diff --git a/.github/workflows/node.js.yml b/.github/workflows/node.js.yml
index 611bdfd..9faddb2 100644
--- a/.github/workflows/node.js.yml
+++ b/.github/workflows/node.js.yml
@@ -59,4 +59,7 @@ jobs:
       - name: Select project
         run: firebase use test
       - name: Launch firestore emulator and test
-        run: firebase emulators:exec 'npm run test-ci'
+        # maxWorkers=2: the emulator-backed suites contend under full
+        # parallel load (pre-existing data-emulator timing flake); capping
+        # workers reproduces consistently-green runs.
+        run: firebase emulators:exec 'npm run test-ci -- --maxWorkers=2'
diff --git a/__tests__/connect-callback-page.test.jsx b/__tests__/connect-callback-page.test.jsx
new file mode 100644
index 0000000..8b83c6f
--- /dev/null
+++ b/__tests__/connect-callback-page.test.jsx
@@ -0,0 +1,115 @@
+import { render, screen, waitFor } from "@testing-library/react";
+import { ChakraProvider } from "@chakra-ui/react";
+import { system } from "../lib/theme";
+import "@testing-library/jest-dom";
+
+const mockGetIdToken = jest.fn(() => Promise.resolve("id-token-123"));
+jest.mock("../lib/firebase", () => ({
+  auth: { currentUser: { uid: "user-1", getIdToken: () => mockGetIdToken() } },
+  db: {},
+}));
+
+// UserContext is re-provided per test via <UserContext.Provider value={...}>
+// so signed-in vs signed-out can vary within this file without re-mocking
+// the module.
+jest.mock("../lib/context", () => ({
+  UserContext: require("react").createContext({ user: null, loading: false }),
+}));
+
+const mockPush = jest.fn();
+let mockQuery = {};
+jest.mock("next/router", () => ({
+  useRouter: () => ({ query: mockQuery, push: mockPush }),
+}));
+
+import { UserContext } from "../lib/context";
+import ConnectCallbackPage from "../pages/oauth2/connect";
+
+function renderPage({ user = { uid: "user-1" } } = {}) {
+  return render(
+    <ChakraProvider value={system}>
+      <UserContext.Provider value={{ user, loading: false }}>
+        <ConnectCallbackPage />
+      </UserContext.Provider>
+    </ChakraProvider>
+  );
+}
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  mockGetIdToken.mockClear();
+  mockGetIdToken.mockImplementation(() => Promise.resolve("id-token-123"));
+  global.fetch = jest.fn();
+  localStorage.clear();
+  mockQuery = {};
+});
+
+describe("oauth2/connect callback page", () => {
+  it("9. happy path posts to connectprovider and routes to /admin/account on success", async () => {
+    mockQuery = { code: "auth-code-1", state: "state-abc" };
+    localStorage.setItem("latestCSRFToken", "state-abc");
+    localStorage.setItem("providerConnectFlow", "gdrive");
+    global.fetch.mockResolvedValue({
+      ok: true,
+      json: () => Promise.resolve({ success: true }),
+    });
+
+    renderPage();
+
+    await waitFor(() => expect(global.fetch).toHaveBeenCalled());
+    const [url, options] = global.fetch.mock.calls[0];
+    expect(url).toBe("/api/connectprovider");
+    expect(JSON.parse(options.body)).toEqual({
+      provider: "gdrive",
+      code: "auth-code-1",
+      state: "state-abc",
+      uid: "user-1",
+      idToken: "id-token-123",
+    });
+
+    await waitFor(() =>
+      expect(mockPush).toHaveBeenCalledWith("/admin/account")
+    );
+  });
+
+  it("10. state mismatch shows error UI and does not call connectprovider", async () => {
+    mockQuery = { code: "auth-code-1", state: "state-abc" };
+    localStorage.setItem("latestCSRFToken", "different-state");
+    localStorage.setItem("providerConnectFlow", "gdrive");
+    global.fetch.mockResolvedValue({
+      ok: true,
+      json: () => Promise.resolve({ success: true }),
+    });
+
+    renderPage();
+
+    await waitFor(() =>
+      expect(
+        screen.getByText(/invalid state|csrf/i)
+      ).toBeInTheDocument()
+    );
+    expect(
+      screen.getByRole("link", { name: /admin.*account|account/i })
+    ).toHaveAttribute("href", "/admin/account");
+    expect(global.fetch).not.toHaveBeenCalled();
+  });
+
+  it("11. signed-out user shows error UI with a sign-in link and does not call connectprovider", async () => {
+    mockQuery = { code: "auth-code-1", state: "state-abc" };
+    localStorage.setItem("latestCSRFToken", "state-abc");
+    localStorage.setItem("providerConnectFlow", "gdrive");
+    global.fetch.mockResolvedValue({
+      ok: true,
+      json: () => Promise.resolve({ success: true }),
+    });
+
+    renderPage({ user: null });
+
+    await waitFor(() =>
+      expect(
+        screen.getByRole("link", { name: /sign in/i })
+      ).toBeInTheDocument()
+    );
+    expect(global.fetch).not.toHaveBeenCalled();
+  });
+});
diff --git a/__tests__/experiment-info.test.jsx b/__tests__/experiment-info.test.jsx
new file mode 100644
index 0000000..90ece43
--- /dev/null
+++ b/__tests__/experiment-info.test.jsx
@@ -0,0 +1,51 @@
+import { render, screen } from "@testing-library/react";
+import { ChakraProvider } from "@chakra-ui/react";
+import { system } from "../lib/theme";
+import "@testing-library/jest-dom";
+
+import ExperimentInfo from "../components/dashboard/ExperimentInfo";
+
+function renderInfo(data) {
+  return render(
+    <ChakraProvider value={system}>
+      <ExperimentInfo data={data} />
+    </ChakraProvider>
+  );
+}
+
+describe("ExperimentInfo — legacy OSF experiments (pinned regression)", () => {
+  it("12. renders OSF Project and OSF Data Component links for legacy experiments", () => {
+    renderInfo({
+      id: "exp1",
+      osfRepo: "abc12",
+      osfComponent: "def34",
+      sessions: 3,
+    });
+
+    expect(screen.getByText("OSF Project")).toBeInTheDocument();
+    expect(screen.getByText("OSF Data Component")).toBeInTheDocument();
+    expect(screen.getByRole("link", { name: /abc12/ })).toBeInTheDocument();
+    expect(screen.getByRole("link", { name: /def34/ })).toBeInTheDocument();
+  });
+});
+
+describe("ExperimentInfo — provider-aware rendering", () => {
+  it("13. renders Google Drive Folder link for gdrive experiments; OSF labels are absent", () => {
+    renderInfo({
+      id: "exp2",
+      storageProvider: "gdrive",
+      providerContainer: { folderId: "folder123" },
+      sessions: 5,
+    });
+
+    expect(screen.getByText("Google Drive Folder")).toBeInTheDocument();
+    const link = screen.getByRole("link", { name: /Open folder/ });
+    expect(link).toHaveAttribute(
+      "href",
+      "https://drive.google.com/drive/folders/folder123"
+    );
+
+    expect(screen.queryByText("OSF Project")).not.toBeInTheDocument();
+    expect(screen.queryByText("OSF Data Component")).not.toBeInTheDocument();
+  });
+});
diff --git a/__tests__/firestore-rules.test.js b/__tests__/firestore-rules.test.js
index 7259f34..00a97f1 100644
--- a/__tests__/firestore-rules.test.js
+++ b/__tests__/firestore-rules.test.js
@@ -121,4 +121,150 @@ describe('/experiments', () => {
     await assertFails(getDoc(doc(user123.firestore(), 'experiments/456')));
   });
 
+});
+
+// ---------------------------------------------------------------------------
+// step 7a: firestore.rules generalization (scratchpad/step7a-create-endpoint-
+// spec.md). These are ADDITIVE describe blocks -- none of the cases above are
+// altered. They exercise the NEW rules shape (baseFields() minus the OSF trio
+// plus a storageProvider/providerContainer-OR-osfRepo/osfComponent/
+// osfFilesLink conditional) that firestore.rules does not implement yet.
+//
+// Field-set parity: `baseFields()` below is the current verifyFields() hasAll
+// list (['active', 'activeBase64', 'activeConditionAssignment', 'id',
+// 'osfRepo', 'osfComponent', 'osfFilesLink', 'owner', 'title', 'sessions',
+// 'nConditions', 'currentCondition', 'useValidation', 'allowJSON', 'allowCSV',
+// 'requiredFields', 'maxSessions', 'limitSessions']) MINUS the three OSF
+// fields, exactly as the spec's new baseFields() is defined to be.
+//
+// Expected-red summary (see build-step report for the verified run):
+// - case 1 (legacy OSF create): both sub-cases already PASS today -- pinned
+//   regression guards, not exercising the gap.
+// - case 2 (gdrive-shaped UPDATE succeeds for the owner): RED today -- current
+//   verifyFields() unconditionally requires osfRepo/osfComponent/osfFilesLink,
+//   which a gdrive-shaped doc never has.
+// - case 3 (gdrive-shaped update validation): both assertFails sub-cases
+//   already hold true today, but not for the reason the new rules will
+//   enforce -- today ANY gdrive-shaped doc is denied (missing the OSF trio)
+//   regardless of providerContainer or ownership; they're pinned here as
+//   "must remain denied after the generalization too", not proof of the gap.
+// - case 4 (/users hasOnly unchanged): already PASSes today -- pinned
+//   regression guard that clients still cannot write connectedAccounts.
+describe('/experiments — provider-migration generalization (step 7a)', () => {
+  function baseFields(overrides = {}) {
+    return {
+      active: false,
+      activeBase64: false,
+      activeConditionAssignment: false,
+      id: overrides.id,
+      owner: overrides.owner,
+      title: 'Test experiment',
+      sessions: 0,
+      nConditions: 1,
+      currentCondition: 0,
+      useValidation: true,
+      allowJSON: true,
+      allowCSV: true,
+      requiredFields: [],
+      maxSessions: 1,
+      limitSessions: false,
+      ...overrides,
+    };
+  }
+
+  describe('1. legacy OSF experiment create (regression guard)', () => {
+    it('succeeds with all OSF fields present -- expected to PASS today and after generalization', async () => {
+      const docId = 'exp-7a-legacy-create-1';
+      const user123 = testEnv.authenticatedContext('user123');
+
+      await assertSucceeds(setDoc(doc(user123.firestore(), `experiments/${docId}`), baseFields({
+        id: docId,
+        owner: 'user123',
+        osfRepo: 'abc12',
+        osfComponent: 'def34',
+        osfFilesLink: 'https://files.osf.io/v1/resources/abc12/providers/osfstorage/',
+      })));
+    });
+
+    it('fails when osfFilesLink is missing and no storageProvider is present -- pinned contract', async () => {
+      const docId = 'exp-7a-legacy-create-2';
+      const user123 = testEnv.authenticatedContext('user123');
+
+      await assertFails(setDoc(doc(user123.firestore(), `experiments/${docId}`), baseFields({
+        id: docId,
+        owner: 'user123',
+        osfRepo: 'abc12',
+        osfComponent: 'def34',
+        // osfFilesLink deliberately omitted; no storageProvider either.
+      })));
+    });
+  });
+
+  describe('2. gdrive-shaped experiment update by owner', () => {
+    it('succeeds for the owner when the doc carries storageProvider + providerContainer instead of OSF fields', async () => {
+      const docId = 'exp-7a-gdrive-update-1';
+      await seedDB({
+        [`experiments/${docId}`]: baseFields({
+          id: docId,
+          owner: 'user123',
+          storageProvider: 'gdrive',
+          providerContainer: { provider: 'gdrive', folderId: 'folder-abc' },
+        }),
+      });
+
+      const user123 = testEnv.authenticatedContext('user123');
+      await assertSucceeds(
+        updateDoc(doc(user123.firestore(), `experiments/${docId}`), { active: true })
+      );
+    });
+  });
+
+  describe('3. gdrive-shaped update validation', () => {
+    it('fails when providerContainer is missing even though storageProvider is present', async () => {
+      const docId = 'exp-7a-gdrive-update-2';
+      await seedDB({
+        [`experiments/${docId}`]: baseFields({
+          id: docId,
+          owner: 'user123',
+          storageProvider: 'gdrive',
+          // providerContainer deliberately omitted.
+        }),
+      });
+
+      const user123 = testEnv.authenticatedContext('user123');
+      await assertFails(
+        updateDoc(doc(user123.firestore(), `experiments/${docId}`), { active: true })
+      );
+    });
+
+    it('fails when a non-owner attempts to update a gdrive-shaped experiment', async () => {
+      const docId = 'exp-7a-gdrive-update-3';
+      await seedDB({
+        [`experiments/${docId}`]: baseFields({
+          id: docId,
+          owner: 'user123',
+          storageProvider: 'gdrive',
+          providerContainer: { provider: 'gdrive', folderId: 'folder-abc' },
+        }),
+      });
+
+      const user456 = testEnv.authenticatedContext('user456');
+      await assertFails(
+        updateDoc(doc(user456.firestore(), `experiments/${docId}`), { active: true })
+      );
+    });
+  });
+
+  describe('4. /users hasOnly unchanged (regression guard)', () => {
+    it('rejects account-creation writes that include connectedAccounts -- clients can never write it', async () => {
+      const user123 = testEnv.authenticatedContext('user123');
+
+      await assertFails(setDoc(doc(user123.firestore(), 'users/user123'), {
+        email: 'john@doe.com',
+        experiments: ['exp1'],
+        osfToken: '',
+        connectedAccounts: { gdrive: { authMethod: 'oauth2' } },
+      }));
+    });
+  });
 });
\ No newline at end of file
diff --git a/__tests__/new-experiment-page.test.jsx b/__tests__/new-experiment-page.test.jsx
new file mode 100644
index 0000000..638630c
--- /dev/null
+++ b/__tests__/new-experiment-page.test.jsx
@@ -0,0 +1,218 @@
+import { render, screen, fireEvent, waitFor } from "@testing-library/react";
+import { ChakraProvider } from "@chakra-ui/react";
+import { system } from "../lib/theme";
+import "@testing-library/jest-dom";
+
+// Mock firebase since test env doesn't have NEXT_PUBLIC_FIREBASE_CONFIG.
+// auth.currentUser mirrors a signed-in user with a working getIdToken().
+const mockGetIdToken = jest.fn(() => Promise.resolve("id-token-123"));
+jest.mock("../lib/firebase", () => ({
+  auth: { currentUser: { uid: "user-1", getIdToken: () => mockGetIdToken() } },
+  db: {},
+}));
+
+// Mock context to provide a signed-in user (this page is wrapped in AuthCheck).
+jest.mock("../lib/context", () => ({
+  UserContext: require("react").createContext({
+    user: { uid: "user-1" },
+    loading: false,
+  }),
+}));
+
+// lib/experiment-creation.js (imported transitively by pages/admin/new.js)
+// pulls in `nanoid`, which ships ESM-only and isn't transformed by Jest by
+// default (`Cannot use import statement outside a module`). Mock it out
+// rather than touching jest.config.js's transformIgnorePatterns.
+jest.mock("nanoid", () => ({
+  customAlphabet: () => () => "mocked-id",
+}));
+
+// firebase/firestore's `doc` (and friends used transitively by
+// lib/experiment-creation.js) must not touch a real Firestore instance.
+jest.mock("firebase/firestore", () => ({
+  doc: jest.fn(() => ({})),
+  writeBatch: jest.fn(() => ({
+    set: jest.fn(),
+    update: jest.fn(),
+    commit: jest.fn(() => Promise.resolve()),
+  })),
+  arrayUnion: jest.fn((v) => v),
+  setDoc: jest.fn(() => Promise.resolve()),
+}));
+
+// The page navigates via the `Router` singleton default export (see
+// pages/admin/new.js: `import Router from "next/router"`), while AuthCheck
+// uses the `useRouter()` hook. Mock both from the same module.
+const mockPush = jest.fn();
+jest.mock("next/router", () => ({
+  __esModule: true,
+  default: { push: (...args) => mockPush(...args) },
+  useRouter: () => ({ push: mockPush, pathname: "/admin/new", query: {} }),
+}));
+
+jest.mock("react-firebase-hooks/firestore", () => ({
+  useDocumentData: jest.fn(),
+}));
+
+import { useDocumentData } from "react-firebase-hooks/firestore";
+import NewExperimentPage from "../pages/admin/new";
+
+function renderPage() {
+  return render(
+    <ChakraProvider value={system}>
+      <NewExperimentPage />
+    </ChakraProvider>
+  );
+}
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  mockGetIdToken.mockClear();
+  mockGetIdToken.mockImplementation(() => Promise.resolve("id-token-123"));
+  global.fetch = jest.fn();
+});
+
+describe("NewExperimentPage — OSF path (pinned regression)", () => {
+  it("2. default render shows the OSF form exactly as today", () => {
+    useDocumentData.mockReturnValue([
+      { refreshToken: "osf-refresh-token", usingPersonalToken: false },
+      false,
+      undefined,
+    ]);
+
+    renderPage();
+
+    expect(screen.getByText("Existing OSF Project")).toBeInTheDocument();
+    expect(
+      screen.getByText("New OSF Data Component Name")
+    ).toBeInTheDocument();
+    expect(screen.getByText("Storage Location")).toBeInTheDocument();
+    expect(screen.getByRole("button", { name: "Create" })).toBeInTheDocument();
+  });
+});
+
+describe("NewExperimentPage — Google Drive provider selector", () => {
+  // NOTE ON INTERACTION MECHANICS: the spec allows a RadioGroup or a Select
+  // for "Where should data be stored?". These assertions target the option
+  // label text via getByLabelText, which works for either control as long
+  // as the GREEN implementation gives the Google Drive option an
+  // accessible name of "Google Drive" (radio input's associated label, or
+  // an <option>/aria-label on a Select). Adjust the query, not the intent,
+  // if the chosen control needs a different accessible-name strategy.
+  function selectGoogleDrive() {
+    fireEvent.click(screen.getByLabelText(/Google Drive/i));
+  }
+
+  it("3. selecting Google Drive with no connection shows a connect CTA, no title-only submit", () => {
+    useDocumentData.mockReturnValue([
+      {
+        refreshToken: "osf-refresh-token",
+        connectedAccounts: {},
+      },
+      false,
+      undefined,
+    ]);
+
+    renderPage();
+    selectGoogleDrive();
+
+    const cta = screen.getByRole("link", {
+      name: /Connect Google Drive Account/i,
+    });
+    expect(cta).toHaveAttribute("href", "/admin/account");
+    expect(
+      screen.queryByRole("button", { name: /^Create$/i })
+    ).not.toBeInTheDocument();
+  });
+
+  it("4. selecting Google Drive while connected shows only the title field + create button", () => {
+    useDocumentData.mockReturnValue([
+      {
+        refreshToken: "osf-refresh-token",
+        connectedAccounts: { gdrive: true },
+      },
+      false,
+      undefined,
+    ]);
+
+    renderPage();
+    selectGoogleDrive();
+
+    expect(screen.getByLabelText(/^Title$/i)).toBeInTheDocument();
+    expect(screen.getByRole("button", { name: /^Create$/i })).toBeInTheDocument();
+    expect(
+      screen.queryByText("Existing OSF Project")
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByText("New OSF Data Component Name")
+    ).not.toBeInTheDocument();
+  });
+
+  it("5. gdrive submit calls /api/createexperiment and navigates to /admin/<id> on success", async () => {
+    useDocumentData.mockReturnValue([
+      {
+        refreshToken: "osf-refresh-token",
+        connectedAccounts: { gdrive: true },
+      },
+      false,
+      undefined,
+    ]);
+    global.fetch.mockResolvedValue({
+      ok: true,
+      json: () => Promise.resolve({ success: true, experimentID: "exp123" }),
+    });
+
+    renderPage();
+    selectGoogleDrive();
+
+    fireEvent.change(screen.getByLabelText(/^Title$/i), {
+      target: { value: "My Study" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: /^Create$/i }));
+
+    await waitFor(() => expect(global.fetch).toHaveBeenCalled());
+    const [url, options] = global.fetch.mock.calls[0];
+    expect(url).toBe("/api/createexperiment");
+    expect(JSON.parse(options.body)).toEqual({
+      provider: "gdrive",
+      title: "My Study",
+      uid: "user-1",
+      idToken: "id-token-123",
+    });
+
+    await waitFor(() =>
+      expect(mockPush).toHaveBeenCalledWith("/admin/exp123")
+    );
+  });
+
+  it("6. gdrive submit failure renders an error message and does not navigate", async () => {
+    useDocumentData.mockReturnValue([
+      {
+        refreshToken: "osf-refresh-token",
+        connectedAccounts: { gdrive: true },
+      },
+      false,
+      undefined,
+    ]);
+    global.fetch.mockResolvedValue({
+      ok: false,
+      status: 400,
+      json: () => Promise.resolve({ error: "Could not create Drive folder" }),
+    });
+
+    renderPage();
+    selectGoogleDrive();
+
+    fireEvent.change(screen.getByLabelText(/^Title$/i), {
+      target: { value: "My Study" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: /^Create$/i }));
+
+    await waitFor(() =>
+      expect(
+        screen.getByText(/Could not create Drive folder/i)
+      ).toBeInTheDocument()
+    );
+    expect(mockPush).not.toHaveBeenCalled();
+  });
+});
diff --git a/__tests__/provider-config.test.js b/__tests__/provider-config.test.js
new file mode 100644
index 0000000..9ece971
--- /dev/null
+++ b/__tests__/provider-config.test.js
@@ -0,0 +1,42 @@
+import { STORAGE_PROVIDERS } from "../lib/provider-config";
+
+describe("STORAGE_PROVIDERS.gdrive", () => {
+  it("isConnected is true when the user doc has connectedAccounts.gdrive", () => {
+    expect(
+      STORAGE_PROVIDERS.gdrive.isConnected({
+        connectedAccounts: { gdrive: true },
+      })
+    ).toBe(true);
+  });
+
+  it("isConnected is false when connectedAccounts.gdrive is absent", () => {
+    expect(STORAGE_PROVIDERS.gdrive.isConnected({ connectedAccounts: {} })).toBe(
+      false
+    );
+    expect(STORAGE_PROVIDERS.gdrive.isConnected({})).toBe(false);
+    expect(STORAGE_PROVIDERS.gdrive.isConnected(undefined)).toBe(false);
+    expect(STORAGE_PROVIDERS.gdrive.isConnected(null)).toBe(false);
+  });
+
+  it("containerLink builds the Google Drive folder URL from providerContainer.folderId", () => {
+    const url = STORAGE_PROVIDERS.gdrive.containerLink({
+      providerContainer: { folderId: "folder-abc-123" },
+    });
+    expect(url).toBe(
+      "https://drive.google.com/drive/folders/folder-abc-123"
+    );
+  });
+
+  it("exposes a human-readable name and container label", () => {
+    expect(STORAGE_PROVIDERS.gdrive.name).toBe("Google Drive");
+    expect(STORAGE_PROVIDERS.gdrive.containerLabel).toBe(
+      "Google Drive Folder"
+    );
+    expect(STORAGE_PROVIDERS.gdrive.containerLinkText).toBe("Open folder");
+    expect(STORAGE_PROVIDERS.gdrive.id).toBe("gdrive");
+  });
+
+  it("does NOT include osf in the provider map (osf keeps its bespoke legacy UI)", () => {
+    expect(STORAGE_PROVIDERS.osf).toBeUndefined();
+  });
+});
diff --git a/__tests__/provider-connections.test.jsx b/__tests__/provider-connections.test.jsx
new file mode 100644
index 0000000..3637e96
--- /dev/null
+++ b/__tests__/provider-connections.test.jsx
@@ -0,0 +1,114 @@
+import { render, screen, fireEvent, waitFor } from "@testing-library/react";
+import { ChakraProvider } from "@chakra-ui/react";
+import { system } from "../lib/theme";
+import "@testing-library/jest-dom";
+
+const mockGetIdToken = jest.fn(() => Promise.resolve("id-token-123"));
+jest.mock("../lib/firebase", () => ({
+  auth: { currentUser: { uid: "user-1", getIdToken: () => mockGetIdToken() } },
+  db: {},
+}));
+
+jest.mock("../lib/context", () => ({
+  UserContext: require("react").createContext({
+    user: { uid: "user-1" },
+    loading: false,
+  }),
+}));
+
+jest.mock("firebase/firestore", () => ({
+  doc: jest.fn(() => ({})),
+  setDoc: jest.fn(() => Promise.resolve()),
+}));
+
+jest.mock("react-firebase-hooks/firestore", () => ({
+  useDocumentData: jest.fn(),
+}));
+
+import { useDocumentData } from "react-firebase-hooks/firestore";
+import ProviderConnections from "../components/account/ProviderConnections";
+
+function renderComponent() {
+  return render(
+    <ChakraProvider value={system}>
+      <ProviderConnections />
+    </ChakraProvider>
+  );
+}
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  mockGetIdToken.mockClear();
+  mockGetIdToken.mockImplementation(() => Promise.resolve("id-token-123"));
+  global.fetch = jest.fn();
+  localStorage.clear();
+
+  // window.location.assign is not implemented by jsdom's navigation stub
+  // (calling the real one throws "Not implemented: navigation"). Replace
+  // the whole `location` object with a plain mock so `.assign` is spy-able;
+  // `delete` + reassignment is the standard jsdom workaround since
+  // `window.location` is configurable on jsdom's global (unlike real
+  // browsers).
+  delete window.location;
+  window.location = { assign: jest.fn(), href: "" };
+});
+
+describe("ProviderConnections", () => {
+  it("7. not connected: Connect click generates state, stores CSRF+flow, and redirects", async () => {
+    useDocumentData.mockReturnValue([{ connectedAccounts: {} }, false, undefined]);
+    global.fetch.mockResolvedValue({
+      ok: true,
+      json: () =>
+        Promise.resolve({
+          state: "state-abc",
+          authorizeUrl: "https://accounts.google.com/o/oauth2/authorize?client_id=x",
+        }),
+    });
+
+    renderComponent();
+
+    expect(
+      screen.getByRole("button", { name: /Connect/i })
+    ).toBeInTheDocument();
+    fireEvent.click(screen.getByRole("button", { name: /Connect/i }));
+
+    await waitFor(() => expect(global.fetch).toHaveBeenCalled());
+    const [url, options] = global.fetch.mock.calls[0];
+    expect(url).toBe("/api/generateoauthstate");
+    expect(JSON.parse(options.body)).toEqual({ provider: "gdrive" });
+
+    await waitFor(() =>
+      expect(window.location.assign).toHaveBeenCalledWith(
+        "https://accounts.google.com/o/oauth2/authorize?client_id=x"
+      )
+    );
+    expect(localStorage.getItem("latestCSRFToken")).toBe("state-abc");
+    expect(localStorage.getItem("providerConnectFlow")).toBe("gdrive");
+  });
+
+  it("8. connected: shows Connected status + Disconnect; click posts to disconnectprovider", async () => {
+    useDocumentData.mockReturnValue([
+      { connectedAccounts: { gdrive: true } },
+      false,
+      undefined,
+    ]);
+    global.fetch.mockResolvedValue({
+      ok: true,
+      json: () => Promise.resolve({ success: true }),
+    });
+
+    renderComponent();
+
+    expect(screen.getByText(/Connected/i)).toBeInTheDocument();
+    fireEvent.click(screen.getByRole("button", { name: /Disconnect/i }));
+
+    await waitFor(() => expect(global.fetch).toHaveBeenCalled());
+    const [url, options] = global.fetch.mock.calls[0];
+    expect(url).toBe("/api/disconnectprovider");
+    expect(JSON.parse(options.body)).toEqual({
+      provider: "gdrive",
+      uid: "user-1",
+      idToken: "id-token-123",
+    });
+  });
+});
diff --git a/__tests__/queue-panel.test.jsx b/__tests__/queue-panel.test.jsx
new file mode 100644
index 0000000..1a83e36
--- /dev/null
+++ b/__tests__/queue-panel.test.jsx
@@ -0,0 +1,86 @@
+import { render, screen } from "@testing-library/react";
+import { ChakraProvider } from "@chakra-ui/react";
+import { system } from "../lib/theme";
+import "@testing-library/jest-dom";
+
+// QueuePanel imports `auth` from lib/firebase for its download handlers;
+// mock it out the same way index.test.jsx does so module init doesn't
+// require a real Firebase config.
+jest.mock("../lib/firebase", () => ({
+  auth: { currentUser: null },
+  db: {},
+}));
+
+import QueuePanel from "../components/dashboard/QueuePanel";
+
+const entries = [
+  {
+    id: "e1",
+    filename: "sub-01_data.csv",
+    status: "pending",
+    failureReason: "interrupted upload",
+    createdAt: new Date(),
+    nextRetryAt: null,
+  },
+  {
+    id: "e2",
+    filename: "sub-02_data.csv",
+    status: "failed",
+    failureReason: "OSF error 503: Service Unavailable",
+    createdAt: new Date(),
+  },
+  {
+    id: "e3",
+    filename: "sub-03_data.csv",
+    status: "failed",
+    failureReason: "Provider error 429: Too Many Requests",
+    createdAt: new Date(),
+  },
+];
+
+function renderPanel() {
+  return render(
+    <ChakraProvider value={system}>
+      <QueuePanel entries={entries} experimentId="exp1" />
+    </ChakraProvider>
+  );
+}
+
+describe("QueuePanel — provider-neutral copy", () => {
+  it("14. generalizes alert/reason copy away from 'OSF' while keeping filenames literal", () => {
+    renderPanel();
+
+    // Pinned legacy behavior: filenames are untouched, provider-agnostic
+    // data that must not be paraphrased.
+    expect(screen.getByText("sub-01_data.csv")).toBeInTheDocument();
+    expect(screen.getByText("sub-02_data.csv")).toBeInTheDocument();
+
+    // Alert title/description: "did not upload to OSF" -> "did not upload
+    // to your storage provider" (spec's own example phrasing).
+    expect(
+      screen.getByText(/did not upload to your storage provider/i)
+    ).toBeInTheDocument();
+    expect(
+      screen.queryByText(/did not upload to OSF/i)
+    ).not.toBeInTheDocument();
+
+    // friendlyReason mapping: "OSF was temporarily unavailable." ->
+    // generalized "storage provider" phrasing.
+    expect(
+      screen.getByText(/storage provider was temporarily unavailable/i)
+    ).toBeInTheDocument();
+    expect(
+      screen.queryByText(/^OSF was temporarily unavailable\.?$/i)
+    ).not.toBeInTheDocument();
+
+    // Both the legacy "OSF error <status>" prefix (older queue docs) and
+    // the current "Provider error <status>" prefix must map to friendly
+    // copy — neither raw string may reach the UI.
+    expect(
+      screen.getByText(/storage provider rate-limited the request/i)
+    ).toBeInTheDocument();
+    expect(
+      screen.queryByText(/Provider error 429/)
+    ).not.toBeInTheDocument();
+  });
+});
diff --git a/components/account/ProviderConnections.js b/components/account/ProviderConnections.js
new file mode 100644
index 0000000..3acc468
--- /dev/null
+++ b/components/account/ProviderConnections.js
@@ -0,0 +1,113 @@
+import { useContext, useState } from "react";
+import { VStack, HStack, Text, Button } from "@chakra-ui/react";
+import { doc } from "firebase/firestore";
+import { db, auth } from "../../lib/firebase";
+import { useDocumentData } from "react-firebase-hooks/firestore";
+import { UserContext } from "../../lib/context";
+import { STORAGE_PROVIDERS } from "../../lib/provider-config";
+
+import { CircleCheck } from "lucide-react";
+
+export default function ProviderConnections() {
+  const { user } = useContext(UserContext);
+
+  const [data] = useDocumentData(doc(db, "users", user.uid));
+
+  const [connectingId, setConnectingId] = useState(null);
+  const [disconnectingId, setDisconnectingId] = useState(null);
+
+  const handleConnect = async (providerId) => {
+    setConnectingId(providerId);
+    try {
+      const stateRes = await fetch("/api/generateoauthstate", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ provider: providerId }),
+      });
+      if (!stateRes.ok) throw new Error("Failed to generate state");
+      const { state, authorizeUrl } = await stateRes.json();
+
+      localStorage.setItem("latestCSRFToken", state);
+      localStorage.setItem("providerConnectFlow", providerId);
+
+      window.location.assign(authorizeUrl);
+    } catch (err) {
+      console.error("Failed to initiate provider connect:", err);
+    } finally {
+      setConnectingId(null);
+    }
+  };
+
+  const handleDisconnect = async (providerId) => {
+    setDisconnectingId(providerId);
+    try {
+      const idToken = await auth.currentUser.getIdToken();
+      const response = await fetch("/api/disconnectprovider", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          provider: providerId,
+          uid: user.uid,
+          idToken,
+        }),
+      });
+      if (!response.ok) {
+        throw new Error("Failed to disconnect provider");
+      }
+    } catch (err) {
+      console.error("Failed to disconnect provider:", err);
+    } finally {
+      setDisconnectingId(null);
+    }
+  };
+
+  return (
+    <VStack gap={3} w="100%" align="stretch">
+      {Object.values(STORAGE_PROVIDERS).map((provider) => {
+        const connected = provider.isConnected(data);
+
+        return (
+          <HStack
+            key={provider.id}
+            justifyContent="space-between"
+            w="100%"
+            flexWrap="wrap"
+            gap={3}
+          >
+            <HStack>
+              <Text fontSize="lg">{provider.name}</Text>
+              {connected && (
+                <HStack gap={1}>
+                  <CircleCheck color="var(--chakra-colors-green-500)" size={18} />
+                  <Text fontSize="sm" color="gray.400">
+                    Connected
+                  </Text>
+                </HStack>
+              )}
+            </HStack>
+            {connected ? (
+              <Button
+                colorPalette="red"
+                variant="outline"
+                size="md"
+                loading={disconnectingId === provider.id}
+                onClick={() => handleDisconnect(provider.id)}
+              >
+                Disconnect
+              </Button>
+            ) : (
+              <Button
+                colorPalette="blue"
+                size="md"
+                loading={connectingId === provider.id}
+                onClick={() => handleConnect(provider.id)}
+              >
+                Connect
+              </Button>
+            )}
+          </HStack>
+        );
+      })}
+    </VStack>
+  );
+}
diff --git a/components/dashboard/ExperimentInfo.js b/components/dashboard/ExperimentInfo.js
index af6b55f..3ba6df1 100644
--- a/components/dashboard/ExperimentInfo.js
+++ b/components/dashboard/ExperimentInfo.js
@@ -1,8 +1,11 @@
 import { Stack, HStack, Text, Link } from "@chakra-ui/react";
 
 import { ExternalLink } from "lucide-react";
+import { STORAGE_PROVIDERS } from "../../lib/provider-config";
 
 export default function ExperimentInfo({ data }) {
+  const provider = STORAGE_PROVIDERS[data.storageProvider];
+
   return (
     <Stack
       w="100%"
@@ -12,24 +15,41 @@ export default function ExperimentInfo({ data }) {
         <Text color="gray.400" fontSize="sm">Experiment ID</Text>
         <Text fontSize="sm">{data.id}</Text>
       </HStack>
-      <HStack justify="space-between" flexWrap="wrap" gap={1}>
-        <Text color="gray.400" fontSize="sm">OSF Project</Text>
-        <Link color="white" fontSize="sm" href={`https://${process.env.NEXT_PUBLIC_OSF_ENV}osf.io/${data.osfRepo}`} target="_blank" rel="noopener noreferrer">
-          {data.osfRepo} <ExternalLink style={{ display: "inline", width: "0.9em", height: "0.9em" }} />
-        </Link>
-      </HStack>
-      <HStack justify="space-between" flexWrap="wrap" gap={1}>
-        <Text color="gray.400" fontSize="sm">OSF Data Component</Text>
-        <Link
-          color="white"
-          fontSize="sm"
-          href={`https://${process.env.NEXT_PUBLIC_OSF_ENV}osf.io/${data.osfComponent}`}
-          target="_blank"
-          rel="noopener noreferrer"
-        >
-          {data.osfComponent} <ExternalLink style={{ display: "inline", width: "0.9em", height: "0.9em" }} />
-        </Link>
-      </HStack>
+      {provider ? (
+        <HStack justify="space-between" flexWrap="wrap" gap={1}>
+          <Text color="gray.400" fontSize="sm">{provider.containerLabel}</Text>
+          <Link
+            color="white"
+            fontSize="sm"
+            href={provider.containerLink(data)}
+            target="_blank"
+            rel="noopener noreferrer"
+          >
+            {provider.containerLinkText} <ExternalLink style={{ display: "inline", width: "0.9em", height: "0.9em" }} />
+          </Link>
+        </HStack>
+      ) : (
+        <>
+          <HStack justify="space-between" flexWrap="wrap" gap={1}>
+            <Text color="gray.400" fontSize="sm">OSF Project</Text>
+            <Link color="white" fontSize="sm" href={`https://${process.env.NEXT_PUBLIC_OSF_ENV}osf.io/${data.osfRepo}`} target="_blank" rel="noopener noreferrer">
+              {data.osfRepo} <ExternalLink style={{ display: "inline", width: "0.9em", height: "0.9em" }} />
+            </Link>
+          </HStack>
+          <HStack justify="space-between" flexWrap="wrap" gap={1}>
+            <Text color="gray.400" fontSize="sm">OSF Data Component</Text>
+            <Link
+              color="white"
+              fontSize="sm"
+              href={`https://${process.env.NEXT_PUBLIC_OSF_ENV}osf.io/${data.osfComponent}`}
+              target="_blank"
+              rel="noopener noreferrer"
+            >
+              {data.osfComponent} <ExternalLink style={{ display: "inline", width: "0.9em", height: "0.9em" }} />
+            </Link>
+          </HStack>
+        </>
+      )}
       <HStack justify="space-between">
         <Text color="gray.400" fontSize="sm">Completed Sessions</Text>
         <Text fontSize="sm">{data.sessions}</Text>
diff --git a/components/dashboard/QueuePanel.js b/components/dashboard/QueuePanel.js
index 0dfda45..99c513c 100644
--- a/components/dashboard/QueuePanel.js
+++ b/components/dashboard/QueuePanel.js
@@ -19,16 +19,19 @@ function friendlyReason(reason) {
     return "Upload was interrupted by a server restart or memory limit.";
   }
   if (reason.includes("Upload exception") || reason.includes("fetch failed")) {
-    return "Could not connect to OSF.";
+    return "Could not connect to your storage provider.";
   }
-  if (reason.includes("OSF error 503") || reason.includes("OSF error 502")) {
-    return "OSF was temporarily unavailable.";
+  // Older queue docs say "OSF error <status>"; current writes say
+  // "Provider error <status>". Both must keep mapping.
+  const status = reason.match(/(?:OSF|Provider) error (\d{3})/)?.[1];
+  if (status === "503" || status === "502") {
+    return "Your storage provider was temporarily unavailable.";
   }
-  if (reason.includes("OSF error 429")) {
-    return "OSF rate-limited the request.";
+  if (status === "429") {
+    return "Your storage provider rate-limited the request.";
   }
-  if (reason.includes("OSF error 401") || reason.includes("OSF error 403")) {
-    return "Authentication error. Your OSF token may need to be refreshed.";
+  if (status === "401" || status === "403") {
+    return "Authentication error. Your storage provider connection may need to be refreshed.";
   }
   return reason;
 }
@@ -156,13 +159,13 @@ export default function QueuePanel({ entries, experimentId }) {
   let alertDescription;
 
   if (allFailed) {
-    alertTitle = `${plural(failedCount, "file")} could not be uploaded to OSF.`;
-    alertDescription = "All retries were exhausted. Download these files and upload them to your OSF project manually to prevent data loss.";
+    alertTitle = `${plural(failedCount, "file")} could not be uploaded to your storage provider.`;
+    alertDescription = "All retries were exhausted. Download these files and upload them to your storage provider manually to prevent data loss.";
   } else if (failedCount > 0) {
-    alertTitle = `${plural(entries.length, "file")} did not upload to OSF.`;
+    alertTitle = `${plural(entries.length, "file")} did not upload to your storage provider.`;
     alertDescription = `${plural(pendingCount, "file")} still being retried. ${plural(failedCount, "file")} failed permanently. You can download all files below.`;
   } else {
-    alertTitle = `${plural(pendingCount, "file")} did not upload to OSF.`;
+    alertTitle = `${plural(pendingCount, "file")} did not upload to your storage provider.`;
     alertDescription = "DataPipe is retrying automatically. You can also download the files now.";
   }
 
@@ -183,7 +186,7 @@ export default function QueuePanel({ entries, experimentId }) {
             <Accordion.ItemContent>
               <Text fontSize="sm" pb={3}>
                 When a participant submits data, DataPipe tries to upload it to
-                your OSF project immediately. If that fails, DataPipe saves a
+                your storage provider immediately. If that fails, DataPipe saves a
                 copy and retries automatically. Common reasons include:
               </Text>
               <Box as="ul" fontSize="sm" pl={5} pb={3} listStyleType="disc">
@@ -192,17 +195,17 @@ export default function QueuePanel({ entries, experimentId }) {
                   can occasionally exceed the server&apos;s memory capacity.
                 </Box>
                 <Box as="li" mb={1}>
-                  <strong>OSF unavailable</strong> — OSF may be temporarily
-                  down or rate-limiting requests.
+                  <strong>Storage provider unavailable</strong> — Your storage
+                  provider may be temporarily down or rate-limiting requests.
                 </Box>
                 <Box as="li" mb={1}>
                   <strong>Configuration issue</strong> — There may be a problem
-                  with your OSF project settings or authentication token.
+                  with your storage provider settings or authentication token.
                 </Box>
               </Box>
               <Text fontSize="sm" pb={3}>
                 Files are stored for up to 7 days. If retries don&apos;t succeed,
-                download the files and upload them to OSF manually.
+                download the files and upload them to your storage provider manually.
               </Text>
             </Accordion.ItemContent>
           </Accordion.Item>
diff --git a/docs/provider-migration-design.md b/docs/provider-migration-design.md
new file mode 100644
index 0000000..9fe3008
--- /dev/null
+++ b/docs/provider-migration-design.md
@@ -0,0 +1,402 @@
+# Storage Provider Migration — Design Doc
+
+## Background
+
+DataPipe currently depends on the Open Science Framework (OSF) as its sole storage
+backend: researchers OAuth2-link (or paste a PAT for) their own OSF account, and
+DataPipe writes experiment session data and a Psych-DS metadata file directly into
+an OSF project/component on their behalf. DataPipe never retains a copy of
+submitted data itself.
+
+This migration is driven by **deprecation/shutdown risk at OSF**, not cost or a
+policy dispute. The goal is to decouple DataPipe from any single storage vendor by
+introducing a pluggable storage-provider abstraction, and to ship initial support
+for three concrete providers: **Google Drive, Figshare, and Dataverse**, alongside
+OSF kept in place as a legacy adapter for existing connected users.
+
+Migration tooling for moving existing OSF experiments or historical data to a
+new provider is **deliberately out of scope**. If OSF shuts down, researchers
+start new experiments on a new provider; the legacy adapter exists so nothing
+breaks before that day, not as the first step of a rescue plan.
+
+## Current OSF dependency (summary)
+
+A full code-level audit found DataPipe's OSF dependency concentrated in a
+identifiable set of modules, with a large amount of surrounding logic
+(condition assignment, Psych-DS metadata generation/merge, token encryption,
+CSRF/OAuth-state handling, and the GCS/Firestore retry-queue durability system)
+already provider-agnostic and requiring no change. The OSF-specific surface:
+
+- **OAuth2 flow**: `oauth2-callback.ts`, `oauth2-regenerate.ts`, `refresh-token.ts`,
+  `resolve-token.ts`, `generate-oauth-state.ts`, plus a parallel static
+  Personal-Access-Token path (`save-osf-token.ts`, `get-osf-token.ts`).
+- **File writes**: `put-file-osf.ts`, `update-file-osf.ts`, `subfolder.ts` — built
+  on OSF's Waterbutler API, and explicitly relying on OSF's `409 Conflict` response
+  as the sole collision-detection mechanism for per-session data files.
+- **Metadata handling**: `metadata-block.ts`, `metadata-process.ts` — reconciles a
+  mutable `dataset_description.json` file against a live provider-side folder
+  listing on every update.
+- **OSF concepts baked into the data model**: project + child "component",
+  `osfstorage` as an implicit provider, 4 hardcoded OSF storage regions, OSF file
+  IDs with an `osfstorage/` prefix.
+- **Frontend**: `pages/admin/new.js` (OSF-shaped experiment creation form),
+  `ExperimentInfo.js` (hardcoded `osf.io` links), `QueuePanel.js` (OSF status-code
+  copy), all of `components/account/*`.
+- **Config/rules**: OSF client ID/secret/redirect env vars, and `firestore.rules`
+  hardcoding OSF-shaped field whitelists.
+
+## Requirements for any replacement
+
+1. OAuth2 delegated authorization with refresh-token rotation — researcher owns
+   the account, DataPipe never holds a password, access must survive unattended
+   for the life of a study (months). **Deliberately relaxed for Dataverse**,
+   which only offers static API tokens: accepted because DataPipe already
+   maintains an equivalent PAT path for OSF, but Dataverse tokens expire
+   (commonly yearly, installation-configurable), so the unattended-for-months
+   constraint requires expiry-warning UX, not just token storage.
+2. A file-write API that handles **binary media as well as text** — the
+   `/api/base64` path (audio/video recordings) is in scope for all providers
+   from day one, so per-provider file-size caps and quota behavior are launch
+   constraints, not later work. (Atomic create-if-absent is a nice-to-have, not
+   a hard requirement — see "Collision detection" below for why.)
+3. Support for updating one mutable file per project (the metadata file).
+4. Folder/path support, or a documented fallback when absent.
+5. A "project + child container" shape, or a flat namespace DataPipe's model can
+   be mapped onto.
+6. Burst tolerance (a class of 30–100 students submitting within a minute).
+7. Free-tier economics realistic for typical academic use, and — where possible —
+   DOI/citation support, since that's part of DataPipe's pitch to researchers,
+   not just plumbing.
+
+## Providers evaluated and ruled out
+
+- **GitHub** — technically the strongest fit (sha-gated Contents API naturally
+  solves collision detection and mutable updates), but using a source-control
+  platform as a silent, continuous data-dump backend runs against the spirit of
+  the service even though no explicit ToS clause forbids it, and there's no
+  precedent either way for this exact usage pattern. Ruled out on those grounds
+  rather than a technical one.
+- **Zenodo, Figshare (as archival), Harvard Dataverse, ICPSR, Dryad, Databrary,
+  DANS** — the entire "research-data-specific repository" category is built
+  around a curate-once-publish-once-mint-a-DOI workflow, structurally mismatched
+  to DataPipe's hundreds-of-small-incremental-writes-over-months pattern. This
+  turned out to be a category-wide limitation, not specific to any one vendor —
+  confirmed across every Dataverse-software installation (Harvard, Borealis,
+  DataverseNL, DataverseNO, DANS all share the same open-source codebase, same
+  static-token-only auth, same silent-rename-on-duplicate-filename behavior).
+  ICPSR has no automated API at all. Dryad supports incremental draft writes but
+  only via a shared service-account grant (no per-researcher OAuth consent) and
+  charges a $150/dataset publishing fee. Databrary is architecturally a gated,
+  human-reviewed video library, not a general write target.
+- **Box, Amazon S3, Dropbox, Microsoft OneDrive/Graph** — all technically solid,
+  generic-storage options with no platform-fit ambiguity. Box has the strongest
+  native atomic-write guarantee of anything evaluated and is already common at
+  universities; S3 has the best region control and longest clean API history but
+  breaks OAuth-onboarding simplicity (self-provisioned IAM). These remain
+  reasonable fallback options but were not selected as the initial three.
+  **Box is the pre-approved substitute**: if a conditional provider fails its
+  gating spike (below), Box takes its slot without re-opening the full
+  evaluation.
+
+**Selected for initial implementation: Google Drive, Figshare, Dataverse** —
+but the three are not equally confident picks. Google Drive is a comfortable
+technical fit. Figshare and Dataverse come from the repository category ruled
+out above; they are selected *despite* that structural mismatch because
+DOI/citation support and research-repository identity are part of DataPipe's
+pitch to researchers (requirement 7), and their selection is **conditional**:
+each must pass its gating spike (see "Gating spikes" below) before its adapter
+is built, with Box as the named substitute if it fails. If both fail, the
+initial lineup is Drive + Box.
+
+OSF is retained as a legacy adapter — existing connected users and in-flight
+studies keep working unmodified; new experiments default to one of the new
+providers.
+
+## Architecture
+
+### Provider interface
+
+```
+StorageProvider {
+  id: 'osf' | 'gdrive' | 'figshare' | 'dataverse'
+  authMethod: 'oauth2' | 'static-token'
+
+  // auth
+  getAuthUrl(state) / exchangeCode(code) / refreshToken(rt)   // oauth2
+  validateStaticToken(token)                                   // static-token
+
+  // one-time setup at experiment creation
+  createDataContainer(auth, researcherInput) -> containerRef   // opaque, provider-shaped
+
+  // ongoing writes — `data` may be binary (base64/media path), with declared
+  // size and content type so adapters can enforce provider size caps up front
+  writeSessionFile(auth, containerRef, filename, data, {size, contentType}) -> WriteResult
+  updateFile(auth, containerRef, existingFileRef, data, {size, contentType}) -> WriteResult
+
+  // needed for collision-cache rehydration (see below) and dashboard file counts
+  listFiles(auth, containerRef) -> FileRef[]
+
+  capabilities: { nativeSubfolders: bool, supportsRegion: bool,
+                  maxFileSizeBytes: number | null, quotaNote: string | null }
+}
+
+WriteResult {
+  fileRef,           // provider-shaped id/path/rev
+  storedFilename,    // the filename the provider REPORTS having stored — not
+                     // the one requested; detecting Dataverse's silent rename
+                     // depends on comparing the two
+  bytesWritten,
+}
+```
+
+`capabilities` is descriptive (UI hints, subfolder fallback behavior, size-cap
+warnings), not a correctness gate — provider-side atomicity is no longer
+load-bearing (see below). Note one contract caveat: Figshare has no in-place
+file update, so its `updateFile` is implemented as delete + re-upload and is
+**non-atomic** — there is a brief window where the metadata file does not exist
+in the article. Callers of `updateFile` must tolerate that.
+
+### Collision detection: a cache, not a new system of record
+
+None of the three selected providers offer OSF's atomic `409`-on-duplicate
+behavior (Drive allows same-name files silently, Dataverse silently renames,
+Figshare's behavior is unconfirmed). Rather than build three different
+reliability models behind one interface, collision detection moves entirely into
+Firestore, decoupled from the provider:
+
+- Before any provider write, atomically claim `(experimentId, filenameHash)` in a
+  Firestore transaction. A failed claim means "duplicate filename" — no
+  provider round-trip needed to know that.
+- **Claims have a lifecycle, not just existence.** A claim is written as
+  `pending` with an idempotency token owned by the submitting request, and
+  flipped to `confirmed` only after the provider write succeeds. The upload
+  retry queue (`queue-upload.ts` / `scheduled-upload-retry.ts`) re-enters its
+  own `pending` claim by token rather than being rejected as a duplicate of
+  itself; a terminally failed write releases its claim (or a new request
+  bearing no token may overwrite a stale `pending` claim past a timeout).
+  Without this, a failed provider write orphans the claim and a legitimate
+  resubmission of that filename is blocked until TTL expiry (~90 days).
+- **Retention-safe by design**: the claim stores a *salted hash* of the filename
+  (salt is per-experiment, generated once, kept indefinitely — a nonce, not
+  "file information"), never the raw filename. This keeps the "we don't retain
+  your file information" promise intact.
+- **Cost-bounded by design**: claim records carry a TTL and expire after an
+  experiment goes inactive (proposed: ~90 days with no new submissions), so
+  storage stays bounded to currently-active studies rather than growing forever
+  across DataPipe's entire history.
+- **Nothing is actually lost on expiry.** The claim-set is a cache over the
+  provider's own file listing, which remains the durable source of truth. If a
+  researcher resumes data collection on an experiment whose claim-set has
+  expired, DataPipe detects the cold cache, calls the adapter's `listFiles`
+  against the live container, hashes each returned filename with the
+  experiment's (permanently retained) salt, bulk-writes fresh claims with a new
+  TTL, then proceeds with the normal claim-and-write for the incoming
+  submission. This only costs anything for experiments that actually get
+  reactivated — the common case (experiment finishes, goes cold, stays cold)
+  never pays the rehydration cost.
+- Edge cases to handle explicitly: rehydration needs a **per-experiment lock**
+  — concurrent submissions arriving at a cold cache must wait/retry against a
+  single in-flight rehydration rather than each triggering their own
+  `listFiles` + bulk claim-write; rehydration should fail loudly (prompt the
+  researcher to reconnect) if the provider container is missing or access was
+  revoked, rather than silently accepting duplicates; large containers need
+  paginated listing.
+- **Validation before it matters**: while OSF is still the only provider
+  (build step 3), dual-run — keep OSF's `409` response as a backstop and log
+  any disagreement between it and the Firestore cache. That checks the cache
+  against production ground truth for free, before any provider that *has* no
+  backstop ships.
+
+This also incidentally resolves a latent bug in the current OSF code, where
+`metadata-block.ts` checks for a success status code (`210`) that
+`putFileOSF` never actually returns — that check disappears along with the
+code path it lives in.
+
+### Metadata-file tracking
+
+Store the provider-returned file ref (id/path/rev) on the experiment's Firestore
+`metadata/{experimentID}` doc after first creation. Every later update reads
+that ref back directly — no more per-adapter "list the folder and look for a
+matching name" logic, which today only exists because OSF is queried as the
+live source of truth for this check.
+
+### Data model
+
+```
+experiments/{id}: {
+  storageProvider: 'gdrive' | 'figshare' | 'dataverse' | 'osf',   // 'osf' = legacy
+  providerContainer: { ...shape varies by storageProvider... },
+  metadataFileRef: {...} | null,
+  collisionCache: { salt, warmUntil: Timestamp },
+}
+
+users/{uid}: {
+  connectedAccounts: {
+    gdrive?:    { authMethod: 'oauth2', encryptedToken, encryptedRefreshToken, tokenExpiresAt, providerAccountId },
+    figshare?:  { authMethod: 'oauth2', ...same shape... },
+    dataverse?: { authMethod: 'static-token', encryptedToken, serverUrl,
+                  tokenExpiresAt },   // Dataverse tokens expire (~yearly) — needed for expiry-warning UX
+  }
+}
+```
+
+`crypto-utils.ts` (AES-256-GCM) and `generate-oauth-state.ts` (CSRF state
+handling) carry over unchanged — already provider-agnostic.
+
+### Per-provider adapter notes
+
+| | Google Drive | Figshare | Dataverse |
+|---|---|---|---|
+| Auth | OAuth2, `drive.file` scope | OAuth2, `authorization_code` + `refresh_token` | Static API token — same shape as today's OSF PAT fallback (`usingPersonalToken`) |
+| Auth longevity | Refresh tokens are revoked after ~6 months of disuse — paused studies need reconnect UX. App must reach **published** OAuth verification status: testing mode means 7-day refresh tokens and a 100-user cap | Long-lived; confirm rotation/expiry behavior in the spike | Tokens **expire** (commonly yearly, installation-configurable) — needs expiry-warning UX, not just storage |
+| Container | **App-created "DataPipe" folder at Drive root.** Under `drive.file` the app can only touch files it created or the user explicitly picked — a researcher-picked parent would force a Google Picker frontend integration for little gain. Revisit only if researchers demand placement control | Article inside a Project (two levels only) | Dataset inside a Collection |
+| Subfolders | Native | **None** — filename-prefix fallback, surfaced in UI as a known limitation | Native via `directoryLabel` |
+| Media / size limits | Free quota is 15 GB **shared with Gmail/Photos** — quota exhaustion is an expected support scenario for audio/video studies, not an edge case | Per-file and total-quota caps on the free tier; upload is a multi-step multipart flow (initiate → parts → complete) with correspondingly more failure modes; no in-place update (delete + re-upload) | Per-installation size caps (federation → varies); CSV uploads are **"ingested"** into archival `.tab` format unless suppressed, which transforms presentation and extends dataset locking — suppression support is version-dependent |
+| Federation | Single global service | Single global service | **Federated** — Harvard, Borealis, DataverseNL, etc. are different servers; `serverUrl` must be stored per researcher, and DataPipe integrates whatever software version each installation runs (version drift is a permanent fact of this adapter) |
+| DOI/publish | N/A | Publishing an Article snapshots it | Dataset publish bumps a major version — dataset should stay in **draft indefinitely**; publish (and DOI mint) becomes a manual researcher action at study completion, not something DataPipe triggers |
+| Gating spike | None (comfortable fit) — but OAuth app verification has **weeks of lead time**; start it at build step 0 | See "Gating spikes" below — duplicate-filename behavior, per-item **file-count cap** (historically ~500 files/item; a semester-long study can exceed it), multipart burst behavior | See "Gating spikes" below — **dataset locking under concurrent adds** (most likely disqualifier in the plan), tabular-ingest suppression, silent-rename response shape |
+
+### OAuth generalization
+
+Replace today's 4–5 near-duplicated OSF-auth-URL-building blocks and single
+OSF-hardcoded `oauth2-callback` function with a small provider registry
+(`{authorizeUrl, tokenUrl, clientId, clientSecret, scope}` per provider) and one
+generic callback function parameterized by a `provider` field carried in the
+existing CSRF state payload.
+
+The generalization also covers the OSF-shaped background jobs:
+
+- `scheduled-token-refresh.ts` becomes per-provider — each OAuth2 provider gets
+  its own refresh cadence, and Dataverse (no refresh token to rotate) gets an
+  **expiry-warning** job instead, emailing/flagging the researcher before the
+  static token lapses mid-study.
+- `on-user-deleted.ts` cleanup iterates the `connectedAccounts.*` map rather
+  than assuming a single OSF token shape.
+
+### Frontend changes
+
+- `admin/new.js`: provider selector + provider-specific sub-form.
+- `account/*`: collapse per-provider components (`SignUpWithOSF`, `OSFToken`,
+  `OAuthTokenStatus`, etc.) into one generic connect-button + token-status
+  component, parameterized by a small per-provider config (name, icon, docs
+  link).
+- `ExperimentInfo.js` / `QueuePanel.js`: replace hardcoded OSF links and OSF
+  status-code copy with a generic error taxonomy (`RATE_LIMITED`,
+  `AUTH_EXPIRED`, `NAME_CONFLICT`, `QUOTA_EXCEEDED`, `UNAVAILABLE`) that each
+  adapter maps its own provider's errors into. With media in scope from day
+  one, `QUOTA_EXCEEDED` (storage full / file too large) is the most likely
+  researcher-visible failure and needs first-class copy, not a generic error.
+- `firestore.rules`: generalize the field whitelist to the `connectedAccounts.*`
+  shape; the experiment `hasAll` check becomes conditional on `storageProvider`.
+
+## Build sequence
+
+0. **Register provider OAuth apps and start Google's verification process
+   immediately** — publication/brand verification has weeks of lead time, and
+   until it completes, Drive refresh tokens last 7 days and the app is capped
+   at 100 users. This runs in parallel with everything below.
+1. Define the provider interface + registry + additive Firestore schema (no
+   behavior change yet).
+2. Refactor existing OSF code into an OSF adapter implementing the new
+   interface — pure refactor, proves the abstraction before adding anything new.
+3. Land the Firestore collision-cache (salted hash + claim lifecycle + TTL +
+   lazy rehydration) and metadata-ref tracking for the OSF adapter first, while
+   there's still only one provider to reason about. **Dual-run**: keep OSF's
+   `409` as a backstop and log cache/backstop disagreements as free production
+   validation.
+4. Google Drive adapter (simplest OAuth2, most rate-limit headroom, proves the
+   multi-provider auth flow end-to-end).
+5. **Gate: Figshare spike** (see below). Pass → Figshare adapter. Fail → Box
+   adapter takes the slot.
+6. **Gate: Dataverse spike** (see below). Pass → Dataverse adapter
+   (static-token path, "stays in draft" publish workflow). Fail → Box (or, if
+   Box already replaced Figshare, ship two providers and revisit).
+7. Frontend: provider selection UI, generalized connect/status components,
+   generalized dashboard links and error copy.
+8. FAQ/docs, `firestore.rules`, env config for new provider client
+   IDs/secrets.
+
+## Testing strategy
+
+- Extend `mock-server.ts` per provider and mirror the existing emulator-based
+  test suite (`__tests__/*-emulator.test.js`) for each adapter — same coverage
+  bar as the OSF path has today, including the base64/media path.
+- Live smoke checks: `demo.dataverse.org` for Dataverse; Figshare has no real
+  sandbox, so a dedicated throwaway account; a dedicated test Google account
+  for Drive.
+- Spikes run against real services with throwaway accounts; their findings get
+  recorded back into this doc (adapter-notes table) when complete.
+
+## Gating spikes (go/no-go before the adapter is built)
+
+These are decision gates, not confirmations. Each has a named disqualification
+criterion and Box is the pre-approved substitute — a failed spike swaps the
+provider, it does not trigger a redesign.
+
+- **Dataverse — concurrent-write locking.** Dataverse locks a dataset during
+  file add/ingest, and concurrent adds to a locked dataset fail. The burst
+  requirement writes 30–100 files to *one* dataset within a minute; the retry
+  queue softens this, but if the spike shows writes serialize through a lock at
+  a rate that can't absorb a class section, that is disqualifying. This is the
+  single most likely spike to fail in the plan.
+- **Dataverse — tabular ingest.** Confirm CSV ingest-into-`.tab` can be
+  suppressed on the installations researchers actually use (suppression is
+  version-dependent, and federation means DataPipe doesn't choose the version).
+- **Dataverse — silent rename.** Confirm the exact response shape on a
+  duplicate filename so DataPipe compares `storedFilename` against the request
+  rather than trusting it blindly.
+- **Figshare — duplicate filename behavior.** Docs are silent; verify
+  empirically.
+- **Figshare — per-item file-count cap.** Historically ~500 files/item; a
+  semester of sessions can exceed it. Determine the real limit and whether
+  article-rollover (a new article per N files) is acceptable; if the cap is low
+  and rollover unacceptable, that is disqualifying.
+- **Figshare — multipart upload under burst.** The initiate → parts → complete
+  flow has more failure modes than a single PUT; verify behavior under
+  concurrent submissions, including media-sized files.
+
+## Deployment checklist (gdrive launch)
+
+Accumulated from build steps 1–7; everything below is required before the
+Google Drive provider is announced:
+
+1. **Google OAuth app** (step 0): register the OAuth client (drive.file
+   scope), set the consent screen, and complete Google's verification to
+   published status — until then refresh tokens last 7 days and the app is
+   capped at 100 users. Weeks of lead time.
+2. **Functions env**: `GDRIVE_CLIENT_ID`, `GDRIVE_CLIENT_SECRET`,
+   `GDRIVE_REDIRECT_URI` (must point at `https://pipe.jspsych.org/oauth2/connect`).
+   `GDRIVE_API_BASE`/`GDRIVE_TOKEN_URL`/`GDRIVE_AUTHORIZE_URL` default to
+   the real Google endpoints and need no production values.
+3. **Firestore TTL policy** on `filenameClaims` `expiresAt` field
+   (console/gcloud). Cost-boundedness only — correctness never depends on
+   it.
+4. **Firestore index**: the scheduled gdrive refresh queries
+   `connectedAccounts.gdrive.tokenExpiresAt` — confirm the single-field
+   index exists in production (auto-indexing normally covers it; the
+   emulator does not prove it).
+5. **FAQ / user docs**: announce Drive support, its quota caveat (15 GB
+   shared with Gmail/Photos), and the app-created "DataPipe" folder
+   behavior. Copy deliberately not drafted by the migration — researcher-
+   facing wording is an editorial decision.
+6. **Deploy order**: functions + rules + hosting can ship together; the
+   collision cache dual-runs against OSF's 409 for legacy experiments, so
+   no data migration or flag-flip is needed.
+
+## Open questions
+
+- **Test-suite hazard (pre-existing, discovered during step 4b)**: the OSF
+  token-refresh path has no URL override (unlike GDRIVE_TOKEN_URL), so an
+  emulator test that seeds a refresh-due OSF user makes a REAL network call
+  to production accounts.osf.io using the credentials in functions/.env.
+  The scheduled-refresh regression test deliberately pins a network-free
+  path because of this. Fix: introduce an OSF_TOKEN_URL override mirroring
+  the gdrive pattern, then pin the live-refresh branch properly.
+- Decide the exact collision-cache TTL window (90 days proposed, not yet
+  validated against real usage patterns).
+- Decide the UX for Dataverse's federated `serverUrl` requirement (does
+  DataPipe maintain a picker of known installations, or require researchers to
+  paste their institution's Dataverse URL?).
+- Do researchers need placement control for the Drive folder strongly enough
+  to justify a Google Picker integration, or is the app-created root folder
+  acceptable? (Default answer: root folder; revisit on demand.)
diff --git a/firebase.json b/firebase.json
index d5122af..c8987ef 100644
--- a/firebase.json
+++ b/firebase.json
@@ -53,6 +53,18 @@
       {
         "source": "/api/queuestatus",
         "function": "apiqueuestatus"
+      },
+      {
+        "source": "/api/createexperiment",
+        "function": "createexperiment"
+      },
+      {
+        "source": "/api/connectprovider",
+        "function": "connectprovider"
+      },
+      {
+        "source": "/api/disconnectprovider",
+        "function": "disconnectprovider"
       }
     ]
   },
diff --git a/firestore.rules b/firestore.rules
index ba93a78..aebdb59 100644
--- a/firestore.rules
+++ b/firestore.rules
@@ -17,8 +17,14 @@ service cloud.firestore {
         (isAccountCreation() || isTokenMethodUpdate() || isExperimentsUpdate());
     }
     match /experiments/{experimentId} {
+      function baseFields() {
+        return request.resource.data.keys().hasAll(['active', 'activeBase64', 'activeConditionAssignment', 'id', 'owner', 'title', 'sessions', 'nConditions', 'currentCondition', 'useValidation', 'allowJSON', 'allowCSV', 'requiredFields', 'maxSessions', 'limitSessions'])
+      }
       function verifyFields() {
-        return request.resource.data.keys().hasAll(['active', 'activeBase64', 'activeConditionAssignment', 'id', 'osfRepo', 'osfComponent', 'osfFilesLink', 'owner', 'title', 'sessions', 'nConditions', 'currentCondition', 'useValidation', 'allowJSON', 'allowCSV', 'requiredFields', 'maxSessions', 'limitSessions'])
+        return baseFields() &&
+          (('storageProvider' in request.resource.data)
+            ? request.resource.data.keys().hasAll(['storageProvider', 'providerContainer'])
+            : request.resource.data.keys().hasAll(['osfRepo', 'osfComponent', 'osfFilesLink']));
       }
       allow read: if(request.auth.uid != null) &&
         resource.data.owner == request.auth.uid;
diff --git a/functions/.env.datapipe-test b/functions/.env.datapipe-test
new file mode 100644
index 0000000..6f272c1
--- /dev/null
+++ b/functions/.env.datapipe-test
@@ -0,0 +1,7 @@
+GDRIVE_API_BASE=http://127.0.0.1:3579
+GDRIVE_TOKEN_URL=http://127.0.0.1:3580/token
+GDRIVE_AUTHORIZE_URL=http://127.0.0.1:3580/authorize
+GDRIVE_CLIENT_ID=test-client-id
+GDRIVE_CLIENT_SECRET=test-client-secret
+GDRIVE_REDIRECT_URI=http://localhost:3000/oauth2/connect
+TOKEN_ENCRYPTION_KEY=abababababababababababababababababababababababababababababababab
diff --git a/functions/package-lock.json b/functions/package-lock.json
index 3c38ebb..5f7623e 100644
--- a/functions/package-lock.json
+++ b/functions/package-lock.json
@@ -15,6 +15,7 @@
         "firebase-functions": "^7.2.2",
         "is-base64": "^1.1.0",
         "joi": "^17.7.0",
+        "nanoid": "^5.1.16",
         "node-fetch": "^3.2.10"
       },
       "devDependencies": {
@@ -37,8 +38,6 @@
     },
     "node_modules/@babel/code-frame": {
       "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -53,8 +52,6 @@
     },
     "node_modules/@babel/compat-data": {
       "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.0.tgz",
-      "integrity": "sha512-T1NCJqT/j9+cn8fvkt7jtwbLBfLC/1y1c7NtCeXFRgzGTsafi68MRv8yzkYSapBnFA6L3U2VSc02ciDzoAJhJg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -64,8 +61,6 @@
     },
     "node_modules/@babel/core": {
       "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.0.tgz",
-      "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -96,8 +91,6 @@
     },
     "node_modules/@babel/core/node_modules/debug": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -115,16 +108,12 @@
     },
     "node_modules/@babel/core/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/@babel/generator": {
       "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -141,8 +130,6 @@
     },
     "node_modules/@babel/helper-compilation-targets": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz",
-      "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -159,8 +146,6 @@
     },
     "node_modules/@babel/helper-compilation-targets/node_modules/lru-cache": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
-      "integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==",
       "dev": true,
       "license": "ISC",
       "peer": true,
@@ -170,16 +155,12 @@
     },
     "node_modules/@babel/helper-compilation-targets/node_modules/yallist": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
-      "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
       "dev": true,
       "license": "ISC",
       "peer": true
     },
     "node_modules/@babel/helper-globals": {
       "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.28.0.tgz",
-      "integrity": "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -189,8 +170,6 @@
     },
     "node_modules/@babel/helper-module-imports": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz",
-      "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -204,8 +183,6 @@
     },
     "node_modules/@babel/helper-module-transforms": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz",
-      "integrity": "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -223,8 +200,6 @@
     },
     "node_modules/@babel/helper-plugin-utils": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.28.6.tgz",
-      "integrity": "sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -234,8 +209,6 @@
     },
     "node_modules/@babel/helper-string-parser": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
-      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -245,8 +218,6 @@
     },
     "node_modules/@babel/helper-validator-identifier": {
       "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
-      "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -256,8 +227,6 @@
     },
     "node_modules/@babel/helper-validator-option": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.27.1.tgz",
-      "integrity": "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -267,8 +236,6 @@
     },
     "node_modules/@babel/helpers": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.28.6.tgz",
-      "integrity": "sha512-xOBvwq86HHdB7WUDTfKfT/Vuxh7gElQ+Sfti2Cy6yIWNW05P8iUslOVcZ4/sKbE+/jQaukQAdz/gf3724kYdqw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -282,8 +249,6 @@
     },
     "node_modules/@babel/parser": {
       "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.0.tgz",
-      "integrity": "sha512-IyDgFV5GeDUVX4YdF/3CPULtVGSXXMLh1xVIgdCgxApktqnQV0r7/8Nqthg+8YLGaAtdyIlo2qIdZrbCv4+7ww==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -299,8 +264,6 @@
     },
     "node_modules/@babel/plugin-syntax-async-generators": {
       "version": "7.8.4",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-async-generators/-/plugin-syntax-async-generators-7.8.4.tgz",
-      "integrity": "sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -313,8 +276,6 @@
     },
     "node_modules/@babel/plugin-syntax-bigint": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-bigint/-/plugin-syntax-bigint-7.8.3.tgz",
-      "integrity": "sha512-wnTnFlG+YxQm3vDxpGE57Pj0srRU4sHE/mDkt1qv2YJJSeUAec2ma4WLUnUPeKjyrfntVwe/N6dCXpU+zL3Npg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -327,8 +288,6 @@
     },
     "node_modules/@babel/plugin-syntax-class-properties": {
       "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-properties/-/plugin-syntax-class-properties-7.12.13.tgz",
-      "integrity": "sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -341,8 +300,6 @@
     },
     "node_modules/@babel/plugin-syntax-class-static-block": {
       "version": "7.14.5",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-static-block/-/plugin-syntax-class-static-block-7.14.5.tgz",
-      "integrity": "sha512-b+YyPmr6ldyNnM6sqYeMWE+bgJcJpO6yS4QD7ymxgH34GBPNDM/THBh8iunyvKIZztiwLH4CJZ0RxTk9emgpjw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -358,8 +315,6 @@
     },
     "node_modules/@babel/plugin-syntax-import-attributes": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-attributes/-/plugin-syntax-import-attributes-7.28.6.tgz",
-      "integrity": "sha512-jiLC0ma9XkQT3TKJ9uYvlakm66Pamywo+qwL+oL8HJOvc6TWdZXVfhqJr8CCzbSGUAbDOzlGHJC1U+vRfLQDvw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -375,8 +330,6 @@
     },
     "node_modules/@babel/plugin-syntax-import-meta": {
       "version": "7.10.4",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-meta/-/plugin-syntax-import-meta-7.10.4.tgz",
-      "integrity": "sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -389,8 +342,6 @@
     },
     "node_modules/@babel/plugin-syntax-json-strings": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-json-strings/-/plugin-syntax-json-strings-7.8.3.tgz",
-      "integrity": "sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -403,8 +354,6 @@
     },
     "node_modules/@babel/plugin-syntax-jsx": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.28.6.tgz",
-      "integrity": "sha512-wgEmr06G6sIpqr8YDwA2dSRTE3bJ+V0IfpzfSY3Lfgd7YWOaAdlykvJi13ZKBt8cZHfgH1IXN+CL656W3uUa4w==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -420,8 +369,6 @@
     },
     "node_modules/@babel/plugin-syntax-logical-assignment-operators": {
       "version": "7.10.4",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-logical-assignment-operators/-/plugin-syntax-logical-assignment-operators-7.10.4.tgz",
-      "integrity": "sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -434,8 +381,6 @@
     },
     "node_modules/@babel/plugin-syntax-nullish-coalescing-operator": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-nullish-coalescing-operator/-/plugin-syntax-nullish-coalescing-operator-7.8.3.tgz",
-      "integrity": "sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -448,8 +393,6 @@
     },
     "node_modules/@babel/plugin-syntax-numeric-separator": {
       "version": "7.10.4",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-numeric-separator/-/plugin-syntax-numeric-separator-7.10.4.tgz",
-      "integrity": "sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -462,8 +405,6 @@
     },
     "node_modules/@babel/plugin-syntax-object-rest-spread": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-object-rest-spread/-/plugin-syntax-object-rest-spread-7.8.3.tgz",
-      "integrity": "sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -476,8 +417,6 @@
     },
     "node_modules/@babel/plugin-syntax-optional-catch-binding": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-catch-binding/-/plugin-syntax-optional-catch-binding-7.8.3.tgz",
-      "integrity": "sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -490,8 +429,6 @@
     },
     "node_modules/@babel/plugin-syntax-optional-chaining": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-chaining/-/plugin-syntax-optional-chaining-7.8.3.tgz",
-      "integrity": "sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -504,8 +441,6 @@
     },
     "node_modules/@babel/plugin-syntax-private-property-in-object": {
       "version": "7.14.5",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-private-property-in-object/-/plugin-syntax-private-property-in-object-7.14.5.tgz",
-      "integrity": "sha512-0wVnp9dxJ72ZUJDV27ZfbSj6iHLoytYZmh3rFcxNnvsJF3ktkzLDZPy/mA17HGsaQT3/DQsWYX1f1QGWkCoVUg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -521,8 +456,6 @@
     },
     "node_modules/@babel/plugin-syntax-top-level-await": {
       "version": "7.14.5",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-top-level-await/-/plugin-syntax-top-level-await-7.14.5.tgz",
-      "integrity": "sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -538,8 +471,6 @@
     },
     "node_modules/@babel/plugin-syntax-typescript": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.28.6.tgz",
-      "integrity": "sha512-+nDNmQye7nlnuuHDboPbGm00Vqg3oO8niRRL27/4LYHUsHYh0zJ1xWOz0uRwNFmM1Avzk8wZbc6rdiYhomzv/A==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -555,8 +486,6 @@
     },
     "node_modules/@babel/template": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -571,8 +500,6 @@
     },
     "node_modules/@babel/traverse": {
       "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -591,8 +518,6 @@
     },
     "node_modules/@babel/traverse/node_modules/debug": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -610,16 +535,12 @@
     },
     "node_modules/@babel/traverse/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/@babel/types": {
       "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -633,29 +554,27 @@
     },
     "node_modules/@bcoe/v8-coverage": {
       "version": "0.2.3",
-      "resolved": "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz",
-      "integrity": "sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/@emnapi/core": {
-      "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.8.1.tgz",
-      "integrity": "sha512-AvT9QFpxK0Zd8J0jopedNm+w/2fIzvtPKPjqyw9jwvBaReTTqPBk9Hixaz7KbjimP+QNz605/XnjFcDAL2pqBg==",
+      "version": "1.11.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.2.tgz",
+      "integrity": "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "peer": true,
       "dependencies": {
-        "@emnapi/wasi-threads": "1.1.0",
+        "@emnapi/wasi-threads": "1.2.2",
         "tslib": "^2.4.0"
       }
     },
     "node_modules/@emnapi/runtime": {
-      "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.8.1.tgz",
-      "integrity": "sha512-mehfKSMWjjNol8659Z8KxEMrdSJDDot5SXMq00dM8BN4o+CLNXQ0xH2V7EchNHV4RmbZLmmPdEaXZc5H2FXmDg==",
+      "version": "1.11.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
+      "integrity": "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -665,9 +584,9 @@
       }
     },
     "node_modules/@emnapi/wasi-threads": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.1.0.tgz",
-      "integrity": "sha512-WI0DdZ8xFSbgMjR1sFsKABJ/C5OnRrjT06JXbZKexJGrDuPTzZdDYfFlsgcCXCyf+suG5QU2e/y1Wo2V/OapLQ==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
+      "integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -678,32 +597,22 @@
     },
     "node_modules/@fastify/busboy": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-3.2.0.tgz",
-      "integrity": "sha512-m9FVDXU3GT2ITSe0UaMA5rU3QkfC/UXtCU8y0gSN/GugTqtVldOBWIB5V6V3sbmenVZUIpU6f+mPEO2+m5iTaA==",
       "license": "MIT"
     },
     "node_modules/@firebase/app-check-interop-types": {
       "version": "0.3.3",
-      "resolved": "https://registry.npmjs.org/@firebase/app-check-interop-types/-/app-check-interop-types-0.3.3.tgz",
-      "integrity": "sha512-gAlxfPLT2j8bTI/qfe3ahl2I2YcBQ8cFIBdhAQA4I2f3TndcO+22YizyGYuttLHPQEpWkhmpFW60VCFEPg4g5A==",
       "license": "Apache-2.0"
     },
     "node_modules/@firebase/app-types": {
       "version": "0.9.3",
-      "resolved": "https://registry.npmjs.org/@firebase/app-types/-/app-types-0.9.3.tgz",
-      "integrity": "sha512-kRVpIl4vVGJ4baogMDINbyrIOtOxqhkZQg4jTq3l8Lw6WSk0xfpEYzezFu+Kl4ve4fbPl79dvwRtaFqAC/ucCw==",
       "license": "Apache-2.0"
     },
     "node_modules/@firebase/auth-interop-types": {
       "version": "0.2.4",
-      "resolved": "https://registry.npmjs.org/@firebase/auth-interop-types/-/auth-interop-types-0.2.4.tgz",
-      "integrity": "sha512-JPgcXKCuO+CWqGDnigBtvo09HeBs5u/Ktc2GaFj2m01hLarbxthLNm7Fk8iOP1aqAtXV+fnnGj7U28xmk7IwVA==",
       "license": "Apache-2.0"
     },
     "node_modules/@firebase/component": {
       "version": "0.7.0",
-      "resolved": "https://registry.npmjs.org/@firebase/component/-/component-0.7.0.tgz",
-      "integrity": "sha512-wR9En2A+WESUHexjmRHkqtaVH94WLNKt6rmeqZhSLBybg4Wyf0Umk04SZsS6sBq4102ZsDBFwoqMqJYj2IoDSg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@firebase/util": "1.13.0",
@@ -715,8 +624,6 @@
     },
     "node_modules/@firebase/database": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@firebase/database/-/database-1.1.0.tgz",
-      "integrity": "sha512-gM6MJFae3pTyNLoc9VcJNuaUDej0ctdjn3cVtILo3D5lpp0dmUHHLFN/pUKe7ImyeB1KAvRlEYxvIHNF04Filg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@firebase/app-check-interop-types": "0.3.3",
@@ -733,8 +640,6 @@
     },
     "node_modules/@firebase/database-compat": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@firebase/database-compat/-/database-compat-2.1.0.tgz",
-      "integrity": "sha512-8nYc43RqxScsePVd1qe1xxvWNf0OBnbwHxmXJ7MHSuuTVYFO3eLyLW3PiCKJ9fHnmIz4p4LbieXwz+qtr9PZDg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@firebase/component": "0.7.0",
@@ -750,8 +655,6 @@
     },
     "node_modules/@firebase/database-types": {
       "version": "1.0.16",
-      "resolved": "https://registry.npmjs.org/@firebase/database-types/-/database-types-1.0.16.tgz",
-      "integrity": "sha512-xkQLQfU5De7+SPhEGAXFBnDryUWhhlFXelEg2YeZOQMCdoe7dL64DDAd77SQsR+6uoXIZY5MB4y/inCs4GTfcw==",
       "license": "Apache-2.0",
       "dependencies": {
         "@firebase/app-types": "0.9.3",
@@ -760,8 +663,6 @@
     },
     "node_modules/@firebase/logger": {
       "version": "0.5.0",
-      "resolved": "https://registry.npmjs.org/@firebase/logger/-/logger-0.5.0.tgz",
-      "integrity": "sha512-cGskaAvkrnh42b3BA3doDWeBmuHFO/Mx5A83rbRDYakPjO9bJtRL3dX7javzc2Rr/JHZf4HlterTW2lUkfeN4g==",
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^2.1.0"
@@ -772,8 +673,6 @@
     },
     "node_modules/@firebase/util": {
       "version": "1.13.0",
-      "resolved": "https://registry.npmjs.org/@firebase/util/-/util-1.13.0.tgz",
-      "integrity": "sha512-0AZUyYUfpMNcztR5l09izHwXkZpghLgCUaAGjtMwXnCg3bj4ml5VgiwqOMOxJ+Nw4qN/zJAaOQBcJ7KGkWStqQ==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -785,8 +684,6 @@
     },
     "node_modules/@google-cloud/firestore": {
       "version": "7.11.6",
-      "resolved": "https://registry.npmjs.org/@google-cloud/firestore/-/firestore-7.11.6.tgz",
-      "integrity": "sha512-EW/O8ktzwLfyWBOsNuhRoMi8lrC3clHM5LVFhGvO1HCsLozCOOXRAlHrYBoE6HL42Sc8yYMuCb2XqcnJ4OOEpw==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -802,8 +699,6 @@
     },
     "node_modules/@google-cloud/paginator": {
       "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/@google-cloud/paginator/-/paginator-5.0.2.tgz",
-      "integrity": "sha512-DJS3s0OVH4zFDB1PzjxAsHqJT6sKVbRwwML0ZBP9PbU7Yebtu/7SWMRzvO2J3nUi9pRNITCfu4LJeooM2w4pjg==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -816,8 +711,6 @@
     },
     "node_modules/@google-cloud/projectify": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@google-cloud/projectify/-/projectify-4.0.0.tgz",
-      "integrity": "sha512-MmaX6HeSvyPbWGwFq7mXdo0uQZLGBYCwziiLIGq5JVX+/bdI3SAq6bP98trV5eTWfLuvsMcIC1YJOF2vfteLFA==",
       "license": "Apache-2.0",
       "optional": true,
       "engines": {
@@ -826,8 +719,6 @@
     },
     "node_modules/@google-cloud/promisify": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@google-cloud/promisify/-/promisify-4.0.0.tgz",
-      "integrity": "sha512-Orxzlfb9c67A15cq2JQEyVc7wEsmFBmHjZWZYQMUyJ1qivXyMwdyNOs9odi79hze+2zqdTtu1E19IM/FtqZ10g==",
       "license": "Apache-2.0",
       "optional": true,
       "engines": {
@@ -836,8 +727,6 @@
     },
     "node_modules/@google-cloud/storage": {
       "version": "7.19.0",
-      "resolved": "https://registry.npmjs.org/@google-cloud/storage/-/storage-7.19.0.tgz",
-      "integrity": "sha512-n2FjE7NAOYyshogdc7KQOl/VZb4sneqPjWouSyia9CMDdMhRX5+RIbqalNmC7LOLzuLAN89VlF2HvG8na9G+zQ==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -863,8 +752,6 @@
     },
     "node_modules/@google-cloud/storage/node_modules/gcp-metadata": {
       "version": "6.1.1",
-      "resolved": "https://registry.npmjs.org/gcp-metadata/-/gcp-metadata-6.1.1.tgz",
-      "integrity": "sha512-a4tiq7E0/5fTjxPAaH4jpjkSv/uCaU2p5KC6HVGrvl0cDjA8iBZv4vv1gyzlmK0ZUKqwpOyQMKzZQe3lTit77A==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -878,8 +765,6 @@
     },
     "node_modules/@google-cloud/storage/node_modules/google-auth-library": {
       "version": "9.15.1",
-      "resolved": "https://registry.npmjs.org/google-auth-library/-/google-auth-library-9.15.1.tgz",
-      "integrity": "sha512-Jb6Z0+nvECVz+2lzSMt9u98UsoakXxA2HGHMCxh+so3n90XgYWkq5dur19JAJV7ONiJY22yBTyJB1TSkvPq9Ng==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -896,8 +781,6 @@
     },
     "node_modules/@google-cloud/storage/node_modules/google-logging-utils": {
       "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/google-logging-utils/-/google-logging-utils-0.0.2.tgz",
-      "integrity": "sha512-NEgUnEcBiP5HrPzufUkBzJOD/Sxsco3rLNo1F1TNf7ieU8ryUzBhqba8r756CjLX7rn3fHl6iLEwPYuqpoKgQQ==",
       "license": "Apache-2.0",
       "optional": true,
       "engines": {
@@ -906,8 +789,6 @@
     },
     "node_modules/@google-cloud/storage/node_modules/uuid": {
       "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
       "license": "MIT",
       "optional": true,
       "bin": {
@@ -916,8 +797,6 @@
     },
     "node_modules/@grpc/grpc-js": {
       "version": "1.14.3",
-      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.3.tgz",
-      "integrity": "sha512-Iq8QQQ/7X3Sac15oB6p0FmUg/klxQvXLeileoqrTRGJYLV+/9tubbr9ipz0GKHjmXVsgFPo/+W+2cA8eNcR+XA==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -930,8 +809,6 @@
     },
     "node_modules/@grpc/grpc-js/node_modules/@grpc/proto-loader": {
       "version": "0.8.0",
-      "resolved": "https://registry.npmjs.org/@grpc/proto-loader/-/proto-loader-0.8.0.tgz",
-      "integrity": "sha512-rc1hOQtjIWGxcxpb9aHAfLpIctjEnsDehj0DAiVfBlmT84uvR0uUtN2hEi/ecvWVjXUGf5qPF4qEgiLOx1YIMQ==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -949,8 +826,6 @@
     },
     "node_modules/@grpc/proto-loader": {
       "version": "0.7.15",
-      "resolved": "https://registry.npmjs.org/@grpc/proto-loader/-/proto-loader-0.7.15.tgz",
-      "integrity": "sha512-tMXdRCfYVixjuFK+Hk0Q1s38gV9zDiDJfWL3h1rv4Qc39oILCu1TRTDt7+fGUI8K4G1Fj125Hx/ru3azECWTyQ==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -968,14 +843,10 @@
     },
     "node_modules/@hapi/hoek": {
       "version": "9.3.0",
-      "resolved": "https://registry.npmjs.org/@hapi/hoek/-/hoek-9.3.0.tgz",
-      "integrity": "sha512-/c6rf4UJlmHlC9b5BaNvzAcFv7HZ2QHaV0D4/HNlBdvFnvQq8RI4kYdhyPCl7Xj+oWvTWQ8ujhqS53LIgAe6KQ==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@hapi/topo": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/@hapi/topo/-/topo-5.1.0.tgz",
-      "integrity": "sha512-foQZKJig7Ob0BMAYBfcJk8d77QtOe7Wo4ox7ff1lQYoNNAb6jwcY1ncdoy2e9wQZzvNy7ODZCYJkK8kzmcAnAg==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "@hapi/hoek": "^9.0.0"
@@ -983,8 +854,6 @@
     },
     "node_modules/@isaacs/cliui": {
       "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
-      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
       "license": "ISC",
       "dependencies": {
         "string-width": "^5.1.2",
@@ -1000,8 +869,6 @@
     },
     "node_modules/@istanbuljs/load-nyc-config": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz",
-      "integrity": "sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==",
       "dev": true,
       "license": "ISC",
       "peer": true,
@@ -1018,8 +885,6 @@
     },
     "node_modules/@istanbuljs/schema": {
       "version": "0.1.3",
-      "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.3.tgz",
-      "integrity": "sha512-ZXRY4jNvVgSVQ8DL3LTcakaAtXwTVUxE81hslsyD2AtoXW/wVob10HkOJ1X/pAlcI7D+2YoZKg5do8G/w6RYgA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1029,8 +894,6 @@
     },
     "node_modules/@jest/console": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/console/-/console-30.2.0.tgz",
-      "integrity": "sha512-+O1ifRjkvYIkBqASKWgLxrpEhQAAE7hY77ALLUufSk5717KfOShg6IbqLmdsLMPdUiFvA2kTs0R7YZy+l0IzZQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1048,8 +911,6 @@
     },
     "node_modules/@jest/core": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/core/-/core-30.2.0.tgz",
-      "integrity": "sha512-03W6IhuhjqTlpzh/ojut/pDB2LPRygyWX8ExpgHtQA8H/3K7+1vKmcINx5UzeOX1se6YEsBsOHQ1CRzf3fOwTQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1097,8 +958,6 @@
     },
     "node_modules/@jest/diff-sequences": {
       "version": "30.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/diff-sequences/-/diff-sequences-30.0.1.tgz",
-      "integrity": "sha512-n5H8QLDJ47QqbCNn5SuFjCRDrOLEZ0h8vAHCK5RL9Ls7Xa8AQLa/YxAc9UjFqoEDM48muwtBGjtMY5cr0PLDCw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1108,8 +967,6 @@
     },
     "node_modules/@jest/environment": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/environment/-/environment-30.2.0.tgz",
-      "integrity": "sha512-/QPTL7OBJQ5ac09UDRa3EQes4gt1FTEG/8jZ/4v5IVzx+Cv7dLxlVIvfvSVRiiX2drWyXeBjkMSR8hvOWSog5g==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1125,8 +982,6 @@
     },
     "node_modules/@jest/expect": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/expect/-/expect-30.2.0.tgz",
-      "integrity": "sha512-V9yxQK5erfzx99Sf+7LbhBwNWEZ9eZay8qQ9+JSC0TrMR1pMDHLMY+BnVPacWU6Jamrh252/IKo4F1Xn/zfiqA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1140,8 +995,6 @@
     },
     "node_modules/@jest/expect-utils": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/expect-utils/-/expect-utils-30.2.0.tgz",
-      "integrity": "sha512-1JnRfhqpD8HGpOmQp180Fo9Zt69zNtC+9lR+kT7NVL05tNXIi+QC8Csz7lfidMoVLPD3FnOtcmp0CEFnxExGEA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1154,8 +1007,6 @@
     },
     "node_modules/@jest/fake-timers": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-30.2.0.tgz",
-      "integrity": "sha512-HI3tRLjRxAbBy0VO8dqqm7Hb2mIa8d5bg/NJkyQcOk7V118ObQML8RC5luTF/Zsg4474a+gDvhce7eTnP4GhYw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1173,8 +1024,6 @@
     },
     "node_modules/@jest/get-type": {
       "version": "30.1.0",
-      "resolved": "https://registry.npmjs.org/@jest/get-type/-/get-type-30.1.0.tgz",
-      "integrity": "sha512-eMbZE2hUnx1WV0pmURZY9XoXPkUYjpc55mb0CrhtdWLtzMQPFvu/rZkTLZFTsdaVQa+Tr4eWAteqcUzoawq/uA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1184,8 +1033,6 @@
     },
     "node_modules/@jest/globals": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/globals/-/globals-30.2.0.tgz",
-      "integrity": "sha512-b63wmnKPaK+6ZZfpYhz9K61oybvbI1aMcIs80++JI1O1rR1vaxHUCNqo3ITu6NU0d4V34yZFoHMn/uoKr/Rwfw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1201,8 +1048,6 @@
     },
     "node_modules/@jest/pattern": {
       "version": "30.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/pattern/-/pattern-30.0.1.tgz",
-      "integrity": "sha512-gWp7NfQW27LaBQz3TITS8L7ZCQ0TLvtmI//4OwlQRx4rnWxcPNIYjxZpDcN4+UlGxgm3jS5QPz8IPTCkb59wZA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1216,8 +1061,6 @@
     },
     "node_modules/@jest/reporters": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/reporters/-/reporters-30.2.0.tgz",
-      "integrity": "sha512-DRyW6baWPqKMa9CzeiBjHwjd8XeAyco2Vt8XbcLFjiwCOEKOvy82GJ8QQnJE9ofsxCMPjH4MfH8fCWIHHDKpAQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1260,8 +1103,6 @@
     },
     "node_modules/@jest/schemas": {
       "version": "30.0.5",
-      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.0.5.tgz",
-      "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1274,8 +1115,6 @@
     },
     "node_modules/@jest/snapshot-utils": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/snapshot-utils/-/snapshot-utils-30.2.0.tgz",
-      "integrity": "sha512-0aVxM3RH6DaiLcjj/b0KrIBZhSX1373Xci4l3cW5xiUWPctZ59zQ7jj4rqcJQ/Z8JuN/4wX3FpJSa3RssVvCug==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1291,8 +1130,6 @@
     },
     "node_modules/@jest/source-map": {
       "version": "30.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/source-map/-/source-map-30.0.1.tgz",
-      "integrity": "sha512-MIRWMUUR3sdbP36oyNyhbThLHyJ2eEDClPCiHVbrYAe5g3CHRArIVpBw7cdSB5fr+ofSfIb2Tnsw8iEHL0PYQg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1307,8 +1144,6 @@
     },
     "node_modules/@jest/test-result": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-30.2.0.tgz",
-      "integrity": "sha512-RF+Z+0CCHkARz5HT9mcQCBulb1wgCP3FBvl9VFokMX27acKphwyQsNuWH3c+ojd1LeWBLoTYoxF0zm6S/66mjg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1324,8 +1159,6 @@
     },
     "node_modules/@jest/test-sequencer": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/test-sequencer/-/test-sequencer-30.2.0.tgz",
-      "integrity": "sha512-wXKgU/lk8fKXMu/l5Hog1R61bL4q5GCdT6OJvdAFz1P+QrpoFuLU68eoKuVc4RbrTtNnTL5FByhWdLgOPSph+Q==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1341,8 +1174,6 @@
     },
     "node_modules/@jest/transform": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-30.2.0.tgz",
-      "integrity": "sha512-XsauDV82o5qXbhalKxD7p4TZYYdwcaEXC77PPD2HixEFF+6YGppjrAAQurTl2ECWcEomHBMMNS9AH3kcCFx8jA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1369,8 +1200,6 @@
     },
     "node_modules/@jest/types": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.2.0.tgz",
-      "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1389,8 +1218,6 @@
     },
     "node_modules/@jridgewell/gen-mapping": {
       "version": "0.3.13",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
-      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1401,8 +1228,6 @@
     },
     "node_modules/@jridgewell/remapping": {
       "version": "2.3.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
-      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1413,8 +1238,6 @@
     },
     "node_modules/@jridgewell/resolve-uri": {
       "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
-      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1424,16 +1247,12 @@
     },
     "node_modules/@jridgewell/sourcemap-codec": {
       "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
-      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/@jridgewell/trace-mapping": {
       "version": "0.3.31",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
-      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1444,8 +1263,6 @@
     },
     "node_modules/@js-sdsl/ordered-map": {
       "version": "4.4.2",
-      "resolved": "https://registry.npmjs.org/@js-sdsl/ordered-map/-/ordered-map-4.4.2.tgz",
-      "integrity": "sha512-iUKgm52T8HOE/makSxjqoWhe95ZJA1/G1sYsGev2JDKUSS14KAgg1LHb+Ba+IPow0xflbnSkOsZcO08C7w1gYw==",
       "license": "MIT",
       "optional": true,
       "funding": {
@@ -1473,8 +1290,6 @@
     },
     "node_modules/@opentelemetry/api": {
       "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.0.tgz",
-      "integrity": "sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==",
       "license": "Apache-2.0",
       "optional": true,
       "engines": {
@@ -1483,8 +1298,6 @@
     },
     "node_modules/@pkgjs/parseargs": {
       "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
-      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
       "license": "MIT",
       "optional": true,
       "engines": {
@@ -1493,8 +1306,6 @@
     },
     "node_modules/@pkgr/core": {
       "version": "0.2.9",
-      "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.2.9.tgz",
-      "integrity": "sha512-QNqXyfVS2wm9hweSYD2O7F0G06uurj9kZ96TRQE5Y9hU7+tgdZwIkbAKc5Ocy1HxEY2kuDQa6cQ1WRs/O5LFKA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1507,32 +1318,22 @@
     },
     "node_modules/@protobufjs/aspromise": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/aspromise/-/aspromise-1.1.2.tgz",
-      "integrity": "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/base64": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/base64/-/base64-1.1.2.tgz",
-      "integrity": "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/codegen": {
       "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.4.tgz",
-      "integrity": "sha512-YyFaikqM5sH0ziFZCN3xDC7zeGaB/d0IUb9CATugHWbd1FRFwWwt4ld4OYMPWu5a3Xe01mGAULCdqhMlPl29Jg==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/eventemitter": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.0.tgz",
-      "integrity": "sha512-j9ednRT81vYJ9OfVuXG6ERSTdEL1xVsNgqpkxMsbIabzSo3goCjDIveeGv5d03om39ML71RdmrGNjG5SReBP/Q==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/fetch": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.0.tgz",
-      "integrity": "sha512-lljVXpqXebpsijW71PZaCYeIcE5on1w5DlQy5WH6GLbFryLUrBD4932W/E2BSpfRJWseIL4v/KPgBFxDOIdKpQ==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "@protobufjs/aspromise": "^1.1.1",
@@ -1541,38 +1342,26 @@
     },
     "node_modules/@protobufjs/float": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/float/-/float-1.0.2.tgz",
-      "integrity": "sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/inquire": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/inquire/-/inquire-1.1.0.tgz",
-      "integrity": "sha512-kdSefcPdruJiFMVSbn801t4vFK7KB/5gd2fYvrxhuJYg8ILrmn9SKSX2tZdV6V+ksulWqS7aXjBcRXl3wHoD9Q==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/path": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/path/-/path-1.1.2.tgz",
-      "integrity": "sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/pool": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/pool/-/pool-1.1.0.tgz",
-      "integrity": "sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/utf8": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.0.tgz",
-      "integrity": "sha512-Vvn3zZrhQZkkBE8LSuW3em98c0FwgO4nxzv6OdSxPKJIEKY2bGbHn+mhGIPerzI4twdxaP8/0+06HBpwf345Lw==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@sideway/address": {
       "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/@sideway/address/-/address-4.1.5.tgz",
-      "integrity": "sha512-IqO/DUQHUkPeixNQ8n0JA6102hT9CmaljNTPmQ1u8MEhBo/R4Q8eKLN/vGZxuebwOroDB4cbpjheD4+/sKFK4Q==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "@hapi/hoek": "^9.0.0"
@@ -1580,28 +1369,20 @@
     },
     "node_modules/@sideway/formula": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@sideway/formula/-/formula-3.0.1.tgz",
-      "integrity": "sha512-/poHZJJVjx3L+zVD6g9KgHfYnb443oi7wLu/XKojDviHy6HOEOA6z1Trk5aR1dGcmPenJEgb2sK2I80LeS3MIg==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@sideway/pinpoint": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@sideway/pinpoint/-/pinpoint-2.0.0.tgz",
-      "integrity": "sha512-RNiOoTPkptFtSVzQevY/yWtZwf/RxyVnPy/OcA9HBM3MlGDnBEYL5B41H0MTn0Uec8Hi+2qUtTfG2WWZBmMejQ==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@sinclair/typebox": {
       "version": "0.34.48",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.48.tgz",
-      "integrity": "sha512-kKJTNuK3AQOrgjjotVxMrCn1sUJwM76wMszfq1kdU4uYVJjvEWuFQ6HgvLt4Xz3fSmZlTOxJ/Ie13KnIcWQXFA==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/@sinonjs/commons": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@sinonjs/commons/-/commons-3.0.1.tgz",
-      "integrity": "sha512-K3mCHKQ9sVh8o1C9cxkwxaOmXoAMlDxC1mYyHrjqOWEcBjYr76t96zL2zlj5dUGZ3HSw240X1qgH3Mjf1yJWpQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "peer": true,
@@ -1611,8 +1392,6 @@
     },
     "node_modules/@sinonjs/fake-timers": {
       "version": "13.0.5",
-      "resolved": "https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-13.0.5.tgz",
-      "integrity": "sha512-36/hTbH2uaWuGVERyC6da9YwGWnzUZXuPro/F2LfsdOsLnCojz/iSH8MxUt/FD2S5XBSVPhmArFUXcpCQ2Hkiw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "peer": true,
@@ -1622,8 +1401,6 @@
     },
     "node_modules/@tootallnate/once": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@tootallnate/once/-/once-2.0.0.tgz",
-      "integrity": "sha512-XCuKFP5PS55gnMVu3dty8KPatLqUoy/ZYzDzAGCQ8JNFCkLXzmI7vNHCR+XpbZaMWQK/vQubr7PkYq8g470J/A==",
       "license": "MIT",
       "optional": true,
       "engines": {
@@ -1631,9 +1408,9 @@
       }
     },
     "node_modules/@tybys/wasm-util": {
-      "version": "0.10.1",
-      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.1.tgz",
-      "integrity": "sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg==",
+      "version": "0.10.3",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
+      "integrity": "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -1644,8 +1421,6 @@
     },
     "node_modules/@types/archiver": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/@types/archiver/-/archiver-7.0.0.tgz",
-      "integrity": "sha512-/3vwGwx9n+mCQdYZ2IKGGHEFL30I96UgBlk8EtRDDFQ9uxM1l4O5Ci6r00EMAkiDaTqD9DQ6nVrWRICnBPtzzg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1654,8 +1429,6 @@
     },
     "node_modules/@types/babel__core": {
       "version": "7.20.5",
-      "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.20.5.tgz",
-      "integrity": "sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1669,8 +1442,6 @@
     },
     "node_modules/@types/babel__generator": {
       "version": "7.27.0",
-      "resolved": "https://registry.npmjs.org/@types/babel__generator/-/babel__generator-7.27.0.tgz",
-      "integrity": "sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY19zk6EwWqUQ8lg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1680,8 +1451,6 @@
     },
     "node_modules/@types/babel__template": {
       "version": "7.4.4",
-      "resolved": "https://registry.npmjs.org/@types/babel__template/-/babel__template-7.4.4.tgz",
-      "integrity": "sha512-h/NUaSyG5EyxBIp8YRxo4RMe2/qQgvyowRwVMzhYhBCONbW8PUsg4lkFMrhgZhUe5z3L3MiLDuvyJ/CaPa2A8A==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1692,8 +1461,6 @@
     },
     "node_modules/@types/babel__traverse": {
       "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.28.0.tgz",
-      "integrity": "sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1703,8 +1470,6 @@
     },
     "node_modules/@types/body-parser": {
       "version": "1.19.6",
-      "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.6.tgz",
-      "integrity": "sha512-HLFeCYgz89uk22N5Qg3dvGvsv46B8GLvKKo1zKG4NybA8U2DiEO3w9lqGg29t/tfLRJpJ6iQxnVw4OnB7MoM9g==",
       "license": "MIT",
       "dependencies": {
         "@types/connect": "*",
@@ -1713,15 +1478,11 @@
     },
     "node_modules/@types/caseless": {
       "version": "0.12.5",
-      "resolved": "https://registry.npmjs.org/@types/caseless/-/caseless-0.12.5.tgz",
-      "integrity": "sha512-hWtVTC2q7hc7xZ/RLbxapMvDMgUnDvKvMOpKal4DrMyfGBUfB1oKaZlIRr6mJL+If3bAP6sV/QneGzF6tJjZDg==",
       "license": "MIT",
       "optional": true
     },
     "node_modules/@types/connect": {
       "version": "3.4.38",
-      "resolved": "https://registry.npmjs.org/@types/connect/-/connect-3.4.38.tgz",
-      "integrity": "sha512-K6uROf1LD88uDQqJCktA4yzL1YYAK6NgfsI0v/mTgyPKWsX1CnJ0XPSDhViejru1GcRkLWb8RlzFYJRqGUbaug==",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*"
@@ -1729,8 +1490,6 @@
     },
     "node_modules/@types/cors": {
       "version": "2.8.19",
-      "resolved": "https://registry.npmjs.org/@types/cors/-/cors-2.8.19.tgz",
-      "integrity": "sha512-mFNylyeyqN93lfe/9CSxOGREz8cpzAhH+E93xJ4xWQf62V8sQ/24reV2nyzUWM6H6Xji+GGHpkbLe7pVoUEskg==",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*"
@@ -1738,8 +1497,6 @@
     },
     "node_modules/@types/express": {
       "version": "4.17.25",
-      "resolved": "https://registry.npmjs.org/@types/express/-/express-4.17.25.tgz",
-      "integrity": "sha512-dVd04UKsfpINUnK0yBoYHDF3xu7xVH4BuDotC/xGuycx4CgbP48X/KF/586bcObxT0HENHXEU8Nqtu6NR+eKhw==",
       "license": "MIT",
       "dependencies": {
         "@types/body-parser": "*",
@@ -1750,8 +1507,6 @@
     },
     "node_modules/@types/express-serve-static-core": {
       "version": "4.19.8",
-      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-4.19.8.tgz",
-      "integrity": "sha512-02S5fmqeoKzVZCHPZid4b8JH2eM5HzQLZWN2FohQEy/0eXTq8VXZfSN6Pcr3F6N9R/vNrj7cpgbhjie6m/1tCA==",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*",
@@ -1762,29 +1517,21 @@
     },
     "node_modules/@types/http-errors": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@types/http-errors/-/http-errors-2.0.5.tgz",
-      "integrity": "sha512-r8Tayk8HJnX0FztbZN7oVqGccWgw98T/0neJphO91KkmOzug1KkofZURD4UaD5uH8AqcFLfdPErnBod0u71/qg==",
       "license": "MIT"
     },
     "node_modules/@types/is-base64": {
       "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@types/is-base64/-/is-base64-1.1.3.tgz",
-      "integrity": "sha512-8h40c+MFeMKhEw8Ebckd11MEt9sngs4AAkvcZVfDYOFDd7FeTD80pTfm3uvepbWcld1zVkHW+WA6b7UaHAOU/w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/istanbul-lib-coverage": {
       "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.6.tgz",
-      "integrity": "sha512-2QF/t/auWm0lsy8XtKVPG19v3sSOQlJe/YHZgfjb/KBBHOGSV+J2q/S671rcq9uTBrLAXmZpqJiaQbMT+zNU1w==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/@types/istanbul-lib-report": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@types/istanbul-lib-report/-/istanbul-lib-report-3.0.3.tgz",
-      "integrity": "sha512-NQn7AHQnk/RSLOxrBbGyJM/aVQ+pjj5HCgasFxc0K/KhoATfQ/47AyUl15I2yBUpihjmas+a+VJBOqecrFH+uA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1794,8 +1541,6 @@
     },
     "node_modules/@types/istanbul-reports": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/istanbul-reports/-/istanbul-reports-3.0.4.tgz",
-      "integrity": "sha512-pk2B1NWalF9toCRu6gjBzR69syFjP4Od8WRAX+0mmf9lAjCRicLOWc+ZrxZHx/0XRjotgkF9t6iaMJ+aXcOdZQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1805,8 +1550,6 @@
     },
     "node_modules/@types/jsonwebtoken": {
       "version": "9.0.10",
-      "resolved": "https://registry.npmjs.org/@types/jsonwebtoken/-/jsonwebtoken-9.0.10.tgz",
-      "integrity": "sha512-asx5hIG9Qmf/1oStypjanR7iKTv0gXQ1Ov/jfrX6kS/EO0OFni8orbmGCn0672NHR3kXHwpAwR+B368ZGN/2rA==",
       "license": "MIT",
       "dependencies": {
         "@types/ms": "*",
@@ -1815,34 +1558,24 @@
     },
     "node_modules/@types/lodash": {
       "version": "4.17.24",
-      "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.17.24.tgz",
-      "integrity": "sha512-gIW7lQLZbue7lRSWEFql49QJJWThrTFFeIMJdp3eH4tKoxm1OvEPg02rm4wCCSHS0cL3/Fizimb35b7k8atwsQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/long": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/@types/long/-/long-4.0.2.tgz",
-      "integrity": "sha512-MqTGEo5bj5t157U6fA/BiDynNkn0YknVdh48CMPkTSpFTVmvao5UQmm7uEF6xBEo7qIMAlY/JSleYaE6VOdpaA==",
       "license": "MIT",
       "optional": true
     },
     "node_modules/@types/mime": {
       "version": "1.3.5",
-      "resolved": "https://registry.npmjs.org/@types/mime/-/mime-1.3.5.tgz",
-      "integrity": "sha512-/pyBZWSLD2n0dcHE3hq8s8ZvcETHtEuF+3E7XVt0Ig2nvsVQXdghHVcEkIWjy9A0wKfTn97a/PSDYohKIlnP/w==",
       "license": "MIT"
     },
     "node_modules/@types/ms": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz",
-      "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
       "license": "MIT"
     },
     "node_modules/@types/node": {
       "version": "25.3.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.3.2.tgz",
-      "integrity": "sha512-RpV6r/ij22zRRdyBPcxDeKAzH43phWVKEjL2iksqo1Vz3CuBUrgmPpPhALKiRfU7OMCmeeO9vECBMsV0hMTG8Q==",
       "license": "MIT",
       "dependencies": {
         "undici-types": "~7.18.0"
@@ -1850,20 +1583,14 @@
     },
     "node_modules/@types/qs": {
       "version": "6.14.0",
-      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.14.0.tgz",
-      "integrity": "sha512-eOunJqu0K1923aExK6y8p6fsihYEn/BYuQ4g0CxAAgFc4b/ZLN4CrsRZ55srTdqoiLzU2B2evC+apEIxprEzkQ==",
       "license": "MIT"
     },
     "node_modules/@types/range-parser": {
       "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/@types/range-parser/-/range-parser-1.2.7.tgz",
-      "integrity": "sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ==",
       "license": "MIT"
     },
     "node_modules/@types/readdir-glob": {
       "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@types/readdir-glob/-/readdir-glob-1.1.5.tgz",
-      "integrity": "sha512-raiuEPUYqXu+nvtY2Pe8s8FEmZ3x5yAH4VkLdihcPdalvsHltomrRC9BzuStrJ9yk06470hS0Crw0f1pXqD+Hg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1872,8 +1599,6 @@
     },
     "node_modules/@types/request": {
       "version": "2.48.13",
-      "resolved": "https://registry.npmjs.org/@types/request/-/request-2.48.13.tgz",
-      "integrity": "sha512-FGJ6udDNUCjd19pp0Q3iTiDkwhYup7J8hpMW9c4k53NrccQFFWKRho6hvtPPEhnXWKvukfwAlB6DbDz4yhH5Gg==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -1885,8 +1610,6 @@
     },
     "node_modules/@types/request/node_modules/form-data": {
       "version": "2.5.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-2.5.5.tgz",
-      "integrity": "sha512-jqdObeR2rxZZbPSGL+3VckHMYtu+f9//KXBsVny6JSX/pa38Fy+bGjuG8eW/H6USNQWhLi8Num++cU2yOCNz4A==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -1903,8 +1626,6 @@
     },
     "node_modules/@types/send": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@types/send/-/send-1.2.1.tgz",
-      "integrity": "sha512-arsCikDvlU99zl1g69TcAB3mzZPpxgw0UQnaHeC1Nwb015xp8bknZv5rIfri9xTOcMuaVgvabfIRA7PSZVuZIQ==",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*"
@@ -1912,8 +1633,6 @@
     },
     "node_modules/@types/serve-static": {
       "version": "1.15.10",
-      "resolved": "https://registry.npmjs.org/@types/serve-static/-/serve-static-1.15.10.tgz",
-      "integrity": "sha512-tRs1dB+g8Itk72rlSI2ZrW6vZg0YrLI81iQSTkMmOqnqCaNr/8Ek4VwWcN5vZgCYWbg/JJSGBlUaYGAOP73qBw==",
       "license": "MIT",
       "dependencies": {
         "@types/http-errors": "*",
@@ -1923,8 +1642,6 @@
     },
     "node_modules/@types/serve-static/node_modules/@types/send": {
       "version": "0.17.6",
-      "resolved": "https://registry.npmjs.org/@types/send/-/send-0.17.6.tgz",
-      "integrity": "sha512-Uqt8rPBE8SY0RK8JB1EzVOIZ32uqy8HwdxCnoCOsYrvnswqmFZ/k+9Ikidlk/ImhsdvBsloHbAlewb2IEBV/Og==",
       "license": "MIT",
       "dependencies": {
         "@types/mime": "^1",
@@ -1933,23 +1650,17 @@
     },
     "node_modules/@types/stack-utils": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/@types/stack-utils/-/stack-utils-2.0.3.tgz",
-      "integrity": "sha512-9aEbYZ3TbYMznPdcdr3SmIrLXwC/AKZXQeCf9Pgao5CKb8CyHuEX5jzWPTkvregvhRJHcpRO6BFoGW9ycaOkYw==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/@types/tough-cookie": {
       "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/@types/tough-cookie/-/tough-cookie-4.0.5.tgz",
-      "integrity": "sha512-/Ad8+nIOV7Rl++6f1BdKxFSMgmoqEoYbHRpPcx3JEfv8VRsQe9Z4mCXeJBzxs7mbHY/XOZZuXlRNfhpVPbs6ZA==",
       "license": "MIT",
       "optional": true
     },
     "node_modules/@types/yargs": {
       "version": "17.0.35",
-      "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-17.0.35.tgz",
-      "integrity": "sha512-qUHkeCyQFxMXg79wQfTtfndEC+N9ZZg76HJftDJp+qH2tV7Gj4OJi7l+PiWwJ+pWtW8GwSmqsDj/oymhrTWXjg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -1959,16 +1670,12 @@
     },
     "node_modules/@types/yargs-parser": {
       "version": "21.0.3",
-      "resolved": "https://registry.npmjs.org/@types/yargs-parser/-/yargs-parser-21.0.3.tgz",
-      "integrity": "sha512-I4q9QU9MQv4oEOz4tAHJtNz1cwuLxn2F3xcc2iV5WdqLPpUnj30aUuxt1mAxYTG+oe8CZMV/+6rU4S4gRDzqtQ==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/@ungap/structured-clone": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.0.tgz",
-      "integrity": "sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==",
       "dev": true,
       "license": "ISC",
       "peer": true
@@ -2005,8 +1712,6 @@
     },
     "node_modules/@unrs/resolver-binding-darwin-arm64": {
       "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-darwin-arm64/-/resolver-binding-darwin-arm64-1.11.1.tgz",
-      "integrity": "sha512-gPVA1UjRu1Y/IsB/dQEsp2V1pm44Of6+LWvbLc9SDk1c2KhhDRDBUkQCYVWe6f26uJb3fOK8saWMgtX8IrMk3g==",
       "cpu": [
         "arm64"
       ],
@@ -2086,6 +1791,9 @@
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2101,6 +1809,9 @@
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2116,6 +1827,9 @@
         "ppc64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2131,6 +1845,9 @@
         "riscv64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2146,6 +1863,9 @@
         "riscv64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2161,6 +1881,9 @@
         "s390x"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2176,6 +1899,9 @@
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2191,6 +1917,9 @@
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2263,8 +1992,6 @@
     },
     "node_modules/abort-controller": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz",
-      "integrity": "sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==",
       "license": "MIT",
       "dependencies": {
         "event-target-shim": "^5.0.0"
@@ -2275,8 +2002,6 @@
     },
     "node_modules/accepts": {
       "version": "1.3.8",
-      "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
-      "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",
       "license": "MIT",
       "dependencies": {
         "mime-types": "~2.1.34",
@@ -2288,8 +2013,6 @@
     },
     "node_modules/agent-base": {
       "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
-      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -2301,8 +2024,6 @@
     },
     "node_modules/agent-base/node_modules/debug": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -2319,15 +2040,11 @@
     },
     "node_modules/agent-base/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "license": "MIT",
       "optional": true
     },
     "node_modules/ansi-escapes": {
       "version": "4.3.2",
-      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz",
-      "integrity": "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -2343,8 +2060,6 @@
     },
     "node_modules/ansi-regex": {
       "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
-      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -2355,8 +2070,6 @@
     },
     "node_modules/ansi-styles": {
       "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
       "license": "MIT",
       "dependencies": {
         "color-convert": "^2.0.1"
@@ -2370,8 +2083,6 @@
     },
     "node_modules/anymatch": {
       "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-3.1.3.tgz",
-      "integrity": "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==",
       "dev": true,
       "license": "ISC",
       "peer": true,
@@ -2385,8 +2096,6 @@
     },
     "node_modules/archiver": {
       "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/archiver/-/archiver-7.0.1.tgz",
-      "integrity": "sha512-ZcbTaIqJOfCc03QwD468Unz/5Ir8ATtvAHsK+FdXbDIbGfihqh9mrvdcYunQzqn4HrvWWaFyaxJhGZagaJJpPQ==",
       "license": "MIT",
       "dependencies": {
         "archiver-utils": "^5.0.2",
@@ -2403,8 +2112,6 @@
     },
     "node_modules/archiver-utils": {
       "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/archiver-utils/-/archiver-utils-5.0.2.tgz",
-      "integrity": "sha512-wuLJMmIBQYCsGZgYLTy5FIB2pF6Lfb6cXMSF8Qywwk3t20zWnAi7zLcQFdKQmIB8wyZpY5ER38x08GbwtR2cLA==",
       "license": "MIT",
       "dependencies": {
         "glob": "^10.0.0",
@@ -2421,8 +2128,6 @@
     },
     "node_modules/archiver-utils/node_modules/buffer": {
       "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz",
-      "integrity": "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==",
       "funding": [
         {
           "type": "github",
@@ -2445,8 +2150,6 @@
     },
     "node_modules/archiver-utils/node_modules/readable-stream": {
       "version": "4.7.0",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-4.7.0.tgz",
-      "integrity": "sha512-oIGGmcpTLwPga8Bn6/Z75SVaH1z5dUut2ibSyAMVhmUggWpmDn2dapB0n7f8nwaSiRtepAsfJyfXIO5DCVAODg==",
       "license": "MIT",
       "dependencies": {
         "abort-controller": "^3.0.0",
@@ -2461,8 +2164,6 @@
     },
     "node_modules/archiver/node_modules/buffer": {
       "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz",
-      "integrity": "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==",
       "funding": [
         {
           "type": "github",
@@ -2485,8 +2186,6 @@
     },
     "node_modules/archiver/node_modules/buffer-crc32": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-1.0.0.tgz",
-      "integrity": "sha512-Db1SbgBS/fg/392AblrMJk97KggmvYhr4pB5ZIMTWtaivCPMWLkmb7m21cJvpvgK+J3nsU2CmmixNBZx4vFj/w==",
       "license": "MIT",
       "engines": {
         "node": ">=8.0.0"
@@ -2494,8 +2193,6 @@
     },
     "node_modules/archiver/node_modules/readable-stream": {
       "version": "4.7.0",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-4.7.0.tgz",
-      "integrity": "sha512-oIGGmcpTLwPga8Bn6/Z75SVaH1z5dUut2ibSyAMVhmUggWpmDn2dapB0n7f8nwaSiRtepAsfJyfXIO5DCVAODg==",
       "license": "MIT",
       "dependencies": {
         "abort-controller": "^3.0.0",
@@ -2510,8 +2207,6 @@
     },
     "node_modules/argparse": {
       "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
-      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -2521,14 +2216,10 @@
     },
     "node_modules/array-flatten": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
-      "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
       "license": "MIT"
     },
     "node_modules/arrify": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/arrify/-/arrify-2.0.1.tgz",
-      "integrity": "sha512-3duEwti880xqi4eAMN8AyR4a0ByT90zoYdLlevfrvU43vb0YZwZVfxOgxWrLXXXpyugL0hNZc9G6BiB5B3nUug==",
       "license": "MIT",
       "optional": true,
       "engines": {
@@ -2537,14 +2228,10 @@
     },
     "node_modules/async": {
       "version": "3.2.6",
-      "resolved": "https://registry.npmjs.org/async/-/async-3.2.6.tgz",
-      "integrity": "sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==",
       "license": "MIT"
     },
     "node_modules/async-retry": {
       "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/async-retry/-/async-retry-1.3.3.tgz",
-      "integrity": "sha512-wfr/jstw9xNi/0teMHrRW7dsz3Lt5ARhYNZ2ewpadnhaIp5mbALhOAP+EAdsC7t4Z6wqsDVv9+W6gm1Dk9mEyw==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -2553,15 +2240,11 @@
     },
     "node_modules/asynckit": {
       "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
-      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==",
       "license": "MIT",
       "optional": true
     },
     "node_modules/b4a": {
       "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/b4a/-/b4a-1.8.0.tgz",
-      "integrity": "sha512-qRuSmNSkGQaHwNbM7J78Wwy+ghLEYF1zNrSeMxj4Kgw6y33O3mXcQ6Ie9fRvfU/YnxWkOchPXbaLb73TkIsfdg==",
       "license": "Apache-2.0",
       "peerDependencies": {
         "react-native-b4a": "*"
@@ -2574,8 +2257,6 @@
     },
     "node_modules/babel-jest": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/babel-jest/-/babel-jest-30.2.0.tgz",
-      "integrity": "sha512-0YiBEOxWqKkSQWL9nNGGEgndoeL0ZpWrbLMNL5u/Kaxrli3Eaxlt3ZtIDktEvXt4L/R9r3ODr2zKwGM/2BjxVw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -2597,8 +2278,6 @@
     },
     "node_modules/babel-plugin-istanbul": {
       "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/babel-plugin-istanbul/-/babel-plugin-istanbul-7.0.1.tgz",
-      "integrity": "sha512-D8Z6Qm8jCvVXtIRkBnqNHX0zJ37rQcFJ9u8WOS6tkYOsRdHBzypCstaxWiu5ZIlqQtviRYbgnRLSoCEvjqcqbA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "peer": true,
@@ -2618,8 +2297,6 @@
     },
     "node_modules/babel-plugin-jest-hoist": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-30.2.0.tgz",
-      "integrity": "sha512-ftzhzSGMUnOzcCXd6WHdBGMyuwy15Wnn0iyyWGKgBDLxf9/s5ABuraCSpBX2uG0jUg4rqJnxsLc5+oYBqoxVaA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -2632,8 +2309,6 @@
     },
     "node_modules/babel-preset-current-node-syntax": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/babel-preset-current-node-syntax/-/babel-preset-current-node-syntax-1.2.0.tgz",
-      "integrity": "sha512-E/VlAEzRrsLEb2+dv8yp3bo4scof3l9nR4lrld+Iy5NyVqgVYUJnDAmunkhPMisRI32Qc4iRiz425d8vM++2fg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -2660,8 +2335,6 @@
     },
     "node_modules/babel-preset-jest": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/babel-preset-jest/-/babel-preset-jest-30.2.0.tgz",
-      "integrity": "sha512-US4Z3NOieAQumwFnYdUWKvUKh8+YSnS/gB3t6YBiz0bskpu7Pine8pPCheNxlPEW4wnUkma2a94YuW2q3guvCQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -2678,14 +2351,10 @@
     },
     "node_modules/balanced-match": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
       "license": "MIT"
     },
     "node_modules/bare-events": {
       "version": "2.8.2",
-      "resolved": "https://registry.npmjs.org/bare-events/-/bare-events-2.8.2.tgz",
-      "integrity": "sha512-riJjyv1/mHLIPX4RwiK+oW9/4c3TEUeORHKefKAKnZ5kyslbN+HXowtbaVEqt4IMUB7OXlfixcs6gsFeo/jhiQ==",
       "license": "Apache-2.0",
       "peerDependencies": {
         "bare-abort-controller": "*"
@@ -2698,8 +2367,6 @@
     },
     "node_modules/bare-fs": {
       "version": "4.5.6",
-      "resolved": "https://registry.npmjs.org/bare-fs/-/bare-fs-4.5.6.tgz",
-      "integrity": "sha512-1QovqDrR80Pmt5HPAsMsXTCFcDYr+NSUKW6nd6WO5v0JBmnItc/irNRzm2KOQ5oZ69P37y+AMujNyNtG+1Rggw==",
       "license": "Apache-2.0",
       "dependencies": {
         "bare-events": "^2.5.4",
@@ -2722,8 +2389,6 @@
     },
     "node_modules/bare-os": {
       "version": "3.8.2",
-      "resolved": "https://registry.npmjs.org/bare-os/-/bare-os-3.8.2.tgz",
-      "integrity": "sha512-lMseYRMTzMrxPGfXkDwOWym2iv9dUMlTqpjXa0M+7ymI1TJKhxQ2jkDOK7y1EGvxuqJcXOoJ/HYEBxIlWObgjQ==",
       "license": "Apache-2.0",
       "engines": {
         "bare": ">=1.14.0"
@@ -2731,8 +2396,6 @@
     },
     "node_modules/bare-path": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/bare-path/-/bare-path-3.0.0.tgz",
-      "integrity": "sha512-tyfW2cQcB5NN8Saijrhqn0Zh7AnFNsnczRcuWODH0eYAXBsJ5gVxAUuNr7tsHSC6IZ77cA0SitzT+s47kot8Mw==",
       "license": "Apache-2.0",
       "dependencies": {
         "bare-os": "^3.0.1"
@@ -2740,8 +2403,6 @@
     },
     "node_modules/bare-stream": {
       "version": "2.11.0",
-      "resolved": "https://registry.npmjs.org/bare-stream/-/bare-stream-2.11.0.tgz",
-      "integrity": "sha512-Y/+iQ49fL3rIn6w/AVxI/2+BRrpmzJvdWt5Jv8Za6Ngqc6V227c+pYjYYgLdpR3MwQ9ObVXD0ZrqoBztakM0rw==",
       "license": "Apache-2.0",
       "dependencies": {
         "streamx": "^2.25.0",
@@ -2766,8 +2427,6 @@
     },
     "node_modules/bare-url": {
       "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/bare-url/-/bare-url-2.4.0.tgz",
-      "integrity": "sha512-NSTU5WN+fy/L0DDenfE8SXQna4voXuW0FHM7wH8i3/q9khUSchfPbPezO4zSFMnDGIf9YE+mt/RWhZgNRKRIXA==",
       "license": "Apache-2.0",
       "dependencies": {
         "bare-path": "^3.0.0"
@@ -2775,8 +2434,6 @@
     },
     "node_modules/base64-js": {
       "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
-      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
       "funding": [
         {
           "type": "github",
@@ -2795,8 +2452,6 @@
     },
     "node_modules/baseline-browser-mapping": {
       "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.0.tgz",
-      "integrity": "sha512-lIyg0szRfYbiy67j9KN8IyeD7q7hcmqnJ1ddWmNt19ItGpNN64mnllmxUNFIOdOm6by97jlL6wfpTTJrmnjWAA==",
       "dev": true,
       "license": "Apache-2.0",
       "peer": true,
@@ -2809,8 +2464,6 @@
     },
     "node_modules/bignumber.js": {
       "version": "9.3.1",
-      "resolved": "https://registry.npmjs.org/bignumber.js/-/bignumber.js-9.3.1.tgz",
-      "integrity": "sha512-Ko0uX15oIUS7wJ3Rb30Fs6SkVbLmPBAKdlm7q9+ak9bbIeFf0MwuBsQV6z7+X768/cHsfg+WlysDWJcmthjsjQ==",
       "license": "MIT",
       "engines": {
         "node": "*"
@@ -2818,8 +2471,6 @@
     },
     "node_modules/body-parser": {
       "version": "1.20.4",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.4.tgz",
-      "integrity": "sha512-ZTgYYLMOXY9qKU/57FAo8F+HA2dGX7bqGc71txDRC1rS4frdFI5R7NhluHxH6M0YItAP0sHB4uqAOcYKxO6uGA==",
       "license": "MIT",
       "dependencies": {
         "bytes": "~3.1.2",
@@ -2842,8 +2493,6 @@
     },
     "node_modules/brace-expansion": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0"
@@ -2851,8 +2500,6 @@
     },
     "node_modules/braces": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
-      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -2865,8 +2512,6 @@
     },
     "node_modules/browserslist": {
       "version": "4.28.1",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.1.tgz",
-      "integrity": "sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==",
       "dev": true,
       "funding": [
         {
@@ -2900,8 +2545,6 @@
     },
     "node_modules/bser": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/bser/-/bser-2.1.1.tgz",
-      "integrity": "sha512-gQxTNE/GAfIIrmHLUE3oJyp5FO6HRBfhjnw4/wMmA63ZGDJnWBmgY/lyQBpnDUkGmAhbSe39tx2d/iTOAfglwQ==",
       "dev": true,
       "license": "Apache-2.0",
       "peer": true,
@@ -2911,22 +2554,16 @@
     },
     "node_modules/buffer-equal-constant-time": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz",
-      "integrity": "sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==",
       "license": "BSD-3-Clause"
     },
     "node_modules/buffer-from": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
-      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/bytes": {
       "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
-      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -2934,8 +2571,6 @@
     },
     "node_modules/call-bind-apply-helpers": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
-      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
@@ -2947,8 +2582,6 @@
     },
     "node_modules/call-bound": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
-      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
       "license": "MIT",
       "dependencies": {
         "call-bind-apply-helpers": "^1.0.2",
@@ -2963,8 +2596,6 @@
     },
     "node_modules/callsites": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
-      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -2974,8 +2605,6 @@
     },
     "node_modules/camelcase": {
       "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz",
-      "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -2985,8 +2614,6 @@
     },
     "node_modules/caniuse-lite": {
       "version": "1.0.30001774",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001774.tgz",
-      "integrity": "sha512-DDdwPGz99nmIEv216hKSgLD+D4ikHQHjBC/seF98N9CPqRX4M5mSxT9eTV6oyisnJcuzxtZy4n17yKKQYmYQOA==",
       "dev": true,
       "funding": [
         {
@@ -3007,8 +2634,6 @@
     },
     "node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -3025,8 +2650,6 @@
     },
     "node_modules/char-regex": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/char-regex/-/char-regex-1.0.2.tgz",
-      "integrity": "sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -3036,8 +2659,6 @@
     },
     "node_modules/ci-info": {
       "version": "4.4.0",
-      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-4.4.0.tgz",
-      "integrity": "sha512-77PSwercCZU2Fc4sX94eF8k8Pxte6JAwL4/ICZLFjJLqegs7kCuAsqqj/70NQF6TvDpgFjkubQB2FW2ZZddvQg==",
       "dev": true,
       "funding": [
         {
@@ -3053,16 +2674,12 @@
     },
     "node_modules/cjs-module-lexer": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-2.2.0.tgz",
-      "integrity": "sha512-4bHTS2YuzUvtoLjdy+98ykbNB5jS0+07EvFNXerqZQJ89F7DI6ET7OQo/HJuW6K0aVsKA9hj9/RVb2kQVOrPDQ==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/cliui": {
       "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
-      "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
       "devOptional": true,
       "license": "ISC",
       "dependencies": {
@@ -3076,8 +2693,6 @@
     },
     "node_modules/cliui/node_modules/ansi-regex": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -3086,15 +2701,11 @@
     },
     "node_modules/cliui/node_modules/emoji-regex": {
       "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
       "devOptional": true,
       "license": "MIT"
     },
     "node_modules/cliui/node_modules/string-width": {
       "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -3108,8 +2719,6 @@
     },
     "node_modules/cliui/node_modules/strip-ansi": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -3121,8 +2730,6 @@
     },
     "node_modules/cliui/node_modules/wrap-ansi": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -3139,8 +2746,6 @@
     },
     "node_modules/co": {
       "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/co/-/co-4.6.0.tgz",
-      "integrity": "sha512-QVb0dM5HvG+uaxitm8wONl7jltx8dqhfU33DcqtOZcLSVIKSDDLDi7+0LbAKiyI8hD9u42m2YxXSkMGWThaecQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -3151,16 +2756,12 @@
     },
     "node_modules/collect-v8-coverage": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/collect-v8-coverage/-/collect-v8-coverage-1.0.3.tgz",
-      "integrity": "sha512-1L5aqIkwPfiodaMgQunkF1zRhNqifHBmtbbbxcr6yVxxBnliw4TDOW6NxpO8DJLgJ16OT+Y4ztZqP6p/FtXnAw==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/color-convert": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
       "license": "MIT",
       "dependencies": {
         "color-name": "~1.1.4"
@@ -3171,14 +2772,10 @@
     },
     "node_modules/color-name": {
       "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
       "license": "MIT"
     },
     "node_modules/combined-stream": {
       "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
-      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -3190,8 +2787,6 @@
     },
     "node_modules/compress-commons": {
       "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/compress-commons/-/compress-commons-6.0.2.tgz",
-      "integrity": "sha512-6FqVXeETqWPoGcfzrXb37E50NP0LXT8kAMu5ooZayhWWdgEY4lBEEcbQNXtkuKQsGduxiIcI4gOTsxTmuq/bSg==",
       "license": "MIT",
       "dependencies": {
         "crc-32": "^1.2.0",
@@ -3206,8 +2801,6 @@
     },
     "node_modules/compress-commons/node_modules/buffer": {
       "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz",
-      "integrity": "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==",
       "funding": [
         {
           "type": "github",
@@ -3230,8 +2823,6 @@
     },
     "node_modules/compress-commons/node_modules/readable-stream": {
       "version": "4.7.0",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-4.7.0.tgz",
-      "integrity": "sha512-oIGGmcpTLwPga8Bn6/Z75SVaH1z5dUut2ibSyAMVhmUggWpmDn2dapB0n7f8nwaSiRtepAsfJyfXIO5DCVAODg==",
       "license": "MIT",
       "dependencies": {
         "abort-controller": "^3.0.0",
@@ -3246,16 +2837,12 @@
     },
     "node_modules/concat-map": {
       "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
-      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/content-disposition": {
       "version": "0.5.4",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
-      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
       "license": "MIT",
       "dependencies": {
         "safe-buffer": "5.2.1"
@@ -3266,8 +2853,6 @@
     },
     "node_modules/content-type": {
       "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
-      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -3275,16 +2860,12 @@
     },
     "node_modules/convert-source-map": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
-      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/cookie": {
       "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
-      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -3292,20 +2873,14 @@
     },
     "node_modules/cookie-signature": {
       "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.7.tgz",
-      "integrity": "sha512-NXdYc3dLr47pBkpUCHtKSwIOQXLVn8dZEuywboCOJY/osA0wFSLlSawr3KN8qXJEyX66FcONTH8EIlVuK0yyFA==",
       "license": "MIT"
     },
     "node_modules/core-util-is": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
-      "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
       "license": "MIT"
     },
     "node_modules/cors": {
       "version": "2.8.6",
-      "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.6.tgz",
-      "integrity": "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==",
       "license": "MIT",
       "dependencies": {
         "object-assign": "^4",
@@ -3321,8 +2896,6 @@
     },
     "node_modules/crc-32": {
       "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/crc-32/-/crc-32-1.2.2.tgz",
-      "integrity": "sha512-ROmzCKrTnOwybPcJApAA6WBWij23HVfGVNKqqrZpuyZOHqK2CwHSvpGuyt/UNNvaIjEd8X5IFGp4Mh+Ie1IHJQ==",
       "license": "Apache-2.0",
       "bin": {
         "crc32": "bin/crc32.njs"
@@ -3333,8 +2906,6 @@
     },
     "node_modules/crc32-stream": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/crc32-stream/-/crc32-stream-6.0.0.tgz",
-      "integrity": "sha512-piICUB6ei4IlTv1+653yq5+KoqfBYmj9bw6LqXoOneTMDXk5nM1qt12mFW1caG3LlJXEKW1Bp0WggEmIfQB34g==",
       "license": "MIT",
       "dependencies": {
         "crc-32": "^1.2.0",
@@ -3346,8 +2917,6 @@
     },
     "node_modules/crc32-stream/node_modules/buffer": {
       "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz",
-      "integrity": "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==",
       "funding": [
         {
           "type": "github",
@@ -3370,8 +2939,6 @@
     },
     "node_modules/crc32-stream/node_modules/readable-stream": {
       "version": "4.7.0",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-4.7.0.tgz",
-      "integrity": "sha512-oIGGmcpTLwPga8Bn6/Z75SVaH1z5dUut2ibSyAMVhmUggWpmDn2dapB0n7f8nwaSiRtepAsfJyfXIO5DCVAODg==",
       "license": "MIT",
       "dependencies": {
         "abort-controller": "^3.0.0",
@@ -3386,8 +2953,6 @@
     },
     "node_modules/cross-spawn": {
       "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
-      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
       "license": "MIT",
       "dependencies": {
         "path-key": "^3.1.0",
@@ -3406,8 +2971,6 @@
     },
     "node_modules/csv-string": {
       "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/csv-string/-/csv-string-4.1.1.tgz",
-      "integrity": "sha512-KGvaJEZEdh2O/EVvczwbPLqJZtSQaWQ4cEJbiOJEG4ALq+dBBqNmBkRXTF4NV79V25+XYtiqbco1IWrmHLm5FQ==",
       "license": "MIT",
       "engines": {
         "node": ">=12.0"
@@ -3415,8 +2978,6 @@
     },
     "node_modules/data-uri-to-buffer": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/data-uri-to-buffer/-/data-uri-to-buffer-4.0.1.tgz",
-      "integrity": "sha512-0R9ikRb668HB7QDxT1vkpuUBtqc53YyAwMwGeUFKRojY/NWKvdZ+9UYtRfGmhqNbRkTSVpMbmyhXipFFv2cb/A==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"
@@ -3424,8 +2985,6 @@
     },
     "node_modules/debug": {
       "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
       "license": "MIT",
       "dependencies": {
         "ms": "2.0.0"
@@ -3433,8 +2992,6 @@
     },
     "node_modules/dedent": {
       "version": "1.7.1",
-      "resolved": "https://registry.npmjs.org/dedent/-/dedent-1.7.1.tgz",
-      "integrity": "sha512-9JmrhGZpOlEgOLdQgSm0zxFaYoQon408V1v49aqTWuXENVlnCuY9JBZcXZiCsZQWDjTm5Qf/nIvAy77mXDAjEg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -3449,8 +3006,6 @@
     },
     "node_modules/deepmerge": {
       "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz",
-      "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -3460,8 +3015,6 @@
     },
     "node_modules/delayed-stream": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
-      "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
       "license": "MIT",
       "optional": true,
       "engines": {
@@ -3470,8 +3023,6 @@
     },
     "node_modules/depd": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
-      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -3479,8 +3030,6 @@
     },
     "node_modules/destroy": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
-      "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8",
@@ -3489,8 +3038,6 @@
     },
     "node_modules/detect-newline": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz",
-      "integrity": "sha512-TLz+x/vEXm/Y7P7wn1EJFNLxYpUD4TgMosxY6fAVJUnJMbupHBOncxyWUG9OpTaH9EBD7uFI5LfEgmMOc54DsA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -3500,8 +3047,6 @@
     },
     "node_modules/dunder-proto": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
-      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
       "license": "MIT",
       "dependencies": {
         "call-bind-apply-helpers": "^1.0.1",
@@ -3514,8 +3059,6 @@
     },
     "node_modules/duplexify": {
       "version": "4.1.3",
-      "resolved": "https://registry.npmjs.org/duplexify/-/duplexify-4.1.3.tgz",
-      "integrity": "sha512-M3BmBhwJRZsSx38lZyhE53Csddgzl5R7xGJNk7CVddZD6CcmwMCH8J+7AprIrQKH7TonKxaCjcv27Qmf+sQ+oA==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -3527,14 +3070,10 @@
     },
     "node_modules/eastasianwidth": {
       "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
-      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
       "license": "MIT"
     },
     "node_modules/ecdsa-sig-formatter": {
       "version": "1.0.11",
-      "resolved": "https://registry.npmjs.org/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.11.tgz",
-      "integrity": "sha512-nagl3RYrbNv6kQkeJIpt6NJZy8twLB/2vtz6yN9Z4vRKHN4/QZJIEbqohALSgwKdnksuY3k5Addp5lg8sVoVcQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "safe-buffer": "^5.0.1"
@@ -3542,22 +3081,16 @@
     },
     "node_modules/ee-first": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
-      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
       "license": "MIT"
     },
     "node_modules/electron-to-chromium": {
       "version": "1.5.302",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.302.tgz",
-      "integrity": "sha512-sM6HAN2LyK82IyPBpznDRqlTQAtuSaO+ShzFiWTvoMJLHyZ+Y39r8VMfHzwbU8MVBzQ4Wdn85+wlZl2TLGIlwg==",
       "dev": true,
       "license": "ISC",
       "peer": true
     },
     "node_modules/emittery": {
       "version": "0.13.1",
-      "resolved": "https://registry.npmjs.org/emittery/-/emittery-0.13.1.tgz",
-      "integrity": "sha512-DeWwawk6r5yR9jFgnDKYt4sLS0LmHJJi3ZOnb5/JdbYwj3nW+FxQnHIjhBKz8YLC7oRNPVM9NQ47I3CVx34eqQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -3570,14 +3103,10 @@
     },
     "node_modules/emoji-regex": {
       "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
-      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
       "license": "MIT"
     },
     "node_modules/encodeurl": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
-      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -3585,8 +3114,6 @@
     },
     "node_modules/end-of-stream": {
       "version": "1.4.5",
-      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
-      "integrity": "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -3595,8 +3122,6 @@
     },
     "node_modules/error-ex": {
       "version": "1.3.4",
-      "resolved": "https://registry.npmjs.org/error-ex/-/error-ex-1.3.4.tgz",
-      "integrity": "sha512-sqQamAnR14VgCr1A618A3sGrygcpK+HEbenA/HiEAkkUwcZIIB/tgWqHFxWgOyDh4nB4JCRimh79dR5Ywc9MDQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -3606,8 +3131,6 @@
     },
     "node_modules/es-define-property": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
-      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -3615,8 +3138,6 @@
     },
     "node_modules/es-errors": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
-      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -3624,8 +3145,6 @@
     },
     "node_modules/es-object-atoms": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
-      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0"
@@ -3636,8 +3155,6 @@
     },
     "node_modules/es-set-tostringtag": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz",
-      "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -3652,8 +3169,6 @@
     },
     "node_modules/escalade": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
-      "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -3662,14 +3177,10 @@
     },
     "node_modules/escape-html": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
-      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
       "license": "MIT"
     },
     "node_modules/escape-string-regexp": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-2.0.0.tgz",
-      "integrity": "sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -3679,8 +3190,6 @@
     },
     "node_modules/esprima": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
-      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
       "dev": true,
       "license": "BSD-2-Clause",
       "peer": true,
@@ -3694,8 +3203,6 @@
     },
     "node_modules/etag": {
       "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
-      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -3703,8 +3210,6 @@
     },
     "node_modules/event-target-shim": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/event-target-shim/-/event-target-shim-5.0.1.tgz",
-      "integrity": "sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -3712,8 +3217,6 @@
     },
     "node_modules/events": {
       "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
-      "integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==",
       "license": "MIT",
       "engines": {
         "node": ">=0.8.x"
@@ -3721,8 +3224,6 @@
     },
     "node_modules/events-universal": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/events-universal/-/events-universal-1.0.1.tgz",
-      "integrity": "sha512-LUd5euvbMLpwOF8m6ivPCbhQeSiYVNb8Vs0fQ8QjXo0JTkEHpz8pxdQf0gStltaPpw0Cca8b39KxvK9cfKRiAw==",
       "license": "Apache-2.0",
       "dependencies": {
         "bare-events": "^2.7.0"
@@ -3730,8 +3231,6 @@
     },
     "node_modules/execa": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
-      "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -3755,16 +3254,12 @@
     },
     "node_modules/execa/node_modules/signal-exit": {
       "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
-      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
       "dev": true,
       "license": "ISC",
       "peer": true
     },
     "node_modules/exit-x": {
       "version": "0.2.2",
-      "resolved": "https://registry.npmjs.org/exit-x/-/exit-x-0.2.2.tgz",
-      "integrity": "sha512-+I6B/IkJc1o/2tiURyz/ivu/O0nKNEArIUB5O7zBrlDVJr22SCLH3xTeEry428LvFhRzIA1g8izguxJ/gbNcVQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -3774,8 +3269,6 @@
     },
     "node_modules/expect": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/expect/-/expect-30.2.0.tgz",
-      "integrity": "sha512-u/feCi0GPsI+988gU2FLcsHyAHTU0MX1Wg68NhAnN7z/+C5wqG+CY8J53N9ioe8RXgaoz0nBR/TYMf3AycUuPw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -3793,8 +3286,6 @@
     },
     "node_modules/express": {
       "version": "4.22.1",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.22.1.tgz",
-      "integrity": "sha512-F2X8g9P1X7uCPZMA3MVf9wcTqlyNp7IhH5qPCI0izhaOIYXaW9L535tGA3qmjRzpH+bZczqq7hVKxTR4NWnu+g==",
       "license": "MIT",
       "dependencies": {
         "accepts": "~1.3.8",
@@ -3839,14 +3330,10 @@
     },
     "node_modules/extend": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
-      "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
       "license": "MIT"
     },
     "node_modules/farmhash-modern": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/farmhash-modern/-/farmhash-modern-1.1.0.tgz",
-      "integrity": "sha512-6ypT4XfgqJk/F3Yuv4SX26I3doUjt0GTG4a+JgWxXQpxXzTBq8fPUeGHfcYMMDPHJHm3yPOSjaeBwBGAHWXCdA==",
       "license": "MIT",
       "engines": {
         "node": ">=18.0.0"
@@ -3854,28 +3341,20 @@
     },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
-      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
       "license": "MIT"
     },
     "node_modules/fast-fifo": {
       "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz",
-      "integrity": "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==",
       "license": "MIT"
     },
     "node_modules/fast-json-stable-stringify": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
-      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/fast-xml-builder": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.0.0.tgz",
-      "integrity": "sha512-fpZuDogrAgnyt9oDDz+5DBz0zgPdPZz6D4IR7iESxRXElrlGTRkHJ9eEt+SACRJwT0FNFrt71DFQIUFBJfX/uQ==",
       "funding": [
         {
           "type": "github",
@@ -3887,8 +3366,6 @@
     },
     "node_modules/fast-xml-parser": {
       "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.4.1.tgz",
-      "integrity": "sha512-BQ30U1mKkvXQXXkAGcuyUA/GA26oEB7NzOtsxCDtyu62sjGw5QraKFhx2Em3WQNjPw9PG6MQ9yuIIgkSDfGu5A==",
       "funding": [
         {
           "type": "github",
@@ -3907,8 +3384,6 @@
     },
     "node_modules/faye-websocket": {
       "version": "0.11.4",
-      "resolved": "https://registry.npmjs.org/faye-websocket/-/faye-websocket-0.11.4.tgz",
-      "integrity": "sha512-CzbClwlXAuiRQAlUyfqPgvPoNKTckTPGfwZV4ZdAhVcP2lh9KUxJg2b5GkE7XbjKQ3YJnQ9z6D9ntLAlB+tP8g==",
       "license": "Apache-2.0",
       "dependencies": {
         "websocket-driver": ">=0.5.1"
@@ -3919,8 +3394,6 @@
     },
     "node_modules/fb-watchman": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/fb-watchman/-/fb-watchman-2.0.2.tgz",
-      "integrity": "sha512-p5161BqbuCaSnB8jIbzQHOlpgsPmK5rJVDfDKO91Axs5NC1uu3HRQm6wt9cd9/+GtQQIO53JdGXXoyDpTAsgYA==",
       "dev": true,
       "license": "Apache-2.0",
       "peer": true,
@@ -3930,8 +3403,6 @@
     },
     "node_modules/fetch-blob": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/fetch-blob/-/fetch-blob-3.2.0.tgz",
-      "integrity": "sha512-7yAQpD2UMJzLi1Dqv7qFYnPbaPx7ZfFK6PiIxQ4PfkGPyNyl2Ugx+a/umUonmKqjhM4DnfbMvdX6otXq83soQQ==",
       "funding": [
         {
           "type": "github",
@@ -3953,8 +3424,6 @@
     },
     "node_modules/fill-range": {
       "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
-      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -3967,8 +3436,6 @@
     },
     "node_modules/finalhandler": {
       "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.2.tgz",
-      "integrity": "sha512-aA4RyPcd3badbdABGDuTXCMTtOneUCAYH/gxoYRTZlIJdF0YPWuGqiAsIrhNnnqdXGswYk6dGujem4w80UJFhg==",
       "license": "MIT",
       "dependencies": {
         "debug": "2.6.9",
@@ -3985,8 +3452,6 @@
     },
     "node_modules/find-up": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz",
-      "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -4000,8 +3465,6 @@
     },
     "node_modules/firebase-admin": {
       "version": "13.7.0",
-      "resolved": "https://registry.npmjs.org/firebase-admin/-/firebase-admin-13.7.0.tgz",
-      "integrity": "sha512-o3qS8zCJbApe7aKzkO2Pa380t9cHISqeSd3blqYTtOuUUUua3qZTLwNWgGUOss3td6wbzrZhiHIj3c8+fC046Q==",
       "license": "Apache-2.0",
       "dependencies": {
         "@fastify/busboy": "^3.0.0",
@@ -4025,8 +3488,6 @@
     },
     "node_modules/firebase-functions": {
       "version": "7.2.2",
-      "resolved": "https://registry.npmjs.org/firebase-functions/-/firebase-functions-7.2.2.tgz",
-      "integrity": "sha512-fWFVI+4weuaat+Fp+4xYY1T+omiTvya8fW79+edgLWCOaDEBSBNlfhstnt+K1esblscZlJf8v+IA0LsCG8Uf1Q==",
       "license": "MIT",
       "dependencies": {
         "@types/cors": "^2.8.5",
@@ -4061,8 +3522,6 @@
     },
     "node_modules/firebase-functions-test": {
       "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/firebase-functions-test/-/firebase-functions-test-3.4.1.tgz",
-      "integrity": "sha512-qAq0oszrBGdf4bnCF6t4FoSgMsepeIXh0Pi/FhikSE6e+TvKKGpfrfUP/5pFjJZxFcLsweoau88KydCql4xSeg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4081,8 +3540,6 @@
     },
     "node_modules/foreground-child": {
       "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
-      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
       "license": "ISC",
       "dependencies": {
         "cross-spawn": "^7.0.6",
@@ -4097,8 +3554,6 @@
     },
     "node_modules/formdata-polyfill": {
       "version": "4.0.10",
-      "resolved": "https://registry.npmjs.org/formdata-polyfill/-/formdata-polyfill-4.0.10.tgz",
-      "integrity": "sha512-buewHzMvYL29jdeQTVILecSaZKnt/RJWjoZCF5OW60Z67/GmSLBkOFM7qh1PI3zFNtJbaZL5eQu1vLfazOwj4g==",
       "license": "MIT",
       "dependencies": {
         "fetch-blob": "^3.1.2"
@@ -4109,8 +3564,6 @@
     },
     "node_modules/forwarded": {
       "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
-      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -4118,8 +3571,6 @@
     },
     "node_modules/fresh": {
       "version": "0.5.2",
-      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
-      "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -4127,18 +3578,13 @@
     },
     "node_modules/fs.realpath": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
-      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
       "dev": true,
       "license": "ISC",
       "peer": true
     },
     "node_modules/fsevents": {
       "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
-      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
       "dev": true,
-      "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4151,8 +3597,6 @@
     },
     "node_modules/function-bind": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
-      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
@@ -4160,15 +3604,11 @@
     },
     "node_modules/functional-red-black-tree": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/functional-red-black-tree/-/functional-red-black-tree-1.0.1.tgz",
-      "integrity": "sha512-dsKNQNdj6xA3T+QlADDA7mOSlX0qiMINjn0cgr+eGHGsbSHzTabcIogz2+p/iqP1Xs6EP/sS2SbqH+brGTbq0g==",
       "license": "MIT",
       "optional": true
     },
     "node_modules/gaxios": {
       "version": "6.7.1",
-      "resolved": "https://registry.npmjs.org/gaxios/-/gaxios-6.7.1.tgz",
-      "integrity": "sha512-LDODD4TMYx7XXdpwxAVRAIAuB0bzv0s+ywFonY46k126qzQHT9ygyoa9tncmOiQmmDrik65UYsEkv3lbfqQ3yQ==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -4184,8 +3624,6 @@
     },
     "node_modules/gaxios/node_modules/agent-base": {
       "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
-      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
       "license": "MIT",
       "optional": true,
       "engines": {
@@ -4194,8 +3632,6 @@
     },
     "node_modules/gaxios/node_modules/debug": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -4212,8 +3648,6 @@
     },
     "node_modules/gaxios/node_modules/https-proxy-agent": {
       "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -4226,15 +3660,11 @@
     },
     "node_modules/gaxios/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "license": "MIT",
       "optional": true
     },
     "node_modules/gaxios/node_modules/node-fetch": {
       "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz",
-      "integrity": "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -4254,8 +3684,6 @@
     },
     "node_modules/gaxios/node_modules/uuid": {
       "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
-      "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
@@ -4268,8 +3696,6 @@
     },
     "node_modules/gcp-metadata": {
       "version": "8.1.2",
-      "resolved": "https://registry.npmjs.org/gcp-metadata/-/gcp-metadata-8.1.2.tgz",
-      "integrity": "sha512-zV/5HKTfCeKWnxG0Dmrw51hEWFGfcF2xiXqcA3+J90WDuP0SvoiSO5ORvcBsifmx/FoIjgQN3oNOGaQ5PhLFkg==",
       "license": "Apache-2.0",
       "dependencies": {
         "gaxios": "^7.0.0",
@@ -4282,8 +3708,6 @@
     },
     "node_modules/gcp-metadata/node_modules/agent-base": {
       "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
-      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 14"
@@ -4291,8 +3715,6 @@
     },
     "node_modules/gcp-metadata/node_modules/debug": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "license": "MIT",
       "dependencies": {
         "ms": "^2.1.3"
@@ -4308,8 +3730,6 @@
     },
     "node_modules/gcp-metadata/node_modules/gaxios": {
       "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/gaxios/-/gaxios-7.1.3.tgz",
-      "integrity": "sha512-YGGyuEdVIjqxkxVH1pUTMY/XtmmsApXrCVv5EU25iX6inEPbV+VakJfLealkBtJN69AQmh1eGOdCl9Sm1UP6XQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "extend": "^3.0.2",
@@ -4323,8 +3743,6 @@
     },
     "node_modules/gcp-metadata/node_modules/https-proxy-agent": {
       "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
       "license": "MIT",
       "dependencies": {
         "agent-base": "^7.1.2",
@@ -4336,14 +3754,10 @@
     },
     "node_modules/gcp-metadata/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "license": "MIT"
     },
     "node_modules/gcp-metadata/node_modules/rimraf": {
       "version": "5.0.10",
-      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-5.0.10.tgz",
-      "integrity": "sha512-l0OE8wL34P4nJH/H2ffoaniAokM2qSmrtXHmlpvYr5AVVX8msAyW0l8NVJFDxlSK4u3Uh/f41cQheDVdnYijwQ==",
       "license": "ISC",
       "dependencies": {
         "glob": "^10.3.7"
@@ -4357,8 +3771,6 @@
     },
     "node_modules/gensync": {
       "version": "1.0.0-beta.2",
-      "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
-      "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -4368,8 +3780,6 @@
     },
     "node_modules/get-caller-file": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
-      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
       "devOptional": true,
       "license": "ISC",
       "engines": {
@@ -4378,8 +3788,6 @@
     },
     "node_modules/get-intrinsic": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
-      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
       "license": "MIT",
       "dependencies": {
         "call-bind-apply-helpers": "^1.0.2",
@@ -4402,8 +3810,6 @@
     },
     "node_modules/get-package-type": {
       "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/get-package-type/-/get-package-type-0.1.0.tgz",
-      "integrity": "sha512-pjzuKtY64GYfWizNAJ0fr9VqttZkNiK2iS430LtIHzjBEr6bX8Am2zm4sW4Ro5wjWW5cAlRL1qAMTcXbjNAO2Q==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -4413,8 +3819,6 @@
     },
     "node_modules/get-proto": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
-      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
       "license": "MIT",
       "dependencies": {
         "dunder-proto": "^1.0.1",
@@ -4426,8 +3830,6 @@
     },
     "node_modules/get-stream": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
-      "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -4440,9 +3842,6 @@
     },
     "node_modules/glob": {
       "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
-      "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "license": "ISC",
       "dependencies": {
         "foreground-child": "^3.1.0",
@@ -4461,8 +3860,6 @@
     },
     "node_modules/google-auth-library": {
       "version": "10.6.1",
-      "resolved": "https://registry.npmjs.org/google-auth-library/-/google-auth-library-10.6.1.tgz",
-      "integrity": "sha512-5awwuLrzNol+pFDmKJd0dKtZ0fPLAtoA5p7YO4ODsDu6ONJUVqbYwvv8y2ZBO5MBNp9TJXigB19710kYpBPdtA==",
       "license": "Apache-2.0",
       "dependencies": {
         "base64-js": "^1.3.0",
@@ -4478,8 +3875,6 @@
     },
     "node_modules/google-auth-library/node_modules/agent-base": {
       "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
-      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 14"
@@ -4487,8 +3882,6 @@
     },
     "node_modules/google-auth-library/node_modules/debug": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "license": "MIT",
       "dependencies": {
         "ms": "^2.1.3"
@@ -4504,8 +3897,6 @@
     },
     "node_modules/google-auth-library/node_modules/gaxios": {
       "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/gaxios/-/gaxios-7.1.3.tgz",
-      "integrity": "sha512-YGGyuEdVIjqxkxVH1pUTMY/XtmmsApXrCVv5EU25iX6inEPbV+VakJfLealkBtJN69AQmh1eGOdCl9Sm1UP6XQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "extend": "^3.0.2",
@@ -4519,8 +3910,6 @@
     },
     "node_modules/google-auth-library/node_modules/https-proxy-agent": {
       "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
       "license": "MIT",
       "dependencies": {
         "agent-base": "^7.1.2",
@@ -4532,14 +3921,10 @@
     },
     "node_modules/google-auth-library/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "license": "MIT"
     },
     "node_modules/google-auth-library/node_modules/rimraf": {
       "version": "5.0.10",
-      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-5.0.10.tgz",
-      "integrity": "sha512-l0OE8wL34P4nJH/H2ffoaniAokM2qSmrtXHmlpvYr5AVVX8msAyW0l8NVJFDxlSK4u3Uh/f41cQheDVdnYijwQ==",
       "license": "ISC",
       "dependencies": {
         "glob": "^10.3.7"
@@ -4553,8 +3938,6 @@
     },
     "node_modules/google-gax": {
       "version": "4.6.1",
-      "resolved": "https://registry.npmjs.org/google-gax/-/google-gax-4.6.1.tgz",
-      "integrity": "sha512-V6eky/xz2mcKfAd1Ioxyd6nmA61gao3n01C+YeuIwu3vzM9EDR6wcVzMSIbLMDXWeoi9SHYctXuKYC5uJUT3eQ==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -4577,8 +3960,6 @@
     },
     "node_modules/google-gax/node_modules/gcp-metadata": {
       "version": "6.1.1",
-      "resolved": "https://registry.npmjs.org/gcp-metadata/-/gcp-metadata-6.1.1.tgz",
-      "integrity": "sha512-a4tiq7E0/5fTjxPAaH4jpjkSv/uCaU2p5KC6HVGrvl0cDjA8iBZv4vv1gyzlmK0ZUKqwpOyQMKzZQe3lTit77A==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -4592,8 +3973,6 @@
     },
     "node_modules/google-gax/node_modules/google-auth-library": {
       "version": "9.15.1",
-      "resolved": "https://registry.npmjs.org/google-auth-library/-/google-auth-library-9.15.1.tgz",
-      "integrity": "sha512-Jb6Z0+nvECVz+2lzSMt9u98UsoakXxA2HGHMCxh+so3n90XgYWkq5dur19JAJV7ONiJY22yBTyJB1TSkvPq9Ng==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -4610,8 +3989,6 @@
     },
     "node_modules/google-gax/node_modules/google-logging-utils": {
       "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/google-logging-utils/-/google-logging-utils-0.0.2.tgz",
-      "integrity": "sha512-NEgUnEcBiP5HrPzufUkBzJOD/Sxsco3rLNo1F1TNf7ieU8ryUzBhqba8r756CjLX7rn3fHl6iLEwPYuqpoKgQQ==",
       "license": "Apache-2.0",
       "optional": true,
       "engines": {
@@ -4620,8 +3997,6 @@
     },
     "node_modules/google-gax/node_modules/node-fetch": {
       "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz",
-      "integrity": "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -4641,8 +4016,6 @@
     },
     "node_modules/google-gax/node_modules/uuid": {
       "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
-      "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
@@ -4655,8 +4028,6 @@
     },
     "node_modules/google-logging-utils": {
       "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/google-logging-utils/-/google-logging-utils-1.1.3.tgz",
-      "integrity": "sha512-eAmLkjDjAFCVXg7A1unxHsLf961m6y17QFqXqAXGj/gVkKFrEICfStRfwUlGNfeCEjNRa32JEWOUTlYXPyyKvA==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=14"
@@ -4664,8 +4035,6 @@
     },
     "node_modules/gopd": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
-      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -4676,14 +4045,10 @@
     },
     "node_modules/graceful-fs": {
       "version": "4.2.11",
-      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
-      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
       "license": "ISC"
     },
     "node_modules/gtoken": {
       "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/gtoken/-/gtoken-7.1.0.tgz",
-      "integrity": "sha512-pCcEwRi+TKpMlxAQObHDQ56KawURgyAf6jtIY046fJ5tIv3zDe/LEIubckAO8fj6JnAxLdmWkUfNyulQ2iKdEw==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -4696,8 +4061,6 @@
     },
     "node_modules/has-flag": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
-      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -4707,8 +4070,6 @@
     },
     "node_modules/has-symbols": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
-      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -4719,8 +4080,6 @@
     },
     "node_modules/has-tostringtag": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz",
-      "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -4735,8 +4094,6 @@
     },
     "node_modules/hasown": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
       "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"
@@ -4747,8 +4104,6 @@
     },
     "node_modules/html-entities": {
       "version": "2.6.0",
-      "resolved": "https://registry.npmjs.org/html-entities/-/html-entities-2.6.0.tgz",
-      "integrity": "sha512-kig+rMn/QOVRvr7c86gQ8lWXq+Hkv6CbAH1hLu+RG338StTpE8Z0b44SDVaqVu7HGKf27frdmUYEs9hTUX/cLQ==",
       "funding": [
         {
           "type": "github",
@@ -4764,16 +4119,12 @@
     },
     "node_modules/html-escaper": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
-      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/http-errors": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
-      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
       "license": "MIT",
       "dependencies": {
         "depd": "~2.0.0",
@@ -4792,14 +4143,10 @@
     },
     "node_modules/http-parser-js": {
       "version": "0.5.10",
-      "resolved": "https://registry.npmjs.org/http-parser-js/-/http-parser-js-0.5.10.tgz",
-      "integrity": "sha512-Pysuw9XpUq5dVc/2SMHpuTY01RFl8fttgcyunjL7eEMhGM3cI4eOmiCycJDVCo/7O7ClfQD3SaI6ftDzqOXYMA==",
       "license": "MIT"
     },
     "node_modules/http-proxy-agent": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-5.0.0.tgz",
-      "integrity": "sha512-n2hY8YdoRE1i7r6M0w9DIw5GgZN0G25P8zLCRQ8rjXtTU3vsNFBI/vWK/UIeE6g5MUUz6avwAPXmL6Fy9D/90w==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -4813,8 +4160,6 @@
     },
     "node_modules/http-proxy-agent/node_modules/debug": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -4831,15 +4176,11 @@
     },
     "node_modules/http-proxy-agent/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "license": "MIT",
       "optional": true
     },
     "node_modules/https-proxy-agent": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
-      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -4852,8 +4193,6 @@
     },
     "node_modules/https-proxy-agent/node_modules/debug": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -4870,15 +4209,11 @@
     },
     "node_modules/https-proxy-agent/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "license": "MIT",
       "optional": true
     },
     "node_modules/human-signals": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz",
-      "integrity": "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==",
       "dev": true,
       "license": "Apache-2.0",
       "peer": true,
@@ -4888,8 +4223,6 @@
     },
     "node_modules/iconv-lite": {
       "version": "0.4.24",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
-      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
       "license": "MIT",
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3"
@@ -4900,8 +4233,6 @@
     },
     "node_modules/ieee754": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
-      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
       "funding": [
         {
           "type": "github",
@@ -4920,8 +4251,6 @@
     },
     "node_modules/import-local": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/import-local/-/import-local-3.2.0.tgz",
-      "integrity": "sha512-2SPlun1JUPWoM6t3F0dw0FkCF/jWY8kttcY4f599GLTSjh2OCuuhdTkJQsEcZzBqbXZGKMK2OqW1oZsjtf/gQA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -4941,8 +4270,6 @@
     },
     "node_modules/imurmurhash": {
       "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
-      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -4952,9 +4279,6 @@
     },
     "node_modules/inflight": {
       "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
-      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
-      "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.",
       "dev": true,
       "license": "ISC",
       "peer": true,
@@ -4965,14 +4289,10 @@
     },
     "node_modules/inherits": {
       "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
       "license": "ISC"
     },
     "node_modules/ipaddr.js": {
       "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
-      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.10"
@@ -4980,16 +4300,12 @@
     },
     "node_modules/is-arrayish": {
       "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.2.1.tgz",
-      "integrity": "sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/is-base64": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/is-base64/-/is-base64-1.1.0.tgz",
-      "integrity": "sha512-Nlhg7Z2dVC4/PTvIFkgVVNvPHSO2eR/Yd0XzhGiXCXEvWnptXlXa/clQ8aePPiMuxEGcWfzWbGw2Fe3d+Y3v1g==",
       "license": "MIT",
       "bin": {
         "is_base64": "bin/is-base64",
@@ -4998,8 +4314,6 @@
     },
     "node_modules/is-fullwidth-code-point": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -5007,8 +4321,6 @@
     },
     "node_modules/is-generator-fn": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/is-generator-fn/-/is-generator-fn-2.1.0.tgz",
-      "integrity": "sha512-cTIB4yPYL/Grw0EaSzASzg6bBy9gqCofvWN8okThAYIxKJZC+udlRAmGbM0XLeniEJSs8uEgHPGuHSe1XsOLSQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5018,8 +4330,6 @@
     },
     "node_modules/is-number": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
-      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5029,8 +4339,6 @@
     },
     "node_modules/is-stream": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
-      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -5041,20 +4349,14 @@
     },
     "node_modules/isarray": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
-      "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
       "license": "MIT"
     },
     "node_modules/isexe": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
       "license": "ISC"
     },
     "node_modules/istanbul-lib-coverage": {
       "version": "3.2.2",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz",
-      "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==",
       "dev": true,
       "license": "BSD-3-Clause",
       "peer": true,
@@ -5064,8 +4366,6 @@
     },
     "node_modules/istanbul-lib-instrument": {
       "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-instrument/-/istanbul-lib-instrument-6.0.3.tgz",
-      "integrity": "sha512-Vtgk7L/R2JHyyGW07spoFlB8/lpjiOLTjMdms6AFMraYt3BaJauod/NGrfnVG/y4Ix1JEuMRPDPEj2ua+zz1/Q==",
       "dev": true,
       "license": "BSD-3-Clause",
       "peer": true,
@@ -5082,8 +4382,6 @@
     },
     "node_modules/istanbul-lib-instrument/node_modules/semver": {
       "version": "7.7.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
-      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
       "dev": true,
       "license": "ISC",
       "peer": true,
@@ -5096,8 +4394,6 @@
     },
     "node_modules/istanbul-lib-report": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz",
-      "integrity": "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "peer": true,
@@ -5112,8 +4408,6 @@
     },
     "node_modules/istanbul-lib-source-maps": {
       "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-source-maps/-/istanbul-lib-source-maps-5.0.6.tgz",
-      "integrity": "sha512-yg2d+Em4KizZC5niWhQaIomgf5WlL4vOOjZ5xGCmF8SnPE/mDWWXgvRExdcpCgh9lLRRa1/fSYp2ymmbJ1pI+A==",
       "dev": true,
       "license": "BSD-3-Clause",
       "peer": true,
@@ -5128,8 +4422,6 @@
     },
     "node_modules/istanbul-lib-source-maps/node_modules/debug": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5147,16 +4439,12 @@
     },
     "node_modules/istanbul-lib-source-maps/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/istanbul-reports": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz",
-      "integrity": "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "peer": true,
@@ -5170,8 +4458,6 @@
     },
     "node_modules/jackspeak": {
       "version": "3.4.3",
-      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
-      "integrity": "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "@isaacs/cliui": "^8.0.2"
@@ -5185,8 +4471,6 @@
     },
     "node_modules/jest": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest/-/jest-30.2.0.tgz",
-      "integrity": "sha512-F26gjC0yWN8uAA5m5Ss8ZQf5nDHWGlN/xWZIh8S5SRbsEKBovwZhxGd6LJlbZYxBgCYOtreSUyb8hpXyGC5O4A==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5213,8 +4497,6 @@
     },
     "node_modules/jest-changed-files": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-changed-files/-/jest-changed-files-30.2.0.tgz",
-      "integrity": "sha512-L8lR1ChrRnSdfeOvTrwZMlnWV8G/LLjQ0nG9MBclwWZidA2N5FviRki0Bvh20WRMOX31/JYvzdqTJrk5oBdydQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5229,8 +4511,6 @@
     },
     "node_modules/jest-circus": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-circus/-/jest-circus-30.2.0.tgz",
-      "integrity": "sha512-Fh0096NC3ZkFx05EP2OXCxJAREVxj1BcW/i6EWqqymcgYKWjyyDpral3fMxVcHXg6oZM7iULer9wGRFvfpl+Tg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5262,8 +4542,6 @@
     },
     "node_modules/jest-cli": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-cli/-/jest-cli-30.2.0.tgz",
-      "integrity": "sha512-Os9ukIvADX/A9sLt6Zse3+nmHtHaE6hqOsjQtNiugFTbKRHYIYtZXNGNK9NChseXy7djFPjndX1tL0sCTlfpAA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5296,8 +4574,6 @@
     },
     "node_modules/jest-config": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-config/-/jest-config-30.2.0.tgz",
-      "integrity": "sha512-g4WkyzFQVWHtu6uqGmQR4CQxz/CH3yDSlhzXMWzNjDx843gYjReZnMRanjRCq5XZFuQrGDxgUaiYWE8BRfVckA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5349,8 +4625,6 @@
     },
     "node_modules/jest-diff": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-30.2.0.tgz",
-      "integrity": "sha512-dQHFo3Pt4/NLlG5z4PxZ/3yZTZ1C7s9hveiOj+GCN+uT109NC2QgsoVZsVOAvbJ3RgKkvyLGXZV9+piDpWbm6A==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5366,8 +4640,6 @@
     },
     "node_modules/jest-docblock": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-docblock/-/jest-docblock-30.2.0.tgz",
-      "integrity": "sha512-tR/FFgZKS1CXluOQzZvNH3+0z9jXr3ldGSD8bhyuxvlVUwbeLOGynkunvlTMxchC5urrKndYiwCFC0DLVjpOCA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5380,8 +4652,6 @@
     },
     "node_modules/jest-each": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-each/-/jest-each-30.2.0.tgz",
-      "integrity": "sha512-lpWlJlM7bCUf1mfmuqTA8+j2lNURW9eNafOy99knBM01i5CQeY5UH1vZjgT9071nDJac1M4XsbyI44oNOdhlDQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5398,8 +4668,6 @@
     },
     "node_modules/jest-environment-node": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-environment-node/-/jest-environment-node-30.2.0.tgz",
-      "integrity": "sha512-ElU8v92QJ9UrYsKrxDIKCxu6PfNj4Hdcktcn0JX12zqNdqWHB0N+hwOnnBBXvjLd2vApZtuLUGs1QSY+MsXoNA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5418,8 +4686,6 @@
     },
     "node_modules/jest-haste-map": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-30.2.0.tgz",
-      "integrity": "sha512-sQA/jCb9kNt+neM0anSj6eZhLZUIhQgwDt7cPGjumgLM4rXsfb9kpnlacmvZz3Q5tb80nS+oG/if+NBKrHC+Xw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5444,8 +4710,6 @@
     },
     "node_modules/jest-leak-detector": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-leak-detector/-/jest-leak-detector-30.2.0.tgz",
-      "integrity": "sha512-M6jKAjyzjHG0SrQgwhgZGy9hFazcudwCNovY/9HPIicmNSBuockPSedAP9vlPK6ONFJ1zfyH/M2/YYJxOz5cdQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5459,8 +4723,6 @@
     },
     "node_modules/jest-matcher-utils": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-30.2.0.tgz",
-      "integrity": "sha512-dQ94Nq4dbzmUWkQ0ANAWS9tBRfqCrn0bV9AMYdOi/MHW726xn7eQmMeRTpX2ViC00bpNaWXq+7o4lIQ3AX13Hg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5476,8 +4738,6 @@
     },
     "node_modules/jest-message-util": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-30.2.0.tgz",
-      "integrity": "sha512-y4DKFLZ2y6DxTWD4cDe07RglV88ZiNEdlRfGtqahfbIjfsw1nMCPx49Uev4IA/hWn3sDKyAnSPwoYSsAEdcimw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5498,8 +4758,6 @@
     },
     "node_modules/jest-mock": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-30.2.0.tgz",
-      "integrity": "sha512-JNNNl2rj4b5ICpmAcq+WbLH83XswjPbjH4T7yvGzfAGCPh1rw+xVNbtk+FnRslvt9lkCcdn9i1oAoKUuFsOxRw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5514,8 +4772,6 @@
     },
     "node_modules/jest-pnp-resolver": {
       "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/jest-pnp-resolver/-/jest-pnp-resolver-1.2.3.tgz",
-      "integrity": "sha512-+3NpwQEnRoIBtx4fyhblQDPgJI0H1IEIkX7ShLUjPGA7TtUTvI1oiKi3SR4oBR0hQhQR80l4WAe5RrXBwWMA8w==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5533,8 +4789,6 @@
     },
     "node_modules/jest-regex-util": {
       "version": "30.0.1",
-      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-30.0.1.tgz",
-      "integrity": "sha512-jHEQgBXAgc+Gh4g0p3bCevgRCVRkB4VB70zhoAE48gxeSr1hfUOsM/C2WoJgVL7Eyg//hudYENbm3Ne+/dRVVA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5544,8 +4798,6 @@
     },
     "node_modules/jest-resolve": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-resolve/-/jest-resolve-30.2.0.tgz",
-      "integrity": "sha512-TCrHSxPlx3tBY3hWNtRQKbtgLhsXa1WmbJEqBlTBrGafd5fiQFByy2GNCEoGR+Tns8d15GaL9cxEzKOO3GEb2A==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5565,8 +4817,6 @@
     },
     "node_modules/jest-resolve-dependencies": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-resolve-dependencies/-/jest-resolve-dependencies-30.2.0.tgz",
-      "integrity": "sha512-xTOIGug/0RmIe3mmCqCT95yO0vj6JURrn1TKWlNbhiAefJRWINNPgwVkrVgt/YaerPzY3iItufd80v3lOrFJ2w==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5580,8 +4830,6 @@
     },
     "node_modules/jest-runner": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-runner/-/jest-runner-30.2.0.tgz",
-      "integrity": "sha512-PqvZ2B2XEyPEbclp+gV6KO/F1FIFSbIwewRgmROCMBo/aZ6J1w8Qypoj2pEOcg3G2HzLlaP6VUtvwCI8dM3oqQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5615,8 +4863,6 @@
     },
     "node_modules/jest-runtime": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-runtime/-/jest-runtime-30.2.0.tgz",
-      "integrity": "sha512-p1+GVX/PJqTucvsmERPMgCPvQJpFt4hFbM+VN3n8TMo47decMUcJbt+rgzwrEme0MQUA/R+1de2axftTHkKckg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5650,8 +4896,6 @@
     },
     "node_modules/jest-snapshot": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-30.2.0.tgz",
-      "integrity": "sha512-5WEtTy2jXPFypadKNpbNkZ72puZCa6UjSr/7djeecHWOu7iYhSXSnHScT8wBz3Rn8Ena5d5RYRcsyKIeqG1IyA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5684,8 +4928,6 @@
     },
     "node_modules/jest-snapshot/node_modules/semver": {
       "version": "7.7.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
-      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
       "dev": true,
       "license": "ISC",
       "peer": true,
@@ -5698,8 +4940,6 @@
     },
     "node_modules/jest-util": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-30.2.0.tgz",
-      "integrity": "sha512-QKNsM0o3Xe6ISQU869e+DhG+4CK/48aHYdJZGlFQVTjnbvgpcKyxpzk29fGiO7i/J8VENZ+d2iGnSsvmuHywlA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5717,8 +4957,6 @@
     },
     "node_modules/jest-util/node_modules/picomatch": {
       "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5731,8 +4969,6 @@
     },
     "node_modules/jest-validate": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-validate/-/jest-validate-30.2.0.tgz",
-      "integrity": "sha512-FBGWi7dP2hpdi8nBoWxSsLvBFewKAg0+uSQwBaof4Y4DPgBabXgpSYC5/lR7VmnIlSpASmCi/ntRWPbv7089Pw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5750,8 +4986,6 @@
     },
     "node_modules/jest-validate/node_modules/camelcase": {
       "version": "6.3.0",
-      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz",
-      "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5764,8 +4998,6 @@
     },
     "node_modules/jest-watcher": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-30.2.0.tgz",
-      "integrity": "sha512-PYxa28dxJ9g777pGm/7PrbnMeA0Jr7osHP9bS7eJy9DuAjMgdGtxgf0uKMyoIsTWAkIbUW5hSDdJ3urmgXBqxg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5785,8 +5017,6 @@
     },
     "node_modules/jest-worker": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-30.2.0.tgz",
-      "integrity": "sha512-0Q4Uk8WF7BUwqXHuAjc23vmopWJw5WH7w2tqBoUOZpOjW/ZnR44GXXd1r82RvnmI2GZge3ivrYXk/BE2+VtW2g==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5803,8 +5033,6 @@
     },
     "node_modules/jest-worker/node_modules/supports-color": {
       "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
-      "integrity": "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5820,8 +5048,6 @@
     },
     "node_modules/joi": {
       "version": "17.13.3",
-      "resolved": "https://registry.npmjs.org/joi/-/joi-17.13.3.tgz",
-      "integrity": "sha512-otDA4ldcIx+ZXsKHWmp0YizCweVRZG96J10b0FevjfuncLO1oX59THoAmHkNubYJ+9gWsYsp5k8v4ib6oDv1fA==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "@hapi/hoek": "^9.3.0",
@@ -5833,8 +5059,6 @@
     },
     "node_modules/jose": {
       "version": "4.15.9",
-      "resolved": "https://registry.npmjs.org/jose/-/jose-4.15.9.tgz",
-      "integrity": "sha512-1vUQX+IdDMVPj4k8kOxgUqlcK518yluMuGZwqlr44FS1ppZB/5GWh4rZG89erpOBOJjU/OBsnCVFfapsRz6nEA==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/panva"
@@ -5842,16 +5066,12 @@
     },
     "node_modules/js-tokens": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
-      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/js-yaml": {
       "version": "3.14.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
-      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5865,8 +5085,6 @@
     },
     "node_modules/jsesc": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz",
-      "integrity": "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5879,8 +5097,6 @@
     },
     "node_modules/json-bigint": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/json-bigint/-/json-bigint-1.0.0.tgz",
-      "integrity": "sha512-SiPv/8VpZuWbvLSMtTDU8hEfrZWg/mH/nV/b4o0CYbSxu1UIQPLdwKOCIyLQX+VIPO5vrLX3i8qtqFyhdPSUSQ==",
       "license": "MIT",
       "dependencies": {
         "bignumber.js": "^9.0.0"
@@ -5888,16 +5104,12 @@
     },
     "node_modules/json-parse-even-better-errors": {
       "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-2.3.1.tgz",
-      "integrity": "sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/json5": {
       "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
-      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -5910,8 +5122,6 @@
     },
     "node_modules/jsonwebtoken": {
       "version": "9.0.3",
-      "resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-9.0.3.tgz",
-      "integrity": "sha512-MT/xP0CrubFRNLNKvxJ2BYfy53Zkm++5bX9dtuPbqAeQpTVe0MQTFhao8+Cp//EmJp244xt6Drw/GVEGCUj40g==",
       "license": "MIT",
       "dependencies": {
         "jws": "^4.0.1",
@@ -5932,14 +5142,10 @@
     },
     "node_modules/jsonwebtoken/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "license": "MIT"
     },
     "node_modules/jsonwebtoken/node_modules/semver": {
       "version": "7.7.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
-      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -5950,8 +5156,6 @@
     },
     "node_modules/jwa": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/jwa/-/jwa-2.0.1.tgz",
-      "integrity": "sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==",
       "license": "MIT",
       "dependencies": {
         "buffer-equal-constant-time": "^1.0.1",
@@ -5961,8 +5165,6 @@
     },
     "node_modules/jwks-rsa": {
       "version": "3.2.2",
-      "resolved": "https://registry.npmjs.org/jwks-rsa/-/jwks-rsa-3.2.2.tgz",
-      "integrity": "sha512-BqTyEDV+lS8F2trk3A+qJnxV5Q9EqKCBJOPti3W97r7qTympCZjb7h2X6f2kc+0K3rsSTY1/6YG2eaXKoj497w==",
       "license": "MIT",
       "dependencies": {
         "@types/jsonwebtoken": "^9.0.4",
@@ -5977,8 +5179,6 @@
     },
     "node_modules/jwks-rsa/node_modules/debug": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "license": "MIT",
       "dependencies": {
         "ms": "^2.1.3"
@@ -5994,14 +5194,10 @@
     },
     "node_modules/jwks-rsa/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "license": "MIT"
     },
     "node_modules/jws": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/jws/-/jws-4.0.1.tgz",
-      "integrity": "sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==",
       "license": "MIT",
       "dependencies": {
         "jwa": "^2.0.1",
@@ -6010,8 +5206,6 @@
     },
     "node_modules/lazystream": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/lazystream/-/lazystream-1.0.1.tgz",
-      "integrity": "sha512-b94GiNHQNy6JNTrt5w6zNyffMrNkXZb3KTkCZJb2V1xaEGCk093vkZ2jk3tpaeP33/OiXC+WvK9AxUebnf5nbw==",
       "license": "MIT",
       "dependencies": {
         "readable-stream": "^2.0.5"
@@ -6022,8 +5216,6 @@
     },
     "node_modules/lazystream/node_modules/readable-stream": {
       "version": "2.3.8",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
-      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
       "license": "MIT",
       "dependencies": {
         "core-util-is": "~1.0.0",
@@ -6037,14 +5229,10 @@
     },
     "node_modules/lazystream/node_modules/safe-buffer": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
       "license": "MIT"
     },
     "node_modules/lazystream/node_modules/string_decoder": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
-      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
       "license": "MIT",
       "dependencies": {
         "safe-buffer": "~5.1.0"
@@ -6052,8 +5240,6 @@
     },
     "node_modules/leven": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/leven/-/leven-3.1.0.tgz",
-      "integrity": "sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6062,22 +5248,16 @@
       }
     },
     "node_modules/limiter": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/limiter/-/limiter-1.1.5.tgz",
-      "integrity": "sha512-FWWMIEOxz3GwUI4Ts/IvgVy6LPvoMPgjMdQ185nN6psJyBJ4yOpzqm695/h5umdLJg2vW3GR5iG11MAkR2AzJA=="
+      "version": "1.1.5"
     },
     "node_modules/lines-and-columns": {
       "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/lines-and-columns/-/lines-and-columns-1.2.4.tgz",
-      "integrity": "sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/locate-path": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
-      "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6090,75 +5270,51 @@
     },
     "node_modules/lodash": {
       "version": "4.17.23",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
-      "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
       "license": "MIT"
     },
     "node_modules/lodash.camelcase": {
       "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/lodash.camelcase/-/lodash.camelcase-4.3.0.tgz",
-      "integrity": "sha512-TwuEnCnxbc3rAvhf/LbG7tJUDzhqXyFnv3dtzLOPgCG/hODL7WFnsbwktkD7yUV0RrreP/l1PALq/YSg6VvjlA==",
       "license": "MIT",
       "optional": true
     },
     "node_modules/lodash.clonedeep": {
       "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/lodash.clonedeep/-/lodash.clonedeep-4.5.0.tgz",
-      "integrity": "sha512-H5ZhCF25riFd9uB5UCkVKo61m3S/xZk1x4wA6yp/L3RFP6Z/eHH1ymQcGLo7J3GMPfm0V/7m1tryHuGVxpqEBQ==",
       "license": "MIT"
     },
     "node_modules/lodash.includes": {
       "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/lodash.includes/-/lodash.includes-4.3.0.tgz",
-      "integrity": "sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w==",
       "license": "MIT"
     },
     "node_modules/lodash.isboolean": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/lodash.isboolean/-/lodash.isboolean-3.0.3.tgz",
-      "integrity": "sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg==",
       "license": "MIT"
     },
     "node_modules/lodash.isinteger": {
       "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/lodash.isinteger/-/lodash.isinteger-4.0.4.tgz",
-      "integrity": "sha512-DBwtEWN2caHQ9/imiNeEA5ys1JoRtRfY3d7V9wkqtbycnAmTvRRmbHKDV4a0EYc678/dia0jrte4tjYwVBaZUA==",
       "license": "MIT"
     },
     "node_modules/lodash.isnumber": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/lodash.isnumber/-/lodash.isnumber-3.0.3.tgz",
-      "integrity": "sha512-QYqzpfwO3/CWf3XP+Z+tkQsfaLL/EnUlXWVkIk5FUPc4sBdTehEqZONuyRt2P67PXAk+NXmTBcc97zw9t1FQrw==",
       "license": "MIT"
     },
     "node_modules/lodash.isplainobject": {
       "version": "4.0.6",
-      "resolved": "https://registry.npmjs.org/lodash.isplainobject/-/lodash.isplainobject-4.0.6.tgz",
-      "integrity": "sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==",
       "license": "MIT"
     },
     "node_modules/lodash.isstring": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/lodash.isstring/-/lodash.isstring-4.0.1.tgz",
-      "integrity": "sha512-0wJxfxH1wgO3GrbuP+dTTk7op+6L41QCXbGINEmD+ny/G/eCqGzxyCsh7159S+mgDDcoarnBw6PC1PS5+wUGgw==",
       "license": "MIT"
     },
     "node_modules/lodash.once": {
       "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/lodash.once/-/lodash.once-4.1.1.tgz",
-      "integrity": "sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==",
       "license": "MIT"
     },
     "node_modules/long": {
       "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
-      "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
       "license": "Apache-2.0"
     },
     "node_modules/lru-cache": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
-      "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
       "license": "ISC",
       "dependencies": {
         "yallist": "^4.0.0"
@@ -6169,8 +5325,6 @@
     },
     "node_modules/lru-memoizer": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/lru-memoizer/-/lru-memoizer-2.3.0.tgz",
-      "integrity": "sha512-GXn7gyHAMhO13WSKrIiNfztwxodVsP8IoZ3XfrJV4yH2x0/OeTO/FIaAHTY5YekdGgW94njfuKmyyt1E0mR6Ug==",
       "license": "MIT",
       "dependencies": {
         "lodash.clonedeep": "^4.5.0",
@@ -6179,8 +5333,6 @@
     },
     "node_modules/make-dir": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz",
-      "integrity": "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6196,8 +5348,6 @@
     },
     "node_modules/make-dir/node_modules/semver": {
       "version": "7.7.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
-      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
       "dev": true,
       "license": "ISC",
       "peer": true,
@@ -6210,8 +5360,6 @@
     },
     "node_modules/makeerror": {
       "version": "1.0.12",
-      "resolved": "https://registry.npmjs.org/makeerror/-/makeerror-1.0.12.tgz",
-      "integrity": "sha512-JmqCvUhmt43madlpFzG4BQzG2Z3m6tvQDNKdClZnO3VbIudJYmxsT0FNJMeiB2+JTSlTQTSbU8QdesVmwJcmLg==",
       "dev": true,
       "license": "BSD-3-Clause",
       "peer": true,
@@ -6221,8 +5369,6 @@
     },
     "node_modules/math-intrinsics": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
-      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -6230,8 +5376,6 @@
     },
     "node_modules/media-typer": {
       "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
-      "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -6239,8 +5383,6 @@
     },
     "node_modules/merge-descriptors": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.3.tgz",
-      "integrity": "sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
@@ -6248,16 +5390,12 @@
     },
     "node_modules/merge-stream": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz",
-      "integrity": "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/methods": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
-      "integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -6265,8 +5403,6 @@
     },
     "node_modules/micromatch": {
       "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
-      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6280,8 +5416,6 @@
     },
     "node_modules/mime": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/mime/-/mime-3.0.0.tgz",
-      "integrity": "sha512-jSCU7/VB1loIWBZe14aEYHU/+1UMEHoaO7qxCOVJOw9GgH72VAWppxNcjU+x9a2k3GSIBXNKxXQFqRvvZ7vr3A==",
       "license": "MIT",
       "optional": true,
       "bin": {
@@ -6293,8 +5427,6 @@
     },
     "node_modules/mime-types": {
       "version": "2.1.35",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
-      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
       "license": "MIT",
       "dependencies": {
         "mime-db": "1.52.0"
@@ -6305,8 +5437,6 @@
     },
     "node_modules/mime-types/node_modules/mime-db": {
       "version": "1.52.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
-      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -6314,8 +5444,6 @@
     },
     "node_modules/mimic-fn": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz",
-      "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6325,8 +5453,6 @@
     },
     "node_modules/minimatch": {
       "version": "9.0.9",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
-      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "license": "ISC",
       "dependencies": {
         "brace-expansion": "^2.0.2"
@@ -6340,8 +5466,6 @@
     },
     "node_modules/minipass": {
       "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
-      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -6349,14 +5473,26 @@
     },
     "node_modules/ms": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
       "license": "MIT"
     },
+    "node_modules/nanoid": {
+      "version": "5.1.16",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.js"
+      },
+      "engines": {
+        "node": "^18 || >=20"
+      }
+    },
     "node_modules/napi-postinstall": {
       "version": "0.3.4",
-      "resolved": "https://registry.npmjs.org/napi-postinstall/-/napi-postinstall-0.3.4.tgz",
-      "integrity": "sha512-PHI5f1O0EP5xJ9gQmFGMS6IZcrVvTjpXjz7Na41gTE7eE2hK11lg04CECCYEEjdc17EV4DO+fkGEtt7TpTaTiQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6372,16 +5508,12 @@
     },
     "node_modules/natural-compare": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
-      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/negotiator": {
       "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
-      "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -6389,9 +5521,6 @@
     },
     "node_modules/node-domexception": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/node-domexception/-/node-domexception-1.0.0.tgz",
-      "integrity": "sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ==",
-      "deprecated": "Use your platform's native DOMException instead",
       "funding": [
         {
           "type": "github",
@@ -6409,8 +5538,6 @@
     },
     "node_modules/node-fetch": {
       "version": "3.3.2",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-3.3.2.tgz",
-      "integrity": "sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA==",
       "license": "MIT",
       "dependencies": {
         "data-uri-to-buffer": "^4.0.0",
@@ -6427,8 +5554,6 @@
     },
     "node_modules/node-forge": {
       "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.3.3.tgz",
-      "integrity": "sha512-rLvcdSyRCyouf6jcOIPe/BgwG/d7hKjzMKOas33/pHEr6gbq18IK9zV7DiPvzsz0oBJPme6qr6H6kGZuI9/DZg==",
       "license": "(BSD-3-Clause OR GPL-2.0)",
       "engines": {
         "node": ">= 6.13.0"
@@ -6436,24 +5561,18 @@
     },
     "node_modules/node-int64": {
       "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz",
-      "integrity": "sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/node-releases": {
       "version": "2.0.27",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.27.tgz",
-      "integrity": "sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/normalize-path": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
-      "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -6461,8 +5580,6 @@
     },
     "node_modules/npm-run-path": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
-      "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6475,8 +5592,6 @@
     },
     "node_modules/object-assign": {
       "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
-      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -6484,8 +5599,6 @@
     },
     "node_modules/object-hash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/object-hash/-/object-hash-3.0.0.tgz",
-      "integrity": "sha512-RSn9F68PjH9HqtltsSnqYC1XXoWe9Bju5+213R98cNGttag9q9yAOTzdbsqvIa7aNm5WffBZFpWYr2aWrklWAw==",
       "license": "MIT",
       "optional": true,
       "engines": {
@@ -6494,8 +5607,6 @@
     },
     "node_modules/object-inspect": {
       "version": "1.13.4",
-      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
-      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -6506,8 +5617,6 @@
     },
     "node_modules/on-finished": {
       "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
-      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
       "license": "MIT",
       "dependencies": {
         "ee-first": "1.1.1"
@@ -6518,8 +5627,6 @@
     },
     "node_modules/once": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
       "devOptional": true,
       "license": "ISC",
       "dependencies": {
@@ -6528,8 +5635,6 @@
     },
     "node_modules/onetime": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
-      "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6545,8 +5650,6 @@
     },
     "node_modules/p-limit": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
-      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -6561,8 +5664,6 @@
     },
     "node_modules/p-locate": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz",
-      "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6575,8 +5676,6 @@
     },
     "node_modules/p-locate/node_modules/p-limit": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz",
-      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6592,8 +5691,6 @@
     },
     "node_modules/p-try": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz",
-      "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6603,14 +5700,10 @@
     },
     "node_modules/package-json-from-dist": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
-      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
       "license": "BlueOak-1.0.0"
     },
     "node_modules/parse-json": {
       "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/parse-json/-/parse-json-5.2.0.tgz",
-      "integrity": "sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6629,8 +5722,6 @@
     },
     "node_modules/parseurl": {
       "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
-      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -6638,8 +5729,6 @@
     },
     "node_modules/path-exists": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
-      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6649,8 +5738,6 @@
     },
     "node_modules/path-is-absolute": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
-      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6660,8 +5747,6 @@
     },
     "node_modules/path-key": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
-      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -6669,8 +5754,6 @@
     },
     "node_modules/path-scurry": {
       "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
-      "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "lru-cache": "^10.2.0",
@@ -6685,28 +5768,20 @@
     },
     "node_modules/path-scurry/node_modules/lru-cache": {
       "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
       "license": "ISC"
     },
     "node_modules/path-to-regexp": {
       "version": "0.1.12",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz",
-      "integrity": "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==",
       "license": "MIT"
     },
     "node_modules/picocolors": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
-      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
       "dev": true,
       "license": "ISC",
       "peer": true
     },
     "node_modules/picomatch": {
       "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
-      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6719,8 +5794,6 @@
     },
     "node_modules/pirates": {
       "version": "4.0.7",
-      "resolved": "https://registry.npmjs.org/pirates/-/pirates-4.0.7.tgz",
-      "integrity": "sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6730,8 +5803,6 @@
     },
     "node_modules/pkg-dir": {
       "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-4.2.0.tgz",
-      "integrity": "sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6744,8 +5815,6 @@
     },
     "node_modules/pretty-format": {
       "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.2.0.tgz",
-      "integrity": "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6760,8 +5829,6 @@
     },
     "node_modules/pretty-format/node_modules/ansi-styles": {
       "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
-      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6774,8 +5841,6 @@
     },
     "node_modules/process": {
       "version": "0.11.10",
-      "resolved": "https://registry.npmjs.org/process/-/process-0.11.10.tgz",
-      "integrity": "sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6.0"
@@ -6783,14 +5848,10 @@
     },
     "node_modules/process-nextick-args": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
-      "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
       "license": "MIT"
     },
     "node_modules/proto3-json-serializer": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/proto3-json-serializer/-/proto3-json-serializer-2.0.2.tgz",
-      "integrity": "sha512-SAzp/O4Yh02jGdRc+uIrGoe87dkN/XtwxfZ4ZyafJHymd79ozp5VG5nyZ7ygqPM5+cpLDjjGnYFUkngonyDPOQ==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -6802,8 +5863,6 @@
     },
     "node_modules/protobufjs": {
       "version": "7.5.4",
-      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.5.4.tgz",
-      "integrity": "sha512-CvexbZtbov6jW2eXAvLukXjXUW1TzFaivC46BpWc/3BpcCysb5Vffu+B3XHMm8lVEuy2Mm4XGex8hBSg1yapPg==",
       "hasInstallScript": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -6826,8 +5885,6 @@
     },
     "node_modules/proxy-addr": {
       "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
       "license": "MIT",
       "dependencies": {
         "forwarded": "0.2.0",
@@ -6839,8 +5896,6 @@
     },
     "node_modules/pure-rand": {
       "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-7.0.1.tgz",
-      "integrity": "sha512-oTUZM/NAZS8p7ANR3SHh30kXB+zK2r2BPcEn/awJIbOvq82WoMN4p62AWWp3Hhw50G0xMsw1mhIBLqHw64EcNQ==",
       "dev": true,
       "funding": [
         {
@@ -6857,8 +5912,6 @@
     },
     "node_modules/qs": {
       "version": "6.14.2",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",
-      "integrity": "sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "side-channel": "^1.1.0"
@@ -6872,8 +5925,6 @@
     },
     "node_modules/range-parser": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
-      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -6881,8 +5932,6 @@
     },
     "node_modules/raw-body": {
       "version": "2.5.3",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.3.tgz",
-      "integrity": "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==",
       "license": "MIT",
       "dependencies": {
         "bytes": "~3.1.2",
@@ -6896,16 +5945,12 @@
     },
     "node_modules/react-is": {
       "version": "18.3.1",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
-      "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
       "dev": true,
       "license": "MIT",
       "peer": true
     },
     "node_modules/readable-stream": {
       "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
-      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -6919,8 +5964,6 @@
     },
     "node_modules/readdir-glob": {
       "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/readdir-glob/-/readdir-glob-1.1.3.tgz",
-      "integrity": "sha512-v05I2k7xN8zXvPD9N+z/uhXPaj0sUFCe2rcWZIpBsqxfP7xXFQ0tipAd/wjj1YxWyWtUS5IDJpOG82JKt2EAVA==",
       "license": "Apache-2.0",
       "dependencies": {
         "minimatch": "^5.1.0"
@@ -6928,8 +5971,6 @@
     },
     "node_modules/readdir-glob/node_modules/minimatch": {
       "version": "5.1.9",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
-      "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
       "license": "ISC",
       "dependencies": {
         "brace-expansion": "^2.0.1"
@@ -6940,8 +5981,6 @@
     },
     "node_modules/require-directory": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
-      "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -6950,8 +5989,6 @@
     },
     "node_modules/resolve-cwd": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-cwd/-/resolve-cwd-3.0.0.tgz",
-      "integrity": "sha512-OrZaX2Mb+rJCpH/6CpSqt9xFVpN++x01XnN2ie9g6P5/3xelLAkXWVADpdz1IHD/KFfEXyE6V0U01OQ3UO2rEg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6964,8 +6001,6 @@
     },
     "node_modules/resolve-from": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz",
-      "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -6975,8 +6010,6 @@
     },
     "node_modules/retry": {
       "version": "0.13.1",
-      "resolved": "https://registry.npmjs.org/retry/-/retry-0.13.1.tgz",
-      "integrity": "sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==",
       "license": "MIT",
       "optional": true,
       "engines": {
@@ -6985,8 +6018,6 @@
     },
     "node_modules/retry-request": {
       "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/retry-request/-/retry-request-7.0.2.tgz",
-      "integrity": "sha512-dUOvLMJ0/JJYEn8NrpOaGNE7X3vpI5XlZS/u0ANjqtcZVKnIxP7IgCFwrKTxENw29emmwug53awKtaMm4i9g5w==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -7000,8 +6031,6 @@
     },
     "node_modules/safe-buffer": {
       "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
-      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
       "funding": [
         {
           "type": "github",
@@ -7020,14 +6049,10 @@
     },
     "node_modules/safer-buffer": {
       "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
-      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
       "license": "MIT"
     },
     "node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
       "dev": true,
       "license": "ISC",
       "peer": true,
@@ -7037,8 +6062,6 @@
     },
     "node_modules/send": {
       "version": "0.19.2",
-      "resolved": "https://registry.npmjs.org/send/-/send-0.19.2.tgz",
-      "integrity": "sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==",
       "license": "MIT",
       "dependencies": {
         "debug": "2.6.9",
@@ -7061,8 +6084,6 @@
     },
     "node_modules/send/node_modules/mime": {
       "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
-      "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==",
       "license": "MIT",
       "bin": {
         "mime": "cli.js"
@@ -7073,14 +6094,10 @@
     },
     "node_modules/send/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "license": "MIT"
     },
     "node_modules/serve-static": {
       "version": "1.16.3",
-      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.3.tgz",
-      "integrity": "sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA==",
       "license": "MIT",
       "dependencies": {
         "encodeurl": "~2.0.0",
@@ -7094,14 +6111,10 @@
     },
     "node_modules/setprototypeof": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
-      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
       "license": "ISC"
     },
     "node_modules/shebang-command": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
-      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
       "license": "MIT",
       "dependencies": {
         "shebang-regex": "^3.0.0"
@@ -7112,8 +6125,6 @@
     },
     "node_modules/shebang-regex": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
-      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -7121,8 +6132,6 @@
     },
     "node_modules/side-channel": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
-      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
@@ -7140,8 +6149,6 @@
     },
     "node_modules/side-channel-list": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
-      "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
@@ -7156,8 +6163,6 @@
     },
     "node_modules/side-channel-map": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
-      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.2",
@@ -7174,8 +6179,6 @@
     },
     "node_modules/side-channel-weakmap": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
-      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.2",
@@ -7193,8 +6196,6 @@
     },
     "node_modules/signal-exit": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
-      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
       "license": "ISC",
       "engines": {
         "node": ">=14"
@@ -7205,8 +6206,6 @@
     },
     "node_modules/slash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -7216,8 +6215,6 @@
     },
     "node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
       "dev": true,
       "license": "BSD-3-Clause",
       "peer": true,
@@ -7227,8 +6224,6 @@
     },
     "node_modules/source-map-support": {
       "version": "0.5.13",
-      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.13.tgz",
-      "integrity": "sha512-SHSKFHadjVA5oR4PPqhtAVdcBWwRYVd6g6cAXnIbRiIwc2EhPrTuKUBdSLvlEKyIP3GCf89fltvcZiP9MMFA1w==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -7239,16 +6234,12 @@
     },
     "node_modules/sprintf-js": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
-      "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==",
       "dev": true,
       "license": "BSD-3-Clause",
       "peer": true
     },
     "node_modules/stack-utils": {
       "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/stack-utils/-/stack-utils-2.0.6.tgz",
-      "integrity": "sha512-XlkWvfIm6RmsWtNJx+uqtKLS8eqFbxUg0ZzLXqY0caEy9l7hruX8IpiDnjsLavoBgqCCR71TqWO8MaXYheJ3RQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -7261,8 +6252,6 @@
     },
     "node_modules/statuses": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
-      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -7270,8 +6259,6 @@
     },
     "node_modules/stream-events": {
       "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/stream-events/-/stream-events-1.0.5.tgz",
-      "integrity": "sha512-E1GUzBSgvct8Jsb3v2X15pjzN1tYebtbLaMg+eBOUOAxgbLoSbT2NS91ckc5lJD1KfLjId+jXJRgo0qnV5Nerg==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -7280,15 +6267,11 @@
     },
     "node_modules/stream-shift": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/stream-shift/-/stream-shift-1.0.3.tgz",
-      "integrity": "sha512-76ORR0DO1o1hlKwTbi/DM3EXWGf3ZJYO8cXX5RJwnul2DEg2oyoZyjLNoQM8WsvZiFKCRfC1O0J7iCvie3RZmQ==",
       "license": "MIT",
       "optional": true
     },
     "node_modules/streamx": {
       "version": "2.25.0",
-      "resolved": "https://registry.npmjs.org/streamx/-/streamx-2.25.0.tgz",
-      "integrity": "sha512-0nQuG6jf1w+wddNEEXCF4nTg3LtufWINB5eFEN+5TNZW7KWJp6x87+JFL43vaAUPyCfH1wID+mNVyW6OHtFamg==",
       "license": "MIT",
       "dependencies": {
         "events-universal": "^1.0.0",
@@ -7298,8 +6281,6 @@
     },
     "node_modules/string_decoder": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
-      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
       "license": "MIT",
       "dependencies": {
         "safe-buffer": "~5.2.0"
@@ -7307,8 +6288,6 @@
     },
     "node_modules/string-length": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/string-length/-/string-length-4.0.2.tgz",
-      "integrity": "sha512-+l6rNN5fYHNhZZy41RXsYptCjA2Igmq4EG7kZAYFQI1E1VTXarr6ZPXBg6eq7Y6eK4FEhY6AJlyuFIb/v/S0VQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -7322,8 +6301,6 @@
     },
     "node_modules/string-length/node_modules/ansi-regex": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -7333,8 +6310,6 @@
     },
     "node_modules/string-length/node_modules/strip-ansi": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -7347,8 +6322,6 @@
     },
     "node_modules/string-width": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
-      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
       "license": "MIT",
       "dependencies": {
         "eastasianwidth": "^0.2.0",
@@ -7365,8 +6338,6 @@
     "node_modules/string-width-cjs": {
       "name": "string-width",
       "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
       "license": "MIT",
       "dependencies": {
         "emoji-regex": "^8.0.0",
@@ -7379,8 +6350,6 @@
     },
     "node_modules/string-width-cjs/node_modules/ansi-regex": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -7388,14 +6357,10 @@
     },
     "node_modules/string-width-cjs/node_modules/emoji-regex": {
       "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
       "license": "MIT"
     },
     "node_modules/string-width-cjs/node_modules/strip-ansi": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
       "license": "MIT",
       "dependencies": {
         "ansi-regex": "^5.0.1"
@@ -7406,8 +6371,6 @@
     },
     "node_modules/strip-ansi": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
-      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "license": "MIT",
       "dependencies": {
         "ansi-regex": "^6.2.2"
@@ -7422,8 +6385,6 @@
     "node_modules/strip-ansi-cjs": {
       "name": "strip-ansi",
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
       "license": "MIT",
       "dependencies": {
         "ansi-regex": "^5.0.1"
@@ -7434,8 +6395,6 @@
     },
     "node_modules/strip-ansi-cjs/node_modules/ansi-regex": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -7443,8 +6402,6 @@
     },
     "node_modules/strip-bom": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-4.0.0.tgz",
-      "integrity": "sha512-3xurFv5tEgii33Zi8Jtp55wEIILR9eh34FAW00PZf+JnSsTmV/ioewSgQl97JHvgjoRGwPShsWm+IdrxB35d0w==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -7454,8 +6411,6 @@
     },
     "node_modules/strip-final-newline": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-2.0.0.tgz",
-      "integrity": "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -7465,8 +6420,6 @@
     },
     "node_modules/strip-json-comments": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
-      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -7479,8 +6432,6 @@
     },
     "node_modules/strnum": {
       "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.1.2.tgz",
-      "integrity": "sha512-l63NF9y/cLROq/yqKXSLtcMeeyOfnSQlfMSlzFt/K73oIaD8DGaQWd7Z34X9GPiKqP5rbSh84Hl4bOlLcjiSrQ==",
       "funding": [
         {
           "type": "github",
@@ -7492,15 +6443,11 @@
     },
     "node_modules/stubs": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/stubs/-/stubs-3.0.0.tgz",
-      "integrity": "sha512-PdHt7hHUJKxvTCgbKX9C1V/ftOcjJQgz8BZwNfV5c4B6dcGqlpelTbJ999jBGZ2jYiPAwcX5dP6oBwVlBlUbxw==",
       "license": "MIT",
       "optional": true
     },
     "node_modules/supports-color": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
-      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -7513,8 +6460,6 @@
     },
     "node_modules/synckit": {
       "version": "0.11.12",
-      "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.12.tgz",
-      "integrity": "sha512-Bh7QjT8/SuKUIfObSXNHNSK6WHo6J1tHCqJsuaFDP7gP0fkzSfTxI8y85JrppZ0h8l0maIgc2tfuZQ6/t3GtnQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -7530,8 +6475,6 @@
     },
     "node_modules/tar-stream": {
       "version": "3.1.8",
-      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-3.1.8.tgz",
-      "integrity": "sha512-U6QpVRyCGHva435KoNWy9PRoi2IFYCgtEhq9nmrPPpbRacPs9IH4aJ3gbrFC8dPcXvdSZ4XXfXT5Fshbp2MtlQ==",
       "license": "MIT",
       "dependencies": {
         "b4a": "^1.6.4",
@@ -7542,8 +6485,6 @@
     },
     "node_modules/teeny-request": {
       "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/teeny-request/-/teeny-request-9.0.0.tgz",
-      "integrity": "sha512-resvxdc6Mgb7YEThw6G6bExlXKkv6+YbuzGg9xuXxSgxJF7Ozs+o8Y9+2R3sArdWdW8nOokoQb1yrpFB0pQK2g==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -7559,8 +6500,6 @@
     },
     "node_modules/teeny-request/node_modules/node-fetch": {
       "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz",
-      "integrity": "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -7580,8 +6519,6 @@
     },
     "node_modules/teeny-request/node_modules/uuid": {
       "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
-      "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
@@ -7594,8 +6531,6 @@
     },
     "node_modules/teex": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/teex/-/teex-1.0.1.tgz",
-      "integrity": "sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg==",
       "license": "MIT",
       "dependencies": {
         "streamx": "^2.12.5"
@@ -7603,8 +6538,6 @@
     },
     "node_modules/test-exclude": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz",
-      "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
       "dev": true,
       "license": "ISC",
       "peer": true,
@@ -7619,8 +6552,6 @@
     },
     "node_modules/test-exclude/node_modules/brace-expansion": {
       "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -7631,9 +6562,6 @@
     },
     "node_modules/test-exclude/node_modules/glob": {
       "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "peer": true,
@@ -7654,8 +6582,6 @@
     },
     "node_modules/test-exclude/node_modules/minimatch": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "peer": true,
@@ -7668,8 +6594,6 @@
     },
     "node_modules/text-decoder": {
       "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/text-decoder/-/text-decoder-1.2.7.tgz",
-      "integrity": "sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "b4a": "^1.6.4"
@@ -7677,16 +6601,12 @@
     },
     "node_modules/tmpl": {
       "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/tmpl/-/tmpl-1.0.5.tgz",
-      "integrity": "sha512-3f0uOEAQwIqGuWW2MVzYg8fV/QNnc/IpuJNG837rLuczAaLVHslWHZQj4IGiEl5Hs3kkbhwL9Ab7Hrsmuj+Smw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "peer": true
     },
     "node_modules/to-regex-range": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
-      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -7699,8 +6619,6 @@
     },
     "node_modules/toidentifier": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
-      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
       "license": "MIT",
       "engines": {
         "node": ">=0.6"
@@ -7708,28 +6626,20 @@
     },
     "node_modules/tr46": {
       "version": "0.0.3",
-      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
-      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==",
       "license": "MIT",
       "optional": true
     },
     "node_modules/ts-deepmerge": {
       "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/ts-deepmerge/-/ts-deepmerge-2.0.7.tgz",
-      "integrity": "sha512-3phiGcxPSSR47RBubQxPoZ+pqXsEsozLo4G4AlSrsMKTFg9TA3l+3he5BqpUi9wiuDbaHWXH/amlzQ49uEdXtg==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/tslib": {
       "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
       "license": "0BSD"
     },
     "node_modules/type-detect": {
       "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/type-detect/-/type-detect-4.0.8.tgz",
-      "integrity": "sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -7739,8 +6649,6 @@
     },
     "node_modules/type-fest": {
       "version": "0.21.3",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
-      "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
       "dev": true,
       "license": "(MIT OR CC0-1.0)",
       "peer": true,
@@ -7753,8 +6661,6 @@
     },
     "node_modules/type-is": {
       "version": "1.6.18",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
-      "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
       "license": "MIT",
       "dependencies": {
         "media-typer": "0.3.0",
@@ -7766,8 +6672,6 @@
     },
     "node_modules/typescript": {
       "version": "5.9.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
-      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -7780,14 +6684,10 @@
     },
     "node_modules/undici-types": {
       "version": "7.18.2",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
-      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
       "license": "MIT"
     },
     "node_modules/unpipe": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
-      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -7795,8 +6695,6 @@
     },
     "node_modules/unrs-resolver": {
       "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/unrs-resolver/-/unrs-resolver-1.11.1.tgz",
-      "integrity": "sha512-bSjt9pjaEBnNiGgc9rUiHGKv5l4/TGzDmYw3RhnkJGtLhbnnA/5qJj7x3dNDCRx/PJxu774LlH8lCOlB4hEfKg==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -7831,8 +6729,6 @@
     },
     "node_modules/update-browserslist-db": {
       "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
-      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
       "dev": true,
       "funding": [
         {
@@ -7863,14 +6759,10 @@
     },
     "node_modules/util-deprecate": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
-      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
       "license": "MIT"
     },
     "node_modules/utils-merge": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
-      "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4.0"
@@ -7878,8 +6770,6 @@
     },
     "node_modules/uuid": {
       "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz",
-      "integrity": "sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==",
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
@@ -7891,8 +6781,6 @@
     },
     "node_modules/v8-to-istanbul": {
       "version": "9.3.0",
-      "resolved": "https://registry.npmjs.org/v8-to-istanbul/-/v8-to-istanbul-9.3.0.tgz",
-      "integrity": "sha512-kiGUalWN+rgBJ/1OHZsBtU4rXZOfj/7rKQxULKlIzwzQSvMJUUNgPwJEEh7gU6xEVxC0ahoOBvN2YI8GH6FNgA==",
       "dev": true,
       "license": "ISC",
       "peer": true,
@@ -7907,8 +6795,6 @@
     },
     "node_modules/vary": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
-      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -7916,8 +6802,6 @@
     },
     "node_modules/walker": {
       "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/walker/-/walker-1.0.8.tgz",
-      "integrity": "sha512-ts/8E8l5b7kY0vlWLewOkDXMmPdLcVV4GmOQLyxuSswIJsweeFZtAsMF7k1Nszz+TYBQrlYRmzOnr398y1JemQ==",
       "dev": true,
       "license": "Apache-2.0",
       "peer": true,
@@ -7927,8 +6811,6 @@
     },
     "node_modules/web-streams-polyfill": {
       "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-3.3.3.tgz",
-      "integrity": "sha512-d2JWLCivmZYTSIoge9MsgFCZrt571BikcWGYkjC1khllbTeDlGqZ2D8vD8E/lJa8WGWbb7Plm8/XJYV7IJHZZw==",
       "license": "MIT",
       "engines": {
         "node": ">= 8"
@@ -7936,15 +6818,11 @@
     },
     "node_modules/webidl-conversions": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
-      "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==",
       "license": "BSD-2-Clause",
       "optional": true
     },
     "node_modules/websocket-driver": {
       "version": "0.7.4",
-      "resolved": "https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.4.tgz",
-      "integrity": "sha512-b17KeDIQVjvb0ssuSDF2cYXSg2iztliJ4B9WdsuB6J952qCPKmnVq4DyW5motImXHDC1cBT/1UezrJVsKw5zjg==",
       "license": "Apache-2.0",
       "dependencies": {
         "http-parser-js": ">=0.5.1",
@@ -7957,8 +6835,6 @@
     },
     "node_modules/websocket-extensions": {
       "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/websocket-extensions/-/websocket-extensions-0.1.4.tgz",
-      "integrity": "sha512-OqedPIGOfsDlo31UNwYbCFMSaO9m9G/0faIHj5/dZFDMFqPTcx6UwqyOy3COEaEOg/9VsGIpdqn62W5KhoKSpg==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=0.8.0"
@@ -7966,8 +6842,6 @@
     },
     "node_modules/whatwg-url": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
-      "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -7977,8 +6851,6 @@
     },
     "node_modules/which": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
       "license": "ISC",
       "dependencies": {
         "isexe": "^2.0.0"
@@ -7992,8 +6864,6 @@
     },
     "node_modules/wrap-ansi": {
       "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
-      "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
       "license": "MIT",
       "dependencies": {
         "ansi-styles": "^6.1.0",
@@ -8010,8 +6880,6 @@
     "node_modules/wrap-ansi-cjs": {
       "name": "wrap-ansi",
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
       "license": "MIT",
       "dependencies": {
         "ansi-styles": "^4.0.0",
@@ -8027,8 +6895,6 @@
     },
     "node_modules/wrap-ansi-cjs/node_modules/ansi-regex": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -8036,14 +6902,10 @@
     },
     "node_modules/wrap-ansi-cjs/node_modules/emoji-regex": {
       "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
       "license": "MIT"
     },
     "node_modules/wrap-ansi-cjs/node_modules/string-width": {
       "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
       "license": "MIT",
       "dependencies": {
         "emoji-regex": "^8.0.0",
@@ -8056,8 +6918,6 @@
     },
     "node_modules/wrap-ansi-cjs/node_modules/strip-ansi": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
       "license": "MIT",
       "dependencies": {
         "ansi-regex": "^5.0.1"
@@ -8068,8 +6928,6 @@
     },
     "node_modules/wrap-ansi/node_modules/ansi-styles": {
       "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
-      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -8080,15 +6938,11 @@
     },
     "node_modules/wrappy": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
       "devOptional": true,
       "license": "ISC"
     },
     "node_modules/write-file-atomic": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/write-file-atomic/-/write-file-atomic-5.0.1.tgz",
-      "integrity": "sha512-+QU2zd6OTD8XWIJCbffaiQeH9U73qIqafo1x6V1snCWYGJf6cVE0cDR4D8xRzcEnfI21IFrUPzPGtcPf8AC+Rw==",
       "dev": true,
       "license": "ISC",
       "peer": true,
@@ -8102,8 +6956,6 @@
     },
     "node_modules/y18n": {
       "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
-      "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
       "devOptional": true,
       "license": "ISC",
       "engines": {
@@ -8112,14 +6964,10 @@
     },
     "node_modules/yallist": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
-      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
       "license": "ISC"
     },
     "node_modules/yargs": {
       "version": "17.7.2",
-      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz",
-      "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -8137,8 +6985,6 @@
     },
     "node_modules/yargs-parser": {
       "version": "21.1.1",
-      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
-      "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
       "devOptional": true,
       "license": "ISC",
       "engines": {
@@ -8147,8 +6993,6 @@
     },
     "node_modules/yargs/node_modules/ansi-regex": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -8157,15 +7001,11 @@
     },
     "node_modules/yargs/node_modules/emoji-regex": {
       "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
       "devOptional": true,
       "license": "MIT"
     },
     "node_modules/yargs/node_modules/string-width": {
       "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -8179,8 +7019,6 @@
     },
     "node_modules/yargs/node_modules/strip-ansi": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -8192,8 +7030,6 @@
     },
     "node_modules/yocto-queue": {
       "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
-      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -8205,8 +7041,6 @@
     },
     "node_modules/zip-stream": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/zip-stream/-/zip-stream-6.0.1.tgz",
-      "integrity": "sha512-zK7YHHz4ZXpW89AHXUPbQVGKI7uvkd3hzusTdotCg1UxyaVtg0zFJSTfW/Dq5f7OBBVnq6cZIaC8Ti4hb6dtCA==",
       "license": "MIT",
       "dependencies": {
         "archiver-utils": "^5.0.0",
@@ -8219,8 +7053,6 @@
     },
     "node_modules/zip-stream/node_modules/buffer": {
       "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz",
-      "integrity": "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==",
       "funding": [
         {
           "type": "github",
@@ -8243,8 +7075,6 @@
     },
     "node_modules/zip-stream/node_modules/readable-stream": {
       "version": "4.7.0",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-4.7.0.tgz",
-      "integrity": "sha512-oIGGmcpTLwPga8Bn6/Z75SVaH1z5dUut2ibSyAMVhmUggWpmDn2dapB0n7f8nwaSiRtepAsfJyfXIO5DCVAODg==",
       "license": "MIT",
       "dependencies": {
         "abort-controller": "^3.0.0",
diff --git a/functions/package.json b/functions/package.json
index f1cef00..c21a43f 100644
--- a/functions/package.json
+++ b/functions/package.json
@@ -27,6 +27,7 @@
     "firebase-functions": "^7.2.2",
     "is-base64": "^1.1.0",
     "joi": "^17.7.0",
+    "nanoid": "^5.1.16",
     "node-fetch": "^3.2.10"
   },
   "devDependencies": {
diff --git a/functions/src/__tests__/collision-cache.test.js b/functions/src/__tests__/collision-cache.test.js
new file mode 100644
index 0000000..e0d0257
--- /dev/null
+++ b/functions/src/__tests__/collision-cache.test.js
@@ -0,0 +1,430 @@
+/**
+ * @jest-environment node
+ */
+
+// RED-phase unit tests for step 3a (docs/provider-migration-design.md,
+// scratchpad/step3a-collision-cache-spec.md). collision-cache.ts does not
+// exist yet — this whole file is expected to fail at module resolution
+// until it is implemented.
+//
+// Style follows upload-queue.test.js: direct Firestore-emulator-backed calls
+// against the module's public API, no HTTP layer involved. Every test uses
+// its own freshly-generated experiment ID so tests never depend on one
+// another's state or ordering.
+
+import { initializeApp, getApp } from "firebase-admin/app";
+import { getFirestore, Timestamp } from "firebase-admin/firestore";
+import { randomUUID, createHash } from "crypto";
+
+import {
+  claimFilename,
+  confirmClaim,
+  releaseClaim,
+  CLAIM_TTL_MS,
+  STALE_PENDING_TAKEOVER_MS,
+  REHYDRATION_LEASE_MS,
+  CollisionCacheUnavailableError,
+} from "../../lib/collision-cache.js";
+
+process.env.FIRESTORE_EMULATOR_HOST = "localhost:8080";
+
+const config = { projectId: "datapipe-test" };
+
+jest.setTimeout(30000);
+
+let db;
+
+beforeAll(async () => {
+  let app;
+  try {
+    app = getApp("collision-cache-test");
+  } catch {
+    app = initializeApp(config, "collision-cache-test");
+  }
+  db = getFirestore(app);
+});
+
+// A tolerance window for timestamp assertions — generous enough to absorb
+// emulator round-trip latency without hiding a genuinely wrong duration.
+const TOLERANCE_MS = 5000;
+
+function freshExperimentId(label) {
+  return `collision-${label}-${randomUUID()}`;
+}
+
+// Mirrors the spec's hashing rule exactly: sha256hex(salt + ":" + filename).
+// Recomputing it locally (rather than trusting the module) lets tests assert
+// the doc ID *is* that specific value, not just "some opaque string".
+function claimHash(salt, filename) {
+  return createHash("sha256").update(`${salt}:${filename}`).digest("hex");
+}
+
+async function createExperiment(experimentID, overrides = {}) {
+  await db
+    .collection("experiments")
+    .doc(experimentID)
+    .set({
+      active: true,
+      owner: "collision-test-owner",
+      osfFilesLink: "https://example.invalid/files",
+      ...overrides,
+    });
+}
+
+// Pre-warms the cache with a known salt and a future warmUntil so tests that
+// aren't *about* rehydration don't incidentally exercise it. Returns the salt
+// so callers can compute expected claim-doc hashes.
+async function warmExperiment(experimentID, { salt, warmUntilMs } = {}) {
+  const resolvedSalt = salt || randomUUID().replace(/-/g, "");
+  const warmUntil = Timestamp.fromMillis(warmUntilMs ?? Date.now() + 24 * 60 * 60 * 1000);
+  await db
+    .collection("experiments")
+    .doc(experimentID)
+    .set({ collisionCache: { salt: resolvedSalt, warmUntil } }, { merge: true });
+  return resolvedSalt;
+}
+
+async function getExperimentData(experimentID) {
+  const snap = await db.collection("experiments").doc(experimentID).get();
+  return snap.data();
+}
+
+function claimsCollection(experimentID) {
+  return db.collection("experiments").doc(experimentID).collection("filenameClaims");
+}
+
+async function getClaimDoc(experimentID, hash) {
+  return claimsCollection(experimentID).doc(hash).get();
+}
+
+describe("1. first claim on a cold cache", () => {
+  it("creates a salt, claims the filename, and never stores the raw filename anywhere in the claim doc", async () => {
+    const experimentID = freshExperimentId("first-claim");
+    await createExperiment(experimentID);
+    const ownerToken = randomUUID();
+    const listFilesFn = jest.fn().mockResolvedValue([]);
+    const filename = "data.csv";
+
+    const result = await claimFilename(experimentID, filename, ownerToken, listFilesFn);
+
+    expect(result).toEqual({ claimed: true });
+
+    const expData = await getExperimentData(experimentID);
+    expect(expData.collisionCache).toBeDefined();
+    expect(typeof expData.collisionCache.salt).toBe("string");
+    expect(expData.collisionCache.salt.length).toBeGreaterThan(0);
+
+    const claims = await claimsCollection(experimentID).get();
+    expect(claims.docs).toHaveLength(1);
+    const claimDoc = claims.docs[0];
+
+    // The doc ID must be the salted hash, not the filename itself.
+    expect(claimDoc.id).not.toBe(filename);
+    expect(claimDoc.id).toBe(claimHash(expData.collisionCache.salt, filename));
+
+    // The raw filename string must not appear anywhere in the stored claim,
+    // including the doc ID — serialize everything and grep for it.
+    const serialized = JSON.stringify({ id: claimDoc.id, ...claimDoc.data() });
+    expect(serialized).not.toContain(filename);
+
+    const data = claimDoc.data();
+    expect(data.status).toBe("pending");
+    expect(data.ownerToken).toBe(ownerToken);
+    expect(data.createdAt).toBeDefined();
+    expect(data.expiresAt).toBeDefined();
+  });
+});
+
+describe("2. duplicate claim from a different owner", () => {
+  it("rejects a second claim of an already-pending filename made by a different token", async () => {
+    const experimentID = freshExperimentId("dup-diff-token");
+    await createExperiment(experimentID);
+    await warmExperiment(experimentID);
+    const listFilesFn = jest.fn().mockResolvedValue([]);
+    const filename = "dup.csv";
+
+    const first = await claimFilename(experimentID, filename, randomUUID(), listFilesFn);
+    expect(first).toEqual({ claimed: true });
+
+    const second = await claimFilename(experimentID, filename, randomUUID(), listFilesFn);
+    expect(second).toEqual({ claimed: false, reason: "duplicate" });
+
+    // Cache was already warm — rehydration must never have run.
+    expect(listFilesFn).not.toHaveBeenCalled();
+  });
+});
+
+describe("3. idempotent re-entry with the same owner token", () => {
+  it("allows the same owner token to re-claim its own pending filename without creating a second doc", async () => {
+    const experimentID = freshExperimentId("idempotent");
+    await createExperiment(experimentID);
+    await warmExperiment(experimentID);
+    const listFilesFn = jest.fn().mockResolvedValue([]);
+    const ownerToken = randomUUID();
+    const filename = "retry.csv";
+
+    const first = await claimFilename(experimentID, filename, ownerToken, listFilesFn);
+    expect(first).toEqual({ claimed: true });
+
+    const second = await claimFilename(experimentID, filename, ownerToken, listFilesFn);
+    expect(second).toEqual({ claimed: true });
+
+    const claims = await claimsCollection(experimentID).get();
+    expect(claims.docs).toHaveLength(1);
+  });
+});
+
+describe("4. confirmClaim", () => {
+  it("marks the claim confirmed, bumps collisionCache.warmUntil forward, and blocks future claims of that filename", async () => {
+    const experimentID = freshExperimentId("confirm");
+    await createExperiment(experimentID);
+    // Warm, but only a little way out — far short of CLAIM_TTL_MS — so a bump
+    // from confirmClaim is unambiguous and can't be confused with rehydration
+    // (which would also set warmUntil, but only runs on a COLD cache).
+    const initialWarmUntilMs = Date.now() + 5 * 60 * 1000;
+    const salt = await warmExperiment(experimentID, { warmUntilMs: initialWarmUntilMs });
+    const listFilesFn = jest.fn().mockResolvedValue([]);
+    const ownerToken = randomUUID();
+    const filename = "confirmed.csv";
+
+    await claimFilename(experimentID, filename, ownerToken, listFilesFn);
+    expect(listFilesFn).not.toHaveBeenCalled(); // cache was warm
+
+    const beforeConfirm = Date.now();
+    await confirmClaim(experimentID, filename, ownerToken);
+    const afterConfirm = Date.now();
+
+    const expData = await getExperimentData(experimentID);
+    const warmUntilMs = expData.collisionCache.warmUntil.toMillis();
+    expect(warmUntilMs).toBeGreaterThan(initialWarmUntilMs);
+    expect(warmUntilMs).toBeGreaterThanOrEqual(beforeConfirm + CLAIM_TTL_MS - TOLERANCE_MS);
+    expect(warmUntilMs).toBeLessThanOrEqual(afterConfirm + CLAIM_TTL_MS + TOLERANCE_MS);
+
+    const hash = claimHash(salt, filename);
+    const claimSnap = await getClaimDoc(experimentID, hash);
+    expect(claimSnap.data().status).toBe("confirmed");
+
+    const later = await claimFilename(experimentID, filename, randomUUID(), listFilesFn);
+    expect(later).toEqual({ claimed: false, reason: "duplicate" });
+  });
+});
+
+describe("5. releaseClaim", () => {
+  it("deletes an owned pending claim so another token can claim it, and is a no-op with the wrong token", async () => {
+    const experimentID = freshExperimentId("release");
+    await createExperiment(experimentID);
+    await warmExperiment(experimentID);
+    const listFilesFn = jest.fn().mockResolvedValue([]);
+    const ownerToken = randomUUID();
+    const otherToken = randomUUID();
+    const filename = "released.csv";
+
+    await claimFilename(experimentID, filename, ownerToken, listFilesFn);
+
+    // Wrong-token release must not touch the claim.
+    await releaseClaim(experimentID, filename, otherToken);
+    const stillBlocked = await claimFilename(experimentID, filename, otherToken, listFilesFn);
+    expect(stillBlocked).toEqual({ claimed: false, reason: "duplicate" });
+
+    // Correct-token release removes it, freeing the filename.
+    await releaseClaim(experimentID, filename, ownerToken);
+    const reclaimed = await claimFilename(experimentID, filename, otherToken, listFilesFn);
+    expect(reclaimed).toEqual({ claimed: true });
+  });
+});
+
+describe("6. stale pending takeover", () => {
+  it("lets a new token take over a pending claim whose createdAt is older than STALE_PENDING_TAKEOVER_MS", async () => {
+    const experimentID = freshExperimentId("stale-takeover");
+    await createExperiment(experimentID);
+    const salt = await warmExperiment(experimentID);
+    const staleOwnerToken = randomUUID();
+    const filename = "stale.csv";
+    const hash = claimHash(salt, filename);
+
+    const staleCreatedAt = Timestamp.fromMillis(Date.now() - STALE_PENDING_TAKEOVER_MS - 60 * 1000);
+    await claimsCollection(experimentID)
+      .doc(hash)
+      .set({
+        status: "pending",
+        ownerToken: staleOwnerToken,
+        createdAt: staleCreatedAt,
+        expiresAt: Timestamp.fromMillis(Date.now() + CLAIM_TTL_MS),
+      });
+
+    const newToken = randomUUID();
+    const listFilesFn = jest.fn().mockResolvedValue([]);
+    const result = await claimFilename(experimentID, filename, newToken, listFilesFn);
+
+    expect(result).toEqual({ claimed: true });
+
+    const claimSnap = await getClaimDoc(experimentID, hash);
+    expect(claimSnap.data().ownerToken).toBe(newToken);
+    expect(claimSnap.data().status).toBe("pending");
+    expect(claimSnap.data().createdAt.toMillis()).toBeGreaterThan(staleCreatedAt.toMillis());
+  });
+});
+
+describe("7. filename and experiment isolation", () => {
+  it("claims different filenames independently within an experiment, and hashes an identical filename differently per experiment", async () => {
+    const expA = freshExperimentId("iso-a");
+    const expB = freshExperimentId("iso-b");
+    await createExperiment(expA);
+    await createExperiment(expB);
+    const saltA = await warmExperiment(expA);
+    const saltB = await warmExperiment(expB);
+    const listFilesFn = jest.fn().mockResolvedValue([]);
+    const sharedFilename = "shared-name.csv";
+
+    const resultOne = await claimFilename(expA, "one.csv", randomUUID(), listFilesFn);
+    const resultTwo = await claimFilename(expA, "two.csv", randomUUID(), listFilesFn);
+    expect(resultOne).toEqual({ claimed: true });
+    expect(resultTwo).toEqual({ claimed: true });
+
+    const resultInB = await claimFilename(expB, sharedFilename, randomUUID(), listFilesFn);
+    const resultInA = await claimFilename(expA, sharedFilename, randomUUID(), listFilesFn);
+    expect(resultInB).toEqual({ claimed: true });
+    expect(resultInA).toEqual({ claimed: true });
+
+    expect(saltA).not.toBe(saltB);
+    const hashInA = claimHash(saltA, sharedFilename);
+    const hashInB = claimHash(saltB, sharedFilename);
+    expect(hashInA).not.toBe(hashInB);
+
+    expect((await getClaimDoc(expA, hashInA)).exists).toBe(true);
+    expect((await getClaimDoc(expB, hashInB)).exists).toBe(true);
+  });
+});
+
+describe("8. expiresAt timing", () => {
+  it("sets expiresAt ~CLAIM_TTL_MS in the future on create, and refreshes it forward on confirm", async () => {
+    const experimentID = freshExperimentId("expires-at");
+    await createExperiment(experimentID);
+    const salt = await warmExperiment(experimentID);
+    const listFilesFn = jest.fn().mockResolvedValue([]);
+    const ownerToken = randomUUID();
+    const filename = "ttl.csv";
+    const hash = claimHash(salt, filename);
+
+    const beforeClaim = Date.now();
+    await claimFilename(experimentID, filename, ownerToken, listFilesFn);
+    const afterClaim = Date.now();
+
+    let claimSnap = await getClaimDoc(experimentID, hash);
+    const createdExpiresAtMs = claimSnap.data().expiresAt.toMillis();
+    expect(createdExpiresAtMs).toBeGreaterThanOrEqual(beforeClaim + CLAIM_TTL_MS - TOLERANCE_MS);
+    expect(createdExpiresAtMs).toBeLessThanOrEqual(afterClaim + CLAIM_TTL_MS + TOLERANCE_MS);
+
+    // Small delay so a refreshed expiresAt is unambiguously later, not just
+    // equal due to millisecond truncation.
+    await new Promise((resolve) => setTimeout(resolve, 50));
+
+    const beforeConfirm = Date.now();
+    await confirmClaim(experimentID, filename, ownerToken);
+    const afterConfirm = Date.now();
+
+    claimSnap = await getClaimDoc(experimentID, hash);
+    const confirmedExpiresAtMs = claimSnap.data().expiresAt.toMillis();
+    expect(confirmedExpiresAtMs).toBeGreaterThanOrEqual(beforeConfirm + CLAIM_TTL_MS - TOLERANCE_MS);
+    expect(confirmedExpiresAtMs).toBeLessThanOrEqual(afterConfirm + CLAIM_TTL_MS + TOLERANCE_MS);
+    expect(confirmedExpiresAtMs).toBeGreaterThanOrEqual(createdExpiresAtMs);
+  });
+});
+
+describe("9. rehydration on a cold cache", () => {
+  it("bulk-confirms every filename listFilesFn returns, calling it exactly once even across multiple claims", async () => {
+    const experimentID = freshExperimentId("rehydrate");
+    await createExperiment(experimentID); // no collisionCache field at all — cold by construction
+    const listFilesFn = jest.fn().mockResolvedValue([{ name: "a.csv" }, { name: "b.csv" }]);
+
+    const beforeRehydrate = Date.now();
+    const result = await claimFilename(experimentID, "c.csv", randomUUID(), listFilesFn);
+
+    expect(result).toEqual({ claimed: true }); // c.csv wasn't in the listing
+    expect(listFilesFn).toHaveBeenCalledTimes(1);
+
+    const expData = await getExperimentData(experimentID);
+    expect(expData.collisionCache.warmUntil.toMillis()).toBeGreaterThanOrEqual(
+      beforeRehydrate + CLAIM_TTL_MS - TOLERANCE_MS
+    );
+
+    const salt = expData.collisionCache.salt;
+    const aSnap = await getClaimDoc(experimentID, claimHash(salt, "a.csv"));
+    const bSnap = await getClaimDoc(experimentID, claimHash(salt, "b.csv"));
+    expect(aSnap.data().status).toBe("confirmed");
+    expect(aSnap.data().ownerToken).toBe("rehydration");
+    expect(bSnap.data().status).toBe("confirmed");
+    expect(bSnap.data().ownerToken).toBe("rehydration");
+
+    // a.csv is now provably taken via the bulk-written claim from rehydration.
+    const dup = await claimFilename(experimentID, "a.csv", randomUUID(), listFilesFn);
+    expect(dup).toEqual({ claimed: false, reason: "duplicate" });
+
+    // Neither the c.csv claim nor the a.csv duplicate check should have
+    // triggered a second rehydration pass.
+    expect(listFilesFn).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe("10. rehydration lease held by another request", () => {
+  it("returns reason 'rehydrating' without calling listFilesFn while another request's lease is active", async () => {
+    const experimentID = freshExperimentId("lease-held");
+    await createExperiment(experimentID);
+    await db
+      .collection("experiments")
+      .doc(experimentID)
+      .set(
+        {
+          collisionCache: {
+            salt: randomUUID().replace(/-/g, ""),
+            // warmUntil deliberately absent/past — cache is cold, forcing the
+            // rehydration-lease check to run.
+            rehydratingUntil: Timestamp.fromMillis(Date.now() + REHYDRATION_LEASE_MS),
+          },
+        },
+        { merge: true }
+      );
+    const listFilesFn = jest.fn().mockResolvedValue([]);
+
+    const result = await claimFilename(experimentID, "leased.csv", randomUUID(), listFilesFn);
+
+    expect(result).toEqual({ claimed: false, reason: "rehydrating" });
+    expect(listFilesFn).not.toHaveBeenCalled();
+  });
+});
+
+describe("11. rehydration failure", () => {
+  it("throws CollisionCacheUnavailableError and clears the lease so a later claim retries rehydration", async () => {
+    const experimentID = freshExperimentId("rehydrate-fail");
+    await createExperiment(experimentID); // cold cache, no salt yet
+
+    const failingListFiles = jest.fn().mockRejectedValue(new Error("container access revoked"));
+
+    await expect(claimFilename(experimentID, "x.csv", randomUUID(), failingListFiles)).rejects.toThrow(
+      CollisionCacheUnavailableError
+    );
+
+    const expDataAfterFailure = await getExperimentData(experimentID);
+    expect(expDataAfterFailure.collisionCache.rehydratingUntil).toBeFalsy();
+
+    const workingListFiles = jest.fn().mockResolvedValue([]);
+    const result = await claimFilename(experimentID, "x.csv", randomUUID(), workingListFiles);
+
+    expect(result).toEqual({ claimed: true });
+    expect(workingListFiles).toHaveBeenCalledTimes(1); // rehydration retried, not skipped
+  });
+});
+
+describe("12. warm cache", () => {
+  it("never calls listFilesFn when warmUntil is already in the future", async () => {
+    const experimentID = freshExperimentId("warm");
+    await createExperiment(experimentID);
+    await warmExperiment(experimentID);
+    const listFilesFn = jest.fn().mockResolvedValue([]);
+
+    const result = await claimFilename(experimentID, "warm.csv", randomUUID(), listFilesFn);
+
+    expect(result).toEqual({ claimed: true });
+    expect(listFilesFn).not.toHaveBeenCalled();
+  });
+});
diff --git a/functions/src/__tests__/collision-integration-emulator.test.js b/functions/src/__tests__/collision-integration-emulator.test.js
new file mode 100644
index 0000000..9de7a26
--- /dev/null
+++ b/functions/src/__tests__/collision-integration-emulator.test.js
@@ -0,0 +1,294 @@
+/**
+ * @jest-environment node
+ */
+
+// RED-phase integration tests for step 3a (docs/provider-migration-design.md,
+// scratchpad/step3a-collision-cache-spec.md), cases 13-17 of the test plan.
+//
+// These exercise the deployed-in-emulator apidata/apibase64 functions end to
+// end against a mock OSF server, following the pattern in
+// early-persist-emulator.test.js: a self-contained express server started on
+// an OS-assigned port (`listen(0)`) rather than the shared, fixed-port
+// mock-server.ts used by metadata-emulator.test.js. Two reasons for that
+// choice instead of extending mock-server.ts:
+//   1. mock-server.ts binds a hardcoded port (3000); a second test file
+//      binding the same port would race it when Jest runs files in parallel
+//      workers, causing spurious EADDRINUSE failures unrelated to collision
+//      logic. `listen(0)` sidesteps that entirely.
+//   2. early-persist-emulator.test.js already establishes this inline-mock
+//      convention for tests that need per-test control over the OSF
+//      response, which is exactly what cases 14/15 need (forcing 409/500).
+// mock-server.ts itself is untouched.
+//
+// Until api-data.ts / api-base64.ts / collision-cache.ts are implemented,
+// these requests never claim a filename in Firestore at all, so most
+// assertions here fail on missing behavior (no collisionCache field ever
+// appears, no claim docs, no claimToken on the queue doc) rather than on any
+// transport-level problem.
+
+import { initializeApp } from "firebase-admin/app";
+import { getFirestore } from "firebase-admin/firestore";
+import { randomUUID, createHash } from "crypto";
+import express from "express";
+import MESSAGES from "../api-messages";
+
+process.env.FIRESTORE_EMULATOR_HOST = "localhost:8080";
+
+jest.setTimeout(30000);
+
+const config = { projectId: "datapipe-test" };
+
+const OWNER_ID = "collision-int-owner";
+
+const sampleData = `[{"trial_type":"html-keyboard-response","trial_index":1,"time_elapsed":776}]`;
+const sampleBase64 = Buffer.from("collision cache integration payload").toString("base64");
+
+async function saveData(body) {
+  const response = await fetch("http://localhost:5001/datapipe-test/us-central1/apidata", {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "*/*" },
+    body: JSON.stringify(body),
+  });
+  const message = await response.json();
+  return { status: response.status, body: message };
+}
+
+async function saveBase64Data(body) {
+  const response = await fetch("http://localhost:5001/datapipe-test/us-central1/apibase64", {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "*/*" },
+    body: JSON.stringify(body),
+  });
+  const message = await response.json();
+  return { status: response.status, body: message };
+}
+
+// Mirrors collision-cache.ts's hashing rule (sha256hex(salt + ":" + filename))
+// so tests can look up the exact claim doc a request should have produced.
+function claimHash(salt, filename) {
+  return createHash("sha256").update(`${salt}:${filename}`).digest("hex");
+}
+
+// A minimal, self-contained mock OSF "files" container:
+//   GET  /files            -> osfProvider.listFiles            (?meta=)
+//   PUT  /files?name=<...> -> osfProvider.writeSessionFile / putFileOSF
+// with in-process (not HTTP) controls, since the test and the mock server
+// share the same Node process.
+function createMockOSFServer() {
+  const app = express();
+  const uploadCountsByFilename = new Map();
+  const forcedStatusByFilename = new Map();
+
+  app.get("/files", (req, res) => {
+    // Always an empty container: every experiment in this suite starts
+    // fresh, so rehydration (if implemented) should complete trivially.
+    res.json({ data: [] });
+  });
+
+  app.put("/files", (req, res) => {
+    const filename = String(req.query.name || "");
+    uploadCountsByFilename.set(filename, (uploadCountsByFilename.get(filename) || 0) + 1);
+
+    const forcedStatus = forcedStatusByFilename.get(filename);
+    if (forcedStatus && forcedStatus !== 201) {
+      // Deliberately setting only the status (not a custom statusMessage) so
+      // Node's default HTTP reason phrase applies — e.g. 409 -> "Conflict",
+      // 500 -> "Internal Server Error" — matching what production code
+      // (api-data.ts's `result.providerMessage === "Conflict"` check) expects
+      // from a real OSF response.
+      res.status(forcedStatus).json({ errors: [{ detail: `mock-forced-status-${forcedStatus}` }] });
+      return;
+    }
+
+    res.status(201).json({
+      data: { attributes: { name: filename, kind: "file" }, id: "osfstorage/mock-upload" },
+    });
+  });
+
+  return new Promise((resolve) => {
+    const server = app.listen(0, () => {
+      resolve({
+        server,
+        port: server.address().port,
+        getUploadCount: (filename) => uploadCountsByFilename.get(filename) || 0,
+        forceStatus: (filename, status) => forcedStatusByFilename.set(filename, status),
+        reset: () => {
+          uploadCountsByFilename.clear();
+          forcedStatusByFilename.clear();
+        },
+      });
+    });
+  });
+}
+
+let db;
+let mockOSF;
+let filesLink;
+
+beforeAll(async () => {
+  mockOSF = await createMockOSFServer();
+  filesLink = `http://localhost:${mockOSF.port}/files`;
+
+  initializeApp(config);
+  db = getFirestore();
+
+  await db.collection("users").doc(OWNER_ID).set({
+    osfTokenValid: true,
+    osfToken: "valid",
+    usingPersonalToken: true,
+  });
+});
+
+afterEach(() => {
+  mockOSF.reset();
+});
+
+afterAll(async () => {
+  mockOSF.server.close();
+});
+
+async function createDataExperiment(experimentID, overrides = {}) {
+  await db
+    .collection("experiments")
+    .doc(experimentID)
+    .set({
+      active: true,
+      metadataActive: false,
+      owner: OWNER_ID,
+      osfFilesLink: filesLink,
+      ...overrides,
+    });
+}
+
+async function createBase64Experiment(experimentID, overrides = {}) {
+  await db
+    .collection("experiments")
+    .doc(experimentID)
+    .set({
+      activeBase64: true,
+      owner: OWNER_ID,
+      osfFilesLink: filesLink,
+      ...overrides,
+    });
+}
+
+describe("13. apidata: duplicate filename is rejected without a second provider upload", () => {
+  it("first POST succeeds, second POST for the same filename gets OSF_FILE_EXISTS, and OSF received exactly one upload", async () => {
+    const experimentID = `collision-int13-${randomUUID()}`;
+    const filename = `dup-${randomUUID()}.json`;
+    await createDataExperiment(experimentID);
+
+    const first = await saveData({ experimentID, data: sampleData, filename });
+    expect(first.status).toBe(201);
+
+    const second = await saveData({ experimentID, data: sampleData, filename });
+    expect(second.status).toBe(400);
+    expect(second.body).toEqual({ ...MESSAGES.OSF_FILE_EXISTS, metadataMessage: "" });
+
+    expect(mockOSF.getUploadCount(filename)).toBe(1);
+  });
+});
+
+describe("14. dual-run disagreement between an empty cache and a 409 from OSF", () => {
+  it("responds OSF_FILE_EXISTS, confirms the claim, and logs a collisionCacheDisagreement entry", async () => {
+    const experimentID = `collision-int14-${randomUUID()}`;
+    const filename = `disagree-${randomUUID()}.json`;
+    await createDataExperiment(experimentID);
+
+    // The cache has no claim for this filename (fresh experiment, empty
+    // mock container) — but OSF itself reports the name is already taken.
+    mockOSF.forceStatus(filename, 409);
+
+    const response = await saveData({ experimentID, data: sampleData, filename });
+
+    expect(response.status).toBe(400);
+    expect(response.body).toEqual({ ...MESSAGES.OSF_FILE_EXISTS, metadataMessage: "" });
+
+    const expDataAfter = (await db.collection("experiments").doc(experimentID).get()).data();
+    expect(expDataAfter.collisionCache).toBeDefined();
+
+    const hash = claimHash(expDataAfter.collisionCache.salt, filename);
+    const claimSnap = await db
+      .collection("experiments")
+      .doc(experimentID)
+      .collection("filenameClaims")
+      .doc(hash)
+      .get();
+    expect(claimSnap.exists).toBe(true);
+    expect(claimSnap.data().status).toBe("confirmed");
+
+    const logDoc = await db.collection("logs").doc(experimentID).get();
+    const errors = logDoc.data()?.errors || [];
+    expect(errors.some((entry) => entry.collisionCacheDisagreement === true)).toBe(true);
+  });
+});
+
+describe("15. provider failure queues the upload and preserves the claim", () => {
+  it("500 from OSF results in a 202 queued response with a claimToken, and the claim stays pending", async () => {
+    const experimentID = `collision-int15-${randomUUID()}`;
+    const filename = `queue-${randomUUID()}.json`;
+    await createDataExperiment(experimentID);
+
+    mockOSF.forceStatus(filename, 500);
+
+    const response = await saveData({ experimentID, data: sampleData, filename });
+
+    expect(response.status).toBe(202);
+    expect(response.body).toEqual(expect.objectContaining({ ...MESSAGES.OSF_UPLOAD_QUEUED, metadataMessage: "" }));
+
+    const docId = `${experimentID}:${filename}`.replace(/[/\\]/g, "_");
+    const queueDoc = await db.collection("uploadQueue").doc(docId).get();
+    expect(queueDoc.exists).toBe(true);
+    expect(typeof queueDoc.data().claimToken).toBe("string");
+    expect(queueDoc.data().claimToken.length).toBeGreaterThan(0);
+
+    const expDataAfter = (await db.collection("experiments").doc(experimentID).get()).data();
+    expect(expDataAfter.collisionCache).toBeDefined();
+
+    const hash = claimHash(expDataAfter.collisionCache.salt, filename);
+    const claimSnap = await db
+      .collection("experiments")
+      .doc(experimentID)
+      .collection("filenameClaims")
+      .doc(hash)
+      .get();
+    expect(claimSnap.exists).toBe(true);
+    expect(claimSnap.data().status).toBe("pending");
+    expect(claimSnap.data().ownerToken).toBe(queueDoc.data().claimToken);
+  });
+});
+
+describe("16. apibase64: duplicate filename is rejected without a second provider upload", () => {
+  it("first POST succeeds, second POST for the same filename gets OSF_FILE_EXISTS, and OSF received exactly one upload", async () => {
+    const experimentID = `collision-int16-${randomUUID()}`;
+    const filename = `dup-b64-${randomUUID()}.dat`;
+    await createBase64Experiment(experimentID);
+
+    const first = await saveBase64Data({ experimentID, data: sampleBase64, filename });
+    expect(first.status).toBe(201);
+
+    const second = await saveBase64Data({ experimentID, data: sampleBase64, filename });
+    expect(second.status).toBe(400);
+    expect(second.body).toEqual(MESSAGES.OSF_FILE_EXISTS);
+
+    expect(mockOSF.getUploadCount(filename)).toBe(1);
+  });
+});
+
+describe("17. successful upload stamps the experiment with a warm collision cache", () => {
+  it("after a 201, the experiment doc has collisionCache.salt and a warmUntil in the future", async () => {
+    const experimentID = `collision-int17-${randomUUID()}`;
+    const filename = `stamp-${randomUUID()}.json`;
+    await createDataExperiment(experimentID);
+
+    const before = Date.now();
+    const response = await saveData({ experimentID, data: sampleData, filename });
+    expect(response.status).toBe(201);
+
+    const expDataAfter = (await db.collection("experiments").doc(experimentID).get()).data();
+    expect(expDataAfter.collisionCache).toBeDefined();
+    expect(typeof expDataAfter.collisionCache.salt).toBe("string");
+    expect(expDataAfter.collisionCache.salt.length).toBeGreaterThan(0);
+    expect(expDataAfter.collisionCache.warmUntil.toMillis()).toBeGreaterThan(before);
+  });
+});
diff --git a/functions/src/__tests__/create-experiment-emulator.test.js b/functions/src/__tests__/create-experiment-emulator.test.js
new file mode 100644
index 0000000..da788ed
--- /dev/null
+++ b/functions/src/__tests__/create-experiment-emulator.test.js
@@ -0,0 +1,372 @@
+/**
+ * @jest-environment node
+ */
+
+// RED-phase integration tests for step 7a (scratchpad/step7a-create-endpoint-
+// spec.md), cases 5-9 of the test plan.
+//
+// createExperiment (functions/src/create-experiment.ts) does not exist yet:
+// it isn't implemented, isn't exported from index.ts, and has no
+// firebase.json rewrite. Every request to its emulator URL therefore 404s
+// today -- a missing-behavior failure, not a mock-server/transport bug.
+// Following the lowercase function-name convention (apiData -> apidata,
+// connectProvider -> connectprovider), the URL under test is
+// http://localhost:5001/datapipe-test/us-central1/createexperiment.
+//
+// Mock Google Drive: createDataContainer's two calls (find-or-create the
+// shared "DataPipe" root folder, then always-create the experiment folder)
+// are served by a fixed-port (3579) express server, reusing the same
+// GDRIVE_API_BASE=http://127.0.0.1:3579 wiring in functions/.env.datapipe-test
+// that gdrive-emulator.test.js's mock Drive server already uses -- there is
+// only one GDRIVE_API_BASE for the whole Functions-emulator process, so any
+// gdrive-touching suite in this test-ci run must bind that same address.
+// Because gdrive-emulator.test.js's suite ALSO binds port 3579 and Jest may
+// schedule the two test files onto different, truly-concurrent workers, this
+// file's listen() retries on EADDRINUSE (with backoff) instead of assuming
+// the port is free -- whichever suite starts first grabs it, the other waits
+// for that suite's afterAll() to release it. This is defensive, not a claim
+// that the two suites are meant to run interleaved: no two tests actually
+// hold the port at the same instant.
+//
+// Auth: real Auth-emulator idTokens via accounts:signUp, exactly like
+// oauth-connect-emulator.test.js's signUpEmulatorUser helper -- the future
+// createExperiment endpoint is spec'd to verify ownership the same way
+// connect-provider.ts's verifyOwnership does (401 missing, 403 mismatch).
+//
+// connectedAccounts.gdrive is seeded with a bare-plaintext encryptedToken
+// (no "v1:" prefix), relying on crypto-utils.ts's decrypt() plaintext
+// fallback -- same convention as gdrive-emulator.test.js, sidestepping the
+// need for this process and the Functions-emulator child process to agree on
+// TOKEN_ENCRYPTION_KEY.
+
+import { initializeApp, getApp } from "firebase-admin/app";
+import { getFirestore } from "firebase-admin/firestore";
+import { randomUUID } from "crypto";
+import express from "express";
+import MESSAGES from "../api-messages";
+
+process.env.FIRESTORE_EMULATOR_HOST = "localhost:8080";
+jest.setTimeout(30000);
+
+const config = { projectId: "datapipe-test" };
+const FOLDER_MIME = "application/vnd.google-apps.folder";
+const DRIVE_PORT = 3579;
+const FUNCTIONS_BASE = "http://localhost:5001/datapipe-test/us-central1";
+const CREATE_EXPERIMENT_URL = `${FUNCTIONS_BASE}/createexperiment`;
+const AUTH_EMULATOR_SIGNUP_URL =
+  "http://localhost:9099/identitytoolkit.googleapis.com/v1/accounts:signUp?key=fake";
+
+// ---- helpers ----
+
+function parseQuery(q) {
+  const nameMatch = /name\s*=\s*'([^']*)'/.exec(q || "");
+  const parentMatch = /'([^']*)'\s+in\s+parents/.exec(q || "");
+  const folderOnly = /mimeType\s*=\s*'application\/vnd\.google-apps\.folder'/.test(q || "");
+  return {
+    name: nameMatch ? nameMatch[1] : null,
+    parent: parentMatch ? parentMatch[1] : null,
+    folderOnly,
+  };
+}
+
+// Minimal mock Drive: only what createDataContainer needs (a folder lookup by
+// name+parent, and a folder create), plus a forceStatus(name, status) hook
+// for case 9. No upload/download routes -- this endpoint never touches file
+// content.
+function createMockDriveServer() {
+  const app = express();
+  app.use(express.json());
+
+  const filesById = new Map();
+  const createCountsByName = new Map();
+  const forcedStatus = new Map();
+  let nextSeq = 1;
+
+  app.get("/drive/v3/files", (req, res) => {
+    const { name, parent, folderOnly } = parseQuery(req.query.q);
+    let matches = Array.from(filesById.values()).filter((f) => {
+      if (parent && !f.parents.includes(parent)) return false;
+      if (name && f.name !== name) return false;
+      if (folderOnly && f.mimeType !== FOLDER_MIME) return false;
+      return true;
+    });
+    matches.sort((a, b) => a.__seq - b.__seq);
+    res.status(200).json({ files: matches.map((f) => ({ id: f.id, name: f.name, mimeType: f.mimeType })) });
+  });
+
+  app.post("/drive/v3/files", (req, res) => {
+    const payload = req.body || {};
+    createCountsByName.set(payload.name, (createCountsByName.get(payload.name) || 0) + 1);
+
+    const forced = forcedStatus.get(payload.name);
+    if (forced && forced !== 200 && forced !== 201) {
+      res.status(forced).json({ errors: [{ reason: "mockForced", message: `mock-forced-status-${forced}` }] });
+      return;
+    }
+
+    const id = `mock-folder-${nextSeq++}`;
+    filesById.set(id, { id, name: payload.name, mimeType: payload.mimeType, parents: payload.parents || [], __seq: nextSeq });
+    res.status(200).json({ id, name: payload.name });
+  });
+
+  return new Promise((resolve, reject) => {
+    const tryListen = (retriesLeft) => {
+      const server = app.listen(DRIVE_PORT);
+      server.once("listening", () => {
+        resolve({
+          server,
+          getCreateCount: (name) => createCountsByName.get(name) || 0,
+          getFolderId: (name) => {
+            for (const f of filesById.values()) {
+              if (f.name === name) return f.id;
+            }
+            return null;
+          },
+          forceStatus: (name, status) => forcedStatus.set(name, status),
+          reset: () => {
+            filesById.clear();
+            createCountsByName.clear();
+            forcedStatus.clear();
+            nextSeq = 1;
+          },
+        });
+      });
+      server.once("error", (err) => {
+        if (err.code === "EADDRINUSE" && retriesLeft > 0) {
+          setTimeout(() => tryListen(retriesLeft - 1), 500);
+        } else {
+          reject(err);
+        }
+      });
+    };
+    tryListen(60); // up to ~30s, in case gdrive-emulator.test.js's suite holds the port
+  });
+}
+
+async function signUpEmulatorUser() {
+  const email = `create-experiment-${randomUUID()}@example.test`;
+  const res = await fetch(AUTH_EMULATOR_SIGNUP_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ email, password: "Password123!", returnSecureToken: true }),
+  });
+  const body = await res.json();
+  if (!res.ok) {
+    throw new Error(`Auth emulator signUp failed (${res.status}): ${JSON.stringify(body)}`);
+  }
+  return { uid: body.localId, idToken: body.idToken };
+}
+
+async function postJson(url, payload) {
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(payload),
+  });
+  const text = await res.text();
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    body = { rawBody: text };
+  }
+  return { status: res.status, body };
+}
+
+function callCreateExperiment(payload) {
+  return postJson(CREATE_EXPERIMENT_URL, payload);
+}
+
+async function seedGdriveUser(uid, overrides = {}) {
+  await db.collection("users").doc(uid).set({
+    connectedAccounts: {
+      gdrive: {
+        authMethod: "oauth2",
+        encryptedToken: "create-experiment-plaintext-token", // plaintext fallback, see header comment
+        encryptedRefreshToken: "create-experiment-plaintext-refresh",
+        tokenExpiresAt: Date.now() + 60 * 60 * 1000,
+        providerAccountId: "create-experiment-acct",
+        ...overrides,
+      },
+    },
+  });
+}
+
+async function experimentsForOwner(uid) {
+  const snap = await db.collection("experiments").where("owner", "==", uid).get();
+  return snap.docs;
+}
+
+let db;
+let mockDrive;
+
+beforeAll(async () => {
+  mockDrive = await createMockDriveServer();
+
+  let app;
+  try {
+    app = getApp("create-experiment-test");
+  } catch {
+    app = initializeApp(config, "create-experiment-test");
+  }
+  db = getFirestore(app);
+});
+
+afterEach(() => {
+  mockDrive.reset();
+});
+
+afterAll(() => {
+  mockDrive.server.close();
+});
+
+describe("5. createExperiment happy path (gdrive)", () => {
+  it("returns 200 and creates an experiment doc matching the client's default field set, plus provider fields and no OSF fields", async () => {
+    const { uid, idToken } = await signUpEmulatorUser();
+    await seedGdriveUser(uid);
+    const title = `Case5 Experiment ${randomUUID()}`;
+
+    const { status, body } = await callCreateExperiment({ provider: "gdrive", title, idToken, uid });
+
+    expect(status).toBe(200);
+    expect(body.success).toBe(true);
+    // Same id format as lib/experiment-creation.js's customAlphabet(
+    // "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz", 12).
+    expect(body.experimentID).toMatch(/^[0-9A-Za-z]{12}$/);
+
+    const folderId = mockDrive.getFolderId(title);
+    expect(typeof folderId).toBe("string");
+    expect(body.providerContainer).toEqual({ provider: "gdrive", folderId });
+
+    // Mock Drive saw the DataPipe-root find/create and the experiment-folder
+    // create with name=title.
+    expect(mockDrive.getCreateCount("DataPipe")).toBe(1);
+    expect(mockDrive.getCreateCount(title)).toBe(1);
+
+    const expDoc = await db.collection("experiments").doc(body.experimentID).get();
+    expect(expDoc.exists).toBe(true);
+    const expData = expDoc.data();
+
+    // Exact default-field parity with createExperimentDocument in
+    // lib/experiment-creation.js (verified by reading that file): title,
+    // active:false, activeBase64:false, activeConditionAssignment:false,
+    // sessions:0, id, owner, nConditions:1, currentCondition:0,
+    // useValidation:true, allowJSON:true, allowCSV:true,
+    // requiredFields:["trial_type"] (NOT [] -- the client hardcodes
+    // ["trial_type"], it is not a parameterized default), limitSessions:false,
+    // maxSessions:1 -- PLUS storageProvider/providerContainer instead of
+    // osfRepo/osfComponent/osfFilesLink.
+    expect(expData).toEqual({
+      title,
+      active: false,
+      activeBase64: false,
+      activeConditionAssignment: false,
+      sessions: 0,
+      limitSessions: false,
+      maxSessions: 1,
+      id: body.experimentID,
+      owner: uid,
+      nConditions: 1,
+      currentCondition: 0,
+      useValidation: true,
+      allowJSON: true,
+      allowCSV: true,
+      requiredFields: ["trial_type"],
+      storageProvider: "gdrive",
+      providerContainer: { provider: "gdrive", folderId },
+    });
+    expect(expData.osfRepo).toBeUndefined();
+    expect(expData.osfComponent).toBeUndefined();
+    expect(expData.osfFilesLink).toBeUndefined();
+
+    const userDoc = await db.collection("users").doc(uid).get();
+    expect(userDoc.data().experiments).toContain(body.experimentID);
+  });
+});
+
+describe("6. createExperiment provider validation", () => {
+  it("returns 400 for provider 'osf' (OSF creation stays browser-driven)", async () => {
+    const { uid, idToken } = await signUpEmulatorUser();
+    const title = `Case6 OSF ${randomUUID()}`;
+
+    const { status } = await callCreateExperiment({ provider: "osf", title, idToken, uid });
+
+    expect(status).toBe(400);
+    expect((await experimentsForOwner(uid)).length).toBe(0);
+  });
+
+  it("returns 400 for an unknown provider", async () => {
+    const { uid, idToken } = await signUpEmulatorUser();
+    const title = `Case6 Unknown ${randomUUID()}`;
+
+    const { status } = await callCreateExperiment({ provider: "not-a-real-provider", title, idToken, uid });
+
+    expect(status).toBe(400);
+    expect((await experimentsForOwner(uid)).length).toBe(0);
+  });
+});
+
+describe("7. createExperiment with no connected gdrive account", () => {
+  it("returns 400 surfacing PROVIDER_NOT_CONNECTED", async () => {
+    const { uid, idToken } = await signUpEmulatorUser();
+    // Deliberately no connectedAccounts.gdrive seeded.
+    const title = `Case7 ${randomUUID()}`;
+
+    const { status, body } = await callCreateExperiment({ provider: "gdrive", title, idToken, uid });
+
+    expect(status).toBe(400);
+    expect(body).toEqual(expect.objectContaining(MESSAGES.PROVIDER_NOT_CONNECTED));
+    expect((await experimentsForOwner(uid)).length).toBe(0);
+  });
+});
+
+describe("8. createExperiment auth failures", () => {
+  it("returns 403 for a wrong-user idToken and creates nothing", async () => {
+    const userA = await signUpEmulatorUser();
+    const userB = await signUpEmulatorUser();
+    await seedGdriveUser(userA.uid);
+    const title = `Case8 wrong-user ${randomUUID()}`;
+
+    const { status } = await callCreateExperiment({
+      provider: "gdrive",
+      title,
+      idToken: userB.idToken,
+      uid: userA.uid,
+    });
+
+    expect(status).toBe(403);
+    expect((await experimentsForOwner(userA.uid)).length).toBe(0);
+    const userAData = (await db.collection("users").doc(userA.uid).get()).data();
+    expect(userAData.experiments || []).toEqual([]);
+  });
+
+  it("returns 401 for a missing idToken and creates nothing", async () => {
+    const { uid } = await signUpEmulatorUser();
+    const title = `Case8 missing-idtoken ${randomUUID()}`;
+
+    const { status } = await callCreateExperiment({ provider: "gdrive", title, uid });
+
+    expect(status).toBe(401);
+    expect((await experimentsForOwner(uid)).length).toBe(0);
+  });
+});
+
+describe("9. createExperiment Drive container-creation failure", () => {
+  it("returns 502 when Drive folder creation fails, and creates nothing", async () => {
+    const { uid, idToken } = await signUpEmulatorUser();
+    await seedGdriveUser(uid);
+    const title = `Case9 ${randomUUID()}`;
+
+    // The DataPipe root-folder create still succeeds; only the
+    // experiment-named folder create is forced to fail.
+    mockDrive.forceStatus(title, 500);
+
+    const { status, body } = await callCreateExperiment({ provider: "gdrive", title, idToken, uid });
+
+    expect(status).toBe(502);
+    expect(body.error).toBe("Failed to create storage container");
+    expect((await experimentsForOwner(uid)).length).toBe(0);
+    const userData = (await db.collection("users").doc(uid).get()).data();
+    expect(userData?.experiments || []).toEqual([]);
+  });
+});
diff --git a/functions/src/__tests__/early-persist-emulator.test.js b/functions/src/__tests__/early-persist-emulator.test.js
index 9c2ad09..c7aaeda 100644
--- a/functions/src/__tests__/early-persist-emulator.test.js
+++ b/functions/src/__tests__/early-persist-emulator.test.js
@@ -57,6 +57,12 @@ function createMockOSFServer() {
   app.put("/endpoint", (req, res) => {
     res.status(201).json({ data: { attributes: { name: req.query.name || "uploaded.json" } } });
   });
+  // Collision-cache rehydration lists the container on an experiment's first
+  // write (see collision-cache.ts); an empty listing keeps this suite's
+  // experiments cold-start-clean without changing what it tests.
+  app.get("/endpoint", (req, res) => {
+    res.json({ data: [] });
+  });
   return new Promise((resolve) => {
     const server = app.listen(0, () => {
       resolve(server);
diff --git a/functions/src/__tests__/gdrive-emulator.test.js b/functions/src/__tests__/gdrive-emulator.test.js
new file mode 100644
index 0000000..32dccd7
--- /dev/null
+++ b/functions/src/__tests__/gdrive-emulator.test.js
@@ -0,0 +1,552 @@
+/**
+ * @jest-environment node
+ */
+
+// RED-phase integration tests for step 4a (docs/provider-migration-design.md,
+// scratchpad/step4a-gdrive-adapter-spec.md), cases 12-16 of the test plan.
+//
+// These exercise the deployed-in-emulator apidata function end to end
+// against a mock Google Drive server, following the fixed-port convention
+// documented in the spec: a self-contained express server bound to
+// 127.0.0.1:3579 (not an OS-assigned port), because functions/.env.datapipe-
+// test (created alongside this file -- see the build-step instructions) sets
+// GDRIVE_API_BASE=http://127.0.0.1:3579 for the *functions emulator process*
+// to read. Verified empirically: starting `firebase emulators:exec --project
+// datapipe-test` logs "functions: Loaded environment variables from .env,
+// .env.datapipe-test." -- confirming firebase-tools' documented
+// .env.<projectId> loading (functions/node_modules/firebase-tools/lib/
+// functions/env.js's findEnvfiles: [".env", `.env.${projectId}`, ...]) picks
+// this file up with no further plumbing needed. This is a genuinely fixed
+// port (unlike collision-integration-emulator.test.js's listen(0) pattern)
+// because the emulator-hosted gdrive adapter has no other way to discover
+// where the mock server lives.
+//
+// None of cases 12-16 exercise real token encryption: the seeded
+// connectedAccounts.gdrive.encryptedToken values below are bare plaintext
+// strings, relying on crypto-utils.ts's decrypt() plaintext fallback (no
+// "v1:" prefix -> returned unchanged) -- exactly like the existing OSF
+// emulator tests seed osfToken: "valid". This sidesteps needing the jest
+// process and the functions-emulator child process to agree on
+// TOKEN_ENCRYPTION_KEY (they're different processes; only the latter loads
+// functions/.env). The real encrypt/decrypt round-trip through a refresh is
+// covered directly, in-process, by resolve-token-gdrive.test.js's case 9.
+//
+// Until gdrive.ts exists, is registered in providers/index.ts, and
+// resolve-token.ts dispatches on storageProvider === "gdrive", every gdrive
+// experiment request in cases 12-15 fails long before it reaches the mock
+// server: getProviderForExperiment throws "Unknown storage provider:
+// gdrive" (registry.ts already throws that for any unregistered id), so
+// apidata's response is never the expected 201/202 -- a missing-behavior
+// failure, not a mock-server/transport bug. Case 15 additionally depends on
+// queue-upload.ts/api-data.ts passing storageProvider/providerContainer
+// through to the queue doc (the "Queue generalization" section of the spec),
+// which also doesn't exist yet.
+//
+// Case 16 is a regression guard: a legacy (storageProvider-less) OSF
+// experiment, using the same OS-assigned-port inline-mock-OSF-server pattern
+// as collision-integration-emulator.test.js. It is expected to PASS today --
+// the gdrive generalization must not be able to break it.
+
+import { initializeApp } from "firebase-admin/app";
+import { getFirestore } from "firebase-admin/firestore";
+import { randomUUID } from "crypto";
+import express from "express";
+import MESSAGES from "../api-messages";
+
+process.env.FIRESTORE_EMULATOR_HOST = "localhost:8080";
+
+jest.setTimeout(30000);
+
+const config = { projectId: "datapipe-test" };
+const GDRIVE_OWNER_ID = "gdrive-emulator-owner";
+const OSF_OWNER_ID = "gdrive-emulator-osf-owner";
+const FOLDER_MIME = "application/vnd.google-apps.folder";
+const DRIVE_PORT = 3579;
+
+const sampleData = `[{"trial_type":"html-keyboard-response","trial_index":1,"time_elapsed":776}]`;
+
+async function saveData(body) {
+  const response = await fetch("http://localhost:5001/datapipe-test/us-central1/apidata", {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "*/*" },
+    body: JSON.stringify(body),
+  });
+  // An uncaught exception in the function (e.g. today's "Unknown storage
+  // provider: gdrive") produces a plain-text "Internal Server Error" body,
+  // not JSON. Parsing defensively keeps assertions on `status` failing
+  // cleanly (e.g. "Expected 201, Received 500") instead of the test itself
+  // throwing a SyntaxError out of response.json() -- that would obscure a
+  // real missing-behavior red as an apparent test-harness bug.
+  const text = await response.text();
+  let message;
+  try {
+    message = JSON.parse(text);
+  } catch {
+    message = { rawBody: text };
+  }
+  return { status: response.status, body: message };
+}
+
+// Parses a Drive `q` filter string just far enough to support the shapes
+// this adapter is spec'd to send: a parent clause ('<id>' in parents), an
+// exact-name clause (name='...'), and an optional folder-mimeType clause.
+function parseQuery(q) {
+  const nameMatch = /name\s*=\s*'([^']*)'/.exec(q || "");
+  const parentMatch = /'([^']*)'\s+in\s+parents/.exec(q || "");
+  const folderOnly = /mimeType\s*=\s*'application\/vnd\.google-apps\.folder'/.test(q || "");
+  return {
+    name: nameMatch ? nameMatch[1] : null,
+    parent: parentMatch ? parentMatch[1] : null,
+    folderOnly,
+  };
+}
+
+// "regex or simple string split on the boundary is fine" per the spec --
+// this splits on the boundary and picks out whichever part declares itself
+// application/json as the metadata part.
+function parseMultipartMetadata(bodyBuffer, contentTypeHeader) {
+  const boundaryMatch = /boundary=("?)([^;"]+)\1/.exec(contentTypeHeader || "");
+  if (!boundaryMatch) return null;
+  const boundary = boundaryMatch[2];
+  const parts = bodyBuffer.toString("utf8").split(`--${boundary}`);
+  for (const rawPart of parts) {
+    const part = rawPart.replace(/^\r\n/, "");
+    if (!part || part.startsWith("--")) continue;
+    if (!/Content-Type:\s*application\/json/i.test(part)) continue;
+    const sep = part.indexOf("\r\n\r\n");
+    if (sep === -1) continue;
+    try {
+      return JSON.parse(part.slice(sep + 4).trim());
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+
+// Companion to parseMultipartMetadata: extracts the *other* part (the
+// payload being uploaded), so the mock can actually store it and serve it
+// back via alt=media.
+function parseMultipartDataPart(bodyBuffer, contentTypeHeader) {
+  const boundaryMatch = /boundary=("?)([^;"]+)\1/.exec(contentTypeHeader || "");
+  if (!boundaryMatch) return { content: "", contentType: "application/octet-stream" };
+  const boundary = boundaryMatch[2];
+  const parts = bodyBuffer.toString("utf8").split(`--${boundary}`);
+  for (const rawPart of parts) {
+    const part = rawPart.replace(/^\r\n/, "");
+    if (!part || part.startsWith("--")) continue;
+    if (/Content-Type:\s*application\/json/i.test(part)) continue; // that's the metadata part
+    const sep = part.indexOf("\r\n\r\n");
+    if (sep === -1) continue;
+    const headerBlock = part.slice(0, sep);
+    const content = part.slice(sep + 4).replace(/\r\n$/, "");
+    const ctMatch = /Content-Type:\s*([^\r\n]+)/i.exec(headerBlock);
+    return { content, contentType: ctMatch ? ctMatch[1].trim() : "application/octet-stream" };
+  }
+  return { content: "", contentType: "application/octet-stream" };
+}
+
+// A self-contained mock Google Drive: a fixed-id filesById store, plus the
+// counters/controls the build-step spec calls for (per-name upload
+// counters, forceStatus(name-or-id, status), reset()).
+function createMockDriveServer() {
+  const app = express();
+  // A single raw-body parser regardless of Content-Type -- multipart/related
+  // and the media-PATCH's raw bytes both need the untouched body; JSON
+  // routes parse it themselves.
+  app.use(express.raw({ type: () => true, limit: "20mb" }));
+
+  const filesById = new Map();
+  const uploadCountsByName = new Map();
+  const updateCountsById = new Map();
+  const forcedStatus = new Map();
+  let nextSeq = 1;
+
+  function forcedFor(key) {
+    const status = forcedStatus.get(key);
+    return status && status !== 200 && status !== 201 ? status : null;
+  }
+
+  app.get("/drive/v3/files", (req, res) => {
+    const { name, parent, folderOnly } = parseQuery(req.query.q);
+    let matches = Array.from(filesById.values()).filter((f) => {
+      if (parent && !f.parents.includes(parent)) return false;
+      if (name && f.name !== name) return false;
+      if (folderOnly && f.mimeType !== FOLDER_MIME) return false;
+      return true;
+    });
+    matches.sort((a, b) => a.__seq - b.__seq);
+
+    const pageSize = parseInt(req.query.pageSize, 10) || matches.length || 1;
+    const offset = req.query.pageToken ? parseInt(req.query.pageToken, 10) : 0;
+    const page = matches.slice(offset, offset + pageSize);
+    const nextPageToken = offset + pageSize < matches.length ? String(offset + pageSize) : undefined;
+
+    const body = { files: page.map((f) => ({ id: f.id, name: f.name, mimeType: f.mimeType })) };
+    if (nextPageToken) body.nextPageToken = nextPageToken;
+    res.status(200).json(body);
+  });
+
+  app.post("/drive/v3/files", (req, res) => {
+    let payload;
+    try {
+      payload = JSON.parse(req.body.toString("utf8"));
+    } catch {
+      res.status(400).json({ errors: [{ reason: "badRequest", message: "invalid JSON body" }] });
+      return;
+    }
+    const forced = forcedFor(payload.name);
+    if (forced) {
+      res.status(forced).json({ errors: [{ reason: "mockForced", message: `mock-forced-status-${forced}` }] });
+      return;
+    }
+    const id = `mock-folder-${nextSeq}`;
+    filesById.set(id, {
+      id,
+      name: payload.name,
+      mimeType: payload.mimeType,
+      parents: payload.parents || [],
+      content: "",
+      contentType: payload.mimeType,
+      __seq: nextSeq++,
+    });
+    res.status(200).json({ id, name: payload.name });
+  });
+
+  app.post("/upload/drive/v3/files", (req, res) => {
+    if (req.query.uploadType !== "multipart") {
+      res.status(400).json({ errors: [{ reason: "badRequest", message: "unsupported uploadType" }] });
+      return;
+    }
+    const contentTypeHeader = req.headers["content-type"];
+    const metadata = parseMultipartMetadata(req.body, contentTypeHeader);
+    if (!metadata || !metadata.name) {
+      res.status(400).json({ errors: [{ reason: "badRequest", message: "could not parse multipart metadata" }] });
+      return;
+    }
+    uploadCountsByName.set(metadata.name, (uploadCountsByName.get(metadata.name) || 0) + 1);
+
+    const forced = forcedFor(metadata.name);
+    if (forced) {
+      res.status(forced).json({ errors: [{ reason: "mockForced", message: `mock-forced-status-${forced}` }] });
+      return;
+    }
+
+    const { content, contentType } = parseMultipartDataPart(req.body, contentTypeHeader);
+    const id = `mock-file-${nextSeq}`;
+    filesById.set(id, {
+      id,
+      name: metadata.name,
+      mimeType: contentType,
+      parents: metadata.parents || [],
+      content,
+      contentType,
+      __seq: nextSeq++,
+    });
+    res.status(200).json({ id, name: metadata.name });
+  });
+
+  app.patch("/upload/drive/v3/files/:id", (req, res) => {
+    if (req.query.uploadType !== "media") {
+      res.status(400).json({ errors: [{ reason: "badRequest", message: "unsupported uploadType" }] });
+      return;
+    }
+    const id = req.params.id;
+    updateCountsById.set(id, (updateCountsById.get(id) || 0) + 1);
+
+    const forced = forcedFor(id);
+    if (forced) {
+      res.status(forced).json({ errors: [{ reason: "mockForced", message: `mock-forced-status-${forced}` }] });
+      return;
+    }
+
+    const contentType = req.headers["content-type"] || "application/octet-stream";
+    const content = req.body.toString("utf8");
+    const existing = filesById.get(id);
+    if (existing) {
+      existing.content = content;
+      existing.contentType = contentType;
+    } else {
+      filesById.set(id, { id, name: id, mimeType: contentType, parents: [], content, contentType, __seq: nextSeq++ });
+    }
+    res.status(200).json({ id });
+  });
+
+  app.get("/drive/v3/files/:id", (req, res) => {
+    if (req.query.alt !== "media") {
+      res.status(400).json({ errors: [{ reason: "badRequest", message: "unsupported alt" }] });
+      return;
+    }
+    const id = req.params.id;
+    const forced = forcedFor(id);
+    if (forced) {
+      res.status(forced).json({ errors: [{ reason: "mockForced", message: `mock-forced-status-${forced}` }] });
+      return;
+    }
+    const file = filesById.get(id);
+    if (!file) {
+      res.status(404).json({ errors: [{ reason: "notFound", message: "no such file" }] });
+      return;
+    }
+    res.status(200).type(file.contentType || "text/plain").send(file.content);
+  });
+
+  // "For completeness" per the spec -- not exercised by cases 12-16 (every
+  // seeded gdrive token is unexpired), but GDRIVE_TOKEN_URL points here.
+  app.post("/token", (req, res) => {
+    res.status(200).json({ access_token: "mock-refreshed-token", expires_in: 3600, token_type: "Bearer" });
+  });
+
+  // Fixed-port bind, shared with create-experiment-emulator.test.js's mock
+  // Drive server (both read the same GDRIVE_API_BASE=http://127.0.0.1:3579
+  // wired into functions/.env.datapipe-test). Jest may schedule the two test
+  // files onto different, truly-concurrent workers, so this retries on
+  // EADDRINUSE (with backoff) instead of assuming the port is free --
+  // whichever suite starts first grabs it, the other waits for that suite's
+  // afterAll() to release it. Defensive only: no two tests actually hold the
+  // port at the same instant.
+  return new Promise((resolve, reject) => {
+    const tryListen = (retriesLeft) => {
+      const server = app.listen(DRIVE_PORT);
+      server.once("listening", () => {
+        resolve({
+          server,
+          port: DRIVE_PORT,
+          getUploadCount: (name) => uploadCountsByName.get(name) || 0,
+          getUpdateCount: (id) => updateCountsById.get(id) || 0,
+          forceStatus: (nameOrId, status) => forcedStatus.set(nameOrId, status),
+          reset: () => {
+            filesById.clear();
+            uploadCountsByName.clear();
+            updateCountsById.clear();
+            forcedStatus.clear();
+            nextSeq = 1;
+          },
+        });
+      });
+      server.once("error", (err) => {
+        if (err.code === "EADDRINUSE" && retriesLeft > 0) {
+          setTimeout(() => tryListen(retriesLeft - 1), 500);
+        } else {
+          reject(err);
+        }
+      });
+    };
+    tryListen(60); // up to ~30s, in case create-experiment-emulator.test.js's suite holds the port
+  });
+}
+
+// Minimal inline mock OSF server for case 16's regression guard, matching
+// the OS-assigned-port pattern established by
+// collision-integration-emulator.test.js (listen(0), in-process counters).
+function createMockOSFServer() {
+  const app = express();
+  const uploadCountsByFilename = new Map();
+
+  app.get("/files", (req, res) => {
+    res.json({ data: [] });
+  });
+
+  app.put("/files", (req, res) => {
+    const filename = String(req.query.name || "");
+    uploadCountsByFilename.set(filename, (uploadCountsByFilename.get(filename) || 0) + 1);
+    res.status(201).json({
+      data: { attributes: { name: filename, kind: "file" }, id: "osfstorage/mock-upload" },
+    });
+  });
+
+  return new Promise((resolve) => {
+    const server = app.listen(0, () => {
+      resolve({
+        server,
+        port: server.address().port,
+        getUploadCount: (filename) => uploadCountsByFilename.get(filename) || 0,
+        reset: () => uploadCountsByFilename.clear(),
+      });
+    });
+  });
+}
+
+let db;
+let mockDrive;
+
+beforeAll(async () => {
+  mockDrive = await createMockDriveServer();
+
+  initializeApp(config);
+  db = getFirestore();
+
+  await db.collection("users").doc(GDRIVE_OWNER_ID).set({
+    connectedAccounts: {
+      gdrive: {
+        authMethod: "oauth2",
+        encryptedToken: "gdrive-integration-token", // plaintext fallback, see header comment
+        encryptedRefreshToken: "gdrive-integration-refresh",
+        tokenExpiresAt: Date.now() + 60 * 60 * 1000,
+        providerAccountId: "gdrive-integration-acct",
+      },
+    },
+  });
+});
+
+afterEach(() => {
+  mockDrive.reset();
+});
+
+afterAll(() => {
+  mockDrive.server.close();
+});
+
+async function createGdriveExperiment(experimentID, folderId, overrides = {}) {
+  await db
+    .collection("experiments")
+    .doc(experimentID)
+    .set({
+      active: true,
+      metadataActive: false,
+      owner: GDRIVE_OWNER_ID,
+      storageProvider: "gdrive",
+      providerContainer: { provider: "gdrive", folderId },
+      ...overrides,
+    });
+}
+
+describe("12. gdrive experiment: apidata POST succeeds and warms the collision cache", () => {
+  it("returns 201, records the upload in the mock, and leaves the experiment's collisionCache warm", async () => {
+    const experimentID = `gdrive-int12-${randomUUID()}`;
+    const folderId = `folder-${randomUUID()}`;
+    const filename = `case12-${randomUUID()}.json`;
+    await createGdriveExperiment(experimentID, folderId);
+
+    const before = Date.now();
+    const response = await saveData({ experimentID, data: sampleData, filename });
+
+    expect(response.status).toBe(201);
+    expect(mockDrive.getUploadCount(filename)).toBe(1);
+
+    const expDataAfter = (await db.collection("experiments").doc(experimentID).get()).data();
+    expect(expDataAfter.collisionCache).toBeDefined();
+    expect(typeof expDataAfter.collisionCache.salt).toBe("string");
+    expect(expDataAfter.collisionCache.warmUntil.toMillis()).toBeGreaterThan(before);
+  });
+});
+
+describe("13. gdrive experiment: duplicate filename is rejected without a second provider upload", () => {
+  it("first POST succeeds, second POST for the same filename gets OSF_FILE_EXISTS, and the mock received exactly one upload", async () => {
+    const experimentID = `gdrive-int13-${randomUUID()}`;
+    const folderId = `folder-${randomUUID()}`;
+    const filename = `dup-${randomUUID()}.json`;
+    await createGdriveExperiment(experimentID, folderId);
+
+    const first = await saveData({ experimentID, data: sampleData, filename });
+    expect(first.status).toBe(201);
+
+    const second = await saveData({ experimentID, data: sampleData, filename });
+    expect(second.status).toBe(400);
+    // Message key is a historical "OSF_FILE_EXISTS" name (unchanged: the
+    // collision-cache duplicate check is entirely provider-agnostic in
+    // api-data.ts), not a claim that gdrive itself returned an OSF error.
+    expect(second.body).toEqual({ ...MESSAGES.OSF_FILE_EXISTS, metadataMessage: "" });
+
+    expect(mockDrive.getUploadCount(filename)).toBe(1);
+  });
+});
+
+describe("14. metadata on gdrive", () => {
+  it("first submission creates dataset_description.json via multipart and stores the ref; second submission media-PATCHes that ref'd id with no second create", async () => {
+    const experimentID = `gdrive-int14-${randomUUID()}`;
+    const folderId = `folder-${randomUUID()}`;
+    await createGdriveExperiment(experimentID, folderId, { metadataActive: true });
+
+    const first = await saveData({
+      experimentID,
+      data: sampleData,
+      filename: `case14-a-${randomUUID()}.json`,
+    });
+    expect(first.status).toBe(201);
+    expect(mockDrive.getUploadCount("dataset_description.json")).toBe(1);
+
+    const metadataDocAfterFirst = (await db.collection("metadata").doc(experimentID).get()).data();
+    expect(metadataDocAfterFirst.metadataFileRef).toBeDefined();
+    expect(metadataDocAfterFirst.metadataFileRef).not.toBeNull();
+    const refId = metadataDocAfterFirst.metadataFileRef.id;
+    expect(typeof refId).toBe("string");
+    expect(refId.length).toBeGreaterThan(0);
+
+    const second = await saveData({
+      experimentID,
+      data: sampleData,
+      filename: `case14-b-${randomUUID()}.json`,
+    });
+    expect(second.status).toBe(201);
+
+    expect(mockDrive.getUploadCount("dataset_description.json")).toBe(1); // still just the one create
+    expect(mockDrive.getUpdateCount(refId)).toBe(1); // the media PATCH from the second submission
+  });
+});
+
+describe("15. provider failure queues the upload and tags it with the gdrive container", () => {
+  it("a mock-forced 500 on upload results in a 202 queued response, with the queue doc carrying claimToken + storageProvider + providerContainer", async () => {
+    const experimentID = `gdrive-int15-${randomUUID()}`;
+    const folderId = `folder-${randomUUID()}`;
+    const filename = `case15-${randomUUID()}.json`;
+    await createGdriveExperiment(experimentID, folderId);
+
+    mockDrive.forceStatus(filename, 500);
+
+    const response = await saveData({ experimentID, data: sampleData, filename });
+
+    expect(response.status).toBe(202);
+    expect(response.body).toEqual(expect.objectContaining({ ...MESSAGES.OSF_UPLOAD_QUEUED, metadataMessage: "" }));
+
+    const docId = `${experimentID}:${filename}`.replace(/[/\\]/g, "_");
+    const queueDoc = await db.collection("uploadQueue").doc(docId).get();
+    expect(queueDoc.exists).toBe(true);
+
+    const queueData = queueDoc.data();
+    expect(typeof queueData.claimToken).toBe("string");
+    expect(queueData.claimToken.length).toBeGreaterThan(0);
+    expect(queueData.storageProvider).toBe("gdrive");
+    expect(queueData.providerContainer).toEqual({ provider: "gdrive", folderId });
+  });
+});
+
+describe("16. OSF experiment in the same run still works (legacy dispatch untouched, regression guard)", () => {
+  let mockOSF;
+
+  beforeAll(async () => {
+    mockOSF = await createMockOSFServer();
+    await db.collection("users").doc(OSF_OWNER_ID).set({
+      osfTokenValid: true,
+      osfToken: "valid",
+      usingPersonalToken: true,
+    });
+  });
+
+  afterEach(() => {
+    mockOSF.reset();
+  });
+
+  afterAll(() => {
+    mockOSF.server.close();
+  });
+
+  it("apidata POST for a legacy (storageProvider-less) OSF experiment succeeds normally -- expected to PASS today", async () => {
+    const experimentID = `gdrive-int16-${randomUUID()}`;
+    const filename = `case16-${randomUUID()}.json`;
+    const filesLink = `http://localhost:${mockOSF.port}/files/`;
+
+    await db.collection("experiments").doc(experimentID).set({
+      active: true,
+      metadataActive: false,
+      owner: OSF_OWNER_ID,
+      osfFilesLink: filesLink,
+      // storageProvider deliberately absent -- legacy dispatch.
+    });
+
+    const response = await saveData({ experimentID, data: sampleData, filename });
+
+    expect(response.status).toBe(201);
+    expect(mockOSF.getUploadCount(filename)).toBe(1);
+  });
+});
diff --git a/functions/src/__tests__/metadata-derived-upload-emulator.test.js b/functions/src/__tests__/metadata-derived-upload-emulator.test.js
index d93e54b..275d606 100644
--- a/functions/src/__tests__/metadata-derived-upload-emulator.test.js
+++ b/functions/src/__tests__/metadata-derived-upload-emulator.test.js
@@ -2,6 +2,20 @@
  * @jest-environment node
  */
 
+// Mocked at the module level (matching put-file-osf-ref.test.js /
+// providers-osf.test.js / put-file-osf.test.js): the generalized
+// metadata-derived-upload.ts routes uploads through getProvider("osf") ->
+// osf.ts -> put-file-osf.ts, all of which import their own `fetch` from the
+// "node-fetch" package (provider-migration's documented architecture) rather
+// than using the global fetch, so assigning global.fetch would never be seen
+// by the code under test.
+const mockFetch = jest.fn();
+
+jest.mock("node-fetch", () => ({
+  __esModule: true,
+  default: (...args) => mockFetch(...args),
+}));
+
 process.env.FIRESTORE_EMULATOR_HOST = "localhost:8080";
 process.env.FIREBASE_STORAGE_EMULATOR_HOST = "localhost:9199";
 process.env.GCLOUD_PROJECT = "datapipe-test";
@@ -47,7 +61,7 @@ const experimentID = "derived-upload-test-exp";
 const target = { experimentID, owner: "derived-upload-test-user", osfFilesLink: ROOT };
 
 beforeEach(() => {
-  global.fetch = jest.fn();
+  mockFetch.mockReset();
 });
 
 afterEach(async () => {
@@ -58,41 +72,55 @@ afterEach(async () => {
 });
 
 describe("uploadDerivedFiles", () => {
-  it("resolves data/ once and queues exactly the file that failed", async () => {
+  it("resolves data/ independently per file now (no shared up-front resolution) and queues exactly the file that failed", async () => {
     const files = [
       { filename: "data/subject-abc_data.csv", content: "main" },
       { filename: "data/measure-x_data.csv", content: "sidecar" },
       { filename: ".psychds-ignore", content: "ignore" },
     ];
 
-    fetch
-      .mockReturnValueOnce(listing(["data"])) // resolve data/ once, up front
-      .mockReturnValueOnce(fileOk())           // main CSV upload
-      .mockReturnValueOnce(fileFail(500, "Server Error")) // sidecar CSV upload fails
-      .mockReturnValueOnce(fileOk());          // .psychds-ignore upload
+    // The up-front "resolve data/ once" optimization was intentionally
+    // dropped when uploadDerivedFiles was generalized to route through the
+    // provider interface (each writeSessionFile call now walks its own path,
+    // independently, so folder-create races are handled inside the adapters
+    // rather than by a shared pre-resolution here). Dispatch by request
+    // shape rather than a fixed call queue, since the two data/-scoped files
+    // now upload concurrently and their folder-lookup/upload calls can
+    // interleave.
+    mockFetch.mockImplementation((url) => {
+      if (url === `${ROOT}?meta=`) {
+        return listing(["data"]);
+      }
+      if (url.includes("name=measure-x_data.csv")) {
+        return fileFail(500, "Server Error");
+      }
+      return fileOk();
+    });
 
     await uploadDerivedFiles(files, target, TOKEN);
 
-    // Only one "data/"-folder resolution call, despite two files living under data/.
-    const dataMetaCalls = fetch.mock.calls.filter(([url]) => url === `${ROOT}?meta=`);
-    expect(dataMetaCalls).toHaveLength(1);
+    // Each of the two files under data/ now resolves its own copy of the
+    // "data" folder independently -- one lookup per file, not one shared
+    // lookup up front.
+    const dataMetaCalls = mockFetch.mock.calls.filter(([url]) => url === `${ROOT}?meta=`);
+    expect(dataMetaCalls).toHaveLength(2);
 
     const docs = await db.collection("uploadQueue").where("experimentID", "==", experimentID).get();
     expect(docs.docs).toHaveLength(1);
     expect(docs.docs[0].data().filename).toBe("data/measure-x_data.csv");
   });
 
-  it("does not throw when the up-front data/ resolution fails — every file is queued instead", async () => {
+  it("does not throw when data/ resolution fails for every file — each is queued instead", async () => {
     const files = [
       { filename: "data/subject-abc_data.csv", content: "main" },
       { filename: "data/measure-x_data.csv", content: "sidecar" },
       { filename: ".psychds-ignore", content: "ignore" },
     ];
 
-    // OSF is unreachable: the up-front resolveFolder rejects, and so does every
-    // per-file re-walk. The best-effort contract requires this never throws and
-    // every file ends up queued for retry rather than lost.
-    fetch.mockRejectedValue(new Error("network down"));
+    // OSF is unreachable: every per-file resolveFolder/upload attempt
+    // rejects. The best-effort contract requires this never throws and every
+    // file ends up queued for retry rather than lost.
+    mockFetch.mockRejectedValue(new Error("network down"));
 
     await expect(uploadDerivedFiles(files, target, TOKEN)).resolves.toBeUndefined();
 
diff --git a/functions/src/__tests__/metadata-emulator.test.js b/functions/src/__tests__/metadata-emulator.test.js
index 7cb6a73..d66c11f 100644
--- a/functions/src/__tests__/metadata-emulator.test.js
+++ b/functions/src/__tests__/metadata-emulator.test.js
@@ -1,10 +1,40 @@
 /**
  * @jest-environment node
  */
-import { startServer } from '../../lib/mock-server.js'
+
+// Rewritten for step 3b (docs/provider-migration-design.md,
+// scratchpad/step3b-metadata-ref-spec.md).
+//
+// The original `runTransaction` block simulated OSF metadata-file
+// presence/absence by flipping a single shared test user's osfToken
+// validity, which flipped mock-server.ts's fixed GET /endpoint response
+// between "has dataset_description.json" and "doesn't" (see
+// mock-server.ts's `bearerInvalid` branch). metadata-block.ts no longer
+// lists the provider folder on every request -- presence/absence is now
+// read from the metadataFileRef stored on the metadata doc -- so that
+// token-validity trick no longer produces the scenario it used to.
+//
+// This rewrite seeds metadataFileRef directly (a ref object, or explicit
+// null) instead of toggling token validity, and replaces mock-server.ts
+// (which defines no PUT route at all -- see below) with a real inline
+// mock OSF server, following the pattern already established in
+// metadata-ref-emulator.test.js.
+//
+// Notably, mock-server.ts's complete absence of a PUT route means the two
+// "not in OSF" scenarios in the original file (METADATA_NOT_IN_FIRESTORE_OR_OSF
+// and METADATA_IN_FIRESTORE_NOT_IN_OSF) could only reach putFileOSF via a 404
+// from the mock. In the METADATA_IN_FIRESTORE_NOT_IN_OSF case this fed
+// straight into the (now-removed) `status !== 210` bug in metadata-block.ts:
+// the create branch always threw, and the request as a whole FAILED --
+// but the old test only asserted `response.metadataMessage`, never
+// `response.success` or the HTTP status, so the failure was invisible. That
+// gap is exactly how the 210 bug survived undetected; each rewritten test
+// below asserts the HTTP status alongside metadataMessage to close it.
 import { initializeApp } from "firebase-admin/app";
 import { getFirestore } from "firebase-admin/firestore";
-import MESSAGES from '../../lib/api-messages.js';
+import { randomUUID } from "crypto";
+import express from "express";
+import MESSAGES from "../../lib/api-messages.js";
 
 process.env.FIRESTORE_EMULATOR_HOST = "localhost:8080";
 
@@ -14,6 +44,8 @@ const config = {
   projectId: "datapipe-test",
 };
 
+const OWNER_ID = "metadata-matrix-owner";
+
 async function saveData(body) {
   const response = await fetch(
     "http://localhost:5001/datapipe-test/us-central1/apidata",
@@ -27,102 +59,252 @@ async function saveData(body) {
     }
   );
   const message = await response.json();
-  return message;
+  return { status: response.status, body: message };
 }
 
 const sampleData = `[{
   "trial_type": "html-keyboard-response",
   "trial_index": 1,
   "time_elapsed": 776
-}]`
+}]`;
+
+// A valid Psych-DS-shaped metadata object. metadata-update.ts's
+// updateMetadata (real, unmocked) requires `variableMeasured`, and
+// metadata-download.ts's downloadMetadata additionally requires the full
+// Psych-DS field set -- both throw "Invalid ..." otherwise, which would fail
+// these tests for the wrong reason (an unrelated throw, not the scenario
+// under test).
+const existingMetadata = { variableMeasured: [{ name: "existing_var" }] };
+const downloadedMetadata = {
+  name: "test-dataset",
+  schemaVersion: "Psych-DS 0.4.0",
+  "@context": "https://schema.org",
+  "@type": "Dataset",
+  description: "test dataset for download",
+  author: [{ name: "tester" }],
+  variableMeasured: [{ name: "downloaded_var" }],
+};
 
-let mockServerInstance;
+// A minimal, self-contained mock OSF "files" container, following the
+// pattern established in metadata-ref-emulator.test.js:
+//   GET  /files      -> osfProvider.listFiles (collision-cache rehydration
+//                        only in this file -- metadataFileRef is always
+//                        seeded explicitly below, so metadata-block.ts's
+//                        legacy-discovery listing never fires)
+//   GET  /files/:id  -> metadata-download.ts's downloadMetadata
+//   PUT  /files      -> create (putFileOSF / writeSessionFile)
+//   PUT  /files/:id  -> update (updateFileOSF / updateFile)
+// mock-server.ts defines none of the PUT routes this needs, and is left
+// untouched -- nothing else in the repo still imports it after this file
+// stops doing so.
+function createMockOSFServer() {
+  const app = express();
+  let nextId = 1;
+  let nextFolderId = 1;
+  const createCallsByFilename = new Map();
+  const updateCallsById = new Map();
+
+  // Handles both a file create (kind=file, the pre-existing behavior) and a
+  // folder create (kind=folder). The latter is new: now that a
+  // metadata-active raw file uploads under data/raw/ (Psych-DS layout),
+  // subfolder.ts's resolveFolder needs to walk/create that path, and its
+  // folder-create step requires a WaterButler-shaped `data.links.move` in the
+  // response (see subfolder.ts) -- without it resolveFolder throws and the
+  // raw upload gets queued instead of succeeding. The shape mirrors
+  // put-file-osf.test.js's `folderCreated` helper.
+  function handleFilesPut(req, res) {
+    const filename = String(req.query.name || "");
+
+    if (req.query.kind === "folder") {
+      const moveLink = `${req.protocol}://${req.get("host")}/folder-${nextFolderId++}/`;
+      res.status(201).json({ data: { links: { move: moveLink } } });
+      return;
+    }
 
-beforeAll(async () => {
+    createCallsByFilename.set(filename, (createCallsByFilename.get(filename) || 0) + 1);
+    const id = `mock-file-${nextId++}`;
+    res.status(201).json({ data: { id, attributes: { name: filename, kind: "file" } } });
+  }
 
-  mockServerInstance = await startServer();
+  app.get("/files", (req, res) => {
+    res.json({ data: [] });
+  });
+
+  app.get("/files/:id", (req, res) => {
+    res.json(downloadedMetadata);
+  });
+
+  app.put("/files", handleFilesPut);
+
+  app.put("/files/:id", (req, res) => {
+    const id = req.params.id;
+    updateCallsById.set(id, (updateCallsById.get(id) || 0) + 1);
+    res.status(200).json({});
+  });
+
+  // Every folder resolveFolder creates gets its own `/folder-N/` path,
+  // reused for both listing (always empty, so a multi-level path like
+  // data/raw/ always creates fresh at each level) and the next level's
+  // create/upload -- same behavior as the root /files route above.
+  app.get("/folder-:n", (req, res) => {
+    res.json({ data: [] });
+  });
+
+  app.put("/folder-:n", handleFilesPut);
+
+  return new Promise((resolve) => {
+    const server = app.listen(0, () => {
+      resolve({
+        server,
+        port: server.address().port,
+        getCreateCount: (filename) => createCallsByFilename.get(filename) || 0,
+        getUpdateCount: (id) => updateCallsById.get(id) || 0,
+        // Every scenario below creates/updates a file literally named
+        // "dataset_description.json", so counts must be reset between
+        // tests -- otherwise a later test's assertion would include
+        // creates/updates left over from an earlier one.
+        resetCounts: () => {
+          createCallsByFilename.clear();
+          updateCallsById.clear();
+        },
+      });
+    });
+  });
+}
+
+let db;
+let mockOSF;
+let filesLink;
+
+beforeAll(async () => {
+  mockOSF = await createMockOSFServer();
+  filesLink = `http://localhost:${mockOSF.port}/files/`;
 
   initializeApp(config);
-  const db = getFirestore();
+  db = getFirestore();
 
-  await db.collection("experiments").doc('metadata-testexp').set({active: true, metadataActive: true, owner: 'test-user', osfFilesLink: "http://localhost:3000/endpoint"});
-  await db.collection('users').doc('test-user').set({osfTokenValid: true, osfToken: 'valid', usingPersonalToken: true});
-  await db.collection("metadata").doc('metadata-testexp').set({});
+  await db.collection("users").doc(OWNER_ID).set({
+    osfTokenValid: true,
+    osfToken: "valid",
+    usingPersonalToken: true,
+  });
+});
+
+afterEach(() => {
+  mockOSF.resetCounts();
 });
 
 afterAll(async () => {
-  mockServerInstance.close();
-  console.log('Server closed');
+  mockOSF.server.close();
 });
 
-describe('runTransaction', () => {
+async function createExperiment(experimentID) {
+  await db.collection("experiments").doc(experimentID).set({
+    active: true,
+    metadataActive: true,
+    owner: OWNER_ID,
+    osfFilesLink: filesLink,
+  });
+}
 
-  it('should handle the case when metadata is present in OSF but not in firestore', async () => {
+describe("runTransaction", () => {
+  // Was: "should handle the case when metadata is present in OSF but not in
+  // firestore", driven by an invalid osfToken flipping mock-server.ts's fixed
+  // GET response to include a dataset_description.json entry. Now: a ref is
+  // seeded directly and no firestore `metadata` field exists, which is the
+  // same (metadataFileRef present, firestoreMetadata absent) pairing the old
+  // test intended. Newly asserted: status/success -- the old test only
+  // checked metadataMessage.
+  it("should handle the case when metadata is present in OSF but not in firestore", async () => {
+    const experimentID = `metadata-matrix1-${randomUUID()}`;
+    const refId = `ref1-${randomUUID()}`;
+    await createExperiment(experimentID);
+    await db.collection("metadata").doc(experimentID).set({
+      metadataFileRef: { id: refId, name: "dataset_description.json" },
+    });
 
     const response = await saveData({
-      experimentID: "metadata-testexp",
+      experimentID,
       data: sampleData,
-      filename: "test",
+      filename: `matrix1-${randomUUID()}.json`,
     });
 
-    expect(response.metadataMessage).toEqual(MESSAGES.METADATA_IN_OSF_NOT_IN_FIRESTORE.metadataMessage);
+    expect(response.status).toBe(201);
+    expect(response.body.metadataMessage).toEqual(MESSAGES.METADATA_IN_OSF_NOT_IN_FIRESTORE.metadataMessage);
+    expect(mockOSF.getUpdateCount(refId)).toBe(1);
   });
 
-  it('should handle the case when metadata is neither in firestore nor OSF', async () => {
-
-    const db = getFirestore();
-    await db.collection("users").doc("test-user").set({osfToken: 'invalid'}, {merge: true});
-
-    await db.collection("experiments").doc("metadata-testexp").get()
-    await db.collection("users").doc('test-user').get()
-    await db.collection("metadata").doc("metadata-testexp").get()
+  // Was: "should handle the case when metadata is neither in firestore nor
+  // OSF", driven by an invalid osfToken. Now: metadataFileRef is explicitly
+  // null (known absent -- this experiment's metadata doc was never
+  // populated) and there's no firestore `metadata` field either. Newly
+  // asserted: status/success, and that a create actually occurred.
+  it("should handle the case when metadata is neither in firestore nor OSF", async () => {
+    const experimentID = `metadata-matrix2-${randomUUID()}`;
+    await createExperiment(experimentID);
+    await db.collection("metadata").doc(experimentID).set({ metadataFileRef: null });
 
     const response = await saveData({
-      experimentID: "metadata-testexp",
+      experimentID,
       data: sampleData,
-      filename: "test",
+      filename: `matrix2-${randomUUID()}.json`,
     });
 
-    console.log(response);
-
-   // console.log(response);
-
-    expect(response.metadataMessage).toEqual(MESSAGES.METADATA_NOT_IN_FIRESTORE_OR_OSF.metadataMessage);
+    expect(response.status).toBe(201);
+    expect(response.body.metadataMessage).toEqual(MESSAGES.METADATA_NOT_IN_FIRESTORE_OR_OSF.metadataMessage);
+    expect(mockOSF.getCreateCount("dataset_description.json")).toBe(1);
   });
-  it('should handle the case when metadata is in OSF and in firestore', async () => {
-
-    const db = getFirestore();
-    await db.collection("users").doc("test-user").set({osfToken: 'valid'}, {merge: true});
-    await db.collection("metadata").doc("metadata-testexp").set({metadata: "test-metadata"}, {merge: true});
 
+  // Was: "should handle the case when metadata is in OSF and in firestore",
+  // driven by a valid osfToken. Now: a ref plus firestore `metadata` are
+  // both seeded directly. Newly asserted: status/success, and that the
+  // ref'd file (not a fresh one) received the update.
+  it("should handle the case when metadata is in OSF and in firestore", async () => {
+    const experimentID = `metadata-matrix3-${randomUUID()}`;
+    const refId = `ref3-${randomUUID()}`;
+    await createExperiment(experimentID);
+    await db.collection("metadata").doc(experimentID).set({
+      metadata: existingMetadata,
+      metadataFileRef: { id: refId, name: "dataset_description.json" },
+    });
 
-    // Call your function
     const response = await saveData({
-      experimentID: "metadata-testexp",
+      experimentID,
       data: sampleData,
-      filename: "test",
+      filename: `matrix3-${randomUUID()}.json`,
     });
 
-   // console.log(response);
-
-    expect(response.metadataMessage).toEqual(MESSAGES.METADATA_IN_OSF_AND_FIRESTORE.metadataMessage);
+    expect(response.status).toBe(201);
+    expect(response.body.metadataMessage).toEqual(MESSAGES.METADATA_IN_OSF_AND_FIRESTORE.metadataMessage);
+    expect(mockOSF.getUpdateCount(refId)).toBe(1);
   });
-  it('should handle the case when metadata is not in OSF but is in firestore', async () => {
 
-    const db = getFirestore();
-    await db.collection("users").doc("test-user").set({osfToken: 'invalid'}, {merge: true});
-    await db.collection("metadata").doc("metadata-testexp").set({metadata: "test-metadata"}, {merge: true})
+  // Was: "should handle the case when metadata is not in OSF but is in
+  // firestore", driven by an invalid osfToken. This is the scenario the
+  // now-removed `status !== 210` bug always threw on: the old mock-server.ts
+  // has no PUT route at all, so the create attempt 404'd, the buggy check
+  // threw regardless, and the request FAILED end-to-end -- invisible to the
+  // old test because it asserted only `metadataMessage`, which the catch
+  // block still populated from the already-set-before-the-throw local
+  // variable. With the bug removed and a real create route in place, this
+  // now genuinely succeeds. Newly asserted: status 201 (was silently 400)
+  // and that a create occurred.
+  it("should handle the case when metadata is not in OSF but is in firestore", async () => {
+    const experimentID = `metadata-matrix4-${randomUUID()}`;
+    await createExperiment(experimentID);
+    await db.collection("metadata").doc(experimentID).set({
+      metadata: existingMetadata,
+      metadataFileRef: null,
+    });
 
     const response = await saveData({
-      experimentID: "metadata-testexp",
+      experimentID,
       data: sampleData,
-      filename: "test",
+      filename: `matrix4-${randomUUID()}.json`,
     });
 
-   // console.log(response);
-
-    expect(response.metadataMessage).toEqual(MESSAGES.METADATA_IN_FIRESTORE_NOT_IN_OSF.metadataMessage);
+    expect(response.status).toBe(201);
+    expect(response.body.metadataMessage).toEqual(MESSAGES.METADATA_IN_FIRESTORE_NOT_IN_OSF.metadataMessage);
+    expect(mockOSF.getCreateCount("dataset_description.json")).toBe(1);
   });
-
 });
-
diff --git a/functions/src/__tests__/metadata-process.test.js b/functions/src/__tests__/metadata-process.test.js
deleted file mode 100644
index 398ff8e..0000000
--- a/functions/src/__tests__/metadata-process.test.js
+++ /dev/null
@@ -1,41 +0,0 @@
-// Import the function to test
-import processMetadata from "../../lib/metadata-process.js";
-
-// Mock the fetch function
-global.fetch = jest.fn(() =>
-  Promise.resolve({
-    json: () => Promise.resolve({ data: [{ attributes: { name: 'dataset_description.json' }, id: 'osfstorage/123' }] }),
-  })
-);
-
-describe('processMetadata', () => {
-  beforeEach(() => {
-    fetch.mockClear();
-  });
-
-  it('returns metadataId when default metadata file is found', async () => {
-    const osfComponent = 'testComponent';
-    const osfToken = 'testToken';
-
-    
-
-    const result = await processMetadata(osfComponent, osfToken);
-
-    expect(result).toEqual({ success: true, errorCode: null, errorText: null, metadataId: '123' });
-    expect(fetch).toHaveBeenCalledTimes(1);
-  });
-
-  it('returns error when metadata file is not found', async () => {
-    fetch.mockImplementationOnce(() => Promise.resolve({
-      json: () => Promise.resolve({ data: [{ attributes: { name: 'other-file.json' }, id: 'osfstorage/123' }] }),
-    }));
-
-    const osfComponent = 'testComponent';
-    const osfToken = 'testToken';
-
-    const result = await processMetadata(osfComponent, osfToken);
-
-    expect(result).toEqual({ success: false, errorCode: 404, errorText: 'Metadata file not found', metadataString: null });
-    expect(fetch).toHaveBeenCalledTimes(1);
-  });
-});
\ No newline at end of file
diff --git a/functions/src/__tests__/metadata-ref-emulator.test.js b/functions/src/__tests__/metadata-ref-emulator.test.js
new file mode 100644
index 0000000..4ffecb5
--- /dev/null
+++ b/functions/src/__tests__/metadata-ref-emulator.test.js
@@ -0,0 +1,405 @@
+/**
+ * @jest-environment node
+ */
+
+// RED-phase integration tests for step 3b (docs/provider-migration-design.md,
+// scratchpad/step3b-metadata-ref-spec.md), cases 3-8 of the test plan.
+//
+// Follows the inline-mock-OSF-server pattern established by
+// collision-integration-emulator.test.js: a self-contained express server
+// started on an OS-assigned port (`listen(0)`), with in-process (not HTTP)
+// controls for call counts and forced statuses, rather than extending the
+// shared fixed-port mock-server.ts used by metadata-emulator.test.js. That
+// server can only express a single fixed GET/PUT pair; this test plan needs
+// a controllable listing body (case 5), an update route keyed by file id
+// (cases 4/5/7), and forced statuses on specific ids (case 7's 404), none of
+// which mock-server.ts supports. mock-server.ts itself is untouched.
+//
+// Until metadata-block.ts is rewritten to read/store metadataFileRef, most
+// assertions below fail on missing/incorrect behavior -- metadataFileRef
+// never appears on the metadata doc, the 210-bug branch always throws
+// (case 6), stale refs are never retried via self-heal (case 7) -- rather
+// than on any transport-level or setup problem.
+
+import { initializeApp } from "firebase-admin/app";
+import { getFirestore } from "firebase-admin/firestore";
+import { randomUUID } from "crypto";
+import express from "express";
+
+process.env.FIRESTORE_EMULATOR_HOST = "localhost:8080";
+
+jest.setTimeout(30000);
+
+const config = { projectId: "datapipe-test" };
+const OWNER_ID = "metadata-ref-owner";
+
+const sampleData = `[{"trial_type":"html-keyboard-response","trial_index":1,"time_elapsed":776}]`;
+
+// A valid Psych-DS-shaped metadata object. metadata-update.ts's updateMetadata
+// (the real, unmocked production function) reads `variableMeasured` and
+// throws "Invalid metadata format" on anything else, so seeded firestore
+// metadata must have this shape or these tests would fail for the wrong
+// reason (an unrelated throw, not the behavior under test).
+const existingMetadata = { variableMeasured: [{ name: "existing_var" }] };
+
+async function saveData(body) {
+  const response = await fetch("http://localhost:5001/datapipe-test/us-central1/apidata", {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "*/*" },
+    body: JSON.stringify(body),
+  });
+  const message = await response.json();
+  return { status: response.status, body: message };
+}
+
+// A minimal, self-contained mock OSF "files" container:
+//   GET  /files       -> osfProvider.listFiles                 (?meta=)
+//   PUT  /files       -> osfProvider.writeSessionFile / putFileOSF (create)
+//   PUT  /files/:id   -> osfProvider.updateFile / updateFileOSF (update)
+// filesLink is handed out with a trailing slash so that update-file-osf.ts's
+// `${osfComponent}${fileId}` concatenation produces `/files/<id>` rather than
+// `/files<id>`.
+function createMockOSFServer() {
+  const app = express();
+
+  let listingContents = [];
+  let nextId = 1;
+  let nextFolderId = 1;
+  const createCallsByFilename = new Map();
+  const updateCallsById = new Map();
+  let listingCallCount = 0;
+  const forcedCreateStatus = new Map();
+  const forcedUpdateStatus = new Map();
+
+  app.get("/files", (req, res) => {
+    listingCallCount += 1;
+    res.json({ data: listingContents });
+  });
+
+  // Handles both a file create (kind=file, the pre-existing behavior) and a
+  // folder create (kind=folder). The latter is new: now that a
+  // metadata-active raw file uploads under data/raw/ (Psych-DS layout),
+  // subfolder.ts's resolveFolder needs to walk/create that path, and its
+  // folder-create step requires a WaterButler-shaped `data.links.move` in the
+  // response (see subfolder.ts) -- without it resolveFolder throws and the
+  // raw upload gets queued instead of succeeding. The shape mirrors
+  // put-file-osf.test.js's `folderCreated` helper.
+  function handleFilesPut(req, res) {
+    const filename = String(req.query.name || "");
+
+    if (req.query.kind === "folder") {
+      const moveLink = `${req.protocol}://${req.get("host")}/folder-${nextFolderId++}/`;
+      res.status(201).json({ data: { links: { move: moveLink } } });
+      return;
+    }
+
+    createCallsByFilename.set(filename, (createCallsByFilename.get(filename) || 0) + 1);
+
+    const forced = forcedCreateStatus.get(filename);
+    if (forced && forced !== 201) {
+      res.status(forced).json({ errors: [{ detail: `mock-forced-create-${forced}` }] });
+      return;
+    }
+
+    const id = `mock-file-${nextId++}`;
+    res.status(201).json({ data: { id, attributes: { name: filename, kind: "file" } } });
+  }
+
+  app.put("/files", handleFilesPut);
+
+  app.put("/files/:id", (req, res) => {
+    const id = req.params.id;
+    updateCallsById.set(id, (updateCallsById.get(id) || 0) + 1);
+
+    const forced = forcedUpdateStatus.get(id);
+    if (forced && forced !== 200) {
+      res.status(forced).json({ errors: [{ detail: `mock-forced-update-${forced}` }] });
+      return;
+    }
+
+    res.status(200).json({});
+  });
+
+  // Every folder resolveFolder creates gets its own `/folder-N/` path,
+  // reused for both listing (always empty, so a multi-level path like
+  // data/raw/ always creates fresh at each level -- deliberately NOT wired
+  // to listingCallCount, which tracks only the container-root listing used
+  // for metadata discovery/collision-cache) and the next level's
+  // create/upload, same behavior as the root /files route above.
+  app.get("/folder-:n", (req, res) => {
+    res.json({ data: [] });
+  });
+
+  app.put("/folder-:n", handleFilesPut);
+
+  return new Promise((resolve) => {
+    const server = app.listen(0, () => {
+      resolve({
+        server,
+        port: server.address().port,
+        setListing: (files) => {
+          listingContents = files;
+        },
+        getCreateCount: (filename) => createCallsByFilename.get(filename) || 0,
+        getUpdateCount: (id) => updateCallsById.get(id) || 0,
+        getTotalUpdateCount: () =>
+          Array.from(updateCallsById.values()).reduce((a, b) => a + b, 0),
+        getListingCallCount: () => listingCallCount,
+        forceCreateStatus: (filename, status) => forcedCreateStatus.set(filename, status),
+        forceUpdateStatus: (id, status) => forcedUpdateStatus.set(id, status),
+        // Clears call counters only, keeping listing contents and forced
+        // statuses -- used mid-test to isolate a "second call" assertion
+        // from setup calls that came before it (see case 4).
+        resetCounts: () => {
+          createCallsByFilename.clear();
+          updateCallsById.clear();
+          listingCallCount = 0;
+        },
+        // Full reset between tests: counters, listing contents, and forced
+        // statuses.
+        reset: () => {
+          listingContents = [];
+          createCallsByFilename.clear();
+          updateCallsById.clear();
+          listingCallCount = 0;
+          forcedCreateStatus.clear();
+          forcedUpdateStatus.clear();
+        },
+      });
+    });
+  });
+}
+
+let db;
+let mockOSF;
+let filesLink;
+
+beforeAll(async () => {
+  mockOSF = await createMockOSFServer();
+  filesLink = `http://localhost:${mockOSF.port}/files/`;
+
+  initializeApp(config);
+  db = getFirestore();
+
+  await db.collection("users").doc(OWNER_ID).set({
+    osfTokenValid: true,
+    osfToken: "valid",
+    usingPersonalToken: true,
+  });
+});
+
+afterEach(() => {
+  mockOSF.reset();
+});
+
+afterAll(async () => {
+  mockOSF.server.close();
+});
+
+async function createExperiment(experimentID, overrides = {}) {
+  await db
+    .collection("experiments")
+    .doc(experimentID)
+    .set({
+      active: true,
+      metadataActive: true,
+      owner: OWNER_ID,
+      osfFilesLink: filesLink,
+      ...overrides,
+    });
+}
+
+describe("3. first metadata-active submission (no metadata anywhere)", () => {
+  it("succeeds and stores metadata AND metadataFileRef with id + name", async () => {
+    const experimentID = `metadata-ref3-${randomUUID()}`;
+    const filename = `case3-${randomUUID()}.json`;
+    await createExperiment(experimentID);
+    // No metadata doc created at all -- firestoreMetadata and
+    // metadataFileRef are both genuinely absent.
+    mockOSF.setListing([]); // provider has no dataset_description.json either
+
+    const response = await saveData({ experimentID, data: sampleData, filename });
+
+    expect(response.status).toBe(201);
+
+    const metadataDoc = (await db.collection("metadata").doc(experimentID).get()).data();
+    expect(metadataDoc.metadata).toBeDefined();
+    expect(metadataDoc.metadataFileRef).toBeDefined();
+    expect(metadataDoc.metadataFileRef).not.toBeNull();
+    expect(typeof metadataDoc.metadataFileRef.id).toBe("string");
+    expect(metadataDoc.metadataFileRef.id.length).toBeGreaterThan(0);
+    expect(metadataDoc.metadataFileRef.name).toBe("dataset_description.json");
+
+    expect(mockOSF.getCreateCount("dataset_description.json")).toBe(1);
+  });
+});
+
+describe("4. second submission updates the existing metadata file via its stored ref", () => {
+  it("PUTs to the ref'd file id and makes no discovery listing call", async () => {
+    const experimentID = `metadata-ref4-${randomUUID()}`;
+    const existingMetaId = `preexisting-meta-${randomUUID()}`;
+    await createExperiment(experimentID);
+
+    // Pre-seed a steady-state metadata doc: metadata AND metadataFileRef
+    // already established, as if a prior submission had already created
+    // them. This isolates "second submission" behavior without depending on
+    // case 3's flow.
+    await db.collection("metadata").doc(experimentID).set({
+      metadata: existingMetadata,
+      metadataFileRef: { id: existingMetaId, name: "dataset_description.json" },
+    });
+
+    // Warm the collision cache first: this experiment's very first
+    // submission triggers collision-cache rehydration (collision-cache.ts),
+    // which calls provider.listFiles once -- a GET entirely unrelated to
+    // metadata discovery, but indistinguishable from one on the wire (same
+    // endpoint). Run it here, then reset counters, so the assertion below
+    // about "no discovery listing" isn't polluted by this unrelated GET.
+    const warmResponse = await saveData({
+      experimentID,
+      data: sampleData,
+      filename: `case4-warm-${randomUUID()}.json`,
+    });
+    expect(warmResponse.status).toBe(201);
+    mockOSF.resetCounts();
+
+    const response = await saveData({
+      experimentID,
+      data: sampleData,
+      filename: `case4-${randomUUID()}.json`,
+    });
+
+    expect(response.status).toBe(201);
+    expect(mockOSF.getUpdateCount(existingMetaId)).toBe(1);
+    expect(mockOSF.getCreateCount("dataset_description.json")).toBe(0);
+    // Not 0: the metadata subsystem itself still does no re-discovery (the
+    // ref is known, confirmed by the two assertions above -- update, not
+    // create). The two calls counted here are unrelated to metadata: the raw
+    // file's own data/raw/ folder resolution, and the derived main-data-CSV
+    // upload's own data/ folder resolution (each writeSessionFile call walks
+    // its own path independently now -- the up-front "resolve data/ once"
+    // optimization was intentionally dropped when uploads were generalized
+    // behind the provider interface), each hitting the same container-root
+    // listing endpoint metadata discovery would also use.
+    expect(mockOSF.getListingCallCount()).toBe(2);
+  });
+});
+
+describe("5. legacy discovery: metadata doc has metadata but no metadataFileRef field", () => {
+  it("finds the existing dataset_description.json via listing, updates it (not create), and stores the discovered ref", async () => {
+    const experimentID = `metadata-ref5-${randomUUID()}`;
+    const legacyId = `legacy-meta-${randomUUID()}`;
+    await createExperiment(experimentID);
+
+    // Pre-seed metadata WITHOUT a metadataFileRef field at all -- distinct
+    // from explicit null (case 6). This is the shape a pre-migration,
+    // still-active legacy experiment would have.
+    await db.collection("metadata").doc(experimentID).set({ metadata: existingMetadata });
+
+    mockOSF.setListing([
+      { attributes: { name: "dataset_description.json", kind: "file" }, id: legacyId },
+      { attributes: { name: "some-session-data.json", kind: "file" }, id: `${legacyId}-other` },
+    ]);
+
+    const response = await saveData({
+      experimentID,
+      data: sampleData,
+      filename: `case5-${randomUUID()}.json`,
+    });
+
+    expect(response.status).toBe(201);
+    expect(mockOSF.getUpdateCount(legacyId)).toBe(1);
+    expect(mockOSF.getCreateCount("dataset_description.json")).toBe(0);
+
+    const metadataDoc = (await db.collection("metadata").doc(experimentID).get()).data();
+    expect(metadataDoc.metadataFileRef).toEqual({ id: legacyId, name: "dataset_description.json" });
+  });
+});
+
+describe("6. 210-bug resurrection: metadataFileRef explicitly null, no metadata file on the provider", () => {
+  it("creates the metadata file and succeeds (previously always failed with METADATA_ERROR)", async () => {
+    const experimentID = `metadata-ref6-${randomUUID()}`;
+    await createExperiment(experimentID);
+
+    // metadataFileRef is explicitly null here -- distinct from case 5's
+    // "field absent" -- meaning "we already looked, it's known absent;
+    // don't list again."
+    await db.collection("metadata").doc(experimentID).set({
+      metadata: existingMetadata,
+      metadataFileRef: null,
+    });
+
+    mockOSF.setListing([]); // provider genuinely has no metadata file
+
+    const response = await saveData({
+      experimentID,
+      data: sampleData,
+      filename: `case6-${randomUUID()}.json`,
+    });
+
+    // Today, this always fails: metadata-block.ts's create branch checks
+    // `status !== 210` on a response that never returns 210, so it throws
+    // MESSAGES.OSF_UPLOAD_ERROR unconditionally, even though the upload
+    // itself succeeded.
+    expect(response.status).toBe(201);
+
+    expect(mockOSF.getCreateCount("dataset_description.json")).toBe(1);
+
+    const metadataDoc = (await db.collection("metadata").doc(experimentID).get()).data();
+    expect(metadataDoc.metadataFileRef).toBeDefined();
+    expect(metadataDoc.metadataFileRef).not.toBeNull();
+    expect(metadataDoc.metadataFileRef.name).toBe("dataset_description.json");
+  });
+});
+
+describe("7. self-heal: stored ref points at a file the mock 404s on update", () => {
+  it("creates a fresh metadata file and stores the new ref without failing the request", async () => {
+    const experimentID = `metadata-ref7-${randomUUID()}`;
+    const staleId = `stale-meta-${randomUUID()}`;
+    await createExperiment(experimentID);
+
+    await db.collection("metadata").doc(experimentID).set({
+      metadata: existingMetadata,
+      metadataFileRef: { id: staleId, name: "dataset_description.json" },
+    });
+
+    mockOSF.forceUpdateStatus(staleId, 404); // provider-side file was deleted
+
+    const response = await saveData({
+      experimentID,
+      data: sampleData,
+      filename: `case7-${randomUUID()}.json`,
+    });
+
+    expect(response.status).toBe(201);
+    expect(mockOSF.getUpdateCount(staleId)).toBe(1); // the failed update attempt
+    expect(mockOSF.getCreateCount("dataset_description.json")).toBe(1); // the self-heal create
+
+    const metadataDoc = (await db.collection("metadata").doc(experimentID).get()).data();
+    expect(metadataDoc.metadataFileRef).toBeDefined();
+    expect(metadataDoc.metadataFileRef.id).not.toBe(staleId);
+    expect(metadataDoc.metadataFileRef.name).toBe("dataset_description.json");
+  });
+});
+
+describe("8. skip-metadata behavior (metadataActive false) is unchanged", () => {
+  it("does not create a metadata document or a metadataFileRef when metadataActive is false", async () => {
+    const experimentID = `metadata-ref8-${randomUUID()}`;
+    await createExperiment(experimentID, { metadataActive: false });
+
+    const response = await saveData({
+      experimentID,
+      data: sampleData,
+      filename: `case8-${randomUUID()}.json`,
+    });
+
+    expect(response.status).toBe(201);
+    expect(response.body.metadataMessage).toBeFalsy();
+
+    const metadataDoc = await db.collection("metadata").doc(experimentID).get();
+    expect(metadataDoc.exists).toBe(false);
+
+    expect(mockOSF.getCreateCount("dataset_description.json")).toBe(0);
+    expect(mockOSF.getTotalUpdateCount()).toBe(0);
+  });
+});
diff --git a/functions/src/__tests__/oauth-connect-emulator.test.js b/functions/src/__tests__/oauth-connect-emulator.test.js
new file mode 100644
index 0000000..fc8128d
--- /dev/null
+++ b/functions/src/__tests__/oauth-connect-emulator.test.js
@@ -0,0 +1,507 @@
+/**
+ * @jest-environment node
+ */
+
+// RED-phase tests for step 4b (docs/provider-migration-design.md,
+// scratchpad/step4b-oauth-connect-spec.md), cases 1-9 of the test plan.
+//
+// generateOAuthState (generate-oauth-state.ts) exists today but only knows
+// the legacy, provider-less OSF flow -- it ignores any `provider` field in
+// the POST body entirely, so case 1 (no provider) is a regression guard
+// expected to PASS today, while cases 2-3 (provider handling, unknown-
+// provider validation) fail red because that branch doesn't exist yet.
+//
+// connectProvider and disconnectProvider (functions/src/connect-provider.ts,
+// exported as connectprovider/disconnectprovider per index.ts's lowercase
+// export convention -- see apiData -> apidata) do not exist at all yet, so
+// every request to their emulator URLs 404s. Cases 4-9 are all red for that
+// reason; none of the validation/persistence logic described in the spec
+// exists to exercise yet. Where a case's setup depends on case 2's
+// (not-yet-existing) provider-aware generateOAuthState -- e.g. case 4's
+// "state from (2)" -- this file still calls the real endpoint the way the
+// finished feature is meant to be exercised; today that just means the
+// created state doc won't carry `provider: "gdrive"` yet, which is
+// irrelevant since connectProvider 404s long before it would read that
+// field anyway.
+//
+// Real Auth-emulator idTokens: the Auth emulator's accounts:signUp REST
+// endpoint (http://localhost:9099/identitytoolkit.googleapis.com/v1/
+// accounts:signUp?key=fake) returns a real idToken + localId for any
+// email/password; localId is used as the uid so connectProvider's (future)
+// auth.verifyIdToken(idToken) check matches -- there is no other way to get
+// a verifiable idToken against the emulator's Auth backend.
+//
+// Mock OAuth token server: a fixed port (3580, this file only -- see
+// functions/.env.datapipe-test) express server standing in for Google's
+// token endpoint. Fixed, not listen(0), for the same reason as
+// gdrive-emulator.test.js's mock Drive server: the emulator-hosted
+// connectProvider function has no other way to discover where the mock
+// lives, since GDRIVE_TOKEN_URL is read from the Functions emulator's own
+// env, not passed at request time. Port 3579 (also fixed) is reserved for
+// gdrive-emulator.test.js's mock Drive API and is never touched here.
+//
+// TOKEN_ENCRYPTION_KEY: this file's process sets the SAME fixed 64-hex value
+// baked into functions/.env.datapipe-test so the Firestore-persisted
+// encryptedToken -- written by the separate Functions-emulator process --
+// can be decrypted and verified here.
+
+import { initializeApp, getApp } from "firebase-admin/app";
+import { getFirestore } from "firebase-admin/firestore";
+import { randomUUID } from "crypto";
+import express from "express";
+
+process.env.FIRESTORE_EMULATOR_HOST = "localhost:8080";
+jest.setTimeout(30000);
+
+const config = { projectId: "datapipe-test" };
+
+// Must match functions/.env.datapipe-test exactly.
+const TOKEN_ENCRYPTION_KEY = "ab".repeat(32);
+const GDRIVE_AUTHORIZE_URL = "http://127.0.0.1:3580/authorize";
+const GDRIVE_CLIENT_ID = "test-client-id";
+const GDRIVE_REDIRECT_URI = "http://localhost:3000/oauth2/connect";
+const GDRIVE_SCOPE = "https://www.googleapis.com/auth/drive.file";
+const TOKEN_PORT = 3580;
+
+const FUNCTIONS_BASE = "http://localhost:5001/datapipe-test/us-central1";
+const AUTH_EMULATOR_SIGNUP_URL =
+  "http://localhost:9099/identitytoolkit.googleapis.com/v1/accounts:signUp?key=fake";
+
+let db;
+let mockTokenServer;
+let decrypt;
+
+beforeAll(async () => {
+  process.env.TOKEN_ENCRYPTION_KEY = TOKEN_ENCRYPTION_KEY;
+  ({ decrypt } = await import("../../lib/crypto-utils.js"));
+
+  let app;
+  try {
+    app = getApp("oauth-connect-test");
+  } catch {
+    app = initializeApp(config, "oauth-connect-test");
+  }
+  db = getFirestore(app);
+
+  mockTokenServer = await createMockTokenServer();
+});
+
+afterEach(() => {
+  mockTokenServer.reset();
+});
+
+afterAll(() => {
+  mockTokenServer.server.close();
+});
+
+// ---- helpers ----
+
+// A minimal stand-in for Google's token endpoint: records every received
+// form-encoded body and returns a configurable response. Defaults to a
+// happy-path grant so tests that don't care about the exchange details
+// (e.g. auth-failure cases, which never reach the exchange) don't need to
+// configure it.
+function createMockTokenServer() {
+  const app = express();
+  app.use(express.urlencoded({ extended: false }));
+
+  function defaultResponse() {
+    return {
+      status: 200,
+      body: {
+        access_token: "mock-access-token",
+        refresh_token: "mock-refresh-token",
+        expires_in: 3600,
+      },
+    };
+  }
+
+  let nextResponse = defaultResponse();
+  const receivedRequests = [];
+
+  app.post("/token", (req, res) => {
+    receivedRequests.push({ ...req.body });
+    res.status(nextResponse.status).json(nextResponse.body);
+  });
+
+  return new Promise((resolve) => {
+    const server = app.listen(TOKEN_PORT, () => {
+      resolve({
+        server,
+        setNextResponse(status, body) {
+          nextResponse = { status, body };
+        },
+        getLastRequest() {
+          return receivedRequests[receivedRequests.length - 1];
+        },
+        reset() {
+          receivedRequests.length = 0;
+          nextResponse = defaultResponse();
+        },
+      });
+    });
+  });
+}
+
+async function signUpEmulatorUser() {
+  const email = `oauth-connect-${randomUUID()}@example.test`;
+  const res = await fetch(AUTH_EMULATOR_SIGNUP_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ email, password: "Password123!", returnSecureToken: true }),
+  });
+  const body = await res.json();
+  if (!res.ok) {
+    throw new Error(`Auth emulator signUp failed (${res.status}): ${JSON.stringify(body)}`);
+  }
+  return { uid: body.localId, idToken: body.idToken };
+}
+
+async function generateState(provider) {
+  const res = await fetch(`${FUNCTIONS_BASE}/generateoauthstate`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(provider ? { provider } : {}),
+  });
+  const body = await res.json();
+  return { status: res.status, body };
+}
+
+async function createStateDoc(overrides = {}) {
+  const state = randomUUID();
+  await db.collection("oauth_states").doc(state).set({
+    createdAt: Date.now(),
+    expiresAt: Date.now() + 10 * 60 * 1000,
+    provider: "gdrive",
+    ...overrides,
+  });
+  return state;
+}
+
+async function getStateDoc(state) {
+  return db.collection("oauth_states").doc(state).get();
+}
+
+async function getUserData(uid) {
+  const snap = await db.collection("users").doc(uid).get();
+  return snap.data();
+}
+
+async function postJson(url, payload) {
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(payload),
+  });
+  const text = await res.text();
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    body = { rawBody: text };
+  }
+  return { status: res.status, body };
+}
+
+function callConnectProvider(payload) {
+  return postJson(`${FUNCTIONS_BASE}/connectprovider`, payload);
+}
+
+function callDisconnectProvider(payload) {
+  return postJson(`${FUNCTIONS_BASE}/disconnectprovider`, payload);
+}
+
+// ---- cases ----
+
+describe("1. generateOAuthState without provider (regression guard)", () => {
+  it("returns { state } only, with no authorizeUrl, and the state doc has no provider field -- expected to PASS today", async () => {
+    const { status, body } = await generateState();
+
+    expect(status).toBe(200);
+    expect(typeof body.state).toBe("string");
+    expect(body.authorizeUrl).toBeUndefined();
+    expect(Object.keys(body).sort()).toEqual(["state"]);
+
+    const stateDoc = await getStateDoc(body.state);
+    expect(stateDoc.exists).toBe(true);
+    expect(stateDoc.data().provider).toBeUndefined();
+  });
+});
+
+describe("2. generateOAuthState with provider gdrive", () => {
+  it("returns { state, authorizeUrl } with the correct query params, and records provider on the state doc", async () => {
+    const { status, body } = await generateState("gdrive");
+
+    expect(status).toBe(200);
+    expect(typeof body.state).toBe("string");
+    expect(typeof body.authorizeUrl).toBe("string");
+
+    const url = new URL(body.authorizeUrl);
+    expect(`${url.origin}${url.pathname}`).toBe(GDRIVE_AUTHORIZE_URL);
+    expect(url.searchParams.get("client_id")).toBe(GDRIVE_CLIENT_ID);
+    expect(url.searchParams.get("redirect_uri")).toBe(GDRIVE_REDIRECT_URI);
+    expect(url.searchParams.get("response_type")).toBe("code");
+    expect(url.searchParams.get("scope")).toBe(GDRIVE_SCOPE);
+    expect(url.searchParams.get("state")).toBe(body.state);
+    expect(url.searchParams.get("access_type")).toBe("offline");
+    expect(url.searchParams.get("prompt")).toBe("consent");
+
+    const stateDoc = await getStateDoc(body.state);
+    expect(stateDoc.data().provider).toBe("gdrive");
+  });
+});
+
+describe("3. generateOAuthState with unknown provider", () => {
+  it("returns 400", async () => {
+    const { status } = await generateState("not-a-real-provider");
+    expect(status).toBe(400);
+  });
+});
+
+describe("4. connectProvider happy path", () => {
+  it("exchanges the code, persists an encrypted gdrive connection, and deletes the state (single-use)", async () => {
+    const { uid, idToken } = await signUpEmulatorUser();
+    const { body: stateBody } = await generateState("gdrive");
+    const state = stateBody.state;
+
+    mockTokenServer.setNextResponse(200, {
+      access_token: "case4-access-token",
+      refresh_token: "case4-refresh-token",
+      expires_in: 3600,
+    });
+
+    const before = Date.now();
+    const { status, body } = await callConnectProvider({
+      provider: "gdrive",
+      code: "case4-auth-code",
+      state,
+      uid,
+      idToken,
+    });
+    const after = Date.now();
+
+    expect(status).toBe(200);
+    expect(body).toEqual({ success: true, provider: "gdrive" });
+
+    const userData = await getUserData(uid);
+    const gdrive = userData.connectedAccounts.gdrive;
+    expect(gdrive.authMethod).toBe("oauth2");
+    expect(gdrive.encryptedToken.startsWith("v1:")).toBe(true);
+    expect(decrypt(gdrive.encryptedToken)).toBe("case4-access-token");
+    expect(gdrive.tokenExpiresAt).toBeGreaterThanOrEqual(before + 3600 * 1000 - 5000);
+    expect(gdrive.tokenExpiresAt).toBeLessThanOrEqual(after + 3600 * 1000 + 5000);
+
+    const lastRequest = mockTokenServer.getLastRequest();
+    expect(lastRequest.grant_type).toBe("authorization_code");
+    expect(lastRequest.code).toBe("case4-auth-code");
+    expect(lastRequest.client_id).toBe(GDRIVE_CLIENT_ID);
+    expect(lastRequest.redirect_uri).toBe(GDRIVE_REDIRECT_URI);
+    expect(typeof lastRequest.client_secret).toBe("string");
+    expect(lastRequest.client_secret.length).toBeGreaterThan(0);
+
+    const stateDoc = await getStateDoc(state);
+    expect(stateDoc.exists).toBe(false);
+  });
+});
+
+describe("5. connectProvider state validation", () => {
+  it("rejects a state issued without a provider (legacy OSF state) as a provider mismatch", async () => {
+    const { uid, idToken } = await signUpEmulatorUser();
+    const { body: legacyStateBody } = await generateState(); // no provider -- legacy OSF state
+
+    const { status } = await callConnectProvider({
+      provider: "gdrive",
+      code: "case5-mismatch-code",
+      state: legacyStateBody.state,
+      uid,
+      idToken,
+    });
+
+    expect(status).toBe(400);
+  });
+
+  it("rejects a reused (already-consumed) state", async () => {
+    const { uid, idToken } = await signUpEmulatorUser();
+    const state = await createStateDoc();
+    await db.collection("oauth_states").doc(state).delete(); // simulate prior consumption
+
+    const { status } = await callConnectProvider({
+      provider: "gdrive",
+      code: "case5-reused-code",
+      state,
+      uid,
+      idToken,
+    });
+
+    expect(status).toBe(400);
+  });
+
+  it("rejects an expired state", async () => {
+    const { uid, idToken } = await signUpEmulatorUser();
+    const state = await createStateDoc({ expiresAt: Date.now() - 1000 });
+
+    const { status } = await callConnectProvider({
+      provider: "gdrive",
+      code: "case5-expired-code",
+      state,
+      uid,
+      idToken,
+    });
+
+    expect(status).toBe(400);
+  });
+});
+
+describe("6. connectProvider auth failures", () => {
+  it("returns 401 when idToken is missing, and persists nothing", async () => {
+    const { uid } = await signUpEmulatorUser();
+    const state = await createStateDoc();
+
+    const { status } = await callConnectProvider({
+      provider: "gdrive",
+      code: "case6-missing-idtoken",
+      state,
+      uid,
+    });
+
+    expect(status).toBe(401);
+    const userData = await getUserData(uid);
+    expect(userData?.connectedAccounts?.gdrive).toBeUndefined();
+  });
+
+  it("returns 403 when idToken belongs to a different emulator user than uid, and persists nothing", async () => {
+    const userA = await signUpEmulatorUser();
+    const userB = await signUpEmulatorUser();
+    const state = await createStateDoc();
+
+    const { status } = await callConnectProvider({
+      provider: "gdrive",
+      code: "case6-mismatched-user",
+      state,
+      uid: userA.uid,
+      idToken: userB.idToken,
+    });
+
+    expect(status).toBe(403);
+    const userAData = await getUserData(userA.uid);
+    expect(userAData?.connectedAccounts?.gdrive).toBeUndefined();
+  });
+});
+
+describe("7. token exchange without a refresh_token", () => {
+  it("returns 400 and persists nothing (half-connected-account guard)", async () => {
+    const { uid, idToken } = await signUpEmulatorUser();
+    const state = await createStateDoc();
+
+    mockTokenServer.setNextResponse(200, {
+      access_token: "case7-access-token",
+      expires_in: 3600,
+      // no refresh_token -- Google only issues one with access_type=offline&prompt=consent
+    });
+
+    const { status, body } = await callConnectProvider({
+      provider: "gdrive",
+      code: "case7-no-refresh-code",
+      state,
+      uid,
+      idToken,
+    });
+
+    expect(status).toBe(400);
+    expect(body.error).toBe("Token exchange failed");
+
+    const userData = await getUserData(uid);
+    expect(userData?.connectedAccounts?.gdrive).toBeUndefined();
+  });
+});
+
+describe("8. connectProvider does not clobber sibling providers", () => {
+  it("leaves a pre-existing connectedAccounts.dataverse entry intact after connecting gdrive", async () => {
+    const { uid, idToken } = await signUpEmulatorUser();
+    const dataverseEntry = {
+      authMethod: "static-token",
+      encryptedToken: "dataverse-token-placeholder",
+      serverUrl: "https://demo.dataverse.org",
+    };
+    await db
+      .collection("users")
+      .doc(uid)
+      .set({ connectedAccounts: { dataverse: dataverseEntry } }, { merge: true });
+
+    const { body: stateBody } = await generateState("gdrive");
+    mockTokenServer.setNextResponse(200, {
+      access_token: "case8-access-token",
+      refresh_token: "case8-refresh-token",
+      expires_in: 3600,
+    });
+
+    const { status } = await callConnectProvider({
+      provider: "gdrive",
+      code: "case8-code",
+      state: stateBody.state,
+      uid,
+      idToken,
+    });
+
+    expect(status).toBe(200);
+    const userData = await getUserData(uid);
+    expect(userData.connectedAccounts.dataverse).toEqual(dataverseEntry);
+    expect(userData.connectedAccounts.gdrive).toBeDefined();
+  });
+});
+
+describe("9. disconnectProvider", () => {
+  it("removes connectedAccounts.gdrive while leaving siblings intact", async () => {
+    const { uid, idToken } = await signUpEmulatorUser();
+    const dataverseEntry = {
+      authMethod: "static-token",
+      encryptedToken: "dataverse-token-placeholder-9",
+      serverUrl: "https://demo.dataverse.org",
+    };
+    await db
+      .collection("users")
+      .doc(uid)
+      .set({
+        connectedAccounts: {
+          gdrive: {
+            authMethod: "oauth2",
+            encryptedToken: "pre-existing-gdrive-token",
+            encryptedRefreshToken: "pre-existing-gdrive-refresh",
+            tokenExpiresAt: Date.now() + 60 * 60 * 1000,
+          },
+          dataverse: dataverseEntry,
+        },
+      });
+
+    const { status, body } = await callDisconnectProvider({ provider: "gdrive", uid, idToken });
+
+    expect(status).toBe(200);
+    expect(body).toEqual({ success: true });
+
+    const userData = await getUserData(uid);
+    expect(userData.connectedAccounts.gdrive).toBeUndefined();
+    expect(userData.connectedAccounts.dataverse).toEqual(dataverseEntry);
+  });
+
+  it("returns 403 for a wrong-user idToken and leaves the entry untouched", async () => {
+    const userA = await signUpEmulatorUser();
+    const userB = await signUpEmulatorUser();
+    const gdriveEntry = {
+      authMethod: "oauth2",
+      encryptedToken: "userA-gdrive-token",
+      encryptedRefreshToken: "userA-gdrive-refresh",
+      tokenExpiresAt: Date.now() + 60 * 60 * 1000,
+    };
+    await db.collection("users").doc(userA.uid).set({ connectedAccounts: { gdrive: gdriveEntry } });
+
+    const { status } = await callDisconnectProvider({
+      provider: "gdrive",
+      uid: userA.uid,
+      idToken: userB.idToken,
+    });
+
+    expect(status).toBe(403);
+    const userAData = await getUserData(userA.uid);
+    expect(userAData.connectedAccounts.gdrive).toEqual(gdriveEntry);
+  });
+});
diff --git a/functions/src/__tests__/oauth-connect-refresh-emulator.test.js b/functions/src/__tests__/oauth-connect-refresh-emulator.test.js
new file mode 100644
index 0000000..bee1eed
--- /dev/null
+++ b/functions/src/__tests__/oauth-connect-refresh-emulator.test.js
@@ -0,0 +1,191 @@
+/**
+ * @jest-environment node
+ */
+
+// RED-phase test for step 4b (scratchpad/step4b-oauth-connect-spec.md), case
+// 10 of the test plan.
+//
+// refreshExpiringGdriveTokens does not exist yet -- the spec calls for it to
+// be extracted out of scheduled-token-refresh.ts (which today only knows the
+// OSF refresh pass) as a new exported helper, sharing its actual refresh
+// logic with resolve-token.ts via a shared providers/gdrive-oauth.ts module.
+// Importing a named export that the compiled module doesn't provide fails at
+// ESM module-evaluation time ("does not provide an export named
+// 'refreshExpiringGdriveTokens'"), which fails EVERY test in whatever file
+// performs the import -- so this case lives in its own file, per the
+// build-step instructions, to keep that red from masking the
+// connectProvider/disconnectProvider/generateOAuthState cases in
+// oauth-connect-emulator.test.js or the OSF regression guard in
+// oauth-connect-scheduled-regression.test.js.
+//
+// This test never touches port 3580 (the mock token server used by the
+// connectProvider tests): it mocks global.fetch directly, in-process, the
+// same way resolve-token-gdrive.test.js's cases 9-10 do for resolveToken's
+// gdrive refresh path. TOKEN_ENCRYPTION_KEY/GDRIVE_* env vars here are
+// scoped to this jest process only and don't need to match
+// functions/.env.datapipe-test (which is loaded by the separate Functions-
+// emulator process for the HTTP-endpoint tests).
+
+import { initializeApp, getApp } from "firebase-admin/app";
+import { getFirestore } from "firebase-admin/firestore";
+import { randomUUID } from "crypto";
+import { refreshExpiringGdriveTokens } from "../../lib/scheduled-token-refresh.js";
+import { decrypt } from "../../lib/crypto-utils.js";
+
+process.env.FIRESTORE_EMULATOR_HOST = "localhost:8080";
+jest.setTimeout(30000);
+
+const config = { projectId: "datapipe-test" };
+
+let db;
+const ORIGINAL_FETCH = global.fetch;
+const ORIGINAL_ENV = {
+  TOKEN_ENCRYPTION_KEY: process.env.TOKEN_ENCRYPTION_KEY,
+  GDRIVE_TOKEN_URL: process.env.GDRIVE_TOKEN_URL,
+  GDRIVE_CLIENT_ID: process.env.GDRIVE_CLIENT_ID,
+  GDRIVE_CLIENT_SECRET: process.env.GDRIVE_CLIENT_SECRET,
+};
+
+beforeAll(async () => {
+  let app;
+  try {
+    app = getApp("oauth-connect-refresh-test");
+  } catch {
+    app = initializeApp(config, "oauth-connect-refresh-test");
+  }
+  db = getFirestore(app);
+
+  // Scoped to this process only -- mirrors resolve-token-gdrive.test.js.
+  process.env.TOKEN_ENCRYPTION_KEY = "22".repeat(32);
+  process.env.GDRIVE_TOKEN_URL = "https://gdrive-token.mock.test/token";
+  process.env.GDRIVE_CLIENT_ID = "test-gdrive-client-id-refresh";
+  process.env.GDRIVE_CLIENT_SECRET = "test-gdrive-client-secret-refresh";
+});
+
+afterAll(() => {
+  process.env.TOKEN_ENCRYPTION_KEY = ORIGINAL_ENV.TOKEN_ENCRYPTION_KEY;
+  process.env.GDRIVE_TOKEN_URL = ORIGINAL_ENV.GDRIVE_TOKEN_URL;
+  process.env.GDRIVE_CLIENT_ID = ORIGINAL_ENV.GDRIVE_CLIENT_ID;
+  process.env.GDRIVE_CLIENT_SECRET = ORIGINAL_ENV.GDRIVE_CLIENT_SECRET;
+  global.fetch = ORIGINAL_FETCH;
+});
+
+// The helper legitimately scans the ENTIRE users collection, and the
+// Firestore emulator is shared across parallel jest workers — other suites
+// (resolve-token-gdrive, gdrive-emulator, oauth-connect) seed their own
+// gdrive users, some deliberately expired, which this helper WILL pick up
+// mid-run. Two isolation rules follow:
+//   1. Never assert on global fetch call counts — only on calls carrying
+//      THIS test's (unique) refresh token.
+//   2. The fetch mock must answer foreign refresh tokens with a failure —
+//      the helper's failure path leaves the user untouched, so we can't
+//      corrupt another suite's seeded tokens.
+function installDiscriminatingFetchMock(ownToken, ownResponse) {
+  global.fetch = jest.fn(async (_url, options) => {
+    const params = new URLSearchParams(options?.body);
+    if (params.get("refresh_token") === ownToken) {
+      return ownResponse;
+    }
+    return { ok: false, status: 400, text: () => Promise.resolve("foreign-token-rejected") };
+  });
+}
+
+function callsForToken(token) {
+  return global.fetch.mock.calls.filter(([, options]) => {
+    const params = new URLSearchParams(options?.body);
+    return params.get("refresh_token") === token;
+  });
+}
+
+const WINDOW_MS = 10 * 60 * 1000; // matches the spec's default window
+
+async function createGdriveUser(uid, overrides = {}) {
+  const gdrive = {
+    authMethod: "oauth2",
+    encryptedToken: "plain-access-token",
+    encryptedRefreshToken: "plain-refresh-token",
+    tokenExpiresAt: Date.now() + 60 * 60 * 1000,
+    ...overrides,
+  };
+  await db.collection("users").doc(uid).set({ connectedAccounts: { gdrive } });
+  return gdrive;
+}
+
+async function getUserData(uid) {
+  const snap = await db.collection("users").doc(uid).get();
+  return snap.data();
+}
+
+describe("10. refreshExpiringGdriveTokens", () => {
+  it("refreshes and persists a new encrypted token for a user inside the window", async () => {
+    const uid = `refresh-window-${randomUUID()}`;
+    const ownRefreshToken = `own-refresh-${randomUUID()}`;
+    await createGdriveUser(uid, {
+      tokenExpiresAt: Date.now() + 2 * 60 * 1000,
+      encryptedRefreshToken: ownRefreshToken,
+    });
+
+    installDiscriminatingFetchMock(ownRefreshToken, {
+      ok: true,
+      json: () =>
+        Promise.resolve({
+          access_token: "refreshed-token",
+          expires_in: 3600,
+          refresh_token: "refreshed-refresh-token",
+        }),
+    });
+
+    const before = Date.now();
+    await refreshExpiringGdriveTokens(WINDOW_MS);
+    const after = Date.now();
+
+    expect(callsForToken(ownRefreshToken)).toHaveLength(1);
+    const persisted = await getUserData(uid);
+    const gdrive = persisted.connectedAccounts.gdrive;
+    expect(decrypt(gdrive.encryptedToken)).toBe("refreshed-token");
+    expect(decrypt(gdrive.encryptedRefreshToken)).toBe("refreshed-refresh-token");
+    expect(gdrive.tokenExpiresAt).toBeGreaterThanOrEqual(before + 3600 * 1000 - 5000);
+    expect(gdrive.tokenExpiresAt).toBeLessThanOrEqual(after + 3600 * 1000 + 5000);
+  });
+
+  it("leaves a user outside the window untouched and never calls fetch for them", async () => {
+    const uid = `refresh-outside-${randomUUID()}`;
+    const ownRefreshToken = `outside-refresh-${randomUUID()}`;
+    const original = await createGdriveUser(uid, {
+      tokenExpiresAt: Date.now() + 60 * 60 * 1000,
+      encryptedRefreshToken: ownRefreshToken,
+    });
+
+    installDiscriminatingFetchMock(ownRefreshToken, {
+      ok: true,
+      json: () => Promise.resolve({ access_token: "should-never-be-used", expires_in: 3600 }),
+    });
+
+    await refreshExpiringGdriveTokens(WINDOW_MS);
+
+    expect(callsForToken(ownRefreshToken)).toHaveLength(0);
+    const persisted = await getUserData(uid);
+    expect(persisted.connectedAccounts.gdrive).toEqual(original);
+  });
+
+  it("leaves the connection as-was and does not throw when the refresh request fails", async () => {
+    const uid = `refresh-fail-${randomUUID()}`;
+    const ownRefreshToken = `fail-refresh-${randomUUID()}`;
+    const original = await createGdriveUser(uid, {
+      tokenExpiresAt: Date.now() + 2 * 60 * 1000,
+      encryptedRefreshToken: ownRefreshToken,
+    });
+
+    installDiscriminatingFetchMock(ownRefreshToken, {
+      ok: false,
+      status: 400,
+      text: () => Promise.resolve("invalid_grant"),
+    });
+
+    await expect(refreshExpiringGdriveTokens(WINDOW_MS)).resolves.not.toThrow();
+
+    expect(callsForToken(ownRefreshToken)).toHaveLength(1);
+    const persisted = await getUserData(uid);
+    expect(persisted.connectedAccounts.gdrive).toEqual(original);
+  });
+});
diff --git a/functions/src/__tests__/oauth-connect-scheduled-regression.test.js b/functions/src/__tests__/oauth-connect-scheduled-regression.test.js
new file mode 100644
index 0000000..06c9502
--- /dev/null
+++ b/functions/src/__tests__/oauth-connect-scheduled-regression.test.js
@@ -0,0 +1,90 @@
+/**
+ * @jest-environment node
+ */
+
+// RED-phase regression guard for step 4b (scratchpad/step4b-oauth-connect-
+// spec.md), case 11 of the test plan.
+//
+// scheduledTokenRefresh (scheduled-token-refresh.ts) is an onSchedule
+// function. The Functions emulator exposes scheduled functions for manual
+// invocation over HTTP at the same host:port/project/region/name URL as any
+// other function (the Local Emulator Suite's documented manual-trigger
+// support for onSchedule functions). This test pins its EXISTING,
+// OSF-only observable behavior for one user, so that case 10's gdrive
+// generalization -- which the spec requires to wrap the new gdrive pass so
+// a gdrive failure "can't break the OSF pass" -- cannot silently change it.
+//
+// It is kept in its own file (not sharing oauth-connect-refresh-emulator.
+// test.js) precisely because that file imports a not-yet-existing named
+// export and fails at module load, which would fail every test in the file
+// -- this regression guard needs to run and report its own, independent
+// result.
+//
+// IMPORTANT deviation from a literal reading of the spec: NEXT_PUBLIC_OSF_ENV
+// is "" (not unset) in functions/.env (loaded ahead of .env.datapipe-test,
+// which doesn't override it), so refresh-token.ts's hardcoded token URL
+// resolves to the REAL "https://accounts.osf.io/oauth2/token" -- and .env
+// also carries real-looking CLIENT_ID/CLIENT_SECRET values. Empirically
+// invoking the scheduled function against a seeded user whose refresh token
+// is due for refresh made a genuine network call to production OSF (it
+// returned {"error":"invalid_request"} for the bogus refresh token). Doing
+// that from a repeatable test/CI run is exactly the kind of non-hermetic,
+// production-touching side effect this suite should avoid -- there is no
+// GDRIVE_TOKEN_URL-style override for OSF's endpoint to redirect it to a
+// local mock. So instead of pinning the live-refresh branch, this test pins
+// the query + per-user-skip behavior that scheduled-token-refresh.ts already
+// has for a user with no refreshToken (see its "if (!userData.refreshToken)
+// ... continue" branch): the user still matches the query but is skipped
+// before any network call happens, which is fully safe to exercise here.
+// The live-refresh branch itself could not be safely pinned without hitting
+// production OSF -- flagged in the build-step report rather than forced.
+
+import { initializeApp, getApp } from "firebase-admin/app";
+import { getFirestore } from "firebase-admin/firestore";
+import { randomUUID } from "crypto";
+
+process.env.FIRESTORE_EMULATOR_HOST = "localhost:8080";
+jest.setTimeout(30000);
+
+const config = { projectId: "datapipe-test" };
+// Verified empirically against this repo's firebase-tools (15.8.0): since
+// firebase.json's emulator suite doesn't include the Pub/Sub emulator,
+// onSchedule functions are registered for manual HTTP invocation under a
+// "-<index>" suffixed trigger name (the emulator logs "function ignored
+// because the pubsub emulator does not exist or is not running" for the
+// bare name, but still lists "...-0" as a valid HTTP target and executes it
+// normally when POSTed). The bare, unsuffixed name 404s.
+const SCHEDULED_URL = "http://localhost:5001/datapipe-test/us-central1/scheduledtokenrefresh-0";
+
+let db;
+
+beforeAll(async () => {
+  let app;
+  try {
+    app = getApp("oauth-connect-scheduled-regression-test");
+  } catch {
+    app = initializeApp(config, "oauth-connect-scheduled-regression-test");
+  }
+  db = getFirestore(app);
+});
+
+describe("11. OSF scheduled pass (regression guard)", () => {
+  it("matches an OAuth user within the expiration window who has no refreshToken, skips them without a network call, and leaves the doc untouched -- expected to PASS today", async () => {
+    const uid = `scheduled-osf-regression-${randomUUID()}`;
+    const original = {
+      email: `${uid}@example.test`,
+      usingPersonalToken: false,
+      refreshTokenExpires: Date.now(), // within the 2-week window -- matches the query
+      // refreshToken deliberately absent -- exercises the existing
+      // "if (!userData.refreshToken) { ...; continue; }" skip branch, so
+      // this never reaches the OSF token endpoint.
+    };
+    await db.collection("users").doc(uid).set(original);
+
+    const response = await fetch(SCHEDULED_URL, { method: "POST" });
+    expect(response.ok).toBe(true);
+
+    const persisted = (await db.collection("users").doc(uid).get()).data();
+    expect(persisted).toEqual(original);
+  });
+});
diff --git a/functions/src/__tests__/pending-recovery-provider-regression.test.js b/functions/src/__tests__/pending-recovery-provider-regression.test.js
new file mode 100644
index 0000000..ad90c2b
--- /dev/null
+++ b/functions/src/__tests__/pending-recovery-provider-regression.test.js
@@ -0,0 +1,131 @@
+/**
+ * @jest-environment node
+ */
+
+// RED-phase regression test for step 7a's scheduled-pending-recovery.ts audit
+// (scratchpad/step7a-create-endpoint-spec.md, case 10 of the test plan).
+//
+// The audit: scheduledPendingRecovery's re-queue path (promoteToQueue in
+// functions/src/scheduled-pending-recovery.ts) builds its uploadQueue doc by
+// hand, reading only `expData.osfFilesLink` off the recovered experiment --
+// it never reads/forwards `expData.storageProvider` /
+// `expData.providerContainer`. Unlike queue-upload.ts (which explicitly
+// passes storageProvider/providerContainer through, see api-data.ts's calls),
+// this path has no such wiring. A recovered pending upload for a gdrive
+// experiment would therefore fall back to the legacy OSF shape in the queue
+// doc and fail when scheduled-upload-retry.ts later tries to process it.
+// This test seeds exactly that scenario and asserts the queue doc carries the
+// provider fields -- expected RED today.
+//
+// Seam: scheduled-pending-recovery.ts exports only `scheduledPendingRecovery`
+// (an onSchedule-wrapped function); `recoverPendingUploads`/`promoteToQueue`
+// are private. Rather than going through the Functions-emulator's HTTP
+// manual-trigger URL (the "scheduledpendingrecovery-0" pattern established by
+// oauth-connect-scheduled-regression.test.js's case 11), this test uses a
+// more direct seam: firebase-functions v2's onSchedule() implementation
+// (node_modules/firebase-functions/lib/v2/providers/scheduler.js) stashes the
+// raw, unwrapped handler on the returned function as `.run` (`func.run =
+// handler`). Dynamically importing the COMPILED module (functions/lib/,
+// requires `npm run build` first -- same convention as
+// oauth-connect-emulator.test.js's `await import("../../lib/crypto-utils.js")`)
+// and calling `scheduledPendingRecovery.run()` invokes recoverPendingUploads()
+// directly in THIS process.
+//
+// That matters because recoverPendingUploads() only recovers files older
+// than STALE_THRESHOLD_MS (15 minutes) -- a real pending-data file would need
+// to sit in the emulator for 15 real minutes before this suite could observe
+// it being recovered, which is impractical for CI. Because `.run()` executes
+// the real handler in-process (not over HTTP to the separate
+// Functions-emulator child process), this test can mock the global `Date.now`
+// that recoverPendingUploads() reads to compute its cutoff, shifting the
+// cutoff forward past the (really, just-created) file's real timeCreated --
+// without touching STALE_THRESHOLD_MS or any other production code.
+
+import { initializeApp, getApp } from "firebase-admin/app";
+import { getFirestore } from "firebase-admin/firestore";
+import { getStorage } from "firebase-admin/storage";
+import { randomUUID } from "crypto";
+
+process.env.FIRESTORE_EMULATOR_HOST = "localhost:8080";
+process.env.FIREBASE_STORAGE_EMULATOR_HOST = "localhost:9199";
+jest.setTimeout(30000);
+
+const config = {
+  projectId: "datapipe-test",
+  storageBucket: "datapipe-test.appspot.com",
+};
+
+const STALE_THRESHOLD_MS = 15 * 60 * 1000;
+
+let db;
+let bucket;
+let scheduledPendingRecovery;
+
+beforeAll(async () => {
+  // A NAMED app for this test's own seeding/assertions -- deliberately not
+  // "[DEFAULT]", so that dynamically importing the compiled
+  // scheduled-pending-recovery.js below (whose app.js calls bare
+  // initializeApp() with no name) doesn't collide with an already-existing
+  // default app in this same module registry.
+  let app;
+  try {
+    app = getApp("pending-recovery-regression-test");
+  } catch {
+    app = initializeApp(config, "pending-recovery-regression-test");
+  }
+  db = getFirestore(app);
+  bucket = getStorage(app).bucket();
+
+  ({ scheduledPendingRecovery } = await import("../../lib/scheduled-pending-recovery.js"));
+});
+
+async function seedPendingFile(experimentID, filename, data) {
+  const storagePath = `pending-data/${experimentID}/${filename}_${Date.now()}`;
+  const envelope = { experimentID, filename, data };
+  const file = bucket.file(storagePath);
+  await file.save(JSON.stringify(envelope), { contentType: "application/json" });
+  return storagePath;
+}
+
+describe("10. scheduled-pending-recovery carries provider fields through for a gdrive experiment", () => {
+  it("promotes a stale pending file for a gdrive experiment into uploadQueue with storageProvider + providerContainer set", async () => {
+    const experimentID = `pending-recovery-gdrive-${randomUUID()}`;
+    const filename = `case10-${randomUUID()}.json`;
+    const owner = `pending-recovery-owner-${randomUUID()}`;
+    const folderId = `folder-${randomUUID()}`;
+
+    await db.collection("experiments").doc(experimentID).set({
+      active: true,
+      owner,
+      storageProvider: "gdrive",
+      providerContainer: { provider: "gdrive", folderId },
+      // osfFilesLink deliberately absent -- a gdrive experiment has none.
+    });
+
+    await seedPendingFile(experimentID, filename, `[{"trial_type":"html-keyboard-response"}]`);
+
+    // Shift the recovery pass's notion of "now" forward so its
+    // STALE_THRESHOLD_MS cutoff falls after this file's real (just-now)
+    // timeCreated, without waiting 15 real minutes.
+    const realNow = Date.now();
+    const nowSpy = jest.spyOn(Date, "now").mockReturnValue(realNow + STALE_THRESHOLD_MS + 5 * 60 * 1000);
+    try {
+      await scheduledPendingRecovery.run({});
+    } finally {
+      nowSpy.mockRestore();
+    }
+
+    const docId = `${experimentID}:${filename}`.replace(/[/\\]/g, "_");
+    const queueDoc = await db.collection("uploadQueue").doc(docId).get();
+    expect(queueDoc.exists).toBe(true);
+
+    const queueData = queueDoc.data();
+    expect(queueData.experimentID).toBe(experimentID);
+    expect(queueData.owner).toBe(owner);
+    // The actual gap: promoteToQueue must pass these through, the same way
+    // queue-upload.ts's callers in api-data.ts already do.
+    expect(queueData.storageProvider).toBe("gdrive");
+    expect(queueData.providerContainer).toEqual({ provider: "gdrive", folderId });
+    expect(queueData.osfFilesLink).toBeUndefined();
+  });
+});
diff --git a/functions/src/__tests__/providers-gdrive.test.js b/functions/src/__tests__/providers-gdrive.test.js
new file mode 100644
index 0000000..29f0ad2
--- /dev/null
+++ b/functions/src/__tests__/providers-gdrive.test.js
@@ -0,0 +1,657 @@
+// RED-phase unit tests for step 4a (docs/provider-migration-design.md,
+// scratchpad/step4a-gdrive-adapter-spec.md), cases 1-7 of the test plan.
+//
+// functions/src/providers/gdrive.ts does not exist yet, so the import below
+// fails at module resolution -- EVERY test in this file (including the osf
+// sub-test inside case 7) fails as a collateral "Cannot find module
+// .../lib/providers/gdrive.js" error until the adapter is implemented. Once
+// gdrive.ts exists, the osf.downloadFile sub-test in case 7 is expected to
+// keep failing on its own, different (and correct) ground: osf.ts has no
+// downloadFile method yet either (that's also new in this step -- see the
+// "downloadFile" interface addition in the spec) -- so it fails with
+// "osfProvider.downloadFile is not a function", a missing-behavior failure
+// distinct from the module-not-found failures affecting cases 1-6.
+//
+// Style follows providers-osf.test.js: node-fetch is imported by name inside
+// the (future) gdrive.ts adapter module, same as osf.ts's put-file-osf.ts /
+// update-file-osf.ts, so "node-fetch" is mocked at the module level and the
+// compiled lib/ output is imported rather than the .ts source.
+//
+// GDRIVE_API_BASE is read at CALL time (not module load, per the spec), so
+// this file pins it to a distinctive, non-default sentinel value in
+// beforeAll/afterAll -- this both keeps assertions independent of whatever
+// the real default happens to be, and forces the implementation to actually
+// read process.env.GDRIVE_API_BASE rather than hardcoding
+// https://www.googleapis.com.
+const mockFetch = jest.fn();
+
+jest.mock("node-fetch", () => ({
+  __esModule: true,
+  default: (...args) => mockFetch(...args),
+}));
+
+import { gdriveProvider } from "../../lib/providers/gdrive.js";
+import { osfProvider } from "../../lib/providers/osf.js";
+
+const API_BASE = "https://gdrive.mock.test";
+
+const ORIGINAL_GDRIVE_API_BASE = process.env.GDRIVE_API_BASE;
+
+beforeAll(() => {
+  process.env.GDRIVE_API_BASE = API_BASE;
+});
+
+afterAll(() => {
+  process.env.GDRIVE_API_BASE = ORIGINAL_GDRIVE_API_BASE;
+});
+
+beforeEach(() => {
+  mockFetch.mockClear();
+});
+
+const auth = { token: "test-token" };
+
+function mockResponse({ status, statusText, retryAfter = null, jsonBody, textBody }) {
+  return {
+    status,
+    statusText,
+    headers: {
+      get: (header) => (header === "Retry-After" ? retryAfter : null),
+    },
+    json: () => Promise.resolve(jsonBody),
+    text: () => Promise.resolve(textBody),
+  };
+}
+
+// Case-insensitive header lookup -- the exact casing of the headers object
+// gdrive.ts builds isn't spec'd beyond "Authorization"/"Content-Type" style
+// (mirrored from osf.ts), so tests look up by name rather than assume a key.
+function header(headers, name) {
+  if (!headers) return undefined;
+  const key = Object.keys(headers).find((k) => k.toLowerCase() === name.toLowerCase());
+  return key ? headers[key] : undefined;
+}
+
+function extractBoundary(contentType) {
+  const match = /boundary=("?)([^;"]+)\1/.exec(contentType || "");
+  return match ? match[2] : null;
+}
+
+function callArgs(index = 0) {
+  const [url, options] = mockFetch.mock.calls[index];
+  return { url, options };
+}
+
+describe("1. writeSessionFile success", () => {
+  it("POSTs a multipart/related upload containing both the JSON metadata and the payload, and parses the returned fileRef", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 200,
+        statusText: "OK",
+        jsonBody: { id: "gdrive-file-1", name: "file.json" },
+      })
+    );
+
+    const container = { provider: "gdrive", folderId: "folder-abc" };
+    const result = await gdriveProvider.writeSessionFile(
+      auth,
+      container,
+      "file.json",
+      "a,b,c\n1,2,3",
+      { size: 11, contentType: "text/csv" }
+    );
+
+    expect(mockFetch).toHaveBeenCalledTimes(1);
+    const { url, options } = callArgs(0);
+
+    expect(url).toBe(`${API_BASE}/upload/drive/v3/files?uploadType=multipart`);
+    expect(options.method).toBe("POST");
+    expect(header(options.headers, "Authorization")).toBe("Bearer test-token");
+
+    const contentType = header(options.headers, "Content-Type");
+    expect(contentType).toMatch(/^multipart\/related; boundary=/);
+    const boundary = extractBoundary(contentType);
+    expect(boundary).toBeTruthy();
+
+    const body = options.body.toString();
+    expect(body).toContain(`--${boundary}`);
+    expect(body).toContain('"name":"file.json"');
+    expect(body).toContain('"parents":["folder-abc"]');
+    expect(body).toContain("application/json; charset=UTF-8");
+    expect(body).toContain("text/csv");
+    expect(body).toContain("a,b,c\n1,2,3");
+    // Metadata part must precede the data part.
+    expect(body.indexOf('"name":"file.json"')).toBeLessThan(body.indexOf("a,b,c\n1,2,3"));
+
+    expect(result).toEqual({
+      success: true,
+      fileRef: { id: "gdrive-file-1", name: "file.json" },
+      storedFilename: "file.json",
+    });
+  });
+
+  it("also treats a 201 response as success (per the '200/201' contract)", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 201,
+        statusText: "Created",
+        jsonBody: { id: "gdrive-file-2", name: "file2.json" },
+      })
+    );
+
+    const result = await gdriveProvider.writeSessionFile(
+      auth,
+      { provider: "gdrive", folderId: "folder-abc" },
+      "file2.json",
+      "data",
+      { size: 4, contentType: "application/json" }
+    );
+
+    expect(result).toEqual({
+      success: true,
+      fileRef: { id: "gdrive-file-2", name: "file2.json" },
+      storedFilename: "file2.json",
+    });
+  });
+
+  it("falls back to the requested filename as storedFilename when the response omits name", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 200,
+        statusText: "OK",
+        jsonBody: { id: "gdrive-file-3" },
+      })
+    );
+
+    const result = await gdriveProvider.writeSessionFile(
+      auth,
+      { provider: "gdrive", folderId: "folder-abc" },
+      "file3.json",
+      "data",
+      { size: 4, contentType: "application/json" }
+    );
+
+    expect(result).toEqual({
+      success: true,
+      fileRef: { id: "gdrive-file-3", name: undefined },
+      storedFilename: "file3.json",
+    });
+  });
+});
+
+describe("2. writeSessionFile subfolder", () => {
+  it("finds-or-creates the subfolder by name under the container, then uploads parented to it", async () => {
+    // 1) folder query -- absent
+    mockFetch.mockResolvedValueOnce(mockResponse({ status: 200, statusText: "OK", jsonBody: { files: [] } }));
+    // 2) folder create
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({ status: 200, statusText: "OK", jsonBody: { id: "sub-folder-id", name: "sub" } })
+    );
+    // 3) upload into the new subfolder
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({ status: 200, statusText: "OK", jsonBody: { id: "gdrive-file-4", name: "file.csv" } })
+    );
+
+    const container = { provider: "gdrive", folderId: "folder-abc" };
+    const result = await gdriveProvider.writeSessionFile(auth, container, "sub/file.csv", "csv-data", {
+      size: 8,
+      contentType: "text/csv",
+    });
+
+    expect(mockFetch).toHaveBeenCalledTimes(3);
+
+    const findCall = callArgs(0);
+    const findUrl = new URL(findCall.url);
+    expect(findCall.options.method).toBe("GET");
+    expect(findUrl.searchParams.get("q")).toContain("name='sub'");
+    expect(findUrl.searchParams.get("q")).toContain("'folder-abc' in parents");
+    expect(findUrl.searchParams.get("q")).toContain("mimeType='application/vnd.google-apps.folder'");
+    expect(findUrl.searchParams.get("q")).toContain("trashed=false");
+
+    const createCall = callArgs(1);
+    expect(createCall.options.method).toBe("POST");
+    expect(JSON.parse(createCall.options.body)).toEqual({
+      name: "sub",
+      mimeType: "application/vnd.google-apps.folder",
+      parents: ["folder-abc"],
+    });
+
+    const uploadCall = callArgs(2);
+    expect(uploadCall.url).toBe(`${API_BASE}/upload/drive/v3/files?uploadType=multipart`);
+    const uploadBody = uploadCall.options.body.toString();
+    expect(uploadBody).toContain('"name":"file.csv"');
+    expect(uploadBody).toContain('"parents":["sub-folder-id"]');
+    expect(uploadBody).toContain("csv-data");
+
+    expect(result).toEqual({
+      success: true,
+      fileRef: { id: "gdrive-file-4", name: "file.csv" },
+      storedFilename: "file.csv",
+    });
+  });
+
+  it("uploads directly into an existing subfolder without creating a duplicate", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 200,
+        statusText: "OK",
+        jsonBody: { files: [{ id: "existing-sub-id", name: "sub", mimeType: "application/vnd.google-apps.folder" }] },
+      })
+    );
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({ status: 200, statusText: "OK", jsonBody: { id: "gdrive-file-5", name: "file2.csv" } })
+    );
+
+    const container = { provider: "gdrive", folderId: "folder-abc" };
+    await gdriveProvider.writeSessionFile(auth, container, "sub/file2.csv", "csv-data-2", {
+      size: 10,
+      contentType: "text/csv",
+    });
+
+    // Exactly 2 calls: the find query, then the upload. No create call.
+    expect(mockFetch).toHaveBeenCalledTimes(2);
+    const uploadBody = callArgs(1).options.body.toString();
+    expect(uploadBody).toContain('"parents":["existing-sub-id"]');
+  });
+});
+
+describe("3. error mapping", () => {
+  it("maps 401 to AUTH_EXPIRED", async () => {
+    mockFetch.mockResolvedValueOnce(mockResponse({ status: 401, statusText: "Unauthorized" }));
+
+    const result = await gdriveProvider.writeSessionFile(
+      auth,
+      { provider: "gdrive", folderId: "folder-abc" },
+      "file.json",
+      "data",
+      { size: 4, contentType: "application/json" }
+    );
+
+    expect(result).toEqual({
+      success: false,
+      error: "AUTH_EXPIRED",
+      providerStatus: 401,
+      providerMessage: "Unauthorized",
+      retryAfter: null,
+    });
+  });
+
+  it("maps 403 storageQuotaExceeded to QUOTA_EXCEEDED", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 403,
+        statusText: "Forbidden",
+        jsonBody: { errors: [{ reason: "storageQuotaExceeded", message: "quota" }] },
+      })
+    );
+
+    const result = await gdriveProvider.writeSessionFile(
+      auth,
+      { provider: "gdrive", folderId: "folder-abc" },
+      "file.json",
+      "data",
+      { size: 4, contentType: "application/json" }
+    );
+
+    expect(result).toEqual({
+      success: false,
+      error: "QUOTA_EXCEEDED",
+      providerStatus: 403,
+      providerMessage: "Forbidden",
+      retryAfter: null,
+    });
+  });
+
+  it("maps 403 userRateLimitExceeded to RATE_LIMITED", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 403,
+        statusText: "Forbidden",
+        jsonBody: { errors: [{ reason: "userRateLimitExceeded", message: "slow down" }] },
+      })
+    );
+
+    const result = await gdriveProvider.writeSessionFile(
+      auth,
+      { provider: "gdrive", folderId: "folder-abc" },
+      "file.json",
+      "data",
+      { size: 4, contentType: "application/json" }
+    );
+
+    expect(result).toEqual({
+      success: false,
+      error: "RATE_LIMITED",
+      providerStatus: 403,
+      providerMessage: "Forbidden",
+      retryAfter: null,
+    });
+  });
+
+  it("maps any other 403 reason to AUTH_EXPIRED", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 403,
+        statusText: "Forbidden",
+        jsonBody: { errors: [{ reason: "insufficientFilePermissions", message: "nope" }] },
+      })
+    );
+
+    const result = await gdriveProvider.writeSessionFile(
+      auth,
+      { provider: "gdrive", folderId: "folder-abc" },
+      "file.json",
+      "data",
+      { size: 4, contentType: "application/json" }
+    );
+
+    expect(result).toEqual({
+      success: false,
+      error: "AUTH_EXPIRED",
+      providerStatus: 403,
+      providerMessage: "Forbidden",
+      retryAfter: null,
+    });
+  });
+
+  it("maps 429 to RATE_LIMITED and passes through Retry-After", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({ status: 429, statusText: "Too Many Requests", retryAfter: "15" })
+    );
+
+    const result = await gdriveProvider.writeSessionFile(
+      auth,
+      { provider: "gdrive", folderId: "folder-abc" },
+      "file.json",
+      "data",
+      { size: 4, contentType: "application/json" }
+    );
+
+    expect(result).toEqual({
+      success: false,
+      error: "RATE_LIMITED",
+      providerStatus: 429,
+      providerMessage: "Too Many Requests",
+      retryAfter: 15,
+    });
+  });
+
+  it("maps 500 to UNAVAILABLE", async () => {
+    mockFetch.mockResolvedValueOnce(mockResponse({ status: 500, statusText: "Internal Server Error" }));
+
+    const result = await gdriveProvider.writeSessionFile(
+      auth,
+      { provider: "gdrive", folderId: "folder-abc" },
+      "file.json",
+      "data",
+      { size: 4, contentType: "application/json" }
+    );
+
+    expect(result).toEqual({
+      success: false,
+      error: "UNAVAILABLE",
+      providerStatus: 500,
+      providerMessage: "Internal Server Error",
+      retryAfter: null,
+    });
+  });
+});
+
+describe("4. listFiles pagination", () => {
+  it("follows nextPageToken until exhausted, concatenates results, recurses into subfolders, and same-level requests carry the same q filter", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 200,
+        statusText: "OK",
+        jsonBody: {
+          nextPageToken: "page2tok",
+          files: [
+            { id: "f1", name: "a.csv", mimeType: "text/csv" },
+            { id: "folder1", name: "subdir", mimeType: "application/vnd.google-apps.folder" },
+          ],
+        },
+      })
+    );
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 200,
+        statusText: "OK",
+        jsonBody: { files: [{ id: "f2", name: "b.csv", mimeType: "text/csv" }] },
+      })
+    );
+    // Recursion: a third request lists the "subdir" folder (folder1) found
+    // above, since listFiles now walks into subfolders (nested Psych-DS
+    // paths like data/raw/ live there) instead of only listing the top level.
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 200,
+        statusText: "OK",
+        jsonBody: { files: [{ id: "f3", name: "c.csv", mimeType: "text/csv" }] },
+      })
+    );
+
+    const container = { provider: "gdrive", folderId: "folder-xyz" };
+    const result = await gdriveProvider.listFiles(auth, container);
+
+    // Files from every level are concatenated, keyed by their own leaf name
+    // (not qualified by folder) so hashing `salt:name` matches a claim made
+    // on the raw leaf filename.
+    expect(result).toEqual([
+      { name: "a.csv", id: "f1" },
+      { name: "b.csv", id: "f2" },
+      { name: "c.csv", id: "f3" },
+    ]);
+
+    expect(mockFetch).toHaveBeenCalledTimes(3);
+
+    const url1 = new URL(callArgs(0).url);
+    const url2 = new URL(callArgs(1).url);
+    const url3 = new URL(callArgs(2).url);
+
+    expect(url1.searchParams.get("q")).toBe("'folder-xyz' in parents and trashed=false");
+    expect(url2.searchParams.get("q")).toBe(url1.searchParams.get("q"));
+    expect(url3.searchParams.get("q")).toBe("'folder1' in parents and trashed=false");
+    expect(url1.searchParams.get("fields")).toBe("nextPageToken,files(id,name,mimeType)");
+    expect(url1.searchParams.get("pageSize")).toBe("1000");
+
+    // The defining pagination assertion: only the second request (same
+    // folder, page 2) carries the page token from the first response.
+    expect(url1.searchParams.get("pageToken")).toBeNull();
+    expect(url2.searchParams.get("pageToken")).toBe("page2tok");
+    expect(url3.searchParams.get("pageToken")).toBeNull();
+  });
+
+  it("stops after a single page when no nextPageToken is returned", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 200,
+        statusText: "OK",
+        jsonBody: { files: [{ id: "f1", name: "only.csv", mimeType: "text/csv" }] },
+      })
+    );
+
+    const result = await gdriveProvider.listFiles(auth, { provider: "gdrive", folderId: "folder-solo" });
+
+    expect(result).toEqual([{ name: "only.csv", id: "f1" }]);
+    expect(mockFetch).toHaveBeenCalledTimes(1);
+  });
+
+  it("throws (never returns a partial/empty list) when the listing request fails", async () => {
+    // Load-bearing for collision-cache rehydration: Drive has no 409
+    // backstop, so a swallowed listing failure would warm the cache empty
+    // and silently accept duplicate filenames. The throw is what surfaces
+    // as CollisionCacheUnavailableError upstream.
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 401,
+        statusText: "Unauthorized",
+        jsonBody: { error: { message: "Invalid Credentials" } },
+      })
+    );
+
+    await expect(
+      gdriveProvider.listFiles(auth, { provider: "gdrive", folderId: "folder-err" })
+    ).rejects.toThrow(/listing failed/i);
+  });
+});
+
+describe("5. updateFile", () => {
+  it("PATCHes the media upload endpoint keyed by the ref id and returns a WriteResult on success", async () => {
+    mockFetch.mockResolvedValueOnce(mockResponse({ status: 200, statusText: "OK" }));
+
+    const existingFileRef = { id: "gdrive-existing-1", name: "data.json" };
+    const result = await gdriveProvider.updateFile(
+      auth,
+      { provider: "gdrive", folderId: "folder-abc" },
+      existingFileRef,
+      "updated-data",
+      { size: 12, contentType: "application/json" }
+    );
+
+    expect(mockFetch).toHaveBeenCalledTimes(1);
+    const { url, options } = callArgs(0);
+    expect(url).toBe(`${API_BASE}/upload/drive/v3/files/gdrive-existing-1?uploadType=media`);
+    expect(options.method).toBe("PATCH");
+    expect(header(options.headers, "Authorization")).toBe("Bearer test-token");
+    expect(options.body).toBe("updated-data");
+
+    expect(result).toEqual({
+      success: true,
+      fileRef: existingFileRef,
+      storedFilename: "data.json",
+    });
+  });
+
+  it("returns a failure WriteResult (does not throw) when the PATCH fails", async () => {
+    mockFetch.mockResolvedValueOnce(mockResponse({ status: 404, statusText: "Not Found" }));
+
+    const existingFileRef = { id: "gdrive-stale-1", name: "data.json" };
+
+    await expect(
+      gdriveProvider.updateFile(
+        auth,
+        { provider: "gdrive", folderId: "folder-abc" },
+        existingFileRef,
+        "updated-data",
+        { size: 12, contentType: "application/json" }
+      )
+    ).resolves.toEqual({
+      success: false,
+      error: "UNAVAILABLE",
+      providerStatus: 404,
+      providerMessage: "Not Found",
+      retryAfter: null,
+    });
+  });
+});
+
+describe("6. createDataContainer", () => {
+  it("only creates the child folder when the DataPipe root already exists", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 200,
+        statusText: "OK",
+        jsonBody: {
+          files: [{ id: "root-existing-id", name: "DataPipe", mimeType: "application/vnd.google-apps.folder" }],
+        },
+      })
+    );
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({ status: 200, statusText: "OK", jsonBody: { id: "child-id-A", name: "My Experiment" } })
+    );
+
+    const result = await gdriveProvider.createDataContainer(auth, { name: "My Experiment" });
+
+    expect(mockFetch).toHaveBeenCalledTimes(2);
+
+    const findUrl = new URL(callArgs(0).url);
+    expect(findUrl.searchParams.get("q")).toContain("name='DataPipe'");
+    expect(findUrl.searchParams.get("q")).toContain("'root' in parents");
+    expect(findUrl.searchParams.get("q")).toContain("mimeType='application/vnd.google-apps.folder'");
+    expect(findUrl.searchParams.get("q")).toContain("trashed=false");
+
+    expect(JSON.parse(callArgs(1).options.body)).toEqual({
+      name: "My Experiment",
+      mimeType: "application/vnd.google-apps.folder",
+      parents: ["root-existing-id"],
+    });
+
+    expect(result).toEqual({ provider: "gdrive", folderId: "child-id-A" });
+  });
+
+  it("creates the DataPipe root first, then the child, when the root is absent", async () => {
+    mockFetch.mockResolvedValueOnce(mockResponse({ status: 200, statusText: "OK", jsonBody: { files: [] } }));
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({ status: 200, statusText: "OK", jsonBody: { id: "root-new-id", name: "DataPipe" } })
+    );
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({ status: 200, statusText: "OK", jsonBody: { id: "child-id-B", name: "My Experiment 2" } })
+    );
+
+    const result = await gdriveProvider.createDataContainer(auth, { name: "My Experiment 2" });
+
+    expect(mockFetch).toHaveBeenCalledTimes(3);
+
+    expect(JSON.parse(callArgs(1).options.body)).toEqual({
+      name: "DataPipe",
+      mimeType: "application/vnd.google-apps.folder",
+      parents: ["root"],
+    });
+    expect(JSON.parse(callArgs(2).options.body)).toEqual({
+      name: "My Experiment 2",
+      mimeType: "application/vnd.google-apps.folder",
+      parents: ["root-new-id"],
+    });
+
+    expect(result).toEqual({ provider: "gdrive", folderId: "child-id-B" });
+  });
+});
+
+describe("7. downloadFile", () => {
+  it("gdrive: GETs the alt=media endpoint and returns the body text as content", async () => {
+    mockFetch.mockResolvedValueOnce(mockResponse({ status: 200, statusText: "OK", textBody: "file body text" }));
+
+    const container = { provider: "gdrive", folderId: "folder-abc" };
+    const result = await gdriveProvider.downloadFile(auth, container, { id: "gdrive-file-9", name: "data.json" });
+
+    expect(mockFetch).toHaveBeenCalledTimes(1);
+    const { url, options } = callArgs(0);
+    expect(url).toBe(`${API_BASE}/drive/v3/files/gdrive-file-9?alt=media`);
+    expect(options.method).toBe("GET");
+    expect(header(options.headers, "Authorization")).toBe("Bearer test-token");
+
+    expect(result).toEqual({ success: true, content: "file body text" });
+  });
+
+  it("gdrive: maps a 401 on download the same way as writes (shared mapDriveError)", async () => {
+    mockFetch.mockResolvedValueOnce(mockResponse({ status: 401, statusText: "Unauthorized" }));
+
+    const result = await gdriveProvider.downloadFile(
+      auth,
+      { provider: "gdrive", folderId: "folder-abc" },
+      { id: "gdrive-file-10", name: "data.json" }
+    );
+
+    expect(result).toEqual({
+      success: false,
+      error: "AUTH_EXPIRED",
+      providerStatus: 401,
+      providerMessage: "Unauthorized",
+    });
+  });
+
+  it("osf: GETs filesLink+id and returns the body text as content", async () => {
+    mockFetch.mockResolvedValueOnce(mockResponse({ status: 200, statusText: "OK", textBody: "osf file content" }));
+
+    const container = { provider: "osf", filesLink: "https://osf.io/abc123/" };
+    const result = await osfProvider.downloadFile(auth, container, { id: "osfstorage/111", name: "data.json" });
+
+    expect(mockFetch).toHaveBeenCalledTimes(1);
+    const { url, options } = callArgs(0);
+    expect(url).toBe("https://osf.io/abc123/osfstorage/111");
+    expect(options.method).toBe("GET");
+    expect(header(options.headers, "Authorization")).toBe("Bearer test-token");
+
+    expect(result).toEqual({ success: true, content: "osf file content" });
+  });
+});
diff --git a/functions/src/__tests__/providers-osf.test.js b/functions/src/__tests__/providers-osf.test.js
new file mode 100644
index 0000000..1dd4476
--- /dev/null
+++ b/functions/src/__tests__/providers-osf.test.js
@@ -0,0 +1,166 @@
+// osfProvider delegates its writes to put-file-osf.js / update-file-osf.js,
+// which both import their own `fetch` from the "node-fetch" package rather
+// than using the global fetch. Mocking global.fetch (the pattern used by
+// metadata-process.test.js) would have no effect on this code path, since
+// node-fetch's fetch is a distinct implementation from globalThis.fetch.
+// We mock the "node-fetch" module itself instead.
+const mockFetch = jest.fn();
+
+jest.mock("node-fetch", () => ({
+  __esModule: true,
+  default: (...args) => mockFetch(...args),
+}));
+
+import { osfProvider } from "../../lib/providers/osf.js";
+
+function mockResponse({ status, statusText, retryAfter = null }) {
+  return {
+    status,
+    statusText,
+    headers: {
+      get: (header) => (header === "Retry-After" ? retryAfter : null),
+    },
+  };
+}
+
+const auth = { token: "test-token" };
+const container = { provider: "osf", filesLink: "https://osf.io/abc123/" };
+
+describe("osfProvider.writeSessionFile", () => {
+  beforeEach(() => {
+    mockFetch.mockClear();
+  });
+
+  it("maps a 201 response to a success WriteResult", async () => {
+    mockFetch.mockResolvedValueOnce(mockResponse({ status: 201, statusText: "Created" }));
+
+    const result = await osfProvider.writeSessionFile(
+      auth,
+      container,
+      "file.json",
+      "data",
+      { size: 4, contentType: "application/json" }
+    );
+
+    expect(result).toEqual({
+      success: true,
+      fileRef: { name: "file.json" },
+      storedFilename: "file.json",
+    });
+  });
+
+  it("maps a 409 response to NAME_CONFLICT", async () => {
+    mockFetch.mockResolvedValueOnce(mockResponse({ status: 409, statusText: "Conflict" }));
+
+    const result = await osfProvider.writeSessionFile(
+      auth,
+      container,
+      "file.json",
+      "data",
+      { size: 4, contentType: "application/json" }
+    );
+
+    expect(result).toEqual({
+      success: false,
+      error: "NAME_CONFLICT",
+      providerStatus: 409,
+      providerMessage: "Conflict",
+      retryAfter: null,
+    });
+  });
+
+  it("maps a 429 response to RATE_LIMITED and passes through retryAfter", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({ status: 429, statusText: "Too Many Requests", retryAfter: "30" })
+    );
+
+    const result = await osfProvider.writeSessionFile(
+      auth,
+      container,
+      "file.json",
+      "data",
+      { size: 4, contentType: "application/json" }
+    );
+
+    expect(result).toEqual({
+      success: false,
+      error: "RATE_LIMITED",
+      providerStatus: 429,
+      providerMessage: "Too Many Requests",
+      retryAfter: 30,
+    });
+  });
+
+  it("maps a 401 response to AUTH_EXPIRED", async () => {
+    mockFetch.mockResolvedValueOnce(mockResponse({ status: 401, statusText: "Unauthorized" }));
+
+    const result = await osfProvider.writeSessionFile(
+      auth,
+      container,
+      "file.json",
+      "data",
+      { size: 4, contentType: "application/json" }
+    );
+
+    expect(result).toEqual({
+      success: false,
+      error: "AUTH_EXPIRED",
+      providerStatus: 401,
+      providerMessage: "Unauthorized",
+      retryAfter: null,
+    });
+  });
+
+  it("maps a 500 response to UNAVAILABLE and preserves providerStatus/providerMessage", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({ status: 500, statusText: "Internal Server Error" })
+    );
+
+    const result = await osfProvider.writeSessionFile(
+      auth,
+      container,
+      "file.json",
+      "data",
+      { size: 4, contentType: "application/json" }
+    );
+
+    expect(result).toEqual({
+      success: false,
+      error: "UNAVAILABLE",
+      providerStatus: 500,
+      providerMessage: "Internal Server Error",
+      retryAfter: null,
+    });
+  });
+});
+
+describe("osfProvider.listFiles", () => {
+  beforeEach(() => {
+    mockFetch.mockClear();
+  });
+
+  it("returns name/id pairs and filters out folder entries", async () => {
+    mockFetch.mockResolvedValueOnce({
+      json: () =>
+        Promise.resolve({
+          data: [
+            { attributes: { name: "data.json", kind: "file" }, id: "osfstorage/111" },
+            { attributes: { name: "subfolder", kind: "folder" }, id: "osfstorage/222" },
+            { attributes: { name: "dataset_description.json", kind: "file" }, id: "osfstorage/333" },
+          ],
+        }),
+    });
+
+    const result = await osfProvider.listFiles(auth, container);
+
+    expect(result).toEqual([
+      { name: "data.json", id: "osfstorage/111" },
+      { name: "dataset_description.json", id: "osfstorage/333" },
+    ]);
+    expect(mockFetch).toHaveBeenCalledTimes(1);
+    expect(mockFetch).toHaveBeenCalledWith(
+      "https://osf.io/abc123/?meta=",
+      expect.objectContaining({ method: "GET" })
+    );
+  });
+});
diff --git a/functions/src/__tests__/providers-registry.test.js b/functions/src/__tests__/providers-registry.test.js
new file mode 100644
index 0000000..a83c874
--- /dev/null
+++ b/functions/src/__tests__/providers-registry.test.js
@@ -0,0 +1,66 @@
+import {
+  registerProvider,
+  getProvider,
+  listProviders,
+  clearProvidersForTesting,
+} from "../../lib/providers/registry.js";
+
+function makeFakeProvider(id) {
+  return {
+    id,
+    authMethod: "static-token",
+    capabilities: {
+      nativeSubfolders: false,
+      supportsRegion: false,
+      maxFileSizeBytes: null,
+      quotaNote: null,
+    },
+    createDataContainer: async () => ({ provider: id }),
+    writeSessionFile: async () => ({
+      success: true,
+      fileRef: { name: "test" },
+      storedFilename: "test",
+    }),
+    updateFile: async () => ({
+      success: true,
+      fileRef: { name: "test" },
+      storedFilename: "test",
+    }),
+    listFiles: async () => [],
+  };
+}
+
+describe("providers registry", () => {
+  beforeEach(() => {
+    clearProvidersForTesting();
+  });
+
+  it("returns a registered provider from getProvider", () => {
+    const provider = makeFakeProvider("osf");
+
+    registerProvider(provider);
+
+    expect(getProvider("osf")).toBe(provider);
+  });
+
+  it("throws when getProvider is called with an unknown id", () => {
+    expect(() => getProvider("gdrive")).toThrow("Unknown storage provider: gdrive");
+  });
+
+  it("throws when registering a duplicate id", () => {
+    registerProvider(makeFakeProvider("figshare"));
+
+    expect(() => registerProvider(makeFakeProvider("figshare"))).toThrow(
+      "Storage provider already registered: figshare"
+    );
+  });
+
+  it("reflects registrations in listProviders", () => {
+    expect(listProviders()).toEqual([]);
+
+    registerProvider(makeFakeProvider("osf"));
+    registerProvider(makeFakeProvider("dataverse"));
+
+    expect(listProviders()).toEqual(["osf", "dataverse"]);
+  });
+});
diff --git a/functions/src/__tests__/put-file-osf-ref.test.js b/functions/src/__tests__/put-file-osf-ref.test.js
new file mode 100644
index 0000000..c59c295
--- /dev/null
+++ b/functions/src/__tests__/put-file-osf-ref.test.js
@@ -0,0 +1,194 @@
+// RED-phase unit tests for step 3b (docs/provider-migration-design.md,
+// scratchpad/step3b-metadata-ref-spec.md), cases 1-2 of the test plan.
+//
+// putFileOSF currently discards the 201 response body entirely (see
+// put-file-osf.ts: it never calls `.json()` on a successful upload). This
+// step extends it to parse `{ data: { id, attributes: { name } } }` and
+// surface `fileId`/`fileName`, and extends osfProvider.writeSessionFile to
+// pass those through as `fileRef`/`storedFilename`. Written as a new file
+// (providers-osf.test.js is left untouched per the RED-phase instructions)
+// but following its mocking style exactly: put-file-osf.ts/update-file-osf.ts
+// import their own `fetch` from "node-fetch" rather than using globalThis
+// fetch, so "node-fetch" is mocked at the module level, and the compiled
+// lib/ output is imported (same convention providers-osf.test.js and
+// metadata-process.test.js use) rather than the .ts source.
+const mockFetch = jest.fn();
+
+jest.mock("node-fetch", () => ({
+  __esModule: true,
+  default: (...args) => mockFetch(...args),
+}));
+
+import putFileOSF from "../../lib/put-file-osf.js";
+import { osfProvider } from "../../lib/providers/osf.js";
+
+function mockResponse({ status, statusText, retryAfter = null, jsonBody, jsonError }) {
+  return {
+    status,
+    statusText,
+    headers: {
+      get: (header) => (header === "Retry-After" ? retryAfter : null),
+    },
+    json: () => (jsonError ? Promise.reject(jsonError) : Promise.resolve(jsonBody)),
+  };
+}
+
+describe("putFileOSF response parsing (case 1)", () => {
+  beforeEach(() => {
+    mockFetch.mockClear();
+  });
+
+  it("parses fileId and fileName from a well-formed 201 body", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 201,
+        statusText: "Created",
+        jsonBody: { data: { id: "osfstorage/abc123", attributes: { name: "file.json" } } },
+      })
+    );
+
+    const result = await putFileOSF("https://osf.io/abc123/", "test-token", "data", "file.json");
+
+    expect(result).toEqual({
+      success: true,
+      errorCode: null,
+      errorText: null,
+      fileId: "osfstorage/abc123",
+      fileName: "file.json",
+    });
+  });
+
+  it("tolerates a 201 body containing only attributes.name (no id)", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 201,
+        statusText: "Created",
+        jsonBody: { data: { attributes: { name: "file.json" } } },
+      })
+    );
+
+    const result = await putFileOSF("https://osf.io/abc123/", "test-token", "data", "file.json");
+
+    expect(result.success).toBe(true);
+    expect(result.fileName).toBe("file.json");
+    expect(result.fileId).toBeUndefined();
+  });
+
+  it("tolerates a missing/unparseable body on a successful upload without throwing", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 201,
+        statusText: "Created",
+        jsonError: new SyntaxError("Unexpected end of JSON input"),
+      })
+    );
+
+    const result = await putFileOSF("https://osf.io/abc123/", "test-token", "data", "file.json");
+
+    expect(result.success).toBe(true);
+    expect(result.fileId).toBeUndefined();
+    expect(result.fileName).toBeUndefined();
+  });
+
+  it("does not attempt to parse a body on a non-201 (failure) response", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 409,
+        statusText: "Conflict",
+        // If implementation code ever called .json() on a failure response,
+        // this rejection would surface as an unhandled/uncaught test failure.
+        jsonError: new Error("json() should not be called on a failed upload"),
+      })
+    );
+
+    const result = await putFileOSF("https://osf.io/abc123/", "test-token", "data", "file.json");
+
+    expect(result).toEqual({
+      success: false,
+      errorCode: 409,
+      errorText: "Conflict",
+      retryAfter: null,
+    });
+  });
+});
+
+describe("osfProvider.writeSessionFile fileRef surfacing (case 2)", () => {
+  const auth = { token: "test-token" };
+  const container = { provider: "osf", filesLink: "https://osf.io/abc123/" };
+
+  beforeEach(() => {
+    mockFetch.mockClear();
+  });
+
+  it("surfaces fileRef.id/name parsed from the 201 body, and storedFilename from the parsed name", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 201,
+        statusText: "Created",
+        jsonBody: { data: { id: "osfstorage/xyz789", attributes: { name: "renamed.json" } } },
+      })
+    );
+
+    const result = await osfProvider.writeSessionFile(
+      auth,
+      container,
+      "requested.json",
+      "data",
+      { size: 4, contentType: "application/json" }
+    );
+
+    expect(result).toEqual({
+      success: true,
+      fileRef: { name: "renamed.json", id: "osfstorage/xyz789" },
+      storedFilename: "renamed.json",
+    });
+  });
+
+  it("falls back to the requested filename when the body has no name, but keeps the parsed id", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 201,
+        statusText: "Created",
+        jsonBody: { data: { id: "osfstorage/xyz789" } },
+      })
+    );
+
+    const result = await osfProvider.writeSessionFile(
+      auth,
+      container,
+      "requested.json",
+      "data",
+      { size: 4, contentType: "application/json" }
+    );
+
+    expect(result).toEqual({
+      success: true,
+      fileRef: { name: "requested.json", id: "osfstorage/xyz789" },
+      storedFilename: "requested.json",
+    });
+  });
+
+  it("falls back to the requested filename and an undefined id when the body is unparseable", async () => {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({
+        status: 201,
+        statusText: "Created",
+        jsonError: new SyntaxError("Unexpected end of JSON input"),
+      })
+    );
+
+    const result = await osfProvider.writeSessionFile(
+      auth,
+      container,
+      "requested.json",
+      "data",
+      { size: 4, contentType: "application/json" }
+    );
+
+    expect(result).toEqual({
+      success: true,
+      fileRef: { name: "requested.json", id: undefined },
+      storedFilename: "requested.json",
+    });
+  });
+});
diff --git a/functions/src/__tests__/put-file-osf.test.js b/functions/src/__tests__/put-file-osf.test.js
index 1ff75d9..ca13459 100644
--- a/functions/src/__tests__/put-file-osf.test.js
+++ b/functions/src/__tests__/put-file-osf.test.js
@@ -1,3 +1,16 @@
+// Mocked at the module level (matching put-file-osf-ref.test.js /
+// providers-osf.test.js): put-file-osf.ts imports its own `fetch` from the
+// "node-fetch" package (provider-migration's documented architecture — see
+// providers-osf.test.js's header comment) rather than using the global
+// fetch, so assigning global.fetch here would never be seen by the code
+// under test.
+const mockFetch = jest.fn();
+
+jest.mock("node-fetch", () => ({
+  __esModule: true,
+  default: (...args) => mockFetch(...args),
+}));
+
 import putFileOSF from '../../lib/put-file-osf.js';
 
 const ROOT = 'https://files.osf.io/v1/resources/abc/providers/osfstorage/';
@@ -29,28 +42,28 @@ const fileFail = (status, statusText, retryAfter = null) => Promise.resolve({
   headers: { get: (h) => (h === 'Retry-After' ? retryAfter : null) },
 });
 
-const callUrls = () => fetch.mock.calls.map((c) => c[0]);
+const callUrls = () => mockFetch.mock.calls.map((c) => c[0]);
 
 beforeEach(() => {
-  global.fetch = jest.fn();
+  mockFetch.mockClear();
 });
 
 describe('putFileOSF', () => {
   it('uploads a bare filename straight to the storage root', async () => {
-    fetch.mockReturnValueOnce(fileOk());
+    mockFetch.mockReturnValueOnce(fileOk());
 
     const result = await putFileOSF(ROOT, TOKEN, 'hello', 'subject01.csv');
 
     expect(result).toEqual({ success: true, errorCode: null, errorText: null });
-    expect(fetch).toHaveBeenCalledTimes(1);
-    const [url, opts] = fetch.mock.calls[0];
+    expect(mockFetch).toHaveBeenCalledTimes(1);
+    const [url, opts] = mockFetch.mock.calls[0];
     expect(url).toBe(`${ROOT}?kind=file&name=subject01.csv`);
     expect(opts.method).toBe('PUT');
     expect(opts.body).toBe('hello');
   });
 
   it('uploads into an existing one-level subfolder', async () => {
-    fetch
+    mockFetch
       .mockReturnValueOnce(listing(['session1', 'other']))
       .mockReturnValueOnce(fileOk());
 
@@ -64,7 +77,7 @@ describe('putFileOSF', () => {
   });
 
   it('creates a missing one-level subfolder before uploading', async () => {
-    fetch
+    mockFetch
       .mockReturnValueOnce(listing([]))
       .mockReturnValueOnce(folderCreated('session1'))
       .mockReturnValueOnce(fileOk());
@@ -76,11 +89,11 @@ describe('putFileOSF', () => {
       `${ROOT}?kind=folder&name=session1`,
       `${move('session1')}?kind=file&name=abc.json`,
     ]);
-    expect(fetch.mock.calls[1][1].method).toBe('PUT');
+    expect(mockFetch.mock.calls[1][1].method).toBe('PUT');
   });
 
   it('walks and creates a two-level path (data/raw/)', async () => {
-    fetch
+    mockFetch
       .mockReturnValueOnce(listing([]))            // root has no data/
       .mockReturnValueOnce(folderCreated('data'))
       .mockReturnValueOnce(listing([]))            // data/ has no raw/
@@ -99,7 +112,7 @@ describe('putFileOSF', () => {
   });
 
   it('walks an existing two-level path without creating folders', async () => {
-    fetch
+    mockFetch
       .mockReturnValueOnce(listing(['data']))
       .mockReturnValueOnce(listing(['raw']))
       .mockReturnValueOnce(fileOk());
@@ -114,7 +127,7 @@ describe('putFileOSF', () => {
   });
 
   it('treats a 409 on folder creation as already-exists and re-resolves', async () => {
-    fetch
+    mockFetch
       .mockReturnValueOnce(listing([]))            // not found on first list
       .mockReturnValueOnce(conflict())             // create loses the race
       .mockReturnValueOnce(listing(['session1']))  // re-list finds the winner's folder
@@ -132,7 +145,7 @@ describe('putFileOSF', () => {
   });
 
   it('uploads straight into a pre-resolved startUrl, skipping the walk entirely', async () => {
-    fetch.mockReturnValueOnce(fileOk());
+    mockFetch.mockReturnValueOnce(fileOk());
 
     const result = await putFileOSF(ROOT, TOKEN, 'data', 'abc123.json', move('data'));
 
@@ -141,7 +154,7 @@ describe('putFileOSF', () => {
   });
 
   it('walks remaining segments starting from a pre-resolved startUrl', async () => {
-    fetch
+    mockFetch
       .mockReturnValueOnce(listing([]))
       .mockReturnValueOnce(folderCreated('raw'))
       .mockReturnValueOnce(fileOk());
@@ -156,7 +169,7 @@ describe('putFileOSF', () => {
   });
 
   it('returns the OSF error when the file upload fails', async () => {
-    fetch.mockReturnValueOnce(fileFail(409, 'Conflict'));
+    mockFetch.mockReturnValueOnce(fileFail(409, 'Conflict'));
 
     const result = await putFileOSF(ROOT, TOKEN, 'data', 'dup.json');
 
@@ -164,7 +177,7 @@ describe('putFileOSF', () => {
   });
 
   it('parses Retry-After on a throttled upload', async () => {
-    fetch.mockReturnValueOnce(fileFail(503, 'Service Unavailable', '30'));
+    mockFetch.mockReturnValueOnce(fileFail(503, 'Service Unavailable', '30'));
 
     const result = await putFileOSF(ROOT, TOKEN, 'data', 'x.json');
 
@@ -172,13 +185,13 @@ describe('putFileOSF', () => {
   });
 
   it('throws when a folder listing request fails', async () => {
-    fetch.mockReturnValueOnce(Promise.resolve({ ok: false, status: 500, statusText: 'Server Error' }));
+    mockFetch.mockReturnValueOnce(Promise.resolve({ ok: false, status: 500, statusText: 'Server Error' }));
 
     await expect(putFileOSF(ROOT, TOKEN, 'd', 'session1/a.json')).rejects.toThrow(/Failed to list files/);
   });
 
   it('throws when a 409 folder conflict cannot be re-resolved', async () => {
-    fetch
+    mockFetch
       .mockReturnValueOnce(listing([]))
       .mockReturnValueOnce(conflict())
       .mockReturnValueOnce(listing([])); // still not there on re-list
diff --git a/functions/src/__tests__/resolve-token-gdrive.test.js b/functions/src/__tests__/resolve-token-gdrive.test.js
new file mode 100644
index 0000000..4803c1c
--- /dev/null
+++ b/functions/src/__tests__/resolve-token-gdrive.test.js
@@ -0,0 +1,286 @@
+/**
+ * @jest-environment node
+ */
+
+// RED-phase unit tests for step 4a (docs/provider-migration-design.md,
+// scratchpad/step4a-gdrive-adapter-spec.md), cases 8-11 of the test plan.
+//
+// resolve-token.ts currently only understands the OSF/PAT dispatch (see
+// resolveToken's source: it branches on user_data.usingPersonalToken and
+// user_data.authTokenExpires with no awareness of exp_data.storageProvider
+// at all). Cases 8-10 below exercise a gdrive branch that does not exist yet:
+//   - case 8 fails because resolveToken falls through to the OAuth/OSF path,
+//     which reads user_data.authToken (undefined for a gdrive-only user) and
+//     returns { success: true, token: undefined } instead of dispatching on
+//     exp_data.storageProvider === "gdrive".
+//   - case 9/10 fail for the same reason: no refresh-POST is ever made (the
+//     OSF path calls refreshAndUpdateUser against the OSF token endpoint, not
+//     GDRIVE_TOKEN_URL), so global.fetch is never called and nothing is
+//     persisted to connectedAccounts.gdrive.
+//   - case 11 is a regression guard: it exercises the existing
+//     usingPersonalToken branch, completely untouched by the gdrive
+//     generalization, and is expected to PASS today. If a future edit to
+//     resolve-token.ts ever breaks it, that's a real regression, not an
+//     artifact of this RED phase.
+//
+// Persistence style follows collision-cache.test.js / upload-queue.test.js:
+// a Firestore-emulator-backed app imported by its compiled lib/ output, one
+// freshly-generated uid per test.
+//
+// Token encoding: per crypto-utils.ts, decrypt() has a plaintext fallback --
+// any value not prefixed with "v1:" is returned unchanged. Seeded tokens that
+// are never expected to be *re-encrypted and re-read back* by this file use
+// that fallback directly (mirrors how existing OSF emulator tests seed
+// osfToken: "valid"). Case 9 is the exception: it asserts that resolveToken
+// itself calls encrypt() when persisting the refreshed token, so this file
+// sets its own TOKEN_ENCRYPTION_KEY and decrypts the persisted value back --
+// entirely self-consistent within this one process, and unrelated to
+// whatever key the Functions emulator loads from functions/.env for the
+// separate gdrive-emulator.test.js integration run (which never exercises
+// real encryption -- see that file's header comment).
+//
+// resolve-token.ts's existing refresh call (refreshAndUpdateUser, in
+// refresh-token.ts) uses the runtime's global `fetch`, not the "node-fetch"
+// package -- only the OSF file-upload modules (put-file-osf.ts,
+// update-file-osf.ts) import node-fetch explicitly, per providers-osf.test.js's
+// header comment. The gdrive refresh branch is expected to follow its
+// sibling module's convention, so this file mocks global.fetch rather than
+// the "node-fetch" module.
+
+import { initializeApp, getApp } from "firebase-admin/app";
+import { getFirestore } from "firebase-admin/firestore";
+import { randomUUID } from "crypto";
+import resolveToken from "../../lib/resolve-token.js";
+import { decrypt } from "../../lib/crypto-utils.js";
+
+// TOKEN_ENCRYPTION_KEY is read lazily inside crypto-utils.ts's encrypt()/
+// decrypt() (via getKey(), called per-invocation, not cached at module
+// load), so it's safe to import resolveToken/crypto-utils statically here
+// and only set the key in beforeAll below, before any test actually calls
+// them.
+process.env.FIRESTORE_EMULATOR_HOST = "localhost:8080";
+
+jest.setTimeout(30000);
+
+const config = { projectId: "datapipe-test" };
+
+let db;
+
+const ORIGINAL_ENV = {
+  TOKEN_ENCRYPTION_KEY: process.env.TOKEN_ENCRYPTION_KEY,
+  GDRIVE_TOKEN_URL: process.env.GDRIVE_TOKEN_URL,
+  GDRIVE_CLIENT_ID: process.env.GDRIVE_CLIENT_ID,
+  GDRIVE_CLIENT_SECRET: process.env.GDRIVE_CLIENT_SECRET,
+};
+const ORIGINAL_FETCH = global.fetch;
+
+beforeAll(async () => {
+  let app;
+  try {
+    app = getApp("resolve-token-gdrive-test");
+  } catch {
+    app = initializeApp(config, "resolve-token-gdrive-test");
+  }
+  db = getFirestore(app);
+
+  // A valid-shaped (64 hex char) key, scoped to this process only -- see
+  // header comment on why this doesn't need to match functions/.env.
+  process.env.TOKEN_ENCRYPTION_KEY = "11".repeat(32);
+  process.env.GDRIVE_TOKEN_URL = "https://gdrive-token.mock.test/token";
+  process.env.GDRIVE_CLIENT_ID = "test-gdrive-client-id";
+  process.env.GDRIVE_CLIENT_SECRET = "test-gdrive-client-secret";
+});
+
+afterAll(() => {
+  process.env.TOKEN_ENCRYPTION_KEY = ORIGINAL_ENV.TOKEN_ENCRYPTION_KEY;
+  process.env.GDRIVE_TOKEN_URL = ORIGINAL_ENV.GDRIVE_TOKEN_URL;
+  process.env.GDRIVE_CLIENT_ID = ORIGINAL_ENV.GDRIVE_CLIENT_ID;
+  process.env.GDRIVE_CLIENT_SECRET = ORIGINAL_ENV.GDRIVE_CLIENT_SECRET;
+  global.fetch = ORIGINAL_FETCH;
+});
+
+beforeEach(() => {
+  global.fetch = jest.fn();
+});
+
+// A tolerance window for timestamp assertions -- generous enough to absorb
+// emulator/test round-trip latency without hiding a genuinely wrong duration
+// (mirrors collision-cache.test.js's TOLERANCE_MS).
+const TOLERANCE_MS = 5000;
+
+function header(headers, name) {
+  if (!headers) return undefined;
+  const key = Object.keys(headers).find((k) => k.toLowerCase() === name.toLowerCase());
+  return key ? headers[key] : undefined;
+}
+
+async function createGdriveUser(uid, overrides = {}) {
+  const gdrive = {
+    authMethod: "oauth2",
+    encryptedToken: "plain-access-token",
+    encryptedRefreshToken: "plain-refresh-token",
+    tokenExpiresAt: Date.now() + 60 * 60 * 1000,
+    providerAccountId: "acct-1",
+    ...overrides,
+  };
+  await db.collection("users").doc(uid).set({ connectedAccounts: { gdrive } });
+  return gdrive;
+}
+
+async function getUserData(uid) {
+  const snap = await db.collection("users").doc(uid).get();
+  return snap.data();
+}
+
+describe("8. unexpired gdrive token", () => {
+  it("returns the decrypted token directly, without calling the token endpoint", async () => {
+    const uid = `gdrive-resolve-8-${randomUUID()}`;
+    await createGdriveUser(uid, { encryptedToken: "unexpired-access-token-8" });
+    const userData = await getUserData(uid);
+    const expData = { storageProvider: "gdrive", owner: uid };
+
+    const result = await resolveToken(userData, expData);
+
+    expect(result).toEqual({ success: true, token: "unexpired-access-token-8" });
+    expect(global.fetch).not.toHaveBeenCalled();
+  });
+});
+
+describe("9. expired gdrive token triggers a refresh", () => {
+  it("POSTs the refresh grant with client credentials, and persists the new token/expiry encrypted, including refresh-token rotation", async () => {
+    const uid = `gdrive-resolve-9-${randomUUID()}`;
+    await createGdriveUser(uid, {
+      encryptedToken: "stale-access-token-9",
+      encryptedRefreshToken: "refresh-token-9",
+      tokenExpiresAt: Date.now() - 1000, // already expired
+    });
+
+    global.fetch.mockResolvedValueOnce({
+      ok: true,
+      json: () =>
+        Promise.resolve({
+          access_token: "new-access-token-9",
+          expires_in: 3600,
+          refresh_token: "new-refresh-token-9",
+        }),
+    });
+
+    const userData = await getUserData(uid);
+    const expData = { storageProvider: "gdrive", owner: uid };
+
+    const before = Date.now();
+    const result = await resolveToken(userData, expData);
+    const after = Date.now();
+
+    expect(result).toEqual({ success: true, token: "new-access-token-9" });
+
+    expect(global.fetch).toHaveBeenCalledTimes(1);
+    const [url, options] = global.fetch.mock.calls[0];
+    expect(url).toBe(process.env.GDRIVE_TOKEN_URL);
+    expect(options.method).toBe("POST");
+    expect(header(options.headers, "Content-Type")).toContain("application/x-www-form-urlencoded");
+
+    const bodyParams = new URLSearchParams(options.body);
+    expect(bodyParams.get("grant_type")).toBe("refresh_token");
+    expect(bodyParams.get("refresh_token")).toBe("refresh-token-9");
+    expect(bodyParams.get("client_id")).toBe("test-gdrive-client-id");
+    expect(bodyParams.get("client_secret")).toBe("test-gdrive-client-secret");
+
+    const persisted = await getUserData(uid);
+    const gdrive = persisted.connectedAccounts.gdrive;
+    expect(decrypt(gdrive.encryptedToken)).toBe("new-access-token-9");
+    expect(decrypt(gdrive.encryptedRefreshToken)).toBe("new-refresh-token-9"); // rotated
+    expect(gdrive.tokenExpiresAt).toBeGreaterThanOrEqual(before + 3600 * 1000 - TOLERANCE_MS);
+    expect(gdrive.tokenExpiresAt).toBeLessThanOrEqual(after + 3600 * 1000 + TOLERANCE_MS);
+  });
+
+  it("keeps the existing refresh token when the response does not include a rotated one", async () => {
+    const uid = `gdrive-resolve-9b-${randomUUID()}`;
+    await createGdriveUser(uid, {
+      encryptedToken: "stale-access-token-9b",
+      encryptedRefreshToken: "refresh-token-9b-unrotated",
+      tokenExpiresAt: Date.now() - 1000,
+    });
+
+    global.fetch.mockResolvedValueOnce({
+      ok: true,
+      json: () =>
+        Promise.resolve({
+          access_token: "new-access-token-9b",
+          expires_in: 1800,
+          // no refresh_token field -- no rotation offered
+        }),
+    });
+
+    const userData = await getUserData(uid);
+    const expData = { storageProvider: "gdrive", owner: uid };
+
+    const result = await resolveToken(userData, expData);
+
+    expect(result).toEqual({ success: true, token: "new-access-token-9b" });
+
+    const persisted = await getUserData(uid);
+    const gdrive = persisted.connectedAccounts.gdrive;
+    expect(decrypt(gdrive.encryptedToken)).toBe("new-access-token-9b");
+    expect(decrypt(gdrive.encryptedRefreshToken)).toBe("refresh-token-9b-unrotated");
+  });
+});
+
+describe("10. resolve failures", () => {
+  it("returns INVALID_REFRESH_TOKEN when the refresh request fails", async () => {
+    const uid = `gdrive-resolve-10a-${randomUUID()}`;
+    await createGdriveUser(uid, {
+      encryptedToken: "stale-access-token-10a",
+      encryptedRefreshToken: "bad-refresh-token-10a",
+      tokenExpiresAt: Date.now() - 1000,
+    });
+
+    global.fetch.mockResolvedValueOnce({
+      ok: false,
+      status: 400,
+      text: () => Promise.resolve("invalid_grant"),
+    });
+
+    const userData = await getUserData(uid);
+    const expData = { storageProvider: "gdrive", owner: uid };
+
+    const result = await resolveToken(userData, expData);
+
+    expect(result.success).toBe(false);
+    expect(result.error).toBe("INVALID_REFRESH_TOKEN");
+    expect(typeof result.detail).toBe("string");
+    expect(result.detail.length).toBeGreaterThan(0);
+  });
+
+  it("returns PROVIDER_NOT_CONNECTED when the user has no connectedAccounts.gdrive at all", async () => {
+    const uid = `gdrive-resolve-10b-${randomUUID()}`;
+    await db.collection("users").doc(uid).set({}); // no connectedAccounts field whatsoever
+
+    const userData = await getUserData(uid);
+    const expData = { storageProvider: "gdrive", owner: uid };
+
+    const result = await resolveToken(userData, expData);
+
+    expect(result.success).toBe(false);
+    expect(result.error).toBe("PROVIDER_NOT_CONNECTED");
+    expect(typeof result.detail).toBe("string");
+    expect(global.fetch).not.toHaveBeenCalled();
+  });
+});
+
+describe("11. osf-experiment dispatch unchanged (regression guard)", () => {
+  it("still returns the decrypted PAT for a personal-token OSF user -- expected to PASS today, unaffected by the gdrive generalization", async () => {
+    const userData = {
+      usingPersonalToken: true,
+      osfTokenValid: true,
+      osfToken: "valid-osf-pat-11",
+    };
+    // storageProvider deliberately absent -- legacy OSF experiment.
+    const expData = { owner: "osf-owner-11" };
+
+    const result = await resolveToken(userData, expData);
+
+    expect(result).toEqual({ success: true, token: "valid-osf-pat-11" });
+    expect(global.fetch).not.toHaveBeenCalled();
+  });
+});
diff --git a/functions/src/__tests__/upload-queue.test.js b/functions/src/__tests__/upload-queue.test.js
index dd33fb0..19362a2 100644
--- a/functions/src/__tests__/upload-queue.test.js
+++ b/functions/src/__tests__/upload-queue.test.js
@@ -198,7 +198,7 @@ describe("queue entry lifecycle in Firestore", () => {
       await docRef.update({
         status: "failed",
         retryCount: newRetryCount,
-        failureReason: "OSF error 500: Internal Server Error",
+        failureReason: "Provider error 500: Internal Server Error",
       });
     }
 
@@ -206,7 +206,7 @@ describe("queue entry lifecycle in Firestore", () => {
     expect(result.data().status).toBe("failed");
     expect(result.data().retryCount).toBe(5);
     expect(result.data().failureReason).toBe(
-      "OSF error 500: Internal Server Error"
+      "Provider error 500: Internal Server Error"
     );
   });
 });
diff --git a/functions/src/api-base64.ts b/functions/src/api-base64.ts
index 46173d7..90c9fa9 100644
--- a/functions/src/api-base64.ts
+++ b/functions/src/api-base64.ts
@@ -1,6 +1,6 @@
 import { onRequest } from "firebase-functions/v2/https";
+import { randomUUID } from "crypto";
 import { DocumentReference, DocumentData, DocumentSnapshot } from "firebase-admin/firestore";
-import putFileOSF from "./put-file-osf.js";
 import { db } from "./app.js";
 import writeLog from "./write-log.js";
 import isBase64 from "is-base64";
@@ -8,7 +8,10 @@ import MESSAGES from "./api-messages.js";
 import resolveToken from "./resolve-token.js";
 import queueUpload from "./queue-upload.js";
 import { persistPending, cleanupPending } from "./persist-pending.js";
-import { ExperimentData, UserData, OSFResult } from './interfaces';
+import { getProviderForExperiment } from "./providers/index.js";
+import { WriteResult } from "./providers/types.js";
+import { claimFilename, confirmClaim, CollisionCacheUnavailableError } from "./collision-cache.js";
+import { ExperimentData, UserData } from './interfaces';
 
 export const apiBase64 = onRequest({ cors: true, memory: "512MiB", concurrency: 1 }, async (req, res) => {
   const { experimentID, data, filename } = req.body;
@@ -112,23 +115,93 @@ export const apiBase64 = onRequest({ cors: true, memory: "512MiB", concurrency:
 
   const token = tokenResult.token;
 
-  let result: OSFResult;
+  const { provider, container } = getProviderForExperiment(exp_data);
+
+  // Collision detection: claim the filename in the Firestore cache
+  // immediately before the provider write. The provider's own conflict
+  // response (NAME_CONFLICT) stays wired up below as a dual-run backstop.
+  const claimToken = randomUUID();
+  let claimResult: Awaited<ReturnType<typeof claimFilename>>;
   try {
-    result = await putFileOSF(
-      exp_data.osfFilesLink,
-      token,
+    claimResult = await claimFilename(experimentID, filename, claimToken, () =>
+      provider.listFiles({ token }, container)
+    );
+  } catch (e) {
+    if (e instanceof CollisionCacheUnavailableError) {
+      const detail = e.message;
+      try {
+        await queueUpload({
+          experimentID, owner: exp_data.owner, filename, data,
+          dataType: "base64", osfFilesLink: exp_data.osfFilesLink,
+          storageProvider: exp_data.storageProvider, providerContainer: exp_data.providerContainer,
+          errorCode: 0, sessionIncremented: false,
+          failureReason: `Collision cache rehydration failed: ${detail}`,
+          claimToken,
+        });
+        await cleanupPending(pendingPath); // queue-upload has its own copy
+        res.status(202).json(MESSAGES.OSF_UPLOAD_QUEUED);
+        await writeLog(experimentID, "logError", {...MESSAGES.OSF_UPLOAD_EXCEPTION, detail: `Collision cache rehydration failed: ${detail}`});
+        return;
+      } catch {
+        res.status(500).json(MESSAGES.OSF_UPLOAD_EXCEPTION);
+        await writeLog(experimentID, "logError", {...MESSAGES.OSF_UPLOAD_EXCEPTION, detail});
+        return;
+      }
+    }
+    throw e;
+  }
+
+  if (!claimResult.claimed) {
+    if (claimResult.reason === "duplicate") {
+      await cleanupPending(pendingPath);
+      res.status(400).json(MESSAGES.OSF_FILE_EXISTS);
+      await writeLog(experimentID, "logError", MESSAGES.OSF_FILE_EXISTS);
+      return;
+    }
+
+    // reason === "rehydrating" — another request holds the rehydration
+    // lease; queue this upload and let the retry land after it expires.
+    try {
+      await queueUpload({
+        experimentID, owner: exp_data.owner, filename, data,
+        dataType: "base64", osfFilesLink: exp_data.osfFilesLink,
+        storageProvider: exp_data.storageProvider, providerContainer: exp_data.providerContainer,
+        errorCode: 0, sessionIncremented: false,
+        failureReason: "Collision cache rehydrating",
+        claimToken,
+      });
+      await cleanupPending(pendingPath); // queue-upload has its own copy
+      res.status(202).json(MESSAGES.OSF_UPLOAD_QUEUED);
+      await writeLog(experimentID, "logError", {...MESSAGES.OSF_UPLOAD_EXCEPTION, detail: "Collision cache rehydrating"});
+      return;
+    } catch {
+      res.status(500).json(MESSAGES.OSF_UPLOAD_EXCEPTION);
+      await writeLog(experimentID, "logError", {...MESSAGES.OSF_UPLOAD_EXCEPTION, detail: "Collision cache rehydrating"});
+      return;
+    }
+  }
+
+  let result: WriteResult;
+  try {
+    result = await provider.writeSessionFile(
+      { token },
+      container,
+      filename,
       buffer,
-      filename
+      { size: buffer.length, contentType: "application/octet-stream" }
     );
   } catch (e) {
-    // Network errors, timeouts, etc. — queue for retry
+    // Network errors, timeouts, etc. — queue for retry. The claim stays
+    // pending so the retry can re-enter it with the same token.
     const detail = e instanceof Error ? e.message : "Unknown error";
     try {
       await queueUpload({
         experimentID, owner: exp_data.owner, filename, data,
         dataType: "base64", osfFilesLink: exp_data.osfFilesLink,
+        storageProvider: exp_data.storageProvider, providerContainer: exp_data.providerContainer,
         errorCode: 0, sessionIncremented: false,
         failureReason: `Upload exception: ${detail}`,
+        claimToken,
       });
       await cleanupPending(pendingPath); // queue-upload has its own copy
       res.status(202).json(MESSAGES.OSF_UPLOAD_QUEUED);
@@ -142,30 +215,48 @@ export const apiBase64 = onRequest({ cors: true, memory: "512MiB", concurrency:
   }
 
   if (!result.success) {
-    if (result.errorCode === 409 && result.errorText === "Conflict") {
-      res.status(400).json(MESSAGES.OSF_FILE_EXISTS);
+    if (result.error === "NAME_CONFLICT" && result.providerMessage === "Conflict") {
+      // Dual-run disagreement: the cache thought the name was free but OSF
+      // says it's taken. OSF is still the backstop — record the
+      // disagreement and confirm the claim (the name is now provably taken).
+      await confirmClaim(experimentID, filename, claimToken);
+      // Logs before response — see the matching comment in api-data.ts:
+      // responding first races observers of the log against the write.
       await writeLog(experimentID, "logError", MESSAGES.OSF_FILE_EXISTS);
+      await writeLog(experimentID, "logError", {
+        collisionCacheDisagreement: true,
+        direction: "cache-free-provider-conflict",
+      });
+      await cleanupPending(pendingPath);
+      res.status(400).json(MESSAGES.OSF_FILE_EXISTS);
       return;
     }
-    // Queue all other failures for retry
+    // Queue all other failures for retry. The claim stays pending so the
+    // retry can re-enter it with the same token.
     try {
       await queueUpload({
         experimentID, owner: exp_data.owner, filename, data,
         dataType: "base64", osfFilesLink: exp_data.osfFilesLink,
-        errorCode: result.errorCode || 0, sessionIncremented: false,
-        failureReason: `OSF error ${result.errorCode}: ${result.errorText}`,
+        storageProvider: exp_data.storageProvider, providerContainer: exp_data.providerContainer,
+        errorCode: result.providerStatus || 0, sessionIncremented: false,
+        failureReason: `Provider error ${result.providerStatus}: ${result.providerMessage}`,
+        claimToken,
       });
       await cleanupPending(pendingPath); // queue-upload has its own copy
       res.status(202).json(MESSAGES.OSF_UPLOAD_QUEUED);
-      await writeLog(experimentID, "logError", {...MESSAGES.OSF_UPLOAD_ERROR, osfStatus: result.errorCode, osfStatusText: result.errorText});
+      await writeLog(experimentID, "logError", {...MESSAGES.OSF_UPLOAD_ERROR, osfStatus: result.providerStatus, osfStatusText: result.providerMessage});
       return;
     } catch {
       res.status(400).json(MESSAGES.OSF_UPLOAD_ERROR);
-      await writeLog(experimentID, "logError", {...MESSAGES.OSF_UPLOAD_ERROR, osfStatus: result.errorCode, osfStatusText: result.errorText});
+      await writeLog(experimentID, "logError", {...MESSAGES.OSF_UPLOAD_ERROR, osfStatus: result.providerStatus, osfStatusText: result.providerMessage});
       return;
     }
   }
 
+  // Successful write — confirm the claim (best-effort; a confirm failure
+  // must not fail a request that already succeeded against the provider).
+  await confirmClaim(experimentID, filename, claimToken);
+
   // Data successfully uploaded to OSF — clean up the pending copy.
   await cleanupPending(pendingPath);
 
diff --git a/functions/src/api-data.ts b/functions/src/api-data.ts
index c9c36f9..3852208 100644
--- a/functions/src/api-data.ts
+++ b/functions/src/api-data.ts
@@ -1,8 +1,8 @@
 import { onRequest } from "firebase-functions/v2/https";
+import { randomUUID } from "crypto";
 import { FieldValue, DocumentReference, DocumentData, DocumentSnapshot } from "firebase-admin/firestore";
 import validateJSON from "./validate-json.js";
 import validateCSV from "./validate-csv.js";
-import putFileOSF from "./put-file-osf.js";
 import { db } from "./app.js";
 import writeLog from "./write-log.js";
 import MESSAGES from "./api-messages.js";
@@ -12,7 +12,10 @@ import { uploadDerivedFiles, queueDerivedFiles } from "./metadata-derived-upload
 import resolveToken from "./resolve-token.js";
 import queueUpload from "./queue-upload.js";
 import { persistPending, cleanupPending } from "./persist-pending.js";
-import { ExperimentData, UserData, OSFResult, RequestBody } from './interfaces';
+import { getProviderForExperiment } from "./providers/index.js";
+import { WriteResult } from "./providers/types.js";
+import { claimFilename, confirmClaim, CollisionCacheUnavailableError } from "./collision-cache.js";
+import { ExperimentData, UserData, RequestBody } from './interfaces';
 
 export const apiData = onRequest({ cors: true, memory: "512MiB", concurrency: 1 }, async (req, res) => {
   const { experimentID, data, filename, metadataOptions }: RequestBody = req.body;
@@ -152,33 +155,113 @@ export const apiData = onRequest({ cors: true, memory: "512MiB", concurrency: 1
     derivedFiles = metadataResponse.derivedFiles ?? [];
   }
 
-  const derivedTarget = { experimentID, owner: exp_data.owner, osfFilesLink: exp_data.osfFilesLink };
+  const derivedTarget = {
+    experimentID,
+    owner: exp_data.owner,
+    storageProvider: exp_data.storageProvider,
+    providerContainer: exp_data.providerContainer,
+    osfFilesLink: exp_data.osfFilesLink,
+  };
 
   //METADATA BLOCK END
 
+  const { provider, container } = getProviderForExperiment(exp_data);
+
   //With metadata on, the raw submission is the critical upload and lives at
   //data/raw/<original name> in the Psych-DS layout (the CSVs above are derived
   //from it). Session counting and queue-on-failure key off this file. With
   //metadata off, the layout is unchanged: the raw file goes to the root.
   const uploadFilename = uploadPathFor(exp_data.metadataActive, filename);
 
-  let result: OSFResult;
+  // Collision detection: claim the filename in the Firestore cache
+  // immediately before the provider write. The provider's own conflict
+  // response (NAME_CONFLICT) stays wired up below as a dual-run backstop.
+  // Claimed on the RAW leaf filename (unchanged by the Psych-DS layout), not
+  // uploadFilename, so dedup keys off what the participant actually submitted.
+  const claimToken = randomUUID();
+  let claimResult: Awaited<ReturnType<typeof claimFilename>>;
+  try {
+    claimResult = await claimFilename(experimentID, filename, claimToken, () =>
+      provider.listFiles({ token }, container)
+    );
+  } catch (e) {
+    if (e instanceof CollisionCacheUnavailableError) {
+      const detail = e.message;
+      try {
+        await queueUpload({
+          experimentID, owner: exp_data.owner, filename, data,
+          dataType: "data", osfFilesLink: exp_data.osfFilesLink,
+          storageProvider: exp_data.storageProvider, providerContainer: exp_data.providerContainer,
+          errorCode: 0, sessionIncremented: true,
+          failureReason: `Collision cache rehydration failed: ${detail}`,
+          claimToken,
+        });
+        await exp_doc_ref.set({ sessions: FieldValue.increment(1) }, { merge: true });
+        await cleanupPending(pendingPath); // queue-upload has its own copy
+        res.status(202).json({...MESSAGES.OSF_UPLOAD_QUEUED, metadataMessage});
+        await writeLog(experimentID, "logError", {...MESSAGES.OSF_UPLOAD_EXCEPTION, detail: `Collision cache rehydration failed: ${detail}`});
+        return;
+      } catch {
+        res.status(500).json({...MESSAGES.OSF_UPLOAD_EXCEPTION, metadataMessage});
+        await writeLog(experimentID, "logError", {...MESSAGES.OSF_UPLOAD_EXCEPTION, detail});
+        return;
+      }
+    }
+    throw e;
+  }
+
+  if (!claimResult.claimed) {
+    if (claimResult.reason === "duplicate") {
+      await cleanupPending(pendingPath);
+      res.status(400).json({...MESSAGES.OSF_FILE_EXISTS, metadataMessage});
+      await writeLog(experimentID, "logError", MESSAGES.OSF_FILE_EXISTS);
+      return;
+    }
+
+    // reason === "rehydrating" — another request holds the rehydration
+    // lease; queue this upload and let the retry land after it expires.
+    try {
+      await queueUpload({
+        experimentID, owner: exp_data.owner, filename, data,
+        dataType: "data", osfFilesLink: exp_data.osfFilesLink,
+        storageProvider: exp_data.storageProvider, providerContainer: exp_data.providerContainer,
+        errorCode: 0, sessionIncremented: true,
+        failureReason: "Collision cache rehydrating",
+        claimToken,
+      });
+      await exp_doc_ref.set({ sessions: FieldValue.increment(1) }, { merge: true });
+      await cleanupPending(pendingPath); // queue-upload has its own copy
+      res.status(202).json({...MESSAGES.OSF_UPLOAD_QUEUED, metadataMessage});
+      await writeLog(experimentID, "logError", {...MESSAGES.OSF_UPLOAD_EXCEPTION, detail: "Collision cache rehydrating"});
+      return;
+    } catch {
+      res.status(500).json({...MESSAGES.OSF_UPLOAD_EXCEPTION, metadataMessage});
+      await writeLog(experimentID, "logError", {...MESSAGES.OSF_UPLOAD_EXCEPTION, detail: "Collision cache rehydrating"});
+      return;
+    }
+  }
+
+  let result: WriteResult;
   try {
-    result = await putFileOSF(
-      exp_data.osfFilesLink,
-      token,
+    result = await provider.writeSessionFile(
+      { token },
+      container,
+      uploadFilename,
       data,
-      uploadFilename
+      { size: Buffer.byteLength(data), contentType: "application/json" }
     );
   } catch (e) {
-    // Network errors, timeouts, etc. — queue for retry
+    // Network errors, timeouts, etc. — queue for retry. The claim stays
+    // pending so the retry can re-enter it with the same token.
     const detail = e instanceof Error ? e.message : "Unknown error";
     try {
       await queueUpload({
         experimentID, owner: exp_data.owner, filename: uploadFilename, data,
         dataType: "data", osfFilesLink: exp_data.osfFilesLink,
+        storageProvider: exp_data.storageProvider, providerContainer: exp_data.providerContainer,
         errorCode: 0, sessionIncremented: true,
         failureReason: `Upload exception: ${detail}`,
+        claimToken,
       });
       await exp_doc_ref.set({ sessions: FieldValue.increment(1) }, { merge: true });
       await cleanupPending(pendingPath); // queue-upload has its own copy
@@ -195,33 +278,52 @@ export const apiData = onRequest({ cors: true, memory: "512MiB", concurrency: 1
   }
 
   if (!result.success) {
-    if (result.errorCode === 409 && result.errorText === "Conflict") {
-      res.status(400).json({...MESSAGES.OSF_FILE_EXISTS, metadataMessage});
+    if (result.error === "NAME_CONFLICT" && result.providerMessage === "Conflict") {
+      // Dual-run disagreement: the cache thought the name was free but OSF
+      // says it's taken. OSF is still the backstop — record the
+      // disagreement and confirm the claim (the name is now provably taken).
+      await confirmClaim(experimentID, filename, claimToken);
+      // Logs are written BEFORE the response here (unlike other branches):
+      // the disagreement entry is the dual-run's whole audit trail, and
+      // responding first races observers of the log against the write.
       await writeLog(experimentID, "logError", MESSAGES.OSF_FILE_EXISTS);
+      await writeLog(experimentID, "logError", {
+        collisionCacheDisagreement: true,
+        direction: "cache-free-provider-conflict",
+      });
+      await cleanupPending(pendingPath);
+      res.status(400).json({...MESSAGES.OSF_FILE_EXISTS, metadataMessage});
       return;
     }
-    // Queue all other failures for retry
+    // Queue all other failures for retry. The claim stays pending so the
+    // retry can re-enter it with the same token.
     try {
       await queueUpload({
         experimentID, owner: exp_data.owner, filename: uploadFilename, data,
         dataType: "data", osfFilesLink: exp_data.osfFilesLink,
-        errorCode: result.errorCode || 0, sessionIncremented: true,
-        failureReason: `OSF error ${result.errorCode}: ${result.errorText}`,
+        storageProvider: exp_data.storageProvider, providerContainer: exp_data.providerContainer,
+        errorCode: result.providerStatus || 0, sessionIncremented: true,
+        failureReason: `Provider error ${result.providerStatus}: ${result.providerMessage}`,
+        claimToken,
       });
       await exp_doc_ref.set({ sessions: FieldValue.increment(1) }, { merge: true });
       await cleanupPending(pendingPath); // queue-upload has its own copy
       // OSF is failing, so queue the derived files alongside the raw data.
-      await queueDerivedFiles(derivedFiles, derivedTarget, `Queued alongside data file: OSF error ${result.errorCode}`);
+      await queueDerivedFiles(derivedFiles, derivedTarget, `Queued alongside data file: OSF error ${result.providerStatus}`);
       res.status(202).json({...MESSAGES.OSF_UPLOAD_QUEUED, metadataMessage});
-      await writeLog(experimentID, "logError", {...MESSAGES.OSF_UPLOAD_ERROR, osfStatus: result.errorCode, osfStatusText: result.errorText});
+      await writeLog(experimentID, "logError", {...MESSAGES.OSF_UPLOAD_ERROR, osfStatus: result.providerStatus, osfStatusText: result.providerMessage});
       return;
     } catch {
       res.status(400).json({...MESSAGES.OSF_UPLOAD_ERROR, metadataMessage});
-      await writeLog(experimentID, "logError", {...MESSAGES.OSF_UPLOAD_ERROR, osfStatus: result.errorCode, osfStatusText: result.errorText});
+      await writeLog(experimentID, "logError", {...MESSAGES.OSF_UPLOAD_ERROR, osfStatus: result.providerStatus, osfStatusText: result.providerMessage});
       return;
     }
   }
 
+  // Successful write — confirm the claim (best-effort; a confirm failure
+  // must not fail a request that already succeeded against the provider).
+  await confirmClaim(experimentID, filename, claimToken);
+
   await exp_doc_ref.set({ sessions: FieldValue.increment(1) }, { merge: true });
 
   // Data successfully uploaded to OSF — clean up the pending copy.
diff --git a/functions/src/api-messages.ts b/functions/src/api-messages.ts
index cb9bec1..a822bc0 100644
--- a/functions/src/api-messages.ts
+++ b/functions/src/api-messages.ts
@@ -39,6 +39,10 @@ const MESSAGES = {
     error: "INVALID_REFRESH_TOKEN",
     message: "The experiment owner's refresh token is not valid",
   },
+  PROVIDER_NOT_CONNECTED: {
+    error: "PROVIDER_NOT_CONNECTED",
+    message: "The experiment owner has not connected an account for this experiment's storage provider",
+  },
   INVALID_BASE64_DATA: {
     error: "INVALID_BASE64_DATA",
     message: "The data are not valid base64 data",
diff --git a/functions/src/collision-cache.ts b/functions/src/collision-cache.ts
new file mode 100644
index 0000000..b9d999f
--- /dev/null
+++ b/functions/src/collision-cache.ts
@@ -0,0 +1,305 @@
+// Firestore-backed filename collision cache (docs/provider-migration-design.md,
+// scratchpad/step3a-collision-cache-spec.md).
+//
+// Duplicate-filename detection moves out of "ask the provider and interpret
+// its 409" and into a per-experiment Firestore cache of salted filename
+// hashes. The provider's own conflict response stays wired up as a dual-run
+// backstop (see api-data.ts / api-base64.ts): callers keep reacting to
+// NAME_CONFLICT, but only to reconcile with what the cache already believes.
+//
+// Firestore layout:
+//   experiments/{id}.collisionCache: {
+//     salt: string,
+//     warmUntil: Timestamp,
+//     rehydratingUntil?: Timestamp,
+//   }
+//   experiments/{id}/filenameClaims/{sha256hex(salt + ":" + filename)}: {
+//     status: "pending" | "confirmed",
+//     ownerToken: string,
+//     createdAt: Timestamp,
+//     expiresAt: Timestamp,
+//   }
+//
+// The raw filename is never stored anywhere — only its salted hash, used as
+// the claim document's ID.
+
+import { randomBytes, createHash } from "crypto";
+import { Timestamp, FieldValue } from "firebase-admin/firestore";
+import { db } from "./app.js";
+import { FileRef } from "./providers/types.js";
+
+export const CLAIM_TTL_MS = 90 * 24 * 60 * 60 * 1000; // 90 days
+export const STALE_PENDING_TAKEOVER_MS = 15 * 60 * 1000; // 15 minutes
+export const REHYDRATION_LEASE_MS = 60 * 1000; // 60 seconds
+
+// Thrown when a cold cache needs to rehydrate but the caller-supplied
+// listFilesFn fails (e.g. container missing, access revoked). Callers must
+// treat this as "we don't know" and fail loudly rather than silently
+// accepting a possible duplicate.
+export class CollisionCacheUnavailableError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "CollisionCacheUnavailableError";
+  }
+}
+
+export type ClaimResult =
+  | { claimed: true }
+  | { claimed: false; reason: "duplicate" }
+  | { claimed: false; reason: "rehydrating" };
+
+function hashFilename(salt: string, filename: string): string {
+  return createHash("sha256").update(`${salt}:${filename}`).digest("hex");
+}
+
+function experimentRef(experimentID: string) {
+  return db.collection("experiments").doc(experimentID);
+}
+
+function claimsCollection(experimentID: string) {
+  return experimentRef(experimentID).collection("filenameClaims");
+}
+
+// Reads (or lazily creates) the per-experiment salt used to hash filenames.
+// The salt is retained indefinitely and never rotated.
+async function ensureSalt(experimentID: string): Promise<string> {
+  const expRef = experimentRef(experimentID);
+  return db.runTransaction(async (tx) => {
+    const snap = await tx.get(expRef);
+    const existingSalt = snap.data()?.collisionCache?.salt as string | undefined;
+    if (existingSalt) {
+      return existingSalt;
+    }
+    const salt = randomBytes(32).toString("hex");
+    tx.update(expRef, { "collisionCache.salt": salt });
+    return salt;
+  });
+}
+
+async function isCacheWarm(experimentID: string): Promise<boolean> {
+  const snap = await experimentRef(experimentID).get();
+  const warmUntil = snap.data()?.collisionCache?.warmUntil as FirebaseFirestore.Timestamp | undefined;
+  return !!warmUntil && warmUntil.toMillis() > Date.now();
+}
+
+// Rehydrates a cold cache: acquires a short lease, lists every file the
+// provider currently has, and bulk-writes them as confirmed claims. Returns
+// true once the cache is warm, or false if another in-flight request already
+// holds the rehydration lease (caller should surface "rehydrating" rather
+// than block). Throws CollisionCacheUnavailableError if listFilesFn fails —
+// the lease is cleared first so a later request can retry.
+async function rehydrate(
+  experimentID: string,
+  salt: string,
+  listFilesFn: () => Promise<FileRef[]>
+): Promise<boolean> {
+  const expRef = experimentRef(experimentID);
+
+  let acquiredLease = false;
+  await db.runTransaction(async (tx) => {
+    const snap = await tx.get(expRef);
+    const rehydratingUntil = snap.data()?.collisionCache?.rehydratingUntil as
+      | FirebaseFirestore.Timestamp
+      | undefined;
+    if (rehydratingUntil && rehydratingUntil.toMillis() > Date.now()) {
+      acquiredLease = false;
+      return;
+    }
+    const leaseUntil = Timestamp.fromMillis(Date.now() + REHYDRATION_LEASE_MS);
+    tx.update(expRef, { "collisionCache.rehydratingUntil": leaseUntil });
+    acquiredLease = true;
+  });
+
+  if (!acquiredLease) {
+    return false;
+  }
+
+  let files: FileRef[];
+  try {
+    files = await listFilesFn();
+  } catch (e) {
+    // Clear the lease so a subsequent claim attempts rehydration again
+    // rather than being locked out until the lease naturally expires.
+    await expRef.update({ "collisionCache.rehydratingUntil": FieldValue.delete() });
+    const detail = e instanceof Error ? e.message : String(e);
+    throw new CollisionCacheUnavailableError(
+      `Rehydration failed for experiment ${experimentID}: ${detail}`
+    );
+  }
+
+  const now = Timestamp.now();
+  const expiresAt = Timestamp.fromMillis(now.toMillis() + CLAIM_TTL_MS);
+  const claims = claimsCollection(experimentID);
+
+  for (let i = 0; i < files.length; i += 500) {
+    const chunk = files.slice(i, i + 500);
+    const batch = db.batch();
+    for (const file of chunk) {
+      const hash = hashFilename(salt, file.name);
+      batch.set(claims.doc(hash), {
+        status: "confirmed",
+        ownerToken: "rehydration",
+        createdAt: now,
+        expiresAt,
+      });
+    }
+    await batch.commit();
+  }
+
+  const warmUntil = Timestamp.fromMillis(Date.now() + CLAIM_TTL_MS);
+  await expRef.update({
+    "collisionCache.warmUntil": warmUntil,
+    "collisionCache.rehydratingUntil": FieldValue.delete(),
+  });
+
+  return true;
+}
+
+async function attemptClaim(
+  experimentID: string,
+  filename: string,
+  ownerToken: string,
+  salt: string
+): Promise<ClaimResult> {
+  const hash = hashFilename(salt, filename);
+  const claimRef = claimsCollection(experimentID).doc(hash);
+
+  return db.runTransaction(async (tx): Promise<ClaimResult> => {
+    const snap = await tx.get(claimRef);
+    const now = Timestamp.now();
+    const expiresAt = Timestamp.fromMillis(now.toMillis() + CLAIM_TTL_MS);
+
+    if (!snap.exists) {
+      tx.set(claimRef, { status: "pending", ownerToken, createdAt: now, expiresAt });
+      return { claimed: true };
+    }
+
+    const data = snap.data()!;
+
+    if (data.status === "pending") {
+      if (data.ownerToken === ownerToken) {
+        // Idempotent re-entry — the retry queue re-claiming its own filename.
+        return { claimed: true };
+      }
+
+      const createdAtMs = (data.createdAt as FirebaseFirestore.Timestamp).toMillis();
+      if (Date.now() - createdAtMs > STALE_PENDING_TAKEOVER_MS) {
+        tx.set(claimRef, { status: "pending", ownerToken, createdAt: now, expiresAt });
+        return { claimed: true };
+      }
+    }
+
+    // confirmed, or a fresh pending claim owned by someone else.
+    return { claimed: false, reason: "duplicate" };
+  });
+}
+
+export async function claimFilename(
+  experimentID: string,
+  filename: string,
+  ownerToken: string,
+  listFilesFn: () => Promise<FileRef[]>
+): Promise<ClaimResult> {
+  const salt = await ensureSalt(experimentID);
+
+  const warm = await isCacheWarm(experimentID);
+  if (!warm) {
+    const nowWarm = await rehydrate(experimentID, salt, listFilesFn);
+    if (!nowWarm) {
+      return { claimed: false, reason: "rehydrating" };
+    }
+  }
+
+  return attemptClaim(experimentID, filename, ownerToken, salt);
+}
+
+// Best-effort: marks a claim confirmed and bumps the cache's warmUntil.
+// Never throws — a confirm failure must not fail the request that already
+// succeeded (or was provably a name conflict) against the provider. Missing
+// claims / salt / owner mismatches are logged, not thrown.
+export async function confirmClaim(
+  experimentID: string,
+  filename: string,
+  ownerToken: string
+): Promise<void> {
+  try {
+    const expRef = experimentRef(experimentID);
+    const expSnap = await expRef.get();
+    const salt = expSnap.data()?.collisionCache?.salt as string | undefined;
+    if (!salt) {
+      console.error(
+        `confirmClaim: no collisionCache.salt for experiment ${experimentID}; cannot confirm claim`
+      );
+      return;
+    }
+
+    const hash = hashFilename(salt, filename);
+    const claimRef = claimsCollection(experimentID).doc(hash);
+
+    // The experiment doc already takes one write per submission (the sessions
+    // increment); bumping warmUntil on every confirm would double that under
+    // burst load. Skip the bump while warmUntil is still comfortably in the
+    // future — a day of drift is irrelevant against a 90-day window.
+    const currentWarmUntil = expSnap.data()?.collisionCache?.warmUntil as
+      | FirebaseFirestore.Timestamp
+      | undefined;
+
+    await db.runTransaction(async (tx) => {
+      const claimSnap = await tx.get(claimRef);
+      if (!claimSnap.exists) {
+        console.error(`confirmClaim: no claim doc found for experiment ${experimentID}`);
+        return;
+      }
+
+      const data = claimSnap.data()!;
+      if (data.ownerToken !== ownerToken) {
+        console.error(`confirmClaim: owner token mismatch for experiment ${experimentID}`);
+        return;
+      }
+
+      const now = Timestamp.now();
+      const expiresAt = Timestamp.fromMillis(now.toMillis() + CLAIM_TTL_MS);
+      tx.update(claimRef, { status: "confirmed", expiresAt });
+      const warmEnough =
+        currentWarmUntil &&
+        currentWarmUntil.toMillis() > now.toMillis() + CLAIM_TTL_MS - 24 * 60 * 60 * 1000;
+      if (!warmEnough) {
+        tx.update(expRef, { "collisionCache.warmUntil": expiresAt });
+      }
+    });
+  } catch (e) {
+    console.error(
+      `confirmClaim failed for experiment ${experimentID}, filename ${filename}:`,
+      e instanceof Error ? e.message : e
+    );
+  }
+}
+
+// Deletes a claim only if it is still pending and owned by the given token —
+// a no-op with the wrong token or for a confirmed claim.
+export async function releaseClaim(
+  experimentID: string,
+  filename: string,
+  ownerToken: string
+): Promise<void> {
+  const expRef = experimentRef(experimentID);
+  const expSnap = await expRef.get();
+  const salt = expSnap.data()?.collisionCache?.salt as string | undefined;
+  if (!salt) {
+    return;
+  }
+
+  const hash = hashFilename(salt, filename);
+  const claimRef = claimsCollection(experimentID).doc(hash);
+
+  await db.runTransaction(async (tx) => {
+    const snap = await tx.get(claimRef);
+    if (!snap.exists) {
+      return;
+    }
+    const data = snap.data()!;
+    if (data.status === "pending" && data.ownerToken === ownerToken) {
+      tx.delete(claimRef);
+    }
+  });
+}
diff --git a/functions/src/connect-provider.ts b/functions/src/connect-provider.ts
new file mode 100644
index 0000000..bb57964
--- /dev/null
+++ b/functions/src/connect-provider.ts
@@ -0,0 +1,193 @@
+// Provider connect/disconnect flow (docs/provider-migration-design.md,
+// scratchpad/step4b-oauth-connect-spec.md).
+//
+// This is a storage GRANT flow for already-authenticated users, distinct
+// from oauth2-callback.ts's OSF IDENTITY flow (signup/sign-in/account
+// linking, Firebase custom tokens). There is no signup path here, ever —
+// the caller must already hold a valid Firebase idToken for the uid they
+// claim.
+
+import { onRequest } from "firebase-functions/v2/https";
+import { FieldValue } from "firebase-admin/firestore";
+import { db, auth } from "./app.js";
+import { encrypt } from "./crypto-utils.js";
+import { getOAuthConfig } from "./providers/oauth-config.js";
+
+export type AuthCheckResult =
+  | { ok: true }
+  | { ok: false; status: number; error: string };
+
+export async function verifyOwnership(uid: string, idToken: string | undefined): Promise<AuthCheckResult> {
+  if (!idToken) {
+    return { ok: false, status: 401, error: 'Authentication required' };
+  }
+  try {
+    const decodedToken = await auth.verifyIdToken(idToken);
+    if (decodedToken.uid !== uid) {
+      return { ok: false, status: 403, error: 'User ID does not match authenticated user' };
+    }
+    return { ok: true };
+  } catch {
+    return { ok: false, status: 401, error: 'Invalid authentication token' };
+  }
+}
+
+export const connectProvider = onRequest({ cors: true }, async (req, res) => {
+  try {
+    if (req.method !== 'POST') {
+      res.status(405).json({ error: 'Method not allowed' });
+      return;
+    }
+
+    const { provider, code, state, uid, idToken } = req.body || {};
+
+    if (!provider || !code || !state || !uid) {
+      res.status(400).json({ error: 'Missing required parameters' });
+      return;
+    }
+
+    let config;
+    try {
+      config = getOAuthConfig(provider);
+    } catch {
+      res.status(400).json({ error: 'Unknown provider' });
+      return;
+    }
+
+    // Server-side CSRF validation: verify the state was issued by our
+    // server. Same oauth_states collection + semantics as the OSF callback
+    // (oauth2-callback.ts): exists, not expired, single-use delete.
+    const stateRef = db.collection('oauth_states').doc(state);
+    const stateDoc = await stateRef.get();
+    if (!stateDoc.exists) {
+      res.status(400).json({ error: 'Invalid state parameter' });
+      return;
+    }
+    const stateData = stateDoc.data();
+    if (stateData && stateData.expiresAt < Date.now()) {
+      await stateRef.delete();
+      res.status(400).json({ error: 'State parameter has expired' });
+      return;
+    }
+    // Delete after use — each state token is single-use.
+    await stateRef.delete();
+
+    // The state must have been issued for this exact provider (a legacy
+    // OSF state, issued with no provider at all, must never be accepted
+    // here).
+    if (!stateData || stateData.provider !== provider) {
+      res.status(400).json({ error: 'State was not issued for this provider' });
+      return;
+    }
+
+    // Verify that the caller owns the uid they claim. No signup path here.
+    const authCheck = await verifyOwnership(uid, idToken);
+    if (!authCheck.ok) {
+      res.status(authCheck.status).json({ error: authCheck.error });
+      return;
+    }
+
+    // Exchange the authorization code for tokens.
+    const params = new URLSearchParams({
+      code,
+      client_id: config.clientId,
+      client_secret: config.clientSecret,
+      redirect_uri: config.redirectUri,
+      grant_type: 'authorization_code',
+    });
+
+    let tokenResponse: Response;
+    try {
+      tokenResponse = await fetch(config.tokenUrl, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: params.toString(),
+      });
+    } catch (e) {
+      console.error('Token exchange network error:', e instanceof Error ? e.message : 'Unknown error');
+      res.status(400).json({ error: 'Token exchange failed' });
+      return;
+    }
+
+    if (!tokenResponse.ok) {
+      const errorText = await tokenResponse.text();
+      console.error('Token exchange failed:', errorText);
+      res.status(400).json({ error: 'Token exchange failed' });
+      return;
+    }
+
+    const tokenData = await tokenResponse.json();
+
+    // Hard-fail on a missing refresh_token: Google only issues one with
+    // access_type=offline&prompt=consent, so its absence means we'd
+    // otherwise persist a half-connected account with no way to refresh.
+    if (!tokenData.access_token || !tokenData.refresh_token || !tokenData.expires_in) {
+      res.status(400).json({ error: 'Token exchange failed' });
+      return;
+    }
+
+    // Dot-path persist via set()+mergeFields: creates users/{uid} if it
+    // doesn't exist yet (a freshly-signed-up user may have no Firestore
+    // doc at all), while touching only connectedAccounts.<provider> and
+    // leaving any sibling provider connections untouched.
+    const fieldPath = `connectedAccounts.${provider}`;
+    await db.doc(`users/${uid}`).set(
+      {
+        connectedAccounts: {
+          [provider]: {
+            authMethod: 'oauth2',
+            encryptedToken: encrypt(tokenData.access_token),
+            encryptedRefreshToken: encrypt(tokenData.refresh_token),
+            tokenExpiresAt: Date.now() + tokenData.expires_in * 1000,
+          },
+        },
+      },
+      { mergeFields: [fieldPath] }
+    );
+
+    res.status(200).json({ success: true, provider });
+  } catch (error) {
+    console.error('Error connecting provider:', error instanceof Error ? error.message : 'Unknown error');
+    res.status(500).json({ error: 'Failed to connect provider' });
+  }
+});
+
+export const disconnectProvider = onRequest({ cors: true }, async (req, res) => {
+  try {
+    if (req.method !== 'POST') {
+      res.status(405).json({ error: 'Method not allowed' });
+      return;
+    }
+
+    const { provider, uid, idToken } = req.body || {};
+
+    if (!provider || !uid) {
+      res.status(400).json({ error: 'Missing required parameters' });
+      return;
+    }
+
+    try {
+      getOAuthConfig(provider);
+    } catch {
+      res.status(400).json({ error: 'Unknown provider' });
+      return;
+    }
+
+    const authCheck = await verifyOwnership(uid, idToken);
+    if (!authCheck.ok) {
+      res.status(authCheck.status).json({ error: authCheck.error });
+      return;
+    }
+
+    await db.doc(`users/${uid}`).update({
+      [`connectedAccounts.${provider}`]: FieldValue.delete(),
+    });
+
+    res.status(200).json({ success: true });
+  } catch (error) {
+    console.error('Error disconnecting provider:', error instanceof Error ? error.message : 'Unknown error');
+    res.status(500).json({ error: 'Failed to disconnect provider' });
+  }
+});
diff --git a/functions/src/create-experiment.ts b/functions/src/create-experiment.ts
new file mode 100644
index 0000000..32c22a2
--- /dev/null
+++ b/functions/src/create-experiment.ts
@@ -0,0 +1,173 @@
+// Server-side experiment creation for non-OSF storage providers
+// (scratchpad/step7a-create-endpoint-spec.md, docs/provider-migration-design.md).
+//
+// OSF experiment creation stays entirely browser-driven (see
+// lib/experiment-creation.js) -- the browser calls the OSF API directly and
+// batch-writes Firestore with a Firebase client SDK, which is fine because
+// the OSF token flow already lives client-side. New providers (starting with
+// gdrive) need a server-side path instead: createDataContainer is
+// server-only (it needs the decrypted, possibly-refreshed provider token
+// that only resolve-token.ts can produce), and the resulting container ref
+// must be folded into the experiment doc atomically with its creation.
+//
+// This endpoint intentionally mirrors createExperimentDocument in
+// lib/experiment-creation.js field-for-field (including the
+// requiredFields: ["trial_type"] default, which the client hardcodes rather
+// than parameterizes) so that gdrive- and OSF-created experiment docs stay
+// uniform for every other consumer (api-data.ts, the dashboard, etc.).
+
+import { onRequest } from "firebase-functions/v2/https";
+import { FieldValue } from "firebase-admin/firestore";
+import { customAlphabet } from "nanoid";
+import { db } from "./app.js";
+import { verifyOwnership } from "./connect-provider.js";
+import resolveToken from "./resolve-token.js";
+import { getProvider, listProviders } from "./providers/index.js";
+import { ContainerRef, StorageProviderId } from "./providers/types.js";
+import { ExperimentData, UserData } from "./interfaces.js";
+import MESSAGES from "./api-messages.js";
+
+// Same alphabet/length as lib/experiment-creation.js's
+// customAlphabet("0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz", 12)
+// -- experiment ids must stay uniform whether created client-side (OSF) or
+// server-side (gdrive and later providers).
+const generateExperimentId = customAlphabet(
+  "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",
+  12
+);
+
+interface ExperimentSettingsOverrides {
+  nConditions?: number;
+  useValidation?: boolean;
+  allowJSON?: boolean;
+  allowCSV?: boolean;
+  requiredFields?: string[];
+  limitSessions?: boolean;
+  maxSessions?: number;
+}
+
+export const createExperiment = onRequest({ cors: true }, async (req, res) => {
+  try {
+    if (req.method !== "POST") {
+      res.status(405).json({ error: "Method not allowed" });
+      return;
+    }
+
+    const {
+      provider,
+      title,
+      idToken,
+      uid,
+      experimentSettings,
+    }: {
+      provider?: string;
+      title?: string;
+      idToken?: string;
+      uid?: string;
+      experimentSettings?: ExperimentSettingsOverrides;
+    } = req.body || {};
+
+    if (!provider || !title || !uid) {
+      res.status(400).json(MESSAGES.MISSING_PARAMETER);
+      return;
+    }
+
+    // Verify the caller owns the uid they claim -- same shape as
+    // connect-provider.ts's storage-grant flow (401 missing/invalid token,
+    // 403 uid mismatch). No signup path here, ever.
+    const authCheck = await verifyOwnership(uid, idToken);
+    if (!authCheck.ok) {
+      res.status(authCheck.status).json({ error: authCheck.error });
+      return;
+    }
+
+    // OSF creation stays browser-driven; only registered NON-osf providers
+    // may be created through this endpoint.
+    if (provider === "osf" || !listProviders().includes(provider as StorageProviderId)) {
+      res.status(400).json({ error: "Unsupported provider" });
+      return;
+    }
+
+    const storageProvider = getProvider(provider as StorageProviderId);
+
+    const userDocRef = db.doc(`users/${uid}`);
+    const userDoc = await userDocRef.get();
+    // A freshly-signed-up user may have no Firestore doc yet -- treat that
+    // the same as "no connected accounts" rather than throwing, so the
+    // PROVIDER_NOT_CONNECTED surface below applies uniformly.
+    const userData: UserData = (userDoc.data() as UserData) || ({} as UserData);
+
+    const tokenResult = await resolveToken(userData, {
+      storageProvider: provider as StorageProviderId,
+      owner: uid,
+    } as ExperimentData);
+
+    if (!tokenResult.success) {
+      const errorMessage =
+        MESSAGES[tokenResult.error as keyof typeof MESSAGES] || MESSAGES.TOKEN_RESOLUTION_ERROR;
+      res.status(400).json(errorMessage);
+      return;
+    }
+
+    let providerContainer: ContainerRef;
+    try {
+      providerContainer = await storageProvider.createDataContainer(
+        { token: tokenResult.token },
+        { name: title }
+      );
+    } catch (e) {
+      const detail = e instanceof Error ? e.message : "Unknown error";
+      res.status(502).json({ error: "Failed to create storage container", detail });
+      return;
+    }
+
+    const settings = experimentSettings || {};
+    const nConditions = settings.nConditions ?? 1;
+    const useValidation = settings.useValidation ?? true;
+    const allowJSON = settings.allowJSON ?? true;
+    const allowCSV = settings.allowCSV ?? true;
+    const requiredFields = settings.requiredFields ?? ["trial_type"];
+    const limitSessions = settings.limitSessions ?? false;
+    const maxSessions = settings.maxSessions ?? 1;
+
+    const experimentID = generateExperimentId();
+
+    const experimentDocRef = db.collection("experiments").doc(experimentID);
+
+    const batch = db.batch();
+    batch.set(experimentDocRef, {
+      title,
+      active: false,
+      activeBase64: false,
+      activeConditionAssignment: false,
+      sessions: 0,
+      limitSessions,
+      maxSessions,
+      id: experimentID,
+      owner: uid,
+      nConditions,
+      currentCondition: 0,
+      useValidation,
+      allowJSON,
+      allowCSV,
+      requiredFields,
+      storageProvider: provider,
+      providerContainer,
+    });
+    // set+merge (not update) -- a freshly-signed-up user may have no
+    // Firestore doc yet, same rationale as connect-provider.ts's
+    // set()+mergeFields for connectedAccounts.
+    batch.set(
+      userDocRef,
+      { experiments: FieldValue.arrayUnion(experimentID) },
+      { merge: true }
+    );
+
+    await batch.commit();
+
+    res.status(200).json({ success: true, experimentID, providerContainer });
+  } catch (error) {
+    console.error("Error creating experiment:", error instanceof Error ? error.message : "Unknown error");
+    res.status(500).json({ error: "Failed to create experiment" });
+  }
+});
diff --git a/functions/src/generate-oauth-state.ts b/functions/src/generate-oauth-state.ts
index 78d3b61..610324f 100644
--- a/functions/src/generate-oauth-state.ts
+++ b/functions/src/generate-oauth-state.ts
@@ -1,5 +1,6 @@
 import { onRequest } from "firebase-functions/v2/https";
 import { db } from "./app.js";
+import { getOAuthConfig } from "./providers/oauth-config.js";
 
 export const generateOAuthState = onRequest({ cors: true }, async (req, res) => {
   try {
@@ -8,17 +9,53 @@ export const generateOAuthState = onRequest({ cors: true }, async (req, res) =>
       return;
     }
 
+    // Optional `provider` in the body. Absent → exactly today's legacy
+    // behavior (the OSF flow keeps working byte-identically): a bare
+    // { state } response and a state doc with no provider field.
+    const { provider } = req.body || {};
+
     const state = crypto.randomUUID();
+    const stateData: Record<string, unknown> = {
+      createdAt: Date.now(),
+      expiresAt: Date.now() + 10 * 60 * 1000,
+    };
+
+    let authorizeUrl: string | undefined;
+
+    if (provider) {
+      let config;
+      try {
+        config = getOAuthConfig(provider);
+      } catch {
+        res.status(400).json({ error: 'Unknown provider' });
+        return;
+      }
+
+      stateData.provider = provider;
+
+      const url = new URL(config.authorizeUrl);
+      url.searchParams.set('client_id', config.clientId);
+      url.searchParams.set('redirect_uri', config.redirectUri);
+      url.searchParams.set('response_type', 'code');
+      url.searchParams.set('scope', config.scope);
+      url.searchParams.set('state', state);
+      for (const [key, value] of Object.entries(config.extraAuthParams)) {
+        url.searchParams.set(key, value);
+      }
+      authorizeUrl = url.toString();
+    }
 
     // Store in Firestore with a 10-minute expiry.
     // The callback endpoint will look this up to verify the state
     // was actually issued by our server, then delete it (single-use).
-    await db.collection('oauth_states').doc(state).set({
-      createdAt: Date.now(),
-      expiresAt: Date.now() + 10 * 60 * 1000,
-    });
+    await db.collection('oauth_states').doc(state).set(stateData);
+
+    const response: Record<string, unknown> = { state };
+    if (authorizeUrl) {
+      response.authorizeUrl = authorizeUrl;
+    }
 
-    res.status(200).json({ state });
+    res.status(200).json(response);
   } catch (error) {
     console.error('Error generating OAuth state:', error instanceof Error ? error.message : 'Unknown error');
     res.status(500).json({ error: 'Failed to generate state' });
diff --git a/functions/src/index.ts b/functions/src/index.ts
index ecbb6c1..082cbde 100644
--- a/functions/src/index.ts
+++ b/functions/src/index.ts
@@ -11,9 +11,11 @@ import { scheduledUploadRetry } from "./scheduled-upload-retry.js";
 import { scheduledPendingRecovery } from "./scheduled-pending-recovery.js";
 import { apiQueueStatus } from "./api-queue-status.js";
 import { generateOAuthState } from "./generate-oauth-state.js";
+import { connectProvider, disconnectProvider } from "./connect-provider.js";
 import { saveOsfToken } from "./save-osf-token.js";
 import { getOsfToken } from "./get-osf-token.js";
 import { onUserDeleted } from "./on-user-deleted.js";
+import { createExperiment } from "./create-experiment.js";
 
 setGlobalOptions({
   maxInstances: 20
@@ -31,7 +33,10 @@ export {
   scheduledPendingRecovery as scheduledpendingrecovery,
   apiQueueStatus as apiqueuestatus,
   generateOAuthState as generateoauthstate,
+  connectProvider as connectprovider,
+  disconnectProvider as disconnectprovider,
   saveOsfToken as saveosftoken,
   getOsfToken as getosftoken,
-  onUserDeleted as onuserdeleted
+  onUserDeleted as onuserdeleted,
+  createExperiment as createexperiment
 };
diff --git a/functions/src/interfaces.ts b/functions/src/interfaces.ts
index 5dfd2d5..b218ef5 100644
--- a/functions/src/interfaces.ts
+++ b/functions/src/interfaces.ts
@@ -1,3 +1,11 @@
+import {
+    StorageProviderId,
+    ContainerRef,
+    FileRef,
+    CollisionCacheState,
+    ConnectedAccounts,
+  } from './providers/types';
+
 export interface ExperimentData {
     active: boolean;
     activeBase64: boolean;
@@ -14,8 +22,13 @@ export interface ExperimentData {
     requiredFields: string[];
     owner: string;
     osfFilesLink: string;
+    // Provider-migration fields (additive; absent = legacy OSF experiment).
+    storageProvider?: StorageProviderId;
+    providerContainer?: ContainerRef;
+    metadataFileRef?: FileRef | null;
+    collisionCache?: CollisionCacheState;
   }
-  
+
   export interface UserData {
     email: string;
     uid: string;
@@ -24,10 +37,12 @@ export interface ExperimentData {
     experiments: string[];
     usingPersonalToken: boolean;
     refreshToken: string;
-    refreshTokenExpires: number; 
+    refreshTokenExpires: number;
     authToken: string;
     authTokenExpires: number;
-  } 
+    // Provider-migration field (additive; legacy OSF fields above stay as-is).
+    connectedAccounts?: ConnectedAccounts;
+  }
   
   export interface RequestBody {
     experimentID: string;
@@ -81,7 +96,9 @@ export interface ExperimentData {
     filename: string;
     storagePath: string;
     dataType: "data" | "base64";
-    osfFilesLink: string;
+    // Optional — undefined for provider-migrated (e.g. gdrive) queue
+    // entries, which carry storageProvider/providerContainer instead.
+    osfFilesLink?: string;
     status: "pending" | "processing" | "completed" | "failed";
     errorCode: number;
     retryCount: number;
@@ -93,6 +110,14 @@ export interface ExperimentData {
     failureReason: string | null;
     deduplicationKey: string;
     sessionIncremented: boolean;
+    // Collision-cache claim owned by this queue entry (additive; absent for
+    // entries queued before the collision cache existed — those skip the
+    // cache entirely on retry).
+    claimToken?: string;
+    // Provider-migration fields (additive; absent = legacy OSF queue entry,
+    // which falls back to the osfFilesLink-based container above).
+    storageProvider?: StorageProviderId;
+    providerContainer?: ContainerRef;
   }
 
   export interface OSFFile{
diff --git a/functions/src/metadata-block.ts b/functions/src/metadata-block.ts
index 5dce4ae..5d99a1c 100644
--- a/functions/src/metadata-block.ts
+++ b/functions/src/metadata-block.ts
@@ -1,14 +1,11 @@
 import MESSAGES from "./api-messages.js";
-import processMetadata from "./metadata-process.js";
 import updateMetadata from "./metadata-update.js";
 import produceMetadata from "./metadata-production.js";
-import updateFileOSF from "./update-file-osf.js";
-import downloadMetadata from "./metadata-download.js";
 import { DocumentReference, DocumentData } from "firebase-admin/firestore";
-import putFileOSF from "./put-file-osf.js";
 import { db } from "./app.js";
+import { getProviderForExperiment } from "./providers/index.js";
+import { FileRef, ProviderErrorCode } from "./providers/types.js";
 import buildDerivedFiles, { DerivedFile } from "./metadata-derived-files.js";
-import { queueDerivedFiles } from "./metadata-derived-upload.js";
 import { ExperimentData, Metadata, MetadataResponse } from './interfaces';
 
 // Discriminated on `success` so the compiler guarantees derivedFiles can only
@@ -19,9 +16,28 @@ type MetadataSuccess = Omit<MetadataResponse, 'success'> & { success: true; deri
 type MetadataFailure = Omit<MetadataResponse, 'success'> & { success: false };
 export type MetadataBlockResult = MetadataSuccess | MetadataFailure;
 
+// Thrown by performUpdate below when a provider's updateFile call fails
+// (either by throwing, in OSF's case, or by returning a failure WriteResult,
+// in gdrive's case). Carries the provider's error code, when known, so
+// callers can distinguish a self-healable failure (stale ref) from one that
+// recreating the file can't fix (auth/quota/rate-limit).
+class ProviderUpdateError extends Error {
+  code?: ProviderErrorCode;
+  constructor(message: string, code?: ProviderErrorCode) {
+    super(message);
+    this.code = code;
+  }
+}
+
+// Failure codes for which recreating the metadata file is pointless: an
+// auth or quota problem isn't fixed by writing a new file, and self-healing
+// on RATE_LIMITED would double the write load exactly when the provider is
+// telling us to back off.
+const NON_HEALABLE_CODES: ProviderErrorCode[] = ["AUTH_EXPIRED", "RATE_LIMITED", "QUOTA_EXCEEDED"];
+
 export default async function blockMetadata(
     exp_data: ExperimentData,
-    osfToken: string,
+    token: string,                       // already-resolved provider token (passed by api-data)
     metadata_doc_ref: DocumentReference<DocumentData>,
     data: string,
     filename: string,
@@ -30,128 +46,203 @@ export default async function blockMetadata(
 
 let metadataMessage: {metadataMessage: string} = {metadataMessage: ''};
 
+//Only run if metadata collection is enabled.
+if (!exp_data.metadataActive) {
+  metadataMessage = MESSAGES.METADATA_NOT_ACTIVE;
+  const metadataResponse: MetadataSuccess = {success: true, ...metadataMessage};
+  return metadataResponse;
+}
+
+const { provider, container } = getProviderForExperiment(exp_data);
+
+// The full Psych-DS file set derived from this submission (main data CSV,
+// sidecar CSVs for nested columns, .psychds-ignore), mirroring the CLI's
+// per-file output. Built inside the transaction below (from the same
+// `produced` result the incoming metadata comes from) and captured here so
+// it can ride on the success response after the transaction commits.
+let derivedFiles: DerivedFile[] = [];
+
 try {
 
-  //Only run if metadata collection is enabled.
-  if (!exp_data.metadataActive) {
-    metadataMessage = MESSAGES.METADATA_NOT_ACTIVE;
-    const metadataResponse: MetadataSuccess = {success: true, ...metadataMessage};
-    return metadataResponse;
-  }
+  //All metadata processing is done within a transaction to ensure consistency.
+  await db.runTransaction(async (t) => {
 
-  //Metadata is produced from the incoming data using the metadata module.
-  const produced = await produceMetadata(data, metadataOptions);
-  const incomingMetadata: Metadata = produced.metadata;
-
-  //The full Psych-DS file set derived from this submission (main data CSV,
-  //sidecar CSVs for nested columns, .psychds-ignore), mirroring the CLI's
-  //per-file output. Built here; uploaded by the caller only after the
-  //participant's raw data file itself lands in OSF under data/raw/, so
-  //derived files can never precede the data they are derived from.
-  const derivedFiles: DerivedFile[] = buildDerivedFiles(filename, produced);
-
-  //Retrieves the metadata ID from the OSF metadata file. If an ID exists, then a metadata file with name:
-  //dataset_description.json exists in the OSF project.
-  const osfMetadataId: string | undefined = (await processMetadata(exp_data.osfFilesLink, osfToken)).metadataId;
-
-  //Non-transactional pre-read to decide whether the OSF copy of the metadata
-  //needs downloading as the merge base (the bootstrap case: Firestore empty,
-  //OSF populated). Done outside the transaction below since Firestore retries
-  //a transaction callback on contention, which would otherwise repeat this
-  //network call on every retry.
-  const preReadFirestoreMetadata: Metadata | undefined = (await metadata_doc_ref.get()).data()?.metadata;
-
-  //Record which of the four states we are in before the download below (which
-  //can throw) so error responses still report the state, same as a successful
-  //response would.
-  if (preReadFirestoreMetadata) {
-    metadataMessage = osfMetadataId ? MESSAGES.METADATA_IN_OSF_AND_FIRESTORE : MESSAGES.METADATA_IN_FIRESTORE_NOT_IN_OSF;
-  } else {
-    metadataMessage = osfMetadataId ? MESSAGES.METADATA_IN_OSF_NOT_IN_FIRESTORE : MESSAGES.METADATA_NOT_IN_FIRESTORE_OR_OSF;
-  }
+      //Metadata is produced from the incoming data using the metadata module.
+      const produced = await produceMetadata(data, metadataOptions);
+      const incomingMetadata: Metadata = produced.metadata;
 
-  let osfMetadata: Metadata | undefined;
-  if (!preReadFirestoreMetadata && osfMetadataId) {
-    osfMetadata = (await downloadMetadata(exp_data.osfFilesLink, osfToken, osfMetadataId)).metadata;
-  }
+      //The full Psych-DS file set derived from this submission -- built here,
+      //uploaded by the caller only after the participant's raw data file
+      //itself lands in the provider under data/raw/, so derived files can
+      //never precede the data they are derived from.
+      derivedFiles = buildDerivedFiles(filename, produced);
 
-  //The transaction is Firestore-only: read the metadata doc, merge, write it
-  //back. All OSF network I/O happened above, so a transaction retry (e.g. a
-  //concurrent submission populating Firestore between the pre-read and here)
-  //can never repeat an OSF call — firestoreMetadata is re-read here, so that
-  //race still resolves correctly via firestoreMetadata ?? osfMetadata.
-  const updatedMetadata = await db.runTransaction(async (t) => {
-    const firestoreMetadata: Metadata | undefined = (await t.get(metadata_doc_ref)).data()?.metadata;
-
-    //Record which of the four states we are in. This is set before any
-    //failure point below so that error responses still report the state.
-    if (firestoreMetadata) {
-      metadataMessage = osfMetadataId ? MESSAGES.METADATA_IN_OSF_AND_FIRESTORE : MESSAGES.METADATA_IN_FIRESTORE_NOT_IN_OSF;
-    } else {
-      metadataMessage = osfMetadataId ? MESSAGES.METADATA_IN_OSF_NOT_IN_FIRESTORE : MESSAGES.METADATA_NOT_IN_FIRESTORE_OR_OSF;
-    }
-
-    //When Firestore has metadata, updating is done with respect to Firestore.
-    //When only OSF has metadata, the downloaded OSF copy is the base instead.
-    //When neither has metadata, the incoming metadata is used as-is.
-    const baseMetadata: Metadata | undefined = firestoreMetadata ?? osfMetadata;
-    const updated = baseMetadata ? await updateMetadata(baseMetadata, incomingMetadata) : incomingMetadata;
-
-    t.set(metadata_doc_ref, {metadata: updated}, {merge: true});
-
-    return updated;
-  });
+      //Retrieves the metadata from the Firestore metadata document.
+      const firestoreMetadataObj: DocumentData | undefined = (await t.get(metadata_doc_ref)).data();
 
-  //Firestore is now up to date; mirror the merged metadata to OSF. The mirror
-  //is best-effort: Firestore is the source of truth and every submission
-  //re-merges and re-mirrors, so a failure here must not reject the
-  //participant's data — it is queued for retry (create) or left for the next
-  //submission to repair (update).
-  const metadataFileContents = JSON.stringify(updatedMetadata, null, 2);
-  const queueTarget = {
-    experimentID: metadata_doc_ref.id,
-    owner: exp_data.owner,
-    osfFilesLink: exp_data.osfFilesLink,
-  };
+      const firestoreMetadata: Metadata | undefined = firestoreMetadataObj ? firestoreMetadataObj.metadata : undefined;
 
-  //If a metadata file exists in OSF, it is updated. Otherwise it is created.
-  if (osfMetadataId) {
-    try {
-      await updateFileOSF(
-        exp_data.osfFilesLink,
-        osfToken,
-        metadataFileContents,
-        osfMetadataId
-      );
-    } catch {
-      //Result intentionally unchecked and NOT queued: the uploadQueue only
-      //PUTs (create), which is guaranteed to 409 against a file that already
-      //exists — queueing here would just leave a dead entry the retry worker
-      //marks completed without ever applying the update. Firestore is the
-      //source of truth and every submission re-merges and re-mirrors, so the
-      //next submission repairs OSF instead.
-    }
-  } else {
-    try {
-      const response = await putFileOSF(
-        exp_data.osfFilesLink,
-        osfToken,
-        metadataFileContents,
-        `dataset_description.json`
-      );
-
-      //A 409 means a concurrent submission created the file first; the next
-      //submission will fold this one's merge (already in Firestore) into it.
-      if (!response.success && response.errorCode !== 409) {
-        await queueDerivedFiles([{ filename: "dataset_description.json", content: metadataFileContents }],
-          queueTarget, `dataset_description OSF error ${response.errorCode}: ${response.errorText}`);
+      // The metadata file's provider ref, tracked on the metadata doc.
+      // - undefined: the field has never been written (pre-migration doc, or
+      //   no doc at all) — distinct from explicit null.
+      // - null: known absent — a prior request already looked and found
+      //   nothing, so we must not list the provider folder again.
+      // - FileRef: a metadata file is known to exist at this id/name.
+      let metadataFileRef: FileRef | null | undefined = firestoreMetadataObj
+        ? (firestoreMetadataObj.metadataFileRef as FileRef | null | undefined)
+        : undefined;
+
+      // Legacy discovery fallback: only runs once, for docs that predate ref
+      // tracking. Afterward the ref (possibly null) is stored so this never
+      // runs again for this experiment.
+      if (metadataFileRef === undefined) {
+        const providerFiles = await provider.listFiles(
+          { token },
+          container
+        );
+
+        const found = providerFiles.find((file) => file.name === "dataset_description.json");
+
+        metadataFileRef = found ?? null;
+
+        t.set(metadata_doc_ref, { metadataFileRef }, { merge: true });
       }
-    } catch (error) {
-      const detail = error instanceof Error ? error.message : "Unknown error";
-      await queueDerivedFiles([{ filename: "dataset_description.json", content: metadataFileContents }],
-        queueTarget, `dataset_description upload exception: ${detail}`);
-    }
-  }
+
+      // Creates a fresh dataset_description.json and stores the returned ref
+      // on the metadata doc. Used both for the "no ref" branches below and
+      // for self-healing a stale ref whose provider-side file is gone.
+      async function createMetadataFile(payload: object) {
+        const serialized = JSON.stringify(payload, null, 2);
+
+        const response = await provider.writeSessionFile(
+          { token },
+          container,
+          `dataset_description.json`,
+          serialized,
+          { size: Buffer.byteLength(serialized), contentType: "application/json" }
+        );
+
+        if (!response.success) {
+          throw new Error(MESSAGES.OSF_UPLOAD_ERROR.message);
+        }
+
+        // Only track a ref we can actually use later. If the provider's 201
+        // body was unparseable, fileRef.id is undefined — storing that would
+        // either fail the Firestore write or persist an un-updatable ref
+        // (whose self-heal re-create would then 409 forever). Leaving the
+        // field unset instead lets the next submission's legacy-discovery
+        // listing find the file and store a complete ref.
+        if (response.fileRef.id) {
+          t.set(metadata_doc_ref, { metadataFileRef: response.fileRef }, { merge: true });
+        }
+      }
+
+      // Updates the ref'd metadata file. Throws a ProviderUpdateError on any
+      // failure — OSF's updateFile already throws on non-200 responses;
+      // gdrive's never throws, so a returned {success:false} is converted
+      // into the same ProviderUpdateError shape here so callers can handle
+      // both provider styles identically.
+      async function performUpdate(fileRef: FileRef, serialized: string) {
+        const result = await provider.updateFile(
+          { token },
+          container,
+          fileRef,
+          serialized,
+          { size: Buffer.byteLength(serialized), contentType: "application/json" }
+        );
+
+        if (!result.success) {
+          throw new ProviderUpdateError(
+            `Error updating metadata file: ${result.providerMessage}`,
+            result.error
+          );
+        }
+      }
+
+      //When a ref and firestore metadata both exist, updating is done with respect to firestore.
+      if (metadataFileRef && firestoreMetadata) {
+
+        metadataMessage = MESSAGES.METADATA_IN_OSF_AND_FIRESTORE;
+
+        // Incoming metadata is used to update firestore metadata.
+        const updatedMetadata = await updateMetadata(firestoreMetadata, incomingMetadata);
+
+        t.update(metadata_doc_ref, {metadata: updatedMetadata});
+
+        const serialized = JSON.stringify(updatedMetadata, null, 2);
+
+        try {
+          //The ref'd metadata file is updated with the above metadata.
+          await performUpdate(metadataFileRef, serialized);
+        } catch (e) {
+          // A returned failure with a non-healable code (auth/quota/rate
+          // limit) must propagate rather than self-heal — recreating the
+          // file can't fix any of those, and re-creating under rate-limiting
+          // would only make things worse.
+          if (e instanceof ProviderUpdateError && e.code && NON_HEALABLE_CODES.includes(e.code)) {
+            throw e;
+          }
+          // Self-heal: the ref is stale (the file was deleted provider-side),
+          // or the failure is otherwise recoverable by recreating the file.
+          await createMetadataFile(updatedMetadata);
+        }
+      }
+      //When a ref exists but firestore does not have metadata, updating is done with respect to OSF.
+      else if (metadataFileRef && !firestoreMetadata) {
+
+        metadataMessage = MESSAGES.METADATA_IN_OSF_NOT_IN_FIRESTORE;
+
+        //Metadata is downloaded from the provider, and is compared to incoming metadata to produce an updated version.
+        const downloadResult = await provider.downloadFile({ token }, container, metadataFileRef);
+
+        if (!downloadResult.success) {
+          throw new Error(`Error downloading metadata file: ${downloadResult.providerMessage}`);
+        }
+
+        let providerMetadata: Metadata;
+        try {
+          providerMetadata = JSON.parse(downloadResult.content) as Metadata;
+        } catch (e) {
+          throw new Error(`Error parsing downloaded metadata: ${e instanceof Error ? e.message : "Unknown error"}`);
+        }
+
+        const updatedMetadata = await updateMetadata(providerMetadata, incomingMetadata);
+
+        //Up to date metadata is uploaded to firestore.
+        t.set(metadata_doc_ref, {metadata: updatedMetadata}, {merge: true});
+
+        //Since metadata exists in the provider, it is updated and not set.
+        // No self-heal here (matches pre-existing behavior) — any failure
+        // propagates to the outer catch as METADATA_ERROR.
+        await performUpdate(metadataFileRef, JSON.stringify(incomingMetadata, null, 2));
+
+      }
+      // When no ref exists but firestore has metadata, the metadata file is (re)created in the provider.
+      else if (!metadataFileRef && firestoreMetadata) {
+
+        metadataMessage = MESSAGES.METADATA_IN_FIRESTORE_NOT_IN_OSF;
+
+        // Incoming metadata is used to update firestore metadata.
+        const updatedMetadata = await updateMetadata(firestoreMetadata, incomingMetadata);
+
+        t.update(metadata_doc_ref, {metadata: updatedMetadata});
+
+        //If a metadata file does not exist in the provider, it is created with the above metadata.
+        await createMetadataFile(updatedMetadata);
+      }
+      // When neither a ref nor firestore metadata exist, the metadata is created in the provider and firestore.
+      else {
+
+        metadataMessage = MESSAGES.METADATA_NOT_IN_FIRESTORE_OR_OSF;
+
+        //Incoming metadata is uploaded to firestore and the provider.
+
+        t.set(metadata_doc_ref, {metadata: incomingMetadata}, {merge: true});
+
+        await createMetadataFile(incomingMetadata);
+
+        }
+  });
 
   const metadataResponse: MetadataSuccess = {success: true, ...metadataMessage, derivedFiles};
   return metadataResponse;
diff --git a/functions/src/metadata-derived-upload.ts b/functions/src/metadata-derived-upload.ts
index b640d0d..44620ed 100644
--- a/functions/src/metadata-derived-upload.ts
+++ b/functions/src/metadata-derived-upload.ts
@@ -1,62 +1,69 @@
-import putFileOSF from "./put-file-osf.js";
+import { getProvider } from "./providers/index.js";
+import { StorageProviderId, ContainerRef } from "./providers/types.js";
 import queueUpload from "./queue-upload.js";
 import writeLog from "./write-log.js";
 import MESSAGES from "./api-messages.js";
 import { DerivedFile } from "./metadata-derived-files.js";
-import resolveFolder from "./subfolder.js";
-
-const DATA_PREFIX = "data/";
 
 export interface DerivedUploadTarget {
   experimentID: string;
   owner: string;
-  osfFilesLink: string;
+  // undefined ⇒ legacy OSF experiment (predates the provider-migration schema).
+  storageProvider?: StorageProviderId;
+  providerContainer?: ContainerRef;
+  // Legacy fallback: only meaningful when storageProvider is absent.
+  osfFilesLink?: string;
+}
+
+// Resolves the provider + container the same way scheduled-upload-retry.ts
+// does: provider-migration fields when present, otherwise the legacy OSF
+// shape built from osfFilesLink.
+function resolveProviderAndContainer(target: DerivedUploadTarget) {
+  const providerId = (target.storageProvider as StorageProviderId) || "osf";
+  const provider = getProvider(providerId);
+  const container: ContainerRef = target.providerContainer
+    ? (target.providerContainer as ContainerRef)
+    : { provider: "osf", filesLink: target.osfFilesLink };
+  return { provider, container };
+}
+
+function contentTypeFor(filename: string): string {
+  if (filename.endsWith(".csv")) return "text/csv";
+  if (filename.endsWith(".json")) return "application/json";
+  return "text/plain";
 }
 
 /**
  * Uploads derived Psych-DS files (main data CSV, sidecar CSVs, .psychds-ignore)
- * to OSF, best-effort: the participant's raw data file is already safely in
- * OSF by the time this runs, and every derived file is reproducible from it,
- * so a failure is queued for retry (the same uploadQueue the data files use)
- * and logged — it never fails the submission.
- * A 409 means an earlier attempt already landed the file; nothing to do.
+ * through the experiment's storage provider, best-effort: the participant's
+ * raw data file is already safely stored by the time this runs, and every
+ * derived file is reproducible from it, so a failure is queued for retry (the
+ * same uploadQueue the data files use) and logged — it never fails the
+ * submission.
+ * A NAME_CONFLICT means an earlier attempt already landed the file; nothing
+ * to do. Each file's writeSessionFile walks its own path — no shared
+ * up-front folder resolution — concurrent folder-create races are handled
+ * inside the provider adapters themselves.
  */
 export async function uploadDerivedFiles(
   files: DerivedFile[],
   target: DerivedUploadTarget,
-  osfToken: string,
+  token: string,
 ): Promise<void> {
-  // Every derived file under data/ shares that one folder; resolve it once up
-  // front instead of each of the N uploads below independently walking (and
-  // possibly racing to create) the same path. Folder-create races among
-  // concurrent submissions still resolve safely via subfolder.ts's own
-  // 409-re-list branch.
-  //
-  // This resolution is best-effort: if it throws (OSF list/create error or a
-  // network failure), fall back to undefined so each under-data/ file re-walks
-  // the path itself inside its own per-file try/catch below — that path still
-  // queues on failure. Letting the throw escape here would instead lose the
-  // derived files entirely (never uploaded, never queued) and fail an already-
-  // successful submission, breaking this function's best-effort contract.
-  const needsDataFolder = files.some((file) => file.filename.startsWith(DATA_PREFIX));
-  let dataFolderLink: string | undefined;
-  if (needsDataFolder) {
-    try {
-      dataFolderLink = await resolveFolder(target.osfFilesLink, osfToken, "data");
-    } catch {
-      dataFolderLink = undefined;
-    }
-  }
+  const { provider, container } = resolveProviderAndContainer(target);
 
   await Promise.allSettled(files.map(async (file) => {
-    const underData = file.filename.startsWith(DATA_PREFIX);
-    const uploadFilename = underData ? file.filename.slice(DATA_PREFIX.length) : file.filename;
-    const startUrl = underData ? dataFolderLink : undefined;
-
     try {
-      const result = await putFileOSF(target.osfFilesLink, osfToken, file.content, uploadFilename, startUrl);
-      if (result.success || result.errorCode === 409) return;
-      await queueDerivedFiles([file], target, `Derived file OSF error ${result.errorCode}: ${result.errorText}`);
+      const result = await provider.writeSessionFile(
+        { token },
+        container,
+        file.filename,
+        file.content,
+        { size: Buffer.byteLength(file.content), contentType: contentTypeFor(file.filename) }
+      );
+      if (result.success) return;
+      if (result.error === "NAME_CONFLICT") return;
+      await queueDerivedFiles([file], target, `Derived file provider error ${result.providerStatus}: ${result.providerMessage}`);
     } catch (e) {
       const detail = e instanceof Error ? e.message : "Unknown error";
       await queueDerivedFiles([file], target, `Derived file upload exception: ${detail}`);
@@ -66,9 +73,9 @@ export async function uploadDerivedFiles(
 
 /**
  * Queues derived files for retried upload without attempting one first — used
- * when the raw data file itself just failed to reach OSF (it was queued, so
- * OSF is known to be unavailable). sessionIncremented is true because only
- * the raw data file accounts for the session count.
+ * when the raw data file itself just failed to reach the provider (it was
+ * queued, so the provider is known to be unavailable). sessionIncremented is
+ * true because only the raw data file accounts for the session count.
  */
 export async function queueDerivedFiles(
   files: DerivedFile[],
@@ -84,6 +91,8 @@ export async function queueDerivedFiles(
         data: file.content,
         dataType: "data",
         osfFilesLink: target.osfFilesLink,
+        storageProvider: target.storageProvider,
+        providerContainer: target.providerContainer,
         errorCode: 0,
         sessionIncremented: true,
         failureReason,
diff --git a/functions/src/metadata-download.ts b/functions/src/metadata-download.ts
deleted file mode 100644
index a71365d..0000000
--- a/functions/src/metadata-download.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-import fetch from "node-fetch";
-import validateJSON from "./validate-json.js";
-import { Metadata } from "./interfaces";
-
-export default async function downloadMetadata(
-  osfComponent: string,
-  osfToken: string,
-  metadataId: string,
-) {
-  //Gets the metadata of the data storage element in the OSF project.
-  const downloadMetadata = await fetch(`${osfComponent}${metadataId}`, {
-    method: "GET",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${osfToken}`,
-    }
-  });
-  /**
- * Checks the status of the metadata download.
- * If the status is 404, logs the list of files to the console and returns an error object.
- */ 
-  if (downloadMetadata.status === 404) {
-    throw Error(`Error downloading metadata with code: ${downloadMetadata.status}, and message: ${downloadMetadata.statusText}`);
-  }
-
-  /**
- * Extracts the URL of the metadata file from the download object.
- * @type {string}
- */ 
-  const fileUrl: string = downloadMetadata.url;
-
-  /**
-   * Uses the download link provided by OSF to get the metadata file as a string.
-   * @param {string} fileUrl - The URL of the file to fetch.
-   * @returns {Promise} A promise that resolves to the data from the file.
-   */
-  async function fetchMetadata(fileUrl: string) {
-    try {
-        const response = await fetch(fileUrl);
-        if (!response.ok) {
-          throw Error(`Error fetching metadata with code: ${response.status}, and message: ${response.statusText}`);
-        }
-        return await response.json();
-    } catch (error) {
-        throw Error(`Error fetching metadata with code: 400, and message: ${error instanceof Error ? error.message : 'An unknown error occurred'}`)
-    }
-}
-  // Download the metadata file.
-  const metadata: Metadata = await fetchMetadata(fileUrl) as Metadata;
-
-  if (!metadata.variableMeasured || !metadata.variableMeasured[0].name) {
-    throw Error(`Error downloading metadata with code: 400, and message: Invalid metadata downloaded`)
-  } 
-
-  // Checks if the existing metadata is in valid JSON format, and that it contains the Psych-DS proper fields.
-  const success: boolean = validateJSON(JSON.stringify(metadata), ["name", "schemaVersion", "@context", "@type", "description", "author", "variableMeasured"]);
-  
-  return { success: success, errorCode: null, errorText: null, metadata: metadata};
-}
\ No newline at end of file
diff --git a/functions/src/metadata-process.ts b/functions/src/metadata-process.ts
deleted file mode 100644
index 9839d21..0000000
--- a/functions/src/metadata-process.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-import { OSFFile } from './interfaces';
-
-export default async function processMetadata(
-  osfComponent: string,
-  osfToken: string,
-) {
-  //Gets the metadata of the data storage element in the OSF project.
-  try {
-  const osfResult = await fetch(`${osfComponent}?meta=`, {
-    method: "GET",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${osfToken}`,
-    }
-  });
-
-  const folder = await osfResult.json(); //Gets the json portion of the response
-
-  // The JSON portion has a property called 'data' that contains an array of objects, each of which
-  // corresponds to a data file in the OSF project. We access this array.
-  const listOfFiles: OSFFile[]= folder['data'];
-
-
-  // Every file object has an 'attributes' property which contains an object of information about the file, 
-  // including a name property. We use this to find the file object of the metadata file.
-  const metadataFile: OSFFile[] = listOfFiles.filter((file) => file.attributes.name === `dataset_description.json`);
-
-  // Return error if no file with the name 'dataset-description.json' is found.
-  if (metadataFile.length === 0) {
-    return { success: false, errorCode: 404, errorText: 'Metadata file not found', metadataString: null};
-  }
-
-  // Since filter returns a list, we access the first object and access the id property, which contains the 
-  // unique id needed to access the file. The string comes with an osfstorage/ prefix that we remove.
-  const metadataId: string = metadataFile[0].id.replace('osfstorage/', '');
-
-  return { success: true, errorCode: null, errorText: null, metadataId: metadataId};
-}
-catch (error) {
-  let errorMessage: string;
-
-  if (error instanceof Error) errorMessage = error.message;
-
-  else errorMessage = 'An unknown error occurred';
-
-  throw Error(`Error processing metadata with code: 400, and message: ${errorMessage}`)}
-}
-
diff --git a/functions/src/providers/gdrive-oauth.ts b/functions/src/providers/gdrive-oauth.ts
new file mode 100644
index 0000000..3a80b66
--- /dev/null
+++ b/functions/src/providers/gdrive-oauth.ts
@@ -0,0 +1,75 @@
+// Shared gdrive OAuth token-refresh logic (scratchpad/step4b-oauth-connect-
+// spec.md). Extracted out of resolve-token.ts so the same refresh+persist
+// path can be called both lazily (resolve-token.ts, on-demand when a token
+// has expired) and proactively (scheduled-token-refresh.ts's
+// refreshExpiringGdriveTokens, run on a schedule ahead of expiry).
+//
+// Uses the runtime's global `fetch`, not the "node-fetch" package — matches
+// resolve-token.ts's existing OSF refresh sibling (refresh-token.ts) and is
+// pinned by resolve-token-gdrive.test.js, which mocks global.fetch.
+
+import { decrypt, encrypt } from "../crypto-utils.js";
+import { db } from "../app.js";
+import { OAuth2AccountConnection } from "./types.js";
+
+export type GdriveRefreshResult =
+  | { success: true; accessToken: string }
+  | { success: false; error: string; detail: string };
+
+/**
+ * Refreshes a single user's gdrive access token using their stored refresh
+ * token, and persists the new (encrypted) access token / expiry — rotating
+ * the refresh token too, if the provider issued a new one. Does not check
+ * whether the current token is actually expired; callers decide when to
+ * invoke this.
+ */
+export async function refreshGdriveToken(
+  uid: string,
+  connection: OAuth2AccountConnection
+): Promise<GdriveRefreshResult> {
+  const tokenUrl = process.env.GDRIVE_TOKEN_URL || "https://oauth2.googleapis.com/token";
+  const params = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: decrypt(connection.encryptedRefreshToken),
+    client_id: process.env.GDRIVE_CLIENT_ID as string,
+    client_secret: process.env.GDRIVE_CLIENT_SECRET as string,
+  });
+
+  let tokenResponse: Response;
+  try {
+    tokenResponse = await fetch(tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+      },
+      body: params.toString(),
+    });
+  } catch (e) {
+    const detail = e instanceof Error ? e.message : "Unknown network error";
+    return { success: false, error: "INVALID_REFRESH_TOKEN", detail };
+  }
+
+  if (!tokenResponse.ok) {
+    const detail = await tokenResponse.text();
+    return { success: false, error: "INVALID_REFRESH_TOKEN", detail: detail || "Refresh token is not valid" };
+  }
+
+  const tokenData = await tokenResponse.json();
+
+  const newTokenExpiresAt = Date.now() + tokenData.expires_in * 1000;
+
+  const update: Record<string, unknown> = {
+    "connectedAccounts.gdrive.encryptedToken": encrypt(tokenData.access_token),
+    "connectedAccounts.gdrive.tokenExpiresAt": newTokenExpiresAt,
+  };
+
+  // Only rotate the refresh token when the provider actually issued a new
+  // one — otherwise leave the existing one in place.
+  if (tokenData.refresh_token) {
+    update["connectedAccounts.gdrive.encryptedRefreshToken"] = encrypt(tokenData.refresh_token);
+  }
+
+  await db.doc(`users/${uid}`).update(update);
+
+  return { success: true, accessToken: tokenData.access_token };
+}
diff --git a/functions/src/providers/gdrive.ts b/functions/src/providers/gdrive.ts
new file mode 100644
index 0000000..b88e86a
--- /dev/null
+++ b/functions/src/providers/gdrive.ts
@@ -0,0 +1,387 @@
+import fetch from "node-fetch";
+import {
+  StorageProvider,
+  ResolvedAuth,
+  ContainerRef,
+  FileRef,
+  FileMeta,
+  WriteResult,
+  DownloadResult,
+  ProviderErrorCode,
+} from "./types.js";
+
+// The gdrive container ref shape — only the folderId is meaningful to this
+// adapter (the Drive folder an experiment's session files land in).
+export interface GdriveContainerRef extends ContainerRef {
+  provider: "gdrive";
+  folderId: string;
+}
+
+const FOLDER_MIME = "application/vnd.google-apps.folder";
+
+// A fixed boundary is fine here — the request body is built and sent in one
+// shot, never streamed/concatenated across requests, so there's no need for
+// per-call uniqueness.
+const MULTIPART_BOUNDARY = "datapipe-gdrive-multipart-boundary";
+
+// GDRIVE_API_BASE is read at CALL time (not module load) so tests — and, in
+// production, config changes — can vary it without a process restart.
+function getApiBase(): string {
+  return process.env.GDRIVE_API_BASE || "https://www.googleapis.com";
+}
+
+function authHeaders(auth: ResolvedAuth): Record<string, string> {
+  return { Authorization: `Bearer ${auth.token}` };
+}
+
+// Google Drive `q` filters are single-quoted strings; escape backslashes and
+// embedded single quotes per Drive's query syntax.
+function escapeQueryValue(value: string): string {
+  return value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
+
+function isSuccessStatus(status: number): boolean {
+  return status === 200 || status === 201;
+}
+
+interface MappedDriveError {
+  error: ProviderErrorCode;
+  providerStatus: number;
+  providerMessage: string;
+  retryAfter: number | null;
+}
+
+// Shared error-mapping helper — every write/update/list/download call routes
+// its non-2xx response through this. Drive never yields a duplicate-name
+// conflict (NAME_CONFLICT): Drive allows multiple files with the same name
+// in the same folder, so the collision cache (not the provider) is the only
+// duplicate gate for gdrive experiments.
+function mapDriveError(
+  status: number,
+  statusText: string,
+  body: { errors?: { reason?: string; message?: string }[] } | undefined,
+  retryAfterHeader: string | null
+): MappedDriveError {
+  const retryAfter = retryAfterHeader ? parseInt(retryAfterHeader, 10) : null;
+
+  let error: ProviderErrorCode;
+  if (status === 401) {
+    error = "AUTH_EXPIRED";
+  } else if (status === 403) {
+    const reason = body?.errors?.[0]?.reason;
+    if (reason === "storageQuotaExceeded") {
+      error = "QUOTA_EXCEEDED";
+    } else if (
+      reason === "userRateLimitExceeded" ||
+      reason === "rateLimitExceeded" ||
+      reason === "dailyLimitExceeded"
+    ) {
+      error = "RATE_LIMITED";
+    } else {
+      error = "AUTH_EXPIRED";
+    }
+  } else if (status === 429) {
+    error = "RATE_LIMITED";
+  } else {
+    error = "UNAVAILABLE";
+  }
+
+  return { error, providerStatus: status, providerMessage: statusText, retryAfter };
+}
+
+// Reads the body (only when the status requires inspecting it — the 403
+// reason drill-down) and maps the response into the shared error shape.
+async function mapErrorResponse(response: {
+  status: number;
+  statusText: string;
+  headers: { get: (name: string) => string | null };
+  json: () => Promise<unknown>;
+}): Promise<MappedDriveError> {
+  let body: { errors?: { reason?: string; message?: string }[] } | undefined;
+  if (response.status === 403) {
+    try {
+      body = (await response.json()) as { errors?: { reason?: string; message?: string }[] };
+    } catch {
+      body = undefined;
+    }
+  }
+  const retryAfterHeader = response.headers.get("Retry-After");
+  return mapDriveError(response.status, response.statusText, body, retryAfterHeader);
+}
+
+// Finds a folder by exact name under a given parent. Returns null if none
+// exists yet.
+async function findFolder(
+  auth: ResolvedAuth,
+  name: string,
+  parentId: string
+): Promise<string | null> {
+  const url = new URL(`${getApiBase()}/drive/v3/files`);
+  const q = `name='${escapeQueryValue(name)}' and '${parentId}' in parents and mimeType='${FOLDER_MIME}' and trashed=false`;
+  url.searchParams.set("q", q);
+
+  const response = await fetch(url.toString(), {
+    method: "GET",
+    headers: authHeaders(auth),
+  });
+
+  if (!isSuccessStatus(response.status)) {
+    const mapped = await mapErrorResponse(response);
+    throw new Error(`Google Drive folder lookup failed: ${mapped.providerStatus} ${mapped.providerMessage}`);
+  }
+
+  const body = (await response.json()) as { files?: { id: string }[] };
+  const files = body.files || [];
+  return files.length > 0 ? files[0].id : null;
+}
+
+async function createFolder(auth: ResolvedAuth, name: string, parentId: string): Promise<string> {
+  const response = await fetch(`${getApiBase()}/drive/v3/files`, {
+    method: "POST",
+    headers: {
+      ...authHeaders(auth),
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({ name, mimeType: FOLDER_MIME, parents: [parentId] }),
+  });
+
+  if (!isSuccessStatus(response.status)) {
+    const mapped = await mapErrorResponse(response);
+    throw new Error(`Google Drive folder creation failed: ${mapped.providerStatus} ${mapped.providerMessage}`);
+  }
+
+  const body = (await response.json()) as { id: string };
+  return body.id;
+}
+
+async function findOrCreateFolder(auth: ResolvedAuth, name: string, parentId: string): Promise<string> {
+  const existingId = await findFolder(auth, name, parentId);
+  if (existingId) {
+    return existingId;
+  }
+  return createFolder(auth, name, parentId);
+}
+
+// Hand-built multipart/related body: part 1 is the JSON metadata (name +
+// parents), part 2 is the raw file payload — no extra dependencies needed
+// for this.
+function buildMultipartBody(metadata: object, data: string | Buffer, contentType: string): Buffer {
+  const dataBuffer = Buffer.isBuffer(data) ? data : Buffer.from(data);
+  const preamble =
+    `--${MULTIPART_BOUNDARY}\r\n` +
+    `Content-Type: application/json; charset=UTF-8\r\n\r\n` +
+    `${JSON.stringify(metadata)}\r\n` +
+    `--${MULTIPART_BOUNDARY}\r\n` +
+    `Content-Type: ${contentType}\r\n\r\n`;
+  const epilogue = `\r\n--${MULTIPART_BOUNDARY}--`;
+
+  return Buffer.concat([Buffer.from(preamble), dataBuffer, Buffer.from(epilogue)]);
+}
+
+export const gdriveProvider: StorageProvider = {
+  id: "gdrive",
+  authMethod: "oauth2",
+  capabilities: {
+    nativeSubfolders: true,
+    supportsRegion: false,
+    maxFileSizeBytes: null,
+    quotaNote: "Free Google accounts share 15 GB across Drive, Gmail, and Photos",
+  },
+
+  async createDataContainer(auth: ResolvedAuth, researcherInput: Record<string, unknown>): Promise<ContainerRef> {
+    const name = researcherInput.name as string;
+
+    let rootId = await findFolder(auth, "DataPipe", "root");
+    if (!rootId) {
+      rootId = await createFolder(auth, "DataPipe", "root");
+    }
+
+    // Experiment folders are always created fresh — Drive allows duplicate
+    // names, so there's nothing to find-or-create here.
+    const folderId = await createFolder(auth, name, rootId);
+
+    return { provider: "gdrive", folderId };
+  },
+
+  async writeSessionFile(
+    auth: ResolvedAuth,
+    container: ContainerRef,
+    filename: string,
+    data: string | Buffer,
+    meta: FileMeta
+  ): Promise<WriteResult> {
+    const gdriveContainer = container as GdriveContainerRef;
+
+    // A filename may carry a multi-level path prefix (e.g.
+    // "data/raw/abc123.json"). Walk every segment, finding-or-creating each
+    // folder level in turn, so nested Psych-DS paths land in the matching
+    // nested Drive folders instead of only the first level.
+    const segments = filename.split("/");
+    const uploadFilename = segments.pop() as string;
+
+    let parentId = gdriveContainer.folderId;
+    try {
+      for (const segment of segments) {
+        parentId = await findOrCreateFolder(auth, segment, parentId);
+      }
+    } catch (e) {
+      return {
+        success: false,
+        error: "UNAVAILABLE",
+        providerStatus: null,
+        providerMessage: e instanceof Error ? e.message : "Unknown error",
+        retryAfter: null,
+      };
+    }
+
+    const body = buildMultipartBody(
+      { name: uploadFilename, parents: [parentId] },
+      data,
+      meta.contentType
+    );
+
+    const response = await fetch(`${getApiBase()}/upload/drive/v3/files?uploadType=multipart`, {
+      method: "POST",
+      headers: {
+        ...authHeaders(auth),
+        "Content-Type": `multipart/related; boundary=${MULTIPART_BOUNDARY}`,
+      },
+      body,
+    });
+
+    if (!isSuccessStatus(response.status)) {
+      const mapped = await mapErrorResponse(response);
+      return { success: false, ...mapped };
+    }
+
+    const responseBody = (await response.json()) as { id?: string; name?: string };
+    const storedFilename = responseBody.name ?? uploadFilename;
+
+    return {
+      success: true,
+      // fileRef.name intentionally mirrors the raw response (possibly
+      // undefined) rather than falling back to storedFilename — callers
+      // compare storedFilename against the requested name to detect a silent
+      // rename, and a fabricated fileRef.name would defeat that.
+      fileRef: { id: responseBody.id, name: responseBody.name as string },
+      storedFilename,
+    };
+  },
+
+  async updateFile(
+    auth: ResolvedAuth,
+    _container: ContainerRef,
+    existingFileRef: FileRef,
+    data: string | Buffer,
+    meta: FileMeta
+  ): Promise<WriteResult> {
+    const response = await fetch(
+      `${getApiBase()}/upload/drive/v3/files/${existingFileRef.id}?uploadType=media`,
+      {
+        method: "PATCH",
+        headers: {
+          ...authHeaders(auth),
+          "Content-Type": meta.contentType,
+        },
+        body: data,
+      }
+    );
+
+    if (!isSuccessStatus(response.status)) {
+      const mapped = await mapErrorResponse(response);
+      return { success: false, ...mapped };
+    }
+
+    return {
+      success: true,
+      fileRef: existingFileRef,
+      storedFilename: existingFileRef.name,
+    };
+  },
+
+  async listFiles(auth: ResolvedAuth, container: ContainerRef): Promise<FileRef[]> {
+    const gdriveContainer = container as GdriveContainerRef;
+
+    // Recurses into subfolders (BFS) so collision-cache rehydration finds raw
+    // files now stored under nested Psych-DS paths (e.g. data/raw/). Every
+    // FILE entry is collected under its own leaf name — regardless of which
+    // folder it was found in — so hashing `salt:name` matches the claim made
+    // on the raw leaf filename. A failed listing at ANY level MUST throw
+    // (never return a partial/empty result): collision-cache rehydration
+    // treats the returned list as the complete set of existing filenames, and
+    // Drive has no 409 backstop — silently returning a partial list here
+    // would warm the cache incomplete and let duplicates through. The throw
+    // surfaces as CollisionCacheUnavailableError.
+    const results: FileRef[] = [];
+    const foldersToVisit: string[] = [gdriveContainer.folderId];
+
+    while (foldersToVisit.length > 0) {
+      const folderId = foldersToVisit.shift() as string;
+      const q = `'${folderId}' in parents and trashed=false`;
+      let pageToken: string | undefined;
+
+      do {
+        const url = new URL(`${getApiBase()}/drive/v3/files`);
+        url.searchParams.set("q", q);
+        url.searchParams.set("fields", "nextPageToken,files(id,name,mimeType)");
+        url.searchParams.set("pageSize", "1000");
+        if (pageToken) {
+          url.searchParams.set("pageToken", pageToken);
+        }
+
+        const response = await fetch(url.toString(), {
+          method: "GET",
+          headers: authHeaders(auth),
+        });
+
+        if (!isSuccessStatus(response.status)) {
+          const mapped = await mapErrorResponse(response);
+          throw new Error(
+            `Google Drive listing failed: ${mapped.providerStatus} ${mapped.providerMessage}`
+          );
+        }
+
+        const body = (await response.json()) as {
+          nextPageToken?: string;
+          files?: { id: string; name: string; mimeType: string }[];
+        };
+
+        for (const file of body.files || []) {
+          if (file.mimeType === FOLDER_MIME) {
+            foldersToVisit.push(file.id);
+            continue;
+          }
+          results.push({ id: file.id, name: file.name });
+        }
+
+        pageToken = body.nextPageToken;
+      } while (pageToken);
+    }
+
+    return results;
+  },
+
+  async downloadFile(
+    auth: ResolvedAuth,
+    _container: ContainerRef,
+    fileRef: FileRef
+  ): Promise<DownloadResult> {
+    const response = await fetch(`${getApiBase()}/drive/v3/files/${fileRef.id}?alt=media`, {
+      method: "GET",
+      headers: authHeaders(auth),
+    });
+
+    if (!isSuccessStatus(response.status)) {
+      const mapped = await mapErrorResponse(response);
+      return {
+        success: false,
+        error: mapped.error,
+        providerStatus: mapped.providerStatus,
+        providerMessage: mapped.providerMessage,
+      };
+    }
+
+    const content = await response.text();
+    return { success: true, content };
+  },
+};
diff --git a/functions/src/providers/index.ts b/functions/src/providers/index.ts
new file mode 100644
index 0000000..19ba505
--- /dev/null
+++ b/functions/src/providers/index.ts
@@ -0,0 +1,32 @@
+import { registerProvider, getProvider } from "./registry.js";
+import { osfProvider } from "./osf.js";
+import { gdriveProvider } from "./gdrive.js";
+import { StorageProvider, ContainerRef } from "./types.js";
+import { ExperimentData } from "../interfaces.js";
+
+registerProvider(osfProvider);
+registerProvider(gdriveProvider);
+
+export function getProviderForExperiment(exp_data: ExperimentData): {
+  provider: StorageProvider;
+  container: ContainerRef;
+} {
+  if (exp_data.storageProvider) {
+    return {
+      provider: getProvider(exp_data.storageProvider),
+      container: exp_data.providerContainer as ContainerRef,
+    };
+  }
+
+  // Legacy default: experiments created before the provider-migration schema
+  // have no storageProvider field and always write to OSF.
+  return {
+    provider: osfProvider,
+    container: { provider: "osf", filesLink: exp_data.osfFilesLink },
+  };
+}
+
+export { registerProvider, getProvider, listProviders } from "./registry.js";
+export { osfProvider } from "./osf.js";
+export { gdriveProvider } from "./gdrive.js";
+export * from "./types.js";
diff --git a/functions/src/providers/oauth-config.ts b/functions/src/providers/oauth-config.ts
new file mode 100644
index 0000000..ee5a1de
--- /dev/null
+++ b/functions/src/providers/oauth-config.ts
@@ -0,0 +1,44 @@
+// Provider OAuth registry (docs/provider-migration-design.md,
+// scratchpad/step4b-oauth-connect-spec.md).
+//
+// Only 'gdrive' is registered today. 'osf' deliberately has no entry here —
+// the OSF identity flow (oauth2-callback.ts) is a separate, untouched
+// legacy path with its own env vars (CLIENT_ID/CLIENT_SECRET/REDIRECT_URI).
+// Structured so a provider like figshare is a config addition, not a
+// rewrite.
+
+export interface OAuthConfig {
+  authorizeUrl: string;
+  tokenUrl: string;
+  clientId: string;
+  clientSecret: string;
+  redirectUri: string;
+  scope: string;
+  extraAuthParams: Record<string, string>;
+}
+
+// Each entry is a factory (not a plain object) so env vars are read at
+// CALL time, not module load — mirrors providers/gdrive.ts's getApiBase().
+const CONFIG_FACTORIES: Record<string, () => OAuthConfig> = {
+  gdrive: () => ({
+    authorizeUrl:
+      process.env.GDRIVE_AUTHORIZE_URL || "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl: process.env.GDRIVE_TOKEN_URL || "https://oauth2.googleapis.com/token",
+    clientId: process.env.GDRIVE_CLIENT_ID as string,
+    clientSecret: process.env.GDRIVE_CLIENT_SECRET as string,
+    redirectUri: process.env.GDRIVE_REDIRECT_URI as string,
+    scope: "https://www.googleapis.com/auth/drive.file",
+    // Without these, Google won't issue a refresh_token on the consent
+    // grant — a half-connected account (access token, no refresh token)
+    // is treated as a hard failure downstream.
+    extraAuthParams: { access_type: "offline", prompt: "consent" },
+  }),
+};
+
+export function getOAuthConfig(provider: string): OAuthConfig {
+  const factory = CONFIG_FACTORIES[provider];
+  if (!factory) {
+    throw new Error(`Unknown or unsupported OAuth provider: ${provider}`);
+  }
+  return factory();
+}
diff --git a/functions/src/providers/osf.ts b/functions/src/providers/osf.ts
new file mode 100644
index 0000000..1ae6b86
--- /dev/null
+++ b/functions/src/providers/osf.ts
@@ -0,0 +1,146 @@
+import fetch from "node-fetch";
+import putFileOSF from "../put-file-osf.js";
+import updateFileOSF from "../update-file-osf.js";
+import { OSFFile } from "../interfaces.js";
+import {
+  StorageProvider,
+  ResolvedAuth,
+  ContainerRef,
+  FileRef,
+  FileMeta,
+  WriteResult,
+  DownloadResult,
+  ProviderErrorCode,
+} from "./types.js";
+
+// The OSF container ref shape — only the filesLink is meaningful to this adapter.
+export interface OSFContainerRef extends ContainerRef {
+  provider: "osf";
+  filesLink: string;
+}
+
+function mapStatus(errorCode: number | null): ProviderErrorCode {
+  switch (errorCode) {
+    case 409:
+      return "NAME_CONFLICT";
+    case 401:
+    case 403:
+      return "AUTH_EXPIRED";
+    case 429:
+      return "RATE_LIMITED";
+    case 507:
+      return "QUOTA_EXCEEDED";
+    default:
+      return "UNAVAILABLE";
+  }
+}
+
+export const osfProvider: StorageProvider = {
+  id: "osf",
+  authMethod: "oauth2",
+  capabilities: {
+    nativeSubfolders: true,
+    supportsRegion: true,
+    maxFileSizeBytes: null,
+    quotaNote: null,
+  },
+
+  async createDataContainer(): Promise<ContainerRef> {
+    throw new Error("osfProvider.createDataContainer is not implemented");
+  },
+
+  async writeSessionFile(
+    auth: ResolvedAuth,
+    container: ContainerRef,
+    filename: string,
+    data: string | Buffer,
+    _meta: FileMeta
+  ): Promise<WriteResult> {
+    const osfContainer = container as OSFContainerRef;
+
+    const result = await putFileOSF(osfContainer.filesLink, auth.token, data, filename);
+
+    if (result.success) {
+      const storedFilename = result.fileName ?? filename;
+      return {
+        success: true,
+        fileRef: { name: storedFilename, id: result.fileId },
+        storedFilename,
+      };
+    }
+
+    return {
+      success: false,
+      error: mapStatus(result.errorCode),
+      providerStatus: result.errorCode,
+      providerMessage: result.errorText,
+      retryAfter: result.retryAfter,
+    };
+  },
+
+  async updateFile(
+    auth: ResolvedAuth,
+    container: ContainerRef,
+    existingFileRef: FileRef,
+    data: string | Buffer,
+    _meta: FileMeta
+  ): Promise<WriteResult> {
+    const osfContainer = container as OSFContainerRef;
+
+    // updateFileOSF throws on non-200 responses — let the throw propagate,
+    // callers rely on this behavior.
+    await updateFileOSF(osfContainer.filesLink, auth.token, data as string, existingFileRef.id as string);
+
+    return {
+      success: true,
+      fileRef: existingFileRef,
+      storedFilename: existingFileRef.name,
+    };
+  },
+
+  async listFiles(auth: ResolvedAuth, container: ContainerRef): Promise<FileRef[]> {
+    const osfContainer = container as OSFContainerRef;
+
+    const osfResult = await fetch(`${osfContainer.filesLink}?meta=`, {
+      method: "GET",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${auth.token}`,
+      },
+    });
+
+    const folder = (await osfResult.json()) as { data: OSFFile[] };
+    const listOfFiles: OSFFile[] = folder["data"];
+
+    return listOfFiles
+      .filter((file) => file.attributes.kind === "file")
+      .map((file) => ({ name: file.attributes.name, id: file.id }));
+  },
+
+  async downloadFile(
+    auth: ResolvedAuth,
+    container: ContainerRef,
+    fileRef: FileRef
+  ): Promise<DownloadResult> {
+    const osfContainer = container as OSFContainerRef;
+
+    const response = await fetch(`${osfContainer.filesLink}${fileRef.id}`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${auth.token}`,
+      },
+    });
+
+    if (response.status !== 200) {
+      return {
+        success: false,
+        error: mapStatus(response.status),
+        providerStatus: response.status,
+        providerMessage: response.statusText,
+      };
+    }
+
+    const content = await response.text();
+    return { success: true, content };
+  },
+};
diff --git a/functions/src/providers/registry.ts b/functions/src/providers/registry.ts
new file mode 100644
index 0000000..af85e3c
--- /dev/null
+++ b/functions/src/providers/registry.ts
@@ -0,0 +1,27 @@
+import { StorageProvider, StorageProviderId } from "./types.js";
+
+const providers = new Map<StorageProviderId, StorageProvider>();
+
+export function registerProvider(provider: StorageProvider): void {
+  if (providers.has(provider.id)) {
+    throw new Error(`Storage provider already registered: ${provider.id}`);
+  }
+  providers.set(provider.id, provider);
+}
+
+export function getProvider(id: StorageProviderId): StorageProvider {
+  const provider = providers.get(id);
+  if (!provider) {
+    throw new Error(`Unknown storage provider: ${id}`);
+  }
+  return provider;
+}
+
+export function listProviders(): StorageProviderId[] {
+  return [...providers.keys()];
+}
+
+// For tests only — production code never unregisters a provider.
+export function clearProvidersForTesting(): void {
+  providers.clear();
+}
diff --git a/functions/src/providers/types.ts b/functions/src/providers/types.ts
new file mode 100644
index 0000000..c93caaf
--- /dev/null
+++ b/functions/src/providers/types.ts
@@ -0,0 +1,173 @@
+// Storage-provider abstraction (docs/provider-migration-design.md).
+// Nothing imports these types yet except the registry; adapters arrive in
+// later build steps, starting with the OSF refactor.
+
+export type StorageProviderId = "osf" | "gdrive" | "figshare" | "dataverse";
+
+export type AuthMethod = "oauth2" | "static-token";
+
+// Generic error taxonomy that every adapter maps its provider's errors into.
+// QUOTA_EXCEEDED covers both storage-full and file-too-large.
+export type ProviderErrorCode =
+  | "RATE_LIMITED"
+  | "AUTH_EXPIRED"
+  | "NAME_CONFLICT"
+  | "QUOTA_EXCEEDED"
+  | "UNAVAILABLE";
+
+// A resolved, decrypted credential handed to adapter calls. serverUrl is only
+// present for federated providers (Dataverse).
+export interface ResolvedAuth {
+  token: string;
+  serverUrl?: string;
+}
+
+// Opaque, provider-shaped reference to the container an experiment writes
+// into (OSF component, Drive folder, Figshare article, Dataverse dataset).
+// Only the owning adapter interprets fields beyond `provider`.
+export interface ContainerRef {
+  provider: StorageProviderId;
+  [key: string]: unknown;
+}
+
+export interface FileRef {
+  name: string;
+  id?: string;
+  path?: string;
+  rev?: string;
+}
+
+export interface FileMeta {
+  size: number;
+  contentType: string;
+}
+
+export type WriteResult =
+  | {
+      success: true;
+      fileRef: FileRef;
+      // The filename the provider REPORTS having stored — callers compare it
+      // against the requested name to detect silent renames (Dataverse).
+      storedFilename: string;
+    }
+  | {
+      success: false;
+      error: ProviderErrorCode;
+      // Raw provider response, preserved for logs and the retry queue.
+      providerStatus: number | null;
+      providerMessage: string | null;
+      retryAfter?: number | null;
+    };
+
+export type DownloadResult =
+  | {
+      success: true;
+      content: string;
+    }
+  | {
+      success: false;
+      error: ProviderErrorCode;
+      providerStatus: number | null;
+      providerMessage: string | null;
+    };
+
+// Descriptive (UI hints, subfolder fallback, size-cap warnings) — never a
+// correctness gate. Collision detection lives in Firestore, not here.
+export interface ProviderCapabilities {
+  nativeSubfolders: boolean;
+  supportsRegion: boolean;
+  maxFileSizeBytes: number | null;
+  quotaNote: string | null;
+}
+
+export interface OAuthEndpointConfig {
+  authorizeUrl: string;
+  tokenUrl: string;
+  clientId: string;
+  clientSecret: string;
+  scope: string;
+}
+
+export interface StorageProvider {
+  id: StorageProviderId;
+  authMethod: AuthMethod;
+  capabilities: ProviderCapabilities;
+
+  // oauth2 providers only
+  oauth?: OAuthEndpointConfig;
+
+  // static-token providers only
+  validateStaticToken?(auth: ResolvedAuth): Promise<boolean>;
+
+  // One-time setup at experiment creation. researcherInput is provider-shaped
+  // (e.g. parent project for Figshare, collection + serverUrl for Dataverse).
+  createDataContainer(
+    auth: ResolvedAuth,
+    researcherInput: Record<string, unknown>
+  ): Promise<ContainerRef>;
+
+  writeSessionFile(
+    auth: ResolvedAuth,
+    container: ContainerRef,
+    filename: string,
+    data: string | Buffer,
+    meta: FileMeta
+  ): Promise<WriteResult>;
+
+  // Figshare has no in-place update: its adapter implements this as
+  // delete + re-upload, so callers must tolerate a non-atomic window.
+  updateFile(
+    auth: ResolvedAuth,
+    container: ContainerRef,
+    existingFileRef: FileRef,
+    data: string | Buffer,
+    meta: FileMeta
+  ): Promise<WriteResult>;
+
+  // Full listing (adapters paginate internally). Used for collision-cache
+  // rehydration and dashboard file counts.
+  listFiles(auth: ResolvedAuth, container: ContainerRef): Promise<FileRef[]>;
+
+  // Fetches a file's contents as text. Used by metadata-block.ts to read
+  // back an existing dataset_description.json. Never throws — failures come
+  // back as a DownloadResult, same shape convention as WriteResult.
+  downloadFile(
+    auth: ResolvedAuth,
+    container: ContainerRef,
+    fileRef: FileRef
+  ): Promise<DownloadResult>;
+}
+
+// users/{uid}.connectedAccounts.* shapes (additive Firestore schema).
+export interface OAuth2AccountConnection {
+  authMethod: "oauth2";
+  encryptedToken: string;
+  encryptedRefreshToken: string;
+  tokenExpiresAt: number;
+  providerAccountId?: string;
+}
+
+export interface StaticTokenAccountConnection {
+  authMethod: "static-token";
+  encryptedToken: string;
+  serverUrl: string;
+  // Dataverse tokens expire (~yearly); drives the expiry-warning job.
+  tokenExpiresAt?: number;
+}
+
+export interface ConnectedAccounts {
+  gdrive?: OAuth2AccountConnection;
+  figshare?: OAuth2AccountConnection;
+  dataverse?: StaticTokenAccountConnection;
+}
+
+// experiments/{id}.collisionCache (additive Firestore schema). The salt is a
+// per-experiment nonce retained indefinitely; claims themselves live in a
+// subcollection keyed by salted filename hash and expire via TTL.
+export interface CollisionCacheState {
+  salt: string;
+  warmUntil: FirebaseFirestore.Timestamp;
+  // Set while a rehydration pass is in flight (leases the rehydration work
+  // to one request at a time); cleared on completion or failure.
+  rehydratingUntil?: FirebaseFirestore.Timestamp;
+}
diff --git a/functions/src/put-file-osf.ts b/functions/src/put-file-osf.ts
index 66b38e6..e4b9ff6 100644
--- a/functions/src/put-file-osf.ts
+++ b/functions/src/put-file-osf.ts
@@ -1,3 +1,4 @@
+import fetch from "node-fetch";
 import resolveFolder from "./subfolder.js";
 
 export default async function putFileOSF(
@@ -18,7 +19,7 @@ export default async function putFileOSF(
   // folder that will hold the file. A bare "abc123.json" has no segments and
   // uploads straight to the storage root (or to startUrl, if given).
   const segments = filename.split('/');
-  const fileName = segments.pop() as string;
+  const requestedFileName = segments.pop() as string;
 
   let targetUrl = startUrl ?? osfComponent;
   for (const folder of segments) {
@@ -27,7 +28,7 @@ export default async function putFileOSF(
 
   const queryParams = new URLSearchParams({
     kind: "file",
-    name: fileName,
+    name: requestedFileName,
   });
 
   const osfResult = await fetch(`${targetUrl}?${queryParams.toString()}`, {
@@ -36,9 +37,7 @@ export default async function putFileOSF(
       "Content-Type": "application/json",
       Authorization: `Bearer ${osfToken}`,
     },
-    // Buffer is a valid fetch body at runtime; the cast sidesteps a @types/node
-    // generic-Buffer vs BodyInit mismatch.
-    body: filedata as BodyInit,
+    body: filedata,
   });
 
   if (osfResult.status !== 201) {
@@ -47,5 +46,19 @@ export default async function putFileOSF(
     return { success: false, errorCode: osfResult.status, errorText: osfResult.statusText, retryAfter };
   }
 
-  return { success: true, errorCode: null, errorText: null };
+  // Parse the created-file reference out of the response body. Tolerate a
+  // missing/unparseable body — the upload itself already succeeded (status
+  // 201), so a body we can't read must never turn this into a failure.
+  let fileId: string | undefined;
+  let fileName: string | undefined;
+  try {
+    const body = (await osfResult.json()) as { data?: { id?: string; attributes?: { name?: string } } };
+    fileId = body?.data?.id;
+    fileName = body?.data?.attributes?.name;
+  } catch {
+    fileId = undefined;
+    fileName = undefined;
+  }
+
+  return { success: true, errorCode: null, errorText: null, fileId, fileName };
 }
diff --git a/functions/src/queue-upload.ts b/functions/src/queue-upload.ts
index 7e75621..a2620f8 100644
--- a/functions/src/queue-upload.ts
+++ b/functions/src/queue-upload.ts
@@ -1,5 +1,6 @@
 import { Timestamp } from "firebase-admin/firestore";
 import { db, storage } from "./app.js";
+import { StorageProviderId, ContainerRef } from "./providers/types.js";
 
 interface QueueUploadParams {
   experimentID: string;
@@ -7,10 +8,18 @@ interface QueueUploadParams {
   filename: string;
   data: string;
   dataType: "data" | "base64";
-  osfFilesLink: string;
+  // Optional — undefined for provider-migrated (e.g. gdrive) experiments,
+  // which carry storageProvider/providerContainer instead.
+  osfFilesLink?: string;
   errorCode: number;
   sessionIncremented: boolean;
   failureReason?: string;
+  claimToken?: string;
+  // Provider-migration fields (additive; absent for legacy OSF experiments —
+  // omitted from the Firestore write below rather than stored as undefined,
+  // since Firestore rejects undefined field values).
+  storageProvider?: StorageProviderId;
+  providerContainer?: ContainerRef;
 }
 
 const MAX_RETRIES = 5;
@@ -65,14 +74,16 @@ export default async function queueUpload(params: QueueUploadParams): Promise<st
   const file = bucket.file(storagePath);
   await file.save(params.data, { contentType: "text/plain" });
 
-  // Write metadata to Firestore
-  await docRef.set({
+  // Write metadata to Firestore. osfFilesLink/storageProvider/providerContainer
+  // are included only when present — Firestore rejects undefined field
+  // values, and a gdrive experiment has no osfFilesLink just as a legacy OSF
+  // experiment has no storageProvider/providerContainer.
+  const queueDocData: Record<string, unknown> = {
     experimentID: params.experimentID,
     owner: params.owner,
     filename: params.filename,
     storagePath,
     dataType: params.dataType,
-    osfFilesLink: params.osfFilesLink,
     status: "pending",
     errorCode: params.errorCode,
     retryCount: 0,
@@ -84,7 +95,20 @@ export default async function queueUpload(params: QueueUploadParams): Promise<st
     failureReason: params.failureReason || null,
     deduplicationKey,
     sessionIncremented: params.sessionIncremented,
-  });
+    claimToken: params.claimToken || null,
+  };
+
+  if (params.osfFilesLink !== undefined) {
+    queueDocData.osfFilesLink = params.osfFilesLink;
+  }
+  if (params.storageProvider !== undefined) {
+    queueDocData.storageProvider = params.storageProvider;
+  }
+  if (params.providerContainer !== undefined) {
+    queueDocData.providerContainer = params.providerContainer;
+  }
+
+  await docRef.set(queueDocData);
 
   return docId;
 }
diff --git a/functions/src/resolve-token.ts b/functions/src/resolve-token.ts
index 40488a1..47884cb 100644
--- a/functions/src/resolve-token.ts
+++ b/functions/src/resolve-token.ts
@@ -1,5 +1,6 @@
 import { decrypt } from "./crypto-utils.js";
 import { refreshAndUpdateUser } from "./refresh-token.js";
+import { refreshGdriveToken } from "./providers/gdrive-oauth.js";
 import { ExperimentData, UserData } from './interfaces';
 
 type TokenResult = {
@@ -15,7 +16,7 @@ function hasValidPAT(user_data: UserData): boolean {
   return user_data.osfTokenValid && !!user_data.osfToken;
 }
 
-export default async function resolveToken(
+async function resolveOsfToken(
   user_data: UserData,
   exp_data: ExperimentData,
 ): Promise<TokenResult> {
@@ -43,3 +44,49 @@ export default async function resolveToken(
 
   return { success: true, token: decrypt(user_data.authToken) };
 }
+
+async function resolveGdriveToken(
+  user_data: UserData,
+  exp_data: ExperimentData,
+): Promise<TokenResult> {
+  const gdrive = user_data.connectedAccounts?.gdrive;
+
+  if (!gdrive) {
+    return {
+      success: false,
+      error: "PROVIDER_NOT_CONNECTED",
+      detail: "No connected Google Drive account for this experiment's owner",
+    };
+  }
+
+  if (gdrive.tokenExpiresAt > Date.now()) {
+    return { success: true, token: decrypt(gdrive.encryptedToken) };
+  }
+
+  const refreshResult = await refreshGdriveToken(exp_data.owner, gdrive);
+
+  if (!refreshResult.success) {
+    return { success: false, error: refreshResult.error, detail: refreshResult.detail };
+  }
+
+  return { success: true, token: refreshResult.accessToken };
+}
+
+export default async function resolveToken(
+  user_data: UserData,
+  exp_data: ExperimentData,
+): Promise<TokenResult> {
+  if (!exp_data.storageProvider || exp_data.storageProvider === "osf") {
+    return resolveOsfToken(user_data, exp_data);
+  }
+
+  if (exp_data.storageProvider === "gdrive") {
+    return resolveGdriveToken(user_data, exp_data);
+  }
+
+  return {
+    success: false,
+    error: "PROVIDER_NOT_CONNECTED",
+    detail: `Unsupported storage provider: ${exp_data.storageProvider}`,
+  };
+}
diff --git a/functions/src/scheduled-pending-recovery.ts b/functions/src/scheduled-pending-recovery.ts
index f17d5f9..51159d2 100644
--- a/functions/src/scheduled-pending-recovery.ts
+++ b/functions/src/scheduled-pending-recovery.ts
@@ -152,13 +152,20 @@ export async function promoteToQueue(
     const now = Timestamp.now();
     const nextRetryAt = Timestamp.fromMillis(now.toMillis() + 60 * 1000); // 1 minute — retry soon
 
-    transaction.set(docRef, {
+    // osfFilesLink/storageProvider/providerContainer are included only when
+    // present -- Firestore rejects undefined field values, and a gdrive
+    // experiment has no osfFilesLink just as a legacy OSF experiment has no
+    // storageProvider/providerContainer. Same omit-if-undefined convention as
+    // queue-upload.ts, whose callers (api-data.ts) already pass these
+    // through; this re-queue path must carry them too, or a recovered
+    // pending upload for a gdrive experiment falls back to the legacy OSF
+    // shape and fails when scheduled-upload-retry.ts processes it.
+    const queueDocData: Record<string, unknown> = {
       experimentID,
       owner: expData.owner,
       filename: uploadFilename,
       storagePath,
       dataType: "data",
-      osfFilesLink: expData.osfFilesLink,
       status: "pending",
       errorCode: 0,
       retryCount: 0,
@@ -170,7 +177,19 @@ export async function promoteToQueue(
       failureReason: "Recovered from interrupted upload (server restart or memory limit)",
       deduplicationKey,
       sessionIncremented: false,
-    });
+    };
+
+    if (expData.osfFilesLink !== undefined) {
+      queueDocData.osfFilesLink = expData.osfFilesLink;
+    }
+    if (expData.storageProvider !== undefined) {
+      queueDocData.storageProvider = expData.storageProvider;
+    }
+    if (expData.providerContainer !== undefined) {
+      queueDocData.providerContainer = expData.providerContainer;
+    }
+
+    transaction.set(docRef, queueDocData);
 
     return true;
   });
diff --git a/functions/src/scheduled-token-refresh.ts b/functions/src/scheduled-token-refresh.ts
index 9d68824..1cf7afc 100644
--- a/functions/src/scheduled-token-refresh.ts
+++ b/functions/src/scheduled-token-refresh.ts
@@ -1,10 +1,54 @@
 import { onSchedule } from "firebase-functions/v2/scheduler";
 import { db } from "./app.js";
 import { refreshAndUpdateUser } from "./refresh-token.js";
+import { refreshGdriveToken } from "./providers/gdrive-oauth.js";
 import { decrypt } from "./crypto-utils.js";
 import { UserData } from "./interfaces.js";
 
 const TWO_WEEKS_MS = 14 * 24 * 60 * 60 * 1000;
+const GDRIVE_DEFAULT_WINDOW_MS = 10 * 60 * 1000;
+
+/**
+ * Proactively refreshes gdrive access tokens for users whose token expires
+ * within `windowMs` (default 10 minutes). Mirrors the OSF pass's cadence
+ * convention, but on a much shorter window since gdrive access tokens are
+ * short-lived (~1 hour) rather than the ~1-month OSF refresh-token window.
+ *
+ * Failures are logged and skipped — a single user's refresh failure must
+ * never abort the whole pass, and (in 4b) there is no user-visible state
+ * change on failure: the connection is simply left as-is.
+ */
+export async function refreshExpiringGdriveTokens(windowMs: number = GDRIVE_DEFAULT_WINDOW_MS): Promise<void> {
+  const expirationThreshold = Date.now() + windowMs;
+
+  const usersSnapshot = await db
+    .collection("users")
+    .where("connectedAccounts.gdrive.tokenExpiresAt", "<", expirationThreshold)
+    .get();
+
+  if (usersSnapshot.empty) {
+    return;
+  }
+
+  for (const userDoc of usersSnapshot.docs) {
+    const userData = userDoc.data() as UserData;
+    const gdrive = userData.connectedAccounts?.gdrive;
+    const userId = userDoc.id;
+
+    if (!gdrive) {
+      continue;
+    }
+
+    try {
+      const result = await refreshGdriveToken(userId, gdrive);
+      if (!result.success) {
+        console.error(`Failed to refresh gdrive token for user ${userId}: ${result.detail}`);
+      }
+    } catch (error) {
+      console.error(`Error refreshing gdrive token for user ${userId}:`, error);
+    }
+  }
+}
 
 /**
  * Scheduled function that runs weekly to proactively refresh OAuth tokens
@@ -68,4 +112,13 @@ export const scheduledTokenRefresh = onSchedule("0 2 * * 0", async () => {
   console.log(
     `Token refresh complete. Success: ${successCount}, Failed: ${failCount}`
   );
+
+  // gdrive pass runs after the OSF pass, wrapped so a gdrive-side failure
+  // (e.g. a query error) can never break/roll back the OSF pass above —
+  // refreshExpiringGdriveTokens itself already isolates per-user failures.
+  try {
+    await refreshExpiringGdriveTokens();
+  } catch (error) {
+    console.error("Error during gdrive token refresh pass:", error);
+  }
 });
diff --git a/functions/src/scheduled-upload-retry.ts b/functions/src/scheduled-upload-retry.ts
index e26b97d..45f2111 100644
--- a/functions/src/scheduled-upload-retry.ts
+++ b/functions/src/scheduled-upload-retry.ts
@@ -1,8 +1,10 @@
 import { onSchedule } from "firebase-functions/v2/scheduler";
 import { Timestamp } from "firebase-admin/firestore";
 import { db, storage } from "./app.js";
-import putFileOSF from "./put-file-osf.js";
+import { getProvider } from "./providers/index.js";
+import { ContainerRef, StorageProviderId } from "./providers/types.js";
 import resolveToken from "./resolve-token.js";
+import { claimFilename, confirmClaim, CollisionCacheUnavailableError } from "./collision-cache.js";
 import { ExperimentData, UserData } from "./interfaces.js";
 
 const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;
@@ -133,24 +135,76 @@ async function processQueueItem(queueDoc: FirebaseFirestore.QueryDocumentSnapsho
     return;
   }
 
+  // Provider/container come from the queue doc's provider-migration fields
+  // when present; legacy entries (queued before this generalization) fall
+  // back to the OSF shape built from osfFilesLink.
+  const providerId: StorageProviderId = (data.storageProvider as StorageProviderId) || "osf";
+  const provider = getProvider(providerId);
+  const container: ContainerRef = data.providerContainer
+    ? (data.providerContainer as ContainerRef)
+    : { provider: "osf", filesLink: data.osfFilesLink };
+
+  // Collision cache: only entries queued after the cache existed carry a
+  // claimToken. Entries queued before it skip the cache entirely — legacy
+  // behavior, the provider's own conflict backstop still applies to them.
+  if (data.claimToken) {
+    let claimResult: Awaited<ReturnType<typeof claimFilename>>;
+    try {
+      claimResult = await claimFilename(data.experimentID, data.filename, data.claimToken, () =>
+        provider.listFiles({ token }, container)
+      );
+    } catch (e) {
+      if (e instanceof CollisionCacheUnavailableError) {
+        await handleRetryFailure(docRef, data, `Collision cache rehydration failed: ${e.message}`);
+        return;
+      }
+      throw e;
+    }
+
+    if (!claimResult.claimed) {
+      if (claimResult.reason === "duplicate") {
+        // Someone else confirmed this name while we were queued — mirrors
+        // today's 409-on-retry-means-done semantics.
+        await markCompleted(docRef, data);
+        console.log(`Upload ${queueDoc.id} marked complete — file already exists in OSF.`);
+        return;
+      }
+      // reason === "rehydrating"
+      await handleRetryFailure(docRef, data, "Collision cache rehydrating");
+      return;
+    }
+  }
+
   // Attempt the upload
   try {
-    const result = await putFileOSF(data.osfFilesLink, token, fileData, data.filename);
+    const result = await provider.writeSessionFile(
+      { token },
+      container,
+      data.filename,
+      fileData,
+      { size: Buffer.byteLength(fileData), contentType: "application/json" }
+    );
 
     if (result.success) {
+      if (data.claimToken) {
+        await confirmClaim(data.experimentID, data.filename, data.claimToken);
+      }
       await markCompleted(docRef, data);
       console.log(`Successfully retried upload ${queueDoc.id} (${data.filename})`);
       return;
     }
 
-    if (result.errorCode === 409) {
+    if (result.error === "NAME_CONFLICT") {
+      if (data.claimToken) {
+        await confirmClaim(data.experimentID, data.filename, data.claimToken);
+      }
       // File already exists — treat as success (original upload may have worked)
       await markCompleted(docRef, data);
-      console.log(`Upload ${queueDoc.id} marked complete — file already exists in OSF.`);
+      console.log(`Upload ${queueDoc.id} marked complete — file already exists provider-side.`);
       return;
     }
 
-    await handleRetryFailure(docRef, data, `OSF error ${result.errorCode}: ${result.errorText}`, result.retryAfter);
+    await handleRetryFailure(docRef, data, `Provider error ${result.providerStatus}: ${result.providerMessage}`, result.retryAfter);
   } catch (e) {
     const detail = e instanceof Error ? e.message : "Unknown error";
     await handleRetryFailure(docRef, data, `Upload exception: ${detail}`);
diff --git a/functions/src/subfolder.ts b/functions/src/subfolder.ts
index b063561..e4926c7 100644
--- a/functions/src/subfolder.ts
+++ b/functions/src/subfolder.ts
@@ -1,3 +1,4 @@
+import fetch from "node-fetch";
 import { OSFFile } from './interfaces';
 
 /**
@@ -32,7 +33,7 @@ export default async function resolveFolder(
   });
 
   if (created.ok) {
-    const body = await created.json();
+    const body = (await created.json()) as { data?: { links?: { move?: string } } };
     const move = body?.data?.links?.move;
     if (!move) {
       throw new Error(`OSF subfolder creation response missing expected 'data.links.move' path`);
@@ -68,7 +69,7 @@ async function findChildFolder(parentUrl: string, osfToken: string, name: string
     throw new Error(`Failed to list files in OSF folder (status ${osfResult.status}: ${osfResult.statusText})`);
   }
 
-  const folder = await osfResult.json();
+  const folder = (await osfResult.json()) as { data?: unknown };
   const listOfFiles = folder['data'];
 
   if (!Array.isArray(listOfFiles)) {
diff --git a/lib/experiment-creation.js b/lib/experiment-creation.js
index 4dfea55..e655102 100644
--- a/lib/experiment-creation.js
+++ b/lib/experiment-creation.js
@@ -155,6 +155,44 @@ export async function createExperimentDocument(experimentData) {
   return id;
 }
 
+// Non-OSF providers (gdrive, and later figshare/dataverse) are created
+// server-side via /api/createexperiment (see functions/src/create-experiment.ts)
+// rather than the browser-driven OSF path above -- the server needs the
+// decrypted provider token that only resolve-token.ts can produce. This
+// helper just calls that endpoint and normalizes the response shape to
+// match createExperiment()'s { experimentId } contract.
+export async function createProviderExperiment(provider, title) {
+  const user = auth.currentUser;
+  if (!user) {
+    throw new Error("User not authenticated");
+  }
+
+  const idToken = await user.getIdToken();
+
+  const response = await fetch("/api/createexperiment", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({
+      provider,
+      title,
+      uid: user.uid,
+      idToken,
+    }),
+  });
+
+  const data = await response.json();
+
+  if (!response.ok) {
+    throw new Error(data.error || `Failed to create experiment: ${response.status}`);
+  }
+
+  return {
+    experimentId: data.experimentID,
+  };
+}
+
 export async function createExperiment(params) {
   const {
     title,
diff --git a/lib/provider-config.js b/lib/provider-config.js
new file mode 100644
index 0000000..8a3da6f
--- /dev/null
+++ b/lib/provider-config.js
@@ -0,0 +1,15 @@
+// Frontend registry of non-OSF storage providers. OSF is deliberately NOT
+// included here -- it keeps its bespoke legacy UI (identity flow, PAT flow,
+// existing new-experiment form, existing dashboard links). Adding a new
+// provider (e.g. figshare) should only require a new entry in this map.
+export const STORAGE_PROVIDERS = {
+  gdrive: {
+    id: "gdrive",
+    name: "Google Drive",
+    isConnected: (userDoc) => !!userDoc?.connectedAccounts?.gdrive,
+    containerLink: (exp) =>
+      `https://drive.google.com/drive/folders/${exp.providerContainer?.folderId}`,
+    containerLabel: "Google Drive Folder",
+    containerLinkText: "Open folder",
+  },
+};
diff --git a/package-lock.json b/package-lock.json
index c6620b3..d7b7337 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5180,7 +5180,6 @@
       "version": "2.5.6",
       "resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.5.6.tgz",
       "integrity": "sha512-tmmZ3lQxAe/k/+rNnXQRawJ4NjxO2hqiOLTHvWchtGZULp4RyFeh6aU4XdOYBFe2KE1oShQTv4AblOs2iOrNnQ==",
-      "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -5220,7 +5219,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5241,7 +5239,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5262,7 +5259,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5283,7 +5279,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5304,7 +5299,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5325,7 +5319,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5346,7 +5339,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5367,7 +5359,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5388,7 +5379,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5409,7 +5399,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5430,7 +5419,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5451,7 +5439,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5472,7 +5459,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5490,7 +5476,6 @@
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "engines": {
@@ -13694,7 +13679,7 @@
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
       "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -13759,7 +13744,7 @@
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
       "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "is-extglob": "^2.1.1"
@@ -17788,7 +17773,6 @@
       "version": "7.1.1",
       "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz",
       "integrity": "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==",
-      "dev": true,
       "license": "MIT",
       "optional": true
     },
diff --git a/pages/admin/account.js b/pages/admin/account.js
index c91f7c0..4ee7649 100644
--- a/pages/admin/account.js
+++ b/pages/admin/account.js
@@ -5,6 +5,7 @@ import ChangePassword from "../../components/account/ChangePassword";
 import DeleteAccount from "../../components/account/DeleteAccount";
 import { useState, useContext } from "react";
 import SelectAuth from "../../components/account/SelectAuth";
+import ProviderConnections from "../../components/account/ProviderConnections";
 import { UserContext } from "../../lib/context";
 import { useDocumentData } from "react-firebase-hooks/firestore";
 import { doc } from "firebase/firestore";
@@ -46,6 +47,13 @@ export default function AccountPage({}) {
           <SelectAuth />
         )}
 
+        {/* Storage Providers Section */}
+        <Separator my={6} borderColor="whiteAlpha.200" />
+        <Text fontSize="xs" fontWeight="semibold" textTransform="uppercase" letterSpacing="wide" color="gray.500" mb={3}>
+          Storage Providers
+        </Text>
+        <ProviderConnections />
+
         {/* Account Section - only for email users */}
         {!isOAuthUser && (
           <>
diff --git a/pages/admin/new.js b/pages/admin/new.js
index 0b010e9..1baabe7 100644
--- a/pages/admin/new.js
+++ b/pages/admin/new.js
@@ -6,10 +6,12 @@ import { UserContext } from "../../lib/context";
 import { useDocumentData } from "react-firebase-hooks/firestore";
 import Link from "next/link";
 import Router from "next/router";
-import { createExperiment } from "../../lib/experiment-creation";
+import { createExperiment, createProviderExperiment } from "../../lib/experiment-creation";
+import { STORAGE_PROVIDERS } from "../../lib/provider-config";
 import {
   Button,
   Stack,
+  HStack,
   Heading,
   Field,
   Input,
@@ -41,9 +43,16 @@ function NewExperimentForm() {
   const [osfComponentName, setOsfComponentName] = useState("");
   const [region, setRegion] = useState("us");
 
+  const [provider, setProvider] = useState("osf");
+  const [gdriveTitle, setGdriveTitle] = useState("");
+  const [gdriveTitleError, setGdriveTitleError] = useState(false);
+  const [gdriveSubmitting, setGdriveSubmitting] = useState(false);
+  const [gdriveError, setGdriveError] = useState(null);
+
   const [data, loading, error] = useDocumentData(doc(db, "users", user.uid));
 
   const isValid = data && (data.usingPersonalToken ? data.osfTokenValid : data.refreshToken !== "");
+  const gdriveConnected = STORAGE_PROVIDERS.gdrive.isConnected(data);
 
   const handleSubmit = async () => {
     setIsSubmitting(true);
@@ -84,102 +93,196 @@ function NewExperimentForm() {
     }
   };
 
+  const handleGdriveSubmit = async () => {
+    setGdriveSubmitting(true);
+    setGdriveError(null);
+
+    if (gdriveTitle.length === 0) {
+      setGdriveTitleError(true);
+      setGdriveSubmitting(false);
+      return;
+    }
+
+    try {
+      const result = await createProviderExperiment("gdrive", gdriveTitle);
+      Router.push(`/admin/${result.experimentId}`);
+    } catch (err) {
+      console.error(err);
+      setGdriveSubmitting(false);
+      setGdriveError(err.message);
+    }
+  };
+
   return (
     <>
       {loading && <Spinner color="brandTeal.500" size={"xl"} />}
-      {isValid && (
+      {!loading && (
         <Stack gap={6} w="100%" maxW="540px" px={4}>
           <Heading>Create a New Experiment</Heading>
-          <Field.Root invalid={titleError}>
-            <Field.Label>Title</Field.Label>
-            <Input
-              type="text"
-              value={title}
-              onChange={(e) => {
-                setTitle(e.target.value);
-                setTitleError(false);
-              }}
-            />
-            <Field.ErrorText color="red.400">
-              This field is required
-            </Field.ErrorText>
-          </Field.Root>
-          <Field.Root invalid={osfError}>
-            <Field.Label>Existing OSF Project</Field.Label>
-            <Group attached>
-              <InputAddon bgColor={"greyBackground"}>
-                {`https://${process.env.NEXT_PUBLIC_OSF_ENV}osf.io/`}
-              </InputAddon>
-              <Input
-                type="text"
-                value={osfRepo}
-                onChange={(e) => setOsfRepo(e.target.value)}
-              />
-            </Group>
-            <Field.ErrorText color="red.400">
-              Cannot connect to this OSF component
-            </Field.ErrorText>
-          </Field.Root>
-          <Field.Root invalid={dataComponentError}>
-            <Field.Label>New OSF Data Component Name</Field.Label>
-            <Input
-              type="text"
-              value={osfComponentName}
-              onChange={(e) => {
-                setOsfComponentName(e.target.value);
-                setDataComponentError(false);
-              }}
-            />
-            <Field.ErrorText color="red.400">
-              This field is required
-            </Field.ErrorText>
-            <Field.HelperText color="gray">
-              DataPipe will create a new component with this name in the OSF
-              project and store all data in it.
-            </Field.HelperText>
-          </Field.Root>
+
           <Field.Root>
-            <Field.Label>Storage Location</Field.Label>
-            <NativeSelect.Root>
-              <NativeSelect.Field
-                value={region}
-                onChange={(e) => setRegion(e.target.value)}
-              >
-                <option value="us">United States</option>
-                <option value="de-1">Germany - Frankfurt</option>
-                <option value="au-1">Australia - Sydney</option>
-                <option value="ca-1">Canada - Montreal</option>
-              </NativeSelect.Field>
-            </NativeSelect.Root>
-            <Field.HelperText color="gray">
-              Choose the region where the data will be stored.
-            </Field.HelperText>
+            <Field.Label>Where should data be stored?</Field.Label>
+            <HStack gap={6} mt={2} role="radiogroup" aria-label="Where should data be stored?">
+              <HStack as="label" gap={2} cursor="pointer">
+                <input
+                  type="radio"
+                  name="storage-provider"
+                  value="osf"
+                  checked={provider === "osf"}
+                  onChange={() => setProvider("osf")}
+                />
+                <Text>OSF</Text>
+              </HStack>
+              <HStack as="label" gap={2} cursor="pointer">
+                <input
+                  type="radio"
+                  name="storage-provider"
+                  value="gdrive"
+                  checked={provider === "gdrive"}
+                  onChange={() => setProvider("gdrive")}
+                />
+                <Text>Google Drive</Text>
+              </HStack>
+            </HStack>
           </Field.Root>
-          <Button
-            onClick={handleSubmit}
-            loading={isSubmitting}
-            colorPalette={"brandTeal"}
-          >
-            Create
-          </Button>
+
+          {provider === "osf" && isValid && (
+            <>
+              <Field.Root invalid={titleError}>
+                <Field.Label>Title</Field.Label>
+                <Input
+                  type="text"
+                  value={title}
+                  onChange={(e) => {
+                    setTitle(e.target.value);
+                    setTitleError(false);
+                  }}
+                />
+                <Field.ErrorText color="red.400">
+                  This field is required
+                </Field.ErrorText>
+              </Field.Root>
+              <Field.Root invalid={osfError}>
+                <Field.Label>Existing OSF Project</Field.Label>
+                <Group attached>
+                  <InputAddon bgColor={"greyBackground"}>
+                    {`https://${process.env.NEXT_PUBLIC_OSF_ENV}osf.io/`}
+                  </InputAddon>
+                  <Input
+                    type="text"
+                    value={osfRepo}
+                    onChange={(e) => setOsfRepo(e.target.value)}
+                  />
+                </Group>
+                <Field.ErrorText color="red.400">
+                  Cannot connect to this OSF component
+                </Field.ErrorText>
+              </Field.Root>
+              <Field.Root invalid={dataComponentError}>
+                <Field.Label>New OSF Data Component Name</Field.Label>
+                <Input
+                  type="text"
+                  value={osfComponentName}
+                  onChange={(e) => {
+                    setOsfComponentName(e.target.value);
+                    setDataComponentError(false);
+                  }}
+                />
+                <Field.ErrorText color="red.400">
+                  This field is required
+                </Field.ErrorText>
+                <Field.HelperText color="gray">
+                  DataPipe will create a new component with this name in the OSF
+                  project and store all data in it.
+                </Field.HelperText>
+              </Field.Root>
+              <Field.Root>
+                <Field.Label>Storage Location</Field.Label>
+                <NativeSelect.Root>
+                  <NativeSelect.Field
+                    value={region}
+                    onChange={(e) => setRegion(e.target.value)}
+                  >
+                    <option value="us">United States</option>
+                    <option value="de-1">Germany - Frankfurt</option>
+                    <option value="au-1">Australia - Sydney</option>
+                    <option value="ca-1">Canada - Montreal</option>
+                  </NativeSelect.Field>
+                </NativeSelect.Root>
+                <Field.HelperText color="gray">
+                  Choose the region where the data will be stored.
+                </Field.HelperText>
+              </Field.Root>
+              <Button
+                onClick={handleSubmit}
+                loading={isSubmitting}
+                colorPalette={"brandTeal"}
+              >
+                Create
+              </Button>
+            </>
+          )}
+
+          {provider === "osf" && !isValid && (
+            <VStack gap={3}>
+              <Text color="gray.400" textAlign="center">
+                DataPipe sends experiment data directly to your OSF project.
+                Connect your OSF account to get started.
+              </Text>
+              <Link href="/admin/account">
+                <Button variant={"solid"} colorPalette={"brandTeal"} size={"lg"}>
+                  Connect OSF Account
+                </Button>
+              </Link>
+            </VStack>
+          )}
+
+          {provider === "gdrive" && !gdriveConnected && (
+            <VStack gap={3}>
+              <Text color="gray.400" textAlign="center">
+                DataPipe sends experiment data directly to your Google Drive.
+                Connect your Google Drive account to get started.
+              </Text>
+              <Link href="/admin/account">
+                <Button variant={"solid"} colorPalette={"brandTeal"} size={"lg"}>
+                  Connect Google Drive Account
+                </Button>
+              </Link>
+            </VStack>
+          )}
+
+          {provider === "gdrive" && gdriveConnected && (
+            <>
+              {gdriveError && (
+                <Text color="red.400" fontSize="sm">
+                  {gdriveError}
+                </Text>
+              )}
+              <Field.Root invalid={gdriveTitleError}>
+                <Field.Label>Title</Field.Label>
+                <Input
+                  type="text"
+                  value={gdriveTitle}
+                  onChange={(e) => {
+                    setGdriveTitle(e.target.value);
+                    setGdriveTitleError(false);
+                  }}
+                />
+                <Field.ErrorText color="red.400">
+                  This field is required
+                </Field.ErrorText>
+              </Field.Root>
+              <Button
+                onClick={handleGdriveSubmit}
+                loading={gdriveSubmitting}
+                colorPalette={"brandTeal"}
+              >
+                Create
+              </Button>
+            </>
+          )}
         </Stack>
       )}
-      {!loading && !isValid && (
-        <VStack gap={6} maxW="540px" w="100%" px={4}>
-          <VStack gap={3}>
-            <Heading>Create a New Experiment</Heading>
-            <Text color="gray.400" textAlign="center">
-              DataPipe sends experiment data directly to your OSF project.
-              Connect your OSF account to get started.
-            </Text>
-          </VStack>
-          <Link href="/admin/account">
-            <Button variant={"solid"} colorPalette={"brandTeal"} size={"lg"}>
-              Connect OSF Account
-            </Button>
-          </Link>
-        </VStack>
-      )}
     </>
   );
 }
diff --git a/pages/oauth2/connect.js b/pages/oauth2/connect.js
new file mode 100644
index 0000000..690811a
--- /dev/null
+++ b/pages/oauth2/connect.js
@@ -0,0 +1,185 @@
+import { VStack, Heading, Text, Button, Alert, Card, Spinner, Center } from "@chakra-ui/react";
+import { useEffect, useContext, useReducer, useRef } from "react";
+import { useRouter } from "next/router";
+import Link from "next/link";
+import { UserContext } from "../../lib/context";
+import { auth } from "../../lib/firebase";
+
+// Redirect target for provider (non-OSF) OAuth connect flows -- distinct
+// from pages/oauth2/callback.js, which handles the OSF IDENTITY flow
+// (signup/sign-in/account linking). This page only ever grants storage
+// access to an already-authenticated user (see connect-provider.ts).
+// GDRIVE_REDIRECT_URI (and future provider redirect URIs) must point here.
+
+const initialState = {
+  status: "processing",
+  error: null,
+};
+
+function connectReducer(state, action) {
+  switch (action.type) {
+    case "ERROR":
+      return { ...state, status: "error", error: action.error };
+    case "SIGNED_OUT":
+      return { ...state, status: "signed-out" };
+    default:
+      return state;
+  }
+}
+
+function useProviderConnectCallback() {
+  const { user } = useContext(UserContext);
+  const router = useRouter();
+  const [state, dispatch] = useReducer(connectReducer, initialState);
+  const processingRef = useRef(false);
+
+  const urlCode = router.query.code;
+  const urlState = router.query.state;
+  const urlError = router.query.error;
+
+  useEffect(() => {
+    if (urlError) {
+      dispatch({ type: "ERROR", error: `OAuth error: ${urlError}` });
+      return;
+    }
+
+    if (!urlCode || !urlState) {
+      return;
+    }
+
+    const storedState = localStorage.getItem("latestCSRFToken") || "";
+    const provider = localStorage.getItem("providerConnectFlow") || "";
+
+    // CSRF check first, mirroring pages/oauth2/callback.js -- this must
+    // reject before we even look at sign-in state.
+    if (urlState !== storedState) {
+      dispatch({
+        type: "ERROR",
+        error: "Invalid state parameter. Possible CSRF attack.",
+      });
+      return;
+    }
+
+    if (!user?.uid) {
+      dispatch({ type: "SIGNED_OUT" });
+      return;
+    }
+
+    const processCallback = async () => {
+      if (processingRef.current) return;
+      processingRef.current = true;
+
+      try {
+        const idToken = await auth.currentUser.getIdToken();
+
+        const res = await fetch("/api/connectprovider", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            provider,
+            code: urlCode,
+            state: urlState,
+            uid: user.uid,
+            idToken,
+          }),
+        });
+
+        const json = await res.json();
+
+        if (!res.ok || !json.success) {
+          throw new Error(json.error || `Failed to connect account (${res.status})`);
+        }
+
+        localStorage.removeItem("latestCSRFToken");
+        localStorage.removeItem("providerConnectFlow");
+
+        router.push("/admin/account");
+      } catch (err) {
+        console.error("Provider connect callback error:", err);
+        dispatch({ type: "ERROR", error: err.message });
+        processingRef.current = false;
+      }
+    };
+
+    processCallback();
+  }, [urlCode, urlState, urlError, user?.uid]);
+
+  return state;
+}
+
+function ProviderConnectCallbackPage() {
+  const { status, error } = useProviderConnectCallback();
+
+  const renderContent = () => {
+    switch (status) {
+      case "signed-out":
+        return (
+          <VStack gap={6}>
+            <Alert.Root status="error" borderRadius="md" bg="red.800" borderColor="red.600" borderWidth={1}>
+              <Alert.Indicator color="red.300" />
+              <VStack gap={2} align="start">
+                <Text fontWeight="medium" color="white">Sign-in Required</Text>
+                <Text fontSize="sm" color="gray.100">
+                  You must be signed in to connect a storage provider account.
+                </Text>
+              </VStack>
+            </Alert.Root>
+
+            <VStack gap={3} w="full">
+              <Link href="/signin">
+                <Button colorPalette="blue" w="full">Sign In</Button>
+              </Link>
+            </VStack>
+          </VStack>
+        );
+
+      case "error":
+        return (
+          <VStack gap={6}>
+            <Alert.Root status="error" borderRadius="md" bg="red.800" borderColor="red.600" borderWidth={1}>
+              <Alert.Indicator color="red.300" />
+              <VStack gap={2} align="start">
+                <Text fontWeight="medium" color="white">Connection Failed</Text>
+                <Text fontSize="sm" color="gray.100">{error}</Text>
+              </VStack>
+            </Alert.Root>
+
+            <VStack gap={3} w="full">
+              <Link href="/admin/account">
+                <Button colorPalette="blue" w="full">Back to Account</Button>
+              </Link>
+            </VStack>
+          </VStack>
+        );
+
+      case "processing":
+      default:
+        return (
+          <VStack gap={6}>
+            <Center>
+              <Spinner size="xl" color="blue.500" borderWidth="4px" />
+            </Center>
+            <Heading size="md" textAlign="center">
+              Connecting your account...
+            </Heading>
+            <Text color="gray.600" textAlign="center">
+              Please wait while we finish connecting your storage provider.
+            </Text>
+          </VStack>
+        );
+    }
+  };
+
+  return (
+    <Card.Root w="100%" maxW={400} mx="auto" px={4} variant="unstyled" color="white">
+      <Card.Body p={8}>
+        <VStack gap={6}>
+          <Heading size="lg" textAlign="center">Storage Provider Connection</Heading>
+          {renderContent()}
+        </VStack>
+      </Card.Body>
+    </Card.Root>
+  );
+}
+
+export default ProviderConnectCallbackPage;