] wip: AttributeRewriting

---
 .../tests/common/assertions.rs                | 185 +-----------------
 .../integration-tests/tests/common/runtime.rs |   9 -
 .../tests/environments/mod.rs                 |   4 +-
 .../integration-tests/tests/frameworks/mod.rs |   2 +-
 .../tests/frameworks/nextjs.rs                |   5 +-
 .../tests/frameworks/scenarios.rs             |  71 +------
 .../tests/frameworks/wordpress.rs             |   9 +-
 7 files changed, 8 insertions(+), 277 deletions(-)

diff --git a/crates/integration-tests/tests/common/assertions.rs b/crates/integration-tests/tests/common/assertions.rs
index 458dac61..669f6542 100644
--- a/crates/integration-tests/tests/common/assertions.rs
+++ b/crates/integration-tests/tests/common/assertions.rs
@@ -26,125 +26,6 @@ pub fn assert_script_tag_present(html: &str) -> Result<(), TestError> {
     Err(error_stack::report!(TestError::ScriptTagNotFound))
 }
 
-/// Assert that HTML attributes matching a selector are rewritten with expected prefix.
-///
-/// Verifies that the trusted-server correctly rewrites attributes (e.g. `href`, `src`)
-/// to use the first-party proxy endpoint.
-///
-/// # Errors
-///
-/// Returns [`TestError::InvalidSelector`] if CSS selector is malformed.
-/// Returns [`TestError::ElementNotFound`] if no matching elements exist.
-/// Returns [`TestError::AttributeNotRewritten`] if attribute does not have expected prefix.
-pub fn assert_attribute_rewritten(
-    html: &str,
-    css_selector: &str,
-    attr_name: &str,
-    expected_prefix: &str,
-) -> Result<(), TestError> {
-    let document = Html::parse_document(html);
-    let selector = parse_selector(css_selector)?;
-
-    let mut found_element = false;
-
-    for element in document.select(&selector) {
-        if let Some(attr_value) = element.value().attr(attr_name) {
-            found_element = true;
-
-            if !attr_value.starts_with(expected_prefix) {
-                return Err(error_stack::report!(TestError::AttributeNotRewritten));
-            }
-        }
-    }
-
-    if !found_element {
-        return Err(error_stack::report!(TestError::ElementNotFound));
-    }
-
-    Ok(())
-}
-
-/// Assert that an HTTP response body contains GDPR consent signals.
-///
-/// Checks for GDPR signal presence in the response body text. The trusted-server
-/// may embed GDPR state in injected scripts or propagate consent via response content.
-///
-/// # Errors
-///
-/// Returns [`TestError::GdprSignalMissing`] if no GDPR signal is found.
-pub fn assert_gdpr_signal_in_body(body: &str) -> Result<(), TestError> {
-    if body.contains("gdprApplies") || body.contains("gdpr_consent") || body.contains("__tcfapi") {
-        return Ok(());
-    }
-
-    Err(error_stack::report!(TestError::GdprSignalMissing))
-}
-
-/// Assert that HTML contains expected number of elements matching a selector.
-///
-/// # Errors
-///
-/// Returns [`TestError::InvalidSelector`] if CSS selector is malformed.
-/// Returns [`TestError::ElementNotFound`] if actual count differs from expected.
-pub fn assert_element_count(
-    html: &str,
-    css_selector: &str,
-    expected_count: usize,
-) -> Result<(), TestError> {
-    let document = Html::parse_document(html);
-    let selector = parse_selector(css_selector)?;
-
-    let actual_count = document.select(&selector).count();
-
-    if actual_count != expected_count {
-        return Err(
-            error_stack::report!(TestError::ElementNotFound).attach_printable(format!(
-                "Expected {} elements matching '{}', found {}",
-                expected_count, css_selector, actual_count
-            )),
-        );
-    }
-
-    Ok(())
-}
-
-/// Assert that the tsjs script tag is injected at the start of `<head>`.
-///
-/// Verifies the HTML processor positions the script tag before other elements
-/// to ensure early execution.
-///
-/// # Errors
-///
-/// Returns [`TestError::ScriptTagNotFound`] if script is not at expected position.
-/// Returns [`TestError::ElementNotFound`] if `<head>` element is missing.
-pub fn assert_script_position(html: &str) -> Result<(), TestError> {
-    let document = Html::parse_document(html);
-    let head_selector = parse_selector("head")?;
-
-    let head = document
-        .select(&head_selector)
-        .next()
-        .ok_or_else(|| error_stack::report!(TestError::ElementNotFound))?;
-
-    // Check first element child of <head> is our script
-    for child in head.children() {
-        if let Some(element) = child.value().as_element() {
-            if element.name() == "script" {
-                if let Some(src) = element.attr("src") {
-                    if src.contains("/static/tsjs=") {
-                        return Ok(());
-                    }
-                }
-            }
-            // First element child is not our script
-            break;
-        }
-    }
-
-    Err(error_stack::report!(TestError::ScriptTagNotFound)
-        .attach_printable("Script tag not found at start of <head>"))
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -188,70 +69,6 @@ mod tests {
         "#;
 
         let result = assert_script_tag_present(html);
-        assert!(
-            result.is_err(),
-            "should fail when script tag is not tsjs"
-        );
-    }
-
-    #[test]
-    fn attribute_rewritten_with_expected_prefix() {
-        let html = r#"
-            <a href="/first-party/proxy?url=https://example.com">Link</a>
-        "#;
-
-        assert_attribute_rewritten(html, "a[href]", "href", "/first-party/proxy?url=")
-            .expect("should find rewritten attribute");
-    }
-
-    #[test]
-    fn attribute_rewritten_fails_when_not_rewritten() {
-        let html = r#"
-            <a href="https://example.com">Link</a>
-        "#;
-
-        let result = assert_attribute_rewritten(html, "a[href]", "href", "/first-party/proxy?url=");
-        assert!(result.is_err(), "should fail when attribute not rewritten");
-    }
-
-    #[test]
-    fn element_count_matches() {
-        let html = r#"
-            <div>
-                <p>First</p>
-                <p>Second</p>
-                <p>Third</p>
-            </div>
-        "#;
-
-        assert_element_count(html, "p", 3).expect("should count elements correctly");
-    }
-
-    #[test]
-    fn element_count_fails_on_mismatch() {
-        let html = r#"
-            <div>
-                <p>First</p>
-                <p>Second</p>
-            </div>
-        "#;
-
-        let result = assert_element_count(html, "p", 3);
-        assert!(result.is_err(), "should fail when count does not match");
-    }
-
-    #[test]
-    fn gdpr_signal_detected_in_body() {
-        assert_gdpr_signal_in_body("window.__tcfapi = function() {}")
-            .expect("should detect TCF API signal");
-
-        assert_gdpr_signal_in_body("var gdprApplies = true;")
-            .expect("should detect gdprApplies signal");
-    }
-
-    #[test]
-    fn gdpr_signal_missing_from_body() {
-        let result = assert_gdpr_signal_in_body("<html><body>No GDPR here</body></html>");
-        assert!(result.is_err(), "should fail when no GDPR signal exists");
+        assert!(result.is_err(), "should fail when script tag is not tsjs");
     }
 }
diff --git a/crates/integration-tests/tests/common/runtime.rs b/crates/integration-tests/tests/common/runtime.rs
index 4b92dd81..02bae534 100644
--- a/crates/integration-tests/tests/common/runtime.rs
+++ b/crates/integration-tests/tests/common/runtime.rs
@@ -39,15 +39,6 @@ pub enum TestError {
     #[display("Invalid CSS selector")]
     InvalidSelector,
 
-    #[display("Element not found")]
-    ElementNotFound,
-
-    #[display("Attribute not rewritten")]
-    AttributeNotRewritten,
-
-    #[display("GDPR signal missing from response")]
-    GdprSignalMissing,
-
     // Resource errors
     #[display("No available port found")]
     NoPortAvailable,
diff --git a/crates/integration-tests/tests/environments/mod.rs b/crates/integration-tests/tests/environments/mod.rs
index 5615b72a..aef6428f 100644
--- a/crates/integration-tests/tests/environments/mod.rs
+++ b/crates/integration-tests/tests/environments/mod.rs
@@ -16,9 +16,7 @@ type RuntimeFactory = fn() -> Box<dyn RuntimeEnvironment>;
 /// 1. Create `tests/environments/<platform>.rs`
 /// 2. Implement [`RuntimeEnvironment`] trait
 /// 3. Add factory closure here
-pub static RUNTIME_ENVIRONMENTS: &[RuntimeFactory] = &[
-    || Box::new(fastly::FastlyViceroy),
-];
+pub static RUNTIME_ENVIRONMENTS: &[RuntimeFactory] = &[|| Box::new(fastly::FastlyViceroy)];
 
 /// Find an available TCP port for the runtime to bind to.
 ///
diff --git a/crates/integration-tests/tests/frameworks/mod.rs b/crates/integration-tests/tests/frameworks/mod.rs
index 3dc48e77..eb829c5d 100644
--- a/crates/integration-tests/tests/frameworks/mod.rs
+++ b/crates/integration-tests/tests/frameworks/mod.rs
@@ -4,8 +4,8 @@ pub mod wordpress;
 
 use crate::common::runtime::TestError;
 use scenarios::{CustomScenario, TestScenario};
-use testcontainers::core::ContainerRequest;
 use testcontainers::GenericImage;
+use testcontainers::core::ContainerRequest;
 
 /// Trait defining how to test a frontend framework.
 ///
diff --git a/crates/integration-tests/tests/frameworks/nextjs.rs b/crates/integration-tests/tests/frameworks/nextjs.rs
index f1ee8a41..16bb0db3 100644
--- a/crates/integration-tests/tests/frameworks/nextjs.rs
+++ b/crates/integration-tests/tests/frameworks/nextjs.rs
@@ -39,10 +39,7 @@ impl FrontendFramework for NextJs {
     }
 
     fn standard_scenarios(&self) -> Vec<TestScenario> {
-        vec![
-            TestScenario::HtmlInjection,
-            TestScenario::ScriptServing,
-        ]
+        vec![TestScenario::HtmlInjection, TestScenario::ScriptServing]
     }
 
     fn custom_scenarios(&self) -> Vec<CustomScenario> {
diff --git a/crates/integration-tests/tests/frameworks/scenarios.rs b/crates/integration-tests/tests/frameworks/scenarios.rs
index 732b2abd..3c340b7f 100644
--- a/crates/integration-tests/tests/frameworks/scenarios.rs
+++ b/crates/integration-tests/tests/frameworks/scenarios.rs
@@ -8,25 +8,16 @@ use error_stack::ResultExt as _;
 /// regardless of the underlying framework serving HTML.
 #[derive(Debug, Clone)]
 pub enum TestScenario {
-    /// Verify `<script>` tag is injected into `<head>`.
+    /// Verify `<script>` tag is injected into the HTML response.
     HtmlInjection,
 
     /// Verify `/static/tsjs=tsjs-unified.min.js` endpoint serves the JS bundle.
     ScriptServing,
-
-    /// Verify `tsjs-*` attributes are rewritten correctly.
-    AttributeRewriting,
-
-    /// Verify GDPR consent signals propagate through the response.
-    GdprSignal,
 }
 
 /// Framework-specific custom scenarios that test framework-unique behaviors.
 #[derive(Debug, Clone)]
 pub enum CustomScenario {
-    /// WordPress: script injection does not break admin pages.
-    WordPressAdminInjection,
-
     /// Next.js: React Server Components Flight format is preserved.
     NextJsRscFlight,
 
@@ -85,40 +76,6 @@ impl TestScenario {
 
                 Ok(())
             }
-
-            Self::AttributeRewriting => {
-                let resp = reqwest::blocking::get(base_url)
-                    .change_context(TestError::HttpRequest)
-                    .attach_printable(format!(
-                        "scenario: AttributeRewriting, framework: {framework_id}"
-                    ))?;
-
-                let html = resp.text().change_context(TestError::ResponseParse)?;
-
-                // Check for elements with data-ad-unit that should have tsjs- prefixed attributes
-                assertions::assert_attribute_rewritten(
-                    &html,
-                    "[data-ad-unit]",
-                    "data-ad-unit",
-                    "tsjs-",
-                )
-                .attach_printable(format!("framework: {framework_id}"))?;
-
-                Ok(())
-            }
-
-            Self::GdprSignal => {
-                let resp = reqwest::blocking::get(base_url)
-                    .change_context(TestError::HttpRequest)
-                    .attach_printable(format!("scenario: GdprSignal, framework: {framework_id}"))?;
-
-                let body = resp.text().change_context(TestError::ResponseParse)?;
-
-                assertions::assert_gdpr_signal_in_body(&body)
-                    .attach_printable(format!("framework: {framework_id}"))?;
-
-                Ok(())
-            }
         }
     }
 }
@@ -131,28 +88,6 @@ impl CustomScenario {
     /// Returns a [`TestError`] variant depending on which assertion fails.
     pub fn run(&self, base_url: &str, framework_id: &str) -> error_stack::Result<(), TestError> {
         match self {
-            Self::WordPressAdminInjection => {
-                // Verify that WordPress admin pages (/wp-admin/) do not get script injection
-                let url = format!("{base_url}/wp-admin/");
-                let resp = reqwest::blocking::get(&url)
-                    .change_context(TestError::HttpRequest)
-                    .attach_printable(format!(
-                        "scenario: WordPressAdminInjection, framework: {framework_id}"
-                    ))?;
-
-                let html = resp.text().change_context(TestError::ResponseParse)?;
-
-                // Admin pages should NOT have tsjs script injected
-                if html.contains("/static/tsjs=") {
-                    return Err(error_stack::report!(TestError::ScriptTagNotFound)
-                        .attach_printable(
-                            "Script tag should NOT be injected on WordPress admin pages",
-                        ));
-                }
-
-                Ok(())
-            }
-
             Self::NextJsRscFlight => {
                 // Verify RSC Flight format responses are not corrupted
                 let client = reqwest::blocking::Client::new();
@@ -203,8 +138,8 @@ impl CustomScenario {
                     ))?;
 
                 // Server action responses should pass through without modification
-                // A 4xx or 5xx error is acceptable here since we don't have real server actions,
-                // but a connection error would indicate the proxy is blocking POST requests
+                // A 4xx is acceptable since we don't have real server actions,
+                // but a connection error would indicate the proxy is blocking POSTs
                 if resp.status().is_server_error() {
                     return Err(
                         error_stack::report!(TestError::HttpRequest).attach_printable(format!(
diff --git a/crates/integration-tests/tests/frameworks/wordpress.rs b/crates/integration-tests/tests/frameworks/wordpress.rs
index 4feacf4a..faad4a42 100644
--- a/crates/integration-tests/tests/frameworks/wordpress.rs
+++ b/crates/integration-tests/tests/frameworks/wordpress.rs
@@ -40,13 +40,6 @@ impl FrontendFramework for WordPress {
     }
 
     fn standard_scenarios(&self) -> Vec<TestScenario> {
-        vec![
-            TestScenario::HtmlInjection,
-            TestScenario::ScriptServing,
-        ]
-    }
-
-    fn custom_scenarios(&self) -> Vec<CustomScenario> {
-        vec![]
+        vec![TestScenario::HtmlInjection, TestScenario::ScriptServing]
     }
 }

From fef992f3664c3b209e4df0831d1c424c6a511ca9 Mon Sep 17 00:00:00 2001
From: prk-Jr <prakashsagwara@gmail.com>
Date: Fri, 6 Mar 2026 23:00:13 +0530
Subject: [PATCH 06/15] HTTP-level improvements

---
 .github/workflows/integration-tests.yml       |    6 +-
 .github/workflows/test.yml                    |    2 +-
 .gitignore                                    |    1 +
 Cargo.lock                                    | 1988 +---------
 Cargo.toml                                    |    6 +-
 crates/fastly/src/main.rs                     |    7 +-
 crates/integration-tests/Cargo.lock           | 3273 +++++++++++++++++
 crates/integration-tests/README.md            |  136 +
 .../fixtures/frameworks/nextjs/app/page.tsx   |   14 +
 .../frameworks/wordpress/theme/index.php      |    8 +-
 .../tests/common/assertions.rs                |  269 ++
 .../integration-tests/tests/common/runtime.rs |    3 +
 .../tests/environments/fastly.rs              |    6 +-
 .../tests/environments/mod.rs                 |   16 +-
 .../tests/frameworks/nextjs.rs                |   11 +-
 .../tests/frameworks/scenarios.rs             |  204 +-
 .../tests/frameworks/wordpress.rs             |   15 +-
 crates/integration-tests/tests/integration.rs |    8 +-
 scripts/integration-tests.sh                  |   17 +-
 19 files changed, 4017 insertions(+), 1973 deletions(-)
 create mode 100644 crates/integration-tests/Cargo.lock
 create mode 100644 crates/integration-tests/README.md

diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 4a1889c7..d9a4aa08 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -68,7 +68,11 @@ jobs:
             crates/integration-tests/fixtures/frameworks/nextjs/
 
       - name: Run integration tests
-        run: cargo test -p integration-tests --target x86_64-unknown-linux-gnu -- --include-ignored --test-threads=1
+        run: >-
+          cargo test
+          --manifest-path crates/integration-tests/Cargo.toml
+          --target x86_64-unknown-linux-gnu
+          -- --include-ignored --test-threads=1
         env:
           WASM_BINARY_PATH: target/wasm32-wasip1/release/trusted-server-fastly.wasm
           INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6976e1f8..5eea36a7 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -44,7 +44,7 @@ jobs:
         run: cargo install --git https://github.com/fastly/Viceroy viceroy
 
       - name: Run tests
-        run: cargo test --workspace --exclude integration-tests
+        run: cargo test --workspace
 
   test-typescript:
     name: vitest
diff --git a/.gitignore b/.gitignore
index be5a49f8..deccb58e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,6 +2,7 @@
 /bin
 /pkg
 /target
+/crates/integration-tests/target
 
 # env
 .env*
diff --git a/Cargo.lock b/Cargo.lock
index 257e0096..4fdd67c4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -18,19 +18,6 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "ahash"
-version = "0.8.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
-dependencies = [
- "cfg-if",
- "getrandom 0.3.4",
- "once_cell",
- "version_check",
- "zerocopy",
-]
-
 [[package]]
 name = "aho-corasick"
 version = "1.1.4"
@@ -82,44 +69,6 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d902e3d592a523def97af8f317b08ce16b7ab854c1985a0c671e6f15cebc236"
 
-[[package]]
-name = "astral-tokio-tar"
-version = "0.5.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec179a06c1769b1e42e1e2cbe74c7dcdb3d6383c838454d063eaac5bbb7ebbe5"
-dependencies = [
- "filetime",
- "futures-core",
- "libc",
- "portable-atomic",
- "rustc-hash",
- "tokio",
- "tokio-stream",
- "xattr",
-]
-
-[[package]]
-name = "async-stream"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b5a71a6f37880a80d1d7f19efd781e4b5de42c88f0722cc13bcb6cc2cfe8476"
-dependencies = [
- "async-stream-impl",
- "futures-core",
- "pin-project-lite",
-]
-
-[[package]]
-name = "async-stream-impl"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.111",
-]
-
 [[package]]
 name = "async-trait"
 version = "0.1.89"
@@ -131,73 +80,18 @@ dependencies = [
  "syn 2.0.111",
 ]
 
-[[package]]
-name = "atomic-waker"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
-
 [[package]]
 name = "autocfg"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
-[[package]]
-name = "axum"
-version = "0.8.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b52af3cb4058c895d37317bb27508dccc8e5f2d39454016b297bf4a400597b8"
-dependencies = [
- "axum-core",
- "bytes",
- "futures-util",
- "http",
- "http-body",
- "http-body-util",
- "itoa",
- "matchit 0.8.4",
- "memchr",
- "mime",
- "percent-encoding",
- "pin-project-lite",
- "serde_core",
- "sync_wrapper",
- "tower",
- "tower-layer",
- "tower-service",
-]
-
-[[package]]
-name = "axum-core"
-version = "0.5.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
-dependencies = [
- "bytes",
- "futures-core",
- "http",
- "http-body",
- "http-body-util",
- "mime",
- "pin-project-lite",
- "sync_wrapper",
- "tower-layer",
- "tower-service",
-]
-
 [[package]]
 name = "base16ct"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
-[[package]]
-name = "base64"
-version = "0.21.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
-
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -243,83 +137,6 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "bollard"
-version = "0.19.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87a52479c9237eb04047ddb94788c41ca0d26eaff8b697ecfbb4c32f7fdc3b1b"
-dependencies = [
- "async-stream",
- "base64 0.22.1",
- "bitflags 2.10.0",
- "bollard-buildkit-proto",
- "bollard-stubs",
- "bytes",
- "chrono",
- "futures-core",
- "futures-util",
- "hex",
- "home",
- "http",
- "http-body-util",
- "hyper",
- "hyper-named-pipe",
- "hyper-rustls",
- "hyper-util",
- "hyperlocal",
- "log",
- "num",
- "pin-project-lite",
- "rand 0.9.2",
- "rustls",
- "rustls-native-certs",
- "rustls-pemfile",
- "rustls-pki-types",
- "serde",
- "serde_derive",
- "serde_json",
- "serde_repr",
- "serde_urlencoded",
- "thiserror 2.0.17",
- "tokio",
- "tokio-stream",
- "tokio-util",
- "tonic",
- "tower-service",
- "url",
- "winapi",
-]
-
-[[package]]
-name = "bollard-buildkit-proto"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85a885520bf6249ab931a764ffdb87b0ceef48e6e7d807cfdb21b751e086e1ad"
-dependencies = [
- "prost",
- "prost-types",
- "tonic",
- "tonic-prost",
- "ureq",
-]
-
-[[package]]
-name = "bollard-stubs"
-version = "1.49.1-rc.28.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5731fe885755e92beff1950774068e0cae67ea6ec7587381536fca84f1779623"
-dependencies = [
- "base64 0.22.1",
- "bollard-buildkit-proto",
- "bytes",
- "chrono",
- "prost",
- "serde",
- "serde_json",
- "serde_repr",
- "serde_with",
-]
-
 [[package]]
 name = "brotli"
 version = "8.0.2"
@@ -353,12 +170,6 @@ version = "3.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
 
-[[package]]
-name = "byteorder"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
-
 [[package]]
 name = "bytes"
 version = "1.11.1"
@@ -414,7 +225,6 @@ dependencies = [
  "iana-time-zone",
  "js-sys",
  "num-traits",
- "serde",
  "wasm-bindgen",
  "windows-link",
 ]
@@ -495,26 +305,6 @@ dependencies = [
  "version_check",
 ]
 
-[[package]]
-name = "core-foundation"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
-[[package]]
-name = "core-foundation"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -552,7 +342,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
 dependencies = [
  "generic-array",
- "rand_core 0.6.4",
+ "rand_core",
  "subtle",
  "zeroize",
 ]
@@ -564,23 +354,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array",
- "rand_core 0.6.4",
+ "rand_core",
  "typenum",
 ]
 
-[[package]]
-name = "cssparser"
-version = "0.34.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7c66d1cd8ed61bf80b38432613a7a2f09401ab8d0501110655f8b341484a3e3"
-dependencies = [
- "cssparser-macros",
- "dtoa-short",
- "itoa",
- "phf 0.11.3",
- "smallvec",
-]
-
 [[package]]
 name = "cssparser"
 version = "0.36.0"
@@ -590,7 +367,7 @@ dependencies = [
  "cssparser-macros",
  "dtoa-short",
  "itoa",
- "phf 0.13.1",
+ "phf",
  "smallvec",
 ]
 
@@ -637,18 +414,8 @@ version = "0.20.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
 dependencies = [
- "darling_core 0.20.11",
- "darling_macro 0.20.11",
-]
-
-[[package]]
-name = "darling"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0"
-dependencies = [
- "darling_core 0.21.3",
- "darling_macro 0.21.3",
+ "darling_core",
+ "darling_macro",
 ]
 
 [[package]]
@@ -665,38 +432,13 @@ dependencies = [
  "syn 2.0.111",
 ]
 
-[[package]]
-name = "darling_core"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4"
-dependencies = [
- "fnv",
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim",
- "syn 2.0.111",
-]
-
 [[package]]
 name = "darling_macro"
 version = "0.20.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
 dependencies = [
- "darling_core 0.20.11",
- "quote",
- "syn 2.0.111",
-]
-
-[[package]]
-name = "darling_macro"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
-dependencies = [
- "darling_core 0.21.3",
+ "darling_core",
  "quote",
  "syn 2.0.111",
 ]
@@ -736,7 +478,7 @@ version = "0.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8"
 dependencies = [
- "darling 0.20.11",
+ "darling",
  "proc-macro2",
  "quote",
  "syn 2.0.111",
@@ -752,45 +494,13 @@ dependencies = [
  "syn 2.0.111",
 ]
 
-[[package]]
-name = "derive_more"
-version = "0.99.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6edb4b64a43d977b8e99788fe3a04d483834fba1215a7e02caa415b626497f7f"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.111",
-]
-
-[[package]]
-name = "derive_more"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a9b99b9cbbe49445b21764dc0625032a89b145a2642e67603e1c936f5458d05"
-dependencies = [
- "derive_more-impl 1.0.0",
-]
-
 [[package]]
 name = "derive_more"
 version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "093242cf7570c207c83073cf82f79706fe7b8317e98620a47d5be7c3d8497678"
 dependencies = [
- "derive_more-impl 2.0.1",
-]
-
-[[package]]
-name = "derive_more-impl"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb7330aeadfbe296029522e6c40f315320aba36fc43a5b3632f3795348f3bd22"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.111",
- "unicode-xid",
+ "derive_more-impl",
 ]
 
 [[package]]
@@ -846,17 +556,6 @@ dependencies = [
  "const-random",
 ]
 
-[[package]]
-name = "docker_credential"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d89dfcba45b4afad7450a99b39e751590463e45c04728cf555d36bb66940de8"
-dependencies = [
- "base64 0.21.7",
- "serde",
- "serde_json",
-]
-
 [[package]]
 name = "downcast-rs"
 version = "1.2.1"
@@ -878,12 +577,6 @@ dependencies = [
  "dtoa",
 ]
 
-[[package]]
-name = "dyn-clone"
-version = "1.0.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
-
 [[package]]
 name = "ed25519"
 version = "2.2.3"
@@ -902,19 +595,13 @@ checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
 dependencies = [
  "curve25519-dalek",
  "ed25519",
- "rand_core 0.6.4",
+ "rand_core",
  "serde",
  "sha2 0.10.9",
  "subtle",
  "zeroize",
 ]
 
-[[package]]
-name = "ego-tree"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c6ba7d4eec39eaa9ab24d44a0e73a7949a1095a8b3f3abb11eddf27dbb56a53"
-
 [[package]]
 name = "either"
 version = "1.15.0"
@@ -933,7 +620,7 @@ dependencies = [
  "ff",
  "generic-array",
  "group",
- "rand_core 0.6.4",
+ "rand_core",
  "sec1",
  "subtle",
  "zeroize",
@@ -945,7 +632,7 @@ version = "1.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9abf33c656a7256451ebb7d0082c5a471820c31269e49d807c538c252352186e"
 dependencies = [
- "indexmap 2.12.1",
+ "indexmap",
  "stable_deref_trait",
 ]
 
@@ -988,17 +675,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "error-stack"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe413319145d1063f080f27556fd30b1d70b01e2ba10c2a6e40d4be982ffc5d1"
-dependencies = [
- "anyhow",
- "rustc_version",
+ "windows-sys",
 ]
 
 [[package]]
@@ -1011,17 +688,6 @@ dependencies = [
  "rustc_version",
 ]
 
-[[package]]
-name = "etcetera"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26c7b13d0780cb82722fd59f6f57f925e143427e4a75313a6c77243bf5326ae6"
-dependencies = [
- "cfg-if",
- "home",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "fastly"
 version = "0.11.12"
@@ -1104,7 +770,7 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
 dependencies = [
- "rand_core 0.6.4",
+ "rand_core",
  "subtle",
 ]
 
@@ -1114,17 +780,6 @@ version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
-[[package]]
-name = "filetime"
-version = "0.2.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f98844151eee8917efc50bd9e8318cb963ae8b297431495d3f758616ea5c57db"
-dependencies = [
- "cfg-if",
- "libc",
- "libredox",
-]
-
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.5"
@@ -1159,21 +814,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
-[[package]]
-name = "foreign-types"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
-dependencies = [
- "foreign-types-shared",
-]
-
-[[package]]
-name = "foreign-types-shared"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
-
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -1183,16 +823,6 @@ dependencies = [
  "percent-encoding",
 ]
 
-[[package]]
-name = "futf"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df420e2e84819663797d1ec6544b13c5be84629e7bb00dc960d6917db2987843"
-dependencies = [
- "mac",
- "new_debug_unreachable",
-]
-
 [[package]]
 name = "futures"
 version = "0.3.32"
@@ -1281,15 +911,6 @@ dependencies = [
  "slab",
 ]
 
-[[package]]
-name = "fxhash"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c31b6d751ae2c7f11320402d34e41349dd1016f8d5d45e48c4312bc8625af50c"
-dependencies = [
- "byteorder",
-]
-
 [[package]]
 name = "generic-array"
 version = "0.14.7"
@@ -1302,19 +923,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "getopts"
-version = "0.2.24"
+name = "getrandom"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfe4fbac503b8d1f88e6676011885f34b7174f46e59956bba534ba83abded4df"
-dependencies = [
- "unicode-width",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
+checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
 dependencies = [
  "cfg-if",
  "libc",
@@ -1340,29 +952,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
 dependencies = [
  "ff",
- "rand_core 0.6.4",
+ "rand_core",
  "subtle",
 ]
 
-[[package]]
-name = "h2"
-version = "0.4.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
-dependencies = [
- "atomic-waker",
- "bytes",
- "fnv",
- "futures-core",
- "futures-sink",
- "http",
- "indexmap 2.12.1",
- "slab",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
 [[package]]
 name = "handlebars"
 version = "6.4.0"
@@ -1379,12 +972,6 @@ dependencies = [
  "thiserror 2.0.17",
 ]
 
-[[package]]
-name = "hashbrown"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
-
 [[package]]
 name = "hashbrown"
 version = "0.14.5"
@@ -1435,27 +1022,6 @@ dependencies = [
  "digest 0.10.7",
 ]
 
-[[package]]
-name = "home"
-version = "0.5.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
-dependencies = [
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "html5ever"
-version = "0.29.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b7410cae13cbc75623c98ac4cbfd1f0bedddf3227afc24f370cf0f50a44a11c"
-dependencies = [
- "log",
- "mac",
- "markup5ever",
- "match_token",
-]
-
 [[package]]
 name = "http"
 version = "1.4.0"
@@ -1466,164 +1032,6 @@ dependencies = [
  "itoa",
 ]
 
-[[package]]
-name = "http-body"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
-dependencies = [
- "bytes",
- "http",
-]
-
-[[package]]
-name = "http-body-util"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
-dependencies = [
- "bytes",
- "futures-core",
- "http",
- "http-body",
- "pin-project-lite",
-]
-
-[[package]]
-name = "httparse"
-version = "1.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
-
-[[package]]
-name = "httpdate"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
-
-[[package]]
-name = "hyper"
-version = "1.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
-dependencies = [
- "atomic-waker",
- "bytes",
- "futures-channel",
- "futures-core",
- "h2",
- "http",
- "http-body",
- "httparse",
- "httpdate",
- "itoa",
- "pin-project-lite",
- "pin-utils",
- "smallvec",
- "tokio",
- "want",
-]
-
-[[package]]
-name = "hyper-named-pipe"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73b7d8abf35697b81a825e386fc151e0d503e8cb5fcb93cc8669c376dfd6f278"
-dependencies = [
- "hex",
- "hyper",
- "hyper-util",
- "pin-project-lite",
- "tokio",
- "tower-service",
- "winapi",
-]
-
-[[package]]
-name = "hyper-rustls"
-version = "0.27.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
-dependencies = [
- "http",
- "hyper",
- "hyper-util",
- "rustls",
- "rustls-pki-types",
- "tokio",
- "tokio-rustls",
- "tower-service",
-]
-
-[[package]]
-name = "hyper-timeout"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
-dependencies = [
- "hyper",
- "hyper-util",
- "pin-project-lite",
- "tokio",
- "tower-service",
-]
-
-[[package]]
-name = "hyper-tls"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
-dependencies = [
- "bytes",
- "http-body-util",
- "hyper",
- "hyper-util",
- "native-tls",
- "tokio",
- "tokio-native-tls",
- "tower-service",
-]
-
-[[package]]
-name = "hyper-util"
-version = "0.1.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
-dependencies = [
- "base64 0.22.1",
- "bytes",
- "futures-channel",
- "futures-util",
- "http",
- "http-body",
- "hyper",
- "ipnet",
- "libc",
- "percent-encoding",
- "pin-project-lite",
- "socket2",
- "system-configuration",
- "tokio",
- "tower-service",
- "tracing",
- "windows-registry",
-]
-
-[[package]]
-name = "hyperlocal"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7"
-dependencies = [
- "hex",
- "http-body-util",
- "hyper",
- "hyper-util",
- "pin-project-lite",
- "tokio",
- "tower-service",
-]
-
 [[package]]
 name = "iana-time-zone"
 version = "0.1.64"
@@ -1756,17 +1164,6 @@ dependencies = [
  "icu_properties",
 ]
 
-[[package]]
-name = "indexmap"
-version = "1.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
-dependencies = [
- "autocfg",
- "hashbrown 0.12.3",
- "serde",
-]
-
 [[package]]
 name = "indexmap"
 version = "2.12.1"
@@ -1775,8 +1172,6 @@ checksum = "0ad4bb2b565bca0645f4d68c5c9af97fba094e9791da685bf83cb5f3ce74acf2"
 dependencies = [
  "equivalent",
  "hashbrown 0.16.1",
- "serde",
- "serde_core",
 ]
 
 [[package]]
@@ -1788,34 +1183,6 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "integration-tests"
-version = "0.1.0"
-dependencies = [
- "derive_more 1.0.0",
- "error-stack 0.5.0",
- "log",
- "reqwest",
- "scraper",
- "testcontainers",
-]
-
-[[package]]
-name = "ipnet"
-version = "2.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
-
-[[package]]
-name = "iri-string"
-version = "0.7.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c91338f0783edbd6195decb37bae672fd3b165faffb89bf7b9e6942f8b1a731a"
-dependencies = [
- "memchr",
- "serde",
-]
-
 [[package]]
 name = "itertools"
 version = "0.13.0"
@@ -1909,18 +1276,6 @@ version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9fbbcab51052fe104eb5e5d351cf728d30a5be1fe14d9be8a3b097481fb97de"
 
-[[package]]
-name = "libredox"
-version = "0.1.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1744e39d1d6a9948f4f388969627434e31128196de472883b39f148769bfe30a"
-dependencies = [
- "bitflags 2.10.0",
- "libc",
- "plain",
- "redox_syscall 0.7.3",
-]
-
 [[package]]
 name = "linux-raw-sys"
 version = "0.11.0"
@@ -1967,54 +1322,17 @@ checksum = "630bc32f75a59df2d35a9f13224b057a1c1ff1d187dfdc56190e9a54c4127917"
 dependencies = [
  "bitflags 2.10.0",
  "cfg-if",
- "cssparser 0.36.0",
+ "cssparser",
  "encoding_rs",
  "foldhash 0.2.0",
  "hashbrown 0.16.1",
  "memchr",
  "mime",
  "precomputed-hash",
- "selectors 0.33.0",
+ "selectors",
  "thiserror 2.0.17",
 ]
 
-[[package]]
-name = "mac"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4"
-
-[[package]]
-name = "markup5ever"
-version = "0.14.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7a7213d12e1864c0f002f52c2923d4556935a43dec5e71355c2760e0f6e7a18"
-dependencies = [
- "log",
- "phf 0.11.3",
- "phf_codegen 0.11.3",
- "string_cache",
- "string_cache_codegen",
- "tendril",
-]
-
-[[package]]
-name = "match_token"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88a9689d8d44bf9964484516275f5cd4c9b59457a6940c1d5d0ecbb94510a36b"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.111",
-]
-
-[[package]]
-name = "matchit"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
-
 [[package]]
 name = "matchit"
 version = "0.9.0"
@@ -2043,64 +1361,12 @@ dependencies = [
  "simd-adler32",
 ]
 
-[[package]]
-name = "mio"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
-dependencies = [
- "libc",
- "wasi",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "native-tls"
-version = "0.2.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "465500e14ea162429d264d44189adc38b199b62b1c21eea9f69e4b73cb03bbf2"
-dependencies = [
- "libc",
- "log",
- "openssl",
- "openssl-probe",
- "openssl-sys",
- "schannel",
- "security-framework",
- "security-framework-sys",
- "tempfile",
-]
-
 [[package]]
 name = "new_debug_unreachable"
 version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
 
-[[package]]
-name = "num"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
-dependencies = [
- "num-bigint",
- "num-complex",
- "num-integer",
- "num-iter",
- "num-rational",
- "num-traits",
-]
-
-[[package]]
-name = "num-bigint"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
-dependencies = [
- "num-integer",
- "num-traits",
-]
-
 [[package]]
 name = "num-bigint-dig"
 version = "0.8.6"
@@ -2112,20 +1378,11 @@ dependencies = [
  "num-integer",
  "num-iter",
  "num-traits",
- "rand 0.8.5",
+ "rand",
  "smallvec",
  "zeroize",
 ]
 
-[[package]]
-name = "num-complex"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
-dependencies = [
- "num-traits",
-]
-
 [[package]]
 name = "num-conv"
 version = "0.2.0"
@@ -2167,17 +1424,6 @@ dependencies = [
  "num-modular",
 ]
 
-[[package]]
-name = "num-rational"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
-dependencies = [
- "num-bigint",
- "num-integer",
- "num-traits",
-]
-
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -2201,82 +1447,38 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
-name = "openssl"
-version = "0.10.75"
+name = "ordered-multimap"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08838db121398ad17ab8531ce9de97b244589089e290a384c900cb9ff7434328"
+checksum = "49203cdcae0030493bad186b28da2fa25645fa276a51b6fec8010d281e02ef79"
 dependencies = [
- "bitflags 2.10.0",
- "cfg-if",
- "foreign-types",
- "libc",
- "once_cell",
- "openssl-macros",
- "openssl-sys",
+ "dlv-list",
+ "hashbrown 0.14.5",
 ]
 
 [[package]]
-name = "openssl-macros"
-version = "0.1.1"
+name = "p256"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.111",
+ "elliptic-curve",
+ "primeorder",
 ]
 
 [[package]]
-name = "openssl-probe"
-version = "0.2.1"
+name = "p384"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
+dependencies = [
+ "elliptic-curve",
+ "primeorder",
+]
 
 [[package]]
-name = "openssl-sys"
-version = "0.9.111"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82cab2d520aa75e3c58898289429321eb788c3106963d0dc886ec7a5f4adc321"
-dependencies = [
- "cc",
- "libc",
- "pkg-config",
- "vcpkg",
-]
-
-[[package]]
-name = "ordered-multimap"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49203cdcae0030493bad186b28da2fa25645fa276a51b6fec8010d281e02ef79"
-dependencies = [
- "dlv-list",
- "hashbrown 0.14.5",
-]
-
-[[package]]
-name = "p256"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
-dependencies = [
- "elliptic-curve",
- "primeorder",
-]
-
-[[package]]
-name = "p384"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
-dependencies = [
- "elliptic-curve",
- "primeorder",
-]
-
-[[package]]
-name = "parking_lot"
-version = "0.12.5"
+name = "parking_lot"
+version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
 dependencies = [
@@ -2292,36 +1494,11 @@ checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.5.18",
+ "redox_syscall",
  "smallvec",
  "windows-link",
 ]
 
-[[package]]
-name = "parse-display"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "914a1c2265c98e2446911282c6ac86d8524f495792c38c5bd884f80499c7538a"
-dependencies = [
- "parse-display-derive",
- "regex",
- "regex-syntax",
-]
-
-[[package]]
-name = "parse-display-derive"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ae7800a4c974efd12df917266338e79a7a74415173caf7e70aa0a0707345281"
-dependencies = [
- "proc-macro2",
- "quote",
- "regex",
- "regex-syntax",
- "structmeta",
- "syn 2.0.111",
-]
-
 [[package]]
 name = "pathdiff"
 version = "0.2.3"
@@ -2377,55 +1554,25 @@ dependencies = [
  "sha2 0.10.9",
 ]
 
-[[package]]
-name = "phf"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
-dependencies = [
- "phf_macros 0.11.3",
- "phf_shared 0.11.3",
-]
-
 [[package]]
 name = "phf"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
 dependencies = [
- "phf_macros 0.13.1",
- "phf_shared 0.13.1",
+ "phf_macros",
+ "phf_shared",
  "serde",
 ]
 
-[[package]]
-name = "phf_codegen"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a"
-dependencies = [
- "phf_generator 0.11.3",
- "phf_shared 0.11.3",
-]
-
 [[package]]
 name = "phf_codegen"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1"
 dependencies = [
- "phf_generator 0.13.1",
- "phf_shared 0.13.1",
-]
-
-[[package]]
-name = "phf_generator"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
-dependencies = [
- "phf_shared 0.11.3",
- "rand 0.8.5",
+ "phf_generator",
+ "phf_shared",
 ]
 
 [[package]]
@@ -2435,20 +1582,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
 dependencies = [
  "fastrand",
- "phf_shared 0.13.1",
-]
-
-[[package]]
-name = "phf_macros"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f84ac04429c13a7ff43785d75ad27569f2951ce0ffd30a3321230db2fc727216"
-dependencies = [
- "phf_generator 0.11.3",
- "phf_shared 0.11.3",
- "proc-macro2",
- "quote",
- "syn 2.0.111",
+ "phf_shared",
 ]
 
 [[package]]
@@ -2457,22 +1591,13 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
 dependencies = [
- "phf_generator 0.13.1",
- "phf_shared 0.13.1",
+ "phf_generator",
+ "phf_shared",
  "proc-macro2",
  "quote",
  "syn 2.0.111",
 ]
 
-[[package]]
-name = "phf_shared"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
-dependencies = [
- "siphasher",
-]
-
 [[package]]
 name = "phf_shared"
 version = "0.13.1"
@@ -2482,38 +1607,12 @@ dependencies = [
  "siphasher",
 ]
 
-[[package]]
-name = "pin-project"
-version = "1.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1749c7ed4bcaf4c3d0a3efc28538844fb29bcdd7d2b67b2be7e20ba861ff517"
-dependencies = [
- "pin-project-internal",
-]
-
-[[package]]
-name = "pin-project-internal"
-version = "1.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b20ed30f105399776b9c883e68e536ef602a16ae6f596d2c473591d6ad64c6"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.111",
-]
-
 [[package]]
 name = "pin-project-lite"
 version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
 
-[[package]]
-name = "pin-utils"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
-
 [[package]]
 name = "pkcs1"
 version = "0.7.5"
@@ -2535,18 +1634,6 @@ dependencies = [
  "spki",
 ]
 
-[[package]]
-name = "pkg-config"
-version = "0.3.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
-
-[[package]]
-name = "plain"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
-
 [[package]]
 name = "poly1305"
 version = "0.8.0"
@@ -2558,12 +1645,6 @@ dependencies = [
  "universal-hash",
 ]
 
-[[package]]
-name = "portable-atomic"
-version = "1.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
-
 [[package]]
 name = "potential_utf"
 version = "0.1.4"
@@ -2634,38 +1715,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "prost"
-version = "0.14.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2ea70524a2f82d518bce41317d0fae74151505651af45faf1ffbd6fd33f0568"
-dependencies = [
- "bytes",
- "prost-derive",
-]
-
-[[package]]
-name = "prost-derive"
-version = "0.14.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
-dependencies = [
- "anyhow",
- "itertools",
- "proc-macro2",
- "quote",
- "syn 2.0.111",
-]
-
-[[package]]
-name = "prost-types"
-version = "0.14.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8991c4cbdb8bc5b11f0b074ffe286c30e523de90fee5ba8132f1399f23cb3dd7"
-dependencies = [
- "prost",
-]
-
 [[package]]
 name = "quote"
 version = "1.0.42"
@@ -2688,18 +1737,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
- "rand_chacha 0.3.1",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand"
-version = "0.9.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
-dependencies = [
- "rand_chacha 0.9.0",
- "rand_core 0.9.5",
+ "rand_chacha",
+ "rand_core",
 ]
 
 [[package]]
@@ -2709,17 +1748,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.9.5",
+ "rand_core",
 ]
 
 [[package]]
@@ -2731,15 +1760,6 @@ dependencies = [
  "getrandom 0.2.16",
 ]
 
-[[package]]
-name = "rand_core"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
-dependencies = [
- "getrandom 0.3.4",
-]
-
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -2749,35 +1769,6 @@ dependencies = [
  "bitflags 2.10.0",
 ]
 
-[[package]]
-name = "redox_syscall"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce70a74e890531977d37e532c34d45e9055d2409ed08ddba14529471ed0be16"
-dependencies = [
- "bitflags 2.10.0",
-]
-
-[[package]]
-name = "ref-cast"
-version = "1.0.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
-dependencies = [
- "ref-cast-impl",
-]
-
-[[package]]
-name = "ref-cast-impl"
-version = "1.0.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.111",
-]
-
 [[package]]
 name = "regex"
 version = "1.12.3"
@@ -2807,62 +1798,6 @@ version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
 
-[[package]]
-name = "reqwest"
-version = "0.12.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
-dependencies = [
- "base64 0.22.1",
- "bytes",
- "encoding_rs",
- "futures-channel",
- "futures-core",
- "futures-util",
- "h2",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
- "hyper-rustls",
- "hyper-tls",
- "hyper-util",
- "js-sys",
- "log",
- "mime",
- "native-tls",
- "percent-encoding",
- "pin-project-lite",
- "rustls-pki-types",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper",
- "tokio",
- "tokio-native-tls",
- "tower",
- "tower-http",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
-]
-
-[[package]]
-name = "ring"
-version = "0.17.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
-dependencies = [
- "cc",
- "cfg-if",
- "getrandom 0.2.16",
- "libc",
- "untrusted",
- "windows-sys 0.52.0",
-]
-
 [[package]]
 name = "ron"
 version = "0.12.0"
@@ -2890,7 +1825,7 @@ dependencies = [
  "num-traits",
  "pkcs1",
  "pkcs8",
- "rand_core 0.6.4",
+ "rand_core",
  "signature",
  "spki",
  "subtle",
@@ -2932,63 +1867,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "rustls"
-version = "0.23.37"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4"
-dependencies = [
- "log",
- "once_cell",
- "ring",
- "rustls-pki-types",
- "rustls-webpki",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "rustls-native-certs"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63"
-dependencies = [
- "openssl-probe",
- "rustls-pki-types",
- "schannel",
- "security-framework",
-]
-
-[[package]]
-name = "rustls-pemfile"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
-dependencies = [
- "rustls-pki-types",
-]
-
-[[package]]
-name = "rustls-pki-types"
-version = "1.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd"
-dependencies = [
- "zeroize",
-]
-
-[[package]]
-name = "rustls-webpki"
-version = "0.103.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
-dependencies = [
- "ring",
- "rustls-pki-types",
- "untrusted",
+ "windows-sys",
 ]
 
 [[package]]
@@ -3003,61 +1882,12 @@ version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
-[[package]]
-name = "schannel"
-version = "0.1.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "891d81b926048e76efe18581bf793546b4c0eaf8448d72be8de2bbee5fd166e1"
-dependencies = [
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "schemars"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
-dependencies = [
- "dyn-clone",
- "ref-cast",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "schemars"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
-dependencies = [
- "dyn-clone",
- "ref-cast",
- "serde",
- "serde_json",
-]
-
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
-[[package]]
-name = "scraper"
-version = "0.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0e749d29b2064585327af5038a5a8eb73aeebad4a3472e83531a436563f7208"
-dependencies = [
- "ahash",
- "cssparser 0.34.0",
- "ego-tree",
- "getopts",
- "html5ever",
- "precomputed-hash",
- "selectors 0.26.0",
- "tendril",
-]
-
 [[package]]
 name = "sec1"
 version = "0.7.3"
@@ -3071,48 +1901,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "security-framework"
-version = "3.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d17b898a6d6948c3a8ee4372c17cb384f90d2e6e912ef00895b14fd7ab54ec38"
-dependencies = [
- "bitflags 2.10.0",
- "core-foundation 0.10.1",
- "core-foundation-sys",
- "libc",
- "security-framework-sys",
-]
-
-[[package]]
-name = "security-framework-sys"
-version = "2.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
-[[package]]
-name = "selectors"
-version = "0.26.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd568a4c9bb598e291a08244a5c1f5a8a6650bee243b5b0f8dbb3d9cc1d87fe8"
-dependencies = [
- "bitflags 2.10.0",
- "cssparser 0.34.0",
- "derive_more 0.99.20",
- "fxhash",
- "log",
- "new_debug_unreachable",
- "phf 0.11.3",
- "phf_codegen 0.11.3",
- "precomputed-hash",
- "servo_arc",
- "smallvec",
-]
-
 [[package]]
 name = "selectors"
 version = "0.33.0"
@@ -3120,12 +1908,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "feef350c36147532e1b79ea5c1f3791373e61cbd9a6a2615413b3807bb164fb7"
 dependencies = [
  "bitflags 2.10.0",
- "cssparser 0.36.0",
- "derive_more 2.0.1",
+ "cssparser",
+ "derive_more",
  "log",
  "new_debug_unreachable",
- "phf 0.13.1",
- "phf_codegen 0.13.1",
+ "phf",
+ "phf_codegen",
  "precomputed-hash",
  "rustc-hash",
  "servo_arc",
@@ -3225,37 +2013,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "serde_with"
-version = "3.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "381b283ce7bc6b476d903296fb59d0d36633652b633b27f64db4fb46dcbfc3b9"
-dependencies = [
- "base64 0.22.1",
- "chrono",
- "hex",
- "indexmap 1.9.3",
- "indexmap 2.12.1",
- "schemars 0.9.0",
- "schemars 1.2.1",
- "serde_core",
- "serde_json",
- "serde_with_macros",
- "time",
-]
-
-[[package]]
-name = "serde_with_macros"
-version = "3.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6d4e30573c8cb306ed6ab1dca8423eec9a463ea0e155f45399455e0368b27e0"
-dependencies = [
- "darling 0.21.3",
- "proc-macro2",
- "quote",
- "syn 2.0.111",
-]
-
 [[package]]
 name = "servo_arc"
 version = "0.4.3"
@@ -3302,7 +2059,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
  "digest 0.10.7",
- "rand_core 0.6.4",
+ "rand_core",
 ]
 
 [[package]]
@@ -3329,16 +2086,6 @@ version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
 
-[[package]]
-name = "socket2"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86f4aa3ad99f2088c990dfa82d367e19cb29268ed67c574d10d0a4bfe71f07e0"
-dependencies = [
- "libc",
- "windows-sys 0.60.2",
-]
-
 [[package]]
 name = "spin"
 version = "0.9.8"
@@ -3361,60 +2108,12 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
-[[package]]
-name = "string_cache"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf776ba3fa74f83bf4b63c3dcbbf82173db2632ed8452cb2d891d33f459de70f"
-dependencies = [
- "new_debug_unreachable",
- "parking_lot",
- "phf_shared 0.11.3",
- "precomputed-hash",
- "serde",
-]
-
-[[package]]
-name = "string_cache_codegen"
-version = "0.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c711928715f1fe0fe509c53b43e993a9a557babc2d0a3567d0a3006f1ac931a0"
-dependencies = [
- "phf_generator 0.11.3",
- "phf_shared 0.11.3",
- "proc-macro2",
- "quote",
-]
-
 [[package]]
 name = "strsim"
 version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
-[[package]]
-name = "structmeta"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e1575d8d40908d70f6fd05537266b90ae71b15dbbe7a8b7dffa2b759306d329"
-dependencies = [
- "proc-macro2",
- "quote",
- "structmeta-derive",
- "syn 2.0.111",
-]
-
-[[package]]
-name = "structmeta-derive"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "152a0b65a590ff6c3da95cabe2353ee04e6167c896b28e3b14478c2636c922fc"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.111",
-]
-
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -3443,15 +2142,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "sync_wrapper"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
-dependencies = [
- "futures-core",
-]
-
 [[package]]
 name = "synstructure"
 version = "0.13.2"
@@ -3463,27 +2153,6 @@ dependencies = [
  "syn 2.0.111",
 ]
 
-[[package]]
-name = "system-configuration"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
-dependencies = [
- "bitflags 2.10.0",
- "core-foundation 0.9.4",
- "system-configuration-sys",
-]
-
-[[package]]
-name = "system-configuration-sys"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
 [[package]]
 name = "temp-env"
 version = "0.3.6"
@@ -3493,59 +2162,6 @@ dependencies = [
  "parking_lot",
 ]
 
-[[package]]
-name = "tempfile"
-version = "3.23.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
-dependencies = [
- "fastrand",
- "getrandom 0.3.4",
- "once_cell",
- "rustix",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "tendril"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d24a120c5fc464a3458240ee02c299ebcb9d67b5249c8848b09d639dca8d7bb0"
-dependencies = [
- "futf",
- "mac",
- "utf-8",
-]
-
-[[package]]
-name = "testcontainers"
-version = "0.25.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f3ac71069f20ecfa60c396316c283fbf35e6833a53dff551a31b5458da05edc"
-dependencies = [
- "astral-tokio-tar",
- "async-trait",
- "bollard",
- "bytes",
- "docker_credential",
- "either",
- "etcetera",
- "futures",
- "log",
- "memchr",
- "parse-display",
- "pin-project-lite",
- "serde",
- "serde_json",
- "serde_with",
- "thiserror 2.0.17",
- "tokio",
- "tokio-stream",
- "tokio-util",
- "ulid",
- "url",
-]
-
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -3643,43 +2259,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
 dependencies = [
  "bytes",
- "libc",
- "mio",
  "pin-project-lite",
- "socket2",
  "tokio-macros",
- "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "tokio-macros"
 version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.111",
-]
-
-[[package]]
-name = "tokio-native-tls"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
-dependencies = [
- "native-tls",
- "tokio",
-]
-
-[[package]]
-name = "tokio-rustls"
-version = "0.26.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
 dependencies = [
- "rustls",
- "tokio",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
 ]
 
 [[package]]
@@ -3704,26 +2296,13 @@ dependencies = [
  "tokio-stream",
 ]
 
-[[package]]
-name = "tokio-util"
-version = "0.7.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
-dependencies = [
- "bytes",
- "futures-core",
- "futures-sink",
- "pin-project-lite",
- "tokio",
-]
-
 [[package]]
 name = "toml"
 version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0dc8b1fb61449e27716ec0e1bdf0f6b8f3e8f6b05391e8497b8b6d7804ea6d8"
 dependencies = [
- "indexmap 2.12.1",
+ "indexmap",
  "serde_core",
  "serde_spanned",
  "toml_datetime",
@@ -3756,141 +2335,21 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df8b2b54733674ad286d16267dcfc7a71ed5c776e4ac7aa3c3e2561f7c637bf2"
 
-[[package]]
-name = "tonic"
-version = "0.14.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fec7c61a0695dc1887c1b53952990f3ad2e3a31453e1f49f10e75424943a93ec"
-dependencies = [
- "async-trait",
- "axum",
- "base64 0.22.1",
- "bytes",
- "h2",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
- "hyper-timeout",
- "hyper-util",
- "percent-encoding",
- "pin-project",
- "socket2",
- "sync_wrapper",
- "tokio",
- "tokio-stream",
- "tower",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "tonic-prost"
-version = "0.14.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a55376a0bbaa4975a3f10d009ad763d8f4108f067c7c2e74f3001fb49778d309"
-dependencies = [
- "bytes",
- "prost",
- "tonic",
-]
-
-[[package]]
-name = "tower"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
-dependencies = [
- "futures-core",
- "futures-util",
- "indexmap 2.12.1",
- "pin-project-lite",
- "slab",
- "sync_wrapper",
- "tokio",
- "tokio-util",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "tower-http"
-version = "0.6.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
-dependencies = [
- "bitflags 2.10.0",
- "bytes",
- "futures-util",
- "http",
- "http-body",
- "iri-string",
- "pin-project-lite",
- "tower",
- "tower-layer",
- "tower-service",
-]
-
-[[package]]
-name = "tower-layer"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
-
-[[package]]
-name = "tower-service"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
-
-[[package]]
-name = "tracing"
-version = "0.1.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
-dependencies = [
- "pin-project-lite",
- "tracing-attributes",
- "tracing-core",
-]
-
-[[package]]
-name = "tracing-attributes"
-version = "0.1.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.111",
-]
-
-[[package]]
-name = "tracing-core"
-version = "0.1.36"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
-dependencies = [
- "once_cell",
-]
-
 [[package]]
 name = "trusted-server-common"
 version = "0.1.0"
 dependencies = [
  "async-trait",
- "base64 0.22.1",
+ "base64",
  "brotli",
  "bytes",
  "chacha20poly1305",
  "chrono",
  "config",
  "cookie",
- "derive_more 2.0.1",
+ "derive_more",
  "ed25519-dalek",
- "error-stack 0.6.0",
+ "error-stack",
  "fastly",
  "flate2",
  "futures",
@@ -3902,10 +2361,10 @@ dependencies = [
  "log",
  "log-fastly",
  "lol_html",
- "matchit 0.9.0",
+ "matchit",
  "once_cell",
  "pin-project-lite",
- "rand 0.8.5",
+ "rand",
  "regex",
  "serde",
  "serde_json",
@@ -3926,7 +2385,7 @@ name = "trusted-server-fastly"
 version = "0.1.0"
 dependencies = [
  "chrono",
- "error-stack 0.6.0",
+ "error-stack",
  "fastly",
  "fern",
  "futures",
@@ -3948,12 +2407,6 @@ dependencies = [
  "which",
 ]
 
-[[package]]
-name = "try-lock"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
-
 [[package]]
 name = "typeid"
 version = "1.0.3"
@@ -3972,16 +2425,6 @@ version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
 
-[[package]]
-name = "ulid"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "470dbf6591da1b39d43c14523b2b469c86879a53e8b758c8e090a470fe7b1fbe"
-dependencies = [
- "rand 0.9.2",
- "web-time",
-]
-
 [[package]]
 name = "unicode-ident"
 version = "1.0.22"
@@ -3994,12 +2437,6 @@ version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
 
-[[package]]
-name = "unicode-width"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
-
 [[package]]
 name = "unicode-xid"
 version = "0.2.6"
@@ -4016,39 +2453,6 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "untrusted"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
-
-[[package]]
-name = "ureq"
-version = "3.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdc97a28575b85cfedf2a7e7d3cc64b3e11bd8ac766666318003abbacc7a21fc"
-dependencies = [
- "base64 0.22.1",
- "log",
- "percent-encoding",
- "rustls",
- "rustls-pki-types",
- "ureq-proto",
- "utf-8",
-]
-
-[[package]]
-name = "ureq-proto"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d81f9efa9df032be5934a46a068815a10a042b494b6a58cb0a1a97bb5467ed6f"
-dependencies = [
- "base64 0.22.1",
- "http",
- "httparse",
- "log",
-]
-
 [[package]]
 name = "url"
 version = "2.5.8"
@@ -4059,7 +2463,6 @@ dependencies = [
  "idna",
  "percent-encoding",
  "serde",
- "serde_derive",
 ]
 
 [[package]]
@@ -4068,12 +2471,6 @@ version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
 
-[[package]]
-name = "utf-8"
-version = "0.7.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
-
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -4113,7 +2510,7 @@ version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7df16e474ef958526d1205f6dda359fdfab79d9aa6d54bafcb92dcd07673dca"
 dependencies = [
- "darling 0.20.11",
+ "darling",
  "once_cell",
  "proc-macro-error2",
  "proc-macro2",
@@ -4121,27 +2518,12 @@ dependencies = [
  "syn 2.0.111",
 ]
 
-[[package]]
-name = "vcpkg"
-version = "0.2.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
-
 [[package]]
 name = "version_check"
 version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
-[[package]]
-name = "want"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
-dependencies = [
- "try-lock",
-]
-
 [[package]]
 name = "wasi"
 version = "0.11.1+wasi-snapshot-preview1"
@@ -4170,19 +2552,6 @@ dependencies = [
  "wasm-bindgen-shared",
 ]
 
-[[package]]
-name = "wasm-bindgen-futures"
-version = "0.4.56"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "836d9622d604feee9e5de25ac10e3ea5f2d65b41eac0d9ce72eb5deae707ce7c"
-dependencies = [
- "cfg-if",
- "js-sys",
- "once_cell",
- "wasm-bindgen",
- "web-sys",
-]
-
 [[package]]
 name = "wasm-bindgen-macro"
 version = "0.2.106"
@@ -4215,26 +2584,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "web-sys"
-version = "0.3.83"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b32828d774c412041098d182a8b38b16ea816958e07cf40eec2bc080ae137ac"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "web-time"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
 [[package]]
 name = "which"
 version = "8.0.0"
@@ -4246,28 +2595,6 @@ dependencies = [
  "winsafe",
 ]
 
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
-
 [[package]]
 name = "windows-core"
 version = "0.62.2"
@@ -4309,17 +2636,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
-[[package]]
-name = "windows-registry"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
-dependencies = [
- "windows-link",
- "windows-result",
- "windows-strings",
-]
-
 [[package]]
 name = "windows-result"
 version = "0.4.1"
@@ -4338,33 +2654,6 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.59.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.5",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.61.2"
@@ -4374,135 +2663,6 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
-dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.53.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
-
 [[package]]
 name = "winnow"
 version = "0.7.14"
@@ -4533,16 +2693,6 @@ version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
 
-[[package]]
-name = "xattr"
-version = "1.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
-dependencies = [
- "libc",
- "rustix",
-]
-
 [[package]]
 name = "yaml-rust2"
 version = "0.10.4"
diff --git a/Cargo.toml b/Cargo.toml
index 571491e8..a3ed76b6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,10 +4,14 @@ members = [
     "crates/common",
     "crates/fastly",
     "crates/js",
+]
+# integration-tests is intentionally excluded from workspace members because it
+# requires a native target (testcontainers, reqwest) while the workspace default
+# is wasm32-wasip1. Run it via: ./scripts/integration-tests.sh
+exclude = [
     "crates/integration-tests",
 ]
 
-# Build defaults exclude the web-only tsjs crate, which is compiled via wasm-pack.
 default-members = [
     "crates/common",
     "crates/fastly",
diff --git a/crates/fastly/src/main.rs b/crates/fastly/src/main.rs
index 19e9eb8a..1602a04c 100644
--- a/crates/fastly/src/main.rs
+++ b/crates/fastly/src/main.rs
@@ -80,8 +80,11 @@ async fn route_request(
 
     // Match known routes and handle them
     let result = match (method, path.as_str()) {
-        // Health check endpoint for integration tests and monitoring
-        (Method::GET, "/health") => Ok(Response::from_status(200).with_body_text_plain("ok")),
+        // Health check endpoint for integration tests and monitoring.
+        // Namespaced to avoid shadowing publisher routes.
+        (Method::GET, "/__trusted-server/health") => {
+            Ok(Response::from_status(200).with_body_text_plain("ok"))
+        }
 
         // Serve the tsjs library
         (Method::GET, path) if path.starts_with("/static/tsjs=") => {
diff --git a/crates/integration-tests/Cargo.lock b/crates/integration-tests/Cargo.lock
new file mode 100644
index 00000000..60cee858
--- /dev/null
+++ b/crates/integration-tests/Cargo.lock
@@ -0,0 +1,3273 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "getrandom 0.3.4",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
+[[package]]
+name = "astral-tokio-tar"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec179a06c1769b1e42e1e2cbe74c7dcdb3d6383c838454d063eaac5bbb7ebbe5"
+dependencies = [
+ "filetime",
+ "futures-core",
+ "libc",
+ "portable-atomic",
+ "rustc-hash",
+ "tokio",
+ "tokio-stream",
+ "xattr",
+]
+
+[[package]]
+name = "async-stream"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b5a71a6f37880a80d1d7f19efd781e4b5de42c88f0722cc13bcb6cc2cfe8476"
+dependencies = [
+ "async-stream-impl",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream-impl"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "async-trait"
+version = "0.1.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
+[[package]]
+name = "axum"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b52af3cb4058c895d37317bb27508dccc8e5f2d39454016b297bf4a400597b8"
+dependencies = [
+ "axum-core",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "sync_wrapper",
+ "tower",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "base64"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bitflags"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
+
+[[package]]
+name = "bollard"
+version = "0.19.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87a52479c9237eb04047ddb94788c41ca0d26eaff8b697ecfbb4c32f7fdc3b1b"
+dependencies = [
+ "async-stream",
+ "base64 0.22.1",
+ "bitflags",
+ "bollard-buildkit-proto",
+ "bollard-stubs",
+ "bytes",
+ "chrono",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "home",
+ "http",
+ "http-body-util",
+ "hyper",
+ "hyper-named-pipe",
+ "hyper-rustls",
+ "hyper-util",
+ "hyperlocal",
+ "log",
+ "num",
+ "pin-project-lite",
+ "rand 0.9.2",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-pemfile",
+ "rustls-pki-types",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "serde_repr",
+ "serde_urlencoded",
+ "thiserror",
+ "tokio",
+ "tokio-stream",
+ "tokio-util",
+ "tonic",
+ "tower-service",
+ "url",
+ "winapi",
+]
+
+[[package]]
+name = "bollard-buildkit-proto"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85a885520bf6249ab931a764ffdb87b0ceef48e6e7d807cfdb21b751e086e1ad"
+dependencies = [
+ "prost",
+ "prost-types",
+ "tonic",
+ "tonic-prost",
+ "ureq",
+]
+
+[[package]]
+name = "bollard-stubs"
+version = "1.49.1-rc.28.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5731fe885755e92beff1950774068e0cae67ea6ec7587381536fca84f1779623"
+dependencies = [
+ "base64 0.22.1",
+ "bollard-buildkit-proto",
+ "bytes",
+ "chrono",
+ "prost",
+ "serde",
+ "serde_json",
+ "serde_repr",
+ "serde_with",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+
+[[package]]
+name = "cc"
+version = "1.2.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aebf35691d1bfb0ac386a69bac2fde4dd276fb618cf8bf4f5318fe285e821bb2"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "chrono"
+version = "0.4.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+dependencies = [
+ "iana-time-zone",
+ "num-traits",
+ "serde",
+ "windows-link",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cssparser"
+version = "0.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c66d1cd8ed61bf80b38432613a7a2f09401ab8d0501110655f8b341484a3e3"
+dependencies = [
+ "cssparser-macros",
+ "dtoa-short",
+ "itoa",
+ "phf",
+ "smallvec",
+]
+
+[[package]]
+name = "cssparser-macros"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331"
+dependencies = [
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "darling"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "powerfmt",
+ "serde_core",
+]
+
+[[package]]
+name = "derive_more"
+version = "0.99.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6edb4b64a43d977b8e99788fe3a04d483834fba1215a7e02caa415b626497f7f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "derive_more"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a9b99b9cbbe49445b21764dc0625032a89b145a2642e67603e1c936f5458d05"
+dependencies = [
+ "derive_more-impl",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7330aeadfbe296029522e6c40f315320aba36fc43a5b3632f3795348f3bd22"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "unicode-xid",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "docker_credential"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d89dfcba45b4afad7450a99b39e751590463e45c04728cf555d36bb66940de8"
+dependencies = [
+ "base64 0.21.7",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "dtoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
+
+[[package]]
+name = "dtoa-short"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87"
+dependencies = [
+ "dtoa",
+]
+
+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
+[[package]]
+name = "ego-tree"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c6ba7d4eec39eaa9ab24d44a0e73a7949a1095a8b3f3abb11eddf27dbb56a53"
+
+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "error-stack"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe413319145d1063f080f27556fd30b1d70b01e2ba10c2a6e40d4be982ffc5d1"
+dependencies = [
+ "anyhow",
+ "rustc_version",
+]
+
+[[package]]
+name = "etcetera"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26c7b13d0780cb82722fd59f6f57f925e143427e4a75313a6c77243bf5326ae6"
+dependencies = [
+ "cfg-if",
+ "home",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+
+[[package]]
+name = "filetime"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f98844151eee8917efc50bd9e8318cb963ae8b297431495d3f758616ea5c57db"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "libredox",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df420e2e84819663797d1ec6544b13c5be84629e7bb00dc960d6917db2987843"
+dependencies = [
+ "mac",
+ "new_debug_unreachable",
+]
+
+[[package]]
+name = "futures"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "fxhash"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c31b6d751ae2c7f11320402d34e41349dd1016f8d5d45e48c4312bc8625af50c"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "getopts"
+version = "0.2.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfe4fbac503b8d1f88e6676011885f34b7174f46e59956bba534ba83abded4df"
+dependencies = [
+ "unicode-width",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "wasip2",
+ "wasip3",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap 2.13.0",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "html5ever"
+version = "0.29.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b7410cae13cbc75623c98ac4cbfd1f0bedddf3227afc24f370cf0f50a44a11c"
+dependencies = [
+ "log",
+ "mac",
+ "markup5ever",
+ "match_token",
+]
+
+[[package]]
+name = "http"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "pin-utils",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-named-pipe"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73b7d8abf35697b81a825e386fc151e0d503e8cb5fcb93cc8669c376dfd6f278"
+dependencies = [
+ "hex",
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+ "winapi",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-timeout"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
+dependencies = [
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-tls"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
+dependencies = [
+ "bytes",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "system-configuration",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "windows-registry",
+]
+
+[[package]]
+name = "hyperlocal"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7"
+dependencies = [
+ "hex",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
+
+[[package]]
+name = "icu_properties"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
+
+[[package]]
+name = "icu_provider"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.16.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "integration-tests"
+version = "0.1.0"
+dependencies = [
+ "derive_more 1.0.0",
+ "error-stack",
+ "log",
+ "reqwest",
+ "scraper",
+ "testcontainers",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+
+[[package]]
+name = "iri-string"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c91338f0783edbd6195decb37bae672fd3b165faffb89bf7b9e6942f8b1a731a"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+
+[[package]]
+name = "js-sys"
+version = "0.3.91"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b49715b7073f385ba4bc528e5747d02e66cb39c6146efb66b781f131f0fb399c"
+dependencies = [
+ "once_cell",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "libc"
+version = "0.2.182"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6800badb6cb2082ffd7b6a67e6125bb39f18782f793520caee8cb8846be06112"
+
+[[package]]
+name = "libredox"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1744e39d1d6a9948f4f388969627434e31128196de472883b39f148769bfe30a"
+dependencies = [
+ "bitflags",
+ "libc",
+ "plain",
+ "redox_syscall 0.7.3",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6373607a59f0be73a39b6fe456b8192fcc3585f602af20751600e974dd455e77"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+
+[[package]]
+name = "mac"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4"
+
+[[package]]
+name = "markup5ever"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7a7213d12e1864c0f002f52c2923d4556935a43dec5e71355c2760e0f6e7a18"
+dependencies = [
+ "log",
+ "phf",
+ "phf_codegen",
+ "string_cache",
+ "string_cache_codegen",
+ "tendril",
+]
+
+[[package]]
+name = "match_token"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88a9689d8d44bf9964484516275f5cd4c9b59457a6940c1d5d0ecbb94510a36b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
+[[package]]
+name = "memchr"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "mio"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "native-tls"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "465500e14ea162429d264d44189adc38b199b62b1c21eea9f69e4b73cb03bbf2"
+dependencies = [
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework",
+ "security-framework-sys",
+ "tempfile",
+]
+
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+
+[[package]]
+name = "num"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
+dependencies = [
+ "num-bigint",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-complex"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050"
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
+dependencies = [
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+
+[[package]]
+name = "openssl"
+version = "0.10.75"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08838db121398ad17ab8531ce9de97b244589089e290a384c900cb9ff7434328"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.111"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82cab2d520aa75e3c58898289429321eb788c3106963d0dc886ec7a5f4adc321"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall 0.5.18",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "parse-display"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "914a1c2265c98e2446911282c6ac86d8524f495792c38c5bd884f80499c7538a"
+dependencies = [
+ "parse-display-derive",
+ "regex",
+ "regex-syntax",
+]
+
+[[package]]
+name = "parse-display-derive"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ae7800a4c974efd12df917266338e79a7a74415173caf7e70aa0a0707345281"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "regex",
+ "regex-syntax",
+ "structmeta",
+ "syn",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "phf"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
+dependencies = [
+ "phf_macros",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
+dependencies = [
+ "phf_shared",
+ "rand 0.8.5",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f84ac04429c13a7ff43785d75ad27569f2951ce0ffd30a3321230db2fc727216"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pin-project"
+version = "1.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1749c7ed4bcaf4c3d0a3efc28538844fb29bcdd7d2b67b2be7e20ba861ff517"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b20ed30f105399776b9c883e68e536ef602a16ae6f596d2c473591d6ad64c6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b73949432f5e2a09657003c25bca5e19a0e9c84f8058ca374f49e0ebe605af77"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "prost"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2ea70524a2f82d518bce41317d0fae74151505651af45faf1ffbd6fd33f0568"
+dependencies = [
+ "bytes",
+ "prost-derive",
+]
+
+[[package]]
+name = "prost-derive"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
+dependencies = [
+ "anyhow",
+ "itertools",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "prost-types"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8991c4cbdb8bc5b11f0b074ffe286c30e523de90fee5ba8132f1399f23cb3dd7"
+dependencies = [
+ "prost",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+dependencies = [
+ "rand_chacha",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce70a74e890531977d37e532c34d45e9055d2409ed08ddba14529471ed0be16"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "regex"
+version = "1.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+
+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "encoding_rs",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-tls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "mime",
+ "native-tls",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-native-tls",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4"
+dependencies = [
+ "log",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "schannel"
+version = "0.1.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "891d81b926048e76efe18581bf793546b4c0eaf8448d72be8de2bbee5fd166e1"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "schemars"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "scraper"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0e749d29b2064585327af5038a5a8eb73aeebad4a3472e83531a436563f7208"
+dependencies = [
+ "ahash",
+ "cssparser",
+ "ego-tree",
+ "getopts",
+ "html5ever",
+ "precomputed-hash",
+ "selectors",
+ "tendril",
+]
+
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags",
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "selectors"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd568a4c9bb598e291a08244a5c1f5a8a6650bee243b5b0f8dbb3d9cc1d87fe8"
+dependencies = [
+ "bitflags",
+ "cssparser",
+ "derive_more 0.99.20",
+ "fxhash",
+ "log",
+ "new_debug_unreachable",
+ "phf",
+ "phf_codegen",
+ "precomputed-hash",
+ "servo_arc",
+ "smallvec",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.149"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_repr"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_with"
+version = "3.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "381b283ce7bc6b476d903296fb59d0d36633652b633b27f64db4fb46dcbfc3b9"
+dependencies = [
+ "base64 0.22.1",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.13.0",
+ "schemars 0.9.0",
+ "schemars 1.2.1",
+ "serde_core",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6d4e30573c8cb306ed6ab1dca8423eec9a463ea0e155f45399455e0368b27e0"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "servo_arc"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "170fb83ab34de17dc69aa7c67482b22218ddb85da56546f9bd6b929e32a05930"
+dependencies = [
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "siphasher"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2aa850e253778c88a04c3d7323b043aeda9d3e30d5971937c1855769763678e"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+
+[[package]]
+name = "socket2"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "string_cache"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf776ba3fa74f83bf4b63c3dcbbf82173db2632ed8452cb2d891d33f459de70f"
+dependencies = [
+ "new_debug_unreachable",
+ "parking_lot",
+ "phf_shared",
+ "precomputed-hash",
+ "serde",
+]
+
+[[package]]
+name = "string_cache_codegen"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c711928715f1fe0fe509c53b43e993a9a557babc2d0a3567d0a3006f1ac931a0"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "structmeta"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e1575d8d40908d70f6fd05537266b90ae71b15dbbe7a8b7dffa2b759306d329"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "structmeta-derive",
+ "syn",
+]
+
+[[package]]
+name = "structmeta-derive"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "152a0b65a590ff6c3da95cabe2353ee04e6167c896b28e3b14478c2636c922fc"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
+dependencies = [
+ "bitflags",
+ "core-foundation 0.9.4",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82a72c767771b47409d2345987fda8628641887d5466101319899796367354a0"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.2",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tendril"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d24a120c5fc464a3458240ee02c299ebcb9d67b5249c8848b09d639dca8d7bb0"
+dependencies = [
+ "futf",
+ "mac",
+ "utf-8",
+]
+
+[[package]]
+name = "testcontainers"
+version = "0.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f3ac71069f20ecfa60c396316c283fbf35e6833a53dff551a31b5458da05edc"
+dependencies = [
+ "astral-tokio-tar",
+ "async-trait",
+ "bollard",
+ "bytes",
+ "docker_credential",
+ "either",
+ "etcetera",
+ "futures",
+ "log",
+ "memchr",
+ "parse-display",
+ "pin-project-lite",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "thiserror",
+ "tokio",
+ "tokio-stream",
+ "tokio-util",
+ "ulid",
+ "url",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "time"
+version = "0.3.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+
+[[package]]
+name = "time-macros"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tokio"
+version = "1.50.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27ad5e34374e03cfffefc301becb44e9dc3c17584f414349ebe29ed26661822d"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c55a2eff8b69ce66c84f85e1da1c233edc36ceb85a2058d11b0d6a3c7e7569c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tokio-native-tls"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
+dependencies = [
+ "native-tls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tonic"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fec7c61a0695dc1887c1b53952990f3ad2e3a31453e1f49f10e75424943a93ec"
+dependencies = [
+ "async-trait",
+ "axum",
+ "base64 0.22.1",
+ "bytes",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-timeout",
+ "hyper-util",
+ "percent-encoding",
+ "pin-project",
+ "socket2",
+ "sync_wrapper",
+ "tokio",
+ "tokio-stream",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tonic-prost"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a55376a0bbaa4975a3f10d009ad763d8f4108f067c7c2e74f3001fb49778d309"
+dependencies = [
+ "bytes",
+ "prost",
+ "tonic",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "indexmap 2.13.0",
+ "pin-project-lite",
+ "slab",
+ "sync_wrapper",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "iri-string",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "ulid"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "470dbf6591da1b39d43c14523b2b469c86879a53e8b758c8e090a470fe7b1fbe"
+dependencies = [
+ "rand 0.9.2",
+ "web-time",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "ureq"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdc97a28575b85cfedf2a7e7d3cc64b3e11bd8ac766666318003abbacc7a21fc"
+dependencies = [
+ "base64 0.22.1",
+ "log",
+ "percent-encoding",
+ "rustls",
+ "rustls-pki-types",
+ "ureq-proto",
+ "utf-8",
+]
+
+[[package]]
+name = "ureq-proto"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d81f9efa9df032be5934a46a068815a10a042b494b6a58cb0a1a97bb5467ed6f"
+dependencies = [
+ "base64 0.22.1",
+ "http",
+ "httparse",
+ "log",
+]
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+ "serde_derive",
+]
+
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.2+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.114"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6532f9a5c1ece3798cb1c2cfdba640b9b3ba884f5db45973a6f442510a87d38e"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.64"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9c5522b3a28661442748e09d40924dfb9ca614b21c00d3fd135720e48b67db8"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "js-sys",
+ "once_cell",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.114"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18a2d50fcf105fb33bb15f00e7a77b772945a2ee45dcf454961fd843e74c18e6"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.114"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03ce4caeaac547cdf713d280eda22a730824dd11e6b8c3ca9e42247b25c631e3"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.114"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75a326b8c223ee17883a4251907455a2431acc2791c98c26279376490c378c16"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap 2.13.0",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.15.5",
+ "indexmap 2.13.0",
+ "semver",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.91"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "854ba17bb104abfb26ba36da9729addc7ce7f06f5c0f90f3c391f8461cca21f9"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap 2.13.0",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap 2.13.0",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap 2.13.0",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
+
+[[package]]
+name = "xattr"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
+dependencies = [
+ "libc",
+ "rustix",
+]
+
+[[package]]
+name = "yoke"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a789c6e490b576db9f7e6b6d661bcc9799f7c0ac8352f56ea20193b2681532e5"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f65c489a7071a749c849713807783f70672b28094011623e200cb86dcb835953"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c28719294829477f525be0186d13efa9a3c602f7ec202ca9e353d310fb9a002"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/crates/integration-tests/README.md b/crates/integration-tests/README.md
new file mode 100644
index 00000000..f425ab43
--- /dev/null
+++ b/crates/integration-tests/README.md
@@ -0,0 +1,136 @@
+# Integration Tests
+
+End-to-end tests that verify the trusted server against real frontend
+containers using [Testcontainers](https://testcontainers.com/).
+
+## Prerequisites
+
+- **Docker** — running and accessible
+- **Viceroy** — Fastly local simulator (`cargo install viceroy`)
+- **wasm32-wasip1 target** — `rustup target add wasm32-wasip1`
+
+## Quick start
+
+```bash
+./scripts/integration-tests.sh
+```
+
+This script handles everything:
+
+1. Builds the WASM binary with test-specific config (origin URL pointing to
+   Docker containers)
+2. Builds the WordPress and Next.js Docker images
+3. Runs all integration tests sequentially
+
+### Run a single test
+
+```bash
+./scripts/integration-tests.sh test_wordpress_fastly
+./scripts/integration-tests.sh test_nextjs_fastly
+```
+
+### Verbose output
+
+```bash
+./scripts/integration-tests.sh --nocapture
+```
+
+## Docker images
+
+Two test images are built from fixtures in `fixtures/frameworks/`:
+
+| Image | Dockerfile | Description |
+|---|---|---|
+| `test-wordpress:latest` | `fixtures/frameworks/wordpress/Dockerfile` | PHP built-in server with a minimal test theme |
+| `test-nextjs:latest` | `fixtures/frameworks/nextjs/Dockerfile` | Next.js 14 standalone app with test pages |
+
+Both images include test fixtures with absolute origin URLs (`ORIGIN_HOST` env
+var) so the trusted server's URL rewriting can be verified.
+
+### Build images manually
+
+```bash
+docker build -t test-wordpress:latest \
+  crates/integration-tests/fixtures/frameworks/wordpress/
+
+docker build -t test-nextjs:latest \
+  crates/integration-tests/fixtures/frameworks/nextjs/
+```
+
+## Test scenarios
+
+### Standard (all frameworks)
+
+| Scenario | What it tests |
+|---|---|
+| `HtmlInjection` | `<script src="/static/tsjs=...">` is present in proxied HTML |
+| `ScriptServing` | `/static/tsjs=tsjs-unified.min.js` returns JavaScript with bundle markers |
+| `AttributeRewriting` | `href`/`src` URLs with origin host are rewritten to proxy host |
+
+### Next.js custom
+
+| Scenario | What it tests |
+|---|---|
+| `NextJsRscFlight` | RSC Flight responses are not corrupted (no HTML, no script injection) |
+| `NextJsServerActions` | POST requests pass through the proxy to the origin |
+
+## Architecture
+
+```
+tests/
+  integration.rs       # Test entry point — runs framework x runtime matrix
+  common/
+    assertions.rs      # HTML assertion helpers (script tag, attribute rewriting)
+    runtime.rs         # Error types, RuntimeEnvironment trait, env var helpers
+  environments/
+    mod.rs             # Runtime registry, port allocation, health checking
+    fastly.rs          # Viceroy-based Fastly Compute runtime
+  frameworks/
+    mod.rs             # Framework registry and FrontendFramework trait
+    scenarios.rs       # Standard and custom test scenarios
+    wordpress.rs       # WordPress container config
+    nextjs.rs          # Next.js container config
+fixtures/
+  configs/
+    viceroy-template.toml  # Viceroy local_server config (KV stores, secrets)
+  frameworks/
+    wordpress/             # WordPress Docker image source
+    nextjs/                # Next.js Docker image source
+```
+
+### How it works
+
+1. A Docker container starts for the frontend framework, mapped to a fixed
+   origin port (default 8888)
+2. The WASM binary is pre-built with `TRUSTED_SERVER__PUBLISHER__ORIGIN_URL`
+   pointing to `http://127.0.0.1:8888` so the proxy knows where to forward
+3. Viceroy spawns with the WASM binary on a random port
+4. HTTP requests go to Viceroy (proxy) which forwards to the Docker container
+   (origin) and processes the response
+5. Assertions verify the proxied response has script injection, URL rewriting,
+   etc.
+
+### Why `--test-threads=1`
+
+All tests share the same fixed origin port (8888). The trusted server config is
+baked into the WASM binary at compile time with this port, so only one Docker
+container can be bound to it at a time.
+
+## CI
+
+Integration tests run in a separate workflow (`.github/workflows/integration-tests.yml`)
+triggered by:
+
+- Push to `main`
+- PR approval
+- Manual dispatch
+
+They are **not** part of `cargo test --workspace` because the crate requires a
+native target while the workspace default is `wasm32-wasip1`.
+
+## Not tested (out of scope)
+
+- **GDPR consent propagation** — the consent field exists in `AuctionRequest`
+  but is not yet populated or forwarded. Requires implementation first.
+- **Client-side navigation** — requires a real browser (Playwright/Selenium).
+  HTTP-level tests cannot verify JavaScript execution or route transitions.
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx b/crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx
index 093b815c..d75cc0be 100644
--- a/crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx
@@ -1,9 +1,23 @@
 export default function Home() {
+  // Server component — process.env is available at render time
+  const originHost = process.env.ORIGIN_HOST || "127.0.0.1:8888";
+
   return (
     <main>
       <h1>Integration Test Publisher</h1>
       <p>This is a test page for integration testing of the trusted server.</p>
 
+      {/* Links with absolute origin URLs for attribute rewriting tests.
+          The trusted server should rewrite these from origin host to proxy host. */}
+      <a id="origin-link" href={`http://${originHost}/page`}>
+        Origin Link
+      </a>
+      <img
+        id="origin-img"
+        src={`http://${originHost}/images/test.png`}
+        alt="test"
+      />
+
       {/* Ad slot that should be rewritten by the trusted server */}
       <div id="ad-slot-1" data-ad-unit="/test/banner">
         <p>Advertisement placeholder</p>
diff --git a/crates/integration-tests/fixtures/frameworks/wordpress/theme/index.php b/crates/integration-tests/fixtures/frameworks/wordpress/theme/index.php
index 624f4d28..54f64e7a 100644
--- a/crates/integration-tests/fixtures/frameworks/wordpress/theme/index.php
+++ b/crates/integration-tests/fixtures/frameworks/wordpress/theme/index.php
@@ -20,6 +20,12 @@
             <h2>Test Article</h2>
             <p>This is a test article for integration testing of the trusted server.</p>
 
+            <!-- Links with absolute origin URLs for attribute rewriting tests.
+                 The trusted server should rewrite these from origin host to proxy host. -->
+            <?php $origin = getenv('ORIGIN_HOST') ?: '127.0.0.1:8888'; ?>
+            <a id="origin-link" href="http://<?= $origin ?>/page">Origin Link</a>
+            <img id="origin-img" src="http://<?= $origin ?>/images/test.png" alt="test">
+
             <!-- Ad slot that should be rewritten by the trusted server -->
             <div id="ad-slot-1" data-ad-unit="/test/banner">
                 <p>Advertisement placeholder</p>
@@ -35,7 +41,7 @@
     </main>
 
     <footer>
-        <p>&copy; 2025 Test Publisher</p>
+        <p>&copy; 2026 Test Publisher</p>
     </footer>
 </body>
 </html>
diff --git a/crates/integration-tests/tests/common/assertions.rs b/crates/integration-tests/tests/common/assertions.rs
index 669f6542..50af25ee 100644
--- a/crates/integration-tests/tests/common/assertions.rs
+++ b/crates/integration-tests/tests/common/assertions.rs
@@ -26,6 +26,130 @@ pub fn assert_script_tag_present(html: &str) -> Result<(), TestError> {
     Err(error_stack::report!(TestError::ScriptTagNotFound))
 }
 
+/// Assert that exactly one `<script id="trustedserver-js">` exists in the HTML.
+///
+/// This is a stricter variant of [`assert_script_tag_present`] that verifies
+/// uniqueness: the trusted-server must inject exactly one script tag with
+/// `id="trustedserver-js"` and a `src` containing `/static/tsjs=`.
+///
+/// # Errors
+///
+/// Returns [`TestError::ScriptTagNotFound`] if zero or more than one matching
+/// script tag is found.
+pub fn assert_unique_script_tag(html: &str) -> Result<(), TestError> {
+    let document = Html::parse_document(html);
+    let selector = parse_selector("script#trustedserver-js[src*='/static/tsjs=']")?;
+
+    let count = document.select(&selector).count();
+
+    if count == 0 {
+        return Err(error_stack::report!(TestError::ScriptTagNotFound)
+            .attach_printable("No script#trustedserver-js[src*='/static/tsjs='] found"));
+    }
+
+    if count > 1 {
+        return Err(error_stack::report!(TestError::ScriptTagNotFound).attach_printable(
+            format!("Expected exactly 1 script#trustedserver-js, found {count}"),
+        ));
+    }
+
+    Ok(())
+}
+
+/// Assert that origin host URLs in `href`/`src` attributes have been rewritten.
+///
+/// Checks that the proxied HTML no longer contains the origin host in `href`
+/// or `src` attributes, and that at least one attribute now contains the proxy
+/// host. This verifies the HTML processor's URL rewriting behavior.
+///
+/// # Errors
+///
+/// Returns [`TestError::AttributeNotRewritten`] if origin URLs remain or if
+/// no proxy URLs are found.
+pub fn assert_attributes_rewritten(
+    html: &str,
+    origin_host: &str,
+    proxy_base_url: &str,
+) -> Result<(), TestError> {
+    let document = Html::parse_document(html);
+
+    // Extract proxy host from base_url (e.g. "http://127.0.0.1:12345" -> "127.0.0.1:12345")
+    let proxy_host = proxy_base_url
+        .strip_prefix("http://")
+        .or_else(|| proxy_base_url.strip_prefix("https://"))
+        .unwrap_or(proxy_base_url);
+
+    // Check all elements with href or src attributes
+    let all_selector = parse_selector("[href], [src]")?;
+    let mut found_proxy_url = false;
+
+    for element in document.select(&all_selector) {
+        for attr in ["href", "src"] {
+            if let Some(value) = element.value().attr(attr) {
+                // Origin host should NOT appear in any attribute
+                if value.contains(origin_host) {
+                    return Err(error_stack::report!(TestError::AttributeNotRewritten)
+                        .attach_printable(format!(
+                            "Origin host still present in {attr}=\"{value}\""
+                        )));
+                }
+
+                // Track whether we find at least one rewritten proxy URL
+                if value.contains(proxy_host) {
+                    found_proxy_url = true;
+                }
+            }
+        }
+    }
+
+    if !found_proxy_url {
+        return Err(error_stack::report!(TestError::AttributeNotRewritten)
+            .attach_printable(format!(
+                "No attributes rewritten to proxy host ({proxy_host}). \
+                 Check that the origin HTML contains absolute URLs with {origin_host}"
+            )));
+    }
+
+    Ok(())
+}
+
+/// Assert that `data-ad-unit` attribute values are preserved unchanged.
+///
+/// The trusted-server rewrites URL-bearing attributes (`href`, `src`) but must
+/// NOT modify non-URL attributes like `data-ad-unit`. This assertion verifies
+/// that ad-slot markup passes through the proxy intact.
+///
+/// # Arguments
+///
+/// * `html` - The proxied HTML response body.
+/// * `expected_units` - The `data-ad-unit` values that must be present unchanged.
+///
+/// # Errors
+///
+/// Returns [`TestError::AttributeNotRewritten`] if any expected `data-ad-unit`
+/// value is missing from the proxied HTML.
+pub fn assert_data_ad_units_preserved(html: &str, expected_units: &[&str]) -> Result<(), TestError> {
+    let document = Html::parse_document(html);
+    let selector = parse_selector("[data-ad-unit]")?;
+
+    let found_units: Vec<String> = document
+        .select(&selector)
+        .filter_map(|el| el.value().attr("data-ad-unit").map(String::from))
+        .collect();
+
+    for expected in expected_units {
+        if !found_units.iter().any(|u| u == expected) {
+            return Err(error_stack::report!(TestError::AttributeNotRewritten)
+                .attach_printable(format!(
+                    "data-ad-unit=\"{expected}\" not found in proxied HTML. \
+                     Found units: {found_units:?}"
+                )));
+        }
+    }
+
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -56,6 +180,151 @@ mod tests {
         assert!(result.is_err(), "should fail when no script tag exists");
     }
 
+    #[test]
+    fn attributes_rewritten_detects_proxy_host() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <head></head>
+            <body>
+                <a id="origin-link" href="http://127.0.0.1:9999/page">Link</a>
+                <img id="origin-img" src="http://127.0.0.1:9999/images/test.png">
+            </body>
+            </html>
+        "#;
+
+        assert_attributes_rewritten(html, "127.0.0.1:8888", "http://127.0.0.1:9999")
+            .expect("should detect rewritten proxy URLs");
+    }
+
+    #[test]
+    fn attributes_rewritten_fails_when_origin_remains() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <head></head>
+            <body>
+                <a href="http://127.0.0.1:8888/page">Link</a>
+            </body>
+            </html>
+        "#;
+
+        let result = assert_attributes_rewritten(html, "127.0.0.1:8888", "http://127.0.0.1:9999");
+        assert!(
+            result.is_err(),
+            "should fail when origin host is still in attributes"
+        );
+    }
+
+    #[test]
+    fn attributes_rewritten_fails_when_no_proxy_urls() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <head></head>
+            <body>
+                <a href="/relative/path">Link</a>
+            </body>
+            </html>
+        "#;
+
+        let result = assert_attributes_rewritten(html, "127.0.0.1:8888", "http://127.0.0.1:9999");
+        assert!(
+            result.is_err(),
+            "should fail when no attributes contain proxy host"
+        );
+    }
+
+    #[test]
+    fn unique_script_tag_passes_with_exactly_one() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <head>
+                <script src="/static/tsjs=tsjs-unified.min.js?v=abc123" id="trustedserver-js"></script>
+            </head>
+            <body></body>
+            </html>
+        "#;
+
+        assert_unique_script_tag(html).expect("should find exactly one trustedserver-js");
+    }
+
+    #[test]
+    fn unique_script_tag_fails_when_missing() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html><head></head><body></body></html>
+        "#;
+
+        let result = assert_unique_script_tag(html);
+        assert!(result.is_err(), "should fail when no trustedserver-js exists");
+    }
+
+    #[test]
+    fn unique_script_tag_fails_when_duplicated() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <head>
+                <script src="/static/tsjs=tsjs-unified.min.js?v=abc" id="trustedserver-js"></script>
+                <script src="/static/tsjs=tsjs-unified.min.js?v=abc" id="trustedserver-js"></script>
+            </head>
+            <body></body>
+            </html>
+        "#;
+
+        let result = assert_unique_script_tag(html);
+        assert!(result.is_err(), "should fail when multiple trustedserver-js exist");
+    }
+
+    #[test]
+    fn unique_script_tag_fails_when_no_id() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <head>
+                <script src="/static/tsjs=tsjs-unified.min.js?v=abc"></script>
+            </head>
+            <body></body>
+            </html>
+        "#;
+
+        let result = assert_unique_script_tag(html);
+        assert!(result.is_err(), "should fail when script has no id");
+    }
+
+    #[test]
+    fn data_ad_units_preserved_passes() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <body>
+                <div data-ad-unit="/test/banner">Ad</div>
+                <div data-ad-unit="/test/sidebar">Ad</div>
+            </body>
+            </html>
+        "#;
+
+        assert_data_ad_units_preserved(html, &["/test/banner", "/test/sidebar"])
+            .expect("should find both ad units");
+    }
+
+    #[test]
+    fn data_ad_units_preserved_fails_when_missing() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <body>
+                <div data-ad-unit="/test/banner">Ad</div>
+            </body>
+            </html>
+        "#;
+
+        let result = assert_data_ad_units_preserved(html, &["/test/banner", "/test/sidebar"]);
+        assert!(result.is_err(), "should fail when expected ad unit is missing");
+    }
+
     #[test]
     fn script_tag_present_fails_when_wrong_script() {
         let html = r#"
diff --git a/crates/integration-tests/tests/common/runtime.rs b/crates/integration-tests/tests/common/runtime.rs
index 02bae534..09c742d0 100644
--- a/crates/integration-tests/tests/common/runtime.rs
+++ b/crates/integration-tests/tests/common/runtime.rs
@@ -39,6 +39,9 @@ pub enum TestError {
     #[display("Invalid CSS selector")]
     InvalidSelector,
 
+    #[display("Origin URL not rewritten in HTML attributes")]
+    AttributeNotRewritten,
+
     // Resource errors
     #[display("No available port found")]
     NoPortAvailable,
diff --git a/crates/integration-tests/tests/environments/fastly.rs b/crates/integration-tests/tests/environments/fastly.rs
index 35328ef5..48aab905 100644
--- a/crates/integration-tests/tests/environments/fastly.rs
+++ b/crates/integration-tests/tests/environments/fastly.rs
@@ -31,18 +31,20 @@ impl RuntimeEnvironment for FastlyViceroy {
             .change_context(TestError::RuntimeSpawn)
             .attach_printable("Failed to spawn viceroy process")?;
 
+        // Wrap immediately so Drop::drop kills the process if readiness check fails
+        let handle = ViceroyHandle { child };
         let base_url = format!("http://127.0.0.1:{port}");
 
         super::wait_for_ready(&base_url, self.health_check_path())?;
 
         Ok(RuntimeProcess {
-            inner: Box::new(ViceroyHandle { child }),
+            inner: Box::new(handle),
             base_url,
         })
     }
 
     fn health_check_path(&self) -> &str {
-        "/health"
+        "/__trusted-server/health"
     }
 }
 
diff --git a/crates/integration-tests/tests/environments/mod.rs b/crates/integration-tests/tests/environments/mod.rs
index aef6428f..23ccc175 100644
--- a/crates/integration-tests/tests/environments/mod.rs
+++ b/crates/integration-tests/tests/environments/mod.rs
@@ -50,17 +50,17 @@ pub fn wait_for_ready(base_url: &str, health_path: &str) -> error_stack::Result<
     let health_url = format!("{}{}", base_url, health_path);
 
     for _ in 0..30 {
-        if let Ok(resp) = reqwest::blocking::get(&health_url) {
-            if resp.status().is_success() {
-                return Ok(());
-            }
+        if let Ok(resp) = reqwest::blocking::get(&health_url)
+            && resp.status().is_success()
+        {
+            return Ok(());
         }
 
         // Fallback: try root path — a 404 means the server is responsive
-        if let Ok(resp) = reqwest::blocking::get(base_url) {
-            if resp.status().is_success() || resp.status().as_u16() == 404 {
-                return Ok(());
-            }
+        if let Ok(resp) = reqwest::blocking::get(base_url)
+            && (resp.status().is_success() || resp.status().as_u16() == 404)
+        {
+            return Ok(());
         }
 
         std::thread::sleep(std::time::Duration::from_millis(100));
diff --git a/crates/integration-tests/tests/frameworks/nextjs.rs b/crates/integration-tests/tests/frameworks/nextjs.rs
index 16bb0db3..27776b4b 100644
--- a/crates/integration-tests/tests/frameworks/nextjs.rs
+++ b/crates/integration-tests/tests/frameworks/nextjs.rs
@@ -25,9 +25,11 @@ impl FrontendFramework for NextJs {
         origin_port: u16,
     ) -> error_stack::Result<ContainerRequest<GenericImage>, TestError> {
         let container_port = self.container_port();
+        let origin_host = format!("127.0.0.1:{origin_port}");
         Ok(GenericImage::new("test-nextjs", "latest")
             .with_exposed_port(container_port.tcp())
-            .with_mapped_port(origin_port, container_port.tcp()))
+            .with_mapped_port(origin_port, container_port.tcp())
+            .with_env_var("ORIGIN_HOST", origin_host))
     }
 
     fn container_port(&self) -> u16 {
@@ -39,7 +41,12 @@ impl FrontendFramework for NextJs {
     }
 
     fn standard_scenarios(&self) -> Vec<TestScenario> {
-        vec![TestScenario::HtmlInjection, TestScenario::ScriptServing]
+        vec![
+            TestScenario::HtmlInjection,
+            TestScenario::ScriptServing,
+            TestScenario::AttributeRewriting,
+            TestScenario::ScriptServingUnknownFile404,
+        ]
     }
 
     fn custom_scenarios(&self) -> Vec<CustomScenario> {
diff --git a/crates/integration-tests/tests/frameworks/scenarios.rs b/crates/integration-tests/tests/frameworks/scenarios.rs
index 3c340b7f..b3a4ff5b 100644
--- a/crates/integration-tests/tests/frameworks/scenarios.rs
+++ b/crates/integration-tests/tests/frameworks/scenarios.rs
@@ -1,5 +1,5 @@
 use crate::common::assertions;
-use crate::common::runtime::TestError;
+use crate::common::runtime::{TestError, origin_port};
 use error_stack::ResultExt as _;
 
 /// Standard test scenarios applicable to all frontend frameworks.
@@ -13,6 +13,12 @@ pub enum TestScenario {
 
     /// Verify `/static/tsjs=tsjs-unified.min.js` endpoint serves the JS bundle.
     ScriptServing,
+
+    /// Verify origin host URLs in `href`/`src` attributes are rewritten to the proxy host.
+    AttributeRewriting,
+
+    /// Verify `/static/tsjs=unknown.js` returns 404, not HTML or a fallback.
+    ScriptServingUnknownFile404,
 }
 
 /// Framework-specific custom scenarios that test framework-unique behaviors.
@@ -23,6 +29,13 @@ pub enum CustomScenario {
 
     /// Next.js: Server Actions POST requests pass through correctly.
     NextJsServerActions,
+
+    /// WordPress: Admin pages (`/wp-admin/`) receive script injection.
+    ///
+    /// The trusted server currently injects into ALL HTML responses
+    /// regardless of path. This test documents that behavior and guards
+    /// against unintended changes.
+    WordPressAdminInjection,
 }
 
 impl TestScenario {
@@ -50,9 +63,40 @@ impl TestScenario {
                     .change_context(TestError::ResponseParse)
                     .attach_printable(format!("framework: {framework_id}"))?;
 
-                assertions::assert_script_tag_present(&html)
+                assertions::assert_unique_script_tag(&html)
+                    .attach_printable(format!("framework: {framework_id}"))?;
+
+                Ok(())
+            }
+
+            Self::AttributeRewriting => {
+                // Verify that absolute origin URLs in href/src attributes are
+                // rewritten to the proxy host. The test fixtures embed links
+                // like `http://127.0.0.1:8888/page` which the HTML processor
+                // should rewrite to `http://127.0.0.1:{proxy_port}/page`.
+                let resp = reqwest::blocking::get(base_url)
+                    .change_context(TestError::HttpRequest)
+                    .attach_printable(format!(
+                        "scenario: AttributeRewriting, framework: {framework_id}"
+                    ))?;
+
+                let html = resp
+                    .text()
+                    .change_context(TestError::ResponseParse)
+                    .attach_printable(format!("framework: {framework_id}"))?;
+
+                let origin_host = format!("127.0.0.1:{}", origin_port());
+
+                assertions::assert_attributes_rewritten(&html, &origin_host, base_url)
                     .attach_printable(format!("framework: {framework_id}"))?;
 
+                // Verify non-URL attributes like data-ad-unit are preserved unchanged
+                assertions::assert_data_ad_units_preserved(
+                    &html,
+                    &["/test/banner", "/test/sidebar"],
+                )
+                .attach_printable(format!("framework: {framework_id}"))?;
+
                 Ok(())
             }
 
@@ -74,6 +118,75 @@ impl TestScenario {
                     );
                 }
 
+                // Verify content type is JavaScript
+                let content_type = resp
+                    .headers()
+                    .get("content-type")
+                    .and_then(|v| v.to_str().ok())
+                    .unwrap_or("")
+                    .to_string();
+
+                let body = resp
+                    .text()
+                    .change_context(TestError::ResponseParse)
+                    .attach_printable(format!("framework: {framework_id}"))?;
+
+                if !content_type.contains("javascript") {
+                    return Err(error_stack::report!(TestError::ResponseParse)
+                        .attach_printable(format!(
+                            "Expected JavaScript content-type, got: {content_type}"
+                        )));
+                }
+
+                // Verify body is non-empty and contains expected bundle markers
+                if body.is_empty() {
+                    return Err(error_stack::report!(TestError::ResponseParse)
+                        .attach_printable("Script bundle body is empty"));
+                }
+
+                // The unified bundle should contain the TSJS core initialization
+                if !body.contains("trustedserver") && !body.contains("tsjs") {
+                    return Err(error_stack::report!(TestError::ResponseParse)
+                        .attach_printable(
+                            "Script bundle does not contain expected trustedserver/tsjs markers",
+                        ));
+                }
+
+                Ok(())
+            }
+
+            Self::ScriptServingUnknownFile404 => {
+                let url = format!("{base_url}/static/tsjs=unknown.js");
+
+                let resp = reqwest::blocking::get(&url)
+                    .change_context(TestError::HttpRequest)
+                    .attach_printable(format!(
+                        "scenario: ScriptServingUnknownFile404, framework: {framework_id}"
+                    ))?;
+
+                let status = resp.status().as_u16();
+
+                if status != 404 {
+                    return Err(error_stack::report!(TestError::HttpRequest)
+                        .attach_printable(format!(
+                            "Expected 404 for unknown tsjs file, got {status}"
+                        )));
+                }
+
+                // Response should not be HTML (which would indicate a fallback to origin)
+                let content_type = resp
+                    .headers()
+                    .get("content-type")
+                    .and_then(|v| v.to_str().ok())
+                    .unwrap_or("");
+
+                if content_type.contains("text/html") {
+                    return Err(error_stack::report!(TestError::ResponseParse)
+                        .attach_printable(
+                            "Unknown tsjs file returned HTML instead of a proper 404",
+                        ));
+                }
+
                 Ok(())
             }
         }
@@ -89,7 +202,9 @@ impl CustomScenario {
     pub fn run(&self, base_url: &str, framework_id: &str) -> error_stack::Result<(), TestError> {
         match self {
             Self::NextJsRscFlight => {
-                // Verify RSC Flight format responses are not corrupted
+                // Verify RSC Flight format responses are not corrupted.
+                // When the proxy mishandles the RSC header, it returns text/html
+                // instead of the expected Flight payload — so we fail on HTML.
                 let client = reqwest::blocking::Client::new();
                 let resp = client
                     .get(base_url)
@@ -105,27 +220,41 @@ impl CustomScenario {
                     .headers()
                     .get("content-type")
                     .and_then(|v| v.to_str().ok())
-                    .unwrap_or("");
+                    .unwrap_or("")
+                    .to_string();
 
-                // RSC responses should have text/x-component content type
-                // and should NOT have script injection (they're not HTML)
-                if content_type.contains("text/x-component") {
-                    let body = resp.text().change_context(TestError::ResponseParse)?;
-
-                    if body.contains("/static/tsjs=") {
-                        return Err(error_stack::report!(TestError::ScriptTagNotFound)
-                            .attach_printable(
-                                "Script tag should NOT be injected in RSC Flight responses",
-                            ));
-                    }
+                let body = resp.text().change_context(TestError::ResponseParse)?;
+
+                // RSC responses must NOT be HTML — that means the proxy
+                // swallowed the RSC header and treated it as a page request
+                if content_type.contains("text/html") {
+                    return Err(error_stack::report!(TestError::ResponseParse)
+                        .attach_printable(format!(
+                            "RSC request returned text/html instead of Flight payload (content-type: {content_type})"
+                        )));
+                }
+
+                // If the response is a Flight payload, it must not contain injected scripts
+                if body.contains("/static/tsjs=") {
+                    return Err(error_stack::report!(TestError::ScriptTagNotFound)
+                        .attach_printable(
+                            "Script tag should NOT be injected in RSC Flight responses",
+                        ));
                 }
 
                 Ok(())
             }
 
             Self::NextJsServerActions => {
-                // Verify POST requests for server actions pass through correctly
-                let client = reqwest::blocking::Client::new();
+                // Verify POST requests pass through the proxy to the origin.
+                // The minimal Next.js app has no real server actions, so the
+                // framework returns a client or redirect response. A 5xx means
+                // the proxy itself failed rather than forwarding.
+                let client = reqwest::blocking::Client::builder()
+                    .redirect(reqwest::redirect::Policy::none())
+                    .build()
+                    .change_context(TestError::HttpRequest)?;
+
                 let resp = client
                     .post(base_url)
                     .header("Next-Action", "test-action-id")
@@ -137,20 +266,49 @@ impl CustomScenario {
                         "scenario: NextJsServerActions, framework: {framework_id}"
                     ))?;
 
-                // Server action responses should pass through without modification
-                // A 4xx is acceptable since we don't have real server actions,
-                // but a connection error would indicate the proxy is blocking POSTs
-                if resp.status().is_server_error() {
+                let status = resp.status();
+
+                // The proxy must forward the POST. We expect a non-5xx from
+                // the origin: 2xx, 3xx (redirect), or 4xx (no matching action).
+                if status.is_server_error() {
+                    let body = resp.text().unwrap_or_default();
                     return Err(
                         error_stack::report!(TestError::HttpRequest).attach_printable(format!(
-                            "Server action request failed with {}",
-                            resp.status()
+                            "POST request failed with {status}; body: {body}"
                         )),
                     );
                 }
 
                 Ok(())
             }
+
+            Self::WordPressAdminInjection => {
+                // Verify that /wp-admin/ pages also receive script injection.
+                // The trusted server injects into ALL HTML responses regardless
+                // of path. This test documents that behavior — if admin-path
+                // exclusion is added in the future, this test should be updated
+                // to assert NO injection instead.
+                let url = format!("{base_url}/wp-admin/");
+
+                let resp = reqwest::blocking::get(&url)
+                    .change_context(TestError::HttpRequest)
+                    .attach_printable(format!(
+                        "scenario: WordPressAdminInjection, framework: {framework_id}"
+                    ))?;
+
+                let html = resp
+                    .text()
+                    .change_context(TestError::ResponseParse)
+                    .attach_printable(format!("framework: {framework_id}"))?;
+
+                assertions::assert_script_tag_present(&html)
+                    .attach_printable(format!(
+                        "Admin page should receive injection (current behavior). \
+                         framework: {framework_id}"
+                    ))?;
+
+                Ok(())
+            }
         }
     }
 }
diff --git a/crates/integration-tests/tests/frameworks/wordpress.rs b/crates/integration-tests/tests/frameworks/wordpress.rs
index faad4a42..0cdfe52e 100644
--- a/crates/integration-tests/tests/frameworks/wordpress.rs
+++ b/crates/integration-tests/tests/frameworks/wordpress.rs
@@ -26,9 +26,11 @@ impl FrontendFramework for WordPress {
         origin_port: u16,
     ) -> error_stack::Result<ContainerRequest<GenericImage>, TestError> {
         let container_port = self.container_port();
+        let origin_host = format!("127.0.0.1:{origin_port}");
         Ok(GenericImage::new("test-wordpress", "latest")
             .with_exposed_port(container_port.tcp())
-            .with_mapped_port(origin_port, container_port.tcp()))
+            .with_mapped_port(origin_port, container_port.tcp())
+            .with_env_var("ORIGIN_HOST", origin_host))
     }
 
     fn container_port(&self) -> u16 {
@@ -40,6 +42,15 @@ impl FrontendFramework for WordPress {
     }
 
     fn standard_scenarios(&self) -> Vec<TestScenario> {
-        vec![TestScenario::HtmlInjection, TestScenario::ScriptServing]
+        vec![
+            TestScenario::HtmlInjection,
+            TestScenario::ScriptServing,
+            TestScenario::AttributeRewriting,
+            TestScenario::ScriptServingUnknownFile404,
+        ]
+    }
+
+    fn custom_scenarios(&self) -> Vec<CustomScenario> {
+        vec![CustomScenario::WordPressAdminInjection]
     }
 }
diff --git a/crates/integration-tests/tests/integration.rs b/crates/integration-tests/tests/integration.rs
index eaa59b84..36b5be1c 100644
--- a/crates/integration-tests/tests/integration.rs
+++ b/crates/integration-tests/tests/integration.rs
@@ -108,10 +108,10 @@ fn wait_for_container(base_url: &str, health_path: &str) -> error_stack::Result<
     let url = format!("{base_url}{health_path}");
 
     for _ in 0..60 {
-        if let Ok(resp) = reqwest::blocking::get(&url) {
-            if resp.status().is_success() {
-                return Ok(());
-            }
+        if let Ok(resp) = reqwest::blocking::get(&url)
+            && resp.status().is_success()
+        {
+            return Ok(());
         }
         std::thread::sleep(Duration::from_millis(500));
     }
diff --git a/scripts/integration-tests.sh b/scripts/integration-tests.sh
index b5e89bdd..316d416c 100755
--- a/scripts/integration-tests.sh
+++ b/scripts/integration-tests.sh
@@ -20,12 +20,12 @@ cd "$REPO_ROOT"
 # can proxy requests to them.
 ORIGIN_PORT="${INTEGRATION_ORIGIN_PORT:-8888}"
 
-# Detect native target
-case "$(uname -m)" in
-    arm64|aarch64) TARGET="aarch64-apple-darwin" ;;
-    x86_64)        TARGET="x86_64-unknown-linux-gnu" ;;
-    *)             echo "Unsupported architecture: $(uname -m)" >&2; exit 1 ;;
-esac
+# Detect native target from rustc (handles all OS + arch combinations correctly)
+TARGET="$(rustc -vV | sed -n 's/^host: //p')"
+if [ -z "$TARGET" ]; then
+    echo "Failed to detect host target from rustc -vV" >&2
+    exit 1
+fi
 
 echo "==> Building WASM binary (origin=http://127.0.0.1:$ORIGIN_PORT)..."
 TRUSTED_SERVER__PUBLISHER__ORIGIN_URL="http://127.0.0.1:$ORIGIN_PORT" \
@@ -44,4 +44,7 @@ echo "==> Running integration tests (target: $TARGET, origin port: $ORIGIN_PORT)
 WASM_BINARY_PATH="$REPO_ROOT/target/wasm32-wasip1/release/trusted-server-fastly.wasm" \
 INTEGRATION_ORIGIN_PORT="$ORIGIN_PORT" \
 RUST_LOG=info \
-    cargo test -p integration-tests --target "$TARGET" -- --include-ignored --test-threads=1 "$@"
+    cargo test \
+        --manifest-path crates/integration-tests/Cargo.toml \
+        --target "$TARGET" \
+        -- --include-ignored --test-threads=1 "$@"

From 582f80c91b79697485f565603762da948140384b Mon Sep 17 00:00:00 2001
From: prk-Jr <prakashsagwara@gmail.com>
Date: Sat, 7 Mar 2026 13:13:16 +0530
Subject: [PATCH 07/15] Enrich Next.js fixture and add browser integration
 tests

---
 .github/workflows/integration-tests.yml       |  98 ++++++++
 .gitignore                                    |   8 +-
 crates/integration-tests/Cargo.lock           |   1 +
 crates/integration-tests/Cargo.toml           |   1 +
 crates/integration-tests/README.md            | 100 ++++++--
 .../integration-tests/browser/global-setup.ts |  80 +++++++
 .../browser/global-teardown.ts                |  33 +++
 .../browser/helpers/infra.ts                  | 128 ++++++++++
 .../browser/helpers/state.ts                  |  16 ++
 .../browser/helpers/wait-for-ready.ts         |  30 +++
 .../browser/package-lock.json                 |  78 ++++++
 crates/integration-tests/browser/package.json |  13 +
 .../browser/playwright.config.ts              |  25 ++
 .../tests/nextjs/api-passthrough.spec.ts      |  40 ++++
 .../tests/nextjs/form-rewriting.spec.ts       |  33 +++
 .../browser/tests/nextjs/navigation.spec.ts   |  99 ++++++++
 .../tests/shared/script-bundle.spec.ts        |  53 +++++
 .../tests/shared/script-injection.spec.ts     |  36 +++
 .../tests/wordpress/admin-injection.spec.ts   |  22 ++
 .../integration-tests/browser/tsconfig.json   |  12 +
 .../fixtures/frameworks/nextjs/Dockerfile     |   4 +-
 .../frameworks/nextjs/app/about/page.tsx      |  18 ++
 .../frameworks/nextjs/app/api/data/route.ts   |  11 +
 .../frameworks/nextjs/app/api/hello/route.ts  |   9 +
 .../nextjs/app/components/Navigation.tsx      |  21 ++
 .../frameworks/nextjs/app/contact/page.tsx    |  28 +++
 .../frameworks/nextjs/app/dashboard/page.tsx  |  30 +++
 .../fixtures/frameworks/nextjs/app/layout.tsx |   7 +-
 .../fixtures/frameworks/nextjs/app/page.tsx   |   8 +-
 .../fixtures/frameworks/nextjs/package.json   |   5 +
 .../frameworks/wordpress/theme/index.php      |   8 +-
 .../tests/common/assertions.rs                | 222 ++++++++++++++++++
 .../tests/frameworks/nextjs.rs                |   2 +
 .../tests/frameworks/scenarios.rs             | 137 ++++++++++-
 scripts/integration-tests-browser.sh          |  63 +++++
 35 files changed, 1444 insertions(+), 35 deletions(-)
 create mode 100644 crates/integration-tests/browser/global-setup.ts
 create mode 100644 crates/integration-tests/browser/global-teardown.ts
 create mode 100644 crates/integration-tests/browser/helpers/infra.ts
 create mode 100644 crates/integration-tests/browser/helpers/state.ts
 create mode 100644 crates/integration-tests/browser/helpers/wait-for-ready.ts
 create mode 100644 crates/integration-tests/browser/package-lock.json
 create mode 100644 crates/integration-tests/browser/package.json
 create mode 100644 crates/integration-tests/browser/playwright.config.ts
 create mode 100644 crates/integration-tests/browser/tests/nextjs/api-passthrough.spec.ts
 create mode 100644 crates/integration-tests/browser/tests/nextjs/form-rewriting.spec.ts
 create mode 100644 crates/integration-tests/browser/tests/nextjs/navigation.spec.ts
 create mode 100644 crates/integration-tests/browser/tests/shared/script-bundle.spec.ts
 create mode 100644 crates/integration-tests/browser/tests/shared/script-injection.spec.ts
 create mode 100644 crates/integration-tests/browser/tests/wordpress/admin-injection.spec.ts
 create mode 100644 crates/integration-tests/browser/tsconfig.json
 create mode 100644 crates/integration-tests/fixtures/frameworks/nextjs/app/about/page.tsx
 create mode 100644 crates/integration-tests/fixtures/frameworks/nextjs/app/api/data/route.ts
 create mode 100644 crates/integration-tests/fixtures/frameworks/nextjs/app/api/hello/route.ts
 create mode 100644 crates/integration-tests/fixtures/frameworks/nextjs/app/components/Navigation.tsx
 create mode 100644 crates/integration-tests/fixtures/frameworks/nextjs/app/contact/page.tsx
 create mode 100644 crates/integration-tests/fixtures/frameworks/nextjs/app/dashboard/page.tsx
 create mode 100755 scripts/integration-tests-browser.sh

diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index d9a4aa08..f1941940 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -77,3 +77,101 @@ jobs:
           WASM_BINARY_PATH: target/wasm32-wasip1/release/trusted-server-fastly.wasm
           INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
           RUST_LOG: info
+
+  browser-tests:
+    name: browser integration tests
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name == 'push' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request_review' && github.event.review.state == 'approved')
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Retrieve Rust version
+        id: rust-version
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        shell: bash
+
+      - name: Set up Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: ${{ steps.rust-version.outputs.rust-version }}
+          target: wasm32-wasip1
+          cache-shared-key: cargo-${{ runner.os }}
+
+      - name: Get Viceroy cache key
+        id: viceroy-rev
+        run: echo "sha=$(git ls-remote https://github.com/fastly/Viceroy HEAD | cut -f1)" >> $GITHUB_OUTPUT
+
+      - name: Cache Viceroy binary
+        id: cache-viceroy
+        uses: actions/cache@v4
+        with:
+          path: ~/.cargo/bin/viceroy
+          key: viceroy-${{ runner.os }}-${{ steps.viceroy-rev.outputs.sha }}
+
+      - name: Install Viceroy
+        if: steps.cache-viceroy.outputs.cache-hit != 'true'
+        run: cargo install --git https://github.com/fastly/Viceroy viceroy
+
+      - name: Build WASM binary
+        run: cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
+        env:
+          TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: "http://127.0.0.1:${{ env.ORIGIN_PORT }}"
+          TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
+
+      - name: Build WordPress test container
+        run: |
+          docker build -t test-wordpress:latest \
+            crates/integration-tests/fixtures/frameworks/wordpress/
+
+      - name: Build Next.js test container
+        run: |
+          docker build -t test-nextjs:latest \
+            crates/integration-tests/fixtures/frameworks/nextjs/
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+
+      - name: Install Playwright
+        working-directory: crates/integration-tests/browser
+        run: |
+          npm ci
+          npx playwright install --with-deps chromium
+
+      - name: Run browser tests (Next.js)
+        working-directory: crates/integration-tests/browser
+        env:
+          WASM_BINARY_PATH: ${{ github.workspace }}/target/wasm32-wasip1/release/trusted-server-fastly.wasm
+          INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
+          VICEROY_CONFIG_PATH: ${{ github.workspace }}/crates/integration-tests/fixtures/configs/viceroy-template.toml
+          TEST_FRAMEWORK: nextjs
+        run: npx playwright test
+
+      - name: Run browser tests (WordPress)
+        working-directory: crates/integration-tests/browser
+        env:
+          WASM_BINARY_PATH: ${{ github.workspace }}/target/wasm32-wasip1/release/trusted-server-fastly.wasm
+          INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
+          VICEROY_CONFIG_PATH: ${{ github.workspace }}/crates/integration-tests/fixtures/configs/viceroy-template.toml
+          TEST_FRAMEWORK: wordpress
+        run: npx playwright test
+
+      - name: Upload Playwright HTML report
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: playwright-report
+          path: crates/integration-tests/browser/playwright-report/
+          retention-days: 7
+
+      - name: Upload Playwright traces and screenshots
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: playwright-traces
+          path: crates/integration-tests/browser/test-results/
+          retention-days: 7
diff --git a/.gitignore b/.gitignore
index deccb58e..864be6a1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,4 +29,10 @@ src/*.html
 *.pem
 
 /guest-profiles
-/benchmark-results/**
\ No newline at end of file
+/benchmark-results/**
+
+# Playwright browser tests
+/crates/integration-tests/browser/node_modules/
+/crates/integration-tests/browser/test-results/
+/crates/integration-tests/browser/playwright-report/
+/crates/integration-tests/browser/.browser-test-state.json
\ No newline at end of file
diff --git a/crates/integration-tests/Cargo.lock b/crates/integration-tests/Cargo.lock
index 60cee858..26bcdf0d 100644
--- a/crates/integration-tests/Cargo.lock
+++ b/crates/integration-tests/Cargo.lock
@@ -1133,6 +1133,7 @@ dependencies = [
  "log",
  "reqwest",
  "scraper",
+ "serde_json",
  "testcontainers",
 ]
 
diff --git a/crates/integration-tests/Cargo.toml b/crates/integration-tests/Cargo.toml
index 962c87e4..508da391 100644
--- a/crates/integration-tests/Cargo.toml
+++ b/crates/integration-tests/Cargo.toml
@@ -14,5 +14,6 @@ testcontainers = { version = "0.25", features = ["blocking"] }
 reqwest = { version = "0.12", features = ["blocking"] }
 scraper = "0.21"
 log = "0.4"
+serde_json = "1"
 error-stack = "0.5"
 derive_more = { version = "1.0", features = ["display"] }
diff --git a/crates/integration-tests/README.md b/crates/integration-tests/README.md
index f425ab43..c4a67fd0 100644
--- a/crates/integration-tests/README.md
+++ b/crates/integration-tests/README.md
@@ -1,16 +1,20 @@
 # Integration Tests
 
 End-to-end tests that verify the trusted server against real frontend
-containers using [Testcontainers](https://testcontainers.com/).
+containers using [Testcontainers](https://testcontainers.com/) and
+[Playwright](https://playwright.dev/).
 
 ## Prerequisites
 
 - **Docker** — running and accessible
 - **Viceroy** — Fastly local simulator (`cargo install viceroy`)
 - **wasm32-wasip1 target** — `rustup target add wasm32-wasip1`
+- **Node.js** (LTS) — for browser tests only
 
 ## Quick start
 
+### HTTP-level tests
+
 ```bash
 ./scripts/integration-tests.sh
 ```
@@ -22,11 +26,29 @@ This script handles everything:
 2. Builds the WordPress and Next.js Docker images
 3. Runs all integration tests sequentially
 
+### Browser tests
+
+```bash
+./scripts/integration-tests-browser.sh
+```
+
+This script:
+
+1. Builds the WASM binary and Docker images (same as above)
+2. Installs Playwright and Chromium
+3. Runs browser tests for Next.js and WordPress sequentially
+
 ### Run a single test
 
 ```bash
+# HTTP-level
 ./scripts/integration-tests.sh test_wordpress_fastly
 ./scripts/integration-tests.sh test_nextjs_fastly
+
+# Browser — single framework
+cd crates/integration-tests/browser
+TEST_FRAMEWORK=nextjs npx playwright test
+TEST_FRAMEWORK=wordpress npx playwright test
 ```
 
 ### Verbose output
@@ -59,20 +81,46 @@ docker build -t test-nextjs:latest \
 
 ## Test scenarios
 
-### Standard (all frameworks)
+### HTTP-level — standard (all frameworks)
 
 | Scenario | What it tests |
 |---|---|
-| `HtmlInjection` | `<script src="/static/tsjs=...">` is present in proxied HTML |
+| `HtmlInjection` | Exactly one `<script id="trustedserver-js" src="/static/tsjs=...">` in proxied HTML |
 | `ScriptServing` | `/static/tsjs=tsjs-unified.min.js` returns JavaScript with bundle markers |
-| `AttributeRewriting` | `href`/`src` URLs with origin host are rewritten to proxy host |
+| `AttributeRewriting` | `href`/`src` URLs with origin host are rewritten to proxy host (including inside ad slots) |
+| `ScriptServingUnknownFile404` | Unknown `/static/tsjs=...` paths return 404, not HTML fallback |
 
-### Next.js custom
+### HTTP-level — Next.js custom
 
 | Scenario | What it tests |
 |---|---|
 | `NextJsRscFlight` | RSC Flight responses are not corrupted (no HTML, no script injection) |
-| `NextJsServerActions` | POST requests pass through the proxy to the origin |
+| `NextJsServerActions` | POST requests pass through proxy; unknown actions return 404 |
+
+### HTTP-level — WordPress custom
+
+| Scenario | What it tests |
+|---|---|
+| `WordPressAdminInjection` | `/wp-admin/` pages receive script injection (documents current behavior) |
+
+### Browser-level — shared (all frameworks)
+
+| Spec | What it tests |
+|---|---|
+| `script-injection` | `script#trustedserver-js` present in live DOM, no console errors |
+| `script-bundle` | JS bundle loads with 200, no parse/runtime errors, correct content type |
+
+### Browser-level — Next.js
+
+| Spec | What it tests |
+|---|---|
+| `navigation` | Client-side (SPA) navigation preserves script injection, back button works |
+
+### Browser-level — WordPress
+
+| Spec | What it tests |
+|---|---|
+| `admin-injection` | `/wp-admin/` has script tag in live DOM |
 
 ## Architecture
 
@@ -90,6 +138,18 @@ tests/
     scenarios.rs       # Standard and custom test scenarios
     wordpress.rs       # WordPress container config
     nextjs.rs          # Next.js container config
+browser/
+  playwright.config.ts # Playwright configuration (chromium, workers: 1)
+  global-setup.ts      # Starts Docker container + Viceroy before tests
+  global-teardown.ts   # Stops container + Viceroy after tests
+  helpers/
+    infra.ts           # Docker + Viceroy spawn/kill logic
+    wait-for-ready.ts  # Health check polling
+    state.ts           # Reads shared state file between setup/tests/teardown
+  tests/
+    shared/            # Tests that run for all frameworks
+    nextjs/            # Next.js-specific browser tests
+    wordpress/         # WordPress-specific browser tests
 fixtures/
   configs/
     viceroy-template.toml  # Viceroy local_server config (KV stores, secrets)
@@ -105,12 +165,11 @@ fixtures/
 2. The WASM binary is pre-built with `TRUSTED_SERVER__PUBLISHER__ORIGIN_URL`
    pointing to `http://127.0.0.1:8888` so the proxy knows where to forward
 3. Viceroy spawns with the WASM binary on a random port
-4. HTTP requests go to Viceroy (proxy) which forwards to the Docker container
-   (origin) and processes the response
-5. Assertions verify the proxied response has script injection, URL rewriting,
-   etc.
+4. **HTTP tests**: reqwest sends requests to Viceroy and asserts on responses
+5. **Browser tests**: Playwright opens Chromium pointing at Viceroy and verifies
+   script injection, bundle loading, and client-side navigation in a real browser
 
-### Why `--test-threads=1`
+### Why `--test-threads=1` / `workers: 1`
 
 All tests share the same fixed origin port (8888). The trusted server config is
 baked into the WASM binary at compile time with this port, so only one Docker
@@ -125,12 +184,21 @@ triggered by:
 - PR approval
 - Manual dispatch
 
-They are **not** part of `cargo test --workspace` because the crate requires a
-native target while the workspace default is `wasm32-wasip1`.
+Two jobs run in parallel:
+
+1. **integration-tests** — HTTP-level tests (Rust + testcontainers)
+2. **browser-tests** — Playwright tests (Node.js + Chromium)
+
+They are **not** part of `cargo test --workspace` because the integration-tests
+crate requires a native target while the workspace default is `wasm32-wasip1`.
 
-## Not tested (out of scope)
+## Known gaps
 
 - **GDPR consent propagation** — the consent field exists in `AuctionRequest`
   but is not yet populated or forwarded. Requires implementation first.
-- **Client-side navigation** — requires a real browser (Playwright/Selenium).
-  HTTP-level tests cannot verify JavaScript execution or route transitions.
+- **Next.js integration features** — the WASM binary is built without
+  `integrations.nextjs` enabled, so Next.js-specific rewriters/post-processors
+  are not exercised. RSC Flight/Server Actions tests are compatibility smoke
+  tests only.
+- **GTM integration** — not enabled in test config. Has unit coverage in
+  `google_tag_manager.rs`.
diff --git a/crates/integration-tests/browser/global-setup.ts b/crates/integration-tests/browser/global-setup.ts
new file mode 100644
index 00000000..b47d9772
--- /dev/null
+++ b/crates/integration-tests/browser/global-setup.ts
@@ -0,0 +1,80 @@
+import { writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import {
+  startContainer,
+  startViceroy,
+  stopContainer,
+  stopViceroy,
+} from "./helpers/infra.js";
+
+const STATE_FILE = resolve(__dirname, ".browser-test-state.json");
+
+const WASM_PATH =
+  process.env.WASM_BINARY_PATH ||
+  resolve(
+    __dirname,
+    "../../../target/wasm32-wasip1/release/trusted-server-fastly.wasm",
+  );
+
+const VICEROY_CONFIG =
+  process.env.VICEROY_CONFIG_PATH ||
+  resolve(__dirname, "../fixtures/configs/viceroy-template.toml");
+
+/** Persist current state so global-teardown can always clean up. */
+function writeState(state: {
+  baseUrl?: string;
+  containerId?: string;
+  viceroyPid?: number;
+  framework: string;
+}): void {
+  writeFileSync(STATE_FILE, JSON.stringify(state, null, 2));
+}
+
+async function globalSetup(): Promise<void> {
+  const framework = process.env.TEST_FRAMEWORK || "nextjs";
+  let containerId: string | undefined;
+  let viceroyPid: number | undefined;
+
+  try {
+    console.log(`[global-setup] Starting ${framework} container...`);
+    containerId = await startContainer(framework);
+
+    // Write partial state immediately so teardown can stop the container
+    // even if Viceroy startup fails below.
+    writeState({ containerId, framework });
+
+    console.log(`[global-setup] Starting Viceroy (WASM: ${WASM_PATH})...`);
+    const viceroy = await startViceroy(WASM_PATH, VICEROY_CONFIG);
+    viceroyPid = viceroy.process.pid;
+
+    console.log(`[global-setup] Viceroy ready at ${viceroy.baseUrl}`);
+
+    // Expose the base URL so playwright.config.ts picks it up via env var
+    process.env.VICEROY_BASE_URL = viceroy.baseUrl;
+
+    // Write complete state for tests and teardown
+    writeState({
+      baseUrl: viceroy.baseUrl,
+      containerId,
+      viceroyPid,
+      framework,
+    });
+  } catch (err) {
+    // Clean up any resources that were started before re-throwing
+    console.error("[global-setup] Setup failed, cleaning up...");
+    if (viceroyPid) stopViceroy(viceroyPid);
+    if (containerId) stopContainer(containerId);
+
+    // Remove partial state file since we cleaned up manually
+    try {
+      const { unlinkSync } = await import("node:fs");
+      unlinkSync(STATE_FILE);
+    } catch {
+      // State file may not exist
+    }
+
+    throw err;
+  }
+}
+
+export default globalSetup;
diff --git a/crates/integration-tests/browser/global-teardown.ts b/crates/integration-tests/browser/global-teardown.ts
new file mode 100644
index 00000000..adb1b1c7
--- /dev/null
+++ b/crates/integration-tests/browser/global-teardown.ts
@@ -0,0 +1,33 @@
+import { readFileSync, unlinkSync } from "node:fs";
+import { resolve } from "node:path";
+import { stopContainer, stopViceroy } from "./helpers/infra.js";
+
+const STATE_FILE = resolve(__dirname, ".browser-test-state.json");
+
+async function globalTeardown(): Promise<void> {
+  let state: { containerId?: string; viceroyPid?: number };
+  try {
+    state = JSON.parse(readFileSync(STATE_FILE, "utf-8"));
+  } catch {
+    console.warn("[global-teardown] No state file found, nothing to clean up");
+    return;
+  }
+
+  if (state.viceroyPid) {
+    console.log(`[global-teardown] Stopping Viceroy (pid: ${state.viceroyPid})`);
+    stopViceroy(state.viceroyPid);
+  }
+
+  if (state.containerId) {
+    console.log(`[global-teardown] Stopping container ${state.containerId.slice(0, 12)}...`);
+    stopContainer(state.containerId);
+  }
+
+  try {
+    unlinkSync(STATE_FILE);
+  } catch {
+    // Already removed
+  }
+}
+
+export default globalTeardown;
diff --git a/crates/integration-tests/browser/helpers/infra.ts b/crates/integration-tests/browser/helpers/infra.ts
new file mode 100644
index 00000000..6577ddab
--- /dev/null
+++ b/crates/integration-tests/browser/helpers/infra.ts
@@ -0,0 +1,128 @@
+import { execSync, spawn, type ChildProcess } from "node:child_process";
+import { createServer } from "node:net";
+import { waitForReady } from "./wait-for-ready.js";
+
+const ORIGIN_PORT = process.env.INTEGRATION_ORIGIN_PORT || "8888";
+
+/** Framework-specific container configuration. */
+const FRAMEWORK_CONFIG: Record<string, { image: string; port: number }> = {
+  nextjs: { image: "test-nextjs:latest", port: 3000 },
+  wordpress: { image: "test-wordpress:latest", port: 80 },
+};
+
+/** Find an available TCP port by briefly binding to port 0. */
+export async function findAvailablePort(): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const server = createServer();
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      if (addr && typeof addr === "object") {
+        const port = addr.port;
+        server.close(() => resolve(port));
+      } else {
+        server.close(() => reject(new Error("Failed to get port")));
+      }
+    });
+    server.on("error", reject);
+  });
+}
+
+/**
+ * Start a Docker container for the given framework.
+ *
+ * Uses `docker run -d` (detached) with `--rm` for auto-cleanup on stop.
+ * The container is mapped to the fixed origin port so the WASM binary
+ * (which has this port baked in) can proxy to it.
+ *
+ * @returns The container ID.
+ */
+export async function startContainer(framework: string): Promise<string> {
+  const config = FRAMEWORK_CONFIG[framework];
+  if (!config) {
+    throw new Error(
+      `Unknown framework: ${framework}. Expected one of: ${Object.keys(FRAMEWORK_CONFIG).join(", ")}`,
+    );
+  }
+
+  const containerId = execSync(
+    [
+      "docker run -d --rm",
+      `-p ${ORIGIN_PORT}:${config.port}`,
+      `-e ORIGIN_HOST=127.0.0.1:${ORIGIN_PORT}`,
+      config.image,
+    ].join(" "),
+    { encoding: "utf-8" },
+  ).trim();
+
+  try {
+    await waitForReady(`http://127.0.0.1:${ORIGIN_PORT}`, "/");
+  } catch (err) {
+    // Container started but never became ready — stop it before propagating.
+    stopContainer(containerId);
+    throw err;
+  }
+
+  return containerId;
+}
+
+/** Stop a Docker container by ID. */
+export function stopContainer(containerId: string): void {
+  try {
+    execSync(`docker stop ${containerId}`, { timeout: 10_000 });
+  } catch {
+    // Container may have already stopped (--rm flag)
+  }
+}
+
+/**
+ * Spawn a Viceroy process with the given WASM binary on a random port.
+ *
+ * Mirrors the Rust `FastlyEnvironment::spawn` in `tests/environments/fastly.rs`.
+ *
+ * @returns The child process and the base URL.
+ */
+export async function startViceroy(
+  wasmPath: string,
+  configPath: string,
+): Promise<{ process: ChildProcess; baseUrl: string }> {
+  const port = await findAvailablePort();
+
+  const child = spawn(
+    "viceroy",
+    [wasmPath, "-C", configPath, "--addr", `127.0.0.1:${port}`],
+    // stdin: ignore, stdout: pipe (drained), stderr: pipe (logged).
+    // IMPORTANT: stdout MUST be drained to prevent pipe buffer deadlock.
+    // If the OS pipe buffer (~64KB) fills, Viceroy blocks on write.
+    { stdio: ["ignore", "pipe", "pipe"] },
+  );
+
+  // Drain stdout to prevent pipe buffer deadlock
+  child.stdout?.resume();
+
+  // Surface Viceroy stderr for debugging
+  child.stderr?.on("data", (data: Buffer) => {
+    const line = data.toString().trim();
+    if (line) console.error(`[viceroy] ${line}`);
+  });
+
+  const baseUrl = `http://127.0.0.1:${port}`;
+
+  try {
+    await waitForReady(baseUrl, "/__trusted-server/health");
+  } catch (err) {
+    // Viceroy spawned but never became ready — kill it before propagating.
+    if (child.pid) stopViceroy(child.pid);
+    throw err;
+  }
+
+  return { process: child, baseUrl };
+}
+
+/** Kill a Viceroy process. */
+export function stopViceroy(pid: number): void {
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch {
+    // Already exited
+  }
+}
diff --git a/crates/integration-tests/browser/helpers/state.ts b/crates/integration-tests/browser/helpers/state.ts
new file mode 100644
index 00000000..72167bd1
--- /dev/null
+++ b/crates/integration-tests/browser/helpers/state.ts
@@ -0,0 +1,16 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+export interface TestState {
+  baseUrl: string;
+  containerId: string;
+  viceroyPid: number;
+  framework: string;
+}
+
+const STATE_FILE = resolve(__dirname, "../.browser-test-state.json");
+
+/** Read the state written by global-setup.ts. */
+export function readState(): TestState {
+  return JSON.parse(readFileSync(STATE_FILE, "utf-8"));
+}
diff --git a/crates/integration-tests/browser/helpers/wait-for-ready.ts b/crates/integration-tests/browser/helpers/wait-for-ready.ts
new file mode 100644
index 00000000..8b7ec803
--- /dev/null
+++ b/crates/integration-tests/browser/helpers/wait-for-ready.ts
@@ -0,0 +1,30 @@
+/**
+ * Poll a URL until it returns a successful response.
+ *
+ * Mirrors the Rust `wait_for_ready` implementation in
+ * `tests/environments/mod.rs` — 30 attempts with 500ms intervals.
+ */
+export async function waitForReady(
+  baseUrl: string,
+  path: string,
+  {
+    maxAttempts = 30,
+    intervalMs = 500,
+  }: { maxAttempts?: number; intervalMs?: number } = {},
+): Promise<void> {
+  const url = `${baseUrl}${path}`;
+
+  for (let i = 0; i < maxAttempts; i++) {
+    try {
+      const resp = await fetch(url);
+      if (resp.ok) return;
+    } catch {
+      // Connection refused — server not ready yet
+    }
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+  }
+
+  throw new Error(
+    `Service at ${url} not ready after ${maxAttempts} attempts (${(maxAttempts * intervalMs) / 1000}s)`,
+  );
+}
diff --git a/crates/integration-tests/browser/package-lock.json b/crates/integration-tests/browser/package-lock.json
new file mode 100644
index 00000000..39b512a1
--- /dev/null
+++ b/crates/integration-tests/browser/package-lock.json
@@ -0,0 +1,78 @@
+{
+  "name": "integration-tests-browser",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "integration-tests-browser",
+      "version": "1.0.0",
+      "devDependencies": {
+        "@playwright/test": "^1.49.0"
+      }
+    },
+    "node_modules/@playwright/test": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.58.2.tgz",
+      "integrity": "sha512-akea+6bHYBBfA9uQqSYmlJXn61cTa+jbO87xVLCWbTqbWadRVmhxlXATaOjOgcBaWU4ePo0wB41KMFv3o35IXA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright": "1.58.2"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/playwright": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz",
+      "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright-core": "1.58.2"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz",
+      "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    }
+  }
+}
diff --git a/crates/integration-tests/browser/package.json b/crates/integration-tests/browser/package.json
new file mode 100644
index 00000000..13282f28
--- /dev/null
+++ b/crates/integration-tests/browser/package.json
@@ -0,0 +1,13 @@
+{
+  "name": "integration-tests-browser",
+  "version": "1.0.0",
+  "private": true,
+  "scripts": {
+    "test": "npx playwright test",
+    "test:nextjs": "TEST_FRAMEWORK=nextjs npx playwright test",
+    "test:wordpress": "TEST_FRAMEWORK=wordpress npx playwright test"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.49.0"
+  }
+}
diff --git a/crates/integration-tests/browser/playwright.config.ts b/crates/integration-tests/browser/playwright.config.ts
new file mode 100644
index 00000000..478546cc
--- /dev/null
+++ b/crates/integration-tests/browser/playwright.config.ts
@@ -0,0 +1,25 @@
+import { defineConfig } from "@playwright/test";
+
+export default defineConfig({
+  testDir: "./tests",
+  globalSetup: "./global-setup.ts",
+  globalTeardown: "./global-teardown.ts",
+  timeout: 30_000,
+  retries: 0,
+  // Sequential execution: all tests share a single origin port (8888)
+  workers: 1,
+  use: {
+    baseURL: process.env.VICEROY_BASE_URL || "http://127.0.0.1:7878",
+    headless: true,
+    screenshot: "only-on-failure",
+    trace: "retain-on-failure",
+  },
+  projects: [
+    {
+      name: "chromium",
+      use: { browserName: "chromium" },
+    },
+  ],
+  reporter: [["list"], ["html", { open: "never" }]],
+  outputDir: "./test-results",
+});
diff --git a/crates/integration-tests/browser/tests/nextjs/api-passthrough.spec.ts b/crates/integration-tests/browser/tests/nextjs/api-passthrough.spec.ts
new file mode 100644
index 00000000..65b13449
--- /dev/null
+++ b/crates/integration-tests/browser/tests/nextjs/api-passthrough.spec.ts
@@ -0,0 +1,40 @@
+import { test, expect } from "@playwright/test";
+import { readState } from "../../helpers/state.js";
+
+test.beforeEach(async ({}, testInfo) => {
+  const state = readState();
+  if (state.framework !== "nextjs") {
+    testInfo.skip();
+  }
+});
+
+test.describe("Next.js API route passthrough", () => {
+  test("API route returns JSON without script injection", async ({
+    request,
+  }) => {
+    const resp = await request.get("/api/hello");
+    expect(resp.status()).toBe(200);
+
+    const contentType = resp.headers()["content-type"] || "";
+    expect(contentType).toContain("application/json");
+
+    const body = await resp.json();
+    expect(body.message).toBe("Hello from the API!");
+    expect(body.status).toBe("success");
+
+    // JSON must not contain HTML injection
+    const text = await (await request.get("/api/hello")).text();
+    expect(text).not.toContain("<script");
+    expect(text).not.toContain("/static/tsjs=");
+  });
+
+  test("data API route returns structured JSON", async ({ request }) => {
+    const resp = await request.get("/api/data");
+    expect(resp.status()).toBe(200);
+
+    const body = await resp.json();
+    expect(body.users).toHaveLength(2);
+    expect(body.users[0].name).toBe("Alice");
+    expect(body.metadata.version).toBe("1.0.0");
+  });
+});
diff --git a/crates/integration-tests/browser/tests/nextjs/form-rewriting.spec.ts b/crates/integration-tests/browser/tests/nextjs/form-rewriting.spec.ts
new file mode 100644
index 00000000..0c0ff012
--- /dev/null
+++ b/crates/integration-tests/browser/tests/nextjs/form-rewriting.spec.ts
@@ -0,0 +1,33 @@
+import { test, expect } from "@playwright/test";
+import { readState } from "../../helpers/state.js";
+
+test.beforeEach(async ({}, testInfo) => {
+  const state = readState();
+  if (state.framework !== "nextjs") {
+    testInfo.skip();
+  }
+});
+
+test.describe("Next.js form action rewriting", () => {
+  test("form action URL is rewritten from origin to proxy", async ({
+    page,
+  }) => {
+    await page.goto("/contact", { waitUntil: "domcontentloaded" });
+
+    const form = page.locator("form#contact-form");
+    await expect(form).toHaveCount(1);
+
+    const action = await form.getAttribute("action");
+    expect(action).toBeTruthy();
+
+    // Origin host (port 8888) should be rewritten to proxy host
+    expect(action).not.toContain("127.0.0.1:8888");
+    // The path should be preserved
+    expect(action).toContain("/api/contact");
+  });
+
+  test("contact page has script injection", async ({ page }) => {
+    await page.goto("/contact", { waitUntil: "domcontentloaded" });
+    await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
+  });
+});
diff --git a/crates/integration-tests/browser/tests/nextjs/navigation.spec.ts b/crates/integration-tests/browser/tests/nextjs/navigation.spec.ts
new file mode 100644
index 00000000..1bf1ff53
--- /dev/null
+++ b/crates/integration-tests/browser/tests/nextjs/navigation.spec.ts
@@ -0,0 +1,99 @@
+import { test, expect, type Page } from "@playwright/test";
+import { readState } from "../../helpers/state.js";
+
+test.beforeEach(async ({}, testInfo) => {
+  const state = readState();
+  if (state.framework !== "nextjs") {
+    testInfo.skip();
+  }
+});
+
+/**
+ * Wait for the Next.js client router to hydrate.
+ *
+ * The Navigation component sets `data-hydrated="true"` on `<html>` inside a
+ * `useEffect`, which only fires after React hydration completes. Waiting for
+ * this attribute prevents clicking `<Link>` elements before the client router
+ * is ready (which would cause a full-page navigation instead of SPA).
+ */
+async function waitForHydration(page: Page): Promise<void> {
+  await page.waitForSelector("html[data-hydrated='true']", {
+    timeout: 10_000,
+  });
+}
+
+test.describe("Next.js client-side navigation", () => {
+  test("4-page SPA navigation chain preserves script injection without full reload", async ({
+    page,
+  }) => {
+    const jsErrors: string[] = [];
+    page.on("pageerror", (error) => jsErrors.push(error.message));
+
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+
+    // Script present on initial load
+    await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
+
+    // Wait for the client router to hydrate before clicking any links.
+    await waitForHydration(page);
+
+    // Track document-level navigations after initial load.
+    // A full page reload triggers a new "document" request; SPA navigation does not.
+    const documentRequests: string[] = [];
+    page.on("request", (req) => {
+      if (req.resourceType() === "document") {
+        documentRequests.push(req.url());
+      }
+    });
+
+    // Navigate: Home → About
+    await page.click('#site-nav a[href="/about"]');
+    await page.waitForURL("**/about", { waitUntil: "domcontentloaded" });
+    await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
+
+    // Navigate: About → Dashboard
+    await page.click('#site-nav a[href="/dashboard"]');
+    await page.waitForURL("**/dashboard", { waitUntil: "domcontentloaded" });
+    await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
+
+    // Navigate: Dashboard → Contact
+    await page.click('#site-nav a[href="/contact"]');
+    await page.waitForURL("**/contact", { waitUntil: "domcontentloaded" });
+    await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
+
+    // Prove all navigations were true SPA — no document-level requests fired
+    expect(documentRequests).toEqual([]);
+
+    // No JS errors during the entire navigation chain
+    expect(jsErrors).toEqual([]);
+  });
+
+  test("navigating back preserves script injection", async ({ page }) => {
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+    await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
+
+    // Wait for hydration before navigating
+    await waitForHydration(page);
+
+    // Navigate forward
+    await page.click('#site-nav a[href="/about"]');
+    await page.waitForURL("**/about", { waitUntil: "domcontentloaded" });
+
+    // Navigate back
+    await page.goBack({ waitUntil: "domcontentloaded" });
+
+    await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
+  });
+
+  test("about page has script injection via direct navigation", async ({
+    page,
+  }) => {
+    await page.goto("/about", { waitUntil: "domcontentloaded" });
+    await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
+
+    const src = await page
+      .locator("script#trustedserver-js")
+      .getAttribute("src");
+    expect(src).toContain("/static/tsjs=");
+  });
+});
diff --git a/crates/integration-tests/browser/tests/shared/script-bundle.spec.ts b/crates/integration-tests/browser/tests/shared/script-bundle.spec.ts
new file mode 100644
index 00000000..8c10974d
--- /dev/null
+++ b/crates/integration-tests/browser/tests/shared/script-bundle.spec.ts
@@ -0,0 +1,53 @@
+import { test, expect } from "@playwright/test";
+
+test.describe("Script bundle", () => {
+  test("JS bundle loads with 200 and executes without parse errors", async ({
+    page,
+  }) => {
+    const bundleResponses: { url: string; status: number }[] = [];
+    page.on("response", (response) => {
+      if (response.url().includes("/static/tsjs=")) {
+        bundleResponses.push({
+          url: response.url(),
+          status: response.status(),
+        });
+      }
+    });
+
+    const jsErrors: string[] = [];
+    page.on("pageerror", (error) => jsErrors.push(error.message));
+
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+
+    // Wait for the bundle response specifically (up to 10s)
+    if (bundleResponses.length === 0) {
+      await page.waitForResponse(
+        (resp) => resp.url().includes("/static/tsjs="),
+        { timeout: 10_000 },
+      );
+    }
+
+    // Bundle was requested and returned 200
+    expect(bundleResponses.length).toBeGreaterThan(0);
+    expect(bundleResponses[0].status).toBe(200);
+
+    // No JS parse/runtime errors from the bundle
+    expect(jsErrors).toEqual([]);
+  });
+
+  test("bundle response has correct content type", async ({ page }) => {
+    let bundleContentType = "";
+
+    const bundlePromise = page.waitForResponse(
+      (resp) => resp.url().includes("/static/tsjs="),
+      { timeout: 10_000 },
+    );
+
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+
+    const bundleResp = await bundlePromise;
+    bundleContentType = bundleResp.headers()["content-type"] || "";
+
+    expect(bundleContentType).toContain("javascript");
+  });
+});
diff --git a/crates/integration-tests/browser/tests/shared/script-injection.spec.ts b/crates/integration-tests/browser/tests/shared/script-injection.spec.ts
new file mode 100644
index 00000000..f67bf06b
--- /dev/null
+++ b/crates/integration-tests/browser/tests/shared/script-injection.spec.ts
@@ -0,0 +1,36 @@
+import { test, expect } from "@playwright/test";
+
+test.describe("Script injection", () => {
+  test("injected script tag is present in the live DOM", async ({ page }) => {
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+    const scriptTag = page.locator("script#trustedserver-js");
+    await expect(scriptTag).toHaveCount(1);
+
+    const src = await scriptTag.getAttribute("src");
+    expect(src).toContain("/static/tsjs=");
+  });
+
+  test("no unexpected console errors on page load", async ({ page }) => {
+    const errors: string[] = [];
+    page.on("console", (msg) => {
+      if (msg.type() === "error") errors.push(msg.text());
+    });
+
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+
+    // Give scripts a moment to execute and log errors
+    await page.waitForTimeout(2000);
+
+    // Suppress benign errors:
+    // - favicon: not served by test containers
+    // - "Failed to load resource": test fixture pages reference images/assets
+    //   at origin URLs purely for attribute-rewriting tests; the resources
+    //   don't need to exist on the server
+    const unexpected = errors.filter(
+      (e) =>
+        !e.includes("favicon") &&
+        !e.includes("Failed to load resource"),
+    );
+    expect(unexpected).toEqual([]);
+  });
+});
diff --git a/crates/integration-tests/browser/tests/wordpress/admin-injection.spec.ts b/crates/integration-tests/browser/tests/wordpress/admin-injection.spec.ts
new file mode 100644
index 00000000..6b6e57c3
--- /dev/null
+++ b/crates/integration-tests/browser/tests/wordpress/admin-injection.spec.ts
@@ -0,0 +1,22 @@
+import { test, expect } from "@playwright/test";
+import { readState } from "../../helpers/state.js";
+
+test.beforeEach(async ({}, testInfo) => {
+  const state = readState();
+  if (state.framework !== "wordpress") {
+    testInfo.skip();
+  }
+});
+
+test.describe("WordPress admin injection", () => {
+  test("admin page has script tag in live DOM", async ({ page }) => {
+    // Documents current behavior: the trusted-server injects the script
+    // on ALL pages, including /wp-admin/. This test captures that behavior
+    // so any future change (e.g. excluding admin pages) is intentional.
+    await page.goto("/wp-admin/", { waitUntil: "domcontentloaded" });
+    await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
+
+    const src = await page.locator("script#trustedserver-js").getAttribute("src");
+    expect(src).toContain("/static/tsjs=");
+  });
+});
diff --git a/crates/integration-tests/browser/tsconfig.json b/crates/integration-tests/browser/tsconfig.json
new file mode 100644
index 00000000..aa2ca675
--- /dev/null
+++ b/crates/integration-tests/browser/tsconfig.json
@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "outDir": "dist"
+  },
+  "include": ["**/*.ts"]
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile b/crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile
index 37ecf03b..ab580ce0 100644
--- a/crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile
@@ -1,5 +1,5 @@
-# Minimal Next.js container for integration testing.
-# Builds a standalone Next.js 14 app with test pages containing ad slots.
+# Next.js container for integration testing.
+# Builds a standalone Next.js 14 app with pages, API routes, forms, and ad slots.
 #
 # Build:
 #   docker build -t test-nextjs:latest \
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/about/page.tsx b/crates/integration-tests/fixtures/frameworks/nextjs/app/about/page.tsx
new file mode 100644
index 00000000..bc36c76c
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/about/page.tsx
@@ -0,0 +1,18 @@
+export default function About() {
+  const originHost = process.env.ORIGIN_HOST || "127.0.0.1:8888";
+
+  return (
+    <main>
+      <h1>About Page</h1>
+      <p>This is the about page for client-side navigation testing.</p>
+
+      <a id="origin-link-about" href={`http://${originHost}/contact`}>
+        Origin Link (About)
+      </a>
+
+      <div id="ad-slot-about" data-ad-unit="/test/about-banner">
+        <a href={`http://${originHost}/ad/about-landing`}>About ad</a>
+      </div>
+    </main>
+  );
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/api/data/route.ts b/crates/integration-tests/fixtures/frameworks/nextjs/app/api/data/route.ts
new file mode 100644
index 00000000..cb3ebc0e
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/api/data/route.ts
@@ -0,0 +1,11 @@
+import { NextResponse } from "next/server";
+
+export async function GET() {
+  return NextResponse.json({
+    users: [
+      { id: 1, name: "Alice", email: "alice@example.com" },
+      { id: 2, name: "Bob", email: "bob@example.com" },
+    ],
+    metadata: { version: "1.0.0" },
+  });
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/api/hello/route.ts b/crates/integration-tests/fixtures/frameworks/nextjs/app/api/hello/route.ts
new file mode 100644
index 00000000..1c8a43ec
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/api/hello/route.ts
@@ -0,0 +1,9 @@
+import { NextResponse } from "next/server";
+
+export async function GET() {
+  return NextResponse.json({
+    message: "Hello from the API!",
+    timestamp: new Date().toISOString(),
+    status: "success",
+  });
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/components/Navigation.tsx b/crates/integration-tests/fixtures/frameworks/nextjs/app/components/Navigation.tsx
new file mode 100644
index 00000000..e4f3ce4d
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/components/Navigation.tsx
@@ -0,0 +1,21 @@
+"use client";
+
+import { useEffect } from "react";
+import Link from "next/link";
+
+export default function Navigation() {
+  useEffect(() => {
+    // Signal that the client router has hydrated and is ready to handle
+    // SPA navigations. Browser tests wait for this before clicking links.
+    document.documentElement.dataset.hydrated = "true";
+  }, []);
+
+  return (
+    <nav id="site-nav">
+      <Link href="/">Home</Link>
+      <Link href="/about">About</Link>
+      <Link href="/dashboard">Dashboard</Link>
+      <Link href="/contact">Contact</Link>
+    </nav>
+  );
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/contact/page.tsx b/crates/integration-tests/fixtures/frameworks/nextjs/app/contact/page.tsx
new file mode 100644
index 00000000..8986fab8
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/contact/page.tsx
@@ -0,0 +1,28 @@
+export default function Contact() {
+  const originHost = process.env.ORIGIN_HOST || "127.0.0.1:8888";
+
+  return (
+    <main>
+      <h1>Contact Us</h1>
+      <p>Send us a message using the form below.</p>
+
+      {/* Form with action URL pointing to origin — the proxy should rewrite it. */}
+      <form id="contact-form" action={`http://${originHost}/api/contact`} method="POST">
+        <label htmlFor="name">Name</label>
+        <input type="text" id="name" name="name" required />
+
+        <label htmlFor="email">Email</label>
+        <input type="email" id="email" name="email" required />
+
+        <label htmlFor="message">Message</label>
+        <textarea id="message" name="message" required rows={5} />
+
+        <button type="submit">Send Message</button>
+      </form>
+
+      <div id="ad-slot-contact" data-ad-unit="/test/contact-sidebar">
+        <a href={`http://${originHost}/ad/contact-landing`}>Contact ad</a>
+      </div>
+    </main>
+  );
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/dashboard/page.tsx b/crates/integration-tests/fixtures/frameworks/nextjs/app/dashboard/page.tsx
new file mode 100644
index 00000000..92f179ce
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/dashboard/page.tsx
@@ -0,0 +1,30 @@
+export default function Dashboard() {
+  const originHost = process.env.ORIGIN_HOST || "127.0.0.1:8888";
+
+  const stats = [
+    { label: "Total Users", value: "1,234" },
+    { label: "Active Sessions", value: "56" },
+    { label: "API Calls", value: "12,345" },
+    { label: "Success Rate", value: "99.9%" },
+  ];
+
+  return (
+    <main>
+      <h1>Dashboard</h1>
+      <p>Sample dashboard page for testing script injection on content-heavy pages.</p>
+
+      <ul id="stats-list">
+        {stats.map((stat) => (
+          <li key={stat.label}>
+            <strong>{stat.label}:</strong> {stat.value}
+          </li>
+        ))}
+      </ul>
+
+      <div id="ad-slot-dashboard" data-ad-unit="/test/dashboard-leaderboard">
+        <a href={`http://${originHost}/ad/dashboard-landing`}>Dashboard ad</a>
+        <img src={`http://${originHost}/ad/leaderboard.png`} alt="leaderboard" />
+      </div>
+    </main>
+  );
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/layout.tsx b/crates/integration-tests/fixtures/frameworks/nextjs/app/layout.tsx
index 943adabd..4a91c9df 100644
--- a/crates/integration-tests/fixtures/frameworks/nextjs/app/layout.tsx
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/layout.tsx
@@ -1,3 +1,5 @@
+import Navigation from "./components/Navigation";
+
 export const metadata = {
   title: "Test Publisher - Next.js",
   description: "Integration test page for trusted server",
@@ -11,7 +13,10 @@ export default function RootLayout({
   return (
     <html lang="en">
       <head />
-      <body>{children}</body>
+      <body>
+        <Navigation />
+        {children}
+      </body>
     </html>
   );
 }
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx b/crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx
index d75cc0be..2769d104 100644
--- a/crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx
@@ -18,16 +18,18 @@ export default function Home() {
         alt="test"
       />
 
-      {/* Ad slot that should be rewritten by the trusted server */}
+      {/* Ad slots with both data-ad-unit (preserved) and URL attributes (rewritten).
+          This tests that URL rewriting works inside ad markup, not just outside it. */}
       <div id="ad-slot-1" data-ad-unit="/test/banner">
-        <p>Advertisement placeholder</p>
+        <a href={`http://${originHost}/ad/banner-landing`}>Banner ad</a>
+        <img src={`http://${originHost}/ad/banner.png`} alt="banner" />
       </div>
 
       <p>More page content follows the ad slot.</p>
 
       {/* Second ad slot */}
       <div id="ad-slot-2" data-ad-unit="/test/sidebar">
-        <p>Sidebar advertisement placeholder</p>
+        <a href={`http://${originHost}/ad/sidebar-landing`}>Sidebar ad</a>
       </div>
     </main>
   );
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/package.json b/crates/integration-tests/fixtures/frameworks/nextjs/package.json
index 7c193fef..8bdf3217 100644
--- a/crates/integration-tests/fixtures/frameworks/nextjs/package.json
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/package.json
@@ -11,5 +11,10 @@
     "next": "^14.0.0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
+  },
+  "devDependencies": {
+    "typescript": "^5",
+    "@types/react": "^18",
+    "@types/node": "^20"
   }
 }
diff --git a/crates/integration-tests/fixtures/frameworks/wordpress/theme/index.php b/crates/integration-tests/fixtures/frameworks/wordpress/theme/index.php
index 54f64e7a..0a9fed1b 100644
--- a/crates/integration-tests/fixtures/frameworks/wordpress/theme/index.php
+++ b/crates/integration-tests/fixtures/frameworks/wordpress/theme/index.php
@@ -26,16 +26,18 @@
             <a id="origin-link" href="http://<?= $origin ?>/page">Origin Link</a>
             <img id="origin-img" src="http://<?= $origin ?>/images/test.png" alt="test">
 
-            <!-- Ad slot that should be rewritten by the trusted server -->
+            <!-- Ad slots with both data-ad-unit (preserved) and URL attributes (rewritten).
+                 This tests that URL rewriting works inside ad markup, not just outside it. -->
             <div id="ad-slot-1" data-ad-unit="/test/banner">
-                <p>Advertisement placeholder</p>
+                <a href="http://<?= $origin ?>/ad/banner-landing">Banner ad</a>
+                <img src="http://<?= $origin ?>/ad/banner.png" alt="banner">
             </div>
 
             <p>More article content follows the ad slot.</p>
 
             <!-- Second ad slot -->
             <div id="ad-slot-2" data-ad-unit="/test/sidebar">
-                <p>Sidebar advertisement placeholder</p>
+                <a href="http://<?= $origin ?>/ad/sidebar-landing">Sidebar ad</a>
             </div>
         </article>
     </main>
diff --git a/crates/integration-tests/tests/common/assertions.rs b/crates/integration-tests/tests/common/assertions.rs
index 50af25ee..f9a52ba3 100644
--- a/crates/integration-tests/tests/common/assertions.rs
+++ b/crates/integration-tests/tests/common/assertions.rs
@@ -113,6 +113,60 @@ pub fn assert_attributes_rewritten(
     Ok(())
 }
 
+/// Assert that URL attributes inside ad-slot elements are rewritten.
+///
+/// Specifically checks that `href`/`src` attributes on elements *within*
+/// `[data-ad-unit]` containers have been rewritten from origin to proxy host.
+/// This catches regressions limited to ad markup that a page-wide scan might miss.
+///
+/// # Errors
+///
+/// Returns [`TestError::AttributeNotRewritten`] if origin URLs remain inside
+/// ad slots or if no rewritten proxy URLs are found inside ad slots.
+pub fn assert_ad_slot_urls_rewritten(
+    html: &str,
+    origin_host: &str,
+    proxy_base_url: &str,
+) -> Result<(), TestError> {
+    let document = Html::parse_document(html);
+
+    let proxy_host = proxy_base_url
+        .strip_prefix("http://")
+        .or_else(|| proxy_base_url.strip_prefix("https://"))
+        .unwrap_or(proxy_base_url);
+
+    // Select elements with href/src that are descendants of [data-ad-unit]
+    let ad_link_selector = parse_selector("[data-ad-unit] [href], [data-ad-unit] [src]")?;
+    let mut found_proxy_url = false;
+
+    for element in document.select(&ad_link_selector) {
+        for attr in ["href", "src"] {
+            if let Some(value) = element.value().attr(attr) {
+                if value.contains(origin_host) {
+                    return Err(error_stack::report!(TestError::AttributeNotRewritten)
+                        .attach_printable(format!(
+                            "Origin host still present inside ad slot: {attr}=\"{value}\""
+                        )));
+                }
+                if value.contains(proxy_host) {
+                    found_proxy_url = true;
+                }
+            }
+        }
+    }
+
+    if !found_proxy_url {
+        return Err(error_stack::report!(TestError::AttributeNotRewritten).attach_printable(
+            format!(
+                "No URL attributes inside ad slots rewritten to proxy host ({proxy_host}). \
+                 Ensure ad-slot fixtures contain href/src with origin host"
+            ),
+        ));
+    }
+
+    Ok(())
+}
+
 /// Assert that `data-ad-unit` attribute values are preserved unchanged.
 ///
 /// The trusted-server rewrites URL-bearing attributes (`href`, `src`) but must
@@ -150,6 +204,56 @@ pub fn assert_data_ad_units_preserved(html: &str, expected_units: &[&str]) -> Re
     Ok(())
 }
 
+/// Assert that a form's `action` attribute has been rewritten from origin to proxy.
+///
+/// Finds a `<form>` matching the given CSS selector and verifies its `action`
+/// attribute no longer contains the origin host and instead points to the proxy.
+///
+/// # Errors
+///
+/// Returns [`TestError::AttributeNotRewritten`] if the form is not found, has
+/// no `action`, or the `action` still contains the origin host.
+pub fn assert_form_action_rewritten(
+    html: &str,
+    form_selector: &str,
+    origin_host: &str,
+    proxy_base_url: &str,
+) -> Result<(), TestError> {
+    let document = Html::parse_document(html);
+    let selector = parse_selector(form_selector)?;
+
+    let proxy_host = proxy_base_url
+        .strip_prefix("http://")
+        .or_else(|| proxy_base_url.strip_prefix("https://"))
+        .unwrap_or(proxy_base_url);
+
+    let form = document.select(&selector).next().ok_or_else(|| {
+        error_stack::report!(TestError::AttributeNotRewritten)
+            .attach_printable(format!("No form matching '{form_selector}' found in HTML"))
+    })?;
+
+    let action = form.value().attr("action").ok_or_else(|| {
+        error_stack::report!(TestError::AttributeNotRewritten)
+            .attach_printable(format!("Form '{form_selector}' has no action attribute"))
+    })?;
+
+    if action.contains(origin_host) {
+        return Err(error_stack::report!(TestError::AttributeNotRewritten).attach_printable(
+            format!("Form action still contains origin host: action=\"{action}\""),
+        ));
+    }
+
+    if !action.contains(proxy_host) {
+        return Err(error_stack::report!(TestError::AttributeNotRewritten).attach_printable(
+            format!(
+                "Form action not rewritten to proxy host ({proxy_host}): action=\"{action}\""
+            ),
+        ));
+    }
+
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -235,6 +339,66 @@ mod tests {
         );
     }
 
+    #[test]
+    fn ad_slot_urls_rewritten_passes() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <body>
+                <div data-ad-unit="/test/banner">
+                    <a href="http://127.0.0.1:9999/ad/banner-landing">Banner</a>
+                    <img src="http://127.0.0.1:9999/ad/banner.png">
+                </div>
+            </body>
+            </html>
+        "#;
+
+        assert_ad_slot_urls_rewritten(html, "127.0.0.1:8888", "http://127.0.0.1:9999")
+            .expect("should detect rewritten URLs inside ad slots");
+    }
+
+    #[test]
+    fn ad_slot_urls_rewritten_fails_when_origin_remains() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <body>
+                <div data-ad-unit="/test/banner">
+                    <a href="http://127.0.0.1:8888/ad/banner-landing">Banner</a>
+                </div>
+            </body>
+            </html>
+        "#;
+
+        let result =
+            assert_ad_slot_urls_rewritten(html, "127.0.0.1:8888", "http://127.0.0.1:9999");
+        assert!(
+            result.is_err(),
+            "should fail when origin host remains inside ad slot"
+        );
+    }
+
+    #[test]
+    fn ad_slot_urls_rewritten_fails_when_no_urls_in_slots() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <body>
+                <div data-ad-unit="/test/banner">
+                    <p>No links here</p>
+                </div>
+            </body>
+            </html>
+        "#;
+
+        let result =
+            assert_ad_slot_urls_rewritten(html, "127.0.0.1:8888", "http://127.0.0.1:9999");
+        assert!(
+            result.is_err(),
+            "should fail when no URL attributes exist inside ad slots"
+        );
+    }
+
     #[test]
     fn unique_script_tag_passes_with_exactly_one() {
         let html = r#"
@@ -325,6 +489,64 @@ mod tests {
         assert!(result.is_err(), "should fail when expected ad unit is missing");
     }
 
+    #[test]
+    fn form_action_rewritten_passes() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <body>
+                <form id="contact-form" action="http://127.0.0.1:9999/api/contact" method="POST">
+                    <input name="name" />
+                </form>
+            </body>
+            </html>
+        "#;
+
+        assert_form_action_rewritten(html, "form#contact-form", "127.0.0.1:8888", "http://127.0.0.1:9999")
+            .expect("should detect rewritten form action");
+    }
+
+    #[test]
+    fn form_action_rewritten_fails_when_origin_remains() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html>
+            <body>
+                <form id="contact-form" action="http://127.0.0.1:8888/api/contact" method="POST">
+                    <input name="name" />
+                </form>
+            </body>
+            </html>
+        "#;
+
+        let result = assert_form_action_rewritten(
+            html,
+            "form#contact-form",
+            "127.0.0.1:8888",
+            "http://127.0.0.1:9999",
+        );
+        assert!(
+            result.is_err(),
+            "should fail when origin host remains in form action"
+        );
+    }
+
+    #[test]
+    fn form_action_rewritten_fails_when_no_form() {
+        let html = r#"
+            <!DOCTYPE html>
+            <html><body><p>No form here</p></body></html>
+        "#;
+
+        let result = assert_form_action_rewritten(
+            html,
+            "form#contact-form",
+            "127.0.0.1:8888",
+            "http://127.0.0.1:9999",
+        );
+        assert!(result.is_err(), "should fail when form is not found");
+    }
+
     #[test]
     fn script_tag_present_fails_when_wrong_script() {
         let html = r#"
diff --git a/crates/integration-tests/tests/frameworks/nextjs.rs b/crates/integration-tests/tests/frameworks/nextjs.rs
index 27776b4b..a4d066f4 100644
--- a/crates/integration-tests/tests/frameworks/nextjs.rs
+++ b/crates/integration-tests/tests/frameworks/nextjs.rs
@@ -53,6 +53,8 @@ impl FrontendFramework for NextJs {
         vec![
             CustomScenario::NextJsRscFlight,
             CustomScenario::NextJsServerActions,
+            CustomScenario::NextJsApiRoute,
+            CustomScenario::NextJsFormAction,
         ]
     }
 }
diff --git a/crates/integration-tests/tests/frameworks/scenarios.rs b/crates/integration-tests/tests/frameworks/scenarios.rs
index b3a4ff5b..89a0ade4 100644
--- a/crates/integration-tests/tests/frameworks/scenarios.rs
+++ b/crates/integration-tests/tests/frameworks/scenarios.rs
@@ -30,6 +30,12 @@ pub enum CustomScenario {
     /// Next.js: Server Actions POST requests pass through correctly.
     NextJsServerActions,
 
+    /// Next.js: API routes return JSON without HTML injection.
+    NextJsApiRoute,
+
+    /// Next.js: Form action URLs are rewritten from origin to proxy.
+    NextJsFormAction,
+
     /// WordPress: Admin pages (`/wp-admin/`) receive script injection.
     ///
     /// The trusted server currently injects into ALL HTML responses
@@ -90,6 +96,10 @@ impl TestScenario {
                 assertions::assert_attributes_rewritten(&html, &origin_host, base_url)
                     .attach_printable(format!("framework: {framework_id}"))?;
 
+                // Verify URL attributes inside ad-slot elements are also rewritten
+                assertions::assert_ad_slot_urls_rewritten(&html, &origin_host, base_url)
+                    .attach_printable(format!("framework: {framework_id}"))?;
+
                 // Verify non-URL attributes like data-ad-unit are preserved unchanged
                 assertions::assert_data_ad_units_preserved(
                     &html,
@@ -247,9 +257,10 @@ impl CustomScenario {
 
             Self::NextJsServerActions => {
                 // Verify POST requests pass through the proxy to the origin.
-                // The minimal Next.js app has no real server actions, so the
-                // framework returns a client or redirect response. A 5xx means
-                // the proxy itself failed rather than forwarding.
+                // The minimal Next.js app has no real server actions, so
+                // Next.js returns 404 for the unknown action ID. This proves
+                // the proxy forwarded the POST to the origin rather than
+                // rejecting or mishandling it.
                 let client = reqwest::blocking::Client::builder()
                     .redirect(reqwest::redirect::Policy::none())
                     .build()
@@ -266,19 +277,127 @@ impl CustomScenario {
                         "scenario: NextJsServerActions, framework: {framework_id}"
                     ))?;
 
-                let status = resp.status();
+                let status = resp.status().as_u16();
+                let body = resp.text().unwrap_or_default();
+
+                // Next.js returns 404 for unknown server action IDs.
+                // With App Router client components in the layout, Next.js
+                // may return a "soft 404" (HTTP 200 with a not-found page).
+                // Accept 200, 404, or 405 — all prove the proxy forwarded
+                // the POST to the origin rather than rejecting it.
+                match status {
+                    404 | 405 => {}
+                    200 => {
+                        // Soft 404: verify the body is a Next.js not-found page
+                        assert!(
+                            body.contains("404") || body.contains("not found")
+                                || body.contains("Not Found"),
+                            "should contain 404 indicator in soft-404 response body"
+                        );
+                    }
+                    _ => {
+                        return Err(
+                            error_stack::report!(TestError::HttpRequest).attach_printable(
+                                format!(
+                                    "Expected 200/404/405 for unknown server action, got {status}; body: {body}"
+                                ),
+                            ),
+                        );
+                    }
+                }
+
+                Ok(())
+            }
+
+            Self::NextJsApiRoute => {
+                // Verify API routes return JSON without HTML injection.
+                // The proxy should pass JSON responses through unchanged.
+                let url = format!("{base_url}/api/hello");
+
+                let resp = reqwest::blocking::get(&url)
+                    .change_context(TestError::HttpRequest)
+                    .attach_printable(format!(
+                        "scenario: NextJsApiRoute, framework: {framework_id}"
+                    ))?;
 
-                // The proxy must forward the POST. We expect a non-5xx from
-                // the origin: 2xx, 3xx (redirect), or 4xx (no matching action).
-                if status.is_server_error() {
-                    let body = resp.text().unwrap_or_default();
+                let status = resp.status().as_u16();
+                if status != 200 {
                     return Err(
                         error_stack::report!(TestError::HttpRequest).attach_printable(format!(
-                            "POST request failed with {status}; body: {body}"
+                            "Expected 200 for API route, got {status}"
                         )),
                     );
                 }
 
+                let content_type = resp
+                    .headers()
+                    .get("content-type")
+                    .and_then(|v| v.to_str().ok())
+                    .unwrap_or("")
+                    .to_string();
+
+                if !content_type.contains("application/json") {
+                    return Err(error_stack::report!(TestError::ResponseParse)
+                        .attach_printable(format!(
+                            "Expected application/json content-type, got: {content_type}"
+                        )));
+                }
+
+                let body = resp
+                    .text()
+                    .change_context(TestError::ResponseParse)
+                    .attach_printable(format!("framework: {framework_id}"))?;
+
+                // JSON responses must not contain HTML injection
+                if body.contains("<script") || body.contains("/static/tsjs=") {
+                    return Err(error_stack::report!(TestError::ResponseParse)
+                        .attach_printable(
+                            "API route response contains script injection — JSON should pass through unchanged",
+                        ));
+                }
+
+                // Verify it's valid JSON with expected structure
+                let json: serde_json::Value = serde_json::from_str(&body)
+                    .map_err(|e| {
+                        error_stack::report!(TestError::ResponseParse)
+                            .attach_printable(format!("API response is not valid JSON: {e}"))
+                    })?;
+
+                if json.get("message").is_none() {
+                    return Err(error_stack::report!(TestError::ResponseParse)
+                        .attach_printable(
+                            "API response missing expected 'message' field",
+                        ));
+                }
+
+                Ok(())
+            }
+
+            Self::NextJsFormAction => {
+                // Verify form action URLs are rewritten from origin to proxy.
+                let url = format!("{base_url}/contact");
+
+                let resp = reqwest::blocking::get(&url)
+                    .change_context(TestError::HttpRequest)
+                    .attach_printable(format!(
+                        "scenario: NextJsFormAction, framework: {framework_id}"
+                    ))?;
+
+                let html = resp
+                    .text()
+                    .change_context(TestError::ResponseParse)
+                    .attach_printable(format!("framework: {framework_id}"))?;
+
+                let origin_host = format!("127.0.0.1:{}", origin_port());
+
+                assertions::assert_form_action_rewritten(
+                    &html,
+                    "form#contact-form",
+                    &origin_host,
+                    base_url,
+                )
+                .attach_printable(format!("framework: {framework_id}"))?;
+
                 Ok(())
             }
 
diff --git a/scripts/integration-tests-browser.sh b/scripts/integration-tests-browser.sh
new file mode 100755
index 00000000..90e20a7d
--- /dev/null
+++ b/scripts/integration-tests-browser.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+#
+# Run browser-level integration tests using Playwright.
+#
+# Builds the WASM binary, Docker test images, and runs Playwright tests
+# against both Next.js and WordPress frontends.
+#
+# Prerequisites:
+#   - Docker running
+#   - Viceroy installed: cargo install viceroy
+#   - wasm32-wasip1 target: rustup target add wasm32-wasip1
+#   - Node.js with npx available
+#
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$REPO_ROOT"
+
+ORIGIN_PORT="${INTEGRATION_ORIGIN_PORT:-8888}"
+BROWSER_DIR="crates/integration-tests/browser"
+
+# --- Build WASM binary ---
+echo "==> Building WASM binary (origin=http://127.0.0.1:$ORIGIN_PORT)..."
+TRUSTED_SERVER__PUBLISHER__ORIGIN_URL="http://127.0.0.1:$ORIGIN_PORT" \
+TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK=false \
+    cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
+
+# --- Build Docker images ---
+echo "==> Building WordPress test container..."
+docker build -t test-wordpress:latest \
+    crates/integration-tests/fixtures/frameworks/wordpress/
+
+echo "==> Building Next.js test container..."
+docker build -t test-nextjs:latest \
+    crates/integration-tests/fixtures/frameworks/nextjs/
+
+# --- Install Playwright ---
+echo "==> Installing Playwright dependencies..."
+cd "$REPO_ROOT/$BROWSER_DIR"
+npm ci
+npx playwright install chromium
+
+# --- Export env vars for global-setup.ts ---
+export WASM_BINARY_PATH="$REPO_ROOT/target/wasm32-wasip1/release/trusted-server-fastly.wasm"
+export INTEGRATION_ORIGIN_PORT="$ORIGIN_PORT"
+export VICEROY_CONFIG_PATH="$REPO_ROOT/crates/integration-tests/fixtures/configs/viceroy-template.toml"
+
+# Cleanup trap: stop any leftover containers on failure
+cleanup() {
+    docker ps -q \
+        --filter ancestor=test-nextjs:latest \
+        --filter ancestor=test-wordpress:latest \
+        2>/dev/null | xargs -r docker stop 2>/dev/null || true
+}
+trap cleanup EXIT
+
+# --- Run tests for each framework ---
+for framework in nextjs wordpress; do
+    echo "==> Running Playwright tests for $framework..."
+    TEST_FRAMEWORK="$framework" npx playwright test "$@"
+done
+
+echo "==> All browser tests passed."

From 12bb1f17533f93a7c908e9483601d27fae1fc888 Mon Sep 17 00:00:00 2001
From: prk-Jr <prakashsagwara@gmail.com>
Date: Sat, 7 Mar 2026 13:29:42 +0530
Subject: [PATCH 08/15] Add deferred route script test for SPA transitions

Proves that a next/script with strategy="afterInteractive" executes
after a client-side navigation through the trusted-server proxy.
The test SPA-navigates from / to /dashboard, waits for the script's
global marker, asserts it ran exactly once, and confirms no
document-level request fired (true SPA, not full reload).
---
 .../browser/tests/nextjs/navigation.spec.ts   | 40 +++++++++++++++++++
 .../nextjs/app/components/RouteScript.tsx     | 18 +++++++++
 .../frameworks/nextjs/app/dashboard/page.tsx  |  4 ++
 3 files changed, 62 insertions(+)
 create mode 100644 crates/integration-tests/fixtures/frameworks/nextjs/app/components/RouteScript.tsx

diff --git a/crates/integration-tests/browser/tests/nextjs/navigation.spec.ts b/crates/integration-tests/browser/tests/nextjs/navigation.spec.ts
index 1bf1ff53..2244e032 100644
--- a/crates/integration-tests/browser/tests/nextjs/navigation.spec.ts
+++ b/crates/integration-tests/browser/tests/nextjs/navigation.spec.ts
@@ -85,6 +85,46 @@ test.describe("Next.js client-side navigation", () => {
     await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
   });
 
+  test("deferred route script executes after SPA transition to dashboard", async ({
+    page,
+  }) => {
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+    await waitForHydration(page);
+
+    // No route script marker on home page
+    const before = await page.evaluate(
+      () => (window as any).__routeScriptExecuted,
+    );
+    expect(before).toBeUndefined();
+
+    // Track document requests to prove this is a true SPA transition
+    const documentRequests: string[] = [];
+    page.on("request", (req) => {
+      if (req.resourceType() === "document") {
+        documentRequests.push(req.url());
+      }
+    });
+
+    // SPA navigate to dashboard
+    await page.click('#site-nav a[href="/dashboard"]');
+    await page.waitForURL("**/dashboard", { waitUntil: "domcontentloaded" });
+
+    // Wait for the deferred script to execute
+    await page.waitForFunction(
+      () => (window as any).__routeScriptExecuted === "dashboard",
+      { timeout: 5_000 },
+    );
+
+    // Script executed exactly once
+    const count = await page.evaluate(
+      () => (window as any).__routeScriptExecutionCount,
+    );
+    expect(count).toBe(1);
+
+    // Prove this was an SPA transition, not a full reload
+    expect(documentRequests).toEqual([]);
+  });
+
   test("about page has script injection via direct navigation", async ({
     page,
   }) => {
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/components/RouteScript.tsx b/crates/integration-tests/fixtures/frameworks/nextjs/app/components/RouteScript.tsx
new file mode 100644
index 00000000..ae479549
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/components/RouteScript.tsx
@@ -0,0 +1,18 @@
+"use client";
+
+import Script from "next/script";
+
+export default function RouteScript({ marker }: { marker: string }) {
+  return (
+    <Script
+      id={`route-deferred-script-${marker}`}
+      strategy="afterInteractive"
+      dangerouslySetInnerHTML={{
+        __html: [
+          `window.__routeScriptExecuted = "${marker}";`,
+          `window.__routeScriptExecutionCount = (window.__routeScriptExecutionCount ?? 0) + 1;`,
+        ].join("\n"),
+      }}
+    />
+  );
+}
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/app/dashboard/page.tsx b/crates/integration-tests/fixtures/frameworks/nextjs/app/dashboard/page.tsx
index 92f179ce..e1249bf0 100644
--- a/crates/integration-tests/fixtures/frameworks/nextjs/app/dashboard/page.tsx
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/app/dashboard/page.tsx
@@ -1,3 +1,5 @@
+import RouteScript from "../components/RouteScript";
+
 export default function Dashboard() {
   const originHost = process.env.ORIGIN_HOST || "127.0.0.1:8888";
 
@@ -25,6 +27,8 @@ export default function Dashboard() {
         <a href={`http://${originHost}/ad/dashboard-landing`}>Dashboard ad</a>
         <img src={`http://${originHost}/ad/leaderboard.png`} alt="leaderboard" />
       </div>
+
+      <RouteScript marker="dashboard" />
     </main>
   );
 }

From 1d79015939aec7b5435aab49894a022ce63524c3 Mon Sep 17 00:00:00 2001
From: prk-Jr <prakashsagwara@gmail.com>
Date: Sat, 7 Mar 2026 13:39:05 +0530
Subject: [PATCH 09/15] Update integration test documentation to reflect
 current state

---
 INTEGRATION_TESTS_PLAN.md          | 40 +++++++++++++++++++-----------
 crates/integration-tests/README.md | 10 +++++---
 2 files changed, 33 insertions(+), 17 deletions(-)

diff --git a/INTEGRATION_TESTS_PLAN.md b/INTEGRATION_TESTS_PLAN.md
index 4a98fa41..7d565351 100644
--- a/INTEGRATION_TESTS_PLAN.md
+++ b/INTEGRATION_TESTS_PLAN.md
@@ -118,7 +118,7 @@ Track progress for each phase using this checklist:
 - [x] Add WordPress to `FRAMEWORKS` registry
 - [x] Create [`tests/integration.rs`](crates/integration-tests/tests/integration.rs) with `test_combination()` helper
 - [x] Create `test_wordpress_fastly()` test
-- [ ] Verify: `cargo test -p integration-tests -- test_wordpress_fastly` passes (requires Docker)
+- [x] Verify: `cargo test -p integration-tests -- test_wordpress_fastly` passes (requires Docker)
 
 ### Phase 4: Next.js Implementation ⏱️ 3-4 hours ✅ COMPLETE
 - [x] Create [`fixtures/frameworks/nextjs/`](crates/integration-tests/fixtures/frameworks/nextjs/) directory
@@ -132,7 +132,21 @@ Track progress for each phase using this checklist:
 - [x] Add Next.js to `FRAMEWORKS` registry
 - [x] Create `test_nextjs_fastly()` test
 - [x] Create `test_all_combinations()` matrix test
-- [ ] Verify: `cargo test -p integration-tests` passes for all tests (requires Docker)
+- [x] Verify: `cargo test -p integration-tests` passes for all tests (requires Docker)
+
+### Phase 4.5: Enriched Next.js Fixture ✅ COMPLETE
+- [x] Add shared Navigation component (`app/components/Navigation.tsx`) with hydration signal
+- [x] Add dashboard page with ad slots and deferred route script (`app/dashboard/page.tsx`)
+- [x] Add contact page with `<form action>` for URL rewriting tests (`app/contact/page.tsx`)
+- [x] Add API routes (`app/api/hello/route.ts`, `app/api/data/route.ts`)
+- [x] Add RouteScript component for deferred script execution testing (`app/components/RouteScript.tsx`)
+- [x] Add `NextJsApiRoute` and `NextJsFormAction` custom scenarios
+- [x] Add `assert_form_action_rewritten` assertion helper
+- [x] Add Playwright browser tests: `api-passthrough`, `form-rewriting`, expanded `navigation` (4-page SPA chain + deferred script)
+- [x] Fix SPA hydration race (wait for `data-hydrated` before clicking)
+- [x] Fix infra.ts helper cleanup on polling failures
+- [x] Fix CI artifact path for Playwright HTML report
+- [x] Verify: all HTTP and browser tests pass
 
 ### Phase 5: Documentation and CI ⏱️ 3-4 hours ✅ COMPLETE
 - [x] Create [`.github/workflows/integration-tests.yml`](.github/workflows/integration-tests.yml)
@@ -146,21 +160,19 @@ Track progress for each phase using this checklist:
 - [ ] Verify: CI passes on test branch
 
 ### Success Criteria
-- [ ] WordPress tests pass (4 standard + 1 custom scenario)
-- [ ] Next.js tests pass (4 standard + 2 custom scenarios)
+- [x] WordPress tests pass (3 standard + 1 custom scenario)
+- [x] Next.js tests pass (3 standard + 4 custom scenarios)
 - [ ] CI completes in < 5 minutes
-- [ ] Containers cleanup automatically (no orphans)
-- [ ] Tests run in parallel (dynamic port allocation works)
-- [ ] Zero flaky tests (20 consecutive runs pass)
-- [ ] README instructions work for new contributor
-- [ ] Adding a new framework takes < 2 hours (documented process)
+- [x] Containers cleanup automatically (no orphans)
+- [x] Tests run sequentially (fixed origin port requires `--test-threads=1`)
+- [x] Browser tests pass (12 Next.js + 5 WordPress, 0 flaky)
+- [x] README instructions work for new contributor
+- [x] Adding a new framework takes < 2 hours (documented process)
 
 ### Post-Implementation Verification
-- [ ] Run full test suite: `cargo test --workspace`
-- [ ] Run integration tests only: `cargo test -p integration-tests`
-- [ ] Run specific framework: `cargo test -p integration-tests -- wordpress`
-- [ ] Verify no Docker orphans: `docker ps -a | grep test-`
-- [ ] Test parallel execution: `cargo test -p integration-tests` (no `--test-threads=1`)
+- [x] Run integration tests: `./scripts/integration-tests.sh`
+- [x] Run browser tests: `./scripts/integration-tests-browser.sh`
+- [x] Cargo clippy clean: `cargo clippy --manifest-path crates/integration-tests/Cargo.toml --tests`
 - [ ] CI passes on PR branch
 
 ## Architecture
diff --git a/crates/integration-tests/README.md b/crates/integration-tests/README.md
index c4a67fd0..0c7e3b05 100644
--- a/crates/integration-tests/README.md
+++ b/crates/integration-tests/README.md
@@ -64,7 +64,7 @@ Two test images are built from fixtures in `fixtures/frameworks/`:
 | Image | Dockerfile | Description |
 |---|---|---|
 | `test-wordpress:latest` | `fixtures/frameworks/wordpress/Dockerfile` | PHP built-in server with a minimal test theme |
-| `test-nextjs:latest` | `fixtures/frameworks/nextjs/Dockerfile` | Next.js 14 standalone app with test pages |
+| `test-nextjs:latest` | `fixtures/frameworks/nextjs/Dockerfile` | Next.js 14 standalone app with 4 pages, API routes, forms, shared navigation, and deferred scripts |
 
 Both images include test fixtures with absolute origin URLs (`ORIGIN_HOST` env
 var) so the trusted server's URL rewriting can be verified.
@@ -95,7 +95,9 @@ docker build -t test-nextjs:latest \
 | Scenario | What it tests |
 |---|---|
 | `NextJsRscFlight` | RSC Flight responses are not corrupted (no HTML, no script injection) |
-| `NextJsServerActions` | POST requests pass through proxy; unknown actions return 404 |
+| `NextJsServerActions` | POST requests pass through proxy; unknown actions return 404/soft-404 |
+| `NextJsApiRoute` | API routes (`/api/hello`) return JSON without HTML injection |
+| `NextJsFormAction` | `<form action>` URLs rewritten from origin host to proxy host |
 
 ### HTTP-level — WordPress custom
 
@@ -114,7 +116,9 @@ docker build -t test-nextjs:latest \
 
 | Spec | What it tests |
 |---|---|
-| `navigation` | Client-side (SPA) navigation preserves script injection, back button works |
+| `navigation` | 4-page SPA navigation chain preserves injection without full reload, back button works, deferred route script executes after SPA transition |
+| `api-passthrough` | API routes return JSON without script injection (`/api/hello`, `/api/data`) |
+| `form-rewriting` | `<form action>` URL rewritten from origin to proxy on `/contact` page |
 
 ### Browser-level — WordPress
 

From 814b6d2bafecb5f0dd06e1845a1bf28678fd5a99 Mon Sep 17 00:00:00 2001
From: prk-Jr <prakashsagwara@gmail.com>
Date: Sat, 7 Mar 2026 13:55:38 +0530
Subject: [PATCH 10/15] Temporarily trigger integration tests on PR push

---
 .github/workflows/integration-tests.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index f1941940..9dafff91 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -6,6 +6,7 @@ permissions:
 on:
   push:
     branches: [main]
+  pull_request:
   pull_request_review:
     types: [submitted]
   workflow_dispatch:

From b903635e4e37e2e471c83cc4f2ee73169fb4a6ac Mon Sep 17 00:00:00 2001
From: prk-Jr <prakashsagwara@gmail.com>
Date: Sat, 7 Mar 2026 13:57:57 +0530
Subject: [PATCH 11/15] Add pull_request to job-level if conditions

---
 .github/workflows/integration-tests.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 9dafff91..e41566f3 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -20,6 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     if: >-
       github.event_name == 'push' ||
+      github.event_name == 'pull_request' ||
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'pull_request_review' && github.event.review.state == 'approved')
     steps:
@@ -84,6 +85,7 @@ jobs:
     runs-on: ubuntu-latest
     if: >-
       github.event_name == 'push' ||
+      github.event_name == 'pull_request' ||
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'pull_request_review' && github.event.review.state == 'approved')
     steps:

From eb2aa1c4593d9f2101b150f6b35dd12e852f8524 Mon Sep 17 00:00:00 2001
From: prk-Jr <prakashsagwara@gmail.com>
Date: Sat, 7 Mar 2026 14:21:32 +0530
Subject: [PATCH 12/15] Fix path for wasm binary in ci

---
 .github/workflows/integration-tests.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index e41566f3..e186c933 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -76,7 +76,6 @@ jobs:
           --target x86_64-unknown-linux-gnu
           -- --include-ignored --test-threads=1
         env:
-          WASM_BINARY_PATH: target/wasm32-wasip1/release/trusted-server-fastly.wasm
           INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
           RUST_LOG: info
 

From 012b8bd6d4f36f8a8fb24d128b1914362cdb2d06 Mon Sep 17 00:00:00 2001
From: prk-Jr <prakashsagwara@gmail.com>
Date: Mon, 9 Mar 2026 15:10:06 +0530
Subject: [PATCH 13/15] Harden integration test infrastructure and fix
 production conventions

---
 INTEGRATION_TESTS_PLAN.md                     | 1974 -----------------
 crates/fastly/src/main.rs                     |    4 +-
 crates/integration-tests/Cargo.lock           |  162 +-
 crates/integration-tests/Cargo.toml           |    5 +-
 .../browser/playwright.config.ts              |    2 +-
 .../tests/nextjs/api-passthrough.spec.ts      |    4 +-
 .../tests/nextjs/form-rewriting.spec.ts       |    5 +-
 .../fixtures/configs/fastly-template.toml     |   97 -
 .../wordpress/theme/wp-admin/index.php        |    2 +-
 crates/integration-tests/tests/common/mod.rs  |    3 -
 .../integration-tests/tests/common/runtime.rs |    3 +
 .../tests/environments/mod.rs                 |    4 +-
 .../tests/frameworks/scenarios.rs             |   15 +-
 crates/integration-tests/tests/integration.rs |   24 +-
 14 files changed, 205 insertions(+), 2099 deletions(-)
 delete mode 100644 INTEGRATION_TESTS_PLAN.md
 delete mode 100644 crates/integration-tests/fixtures/configs/fastly-template.toml

diff --git a/INTEGRATION_TESTS_PLAN.md b/INTEGRATION_TESTS_PLAN.md
deleted file mode 100644
index 7d565351..00000000
--- a/INTEGRATION_TESTS_PLAN.md
+++ /dev/null
@@ -1,1974 +0,0 @@
-# Integration Tests Plan: Multi-Framework Frontend Testing
-
-## Revision History
-
-**Latest Update**: Staff engineering review applied - addressed critical architectural and implementation issues.
-
-### Changes Applied
-
-**Critical Fixes**:
-1. ✅ **Trait Object Safety**: Changed from `&[&dyn FrontendFramework]` to function registry pattern to avoid static initialization issues
-2. ✅ **Complete Error Types**: Added full `TestError` enum with all necessary variants
-3. ✅ **Health Check Strategy**: Documented `/health` endpoint requirement and implemented fallback strategy
-4. ✅ **Safe TOML Mutation**: Fixed config generation to use safe table lookups instead of panic-prone indexing
-5. ✅ **WordPress Container Setup**: Clarified WordPress database requirements and recommended approach
-6. ✅ **Container Build Process**: Documented Docker image pre-build strategy for CI and local development
-
-**Major Improvements**:
-7. ✅ **WASM Binary Path**: Made configurable via environment variable
-8. ✅ **Error Context**: Added comprehensive error context propagation with framework/scenario information
-9. ✅ **Container Timeouts**: Added 60s timeout on container operations to prevent infinite hangs
-10. ✅ **Test Isolation**: Documented sequential execution requirement and future enhancement plans
-
-**Documentation Additions**:
-- Troubleshooting guide with common issues and solutions
-- Implementation notes and best practices section
-- Future enhancements roadmap (Phase 6+)
-- CI workflow example with proper build steps
-- Debug mode instructions
-
-**Estimated Impact**: Prevents 10-15 hours of debugging during implementation by addressing issues upfront.
-
----
-
-## Context
-
-The trusted server currently has 465 passing Rust unit tests and 256 JS tests, but lacks end-to-end integration tests that verify the complete system behavior against real frontend applications and across different runtime platforms. This plan implements an extensible integration test framework with dual abstractions:
-
-1. **Frontend Framework Abstraction**: Test against WordPress, Next.js, and future frameworks
-2. **Runtime Environment Abstraction**: Test on Fastly Compute (initially), with architecture to support future platforms
-
-**Why this matters**:
-- **Unit tests** verify individual components in isolation
-- **Integration tests** prove the system works end-to-end with real frontend frameworks
-- **Multi-platform architecture** enables future platform migration validation (Cloudflare Workers, etc.)
-
-This catches issues like HTML streaming bugs, RSC Flight format handling, GDPR signal propagation, and platform-specific runtime differences that only manifest when all components interact.
-
-**Initial Implementation Scope**:
-- Start with **Fastly/Viceroy only** (2 frameworks × 1 runtime = 2 test combinations)
-- Architecture supports adding platforms later via `RuntimeEnvironment` trait
-- Future platforms (Cloudflare, Fermyon Spin, etc.) can be added without refactoring
-
-**Extensibility goals**:
-
-*Frontend Framework*: Adding support for a new framework should require only:
-1. Creating a new fixture directory (`fixtures/frameworks/<name>/`)
-2. Implementing the `FrontendFramework` trait (~50 lines)
-3. Registering in `FRAMEWORKS` constant (~1 line)
-
-*Runtime Environment*: Adding support for a new platform should require only:
-1. Creating a platform config template (`fixtures/configs/<platform>-template.toml`)
-2. Implementing the `RuntimeEnvironment` trait (~100 lines)
-3. Registering in `RUNTIME_ENVIRONMENTS` constant (~1 line)
-
-No changes to core test infrastructure, assertions, or test runner logic when extending either dimension.
-
----
-
-## Implementation Checklist
-
-Track progress for each phase using this checklist:
-
-### Phase 0: Prerequisites (BLOCKER) ⏱️ 1-2 hours ✅ COMPLETE
-- [x] Add `/health` endpoint to [`crates/fastly/src/main.rs`](crates/fastly/src/main.rs)
-- [x] Build WASM binary: `cargo build --target wasm32-wasip1 --release`
-- [x] Start Viceroy manually to test health endpoint
-- [x] Verify `curl http://127.0.0.1:7676/health` returns 200 OK
-
-### Phase 1: Core Infrastructure ⏱️ 4-6 hours ✅ COMPLETE
-- [x] Add `integration-tests` to workspace members in root `Cargo.toml`
-- [x] Create [`crates/integration-tests/Cargo.toml`](crates/integration-tests/Cargo.toml) with dependencies
-- [x] Create [`tests/common/mod.rs`](crates/integration-tests/tests/common/mod.rs) (re-exports)
-- [x] Define `RuntimeEnvironment` trait in [`tests/common/runtime.rs`](crates/integration-tests/tests/common/runtime.rs)
-- [x] Implement `RuntimeConfig` struct with platform-agnostic interface
-- [x] Create [`tests/common/config.rs`](crates/integration-tests/tests/common/config.rs) for config generation
-- [x] Implement assertion helpers in [`tests/common/assertions.rs`](crates/integration-tests/tests/common/assertions.rs)
-- [x] Create [`fixtures/configs/fastly-template.toml`](crates/integration-tests/fixtures/configs/fastly-template.toml)
-- [x] Create [`fixtures/configs/viceroy-template.toml`](crates/integration-tests/fixtures/configs/viceroy-template.toml)
-- [x] Verify: `cargo check -p integration-tests` passes
-- [x] Verify: 9/9 assertion unit tests pass
-
-### Phase 1.5: Fastly Runtime Implementation ⏱️ 2-3 hours ✅ COMPLETE
-- [x] Create [`tests/environments/mod.rs`](crates/integration-tests/tests/environments/mod.rs) with `RuntimeEnvironment` trait
-- [x] Create [`tests/environments/fastly.rs`](crates/integration-tests/tests/environments/fastly.rs)
-- [x] Implement `FastlyViceroy` struct with `RuntimeEnvironment` trait
-- [x] Implement `ViceroyHandle` for process lifecycle (spawn, kill, wait, Drop)
-- [x] Implement dynamic port allocation with `find_available_port()`
-- [x] Implement health check with retry logic (30 attempts × 100ms)
-- [x] Create `RUNTIME_ENVIRONMENTS` registry with Fastly factory
-- [x] Verify: test binary compiles for native target
-
-### Phase 2: Framework Abstraction ⏱️ 2-3 hours ✅ COMPLETE
-- [x] Create [`tests/frameworks/mod.rs`](crates/integration-tests/tests/frameworks/mod.rs) with `FrontendFramework` trait
-- [x] Create [`tests/frameworks/scenarios.rs`](crates/integration-tests/tests/frameworks/scenarios.rs)
-- [x] Define `TestScenario` enum (HtmlInjection, ScriptServing, AttributeRewriting, GdprSignal)
-- [x] Define `CustomScenario` enum (WordPressAdminInjection, NextJsRscFlight, NextJsServerActions)
-- [x] Implement scenario runners with error context
-- [x] Create `FRAMEWORKS` registry with WordPress and Next.js factories
-- [x] Verify: Trait compiles, registry pattern works
-
-### Phase 3: WordPress Implementation ⏱️ 5-7 hours ✅ COMPLETE
-- [x] Create [`fixtures/frameworks/wordpress/`](crates/integration-tests/fixtures/frameworks/wordpress/) directory
-- [x] Create [`fixtures/frameworks/wordpress/Dockerfile`](crates/integration-tests/fixtures/frameworks/wordpress/Dockerfile) (PHP CLI with test theme)
-- [x] Create minimal WordPress test theme in [`fixtures/frameworks/wordpress/theme/`](crates/integration-tests/fixtures/frameworks/wordpress/theme/)
-- [x] Create wp-admin test page for admin injection scenario
-- [x] Create [`tests/frameworks/wordpress.rs`](crates/integration-tests/tests/frameworks/wordpress.rs)
-- [x] Implement `WordPress` struct with `FrontendFramework` trait
-- [x] Add WordPress to `FRAMEWORKS` registry
-- [x] Create [`tests/integration.rs`](crates/integration-tests/tests/integration.rs) with `test_combination()` helper
-- [x] Create `test_wordpress_fastly()` test
-- [x] Verify: `cargo test -p integration-tests -- test_wordpress_fastly` passes (requires Docker)
-
-### Phase 4: Next.js Implementation ⏱️ 3-4 hours ✅ COMPLETE
-- [x] Create [`fixtures/frameworks/nextjs/`](crates/integration-tests/fixtures/frameworks/nextjs/) directory
-- [x] Create [`fixtures/frameworks/nextjs/package.json`](crates/integration-tests/fixtures/frameworks/nextjs/package.json)
-- [x] Create [`fixtures/frameworks/nextjs/next.config.mjs`](crates/integration-tests/fixtures/frameworks/nextjs/next.config.mjs) (standalone output)
-- [x] Create [`fixtures/frameworks/nextjs/app/layout.tsx`](crates/integration-tests/fixtures/frameworks/nextjs/app/layout.tsx)
-- [x] Create [`fixtures/frameworks/nextjs/app/page.tsx`](crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx) with ad slot test content
-- [x] Create [`fixtures/frameworks/nextjs/Dockerfile`](crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile) (multi-stage build)
-- [x] Create [`tests/frameworks/nextjs.rs`](crates/integration-tests/tests/frameworks/nextjs.rs)
-- [x] Implement `NextJs` struct with RSC-specific scenarios
-- [x] Add Next.js to `FRAMEWORKS` registry
-- [x] Create `test_nextjs_fastly()` test
-- [x] Create `test_all_combinations()` matrix test
-- [x] Verify: `cargo test -p integration-tests` passes for all tests (requires Docker)
-
-### Phase 4.5: Enriched Next.js Fixture ✅ COMPLETE
-- [x] Add shared Navigation component (`app/components/Navigation.tsx`) with hydration signal
-- [x] Add dashboard page with ad slots and deferred route script (`app/dashboard/page.tsx`)
-- [x] Add contact page with `<form action>` for URL rewriting tests (`app/contact/page.tsx`)
-- [x] Add API routes (`app/api/hello/route.ts`, `app/api/data/route.ts`)
-- [x] Add RouteScript component for deferred script execution testing (`app/components/RouteScript.tsx`)
-- [x] Add `NextJsApiRoute` and `NextJsFormAction` custom scenarios
-- [x] Add `assert_form_action_rewritten` assertion helper
-- [x] Add Playwright browser tests: `api-passthrough`, `form-rewriting`, expanded `navigation` (4-page SPA chain + deferred script)
-- [x] Fix SPA hydration race (wait for `data-hydrated` before clicking)
-- [x] Fix infra.ts helper cleanup on polling failures
-- [x] Fix CI artifact path for Playwright HTML report
-- [x] Verify: all HTTP and browser tests pass
-
-### Phase 5: Documentation and CI ⏱️ 3-4 hours ✅ COMPLETE
-- [x] Create [`.github/workflows/integration-tests.yml`](.github/workflows/integration-tests.yml)
-  - [x] Build WASM binary step
-  - [x] Build Docker images (WordPress, Next.js)
-  - [x] Install Viceroy (with caching)
-  - [x] Run integration tests with WASM_BINARY_PATH env var
-- [x] Create [`crates/integration-tests/.dockerignore`](crates/integration-tests/.dockerignore)
-- [x] Update root [`Cargo.toml`](Cargo.toml) workspace members
-- [ ] Test CI on PR branch
-- [ ] Verify: CI passes on test branch
-
-### Success Criteria
-- [x] WordPress tests pass (3 standard + 1 custom scenario)
-- [x] Next.js tests pass (3 standard + 4 custom scenarios)
-- [ ] CI completes in < 5 minutes
-- [x] Containers cleanup automatically (no orphans)
-- [x] Tests run sequentially (fixed origin port requires `--test-threads=1`)
-- [x] Browser tests pass (12 Next.js + 5 WordPress, 0 flaky)
-- [x] README instructions work for new contributor
-- [x] Adding a new framework takes < 2 hours (documented process)
-
-### Post-Implementation Verification
-- [x] Run integration tests: `./scripts/integration-tests.sh`
-- [x] Run browser tests: `./scripts/integration-tests-browser.sh`
-- [x] Cargo clippy clean: `cargo clippy --manifest-path crates/integration-tests/Cargo.toml --tests`
-- [ ] CI passes on PR branch
-
-## Architecture
-
-### High-Level Pattern (Multi-Platform)
-
-```
-┌──────────────────────────────────────────────────────────┐
-│ Matrix Test Runner                                       │
-│  ├─ Discovers registered runtimes (RUNTIME_ENVIRONMENTS) │
-│  ├─ Discovers registered frameworks (FRAMEWORKS)         │
-│  ├─ For each runtime:                                    │
-│  │   └─ For each framework:                             │
-│  │       ├─ Build container from fixture                │
-│  │       ├─ Generate platform-specific config           │
-│  │       ├─ Spawn runtime process (Viceroy/Wrangler/etc)│
-│  │       ├─ Run standard test scenarios                 │
-│  │       └─ Run framework-specific scenarios            │
-│  └─ Cleanup (automatic via Drop)                        │
-└──────────────────────────────────────────────────────────┘
-```
-
-**Initial Implementation** (1 runtime × 2 frameworks = 2 test combinations):
-```
-✓ WordPress + Fastly
-✓ Next.js + Fastly
-```
-
-**Future Expansion** (adding Cloudflare = 2 runtimes × 2 frameworks = 4 combinations):
-```
-✓ WordPress + Fastly
-✓ WordPress + Cloudflare  (future)
-✓ Next.js + Fastly
-✓ Next.js + Cloudflare    (future)
-```
-
-### Dual Abstraction Design
-
-#### Frontend Framework Abstraction
-
-```rust
-/// Trait defining how to test a frontend framework
-pub trait FrontendFramework {
-    /// Framework identifier (e.g., "wordpress", "nextjs")
-    fn id(&self) -> &'static str;
-
-    /// Build Docker container image for this framework
-    fn build_container(&self) -> Result<GenericImage>;
-
-    /// Port the framework serves on inside container
-    fn container_port(&self) -> u16;
-
-    /// HTTP path to use for health checks
-    fn health_check_path(&self) -> &str { "/" }
-
-    /// Standard test scenarios applicable to this framework
-    fn standard_scenarios(&self) -> Vec<TestScenario> {
-        vec![
-            TestScenario::HtmlInjection,
-            TestScenario::ScriptServing,
-            TestScenario::AttributeRewriting,
-            TestScenario::GdprSignal,
-        ]
-    }
-
-    /// Framework-specific test scenarios (optional)
-    fn custom_scenarios(&self) -> Vec<CustomScenario> {
-        vec![]
-    }
-
-    /// Additional assertions for this framework (optional)
-    fn custom_assertions(&self, html: &str) -> Result<()> {
-        Ok(())
-    }
-}
-```
-
-#### Runtime Environment Abstraction
-
-```rust
-/// Trait defining how to run the trusted-server on different platforms
-pub trait RuntimeEnvironment: Send + Sync {
-    /// Platform identifier (e.g., "fastly", "cloudflare")
-    fn id(&self) -> &'static str;
-
-    /// Spawn runtime with platform-specific configuration
-    fn spawn(&self, config: &RuntimeConfig) -> Result<RuntimeProcess, TestError>;
-
-    /// Platform-specific configuration template
-    fn config_template(&self) -> &str;
-
-    /// Health check endpoint (may differ by platform)
-    fn health_check_path(&self) -> &str { "/health" }
-
-    /// Platform-specific environment variables
-    fn env_vars(&self) -> HashMap<String, String> { HashMap::new() }
-}
-
-/// Platform-agnostic process handle
-pub struct RuntimeProcess {
-    inner: Box<dyn RuntimeProcessHandle>,
-    pub base_url: String,
-}
-
-trait RuntimeProcessHandle {
-    fn kill(&mut self) -> Result<(), TestError>;
-    fn wait(&mut self) -> Result<(), TestError>;
-}
-```
-
-### Request Flow (Multi-Platform)
-
-```
-┌──────────────┐
-│ Test Client  │
-│ (reqwest)    │
-└──────┬───────┘
-       │ GET http://127.0.0.1:<DYNAMIC_PORT>/
-       ▼
-┌───────────────────────────────────┐
-│ Runtime Process (child process)   │
-│  • Fastly: Viceroy                │
-│  • Cloudflare: Wrangler            │
-│  • (extensible via trait)          │
-│                                   │
-│ Runs WASM binary                  │
-│ Config: platform-specific toml    │
-└───────────────┬───────────────────┘
-                │ Proxy to origin_url
-                ▼
-┌────────────────────────────────────┐
-│ TestContainer (Docker)             │
-│  • WordPress                       │
-│  • Next.js                         │
-│  • (extensible via trait)          │
-│                                    │
-│ Port: 127.0.0.1:RANDOM             │
-└────────────────────────────────────┘
-```
-
-**Key Design Decisions:**
-
-1. **Dual Trait Abstraction**: Separate traits for frontend frameworks and runtime environments - enables independent extensibility
-2. **Framework Registry**: Static `FRAMEWORKS` array holds all registered frontend implementations
-3. **Runtime Registry**: Static `RUNTIME_ENVIRONMENTS` array holds all registered platform implementations
-4. **Matrix Test Runner**: Single test file iterates over both registries, runs all combinations
-5. **Fixture Isolation**: Each framework has dedicated `fixtures/frameworks/<name>/` directory
-6. **Config Isolation**: Each platform has dedicated `fixtures/configs/<platform>-template.toml`
-7. **Dynamic Port Allocation**: Each runtime gets random available port - enables parallel execution
-8. **Platform-Specific Config**: Template-based config generation with platform-specific formats
-9. **Automatic Cleanup**: Runtime processes and containers use `Drop` impl for cleanup
-
-## Directory Structure
-
-```
-crates/integration-tests/
-├── Cargo.toml                      # Test crate with testcontainers, reqwest
-├── README.md                       # Setup and how to add frameworks/runtimes
-├── fixtures/
-│   ├── configs/                    # Platform-specific config templates
-│   │   └── fastly-template.toml   # Fastly Compute configuration
-│   │       # Future: cloudflare-template.toml, spin-template.toml, etc.
-│   └── frameworks/                 # Frontend framework fixtures
-│       ├── wordpress/
-│       │   ├── Dockerfile          # WordPress + SQLite custom image
-│       │   └── theme/              # Minimal test theme
-│       └── nextjs/
-│           ├── Dockerfile          # Next.js 14 test app
-│           ├── package.json
-│           ├── next.config.mjs
-│           └── app/
-│               └── page.tsx        # Test page with ad slots
-├── tests/
-│   ├── common/
-│   │   ├── mod.rs                  # Re-exports
-│   │   ├── runtime.rs              # RuntimeEnvironment trait (NEW)
-│   │   ├── config.rs               # Platform-agnostic config generation
-│   │   └── assertions.rs           # Shared assertion helpers
-│   ├── environments/               # Runtime implementations
-│   │   ├── mod.rs                  # RuntimeEnvironment trait + registry
-│   │   └── fastly.rs               # FastlyViceroy implementation
-│   │       # Future: cloudflare.rs, spin.rs, etc.
-│   ├── frameworks/                 # Frontend implementations
-│   │   ├── mod.rs                  # FrontendFramework trait + registry
-│   │   ├── wordpress.rs            # WordPress implementation
-│   │   ├── nextjs.rs               # Next.js implementation
-│   │   └── scenarios.rs            # TestScenario enum + runners
-│   └── integration.rs              # Matrix test runner (frameworks × runtimes)
-└── .dockerignore
-```
-
-## Registry Pattern (Dual Abstraction)
-
-### Runtime Environment Registry (`tests/environments/mod.rs`)
-
-```rust
-mod fastly;
-// Future platforms:
-// mod cloudflare;
-// mod spin;
-
-use std::collections::HashMap;
-use error_stack::Result;
-
-/// Trait that all runtime environments must implement
-pub trait RuntimeEnvironment: Send + Sync {
-    fn id(&self) -> &'static str;
-    fn spawn(&self, config: &RuntimeConfig) -> Result<RuntimeProcess, TestError>;
-    fn config_template(&self) -> &str;
-    fn health_check_path(&self) -> &str { "/health" }
-    fn env_vars(&self) -> HashMap<String, String> { HashMap::new() }
-}
-
-/// Platform-agnostic process handle
-pub struct RuntimeProcess {
-    inner: Box<dyn RuntimeProcessHandle>,
-    pub base_url: String,
-}
-
-trait RuntimeProcessHandle {
-    fn kill(&mut self) -> Result<(), TestError>;
-    fn wait(&mut self) -> Result<(), TestError>;
-}
-
-/// Runtime factory function type
-type RuntimeFactory = fn() -> Box<dyn RuntimeEnvironment>;
-
-/// Registry of all supported runtime environments
-/// Uses function pointers to avoid trait object static initialization issues
-pub static RUNTIME_ENVIRONMENTS: &[RuntimeFactory] = &[
-    || Box::new(fastly::FastlyViceroy),
-    // Future: Add Cloudflare, Fermyon Spin, etc.
-    // || Box::new(cloudflare::CloudflareWrangler),
-    // || Box::new(spin::FermyonSpin),
-
-    // To add new runtime:
-    // 1. Create tests/environments/<platform>.rs
-    // 2. Implement RuntimeEnvironment trait
-    // 3. Add factory here: || Box::new(<platform>::<Struct>)
-];
-```
-
-### Frontend Framework Registry (`tests/frameworks/mod.rs`)
-
-```rust
-mod wordpress;
-mod nextjs;
-// To add new framework: create module and register below
-
-pub mod scenarios;
-
-use testcontainers::GenericImage;
-use error_stack::Result;
-
-/// Trait that all frontend frameworks must implement
-pub trait FrontendFramework: Send + Sync {
-    fn id(&self) -> &'static str;
-    fn build_container(&self) -> Result<GenericImage, TestError>;
-    fn container_port(&self) -> u16;
-    fn health_check_path(&self) -> &str { "/" }
-    fn standard_scenarios(&self) -> Vec<scenarios::TestScenario>;
-    fn custom_scenarios(&self) -> Vec<scenarios::CustomScenario> { vec![] }
-    fn custom_assertions(&self, html: &str) -> Result<(), TestError> { Ok(()) }
-}
-
-/// Framework factory function type
-type FrameworkFactory = fn() -> Box<dyn FrontendFramework>;
-
-/// Registry of all supported frameworks
-/// Uses function pointers to avoid trait object static initialization issues
-pub static FRAMEWORKS: &[FrameworkFactory] = &[
-    || Box::new(wordpress::WordPress),
-    || Box::new(nextjs::NextJs),
-    // To add new framework:
-    // 1. Create fixtures/frameworks/<name>/
-    // 2. Create tests/frameworks/<name>.rs
-    // 3. Implement FrontendFramework trait
-    // 4. Add factory here: || Box::new(<name>::<Struct>)
-];
-
-### Test Error Types
-
-```rust
-/// Test error types (platform-agnostic)
-#[derive(Debug, derive_more::Display)]
-pub enum TestError {
-    // Runtime environment errors
-    #[display("Failed to spawn runtime process")]
-    RuntimeSpawn,
-
-    #[display("Runtime not ready after timeout")]
-    RuntimeNotReady,
-
-    #[display("Failed to kill runtime process")]
-    RuntimeKill,
-
-    #[display("Failed to wait for runtime process")]
-    RuntimeWait,
-
-    // Container errors
-    #[display("Container failed to start: {reason}")]
-    ContainerStart { reason: String },
-
-    #[display("Container operation timed out")]
-    ContainerTimeout,
-
-    // HTTP errors
-    #[display("HTTP request failed")]
-    HttpRequest,
-
-    #[display("Failed to parse response")]
-    ResponseParse,
-
-    // Assertion errors
-    #[display("Script tag not found in HTML")]
-    ScriptTagNotFound,
-
-    #[display("Missing module: {module}")]
-    MissingModule { module: String },
-
-    #[display("Invalid CSS selector")]
-    InvalidSelector,
-
-    #[display("Element not found")]
-    ElementNotFound,
-
-    #[display("Attribute not rewritten")]
-    AttributeNotRewritten,
-
-    #[display("GDPR signal missing from response")]
-    GdprSignalMissing,
-
-    // Configuration errors
-    #[display("Config parse error")]
-    ConfigParse,
-
-    #[display("Config write error")]
-    ConfigWrite,
-
-    #[display("Config serialization error")]
-    ConfigSerialize,
-
-    // Resource errors
-    #[display("WASM binary not found")]
-    WasmBinaryNotFound,
-
-    #[display("No available port found")]
-    NoPortAvailable,
-}
-
-impl core::error::Error for TestError {}
-```
-
-### Runtime Implementation Examples
-
-#### Fastly Runtime (`tests/environments/fastly.rs`)
-
-```rust
-use super::*;
-use std::process::{Child, Command};
-
-pub struct FastlyViceroy;
-
-impl RuntimeEnvironment for FastlyViceroy {
-    fn id(&self) -> &'static str {
-        "fastly"
-    }
-
-    fn spawn(&self, config: &RuntimeConfig) -> Result<RuntimeProcess, TestError> {
-        let port = find_available_port()?;
-
-        let mut child = Command::new("viceroy")
-            .arg("run")
-            .arg("-C")
-            .arg(&config.config_path)
-            .arg("--addr")
-            .arg(format!("127.0.0.1:{}", port))
-            .arg("--")
-            .arg(&config.wasm_path)
-            .spawn()
-            .change_context(TestError::RuntimeSpawn)?;
-
-        let base_url = format!("http://127.0.0.1:{}", port);
-        wait_for_ready(&base_url, self.health_check_path())?;
-
-        Ok(RuntimeProcess {
-            inner: Box::new(ViceroyHandle { child }),
-            base_url,
-        })
-    }
-
-    fn config_template(&self) -> &str {
-        include_str!("../../fixtures/configs/fastly-template.toml")
-    }
-}
-
-struct ViceroyHandle {
-    child: Child,
-}
-
-impl RuntimeProcessHandle for ViceroyHandle {
-    fn kill(&mut self) -> Result<(), TestError> {
-        self.child.kill()
-            .change_context(TestError::RuntimeKill)?;
-        Ok(())
-    }
-
-    fn wait(&mut self) -> Result<(), TestError> {
-        self.child.wait()
-            .change_context(TestError::RuntimeWait)?;
-        Ok(())
-    }
-}
-```
-
-**Note**: Cloudflare runtime implementation example moved to "Future Enhancements" section.
-
-To add a new runtime platform, follow the same pattern as Fastly above:
-1. Create `tests/environments/<platform>.rs`
-2. Implement `RuntimeEnvironment` trait
-3. Create platform-specific process handle
-4. Register in `RUNTIME_ENVIRONMENTS` array
-
-### Frontend Framework Implementation Examples
-
-#### WordPress Implementation (`tests/frameworks/wordpress.rs`)
-
-```rust
-use super::{FrontendFramework, scenarios::*};
-use testcontainers::{GenericImage, WaitFor};
-
-pub struct WordPress;
-
-impl FrontendFramework for WordPress {
-    fn id(&self) -> &'static str {
-        "wordpress"
-    }
-
-    fn build_container(&self) -> Result<GenericImage, TestError> {
-        // Use wordpress:cli with minimal setup (no MySQL required for basic HTML serving)
-        // Alternative: Use pre-configured image with SQLite plugin
-        Ok(GenericImage::new("wordpress", "cli")
-            .with_exposed_port(8080)
-            .with_env_var("WORDPRESS_DEBUG", "0")
-            .with_wait_for(WaitFor::message_on_stdout("WordPress Ready")))
-    }
-
-    fn container_port(&self) -> u16 {
-        8080
-    }
-
-    fn standard_scenarios(&self) -> Vec<TestScenario> {
-        vec![
-            TestScenario::HtmlInjection,
-            TestScenario::ScriptServing { modules: vec!["core", "prebid"] },
-            TestScenario::AttributeRewriting,
-            TestScenario::GdprSignal,
-        ]
-    }
-
-    fn custom_scenarios(&self) -> Vec<CustomScenario> {
-        vec![
-            CustomScenario::WordPressAdminInjection,
-        ]
-    }
-
-    fn custom_assertions(&self, html: &str) -> Result<(), TestError> {
-        // Verify WordPress-specific HTML structure preserved
-        ensure!(html.contains("wp-content"), "should preserve wp-content paths");
-        Ok(())
-    }
-}
-```
-
-**Note**: WordPress requires additional setup for full functionality. For Phase 3, consider:
-- **Option A** (Recommended): Use `wordpress:cli` image or pre-built image with SQLite plugin - simpler, faster startup
-- **Option B**: Multi-container setup with MySQL - more realistic but adds complexity
-
-### Building Container Images
-
-For frameworks that require custom Docker images (like Next.js), the images must be built before tests run:
-
-**Option 1: Pre-build in CI** (Recommended)
-```yaml
-# In .github/workflows/test.yml
-- name: Build test container images
-  run: |
-    docker build -t test-nextjs:latest \
-      crates/integration-tests/fixtures/frameworks/nextjs/
-```
-
-**Option 2: Build on-demand in tests**
-```rust
-// In tests/frameworks/nextjs.rs
-fn build_container(&self) -> Result<GenericImage, TestError> {
-    // Check if image exists, build if not
-    let image_name = "test-nextjs:latest";
-
-    // Use testcontainers ImageBuild API (if available)
-    // or shell out to docker build command
-    Ok(GenericImage::new(image_name, "latest")
-        .with_exposed_port(3000))
-}
-```
-
-**Option 3: Use docker-compose** (Future enhancement)
-```rust
-// Multi-service orchestration for complex setups
-```
-
-### Next.js Implementation (`tests/frameworks/nextjs.rs`)
-
-```rust
-use super::{FrontendFramework, scenarios::*};
-use testcontainers::GenericImage;
-
-pub struct NextJs;
-
-impl FrontendFramework for NextJs {
-    fn id(&self) -> &'static str {
-        "nextjs"
-    }
-
-    fn build_container(&self) -> Result<GenericImage, TestError> {
-        // Build from Dockerfile in fixtures/frameworks/nextjs/
-        Ok(GenericImage::new("test-nextjs", "latest")
-            .with_exposed_port(3000)
-            .with_wait_for(WaitFor::message_on_stdout("ready")))
-    }
-
-    fn container_port(&self) -> u16 {
-        3000
-    }
-
-    fn standard_scenarios(&self) -> Vec<TestScenario> {
-        vec![
-            TestScenario::HtmlInjection,
-            TestScenario::ScriptServing { modules: vec!["core", "prebid", "lockr"] },
-            TestScenario::AttributeRewriting,
-            TestScenario::GdprSignal,
-        ]
-    }
-
-    fn custom_scenarios(&self) -> Vec<CustomScenario> {
-        vec![
-            CustomScenario::NextJsRscFlight,  // RSC streaming format
-            CustomScenario::NextJsServerActions,
-        ]
-    }
-
-    fn custom_assertions(&self, html: &str) -> Result<(), TestError> {
-        // Verify Next.js hydration markers preserved
-        ensure!(html.contains("__NEXT_DATA__"), "should preserve Next.js data");
-        Ok(())
-    }
-}
-```
-
-### Test Scenarios (`tests/frameworks/scenarios.rs`)
-
-```rust
-/// Standard test scenarios applicable to all frameworks
-#[derive(Debug, Clone)]
-pub enum TestScenario {
-    /// Verify <script> tag injected into <head>
-    HtmlInjection,
-
-    /// Verify /static/tsjs= endpoint serves JS bundles
-    ScriptServing { modules: Vec<&'static str> },
-
-    /// Verify tsjs-* attributes rewritten correctly
-    AttributeRewriting,
-
-    /// Verify GDPR consent signals propagate
-    GdprSignal,
-}
-
-/// Framework-specific custom scenarios
-#[derive(Debug, Clone)]
-pub enum CustomScenario {
-    WordPressAdminInjection,
-    NextJsRscFlight,
-    NextJsServerActions,
-    LeptosHydration,      // Future
-    NuxtSsr,              // Future
-}
-
-impl TestScenario {
-    pub fn run(&self, viceroy: &ViceroyProcess, framework: &dyn FrontendFramework) -> Result<(), TestError> {
-        let framework_id = framework.id();
-
-        match self {
-            Self::HtmlInjection => {
-                let resp = reqwest::blocking::get(viceroy.base_url())
-                    .change_context(TestError::HttpRequest)
-                    .attach_printable(format!(
-                        "scenario: HtmlInjection, framework: {}", framework_id
-                    ))?;
-
-                let html = resp.text()
-                    .change_context(TestError::ResponseParse)
-                    .attach_printable(format!("framework: {}", framework_id))?;
-
-                assert_script_tag_present(&html, &["core"])
-                    .attach_printable(format!("framework: {}", framework_id))?;
-
-                Ok(())
-            }
-            Self::ScriptServing { modules } => {
-                let url = format!("{}/static/tsjs={}", viceroy.base_url(), modules.join(","));
-                let resp = reqwest::blocking::get(&url)
-                    .change_context(TestError::HttpRequest)
-                    .attach_printable(format!(
-                        "scenario: ScriptServing, framework: {}, modules: {:?}",
-                        framework_id, modules
-                    ))?;
-
-                ensure!(
-                    resp.status().is_success(),
-                    TestError::HttpRequest
-                );
-
-                let js = resp.text()
-                    .change_context(TestError::ResponseParse)?;
-
-                ensure!(
-                    js.contains("window.tsjs"),
-                    TestError::ScriptTagNotFound
-                );
-
-                Ok(())
-            }
-            Self::AttributeRewriting => {
-                let resp = reqwest::blocking::get(viceroy.base_url())
-                    .change_context(TestError::HttpRequest)
-                    .attach_printable(format!(
-                        "scenario: AttributeRewriting, framework: {}", framework_id
-                    ))?;
-
-                let html = resp.text()
-                    .change_context(TestError::ResponseParse)?;
-
-                assert_attribute_rewritten(&html, "div[data-ad-unit]", "tsjs-")
-                    .attach_printable(format!("framework: {}", framework_id))?;
-
-                Ok(())
-            }
-            Self::GdprSignal => {
-                let resp = reqwest::blocking::get(viceroy.base_url())
-                    .change_context(TestError::HttpRequest)
-                    .attach_printable(format!(
-                        "scenario: GdprSignal, framework: {}", framework_id
-                    ))?;
-
-                assert_gdpr_signal(&resp)
-                    .attach_printable(format!("framework: {}", framework_id))?;
-
-                Ok(())
-            }
-        }
-    }
-}
-```
-
-### Matrix Test Runner (`tests/integration.rs`)
-
-```rust
-mod common;
-mod environments;
-mod frameworks;
-
-use environments::RUNTIME_ENVIRONMENTS;
-use frameworks::FRAMEWORKS;
-use common::{RuntimeConfig, wasm_binary_path};
-use std::time::Duration;
-use error_stack::ResultExt;
-
-/// Test all combinations: frameworks × runtimes (matrix testing)
-#[test]
-fn test_all_combinations() {
-    for runtime_factory in RUNTIME_ENVIRONMENTS {
-        let runtime = runtime_factory();
-        println!("Testing runtime: {}", runtime.id());
-
-        for framework_factory in FRAMEWORKS {
-            let framework = framework_factory();
-            println!("  Testing framework: {}", framework.id());
-
-            test_combination(runtime.as_ref(), framework.as_ref())
-                .expect("combination should pass");
-        }
-    }
-}
-
-/// Test a specific framework × runtime combination
-fn test_combination(
-    runtime: &dyn RuntimeEnvironment,
-    framework: &dyn FrontendFramework,
-) -> Result<(), TestError> {
-    // 1. Start frontend container
-    let container = framework.build_container()
-        .attach_printable(format!(
-            "runtime: {}, framework: {}",
-            runtime.id(),
-            framework.id()
-        ))?;
-
-    let container_instance = tokio::time::timeout(
-        Duration::from_secs(60),
-        async { container.start() }
-    )
-        .await
-        .change_context(TestError::ContainerTimeout)?
-        .change_context(TestError::ContainerStart {
-            reason: format!("framework: {}", framework.id())
-        })?;
-
-    let origin_url = format!(
-        "http://127.0.0.1:{}",
-        container_instance.get_host_port(framework.container_port())
-    );
-
-    // 2. Generate platform-specific config
-    let wasm_path = wasm_binary_path();
-    let config = RuntimeConfig::new(runtime.config_template())
-        .with_origin_url(origin_url)
-        .with_integrations(vec!["prebid", "lockr"])
-        .with_wasm_path(wasm_path)
-        .build()
-        .attach_printable(format!(
-            "runtime: {}, framework: {}",
-            runtime.id(),
-            framework.id()
-        ))?;
-
-    // 3. Spawn runtime process
-    let process = runtime.spawn(&config)
-        .attach_printable(format!(
-            "runtime: {}, framework: {}",
-            runtime.id(),
-            framework.id()
-        ))?;
-
-    // 4. Run standard scenarios
-    for scenario in framework.standard_scenarios() {
-        scenario.run(&process.base_url, framework)
-            .attach_printable(format!(
-                "runtime: {}, framework: {}, scenario: {:?}",
-                runtime.id(),
-                framework.id(),
-                scenario
-            ))?;
-    }
-
-    // 5. Run custom scenarios
-    for scenario in framework.custom_scenarios() {
-        scenario.run(&process.base_url, framework)
-            .attach_printable(format!(
-                "runtime: {}, framework: {}, custom scenario: {:?}",
-                runtime.id(),
-                framework.id(),
-                scenario
-            ))?;
-    }
-
-    // 6. Cleanup (automatic via Drop)
-    Ok(())
-}
-
-// Support running specific combinations for faster iteration
-#[test]
-fn test_wordpress_fastly() {
-    let runtime = environments::fastly::FastlyViceroy;
-    let framework = frameworks::wordpress::WordPress;
-    test_combination(&runtime, &framework)
-        .expect("WordPress on Fastly should work");
-}
-
-#[test]
-fn test_nextjs_fastly() {
-    let runtime = environments::fastly::FastlyViceroy;
-    let framework = frameworks::nextjs::NextJs;
-    test_combination(&runtime, &framework)
-        .expect("Next.js on Fastly should work");
-}
-
-// Future: Add Cloudflare-specific tests when platform support is added
-// #[test]
-// fn test_wordpress_cloudflare() { ... }
-// #[test]
-// fn test_nextjs_cloudflare() { ... }
-```
-
-## Extensibility Guide
-
-### Adding a New Frontend Framework
-
-**Example workflow** (implementation details in code comments):
-
-**Step 1**: Create fixture directory
-```bash
-mkdir -p crates/integration-tests/fixtures/frameworks/<name>
-# Add Dockerfile, test application code, etc.
-```
-
-**Step 2**: Implement `FrontendFramework` trait
-```rust
-// tests/frameworks/<name>.rs
-use super::{FrontendFramework, scenarios::*};
-
-pub struct YourFramework;
-
-impl FrontendFramework for YourFramework {
-    fn id(&self) -> &'static str { "<name>" }
-    fn build_container(&self) -> Result<GenericImage, TestError> { /* ... */ }
-    fn container_port(&self) -> u16 { /* port */ }
-    fn standard_scenarios(&self) -> Vec<TestScenario> { /* ... */ }
-    // Optional: custom_scenarios, custom_assertions
-}
-```
-
-**Step 3**: Register in framework registry
-```rust
-// tests/frameworks/mod.rs
-mod <name>;
-
-pub static FRAMEWORKS: &[FrameworkFactory] = &[
-    || Box::new(wordpress::WordPress),
-    || Box::new(nextjs::NextJs),
-    || Box::new(<name>::YourFramework),  // <- Add here
-];
-```
-
-**Done!** The new framework is automatically tested against ALL registered runtimes.
-
-### Adding a New Runtime Environment
-
-**Example workflow** (implementation details in code comments):
-
-**Step 1**: Create platform config template
-```bash
-# fixtures/configs/<platform>-template.toml
-# Platform-specific configuration format
-```
-
-**Step 2**: Implement `RuntimeEnvironment` trait
-```rust
-// tests/environments/<platform>.rs
-use super::*;
-
-pub struct YourRuntime;
-
-impl RuntimeEnvironment for YourRuntime {
-    fn id(&self) -> &'static str { "<platform>" }
-    fn spawn(&self, config: &RuntimeConfig) -> Result<RuntimeProcess, TestError> {
-        // Platform-specific process spawning
-        /* ... */
-    }
-    fn config_template(&self) -> &str {
-        include_str!("../../fixtures/configs/<platform>-template.toml")
-    }
-    // Optional: health_check_path, env_vars
-}
-
-struct YourRuntimeHandle {
-    child: Child,
-}
-
-impl RuntimeProcessHandle for YourRuntimeHandle {
-    fn kill(&mut self) -> Result<(), TestError> { /* ... */ }
-    fn wait(&mut self) -> Result<(), TestError> { /* ... */ }
-}
-```
-
-**Step 3**: Register in runtime registry
-```rust
-// tests/environments/mod.rs
-mod <platform>;
-
-pub static RUNTIME_ENVIRONMENTS: &[RuntimeFactory] = &[
-    || Box::new(fastly::FastlyViceroy),
-    || Box::new(cloudflare::CloudflareWrangler),
-    || Box::new(<platform>::YourRuntime),  // <- Add here
-];
-```
-
-**Done!** The new runtime is automatically tested against ALL registered frameworks.
-
-## Implementation Phases (Multi-Platform)
-
-### Phase 0: Prerequisites (BLOCKER)
-**Goal**: Add `/health` endpoint to enable runtime readiness checks
-
-1. Add health check route to `crates/fastly/src/main.rs`:
-```rust
-(Method::GET, "/health") => Ok(Response::from_status(200).with_body_text_plain("ok"))
-```
-2. Build and test WASM binary with Viceroy
-3. Verify `/health` returns 200 OK
-
-**Verification**: `curl http://127.0.0.1:7676/health` returns "ok"
-
-### Phase 1: Core Infrastructure (Foundation)
-**Goal**: Set up test crate structure with dual abstraction support
-
-1. Add `integration-tests` to workspace members in root `Cargo.toml`
-2. Create `crates/integration-tests/Cargo.toml` with dependencies
-3. Define `RuntimeEnvironment` trait in `tests/common/runtime.rs` (NEW)
-4. Implement `RuntimeConfig` with platform-agnostic interface
-5. Create platform config templates in `fixtures/configs/`
-6. Implement assertion helpers in `tests/common/assertions.rs`
-
-**Verification**: `cargo check -p integration-tests`
-
-### Phase 1.5: Fastly Runtime Implementation
-**Goal**: Implement Fastly/Viceroy runtime support
-
-1. Create `tests/environments/fastly.rs`
-2. Implement `FastlyViceroy` struct with `RuntimeEnvironment` trait
-3. Create `ViceroyHandle` for process lifecycle
-4. Implement health check with `/health` endpoint
-5. Create `fixtures/configs/fastly-template.toml`
-
-**Verification**: `cargo test -p integration-tests --lib test_fastly_runtime_spawn`
-
-### Phase 2: Framework Abstraction (Extensibility Layer)
-**Goal**: Create trait-based framework system
-
-1. Define `FrontendFramework` trait in `tests/frameworks/mod.rs`
-2. Define `TestScenario` enum and runners in `tests/frameworks/scenarios.rs`
-3. Implement scenario execution logic
-4. Create framework registry pattern
-
-**Verification**: Trait compiles and registry pattern works
-
-### Phase 3: WordPress Implementation
-**Goal**: Implement first framework and test against Fastly
-
-1. Create WordPress Dockerfile with SQLite plugin
-2. Create minimal test theme
-3. Implement `WordPress` struct in `tests/frameworks/wordpress.rs`
-4. Create matrix test runner in `tests/integration.rs`
-5. Test WordPress against Fastly
-
-**Verification**:
-```bash
-cargo test -p integration-tests -- wordpress_fastly
-```
-
-### Phase 4: Next.js Implementation
-**Goal**: Prove extensibility works for frameworks
-
-1. Create Next.js 14 minimal app
-2. Create Dockerfile
-3. Implement `NextJs` struct in `tests/frameworks/nextjs.rs`
-4. Add RSC-specific scenarios
-5. Test against Fastly
-
-**Verification**:
-```bash
-cargo test -p integration-tests -- test_all_combinations
-cargo test -p integration-tests -- nextjs_fastly
-```
-
-### Phase 5: Documentation and CI (Production Ready)
-**Goal**: Production-ready CI pipeline and documentation
-
-1. Write comprehensive `README.md` with:
-   - How to add new frameworks
-   - How to add new runtimes (for future)
-   - Troubleshooting guide
-2. Create `.github/workflows/integration-tests.yml`:
-   - Build WASM binary first
-   - Install Viceroy
-   - Build container images (WordPress, Next.js)
-   - Run integration tests with `WASM_BINARY_PATH` env var
-3. Add `.dockerignore` for build optimization
-
-**Verification**: CI passes with both frameworks against Fastly
-
-## Critical Files to Create
-
-### 1. `crates/integration-tests/Cargo.toml`
-
-```toml
-[package]
-name = "integration-tests"
-version = "0.1.0"
-edition = "2024"
-publish = false
-
-[dev-dependencies]
-testcontainers = "0.25"
-reqwest = { version = "0.12", features = ["blocking"] }
-scraper = "0.21"
-tempfile = "3.0"
-toml = "0.8"
-serde = { version = "1.0", features = ["derive"] }
-log = "0.4"
-error-stack = "0.5"
-tokio = { version = "1.0", features = ["time"] }  # For container timeouts
-# serial_test = "3.0"  # Optional: for test isolation (Phase 6)
-```
-
-### 2. `tests/common/viceroy.rs` - Process Manager
-
-```rust
-use std::process::{Child, Command};
-use std::path::{Path, PathBuf};
-use std::time::Duration;
-use std::env;
-use error_stack::{Result, Report, ResultExt};
-
-pub struct ViceroyProcess {
-    child: Child,
-    address: String,
-}
-
-impl ViceroyProcess {
-    pub fn spawn(config_path: &Path, wasm_path: &Path) -> Result<Self, TestError> {
-        // Verify WASM binary exists
-        ensure!(
-            wasm_path.exists(),
-            TestError::WasmBinaryNotFound
-        );
-
-        // 1. Spawn: viceroy run -C config_path -- wasm_path
-        let mut child = Command::new("viceroy")
-            .arg("run")
-            .arg("-C")
-            .arg(config_path)
-            .arg("--")
-            .arg(wasm_path)
-            .spawn()
-            .change_context(TestError::ViceroySpawn)?;
-
-        // 2. Wait for Viceroy to be ready on 127.0.0.1:7676
-        let address = "http://127.0.0.1:7676".to_string();
-        Self::wait_for_ready(&address)?;
-
-        Ok(Self { child, address })
-    }
-
-    fn wait_for_ready(address: &str) -> Result<(), TestError> {
-        // Try /health endpoint first (requires WASM binary to implement it)
-        // Fall back to root path if /health doesn't exist
-        for attempt in 0..30 {
-            if let Ok(resp) = reqwest::blocking::get(format!("{}/health", address)) {
-                if resp.status().is_success() {
-                    return Ok(());
-                }
-            }
-
-            // Fallback: try root path
-            if let Ok(resp) = reqwest::blocking::get(address) {
-                if resp.status().is_success() || resp.status().as_u16() == 404 {
-                    // 404 is fine - means server is responding
-                    return Ok(());
-                }
-            }
-
-            std::thread::sleep(Duration::from_millis(100));
-        }
-        bail!(TestError::ViceroyNotReady)
-    }
-
-    pub fn base_url(&self) -> &str {
-        &self.address
-    }
-}
-
-impl Drop for ViceroyProcess {
-    fn drop(&mut self) {
-        let _ = self.child.kill();
-        let _ = self.child.wait();
-    }
-}
-
-/// Get path to WASM binary, respecting environment variable
-fn wasm_binary_path() -> PathBuf {
-    env::var("WASM_BINARY_PATH")
-        .map(PathBuf::from)
-        .unwrap_or_else(|_| {
-            PathBuf::from(env!("CARGO_MANIFEST_DIR"))
-                .join("../target/wasm32-wasip1/release/trusted-server-fastly.wasm")
-        })
-}
-```
-
-**IMPORTANT**: For production use, add a `/health` endpoint to the WASM binary:
-
-```rust
-// In crates/fastly/src/main.rs
-fn route_request(req: Request) -> Result<Response, Report<TrustedServerError>> {
-    match req.get_path() {
-        "/health" => Ok(Response::from_status(200)
-            .with_body_text_plain("ok")),
-        // ... existing routes
-    }
-}
-```
-
-### 3. `tests/common/config.rs` - Dynamic Config
-
-```rust
-use tempfile::NamedTempFile;
-use std::io::Write;
-use error_stack::{Result, ResultExt};
-
-pub struct TestConfig {
-    origin_url: String,
-    integrations: Vec<String>,
-}
-
-impl TestConfig {
-    pub fn new(container_url: String) -> Self {
-        Self {
-            origin_url: container_url,
-            integrations: vec![],
-        }
-    }
-
-    pub fn with_integrations(mut self, ids: Vec<String>) -> Self {
-        self.integrations = ids;
-        self
-    }
-
-    pub fn write_to_file(&self) -> Result<NamedTempFile, TestError> {
-        // Load template
-        let template = include_str!("../../fixtures/base-config.toml");
-        let mut config: toml::Value = toml::from_str(template)
-            .change_context(TestError::ConfigParse)?;
-
-        // Safe mutation: override publisher.origin_url
-        if let Some(publisher) = config.get_mut("publisher") {
-            if let Some(publisher_table) = publisher.as_table_mut() {
-                publisher_table.insert(
-                    "origin_url".to_string(),
-                    toml::Value::String(self.origin_url.clone())
-                );
-            }
-        } else {
-            return Err(TestError::ConfigParse)
-                .attach_printable("missing [publisher] section in base config");
-        }
-
-        // Safe mutation: enable integrations
-        let integrations_config = config
-            .get_mut("integrations")
-            .and_then(|v| v.get_mut("config"))
-            .and_then(|v| v.as_table_mut())
-            .ok_or(TestError::ConfigParse)
-            .attach_printable("missing [integrations.config] section")?;
-
-        for integration_id in &self.integrations {
-            if let Some(integration_entry) = integrations_config.get_mut(integration_id) {
-                // Integration exists in template - update it
-                if let Some(table) = integration_entry.as_table_mut() {
-                    table.insert("enabled".to_string(), toml::Value::Boolean(true));
-                }
-            } else {
-                // Integration doesn't exist - create new entry
-                let mut new_table = toml::map::Map::new();
-                new_table.insert("enabled".to_string(), toml::Value::Boolean(true));
-                integrations_config.insert(
-                    integration_id.clone(),
-                    toml::Value::Table(new_table)
-                );
-            }
-        }
-
-        // Write to temp file
-        let mut file = NamedTempFile::new()
-            .change_context(TestError::ConfigWrite)?;
-        let content = toml::to_string_pretty(&config)
-            .change_context(TestError::ConfigSerialize)?;
-        file.write_all(content.as_bytes())
-            .change_context(TestError::ConfigWrite)?;
-
-        Ok(file)
-    }
-}
-```
-
-### 4. `tests/common/assertions.rs` - Shared Helpers
-
-```rust
-use scraper::{Html, Selector};
-use error_stack::{Result, Report};
-
-pub fn assert_script_tag_present(html: &str, module_ids: &[&str]) -> Result<(), TestError> {
-    let document = Html::parse_document(html);
-    let selector = Selector::parse("script[src]").expect("valid selector");
-
-    for element in document.select(&selector) {
-        if let Some(src) = element.value().attr("src") {
-            if src.starts_with("/static/tsjs=") {
-                for module_id in module_ids {
-                    ensure!(
-                        src.contains(module_id),
-                        TestError::MissingModule { module: module_id.to_string() }
-                    );
-                }
-                return Ok(());
-            }
-        }
-    }
-
-    bail!(TestError::ScriptTagNotFound)
-}
-
-pub fn assert_attribute_rewritten(html: &str, selector: &str, attr_prefix: &str) -> Result<(), TestError> {
-    let document = Html::parse_document(html);
-    let sel = Selector::parse(selector).change_context(TestError::InvalidSelector)?;
-
-    let element = document
-        .select(&sel)
-        .next()
-        .ok_or(TestError::ElementNotFound)?;
-
-    let has_tsjs_attr = element
-        .value()
-        .attrs()
-        .any(|(name, _)| name.starts_with(attr_prefix));
-
-    ensure!(has_tsjs_attr, TestError::AttributeNotRewritten);
-    Ok(())
-}
-
-pub fn assert_gdpr_signal(response: &reqwest::blocking::Response) -> Result<(), TestError> {
-    let cookies = response.cookies().collect::<Vec<_>>();
-    ensure!(
-        cookies.iter().any(|c| c.name() == "tsjs_gdpr_consent"),
-        TestError::GdprSignalMissing
-    );
-    Ok(())
-}
-```
-
-### 5. `crates/integration-tests/README.md`
-
-```markdown
-# Integration Tests
-
-End-to-end integration tests for Trusted Server with multiple frontend frameworks.
-
-## Prerequisites
-
-- Docker installed and running
-- Rust 1.91+ with wasm32-wasip1 target
-- Viceroy installed: `cargo install viceroy`
-
-## Running Tests
-
-```bash
-# Build WASM binary first
-cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
-
-# Build container images (if needed)
-docker build -t test-nextjs:latest \
-  crates/integration-tests/fixtures/frameworks/nextjs/
-
-# Run all framework tests (sequential execution required due to shared port)
-cargo test -p integration-tests -- --test-threads=1
-
-# Run specific framework
-cargo test -p integration-tests --test integration -- wordpress --test-threads=1
-cargo test -p integration-tests --test integration -- nextjs --test-threads=1
-
-# With debug logging
-RUST_LOG=debug cargo test -p integration-tests -- --test-threads=1 --nocapture
-```
-
-**Note**: Tests must run sequentially (`--test-threads=1`) because they share Viceroy port 7676. Future enhancement will add dynamic port allocation for parallel execution.
-
-## Adding a New Framework
-
-See INTEGRATION_TESTS_PLAN.md section "How to Add a New Framework" for step-by-step guide.
-
-Quick checklist:
-1. Create `fixtures/frameworks/<name>/` with Dockerfile and test app
-2. Implement `FrontendFramework` trait in `tests/frameworks/<name>.rs`
-3. Register in `FRAMEWORKS` array in `tests/frameworks/mod.rs`
-4. Run tests!
-```
-
-## Fixtures
-
-### `fixtures/base-config.toml`
-
-```toml
-[publisher]
-id = "test-publisher"
-name = "Integration Test Publisher"
-origin_url = "PLACEHOLDER"
-public_domain_url = "http://127.0.0.1:7676"
-
-[integrations.config]
-prebid = { enabled = false }
-lockr = { enabled = false }
-permutive = { enabled = false }
-datadome = { enabled = false }
-
-[storage]
-kv_store_name = "test_store"
-
-[gdpr]
-enabled = true
-```
-
-### `fixtures/frameworks/nextjs/package.json`
-
-```json
-{
-  "name": "integration-test-nextjs",
-  "version": "1.0.0",
-  "private": true,
-  "scripts": {
-    "dev": "next dev",
-    "build": "next build",
-    "start": "next start"
-  },
-  "dependencies": {
-    "next": "^14.0.0",
-    "react": "^18.2.0",
-    "react-dom": "^18.2.0"
-  }
-}
-```
-
-### `fixtures/frameworks/nextjs/app/page.tsx`
-
-```tsx
-export default function Home() {
-  return (
-    <div>
-      <h1>Integration Test Page</h1>
-      <div id="ad-slot-1" data-ad-unit="/test/banner"></div>
-      <div id="ad-slot-2" data-ad-unit="/test/sidebar"></div>
-    </div>
-  );
-}
-```
-
-## Verification
-
-### Local Testing
-```bash
-# Full suite
-cargo test -p integration-tests
-
-# Single framework (faster iteration)
-cargo test -p integration-tests --test integration -- wordpress --nocapture
-
-# With logs
-RUST_LOG=debug cargo test -p integration-tests
-```
-
-### CI Testing
-
-Example workflow job:
-```yaml
-integration-tests:
-  runs-on: ubuntu-latest
-  needs: test  # Run after unit tests pass
-  steps:
-    - uses: actions/checkout@v4
-
-    - name: Install Rust
-      uses: dtolnay/rust-toolchain@stable
-      with:
-        targets: wasm32-wasip1
-
-    - name: Build WASM binary
-      run: |
-        cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
-
-    - name: Build WordPress test container
-      run: |
-        docker build -t test-wordpress:latest \
-          crates/integration-tests/fixtures/frameworks/wordpress/
-
-    - name: Build Next.js test container
-      run: |
-        docker build -t test-nextjs:latest \
-          crates/integration-tests/fixtures/frameworks/nextjs/
-
-    - name: Install Viceroy
-      run: cargo install viceroy --locked
-
-    - name: Run integration tests
-      run: cargo test -p integration-tests
-      env:
-        WASM_BINARY_PATH: target/wasm32-wasip1/release/trusted-server-fastly.wasm
-```
-
-- Builds WASM binary as prerequisite
-- Pre-builds Docker images for both frameworks
-- Installs Viceroy for Fastly runtime
-- Runs all framework tests against Fastly
-- Fails if any framework test fails
-
-### Success Criteria
-- [ ] WordPress tests pass against Fastly (4 standard + 1 custom scenario)
-- [ ] Next.js tests pass against Fastly (4 standard + 2 custom scenarios)
-- [ ] CI completes in < 5 minutes
-- [ ] Containers cleanup automatically (no orphans)
-- [ ] Tests run in parallel (dynamic port allocation works)
-- [ ] Zero flaky tests (20 consecutive runs pass)
-- [ ] README instructions work for new contributor
-- [ ] RuntimeEnvironment architecture supports future platforms without refactoring
-
-## Future Framework Support
-
-Planned frameworks to add after initial implementation:
-
-- **Leptos** - Rust frontend framework (SSR + hydration)
-- **Nuxt** - Vue.js framework (SSR, streaming)
-- **SvelteKit** - Svelte framework (SSR, islands)
-- **Qwik** - Resumability-focused framework
-- **Astro** - Static site generator with islands
-
-Each should require only:
-- Fixture creation (~1 hour)
-- Trait implementation (~50 lines)
-- Registry addition (~1 line)
-
-## Dependencies
-
-**New Workspace Dependencies:**
-- `testcontainers = "0.25"` - Docker container orchestration
-- `scraper = "0.21"` - HTML parsing for assertions
-- `tempfile = "3.0"` - Temporary config files
-
-**Existing Dependencies (reused):**
-- `reqwest` - HTTP client
-- `toml` - Config parsing
-- `serde` - Serialization
-- `error-stack` - Error handling
-
-## Risks and Mitigations
-
-| Risk | Impact | Mitigation |
-|------|--------|------------|
-| Docker not available in CI | High | ubuntu-latest has Docker pre-installed, verify early |
-| Port 7676 conflicts | Medium | Add port availability check with retry logic |
-| Slow container startup | Medium | Health check polling with 30s timeout, fail fast |
-| WASM binary not built | High | Explicit build step in CI before tests, clear error message |
-| Framework-specific bugs | Low | Trait abstraction isolates issues to specific impl |
-| Flaky tests | High | Proper health checks, deterministic scenarios, retry logic |
-
-## Files to Modify
-
-- `Cargo.toml` (workspace root) - Add `integration-tests` to members
-- `.github/workflows/test.yml` - Add integration test job with WASM build and container image builds (or create new `integration-tests.yml`)
-- `crates/fastly/src/main.rs` - Add `/health` endpoint for Viceroy readiness checks
-
-## Files to Create (Total: 21 files)
-
-### Core Infrastructure (7 files)
-- `crates/integration-tests/Cargo.toml`
-- `crates/integration-tests/README.md`
-- `crates/integration-tests/tests/common/mod.rs`
-- `crates/integration-tests/tests/common/runtime.rs` (RuntimeEnvironment trait)
-- `crates/integration-tests/tests/common/config.rs`
-- `crates/integration-tests/tests/common/assertions.rs`
-- `crates/fastly/src/main.rs` (MODIFY - add `/health` endpoint)
-
-### Environment Abstraction (2 files)
-- `crates/integration-tests/tests/environments/mod.rs` (RuntimeEnvironment registry)
-- `crates/integration-tests/tests/environments/fastly.rs` (FastlyViceroy implementation)
-
-### Framework System (4 files)
-- `crates/integration-tests/tests/frameworks/mod.rs`
-- `crates/integration-tests/tests/frameworks/scenarios.rs`
-- `crates/integration-tests/tests/frameworks/wordpress.rs`
-- `crates/integration-tests/tests/frameworks/nextjs.rs`
-
-### Test Runner (1 file)
-- `crates/integration-tests/tests/integration.rs` (Matrix test runner)
-
-### Fixtures (7 files)
-- `crates/integration-tests/fixtures/configs/fastly-template.toml`
-- `crates/integration-tests/fixtures/frameworks/wordpress/Dockerfile`
-- `crates/integration-tests/fixtures/frameworks/wordpress/theme.zip`
-- `crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile`
-- `crates/integration-tests/fixtures/frameworks/nextjs/package.json`
-- `crates/integration-tests/fixtures/frameworks/nextjs/next.config.mjs`
-- `crates/integration-tests/fixtures/frameworks/nextjs/app/page.tsx`
-
-## Troubleshooting Guide
-
-### Common Issues
-
-**1. "WASM binary not found"**
-```bash
-# Solution: Build the WASM binary first
-cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
-
-# Or set WASM_BINARY_PATH environment variable
-export WASM_BINARY_PATH=/path/to/trusted-server-fastly.wasm
-```
-
-**2. "Container image not found: test-nextjs:latest"**
-```bash
-# Solution: Pre-build the Docker image
-docker build -t test-nextjs:latest \
-  crates/integration-tests/fixtures/frameworks/nextjs/
-```
-
-**3. "Viceroy not ready after 30s"**
-- Check if port 7676 is already in use: `lsof -i :7676`
-- Verify WASM binary runs: `viceroy run -C fastly.toml -- path/to/binary.wasm`
-- Check Viceroy logs for errors
-- Ensure `/health` endpoint exists or fallback works
-
-**4. "Address already in use (port 7676)"**
-- Kill existing Viceroy process: `pkill viceroy`
-- Run tests sequentially (not in parallel)
-- Future: Use dynamic port allocation
-
-**5. "Container startup timeout"**
-- Increase timeout in `test_framework()` function
-- Check Docker daemon is running: `docker ps`
-- Verify container image builds correctly: `docker run -it test-nextjs:latest`
-
-**6. "Config parse error: missing [integrations.config]"**
-- Verify `fixtures/base-config.toml` has correct structure
-- Ensure template includes all required sections
-
-**7. "Script tag not found in HTML"**
-- Verify origin container is serving HTML correctly
-- Check Viceroy proxy configuration
-- Inspect response with `--nocapture` flag: `cargo test -- --nocapture`
-
-### Debug Mode
-
-Run tests with full logging:
-```bash
-RUST_LOG=debug cargo test -p integration-tests -- --nocapture
-```
-
-Inspect container logs:
-```bash
-docker logs <container-id>
-```
-
-Attach to running Viceroy:
-```bash
-# In test, add: std::thread::sleep(Duration::from_secs(300));
-# Then: curl http://127.0.0.1:7676/health
-```
-
-## Implementation Notes & Best Practices
-
-### Critical Fixes Applied
-
-1. **Trait Object Safety**: Uses function registry (`&[FrameworkFactory]`) instead of `&[&dyn Trait]` to avoid static initialization issues with trait objects returning non-`Sized` types.
-
-2. **Complete Error Types**: `TestError` enum defined with all variants needed for proper error handling and context propagation.
-
-3. **Health Check Strategy**: Viceroy readiness check tries `/health` endpoint first, falls back to root path. Production should implement `/health` endpoint in WASM binary.
-
-4. **Safe TOML Mutation**: Config generation uses safe table lookups with proper error handling instead of direct indexing that could panic.
-
-5. **Container Image Management**: Documents pre-build strategy for custom Docker images (Next.js, Leptos) to avoid "image not found" errors.
-
-6. **WASM Binary Path**: Uses environment variable `WASM_BINARY_PATH` with fallback to relative path for flexibility across environments.
-
-### Error Context Strategy
-
-All fallible operations include:
-- `.change_context()` for error type conversion
-- `.attach_printable()` for diagnostic context (framework ID, scenario name, etc.)
-- This enables precise debugging when tests fail
-
-### Test Isolation
-
-**Current approach**: Tests share port 7676 (Viceroy default)
-- Sequential execution required: use `#[serial]` attribute or single-threaded test runner
-- Future enhancement: Dynamic port allocation per test
-
-### Container Lifecycle
-
-- Containers start with 60s timeout to prevent indefinite hangs
-- Health checks poll for 3 seconds before giving up
-- `Drop` implementations ensure cleanup even on panic
-- Verify cleanup in CI logs (no orphaned containers)
-
-## Timeline Estimate (Fastly-Only Initial Implementation)
-
-- **Phase 0** (Health endpoint): 1-2 hours (BLOCKER)
-- **Phase 1** (Core Infrastructure): 4-6 hours (RuntimeEnvironment trait for future extensibility)
-- **Phase 1.5** (Fastly Runtime): 2-3 hours
-- **Phase 2** (Framework Abstraction): 2-3 hours
-- **Phase 3** (WordPress): 5-7 hours
-- **Phase 4** (Next.js): 3-4 hours
-- **Phase 5** (Docs + CI): 3-4 hours
-
-**Total**: 20-29 hours for complete implementation with 2 frameworks × 1 runtime
-
-**Future frameworks**: 1-2 hours each (automatically tested on Fastly, and future runtimes when added)
-**Future runtimes**: 2-3 hours each (automatically tests all existing frameworks)
-
-## Future Enhancements
-
-### Platform Support: Cloudflare Workers (2-3 hours)
-
-When ready to add Cloudflare Workers support:
-
-**Step 1**: Create Cloudflare runtime implementation
-```rust
-// tests/environments/cloudflare.rs
-use super::*;
-use std::process::{Child, Command};
-
-pub struct CloudflareWrangler;
-
-impl RuntimeEnvironment for CloudflareWrangler {
-    fn id(&self) -> &'static str { "cloudflare" }
-
-    fn spawn(&self, config: &RuntimeConfig) -> Result<RuntimeProcess, TestError> {
-        let port = find_available_port()?;
-
-        let mut child = Command::new("wrangler")
-            .arg("dev")
-            .arg(&config.wasm_path)
-            .arg("--port")
-            .arg(port.to_string())
-            .arg("--local")
-            .env("WASM_BINARY_PATH", &config.wasm_path)
-            .spawn()
-            .change_context(TestError::RuntimeSpawn)?;
-
-        let base_url = format!("http://127.0.0.1:{}", port);
-        wait_for_ready(&base_url, self.health_check_path())?;
-
-        Ok(RuntimeProcess {
-            inner: Box::new(WranglerHandle { child }),
-            base_url,
-        })
-    }
-
-    fn config_template(&self) -> &str {
-        include_str!("../../fixtures/configs/cloudflare-template.toml")
-    }
-
-    fn health_check_path(&self) -> &str {
-        "/"  // Cloudflare may use different path
-    }
-}
-
-struct WranglerHandle {
-    child: Child,
-}
-
-impl RuntimeProcessHandle for WranglerHandle {
-    fn kill(&mut self) -> Result<(), TestError> {
-        self.child.kill().change_context(TestError::RuntimeKill)?;
-        Ok(())
-    }
-
-    fn wait(&mut self) -> Result<(), TestError> {
-        self.child.wait().change_context(TestError::RuntimeWait)?;
-        Ok(())
-    }
-}
-```
-
-**Step 2**: Create config template
-```toml
-# fixtures/configs/cloudflare-template.toml
-name = "trusted-server-test"
-main = "{{WASM_PATH}}"
-compatibility_date = "2024-01-01"
-
-[vars]
-PUBLISHER_ORIGIN_URL = "{{ORIGIN_URL}}"
-```
-
-**Step 3**: Register in runtime registry
-```rust
-// tests/environments/mod.rs
-mod cloudflare;
-
-pub static RUNTIME_ENVIRONMENTS: &[RuntimeFactory] = &[
-    || Box::new(fastly::FastlyViceroy),
-    || Box::new(cloudflare::CloudflareWrangler),  // <- Add here
-];
-```
-
-**Step 4**: Add test combinations
-```rust
-// tests/integration.rs
-#[test]
-fn test_wordpress_cloudflare() {
-    let runtime = environments::cloudflare::CloudflareWrangler;
-    let framework = frameworks::wordpress::WordPress;
-    test_combination(&runtime, &framework)
-        .expect("WordPress on Cloudflare should work");
-}
-
-#[test]
-fn test_nextjs_cloudflare() {
-    let runtime = environments::cloudflare::CloudflareWrangler;
-    let framework = frameworks::nextjs::NextJs;
-    test_combination(&runtime, &framework)
-        .expect("Next.js on Cloudflare should work");
-}
-```
-
-**Done!** All existing frameworks (WordPress, Next.js) now automatically test against both Fastly AND Cloudflare.
-
-**Benefits**:
-- Validate migration from Fastly → Cloudflare before production
-- Catch platform-specific bugs early
-- Compare performance across platforms
-- Zero changes to framework implementations
-
----
-
-### Phase 6: Advanced Features (Post-MVP)
-
-**1. Dynamic Port Allocation**
-- Eliminate shared port 7676 constraint
-- Enable parallel test execution
-- Use `TcpListener::bind("127.0.0.1:0")` to find available ports
-- Pass port to Viceroy via command-line argument (if supported)
-
-**2. Test Isolation with `serial_test` Crate**
-```rust
-use serial_test::serial;
-
-#[test]
-#[serial]
-fn test_wordpress_only() { ... }
-```
-
-**3. Stress Testing**
-```rust
-#[test]
-#[ignore]  // Run with --ignored flag
-fn test_frameworks_stress() {
-    for _ in 0..10 {
-        test_all_frameworks();
-    }
-}
-```
-
-**4. Cleanup Verification Tests**
-```rust
-#[test]
-fn verify_no_orphaned_containers() {
-    let before = count_docker_containers();
-    test_all_frameworks();
-    let after = count_docker_containers();
-    assert_eq!(before, after, "containers not cleaned up");
-}
-```
-
-**5. Multi-Container Orchestration**
-- Use docker-compose for complex setups (e.g., WordPress + MySQL)
-- Support testing against databases, message queues, etc.
-
-**6. Framework Discovery via `inventory` Crate**
-```rust
-use inventory;
-
-inventory::collect!(FrameworkRegistration);
-
-// Frameworks self-register, no manual registry updates needed
-```
-
-**7. Scenario Builder Pattern**
-```rust
-ScriptServingScenario::builder()
-    .modules(vec!["core", "prebid"])
-    .expect_globals(vec!["window.tsjs"])
-    .build()
-```
-
-**8. Performance Benchmarking**
-- Track test execution time per framework
-- Alert on regressions (e.g., >20% slower)
-- CI job outputs performance metrics
-
-**9. Matrix Testing in CI**
-```yaml
-strategy:
-  matrix:
-    framework: [wordpress, nextjs, leptos]
-steps:
-  - run: cargo test -p integration-tests -- ${{ matrix.framework }}
-```
-
-**10. Remote Debugging Support**
-- Keep Viceroy running after test failure
-- Expose debug endpoint for manual inspection
-- Capture network traffic for analysis
diff --git a/crates/fastly/src/main.rs b/crates/fastly/src/main.rs
index 1602a04c..17b7e987 100644
--- a/crates/fastly/src/main.rs
+++ b/crates/fastly/src/main.rs
@@ -182,7 +182,7 @@ fn init_logger() {
         .echo_stdout(true)
         .max_level(log::LevelFilter::Debug)
         .build()
-        .expect("Failed to build Logger");
+        .expect("should build Logger");
 
     fern::Dispatch::new()
         .format(|out, message, record| {
@@ -200,5 +200,5 @@ fn init_logger() {
         })
         .chain(Box::new(logger) as Box<dyn log::Log>)
         .apply()
-        .expect("Failed to initialize logger");
+        .expect("should initialize logger");
 }
diff --git a/crates/integration-tests/Cargo.lock b/crates/integration-tests/Cargo.lock
index 26bcdf0d..ac3a2460 100644
--- a/crates/integration-tests/Cargo.lock
+++ b/crates/integration-tests/Cargo.lock
@@ -33,6 +33,56 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "anstream"
+version = "0.6.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43d5b281e737544384e969a5ccad3f1cdd24b48086a0fc1b2a5262a26b8f4f4a"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "anyhow"
 version = "1.0.102"
@@ -284,6 +334,21 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "colorchoice"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+
+[[package]]
+name = "convert_case"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "633458d4ef8c78b72454de2d54fd6ab2e60f9e02be22f3c6104cdc8a4e0fceb9"
+dependencies = [
+ "unicode-segmentation",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
@@ -391,21 +456,23 @@ dependencies = [
 
 [[package]]
 name = "derive_more"
-version = "1.0.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a9b99b9cbbe49445b21764dc0625032a89b145a2642e67603e1c936f5458d05"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
 dependencies = [
  "derive_more-impl",
 ]
 
 [[package]]
 name = "derive_more-impl"
-version = "1.0.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb7330aeadfbe296029522e6c40f315320aba36fc43a5b3632f3795348f3bd22"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
 dependencies = [
+ "convert_case",
  "proc-macro2",
  "quote",
+ "rustc_version",
  "syn",
  "unicode-xid",
 ]
@@ -474,6 +541,29 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "env_filter"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a1c3cc8e57274ec99de65301228b537f1e4eedc1b8e0f9411c6caac8ae7308f"
+dependencies = [
+ "log",
+ "regex",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2daee4ea451f429a58296525ddf28b45a3b64f1acf6587e2067437bb11e218d"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "env_filter",
+ "jiff",
+ "log",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -492,9 +582,9 @@ dependencies = [
 
 [[package]]
 name = "error-stack"
-version = "0.5.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe413319145d1063f080f27556fd30b1d70b01e2ba10c2a6e40d4be982ffc5d1"
+checksum = "b878b3fac9613c3c7f22eb70bc8a3c6ebdc03cc11479ee60fde1692d747fd45f"
 dependencies = [
  "anyhow",
  "rustc_version",
@@ -1128,7 +1218,8 @@ dependencies = [
 name = "integration-tests"
 version = "0.1.0"
 dependencies = [
- "derive_more 1.0.0",
+ "derive_more 2.1.1",
+ "env_logger",
  "error-stack",
  "log",
  "reqwest",
@@ -1153,6 +1244,12 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
 [[package]]
 name = "itertools"
 version = "0.14.0"
@@ -1168,6 +1265,30 @@ version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
 
+[[package]]
+name = "jiff"
+version = "0.2.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a3546dc96b6d42c5f24902af9e2538e82e39ad350b0c766eb3fbf2d8f3d8359"
+dependencies = [
+ "jiff-static",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a8c8b344124222efd714b73bb41f8b5120b27a7cc1c75593a6ff768d9d05aa4"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "js-sys"
 version = "0.3.91"
@@ -1397,6 +1518,12 @@ version = "1.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
 
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
 [[package]]
 name = "openssl"
 version = "0.10.75"
@@ -1597,6 +1724,15 @@ version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
 
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a9db96d7fa8782dd8c15ce32ffe8680bbd1e978a43bf51a34d39483540495f5"
+dependencies = [
+ "portable-atomic",
+]
+
 [[package]]
 name = "potential_utf"
 version = "0.1.4"
@@ -2649,6 +2785,12 @@ version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
+[[package]]
+name = "unicode-segmentation"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+
 [[package]]
 name = "unicode-width"
 version = "0.2.2"
@@ -2719,6 +2861,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
 [[package]]
 name = "vcpkg"
 version = "0.2.15"
diff --git a/crates/integration-tests/Cargo.toml b/crates/integration-tests/Cargo.toml
index 508da391..d0f8369d 100644
--- a/crates/integration-tests/Cargo.toml
+++ b/crates/integration-tests/Cargo.toml
@@ -15,5 +15,6 @@ reqwest = { version = "0.12", features = ["blocking"] }
 scraper = "0.21"
 log = "0.4"
 serde_json = "1"
-error-stack = "0.5"
-derive_more = { version = "1.0", features = ["display"] }
+error-stack = "0.6"
+derive_more = { version = "2.0", features = ["display"] }
+env_logger = "0.11"
diff --git a/crates/integration-tests/browser/playwright.config.ts b/crates/integration-tests/browser/playwright.config.ts
index 478546cc..1eb232d5 100644
--- a/crates/integration-tests/browser/playwright.config.ts
+++ b/crates/integration-tests/browser/playwright.config.ts
@@ -5,7 +5,7 @@ export default defineConfig({
   globalSetup: "./global-setup.ts",
   globalTeardown: "./global-teardown.ts",
   timeout: 30_000,
-  retries: 0,
+  retries: 1,
   // Sequential execution: all tests share a single origin port (8888)
   workers: 1,
   use: {
diff --git a/crates/integration-tests/browser/tests/nextjs/api-passthrough.spec.ts b/crates/integration-tests/browser/tests/nextjs/api-passthrough.spec.ts
index 65b13449..22299191 100644
--- a/crates/integration-tests/browser/tests/nextjs/api-passthrough.spec.ts
+++ b/crates/integration-tests/browser/tests/nextjs/api-passthrough.spec.ts
@@ -18,12 +18,12 @@ test.describe("Next.js API route passthrough", () => {
     const contentType = resp.headers()["content-type"] || "";
     expect(contentType).toContain("application/json");
 
-    const body = await resp.json();
+    const text = await resp.text();
+    const body = JSON.parse(text);
     expect(body.message).toBe("Hello from the API!");
     expect(body.status).toBe("success");
 
     // JSON must not contain HTML injection
-    const text = await (await request.get("/api/hello")).text();
     expect(text).not.toContain("<script");
     expect(text).not.toContain("/static/tsjs=");
   });
diff --git a/crates/integration-tests/browser/tests/nextjs/form-rewriting.spec.ts b/crates/integration-tests/browser/tests/nextjs/form-rewriting.spec.ts
index 0c0ff012..ac5927e1 100644
--- a/crates/integration-tests/browser/tests/nextjs/form-rewriting.spec.ts
+++ b/crates/integration-tests/browser/tests/nextjs/form-rewriting.spec.ts
@@ -20,8 +20,9 @@ test.describe("Next.js form action rewriting", () => {
     const action = await form.getAttribute("action");
     expect(action).toBeTruthy();
 
-    // Origin host (port 8888) should be rewritten to proxy host
-    expect(action).not.toContain("127.0.0.1:8888");
+    // Origin host should be rewritten to proxy host
+    const originPort = process.env.INTEGRATION_ORIGIN_PORT || "8888";
+    expect(action).not.toContain(`127.0.0.1:${originPort}`);
     // The path should be preserved
     expect(action).toContain("/api/contact");
   });
diff --git a/crates/integration-tests/fixtures/configs/fastly-template.toml b/crates/integration-tests/fixtures/configs/fastly-template.toml
deleted file mode 100644
index 9e377a74..00000000
--- a/crates/integration-tests/fixtures/configs/fastly-template.toml
+++ /dev/null
@@ -1,97 +0,0 @@
-# Fastly Compute configuration template for integration tests.
-# The test harness mutates `publisher.origin_url` and integration toggles
-# at runtime via RuntimeConfigBuilder.
-
-[[handlers]]
-path = "^/secure"
-username = "user"
-password = "pass"
-
-[publisher]
-domain = "test-publisher.com"
-cookie_domain = ".test-publisher.com"
-origin_url = "PLACEHOLDER"
-proxy_secret = "integration-test-proxy-secret"
-
-[synthetic]
-counter_store = "counter_store"
-opid_store = "opid_store"
-secret_key = "integration-test-secret"
-template = "{{ client_ip }}:{{ user_agent }}:{{ accept_language }}:{{ accept_encoding }}"
-
-[request_signing]
-enabled = false
-config_store_id = "unused"
-secret_store_id = "unused"
-
-[integrations.prebid]
-enabled = false
-server_url = "http://127.0.0.1:9999"
-timeout_ms = 1000
-bidders = ["appnexus"]
-debug = false
-
-[integrations.nextjs]
-enabled = false
-rewrite_attributes = ["href", "link", "siteBaseUrl", "siteProductionDomain", "url"]
-max_combined_payload_bytes = 10485760
-
-[integrations.testlight]
-endpoint = "https://testlight.example/openrtb2/auction"
-timeout_ms = 1200
-rewrite_scripts = true
-
-[integrations.didomi]
-enabled = false
-sdk_origin = "https://sdk.privacy-center.org"
-api_origin = "https://api.privacy-center.org"
-
-[integrations.permutive]
-enabled = false
-organization_id = ""
-workspace_id = ""
-project_id = ""
-api_endpoint = "https://api.permutive.com"
-secure_signals_endpoint = "https://secure-signals.permutive.app"
-
-[integrations.lockr]
-enabled = false
-app_id = ""
-api_endpoint = "https://identity.loc.kr"
-sdk_url = "https://aim.loc.kr/identity-lockr-v1.0.js"
-cache_ttl_seconds = 3600
-rewrite_sdk = true
-
-[integrations.datadome]
-enabled = false
-sdk_origin = "https://js.datadome.co"
-api_origin = "https://api-js.datadome.co"
-cache_ttl_seconds = 3600
-rewrite_sdk = true
-
-[integrations.gpt]
-enabled = false
-script_url = "https://securepubads.g.doubleclick.net/tag/js/gpt.js"
-cache_ttl_seconds = 3600
-rewrite_script = true
-
-[auction]
-enabled = false
-providers = ["prebid"]
-timeout_ms = 2000
-allowed_context_keys = []
-
-[integrations.aps]
-enabled = false
-pub_id = "test-aps-publisher-id"
-endpoint = "https://origin-mocktioneer.cdintel.com/e/dtb/bid"
-timeout_ms = 1000
-
-[integrations.google_tag_manager]
-enabled = false
-container_id = "GTM-TEST"
-
-[integrations.adserver_mock]
-enabled = false
-endpoint = "https://origin-mocktioneer.cdintel.com/adserver/mediate"
-timeout_ms = 1000
diff --git a/crates/integration-tests/fixtures/frameworks/wordpress/theme/wp-admin/index.php b/crates/integration-tests/fixtures/frameworks/wordpress/theme/wp-admin/index.php
index 23faf3e0..f619a973 100644
--- a/crates/integration-tests/fixtures/frameworks/wordpress/theme/wp-admin/index.php
+++ b/crates/integration-tests/fixtures/frameworks/wordpress/theme/wp-admin/index.php
@@ -7,7 +7,7 @@
 <body class="wp-admin">
     <div id="wpwrap">
         <h1>Dashboard</h1>
-        <p>WordPress admin area — scripts should NOT be injected here.</p>
+        <p>WordPress admin area — scripts ARE injected here (current behavior — update this if admin exclusion is added).</p>
     </div>
 </body>
 </html>
diff --git a/crates/integration-tests/tests/common/mod.rs b/crates/integration-tests/tests/common/mod.rs
index 86cd5f62..61fb404e 100644
--- a/crates/integration-tests/tests/common/mod.rs
+++ b/crates/integration-tests/tests/common/mod.rs
@@ -1,5 +1,2 @@
 pub mod assertions;
 pub mod runtime;
-
-pub use assertions::*;
-pub use runtime::*;
diff --git a/crates/integration-tests/tests/common/runtime.rs b/crates/integration-tests/tests/common/runtime.rs
index 09c742d0..187cfbcf 100644
--- a/crates/integration-tests/tests/common/runtime.rs
+++ b/crates/integration-tests/tests/common/runtime.rs
@@ -36,6 +36,9 @@ pub enum TestError {
     #[display("Script tag not found in HTML")]
     ScriptTagNotFound,
 
+    #[display("Response body did not match expected content")]
+    UnexpectedContent,
+
     #[display("Invalid CSS selector")]
     InvalidSelector,
 
diff --git a/crates/integration-tests/tests/environments/mod.rs b/crates/integration-tests/tests/environments/mod.rs
index 23ccc175..e9194e79 100644
--- a/crates/integration-tests/tests/environments/mod.rs
+++ b/crates/integration-tests/tests/environments/mod.rs
@@ -40,7 +40,7 @@ pub fn find_available_port() -> error_stack::Result<u16, TestError> {
 
 /// Poll a runtime's health endpoint until it responds with success.
 ///
-/// Retries up to 30 times with 100ms delay between attempts (total ~3s).
+/// Retries up to 30 times with 500ms delay between attempts (total ~15s).
 /// Falls back to checking the root path if the health endpoint is not available.
 ///
 /// # Errors
@@ -63,7 +63,7 @@ pub fn wait_for_ready(base_url: &str, health_path: &str) -> error_stack::Result<
             return Ok(());
         }
 
-        std::thread::sleep(std::time::Duration::from_millis(100));
+        std::thread::sleep(std::time::Duration::from_millis(500));
     }
 
     Err(error_stack::report!(TestError::RuntimeNotReady))
diff --git a/crates/integration-tests/tests/frameworks/scenarios.rs b/crates/integration-tests/tests/frameworks/scenarios.rs
index 89a0ade4..870fc93c 100644
--- a/crates/integration-tests/tests/frameworks/scenarios.rs
+++ b/crates/integration-tests/tests/frameworks/scenarios.rs
@@ -289,11 +289,16 @@ impl CustomScenario {
                     404 | 405 => {}
                     200 => {
                         // Soft 404: verify the body is a Next.js not-found page
-                        assert!(
-                            body.contains("404") || body.contains("not found")
-                                || body.contains("Not Found"),
-                            "should contain 404 indicator in soft-404 response body"
-                        );
+                        if !body.contains("404")
+                            && !body.contains("not found")
+                            && !body.contains("Not Found")
+                        {
+                            return Err(error_stack::report!(TestError::UnexpectedContent)
+                                .attach_printable(format!(
+                                    "Soft-404 body should contain a 404 indicator; \
+                                     framework: {framework_id}, body: {body}"
+                                )));
+                        }
                     }
                     _ => {
                         return Err(
diff --git a/crates/integration-tests/tests/integration.rs b/crates/integration-tests/tests/integration.rs
index 36b5be1c..cf66a103 100644
--- a/crates/integration-tests/tests/integration.rs
+++ b/crates/integration-tests/tests/integration.rs
@@ -14,6 +14,14 @@ use frameworks::{FRAMEWORKS, FrontendFramework};
 use std::time::Duration;
 use testcontainers::runners::SyncRunner as _;
 
+/// Initialize the logger once for the test binary.
+///
+/// Called at the start of each test function. `try_init` is used so that
+/// repeated calls (one per test) are harmless — only the first succeeds.
+fn init_logger() {
+    let _ = env_logger::try_init();
+}
+
 /// Test all combinations: frameworks x runtimes (matrix testing).
 ///
 /// Iterates every registered runtime and framework, running all standard
@@ -22,6 +30,7 @@ use testcontainers::runners::SyncRunner as _;
 #[test]
 #[ignore = "requires Docker, Viceroy, and pre-built WASM binary"]
 fn test_all_combinations() {
+    init_logger();
     for runtime_factory in RUNTIME_ENVIRONMENTS {
         let runtime = runtime_factory();
         log::info!("Testing runtime: {}", runtime.id());
@@ -54,6 +63,7 @@ fn test_combination(
     runtime: &dyn common::runtime::RuntimeEnvironment,
     framework: &dyn FrontendFramework,
 ) -> error_stack::Result<(), TestError> {
+    init_logger();
     let runtime_id = runtime.id();
     let framework_id = framework.id();
     let port = origin_port();
@@ -103,7 +113,19 @@ fn test_combination(
     Ok(())
 }
 
-/// Wait for a container's health check endpoint to respond.
+/// Wait for a Docker container's health endpoint to respond successfully.
+///
+/// Retries up to 60 times with 500ms delay (total ~30s). Uses a longer
+/// budget than `wait_for_ready` because container cold-starts
+/// include image pull, filesystem setup, and application init time.
+///
+/// Unlike `wait_for_ready`, this function does not fall back to the root path —
+/// containers are expected to expose a reliable health endpoint.
+///
+/// # Errors
+///
+/// Returns [`TestError::ContainerTimeout`] if the health endpoint does not
+/// respond with a success status within the timeout.
 fn wait_for_container(base_url: &str, health_path: &str) -> error_stack::Result<(), TestError> {
     let url = format!("{base_url}{health_path}");
 

From 4dc2d3cd5361c63e1e3647c0d7f970bd600c1465 Mon Sep 17 00:00:00 2001
From: prk-Jr <prakashsagwara@gmail.com>
Date: Mon, 9 Mar 2026 15:47:33 +0530
Subject: [PATCH 14/15] Update integration tests for latest error-stack API

---
 .../tests/common/assertions.rs                | 121 ++++++++-------
 .../integration-tests/tests/common/runtime.rs |  11 +-
 .../tests/environments/fastly.rs              |  16 +-
 .../tests/environments/mod.rs                 |  13 +-
 .../integration-tests/tests/frameworks/mod.rs |   7 +-
 .../tests/frameworks/nextjs.rs                |   7 +-
 .../tests/frameworks/scenarios.rs             | 145 ++++++++----------
 .../tests/frameworks/wordpress.rs             |   7 +-
 crates/integration-tests/tests/integration.rs |  20 +--
 9 files changed, 170 insertions(+), 177 deletions(-)

diff --git a/crates/integration-tests/tests/common/assertions.rs b/crates/integration-tests/tests/common/assertions.rs
index f9a52ba3..b462cb6e 100644
--- a/crates/integration-tests/tests/common/assertions.rs
+++ b/crates/integration-tests/tests/common/assertions.rs
@@ -1,10 +1,10 @@
-use super::runtime::TestError;
-use error_stack::Result;
+use super::runtime::{TestError, TestResult};
+use error_stack::Report;
 use scraper::{Html, Selector};
 
 /// Parse a CSS selector, mapping the error to [`TestError::InvalidSelector`]
-fn parse_selector(selector: &str) -> Result<Selector, TestError> {
-    Selector::parse(selector).map_err(|_| error_stack::report!(TestError::InvalidSelector))
+fn parse_selector(selector: &str) -> TestResult<Selector> {
+    Selector::parse(selector).map_err(|_| Report::new(TestError::InvalidSelector))
 }
 
 /// Assert that HTML contains the trustedserver-js script tag.
@@ -15,7 +15,7 @@ fn parse_selector(selector: &str) -> Result<Selector, TestError> {
 /// # Errors
 ///
 /// Returns [`TestError::ScriptTagNotFound`] if no matching script tag exists.
-pub fn assert_script_tag_present(html: &str) -> Result<(), TestError> {
+pub fn assert_script_tag_present(html: &str) -> TestResult<()> {
     let document = Html::parse_document(html);
     let selector = parse_selector("script[src*='/static/tsjs=']")?;
 
@@ -23,7 +23,7 @@ pub fn assert_script_tag_present(html: &str) -> Result<(), TestError> {
         return Ok(());
     }
 
-    Err(error_stack::report!(TestError::ScriptTagNotFound))
+    Err(Report::new(TestError::ScriptTagNotFound))
 }
 
 /// Assert that exactly one `<script id="trustedserver-js">` exists in the HTML.
@@ -36,21 +36,21 @@ pub fn assert_script_tag_present(html: &str) -> Result<(), TestError> {
 ///
 /// Returns [`TestError::ScriptTagNotFound`] if zero or more than one matching
 /// script tag is found.
-pub fn assert_unique_script_tag(html: &str) -> Result<(), TestError> {
+pub fn assert_unique_script_tag(html: &str) -> TestResult<()> {
     let document = Html::parse_document(html);
     let selector = parse_selector("script#trustedserver-js[src*='/static/tsjs=']")?;
 
     let count = document.select(&selector).count();
 
     if count == 0 {
-        return Err(error_stack::report!(TestError::ScriptTagNotFound)
-            .attach_printable("No script#trustedserver-js[src*='/static/tsjs='] found"));
+        return Err(Report::new(TestError::ScriptTagNotFound)
+            .attach("No script#trustedserver-js[src*='/static/tsjs='] found"));
     }
 
     if count > 1 {
-        return Err(error_stack::report!(TestError::ScriptTagNotFound).attach_printable(
-            format!("Expected exactly 1 script#trustedserver-js, found {count}"),
-        ));
+        return Err(Report::new(TestError::ScriptTagNotFound).attach(format!(
+            "Expected exactly 1 script#trustedserver-js, found {count}"
+        )));
     }
 
     Ok(())
@@ -70,7 +70,7 @@ pub fn assert_attributes_rewritten(
     html: &str,
     origin_host: &str,
     proxy_base_url: &str,
-) -> Result<(), TestError> {
+) -> TestResult<()> {
     let document = Html::parse_document(html);
 
     // Extract proxy host from base_url (e.g. "http://127.0.0.1:12345" -> "127.0.0.1:12345")
@@ -88,10 +88,8 @@ pub fn assert_attributes_rewritten(
             if let Some(value) = element.value().attr(attr) {
                 // Origin host should NOT appear in any attribute
                 if value.contains(origin_host) {
-                    return Err(error_stack::report!(TestError::AttributeNotRewritten)
-                        .attach_printable(format!(
-                            "Origin host still present in {attr}=\"{value}\""
-                        )));
+                    return Err(Report::new(TestError::AttributeNotRewritten)
+                        .attach(format!("Origin host still present in {attr}=\"{value}\"")));
                 }
 
                 // Track whether we find at least one rewritten proxy URL
@@ -103,11 +101,12 @@ pub fn assert_attributes_rewritten(
     }
 
     if !found_proxy_url {
-        return Err(error_stack::report!(TestError::AttributeNotRewritten)
-            .attach_printable(format!(
+        return Err(
+            Report::new(TestError::AttributeNotRewritten).attach(format!(
                 "No attributes rewritten to proxy host ({proxy_host}). \
                  Check that the origin HTML contains absolute URLs with {origin_host}"
-            )));
+            )),
+        );
     }
 
     Ok(())
@@ -127,7 +126,7 @@ pub fn assert_ad_slot_urls_rewritten(
     html: &str,
     origin_host: &str,
     proxy_base_url: &str,
-) -> Result<(), TestError> {
+) -> TestResult<()> {
     let document = Html::parse_document(html);
 
     let proxy_host = proxy_base_url
@@ -143,10 +142,11 @@ pub fn assert_ad_slot_urls_rewritten(
         for attr in ["href", "src"] {
             if let Some(value) = element.value().attr(attr) {
                 if value.contains(origin_host) {
-                    return Err(error_stack::report!(TestError::AttributeNotRewritten)
-                        .attach_printable(format!(
+                    return Err(
+                        Report::new(TestError::AttributeNotRewritten).attach(format!(
                             "Origin host still present inside ad slot: {attr}=\"{value}\""
-                        )));
+                        )),
+                    );
                 }
                 if value.contains(proxy_host) {
                     found_proxy_url = true;
@@ -156,12 +156,12 @@ pub fn assert_ad_slot_urls_rewritten(
     }
 
     if !found_proxy_url {
-        return Err(error_stack::report!(TestError::AttributeNotRewritten).attach_printable(
-            format!(
+        return Err(
+            Report::new(TestError::AttributeNotRewritten).attach(format!(
                 "No URL attributes inside ad slots rewritten to proxy host ({proxy_host}). \
                  Ensure ad-slot fixtures contain href/src with origin host"
-            ),
-        ));
+            )),
+        );
     }
 
     Ok(())
@@ -182,7 +182,7 @@ pub fn assert_ad_slot_urls_rewritten(
 ///
 /// Returns [`TestError::AttributeNotRewritten`] if any expected `data-ad-unit`
 /// value is missing from the proxied HTML.
-pub fn assert_data_ad_units_preserved(html: &str, expected_units: &[&str]) -> Result<(), TestError> {
+pub fn assert_data_ad_units_preserved(html: &str, expected_units: &[&str]) -> TestResult<()> {
     let document = Html::parse_document(html);
     let selector = parse_selector("[data-ad-unit]")?;
 
@@ -193,11 +193,12 @@ pub fn assert_data_ad_units_preserved(html: &str, expected_units: &[&str]) -> Re
 
     for expected in expected_units {
         if !found_units.iter().any(|u| u == expected) {
-            return Err(error_stack::report!(TestError::AttributeNotRewritten)
-                .attach_printable(format!(
+            return Err(
+                Report::new(TestError::AttributeNotRewritten).attach(format!(
                     "data-ad-unit=\"{expected}\" not found in proxied HTML. \
                      Found units: {found_units:?}"
-                )));
+                )),
+            );
         }
     }
 
@@ -218,7 +219,7 @@ pub fn assert_form_action_rewritten(
     form_selector: &str,
     origin_host: &str,
     proxy_base_url: &str,
-) -> Result<(), TestError> {
+) -> TestResult<()> {
     let document = Html::parse_document(html);
     let selector = parse_selector(form_selector)?;
 
@@ -228,27 +229,29 @@ pub fn assert_form_action_rewritten(
         .unwrap_or(proxy_base_url);
 
     let form = document.select(&selector).next().ok_or_else(|| {
-        error_stack::report!(TestError::AttributeNotRewritten)
-            .attach_printable(format!("No form matching '{form_selector}' found in HTML"))
+        Report::new(TestError::AttributeNotRewritten)
+            .attach(format!("No form matching '{form_selector}' found in HTML"))
     })?;
 
     let action = form.value().attr("action").ok_or_else(|| {
-        error_stack::report!(TestError::AttributeNotRewritten)
-            .attach_printable(format!("Form '{form_selector}' has no action attribute"))
+        Report::new(TestError::AttributeNotRewritten)
+            .attach(format!("Form '{form_selector}' has no action attribute"))
     })?;
 
     if action.contains(origin_host) {
-        return Err(error_stack::report!(TestError::AttributeNotRewritten).attach_printable(
-            format!("Form action still contains origin host: action=\"{action}\""),
-        ));
+        return Err(
+            Report::new(TestError::AttributeNotRewritten).attach(format!(
+                "Form action still contains origin host: action=\"{action}\""
+            )),
+        );
     }
 
     if !action.contains(proxy_host) {
-        return Err(error_stack::report!(TestError::AttributeNotRewritten).attach_printable(
-            format!(
+        return Err(
+            Report::new(TestError::AttributeNotRewritten).attach(format!(
                 "Form action not rewritten to proxy host ({proxy_host}): action=\"{action}\""
-            ),
-        ));
+            )),
+        );
     }
 
     Ok(())
@@ -370,8 +373,7 @@ mod tests {
             </html>
         "#;
 
-        let result =
-            assert_ad_slot_urls_rewritten(html, "127.0.0.1:8888", "http://127.0.0.1:9999");
+        let result = assert_ad_slot_urls_rewritten(html, "127.0.0.1:8888", "http://127.0.0.1:9999");
         assert!(
             result.is_err(),
             "should fail when origin host remains inside ad slot"
@@ -391,8 +393,7 @@ mod tests {
             </html>
         "#;
 
-        let result =
-            assert_ad_slot_urls_rewritten(html, "127.0.0.1:8888", "http://127.0.0.1:9999");
+        let result = assert_ad_slot_urls_rewritten(html, "127.0.0.1:8888", "http://127.0.0.1:9999");
         assert!(
             result.is_err(),
             "should fail when no URL attributes exist inside ad slots"
@@ -422,7 +423,10 @@ mod tests {
         "#;
 
         let result = assert_unique_script_tag(html);
-        assert!(result.is_err(), "should fail when no trustedserver-js exists");
+        assert!(
+            result.is_err(),
+            "should fail when no trustedserver-js exists"
+        );
     }
 
     #[test]
@@ -439,7 +443,10 @@ mod tests {
         "#;
 
         let result = assert_unique_script_tag(html);
-        assert!(result.is_err(), "should fail when multiple trustedserver-js exist");
+        assert!(
+            result.is_err(),
+            "should fail when multiple trustedserver-js exist"
+        );
     }
 
     #[test]
@@ -486,7 +493,10 @@ mod tests {
         "#;
 
         let result = assert_data_ad_units_preserved(html, &["/test/banner", "/test/sidebar"]);
-        assert!(result.is_err(), "should fail when expected ad unit is missing");
+        assert!(
+            result.is_err(),
+            "should fail when expected ad unit is missing"
+        );
     }
 
     #[test]
@@ -502,8 +512,13 @@ mod tests {
             </html>
         "#;
 
-        assert_form_action_rewritten(html, "form#contact-form", "127.0.0.1:8888", "http://127.0.0.1:9999")
-            .expect("should detect rewritten form action");
+        assert_form_action_rewritten(
+            html,
+            "form#contact-form",
+            "127.0.0.1:8888",
+            "http://127.0.0.1:9999",
+        )
+        .expect("should detect rewritten form action");
     }
 
     #[test]
diff --git a/crates/integration-tests/tests/common/runtime.rs b/crates/integration-tests/tests/common/runtime.rs
index 187cfbcf..c7ae0e22 100644
--- a/crates/integration-tests/tests/common/runtime.rs
+++ b/crates/integration-tests/tests/common/runtime.rs
@@ -1,4 +1,4 @@
-use error_stack::Result;
+use error_stack::Report;
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
 
@@ -52,6 +52,9 @@ pub enum TestError {
 
 impl core::error::Error for TestError {}
 
+/// Result type used across integration tests.
+pub type TestResult<T> = core::result::Result<T, Report<TestError>>;
+
 /// Platform-agnostic process handle
 pub struct RuntimeProcess {
     pub inner: Box<dyn RuntimeProcessHandle>,
@@ -60,8 +63,8 @@ pub struct RuntimeProcess {
 
 /// Trait for runtime process lifecycle management
 pub trait RuntimeProcessHandle: Send + Sync {
-    fn kill(&mut self) -> Result<(), TestError>;
-    fn wait(&mut self) -> Result<(), TestError>;
+    fn kill(&mut self) -> TestResult<()>;
+    fn wait(&mut self) -> TestResult<()>;
 }
 
 /// Trait defining how to run the trusted-server on different platforms.
@@ -80,7 +83,7 @@ pub trait RuntimeEnvironment: Send + Sync {
     ///
     /// Returns [`TestError::RuntimeSpawn`] if the process cannot be started.
     /// Returns [`TestError::RuntimeNotReady`] if the health check times out.
-    fn spawn(&self, wasm_path: &Path) -> Result<RuntimeProcess, TestError>;
+    fn spawn(&self, wasm_path: &Path) -> TestResult<RuntimeProcess>;
 
     /// Health check endpoint (may differ by platform)
     fn health_check_path(&self) -> &str {
diff --git a/crates/integration-tests/tests/environments/fastly.rs b/crates/integration-tests/tests/environments/fastly.rs
index 48aab905..5f055201 100644
--- a/crates/integration-tests/tests/environments/fastly.rs
+++ b/crates/integration-tests/tests/environments/fastly.rs
@@ -1,4 +1,6 @@
-use crate::common::runtime::{RuntimeEnvironment, RuntimeProcess, RuntimeProcessHandle, TestError};
+use crate::common::runtime::{
+    RuntimeEnvironment, RuntimeProcess, RuntimeProcessHandle, TestError, TestResult,
+};
 use error_stack::ResultExt as _;
 use std::path::Path;
 use std::process::{Child, Command};
@@ -16,7 +18,7 @@ impl RuntimeEnvironment for FastlyViceroy {
         "fastly"
     }
 
-    fn spawn(&self, wasm_path: &Path) -> error_stack::Result<RuntimeProcess, TestError> {
+    fn spawn(&self, wasm_path: &Path) -> TestResult<RuntimeProcess> {
         let port = super::find_available_port()?;
 
         let viceroy_config = self.viceroy_config_path();
@@ -29,7 +31,7 @@ impl RuntimeEnvironment for FastlyViceroy {
             .arg(format!("127.0.0.1:{port}"))
             .spawn()
             .change_context(TestError::RuntimeSpawn)
-            .attach_printable("Failed to spawn viceroy process")?;
+            .attach("Failed to spawn viceroy process")?;
 
         // Wrap immediately so Drop::drop kills the process if readiness check fails
         let handle = ViceroyHandle { child };
@@ -68,19 +70,19 @@ struct ViceroyHandle {
 }
 
 impl RuntimeProcessHandle for ViceroyHandle {
-    fn kill(&mut self) -> error_stack::Result<(), TestError> {
+    fn kill(&mut self) -> TestResult<()> {
         self.child
             .kill()
             .change_context(TestError::RuntimeKill)
-            .attach_printable("Failed to kill viceroy process")?;
+            .attach("Failed to kill viceroy process")?;
         Ok(())
     }
 
-    fn wait(&mut self) -> error_stack::Result<(), TestError> {
+    fn wait(&mut self) -> TestResult<()> {
         self.child
             .wait()
             .change_context(TestError::RuntimeWait)
-            .attach_printable("Failed to wait on viceroy process")?;
+            .attach("Failed to wait on viceroy process")?;
         Ok(())
     }
 }
diff --git a/crates/integration-tests/tests/environments/mod.rs b/crates/integration-tests/tests/environments/mod.rs
index e9194e79..8eeb98a9 100644
--- a/crates/integration-tests/tests/environments/mod.rs
+++ b/crates/integration-tests/tests/environments/mod.rs
@@ -1,6 +1,7 @@
 pub mod fastly;
 
-use crate::common::runtime::{RuntimeEnvironment, TestError};
+use crate::common::runtime::{RuntimeEnvironment, TestError, TestResult};
+use error_stack::Report;
 
 /// Runtime factory function type — avoids trait object static initialization issues.
 type RuntimeFactory = fn() -> Box<dyn RuntimeEnvironment>;
@@ -26,13 +27,13 @@ pub static RUNTIME_ENVIRONMENTS: &[RuntimeFactory] = &[|| Box::new(fastly::Fastl
 /// # Errors
 ///
 /// Returns [`TestError::NoPortAvailable`] if no port can be allocated.
-pub fn find_available_port() -> error_stack::Result<u16, TestError> {
+pub fn find_available_port() -> TestResult<u16> {
     let listener = std::net::TcpListener::bind("127.0.0.1:0")
-        .map_err(|_| error_stack::report!(TestError::NoPortAvailable))?;
+        .map_err(|_| Report::new(TestError::NoPortAvailable))?;
 
     let port = listener
         .local_addr()
-        .map_err(|_| error_stack::report!(TestError::NoPortAvailable))?
+        .map_err(|_| Report::new(TestError::NoPortAvailable))?
         .port();
 
     Ok(port)
@@ -46,7 +47,7 @@ pub fn find_available_port() -> error_stack::Result<u16, TestError> {
 /// # Errors
 ///
 /// Returns [`TestError::RuntimeNotReady`] if the runtime does not respond within timeout.
-pub fn wait_for_ready(base_url: &str, health_path: &str) -> error_stack::Result<(), TestError> {
+pub fn wait_for_ready(base_url: &str, health_path: &str) -> TestResult<()> {
     let health_url = format!("{}{}", base_url, health_path);
 
     for _ in 0..30 {
@@ -66,5 +67,5 @@ pub fn wait_for_ready(base_url: &str, health_path: &str) -> error_stack::Result<
         std::thread::sleep(std::time::Duration::from_millis(500));
     }
 
-    Err(error_stack::report!(TestError::RuntimeNotReady))
+    Err(Report::new(TestError::RuntimeNotReady))
 }
diff --git a/crates/integration-tests/tests/frameworks/mod.rs b/crates/integration-tests/tests/frameworks/mod.rs
index eb829c5d..0d8d86ae 100644
--- a/crates/integration-tests/tests/frameworks/mod.rs
+++ b/crates/integration-tests/tests/frameworks/mod.rs
@@ -2,7 +2,7 @@ pub mod nextjs;
 pub mod scenarios;
 pub mod wordpress;
 
-use crate::common::runtime::TestError;
+use crate::common::runtime::TestResult;
 use scenarios::{CustomScenario, TestScenario};
 use testcontainers::GenericImage;
 use testcontainers::core::ContainerRequest;
@@ -30,10 +30,7 @@ pub trait FrontendFramework: Send + Sync {
     /// # Errors
     ///
     /// Returns [`TestError::ContainerStart`] if the image cannot be created.
-    fn build_container(
-        &self,
-        origin_port: u16,
-    ) -> error_stack::Result<ContainerRequest<GenericImage>, TestError>;
+    fn build_container(&self, origin_port: u16) -> TestResult<ContainerRequest<GenericImage>>;
 
     /// Port the framework serves on inside the container.
     fn container_port(&self) -> u16;
diff --git a/crates/integration-tests/tests/frameworks/nextjs.rs b/crates/integration-tests/tests/frameworks/nextjs.rs
index a4d066f4..09038e30 100644
--- a/crates/integration-tests/tests/frameworks/nextjs.rs
+++ b/crates/integration-tests/tests/frameworks/nextjs.rs
@@ -1,6 +1,6 @@
 use super::FrontendFramework;
 use super::scenarios::{CustomScenario, TestScenario};
-use crate::common::runtime::TestError;
+use crate::common::runtime::TestResult;
 use testcontainers::core::{ContainerRequest, IntoContainerPort};
 use testcontainers::{GenericImage, ImageExt as _};
 
@@ -20,10 +20,7 @@ impl FrontendFramework for NextJs {
         "nextjs"
     }
 
-    fn build_container(
-        &self,
-        origin_port: u16,
-    ) -> error_stack::Result<ContainerRequest<GenericImage>, TestError> {
+    fn build_container(&self, origin_port: u16) -> TestResult<ContainerRequest<GenericImage>> {
         let container_port = self.container_port();
         let origin_host = format!("127.0.0.1:{origin_port}");
         Ok(GenericImage::new("test-nextjs", "latest")
diff --git a/crates/integration-tests/tests/frameworks/scenarios.rs b/crates/integration-tests/tests/frameworks/scenarios.rs
index 870fc93c..2a171b60 100644
--- a/crates/integration-tests/tests/frameworks/scenarios.rs
+++ b/crates/integration-tests/tests/frameworks/scenarios.rs
@@ -1,5 +1,6 @@
 use crate::common::assertions;
-use crate::common::runtime::{TestError, origin_port};
+use crate::common::runtime::{TestError, TestResult, origin_port};
+use error_stack::Report;
 use error_stack::ResultExt as _;
 
 /// Standard test scenarios applicable to all frontend frameworks.
@@ -55,22 +56,22 @@ impl TestScenario {
     /// # Errors
     ///
     /// Returns a [`TestError`] variant depending on which assertion fails.
-    pub fn run(&self, base_url: &str, framework_id: &str) -> error_stack::Result<(), TestError> {
+    pub fn run(&self, base_url: &str, framework_id: &str) -> TestResult<()> {
         match self {
             Self::HtmlInjection => {
                 let resp = reqwest::blocking::get(base_url)
                     .change_context(TestError::HttpRequest)
-                    .attach_printable(format!(
+                    .attach(format!(
                         "scenario: HtmlInjection, framework: {framework_id}"
                     ))?;
 
                 let html = resp
                     .text()
                     .change_context(TestError::ResponseParse)
-                    .attach_printable(format!("framework: {framework_id}"))?;
+                    .attach(format!("framework: {framework_id}"))?;
 
                 assertions::assert_unique_script_tag(&html)
-                    .attach_printable(format!("framework: {framework_id}"))?;
+                    .attach(format!("framework: {framework_id}"))?;
 
                 Ok(())
             }
@@ -82,30 +83,30 @@ impl TestScenario {
                 // should rewrite to `http://127.0.0.1:{proxy_port}/page`.
                 let resp = reqwest::blocking::get(base_url)
                     .change_context(TestError::HttpRequest)
-                    .attach_printable(format!(
+                    .attach(format!(
                         "scenario: AttributeRewriting, framework: {framework_id}"
                     ))?;
 
                 let html = resp
                     .text()
                     .change_context(TestError::ResponseParse)
-                    .attach_printable(format!("framework: {framework_id}"))?;
+                    .attach(format!("framework: {framework_id}"))?;
 
                 let origin_host = format!("127.0.0.1:{}", origin_port());
 
                 assertions::assert_attributes_rewritten(&html, &origin_host, base_url)
-                    .attach_printable(format!("framework: {framework_id}"))?;
+                    .attach(format!("framework: {framework_id}"))?;
 
                 // Verify URL attributes inside ad-slot elements are also rewritten
                 assertions::assert_ad_slot_urls_rewritten(&html, &origin_host, base_url)
-                    .attach_printable(format!("framework: {framework_id}"))?;
+                    .attach(format!("framework: {framework_id}"))?;
 
                 // Verify non-URL attributes like data-ad-unit are preserved unchanged
                 assertions::assert_data_ad_units_preserved(
                     &html,
                     &["/test/banner", "/test/sidebar"],
                 )
-                .attach_printable(format!("framework: {framework_id}"))?;
+                .attach(format!("framework: {framework_id}"))?;
 
                 Ok(())
             }
@@ -115,17 +116,15 @@ impl TestScenario {
 
                 let resp = reqwest::blocking::get(&url)
                     .change_context(TestError::HttpRequest)
-                    .attach_printable(format!(
+                    .attach(format!(
                         "scenario: ScriptServing, framework: {framework_id}"
                     ))?;
 
                 if !resp.status().is_success() {
-                    return Err(
-                        error_stack::report!(TestError::HttpRequest).attach_printable(format!(
-                            "Script serving returned {}, expected 2xx",
-                            resp.status()
-                        )),
-                    );
+                    return Err(Report::new(TestError::HttpRequest).attach(format!(
+                        "Script serving returned {}, expected 2xx",
+                        resp.status()
+                    )));
                 }
 
                 // Verify content type is JavaScript
@@ -139,27 +138,26 @@ impl TestScenario {
                 let body = resp
                     .text()
                     .change_context(TestError::ResponseParse)
-                    .attach_printable(format!("framework: {framework_id}"))?;
+                    .attach(format!("framework: {framework_id}"))?;
 
                 if !content_type.contains("javascript") {
-                    return Err(error_stack::report!(TestError::ResponseParse)
-                        .attach_printable(format!(
-                            "Expected JavaScript content-type, got: {content_type}"
-                        )));
+                    return Err(Report::new(TestError::ResponseParse).attach(format!(
+                        "Expected JavaScript content-type, got: {content_type}"
+                    )));
                 }
 
                 // Verify body is non-empty and contains expected bundle markers
                 if body.is_empty() {
-                    return Err(error_stack::report!(TestError::ResponseParse)
-                        .attach_printable("Script bundle body is empty"));
+                    return Err(
+                        Report::new(TestError::ResponseParse).attach("Script bundle body is empty")
+                    );
                 }
 
                 // The unified bundle should contain the TSJS core initialization
                 if !body.contains("trustedserver") && !body.contains("tsjs") {
-                    return Err(error_stack::report!(TestError::ResponseParse)
-                        .attach_printable(
-                            "Script bundle does not contain expected trustedserver/tsjs markers",
-                        ));
+                    return Err(Report::new(TestError::ResponseParse).attach(
+                        "Script bundle does not contain expected trustedserver/tsjs markers",
+                    ));
                 }
 
                 Ok(())
@@ -170,17 +168,15 @@ impl TestScenario {
 
                 let resp = reqwest::blocking::get(&url)
                     .change_context(TestError::HttpRequest)
-                    .attach_printable(format!(
+                    .attach(format!(
                         "scenario: ScriptServingUnknownFile404, framework: {framework_id}"
                     ))?;
 
                 let status = resp.status().as_u16();
 
                 if status != 404 {
-                    return Err(error_stack::report!(TestError::HttpRequest)
-                        .attach_printable(format!(
-                            "Expected 404 for unknown tsjs file, got {status}"
-                        )));
+                    return Err(Report::new(TestError::HttpRequest)
+                        .attach(format!("Expected 404 for unknown tsjs file, got {status}")));
                 }
 
                 // Response should not be HTML (which would indicate a fallback to origin)
@@ -191,10 +187,8 @@ impl TestScenario {
                     .unwrap_or("");
 
                 if content_type.contains("text/html") {
-                    return Err(error_stack::report!(TestError::ResponseParse)
-                        .attach_printable(
-                            "Unknown tsjs file returned HTML instead of a proper 404",
-                        ));
+                    return Err(Report::new(TestError::ResponseParse)
+                        .attach("Unknown tsjs file returned HTML instead of a proper 404"));
                 }
 
                 Ok(())
@@ -209,7 +203,7 @@ impl CustomScenario {
     /// # Errors
     ///
     /// Returns a [`TestError`] variant depending on which assertion fails.
-    pub fn run(&self, base_url: &str, framework_id: &str) -> error_stack::Result<(), TestError> {
+    pub fn run(&self, base_url: &str, framework_id: &str) -> TestResult<()> {
         match self {
             Self::NextJsRscFlight => {
                 // Verify RSC Flight format responses are not corrupted.
@@ -222,7 +216,7 @@ impl CustomScenario {
                     .header("Next-Router-State-Tree", "%5B%22%22%5D")
                     .send()
                     .change_context(TestError::HttpRequest)
-                    .attach_printable(format!(
+                    .attach(format!(
                         "scenario: NextJsRscFlight, framework: {framework_id}"
                     ))?;
 
@@ -238,18 +232,15 @@ impl CustomScenario {
                 // RSC responses must NOT be HTML — that means the proxy
                 // swallowed the RSC header and treated it as a page request
                 if content_type.contains("text/html") {
-                    return Err(error_stack::report!(TestError::ResponseParse)
-                        .attach_printable(format!(
+                    return Err(Report::new(TestError::ResponseParse).attach(format!(
                             "RSC request returned text/html instead of Flight payload (content-type: {content_type})"
                         )));
                 }
 
                 // If the response is a Flight payload, it must not contain injected scripts
                 if body.contains("/static/tsjs=") {
-                    return Err(error_stack::report!(TestError::ScriptTagNotFound)
-                        .attach_printable(
-                            "Script tag should NOT be injected in RSC Flight responses",
-                        ));
+                    return Err(Report::new(TestError::ScriptTagNotFound)
+                        .attach("Script tag should NOT be injected in RSC Flight responses"));
                 }
 
                 Ok(())
@@ -273,7 +264,7 @@ impl CustomScenario {
                     .body("[]")
                     .send()
                     .change_context(TestError::HttpRequest)
-                    .attach_printable(format!(
+                    .attach(format!(
                         "scenario: NextJsServerActions, framework: {framework_id}"
                     ))?;
 
@@ -293,16 +284,15 @@ impl CustomScenario {
                             && !body.contains("not found")
                             && !body.contains("Not Found")
                         {
-                            return Err(error_stack::report!(TestError::UnexpectedContent)
-                                .attach_printable(format!(
-                                    "Soft-404 body should contain a 404 indicator; \
+                            return Err(Report::new(TestError::UnexpectedContent).attach(format!(
+                                "Soft-404 body should contain a 404 indicator; \
                                      framework: {framework_id}, body: {body}"
-                                )));
+                            )));
                         }
                     }
                     _ => {
                         return Err(
-                            error_stack::report!(TestError::HttpRequest).attach_printable(
+                            Report::new(TestError::HttpRequest).attach(
                                 format!(
                                     "Expected 200/404/405 for unknown server action, got {status}; body: {body}"
                                 ),
@@ -321,17 +311,14 @@ impl CustomScenario {
 
                 let resp = reqwest::blocking::get(&url)
                     .change_context(TestError::HttpRequest)
-                    .attach_printable(format!(
+                    .attach(format!(
                         "scenario: NextJsApiRoute, framework: {framework_id}"
                     ))?;
 
                 let status = resp.status().as_u16();
                 if status != 200 {
-                    return Err(
-                        error_stack::report!(TestError::HttpRequest).attach_printable(format!(
-                            "Expected 200 for API route, got {status}"
-                        )),
-                    );
+                    return Err(Report::new(TestError::HttpRequest)
+                        .attach(format!("Expected 200 for API route, got {status}")));
                 }
 
                 let content_type = resp
@@ -342,37 +329,32 @@ impl CustomScenario {
                     .to_string();
 
                 if !content_type.contains("application/json") {
-                    return Err(error_stack::report!(TestError::ResponseParse)
-                        .attach_printable(format!(
-                            "Expected application/json content-type, got: {content_type}"
-                        )));
+                    return Err(Report::new(TestError::ResponseParse).attach(format!(
+                        "Expected application/json content-type, got: {content_type}"
+                    )));
                 }
 
                 let body = resp
                     .text()
                     .change_context(TestError::ResponseParse)
-                    .attach_printable(format!("framework: {framework_id}"))?;
+                    .attach(format!("framework: {framework_id}"))?;
 
                 // JSON responses must not contain HTML injection
                 if body.contains("<script") || body.contains("/static/tsjs=") {
-                    return Err(error_stack::report!(TestError::ResponseParse)
-                        .attach_printable(
+                    return Err(Report::new(TestError::ResponseParse).attach(
                             "API route response contains script injection — JSON should pass through unchanged",
                         ));
                 }
 
                 // Verify it's valid JSON with expected structure
-                let json: serde_json::Value = serde_json::from_str(&body)
-                    .map_err(|e| {
-                        error_stack::report!(TestError::ResponseParse)
-                            .attach_printable(format!("API response is not valid JSON: {e}"))
-                    })?;
+                let json: serde_json::Value = serde_json::from_str(&body).map_err(|e| {
+                    Report::new(TestError::ResponseParse)
+                        .attach(format!("API response is not valid JSON: {e}"))
+                })?;
 
                 if json.get("message").is_none() {
-                    return Err(error_stack::report!(TestError::ResponseParse)
-                        .attach_printable(
-                            "API response missing expected 'message' field",
-                        ));
+                    return Err(Report::new(TestError::ResponseParse)
+                        .attach("API response missing expected 'message' field"));
                 }
 
                 Ok(())
@@ -384,14 +366,14 @@ impl CustomScenario {
 
                 let resp = reqwest::blocking::get(&url)
                     .change_context(TestError::HttpRequest)
-                    .attach_printable(format!(
+                    .attach(format!(
                         "scenario: NextJsFormAction, framework: {framework_id}"
                     ))?;
 
                 let html = resp
                     .text()
                     .change_context(TestError::ResponseParse)
-                    .attach_printable(format!("framework: {framework_id}"))?;
+                    .attach(format!("framework: {framework_id}"))?;
 
                 let origin_host = format!("127.0.0.1:{}", origin_port());
 
@@ -401,7 +383,7 @@ impl CustomScenario {
                     &origin_host,
                     base_url,
                 )
-                .attach_printable(format!("framework: {framework_id}"))?;
+                .attach(format!("framework: {framework_id}"))?;
 
                 Ok(())
             }
@@ -416,20 +398,19 @@ impl CustomScenario {
 
                 let resp = reqwest::blocking::get(&url)
                     .change_context(TestError::HttpRequest)
-                    .attach_printable(format!(
+                    .attach(format!(
                         "scenario: WordPressAdminInjection, framework: {framework_id}"
                     ))?;
 
                 let html = resp
                     .text()
                     .change_context(TestError::ResponseParse)
-                    .attach_printable(format!("framework: {framework_id}"))?;
+                    .attach(format!("framework: {framework_id}"))?;
 
-                assertions::assert_script_tag_present(&html)
-                    .attach_printable(format!(
-                        "Admin page should receive injection (current behavior). \
+                assertions::assert_script_tag_present(&html).attach(format!(
+                    "Admin page should receive injection (current behavior). \
                          framework: {framework_id}"
-                    ))?;
+                ))?;
 
                 Ok(())
             }
diff --git a/crates/integration-tests/tests/frameworks/wordpress.rs b/crates/integration-tests/tests/frameworks/wordpress.rs
index 0cdfe52e..00996ce9 100644
--- a/crates/integration-tests/tests/frameworks/wordpress.rs
+++ b/crates/integration-tests/tests/frameworks/wordpress.rs
@@ -1,6 +1,6 @@
 use super::FrontendFramework;
 use super::scenarios::{CustomScenario, TestScenario};
-use crate::common::runtime::TestError;
+use crate::common::runtime::TestResult;
 use testcontainers::core::{ContainerRequest, IntoContainerPort};
 use testcontainers::{GenericImage, ImageExt as _};
 
@@ -21,10 +21,7 @@ impl FrontendFramework for WordPress {
         "wordpress"
     }
 
-    fn build_container(
-        &self,
-        origin_port: u16,
-    ) -> error_stack::Result<ContainerRequest<GenericImage>, TestError> {
+    fn build_container(&self, origin_port: u16) -> TestResult<ContainerRequest<GenericImage>> {
         let container_port = self.container_port();
         let origin_host = format!("127.0.0.1:{origin_port}");
         Ok(GenericImage::new("test-wordpress", "latest")
diff --git a/crates/integration-tests/tests/integration.rs b/crates/integration-tests/tests/integration.rs
index cf66a103..168a2ba4 100644
--- a/crates/integration-tests/tests/integration.rs
+++ b/crates/integration-tests/tests/integration.rs
@@ -9,7 +9,7 @@ mod frameworks;
 
 use common::runtime::{TestError, origin_port, wasm_binary_path};
 use environments::RUNTIME_ENVIRONMENTS;
-use error_stack::ResultExt as _;
+use error_stack::{Report, ResultExt as _};
 use frameworks::{FRAMEWORKS, FrontendFramework};
 use std::time::Duration;
 use testcontainers::runners::SyncRunner as _;
@@ -62,7 +62,7 @@ fn test_all_combinations() {
 fn test_combination(
     runtime: &dyn common::runtime::RuntimeEnvironment,
     framework: &dyn FrontendFramework,
-) -> error_stack::Result<(), TestError> {
+) -> common::runtime::TestResult<()> {
     init_logger();
     let runtime_id = runtime.id();
     let framework_id = framework.id();
@@ -71,12 +71,12 @@ fn test_combination(
     // 1. Start frontend container mapped to the fixed origin port
     let container = framework
         .build_container(port)
-        .attach_printable(format!("runtime: {runtime_id}, framework: {framework_id}"))?
+        .attach(format!("runtime: {runtime_id}, framework: {framework_id}"))?
         .start()
         .change_context(TestError::ContainerStart {
             reason: format!("framework: {framework_id}"),
         })
-        .attach_printable(format!("runtime: {runtime_id}, framework: {framework_id}"))?;
+        .attach(format!("runtime: {runtime_id}, framework: {framework_id}"))?;
 
     let origin_url = format!("http://127.0.0.1:{port}");
 
@@ -87,13 +87,13 @@ fn test_combination(
     let wasm_path = wasm_binary_path();
     let process = runtime
         .spawn(&wasm_path)
-        .attach_printable(format!("runtime: {runtime_id}, framework: {framework_id}"))?;
+        .attach(format!("runtime: {runtime_id}, framework: {framework_id}"))?;
 
     // 3. Run standard scenarios
     for scenario in framework.standard_scenarios() {
         scenario
             .run(&process.base_url, framework_id)
-            .attach_printable(format!(
+            .attach(format!(
                 "runtime: {runtime_id}, framework: {framework_id}, scenario: {scenario:?}"
             ))?;
     }
@@ -102,7 +102,7 @@ fn test_combination(
     for scenario in framework.custom_scenarios() {
         scenario
             .run(&process.base_url, framework_id)
-            .attach_printable(format!(
+            .attach(format!(
                 "runtime: {runtime_id}, framework: {framework_id}, custom scenario: {scenario:?}"
             ))?;
     }
@@ -126,7 +126,7 @@ fn test_combination(
 ///
 /// Returns [`TestError::ContainerTimeout`] if the health endpoint does not
 /// respond with a success status within the timeout.
-fn wait_for_container(base_url: &str, health_path: &str) -> error_stack::Result<(), TestError> {
+fn wait_for_container(base_url: &str, health_path: &str) -> common::runtime::TestResult<()> {
     let url = format!("{base_url}{health_path}");
 
     for _ in 0..60 {
@@ -138,8 +138,8 @@ fn wait_for_container(base_url: &str, health_path: &str) -> error_stack::Result<
         std::thread::sleep(Duration::from_millis(500));
     }
 
-    Err(error_stack::report!(TestError::ContainerTimeout)
-        .attach_printable(format!("Container at {base_url} not ready after 30s")))
+    Err(Report::new(TestError::ContainerTimeout)
+        .attach(format!("Container at {base_url} not ready after 30s")))
 }
 
 // Individual test functions for faster iteration during development.

From 437a9f40007a19da2a5361bb0dc8e85855bf8732 Mon Sep 17 00:00:00 2001
From: prk-Jr <prakashsagwara@gmail.com>
Date: Wed, 11 Mar 2026 16:30:21 +0530
Subject: [PATCH 15/15] Harden integration test dependency and fixture
 reproducibility

---
 .../setup-integration-test-env/action.yml     |  74 +++
 .github/workflows/integration-tests.yml       |  94 +---
 .gitignore                                    |   2 +-
 crates/fastly/src/main.rs                     |   6 -
 crates/integration-tests/Cargo.lock           |  47 +-
 crates/integration-tests/Cargo.toml           |   6 +-
 crates/integration-tests/README.md            |  19 +-
 .../integration-tests/browser/global-setup.ts |   3 -
 .../browser/helpers/infra.ts                  |  21 +-
 .../browser/helpers/state.ts                  |   5 +
 .../browser/playwright.config.ts              |   1 -
 .../tests/nextjs/api-passthrough.spec.ts      |   6 +-
 .../tests/nextjs/form-rewriting.spec.ts       |   6 +-
 .../browser/tests/nextjs/navigation.spec.ts   |  10 +-
 .../tests/shared/script-bundle.spec.ts        |   5 +-
 .../tests/shared/script-injection.spec.ts     |  14 +-
 .../tests/wordpress/admin-injection.spec.ts   |   4 +-
 .../fixtures/configs/viceroy-template.toml    |   2 +
 .../fixtures/frameworks/nextjs/Dockerfile     |  13 +-
 .../frameworks/nextjs/package-lock.json       | 487 ++++++++++++++++++
 .../tests/environments/fastly.rs              |  20 +-
 .../tests/environments/mod.rs                 |  47 +-
 .../integration-tests/tests/frameworks/mod.rs |   5 +-
 .../tests/frameworks/scenarios.rs             |   7 +-
 crates/integration-tests/tests/integration.rs |  57 +-
 .../check-integration-dependency-versions.sh  |  57 ++
 scripts/integration-tests-browser.sh          |  28 +-
 scripts/integration-tests.sh                  |  29 +-
 28 files changed, 857 insertions(+), 218 deletions(-)
 create mode 100644 .github/actions/setup-integration-test-env/action.yml
 create mode 100644 crates/integration-tests/fixtures/frameworks/nextjs/package-lock.json
 create mode 100755 scripts/check-integration-dependency-versions.sh

diff --git a/.github/actions/setup-integration-test-env/action.yml b/.github/actions/setup-integration-test-env/action.yml
new file mode 100644
index 00000000..889c5cbc
--- /dev/null
+++ b/.github/actions/setup-integration-test-env/action.yml
@@ -0,0 +1,74 @@
+name: Setup integration test environment
+description: Prepare toolchains, Viceroy, and Docker images for integration test jobs.
+
+inputs:
+  origin-port:
+    description: Fixed origin port baked into the WASM binary for integration tests.
+    required: true
+
+outputs:
+  node-version:
+    description: Node.js version read from .tool-versions.
+    value: ${{ steps.node-version.outputs.node-version }}
+
+runs:
+  using: composite
+  steps:
+    - name: Check shared dependency versions
+      shell: bash
+      run: ./scripts/check-integration-dependency-versions.sh
+
+    - name: Retrieve Rust version
+      id: rust-version
+      shell: bash
+      run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+
+    - name: Retrieve Node.js version
+      id: node-version
+      shell: bash
+      run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+
+    - name: Set up Rust toolchain
+      uses: actions-rust-lang/setup-rust-toolchain@v1
+      with:
+        toolchain: ${{ steps.rust-version.outputs.rust-version }}
+        target: wasm32-wasip1
+        cache-shared-key: cargo-${{ runner.os }}
+
+    - name: Get Viceroy cache key
+      id: viceroy-rev
+      shell: bash
+      run: echo "sha=$(git ls-remote https://github.com/fastly/Viceroy HEAD | cut -f1)" >> "$GITHUB_OUTPUT"
+
+    - name: Cache Viceroy binary
+      id: cache-viceroy
+      uses: actions/cache@v4
+      with:
+        path: ~/.cargo/bin/viceroy
+        key: viceroy-${{ runner.os }}-${{ steps.viceroy-rev.outputs.sha }}
+
+    - name: Install Viceroy
+      if: steps.cache-viceroy.outputs.cache-hit != 'true'
+      shell: bash
+      run: cargo install --git https://github.com/fastly/Viceroy viceroy
+
+    - name: Build WASM binary
+      shell: bash
+      env:
+        TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
+        TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
+      run: cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
+
+    - name: Build WordPress test container
+      shell: bash
+      run: |
+        docker build -t test-wordpress:latest \
+          crates/integration-tests/fixtures/frameworks/wordpress/
+
+    - name: Build Next.js test container
+      shell: bash
+      run: |
+        docker build \
+          --build-arg NODE_VERSION=${{ steps.node-version.outputs.node-version }} \
+          -t test-nextjs:latest \
+          crates/integration-tests/fixtures/frameworks/nextjs/
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index e186c933..07d29d19 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -26,55 +26,18 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Retrieve Rust version
-        id: rust-version
-        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
-        shell: bash
-
-      - name: Set up Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
-        with:
-          toolchain: ${{ steps.rust-version.outputs.rust-version }}
-          target: wasm32-wasip1
-          cache-shared-key: cargo-${{ runner.os }}
-
-      - name: Get Viceroy cache key
-        id: viceroy-rev
-        run: echo "sha=$(git ls-remote https://github.com/fastly/Viceroy HEAD | cut -f1)" >> $GITHUB_OUTPUT
-
-      - name: Cache Viceroy binary
-        id: cache-viceroy
-        uses: actions/cache@v4
+      - name: Set up shared integration test environment
+        id: shared-setup
+        uses: ./.github/actions/setup-integration-test-env
         with:
-          path: ~/.cargo/bin/viceroy
-          key: viceroy-${{ runner.os }}-${{ steps.viceroy-rev.outputs.sha }}
-
-      - name: Install Viceroy
-        if: steps.cache-viceroy.outputs.cache-hit != 'true'
-        run: cargo install --git https://github.com/fastly/Viceroy viceroy
-
-      - name: Build WASM binary
-        run: cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
-        env:
-          TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: "http://127.0.0.1:${{ env.ORIGIN_PORT }}"
-          TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
-
-      - name: Build WordPress test container
-        run: |
-          docker build -t test-wordpress:latest \
-            crates/integration-tests/fixtures/frameworks/wordpress/
-
-      - name: Build Next.js test container
-        run: |
-          docker build -t test-nextjs:latest \
-            crates/integration-tests/fixtures/frameworks/nextjs/
+          origin-port: ${{ env.ORIGIN_PORT }}
 
       - name: Run integration tests
         run: >-
           cargo test
           --manifest-path crates/integration-tests/Cargo.toml
           --target x86_64-unknown-linux-gnu
-          -- --include-ignored --test-threads=1
+          -- --include-ignored --skip test_wordpress_fastly --skip test_nextjs_fastly --test-threads=1
         env:
           INTEGRATION_ORIGIN_PORT: ${{ env.ORIGIN_PORT }}
           RUST_LOG: info
@@ -90,53 +53,16 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Retrieve Rust version
-        id: rust-version
-        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
-        shell: bash
-
-      - name: Set up Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
-        with:
-          toolchain: ${{ steps.rust-version.outputs.rust-version }}
-          target: wasm32-wasip1
-          cache-shared-key: cargo-${{ runner.os }}
-
-      - name: Get Viceroy cache key
-        id: viceroy-rev
-        run: echo "sha=$(git ls-remote https://github.com/fastly/Viceroy HEAD | cut -f1)" >> $GITHUB_OUTPUT
-
-      - name: Cache Viceroy binary
-        id: cache-viceroy
-        uses: actions/cache@v4
+      - name: Set up shared integration test environment
+        id: shared-setup
+        uses: ./.github/actions/setup-integration-test-env
         with:
-          path: ~/.cargo/bin/viceroy
-          key: viceroy-${{ runner.os }}-${{ steps.viceroy-rev.outputs.sha }}
-
-      - name: Install Viceroy
-        if: steps.cache-viceroy.outputs.cache-hit != 'true'
-        run: cargo install --git https://github.com/fastly/Viceroy viceroy
-
-      - name: Build WASM binary
-        run: cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
-        env:
-          TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: "http://127.0.0.1:${{ env.ORIGIN_PORT }}"
-          TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
-
-      - name: Build WordPress test container
-        run: |
-          docker build -t test-wordpress:latest \
-            crates/integration-tests/fixtures/frameworks/wordpress/
-
-      - name: Build Next.js test container
-        run: |
-          docker build -t test-nextjs:latest \
-            crates/integration-tests/fixtures/frameworks/nextjs/
+          origin-port: ${{ env.ORIGIN_PORT }}
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: lts/*
+          node-version: ${{ steps.shared-setup.outputs.node-version }}
 
       - name: Install Playwright
         working-directory: crates/integration-tests/browser
diff --git a/.gitignore b/.gitignore
index 864be6a1..af70c452 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,4 +35,4 @@ src/*.html
 /crates/integration-tests/browser/node_modules/
 /crates/integration-tests/browser/test-results/
 /crates/integration-tests/browser/playwright-report/
-/crates/integration-tests/browser/.browser-test-state.json
\ No newline at end of file
+/crates/integration-tests/browser/.browser-test-state.json
diff --git a/crates/fastly/src/main.rs b/crates/fastly/src/main.rs
index 17b7e987..b4e3e3a2 100644
--- a/crates/fastly/src/main.rs
+++ b/crates/fastly/src/main.rs
@@ -80,12 +80,6 @@ async fn route_request(
 
     // Match known routes and handle them
     let result = match (method, path.as_str()) {
-        // Health check endpoint for integration tests and monitoring.
-        // Namespaced to avoid shadowing publisher routes.
-        (Method::GET, "/__trusted-server/health") => {
-            Ok(Response::from_status(200).with_body_text_plain("ok"))
-        }
-
         // Serve the tsjs library
         (Method::GET, path) if path.starts_with("/static/tsjs=") => {
             handle_tsjs_dynamic(&req, integration_registry)
diff --git a/crates/integration-tests/Cargo.lock b/crates/integration-tests/Cargo.lock
index ac3a2460..8c4edd8c 100644
--- a/crates/integration-tests/Cargo.lock
+++ b/crates/integration-tests/Cargo.lock
@@ -340,15 +340,6 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
 
-[[package]]
-name = "convert_case"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "633458d4ef8c78b72454de2d54fd6ab2e60f9e02be22f3c6104cdc8a4e0fceb9"
-dependencies = [
- "unicode-segmentation",
-]
-
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
@@ -456,23 +447,21 @@ dependencies = [
 
 [[package]]
 name = "derive_more"
-version = "2.1.1"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
+checksum = "093242cf7570c207c83073cf82f79706fe7b8317e98620a47d5be7c3d8497678"
 dependencies = [
  "derive_more-impl",
 ]
 
 [[package]]
 name = "derive_more-impl"
-version = "2.1.1"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
+checksum = "bda628edc44c4bb645fbe0f758797143e4e07926f7ebf4e9bdfbd3d2ce621df3"
 dependencies = [
- "convert_case",
  "proc-macro2",
  "quote",
- "rustc_version",
  "syn",
  "unicode-xid",
 ]
@@ -1218,7 +1207,7 @@ dependencies = [
 name = "integration-tests"
 version = "0.1.0"
 dependencies = [
- "derive_more 2.1.1",
+ "derive_more 2.0.1",
  "env_logger",
  "error-stack",
  "log",
@@ -1307,9 +1296,9 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "libc"
-version = "0.2.182"
+version = "0.2.183"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6800badb6cb2082ffd7b6a67e6125bb39f18782f793520caee8cb8846be06112"
+checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
 
 [[package]]
 name = "libredox"
@@ -2100,9 +2089,9 @@ checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "schannel"
-version = "0.1.28"
+version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "891d81b926048e76efe18581bf793546b4c0eaf8448d72be8de2bbee5fd166e1"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
 dependencies = [
  "windows-sys 0.61.2",
 ]
@@ -2461,9 +2450,9 @@ dependencies = [
 
 [[package]]
 name = "tempfile"
-version = "3.26.0"
+version = "3.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82a72c767771b47409d2345987fda8628641887d5466101319899796367354a0"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
  "getrandom 0.4.2",
@@ -2785,12 +2774,6 @@ version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
-[[package]]
-name = "unicode-segmentation"
-version = "1.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
-
 [[package]]
 name = "unicode-width"
 version = "0.2.2"
@@ -3337,18 +3320,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.40"
+version = "0.8.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a789c6e490b576db9f7e6b6d661bcc9799f7c0ac8352f56ea20193b2681532e5"
+checksum = "f2578b716f8a7a858b7f02d5bd870c14bf4ddbbcf3a4c05414ba6503640505e3"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.40"
+version = "0.8.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f65c489a7071a749c849713807783f70672b28094011623e200cb86dcb835953"
+checksum = "7e6cc098ea4d3bd6246687de65af3f920c430e236bee1e3bf2e441463f08a02f"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/crates/integration-tests/Cargo.toml b/crates/integration-tests/Cargo.toml
index d0f8369d..bc61c471 100644
--- a/crates/integration-tests/Cargo.toml
+++ b/crates/integration-tests/Cargo.toml
@@ -13,8 +13,8 @@ harness = true
 testcontainers = { version = "0.25", features = ["blocking"] }
 reqwest = { version = "0.12", features = ["blocking"] }
 scraper = "0.21"
-log = "0.4"
-serde_json = "1"
+log = "0.4.29"
+serde_json = "1.0.149"
 error-stack = "0.6"
-derive_more = { version = "2.0", features = ["display"] }
+derive_more = { version = "=2.0.1", features = ["display"] }
 env_logger = "0.11"
diff --git a/crates/integration-tests/README.md b/crates/integration-tests/README.md
index 0c7e3b05..0f05eaf1 100644
--- a/crates/integration-tests/README.md
+++ b/crates/integration-tests/README.md
@@ -75,7 +75,9 @@ var) so the trusted server's URL rewriting can be verified.
 docker build -t test-wordpress:latest \
   crates/integration-tests/fixtures/frameworks/wordpress/
 
-docker build -t test-nextjs:latest \
+docker build \
+  --build-arg NODE_VERSION="$(grep '^nodejs ' .tool-versions | awk '{print $2}')" \
+  -t test-nextjs:latest \
   crates/integration-tests/fixtures/frameworks/nextjs/
 ```
 
@@ -196,6 +198,21 @@ Two jobs run in parallel:
 They are **not** part of `cargo test --workspace` because the integration-tests
 crate requires a native target while the workspace default is `wasm32-wasip1`.
 
+## Dependency maintenance
+
+`crates/integration-tests` is intentionally excluded from the workspace, so it
+keeps its own `Cargo.lock`.
+
+Shared direct dependency versions are checked in CI by
+`scripts/check-integration-dependency-versions.sh`. When updating a dependency
+that exists in both manifests:
+
+1. Update the version in both `Cargo.toml` files.
+2. Regenerate the nested lockfile with
+   `cargo generate-lockfile --manifest-path crates/integration-tests/Cargo.toml`.
+3. Ensure the workspace and integration-test lockfiles resolve the same version
+   for that shared dependency.
+
 ## Known gaps
 
 - **GDPR consent propagation** — the consent field exists in `AuctionRequest`
diff --git a/crates/integration-tests/browser/global-setup.ts b/crates/integration-tests/browser/global-setup.ts
index b47d9772..c804f4d5 100644
--- a/crates/integration-tests/browser/global-setup.ts
+++ b/crates/integration-tests/browser/global-setup.ts
@@ -49,9 +49,6 @@ async function globalSetup(): Promise<void> {
 
     console.log(`[global-setup] Viceroy ready at ${viceroy.baseUrl}`);
 
-    // Expose the base URL so playwright.config.ts picks it up via env var
-    process.env.VICEROY_BASE_URL = viceroy.baseUrl;
-
     // Write complete state for tests and teardown
     writeState({
       baseUrl: viceroy.baseUrl,
diff --git a/crates/integration-tests/browser/helpers/infra.ts b/crates/integration-tests/browser/helpers/infra.ts
index 6577ddab..6302f50f 100644
--- a/crates/integration-tests/browser/helpers/infra.ts
+++ b/crates/integration-tests/browser/helpers/infra.ts
@@ -1,4 +1,4 @@
-import { execSync, spawn, type ChildProcess } from "node:child_process";
+import { execFileSync, spawn, type ChildProcess } from "node:child_process";
 import { createServer } from "node:net";
 import { waitForReady } from "./wait-for-ready.js";
 
@@ -44,13 +44,18 @@ export async function startContainer(framework: string): Promise<string> {
     );
   }
 
-  const containerId = execSync(
+  const containerId = execFileSync(
+    "docker",
     [
-      "docker run -d --rm",
-      `-p ${ORIGIN_PORT}:${config.port}`,
-      `-e ORIGIN_HOST=127.0.0.1:${ORIGIN_PORT}`,
+      "run",
+      "-d",
+      "--rm",
+      "-p",
+      `${ORIGIN_PORT}:${config.port}`,
+      "-e",
+      `ORIGIN_HOST=127.0.0.1:${ORIGIN_PORT}`,
       config.image,
-    ].join(" "),
+    ],
     { encoding: "utf-8" },
   ).trim();
 
@@ -68,7 +73,7 @@ export async function startContainer(framework: string): Promise<string> {
 /** Stop a Docker container by ID. */
 export function stopContainer(containerId: string): void {
   try {
-    execSync(`docker stop ${containerId}`, { timeout: 10_000 });
+    execFileSync("docker", ["stop", containerId], { timeout: 10_000 });
   } catch {
     // Container may have already stopped (--rm flag)
   }
@@ -108,7 +113,7 @@ export async function startViceroy(
   const baseUrl = `http://127.0.0.1:${port}`;
 
   try {
-    await waitForReady(baseUrl, "/__trusted-server/health");
+    await waitForReady(baseUrl, "/");
   } catch (err) {
     // Viceroy spawned but never became ready — kill it before propagating.
     if (child.pid) stopViceroy(child.pid);
diff --git a/crates/integration-tests/browser/helpers/state.ts b/crates/integration-tests/browser/helpers/state.ts
index 72167bd1..e98d04eb 100644
--- a/crates/integration-tests/browser/helpers/state.ts
+++ b/crates/integration-tests/browser/helpers/state.ts
@@ -14,3 +14,8 @@ const STATE_FILE = resolve(__dirname, "../.browser-test-state.json");
 export function readState(): TestState {
   return JSON.parse(readFileSync(STATE_FILE, "utf-8"));
 }
+
+/** Resolve an absolute runtime URL from the current browser test state. */
+export function runtimeUrl(path: string): string {
+  return new URL(path, readState().baseUrl).toString();
+}
diff --git a/crates/integration-tests/browser/playwright.config.ts b/crates/integration-tests/browser/playwright.config.ts
index 1eb232d5..8a1ef3b5 100644
--- a/crates/integration-tests/browser/playwright.config.ts
+++ b/crates/integration-tests/browser/playwright.config.ts
@@ -9,7 +9,6 @@ export default defineConfig({
   // Sequential execution: all tests share a single origin port (8888)
   workers: 1,
   use: {
-    baseURL: process.env.VICEROY_BASE_URL || "http://127.0.0.1:7878",
     headless: true,
     screenshot: "only-on-failure",
     trace: "retain-on-failure",
diff --git a/crates/integration-tests/browser/tests/nextjs/api-passthrough.spec.ts b/crates/integration-tests/browser/tests/nextjs/api-passthrough.spec.ts
index 22299191..94fb3590 100644
--- a/crates/integration-tests/browser/tests/nextjs/api-passthrough.spec.ts
+++ b/crates/integration-tests/browser/tests/nextjs/api-passthrough.spec.ts
@@ -1,5 +1,5 @@
 import { test, expect } from "@playwright/test";
-import { readState } from "../../helpers/state.js";
+import { readState, runtimeUrl } from "../../helpers/state.js";
 
 test.beforeEach(async ({}, testInfo) => {
   const state = readState();
@@ -12,7 +12,7 @@ test.describe("Next.js API route passthrough", () => {
   test("API route returns JSON without script injection", async ({
     request,
   }) => {
-    const resp = await request.get("/api/hello");
+    const resp = await request.get(runtimeUrl("/api/hello"));
     expect(resp.status()).toBe(200);
 
     const contentType = resp.headers()["content-type"] || "";
@@ -29,7 +29,7 @@ test.describe("Next.js API route passthrough", () => {
   });
 
   test("data API route returns structured JSON", async ({ request }) => {
-    const resp = await request.get("/api/data");
+    const resp = await request.get(runtimeUrl("/api/data"));
     expect(resp.status()).toBe(200);
 
     const body = await resp.json();
diff --git a/crates/integration-tests/browser/tests/nextjs/form-rewriting.spec.ts b/crates/integration-tests/browser/tests/nextjs/form-rewriting.spec.ts
index ac5927e1..278c7f0f 100644
--- a/crates/integration-tests/browser/tests/nextjs/form-rewriting.spec.ts
+++ b/crates/integration-tests/browser/tests/nextjs/form-rewriting.spec.ts
@@ -1,5 +1,5 @@
 import { test, expect } from "@playwright/test";
-import { readState } from "../../helpers/state.js";
+import { readState, runtimeUrl } from "../../helpers/state.js";
 
 test.beforeEach(async ({}, testInfo) => {
   const state = readState();
@@ -12,7 +12,7 @@ test.describe("Next.js form action rewriting", () => {
   test("form action URL is rewritten from origin to proxy", async ({
     page,
   }) => {
-    await page.goto("/contact", { waitUntil: "domcontentloaded" });
+    await page.goto(runtimeUrl("/contact"), { waitUntil: "domcontentloaded" });
 
     const form = page.locator("form#contact-form");
     await expect(form).toHaveCount(1);
@@ -28,7 +28,7 @@ test.describe("Next.js form action rewriting", () => {
   });
 
   test("contact page has script injection", async ({ page }) => {
-    await page.goto("/contact", { waitUntil: "domcontentloaded" });
+    await page.goto(runtimeUrl("/contact"), { waitUntil: "domcontentloaded" });
     await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
   });
 });
diff --git a/crates/integration-tests/browser/tests/nextjs/navigation.spec.ts b/crates/integration-tests/browser/tests/nextjs/navigation.spec.ts
index 2244e032..f7643d93 100644
--- a/crates/integration-tests/browser/tests/nextjs/navigation.spec.ts
+++ b/crates/integration-tests/browser/tests/nextjs/navigation.spec.ts
@@ -1,5 +1,5 @@
 import { test, expect, type Page } from "@playwright/test";
-import { readState } from "../../helpers/state.js";
+import { readState, runtimeUrl } from "../../helpers/state.js";
 
 test.beforeEach(async ({}, testInfo) => {
   const state = readState();
@@ -29,7 +29,7 @@ test.describe("Next.js client-side navigation", () => {
     const jsErrors: string[] = [];
     page.on("pageerror", (error) => jsErrors.push(error.message));
 
-    await page.goto("/", { waitUntil: "domcontentloaded" });
+    await page.goto(runtimeUrl("/"), { waitUntil: "domcontentloaded" });
 
     // Script present on initial load
     await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
@@ -69,7 +69,7 @@ test.describe("Next.js client-side navigation", () => {
   });
 
   test("navigating back preserves script injection", async ({ page }) => {
-    await page.goto("/", { waitUntil: "domcontentloaded" });
+    await page.goto(runtimeUrl("/"), { waitUntil: "domcontentloaded" });
     await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
 
     // Wait for hydration before navigating
@@ -88,7 +88,7 @@ test.describe("Next.js client-side navigation", () => {
   test("deferred route script executes after SPA transition to dashboard", async ({
     page,
   }) => {
-    await page.goto("/", { waitUntil: "domcontentloaded" });
+    await page.goto(runtimeUrl("/"), { waitUntil: "domcontentloaded" });
     await waitForHydration(page);
 
     // No route script marker on home page
@@ -128,7 +128,7 @@ test.describe("Next.js client-side navigation", () => {
   test("about page has script injection via direct navigation", async ({
     page,
   }) => {
-    await page.goto("/about", { waitUntil: "domcontentloaded" });
+    await page.goto(runtimeUrl("/about"), { waitUntil: "domcontentloaded" });
     await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
 
     const src = await page
diff --git a/crates/integration-tests/browser/tests/shared/script-bundle.spec.ts b/crates/integration-tests/browser/tests/shared/script-bundle.spec.ts
index 8c10974d..fcadcdf4 100644
--- a/crates/integration-tests/browser/tests/shared/script-bundle.spec.ts
+++ b/crates/integration-tests/browser/tests/shared/script-bundle.spec.ts
@@ -1,4 +1,5 @@
 import { test, expect } from "@playwright/test";
+import { runtimeUrl } from "../../helpers/state.js";
 
 test.describe("Script bundle", () => {
   test("JS bundle loads with 200 and executes without parse errors", async ({
@@ -17,7 +18,7 @@ test.describe("Script bundle", () => {
     const jsErrors: string[] = [];
     page.on("pageerror", (error) => jsErrors.push(error.message));
 
-    await page.goto("/", { waitUntil: "domcontentloaded" });
+    await page.goto(runtimeUrl("/"), { waitUntil: "domcontentloaded" });
 
     // Wait for the bundle response specifically (up to 10s)
     if (bundleResponses.length === 0) {
@@ -43,7 +44,7 @@ test.describe("Script bundle", () => {
       { timeout: 10_000 },
     );
 
-    await page.goto("/", { waitUntil: "domcontentloaded" });
+    await page.goto(runtimeUrl("/"), { waitUntil: "domcontentloaded" });
 
     const bundleResp = await bundlePromise;
     bundleContentType = bundleResp.headers()["content-type"] || "";
diff --git a/crates/integration-tests/browser/tests/shared/script-injection.spec.ts b/crates/integration-tests/browser/tests/shared/script-injection.spec.ts
index f67bf06b..3a38aa74 100644
--- a/crates/integration-tests/browser/tests/shared/script-injection.spec.ts
+++ b/crates/integration-tests/browser/tests/shared/script-injection.spec.ts
@@ -1,8 +1,9 @@
 import { test, expect } from "@playwright/test";
+import { runtimeUrl } from "../../helpers/state.js";
 
 test.describe("Script injection", () => {
   test("injected script tag is present in the live DOM", async ({ page }) => {
-    await page.goto("/", { waitUntil: "domcontentloaded" });
+    await page.goto(runtimeUrl("/"), { waitUntil: "domcontentloaded" });
     const scriptTag = page.locator("script#trustedserver-js");
     await expect(scriptTag).toHaveCount(1);
 
@@ -12,14 +13,17 @@ test.describe("Script injection", () => {
 
   test("no unexpected console errors on page load", async ({ page }) => {
     const errors: string[] = [];
+    let lastConsoleActivityAt = Date.now();
     page.on("console", (msg) => {
+      lastConsoleActivityAt = Date.now();
       if (msg.type() === "error") errors.push(msg.text());
     });
 
-    await page.goto("/", { waitUntil: "domcontentloaded" });
-
-    // Give scripts a moment to execute and log errors
-    await page.waitForTimeout(2000);
+    await page.goto(runtimeUrl("/"), { waitUntil: "domcontentloaded" });
+    await expect.poll(
+      () => Date.now() - lastConsoleActivityAt,
+      { timeout: 5_000 },
+    ).toBeGreaterThanOrEqual(500);
 
     // Suppress benign errors:
     // - favicon: not served by test containers
diff --git a/crates/integration-tests/browser/tests/wordpress/admin-injection.spec.ts b/crates/integration-tests/browser/tests/wordpress/admin-injection.spec.ts
index 6b6e57c3..0823b39c 100644
--- a/crates/integration-tests/browser/tests/wordpress/admin-injection.spec.ts
+++ b/crates/integration-tests/browser/tests/wordpress/admin-injection.spec.ts
@@ -1,5 +1,5 @@
 import { test, expect } from "@playwright/test";
-import { readState } from "../../helpers/state.js";
+import { readState, runtimeUrl } from "../../helpers/state.js";
 
 test.beforeEach(async ({}, testInfo) => {
   const state = readState();
@@ -13,7 +13,7 @@ test.describe("WordPress admin injection", () => {
     // Documents current behavior: the trusted-server injects the script
     // on ALL pages, including /wp-admin/. This test captures that behavior
     // so any future change (e.g. excluding admin pages) is intentional.
-    await page.goto("/wp-admin/", { waitUntil: "domcontentloaded" });
+    await page.goto(runtimeUrl("/wp-admin/"), { waitUntil: "domcontentloaded" });
     await expect(page.locator("script#trustedserver-js")).toHaveCount(1);
 
     const src = await page.locator("script#trustedserver-js").getAttribute("src");
diff --git a/crates/integration-tests/fixtures/configs/viceroy-template.toml b/crates/integration-tests/fixtures/configs/viceroy-template.toml
index 3129c3f5..7b11b9b9 100644
--- a/crates/integration-tests/fixtures/configs/viceroy-template.toml
+++ b/crates/integration-tests/fixtures/configs/viceroy-template.toml
@@ -7,6 +7,8 @@
     [local_server.backends]
 
     [local_server.kv_stores]
+        # These inline placeholders satisfy Viceroy's local KV configuration
+        # requirements without exercising KV-backed application behavior.
         [[local_server.kv_stores.counter_store]]
             key = "placeholder"
             data = "placeholder"
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile b/crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile
index ab580ce0..323f5fb9 100644
--- a/crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/Dockerfile
@@ -6,15 +6,20 @@
 #     crates/integration-tests/fixtures/frameworks/nextjs/
 #
 # Run manually:
+#   docker build \
+#     --build-arg NODE_VERSION="$(grep '^nodejs ' .tool-versions | awk '{print $2}')" \
+#     -t test-nextjs:latest \
+#     crates/integration-tests/fixtures/frameworks/nextjs/
 #   docker run -p 3000:3000 test-nextjs:latest
 
 # --- Build stage ---
-FROM node:20-alpine AS builder
+ARG NODE_VERSION
+FROM node:${NODE_VERSION}-alpine AS builder
 
 WORKDIR /app
 
-COPY package.json ./
-RUN npm install
+COPY package.json package-lock.json ./
+RUN npm ci
 
 COPY next.config.mjs ./
 COPY app/ ./app/
@@ -22,7 +27,7 @@ COPY app/ ./app/
 RUN npm run build
 
 # --- Runtime stage ---
-FROM node:20-alpine AS runner
+FROM node:${NODE_VERSION}-alpine AS runner
 
 WORKDIR /app
 
diff --git a/crates/integration-tests/fixtures/frameworks/nextjs/package-lock.json b/crates/integration-tests/fixtures/frameworks/nextjs/package-lock.json
new file mode 100644
index 00000000..78e2a619
--- /dev/null
+++ b/crates/integration-tests/fixtures/frameworks/nextjs/package-lock.json
@@ -0,0 +1,487 @@
+{
+  "name": "integration-test-nextjs",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "integration-test-nextjs",
+      "version": "1.0.0",
+      "dependencies": {
+        "next": "^14.0.0",
+        "react": "^18.2.0",
+        "react-dom": "^18.2.0"
+      },
+      "devDependencies": {
+        "@types/node": "^20",
+        "@types/react": "^18",
+        "typescript": "^5"
+      }
+    },
+    "node_modules/@next/env": {
+      "version": "14.2.35",
+      "resolved": "https://registry.npmjs.org/@next/env/-/env-14.2.35.tgz",
+      "integrity": "sha512-DuhvCtj4t9Gwrx80dmz2F4t/zKQ4ktN8WrMwOuVzkJfBilwAwGr6v16M5eI8yCuZ63H9TTuEU09Iu2HqkzFPVQ==",
+      "license": "MIT"
+    },
+    "node_modules/@next/swc-darwin-arm64": {
+      "version": "14.2.33",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-14.2.33.tgz",
+      "integrity": "sha512-HqYnb6pxlsshoSTubdXKu15g3iivcbsMXg4bYpjL2iS/V6aQot+iyF4BUc2qA/J/n55YtvE4PHMKWBKGCF/+wA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-darwin-x64": {
+      "version": "14.2.33",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-14.2.33.tgz",
+      "integrity": "sha512-8HGBeAE5rX3jzKvF593XTTFg3gxeU4f+UWnswa6JPhzaR6+zblO5+fjltJWIZc4aUalqTclvN2QtTC37LxvZAA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-linux-arm64-gnu": {
+      "version": "14.2.33",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-14.2.33.tgz",
+      "integrity": "sha512-JXMBka6lNNmqbkvcTtaX8Gu5by9547bukHQvPoLe9VRBx1gHwzf5tdt4AaezW85HAB3pikcvyqBToRTDA4DeLw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-linux-arm64-musl": {
+      "version": "14.2.33",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-14.2.33.tgz",
+      "integrity": "sha512-Bm+QulsAItD/x6Ih8wGIMfRJy4G73tu1HJsrccPW6AfqdZd0Sfm5Imhgkgq2+kly065rYMnCOxTBvmvFY1BKfg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-linux-x64-gnu": {
+      "version": "14.2.33",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-14.2.33.tgz",
+      "integrity": "sha512-FnFn+ZBgsVMbGDsTqo8zsnRzydvsGV8vfiWwUo1LD8FTmPTdV+otGSWKc4LJec0oSexFnCYVO4hX8P8qQKaSlg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-linux-x64-musl": {
+      "version": "14.2.33",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-14.2.33.tgz",
+      "integrity": "sha512-345tsIWMzoXaQndUTDv1qypDRiebFxGYx9pYkhwY4hBRaOLt8UGfiWKr9FSSHs25dFIf8ZqIFaPdy5MljdoawA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-win32-arm64-msvc": {
+      "version": "14.2.33",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-14.2.33.tgz",
+      "integrity": "sha512-nscpt0G6UCTkrT2ppnJnFsYbPDQwmum4GNXYTeoTIdsmMydSKFz9Iny2jpaRupTb+Wl298+Rh82WKzt9LCcqSQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-win32-ia32-msvc": {
+      "version": "14.2.33",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-ia32-msvc/-/swc-win32-ia32-msvc-14.2.33.tgz",
+      "integrity": "sha512-pc9LpGNKhJ0dXQhZ5QMmYxtARwwmWLpeocFmVG5Z0DzWq5Uf0izcI8tLc+qOpqxO1PWqZ5A7J1blrUIKrIFc7Q==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-win32-x64-msvc": {
+      "version": "14.2.33",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-14.2.33.tgz",
+      "integrity": "sha512-nOjfZMy8B94MdisuzZo9/57xuFVLHJaDj5e/xrduJp9CV2/HrfxTRH2fbyLe+K9QT41WBLUd4iXX3R7jBp0EUg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@swc/counter": {
+      "version": "0.1.3",
+      "resolved": "https://registry.npmjs.org/@swc/counter/-/counter-0.1.3.tgz",
+      "integrity": "sha512-e2BR4lsJkkRlKZ/qCHPw9ZaSxc0MVUd7gtbtaB7aMvHeJVYe8sOB8DBZkP2DtISHGSku9sCK6T6cnY0CtXrOCQ==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/@swc/helpers": {
+      "version": "0.5.5",
+      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.5.tgz",
+      "integrity": "sha512-KGYxvIOXcceOAbEk4bi/dVLEK9z8sZ0uBB3Il5b1rhfClSpcX0yfRO0KmTkqR2cnQDymwLB+25ZyMzICg/cm/A==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@swc/counter": "^0.1.3",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@types/node": {
+      "version": "20.19.37",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.37.tgz",
+      "integrity": "sha512-8kzdPJ3FsNsVIurqBs7oodNnCEVbni9yUEkaHbgptDACOPW04jimGagZ51E6+lXUwJjgnBw+hyko/lkFWCldqw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~6.21.0"
+      }
+    },
+    "node_modules/@types/prop-types": {
+      "version": "15.7.15",
+      "resolved": "https://registry.npmjs.org/@types/prop-types/-/prop-types-15.7.15.tgz",
+      "integrity": "sha512-F6bEyamV9jKGAFBEmlQnesRPGOQqS2+Uwi0Em15xenOxHaf2hv6L8YCVn3rPdPJOiJfPiCnLIRyvwVaqMY3MIw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/react": {
+      "version": "18.3.28",
+      "resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.28.tgz",
+      "integrity": "sha512-z9VXpC7MWrhfWipitjNdgCauoMLRdIILQsAEV+ZesIzBq/oUlxk0m3ApZuMFCXdnS4U7KrI+l3WRUEGQ8K1QKw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/prop-types": "*",
+        "csstype": "^3.2.2"
+      }
+    },
+    "node_modules/busboy": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/busboy/-/busboy-1.6.0.tgz",
+      "integrity": "sha512-8SFQbg/0hQ9xy3UNTB0YEnsNBbWfhf7RtnzpL7TkBiTBRfrQ9Fxcnz7VJsleJpyp6rVLvXiuORqjlHi5q+PYuA==",
+      "dependencies": {
+        "streamsearch": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=10.16.0"
+      }
+    },
+    "node_modules/caniuse-lite": {
+      "version": "1.0.30001777",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001777.tgz",
+      "integrity": "sha512-tmN+fJxroPndC74efCdp12j+0rk0RHwV5Jwa1zWaFVyw2ZxAuPeG8ZgWC3Wz7uSjT3qMRQ5XHZ4COgQmsCMJAQ==",
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/caniuse-lite"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "CC-BY-4.0"
+    },
+    "node_modules/client-only": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/client-only/-/client-only-0.0.1.tgz",
+      "integrity": "sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA==",
+      "license": "MIT"
+    },
+    "node_modules/csstype": {
+      "version": "3.2.3",
+      "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
+      "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/graceful-fs": {
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "license": "ISC"
+    },
+    "node_modules/js-tokens": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
+      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
+      "license": "MIT"
+    },
+    "node_modules/loose-envify": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/loose-envify/-/loose-envify-1.4.0.tgz",
+      "integrity": "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==",
+      "license": "MIT",
+      "dependencies": {
+        "js-tokens": "^3.0.0 || ^4.0.0"
+      },
+      "bin": {
+        "loose-envify": "cli.js"
+      }
+    },
+    "node_modules/nanoid": {
+      "version": "3.3.11",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
+      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
+    "node_modules/next": {
+      "version": "14.2.35",
+      "resolved": "https://registry.npmjs.org/next/-/next-14.2.35.tgz",
+      "integrity": "sha512-KhYd2Hjt/O1/1aZVX3dCwGXM1QmOV4eNM2UTacK5gipDdPN/oHHK/4oVGy7X8GMfPMsUTUEmGlsy0EY1YGAkig==",
+      "license": "MIT",
+      "dependencies": {
+        "@next/env": "14.2.35",
+        "@swc/helpers": "0.5.5",
+        "busboy": "1.6.0",
+        "caniuse-lite": "^1.0.30001579",
+        "graceful-fs": "^4.2.11",
+        "postcss": "8.4.31",
+        "styled-jsx": "5.1.1"
+      },
+      "bin": {
+        "next": "dist/bin/next"
+      },
+      "engines": {
+        "node": ">=18.17.0"
+      },
+      "optionalDependencies": {
+        "@next/swc-darwin-arm64": "14.2.33",
+        "@next/swc-darwin-x64": "14.2.33",
+        "@next/swc-linux-arm64-gnu": "14.2.33",
+        "@next/swc-linux-arm64-musl": "14.2.33",
+        "@next/swc-linux-x64-gnu": "14.2.33",
+        "@next/swc-linux-x64-musl": "14.2.33",
+        "@next/swc-win32-arm64-msvc": "14.2.33",
+        "@next/swc-win32-ia32-msvc": "14.2.33",
+        "@next/swc-win32-x64-msvc": "14.2.33"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.1.0",
+        "@playwright/test": "^1.41.2",
+        "react": "^18.2.0",
+        "react-dom": "^18.2.0",
+        "sass": "^1.3.0"
+      },
+      "peerDependenciesMeta": {
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "@playwright/test": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/picocolors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "license": "ISC"
+    },
+    "node_modules/postcss": {
+      "version": "8.4.31",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz",
+      "integrity": "sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==",
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.6",
+        "picocolors": "^1.0.0",
+        "source-map-js": "^1.0.2"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
+    "node_modules/react": {
+      "version": "18.3.1",
+      "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
+      "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
+      "license": "MIT",
+      "dependencies": {
+        "loose-envify": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/react-dom": {
+      "version": "18.3.1",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz",
+      "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==",
+      "license": "MIT",
+      "dependencies": {
+        "loose-envify": "^1.1.0",
+        "scheduler": "^0.23.2"
+      },
+      "peerDependencies": {
+        "react": "^18.3.1"
+      }
+    },
+    "node_modules/scheduler": {
+      "version": "0.23.2",
+      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.23.2.tgz",
+      "integrity": "sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ==",
+      "license": "MIT",
+      "dependencies": {
+        "loose-envify": "^1.1.0"
+      }
+    },
+    "node_modules/source-map-js": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/streamsearch": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/streamsearch/-/streamsearch-1.1.0.tgz",
+      "integrity": "sha512-Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg==",
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
+    "node_modules/styled-jsx": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/styled-jsx/-/styled-jsx-5.1.1.tgz",
+      "integrity": "sha512-pW7uC1l4mBZ8ugbiZrcIsiIvVx1UmTfw7UkC3Um2tmfUq9Bhk8IiyEIPl6F8agHgjzku6j0xQEZbfA5uSgSaCw==",
+      "license": "MIT",
+      "dependencies": {
+        "client-only": "0.0.1"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "peerDependencies": {
+        "react": ">= 16.8.0 || 17.x.x || ^18.0.0-0"
+      },
+      "peerDependenciesMeta": {
+        "@babel/core": {
+          "optional": true
+        },
+        "babel-plugin-macros": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "6.21.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
+      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+      "dev": true,
+      "license": "MIT"
+    }
+  }
+}
diff --git a/crates/integration-tests/tests/environments/fastly.rs b/crates/integration-tests/tests/environments/fastly.rs
index 5f055201..09822ffd 100644
--- a/crates/integration-tests/tests/environments/fastly.rs
+++ b/crates/integration-tests/tests/environments/fastly.rs
@@ -2,8 +2,9 @@ use crate::common::runtime::{
     RuntimeEnvironment, RuntimeProcess, RuntimeProcessHandle, TestError, TestResult,
 };
 use error_stack::ResultExt as _;
+use std::io::{BufRead as _, BufReader};
 use std::path::Path;
-use std::process::{Child, Command};
+use std::process::{Child, Command, Stdio};
 
 /// Fastly Compute runtime using Viceroy local simulator.
 ///
@@ -23,16 +24,29 @@ impl RuntimeEnvironment for FastlyViceroy {
 
         let viceroy_config = self.viceroy_config_path();
 
-        let child = Command::new("viceroy")
+        let mut child = Command::new("viceroy")
             .arg(wasm_path)
             .arg("-C")
             .arg(&viceroy_config)
             .arg("--addr")
             .arg(format!("127.0.0.1:{port}"))
+            .stdout(Stdio::null())
+            .stderr(Stdio::piped())
             .spawn()
             .change_context(TestError::RuntimeSpawn)
             .attach("Failed to spawn viceroy process")?;
 
+        if let Some(stderr) = child.stderr.take() {
+            std::thread::spawn(move || {
+                let reader = BufReader::new(stderr);
+                for line in reader.lines().map_while(Result::ok) {
+                    if !line.is_empty() {
+                        log::debug!("viceroy: {line}");
+                    }
+                }
+            });
+        }
+
         // Wrap immediately so Drop::drop kills the process if readiness check fails
         let handle = ViceroyHandle { child };
         let base_url = format!("http://127.0.0.1:{port}");
@@ -46,7 +60,7 @@ impl RuntimeEnvironment for FastlyViceroy {
     }
 
     fn health_check_path(&self) -> &str {
-        "/__trusted-server/health"
+        "/"
     }
 }
 
diff --git a/crates/integration-tests/tests/environments/mod.rs b/crates/integration-tests/tests/environments/mod.rs
index 8eeb98a9..e7cc0c4d 100644
--- a/crates/integration-tests/tests/environments/mod.rs
+++ b/crates/integration-tests/tests/environments/mod.rs
@@ -2,6 +2,7 @@ pub mod fastly;
 
 use crate::common::runtime::{RuntimeEnvironment, TestError, TestResult};
 use error_stack::Report;
+use std::time::Duration;
 
 /// Runtime factory function type — avoids trait object static initialization issues.
 type RuntimeFactory = fn() -> Box<dyn RuntimeEnvironment>;
@@ -19,6 +20,15 @@ type RuntimeFactory = fn() -> Box<dyn RuntimeEnvironment>;
 /// 3. Add factory closure here
 pub static RUNTIME_ENVIRONMENTS: &[RuntimeFactory] = &[|| Box::new(fastly::FastlyViceroy)];
 
+/// Readiness polling configuration for runtimes and frontend containers.
+pub(crate) struct ReadyCheckOptions {
+    pub(crate) max_attempts: usize,
+    pub(crate) interval: Duration,
+    pub(crate) fallback_to_root: bool,
+    pub(crate) timeout_error: TestError,
+    pub(crate) timeout_message: String,
+}
+
 /// Find an available TCP port for the runtime to bind to.
 ///
 /// Binds to port 0, which asks the OS to assign a random available port,
@@ -48,24 +58,51 @@ pub fn find_available_port() -> TestResult<u16> {
 ///
 /// Returns [`TestError::RuntimeNotReady`] if the runtime does not respond within timeout.
 pub fn wait_for_ready(base_url: &str, health_path: &str) -> TestResult<()> {
+    wait_for_http_ready(
+        base_url,
+        health_path,
+        ReadyCheckOptions {
+            max_attempts: 30,
+            interval: Duration::from_millis(500),
+            fallback_to_root: true,
+            timeout_error: TestError::RuntimeNotReady,
+            timeout_message: format!("Runtime at {base_url} not ready after 15s"),
+        },
+    )
+}
+
+/// Poll an HTTP endpoint until it responds successfully.
+///
+/// When `fallback_to_root` is enabled, a successful or 404 response from the
+/// base URL also counts as ready. This is useful for runtimes that proxy to an
+/// origin but do not expose a dedicated health endpoint.
+///
+/// # Errors
+///
+/// Returns the configured timeout error if the endpoint does not become ready.
+pub(crate) fn wait_for_http_ready(
+    base_url: &str,
+    health_path: &str,
+    options: ReadyCheckOptions,
+) -> TestResult<()> {
     let health_url = format!("{}{}", base_url, health_path);
 
-    for _ in 0..30 {
+    for _ in 0..options.max_attempts {
         if let Ok(resp) = reqwest::blocking::get(&health_url)
             && resp.status().is_success()
         {
             return Ok(());
         }
 
-        // Fallback: try root path — a 404 means the server is responsive
-        if let Ok(resp) = reqwest::blocking::get(base_url)
+        if options.fallback_to_root
+            && let Ok(resp) = reqwest::blocking::get(base_url)
             && (resp.status().is_success() || resp.status().as_u16() == 404)
         {
             return Ok(());
         }
 
-        std::thread::sleep(std::time::Duration::from_millis(500));
+        std::thread::sleep(options.interval);
     }
 
-    Err(Report::new(TestError::RuntimeNotReady))
+    Err(Report::new(options.timeout_error).attach(options.timeout_message))
 }
diff --git a/crates/integration-tests/tests/frameworks/mod.rs b/crates/integration-tests/tests/frameworks/mod.rs
index 0d8d86ae..e77fb9b9 100644
--- a/crates/integration-tests/tests/frameworks/mod.rs
+++ b/crates/integration-tests/tests/frameworks/mod.rs
@@ -29,7 +29,10 @@ pub trait FrontendFramework: Send + Sync {
     ///
     /// # Errors
     ///
-    /// Returns [`TestError::ContainerStart`] if the image cannot be created.
+    /// Returns [`TestError::ContainerStart`] when an implementation needs to
+    /// validate or derive container configuration before startup. The in-tree
+    /// frameworks currently return `Ok(...)`, but the trait remains fallible so
+    /// future builders can fail with context instead of panicking.
     fn build_container(&self, origin_port: u16) -> TestResult<ContainerRequest<GenericImage>>;
 
     /// Port the framework serves on inside the container.
diff --git a/crates/integration-tests/tests/frameworks/scenarios.rs b/crates/integration-tests/tests/frameworks/scenarios.rs
index 2a171b60..333a9387 100644
--- a/crates/integration-tests/tests/frameworks/scenarios.rs
+++ b/crates/integration-tests/tests/frameworks/scenarios.rs
@@ -269,7 +269,12 @@ impl CustomScenario {
                     ))?;
 
                 let status = resp.status().as_u16();
-                let body = resp.text().unwrap_or_default();
+                let body = resp
+                    .text()
+                    .change_context(TestError::ResponseParse)
+                    .attach(format!(
+                        "scenario: NextJsServerActions, framework: {framework_id}"
+                    ))?;
 
                 // Next.js returns 404 for unknown server action IDs.
                 // With App Router client components in the layout, Next.js
diff --git a/crates/integration-tests/tests/integration.rs b/crates/integration-tests/tests/integration.rs
index 168a2ba4..2ecff716 100644
--- a/crates/integration-tests/tests/integration.rs
+++ b/crates/integration-tests/tests/integration.rs
@@ -1,15 +1,16 @@
-// Many items in common/environments/frameworks are defined for use by
-// Docker-dependent integration tests that only run when Docker is available.
-// The compiler sees them as unused when analysing the test binary alone.
-#![allow(dead_code, unused_imports)]
-
+// These modules are shared by ignored Docker-backed tests and unit tests
+// inside the same integration test target, so some items are intentionally
+// unused in a plain `cargo test` compile.
+#[allow(dead_code, unused_imports)]
 mod common;
+#[allow(dead_code, unused_imports)]
 mod environments;
+#[allow(dead_code, unused_imports)]
 mod frameworks;
 
 use common::runtime::{TestError, origin_port, wasm_binary_path};
-use environments::RUNTIME_ENVIRONMENTS;
-use error_stack::{Report, ResultExt as _};
+use environments::{RUNTIME_ENVIRONMENTS, ReadyCheckOptions, wait_for_http_ready};
+use error_stack::ResultExt as _;
 use frameworks::{FRAMEWORKS, FrontendFramework};
 use std::time::Duration;
 use testcontainers::runners::SyncRunner as _;
@@ -81,7 +82,17 @@ fn test_combination(
     let origin_url = format!("http://127.0.0.1:{port}");
 
     // Wait for container to be ready
-    wait_for_container(&origin_url, framework.health_check_path())?;
+    wait_for_http_ready(
+        &origin_url,
+        framework.health_check_path(),
+        ReadyCheckOptions {
+            max_attempts: 60,
+            interval: Duration::from_millis(500),
+            fallback_to_root: false,
+            timeout_error: TestError::ContainerTimeout,
+            timeout_message: format!("Container at {origin_url} not ready after 30s"),
+        },
+    )?;
 
     // 2. Spawn runtime process with the pre-built WASM binary
     let wasm_path = wasm_binary_path();
@@ -112,36 +123,6 @@ fn test_combination(
 
     Ok(())
 }
-
-/// Wait for a Docker container's health endpoint to respond successfully.
-///
-/// Retries up to 60 times with 500ms delay (total ~30s). Uses a longer
-/// budget than `wait_for_ready` because container cold-starts
-/// include image pull, filesystem setup, and application init time.
-///
-/// Unlike `wait_for_ready`, this function does not fall back to the root path —
-/// containers are expected to expose a reliable health endpoint.
-///
-/// # Errors
-///
-/// Returns [`TestError::ContainerTimeout`] if the health endpoint does not
-/// respond with a success status within the timeout.
-fn wait_for_container(base_url: &str, health_path: &str) -> common::runtime::TestResult<()> {
-    let url = format!("{base_url}{health_path}");
-
-    for _ in 0..60 {
-        if let Ok(resp) = reqwest::blocking::get(&url)
-            && resp.status().is_success()
-        {
-            return Ok(());
-        }
-        std::thread::sleep(Duration::from_millis(500));
-    }
-
-    Err(Report::new(TestError::ContainerTimeout)
-        .attach(format!("Container at {base_url} not ready after 30s")))
-}
-
 // Individual test functions for faster iteration during development.
 
 #[test]
diff --git a/scripts/check-integration-dependency-versions.sh b/scripts/check-integration-dependency-versions.sh
new file mode 100755
index 00000000..aa960aac
--- /dev/null
+++ b/scripts/check-integration-dependency-versions.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+#
+# Ensure the excluded integration-tests crate resolves the same shared direct
+# dependency versions as the workspace, and that its own lockfile is current.
+#
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+extract_resolved_direct_dependencies() {
+    sed -En 's/^([A-Za-z0-9_-]+) v([^ ]+).*/\1\t\2/p' | sort -u
+}
+
+workspace_dependencies="$(mktemp)"
+integration_dependencies="$(mktemp)"
+workspace_names="$(mktemp)"
+integration_names="$(mktemp)"
+shared_names="$(mktemp)"
+trap 'rm -f "$workspace_dependencies" "$integration_dependencies" "$workspace_names" "$integration_names" "$shared_names"' EXIT
+
+cargo tree --workspace --depth 1 --prefix none \
+    | extract_resolved_direct_dependencies >"$workspace_dependencies"
+cargo tree \
+    --manifest-path "$REPO_ROOT/crates/integration-tests/Cargo.toml" \
+    --depth 1 \
+    --prefix none \
+    --locked \
+    | extract_resolved_direct_dependencies >"$integration_dependencies"
+
+cut -f1 "$workspace_dependencies" | sort -u >"$workspace_names"
+cut -f1 "$integration_dependencies" | sort -u >"$integration_names"
+comm -12 "$workspace_names" "$integration_names" >"$shared_names"
+
+status=0
+while IFS= read -r dependency_name; do
+    workspace_versions="$(
+        awk -F "$(printf '\t')" -v dep="$dependency_name" '$1 == dep { print $2 }' \
+            "$workspace_dependencies" | sort -u | paste -sd ',' -
+    )"
+    integration_versions="$(
+        awk -F "$(printf '\t')" -v dep="$dependency_name" '$1 == dep { print $2 }' \
+            "$integration_dependencies" | sort -u | paste -sd ',' -
+    )"
+
+    if [ -z "$workspace_versions" ] || [ -z "$integration_versions" ]; then
+        echo "Missing resolved version for shared dependency $dependency_name in one of the lockfiles" >&2
+        status=1
+        continue
+    fi
+
+    if [ "$workspace_versions" != "$integration_versions" ]; then
+        echo "Shared dependency version mismatch for $dependency_name: workspace=$workspace_versions integration-tests=$integration_versions" >&2
+        status=1
+    fi
+done <"$shared_names"
+
+exit "$status"
diff --git a/scripts/integration-tests-browser.sh b/scripts/integration-tests-browser.sh
index 90e20a7d..3d2c7ede 100755
--- a/scripts/integration-tests-browser.sh
+++ b/scripts/integration-tests-browser.sh
@@ -18,6 +18,15 @@ cd "$REPO_ROOT"
 
 ORIGIN_PORT="${INTEGRATION_ORIGIN_PORT:-8888}"
 BROWSER_DIR="crates/integration-tests/browser"
+NODE_VERSION="$(grep '^nodejs ' .tool-versions | awk '{print $2}')"
+
+if [ -z "$NODE_VERSION" ]; then
+    echo "Failed to detect Node.js version from .tool-versions" >&2
+    exit 1
+fi
+
+echo "==> Validating shared integration-test dependency versions..."
+./scripts/check-integration-dependency-versions.sh
 
 # --- Build WASM binary ---
 echo "==> Building WASM binary (origin=http://127.0.0.1:$ORIGIN_PORT)..."
@@ -31,7 +40,9 @@ docker build -t test-wordpress:latest \
     crates/integration-tests/fixtures/frameworks/wordpress/
 
 echo "==> Building Next.js test container..."
-docker build -t test-nextjs:latest \
+docker build \
+    --build-arg NODE_VERSION="$NODE_VERSION" \
+    -t test-nextjs:latest \
     crates/integration-tests/fixtures/frameworks/nextjs/
 
 # --- Install Playwright ---
@@ -46,11 +57,18 @@ export INTEGRATION_ORIGIN_PORT="$ORIGIN_PORT"
 export VICEROY_CONFIG_PATH="$REPO_ROOT/crates/integration-tests/fixtures/configs/viceroy-template.toml"
 
 # Cleanup trap: stop any leftover containers on failure
+stop_matching_containers() {
+    local image="$1"
+    local ids
+    ids="$(docker ps -q --filter "ancestor=$image" 2>/dev/null || true)"
+    if [ -n "$ids" ]; then
+        printf '%s\n' "$ids" | xargs docker stop 2>/dev/null || true
+    fi
+}
+
 cleanup() {
-    docker ps -q \
-        --filter ancestor=test-nextjs:latest \
-        --filter ancestor=test-wordpress:latest \
-        2>/dev/null | xargs -r docker stop 2>/dev/null || true
+    stop_matching_containers test-nextjs:latest
+    stop_matching_containers test-wordpress:latest
 }
 trap cleanup EXIT
 
diff --git a/scripts/integration-tests.sh b/scripts/integration-tests.sh
index 316d416c..c7b64cde 100755
--- a/scripts/integration-tests.sh
+++ b/scripts/integration-tests.sh
@@ -19,6 +19,29 @@ cd "$REPO_ROOT"
 # Docker containers are mapped to this port so the trusted-server
 # can proxy requests to them.
 ORIGIN_PORT="${INTEGRATION_ORIGIN_PORT:-8888}"
+NODE_VERSION="$(grep '^nodejs ' .tool-versions | awk '{print $2}')"
+TEST_ARGS=("$@")
+SKIP_DUPLICATE_HELPERS=true
+
+if [ -z "$NODE_VERSION" ]; then
+    echo "Failed to detect Node.js version from .tool-versions" >&2
+    exit 1
+fi
+
+echo "==> Validating shared integration-test dependency versions..."
+./scripts/check-integration-dependency-versions.sh
+
+for arg in "$@"; do
+    case "$arg" in
+        test_wordpress_fastly|test_nextjs_fastly)
+            SKIP_DUPLICATE_HELPERS=false
+            ;;
+    esac
+done
+
+if [ "$SKIP_DUPLICATE_HELPERS" = true ]; then
+    TEST_ARGS=(--skip test_wordpress_fastly --skip test_nextjs_fastly "${TEST_ARGS[@]}")
+fi
 
 # Detect native target from rustc (handles all OS + arch combinations correctly)
 TARGET="$(rustc -vV | sed -n 's/^host: //p')"
@@ -37,7 +60,9 @@ docker build -t test-wordpress:latest \
     crates/integration-tests/fixtures/frameworks/wordpress/
 
 echo "==> Building Next.js test container..."
-docker build -t test-nextjs:latest \
+docker build \
+    --build-arg NODE_VERSION="$NODE_VERSION" \
+    -t test-nextjs:latest \
     crates/integration-tests/fixtures/frameworks/nextjs/
 
 echo "==> Running integration tests (target: $TARGET, origin port: $ORIGIN_PORT)..."
@@ -47,4 +72,4 @@ RUST_LOG=info \
     cargo test \
         --manifest-path crates/integration-tests/Cargo.toml \
         --target "$TARGET" \
-        -- --include-ignored --test-threads=1 "$@"
+        -- --include-ignored --test-threads=1 "${TEST_ARGS[@]}"