diff --git a/.clang-format b/.clang-format
new file mode 100644
index 00000000..6e3ed42e
--- /dev/null
+++ b/.clang-format
@@ -0,0 +1,15 @@
+# ©AngelaMos | 2026
+# .clang-format
+BasedOnStyle: LLVM
+IndentWidth: 4
+TabWidth: 4
+UseTab: Never
+ColumnLimit: 100
+AccessModifierOffset: -4
+AllowShortFunctionsOnASingleLine: None
+AllowShortIfStatementsOnASingleLine: Never
+AllowShortLoopsOnASingleLine: false
+SortIncludes: CaseSensitive
+PointerAlignment: Left
+SpaceBeforeParens: ControlStatements
+BreakBeforeBraces: Attach
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index bffb1595..767fb596 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -68,6 +68,16 @@ jobs:
           - name: dlp-scanner
             type: ruff
             path: PROJECTS/intermediate/dlp-scanner
+          # Python (ruff) - Foundations
+          - name: hash-identifier
+            type: ruff
+            path: PROJECTS/foundations/hash-identifier
+          - name: http-headers-scanner
+            type: ruff
+            path: PROJECTS/foundations/http-headers-scanner
+          - name: password-manager
+            type: ruff
+            path: PROJECTS/foundations/password-manager
           # Biome (frontend)
           - name: bug-bounty-platform-frontend
             type: biome
@@ -84,6 +94,21 @@ jobs:
           - name: encrypted-p2p-chat-frontend
             type: biome
             path: PROJECTS/advanced/encrypted-p2p-chat/frontend
+          - name: canary-token-generator-frontend
+            type: biome
+            path: PROJECTS/beginner/canary-token-generator/frontend
+          - name: ai-threat-detection-frontend
+            type: biome
+            path: PROJECTS/advanced/ai-threat-detection/frontend
+          - name: binary-analysis-tool-frontend
+            type: biome
+            path: PROJECTS/intermediate/binary-analysis-tool/frontend
+          - name: honeypot-network-frontend
+            type: biome
+            path: PROJECTS/advanced/honeypot-network/frontend
+          - name: monitor-the-situation-dashboard-frontend
+            type: biome
+            path: PROJECTS/advanced/monitor-the-situation-dashboard/frontend
           # Go
           - name: simple-vulnerability-scanner
             type: go
@@ -94,10 +119,51 @@ jobs:
           - name: secrets-scanner
             type: go
             path: PROJECTS/intermediate/secrets-scanner
+          - name: canary-token-generator-backend
+            type: go
+            path: PROJECTS/beginner/canary-token-generator/backend
+          - name: systemd-persistence-scanner
+            type: go
+            path: PROJECTS/beginner/systemd-persistence-scanner
+          - name: sbom-generator-vulnerability-matcher
+            type: go
+            path: PROJECTS/intermediate/sbom-generator-vulnerability-matcher
+          - name: honeypot-network
+            type: go
+            path: PROJECTS/advanced/honeypot-network
+          - name: monitor-the-situation-dashboard-backend
+            type: go
+            path: PROJECTS/advanced/monitor-the-situation-dashboard/backend
           # Nim
           - name: credential-enumeration
             type: nim
             path: PROJECTS/intermediate/credential-enumeration
+          # Rust
+          - name: binary-analysis-tool-backend
+            type: rust
+            path: PROJECTS/intermediate/binary-analysis-tool/backend
+          # Crystal
+          - name: credential-rotation-enforcer
+            type: crystal
+            path: PROJECTS/intermediate/credential-rotation-enforcer
+          # V (Vlang)
+          - name: firewall-rule-engine
+            type: v
+            path: PROJECTS/beginner/firewall-rule-engine
+          # C++
+          - name: hash-cracker
+            type: cpp
+            path: PROJECTS/beginner/hash-cracker
+          - name: simple-port-scanner
+            type: cpp
+            path: PROJECTS/beginner/simple-port-scanner
+          - name: network-traffic-analyzer-cpp
+            type: cpp
+            path: PROJECTS/beginner/network-traffic-analyzer/cpp
+          # Bash (shellcheck)
+          - name: linux-cis-hardening-auditor
+            type: bash
+            path: PROJECTS/beginner/linux-cis-hardening-auditor
 
     defaults:
       run:
@@ -155,7 +221,7 @@ jobs:
 
     - name: Install golangci-lint
       if: matrix.type == 'go'
-      run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
+      run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.10.1
 
     # Nim Setup
     - name: Setup Nim
@@ -168,6 +234,73 @@ jobs:
       if: matrix.type == 'nim'
       run: nimble install -y nph
 
+    # Rust Setup (pinned to match locally-verified clippy version)
+    - name: Install Rust 1.92.0
+      if: matrix.type == 'rust'
+      uses: dtolnay/rust-toolchain@1.92.0
+      with:
+        components: rustfmt, clippy
+
+    - name: Cache Cargo registry and target
+      if: matrix.type == 'rust'
+      uses: Swatinem/rust-cache@v2
+      with:
+        workspaces: "${{ matrix.path }} -> target"
+
+    # Crystal Setup
+    - name: Install libyaml-dev (ameba dep)
+      if: matrix.type == 'crystal'
+      run: |
+        sudo apt-get update -qq
+        sudo apt-get install -y libyaml-dev
+
+    - name: Install Crystal
+      if: matrix.type == 'crystal'
+      uses: crystal-lang/install-crystal@v1
+      with:
+        crystal: 1.20.0
+
+    - name: Cache shards
+      if: matrix.type == 'crystal'
+      uses: actions/cache@v4
+      with:
+        path: ${{ matrix.path }}/lib
+        key: ${{ runner.os }}-shards-${{ matrix.name }}-${{ hashFiles(format('{0}/shard.lock', matrix.path)) }}
+        restore-keys: |
+          ${{ runner.os }}-shards-${{ matrix.name }}-
+          ${{ runner.os }}-shards-
+
+    - name: Install shards
+      if: matrix.type == 'crystal'
+      run: shards install
+
+    - name: Build ameba binary
+      if: matrix.type == 'crystal'
+      run: |
+        mkdir -p bin
+        crystal build lib/ameba/bin/ameba.cr -o bin/ameba
+
+    # V (Vlang) Setup (no check-latest — master drift breaks fmt parity)
+    - name: Install V
+      if: matrix.type == 'v'
+      uses: vlang/setup-v@v1.4
+
+    # C++ Setup (pinned clang-format via PyPI wheel — apt patch versions drift)
+    - name: Install clang-format and cppcheck
+      if: matrix.type == 'cpp'
+      run: |
+        sudo apt-get update -qq
+        sudo apt-get install -y cppcheck python3-pip
+        pip install --user --break-system-packages clang-format==19.1.7
+        echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+    # Bash Setup (shellcheck pre-installed on ubuntu-latest, but ensure latest)
+    - name: Install shellcheck
+      if: matrix.type == 'bash'
+      run: |
+        sudo apt-get update -qq
+        sudo apt-get install -y shellcheck
+
     # Ruff Linting
     - name: Run ruff
       if: matrix.type == 'ruff'
@@ -247,6 +380,153 @@ jobs:
         cat nim-output.txt
       continue-on-error: true
 
+    # Rust Linting
+    - name: Run cargo fmt and clippy
+      if: matrix.type == 'rust'
+      id: rust
+      run: |
+        RUST_OK=true
+        echo "Running cargo fmt --check..."
+        if cargo fmt -- --check > rust-output.txt 2>&1; then
+          echo "cargo fmt: no issues"
+        else
+          RUST_OK=false
+          echo "cargo fmt: formatting issues found"
+        fi
+        echo "Running cargo clippy..."
+        if cargo clippy --all-targets --all-features -- -D warnings >> rust-output.txt 2>&1; then
+          echo "cargo clippy: no issues"
+        else
+          RUST_OK=false
+          echo "cargo clippy: issues found"
+        fi
+        if [[ "$RUST_OK" == "true" ]]; then
+          echo "RUST_PASSED=true" >> $GITHUB_ENV
+        else
+          echo "RUST_PASSED=false" >> $GITHUB_ENV
+        fi
+        cat rust-output.txt
+      continue-on-error: true
+
+    # Crystal Linting
+    - name: Run crystal format + ameba + compile check
+      if: matrix.type == 'crystal'
+      id: crystal
+      run: |
+        CRYSTAL_OK=true
+        echo "Running crystal tool format --check..."
+        if crystal tool format --check src/ spec/ > crystal-output.txt 2>&1; then
+          echo "crystal format: no issues"
+        else
+          CRYSTAL_OK=false
+          echo "crystal format: formatting issues found"
+        fi
+        echo "Running ameba..."
+        if bin/ameba src/ >> crystal-output.txt 2>&1; then
+          echo "ameba: no issues"
+        else
+          CRYSTAL_OK=false
+          echo "ameba: issues found"
+        fi
+        echo "Running crystal build --no-codegen..."
+        if crystal build --no-codegen src/cre.cr >> crystal-output.txt 2>&1; then
+          echo "crystal build: passed"
+        else
+          CRYSTAL_OK=false
+          echo "crystal build: failed"
+        fi
+        if [[ "$CRYSTAL_OK" == "true" ]]; then
+          echo "CRYSTAL_PASSED=true" >> $GITHUB_ENV
+        else
+          echo "CRYSTAL_PASSED=false" >> $GITHUB_ENV
+        fi
+        cat crystal-output.txt
+      continue-on-error: true
+
+    # V Linting (v fmt is advisory — formatter rules drift between V builds even
+    # within the same version string, making strict fmt parity impractical. v vet
+    # is stable across builds and remains the pass/fail gate.)
+    - name: Run v fmt (advisory) and v vet
+      if: matrix.type == 'v'
+      id: v
+      run: |
+        V_OK=true
+        echo "Running v fmt -diff src/ (advisory)..."
+        v fmt -diff src/ > v-output.txt 2>&1 || true
+        echo "Running v fmt -verify src/ (advisory)..."
+        if v fmt -verify src/ >> v-output.txt 2>&1; then
+          echo "v fmt: no issues"
+        else
+          echo "v fmt: formatting suggestions found (advisory — not failing the job)"
+        fi
+        echo "Running v vet src/..."
+        if v vet src/ >> v-output.txt 2>&1; then
+          echo "v vet: no issues"
+        else
+          V_OK=false
+          echo "v vet: issues found"
+        fi
+        if [[ "$V_OK" == "true" ]]; then
+          echo "V_PASSED=true" >> $GITHUB_ENV
+        else
+          echo "V_PASSED=false" >> $GITHUB_ENV
+        fi
+        cat v-output.txt
+      continue-on-error: true
+
+    # C++ Linting
+    - name: Run clang-format and cppcheck
+      if: matrix.type == 'cpp'
+      id: cpp
+      run: |
+        CPP_OK=true
+        echo "Running clang-format check..."
+        FILES=$(find . \( -path ./build -o -path ./cmake-build -o -path ./node_modules -o -path ./.git \) -prune -o \( -name '*.cpp' -o -name '*.hpp' -o -name '*.h' \) -print 2>/dev/null)
+        if [ -n "$FILES" ]; then
+          if echo "$FILES" | xargs clang-format --dry-run --Werror > cpp-output.txt 2>&1; then
+            echo "clang-format: no issues"
+          else
+            CPP_OK=false
+            echo "clang-format: formatting issues found"
+          fi
+        else
+          echo "clang-format: no C++ files found" > cpp-output.txt
+        fi
+        echo "Running cppcheck..."
+        if cppcheck --enable=warning,style,performance,portability --error-exitcode=1 --suppress=missingIncludeSystem --suppress=normalCheckLevelMaxBranches -i build -i cmake-build -q . >> cpp-output.txt 2>&1; then
+          echo "cppcheck: no issues"
+        else
+          CPP_OK=false
+          echo "cppcheck: issues found"
+        fi
+        if [[ "$CPP_OK" == "true" ]]; then
+          echo "CPP_PASSED=true" >> $GITHUB_ENV
+        else
+          echo "CPP_PASSED=false" >> $GITHUB_ENV
+        fi
+        cat cpp-output.txt
+      continue-on-error: true
+
+    # Bash Linting
+    - name: Run shellcheck
+      if: matrix.type == 'bash'
+      id: bash
+      run: |
+        echo "Running shellcheck..."
+        FILES=$(find . -name '*.sh' -not -path '*/.venv/*' -not -path '*/node_modules/*' 2>/dev/null || true)
+        if [ -z "$FILES" ]; then
+          echo "shellcheck: no .sh files found" > bash-output.txt
+          echo "BASH_PASSED=true" >> $GITHUB_ENV
+        elif echo "$FILES" | xargs shellcheck > bash-output.txt 2>&1; then
+          echo "BASH_PASSED=true" >> $GITHUB_ENV
+          echo "shellcheck: no issues"
+        else
+          echo "BASH_PASSED=false" >> $GITHUB_ENV
+          echo "shellcheck: issues found"
+        fi
+        cat bash-output.txt
+      continue-on-error: true
+
     # Create Summary for Ruff
     - name: Create Ruff Lint Summary
       if: matrix.type == 'ruff'
@@ -371,6 +651,151 @@ jobs:
           fi
         } >> $GITHUB_STEP_SUMMARY
 
+    # Create Summary for Rust
+    - name: Create Rust Lint Summary
+      if: matrix.type == 'rust'
+      run: |
+        {
+          echo "## Lint Results: ${{ matrix.name }}"
+          echo ''
+          if [[ "${{ env.RUST_PASSED }}" == "true" ]]; then
+            echo '### cargo fmt + clippy: **Passed**'
+            echo 'No Rust issues found.'
+          else
+            echo '### cargo fmt + clippy: **Issues Found**'
+            echo '<details><summary>View output</summary>'
+            echo ''
+            echo '```'
+            head -100 rust-output.txt
+            echo '```'
+            echo '</details>'
+          fi
+          echo ''
+          if [[ "${{ env.RUST_PASSED }}" == "true" ]]; then
+            echo '---'
+            echo '### All checks passed!'
+          else
+            echo '---'
+            echo '### Review the issues above'
+          fi
+        } >> $GITHUB_STEP_SUMMARY
+
+    # Create Summary for Crystal
+    - name: Create Crystal Lint Summary
+      if: matrix.type == 'crystal'
+      run: |
+        {
+          echo "## Lint Results: ${{ matrix.name }}"
+          echo ''
+          if [[ "${{ env.CRYSTAL_PASSED }}" == "true" ]]; then
+            echo '### crystal format + ameba + build: **Passed**'
+            echo 'No Crystal issues found.'
+          else
+            echo '### crystal format + ameba + build: **Issues Found**'
+            echo '<details><summary>View output</summary>'
+            echo ''
+            echo '```'
+            head -100 crystal-output.txt
+            echo '```'
+            echo '</details>'
+          fi
+          echo ''
+          if [[ "${{ env.CRYSTAL_PASSED }}" == "true" ]]; then
+            echo '---'
+            echo '### All checks passed!'
+          else
+            echo '---'
+            echo '### Review the issues above'
+          fi
+        } >> $GITHUB_STEP_SUMMARY
+
+    # Create Summary for V
+    - name: Create V Lint Summary
+      if: matrix.type == 'v'
+      run: |
+        {
+          echo "## Lint Results: ${{ matrix.name }}"
+          echo ''
+          if [[ "${{ env.V_PASSED }}" == "true" ]]; then
+            echo '### v vet: **Passed** (v fmt advisory)'
+            echo 'No V vet issues found. See output for v fmt suggestions.'
+          else
+            echo '### v vet: **Issues Found**'
+            echo '<details><summary>View output</summary>'
+            echo ''
+            echo '```'
+            head -100 v-output.txt
+            echo '```'
+            echo '</details>'
+          fi
+          echo ''
+          if [[ "${{ env.V_PASSED }}" == "true" ]]; then
+            echo '---'
+            echo '### All checks passed!'
+          else
+            echo '---'
+            echo '### Review the issues above'
+          fi
+        } >> $GITHUB_STEP_SUMMARY
+
+    # Create Summary for C++
+    - name: Create C++ Lint Summary
+      if: matrix.type == 'cpp'
+      run: |
+        {
+          echo "## Lint Results: ${{ matrix.name }}"
+          echo ''
+          if [[ "${{ env.CPP_PASSED }}" == "true" ]]; then
+            echo '### clang-format + cppcheck: **Passed**'
+            echo 'No C++ issues found.'
+          else
+            echo '### clang-format + cppcheck: **Issues Found**'
+            echo '<details><summary>View output</summary>'
+            echo ''
+            echo '```'
+            head -100 cpp-output.txt
+            echo '```'
+            echo '</details>'
+          fi
+          echo ''
+          if [[ "${{ env.CPP_PASSED }}" == "true" ]]; then
+            echo '---'
+            echo '### All checks passed!'
+          else
+            echo '---'
+            echo '### Review the issues above'
+          fi
+        } >> $GITHUB_STEP_SUMMARY
+
+    # Create Summary for Bash
+    - name: Create Bash Lint Summary
+      if: matrix.type == 'bash'
+      run: |
+        {
+          echo "## Lint Results: ${{ matrix.name }}"
+          echo ''
+          if [[ "${{ env.BASH_PASSED }}" == "true" ]]; then
+            echo '### shellcheck: **Passed**'
+            echo 'No shell issues found.'
+          else
+            echo '### shellcheck: **Issues Found**'
+            echo '<details><summary>View output</summary>'
+            echo ''
+            echo '```'
+            head -100 bash-output.txt
+            echo '```'
+            echo '</details>'
+          fi
+          echo ''
+          if [[ "${{ env.BASH_PASSED }}" == "true" ]]; then
+            echo '---'
+            echo '### All checks passed!'
+          else
+            echo '---'
+            echo '### Review the issues above'
+          fi
+        } >> $GITHUB_STEP_SUMMARY
+
     # Exit with proper status
     - name: Check lint status
       run: |
@@ -394,5 +819,30 @@ jobs:
             echo "Nim lint checks failed"
             exit 1
           fi
+        elif [[ "${{ matrix.type }}" == "rust" ]]; then
+          if [[ "${{ env.RUST_PASSED }}" == "false" ]]; then
+            echo "Rust lint checks failed"
+            exit 1
+          fi
+        elif [[ "${{ matrix.type }}" == "crystal" ]]; then
+          if [[ "${{ env.CRYSTAL_PASSED }}" == "false" ]]; then
+            echo "Crystal lint checks failed"
+            exit 1
+          fi
+        elif [[ "${{ matrix.type }}" == "v" ]]; then
+          if [[ "${{ env.V_PASSED }}" == "false" ]]; then
+            echo "V lint checks failed"
+            exit 1
+          fi
+        elif [[ "${{ matrix.type }}" == "cpp" ]]; then
+          if [[ "${{ env.CPP_PASSED }}" == "false" ]]; then
+            echo "C++ lint checks failed"
+            exit 1
+          fi
+        elif [[ "${{ matrix.type }}" == "bash" ]]; then
+          if [[ "${{ env.BASH_PASSED }}" == "false" ]]; then
+            echo "Bash lint checks failed"
+            exit 1
+          fi
         fi
         echo "All lint checks passed"
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 20efe34a..f0ec85af 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -84,6 +84,37 @@ repos:
         files: ^PROJECTS/advanced/ai-threat-detection/backend/
         exclude: (\.venv|__pycache__|\.pytest_cache)/
 
+      - id: ruff
+        name: ruff check (dlp-scanner)
+        args: [--fix, --exit-non-zero-on-fix]
+        files: ^PROJECTS/intermediate/dlp-scanner/
+        exclude: (\.venv|__pycache__|\.pytest_cache)/
+
+      - id: ruff
+        name: ruff check (linux-ebpf-security-tracer)
+        args: [--fix, --exit-non-zero-on-fix]
+        files: ^PROJECTS/beginner/linux-ebpf-security-tracer/
+        exclude: (\.venv|__pycache__|\.pytest_cache)/
+
+      # Foundations projects
+      - id: ruff
+        name: ruff check (hash-identifier)
+        args: [--fix, --exit-non-zero-on-fix]
+        files: ^PROJECTS/foundations/hash-identifier/
+        exclude: (\.venv|__pycache__|\.pytest_cache)/
+
+      - id: ruff
+        name: ruff check (http-headers-scanner)
+        args: [--fix, --exit-non-zero-on-fix]
+        files: ^PROJECTS/foundations/http-headers-scanner/
+        exclude: (\.venv|__pycache__|\.pytest_cache)/
+
+      - id: ruff
+        name: ruff check (password-manager)
+        args: [--fix, --exit-non-zero-on-fix]
+        files: ^PROJECTS/foundations/password-manager/
+        exclude: (\.venv|__pycache__|\.pytest_cache)/
+
 
   # Go golangci-lint Checks
   - repo: local
@@ -112,6 +143,48 @@ repos:
         types: [go]
         pass_filenames: false
 
+      - id: golangci-lint-canary-token-generator
+        name: golangci-lint (canary-token-generator backend)
+        entry: bash -c 'cd PROJECTS/beginner/canary-token-generator/backend && golangci-lint run --fix'
+        language: system
+        files: ^PROJECTS/beginner/canary-token-generator/backend/
+        types: [go]
+        pass_filenames: false
+
+      - id: golangci-lint-systemd-persistence-scanner
+        name: golangci-lint (systemd-persistence-scanner)
+        entry: bash -c 'cd PROJECTS/beginner/systemd-persistence-scanner && golangci-lint run --fix'
+        language: system
+        files: ^PROJECTS/beginner/systemd-persistence-scanner/
+        types: [go]
+        pass_filenames: false
+
+      - id: golangci-lint-sbom-generator
+        name: golangci-lint (sbom-generator-vulnerability-matcher)
+        entry: bash -c 'cd PROJECTS/intermediate/sbom-generator-vulnerability-matcher && golangci-lint run --fix'
+        language: system
+        files: ^PROJECTS/intermediate/sbom-generator-vulnerability-matcher/
+        exclude: ^PROJECTS/intermediate/sbom-generator-vulnerability-matcher/testdata/
+        types: [go]
+        pass_filenames: false
+
+      - id: golangci-lint-honeypot-network
+        name: golangci-lint (honeypot-network)
+        entry: bash -c 'cd PROJECTS/advanced/honeypot-network && golangci-lint run --fix'
+        language: system
+        files: ^PROJECTS/advanced/honeypot-network/
+        exclude: ^PROJECTS/advanced/honeypot-network/frontend/
+        types: [go]
+        pass_filenames: false
+
+      - id: golangci-lint-monitor-the-situation-dashboard
+        name: golangci-lint (monitor-the-situation-dashboard backend)
+        entry: bash -c 'cd PROJECTS/advanced/monitor-the-situation-dashboard/backend && golangci-lint run --fix'
+        language: system
+        files: ^PROJECTS/advanced/monitor-the-situation-dashboard/backend/
+        types: [go]
+        pass_filenames: false
+
   # Biome Frontend Checks
   - repo: local
     hooks:
@@ -150,6 +223,41 @@ repos:
         files: ^PROJECTS/advanced/encrypted-p2p-chat/frontend/src/
         pass_filenames: false
 
+      - id: biome-canary-token-generator
+        name: biome check (canary-token-generator frontend)
+        entry: bash -c 'cd PROJECTS/beginner/canary-token-generator/frontend && npx @biomejs/biome check .'
+        language: system
+        files: ^PROJECTS/beginner/canary-token-generator/frontend/src/
+        pass_filenames: false
+
+      - id: biome-ai-threat-detection
+        name: biome check (ai-threat-detection frontend)
+        entry: bash -c 'cd PROJECTS/advanced/ai-threat-detection/frontend && npx @biomejs/biome check .'
+        language: system
+        files: ^PROJECTS/advanced/ai-threat-detection/frontend/src/
+        pass_filenames: false
+
+      - id: biome-binary-analysis-tool
+        name: biome check (binary-analysis-tool frontend)
+        entry: bash -c 'cd PROJECTS/intermediate/binary-analysis-tool/frontend && npx @biomejs/biome check .'
+        language: system
+        files: ^PROJECTS/intermediate/binary-analysis-tool/frontend/src/
+        pass_filenames: false
+
+      - id: biome-honeypot-network
+        name: biome check (honeypot-network frontend)
+        entry: bash -c 'cd PROJECTS/advanced/honeypot-network/frontend && npx @biomejs/biome check .'
+        language: system
+        files: ^PROJECTS/advanced/honeypot-network/frontend/src/
+        pass_filenames: false
+
+      - id: biome-monitor-the-situation-dashboard
+        name: biome check (monitor-the-situation-dashboard frontend)
+        entry: bash -c 'cd PROJECTS/advanced/monitor-the-situation-dashboard/frontend && npx @biomejs/biome check .'
+        language: system
+        files: ^PROJECTS/advanced/monitor-the-situation-dashboard/frontend/src/
+        pass_filenames: false
+
   # Nim nph Checks
   - repo: local
     hooks:
@@ -160,6 +268,130 @@ repos:
         files: ^PROJECTS/intermediate/credential-enumeration/src/
         pass_filenames: false
 
+  # Rust Checks (cargo fmt + clippy)
+  - repo: local
+    hooks:
+      - id: cargo-fmt-binary-analysis-tool
+        name: cargo fmt (binary-analysis-tool backend)
+        entry: bash -c 'cd PROJECTS/intermediate/binary-analysis-tool/backend && cargo fmt -- --check'
+        language: system
+        files: ^PROJECTS/intermediate/binary-analysis-tool/backend/
+        types: [rust]
+        pass_filenames: false
+
+      - id: cargo-clippy-binary-analysis-tool
+        name: cargo clippy (binary-analysis-tool backend)
+        entry: bash -c 'cd PROJECTS/intermediate/binary-analysis-tool/backend && cargo clippy --all-targets --all-features -- -D warnings'
+        language: system
+        files: ^PROJECTS/intermediate/binary-analysis-tool/backend/
+        types: [rust]
+        pass_filenames: false
+
+  # Crystal Checks (format + ameba + compile)
+  - repo: local
+    hooks:
+      - id: crystal-format-credential-rotation-enforcer
+        name: crystal format check (credential-rotation-enforcer)
+        entry: bash -c 'cd PROJECTS/intermediate/credential-rotation-enforcer && crystal tool format --check src/ spec/'
+        language: system
+        files: ^PROJECTS/intermediate/credential-rotation-enforcer/
+        types_or: [crystal]
+        pass_filenames: false
+
+      - id: ameba-credential-rotation-enforcer
+        name: ameba (credential-rotation-enforcer)
+        entry: bash -c 'cd PROJECTS/intermediate/credential-rotation-enforcer && bin/ameba src/'
+        language: system
+        files: ^PROJECTS/intermediate/credential-rotation-enforcer/
+        types_or: [crystal]
+        pass_filenames: false
+
+      - id: crystal-build-check-credential-rotation-enforcer
+        name: crystal compile check (credential-rotation-enforcer)
+        entry: bash -c 'cd PROJECTS/intermediate/credential-rotation-enforcer && crystal build --no-codegen src/cre.cr'
+        language: system
+        files: ^PROJECTS/intermediate/credential-rotation-enforcer/
+        types_or: [crystal]
+        pass_filenames: false
+
+  # V (Vlang) Checks
+  - repo: local
+    hooks:
+      - id: v-fmt-firewall-rule-engine
+        name: v fmt (firewall-rule-engine)
+        entry: bash -c 'cd PROJECTS/beginner/firewall-rule-engine && v fmt -verify src/'
+        language: system
+        files: ^PROJECTS/beginner/firewall-rule-engine/src/
+        pass_filenames: false
+
+      - id: v-vet-firewall-rule-engine
+        name: v vet (firewall-rule-engine)
+        entry: bash -c 'cd PROJECTS/beginner/firewall-rule-engine && v vet src/'
+        language: system
+        files: ^PROJECTS/beginner/firewall-rule-engine/src/
+        pass_filenames: false
+
+  # C++ Checks (clang-format + cppcheck)
+  - repo: local
+    hooks:
+      - id: clang-format-hash-cracker
+        name: clang-format (hash-cracker)
+        entry: bash -c 'cd PROJECTS/beginner/hash-cracker && find . \( -path ./build -o -path ./cmake-build -o -path ./.git \) -prune -o \( -name "*.cpp" -o -name "*.hpp" -o -name "*.h" \) -print 2>/dev/null | xargs -r clang-format --dry-run --Werror'
+        language: system
+        files: ^PROJECTS/beginner/hash-cracker/
+        types_or: [c++, c]
+        pass_filenames: false
+
+      - id: cppcheck-hash-cracker
+        name: cppcheck (hash-cracker)
+        entry: bash -c 'cd PROJECTS/beginner/hash-cracker && cppcheck --enable=warning,style,performance,portability --error-exitcode=1 --suppress=missingIncludeSystem --suppress=normalCheckLevelMaxBranches -i build -i cmake-build -q .'
+        language: system
+        files: ^PROJECTS/beginner/hash-cracker/
+        types_or: [c++, c]
+        pass_filenames: false
+
+      - id: clang-format-simple-port-scanner
+        name: clang-format (simple-port-scanner)
+        entry: bash -c 'cd PROJECTS/beginner/simple-port-scanner && find . \( -path ./build -o -path ./cmake-build -o -path ./.git \) -prune -o \( -name "*.cpp" -o -name "*.hpp" -o -name "*.h" \) -print 2>/dev/null | xargs -r clang-format --dry-run --Werror'
+        language: system
+        files: ^PROJECTS/beginner/simple-port-scanner/
+        types_or: [c++, c]
+        pass_filenames: false
+
+      - id: cppcheck-simple-port-scanner
+        name: cppcheck (simple-port-scanner)
+        entry: bash -c 'cd PROJECTS/beginner/simple-port-scanner && cppcheck --enable=warning,style,performance,portability --error-exitcode=1 --suppress=missingIncludeSystem --suppress=normalCheckLevelMaxBranches -i build -i cmake-build -q .'
+        language: system
+        files: ^PROJECTS/beginner/simple-port-scanner/
+        types_or: [c++, c]
+        pass_filenames: false
+
+      - id: clang-format-network-traffic-analyzer-cpp
+        name: clang-format (network-traffic-analyzer/cpp)
+        entry: bash -c 'cd PROJECTS/beginner/network-traffic-analyzer/cpp && find . \( -path ./build -o -path ./cmake-build -o -path ./.git \) -prune -o \( -name "*.cpp" -o -name "*.hpp" -o -name "*.h" \) -print 2>/dev/null | xargs -r clang-format --dry-run --Werror'
+        language: system
+        files: ^PROJECTS/beginner/network-traffic-analyzer/cpp/
+        types_or: [c++, c]
+        pass_filenames: false
+
+      - id: cppcheck-network-traffic-analyzer-cpp
+        name: cppcheck (network-traffic-analyzer/cpp)
+        entry: bash -c 'cd PROJECTS/beginner/network-traffic-analyzer/cpp && cppcheck --enable=warning,style,performance,portability --error-exitcode=1 --suppress=missingIncludeSystem --suppress=normalCheckLevelMaxBranches -i build -i cmake-build -q .'
+        language: system
+        files: ^PROJECTS/beginner/network-traffic-analyzer/cpp/
+        types_or: [c++, c]
+        pass_filenames: false
+
+  # Bash (shellcheck)
+  - repo: local
+    hooks:
+      - id: shellcheck-linux-cis-hardening-auditor
+        name: shellcheck (linux-cis-hardening-auditor)
+        entry: bash -c 'find PROJECTS/beginner/linux-cis-hardening-auditor -name "*.sh" -not -path "*/.venv/*" | xargs -r shellcheck'
+        language: system
+        files: ^PROJECTS/beginner/linux-cis-hardening-auditor/.*\.sh$
+        pass_filenames: false
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v6.0.0
     hooks:
@@ -174,9 +406,9 @@ repos:
       - id: check-symlinks
         exclude: (\.pnpm-store|node_modules)/
       - id: end-of-file-fixer
-        exclude: (\.pnpm-store|node_modules)/
+        exclude: (\.pnpm-store|node_modules)/|^PROJECTS/advanced/hsm-emulator/vendor/
       - id: trailing-whitespace
-        exclude: (\.pnpm-store|node_modules)/
+        exclude: (\.pnpm-store|node_modules)/|^PROJECTS/advanced/hsm-emulator/vendor/
       - id: check-illegal-windows-names
         exclude: (\.pnpm-store|node_modules)/
       - id: check-executables-have-shebangs
diff --git a/PROJECTS/advanced/ai-threat-detection/README.md b/PROJECTS/advanced/ai-threat-detection/README.md
index 30e27506..cbabfacf 100644
--- a/PROJECTS/advanced/ai-threat-detection/README.md
+++ b/PROJECTS/advanced/ai-threat-detection/README.md
@@ -22,7 +22,19 @@
 
 > AI-powered threat detection engine that analyzes nginx access logs using a 3-model ML ensemble to classify HTTP traffic as benign or malicious in real time.
 
-*This is a quick overview — learn modules with security theory, architecture deep-dives, and full walkthroughs are coming soon.*
+<p align="center">
+  <a href="https://youtu.be/H8WZYS8c78g">
+    <img src="https://img.shields.io/badge/Watch_on-YouTube-FF0000?logo=youtube&logoColor=white" alt="Watch on YouTube">
+  </a>
+</p>
+
+<p align="center">
+  <a href="https://youtu.be/H8WZYS8c78g">
+    <img src="https://img.youtube.com/vi/H8WZYS8c78g/maxresdefault.jpg" alt="Video Thumbnail" width="800">
+  </a>
+</p>
+
+*Learn docs located here: [Learn](https://github.com/CarterPerez-dev/Cybersecurity-Projects/edit/main/PROJECTS/advanced/ai-threat-detection/learn/)*
 
 ## What It Does
 
diff --git a/PROJECTS/advanced/ai-threat-detection/backend/pyproject.toml b/PROJECTS/advanced/ai-threat-detection/backend/pyproject.toml
index 821a5948..74bdeb40 100644
--- a/PROJECTS/advanced/ai-threat-detection/backend/pyproject.toml
+++ b/PROJECTS/advanced/ai-threat-detection/backend/pyproject.toml
@@ -60,7 +60,7 @@ ml = [
     "scikit-learn>=1.8.0",
     "onnxruntime>=1.24.1",
     "skl2onnx>=1.20.0",
-    "mlflow>=3.9.0",
+    "mlflow>=3.11.1",
     "numpy>=2.4.2",
     "pandas>=2.2.0,<3",
     "imbalanced-learn>=0.14.1",
diff --git a/PROJECTS/advanced/ai-threat-detection/backend/uv.lock b/PROJECTS/advanced/ai-threat-detection/backend/uv.lock
index 9125ef1d..651666d9 100644
--- a/PROJECTS/advanced/ai-threat-detection/backend/uv.lock
+++ b/PROJECTS/advanced/ai-threat-detection/backend/uv.lock
@@ -17,7 +17,7 @@ wheels = [
 
 [[package]]
 name = "aiohttp"
-version = "3.13.4"
+version = "3.14.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiohappyeyeballs" },
@@ -28,42 +28,49 @@ dependencies = [
     { name = "propcache" },
     { name = "yarl" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/45/4a/064321452809dae953c1ed6e017504e72551a26b6f5708a5a80e4bf556ff/aiohttp-3.13.4.tar.gz", hash = "sha256:d97a6d09c66087890c2ab5d49069e1e570583f7ac0314ecf98294c1b6aaebd38", size = 7859748, upload-time = "2026-03-28T17:19:40.6Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ee/ab/93ce242f899b68c51b0578c027aafa791ab3614cb9345fa5d37b5f5c8e3e/aiohttp-3.14.0.tar.gz", hash = "sha256:2882de819734c715fd1b9c11c97e09fa020d14438203d1d354d8ed1702791c9b", size = 7940674, upload-time = "2026-06-01T19:41:02.763Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/6d/29/6657cc37ae04cacc2dbf53fb730a06b6091cc4cbe745028e047c53e6d840/aiohttp-3.13.4-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:e0a2c961fc92abeff61d6444f2ce6ad35bb982db9fc8ff8a47455beacf454a57", size = 749363, upload-time = "2026-03-28T17:17:24.044Z" },
-    { url = "https://files.pythonhosted.org/packages/90/7f/30ccdf67ca3d24b610067dc63d64dcb91e5d88e27667811640644aa4a85d/aiohttp-3.13.4-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:153274535985a0ff2bff1fb6c104ed547cec898a09213d21b0f791a44b14d933", size = 499317, upload-time = "2026-03-28T17:17:26.199Z" },
-    { url = "https://files.pythonhosted.org/packages/93/13/e372dd4e68ad04ee25dafb050c7f98b0d91ea643f7352757e87231102555/aiohttp-3.13.4-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:351f3171e2458da3d731ce83f9e6b9619e325c45cbd534c7759750cabf453ad7", size = 500477, upload-time = "2026-03-28T17:17:28.279Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/fe/ee6298e8e586096fb6f5eddd31393d8544f33ae0792c71ecbb4c2bef98ac/aiohttp-3.13.4-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f989ac8bc5595ff761a5ccd32bdb0768a117f36dd1504b1c2c074ed5d3f4df9c", size = 1737227, upload-time = "2026-03-28T17:17:30.587Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/b9/a7a0463a09e1a3fe35100f74324f23644bfc3383ac5fd5effe0722a5f0b7/aiohttp-3.13.4-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:d36fc1709110ec1e87a229b201dd3ddc32aa01e98e7868083a794609b081c349", size = 1694036, upload-time = "2026-03-28T17:17:33.29Z" },
-    { url = "https://files.pythonhosted.org/packages/57/7c/8972ae3fb7be00a91aee6b644b2a6a909aedb2c425269a3bfd90115e6f8f/aiohttp-3.13.4-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:42adaeea83cbdf069ab94f5103ce0787c21fb1a0153270da76b59d5578302329", size = 1786814, upload-time = "2026-03-28T17:17:36.035Z" },
-    { url = "https://files.pythonhosted.org/packages/93/01/c81e97e85c774decbaf0d577de7d848934e8166a3a14ad9f8aa5be329d28/aiohttp-3.13.4-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:92deb95469928cc41fd4b42a95d8012fa6df93f6b1c0a83af0ffbc4a5e218cde", size = 1866676, upload-time = "2026-03-28T17:17:38.441Z" },
-    { url = "https://files.pythonhosted.org/packages/5a/5f/5b46fe8694a639ddea2cd035bf5729e4677ea882cb251396637e2ef1590d/aiohttp-3.13.4-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0c0c7c07c4257ef3a1df355f840bc62d133bcdef5c1c5ba75add3c08553e2eed", size = 1740842, upload-time = "2026-03-28T17:17:40.783Z" },
-    { url = "https://files.pythonhosted.org/packages/20/a2/0d4b03d011cca6b6b0acba8433193c1e484efa8d705ea58295590fe24203/aiohttp-3.13.4-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f062c45de8a1098cb137a1898819796a2491aec4e637a06b03f149315dff4d8f", size = 1566508, upload-time = "2026-03-28T17:17:43.235Z" },
-    { url = "https://files.pythonhosted.org/packages/98/17/e689fd500da52488ec5f889effd6404dece6a59de301e380f3c64f167beb/aiohttp-3.13.4-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:76093107c531517001114f0ebdb4f46858ce818590363e3e99a4a2280334454a", size = 1700569, upload-time = "2026-03-28T17:17:46.165Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/0d/66402894dbcf470ef7db99449e436105ea862c24f7ea4c95c683e635af35/aiohttp-3.13.4-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:6f6ec32162d293b82f8b63a16edc80769662fbd5ae6fbd4936d3206a2c2cc63b", size = 1707407, upload-time = "2026-03-28T17:17:48.825Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/eb/af0ab1a3650092cbd8e14ef29e4ab0209e1460e1c299996c3f8288b3f1ff/aiohttp-3.13.4-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:5903e2db3d202a00ad9f0ec35a122c005e85d90c9836ab4cda628f01edf425e2", size = 1752214, upload-time = "2026-03-28T17:17:51.206Z" },
-    { url = "https://files.pythonhosted.org/packages/5a/bf/72326f8a98e4c666f292f03c385545963cc65e358835d2a7375037a97b57/aiohttp-3.13.4-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:2d5bea57be7aca98dbbac8da046d99b5557c5cf4e28538c4c786313078aca09e", size = 1562162, upload-time = "2026-03-28T17:17:53.634Z" },
-    { url = "https://files.pythonhosted.org/packages/67/9f/13b72435f99151dd9a5469c96b3b5f86aa29b7e785ca7f35cf5e538f74c0/aiohttp-3.13.4-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:bcf0c9902085976edc0232b75006ef38f89686901249ce14226b6877f88464fb", size = 1768904, upload-time = "2026-03-28T17:17:55.991Z" },
-    { url = "https://files.pythonhosted.org/packages/18/bc/28d4970e7d5452ac7776cdb5431a1164a0d9cf8bd2fffd67b4fb463aa56d/aiohttp-3.13.4-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:c3295f98bfeed2e867cab588f2a146a9db37a85e3ae9062abf46ba062bd29165", size = 1723378, upload-time = "2026-03-28T17:17:58.348Z" },
-    { url = "https://files.pythonhosted.org/packages/53/74/b32458ca1a7f34d65bdee7aef2036adbe0438123d3d53e2b083c453c24dd/aiohttp-3.13.4-cp314-cp314-win32.whl", hash = "sha256:a598a5c5767e1369d8f5b08695cab1d8160040f796c4416af76fd773d229b3c9", size = 438711, upload-time = "2026-03-28T17:18:00.728Z" },
-    { url = "https://files.pythonhosted.org/packages/40/b2/54b487316c2df3e03a8f3435e9636f8a81a42a69d942164830d193beb56a/aiohttp-3.13.4-cp314-cp314-win_amd64.whl", hash = "sha256:c555db4bc7a264bead5a7d63d92d41a1122fcd39cc62a4db815f45ad46f9c2c8", size = 464977, upload-time = "2026-03-28T17:18:03.367Z" },
-    { url = "https://files.pythonhosted.org/packages/47/fb/e41b63c6ce71b07a59243bb8f3b457ee0c3402a619acb9d2c0d21ef0e647/aiohttp-3.13.4-cp314-cp314t-macosx_10_13_universal2.whl", hash = "sha256:45abbbf09a129825d13c18c7d3182fecd46d9da3cfc383756145394013604ac1", size = 781549, upload-time = "2026-03-28T17:18:05.779Z" },
-    { url = "https://files.pythonhosted.org/packages/97/53/532b8d28df1e17e44c4d9a9368b78dcb6bf0b51037522136eced13afa9e8/aiohttp-3.13.4-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:74c80b2bc2c2adb7b3d1941b2b60701ee2af8296fc8aad8b8bc48bc25767266c", size = 514383, upload-time = "2026-03-28T17:18:08.096Z" },
-    { url = "https://files.pythonhosted.org/packages/1b/1f/62e5d400603e8468cd635812d99cb81cfdc08127a3dc474c647615f31339/aiohttp-3.13.4-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:c97989ae40a9746650fa196894f317dafc12227c808c774929dda0ff873a5954", size = 518304, upload-time = "2026-03-28T17:18:10.642Z" },
-    { url = "https://files.pythonhosted.org/packages/90/57/2326b37b10896447e3c6e0cbef4fe2486d30913639a5cfd1332b5d870f82/aiohttp-3.13.4-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:dae86be9811493f9990ef44fff1685f5c1a3192e9061a71a109d527944eed551", size = 1893433, upload-time = "2026-03-28T17:18:13.121Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/b4/a24d82112c304afdb650167ef2fe190957d81cbddac7460bedd245f765aa/aiohttp-3.13.4-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:1db491abe852ca2fa6cc48a3341985b0174b3741838e1341b82ac82c8bd9e871", size = 1755901, upload-time = "2026-03-28T17:18:16.21Z" },
-    { url = "https://files.pythonhosted.org/packages/9e/2d/0883ef9d878d7846287f036c162a951968f22aabeef3ac97b0bea6f76d5d/aiohttp-3.13.4-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:0e5d701c0aad02a7dce72eef6b93226cf3734330f1a31d69ebbf69f33b86666e", size = 1876093, upload-time = "2026-03-28T17:18:18.703Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/52/9204bb59c014869b71971addad6778f005daa72a96eed652c496789d7468/aiohttp-3.13.4-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:8ac32a189081ae0a10ba18993f10f338ec94341f0d5df8fff348043962f3c6f8", size = 1970815, upload-time = "2026-03-28T17:18:21.858Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/b5/e4eb20275a866dde0f570f411b36c6b48f7b53edfe4f4071aa1b0728098a/aiohttp-3.13.4-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:98e968cdaba43e45c73c3f306fca418c8009a957733bac85937c9f9cf3f4de27", size = 1816223, upload-time = "2026-03-28T17:18:24.729Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/23/e98075c5bb146aa61a1239ee1ac7714c85e814838d6cebbe37d3fe19214a/aiohttp-3.13.4-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:ca114790c9144c335d538852612d3e43ea0f075288f4849cf4b05d6cd2238ce7", size = 1649145, upload-time = "2026-03-28T17:18:27.269Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/c1/7bad8be33bb06c2bb224b6468874346026092762cbec388c3bdb65a368ee/aiohttp-3.13.4-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:ea2e071661ba9cfe11eabbc81ac5376eaeb3061f6e72ec4cc86d7cdd1ffbdbbb", size = 1816562, upload-time = "2026-03-28T17:18:29.847Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/10/c00323348695e9a5e316825969c88463dcc24c7e9d443244b8a2c9cf2eae/aiohttp-3.13.4-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:34e89912b6c20e0fd80e07fa401fd218a410aa1ce9f1c2f1dad6db1bd0ce0927", size = 1800333, upload-time = "2026-03-28T17:18:32.269Z" },
-    { url = "https://files.pythonhosted.org/packages/84/43/9b2147a1df3559f49bd723e22905b46a46c068a53adb54abdca32c4de180/aiohttp-3.13.4-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:0e217cf9f6a42908c52b46e42c568bd57adc39c9286ced31aaace614b6087965", size = 1820617, upload-time = "2026-03-28T17:18:35.238Z" },
-    { url = "https://files.pythonhosted.org/packages/a9/7f/b3481a81e7a586d02e99387b18c6dafff41285f6efd3daa2124c01f87eae/aiohttp-3.13.4-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:0c296f1221e21ba979f5ac1964c3b78cfde15c5c5f855ffd2caab337e9cd9182", size = 1643417, upload-time = "2026-03-28T17:18:37.949Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/72/07181226bc99ce1124e0f89280f5221a82d3ae6a6d9d1973ce429d48e52b/aiohttp-3.13.4-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:d99a9d168ebaffb74f36d011750e490085ac418f4db926cce3989c8fe6cb6b1b", size = 1849286, upload-time = "2026-03-28T17:18:40.534Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/e6/1b3566e103eca6da5be4ae6713e112a053725c584e96574caf117568ffef/aiohttp-3.13.4-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:cb19177205d93b881f3f89e6081593676043a6828f59c78c17a0fd6c1fbed2ba", size = 1782635, upload-time = "2026-03-28T17:18:43.073Z" },
-    { url = "https://files.pythonhosted.org/packages/37/58/1b11c71904b8d079eb0c39fe664180dd1e14bebe5608e235d8bfbadc8929/aiohttp-3.13.4-cp314-cp314t-win32.whl", hash = "sha256:c606aa5656dab6552e52ca368e43869c916338346bfaf6304e15c58fb113ea30", size = 472537, upload-time = "2026-03-28T17:18:46.286Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/8f/87c56a1a1977d7dddea5b31e12189665a140fdb48a71e9038ff90bb564ec/aiohttp-3.13.4-cp314-cp314t-win_amd64.whl", hash = "sha256:014dcc10ec8ab8db681f0d68e939d1e9286a5aa2b993cbbdb0db130853e02144", size = 506381, upload-time = "2026-03-28T17:18:48.74Z" },
+    { url = "https://files.pythonhosted.org/packages/28/03/5f36ab196a88ba5e9648ae5643e6531e67a3a8c0e96f9c6510ff41540fec/aiohttp-3.14.0-cp314-cp314-android_24_arm64_v8a.whl", hash = "sha256:363ef9e91014e7891679bfb2ac0a7c6ea93435dbbfd10ecf41b9f06fcf506c5f", size = 503330, upload-time = "2026-06-01T19:39:18.195Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/ce/8b49ec2f30f68e02f314f4832186cd45e583360a5a386058be36855d23b6/aiohttp-3.14.0-cp314-cp314-android_24_x86_64.whl", hash = "sha256:884a4edbdad77be9d0ef36142c8b504351b170df0bf62b51e784fadabf311c42", size = 509822, upload-time = "2026-06-01T19:39:20.396Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/fe/6edbf5d39bf29322b6816365b17ed8ede4dace164a3aea1abcd30110eb78/aiohttp-3.14.0-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:70ea956f6cc4a37620966b56c2e205d88ca3e6d85ec063277e414b1035cddad3", size = 483329, upload-time = "2026-06-01T19:39:22.607Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/5a/fae531bdbc6456fb6241f46b7b81e4d8a0dd3fc09118a0055dc7141ac1ec/aiohttp-3.14.0-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:ea3b9806c89f61da22fddf1f12dd524fb368e5e28f1261fbdafe5c3cd8ce893b", size = 489502, upload-time = "2026-06-01T19:39:24.881Z" },
+    { url = "https://files.pythonhosted.org/packages/36/f4/48a7b0414db7fed77a03d5dde34508c026afd83510ab6bca08c313855776/aiohttp-3.14.0-cp314-cp314-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:a071be341c2bd9b0188e62d173509f024e0a35b1c342c53c50f8daaeda8c3bd8", size = 497357, upload-time = "2026-06-01T19:39:27.197Z" },
+    { url = "https://files.pythonhosted.org/packages/75/75/e85a13a370acc007fca5feb1fd1b88ac2d8426e6dadd625479b7cadd55a3/aiohttp-3.14.0-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:198cfe61bf253b19da1fb3e0fa122249dc4f14c12709493fed8054aa0411cc76", size = 750898, upload-time = "2026-06-01T19:39:29.563Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/e4/3d637f800c724eff0e2bed64df72557444482366fd0a35b0cec0e6968f6c/aiohttp-3.14.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:9dc203d6ce6b9106d54e2a93f41dfdfebfbca2d99962ba503bfd3e5921a6549e", size = 506986, upload-time = "2026-06-01T19:39:31.872Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/df/35161f3598bf7501d2b2a805b41ab4f45a2e34150c421bcb4ef8c0d281a7/aiohttp-3.14.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:9e19d17ab02bf16832a2c8c0d55a486792c5b1645665652ee9531aebcc30cb72", size = 508033, upload-time = "2026-06-01T19:39:34.137Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/39/b36e5d3d31e850fb4691dd3e941684ac490a2559249f6fa634b6b0fdf020/aiohttp-3.14.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d925fba0c14d5b498a8028b0107beebdfd16c5d48d702ff54f879cb017aaaca3", size = 1746213, upload-time = "2026-06-01T19:39:36.654Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/28/24e1409e605a9aa5d84abe0e2acb365354b70ae56d40948101cabe3341ab/aiohttp-3.14.0-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:d33e61021222ce7f9792bcac870d6f58d8adfceda33ab857b01264f4560f2c5f", size = 1705862, upload-time = "2026-06-01T19:39:38.968Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/d0/e5eb3ff1daeaf644c7e36a957517672494122628e067c38b263fa04eda77/aiohttp-3.14.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:44eca38755d0105bb32f47d085f5dd449846a449e1245fc105889e3279dcf8e3", size = 1798909, upload-time = "2026-06-01T19:39:41.334Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/ba/8943f906f0570342886ababb9a722a44e360f786a028c5e0b0e29e3f735b/aiohttp-3.14.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:f13087e06f68fea4941c21a0c541c00553aa16e4f8fd7bbe2b198df761e964d6", size = 1868892, upload-time = "2026-06-01T19:39:43.807Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/05/27df32c844b2156e1675a8d8ec22d963e3c8ba469ed7ceb1863320c7b521/aiohttp-3.14.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ff82be7f1ef73634cb77890a770743239bc3d487b848669be1c599889336dc0a", size = 1751659, upload-time = "2026-06-01T19:39:46.398Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/62/da182e5910ab912b2e88aa919b61a16046a37a95714a5795b02eb57b2d18/aiohttp-3.14.0-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a150c0875ac8fd87f1c398650841308a30d65facf7416b12dbdb9cfdcbe5a48c", size = 1578775, upload-time = "2026-06-01T19:39:48.902Z" },
+    { url = "https://files.pythonhosted.org/packages/66/e3/53c67097e8a5ce98625e91e3fa7f43c9c6940de680345d03b3509a72a078/aiohttp-3.14.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:edc01ea4e1ec5a1649a28866262bf24195889ff7b27bdd947029a6086741de9b", size = 1710090, upload-time = "2026-06-01T19:39:51.392Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/55/0e2732ca598c7a4dfe8a775662376d0ca2977cb1030e48386d4da5d9a456/aiohttp-3.14.0-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:540632bf882ff8fc88f2e1697be0761578e89e0d79fb4a8a6d65dc5da7e729d4", size = 1715016, upload-time = "2026-06-01T19:39:53.807Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/96/f0b73730798c9ca525afc30b39f1f81bbe24e245d9654c54d3b39d63212d/aiohttp-3.14.0-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:860a86bc2c80237f5dff52edcf427e10a8d8352271fd84845429a3e60199e02c", size = 1763810, upload-time = "2026-06-01T19:39:56.31Z" },
+    { url = "https://files.pythonhosted.org/packages/71/cc/11acb6c4518f448323405a7312b6f255d0f974a34373ad1db7633c4aadc8/aiohttp-3.14.0-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:5cbd50e6a50d6b99283a826b18cbdebf65b0797689a7535cb0e9dd37be0f63c3", size = 1573064, upload-time = "2026-06-01T19:39:58.718Z" },
+    { url = "https://files.pythonhosted.org/packages/de/2d/28c31dde0a7dc98c0ee7d0da2ddcec3f7688c4fc131e5989e278d0c03c0a/aiohttp-3.14.0-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:20144819e99db593e22bbd2f3f2691a5e149f879142d6b8670254708853ff4fb", size = 1775765, upload-time = "2026-06-01T19:40:01.195Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/69/155c4ef3aec96417d47024800472b33b16c5d8a665371dcd044c2afdf25d/aiohttp-3.14.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:26b6d79aa54cb4ed50cc7d41ed14e99e0f1fc8e7c2d42f2e05b37aea897b2b52", size = 1733716, upload-time = "2026-06-01T19:40:03.631Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/44/6126116fd8a316b712bb615660b855c78466bb67ba1bb1742427eafcf7ac/aiohttp-3.14.0-cp314-cp314-win32.whl", hash = "sha256:106ed074a856f3e21d186b8579e2c8afb6da598e267cdaab01059e13db2fc44d", size = 453684, upload-time = "2026-06-01T19:40:06.277Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/d7/eff4c58a88c5cac5e38b55f44fb8a6d3929c3cbd77356e383e094d3220bd/aiohttp-3.14.0-cp314-cp314-win_amd64.whl", hash = "sha256:4f770846edae8f00ecc57af825bce811f787f87a7dcf0e90d191790efe5b31f7", size = 481758, upload-time = "2026-06-01T19:40:08.653Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/ed/17b5bd9fbcb46e688f02e572f517754a9a75831e7b54702f027761dc4fa5/aiohttp-3.14.0-cp314-cp314-win_arm64.whl", hash = "sha256:acf1581c4f21ed4b80a2dded504d87b055a071a84d5737ea966435f768275ac6", size = 450557, upload-time = "2026-06-01T19:40:11.03Z" },
+    { url = "https://files.pythonhosted.org/packages/12/34/6180103ce9aabc8ebff3f7bb55a1228ffe60f61042823031d9692cb7b101/aiohttp-3.14.0-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:6aa1a40f9cbb3da9f80714c5966b8946c21e6a2530d809b9498b33161e3c8733", size = 787878, upload-time = "2026-06-01T19:40:13.401Z" },
+    { url = "https://files.pythonhosted.org/packages/92/e9/08954a40e8b7baa3d8beadd2b074b186e9b1e9c8ddabc288678a6265de50/aiohttp-3.14.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:b62af5a8cc96a194eaa01a9ed7b34a3ffa58d3d8daaa1a0d7a749353ad12d228", size = 524400, upload-time = "2026-06-01T19:40:15.972Z" },
+    { url = "https://files.pythonhosted.org/packages/08/6a/b5965a634ac4d5ba99a463314cf4ab214ca073fcdc38a15e0294273701fc/aiohttp-3.14.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:6eb63b1417efaf7d1002a6ad034a40d44376afcc16508a57f8e74b49ad26a095", size = 527904, upload-time = "2026-06-01T19:40:18.28Z" },
+    { url = "https://files.pythonhosted.org/packages/06/b4/932bcdd850c354d9bcca30f360e475d7852e30413fbbd44b182782ed5432/aiohttp-3.14.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c20b9ad156a79eb97be5cf9e069eec01d2f0dc8472ffbd75299a8b2d4c2cbbde", size = 1912162, upload-time = "2026-06-01T19:40:20.825Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/85/ce79bab0310d2e3fd2d7bc7e44412abeff7c8338f8a21dd0f2f1714989e5/aiohttp-3.14.0-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:40ae7b0642c25632c7eabc4a04754012691864d2a1b93becf7cddb76027b838a", size = 1778813, upload-time = "2026-06-01T19:40:23.726Z" },
+    { url = "https://files.pythonhosted.org/packages/05/54/ba62ac2d1bc87e010aad23751e383b8794e45d931df67677313a2da78823/aiohttp-3.14.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:95f5217e76a046b9f228a101717ef8d42b1eb3d9d196d15202db5bf41df88936", size = 1899969, upload-time = "2026-06-01T19:40:26.406Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/82/7cc7907725d83a19f31551334061e1ab8e108b1d7ac52632a2a844a4acb5/aiohttp-3.14.0-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:1a4a9f17e85b80878c176695c1998c790e83731d8271881e5d356488652a1f9e", size = 1991771, upload-time = "2026-06-01T19:40:29.061Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/1c/a57de71a4508c93a830b77c28af3d08cd97f606dedfc6b94275347744508/aiohttp-3.14.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:145262119b07d7f95abc1839add35ba2bfc84551d4b4660ca11542c0b215455b", size = 1868606, upload-time = "2026-06-01T19:40:31.843Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/ae/3839726cd49150a53ed340cc24ce5ba09d4c2117020ef9d45542bec5eb2f/aiohttp-3.14.0-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:49a33ded29b0b2fa7a367a02cf0fb89af602bb87542a16177ec8ce1c9c51d12a", size = 1665437, upload-time = "2026-06-01T19:40:35.01Z" },
+    { url = "https://files.pythonhosted.org/packages/35/1e/c237923232c7da7f0392ea25d89fc5e60c0e93f685f4ebca8e7bcdd5271c/aiohttp-3.14.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:2cc736a9c9fc2bc4dd71fd404815741b6573df27c3f985948ec4076989ac57de", size = 1834090, upload-time = "2026-06-01T19:40:37.733Z" },
+    { url = "https://files.pythonhosted.org/packages/98/02/a5a7a2524f92d3911761b405a7c067c751891942144adc13e2ad79611e39/aiohttp-3.14.0-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:b4141a3e5342ee3053a9cab54d25b64ed28289c1041e4c54b3d99839314d90ce", size = 1816907, upload-time = "2026-06-01T19:40:40.46Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/76/a8b9f0d09234d516af9f2d7dd715557f33b5da3b0b56ead41d1170e86e3c/aiohttp-3.14.0-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:e30871b2d58996cb81aac52d2b1d15ac05257131ef0f90f18c2115a380fbfe7c", size = 1840382, upload-time = "2026-06-01T19:40:43.48Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/8e/140e715a0a4bbc211979ea30ec8396ad2ed5bf90ab87d8058fc4668b1923/aiohttp-3.14.0-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:667b881d083ccae3900ea5a241e17e5007ca78844c53ed389bb63d48f729d9c7", size = 1659497, upload-time = "2026-06-01T19:40:46.265Z" },
+    { url = "https://files.pythonhosted.org/packages/10/c7/7ba5de8af9650b9767b063c675427b8685f43fa7ce563673a7bc3af60f08/aiohttp-3.14.0-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:b584dfe615d151e9b8f0a8ecb3aee6147f2927ec5b95ba25fe621f5377510928", size = 1870829, upload-time = "2026-06-01T19:40:49.583Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/bc/2aaab2f85cadb26ea59c091fa2b8e370d625154b5c14b478f1b489d07551/aiohttp-3.14.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:6199707cc40e0e9cd39c36fbc97bec416c704e1d0ddce03412bb3b3e6a90ccd0", size = 1832281, upload-time = "2026-06-01T19:40:52.303Z" },
+    { url = "https://files.pythonhosted.org/packages/39/98/31b9ad9fbc01f0075ee7221002df5fd2d10b647f451ca5f30edc802d9dd6/aiohttp-3.14.0-cp314-cp314t-win32.whl", hash = "sha256:a8d93334d4961c9d566b1f046c81dee475b7c21eb730728d38237bfa70d1c8e6", size = 490597, upload-time = "2026-06-01T19:40:54.937Z" },
+    { url = "https://files.pythonhosted.org/packages/59/1f/299b21441c8de42ff70fddc7cfe65e92f810abcf740739a09b56f7835364/aiohttp-3.14.0-cp314-cp314t-win_amd64.whl", hash = "sha256:2d2ffe9b614f50f069068b3b52e73414e4107fc10b7efc939a76acff9251fdd2", size = 525789, upload-time = "2026-06-01T19:40:57.306Z" },
+    { url = "https://files.pythonhosted.org/packages/70/11/7f83fcba9ee05d4c54d61b3f8104da0d43a59adac44dd28effc0c9a10422/aiohttp-3.14.0-cp314-cp314t-win_arm64.whl", hash = "sha256:7a3fc4358e65826c515350f199c210de747cf669998211b1ee6c2e46de364b24", size = 467399, upload-time = "2026-06-01T19:40:59.993Z" },
 ]
 
 [[package]]
@@ -158,7 +165,7 @@ requires-dist = [
     { name = "geoip2", specifier = ">=5.2.0" },
     { name = "httpx", specifier = ">=0.28.1" },
     { name = "imbalanced-learn", marker = "extra == 'ml'", specifier = ">=0.14.1" },
-    { name = "mlflow", marker = "extra == 'ml'", specifier = ">=3.9.0" },
+    { name = "mlflow", marker = "extra == 'ml'", specifier = ">=3.11.1" },
     { name = "mypy", marker = "extra == 'dev'", specifier = ">=1.19.1" },
     { name = "numpy", marker = "extra == 'ml'", specifier = ">=2.4.2" },
     { name = "onnxruntime", marker = "extra == 'ml'", specifier = ">=1.24.1" },
@@ -934,11 +941,11 @@ wheels = [
 
 [[package]]
 name = "idna"
-version = "3.11"
+version = "3.15"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/0703ccc57f3a7233505399edb88de3cbd678da106337b9fcde432b65ed60/idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902", size = 194582, upload-time = "2025-10-12T14:55:20.501Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/82/77/7b3966d0b9d1d31a36ddf1746926a11dface89a83409bf1483f0237aa758/idna-3.15.tar.gz", hash = "sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc", size = 199245, upload-time = "2026-05-12T22:45:57.011Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/23/408243171aa9aaba178d3e2559159c24c1171a641aa83b67bdd3394ead8e/idna-3.15-py3-none-any.whl", hash = "sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8", size = 72340, upload-time = "2026-05-12T22:45:55.733Z" },
 ]
 
 [[package]]
@@ -1242,9 +1249,10 @@ wheels = [
 
 [[package]]
 name = "mlflow"
-version = "3.9.0"
+version = "3.11.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
+    { name = "aiohttp" },
     { name = "alembic" },
     { name = "cryptography" },
     { name = "docker" },
@@ -1265,14 +1273,14 @@ dependencies = [
     { name = "sqlalchemy" },
     { name = "waitress", marker = "sys_platform == 'win32'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/95/e5/9f8481b879329ed0f5317eda459fb7eebe9eb9bae7d99ba6a7d68074f619/mlflow-3.9.0.tar.gz", hash = "sha256:47a41fa22107b0ceee1f91e2184759ebfaffa31d7913b70318b78fb5369e52ec", size = 9105613, upload-time = "2026-01-29T07:56:51.477Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e9/34/e328c073cd32c186fb242a957e5bade82433c06bc45b7d1695bf4d02f166/mlflow-3.11.1.tar.gz", hash = "sha256:84e54c4be91b5b2a19039a2673fe688b1d7307ceddacc08af51f8df05b19ee56", size = 9797469, upload-time = "2026-04-07T14:26:58.463Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e9/ce/871d1168206164242856b5cbf327693b708d6a63c3163d90f89ad5e70807/mlflow-3.9.0-py3-none-any.whl", hash = "sha256:280f94854e5ece42fc5538180b276661c62dbfb2c848a98e8873e78915379ac6", size = 9692264, upload-time = "2026-01-29T07:56:48.811Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/62/96826c340354638dfedcbdbcd35d67754566bd45f6592300e0c215c80e30/mlflow-3.11.1-py3-none-any.whl", hash = "sha256:8f6bf1238ac04f97664c229dd480380c5c254a78bdb3c0e433e3a0397508b1af", size = 10479141, upload-time = "2026-04-07T14:26:55.709Z" },
 ]
 
 [[package]]
 name = "mlflow-skinny"
-version = "3.9.0"
+version = "3.11.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cachetools" },
@@ -1295,14 +1303,14 @@ dependencies = [
     { name = "typing-extensions" },
     { name = "uvicorn" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/fc/18/34a8c085eece1abb7edaed3b9a383670b97a4a234fec62d1823e8c64d11b/mlflow_skinny-3.9.0.tar.gz", hash = "sha256:0598e0635dd1af9d195fb429210819aa4b56e9d6014f87134241f2325d57a290", size = 2329309, upload-time = "2026-01-29T07:42:36.8Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/40/77/fe2027ddad9e52ed1ac360fbc262169e6366f6678632e350cbd0d901bb9b/mlflow_skinny-3.11.1.tar.gz", hash = "sha256:86ce63491349f6713afc8a4ef0bf77a8314d0e79e03753cb150d6c860a0b0475", size = 2642799, upload-time = "2026-04-07T14:26:43.818Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/c0/7c/a82fd9d6ecefba347e3a65168df63fd79784fa8c22b8734fb4cb71f2d469/mlflow_skinny-3.9.0-py3-none-any.whl", hash = "sha256:9b98706cdf9e07a61da7fbcd717c8d35ac89c76e084d25aafdbc150028e832d5", size = 2807062, upload-time = "2026-01-29T07:42:35.132Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/a7/e61ec397b34dc3c9e91572f45e41617f429d5c524d38a4e1aa2316ee1b5e/mlflow_skinny-3.11.1-py3-none-any.whl", hash = "sha256:82ffd5f6980320b4ac19f741e7a754faa1d01707e632b002ea68e04fd25a0535", size = 3171551, upload-time = "2026-04-07T14:26:41.762Z" },
 ]
 
 [[package]]
 name = "mlflow-tracing"
-version = "3.9.0"
+version = "3.11.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cachetools" },
@@ -1314,9 +1322,9 @@ dependencies = [
     { name = "protobuf" },
     { name = "pydantic" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/36/ba/11c8b4a4841104b55ad63a1f11ad72b1f282b819c4da197cf01128b61c25/mlflow_tracing-3.9.0.tar.gz", hash = "sha256:3a0676e6f362712299d191108a5cbcd596f6d84f23f050dfbf80161e245d456c", size = 1176445, upload-time = "2026-01-29T07:44:59.525Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/1b/77/73af163432f3c66e2d213045250972e504a6683c76f63dd1abfba441a16a/mlflow_tracing-3.11.1.tar.gz", hash = "sha256:cb63cee16385d081467ec5bee4807fe1af59ddfdf04be4c79e7a7813b1002193", size = 1314550, upload-time = "2026-04-07T14:26:32.785Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a1/9c/d726d51aec6a2349f90630b43972cee1f683a22b4b3683a241b02a454baf/mlflow_tracing-3.9.0-py3-none-any.whl", hash = "sha256:93df8df0697303ad3135df6228934e5d9d2f264d2683b97a6f06ad865ec418a0", size = 1410828, upload-time = "2026-01-29T07:44:57.615Z" },
+    { url = "https://files.pythonhosted.org/packages/62/ab/d980c84e7df4224ab8db2457afbe135b430f371ca081a37cf89f8ef18ca1/mlflow_tracing-3.11.1-py3-none-any.whl", hash = "sha256:fa82df64dacf8293b714ae666440fe7c1902c6470c024df389bb91e9de3106d9", size = 1575790, upload-time = "2026-04-07T14:26:30.804Z" },
 ]
 
 [[package]]
@@ -1892,24 +1900,24 @@ wheels = [
 
 [[package]]
 name = "pyarrow"
-version = "22.0.0"
+version = "23.0.1"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/30/53/04a7fdc63e6056116c9ddc8b43bc28c12cdd181b85cbeadb79278475f3ae/pyarrow-22.0.0.tar.gz", hash = "sha256:3d600dc583260d845c7d8a6db540339dd883081925da2bd1c5cb808f720b3cd9", size = 1151151, upload-time = "2025-10-24T12:30:00.762Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/88/22/134986a4cc224d593c1afde5494d18ff629393d74cc2eddb176669f234a4/pyarrow-23.0.1.tar.gz", hash = "sha256:b8c5873e33440b2bc2f4a79d2b47017a89c5a24116c055625e6f2ee50523f019", size = 1167336, upload-time = "2026-02-16T10:14:12.39Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/bd/b0/0fa4d28a8edb42b0a7144edd20befd04173ac79819547216f8a9f36f9e50/pyarrow-22.0.0-cp314-cp314-macosx_12_0_arm64.whl", hash = "sha256:9bddc2cade6561f6820d4cd73f99a0243532ad506bc510a75a5a65a522b2d74d", size = 34224062, upload-time = "2025-10-24T10:08:14.101Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/a8/7a719076b3c1be0acef56a07220c586f25cd24de0e3f3102b438d18ae5df/pyarrow-22.0.0-cp314-cp314-macosx_12_0_x86_64.whl", hash = "sha256:e70ff90c64419709d38c8932ea9fe1cc98415c4f87ea8da81719e43f02534bc9", size = 35990057, upload-time = "2025-10-24T10:08:21.842Z" },
-    { url = "https://files.pythonhosted.org/packages/89/3c/359ed54c93b47fb6fe30ed16cdf50e3f0e8b9ccfb11b86218c3619ae50a8/pyarrow-22.0.0-cp314-cp314-manylinux_2_28_aarch64.whl", hash = "sha256:92843c305330aa94a36e706c16209cd4df274693e777ca47112617db7d0ef3d7", size = 45068002, upload-time = "2025-10-24T10:08:29.034Z" },
-    { url = "https://files.pythonhosted.org/packages/55/fc/4945896cc8638536ee787a3bd6ce7cec8ec9acf452d78ec39ab328efa0a1/pyarrow-22.0.0-cp314-cp314-manylinux_2_28_x86_64.whl", hash = "sha256:6dda1ddac033d27421c20d7a7943eec60be44e0db4e079f33cc5af3b8280ccde", size = 47737765, upload-time = "2025-10-24T10:08:38.559Z" },
-    { url = "https://files.pythonhosted.org/packages/cd/5e/7cb7edeb2abfaa1f79b5d5eb89432356155c8426f75d3753cbcb9592c0fd/pyarrow-22.0.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:84378110dd9a6c06323b41b56e129c504d157d1a983ce8f5443761eb5256bafc", size = 48048139, upload-time = "2025-10-24T10:08:46.784Z" },
-    { url = "https://files.pythonhosted.org/packages/88/c6/546baa7c48185f5e9d6e59277c4b19f30f48c94d9dd938c2a80d4d6b067c/pyarrow-22.0.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:854794239111d2b88b40b6ef92aa478024d1e5074f364033e73e21e3f76b25e0", size = 50314244, upload-time = "2025-10-24T10:08:55.771Z" },
-    { url = "https://files.pythonhosted.org/packages/3c/79/755ff2d145aafec8d347bf18f95e4e81c00127f06d080135dfc86aea417c/pyarrow-22.0.0-cp314-cp314-win_amd64.whl", hash = "sha256:b883fe6fd85adad7932b3271c38ac289c65b7337c2c132e9569f9d3940620730", size = 28757501, upload-time = "2025-10-24T10:09:59.891Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/d2/237d75ac28ced3147912954e3c1a174df43a95f4f88e467809118a8165e0/pyarrow-22.0.0-cp314-cp314t-macosx_12_0_arm64.whl", hash = "sha256:7a820d8ae11facf32585507c11f04e3f38343c1e784c9b5a8b1da5c930547fe2", size = 34355506, upload-time = "2025-10-24T10:09:02.953Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/2c/733dfffe6d3069740f98e57ff81007809067d68626c5faef293434d11bd6/pyarrow-22.0.0-cp314-cp314t-macosx_12_0_x86_64.whl", hash = "sha256:c6ec3675d98915bf1ec8b3c7986422682f7232ea76cad276f4c8abd5b7319b70", size = 36047312, upload-time = "2025-10-24T10:09:10.334Z" },
-    { url = "https://files.pythonhosted.org/packages/7c/2b/29d6e3782dc1f299727462c1543af357a0f2c1d3c160ce199950d9ca51eb/pyarrow-22.0.0-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:3e739edd001b04f654b166204fc7a9de896cf6007eaff33409ee9e50ceaff754", size = 45081609, upload-time = "2025-10-24T10:09:18.61Z" },
-    { url = "https://files.pythonhosted.org/packages/8d/42/aa9355ecc05997915af1b7b947a7f66c02dcaa927f3203b87871c114ba10/pyarrow-22.0.0-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:7388ac685cab5b279a41dfe0a6ccd99e4dbf322edfb63e02fc0443bf24134e91", size = 47703663, upload-time = "2025-10-24T10:09:27.369Z" },
-    { url = "https://files.pythonhosted.org/packages/ee/62/45abedde480168e83a1de005b7b7043fd553321c1e8c5a9a114425f64842/pyarrow-22.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:f633074f36dbc33d5c05b5dc75371e5660f1dbf9c8b1d95669def05e5425989c", size = 48066543, upload-time = "2025-10-24T10:09:34.908Z" },
-    { url = "https://files.pythonhosted.org/packages/84/e9/7878940a5b072e4f3bf998770acafeae13b267f9893af5f6d4ab3904b67e/pyarrow-22.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:4c19236ae2402a8663a2c8f21f1870a03cc57f0bef7e4b6eb3238cc82944de80", size = 50288838, upload-time = "2025-10-24T10:09:44.394Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/03/f335d6c52b4a4761bcc83499789a1e2e16d9d201a58c327a9b5cc9a41bd9/pyarrow-22.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:0c34fe18094686194f204a3b1787a27456897d8a2d62caf84b61e8dfbc0252ae", size = 29185594, upload-time = "2025-10-24T10:09:53.111Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/1b/6da9a89583ce7b23ac611f183ae4843cd3a6cf54f079549b0e8c14031e73/pyarrow-23.0.1-cp314-cp314-macosx_12_0_arm64.whl", hash = "sha256:5df1161da23636a70838099d4aaa65142777185cc0cdba4037a18cee7d8db9ca", size = 34238755, upload-time = "2026-02-16T10:12:32.819Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/b5/d58a241fbe324dbaeb8df07be6af8752c846192d78d2272e551098f74e88/pyarrow-23.0.1-cp314-cp314-macosx_12_0_x86_64.whl", hash = "sha256:fa8e51cb04b9f8c9c5ace6bab63af9a1f88d35c0d6cbf53e8c17c098552285e1", size = 35847826, upload-time = "2026-02-16T10:12:38.949Z" },
+    { url = "https://files.pythonhosted.org/packages/54/a5/8cbc83f04aba433ca7b331b38f39e000efd9f0c7ce47128670e737542996/pyarrow-23.0.1-cp314-cp314-manylinux_2_28_aarch64.whl", hash = "sha256:0b95a3994f015be13c63148fef8832e8a23938128c185ee951c98908a696e0eb", size = 44536859, upload-time = "2026-02-16T10:12:45.467Z" },
+    { url = "https://files.pythonhosted.org/packages/36/2e/c0f017c405fcdc252dbccafbe05e36b0d0eb1ea9a958f081e01c6972927f/pyarrow-23.0.1-cp314-cp314-manylinux_2_28_x86_64.whl", hash = "sha256:4982d71350b1a6e5cfe1af742c53dfb759b11ce14141870d05d9e540d13bc5d1", size = 47614443, upload-time = "2026-02-16T10:12:55.525Z" },
+    { url = "https://files.pythonhosted.org/packages/af/6b/2314a78057912f5627afa13ba43809d9d653e6630859618b0fd81a4e0759/pyarrow-23.0.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:c250248f1fe266db627921c89b47b7c06fee0489ad95b04d50353537d74d6886", size = 48232991, upload-time = "2026-02-16T10:13:04.729Z" },
+    { url = "https://files.pythonhosted.org/packages/40/f2/1bcb1d3be3460832ef3370d621142216e15a2c7c62602a4ea19ec240dd64/pyarrow-23.0.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:5f4763b83c11c16e5f4c15601ba6dfa849e20723b46aa2617cb4bffe8768479f", size = 50645077, upload-time = "2026-02-16T10:13:14.147Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/3f/b1da7b61cd66566a4d4c8383d376c606d1c34a906c3f1cb35c479f59d1aa/pyarrow-23.0.1-cp314-cp314-win_amd64.whl", hash = "sha256:3a4c85ef66c134161987c17b147d6bffdca4566f9a4c1d81a0a01cdf08414ea5", size = 28234271, upload-time = "2026-02-16T10:14:09.397Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/78/07f67434e910a0f7323269be7bfbf58699bd0c1d080b18a1ab49ba943fe8/pyarrow-23.0.1-cp314-cp314t-macosx_12_0_arm64.whl", hash = "sha256:17cd28e906c18af486a499422740298c52d7c6795344ea5002a7720b4eadf16d", size = 34488692, upload-time = "2026-02-16T10:13:21.541Z" },
+    { url = "https://files.pythonhosted.org/packages/50/76/34cf7ae93ece1f740a04910d9f7e80ba166b9b4ab9596a953e9e62b90fe1/pyarrow-23.0.1-cp314-cp314t-macosx_12_0_x86_64.whl", hash = "sha256:76e823d0e86b4fb5e1cf4a58d293036e678b5a4b03539be933d3b31f9406859f", size = 35964383, upload-time = "2026-02-16T10:13:28.63Z" },
+    { url = "https://files.pythonhosted.org/packages/46/90/459b827238936d4244214be7c684e1b366a63f8c78c380807ae25ed92199/pyarrow-23.0.1-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:a62e1899e3078bf65943078b3ad2a6ddcacf2373bc06379aac61b1e548a75814", size = 44538119, upload-time = "2026-02-16T10:13:35.506Z" },
+    { url = "https://files.pythonhosted.org/packages/28/a1/93a71ae5881e99d1f9de1d4554a87be37da11cd6b152239fb5bd924fdc64/pyarrow-23.0.1-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:df088e8f640c9fae3b1f495b3c64755c4e719091caf250f3a74d095ddf3c836d", size = 47571199, upload-time = "2026-02-16T10:13:42.504Z" },
+    { url = "https://files.pythonhosted.org/packages/88/a3/d2c462d4ef313521eaf2eff04d204ac60775263f1fb08c374b543f79f610/pyarrow-23.0.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:46718a220d64677c93bc243af1d44b55998255427588e400677d7192671845c7", size = 48259435, upload-time = "2026-02-16T10:13:49.226Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/f1/11a544b8c3d38a759eb3fbb022039117fd633e9a7b19e4841cc3da091915/pyarrow-23.0.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:a09f3876e87f48bc2f13583ab551f0379e5dfb83210391e68ace404181a20690", size = 50629149, upload-time = "2026-02-16T10:13:57.238Z" },
+    { url = "https://files.pythonhosted.org/packages/50/f2/c0e76a0b451ffdf0cf788932e182758eb7558953f4f27f1aff8e2518b653/pyarrow-23.0.1-cp314-cp314t-win_amd64.whl", hash = "sha256:527e8d899f14bd15b740cd5a54ad56b7f98044955373a17179d5956ddb93d9ce", size = 28365807, upload-time = "2026-02-16T10:14:03.892Z" },
 ]
 
 [[package]]
diff --git a/PROJECTS/advanced/ai-threat-detection/frontend/package.json b/PROJECTS/advanced/ai-threat-detection/frontend/package.json
index e50dddc4..e7fc7284 100644
--- a/PROJECTS/advanced/ai-threat-detection/frontend/package.json
+++ b/PROJECTS/advanced/ai-threat-detection/frontend/package.json
@@ -16,7 +16,7 @@
   },
   "dependencies": {
     "@tanstack/react-query": "^5.90.20",
-    "axios": "^1.15.2",
+    "axios": "^1.16.0",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
     "react-error-boundary": "^6.1.0",
diff --git a/PROJECTS/advanced/ai-threat-detection/frontend/pnpm-lock.yaml b/PROJECTS/advanced/ai-threat-detection/frontend/pnpm-lock.yaml
index 43776030..a76043c9 100644
--- a/PROJECTS/advanced/ai-threat-detection/frontend/pnpm-lock.yaml
+++ b/PROJECTS/advanced/ai-threat-detection/frontend/pnpm-lock.yaml
@@ -15,8 +15,8 @@ importers:
         specifier: ^5.90.20
         version: 5.90.21(react@19.2.4)
       axios:
-        specifier: ^1.15.2
-        version: 1.15.2
+        specifier: ^1.16.0
+        version: 1.16.0
       react:
         specifier: ^19.2.4
         version: 19.2.4
@@ -192,24 +192,28 @@ packages:
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@biomejs/cli-linux-arm64@2.4.4':
     resolution: {integrity: sha512-V/NFfbWhsUU6w+m5WYbBenlEAz8eYnSqRMDMAW3K+3v0tYVkNyZn8VU0XPxk/lOqNXLSCCrV7FmV/u3SjCBShg==}
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@biomejs/cli-linux-x64-musl@2.4.4':
     resolution: {integrity: sha512-gGvFTGpOIQDb5CQ2VC0n9Z2UEqlP46c4aNgHmAMytYieTGEcfqhfCFnhs6xjt0S3igE6q5GLuIXtdQt3Izok+g==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@biomejs/cli-linux-x64@2.4.4':
     resolution: {integrity: sha512-R4+ZCDtG9kHArasyBO+UBD6jr/FcFCTH8QkNTOCu0pRJzCWyWC4EtZa2AmUZB5h3e0jD7bRV2KvrENcf8rndBg==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@biomejs/cli-win32-arm64@2.4.4':
     resolution: {integrity: sha512-trzCqM7x+Gn832zZHgr28JoYagQNX4CZkUZhMUac2YxvvyDRLJDrb5m9IA7CaZLlX6lTQmADVfLEKP1et1Ma4Q==}
@@ -353,36 +357,42 @@ packages:
     engines: {node: '>= 10.0.0'}
     cpu: [arm]
     os: [linux]
+    libc: [glibc]
 
   '@parcel/watcher-linux-arm-musl@2.5.6':
     resolution: {integrity: sha512-Ve3gUCG57nuUUSyjBq/MAM0CzArtuIOxsBdQ+ftz6ho8n7s1i9E1Nmk/xmP323r2YL0SONs1EuwqBp2u1k5fxg==}
     engines: {node: '>= 10.0.0'}
     cpu: [arm]
     os: [linux]
+    libc: [musl]
 
   '@parcel/watcher-linux-arm64-glibc@2.5.6':
     resolution: {integrity: sha512-f2g/DT3NhGPdBmMWYoxixqYr3v/UXcmLOYy16Bx0TM20Tchduwr4EaCbmxh1321TABqPGDpS8D/ggOTaljijOA==}
     engines: {node: '>= 10.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@parcel/watcher-linux-arm64-musl@2.5.6':
     resolution: {integrity: sha512-qb6naMDGlbCwdhLj6hgoVKJl2odL34z2sqkC7Z6kzir8b5W65WYDpLB6R06KabvZdgoHI/zxke4b3zR0wAbDTA==}
     engines: {node: '>= 10.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@parcel/watcher-linux-x64-glibc@2.5.6':
     resolution: {integrity: sha512-kbT5wvNQlx7NaGjzPFu8nVIW1rWqV780O7ZtkjuWaPUgpv2NMFpjYERVi0UYj1msZNyCzGlaCWEtzc+exjMGbQ==}
     engines: {node: '>= 10.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@parcel/watcher-linux-x64-musl@2.5.6':
     resolution: {integrity: sha512-1JRFeC+h7RdXwldHzTsmdtYR/Ku8SylLgTU/reMuqdVD7CtLwf0VR1FqeprZ0eHQkO0vqsbvFLXUmYm/uNKJBg==}
     engines: {node: '>= 10.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@parcel/watcher-win32-arm64@2.5.6':
     resolution: {integrity: sha512-3ukyebjc6eGlw9yRt678DxVF7rjXatWiHvTXqphZLvo7aC5NdEgFufVwjFfY51ijYEWpXbqF5jtrK275z52D4Q==}
@@ -441,24 +451,28 @@ packages:
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@rolldown/binding-linux-arm64-musl@1.0.0-beta.50':
     resolution: {integrity: sha512-L0zRdH2oDPkmB+wvuTl+dJbXCsx62SkqcEqdM+79LOcB+PxbAxxjzHU14BuZIQdXcAVDzfpMfaHWzZuwhhBTcw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@rolldown/binding-linux-x64-gnu@1.0.0-beta.50':
     resolution: {integrity: sha512-gyoI8o/TGpQd3OzkJnh1M2kxy1Bisg8qJ5Gci0sXm9yLFzEXIFdtc4EAzepxGvrT2ri99ar5rdsmNG0zP0SbIg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@rolldown/binding-linux-x64-musl@1.0.0-beta.50':
     resolution: {integrity: sha512-zti8A7M+xFDpKlghpcCAzyOi+e5nfUl3QhU023ce5NCgUxRG5zGP2GR9LTydQ1rnIPwZUVBWd4o7NjZDaQxaXA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@rolldown/binding-openharmony-arm64@1.0.0-beta.50':
     resolution: {integrity: sha512-eZUssog7qljrrRU9Mi0eqYEPm3Ch0UwB+qlWPMKSUXHNqhm3TvDZarJQdTevGEfu3EHAXJvBIe0YFYr0TPVaMA==}
@@ -573,8 +587,8 @@ packages:
   asynckit@0.4.0:
     resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
 
-  axios@1.15.2:
-    resolution: {integrity: sha512-wLrXxPtcrPTsNlJmKjkPnNPK2Ihe0hn0wGSaTEiHRPxwjvJwT3hKmXF4dpqxmPO9SoNb2FsYXj/xEo0gHN+D5A==}
+  axios@1.16.0:
+    resolution: {integrity: sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==}
 
   babel-runtime@5.8.38:
     resolution: {integrity: sha512-KpgoA8VE/pMmNCrnEeeXqFG24TIH11Z3ZaimIhJWsin8EbfZy3WzFKUTIan10ZIDgRVvi9EkLbruJElJC9dRlg==}
@@ -703,8 +717,8 @@ packages:
     resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
     engines: {node: '>= 0.4'}
 
-  es-object-atoms@1.1.1:
-    resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
+  es-object-atoms@1.1.2:
+    resolution: {integrity: sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==}
     engines: {node: '>= 0.4'}
 
   es-set-tostringtag@2.1.0:
@@ -833,8 +847,8 @@ packages:
     resolution: {integrity: sha512-nhQ6ExaOIqti2FDWoEMWARUqIKyjr2VcZzXShrI+A3zpeiuPWzx6iPftt44LhP74E5sW36B75N6VHbvRtpvO6Q==}
     engines: {node: '>=20'}
 
-  hasown@2.0.3:
-    resolution: {integrity: sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==}
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
     engines: {node: '>= 0.4'}
 
   hookified@1.15.1:
@@ -963,24 +977,28 @@ packages:
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   lightningcss-linux-arm64-musl@1.31.1:
     resolution: {integrity: sha512-mVZ7Pg2zIbe3XlNbZJdjs86YViQFoJSpc41CbVmKBPiGmC4YrfeOyz65ms2qpAobVd7WQsbW4PdsSJEMymyIMg==}
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   lightningcss-linux-x64-gnu@1.31.1:
     resolution: {integrity: sha512-xGlFWRMl+0KvUhgySdIaReQdB4FNudfUTARn7q0hh/V67PVGCs3ADFjw+6++kG1RNd0zdGRlEKa+T13/tQjPMA==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   lightningcss-linux-x64-musl@1.31.1:
     resolution: {integrity: sha512-eowF8PrKHw9LpoZii5tdZwnBcYDxRw2rRCyvAXLi34iyeYfqCQNA9rmUM0ce62NlPhCvof1+9ivRaTY6pSKDaA==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   lightningcss-win32-arm64-msvc@1.31.1:
     resolution: {integrity: sha512-aJReEbSEQzx1uBlQizAOBSjcmr9dCdL3XuC/6HLXAxmtErsj2ICo5yYggg1qOODQMtnjNQv2UHb9NpOuFtYe4w==}
@@ -1875,7 +1893,7 @@ snapshots:
 
   asynckit@0.4.0: {}
 
-  axios@1.15.2:
+  axios@1.16.0:
     dependencies:
       follow-redirects: 1.16.0
       form-data: 4.0.5
@@ -1988,7 +2006,7 @@ snapshots:
 
   es-errors@1.3.0: {}
 
-  es-object-atoms@1.1.1:
+  es-object-atoms@1.1.2:
     dependencies:
       es-errors: 1.3.0
 
@@ -1997,7 +2015,7 @@ snapshots:
       es-errors: 1.3.0
       get-intrinsic: 1.3.0
       has-tostringtag: 1.0.2
-      hasown: 2.0.3
+      hasown: 2.0.4
 
   escalade@3.2.0: {}
 
@@ -2046,7 +2064,7 @@ snapshots:
       asynckit: 0.4.0
       combined-stream: 1.0.8
       es-set-tostringtag: 2.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       mime-types: 2.1.35
 
   fsevents@2.3.3:
@@ -2063,18 +2081,18 @@ snapshots:
       call-bind-apply-helpers: 1.0.2
       es-define-property: 1.0.1
       es-errors: 1.3.0
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
       function-bind: 1.1.2
       get-proto: 1.0.1
       gopd: 1.2.0
       has-symbols: 1.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       math-intrinsics: 1.1.0
 
   get-proto@1.0.1:
     dependencies:
       dunder-proto: 1.0.1
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
 
   glob-parent@5.1.2:
     dependencies:
@@ -2117,7 +2135,7 @@ snapshots:
     dependencies:
       hookified: 1.15.1
 
-  hasown@2.0.3:
+  hasown@2.0.4:
     dependencies:
       function-bind: 1.1.2
 
diff --git a/PROJECTS/advanced/api-rate-limiter/README.md b/PROJECTS/advanced/api-rate-limiter/README.md
index 4c9e49c4..a56ef59b 100644
--- a/PROJECTS/advanced/api-rate-limiter/README.md
+++ b/PROJECTS/advanced/api-rate-limiter/README.md
@@ -15,7 +15,20 @@
 
 > Enterprise rate limiting for FastAPI using HTTP 420 "Enhance Your Calm".
 
-*This is a quick overview — security theory, architecture, and full walkthroughs are in the [learn modules](#learn).*
+<p align="center">
+  <a href="https://youtu.be/mIeVcpwWP2Q">
+    <img src="https://img.shields.io/badge/Watch_on-YouTube-FF0000?logo=youtube&logoColor=white" alt="Watch on YouTube">
+  </a>
+</p>
+
+<p align="center">
+  <a href="https://youtu.be/mIeVcpwWP2Q">
+    <img src="https://img.youtube.com/vi/mIeVcpwWP2Q/maxresdefault.jpg" alt="Video Thumbnail" width="800">
+  </a>
+</p>
+
+
+*Learning Docs are here: [learn modules](#learn).*
 
 ## What It Does
 
diff --git a/PROJECTS/advanced/api-rate-limiter/uv.lock b/PROJECTS/advanced/api-rate-limiter/uv.lock
index c40b5063..855d874e 100644
--- a/PROJECTS/advanced/api-rate-limiter/uv.lock
+++ b/PROJECTS/advanced/api-rate-limiter/uv.lock
@@ -501,11 +501,11 @@ wheels = [
 
 [[package]]
 name = "idna"
-version = "3.11"
+version = "3.15"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/0703ccc57f3a7233505399edb88de3cbd678da106337b9fcde432b65ed60/idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902", size = 194582, upload-time = "2025-10-12T14:55:20.501Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/82/77/7b3966d0b9d1d31a36ddf1746926a11dface89a83409bf1483f0237aa758/idna-3.15.tar.gz", hash = "sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc", size = 199245, upload-time = "2026-05-12T22:45:57.011Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/23/408243171aa9aaba178d3e2559159c24c1171a641aa83b67bdd3394ead8e/idna-3.15-py3-none-any.whl", hash = "sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8", size = 72340, upload-time = "2026-05-12T22:45:55.733Z" },
 ]
 
 [[package]]
@@ -1114,14 +1114,14 @@ wheels = [
 
 [[package]]
 name = "starlette"
-version = "0.52.1"
+version = "1.0.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/c4/68/79977123bb7be889ad680d79a40f339082c1978b5cfcf62c2d8d196873ac/starlette-0.52.1.tar.gz", hash = "sha256:834edd1b0a23167694292e94f597773bc3f89f362be6effee198165a35d62933", size = 2653702, upload-time = "2026-01-18T13:34:11.062Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/08/a3/84e821cc54b4ab50ae6dbc6ac3800a651b65ec35f045cc73785380654057/starlette-1.0.1.tar.gz", hash = "sha256:512399c5f1de7fac99c88572212ded9ddeddef2fb32afa82d724000e88b38f4f", size = 2659596, upload-time = "2026-05-21T21:58:58.433Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/81/0d/13d1d239a25cbfb19e740db83143e95c772a1fe10202dda4b76792b114dd/starlette-0.52.1-py3-none-any.whl", hash = "sha256:0029d43eb3d273bc4f83a08720b4912ea4b071087a3b48db01b7c839f7954d74", size = 74272, upload-time = "2026-01-18T13:34:09.188Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/e1/b2df4bc09a1e51ff664c1e17018a4274b42e5e9352e4a478ea540512dc88/starlette-1.0.1-py3-none-any.whl", hash = "sha256:7c0e69b2ee1c848bd54669d908500117a3ee13de603a21427e5c6fc1adf98dcd", size = 72802, upload-time = "2026-05-21T21:58:56.551Z" },
 ]
 
 [[package]]
diff --git a/PROJECTS/advanced/bug-bounty-platform/backend/uv.lock b/PROJECTS/advanced/bug-bounty-platform/backend/uv.lock
index 840da65b..41af02b1 100644
--- a/PROJECTS/advanced/bug-bounty-platform/backend/uv.lock
+++ b/PROJECTS/advanced/bug-bounty-platform/backend/uv.lock
@@ -517,23 +517,25 @@ wheels = [
 
 [[package]]
 name = "fastapi"
-version = "0.128.0"
+version = "0.136.3"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "annotated-doc" },
     { name = "pydantic" },
     { name = "starlette" },
     { name = "typing-extensions" },
+    { name = "typing-inspection" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/52/08/8c8508db6c7b9aae8f7175046af41baad690771c9bcde676419965e338c7/fastapi-0.128.0.tar.gz", hash = "sha256:1cc179e1cef10a6be60ffe429f79b829dce99d8de32d7acb7e6c8dfdf7f2645a", size = 365682, upload-time = "2025-12-27T15:21:13.714Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/81/2d/ff8d91d7b564d464629a0fd50a4489c97fcb836ac230bf3a7269232a9b1f/fastapi-0.136.3.tar.gz", hash = "sha256:e487fae93ad408e6f47641ee4dfe389864fd7bec92e547ea8498fc13f43e83ab", size = 396410, upload-time = "2026-05-23T18:53:15.192Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/5c/05/5cbb59154b093548acd0f4c7c474a118eda06da25aa75c616b72d8fcd92a/fastapi-0.128.0-py3-none-any.whl", hash = "sha256:aebd93f9716ee3b4f4fcfe13ffb7cf308d99c9f3ab5622d8877441072561582d", size = 103094, upload-time = "2025-12-27T15:21:12.154Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/82/45359b62a067409bd929ae8a56b8ed13e5a8c8a61194b3c236920999ab83/fastapi-0.136.3-py3-none-any.whl", hash = "sha256:3d2a69bdf04b7e9f3afa292c3bc7a98816bbfafa10bc9b45f3f3700d2f761620", size = 117481, upload-time = "2026-05-23T18:53:16.924Z" },
 ]
 
 [package.optional-dependencies]
 standard = [
     { name = "email-validator" },
     { name = "fastapi-cli", extra = ["standard"] },
+    { name = "fastar" },
     { name = "httpx" },
     { name = "jinja2" },
     { name = "pydantic-extra-types" },
@@ -583,70 +585,74 @@ wheels = [
 
 [[package]]
 name = "fastar"
-version = "0.8.0"
+version = "0.11.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/69/e7/f89d54fb04104114dd0552836dc2b47914f416cc0e200b409dd04a33de5e/fastar-0.8.0.tar.gz", hash = "sha256:f4d4d68dbf1c4c2808f0e730fac5843493fc849f70fe3ad3af60dfbaf68b9a12", size = 68524, upload-time = "2025-11-26T02:36:00.72Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/03/0f/0aeb3fc50046617702acc0078b277b58367fd62eb727b9ec733ae0e8bbcc/fastar-0.11.0.tar.gz", hash = "sha256:aa7f100f7313c03fdb20f1385927ba95671071ba308ad0c1763fef295e1895ce", size = 70238, upload-time = "2026-04-13T17:11:17.143Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/58/f1/5b2ff898abac7f1a418284aad285e3a4f68d189c572ab2db0f6c9079dd16/fastar-0.8.0-cp312-cp312-macosx_10_12_x86_64.whl", hash = "sha256:0f10d2adfe40f47ff228f4efaa32d409d732ded98580e03ed37c9535b5fc923d", size = 706369, upload-time = "2025-11-26T02:34:37.783Z" },
-    { url = "https://files.pythonhosted.org/packages/23/60/8046a386dca39154f80c927cbbeeb4b1c1267a3271bffe61552eb9995757/fastar-0.8.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:b930da9d598e3bc69513d131f397e6d6be4643926ef3de5d33d1e826631eb036", size = 629097, upload-time = "2025-11-26T02:34:21.888Z" },
-    { url = "https://files.pythonhosted.org/packages/22/7e/1ae005addc789924a9268da2394d3bb5c6f96836f7e37b7e3d23c2362675/fastar-0.8.0-cp312-cp312-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:9d210da2de733ca801de83e931012349d209f38b92d9630ccaa94bd445bdc9b8", size = 868938, upload-time = "2025-11-26T02:33:51.119Z" },
-    { url = "https://files.pythonhosted.org/packages/a6/77/290a892b073b84bf82e6b2259708dfe79c54f356e252c2dd40180b16fe07/fastar-0.8.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:aa02270721517078a5bd61a38719070ac2537a4aa6b6c48cf369cf2abc59174a", size = 765204, upload-time = "2025-11-26T02:32:47.02Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/00/c3155171b976003af3281f5258189f1935b15d1221bfc7467b478c631216/fastar-0.8.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:83c391e5b789a720e4d0029b9559f5d6dee3226693c5b39c0eab8eaece997e0f", size = 764717, upload-time = "2025-11-26T02:33:02.453Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/43/405b7ad76207b2c11b7b59335b70eac19e4a2653977f5588a1ac8fed54f4/fastar-0.8.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3258d7a78a72793cdd081545da61cabe85b1f37634a1d0b97ffee0ff11d105ef", size = 931502, upload-time = "2025-11-26T02:33:18.619Z" },
-    { url = "https://files.pythonhosted.org/packages/da/8a/a3dde6d37cc3da4453f2845cdf16675b5686b73b164f37e2cc579b057c2c/fastar-0.8.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e6eab95dd985cdb6a50666cbeb9e4814676e59cfe52039c880b69d67cfd44767", size = 821454, upload-time = "2025-11-26T02:33:33.427Z" },
-    { url = "https://files.pythonhosted.org/packages/da/c1/904fe2468609c8990dce9fe654df3fbc7324a8d8e80d8240ae2c89757064/fastar-0.8.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:829b1854166141860887273c116c94e31357213fa8e9fe8baeb18bd6c38aa8d9", size = 821647, upload-time = "2025-11-26T02:34:07Z" },
-    { url = "https://files.pythonhosted.org/packages/c8/73/a0642ab7a400bc07528091785e868ace598fde06fcd139b8f865ec1b6f3c/fastar-0.8.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:b1667eae13f9457a3c737f4376d68e8c3e548353538b28f7e4273a30cb3965cd", size = 986342, upload-time = "2025-11-26T02:34:53.371Z" },
-    { url = "https://files.pythonhosted.org/packages/af/af/60c1bfa6edab72366461a95f053d0f5f7ab1825fe65ca2ca367432cd8629/fastar-0.8.0-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:b864a95229a7db0814cd9ef7987cb713fd43dce1b0d809dd17d9cd6f02fdde3e", size = 1040207, upload-time = "2025-11-26T02:35:10.65Z" },
-    { url = "https://files.pythonhosted.org/packages/f6/a0/0d624290dec622e7fa084b6881f456809f68777d54a314f5dde932714506/fastar-0.8.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:c05fbc5618ce17675a42576fa49858d79734627f0a0c74c0875ab45ee8de340c", size = 1045031, upload-time = "2025-11-26T02:35:28.108Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/74/cf663af53c4706ba88e6b4af44a6b0c3bd7d7ca09f079dc40647a8f06585/fastar-0.8.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:7f41c51ee96f338662ee3c3df4840511ba3f9969606840f1b10b7cb633a3c716", size = 994877, upload-time = "2025-11-26T02:35:45.797Z" },
-    { url = "https://files.pythonhosted.org/packages/52/17/444c8be6e77206050e350da7c338102b6cab384be937fa0b1d6d1f9ede73/fastar-0.8.0-cp312-cp312-win32.whl", hash = "sha256:d949a1a2ea7968b734632c009df0571c94636a5e1622c87a6e2bf712a7334f47", size = 455996, upload-time = "2025-11-26T02:36:26.938Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/34/fc3b5e56d71a17b1904800003d9251716e8fd65f662e1b10a26881698a74/fastar-0.8.0-cp312-cp312-win_amd64.whl", hash = "sha256:fc645994d5b927d769121094e8a649b09923b3c13a8b0b98696d8f853f23c532", size = 490429, upload-time = "2025-11-26T02:36:12.707Z" },
-    { url = "https://files.pythonhosted.org/packages/35/a8/5608cc837417107c594e2e7be850b9365bcb05e99645966a5d6a156285fe/fastar-0.8.0-cp312-cp312-win_arm64.whl", hash = "sha256:d81ee82e8dc78a0adb81728383bd39611177d642a8fa2d601d4ad5ad59e5f3bd", size = 461297, upload-time = "2025-11-26T02:36:03.546Z" },
-    { url = "https://files.pythonhosted.org/packages/d1/a5/79ecba3646e22d03eef1a66fb7fc156567213e2e4ab9faab3bbd4489e483/fastar-0.8.0-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:a3253a06845462ca2196024c7a18f5c0ba4de1532ab1c4bad23a40b332a06a6a", size = 706112, upload-time = "2025-11-26T02:34:39.237Z" },
-    { url = "https://files.pythonhosted.org/packages/0a/03/4f883bce878218a8676c2d7ca09b50c856a5470bb3b7f63baf9521ea6995/fastar-0.8.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:5cbeb3ebfa0980c68ff8b126295cc6b208ccd81b638aebc5a723d810a7a0e5d2", size = 628954, upload-time = "2025-11-26T02:34:23.705Z" },
-    { url = "https://files.pythonhosted.org/packages/4f/f1/892e471f156b03d10ba48ace9384f5a896702a54506137462545f38e40b8/fastar-0.8.0-cp313-cp313-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:1c0d5956b917daac77d333d48b3f0f3ff927b8039d5b32d8125462782369f761", size = 868685, upload-time = "2025-11-26T02:33:53.077Z" },
-    { url = "https://files.pythonhosted.org/packages/39/ba/e24915045852e30014ec6840446975c03f4234d1c9270394b51d3ad18394/fastar-0.8.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:27b404db2b786b65912927ce7f3790964a4bcbde42cdd13091b82a89cd655e1c", size = 765044, upload-time = "2025-11-26T02:32:48.187Z" },
-    { url = "https://files.pythonhosted.org/packages/14/2c/1aa11ac21a99984864c2fca4994e094319ff3a2046e7a0343c39317bd5b9/fastar-0.8.0-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:0902fc89dcf1e7f07b8563032a4159fe2b835e4c16942c76fd63451d0e5f76a3", size = 764322, upload-time = "2025-11-26T02:33:03.859Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/f0/4b91902af39fe2d3bae7c85c6d789586b9fbcf618d7fdb3d37323915906d/fastar-0.8.0-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:069347e2f0f7a8b99bbac8cd1bc0e06c7b4a31dc964fc60d84b95eab3d869dc1", size = 931016, upload-time = "2025-11-26T02:33:19.902Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/97/8fc43a5a9c0a2dc195730f6f7a0f367d171282cd8be2511d0e87c6d2dad0/fastar-0.8.0-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:7fd135306f6bfe9a835918280e0eb440b70ab303e0187d90ab51ca86e143f70d", size = 821308, upload-time = "2025-11-26T02:33:34.664Z" },
-    { url = "https://files.pythonhosted.org/packages/0c/e9/058615b63a7fd27965e8c5966f393ed0c169f7ff5012e1674f21684de3ba/fastar-0.8.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:78d06d6897f43c27154b5f2d0eb930a43a81b7eec73f6f0b0114814d4a10ab38", size = 821171, upload-time = "2025-11-26T02:34:08.498Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/cf/69e16a17961570a755c37ffb5b5aa7610d2e77807625f537989da66f2a9d/fastar-0.8.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a922f8439231fa0c32b15e8d70ff6d415619b9d40492029dabbc14a0c53b5f18", size = 986227, upload-time = "2025-11-26T02:34:55.06Z" },
-    { url = "https://files.pythonhosted.org/packages/fb/83/2100192372e59b56f4ace37d7d9cabda511afd71b5febad1643d1c334271/fastar-0.8.0-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:a739abd51eb766384b4caff83050888e80cd75bbcfec61e6d1e64875f94e4a40", size = 1039395, upload-time = "2025-11-26T02:35:12.166Z" },
-    { url = "https://files.pythonhosted.org/packages/75/15/cdd03aca972f55872efbb7cf7540c3fa7b97a75d626303a3ea46932163dc/fastar-0.8.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:5a65f419d808b23ac89d5cd1b13a2f340f15bc5d1d9af79f39fdb77bba48ff1b", size = 1044766, upload-time = "2025-11-26T02:35:29.62Z" },
-    { url = "https://files.pythonhosted.org/packages/3d/29/945e69e4e2652329ace545999334ec31f1431fbae3abb0105587e11af2ae/fastar-0.8.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:7bb2ae6c0cce58f0db1c9f20495e7557cca2c1ee9c69bbd90eafd54f139171c5", size = 994740, upload-time = "2025-11-26T02:35:47.887Z" },
-    { url = "https://files.pythonhosted.org/packages/4b/5d/dbfe28f8cd1eb484bba0c62e5259b2cf6fea229d6ef43e05c06b5a78c034/fastar-0.8.0-cp313-cp313-win32.whl", hash = "sha256:b28753e0d18a643272597cb16d39f1053842aa43131ad3e260c03a2417d38401", size = 455990, upload-time = "2025-11-26T02:36:28.502Z" },
-    { url = "https://files.pythonhosted.org/packages/e1/01/e965740bd36e60ef4c5aa2cbe42b6c4eb1dc3551009238a97c2e5e96bd23/fastar-0.8.0-cp313-cp313-win_amd64.whl", hash = "sha256:620e5d737dce8321d49a5ebb7997f1fd0047cde3512082c27dc66d6ac8c1927a", size = 490227, upload-time = "2025-11-26T02:36:14.363Z" },
-    { url = "https://files.pythonhosted.org/packages/dd/10/c99202719b83e5249f26902ae53a05aea67d840eeb242019322f20fc171c/fastar-0.8.0-cp313-cp313-win_arm64.whl", hash = "sha256:c4c4bd08df563120cd33e854fe0a93b81579e8571b11f9b7da9e84c37da2d6b6", size = 461078, upload-time = "2025-11-26T02:36:04.94Z" },
-    { url = "https://files.pythonhosted.org/packages/96/4a/9573b87a0ef07580ed111e7230259aec31bb33ca3667963ebee77022ec61/fastar-0.8.0-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:50b36ce654ba44b0e13fae607ae17ee6e1597b69f71df1bee64bb8328d881dfc", size = 706041, upload-time = "2025-11-26T02:34:40.638Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/19/f95444a1d4f375333af49300aa75ee93afa3335c0e40fda528e460ed859c/fastar-0.8.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:63a892762683d7ab00df0227d5ea9677c62ff2cde9b875e666c0be569ed940f3", size = 628617, upload-time = "2025-11-26T02:34:24.893Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/c9/b51481b38b7e3f16ef2b9e233b1a3623386c939d745d6e41bbd389eaae30/fastar-0.8.0-cp314-cp314-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:4ae6a145c1bff592644bde13f2115e0239f4b7babaf506d14e7d208483cf01a5", size = 869299, upload-time = "2025-11-26T02:33:54.274Z" },
-    { url = "https://files.pythonhosted.org/packages/bf/02/3ba1267ee5ba7314e29c431cf82eaa68586f2c40cdfa08be3632b7d07619/fastar-0.8.0-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6ae0ff7c0a1c7e1428404b81faee8aebef466bfd0be25bfe4dabf5d535c68741", size = 764667, upload-time = "2025-11-26T02:32:49.606Z" },
-    { url = "https://files.pythonhosted.org/packages/1b/84/bf33530fd015b5d7c2cc69e0bce4a38d736754a6955487005aab1af6adcd/fastar-0.8.0-cp314-cp314-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:dbfd87dbd217b45c898b2dbcd0169aae534b2c1c5cbe3119510881f6a5ac8ef5", size = 763993, upload-time = "2025-11-26T02:33:05.782Z" },
-    { url = "https://files.pythonhosted.org/packages/da/e0/9564d24e7cea6321a8d921c6d2a457044a476ef197aa4708e179d3d97f0d/fastar-0.8.0-cp314-cp314-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:9a5abd99fcba83ef28c8fe6ae2927edc79053db43a0457a962ed85c9bf150d37", size = 930153, upload-time = "2025-11-26T02:33:21.53Z" },
-    { url = "https://files.pythonhosted.org/packages/35/b1/6f57fcd8d6e192cfebf97e58eb27751640ad93784c857b79039e84387b51/fastar-0.8.0-cp314-cp314-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:91d4c685620c3a9d6b5ae091dbabab4f98b20049b7ecc7976e19cc9016c0d5d6", size = 821177, upload-time = "2025-11-26T02:33:35.839Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/78/9e004ea9f3aa7466f5ddb6f9518780e1d2f0ed3ca55f093632982598bace/fastar-0.8.0-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f77c2f2cad76e9dc7b6701297adb1eba87d0485944b416fc2ccf5516c01219a3", size = 820652, upload-time = "2025-11-26T02:34:09.776Z" },
-    { url = "https://files.pythonhosted.org/packages/42/95/b604ed536544005c9f1aee7c4c74b00150db3d8d535cd8232dc20f947063/fastar-0.8.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:e7f07c4a3dada7757a8fc430a5b4a29e6ef696d2212747213f57086ffd970316", size = 985961, upload-time = "2025-11-26T02:34:56.401Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/7b/fa9d4d96a5d494bdb8699363bb9de8178c0c21a02e1d89cd6f913d127018/fastar-0.8.0-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:90c0c3fe55105c0aed8a83135dbdeb31e683455dbd326a1c48fa44c378b85616", size = 1039316, upload-time = "2025-11-26T02:35:13.807Z" },
-    { url = "https://files.pythonhosted.org/packages/4e/f9/8462789243bc3f33e8401378ec6d54de4e20cfa60c96a0e15e3e9d1389bb/fastar-0.8.0-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:fb9ee51e5bffe0dab3d3126d3a4fac8d8f7235cedcb4b8e74936087ce1c157f3", size = 1045028, upload-time = "2025-11-26T02:35:31.079Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/71/9abb128777e616127194b509e98fcda3db797d76288c1a8c23dd22afc14f/fastar-0.8.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:e380b1e8d30317f52406c43b11e98d11e1d68723bbd031e18049ea3497b59a6d", size = 994677, upload-time = "2025-11-26T02:35:49.391Z" },
-    { url = "https://files.pythonhosted.org/packages/de/c1/b81b3f194853d7ad232a67a1d768f5f51a016f165cfb56cb31b31bbc6177/fastar-0.8.0-cp314-cp314-win32.whl", hash = "sha256:1c4ffc06e9c4a8ca498c07e094670d8d8c0d25b17ca6465b9774da44ea997ab1", size = 456687, upload-time = "2025-11-26T02:36:30.205Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/87/9e0cd4768a98181d56f0cdbab2363404cc15deb93f4aad3b99cd2761bbaa/fastar-0.8.0-cp314-cp314-win_amd64.whl", hash = "sha256:5517a8ad4726267c57a3e0e2a44430b782e00b230bf51c55b5728e758bb3a692", size = 490578, upload-time = "2025-11-26T02:36:16.218Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/1e/580a76cf91847654f2ad6520e956e93218f778540975bc4190d363f709e2/fastar-0.8.0-cp314-cp314-win_arm64.whl", hash = "sha256:58030551046ff4a8616931e52a36c83545ff05996db5beb6e0cd2b7e748aa309", size = 461473, upload-time = "2025-11-26T02:36:06.373Z" },
-    { url = "https://files.pythonhosted.org/packages/58/4c/bdb5c6efe934f68708529c8c9d4055ebef5c4be370621966438f658b29bd/fastar-0.8.0-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:1e7d29b6bfecb29db126a08baf3c04a5ab667f6cea2b7067d3e623a67729c4a6", size = 705570, upload-time = "2025-11-26T02:34:42.01Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/78/f01ac7e71d5a37621bd13598a26e948a12b85ca8042f7ee1a0a8c9f59cda/fastar-0.8.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:05eb7b96940f9526b485f1d0b02393839f0f61cac4b1f60024984f8b326d2640", size = 627761, upload-time = "2025-11-26T02:34:26.152Z" },
-    { url = "https://files.pythonhosted.org/packages/06/45/6df0ecda86ea9d2e95053c1a655d153dee55fc121b6e13ea6d1e246a50b6/fastar-0.8.0-cp314-cp314t-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:619352d8ac011794e2345c462189dc02ba634750d23cd9d86a9267dd71b1f278", size = 869414, upload-time = "2025-11-26T02:33:55.618Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/72/486421f5a8c0c377cc82e7a50c8a8ea899a6ec2aa72bde8f09fb667a2dc8/fastar-0.8.0-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:74ebfecef3fe6d7a90355fac1402fd30636988332a1d33f3e80019a10782bb24", size = 763863, upload-time = "2025-11-26T02:32:51.051Z" },
-    { url = "https://files.pythonhosted.org/packages/d4/64/39f654dbb41a3867fb1f2c8081c014d8f1d32ea10585d84cacbef0b32995/fastar-0.8.0-cp314-cp314t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:2975aca5a639e26a3ab0d23b4b0628d6dd6d521146c3c11486d782be621a35aa", size = 763065, upload-time = "2025-11-26T02:33:07.274Z" },
-    { url = "https://files.pythonhosted.org/packages/4e/bd/c011a34fb3534c4c3301f7c87c4ffd7e47f6113c904c092ddc8a59a303ea/fastar-0.8.0-cp314-cp314t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:afc438eaed8ff0dcdd9308268be5cb38c1db7e94c3ccca7c498ca13a4a4535a3", size = 930530, upload-time = "2025-11-26T02:33:23.117Z" },
-    { url = "https://files.pythonhosted.org/packages/55/9d/aa6e887a7033c571b1064429222bbe09adc9a3c1e04f3d1788ba5838ebd5/fastar-0.8.0-cp314-cp314t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:6ced0a5399cc0a84a858ef0a31ca2d0c24d3bbec4bcda506a9192d8119f3590a", size = 820572, upload-time = "2025-11-26T02:33:37.542Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/9c/7a3a2278a1052e1a5d98646de7c095a00cffd2492b3b84ce730e2f1cd93a/fastar-0.8.0-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ec9b23da8c4c039da3fe2e358973c66976a0c8508aa06d6626b4403cb5666c19", size = 820649, upload-time = "2025-11-26T02:34:11.108Z" },
-    { url = "https://files.pythonhosted.org/packages/02/9e/d38edc1f4438cd047e56137c26d94783ffade42e1b3bde620ccf17b771ef/fastar-0.8.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:dfba078fcd53478032fd0ceed56960ec6b7ff0511cfc013a8a3a4307e3a7bac4", size = 985653, upload-time = "2025-11-26T02:34:57.884Z" },
-    { url = "https://files.pythonhosted.org/packages/69/d9/2147d0c19757e165cd62d41cec3f7b38fad2ad68ab784978b5f81716c7ea/fastar-0.8.0-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:ade56c94c14be356d295fecb47a3fcd473dd43a8803ead2e2b5b9e58feb6dcfa", size = 1038140, upload-time = "2025-11-26T02:35:15.778Z" },
-    { url = "https://files.pythonhosted.org/packages/7f/1d/ec4c717ffb8a308871e9602ec3197d957e238dc0227127ac573ec9bca952/fastar-0.8.0-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:e48d938f9366db5e59441728f70b7f6c1ccfab7eff84f96f9b7e689b07786c52", size = 1045195, upload-time = "2025-11-26T02:35:32.865Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/9f/637334dc8c8f3bb391388b064ae13f0ad9402bc5a6c3e77b8887d0c31921/fastar-0.8.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:79c441dc1482ff51a54fb3f57ae6f7bb3d2cff88fa2cc5d196c519f8aab64a56", size = 994686, upload-time = "2025-11-26T02:35:51.392Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/e2/dfa19a4b260b8ab3581b7484dcb80c09b25324f4daa6b6ae1c7640d1607a/fastar-0.8.0-cp314-cp314t-win32.whl", hash = "sha256:187f61dc739afe45ac8e47ed7fd1adc45d52eac110cf27d579155720507d6fbe", size = 455767, upload-time = "2025-11-26T02:36:34.758Z" },
-    { url = "https://files.pythonhosted.org/packages/51/47/df65c72afc1297797b255f90c4778b5d6f1f0f80282a134d5ab610310ed9/fastar-0.8.0-cp314-cp314t-win_amd64.whl", hash = "sha256:40e9d763cf8bf85ce2fa256e010aa795c0fe3d3bd1326d5c3084e6ce7857127e", size = 489971, upload-time = "2025-11-26T02:36:22.081Z" },
-    { url = "https://files.pythonhosted.org/packages/85/11/0aa8455af26f0ae89e42be67f3a874255ee5d7f0f026fc86e8d56f76b428/fastar-0.8.0-cp314-cp314t-win_arm64.whl", hash = "sha256:e59673307b6a08210987059a2bdea2614fe26e3335d0e5d1a3d95f49a05b1418", size = 460467, upload-time = "2025-11-26T02:36:07.978Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/06/a5773706afc8bd496769786590bbc56d2d0ee419a299cc12ea3f5717fcf3/fastar-0.11.0-cp312-cp312-macosx_10_12_x86_64.whl", hash = "sha256:3c51f1c2cdddbd1420d2897ace7738e36c65e17f6ae84e0bfe763f8d1068bb97", size = 708394, upload-time = "2026-04-13T17:09:57.269Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/a6/d5e2a4e48495616440a21eed07558219ca90243ad00b0502586f95bd4833/fastar-0.11.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:0d9d6b052baf5380baea866675dab6ccd04ec2460d12b1c46f10ce3f4ee6a820", size = 628417, upload-time = "2026-04-13T17:09:42.145Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/69/9816d69ac8265c9e50456637a487ccfb7a9c566efd9dbcd673df9c2558c2/fastar-0.11.0-cp312-cp312-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:bd2f05666d4df7e14885b5c38fefd92a785917387513d33d837ff42ec143a22f", size = 863950, upload-time = "2026-04-13T17:09:11.506Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/0d/f88daad53aff2e754b6b5ff2a7113f72447a34f6ef17cc23ca99988117b7/fastar-0.11.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c1e6e74aba1ae77ca4aedcaf1697cd413319f4c88a5ccbe5b42c709517c5097e", size = 760737, upload-time = "2026-04-13T17:07:55.958Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/a6/82ef4ecd969d50d92ed3ed9dbd8fe77faa24be5e5736f716edc9f4ce8d62/fastar-0.11.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:38ef77fe940bbc9b37a98bd838727f844b11731cd39358a2640ff864fb385086", size = 757603, upload-time = "2026-04-13T17:08:10.623Z" },
+    { url = "https://files.pythonhosted.org/packages/03/35/50249f0d827251f8ac511495e2eacccebda80a00a0ad73e9615b8113b84f/fastar-0.11.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:8955e61b32d6aff82c983217abf80933fd823b0e727586fc72f08043d996fd59", size = 923952, upload-time = "2026-04-13T17:08:25.526Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/d8/faee41659e9c379d906d24eaee6d6833ac8cfef0a5df480e5c2a8d3efb33/fastar-0.11.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:483532442cdb08fbff0169510224eae0836f2f672cea6aacb52847d90fefdc46", size = 816574, upload-time = "2026-04-13T17:08:56.076Z" },
+    { url = "https://files.pythonhosted.org/packages/22/47/0448ea7992b997dad2bf004bfd98eca74b5858630eae080b50c7b17d9ddc/fastar-0.11.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ef5a6071121e05d8287fc75bccb054bcbac8bb0501200a0c0a8feeace5303ea4", size = 819382, upload-time = "2026-04-13T17:09:26.66Z" },
+    { url = "https://files.pythonhosted.org/packages/33/ef/0d63eb43586831b7a6f8b22c4d77125a7c594423af1f4f090fa9541b9b40/fastar-0.11.0-cp312-cp312-manylinux_2_31_riscv64.whl", hash = "sha256:e45e598af5afe8412197d4786efd6cf29be02e7d3d4f6a3461149eae5d7e94f1", size = 885254, upload-time = "2026-04-13T17:08:40.9Z" },
+    { url = "https://files.pythonhosted.org/packages/01/25/edd584675d69e49a165052c3ee886df1c5d574f3e7d813c990306387c623/fastar-0.11.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:2e160919b1c47ddb8538e7e8eb4cd527281b40f0bf75110a75993838ef61f286", size = 971239, upload-time = "2026-04-13T17:10:12.997Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/37/e8bb24f506ba2b08fbaf36c5800e843bd4d542954e9331f00418e2d23349/fastar-0.11.0-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:4bb4dc0fc8f7a6807febcebce8a2f3626ba4955a9263d81ecc630aad83be84c0", size = 1035185, upload-time = "2026-04-13T17:10:30.207Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/bf/be753736296338149ee4cb3e92e2b5423d6ba17c7b951d15218fd7e99bbf/fastar-0.11.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:4ec95af56aa173f6e320e1183001bf108ba59beaf13edd1fc8200648db203588", size = 1072191, upload-time = "2026-04-13T17:10:47.072Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/cd/a81c1aaafb5a22ce57c98ae22f39c89413ed53e4ee6e1b1444b0bd666a6c/fastar-0.11.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:136cf342735464091c39dc3708168f9fdeb9ebea40b1ead937c61afaf46143d9", size = 1028054, upload-time = "2026-04-13T17:11:04.293Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/88/1ce4eed3d70627c95f49ca017f6bbbf2ddcc4b0c601d293259de7689bc20/fastar-0.11.0-cp312-cp312-win32.whl", hash = "sha256:35f23c11b556cc4d3704587faacbc0037f7bdf6c4525cd1d09c70bda4b1c6809", size = 454198, upload-time = "2026-04-13T17:11:45.168Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/1d/26ce92f4331cd61a69840db9ca6115829805eec24f285481a854f578e917/fastar-0.11.0-cp312-cp312-win_amd64.whl", hash = "sha256:920bc56c3c0b8a8ca492904941d1883c1c947c858cd93343356c29122a38f44c", size = 486697, upload-time = "2026-04-13T17:11:31.084Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/96/e6eda4480559c69b05d466e7b5ea9170e81fef3795a73e059959a3258319/fastar-0.11.0-cp312-cp312-win_arm64.whl", hash = "sha256:395248faf89e8a6bd5dc1fd544c8465113b627cb6d7c8b296796b60ebea33593", size = 462591, upload-time = "2026-04-13T17:11:20.577Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/d6/3be260037e86fb694e88d47f583bac3a0188c99cee1a6b257ac26cb6b53c/fastar-0.11.0-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:33f544b08b4541b678e53749b4552a44720d96761fb79c172b005b1089c443ed", size = 707975, upload-time = "2026-04-13T17:09:58.866Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/cd/7867aefb1784662554a335f2952c75a50f0c70585ed0d2210d6cc15e5627/fastar-0.11.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:91c1c792447e4a642745f347ff9847c52af39633071c57ee67ed53c157fc3506", size = 628460, upload-time = "2026-04-13T17:09:43.776Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/2b/d11d84bdd5e0e377771b955755771e3460b290da5809cb78c1b735ee2228/fastar-0.11.0-cp313-cp313-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:881247e6b6eaea59fc6569f9b61447aa6b9fc2ee864e048b4643d69c52745805", size = 863054, upload-time = "2026-04-13T17:09:13.048Z" },
+    { url = "https://files.pythonhosted.org/packages/25/39/d3f428b318fa940b1b6e785b8d54fc895dfb5d5b945ef8d5442ffa904fb2/fastar-0.11.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:863b7929845c9fec92ef6c8d59579cf46af5136655e5342f8df5cebe46cab06c", size = 760247, upload-time = "2026-04-13T17:07:57.396Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/04/03949aee82aabb8ede06ac5a4a5579ffaf98a8fe59ce958494508ff15513/fastar-0.11.0-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:96b4a57df12bf3211662627a3ea29d62ecb314a2434a0d0843f9fc23e47536e5", size = 756512, upload-time = "2026-04-13T17:08:12.415Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/0c/2ca1ae0a3828ca51047962d932b80daca2522db73e8cb9d040cb6ebe28d5/fastar-0.11.0-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ceef1c2c4df7b7b8ebd3f5d718bbf457b9bbdf25ce0bd07870211ec4fbd9aff4", size = 922183, upload-time = "2026-04-13T17:08:27.187Z" },
+    { url = "https://files.pythonhosted.org/packages/65/68/7fe808b1f73a68e686f25434f538c6dc10ef4dfb3db0ace22cd861744bf8/fastar-0.11.0-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:b8e545918441910a779659d4759ad0eef349e935fbdb4668a666d3681567eb05", size = 816394, upload-time = "2026-04-13T17:08:57.657Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/17/07d086080f8a83b8d7966955e29bcdbd6a060f5bd949dc9d5abd3658cead/fastar-0.11.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:28095bb8f821e85fc2764e1a55f03e5e2876dee2abe7cd0ee9420d929905d643", size = 818983, upload-time = "2026-04-13T17:09:28.46Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/e2/2c4edf0910af2e814ff6d65b77a91196d472ca8a9fb2033bd983f6856caa/fastar-0.11.0-cp313-cp313-manylinux_2_31_riscv64.whl", hash = "sha256:0fafb95ecbe70f666a5e9b35dd63974ccdc9bb3d99ccdbd4014a823ec3e659b5", size = 884689, upload-time = "2026-04-13T17:08:42.763Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/ba/04fdcbd6558e60de4ced3b55230fac47675d181252582b2fcec3c74608e5/fastar-0.11.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:af48fed039b94016629dcdad1c95c90c486326dd068de2b0a4df419ee09b6821", size = 970677, upload-time = "2026-04-13T17:10:15.124Z" },
+    { url = "https://files.pythonhosted.org/packages/df/b3/2b860a9658550167dbd5824c85e88d0b4b912bf493e42a6322544d6e483d/fastar-0.11.0-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:74cd96163f39b8638ab4e8d49708ca887959672a22871d8170d01f067319533b", size = 1034026, upload-time = "2026-04-13T17:10:32.318Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/9b/fa42ea1188b144bac4b1b60753dfd449974a4d5eda132029ee7711569f94/fastar-0.11.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:4e8b993cb5613bab495ed482810bedc0986633fcb9a3b55c37ec88e0d6714f6a", size = 1071147, upload-time = "2026-04-13T17:10:48.833Z" },
+    { url = "https://files.pythonhosted.org/packages/95/c8/d2e501556dca9f1fbc9246111a31792fb49ad908fa4927f34938a97a3604/fastar-0.11.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:dfe39d91fc28e37e06162d94afe01050220edb7df554acb5b702b5503e564816", size = 1028377, upload-time = "2026-04-13T17:11:06.374Z" },
+    { url = "https://files.pythonhosted.org/packages/db/33/5f11f23eca0a569cd052507bc45dda2e5468697f8665728d25be44120f7d/fastar-0.11.0-cp313-cp313-win32.whl", hash = "sha256:c5f63d4d99ff4bfb37c659982ec413358bdee747005348756cc50a04d412d989", size = 454089, upload-time = "2026-04-13T17:11:46.821Z" },
+    { url = "https://files.pythonhosted.org/packages/da/2f/35ff03c939cba7a255a9132367873fec6c355fd06a7f84fedcbaf4c8129f/fastar-0.11.0-cp313-cp313-win_amd64.whl", hash = "sha256:8690ed1928d31ded3ada308e1086525fb3871f5fa81e1b69601a3f7774004583", size = 486312, upload-time = "2026-04-13T17:11:32.86Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/71/ee9246cbfcbfd4144558f35e7e9a306ffe0a7564730a5188c45f21d2dab8/fastar-0.11.0-cp313-cp313-win_arm64.whl", hash = "sha256:d977ded9d98a0719a305e0a4d5ee811f1d3e856d853a50acb8ae833c3cd6d5d2", size = 461975, upload-time = "2026-04-13T17:11:22.589Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/cd/3644c48ecac456f928c12d47ec3bed36c36555b17c3859856f1ff860265d/fastar-0.11.0-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:71375bd6f03c2a43eb47bd949ea38ff45434917f9cdac79675c5b9f60de4fa73", size = 707860, upload-time = "2026-04-13T17:10:00.371Z" },
+    { url = "https://files.pythonhosted.org/packages/69/ca/dee04476ae3626b2b040a60ad84628f77e1ffd8444232f2426b0ca1e0d7e/fastar-0.11.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:eddfd9cab16e19ae247fe44bf992cb403ccfe27d3931d6de29a4695d95ad386c", size = 628216, upload-time = "2026-04-13T17:09:45.355Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/5e/9395c7353d079cb4f5be0f7982ce0dc9f2e7dec5fd175eef466729d6023a/fastar-0.11.0-cp314-cp314-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:7c371f1d4386c699018bb64eb2fa785feacf32785559049d2bb72fe4af023f53", size = 864378, upload-time = "2026-04-13T17:09:14.611Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/ba/1e4f67148223ff219612b6281a6000357abbcc2417964fa5c83f11d68fce/fastar-0.11.0-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cad7fa41e3e66554387481c1a09365e4638becd322904932674159d5f4046728", size = 760921, upload-time = "2026-04-13T17:07:59.138Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/82/09d11fb6d12f17993ffaf32ffd30c3c121a11e2966e84f19fb6f66430118/fastar-0.11.0-cp314-cp314-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:cf36652fa71b83761717c9899b98732498f8a2cb6327ff16bbf07f6be85c3437", size = 757012, upload-time = "2026-04-13T17:08:14.186Z" },
+    { url = "https://files.pythonhosted.org/packages/52/1f/5aeeacc4cb65615e2c9292cd9c5b0cd6fb6d2e6ee472ca6adc6c1b1b22ef/fastar-0.11.0-cp314-cp314-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f68ff8c17833053da4841720e95edde80ce45bb994b6b7d51418dddaac70ee47", size = 924510, upload-time = "2026-04-13T17:08:28.741Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/1a/1e5bdabbeaf2e856928956292609f2ff6a650f94480fb8afaca30229e483/fastar-0.11.0-cp314-cp314-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4563ed37a12ea1cdc398af8571258d24b988bf342b7b3bf5451bd5891243280c", size = 816602, upload-time = "2026-04-13T17:08:59.461Z" },
+    { url = "https://files.pythonhosted.org/packages/87/24/f960147910da3bed41a3adfcb026e17d5f50f4cf467a3324237a7088f61a/fastar-0.11.0-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cee63c9875cba3b70dc44338c560facc5d6e763047dcc4a30501f9a68cf5f890", size = 819452, upload-time = "2026-04-13T17:09:29.926Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/f4/3e77d7901d5707fd7f8a352e153c8ae09ea974e6fabad0b7c4eb9944b8d4/fastar-0.11.0-cp314-cp314-manylinux_2_31_riscv64.whl", hash = "sha256:bd76bfffae6d0a91f4ac4a612f721e7aec108db97dccdd120ae063cd66959f27", size = 885254, upload-time = "2026-04-13T17:08:44.285Z" },
+    { url = "https://files.pythonhosted.org/packages/47/01/1585edd5ec47782ae93cd94edf05828e0ab02ef00aec00aea4194a600464/fastar-0.11.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:8f5b707501ec01c1bc0518f741f01d322e50c9adc19a451aa24f67a2316e9397", size = 971496, upload-time = "2026-04-13T17:10:17.024Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/e9/6874c9d1236ded565a0bed54b320ac9f165f287b1d89490fb70f9f323c81/fastar-0.11.0-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:37c0b5a88a657839aad98b0a6c9e4ac4c2c15d6b49c44ee3935c6b08e9d3e479", size = 1034685, upload-time = "2026-04-13T17:10:34.063Z" },
+    { url = "https://files.pythonhosted.org/packages/14/d8/4ab20613ce2983427aee958e39be878dba874aa227c530a845e32429c4f6/fastar-0.11.0-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:6c55f536c62a6efb180c1af0d5182948bff576bbfe6276e8e1359c9c7d2215d8", size = 1072675, upload-time = "2026-04-13T17:10:50.53Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/ae/5ac3b7c20ce4b08f011dd2b979f96caabe64f9b10b157f211ea91bdfadca/fastar-0.11.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:3082eeca59e189b9039335862f4c2780c0c8871d656bfdf559db4414a105b251", size = 1029330, upload-time = "2026-04-13T17:11:08.138Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/e7/37cd6a1d4e288292170b64e19d79ecce2a7de8bb76790323399a2abc4619/fastar-0.11.0-cp314-cp314-win32.whl", hash = "sha256:b201a0a4e29f9fec2a177e13154b8725ec65ab9f83bd6415483efaa2aa18344b", size = 453940, upload-time = "2026-04-13T17:11:48.713Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/1c/795c878b1ee29d79021cf8ed81f18f2b25ccde58453b0d34b9bdc7e025ea/fastar-0.11.0-cp314-cp314-win_amd64.whl", hash = "sha256:868fddb26072a43e870a8819134b9f80ee602931be5a76e6fb873e04da343637", size = 486334, upload-time = "2026-04-13T17:11:34.882Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/a4/113f104301df8bddcc0b3775b611a30cb7610baa3add933c7ccac9386467/fastar-0.11.0-cp314-cp314-win_arm64.whl", hash = "sha256:3db39c9cc42abb0c780a26b299f24dfbc8be455985e969e15336d70d7b2f833b", size = 461534, upload-time = "2026-04-13T17:11:24.329Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/a6/5c5f2c2c8e0c63e56a5636ebc7721589c889e94c0092cec7eb28ae7207e6/fastar-0.11.0-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:49c3299dec5e125e7ebaa27545714da9c7391777366015427e0ae62d548b442b", size = 707156, upload-time = "2026-04-13T17:10:02.176Z" },
+    { url = "https://files.pythonhosted.org/packages/df/f7/982c01b61f0fc135ad2b16d01e6d0ee53cf8791e68827f5f7c5a65b2e5b1/fastar-0.11.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:3328ed1ed56d31f5198350b17dd60449b8d6b9d47abb4688bab6aef4450a165b", size = 627032, upload-time = "2026-04-13T17:09:46.978Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/c3/38f1dac77ae0c71c37b176277c96d830796b8ce2fe69705f917829b53829/fastar-0.11.0-cp314-cp314t-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:bd3eca3bbfec84a614bcb4143b4ad4f784d0895babc26cfc88436af88ca23c7a", size = 864403, upload-time = "2026-04-13T17:09:16.58Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/f0/e69c363bdb3e5a5848e937b662b5469581ee6682c51bc1c0556494773929/fastar-0.11.0-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ff86a967acb0d621dd24063dda090daa67bf4993b9570e97fe156de88a9006ca", size = 759480, upload-time = "2026-04-13T17:08:00.599Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/29/4d8737590c2a6357d614d7cc7288e8f68e7e449680b8922997cc4349e65e/fastar-0.11.0-cp314-cp314t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:86eaf7c0e985d93a7734168be2fb232b2a8cca53e41431c2782d7c12b12c03b1", size = 756219, upload-time = "2026-04-13T17:08:15.699Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/ec/400de7b3b7d48801908f19cf5462177104395799472671b3e8152b2b04ca/fastar-0.11.0-cp314-cp314t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:91f07b0b8eb67e2f177733a1f884edad7dfb9f8977ffef15927b20cb9604027d", size = 923669, upload-time = "2026-04-13T17:08:30.574Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/01/8926c53da923fed7ab4b96e7fbf7f73b663beb4f02095b654d6fab46f9ad/fastar-0.11.0-cp314-cp314t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f85c896885eb4abf1a635d54dea22cac6ae48d04fc2ea26ae652fcf1febe1220", size = 815729, upload-time = "2026-04-13T17:09:01.204Z" },
+    { url = "https://files.pythonhosted.org/packages/89/f0/5fef4c7946e352651b504b1a4235dac3505e7cfd24020788ab50552e84bf/fastar-0.11.0-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:075c07095c8de4b774ba8f28b9c0a02b1a2cd254da50cbe464dd3bb2432e9158", size = 819812, upload-time = "2026-04-13T17:09:31.907Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/c8/0ebc3298b4a45e7bddc50b169ae6a6f5b80c939394d4befe6e60de535ee7/fastar-0.11.0-cp314-cp314t-manylinux_2_31_riscv64.whl", hash = "sha256:07f028933820c65750baf3383b807ecce1cd9385cf00ce192b79d263ad6b856c", size = 884074, upload-time = "2026-04-13T17:08:45.802Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/9f/7baa4cdff8d6fbca41fa5c764b48a941fed8a9ec6c4cc92de65895a28299/fastar-0.11.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:039f875efa0f01fa43c20bf4e2fc7305489c61d0ac76eda991acfba7820a0e63", size = 969450, upload-time = "2026-04-13T17:10:18.667Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/dc/1ebbfb58a47056ba866494f19efbcdd2ba2897096b94f36e796594b4d05b/fastar-0.11.0-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:fff12452a9a5c6814a012445f26365541cc3d99dcca61f09762e6a389f7a32ea", size = 1033775, upload-time = "2026-04-13T17:10:36.165Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/5f/ce4e3914066f08c99eb8c32952cc07c1a013e81b1db1b0f598130bf6b974/fastar-0.11.0-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:2bf733e09f942b6fa876efe30a90508d1f4caef5630c00fb2a84fba355873712", size = 1072158, upload-time = "2026-04-13T17:10:52.497Z" },
+    { url = "https://files.pythonhosted.org/packages/03/2a/6bca72992c84151c387cc6558f3867f5ebe5fb3684ee6fa9b76280ba4b8e/fastar-0.11.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:d1531fa848fdd3677d2dce0a4b436ea64d9ae38fb8babe2ddbc180dd153cb7a3", size = 1028577, upload-time = "2026-04-13T17:11:09.934Z" },
+    { url = "https://files.pythonhosted.org/packages/83/18/7a7c15657a3da5569b26fc51cde6a80f8d84cb54b3b1aea6d74a103db4ad/fastar-0.11.0-cp314-cp314t-win32.whl", hash = "sha256:5744551bc67c6fc6581cbd0e34a0fd6e2cd0bd30b43e94b1c3119cf35064b162", size = 453601, upload-time = "2026-04-13T17:11:53.726Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/d8/331b59a6de279f3ad75c10c02c40a12f21d64a437d9c3d6f1af2dcbd7a76/fastar-0.11.0-cp314-cp314t-win_amd64.whl", hash = "sha256:f4ce44e3b56c47cf38244b98d29f269b259740a580c47a2552efa5b96a5458fb", size = 486436, upload-time = "2026-04-13T17:11:40.089Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/fd/5390ec4f49100f3ecb9968a392f9e6d039f1e3fe0ecd28443716ff01e589/fastar-0.11.0-cp314-cp314t-win_arm64.whl", hash = "sha256:76c1359314355eafbc6989f20fb1ad565a3d10200117923b9da765a17e2f6f11", size = 461049, upload-time = "2026-04-13T17:11:25.918Z" },
 ]
 
 [[package]]
@@ -782,11 +788,11 @@ wheels = [
 
 [[package]]
 name = "idna"
-version = "3.11"
+version = "3.15"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/0703ccc57f3a7233505399edb88de3cbd678da106337b9fcde432b65ed60/idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902", size = 194582, upload-time = "2025-10-12T14:55:20.501Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/82/77/7b3966d0b9d1d31a36ddf1746926a11dface89a83409bf1483f0237aa758/idna-3.15.tar.gz", hash = "sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc", size = 199245, upload-time = "2026-05-12T22:45:57.011Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/23/408243171aa9aaba178d3e2559159c24c1171a641aa83b67bdd3394ead8e/idna-3.15-py3-none-any.whl", hash = "sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8", size = 72340, upload-time = "2026-05-12T22:45:55.733Z" },
 ]
 
 [[package]]
@@ -1665,15 +1671,15 @@ wheels = [
 
 [[package]]
 name = "starlette"
-version = "0.50.0"
+version = "1.0.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
     { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/ba/b8/73a0e6a6e079a9d9cfa64113d771e421640b6f679a52eeb9b32f72d871a1/starlette-0.50.0.tar.gz", hash = "sha256:a2a17b22203254bcbc2e1f926d2d55f3f9497f769416b3190768befe598fa3ca", size = 2646985, upload-time = "2025-11-01T15:25:27.516Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/08/a3/84e821cc54b4ab50ae6dbc6ac3800a651b65ec35f045cc73785380654057/starlette-1.0.1.tar.gz", hash = "sha256:512399c5f1de7fac99c88572212ded9ddeddef2fb32afa82d724000e88b38f4f", size = 2659596, upload-time = "2026-05-21T21:58:58.433Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/d9/52/1064f510b141bd54025f9b55105e26d1fa970b9be67ad766380a3c9b74b0/starlette-0.50.0-py3-none-any.whl", hash = "sha256:9e5391843ec9b6e472eed1365a78c8098cfceb7a74bfd4d6b1c0c0095efb3bca", size = 74033, upload-time = "2025-11-01T15:25:25.461Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/e1/b2df4bc09a1e51ff664c1e17018a4274b42e5e9352e4a478ea540512dc88/starlette-1.0.1-py3-none-any.whl", hash = "sha256:7c0e69b2ee1c848bd54669d908500117a3ee13de603a21427e5c6fc1adf98dcd", size = 72802, upload-time = "2026-05-21T21:58:56.551Z" },
 ]
 
 [[package]]
diff --git a/PROJECTS/advanced/bug-bounty-platform/frontend/package.json b/PROJECTS/advanced/bug-bounty-platform/frontend/package.json
index 732c2ec6..3caabf5d 100644
--- a/PROJECTS/advanced/bug-bounty-platform/frontend/package.json
+++ b/PROJECTS/advanced/bug-bounty-platform/frontend/package.json
@@ -16,7 +16,7 @@
   },
   "dependencies": {
     "@tanstack/react-query": "^5.90.12",
-    "axios": "^1.15.2",
+    "axios": "^1.16.0",
     "react": "^19.2.1",
     "react-dom": "^19.2.0",
     "react-error-boundary": "^6.0.0",
diff --git a/PROJECTS/advanced/bug-bounty-platform/frontend/pnpm-lock.yaml b/PROJECTS/advanced/bug-bounty-platform/frontend/pnpm-lock.yaml
index c781f85e..734bb5ae 100644
--- a/PROJECTS/advanced/bug-bounty-platform/frontend/pnpm-lock.yaml
+++ b/PROJECTS/advanced/bug-bounty-platform/frontend/pnpm-lock.yaml
@@ -15,8 +15,8 @@ importers:
         specifier: ^5.90.12
         version: 5.90.16(react@19.2.3)
       axios:
-        specifier: ^1.15.2
-        version: 1.15.2
+        specifier: ^1.16.0
+        version: 1.16.0
       react:
         specifier: ^19.2.1
         version: 19.2.3
@@ -192,24 +192,28 @@ packages:
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@biomejs/cli-linux-arm64@2.4.2':
     resolution: {integrity: sha512-DI3Mi7GT2zYNgUTDEbSjl3e1KhoP76OjQdm8JpvZYZWtVDRyLd3w8llSr2TWk1z+U3P44kUBWY3X7H9MD1/DGQ==}
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@biomejs/cli-linux-x64-musl@2.4.2':
     resolution: {integrity: sha512-wbBmTkeAoAYbOQ33f6sfKG7pcRSydQiF+dTYOBjJsnXO2mWEOQHllKlC2YVnedqZFERp2WZhFUoO7TNRwnwEHQ==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@biomejs/cli-linux-x64@2.4.2':
     resolution: {integrity: sha512-GK2ErnrKpWFigYP68cXiCHK4RTL4IUWhK92AFS3U28X/nuAL5+hTuy6hyobc8JZRSt+upXt1nXChK+tuHHx4mA==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@biomejs/cli-win32-arm64@2.4.2':
     resolution: {integrity: sha512-k2uqwLYrNNxnaoiW3RJxoMGnbKda8FuCmtYG3cOtVljs3CzWxaTR+AoXwKGHscC9thax9R4kOrtWqWN0+KdPTw==}
@@ -344,36 +348,42 @@ packages:
     engines: {node: '>= 10.0.0'}
     cpu: [arm]
     os: [linux]
+    libc: [glibc]
 
   '@parcel/watcher-linux-arm-musl@2.5.1':
     resolution: {integrity: sha512-6E+m/Mm1t1yhB8X412stiKFG3XykmgdIOqhjWj+VL8oHkKABfu/gjFj8DvLrYVHSBNC+/u5PeNrujiSQ1zwd1Q==}
     engines: {node: '>= 10.0.0'}
     cpu: [arm]
     os: [linux]
+    libc: [musl]
 
   '@parcel/watcher-linux-arm64-glibc@2.5.1':
     resolution: {integrity: sha512-LrGp+f02yU3BN9A+DGuY3v3bmnFUggAITBGriZHUREfNEzZh/GO06FF5u2kx8x+GBEUYfyTGamol4j3m9ANe8w==}
     engines: {node: '>= 10.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@parcel/watcher-linux-arm64-musl@2.5.1':
     resolution: {integrity: sha512-cFOjABi92pMYRXS7AcQv9/M1YuKRw8SZniCDw0ssQb/noPkRzA+HBDkwmyOJYp5wXcsTrhxO0zq1U11cK9jsFg==}
     engines: {node: '>= 10.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@parcel/watcher-linux-x64-glibc@2.5.1':
     resolution: {integrity: sha512-GcESn8NZySmfwlTsIur+49yDqSny2IhPeZfXunQi48DMugKeZ7uy1FX83pO0X22sHntJ4Ub+9k34XQCX+oHt2A==}
     engines: {node: '>= 10.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@parcel/watcher-linux-x64-musl@2.5.1':
     resolution: {integrity: sha512-n0E2EQbatQ3bXhcH2D1XIAANAcTZkQICBPVaxMeaCVBtOpBZpWJuf7LwyWPSBDITb7In8mqQgJ7gH8CILCURXg==}
     engines: {node: '>= 10.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@parcel/watcher-win32-arm64@2.5.1':
     resolution: {integrity: sha512-RFzklRvmc3PkjKjry3hLF9wD7ppR4AKcWNzH7kXR7GUe0Igb3Nz8fyPwtZCSquGrhU5HhUNDr/mKBqj7tqA2Vw==}
@@ -432,24 +442,28 @@ packages:
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@rolldown/binding-linux-arm64-musl@1.0.0-beta.50':
     resolution: {integrity: sha512-L0zRdH2oDPkmB+wvuTl+dJbXCsx62SkqcEqdM+79LOcB+PxbAxxjzHU14BuZIQdXcAVDzfpMfaHWzZuwhhBTcw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@rolldown/binding-linux-x64-gnu@1.0.0-beta.50':
     resolution: {integrity: sha512-gyoI8o/TGpQd3OzkJnh1M2kxy1Bisg8qJ5Gci0sXm9yLFzEXIFdtc4EAzepxGvrT2ri99ar5rdsmNG0zP0SbIg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@rolldown/binding-linux-x64-musl@1.0.0-beta.50':
     resolution: {integrity: sha512-zti8A7M+xFDpKlghpcCAzyOi+e5nfUl3QhU023ce5NCgUxRG5zGP2GR9LTydQ1rnIPwZUVBWd4o7NjZDaQxaXA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@rolldown/binding-openharmony-arm64@1.0.0-beta.50':
     resolution: {integrity: sha512-eZUssog7qljrrRU9Mi0eqYEPm3Ch0UwB+qlWPMKSUXHNqhm3TvDZarJQdTevGEfu3EHAXJvBIe0YFYr0TPVaMA==}
@@ -560,8 +574,8 @@ packages:
   asynckit@0.4.0:
     resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
 
-  axios@1.15.2:
-    resolution: {integrity: sha512-wLrXxPtcrPTsNlJmKjkPnNPK2Ihe0hn0wGSaTEiHRPxwjvJwT3hKmXF4dpqxmPO9SoNb2FsYXj/xEo0gHN+D5A==}
+  axios@1.16.0:
+    resolution: {integrity: sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==}
 
   babel-runtime@5.8.38:
     resolution: {integrity: sha512-KpgoA8VE/pMmNCrnEeeXqFG24TIH11Z3ZaimIhJWsin8EbfZy3WzFKUTIan10ZIDgRVvi9EkLbruJElJC9dRlg==}
@@ -701,8 +715,8 @@ packages:
     resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
     engines: {node: '>= 0.4'}
 
-  es-object-atoms@1.1.1:
-    resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
+  es-object-atoms@1.1.2:
+    resolution: {integrity: sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==}
     engines: {node: '>= 0.4'}
 
   es-set-tostringtag@2.1.0:
@@ -827,8 +841,8 @@ packages:
     resolution: {integrity: sha512-Wn2i1In6XFxl8Az55kkgnFRiAlIAushzh26PTjL2AKtQcEfXrcLa7Hn5QOWGZEf3LU057P9TwwZjFyxfS1VuvQ==}
     engines: {node: '>=20'}
 
-  hasown@2.0.3:
-    resolution: {integrity: sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==}
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
     engines: {node: '>= 0.4'}
 
   hookified@1.15.0:
@@ -954,24 +968,28 @@ packages:
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   lightningcss-linux-arm64-musl@1.30.2:
     resolution: {integrity: sha512-5Vh9dGeblpTxWHpOx8iauV02popZDsCYMPIgiuw97OJ5uaDsL86cnqSFs5LZkG3ghHoX5isLgWzMs+eD1YzrnA==}
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   lightningcss-linux-x64-gnu@1.30.2:
     resolution: {integrity: sha512-Cfd46gdmj1vQ+lR6VRTTadNHu6ALuw2pKR9lYq4FnhvgBc4zWY1EtZcAc6EffShbb1MFrIPfLDXD6Xprbnni4w==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   lightningcss-linux-x64-musl@1.30.2:
     resolution: {integrity: sha512-XJaLUUFXb6/QG2lGIW6aIk6jKdtjtcffUT0NKvIqhSBY3hh9Ch+1LCeH80dR9q9LBjG3ewbDjnumefsLsP6aiA==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   lightningcss-win32-arm64-msvc@1.30.2:
     resolution: {integrity: sha512-FZn+vaj7zLv//D/192WFFVA0RgHawIcHqLX9xuWiQt7P0PtdFEVaxgF9rjM/IRYHQXNnk61/H/gb2Ei+kUQ4xQ==}
@@ -1857,7 +1875,7 @@ snapshots:
 
   asynckit@0.4.0: {}
 
-  axios@1.15.2:
+  axios@1.16.0:
     dependencies:
       follow-redirects: 1.16.0
       form-data: 4.0.5
@@ -1979,7 +1997,7 @@ snapshots:
 
   es-errors@1.3.0: {}
 
-  es-object-atoms@1.1.1:
+  es-object-atoms@1.1.2:
     dependencies:
       es-errors: 1.3.0
 
@@ -1988,7 +2006,7 @@ snapshots:
       es-errors: 1.3.0
       get-intrinsic: 1.3.0
       has-tostringtag: 1.0.2
-      hasown: 2.0.3
+      hasown: 2.0.4
 
   escalade@3.2.0: {}
 
@@ -2037,7 +2055,7 @@ snapshots:
       asynckit: 0.4.0
       combined-stream: 1.0.8
       es-set-tostringtag: 2.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       mime-types: 2.1.35
 
   fsevents@2.3.3:
@@ -2052,18 +2070,18 @@ snapshots:
       call-bind-apply-helpers: 1.0.2
       es-define-property: 1.0.1
       es-errors: 1.3.0
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
       function-bind: 1.1.2
       get-proto: 1.0.1
       gopd: 1.2.0
       has-symbols: 1.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       math-intrinsics: 1.1.0
 
   get-proto@1.0.1:
     dependencies:
       dunder-proto: 1.0.1
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
 
   glob-parent@5.1.2:
     dependencies:
@@ -2106,7 +2124,7 @@ snapshots:
     dependencies:
       hookified: 1.15.0
 
-  hasown@2.0.3:
+  hasown@2.0.4:
     dependencies:
       function-bind: 1.1.2
 
diff --git a/PROJECTS/advanced/encrypted-p2p-chat/backend/uv.lock b/PROJECTS/advanced/encrypted-p2p-chat/backend/uv.lock
index f36a879f..6645ce2d 100644
--- a/PROJECTS/advanced/encrypted-p2p-chat/backend/uv.lock
+++ b/PROJECTS/advanced/encrypted-p2p-chat/backend/uv.lock
@@ -13,7 +13,7 @@ wheels = [
 
 [[package]]
 name = "aiohttp"
-version = "3.13.4"
+version = "3.14.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiohappyeyeballs" },
@@ -24,59 +24,72 @@ dependencies = [
     { name = "propcache" },
     { name = "yarl" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/45/4a/064321452809dae953c1ed6e017504e72551a26b6f5708a5a80e4bf556ff/aiohttp-3.13.4.tar.gz", hash = "sha256:d97a6d09c66087890c2ab5d49069e1e570583f7ac0314ecf98294c1b6aaebd38", size = 7859748, upload-time = "2026-03-28T17:19:40.6Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ee/ab/93ce242f899b68c51b0578c027aafa791ab3614cb9345fa5d37b5f5c8e3e/aiohttp-3.14.0.tar.gz", hash = "sha256:2882de819734c715fd1b9c11c97e09fa020d14438203d1d354d8ed1702791c9b", size = 7940674, upload-time = "2026-06-01T19:41:02.763Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e3/ac/892f4162df9b115b4758d615f32ec63d00f3084c705ff5526630887b9b42/aiohttp-3.13.4-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:63dd5e5b1e43b8fb1e91b79b7ceba1feba588b317d1edff385084fcc7a0a4538", size = 745744, upload-time = "2026-03-28T17:16:44.67Z" },
-    { url = "https://files.pythonhosted.org/packages/97/a9/c5b87e4443a2f0ea88cb3000c93a8fdad1ee63bffc9ded8d8c8e0d66efc6/aiohttp-3.13.4-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:746ac3cc00b5baea424dacddea3ec2c2702f9590de27d837aa67004db1eebc6e", size = 498178, upload-time = "2026-03-28T17:16:46.766Z" },
-    { url = "https://files.pythonhosted.org/packages/94/42/07e1b543a61250783650df13da8ddcdc0d0a5538b2bd15cef6e042aefc61/aiohttp-3.13.4-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:bda8f16ea99d6a6705e5946732e48487a448be874e54a4f73d514660ff7c05d3", size = 498331, upload-time = "2026-03-28T17:16:48.9Z" },
-    { url = "https://files.pythonhosted.org/packages/20/d6/492f46bf0328534124772d0cf58570acae5b286ea25006900650f69dae0e/aiohttp-3.13.4-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4b061e7b5f840391e3f64d0ddf672973e45c4cfff7a0feea425ea24e51530fc2", size = 1744414, upload-time = "2026-03-28T17:16:50.968Z" },
-    { url = "https://files.pythonhosted.org/packages/e2/4d/e02627b2683f68051246215d2d62b2d2f249ff7a285e7a858dc47d6b6a14/aiohttp-3.13.4-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:b252e8d5cd66184b570d0d010de742736e8a4fab22c58299772b0c5a466d4b21", size = 1719226, upload-time = "2026-03-28T17:16:53.173Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/6c/5d0a3394dd2b9f9aeba6e1b6065d0439e4b75d41f1fb09a3ec010b43552b/aiohttp-3.13.4-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:20af8aad61d1803ff11152a26146d8d81c266aa8c5aa9b4504432abb965c36a0", size = 1782110, upload-time = "2026-03-28T17:16:55.362Z" },
-    { url = "https://files.pythonhosted.org/packages/0d/2d/c20791e3437700a7441a7edfb59731150322424f5aadf635602d1d326101/aiohttp-3.13.4-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:13a5cc924b59859ad2adb1478e31f410a7ed46e92a2a619d6d1dd1a63c1a855e", size = 1884809, upload-time = "2026-03-28T17:16:57.734Z" },
-    { url = "https://files.pythonhosted.org/packages/c8/94/d99dbfbd1924a87ef643833932eb2a3d9e5eee87656efea7d78058539eff/aiohttp-3.13.4-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:534913dfb0a644d537aebb4123e7d466d94e3be5549205e6a31f72368980a81a", size = 1764938, upload-time = "2026-03-28T17:17:00.221Z" },
-    { url = "https://files.pythonhosted.org/packages/49/61/3ce326a1538781deb89f6cf5e094e2029cd308ed1e21b2ba2278b08426f6/aiohttp-3.13.4-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:320e40192a2dcc1cf4b5576936e9652981ab596bf81eb309535db7e2f5b5672f", size = 1570697, upload-time = "2026-03-28T17:17:02.985Z" },
-    { url = "https://files.pythonhosted.org/packages/b6/77/4ab5a546857bb3028fbaf34d6eea180267bdab022ee8b1168b1fcde4bfdd/aiohttp-3.13.4-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:9e587fcfce2bcf06526a43cb705bdee21ac089096f2e271d75de9c339db3100c", size = 1702258, upload-time = "2026-03-28T17:17:05.28Z" },
-    { url = "https://files.pythonhosted.org/packages/79/63/d8f29021e39bc5af8e5d5e9da1b07976fb9846487a784e11e4f4eeda4666/aiohttp-3.13.4-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:9eb9c2eea7278206b5c6c1441fdd9dc420c278ead3f3b2cc87f9b693698cc500", size = 1740287, upload-time = "2026-03-28T17:17:07.712Z" },
-    { url = "https://files.pythonhosted.org/packages/55/3a/cbc6b3b124859a11bc8055d3682c26999b393531ef926754a3445b99dfef/aiohttp-3.13.4-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:29be00c51972b04bf9d5c8f2d7f7314f48f96070ca40a873a53056e652e805f7", size = 1753011, upload-time = "2026-03-28T17:17:10.053Z" },
-    { url = "https://files.pythonhosted.org/packages/e0/30/836278675205d58c1368b21520eab9572457cf19afd23759216c04483048/aiohttp-3.13.4-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:90c06228a6c3a7c9f776fe4fc0b7ff647fffd3bed93779a6913c804ae00c1073", size = 1566359, upload-time = "2026-03-28T17:17:12.433Z" },
-    { url = "https://files.pythonhosted.org/packages/50/b4/8032cc9b82d17e4277704ba30509eaccb39329dc18d6a35f05e424439e32/aiohttp-3.13.4-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:a533ec132f05fd9a1d959e7f34184cd7d5e8511584848dab85faefbaac573069", size = 1785537, upload-time = "2026-03-28T17:17:14.721Z" },
-    { url = "https://files.pythonhosted.org/packages/17/7d/5873e98230bde59f493bf1f7c3e327486a4b5653fa401144704df5d00211/aiohttp-3.13.4-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:1c946f10f413836f82ea4cfb90200d2a59578c549f00857e03111cf45ad01ca5", size = 1740752, upload-time = "2026-03-28T17:17:17.387Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/f2/13e46e0df051494d7d3c68b7f72d071f48c384c12716fc294f75d5b1a064/aiohttp-3.13.4-cp313-cp313-win32.whl", hash = "sha256:48708e2706106da6967eff5908c78ca3943f005ed6bcb75da2a7e4da94ef8c70", size = 433187, upload-time = "2026-03-28T17:17:19.523Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/c0/649856ee655a843c8f8664592cfccb73ac80ede6a8c8db33a25d810c12db/aiohttp-3.13.4-cp313-cp313-win_amd64.whl", hash = "sha256:74a2eb058da44fa3a877a49e2095b591d4913308bb424c418b77beb160c55ce3", size = 459778, upload-time = "2026-03-28T17:17:21.964Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/29/6657cc37ae04cacc2dbf53fb730a06b6091cc4cbe745028e047c53e6d840/aiohttp-3.13.4-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:e0a2c961fc92abeff61d6444f2ce6ad35bb982db9fc8ff8a47455beacf454a57", size = 749363, upload-time = "2026-03-28T17:17:24.044Z" },
-    { url = "https://files.pythonhosted.org/packages/90/7f/30ccdf67ca3d24b610067dc63d64dcb91e5d88e27667811640644aa4a85d/aiohttp-3.13.4-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:153274535985a0ff2bff1fb6c104ed547cec898a09213d21b0f791a44b14d933", size = 499317, upload-time = "2026-03-28T17:17:26.199Z" },
-    { url = "https://files.pythonhosted.org/packages/93/13/e372dd4e68ad04ee25dafb050c7f98b0d91ea643f7352757e87231102555/aiohttp-3.13.4-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:351f3171e2458da3d731ce83f9e6b9619e325c45cbd534c7759750cabf453ad7", size = 500477, upload-time = "2026-03-28T17:17:28.279Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/fe/ee6298e8e586096fb6f5eddd31393d8544f33ae0792c71ecbb4c2bef98ac/aiohttp-3.13.4-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f989ac8bc5595ff761a5ccd32bdb0768a117f36dd1504b1c2c074ed5d3f4df9c", size = 1737227, upload-time = "2026-03-28T17:17:30.587Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/b9/a7a0463a09e1a3fe35100f74324f23644bfc3383ac5fd5effe0722a5f0b7/aiohttp-3.13.4-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:d36fc1709110ec1e87a229b201dd3ddc32aa01e98e7868083a794609b081c349", size = 1694036, upload-time = "2026-03-28T17:17:33.29Z" },
-    { url = "https://files.pythonhosted.org/packages/57/7c/8972ae3fb7be00a91aee6b644b2a6a909aedb2c425269a3bfd90115e6f8f/aiohttp-3.13.4-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:42adaeea83cbdf069ab94f5103ce0787c21fb1a0153270da76b59d5578302329", size = 1786814, upload-time = "2026-03-28T17:17:36.035Z" },
-    { url = "https://files.pythonhosted.org/packages/93/01/c81e97e85c774decbaf0d577de7d848934e8166a3a14ad9f8aa5be329d28/aiohttp-3.13.4-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:92deb95469928cc41fd4b42a95d8012fa6df93f6b1c0a83af0ffbc4a5e218cde", size = 1866676, upload-time = "2026-03-28T17:17:38.441Z" },
-    { url = "https://files.pythonhosted.org/packages/5a/5f/5b46fe8694a639ddea2cd035bf5729e4677ea882cb251396637e2ef1590d/aiohttp-3.13.4-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0c0c7c07c4257ef3a1df355f840bc62d133bcdef5c1c5ba75add3c08553e2eed", size = 1740842, upload-time = "2026-03-28T17:17:40.783Z" },
-    { url = "https://files.pythonhosted.org/packages/20/a2/0d4b03d011cca6b6b0acba8433193c1e484efa8d705ea58295590fe24203/aiohttp-3.13.4-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f062c45de8a1098cb137a1898819796a2491aec4e637a06b03f149315dff4d8f", size = 1566508, upload-time = "2026-03-28T17:17:43.235Z" },
-    { url = "https://files.pythonhosted.org/packages/98/17/e689fd500da52488ec5f889effd6404dece6a59de301e380f3c64f167beb/aiohttp-3.13.4-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:76093107c531517001114f0ebdb4f46858ce818590363e3e99a4a2280334454a", size = 1700569, upload-time = "2026-03-28T17:17:46.165Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/0d/66402894dbcf470ef7db99449e436105ea862c24f7ea4c95c683e635af35/aiohttp-3.13.4-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:6f6ec32162d293b82f8b63a16edc80769662fbd5ae6fbd4936d3206a2c2cc63b", size = 1707407, upload-time = "2026-03-28T17:17:48.825Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/eb/af0ab1a3650092cbd8e14ef29e4ab0209e1460e1c299996c3f8288b3f1ff/aiohttp-3.13.4-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:5903e2db3d202a00ad9f0ec35a122c005e85d90c9836ab4cda628f01edf425e2", size = 1752214, upload-time = "2026-03-28T17:17:51.206Z" },
-    { url = "https://files.pythonhosted.org/packages/5a/bf/72326f8a98e4c666f292f03c385545963cc65e358835d2a7375037a97b57/aiohttp-3.13.4-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:2d5bea57be7aca98dbbac8da046d99b5557c5cf4e28538c4c786313078aca09e", size = 1562162, upload-time = "2026-03-28T17:17:53.634Z" },
-    { url = "https://files.pythonhosted.org/packages/67/9f/13b72435f99151dd9a5469c96b3b5f86aa29b7e785ca7f35cf5e538f74c0/aiohttp-3.13.4-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:bcf0c9902085976edc0232b75006ef38f89686901249ce14226b6877f88464fb", size = 1768904, upload-time = "2026-03-28T17:17:55.991Z" },
-    { url = "https://files.pythonhosted.org/packages/18/bc/28d4970e7d5452ac7776cdb5431a1164a0d9cf8bd2fffd67b4fb463aa56d/aiohttp-3.13.4-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:c3295f98bfeed2e867cab588f2a146a9db37a85e3ae9062abf46ba062bd29165", size = 1723378, upload-time = "2026-03-28T17:17:58.348Z" },
-    { url = "https://files.pythonhosted.org/packages/53/74/b32458ca1a7f34d65bdee7aef2036adbe0438123d3d53e2b083c453c24dd/aiohttp-3.13.4-cp314-cp314-win32.whl", hash = "sha256:a598a5c5767e1369d8f5b08695cab1d8160040f796c4416af76fd773d229b3c9", size = 438711, upload-time = "2026-03-28T17:18:00.728Z" },
-    { url = "https://files.pythonhosted.org/packages/40/b2/54b487316c2df3e03a8f3435e9636f8a81a42a69d942164830d193beb56a/aiohttp-3.13.4-cp314-cp314-win_amd64.whl", hash = "sha256:c555db4bc7a264bead5a7d63d92d41a1122fcd39cc62a4db815f45ad46f9c2c8", size = 464977, upload-time = "2026-03-28T17:18:03.367Z" },
-    { url = "https://files.pythonhosted.org/packages/47/fb/e41b63c6ce71b07a59243bb8f3b457ee0c3402a619acb9d2c0d21ef0e647/aiohttp-3.13.4-cp314-cp314t-macosx_10_13_universal2.whl", hash = "sha256:45abbbf09a129825d13c18c7d3182fecd46d9da3cfc383756145394013604ac1", size = 781549, upload-time = "2026-03-28T17:18:05.779Z" },
-    { url = "https://files.pythonhosted.org/packages/97/53/532b8d28df1e17e44c4d9a9368b78dcb6bf0b51037522136eced13afa9e8/aiohttp-3.13.4-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:74c80b2bc2c2adb7b3d1941b2b60701ee2af8296fc8aad8b8bc48bc25767266c", size = 514383, upload-time = "2026-03-28T17:18:08.096Z" },
-    { url = "https://files.pythonhosted.org/packages/1b/1f/62e5d400603e8468cd635812d99cb81cfdc08127a3dc474c647615f31339/aiohttp-3.13.4-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:c97989ae40a9746650fa196894f317dafc12227c808c774929dda0ff873a5954", size = 518304, upload-time = "2026-03-28T17:18:10.642Z" },
-    { url = "https://files.pythonhosted.org/packages/90/57/2326b37b10896447e3c6e0cbef4fe2486d30913639a5cfd1332b5d870f82/aiohttp-3.13.4-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:dae86be9811493f9990ef44fff1685f5c1a3192e9061a71a109d527944eed551", size = 1893433, upload-time = "2026-03-28T17:18:13.121Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/b4/a24d82112c304afdb650167ef2fe190957d81cbddac7460bedd245f765aa/aiohttp-3.13.4-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:1db491abe852ca2fa6cc48a3341985b0174b3741838e1341b82ac82c8bd9e871", size = 1755901, upload-time = "2026-03-28T17:18:16.21Z" },
-    { url = "https://files.pythonhosted.org/packages/9e/2d/0883ef9d878d7846287f036c162a951968f22aabeef3ac97b0bea6f76d5d/aiohttp-3.13.4-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:0e5d701c0aad02a7dce72eef6b93226cf3734330f1a31d69ebbf69f33b86666e", size = 1876093, upload-time = "2026-03-28T17:18:18.703Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/52/9204bb59c014869b71971addad6778f005daa72a96eed652c496789d7468/aiohttp-3.13.4-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:8ac32a189081ae0a10ba18993f10f338ec94341f0d5df8fff348043962f3c6f8", size = 1970815, upload-time = "2026-03-28T17:18:21.858Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/b5/e4eb20275a866dde0f570f411b36c6b48f7b53edfe4f4071aa1b0728098a/aiohttp-3.13.4-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:98e968cdaba43e45c73c3f306fca418c8009a957733bac85937c9f9cf3f4de27", size = 1816223, upload-time = "2026-03-28T17:18:24.729Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/23/e98075c5bb146aa61a1239ee1ac7714c85e814838d6cebbe37d3fe19214a/aiohttp-3.13.4-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:ca114790c9144c335d538852612d3e43ea0f075288f4849cf4b05d6cd2238ce7", size = 1649145, upload-time = "2026-03-28T17:18:27.269Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/c1/7bad8be33bb06c2bb224b6468874346026092762cbec388c3bdb65a368ee/aiohttp-3.13.4-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:ea2e071661ba9cfe11eabbc81ac5376eaeb3061f6e72ec4cc86d7cdd1ffbdbbb", size = 1816562, upload-time = "2026-03-28T17:18:29.847Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/10/c00323348695e9a5e316825969c88463dcc24c7e9d443244b8a2c9cf2eae/aiohttp-3.13.4-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:34e89912b6c20e0fd80e07fa401fd218a410aa1ce9f1c2f1dad6db1bd0ce0927", size = 1800333, upload-time = "2026-03-28T17:18:32.269Z" },
-    { url = "https://files.pythonhosted.org/packages/84/43/9b2147a1df3559f49bd723e22905b46a46c068a53adb54abdca32c4de180/aiohttp-3.13.4-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:0e217cf9f6a42908c52b46e42c568bd57adc39c9286ced31aaace614b6087965", size = 1820617, upload-time = "2026-03-28T17:18:35.238Z" },
-    { url = "https://files.pythonhosted.org/packages/a9/7f/b3481a81e7a586d02e99387b18c6dafff41285f6efd3daa2124c01f87eae/aiohttp-3.13.4-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:0c296f1221e21ba979f5ac1964c3b78cfde15c5c5f855ffd2caab337e9cd9182", size = 1643417, upload-time = "2026-03-28T17:18:37.949Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/72/07181226bc99ce1124e0f89280f5221a82d3ae6a6d9d1973ce429d48e52b/aiohttp-3.13.4-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:d99a9d168ebaffb74f36d011750e490085ac418f4db926cce3989c8fe6cb6b1b", size = 1849286, upload-time = "2026-03-28T17:18:40.534Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/e6/1b3566e103eca6da5be4ae6713e112a053725c584e96574caf117568ffef/aiohttp-3.13.4-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:cb19177205d93b881f3f89e6081593676043a6828f59c78c17a0fd6c1fbed2ba", size = 1782635, upload-time = "2026-03-28T17:18:43.073Z" },
-    { url = "https://files.pythonhosted.org/packages/37/58/1b11c71904b8d079eb0c39fe664180dd1e14bebe5608e235d8bfbadc8929/aiohttp-3.13.4-cp314-cp314t-win32.whl", hash = "sha256:c606aa5656dab6552e52ca368e43869c916338346bfaf6304e15c58fb113ea30", size = 472537, upload-time = "2026-03-28T17:18:46.286Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/8f/87c56a1a1977d7dddea5b31e12189665a140fdb48a71e9038ff90bb564ec/aiohttp-3.13.4-cp314-cp314t-win_amd64.whl", hash = "sha256:014dcc10ec8ab8db681f0d68e939d1e9286a5aa2b993cbbdb0db130853e02144", size = 506381, upload-time = "2026-03-28T17:18:48.74Z" },
+    { url = "https://files.pythonhosted.org/packages/21/61/d11f7d9a3144bffe825247d6367cd93053666da50b94707c9129c78868d5/aiohttp-3.14.0-cp313-cp313-android_21_arm64_v8a.whl", hash = "sha256:25400d710641a8040bf022a8a99f579e581ffa1c5bd42c33255d7d6f3957c127", size = 502399, upload-time = "2026-06-01T19:38:25.955Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/9b/a7e317625d36356844f8bb022cabd305b541f968856cc3c2e0b58e53ee6e/aiohttp-3.14.0-cp313-cp313-android_21_x86_64.whl", hash = "sha256:c5492b9929826e07cc3fcb9739ae87aab05dff6b5e67a9b73fd1700c6d008981", size = 510068, upload-time = "2026-06-01T19:38:27.828Z" },
+    { url = "https://files.pythonhosted.org/packages/11/41/cc2d2cfbfbdc3126ba258f3cd27d1ac8a33492ae3c35a4583ee21f0ba7f1/aiohttp-3.14.0-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:3366751d68d237c621264233a32f3078bbc21b7904ab90a77e03d21390c742c6", size = 481670, upload-time = "2026-06-01T19:38:29.836Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/07/381f4023c3b08cb616e520f566d8c58957abad54e56441d41fe67cfb0195/aiohttp-3.14.0-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:57ea07d28695a7a40304d42251892a8df765e5588c10ee32afeddcd5df33c0a2", size = 487591, upload-time = "2026-06-01T19:38:31.704Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/4d/4506fdb7a022bdf70011a3bbb4ca00c5c570026ef6a3c5bd7bc70c39089c/aiohttp-3.14.0-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:076cb014191ae2e65d949e1ad01f1dcfe33e32789b5172510f3e79c79fc04d50", size = 496503, upload-time = "2026-06-01T19:38:33.6Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/7d/c814111e04894a45d9e2defc94443879a6f118d9633d5fedfe6e2e8af5f0/aiohttp-3.14.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:2f3fc37054564dee64a855b5b092d87ec35dcddfaabf7dacb1c8a2b1f83dc0a9", size = 745870, upload-time = "2026-06-01T19:38:36.013Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/ee/80eee0efddfe187e7cd05027086b7ce1c0e492e82a4eda58f5c5543a44a0/aiohttp-3.14.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:8fcaef74d2ab0f607d7ff85a0d15e21bb5a258c4a58df1908396eb50d7f4ed3c", size = 505588, upload-time = "2026-06-01T19:38:38.282Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/f8/0f28f04eef75d52fc9c715dde7ce9c0abb810fd20cfeb0fea7afd2ab1e98/aiohttp-3.14.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:e4c01b0bfc6209590960e68eac083cd22d5d87c21f974dd6208cafa5d3542bc8", size = 504492, upload-time = "2026-06-01T19:38:40.611Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/db/44c755232085545065c94378dfce38641b1aee647f4939fcd32f5b32e719/aiohttp-3.14.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f12eb7896e81caf403a2b18c9406426f1207361e7239c057ab29c076d4257e83", size = 1752111, upload-time = "2026-06-01T19:38:42.682Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/6a/42e030a46743841414402a3b00cd3d78419055e86c66fb5822c14b5abfc6/aiohttp-3.14.0-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:6c79a044cacf360ec46738d863d2f41c9300d2a06ef4a7402ea0df306a350e61", size = 1729674, upload-time = "2026-06-01T19:38:44.79Z" },
+    { url = "https://files.pythonhosted.org/packages/34/26/3199beb415202e3108e7b83ecebe10914d806d33fb9860c3e4aa60a19be3/aiohttp-3.14.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:85e0675f47be4eff0636bf88c02140ea89168ae0df3ff1f3f464e9de9610d277", size = 1798808, upload-time = "2026-06-01T19:38:47.01Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/94/b9b6fcf0ee17c21d0d19fb8c22bf83ad18f82e702a9c3bd901a868f5e446/aiohttp-3.14.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:7b33e751cab03fdc960095b1e326cb5a03f5ee577d6ded59f3d1c100f8668882", size = 1891921, upload-time = "2026-06-01T19:38:49.233Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/a3/3800dbd095cb2bb165a7ea5d94d790914677e27f45638c7d80e3f34c8945/aiohttp-3.14.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:26d9224c6dd7f5c749aba4f61315a894601448b28d94d12f4dea0903e26d2096", size = 1777241, upload-time = "2026-06-01T19:38:52.04Z" },
+    { url = "https://files.pythonhosted.org/packages/21/2a/45be91ad1b860508557448d4cc2e165a2ee68dd865657b73bf66cc5a00fb/aiohttp-3.14.0-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:6281aecdf2732940f4fe06bd6adec5ae4d59b78b080b8e3a6b81467301010988", size = 1579554, upload-time = "2026-06-01T19:38:54.508Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/3d/dc94df99ed1511fdf28314f722643ed334112643cab00223577085e788c4/aiohttp-3.14.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:23e8314e7aed8576fbe33314d218bd81447a3adbc91dc36f1163bf583cd3084c", size = 1714864, upload-time = "2026-06-01T19:38:56.788Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/e4/1f1c8acbb3acd5c8f795473b92c9c3d44eb60a5692c6104256c8a1c83a0c/aiohttp-3.14.0-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:3b54fbff46127aeafdd764cecd0d99fa2f24a0e37ea5c18a7c3a4ac450df1db3", size = 1749803, upload-time = "2026-06-01T19:38:59.367Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/c8/c45ea6e7ed84cebba939b9c334498a045ba19d79c61b0110df5f21580de3/aiohttp-3.14.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:b27d89af91a555f58e08e4902dbcbc48862fd40095720ca705990476bd93b7ac", size = 1765023, upload-time = "2026-06-01T19:39:01.651Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/a1/a932941784432962fe390e1066823aaef64b4e5ac9fa595df57b5fe472a9/aiohttp-3.14.0-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:25d2326a4967bf705a9f9913a13005e93b6020ad8a9f6bd6bd78850d5171332e", size = 1571671, upload-time = "2026-06-01T19:39:04.044Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/01/e1280feac522597a4d46eb67a0cdfa053cfae263033030b761ab146f29fb/aiohttp-3.14.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:a1d209375c503472b3c0a340cdf3c55fcd82e84b46dda7caeaced59faba373ec", size = 1789904, upload-time = "2026-06-01T19:39:06.294Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/10/ab28818262f4d26bdb47ed5f1fc7999b69e2fc6e0370b02d0f49011f45ea/aiohttp-3.14.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:666c7c5036df57b693026398b69b41874a1931ac5b3485fd910e57bfac253869", size = 1754516, upload-time = "2026-06-01T19:39:08.788Z" },
+    { url = "https://files.pythonhosted.org/packages/af/cc/c122eabd7a1b7e0c9bbdd6be60e4715905b858399145d9df872bb94f1427/aiohttp-3.14.0-cp313-cp313-win32.whl", hash = "sha256:23f094a1ef64823fd35854ddf5c7a80a078162f37f9d2f7c6142b51a6affa456", size = 448656, upload-time = "2026-06-01T19:39:11.171Z" },
+    { url = "https://files.pythonhosted.org/packages/41/a5/bab07d79848a00eedd8ed979ccb302aaea3ac6eb9fa16bd0ed87135869b4/aiohttp-3.14.0-cp313-cp313-win_amd64.whl", hash = "sha256:e03abdaa17d553f17e1d1d06bb266b3970106c78051d06795723e748d8e49d11", size = 475803, upload-time = "2026-06-01T19:39:13.439Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/a0/f03ade8566c153666a3871afccbedf6d99911da006325e1fc6cf72a2de99/aiohttp-3.14.0-cp313-cp313-win_arm64.whl", hash = "sha256:acdb400538cf4769543548bb5d1eb23d39bed4f96554a6078cb728c7cb2c268b", size = 443889, upload-time = "2026-06-01T19:39:15.945Z" },
+    { url = "https://files.pythonhosted.org/packages/28/03/5f36ab196a88ba5e9648ae5643e6531e67a3a8c0e96f9c6510ff41540fec/aiohttp-3.14.0-cp314-cp314-android_24_arm64_v8a.whl", hash = "sha256:363ef9e91014e7891679bfb2ac0a7c6ea93435dbbfd10ecf41b9f06fcf506c5f", size = 503330, upload-time = "2026-06-01T19:39:18.195Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/ce/8b49ec2f30f68e02f314f4832186cd45e583360a5a386058be36855d23b6/aiohttp-3.14.0-cp314-cp314-android_24_x86_64.whl", hash = "sha256:884a4edbdad77be9d0ef36142c8b504351b170df0bf62b51e784fadabf311c42", size = 509822, upload-time = "2026-06-01T19:39:20.396Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/fe/6edbf5d39bf29322b6816365b17ed8ede4dace164a3aea1abcd30110eb78/aiohttp-3.14.0-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:70ea956f6cc4a37620966b56c2e205d88ca3e6d85ec063277e414b1035cddad3", size = 483329, upload-time = "2026-06-01T19:39:22.607Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/5a/fae531bdbc6456fb6241f46b7b81e4d8a0dd3fc09118a0055dc7141ac1ec/aiohttp-3.14.0-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:ea3b9806c89f61da22fddf1f12dd524fb368e5e28f1261fbdafe5c3cd8ce893b", size = 489502, upload-time = "2026-06-01T19:39:24.881Z" },
+    { url = "https://files.pythonhosted.org/packages/36/f4/48a7b0414db7fed77a03d5dde34508c026afd83510ab6bca08c313855776/aiohttp-3.14.0-cp314-cp314-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:a071be341c2bd9b0188e62d173509f024e0a35b1c342c53c50f8daaeda8c3bd8", size = 497357, upload-time = "2026-06-01T19:39:27.197Z" },
+    { url = "https://files.pythonhosted.org/packages/75/75/e85a13a370acc007fca5feb1fd1b88ac2d8426e6dadd625479b7cadd55a3/aiohttp-3.14.0-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:198cfe61bf253b19da1fb3e0fa122249dc4f14c12709493fed8054aa0411cc76", size = 750898, upload-time = "2026-06-01T19:39:29.563Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/e4/3d637f800c724eff0e2bed64df72557444482366fd0a35b0cec0e6968f6c/aiohttp-3.14.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:9dc203d6ce6b9106d54e2a93f41dfdfebfbca2d99962ba503bfd3e5921a6549e", size = 506986, upload-time = "2026-06-01T19:39:31.872Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/df/35161f3598bf7501d2b2a805b41ab4f45a2e34150c421bcb4ef8c0d281a7/aiohttp-3.14.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:9e19d17ab02bf16832a2c8c0d55a486792c5b1645665652ee9531aebcc30cb72", size = 508033, upload-time = "2026-06-01T19:39:34.137Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/39/b36e5d3d31e850fb4691dd3e941684ac490a2559249f6fa634b6b0fdf020/aiohttp-3.14.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d925fba0c14d5b498a8028b0107beebdfd16c5d48d702ff54f879cb017aaaca3", size = 1746213, upload-time = "2026-06-01T19:39:36.654Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/28/24e1409e605a9aa5d84abe0e2acb365354b70ae56d40948101cabe3341ab/aiohttp-3.14.0-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:d33e61021222ce7f9792bcac870d6f58d8adfceda33ab857b01264f4560f2c5f", size = 1705862, upload-time = "2026-06-01T19:39:38.968Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/d0/e5eb3ff1daeaf644c7e36a957517672494122628e067c38b263fa04eda77/aiohttp-3.14.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:44eca38755d0105bb32f47d085f5dd449846a449e1245fc105889e3279dcf8e3", size = 1798909, upload-time = "2026-06-01T19:39:41.334Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/ba/8943f906f0570342886ababb9a722a44e360f786a028c5e0b0e29e3f735b/aiohttp-3.14.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:f13087e06f68fea4941c21a0c541c00553aa16e4f8fd7bbe2b198df761e964d6", size = 1868892, upload-time = "2026-06-01T19:39:43.807Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/05/27df32c844b2156e1675a8d8ec22d963e3c8ba469ed7ceb1863320c7b521/aiohttp-3.14.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ff82be7f1ef73634cb77890a770743239bc3d487b848669be1c599889336dc0a", size = 1751659, upload-time = "2026-06-01T19:39:46.398Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/62/da182e5910ab912b2e88aa919b61a16046a37a95714a5795b02eb57b2d18/aiohttp-3.14.0-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a150c0875ac8fd87f1c398650841308a30d65facf7416b12dbdb9cfdcbe5a48c", size = 1578775, upload-time = "2026-06-01T19:39:48.902Z" },
+    { url = "https://files.pythonhosted.org/packages/66/e3/53c67097e8a5ce98625e91e3fa7f43c9c6940de680345d03b3509a72a078/aiohttp-3.14.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:edc01ea4e1ec5a1649a28866262bf24195889ff7b27bdd947029a6086741de9b", size = 1710090, upload-time = "2026-06-01T19:39:51.392Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/55/0e2732ca598c7a4dfe8a775662376d0ca2977cb1030e48386d4da5d9a456/aiohttp-3.14.0-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:540632bf882ff8fc88f2e1697be0761578e89e0d79fb4a8a6d65dc5da7e729d4", size = 1715016, upload-time = "2026-06-01T19:39:53.807Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/96/f0b73730798c9ca525afc30b39f1f81bbe24e245d9654c54d3b39d63212d/aiohttp-3.14.0-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:860a86bc2c80237f5dff52edcf427e10a8d8352271fd84845429a3e60199e02c", size = 1763810, upload-time = "2026-06-01T19:39:56.31Z" },
+    { url = "https://files.pythonhosted.org/packages/71/cc/11acb6c4518f448323405a7312b6f255d0f974a34373ad1db7633c4aadc8/aiohttp-3.14.0-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:5cbd50e6a50d6b99283a826b18cbdebf65b0797689a7535cb0e9dd37be0f63c3", size = 1573064, upload-time = "2026-06-01T19:39:58.718Z" },
+    { url = "https://files.pythonhosted.org/packages/de/2d/28c31dde0a7dc98c0ee7d0da2ddcec3f7688c4fc131e5989e278d0c03c0a/aiohttp-3.14.0-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:20144819e99db593e22bbd2f3f2691a5e149f879142d6b8670254708853ff4fb", size = 1775765, upload-time = "2026-06-01T19:40:01.195Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/69/155c4ef3aec96417d47024800472b33b16c5d8a665371dcd044c2afdf25d/aiohttp-3.14.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:26b6d79aa54cb4ed50cc7d41ed14e99e0f1fc8e7c2d42f2e05b37aea897b2b52", size = 1733716, upload-time = "2026-06-01T19:40:03.631Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/44/6126116fd8a316b712bb615660b855c78466bb67ba1bb1742427eafcf7ac/aiohttp-3.14.0-cp314-cp314-win32.whl", hash = "sha256:106ed074a856f3e21d186b8579e2c8afb6da598e267cdaab01059e13db2fc44d", size = 453684, upload-time = "2026-06-01T19:40:06.277Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/d7/eff4c58a88c5cac5e38b55f44fb8a6d3929c3cbd77356e383e094d3220bd/aiohttp-3.14.0-cp314-cp314-win_amd64.whl", hash = "sha256:4f770846edae8f00ecc57af825bce811f787f87a7dcf0e90d191790efe5b31f7", size = 481758, upload-time = "2026-06-01T19:40:08.653Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/ed/17b5bd9fbcb46e688f02e572f517754a9a75831e7b54702f027761dc4fa5/aiohttp-3.14.0-cp314-cp314-win_arm64.whl", hash = "sha256:acf1581c4f21ed4b80a2dded504d87b055a071a84d5737ea966435f768275ac6", size = 450557, upload-time = "2026-06-01T19:40:11.03Z" },
+    { url = "https://files.pythonhosted.org/packages/12/34/6180103ce9aabc8ebff3f7bb55a1228ffe60f61042823031d9692cb7b101/aiohttp-3.14.0-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:6aa1a40f9cbb3da9f80714c5966b8946c21e6a2530d809b9498b33161e3c8733", size = 787878, upload-time = "2026-06-01T19:40:13.401Z" },
+    { url = "https://files.pythonhosted.org/packages/92/e9/08954a40e8b7baa3d8beadd2b074b186e9b1e9c8ddabc288678a6265de50/aiohttp-3.14.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:b62af5a8cc96a194eaa01a9ed7b34a3ffa58d3d8daaa1a0d7a749353ad12d228", size = 524400, upload-time = "2026-06-01T19:40:15.972Z" },
+    { url = "https://files.pythonhosted.org/packages/08/6a/b5965a634ac4d5ba99a463314cf4ab214ca073fcdc38a15e0294273701fc/aiohttp-3.14.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:6eb63b1417efaf7d1002a6ad034a40d44376afcc16508a57f8e74b49ad26a095", size = 527904, upload-time = "2026-06-01T19:40:18.28Z" },
+    { url = "https://files.pythonhosted.org/packages/06/b4/932bcdd850c354d9bcca30f360e475d7852e30413fbbd44b182782ed5432/aiohttp-3.14.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c20b9ad156a79eb97be5cf9e069eec01d2f0dc8472ffbd75299a8b2d4c2cbbde", size = 1912162, upload-time = "2026-06-01T19:40:20.825Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/85/ce79bab0310d2e3fd2d7bc7e44412abeff7c8338f8a21dd0f2f1714989e5/aiohttp-3.14.0-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:40ae7b0642c25632c7eabc4a04754012691864d2a1b93becf7cddb76027b838a", size = 1778813, upload-time = "2026-06-01T19:40:23.726Z" },
+    { url = "https://files.pythonhosted.org/packages/05/54/ba62ac2d1bc87e010aad23751e383b8794e45d931df67677313a2da78823/aiohttp-3.14.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:95f5217e76a046b9f228a101717ef8d42b1eb3d9d196d15202db5bf41df88936", size = 1899969, upload-time = "2026-06-01T19:40:26.406Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/82/7cc7907725d83a19f31551334061e1ab8e108b1d7ac52632a2a844a4acb5/aiohttp-3.14.0-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:1a4a9f17e85b80878c176695c1998c790e83731d8271881e5d356488652a1f9e", size = 1991771, upload-time = "2026-06-01T19:40:29.061Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/1c/a57de71a4508c93a830b77c28af3d08cd97f606dedfc6b94275347744508/aiohttp-3.14.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:145262119b07d7f95abc1839add35ba2bfc84551d4b4660ca11542c0b215455b", size = 1868606, upload-time = "2026-06-01T19:40:31.843Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/ae/3839726cd49150a53ed340cc24ce5ba09d4c2117020ef9d45542bec5eb2f/aiohttp-3.14.0-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:49a33ded29b0b2fa7a367a02cf0fb89af602bb87542a16177ec8ce1c9c51d12a", size = 1665437, upload-time = "2026-06-01T19:40:35.01Z" },
+    { url = "https://files.pythonhosted.org/packages/35/1e/c237923232c7da7f0392ea25d89fc5e60c0e93f685f4ebca8e7bcdd5271c/aiohttp-3.14.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:2cc736a9c9fc2bc4dd71fd404815741b6573df27c3f985948ec4076989ac57de", size = 1834090, upload-time = "2026-06-01T19:40:37.733Z" },
+    { url = "https://files.pythonhosted.org/packages/98/02/a5a7a2524f92d3911761b405a7c067c751891942144adc13e2ad79611e39/aiohttp-3.14.0-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:b4141a3e5342ee3053a9cab54d25b64ed28289c1041e4c54b3d99839314d90ce", size = 1816907, upload-time = "2026-06-01T19:40:40.46Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/76/a8b9f0d09234d516af9f2d7dd715557f33b5da3b0b56ead41d1170e86e3c/aiohttp-3.14.0-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:e30871b2d58996cb81aac52d2b1d15ac05257131ef0f90f18c2115a380fbfe7c", size = 1840382, upload-time = "2026-06-01T19:40:43.48Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/8e/140e715a0a4bbc211979ea30ec8396ad2ed5bf90ab87d8058fc4668b1923/aiohttp-3.14.0-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:667b881d083ccae3900ea5a241e17e5007ca78844c53ed389bb63d48f729d9c7", size = 1659497, upload-time = "2026-06-01T19:40:46.265Z" },
+    { url = "https://files.pythonhosted.org/packages/10/c7/7ba5de8af9650b9767b063c675427b8685f43fa7ce563673a7bc3af60f08/aiohttp-3.14.0-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:b584dfe615d151e9b8f0a8ecb3aee6147f2927ec5b95ba25fe621f5377510928", size = 1870829, upload-time = "2026-06-01T19:40:49.583Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/bc/2aaab2f85cadb26ea59c091fa2b8e370d625154b5c14b478f1b489d07551/aiohttp-3.14.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:6199707cc40e0e9cd39c36fbc97bec416c704e1d0ddce03412bb3b3e6a90ccd0", size = 1832281, upload-time = "2026-06-01T19:40:52.303Z" },
+    { url = "https://files.pythonhosted.org/packages/39/98/31b9ad9fbc01f0075ee7221002df5fd2d10b647f451ca5f30edc802d9dd6/aiohttp-3.14.0-cp314-cp314t-win32.whl", hash = "sha256:a8d93334d4961c9d566b1f046c81dee475b7c21eb730728d38237bfa70d1c8e6", size = 490597, upload-time = "2026-06-01T19:40:54.937Z" },
+    { url = "https://files.pythonhosted.org/packages/59/1f/299b21441c8de42ff70fddc7cfe65e92f810abcf740739a09b56f7835364/aiohttp-3.14.0-cp314-cp314t-win_amd64.whl", hash = "sha256:2d2ffe9b614f50f069068b3b52e73414e4107fc10b7efc939a76acff9251fdd2", size = 525789, upload-time = "2026-06-01T19:40:57.306Z" },
+    { url = "https://files.pythonhosted.org/packages/70/11/7f83fcba9ee05d4c54d61b3f8104da0d43a59adac44dd28effc0c9a10422/aiohttp-3.14.0-cp314-cp314t-win_arm64.whl", hash = "sha256:7a3fc4358e65826c515350f199c210de747cf669998211b1ee6c2e46de364b24", size = 467399, upload-time = "2026-06-01T19:40:59.993Z" },
 ]
 
 [[package]]
@@ -501,17 +514,18 @@ provides-extras = ["dev"]
 
 [[package]]
 name = "fastapi"
-version = "0.128.0"
+version = "0.136.3"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "annotated-doc" },
     { name = "pydantic" },
     { name = "starlette" },
     { name = "typing-extensions" },
+    { name = "typing-inspection" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/52/08/8c8508db6c7b9aae8f7175046af41baad690771c9bcde676419965e338c7/fastapi-0.128.0.tar.gz", hash = "sha256:1cc179e1cef10a6be60ffe429f79b829dce99d8de32d7acb7e6c8dfdf7f2645a", size = 365682, upload-time = "2025-12-27T15:21:13.714Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/81/2d/ff8d91d7b564d464629a0fd50a4489c97fcb836ac230bf3a7269232a9b1f/fastapi-0.136.3.tar.gz", hash = "sha256:e487fae93ad408e6f47641ee4dfe389864fd7bec92e547ea8498fc13f43e83ab", size = 396410, upload-time = "2026-05-23T18:53:15.192Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/5c/05/5cbb59154b093548acd0f4c7c474a118eda06da25aa75c616b72d8fcd92a/fastapi-0.128.0-py3-none-any.whl", hash = "sha256:aebd93f9716ee3b4f4fcfe13ffb7cf308d99c9f3ab5622d8877441072561582d", size = 103094, upload-time = "2025-12-27T15:21:12.154Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/82/45359b62a067409bd929ae8a56b8ed13e5a8c8a61194b3c236920999ab83/fastapi-0.136.3-py3-none-any.whl", hash = "sha256:3d2a69bdf04b7e9f3afa292c3bc7a98816bbfafa10bc9b45f3f3700d2f761620", size = 117481, upload-time = "2026-05-23T18:53:16.924Z" },
 ]
 
 [[package]]
@@ -753,11 +767,11 @@ wheels = [
 
 [[package]]
 name = "idna"
-version = "3.11"
+version = "3.15"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/0703ccc57f3a7233505399edb88de3cbd678da106337b9fcde432b65ed60/idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902", size = 194582, upload-time = "2025-10-12T14:55:20.501Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/82/77/7b3966d0b9d1d31a36ddf1746926a11dface89a83409bf1483f0237aa758/idna-3.15.tar.gz", hash = "sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc", size = 199245, upload-time = "2026-05-12T22:45:57.011Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/23/408243171aa9aaba178d3e2559159c24c1171a641aa83b67bdd3394ead8e/idna-3.15-py3-none-any.whl", hash = "sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8", size = 72340, upload-time = "2026-05-12T22:45:55.733Z" },
 ]
 
 [[package]]
@@ -1532,14 +1546,14 @@ wheels = [
 
 [[package]]
 name = "starlette"
-version = "0.50.0"
+version = "1.0.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/ba/b8/73a0e6a6e079a9d9cfa64113d771e421640b6f679a52eeb9b32f72d871a1/starlette-0.50.0.tar.gz", hash = "sha256:a2a17b22203254bcbc2e1f926d2d55f3f9497f769416b3190768befe598fa3ca", size = 2646985, upload-time = "2025-11-01T15:25:27.516Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/08/a3/84e821cc54b4ab50ae6dbc6ac3800a651b65ec35f045cc73785380654057/starlette-1.0.1.tar.gz", hash = "sha256:512399c5f1de7fac99c88572212ded9ddeddef2fb32afa82d724000e88b38f4f", size = 2659596, upload-time = "2026-05-21T21:58:58.433Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/d9/52/1064f510b141bd54025f9b55105e26d1fa970b9be67ad766380a3c9b74b0/starlette-0.50.0-py3-none-any.whl", hash = "sha256:9e5391843ec9b6e472eed1365a78c8098cfceb7a74bfd4d6b1c0c0095efb3bca", size = 74033, upload-time = "2025-11-01T15:25:25.461Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/e1/b2df4bc09a1e51ff664c1e17018a4274b42e5e9352e4a478ea540512dc88/starlette-1.0.1-py3-none-any.whl", hash = "sha256:7c0e69b2ee1c848bd54669d908500117a3ee13de603a21427e5c6fc1adf98dcd", size = 72802, upload-time = "2026-05-21T21:58:56.551Z" },
 ]
 
 [[package]]
diff --git a/PROJECTS/advanced/encrypted-p2p-chat/frontend/package.json b/PROJECTS/advanced/encrypted-p2p-chat/frontend/package.json
index 84a37ba2..4cae1628 100644
--- a/PROJECTS/advanced/encrypted-p2p-chat/frontend/package.json
+++ b/PROJECTS/advanced/encrypted-p2p-chat/frontend/package.json
@@ -43,6 +43,6 @@
     "typescript-eslint": "^8.56.0",
     "vite": "^7.3.2",
     "vite-plugin-solid": "^2.11.10",
-    "vitest": "^2.1.5"
+    "vitest": "^4.1.0"
   }
 }
diff --git a/PROJECTS/advanced/encrypted-p2p-chat/frontend/pnpm-lock.yaml b/PROJECTS/advanced/encrypted-p2p-chat/frontend/pnpm-lock.yaml
index e162f77d..777c5262 100644
--- a/PROJECTS/advanced/encrypted-p2p-chat/frontend/pnpm-lock.yaml
+++ b/PROJECTS/advanced/encrypted-p2p-chat/frontend/pnpm-lock.yaml
@@ -76,8 +76,8 @@ importers:
         specifier: ^2.11.10
         version: 2.11.10(solid-js@1.9.11)(vite@7.3.2(@types/node@25.2.3)(jiti@2.6.1)(lightningcss@1.31.1))
       vitest:
-        specifier: ^2.1.5
-        version: 2.1.9(@types/node@25.2.3)(lightningcss@1.31.1)
+        specifier: ^4.1.0
+        version: 4.1.0(@types/node@25.2.3)(vite@7.3.2(@types/node@25.2.3)(jiti@2.6.1)(lightningcss@1.31.1))
 
 packages:
 
@@ -184,24 +184,28 @@ packages:
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@biomejs/cli-linux-arm64@2.4.2':
     resolution: {integrity: sha512-DI3Mi7GT2zYNgUTDEbSjl3e1KhoP76OjQdm8JpvZYZWtVDRyLd3w8llSr2TWk1z+U3P44kUBWY3X7H9MD1/DGQ==}
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@biomejs/cli-linux-x64-musl@2.4.2':
     resolution: {integrity: sha512-wbBmTkeAoAYbOQ33f6sfKG7pcRSydQiF+dTYOBjJsnXO2mWEOQHllKlC2YVnedqZFERp2WZhFUoO7TNRwnwEHQ==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@biomejs/cli-linux-x64@2.4.2':
     resolution: {integrity: sha512-GK2ErnrKpWFigYP68cXiCHK4RTL4IUWhK92AFS3U28X/nuAL5+hTuy6hyobc8JZRSt+upXt1nXChK+tuHHx4mA==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@biomejs/cli-win32-arm64@2.4.2':
     resolution: {integrity: sha512-k2uqwLYrNNxnaoiW3RJxoMGnbKda8FuCmtYG3cOtVljs3CzWxaTR+AoXwKGHscC9thax9R4kOrtWqWN0+KdPTw==}
@@ -215,204 +219,102 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@esbuild/aix-ppc64@0.21.5':
-    resolution: {integrity: sha512-1SDgH6ZSPTlggy1yI6+Dbkiz8xzpHJEVAlF/AM1tHPLsf5STom9rwtjE4hKAF20FfXXNTFqEYXyJNWh1GiZedQ==}
-    engines: {node: '>=12'}
-    cpu: [ppc64]
-    os: [aix]
-
   '@esbuild/aix-ppc64@0.27.7':
     resolution: {integrity: sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg==}
     engines: {node: '>=18'}
     cpu: [ppc64]
     os: [aix]
 
-  '@esbuild/android-arm64@0.21.5':
-    resolution: {integrity: sha512-c0uX9VAUBQ7dTDCjq+wdyGLowMdtR/GoC2U5IYk/7D1H1JYC0qseD7+11iMP2mRLN9RcCMRcjC4YMclCzGwS/A==}
-    engines: {node: '>=12'}
-    cpu: [arm64]
-    os: [android]
-
   '@esbuild/android-arm64@0.27.7':
     resolution: {integrity: sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [android]
 
-  '@esbuild/android-arm@0.21.5':
-    resolution: {integrity: sha512-vCPvzSjpPHEi1siZdlvAlsPxXl7WbOVUBBAowWug4rJHb68Ox8KualB+1ocNvT5fjv6wpkX6o/iEpbDrf68zcg==}
-    engines: {node: '>=12'}
-    cpu: [arm]
-    os: [android]
-
   '@esbuild/android-arm@0.27.7':
     resolution: {integrity: sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [android]
 
-  '@esbuild/android-x64@0.21.5':
-    resolution: {integrity: sha512-D7aPRUUNHRBwHxzxRvp856rjUHRFW1SdQATKXH2hqA0kAZb1hKmi02OpYRacl0TxIGz/ZmXWlbZgjwWYaCakTA==}
-    engines: {node: '>=12'}
-    cpu: [x64]
-    os: [android]
-
   '@esbuild/android-x64@0.27.7':
     resolution: {integrity: sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [android]
 
-  '@esbuild/darwin-arm64@0.21.5':
-    resolution: {integrity: sha512-DwqXqZyuk5AiWWf3UfLiRDJ5EDd49zg6O9wclZ7kUMv2WRFr4HKjXp/5t8JZ11QbQfUS6/cRCKGwYhtNAY88kQ==}
-    engines: {node: '>=12'}
-    cpu: [arm64]
-    os: [darwin]
-
   '@esbuild/darwin-arm64@0.27.7':
     resolution: {integrity: sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [darwin]
 
-  '@esbuild/darwin-x64@0.21.5':
-    resolution: {integrity: sha512-se/JjF8NlmKVG4kNIuyWMV/22ZaerB+qaSi5MdrXtd6R08kvs2qCN4C09miupktDitvh8jRFflwGFBQcxZRjbw==}
-    engines: {node: '>=12'}
-    cpu: [x64]
-    os: [darwin]
-
   '@esbuild/darwin-x64@0.27.7':
     resolution: {integrity: sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [darwin]
 
-  '@esbuild/freebsd-arm64@0.21.5':
-    resolution: {integrity: sha512-5JcRxxRDUJLX8JXp/wcBCy3pENnCgBR9bN6JsY4OmhfUtIHe3ZW0mawA7+RDAcMLrMIZaf03NlQiX9DGyB8h4g==}
-    engines: {node: '>=12'}
-    cpu: [arm64]
-    os: [freebsd]
-
   '@esbuild/freebsd-arm64@0.27.7':
     resolution: {integrity: sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [freebsd]
 
-  '@esbuild/freebsd-x64@0.21.5':
-    resolution: {integrity: sha512-J95kNBj1zkbMXtHVH29bBriQygMXqoVQOQYA+ISs0/2l3T9/kj42ow2mpqerRBxDJnmkUDCaQT/dfNXWX/ZZCQ==}
-    engines: {node: '>=12'}
-    cpu: [x64]
-    os: [freebsd]
-
   '@esbuild/freebsd-x64@0.27.7':
     resolution: {integrity: sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [freebsd]
 
-  '@esbuild/linux-arm64@0.21.5':
-    resolution: {integrity: sha512-ibKvmyYzKsBeX8d8I7MH/TMfWDXBF3db4qM6sy+7re0YXya+K1cem3on9XgdT2EQGMu4hQyZhan7TeQ8XkGp4Q==}
-    engines: {node: '>=12'}
-    cpu: [arm64]
-    os: [linux]
-
   '@esbuild/linux-arm64@0.27.7':
     resolution: {integrity: sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [linux]
 
-  '@esbuild/linux-arm@0.21.5':
-    resolution: {integrity: sha512-bPb5AHZtbeNGjCKVZ9UGqGwo8EUu4cLq68E95A53KlxAPRmUyYv2D6F0uUI65XisGOL1hBP5mTronbgo+0bFcA==}
-    engines: {node: '>=12'}
-    cpu: [arm]
-    os: [linux]
-
   '@esbuild/linux-arm@0.27.7':
     resolution: {integrity: sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [linux]
 
-  '@esbuild/linux-ia32@0.21.5':
-    resolution: {integrity: sha512-YvjXDqLRqPDl2dvRODYmmhz4rPeVKYvppfGYKSNGdyZkA01046pLWyRKKI3ax8fbJoK5QbxblURkwK/MWY18Tg==}
-    engines: {node: '>=12'}
-    cpu: [ia32]
-    os: [linux]
-
   '@esbuild/linux-ia32@0.27.7':
     resolution: {integrity: sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [linux]
 
-  '@esbuild/linux-loong64@0.21.5':
-    resolution: {integrity: sha512-uHf1BmMG8qEvzdrzAqg2SIG/02+4/DHB6a9Kbya0XDvwDEKCoC8ZRWI5JJvNdUjtciBGFQ5PuBlpEOXQj+JQSg==}
-    engines: {node: '>=12'}
-    cpu: [loong64]
-    os: [linux]
-
   '@esbuild/linux-loong64@0.27.7':
     resolution: {integrity: sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q==}
     engines: {node: '>=18'}
     cpu: [loong64]
     os: [linux]
 
-  '@esbuild/linux-mips64el@0.21.5':
-    resolution: {integrity: sha512-IajOmO+KJK23bj52dFSNCMsz1QP1DqM6cwLUv3W1QwyxkyIWecfafnI555fvSGqEKwjMXVLokcV5ygHW5b3Jbg==}
-    engines: {node: '>=12'}
-    cpu: [mips64el]
-    os: [linux]
-
   '@esbuild/linux-mips64el@0.27.7':
     resolution: {integrity: sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw==}
     engines: {node: '>=18'}
     cpu: [mips64el]
     os: [linux]
 
-  '@esbuild/linux-ppc64@0.21.5':
-    resolution: {integrity: sha512-1hHV/Z4OEfMwpLO8rp7CvlhBDnjsC3CttJXIhBi+5Aj5r+MBvy4egg7wCbe//hSsT+RvDAG7s81tAvpL2XAE4w==}
-    engines: {node: '>=12'}
-    cpu: [ppc64]
-    os: [linux]
-
   '@esbuild/linux-ppc64@0.27.7':
     resolution: {integrity: sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ==}
     engines: {node: '>=18'}
     cpu: [ppc64]
     os: [linux]
 
-  '@esbuild/linux-riscv64@0.21.5':
-    resolution: {integrity: sha512-2HdXDMd9GMgTGrPWnJzP2ALSokE/0O5HhTUvWIbD3YdjME8JwvSCnNGBnTThKGEB91OZhzrJ4qIIxk/SBmyDDA==}
-    engines: {node: '>=12'}
-    cpu: [riscv64]
-    os: [linux]
-
   '@esbuild/linux-riscv64@0.27.7':
     resolution: {integrity: sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ==}
     engines: {node: '>=18'}
     cpu: [riscv64]
     os: [linux]
 
-  '@esbuild/linux-s390x@0.21.5':
-    resolution: {integrity: sha512-zus5sxzqBJD3eXxwvjN1yQkRepANgxE9lgOW2qLnmr8ikMTphkjgXu1HR01K4FJg8h1kEEDAqDcZQtbrRnB41A==}
-    engines: {node: '>=12'}
-    cpu: [s390x]
-    os: [linux]
-
   '@esbuild/linux-s390x@0.27.7':
     resolution: {integrity: sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw==}
     engines: {node: '>=18'}
     cpu: [s390x]
     os: [linux]
 
-  '@esbuild/linux-x64@0.21.5':
-    resolution: {integrity: sha512-1rYdTpyv03iycF1+BhzrzQJCdOuAOtaqHTWJZCWvijKD2N5Xu0TtVC8/+1faWqcP9iBCWOmjmhoH94dH82BxPQ==}
-    engines: {node: '>=12'}
-    cpu: [x64]
-    os: [linux]
-
   '@esbuild/linux-x64@0.27.7':
     resolution: {integrity: sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA==}
     engines: {node: '>=18'}
@@ -425,12 +327,6 @@ packages:
     cpu: [arm64]
     os: [netbsd]
 
-  '@esbuild/netbsd-x64@0.21.5':
-    resolution: {integrity: sha512-Woi2MXzXjMULccIwMnLciyZH4nCIMpWQAs049KEeMvOcNADVxo0UBIQPfSmxB3CWKedngg7sWZdLvLczpe0tLg==}
-    engines: {node: '>=12'}
-    cpu: [x64]
-    os: [netbsd]
-
   '@esbuild/netbsd-x64@0.27.7':
     resolution: {integrity: sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw==}
     engines: {node: '>=18'}
@@ -443,12 +339,6 @@ packages:
     cpu: [arm64]
     os: [openbsd]
 
-  '@esbuild/openbsd-x64@0.21.5':
-    resolution: {integrity: sha512-HLNNw99xsvx12lFBUwoT8EVCsSvRNDVxNpjZ7bPn947b8gJPzeHWyNVhFsaerc0n3TsbOINvRP2byTZ5LKezow==}
-    engines: {node: '>=12'}
-    cpu: [x64]
-    os: [openbsd]
-
   '@esbuild/openbsd-x64@0.27.7':
     resolution: {integrity: sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg==}
     engines: {node: '>=18'}
@@ -461,48 +351,24 @@ packages:
     cpu: [arm64]
     os: [openharmony]
 
-  '@esbuild/sunos-x64@0.21.5':
-    resolution: {integrity: sha512-6+gjmFpfy0BHU5Tpptkuh8+uw3mnrvgs+dSPQXQOv3ekbordwnzTVEb4qnIvQcYXq6gzkyTnoZ9dZG+D4garKg==}
-    engines: {node: '>=12'}
-    cpu: [x64]
-    os: [sunos]
-
   '@esbuild/sunos-x64@0.27.7':
     resolution: {integrity: sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [sunos]
 
-  '@esbuild/win32-arm64@0.21.5':
-    resolution: {integrity: sha512-Z0gOTd75VvXqyq7nsl93zwahcTROgqvuAcYDUr+vOv8uHhNSKROyU961kgtCD1e95IqPKSQKH7tBTslnS3tA8A==}
-    engines: {node: '>=12'}
-    cpu: [arm64]
-    os: [win32]
-
   '@esbuild/win32-arm64@0.27.7':
     resolution: {integrity: sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [win32]
 
-  '@esbuild/win32-ia32@0.21.5':
-    resolution: {integrity: sha512-SWXFF1CL2RVNMaVs+BBClwtfZSvDgtL//G/smwAc5oVK/UPu2Gu9tIaRgFmYFFKrmg3SyAjSrElf0TiJ1v8fYA==}
-    engines: {node: '>=12'}
-    cpu: [ia32]
-    os: [win32]
-
   '@esbuild/win32-ia32@0.27.7':
     resolution: {integrity: sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [win32]
 
-  '@esbuild/win32-x64@0.21.5':
-    resolution: {integrity: sha512-tQd/1efJuzPC6rCFwEvLtci/xNFcTZknmXs98FYDfGE4wP9ClFV98nyKrzJKVPMhdDnjzLhdUyMX4PsQAPjwIw==}
-    engines: {node: '>=12'}
-    cpu: [x64]
-    os: [win32]
-
   '@esbuild/win32-x64@0.27.7':
     resolution: {integrity: sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg==}
     engines: {node: '>=18'}
@@ -625,66 +491,79 @@ packages:
     resolution: {integrity: sha512-2QxQrM+KQ7DAW4o22j+XZ6RKdxjLD7BOWTP0Bv0tmjdyhXSsr2Ul1oJDQqh9Zf5qOwTuTc7Ek83mOFaKnodPjg==}
     cpu: [arm]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-arm-musleabihf@4.60.2':
     resolution: {integrity: sha512-TbziEu2DVsTEOPif2mKWkMeDMLoYjx95oESa9fkQQK7r/Orta0gnkcDpzwufEcAO2BLBsD7mZkXGFqEdMRRwfw==}
     cpu: [arm]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-arm64-gnu@4.60.2':
     resolution: {integrity: sha512-bO/rVDiDUuM2YfuCUwZ1t1cP+/yqjqz+Xf2VtkdppefuOFS2OSeAfgafaHNkFn0t02hEyXngZkxtGqXcXwO8Rg==}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-arm64-musl@4.60.2':
     resolution: {integrity: sha512-hr26p7e93Rl0Za+JwW7EAnwAvKkehh12BU1Llm9Ykiibg4uIr2rbpxG9WCf56GuvidlTG9KiiQT/TXT1yAWxTA==}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-loong64-gnu@4.60.2':
     resolution: {integrity: sha512-pOjB/uSIyDt+ow3k/RcLvUAOGpysT2phDn7TTUB3n75SlIgZzM6NKAqlErPhoFU+npgY3/n+2HYIQVbF70P9/A==}
     cpu: [loong64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-loong64-musl@4.60.2':
     resolution: {integrity: sha512-2/w+q8jszv9Ww1c+6uJT3OwqhdmGP2/4T17cu8WuwyUuuaCDDJ2ojdyYwZzCxx0GcsZBhzi3HmH+J5pZNXnd+Q==}
     cpu: [loong64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-ppc64-gnu@4.60.2':
     resolution: {integrity: sha512-11+aL5vKheYgczxtPVVRhdptAM2H7fcDR5Gw4/bTcteuZBlH4oP9f5s9zYO9aGZvoGeBpqXI/9TZZihZ609wKw==}
     cpu: [ppc64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-ppc64-musl@4.60.2':
     resolution: {integrity: sha512-i16fokAGK46IVZuV8LIIwMdtqhin9hfYkCh8pf8iC3QU3LpwL+1FSFGej+O7l3E/AoknL6Dclh2oTdnRMpTzFQ==}
     cpu: [ppc64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-riscv64-gnu@4.60.2':
     resolution: {integrity: sha512-49FkKS6RGQoriDSK/6E2GkAsAuU5kETFCh7pG4yD/ylj9rKhTmO3elsnmBvRD4PgJPds5W2PkhC82aVwmUcJ7A==}
     cpu: [riscv64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-riscv64-musl@4.60.2':
     resolution: {integrity: sha512-mjYNkHPfGpUR00DuM1ZZIgs64Hpf4bWcz9Z41+4Q+pgDx73UwWdAYyf6EG/lRFldmdHHzgrYyge5akFUW0D3mQ==}
     cpu: [riscv64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-s390x-gnu@4.60.2':
     resolution: {integrity: sha512-ALyvJz965BQk8E9Al/JDKKDLH2kfKFLTGMlgkAbbYtZuJt9LU8DW3ZoDMCtQpXAltZxwBHevXz5u+gf0yA0YoA==}
     cpu: [s390x]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-x64-gnu@4.60.2':
     resolution: {integrity: sha512-UQjrkIdWrKI626Du8lCQ6MJp/6V1LAo2bOK9OTu4mSn8GGXIkPXk/Vsp4bLHCd9Z9Iz2OTEaokUE90VweJgIYQ==}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-x64-musl@4.60.2':
     resolution: {integrity: sha512-bTsRGj6VlSdn/XD4CGyzMnzaBs9bsRxy79eTqTCBsA8TMIEky7qg48aPkvJvFe1HyzQ5oMZdg7AnVlWQSKLTnw==}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-openbsd-x64@4.60.2':
     resolution: {integrity: sha512-6d4Z3534xitaA1FcMWP7mQPq5zGwBmGbhphh2DwaA1aNIXUu3KTOfwrWpbwI4/Gr0uANo7NTtaykFyO2hPuFLg==}
@@ -721,6 +600,9 @@ packages:
     peerDependencies:
       solid-js: ^1.8.6
 
+  '@standard-schema/spec@1.1.0':
+    resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
+
   '@tailwindcss/node@4.2.0':
     resolution: {integrity: sha512-Yv+fn/o2OmL5fh/Ir62VXItdShnUxfpkMA4Y7jdeC8O81WPB8Kf6TT6GSHvnqgSwDzlB5iT7kDpeXxLsUS0T6Q==}
 
@@ -759,24 +641,28 @@ packages:
     engines: {node: '>= 20'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@tailwindcss/oxide-linux-arm64-musl@4.2.0':
     resolution: {integrity: sha512-XKcSStleEVnbH6W/9DHzZv1YhjE4eSS6zOu2eRtYAIh7aV4o3vIBs+t/B15xlqoxt6ef/0uiqJVB6hkHjWD/0A==}
     engines: {node: '>= 20'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@tailwindcss/oxide-linux-x64-gnu@4.2.0':
     resolution: {integrity: sha512-/hlXCBqn9K6fi7eAM0RsobHwJYa5V/xzWspVTzxnX+Ft9v6n+30Pz8+RxCn7sQL/vRHHLS30iQPrHQunu6/vJA==}
     engines: {node: '>= 20'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@tailwindcss/oxide-linux-x64-musl@4.2.0':
     resolution: {integrity: sha512-lKUaygq4G7sWkhQbfdRRBkaq4LY39IriqBQ+Gk6l5nKq6Ay2M2ZZb1tlIyRNgZKS8cbErTwuYSor0IIULC0SHw==}
     engines: {node: '>= 20'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@tailwindcss/oxide-wasm32-wasi@4.2.0':
     resolution: {integrity: sha512-xuDjhAsFdUuFP5W9Ze4k/o4AskUtI8bcAGU4puTYprr89QaYFmhYOPfP+d1pH+k9ets6RoE23BXZM1X1jJqoyw==}
@@ -831,9 +717,18 @@ packages:
   '@types/babel__traverse@7.28.0':
     resolution: {integrity: sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==}
 
+  '@types/chai@5.2.3':
+    resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
+
+  '@types/deep-eql@4.0.2':
+    resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
+
   '@types/estree@1.0.8':
     resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
 
+  '@types/estree@1.0.9':
+    resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
+
   '@types/json-schema@7.0.15':
     resolution: {integrity: sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==}
 
@@ -899,34 +794,34 @@ packages:
     resolution: {integrity: sha512-q+SL+b+05Ud6LbEE35qe4A99P+htKTKVbyiNEe45eCbJFyh/HVK9QXwlrbz+Q4L8SOW4roxSVwXYj4DMBT7Ieg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@vitest/expect@2.1.9':
-    resolution: {integrity: sha512-UJCIkTBenHeKT1TTlKMJWy1laZewsRIzYighyYiJKZreqtdxSos/S1t+ktRMQWu2CKqaarrkeszJx1cgC5tGZw==}
+  '@vitest/expect@4.1.0':
+    resolution: {integrity: sha512-EIxG7k4wlWweuCLG9Y5InKFwpMEOyrMb6ZJ1ihYu02LVj/bzUwn2VMU+13PinsjRW75XnITeFrQBMH5+dLvCDA==}
 
-  '@vitest/mocker@2.1.9':
-    resolution: {integrity: sha512-tVL6uJgoUdi6icpxmdrn5YNo3g3Dxv+IHJBr0GXHaEdTcw3F+cPKnsXFhli6nO+f/6SDKPHEK1UN+k+TQv0Ehg==}
+  '@vitest/mocker@4.1.0':
+    resolution: {integrity: sha512-evxREh+Hork43+Y4IOhTo+h5lGmVRyjqI739Rz4RlUPqwrkFFDF6EMvOOYjTx4E8Tl6gyCLRL8Mu7Ry12a13Tw==}
     peerDependencies:
       msw: ^2.4.9
-      vite: ^5.0.0
+      vite: ^6.0.0 || ^7.0.0 || ^8.0.0-0
     peerDependenciesMeta:
       msw:
         optional: true
       vite:
         optional: true
 
-  '@vitest/pretty-format@2.1.9':
-    resolution: {integrity: sha512-KhRIdGV2U9HOUzxfiHmY8IFHTdqtOhIzCpd8WRdJiE7D/HUcZVD0EgQCVjm+Q9gkUXWgBvMmTtZgIG48wq7sOQ==}
+  '@vitest/pretty-format@4.1.0':
+    resolution: {integrity: sha512-3RZLZlh88Ib0J7NQTRATfc/3ZPOnSUn2uDBUoGNn5T36+bALixmzphN26OUD3LRXWkJu4H0s5vvUeqBiw+kS0A==}
 
-  '@vitest/runner@2.1.9':
-    resolution: {integrity: sha512-ZXSSqTFIrzduD63btIfEyOmNcBmQvgOVsPNPe0jYtESiXkhd8u2erDLnMxmGrDCwHCCHE7hxwRDCT3pt0esT4g==}
+  '@vitest/runner@4.1.0':
+    resolution: {integrity: sha512-Duvx2OzQ7d6OjchL+trw+aSrb9idh7pnNfxrklo14p3zmNL4qPCDeIJAK+eBKYjkIwG96Bc6vYuxhqDXQOWpoQ==}
 
-  '@vitest/snapshot@2.1.9':
-    resolution: {integrity: sha512-oBO82rEjsxLNJincVhLhaxxZdEtV0EFHMK5Kmx5sJ6H9L183dHECjiefOAdnqpIgT5eZwT04PoggUnW88vOBNQ==}
+  '@vitest/snapshot@4.1.0':
+    resolution: {integrity: sha512-0Vy9euT1kgsnj1CHttwi9i9o+4rRLEaPRSOJ5gyv579GJkNpgJK+B4HSv/rAWixx2wdAFci1X4CEPjiu2bXIMg==}
 
-  '@vitest/spy@2.1.9':
-    resolution: {integrity: sha512-E1B35FwzXXTs9FHNK6bDszs7mtydNi5MIfUWpceJ8Xbfb1gBMscAnwLbEu+B44ed6W3XjL9/ehLPHR1fkf1KLQ==}
+  '@vitest/spy@4.1.0':
+    resolution: {integrity: sha512-pz77k+PgNpyMDv2FV6qmk5ZVau6c3R8HC8v342T2xlFxQKTrSeYw9waIJG8KgV9fFwAtTu4ceRzMivPTH6wSxw==}
 
-  '@vitest/utils@2.1.9':
-    resolution: {integrity: sha512-v0psaMSkNJ3A2NMrUEHFRzJtDPFn+/VWZ5WxImB21T9fjucJRmS7xCS3ppEnARb9y11OAzaD+P2Ps+b+BGX5iQ==}
+  '@vitest/utils@4.1.0':
+    resolution: {integrity: sha512-XfPXT6a8TZY3dcGY8EdwsBulFCIw+BeeX0RZn2x/BtiY/75YGh8FeWGG8QISN/WhaqSrE2OrlDgtF8q5uhOTmw==}
 
   acorn-jsx@5.3.2:
     resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
@@ -1027,10 +922,6 @@ packages:
     engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
     hasBin: true
 
-  cac@6.7.14:
-    resolution: {integrity: sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ==}
-    engines: {node: '>=8'}
-
   call-bind-apply-helpers@1.0.2:
     resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
     engines: {node: '>= 0.4'}
@@ -1050,18 +941,14 @@ packages:
   caniuse-lite@1.0.30001770:
     resolution: {integrity: sha512-x/2CLQ1jHENRbHg5PSId2sXq1CIO1CISvwWAj027ltMVG2UNgW+w9oH2+HzgEIRFembL8bUlXtfbBHR1fCg2xw==}
 
-  chai@5.3.3:
-    resolution: {integrity: sha512-4zNhdJD/iOjSH0A05ea+Ke6MU5mmpQcbQsSOkgdaUMJ9zTlDTD/GYlwohmIE2u0gaxHYiVHEn1Fw9mZ/ktJWgw==}
+  chai@6.2.2:
+    resolution: {integrity: sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==}
     engines: {node: '>=18'}
 
   chalk@4.1.2:
     resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
     engines: {node: '>=10'}
 
-  check-error@2.1.3:
-    resolution: {integrity: sha512-PAJdDJusoxnwm1VwW07VWwUN1sl7smmC3OKggvndJFadxxDRyFJBX/ggnu/KE4kQAB7a3Dp8f/YXC1FlUprWmA==}
-    engines: {node: '>= 16'}
-
   color-convert@2.0.1:
     resolution: {integrity: sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==}
     engines: {node: '>=7.0.0'}
@@ -1106,10 +993,6 @@ packages:
       supports-color:
         optional: true
 
-  deep-eql@5.0.2:
-    resolution: {integrity: sha512-h5k/5U50IJJFpzfL6nO9jaaumfjO/f2NjK/oYB2Djzm4p9L+3T9qWpZqZ2hAbLPuuYq9wrU08WQyBTL5GbPk5Q==}
-    engines: {node: '>=6'}
-
   deep-is@0.1.4:
     resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==}
 
@@ -1155,8 +1038,8 @@ packages:
     resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
     engines: {node: '>= 0.4'}
 
-  es-module-lexer@1.7.0:
-    resolution: {integrity: sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==}
+  es-module-lexer@2.1.0:
+    resolution: {integrity: sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==}
 
   es-object-atoms@1.1.1:
     resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
@@ -1174,11 +1057,6 @@ packages:
     resolution: {integrity: sha512-w+5mJ3GuFL+NjVtJlvydShqE1eN3h3PbI7/5LAsYJP/2qtuMXjfL2LpHSRqo4b4eSF5K/DH1JXKUAHSB2UW50g==}
     engines: {node: '>= 0.4'}
 
-  esbuild@0.21.5:
-    resolution: {integrity: sha512-mg3OPMV4hXywwpoDxu3Qda5xCKQi+vCTZq8S9J/EpkhB2HzKXq4SNFZE3+NK93JYxc8VMSep+lOUSC/RVKaBqw==}
-    engines: {node: '>=12'}
-    hasBin: true
-
   esbuild@0.27.7:
     resolution: {integrity: sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w==}
     engines: {node: '>=18'}
@@ -1611,24 +1489,28 @@ packages:
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   lightningcss-linux-arm64-musl@1.31.1:
     resolution: {integrity: sha512-mVZ7Pg2zIbe3XlNbZJdjs86YViQFoJSpc41CbVmKBPiGmC4YrfeOyz65ms2qpAobVd7WQsbW4PdsSJEMymyIMg==}
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   lightningcss-linux-x64-gnu@1.31.1:
     resolution: {integrity: sha512-xGlFWRMl+0KvUhgySdIaReQdB4FNudfUTARn7q0hh/V67PVGCs3ADFjw+6++kG1RNd0zdGRlEKa+T13/tQjPMA==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   lightningcss-linux-x64-musl@1.31.1:
     resolution: {integrity: sha512-eowF8PrKHw9LpoZii5tdZwnBcYDxRw2rRCyvAXLi34iyeYfqCQNA9rmUM0ce62NlPhCvof1+9ivRaTY6pSKDaA==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   lightningcss-win32-arm64-msvc@1.31.1:
     resolution: {integrity: sha512-aJReEbSEQzx1uBlQizAOBSjcmr9dCdL3XuC/6HLXAxmtErsj2ICo5yYggg1qOODQMtnjNQv2UHb9NpOuFtYe4w==}
@@ -1653,9 +1535,6 @@ packages:
   lodash.merge@4.6.2:
     resolution: {integrity: sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==}
 
-  loupe@3.2.1:
-    resolution: {integrity: sha512-CdzqowRJCeLU72bHvWqwRBBlLcMEtIvGrlvef74kMnV2AolS9Y8xUv1I0U/MNAWMhBlKIoyuEgoJ0t/bbwHbLQ==}
-
   lru-cache@5.1.1:
     resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}
 
@@ -1715,6 +1594,9 @@ packages:
     resolution: {integrity: sha512-gXah6aZrcUxjWg2zR2MwouP2eHlCBzdV4pygudehaKXSGW4v2AsRQUK+lwwXhii6KFZcunEnmSUoYp5CXibxtA==}
     engines: {node: '>= 0.4'}
 
+  obug@2.1.1:
+    resolution: {integrity: sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ==}
+
   optionator@0.9.4:
     resolution: {integrity: sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==}
     engines: {node: '>= 0.8.0'}
@@ -1746,12 +1628,8 @@ packages:
     resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
     engines: {node: '>=8'}
 
-  pathe@1.1.2:
-    resolution: {integrity: sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ==}
-
-  pathval@2.0.1:
-    resolution: {integrity: sha512-//nshmD55c46FuFw26xV/xFAaB5HF9Xdap7HJBBnrKdAd6/GxDBaNA1870O79+9ueg61cZLSVc+OaFlfmObYVQ==}
-    engines: {node: '>= 14.16'}
+  pathe@2.0.3:
+    resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
 
   picocolors@1.1.1:
     resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
@@ -1938,8 +1816,8 @@ packages:
   stackback@0.0.2:
     resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
 
-  std-env@3.10.0:
-    resolution: {integrity: sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==}
+  std-env@4.1.0:
+    resolution: {integrity: sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ==}
 
   stop-iteration-iterator@1.1.0:
     resolution: {integrity: sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ==}
@@ -1982,23 +1860,20 @@ packages:
   tinybench@2.9.0:
     resolution: {integrity: sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==}
 
-  tinyexec@0.3.2:
-    resolution: {integrity: sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA==}
+  tinyexec@1.2.4:
+    resolution: {integrity: sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==}
+    engines: {node: '>=18'}
 
   tinyglobby@0.2.16:
     resolution: {integrity: sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==}
     engines: {node: '>=12.0.0'}
 
-  tinypool@1.1.1:
-    resolution: {integrity: sha512-Zba82s87IFq9A9XmjiX5uZA/ARWDrB03OHlq+Vw1fSdt0I+4/Kutwy8BP4Y/y/aORMo61FQ0vIb5j44vSo5Pkg==}
-    engines: {node: ^18.0.0 || >=20.0.0}
+  tinyglobby@0.2.17:
+    resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
+    engines: {node: '>=12.0.0'}
 
-  tinyrainbow@1.2.0:
-    resolution: {integrity: sha512-weEDEq7Z5eTHPDh4xjX789+fHfF+P8boiFB+0vbWzpbnbsEr/GRaohi/uMKxg8RZMXnl1ItAi/IUHWMsjDV7kQ==}
-    engines: {node: '>=14.0.0'}
-
-  tinyspy@3.0.2:
-    resolution: {integrity: sha512-n1cw8k1k0x4pgA2+9XrOkFydTerNcJ1zWCO5Nn9scWHTD+5tp8dghT2x1uduQePZTZgd3Tupf+x9BxJjeJi77Q==}
+  tinyrainbow@3.1.0:
+    resolution: {integrity: sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==}
     engines: {node: '>=14.0.0'}
 
   ts-api-utils@2.4.0:
@@ -2055,11 +1930,6 @@ packages:
   uri-js@4.4.1:
     resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
 
-  vite-node@2.1.9:
-    resolution: {integrity: sha512-AM9aQ/IPrW/6ENLQg3AGY4K1N2TGZdR5e4gu/MmmR2xR3Ll1+dib+nook92g4TV3PXVyeyxdWwtaCAiUL0hMxA==}
-    engines: {node: ^18.0.0 || >=20.0.0}
-    hasBin: true
-
   vite-plugin-solid@2.11.10:
     resolution: {integrity: sha512-Yr1dQybmtDtDAHkii6hXuc1oVH9CPcS/Zb2jN/P36qqcrkNnVPsMTzQ06jyzFPFjj3U1IYKMVt/9ZqcwGCEbjw==}
     peerDependencies:
@@ -2070,37 +1940,6 @@ packages:
       '@testing-library/jest-dom':
         optional: true
 
-  vite@5.4.21:
-    resolution: {integrity: sha512-o5a9xKjbtuhY6Bi5S3+HvbRERmouabWbyUcpXXUA1u+GNUKoROi9byOJ8M0nHbHYHkYICiMlqxkg1KkYmm25Sw==}
-    engines: {node: ^18.0.0 || >=20.0.0}
-    hasBin: true
-    peerDependencies:
-      '@types/node': ^18.0.0 || >=20.0.0
-      less: '*'
-      lightningcss: ^1.21.0
-      sass: '*'
-      sass-embedded: '*'
-      stylus: '*'
-      sugarss: '*'
-      terser: ^5.4.0
-    peerDependenciesMeta:
-      '@types/node':
-        optional: true
-      less:
-        optional: true
-      lightningcss:
-        optional: true
-      sass:
-        optional: true
-      sass-embedded:
-        optional: true
-      stylus:
-        optional: true
-      sugarss:
-        optional: true
-      terser:
-        optional: true
-
   vite@7.3.2:
     resolution: {integrity: sha512-Bby3NOsna2jsjfLVOHKes8sGwgl4TT0E6vvpYgnAYDIF/tie7MRaFthmKuHx1NSXjiTueXH3do80FMQgvEktRg==}
     engines: {node: ^20.19.0 || >=22.12.0}
@@ -2149,23 +1988,33 @@ packages:
       vite:
         optional: true
 
-  vitest@2.1.9:
-    resolution: {integrity: sha512-MSmPM9REYqDGBI8439mA4mWhV5sKmDlBKWIYbA3lRb2PTHACE0mgKwA8yQ2xq9vxDTuk4iPrECBAEW2aoFXY0Q==}
-    engines: {node: ^18.0.0 || >=20.0.0}
+  vitest@4.1.0:
+    resolution: {integrity: sha512-YbDrMF9jM2Lqc++2530UourxZHmkKLxrs4+mYhEwqWS97WJ7wOYEkcr+QfRgJ3PW9wz3odRijLZjHEaRLTNbqw==}
+    engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
     hasBin: true
     peerDependencies:
       '@edge-runtime/vm': '*'
-      '@types/node': ^18.0.0 || >=20.0.0
-      '@vitest/browser': 2.1.9
-      '@vitest/ui': 2.1.9
+      '@opentelemetry/api': ^1.9.0
+      '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
+      '@vitest/browser-playwright': 4.1.0
+      '@vitest/browser-preview': 4.1.0
+      '@vitest/browser-webdriverio': 4.1.0
+      '@vitest/ui': 4.1.0
       happy-dom: '*'
       jsdom: '*'
+      vite: ^6.0.0 || ^7.0.0 || ^8.0.0-0
     peerDependenciesMeta:
       '@edge-runtime/vm':
         optional: true
+      '@opentelemetry/api':
+        optional: true
       '@types/node':
         optional: true
-      '@vitest/browser':
+      '@vitest/browser-playwright':
+        optional: true
+      '@vitest/browser-preview':
+        optional: true
+      '@vitest/browser-webdriverio':
         optional: true
       '@vitest/ui':
         optional: true
@@ -2359,150 +2208,81 @@ snapshots:
   '@biomejs/cli-win32-x64@2.4.2':
     optional: true
 
-  '@esbuild/aix-ppc64@0.21.5':
-    optional: true
-
   '@esbuild/aix-ppc64@0.27.7':
     optional: true
 
-  '@esbuild/android-arm64@0.21.5':
-    optional: true
-
   '@esbuild/android-arm64@0.27.7':
     optional: true
 
-  '@esbuild/android-arm@0.21.5':
-    optional: true
-
   '@esbuild/android-arm@0.27.7':
     optional: true
 
-  '@esbuild/android-x64@0.21.5':
-    optional: true
-
   '@esbuild/android-x64@0.27.7':
     optional: true
 
-  '@esbuild/darwin-arm64@0.21.5':
-    optional: true
-
   '@esbuild/darwin-arm64@0.27.7':
     optional: true
 
-  '@esbuild/darwin-x64@0.21.5':
-    optional: true
-
   '@esbuild/darwin-x64@0.27.7':
     optional: true
 
-  '@esbuild/freebsd-arm64@0.21.5':
-    optional: true
-
   '@esbuild/freebsd-arm64@0.27.7':
     optional: true
 
-  '@esbuild/freebsd-x64@0.21.5':
-    optional: true
-
   '@esbuild/freebsd-x64@0.27.7':
     optional: true
 
-  '@esbuild/linux-arm64@0.21.5':
-    optional: true
-
   '@esbuild/linux-arm64@0.27.7':
     optional: true
 
-  '@esbuild/linux-arm@0.21.5':
-    optional: true
-
   '@esbuild/linux-arm@0.27.7':
     optional: true
 
-  '@esbuild/linux-ia32@0.21.5':
-    optional: true
-
   '@esbuild/linux-ia32@0.27.7':
     optional: true
 
-  '@esbuild/linux-loong64@0.21.5':
-    optional: true
-
   '@esbuild/linux-loong64@0.27.7':
     optional: true
 
-  '@esbuild/linux-mips64el@0.21.5':
-    optional: true
-
   '@esbuild/linux-mips64el@0.27.7':
     optional: true
 
-  '@esbuild/linux-ppc64@0.21.5':
-    optional: true
-
   '@esbuild/linux-ppc64@0.27.7':
     optional: true
 
-  '@esbuild/linux-riscv64@0.21.5':
-    optional: true
-
   '@esbuild/linux-riscv64@0.27.7':
     optional: true
 
-  '@esbuild/linux-s390x@0.21.5':
-    optional: true
-
   '@esbuild/linux-s390x@0.27.7':
     optional: true
 
-  '@esbuild/linux-x64@0.21.5':
-    optional: true
-
   '@esbuild/linux-x64@0.27.7':
     optional: true
 
   '@esbuild/netbsd-arm64@0.27.7':
     optional: true
 
-  '@esbuild/netbsd-x64@0.21.5':
-    optional: true
-
   '@esbuild/netbsd-x64@0.27.7':
     optional: true
 
   '@esbuild/openbsd-arm64@0.27.7':
     optional: true
 
-  '@esbuild/openbsd-x64@0.21.5':
-    optional: true
-
   '@esbuild/openbsd-x64@0.27.7':
     optional: true
 
   '@esbuild/openharmony-arm64@0.27.7':
     optional: true
 
-  '@esbuild/sunos-x64@0.21.5':
-    optional: true
-
   '@esbuild/sunos-x64@0.27.7':
     optional: true
 
-  '@esbuild/win32-arm64@0.21.5':
-    optional: true
-
   '@esbuild/win32-arm64@0.27.7':
     optional: true
 
-  '@esbuild/win32-ia32@0.21.5':
-    optional: true
-
   '@esbuild/win32-ia32@0.27.7':
     optional: true
 
-  '@esbuild/win32-x64@0.21.5':
-    optional: true
-
   '@esbuild/win32-x64@0.27.7':
     optional: true
 
@@ -2670,6 +2450,8 @@ snapshots:
     dependencies:
       solid-js: 1.9.11
 
+  '@standard-schema/spec@1.1.0': {}
+
   '@tailwindcss/node@4.2.0':
     dependencies:
       '@jridgewell/remapping': 2.3.5
@@ -2766,8 +2548,17 @@ snapshots:
     dependencies:
       '@babel/types': 7.29.0
 
+  '@types/chai@5.2.3':
+    dependencies:
+      '@types/deep-eql': 4.0.2
+      assertion-error: 2.0.1
+
+  '@types/deep-eql@4.0.2': {}
+
   '@types/estree@1.0.8': {}
 
+  '@types/estree@1.0.9': {}
+
   '@types/json-schema@7.0.15': {}
 
   '@types/node@25.2.3':
@@ -2843,7 +2634,7 @@ snapshots:
       debug: 4.4.3
       minimatch: 9.0.5
       semver: 7.7.4
-      tinyglobby: 0.2.16
+      tinyglobby: 0.2.17
       ts-api-utils: 2.4.0(typescript@5.9.3)
       typescript: 5.9.3
     transitivePeerDependencies:
@@ -2865,45 +2656,46 @@ snapshots:
       '@typescript-eslint/types': 8.56.0
       eslint-visitor-keys: 5.0.0
 
-  '@vitest/expect@2.1.9':
+  '@vitest/expect@4.1.0':
     dependencies:
-      '@vitest/spy': 2.1.9
-      '@vitest/utils': 2.1.9
-      chai: 5.3.3
-      tinyrainbow: 1.2.0
+      '@standard-schema/spec': 1.1.0
+      '@types/chai': 5.2.3
+      '@vitest/spy': 4.1.0
+      '@vitest/utils': 4.1.0
+      chai: 6.2.2
+      tinyrainbow: 3.1.0
 
-  '@vitest/mocker@2.1.9(vite@5.4.21(@types/node@25.2.3)(lightningcss@1.31.1))':
+  '@vitest/mocker@4.1.0(vite@7.3.2(@types/node@25.2.3)(jiti@2.6.1)(lightningcss@1.31.1))':
     dependencies:
-      '@vitest/spy': 2.1.9
+      '@vitest/spy': 4.1.0
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
-      vite: 5.4.21(@types/node@25.2.3)(lightningcss@1.31.1)
+      vite: 7.3.2(@types/node@25.2.3)(jiti@2.6.1)(lightningcss@1.31.1)
 
-  '@vitest/pretty-format@2.1.9':
+  '@vitest/pretty-format@4.1.0':
     dependencies:
-      tinyrainbow: 1.2.0
+      tinyrainbow: 3.1.0
 
-  '@vitest/runner@2.1.9':
+  '@vitest/runner@4.1.0':
     dependencies:
-      '@vitest/utils': 2.1.9
-      pathe: 1.1.2
+      '@vitest/utils': 4.1.0
+      pathe: 2.0.3
 
-  '@vitest/snapshot@2.1.9':
+  '@vitest/snapshot@4.1.0':
     dependencies:
-      '@vitest/pretty-format': 2.1.9
+      '@vitest/pretty-format': 4.1.0
+      '@vitest/utils': 4.1.0
       magic-string: 0.30.21
-      pathe: 1.1.2
+      pathe: 2.0.3
 
-  '@vitest/spy@2.1.9':
-    dependencies:
-      tinyspy: 3.0.2
+  '@vitest/spy@4.1.0': {}
 
-  '@vitest/utils@2.1.9':
+  '@vitest/utils@4.1.0':
     dependencies:
-      '@vitest/pretty-format': 2.1.9
-      loupe: 3.2.1
-      tinyrainbow: 1.2.0
+      '@vitest/pretty-format': 4.1.0
+      convert-source-map: 2.0.0
+      tinyrainbow: 3.1.0
 
   acorn-jsx@5.3.2(acorn@8.15.0):
     dependencies:
@@ -3017,8 +2809,6 @@ snapshots:
       node-releases: 2.0.27
       update-browserslist-db: 1.2.3(browserslist@4.28.1)
 
-  cac@6.7.14: {}
-
   call-bind-apply-helpers@1.0.2:
     dependencies:
       es-errors: 1.3.0
@@ -3040,21 +2830,13 @@ snapshots:
 
   caniuse-lite@1.0.30001770: {}
 
-  chai@5.3.3:
-    dependencies:
-      assertion-error: 2.0.1
-      check-error: 2.1.3
-      deep-eql: 5.0.2
-      loupe: 3.2.1
-      pathval: 2.0.1
+  chai@6.2.2: {}
 
   chalk@4.1.2:
     dependencies:
       ansi-styles: 4.3.0
       supports-color: 7.2.0
 
-  check-error@2.1.3: {}
-
   color-convert@2.0.1:
     dependencies:
       color-name: 1.1.4
@@ -3097,8 +2879,6 @@ snapshots:
     dependencies:
       ms: 2.1.3
 
-  deep-eql@5.0.2: {}
-
   deep-is@0.1.4: {}
 
   define-data-property@1.1.4:
@@ -3193,7 +2973,7 @@ snapshots:
 
   es-errors@1.3.0: {}
 
-  es-module-lexer@1.7.0: {}
+  es-module-lexer@2.1.0: {}
 
   es-object-atoms@1.1.1:
     dependencies:
@@ -3216,32 +2996,6 @@ snapshots:
       is-date-object: 1.1.0
       is-symbol: 1.1.1
 
-  esbuild@0.21.5:
-    optionalDependencies:
-      '@esbuild/aix-ppc64': 0.21.5
-      '@esbuild/android-arm': 0.21.5
-      '@esbuild/android-arm64': 0.21.5
-      '@esbuild/android-x64': 0.21.5
-      '@esbuild/darwin-arm64': 0.21.5
-      '@esbuild/darwin-x64': 0.21.5
-      '@esbuild/freebsd-arm64': 0.21.5
-      '@esbuild/freebsd-x64': 0.21.5
-      '@esbuild/linux-arm': 0.21.5
-      '@esbuild/linux-arm64': 0.21.5
-      '@esbuild/linux-ia32': 0.21.5
-      '@esbuild/linux-loong64': 0.21.5
-      '@esbuild/linux-mips64el': 0.21.5
-      '@esbuild/linux-ppc64': 0.21.5
-      '@esbuild/linux-riscv64': 0.21.5
-      '@esbuild/linux-s390x': 0.21.5
-      '@esbuild/linux-x64': 0.21.5
-      '@esbuild/netbsd-x64': 0.21.5
-      '@esbuild/openbsd-x64': 0.21.5
-      '@esbuild/sunos-x64': 0.21.5
-      '@esbuild/win32-arm64': 0.21.5
-      '@esbuild/win32-ia32': 0.21.5
-      '@esbuild/win32-x64': 0.21.5
-
   esbuild@0.27.7:
     optionalDependencies:
       '@esbuild/aix-ppc64': 0.27.7
@@ -3381,7 +3135,7 @@ snapshots:
 
   estree-walker@3.0.3:
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
 
   esutils@2.0.3: {}
 
@@ -3734,8 +3488,6 @@ snapshots:
 
   lodash.merge@4.6.2: {}
 
-  loupe@3.2.1: {}
-
   lru-cache@5.1.1:
     dependencies:
       yallist: 3.1.1
@@ -3795,6 +3547,8 @@ snapshots:
       define-properties: 1.2.1
       es-object-atoms: 1.1.1
 
+  obug@2.1.1: {}
+
   optionator@0.9.4:
     dependencies:
       deep-is: 0.1.4
@@ -3830,9 +3584,7 @@ snapshots:
 
   path-key@3.1.1: {}
 
-  pathe@1.1.2: {}
-
-  pathval@2.0.1: {}
+  pathe@2.0.3: {}
 
   picocolors@1.1.1: {}
 
@@ -4015,7 +3767,7 @@ snapshots:
 
   stackback@0.0.2: {}
 
-  std-env@3.10.0: {}
+  std-env@4.1.0: {}
 
   stop-iteration-iterator@1.1.0:
     dependencies:
@@ -4067,18 +3819,19 @@ snapshots:
 
   tinybench@2.9.0: {}
 
-  tinyexec@0.3.2: {}
+  tinyexec@1.2.4: {}
 
   tinyglobby@0.2.16:
     dependencies:
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
 
-  tinypool@1.1.1: {}
+  tinyglobby@0.2.17:
+    dependencies:
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4
 
-  tinyrainbow@1.2.0: {}
-
-  tinyspy@3.0.2: {}
+  tinyrainbow@3.1.0: {}
 
   ts-api-utils@2.4.0(typescript@5.9.3):
     dependencies:
@@ -4153,24 +3906,6 @@ snapshots:
     dependencies:
       punycode: 2.3.1
 
-  vite-node@2.1.9(@types/node@25.2.3)(lightningcss@1.31.1):
-    dependencies:
-      cac: 6.7.14
-      debug: 4.4.3
-      es-module-lexer: 1.7.0
-      pathe: 1.1.2
-      vite: 5.4.21(@types/node@25.2.3)(lightningcss@1.31.1)
-    transitivePeerDependencies:
-      - '@types/node'
-      - less
-      - lightningcss
-      - sass
-      - sass-embedded
-      - stylus
-      - sugarss
-      - supports-color
-      - terser
-
   vite-plugin-solid@2.11.10(solid-js@1.9.11)(vite@7.3.2(@types/node@25.2.3)(jiti@2.6.1)(lightningcss@1.31.1)):
     dependencies:
       '@babel/core': 7.29.0
@@ -4184,16 +3919,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  vite@5.4.21(@types/node@25.2.3)(lightningcss@1.31.1):
-    dependencies:
-      esbuild: 0.21.5
-      postcss: 8.5.12
-      rollup: 4.60.2
-    optionalDependencies:
-      '@types/node': 25.2.3
-      fsevents: 2.3.3
-      lightningcss: 1.31.1
-
   vite@7.3.2(@types/node@25.2.3)(jiti@2.6.1)(lightningcss@1.31.1):
     dependencies:
       esbuild: 0.27.7
@@ -4212,40 +3937,32 @@ snapshots:
     optionalDependencies:
       vite: 7.3.2(@types/node@25.2.3)(jiti@2.6.1)(lightningcss@1.31.1)
 
-  vitest@2.1.9(@types/node@25.2.3)(lightningcss@1.31.1):
+  vitest@4.1.0(@types/node@25.2.3)(vite@7.3.2(@types/node@25.2.3)(jiti@2.6.1)(lightningcss@1.31.1)):
     dependencies:
-      '@vitest/expect': 2.1.9
-      '@vitest/mocker': 2.1.9(vite@5.4.21(@types/node@25.2.3)(lightningcss@1.31.1))
-      '@vitest/pretty-format': 2.1.9
-      '@vitest/runner': 2.1.9
-      '@vitest/snapshot': 2.1.9
-      '@vitest/spy': 2.1.9
-      '@vitest/utils': 2.1.9
-      chai: 5.3.3
-      debug: 4.4.3
+      '@vitest/expect': 4.1.0
+      '@vitest/mocker': 4.1.0(vite@7.3.2(@types/node@25.2.3)(jiti@2.6.1)(lightningcss@1.31.1))
+      '@vitest/pretty-format': 4.1.0
+      '@vitest/runner': 4.1.0
+      '@vitest/snapshot': 4.1.0
+      '@vitest/spy': 4.1.0
+      '@vitest/utils': 4.1.0
+      es-module-lexer: 2.1.0
       expect-type: 1.3.0
       magic-string: 0.30.21
-      pathe: 1.1.2
-      std-env: 3.10.0
+      obug: 2.1.1
+      pathe: 2.0.3
+      picomatch: 4.0.4
+      std-env: 4.1.0
       tinybench: 2.9.0
-      tinyexec: 0.3.2
-      tinypool: 1.1.1
-      tinyrainbow: 1.2.0
-      vite: 5.4.21(@types/node@25.2.3)(lightningcss@1.31.1)
-      vite-node: 2.1.9(@types/node@25.2.3)(lightningcss@1.31.1)
+      tinyexec: 1.2.4
+      tinyglobby: 0.2.17
+      tinyrainbow: 3.1.0
+      vite: 7.3.2(@types/node@25.2.3)(jiti@2.6.1)(lightningcss@1.31.1)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@types/node': 25.2.3
     transitivePeerDependencies:
-      - less
-      - lightningcss
       - msw
-      - sass
-      - sass-embedded
-      - stylus
-      - sugarss
-      - supports-color
-      - terser
 
   which-boxed-primitive@1.1.1:
     dependencies:
diff --git a/PROJECTS/advanced/honeypot-network/frontend/package.json b/PROJECTS/advanced/honeypot-network/frontend/package.json
index f9465b6b..00486256 100644
--- a/PROJECTS/advanced/honeypot-network/frontend/package.json
+++ b/PROJECTS/advanced/honeypot-network/frontend/package.json
@@ -18,7 +18,7 @@
     "@tanstack/react-query": "^5.72.2",
     "@xterm/addon-fit": "^0.10.0",
     "@xterm/xterm": "^5.5.0",
-    "axios": "^1.15.2",
+    "axios": "^1.16.0",
     "leaflet": "^1.9.4",
     "react": "^19.1.0",
     "react-dom": "^19.1.0",
diff --git a/PROJECTS/advanced/honeypot-network/frontend/pnpm-lock.yaml b/PROJECTS/advanced/honeypot-network/frontend/pnpm-lock.yaml
index efb0ddbe..2a7f16cd 100644
--- a/PROJECTS/advanced/honeypot-network/frontend/pnpm-lock.yaml
+++ b/PROJECTS/advanced/honeypot-network/frontend/pnpm-lock.yaml
@@ -18,8 +18,8 @@ importers:
         specifier: ^5.5.0
         version: 5.5.0
       axios:
-        specifier: ^1.15.2
-        version: 1.15.2
+        specifier: ^1.16.0
+        version: 1.16.0
       leaflet:
         specifier: ^1.9.4
         version: 1.9.4
@@ -196,24 +196,28 @@ packages:
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@biomejs/cli-linux-arm64@2.4.12':
     resolution: {integrity: sha512-tOwuCuZZtKi1jVzbk/5nXmIsziOB6yqN8c9r9QM0EJYPU6DpQWf11uBOSCfFKKM4H3d9ZoarvlgMfbcuD051Pw==}
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@biomejs/cli-linux-x64-musl@2.4.12':
     resolution: {integrity: sha512-dwTIgZrGutzhkQCuvHynCkyW6hJxUuyZqKKO0YNfaS2GUoRO+tOvxXZqZB6SkWAOdfZTzwaw8IEdUnIkHKHoew==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@biomejs/cli-linux-x64@2.4.12':
     resolution: {integrity: sha512-8pFeAnLU9QdW9jCIslB/v82bI0lhBmz2ZAKc8pVMFPO0t0wAHsoEkrUQUbMkIorTRIjbqyNZHA3lEXavsPWYSw==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@biomejs/cli-win32-arm64@2.4.12':
     resolution: {integrity: sha512-B0DLnx0vA9ya/3v7XyCaP+/lCpnbWbMOfUFFve+xb5OxyYvdHaS55YsSddr228Y+JAFk58agCuZTsqNiw2a6ig==}
@@ -499,36 +503,42 @@ packages:
     engines: {node: '>= 10.0.0'}
     cpu: [arm]
     os: [linux]
+    libc: [glibc]
 
   '@parcel/watcher-linux-arm-musl@2.5.6':
     resolution: {integrity: sha512-Ve3gUCG57nuUUSyjBq/MAM0CzArtuIOxsBdQ+ftz6ho8n7s1i9E1Nmk/xmP323r2YL0SONs1EuwqBp2u1k5fxg==}
     engines: {node: '>= 10.0.0'}
     cpu: [arm]
     os: [linux]
+    libc: [musl]
 
   '@parcel/watcher-linux-arm64-glibc@2.5.6':
     resolution: {integrity: sha512-f2g/DT3NhGPdBmMWYoxixqYr3v/UXcmLOYy16Bx0TM20Tchduwr4EaCbmxh1321TABqPGDpS8D/ggOTaljijOA==}
     engines: {node: '>= 10.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@parcel/watcher-linux-arm64-musl@2.5.6':
     resolution: {integrity: sha512-qb6naMDGlbCwdhLj6hgoVKJl2odL34z2sqkC7Z6kzir8b5W65WYDpLB6R06KabvZdgoHI/zxke4b3zR0wAbDTA==}
     engines: {node: '>= 10.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@parcel/watcher-linux-x64-glibc@2.5.6':
     resolution: {integrity: sha512-kbT5wvNQlx7NaGjzPFu8nVIW1rWqV780O7ZtkjuWaPUgpv2NMFpjYERVi0UYj1msZNyCzGlaCWEtzc+exjMGbQ==}
     engines: {node: '>= 10.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@parcel/watcher-linux-x64-musl@2.5.6':
     resolution: {integrity: sha512-1JRFeC+h7RdXwldHzTsmdtYR/Ku8SylLgTU/reMuqdVD7CtLwf0VR1FqeprZ0eHQkO0vqsbvFLXUmYm/uNKJBg==}
     engines: {node: '>= 10.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@parcel/watcher-win32-arm64@2.5.6':
     resolution: {integrity: sha512-3ukyebjc6eGlw9yRt678DxVF7rjXatWiHvTXqphZLvo7aC5NdEgFufVwjFfY51ijYEWpXbqF5jtrK275z52D4Q==}
@@ -596,66 +606,79 @@ packages:
     resolution: {integrity: sha512-L+34Qqil+v5uC0zEubW7uByo78WOCIrBvci69E7sFASRl0X7b/MB6Cqd1lky/CtcSVTydWa2WZwFuWexjS5o6g==}
     cpu: [arm]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-arm-musleabihf@4.60.1':
     resolution: {integrity: sha512-n83O8rt4v34hgFzlkb1ycniJh7IR5RCIqt6mz1VRJD6pmhRi0CXdmfnLu9dIUS6buzh60IvACM842Ffb3xd6Gg==}
     cpu: [arm]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-arm64-gnu@4.60.1':
     resolution: {integrity: sha512-Nql7sTeAzhTAja3QXeAI48+/+GjBJ+QmAH13snn0AJSNL50JsDqotyudHyMbO2RbJkskbMbFJfIJKWA6R1LCJQ==}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-arm64-musl@4.60.1':
     resolution: {integrity: sha512-+pUymDhd0ys9GcKZPPWlFiZ67sTWV5UU6zOJat02M1+PiuSGDziyRuI/pPue3hoUwm2uGfxdL+trT6Z9rxnlMA==}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-loong64-gnu@4.60.1':
     resolution: {integrity: sha512-VSvgvQeIcsEvY4bKDHEDWcpW4Yw7BtlKG1GUT4FzBUlEKQK0rWHYBqQt6Fm2taXS+1bXvJT6kICu5ZwqKCnvlQ==}
     cpu: [loong64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-loong64-musl@4.60.1':
     resolution: {integrity: sha512-4LqhUomJqwe641gsPp6xLfhqWMbQV04KtPp7/dIp0nzPxAkNY1AbwL5W0MQpcalLYk07vaW9Kp1PBhdpZYYcEw==}
     cpu: [loong64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-ppc64-gnu@4.60.1':
     resolution: {integrity: sha512-tLQQ9aPvkBxOc/EUT6j3pyeMD6Hb8QF2BTBnCQWP/uu1lhc9AIrIjKnLYMEroIz/JvtGYgI9dF3AxHZNaEH0rw==}
     cpu: [ppc64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-ppc64-musl@4.60.1':
     resolution: {integrity: sha512-RMxFhJwc9fSXP6PqmAz4cbv3kAyvD1etJFjTx4ONqFP9DkTkXsAMU4v3Vyc5BgzC+anz7nS/9tp4obsKfqkDHg==}
     cpu: [ppc64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-riscv64-gnu@4.60.1':
     resolution: {integrity: sha512-QKgFl+Yc1eEk6MmOBfRHYF6lTxiiiV3/z/BRrbSiW2I7AFTXoBFvdMEyglohPj//2mZS4hDOqeB0H1ACh3sBbg==}
     cpu: [riscv64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-riscv64-musl@4.60.1':
     resolution: {integrity: sha512-RAjXjP/8c6ZtzatZcA1RaQr6O1TRhzC+adn8YZDnChliZHviqIjmvFwHcxi4JKPSDAt6Uhf/7vqcBzQJy0PDJg==}
     cpu: [riscv64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-s390x-gnu@4.60.1':
     resolution: {integrity: sha512-wcuocpaOlaL1COBYiA89O6yfjlp3RwKDeTIA0hM7OpmhR1Bjo9j31G1uQVpDlTvwxGn2nQs65fBFL5UFd76FcQ==}
     cpu: [s390x]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-x64-gnu@4.60.1':
     resolution: {integrity: sha512-77PpsFQUCOiZR9+LQEFg9GClyfkNXj1MP6wRnzYs0EeWbPcHs02AXu4xuUbM1zhwn3wqaizle3AEYg5aeoohhg==}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-x64-musl@4.60.1':
     resolution: {integrity: sha512-5cIATbk5vynAjqqmyBjlciMJl1+R/CwX9oLk/EyiFXDWd95KpHdrOJT//rnUl4cUcskrd0jCCw3wpZnhIHdD9w==}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-openbsd-x64@4.60.1':
     resolution: {integrity: sha512-cl0w09WsCi17mcmWqqglez9Gk8isgeWvoUZ3WiJFYSR3zjBQc2J5/ihSjpl+VLjPqjQ/1hJRcqBfLjssREQILw==}
@@ -797,8 +820,8 @@ packages:
   asynckit@0.4.0:
     resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
 
-  axios@1.15.2:
-    resolution: {integrity: sha512-wLrXxPtcrPTsNlJmKjkPnNPK2Ihe0hn0wGSaTEiHRPxwjvJwT3hKmXF4dpqxmPO9SoNb2FsYXj/xEo0gHN+D5A==}
+  axios@1.16.0:
+    resolution: {integrity: sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==}
 
   baseline-browser-mapping@2.10.19:
     resolution: {integrity: sha512-qCkNLi2sfBOn8XhZQ0FXsT1Ki/Yo5P90hrkRamVFRS7/KV9hpfA4HkoWNU152+8w0zPjnxo5psx5NL3PSGgv5g==}
@@ -974,8 +997,8 @@ packages:
     resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
     engines: {node: '>= 0.4'}
 
-  es-object-atoms@1.1.1:
-    resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
+  es-object-atoms@1.1.2:
+    resolution: {integrity: sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==}
     engines: {node: '>= 0.4'}
 
   es-set-tostringtag@2.1.0:
@@ -1113,8 +1136,8 @@ packages:
     resolution: {integrity: sha512-iZyKG96/JwPz1N55vj2Ie2vXbhu440zfUfJvSwEqEbeLluk7NnapfGqa7LH0mOsnDxTF85Mx8/dyR6HfqcbmbQ==}
     engines: {node: '>=20'}
 
-  hasown@2.0.3:
-    resolution: {integrity: sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==}
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
     engines: {node: '>= 0.4'}
 
   hookified@1.15.1:
@@ -1412,6 +1435,7 @@ packages:
   recharts@2.15.4:
     resolution: {integrity: sha512-UT/q6fwS3c1dHbXv2uFgYJ9BMFHu3fwnd7AYZaEQhXuYQ4hgsxLvsUXzGdKeZrW5xopzDCvuA2N41WJ88I7zIw==}
     engines: {node: '>=14'}
+    deprecated: 1.x and 2.x branches are no longer active. Bump to Recharts v3 to receive latest features and bugfixes. See https://github.com/recharts/recharts/wiki/3.0-migration-guide
     peerDependencies:
       react: ^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
@@ -2226,7 +2250,7 @@ snapshots:
 
   asynckit@0.4.0: {}
 
-  axios@1.15.2:
+  axios@1.16.0:
     dependencies:
       follow-redirects: 1.16.0
       form-data: 4.0.5
@@ -2381,7 +2405,7 @@ snapshots:
 
   es-errors@1.3.0: {}
 
-  es-object-atoms@1.1.1:
+  es-object-atoms@1.1.2:
     dependencies:
       es-errors: 1.3.0
 
@@ -2390,7 +2414,7 @@ snapshots:
       es-errors: 1.3.0
       get-intrinsic: 1.3.0
       has-tostringtag: 1.0.2
-      hasown: 2.0.3
+      hasown: 2.0.4
 
   esbuild@0.25.12:
     optionalDependencies:
@@ -2472,7 +2496,7 @@ snapshots:
       asynckit: 0.4.0
       combined-stream: 1.0.8
       es-set-tostringtag: 2.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       mime-types: 2.1.35
 
   fsevents@2.3.3:
@@ -2489,18 +2513,18 @@ snapshots:
       call-bind-apply-helpers: 1.0.2
       es-define-property: 1.0.1
       es-errors: 1.3.0
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
       function-bind: 1.1.2
       get-proto: 1.0.1
       gopd: 1.2.0
       has-symbols: 1.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       math-intrinsics: 1.1.0
 
   get-proto@1.0.1:
     dependencies:
       dunder-proto: 1.0.1
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
 
   glob-parent@5.1.2:
     dependencies:
@@ -2541,7 +2565,7 @@ snapshots:
     dependencies:
       hookified: 1.15.1
 
-  hasown@2.0.3:
+  hasown@2.0.4:
     dependencies:
       function-bind: 1.1.2
 
diff --git a/PROJECTS/advanced/honeypot-network/frontend/src/components/event-feed.tsx b/PROJECTS/advanced/honeypot-network/frontend/src/components/event-feed.tsx
index c7799aaf..cacfc6af 100644
--- a/PROJECTS/advanced/honeypot-network/frontend/src/components/event-feed.tsx
+++ b/PROJECTS/advanced/honeypot-network/frontend/src/components/event-feed.tsx
@@ -2,8 +2,8 @@
 // event-feed.tsx
 
 import { useWebSocketStore } from '@/core/lib/websocket.store'
-import { ServiceBadge } from './service-badge'
 import styles from './event-feed.module.scss'
+import { ServiceBadge } from './service-badge'
 
 const MAX_VISIBLE = 15
 
diff --git a/PROJECTS/advanced/honeypot-network/frontend/src/components/service-badge.tsx b/PROJECTS/advanced/honeypot-network/frontend/src/components/service-badge.tsx
index 04d20088..72bba415 100644
--- a/PROJECTS/advanced/honeypot-network/frontend/src/components/service-badge.tsx
+++ b/PROJECTS/advanced/honeypot-network/frontend/src/components/service-badge.tsx
@@ -9,9 +9,5 @@ interface ServiceBadgeProps {
 }
 
 export function ServiceBadge({ service }: ServiceBadgeProps) {
-  return (
-    <span className={styles.badge}>
-      {service.toUpperCase()}
-    </span>
-  )
+  return <span className={styles.badge}>{service.toUpperCase()}</span>
 }
diff --git a/PROJECTS/advanced/honeypot-network/frontend/src/core/app/shell.tsx b/PROJECTS/advanced/honeypot-network/frontend/src/core/app/shell.tsx
index c2fbefca..4e976a1e 100644
--- a/PROJECTS/advanced/honeypot-network/frontend/src/core/app/shell.tsx
+++ b/PROJECTS/advanced/honeypot-network/frontend/src/core/app/shell.tsx
@@ -52,9 +52,7 @@ export function Shell() {
 
         <div className={styles.status}>
           <span className={styles.statusLabel}>LINK</span>
-          <span
-            className={connected ? styles.statusOn : styles.statusOff}
-          >
+          <span className={connected ? styles.statusOn : styles.statusOff}>
             {connected ? 'ACTIVE' : 'DOWN'}
           </span>
         </div>
diff --git a/PROJECTS/advanced/honeypot-network/frontend/src/pages/attackers/detail.tsx b/PROJECTS/advanced/honeypot-network/frontend/src/pages/attackers/detail.tsx
index 904c99e2..32c1d76d 100644
--- a/PROJECTS/advanced/honeypot-network/frontend/src/pages/attackers/detail.tsx
+++ b/PROJECTS/advanced/honeypot-network/frontend/src/pages/attackers/detail.tsx
@@ -57,9 +57,7 @@ export function AttackerDetailPage() {
 
         <div className={styles.dossierRow}>
           <span className={styles.dossierLabel}>THREAT SCORE</span>
-          <span
-            className={`${styles.dossierValue} ${styles.threatValue}`}
-          >
+          <span className={`${styles.dossierValue} ${styles.threatValue}`}>
             {attacker.threat_score}
           </span>
         </div>
diff --git a/PROJECTS/advanced/honeypot-network/frontend/src/pages/attackers/index.tsx b/PROJECTS/advanced/honeypot-network/frontend/src/pages/attackers/index.tsx
index b5823ea3..69cdacee 100644
--- a/PROJECTS/advanced/honeypot-network/frontend/src/pages/attackers/index.tsx
+++ b/PROJECTS/advanced/honeypot-network/frontend/src/pages/attackers/index.tsx
@@ -34,10 +34,7 @@ export function AttackersPage() {
             {attackers?.map((a) => (
               <tr key={a.id}>
                 <td>
-                  <Link
-                    to={`/attackers/${a.id}`}
-                    className={styles.link}
-                  >
+                  <Link to={`/attackers/${a.id}`} className={styles.link}>
                     {a.ip}
                   </Link>
                 </td>
diff --git a/PROJECTS/advanced/honeypot-network/frontend/src/pages/dashboard/index.tsx b/PROJECTS/advanced/honeypot-network/frontend/src/pages/dashboard/index.tsx
index 772921c2..67188e5b 100644
--- a/PROJECTS/advanced/honeypot-network/frontend/src/pages/dashboard/index.tsx
+++ b/PROJECTS/advanced/honeypot-network/frontend/src/pages/dashboard/index.tsx
@@ -113,11 +113,7 @@ export function DashboardPage() {
                   axisLine={false}
                 />
                 <Tooltip contentStyle={TOOLTIP_STYLE} cursor={false} />
-                <Bar
-                  dataKey="count"
-                  fill="oklch(70% 0.19 55)"
-                  radius={0}
-                />
+                <Bar dataKey="count" fill="oklch(70% 0.19 55)" radius={0} />
               </BarChart>
             </ResponsiveContainer>
           </div>
@@ -143,28 +139,24 @@ export function DashboardPage() {
           <section className={styles.panel}>
             <h2 className={styles.panelLabel}>Top Usernames</h2>
             <div className={styles.list}>
-              {credentials.top_usernames
-                .slice(0, TOP_CREDS_LIMIT)
-                .map((u) => (
-                  <div key={u.value} className={styles.listRow}>
-                    <span className={styles.listLabel}>{u.value}</span>
-                    <span className={styles.listValue}>{u.count}</span>
-                  </div>
-                ))}
+              {credentials.top_usernames.slice(0, TOP_CREDS_LIMIT).map((u) => (
+                <div key={u.value} className={styles.listRow}>
+                  <span className={styles.listLabel}>{u.value}</span>
+                  <span className={styles.listValue}>{u.count}</span>
+                </div>
+              ))}
             </div>
           </section>
 
           <section className={styles.panel}>
             <h2 className={styles.panelLabel}>Top Passwords</h2>
             <div className={styles.list}>
-              {credentials.top_passwords
-                .slice(0, TOP_CREDS_LIMIT)
-                .map((p) => (
-                  <div key={p.value} className={styles.listRow}>
-                    <span className={styles.listLabel}>{p.value}</span>
-                    <span className={styles.listValue}>{p.count}</span>
-                  </div>
-                ))}
+              {credentials.top_passwords.slice(0, TOP_CREDS_LIMIT).map((p) => (
+                <div key={p.value} className={styles.listRow}>
+                  <span className={styles.listLabel}>{p.value}</span>
+                  <span className={styles.listValue}>{p.count}</span>
+                </div>
+              ))}
             </div>
           </section>
         </div>
diff --git a/PROJECTS/advanced/honeypot-network/frontend/src/pages/events/index.tsx b/PROJECTS/advanced/honeypot-network/frontend/src/pages/events/index.tsx
index 4d15a83a..c752a4b0 100644
--- a/PROJECTS/advanced/honeypot-network/frontend/src/pages/events/index.tsx
+++ b/PROJECTS/advanced/honeypot-network/frontend/src/pages/events/index.tsx
@@ -10,10 +10,7 @@ const PAGE_SIZE = 50
 
 export function EventsPage() {
   const [ipFilter, setIpFilter] = useState('')
-  const { data: events, isLoading } = useEvents(
-    PAGE_SIZE,
-    ipFilter || undefined
-  )
+  const { data: events, isLoading } = useEvents(PAGE_SIZE, ipFilter || undefined)
 
   return (
     <div className={styles.page}>
diff --git a/PROJECTS/advanced/honeypot-network/frontend/src/pages/intel/index.tsx b/PROJECTS/advanced/honeypot-network/frontend/src/pages/intel/index.tsx
index 98b73645..23d2ec21 100644
--- a/PROJECTS/advanced/honeypot-network/frontend/src/pages/intel/index.tsx
+++ b/PROJECTS/advanced/honeypot-network/frontend/src/pages/intel/index.tsx
@@ -27,24 +27,16 @@ export function IntelPage() {
     const res = await apiClient.get(API_ENDPOINTS.IOCS.EXPORT_STIX, {
       responseType: 'text',
     })
-    downloadBlob(
-      res.data as string,
-      'hive-iocs.stix.json',
-      'application/json'
-    )
+    downloadBlob(res.data as string, 'hive-iocs.stix.json', 'application/json')
   }
 
   async function exportBlocklist(format: string) {
-    const res = await apiClient.get(
-      API_ENDPOINTS.IOCS.EXPORT_BLOCKLIST,
-      { params: { format }, responseType: 'text' }
-    )
+    const res = await apiClient.get(API_ENDPOINTS.IOCS.EXPORT_BLOCKLIST, {
+      params: { format },
+      responseType: 'text',
+    })
     const ext = format === 'csv' ? '.csv' : '.txt'
-    downloadBlob(
-      res.data as string,
-      `hive-blocklist${ext}`,
-      'text/plain'
-    )
+    downloadBlob(res.data as string, `hive-blocklist${ext}`, 'text/plain')
   }
 
   return (
@@ -52,18 +44,12 @@ export function IntelPage() {
       <header className={styles.heading}>
         <div className={styles.headingLeft}>
           <h1 className={styles.title}>Intel</h1>
-          <span className={styles.subtitle}>
-            THREAT INTELLIGENCE PRODUCTS
-          </span>
+          <span className={styles.subtitle}>THREAT INTELLIGENCE PRODUCTS</span>
         </div>
 
         <div className={styles.exports}>
           <span className={styles.exportLabel}>EXPORT</span>
-          <button
-            type="button"
-            className={styles.exportBtn}
-            onClick={exportSTIX}
-          >
+          <button type="button" className={styles.exportBtn} onClick={exportSTIX}>
             STIX 2.1
           </button>
           {BLOCKLIST_FORMATS.map((fmt) => (
@@ -103,12 +89,8 @@ export function IntelPage() {
                   <td>{ioc.confidence}%</td>
                   <td>{ioc.sight_count}</td>
                   <td>{ioc.source}</td>
-                  <td>
-                    {new Date(ioc.first_seen).toLocaleDateString()}
-                  </td>
-                  <td>
-                    {new Date(ioc.last_seen).toLocaleDateString()}
-                  </td>
+                  <td>{new Date(ioc.first_seen).toLocaleDateString()}</td>
+                  <td>{new Date(ioc.last_seen).toLocaleDateString()}</td>
                 </tr>
               ))}
             </tbody>
@@ -120,25 +102,20 @@ export function IntelPage() {
               className={styles.pageBtn}
               disabled={offset === 0}
               onClick={() =>
-                setOffset(
-                  Math.max(0, offset - PAGINATION.DEFAULT_LIMIT)
-                )
+                setOffset(Math.max(0, offset - PAGINATION.DEFAULT_LIMIT))
               }
             >
               &#9664; PREV
             </button>
             <span className={styles.pageInfo}>
               {offset + 1}&ndash;
-              {Math.min(offset + PAGINATION.DEFAULT_LIMIT, total)} OF{' '}
-              {total}
+              {Math.min(offset + PAGINATION.DEFAULT_LIMIT, total)} OF {total}
             </span>
             <button
               type="button"
               className={styles.pageBtn}
               disabled={offset + PAGINATION.DEFAULT_LIMIT >= total}
-              onClick={() =>
-                setOffset(offset + PAGINATION.DEFAULT_LIMIT)
-              }
+              onClick={() => setOffset(offset + PAGINATION.DEFAULT_LIMIT)}
             >
               NEXT &#9654;
             </button>
diff --git a/PROJECTS/advanced/honeypot-network/frontend/src/pages/mitre/index.tsx b/PROJECTS/advanced/honeypot-network/frontend/src/pages/mitre/index.tsx
index 86e7b81e..ab8768dc 100644
--- a/PROJECTS/advanced/honeypot-network/frontend/src/pages/mitre/index.tsx
+++ b/PROJECTS/advanced/honeypot-network/frontend/src/pages/mitre/index.tsx
@@ -29,9 +29,7 @@ export function MitrePage() {
   const { data: techniques } = useMitreTechniques()
   const { data: heatmap } = useMitreHeatmap()
 
-  const countMap = new Map(
-    heatmap?.map((h) => [h.technique_id, h.count])
-  )
+  const countMap = new Map(heatmap?.map((h) => [h.technique_id, h.count]))
 
   const byTactic = new Map<string, typeof techniques>()
   for (const t of techniques ?? []) {
@@ -51,9 +49,7 @@ export function MitrePage() {
         <span className={styles.legendLabel}>INTENSITY</span>
         {HEAT_THRESHOLDS.map((t, i) => (
           <span key={t} className={styles.legendItem}>
-            <span
-              className={`${styles.legendSwatch} ${styles[`heat${i}`]}`}
-            />
+            <span className={`${styles.legendSwatch} ${styles[`heat${i}`]}`} />
             <span className={styles.legendText}>{t}+</span>
           </span>
         ))}
@@ -66,9 +62,7 @@ export function MitrePage() {
 
           return (
             <div key={tactic} className={styles.tacticColumn}>
-              <h3 className={styles.tacticLabel}>
-                {tactic.replace(/-/g, ' ')}
-              </h3>
+              <h3 className={styles.tacticLabel}>{tactic.replace(/-/g, ' ')}</h3>
               <div className={styles.techniques}>
                 {techs.map((t) => {
                   const count = countMap.get(t.id) ?? 0
@@ -83,9 +77,7 @@ export function MitrePage() {
                       <span className={styles.techId}>{t.id}</span>
                       <span className={styles.techName}>{t.name}</span>
                       {count > 0 && (
-                        <span className={styles.techCount}>
-                          {count}
-                        </span>
+                        <span className={styles.techCount}>{count}</span>
                       )}
                     </div>
                   )
diff --git a/PROJECTS/advanced/honeypot-network/frontend/src/pages/sessions/detail.tsx b/PROJECTS/advanced/honeypot-network/frontend/src/pages/sessions/detail.tsx
index 8ddb14a6..3c2c541b 100644
--- a/PROJECTS/advanced/honeypot-network/frontend/src/pages/sessions/detail.tsx
+++ b/PROJECTS/advanced/honeypot-network/frontend/src/pages/sessions/detail.tsx
@@ -44,9 +44,7 @@ export function SessionDetailPage() {
         &#8592; SESSIONS
       </Link>
 
-      <h1 className={styles.detailTitle}>
-        SESSION {session.id.slice(0, 8)}
-      </h1>
+      <h1 className={styles.detailTitle}>SESSION {session.id.slice(0, 8)}</h1>
 
       <div className={styles.dossier}>
         {rows.map((row) => (
diff --git a/PROJECTS/advanced/honeypot-network/frontend/src/pages/sessions/index.tsx b/PROJECTS/advanced/honeypot-network/frontend/src/pages/sessions/index.tsx
index cc30599c..9d1829f0 100644
--- a/PROJECTS/advanced/honeypot-network/frontend/src/pages/sessions/index.tsx
+++ b/PROJECTS/advanced/honeypot-network/frontend/src/pages/sessions/index.tsx
@@ -52,10 +52,7 @@ export function SessionsPage() {
                 return (
                   <tr key={s.id}>
                     <td>
-                      <Link
-                        to={`/sessions/${s.id}`}
-                        className={styles.link}
-                      >
+                      <Link to={`/sessions/${s.id}`} className={styles.link}>
                         {s.id.slice(0, 8)}
                       </Link>
                     </td>
@@ -67,9 +64,7 @@ export function SessionsPage() {
                     <td>{s.command_count}</td>
                     <td className={styles.threat}>{s.threat_score}</td>
                     <td>{new Date(s.started_at).toLocaleString()}</td>
-                    <td>
-                      {duration !== null ? `${duration}s` : 'active'}
-                    </td>
+                    <td>{duration !== null ? `${duration}s` : 'active'}</td>
                   </tr>
                 )
               })}
@@ -81,15 +76,12 @@ export function SessionsPage() {
               type="button"
               className={styles.pageBtn}
               disabled={offset === 0}
-              onClick={() =>
-                setOffset(Math.max(0, offset - PAGE_SIZE))
-              }
+              onClick={() => setOffset(Math.max(0, offset - PAGE_SIZE))}
             >
               &#9664; PREV
             </button>
             <span className={styles.pageInfo}>
-              {offset + 1}&ndash;{Math.min(offset + PAGE_SIZE, total)}{' '}
-              OF {total}
+              {offset + 1}&ndash;{Math.min(offset + PAGE_SIZE, total)} OF {total}
             </span>
             <button
               type="button"
diff --git a/PROJECTS/advanced/hsm-emulator/.dockerignore b/PROJECTS/advanced/hsm-emulator/.dockerignore
new file mode 100644
index 00000000..762e4a8b
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/.dockerignore
@@ -0,0 +1,7 @@
+# ©AngelaMos | 2026
+# .dockerignore
+.zig-cache
+zig-out
+docs
+.git
+*.tmp
diff --git a/PROJECTS/advanced/hsm-emulator/.gitignore b/PROJECTS/advanced/hsm-emulator/.gitignore
new file mode 100644
index 00000000..4ec2d165
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/.gitignore
@@ -0,0 +1,13 @@
+# ©AngelaMos | 2026
+# .gitignore
+
+# Zig build artifacts and compilation cache
+.zig-cache/
+zig-out/
+
+# Local-only development docs (handoffs, archives, Zig reference notes)
+docs/
+
+# HSM state files if ever written into the project dir
+.angelamos-hsm-*
+*.tmp
diff --git a/PROJECTS/advanced/hsm-emulator/Dockerfile b/PROJECTS/advanced/hsm-emulator/Dockerfile
new file mode 100644
index 00000000..67e1ed10
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/Dockerfile
@@ -0,0 +1,40 @@
+# ©AngelaMos | 2026
+# Dockerfile
+
+FROM debian:bookworm-slim AS builder
+
+ARG ZIG_VERSION=0.16.0
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates curl xz-utils libssl-dev libc6-dev \
+    && rm -rf /var/lib/apt/lists/*
+RUN curl -fSL "https://ziglang.org/download/${ZIG_VERSION}/zig-x86_64-linux-${ZIG_VERSION}.tar.xz" \
+        -o /tmp/zig.tar.xz \
+    && mkdir -p /opt/zig \
+    && tar -xJf /tmp/zig.tar.xz -C /opt/zig --strip-components=1 \
+    && rm /tmp/zig.tar.xz
+ENV PATH="/opt/zig:${PATH}"
+
+WORKDIR /src
+COPY build.zig build.zig.zon pkcs11.map ./
+COPY src ./src
+COPY vendor ./vendor
+COPY examples ./examples
+COPY tests ./tests
+RUN zig build --release=safe
+
+FROM debian:bookworm-slim AS runtime
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        opensc libssl3 \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /hsm
+COPY --from=builder /src/zig-out/lib/ /hsm/lib/
+COPY docker/demo.sh /hsm/demo.sh
+RUN chmod +x /hsm/demo.sh
+
+ENV HSM_MODULE=/hsm/lib/libhsm.so.0.1.0 \
+    ANGELAMOS_HSM_TOKEN=/hsm/state/token \
+    ANGELAMOS_HSM_OBJECTS=/hsm/state/objects
+
+ENTRYPOINT ["/hsm/demo.sh"]
diff --git a/PROJECTS/advanced/hsm-emulator/LICENSE b/PROJECTS/advanced/hsm-emulator/LICENSE
new file mode 100644
index 00000000..0ad25db4
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/LICENSE
@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published
+    by the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
diff --git a/PROJECTS/advanced/hsm-emulator/README.md b/PROJECTS/advanced/hsm-emulator/README.md
new file mode 100644
index 00000000..35a78e07
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/README.md
@@ -0,0 +1,249 @@
+<!-- ©AngelaMos | 2026 -->
+<!-- README.md -->
+
+```
+██╗  ██╗███████╗███╗   ███╗    ███████╗███╗   ███╗██╗   ██╗██╗      █████╗ ████████╗ ██████╗ ██████╗
+██║  ██║██╔════╝████╗ ████║    ██╔════╝████╗ ████║██║   ██║██║     ██╔══██╗╚══██╔══╝██╔═══██╗██╔══██╗
+███████║███████╗██╔████╔██║    █████╗  ██╔████╔██║██║   ██║██║     ███████║   ██║   ██║   ██║██████╔╝
+██╔══██║╚════██║██║╚██╔╝██║    ██╔══╝  ██║╚██╔╝██║██║   ██║██║     ██╔══██║   ██║   ██║   ██║██╔══██╗
+██║  ██║███████║██║ ╚═╝ ██║    ███████╗██║ ╚═╝ ██║╚██████╔╝███████╗██║  ██║   ██║   ╚██████╔╝██║  ██║
+╚═╝  ╚═╝╚══════╝╚═╝     ╚═╝    ╚══════╝╚═╝     ╚═╝ ╚═════╝ ╚══════╝╚═╝  ╚═╝   ╚═╝    ╚═════╝ ╚═╝  ╚═╝
+```
+
+[![Cybersecurity Projects](https://img.shields.io/badge/Cybersecurity--Projects-Project%20%2333-red?style=flat&logo=github)](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/main/PROJECTS/advanced/hsm-emulator)
+[![Zig](https://img.shields.io/badge/Zig-0.16.0-F7A41D?style=flat&logo=zig&logoColor=white)](https://ziglang.org)
+[![PKCS#11](https://img.shields.io/badge/PKCS%2311-v2.40-4B7BEC?style=flat)](https://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/errata01/os/pkcs11-base-v2.40-errata01-os.html)
+[![Verified with](https://img.shields.io/badge/verified-pkcs11--tool-green?style=flat)](https://github.com/OpenSC/OpenSC)
+[![License: AGPLv3](https://img.shields.io/badge/License-AGPL_v3-purple.svg)](https://www.gnu.org/licenses/agpl-3.0)
+
+> A software **Hardware Security Module** that compiles to a real Cryptoki (PKCS#11) shared object. Load it with `pkcs11-tool`, OpenSSL, or any PKCS#11 host the same way you would a real smartcard or HSM. It speaks the C ABI byte for byte, generates and stores keys, signs and encrypts, and keeps private key material sealed on disk and zeroized in RAM.
+
+[![YouTube Learn Video](https://img.shields.io/badge/YouTube-Learn-red?logo=youtube&logoColor=white)](https://youtu.be/Na-bmX9px4g)
+[![Cybersecurity Project Walkthrough](https://img.youtube.com/vi/Na-bmX9px4g/maxresdefault.jpg)](https://youtu.be/Na-bmX9px4g)
+
+
+## Why PKCS#11 in Zig
+
+PKCS#11 (Cryptoki) is the C-ABI standard that smartcards, YubiKeys, and cloud HSMs all speak. A conforming module is a `.so` that exports one function, `C_GetFunctionList`, returning a 68-entry table of function pointers in a *fixed canonical order*. Get one struct offset or one pointer slot wrong and the host loads garbage.
+
+That makes it a near-perfect showcase for Zig's C interop: `extern struct` with natural alignment, `callconv(.c)`, a version script that exports exactly one symbol, and a hand-written ABI that is **machine-checked against the official OASIS headers at build time**. On top of that ABI sits a real HSM: a login model, an attribute-bag object store, a full set of cryptographic mechanisms, and encrypted-at-rest key storage.
+
+## What Works Today
+
+This is not a stub. A host can drive the module through a complete key lifecycle, and every capability below is exercised by a cross-process `pkcs11-tool` run, an in-process smoke harness against the built `.so`, and unit tests.
+
+**The ABI and the module**
+- Loads under OpenSC `pkcs11-tool` 0.26.1, enumerates the slot and token (`-L`), advertises **21 mechanisms** (`-M`)
+- Exports **only** `C_GetFunctionList` (verified with `objdump -T`); 34 `__ubsan_*` symbols are kept out of the dynamic table
+- The full v2.40 ABI hand-written in `src/ck.zig`: every type, 200+ constants, every struct, and the 68-entry `CK_FUNCTION_LIST` in canonical order
+- A build-time cross-check (`zig build test`) translates the vendored OASIS headers and asserts `@sizeOf` / `@offsetOf` / constant equality **and per-function C-ABI signatures** against `ck.zig`. Spec compliance is a compile-time invariant, not a hope
+
+**Tokens, sessions, login**
+- `C_InitToken` / `C_InitPIN` / `C_SetPIN` / `C_Login` / `C_Logout` with a real Security Officer and User role split
+- PINs are stretched with **Argon2id** (t=3, m=64 MiB, p=1); only salt and hash touch disk, never the PIN
+- Three wrong attempts trip a lockout (`CKR_PIN_LOCKED`), reflected in the token flags
+- Read-only versus read-write session enforcement and the full session state machine
+
+**Objects**
+- `C_CreateObject` / `C_CopyObject` / `C_DestroyObject` / `C_GetObjectSize`
+- Two-call `C_GetAttributeValue`, per-attribute, with `CKR_ATTRIBUTE_SENSITIVE` for sealed key material
+- `C_FindObjects` triad with `CKA_PRIVATE` login gating (private objects are invisible before login)
+- `CKA_MODIFIABLE` / `CKA_DESTROYABLE` honored
+
+**Cryptography**
+- Digest: SHA-256 / SHA-384 / SHA-512, single-shot and multi-part
+- HMAC: HMAC-SHA-256 / 384 / 512, with constant-time tag verification
+- AES: CBC, CBC-PAD, and GCM (128 and 256-bit keys), encrypt and decrypt, with streaming GCM that buffers until the tag verifies
+- ECDSA: P-256 and P-384 keygen, `CKM_ECDSA` and `CKM_ECDSA_SHA256`, cross-verified against OpenSSL
+- RSA via libcrypto: 2048 to 4096-bit keygen, PKCS#1 v1.5, PSS, and OAEP; sign / verify / encrypt / decrypt and Sign / VerifyRecover
+- Key management: `C_GenerateKey` (AES), `C_GenerateKeyPair` (RSA / EC), `C_WrapKey` / `C_UnwrapKey` (AES-KEY-WRAP RFC 3394 and RSA-OAEP), `C_DeriveKey` (ECDH), `C_DigestKey`
+- RNG: `C_GenerateRandom` drawn from `std.Io.randomSecure` (the OS CSPRNG)
+
+**Encrypted at rest, zeroized in RAM**
+- Token objects persist to a file. Sensitive attribute *values* are sealed with AES-256-GCM under a per-token master key
+- The master key is wrapped under a single User-PIN keyslot (Argon2id-derived KEK). There is no Security-Officer keyslot for user secrets by design
+- On `C_Logout`, `C_CloseAllSessions`, and `C_Finalize`, sealed secrets are re-sealed and the master key is wiped with `std.crypto.secureZero`. A failed re-seal fails closed (the plaintext is scrubbed in place)
+
+See [`learn/CONFORMANCE.md`](learn/CONFORMANCE.md) for the precise return code at every deliberate boundary.
+
+## Quick Start
+
+```bash
+git clone https://github.com/CarterPerez-dev/Cybersecurity-Projects.git
+cd Cybersecurity-Projects/PROJECTS/advanced/hsm-emulator
+./install.sh
+```
+
+`install.sh` checks for Zig 0.16, OpenSC, and OpenSSL, builds the module in ReleaseSafe, runs the ABI cross-check plus the smoke test, and confirms `pkcs11-tool` can load it. Then drive it like any real token. Point both storage paths at a scratch directory so you do not write into `$HOME`:
+
+```bash
+export ANGELAMOS_HSM_TOKEN=/tmp/hsm-token
+export ANGELAMOS_HSM_OBJECTS=/tmp/hsm-objects
+MOD=zig-out/lib/libhsm.so
+
+pkcs11-tool --module $MOD -L                    # list slots and token
+pkcs11-tool --module $MOD -M                    # list 21 mechanisms
+
+pkcs11-tool --module $MOD --init-token --label demo --so-pin 12345678
+pkcs11-tool --module $MOD --init-pin --so-pin 12345678 --pin 1234
+pkcs11-tool --module $MOD -l --pin 1234 \
+    --keypairgen --key-type rsa:2048 --label signer
+pkcs11-tool --module $MOD -l --pin 1234 \
+    --sign --mechanism SHA256-RSA-PKCS --label signer \
+    --input-file message.bin --output-file sig.bin
+```
+
+```
+Available slots:
+Slot 0 (0x0): AngelaMos HSM Emulator Slot 0
+  token state:   uninitialized
+```
+
+> [!TIP]
+> This project uses [`just`](https://github.com/casey/just) as a command runner. Type `just` to see everything. `just spy -L` wraps the module in `pkcs11-spy.so` and logs every Cryptoki call with its arguments and return code. It is the fastest way to watch the ABI work.
+>
+> Install: `curl -sSf https://just.systems/install.sh | bash -s -- --to ~/.local/bin`
+
+## Learn
+
+This project ships a full teaching track. Read it in order, or jump to what you need.
+
+| Doc | What it covers |
+|-----|----------------|
+| [`learn/00-OVERVIEW.md`](learn/00-OVERVIEW.md) | What an HSM is, why it exists, and a 10-minute tour |
+| [`learn/01-CONCEPTS.md`](learn/01-CONCEPTS.md) | Key sensitivity, the login model, encryption at rest, constant-time, padding oracles, with real breaches |
+| [`learn/02-ARCHITECTURE.md`](learn/02-ARCHITECTURE.md) | The three-layer design, object model, locking, the threat model |
+| [`learn/03-IMPLEMENTATION.md`](learn/03-IMPLEMENTATION.md) | A code walkthrough of the ABI, an end-to-end operation, and the secret-handling patterns |
+| [`learn/MECHANICS.md`](learn/MECHANICS.md) | How each cryptographic mechanism actually works, byte by byte |
+| [`learn/CONFORMANCE.md`](learn/CONFORMANCE.md) | The v2.40 conformance statement: every narrowed behavior and its exact return code |
+| [`learn/04-CHALLENGES.md`](learn/04-CHALLENGES.md) | Extension ideas from beginner to expert |
+
+## Architecture
+
+The same three-layer split SoftHSM2 uses: a thin C-ABI façade over typed core state over the store and crypto backends.
+
+```
+   PKCS#11 host (pkcs11-tool, OpenSSL, p11-kit)
+                      │  C ABI
+                      ▼
+   ┌───────────────────────────────────────────┐
+   │  C_GetFunctionList  (src/main.zig)          │   one exported symbol,
+   │  68-entry CK_FUNCTION_LIST                  │   one version script
+   └───────────────────────┬─────────────────────┘
+                           │
+   ┌───────────────────────┴─────────────────────┐
+   │  ABI façade   src/ck.zig  +  src/api/*.zig   │   hand-written Cryptoki ABI
+   │  general · slot_token · session · object ·   │   + per-call entry points,
+   │  crypto_ops · keymgmt · random               │   argument and FSM validation
+   └───────────────────────┬─────────────────────┘
+                           │
+   ┌───────────────────────┴─────────────────────┐
+   │  core state   src/core/*.zig                 │   global instance behind a lock,
+   │  state · session · object_store · token      │   sessions, objects, PIN, master key
+   └───────────────────────┬─────────────────────┘
+                           │
+   ┌───────────────────────┴─────────────────────┐
+   │  crypto   src/crypto/*.zig                   │   pure-Zig std.crypto for AES/EC/
+   │  digest · mac · cipher · ecdsa · rsa ·       │   hash/HMAC/ECDH, libcrypto for RSA,
+   │  keystore · pin · openssl                    │   Argon2id KDF, GCM envelope at rest
+   └───────────────────────────────────────────────┘
+```
+
+**Design decisions:** non-RSA crypto is pure-Zig `std.crypto`. RSA links libcrypto (OpenSSL EVP) because `std.crypto` has no public RSA. The RSA binding is hand-written `extern` declarations, not `@cImport`, so the production `.so` exports nothing but `C_GetFunctionList`. The RNG is `std.Io.randomSecure`, which draws fresh entropy from the OS on every call (`getrandom(2)` on Linux) and keeps no CSPRNG state in process memory. The ABI is structured for v2.40 with room to add the v3.0 `C_GetInterface` surface later.
+
+## Build and Test
+
+```bash
+zig build               # build the module → zig-out/lib/libhsm.so (Debug)
+zig build --release=safe # the shipped artifact: ReleaseSafe, UB checks as traps
+zig build test          # ABI cross-check vs OASIS headers + the unit suite
+zig build smoke         # dlopen the built .so and exercise the whole ABI as a host would
+just ci                 # fmt-check + test + smoke
+```
+
+The smoke harness in `examples/smoke.zig` is not a unit test. It `dlopen`s the *actual built shared object* and calls through the function list exactly like an external host, so it catches export and ABI-shape bugs that in-process tests cannot. It walks a full lifecycle: init, login, keygen, sign, encrypt, wrap, derive, GCM streaming, dual-function, recover, operation-state, and the conformance edges.
+
+> [!NOTE]
+> Plain `zig build` produces a **Debug** binary. The shipped artifact is `--release=safe` (ReleaseSafe), which keeps every undefined-behavior check live and turns it into a fail-closed trap rather than silent corruption. Set both `ANGELAMOS_HSM_TOKEN` and `ANGELAMOS_HSM_OBJECTS` to a scratch path for tests and tool runs, or the module falls back to `$HOME/.angelamos-hsm-*`.
+
+## Run in Docker
+
+No Zig or OpenSC on the host? The container builds the module and drives it end to end through `pkcs11-tool`: token init, RSA and EC keygen and signing, AES-CBC round-trip, all inside the image.
+
+```bash
+just docker-demo        # build the image, then run the full pkcs11-tool demo
+```
+
+Or with Docker directly:
+
+```bash
+docker build -t angelamos-hsm:latest .
+docker run --rm angelamos-hsm:latest
+```
+
+A multi-stage build compiles the module in ReleaseSafe in a `debian-slim` builder, then ships only the `.so` plus `opensc` and `libssl3` in a roughly 96 MB runtime image. The demo exits non-zero if any signature fails to verify.
+
+## Project Structure
+
+```
+hsm-emulator/
+├── build.zig              # addLibrary(.dynamic), version script, sanitize_c=.trap,
+│                          #   libcrypto link, translate-c ABI cross-check, test + smoke
+├── build.zig.zon          # package manifest
+├── pkcs11.map             # version script: exports only C_GetFunctionList
+├── src/
+│   ├── ck.zig             # the hand-written Cryptoki v2.40 ABI (types, constants, structs, list)
+│   ├── config.zig         # identity strings, key-size bounds, mechanism list (no magic numbers)
+│   ├── util.zig           # comptime helpers (space-padded fixed fields)
+│   ├── main.zig           # exported C_GetFunctionList + the wired 68-slot table
+│   ├── core/
+│   │   ├── state.zig       # global instance behind a lock, init-args parsing, generation counter
+│   │   ├── lock.zig        # spinlock wrapper over std.atomic.Mutex
+│   │   ├── env.zig         # reads std.c.environ for storage paths at the C boundary
+│   │   ├── token.zig       # token record: PIN slots, fail counters, wrapped master key
+│   │   ├── session.zig     # session table, op-state unions, the RUP-safe GCM buffer
+│   │   └── object_store.zig# attribute-bag objects, the selective-sealing codec
+│   ├── api/
+│   │   ├── general.zig     # C_Initialize / Finalize / GetInfo / WaitForSlotEvent
+│   │   ├── slot_token.zig  # slot + token + mechanism queries, InitToken / InitPIN / SetPIN
+│   │   ├── session.zig     # OpenSession / Login / Logout / Get+SetOperationState
+│   │   ├── object.zig      # CreateObject / Find / GetAttributeValue
+│   │   ├── crypto_ops.zig  # the digest / sign / verify / encrypt / decrypt / dual surface
+│   │   ├── keymgmt.zig     # GenerateKey(Pair) / WrapKey / UnwrapKey / DeriveKey
+│   │   └── random.zig      # GenerateRandom / SeedRandom
+│   └── crypto/
+│       ├── openssl.zig     # hand-written extern EVP/BN/OSSL_PARAM declarations
+│       ├── pin.zig         # Argon2id derive / verify (constant-time)
+│       ├── digest.zig      # SHA-2 hasher union + serializable op-state
+│       ├── mac.zig         # HMAC-SHA-2 union
+│       ├── cipher.zig      # AES-CBC/CBC-PAD/GCM + RFC 3394 key wrap
+│       ├── ecdsa.zig       # P-256/384 keygen, sign, verify, ECDH, curve OID + EC point DER
+│       ├── rsa.zig         # the stateless libcrypto RSA bridge
+│       └── keystore.zig    # master-key gen, wrap/unwrap, seal/unseal envelope
+├── tests/abi_test.zig     # @sizeOf/@offsetOf/constant/signature cross-check vs OASIS
+├── examples/smoke.zig     # loads the built .so via dlopen and drives the whole lifecycle
+└── vendor/pkcs11/         # unmodified OASIS v2.40 headers (build-time cross-check only)
+```
+
+## Roadmap
+
+Each milestone ends with a proof from a real external tool. No feature is "done" until `pkcs11-tool` or OpenSSL exercises it.
+
+| Milestone | Scope | Proof |
+|-----------|-------|-------|
+| **M0** ✅ | Scaffold + hand-written ABI + loadable `.so` | `pkcs11-tool -L/-M`, `objdump -T` |
+| **M1** ✅ | Sessions + login + PIN (Argon2id, lockout) | `--init-token --init-pin --login --change-pin` |
+| **M2** ✅ | Objects + find, `CKA_PRIVATE` gating | `-O --read-object`, two-call attribute fetch |
+| **M3** ✅ | RNG + SHA-2 + HMAC + AES-CBC/CBC-PAD/GCM | `--hash --sign --encrypt --decrypt --generate-random` |
+| **M4** ✅ | ECDSA P-256/384 + keygen | `--keypairgen EC --sign`, cross-verify with OpenSSL |
+| **M5** ✅ | RSA via libcrypto (v1.5 / PSS / OAEP) | sign / verify / encrypt / decrypt through the module |
+| **M6** ✅ | Encrypted store at rest (AES-256-GCM under Argon2id KEK) | survives restart; wrong PIN and tamper fail closed |
+| **M7** ✅ | Hardening (secret zeroization, fail-closed relock) + Docker | leak-checked build, `just docker-demo` exits 0 |
+| **M9** ✅ | Key management: wrap / unwrap, ECDH derive, digest-key | RFC 3394 KAT, ECDH matches `openssl pkeyutl -derive` |
+| **M10** ✅ | Crypto surface: GCM streaming, dual-function, Sign/VerifyRecover, op-state | chunked GCM equals one-shot, recover round-trips |
+| **M11** ✅ | Conformance pass + `CONFORMANCE.md` | every N/A boundary asserted against the built `.so` |
+| **M12** ✅ | Learn modules + mechanism reference | this `learn/` track |
+
+## License
+
+[AGPL 3.0](LICENSE). The vendored OASIS headers under `vendor/pkcs11/` keep their original copyright and are used only for the build-time cross-check.
diff --git a/PROJECTS/advanced/hsm-emulator/build.zig b/PROJECTS/advanced/hsm-emulator/build.zig
new file mode 100644
index 00000000..ca99fe7d
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/build.zig
@@ -0,0 +1,84 @@
+// ©AngelaMos | 2026
+// build.zig
+
+const std = @import("std");
+
+pub fn build(b: *std.Build) void {
+    const target = b.standardTargetOptions(.{});
+    const optimize = b.standardOptimizeOption(.{ .preferred_optimize_mode = .ReleaseSafe });
+
+    const lib = b.addLibrary(.{
+        .name = "hsm",
+        .linkage = .dynamic,
+        .version = .{ .major = 0, .minor = 1, .patch = 0 },
+        .root_module = b.createModule(.{
+            .root_source_file = b.path("src/main.zig"),
+            .target = target,
+            .optimize = optimize,
+            .link_libc = true,
+            .sanitize_c = .trap,
+        }),
+    });
+    lib.root_module.linkSystemLibrary("crypto", .{});
+    lib.setVersionScript(b.path("pkcs11.map"));
+    b.installArtifact(lib);
+
+    const ck_module = b.createModule(.{
+        .root_source_file = b.path("src/ck.zig"),
+        .target = target,
+        .optimize = optimize,
+    });
+
+    const translate_c = b.addTranslateC(.{
+        .root_source_file = b.path("vendor/pkcs11/shim.h"),
+        .target = target,
+        .optimize = optimize,
+    });
+    translate_c.addIncludePath(b.path("vendor/pkcs11"));
+    const p11c_module = translate_c.createModule();
+
+    const tests = b.addTest(.{
+        .root_module = b.createModule(.{
+            .root_source_file = b.path("tests/abi_test.zig"),
+            .target = target,
+            .optimize = optimize,
+            .imports = &.{
+                .{ .name = "ck", .module = ck_module },
+                .{ .name = "p11c", .module = p11c_module },
+            },
+        }),
+    });
+    const run_tests = b.addRunArtifact(tests);
+    const test_step = b.step("test", "Run ABI and unit tests");
+    test_step.dependOn(&run_tests.step);
+
+    const unit_tests = b.addTest(.{
+        .root_module = b.createModule(.{
+            .root_source_file = b.path("src/test_all.zig"),
+            .target = target,
+            .optimize = optimize,
+            .link_libc = true,
+        }),
+    });
+    unit_tests.root_module.linkSystemLibrary("crypto", .{});
+    const run_unit_tests = b.addRunArtifact(unit_tests);
+    test_step.dependOn(&run_unit_tests.step);
+
+    const smoke = b.addExecutable(.{
+        .name = "smoke",
+        .root_module = b.createModule(.{
+            .root_source_file = b.path("examples/smoke.zig"),
+            .target = target,
+            .optimize = optimize,
+            .link_libc = true,
+            .imports = &.{
+                .{ .name = "ck", .module = ck_module },
+            },
+        }),
+    });
+    const run_smoke = b.addRunArtifact(smoke);
+    run_smoke.step.dependOn(b.getInstallStep());
+    if (b.args) |args| run_smoke.addArgs(args);
+    const smoke_step = b.step("smoke", "Load the built .so via dlopen and exercise the Cryptoki ABI");
+    smoke_step.dependOn(&run_smoke.step);
+}
diff --git a/PROJECTS/advanced/hsm-emulator/build.zig.zon b/PROJECTS/advanced/hsm-emulator/build.zig.zon
new file mode 100644
index 00000000..daaae246
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/build.zig.zon
@@ -0,0 +1,16 @@
+// ©AngelaMos | 2026
+// build.zig.zon
+.{
+    .name = .hsm_emulator,
+    .version = "0.1.0",
+    .fingerprint = 0x42f25b5af31e3d64,
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{},
+    .paths = .{
+        "build.zig",
+        "build.zig.zon",
+        "pkcs11.map",
+        "src",
+        "vendor",
+    },
+}
diff --git a/PROJECTS/advanced/hsm-emulator/docker/demo.sh b/PROJECTS/advanced/hsm-emulator/docker/demo.sh
new file mode 100755
index 00000000..f6a66634
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/docker/demo.sh
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# ©AngelaMos | 2026
+# demo.sh
+
+set -euo pipefail
+
+MOD="${HSM_MODULE:-/hsm/lib/libhsm.so.0.1.0}"
+SO_PIN=12345678
+PIN=1234
+WORK="$(mktemp -d)"
+mkdir -p "$(dirname "$ANGELAMOS_HSM_TOKEN")" "$(dirname "$ANGELAMOS_HSM_OBJECTS")"
+
+line() { printf '\n\033[1m== %s ==\033[0m\n' "$1"; }
+
+line "AngelaMos HSM — PKCS#11 module loaded by OpenSC pkcs11-tool"
+pkcs11-tool --module "$MOD" --init-token --label angelamos --so-pin "$SO_PIN" >/dev/null
+pkcs11-tool --module "$MOD" --init-pin --so-pin "$SO_PIN" --pin "$PIN" >/dev/null
+pkcs11-tool --module "$MOD" -I
+
+line "Supported mechanisms"
+pkcs11-tool --module "$MOD" -M
+
+line "RSA-2048 — generate, sign (SHA256-RSA-PKCS), verify"
+pkcs11-tool --module "$MOD" --login --pin "$PIN" --keypairgen --key-type RSA:2048 --label rsa --id 01 2>/dev/null
+printf 'invoice #42 total $1000' > "$WORK/msg"
+pkcs11-tool --module "$MOD" --login --pin "$PIN" --sign --mechanism SHA256-RSA-PKCS --id 01 -i "$WORK/msg" -o "$WORK/rsa.sig" 2>/dev/null
+pkcs11-tool --module "$MOD" --login --pin "$PIN" --verify --mechanism SHA256-RSA-PKCS --id 01 -i "$WORK/msg" --signature-file "$WORK/rsa.sig"
+
+line "EC P-256 — generate, sign (ECDSA-SHA256), verify"
+pkcs11-tool --module "$MOD" --login --pin "$PIN" --keypairgen --key-type EC:prime256v1 --label ec --id 02 2>/dev/null
+pkcs11-tool --module "$MOD" --login --pin "$PIN" --sign --mechanism ECDSA-SHA256 --id 02 -i "$WORK/msg" -o "$WORK/ec.sig" 2>/dev/null
+pkcs11-tool --module "$MOD" --login --pin "$PIN" --verify --mechanism ECDSA-SHA256 --id 02 -i "$WORK/msg" --signature-file "$WORK/ec.sig"
+
+line "AES-256 — generate, encrypt (AES-CBC), decrypt, compare"
+pkcs11-tool --module "$MOD" --login --pin "$PIN" --keygen --key-type AES:32 --label aes --id 03 2>/dev/null
+printf '0123456789ABCDEF' > "$WORK/pt"
+IV=000102030405060708090a0b0c0d0e0f
+pkcs11-tool --module "$MOD" --login --pin "$PIN" --encrypt --mechanism AES-CBC --id 03 --iv "$IV" -i "$WORK/pt" -o "$WORK/ct" 2>/dev/null
+pkcs11-tool --module "$MOD" --login --pin "$PIN" --decrypt --mechanism AES-CBC --id 03 --iv "$IV" -i "$WORK/ct" -o "$WORK/dec" 2>/dev/null
+if cmp -s "$WORK/pt" "$WORK/dec"; then
+    echo "AES-CBC round-trip: plaintext recovered OK"
+else
+    echo "AES-CBC round-trip: MISMATCH" && exit 1
+fi
+
+line "Token objects (private material sealed at rest under Argon2id(User-PIN))"
+pkcs11-tool --module "$MOD" --login --pin "$PIN" -O
+
+line "Demo complete — RSA + ECDSA signatures verified, AES-CBC round-trip OK"
diff --git a/PROJECTS/advanced/hsm-emulator/examples/smoke.zig b/PROJECTS/advanced/hsm-emulator/examples/smoke.zig
new file mode 100644
index 00000000..876eee58
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/examples/smoke.zig
@@ -0,0 +1,717 @@
+// ©AngelaMos | 2026
+// smoke.zig
+
+const std = @import("std");
+const ck = @import("ck");
+
+const GetFunctionList = *const fn (*?*ck.CK_FUNCTION_LIST) callconv(.c) ck.CK_RV;
+
+const default_module = "zig-out/lib/libhsm.so";
+const smoke_token = "/tmp/angelamos-hsm-smoke-token.bin";
+const smoke_objects = "/tmp/angelamos-hsm-smoke-objects.bin";
+
+extern "c" fn setenv(name: [*:0]const u8, value: [*:0]const u8, overwrite: c_int) c_int;
+
+pub fn main() !void {
+    _ = setenv("ANGELAMOS_HSM_TOKEN", smoke_token, 1);
+    _ = setenv("ANGELAMOS_HSM_OBJECTS", smoke_objects, 1);
+    _ = std.c.unlink(smoke_token);
+    _ = std.c.unlink(smoke_objects);
+    defer _ = std.c.unlink(smoke_token);
+    defer _ = std.c.unlink(smoke_objects);
+
+    var so_pin = "12345678".*;
+    var user_pin = "1234".*;
+    var new_user_pin = "5678".*;
+    var wrong_pin = "0000".*;
+    var short_pin = "12".*;
+    var label: [32]u8 = @splat(' ');
+    @memcpy(label[0..11], "smoke-token");
+
+    var lib = try std.DynLib.open(default_module);
+    defer lib.close();
+
+    const getFunctionList = lib.lookup(GetFunctionList, "C_GetFunctionList") orelse {
+        std.debug.print("smoke: C_GetFunctionList not exported\n", .{});
+        return error.SymbolNotFound;
+    };
+
+    var list_ptr: ?*ck.CK_FUNCTION_LIST = null;
+    try check("C_GetFunctionList", getFunctionList(&list_ptr));
+    const f = list_ptr orelse return error.NullFunctionList;
+
+    if (f.version.major != 2 or f.version.minor != 40) return error.UnexpectedVersion;
+
+    try check("C_Initialize", f.C_Initialize.?(null));
+    if (f.C_Initialize.?(null) != ck.CKR_CRYPTOKI_ALREADY_INITIALIZED) return error.DoubleInitNotRejected;
+
+    var info: ck.CK_INFO = undefined;
+    try check("C_GetInfo", f.C_GetInfo.?(&info));
+
+    var count: ck.CK_ULONG = 0;
+    try check("C_GetSlotList(size)", f.C_GetSlotList.?(ck.CK_FALSE, null, &count));
+    if (count != 1) return error.UnexpectedSlotCount;
+    var slots: [4]ck.CK_SLOT_ID = undefined;
+    try check("C_GetSlotList(fill)", f.C_GetSlotList.?(ck.CK_FALSE, &slots, &count));
+    const slot = slots[0];
+
+    var slot_info: ck.CK_SLOT_INFO = undefined;
+    try check("C_GetSlotInfo", f.C_GetSlotInfo.?(slot, &slot_info));
+
+    var token_info: ck.CK_TOKEN_INFO = undefined;
+    try check("C_GetTokenInfo", f.C_GetTokenInfo.?(slot, &token_info));
+    if (token_info.flags & ck.CKF_TOKEN_INITIALIZED != 0) return error.TokenShouldStartUninitialized;
+
+    var mech_count: ck.CK_ULONG = 0;
+    try check("C_GetMechanismList(size)", f.C_GetMechanismList.?(slot, null, &mech_count));
+    if (mech_count == 0) return error.NoMechanisms;
+
+    if (f.C_InitToken.?(slot, &short_pin, short_pin.len, &label) != ck.CKR_PIN_LEN_RANGE) return error.ShortSoPinNotRejected;
+    try check("C_InitToken", f.C_InitToken.?(slot, &so_pin, so_pin.len, &label));
+    try check("C_GetTokenInfo(post-init)", f.C_GetTokenInfo.?(slot, &token_info));
+    if (token_info.flags & ck.CKF_TOKEN_INITIALIZED == 0) return error.InitTokenDidNotInitialize;
+
+    var h: ck.CK_SESSION_HANDLE = 0;
+    try check("C_OpenSession", f.C_OpenSession.?(slot, ck.CKF_SERIAL_SESSION | ck.CKF_RW_SESSION, null, null, &h));
+
+    var si: ck.CK_SESSION_INFO = undefined;
+    try check("C_GetSessionInfo", f.C_GetSessionInfo.?(h, &si));
+    if (si.state != ck.CKS_RW_PUBLIC_SESSION) return error.UnexpectedPublicState;
+
+    try check("C_Login(SO)", f.C_Login.?(h, ck.CKU_SO, &so_pin, so_pin.len));
+    try check("C_GetSessionInfo(SO)", f.C_GetSessionInfo.?(h, &si));
+    if (si.state != ck.CKS_RW_SO_FUNCTIONS) return error.UnexpectedSoState;
+
+    if (f.C_InitPIN.?(h, &short_pin, short_pin.len) != ck.CKR_PIN_LEN_RANGE) return error.ShortUserPinNotRejected;
+    try check("C_InitPIN", f.C_InitPIN.?(h, &user_pin, user_pin.len));
+    try check("C_Logout(SO)", f.C_Logout.?(h));
+
+    try check("C_GetTokenInfo(post-initpin)", f.C_GetTokenInfo.?(slot, &token_info));
+    if (token_info.flags & ck.CKF_USER_PIN_INITIALIZED == 0) return error.UserPinNotInitialized;
+
+    try check("C_Login(USER)", f.C_Login.?(h, ck.CKU_USER, &user_pin, user_pin.len));
+    try check("C_GetSessionInfo(USER)", f.C_GetSessionInfo.?(h, &si));
+    if (si.state != ck.CKS_RW_USER_FUNCTIONS) return error.UnexpectedUserState;
+
+    if (f.C_SetPIN.?(h, &user_pin, user_pin.len, &short_pin, short_pin.len) != ck.CKR_PIN_LEN_RANGE) return error.ShortNewPinNotRejected;
+    try check("C_SetPIN", f.C_SetPIN.?(h, &user_pin, user_pin.len, &new_user_pin, new_user_pin.len));
+    try check("C_Logout(USER)", f.C_Logout.?(h));
+
+    try check("C_Login(USER,new)", f.C_Login.?(h, ck.CKU_USER, &new_user_pin, new_user_pin.len));
+
+    var class_data: ck.CK_OBJECT_CLASS = ck.CKO_DATA;
+    var ck_true: ck.CK_BBOOL = ck.CK_TRUE;
+    var data_label = "smoke-data".*;
+    var data_value = "hello-hsm".*;
+    var create_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_CLASS, .pValue = &class_data, .ulValueLen = @sizeOf(ck.CK_OBJECT_CLASS) },
+        .{ .type = ck.CKA_LABEL, .pValue = &data_label, .ulValueLen = data_label.len },
+        .{ .type = ck.CKA_VALUE, .pValue = &data_value, .ulValueLen = data_value.len },
+    };
+    var h_data: ck.CK_OBJECT_HANDLE = 0;
+    try check("C_CreateObject(data)", f.C_CreateObject.?(h, &create_tmpl, create_tmpl.len, &h_data));
+    if (h_data == ck.CK_INVALID_HANDLE) return error.BadObjectHandle;
+
+    var priv_label = "smoke-secret".*;
+    var priv_value = "top-secret".*;
+    var priv_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_CLASS, .pValue = &class_data, .ulValueLen = @sizeOf(ck.CK_OBJECT_CLASS) },
+        .{ .type = ck.CKA_PRIVATE, .pValue = &ck_true, .ulValueLen = 1 },
+        .{ .type = ck.CKA_LABEL, .pValue = &priv_label, .ulValueLen = priv_label.len },
+        .{ .type = ck.CKA_VALUE, .pValue = &priv_value, .ulValueLen = priv_value.len },
+    };
+    var h_priv: ck.CK_OBJECT_HANDLE = 0;
+    try check("C_CreateObject(private)", f.C_CreateObject.?(h, &priv_tmpl, priv_tmpl.len, &h_priv));
+
+    var find_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_CLASS, .pValue = &class_data, .ulValueLen = @sizeOf(ck.CK_OBJECT_CLASS) },
+    };
+    var found: [8]ck.CK_OBJECT_HANDLE = undefined;
+    var nfound: ck.CK_ULONG = 0;
+    try check("C_FindObjectsInit", f.C_FindObjectsInit.?(h, &find_tmpl, find_tmpl.len));
+    try check("C_FindObjects", f.C_FindObjects.?(h, &found, found.len, &nfound));
+    try check("C_FindObjectsFinal", f.C_FindObjectsFinal.?(h));
+    if (nfound != 2) return error.FindCountWrong;
+
+    var probe = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_VALUE, .pValue = null, .ulValueLen = 0 },
+    };
+    try check("C_GetAttributeValue(len)", f.C_GetAttributeValue.?(h, h_data, &probe, probe.len));
+    if (probe[0].ulValueLen != data_value.len) return error.LenProbeWrong;
+    var valbuf: [64]u8 = undefined;
+    probe[0].pValue = &valbuf;
+    try check("C_GetAttributeValue(fetch)", f.C_GetAttributeValue.?(h, h_data, &probe, probe.len));
+    if (!std.mem.eql(u8, valbuf[0..probe[0].ulValueLen], &data_value)) return error.ValueMismatch;
+
+    var new_label = "relabeled!!".*;
+    var set_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_LABEL, .pValue = &new_label, .ulValueLen = new_label.len },
+    };
+    try check("C_SetAttributeValue", f.C_SetAttributeValue.?(h, h_data, &set_tmpl, set_tmpl.len));
+    var lblbuf: [32]u8 = undefined;
+    var lblq = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_LABEL, .pValue = &lblbuf, .ulValueLen = lblbuf.len },
+    };
+    try check("C_GetAttributeValue(label)", f.C_GetAttributeValue.?(h, h_data, &lblq, lblq.len));
+    if (!std.mem.eql(u8, lblbuf[0..lblq[0].ulValueLen], &new_label)) return error.RelabelFailed;
+
+    var osize: ck.CK_ULONG = 0;
+    try check("C_GetObjectSize", f.C_GetObjectSize.?(h, h_data, &osize));
+    if (osize == 0) return error.ZeroObjectSize;
+
+    try check("C_DestroyObject", f.C_DestroyObject.?(h, h_data));
+    if (f.C_FindObjects.?(h, &found, found.len, &nfound) != ck.CKR_OPERATION_NOT_INITIALIZED) return error.FsmNotEnforced;
+
+    try check("C_Logout(after-objects)", f.C_Logout.?(h));
+    try check("C_FindObjectsInit(public)", f.C_FindObjectsInit.?(h, null, 0));
+    try check("C_FindObjects(public)", f.C_FindObjects.?(h, &found, found.len, &nfound));
+    try check("C_FindObjectsFinal(public)", f.C_FindObjectsFinal.?(h));
+    if (nfound != 0) return error.PrivateObjectLeaked;
+    if (f.C_GetAttributeValue.?(h, h_priv, &lblq, lblq.len) != ck.CKR_OBJECT_HANDLE_INVALID) return error.PrivateNotGated;
+
+    var ck_false: ck.CK_BBOOL = ck.CK_FALSE;
+    var undead_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_CLASS, .pValue = &class_data, .ulValueLen = @sizeOf(ck.CK_OBJECT_CLASS) },
+        .{ .type = ck.CKA_DESTROYABLE, .pValue = &ck_false, .ulValueLen = 1 },
+    };
+    var h_undead: ck.CK_OBJECT_HANDLE = 0;
+    try check("C_CreateObject(undestroyable)", f.C_CreateObject.?(h, &undead_tmpl, undead_tmpl.len, &h_undead));
+    if (f.C_DestroyObject.?(h, h_undead) != ck.CKR_ACTION_PROHIBITED) return error.DestroyableGateBroken;
+
+    var immut_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_CLASS, .pValue = &class_data, .ulValueLen = @sizeOf(ck.CK_OBJECT_CLASS) },
+        .{ .type = ck.CKA_MODIFIABLE, .pValue = &ck_false, .ulValueLen = 1 },
+    };
+    var h_immut: ck.CK_OBJECT_HANDLE = 0;
+    try check("C_CreateObject(immutable)", f.C_CreateObject.?(h, &immut_tmpl, immut_tmpl.len, &h_immut));
+    var nope = "nope".*;
+    var set_immut = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_LABEL, .pValue = &nope, .ulValueLen = nope.len },
+    };
+    if (f.C_SetAttributeValue.?(h, h_immut, &set_immut, set_immut.len) != ck.CKR_ACTION_PROHIBITED) return error.ModifiableGateBroken;
+
+    if (f.C_FindObjectsInit.?(h, null, 3) != ck.CKR_ARGUMENTS_BAD) return error.ArgsBadNotEnforced;
+
+    var attempt: u8 = 0;
+    while (attempt < 3) : (attempt += 1) {
+        if (f.C_Login.?(h, ck.CKU_USER, &wrong_pin, wrong_pin.len) != ck.CKR_PIN_INCORRECT) return error.WrongPinNotRejected;
+    }
+    if (f.C_Login.?(h, ck.CKU_USER, &new_user_pin, new_user_pin.len) != ck.CKR_PIN_LOCKED) return error.LockoutNotEnforced;
+    try check("C_GetTokenInfo(locked)", f.C_GetTokenInfo.?(slot, &token_info));
+    if (token_info.flags & ck.CKF_USER_PIN_LOCKED == 0) return error.LockFlagNotSet;
+
+    var sha_mech = ck.CK_MECHANISM{ .mechanism = ck.CKM_SHA256, .pParameter = null, .ulParameterLen = 0 };
+    try check("C_DigestInit", f.C_DigestInit.?(h, &sha_mech));
+    var abc = "abc".*;
+    var dg: [64]u8 = undefined;
+    var dglen: ck.CK_ULONG = dg.len;
+    try check("C_Digest", f.C_Digest.?(h, &abc, abc.len, &dg, &dglen));
+    const sha_abc = [_]u8{
+        0xba, 0x78, 0x16, 0xbf, 0x8f, 0x01, 0xcf, 0xea, 0x41, 0x41, 0x40, 0xde, 0x5d, 0xae, 0x22, 0x23,
+        0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c, 0xb4, 0x10, 0xff, 0x61, 0xf2, 0x00, 0x15, 0xad,
+    };
+    if (dglen != 32 or !std.mem.eql(u8, dg[0..32], &sha_abc)) return error.DigestVectorMismatch;
+
+    var class_secret: ck.CK_OBJECT_CLASS = ck.CKO_SECRET_KEY;
+    var ck_yes: ck.CK_BBOOL = ck.CK_TRUE;
+    var kt_generic: ck.CK_KEY_TYPE = ck.CKK_GENERIC_SECRET;
+    var hkey_val = "secret-hmac-key".*;
+    var hmac_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_CLASS, .pValue = &class_secret, .ulValueLen = @sizeOf(ck.CK_OBJECT_CLASS) },
+        .{ .type = ck.CKA_KEY_TYPE, .pValue = &kt_generic, .ulValueLen = @sizeOf(ck.CK_KEY_TYPE) },
+        .{ .type = ck.CKA_VALUE, .pValue = &hkey_val, .ulValueLen = hkey_val.len },
+        .{ .type = ck.CKA_SIGN, .pValue = &ck_yes, .ulValueLen = 1 },
+        .{ .type = ck.CKA_VERIFY, .pValue = &ck_yes, .ulValueLen = 1 },
+    };
+    var h_hmac: ck.CK_OBJECT_HANDLE = 0;
+    try check("C_CreateObject(hmac key)", f.C_CreateObject.?(h, &hmac_tmpl, hmac_tmpl.len, &h_hmac));
+
+    var hmac_mech = ck.CK_MECHANISM{ .mechanism = ck.CKM_SHA256_HMAC, .pParameter = null, .ulParameterLen = 0 };
+    var hmsg = "authenticate me".*;
+    var sig: [64]u8 = undefined;
+    var siglen: ck.CK_ULONG = sig.len;
+    try check("C_SignInit", f.C_SignInit.?(h, &hmac_mech, h_hmac));
+    try check("C_Sign", f.C_Sign.?(h, &hmsg, hmsg.len, &sig, &siglen));
+    if (siglen != 32) return error.HmacLenWrong;
+    try check("C_VerifyInit", f.C_VerifyInit.?(h, &hmac_mech, h_hmac));
+    try check("C_Verify", f.C_Verify.?(h, &hmsg, hmsg.len, &sig, siglen));
+    try check("C_VerifyInit(tamper)", f.C_VerifyInit.?(h, &hmac_mech, h_hmac));
+    sig[0] ^= 0xff;
+    if (f.C_Verify.?(h, &hmsg, hmsg.len, &sig, siglen) != ck.CKR_SIGNATURE_INVALID) return error.HmacTamperNotDetected;
+
+    var kt_aes: ck.CK_KEY_TYPE = ck.CKK_AES;
+    var aes_val = [_]u8{0} ** 32;
+    for (0..32) |j| aes_val[j] = @intCast(j);
+    var aes_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_CLASS, .pValue = &class_secret, .ulValueLen = @sizeOf(ck.CK_OBJECT_CLASS) },
+        .{ .type = ck.CKA_KEY_TYPE, .pValue = &kt_aes, .ulValueLen = @sizeOf(ck.CK_KEY_TYPE) },
+        .{ .type = ck.CKA_VALUE, .pValue = &aes_val, .ulValueLen = aes_val.len },
+        .{ .type = ck.CKA_ENCRYPT, .pValue = &ck_yes, .ulValueLen = 1 },
+        .{ .type = ck.CKA_DECRYPT, .pValue = &ck_yes, .ulValueLen = 1 },
+    };
+    var h_aes: ck.CK_OBJECT_HANDLE = 0;
+    try check("C_CreateObject(aes key)", f.C_CreateObject.?(h, &aes_tmpl, aes_tmpl.len, &h_aes));
+
+    var iv = [_]u8{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 };
+    var cbc_mech = ck.CK_MECHANISM{ .mechanism = ck.CKM_AES_CBC_PAD, .pParameter = &iv, .ulParameterLen = iv.len };
+    var aes_pt = "AES round-trip through the Cryptoki ABI".*;
+    var aes_ct: [64]u8 = undefined;
+    var ctlen: ck.CK_ULONG = aes_ct.len;
+    try check("C_EncryptInit", f.C_EncryptInit.?(h, &cbc_mech, h_aes));
+    try check("C_Encrypt", f.C_Encrypt.?(h, &aes_pt, aes_pt.len, &aes_ct, &ctlen));
+    var aes_back: [64]u8 = undefined;
+    var backlen: ck.CK_ULONG = aes_back.len;
+    try check("C_DecryptInit", f.C_DecryptInit.?(h, &cbc_mech, h_aes));
+    try check("C_Decrypt", f.C_Decrypt.?(h, &aes_ct, ctlen, &aes_back, &backlen));
+    if (backlen != aes_pt.len or !std.mem.eql(u8, aes_back[0..backlen], &aes_pt)) return error.AesRoundTripFailed;
+
+    var gen_keylen: ck.CK_ULONG = 32;
+    var gen_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_VALUE_LEN, .pValue = &gen_keylen, .ulValueLen = @sizeOf(ck.CK_ULONG) },
+    };
+    var gen_mech = ck.CK_MECHANISM{ .mechanism = ck.CKM_AES_KEY_GEN, .pParameter = null, .ulParameterLen = 0 };
+    var h_gen: ck.CK_OBJECT_HANDLE = 0;
+    try check("C_GenerateKey", f.C_GenerateKey.?(h, &gen_mech, &gen_tmpl, gen_tmpl.len, &h_gen));
+    var genval_q = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_VALUE, .pValue = null, .ulValueLen = 0 },
+    };
+    if (f.C_GetAttributeValue.?(h, h_gen, &genval_q, genval_q.len) != ck.CKR_ATTRIBUTE_SENSITIVE) return error.GeneratedKeyNotSensitive;
+
+    var ec_params = [_]u8{ 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07 };
+    var ec_kpgen = ck.CK_MECHANISM{ .mechanism = ck.CKM_EC_KEY_PAIR_GEN, .pParameter = null, .ulParameterLen = 0 };
+    var ecpub_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_EC_PARAMS, .pValue = &ec_params, .ulValueLen = ec_params.len },
+        .{ .type = ck.CKA_VERIFY, .pValue = &ck_yes, .ulValueLen = 1 },
+    };
+    var ecpriv_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_SIGN, .pValue = &ck_yes, .ulValueLen = 1 },
+        .{ .type = ck.CKA_PRIVATE, .pValue = &ck_false, .ulValueLen = 1 },
+    };
+    var h_ecpub: ck.CK_OBJECT_HANDLE = 0;
+    var h_ecpriv: ck.CK_OBJECT_HANDLE = 0;
+    try check("C_GenerateKeyPair(EC)", f.C_GenerateKeyPair.?(h, &ec_kpgen, &ecpub_tmpl, ecpub_tmpl.len, &ecpriv_tmpl, ecpriv_tmpl.len, &h_ecpub, &h_ecpriv));
+
+    var ecdsa_mech = ck.CK_MECHANISM{ .mechanism = ck.CKM_ECDSA_SHA256, .pParameter = null, .ulParameterLen = 0 };
+    var ecmsg = "sign me over ECDSA P-256".*;
+    var ecsig: [128]u8 = undefined;
+    var ecsiglen: ck.CK_ULONG = ecsig.len;
+    try check("C_SignInit(ECDSA)", f.C_SignInit.?(h, &ecdsa_mech, h_ecpriv));
+    try check("C_Sign(ECDSA)", f.C_Sign.?(h, &ecmsg, ecmsg.len, &ecsig, &ecsiglen));
+    if (ecsiglen != 64) return error.EcdsaSigLenWrong;
+    try check("C_VerifyInit(ECDSA)", f.C_VerifyInit.?(h, &ecdsa_mech, h_ecpub));
+    try check("C_Verify(ECDSA)", f.C_Verify.?(h, &ecmsg, ecmsg.len, &ecsig, ecsiglen));
+    try check("C_VerifyInit(ECDSA tamper)", f.C_VerifyInit.?(h, &ecdsa_mech, h_ecpub));
+    ecsig[0] ^= 0xff;
+    if (f.C_Verify.?(h, &ecmsg, ecmsg.len, &ecsig, ecsiglen) != ck.CKR_SIGNATURE_INVALID) return error.EcdsaTamperNotDetected;
+
+    var ecval_q = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_VALUE, .pValue = null, .ulValueLen = 0 },
+    };
+    if (f.C_GetAttributeValue.?(h, h_ecpriv, &ecval_q, ecval_q.len) != ck.CKR_ATTRIBUTE_SENSITIVE) return error.EcPrivNotSensitive;
+    var ecpt_q = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_EC_POINT, .pValue = null, .ulValueLen = 0 },
+    };
+    try check("C_GetAttributeValue(EC_POINT)", f.C_GetAttributeValue.?(h, h_ecpub, &ecpt_q, ecpt_q.len));
+    if (ecpt_q[0].ulValueLen != 67) return error.EcPointLenWrong;
+
+    var rsa_bits: ck.CK_ULONG = 2048;
+    var rsa_kpgen = ck.CK_MECHANISM{ .mechanism = ck.CKM_RSA_PKCS_KEY_PAIR_GEN, .pParameter = null, .ulParameterLen = 0 };
+    var rsapub_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_MODULUS_BITS, .pValue = &rsa_bits, .ulValueLen = @sizeOf(ck.CK_ULONG) },
+        .{ .type = ck.CKA_VERIFY, .pValue = &ck_yes, .ulValueLen = 1 },
+        .{ .type = ck.CKA_ENCRYPT, .pValue = &ck_yes, .ulValueLen = 1 },
+    };
+    var rsapriv_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_SIGN, .pValue = &ck_yes, .ulValueLen = 1 },
+        .{ .type = ck.CKA_DECRYPT, .pValue = &ck_yes, .ulValueLen = 1 },
+        .{ .type = ck.CKA_PRIVATE, .pValue = &ck_false, .ulValueLen = 1 },
+    };
+    var h_rsapub: ck.CK_OBJECT_HANDLE = 0;
+    var h_rsapriv: ck.CK_OBJECT_HANDLE = 0;
+    try check("C_GenerateKeyPair(RSA)", f.C_GenerateKeyPair.?(h, &rsa_kpgen, &rsapub_tmpl, rsapub_tmpl.len, &rsapriv_tmpl, rsapriv_tmpl.len, &h_rsapub, &h_rsapriv));
+
+    var rsa_sha_pkcs = ck.CK_MECHANISM{ .mechanism = ck.CKM_SHA256_RSA_PKCS, .pParameter = null, .ulParameterLen = 0 };
+    var rsamsg = "sign me over RSA PKCS#1 v1.5".*;
+    var rsasig: [256]u8 = undefined;
+    var rsasiglen: ck.CK_ULONG = rsasig.len;
+    try check("C_SignInit(RSA)", f.C_SignInit.?(h, &rsa_sha_pkcs, h_rsapriv));
+    try check("C_Sign(RSA)", f.C_Sign.?(h, &rsamsg, rsamsg.len, &rsasig, &rsasiglen));
+    if (rsasiglen != 256) return error.RsaSigLenWrong;
+    try check("C_VerifyInit(RSA)", f.C_VerifyInit.?(h, &rsa_sha_pkcs, h_rsapub));
+    try check("C_Verify(RSA)", f.C_Verify.?(h, &rsamsg, rsamsg.len, &rsasig, rsasiglen));
+    try check("C_VerifyInit(RSA tamper)", f.C_VerifyInit.?(h, &rsa_sha_pkcs, h_rsapub));
+    rsasig[10] ^= 0xff;
+    if (f.C_Verify.?(h, &rsamsg, rsamsg.len, &rsasig, rsasiglen) != ck.CKR_SIGNATURE_INVALID) return error.RsaTamperNotDetected;
+
+    var rsa_pkcs = ck.CK_MECHANISM{ .mechanism = ck.CKM_RSA_PKCS, .pParameter = null, .ulParameterLen = 0 };
+    var rsapt = "rsa secret".*;
+    var rsact: [256]u8 = undefined;
+    var rsactlen: ck.CK_ULONG = rsact.len;
+    try check("C_EncryptInit(RSA)", f.C_EncryptInit.?(h, &rsa_pkcs, h_rsapub));
+    try check("C_Encrypt(RSA)", f.C_Encrypt.?(h, &rsapt, rsapt.len, &rsact, &rsactlen));
+    if (rsactlen != 256) return error.RsaCtLenWrong;
+    var rsaback: [256]u8 = undefined;
+    var rsabacklen: ck.CK_ULONG = rsaback.len;
+    try check("C_DecryptInit(RSA)", f.C_DecryptInit.?(h, &rsa_pkcs, h_rsapriv));
+    try check("C_Decrypt(RSA)", f.C_Decrypt.?(h, &rsact, rsactlen, &rsaback, &rsabacklen));
+    if (rsabacklen != rsapt.len or !std.mem.eql(u8, rsaback[0..rsabacklen], &rsapt)) return error.RsaRoundTripFailed;
+
+    var rsaval_q = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_PRIVATE_EXPONENT, .pValue = null, .ulValueLen = 0 },
+    };
+    if (f.C_GetAttributeValue.?(h, h_rsapriv, &rsaval_q, rsaval_q.len) != ck.CKR_ATTRIBUTE_SENSITIVE) return error.RsaPrivNotSensitive;
+
+    var ecdh_kpgen = ck.CK_MECHANISM{ .mechanism = ck.CKM_EC_KEY_PAIR_GEN, .pParameter = null, .ulParameterLen = 0 };
+    var derive_pub_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_EC_PARAMS, .pValue = &ec_params, .ulValueLen = ec_params.len },
+    };
+    var derive_priv_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_DERIVE, .pValue = &ck_yes, .ulValueLen = 1 },
+        .{ .type = ck.CKA_PRIVATE, .pValue = &ck_false, .ulValueLen = 1 },
+    };
+    var h_pubA: ck.CK_OBJECT_HANDLE = 0;
+    var h_privA: ck.CK_OBJECT_HANDLE = 0;
+    var h_pubB: ck.CK_OBJECT_HANDLE = 0;
+    var h_privB: ck.CK_OBJECT_HANDLE = 0;
+    try check("C_GenerateKeyPair(ECDH A)", f.C_GenerateKeyPair.?(h, &ecdh_kpgen, &derive_pub_tmpl, derive_pub_tmpl.len, &derive_priv_tmpl, derive_priv_tmpl.len, &h_pubA, &h_privA));
+    try check("C_GenerateKeyPair(ECDH B)", f.C_GenerateKeyPair.?(h, &ecdh_kpgen, &derive_pub_tmpl, derive_pub_tmpl.len, &derive_priv_tmpl, derive_priv_tmpl.len, &h_pubB, &h_privB));
+
+    var ptA: [67]u8 = undefined;
+    var ptB: [67]u8 = undefined;
+    var ptA_q = [_]ck.CK_ATTRIBUTE{.{ .type = ck.CKA_EC_POINT, .pValue = &ptA, .ulValueLen = ptA.len }};
+    var ptB_q = [_]ck.CK_ATTRIBUTE{.{ .type = ck.CKA_EC_POINT, .pValue = &ptB, .ulValueLen = ptB.len }};
+    try check("C_GetAttributeValue(EC_POINT A)", f.C_GetAttributeValue.?(h, h_pubA, &ptA_q, ptA_q.len));
+    try check("C_GetAttributeValue(EC_POINT B)", f.C_GetAttributeValue.?(h, h_pubB, &ptB_q, ptB_q.len));
+
+    var derive_value_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_CLASS, .pValue = &class_secret, .ulValueLen = @sizeOf(ck.CK_OBJECT_CLASS) },
+        .{ .type = ck.CKA_KEY_TYPE, .pValue = &kt_generic, .ulValueLen = @sizeOf(ck.CK_KEY_TYPE) },
+        .{ .type = ck.CKA_SENSITIVE, .pValue = &ck_false, .ulValueLen = 1 },
+        .{ .type = ck.CKA_EXTRACTABLE, .pValue = &ck_yes, .ulValueLen = 1 },
+    };
+    const lenB: usize = @intCast(ptB_q[0].ulValueLen);
+    const ptB_raw = ptB[2..lenB];
+    var paramsA = ck.CK_ECDH1_DERIVE_PARAMS{ .kdf = ck.CKD_NULL, .ulSharedDataLen = 0, .pSharedData = null, .ulPublicDataLen = ptB_raw.len, .pPublicData = ptB_raw.ptr };
+    var paramsB = ck.CK_ECDH1_DERIVE_PARAMS{ .kdf = ck.CKD_NULL, .ulSharedDataLen = 0, .pSharedData = null, .ulPublicDataLen = ptA_q[0].ulValueLen, .pPublicData = &ptA };
+    var ecdh_mechA = ck.CK_MECHANISM{ .mechanism = ck.CKM_ECDH1_DERIVE, .pParameter = &paramsA, .ulParameterLen = @sizeOf(ck.CK_ECDH1_DERIVE_PARAMS) };
+    var ecdh_mechB = ck.CK_MECHANISM{ .mechanism = ck.CKM_ECDH1_DERIVE, .pParameter = &paramsB, .ulParameterLen = @sizeOf(ck.CK_ECDH1_DERIVE_PARAMS) };
+    var h_secretA: ck.CK_OBJECT_HANDLE = 0;
+    var h_secretB: ck.CK_OBJECT_HANDLE = 0;
+    try check("C_DeriveKey(A uses raw peer point)", f.C_DeriveKey.?(h, &ecdh_mechA, h_privA, &derive_value_tmpl, derive_value_tmpl.len, &h_secretA));
+    try check("C_DeriveKey(B uses DER peer point)", f.C_DeriveKey.?(h, &ecdh_mechB, h_privB, &derive_value_tmpl, derive_value_tmpl.len, &h_secretB));
+
+    var dvA: [48]u8 = undefined;
+    var dvB: [48]u8 = undefined;
+    var dvA_q = [_]ck.CK_ATTRIBUTE{.{ .type = ck.CKA_VALUE, .pValue = &dvA, .ulValueLen = dvA.len }};
+    var dvB_q = [_]ck.CK_ATTRIBUTE{.{ .type = ck.CKA_VALUE, .pValue = &dvB, .ulValueLen = dvB.len }};
+    try check("C_GetAttributeValue(derived A)", f.C_GetAttributeValue.?(h, h_secretA, &dvA_q, dvA_q.len));
+    try check("C_GetAttributeValue(derived B)", f.C_GetAttributeValue.?(h, h_secretB, &dvB_q, dvB_q.len));
+    if (dvA_q[0].ulValueLen != 32 or dvB_q[0].ulValueLen != 32) return error.DerivedLenWrong;
+    if (!std.mem.eql(u8, dvA[0..32], dvB[0..32])) return error.EcdhDisagree;
+
+    var kek_val: [32]u8 = undefined;
+    for (0..32) |j| kek_val[j] = @intCast(0xA0 + j);
+    var kek_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_CLASS, .pValue = &class_secret, .ulValueLen = @sizeOf(ck.CK_OBJECT_CLASS) },
+        .{ .type = ck.CKA_KEY_TYPE, .pValue = &kt_aes, .ulValueLen = @sizeOf(ck.CK_KEY_TYPE) },
+        .{ .type = ck.CKA_VALUE, .pValue = &kek_val, .ulValueLen = kek_val.len },
+        .{ .type = ck.CKA_WRAP, .pValue = &ck_yes, .ulValueLen = 1 },
+        .{ .type = ck.CKA_UNWRAP, .pValue = &ck_yes, .ulValueLen = 1 },
+    };
+    var h_kek: ck.CK_OBJECT_HANDLE = 0;
+    try check("C_CreateObject(KEK)", f.C_CreateObject.?(h, &kek_tmpl, kek_tmpl.len, &h_kek));
+
+    var target_val = "0123456789abcdef".*;
+    var target_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_CLASS, .pValue = &class_secret, .ulValueLen = @sizeOf(ck.CK_OBJECT_CLASS) },
+        .{ .type = ck.CKA_KEY_TYPE, .pValue = &kt_aes, .ulValueLen = @sizeOf(ck.CK_KEY_TYPE) },
+        .{ .type = ck.CKA_VALUE, .pValue = &target_val, .ulValueLen = target_val.len },
+        .{ .type = ck.CKA_EXTRACTABLE, .pValue = &ck_yes, .ulValueLen = 1 },
+        .{ .type = ck.CKA_SENSITIVE, .pValue = &ck_false, .ulValueLen = 1 },
+    };
+    var h_target: ck.CK_OBJECT_HANDLE = 0;
+    try check("C_CreateObject(wrap target)", f.C_CreateObject.?(h, &target_tmpl, target_tmpl.len, &h_target));
+
+    var keywrap_mech = ck.CK_MECHANISM{ .mechanism = ck.CKM_AES_KEY_WRAP, .pParameter = null, .ulParameterLen = 0 };
+    var wsize: ck.CK_ULONG = 0;
+    try check("C_WrapKey(size)", f.C_WrapKey.?(h, &keywrap_mech, h_kek, h_target, null, &wsize));
+    if (wsize != target_val.len + 8) return error.WrapSizeWrong;
+    var wrapped: [64]u8 = undefined;
+    var wrappedlen: ck.CK_ULONG = wrapped.len;
+    try check("C_WrapKey", f.C_WrapKey.?(h, &keywrap_mech, h_kek, h_target, &wrapped, &wrappedlen));
+    if (wrappedlen != target_val.len + 8) return error.WrapLenWrong;
+
+    var unwrap_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_CLASS, .pValue = &class_secret, .ulValueLen = @sizeOf(ck.CK_OBJECT_CLASS) },
+        .{ .type = ck.CKA_KEY_TYPE, .pValue = &kt_aes, .ulValueLen = @sizeOf(ck.CK_KEY_TYPE) },
+        .{ .type = ck.CKA_EXTRACTABLE, .pValue = &ck_yes, .ulValueLen = 1 },
+        .{ .type = ck.CKA_SENSITIVE, .pValue = &ck_false, .ulValueLen = 1 },
+    };
+    var h_unwrapped: ck.CK_OBJECT_HANDLE = 0;
+    try check("C_UnwrapKey", f.C_UnwrapKey.?(h, &keywrap_mech, h_kek, &wrapped, wrappedlen, &unwrap_tmpl, unwrap_tmpl.len, &h_unwrapped));
+
+    var uwval: [32]u8 = undefined;
+    var uwval_q = [_]ck.CK_ATTRIBUTE{.{ .type = ck.CKA_VALUE, .pValue = &uwval, .ulValueLen = uwval.len }};
+    try check("C_GetAttributeValue(unwrapped)", f.C_GetAttributeValue.?(h, h_unwrapped, &uwval_q, uwval_q.len));
+    const uwlen: usize = @intCast(uwval_q[0].ulValueLen);
+    if (uwlen != target_val.len or !std.mem.eql(u8, uwval[0..uwlen], &target_val)) return error.UnwrapMismatch;
+
+    var wrapped2: [64]u8 = undefined;
+    var wrapped2len: ck.CK_ULONG = wrapped2.len;
+    if (f.C_WrapKey.?(h, &keywrap_mech, h_kek, h_gen, &wrapped2, &wrapped2len) != ck.CKR_KEY_UNEXTRACTABLE) return error.UnextractableWrapNotRejected;
+
+    var oaep_params = ck.CK_RSA_PKCS_OAEP_PARAMS{ .hashAlg = ck.CKM_SHA256, .mgf = ck.CKG_MGF1_SHA256, .source = ck.CKZ_DATA_SPECIFIED, .pSourceData = null, .ulSourceDataLen = 0 };
+    var oaep_wrap_mech = ck.CK_MECHANISM{ .mechanism = ck.CKM_RSA_PKCS_OAEP, .pParameter = &oaep_params, .ulParameterLen = @sizeOf(ck.CK_RSA_PKCS_OAEP_PARAMS) };
+    var rsawrapped: [256]u8 = undefined;
+    var rsawrappedlen: ck.CK_ULONG = rsawrapped.len;
+    try check("C_WrapKey(RSA-OAEP)", f.C_WrapKey.?(h, &oaep_wrap_mech, h_rsapub, h_target, &rsawrapped, &rsawrappedlen));
+    if (rsawrappedlen != 256) return error.RsaWrapLenWrong;
+    var h_rsaunwrapped: ck.CK_OBJECT_HANDLE = 0;
+    try check("C_UnwrapKey(RSA-OAEP)", f.C_UnwrapKey.?(h, &oaep_wrap_mech, h_rsapriv, &rsawrapped, rsawrappedlen, &unwrap_tmpl, unwrap_tmpl.len, &h_rsaunwrapped));
+    var ruwval: [32]u8 = undefined;
+    var ruwval_q = [_]ck.CK_ATTRIBUTE{.{ .type = ck.CKA_VALUE, .pValue = &ruwval, .ulValueLen = ruwval.len }};
+    try check("C_GetAttributeValue(rsa-unwrapped)", f.C_GetAttributeValue.?(h, h_rsaunwrapped, &ruwval_q, ruwval_q.len));
+    const ruwlen: usize = @intCast(ruwval_q[0].ulValueLen);
+    if (ruwlen != target_val.len or !std.mem.eql(u8, ruwval[0..ruwlen], &target_val)) return error.RsaUnwrapMismatch;
+
+    var dk_val = "digest-this-key!".*;
+    var dk_tmpl = [_]ck.CK_ATTRIBUTE{
+        .{ .type = ck.CKA_CLASS, .pValue = &class_secret, .ulValueLen = @sizeOf(ck.CK_OBJECT_CLASS) },
+        .{ .type = ck.CKA_KEY_TYPE, .pValue = &kt_generic, .ulValueLen = @sizeOf(ck.CK_KEY_TYPE) },
+        .{ .type = ck.CKA_VALUE, .pValue = &dk_val, .ulValueLen = dk_val.len },
+    };
+    var h_dk: ck.CK_OBJECT_HANDLE = 0;
+    try check("C_CreateObject(digestkey)", f.C_CreateObject.?(h, &dk_tmpl, dk_tmpl.len, &h_dk));
+
+    var dk_mech = ck.CK_MECHANISM{ .mechanism = ck.CKM_SHA256, .pParameter = null, .ulParameterLen = 0 };
+    var dk_d1: [32]u8 = undefined;
+    var dk_d1len: ck.CK_ULONG = dk_d1.len;
+    try check("C_DigestInit(key)", f.C_DigestInit.?(h, &dk_mech));
+    try check("C_DigestKey", f.C_DigestKey.?(h, h_dk));
+    try check("C_DigestFinal(key)", f.C_DigestFinal.?(h, &dk_d1, &dk_d1len));
+
+    var dk_d2: [32]u8 = undefined;
+    var dk_d2len: ck.CK_ULONG = dk_d2.len;
+    try check("C_DigestInit(value)", f.C_DigestInit.?(h, &dk_mech));
+    try check("C_Digest(value)", f.C_Digest.?(h, &dk_val, dk_val.len, &dk_d2, &dk_d2len));
+    if (dk_d1len != 32 or !std.mem.eql(u8, dk_d1[0..32], dk_d2[0..32])) return error.DigestKeyMismatch;
+
+    var gcm_iv = [_]u8{ 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5, 0xA6, 0xA7, 0xA8, 0xA9, 0xAA, 0xAB };
+    var gcm_aad = "gcm-associated-data".*;
+    var gcm_params = ck.CK_GCM_PARAMS{
+        .pIv = &gcm_iv,
+        .ulIvLen = gcm_iv.len,
+        .ulIvBits = 96,
+        .pAAD = &gcm_aad,
+        .ulAADLen = gcm_aad.len,
+        .ulTagBits = 128,
+    };
+    var gcm_mech = ck.CK_MECHANISM{ .mechanism = ck.CKM_AES_GCM, .pParameter = &gcm_params, .ulParameterLen = @sizeOf(ck.CK_GCM_PARAMS) };
+    var gcm_pt = "GCM streaming over multiple update calls exceeds one block".*;
+
+    var gcm_ct1: [128]u8 = undefined;
+    var gcm_ct1len: ck.CK_ULONG = gcm_ct1.len;
+    try check("C_EncryptInit(GCM one-shot)", f.C_EncryptInit.?(h, &gcm_mech, h_aes));
+    try check("C_Encrypt(GCM one-shot)", f.C_Encrypt.?(h, &gcm_pt, gcm_pt.len, &gcm_ct1, &gcm_ct1len));
+
+    var gcm_ct2: [128]u8 = undefined;
+    var part_out: [128]u8 = undefined;
+    var part_outlen: ck.CK_ULONG = part_out.len;
+    try check("C_EncryptInit(GCM stream)", f.C_EncryptInit.?(h, &gcm_mech, h_aes));
+    var off: usize = 0;
+    while (off < gcm_pt.len) {
+        const end = @min(off + 17, gcm_pt.len);
+        part_outlen = part_out.len;
+        try check("C_EncryptUpdate(GCM)", f.C_EncryptUpdate.?(h, gcm_pt[off..].ptr, @intCast(end - off), &part_out, &part_outlen));
+        if (part_outlen != 0) return error.GcmUpdateEmittedEarly;
+        off = end;
+    }
+    var gcm_ct2len: ck.CK_ULONG = gcm_ct2.len;
+    try check("C_EncryptFinal(GCM)", f.C_EncryptFinal.?(h, &gcm_ct2, &gcm_ct2len));
+    if (gcm_ct1len != gcm_ct2len or !std.mem.eql(u8, gcm_ct1[0..gcm_ct1len], gcm_ct2[0..gcm_ct2len])) return error.GcmStreamMismatch;
+
+    var gcm_back: [128]u8 = undefined;
+    try check("C_DecryptInit(GCM stream)", f.C_DecryptInit.?(h, &gcm_mech, h_aes));
+    off = 0;
+    while (off < gcm_ct1len) {
+        const end = @min(off + 19, gcm_ct1len);
+        part_outlen = part_out.len;
+        try check("C_DecryptUpdate(GCM)", f.C_DecryptUpdate.?(h, gcm_ct1[off..].ptr, @intCast(end - off), &part_out, &part_outlen));
+        if (part_outlen != 0) return error.GcmDecryptEmittedEarly;
+        off = end;
+    }
+    var gcm_backlen: ck.CK_ULONG = gcm_back.len;
+    try check("C_DecryptFinal(GCM)", f.C_DecryptFinal.?(h, &gcm_back, &gcm_backlen));
+    if (gcm_backlen != gcm_pt.len or !std.mem.eql(u8, gcm_back[0..gcm_backlen], &gcm_pt)) return error.GcmStreamRoundTripFailed;
+
+    var gcm_bad: [128]u8 = undefined;
+    @memcpy(gcm_bad[0..gcm_ct1len], gcm_ct1[0..gcm_ct1len]);
+    gcm_bad[0] ^= 0xff;
+    var gcm_badlen: ck.CK_ULONG = gcm_back.len;
+    try check("C_DecryptInit(GCM tamper)", f.C_DecryptInit.?(h, &gcm_mech, h_aes));
+    if (f.C_Decrypt.?(h, &gcm_bad, gcm_ct1len, &gcm_back, &gcm_badlen) != ck.CKR_ENCRYPTED_DATA_INVALID) return error.GcmTamperNotDetected;
+
+    var de_sha = ck.CK_MECHANISM{ .mechanism = ck.CKM_SHA256, .pParameter = null, .ulParameterLen = 0 };
+    var dual_pt = "dual-function plaintext spanning blocks".*;
+    var de_iv = [_]u8{1} ** 16;
+    var de_cbcpad = ck.CK_MECHANISM{ .mechanism = ck.CKM_AES_CBC_PAD, .pParameter = &de_iv, .ulParameterLen = de_iv.len };
+    try check("C_DigestInit(DigestEncrypt)", f.C_DigestInit.?(h, &de_sha));
+    try check("C_EncryptInit(DigestEncrypt)", f.C_EncryptInit.?(h, &de_cbcpad, h_aes));
+    var de_ct: [80]u8 = undefined;
+    var de_ctlen: usize = 0;
+    off = 0;
+    while (off < dual_pt.len) {
+        const end = @min(off + 16, dual_pt.len);
+        var seg: ck.CK_ULONG = @intCast(de_ct.len - de_ctlen);
+        try check("C_DigestEncryptUpdate", f.C_DigestEncryptUpdate.?(h, dual_pt[off..].ptr, @intCast(end - off), de_ct[de_ctlen..].ptr, &seg));
+        de_ctlen += @intCast(seg);
+        off = end;
+    }
+    var de_finlen: ck.CK_ULONG = @intCast(de_ct.len - de_ctlen);
+    try check("C_EncryptFinal(DigestEncrypt)", f.C_EncryptFinal.?(h, de_ct[de_ctlen..].ptr, &de_finlen));
+    de_ctlen += @intCast(de_finlen);
+    var de_dig: [32]u8 = undefined;
+    var de_diglen: ck.CK_ULONG = de_dig.len;
+    try check("C_DigestFinal(DigestEncrypt)", f.C_DigestFinal.?(h, &de_dig, &de_diglen));
+    var de_ref: [32]u8 = undefined;
+    var de_reflen: ck.CK_ULONG = de_ref.len;
+    try check("C_DigestInit(DigestEncrypt ref)", f.C_DigestInit.?(h, &de_sha));
+    try check("C_Digest(DigestEncrypt ref)", f.C_Digest.?(h, &dual_pt, dual_pt.len, &de_ref, &de_reflen));
+    if (!std.mem.eql(u8, de_dig[0..32], de_ref[0..32])) return error.DualDigestMismatch;
+    var de_back: [80]u8 = undefined;
+    var de_backlen: ck.CK_ULONG = de_back.len;
+    try check("C_DecryptInit(DigestEncrypt verify)", f.C_DecryptInit.?(h, &de_cbcpad, h_aes));
+    try check("C_Decrypt(DigestEncrypt verify)", f.C_Decrypt.?(h, &de_ct, @intCast(de_ctlen), &de_back, &de_backlen));
+    if (de_backlen != dual_pt.len or !std.mem.eql(u8, de_back[0..de_backlen], &dual_pt)) return error.DualEncryptRoundTrip;
+
+    var dd_pt = "thirty-two-byte aligned message!".*;
+    var dd_iv = [_]u8{2} ** 16;
+    var dd_cbc = ck.CK_MECHANISM{ .mechanism = ck.CKM_AES_CBC, .pParameter = &dd_iv, .ulParameterLen = dd_iv.len };
+    var dd_ct: [48]u8 = undefined;
+    var dd_ctlen: ck.CK_ULONG = dd_ct.len;
+    try check("C_EncryptInit(DecryptDigest setup)", f.C_EncryptInit.?(h, &dd_cbc, h_aes));
+    try check("C_Encrypt(DecryptDigest setup)", f.C_Encrypt.?(h, &dd_pt, dd_pt.len, &dd_ct, &dd_ctlen));
+    try check("C_DecryptInit(DecryptDigest)", f.C_DecryptInit.?(h, &dd_cbc, h_aes));
+    try check("C_DigestInit(DecryptDigest)", f.C_DigestInit.?(h, &de_sha));
+    var dd_back: [48]u8 = undefined;
+    var dd_seg: ck.CK_ULONG = dd_back.len;
+    try check("C_DecryptDigestUpdate", f.C_DecryptDigestUpdate.?(h, &dd_ct, dd_ctlen, &dd_back, &dd_seg));
+    var dd_backlen: usize = @intCast(dd_seg);
+    var dd_finlen: ck.CK_ULONG = @intCast(dd_back.len - dd_backlen);
+    try check("C_DecryptFinal(DecryptDigest)", f.C_DecryptFinal.?(h, dd_back[dd_backlen..].ptr, &dd_finlen));
+    dd_backlen += @intCast(dd_finlen);
+    var dd_dig: [32]u8 = undefined;
+    var dd_diglen: ck.CK_ULONG = dd_dig.len;
+    try check("C_DigestFinal(DecryptDigest)", f.C_DigestFinal.?(h, &dd_dig, &dd_diglen));
+    if (dd_backlen != dd_pt.len or !std.mem.eql(u8, dd_back[0..dd_backlen], &dd_pt)) return error.DualDecryptRoundTrip;
+    var dd_ref: [32]u8 = undefined;
+    var dd_reflen: ck.CK_ULONG = dd_ref.len;
+    try check("C_DigestInit(DecryptDigest ref)", f.C_DigestInit.?(h, &de_sha));
+    try check("C_Digest(DecryptDigest ref)", f.C_Digest.?(h, &dd_pt, dd_pt.len, &dd_ref, &dd_reflen));
+    if (!std.mem.eql(u8, dd_dig[0..32], dd_ref[0..32])) return error.DualDecryptDigestMismatch;
+
+    var sv_pt = "verify-after-decrypt aligned!!!!".*;
+    var sv_iv = [_]u8{3} ** 16;
+    var sv_cbc = ck.CK_MECHANISM{ .mechanism = ck.CKM_AES_CBC, .pParameter = &sv_iv, .ulParameterLen = sv_iv.len };
+    try check("C_SignInit(SignEncrypt)", f.C_SignInit.?(h, &hmac_mech, h_hmac));
+    try check("C_EncryptInit(SignEncrypt)", f.C_EncryptInit.?(h, &sv_cbc, h_aes));
+    var sv_ct: [48]u8 = undefined;
+    var sv_seg: ck.CK_ULONG = sv_ct.len;
+    try check("C_SignEncryptUpdate", f.C_SignEncryptUpdate.?(h, &sv_pt, sv_pt.len, &sv_ct, &sv_seg));
+    var sv_ctlen: usize = @intCast(sv_seg);
+    var sv_finlen: ck.CK_ULONG = @intCast(sv_ct.len - sv_ctlen);
+    try check("C_EncryptFinal(SignEncrypt)", f.C_EncryptFinal.?(h, sv_ct[sv_ctlen..].ptr, &sv_finlen));
+    sv_ctlen += @intCast(sv_finlen);
+    var sv_mac: [32]u8 = undefined;
+    var sv_maclen: ck.CK_ULONG = sv_mac.len;
+    try check("C_SignFinal(SignEncrypt)", f.C_SignFinal.?(h, &sv_mac, &sv_maclen));
+    try check("C_DecryptInit(DecryptVerify)", f.C_DecryptInit.?(h, &sv_cbc, h_aes));
+    try check("C_VerifyInit(DecryptVerify)", f.C_VerifyInit.?(h, &hmac_mech, h_hmac));
+    var sv_back: [48]u8 = undefined;
+    var sv_bseg: ck.CK_ULONG = sv_back.len;
+    try check("C_DecryptVerifyUpdate", f.C_DecryptVerifyUpdate.?(h, sv_ct[0..sv_ctlen].ptr, @intCast(sv_ctlen), &sv_back, &sv_bseg));
+    var sv_backlen: usize = @intCast(sv_bseg);
+    var sv_bfinlen: ck.CK_ULONG = @intCast(sv_back.len - sv_backlen);
+    try check("C_DecryptFinal(DecryptVerify)", f.C_DecryptFinal.?(h, sv_back[sv_backlen..].ptr, &sv_bfinlen));
+    sv_backlen += @intCast(sv_bfinlen);
+    try check("C_VerifyFinal(DecryptVerify)", f.C_VerifyFinal.?(h, &sv_mac, sv_maclen));
+    if (sv_backlen != sv_pt.len or !std.mem.eql(u8, sv_back[0..sv_backlen], &sv_pt)) return error.DualSignVerifyRoundTrip;
+
+    var rec_mech = ck.CK_MECHANISM{ .mechanism = ck.CKM_RSA_PKCS, .pParameter = null, .ulParameterLen = 0 };
+    var rec_msg = "recover me via RSA".*;
+    var rec_sig: [256]u8 = undefined;
+    var rec_siglen: ck.CK_ULONG = rec_sig.len;
+    try check("C_SignRecoverInit", f.C_SignRecoverInit.?(h, &rec_mech, h_rsapriv));
+    try check("C_SignRecover", f.C_SignRecover.?(h, &rec_msg, rec_msg.len, &rec_sig, &rec_siglen));
+    if (rec_siglen != 256) return error.SignRecoverLenWrong;
+    var rec_out: [256]u8 = undefined;
+    var rec_outlen: ck.CK_ULONG = rec_out.len;
+    try check("C_VerifyRecoverInit", f.C_VerifyRecoverInit.?(h, &rec_mech, h_rsapub));
+    try check("C_VerifyRecover", f.C_VerifyRecover.?(h, &rec_sig, rec_siglen, &rec_out, &rec_outlen));
+    if (rec_outlen != rec_msg.len or !std.mem.eql(u8, rec_out[0..rec_outlen], &rec_msg)) return error.VerifyRecoverMismatch;
+
+    var os_sha = ck.CK_MECHANISM{ .mechanism = ck.CKM_SHA256, .pParameter = null, .ulParameterLen = 0 };
+    var os_p1 = "operation-".*;
+    var os_p2 = "state".*;
+    try check("C_DigestInit(opstate)", f.C_DigestInit.?(h, &os_sha));
+    try check("C_DigestUpdate(opstate p1)", f.C_DigestUpdate.?(h, &os_p1, os_p1.len));
+    var os_blob: [256]u8 = undefined;
+    var os_bloblen: ck.CK_ULONG = 0;
+    try check("C_GetOperationState(size)", f.C_GetOperationState.?(h, null, &os_bloblen));
+    if (os_bloblen == 0 or os_bloblen > os_blob.len) return error.OpStateSizeWrong;
+    try check("C_GetOperationState(fill)", f.C_GetOperationState.?(h, &os_blob, &os_bloblen));
+    try check("C_DigestUpdate(opstate p2)", f.C_DigestUpdate.?(h, &os_p2, os_p2.len));
+    var os_dA: [32]u8 = undefined;
+    var os_dAlen: ck.CK_ULONG = os_dA.len;
+    try check("C_DigestFinal(opstate A)", f.C_DigestFinal.?(h, &os_dA, &os_dAlen));
+    try check("C_SetOperationState", f.C_SetOperationState.?(h, &os_blob, os_bloblen, ck.CK_INVALID_HANDLE, ck.CK_INVALID_HANDLE));
+    try check("C_DigestUpdate(opstate p2 restored)", f.C_DigestUpdate.?(h, &os_p2, os_p2.len));
+    var os_dB: [32]u8 = undefined;
+    var os_dBlen: ck.CK_ULONG = os_dB.len;
+    try check("C_DigestFinal(opstate B)", f.C_DigestFinal.?(h, &os_dB, &os_dBlen));
+    if (!std.mem.eql(u8, os_dA[0..32], os_dB[0..32])) return error.OpStateRestoreMismatch;
+
+    var slot_evt: ck.CK_SLOT_ID = 0;
+    var reserved_probe: u8 = 0;
+    const reserved_ptr: ?*anyopaque = &reserved_probe;
+    if (f.C_WaitForSlotEvent.?(ck.CKF_DONT_BLOCK, &slot_evt, null) != ck.CKR_NO_EVENT) return error.WaitSlotEventNotNoEvent;
+    if (f.C_WaitForSlotEvent.?(0, &slot_evt, null) != ck.CKR_FUNCTION_NOT_SUPPORTED) return error.WaitSlotEventBlockingNotRefused;
+    if (f.C_WaitForSlotEvent.?(ck.CKF_DONT_BLOCK, &slot_evt, reserved_ptr) != ck.CKR_ARGUMENTS_BAD) return error.WaitSlotEventReservedNotChecked;
+    if (f.C_GetFunctionStatus.?(h) != ck.CKR_FUNCTION_NOT_PARALLEL) return error.GetFunctionStatusNotParallel;
+    if (f.C_CancelFunction.?(h) != ck.CKR_FUNCTION_NOT_PARALLEL) return error.CancelFunctionNotParallel;
+    var seed_probe = "seed-material".*;
+    if (f.C_SeedRandom.?(h, &seed_probe, seed_probe.len) != ck.CKR_RANDOM_SEED_NOT_SUPPORTED) return error.SeedRandomNotRefused;
+
+    try check("C_CloseSession", f.C_CloseSession.?(h));
+    try check("C_Finalize", f.C_Finalize.?(null));
+
+    if (f.C_WaitForSlotEvent.?(ck.CKF_DONT_BLOCK, &slot_evt, null) != ck.CKR_CRYPTOKI_NOT_INITIALIZED) return error.WaitSlotEventUninitNotRejected;
+
+    std.debug.print("smoke: OK\n", .{});
+    std.debug.print("  cryptokiVersion = {d}.{d}\n", .{ info.cryptokiVersion.major, info.cryptokiVersion.minor });
+    std.debug.print("  slots           = {d}\n", .{count});
+    std.debug.print("  token label     = {s}\n", .{token_info.label});
+    std.debug.print("  mechanisms      = {d}\n", .{mech_count});
+    std.debug.print("  login + PIN     = init/login/initpin/setpin OK; lockout trips after 3 wrong\n", .{});
+    std.debug.print("  objects         = create/find/get(2-call)/set/size/destroy OK; CKA_PRIVATE hidden after logout\n", .{});
+    std.debug.print("  object gates    = CKA_DESTROYABLE/CKA_MODIFIABLE=false enforced; FindObjectsInit arg-check OK\n", .{});
+    std.debug.print("  crypto          = SHA-256 vector OK; HMAC sign/verify (+tamper) OK; AES-CBC-PAD round-trip OK\n", .{});
+    std.debug.print("  keygen          = C_GenerateKey AES OK; generated key CKA_VALUE is sensitive (unextractable)\n", .{});
+    std.debug.print("  ecdsa           = C_GenerateKeyPair EC P-256 OK; ECDSA-SHA256 sign/verify (+tamper) OK; priv scalar sensitive\n", .{});
+    std.debug.print("  rsa             = C_GenerateKeyPair RSA-2048 OK; SHA256-RSA-PKCS sign/verify (+tamper) + RSA-PKCS enc/dec OK; priv sensitive\n", .{});
+    std.debug.print("  derive          = C_DeriveKey ECDH1 P-256: both parties agree (raw + DER-wrapped peer point)\n", .{});
+    std.debug.print("  keywrap         = C_WrapKey/C_UnwrapKey AES-KEY-WRAP + RSA-OAEP round-trips; unextractable target refused\n", .{});
+    std.debug.print("  digestkey       = C_DigestKey digest equals C_Digest of the same key bytes\n", .{});
+    std.debug.print("  gcmstream       = AES-GCM multipart enc/dec == one-shot (chunked); tamper -> ENCRYPTED_DATA_INVALID\n", .{});
+    std.debug.print("  dual            = DigestEncrypt/SignEncrypt + DecryptDigest/DecryptVerify lock-step round-trips\n", .{});
+    std.debug.print("  recover         = RSA C_SignRecover -> C_VerifyRecover recovers the exact message\n", .{});
+    std.debug.print("  opstate         = C_GetOperationState -> C_SetOperationState resumes the digest identically\n", .{});
+    std.debug.print("  conformance     = WaitForSlotEvent(DONT_BLOCK)->NO_EVENT, blocking->NOT_SUPPORTED, pReserved->ARGS_BAD; Get/CancelFunction->NOT_PARALLEL; SeedRandom->SEED_NOT_SUPPORTED\n", .{});
+}
+
+fn check(name: []const u8, rv: ck.CK_RV) !void {
+    if (rv != ck.CKR_OK) {
+        std.debug.print("smoke: {s} -> 0x{X}\n", .{ name, rv });
+        return error.CryptokiError;
+    }
+}
diff --git a/PROJECTS/advanced/hsm-emulator/install.sh b/PROJECTS/advanced/hsm-emulator/install.sh
new file mode 100755
index 00000000..efbe5fea
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/install.sh
@@ -0,0 +1,141 @@
+#!/usr/bin/env bash
+# ©AngelaMos | 2026
+# install.sh
+
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[0;33m'
+CYAN='\033[0;36m'
+DIM='\033[2m'
+NC='\033[0m'
+
+info()  { printf "${CYAN}▸${NC} %s\n" "$1"; }
+ok()    { printf "${GREEN}✓${NC} %s\n" "$1"; }
+warn()  { printf "${YELLOW}!${NC} %s\n" "$1"; }
+fail()  { printf "${RED}✗${NC} %s\n" "$1"; exit 1; }
+
+MIN_ZIG="0.16.0"
+
+banner() {
+    printf "\n"
+    printf "${CYAN}"
+    cat <<'EOF'
+  ██╗  ██╗███████╗███╗   ███╗
+  ██║  ██║██╔════╝████╗ ████║
+  ███████║███████╗██╔████╔██║
+  ██╔══██║╚════██║██║╚██╔╝██║
+  ██║  ██║███████║██║ ╚═╝ ██║
+  ╚═╝  ╚═╝╚══════╝╚═╝     ╚═╝
+EOF
+    printf "${NC}"
+    printf "  ${DIM}hsm emulator installer — pkcs#11 v2.40 module in zig${NC}\n"
+    printf "\n"
+}
+
+check_zig() {
+    if ! command -v zig &>/dev/null; then
+        fail "Zig is not installed. Get 0.16.0 at https://ziglang.org/download/"
+    fi
+
+    local ver
+    ver=$(zig version)
+
+    if ! printf '%s\n%s\n' "$MIN_ZIG" "$ver" \
+        | sort -V | head -n1 | grep -qx "$MIN_ZIG"; then
+        fail "Zig $MIN_ZIG+ required (found $ver). This project tracks 0.16 idioms."
+    fi
+
+    ok "Zig $ver"
+}
+
+check_opensc() {
+    if ! command -v pkcs11-tool &>/dev/null; then
+        fail "OpenSC (pkcs11-tool) not found. Install: sudo apt install opensc"
+    fi
+    ok "OpenSC pkcs11-tool$(dpkg -l opensc 2>/dev/null | awk '/^ii/{print " "$3}')"
+
+    if [ -e /usr/lib/x86_64-linux-gnu/pkcs11-spy.so ]; then
+        ok "pkcs11-spy.so present (call tracing via 'just spy')"
+    else
+        warn "pkcs11-spy.so not found (optional; ships with opensc-pkcs11)"
+    fi
+}
+
+check_openssl() {
+    if command -v openssl &>/dev/null; then
+        ok "$(openssl version | cut -d' ' -f1-2) (libcrypto for RSA, M5)"
+    else
+        warn "OpenSSL not found (needed later for the RSA milestone). Install: sudo apt install libssl-dev"
+    fi
+}
+
+check_just() {
+    if command -v just &>/dev/null; then
+        ok "just $(just --version 2>/dev/null | cut -d' ' -f2)"
+    else
+        info "just not found (optional). Install: curl -sSf https://just.systems/install.sh | bash -s -- --to ~/.local/bin"
+    fi
+}
+
+build_module() {
+    info "Building the Cryptoki module (ReleaseSafe)..."
+    zig build --release=safe
+    local so
+    so=$(find zig-out/lib -name 'libhsm.so.*' -type f | head -1)
+    [ -n "$so" ] || fail "Build produced no libhsm.so"
+    ok "Built $so ($(du -h "$so" | cut -f1))"
+}
+
+run_tests() {
+    info "Running ABI cross-check and unit tests..."
+    if zig build test --release=safe >/dev/null 2>&1; then
+        ok "All tests passed (ck.zig matches OASIS v2.40 headers)"
+    else
+        fail "Tests failed. Run 'zig build test --summary all' for details."
+    fi
+
+    info "Running the dlopen smoke test..."
+    if zig build smoke --release=safe 2>&1 | grep -q "smoke: OK"; then
+        ok "Smoke test passed (module loads and drives the ABI)"
+    else
+        fail "Smoke test failed. Run 'zig build smoke' for details."
+    fi
+}
+
+verify_load() {
+    info "Verifying the module loads under OpenSC..."
+    if pkcs11-tool --module zig-out/lib/libhsm.so -L >/dev/null 2>&1; then
+        ok "pkcs11-tool loaded the module and enumerated the slot"
+    else
+        fail "pkcs11-tool could not load the module."
+    fi
+}
+
+main() {
+    banner
+
+    info "Checking dependencies..."
+    check_zig
+    check_opensc
+    check_openssl
+    check_just
+
+    printf "\n"
+
+    build_module
+    run_tests
+    verify_load
+
+    printf "\n"
+    ok "Setup complete"
+    printf "\n"
+    printf "  ${DIM}List the slot:${NC}      pkcs11-tool --module zig-out/lib/libhsm.so -L\n"
+    printf "  ${DIM}List mechanisms:${NC}    pkcs11-tool --module zig-out/lib/libhsm.so -M\n"
+    printf "  ${DIM}Trace every call:${NC}   just spy -L\n"
+    printf "  ${DIM}All commands:${NC}       just\n"
+    printf "\n"
+}
+
+main "$@"
diff --git a/PROJECTS/advanced/hsm-emulator/justfile b/PROJECTS/advanced/hsm-emulator/justfile
new file mode 100644
index 00000000..327de1aa
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/justfile
@@ -0,0 +1,122 @@
+# =============================================================================
+# ©AngelaMos | 2026
+# justfile
+# =============================================================================
+
+set dotenv-load
+set export
+set shell := ["bash", "-uc"]
+
+project    := file_name(justfile_directory())
+version    := `git describe --tags --always 2>/dev/null || echo "dev"`
+module     := justfile_directory() / "zig-out/lib/libhsm.so"
+spy        := "/usr/lib/x86_64-linux-gnu/pkcs11-spy.so"
+image      := "angelamos-hsm:latest"
+
+# =============================================================================
+# Default
+# =============================================================================
+
+default:
+    @just --list --unsorted
+
+# =============================================================================
+# Build
+# =============================================================================
+
+[group('build')]
+build:
+    zig build
+
+[group('build')]
+debug:
+    zig build -Doptimize=Debug
+
+[group('build')]
+release:
+    zig build -Doptimize=ReleaseSafe
+
+# =============================================================================
+# Test
+# =============================================================================
+
+[group('test')]
+test:
+    zig build test
+
+[group('test')]
+test-verbose:
+    zig build test --summary all
+
+[group('test')]
+smoke:
+    zig build smoke
+
+# =============================================================================
+# Lint and Format
+# =============================================================================
+
+[group('lint')]
+fmt:
+    zig fmt build.zig build.zig.zon src tests examples
+
+[group('lint')]
+fmt-check:
+    zig fmt --check build.zig build.zig.zon src tests examples
+
+# =============================================================================
+# PKCS#11 (drive the built module with OpenSC pkcs11-tool)
+# =============================================================================
+
+[group('pkcs11')]
+inspect: build
+    pkcs11-tool --module {{module}} -I
+
+[group('pkcs11')]
+slots: build
+    pkcs11-tool --module {{module}} -L
+
+[group('pkcs11')]
+mechs: build
+    pkcs11-tool --module {{module}} -M
+
+[group('pkcs11')]
+spy *ARGS: build
+    PKCS11SPY={{module}} pkcs11-tool --module {{spy}} {{ARGS}}
+
+# =============================================================================
+# Docker (build the image, then run the end-to-end pkcs11-tool demo)
+# =============================================================================
+
+[group('docker')]
+docker-build:
+    docker build -t {{image}} .
+
+[group('docker')]
+docker-demo: docker-build
+    docker run --rm {{image}}
+
+# =============================================================================
+# CI / Quality
+# =============================================================================
+
+[group('ci')]
+ci: fmt-check test smoke
+
+# =============================================================================
+# Utilities
+# =============================================================================
+
+[group('util')]
+info:
+    @echo "Project: {{project}}"
+    @echo "Version: {{version}}"
+    @echo "Module:  {{module}}"
+    @echo "OS:      {{os()}} ({{arch()}})"
+    @zig version | xargs -I{} echo "Zig:     {}"
+
+[group('util')]
+clean:
+    -rm -rf zig-out
+    -rm -rf .zig-cache
+    @echo "Build artifacts cleaned"
diff --git a/PROJECTS/advanced/hsm-emulator/learn/00-OVERVIEW.md b/PROJECTS/advanced/hsm-emulator/learn/00-OVERVIEW.md
new file mode 100644
index 00000000..d94c94a8
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/learn/00-OVERVIEW.md
@@ -0,0 +1,143 @@
+<!-- ©AngelaMos | 2026 -->
+<!-- 00-OVERVIEW.md -->
+
+# HSM Emulator: Overview
+
+## What This Is
+
+A software **Hardware Security Module** written in Zig that compiles to a real PKCS#11 (Cryptoki) shared object. Any program that already knows how to talk to a smartcard, a YubiKey, or a cloud HSM (OpenSSL, `pkcs11-tool`, Java's SunPKCS11, p11-kit) can load this `.so` and use it to generate keys, sign, encrypt, and store secrets. It speaks the same C ABI a real HSM speaks, so to the host it is indistinguishable from hardware until you look at where the bytes actually live.
+
+The point of the project is to understand, by building it, what an HSM actually does and why the interface to one looks the way it does. You get a working module you can poke at with standard tools, and a codebase small enough to read in an afternoon.
+
+## Why This Matters
+
+A cryptographic key is the whole game. If an attacker reads your TLS private key, your code-signing key, or your CA root key out of a file or out of process memory, every signature and every certificate that key ever produced is now forgeable. The defense the industry settled on is to never let the application touch the key. The key lives inside a separate trust boundary (a chip, a card, a network appliance) and the application sends it *requests*: "sign this", "decrypt that". The key goes in once and never comes back out.
+
+The cost of getting this wrong is not hypothetical.
+
+- **RSA SecurID, 2011.** Attackers breached RSA and exfiltrated seed records tied to SecurID tokens, then used them to attack Lockheed Martin. The lesson the industry took from it: the secrets that authenticate everything else must sit behind a hardware boundary, not in a database an intruder can read.
+- **Stuxnet, 2010.** The worm carried drivers signed with legitimate code-signing keys stolen from Realtek and JMicron. Valid signatures from stolen keys let malware sail past trust checks. Code-signing keys are exactly the kind of thing that belongs in an HSM, where the key signs but never leaves.
+- **DigiNotar, 2011.** A certificate authority was compromised and issued rogue certificates for `*.google.com`, used to intercept traffic in Iran. The company did not survive it. CA root and issuing keys are the canonical HSM use case: the key must be usable for signing yet impossible to copy.
+
+**Real world scenarios where this applies:**
+- **Certificate authorities and PKI.** A CA's signing keys live in an HSM. The CA software calls `C_Sign`; the key never exists in the CA server's memory in usable form.
+- **Code signing.** Apple, Microsoft, and Linux distros sign release artifacts with keys held in HSMs so a server breach cannot mint signed malware.
+- **Payment and KMS backends.** AWS KMS and CloudHSM, payment HSMs (PIN translation, card issuance), and database TDE all delegate the actual crypto to a module that exposes an interface very much like this one.
+
+## What You'll Learn
+
+This project teaches how key custody actually works under the hood. By building it yourself, you will understand:
+
+**Security concepts:**
+- **Key custody and the trust boundary.** Why "the application never sees the key" is the entire design goal, and how an attribute like `CKA_SENSITIVE` turns into a hard refusal to ever hand `CKA_VALUE` back to the caller.
+- **Authentication and lockout.** How a PIN is stretched with Argon2id so the value on disk is useless to a thief, and why three wrong tries must lock the token rather than let an attacker grind.
+- **Encryption at rest with key wrapping.** The envelope pattern: a random master key encrypts your secrets, and the master key is itself wrapped under a key derived from your PIN. Change the PIN and you re-wrap one small key instead of re-encrypting everything.
+- **Release of unverified plaintext (RUP).** Why a streaming AEAD decrypt that hands back bytes before the authentication tag is checked is dangerous, and how buffering until the tag verifies removes the problem.
+- **Side channels.** Why comparing a PIN or a MAC with a normal byte-by-byte compare leaks information through timing, and what constant-time comparison fixes.
+
+**Technical skills:**
+- **Writing a C ABI by hand.** Laying out `extern struct` types so they match a C header byte for byte, and proving it with compile-time `@sizeOf` / `@offsetOf` assertions instead of hoping.
+- **Calling a C library safely from Zig.** Binding OpenSSL's `libcrypto` through hand-written `extern` declarations (RSA lives there because Zig's standard library has none), without leaking its symbols out of your module.
+- **Concurrency at a C boundary.** Holding a global instance behind a lock, and using a generation counter so a slow operation that started before the token was reinitialized cannot commit stale results.
+- **Secret hygiene in a systems language.** Zeroizing key material with `std.crypto.secureZero`, understanding what the `volatile` trick buys you, and freeing heap secrets without leaving copies behind.
+
+**Tools and techniques:**
+- **`pkcs11-tool`** (from OpenSC), the standard command-line host for any PKCS#11 module. You will use it to init the token, log in, generate keys, and sign.
+- **`pkcs11-spy`**, a shim that sits in front of any module and logs every call with its arguments and return code. It is the single best debugging tool for ABI work.
+- **OpenSSL as an oracle.** Verifying that a signature this module produces validates under OpenSSL, and that an ECDH secret it derives matches `openssl pkeyutl -derive` byte for byte.
+
+## Prerequisites
+
+You do not need prior HSM experience. You do need some comfort with the following.
+
+**Required knowledge:**
+- **C ABI basics.** What a struct's memory layout is, what a function pointer is, what "calling convention" means. The whole module is an exercise in matching a C interface exactly.
+- **Symmetric versus asymmetric crypto.** The difference between AES (one shared key) and RSA/EC (a keypair). You do not need the math, but you should know which is which and what "sign" versus "encrypt" means.
+- **Basic Zig or a willingness to read it.** The code uses tagged unions, `comptime`, error unions, and slices. If you know Rust, Go, or modern C++, you can follow it.
+
+**Tools you'll need:**
+- **Zig 0.16.0** to build the module. The exact version matters; the `std.Io` interface and the build API changed in 0.16.
+- **OpenSC** for `pkcs11-tool` and `pkcs11-spy`. On Debian or Ubuntu: `apt install opensc`.
+- **OpenSSL development headers** (`libssl-dev`) so the module can link `libcrypto` for RSA.
+
+**Helpful but not required:**
+- A reading of the [PKCS#11 v2.40 base specification](https://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html). You can also just read [`01-CONCEPTS.md`](./01-CONCEPTS.md) and pick up the spec when something is unclear.
+- Familiarity with how SoftHSM2 (the reference open-source software HSM) is structured. This project borrows its three-layer split.
+
+## Quick Start
+
+```bash
+cd PROJECTS/advanced/hsm-emulator
+
+# Build, cross-check the ABI, and confirm pkcs11-tool can load it
+./install.sh
+
+# Keep all state in a scratch directory instead of $HOME
+export ANGELAMOS_HSM_TOKEN=/tmp/hsm-token
+export ANGELAMOS_HSM_OBJECTS=/tmp/hsm-objects
+MOD=zig-out/lib/libhsm.so
+
+# Look at the empty token, then bring it to life
+pkcs11-tool --module $MOD -L
+pkcs11-tool --module $MOD --init-token --label demo --so-pin 12345678
+pkcs11-tool --module $MOD --init-pin --so-pin 12345678 --pin 1234
+
+# Generate a keypair and sign with it
+pkcs11-tool --module $MOD -l --pin 1234 --keypairgen --key-type EC:prime256v1 --label k1
+echo "hello hsm" > msg.bin
+pkcs11-tool --module $MOD -l --pin 1234 --sign --mechanism ECDSA-SHA256 --label k1 \
+    --input-file msg.bin --output-file sig.bin
+```
+
+Expected output: `-L` shows one slot whose token starts `uninitialized`. After `--init-token` the token reports `flags: ... token initialized`. The keypair generation prints the new public and private object handles, and `--sign` writes a 64-byte signature to `sig.bin`. If you want to *watch* every Cryptoki call the tool makes, run any command through `just spy` (for example `just spy --keypairgen ...`) and read the spy log.
+
+## Project Structure
+
+```
+hsm-emulator/
+├── src/
+│   ├── ck.zig             # the hand-written Cryptoki ABI (the contract with the host)
+│   ├── main.zig           # the one exported symbol and the 68-entry function table
+│   ├── config.zig         # every tunable constant in one place
+│   ├── core/              # global state, sessions, the object store, the token record
+│   ├── api/               # one file per group of C_ functions (the entry points)
+│   └── crypto/            # the actual cryptography (AES, EC, RSA, hashing, the keystore)
+├── tests/abi_test.zig     # proves ck.zig matches the OASIS headers at build time
+├── examples/smoke.zig     # loads the built .so and drives it like a real host
+└── vendor/pkcs11/         # the official OASIS headers, used only for the cross-check
+```
+
+The single most important file to understand first is `src/ck.zig`. Everything else exists to fill in the function pointers that file declares.
+
+## Next Steps
+
+1. **Understand the ideas.** Read [01-CONCEPTS.md](./01-CONCEPTS.md) for key custody, the login model, encryption at rest, and the side-channel defenses, each grounded in a real incident.
+2. **See the design.** Read [02-ARCHITECTURE.md](./02-ARCHITECTURE.md) for the three-layer split, the object model, and how concurrency is handled.
+3. **Walk the code.** Read [03-IMPLEMENTATION.md](./03-IMPLEMENTATION.md) to trace a full operation from the C call down to the crypto and back.
+4. **Learn the crypto.** Read [MECHANICS.md](./MECHANICS.md) for how each mechanism (AES modes, GCM, key wrap, ECDSA, ECDH, RSA, Argon2id) works byte by byte.
+5. **Check the contract.** Read [CONFORMANCE.md](./CONFORMANCE.md) for the exact return code at every boundary.
+6. **Extend it.** Read [04-CHALLENGES.md](./04-CHALLENGES.md) for projects from "add a mechanism" to "implement the v3.0 interface".
+
+## Common Issues
+
+**`pkcs11-tool` writes files into my home directory**
+```
+~/.angelamos-hsm-token
+~/.angelamos-hsm-objects
+```
+Solution: set `ANGELAMOS_HSM_TOKEN` and `ANGELAMOS_HSM_OBJECTS` before every command. The module falls back to `$HOME/.angelamos-hsm-*` only when those are unset.
+
+**`error: unable to find dynamic system library 'crypto'`**
+Solution: install the OpenSSL development package (`libssl-dev` on Debian or Ubuntu, `openssl-devel` on Fedora). RSA is the one mechanism family that links a C library.
+
+**`C_Login` returns `CKR_PIN_LOCKED` and nothing works**
+Solution: you tried the wrong PIN three times and the token locked. Re-run `--init-token` (with the Security Officer PIN) to reset it, which also clears all objects. This is the intended behavior; an attacker should not get unlimited tries.
+
+**A plain `zig build` behaves differently from the installed module**
+Solution: `zig build` with no flags is a Debug build. The shipped module is `zig build --release=safe`. Debug and ReleaseSafe differ in how freed and nulled memory is poisoned, which matters when you are inspecting zeroized secrets. Use `--release=safe` to match the artifact.
+
+## Related Projects
+
+If you found this interesting, look at:
+- **api-rate-limiter**: another advanced project where the security property (correctness under concurrency) lives in carefully designed state handling, here with Lua scripts instead of a Zig mutex.
+- **bug-bounty-platform**: shows how key material and credentials are handled in a full application, the layer that would *call* an HSM like this one.
diff --git a/PROJECTS/advanced/hsm-emulator/learn/01-CONCEPTS.md b/PROJECTS/advanced/hsm-emulator/learn/01-CONCEPTS.md
new file mode 100644
index 00000000..ff603b74
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/learn/01-CONCEPTS.md
@@ -0,0 +1,351 @@
+<!-- ©AngelaMos | 2026 -->
+<!-- 01-CONCEPTS.md -->
+
+# Core Security Concepts
+
+This document explains the security ideas the project is built on. These are not just definitions. Each one is tied to a real failure and to the exact code in this module that defends against it.
+
+## Key Custody: the application must never see the key
+
+### What it is
+
+An HSM exists to enforce one rule: the secret key goes in once and never comes back out in usable form. The application that needs a signature does not get the key and compute the signature itself. It hands the HSM a request, and the HSM computes the signature inside its own boundary and returns only the result. The key material never crosses back over the line.
+
+In PKCS#11 this rule is expressed through two attributes on a key object:
+
+- `CKA_SENSITIVE = CK_TRUE` means the value of the key cannot be read back through the API. Asking for `CKA_VALUE` returns `CKR_ATTRIBUTE_SENSITIVE`, not the bytes.
+- `CKA_EXTRACTABLE = CK_FALSE` means the key cannot be wrapped out (encrypted and exported) either.
+
+### Why it matters
+
+If the key is just a variable in your process, then any bug that reads process memory reads the key. The 2014 **Heartbleed** bug (CVE-2014-0160) was exactly this: a missing bounds check in OpenSSL let a remote attacker read up to 64 KB of server memory per request, and private TLS keys were among the things people pulled out. Servers whose keys lived in an HSM were not exposed the same way. The key was never in the web server's address space to leak.
+
+### How it works here
+
+When you generate a key, the module marks the secret material sensitive and unextractable by default, and it computes the two "always" flags the spec requires. From `keymgmt.zig`:
+
+```zig
+if (!obj.has(ck.CKA_SENSITIVE)) try obj.set(allocator, ck.CKA_SENSITIVE, &[_]u8{ck.CK_TRUE});
+if (!obj.has(ck.CKA_EXTRACTABLE)) try obj.set(allocator, ck.CKA_EXTRACTABLE, &[_]u8{ck.CK_FALSE});
+const always_sensitive: u8 = if (obj.getBool(ck.CKA_SENSITIVE)) ck.CK_TRUE else ck.CK_FALSE;
+const never_extractable: u8 = if (!obj.getBool(ck.CKA_EXTRACTABLE)) ck.CK_TRUE else ck.CK_FALSE;
+```
+
+When a host then tries to read that value, `object.zig`'s `sensitiveProtected` check fires before any bytes are copied, and `C_GetAttributeValue` reports the value length as `CK_UNAVAILABLE_INFORMATION` and returns `CKR_ATTRIBUTE_SENSITIVE`. The key is usable for signing (you pass its *handle* to `C_SignInit`) but its bytes are unreachable.
+
+You can watch this in the smoke harness: after generating an AES key, the harness asks for `CKA_VALUE` and asserts the answer is `CKR_ATTRIBUTE_SENSITIVE`, not the key.
+
+### Common attacks
+
+1. **Memory disclosure.** A buffer over-read (Heartbleed), an uninitialized-memory leak, or a crash dump that ships off-box. If the key was never in your memory in plaintext, the leak yields nothing useful.
+2. **Key export through the API.** An attacker who gains a session tries to simply read the key out. `CKA_SENSITIVE` refuses. They try to wrap it out with `C_WrapKey`. `CKA_EXTRACTABLE = CK_FALSE` refuses with `CKR_KEY_UNEXTRACTABLE`.
+3. **Cold disk theft.** Someone copies the token file. The sensitive values in it are sealed (see encryption at rest, below), so the file is ciphertext.
+
+### Defense strategies
+
+The whole module is the defense, but the core moves are: mark secrets sensitive and unextractable by default, gate every read through one chokepoint (`sensitiveProtected`), and never construct a code path that returns raw secret bytes to the caller. Operations take *handles*, not keys.
+
+## The Login Model: public objects, private objects, and roles
+
+### What it is
+
+A PKCS#11 token has two roles: the **Security Officer** (SO), who administers the token and sets up the User, and the **User**, who actually uses the keys. Objects are either *public* (visible to anyone with a session) or *private* (`CKA_PRIVATE = CK_TRUE`, visible only after the User logs in).
+
+### Why it matters
+
+The role split is what lets you hand someone a token without handing them the keys on it. The SO can initialize and reset, but in a correct design the SO cannot read the User's secrets. If the administrator role could read user key material, "administrator" would just be a second word for "attacker who got admin".
+
+### How it works here
+
+Visibility is one function, `object_store.visible`:
+
+```zig
+pub fn visible(obj: *const Object, logged_in: ?ck.CK_USER_TYPE) bool {
+    if (!obj.isPrivate()) return true;
+    return logged_in == ck.CKU_USER;
+}
+```
+
+Every object-facing entry point (`C_FindObjects`, `C_GetAttributeValue`, `C_DestroyObject`, the key fetches inside `crypto_ops.zig`) calls this first. A private object simply does not exist to a caller who has not logged in as User. The smoke harness proves it: it creates a private object, logs out, runs `C_FindObjects`, and asserts the private object does not appear and that fetching it returns `CKR_OBJECT_HANDLE_INVALID`. The object is not just hidden from listings; it is unreachable by handle.
+
+Critically, this module gives the SO **no keyslot for user secrets**. The master key that protects sensitive values is wrapped only under the User PIN (see below). An SO who resets the token can wipe it, but cannot read what was there. That is a deliberate design choice, documented in [CONFORMANCE.md](./CONFORMANCE.md) section 4.
+
+### Common attacks
+
+1. **Privilege confusion.** An attacker with SO access tries to read User keys. The absence of an SO keyslot means there is nothing for the SO to decrypt with.
+2. **Pre-login enumeration.** An attacker without credentials lists objects hoping private keys leak into the listing. `visible` keeps them out.
+
+## Authentication: stretching the PIN, and locking the door
+
+### What it is
+
+The User and SO authenticate with a PIN. A PIN is short and low-entropy by nature (often four to eight digits), so two things must be true: the stored form must be expensive to attack offline, and online guessing must be rate-limited to a hard stop.
+
+### Why it matters
+
+If you store the PIN itself, or a fast hash of it, an attacker who steals the token file runs a dictionary in seconds. The 2012 **LinkedIn breach** leaked 6.5 million unsalted SHA-1 password hashes; because SHA-1 is fast and the hashes were unsalted, most were cracked almost immediately. A PIN protected by a fast hash is no better.
+
+### How it works here
+
+The PIN is stretched with **Argon2id**, the memory-hard KDF that won the Password Hashing Competition. From `config.zig` and `pin.zig`:
+
+```zig
+const params: argon2.Params = .{
+    .t = config.pin_kdf_t,      // 3 iterations
+    .m = config.pin_kdf_m_kib,  // 64 MiB of memory
+    .p = config.pin_kdf_p,      // 1 lane
+};
+```
+
+Each guess costs 64 MiB of memory and three passes over it, which collapses the throughput of a brute-force rig. Only a random 16-byte salt and the 32-byte derived hash ever touch disk. The PIN is never stored in any form. Verification is constant-time:
+
+```zig
+pub fn verify(io: std.Io, allocator: std.mem.Allocator, pin: []const u8, salt: *const Salt, expected: *const Hash) !bool {
+    var got: Hash = undefined;
+    defer std.crypto.secureZero(u8, &got);
+    try derive(io, allocator, pin, salt, &got);
+    return std.crypto.timing_safe.eql(Hash, got, expected.*);
+}
+```
+
+For online guessing, the token counts failures and locks after three. From `slot_token.zig`, the token info reflects the count low / final try / locked flags, and `C_Login` refuses once the counter reaches the limit:
+
+```zig
+if (inst.token.user_fail >= config.login_max_attempts) {
+    state.mutex.unlock();
+    return ck.CKR_PIN_LOCKED;
+}
+```
+
+The smoke harness drives three wrong PINs and asserts the fourth attempt returns `CKR_PIN_LOCKED` and that `CKF_USER_PIN_LOCKED` is set in the token flags.
+
+### Common pitfalls
+
+**Mistake: comparing the hash with a normal equality check**
+```zig
+// Bad: std.mem.eql returns as soon as it finds a mismatched byte.
+// The time it takes leaks how many leading bytes matched.
+return std.mem.eql(u8, &got, expected);
+
+// Good: timing_safe.eql looks at every byte before deciding.
+return std.crypto.timing_safe.eql(Hash, got, expected.*);
+```
+
+**Mistake: a fast hash for the PIN**
+```zig
+// Bad: a thief with the file runs billions of SHA-256 guesses per second.
+var h: [32]u8 = undefined;
+std.crypto.hash.sha2.Sha256.hash(pin, &h, .{});
+
+// Good: Argon2id makes each guess cost 64 MiB and three passes.
+try argon2.kdf(allocator, &h, pin, &salt, params, .argon2id, io);
+```
+
+## Encryption at Rest and the Envelope Pattern
+
+### What it is
+
+The token persists to a file so keys survive a restart. The sensitive values in that file are encrypted. The clever part is *how* the encryption key is managed: a random per-token **master key** (MK) encrypts the secrets, and the MK is itself encrypted ("wrapped") under a key derived from the User PIN. This two-level scheme is the **envelope** pattern.
+
+### Why it matters
+
+Encrypting each secret directly under a PIN-derived key sounds simpler, but it means changing the PIN requires re-encrypting every secret. With the envelope, changing the PIN re-wraps one 32-byte master key and nothing else. It also means the expensive Argon2id derivation happens once per login, not once per object. AWS KMS, Google Tink, and every serious secrets system use envelope encryption for these reasons.
+
+The threat it answers is plaintext storage of secrets, CWE-312 (cleartext storage of sensitive information). A token file that is just key bytes on disk is a single `cat` away from total compromise.
+
+### How it works here
+
+```
+   User PIN ──Argon2id──▶ KEK ──AES-256-GCM wrap──▶ wrapped MK (on disk, in the token record)
+                                                          │
+                                                  C_Login unwraps with the KEK
+                                                          ▼
+   random master key (MK) ──AES-256-GCM seal──▶ sealed secret values (on disk, in the object file)
+```
+
+`keystore.zig` holds the two halves. `wrap` derives the KEK from the PIN and GCM-encrypts the MK; `unwrap` reverses it, and a wrong PIN fails the GCM tag and returns false rather than garbage:
+
+```zig
+pub fn unwrap(io: std.Io, allocator: std.mem.Allocator, pin_bytes: []const u8, w: *const Wrapped, out: *MasterKey) !bool {
+    var kek: MasterKey = undefined;
+    defer std.crypto.secureZero(u8, &kek);
+    try deriveKek(io, allocator, pin_bytes, &w.salt, &kek);
+    gcm.decrypt(out, &w.ct, w.tag, "", w.nonce, kek) catch {
+        std.crypto.secureZero(u8, out);
+        return false;
+    };
+    return true;
+}
+```
+
+`seal` and `unseal` protect the individual attribute values, binding each one to its attribute type as associated data so a sealed `CKA_PRIVATE_EXPONENT` cannot be swapped in where a `CKA_VALUE` was expected. The object store seals *selectively*: only the sensitive values (the AES key bytes, the RSA private exponent and CRT factors, the EC scalar) are encrypted. Public material (the modulus, the EC point, labels) stays plaintext so it is visible before login, which is spec-correct.
+
+### Common attacks
+
+1. **Disk theft.** The file is sealed under a key the thief does not have. Without the PIN, the MK stays wrapped.
+2. **Tampering.** Flipping a byte in a sealed value breaks the GCM tag on unseal, and the module fails closed. The store-level tests flip a byte and assert `error.AuthFailed`.
+3. **Downgrade.** An attacker swaps in an old token file from before a PIN change. The MK in that file is wrapped under the old KEK, so the new PIN cannot unwrap it. The record version is also bumped, so an old plaintext-era file is rejected outright.
+
+## Release of Unverified Plaintext (RUP)
+
+### What it is
+
+AES-GCM is an authenticated cipher: decryption both decrypts and verifies a 128-bit tag, and the tag is what tells you the ciphertext was not tampered with. A *streaming* decrypt that returns plaintext chunk by chunk has a problem: it hands you bytes before it has seen the tag. If you act on those bytes and the tag later turns out to be wrong, you acted on attacker-controlled data. That is release of unverified plaintext.
+
+### Why it matters
+
+For an HSM this is unacceptable. The whole point is to be trustworthy about what it returns. Returning plaintext that has not been authenticated, even briefly, is a foothold for chosen-ciphertext attacks. The cryptographic community treats RUP resistance as a property a serious AEAD usage must have.
+
+### How it works here
+
+The module makes RUP impossible by construction. GCM is implemented as a **buffered** operation: `C_EncryptUpdate` and `C_DecryptUpdate` append to an internal buffer and emit zero bytes, and the real work happens once at `C_*Final`, where decrypt verifies the tag before any plaintext is released. The accumulator lives in `session.zig` as `GcmStream`, and it is bounded to 16 MiB so a host cannot exhaust memory by streaming forever:
+
+```zig
+pub fn append(self: *GcmStream, allocator: std.mem.Allocator, bytes: []const u8) error{ OutOfMemory, TooLarge }!void {
+    if (bytes.len == 0) return;
+    const needed = self.len + bytes.len;
+    if (needed > config.max_gcm_stream_len) return error.TooLarge;
+    ...
+}
+```
+
+The smoke harness streams a multi-block message through `C_DecryptUpdate` in 19-byte chunks, asserts that every update emits zero bytes, and only gets the plaintext at `C_DecryptFinal`. It then flips a byte and confirms decryption returns `CKR_ENCRYPTED_DATA_INVALID` with no plaintext released.
+
+## Side Channels: timing, and zeroizing memory
+
+### What it is
+
+A side channel is information that leaks through *how* a computation runs rather than its output: how long it took, what memory it touched, what the cache state is afterward. Two side channels matter most for a key-handling module: timing (a comparison that exits early reveals where it stopped) and residue (a secret left in freed memory after use).
+
+### Why it matters
+
+**Timing.** The 1998 **Bleichenbacher attack** and its 2017 revival **ROBOT** recovered RSA-encrypted secrets by measuring how a server responded to malformed PKCS#1 v1.5 ciphertexts. **Lucky Thirteen** (2013) did the same against TLS CBC padding using timing alone. The lesson: any branch whose timing depends on a secret is a leak.
+
+**Residue.** The 2008 **cold boot attack** (Halderman et al.) showed that DRAM retains its contents for seconds to minutes after power loss, long enough to dump and recover keys. If a key sits in freed memory, a crash dump, a swapped-out page, or a cold-boot read can recover it.
+
+### How it works here
+
+Comparisons of secrets are constant-time. PIN verification uses `std.crypto.timing_safe.eql`; MAC verification in `crypto_ops.zig` uses a hand-rolled `ctEql` that ORs every byte difference before deciding:
+
+```zig
+fn ctEql(a: []const u8, b: []const u8) bool {
+    if (a.len != b.len) return false;
+    var diff: u8 = 0;
+    for (a, b) |x, y| diff |= x ^ y;
+    return diff == 0;
+}
+```
+
+Secrets are zeroized when they go out of scope. Stack secrets use `defer std.crypto.secureZero(...)`; the session operation unions zeroize themselves on teardown; the object store frees every secret value through `secureFree`, which scrubs before releasing:
+
+```zig
+fn secureFree(allocator: std.mem.Allocator, value: []u8) void {
+    std.crypto.secureZero(u8, value);
+    allocator.free(value);
+}
+```
+
+`secureZero` takes a `[]volatile` slice precisely so the compiler is forbidden from optimizing the write away as dead (it has no subsequent read). On logout the whole store re-seals and the master key is wiped, so an idle, logged-out token holds no plaintext secrets in RAM. [MECHANICS.md](./MECHANICS.md) covers the constant-time and zeroization mechanics in more depth.
+
+### Common pitfalls
+
+**Mistake: zeroizing through a non-volatile slice**
+```zig
+// Bad: with no later read, the optimizer may delete this @memset entirely.
+@memset(&key, 0);
+
+// Good: secureZero forces the store to happen.
+std.crypto.secureZero(u8, &key);
+```
+
+**Mistake: a padding oracle through distinct error codes**
+```zig
+// Bad: returning a different error for "bad padding" vs "bad MAC" tells an
+// attacker which step failed, which is what Bleichenbacher/Lucky13 exploit.
+
+// Good: this module maps RSA decrypt failures to one uniform CKR code and
+// lets libcrypto handle the padding check in constant time. CBC-PAD padding
+// verification ORs all the pad bytes before deciding, no early exit.
+```
+
+## How These Concepts Relate
+
+The concepts are layers of one system. Each depends on the one below it.
+
+```
+   Key custody (sensitive, unextractable)
+            │ requires
+            ▼
+   The login model (who may see what)
+            │ requires
+            ▼
+   Authentication (Argon2id PIN + lockout)
+            │ unlocks
+            ▼
+   Encryption at rest (envelope: PIN -> KEK -> MK -> sealed secrets)
+            │ relies on
+            ▼
+   Authenticated encryption done safely (GCM, no RUP)
+            │ relies on
+            ▼
+   Side-channel hygiene (constant-time compares, zeroized memory)
+```
+
+If the constant-time compare leaks, the PIN falls. If the PIN falls, the envelope opens. If the envelope opens, the login model is moot and key custody is broken. The strength of the chain is the strength of its weakest link, which is why the module is uniform about all of them.
+
+## Industry Standards and Frameworks
+
+### OWASP Top 10 (2021)
+
+- **A02:2021 Cryptographic Failures.** The headline category. This project is a study in not committing them: strong KDF for the PIN, AES-256-GCM for storage, fresh nonces, authenticated encryption, no home-grown primitives except where they are textbook (CBC mode assembly, RFC 3394 wrap) and tested against published vectors.
+- **A04:2021 Insecure Design.** The envelope pattern, the SO-cannot-read-User-secrets decision, and RUP-safe GCM are design-level choices, not bolt-ons.
+- **A07:2021 Identification and Authentication Failures.** The PIN lockout and the role model address brute force and privilege confusion.
+
+### MITRE ATT&CK
+
+- **T1552 Unsecured Credentials** and **T1555 Credentials from Password Stores.** An HSM is the countermeasure: credentials that authenticate everything else are not sitting in a readable store.
+- **T1003 OS Credential Dumping.** Zeroization and never-in-plaintext-memory custody reduce what a memory dump yields.
+- **T1588.004 / T1649 Obtain or Forge Certificates.** Keeping signing keys unextractable is what stops a breach from minting forged certificates, the DigiNotar failure mode.
+
+### CWE
+
+- **CWE-312 Cleartext Storage of Sensitive Information.** Defended by the encrypted-at-rest envelope.
+- **CWE-316 Cleartext Storage in Memory.** Defended by zeroization and the logout relock.
+- **CWE-208 Observable Timing Discrepancy.** Defended by constant-time comparison.
+- **CWE-326 Inadequate Encryption Strength** and **CWE-327 Use of a Broken or Risky Cryptographic Algorithm.** Defended by AES-256-GCM, Argon2id, and standard signature schemes.
+- **CWE-522 Insufficiently Protected Credentials.** Defended by Argon2id stretching and lockout.
+
+## Real World Examples
+
+### Case study: Heartbleed (CVE-2014-0160, 2014)
+
+A missing bounds check in OpenSSL's TLS heartbeat let a remote attacker read server memory in 64 KB chunks. Private keys, session cookies, and passwords all leaked. The defense that worked was custody: organizations whose private keys lived in an HSM did not leak those keys, because the keys were never in the vulnerable process's memory. This project's `CKA_SENSITIVE` enforcement and zeroization are the same principle in miniature.
+
+### Case study: the Bleichenbacher family (1998, ROBOT 2017)
+
+Daniel Bleichenbacher showed that an RSA decryption oracle which reveals whether PKCS#1 v1.5 padding was valid lets an attacker decrypt a ciphertext with about a million queries. Nineteen years later ROBOT found the same flaw still live in major TLS stacks because the "fixes" were not uniform. The takeaway baked into this module: never let the error you return depend on which internal check failed, and prefer OAEP, whose design resists the attack. RSA decrypt failures here collapse to one return code.
+
+## Testing Your Understanding
+
+Before moving on, make sure you can answer these.
+
+1. A host generates an AES key, then immediately calls `C_GetAttributeValue` for `CKA_VALUE`. What does it get back, and which function decided that? What would the answer be for `CKA_MODULUS_BITS` on an RSA public key, and why is that different?
+2. Walk the envelope from a User PIN to a decrypted secret value. Name each key in the chain and what encrypts what. Why does changing the PIN not require re-encrypting every object?
+3. Why does `C_DecryptUpdate` for AES-GCM return zero bytes every time, and where does the plaintext actually appear? What attack would a chunk-by-chunk release enable?
+4. The SO can reset the token. Why can the SO not read the User's keys? Point to the design decision that makes that true.
+
+If any of these are fuzzy, re-read the matching section. The implementation will make far more sense once these click.
+
+## Further Reading
+
+**Essential:**
+- [PKCS#11 v2.40 Base Specification (OASIS)](https://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html). The contract this module implements. Read the function semantics and the object model sections.
+- [SoftHSMv2](https://github.com/softhsm/SoftHSMv2). The reference open-source software HSM. This project borrows its three-layer split and its object store idea.
+
+**Deep dives:**
+- Bleichenbacher, "Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS #1" (CRYPTO 1998), and the ROBOT writeup at robotattack.org for the modern recurrence.
+- Halderman et al., "Lest We Remember: Cold Boot Attacks on Encryption Keys" (USENIX Security 2008), the motivation for `secureZero`.
+- The Argon2 paper and RFC 9106 for why a memory-hard KDF beats a fast hash for low-entropy secrets.
+
+**Historical context:**
+- The original RSA Security PKCS#11 documents (pre-OASIS) for how the standard came to look the way it does, and why "the function list is the API".
diff --git a/PROJECTS/advanced/hsm-emulator/learn/02-ARCHITECTURE.md b/PROJECTS/advanced/hsm-emulator/learn/02-ARCHITECTURE.md
new file mode 100644
index 00000000..761e9ead
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/learn/02-ARCHITECTURE.md
@@ -0,0 +1,430 @@
+<!-- ©AngelaMos | 2026 -->
+<!-- 02-ARCHITECTURE.md -->
+
+# System Architecture
+
+This document explains how the module is built and why it is built that way. It assumes you have read [01-CONCEPTS.md](./01-CONCEPTS.md).
+
+## High Level Architecture
+
+The module is three layers. A thin C-ABI façade takes calls from the host and validates them. A core-state layer owns the live token, sessions, and objects behind a single lock. A crypto layer does the actual mathematics and the storage codec. Calls flow down, results flow back up, and the only thing the host ever sees is the function table at the top.
+
+```
+   ┌──────────────────────────────────────────────────────────────┐
+   │  HOST: pkcs11-tool, OpenSSL, p11-kit, Java SunPKCS11           │
+   └───────────────────────────────┬──────────────────────────────┘
+                                    │  C ABI, through a function-pointer table
+                                    ▼
+   ┌──────────────────────────────────────────────────────────────┐
+   │  LAYER 1  ABI façade                                           │
+   │  main.zig          one exported symbol, the 68-slot table      │
+   │  ck.zig            every CK_ type, constant, struct            │
+   │  api/general       Initialize / Finalize / GetInfo             │
+   │  api/slot_token    slot + token + mechanism queries, PIN admin │
+   │  api/session       OpenSession / Login / Logout / op-state     │
+   │  api/object        CreateObject / Find / GetAttributeValue     │
+   │  api/crypto_ops    digest / sign / verify / encrypt / decrypt  │
+   │  api/keymgmt       GenerateKey(Pair) / Wrap / Unwrap / Derive  │
+   │  api/random        GenerateRandom / SeedRandom                 │
+   └───────────────────────────────┬──────────────────────────────┘
+                                    │  acquire() the instance under the lock
+                                    ▼
+   ┌──────────────────────────────────────────────────────────────┐
+   │  LAYER 2  core state  (one global Instance, one mutex)         │
+   │  state             the Instance, init-args, generation counter │
+   │  lock              the mutex (std.atomic.Mutex + spin/yield)   │
+   │  session           session Table, op-state unions, GCM buffer  │
+   │  object_store      attribute-bag objects, the persist codec    │
+   │  token             the token record: PINs, fail counts, MK     │
+   │  env               reads storage paths from std.c.environ      │
+   └───────────────────────────────┬──────────────────────────────┘
+                                    │  call the primitives
+                                    ▼
+   ┌──────────────────────────────────────────────────────────────┐
+   │  LAYER 3  crypto                                               │
+   │  digest / mac      SHA-2, HMAC (pure Zig std.crypto)           │
+   │  cipher            AES-CBC/CBC-PAD/GCM, RFC 3394 wrap (pure)    │
+   │  ecdsa             P-256/384 sign/verify/keygen, ECDH (pure)   │
+   │  rsa + openssl     RSA via libcrypto (hand-written extern)     │
+   │  pin               Argon2id derive/verify (pure)               │
+   │  keystore          master-key wrap, value seal/unseal (pure)   │
+   └──────────────────────────────────────────────────────────────┘
+```
+
+### Component breakdown
+
+**`main.zig` (the entry point).** Exports exactly one symbol, `C_GetFunctionList`, which hands the host a pointer to a static `CK_FUNCTION_LIST`. That table's 68 function pointers are wired to the `api/*` functions in canonical order. A `comptime` block asserts the table is `69 * @sizeOf(usize)` bytes (version plus 68 pointers) and that `CK_ATTRIBUTE` is 24 bytes, so an ABI regression cannot compile.
+
+**`ck.zig` (the contract).** The hand-written Cryptoki v2.40 ABI: scalar typedefs, 200+ constants, every struct laid out for the Linux LP64 ABI with natural alignment, the function-pointer typedefs, and the `CK_FUNCTION_LIST` struct. Nothing in here executes; it is pure shape, and that shape is the agreement with the host.
+
+**`api/*` (the entry points).** One file per group of `C_*` functions. Every entry point follows the same skeleton: acquire the instance under the lock, validate the session handle and arguments, do the work or dispatch into the crypto layer, set the in/out length, return the precise `CKR_*` code. These functions are where the spec's rules live (two-call length queries, the operation state machine, login gating).
+
+**`core/state.zig` (the spine).** Owns the single global `Instance`: the allocator, the `std.Io` backend, the locking mode, the token, the session table, the object store, the current login role, and the unwrapped master key. It exposes `acquire()` (the only way to touch the instance), the init-args parser, and the generation counter used to make slow operations safe.
+
+**`core/session.zig`, `core/object_store.zig`, `core/token.zig`.** The three data stores. Sessions hold per-session operation state. The object store holds objects and the persistence codec. The token holds authentication state and the wrapped master key.
+
+**`crypto/*` (the math).** Stateless or self-contained primitives. Everything except RSA is pure-Zig `std.crypto`. RSA is `libcrypto` reached through hand-written `extern` declarations in `openssl.zig`.
+
+## Data Flow
+
+### Signing with an RSA key, end to end
+
+Here is what happens when a host calls `C_Sign` after a `C_SignInit` with an RSA key. It shows every layer.
+
+```
+1. host: C_SignInit(session, {CKM_SHA256_RSA_PKCS}, hRsaPriv)
+   api/crypto_ops C_SignInit
+     state.acquire()                      -> lock, get the *Instance
+     sessions.get(hSession)               -> the Session, or CKR_SESSION_HANDLE_INVALID
+     signInitOp(...)                       -> classify the mechanism as RSA-sign,
+                                             parse the scheme/digest params,
+                                             fetch+validate the private key object
+     sess.sign_op = .{ .rsa = { key, params, sig_len } }   (just the handle + params)
+     return CKR_OK                         (unlock via defer)
+
+2. host: C_Sign(session, data, dataLen, NULL, &sigLen)     (length query)
+   api/crypto_ops C_Sign
+     signLen(&sess.sign_op.?)             -> modulus length
+     *pulSignatureLen = that; return CKR_OK
+
+3. host: C_Sign(session, data, dataLen, sigBuf, &sigLen)   (real call)
+   api/crypto_ops C_Sign, the .rsa arm
+     rsaPrivateComponents(inst, op.key, CKA_SIGN)   -> re-fetch the components,
+                                                       refuse if sealed or usage-denied
+     rsa.sign(components, params, data, out)        -> crypto layer
+       openssl.zig: rebuild EVP_PKEY from the components,
+                    EVP_DigestSign (hash-then-sign) for SHA256-RSA-PKCS
+     *pulSignatureLen = n
+     sess.endSign()                       -> zeroize the op union, clear it
+     return CKR_OK                         (unlock via defer)
+```
+
+Two design points stand out. First, the operation state stores only the key *handle* and the parsed parameters, never the key material; the components are re-fetched under the lock for the actual sign. Second, the two-call pattern (NULL buffer to learn the length, then the real buffer) is handled at the top, and a buffer-too-small answer does not consume the operation, exactly as the spec requires.
+
+### Logging in, end to end
+
+`C_Login` is the most interesting flow because it does an expensive Argon2id derivation that must not be done while holding the lock, and it has to defend against the token being reinitialized underneath it.
+
+```
+1. acquire(), validate the session, read the salt/hash and (for User) the wrapped MK
+2. gen = cryptoBegin(); grab io + allocator; UNLOCK   <- release the lock for the slow part
+3. pin.verify(...)                 -> Argon2id, the expensive part, no lock held
+   keystore.unwrap(...)            -> if User, derive the KEK and unwrap the MK
+4. LOCK again; cryptoEnd()
+   if generation changed since step 2  -> someone reinitialized the token: abort
+   commit: set logged_in, install the MK, object_store.unlock() to unseal secrets
+   token.save(...); return CKR_OK
+```
+
+The `generation` counter is the safety net. `C_InitToken` and `C_InitPIN` bump it. If a second thread reinitialized the token during the long Argon2id call, the committing thread sees the generation has changed and refuses to apply its now-stale result. This is the classic time-of-check-to-time-of-use defense, made explicit.
+
+## Design Patterns
+
+### The acquire-and-defer template
+
+Every fast entry point uses the same shape:
+
+```zig
+pub fn C_SomeOp(hSession: ck.CK_SESSION_HANDLE, ...) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    // ... do the work, return a precise CKR_* ...
+}
+```
+
+`acquire()` locks the mutex and returns the instance only if the library is initialized; if not, it unlocks and returns null so the caller can answer `CKR_CRYPTOKI_NOT_INITIALIZED`. The `defer` guarantees the unlock on every return path. This pattern is used at roughly sixty entry points and is the reason the locking is uniform and hard to get wrong.
+
+**Why this and not a lock-free instance accessor?** An earlier version exposed a lock-free `current()` that read the instance pointer without the lock. That had a window: `C_Finalize` could tear down the allocator and session table between the present-check and the actual lock. The fix was to make `acquire()` the only accessor and to verify `present` *under* the lock. There is now no way to touch the instance without holding the mutex.
+
+### The snapshot-unlock-recheck template (for slow operations)
+
+Argon2id takes real time (it is supposed to). Holding the global lock across it would serialize the whole module behind one login. So slow entry points (`C_Login`, `C_InitToken`, `C_InitPIN`, `C_SetPIN`) snapshot what they need, record the generation, release the lock, do the slow work, then re-lock and verify the generation before committing. This is the only safe way to run a long computation against shared state without freezing the world or risking a stale write.
+
+### Tagged unions for operation state
+
+A session can have one active operation of each kind. Each is a Zig tagged union that holds exactly the state that operation needs and nothing more:
+
+```zig
+pub const SignOp = union(enum) {
+    mac: mac.Mac,         // HMAC: the running hash state
+    ec:  ecdsa.SignState, // ECDSA: the curve, scalar, and accumulator
+    rsa: RsaSig,          // RSA: just the key handle + parsed params
+};
+```
+
+This keeps the operation state inline in the `Session` (no heap allocation for sign/verify/digest), makes "wrong mechanism for this call" a simple `switch` arm, and lets teardown zeroize the whole union in one `secureZero`. The one exception is GCM, which needs a growable buffer and so carries a heap slice (`GcmStream`).
+
+## Layer Separation
+
+```
+┌────────────────────────────────────────────────────────┐
+│  Layer 1: ABI façade  (ck.zig, api/*)                    │
+│  - Validates handles, arguments, and the operation FSM   │
+│  - Translates between the C ABI and Zig types            │
+│  - Does NOT do cryptography or own state                 │
+└────────────────────────────────────────────────────────┘
+              ↓ may call into
+┌────────────────────────────────────────────────────────┐
+│  Layer 2: core state  (state, session, object_store,     │
+│           token, lock, env)                              │
+│  - Owns the single Instance behind the mutex             │
+│  - Knows objects, sessions, login, persistence           │
+│  - Does NOT speak the C ABI or pick return codes         │
+└────────────────────────────────────────────────────────┘
+              ↓ may call into
+┌────────────────────────────────────────────────────────┐
+│  Layer 3: crypto  (digest, mac, cipher, ecdsa, rsa,      │
+│           pin, keystore, openssl)                        │
+│  - Pure primitives: takes bytes, returns bytes/errors    │
+│  - Does NOT know about sessions, handles, or the ABI     │
+└────────────────────────────────────────────────────────┘
+```
+
+### Why layers
+
+- **The crypto layer is testable in isolation.** Every file in `crypto/` has unit tests that run without a session or a token, against published vectors (NIST SP800-38A for AES-CBC, RFC 4231 for HMAC, RFC 3394 for key wrap, RFC 6979 for ECDSA). A bug in the math is caught there, not in an integration test.
+- **The ABI layer can be cross-checked mechanically.** Because `ck.zig` is pure shape with no logic, `tests/abi_test.zig` can compare it field by field against the translated OASIS headers.
+- **Return codes live in exactly one layer.** The crypto layer returns Zig errors; the ABI layer maps them to `CKR_*`. There is one `mapCipherErr`, one `mapSetErr`. A reader looking for "where does `CKR_DATA_LEN_RANGE` come from" has one place to look.
+
+### What lives where
+
+- **Layer 1** may import Layer 2 and Layer 3. It owns no mutable state of its own.
+- **Layer 2** may import Layer 3. It never imports an `api/*` file (no upward dependency).
+- **Layer 3** imports only `std`, `ck` (for constants and types), `config`, and for RSA the `openssl` bindings. It never reaches up.
+
+## Data Models
+
+### Object
+
+An object is a bag of attributes. Each attribute is a type tag, a byte value, and a flag that says whether the value is currently sealed.
+
+```zig
+pub const Attribute = struct {
+    type: ck.CK_ATTRIBUTE_TYPE,  // CKA_*
+    value: []u8,                  // owned bytes
+    sealed: bool = false,         // true when the value is GCM ciphertext at rest
+};
+
+pub const Object = struct {
+    attrs: std.ArrayList(Attribute),
+    // get / set / has / getBool / isToken / isPrivate / shouldSeal / clone / deinit
+};
+```
+
+The `sealed` flag is the in-memory analogue of the at-rest envelope. While the User is logged in, sensitive values are plaintext and `sealed = false`. On logout they are re-encrypted in place and `sealed = true`. A crypto operation that finds a sealed value it needs returns `CKR_USER_NOT_LOGGED_IN`, which covers the case where a sensitive token key was loaded sealed and the user has not logged in to unseal it.
+
+### Object store
+
+A fixed array of 256 slots, each optionally holding an entry, with a monotonic handle counter that never reuses a handle.
+
+```zig
+pub const Store = struct {
+    slots: [config.max_objects]?Entry = @splat(null),
+    next_handle: ck.CK_OBJECT_HANDLE = 1,  // never reused, so stale handles stay invalid
+};
+```
+
+Handle `0` is reserved as `CK_INVALID_HANDLE`. A host that holds a handle after `C_DestroyObject` and passes it back gets `CKR_OBJECT_HANDLE_INVALID`, not a recycled object, because the counter only ever moves forward.
+
+### Session
+
+```zig
+pub const Session = struct {
+    slot: ck.CK_SLOT_ID,
+    flags: ck.CK_FLAGS,               // CKF_RW_SESSION, CKF_SERIAL_SESSION
+    find: Find,                        // the active C_FindObjects cursor
+    digest_op:  ?digest.Hasher,        // one active op of each kind, at most
+    sign_op:    ?SignOp,
+    verify_op:  ?VerifyOp,
+    encrypt_op: ?EncryptOp,
+    decrypt_op: ?DecryptOp,
+    sign_recover_op:   ?RsaRecover,
+    verify_recover_op: ?RsaRecover,
+};
+```
+
+The session table is a fixed array of 64 slots. Opening a session scrubs the slot before reuse; closing it frees any heap (the GCM buffer) and zeroizes the slot. The whole table is wiped on `C_Finalize`.
+
+### Token record
+
+The token's authentication state is a small fixed struct, serialized to a fixed-size `extern struct` record on disk:
+
+```zig
+pub const Token = struct {
+    initialized: bool,
+    label: [32]u8,
+    so:   PinSlot,           // SO salt + Argon2id hash
+    user: ?PinSlot,          // User salt + hash, null until C_InitPIN
+    so_fail: u32,            // failure counters for lockout
+    user_fail: u32,
+    user_mk: ?keystore.Wrapped,  // the master key, wrapped under the User KEK
+};
+```
+
+`PinSlot` is a salt and a hash; the PIN itself is never present. `user_mk` is the wrapped master key: a salt, a nonce, the ciphertext, and a GCM tag. This is the entire authentication and at-rest-key state, and it fits in a few hundred bytes.
+
+## Security Architecture
+
+### Threat model
+
+What the module is built to resist:
+
+1. **Disk theft.** An attacker copies the token and object files. Sensitive values are sealed under a master key that is wrapped under the User PIN; the files are ciphertext without the PIN.
+2. **Offline PIN attack.** The attacker has the files and runs a dictionary against the PIN. Argon2id (64 MiB, t=3) makes each guess expensive.
+3. **Online PIN attack.** The attacker guesses against the live module. Three failures lock the token.
+4. **Key export through the API.** A logged-in attacker tries to read or wrap out the key. Sensitive and unextractable refuse.
+5. **Tampering at rest.** The attacker flips bytes in a sealed value. The GCM tag fails on unseal and the module fails closed.
+6. **Privilege confusion.** An SO tries to read User secrets. There is no SO keyslot for them.
+7. **Stale-result race.** A slow login races a token reinit. The generation counter rejects the stale commit.
+8. **Memory residue.** A crash dump or cold-boot read tries to recover keys from freed or idle memory. Zeroization and the logout relock shrink that window.
+
+What is explicitly out of scope:
+
+- **Physical side channels.** Power analysis, electromagnetic emanation, and microarchitectural attacks like cachebleed are hardware problems. The software constant-time work addresses timing, not power. A real HSM adds physical countermeasures this software cannot.
+- **A malicious host while the User is logged in.** PKCS#11's model trusts the calling process during a logged-in session. If the host is compromised while logged in, it can ask the module to sign anything. The module protects the *key*, not the host's intentions.
+- **The Windows ABI.** The struct layout is the Linux/macOS LP64 natural-alignment ABI. Windows uses 1-byte packing and a 4-byte `CK_ULONG`, a separate build that is not targeted here.
+
+### Defense in depth
+
+```
+   On disk:     sealed values (AES-256-GCM) + wrapped MK (AES-256-GCM under Argon2id KEK)
+        ↓ C_Login unseals into RAM
+   In RAM:      plaintext only while User-logged-in; relocked + MK wiped on logout/close/finalize
+        ↓ a sensitive value needed by an op while sealed
+   At the API:  CKR_USER_NOT_LOGGED_IN; sensitive reads -> CKR_ATTRIBUTE_SENSITIVE
+        ↓ every comparison of a secret
+   In compute:  constant-time PIN and MAC checks; uniform error codes on RSA decrypt
+```
+
+## Storage Strategy
+
+There are two files, both paths resolved from the environment.
+
+- **The token file** (`ANGELAMOS_HSM_TOKEN`, default `$HOME/.angelamos-hsm-token`). A single fixed-size record holding the auth state and the wrapped master key. Written with a temp-file-then-rename so a crash mid-write cannot leave a half-record.
+- **The object file** (`ANGELAMOS_HSM_OBJECTS`, default `$HOME/.angelamos-hsm-objects`). A variable-length record holding only *token* objects (`CKA_TOKEN = CK_TRUE`); session objects are never persisted. Sensitive attribute values are sealed; public values are stored plaintext.
+
+Both records carry a magic number and a version. The version was bumped when sealing was introduced, so an old plaintext-era file is rejected rather than misread. A corrupt object file parses to empty rather than crashing, so a damaged store degrades to "no objects" instead of undefined behavior.
+
+This is the one place the design diverges from SoftHSM2, which uses a directory per token and a file per object (or a SQLite database). A single file is simpler and sufficient for an emulator; the per-object directory layout is noted as an extension in [04-CHALLENGES.md](./04-CHALLENGES.md).
+
+## Configuration
+
+Every tunable lives in `config.zig`. There are no magic numbers scattered through the code; a value like the GCM buffer cap or the Argon2id memory cost is named once and referenced everywhere.
+
+```bash
+ANGELAMOS_HSM_TOKEN     # path to the token record (default: $HOME/.angelamos-hsm-token)
+ANGELAMOS_HSM_OBJECTS   # path to the object store (default: $HOME/.angelamos-hsm-objects)
+```
+
+Reading the environment at a C boundary is its own small problem: there is no `std.process` arena to lean on, so `env.zig` walks `std.c.environ` directly. Notable constants in `config.zig`: PIN length 4 to 255, Argon2id t=3 / m=64 MiB / p=1, three login attempts, AES 16 or 32-byte keys, RSA 2048 to 4096 bits, the 16 MiB GCM stream cap, 256 objects, 64 sessions.
+
+## Performance Considerations
+
+This is an emulator, so correctness and clarity are weighted above throughput. That said, the design avoids the obvious traps:
+
+- **The global lock is released across Argon2id.** A login does not freeze every other session for the duration of the KDF. The lock is held only for the quick state reads and the final commit.
+- **AES-NI when present.** `std.crypto.core.aes` selects the hardware AES path at compile time when the target has it, so CBC and GCM run on the CPU's AES unit, which is also constant-time by design.
+- **Operation state is inline.** Sign, verify, and digest state live in the `Session` struct with no per-operation heap allocation. Only GCM, which must buffer the whole message, touches the heap.
+
+The bottleneck under load is the single global mutex: this is a serial design, which matches PKCS#11's serial execution model (`C_GetFunctionStatus` and `C_CancelFunction` exist only for the long-dead parallel model and return `CKR_FUNCTION_NOT_PARALLEL`). Sharding by slot is possible but pointless here, since there is one slot.
+
+## Design Decisions
+
+### libcrypto for RSA, pure Zig for everything else
+
+**What we chose:** AES, SHA-2, HMAC, ECDSA, ECDH, and Argon2id come from `std.crypto`. RSA links OpenSSL's `libcrypto`.
+
+**Alternatives considered:** A pure-Zig RSA. Rejected because `std.crypto` has no public RSA (it exists privately inside the TLS code), and the available third-party Zig RSA libraries are either blind-signature-focused or not safe to trust. Hand-rolling RSA, with its padding schemes and constant-time requirements, is exactly the kind of thing you should not hand-roll.
+
+**Trade-offs:** A C dependency and a slightly larger build. Mitigated by binding `libcrypto` through hand-written `extern` declarations rather than `@cImport`, and by a version script that exports only `C_GetFunctionList`, so none of OpenSSL's symbols leak out of the module.
+
+### Selective sealing, not whole-file encryption
+
+**What we chose:** Only sensitive attribute *values* are encrypted at rest. Public material stays plaintext.
+
+**Alternatives considered:** Encrypting the entire object file under the master key. Rejected because public objects and public key material are meant to be visible before login (you can read a public key's modulus without a PIN). Encrypting everything would break that and force a login just to list the token.
+
+**Trade-offs:** The codec is more complex (it has to decide per attribute), but the behavior is spec-correct and the public surface stays usable pre-login.
+
+### A single User keyslot, no SO keyslot for secrets
+
+**What we chose:** The master key is wrapped only under the User PIN. The SO can administer and reset, but has no path to the User's secret values.
+
+**Alternatives considered:** A second keyslot wrapping the MK under the SO PIN, so the SO could recover. Rejected on principle: an SO who can read User keys is a backdoor. The cost is that there is no key recovery if the User PIN is lost, which is the correct trade for a security module.
+
+### GCM buffered, not streamed through libcrypto
+
+**What we chose:** AES-GCM accumulates the whole message and runs the authenticated operation once at `*Final`. Covered in [01-CONCEPTS.md](./01-CONCEPTS.md) and [MECHANICS.md](./MECHANICS.md).
+
+**Alternatives considered:** Using libcrypto's EVP streaming-decrypt. Rejected because it releases unverified plaintext before the tag check. Buffering removes the RUP class of bug entirely, at the cost of a 16 MiB per-message bound.
+
+## Error Handling Strategy
+
+Errors come in two flavors and are handled in two places.
+
+1. **Zig errors in the crypto layer.** A cipher failure, an out-of-memory, a malformed record. These are Zig `error` values. The crypto layer never picks a `CKR_*` code; it returns the error.
+2. **`CKR_*` codes at the ABI layer.** Each entry point maps the Zig error to the precise return code the spec wants, through one of a handful of mappers (`mapCipherErr`, `mapSetErr`, the per-call switches). RSA decryption failures collapse to a single code so they cannot be used as a padding oracle.
+
+The guiding rule is **fail closed**. If a re-seal at logout fails (say, out of memory), the plaintext is scrubbed in place anyway (`scrubUnsealed`) so a failed cleanup never leaves a secret in the clear. If a slow operation cannot prove its result is still current, it returns `CKR_FUNCTION_FAILED` rather than commit stale state.
+
+## Extensibility
+
+### Adding a new mechanism
+
+The mechanism list is data, not code. To add one:
+
+1. Add the `CKM_*` constant to `ck.zig` (the ABI test will cross-check it against the OASIS header automatically).
+2. Add it to `config.supported_mechanisms` and give it a `CK_MECHANISM_INFO` arm in `slot_token.zig`'s `C_GetMechanismInfo`.
+3. Implement the primitive in a `crypto/*` file with unit tests against a published vector.
+4. Wire it into the relevant `crypto_ops.zig` or `keymgmt.zig` dispatch (the `modeOf` / `hashModeOf` / `isRsa*Mech` helpers).
+
+The layered design means each step is local: the math lands in Layer 3 with its own tests, the dispatch in Layer 1.
+
+### Where v3.0 would go
+
+PKCS#11 v3.0 adds a second entry point, `C_GetInterface`, and 24 functions including the message-based AEAD family. The ABI is laid out so a `CK_FUNCTION_LIST_3_0` (the same prefix plus the new pointers) can be added beside the existing table, and `C_GetInterface` exported alongside `C_GetFunctionList`. This is the largest of the [04-CHALLENGES.md](./04-CHALLENGES.md) extensions.
+
+## Limitations
+
+These are conscious trade-offs, not bugs.
+
+1. **One slot, one token.** A real HSM exposes many slots. Here there is exactly one, always present. Multi-slot would mean sharding the global state per slot.
+2. **Single-file storage.** No per-object files, no database. Fine for an emulator; a directory backend is the SoftHSM2 approach and a listed extension.
+3. **AES-128 and AES-256 only.** Zig's standard library has no 192-bit AES. Supporting it would mean routing AES-192 through libcrypto like RSA.
+4. **No v3.0 surface.** v2.40 only, by scope. The structure leaves room for it.
+5. **Linux/macOS ABI.** The Windows packed layout is a separate build.
+
+## Comparison to Similar Systems
+
+### SoftHSM2
+
+The reference open-source software HSM, and the model this project follows.
+
+- **Same:** the three-layer façade / store / crypto split, the two-call attribute handling, the per-token PIN with encrypted private-key material, the OpenSSL crypto backend for RSA.
+- **Different:** SoftHSM2 stores each object as a file under a per-token directory (or in SQLite); this uses one object file. SoftHSM2 supports multiple tokens and slots; this has one. SoftHSM2 is C++; this is Zig with a machine-checked ABI, which SoftHSM2 does not have.
+
+### A real hardware HSM (Thales Luna, AWS CloudHSM, YubiHSM)
+
+- **Same interface.** A host cannot tell the difference at the API level; that is the point of PKCS#11.
+- **Different boundary.** A hardware HSM enforces custody with a physical chip and tamper response. This enforces it with process boundaries and software discipline. The software version resists the threats in the model above; it does not resist an attacker with physical access and an oscilloscope.
+
+## Key Files Reference
+
+Quick map of where to find things:
+
+- `src/ck.zig`: the ABI. Start here.
+- `src/main.zig`: the exported symbol and the wired table.
+- `src/core/state.zig`: the instance, `acquire()`, the generation counter.
+- `src/api/session.zig`: login, the snapshot-unlock-recheck pattern in `C_Login`.
+- `src/api/crypto_ops.zig`: the whole sign/verify/encrypt/decrypt surface.
+- `src/core/object_store.zig`: objects and the sealing codec.
+- `src/crypto/keystore.zig`: the envelope (wrap/unwrap, seal/unseal).
+- `src/crypto/cipher.zig`: AES modes and RFC 3394 key wrap.
+
+## Next Steps
+
+Now that you understand the design:
+1. Read [03-IMPLEMENTATION.md](./03-IMPLEMENTATION.md) to walk the actual code of the ABI, an end-to-end operation, and the secret-handling patterns.
+2. Read [MECHANICS.md](./MECHANICS.md) for the cryptographic details of each mechanism.
+3. Try modifying `config.supported_mechanisms` and watch the ABI test and `C_GetMechanismInfo` respond.
diff --git a/PROJECTS/advanced/hsm-emulator/learn/03-IMPLEMENTATION.md b/PROJECTS/advanced/hsm-emulator/learn/03-IMPLEMENTATION.md
new file mode 100644
index 00000000..68ffcd0b
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/learn/03-IMPLEMENTATION.md
@@ -0,0 +1,510 @@
+<!-- ©AngelaMos | 2026 -->
+<!-- 03-IMPLEMENTATION.md -->
+
+# Implementation Guide
+
+This document walks the actual code. It assumes you have read [02-ARCHITECTURE.md](./02-ARCHITECTURE.md). Code is referenced by file and function name so you can open the file and search for it. Snippets are real, lightly trimmed for focus.
+
+## File Structure Walkthrough
+
+```
+src/
+├── ck.zig             # the hand-written ABI: types, constants, structs, the function list
+├── main.zig           # exports C_GetFunctionList, wires the 68-slot table, comptime asserts
+├── config.zig         # every constant: sizes, KDF params, the mechanism list
+├── util.zig           # padded(): space-pad a fixed C string field at comptime
+├── core/
+│   ├── state.zig       # the global Instance, acquire(), the generation counter, finalize()
+│   ├── lock.zig        # the mutex
+│   ├── env.zig         # storage-path resolution from std.c.environ
+│   ├── token.zig       # the token record + atomic save/load
+│   ├── session.zig     # the session Table, op-state unions, the GcmStream buffer
+│   └── object_store.zig# the Object/Store types + the persistence codec with sealing
+├── api/
+│   ├── general.zig     # Initialize / Finalize / GetInfo / WaitForSlotEvent
+│   ├── slot_token.zig  # slot/token/mechanism queries + InitToken / InitPIN / SetPIN
+│   ├── session.zig     # OpenSession / Login / Logout / Get+SetOperationState
+│   ├── object.zig      # CreateObject / Find / GetAttributeValue / SetAttributeValue
+│   ├── crypto_ops.zig  # the digest/sign/verify/encrypt/decrypt/dual surface (the big one)
+│   ├── keymgmt.zig     # GenerateKey(Pair) / WrapKey / UnwrapKey / DeriveKey
+│   └── random.zig      # GenerateRandom / SeedRandom
+└── crypto/
+    ├── openssl.zig     # hand-written extern EVP/BN/OSSL_PARAM declarations
+    ├── pin.zig         # Argon2id derive / verify
+    ├── digest.zig      # the SHA-2 Hasher union + serializable state
+    ├── mac.zig         # the HMAC-SHA-2 Mac union
+    ├── cipher.zig      # AES-CBC/CBC-PAD/GCM + RFC 3394 key wrap
+    ├── ecdsa.zig       # P-256/384 keygen, sign, verify, ECDH
+    ├── rsa.zig         # the stateless libcrypto RSA bridge
+    └── keystore.zig    # the envelope: master-key wrap/unwrap, value seal/unseal
+```
+
+## Building the ABI: the contract with the host
+
+### The hand-written types
+
+`ck.zig` is the whole agreement with the host, and it is pure shape. The scalar types map to the Linux LP64 ABI:
+
+```zig
+pub const CK_BYTE = u8;
+pub const CK_ULONG = c_ulong;   // 8 bytes on LP64 Linux/macOS; this is the #1 ABI hazard
+pub const CK_RV = CK_ULONG;
+pub const CK_SESSION_HANDLE = CK_ULONG;
+pub const CK_OBJECT_HANDLE = CK_ULONG;
+```
+
+Using `c_ulong` (not `u64`) is deliberate: it is whatever the platform's C `unsigned long` is, which is exactly what the host's headers use. Get this wrong and every struct field after the first `CK_ULONG` is at the wrong offset, and the host silently reads garbage.
+
+The structs are plain `extern struct` with natural alignment. No `packed`, no `align(1)`:
+
+```zig
+pub const CK_ATTRIBUTE = extern struct {
+    type: CK_ATTRIBUTE_TYPE,
+    pValue: ?*anyopaque,
+    ulValueLen: CK_ULONG,
+};
+```
+
+The spec text says structures are 1-byte packed, but on Linux and macOS the real headers set no packing pragma and use natural alignment. That is the de-facto ABI every Linux host actually uses, so `extern struct` is correct and `packed` would be wrong.
+
+### The function list and the one exported symbol
+
+The heart of the ABI is `CK_FUNCTION_LIST`: a version followed by 68 function pointers in a fixed order that you cannot reorder. `main.zig` builds one static instance of it and exports the single symbol that hands out its address:
+
+```zig
+export fn C_GetFunctionList(ppFunctionList: *?*ck.CK_FUNCTION_LIST) callconv(.c) ck.CK_RV {
+    ppFunctionList.* = &function_list;
+    return ck.CKR_OK;
+}
+
+var function_list: ck.CK_FUNCTION_LIST = .{
+    .version = ck.CK_VERSION{ .major = 2, .minor = 40 },
+    .C_Initialize = general.C_Initialize,
+    .C_Finalize = general.C_Finalize,
+    // ... every one of the 68 slots, in canonical order ...
+    .C_WaitForSlotEvent = general.C_WaitForSlotEvent,
+};
+```
+
+Every slot points at a real `callconv(.c)` function. None is null, because a host calls through these pointers without checking, and a null slot segfaults inside the host. Operations that are deliberately unsupported point at a real function that returns the right `CKR_*` code, never at null.
+
+### Proving the layout at compile time
+
+`main.zig` will not compile if the table is the wrong size:
+
+```zig
+comptime {
+    std.debug.assert(@sizeOf(ck.CK_FUNCTION_LIST) == 69 * @sizeOf(usize));
+    std.debug.assert(@sizeOf(ck.CK_ATTRIBUTE) == 24);
+}
+```
+
+The table is the version plus 68 pointers, so 69 pointer-widths. `CK_ATTRIBUTE` is three eight-byte fields, so 24. These are cheap, but the real proof is the build-time cross-check against the OASIS headers, covered later.
+
+### The version script
+
+`pkcs11.map` is what keeps everything else hidden:
+
+```
+PKCS11_2_40 {
+    global:
+        C_GetFunctionList;
+    local:
+        *;
+};
+```
+
+`build.zig` applies it with `lib.setVersionScript`. Everything except `C_GetFunctionList` is `local`, so `objdump -T zig-out/lib/libhsm.so` shows exactly one exported symbol. The other `C_*` functions are reachable only through the table, and none of libcrypto's symbols leak.
+
+## Building an entry point: the acquire-and-defer template
+
+Every fast entry point has the same skeleton. `C_GetSessionInfo` from `api/session.zig` is a clean example:
+
+```zig
+pub fn C_GetSessionInfo(hSession: ck.CK_SESSION_HANDLE, pInfo: *ck.CK_SESSION_INFO) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const s = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    pInfo.* = .{
+        .slotID = s.slot,
+        .state = sessionState(s.flags, inst.logged_in),
+        .flags = s.flags,
+        .ulDeviceError = 0,
+    };
+    return ck.CKR_OK;
+}
+```
+
+`state.acquire()` is the only way to touch the instance. Its implementation locks the mutex, verifies the library is initialized *under the lock*, and unlocks-and-returns-null if not:
+
+```zig
+pub fn acquire() ?*Instance {
+    mutex.lock();
+    if (!@atomicLoad(bool, &present, .acquire)) {
+        mutex.unlock();
+        return null;
+    }
+    return &storage;
+}
+```
+
+The `defer state.mutex.unlock()` in the caller guarantees the lock is released on every path, including the early `CKR_SESSION_HANDLE_INVALID` return. This is why there is no lock-leak: you cannot forget the unlock because `defer` runs it for you.
+
+### The two-call length pattern
+
+Variable-length outputs use the spec's two-call dance: pass a null buffer to learn the size, then pass a real buffer. Here is the encrypt path from `crypto_ops.zig`, the AES arm:
+
+```zig
+const need: ck.CK_ULONG = @intCast(cipher.encryptOutLen(c.mode, in.len));
+if (pEncryptedData == null) {
+    pulEncryptedDataLen.* = need;          // first call: report the size
+    return ck.CKR_OK;
+}
+if (pulEncryptedDataLen.* < need) {
+    pulEncryptedDataLen.* = need;          // buffer too small: report size again
+    return ck.CKR_BUFFER_TOO_SMALL;        // and do NOT consume the operation
+}
+```
+
+The important subtlety is that a `CKR_BUFFER_TOO_SMALL` does not tear down the operation. The host is expected to retry with a bigger buffer, and the operation state must still be there when it does. A successful single-shot call, on the other hand, *does* end the operation (you will see `sess.endEncrypt(...)` after the bytes are written).
+
+## Logging in: the snapshot-unlock-recheck pattern
+
+`C_Login` in `api/session.zig` is the most careful function in the codebase, because it does an expensive Argon2id derivation that must not run while holding the global lock, and it must not commit a stale result if the token was reinitialized during that derivation.
+
+Step one: acquire, validate, and read out what the slow part needs. Then record the generation, grab the io and allocator, and release the lock:
+
+```zig
+const gen = state.cryptoBegin();   // returns the current generation, marks an op in flight
+const io = inst.io();
+const allocator = inst.allocator();
+state.mutex.unlock();              // release the lock for the slow part
+defer std.crypto.secureZero(u8, &hash);
+```
+
+Step two: the slow work, with no lock held. Verify the PIN, and if this is a User login, unwrap the master key:
+
+```zig
+const ok = pin.verify(io, allocator, pinSlice(pPin, ulPinLen), &salt, &hash) catch {
+    state.cryptoAbort();
+    return ck.CKR_FUNCTION_FAILED;
+};
+// ... if ok and userType == CKU_USER, keystore.unwrap(...) the master key ...
+```
+
+Step three: re-lock, and refuse if the world changed underneath us:
+
+```zig
+state.mutex.lock();
+defer state.mutex.unlock();
+state.cryptoEnd();
+if (state.currentGeneration() != gen) return ck.CKR_FUNCTION_FAILED;  // token was reinitialized
+if (inst.logged_in != null) return ck.CKR_USER_ALREADY_LOGGED_IN;
+if (ok) {
+    inst.logged_in = userType;
+    if (have_mk) {
+        inst.mk = mk;
+        object_store.unlock(allocator, &inst.objects, mk) catch {
+            inst.relock();
+            inst.logged_in = null;
+            return ck.CKR_FUNCTION_FAILED;
+        };
+    }
+    token.save(inst.io(), inst.token) catch {};
+    return ck.CKR_OK;
+}
+```
+
+The `generation` check is the time-of-check-to-time-of-use defense made explicit. `C_InitToken` and `C_InitPIN` call `state.bumpGeneration()`. If one of them ran while this login was deriving Argon2id, the committing thread sees `currentGeneration() != gen` and throws its stale result away rather than logging into a token that no longer exists in the form it checked.
+
+On success, `object_store.unlock` walks every sealed sensitive value and decrypts it in place with the now-unwrapped master key. If that fails (a corrupt sealed value), the function relocks and refuses the login, so a damaged store cannot leave you half-unsealed.
+
+## The object store and the sealing codec
+
+### Objects are attribute bags
+
+`object_store.zig` models an object as a list of attributes, each with a `sealed` flag. `set` replaces or appends, securely freeing the old value and clearing any stale sealed flag:
+
+```zig
+pub fn set(self: *Object, allocator: std.mem.Allocator, t: ck.CK_ATTRIBUTE_TYPE, bytes: []const u8) !void {
+    if (bytes.len > config.max_attr_value_len) return error.AttrTooLarge;
+    if (self.findPtr(t)) |a| {
+        const dup = try allocator.dupe(u8, bytes);
+        secureFree(allocator, a.value);   // scrub the old value before freeing
+        a.value = dup;
+        a.sealed = false;                  // a fresh plaintext value is not sealed
+        return;
+    }
+    // ... append a new attribute ...
+}
+```
+
+### What gets sealed
+
+`shouldSeal` decides whether a given attribute on a given object is secret material that must be encrypted at rest. It is secret if the type is one of the key-material attributes (the AES/HMAC value, or the RSA private exponent and CRT factors) and the object is marked sensitive or unextractable:
+
+```zig
+pub fn shouldSeal(self: *const Object, t: ck.CK_ATTRIBUTE_TYPE) bool {
+    if (!isSecretMaterial(t)) return false;
+    if (self.getBool(ck.CKA_SENSITIVE)) return true;
+    return self.has(ck.CKA_EXTRACTABLE) and !self.getBool(ck.CKA_EXTRACTABLE);
+}
+```
+
+A public value (a modulus, an EC point, a label) returns false and is stored plaintext, so it stays readable before login.
+
+### The codec: seal on the way out, mark sealed on the way in
+
+`serialize` writes only token objects, and seals each sensitive value as it writes it:
+
+```zig
+if (!a.sealed and e.obj.shouldSeal(a.type)) {
+    const key = mk orelse return error.NoMasterKey;
+    const scratch = try allocator.alloc(u8, keystore.sealedLen(a.value.len));
+    defer allocator.free(scratch);
+    const wrote = try keystore.seal(io, &key, std.mem.asBytes(&a.type), a.value, scratch);
+    // append the sealed bytes
+} else {
+    // append the plaintext value
+}
+```
+
+Note `std.mem.asBytes(&a.type)` as the associated data: the attribute's type is bound into the GCM tag, so a sealed `CKA_PRIVATE_EXPONENT` cannot be moved into a slot expecting a `CKA_VALUE` without breaking authentication.
+
+`parse` reads the values back and, after loading, marks the sensitive ones sealed so they are not treated as usable plaintext until `C_Login` unseals them. The whole load is fail-safe: a bad magic, a bad version, a truncated record, or too many attributes all cause the store to clear to empty rather than crash.
+
+## The RUP-safe GCM buffer
+
+`GcmStream` in `session.zig` is the accumulator that makes streaming GCM safe. `append` grows a heap buffer, secure-zeroing the old backing on every realloc, and enforces the 16 MiB cap:
+
+```zig
+pub fn append(self: *GcmStream, allocator: std.mem.Allocator, bytes: []const u8) error{ OutOfMemory, TooLarge }!void {
+    if (bytes.len == 0) return;
+    const needed = self.len + bytes.len;
+    if (needed > config.max_gcm_stream_len) return error.TooLarge;
+    if (self.buf == null or self.buf.?.len < needed) {
+        var new_cap: usize = if (self.buf) |b| b.len else 256;
+        while (new_cap < needed) new_cap *|= 2;
+        if (new_cap > config.max_gcm_stream_len) new_cap = config.max_gcm_stream_len;
+        const fresh = try allocator.alloc(u8, new_cap);
+        if (self.buf) |old| {
+            @memcpy(fresh[0..self.len], old[0..self.len]);
+            std.crypto.secureZero(u8, old);   // scrub the old buffer, it held plaintext
+            allocator.free(old);
+        }
+        self.buf = fresh;
+    }
+    @memcpy(self.buf.?[self.len..][0..bytes.len], bytes);
+    self.len += bytes.len;
+}
+```
+
+In `crypto_ops.zig`, `C_EncryptUpdate` and `C_DecryptUpdate` for the GCM arm append and report zero bytes written. The real GCM call happens in `C_*Final`, where for decrypt the tag is verified before any plaintext is returned. The smoke harness drives a multi-block message through `C_DecryptUpdate` in 19-byte chunks and asserts every update emits zero, then gets the plaintext only at `C_DecryptFinal`.
+
+## The RSA bridge to libcrypto
+
+`rsa.zig` is stateless. It never holds an `EVP_PKEY` across calls; it rebuilds one from the PKCS#11-native components each time. `generate` extracts the components out of a freshly generated key:
+
+```zig
+pub fn generate(bits: u32) Error!Generated {
+    const ctx = ossl.EVP_PKEY_CTX_new_id(ossl.pkey_rsa, null) orelse return Error.Crypto;
+    defer ossl.EVP_PKEY_CTX_free(ctx);
+    if (ossl.EVP_PKEY_keygen_init(ctx) <= 0) return Error.Crypto;
+    if (ossl.EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, @intCast(bits)) <= 0) return Error.Crypto;
+    var pkey: ?*ossl.EVP_PKEY = null;
+    if (ossl.EVP_PKEY_generate(ctx, &pkey) <= 0) return Error.Crypto;
+    defer ossl.EVP_PKEY_free(pkey);
+    // extract n, e, d, p, q, dmp1, dmq1, iqmp into a Generated struct
+}
+```
+
+`sign` rebuilds the key from the stored components, then either hash-then-signs (for `CKM_SHA256_RSA_PKCS` and the PSS variants) or signs a pre-hashed value directly (`CKM_RSA_PKCS` raw). The components are passed in fresh each call; the operation state in the session held only the handle.
+
+The bindings in `openssl.zig` are hand-written `extern fn` declarations, not `@cImport`. This is what keeps the production `.so` clean: there is no translated header pulling symbols in, and the version script exports nothing but `C_GetFunctionList`. One detail worth seeing is the use of `BN_clear_free` rather than `BN_free` for the private BIGNUMs:
+
+```zig
+pub extern fn BN_clear_free(a: ?*BIGNUM) void;  // zeroes the BIGNUM before freeing
+```
+
+`BN_free` does not zero the memory; `BN_clear_free` does. The private components (d, p, q, the CRT values) are freed with `BN_clear_free` so they are not left in freed heap.
+
+## Secret-handling patterns
+
+The same handful of patterns appear everywhere a secret lives.
+
+**Stack secrets: defer secureZero.** A derived hash, a master key on the stack, a decrypted buffer:
+
+```zig
+var hash: pin.Hash = undefined;
+defer std.crypto.secureZero(u8, &hash);
+```
+
+`secureZero` takes a `[]volatile` slice, which forbids the compiler from deleting the write as dead store. A plain `@memset(&hash, 0)` with no later read can be optimized away; `secureZero` cannot.
+
+**Heap secrets: secureFree.** Every attribute value is freed through one function that scrubs first:
+
+```zig
+fn secureFree(allocator: std.mem.Allocator, value: []u8) void {
+    std.crypto.secureZero(u8, value);
+    allocator.free(value);
+}
+```
+
+**Operation state: zeroize on teardown.** The session op unions zero themselves when an operation ends. `endSign`, `endEncrypt`, and friends call into the union's `zeroize`/`deinit` (which `secureZero`s the whole union and frees any heap), then null the field. The session `Table` scrubs slots on open, close, and a full `wipeAll` at `C_Finalize`.
+
+**Logout: relock and wipe.** `inst.relock()` re-seals every sensitive value and wipes the master key:
+
+```zig
+pub fn relock(self: *Instance) void {
+    if (self.mk) |*mk| object_store.lock(self.io(), self.allocator(), &self.objects, mk.*) catch {
+        object_store.scrubUnsealed(&self.objects);  // if re-seal fails, scrub in place: fail closed
+    };
+    self.wipeMasterKey();
+}
+```
+
+If the re-seal fails (for example, out of memory), `scrubUnsealed` zeroes the plaintext values in place and marks them sealed, so a failed cleanup never leaves a secret in the clear. This is the fail-closed principle in code.
+
+## The ABI cross-check
+
+`tests/abi_test.zig` is what turns "the ABI matches the spec" from a hope into a build-time invariant. `build.zig` runs `addTranslateC` on a shim that includes the vendored OASIS headers, producing a `p11c` module. The test then compares the hand-written `ck.zig` against it.
+
+Layout equality, field by field:
+
+```zig
+test "hand-coded structs match OASIS-translated layout byte-for-byte" {
+    try expectSameLayout(ck.CK_ATTRIBUTE, p11c.CK_ATTRIBUTE);
+    try expectSameLayout(ck.CK_FUNCTION_LIST, p11c.CK_FUNCTION_LIST);
+    // ... every struct ...
+}
+```
+
+Constant equality, every constant that exists in both:
+
+```zig
+test "every hand-coded constant equals its OASIS value" {
+    inline for (@typeInfo(ck).@"struct".decls) |d| {
+        if (@hasDecl(p11c, d.name)) {
+            // assert ck.<name> == p11c.<name>, error.ConstantMismatch if not
+        }
+    }
+    try std.testing.expect(checked >= 100);  // and we checked at least 100 of them
+}
+```
+
+And the per-function C-ABI signatures: every entry in `CK_FUNCTION_LIST` is compared against the translated one for parameter count and parameter sizes/alignments. Add a constant to `ck.zig` that also exists in the OASIS headers and this loop picks it up automatically; get an offset wrong and the build fails with the exact field that diverged.
+
+## The smoke harness
+
+`examples/smoke.zig` is not a unit test. It `dlopen`s the *built* `.so` and calls through the function list exactly like an external host, which is the only way to catch export bugs and ABI-shape bugs that in-process tests miss:
+
+```zig
+var lib = try std.DynLib.open(default_module);
+const getFunctionList = lib.lookup(GetFunctionList, "C_GetFunctionList") orelse return error.SymbolNotFound;
+var list_ptr: ?*ck.CK_FUNCTION_LIST = null;
+try check("C_GetFunctionList", getFunctionList(&list_ptr));
+const f = list_ptr orelse return error.NullFunctionList;
+```
+
+From there it walks a full lifecycle: init the token, log in as SO, init the User PIN, set the PIN, create and find objects, prove a private object is hidden after logout, generate AES/EC/RSA keys, sign and verify (and tamper), encrypt and decrypt, derive an ECDH secret on both sides, wrap and unwrap, run GCM streaming and assert it equals the one-shot, exercise the dual functions, recover with RSA, round-trip operation state, and finally assert every conformance edge (`C_WaitForSlotEvent`, `C_GetFunctionStatus`, `C_SeedRandom`). It prints a summary block at the end so you can see at a glance what passed.
+
+## Common Implementation Pitfalls
+
+### Pitfall: a plain `zig build` does not match the shipped module
+
+**Symptom:** you inspect a zeroized secret in a debugger and see `0xAA` bytes, not zeros, and conclude the zeroization is broken.
+
+**Cause:** `zig build` with no flags is a Debug build. In Debug and ReleaseSafe, Zig poisons an optional's payload to `0xAA` when you set it to null, and `Allocator.free` memsets freed memory to `0xAA`. So `secureZero`-then-null leaves `0xAA` (the secret is gone, just not zero).
+
+**Fix:** test for "the secret pattern is gone", not "all bytes are zero". The session tests assert the secret byte is absent, not that the buffer is zero. The shipped artifact is `zig build --release=safe`, where the explicit `secureZero` is what protects you (there is no poison in release builds without the safety check, so the explicit zero matters).
+
+### Pitfall: comparing secrets with `std.mem.eql`
+
+**Symptom:** a PIN or MAC check that works functionally but leaks timing.
+
+**Cause:** `std.mem.eql` returns on the first mismatched byte.
+
+**Fix:** `std.crypto.timing_safe.eql` for fixed-size arrays (the PIN hash), or the `ctEql` helper in `crypto_ops.zig` for variable-length MACs. Both look at every byte before deciding.
+
+### Pitfall: leaving a function-list slot null
+
+**Symptom:** the host segfaults the moment it calls an unsupported function.
+
+**Cause:** a null pointer in the table.
+
+**Fix:** every slot points at a real `callconv(.c)` function. Unsupported operations return a `CKR_*` code; they are never null. The `comptime` size assert in `main.zig` and the ABI test guard the shape.
+
+## Debugging Tips
+
+### Watch every call with pkcs11-spy
+
+When a host call misbehaves, the fastest way to see what it actually sent is `pkcs11-spy`, which sits in front of your module and logs every call:
+
+```bash
+export PKCS11SPY=$PWD/zig-out/lib/libhsm.so
+export PKCS11SPY_OUTPUT=/tmp/spy.log
+pkcs11-tool --module /usr/lib/x86_64-linux-gnu/pkcs11/pkcs11-spy.so -T
+```
+
+The `just spy` recipe wraps this. The log shows each `C_*` call, its arguments, and its return code, so you can find the exact call that returned the wrong thing and with what inputs.
+
+### Read the return code, then read the spec
+
+PKCS#11 return codes are specific. `CKR_OPERATION_NOT_INITIALIZED` means a `C_Sign` came without a `C_SignInit`. `CKR_OPERATION_ACTIVE` means a second `C_SignInit` while one was live. `CKR_ATTRIBUTE_SENSITIVE` means you asked for a sealed value. When a host fails, the code it got usually names the bug.
+
+### Confirm the export surface
+
+If a host cannot load the module at all, check that the one symbol is there and nothing else leaked:
+
+```bash
+objdump -T zig-out/lib/libhsm.so | grep ' g '   # should show only C_GetFunctionList
+```
+
+## Code Organization Principles
+
+### Why one file per function group
+
+The `api/*` split mirrors the spec's own grouping (slot/token, session, object, crypto, key management). A reader looking for "how does login work" opens `api/session.zig`; "how does signing work" opens `api/crypto_ops.zig`. Each file imports the core and crypto layers it needs and nothing it does not.
+
+### Why the crypto layer never picks a return code
+
+Crypto functions return Zig errors (`error.Crypto`, `cipher.Error.DataLenRange`). The ABI layer maps them to `CKR_*`. This keeps the crypto layer independently testable (a test asserts `error.AuthFailed`, not `CKR_*`) and keeps return-code policy in one layer. There is one `mapCipherErr`, one `mapSetErr`.
+
+## Extending the Code
+
+### Adding a mechanism, concretely
+
+Say you want to add HMAC-SHA-512 (it is already there, but the steps are the same for any new one):
+
+1. **Constant.** Add `CKM_FOO` to `ck.zig`. If the OASIS headers define it, the ABI test cross-checks the value for free.
+2. **Advertise it.** Add `CKM_FOO` to `config.supported_mechanisms` and give it an arm in `slot_token.zig`'s `C_GetMechanismInfo` with the right key-size bounds and flags.
+3. **Implement.** Add the primitive in the relevant `crypto/*` file. Write a unit test against a published vector and add the file to `test_all.zig`.
+4. **Dispatch.** Wire it into the classifier helper it belongs to (`mac.macLenOf`, `cipher.modeOf`, `ecdsa.hashModeOf`, or the RSA `isRsa*Mech` checks) so the `*Init` functions route to it.
+
+### Adding an entry point
+
+Copy the acquire-and-defer skeleton from any `api/*` function. Validate the session handle first, then the arguments, then do the work, then set the in/out lengths and return the precise code. If the operation is slow (a KDF, a keygen that should not hold the lock), use the snapshot-unlock-recheck pattern from `C_Login`.
+
+## Code Style
+
+The project follows the repository conventions: a file header comment and no inline comments elsewhere, every constant in `config.zig` (no magic numbers in the logic), and `zig fmt` clean. Run the formatter check and the full suite together:
+
+```bash
+just ci    # zig fmt --check + zig build test + zig build smoke
+```
+
+## Build and Test
+
+```bash
+zig build --release=safe   # the shipped artifact
+zig build test             # ABI cross-check + the crypto/core unit suite
+zig build smoke            # dlopen the built .so and run the full lifecycle
+```
+
+`zig build test` runs two test binaries: `tests/abi_test.zig` (the OASIS cross-check) and `src/test_all.zig` (which pulls in every `crypto/*` and `core/*` test file). The crypto tests run against published vectors, so a regression in the math is caught at the unit level, and the ABI test catches any layout drift at the same step.
+
+## Next Steps
+
+1. Read [MECHANICS.md](./MECHANICS.md) for the cryptographic detail behind the dispatch you just saw: how AES-CBC chains, how PKCS#7 padding is verified, how RFC 3394 wrapping works, how ECDSA and ECDH compute, and how RSA's schemes differ.
+2. Read [CONFORMANCE.md](./CONFORMANCE.md) for the exact return code at every deliberate boundary.
+3. Open `examples/smoke.zig` and trace one operation from the `f.C_...` call down through the layers you now know.
diff --git a/PROJECTS/advanced/hsm-emulator/learn/04-CHALLENGES.md b/PROJECTS/advanced/hsm-emulator/learn/04-CHALLENGES.md
new file mode 100644
index 00000000..b0deb179
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/learn/04-CHALLENGES.md
@@ -0,0 +1,330 @@
+<!-- ©AngelaMos | 2026 -->
+<!-- 04-CHALLENGES.md -->
+
+# Extension Challenges
+
+You have a working software HSM. Now make it yours. These challenges are ordered by difficulty, and each one names the real files and functions you will touch so you are not hunting. Start easy to learn the codebase's shape, then go deeper.
+
+The golden rule of this project applies to every challenge: nothing is done until an external tool exercises it. Add a unit test against a published vector, then prove it through `pkcs11-tool` or the smoke harness.
+
+## Easy Challenges
+
+### Challenge 1: Add SHA-224 as a digest mechanism
+
+**What to build:** Support `CKM_SHA224` alongside the existing SHA-256/384/512 digests.
+
+**Why it's useful:** SHA-224 is still required by some compliance profiles, and adding it teaches you the exact path a new mechanism takes through the layers.
+
+**What you'll learn:**
+- The four-step "add a mechanism" path described in [02-ARCHITECTURE.md](./02-ARCHITECTURE.md)
+- How the ABI test cross-checks a new constant for free
+
+**Hints:**
+- Add `CKM_SHA224` to `ck.zig`. The "every hand-coded constant equals its OASIS value" test in `tests/abi_test.zig` will check the value against the header automatically.
+- Add a `sha224` arm to the `Hasher` union in `crypto/digest.zig` (Zig's std has `sha2.Sha224`), and give it a new state tag for operation-state serialization.
+- Add it to `config.supported_mechanisms` and to the digest arm of `C_GetMechanismInfo` in `slot_token.zig`.
+
+**Test it works:**
+```bash
+pkcs11-tool --module zig-out/lib/libhsm.so --hash --mechanism SHA224 --input-file msg.bin
+```
+Compare against `sha224sum msg.bin`. Add a unit test in `digest.zig` against the `SHA-224("abc")` vector.
+
+### Challenge 2: Expose a token-info detail you control
+
+**What to build:** Make the token model string or serial number configurable through an environment variable instead of a fixed constant.
+
+**Why it's useful:** Real deployments label tokens. It is a gentle introduction to the config and slot-token layers.
+
+**What you'll learn:**
+- How `config.zig` centralizes every constant
+- How `env.zig` reads the environment at the C boundary (there is no `std.process` arena here)
+
+**Hints:**
+- `C_GetTokenInfo` in `slot_token.zig` fills the `model` and `serialNumber` fields from `config.token_model` and `config.token_serial` through `util.padded`.
+- Add an env lookup in `env.zig` and fall back to the constant when it is unset, mirroring how the storage paths work.
+- Remember the fields are space-padded fixed arrays, not NUL-terminated strings.
+
+**Test it works:** `pkcs11-tool -T` should show your value, and an unset variable should show the default.
+
+### Challenge 3: Add a `just` recipe that signs and then verifies with OpenSSL
+
+**What to build:** A recipe that generates an EC key in the module, signs a file, exports the public key, and verifies the signature with the `openssl` command line.
+
+**Why it's useful:** Cross-verifying against an independent implementation is exactly how this project proves correctness. You are turning that into a one-liner.
+
+**What you'll learn:**
+- How `pkcs11-tool` and `openssl` interoperate through the module
+- Why an independent oracle is stronger proof than a self-test
+
+**Hints:**
+- Look at the existing `justfile` recipes and the smoke flow for the command sequence.
+- `pkcs11-tool --read-object --type pubkey` exports the public key; `openssl dgst -verify` checks the signature.
+
+**Test it works:** The recipe exits 0 and prints `Verified OK`.
+
+## Intermediate Challenges
+
+### Challenge 4: AES-192
+
+**What to build:** Support 192-bit AES keys for `CKM_AES_KEY_GEN`, `CKM_AES_CBC`, `CKM_AES_CBC_PAD`, and `CKM_AES_GCM`.
+
+**Why it's useful:** It is currently unsupported because Zig's standard library exposes no 192-bit AES (see [CONFORMANCE.md](./CONFORMANCE.md) section 3.3). Solving it teaches you the same libcrypto-bridge pattern RSA uses.
+
+**Real world application:** Some FIPS profiles and legacy systems require AES-192 specifically.
+
+**Implementation approach:**
+1. Decide the backend. Zig std has no Aes192, so route 192-bit keys through libcrypto's EVP AES, the way `rsa.zig` routes RSA.
+2. Add the extern declarations you need to `openssl.zig` (the EVP cipher functions).
+3. Branch on key length in `cipher.zig`'s block and GCM functions, calling libcrypto for 24-byte keys and keeping std for 16 and 32.
+4. Update `cipher.validKeyLen` and the `CKR_KEY_SIZE_RANGE` checks to accept 24.
+
+**Hints:**
+- The `encBlockRaw` / `decBlockRaw` functions currently `switch (key.len)` over 16 and 32 with `unreachable` otherwise. That switch is where the 24-byte arm goes.
+- Keep the constant-time and zeroization patterns identical to the existing arms.
+
+**Test it works:** A NIST AES-192-CBC vector in `cipher.zig`, plus a `pkcs11-tool` round-trip with a 24-byte key.
+
+### Challenge 5: A per-object file backend
+
+**What to build:** Replace the single object file with a directory where each token object is its own file, the way SoftHSM2 does it.
+
+**Why it's useful:** A single file means rewriting everything on every change. Per-object files let you write only what changed and make backup a per-object copy.
+
+**What you'll learn:**
+- Storage design trade-offs (one file versus many)
+- How the persistence codec in `object_store.zig` separates serialization from I/O
+
+**Implementation approach:**
+1. Keep the existing `serialize` / `parse` for a single object's attributes; you are changing only how they are grouped on disk.
+2. Give each object a stable on-disk id (the handle is monotonic and never reused, which helps).
+3. Write the sealing logic unchanged; each object file still seals its sensitive values under the master key.
+
+**Hints:**
+- The seal-on-write and mark-sealed-on-read logic in `object_store.zig` does not care how many files there are. Keep it.
+- `env.zig` resolves a path today; you will resolve a directory.
+
+**Test it works:** Create several objects, restart the process, and confirm they all reload. Corrupt one object file and confirm only that object is lost, not the whole store.
+
+## Advanced Challenges
+
+### Challenge 6: Implement the PKCS#11 v3.0 interface discovery
+
+**What to build:** Export `C_GetInterface` alongside `C_GetFunctionList`, returning a `CK_FUNCTION_LIST_3_0` for hosts that ask for v3.0.
+
+**Why this is hard:** You are extending the ABI itself, the part that must match the host byte for byte. A mistake here means hosts crash, not just misbehave.
+
+**What you'll learn:**
+- How v3.0 interface discovery works and why hosts fall back to `C_GetFunctionList` when `C_GetInterface` is absent (the OpenJDK fallback path)
+- How `CK_FUNCTION_LIST_3_0` shares a prefix with `CK_FUNCTION_LIST` and appends the new pointers
+
+**Architecture changes needed:**
+```
+   C_GetInterface(name, version, &iface, flags)
+        │
+        ▼
+   CK_INTERFACE { pInterfaceName, pFunctionList -> CK_FUNCTION_LIST_3_0, flags }
+        │
+   (C_GetFunctionList still returns the v2.40 CK_FUNCTION_LIST prefix)
+```
+
+**Implementation steps:**
+1. Add `CK_FUNCTION_LIST_3_0` and `CK_INTERFACE` to `ck.zig`, with the 24 new v3.0 function-pointer typedefs.
+2. Build one larger table and hand out a pointer typed either way, setting the version field correctly per caller.
+3. Export `C_GetInterface` in `main.zig` and add it to the version script in `pkcs11.map`.
+4. Extend `tests/abi_test.zig` to cross-check the new structs against the v3.0 OASIS headers (vendor them alongside the v2.40 ones).
+
+**Gotchas:**
+- The first N members of `CK_FUNCTION_LIST_3_0` must be byte-identical to `CK_FUNCTION_LIST`. The cross-check test is your safety net.
+- New v3.0 functions you do not implement still need real, correctly-typed stub functions in the table. Never null.
+
+**Resources:** The PKCS#11 v3.1 specification, and the `08-pkcs11.md` research note in `docs/zig/reference/` which covers the v3.0 surface.
+
+### Challenge 7: The v3.0 message-based AEAD API
+
+**What to build:** Implement `C_EncryptMessage` / `C_DecryptMessage` (and the begin/next/final variants) for AES-GCM.
+
+**Why this is hard:** The message API is how the OpenSSL 3.x provider increasingly prefers to do GCM, and it has a different nonce-management contract than the classic `C_Encrypt`.
+
+**What you'll learn:**
+- The v3.0 message API shape and how it differs from the v2.40 single-shot and update/final flows
+- How to keep your RUP-safe stance under the new API
+
+**Implementation approach:**
+1. Requires Challenge 6 first (the v3.0 table).
+2. The message API passes the nonce and AAD through `CK_MESSAGE`-family parameters rather than the mechanism parameter.
+3. Keep the buffered, verify-before-release behavior for decrypt that the classic path already has in `GcmStream`.
+
+**Hints:** Your existing GCM accumulator and the strict parameter validation in `buildCipher` are most of the work; the new part is the message-API parameter parsing.
+
+### Challenge 8: Fork safety
+
+**What to build:** Detect a `fork()` and refuse to operate in the child with stale state inherited from the parent, or re-initialize cleanly.
+
+**Why this is hard:** A child process inherits the parent's initialized state, including an unwrapped master key, which is a real hazard. The PKCS#11 answer is the `CKF_INTERFACE_FORK_SAFE` flag, but only if you actually handle it.
+
+**What you'll learn:**
+- Why inherited crypto state across a fork is dangerous
+- How to track the process id and invalidate state on change
+
+**Implementation approach:**
+1. Record the pid in the `Instance` at `C_Initialize`.
+2. In `state.acquire()`, compare the current pid; on a mismatch, treat the library as not initialized in the child (force a re-init) rather than operating on the parent's secrets.
+3. Only then advertise `CKF_INTERFACE_FORK_SAFE` (a v3.0 interface flag, so this pairs with Challenge 6).
+
+**Gotchas:** The master key inherited by a child must be wiped, not used. Be careful that the detection happens before any operation can touch `inst.mk`.
+
+## Expert Challenges
+
+### Challenge 9: A SQLite storage backend with multi-token support
+
+**What to build:** Replace the file backend with SQLite, and lift the one-token limit so the module can host several tokens across several slots.
+
+**Estimated time:** A week or more.
+
+**Prerequisites:** You should have done Challenge 5 (per-object storage) first, because this builds on separating the codec from the I/O.
+
+**What you'll learn:**
+- How a real software HSM (SoftHSM2 has exactly this) structures multi-token storage
+- How to shard the global state per slot without losing the single-lock simplicity, or how to move to per-slot locks
+
+**Planning this feature:**
+
+Before you code, think through:
+- How does multi-slot change the global `Instance`? Today it is one token, one session table, one object store. You need a collection keyed by slot.
+- Does the single global mutex still serve, or do you want per-slot locks? Per-slot locks add real concurrency but also real deadlock risk.
+- How do you migrate an existing single-file token into the database on first run?
+
+**High level architecture:**
+```
+   slots: [N] of Token
+     each Token: its own PIN state, master key, object store
+   storage: SQLite (one table for tokens, one for objects, sealed values as BLOBs)
+   locking: either the one global mutex (simple) or per-slot (concurrent)
+```
+
+**Implementation phases:**
+
+**Phase 1: Multi-token in memory.** Turn the single token/store/sessions in `Instance` into slot-indexed collections. Keep the file backend. Get `C_GetSlotList` returning several slots and the per-slot operations routing correctly.
+
+**Phase 2: The SQLite backend.** Link SQLite (the libcrypto bridge in `openssl.zig` is your template for binding a C library cleanly). Move serialize/parse to read and write rows. Keep the sealing logic untouched; values are still GCM-sealed BLOBs.
+
+**Phase 3: Migration and concurrency.** Migrate an existing file token on first open. Decide and implement the locking model.
+
+**Phase 4: Polish.** Error handling for a locked or corrupt database, and the full test pass through `pkcs11-tool` against multiple tokens.
+
+**Success criteria:**
+- [ ] `C_GetSlotList` returns more than one slot
+- [ ] Two tokens hold independent keys and PINs
+- [ ] Keys survive a restart, loaded from SQLite
+- [ ] A corrupt or locked database fails closed, never returns a wrong key
+- [ ] The ABI test and smoke harness still pass unchanged
+
+## Mix and Match
+
+Combine challenges into bigger projects:
+
+**A v3.0-native module.** Challenge 6 (interface) plus Challenge 7 (message API) plus Challenge 8 (fork safety) gives you a module a modern OpenSSL 3.x provider talks to natively.
+
+**A production-shaped store.** Challenge 5 (per-object) plus Challenge 9 (SQLite, multi-token) gives you something with SoftHSM2's storage capabilities.
+
+## Real World Integration Challenges
+
+### Drive the module from the OpenSSL pkcs11 provider
+
+**The goal:** Use this module as the key store behind OpenSSL itself, so `openssl` commands sign and decrypt through it.
+
+**What you'll need:**
+- The `pkcs11-provider` (the modern OpenSSL 3.x provider) configured to point at `libhsm.so`
+- An OpenSSL config that loads the provider
+
+**Watch out for:** The provider exercises corners `pkcs11-tool` does not, especially around RSA-PSS parameters and GCM. This is a great way to find conformance gaps. Anything it trips is a real bug or a documented narrowing in [CONFORMANCE.md](./CONFORMANCE.md).
+
+### Use the module from Java via SunPKCS11
+
+**The goal:** Have a Java program generate a key and sign through the module using `java.security` and the SunPKCS11 provider.
+
+**What you'll learn:** SunPKCS11 is the classic `C_GetInterface`-fallback consumer, so this also validates that your `C_GetFunctionList` path is solid (and motivates Challenge 6 if you want the v3.0 path).
+
+## Performance Challenges
+
+### Reduce lock contention under concurrent sessions
+
+**The goal:** Let many sessions do crypto in parallel instead of serializing on the one global mutex.
+
+**Current bottleneck:** Every entry point takes `state.mutex`. Two sessions signing at once serialize, even though their operations are independent.
+
+**Approaches:**
+- **Per-session operation state, lock only for shared state.** The op-state already lives in the `Session`; you could do the crypto outside the lock and only lock to fetch and commit, the way `C_Login` already does for Argon2id.
+- **Per-slot locks.** Pairs with the multi-slot work in Challenge 9.
+
+**Benchmark it:** Drive N threads each signing in a loop and measure throughput before and after. Watch for races; the generation-counter pattern in `state.zig` is your model for safe lock-release-relock.
+
+## Security Challenges
+
+### Prove constant-time behavior with Valgrind
+
+**The goal:** Use Valgrind's memcheck and Zig's `classify` / `declassify` to detect any branch or memory access that depends on a secret.
+
+**What you'll learn:** The closest thing to a constant-time verifier Zig has. `classify` marks secret memory as uninitialized to Valgrind, which then flags any conditional that depends on it.
+
+**Implementation:** Add a debug build that classifies the PIN hash and key material before the crypto, run it under `valgrind --tool=memcheck --track-origins=yes`, and chase down any "conditional jump depends on uninitialised value" reports. The `16-constant-time-security.md` research note in `docs/zig/reference/` walks through the API.
+
+**Testing the security:** A clean run with no conditional-on-secret warnings through a full sign and decrypt is the goal.
+
+### Fuzz the persistence codec
+
+**The goal:** Throw malformed token and object files at `parse` and confirm it always fails closed (clears to empty) and never crashes or reads out of bounds.
+
+**Threat model:** This protects against a malicious or corrupted store file. The codec already has length and bounds checks; fuzzing proves they are complete.
+
+**Implementation:** Generate random and mutated record bytes, feed them to `object_store.parse` and `token.loadFrom`, and assert the result is either a valid parse or a clean empty store, never a panic. The existing "rejects a bad magic" and "fails safe on a truncated record" tests are your starting points.
+
+## Contribution Ideas
+
+Finished something? Share it back:
+
+1. Fork the repo.
+2. Implement your extension in a branch, with unit tests against a published vector and a smoke-harness or `pkcs11-tool` proof.
+3. Document it: update [CONFORMANCE.md](./CONFORMANCE.md) if you changed a boundary, and add a note to the relevant learn doc.
+4. Open a PR with the implementation, the tests, and the external-tool proof.
+
+Good extensions (a new mechanism with vectors, a real storage backend, the v3.0 surface) are exactly the kind of thing that makes the project more useful to the next person.
+
+## Challenge Yourself Further
+
+### Build something new
+
+Use what you learned here to build:
+- A **PKCS#11 provider for a different key type**, like Ed25519 or ML-DSA (both are in Zig's std), following the ECDSA path.
+- A **minimal host** that loads any PKCS#11 module and exercises it, the consumer side of the interface you just implemented.
+
+### Study real implementations
+
+Read these and steal their good ideas:
+- **SoftHSMv2** for the per-token directory store and the OpenSSL/Botan crypto abstraction.
+- **OpenSC `pkcs11-spy`** for how a transparent shim logs every call, which is a clean piece of ABI engineering in its own right.
+
+## Getting Help
+
+Stuck on a challenge?
+
+1. **Debug systematically.** What did you expect, what happened, what is the smallest input that reproduces it? Run the failing case through `just spy` and read the exact call and return code.
+2. **Read the existing code.** The mechanism you are adding almost certainly has a sibling already implemented. The path is the same.
+3. **Lean on the cross-check.** If you touched `ck.zig`, run `zig build test`; the ABI test will tell you precisely which field or constant diverged from the OASIS headers.
+
+## Challenge Completion
+
+Track your progress:
+
+- [ ] Easy 1: SHA-224 digest
+- [ ] Easy 2: configurable token info
+- [ ] Easy 3: OpenSSL cross-verify recipe
+- [ ] Intermediate 4: AES-192 via libcrypto
+- [ ] Intermediate 5: per-object file backend
+- [ ] Advanced 6: v3.0 `C_GetInterface`
+- [ ] Advanced 7: v3.0 message API
+- [ ] Advanced 8: fork safety
+- [ ] Expert 9: SQLite, multi-token
+
+Finished them all? You have built a multi-token, v3.0-capable software HSM with a real database backend and proven constant-time behavior. At that point you understand key custody at a level most working engineers never reach. Go read a real HSM vendor's PKCS#11 docs; you will recognize every design decision they made and why.
diff --git a/PROJECTS/advanced/hsm-emulator/learn/CONFORMANCE.md b/PROJECTS/advanced/hsm-emulator/learn/CONFORMANCE.md
new file mode 100644
index 00000000..1e49e7c5
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/learn/CONFORMANCE.md
@@ -0,0 +1,301 @@
+<!-- ©AngelaMos | 2026 -->
+<!-- CONFORMANCE.md -->
+
+# PKCS#11 v2.40 Conformance Statement
+
+The AngelaMos HSM Emulator implements the full Cryptoki (PKCS#11) v2.40 C ABI: all
+68 functions in the canonical `CK_FUNCTION_LIST`, machine-checked against the
+vendored OASIS headers at build time. This document records every place where the
+module narrows behavior: the exact return code it gives, the spec clause that
+permits it, and why. Every narrowing here is a documented decision with a defined
+return value.
+
+A function that is not applicable to a fixed software token returns the specific
+code the spec defines for that situation. The `CKR_FUNCTION_NOT_SUPPORTED` results
+that remain mark the boundary between single-shot and multi-part operation surfaces,
+covered in section 2.
+
+**Specifications**
+
+- PKCS#11 Base Specification v2.40 (OASIS, errata 01) — function semantics and return codes.
+- PKCS#11 Current Mechanisms v2.40 (OASIS, errata 01) — per-mechanism parameters.
+
+Section numbers below refer to the Base specification unless a line names the
+Mechanisms document.
+
+---
+
+## 1. Function-level conformance
+
+### 1.1 `C_WaitForSlotEvent` — §5.5 (slot and token management)
+
+The module exposes a single fixed slot (ID 0) whose token is always present. No
+insertion or removal event can ever occur, so the function reports that fact
+precisely rather than pretending to support hardware slot events.
+
+| Call | Return | Basis |
+|------|--------|-------|
+| `flags` has `CKF_DONT_BLOCK`, no event pending | `CKR_NO_EVENT` | §5.5: a non-blocking poll with no pending event returns `CKR_NO_EVENT`. For a fixed slot, no event is ever pending, so this is always the answer. |
+| `flags` clears `CKF_DONT_BLOCK` (blocking) | `CKR_FUNCTION_NOT_SUPPORTED` | A blocking wait must not return until an event occurs. For a fixed software slot no event can occur, so blocking would hang the caller forever. The module declines the blocking mode instead. |
+| `pReserved != NULL_PTR` | `CKR_ARGUMENTS_BAD` | §5.5: `pReserved` is reserved and must be `NULL_PTR` in v2.40. |
+| called before `C_Initialize` | `CKR_CRYPTOKI_NOT_INITIALIZED` | §5.4 general semantics. |
+
+Interop note: `pkcs11-tool --wait` calls this in blocking mode and therefore
+receives `CKR_FUNCTION_NOT_SUPPORTED` immediately rather than blocking. Hosts that
+poll with `CKF_DONT_BLOCK` (the common case for slot enumeration) get the correct
+`CKR_NO_EVENT`.
+
+### 1.2 `C_GetFunctionStatus`, `C_CancelFunction` — §5.15 (parallel function management)
+
+Both are legacy functions from the era of parallel (asynchronous) Cryptoki calls.
+v2.40 has no parallel execution model, and the spec defines the canonical answer
+for a serial implementation:
+
+| Call | Return | Basis |
+|------|--------|-------|
+| `C_GetFunctionStatus` | `CKR_FUNCTION_NOT_PARALLEL` | §5.15: the only meaningful return for a library that does not run functions in parallel. |
+| `C_CancelFunction` | `CKR_FUNCTION_NOT_PARALLEL` | §5.15: same. |
+
+### 1.3 `C_SeedRandom` — §5.14 (random number generation)
+
+| Call | Return | Basis |
+|------|--------|-------|
+| `C_SeedRandom` | `CKR_RANDOM_SEED_NOT_SUPPORTED` | The RNG is the operating-system CSPRNG, drawn through `std.Io.randomSecure` (`getrandom(2)`, `arc4random_buf`, or `/dev/urandom` depending on platform and libc). Caller-supplied seed material cannot meaningfully reseed it, so the module declines rather than silently discarding the seed (which would mislead the caller). |
+| `C_GenerateRandom` | fully supported | — |
+
+---
+
+## 2. Operation-surface boundaries
+
+These are the deliberate edges of the multi-part operation surface. Each returns a
+specific code so a caller can distinguish "wrong call for this mechanism" from a
+runtime failure.
+
+### 2.1 AES-GCM is RUP-safe buffered — §5.8, §5.9
+
+`CKM_AES_GCM` multi-part encryption and decryption buffer the entire message and run
+the authenticated operation **once at `*Final`**:
+
+- `C_EncryptUpdate` / `C_DecryptUpdate` append the part to an internal buffer and
+  emit **0 bytes**. §5.8/§5.9 permit an Update to produce fewer output bytes than it
+  consumes (block buffering); producing the whole result at `*Final` is conformant.
+- `C_EncryptFinal` emits ciphertext + 128-bit tag; `C_DecryptFinal` verifies the tag
+  and only then releases plaintext.
+
+This is a security decision. A streaming GCM *decrypt* built on incremental
+release would hand back **unverified plaintext** before the tag is checked (release
+of unverified plaintext, "RUP") — an anti-pattern for an HSM. Buffering until the
+tag verifies makes RUP impossible by construction.
+
+Because the buffer holds the whole message, a single GCM message is bounded:
+
+| Condition | Return |
+|-----------|--------|
+| buffered length would exceed 16 MiB (`max_gcm_stream_len`), encrypt | `CKR_DATA_LEN_RANGE` |
+| buffered length would exceed 16 MiB, decrypt | `CKR_ENCRYPTED_DATA_LEN_RANGE` |
+
+Strict parameter validation (`CK_GCM_PARAMS`):
+
+| Parameter | Accepted | Else |
+|-----------|----------|------|
+| `ulIvLen` | exactly 12 bytes | `CKR_MECHANISM_PARAM_INVALID` |
+| `ulIvBits` | `0` or `96` | `CKR_MECHANISM_PARAM_INVALID` |
+| `ulTagBits` | exactly `128` | `CKR_MECHANISM_PARAM_INVALID` |
+| `pIv` | non-NULL | `CKR_MECHANISM_PARAM_INVALID` |
+| `ulAADLen` | ≤ 256 bytes | `CKR_ARGUMENTS_BAD` |
+
+Interop note: a host MUST request a 128-bit tag and supply a 12-byte IV. With
+`pkcs11-tool` that means `--iv <24 hex chars> --tag-bits-len 128`; omitting either
+trips `CKR_MECHANISM_PARAM_INVALID`.
+
+### 2.2 Dual-function operations — §5.12
+
+| Function | Supported modes | Else |
+|----------|-----------------|------|
+| `C_DigestEncryptUpdate`, `C_SignEncryptUpdate` (encrypt side) | AES-CBC, AES-CBC-PAD, AES-GCM | — |
+| `C_DecryptDigestUpdate`, `C_DecryptVerifyUpdate` (decrypt side) | AES-CBC only | non-CBC → `CKR_FUNCTION_NOT_SUPPORTED` |
+| any dual-function leg using an RSA sign/verify operation | — | `CKR_FUNCTION_NOT_SUPPORTED` |
+
+The decrypt side couples the **recovered plaintext** of each `C_Decrypt*Update` into
+the digest/verify operation. That coupling is only exact when the cipher releases
+exactly the decrypted bytes on every call:
+
+- **AES-CBC** releases each decrypted block immediately, so bytes-out equals
+  bytes-to-digest per call. Supported.
+- **AES-CBC-PAD** holds back the final block until `C_DecryptFinal` (it cannot know
+  the padding until the end), so the digest would miss the last block.
+- **AES-GCM** buffers everything and releases at `C_DecryptFinal` (§2.1), so the
+  digest would receive nothing incrementally.
+
+Coupling either of the latter would desynchronize the pair, so the module returns
+`CKR_FUNCTION_NOT_SUPPORTED` rather than producing a silently wrong digest. The
+encrypt side has no such constraint — it digests/signs the **input** plaintext,
+which is fully available on each call, so all three modes work.
+
+### 2.3 RSA is single-shot — §5.8, §5.9, §5.11
+
+Every RSA operation is a single modular exponentiation over the whole input, so RSA
+has no multi-part form:
+
+| Call on an RSA operation | Return |
+|--------------------------|--------|
+| `C_EncryptUpdate` / `C_EncryptFinal` | `CKR_FUNCTION_NOT_SUPPORTED` |
+| `C_DecryptUpdate` / `C_DecryptFinal` | `CKR_FUNCTION_NOT_SUPPORTED` |
+| `C_SignUpdate` / `C_SignFinal` | `CKR_FUNCTION_NOT_SUPPORTED` |
+| `C_VerifyUpdate` / `C_VerifyFinal` | `CKR_FUNCTION_NOT_SUPPORTED` |
+
+Use the one-shot `C_Encrypt` / `C_Decrypt` / `C_Sign` / `C_Verify`. The hash-then-sign
+mechanisms (`CKM_SHA256_RSA_PKCS`, the PSS variants) still need the full message
+before the single RSA operation, so they too are one-shot.
+
+### 2.4 Sign / Verify-Recover — §5.11
+
+| Mechanism | Supported | Else |
+|-----------|-----------|------|
+| `CKM_RSA_PKCS` (EMSA-PKCS1-v1.5 type 1, message recoverable from the signature) | yes | other mechanism → `CKR_MECHANISM_INVALID` |
+
+`C_SignRecover` rejects input that cannot fit the modulus with PKCS#1 v1.5 overhead
+(data length + 11 bytes > modulus) with `CKR_DATA_LEN_RANGE`. `C_VerifyRecover`
+returns the recovered message; a signature whose length is not the modulus length
+returns `CKR_SIGNATURE_LEN_RANGE`, and a malformed encoding returns
+`CKR_SIGNATURE_INVALID`. Raw recover (`CKM_RSA_X_509`) is not offered.
+
+### 2.5 Get / SetOperationState — §5.6
+
+Operation state is **digest-only**:
+
+| Call | Return | Basis |
+|------|--------|-------|
+| `C_GetOperationState` with an active sign/verify/encrypt/decrypt/sign-recover/verify-recover operation | `CKR_STATE_UNSAVEABLE` | §5.6: a library may decline to save state it cannot serialize. Only digest state is saveable here. |
+| `C_GetOperationState` with no operation active | `CKR_OPERATION_NOT_INITIALIZED` | §5.6. |
+| `C_SetOperationState` with non-zero `hEncryptionKey` or `hAuthenticationKey` | `CKR_KEY_NOT_NEEDED` | §5.6: a digest needs no key, so passing one is an error. |
+| `C_SetOperationState` with a malformed blob (wrong version byte, unknown hasher tag, wrong length) | `CKR_SAVED_STATE_INVALID` | §5.6. |
+
+The saved blob is `[version][hasher tag][raw hasher state]`, validated on restore.
+It is **opaque and same-build only**: it carries the raw standard-library hasher
+state, whose layout is not stable across builds. PKCS#11 does not promise
+operation-state portability across implementations or builds (§5.6). Restore is
+byte-exact within the same binary; any other input fails closed via the version,
+tag, and exact-length checks above.
+
+---
+
+## 3. Mechanism constraints
+
+### 3.1 ECDH key derivation — §5.13, Mechanisms (CKM_ECDH1_DERIVE)
+
+| Aspect | Value | Else |
+|--------|-------|------|
+| KDF | `CKD_NULL` only | other KDF → `CKR_MECHANISM_PARAM_INVALID` |
+| peer public point | raw SEC1 uncompressed **or** DER `OCTET STRING`-wrapped | malformed → `CKR_MECHANISM_PARAM_INVALID` |
+| curves | P-256, P-384 | — |
+| shared data | none (`CKD_NULL` carries no shared data) | — |
+
+### 3.2 RSA — Mechanisms (CKM_RSA_PKCS, _PSS, _OAEP)
+
+| Aspect | Value | Else |
+|--------|-------|------|
+| key size | 2048–4096 bits | outside range → `CKR_KEY_SIZE_RANGE` |
+| public exponent | fixed at 65537 (F4) | not selectable at keygen |
+| PSS / OAEP hash | SHA-256, SHA-384, SHA-512 | other → `CKR_MECHANISM_PARAM_INVALID` |
+| MGF hash | must equal the content hash | mismatch → `CKR_MECHANISM_PARAM_INVALID` |
+| OAEP label (source) | not supported | `ulSourceDataLen != 0` → `CKR_MECHANISM_PARAM_INVALID` |
+
+Dedicated `CKM_SHA384_RSA_PKCS` / `CKM_SHA512_RSA_PKCS` mechanisms are not
+advertised; SHA-384 and SHA-512 are reachable through the `CKM_RSA_PKCS_PSS` and
+`CKM_RSA_PKCS_OAEP` parameter `hashAlg`.
+
+### 3.3 AES — Mechanisms (CKM_AES_*)
+
+AES-128 and AES-256 only. AES-192 is not implemented (the Zig standard library
+exposes no 192-bit AES). A key length outside {16, 32} bytes → `CKR_KEY_SIZE_RANGE`.
+
+### 3.4 ECDSA — Mechanisms (CKM_ECDSA*)
+
+Curves P-256 and P-384. Mechanisms `CKM_ECDSA` (pre-hashed input) and
+`CKM_ECDSA_SHA256`. `CKM_ECDSA_SHA384` and `CKM_ECDSA_SHA512` are out of scope.
+
+### 3.5 Key wrap — §5.13
+
+| Aspect | Value | Else |
+|--------|-------|------|
+| wrappable target | secret keys (`CKO_SECRET_KEY`) only | asymmetric target → `CKR_KEY_NOT_WRAPPABLE` |
+| wrapping mechanisms | `CKM_AES_KEY_WRAP` (RFC 3394), `CKM_RSA_PKCS_OAEP` | other → `CKR_MECHANISM_INVALID` |
+| unextractable target | refused | `CKR_KEY_UNEXTRACTABLE` |
+| tampered wrapped blob on unwrap | refused | `CKR_WRAPPED_KEY_INVALID` |
+
+---
+
+## 4. Object and token model (informative)
+
+- **One fixed slot** (ID 0), always present, hosting **one token**. Login is required
+  to see or use private objects.
+- **Encrypted at rest.** Token objects persist to a file under a selective envelope:
+  only sensitive attribute *values* are sealed with AES-256-GCM under a per-token
+  master key. The master key is wrapped under a single **User-PIN keyslot**
+  (Argon2id-derived KEK). There is no SO keyslot for user secrets by design — the
+  Security Officer must not be able to read user key material.
+- **Public objects and attributes stay in plaintext** and are visible before login,
+  which is spec-correct: only private/sensitive material is gated by login.
+- In memory, sensitive attributes are plaintext only while the User is logged in;
+  logout and session teardown re-seal them and zeroize the master key.
+
+---
+
+## 5. Advertised mechanism list
+
+`C_GetMechanismList` returns these 21 mechanisms. Key-size units are
+mechanism-dependent per the spec (bits for RSA and EC, bytes for AES and HMAC).
+
+| Mechanism | Min | Max | Flags |
+|-----------|-----|-----|-------|
+| `CKM_SHA256` | 0 | 0 | DIGEST |
+| `CKM_SHA384` | 0 | 0 | DIGEST |
+| `CKM_SHA512` | 0 | 0 | DIGEST |
+| `CKM_SHA256_HMAC` | 32 | 64 | SIGN, VERIFY |
+| `CKM_SHA384_HMAC` | 32 | 64 | SIGN, VERIFY |
+| `CKM_SHA512_HMAC` | 32 | 64 | SIGN, VERIFY |
+| `CKM_AES_KEY_GEN` | 16 | 32 | GENERATE |
+| `CKM_AES_CBC` | 16 | 32 | ENCRYPT, DECRYPT |
+| `CKM_AES_CBC_PAD` | 16 | 32 | ENCRYPT, DECRYPT |
+| `CKM_AES_GCM` | 16 | 32 | ENCRYPT, DECRYPT |
+| `CKM_EC_KEY_PAIR_GEN` | 256 | 384 | GENERATE_KEY_PAIR, EC_NAMEDCURVE |
+| `CKM_ECDSA` | 256 | 384 | SIGN, VERIFY, EC_NAMEDCURVE |
+| `CKM_ECDSA_SHA256` | 256 | 384 | SIGN, VERIFY, EC_NAMEDCURVE |
+| `CKM_ECDH1_DERIVE` | 256 | 384 | DERIVE, EC_NAMEDCURVE |
+| `CKM_RSA_PKCS_KEY_PAIR_GEN` | 2048 | 4096 | GENERATE_KEY_PAIR |
+| `CKM_RSA_PKCS` | 2048 | 4096 | SIGN, VERIFY, ENCRYPT, DECRYPT, SIGN_RECOVER, VERIFY_RECOVER |
+| `CKM_SHA256_RSA_PKCS` | 2048 | 4096 | SIGN, VERIFY |
+| `CKM_RSA_PKCS_PSS` | 2048 | 4096 | SIGN, VERIFY |
+| `CKM_SHA256_RSA_PKCS_PSS` | 2048 | 4096 | SIGN, VERIFY |
+| `CKM_RSA_PKCS_OAEP` | 2048 | 4096 | ENCRYPT, DECRYPT, WRAP, UNWRAP |
+| `CKM_AES_KEY_WRAP` | 16 | 32 | WRAP, UNWRAP |
+
+---
+
+## 6. Summary: deliberate return codes
+
+| Boundary | Return code |
+|----------|-------------|
+| `C_WaitForSlotEvent`, non-blocking poll | `CKR_NO_EVENT` |
+| `C_WaitForSlotEvent`, blocking mode | `CKR_FUNCTION_NOT_SUPPORTED` |
+| `C_WaitForSlotEvent`, `pReserved != NULL` | `CKR_ARGUMENTS_BAD` |
+| `C_GetFunctionStatus`, `C_CancelFunction` | `CKR_FUNCTION_NOT_PARALLEL` |
+| `C_SeedRandom` | `CKR_RANDOM_SEED_NOT_SUPPORTED` |
+| GCM message over 16 MiB | `CKR_DATA_LEN_RANGE` / `CKR_ENCRYPTED_DATA_LEN_RANGE` |
+| GCM bad parameters | `CKR_MECHANISM_PARAM_INVALID` / `CKR_ARGUMENTS_BAD` |
+| dual-function decrypt side, non-CBC | `CKR_FUNCTION_NOT_SUPPORTED` |
+| RSA multi-part (`*Update` / `*Final`) | `CKR_FUNCTION_NOT_SUPPORTED` |
+| Sign/Verify-Recover, non-`CKM_RSA_PKCS` | `CKR_MECHANISM_INVALID` |
+| Get/SetOperationState, non-digest operation | `CKR_STATE_UNSAVEABLE` |
+| SetOperationState with a key handle | `CKR_KEY_NOT_NEEDED` |
+| SetOperationState, malformed blob | `CKR_SAVED_STATE_INVALID` |
+| ECDH non-`CKD_NULL` KDF | `CKR_MECHANISM_PARAM_INVALID` |
+| OAEP with a label | `CKR_MECHANISM_PARAM_INVALID` |
+| AES key length not 16/32 bytes | `CKR_KEY_SIZE_RANGE` |
+| wrap of an asymmetric target | `CKR_KEY_NOT_WRAPPABLE` |
+| wrap of an unextractable key | `CKR_KEY_UNEXTRACTABLE` |
+
+Every entry above is exercised by the unit tests, the in-process smoke harness, or a
+cross-process `pkcs11-tool` run; the corrected slot/parallel/RNG codes are asserted
+in `examples/smoke.zig` against the built shared object.
diff --git a/PROJECTS/advanced/hsm-emulator/learn/MECHANICS.md b/PROJECTS/advanced/hsm-emulator/learn/MECHANICS.md
new file mode 100644
index 00000000..e7f9c13b
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/learn/MECHANICS.md
@@ -0,0 +1,348 @@
+<!-- ©AngelaMos | 2026 -->
+<!-- MECHANICS.md -->
+
+# How the Mechanisms Actually Work
+
+The [conformance statement](./CONFORMANCE.md) tells you *what* each mechanism does and which return code it gives. This document tells you *how* each one works under the hood, byte by byte, and why the implementation looks the way it does. If [03-IMPLEMENTATION.md](./03-IMPLEMENTATION.md) is the tour of the plumbing, this is the tour of the water.
+
+Everything here except RSA is pure-Zig `std.crypto`, tested against published vectors. RSA is libcrypto. Each section names the file you can open to read the real thing.
+
+## The Short Version
+
+| Family | Mechanisms | Where the math is | Backed by |
+|--------|-----------|-------------------|-----------|
+| Digest | SHA-256 / 384 / 512 | `digest.zig` | `std.crypto.hash.sha2` |
+| MAC | HMAC-SHA-256 / 384 / 512 | `mac.zig` | `std.crypto.auth.hmac` |
+| AES | CBC, CBC-PAD, GCM | `cipher.zig` | `std.crypto.core.aes`, `aead.aes_gcm` |
+| Key wrap | AES-KEY-WRAP (RFC 3394) | `cipher.zig` | the AES block on top |
+| ECDSA | P-256, P-384, raw and SHA-256 | `ecdsa.zig` | `std.crypto.sign.ecdsa` |
+| ECDH | P-256, P-384, `CKD_NULL` | `ecdsa.zig` | `std.crypto.ecc` |
+| RSA | PKCS#1 v1.5, PSS, OAEP | `rsa.zig` + `openssl.zig` | OpenSSL `libcrypto` |
+| KDF | Argon2id (PIN stretching) | `pin.zig` | `std.crypto.pwhash.argon2` |
+| Envelope | AES-256-GCM seal/wrap | `keystore.zig` | `std.crypto.aead.aes_gcm` |
+
+A theme runs through all of them: the dangerous part of each primitive is handled by a tested standard-library function, and the module's own code is the wiring, the validation, and the constant-time and memory hygiene around it.
+
+## AES-CBC: chaining blocks
+
+CBC (Cipher Block Chaining) turns a block cipher, which only encrypts one 16-byte block, into something that encrypts a whole message. The trick is that each plaintext block is XORed with the previous ciphertext block before encryption, so identical plaintext blocks do not produce identical ciphertext.
+
+```
+   P0        P1        P2
+   │         │         │
+IV─XOR    ┌─►XOR    ┌─►XOR        (IV seeds the very first XOR)
+   │      │  │      │  │
+  AES     │ AES     │ AES
+   │      │  │      │  │
+   ▼      │  ▼      │  ▼
+   C0─────┘  C1─────┘  C2
+```
+
+In `cipher.zig`, one encrypt step is exactly that XOR-then-encrypt, with the chain value updated to the new ciphertext:
+
+```zig
+fn cbcEncStep(self: *Cipher, in16: *const [block]u8, out16: *[block]u8) void {
+    var x: [block]u8 = undefined;
+    defer std.crypto.secureZero(u8, &x);     // the XOR scratch held plaintext, scrub it
+    for (0..block) |j| x[j] = in16[j] ^ self.chain[j];
+    encBlockRaw(self.key(), &x, out16);
+    self.chain = out16.*;                      // chain forward
+}
+```
+
+Decryption reverses it: decrypt the block, then XOR with the previous ciphertext (held in `chain`). The chain advances to the input block, not the output.
+
+Plain `CKM_AES_CBC` has no padding, so the input must be a whole number of blocks. A partial trailing block is an error (`CKR_DATA_LEN_RANGE`), because there is nothing to do with 5 leftover bytes. The IV arrives in the mechanism parameter and seeds `chain`.
+
+## AES-CBC-PAD: padding, and the held-back block
+
+`CKM_AES_CBC_PAD` adds PKCS#7 padding so any length encrypts. PKCS#7 is simple: if you need `n` bytes of padding, append `n` copies of the byte `n`. If the message is already block-aligned, you add a whole block of `0x10` (16) so there is always padding to remove.
+
+```
+   message ...... |  pad
+   "ABCDE"  (5)   |  0B 0B 0B 0B 0B 0B 0B 0B 0B 0B 0B   (11 bytes of 0x0B)
+                     └──────────── 11 = pad length ────────────┘
+```
+
+`encryptFinal` writes the padding into the last partial block and encrypts it:
+
+```zig
+const padlen: u8 = @intCast(block - self.partial_len);
+for (self.partial_len..block) |j| self.partial[j] = padlen;
+self.cbcEncStep(&self.partial, out[0..block]);
+```
+
+Decryption is where it gets subtle. The decryptor cannot strip padding until it knows it has the *last* block, but in streaming mode it does not know which block is last until the stream ends. So CBC-PAD decrypt **holds back one block**: each time a full block arrives, it emits the *previous* held block and holds the new one. `decryptFinal` decrypts the final held block and strips the padding. This held-back behavior is exactly why CBC-PAD cannot participate in the decrypt side of a dual function (the digest would miss the last block); see [CONFORMANCE.md](./CONFORMANCE.md) section 2.2.
+
+The padding check is constant-time. A naive check returns as soon as a pad byte is wrong, which leaks where it failed (the Vaudenay padding-oracle attack, and Lucky Thirteen against TLS). This module ORs all the differences first, then decides once:
+
+```zig
+const padlen = pt[block - 1];
+if (padlen == 0 or padlen > block) return Error.EncryptedDataInvalid;
+var bad: u8 = 0;
+for (0..block) |j| {
+    const is_pad = j >= block - padlen;
+    if (is_pad) bad |= pt[j] ^ padlen;     // accumulate, do not branch out early
+}
+if (bad != 0) return Error.EncryptedDataInvalid;
+```
+
+## AES-GCM: authenticated, and why it is buffered here
+
+GCM (Galois/Counter Mode) does two things at once: it encrypts with AES in counter mode, and it computes an authentication tag over the ciphertext and the associated data using multiplication in a Galois field. The tag is the whole value of GCM: decryption verifies it, and a wrong tag means the ciphertext was tampered with (or you used the wrong key or nonce).
+
+```
+   nonce(12) + counter ──► AES ──► keystream ──XOR──► ciphertext
+                                                          │
+   AAD + ciphertext ──► GHASH (GF(2^128) mult) ──► tag(16)
+```
+
+This module uses the standard library's one-shot GCM, with a 12-byte (96-bit) nonce and a 128-bit tag, and up to 256 bytes of associated data:
+
+```zig
+aesgcm.Aes256Gcm.encrypt(out[0..input.len], tag, input, ad, self.iv, self.key_buf[0..32].*);
+```
+
+The 96-bit nonce is the standard choice: it is used directly as the initial counter without the extra hashing a different length would require. The fixed 128-bit tag is the full-strength tag; truncated tags weaken authentication.
+
+**Why buffered.** A streaming GCM decrypt that releases plaintext block by block would hand back unverified bytes before it has seen the tag. That is release of unverified plaintext, and it is an anti-pattern for a security module (see [01-CONCEPTS.md](./01-CONCEPTS.md)). This module accumulates the whole message in `GcmStream` and runs the authenticated operation once at `*Final`, where decrypt verifies the tag before returning a single byte. The buffer is capped at 16 MiB so a host cannot exhaust memory. The cost is that GCM is single-message-bounded; the benefit is that RUP is impossible by construction.
+
+On a bad tag, decryption returns `error.EncryptedDataInvalid` and no plaintext. The standard library zeroes the output buffer internally before returning the error, so failed decryption leaves nothing usable behind.
+
+## AES Key Wrap (RFC 3394): encrypting a key with a key
+
+You cannot just AES-encrypt a key and call it wrapped; you want the result to be tamper-evident, so a corrupted wrapped key is *rejected* rather than unwrapped into garbage. RFC 3394 AES Key Wrap does this with a fixed initial value (the integrity check value, ICV) and six passes over the data.
+
+The ICV is the constant `A6 A6 A6 A6 A6 A6 A6 A6`. Wrapping prepends it, then runs 6 rounds where each 64-bit block of the key is mixed with a running `A` register through the AES block cipher and a counter:
+
+```zig
+var a: [8]u8 = key_wrap_iv;                 // A6 A6 ... A6
+// for j in 0..6, for each 64-bit block i:
+@memcpy(blk[0..8], &a);
+@memcpy(blk[8..16], r[i * 8 ..][0..8]);
+encBlockRaw(kek, &blk, &enc);                // B = AES(A | R[i])
+@memcpy(&a, enc[0..8]);                       // A = MSB64(B)
+xorCounter(&a, n * j + i + 1);                // A ^= t (the round counter)
+@memcpy(r[i * 8 ..][0..8], enc[8..16]);       // R[i] = LSB64(B)
+```
+
+Unwrapping runs the rounds backward and then checks that the recovered `A` equals the ICV. If a single bit of the wrapped key was flipped, `A` will not match `A6...A6`, and the unwrap fails. The check is done by ORing the differences (not an early-exit compare), and on failure the partial output is scrubbed:
+
+```zig
+var diff: u8 = 0;
+for (a, key_wrap_iv) |x, y| diff |= x ^ y;
+if (diff != 0) {
+    std.crypto.secureZero(u8, out[0..plain_len]);
+    return WrapError.Integrity;             // -> CKR_WRAPPED_KEY_INVALID at the API
+}
+```
+
+The implementation is verified against the RFC 3394 section 4.1 known-answer test: wrapping the test key under the test KEK produces the exact published ciphertext, and unwrapping round-trips. The 8-byte ICV is why a wrapped key is 8 bytes longer than the key it wraps.
+
+## SHA-2 and HMAC: hashing and keyed hashing
+
+SHA-256, SHA-384, and SHA-512 are the digest mechanisms. The `Hasher` in `digest.zig` is a tagged union over the three, and multi-part hashing (`C_DigestUpdate` repeatedly) just feeds the running state:
+
+```zig
+pub const Hasher = union(enum) {
+    sha256: sha2.Sha256,
+    sha384: sha2.Sha384,
+    sha512: sha2.Sha512,
+};
+```
+
+A digest is verified against the classic `SHA-256("abc")` vector in the unit tests and again in the smoke harness through the real `.so`.
+
+The interesting part is **operation-state serialization**. `C_GetOperationState` lets a host snapshot a digest mid-stream and resume it later with `C_SetOperationState`. The module serializes the raw hasher state with a version byte and a type tag:
+
+```
+   [version=1][tag: 1=sha256 2=sha384 3=sha512][raw hasher state bytes]
+```
+
+```zig
+out[0] = config.op_state_version;
+out[1] = d.stateTag();
+d.writeState(out[config.op_state_header_len..]);
+```
+
+This blob is **same-build only**: it carries the in-memory layout of the standard library's hasher, which is not promised stable across builds or implementations. The spec allows exactly this (operation state is not portable), and restore validates the version, the tag, and the exact length, failing closed on anything else. Only digest state is saveable; trying to save a sign or encrypt operation returns `CKR_STATE_UNSAVEABLE`.
+
+HMAC (`mac.zig`) is the keyed-hash construction `H(key ⊕ opad || H(key ⊕ ipad || message))`, but you do not implement that by hand; the standard library's `HmacSha256` and friends do. The module's job is to verify the tag in constant time, which `crypto_ops.zig` does with `ctEql`. HMAC-SHA-256 is checked against RFC 4231 test case 2.
+
+## ECDSA: signing on a curve
+
+ECDSA signs over an elliptic curve. This module supports NIST P-256 and P-384, with two mechanisms: `CKM_ECDSA` (you supply an already-hashed value) and `CKM_ECDSA_SHA256` (the module hashes the message with SHA-256 first).
+
+### The curve and the key encoding
+
+The curve is identified by an OID in DER, stored in `CKA_EC_PARAMS`. P-256 is `06 08 2A 86 48 CE 3D 03 01 07`, P-384 is `06 05 2B 81 04 00 22`. `curveFromParams` matches the bytes:
+
+```zig
+pub fn curveFromParams(ec_params: []const u8) ?Curve {
+    if (std.mem.eql(u8, ec_params, &oid_p256)) return .p256;
+    if (std.mem.eql(u8, ec_params, &oid_p384)) return .p384;
+    return null;
+}
+```
+
+The public key is a point in SEC1 uncompressed form: a `0x04` byte followed by the X and Y coordinates. For P-256 that is `1 + 32 + 32 = 65` bytes; the `CKA_EC_POINT` attribute wraps it in a DER `OCTET STRING`, so the stored value is 67 bytes (the `0x04 0x41` DER header plus the 65-byte point). `wrapEcPoint` and `unwrapEcPoint` handle that wrapping, including the long-form DER length encoding for P-384's larger point.
+
+### Prehash, reduce, sign
+
+The message (or its hash) is reduced to a scalar by taking the leftmost bytes equal to the curve's order size, which is what ECDSA does with a hash that may be a different width than the curve:
+
+```zig
+fn reduce(curve: Curve, dgst: []const u8, out: *[max_scalar]u8) []const u8 {
+    const n = curve.scalarLen();
+    if (dgst.len >= n) @memcpy(out[0..n], dgst[0..n])     // take the leftmost n bytes
+    else // left-pad with zeros
+}
+```
+
+The actual signing uses `signPrehashed`. One subtlety worth knowing: Zig's deterministic ECDSA is not plain RFC 6979. It mixes in a noise field, so the signature is not a fixed function of the message and key. That means you cannot pin a sign-output known-answer test (two signatures of the same message differ), so the test suite uses an RFC 6979 vector as a *verify* known-answer test instead, and round-trips its own signatures. The noise comes from `randomSecure`, with a fallback to deterministic if entropy is unavailable:
+
+```zig
+const nz: ?[slen]u8 = if (io.randomSecure(&noise)) |_| noise else |_| null;
+const sig = kp.signPrehashed(ph, nz) catch return Error.Crypto;
+```
+
+A P-256 signature is 64 bytes (r and s, 32 each); P-384 is 96. Verification reconstructs the public key from the SEC1 point, validates the point is on the curve, and checks the signature. The smoke harness signs over the module, verifies, then flips a byte and confirms `CKR_SIGNATURE_INVALID`.
+
+## ECDH: agreeing on a shared secret
+
+ECDH (`CKM_ECDH1_DERIVE`) lets two parties with EC keypairs compute the same shared secret without ever transmitting it. Each multiplies their own private scalar by the other's public point; the math guarantees both arrive at the same point, and the secret is that point's X coordinate.
+
+```
+   Alice:  secret = X-coordinate of (alice_private * bob_public)
+   Bob:    secret = X-coordinate of (bob_private * alice_public)
+   alice_private * bob_public == bob_private * alice_public   (same point)
+```
+
+The implementation multiplies the peer point by the scalar and takes the affine X coordinate:
+
+```zig
+const peer = Pt.fromSec1(peer_point_sec1) catch return Error.Crypto;  // validates on-curve
+const shared = peer.mul(s, .big) catch return Error.Crypto;
+const xb = shared.affineCoordinates().x.toBytes(.big);
+@memcpy(out[0..n], xb[0..n]);
+```
+
+`fromSec1` rejects a point that is not on the curve, which is the defense against invalid-curve attacks (feeding a carefully chosen off-curve point to leak the private scalar). The module supports only the `CKD_NULL` key-derivation function, meaning the raw shared X coordinate is the derived key with no further KDF, and it accepts the peer point either as raw SEC1 or DER-wrapped. The derived value is correct to the bit: the smoke harness derives on both sides and asserts they match, and a cross-process test confirms it equals `openssl pkeyutl -derive` byte for byte. The smoke harness even derives one side with a raw peer point and the other with a DER-wrapped one and confirms both agree.
+
+## RSA: three schemes, one modular exponentiation
+
+RSA is the one family this module does not implement itself. Zig's standard library has no public RSA, so `rsa.zig` calls OpenSSL's `libcrypto` through the hand-written `extern` declarations in `openssl.zig`. Every RSA operation is a single modular exponentiation over the whole input, so RSA has no multi-part form (no `C_SignUpdate`); you use the one-shot calls.
+
+Keys are stored PKCS#11-native: the modulus and public exponent are public, and the private side keeps the private exponent plus the four CRT (Chinese Remainder Theorem) values that make private operations about four times faster. The public exponent is fixed at 65537 (the F4 prime), the universal default. `rsa.zig` is stateless: it rebuilds an `EVP_PKEY` from these components on every call rather than holding one.
+
+The three schemes differ in how they pad before the exponentiation:
+
+**PKCS#1 v1.5** (`CKM_RSA_PKCS`, `CKM_SHA256_RSA_PKCS`). The classic padding. For signing, the message (or its hash, wrapped in a DigestInfo) is padded with `00 01 FF FF ... FF 00` up to the modulus size. Simple and everywhere, but its decryption form is the one vulnerable to the Bleichenbacher oracle, which is why decryption failures here collapse to one uniform return code.
+
+**PSS** (`CKM_RSA_PKCS_PSS`, `CKM_SHA256_RSA_PKCS_PSS`). Probabilistic Signature Scheme. It mixes a random salt into the padding, so signing the same message twice gives different signatures, and it has a security proof PKCS#1 v1.5 lacks. The module requires the MGF hash to equal the content hash and rejects mismatches:
+
+```zig
+if (mgfHash(pp.mgf) != h) return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+```
+
+**OAEP** (`CKM_RSA_PKCS_OAEP`). Optimal Asymmetric Encryption Padding, for encryption and key wrapping. It is the encryption counterpart to PSS: randomized, with a proof, and the recommended replacement for PKCS#1 v1.5 encryption precisely because it resists Bleichenbacher.
+
+The split between hash-then-sign and raw is visible in `sign`. When a digest is specified, it uses `EVP_DigestSign` (which hashes then signs); when the input is already a hash, it uses `EVP_PKEY_sign` directly:
+
+```zig
+if (p.digest != .none) {
+    // EVP_DigestSignInit + EVP_DigestSign: hash the message, then sign
+} else {
+    // EVP_PKEY_sign: sign the pre-hashed value as-is
+}
+```
+
+Sign/VerifyRecover (`C_SignRecover` / `C_VerifyRecover`) use PKCS#1 v1.5's property that the message is recoverable from the signature. The module offers recover only for `CKM_RSA_PKCS`, and it checks the data fits the modulus with the 11-byte v1.5 overhead before signing.
+
+## Argon2id: turning a weak PIN into a strong key
+
+A PIN is low-entropy, so the stored form has to be expensive to attack and the derived KEK has to be strong. Argon2id, the winner of the Password Hashing Competition, is memory-hard: each guess must allocate and traverse a large block of memory, which defeats the massive parallelism a GPU or ASIC brings to a fast hash.
+
+The parameters in `config.zig` are `t = 3` iterations, `m = 64 MiB`, `p = 1` lane. Each PIN guess costs 64 MiB of memory and three passes over it. `pin.zig` derives the 32-byte output from the PIN and a random 16-byte salt:
+
+```zig
+pub fn derive(io: std.Io, allocator: std.mem.Allocator, pin: []const u8, salt: *const Salt, out: *Hash) !void {
+    try argon2.kdf(allocator, out, pin, salt, params, .argon2id, io);
+}
+```
+
+The same derivation does double duty. For authentication, the output is compared (constant-time) against the stored hash. For the envelope, the output is the key-encryption key that wraps the master key. The `id` variant blends the data-independent and data-dependent modes, giving resistance to both side-channel and time-memory-tradeoff attacks.
+
+## The Envelope: sealing values and wrapping the master key
+
+The at-rest scheme has two GCM operations, both in `keystore.zig`.
+
+**Wrapping the master key.** The master key (32 random bytes) is encrypted under the KEK derived from the PIN. The wrapped form is salt, nonce, ciphertext, and tag, stored in the token record. A wrong PIN derives a wrong KEK, the GCM tag fails, and `unwrap` returns false rather than a bogus key:
+
+```zig
+gcm.decrypt(out, &w.ct, w.tag, "", w.nonce, kek) catch {
+    std.crypto.secureZero(u8, out);
+    return false;
+};
+```
+
+**Sealing a value.** Each sensitive attribute value is GCM-encrypted under the master key, with the attribute *type* as associated data, and a fresh nonce per seal:
+
+```zig
+pub fn seal(io: std.Io, mk: *const MasterKey, ad: []const u8, plain: []const u8, out: []u8) !usize {
+    var nonce: [nonce_len]u8 = undefined;
+    try io.randomSecure(&nonce);            // fresh nonce every time
+    @memcpy(out[0..nonce_len], &nonce);
+    const ct = out[nonce_len..][0..plain.len];
+    const tag = out[nonce_len + plain.len ..][0..tag_len];
+    gcm.encrypt(ct, tag, plain, ad, nonce, mk.*);
+    return sealedLen(plain.len);
+}
+```
+
+The associated data binds the ciphertext to its attribute type. Unseal of a value whose `ad` does not match the type it is being loaded into fails the tag, so a sealed `CKA_PRIVATE_EXPONENT` cannot be swapped into a `CKA_VALUE` slot. The fresh nonce per seal is what keeps GCM safe; reusing a nonce under the same key is GCM's one catastrophic foot-gun, and the design never does.
+
+A sealed value is `nonce_len + plaintext_len + tag_len` bytes, which is `12 + n + 16`. The on-disk record stores that length so unseal knows where the ciphertext ends and the tag begins.
+
+## Constant-Time and Zeroization: the cross-cutting mechanics
+
+These are not mechanisms a host calls, but they are the machinery that makes the mechanisms safe.
+
+**Constant-time comparison.** Any compare of a secret has to look at every byte regardless of where the first mismatch is, or the time it takes leaks the position. Fixed-size secrets (the PIN hash) use `std.crypto.timing_safe.eql`, which XORs all elements into one accumulator and tests it branchlessly. Variable-length MACs use `ctEql`, the same idea by hand. The CBC-PAD and RFC 3394 checks fold all their differences before deciding, for the same reason.
+
+**Zeroization.** A secret left in freed or idle memory can be recovered from a crash dump, a swapped page, or a cold-boot read. The module zeroes secrets with `std.crypto.secureZero`, which takes a `[]volatile` slice:
+
+```zig
+pub fn secureZero(comptime T: type, s: []volatile T) void {
+    @memset(s, 0);
+}
+```
+
+The `volatile` is the whole point. A plain `@memset(&key, 0)` with no subsequent read is a dead store the optimizer is free to delete. Marking the slice volatile tells the compiler the write is an observable side effect that must happen. This is the same technique every serious C crypto library uses, and Zig builds it into one auditable function. Stack secrets pair it with `defer`; heap secrets go through `secureFree`; session operation state zeroes itself on teardown; logout re-seals and wipes the master key. The net effect is that an idle, logged-out token holds no plaintext key material anywhere.
+
+One Zig-specific wrinkle: in Debug and ReleaseSafe builds, setting an optional to null poisons its payload to `0xAA`, and `Allocator.free` memsets freed memory to `0xAA`. So after a `secureZero`-then-null you see `0xAA`, not zeros. The secret is destroyed (it is `0xAA`, not the key), it is simply not zero. The tests therefore assert "the secret pattern is gone", not "all bytes are zero". In a release build without those safety memsets, the explicit `secureZero` is what does the work.
+
+## Picking a Mechanism
+
+Most of the time the choice is dictated by what you are interoperating with, but here is the guidance the design encodes:
+
+- **Symmetric encryption:** prefer GCM (`CKM_AES_GCM`). It authenticates, so tampering is detected. Use CBC-PAD only when a peer requires unauthenticated CBC, and pair it with a separate MAC if you do.
+- **RSA encryption / key transport:** prefer OAEP (`CKM_RSA_PKCS_OAEP`). PKCS#1 v1.5 encryption is the Bleichenbacher target; OAEP is the modern replacement.
+- **RSA signatures:** prefer PSS (`CKM_RSA_PKCS_PSS`). It has a security proof v1.5 lacks. Use v1.5 (`CKM_SHA256_RSA_PKCS`) for compatibility with systems that expect it.
+- **Signatures in general:** ECDSA gives you the same security as RSA with far smaller keys and signatures (a P-256 signature is 64 bytes versus 256 for RSA-2048). Prefer it when both ends support it.
+- **Key wrapping:** AES-KEY-WRAP (RFC 3394) for wrapping a symmetric key under another symmetric key; RSA-OAEP for wrapping under a public key.
+- **Key agreement:** ECDH (`CKM_ECDH1_DERIVE`) to derive a shared secret from two EC keypairs.
+
+## The Detail Behind ECDSA Determinism
+
+If you are curious why the test suite verifies an external vector but cannot assert its own sign output:
+
+Plain RFC 6979 ECDSA is fully deterministic: the nonce is a function of the message and the private key, so signing the same message twice yields the same signature, and you can pin a known-answer test on the output. Zig's `signPrehashed`, however, mixes an optional noise field into the nonce derivation (a hedged-signature design that adds defense against fault attacks). That makes the output non-deterministic, so two signatures of the same message differ.
+
+The consequence for testing is that you verify against RFC 6979 (a known signature must validate under the known key) but you cannot assert that your own signing reproduces the RFC 6979 signature byte for byte. The suite does both of the things you *can* do: it uses the RFC 6979 vector as a verify known-answer test, and it round-trips its own signatures (sign, then verify, then tamper and confirm rejection). This is the correct way to test a hedged signature scheme, and it is worth understanding so the test design does not look like a gap.
+
+## Next Steps
+
+1. Read [CONFORMANCE.md](./CONFORMANCE.md) for the exact parameter rules and return codes at every boundary of these mechanisms.
+2. Open `src/crypto/cipher.zig` and read the RFC 3394 test, then `src/crypto/ecdsa.zig` and read the ECDH both-sides test. The tests are short and show each mechanism end to end.
+3. Try the extensions in [04-CHALLENGES.md](./04-CHALLENGES.md), several of which add a mechanism and walk you through the same wiring you have now seen for the existing ones.
diff --git a/PROJECTS/advanced/hsm-emulator/pkcs11.map b/PROJECTS/advanced/hsm-emulator/pkcs11.map
new file mode 100644
index 00000000..a2b8bda3
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/pkcs11.map
@@ -0,0 +1,8 @@
+/* ©AngelaMos | 2026 */
+/* pkcs11.map */
+PKCS11_2_40 {
+    global:
+        C_GetFunctionList;
+    local:
+        *;
+};
diff --git a/PROJECTS/advanced/hsm-emulator/src/api/crypto_ops.zig b/PROJECTS/advanced/hsm-emulator/src/api/crypto_ops.zig
new file mode 100644
index 00000000..29f581d5
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/api/crypto_ops.zig
@@ -0,0 +1,1240 @@
+// ©AngelaMos | 2026
+// crypto_ops.zig
+
+const std = @import("std");
+const ck = @import("../ck.zig");
+const config = @import("../config.zig");
+const state = @import("../core/state.zig");
+const session = @import("../core/session.zig");
+const object_store = @import("../core/object_store.zig");
+const digest = @import("../crypto/digest.zig");
+const mac = @import("../crypto/mac.zig");
+const cipher = @import("../crypto/cipher.zig");
+const ecdsa = @import("../crypto/ecdsa.zig");
+const rsa = @import("../crypto/rsa.zig");
+
+fn part(p: [*]ck.CK_BYTE, len: ck.CK_ULONG) []const u8 {
+    return p[0..@intCast(len)];
+}
+
+fn ctEql(a: []const u8, b: []const u8) bool {
+    if (a.len != b.len) return false;
+    var diff: u8 = 0;
+    for (a, b) |x, y| diff |= x ^ y;
+    return diff == 0;
+}
+
+fn objectClass(obj: *const object_store.Object) ?ck.CK_OBJECT_CLASS {
+    const v = obj.get(ck.CKA_CLASS) orelse return null;
+    if (v.len != @sizeOf(ck.CK_OBJECT_CLASS)) return null;
+    return std.mem.bytesToValue(ck.CK_OBJECT_CLASS, v[0..@sizeOf(ck.CK_OBJECT_CLASS)]);
+}
+
+fn keyType(obj: *const object_store.Object) ?ck.CK_KEY_TYPE {
+    const v = obj.get(ck.CKA_KEY_TYPE) orelse return null;
+    if (v.len != @sizeOf(ck.CK_KEY_TYPE)) return null;
+    return std.mem.bytesToValue(ck.CK_KEY_TYPE, v[0..@sizeOf(ck.CK_KEY_TYPE)]);
+}
+
+const KeyVal = union(enum) {
+    ok: []const u8,
+    err: ck.CK_RV,
+};
+
+fn secretKeyValue(inst: *state.Instance, hKey: ck.CK_OBJECT_HANDLE, usage: ck.CK_ATTRIBUTE_TYPE) KeyVal {
+    const obj = inst.objects.getPtr(hKey) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID };
+    if (!object_store.visible(obj, inst.logged_in)) return .{ .err = ck.CKR_KEY_HANDLE_INVALID };
+    if (objectClass(obj) != ck.CKO_SECRET_KEY) return .{ .err = ck.CKR_KEY_TYPE_INCONSISTENT };
+    if (obj.has(usage) and !obj.getBool(usage)) return .{ .err = ck.CKR_KEY_FUNCTION_NOT_PERMITTED };
+    const a = obj.findPtr(ck.CKA_VALUE) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID };
+    if (a.sealed) return .{ .err = ck.CKR_USER_NOT_LOGGED_IN };
+    return .{ .ok = a.value };
+}
+
+const EcKey = union(enum) {
+    ok: struct { curve: ecdsa.Curve, material: []const u8 },
+    err: ck.CK_RV,
+};
+
+fn ecPrivateKey(inst: *state.Instance, hKey: ck.CK_OBJECT_HANDLE) EcKey {
+    const obj = inst.objects.getPtr(hKey) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID };
+    if (!object_store.visible(obj, inst.logged_in)) return .{ .err = ck.CKR_KEY_HANDLE_INVALID };
+    if (objectClass(obj) != ck.CKO_PRIVATE_KEY) return .{ .err = ck.CKR_KEY_TYPE_INCONSISTENT };
+    if (keyType(obj) != ck.CKK_EC) return .{ .err = ck.CKR_KEY_TYPE_INCONSISTENT };
+    if (obj.has(ck.CKA_SIGN) and !obj.getBool(ck.CKA_SIGN)) return .{ .err = ck.CKR_KEY_FUNCTION_NOT_PERMITTED };
+    const params = obj.get(ck.CKA_EC_PARAMS) orelse return .{ .err = ck.CKR_KEY_TYPE_INCONSISTENT };
+    const curve = ecdsa.curveFromParams(params) orelse return .{ .err = ck.CKR_KEY_TYPE_INCONSISTENT };
+    const sa = obj.findPtr(ck.CKA_VALUE) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID };
+    if (sa.sealed) return .{ .err = ck.CKR_USER_NOT_LOGGED_IN };
+    if (sa.value.len != curve.scalarLen()) return .{ .err = ck.CKR_FUNCTION_FAILED };
+    return .{ .ok = .{ .curve = curve, .material = sa.value } };
+}
+
+fn ecPublicKey(inst: *state.Instance, hKey: ck.CK_OBJECT_HANDLE) EcKey {
+    const obj = inst.objects.getPtr(hKey) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID };
+    if (!object_store.visible(obj, inst.logged_in)) return .{ .err = ck.CKR_KEY_HANDLE_INVALID };
+    if (objectClass(obj) != ck.CKO_PUBLIC_KEY) return .{ .err = ck.CKR_KEY_TYPE_INCONSISTENT };
+    if (keyType(obj) != ck.CKK_EC) return .{ .err = ck.CKR_KEY_TYPE_INCONSISTENT };
+    if (obj.has(ck.CKA_VERIFY) and !obj.getBool(ck.CKA_VERIFY)) return .{ .err = ck.CKR_KEY_FUNCTION_NOT_PERMITTED };
+    const params = obj.get(ck.CKA_EC_PARAMS) orelse return .{ .err = ck.CKR_KEY_TYPE_INCONSISTENT };
+    const curve = ecdsa.curveFromParams(params) orelse return .{ .err = ck.CKR_KEY_TYPE_INCONSISTENT };
+    const der = obj.get(ck.CKA_EC_POINT) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID };
+    const point = ecdsa.unwrapEcPoint(der) orelse return .{ .err = ck.CKR_FUNCTION_FAILED };
+    if (point.len != curve.pointLen()) return .{ .err = ck.CKR_FUNCTION_FAILED };
+    return .{ .ok = .{ .curve = curve, .material = point } };
+}
+
+const RsaPriv = union(enum) {
+    ok: rsa.PrivateComponents,
+    err: ck.CK_RV,
+};
+
+const RsaPub = union(enum) {
+    ok: rsa.PublicComponents,
+    err: ck.CK_RV,
+};
+
+fn rsaPrivateComponents(inst: *state.Instance, hKey: ck.CK_OBJECT_HANDLE, usage: ck.CK_ATTRIBUTE_TYPE) RsaPriv {
+    const obj = inst.objects.getPtr(hKey) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID };
+    if (!object_store.visible(obj, inst.logged_in)) return .{ .err = ck.CKR_KEY_HANDLE_INVALID };
+    if (objectClass(obj) != ck.CKO_PRIVATE_KEY) return .{ .err = ck.CKR_KEY_TYPE_INCONSISTENT };
+    if (keyType(obj) != ck.CKK_RSA) return .{ .err = ck.CKR_KEY_TYPE_INCONSISTENT };
+    if (obj.has(usage) and !obj.getBool(usage)) return .{ .err = ck.CKR_KEY_FUNCTION_NOT_PERMITTED };
+    if (obj.findPtr(ck.CKA_PRIVATE_EXPONENT)) |da| {
+        if (da.sealed) return .{ .err = ck.CKR_USER_NOT_LOGGED_IN };
+    }
+    return .{ .ok = .{
+        .n = obj.get(ck.CKA_MODULUS) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID },
+        .e = obj.get(ck.CKA_PUBLIC_EXPONENT) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID },
+        .d = obj.get(ck.CKA_PRIVATE_EXPONENT) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID },
+        .p = obj.get(ck.CKA_PRIME_1) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID },
+        .q = obj.get(ck.CKA_PRIME_2) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID },
+        .dmp1 = obj.get(ck.CKA_EXPONENT_1) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID },
+        .dmq1 = obj.get(ck.CKA_EXPONENT_2) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID },
+        .iqmp = obj.get(ck.CKA_COEFFICIENT) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID },
+    } };
+}
+
+fn rsaPublicComponents(inst: *state.Instance, hKey: ck.CK_OBJECT_HANDLE, usage: ck.CK_ATTRIBUTE_TYPE) RsaPub {
+    const obj = inst.objects.getPtr(hKey) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID };
+    if (!object_store.visible(obj, inst.logged_in)) return .{ .err = ck.CKR_KEY_HANDLE_INVALID };
+    if (objectClass(obj) != ck.CKO_PUBLIC_KEY) return .{ .err = ck.CKR_KEY_TYPE_INCONSISTENT };
+    if (keyType(obj) != ck.CKK_RSA) return .{ .err = ck.CKR_KEY_TYPE_INCONSISTENT };
+    if (obj.has(usage) and !obj.getBool(usage)) return .{ .err = ck.CKR_KEY_FUNCTION_NOT_PERMITTED };
+    return .{ .ok = .{
+        .n = obj.get(ck.CKA_MODULUS) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID },
+        .e = obj.get(ck.CKA_PUBLIC_EXPONENT) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID },
+    } };
+}
+
+fn isRsaSignMech(mech: ck.CK_MECHANISM_TYPE) bool {
+    return switch (mech) {
+        ck.CKM_RSA_PKCS, ck.CKM_SHA256_RSA_PKCS, ck.CKM_RSA_PKCS_PSS, ck.CKM_SHA256_RSA_PKCS_PSS => true,
+        else => false,
+    };
+}
+
+fn mgfHash(mgf: ck.CK_RSA_PKCS_MGF_TYPE) ?rsa.Hash {
+    return switch (mgf) {
+        ck.CKG_MGF1_SHA256 => .sha256,
+        ck.CKG_MGF1_SHA384 => .sha384,
+        ck.CKG_MGF1_SHA512 => .sha512,
+        else => null,
+    };
+}
+
+const SignParamsResult = union(enum) {
+    ok: rsa.SignParams,
+    err: ck.CK_RV,
+};
+
+fn parsePss(pMechanism: *ck.CK_MECHANISM, digest_hash: rsa.Hash) SignParamsResult {
+    var params: rsa.SignParams = .{
+        .scheme = .pss,
+        .digest = digest_hash,
+        .pss_hash = if (digest_hash == .none) .sha256 else digest_hash,
+    };
+    const p = pMechanism.pParameter orelse {
+        if (digest_hash == .none) return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+        return .{ .ok = params };
+    };
+    if (pMechanism.ulParameterLen != @sizeOf(ck.CK_RSA_PKCS_PSS_PARAMS)) return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+    const pp: *const ck.CK_RSA_PKCS_PSS_PARAMS = @ptrCast(@alignCast(p));
+    const h = rsa.Hash.fromMech(pp.hashAlg) orelse return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+    if (digest_hash != .none and h != digest_hash) return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+    if (mgfHash(pp.mgf) != h) return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+    if (pp.sLen > rsa.max_modulus_bytes) return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+    params.pss_hash = h;
+    params.salt_len = @intCast(pp.sLen);
+    return .{ .ok = params };
+}
+
+fn rsaSignParams(pMechanism: *ck.CK_MECHANISM) SignParamsResult {
+    return switch (pMechanism.mechanism) {
+        ck.CKM_RSA_PKCS => .{ .ok = .{ .scheme = .pkcs1, .digest = .none } },
+        ck.CKM_SHA256_RSA_PKCS => .{ .ok = .{ .scheme = .pkcs1, .digest = .sha256 } },
+        ck.CKM_RSA_PKCS_PSS => parsePss(pMechanism, .none),
+        ck.CKM_SHA256_RSA_PKCS_PSS => parsePss(pMechanism, .sha256),
+        else => .{ .err = ck.CKR_MECHANISM_INVALID },
+    };
+}
+
+const CryptParamsResult = union(enum) {
+    ok: rsa.CryptParams,
+    err: ck.CK_RV,
+};
+
+fn rsaCryptParams(pMechanism: *ck.CK_MECHANISM) CryptParamsResult {
+    return switch (pMechanism.mechanism) {
+        ck.CKM_RSA_PKCS => .{ .ok = .{ .scheme = .pkcs1 } },
+        ck.CKM_RSA_PKCS_OAEP => blk: {
+            const p = pMechanism.pParameter orelse break :blk .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+            if (pMechanism.ulParameterLen != @sizeOf(ck.CK_RSA_PKCS_OAEP_PARAMS)) break :blk .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+            const op: *const ck.CK_RSA_PKCS_OAEP_PARAMS = @ptrCast(@alignCast(p));
+            const h = rsa.Hash.fromMech(op.hashAlg) orelse break :blk .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+            if (mgfHash(op.mgf) != h) break :blk .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+            if (op.ulSourceDataLen != 0) break :blk .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+            break :blk .{ .ok = .{ .scheme = .oaep, .oaep_hash = h } };
+        },
+        else => .{ .err = ck.CKR_MECHANISM_INVALID },
+    };
+}
+
+fn signLen(op: *const session.SignOp) ck.CK_ULONG {
+    return switch (op.*) {
+        .mac => |*m| @intCast(m.macLen()),
+        .ec => |*e| @intCast(e.sigLen()),
+        .rsa => |*r| @intCast(r.sig_len),
+    };
+}
+
+fn emitSign(inst: *state.Instance, sess: *session.Session, pSignature: ?[*]ck.CK_BYTE, pulSignatureLen: *ck.CK_ULONG) ck.CK_RV {
+    const op = &sess.sign_op.?;
+    const slen = signLen(op);
+    if (pSignature == null) {
+        pulSignatureLen.* = slen;
+        return ck.CKR_OK;
+    }
+    if (pulSignatureLen.* < slen) {
+        pulSignatureLen.* = slen;
+        return ck.CKR_BUFFER_TOO_SMALL;
+    }
+    const out = pSignature.?[0..@intCast(slen)];
+    switch (op.*) {
+        .mac => |*m| m.finalInto(out),
+        .ec => |*e| _ = e.finalInto(inst.io(), out) catch {
+            sess.endSign();
+            return ck.CKR_FUNCTION_FAILED;
+        },
+        .rsa => return ck.CKR_FUNCTION_FAILED,
+    }
+    pulSignatureLen.* = slen;
+    sess.endSign();
+    return ck.CKR_OK;
+}
+
+fn finalizeVerify(sess: *session.Session, pSignature: [*]ck.CK_BYTE, ulSignatureLen: ck.CK_ULONG) ck.CK_RV {
+    const sig = pSignature[0..@intCast(ulSignatureLen)];
+    const rv = switch (sess.verify_op.?) {
+        .mac => |*m| blk: {
+            const mlen: ck.CK_ULONG = @intCast(m.macLen());
+            var computed: [mac.max_mac_len]u8 = undefined;
+            m.finalInto(computed[0..@intCast(mlen)]);
+            if (ulSignatureLen != mlen) break :blk ck.CKR_SIGNATURE_LEN_RANGE;
+            if (!ctEql(computed[0..@intCast(mlen)], sig)) break :blk ck.CKR_SIGNATURE_INVALID;
+            break :blk ck.CKR_OK;
+        },
+        .ec => |*e| switch (e.finalVerify(sig)) {
+            .ok => ck.CKR_OK,
+            .invalid => ck.CKR_SIGNATURE_INVALID,
+            .len_range => ck.CKR_SIGNATURE_LEN_RANGE,
+        },
+        .rsa => ck.CKR_FUNCTION_FAILED,
+    };
+    sess.endVerify();
+    return rv;
+}
+
+fn signInitOp(inst: *state.Instance, hKey: ck.CK_OBJECT_HANDLE, pMechanism: *ck.CK_MECHANISM) union(enum) { ok: session.SignOp, err: ck.CK_RV } {
+    const mech = pMechanism.mechanism;
+    if (mac.macLenOf(mech) != null) {
+        const val = switch (secretKeyValue(inst, hKey, ck.CKA_SIGN)) {
+            .err => |rv| return .{ .err = rv },
+            .ok => |v| v,
+        };
+        return .{ .ok = .{ .mac = mac.Mac.init(mech, val) orelse return .{ .err = ck.CKR_MECHANISM_INVALID } } };
+    }
+    if (ecdsa.hashModeOf(mech) != null) {
+        const k = switch (ecPrivateKey(inst, hKey)) {
+            .err => |rv| return .{ .err = rv },
+            .ok => |v| v,
+        };
+        return .{ .ok = .{ .ec = ecdsa.SignState.init(k.curve, mech, k.material) orelse return .{ .err = ck.CKR_MECHANISM_INVALID } } };
+    }
+    if (isRsaSignMech(mech)) {
+        const params = switch (rsaSignParams(pMechanism)) {
+            .err => |rv| return .{ .err = rv },
+            .ok => |p| p,
+        };
+        const pc = switch (rsaPrivateComponents(inst, hKey, ck.CKA_SIGN)) {
+            .err => |rv| return .{ .err = rv },
+            .ok => |c| c,
+        };
+        return .{ .ok = .{ .rsa = .{ .key = hKey, .params = params, .sig_len = pc.n.len } } };
+    }
+    return .{ .err = ck.CKR_MECHANISM_INVALID };
+}
+
+fn verifyInitOp(inst: *state.Instance, hKey: ck.CK_OBJECT_HANDLE, pMechanism: *ck.CK_MECHANISM) union(enum) { ok: session.VerifyOp, err: ck.CK_RV } {
+    const mech = pMechanism.mechanism;
+    if (mac.macLenOf(mech) != null) {
+        const val = switch (secretKeyValue(inst, hKey, ck.CKA_VERIFY)) {
+            .err => |rv| return .{ .err = rv },
+            .ok => |v| v,
+        };
+        return .{ .ok = .{ .mac = mac.Mac.init(mech, val) orelse return .{ .err = ck.CKR_MECHANISM_INVALID } } };
+    }
+    if (ecdsa.hashModeOf(mech) != null) {
+        const k = switch (ecPublicKey(inst, hKey)) {
+            .err => |rv| return .{ .err = rv },
+            .ok => |v| v,
+        };
+        return .{ .ok = .{ .ec = ecdsa.VerifyState.init(k.curve, mech, k.material) orelse return .{ .err = ck.CKR_MECHANISM_INVALID } } };
+    }
+    if (isRsaSignMech(mech)) {
+        const params = switch (rsaSignParams(pMechanism)) {
+            .err => |rv| return .{ .err = rv },
+            .ok => |p| p,
+        };
+        const pc = switch (rsaPublicComponents(inst, hKey, ck.CKA_VERIFY)) {
+            .err => |rv| return .{ .err = rv },
+            .ok => |c| c,
+        };
+        return .{ .ok = .{ .rsa = .{ .key = hKey, .params = params, .sig_len = pc.n.len } } };
+    }
+    return .{ .err = ck.CKR_MECHANISM_INVALID };
+}
+
+fn mapCipherErr(e: cipher.Error) ck.CK_RV {
+    return switch (e) {
+        cipher.Error.DataLenRange => ck.CKR_DATA_LEN_RANGE,
+        cipher.Error.EncryptedDataLenRange => ck.CKR_ENCRYPTED_DATA_LEN_RANGE,
+        cipher.Error.EncryptedDataInvalid => ck.CKR_ENCRYPTED_DATA_INVALID,
+        cipher.Error.KeySize => ck.CKR_KEY_SIZE_RANGE,
+        cipher.Error.AadTooLarge => ck.CKR_ARGUMENTS_BAD,
+        cipher.Error.IvInvalid => ck.CKR_MECHANISM_PARAM_INVALID,
+    };
+}
+
+const CipherInit = union(enum) {
+    ok: cipher.Cipher,
+    err: ck.CK_RV,
+};
+
+fn buildCipher(inst: *state.Instance, pMechanism: *ck.CK_MECHANISM, hKey: ck.CK_OBJECT_HANDLE, encrypt: bool, usage: ck.CK_ATTRIBUTE_TYPE) CipherInit {
+    const mode = cipher.modeOf(pMechanism.mechanism) orelse return .{ .err = ck.CKR_MECHANISM_INVALID };
+    const val = switch (secretKeyValue(inst, hKey, usage)) {
+        .err => |rv| return .{ .err = rv },
+        .ok => |v| v,
+    };
+    if (!cipher.validKeyLen(val.len)) return .{ .err = ck.CKR_KEY_SIZE_RANGE };
+
+    var c: cipher.Cipher = .{ .mode = mode, .encrypt = encrypt, .key_len = @intCast(val.len) };
+    @memcpy(c.key_buf[0..val.len], val);
+
+    switch (mode) {
+        .cbc, .cbc_pad => {
+            const p = pMechanism.pParameter orelse return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+            if (pMechanism.ulParameterLen != config.aes_block_len) return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+            @memcpy(&c.chain, @as([*]const u8, @ptrCast(p))[0..config.aes_block_len]);
+        },
+        .gcm => {
+            const p = pMechanism.pParameter orelse return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+            if (pMechanism.ulParameterLen != @sizeOf(ck.CK_GCM_PARAMS)) return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+            const gp: *const ck.CK_GCM_PARAMS = @ptrCast(@alignCast(p));
+            if (gp.ulIvLen != config.gcm_iv_len) return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+            if (gp.ulIvBits != 0 and gp.ulIvBits != config.gcm_iv_bits) return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+            if (gp.ulTagBits != config.gcm_tag_bits) return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+            const ivp = gp.pIv orelse return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+            @memcpy(&c.iv, ivp[0..config.gcm_iv_len]);
+            const aad_len: usize = @intCast(gp.ulAADLen);
+            if (aad_len > config.max_gcm_aad_len) return .{ .err = ck.CKR_ARGUMENTS_BAD };
+            if (aad_len > 0) {
+                const ap = gp.pAAD orelse return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+                @memcpy(c.aad_buf[0..aad_len], ap[0..aad_len]);
+            }
+            c.aad_len = aad_len;
+        },
+    }
+    return .{ .ok = c };
+}
+
+fn updateOutLen(op: *const cipher.Cipher, in_len: usize) ck.CK_ULONG {
+    return @intCast(((op.partial_len + in_len) / config.aes_block_len) * config.aes_block_len);
+}
+
+const NeedResult = union(enum) { ok: ck.CK_ULONG, err: ck.CK_RV };
+const EmitResult = union(enum) { ok: usize, err: ck.CK_RV };
+
+fn encUpdateNeed(op: *const session.EncryptOp, in_len: usize) NeedResult {
+    return switch (op.*) {
+        .rsa => .{ .err = ck.CKR_FUNCTION_NOT_SUPPORTED },
+        .aes => |*c| .{ .ok = updateOutLen(c, in_len) },
+        .gcm => .{ .ok = 0 },
+    };
+}
+
+fn encUpdateEmit(inst: *state.Instance, op: *session.EncryptOp, in: []const u8, out: []u8) EmitResult {
+    switch (op.*) {
+        .rsa => return .{ .err = ck.CKR_FUNCTION_NOT_SUPPORTED },
+        .aes => |*c| return .{ .ok = c.encryptUpdate(in, out) },
+        .gcm => |*g| {
+            g.append(inst.allocator(), in) catch |e| return .{ .err = switch (e) {
+                error.OutOfMemory => ck.CKR_HOST_MEMORY,
+                error.TooLarge => ck.CKR_DATA_LEN_RANGE,
+            } };
+            return .{ .ok = 0 };
+        },
+    }
+}
+
+fn decUpdateNeed(op: *const session.DecryptOp, in_len: usize) NeedResult {
+    return switch (op.*) {
+        .rsa => .{ .err = ck.CKR_FUNCTION_NOT_SUPPORTED },
+        .aes => |*c| .{ .ok = updateOutLen(c, in_len) },
+        .gcm => .{ .ok = 0 },
+    };
+}
+
+fn decUpdateEmit(inst: *state.Instance, op: *session.DecryptOp, in: []const u8, out: []u8) EmitResult {
+    switch (op.*) {
+        .rsa => return .{ .err = ck.CKR_FUNCTION_NOT_SUPPORTED },
+        .aes => |*c| return .{ .ok = c.decryptUpdate(in, out) },
+        .gcm => |*g| {
+            g.append(inst.allocator(), in) catch |e| return .{ .err = switch (e) {
+                error.OutOfMemory => ck.CKR_HOST_MEMORY,
+                error.TooLarge => ck.CKR_ENCRYPTED_DATA_LEN_RANGE,
+            } };
+            return .{ .ok = 0 };
+        },
+    }
+}
+
+fn decryptSideDualOk(op: *const session.DecryptOp) bool {
+    return switch (op.*) {
+        .aes => |*c| c.mode == .cbc,
+        else => false,
+    };
+}
+
+fn emitDigest(sess: *session.Session, pDigest: ?[*]ck.CK_BYTE, pulDigestLen: *ck.CK_ULONG) ck.CK_RV {
+    const op = &sess.digest_op.?;
+    const dlen: ck.CK_ULONG = @intCast(op.digestLen());
+    if (pDigest == null) {
+        pulDigestLen.* = dlen;
+        return ck.CKR_OK;
+    }
+    if (pulDigestLen.* < dlen) {
+        pulDigestLen.* = dlen;
+        return ck.CKR_BUFFER_TOO_SMALL;
+    }
+    op.finalInto(pDigest.?[0..@intCast(dlen)]);
+    pulDigestLen.* = dlen;
+    sess.endDigest();
+    return ck.CKR_OK;
+}
+
+fn isRsaCryptMech(mech: ck.CK_MECHANISM_TYPE) bool {
+    return mech == ck.CKM_RSA_PKCS or mech == ck.CKM_RSA_PKCS_OAEP;
+}
+
+const RsaCryptResult = union(enum) {
+    ok: session.RsaCrypt,
+    err: ck.CK_RV,
+};
+
+fn rsaCryptInit(inst: *state.Instance, pMechanism: *ck.CK_MECHANISM, hKey: ck.CK_OBJECT_HANDLE, private: bool, usage: ck.CK_ATTRIBUTE_TYPE) RsaCryptResult {
+    const params = switch (rsaCryptParams(pMechanism)) {
+        .err => |rv| return .{ .err = rv },
+        .ok => |p| p,
+    };
+    const mod_len = if (private) switch (rsaPrivateComponents(inst, hKey, usage)) {
+        .err => |rv| return .{ .err = rv },
+        .ok => |c| c.n.len,
+    } else switch (rsaPublicComponents(inst, hKey, usage)) {
+        .err => |rv| return .{ .err = rv },
+        .ok => |c| c.n.len,
+    };
+    return .{ .ok = .{ .key = hKey, .params = params, .out_len = mod_len } };
+}
+
+pub fn C_EncryptInit(hSession: ck.CK_SESSION_HANDLE, pMechanism: *ck.CK_MECHANISM, hKey: ck.CK_OBJECT_HANDLE) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.encrypt_op != null) return ck.CKR_OPERATION_ACTIVE;
+    if (cipher.modeOf(pMechanism.mechanism) != null) {
+        const c = switch (buildCipher(inst, pMechanism, hKey, true, ck.CKA_ENCRYPT)) {
+            .err => |rv| return rv,
+            .ok => |built| built,
+        };
+        sess.encrypt_op = if (c.mode == .gcm) .{ .gcm = .{ .cipher = c } } else .{ .aes = c };
+        return ck.CKR_OK;
+    }
+    if (isRsaCryptMech(pMechanism.mechanism)) {
+        sess.encrypt_op = .{ .rsa = switch (rsaCryptInit(inst, pMechanism, hKey, false, ck.CKA_ENCRYPT)) {
+            .err => |rv| return rv,
+            .ok => |o| o,
+        } };
+        return ck.CKR_OK;
+    }
+    return ck.CKR_MECHANISM_INVALID;
+}
+
+pub fn C_Encrypt(hSession: ck.CK_SESSION_HANDLE, pData: [*]ck.CK_BYTE, ulDataLen: ck.CK_ULONG, pEncryptedData: ?[*]ck.CK_BYTE, pulEncryptedDataLen: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    const op = if (sess.encrypt_op) |*o| o else return ck.CKR_OPERATION_NOT_INITIALIZED;
+    const in = part(pData, ulDataLen);
+
+    switch (op.*) {
+        .aes => |*c| {
+            const need: ck.CK_ULONG = @intCast(cipher.encryptOutLen(c.mode, in.len));
+            if (pEncryptedData == null) {
+                pulEncryptedDataLen.* = need;
+                return ck.CKR_OK;
+            }
+            if (pulEncryptedDataLen.* < need) {
+                pulEncryptedDataLen.* = need;
+                return ck.CKR_BUFFER_TOO_SMALL;
+            }
+            const out = pEncryptedData.?[0..@intCast(need)];
+            var n = c.encryptUpdate(in, out);
+            n += c.encryptFinal(out[n..]) catch |e| {
+                sess.endEncrypt(inst.allocator());
+                return mapCipherErr(e);
+            };
+            pulEncryptedDataLen.* = @intCast(n);
+            sess.endEncrypt(inst.allocator());
+            return ck.CKR_OK;
+        },
+        .gcm => |*g| {
+            const need: ck.CK_ULONG = @intCast(cipher.encryptOutLen(.gcm, in.len));
+            if (pEncryptedData == null) {
+                pulEncryptedDataLen.* = need;
+                return ck.CKR_OK;
+            }
+            if (pulEncryptedDataLen.* < need) {
+                pulEncryptedDataLen.* = need;
+                return ck.CKR_BUFFER_TOO_SMALL;
+            }
+            const n = g.cipher.gcmEncrypt(in, pEncryptedData.?[0..@intCast(need)]);
+            pulEncryptedDataLen.* = @intCast(n);
+            sess.endEncrypt(inst.allocator());
+            return ck.CKR_OK;
+        },
+        .rsa => |*r| {
+            const need: ck.CK_ULONG = @intCast(r.out_len);
+            if (pEncryptedData == null) {
+                pulEncryptedDataLen.* = need;
+                return ck.CKR_OK;
+            }
+            if (pulEncryptedDataLen.* < need) {
+                pulEncryptedDataLen.* = need;
+                return ck.CKR_BUFFER_TOO_SMALL;
+            }
+            const pc = switch (rsaPublicComponents(inst, r.key, ck.CKA_ENCRYPT)) {
+                .err => |rv| {
+                    sess.endEncrypt(inst.allocator());
+                    return rv;
+                },
+                .ok => |c| c,
+            };
+            const n = rsa.encrypt(pc, r.params, in, pEncryptedData.?[0..@intCast(need)]) catch {
+                sess.endEncrypt(inst.allocator());
+                return ck.CKR_DATA_LEN_RANGE;
+            };
+            pulEncryptedDataLen.* = @intCast(n);
+            sess.endEncrypt(inst.allocator());
+            return ck.CKR_OK;
+        },
+    }
+}
+
+pub fn C_EncryptUpdate(hSession: ck.CK_SESSION_HANDLE, pPart: [*]ck.CK_BYTE, ulPartLen: ck.CK_ULONG, pEncryptedPart: ?[*]ck.CK_BYTE, pulEncryptedPartLen: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    const op = if (sess.encrypt_op) |*o| o else return ck.CKR_OPERATION_NOT_INITIALIZED;
+    const in = part(pPart, ulPartLen);
+    const need = switch (encUpdateNeed(op, in.len)) {
+        .err => |rv| return rv,
+        .ok => |n| n,
+    };
+    if (pEncryptedPart == null) {
+        pulEncryptedPartLen.* = need;
+        return ck.CKR_OK;
+    }
+    if (pulEncryptedPartLen.* < need) {
+        pulEncryptedPartLen.* = need;
+        return ck.CKR_BUFFER_TOO_SMALL;
+    }
+    const wrote = switch (encUpdateEmit(inst, op, in, pEncryptedPart.?[0..@intCast(need)])) {
+        .err => |rv| {
+            sess.endEncrypt(inst.allocator());
+            return rv;
+        },
+        .ok => |n| n,
+    };
+    pulEncryptedPartLen.* = @intCast(wrote);
+    return ck.CKR_OK;
+}
+
+pub fn C_EncryptFinal(hSession: ck.CK_SESSION_HANDLE, pLastEncryptedPart: ?[*]ck.CK_BYTE, pulLastEncryptedPartLen: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    const op = if (sess.encrypt_op) |*o| o else return ck.CKR_OPERATION_NOT_INITIALIZED;
+    switch (op.*) {
+        .rsa => return ck.CKR_FUNCTION_NOT_SUPPORTED,
+        .aes => |*c| {
+            const need: ck.CK_ULONG = if (c.mode == .cbc_pad) config.aes_block_len else 0;
+            if (pLastEncryptedPart == null) {
+                pulLastEncryptedPartLen.* = need;
+                return ck.CKR_OK;
+            }
+            if (pulLastEncryptedPartLen.* < need) {
+                pulLastEncryptedPartLen.* = need;
+                return ck.CKR_BUFFER_TOO_SMALL;
+            }
+            const n = c.encryptFinal(pLastEncryptedPart.?[0..@intCast(need)]) catch |e| {
+                sess.endEncrypt(inst.allocator());
+                return mapCipherErr(e);
+            };
+            pulLastEncryptedPartLen.* = @intCast(n);
+            sess.endEncrypt(inst.allocator());
+            return ck.CKR_OK;
+        },
+        .gcm => |*g| {
+            const need: ck.CK_ULONG = @intCast(g.len + config.gcm_tag_len);
+            if (pLastEncryptedPart == null) {
+                pulLastEncryptedPartLen.* = need;
+                return ck.CKR_OK;
+            }
+            if (pulLastEncryptedPartLen.* < need) {
+                pulLastEncryptedPartLen.* = need;
+                return ck.CKR_BUFFER_TOO_SMALL;
+            }
+            const n = g.cipher.gcmEncrypt(g.data(), pLastEncryptedPart.?[0..@intCast(need)]);
+            pulLastEncryptedPartLen.* = @intCast(n);
+            sess.endEncrypt(inst.allocator());
+            return ck.CKR_OK;
+        },
+    }
+}
+
+pub fn C_DecryptInit(hSession: ck.CK_SESSION_HANDLE, pMechanism: *ck.CK_MECHANISM, hKey: ck.CK_OBJECT_HANDLE) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.decrypt_op != null) return ck.CKR_OPERATION_ACTIVE;
+    if (cipher.modeOf(pMechanism.mechanism) != null) {
+        const c = switch (buildCipher(inst, pMechanism, hKey, false, ck.CKA_DECRYPT)) {
+            .err => |rv| return rv,
+            .ok => |built| built,
+        };
+        sess.decrypt_op = if (c.mode == .gcm) .{ .gcm = .{ .cipher = c } } else .{ .aes = c };
+        return ck.CKR_OK;
+    }
+    if (isRsaCryptMech(pMechanism.mechanism)) {
+        sess.decrypt_op = .{ .rsa = switch (rsaCryptInit(inst, pMechanism, hKey, true, ck.CKA_DECRYPT)) {
+            .err => |rv| return rv,
+            .ok => |o| o,
+        } };
+        return ck.CKR_OK;
+    }
+    return ck.CKR_MECHANISM_INVALID;
+}
+
+pub fn C_Decrypt(hSession: ck.CK_SESSION_HANDLE, pEncryptedData: [*]ck.CK_BYTE, ulEncryptedDataLen: ck.CK_ULONG, pData: ?[*]ck.CK_BYTE, pulDataLen: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    const op = if (sess.decrypt_op) |*o| o else return ck.CKR_OPERATION_NOT_INITIALIZED;
+    const in = part(pEncryptedData, ulEncryptedDataLen);
+
+    switch (op.*) {
+        .aes => |*c| {
+            const need: ck.CK_ULONG = @intCast(cipher.decryptOutLen(c.mode, in.len));
+            if (pData == null) {
+                pulDataLen.* = need;
+                return ck.CKR_OK;
+            }
+            if (pulDataLen.* < need) {
+                pulDataLen.* = need;
+                return ck.CKR_BUFFER_TOO_SMALL;
+            }
+            const out = pData.?[0..@intCast(need)];
+            var n = c.decryptUpdate(in, out);
+            n += c.decryptFinal(out[n..]) catch |e| {
+                sess.endDecrypt(inst.allocator());
+                return mapCipherErr(e);
+            };
+            pulDataLen.* = @intCast(n);
+            sess.endDecrypt(inst.allocator());
+            return ck.CKR_OK;
+        },
+        .gcm => |*g| {
+            const need: ck.CK_ULONG = @intCast(cipher.decryptOutLen(.gcm, in.len));
+            if (pData == null) {
+                pulDataLen.* = need;
+                return ck.CKR_OK;
+            }
+            if (pulDataLen.* < need) {
+                pulDataLen.* = need;
+                return ck.CKR_BUFFER_TOO_SMALL;
+            }
+            const n = g.cipher.gcmDecrypt(in, pData.?[0..@intCast(need)]) catch |e| {
+                sess.endDecrypt(inst.allocator());
+                return mapCipherErr(e);
+            };
+            pulDataLen.* = @intCast(n);
+            sess.endDecrypt(inst.allocator());
+            return ck.CKR_OK;
+        },
+        .rsa => |*r| {
+            const need: ck.CK_ULONG = @intCast(r.out_len);
+            if (pData == null) {
+                pulDataLen.* = need;
+                return ck.CKR_OK;
+            }
+            if (pulDataLen.* < need) {
+                pulDataLen.* = need;
+                return ck.CKR_BUFFER_TOO_SMALL;
+            }
+            const sc = switch (rsaPrivateComponents(inst, r.key, ck.CKA_DECRYPT)) {
+                .err => |rv| {
+                    sess.endDecrypt(inst.allocator());
+                    return rv;
+                },
+                .ok => |c| c,
+            };
+            const n = rsa.decrypt(sc, r.params, in, pData.?[0..@intCast(need)]) catch {
+                sess.endDecrypt(inst.allocator());
+                return ck.CKR_ENCRYPTED_DATA_INVALID;
+            };
+            pulDataLen.* = @intCast(n);
+            sess.endDecrypt(inst.allocator());
+            return ck.CKR_OK;
+        },
+    }
+}
+
+pub fn C_DecryptUpdate(hSession: ck.CK_SESSION_HANDLE, pEncryptedPart: [*]ck.CK_BYTE, ulEncryptedPartLen: ck.CK_ULONG, pPart: ?[*]ck.CK_BYTE, pulPartLen: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    const op = if (sess.decrypt_op) |*o| o else return ck.CKR_OPERATION_NOT_INITIALIZED;
+    const in = part(pEncryptedPart, ulEncryptedPartLen);
+    const need = switch (decUpdateNeed(op, in.len)) {
+        .err => |rv| return rv,
+        .ok => |n| n,
+    };
+    if (pPart == null) {
+        pulPartLen.* = need;
+        return ck.CKR_OK;
+    }
+    if (pulPartLen.* < need) {
+        pulPartLen.* = need;
+        return ck.CKR_BUFFER_TOO_SMALL;
+    }
+    const wrote = switch (decUpdateEmit(inst, op, in, pPart.?[0..@intCast(need)])) {
+        .err => |rv| {
+            sess.endDecrypt(inst.allocator());
+            return rv;
+        },
+        .ok => |n| n,
+    };
+    pulPartLen.* = @intCast(wrote);
+    return ck.CKR_OK;
+}
+
+pub fn C_DecryptFinal(hSession: ck.CK_SESSION_HANDLE, pLastPart: ?[*]ck.CK_BYTE, pulLastPartLen: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    const op = if (sess.decrypt_op) |*o| o else return ck.CKR_OPERATION_NOT_INITIALIZED;
+    switch (op.*) {
+        .rsa => return ck.CKR_FUNCTION_NOT_SUPPORTED,
+        .aes => |*c| {
+            const need: ck.CK_ULONG = if (c.mode == .cbc_pad) config.aes_block_len else 0;
+            if (pLastPart == null) {
+                pulLastPartLen.* = need;
+                return ck.CKR_OK;
+            }
+            if (pulLastPartLen.* < need) {
+                pulLastPartLen.* = need;
+                return ck.CKR_BUFFER_TOO_SMALL;
+            }
+            const n = c.decryptFinal(pLastPart.?[0..@intCast(need)]) catch |e| {
+                sess.endDecrypt(inst.allocator());
+                return mapCipherErr(e);
+            };
+            pulLastPartLen.* = @intCast(n);
+            sess.endDecrypt(inst.allocator());
+            return ck.CKR_OK;
+        },
+        .gcm => |*g| {
+            const need: ck.CK_ULONG = @intCast(cipher.decryptOutLen(.gcm, g.len));
+            if (pLastPart == null) {
+                pulLastPartLen.* = need;
+                return ck.CKR_OK;
+            }
+            if (pulLastPartLen.* < need) {
+                pulLastPartLen.* = need;
+                return ck.CKR_BUFFER_TOO_SMALL;
+            }
+            const n = g.cipher.gcmDecrypt(g.data(), pLastPart.?[0..@intCast(need)]) catch |e| {
+                sess.endDecrypt(inst.allocator());
+                return mapCipherErr(e);
+            };
+            pulLastPartLen.* = @intCast(n);
+            sess.endDecrypt(inst.allocator());
+            return ck.CKR_OK;
+        },
+    }
+}
+
+pub fn C_DigestInit(hSession: ck.CK_SESSION_HANDLE, pMechanism: *ck.CK_MECHANISM) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.digest_op != null) return ck.CKR_OPERATION_ACTIVE;
+    sess.digest_op = digest.Hasher.init(pMechanism.mechanism) orelse return ck.CKR_MECHANISM_INVALID;
+    return ck.CKR_OK;
+}
+
+pub fn C_Digest(hSession: ck.CK_SESSION_HANDLE, pData: [*]ck.CK_BYTE, ulDataLen: ck.CK_ULONG, pDigest: ?[*]ck.CK_BYTE, pulDigestLen: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.digest_op == null) return ck.CKR_OPERATION_NOT_INITIALIZED;
+    const dlen: ck.CK_ULONG = @intCast(sess.digest_op.?.digestLen());
+    if (pDigest == null) {
+        pulDigestLen.* = dlen;
+        return ck.CKR_OK;
+    }
+    if (pulDigestLen.* < dlen) {
+        pulDigestLen.* = dlen;
+        return ck.CKR_BUFFER_TOO_SMALL;
+    }
+    sess.digest_op.?.update(part(pData, ulDataLen));
+    return emitDigest(sess, pDigest, pulDigestLen);
+}
+
+pub fn C_DigestUpdate(hSession: ck.CK_SESSION_HANDLE, pPart: [*]ck.CK_BYTE, ulPartLen: ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.digest_op == null) return ck.CKR_OPERATION_NOT_INITIALIZED;
+    sess.digest_op.?.update(part(pPart, ulPartLen));
+    return ck.CKR_OK;
+}
+
+pub fn C_DigestKey(hSession: ck.CK_SESSION_HANDLE, hKey: ck.CK_OBJECT_HANDLE) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.digest_op == null) return ck.CKR_OPERATION_NOT_INITIALIZED;
+    const obj = inst.objects.getPtr(hKey) orelse return ck.CKR_KEY_HANDLE_INVALID;
+    if (!object_store.visible(obj, inst.logged_in)) return ck.CKR_KEY_HANDLE_INVALID;
+    if (objectClass(obj) != ck.CKO_SECRET_KEY) return ck.CKR_KEY_INDIGESTIBLE;
+    const sa = obj.findPtr(ck.CKA_VALUE) orelse return ck.CKR_KEY_INDIGESTIBLE;
+    if (sa.sealed) return ck.CKR_USER_NOT_LOGGED_IN;
+    sess.digest_op.?.update(sa.value);
+    return ck.CKR_OK;
+}
+
+pub fn C_DigestFinal(hSession: ck.CK_SESSION_HANDLE, pDigest: ?[*]ck.CK_BYTE, pulDigestLen: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.digest_op == null) return ck.CKR_OPERATION_NOT_INITIALIZED;
+    return emitDigest(sess, pDigest, pulDigestLen);
+}
+
+pub fn C_SignInit(hSession: ck.CK_SESSION_HANDLE, pMechanism: *ck.CK_MECHANISM, hKey: ck.CK_OBJECT_HANDLE) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.sign_op != null) return ck.CKR_OPERATION_ACTIVE;
+    sess.sign_op = switch (signInitOp(inst, hKey, pMechanism)) {
+        .err => |rv| return rv,
+        .ok => |op| op,
+    };
+    return ck.CKR_OK;
+}
+
+pub fn C_Sign(hSession: ck.CK_SESSION_HANDLE, pData: [*]ck.CK_BYTE, ulDataLen: ck.CK_ULONG, pSignature: ?[*]ck.CK_BYTE, pulSignatureLen: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.sign_op == null) return ck.CKR_OPERATION_NOT_INITIALIZED;
+    const slen = signLen(&sess.sign_op.?);
+    if (pSignature == null) {
+        pulSignatureLen.* = slen;
+        return ck.CKR_OK;
+    }
+    if (pulSignatureLen.* < slen) {
+        pulSignatureLen.* = slen;
+        return ck.CKR_BUFFER_TOO_SMALL;
+    }
+    switch (sess.sign_op.?) {
+        .rsa => |op| {
+            const out = pSignature.?[0..@intCast(slen)];
+            const sc = switch (rsaPrivateComponents(inst, op.key, ck.CKA_SIGN)) {
+                .err => |rv| {
+                    sess.endSign();
+                    return rv;
+                },
+                .ok => |c| c,
+            };
+            const n = rsa.sign(sc, op.params, part(pData, ulDataLen), out) catch {
+                sess.endSign();
+                return ck.CKR_FUNCTION_FAILED;
+            };
+            pulSignatureLen.* = @intCast(n);
+            sess.endSign();
+            return ck.CKR_OK;
+        },
+        else => {
+            sess.sign_op.?.update(part(pData, ulDataLen));
+            return emitSign(inst, sess, pSignature, pulSignatureLen);
+        },
+    }
+}
+
+pub fn C_SignUpdate(hSession: ck.CK_SESSION_HANDLE, pPart: [*]ck.CK_BYTE, ulPartLen: ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.sign_op == null) return ck.CKR_OPERATION_NOT_INITIALIZED;
+    switch (sess.sign_op.?) {
+        .rsa => return ck.CKR_FUNCTION_NOT_SUPPORTED,
+        else => {},
+    }
+    sess.sign_op.?.update(part(pPart, ulPartLen));
+    return ck.CKR_OK;
+}
+
+pub fn C_SignFinal(hSession: ck.CK_SESSION_HANDLE, pSignature: ?[*]ck.CK_BYTE, pulSignatureLen: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.sign_op == null) return ck.CKR_OPERATION_NOT_INITIALIZED;
+    switch (sess.sign_op.?) {
+        .rsa => return ck.CKR_FUNCTION_NOT_SUPPORTED,
+        else => {},
+    }
+    return emitSign(inst, sess, pSignature, pulSignatureLen);
+}
+
+pub fn C_SignRecoverInit(hSession: ck.CK_SESSION_HANDLE, pMechanism: *ck.CK_MECHANISM, hKey: ck.CK_OBJECT_HANDLE) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.sign_recover_op != null) return ck.CKR_OPERATION_ACTIVE;
+    if (pMechanism.mechanism != ck.CKM_RSA_PKCS) return ck.CKR_MECHANISM_INVALID;
+    const pc = switch (rsaPrivateComponents(inst, hKey, ck.CKA_SIGN_RECOVER)) {
+        .err => |rv| return rv,
+        .ok => |c| c,
+    };
+    sess.sign_recover_op = .{ .key = hKey, .out_len = pc.n.len };
+    return ck.CKR_OK;
+}
+
+pub fn C_SignRecover(hSession: ck.CK_SESSION_HANDLE, pData: [*]ck.CK_BYTE, ulDataLen: ck.CK_ULONG, pSignature: ?[*]ck.CK_BYTE, pulSignatureLen: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    const op = if (sess.sign_recover_op) |o| o else return ck.CKR_OPERATION_NOT_INITIALIZED;
+    const need: ck.CK_ULONG = @intCast(op.out_len);
+    if (pSignature == null) {
+        pulSignatureLen.* = need;
+        return ck.CKR_OK;
+    }
+    if (pulSignatureLen.* < need) {
+        pulSignatureLen.* = need;
+        return ck.CKR_BUFFER_TOO_SMALL;
+    }
+    const in = part(pData, ulDataLen);
+    if (in.len + rsa.pkcs1_v15_min_overhead > op.out_len) {
+        sess.endSignRecover();
+        return ck.CKR_DATA_LEN_RANGE;
+    }
+    const sc = switch (rsaPrivateComponents(inst, op.key, ck.CKA_SIGN_RECOVER)) {
+        .err => |rv| {
+            sess.endSignRecover();
+            return rv;
+        },
+        .ok => |c| c,
+    };
+    const n = rsa.sign(sc, .{ .scheme = .pkcs1, .digest = .none }, in, pSignature.?[0..@intCast(need)]) catch {
+        sess.endSignRecover();
+        return ck.CKR_FUNCTION_FAILED;
+    };
+    pulSignatureLen.* = @intCast(n);
+    sess.endSignRecover();
+    return ck.CKR_OK;
+}
+
+pub fn C_VerifyInit(hSession: ck.CK_SESSION_HANDLE, pMechanism: *ck.CK_MECHANISM, hKey: ck.CK_OBJECT_HANDLE) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.verify_op != null) return ck.CKR_OPERATION_ACTIVE;
+    sess.verify_op = switch (verifyInitOp(inst, hKey, pMechanism)) {
+        .err => |rv| return rv,
+        .ok => |op| op,
+    };
+    return ck.CKR_OK;
+}
+
+pub fn C_Verify(hSession: ck.CK_SESSION_HANDLE, pData: [*]ck.CK_BYTE, ulDataLen: ck.CK_ULONG, pSignature: [*]ck.CK_BYTE, ulSignatureLen: ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.verify_op == null) return ck.CKR_OPERATION_NOT_INITIALIZED;
+    switch (sess.verify_op.?) {
+        .rsa => |op| {
+            const data = part(pData, ulDataLen);
+            sess.endVerify();
+            if (ulSignatureLen != op.sig_len) return ck.CKR_SIGNATURE_LEN_RANGE;
+            const pc = switch (rsaPublicComponents(inst, op.key, ck.CKA_VERIFY)) {
+                .err => |rv| return rv,
+                .ok => |c| c,
+            };
+            const r = rsa.verify(pc, op.params, data, pSignature[0..@intCast(ulSignatureLen)]) catch return ck.CKR_FUNCTION_FAILED;
+            return switch (r) {
+                .ok => ck.CKR_OK,
+                .invalid => ck.CKR_SIGNATURE_INVALID,
+            };
+        },
+        else => {
+            sess.verify_op.?.update(part(pData, ulDataLen));
+            return finalizeVerify(sess, pSignature, ulSignatureLen);
+        },
+    }
+}
+
+pub fn C_VerifyUpdate(hSession: ck.CK_SESSION_HANDLE, pPart: [*]ck.CK_BYTE, ulPartLen: ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.verify_op == null) return ck.CKR_OPERATION_NOT_INITIALIZED;
+    switch (sess.verify_op.?) {
+        .rsa => return ck.CKR_FUNCTION_NOT_SUPPORTED,
+        else => {},
+    }
+    sess.verify_op.?.update(part(pPart, ulPartLen));
+    return ck.CKR_OK;
+}
+
+pub fn C_VerifyFinal(hSession: ck.CK_SESSION_HANDLE, pSignature: [*]ck.CK_BYTE, ulSignatureLen: ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.verify_op == null) return ck.CKR_OPERATION_NOT_INITIALIZED;
+    switch (sess.verify_op.?) {
+        .rsa => return ck.CKR_FUNCTION_NOT_SUPPORTED,
+        else => {},
+    }
+    return finalizeVerify(sess, pSignature, ulSignatureLen);
+}
+
+pub fn C_VerifyRecoverInit(hSession: ck.CK_SESSION_HANDLE, pMechanism: *ck.CK_MECHANISM, hKey: ck.CK_OBJECT_HANDLE) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.verify_recover_op != null) return ck.CKR_OPERATION_ACTIVE;
+    if (pMechanism.mechanism != ck.CKM_RSA_PKCS) return ck.CKR_MECHANISM_INVALID;
+    const pc = switch (rsaPublicComponents(inst, hKey, ck.CKA_VERIFY_RECOVER)) {
+        .err => |rv| return rv,
+        .ok => |c| c,
+    };
+    sess.verify_recover_op = .{ .key = hKey, .out_len = pc.n.len };
+    return ck.CKR_OK;
+}
+
+pub fn C_VerifyRecover(hSession: ck.CK_SESSION_HANDLE, pSignature: [*]ck.CK_BYTE, ulSignatureLen: ck.CK_ULONG, pData: ?[*]ck.CK_BYTE, pulDataLen: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    const op = if (sess.verify_recover_op) |o| o else return ck.CKR_OPERATION_NOT_INITIALIZED;
+    if (pData == null) {
+        pulDataLen.* = @intCast(op.out_len);
+        return ck.CKR_OK;
+    }
+    if (ulSignatureLen != op.out_len) {
+        sess.endVerifyRecover();
+        return ck.CKR_SIGNATURE_LEN_RANGE;
+    }
+    const pc = switch (rsaPublicComponents(inst, op.key, ck.CKA_VERIFY_RECOVER)) {
+        .err => |rv| {
+            sess.endVerifyRecover();
+            return rv;
+        },
+        .ok => |c| c,
+    };
+    var tmp: [rsa.max_modulus_bytes]u8 = undefined;
+    defer std.crypto.secureZero(u8, &tmp);
+    const m = rsa.recover(pc, part(pSignature, ulSignatureLen), &tmp) catch {
+        sess.endVerifyRecover();
+        return ck.CKR_SIGNATURE_INVALID;
+    };
+    if (pulDataLen.* < m) {
+        pulDataLen.* = @intCast(m);
+        return ck.CKR_BUFFER_TOO_SMALL;
+    }
+    @memcpy(pData.?[0..m], tmp[0..m]);
+    pulDataLen.* = @intCast(m);
+    sess.endVerifyRecover();
+    return ck.CKR_OK;
+}
+
+pub fn C_DigestEncryptUpdate(hSession: ck.CK_SESSION_HANDLE, pPart: [*]ck.CK_BYTE, ulPartLen: ck.CK_ULONG, pEncryptedPart: ?[*]ck.CK_BYTE, pulEncryptedPartLen: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.digest_op == null or sess.encrypt_op == null) return ck.CKR_OPERATION_NOT_INITIALIZED;
+    const op = &sess.encrypt_op.?;
+    const in = part(pPart, ulPartLen);
+    const need = switch (encUpdateNeed(op, in.len)) {
+        .err => |rv| return rv,
+        .ok => |n| n,
+    };
+    if (pEncryptedPart == null) {
+        pulEncryptedPartLen.* = need;
+        return ck.CKR_OK;
+    }
+    if (pulEncryptedPartLen.* < need) {
+        pulEncryptedPartLen.* = need;
+        return ck.CKR_BUFFER_TOO_SMALL;
+    }
+    sess.digest_op.?.update(in);
+    const wrote = switch (encUpdateEmit(inst, op, in, pEncryptedPart.?[0..@intCast(need)])) {
+        .err => |rv| {
+            sess.endEncrypt(inst.allocator());
+            return rv;
+        },
+        .ok => |n| n,
+    };
+    pulEncryptedPartLen.* = @intCast(wrote);
+    return ck.CKR_OK;
+}
+
+pub fn C_DecryptDigestUpdate(hSession: ck.CK_SESSION_HANDLE, pEncryptedPart: [*]ck.CK_BYTE, ulEncryptedPartLen: ck.CK_ULONG, pPart: ?[*]ck.CK_BYTE, pulPartLen: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.decrypt_op == null or sess.digest_op == null) return ck.CKR_OPERATION_NOT_INITIALIZED;
+    const op = &sess.decrypt_op.?;
+    if (!decryptSideDualOk(op)) return ck.CKR_FUNCTION_NOT_SUPPORTED;
+    const in = part(pEncryptedPart, ulEncryptedPartLen);
+    const need = switch (decUpdateNeed(op, in.len)) {
+        .err => |rv| return rv,
+        .ok => |n| n,
+    };
+    if (pPart == null) {
+        pulPartLen.* = need;
+        return ck.CKR_OK;
+    }
+    if (pulPartLen.* < need) {
+        pulPartLen.* = need;
+        return ck.CKR_BUFFER_TOO_SMALL;
+    }
+    const out = pPart.?[0..@intCast(need)];
+    const wrote = switch (decUpdateEmit(inst, op, in, out)) {
+        .err => |rv| {
+            sess.endDecrypt(inst.allocator());
+            return rv;
+        },
+        .ok => |n| n,
+    };
+    sess.digest_op.?.update(out[0..wrote]);
+    pulPartLen.* = @intCast(wrote);
+    return ck.CKR_OK;
+}
+
+pub fn C_SignEncryptUpdate(hSession: ck.CK_SESSION_HANDLE, pPart: [*]ck.CK_BYTE, ulPartLen: ck.CK_ULONG, pEncryptedPart: ?[*]ck.CK_BYTE, pulEncryptedPartLen: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.sign_op == null or sess.encrypt_op == null) return ck.CKR_OPERATION_NOT_INITIALIZED;
+    switch (sess.sign_op.?) {
+        .rsa => return ck.CKR_FUNCTION_NOT_SUPPORTED,
+        else => {},
+    }
+    const op = &sess.encrypt_op.?;
+    const in = part(pPart, ulPartLen);
+    const need = switch (encUpdateNeed(op, in.len)) {
+        .err => |rv| return rv,
+        .ok => |n| n,
+    };
+    if (pEncryptedPart == null) {
+        pulEncryptedPartLen.* = need;
+        return ck.CKR_OK;
+    }
+    if (pulEncryptedPartLen.* < need) {
+        pulEncryptedPartLen.* = need;
+        return ck.CKR_BUFFER_TOO_SMALL;
+    }
+    sess.sign_op.?.update(in);
+    const wrote = switch (encUpdateEmit(inst, op, in, pEncryptedPart.?[0..@intCast(need)])) {
+        .err => |rv| {
+            sess.endEncrypt(inst.allocator());
+            return rv;
+        },
+        .ok => |n| n,
+    };
+    pulEncryptedPartLen.* = @intCast(wrote);
+    return ck.CKR_OK;
+}
+
+pub fn C_DecryptVerifyUpdate(hSession: ck.CK_SESSION_HANDLE, pEncryptedPart: [*]ck.CK_BYTE, ulEncryptedPartLen: ck.CK_ULONG, pPart: ?[*]ck.CK_BYTE, pulPartLen: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.decrypt_op == null or sess.verify_op == null) return ck.CKR_OPERATION_NOT_INITIALIZED;
+    const op = &sess.decrypt_op.?;
+    if (!decryptSideDualOk(op)) return ck.CKR_FUNCTION_NOT_SUPPORTED;
+    switch (sess.verify_op.?) {
+        .rsa => return ck.CKR_FUNCTION_NOT_SUPPORTED,
+        else => {},
+    }
+    const in = part(pEncryptedPart, ulEncryptedPartLen);
+    const need = switch (decUpdateNeed(op, in.len)) {
+        .err => |rv| return rv,
+        .ok => |n| n,
+    };
+    if (pPart == null) {
+        pulPartLen.* = need;
+        return ck.CKR_OK;
+    }
+    if (pulPartLen.* < need) {
+        pulPartLen.* = need;
+        return ck.CKR_BUFFER_TOO_SMALL;
+    }
+    const out = pPart.?[0..@intCast(need)];
+    const wrote = switch (decUpdateEmit(inst, op, in, out)) {
+        .err => |rv| {
+            sess.endDecrypt(inst.allocator());
+            return rv;
+        },
+        .ok => |n| n,
+    };
+    sess.verify_op.?.update(out[0..wrote]);
+    pulPartLen.* = @intCast(wrote);
+    return ck.CKR_OK;
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/api/general.zig b/PROJECTS/advanced/hsm-emulator/src/api/general.zig
new file mode 100644
index 00000000..145b2081
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/api/general.zig
@@ -0,0 +1,53 @@
+// ©AngelaMos | 2026
+// general.zig
+
+const ck = @import("../ck.zig");
+const config = @import("../config.zig");
+const util = @import("../util.zig");
+const state = @import("../core/state.zig");
+
+pub fn C_Initialize(pInitArgs: ?*anyopaque) callconv(.c) ck.CK_RV {
+    state.mutex.lock();
+    defer state.mutex.unlock();
+    if (state.isInitialized()) return ck.CKR_CRYPTOKI_ALREADY_INITIALIZED;
+    switch (state.parseInitArgs(pInitArgs)) {
+        .err => |rv| return rv,
+        .ok => |locking| state.initialize(locking),
+    }
+    return ck.CKR_OK;
+}
+
+pub fn C_Finalize(pReserved: ?*anyopaque) callconv(.c) ck.CK_RV {
+    if (pReserved != null) return ck.CKR_ARGUMENTS_BAD;
+    return state.finalize();
+}
+
+pub fn C_GetInfo(pInfo: *ck.CK_INFO) callconv(.c) ck.CK_RV {
+    state.mutex.lock();
+    defer state.mutex.unlock();
+    if (!state.isInitialized()) return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    pInfo.* = .{
+        .cryptokiVersion = config.cryptoki_version,
+        .manufacturerID = util.padded(32, config.manufacturer_id),
+        .flags = 0,
+        .libraryDescription = util.padded(32, config.library_description),
+        .libraryVersion = config.library_version,
+    };
+    return ck.CKR_OK;
+}
+
+pub fn C_GetFunctionStatus(_: ck.CK_SESSION_HANDLE) callconv(.c) ck.CK_RV {
+    return ck.CKR_FUNCTION_NOT_PARALLEL;
+}
+
+pub fn C_CancelFunction(_: ck.CK_SESSION_HANDLE) callconv(.c) ck.CK_RV {
+    return ck.CKR_FUNCTION_NOT_PARALLEL;
+}
+
+pub fn C_WaitForSlotEvent(flags: ck.CK_FLAGS, pSlot: *ck.CK_SLOT_ID, pReserved: ?*anyopaque) callconv(.c) ck.CK_RV {
+    _ = pSlot;
+    if (!state.isInitialized()) return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    if (pReserved != null) return ck.CKR_ARGUMENTS_BAD;
+    if ((flags & ck.CKF_DONT_BLOCK) != 0) return ck.CKR_NO_EVENT;
+    return ck.CKR_FUNCTION_NOT_SUPPORTED;
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/api/keymgmt.zig b/PROJECTS/advanced/hsm-emulator/src/api/keymgmt.zig
new file mode 100644
index 00000000..9b531ad5
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/api/keymgmt.zig
@@ -0,0 +1,546 @@
+// ©AngelaMos | 2026
+// keymgmt.zig
+
+const std = @import("std");
+const ck = @import("../ck.zig");
+const config = @import("../config.zig");
+const state = @import("../core/state.zig");
+const session = @import("../core/session.zig");
+const object_store = @import("../core/object_store.zig");
+const object = @import("object.zig");
+const ecdsa = @import("../crypto/ecdsa.zig");
+const rsa = @import("../crypto/rsa.zig");
+const cipher = @import("../crypto/cipher.zig");
+
+const Object = object_store.Object;
+
+fn attrBytes(a: ck.CK_ATTRIBUTE) []const u8 {
+    const ptr = a.pValue orelse return &.{};
+    return @as([*]const u8, @ptrCast(ptr))[0..@intCast(a.ulValueLen)];
+}
+
+fn ulongFrom(bytes: []const u8) ?ck.CK_ULONG {
+    if (bytes.len != @sizeOf(ck.CK_ULONG)) return null;
+    return std.mem.bytesToValue(ck.CK_ULONG, bytes[0..@sizeOf(ck.CK_ULONG)]);
+}
+
+pub fn C_GenerateKey(hSession: ck.CK_SESSION_HANDLE, pMechanism: *ck.CK_MECHANISM, pTemplate: [*]ck.CK_ATTRIBUTE, ulCount: ck.CK_ULONG, phKey: *ck.CK_OBJECT_HANDLE) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (pMechanism.mechanism != ck.CKM_AES_KEY_GEN) return ck.CKR_MECHANISM_INVALID;
+
+    const allocator = inst.allocator();
+    const template = if (ulCount == 0) &[_]ck.CK_ATTRIBUTE{} else pTemplate[0..@intCast(ulCount)];
+
+    var key_len: usize = 0;
+    var have_len = false;
+    for (template) |a| {
+        if (a.type == ck.CKA_VALUE_LEN) {
+            const v = ulongFrom(attrBytes(a)) orelse return ck.CKR_ATTRIBUTE_VALUE_INVALID;
+            key_len = @intCast(v);
+            have_len = true;
+        }
+    }
+    if (!have_len) return ck.CKR_TEMPLATE_INCOMPLETE;
+    if (key_len != config.aes_min_key_bytes and key_len != config.aes_max_key_bytes) return ck.CKR_KEY_SIZE_RANGE;
+
+    var obj: Object = .{};
+    var moved = false;
+    defer if (!moved) obj.deinit(allocator);
+
+    for (template) |a| {
+        obj.set(allocator, a.type, attrBytes(a)) catch |e| return object_store.mapSetErr(e);
+    }
+
+    var key_bytes: [32]u8 = undefined;
+    defer std.crypto.secureZero(u8, &key_bytes);
+    inst.io().randomSecure(key_bytes[0..key_len]) catch return ck.CKR_FUNCTION_FAILED;
+
+    var class_val: ck.CK_OBJECT_CLASS = ck.CKO_SECRET_KEY;
+    var type_val: ck.CK_KEY_TYPE = ck.CKK_AES;
+    obj.set(allocator, ck.CKA_CLASS, std.mem.asBytes(&class_val)) catch |e| return object_store.mapSetErr(e);
+    obj.set(allocator, ck.CKA_KEY_TYPE, std.mem.asBytes(&type_val)) catch |e| return object_store.mapSetErr(e);
+    obj.set(allocator, ck.CKA_VALUE, key_bytes[0..key_len]) catch |e| return object_store.mapSetErr(e);
+    obj.set(allocator, ck.CKA_LOCAL, &[_]u8{ck.CK_TRUE}) catch |e| return object_store.mapSetErr(e);
+    const kgm: ck.CK_MECHANISM_TYPE = ck.CKM_AES_KEY_GEN;
+    obj.set(allocator, ck.CKA_KEY_GEN_MECHANISM, std.mem.asBytes(&kgm)) catch |e| return object_store.mapSetErr(e);
+
+    if (!obj.has(ck.CKA_SENSITIVE)) obj.set(allocator, ck.CKA_SENSITIVE, &[_]u8{ck.CK_TRUE}) catch |e| return object_store.mapSetErr(e);
+    if (!obj.has(ck.CKA_EXTRACTABLE)) obj.set(allocator, ck.CKA_EXTRACTABLE, &[_]u8{ck.CK_FALSE}) catch |e| return object_store.mapSetErr(e);
+    const always_sensitive: u8 = if (obj.getBool(ck.CKA_SENSITIVE)) ck.CK_TRUE else ck.CK_FALSE;
+    const never_extractable: u8 = if (!obj.getBool(ck.CKA_EXTRACTABLE)) ck.CK_TRUE else ck.CK_FALSE;
+    obj.set(allocator, ck.CKA_ALWAYS_SENSITIVE, &[_]u8{always_sensitive}) catch |e| return object_store.mapSetErr(e);
+    obj.set(allocator, ck.CKA_NEVER_EXTRACTABLE, &[_]u8{never_extractable}) catch |e| return object_store.mapSetErr(e);
+
+    object.materializeDefaults(&obj, allocator, ck.CKO_SECRET_KEY) catch |e| return object_store.mapSetErr(e);
+
+    moved = true;
+    return object.insertNew(inst, sess, obj, phKey);
+}
+
+fn ecParamsFrom(template: []const ck.CK_ATTRIBUTE) ?[]const u8 {
+    for (template) |a| {
+        if (a.type == ck.CKA_EC_PARAMS) return attrBytes(a);
+    }
+    return null;
+}
+
+fn modulusBitsFrom(template: []const ck.CK_ATTRIBUTE) ?ck.CK_ULONG {
+    for (template) |a| {
+        if (a.type == ck.CKA_MODULUS_BITS) return ulongFrom(attrBytes(a));
+    }
+    return null;
+}
+
+fn applySensitivityDefaults(obj: *Object, allocator: std.mem.Allocator, kgm: ck.CK_MECHANISM_TYPE) !void {
+    try obj.set(allocator, ck.CKA_LOCAL, &[_]u8{ck.CK_TRUE});
+    if (!obj.has(ck.CKA_SENSITIVE)) try obj.set(allocator, ck.CKA_SENSITIVE, &[_]u8{ck.CK_TRUE});
+    if (!obj.has(ck.CKA_EXTRACTABLE)) try obj.set(allocator, ck.CKA_EXTRACTABLE, &[_]u8{ck.CK_FALSE});
+    const always_sensitive: u8 = if (obj.getBool(ck.CKA_SENSITIVE)) ck.CK_TRUE else ck.CK_FALSE;
+    const never_extractable: u8 = if (!obj.getBool(ck.CKA_EXTRACTABLE)) ck.CK_TRUE else ck.CK_FALSE;
+    try obj.set(allocator, ck.CKA_ALWAYS_SENSITIVE, &[_]u8{always_sensitive});
+    try obj.set(allocator, ck.CKA_NEVER_EXTRACTABLE, &[_]u8{never_extractable});
+    const m: ck.CK_MECHANISM_TYPE = kgm;
+    try obj.set(allocator, ck.CKA_KEY_GEN_MECHANISM, std.mem.asBytes(&m));
+}
+
+fn buildEcPublic(obj: *Object, allocator: std.mem.Allocator, template: []const ck.CK_ATTRIBUTE, curve: ecdsa.Curve, point: []const u8) !void {
+    for (template) |a| try obj.set(allocator, a.type, attrBytes(a));
+    const class_val: ck.CK_OBJECT_CLASS = ck.CKO_PUBLIC_KEY;
+    const type_val: ck.CK_KEY_TYPE = ck.CKK_EC;
+    try obj.set(allocator, ck.CKA_CLASS, std.mem.asBytes(&class_val));
+    try obj.set(allocator, ck.CKA_KEY_TYPE, std.mem.asBytes(&type_val));
+    try obj.set(allocator, ck.CKA_EC_PARAMS, curve.oidDer());
+    var der_buf: [ecdsa.max_ec_point_der]u8 = undefined;
+    try obj.set(allocator, ck.CKA_EC_POINT, ecdsa.wrapEcPoint(&der_buf, point));
+    try obj.set(allocator, ck.CKA_LOCAL, &[_]u8{ck.CK_TRUE});
+    const kgm: ck.CK_MECHANISM_TYPE = ck.CKM_EC_KEY_PAIR_GEN;
+    try obj.set(allocator, ck.CKA_KEY_GEN_MECHANISM, std.mem.asBytes(&kgm));
+    try object.materializeDefaults(obj, allocator, ck.CKO_PUBLIC_KEY);
+}
+
+fn buildEcPrivate(obj: *Object, allocator: std.mem.Allocator, template: []const ck.CK_ATTRIBUTE, curve: ecdsa.Curve, scalar: []const u8) !void {
+    for (template) |a| try obj.set(allocator, a.type, attrBytes(a));
+    const class_val: ck.CK_OBJECT_CLASS = ck.CKO_PRIVATE_KEY;
+    const type_val: ck.CK_KEY_TYPE = ck.CKK_EC;
+    try obj.set(allocator, ck.CKA_CLASS, std.mem.asBytes(&class_val));
+    try obj.set(allocator, ck.CKA_KEY_TYPE, std.mem.asBytes(&type_val));
+    try obj.set(allocator, ck.CKA_EC_PARAMS, curve.oidDer());
+    try obj.set(allocator, ck.CKA_VALUE, scalar);
+    try applySensitivityDefaults(obj, allocator, ck.CKM_EC_KEY_PAIR_GEN);
+    try object.materializeDefaults(obj, allocator, ck.CKO_PRIVATE_KEY);
+}
+
+fn buildRsaPublic(obj: *Object, allocator: std.mem.Allocator, template: []const ck.CK_ATTRIBUTE, g: *const rsa.Generated) !void {
+    for (template) |a| try obj.set(allocator, a.type, attrBytes(a));
+    const class_val: ck.CK_OBJECT_CLASS = ck.CKO_PUBLIC_KEY;
+    const type_val: ck.CK_KEY_TYPE = ck.CKK_RSA;
+    const bits: ck.CK_ULONG = g.bits;
+    try obj.set(allocator, ck.CKA_CLASS, std.mem.asBytes(&class_val));
+    try obj.set(allocator, ck.CKA_KEY_TYPE, std.mem.asBytes(&type_val));
+    try obj.set(allocator, ck.CKA_MODULUS, g.n.slice());
+    try obj.set(allocator, ck.CKA_PUBLIC_EXPONENT, g.e.slice());
+    try obj.set(allocator, ck.CKA_MODULUS_BITS, std.mem.asBytes(&bits));
+    try obj.set(allocator, ck.CKA_LOCAL, &[_]u8{ck.CK_TRUE});
+    const kgm: ck.CK_MECHANISM_TYPE = ck.CKM_RSA_PKCS_KEY_PAIR_GEN;
+    try obj.set(allocator, ck.CKA_KEY_GEN_MECHANISM, std.mem.asBytes(&kgm));
+    try object.materializeDefaults(obj, allocator, ck.CKO_PUBLIC_KEY);
+}
+
+fn buildRsaPrivate(obj: *Object, allocator: std.mem.Allocator, template: []const ck.CK_ATTRIBUTE, g: *const rsa.Generated) !void {
+    for (template) |a| try obj.set(allocator, a.type, attrBytes(a));
+    const class_val: ck.CK_OBJECT_CLASS = ck.CKO_PRIVATE_KEY;
+    const type_val: ck.CK_KEY_TYPE = ck.CKK_RSA;
+    try obj.set(allocator, ck.CKA_CLASS, std.mem.asBytes(&class_val));
+    try obj.set(allocator, ck.CKA_KEY_TYPE, std.mem.asBytes(&type_val));
+    try obj.set(allocator, ck.CKA_MODULUS, g.n.slice());
+    try obj.set(allocator, ck.CKA_PUBLIC_EXPONENT, g.e.slice());
+    try obj.set(allocator, ck.CKA_PRIVATE_EXPONENT, g.d.slice());
+    try obj.set(allocator, ck.CKA_PRIME_1, g.p.slice());
+    try obj.set(allocator, ck.CKA_PRIME_2, g.q.slice());
+    try obj.set(allocator, ck.CKA_EXPONENT_1, g.dmp1.slice());
+    try obj.set(allocator, ck.CKA_EXPONENT_2, g.dmq1.slice());
+    try obj.set(allocator, ck.CKA_COEFFICIENT, g.iqmp.slice());
+    try applySensitivityDefaults(obj, allocator, ck.CKM_RSA_PKCS_KEY_PAIR_GEN);
+    try object.materializeDefaults(obj, allocator, ck.CKO_PRIVATE_KEY);
+}
+
+pub fn C_GenerateKeyPair(hSession: ck.CK_SESSION_HANDLE, pMechanism: *ck.CK_MECHANISM, pPublicKeyTemplate: [*]ck.CK_ATTRIBUTE, ulPublicKeyAttributeCount: ck.CK_ULONG, pPrivateKeyTemplate: [*]ck.CK_ATTRIBUTE, ulPrivateKeyAttributeCount: ck.CK_ULONG, phPublicKey: *ck.CK_OBJECT_HANDLE, phPrivateKey: *ck.CK_OBJECT_HANDLE) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+
+    const allocator = inst.allocator();
+    const pub_template = if (ulPublicKeyAttributeCount == 0) &[_]ck.CK_ATTRIBUTE{} else pPublicKeyTemplate[0..@intCast(ulPublicKeyAttributeCount)];
+    const priv_template = if (ulPrivateKeyAttributeCount == 0) &[_]ck.CK_ATTRIBUTE{} else pPrivateKeyTemplate[0..@intCast(ulPrivateKeyAttributeCount)];
+
+    var pub_obj: Object = .{};
+    var pub_moved = false;
+    defer if (!pub_moved) pub_obj.deinit(allocator);
+    var priv_obj: Object = .{};
+    var priv_moved = false;
+    defer if (!priv_moved) priv_obj.deinit(allocator);
+
+    switch (pMechanism.mechanism) {
+        ck.CKM_EC_KEY_PAIR_GEN => {
+            const params = ecParamsFrom(pub_template) orelse return ck.CKR_TEMPLATE_INCOMPLETE;
+            const curve = ecdsa.curveFromParams(params) orelse return ck.CKR_DOMAIN_PARAMS_INVALID;
+            var km = ecdsa.generate(inst.io(), curve) catch return ck.CKR_FUNCTION_FAILED;
+            defer std.crypto.secureZero(u8, &km.scalar);
+            buildEcPublic(&pub_obj, allocator, pub_template, curve, km.pointBytes()) catch |e| return object_store.mapSetErr(e);
+            buildEcPrivate(&priv_obj, allocator, priv_template, curve, km.scalarBytes()) catch |e| return object_store.mapSetErr(e);
+        },
+        ck.CKM_RSA_PKCS_KEY_PAIR_GEN => {
+            const bits = modulusBitsFrom(pub_template) orelse return ck.CKR_TEMPLATE_INCOMPLETE;
+            if (bits < config.rsa_min_key_bits or bits > config.rsa_max_key_bits) return ck.CKR_KEY_SIZE_RANGE;
+            var g = rsa.generate(@intCast(bits)) catch return ck.CKR_FUNCTION_FAILED;
+            defer g.zeroize();
+            buildRsaPublic(&pub_obj, allocator, pub_template, &g) catch |e| return object_store.mapSetErr(e);
+            buildRsaPrivate(&priv_obj, allocator, priv_template, &g) catch |e| return object_store.mapSetErr(e);
+        },
+        else => return ck.CKR_MECHANISM_INVALID,
+    }
+
+    const pub_is_token = pub_obj.isToken();
+    pub_moved = true;
+    const pub_rv = object.insertNew(inst, sess, pub_obj, phPublicKey);
+    if (pub_rv != ck.CKR_OK) return pub_rv;
+
+    priv_moved = true;
+    const priv_rv = object.insertNew(inst, sess, priv_obj, phPrivateKey);
+    if (priv_rv != ck.CKR_OK) {
+        _ = inst.objects.destroy(allocator, phPublicKey.*);
+        if (pub_is_token) object_store.save(inst.io(), allocator, &inst.objects, inst.mk) catch {};
+        return priv_rv;
+    }
+    return ck.CKR_OK;
+}
+
+fn buildSecretKeyObject(
+    inst: *state.Instance,
+    sess: *session.Session,
+    template: []const ck.CK_ATTRIBUTE,
+    value: []const u8,
+    base_always_sensitive: bool,
+    base_never_extractable: bool,
+    phKey: *ck.CK_OBJECT_HANDLE,
+) ck.CK_RV {
+    const allocator = inst.allocator();
+    var obj: Object = .{};
+    var moved = false;
+    defer if (!moved) obj.deinit(allocator);
+
+    for (template) |a| {
+        if (a.type == ck.CKA_VALUE_LEN or a.type == ck.CKA_VALUE) continue;
+        obj.set(allocator, a.type, attrBytes(a)) catch |e| return object_store.mapSetErr(e);
+    }
+
+    if (!obj.has(ck.CKA_CLASS)) {
+        const cls: ck.CK_OBJECT_CLASS = ck.CKO_SECRET_KEY;
+        obj.set(allocator, ck.CKA_CLASS, std.mem.asBytes(&cls)) catch |e| return object_store.mapSetErr(e);
+    }
+    if (!obj.has(ck.CKA_KEY_TYPE)) {
+        const kt: ck.CK_KEY_TYPE = ck.CKK_GENERIC_SECRET;
+        obj.set(allocator, ck.CKA_KEY_TYPE, std.mem.asBytes(&kt)) catch |e| return object_store.mapSetErr(e);
+    }
+    obj.set(allocator, ck.CKA_VALUE, value) catch |e| return object_store.mapSetErr(e);
+    obj.set(allocator, ck.CKA_LOCAL, &[_]u8{ck.CK_FALSE}) catch |e| return object_store.mapSetErr(e);
+
+    if (!obj.has(ck.CKA_SENSITIVE)) obj.set(allocator, ck.CKA_SENSITIVE, &[_]u8{ck.CK_TRUE}) catch |e| return object_store.mapSetErr(e);
+    if (!obj.has(ck.CKA_EXTRACTABLE)) obj.set(allocator, ck.CKA_EXTRACTABLE, &[_]u8{ck.CK_FALSE}) catch |e| return object_store.mapSetErr(e);
+    const always_sensitive: u8 = if (obj.getBool(ck.CKA_SENSITIVE) and base_always_sensitive) ck.CK_TRUE else ck.CK_FALSE;
+    const never_extractable: u8 = if (!obj.getBool(ck.CKA_EXTRACTABLE) and base_never_extractable) ck.CK_TRUE else ck.CK_FALSE;
+    obj.set(allocator, ck.CKA_ALWAYS_SENSITIVE, &[_]u8{always_sensitive}) catch |e| return object_store.mapSetErr(e);
+    obj.set(allocator, ck.CKA_NEVER_EXTRACTABLE, &[_]u8{never_extractable}) catch |e| return object_store.mapSetErr(e);
+
+    object.materializeDefaults(&obj, allocator, ck.CKO_SECRET_KEY) catch |e| return object_store.mapSetErr(e);
+
+    moved = true;
+    return object.insertNew(inst, sess, obj, phKey);
+}
+
+const SecretVal = union(enum) {
+    ok: []const u8,
+    err: ck.CK_RV,
+};
+
+fn wrapTargetValue(inst: *state.Instance, hKey: ck.CK_OBJECT_HANDLE) SecretVal {
+    const obj = inst.objects.getPtr(hKey) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID };
+    if (!object_store.visible(obj, inst.logged_in)) return .{ .err = ck.CKR_KEY_HANDLE_INVALID };
+    if (classOf(obj) != ck.CKO_SECRET_KEY) return .{ .err = ck.CKR_KEY_NOT_WRAPPABLE };
+    if (obj.has(ck.CKA_EXTRACTABLE) and !obj.getBool(ck.CKA_EXTRACTABLE)) return .{ .err = ck.CKR_KEY_UNEXTRACTABLE };
+    const sa = obj.findPtr(ck.CKA_VALUE) orelse return .{ .err = ck.CKR_KEY_NOT_WRAPPABLE };
+    if (sa.sealed) return .{ .err = ck.CKR_USER_NOT_LOGGED_IN };
+    return .{ .ok = sa.value };
+}
+
+fn aesKekValue(inst: *state.Instance, hKey: ck.CK_OBJECT_HANDLE, usage: ck.CK_ATTRIBUTE_TYPE, handle_err: ck.CK_RV, type_err: ck.CK_RV, size_err: ck.CK_RV) SecretVal {
+    const obj = inst.objects.getPtr(hKey) orelse return .{ .err = handle_err };
+    if (!object_store.visible(obj, inst.logged_in)) return .{ .err = handle_err };
+    if (classOf(obj) != ck.CKO_SECRET_KEY or keyTypeOf(obj) != ck.CKK_AES) return .{ .err = type_err };
+    if (obj.has(usage) and !obj.getBool(usage)) return .{ .err = ck.CKR_KEY_FUNCTION_NOT_PERMITTED };
+    const sa = obj.findPtr(ck.CKA_VALUE) orelse return .{ .err = handle_err };
+    if (sa.sealed) return .{ .err = ck.CKR_USER_NOT_LOGGED_IN };
+    if (!cipher.validKeyLen(sa.value.len)) return .{ .err = size_err };
+    return .{ .ok = sa.value };
+}
+
+const RsaPubVal = union(enum) {
+    ok: rsa.PublicComponents,
+    err: ck.CK_RV,
+};
+
+fn rsaWrapPublic(inst: *state.Instance, hKey: ck.CK_OBJECT_HANDLE) RsaPubVal {
+    const obj = inst.objects.getPtr(hKey) orelse return .{ .err = ck.CKR_WRAPPING_KEY_HANDLE_INVALID };
+    if (!object_store.visible(obj, inst.logged_in)) return .{ .err = ck.CKR_WRAPPING_KEY_HANDLE_INVALID };
+    if (classOf(obj) != ck.CKO_PUBLIC_KEY or keyTypeOf(obj) != ck.CKK_RSA) return .{ .err = ck.CKR_WRAPPING_KEY_TYPE_INCONSISTENT };
+    if (obj.has(ck.CKA_WRAP) and !obj.getBool(ck.CKA_WRAP)) return .{ .err = ck.CKR_KEY_FUNCTION_NOT_PERMITTED };
+    return .{ .ok = .{
+        .n = obj.get(ck.CKA_MODULUS) orelse return .{ .err = ck.CKR_WRAPPING_KEY_HANDLE_INVALID },
+        .e = obj.get(ck.CKA_PUBLIC_EXPONENT) orelse return .{ .err = ck.CKR_WRAPPING_KEY_HANDLE_INVALID },
+    } };
+}
+
+const RsaPrivVal = union(enum) {
+    ok: rsa.PrivateComponents,
+    err: ck.CK_RV,
+};
+
+fn rsaUnwrapPrivate(inst: *state.Instance, hKey: ck.CK_OBJECT_HANDLE) RsaPrivVal {
+    const obj = inst.objects.getPtr(hKey) orelse return .{ .err = ck.CKR_UNWRAPPING_KEY_HANDLE_INVALID };
+    if (!object_store.visible(obj, inst.logged_in)) return .{ .err = ck.CKR_UNWRAPPING_KEY_HANDLE_INVALID };
+    if (classOf(obj) != ck.CKO_PRIVATE_KEY or keyTypeOf(obj) != ck.CKK_RSA) return .{ .err = ck.CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT };
+    if (obj.has(ck.CKA_UNWRAP) and !obj.getBool(ck.CKA_UNWRAP)) return .{ .err = ck.CKR_KEY_FUNCTION_NOT_PERMITTED };
+    if (obj.findPtr(ck.CKA_PRIVATE_EXPONENT)) |da| {
+        if (da.sealed) return .{ .err = ck.CKR_USER_NOT_LOGGED_IN };
+    }
+    return .{ .ok = .{
+        .n = obj.get(ck.CKA_MODULUS) orelse return .{ .err = ck.CKR_UNWRAPPING_KEY_HANDLE_INVALID },
+        .e = obj.get(ck.CKA_PUBLIC_EXPONENT) orelse return .{ .err = ck.CKR_UNWRAPPING_KEY_HANDLE_INVALID },
+        .d = obj.get(ck.CKA_PRIVATE_EXPONENT) orelse return .{ .err = ck.CKR_UNWRAPPING_KEY_HANDLE_INVALID },
+        .p = obj.get(ck.CKA_PRIME_1) orelse return .{ .err = ck.CKR_UNWRAPPING_KEY_HANDLE_INVALID },
+        .q = obj.get(ck.CKA_PRIME_2) orelse return .{ .err = ck.CKR_UNWRAPPING_KEY_HANDLE_INVALID },
+        .dmp1 = obj.get(ck.CKA_EXPONENT_1) orelse return .{ .err = ck.CKR_UNWRAPPING_KEY_HANDLE_INVALID },
+        .dmq1 = obj.get(ck.CKA_EXPONENT_2) orelse return .{ .err = ck.CKR_UNWRAPPING_KEY_HANDLE_INVALID },
+        .iqmp = obj.get(ck.CKA_COEFFICIENT) orelse return .{ .err = ck.CKR_UNWRAPPING_KEY_HANDLE_INVALID },
+    } };
+}
+
+fn mgfHash(mgf: ck.CK_RSA_PKCS_MGF_TYPE) ?rsa.Hash {
+    return switch (mgf) {
+        ck.CKG_MGF1_SHA256 => .sha256,
+        ck.CKG_MGF1_SHA384 => .sha384,
+        ck.CKG_MGF1_SHA512 => .sha512,
+        else => null,
+    };
+}
+
+const OaepVal = union(enum) {
+    ok: rsa.CryptParams,
+    err: ck.CK_RV,
+};
+
+fn oaepParams(pMechanism: *ck.CK_MECHANISM) OaepVal {
+    const p = pMechanism.pParameter orelse return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+    if (pMechanism.ulParameterLen != @sizeOf(ck.CK_RSA_PKCS_OAEP_PARAMS)) return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+    const op: *const ck.CK_RSA_PKCS_OAEP_PARAMS = @ptrCast(@alignCast(p));
+    const h = rsa.Hash.fromMech(op.hashAlg) orelse return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+    if (mgfHash(op.mgf) != h) return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+    if (op.ulSourceDataLen != 0) return .{ .err = ck.CKR_MECHANISM_PARAM_INVALID };
+    return .{ .ok = .{ .scheme = .oaep, .oaep_hash = h } };
+}
+
+pub fn C_WrapKey(hSession: ck.CK_SESSION_HANDLE, pMechanism: *ck.CK_MECHANISM, hWrappingKey: ck.CK_OBJECT_HANDLE, hKey: ck.CK_OBJECT_HANDLE, pWrappedKey: ?[*]ck.CK_BYTE, pulWrappedKeyLen: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    _ = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+
+    const target = switch (wrapTargetValue(inst, hKey)) {
+        .err => |rv| return rv,
+        .ok => |v| v,
+    };
+
+    switch (pMechanism.mechanism) {
+        ck.CKM_AES_KEY_WRAP => {
+            const kek = switch (aesKekValue(inst, hWrappingKey, ck.CKA_WRAP, ck.CKR_WRAPPING_KEY_HANDLE_INVALID, ck.CKR_WRAPPING_KEY_TYPE_INCONSISTENT, ck.CKR_WRAPPING_KEY_SIZE_RANGE)) {
+                .err => |rv| return rv,
+                .ok => |v| v,
+            };
+            if (target.len < 2 * cipher.key_wrap_overhead or target.len % cipher.key_wrap_overhead != 0) return ck.CKR_KEY_NOT_WRAPPABLE;
+            const need: ck.CK_ULONG = @intCast(target.len + cipher.key_wrap_overhead);
+            if (pWrappedKey == null) {
+                pulWrappedKeyLen.* = need;
+                return ck.CKR_OK;
+            }
+            if (pulWrappedKeyLen.* < need) {
+                pulWrappedKeyLen.* = need;
+                return ck.CKR_BUFFER_TOO_SMALL;
+            }
+            const n = cipher.aesKeyWrap(kek, target, pWrappedKey.?[0..@intCast(need)]) catch return ck.CKR_FUNCTION_FAILED;
+            pulWrappedKeyLen.* = @intCast(n);
+            return ck.CKR_OK;
+        },
+        ck.CKM_RSA_PKCS_OAEP => {
+            const params = switch (oaepParams(pMechanism)) {
+                .err => |rv| return rv,
+                .ok => |p| p,
+            };
+            const pc = switch (rsaWrapPublic(inst, hWrappingKey)) {
+                .err => |rv| return rv,
+                .ok => |c| c,
+            };
+            const need: ck.CK_ULONG = @intCast(pc.n.len);
+            if (pWrappedKey == null) {
+                pulWrappedKeyLen.* = need;
+                return ck.CKR_OK;
+            }
+            if (pulWrappedKeyLen.* < need) {
+                pulWrappedKeyLen.* = need;
+                return ck.CKR_BUFFER_TOO_SMALL;
+            }
+            const n = rsa.encrypt(pc, params, target, pWrappedKey.?[0..@intCast(need)]) catch return ck.CKR_KEY_SIZE_RANGE;
+            pulWrappedKeyLen.* = @intCast(n);
+            return ck.CKR_OK;
+        },
+        else => return ck.CKR_MECHANISM_INVALID,
+    }
+}
+
+pub fn C_UnwrapKey(hSession: ck.CK_SESSION_HANDLE, pMechanism: *ck.CK_MECHANISM, hUnwrappingKey: ck.CK_OBJECT_HANDLE, pWrappedKey: [*]ck.CK_BYTE, ulWrappedKeyLen: ck.CK_ULONG, pTemplate: [*]ck.CK_ATTRIBUTE, ulAttributeCount: ck.CK_ULONG, phKey: *ck.CK_OBJECT_HANDLE) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+
+    const wrapped = pWrappedKey[0..@intCast(ulWrappedKeyLen)];
+    const template = if (ulAttributeCount == 0) &[_]ck.CK_ATTRIBUTE{} else pTemplate[0..@intCast(ulAttributeCount)];
+
+    var buf: [rsa.max_modulus_bytes]u8 = undefined;
+    defer std.crypto.secureZero(u8, &buf);
+
+    const recovered: []const u8 = switch (pMechanism.mechanism) {
+        ck.CKM_AES_KEY_WRAP => blk: {
+            const kek = switch (aesKekValue(inst, hUnwrappingKey, ck.CKA_UNWRAP, ck.CKR_UNWRAPPING_KEY_HANDLE_INVALID, ck.CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT, ck.CKR_UNWRAPPING_KEY_SIZE_RANGE)) {
+                .err => |rv| return rv,
+                .ok => |v| v,
+            };
+            if (wrapped.len < 3 * cipher.key_wrap_overhead or wrapped.len % cipher.key_wrap_overhead != 0) return ck.CKR_WRAPPED_KEY_LEN_RANGE;
+            if (wrapped.len - cipher.key_wrap_overhead > buf.len) return ck.CKR_WRAPPED_KEY_LEN_RANGE;
+            const n = cipher.aesKeyUnwrap(kek, wrapped, &buf) catch |e| switch (e) {
+                cipher.WrapError.Integrity => return ck.CKR_WRAPPED_KEY_INVALID,
+                else => return ck.CKR_WRAPPED_KEY_LEN_RANGE,
+            };
+            break :blk buf[0..n];
+        },
+        ck.CKM_RSA_PKCS_OAEP => blk: {
+            const params = switch (oaepParams(pMechanism)) {
+                .err => |rv| return rv,
+                .ok => |p| p,
+            };
+            const sc = switch (rsaUnwrapPrivate(inst, hUnwrappingKey)) {
+                .err => |rv| return rv,
+                .ok => |c| c,
+            };
+            const n = rsa.decrypt(sc, params, wrapped, &buf) catch return ck.CKR_WRAPPED_KEY_INVALID;
+            break :blk buf[0..n];
+        },
+        else => return ck.CKR_MECHANISM_INVALID,
+    };
+
+    var final = recovered;
+    for (template) |a| {
+        if (a.type == ck.CKA_VALUE_LEN) {
+            const v = ulongFrom(attrBytes(a)) orelse return ck.CKR_ATTRIBUTE_VALUE_INVALID;
+            const vlen: usize = @intCast(v);
+            if (vlen == 0 or vlen > recovered.len) return ck.CKR_ATTRIBUTE_VALUE_INVALID;
+            final = recovered[0..vlen];
+        }
+    }
+
+    return buildSecretKeyObject(inst, sess, template, final, false, false, phKey);
+}
+
+fn classOf(obj: *const Object) ?ck.CK_OBJECT_CLASS {
+    const v = obj.get(ck.CKA_CLASS) orelse return null;
+    if (v.len != @sizeOf(ck.CK_OBJECT_CLASS)) return null;
+    return std.mem.bytesToValue(ck.CK_OBJECT_CLASS, v[0..@sizeOf(ck.CK_OBJECT_CLASS)]);
+}
+
+fn keyTypeOf(obj: *const Object) ?ck.CK_KEY_TYPE {
+    const v = obj.get(ck.CKA_KEY_TYPE) orelse return null;
+    if (v.len != @sizeOf(ck.CK_KEY_TYPE)) return null;
+    return std.mem.bytesToValue(ck.CK_KEY_TYPE, v[0..@sizeOf(ck.CK_KEY_TYPE)]);
+}
+
+const EcDeriveBase = union(enum) {
+    ok: struct {
+        curve: ecdsa.Curve,
+        scalar: []const u8,
+        always_sensitive: bool,
+        never_extractable: bool,
+    },
+    err: ck.CK_RV,
+};
+
+fn ecDeriveBaseKey(inst: *state.Instance, hKey: ck.CK_OBJECT_HANDLE) EcDeriveBase {
+    const obj = inst.objects.getPtr(hKey) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID };
+    if (!object_store.visible(obj, inst.logged_in)) return .{ .err = ck.CKR_KEY_HANDLE_INVALID };
+    if (classOf(obj) != ck.CKO_PRIVATE_KEY) return .{ .err = ck.CKR_KEY_TYPE_INCONSISTENT };
+    if (keyTypeOf(obj) != ck.CKK_EC) return .{ .err = ck.CKR_KEY_TYPE_INCONSISTENT };
+    if (obj.has(ck.CKA_DERIVE) and !obj.getBool(ck.CKA_DERIVE)) return .{ .err = ck.CKR_KEY_FUNCTION_NOT_PERMITTED };
+    const params = obj.get(ck.CKA_EC_PARAMS) orelse return .{ .err = ck.CKR_KEY_TYPE_INCONSISTENT };
+    const curve = ecdsa.curveFromParams(params) orelse return .{ .err = ck.CKR_KEY_TYPE_INCONSISTENT };
+    const sa = obj.findPtr(ck.CKA_VALUE) orelse return .{ .err = ck.CKR_KEY_HANDLE_INVALID };
+    if (sa.sealed) return .{ .err = ck.CKR_USER_NOT_LOGGED_IN };
+    if (sa.value.len != curve.scalarLen()) return .{ .err = ck.CKR_FUNCTION_FAILED };
+    return .{ .ok = .{
+        .curve = curve,
+        .scalar = sa.value,
+        .always_sensitive = obj.getBool(ck.CKA_ALWAYS_SENSITIVE),
+        .never_extractable = obj.getBool(ck.CKA_NEVER_EXTRACTABLE),
+    } };
+}
+
+fn peerPointSec1(curve: ecdsa.Curve, data: []const u8) ?[]const u8 {
+    if (data.len == curve.pointLen()) return data;
+    const inner = ecdsa.unwrapEcPoint(data) orelse return null;
+    if (inner.len == curve.pointLen()) return inner;
+    return null;
+}
+
+pub fn C_DeriveKey(hSession: ck.CK_SESSION_HANDLE, pMechanism: *ck.CK_MECHANISM, hBaseKey: ck.CK_OBJECT_HANDLE, pTemplate: ?[*]ck.CK_ATTRIBUTE, ulCount: ck.CK_ULONG, phKey: *ck.CK_OBJECT_HANDLE) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (pMechanism.mechanism != ck.CKM_ECDH1_DERIVE) return ck.CKR_MECHANISM_INVALID;
+
+    const p = pMechanism.pParameter orelse return ck.CKR_MECHANISM_PARAM_INVALID;
+    if (pMechanism.ulParameterLen != @sizeOf(ck.CK_ECDH1_DERIVE_PARAMS)) return ck.CKR_MECHANISM_PARAM_INVALID;
+    const dp: *const ck.CK_ECDH1_DERIVE_PARAMS = @ptrCast(@alignCast(p));
+    if (dp.kdf != ck.CKD_NULL) return ck.CKR_MECHANISM_PARAM_INVALID;
+    if (dp.ulSharedDataLen != 0) return ck.CKR_MECHANISM_PARAM_INVALID;
+    const peer = (dp.pPublicData orelse return ck.CKR_MECHANISM_PARAM_INVALID)[0..@intCast(dp.ulPublicDataLen)];
+
+    const base = switch (ecDeriveBaseKey(inst, hBaseKey)) {
+        .err => |rv| return rv,
+        .ok => |b| b,
+    };
+
+    const peer_sec1 = peerPointSec1(base.curve, peer) orelse return ck.CKR_MECHANISM_PARAM_INVALID;
+    var secret: [ecdsa.max_scalar]u8 = undefined;
+    defer std.crypto.secureZero(u8, &secret);
+    const slen = ecdsa.ecdh(base.curve, base.scalar, peer_sec1, &secret) catch return ck.CKR_FUNCTION_FAILED;
+
+    const template = if (ulCount == 0) &[_]ck.CK_ATTRIBUTE{} else (pTemplate orelse return ck.CKR_ARGUMENTS_BAD)[0..@intCast(ulCount)];
+
+    var value_len: usize = slen;
+    for (template) |a| {
+        if (a.type == ck.CKA_VALUE_LEN) {
+            const v = ulongFrom(attrBytes(a)) orelse return ck.CKR_ATTRIBUTE_VALUE_INVALID;
+            value_len = @intCast(v);
+        }
+    }
+    if (value_len == 0 or value_len > slen) return ck.CKR_ATTRIBUTE_VALUE_INVALID;
+
+    return buildSecretKeyObject(inst, sess, template, secret[0..value_len], base.always_sensitive, base.never_extractable, phKey);
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/api/object.zig b/PROJECTS/advanced/hsm-emulator/src/api/object.zig
new file mode 100644
index 00000000..88b8ecf6
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/api/object.zig
@@ -0,0 +1,328 @@
+// ©AngelaMos | 2026
+// object.zig
+
+const std = @import("std");
+const ck = @import("../ck.zig");
+const config = @import("../config.zig");
+const state = @import("../core/state.zig");
+const session = @import("../core/session.zig");
+const object_store = @import("../core/object_store.zig");
+
+const Object = object_store.Object;
+const mapSetErr = object_store.mapSetErr;
+
+fn inputTemplate(p: ?[*]ck.CK_ATTRIBUTE, count: ck.CK_ULONG) []ck.CK_ATTRIBUTE {
+    if (count == 0) return &.{};
+    return (p orelse return &.{})[0..@intCast(count)];
+}
+
+fn attrBytes(a: ck.CK_ATTRIBUTE) []const u8 {
+    const ptr = a.pValue orelse return &.{};
+    return @as([*]const u8, @ptrCast(ptr))[0..@intCast(a.ulValueLen)];
+}
+
+fn ulongAttr(obj: *const Object, t: ck.CK_ATTRIBUTE_TYPE) ?ck.CK_ULONG {
+    const v = obj.get(t) orelse return null;
+    if (v.len != @sizeOf(ck.CK_ULONG)) return null;
+    return std.mem.bytesToValue(ck.CK_ULONG, v[0..@sizeOf(ck.CK_ULONG)]);
+}
+
+const visible = object_store.visible;
+
+fn matches(obj: *Object, template: []ck.CK_ATTRIBUTE) bool {
+    for (template) |a| {
+        const have = obj.get(a.type) orelse return false;
+        if (!std.mem.eql(u8, have, attrBytes(a))) return false;
+    }
+    return true;
+}
+
+fn readOnlyAttr(t: ck.CK_ATTRIBUTE_TYPE) bool {
+    return switch (t) {
+        ck.CKA_CLASS,
+        ck.CKA_TOKEN,
+        ck.CKA_PRIVATE,
+        ck.CKA_KEY_TYPE,
+        ck.CKA_LOCAL,
+        ck.CKA_KEY_GEN_MECHANISM,
+        ck.CKA_ALWAYS_SENSITIVE,
+        ck.CKA_NEVER_EXTRACTABLE,
+        ck.CKA_MODULUS,
+        ck.CKA_PUBLIC_EXPONENT,
+        ck.CKA_PRIVATE_EXPONENT,
+        ck.CKA_PRIME_1,
+        ck.CKA_PRIME_2,
+        ck.CKA_EXPONENT_1,
+        ck.CKA_EXPONENT_2,
+        ck.CKA_COEFFICIENT,
+        ck.CKA_EC_PARAMS,
+        ck.CKA_EC_POINT,
+        => true,
+        else => false,
+    };
+}
+
+fn sensitiveProtected(obj: *const Object, t: ck.CK_ATTRIBUTE_TYPE) bool {
+    const secret_material = switch (t) {
+        ck.CKA_VALUE,
+        ck.CKA_PRIVATE_EXPONENT,
+        ck.CKA_PRIME_1,
+        ck.CKA_PRIME_2,
+        ck.CKA_EXPONENT_1,
+        ck.CKA_EXPONENT_2,
+        ck.CKA_COEFFICIENT,
+        => true,
+        else => false,
+    };
+    if (!secret_material) return false;
+    if (!obj.has(t)) return false;
+    if (obj.getBool(ck.CKA_SENSITIVE)) return true;
+    return obj.has(ck.CKA_EXTRACTABLE) and !obj.getBool(ck.CKA_EXTRACTABLE);
+}
+
+pub fn materializeDefaults(obj: *Object, allocator: std.mem.Allocator, class: ck.CK_OBJECT_CLASS) !void {
+    if (!obj.has(ck.CKA_TOKEN)) try obj.set(allocator, ck.CKA_TOKEN, &[_]u8{ck.CK_FALSE});
+    if (!obj.has(ck.CKA_PRIVATE)) {
+        const def: u8 = if (class == ck.CKO_PRIVATE_KEY) ck.CK_TRUE else ck.CK_FALSE;
+        try obj.set(allocator, ck.CKA_PRIVATE, &[_]u8{def});
+    }
+}
+
+pub fn insertNew(inst: *state.Instance, sess: *session.Session, obj_in: Object, phObject: *ck.CK_OBJECT_HANDLE) ck.CK_RV {
+    var obj = obj_in;
+    const allocator = inst.allocator();
+    const is_token = obj.isToken();
+    if (is_token and (sess.flags & ck.CKF_RW_SESSION) == 0) {
+        obj.deinit(allocator);
+        return ck.CKR_SESSION_READ_ONLY;
+    }
+    if (obj.isPrivate() and inst.logged_in != ck.CKU_USER) {
+        obj.deinit(allocator);
+        return ck.CKR_USER_NOT_LOGGED_IN;
+    }
+    if (is_token and inst.mk == null and obj.hasSealable()) {
+        obj.deinit(allocator);
+        return ck.CKR_USER_NOT_LOGGED_IN;
+    }
+    const h = inst.objects.insert(obj) orelse {
+        obj.deinit(allocator);
+        return ck.CKR_DEVICE_MEMORY;
+    };
+    phObject.* = h;
+    persistIfToken(inst, is_token);
+    return ck.CKR_OK;
+}
+
+fn worse(cur: ck.CK_RV, new: ck.CK_RV) ck.CK_RV {
+    if (cur == ck.CKR_OK) return new;
+    if (cur == ck.CKR_ATTRIBUTE_SENSITIVE or new == ck.CKR_ATTRIBUTE_SENSITIVE) return ck.CKR_ATTRIBUTE_SENSITIVE;
+    if (cur == ck.CKR_ATTRIBUTE_TYPE_INVALID or new == ck.CKR_ATTRIBUTE_TYPE_INVALID) return ck.CKR_ATTRIBUTE_TYPE_INVALID;
+    return new;
+}
+
+fn persistIfToken(inst: *state.Instance, is_token: bool) void {
+    if (is_token) object_store.save(inst.io(), inst.allocator(), &inst.objects, inst.mk) catch {};
+}
+
+pub fn C_CreateObject(hSession: ck.CK_SESSION_HANDLE, pTemplate: [*]ck.CK_ATTRIBUTE, ulCount: ck.CK_ULONG, phObject: *ck.CK_OBJECT_HANDLE) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    const allocator = inst.allocator();
+    const template = inputTemplate(pTemplate, ulCount);
+
+    var obj: Object = .{};
+    var moved = false;
+    defer if (!moved) obj.deinit(allocator);
+
+    for (template) |a| {
+        obj.set(allocator, a.type, attrBytes(a)) catch |e| return mapSetErr(e);
+    }
+
+    if (!obj.has(ck.CKA_CLASS)) return ck.CKR_TEMPLATE_INCOMPLETE;
+    const class = ulongAttr(&obj, ck.CKA_CLASS) orelse return ck.CKR_ATTRIBUTE_VALUE_INVALID;
+    materializeDefaults(&obj, allocator, class) catch |e| return mapSetErr(e);
+
+    moved = true;
+    return insertNew(inst, sess, obj, phObject);
+}
+
+pub fn C_CopyObject(hSession: ck.CK_SESSION_HANDLE, hObject: ck.CK_OBJECT_HANDLE, pTemplate: [*]ck.CK_ATTRIBUTE, ulCount: ck.CK_ULONG, phNewObject: *ck.CK_OBJECT_HANDLE) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    const src = inst.objects.getPtr(hObject) orelse return ck.CKR_OBJECT_HANDLE_INVALID;
+    if (!visible(src, inst.logged_in)) return ck.CKR_OBJECT_HANDLE_INVALID;
+
+    const allocator = inst.allocator();
+    var obj = src.clone(allocator) catch |e| return mapSetErr(e);
+    var inserted = false;
+    defer if (!inserted) obj.deinit(allocator);
+
+    const template = inputTemplate(pTemplate, ulCount);
+    for (template) |a| {
+        if (readOnlyAttr(a.type) and a.type != ck.CKA_TOKEN and a.type != ck.CKA_PRIVATE) return ck.CKR_ATTRIBUTE_READ_ONLY;
+    }
+    for (template) |a| {
+        obj.set(allocator, a.type, attrBytes(a)) catch |e| return mapSetErr(e);
+    }
+
+    const is_token = obj.isToken();
+    if (is_token and (sess.flags & ck.CKF_RW_SESSION) == 0) return ck.CKR_SESSION_READ_ONLY;
+    if (obj.isPrivate() and inst.logged_in != ck.CKU_USER) return ck.CKR_USER_NOT_LOGGED_IN;
+
+    const h = inst.objects.insert(obj) orelse return ck.CKR_DEVICE_MEMORY;
+    inserted = true;
+    phNewObject.* = h;
+    persistIfToken(inst, is_token);
+    return ck.CKR_OK;
+}
+
+pub fn C_DestroyObject(hSession: ck.CK_SESSION_HANDLE, hObject: ck.CK_OBJECT_HANDLE) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    const obj = inst.objects.getPtr(hObject) orelse return ck.CKR_OBJECT_HANDLE_INVALID;
+    if (!visible(obj, inst.logged_in)) return ck.CKR_OBJECT_HANDLE_INVALID;
+
+    const was_token = obj.isToken();
+    if (was_token and (sess.flags & ck.CKF_RW_SESSION) == 0) return ck.CKR_SESSION_READ_ONLY;
+    if (obj.has(ck.CKA_DESTROYABLE) and !obj.getBool(ck.CKA_DESTROYABLE)) return ck.CKR_ACTION_PROHIBITED;
+
+    _ = inst.objects.destroy(inst.allocator(), hObject);
+    persistIfToken(inst, was_token);
+    return ck.CKR_OK;
+}
+
+pub fn C_GetObjectSize(hSession: ck.CK_SESSION_HANDLE, hObject: ck.CK_OBJECT_HANDLE, pulSize: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+
+    _ = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    const obj = inst.objects.getPtr(hObject) orelse return ck.CKR_OBJECT_HANDLE_INVALID;
+    if (!visible(obj, inst.logged_in)) return ck.CKR_OBJECT_HANDLE_INVALID;
+
+    pulSize.* = obj.sizeBytes();
+    return ck.CKR_OK;
+}
+
+pub fn C_GetAttributeValue(hSession: ck.CK_SESSION_HANDLE, hObject: ck.CK_OBJECT_HANDLE, pTemplate: [*]ck.CK_ATTRIBUTE, ulCount: ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+
+    _ = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    const obj = inst.objects.getPtr(hObject) orelse return ck.CKR_OBJECT_HANDLE_INVALID;
+    if (!visible(obj, inst.logged_in)) return ck.CKR_OBJECT_HANDLE_INVALID;
+
+    const template = inputTemplate(pTemplate, ulCount);
+    var rv: ck.CK_RV = ck.CKR_OK;
+    for (template) |*a| {
+        if (sensitiveProtected(obj, a.type)) {
+            a.ulValueLen = ck.CK_UNAVAILABLE_INFORMATION;
+            rv = worse(rv, ck.CKR_ATTRIBUTE_SENSITIVE);
+            continue;
+        }
+        const val = obj.get(a.type) orelse {
+            a.ulValueLen = ck.CK_UNAVAILABLE_INFORMATION;
+            rv = worse(rv, ck.CKR_ATTRIBUTE_TYPE_INVALID);
+            continue;
+        };
+        if (a.pValue) |ptr| {
+            if (a.ulValueLen < val.len) {
+                a.ulValueLen = ck.CK_UNAVAILABLE_INFORMATION;
+                rv = worse(rv, ck.CKR_BUFFER_TOO_SMALL);
+            } else {
+                @memcpy(@as([*]u8, @ptrCast(ptr))[0..val.len], val);
+                a.ulValueLen = @intCast(val.len);
+            }
+        } else {
+            a.ulValueLen = @intCast(val.len);
+        }
+    }
+    return rv;
+}
+
+pub fn C_SetAttributeValue(hSession: ck.CK_SESSION_HANDLE, hObject: ck.CK_OBJECT_HANDLE, pTemplate: [*]ck.CK_ATTRIBUTE, ulCount: ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    const obj = inst.objects.getPtr(hObject) orelse return ck.CKR_OBJECT_HANDLE_INVALID;
+    if (!visible(obj, inst.logged_in)) return ck.CKR_OBJECT_HANDLE_INVALID;
+    if (obj.isToken() and (sess.flags & ck.CKF_RW_SESSION) == 0) return ck.CKR_SESSION_READ_ONLY;
+    if (obj.has(ck.CKA_MODIFIABLE) and !obj.getBool(ck.CKA_MODIFIABLE)) return ck.CKR_ACTION_PROHIBITED;
+
+    const template = inputTemplate(pTemplate, ulCount);
+    for (template) |a| {
+        if (readOnlyAttr(a.type)) return ck.CKR_ATTRIBUTE_READ_ONLY;
+    }
+
+    const allocator = inst.allocator();
+    var staged = obj.clone(allocator) catch |e| return mapSetErr(e);
+    var swapped = false;
+    defer if (!swapped) staged.deinit(allocator);
+    for (template) |a| {
+        staged.set(allocator, a.type, attrBytes(a)) catch |e| return mapSetErr(e);
+    }
+    obj.deinit(allocator);
+    obj.* = staged;
+    swapped = true;
+    persistIfToken(inst, obj.isToken());
+    return ck.CKR_OK;
+}
+
+pub fn C_FindObjectsInit(hSession: ck.CK_SESSION_HANDLE, pTemplate: ?[*]ck.CK_ATTRIBUTE, ulCount: ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.find.active) return ck.CKR_OPERATION_ACTIVE;
+    if (pTemplate == null and ulCount != 0) return ck.CKR_ARGUMENTS_BAD;
+
+    const template = inputTemplate(pTemplate, ulCount);
+    sess.find.count = 0;
+    sess.find.cursor = 0;
+    for (&inst.objects.slots) |*slot| {
+        if (slot.*) |*e| {
+            if (!visible(&e.obj, inst.logged_in)) continue;
+            if (matches(&e.obj, template)) {
+                sess.find.matches[sess.find.count] = e.handle;
+                sess.find.count += 1;
+            }
+        }
+    }
+    sess.find.active = true;
+    return ck.CKR_OK;
+}
+
+pub fn C_FindObjects(hSession: ck.CK_SESSION_HANDLE, phObject: [*]ck.CK_OBJECT_HANDLE, ulMaxObjectCount: ck.CK_ULONG, pulObjectCount: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (!sess.find.active) return ck.CKR_OPERATION_NOT_INITIALIZED;
+
+    const max: usize = @intCast(ulMaxObjectCount);
+    var n: usize = 0;
+    while (n < max and sess.find.cursor < sess.find.count) : (n += 1) {
+        phObject[n] = sess.find.matches[sess.find.cursor];
+        sess.find.cursor += 1;
+    }
+    pulObjectCount.* = @intCast(n);
+    return ck.CKR_OK;
+}
+
+pub fn C_FindObjectsFinal(hSession: ck.CK_SESSION_HANDLE) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (!sess.find.active) return ck.CKR_OPERATION_NOT_INITIALIZED;
+    sess.find.active = false;
+    sess.find.count = 0;
+    sess.find.cursor = 0;
+    return ck.CKR_OK;
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/api/random.zig b/PROJECTS/advanced/hsm-emulator/src/api/random.zig
new file mode 100644
index 00000000..e2b224a2
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/api/random.zig
@@ -0,0 +1,21 @@
+// ©AngelaMos | 2026
+// random.zig
+
+const ck = @import("../ck.zig");
+const state = @import("../core/state.zig");
+
+pub fn C_SeedRandom(hSession: ck.CK_SESSION_HANDLE, _: [*]ck.CK_BYTE, _: ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    if (inst.sessions.get(hSession) == null) return ck.CKR_SESSION_HANDLE_INVALID;
+    return ck.CKR_RANDOM_SEED_NOT_SUPPORTED;
+}
+
+pub fn C_GenerateRandom(hSession: ck.CK_SESSION_HANDLE, pRandomData: [*]ck.CK_BYTE, ulRandomLen: ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    if (inst.sessions.get(hSession) == null) return ck.CKR_SESSION_HANDLE_INVALID;
+    if (ulRandomLen == 0) return ck.CKR_OK;
+    inst.io().randomSecure(pRandomData[0..@intCast(ulRandomLen)]) catch return ck.CKR_FUNCTION_FAILED;
+    return ck.CKR_OK;
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/api/session.zig b/PROJECTS/advanced/hsm-emulator/src/api/session.zig
new file mode 100644
index 00000000..8176b298
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/api/session.zig
@@ -0,0 +1,225 @@
+// ©AngelaMos | 2026
+// session.zig
+
+const std = @import("std");
+const ck = @import("../ck.zig");
+const config = @import("../config.zig");
+const state = @import("../core/state.zig");
+const pin = @import("../crypto/pin.zig");
+const keystore = @import("../crypto/keystore.zig");
+const token = @import("../core/token.zig");
+const object_store = @import("../core/object_store.zig");
+const digest = @import("../crypto/digest.zig");
+
+fn pinSlice(p: ?[*]ck.CK_UTF8CHAR, len: ck.CK_ULONG) []const u8 {
+    return if (p) |ptr| ptr[0..@intCast(len)] else &.{};
+}
+
+fn sessionState(flags: ck.CK_FLAGS, logged_in: ?ck.CK_USER_TYPE) ck.CK_STATE {
+    const rw = (flags & ck.CKF_RW_SESSION) != 0;
+    if (logged_in) |u| {
+        if (u == ck.CKU_SO) return ck.CKS_RW_SO_FUNCTIONS;
+        return if (rw) ck.CKS_RW_USER_FUNCTIONS else ck.CKS_RO_USER_FUNCTIONS;
+    }
+    return if (rw) ck.CKS_RW_PUBLIC_SESSION else ck.CKS_RO_PUBLIC_SESSION;
+}
+
+pub fn C_OpenSession(slotID: ck.CK_SLOT_ID, flags: ck.CK_FLAGS, pApplication: ?*anyopaque, notify: ck.CK_NOTIFY, phSession: *ck.CK_SESSION_HANDLE) callconv(.c) ck.CK_RV {
+    _ = pApplication;
+    _ = notify;
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    if (slotID != config.slot_id) return ck.CKR_SLOT_ID_INVALID;
+    if ((flags & ck.CKF_SERIAL_SESSION) == 0) return ck.CKR_SESSION_PARALLEL_NOT_SUPPORTED;
+    if ((flags & ck.CKF_RW_SESSION) == 0 and inst.logged_in == ck.CKU_SO) {
+        return ck.CKR_SESSION_READ_WRITE_SO_EXISTS;
+    }
+    const h = inst.sessions.open(slotID, flags) orelse return ck.CKR_SESSION_COUNT;
+    phSession.* = h;
+    return ck.CKR_OK;
+}
+
+pub fn C_CloseSession(hSession: ck.CK_SESSION_HANDLE) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    if (!inst.sessions.close(inst.allocator(), hSession)) return ck.CKR_SESSION_HANDLE_INVALID;
+    if (!inst.sessions.anyOpen()) {
+        inst.relock();
+        inst.logged_in = null;
+    }
+    return ck.CKR_OK;
+}
+
+pub fn C_CloseAllSessions(slotID: ck.CK_SLOT_ID) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    if (slotID != config.slot_id) return ck.CKR_SLOT_ID_INVALID;
+    inst.sessions.closeAll(inst.allocator(), slotID);
+    inst.relock();
+    inst.logged_in = null;
+    return ck.CKR_OK;
+}
+
+pub fn C_GetSessionInfo(hSession: ck.CK_SESSION_HANDLE, pInfo: *ck.CK_SESSION_INFO) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const s = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    pInfo.* = .{
+        .slotID = s.slot,
+        .state = sessionState(s.flags, inst.logged_in),
+        .flags = s.flags,
+        .ulDeviceError = 0,
+    };
+    return ck.CKR_OK;
+}
+
+pub fn C_GetOperationState(hSession: ck.CK_SESSION_HANDLE, pOperationState: ?[*]ck.CK_BYTE, pulOperationStateLen: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (sess.sign_op != null or sess.verify_op != null or sess.encrypt_op != null or
+        sess.decrypt_op != null or sess.sign_recover_op != null or sess.verify_recover_op != null)
+    {
+        return ck.CKR_STATE_UNSAVEABLE;
+    }
+    const d = if (sess.digest_op) |*o| o else return ck.CKR_OPERATION_NOT_INITIALIZED;
+    const total: ck.CK_ULONG = @intCast(config.op_state_header_len + d.stateLen());
+    if (pOperationState == null) {
+        pulOperationStateLen.* = total;
+        return ck.CKR_OK;
+    }
+    if (pulOperationStateLen.* < total) {
+        pulOperationStateLen.* = total;
+        return ck.CKR_BUFFER_TOO_SMALL;
+    }
+    const out = pOperationState.?[0..@intCast(total)];
+    out[0] = config.op_state_version;
+    out[1] = d.stateTag();
+    d.writeState(out[config.op_state_header_len..]);
+    pulOperationStateLen.* = total;
+    return ck.CKR_OK;
+}
+
+pub fn C_SetOperationState(hSession: ck.CK_SESSION_HANDLE, pOperationState: [*]ck.CK_BYTE, ulOperationStateLen: ck.CK_ULONG, hEncryptionKey: ck.CK_OBJECT_HANDLE, hAuthenticationKey: ck.CK_OBJECT_HANDLE) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    const sess = inst.sessions.get(hSession) orelse return ck.CKR_SESSION_HANDLE_INVALID;
+    if (hEncryptionKey != ck.CK_INVALID_HANDLE or hAuthenticationKey != ck.CK_INVALID_HANDLE) {
+        return ck.CKR_KEY_NOT_NEEDED;
+    }
+    const blob = pOperationState[0..@intCast(ulOperationStateLen)];
+    if (blob.len < config.op_state_header_len) return ck.CKR_SAVED_STATE_INVALID;
+    if (blob[0] != config.op_state_version) return ck.CKR_SAVED_STATE_INVALID;
+    const restored = digest.Hasher.fromState(blob[1], blob[config.op_state_header_len..]) orelse return ck.CKR_SAVED_STATE_INVALID;
+    sess.endDigest();
+    sess.digest_op = restored;
+    return ck.CKR_OK;
+}
+
+pub fn C_Login(hSession: ck.CK_SESSION_HANDLE, userType: ck.CK_USER_TYPE, pPin: ?[*]ck.CK_UTF8CHAR, ulPinLen: ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    if (userType != ck.CKU_SO and userType != ck.CKU_USER) {
+        state.mutex.unlock();
+        return ck.CKR_USER_TYPE_INVALID;
+    }
+
+    if (inst.sessions.get(hSession) == null) {
+        state.mutex.unlock();
+        return ck.CKR_SESSION_HANDLE_INVALID;
+    }
+    if (inst.logged_in != null) {
+        state.mutex.unlock();
+        return ck.CKR_USER_ALREADY_LOGGED_IN;
+    }
+    var salt: pin.Salt = undefined;
+    var hash: pin.Hash = undefined;
+    var wrapped_mk: ?keystore.Wrapped = null;
+    if (userType == ck.CKU_SO) {
+        if (inst.sessions.count() > inst.sessions.countRw()) {
+            state.mutex.unlock();
+            return ck.CKR_SESSION_READ_ONLY_EXISTS;
+        }
+        if (!inst.token.initialized) {
+            state.mutex.unlock();
+            return ck.CKR_USER_PIN_NOT_INITIALIZED;
+        }
+        if (inst.token.so_fail >= config.login_max_attempts) {
+            state.mutex.unlock();
+            return ck.CKR_PIN_LOCKED;
+        }
+        salt = inst.token.so.salt;
+        hash = inst.token.so.hash;
+    } else {
+        const u = inst.token.user orelse {
+            state.mutex.unlock();
+            return ck.CKR_USER_PIN_NOT_INITIALIZED;
+        };
+        if (inst.token.user_fail >= config.login_max_attempts) {
+            state.mutex.unlock();
+            return ck.CKR_PIN_LOCKED;
+        }
+        salt = u.salt;
+        hash = u.hash;
+        wrapped_mk = inst.token.user_mk;
+    }
+    const gen = state.cryptoBegin();
+    const io = inst.io();
+    const allocator = inst.allocator();
+    state.mutex.unlock();
+    defer std.crypto.secureZero(u8, &hash);
+
+    const ok = pin.verify(io, allocator, pinSlice(pPin, ulPinLen), &salt, &hash) catch {
+        state.cryptoAbort();
+        return ck.CKR_FUNCTION_FAILED;
+    };
+
+    var mk: keystore.MasterKey = undefined;
+    defer std.crypto.secureZero(u8, &mk);
+    var have_mk = false;
+    if (ok and userType == ck.CKU_USER) {
+        if (wrapped_mk) |w| {
+            have_mk = keystore.unwrap(io, allocator, pinSlice(pPin, ulPinLen), &w, &mk) catch {
+                state.cryptoAbort();
+                return ck.CKR_FUNCTION_FAILED;
+            };
+            if (!have_mk) {
+                state.cryptoAbort();
+                return ck.CKR_FUNCTION_FAILED;
+            }
+        }
+    }
+
+    state.mutex.lock();
+    defer state.mutex.unlock();
+    state.cryptoEnd();
+    if (state.currentGeneration() != gen) return ck.CKR_FUNCTION_FAILED;
+    if (inst.sessions.get(hSession) == null) return ck.CKR_SESSION_HANDLE_INVALID;
+    if (inst.logged_in != null) return ck.CKR_USER_ALREADY_LOGGED_IN;
+    if (ok) {
+        if (userType == ck.CKU_SO) inst.token.so_fail = 0 else inst.token.user_fail = 0;
+        inst.logged_in = userType;
+        if (have_mk) {
+            inst.mk = mk;
+            object_store.unlock(allocator, &inst.objects, mk) catch {
+                inst.relock();
+                inst.logged_in = null;
+                return ck.CKR_FUNCTION_FAILED;
+            };
+        }
+        token.save(inst.io(), inst.token) catch {};
+        return ck.CKR_OK;
+    }
+    if (userType == ck.CKU_SO) inst.token.so_fail += 1 else inst.token.user_fail += 1;
+    token.save(inst.io(), inst.token) catch {};
+    return ck.CKR_PIN_INCORRECT;
+}
+
+pub fn C_Logout(hSession: ck.CK_SESSION_HANDLE) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    if (inst.sessions.get(hSession) == null) return ck.CKR_SESSION_HANDLE_INVALID;
+    if (inst.logged_in == null) return ck.CKR_USER_NOT_LOGGED_IN;
+    inst.relock();
+    inst.logged_in = null;
+    return ck.CKR_OK;
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/api/slot_token.zig b/PROJECTS/advanced/hsm-emulator/src/api/slot_token.zig
new file mode 100644
index 00000000..0af7a11f
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/api/slot_token.zig
@@ -0,0 +1,428 @@
+// ©AngelaMos | 2026
+// slot_token.zig
+
+const std = @import("std");
+const ck = @import("../ck.zig");
+const config = @import("../config.zig");
+const util = @import("../util.zig");
+const state = @import("../core/state.zig");
+const pin = @import("../crypto/pin.zig");
+const keystore = @import("../crypto/keystore.zig");
+const token = @import("../core/token.zig");
+const object_store = @import("../core/object_store.zig");
+
+fn requireInit() ?ck.CK_RV {
+    return if (state.isInitialized()) null else ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+}
+
+fn pinSlice(p: ?[*]ck.CK_UTF8CHAR, len: ck.CK_ULONG) []const u8 {
+    return if (p) |ptr| ptr[0..@intCast(len)] else &.{};
+}
+
+fn pinLenOk(len: ck.CK_ULONG) bool {
+    return len >= config.min_pin_len and len <= config.max_pin_len;
+}
+
+fn labelFrom(p: ?[*]ck.CK_UTF8CHAR) [config.label_len]u8 {
+    var out: [config.label_len]u8 = @splat(' ');
+    if (p) |lp| @memcpy(&out, lp[0..config.label_len]);
+    return out;
+}
+
+fn pinStateFlags(fail: u32, low: ck.CK_FLAGS, final_try: ck.CK_FLAGS, locked: ck.CK_FLAGS) ck.CK_FLAGS {
+    const f: ck.CK_ULONG = fail;
+    const max = config.login_max_attempts;
+    if (f >= max) return locked;
+    if (f == max - 1) return final_try;
+    if (f > 0) return low;
+    return 0;
+}
+
+pub fn C_GetSlotList(_: ck.CK_BBOOL, pSlotList: ?[*]ck.CK_SLOT_ID, pulCount: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    if (requireInit()) |rv| return rv;
+    if (pSlotList == null) {
+        pulCount.* = config.slot_count;
+        return ck.CKR_OK;
+    }
+    if (pulCount.* < config.slot_count) {
+        pulCount.* = config.slot_count;
+        return ck.CKR_BUFFER_TOO_SMALL;
+    }
+    pSlotList.?[0] = config.slot_id;
+    pulCount.* = config.slot_count;
+    return ck.CKR_OK;
+}
+
+pub fn C_GetSlotInfo(slotID: ck.CK_SLOT_ID, pInfo: *ck.CK_SLOT_INFO) callconv(.c) ck.CK_RV {
+    if (requireInit()) |rv| return rv;
+    if (slotID != config.slot_id) return ck.CKR_SLOT_ID_INVALID;
+    pInfo.* = .{
+        .slotDescription = util.padded(64, config.slot_description),
+        .manufacturerID = util.padded(32, config.manufacturer_id),
+        .flags = ck.CKF_TOKEN_PRESENT | ck.CKF_HW_SLOT,
+        .hardwareVersion = config.hardware_version,
+        .firmwareVersion = config.firmware_version,
+    };
+    return ck.CKR_OK;
+}
+
+pub fn C_GetTokenInfo(slotID: ck.CK_SLOT_ID, pInfo: *ck.CK_TOKEN_INFO) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    defer state.mutex.unlock();
+    if (slotID != config.slot_id) return ck.CKR_SLOT_ID_INVALID;
+
+    var flags: ck.CK_FLAGS = ck.CKF_RNG | ck.CKF_LOGIN_REQUIRED;
+    if (inst.token.initialized) flags |= ck.CKF_TOKEN_INITIALIZED;
+    if (inst.token.user != null) flags |= ck.CKF_USER_PIN_INITIALIZED;
+    flags |= pinStateFlags(inst.token.user_fail, ck.CKF_USER_PIN_COUNT_LOW, ck.CKF_USER_PIN_FINAL_TRY, ck.CKF_USER_PIN_LOCKED);
+    flags |= pinStateFlags(inst.token.so_fail, ck.CKF_SO_PIN_COUNT_LOW, ck.CKF_SO_PIN_FINAL_TRY, ck.CKF_SO_PIN_LOCKED);
+
+    pInfo.* = .{
+        .label = if (inst.token.initialized) inst.token.label else util.padded(32, config.token_label),
+        .manufacturerID = util.padded(32, config.manufacturer_id),
+        .model = util.padded(16, config.token_model),
+        .serialNumber = util.padded(16, config.token_serial),
+        .flags = flags,
+        .ulMaxSessionCount = config.max_sessions,
+        .ulSessionCount = inst.sessions.count(),
+        .ulMaxRwSessionCount = config.max_sessions,
+        .ulRwSessionCount = inst.sessions.countRw(),
+        .ulMaxPinLen = config.max_pin_len,
+        .ulMinPinLen = config.min_pin_len,
+        .ulTotalPublicMemory = ck.CK_UNAVAILABLE_INFORMATION,
+        .ulFreePublicMemory = ck.CK_UNAVAILABLE_INFORMATION,
+        .ulTotalPrivateMemory = ck.CK_UNAVAILABLE_INFORMATION,
+        .ulFreePrivateMemory = ck.CK_UNAVAILABLE_INFORMATION,
+        .hardwareVersion = config.hardware_version,
+        .firmwareVersion = config.firmware_version,
+        .utcTime = util.padded(16, ""),
+    };
+    return ck.CKR_OK;
+}
+
+pub fn C_GetMechanismList(slotID: ck.CK_SLOT_ID, pMechanismList: ?[*]ck.CK_MECHANISM_TYPE, pulCount: *ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    if (requireInit()) |rv| return rv;
+    if (slotID != config.slot_id) return ck.CKR_SLOT_ID_INVALID;
+    const n: ck.CK_ULONG = config.supported_mechanisms.len;
+    if (pMechanismList == null) {
+        pulCount.* = n;
+        return ck.CKR_OK;
+    }
+    if (pulCount.* < n) {
+        pulCount.* = n;
+        return ck.CKR_BUFFER_TOO_SMALL;
+    }
+    for (config.supported_mechanisms, 0..) |m, i| pMechanismList.?[i] = m;
+    pulCount.* = n;
+    return ck.CKR_OK;
+}
+
+pub fn C_GetMechanismInfo(slotID: ck.CK_SLOT_ID, mechType: ck.CK_MECHANISM_TYPE, pInfo: *ck.CK_MECHANISM_INFO) callconv(.c) ck.CK_RV {
+    if (requireInit()) |rv| return rv;
+    if (slotID != config.slot_id) return ck.CKR_SLOT_ID_INVALID;
+    pInfo.* = switch (mechType) {
+        ck.CKM_SHA256, ck.CKM_SHA384, ck.CKM_SHA512 => .{
+            .ulMinKeySize = 0,
+            .ulMaxKeySize = 0,
+            .flags = ck.CKF_DIGEST,
+        },
+        ck.CKM_SHA256_HMAC, ck.CKM_SHA384_HMAC, ck.CKM_SHA512_HMAC => .{
+            .ulMinKeySize = config.hmac_min_key_bytes,
+            .ulMaxKeySize = config.hmac_max_key_bytes,
+            .flags = ck.CKF_SIGN | ck.CKF_VERIFY,
+        },
+        ck.CKM_AES_KEY_GEN => .{
+            .ulMinKeySize = config.aes_min_key_bytes,
+            .ulMaxKeySize = config.aes_max_key_bytes,
+            .flags = ck.CKF_GENERATE,
+        },
+        ck.CKM_AES_CBC, ck.CKM_AES_CBC_PAD, ck.CKM_AES_GCM => .{
+            .ulMinKeySize = config.aes_min_key_bytes,
+            .ulMaxKeySize = config.aes_max_key_bytes,
+            .flags = ck.CKF_ENCRYPT | ck.CKF_DECRYPT,
+        },
+        ck.CKM_AES_KEY_WRAP => .{
+            .ulMinKeySize = config.aes_min_key_bytes,
+            .ulMaxKeySize = config.aes_max_key_bytes,
+            .flags = ck.CKF_WRAP | ck.CKF_UNWRAP,
+        },
+        ck.CKM_EC_KEY_PAIR_GEN => .{
+            .ulMinKeySize = config.ec_min_key_bits,
+            .ulMaxKeySize = config.ec_max_key_bits,
+            .flags = ck.CKF_GENERATE_KEY_PAIR | ck.CKF_EC_NAMEDCURVE,
+        },
+        ck.CKM_ECDSA, ck.CKM_ECDSA_SHA256 => .{
+            .ulMinKeySize = config.ec_min_key_bits,
+            .ulMaxKeySize = config.ec_max_key_bits,
+            .flags = ck.CKF_SIGN | ck.CKF_VERIFY | ck.CKF_EC_NAMEDCURVE,
+        },
+        ck.CKM_ECDH1_DERIVE => .{
+            .ulMinKeySize = config.ec_min_key_bits,
+            .ulMaxKeySize = config.ec_max_key_bits,
+            .flags = ck.CKF_DERIVE | ck.CKF_EC_NAMEDCURVE,
+        },
+        ck.CKM_RSA_PKCS_KEY_PAIR_GEN => .{
+            .ulMinKeySize = config.rsa_min_key_bits,
+            .ulMaxKeySize = config.rsa_max_key_bits,
+            .flags = ck.CKF_GENERATE_KEY_PAIR,
+        },
+        ck.CKM_RSA_PKCS => .{
+            .ulMinKeySize = config.rsa_min_key_bits,
+            .ulMaxKeySize = config.rsa_max_key_bits,
+            .flags = ck.CKF_SIGN | ck.CKF_VERIFY | ck.CKF_ENCRYPT | ck.CKF_DECRYPT | ck.CKF_SIGN_RECOVER | ck.CKF_VERIFY_RECOVER,
+        },
+        ck.CKM_SHA256_RSA_PKCS, ck.CKM_RSA_PKCS_PSS, ck.CKM_SHA256_RSA_PKCS_PSS => .{
+            .ulMinKeySize = config.rsa_min_key_bits,
+            .ulMaxKeySize = config.rsa_max_key_bits,
+            .flags = ck.CKF_SIGN | ck.CKF_VERIFY,
+        },
+        ck.CKM_RSA_PKCS_OAEP => .{
+            .ulMinKeySize = config.rsa_min_key_bits,
+            .ulMaxKeySize = config.rsa_max_key_bits,
+            .flags = ck.CKF_ENCRYPT | ck.CKF_DECRYPT | ck.CKF_WRAP | ck.CKF_UNWRAP,
+        },
+        else => return ck.CKR_MECHANISM_INVALID,
+    };
+    return ck.CKR_OK;
+}
+
+pub fn C_InitToken(slotID: ck.CK_SLOT_ID, pPin: ?[*]ck.CK_UTF8CHAR, ulPinLen: ck.CK_ULONG, pLabel: ?[*]ck.CK_UTF8CHAR) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    if (slotID != config.slot_id) {
+        state.mutex.unlock();
+        return ck.CKR_SLOT_ID_INVALID;
+    }
+
+    if (inst.sessions.anyOpen()) {
+        state.mutex.unlock();
+        return ck.CKR_SESSION_EXISTS;
+    }
+    const was_init = inst.token.initialized;
+    if (!was_init and !pinLenOk(ulPinLen)) {
+        state.mutex.unlock();
+        return ck.CKR_PIN_LEN_RANGE;
+    }
+    if (was_init and inst.token.so_fail >= config.login_max_attempts) {
+        state.mutex.unlock();
+        return ck.CKR_PIN_LOCKED;
+    }
+    var snap_so = inst.token.so;
+    const gen = state.cryptoBegin();
+    const io = inst.io();
+    const allocator = inst.allocator();
+    state.mutex.unlock();
+    defer std.crypto.secureZero(u8, &snap_so.hash);
+
+    const new_label = labelFrom(pLabel);
+
+    if (was_init) {
+        const ok = pin.verify(io, allocator, pinSlice(pPin, ulPinLen), &snap_so.salt, &snap_so.hash) catch {
+            state.cryptoAbort();
+            return ck.CKR_FUNCTION_FAILED;
+        };
+        state.mutex.lock();
+        defer state.mutex.unlock();
+        state.cryptoEnd();
+        if (state.currentGeneration() != gen) return ck.CKR_FUNCTION_FAILED;
+        if (!ok) {
+            inst.token.so_fail += 1;
+            token.save(inst.io(), inst.token) catch {};
+            return ck.CKR_PIN_INCORRECT;
+        }
+        inst.token.user = null;
+        inst.token.user_mk = null;
+        inst.wipeMasterKey();
+        inst.token.user_fail = 0;
+        inst.token.so_fail = 0;
+        inst.token.label = new_label;
+        inst.logged_in = null;
+        state.bumpGeneration();
+        inst.objects.clear(inst.allocator());
+        token.save(inst.io(), inst.token) catch {};
+        object_store.save(inst.io(), inst.allocator(), &inst.objects, inst.mk) catch {};
+        return ck.CKR_OK;
+    }
+
+    var salt: pin.Salt = undefined;
+    pin.genSalt(io, &salt) catch {
+        state.cryptoAbort();
+        return ck.CKR_FUNCTION_FAILED;
+    };
+    var hash: pin.Hash = undefined;
+    defer std.crypto.secureZero(u8, &hash);
+    pin.derive(io, allocator, pinSlice(pPin, ulPinLen), &salt, &hash) catch {
+        state.cryptoAbort();
+        return ck.CKR_FUNCTION_FAILED;
+    };
+
+    state.mutex.lock();
+    defer state.mutex.unlock();
+    state.cryptoEnd();
+    inst.token.initialized = true;
+    inst.token.so = .{ .salt = salt, .hash = hash };
+    inst.token.user = null;
+    inst.token.user_mk = null;
+    inst.wipeMasterKey();
+    inst.token.so_fail = 0;
+    inst.token.user_fail = 0;
+    inst.token.label = new_label;
+    inst.logged_in = null;
+    state.bumpGeneration();
+    inst.objects.clear(inst.allocator());
+    token.save(inst.io(), inst.token) catch {};
+    object_store.save(inst.io(), inst.allocator(), &inst.objects, inst.mk) catch {};
+    return ck.CKR_OK;
+}
+
+pub fn C_InitPIN(hSession: ck.CK_SESSION_HANDLE, pPin: ?[*]ck.CK_UTF8CHAR, ulPinLen: ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+
+    if (inst.sessions.get(hSession) == null) {
+        state.mutex.unlock();
+        return ck.CKR_SESSION_HANDLE_INVALID;
+    }
+    if (inst.logged_in != ck.CKU_SO) {
+        state.mutex.unlock();
+        return ck.CKR_USER_NOT_LOGGED_IN;
+    }
+    if (!pinLenOk(ulPinLen)) {
+        state.mutex.unlock();
+        return ck.CKR_PIN_LEN_RANGE;
+    }
+    _ = state.cryptoBegin();
+    const io = inst.io();
+    const allocator = inst.allocator();
+    state.mutex.unlock();
+
+    var salt: pin.Salt = undefined;
+    pin.genSalt(io, &salt) catch {
+        state.cryptoAbort();
+        return ck.CKR_FUNCTION_FAILED;
+    };
+    var hash: pin.Hash = undefined;
+    defer std.crypto.secureZero(u8, &hash);
+    pin.derive(io, allocator, pinSlice(pPin, ulPinLen), &salt, &hash) catch {
+        state.cryptoAbort();
+        return ck.CKR_FUNCTION_FAILED;
+    };
+
+    var mk: keystore.MasterKey = undefined;
+    defer std.crypto.secureZero(u8, &mk);
+    keystore.generateMasterKey(io, &mk) catch {
+        state.cryptoAbort();
+        return ck.CKR_FUNCTION_FAILED;
+    };
+    const wrapped = keystore.wrap(io, allocator, pinSlice(pPin, ulPinLen), &mk) catch {
+        state.cryptoAbort();
+        return ck.CKR_FUNCTION_FAILED;
+    };
+
+    state.mutex.lock();
+    defer state.mutex.unlock();
+    state.cryptoEnd();
+    inst.token.user = .{ .salt = salt, .hash = hash };
+    inst.token.user_mk = wrapped;
+    inst.token.user_fail = 0;
+    state.bumpGeneration();
+    token.save(inst.io(), inst.token) catch {};
+    return ck.CKR_OK;
+}
+
+pub fn C_SetPIN(hSession: ck.CK_SESSION_HANDLE, pOldPin: ?[*]ck.CK_UTF8CHAR, ulOldLen: ck.CK_ULONG, pNewPin: ?[*]ck.CK_UTF8CHAR, ulNewLen: ck.CK_ULONG) callconv(.c) ck.CK_RV {
+    const inst = state.acquire() orelse return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+
+    const sess = inst.sessions.get(hSession) orelse {
+        state.mutex.unlock();
+        return ck.CKR_SESSION_HANDLE_INVALID;
+    };
+    if ((sess.flags & ck.CKF_RW_SESSION) == 0) {
+        state.mutex.unlock();
+        return ck.CKR_SESSION_READ_ONLY;
+    }
+    const as_so = inst.logged_in == ck.CKU_SO;
+    var salt: pin.Salt = undefined;
+    var hash: pin.Hash = undefined;
+    var wrapped_mk: ?keystore.Wrapped = null;
+    if (as_so) {
+        if (!inst.token.initialized) {
+            state.mutex.unlock();
+            return ck.CKR_USER_PIN_NOT_INITIALIZED;
+        }
+        salt = inst.token.so.salt;
+        hash = inst.token.so.hash;
+    } else {
+        const u = inst.token.user orelse {
+            state.mutex.unlock();
+            return ck.CKR_USER_PIN_NOT_INITIALIZED;
+        };
+        salt = u.salt;
+        hash = u.hash;
+        wrapped_mk = inst.token.user_mk;
+    }
+    if (!pinLenOk(ulNewLen)) {
+        state.mutex.unlock();
+        return ck.CKR_PIN_LEN_RANGE;
+    }
+    const gen = state.cryptoBegin();
+    const io = inst.io();
+    const allocator = inst.allocator();
+    state.mutex.unlock();
+    defer std.crypto.secureZero(u8, &hash);
+
+    const old_ok = pin.verify(io, allocator, pinSlice(pOldPin, ulOldLen), &salt, &hash) catch {
+        state.cryptoAbort();
+        return ck.CKR_FUNCTION_FAILED;
+    };
+    if (!old_ok) {
+        state.cryptoAbort();
+        return ck.CKR_PIN_INCORRECT;
+    }
+
+    var nsalt: pin.Salt = undefined;
+    pin.genSalt(io, &nsalt) catch {
+        state.cryptoAbort();
+        return ck.CKR_FUNCTION_FAILED;
+    };
+    var nhash: pin.Hash = undefined;
+    defer std.crypto.secureZero(u8, &nhash);
+    pin.derive(io, allocator, pinSlice(pNewPin, ulNewLen), &nsalt, &nhash) catch {
+        state.cryptoAbort();
+        return ck.CKR_FUNCTION_FAILED;
+    };
+
+    var new_mk_wrap: ?keystore.Wrapped = null;
+    if (!as_so) {
+        if (wrapped_mk) |w| {
+            var mk: keystore.MasterKey = undefined;
+            defer std.crypto.secureZero(u8, &mk);
+            const unwrapped = keystore.unwrap(io, allocator, pinSlice(pOldPin, ulOldLen), &w, &mk) catch {
+                state.cryptoAbort();
+                return ck.CKR_FUNCTION_FAILED;
+            };
+            if (!unwrapped) {
+                state.cryptoAbort();
+                return ck.CKR_FUNCTION_FAILED;
+            }
+            new_mk_wrap = keystore.rewrap(io, allocator, pinSlice(pNewPin, ulNewLen), &mk) catch {
+                state.cryptoAbort();
+                return ck.CKR_FUNCTION_FAILED;
+            };
+        }
+    }
+
+    state.mutex.lock();
+    defer state.mutex.unlock();
+    state.cryptoEnd();
+    if (state.currentGeneration() != gen) return ck.CKR_FUNCTION_FAILED;
+    if (as_so) {
+        inst.token.so = .{ .salt = nsalt, .hash = nhash };
+        inst.token.so_fail = 0;
+    } else {
+        inst.token.user = .{ .salt = nsalt, .hash = nhash };
+        if (new_mk_wrap) |w| inst.token.user_mk = w;
+        inst.token.user_fail = 0;
+    }
+    state.bumpGeneration();
+    token.save(inst.io(), inst.token) catch {};
+    return ck.CKR_OK;
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/ck.zig b/PROJECTS/advanced/hsm-emulator/src/ck.zig
new file mode 100644
index 00000000..13300329
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/ck.zig
@@ -0,0 +1,528 @@
+// ©AngelaMos | 2026
+// ck.zig
+
+pub const CK_BYTE = u8;
+pub const CK_CHAR = u8;
+pub const CK_UTF8CHAR = u8;
+pub const CK_BBOOL = u8;
+pub const CK_ULONG = c_ulong;
+pub const CK_LONG = c_long;
+pub const CK_FLAGS = CK_ULONG;
+pub const CK_RV = CK_ULONG;
+pub const CK_SLOT_ID = CK_ULONG;
+pub const CK_SESSION_HANDLE = CK_ULONG;
+pub const CK_OBJECT_HANDLE = CK_ULONG;
+pub const CK_OBJECT_CLASS = CK_ULONG;
+pub const CK_KEY_TYPE = CK_ULONG;
+pub const CK_MECHANISM_TYPE = CK_ULONG;
+pub const CK_ATTRIBUTE_TYPE = CK_ULONG;
+pub const CK_RSA_PKCS_MGF_TYPE = CK_ULONG;
+pub const CK_RSA_PKCS_OAEP_SOURCE_TYPE = CK_ULONG;
+pub const CK_USER_TYPE = CK_ULONG;
+pub const CK_STATE = CK_ULONG;
+pub const CK_NOTIFICATION = CK_ULONG;
+
+pub const CK_TRUE: CK_BBOOL = 1;
+pub const CK_FALSE: CK_BBOOL = 0;
+pub const CK_INVALID_HANDLE: CK_ULONG = 0;
+pub const CK_UNAVAILABLE_INFORMATION: CK_ULONG = ~@as(CK_ULONG, 0);
+pub const CK_EFFECTIVELY_INFINITE: CK_ULONG = 0;
+
+pub const CKR_OK: CK_RV = 0x00000000;
+pub const CKR_CANCEL: CK_RV = 0x00000001;
+pub const CKR_HOST_MEMORY: CK_RV = 0x00000002;
+pub const CKR_SLOT_ID_INVALID: CK_RV = 0x00000003;
+pub const CKR_GENERAL_ERROR: CK_RV = 0x00000005;
+pub const CKR_FUNCTION_FAILED: CK_RV = 0x00000006;
+pub const CKR_ARGUMENTS_BAD: CK_RV = 0x00000007;
+pub const CKR_NO_EVENT: CK_RV = 0x00000008;
+pub const CKR_NEED_TO_CREATE_THREADS: CK_RV = 0x00000009;
+pub const CKR_CANT_LOCK: CK_RV = 0x0000000A;
+pub const CKR_ATTRIBUTE_READ_ONLY: CK_RV = 0x00000010;
+pub const CKR_ATTRIBUTE_SENSITIVE: CK_RV = 0x00000011;
+pub const CKR_ATTRIBUTE_TYPE_INVALID: CK_RV = 0x00000012;
+pub const CKR_ATTRIBUTE_VALUE_INVALID: CK_RV = 0x00000013;
+pub const CKR_ACTION_PROHIBITED: CK_RV = 0x0000001B;
+pub const CKR_DATA_INVALID: CK_RV = 0x00000020;
+pub const CKR_DATA_LEN_RANGE: CK_RV = 0x00000021;
+pub const CKR_DEVICE_ERROR: CK_RV = 0x00000030;
+pub const CKR_DEVICE_MEMORY: CK_RV = 0x00000031;
+pub const CKR_DEVICE_REMOVED: CK_RV = 0x00000032;
+pub const CKR_ENCRYPTED_DATA_INVALID: CK_RV = 0x00000040;
+pub const CKR_ENCRYPTED_DATA_LEN_RANGE: CK_RV = 0x00000041;
+pub const CKR_FUNCTION_CANCELED: CK_RV = 0x00000050;
+pub const CKR_FUNCTION_NOT_PARALLEL: CK_RV = 0x00000051;
+pub const CKR_FUNCTION_NOT_SUPPORTED: CK_RV = 0x00000054;
+pub const CKR_KEY_HANDLE_INVALID: CK_RV = 0x00000060;
+pub const CKR_KEY_SIZE_RANGE: CK_RV = 0x00000062;
+pub const CKR_KEY_TYPE_INCONSISTENT: CK_RV = 0x00000063;
+pub const CKR_KEY_NOT_NEEDED: CK_RV = 0x00000064;
+pub const CKR_KEY_INDIGESTIBLE: CK_RV = 0x00000067;
+pub const CKR_KEY_FUNCTION_NOT_PERMITTED: CK_RV = 0x00000068;
+pub const CKR_KEY_NOT_WRAPPABLE: CK_RV = 0x00000069;
+pub const CKR_KEY_UNEXTRACTABLE: CK_RV = 0x0000006A;
+pub const CKR_MECHANISM_INVALID: CK_RV = 0x00000070;
+pub const CKR_MECHANISM_PARAM_INVALID: CK_RV = 0x00000071;
+pub const CKR_OBJECT_HANDLE_INVALID: CK_RV = 0x00000082;
+pub const CKR_OPERATION_ACTIVE: CK_RV = 0x00000090;
+pub const CKR_OPERATION_NOT_INITIALIZED: CK_RV = 0x00000091;
+pub const CKR_PIN_INCORRECT: CK_RV = 0x000000A0;
+pub const CKR_PIN_INVALID: CK_RV = 0x000000A1;
+pub const CKR_PIN_LEN_RANGE: CK_RV = 0x000000A2;
+pub const CKR_PIN_EXPIRED: CK_RV = 0x000000A3;
+pub const CKR_PIN_LOCKED: CK_RV = 0x000000A4;
+pub const CKR_SESSION_CLOSED: CK_RV = 0x000000B0;
+pub const CKR_SESSION_COUNT: CK_RV = 0x000000B1;
+pub const CKR_SESSION_HANDLE_INVALID: CK_RV = 0x000000B3;
+pub const CKR_SESSION_PARALLEL_NOT_SUPPORTED: CK_RV = 0x000000B4;
+pub const CKR_SESSION_READ_ONLY: CK_RV = 0x000000B5;
+pub const CKR_SESSION_EXISTS: CK_RV = 0x000000B6;
+pub const CKR_SESSION_READ_ONLY_EXISTS: CK_RV = 0x000000B7;
+pub const CKR_SESSION_READ_WRITE_SO_EXISTS: CK_RV = 0x000000B8;
+pub const CKR_SIGNATURE_INVALID: CK_RV = 0x000000C0;
+pub const CKR_SIGNATURE_LEN_RANGE: CK_RV = 0x000000C1;
+pub const CKR_TEMPLATE_INCOMPLETE: CK_RV = 0x000000D0;
+pub const CKR_TEMPLATE_INCONSISTENT: CK_RV = 0x000000D1;
+pub const CKR_TOKEN_NOT_PRESENT: CK_RV = 0x000000E0;
+pub const CKR_TOKEN_NOT_RECOGNIZED: CK_RV = 0x000000E1;
+pub const CKR_TOKEN_WRITE_PROTECTED: CK_RV = 0x000000E2;
+pub const CKR_UNWRAPPING_KEY_HANDLE_INVALID: CK_RV = 0x000000F0;
+pub const CKR_UNWRAPPING_KEY_SIZE_RANGE: CK_RV = 0x000000F1;
+pub const CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT: CK_RV = 0x000000F2;
+pub const CKR_USER_ALREADY_LOGGED_IN: CK_RV = 0x00000100;
+pub const CKR_USER_NOT_LOGGED_IN: CK_RV = 0x00000101;
+pub const CKR_USER_PIN_NOT_INITIALIZED: CK_RV = 0x00000102;
+pub const CKR_USER_TYPE_INVALID: CK_RV = 0x00000103;
+pub const CKR_USER_ANOTHER_ALREADY_LOGGED_IN: CK_RV = 0x00000104;
+pub const CKR_USER_TOO_MANY_TYPES: CK_RV = 0x00000105;
+pub const CKR_WRAPPED_KEY_INVALID: CK_RV = 0x00000110;
+pub const CKR_WRAPPED_KEY_LEN_RANGE: CK_RV = 0x00000112;
+pub const CKR_WRAPPING_KEY_HANDLE_INVALID: CK_RV = 0x00000113;
+pub const CKR_WRAPPING_KEY_SIZE_RANGE: CK_RV = 0x00000114;
+pub const CKR_WRAPPING_KEY_TYPE_INCONSISTENT: CK_RV = 0x00000115;
+pub const CKR_RANDOM_SEED_NOT_SUPPORTED: CK_RV = 0x00000120;
+pub const CKR_RANDOM_NO_RNG: CK_RV = 0x00000121;
+pub const CKR_DOMAIN_PARAMS_INVALID: CK_RV = 0x00000130;
+pub const CKR_BUFFER_TOO_SMALL: CK_RV = 0x00000150;
+pub const CKR_SAVED_STATE_INVALID: CK_RV = 0x00000160;
+pub const CKR_INFORMATION_SENSITIVE: CK_RV = 0x00000170;
+pub const CKR_STATE_UNSAVEABLE: CK_RV = 0x00000180;
+pub const CKR_CRYPTOKI_NOT_INITIALIZED: CK_RV = 0x00000190;
+pub const CKR_CRYPTOKI_ALREADY_INITIALIZED: CK_RV = 0x00000191;
+pub const CKR_MUTEX_BAD: CK_RV = 0x000001A0;
+pub const CKR_MUTEX_NOT_LOCKED: CK_RV = 0x000001A1;
+pub const CKR_FUNCTION_REJECTED: CK_RV = 0x00000200;
+
+pub const CKU_SO: CK_USER_TYPE = 0;
+pub const CKU_USER: CK_USER_TYPE = 1;
+pub const CKU_CONTEXT_SPECIFIC: CK_USER_TYPE = 2;
+
+pub const CKS_RO_PUBLIC_SESSION: CK_STATE = 0;
+pub const CKS_RO_USER_FUNCTIONS: CK_STATE = 1;
+pub const CKS_RW_PUBLIC_SESSION: CK_STATE = 2;
+pub const CKS_RW_USER_FUNCTIONS: CK_STATE = 3;
+pub const CKS_RW_SO_FUNCTIONS: CK_STATE = 4;
+
+pub const CKO_DATA: CK_OBJECT_CLASS = 0x00000000;
+pub const CKO_CERTIFICATE: CK_OBJECT_CLASS = 0x00000001;
+pub const CKO_PUBLIC_KEY: CK_OBJECT_CLASS = 0x00000002;
+pub const CKO_PRIVATE_KEY: CK_OBJECT_CLASS = 0x00000003;
+pub const CKO_SECRET_KEY: CK_OBJECT_CLASS = 0x00000004;
+pub const CKO_HW_FEATURE: CK_OBJECT_CLASS = 0x00000005;
+pub const CKO_DOMAIN_PARAMETERS: CK_OBJECT_CLASS = 0x00000006;
+pub const CKO_MECHANISM: CK_OBJECT_CLASS = 0x00000007;
+
+pub const CKK_RSA: CK_KEY_TYPE = 0x00000000;
+pub const CKK_DSA: CK_KEY_TYPE = 0x00000001;
+pub const CKK_DH: CK_KEY_TYPE = 0x00000002;
+pub const CKK_EC: CK_KEY_TYPE = 0x00000003;
+pub const CKK_GENERIC_SECRET: CK_KEY_TYPE = 0x00000010;
+pub const CKK_AES: CK_KEY_TYPE = 0x0000001F;
+pub const CKK_SHA256_HMAC: CK_KEY_TYPE = 0x0000002B;
+pub const CKK_SHA384_HMAC: CK_KEY_TYPE = 0x0000002C;
+pub const CKK_SHA512_HMAC: CK_KEY_TYPE = 0x0000002D;
+
+pub const CKM_RSA_PKCS_KEY_PAIR_GEN: CK_MECHANISM_TYPE = 0x00000000;
+pub const CKM_RSA_PKCS: CK_MECHANISM_TYPE = 0x00000001;
+pub const CKM_RSA_PKCS_OAEP: CK_MECHANISM_TYPE = 0x00000009;
+pub const CKM_RSA_PKCS_PSS: CK_MECHANISM_TYPE = 0x0000000D;
+pub const CKM_SHA256_RSA_PKCS: CK_MECHANISM_TYPE = 0x00000040;
+pub const CKM_SHA384_RSA_PKCS: CK_MECHANISM_TYPE = 0x00000041;
+pub const CKM_SHA512_RSA_PKCS: CK_MECHANISM_TYPE = 0x00000042;
+pub const CKM_SHA256_RSA_PKCS_PSS: CK_MECHANISM_TYPE = 0x00000043;
+pub const CKM_SHA384_RSA_PKCS_PSS: CK_MECHANISM_TYPE = 0x00000044;
+pub const CKM_SHA512_RSA_PKCS_PSS: CK_MECHANISM_TYPE = 0x00000045;
+pub const CKM_SHA256: CK_MECHANISM_TYPE = 0x00000250;
+pub const CKM_SHA256_HMAC: CK_MECHANISM_TYPE = 0x00000251;
+pub const CKM_SHA384: CK_MECHANISM_TYPE = 0x00000260;
+pub const CKM_SHA384_HMAC: CK_MECHANISM_TYPE = 0x00000261;
+pub const CKM_SHA512: CK_MECHANISM_TYPE = 0x00000270;
+pub const CKM_SHA512_HMAC: CK_MECHANISM_TYPE = 0x00000271;
+pub const CKM_EC_KEY_PAIR_GEN: CK_MECHANISM_TYPE = 0x00001040;
+pub const CKM_ECDSA: CK_MECHANISM_TYPE = 0x00001041;
+pub const CKM_ECDSA_SHA256: CK_MECHANISM_TYPE = 0x00001044;
+pub const CKM_ECDSA_SHA384: CK_MECHANISM_TYPE = 0x00001045;
+pub const CKM_ECDSA_SHA512: CK_MECHANISM_TYPE = 0x00001046;
+pub const CKM_ECDH1_DERIVE: CK_MECHANISM_TYPE = 0x00001050;
+pub const CKM_AES_KEY_GEN: CK_MECHANISM_TYPE = 0x00001080;
+pub const CKM_AES_CBC: CK_MECHANISM_TYPE = 0x00001082;
+pub const CKM_AES_CBC_PAD: CK_MECHANISM_TYPE = 0x00001085;
+pub const CKM_AES_GCM: CK_MECHANISM_TYPE = 0x00001087;
+pub const CKM_AES_KEY_WRAP: CK_MECHANISM_TYPE = 0x00002109;
+
+pub const CKA_CLASS: CK_ATTRIBUTE_TYPE = 0x00000000;
+pub const CKA_TOKEN: CK_ATTRIBUTE_TYPE = 0x00000001;
+pub const CKA_PRIVATE: CK_ATTRIBUTE_TYPE = 0x00000002;
+pub const CKA_LABEL: CK_ATTRIBUTE_TYPE = 0x00000003;
+pub const CKA_VALUE: CK_ATTRIBUTE_TYPE = 0x00000011;
+pub const CKA_CERTIFICATE_TYPE: CK_ATTRIBUTE_TYPE = 0x00000080;
+pub const CKA_KEY_TYPE: CK_ATTRIBUTE_TYPE = 0x00000100;
+pub const CKA_ID: CK_ATTRIBUTE_TYPE = 0x00000102;
+pub const CKA_SENSITIVE: CK_ATTRIBUTE_TYPE = 0x00000103;
+pub const CKA_ENCRYPT: CK_ATTRIBUTE_TYPE = 0x00000104;
+pub const CKA_DECRYPT: CK_ATTRIBUTE_TYPE = 0x00000105;
+pub const CKA_WRAP: CK_ATTRIBUTE_TYPE = 0x00000106;
+pub const CKA_UNWRAP: CK_ATTRIBUTE_TYPE = 0x00000107;
+pub const CKA_SIGN: CK_ATTRIBUTE_TYPE = 0x00000108;
+pub const CKA_SIGN_RECOVER: CK_ATTRIBUTE_TYPE = 0x00000109;
+pub const CKA_VERIFY: CK_ATTRIBUTE_TYPE = 0x0000010A;
+pub const CKA_VERIFY_RECOVER: CK_ATTRIBUTE_TYPE = 0x0000010B;
+pub const CKA_DERIVE: CK_ATTRIBUTE_TYPE = 0x0000010C;
+pub const CKA_MODULUS: CK_ATTRIBUTE_TYPE = 0x00000120;
+pub const CKA_MODULUS_BITS: CK_ATTRIBUTE_TYPE = 0x00000121;
+pub const CKA_PUBLIC_EXPONENT: CK_ATTRIBUTE_TYPE = 0x00000122;
+pub const CKA_PRIVATE_EXPONENT: CK_ATTRIBUTE_TYPE = 0x00000123;
+pub const CKA_PRIME_1: CK_ATTRIBUTE_TYPE = 0x00000124;
+pub const CKA_PRIME_2: CK_ATTRIBUTE_TYPE = 0x00000125;
+pub const CKA_EXPONENT_1: CK_ATTRIBUTE_TYPE = 0x00000126;
+pub const CKA_EXPONENT_2: CK_ATTRIBUTE_TYPE = 0x00000127;
+pub const CKA_COEFFICIENT: CK_ATTRIBUTE_TYPE = 0x00000128;
+pub const CKA_VALUE_LEN: CK_ATTRIBUTE_TYPE = 0x00000161;
+pub const CKA_EXTRACTABLE: CK_ATTRIBUTE_TYPE = 0x00000162;
+pub const CKA_LOCAL: CK_ATTRIBUTE_TYPE = 0x00000163;
+pub const CKA_NEVER_EXTRACTABLE: CK_ATTRIBUTE_TYPE = 0x00000164;
+pub const CKA_ALWAYS_SENSITIVE: CK_ATTRIBUTE_TYPE = 0x00000165;
+pub const CKA_KEY_GEN_MECHANISM: CK_ATTRIBUTE_TYPE = 0x00000166;
+pub const CKA_MODIFIABLE: CK_ATTRIBUTE_TYPE = 0x00000170;
+pub const CKA_COPYABLE: CK_ATTRIBUTE_TYPE = 0x00000171;
+pub const CKA_DESTROYABLE: CK_ATTRIBUTE_TYPE = 0x00000172;
+pub const CKA_EC_PARAMS: CK_ATTRIBUTE_TYPE = 0x00000180;
+pub const CKA_EC_POINT: CK_ATTRIBUTE_TYPE = 0x00000181;
+pub const CKA_ALWAYS_AUTHENTICATE: CK_ATTRIBUTE_TYPE = 0x00000202;
+
+pub const CKF_TOKEN_PRESENT: CK_FLAGS = 0x00000001;
+pub const CKF_REMOVABLE_DEVICE: CK_FLAGS = 0x00000002;
+pub const CKF_HW_SLOT: CK_FLAGS = 0x00000004;
+
+pub const CKF_RNG: CK_FLAGS = 0x00000001;
+pub const CKF_WRITE_PROTECTED: CK_FLAGS = 0x00000002;
+pub const CKF_LOGIN_REQUIRED: CK_FLAGS = 0x00000004;
+pub const CKF_USER_PIN_INITIALIZED: CK_FLAGS = 0x00000008;
+pub const CKF_RESTORE_KEY_NOT_NEEDED: CK_FLAGS = 0x00000020;
+pub const CKF_CLOCK_ON_TOKEN: CK_FLAGS = 0x00000040;
+pub const CKF_PROTECTED_AUTHENTICATION_PATH: CK_FLAGS = 0x00000100;
+pub const CKF_DUAL_CRYPTO_OPERATIONS: CK_FLAGS = 0x00000200;
+pub const CKF_TOKEN_INITIALIZED: CK_FLAGS = 0x00000400;
+pub const CKF_USER_PIN_COUNT_LOW: CK_FLAGS = 0x00010000;
+pub const CKF_USER_PIN_FINAL_TRY: CK_FLAGS = 0x00020000;
+pub const CKF_USER_PIN_LOCKED: CK_FLAGS = 0x00040000;
+pub const CKF_SO_PIN_COUNT_LOW: CK_FLAGS = 0x00100000;
+pub const CKF_SO_PIN_FINAL_TRY: CK_FLAGS = 0x00200000;
+pub const CKF_SO_PIN_LOCKED: CK_FLAGS = 0x00400000;
+
+pub const CKF_RW_SESSION: CK_FLAGS = 0x00000002;
+pub const CKF_SERIAL_SESSION: CK_FLAGS = 0x00000004;
+
+pub const CKF_HW: CK_FLAGS = 0x00000001;
+pub const CKF_ENCRYPT: CK_FLAGS = 0x00000100;
+pub const CKF_DECRYPT: CK_FLAGS = 0x00000200;
+pub const CKF_DIGEST: CK_FLAGS = 0x00000400;
+pub const CKF_SIGN: CK_FLAGS = 0x00000800;
+pub const CKF_SIGN_RECOVER: CK_FLAGS = 0x00001000;
+pub const CKF_VERIFY: CK_FLAGS = 0x00002000;
+pub const CKF_VERIFY_RECOVER: CK_FLAGS = 0x00004000;
+pub const CKF_GENERATE: CK_FLAGS = 0x00008000;
+pub const CKF_GENERATE_KEY_PAIR: CK_FLAGS = 0x00010000;
+pub const CKF_WRAP: CK_FLAGS = 0x00020000;
+pub const CKF_UNWRAP: CK_FLAGS = 0x00040000;
+pub const CKF_DERIVE: CK_FLAGS = 0x00080000;
+pub const CKF_EC_F_P: CK_FLAGS = 0x00100000;
+pub const CKF_EC_NAMEDCURVE: CK_FLAGS = 0x00800000;
+pub const CKF_EC_UNCOMPRESS: CK_FLAGS = 0x01000000;
+pub const CKF_EC_COMPRESS: CK_FLAGS = 0x02000000;
+
+pub const CKF_LIBRARY_CANT_CREATE_OS_THREADS: CK_FLAGS = 0x00000001;
+pub const CKF_OS_LOCKING_OK: CK_FLAGS = 0x00000002;
+
+pub const CKF_DONT_BLOCK: CK_FLAGS = 0x00000001;
+
+pub const CKG_MGF1_SHA1: CK_RSA_PKCS_MGF_TYPE = 0x00000001;
+pub const CKG_MGF1_SHA256: CK_RSA_PKCS_MGF_TYPE = 0x00000002;
+pub const CKG_MGF1_SHA384: CK_RSA_PKCS_MGF_TYPE = 0x00000003;
+pub const CKG_MGF1_SHA512: CK_RSA_PKCS_MGF_TYPE = 0x00000004;
+
+pub const CKZ_DATA_SPECIFIED: CK_RSA_PKCS_OAEP_SOURCE_TYPE = 0x00000001;
+
+pub const CK_VERSION = extern struct {
+    major: CK_BYTE,
+    minor: CK_BYTE,
+};
+
+pub const CK_INFO = extern struct {
+    cryptokiVersion: CK_VERSION,
+    manufacturerID: [32]CK_UTF8CHAR,
+    flags: CK_FLAGS,
+    libraryDescription: [32]CK_UTF8CHAR,
+    libraryVersion: CK_VERSION,
+};
+
+pub const CK_SLOT_INFO = extern struct {
+    slotDescription: [64]CK_UTF8CHAR,
+    manufacturerID: [32]CK_UTF8CHAR,
+    flags: CK_FLAGS,
+    hardwareVersion: CK_VERSION,
+    firmwareVersion: CK_VERSION,
+};
+
+pub const CK_TOKEN_INFO = extern struct {
+    label: [32]CK_UTF8CHAR,
+    manufacturerID: [32]CK_UTF8CHAR,
+    model: [16]CK_UTF8CHAR,
+    serialNumber: [16]CK_CHAR,
+    flags: CK_FLAGS,
+    ulMaxSessionCount: CK_ULONG,
+    ulSessionCount: CK_ULONG,
+    ulMaxRwSessionCount: CK_ULONG,
+    ulRwSessionCount: CK_ULONG,
+    ulMaxPinLen: CK_ULONG,
+    ulMinPinLen: CK_ULONG,
+    ulTotalPublicMemory: CK_ULONG,
+    ulFreePublicMemory: CK_ULONG,
+    ulTotalPrivateMemory: CK_ULONG,
+    ulFreePrivateMemory: CK_ULONG,
+    hardwareVersion: CK_VERSION,
+    firmwareVersion: CK_VERSION,
+    utcTime: [16]CK_CHAR,
+};
+
+pub const CK_SESSION_INFO = extern struct {
+    slotID: CK_SLOT_ID,
+    state: CK_STATE,
+    flags: CK_FLAGS,
+    ulDeviceError: CK_ULONG,
+};
+
+pub const CK_MECHANISM_INFO = extern struct {
+    ulMinKeySize: CK_ULONG,
+    ulMaxKeySize: CK_ULONG,
+    flags: CK_FLAGS,
+};
+
+pub const CK_ATTRIBUTE = extern struct {
+    type: CK_ATTRIBUTE_TYPE,
+    pValue: ?*anyopaque,
+    ulValueLen: CK_ULONG,
+};
+
+pub const CK_MECHANISM = extern struct {
+    mechanism: CK_MECHANISM_TYPE,
+    pParameter: ?*anyopaque,
+    ulParameterLen: CK_ULONG,
+};
+
+pub const CK_GCM_PARAMS = extern struct {
+    pIv: ?[*]CK_BYTE,
+    ulIvLen: CK_ULONG,
+    ulIvBits: CK_ULONG,
+    pAAD: ?[*]CK_BYTE,
+    ulAADLen: CK_ULONG,
+    ulTagBits: CK_ULONG,
+};
+
+pub const CK_RSA_PKCS_PSS_PARAMS = extern struct {
+    hashAlg: CK_MECHANISM_TYPE,
+    mgf: CK_RSA_PKCS_MGF_TYPE,
+    sLen: CK_ULONG,
+};
+
+pub const CK_RSA_PKCS_OAEP_PARAMS = extern struct {
+    hashAlg: CK_MECHANISM_TYPE,
+    mgf: CK_RSA_PKCS_MGF_TYPE,
+    source: CK_RSA_PKCS_OAEP_SOURCE_TYPE,
+    pSourceData: ?*anyopaque,
+    ulSourceDataLen: CK_ULONG,
+};
+
+pub const CK_EC_KDF_TYPE = CK_ULONG;
+pub const CKD_NULL: CK_EC_KDF_TYPE = 0x00000001;
+
+pub const CK_ECDH1_DERIVE_PARAMS = extern struct {
+    kdf: CK_EC_KDF_TYPE,
+    ulSharedDataLen: CK_ULONG,
+    pSharedData: ?[*]CK_BYTE,
+    ulPublicDataLen: CK_ULONG,
+    pPublicData: ?[*]CK_BYTE,
+};
+
+pub const CK_DATE = extern struct {
+    year: [4]CK_CHAR,
+    month: [2]CK_CHAR,
+    day: [2]CK_CHAR,
+};
+
+pub const CK_NOTIFY = ?*const fn (CK_SESSION_HANDLE, CK_NOTIFICATION, ?*anyopaque) callconv(.c) CK_RV;
+
+pub const CK_CREATEMUTEX = ?*const fn (*?*anyopaque) callconv(.c) CK_RV;
+pub const CK_DESTROYMUTEX = ?*const fn (?*anyopaque) callconv(.c) CK_RV;
+pub const CK_LOCKMUTEX = ?*const fn (?*anyopaque) callconv(.c) CK_RV;
+pub const CK_UNLOCKMUTEX = ?*const fn (?*anyopaque) callconv(.c) CK_RV;
+
+pub const CK_C_INITIALIZE_ARGS = extern struct {
+    CreateMutex: CK_CREATEMUTEX,
+    DestroyMutex: CK_DESTROYMUTEX,
+    LockMutex: CK_LOCKMUTEX,
+    UnlockMutex: CK_UNLOCKMUTEX,
+    flags: CK_FLAGS,
+    pReserved: ?*anyopaque,
+};
+
+pub const CK_C_Initialize = ?*const fn (?*anyopaque) callconv(.c) CK_RV;
+pub const CK_C_Finalize = ?*const fn (?*anyopaque) callconv(.c) CK_RV;
+pub const CK_C_GetInfo = ?*const fn (*CK_INFO) callconv(.c) CK_RV;
+pub const CK_C_GetFunctionList = ?*const fn (*?*CK_FUNCTION_LIST) callconv(.c) CK_RV;
+pub const CK_C_GetSlotList = ?*const fn (CK_BBOOL, ?[*]CK_SLOT_ID, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_GetSlotInfo = ?*const fn (CK_SLOT_ID, *CK_SLOT_INFO) callconv(.c) CK_RV;
+pub const CK_C_GetTokenInfo = ?*const fn (CK_SLOT_ID, *CK_TOKEN_INFO) callconv(.c) CK_RV;
+pub const CK_C_GetMechanismList = ?*const fn (CK_SLOT_ID, ?[*]CK_MECHANISM_TYPE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_GetMechanismInfo = ?*const fn (CK_SLOT_ID, CK_MECHANISM_TYPE, *CK_MECHANISM_INFO) callconv(.c) CK_RV;
+pub const CK_C_InitToken = ?*const fn (CK_SLOT_ID, ?[*]CK_UTF8CHAR, CK_ULONG, ?[*]CK_UTF8CHAR) callconv(.c) CK_RV;
+pub const CK_C_InitPIN = ?*const fn (CK_SESSION_HANDLE, ?[*]CK_UTF8CHAR, CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_SetPIN = ?*const fn (CK_SESSION_HANDLE, ?[*]CK_UTF8CHAR, CK_ULONG, ?[*]CK_UTF8CHAR, CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_OpenSession = ?*const fn (CK_SLOT_ID, CK_FLAGS, ?*anyopaque, CK_NOTIFY, *CK_SESSION_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_CloseSession = ?*const fn (CK_SESSION_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_CloseAllSessions = ?*const fn (CK_SLOT_ID) callconv(.c) CK_RV;
+pub const CK_C_GetSessionInfo = ?*const fn (CK_SESSION_HANDLE, *CK_SESSION_INFO) callconv(.c) CK_RV;
+pub const CK_C_GetOperationState = ?*const fn (CK_SESSION_HANDLE, ?[*]CK_BYTE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_SetOperationState = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG, CK_OBJECT_HANDLE, CK_OBJECT_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_Login = ?*const fn (CK_SESSION_HANDLE, CK_USER_TYPE, ?[*]CK_UTF8CHAR, CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_Logout = ?*const fn (CK_SESSION_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_CreateObject = ?*const fn (CK_SESSION_HANDLE, [*]CK_ATTRIBUTE, CK_ULONG, *CK_OBJECT_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_CopyObject = ?*const fn (CK_SESSION_HANDLE, CK_OBJECT_HANDLE, [*]CK_ATTRIBUTE, CK_ULONG, *CK_OBJECT_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_DestroyObject = ?*const fn (CK_SESSION_HANDLE, CK_OBJECT_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_GetObjectSize = ?*const fn (CK_SESSION_HANDLE, CK_OBJECT_HANDLE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_GetAttributeValue = ?*const fn (CK_SESSION_HANDLE, CK_OBJECT_HANDLE, [*]CK_ATTRIBUTE, CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_SetAttributeValue = ?*const fn (CK_SESSION_HANDLE, CK_OBJECT_HANDLE, [*]CK_ATTRIBUTE, CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_FindObjectsInit = ?*const fn (CK_SESSION_HANDLE, ?[*]CK_ATTRIBUTE, CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_FindObjects = ?*const fn (CK_SESSION_HANDLE, [*]CK_OBJECT_HANDLE, CK_ULONG, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_FindObjectsFinal = ?*const fn (CK_SESSION_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_EncryptInit = ?*const fn (CK_SESSION_HANDLE, *CK_MECHANISM, CK_OBJECT_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_Encrypt = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG, ?[*]CK_BYTE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_EncryptUpdate = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG, ?[*]CK_BYTE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_EncryptFinal = ?*const fn (CK_SESSION_HANDLE, ?[*]CK_BYTE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_DecryptInit = ?*const fn (CK_SESSION_HANDLE, *CK_MECHANISM, CK_OBJECT_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_Decrypt = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG, ?[*]CK_BYTE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_DecryptUpdate = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG, ?[*]CK_BYTE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_DecryptFinal = ?*const fn (CK_SESSION_HANDLE, ?[*]CK_BYTE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_DigestInit = ?*const fn (CK_SESSION_HANDLE, *CK_MECHANISM) callconv(.c) CK_RV;
+pub const CK_C_Digest = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG, ?[*]CK_BYTE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_DigestUpdate = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_DigestKey = ?*const fn (CK_SESSION_HANDLE, CK_OBJECT_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_DigestFinal = ?*const fn (CK_SESSION_HANDLE, ?[*]CK_BYTE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_SignInit = ?*const fn (CK_SESSION_HANDLE, *CK_MECHANISM, CK_OBJECT_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_Sign = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG, ?[*]CK_BYTE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_SignUpdate = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_SignFinal = ?*const fn (CK_SESSION_HANDLE, ?[*]CK_BYTE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_SignRecoverInit = ?*const fn (CK_SESSION_HANDLE, *CK_MECHANISM, CK_OBJECT_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_SignRecover = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG, ?[*]CK_BYTE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_VerifyInit = ?*const fn (CK_SESSION_HANDLE, *CK_MECHANISM, CK_OBJECT_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_Verify = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG, [*]CK_BYTE, CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_VerifyUpdate = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_VerifyFinal = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_VerifyRecoverInit = ?*const fn (CK_SESSION_HANDLE, *CK_MECHANISM, CK_OBJECT_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_VerifyRecover = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG, ?[*]CK_BYTE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_DigestEncryptUpdate = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG, ?[*]CK_BYTE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_DecryptDigestUpdate = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG, ?[*]CK_BYTE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_SignEncryptUpdate = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG, ?[*]CK_BYTE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_DecryptVerifyUpdate = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG, ?[*]CK_BYTE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_GenerateKey = ?*const fn (CK_SESSION_HANDLE, *CK_MECHANISM, [*]CK_ATTRIBUTE, CK_ULONG, *CK_OBJECT_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_GenerateKeyPair = ?*const fn (CK_SESSION_HANDLE, *CK_MECHANISM, [*]CK_ATTRIBUTE, CK_ULONG, [*]CK_ATTRIBUTE, CK_ULONG, *CK_OBJECT_HANDLE, *CK_OBJECT_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_WrapKey = ?*const fn (CK_SESSION_HANDLE, *CK_MECHANISM, CK_OBJECT_HANDLE, CK_OBJECT_HANDLE, ?[*]CK_BYTE, *CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_UnwrapKey = ?*const fn (CK_SESSION_HANDLE, *CK_MECHANISM, CK_OBJECT_HANDLE, [*]CK_BYTE, CK_ULONG, [*]CK_ATTRIBUTE, CK_ULONG, *CK_OBJECT_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_DeriveKey = ?*const fn (CK_SESSION_HANDLE, *CK_MECHANISM, CK_OBJECT_HANDLE, ?[*]CK_ATTRIBUTE, CK_ULONG, *CK_OBJECT_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_SeedRandom = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_GenerateRandom = ?*const fn (CK_SESSION_HANDLE, [*]CK_BYTE, CK_ULONG) callconv(.c) CK_RV;
+pub const CK_C_GetFunctionStatus = ?*const fn (CK_SESSION_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_CancelFunction = ?*const fn (CK_SESSION_HANDLE) callconv(.c) CK_RV;
+pub const CK_C_WaitForSlotEvent = ?*const fn (CK_FLAGS, *CK_SLOT_ID, ?*anyopaque) callconv(.c) CK_RV;
+
+pub const CK_FUNCTION_LIST = extern struct {
+    version: CK_VERSION,
+    C_Initialize: CK_C_Initialize,
+    C_Finalize: CK_C_Finalize,
+    C_GetInfo: CK_C_GetInfo,
+    C_GetFunctionList: CK_C_GetFunctionList,
+    C_GetSlotList: CK_C_GetSlotList,
+    C_GetSlotInfo: CK_C_GetSlotInfo,
+    C_GetTokenInfo: CK_C_GetTokenInfo,
+    C_GetMechanismList: CK_C_GetMechanismList,
+    C_GetMechanismInfo: CK_C_GetMechanismInfo,
+    C_InitToken: CK_C_InitToken,
+    C_InitPIN: CK_C_InitPIN,
+    C_SetPIN: CK_C_SetPIN,
+    C_OpenSession: CK_C_OpenSession,
+    C_CloseSession: CK_C_CloseSession,
+    C_CloseAllSessions: CK_C_CloseAllSessions,
+    C_GetSessionInfo: CK_C_GetSessionInfo,
+    C_GetOperationState: CK_C_GetOperationState,
+    C_SetOperationState: CK_C_SetOperationState,
+    C_Login: CK_C_Login,
+    C_Logout: CK_C_Logout,
+    C_CreateObject: CK_C_CreateObject,
+    C_CopyObject: CK_C_CopyObject,
+    C_DestroyObject: CK_C_DestroyObject,
+    C_GetObjectSize: CK_C_GetObjectSize,
+    C_GetAttributeValue: CK_C_GetAttributeValue,
+    C_SetAttributeValue: CK_C_SetAttributeValue,
+    C_FindObjectsInit: CK_C_FindObjectsInit,
+    C_FindObjects: CK_C_FindObjects,
+    C_FindObjectsFinal: CK_C_FindObjectsFinal,
+    C_EncryptInit: CK_C_EncryptInit,
+    C_Encrypt: CK_C_Encrypt,
+    C_EncryptUpdate: CK_C_EncryptUpdate,
+    C_EncryptFinal: CK_C_EncryptFinal,
+    C_DecryptInit: CK_C_DecryptInit,
+    C_Decrypt: CK_C_Decrypt,
+    C_DecryptUpdate: CK_C_DecryptUpdate,
+    C_DecryptFinal: CK_C_DecryptFinal,
+    C_DigestInit: CK_C_DigestInit,
+    C_Digest: CK_C_Digest,
+    C_DigestUpdate: CK_C_DigestUpdate,
+    C_DigestKey: CK_C_DigestKey,
+    C_DigestFinal: CK_C_DigestFinal,
+    C_SignInit: CK_C_SignInit,
+    C_Sign: CK_C_Sign,
+    C_SignUpdate: CK_C_SignUpdate,
+    C_SignFinal: CK_C_SignFinal,
+    C_SignRecoverInit: CK_C_SignRecoverInit,
+    C_SignRecover: CK_C_SignRecover,
+    C_VerifyInit: CK_C_VerifyInit,
+    C_Verify: CK_C_Verify,
+    C_VerifyUpdate: CK_C_VerifyUpdate,
+    C_VerifyFinal: CK_C_VerifyFinal,
+    C_VerifyRecoverInit: CK_C_VerifyRecoverInit,
+    C_VerifyRecover: CK_C_VerifyRecover,
+    C_DigestEncryptUpdate: CK_C_DigestEncryptUpdate,
+    C_DecryptDigestUpdate: CK_C_DecryptDigestUpdate,
+    C_SignEncryptUpdate: CK_C_SignEncryptUpdate,
+    C_DecryptVerifyUpdate: CK_C_DecryptVerifyUpdate,
+    C_GenerateKey: CK_C_GenerateKey,
+    C_GenerateKeyPair: CK_C_GenerateKeyPair,
+    C_WrapKey: CK_C_WrapKey,
+    C_UnwrapKey: CK_C_UnwrapKey,
+    C_DeriveKey: CK_C_DeriveKey,
+    C_SeedRandom: CK_C_SeedRandom,
+    C_GenerateRandom: CK_C_GenerateRandom,
+    C_GetFunctionStatus: CK_C_GetFunctionStatus,
+    C_CancelFunction: CK_C_CancelFunction,
+    C_WaitForSlotEvent: CK_C_WaitForSlotEvent,
+};
diff --git a/PROJECTS/advanced/hsm-emulator/src/config.zig b/PROJECTS/advanced/hsm-emulator/src/config.zig
new file mode 100644
index 00000000..b6cb9830
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/config.zig
@@ -0,0 +1,95 @@
+// ©AngelaMos | 2026
+// config.zig
+
+const ck = @import("ck.zig");
+
+pub const cryptoki_version: ck.CK_VERSION = .{ .major = 2, .minor = 40 };
+pub const library_version: ck.CK_VERSION = .{ .major = 0, .minor = 1 };
+pub const hardware_version: ck.CK_VERSION = .{ .major = 1, .minor = 0 };
+pub const firmware_version: ck.CK_VERSION = .{ .major = 0, .minor = 1 };
+
+pub const manufacturer_id = "Angelamos";
+pub const library_description = "Zig HSM Emulator";
+pub const slot_description = "AngelaMos HSM Emulator Slot 0";
+pub const token_label = "AngelaMos-HSM";
+pub const token_model = "hsm-emu";
+pub const token_serial = "0000000000000001";
+
+pub const slot_id: ck.CK_SLOT_ID = 0;
+pub const slot_count: ck.CK_ULONG = 1;
+pub const max_sessions: ck.CK_ULONG = 64;
+
+pub const min_pin_len: ck.CK_ULONG = 4;
+pub const max_pin_len: ck.CK_ULONG = 255;
+
+pub const aes_min_key_bytes: ck.CK_ULONG = 16;
+pub const aes_max_key_bytes: ck.CK_ULONG = 32;
+pub const rsa_min_key_bits: ck.CK_ULONG = 2048;
+pub const rsa_max_key_bits: ck.CK_ULONG = 4096;
+pub const ec_min_key_bits: ck.CK_ULONG = 256;
+pub const ec_max_key_bits: ck.CK_ULONG = 384;
+pub const ec_keygen_max_attempts: usize = 8;
+pub const hmac_min_key_bytes: ck.CK_ULONG = 32;
+pub const hmac_max_key_bytes: ck.CK_ULONG = 64;
+
+pub const pin_kdf_t: u32 = 3;
+pub const pin_kdf_m_kib: u32 = 65536;
+pub const pin_kdf_p: u24 = 1;
+pub const pin_salt_len: usize = 16;
+pub const pin_hash_len: usize = 32;
+
+pub const login_max_attempts: ck.CK_ULONG = 3;
+
+pub const token_path_env = "ANGELAMOS_HSM_TOKEN";
+pub const token_path_default = ".angelamos-hsm-token";
+pub const token_record_magic: u32 = 0x484D5331;
+pub const token_record_version: u32 = 2;
+pub const path_buf_len: usize = 4096;
+pub const token_read_limit: usize = 512;
+pub const label_len: usize = 32;
+
+pub const object_path_env = "ANGELAMOS_HSM_OBJECTS";
+pub const object_path_default = ".angelamos-hsm-objects";
+pub const object_record_magic: u32 = 0x484D4F31;
+pub const object_record_version: u32 = 2;
+pub const object_read_limit: usize = 4 * 1024 * 1024;
+pub const max_objects: usize = 256;
+pub const max_attributes_per_object: usize = 64;
+pub const max_attr_value_len: usize = 64 * 1024;
+
+pub const aes_block_len: usize = 16;
+pub const gcm_iv_len: usize = 12;
+pub const gcm_iv_bits: ck.CK_ULONG = 96;
+pub const gcm_tag_len: usize = 16;
+pub const gcm_tag_bits: ck.CK_ULONG = 128;
+pub const max_gcm_aad_len: usize = 256;
+pub const max_gcm_stream_len: usize = 16 * 1024 * 1024;
+
+pub const master_key_len: usize = 32;
+
+pub const op_state_version: u8 = 1;
+pub const op_state_header_len: usize = 2;
+
+pub const supported_mechanisms = [_]ck.CK_MECHANISM_TYPE{
+    ck.CKM_SHA256,
+    ck.CKM_SHA384,
+    ck.CKM_SHA512,
+    ck.CKM_SHA256_HMAC,
+    ck.CKM_SHA384_HMAC,
+    ck.CKM_SHA512_HMAC,
+    ck.CKM_AES_KEY_GEN,
+    ck.CKM_AES_CBC,
+    ck.CKM_AES_CBC_PAD,
+    ck.CKM_AES_GCM,
+    ck.CKM_EC_KEY_PAIR_GEN,
+    ck.CKM_ECDSA,
+    ck.CKM_ECDSA_SHA256,
+    ck.CKM_ECDH1_DERIVE,
+    ck.CKM_RSA_PKCS_KEY_PAIR_GEN,
+    ck.CKM_RSA_PKCS,
+    ck.CKM_SHA256_RSA_PKCS,
+    ck.CKM_RSA_PKCS_PSS,
+    ck.CKM_SHA256_RSA_PKCS_PSS,
+    ck.CKM_RSA_PKCS_OAEP,
+    ck.CKM_AES_KEY_WRAP,
+};
diff --git a/PROJECTS/advanced/hsm-emulator/src/core/env.zig b/PROJECTS/advanced/hsm-emulator/src/core/env.zig
new file mode 100644
index 00000000..bc20c6b2
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/core/env.zig
@@ -0,0 +1,23 @@
+// ©AngelaMos | 2026
+// env.zig
+
+const std = @import("std");
+
+pub fn get(key: []const u8) ?[]const u8 {
+    var i: usize = 0;
+    while (std.c.environ[i]) |entry| : (i += 1) {
+        const s = std.mem.sliceTo(entry, 0);
+        if (s.len > key.len and s[key.len] == '=' and std.mem.eql(u8, s[0..key.len], key)) {
+            return s[key.len + 1 ..];
+        }
+    }
+    return null;
+}
+
+pub fn resolvePath(buf: []u8, env_key: []const u8, default_rel: []const u8) ![]const u8 {
+    if (get(env_key)) |p| {
+        if (p.len > 0) return p;
+    }
+    const home = get("HOME") orelse return error.NoHomeDir;
+    return std.fmt.bufPrint(buf, "{s}/{s}", .{ home, default_rel });
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/core/lock.zig b/PROJECTS/advanced/hsm-emulator/src/core/lock.zig
new file mode 100644
index 00000000..d53ca112
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/core/lock.zig
@@ -0,0 +1,31 @@
+// ©AngelaMos | 2026
+// lock.zig
+
+const std = @import("std");
+
+const spin_limit: usize = 64;
+
+pub const Lock = struct {
+    state: std.atomic.Mutex = .unlocked,
+
+    pub fn lock(self: *Lock) void {
+        var spins: usize = 0;
+        while (!self.state.tryLock()) {
+            if (spins < spin_limit) {
+                spins += 1;
+                std.atomic.spinLoopHint();
+            } else {
+                spins = 0;
+                std.Thread.yield() catch std.atomic.spinLoopHint();
+            }
+        }
+    }
+
+    pub fn tryLock(self: *Lock) bool {
+        return self.state.tryLock();
+    }
+
+    pub fn unlock(self: *Lock) void {
+        self.state.unlock();
+    }
+};
diff --git a/PROJECTS/advanced/hsm-emulator/src/core/object_store.zig b/PROJECTS/advanced/hsm-emulator/src/core/object_store.zig
new file mode 100644
index 00000000..92af6490
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/core/object_store.zig
@@ -0,0 +1,595 @@
+// ©AngelaMos | 2026
+// object_store.zig
+
+const std = @import("std");
+const ck = @import("../ck.zig");
+const config = @import("../config.zig");
+const env = @import("env.zig");
+const keystore = @import("../crypto/keystore.zig");
+
+fn secureFree(allocator: std.mem.Allocator, value: []u8) void {
+    std.crypto.secureZero(u8, value);
+    allocator.free(value);
+}
+
+pub const Attribute = struct {
+    type: ck.CK_ATTRIBUTE_TYPE,
+    value: []u8,
+    sealed: bool = false,
+};
+
+fn isSecretMaterial(t: ck.CK_ATTRIBUTE_TYPE) bool {
+    return switch (t) {
+        ck.CKA_VALUE,
+        ck.CKA_PRIVATE_EXPONENT,
+        ck.CKA_PRIME_1,
+        ck.CKA_PRIME_2,
+        ck.CKA_EXPONENT_1,
+        ck.CKA_EXPONENT_2,
+        ck.CKA_COEFFICIENT,
+        => true,
+        else => false,
+    };
+}
+
+pub const Object = struct {
+    attrs: std.ArrayList(Attribute) = .empty,
+
+    pub fn deinit(self: *Object, allocator: std.mem.Allocator) void {
+        for (self.attrs.items) |a| secureFree(allocator, a.value);
+        self.attrs.deinit(allocator);
+        self.* = .{};
+    }
+
+    pub fn findPtr(self: *Object, t: ck.CK_ATTRIBUTE_TYPE) ?*Attribute {
+        for (self.attrs.items) |*a| {
+            if (a.type == t) return a;
+        }
+        return null;
+    }
+
+    pub fn get(self: *const Object, t: ck.CK_ATTRIBUTE_TYPE) ?[]const u8 {
+        for (self.attrs.items) |a| {
+            if (a.type == t) return a.value;
+        }
+        return null;
+    }
+
+    pub fn has(self: *const Object, t: ck.CK_ATTRIBUTE_TYPE) bool {
+        return self.get(t) != null;
+    }
+
+    pub fn getBool(self: *const Object, t: ck.CK_ATTRIBUTE_TYPE) bool {
+        const v = self.get(t) orelse return false;
+        return v.len >= 1 and v[0] != ck.CK_FALSE;
+    }
+
+    pub fn isToken(self: *const Object) bool {
+        return self.getBool(ck.CKA_TOKEN);
+    }
+
+    pub fn isPrivate(self: *const Object) bool {
+        return self.getBool(ck.CKA_PRIVATE);
+    }
+
+    pub fn shouldSeal(self: *const Object, t: ck.CK_ATTRIBUTE_TYPE) bool {
+        if (!isSecretMaterial(t)) return false;
+        if (self.getBool(ck.CKA_SENSITIVE)) return true;
+        return self.has(ck.CKA_EXTRACTABLE) and !self.getBool(ck.CKA_EXTRACTABLE);
+    }
+
+    pub fn hasSealable(self: *const Object) bool {
+        for (self.attrs.items) |a| {
+            if (self.shouldSeal(a.type)) return true;
+        }
+        return false;
+    }
+
+    pub fn set(self: *Object, allocator: std.mem.Allocator, t: ck.CK_ATTRIBUTE_TYPE, bytes: []const u8) !void {
+        if (bytes.len > config.max_attr_value_len) return error.AttrTooLarge;
+        if (self.findPtr(t)) |a| {
+            const dup = try allocator.dupe(u8, bytes);
+            secureFree(allocator, a.value);
+            a.value = dup;
+            a.sealed = false;
+            return;
+        }
+        if (self.attrs.items.len >= config.max_attributes_per_object) return error.TooManyAttributes;
+        const dup = try allocator.dupe(u8, bytes);
+        errdefer secureFree(allocator, dup);
+        try self.attrs.append(allocator, .{ .type = t, .value = dup });
+    }
+
+    pub fn sizeBytes(self: *const Object) ck.CK_ULONG {
+        var total: ck.CK_ULONG = 0;
+        for (self.attrs.items) |a| total += @intCast(a.value.len);
+        return total;
+    }
+
+    pub fn clone(self: *const Object, allocator: std.mem.Allocator) !Object {
+        var out: Object = .{};
+        errdefer out.deinit(allocator);
+        for (self.attrs.items) |a| {
+            try out.set(allocator, a.type, a.value);
+            out.findPtr(a.type).?.sealed = a.sealed;
+        }
+        return out;
+    }
+};
+
+pub fn visible(obj: *const Object, logged_in: ?ck.CK_USER_TYPE) bool {
+    if (!obj.isPrivate()) return true;
+    return logged_in == ck.CKU_USER;
+}
+
+pub fn mapSetErr(e: anyerror) ck.CK_RV {
+    return switch (e) {
+        error.OutOfMemory => ck.CKR_HOST_MEMORY,
+        error.AttrTooLarge => ck.CKR_ATTRIBUTE_VALUE_INVALID,
+        error.TooManyAttributes => ck.CKR_TEMPLATE_INCONSISTENT,
+        else => ck.CKR_FUNCTION_FAILED,
+    };
+}
+
+const Entry = struct {
+    handle: ck.CK_OBJECT_HANDLE,
+    obj: Object,
+};
+
+pub const Store = struct {
+    slots: [config.max_objects]?Entry = @splat(null),
+    next_handle: ck.CK_OBJECT_HANDLE = 1,
+
+    pub fn insert(self: *Store, obj: Object) ?ck.CK_OBJECT_HANDLE {
+        for (&self.slots) |*slot| {
+            if (slot.* == null) {
+                const h = self.next_handle;
+                slot.* = .{ .handle = h, .obj = obj };
+                self.next_handle += 1;
+                return h;
+            }
+        }
+        return null;
+    }
+
+    pub fn getPtr(self: *Store, h: ck.CK_OBJECT_HANDLE) ?*Object {
+        if (h == ck.CK_INVALID_HANDLE) return null;
+        for (&self.slots) |*slot| {
+            if (slot.*) |*e| {
+                if (e.handle == h) return &e.obj;
+            }
+        }
+        return null;
+    }
+
+    pub fn destroy(self: *Store, allocator: std.mem.Allocator, h: ck.CK_OBJECT_HANDLE) bool {
+        if (h == ck.CK_INVALID_HANDLE) return false;
+        for (&self.slots) |*slot| {
+            if (slot.*) |*e| {
+                if (e.handle == h) {
+                    e.obj.deinit(allocator);
+                    slot.* = null;
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+
+    pub fn count(self: *const Store) usize {
+        var n: usize = 0;
+        for (self.slots) |slot| {
+            if (slot != null) n += 1;
+        }
+        return n;
+    }
+
+    pub fn clear(self: *Store, allocator: std.mem.Allocator) void {
+        for (&self.slots) |*slot| {
+            if (slot.*) |*e| {
+                e.obj.deinit(allocator);
+                slot.* = null;
+            }
+        }
+        self.next_handle = 1;
+    }
+
+    pub fn deinit(self: *Store, allocator: std.mem.Allocator) void {
+        self.clear(allocator);
+    }
+};
+
+fn appendU32(buf: *std.ArrayList(u8), allocator: std.mem.Allocator, v: u32) !void {
+    const x: u32 = v;
+    try buf.appendSlice(allocator, std.mem.asBytes(&x));
+}
+
+fn appendU64(buf: *std.ArrayList(u8), allocator: std.mem.Allocator, v: u64) !void {
+    const x: u64 = v;
+    try buf.appendSlice(allocator, std.mem.asBytes(&x));
+}
+
+fn readU32(bytes: []const u8, cursor: *usize) !u32 {
+    const w = @sizeOf(u32);
+    if (cursor.* + w > bytes.len) return error.Truncated;
+    const v = std.mem.bytesToValue(u32, bytes[cursor.*..][0..w]);
+    cursor.* += w;
+    return v;
+}
+
+fn readU64(bytes: []const u8, cursor: *usize) !u64 {
+    const w = @sizeOf(u64);
+    if (cursor.* + w > bytes.len) return error.Truncated;
+    const v = std.mem.bytesToValue(u64, bytes[cursor.*..][0..w]);
+    cursor.* += w;
+    return v;
+}
+
+pub fn serialize(io: std.Io, allocator: std.mem.Allocator, store: *const Store, mk: ?keystore.MasterKey) ![]u8 {
+    var buf: std.ArrayList(u8) = .empty;
+    errdefer buf.deinit(allocator);
+
+    try appendU32(&buf, allocator, config.object_record_magic);
+    try appendU32(&buf, allocator, config.object_record_version);
+
+    var n: u32 = 0;
+    for (store.slots) |slot| {
+        if (slot) |e| {
+            if (e.obj.isToken()) n += 1;
+        }
+    }
+    try appendU32(&buf, allocator, n);
+
+    for (store.slots) |slot| {
+        if (slot) |e| {
+            if (!e.obj.isToken()) continue;
+            try appendU32(&buf, allocator, @intCast(e.obj.attrs.items.len));
+            for (e.obj.attrs.items) |a| {
+                try appendU64(&buf, allocator, @intCast(a.type));
+                if (!a.sealed and e.obj.shouldSeal(a.type)) {
+                    const key = mk orelse return error.NoMasterKey;
+                    const scratch = try allocator.alloc(u8, keystore.sealedLen(a.value.len));
+                    defer allocator.free(scratch);
+                    const wrote = try keystore.seal(io, &key, std.mem.asBytes(&a.type), a.value, scratch);
+                    try appendU64(&buf, allocator, @intCast(wrote));
+                    try buf.appendSlice(allocator, scratch[0..wrote]);
+                } else {
+                    try appendU64(&buf, allocator, @intCast(a.value.len));
+                    try buf.appendSlice(allocator, a.value);
+                }
+            }
+        }
+    }
+
+    return buf.toOwnedSlice(allocator);
+}
+
+fn parse(allocator: std.mem.Allocator, store: *Store, bytes: []const u8) !void {
+    var c: usize = 0;
+    const magic = try readU32(bytes, &c);
+    const version = try readU32(bytes, &c);
+    if (magic != config.object_record_magic or version != config.object_record_version) return error.BadHeader;
+
+    const obj_count = try readU32(bytes, &c);
+    var i: u32 = 0;
+    while (i < obj_count) : (i += 1) {
+        var obj: Object = .{};
+        var inserted = false;
+        defer if (!inserted) obj.deinit(allocator);
+
+        const attr_count = try readU32(bytes, &c);
+        if (attr_count > config.max_attributes_per_object) return error.TooManyAttributes;
+
+        var j: u32 = 0;
+        while (j < attr_count) : (j += 1) {
+            const t = try readU64(bytes, &c);
+            const len = try readU64(bytes, &c);
+            if (len > config.max_attr_value_len) return error.AttrTooLarge;
+            const n: usize = @intCast(len);
+            if (c + n > bytes.len) return error.Truncated;
+            try obj.set(allocator, @intCast(t), bytes[c .. c + n]);
+            c += n;
+        }
+
+        for (obj.attrs.items) |*a| {
+            if (obj.shouldSeal(a.type)) a.sealed = true;
+        }
+
+        if (store.insert(obj) == null) return error.StoreFull;
+        inserted = true;
+    }
+}
+
+pub fn save(io: std.Io, allocator: std.mem.Allocator, store: *const Store, mk: ?keystore.MasterKey) !void {
+    const data = try serialize(io, allocator, store, mk);
+    defer allocator.free(data);
+
+    var buf: [config.path_buf_len]u8 = undefined;
+    const path = try env.resolvePath(&buf, config.object_path_env, config.object_path_default);
+
+    var tmp_buf: [config.path_buf_len + 8]u8 = undefined;
+    const tmp = try std.fmt.bufPrint(&tmp_buf, "{s}.tmp", .{path});
+    const dir = std.Io.Dir.cwd();
+    try dir.writeFile(io, .{ .sub_path = tmp, .data = data });
+    try dir.rename(tmp, dir, path, io);
+}
+
+pub fn unlock(allocator: std.mem.Allocator, store: *Store, mk: keystore.MasterKey) !void {
+    for (&store.slots) |*slot| {
+        if (slot.*) |*e| {
+            if (!e.obj.isToken()) continue;
+            for (e.obj.attrs.items) |*a| {
+                if (!a.sealed) continue;
+                if (a.value.len < keystore.seal_overhead) return error.Corrupt;
+                const plain = try allocator.alloc(u8, a.value.len - keystore.seal_overhead);
+                _ = keystore.unseal(&mk, std.mem.asBytes(&a.type), a.value, plain) catch {
+                    secureFree(allocator, plain);
+                    return error.AuthFailed;
+                };
+                secureFree(allocator, a.value);
+                a.value = plain;
+                a.sealed = false;
+            }
+        }
+    }
+}
+
+pub fn lock(io: std.Io, allocator: std.mem.Allocator, store: *Store, mk: keystore.MasterKey) !void {
+    for (&store.slots) |*slot| {
+        if (slot.*) |*e| {
+            if (!e.obj.isToken()) continue;
+            for (e.obj.attrs.items) |*a| {
+                if (a.sealed or !e.obj.shouldSeal(a.type)) continue;
+                const sealed = try allocator.alloc(u8, keystore.sealedLen(a.value.len));
+                _ = keystore.seal(io, &mk, std.mem.asBytes(&a.type), a.value, sealed) catch {
+                    secureFree(allocator, sealed);
+                    return error.Seal;
+                };
+                secureFree(allocator, a.value);
+                a.value = sealed;
+                a.sealed = true;
+            }
+        }
+    }
+}
+
+pub fn scrubUnsealed(store: *Store) void {
+    for (&store.slots) |*slot| {
+        if (slot.*) |*e| {
+            if (!e.obj.isToken()) continue;
+            for (e.obj.attrs.items) |*a| {
+                if (a.sealed or !e.obj.shouldSeal(a.type)) continue;
+                std.crypto.secureZero(u8, a.value);
+                a.sealed = true;
+            }
+        }
+    }
+}
+
+pub fn load(io: std.Io, allocator: std.mem.Allocator, store: *Store) void {
+    var buf: [config.path_buf_len]u8 = undefined;
+    const path = env.resolvePath(&buf, config.object_path_env, config.object_path_default) catch return;
+    const bytes = std.Io.Dir.cwd().readFileAlloc(io, path, allocator, .limited(config.object_read_limit)) catch return;
+    defer allocator.free(bytes);
+    parse(allocator, store, bytes) catch store.clear(allocator);
+}
+
+test "set replaces an existing attribute and reports size" {
+    const a = std.testing.allocator;
+    var obj: Object = .{};
+    defer obj.deinit(a);
+
+    try obj.set(a, ck.CKA_LABEL, "first");
+    try obj.set(a, ck.CKA_LABEL, "second-value");
+    try std.testing.expectEqual(@as(usize, 1), obj.attrs.items.len);
+    try std.testing.expectEqualSlices(u8, "second-value", obj.get(ck.CKA_LABEL).?);
+    try std.testing.expectEqual(@as(ck.CK_ULONG, "second-value".len), obj.sizeBytes());
+}
+
+test "set on an existing attribute clears a stale sealed flag" {
+    const a = std.testing.allocator;
+    var obj: Object = .{};
+    defer obj.deinit(a);
+
+    try obj.set(a, ck.CKA_VALUE, "ciphertext-placeholder");
+    obj.findPtr(ck.CKA_VALUE).?.sealed = true;
+    try obj.set(a, ck.CKA_VALUE, "fresh-plaintext");
+    try std.testing.expect(!obj.findPtr(ck.CKA_VALUE).?.sealed);
+    try std.testing.expectEqualSlices(u8, "fresh-plaintext", obj.get(ck.CKA_VALUE).?);
+}
+
+test "bool and class helpers read CK_BBOOL semantics" {
+    const a = std.testing.allocator;
+    var obj: Object = .{};
+    defer obj.deinit(a);
+
+    try std.testing.expect(!obj.isToken());
+    try obj.set(a, ck.CKA_TOKEN, &[_]u8{ck.CK_TRUE});
+    try obj.set(a, ck.CKA_PRIVATE, &[_]u8{ck.CK_FALSE});
+    try std.testing.expect(obj.isToken());
+    try std.testing.expect(!obj.isPrivate());
+}
+
+test "store hands out monotonic non-reused handles and destroys" {
+    const a = std.testing.allocator;
+    var store: Store = .{};
+    defer store.deinit(a);
+
+    var o1: Object = .{};
+    try o1.set(a, ck.CKA_CLASS, &[_]u8{0});
+    const h1 = store.insert(o1).?;
+
+    var o2: Object = .{};
+    try o2.set(a, ck.CKA_CLASS, &[_]u8{1});
+    const h2 = store.insert(o2).?;
+
+    try std.testing.expect(h1 != h2);
+    try std.testing.expect(store.getPtr(h1) != null);
+    try std.testing.expect(store.destroy(a, h1));
+    try std.testing.expect(store.getPtr(h1) == null);
+    try std.testing.expect(!store.destroy(a, h1));
+
+    var o3: Object = .{};
+    try o3.set(a, ck.CKA_CLASS, &[_]u8{2});
+    const h3 = store.insert(o3).?;
+    try std.testing.expect(h3 != h1 and h3 != h2);
+    try std.testing.expectEqual(@as(usize, 2), store.count());
+}
+
+test "serialize then parse round-trips only token objects" {
+    const a = std.testing.allocator;
+    var store: Store = .{};
+    defer store.deinit(a);
+
+    var tok: Object = .{};
+    try tok.set(a, ck.CKA_TOKEN, &[_]u8{ck.CK_TRUE});
+    try tok.set(a, ck.CKA_CLASS, &[_]u8{ 0, 0, 0, 0, 0, 0, 0, 0 });
+    try tok.set(a, ck.CKA_LABEL, "persisted");
+    _ = store.insert(tok);
+
+    var sess: Object = .{};
+    try sess.set(a, ck.CKA_TOKEN, &[_]u8{ck.CK_FALSE});
+    try sess.set(a, ck.CKA_LABEL, "ephemeral");
+    _ = store.insert(sess);
+
+    const data = try serialize(std.testing.io, a, &store, null);
+    defer a.free(data);
+
+    var restored: Store = .{};
+    defer restored.deinit(a);
+    try parse(a, &restored, data);
+
+    try std.testing.expectEqual(@as(usize, 1), restored.count());
+    var found_label: ?[]const u8 = null;
+    for (&restored.slots) |*slot| {
+        if (slot.*) |*e| found_label = e.obj.get(ck.CKA_LABEL);
+    }
+    try std.testing.expectEqualSlices(u8, "persisted", found_label.?);
+}
+
+test "serialize seals a sensitive value at rest and unlock recovers it" {
+    const a = std.testing.allocator;
+    const io = std.testing.io;
+    const mk: keystore.MasterKey = @splat(0x5a);
+    const wrong: keystore.MasterKey = @splat(0x17);
+    const secret = "SUPER-SECRET-KEY-MATERIAL";
+
+    var store: Store = .{};
+    defer store.deinit(a);
+    var key: Object = .{};
+    try key.set(a, ck.CKA_TOKEN, &[_]u8{ck.CK_TRUE});
+    try key.set(a, ck.CKA_CLASS, &[_]u8{ 4, 0, 0, 0, 0, 0, 0, 0 });
+    try key.set(a, ck.CKA_SENSITIVE, &[_]u8{ck.CK_TRUE});
+    try key.set(a, ck.CKA_VALUE, secret);
+    _ = store.insert(key);
+
+    const data = try serialize(io, a, &store, mk);
+    defer a.free(data);
+    try std.testing.expect(std.mem.indexOf(u8, data, secret) == null);
+
+    var restored: Store = .{};
+    defer restored.deinit(a);
+    try parse(a, &restored, data);
+
+    var sealed_value: ?[]const u8 = null;
+    for (&restored.slots) |*slot| {
+        if (slot.*) |*e| {
+            if (e.obj.findPtr(ck.CKA_VALUE)) |attr| {
+                try std.testing.expect(attr.sealed);
+                sealed_value = attr.value;
+            }
+        }
+    }
+    try std.testing.expect(sealed_value != null);
+    try std.testing.expect(std.mem.indexOf(u8, sealed_value.?, secret) == null);
+
+    try std.testing.expectError(error.AuthFailed, unlock(a, &restored, wrong));
+    try unlock(a, &restored, mk);
+    for (&restored.slots) |*slot| {
+        if (slot.*) |*e| {
+            const v = e.obj.get(ck.CKA_VALUE).?;
+            try std.testing.expectEqualSlices(u8, secret, v);
+            try std.testing.expect(!e.obj.findPtr(ck.CKA_VALUE).?.sealed);
+        }
+    }
+}
+
+test "secureFree clears the secret from the value buffer" {
+    var backing: [64]u8 = undefined;
+    var fba = std.heap.FixedBufferAllocator.init(&backing);
+    const a = fba.allocator();
+    const v = try a.dupe(u8, "SUPER-SECRET-KEY");
+    const region = backing[0..v.len];
+    try std.testing.expect(std.mem.indexOf(u8, region, "SECRET") != null);
+    secureFree(a, v);
+    try std.testing.expect(std.mem.indexOf(u8, region, "SECRET") == null);
+}
+
+test "deinit clears a plaintext secret attribute from its buffer" {
+    var backing: [512]u8 = undefined;
+    var fba = std.heap.FixedBufferAllocator.init(&backing);
+    const a = fba.allocator();
+    var obj: Object = .{};
+    try obj.set(a, ck.CKA_VALUE, "AES-256-SECRET-KEY-BYTES");
+    const stored = obj.findPtr(ck.CKA_VALUE).?.value;
+    const region = stored[0..stored.len];
+    try std.testing.expect(std.mem.indexOf(u8, region, "SECRET") != null);
+    obj.deinit(a);
+    try std.testing.expect(std.mem.indexOf(u8, region, "SECRET") == null);
+}
+
+test "parse rejects a bad magic without leaking" {
+    const a = std.testing.allocator;
+    var store: Store = .{};
+    defer store.deinit(a);
+    const junk = [_]u8{ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12 };
+    try std.testing.expectError(error.BadHeader, parse(a, &store, &junk));
+    try std.testing.expectEqual(@as(usize, 0), store.count());
+}
+
+test "parse fails safe on a truncated record and clear frees partial inserts" {
+    const a = std.testing.allocator;
+    var store: Store = .{};
+    defer store.deinit(a);
+
+    var good: Store = .{};
+    defer good.deinit(a);
+    var tok: Object = .{};
+    try tok.set(a, ck.CKA_TOKEN, &[_]u8{ck.CK_TRUE});
+    try tok.set(a, ck.CKA_LABEL, "x");
+    _ = good.insert(tok);
+    const data = try serialize(std.testing.io, a, &good, null);
+    defer a.free(data);
+
+    try std.testing.expectError(error.Truncated, parse(a, &store, data[0 .. data.len - 1]));
+    store.clear(a);
+    try std.testing.expectEqual(@as(usize, 0), store.count());
+}
+
+test "scrubUnsealed fail-closes plaintext secrets after a failed re-seal" {
+    const a = std.testing.allocator;
+    const io = std.testing.io;
+    const secret = "PLAINTEXT-KEY-MUST-NOT-SURVIVE-LOGOUT";
+
+    var store: Store = .{};
+    defer store.deinit(a);
+    var key: Object = .{};
+    try key.set(a, ck.CKA_TOKEN, &[_]u8{ck.CK_TRUE});
+    try key.set(a, ck.CKA_SENSITIVE, &[_]u8{ck.CK_TRUE});
+    try key.set(a, ck.CKA_VALUE, secret);
+    _ = store.insert(key);
+
+    const mk: keystore.MasterKey = @splat(0x42);
+    var failing = std.testing.FailingAllocator.init(a, .{ .fail_index = 0 });
+    try std.testing.expectError(error.OutOfMemory, lock(io, failing.allocator(), &store, mk));
+
+    const attr = store.slots[0].?.obj.findPtr(ck.CKA_VALUE).?;
+    try std.testing.expect(!attr.sealed);
+    try std.testing.expect(std.mem.indexOf(u8, attr.value, "SURVIVE") != null);
+
+    scrubUnsealed(&store);
+
+    try std.testing.expect(attr.sealed);
+    try std.testing.expect(std.mem.indexOf(u8, attr.value, "SURVIVE") == null);
+    for (attr.value) |b| try std.testing.expectEqual(@as(u8, 0), b);
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/core/session.zig b/PROJECTS/advanced/hsm-emulator/src/core/session.zig
new file mode 100644
index 00000000..b9cfda82
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/core/session.zig
@@ -0,0 +1,401 @@
+// ©AngelaMos | 2026
+// session.zig
+
+const std = @import("std");
+const ck = @import("../ck.zig");
+const config = @import("../config.zig");
+const digest = @import("../crypto/digest.zig");
+const mac = @import("../crypto/mac.zig");
+const cipher = @import("../crypto/cipher.zig");
+const ecdsa = @import("../crypto/ecdsa.zig");
+const rsa = @import("../crypto/rsa.zig");
+
+pub const Find = struct {
+    matches: [config.max_objects]ck.CK_OBJECT_HANDLE = undefined,
+    count: usize = 0,
+    cursor: usize = 0,
+    active: bool = false,
+};
+
+pub const RsaSig = struct {
+    key: ck.CK_OBJECT_HANDLE,
+    params: rsa.SignParams,
+    sig_len: usize,
+};
+
+pub const RsaCrypt = struct {
+    key: ck.CK_OBJECT_HANDLE,
+    params: rsa.CryptParams,
+    out_len: usize,
+};
+
+pub const RsaRecover = struct {
+    key: ck.CK_OBJECT_HANDLE,
+    out_len: usize,
+};
+
+pub const GcmStream = struct {
+    cipher: cipher.Cipher,
+    buf: ?[]u8 = null,
+    len: usize = 0,
+
+    pub fn append(self: *GcmStream, allocator: std.mem.Allocator, bytes: []const u8) error{ OutOfMemory, TooLarge }!void {
+        if (bytes.len == 0) return;
+        const needed = self.len + bytes.len;
+        if (needed > config.max_gcm_stream_len) return error.TooLarge;
+        if (self.buf == null or self.buf.?.len < needed) {
+            var new_cap: usize = if (self.buf) |b| b.len else 256;
+            while (new_cap < needed) new_cap *|= 2;
+            if (new_cap > config.max_gcm_stream_len) new_cap = config.max_gcm_stream_len;
+            const fresh = try allocator.alloc(u8, new_cap);
+            if (self.buf) |old| {
+                @memcpy(fresh[0..self.len], old[0..self.len]);
+                std.crypto.secureZero(u8, old);
+                allocator.free(old);
+            }
+            self.buf = fresh;
+        }
+        @memcpy(self.buf.?[self.len..][0..bytes.len], bytes);
+        self.len += bytes.len;
+    }
+
+    pub fn data(self: *const GcmStream) []const u8 {
+        return if (self.buf) |b| b[0..self.len] else &.{};
+    }
+
+    pub fn deinit(self: *GcmStream, allocator: std.mem.Allocator) void {
+        if (self.buf) |b| {
+            std.crypto.secureZero(u8, b);
+            allocator.free(b);
+        }
+        self.buf = null;
+        self.len = 0;
+    }
+};
+
+pub const SignOp = union(enum) {
+    mac: mac.Mac,
+    ec: ecdsa.SignState,
+    rsa: RsaSig,
+
+    pub fn update(self: *SignOp, data: []const u8) void {
+        switch (self.*) {
+            .mac => |*m| m.update(data),
+            .ec => |*e| e.update(data),
+            .rsa => {},
+        }
+    }
+
+    pub fn zeroize(self: *SignOp) void {
+        std.crypto.secureZero(u8, std.mem.asBytes(self));
+    }
+};
+
+pub const VerifyOp = union(enum) {
+    mac: mac.Mac,
+    ec: ecdsa.VerifyState,
+    rsa: RsaSig,
+
+    pub fn update(self: *VerifyOp, data: []const u8) void {
+        switch (self.*) {
+            .mac => |*m| m.update(data),
+            .ec => |*e| e.update(data),
+            .rsa => {},
+        }
+    }
+
+    pub fn zeroize(self: *VerifyOp) void {
+        std.crypto.secureZero(u8, std.mem.asBytes(self));
+    }
+};
+
+pub const EncryptOp = union(enum) {
+    aes: cipher.Cipher,
+    gcm: GcmStream,
+    rsa: RsaCrypt,
+
+    pub fn deinit(self: *EncryptOp, allocator: std.mem.Allocator) void {
+        switch (self.*) {
+            .gcm => |*g| g.deinit(allocator),
+            else => {},
+        }
+        std.crypto.secureZero(u8, std.mem.asBytes(self));
+    }
+};
+
+pub const DecryptOp = union(enum) {
+    aes: cipher.Cipher,
+    gcm: GcmStream,
+    rsa: RsaCrypt,
+
+    pub fn deinit(self: *DecryptOp, allocator: std.mem.Allocator) void {
+        switch (self.*) {
+            .gcm => |*g| g.deinit(allocator),
+            else => {},
+        }
+        std.crypto.secureZero(u8, std.mem.asBytes(self));
+    }
+};
+
+pub const Session = struct {
+    slot: ck.CK_SLOT_ID,
+    flags: ck.CK_FLAGS,
+    find: Find = .{},
+    digest_op: ?digest.Hasher = null,
+    sign_op: ?SignOp = null,
+    verify_op: ?VerifyOp = null,
+    encrypt_op: ?EncryptOp = null,
+    decrypt_op: ?DecryptOp = null,
+    sign_recover_op: ?RsaRecover = null,
+    verify_recover_op: ?RsaRecover = null,
+
+    pub fn endDigest(self: *Session) void {
+        if (self.digest_op) |*o| std.crypto.secureZero(u8, std.mem.asBytes(o));
+        self.digest_op = null;
+    }
+
+    pub fn endSign(self: *Session) void {
+        if (self.sign_op) |*o| o.zeroize();
+        self.sign_op = null;
+    }
+
+    pub fn endVerify(self: *Session) void {
+        if (self.verify_op) |*o| o.zeroize();
+        self.verify_op = null;
+    }
+
+    pub fn endEncrypt(self: *Session, allocator: std.mem.Allocator) void {
+        if (self.encrypt_op) |*o| o.deinit(allocator);
+        self.encrypt_op = null;
+    }
+
+    pub fn endDecrypt(self: *Session, allocator: std.mem.Allocator) void {
+        if (self.decrypt_op) |*o| o.deinit(allocator);
+        self.decrypt_op = null;
+    }
+
+    pub fn endSignRecover(self: *Session) void {
+        if (self.sign_recover_op) |*o| std.crypto.secureZero(u8, std.mem.asBytes(o));
+        self.sign_recover_op = null;
+    }
+
+    pub fn endVerifyRecover(self: *Session) void {
+        if (self.verify_recover_op) |*o| std.crypto.secureZero(u8, std.mem.asBytes(o));
+        self.verify_recover_op = null;
+    }
+
+    pub fn freeHeap(self: *Session, allocator: std.mem.Allocator) void {
+        if (self.encrypt_op) |*o| switch (o.*) {
+            .gcm => |*g| g.deinit(allocator),
+            else => {},
+        };
+        if (self.decrypt_op) |*o| switch (o.*) {
+            .gcm => |*g| g.deinit(allocator),
+            else => {},
+        };
+    }
+};
+
+pub const Table = struct {
+    slots: [config.max_sessions]?Session = @splat(null),
+
+    pub fn open(self: *Table, slot: ck.CK_SLOT_ID, flags: ck.CK_FLAGS) ?ck.CK_SESSION_HANDLE {
+        for (&self.slots, 0..) |*s, i| {
+            if (s.* == null) {
+                std.crypto.secureZero(u8, std.mem.asBytes(s));
+                s.* = .{ .slot = slot, .flags = flags };
+                return @intCast(i + 1);
+            }
+        }
+        return null;
+    }
+
+    pub fn get(self: *Table, h: ck.CK_SESSION_HANDLE) ?*Session {
+        if (h == 0 or h > config.max_sessions) return null;
+        if (self.slots[h - 1]) |*s| return s;
+        return null;
+    }
+
+    pub fn close(self: *Table, allocator: std.mem.Allocator, h: ck.CK_SESSION_HANDLE) bool {
+        if (h == 0 or h > config.max_sessions) return false;
+        if (self.slots[h - 1] == null) return false;
+        if (self.slots[h - 1]) |*s| s.freeHeap(allocator);
+        std.crypto.secureZero(u8, std.mem.asBytes(&self.slots[h - 1]));
+        self.slots[h - 1] = null;
+        return true;
+    }
+
+    pub fn closeAll(self: *Table, allocator: std.mem.Allocator, slot: ck.CK_SLOT_ID) void {
+        for (&self.slots) |*s| {
+            if (s.*) |*sp| {
+                if (sp.slot == slot) {
+                    sp.freeHeap(allocator);
+                    std.crypto.secureZero(u8, std.mem.asBytes(s));
+                    s.* = null;
+                }
+            }
+        }
+    }
+
+    pub fn wipeAll(self: *Table, allocator: std.mem.Allocator) void {
+        for (&self.slots) |*s| {
+            if (s.*) |*sp| sp.freeHeap(allocator);
+        }
+        std.crypto.secureZero(u8, std.mem.asBytes(&self.slots));
+    }
+
+    pub fn anyOpen(self: *Table) bool {
+        for (&self.slots) |*s| {
+            if (s.* != null) return true;
+        }
+        return false;
+    }
+
+    pub fn count(self: *Table) ck.CK_ULONG {
+        var n: ck.CK_ULONG = 0;
+        for (&self.slots) |*s| {
+            if (s.* != null) n += 1;
+        }
+        return n;
+    }
+
+    pub fn countRw(self: *Table) ck.CK_ULONG {
+        var n: ck.CK_ULONG = 0;
+        for (&self.slots) |*s| {
+            if (s.*) |*sp| {
+                if ((sp.flags & ck.CKF_RW_SESSION) != 0) n += 1;
+            }
+        }
+        return n;
+    }
+};
+
+test "open returns nonzero handles and get resolves them" {
+    var t: Table = .{};
+    const h1 = t.open(0, ck.CKF_SERIAL_SESSION).?;
+    const h2 = t.open(0, ck.CKF_SERIAL_SESSION | ck.CKF_RW_SESSION).?;
+    try std.testing.expect(h1 != 0 and h2 != 0 and h1 != h2);
+    try std.testing.expectEqual(@as(ck.CK_ULONG, 2), t.count());
+    try std.testing.expectEqual(@as(ck.CK_ULONG, 1), t.countRw());
+    try std.testing.expect(t.get(h1) != null);
+    try std.testing.expect(t.get(9999) == null);
+}
+
+test "close frees the slot and closeAll empties the table" {
+    const a = std.testing.allocator;
+    var t: Table = .{};
+    const h = t.open(0, ck.CKF_SERIAL_SESSION).?;
+    try std.testing.expect(t.close(a, h));
+    try std.testing.expect(!t.close(a, h));
+    try std.testing.expect(!t.anyOpen());
+    _ = t.open(0, ck.CKF_SERIAL_SESSION);
+    t.closeAll(a, 0);
+    try std.testing.expect(!t.anyOpen());
+}
+
+fn expectAllZero(bytes: []const u8) !void {
+    for (bytes) |b| try std.testing.expectEqual(@as(u8, 0), b);
+}
+
+test "EncryptOp.deinit zeros the AES key material" {
+    var op: EncryptOp = .{ .aes = .{ .mode = .cbc, .encrypt = true, .key_len = 32 } };
+    const key: []u8 = &op.aes.key_buf;
+    @memset(key, 0xAA);
+    op.deinit(std.testing.allocator);
+    try expectAllZero(key);
+}
+
+test "DecryptOp.deinit zeros the AES key material" {
+    var op: DecryptOp = .{ .aes = .{ .mode = .cbc, .encrypt = false, .key_len = 16 } };
+    const key: []u8 = &op.aes.key_buf;
+    @memset(key, 0xAA);
+    op.deinit(std.testing.allocator);
+    try expectAllZero(key);
+}
+
+test "GcmStream secure-grows across a realloc and deinit clears it" {
+    const a = std.testing.allocator;
+    var g: GcmStream = .{ .cipher = .{ .mode = .gcm, .encrypt = true, .key_len = 32 } };
+    var part: [200]u8 = undefined;
+    for (&part, 0..) |*b, i| b.* = @intCast(i & 0xff);
+    try g.append(a, &part);
+    try g.append(a, &part);
+    try std.testing.expectEqual(@as(usize, 400), g.len);
+    try std.testing.expectEqualSlices(u8, &part, g.data()[0..200]);
+    try std.testing.expectEqualSlices(u8, &part, g.data()[200..400]);
+    g.deinit(a);
+    try std.testing.expect(g.buf == null);
+    try std.testing.expectEqual(@as(usize, 0), g.len);
+}
+
+test "GcmStream enforces the DoS bound" {
+    const a = std.testing.allocator;
+    var g: GcmStream = .{ .cipher = .{ .mode = .gcm, .encrypt = true, .key_len = 16 } };
+    defer g.deinit(a);
+    g.len = config.max_gcm_stream_len;
+    try std.testing.expectError(error.TooLarge, g.append(a, "x"));
+}
+
+test "SignOp.zeroize zeros the EC private scalar" {
+    const scalar = [_]u8{0xAB} ** 32;
+    var op: SignOp = .{ .ec = ecdsa.SignState.init(.p256, ck.CKM_ECDSA, &scalar).? };
+    const sc: []u8 = &op.ec.scalar;
+    op.zeroize();
+    try expectAllZero(sc);
+}
+
+test "VerifyOp.zeroize zeros HMAC key state" {
+    var op: VerifyOp = .{ .mac = undefined };
+    const st: []u8 = std.mem.asBytes(&op.mac);
+    @memset(st, 0xCD);
+    op.zeroize();
+    try expectAllZero(st);
+}
+
+test "endEncrypt clears the op and removes the secret from the slot" {
+    const a = std.testing.allocator;
+    var t: Table = .{};
+    const h = t.open(0, ck.CKF_SERIAL_SESSION).?;
+    const sess = t.get(h).?;
+    sess.encrypt_op = .{ .aes = .{ .mode = .cbc, .encrypt = true, .key_len = 32 } };
+    const key: []u8 = &sess.encrypt_op.?.aes.key_buf;
+    @memset(key, 0x5C);
+    sess.endEncrypt(a);
+    try std.testing.expect(sess.encrypt_op == null);
+    try std.testing.expect(std.mem.indexOfScalar(u8, key, 0x5C) == null);
+}
+
+test "close removes an active op's secret from the slot" {
+    const a = std.testing.allocator;
+    var t: Table = .{};
+    const h = t.open(0, ck.CKF_SERIAL_SESSION).?;
+    const sess = t.get(h).?;
+    sess.decrypt_op = .{ .aes = .{ .mode = .cbc, .encrypt = false, .key_len = 32 } };
+    const key: []u8 = &sess.decrypt_op.?.aes.key_buf;
+    @memset(key, 0x5C);
+    try std.testing.expect(t.close(a, h));
+    try std.testing.expect(std.mem.indexOfScalar(u8, key, 0x5C) == null);
+}
+
+test "close frees an active GCM stream's heap buffer" {
+    const a = std.testing.allocator;
+    var t: Table = .{};
+    const h = t.open(0, ck.CKF_SERIAL_SESSION).?;
+    const sess = t.get(h).?;
+    sess.encrypt_op = .{ .gcm = .{ .cipher = .{ .mode = .gcm, .encrypt = true, .key_len = 32 } } };
+    try sess.encrypt_op.?.gcm.append(a, "buffered-plaintext-awaiting-final");
+    try std.testing.expect(t.close(a, h));
+    try std.testing.expect(!t.anyOpen());
+}
+
+test "wipeAll zeros secret material in every slot" {
+    const a = std.testing.allocator;
+    var t: Table = .{};
+    const h = t.open(0, ck.CKF_SERIAL_SESSION).?;
+    const sess = t.get(h).?;
+    sess.sign_op = .{ .mac = undefined };
+    const st: []u8 = std.mem.asBytes(&sess.sign_op.?.mac);
+    @memset(st, 0xEF);
+    t.wipeAll(a);
+    try expectAllZero(st);
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/core/state.zig b/PROJECTS/advanced/hsm-emulator/src/core/state.zig
new file mode 100644
index 00000000..5f53692e
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/core/state.zig
@@ -0,0 +1,146 @@
+// ©AngelaMos | 2026
+// state.zig
+
+const std = @import("std");
+const builtin = @import("builtin");
+const ck = @import("../ck.zig");
+const lock = @import("lock.zig");
+const token = @import("token.zig");
+const session = @import("session.zig");
+const object_store = @import("object_store.zig");
+const keystore = @import("../crypto/keystore.zig");
+
+pub const Locking = enum { none, os };
+
+pub const Instance = struct {
+    debug_alloc: std.heap.DebugAllocator(.{}) = undefined,
+    threaded: std.Io.Threaded = undefined,
+    locking: Locking = .none,
+    token: token.Token = .{},
+    sessions: session.Table = .{},
+    objects: object_store.Store = .{},
+    logged_in: ?ck.CK_USER_TYPE = null,
+    mk: ?keystore.MasterKey = null,
+
+    pub fn allocator(self: *Instance) std.mem.Allocator {
+        return if (builtin.mode == .Debug) self.debug_alloc.allocator() else std.heap.smp_allocator;
+    }
+
+    pub fn io(self: *Instance) std.Io {
+        return self.threaded.io();
+    }
+
+    pub fn wipeMasterKey(self: *Instance) void {
+        if (self.mk) |*mk| std.crypto.secureZero(u8, mk);
+        self.mk = null;
+    }
+
+    pub fn relock(self: *Instance) void {
+        if (self.mk) |*mk| object_store.lock(self.io(), self.allocator(), &self.objects, mk.*) catch {
+            object_store.scrubUnsealed(&self.objects);
+        };
+        self.wipeMasterKey();
+    }
+};
+
+pub var mutex: lock.Lock = .{};
+var storage: Instance = undefined;
+var present: bool = false;
+var inflight: usize = 0;
+var generation: u64 = 0;
+
+pub fn acquire() ?*Instance {
+    mutex.lock();
+    if (!@atomicLoad(bool, &present, .acquire)) {
+        mutex.unlock();
+        return null;
+    }
+    return &storage;
+}
+
+pub fn isInitialized() bool {
+    return @atomicLoad(bool, &present, .acquire);
+}
+
+pub fn initialize(locking: Locking) void {
+    storage = .{
+        .debug_alloc = .init,
+        .threaded = .init(std.heap.smp_allocator, .{}),
+        .locking = locking,
+    };
+    storage.token = token.load(storage.io(), storage.allocator());
+    object_store.load(storage.io(), storage.allocator(), &storage.objects);
+    @atomicStore(bool, &present, true, .release);
+}
+
+pub fn finalize() ck.CK_RV {
+    mutex.lock();
+    if (!@atomicLoad(bool, &present, .acquire)) {
+        mutex.unlock();
+        return ck.CKR_CRYPTOKI_NOT_INITIALIZED;
+    }
+    @atomicStore(bool, &present, false, .release);
+    mutex.unlock();
+
+    while (true) {
+        mutex.lock();
+        const pending = inflight;
+        mutex.unlock();
+        if (pending == 0) break;
+        std.Thread.yield() catch std.atomic.spinLoopHint();
+    }
+
+    mutex.lock();
+    defer mutex.unlock();
+    storage.sessions.wipeAll(storage.allocator());
+    storage.wipeMasterKey();
+    storage.objects.deinit(storage.allocator());
+    storage.threaded.deinit();
+    const leak = storage.debug_alloc.deinit();
+    if (builtin.mode == .Debug and leak == .leak) @panic("hsm: allocator leak detected at C_Finalize");
+    return ck.CKR_OK;
+}
+
+pub fn cryptoBegin() u64 {
+    inflight += 1;
+    return generation;
+}
+
+pub fn cryptoEnd() void {
+    inflight -= 1;
+}
+
+pub fn cryptoAbort() void {
+    mutex.lock();
+    inflight -= 1;
+    mutex.unlock();
+}
+
+pub fn bumpGeneration() void {
+    generation += 1;
+}
+
+pub fn currentGeneration() u64 {
+    return generation;
+}
+
+pub const InitOutcome = union(enum) {
+    ok: Locking,
+    err: ck.CK_RV,
+};
+
+pub fn parseInitArgs(p: ?*anyopaque) InitOutcome {
+    if (p == null) return .{ .ok = .none };
+    const args: *ck.CK_C_INITIALIZE_ARGS = @ptrCast(@alignCast(p.?));
+    if (args.pReserved != null) return .{ .err = ck.CKR_ARGUMENTS_BAD };
+    var cbs: u8 = 0;
+    if (args.CreateMutex != null) cbs += 1;
+    if (args.DestroyMutex != null) cbs += 1;
+    if (args.LockMutex != null) cbs += 1;
+    if (args.UnlockMutex != null) cbs += 1;
+    if (cbs != 0 and cbs != 4) return .{ .err = ck.CKR_ARGUMENTS_BAD };
+    const os_locking_ok = (args.flags & ck.CKF_OS_LOCKING_OK) != 0;
+    if (os_locking_ok) return .{ .ok = .os };
+    if (cbs == 4) return .{ .err = ck.CKR_CANT_LOCK };
+    return .{ .ok = .none };
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/core/token.zig b/PROJECTS/advanced/hsm-emulator/src/core/token.zig
new file mode 100644
index 00000000..641386ca
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/core/token.zig
@@ -0,0 +1,168 @@
+// ©AngelaMos | 2026
+// token.zig
+
+const std = @import("std");
+const config = @import("../config.zig");
+const pin = @import("../crypto/pin.zig");
+const keystore = @import("../crypto/keystore.zig");
+const env = @import("env.zig");
+
+pub const PinSlot = struct {
+    salt: pin.Salt,
+    hash: pin.Hash,
+};
+
+pub const Token = struct {
+    initialized: bool = false,
+    label: [config.label_len]u8 = @splat(' '),
+    so: PinSlot = std.mem.zeroes(PinSlot),
+    user: ?PinSlot = null,
+    so_fail: u32 = 0,
+    user_fail: u32 = 0,
+    user_mk: ?keystore.Wrapped = null,
+};
+
+const flag_initialized: u32 = 1 << 0;
+const flag_user_present: u32 = 1 << 1;
+const flag_user_mk: u32 = 1 << 2;
+
+const Record = extern struct {
+    magic: u32,
+    version: u32,
+    flags: u32,
+    label: [config.label_len]u8,
+    so_salt: [pin.salt_len]u8,
+    so_hash: [pin.hash_len]u8,
+    user_salt: [pin.salt_len]u8,
+    user_hash: [pin.hash_len]u8,
+    so_fail: u32,
+    user_fail: u32,
+    mk_salt: [pin.salt_len]u8,
+    mk_nonce: [keystore.nonce_len]u8,
+    mk_ct: [keystore.mk_len]u8,
+    mk_tag: [keystore.tag_len]u8,
+};
+
+fn serialize(t: Token) Record {
+    var r = std.mem.zeroes(Record);
+    r.magic = config.token_record_magic;
+    r.version = config.token_record_version;
+    r.flags = (if (t.initialized) flag_initialized else 0) | (if (t.user != null) flag_user_present else 0) | (if (t.user_mk != null) flag_user_mk else 0);
+    r.label = t.label;
+    r.so_salt = t.so.salt;
+    r.so_hash = t.so.hash;
+    if (t.user) |u| {
+        r.user_salt = u.salt;
+        r.user_hash = u.hash;
+    }
+    if (t.user_mk) |w| {
+        r.mk_salt = w.salt;
+        r.mk_nonce = w.nonce;
+        r.mk_ct = w.ct;
+        r.mk_tag = w.tag;
+    }
+    r.so_fail = t.so_fail;
+    r.user_fail = t.user_fail;
+    return r;
+}
+
+fn deserialize(r: *const Record) Token {
+    return .{
+        .initialized = (r.flags & flag_initialized) != 0,
+        .label = r.label,
+        .so = .{ .salt = r.so_salt, .hash = r.so_hash },
+        .user = if ((r.flags & flag_user_present) != 0) PinSlot{ .salt = r.user_salt, .hash = r.user_hash } else null,
+        .so_fail = r.so_fail,
+        .user_fail = r.user_fail,
+        .user_mk = if ((r.flags & flag_user_mk) != 0) keystore.Wrapped{ .salt = r.mk_salt, .nonce = r.mk_nonce, .ct = r.mk_ct, .tag = r.mk_tag } else null,
+    };
+}
+
+pub fn resolvePath(buf: []u8) ![]const u8 {
+    return env.resolvePath(buf, config.token_path_env, config.token_path_default);
+}
+
+pub fn saveTo(io: std.Io, path: []const u8, t: Token) !void {
+    const rec = serialize(t);
+    var tmp_buf: [config.path_buf_len + 8]u8 = undefined;
+    const tmp = try std.fmt.bufPrint(&tmp_buf, "{s}.tmp", .{path});
+    const dir = std.Io.Dir.cwd();
+    try dir.writeFile(io, .{ .sub_path = tmp, .data = std.mem.asBytes(&rec) });
+    try dir.rename(tmp, dir, path, io);
+}
+
+pub fn loadFrom(io: std.Io, allocator: std.mem.Allocator, path: []const u8) Token {
+    const bytes = std.Io.Dir.cwd().readFileAlloc(io, path, allocator, .limited(config.token_read_limit)) catch return .{};
+    defer allocator.free(bytes);
+    if (bytes.len != @sizeOf(Record)) return .{};
+    var rec: Record = undefined;
+    @memcpy(std.mem.asBytes(&rec), bytes[0..@sizeOf(Record)]);
+    if (rec.magic != config.token_record_magic or rec.version != config.token_record_version) return .{};
+    return deserialize(&rec);
+}
+
+pub fn save(io: std.Io, t: Token) !void {
+    var buf: [config.path_buf_len]u8 = undefined;
+    const path = try resolvePath(&buf);
+    try saveTo(io, path, t);
+}
+
+pub fn load(io: std.Io, allocator: std.mem.Allocator) Token {
+    var buf: [config.path_buf_len]u8 = undefined;
+    const path = resolvePath(&buf) catch return .{};
+    return loadFrom(io, allocator, path);
+}
+
+test "serialize then deserialize round-trips an initialized token with a user PIN" {
+    var t: Token = .{ .initialized = true, .so_fail = 2, .user_fail = 1 };
+    t.label = @splat('X');
+    t.so = .{ .salt = @splat(3), .hash = @splat(4) };
+    t.user = .{ .salt = @splat(5), .hash = @splat(6) };
+
+    const rec = serialize(t);
+    const back = deserialize(&rec);
+
+    try std.testing.expect(back.initialized);
+    try std.testing.expectEqualSlices(u8, &t.label, &back.label);
+    try std.testing.expectEqual(t.so.salt, back.so.salt);
+    try std.testing.expectEqual(t.so.hash, back.so.hash);
+    try std.testing.expect(back.user != null);
+    try std.testing.expectEqual(t.user.?.hash, back.user.?.hash);
+    try std.testing.expectEqual(@as(u32, 2), back.so_fail);
+    try std.testing.expectEqual(@as(u32, 1), back.user_fail);
+}
+
+test "an uninitialized token has no user PIN after a round-trip" {
+    const rec = serialize(.{});
+    const back = deserialize(&rec);
+    try std.testing.expect(!back.initialized);
+    try std.testing.expect(back.user == null);
+}
+
+test "saveTo then loadFrom persists across a file" {
+    var threaded: std.Io.Threaded = .init(std.testing.allocator, .{});
+    defer threaded.deinit();
+    const io = threaded.io();
+
+    const path = "/tmp/angelamos-hsm-unit-token.bin";
+    std.Io.Dir.cwd().deleteFile(io, path) catch {};
+    defer std.Io.Dir.cwd().deleteFile(io, path) catch {};
+
+    var t: Token = .{ .initialized = true };
+    t.label = @splat('Z');
+    t.so = .{ .salt = @splat(9), .hash = @splat(8) };
+
+    try saveTo(io, path, t);
+    const back = loadFrom(io, std.testing.allocator, path);
+    try std.testing.expect(back.initialized);
+    try std.testing.expectEqual(t.so.hash, back.so.hash);
+    try std.testing.expect(back.user == null);
+}
+
+test "loadFrom a missing file yields a default uninitialized token" {
+    var threaded: std.Io.Threaded = .init(std.testing.allocator, .{});
+    defer threaded.deinit();
+    const io = threaded.io();
+    const back = loadFrom(io, std.testing.allocator, "/tmp/angelamos-hsm-does-not-exist.bin");
+    try std.testing.expect(!back.initialized);
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/crypto/cipher.zig b/PROJECTS/advanced/hsm-emulator/src/crypto/cipher.zig
new file mode 100644
index 00000000..edfc68bf
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/crypto/cipher.zig
@@ -0,0 +1,431 @@
+// ©AngelaMos | 2026
+// cipher.zig
+
+const std = @import("std");
+const ck = @import("../ck.zig");
+const config = @import("../config.zig");
+
+const aes = std.crypto.core.aes;
+const aesgcm = std.crypto.aead.aes_gcm;
+
+const block = config.aes_block_len;
+
+pub const Mode = enum { cbc, cbc_pad, gcm };
+
+pub const Error = error{
+    KeySize,
+    DataLenRange,
+    EncryptedDataLenRange,
+    EncryptedDataInvalid,
+    AadTooLarge,
+    IvInvalid,
+};
+
+pub fn modeOf(mech: ck.CK_MECHANISM_TYPE) ?Mode {
+    return switch (mech) {
+        ck.CKM_AES_CBC => .cbc,
+        ck.CKM_AES_CBC_PAD => .cbc_pad,
+        ck.CKM_AES_GCM => .gcm,
+        else => null,
+    };
+}
+
+pub fn validKeyLen(len: usize) bool {
+    return len == config.aes_min_key_bytes or len == config.aes_max_key_bytes;
+}
+
+fn encBlockRaw(key: []const u8, in: *const [block]u8, out: *[block]u8) void {
+    switch (key.len) {
+        16 => aes.Aes128.initEnc(key[0..16].*).encrypt(out, in),
+        32 => aes.Aes256.initEnc(key[0..32].*).encrypt(out, in),
+        else => unreachable,
+    }
+}
+
+fn decBlockRaw(key: []const u8, in: *const [block]u8, out: *[block]u8) void {
+    switch (key.len) {
+        16 => aes.Aes128.initDec(key[0..16].*).decrypt(out, in),
+        32 => aes.Aes256.initDec(key[0..32].*).decrypt(out, in),
+        else => unreachable,
+    }
+}
+
+pub const Cipher = struct {
+    mode: Mode,
+    encrypt: bool,
+    key_buf: [32]u8 = @splat(0),
+    key_len: u8 = 0,
+    chain: [block]u8 = @splat(0),
+    partial: [block]u8 = @splat(0),
+    partial_len: u8 = 0,
+    held: [block]u8 = @splat(0),
+    has_held: bool = false,
+    iv: [config.gcm_iv_len]u8 = @splat(0),
+    aad_buf: [config.max_gcm_aad_len]u8 = @splat(0),
+    aad_len: usize = 0,
+
+    fn key(self: *const Cipher) []const u8 {
+        return self.key_buf[0..self.key_len];
+    }
+
+    fn cbcEncStep(self: *Cipher, in16: *const [block]u8, out16: *[block]u8) void {
+        var x: [block]u8 = undefined;
+        defer std.crypto.secureZero(u8, &x);
+        for (0..block) |j| x[j] = in16[j] ^ self.chain[j];
+        encBlockRaw(self.key(), &x, out16);
+        self.chain = out16.*;
+    }
+
+    fn cbcDecStep(self: *Cipher, in16: *const [block]u8, out16: *[block]u8) void {
+        var d: [block]u8 = undefined;
+        defer std.crypto.secureZero(u8, &d);
+        decBlockRaw(self.key(), in16, &d);
+        for (0..block) |j| out16[j] = d[j] ^ self.chain[j];
+        self.chain = in16.*;
+    }
+
+    pub fn encryptUpdate(self: *Cipher, input: []const u8, out: []u8) usize {
+        var o: usize = 0;
+        var i: usize = 0;
+        while (i < input.len) {
+            const take = @min(block - self.partial_len, input.len - i);
+            @memcpy(self.partial[self.partial_len..][0..take], input[i .. i + take]);
+            self.partial_len += @intCast(take);
+            i += take;
+            if (self.partial_len == block) {
+                self.cbcEncStep(&self.partial, out[o..][0..block]);
+                o += block;
+                self.partial_len = 0;
+            }
+        }
+        return o;
+    }
+
+    pub fn encryptFinal(self: *Cipher, out: []u8) Error!usize {
+        if (self.mode == .cbc) {
+            if (self.partial_len != 0) return Error.DataLenRange;
+            return 0;
+        }
+        const padlen: u8 = @intCast(block - self.partial_len);
+        for (self.partial_len..block) |j| self.partial[j] = padlen;
+        self.cbcEncStep(&self.partial, out[0..block]);
+        self.partial_len = 0;
+        return block;
+    }
+
+    pub fn decryptUpdate(self: *Cipher, input: []const u8, out: []u8) usize {
+        var o: usize = 0;
+        var i: usize = 0;
+        while (i < input.len) {
+            const take = @min(block - self.partial_len, input.len - i);
+            @memcpy(self.partial[self.partial_len..][0..take], input[i .. i + take]);
+            self.partial_len += @intCast(take);
+            i += take;
+            if (self.partial_len == block) {
+                if (self.mode == .cbc_pad) {
+                    if (self.has_held) {
+                        self.cbcDecStep(&self.held, out[o..][0..block]);
+                        o += block;
+                    }
+                    self.held = self.partial;
+                    self.has_held = true;
+                } else {
+                    self.cbcDecStep(&self.partial, out[o..][0..block]);
+                    o += block;
+                }
+                self.partial_len = 0;
+            }
+        }
+        return o;
+    }
+
+    pub fn decryptFinal(self: *Cipher, out: []u8) Error!usize {
+        if (self.partial_len != 0) return Error.EncryptedDataLenRange;
+        if (self.mode == .cbc) return 0;
+        if (!self.has_held) return Error.EncryptedDataLenRange;
+        var pt: [block]u8 = undefined;
+        defer std.crypto.secureZero(u8, &pt);
+        self.cbcDecStep(&self.held, &pt);
+        self.has_held = false;
+        const padlen = pt[block - 1];
+        if (padlen == 0 or padlen > block) return Error.EncryptedDataInvalid;
+        var bad: u8 = 0;
+        for (0..block) |j| {
+            const is_pad = j >= block - padlen;
+            if (is_pad) bad |= pt[j] ^ padlen;
+        }
+        if (bad != 0) return Error.EncryptedDataInvalid;
+        const keep = block - padlen;
+        @memcpy(out[0..keep], pt[0..keep]);
+        return keep;
+    }
+
+    pub fn gcmEncrypt(self: *Cipher, input: []const u8, out: []u8) usize {
+        std.debug.assert(out.len >= input.len + config.gcm_tag_len);
+        const tag: *[config.gcm_tag_len]u8 = out[input.len..][0..config.gcm_tag_len];
+        const ad = self.aad_buf[0..self.aad_len];
+        switch (self.key_len) {
+            16 => aesgcm.Aes128Gcm.encrypt(out[0..input.len], tag, input, ad, self.iv, self.key_buf[0..16].*),
+            32 => aesgcm.Aes256Gcm.encrypt(out[0..input.len], tag, input, ad, self.iv, self.key_buf[0..32].*),
+            else => unreachable,
+        }
+        return input.len + config.gcm_tag_len;
+    }
+
+    pub fn gcmDecrypt(self: *Cipher, input: []const u8, out: []u8) Error!usize {
+        if (input.len < config.gcm_tag_len) return Error.EncryptedDataLenRange;
+        const ct_len = input.len - config.gcm_tag_len;
+        std.debug.assert(out.len >= ct_len);
+        const tag: [config.gcm_tag_len]u8 = input[ct_len..][0..config.gcm_tag_len].*;
+        const ad = self.aad_buf[0..self.aad_len];
+        switch (self.key_len) {
+            16 => aesgcm.Aes128Gcm.decrypt(out[0..ct_len], input[0..ct_len], tag, ad, self.iv, self.key_buf[0..16].*) catch return Error.EncryptedDataInvalid,
+            32 => aesgcm.Aes256Gcm.decrypt(out[0..ct_len], input[0..ct_len], tag, ad, self.iv, self.key_buf[0..32].*) catch return Error.EncryptedDataInvalid,
+            else => unreachable,
+        }
+        return ct_len;
+    }
+};
+
+pub fn encryptOutLen(mode: Mode, in_len: usize) usize {
+    return switch (mode) {
+        .cbc => in_len,
+        .cbc_pad => (in_len / block + 1) * block,
+        .gcm => in_len + config.gcm_tag_len,
+    };
+}
+
+pub fn decryptOutLen(mode: Mode, in_len: usize) usize {
+    return switch (mode) {
+        .cbc, .cbc_pad => in_len,
+        .gcm => if (in_len >= config.gcm_tag_len) in_len - config.gcm_tag_len else 0,
+    };
+}
+
+pub const WrapError = error{ KeySize, DataLen, Integrity };
+
+pub const key_wrap_overhead = 8;
+
+const key_wrap_iv = [8]u8{ 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6 };
+
+fn xorCounter(a: *[8]u8, t: u64) void {
+    var tb: [8]u8 = undefined;
+    std.mem.writeInt(u64, &tb, t, .big);
+    for (a, tb) |*x, y| x.* ^= y;
+}
+
+pub fn aesKeyWrap(kek: []const u8, plain: []const u8, out: []u8) WrapError!usize {
+    if (kek.len != config.aes_min_key_bytes and kek.len != config.aes_max_key_bytes) return WrapError.KeySize;
+    if (plain.len < 2 * key_wrap_overhead or plain.len % key_wrap_overhead != 0) return WrapError.DataLen;
+    std.debug.assert(out.len >= plain.len + key_wrap_overhead);
+    const n = plain.len / key_wrap_overhead;
+    @memcpy(out[key_wrap_overhead..][0..plain.len], plain);
+    const r = out[key_wrap_overhead..][0..plain.len];
+    var a: [8]u8 = key_wrap_iv;
+    var blk: [block]u8 = undefined;
+    var enc: [block]u8 = undefined;
+    defer {
+        std.crypto.secureZero(u8, &a);
+        std.crypto.secureZero(u8, &blk);
+        std.crypto.secureZero(u8, &enc);
+    }
+    var j: usize = 0;
+    while (j < 6) : (j += 1) {
+        var i: usize = 0;
+        while (i < n) : (i += 1) {
+            @memcpy(blk[0..8], &a);
+            @memcpy(blk[8..16], r[i * 8 ..][0..8]);
+            encBlockRaw(kek, &blk, &enc);
+            @memcpy(&a, enc[0..8]);
+            xorCounter(&a, n * j + i + 1);
+            @memcpy(r[i * 8 ..][0..8], enc[8..16]);
+        }
+    }
+    @memcpy(out[0..8], &a);
+    return plain.len + key_wrap_overhead;
+}
+
+pub fn aesKeyUnwrap(kek: []const u8, wrapped: []const u8, out: []u8) WrapError!usize {
+    if (kek.len != config.aes_min_key_bytes and kek.len != config.aes_max_key_bytes) return WrapError.KeySize;
+    if (wrapped.len < 3 * key_wrap_overhead or wrapped.len % key_wrap_overhead != 0) return WrapError.DataLen;
+    const n = wrapped.len / key_wrap_overhead - 1;
+    const plain_len = n * key_wrap_overhead;
+    std.debug.assert(out.len >= plain_len);
+    @memcpy(out[0..plain_len], wrapped[key_wrap_overhead..][0..plain_len]);
+    const r = out[0..plain_len];
+    var a: [8]u8 = undefined;
+    @memcpy(&a, wrapped[0..8]);
+    var blk: [block]u8 = undefined;
+    var dec: [block]u8 = undefined;
+    defer {
+        std.crypto.secureZero(u8, &a);
+        std.crypto.secureZero(u8, &blk);
+        std.crypto.secureZero(u8, &dec);
+    }
+    var j: usize = 6;
+    while (j > 0) {
+        j -= 1;
+        var i: usize = n;
+        while (i > 0) {
+            i -= 1;
+            xorCounter(&a, n * j + i + 1);
+            @memcpy(blk[0..8], &a);
+            @memcpy(blk[8..16], r[i * 8 ..][0..8]);
+            decBlockRaw(kek, &blk, &dec);
+            @memcpy(&a, dec[0..8]);
+            @memcpy(r[i * 8 ..][0..8], dec[8..16]);
+        }
+    }
+    var diff: u8 = 0;
+    for (a, key_wrap_iv) |x, y| diff |= x ^ y;
+    if (diff != 0) {
+        std.crypto.secureZero(u8, out[0..plain_len]);
+        return WrapError.Integrity;
+    }
+    return plain_len;
+}
+
+fn testKey() [32]u8 {
+    var k: [32]u8 = undefined;
+    for (0..32) |j| k[j] = @intCast(j);
+    return k;
+}
+
+test "AES-256-CBC single-block matches a NIST SP800-38A vector" {
+    const key = [_]u8{
+        0x60, 0x3d, 0xeb, 0x10, 0x15, 0xca, 0x71, 0xbe, 0x2b, 0x73, 0xae, 0xf0, 0x85, 0x7d, 0x77, 0x81,
+        0x1f, 0x35, 0x2c, 0x07, 0x3b, 0x61, 0x08, 0xd7, 0x2d, 0x98, 0x10, 0xa3, 0x09, 0x14, 0xdf, 0xf4,
+    };
+    const iv = [_]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f };
+    const pt = [_]u8{ 0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96, 0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a };
+    const expect = [_]u8{ 0xf5, 0x8c, 0x4c, 0x04, 0xd6, 0xe5, 0xf1, 0xba, 0x77, 0x9e, 0xab, 0xfb, 0x5f, 0x7b, 0xfb, 0xd6 };
+
+    var c: Cipher = .{ .mode = .cbc, .encrypt = true, .key_len = 32 };
+    c.key_buf = key;
+    c.chain = iv;
+    var out: [16]u8 = undefined;
+    const n = c.encryptUpdate(&pt, &out);
+    try std.testing.expectEqual(@as(usize, 16), n);
+    try std.testing.expectEqualSlices(u8, &expect, &out);
+}
+
+test "CBC-PAD round-trips arbitrary lengths" {
+    const key = testKey();
+    const iv = [_]u8{1} ** 16;
+    for ([_]usize{ 0, 1, 15, 16, 17, 100 }) |len| {
+        var pt: [100]u8 = undefined;
+        for (0..len) |j| pt[j] = @intCast((j * 7) & 0xff);
+
+        var enc: Cipher = .{ .mode = .cbc_pad, .encrypt = true, .key_len = 32 };
+        enc.key_buf = key;
+        enc.chain = iv;
+        var ct: [128]u8 = undefined;
+        var cn = enc.encryptUpdate(pt[0..len], &ct);
+        cn += try enc.encryptFinal(ct[cn..]);
+        try std.testing.expectEqual(encryptOutLen(.cbc_pad, len), cn);
+
+        var dec: Cipher = .{ .mode = .cbc_pad, .encrypt = false, .key_len = 32 };
+        dec.key_buf = key;
+        dec.chain = iv;
+        var back: [128]u8 = undefined;
+        var bn = dec.decryptUpdate(ct[0..cn], &back);
+        bn += try dec.decryptFinal(back[bn..]);
+        try std.testing.expectEqual(len, bn);
+        try std.testing.expectEqualSlices(u8, pt[0..len], back[0..bn]);
+    }
+}
+
+test "CBC-PAD streaming in small chunks equals one-shot" {
+    const key = testKey();
+    const iv = [_]u8{2} ** 16;
+    var pt: [70]u8 = undefined;
+    for (0..70) |j| pt[j] = @intCast(j);
+
+    var enc: Cipher = .{ .mode = .cbc_pad, .encrypt = true, .key_len = 16 };
+    enc.key_buf = key;
+    enc.chain = iv;
+    var ct: [96]u8 = undefined;
+    var cn = enc.encryptUpdate(&pt, &ct);
+    cn += try enc.encryptFinal(ct[cn..]);
+
+    var dec: Cipher = .{ .mode = .cbc_pad, .encrypt = false, .key_len = 16 };
+    dec.key_buf = key;
+    dec.chain = iv;
+    var back: [96]u8 = undefined;
+    var bn: usize = 0;
+    var i: usize = 0;
+    while (i < cn) : (i += 7) {
+        const end = @min(i + 7, cn);
+        bn += dec.decryptUpdate(ct[i..end], back[bn..]);
+    }
+    bn += try dec.decryptFinal(back[bn..]);
+    try std.testing.expectEqual(@as(usize, 70), bn);
+    try std.testing.expectEqualSlices(u8, &pt, back[0..bn]);
+}
+
+test "GCM round-trips and rejects a tampered tag" {
+    const key = testKey();
+    var c: Cipher = .{ .mode = .gcm, .encrypt = true, .key_len = 32 };
+    c.key_buf = key;
+    c.iv = [_]u8{7} ** 12;
+    const pt = "authenticated secret";
+    var ct: [64]u8 = undefined;
+    const cn = c.gcmEncrypt(pt, &ct);
+    try std.testing.expectEqual(pt.len + 16, cn);
+
+    var d: Cipher = .{ .mode = .gcm, .encrypt = false, .key_len = 32 };
+    d.key_buf = key;
+    d.iv = [_]u8{7} ** 12;
+    var back: [64]u8 = undefined;
+    const bn = try d.gcmDecrypt(ct[0..cn], &back);
+    try std.testing.expectEqualSlices(u8, pt, back[0..bn]);
+
+    ct[0] ^= 0x01;
+    var d2: Cipher = .{ .mode = .gcm, .encrypt = false, .key_len = 32 };
+    d2.key_buf = key;
+    d2.iv = [_]u8{7} ** 12;
+    try std.testing.expectError(Error.EncryptedDataInvalid, d2.gcmDecrypt(ct[0..cn], &back));
+}
+
+test "AES-128 key wrap matches the RFC 3394 section 4.1 KAT and unwraps" {
+    const kek = [_]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f };
+    const plain = [_]u8{ 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff };
+    const expect = [_]u8{ 0x1f, 0xa6, 0x8b, 0x0a, 0x81, 0x12, 0xb4, 0x47, 0xae, 0xf3, 0x4b, 0xd8, 0xfb, 0x5a, 0x7b, 0x82, 0x9d, 0x3e, 0x86, 0x23, 0x71, 0xd2, 0xcf, 0xe5 };
+
+    var out: [24]u8 = undefined;
+    const n = try aesKeyWrap(&kek, &plain, &out);
+    try std.testing.expectEqual(@as(usize, 24), n);
+    try std.testing.expectEqualSlices(u8, &expect, &out);
+
+    var back: [16]u8 = undefined;
+    const m = try aesKeyUnwrap(&kek, &out, &back);
+    try std.testing.expectEqual(@as(usize, 16), m);
+    try std.testing.expectEqualSlices(u8, &plain, &back);
+}
+
+test "AES-256 key wrap round-trips 256-bit key material and rejects tampering" {
+    const kek = testKey();
+    var plain: [32]u8 = undefined;
+    for (0..32) |k| plain[k] = @intCast((k * 11) & 0xff);
+
+    var wrapped: [40]u8 = undefined;
+    const n = try aesKeyWrap(&kek, &plain, &wrapped);
+    try std.testing.expectEqual(@as(usize, 40), n);
+
+    var back: [32]u8 = undefined;
+    const m = try aesKeyUnwrap(&kek, &wrapped, &back);
+    try std.testing.expectEqual(@as(usize, 32), m);
+    try std.testing.expectEqualSlices(u8, &plain, &back);
+
+    wrapped[3] ^= 0x01;
+    try std.testing.expectError(WrapError.Integrity, aesKeyUnwrap(&kek, &wrapped, &back));
+}
+
+test "AES key wrap rejects bad input and KEK lengths" {
+    const kek = testKey();
+    var out: [64]u8 = undefined;
+    try std.testing.expectError(WrapError.DataLen, aesKeyWrap(&kek, &[_]u8{0} ** 8, &out));
+    try std.testing.expectError(WrapError.DataLen, aesKeyWrap(&kek, &[_]u8{0} ** 20, &out));
+    try std.testing.expectError(WrapError.DataLen, aesKeyUnwrap(&kek, &[_]u8{0} ** 16, &out));
+    try std.testing.expectError(WrapError.KeySize, aesKeyWrap(&[_]u8{0} ** 24, &[_]u8{0} ** 16, &out));
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/crypto/digest.zig b/PROJECTS/advanced/hsm-emulator/src/crypto/digest.zig
new file mode 100644
index 00000000..e2d848a9
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/crypto/digest.zig
@@ -0,0 +1,160 @@
+// ©AngelaMos | 2026
+// digest.zig
+
+const std = @import("std");
+const ck = @import("../ck.zig");
+
+const sha2 = std.crypto.hash.sha2;
+
+pub const max_digest_len = sha2.Sha512.digest_length;
+
+pub const state_tag_sha256: u8 = 1;
+pub const state_tag_sha384: u8 = 2;
+pub const state_tag_sha512: u8 = 3;
+
+pub const Hasher = union(enum) {
+    sha256: sha2.Sha256,
+    sha384: sha2.Sha384,
+    sha512: sha2.Sha512,
+
+    pub fn init(mech: ck.CK_MECHANISM_TYPE) ?Hasher {
+        return switch (mech) {
+            ck.CKM_SHA256 => .{ .sha256 = sha2.Sha256.init(.{}) },
+            ck.CKM_SHA384 => .{ .sha384 = sha2.Sha384.init(.{}) },
+            ck.CKM_SHA512 => .{ .sha512 = sha2.Sha512.init(.{}) },
+            else => null,
+        };
+    }
+
+    pub fn update(self: *Hasher, data: []const u8) void {
+        switch (self.*) {
+            inline else => |*h| h.update(data),
+        }
+    }
+
+    pub fn digestLen(self: *const Hasher) usize {
+        return switch (self.*) {
+            inline else => |h| @TypeOf(h).digest_length,
+        };
+    }
+
+    pub fn finalInto(self: *Hasher, out: []u8) void {
+        switch (self.*) {
+            inline else => |*h| {
+                const Hash = @TypeOf(h.*);
+                h.final(out[0..Hash.digest_length]);
+            },
+        }
+    }
+
+    pub fn stateTag(self: *const Hasher) u8 {
+        return switch (self.*) {
+            .sha256 => state_tag_sha256,
+            .sha384 => state_tag_sha384,
+            .sha512 => state_tag_sha512,
+        };
+    }
+
+    pub fn stateLen(self: *const Hasher) usize {
+        return switch (self.*) {
+            inline else => |*h| @sizeOf(@TypeOf(h.*)),
+        };
+    }
+
+    pub fn writeState(self: *const Hasher, out: []u8) void {
+        switch (self.*) {
+            inline else => |*h| @memcpy(out[0..@sizeOf(@TypeOf(h.*))], std.mem.asBytes(h)),
+        }
+    }
+
+    pub fn fromState(tag: u8, bytes: []const u8) ?Hasher {
+        switch (tag) {
+            state_tag_sha256 => {
+                if (bytes.len != @sizeOf(sha2.Sha256)) return null;
+                var h: Hasher = .{ .sha256 = undefined };
+                @memcpy(std.mem.asBytes(&h.sha256), bytes);
+                return h;
+            },
+            state_tag_sha384 => {
+                if (bytes.len != @sizeOf(sha2.Sha384)) return null;
+                var h: Hasher = .{ .sha384 = undefined };
+                @memcpy(std.mem.asBytes(&h.sha384), bytes);
+                return h;
+            },
+            state_tag_sha512 => {
+                if (bytes.len != @sizeOf(sha2.Sha512)) return null;
+                var h: Hasher = .{ .sha512 = undefined };
+                @memcpy(std.mem.asBytes(&h.sha512), bytes);
+                return h;
+            },
+            else => return null,
+        }
+    }
+};
+
+pub fn digestLenOf(mech: ck.CK_MECHANISM_TYPE) ?usize {
+    return switch (mech) {
+        ck.CKM_SHA256 => sha2.Sha256.digest_length,
+        ck.CKM_SHA384 => sha2.Sha384.digest_length,
+        ck.CKM_SHA512 => sha2.Sha512.digest_length,
+        else => null,
+    };
+}
+
+test "one-shot digest matches a known SHA-256 vector" {
+    var h = Hasher.init(ck.CKM_SHA256).?;
+    h.update("abc");
+    var out: [max_digest_len]u8 = undefined;
+    h.finalInto(&out);
+    const expect = [_]u8{
+        0xba, 0x78, 0x16, 0xbf, 0x8f, 0x01, 0xcf, 0xea,
+        0x41, 0x41, 0x40, 0xde, 0x5d, 0xae, 0x22, 0x23,
+        0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c,
+        0xb4, 0x10, 0xff, 0x61, 0xf2, 0x00, 0x15, 0xad,
+    };
+    try std.testing.expectEqual(@as(usize, 32), h.digestLen());
+    try std.testing.expectEqualSlices(u8, &expect, out[0..32]);
+}
+
+test "multi-part digest equals single-part" {
+    var a = Hasher.init(ck.CKM_SHA512).?;
+    a.update("hello world");
+    var oa: [max_digest_len]u8 = undefined;
+    a.finalInto(&oa);
+
+    var b = Hasher.init(ck.CKM_SHA512).?;
+    b.update("hello ");
+    b.update("world");
+    var ob: [max_digest_len]u8 = undefined;
+    b.finalInto(&ob);
+
+    try std.testing.expectEqualSlices(u8, oa[0..64], ob[0..64]);
+}
+
+test "unknown mechanism yields null" {
+    try std.testing.expect(Hasher.init(ck.CKM_AES_CBC) == null);
+    try std.testing.expect(digestLenOf(ck.CKM_SHA384).? == 48);
+}
+
+test "op-state serialize then restore continues the same digest" {
+    var a = Hasher.init(ck.CKM_SHA256).?;
+    a.update("first part ");
+
+    var blob: [1 + @sizeOf(sha2.Sha512)]u8 = undefined;
+    const tag = a.stateTag();
+    const len = a.stateLen();
+    a.writeState(blob[0..len]);
+
+    var b = Hasher.fromState(tag, blob[0..len]).?;
+    a.update("second part");
+    b.update("second part");
+
+    var oa: [max_digest_len]u8 = undefined;
+    var ob: [max_digest_len]u8 = undefined;
+    a.finalInto(&oa);
+    b.finalInto(&ob);
+    try std.testing.expectEqualSlices(u8, oa[0..32], ob[0..32]);
+
+    try std.testing.expect(Hasher.fromState(99, blob[0..len]) == null);
+    try std.testing.expect(Hasher.fromState(tag, blob[0 .. len - 1]) == null);
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/crypto/ecdsa.zig b/PROJECTS/advanced/hsm-emulator/src/crypto/ecdsa.zig
new file mode 100644
index 00000000..aed244c2
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/crypto/ecdsa.zig
@@ -0,0 +1,466 @@
+// ©AngelaMos | 2026
+// ecdsa.zig
+
+const std = @import("std");
+const ck = @import("../ck.zig");
+const config = @import("../config.zig");
+const digest = @import("digest.zig");
+
+const P256 = std.crypto.sign.ecdsa.EcdsaP256Sha256;
+const P384 = std.crypto.sign.ecdsa.EcdsaP384Sha384;
+
+pub const max_scalar = P384.SecretKey.encoded_length;
+pub const max_point = P384.PublicKey.uncompressed_sec1_encoded_length;
+pub const max_sig = P384.Signature.encoded_length;
+pub const max_prehash = digest.max_digest_len;
+pub const max_ec_point_der = 2 + max_point;
+
+const der_octet_string: u8 = 0x04;
+const der_long_form_bit: u8 = 0x80;
+
+const oid_p256 = [_]u8{ 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07 };
+const oid_p384 = [_]u8{ 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x22 };
+
+pub const Error = error{
+    Random,
+    Generate,
+    Crypto,
+};
+
+pub const Curve = enum {
+    p256,
+    p384,
+
+    pub fn scalarLen(self: Curve) usize {
+        return switch (self) {
+            .p256 => P256.SecretKey.encoded_length,
+            .p384 => P384.SecretKey.encoded_length,
+        };
+    }
+
+    pub fn pointLen(self: Curve) usize {
+        return switch (self) {
+            .p256 => P256.PublicKey.uncompressed_sec1_encoded_length,
+            .p384 => P384.PublicKey.uncompressed_sec1_encoded_length,
+        };
+    }
+
+    pub fn sigLen(self: Curve) usize {
+        return switch (self) {
+            .p256 => P256.Signature.encoded_length,
+            .p384 => P384.Signature.encoded_length,
+        };
+    }
+
+    pub fn bits(self: Curve) ck.CK_ULONG {
+        return switch (self) {
+            .p256 => config.ec_min_key_bits,
+            .p384 => config.ec_max_key_bits,
+        };
+    }
+
+    pub fn oidDer(self: Curve) []const u8 {
+        return switch (self) {
+            .p256 => &oid_p256,
+            .p384 => &oid_p384,
+        };
+    }
+};
+
+pub const HashMode = enum { raw, sha256 };
+
+pub fn hashModeOf(mech: ck.CK_MECHANISM_TYPE) ?HashMode {
+    return switch (mech) {
+        ck.CKM_ECDSA => .raw,
+        ck.CKM_ECDSA_SHA256 => .sha256,
+        else => null,
+    };
+}
+
+pub fn curveFromParams(ec_params: []const u8) ?Curve {
+    if (std.mem.eql(u8, ec_params, &oid_p256)) return .p256;
+    if (std.mem.eql(u8, ec_params, &oid_p384)) return .p384;
+    return null;
+}
+
+pub fn wrapEcPoint(out: []u8, sec1: []const u8) []u8 {
+    out[0] = der_octet_string;
+    out[1] = @intCast(sec1.len);
+    @memcpy(out[2..][0..sec1.len], sec1);
+    return out[0 .. 2 + sec1.len];
+}
+
+pub fn unwrapEcPoint(der: []const u8) ?[]const u8 {
+    if (der.len < 2 or der[0] != der_octet_string) return null;
+    if (der[1] & der_long_form_bit == 0) {
+        const len: usize = der[1];
+        if (2 + len != der.len) return null;
+        return der[2 .. 2 + len];
+    }
+    const nlen: usize = der[1] & ~der_long_form_bit;
+    if (nlen == 0 or nlen > 2 or der.len < 2 + nlen) return null;
+    var len: usize = 0;
+    for (der[2 .. 2 + nlen]) |b| len = (len << 8) | b;
+    if (2 + nlen + len != der.len) return null;
+    return der[2 + nlen .. 2 + nlen + len];
+}
+
+pub const KeyMaterial = struct {
+    curve: Curve,
+    scalar: [max_scalar]u8 = @splat(0),
+    point: [max_point]u8 = @splat(0),
+
+    pub fn scalarBytes(self: *const KeyMaterial) []const u8 {
+        return self.scalar[0..self.curve.scalarLen()];
+    }
+
+    pub fn pointBytes(self: *const KeyMaterial) []const u8 {
+        return self.point[0..self.curve.pointLen()];
+    }
+};
+
+pub fn generate(io: std.Io, curve: Curve) Error!KeyMaterial {
+    return switch (curve) {
+        .p256 => generateImpl(P256, io, curve),
+        .p384 => generateImpl(P384, io, curve),
+    };
+}
+
+fn generateImpl(comptime Scheme: type, io: std.Io, curve: Curve) Error!KeyMaterial {
+    var attempt: usize = 0;
+    while (attempt < config.ec_keygen_max_attempts) : (attempt += 1) {
+        var seed: [Scheme.KeyPair.seed_length]u8 = undefined;
+        defer std.crypto.secureZero(u8, &seed);
+        io.randomSecure(&seed) catch return Error.Random;
+        const kp = Scheme.KeyPair.generateDeterministic(seed) catch continue;
+        var km: KeyMaterial = .{ .curve = curve };
+        const sk = kp.secret_key.toBytes();
+        @memcpy(km.scalar[0..sk.len], &sk);
+        const pt = kp.public_key.toUncompressedSec1();
+        @memcpy(km.point[0..pt.len], &pt);
+        return km;
+    }
+    return Error.Generate;
+}
+
+fn reduce(curve: Curve, dgst: []const u8, out: *[max_scalar]u8) []const u8 {
+    const n = curve.scalarLen();
+    @memset(out[0..n], 0);
+    if (dgst.len >= n) {
+        @memcpy(out[0..n], dgst[0..n]);
+    } else {
+        @memcpy(out[n - dgst.len .. n], dgst);
+    }
+    return out[0..n];
+}
+
+const Accum = struct {
+    mode: HashMode,
+    hasher: ?digest.Hasher = null,
+    raw: [max_prehash]u8 = @splat(0),
+    raw_len: usize = 0,
+
+    fn init(mode: HashMode) Accum {
+        return .{
+            .mode = mode,
+            .hasher = if (mode == .sha256) digest.Hasher.init(ck.CKM_SHA256) else null,
+        };
+    }
+
+    fn update(self: *Accum, data: []const u8) void {
+        switch (self.mode) {
+            .sha256 => self.hasher.?.update(data),
+            .raw => {
+                const take = @min(max_prehash - self.raw_len, data.len);
+                @memcpy(self.raw[self.raw_len..][0..take], data[0..take]);
+                self.raw_len += take;
+            },
+        }
+    }
+
+    fn digestBytes(self: *Accum, buf: *[max_prehash]u8) []const u8 {
+        switch (self.mode) {
+            .raw => return self.raw[0..self.raw_len],
+            .sha256 => {
+                const dlen = self.hasher.?.digestLen();
+                self.hasher.?.finalInto(buf[0..dlen]);
+                return buf[0..dlen];
+            },
+        }
+    }
+};
+
+pub const SignState = struct {
+    curve: Curve,
+    scalar: [max_scalar]u8 = @splat(0),
+    acc: Accum,
+
+    pub fn init(curve: Curve, mech: ck.CK_MECHANISM_TYPE, scalar: []const u8) ?SignState {
+        const mode = hashModeOf(mech) orelse return null;
+        if (scalar.len != curve.scalarLen()) return null;
+        var st: SignState = .{ .curve = curve, .acc = Accum.init(mode) };
+        @memcpy(st.scalar[0..scalar.len], scalar);
+        return st;
+    }
+
+    pub fn update(self: *SignState, data: []const u8) void {
+        self.acc.update(data);
+    }
+
+    pub fn sigLen(self: *const SignState) usize {
+        return self.curve.sigLen();
+    }
+
+    pub fn finalInto(self: *SignState, io: std.Io, out: []u8) Error!usize {
+        var dbuf: [max_prehash]u8 = undefined;
+        const dgst = self.acc.digestBytes(&dbuf);
+        var phbuf: [max_scalar]u8 = undefined;
+        const prehash = reduce(self.curve, dgst, &phbuf);
+        return switch (self.curve) {
+            .p256 => signImpl(P256, self.scalar[0..P256.SecretKey.encoded_length], prehash, io, out),
+            .p384 => signImpl(P384, self.scalar[0..P384.SecretKey.encoded_length], prehash, io, out),
+        };
+    }
+};
+
+fn signImpl(comptime Scheme: type, scalar: []const u8, prehash: []const u8, io: std.Io, out: []u8) Error!usize {
+    const slen = Scheme.SecretKey.encoded_length;
+    const siglen = Scheme.Signature.encoded_length;
+
+    var sk: [slen]u8 = undefined;
+    defer std.crypto.secureZero(u8, &sk);
+    @memcpy(&sk, scalar[0..slen]);
+    const kp = Scheme.KeyPair.fromSecretKey(.{ .bytes = sk }) catch return Error.Crypto;
+
+    var ph: [slen]u8 = undefined;
+    @memcpy(&ph, prehash[0..slen]);
+
+    var noise: [slen]u8 = undefined;
+    defer std.crypto.secureZero(u8, &noise);
+    const nz: ?[slen]u8 = if (io.randomSecure(&noise)) |_| noise else |_| null;
+
+    const sig = kp.signPrehashed(ph, nz) catch return Error.Crypto;
+    const raw = sig.toBytes();
+    @memcpy(out[0..siglen], &raw);
+    return siglen;
+}
+
+pub const VerifyResult = enum { ok, invalid, len_range };
+
+pub const VerifyState = struct {
+    curve: Curve,
+    point: [max_point]u8 = @splat(0),
+    acc: Accum,
+
+    pub fn init(curve: Curve, mech: ck.CK_MECHANISM_TYPE, point_sec1: []const u8) ?VerifyState {
+        const mode = hashModeOf(mech) orelse return null;
+        if (point_sec1.len != curve.pointLen()) return null;
+        if (!validPoint(curve, point_sec1)) return null;
+        var st: VerifyState = .{ .curve = curve, .acc = Accum.init(mode) };
+        @memcpy(st.point[0..point_sec1.len], point_sec1);
+        return st;
+    }
+
+    pub fn update(self: *VerifyState, data: []const u8) void {
+        self.acc.update(data);
+    }
+
+    pub fn finalVerify(self: *VerifyState, sig: []const u8) VerifyResult {
+        if (sig.len != self.curve.sigLen()) return .len_range;
+        var dbuf: [max_prehash]u8 = undefined;
+        const dgst = self.acc.digestBytes(&dbuf);
+        var phbuf: [max_scalar]u8 = undefined;
+        const prehash = reduce(self.curve, dgst, &phbuf);
+        const point = self.point[0..self.curve.pointLen()];
+        return switch (self.curve) {
+            .p256 => verifyImpl(P256, point, prehash, sig),
+            .p384 => verifyImpl(P384, point, prehash, sig),
+        };
+    }
+};
+
+fn validPoint(curve: Curve, point_sec1: []const u8) bool {
+    switch (curve) {
+        .p256 => {
+            _ = P256.PublicKey.fromSec1(point_sec1) catch return false;
+        },
+        .p384 => {
+            _ = P384.PublicKey.fromSec1(point_sec1) catch return false;
+        },
+    }
+    return true;
+}
+
+fn verifyImpl(comptime Scheme: type, point: []const u8, prehash: []const u8, sig: []const u8) VerifyResult {
+    const slen = Scheme.SecretKey.encoded_length;
+    const siglen = Scheme.Signature.encoded_length;
+
+    const pk = Scheme.PublicKey.fromSec1(point) catch return .invalid;
+
+    var sb: [siglen]u8 = undefined;
+    @memcpy(&sb, sig[0..siglen]);
+    const signature = Scheme.Signature.fromBytes(sb);
+
+    var ph: [slen]u8 = undefined;
+    @memcpy(&ph, prehash[0..slen]);
+
+    signature.verifyPrehashed(ph, pk) catch return .invalid;
+    return .ok;
+}
+
+pub fn ecdh(curve: Curve, scalar: []const u8, peer_point_sec1: []const u8, out: []u8) Error!usize {
+    return switch (curve) {
+        .p256 => ecdhImpl(std.crypto.ecc.P256, 32, scalar, peer_point_sec1, out),
+        .p384 => ecdhImpl(std.crypto.ecc.P384, 48, scalar, peer_point_sec1, out),
+    };
+}
+
+fn ecdhImpl(comptime Pt: type, comptime n: usize, scalar: []const u8, peer_point_sec1: []const u8, out: []u8) Error!usize {
+    if (scalar.len != n or out.len < n) return Error.Crypto;
+    const peer = Pt.fromSec1(peer_point_sec1) catch return Error.Crypto;
+    var s: [n]u8 = undefined;
+    defer std.crypto.secureZero(u8, &s);
+    @memcpy(&s, scalar[0..n]);
+    const shared = peer.mul(s, .big) catch return Error.Crypto;
+    const xb = shared.affineCoordinates().x.toBytes(.big);
+    @memcpy(out[0..n], xb[0..n]);
+    return n;
+}
+
+fn hexToBytes(comptime hex: []const u8) [hex.len / 2]u8 {
+    var out: [hex.len / 2]u8 = undefined;
+    _ = std.fmt.hexToBytes(&out, hex) catch unreachable;
+    return out;
+}
+
+test "RFC 6979 P-256/SHA-256 sample vector verifies and rejects tampering" {
+    const ux = hexToBytes("60FED4BA255A9D31C961EB74C6356D68C049B8923B61FA6CE669622E60F29FB6");
+    const uy = hexToBytes("7903FE1008B8BC99A41AE9E95628BC64F2F1B20C2D7E9F5177A3C294D4462299");
+    const point = [_]u8{0x04} ++ ux ++ uy;
+    var sig = hexToBytes("EFD48B2AACB6A8FD1140DD9CD45E81D69D2C877B56AAF991C34D0EA84EAF3716") ++
+        hexToBytes("F7CB1C942D657C41D436C7A1B6E29F65F3E900DBB9AFF4064DC4AB2F843ACDA8");
+
+    var v = VerifyState.init(.p256, ck.CKM_ECDSA_SHA256, &point).?;
+    v.update("sample");
+    try std.testing.expectEqual(VerifyResult.ok, v.finalVerify(&sig));
+
+    sig[0] ^= 0x01;
+    var v2 = VerifyState.init(.p256, ck.CKM_ECDSA_SHA256, &point).?;
+    v2.update("sample");
+    try std.testing.expectEqual(VerifyResult.invalid, v2.finalVerify(&sig));
+}
+
+test "P-256 generate then hash-then-sign round-trips and detects tamper" {
+    const io = std.testing.io;
+    const km = try generate(io, .p256);
+
+    var s = SignState.init(.p256, ck.CKM_ECDSA_SHA256, km.scalarBytes()).?;
+    s.update("attack at dawn");
+    var sig: [max_sig]u8 = undefined;
+    const n = try s.finalInto(io, &sig);
+    try std.testing.expectEqual(@as(usize, 64), n);
+
+    var v = VerifyState.init(.p256, ck.CKM_ECDSA_SHA256, km.pointBytes()).?;
+    v.update("attack at dawn");
+    try std.testing.expectEqual(VerifyResult.ok, v.finalVerify(sig[0..n]));
+
+    var v2 = VerifyState.init(.p256, ck.CKM_ECDSA_SHA256, km.pointBytes()).?;
+    v2.update("attack at dusk");
+    try std.testing.expectEqual(VerifyResult.invalid, v2.finalVerify(sig[0..n]));
+}
+
+test "P-256 raw prehash signing round-trips" {
+    const io = std.testing.io;
+    const km = try generate(io, .p256);
+    const hash = [_]u8{0xab} ** 32;
+
+    var s = SignState.init(.p256, ck.CKM_ECDSA, km.scalarBytes()).?;
+    s.update(&hash);
+    var sig: [max_sig]u8 = undefined;
+    const n = try s.finalInto(io, &sig);
+
+    var v = VerifyState.init(.p256, ck.CKM_ECDSA, km.pointBytes()).?;
+    v.update(&hash);
+    try std.testing.expectEqual(VerifyResult.ok, v.finalVerify(sig[0..n]));
+}
+
+test "P-384 generate sign verify round-trips with correct sizes" {
+    const io = std.testing.io;
+    const km = try generate(io, .p384);
+    try std.testing.expectEqual(@as(usize, 48), km.scalarBytes().len);
+    try std.testing.expectEqual(@as(usize, 97), km.pointBytes().len);
+
+    var s = SignState.init(.p384, ck.CKM_ECDSA_SHA256, km.scalarBytes()).?;
+    s.update("p384 message");
+    var sig: [max_sig]u8 = undefined;
+    const n = try s.finalInto(io, &sig);
+    try std.testing.expectEqual(@as(usize, 96), n);
+
+    var v = VerifyState.init(.p384, ck.CKM_ECDSA_SHA256, km.pointBytes()).?;
+    v.update("p384 message");
+    try std.testing.expectEqual(VerifyResult.ok, v.finalVerify(sig[0..n]));
+}
+
+test "P-384 raw prehash signing round-trips" {
+    const io = std.testing.io;
+    const km = try generate(io, .p384);
+    const hash = [_]u8{0xcd} ** 48;
+
+    var s = SignState.init(.p384, ck.CKM_ECDSA, km.scalarBytes()).?;
+    s.update(&hash);
+    var sig: [max_sig]u8 = undefined;
+    const n = try s.finalInto(io, &sig);
+    try std.testing.expectEqual(@as(usize, 96), n);
+
+    var v = VerifyState.init(.p384, ck.CKM_ECDSA, km.pointBytes()).?;
+    v.update(&hash);
+    try std.testing.expectEqual(VerifyResult.ok, v.finalVerify(sig[0..n]));
+}
+
+test "wrong-length signature reports len_range" {
+    const io = std.testing.io;
+    const km = try generate(io, .p256);
+    var v = VerifyState.init(.p256, ck.CKM_ECDSA_SHA256, km.pointBytes()).?;
+    v.update("data");
+    try std.testing.expectEqual(VerifyResult.len_range, v.finalVerify(&[_]u8{0} ** 63));
+}
+
+test "ECDH P-256 shared secret agrees on both sides and rejects a bad point" {
+    const io = std.testing.io;
+    const a = try generate(io, .p256);
+    const b = try generate(io, .p256);
+    var sa: [max_scalar]u8 = undefined;
+    var sb: [max_scalar]u8 = undefined;
+    const na = try ecdh(.p256, a.scalarBytes(), b.pointBytes(), &sa);
+    const nb = try ecdh(.p256, b.scalarBytes(), a.pointBytes(), &sb);
+    try std.testing.expectEqual(@as(usize, 32), na);
+    try std.testing.expectEqualSlices(u8, sa[0..na], sb[0..nb]);
+
+    const bad = [_]u8{0x04} ++ [_]u8{0xff} ** 64;
+    try std.testing.expectError(Error.Crypto, ecdh(.p256, a.scalarBytes(), &bad, &sa));
+}
+
+test "ECDH P-384 shared secret agrees on both sides" {
+    const io = std.testing.io;
+    const a = try generate(io, .p384);
+    const b = try generate(io, .p384);
+    var sa: [max_scalar]u8 = undefined;
+    var sb: [max_scalar]u8 = undefined;
+    const na = try ecdh(.p384, a.scalarBytes(), b.pointBytes(), &sa);
+    const nb = try ecdh(.p384, b.scalarBytes(), a.pointBytes(), &sb);
+    try std.testing.expectEqual(@as(usize, 48), na);
+    try std.testing.expectEqualSlices(u8, sa[0..na], sb[0..nb]);
+}
+
+test "curve OID mapping and EC point DER round-trip" {
+    try std.testing.expectEqual(Curve.p256, curveFromParams(&oid_p256).?);
+    try std.testing.expectEqual(Curve.p384, curveFromParams(&oid_p384).?);
+    try std.testing.expect(curveFromParams(&[_]u8{ 0x06, 0x01, 0x00 }) == null);
+
+    const sec1 = [_]u8{0x04} ++ [_]u8{0x11} ** 64;
+    var buf: [max_ec_point_der]u8 = undefined;
+    const der = wrapEcPoint(&buf, &sec1);
+    try std.testing.expectEqual(@as(usize, 67), der.len);
+    try std.testing.expectEqualSlices(u8, &sec1, unwrapEcPoint(der).?);
+    try std.testing.expect(unwrapEcPoint(&[_]u8{0x05}) == null);
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/crypto/keystore.zig b/PROJECTS/advanced/hsm-emulator/src/crypto/keystore.zig
new file mode 100644
index 00000000..9cccebab
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/crypto/keystore.zig
@@ -0,0 +1,145 @@
+// ©AngelaMos | 2026
+// keystore.zig
+
+const std = @import("std");
+const config = @import("../config.zig");
+const pin = @import("pin.zig");
+
+const gcm = std.crypto.aead.aes_gcm.Aes256Gcm;
+
+pub const mk_len = config.master_key_len;
+pub const nonce_len = config.gcm_iv_len;
+pub const tag_len = config.gcm_tag_len;
+pub const seal_overhead = nonce_len + tag_len;
+
+pub const MasterKey = [mk_len]u8;
+pub const Salt = pin.Salt;
+
+pub const Error = error{ Malformed, AuthFailed };
+
+pub const Wrapped = struct {
+    salt: Salt = @splat(0),
+    nonce: [nonce_len]u8 = @splat(0),
+    ct: [mk_len]u8 = @splat(0),
+    tag: [tag_len]u8 = @splat(0),
+};
+
+pub fn deriveKek(io: std.Io, allocator: std.mem.Allocator, pin_bytes: []const u8, salt: *const Salt, out: *MasterKey) !void {
+    try pin.derive(io, allocator, pin_bytes, salt, out);
+}
+
+pub fn generateMasterKey(io: std.Io, out: *MasterKey) !void {
+    try io.randomSecure(out);
+}
+
+pub fn wrap(io: std.Io, allocator: std.mem.Allocator, pin_bytes: []const u8, mk: *const MasterKey) !Wrapped {
+    var w: Wrapped = .{};
+    try pin.genSalt(io, &w.salt);
+    var kek: MasterKey = undefined;
+    defer std.crypto.secureZero(u8, &kek);
+    try deriveKek(io, allocator, pin_bytes, &w.salt, &kek);
+    try io.randomSecure(&w.nonce);
+    gcm.encrypt(&w.ct, &w.tag, mk, "", w.nonce, kek);
+    return w;
+}
+
+pub fn rewrap(io: std.Io, allocator: std.mem.Allocator, pin_bytes: []const u8, mk: *const MasterKey) !Wrapped {
+    return wrap(io, allocator, pin_bytes, mk);
+}
+
+pub fn unwrap(io: std.Io, allocator: std.mem.Allocator, pin_bytes: []const u8, w: *const Wrapped, out: *MasterKey) !bool {
+    var kek: MasterKey = undefined;
+    defer std.crypto.secureZero(u8, &kek);
+    try deriveKek(io, allocator, pin_bytes, &w.salt, &kek);
+    gcm.decrypt(out, &w.ct, w.tag, "", w.nonce, kek) catch {
+        std.crypto.secureZero(u8, out);
+        return false;
+    };
+    return true;
+}
+
+pub fn sealedLen(plain_len: usize) usize {
+    return nonce_len + plain_len + tag_len;
+}
+
+pub fn seal(io: std.Io, mk: *const MasterKey, ad: []const u8, plain: []const u8, out: []u8) !usize {
+    var nonce: [nonce_len]u8 = undefined;
+    try io.randomSecure(&nonce);
+    @memcpy(out[0..nonce_len], &nonce);
+    const ct = out[nonce_len..][0..plain.len];
+    const tag = out[nonce_len + plain.len ..][0..tag_len];
+    gcm.encrypt(ct, tag, plain, ad, nonce, mk.*);
+    return sealedLen(plain.len);
+}
+
+pub fn unseal(mk: *const MasterKey, ad: []const u8, sealed: []const u8, out: []u8) Error!usize {
+    if (sealed.len < seal_overhead) return Error.Malformed;
+    const ct_len = sealed.len - seal_overhead;
+    var nonce: [nonce_len]u8 = undefined;
+    @memcpy(&nonce, sealed[0..nonce_len]);
+    var tag: [tag_len]u8 = undefined;
+    @memcpy(&tag, sealed[nonce_len + ct_len ..][0..tag_len]);
+    const ct = sealed[nonce_len..][0..ct_len];
+    gcm.decrypt(out[0..ct_len], ct, tag, ad, nonce, mk.*) catch return Error.AuthFailed;
+    return ct_len;
+}
+
+test "master key wrap then unwrap round-trips under the right PIN" {
+    const io = std.testing.io;
+    const a = std.testing.allocator;
+    var mk: MasterKey = undefined;
+    try generateMasterKey(io, &mk);
+
+    const w = try wrap(io, a, "1234", &mk);
+    var got: MasterKey = undefined;
+    try std.testing.expect(try unwrap(io, a, "1234", &w, &got));
+    try std.testing.expectEqualSlices(u8, &mk, &got);
+}
+
+test "unwrap with the wrong PIN fails the GCM tag and yields false" {
+    const io = std.testing.io;
+    const a = std.testing.allocator;
+    var mk: MasterKey = undefined;
+    try generateMasterKey(io, &mk);
+
+    const w = try wrap(io, a, "1234", &mk);
+    var got: MasterKey = undefined;
+    try std.testing.expect(!try unwrap(io, a, "9999", &w, &got));
+}
+
+test "rewrap under a new PIN keeps the same master key recoverable" {
+    const io = std.testing.io;
+    const a = std.testing.allocator;
+    var mk: MasterKey = undefined;
+    try generateMasterKey(io, &mk);
+
+    const w1 = try wrap(io, a, "old-pin", &mk);
+    var unwrapped: MasterKey = undefined;
+    try std.testing.expect(try unwrap(io, a, "old-pin", &w1, &unwrapped));
+
+    const w2 = try rewrap(io, a, "new-pin", &unwrapped);
+    var got: MasterKey = undefined;
+    try std.testing.expect(!try unwrap(io, a, "old-pin", &w2, &got));
+    try std.testing.expect(try unwrap(io, a, "new-pin", &w2, &got));
+    try std.testing.expectEqualSlices(u8, &mk, &got);
+}
+
+test "seal then unseal round-trips and binds the AAD" {
+    const io = std.testing.io;
+    var mk: MasterKey = undefined;
+    try generateMasterKey(io, &mk);
+
+    const secret = "private-scalar-bytes";
+    const ad = "\x11\x00\x00\x00\x00\x00\x00\x00";
+    var sealed: [64]u8 = undefined;
+    const sn = try seal(io, &mk, ad, secret, &sealed);
+    try std.testing.expectEqual(sealedLen(secret.len), sn);
+
+    var out: [64]u8 = undefined;
+    const un = try unseal(&mk, ad, sealed[0..sn], &out);
+    try std.testing.expectEqualSlices(u8, secret, out[0..un]);
+
+    try std.testing.expectError(Error.AuthFailed, unseal(&mk, "\x12\x00\x00\x00\x00\x00\x00\x00", sealed[0..sn], &out));
+    sealed[0] ^= 0x01;
+    try std.testing.expectError(Error.AuthFailed, unseal(&mk, ad, sealed[0..sn], &out));
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/crypto/mac.zig b/PROJECTS/advanced/hsm-emulator/src/crypto/mac.zig
new file mode 100644
index 00000000..0a7e54b7
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/crypto/mac.zig
@@ -0,0 +1,76 @@
+// ©AngelaMos | 2026
+// mac.zig
+
+const std = @import("std");
+const ck = @import("../ck.zig");
+
+const hmac = std.crypto.auth.hmac.sha2;
+
+pub const max_mac_len = hmac.HmacSha512.mac_length;
+
+pub const Mac = union(enum) {
+    sha256: hmac.HmacSha256,
+    sha384: hmac.HmacSha384,
+    sha512: hmac.HmacSha512,
+
+    pub fn init(mech: ck.CK_MECHANISM_TYPE, key: []const u8) ?Mac {
+        return switch (mech) {
+            ck.CKM_SHA256_HMAC => .{ .sha256 = hmac.HmacSha256.init(key) },
+            ck.CKM_SHA384_HMAC => .{ .sha384 = hmac.HmacSha384.init(key) },
+            ck.CKM_SHA512_HMAC => .{ .sha512 = hmac.HmacSha512.init(key) },
+            else => null,
+        };
+    }
+
+    pub fn update(self: *Mac, data: []const u8) void {
+        switch (self.*) {
+            inline else => |*m| m.update(data),
+        }
+    }
+
+    pub fn macLen(self: *const Mac) usize {
+        return switch (self.*) {
+            inline else => |m| @TypeOf(m).mac_length,
+        };
+    }
+
+    pub fn finalInto(self: *Mac, out: []u8) void {
+        switch (self.*) {
+            inline else => |*m| {
+                const M = @TypeOf(m.*);
+                m.final(out[0..M.mac_length]);
+            },
+        }
+    }
+};
+
+pub fn macLenOf(mech: ck.CK_MECHANISM_TYPE) ?usize {
+    return switch (mech) {
+        ck.CKM_SHA256_HMAC => hmac.HmacSha256.mac_length,
+        ck.CKM_SHA384_HMAC => hmac.HmacSha384.mac_length,
+        ck.CKM_SHA512_HMAC => hmac.HmacSha512.mac_length,
+        else => null,
+    };
+}
+
+test "HMAC-SHA256 matches RFC 4231 test case 2" {
+    var m = Mac.init(ck.CKM_SHA256_HMAC, "Jefe").?;
+    m.update("what do ya want ");
+    m.update("for nothing?");
+    var out: [max_mac_len]u8 = undefined;
+    m.finalInto(&out);
+    const expect = [_]u8{
+        0x5b, 0xdc, 0xc1, 0x46, 0xbf, 0x60, 0x75, 0x4e,
+        0x6a, 0x04, 0x24, 0x26, 0x08, 0x95, 0x75, 0xc7,
+        0x5a, 0x00, 0x3f, 0x08, 0x9d, 0x27, 0x39, 0x83,
+        0x9d, 0xec, 0x58, 0xb9, 0x64, 0xec, 0x38, 0x43,
+    };
+    try std.testing.expectEqual(@as(usize, 32), m.macLen());
+    try std.testing.expectEqualSlices(u8, &expect, out[0..32]);
+}
+
+test "macLenOf maps mechanisms and rejects non-HMAC" {
+    try std.testing.expectEqual(@as(?usize, 48), macLenOf(ck.CKM_SHA384_HMAC));
+    try std.testing.expectEqual(@as(?usize, 64), macLenOf(ck.CKM_SHA512_HMAC));
+    try std.testing.expect(macLenOf(ck.CKM_SHA256) == null);
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/crypto/openssl.zig b/PROJECTS/advanced/hsm-emulator/src/crypto/openssl.zig
new file mode 100644
index 00000000..0efcb01a
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/crypto/openssl.zig
@@ -0,0 +1,87 @@
+// ©AngelaMos | 2026
+// openssl.zig
+
+pub const EVP_PKEY = opaque {};
+pub const EVP_PKEY_CTX = opaque {};
+pub const EVP_MD = opaque {};
+pub const EVP_MD_CTX = opaque {};
+pub const ENGINE = opaque {};
+pub const BIGNUM = opaque {};
+pub const OSSL_LIB_CTX = opaque {};
+pub const OSSL_PARAM = opaque {};
+pub const OSSL_PARAM_BLD = opaque {};
+
+pub const pkey_rsa: c_int = 6;
+pub const selection_public_key: c_int = 134;
+pub const selection_keypair: c_int = 135;
+
+pub const pad_pkcs1: c_int = 1;
+pub const pad_oaep: c_int = 4;
+pub const pad_pss: c_int = 6;
+pub const pss_saltlen_digest: c_int = -1;
+
+pub const param_n = "n";
+pub const param_e = "e";
+pub const param_d = "d";
+pub const param_factor1 = "rsa-factor1";
+pub const param_factor2 = "rsa-factor2";
+pub const param_exponent1 = "rsa-exponent1";
+pub const param_exponent2 = "rsa-exponent2";
+pub const param_coefficient1 = "rsa-coefficient1";
+
+pub extern fn EVP_PKEY_CTX_new_id(id: c_int, e: ?*ENGINE) ?*EVP_PKEY_CTX;
+pub extern fn EVP_PKEY_CTX_new(pkey: ?*EVP_PKEY, e: ?*ENGINE) ?*EVP_PKEY_CTX;
+pub extern fn EVP_PKEY_CTX_new_from_name(libctx: ?*OSSL_LIB_CTX, name: [*:0]const u8, propq: ?[*:0]const u8) ?*EVP_PKEY_CTX;
+pub extern fn EVP_PKEY_CTX_free(ctx: ?*EVP_PKEY_CTX) void;
+pub extern fn EVP_PKEY_free(pkey: ?*EVP_PKEY) void;
+
+pub extern fn EVP_PKEY_keygen_init(ctx: ?*EVP_PKEY_CTX) c_int;
+pub extern fn EVP_PKEY_CTX_set_rsa_keygen_bits(ctx: ?*EVP_PKEY_CTX, bits: c_int) c_int;
+pub extern fn EVP_PKEY_generate(ctx: ?*EVP_PKEY_CTX, ppkey: *?*EVP_PKEY) c_int;
+
+pub extern fn EVP_PKEY_get_bits(pkey: ?*const EVP_PKEY) c_int;
+pub extern fn EVP_PKEY_get_bn_param(pkey: ?*const EVP_PKEY, key_name: [*:0]const u8, bn: *?*BIGNUM) c_int;
+
+pub extern fn EVP_PKEY_fromdata_init(ctx: ?*EVP_PKEY_CTX) c_int;
+pub extern fn EVP_PKEY_fromdata(ctx: ?*EVP_PKEY_CTX, ppkey: *?*EVP_PKEY, selection: c_int, params: ?*OSSL_PARAM) c_int;
+
+pub extern fn BN_bin2bn(s: [*]const u8, len: c_int, ret: ?*BIGNUM) ?*BIGNUM;
+pub extern fn BN_bn2binpad(a: ?*const BIGNUM, to: [*]u8, tolen: c_int) c_int;
+pub extern fn BN_num_bits(a: ?*const BIGNUM) c_int;
+pub extern fn BN_free(a: ?*BIGNUM) void;
+pub extern fn BN_clear_free(a: ?*BIGNUM) void;
+
+pub extern fn OSSL_PARAM_BLD_new() ?*OSSL_PARAM_BLD;
+pub extern fn OSSL_PARAM_BLD_push_BN(bld: ?*OSSL_PARAM_BLD, key: [*:0]const u8, bn: ?*const BIGNUM) c_int;
+pub extern fn OSSL_PARAM_BLD_to_param(bld: ?*OSSL_PARAM_BLD) ?*OSSL_PARAM;
+pub extern fn OSSL_PARAM_BLD_free(bld: ?*OSSL_PARAM_BLD) void;
+pub extern fn OSSL_PARAM_free(p: ?*OSSL_PARAM) void;
+
+pub extern fn EVP_MD_CTX_new() ?*EVP_MD_CTX;
+pub extern fn EVP_MD_CTX_free(ctx: ?*EVP_MD_CTX) void;
+pub extern fn EVP_sha256() ?*const EVP_MD;
+pub extern fn EVP_sha384() ?*const EVP_MD;
+pub extern fn EVP_sha512() ?*const EVP_MD;
+
+pub extern fn EVP_DigestSignInit(ctx: ?*EVP_MD_CTX, pctx: ?*?*EVP_PKEY_CTX, mdtype: ?*const EVP_MD, e: ?*ENGINE, pkey: ?*EVP_PKEY) c_int;
+pub extern fn EVP_DigestSign(ctx: ?*EVP_MD_CTX, sigret: ?[*]u8, siglen: *usize, tbs: [*]const u8, tbslen: usize) c_int;
+pub extern fn EVP_DigestVerifyInit(ctx: ?*EVP_MD_CTX, pctx: ?*?*EVP_PKEY_CTX, mdtype: ?*const EVP_MD, e: ?*ENGINE, pkey: ?*EVP_PKEY) c_int;
+pub extern fn EVP_DigestVerify(ctx: ?*EVP_MD_CTX, sig: [*]const u8, siglen: usize, tbs: [*]const u8, tbslen: usize) c_int;
+
+pub extern fn EVP_PKEY_sign_init(ctx: ?*EVP_PKEY_CTX) c_int;
+pub extern fn EVP_PKEY_sign(ctx: ?*EVP_PKEY_CTX, sig: ?[*]u8, siglen: *usize, tbs: [*]const u8, tbslen: usize) c_int;
+pub extern fn EVP_PKEY_verify_init(ctx: ?*EVP_PKEY_CTX) c_int;
+pub extern fn EVP_PKEY_verify(ctx: ?*EVP_PKEY_CTX, sig: [*]const u8, siglen: usize, tbs: [*]const u8, tbslen: usize) c_int;
+pub extern fn EVP_PKEY_verify_recover_init(ctx: ?*EVP_PKEY_CTX) c_int;
+pub extern fn EVP_PKEY_verify_recover(ctx: ?*EVP_PKEY_CTX, rout: ?[*]u8, routlen: *usize, sig: [*]const u8, siglen: usize) c_int;
+
+pub extern fn EVP_PKEY_encrypt_init(ctx: ?*EVP_PKEY_CTX) c_int;
+pub extern fn EVP_PKEY_encrypt(ctx: ?*EVP_PKEY_CTX, out: ?[*]u8, outlen: *usize, in: [*]const u8, inlen: usize) c_int;
+pub extern fn EVP_PKEY_decrypt_init(ctx: ?*EVP_PKEY_CTX) c_int;
+pub extern fn EVP_PKEY_decrypt(ctx: ?*EVP_PKEY_CTX, out: ?[*]u8, outlen: *usize, in: [*]const u8, inlen: usize) c_int;
+
+pub extern fn EVP_PKEY_CTX_set_rsa_padding(ctx: ?*EVP_PKEY_CTX, pad_mode: c_int) c_int;
+pub extern fn EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx: ?*EVP_PKEY_CTX, saltlen: c_int) c_int;
+pub extern fn EVP_PKEY_CTX_set_rsa_mgf1_md(ctx: ?*EVP_PKEY_CTX, md: ?*const EVP_MD) c_int;
+pub extern fn EVP_PKEY_CTX_set_rsa_oaep_md(ctx: ?*EVP_PKEY_CTX, md: ?*const EVP_MD) c_int;
+pub extern fn EVP_PKEY_CTX_set_signature_md(ctx: ?*EVP_PKEY_CTX, md: ?*const EVP_MD) c_int;
diff --git a/PROJECTS/advanced/hsm-emulator/src/crypto/pin.zig b/PROJECTS/advanced/hsm-emulator/src/crypto/pin.zig
new file mode 100644
index 00000000..a9589598
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/crypto/pin.zig
@@ -0,0 +1,77 @@
+// ©AngelaMos | 2026
+// pin.zig
+
+const std = @import("std");
+const config = @import("../config.zig");
+
+const argon2 = std.crypto.pwhash.argon2;
+
+pub const salt_len = config.pin_salt_len;
+pub const hash_len = config.pin_hash_len;
+
+pub const Salt = [salt_len]u8;
+pub const Hash = [hash_len]u8;
+
+const params: argon2.Params = .{
+    .t = config.pin_kdf_t,
+    .m = config.pin_kdf_m_kib,
+    .p = config.pin_kdf_p,
+};
+
+pub fn genSalt(io: std.Io, out: *Salt) !void {
+    try io.randomSecure(out);
+}
+
+pub fn derive(io: std.Io, allocator: std.mem.Allocator, pin: []const u8, salt: *const Salt, out: *Hash) !void {
+    try argon2.kdf(allocator, out, pin, salt, params, .argon2id, io);
+}
+
+pub fn verify(io: std.Io, allocator: std.mem.Allocator, pin: []const u8, salt: *const Salt, expected: *const Hash) !bool {
+    var got: Hash = undefined;
+    defer std.crypto.secureZero(u8, &got);
+    try derive(io, allocator, pin, salt, &got);
+    return std.crypto.timing_safe.eql(Hash, got, expected.*);
+}
+
+test "argon2id derive is deterministic for a fixed salt" {
+    var threaded: std.Io.Threaded = .init(std.testing.allocator, .{});
+    defer threaded.deinit();
+    const io = threaded.io();
+
+    const salt: Salt = @splat(7);
+    var a: Hash = undefined;
+    var b: Hash = undefined;
+    try derive(io, std.testing.allocator, "1234", &salt, &a);
+    try derive(io, std.testing.allocator, "1234", &salt, &b);
+    try std.testing.expectEqual(a, b);
+}
+
+test "verify accepts the right PIN and rejects the wrong one" {
+    var threaded: std.Io.Threaded = .init(std.testing.allocator, .{});
+    defer threaded.deinit();
+    const io = threaded.io();
+
+    var salt: Salt = undefined;
+    try genSalt(io, &salt);
+    var h: Hash = undefined;
+    try derive(io, std.testing.allocator, "secret-pin", &salt, &h);
+
+    try std.testing.expect(try verify(io, std.testing.allocator, "secret-pin", &salt, &h));
+    try std.testing.expect(!try verify(io, std.testing.allocator, "wrong-pin", &salt, &h));
+}
+
+test "a fresh salt changes the derived hash" {
+    var threaded: std.Io.Threaded = .init(std.testing.allocator, .{});
+    defer threaded.deinit();
+    const io = threaded.io();
+
+    var s1: Salt = undefined;
+    var s2: Salt = undefined;
+    try genSalt(io, &s1);
+    try genSalt(io, &s2);
+    var h1: Hash = undefined;
+    var h2: Hash = undefined;
+    try derive(io, std.testing.allocator, "1234", &s1, &h1);
+    try derive(io, std.testing.allocator, "1234", &s2, &h2);
+    try std.testing.expect(!std.mem.eql(u8, &h1, &h2));
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/crypto/rsa.zig b/PROJECTS/advanced/hsm-emulator/src/crypto/rsa.zig
new file mode 100644
index 00000000..825c8741
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/crypto/rsa.zig
@@ -0,0 +1,379 @@
+// ©AngelaMos | 2026
+// rsa.zig
+
+const std = @import("std");
+const ck = @import("../ck.zig");
+const config = @import("../config.zig");
+const ossl = @import("openssl.zig");
+
+pub const max_modulus_bytes: usize = config.rsa_max_key_bits / 8;
+pub const max_sig_bytes: usize = max_modulus_bytes;
+pub const pkcs1_v15_min_overhead: usize = 11;
+const component_count = 8;
+
+pub const Error = error{Crypto};
+
+pub const Hash = enum {
+    none,
+    sha256,
+    sha384,
+    sha512,
+
+    pub fn fromMech(mech: ck.CK_MECHANISM_TYPE) ?Hash {
+        return switch (mech) {
+            ck.CKM_SHA256 => .sha256,
+            ck.CKM_SHA384 => .sha384,
+            ck.CKM_SHA512 => .sha512,
+            else => null,
+        };
+    }
+};
+
+fn mdOf(h: Hash) ?*const ossl.EVP_MD {
+    return switch (h) {
+        .none => null,
+        .sha256 => ossl.EVP_sha256(),
+        .sha384 => ossl.EVP_sha384(),
+        .sha512 => ossl.EVP_sha512(),
+    };
+}
+
+pub const SigScheme = enum { pkcs1, pss };
+
+pub const SignParams = struct {
+    scheme: SigScheme,
+    digest: Hash,
+    pss_hash: Hash = .sha256,
+    salt_len: c_int = ossl.pss_saltlen_digest,
+};
+
+pub const CryptScheme = enum { pkcs1, oaep };
+
+pub const CryptParams = struct {
+    scheme: CryptScheme,
+    oaep_hash: Hash = .sha256,
+};
+
+pub const VerifyResult = enum { ok, invalid };
+
+pub const Buf = struct {
+    bytes: [max_modulus_bytes]u8 = @splat(0),
+    len: usize = 0,
+
+    pub fn slice(self: *const Buf) []const u8 {
+        return self.bytes[0..self.len];
+    }
+};
+
+pub const Generated = struct {
+    bits: u32 = 0,
+    n: Buf = .{},
+    e: Buf = .{},
+    d: Buf = .{},
+    p: Buf = .{},
+    q: Buf = .{},
+    dmp1: Buf = .{},
+    dmq1: Buf = .{},
+    iqmp: Buf = .{},
+
+    pub fn zeroize(self: *Generated) void {
+        std.crypto.secureZero(u8, &self.d.bytes);
+        std.crypto.secureZero(u8, &self.p.bytes);
+        std.crypto.secureZero(u8, &self.q.bytes);
+        std.crypto.secureZero(u8, &self.dmp1.bytes);
+        std.crypto.secureZero(u8, &self.dmq1.bytes);
+        std.crypto.secureZero(u8, &self.iqmp.bytes);
+    }
+};
+
+pub const PublicComponents = struct {
+    n: []const u8,
+    e: []const u8,
+};
+
+pub const PrivateComponents = struct {
+    n: []const u8,
+    e: []const u8,
+    d: []const u8,
+    p: []const u8,
+    q: []const u8,
+    dmp1: []const u8,
+    dmq1: []const u8,
+    iqmp: []const u8,
+};
+
+fn extractBn(pkey: *const ossl.EVP_PKEY, name: [*:0]const u8, buf: *Buf) Error!void {
+    var bn: ?*ossl.BIGNUM = null;
+    if (ossl.EVP_PKEY_get_bn_param(pkey, name, &bn) <= 0) return Error.Crypto;
+    defer ossl.BN_clear_free(bn);
+    const nbits = ossl.BN_num_bits(bn);
+    if (nbits < 0) return Error.Crypto;
+    const nbytes: usize = @intCast(@divFloor(nbits + 7, 8));
+    if (nbytes == 0 or nbytes > max_modulus_bytes) return Error.Crypto;
+    if (ossl.BN_bn2binpad(bn, &buf.bytes, @intCast(nbytes)) < 0) return Error.Crypto;
+    buf.len = nbytes;
+}
+
+pub fn generate(bits: u32) Error!Generated {
+    const ctx = ossl.EVP_PKEY_CTX_new_id(ossl.pkey_rsa, null) orelse return Error.Crypto;
+    defer ossl.EVP_PKEY_CTX_free(ctx);
+    if (ossl.EVP_PKEY_keygen_init(ctx) <= 0) return Error.Crypto;
+    if (ossl.EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, @intCast(bits)) <= 0) return Error.Crypto;
+    var pkey: ?*ossl.EVP_PKEY = null;
+    if (ossl.EVP_PKEY_generate(ctx, &pkey) <= 0) return Error.Crypto;
+    defer ossl.EVP_PKEY_free(pkey);
+
+    const key = pkey orelse return Error.Crypto;
+    var g: Generated = .{ .bits = @intCast(ossl.EVP_PKEY_get_bits(key)) };
+    errdefer g.zeroize();
+    try extractBn(key, ossl.param_n, &g.n);
+    try extractBn(key, ossl.param_e, &g.e);
+    try extractBn(key, ossl.param_d, &g.d);
+    try extractBn(key, ossl.param_factor1, &g.p);
+    try extractBn(key, ossl.param_factor2, &g.q);
+    try extractBn(key, ossl.param_exponent1, &g.dmp1);
+    try extractBn(key, ossl.param_exponent2, &g.dmq1);
+    try extractBn(key, ossl.param_coefficient1, &g.iqmp);
+    return g;
+}
+
+fn buildKey(names: []const [*:0]const u8, vals: []const []const u8, selection: c_int) Error!*ossl.EVP_PKEY {
+    const bld = ossl.OSSL_PARAM_BLD_new() orelse return Error.Crypto;
+    defer ossl.OSSL_PARAM_BLD_free(bld);
+
+    var bns: [component_count]?*ossl.BIGNUM = @splat(null);
+    defer for (bns[0..names.len]) |bn| ossl.BN_clear_free(bn);
+
+    for (names, vals, 0..) |nm, v, i| {
+        bns[i] = ossl.BN_bin2bn(v.ptr, @intCast(v.len), null) orelse return Error.Crypto;
+        if (ossl.OSSL_PARAM_BLD_push_BN(bld, nm, bns[i]) <= 0) return Error.Crypto;
+    }
+
+    const params = ossl.OSSL_PARAM_BLD_to_param(bld) orelse return Error.Crypto;
+    defer ossl.OSSL_PARAM_free(params);
+
+    const ctx = ossl.EVP_PKEY_CTX_new_from_name(null, "RSA", null) orelse return Error.Crypto;
+    defer ossl.EVP_PKEY_CTX_free(ctx);
+    if (ossl.EVP_PKEY_fromdata_init(ctx) <= 0) return Error.Crypto;
+    var pkey: ?*ossl.EVP_PKEY = null;
+    if (ossl.EVP_PKEY_fromdata(ctx, &pkey, selection, params) <= 0) return Error.Crypto;
+    return pkey orelse Error.Crypto;
+}
+
+fn buildPublic(pc: PublicComponents) Error!*ossl.EVP_PKEY {
+    return buildKey(
+        &.{ ossl.param_n, ossl.param_e },
+        &.{ pc.n, pc.e },
+        ossl.selection_public_key,
+    );
+}
+
+fn buildPrivate(sc: PrivateComponents) Error!*ossl.EVP_PKEY {
+    return buildKey(
+        &.{ ossl.param_n, ossl.param_e, ossl.param_d, ossl.param_factor1, ossl.param_factor2, ossl.param_exponent1, ossl.param_exponent2, ossl.param_coefficient1 },
+        &.{ sc.n, sc.e, sc.d, sc.p, sc.q, sc.dmp1, sc.dmq1, sc.iqmp },
+        ossl.selection_keypair,
+    );
+}
+
+fn applyPss(pctx: ?*ossl.EVP_PKEY_CTX, p: SignParams, raw: bool) Error!void {
+    if (ossl.EVP_PKEY_CTX_set_rsa_padding(pctx, ossl.pad_pss) <= 0) return Error.Crypto;
+    if (raw) {
+        if (ossl.EVP_PKEY_CTX_set_signature_md(pctx, mdOf(p.pss_hash)) <= 0) return Error.Crypto;
+    }
+    if (ossl.EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, p.salt_len) <= 0) return Error.Crypto;
+    if (ossl.EVP_PKEY_CTX_set_rsa_mgf1_md(pctx, mdOf(p.pss_hash)) <= 0) return Error.Crypto;
+}
+
+pub fn sign(sc: PrivateComponents, p: SignParams, data: []const u8, out: []u8) Error!usize {
+    const pkey = try buildPrivate(sc);
+    defer ossl.EVP_PKEY_free(pkey);
+    var siglen: usize = out.len;
+
+    if (p.digest != .none) {
+        const mdctx = ossl.EVP_MD_CTX_new() orelse return Error.Crypto;
+        defer ossl.EVP_MD_CTX_free(mdctx);
+        var pctx: ?*ossl.EVP_PKEY_CTX = null;
+        if (ossl.EVP_DigestSignInit(mdctx, &pctx, mdOf(p.digest), null, pkey) <= 0) return Error.Crypto;
+        if (p.scheme == .pss) try applyPss(pctx, p, false);
+        if (ossl.EVP_DigestSign(mdctx, out.ptr, &siglen, data.ptr, data.len) <= 0) return Error.Crypto;
+        return siglen;
+    }
+
+    const ctx = ossl.EVP_PKEY_CTX_new(pkey, null) orelse return Error.Crypto;
+    defer ossl.EVP_PKEY_CTX_free(ctx);
+    if (ossl.EVP_PKEY_sign_init(ctx) <= 0) return Error.Crypto;
+    if (p.scheme == .pss) {
+        try applyPss(ctx, p, true);
+    } else {
+        if (ossl.EVP_PKEY_CTX_set_rsa_padding(ctx, ossl.pad_pkcs1) <= 0) return Error.Crypto;
+    }
+    if (ossl.EVP_PKEY_sign(ctx, out.ptr, &siglen, data.ptr, data.len) <= 0) return Error.Crypto;
+    return siglen;
+}
+
+pub fn verify(pc: PublicComponents, p: SignParams, data: []const u8, sig: []const u8) Error!VerifyResult {
+    const pkey = try buildPublic(pc);
+    defer ossl.EVP_PKEY_free(pkey);
+
+    if (p.digest != .none) {
+        const mdctx = ossl.EVP_MD_CTX_new() orelse return Error.Crypto;
+        defer ossl.EVP_MD_CTX_free(mdctx);
+        var pctx: ?*ossl.EVP_PKEY_CTX = null;
+        if (ossl.EVP_DigestVerifyInit(mdctx, &pctx, mdOf(p.digest), null, pkey) <= 0) return Error.Crypto;
+        if (p.scheme == .pss) try applyPss(pctx, p, false);
+        return if (ossl.EVP_DigestVerify(mdctx, sig.ptr, sig.len, data.ptr, data.len) == 1) .ok else .invalid;
+    }
+
+    const ctx = ossl.EVP_PKEY_CTX_new(pkey, null) orelse return Error.Crypto;
+    defer ossl.EVP_PKEY_CTX_free(ctx);
+    if (ossl.EVP_PKEY_verify_init(ctx) <= 0) return Error.Crypto;
+    if (p.scheme == .pss) {
+        try applyPss(ctx, p, true);
+    } else {
+        if (ossl.EVP_PKEY_CTX_set_rsa_padding(ctx, ossl.pad_pkcs1) <= 0) return Error.Crypto;
+    }
+    return if (ossl.EVP_PKEY_verify(ctx, sig.ptr, sig.len, data.ptr, data.len) == 1) .ok else .invalid;
+}
+
+pub fn recover(pc: PublicComponents, sig: []const u8, out: []u8) Error!usize {
+    const pkey = try buildPublic(pc);
+    defer ossl.EVP_PKEY_free(pkey);
+    const ctx = ossl.EVP_PKEY_CTX_new(pkey, null) orelse return Error.Crypto;
+    defer ossl.EVP_PKEY_CTX_free(ctx);
+    if (ossl.EVP_PKEY_verify_recover_init(ctx) <= 0) return Error.Crypto;
+    if (ossl.EVP_PKEY_CTX_set_rsa_padding(ctx, ossl.pad_pkcs1) <= 0) return Error.Crypto;
+    var outlen: usize = out.len;
+    if (ossl.EVP_PKEY_verify_recover(ctx, out.ptr, &outlen, sig.ptr, sig.len) <= 0) return Error.Crypto;
+    return outlen;
+}
+
+fn applyCryptPadding(ctx: ?*ossl.EVP_PKEY_CTX, p: CryptParams) Error!void {
+    if (p.scheme == .oaep) {
+        if (ossl.EVP_PKEY_CTX_set_rsa_padding(ctx, ossl.pad_oaep) <= 0) return Error.Crypto;
+        if (ossl.EVP_PKEY_CTX_set_rsa_oaep_md(ctx, mdOf(p.oaep_hash)) <= 0) return Error.Crypto;
+        if (ossl.EVP_PKEY_CTX_set_rsa_mgf1_md(ctx, mdOf(p.oaep_hash)) <= 0) return Error.Crypto;
+    } else {
+        if (ossl.EVP_PKEY_CTX_set_rsa_padding(ctx, ossl.pad_pkcs1) <= 0) return Error.Crypto;
+    }
+}
+
+pub fn encrypt(pc: PublicComponents, p: CryptParams, in: []const u8, out: []u8) Error!usize {
+    const pkey = try buildPublic(pc);
+    defer ossl.EVP_PKEY_free(pkey);
+    const ctx = ossl.EVP_PKEY_CTX_new(pkey, null) orelse return Error.Crypto;
+    defer ossl.EVP_PKEY_CTX_free(ctx);
+    if (ossl.EVP_PKEY_encrypt_init(ctx) <= 0) return Error.Crypto;
+    try applyCryptPadding(ctx, p);
+    var outlen: usize = out.len;
+    if (ossl.EVP_PKEY_encrypt(ctx, out.ptr, &outlen, in.ptr, in.len) <= 0) return Error.Crypto;
+    return outlen;
+}
+
+pub fn decrypt(sc: PrivateComponents, p: CryptParams, in: []const u8, out: []u8) Error!usize {
+    const pkey = try buildPrivate(sc);
+    defer ossl.EVP_PKEY_free(pkey);
+    const ctx = ossl.EVP_PKEY_CTX_new(pkey, null) orelse return Error.Crypto;
+    defer ossl.EVP_PKEY_CTX_free(ctx);
+    if (ossl.EVP_PKEY_decrypt_init(ctx) <= 0) return Error.Crypto;
+    try applyCryptPadding(ctx, p);
+    var outlen: usize = out.len;
+    if (ossl.EVP_PKEY_decrypt(ctx, out.ptr, &outlen, in.ptr, in.len) <= 0) return Error.Crypto;
+    return outlen;
+}
+
+fn testPriv(g: *const Generated) PrivateComponents {
+    return .{
+        .n = g.n.slice(),
+        .e = g.e.slice(),
+        .d = g.d.slice(),
+        .p = g.p.slice(),
+        .q = g.q.slice(),
+        .dmp1 = g.dmp1.slice(),
+        .dmq1 = g.dmq1.slice(),
+        .iqmp = g.iqmp.slice(),
+    };
+}
+
+fn testPub(g: *const Generated) PublicComponents {
+    return .{ .n = g.n.slice(), .e = g.e.slice() };
+}
+
+test "generate yields a 2048-bit key with sane component sizes" {
+    var g = try generate(config.rsa_min_key_bits);
+    defer g.zeroize();
+    try std.testing.expectEqual(@as(u32, 2048), g.bits);
+    try std.testing.expectEqual(@as(usize, 256), g.n.len);
+    try std.testing.expect(g.e.len >= 3 and g.e.len <= 4);
+    try std.testing.expect(g.p.len == 128 and g.q.len == 128);
+}
+
+test "PKCS#1 v1.5 hash-then-sign round-trips and detects tamper" {
+    var g = try generate(config.rsa_min_key_bits);
+    defer g.zeroize();
+    const params: SignParams = .{ .scheme = .pkcs1, .digest = .sha256 };
+    var sig: [max_sig_bytes]u8 = undefined;
+    const n = try sign(testPriv(&g), params, "enterprise message", &sig);
+    try std.testing.expectEqual(@as(usize, 256), n);
+    try std.testing.expectEqual(VerifyResult.ok, try verify(testPub(&g), params, "enterprise message", sig[0..n]));
+    try std.testing.expectEqual(VerifyResult.invalid, try verify(testPub(&g), params, "enterprise messagX", sig[0..n]));
+    sig[0] ^= 0x01;
+    try std.testing.expectEqual(VerifyResult.invalid, try verify(testPub(&g), params, "enterprise message", sig[0..n]));
+}
+
+test "PSS hash-then-sign round-trips" {
+    var g = try generate(config.rsa_min_key_bits);
+    defer g.zeroize();
+    const params: SignParams = .{ .scheme = .pss, .digest = .sha256, .pss_hash = .sha256 };
+    var sig: [max_sig_bytes]u8 = undefined;
+    const n = try sign(testPriv(&g), params, "pss payload", &sig);
+    try std.testing.expectEqual(VerifyResult.ok, try verify(testPub(&g), params, "pss payload", sig[0..n]));
+    try std.testing.expectEqual(VerifyResult.invalid, try verify(testPub(&g), params, "pss payloaX", sig[0..n]));
+}
+
+test "raw PKCS#1 v1.5 sign over a pre-hashed value round-trips" {
+    var g = try generate(config.rsa_min_key_bits);
+    defer g.zeroize();
+    const params: SignParams = .{ .scheme = .pkcs1, .digest = .none };
+    const prehash = [_]u8{0xa5} ** 32;
+    var sig: [max_sig_bytes]u8 = undefined;
+    const n = try sign(testPriv(&g), params, &prehash, &sig);
+    try std.testing.expectEqual(VerifyResult.ok, try verify(testPub(&g), params, &prehash, sig[0..n]));
+}
+
+test "PKCS#1 v1.5 encrypt/decrypt round-trips" {
+    var g = try generate(config.rsa_min_key_bits);
+    defer g.zeroize();
+    const params: CryptParams = .{ .scheme = .pkcs1 };
+    const msg = "wrap me";
+    var ct: [max_modulus_bytes]u8 = undefined;
+    const cn = try encrypt(testPub(&g), params, msg, &ct);
+    try std.testing.expectEqual(@as(usize, 256), cn);
+    var pt: [max_modulus_bytes]u8 = undefined;
+    const pn = try decrypt(testPriv(&g), params, ct[0..cn], &pt);
+    try std.testing.expectEqualSlices(u8, msg, pt[0..pn]);
+}
+
+test "RSA sign-recover then verify-recover returns the original message" {
+    var g = try generate(config.rsa_min_key_bits);
+    defer g.zeroize();
+    const params: SignParams = .{ .scheme = .pkcs1, .digest = .none };
+    const msg = "recoverable enterprise payload";
+    var sig: [max_sig_bytes]u8 = undefined;
+    const n = try sign(testPriv(&g), params, msg, &sig);
+    var rec: [max_modulus_bytes]u8 = undefined;
+    const m = try recover(testPub(&g), sig[0..n], &rec);
+    try std.testing.expectEqualSlices(u8, msg, rec[0..m]);
+}
+
+test "OAEP-SHA256 encrypt/decrypt round-trips" {
+    var g = try generate(config.rsa_min_key_bits);
+    defer g.zeroize();
+    const params: CryptParams = .{ .scheme = .oaep, .oaep_hash = .sha256 };
+    const msg = "oaep secret payload";
+    var ct: [max_modulus_bytes]u8 = undefined;
+    const cn = try encrypt(testPub(&g), params, msg, &ct);
+    var pt: [max_modulus_bytes]u8 = undefined;
+    const pn = try decrypt(testPriv(&g), params, ct[0..cn], &pt);
+    try std.testing.expectEqualSlices(u8, msg, pt[0..pn]);
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/main.zig b/PROJECTS/advanced/hsm-emulator/src/main.zig
new file mode 100644
index 00000000..3c09a199
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/main.zig
@@ -0,0 +1,94 @@
+// ©AngelaMos | 2026
+// main.zig
+
+const std = @import("std");
+const ck = @import("ck.zig");
+const general = @import("api/general.zig");
+const slot_token = @import("api/slot_token.zig");
+const session = @import("api/session.zig");
+const object = @import("api/object.zig");
+const crypto_ops = @import("api/crypto_ops.zig");
+const keymgmt = @import("api/keymgmt.zig");
+const random = @import("api/random.zig");
+
+comptime {
+    std.debug.assert(@sizeOf(ck.CK_FUNCTION_LIST) == 69 * @sizeOf(usize));
+    std.debug.assert(@sizeOf(ck.CK_ATTRIBUTE) == 24);
+}
+
+export fn C_GetFunctionList(ppFunctionList: *?*ck.CK_FUNCTION_LIST) callconv(.c) ck.CK_RV {
+    ppFunctionList.* = &function_list;
+    return ck.CKR_OK;
+}
+
+var function_list: ck.CK_FUNCTION_LIST = .{
+    .version = ck.CK_VERSION{ .major = 2, .minor = 40 },
+    .C_Initialize = general.C_Initialize,
+    .C_Finalize = general.C_Finalize,
+    .C_GetInfo = general.C_GetInfo,
+    .C_GetFunctionList = C_GetFunctionList,
+    .C_GetSlotList = slot_token.C_GetSlotList,
+    .C_GetSlotInfo = slot_token.C_GetSlotInfo,
+    .C_GetTokenInfo = slot_token.C_GetTokenInfo,
+    .C_GetMechanismList = slot_token.C_GetMechanismList,
+    .C_GetMechanismInfo = slot_token.C_GetMechanismInfo,
+    .C_InitToken = slot_token.C_InitToken,
+    .C_InitPIN = slot_token.C_InitPIN,
+    .C_SetPIN = slot_token.C_SetPIN,
+    .C_OpenSession = session.C_OpenSession,
+    .C_CloseSession = session.C_CloseSession,
+    .C_CloseAllSessions = session.C_CloseAllSessions,
+    .C_GetSessionInfo = session.C_GetSessionInfo,
+    .C_GetOperationState = session.C_GetOperationState,
+    .C_SetOperationState = session.C_SetOperationState,
+    .C_Login = session.C_Login,
+    .C_Logout = session.C_Logout,
+    .C_CreateObject = object.C_CreateObject,
+    .C_CopyObject = object.C_CopyObject,
+    .C_DestroyObject = object.C_DestroyObject,
+    .C_GetObjectSize = object.C_GetObjectSize,
+    .C_GetAttributeValue = object.C_GetAttributeValue,
+    .C_SetAttributeValue = object.C_SetAttributeValue,
+    .C_FindObjectsInit = object.C_FindObjectsInit,
+    .C_FindObjects = object.C_FindObjects,
+    .C_FindObjectsFinal = object.C_FindObjectsFinal,
+    .C_EncryptInit = crypto_ops.C_EncryptInit,
+    .C_Encrypt = crypto_ops.C_Encrypt,
+    .C_EncryptUpdate = crypto_ops.C_EncryptUpdate,
+    .C_EncryptFinal = crypto_ops.C_EncryptFinal,
+    .C_DecryptInit = crypto_ops.C_DecryptInit,
+    .C_Decrypt = crypto_ops.C_Decrypt,
+    .C_DecryptUpdate = crypto_ops.C_DecryptUpdate,
+    .C_DecryptFinal = crypto_ops.C_DecryptFinal,
+    .C_DigestInit = crypto_ops.C_DigestInit,
+    .C_Digest = crypto_ops.C_Digest,
+    .C_DigestUpdate = crypto_ops.C_DigestUpdate,
+    .C_DigestKey = crypto_ops.C_DigestKey,
+    .C_DigestFinal = crypto_ops.C_DigestFinal,
+    .C_SignInit = crypto_ops.C_SignInit,
+    .C_Sign = crypto_ops.C_Sign,
+    .C_SignUpdate = crypto_ops.C_SignUpdate,
+    .C_SignFinal = crypto_ops.C_SignFinal,
+    .C_SignRecoverInit = crypto_ops.C_SignRecoverInit,
+    .C_SignRecover = crypto_ops.C_SignRecover,
+    .C_VerifyInit = crypto_ops.C_VerifyInit,
+    .C_Verify = crypto_ops.C_Verify,
+    .C_VerifyUpdate = crypto_ops.C_VerifyUpdate,
+    .C_VerifyFinal = crypto_ops.C_VerifyFinal,
+    .C_VerifyRecoverInit = crypto_ops.C_VerifyRecoverInit,
+    .C_VerifyRecover = crypto_ops.C_VerifyRecover,
+    .C_DigestEncryptUpdate = crypto_ops.C_DigestEncryptUpdate,
+    .C_DecryptDigestUpdate = crypto_ops.C_DecryptDigestUpdate,
+    .C_SignEncryptUpdate = crypto_ops.C_SignEncryptUpdate,
+    .C_DecryptVerifyUpdate = crypto_ops.C_DecryptVerifyUpdate,
+    .C_GenerateKey = keymgmt.C_GenerateKey,
+    .C_GenerateKeyPair = keymgmt.C_GenerateKeyPair,
+    .C_WrapKey = keymgmt.C_WrapKey,
+    .C_UnwrapKey = keymgmt.C_UnwrapKey,
+    .C_DeriveKey = keymgmt.C_DeriveKey,
+    .C_SeedRandom = random.C_SeedRandom,
+    .C_GenerateRandom = random.C_GenerateRandom,
+    .C_GetFunctionStatus = general.C_GetFunctionStatus,
+    .C_CancelFunction = general.C_CancelFunction,
+    .C_WaitForSlotEvent = general.C_WaitForSlotEvent,
+};
diff --git a/PROJECTS/advanced/hsm-emulator/src/test_all.zig b/PROJECTS/advanced/hsm-emulator/src/test_all.zig
new file mode 100644
index 00000000..8658f43f
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/test_all.zig
@@ -0,0 +1,15 @@
+// ©AngelaMos | 2026
+// test_all.zig
+
+test {
+    _ = @import("crypto/pin.zig");
+    _ = @import("core/token.zig");
+    _ = @import("core/session.zig");
+    _ = @import("core/object_store.zig");
+    _ = @import("crypto/digest.zig");
+    _ = @import("crypto/mac.zig");
+    _ = @import("crypto/cipher.zig");
+    _ = @import("crypto/ecdsa.zig");
+    _ = @import("crypto/rsa.zig");
+    _ = @import("crypto/keystore.zig");
+}
diff --git a/PROJECTS/advanced/hsm-emulator/src/util.zig b/PROJECTS/advanced/hsm-emulator/src/util.zig
new file mode 100644
index 00000000..234b6342
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/src/util.zig
@@ -0,0 +1,12 @@
+// ©AngelaMos | 2026
+// util.zig
+
+pub fn padded(comptime n: usize, comptime s: []const u8) [n]u8 {
+    if (s.len > n) @compileError("padded: source string longer than field width");
+    var out: [n]u8 = undefined;
+    var i: usize = 0;
+    while (i < n) : (i += 1) {
+        out[i] = if (i < s.len) s[i] else ' ';
+    }
+    return out;
+}
diff --git a/PROJECTS/advanced/hsm-emulator/tests/abi_test.zig b/PROJECTS/advanced/hsm-emulator/tests/abi_test.zig
new file mode 100644
index 00000000..b398507f
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/tests/abi_test.zig
@@ -0,0 +1,154 @@
+// ©AngelaMos | 2026
+// abi_test.zig
+
+const std = @import("std");
+const ck = @import("ck");
+const p11c = @import("p11c");
+
+const ptr = @sizeOf(usize);
+
+test "scalar ABI widths match Cryptoki LP64" {
+    try std.testing.expectEqual(@as(usize, 1), @sizeOf(ck.CK_BYTE));
+    try std.testing.expectEqual(@as(usize, 1), @sizeOf(ck.CK_BBOOL));
+    try std.testing.expectEqual(@as(usize, 8), @sizeOf(ck.CK_ULONG));
+    try std.testing.expectEqual(@as(usize, 8), @sizeOf(ck.CK_RV));
+    try std.testing.expectEqual(@as(usize, 8), @sizeOf(ck.CK_SESSION_HANDLE));
+    try std.testing.expectEqual(@as(usize, 8), @sizeOf(ck.CK_OBJECT_HANDLE));
+}
+
+test "CK_VERSION is two packed bytes" {
+    try std.testing.expectEqual(@as(usize, 2), @sizeOf(ck.CK_VERSION));
+    try std.testing.expectEqual(@as(usize, 0), @offsetOf(ck.CK_VERSION, "major"));
+    try std.testing.expectEqual(@as(usize, 1), @offsetOf(ck.CK_VERSION, "minor"));
+}
+
+test "CK_ATTRIBUTE layout (type, pValue, ulValueLen)" {
+    try std.testing.expectEqual(@as(usize, 24), @sizeOf(ck.CK_ATTRIBUTE));
+    try std.testing.expectEqual(@as(usize, 0), @offsetOf(ck.CK_ATTRIBUTE, "type"));
+    try std.testing.expectEqual(@as(usize, 8), @offsetOf(ck.CK_ATTRIBUTE, "pValue"));
+    try std.testing.expectEqual(@as(usize, 16), @offsetOf(ck.CK_ATTRIBUTE, "ulValueLen"));
+}
+
+test "CK_MECHANISM layout" {
+    try std.testing.expectEqual(@as(usize, 24), @sizeOf(ck.CK_MECHANISM));
+    try std.testing.expectEqual(@as(usize, 0), @offsetOf(ck.CK_MECHANISM, "mechanism"));
+    try std.testing.expectEqual(@as(usize, 8), @offsetOf(ck.CK_MECHANISM, "pParameter"));
+    try std.testing.expectEqual(@as(usize, 16), @offsetOf(ck.CK_MECHANISM, "ulParameterLen"));
+}
+
+test "CK_INFO natural-alignment layout" {
+    try std.testing.expectEqual(@as(usize, 40), @offsetOf(ck.CK_INFO, "flags"));
+    try std.testing.expectEqual(@as(usize, 88), @sizeOf(ck.CK_INFO));
+}
+
+test "CK_TOKEN_INFO natural-alignment layout" {
+    try std.testing.expectEqual(@as(usize, 96), @offsetOf(ck.CK_TOKEN_INFO, "flags"));
+    try std.testing.expectEqual(@as(usize, 208), @sizeOf(ck.CK_TOKEN_INFO));
+}
+
+test "CK_FUNCTION_LIST is version + 68 pointers in canonical order" {
+    try std.testing.expectEqual(69 * ptr, @sizeOf(ck.CK_FUNCTION_LIST));
+    try std.testing.expectEqual(@as(usize, 0), @offsetOf(ck.CK_FUNCTION_LIST, "version"));
+    try std.testing.expectEqual(ptr, @offsetOf(ck.CK_FUNCTION_LIST, "C_Initialize"));
+    try std.testing.expectEqual(5 * ptr, @offsetOf(ck.CK_FUNCTION_LIST, "C_GetSlotList"));
+    try std.testing.expectEqual(68 * ptr, @offsetOf(ck.CK_FUNCTION_LIST, "C_WaitForSlotEvent"));
+}
+
+test "key return codes have canonical values" {
+    try std.testing.expectEqual(@as(ck.CK_RV, 0x00000000), ck.CKR_OK);
+    try std.testing.expectEqual(@as(ck.CK_RV, 0x00000054), ck.CKR_FUNCTION_NOT_SUPPORTED);
+    try std.testing.expectEqual(@as(ck.CK_RV, 0x00000150), ck.CKR_BUFFER_TOO_SMALL);
+    try std.testing.expectEqual(@as(ck.CK_RV, 0x00000190), ck.CKR_CRYPTOKI_NOT_INITIALIZED);
+}
+
+fn expectSameLayout(comptime A: type, comptime B: type) !void {
+    try std.testing.expectEqual(@sizeOf(A), @sizeOf(B));
+    try std.testing.expectEqual(@alignOf(A), @alignOf(B));
+    const fa = @typeInfo(A).@"struct".fields;
+    const fb = @typeInfo(B).@"struct".fields;
+    try std.testing.expectEqual(fa.len, fb.len);
+    inline for (fa) |f| {
+        try std.testing.expectEqual(@offsetOf(A, f.name), @offsetOf(B, f.name));
+    }
+}
+
+test "hand-coded structs match OASIS-translated layout byte-for-byte" {
+    try expectSameLayout(ck.CK_VERSION, p11c.CK_VERSION);
+    try expectSameLayout(ck.CK_INFO, p11c.CK_INFO);
+    try expectSameLayout(ck.CK_SLOT_INFO, p11c.CK_SLOT_INFO);
+    try expectSameLayout(ck.CK_TOKEN_INFO, p11c.CK_TOKEN_INFO);
+    try expectSameLayout(ck.CK_SESSION_INFO, p11c.CK_SESSION_INFO);
+    try expectSameLayout(ck.CK_MECHANISM_INFO, p11c.CK_MECHANISM_INFO);
+    try expectSameLayout(ck.CK_ATTRIBUTE, p11c.CK_ATTRIBUTE);
+    try expectSameLayout(ck.CK_MECHANISM, p11c.CK_MECHANISM);
+    try expectSameLayout(ck.CK_GCM_PARAMS, p11c.CK_GCM_PARAMS);
+    try expectSameLayout(ck.CK_RSA_PKCS_PSS_PARAMS, p11c.CK_RSA_PKCS_PSS_PARAMS);
+    try expectSameLayout(ck.CK_RSA_PKCS_OAEP_PARAMS, p11c.CK_RSA_PKCS_OAEP_PARAMS);
+    try expectSameLayout(ck.CK_ECDH1_DERIVE_PARAMS, p11c.CK_ECDH1_DERIVE_PARAMS);
+    try expectSameLayout(ck.CK_DATE, p11c.CK_DATE);
+    try expectSameLayout(ck.CK_C_INITIALIZE_ARGS, p11c.CK_C_INITIALIZE_ARGS);
+}
+
+test "hand-coded CK_FUNCTION_LIST matches OASIS 68-entry order and size" {
+    try expectSameLayout(ck.CK_FUNCTION_LIST, p11c.CK_FUNCTION_LIST);
+}
+
+test "every hand-coded constant equals its OASIS value" {
+    @setEvalBranchQuota(20000);
+    comptime var checked: usize = 0;
+    inline for (@typeInfo(ck).@"struct".decls) |d| {
+        if (@hasDecl(p11c, d.name)) {
+            const value = @field(ck, d.name);
+            const T = @TypeOf(value);
+            if (T == type) continue;
+            const info = @typeInfo(T);
+            if (info != .int and info != .comptime_int) continue;
+            const ours: u64 = @intCast(value);
+            const theirs: u64 = @intCast(@field(p11c, d.name));
+            if (ours != theirs) {
+                std.debug.print("constant {s}: ck=0x{X} oasis=0x{X}\n", .{ d.name, ours, theirs });
+                return error.ConstantMismatch;
+            }
+            checked += 1;
+        }
+    }
+    try std.testing.expect(checked >= 100);
+}
+
+fn fnInfo(comptime FnPtr: type) std.builtin.Type.Fn {
+    const fn_ptr = @typeInfo(FnPtr).optional.child;
+    return @typeInfo(@typeInfo(fn_ptr).pointer.child).@"fn";
+}
+
+fn expectSameFnAbi(comptime name: []const u8, comptime A: type, comptime B: type) !void {
+    const fa = fnInfo(A);
+    const fb = fnInfo(B);
+    if (fa.params.len != fb.params.len) {
+        std.debug.print("fn {s}: param count ck={d} oasis={d}\n", .{ name, fa.params.len, fb.params.len });
+        return error.FnAbiMismatch;
+    }
+    if (@sizeOf(fa.return_type.?) != @sizeOf(fb.return_type.?)) {
+        std.debug.print("fn {s}: return-type size ck={d} oasis={d}\n", .{ name, @sizeOf(fa.return_type.?), @sizeOf(fb.return_type.?) });
+        return error.FnAbiMismatch;
+    }
+    inline for (0..@min(fa.params.len, fb.params.len)) |i| {
+        const ours = fa.params[i].type.?;
+        const theirs = fb.params[i].type.?;
+        if (@sizeOf(ours) != @sizeOf(theirs) or @alignOf(ours) != @alignOf(theirs)) {
+            std.debug.print("fn {s}: param {d} ck={d}/{d} oasis={d}/{d}\n", .{ name, i, @sizeOf(ours), @alignOf(ours), @sizeOf(theirs), @alignOf(theirs) });
+            return error.FnAbiMismatch;
+        }
+    }
+}
+
+test "every CK_FUNCTION_LIST entry matches the OASIS C ABI signature" {
+    try std.testing.expectEqual(@as(usize, 3), fnInfo(ck.CK_C_GetSlotList).params.len);
+    const cf = @typeInfo(ck.CK_FUNCTION_LIST).@"struct".fields;
+    const pf = @typeInfo(p11c.CK_FUNCTION_LIST).@"struct".fields;
+    inline for (cf, pf) |a, b| {
+        comptime std.debug.assert(std.mem.eql(u8, a.name, b.name));
+        if (comptime !std.mem.eql(u8, a.name, "version")) {
+            try expectSameFnAbi(a.name, a.type, b.type);
+        }
+    }
+}
diff --git a/PROJECTS/advanced/hsm-emulator/vendor/pkcs11/PROVENANCE.md b/PROJECTS/advanced/hsm-emulator/vendor/pkcs11/PROVENANCE.md
new file mode 100644
index 00000000..2debc9c5
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/vendor/pkcs11/PROVENANCE.md
@@ -0,0 +1,34 @@
+# Vendored PKCS#11 headers
+
+`pkcs11.h`, `pkcs11t.h`, and `pkcs11f.h` are the **canonical OASIS headers**, fetched
+**unmodified** from the published v2.40 errata-01 OASIS Standard:
+
+```
+https://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/errata01/os/include/pkcs11-v2.40/
+```
+
+They retain their original OASIS copyright notices and are **not** covered by this
+project's license. They are vendored for one purpose only: a build-time ABI
+cross-check (`zig build test`) that proves the hand-written Cryptoki ABI in
+`src/ck.zig` matches the spec byte-for-byte.
+
+## Integrity
+
+SHA-256 of the vendored headers as fetched (verify with `sha256sum -c` after
+re-fetching from the URL above):
+
+```
+8bb7aa1aeaa328b6a39913070d6f3d2bdeb9f2c92baf27f714fbb4cbefdf4054  pkcs11.h
+5b58736b6d23f12b4d9492cd24b06b9d11056c3153afc4e89b1fe564749e71a2  pkcs11t.h
+a85adad038bfc9dad9c71377f3ed3b049ba2ac9b3f37198a372f211d210c6057  pkcs11f.h
+```
+
+`shim.h` is the only file here authored by this project. It defines the five
+caller-supplied macros the OASIS headers require (`CK_PTR`,
+`CK_DECLARE_FUNCTION`, `CK_DECLARE_FUNCTION_POINTER`, `CK_CALLBACK_FUNCTION`,
+`NULL_PTR`) and then includes `pkcs11.h`. `build.zig` runs `addTranslateC` on
+`shim.h`; `tests/abi_test.zig` then asserts `@sizeOf`/`@offsetOf`/constant
+equality between `src/ck.zig` and the translated headers.
+
+The production `.so` does **not** depend on these headers — it ships the pure
+hand-written `src/ck.zig`. These exist for regression-hardening of that file.
diff --git a/PROJECTS/advanced/hsm-emulator/vendor/pkcs11/pkcs11.h b/PROJECTS/advanced/hsm-emulator/vendor/pkcs11/pkcs11.h
new file mode 100644
index 00000000..0d78dd71
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/vendor/pkcs11/pkcs11.h
@@ -0,0 +1,265 @@
+/* Copyright (c) OASIS Open 2016. All Rights Reserved./
+ * /Distributed under the terms of the OASIS IPR Policy,
+ * [http://www.oasis-open.org/policies-guidelines/ipr], AS-IS, WITHOUT ANY
+ * IMPLIED OR EXPRESS WARRANTY; there is no warranty of MERCHANTABILITY, FITNESS FOR A
+ * PARTICULAR PURPOSE or NONINFRINGEMENT of the rights of others.
+ */
+        
+/* Latest version of the specification:
+ * http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/pkcs11-base-v2.40.html
+ */
+
+#ifndef _PKCS11_H_
+#define _PKCS11_H_ 1
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Before including this file (pkcs11.h) (or pkcs11t.h by
+ * itself), 5 platform-specific macros must be defined.  These
+ * macros are described below, and typical definitions for them
+ * are also given.  Be advised that these definitions can depend
+ * on both the platform and the compiler used (and possibly also
+ * on whether a Cryptoki library is linked statically or
+ * dynamically).
+ *
+ * In addition to defining these 5 macros, the packing convention
+ * for Cryptoki structures should be set.  The Cryptoki
+ * convention on packing is that structures should be 1-byte
+ * aligned.
+ *
+ * If you're using Microsoft Developer Studio 5.0 to produce
+ * Win32 stuff, this might be done by using the following
+ * preprocessor directive before including pkcs11.h or pkcs11t.h:
+ *
+ * #pragma pack(push, cryptoki, 1)
+ *
+ * and using the following preprocessor directive after including
+ * pkcs11.h or pkcs11t.h:
+ *
+ * #pragma pack(pop, cryptoki)
+ *
+ * If you're using an earlier version of Microsoft Developer
+ * Studio to produce Win16 stuff, this might be done by using
+ * the following preprocessor directive before including
+ * pkcs11.h or pkcs11t.h:
+ *
+ * #pragma pack(1)
+ *
+ * In a UNIX environment, you're on your own for this.  You might
+ * not need to do (or be able to do!) anything.
+ *
+ *
+ * Now for the macros:
+ *
+ *
+ * 1. CK_PTR: The indirection string for making a pointer to an
+ * object.  It can be used like this:
+ *
+ * typedef CK_BYTE CK_PTR CK_BYTE_PTR;
+ *
+ * If you're using Microsoft Developer Studio 5.0 to produce
+ * Win32 stuff, it might be defined by:
+ *
+ * #define CK_PTR *
+ *
+ * If you're using an earlier version of Microsoft Developer
+ * Studio to produce Win16 stuff, it might be defined by:
+ *
+ * #define CK_PTR far *
+ *
+ * In a typical UNIX environment, it might be defined by:
+ *
+ * #define CK_PTR *
+ *
+ *
+ * 2. CK_DECLARE_FUNCTION(returnType, name): A macro which makes
+ * an importable Cryptoki library function declaration out of a
+ * return type and a function name.  It should be used in the
+ * following fashion:
+ *
+ * extern CK_DECLARE_FUNCTION(CK_RV, C_Initialize)(
+ *   CK_VOID_PTR pReserved
+ * );
+ *
+ * If you're using Microsoft Developer Studio 5.0 to declare a
+ * function in a Win32 Cryptoki .dll, it might be defined by:
+ *
+ * #define CK_DECLARE_FUNCTION(returnType, name) \
+ *   returnType __declspec(dllimport) name
+ *
+ * If you're using an earlier version of Microsoft Developer
+ * Studio to declare a function in a Win16 Cryptoki .dll, it
+ * might be defined by:
+ *
+ * #define CK_DECLARE_FUNCTION(returnType, name) \
+ *   returnType __export _far _pascal name
+ *
+ * In a UNIX environment, it might be defined by:
+ *
+ * #define CK_DECLARE_FUNCTION(returnType, name) \
+ *   returnType name
+ *
+ *
+ * 3. CK_DECLARE_FUNCTION_POINTER(returnType, name): A macro
+ * which makes a Cryptoki API function pointer declaration or
+ * function pointer type declaration out of a return type and a
+ * function name.  It should be used in the following fashion:
+ *
+ * // Define funcPtr to be a pointer to a Cryptoki API function
+ * // taking arguments args and returning CK_RV.
+ * CK_DECLARE_FUNCTION_POINTER(CK_RV, funcPtr)(args);
+ *
+ * or
+ *
+ * // Define funcPtrType to be the type of a pointer to a
+ * // Cryptoki API function taking arguments args and returning
+ * // CK_RV, and then define funcPtr to be a variable of type
+ * // funcPtrType.
+ * typedef CK_DECLARE_FUNCTION_POINTER(CK_RV, funcPtrType)(args);
+ * funcPtrType funcPtr;
+ *
+ * If you're using Microsoft Developer Studio 5.0 to access
+ * functions in a Win32 Cryptoki .dll, in might be defined by:
+ *
+ * #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
+ *   returnType __declspec(dllimport) (* name)
+ *
+ * If you're using an earlier version of Microsoft Developer
+ * Studio to access functions in a Win16 Cryptoki .dll, it might
+ * be defined by:
+ *
+ * #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
+ *   returnType __export _far _pascal (* name)
+ *
+ * In a UNIX environment, it might be defined by:
+ *
+ * #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
+ *   returnType (* name)
+ *
+ *
+ * 4. CK_CALLBACK_FUNCTION(returnType, name): A macro which makes
+ * a function pointer type for an application callback out of
+ * a return type for the callback and a name for the callback.
+ * It should be used in the following fashion:
+ *
+ * CK_CALLBACK_FUNCTION(CK_RV, myCallback)(args);
+ *
+ * to declare a function pointer, myCallback, to a callback
+ * which takes arguments args and returns a CK_RV.  It can also
+ * be used like this:
+ *
+ * typedef CK_CALLBACK_FUNCTION(CK_RV, myCallbackType)(args);
+ * myCallbackType myCallback;
+ *
+ * If you're using Microsoft Developer Studio 5.0 to do Win32
+ * Cryptoki development, it might be defined by:
+ *
+ * #define CK_CALLBACK_FUNCTION(returnType, name) \
+ *   returnType (* name)
+ *
+ * If you're using an earlier version of Microsoft Developer
+ * Studio to do Win16 development, it might be defined by:
+ *
+ * #define CK_CALLBACK_FUNCTION(returnType, name) \
+ *   returnType _far _pascal (* name)
+ *
+ * In a UNIX environment, it might be defined by:
+ *
+ * #define CK_CALLBACK_FUNCTION(returnType, name) \
+ *   returnType (* name)
+ *
+ *
+ * 5. NULL_PTR: This macro is the value of a NULL pointer.
+ *
+ * In any ANSI/ISO C environment (and in many others as well),
+ * this should best be defined by
+ *
+ * #ifndef NULL_PTR
+ * #define NULL_PTR 0
+ * #endif
+ */
+
+
+/* All the various Cryptoki types and #define'd values are in the
+ * file pkcs11t.h.
+ */
+#include "pkcs11t.h"
+
+#define __PASTE(x,y)      x##y
+
+
+/* ==============================================================
+ * Define the "extern" form of all the entry points.
+ * ==============================================================
+ */
+
+#define CK_NEED_ARG_LIST  1
+#define CK_PKCS11_FUNCTION_INFO(name) \
+  extern CK_DECLARE_FUNCTION(CK_RV, name)
+
+/* pkcs11f.h has all the information about the Cryptoki
+ * function prototypes.
+ */
+#include "pkcs11f.h"
+
+#undef CK_NEED_ARG_LIST
+#undef CK_PKCS11_FUNCTION_INFO
+
+
+/* ==============================================================
+ * Define the typedef form of all the entry points.  That is, for
+ * each Cryptoki function C_XXX, define a type CK_C_XXX which is
+ * a pointer to that kind of function.
+ * ==============================================================
+ */
+
+#define CK_NEED_ARG_LIST  1
+#define CK_PKCS11_FUNCTION_INFO(name) \
+  typedef CK_DECLARE_FUNCTION_POINTER(CK_RV, __PASTE(CK_,name))
+
+/* pkcs11f.h has all the information about the Cryptoki
+ * function prototypes.
+ */
+#include "pkcs11f.h"
+
+#undef CK_NEED_ARG_LIST
+#undef CK_PKCS11_FUNCTION_INFO
+
+
+/* ==============================================================
+ * Define structed vector of entry points.  A CK_FUNCTION_LIST
+ * contains a CK_VERSION indicating a library's Cryptoki version
+ * and then a whole slew of function pointers to the routines in
+ * the library.  This type was declared, but not defined, in
+ * pkcs11t.h.
+ * ==============================================================
+ */
+
+#define CK_PKCS11_FUNCTION_INFO(name) \
+  __PASTE(CK_,name) name;
+
+struct CK_FUNCTION_LIST {
+
+  CK_VERSION    version;  /* Cryptoki version */
+
+/* Pile all the function pointers into the CK_FUNCTION_LIST. */
+/* pkcs11f.h has all the information about the Cryptoki
+ * function prototypes.
+ */
+#include "pkcs11f.h"
+
+};
+
+#undef CK_PKCS11_FUNCTION_INFO
+
+
+#undef __PASTE
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _PKCS11_H_ */
+
diff --git a/PROJECTS/advanced/hsm-emulator/vendor/pkcs11/pkcs11f.h b/PROJECTS/advanced/hsm-emulator/vendor/pkcs11/pkcs11f.h
new file mode 100644
index 00000000..ed90affc
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/vendor/pkcs11/pkcs11f.h
@@ -0,0 +1,939 @@
+/* Copyright (c) OASIS Open 2016. All Rights Reserved./
+ * /Distributed under the terms of the OASIS IPR Policy,
+ * [http://www.oasis-open.org/policies-guidelines/ipr], AS-IS, WITHOUT ANY
+ * IMPLIED OR EXPRESS WARRANTY; there is no warranty of MERCHANTABILITY, FITNESS FOR A
+ * PARTICULAR PURPOSE or NONINFRINGEMENT of the rights of others.
+ */
+        
+/* Latest version of the specification:
+ * http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/pkcs11-base-v2.40.html
+ */
+
+/* This header file contains pretty much everything about all the
+ * Cryptoki function prototypes.  Because this information is
+ * used for more than just declaring function prototypes, the
+ * order of the functions appearing herein is important, and
+ * should not be altered.
+ */
+
+/* General-purpose */
+
+/* C_Initialize initializes the Cryptoki library. */
+CK_PKCS11_FUNCTION_INFO(C_Initialize)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_VOID_PTR   pInitArgs  /* if this is not NULL_PTR, it gets
+                            * cast to CK_C_INITIALIZE_ARGS_PTR
+                            * and dereferenced
+                            */
+);
+#endif
+
+
+/* C_Finalize indicates that an application is done with the
+ * Cryptoki library.
+ */
+CK_PKCS11_FUNCTION_INFO(C_Finalize)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_VOID_PTR   pReserved  /* reserved.  Should be NULL_PTR */
+);
+#endif
+
+
+/* C_GetInfo returns general information about Cryptoki. */
+CK_PKCS11_FUNCTION_INFO(C_GetInfo)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_INFO_PTR   pInfo  /* location that receives information */
+);
+#endif
+
+
+/* C_GetFunctionList returns the function list. */
+CK_PKCS11_FUNCTION_INFO(C_GetFunctionList)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_FUNCTION_LIST_PTR_PTR ppFunctionList  /* receives pointer to
+                                            * function list
+                                            */
+);
+#endif
+
+
+
+/* Slot and token management */
+
+/* C_GetSlotList obtains a list of slots in the system. */
+CK_PKCS11_FUNCTION_INFO(C_GetSlotList)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_BBOOL       tokenPresent,  /* only slots with tokens */
+  CK_SLOT_ID_PTR pSlotList,     /* receives array of slot IDs */
+  CK_ULONG_PTR   pulCount       /* receives number of slots */
+);
+#endif
+
+
+/* C_GetSlotInfo obtains information about a particular slot in
+ * the system.
+ */
+CK_PKCS11_FUNCTION_INFO(C_GetSlotInfo)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SLOT_ID       slotID,  /* the ID of the slot */
+  CK_SLOT_INFO_PTR pInfo    /* receives the slot information */
+);
+#endif
+
+
+/* C_GetTokenInfo obtains information about a particular token
+ * in the system.
+ */
+CK_PKCS11_FUNCTION_INFO(C_GetTokenInfo)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SLOT_ID        slotID,  /* ID of the token's slot */
+  CK_TOKEN_INFO_PTR pInfo    /* receives the token information */
+);
+#endif
+
+
+/* C_GetMechanismList obtains a list of mechanism types
+ * supported by a token.
+ */
+CK_PKCS11_FUNCTION_INFO(C_GetMechanismList)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SLOT_ID            slotID,          /* ID of token's slot */
+  CK_MECHANISM_TYPE_PTR pMechanismList,  /* gets mech. array */
+  CK_ULONG_PTR          pulCount         /* gets # of mechs. */
+);
+#endif
+
+
+/* C_GetMechanismInfo obtains information about a particular
+ * mechanism possibly supported by a token.
+ */
+CK_PKCS11_FUNCTION_INFO(C_GetMechanismInfo)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SLOT_ID            slotID,  /* ID of the token's slot */
+  CK_MECHANISM_TYPE     type,    /* type of mechanism */
+  CK_MECHANISM_INFO_PTR pInfo    /* receives mechanism info */
+);
+#endif
+
+
+/* C_InitToken initializes a token. */
+CK_PKCS11_FUNCTION_INFO(C_InitToken)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SLOT_ID      slotID,    /* ID of the token's slot */
+  CK_UTF8CHAR_PTR pPin,      /* the SO's initial PIN */
+  CK_ULONG        ulPinLen,  /* length in bytes of the PIN */
+  CK_UTF8CHAR_PTR pLabel     /* 32-byte token label (blank padded) */
+);
+#endif
+
+
+/* C_InitPIN initializes the normal user's PIN. */
+CK_PKCS11_FUNCTION_INFO(C_InitPIN)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,  /* the session's handle */
+  CK_UTF8CHAR_PTR   pPin,      /* the normal user's PIN */
+  CK_ULONG          ulPinLen   /* length in bytes of the PIN */
+);
+#endif
+
+
+/* C_SetPIN modifies the PIN of the user who is logged in. */
+CK_PKCS11_FUNCTION_INFO(C_SetPIN)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,  /* the session's handle */
+  CK_UTF8CHAR_PTR   pOldPin,   /* the old PIN */
+  CK_ULONG          ulOldLen,  /* length of the old PIN */
+  CK_UTF8CHAR_PTR   pNewPin,   /* the new PIN */
+  CK_ULONG          ulNewLen   /* length of the new PIN */
+);
+#endif
+
+
+
+/* Session management */
+
+/* C_OpenSession opens a session between an application and a
+ * token.
+ */
+CK_PKCS11_FUNCTION_INFO(C_OpenSession)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SLOT_ID            slotID,        /* the slot's ID */
+  CK_FLAGS              flags,         /* from CK_SESSION_INFO */
+  CK_VOID_PTR           pApplication,  /* passed to callback */
+  CK_NOTIFY             Notify,        /* callback function */
+  CK_SESSION_HANDLE_PTR phSession      /* gets session handle */
+);
+#endif
+
+
+/* C_CloseSession closes a session between an application and a
+ * token.
+ */
+CK_PKCS11_FUNCTION_INFO(C_CloseSession)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession  /* the session's handle */
+);
+#endif
+
+
+/* C_CloseAllSessions closes all sessions with a token. */
+CK_PKCS11_FUNCTION_INFO(C_CloseAllSessions)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SLOT_ID     slotID  /* the token's slot */
+);
+#endif
+
+
+/* C_GetSessionInfo obtains information about the session. */
+CK_PKCS11_FUNCTION_INFO(C_GetSessionInfo)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE   hSession,  /* the session's handle */
+  CK_SESSION_INFO_PTR pInfo      /* receives session info */
+);
+#endif
+
+
+/* C_GetOperationState obtains the state of the cryptographic operation
+ * in a session.
+ */
+CK_PKCS11_FUNCTION_INFO(C_GetOperationState)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,             /* session's handle */
+  CK_BYTE_PTR       pOperationState,      /* gets state */
+  CK_ULONG_PTR      pulOperationStateLen  /* gets state length */
+);
+#endif
+
+
+/* C_SetOperationState restores the state of the cryptographic
+ * operation in a session.
+ */
+CK_PKCS11_FUNCTION_INFO(C_SetOperationState)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,            /* session's handle */
+  CK_BYTE_PTR      pOperationState,      /* holds state */
+  CK_ULONG         ulOperationStateLen,  /* holds state length */
+  CK_OBJECT_HANDLE hEncryptionKey,       /* en/decryption key */
+  CK_OBJECT_HANDLE hAuthenticationKey    /* sign/verify key */
+);
+#endif
+
+
+/* C_Login logs a user into a token. */
+CK_PKCS11_FUNCTION_INFO(C_Login)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,  /* the session's handle */
+  CK_USER_TYPE      userType,  /* the user type */
+  CK_UTF8CHAR_PTR   pPin,      /* the user's PIN */
+  CK_ULONG          ulPinLen   /* the length of the PIN */
+);
+#endif
+
+
+/* C_Logout logs a user out from a token. */
+CK_PKCS11_FUNCTION_INFO(C_Logout)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession  /* the session's handle */
+);
+#endif
+
+
+
+/* Object management */
+
+/* C_CreateObject creates a new object. */
+CK_PKCS11_FUNCTION_INFO(C_CreateObject)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,    /* the session's handle */
+  CK_ATTRIBUTE_PTR  pTemplate,   /* the object's template */
+  CK_ULONG          ulCount,     /* attributes in template */
+  CK_OBJECT_HANDLE_PTR phObject  /* gets new object's handle. */
+);
+#endif
+
+
+/* C_CopyObject copies an object, creating a new object for the
+ * copy.
+ */
+CK_PKCS11_FUNCTION_INFO(C_CopyObject)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE    hSession,    /* the session's handle */
+  CK_OBJECT_HANDLE     hObject,     /* the object's handle */
+  CK_ATTRIBUTE_PTR     pTemplate,   /* template for new object */
+  CK_ULONG             ulCount,     /* attributes in template */
+  CK_OBJECT_HANDLE_PTR phNewObject  /* receives handle of copy */
+);
+#endif
+
+
+/* C_DestroyObject destroys an object. */
+CK_PKCS11_FUNCTION_INFO(C_DestroyObject)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,  /* the session's handle */
+  CK_OBJECT_HANDLE  hObject    /* the object's handle */
+);
+#endif
+
+
+/* C_GetObjectSize gets the size of an object in bytes. */
+CK_PKCS11_FUNCTION_INFO(C_GetObjectSize)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,  /* the session's handle */
+  CK_OBJECT_HANDLE  hObject,   /* the object's handle */
+  CK_ULONG_PTR      pulSize    /* receives size of object */
+);
+#endif
+
+
+/* C_GetAttributeValue obtains the value of one or more object
+ * attributes.
+ */
+CK_PKCS11_FUNCTION_INFO(C_GetAttributeValue)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,   /* the session's handle */
+  CK_OBJECT_HANDLE  hObject,    /* the object's handle */
+  CK_ATTRIBUTE_PTR  pTemplate,  /* specifies attrs; gets vals */
+  CK_ULONG          ulCount     /* attributes in template */
+);
+#endif
+
+
+/* C_SetAttributeValue modifies the value of one or more object
+ * attributes.
+ */
+CK_PKCS11_FUNCTION_INFO(C_SetAttributeValue)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,   /* the session's handle */
+  CK_OBJECT_HANDLE  hObject,    /* the object's handle */
+  CK_ATTRIBUTE_PTR  pTemplate,  /* specifies attrs and values */
+  CK_ULONG          ulCount     /* attributes in template */
+);
+#endif
+
+
+/* C_FindObjectsInit initializes a search for token and session
+ * objects that match a template.
+ */
+CK_PKCS11_FUNCTION_INFO(C_FindObjectsInit)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,   /* the session's handle */
+  CK_ATTRIBUTE_PTR  pTemplate,  /* attribute values to match */
+  CK_ULONG          ulCount     /* attrs in search template */
+);
+#endif
+
+
+/* C_FindObjects continues a search for token and session
+ * objects that match a template, obtaining additional object
+ * handles.
+ */
+CK_PKCS11_FUNCTION_INFO(C_FindObjects)
+#ifdef CK_NEED_ARG_LIST
+(
+ CK_SESSION_HANDLE    hSession,          /* session's handle */
+ CK_OBJECT_HANDLE_PTR phObject,          /* gets obj. handles */
+ CK_ULONG             ulMaxObjectCount,  /* max handles to get */
+ CK_ULONG_PTR         pulObjectCount     /* actual # returned */
+);
+#endif
+
+
+/* C_FindObjectsFinal finishes a search for token and session
+ * objects.
+ */
+CK_PKCS11_FUNCTION_INFO(C_FindObjectsFinal)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession  /* the session's handle */
+);
+#endif
+
+
+
+/* Encryption and decryption */
+
+/* C_EncryptInit initializes an encryption operation. */
+CK_PKCS11_FUNCTION_INFO(C_EncryptInit)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,    /* the session's handle */
+  CK_MECHANISM_PTR  pMechanism,  /* the encryption mechanism */
+  CK_OBJECT_HANDLE  hKey         /* handle of encryption key */
+);
+#endif
+
+
+/* C_Encrypt encrypts single-part data. */
+CK_PKCS11_FUNCTION_INFO(C_Encrypt)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,            /* session's handle */
+  CK_BYTE_PTR       pData,               /* the plaintext data */
+  CK_ULONG          ulDataLen,           /* bytes of plaintext */
+  CK_BYTE_PTR       pEncryptedData,      /* gets ciphertext */
+  CK_ULONG_PTR      pulEncryptedDataLen  /* gets c-text size */
+);
+#endif
+
+
+/* C_EncryptUpdate continues a multiple-part encryption
+ * operation.
+ */
+CK_PKCS11_FUNCTION_INFO(C_EncryptUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,           /* session's handle */
+  CK_BYTE_PTR       pPart,              /* the plaintext data */
+  CK_ULONG          ulPartLen,          /* plaintext data len */
+  CK_BYTE_PTR       pEncryptedPart,     /* gets ciphertext */
+  CK_ULONG_PTR      pulEncryptedPartLen /* gets c-text size */
+);
+#endif
+
+
+/* C_EncryptFinal finishes a multiple-part encryption
+ * operation.
+ */
+CK_PKCS11_FUNCTION_INFO(C_EncryptFinal)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,                /* session handle */
+  CK_BYTE_PTR       pLastEncryptedPart,      /* last c-text */
+  CK_ULONG_PTR      pulLastEncryptedPartLen  /* gets last size */
+);
+#endif
+
+
+/* C_DecryptInit initializes a decryption operation. */
+CK_PKCS11_FUNCTION_INFO(C_DecryptInit)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,    /* the session's handle */
+  CK_MECHANISM_PTR  pMechanism,  /* the decryption mechanism */
+  CK_OBJECT_HANDLE  hKey         /* handle of decryption key */
+);
+#endif
+
+
+/* C_Decrypt decrypts encrypted data in a single part. */
+CK_PKCS11_FUNCTION_INFO(C_Decrypt)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,           /* session's handle */
+  CK_BYTE_PTR       pEncryptedData,     /* ciphertext */
+  CK_ULONG          ulEncryptedDataLen, /* ciphertext length */
+  CK_BYTE_PTR       pData,              /* gets plaintext */
+  CK_ULONG_PTR      pulDataLen          /* gets p-text size */
+);
+#endif
+
+
+/* C_DecryptUpdate continues a multiple-part decryption
+ * operation.
+ */
+CK_PKCS11_FUNCTION_INFO(C_DecryptUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,            /* session's handle */
+  CK_BYTE_PTR       pEncryptedPart,      /* encrypted data */
+  CK_ULONG          ulEncryptedPartLen,  /* input length */
+  CK_BYTE_PTR       pPart,               /* gets plaintext */
+  CK_ULONG_PTR      pulPartLen           /* p-text size */
+);
+#endif
+
+
+/* C_DecryptFinal finishes a multiple-part decryption
+ * operation.
+ */
+CK_PKCS11_FUNCTION_INFO(C_DecryptFinal)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,       /* the session's handle */
+  CK_BYTE_PTR       pLastPart,      /* gets plaintext */
+  CK_ULONG_PTR      pulLastPartLen  /* p-text size */
+);
+#endif
+
+
+
+/* Message digesting */
+
+/* C_DigestInit initializes a message-digesting operation. */
+CK_PKCS11_FUNCTION_INFO(C_DigestInit)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,   /* the session's handle */
+  CK_MECHANISM_PTR  pMechanism  /* the digesting mechanism */
+);
+#endif
+
+
+/* C_Digest digests data in a single part. */
+CK_PKCS11_FUNCTION_INFO(C_Digest)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,     /* the session's handle */
+  CK_BYTE_PTR       pData,        /* data to be digested */
+  CK_ULONG          ulDataLen,    /* bytes of data to digest */
+  CK_BYTE_PTR       pDigest,      /* gets the message digest */
+  CK_ULONG_PTR      pulDigestLen  /* gets digest length */
+);
+#endif
+
+
+/* C_DigestUpdate continues a multiple-part message-digesting
+ * operation.
+ */
+CK_PKCS11_FUNCTION_INFO(C_DigestUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,  /* the session's handle */
+  CK_BYTE_PTR       pPart,     /* data to be digested */
+  CK_ULONG          ulPartLen  /* bytes of data to be digested */
+);
+#endif
+
+
+/* C_DigestKey continues a multi-part message-digesting
+ * operation, by digesting the value of a secret key as part of
+ * the data already digested.
+ */
+CK_PKCS11_FUNCTION_INFO(C_DigestKey)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,  /* the session's handle */
+  CK_OBJECT_HANDLE  hKey       /* secret key to digest */
+);
+#endif
+
+
+/* C_DigestFinal finishes a multiple-part message-digesting
+ * operation.
+ */
+CK_PKCS11_FUNCTION_INFO(C_DigestFinal)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,     /* the session's handle */
+  CK_BYTE_PTR       pDigest,      /* gets the message digest */
+  CK_ULONG_PTR      pulDigestLen  /* gets byte count of digest */
+);
+#endif
+
+
+
+/* Signing and MACing */
+
+/* C_SignInit initializes a signature (private key encryption)
+ * operation, where the signature is (will be) an appendix to
+ * the data, and plaintext cannot be recovered from the
+ * signature.
+ */
+CK_PKCS11_FUNCTION_INFO(C_SignInit)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,    /* the session's handle */
+  CK_MECHANISM_PTR  pMechanism,  /* the signature mechanism */
+  CK_OBJECT_HANDLE  hKey         /* handle of signature key */
+);
+#endif
+
+
+/* C_Sign signs (encrypts with private key) data in a single
+ * part, where the signature is (will be) an appendix to the
+ * data, and plaintext cannot be recovered from the signature.
+ */
+CK_PKCS11_FUNCTION_INFO(C_Sign)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,        /* the session's handle */
+  CK_BYTE_PTR       pData,           /* the data to sign */
+  CK_ULONG          ulDataLen,       /* count of bytes to sign */
+  CK_BYTE_PTR       pSignature,      /* gets the signature */
+  CK_ULONG_PTR      pulSignatureLen  /* gets signature length */
+);
+#endif
+
+
+/* C_SignUpdate continues a multiple-part signature operation,
+ * where the signature is (will be) an appendix to the data,
+ * and plaintext cannot be recovered from the signature.
+ */
+CK_PKCS11_FUNCTION_INFO(C_SignUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,  /* the session's handle */
+  CK_BYTE_PTR       pPart,     /* the data to sign */
+  CK_ULONG          ulPartLen  /* count of bytes to sign */
+);
+#endif
+
+
+/* C_SignFinal finishes a multiple-part signature operation,
+ * returning the signature.
+ */
+CK_PKCS11_FUNCTION_INFO(C_SignFinal)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,        /* the session's handle */
+  CK_BYTE_PTR       pSignature,      /* gets the signature */
+  CK_ULONG_PTR      pulSignatureLen  /* gets signature length */
+);
+#endif
+
+
+/* C_SignRecoverInit initializes a signature operation, where
+ * the data can be recovered from the signature.
+ */
+CK_PKCS11_FUNCTION_INFO(C_SignRecoverInit)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,   /* the session's handle */
+  CK_MECHANISM_PTR  pMechanism, /* the signature mechanism */
+  CK_OBJECT_HANDLE  hKey        /* handle of the signature key */
+);
+#endif
+
+
+/* C_SignRecover signs data in a single operation, where the
+ * data can be recovered from the signature.
+ */
+CK_PKCS11_FUNCTION_INFO(C_SignRecover)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,        /* the session's handle */
+  CK_BYTE_PTR       pData,           /* the data to sign */
+  CK_ULONG          ulDataLen,       /* count of bytes to sign */
+  CK_BYTE_PTR       pSignature,      /* gets the signature */
+  CK_ULONG_PTR      pulSignatureLen  /* gets signature length */
+);
+#endif
+
+
+
+/* Verifying signatures and MACs */
+
+/* C_VerifyInit initializes a verification operation, where the
+ * signature is an appendix to the data, and plaintext cannot
+ * cannot be recovered from the signature (e.g. DSA).
+ */
+CK_PKCS11_FUNCTION_INFO(C_VerifyInit)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,    /* the session's handle */
+  CK_MECHANISM_PTR  pMechanism,  /* the verification mechanism */
+  CK_OBJECT_HANDLE  hKey         /* verification key */
+);
+#endif
+
+
+/* C_Verify verifies a signature in a single-part operation,
+ * where the signature is an appendix to the data, and plaintext
+ * cannot be recovered from the signature.
+ */
+CK_PKCS11_FUNCTION_INFO(C_Verify)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,       /* the session's handle */
+  CK_BYTE_PTR       pData,          /* signed data */
+  CK_ULONG          ulDataLen,      /* length of signed data */
+  CK_BYTE_PTR       pSignature,     /* signature */
+  CK_ULONG          ulSignatureLen  /* signature length*/
+);
+#endif
+
+
+/* C_VerifyUpdate continues a multiple-part verification
+ * operation, where the signature is an appendix to the data,
+ * and plaintext cannot be recovered from the signature.
+ */
+CK_PKCS11_FUNCTION_INFO(C_VerifyUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,  /* the session's handle */
+  CK_BYTE_PTR       pPart,     /* signed data */
+  CK_ULONG          ulPartLen  /* length of signed data */
+);
+#endif
+
+
+/* C_VerifyFinal finishes a multiple-part verification
+ * operation, checking the signature.
+ */
+CK_PKCS11_FUNCTION_INFO(C_VerifyFinal)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,       /* the session's handle */
+  CK_BYTE_PTR       pSignature,     /* signature to verify */
+  CK_ULONG          ulSignatureLen  /* signature length */
+);
+#endif
+
+
+/* C_VerifyRecoverInit initializes a signature verification
+ * operation, where the data is recovered from the signature.
+ */
+CK_PKCS11_FUNCTION_INFO(C_VerifyRecoverInit)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,    /* the session's handle */
+  CK_MECHANISM_PTR  pMechanism,  /* the verification mechanism */
+  CK_OBJECT_HANDLE  hKey         /* verification key */
+);
+#endif
+
+
+/* C_VerifyRecover verifies a signature in a single-part
+ * operation, where the data is recovered from the signature.
+ */
+CK_PKCS11_FUNCTION_INFO(C_VerifyRecover)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,        /* the session's handle */
+  CK_BYTE_PTR       pSignature,      /* signature to verify */
+  CK_ULONG          ulSignatureLen,  /* signature length */
+  CK_BYTE_PTR       pData,           /* gets signed data */
+  CK_ULONG_PTR      pulDataLen       /* gets signed data len */
+);
+#endif
+
+
+
+/* Dual-function cryptographic operations */
+
+/* C_DigestEncryptUpdate continues a multiple-part digesting
+ * and encryption operation.
+ */
+CK_PKCS11_FUNCTION_INFO(C_DigestEncryptUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,            /* session's handle */
+  CK_BYTE_PTR       pPart,               /* the plaintext data */
+  CK_ULONG          ulPartLen,           /* plaintext length */
+  CK_BYTE_PTR       pEncryptedPart,      /* gets ciphertext */
+  CK_ULONG_PTR      pulEncryptedPartLen  /* gets c-text length */
+);
+#endif
+
+
+/* C_DecryptDigestUpdate continues a multiple-part decryption and
+ * digesting operation.
+ */
+CK_PKCS11_FUNCTION_INFO(C_DecryptDigestUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,            /* session's handle */
+  CK_BYTE_PTR       pEncryptedPart,      /* ciphertext */
+  CK_ULONG          ulEncryptedPartLen,  /* ciphertext length */
+  CK_BYTE_PTR       pPart,               /* gets plaintext */
+  CK_ULONG_PTR      pulPartLen           /* gets plaintext len */
+);
+#endif
+
+
+/* C_SignEncryptUpdate continues a multiple-part signing and
+ * encryption operation.
+ */
+CK_PKCS11_FUNCTION_INFO(C_SignEncryptUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,            /* session's handle */
+  CK_BYTE_PTR       pPart,               /* the plaintext data */
+  CK_ULONG          ulPartLen,           /* plaintext length */
+  CK_BYTE_PTR       pEncryptedPart,      /* gets ciphertext */
+  CK_ULONG_PTR      pulEncryptedPartLen  /* gets c-text length */
+);
+#endif
+
+
+/* C_DecryptVerifyUpdate continues a multiple-part decryption and
+ * verify operation.
+ */
+CK_PKCS11_FUNCTION_INFO(C_DecryptVerifyUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,            /* session's handle */
+  CK_BYTE_PTR       pEncryptedPart,      /* ciphertext */
+  CK_ULONG          ulEncryptedPartLen,  /* ciphertext length */
+  CK_BYTE_PTR       pPart,               /* gets plaintext */
+  CK_ULONG_PTR      pulPartLen           /* gets p-text length */
+);
+#endif
+
+
+
+/* Key management */
+
+/* C_GenerateKey generates a secret key, creating a new key
+ * object.
+ */
+CK_PKCS11_FUNCTION_INFO(C_GenerateKey)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE    hSession,    /* the session's handle */
+  CK_MECHANISM_PTR     pMechanism,  /* key generation mech. */
+  CK_ATTRIBUTE_PTR     pTemplate,   /* template for new key */
+  CK_ULONG             ulCount,     /* # of attrs in template */
+  CK_OBJECT_HANDLE_PTR phKey        /* gets handle of new key */
+);
+#endif
+
+
+/* C_GenerateKeyPair generates a public-key/private-key pair,
+ * creating new key objects.
+ */
+CK_PKCS11_FUNCTION_INFO(C_GenerateKeyPair)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE    hSession,                    /* session handle */
+  CK_MECHANISM_PTR     pMechanism,                  /* key-gen mech. */
+  CK_ATTRIBUTE_PTR     pPublicKeyTemplate,          /* template for pub. key */
+  CK_ULONG             ulPublicKeyAttributeCount,   /* # pub. attrs. */
+  CK_ATTRIBUTE_PTR     pPrivateKeyTemplate,         /* template for priv. key */
+  CK_ULONG             ulPrivateKeyAttributeCount,  /* # priv.  attrs. */
+  CK_OBJECT_HANDLE_PTR phPublicKey,                 /* gets pub. key handle */
+  CK_OBJECT_HANDLE_PTR phPrivateKey                 /* gets priv. key handle */
+);
+#endif
+
+
+/* C_WrapKey wraps (i.e., encrypts) a key. */
+CK_PKCS11_FUNCTION_INFO(C_WrapKey)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,        /* the session's handle */
+  CK_MECHANISM_PTR  pMechanism,      /* the wrapping mechanism */
+  CK_OBJECT_HANDLE  hWrappingKey,    /* wrapping key */
+  CK_OBJECT_HANDLE  hKey,            /* key to be wrapped */
+  CK_BYTE_PTR       pWrappedKey,     /* gets wrapped key */
+  CK_ULONG_PTR      pulWrappedKeyLen /* gets wrapped key size */
+);
+#endif
+
+
+/* C_UnwrapKey unwraps (decrypts) a wrapped key, creating a new
+ * key object.
+ */
+CK_PKCS11_FUNCTION_INFO(C_UnwrapKey)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE    hSession,          /* session's handle */
+  CK_MECHANISM_PTR     pMechanism,        /* unwrapping mech. */
+  CK_OBJECT_HANDLE     hUnwrappingKey,    /* unwrapping key */
+  CK_BYTE_PTR          pWrappedKey,       /* the wrapped key */
+  CK_ULONG             ulWrappedKeyLen,   /* wrapped key len */
+  CK_ATTRIBUTE_PTR     pTemplate,         /* new key template */
+  CK_ULONG             ulAttributeCount,  /* template length */
+  CK_OBJECT_HANDLE_PTR phKey              /* gets new handle */
+);
+#endif
+
+
+/* C_DeriveKey derives a key from a base key, creating a new key
+ * object.
+ */
+CK_PKCS11_FUNCTION_INFO(C_DeriveKey)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE    hSession,          /* session's handle */
+  CK_MECHANISM_PTR     pMechanism,        /* key deriv. mech. */
+  CK_OBJECT_HANDLE     hBaseKey,          /* base key */
+  CK_ATTRIBUTE_PTR     pTemplate,         /* new key template */
+  CK_ULONG             ulAttributeCount,  /* template length */
+  CK_OBJECT_HANDLE_PTR phKey              /* gets new handle */
+);
+#endif
+
+
+
+/* Random number generation */
+
+/* C_SeedRandom mixes additional seed material into the token's
+ * random number generator.
+ */
+CK_PKCS11_FUNCTION_INFO(C_SeedRandom)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,  /* the session's handle */
+  CK_BYTE_PTR       pSeed,     /* the seed material */
+  CK_ULONG          ulSeedLen  /* length of seed material */
+);
+#endif
+
+
+/* C_GenerateRandom generates random data. */
+CK_PKCS11_FUNCTION_INFO(C_GenerateRandom)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession,    /* the session's handle */
+  CK_BYTE_PTR       RandomData,  /* receives the random data */
+  CK_ULONG          ulRandomLen  /* # of bytes to generate */
+);
+#endif
+
+
+
+/* Parallel function management */
+
+/* C_GetFunctionStatus is a legacy function; it obtains an
+ * updated status of a function running in parallel with an
+ * application.
+ */
+CK_PKCS11_FUNCTION_INFO(C_GetFunctionStatus)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession  /* the session's handle */
+);
+#endif
+
+
+/* C_CancelFunction is a legacy function; it cancels a function
+ * running in parallel.
+ */
+CK_PKCS11_FUNCTION_INFO(C_CancelFunction)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_SESSION_HANDLE hSession  /* the session's handle */
+);
+#endif
+
+
+/* C_WaitForSlotEvent waits for a slot event (token insertion,
+ * removal, etc.) to occur.
+ */
+CK_PKCS11_FUNCTION_INFO(C_WaitForSlotEvent)
+#ifdef CK_NEED_ARG_LIST
+(
+  CK_FLAGS flags,        /* blocking/nonblocking flag */
+  CK_SLOT_ID_PTR pSlot,  /* location that receives the slot ID */
+  CK_VOID_PTR pRserved   /* reserved.  Should be NULL_PTR */
+);
+#endif
+
diff --git a/PROJECTS/advanced/hsm-emulator/vendor/pkcs11/pkcs11t.h b/PROJECTS/advanced/hsm-emulator/vendor/pkcs11/pkcs11t.h
new file mode 100644
index 00000000..c13e67cf
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/vendor/pkcs11/pkcs11t.h
@@ -0,0 +1,2003 @@
+/* Copyright (c) OASIS Open 2016. All Rights Reserved./
+ * /Distributed under the terms of the OASIS IPR Policy,
+ * [http://www.oasis-open.org/policies-guidelines/ipr], AS-IS, WITHOUT ANY
+ * IMPLIED OR EXPRESS WARRANTY; there is no warranty of MERCHANTABILITY, FITNESS FOR A
+ * PARTICULAR PURPOSE or NONINFRINGEMENT of the rights of others.
+ */
+        
+/* Latest version of the specification:
+ * http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/pkcs11-base-v2.40.html
+ */
+
+/* See top of pkcs11.h for information about the macros that
+ * must be defined and the structure-packing conventions that
+ * must be set before including this file.
+ */
+
+#ifndef _PKCS11T_H_
+#define _PKCS11T_H_ 1
+
+#define CRYPTOKI_VERSION_MAJOR          2
+#define CRYPTOKI_VERSION_MINOR          40
+#define CRYPTOKI_VERSION_AMENDMENT      0
+
+#define CK_TRUE         1
+#define CK_FALSE        0
+
+#ifndef CK_DISABLE_TRUE_FALSE
+#ifndef FALSE
+#define FALSE CK_FALSE
+#endif
+#ifndef TRUE
+#define TRUE CK_TRUE
+#endif
+#endif
+
+/* an unsigned 8-bit value */
+typedef unsigned char     CK_BYTE;
+
+/* an unsigned 8-bit character */
+typedef CK_BYTE           CK_CHAR;
+
+/* an 8-bit UTF-8 character */
+typedef CK_BYTE           CK_UTF8CHAR;
+
+/* a BYTE-sized Boolean flag */
+typedef CK_BYTE           CK_BBOOL;
+
+/* an unsigned value, at least 32 bits long */
+typedef unsigned long int CK_ULONG;
+
+/* a signed value, the same size as a CK_ULONG */
+typedef long int          CK_LONG;
+
+/* at least 32 bits; each bit is a Boolean flag */
+typedef CK_ULONG          CK_FLAGS;
+
+
+/* some special values for certain CK_ULONG variables */
+#define CK_UNAVAILABLE_INFORMATION      (~0UL)
+#define CK_EFFECTIVELY_INFINITE         0UL
+
+
+typedef CK_BYTE     CK_PTR   CK_BYTE_PTR;
+typedef CK_CHAR     CK_PTR   CK_CHAR_PTR;
+typedef CK_UTF8CHAR CK_PTR   CK_UTF8CHAR_PTR;
+typedef CK_ULONG    CK_PTR   CK_ULONG_PTR;
+typedef void        CK_PTR   CK_VOID_PTR;
+
+/* Pointer to a CK_VOID_PTR-- i.e., pointer to pointer to void */
+typedef CK_VOID_PTR CK_PTR CK_VOID_PTR_PTR;
+
+
+/* The following value is always invalid if used as a session
+ * handle or object handle
+ */
+#define CK_INVALID_HANDLE       0UL
+
+
+typedef struct CK_VERSION {
+  CK_BYTE       major;  /* integer portion of version number */
+  CK_BYTE       minor;  /* 1/100ths portion of version number */
+} CK_VERSION;
+
+typedef CK_VERSION CK_PTR CK_VERSION_PTR;
+
+
+typedef struct CK_INFO {
+  CK_VERSION    cryptokiVersion;     /* Cryptoki interface ver */
+  CK_UTF8CHAR   manufacturerID[32];  /* blank padded */
+  CK_FLAGS      flags;               /* must be zero */
+  CK_UTF8CHAR   libraryDescription[32];  /* blank padded */
+  CK_VERSION    libraryVersion;          /* version of library */
+} CK_INFO;
+
+typedef CK_INFO CK_PTR    CK_INFO_PTR;
+
+
+/* CK_NOTIFICATION enumerates the types of notifications that
+ * Cryptoki provides to an application
+ */
+typedef CK_ULONG CK_NOTIFICATION;
+#define CKN_SURRENDER           0UL
+#define CKN_OTP_CHANGED         1UL
+
+typedef CK_ULONG          CK_SLOT_ID;
+
+typedef CK_SLOT_ID CK_PTR CK_SLOT_ID_PTR;
+
+
+/* CK_SLOT_INFO provides information about a slot */
+typedef struct CK_SLOT_INFO {
+  CK_UTF8CHAR   slotDescription[64];  /* blank padded */
+  CK_UTF8CHAR   manufacturerID[32];   /* blank padded */
+  CK_FLAGS      flags;
+
+  CK_VERSION    hardwareVersion;  /* version of hardware */
+  CK_VERSION    firmwareVersion;  /* version of firmware */
+} CK_SLOT_INFO;
+
+/* flags: bit flags that provide capabilities of the slot
+ *      Bit Flag              Mask        Meaning
+ */
+#define CKF_TOKEN_PRESENT     0x00000001UL  /* a token is there */
+#define CKF_REMOVABLE_DEVICE  0x00000002UL  /* removable devices*/
+#define CKF_HW_SLOT           0x00000004UL  /* hardware slot */
+
+typedef CK_SLOT_INFO CK_PTR CK_SLOT_INFO_PTR;
+
+
+/* CK_TOKEN_INFO provides information about a token */
+typedef struct CK_TOKEN_INFO {
+  CK_UTF8CHAR   label[32];           /* blank padded */
+  CK_UTF8CHAR   manufacturerID[32];  /* blank padded */
+  CK_UTF8CHAR   model[16];           /* blank padded */
+  CK_CHAR       serialNumber[16];    /* blank padded */
+  CK_FLAGS      flags;               /* see below */
+
+  CK_ULONG      ulMaxSessionCount;     /* max open sessions */
+  CK_ULONG      ulSessionCount;        /* sess. now open */
+  CK_ULONG      ulMaxRwSessionCount;   /* max R/W sessions */
+  CK_ULONG      ulRwSessionCount;      /* R/W sess. now open */
+  CK_ULONG      ulMaxPinLen;           /* in bytes */
+  CK_ULONG      ulMinPinLen;           /* in bytes */
+  CK_ULONG      ulTotalPublicMemory;   /* in bytes */
+  CK_ULONG      ulFreePublicMemory;    /* in bytes */
+  CK_ULONG      ulTotalPrivateMemory;  /* in bytes */
+  CK_ULONG      ulFreePrivateMemory;   /* in bytes */
+  CK_VERSION    hardwareVersion;       /* version of hardware */
+  CK_VERSION    firmwareVersion;       /* version of firmware */
+  CK_CHAR       utcTime[16];           /* time */
+} CK_TOKEN_INFO;
+
+/* The flags parameter is defined as follows:
+ *      Bit Flag                    Mask        Meaning
+ */
+#define CKF_RNG                     0x00000001UL  /* has random # generator */
+#define CKF_WRITE_PROTECTED         0x00000002UL  /* token is write-protected */
+#define CKF_LOGIN_REQUIRED          0x00000004UL  /* user must login */
+#define CKF_USER_PIN_INITIALIZED    0x00000008UL  /* normal user's PIN is set */
+
+/* CKF_RESTORE_KEY_NOT_NEEDED.  If it is set,
+ * that means that *every* time the state of cryptographic
+ * operations of a session is successfully saved, all keys
+ * needed to continue those operations are stored in the state
+ */
+#define CKF_RESTORE_KEY_NOT_NEEDED  0x00000020UL
+
+/* CKF_CLOCK_ON_TOKEN.  If it is set, that means
+ * that the token has some sort of clock.  The time on that
+ * clock is returned in the token info structure
+ */
+#define CKF_CLOCK_ON_TOKEN          0x00000040UL
+
+/* CKF_PROTECTED_AUTHENTICATION_PATH.  If it is
+ * set, that means that there is some way for the user to login
+ * without sending a PIN through the Cryptoki library itself
+ */
+#define CKF_PROTECTED_AUTHENTICATION_PATH 0x00000100UL
+
+/* CKF_DUAL_CRYPTO_OPERATIONS.  If it is true,
+ * that means that a single session with the token can perform
+ * dual simultaneous cryptographic operations (digest and
+ * encrypt; decrypt and digest; sign and encrypt; and decrypt
+ * and sign)
+ */
+#define CKF_DUAL_CRYPTO_OPERATIONS  0x00000200UL
+
+/* CKF_TOKEN_INITIALIZED. If it is true, the
+ * token has been initialized using C_InitializeToken or an
+ * equivalent mechanism outside the scope of PKCS #11.
+ * Calling C_InitializeToken when this flag is set will cause
+ * the token to be reinitialized.
+ */
+#define CKF_TOKEN_INITIALIZED       0x00000400UL
+
+/* CKF_SECONDARY_AUTHENTICATION. If it is
+ * true, the token supports secondary authentication for
+ * private key objects.
+ */
+#define CKF_SECONDARY_AUTHENTICATION  0x00000800UL
+
+/* CKF_USER_PIN_COUNT_LOW. If it is true, an
+ * incorrect user login PIN has been entered at least once
+ * since the last successful authentication.
+ */
+#define CKF_USER_PIN_COUNT_LOW       0x00010000UL
+
+/* CKF_USER_PIN_FINAL_TRY. If it is true,
+ * supplying an incorrect user PIN will it to become locked.
+ */
+#define CKF_USER_PIN_FINAL_TRY       0x00020000UL
+
+/* CKF_USER_PIN_LOCKED. If it is true, the
+ * user PIN has been locked. User login to the token is not
+ * possible.
+ */
+#define CKF_USER_PIN_LOCKED          0x00040000UL
+
+/* CKF_USER_PIN_TO_BE_CHANGED. If it is true,
+ * the user PIN value is the default value set by token
+ * initialization or manufacturing, or the PIN has been
+ * expired by the card.
+ */
+#define CKF_USER_PIN_TO_BE_CHANGED   0x00080000UL
+
+/* CKF_SO_PIN_COUNT_LOW. If it is true, an
+ * incorrect SO login PIN has been entered at least once since
+ * the last successful authentication.
+ */
+#define CKF_SO_PIN_COUNT_LOW         0x00100000UL
+
+/* CKF_SO_PIN_FINAL_TRY. If it is true,
+ * supplying an incorrect SO PIN will it to become locked.
+ */
+#define CKF_SO_PIN_FINAL_TRY         0x00200000UL
+
+/* CKF_SO_PIN_LOCKED. If it is true, the SO
+ * PIN has been locked. SO login to the token is not possible.
+ */
+#define CKF_SO_PIN_LOCKED            0x00400000UL
+
+/* CKF_SO_PIN_TO_BE_CHANGED. If it is true,
+ * the SO PIN value is the default value set by token
+ * initialization or manufacturing, or the PIN has been
+ * expired by the card.
+ */
+#define CKF_SO_PIN_TO_BE_CHANGED     0x00800000UL
+
+#define CKF_ERROR_STATE              0x01000000UL
+
+typedef CK_TOKEN_INFO CK_PTR CK_TOKEN_INFO_PTR;
+
+
+/* CK_SESSION_HANDLE is a Cryptoki-assigned value that
+ * identifies a session
+ */
+typedef CK_ULONG          CK_SESSION_HANDLE;
+
+typedef CK_SESSION_HANDLE CK_PTR CK_SESSION_HANDLE_PTR;
+
+
+/* CK_USER_TYPE enumerates the types of Cryptoki users */
+typedef CK_ULONG          CK_USER_TYPE;
+/* Security Officer */
+#define CKU_SO                  0UL
+/* Normal user */
+#define CKU_USER                1UL
+/* Context specific */
+#define CKU_CONTEXT_SPECIFIC    2UL
+
+/* CK_STATE enumerates the session states */
+typedef CK_ULONG          CK_STATE;
+#define CKS_RO_PUBLIC_SESSION   0UL
+#define CKS_RO_USER_FUNCTIONS   1UL
+#define CKS_RW_PUBLIC_SESSION   2UL
+#define CKS_RW_USER_FUNCTIONS   3UL
+#define CKS_RW_SO_FUNCTIONS     4UL
+
+/* CK_SESSION_INFO provides information about a session */
+typedef struct CK_SESSION_INFO {
+  CK_SLOT_ID    slotID;
+  CK_STATE      state;
+  CK_FLAGS      flags;          /* see below */
+  CK_ULONG      ulDeviceError;  /* device-dependent error code */
+} CK_SESSION_INFO;
+
+/* The flags are defined in the following table:
+ *      Bit Flag                Mask        Meaning
+ */
+#define CKF_RW_SESSION          0x00000002UL /* session is r/w */
+#define CKF_SERIAL_SESSION      0x00000004UL /* no parallel    */
+
+typedef CK_SESSION_INFO CK_PTR CK_SESSION_INFO_PTR;
+
+
+/* CK_OBJECT_HANDLE is a token-specific identifier for an
+ * object
+ */
+typedef CK_ULONG          CK_OBJECT_HANDLE;
+
+typedef CK_OBJECT_HANDLE CK_PTR CK_OBJECT_HANDLE_PTR;
+
+
+/* CK_OBJECT_CLASS is a value that identifies the classes (or
+ * types) of objects that Cryptoki recognizes.  It is defined
+ * as follows:
+ */
+typedef CK_ULONG          CK_OBJECT_CLASS;
+
+/* The following classes of objects are defined: */
+#define CKO_DATA              0x00000000UL
+#define CKO_CERTIFICATE       0x00000001UL
+#define CKO_PUBLIC_KEY        0x00000002UL
+#define CKO_PRIVATE_KEY       0x00000003UL
+#define CKO_SECRET_KEY        0x00000004UL
+#define CKO_HW_FEATURE        0x00000005UL
+#define CKO_DOMAIN_PARAMETERS 0x00000006UL
+#define CKO_MECHANISM         0x00000007UL
+#define CKO_OTP_KEY           0x00000008UL
+
+#define CKO_VENDOR_DEFINED    0x80000000UL
+
+typedef CK_OBJECT_CLASS CK_PTR CK_OBJECT_CLASS_PTR;
+
+/* CK_HW_FEATURE_TYPE is a value that identifies the hardware feature type
+ * of an object with CK_OBJECT_CLASS equal to CKO_HW_FEATURE.
+ */
+typedef CK_ULONG          CK_HW_FEATURE_TYPE;
+
+/* The following hardware feature types are defined */
+#define CKH_MONOTONIC_COUNTER  0x00000001UL
+#define CKH_CLOCK              0x00000002UL
+#define CKH_USER_INTERFACE     0x00000003UL
+#define CKH_VENDOR_DEFINED     0x80000000UL
+
+/* CK_KEY_TYPE is a value that identifies a key type */
+typedef CK_ULONG          CK_KEY_TYPE;
+
+/* the following key types are defined: */
+#define CKK_RSA                 0x00000000UL
+#define CKK_DSA                 0x00000001UL
+#define CKK_DH                  0x00000002UL
+#define CKK_ECDSA               0x00000003UL /* Deprecated */
+#define CKK_EC                  0x00000003UL
+#define CKK_X9_42_DH            0x00000004UL
+#define CKK_KEA                 0x00000005UL
+#define CKK_GENERIC_SECRET      0x00000010UL
+#define CKK_RC2                 0x00000011UL
+#define CKK_RC4                 0x00000012UL
+#define CKK_DES                 0x00000013UL
+#define CKK_DES2                0x00000014UL
+#define CKK_DES3                0x00000015UL
+#define CKK_CAST                0x00000016UL
+#define CKK_CAST3               0x00000017UL
+#define CKK_CAST5               0x00000018UL /* Deprecated */
+#define CKK_CAST128             0x00000018UL
+#define CKK_RC5                 0x00000019UL
+#define CKK_IDEA                0x0000001AUL
+#define CKK_SKIPJACK            0x0000001BUL
+#define CKK_BATON               0x0000001CUL
+#define CKK_JUNIPER             0x0000001DUL
+#define CKK_CDMF                0x0000001EUL
+#define CKK_AES                 0x0000001FUL
+#define CKK_BLOWFISH            0x00000020UL
+#define CKK_TWOFISH             0x00000021UL
+#define CKK_SECURID             0x00000022UL
+#define CKK_HOTP                0x00000023UL
+#define CKK_ACTI                0x00000024UL
+#define CKK_CAMELLIA            0x00000025UL
+#define CKK_ARIA                0x00000026UL
+
+#define CKK_MD5_HMAC            0x00000027UL
+#define CKK_SHA_1_HMAC          0x00000028UL
+#define CKK_RIPEMD128_HMAC      0x00000029UL
+#define CKK_RIPEMD160_HMAC      0x0000002AUL
+#define CKK_SHA256_HMAC         0x0000002BUL
+#define CKK_SHA384_HMAC         0x0000002CUL
+#define CKK_SHA512_HMAC         0x0000002DUL
+#define CKK_SHA224_HMAC         0x0000002EUL
+
+#define CKK_SEED                0x0000002FUL
+#define CKK_GOSTR3410           0x00000030UL
+#define CKK_GOSTR3411           0x00000031UL
+#define CKK_GOST28147           0x00000032UL
+
+
+
+#define CKK_VENDOR_DEFINED      0x80000000UL
+
+
+/* CK_CERTIFICATE_TYPE is a value that identifies a certificate
+ * type
+ */
+typedef CK_ULONG          CK_CERTIFICATE_TYPE;
+
+#define CK_CERTIFICATE_CATEGORY_UNSPECIFIED     0UL
+#define CK_CERTIFICATE_CATEGORY_TOKEN_USER      1UL
+#define CK_CERTIFICATE_CATEGORY_AUTHORITY       2UL
+#define CK_CERTIFICATE_CATEGORY_OTHER_ENTITY    3UL
+
+#define CK_SECURITY_DOMAIN_UNSPECIFIED     0UL
+#define CK_SECURITY_DOMAIN_MANUFACTURER    1UL
+#define CK_SECURITY_DOMAIN_OPERATOR        2UL
+#define CK_SECURITY_DOMAIN_THIRD_PARTY     3UL
+
+
+/* The following certificate types are defined: */
+#define CKC_X_509               0x00000000UL
+#define CKC_X_509_ATTR_CERT     0x00000001UL
+#define CKC_WTLS                0x00000002UL
+#define CKC_VENDOR_DEFINED      0x80000000UL
+
+
+/* CK_ATTRIBUTE_TYPE is a value that identifies an attribute
+ * type
+ */
+typedef CK_ULONG          CK_ATTRIBUTE_TYPE;
+
+/* The CKF_ARRAY_ATTRIBUTE flag identifies an attribute which
+ * consists of an array of values.
+ */
+#define CKF_ARRAY_ATTRIBUTE     0x40000000UL
+
+/* The following OTP-related defines relate to the CKA_OTP_FORMAT attribute */
+#define CK_OTP_FORMAT_DECIMAL           0UL
+#define CK_OTP_FORMAT_HEXADECIMAL       1UL
+#define CK_OTP_FORMAT_ALPHANUMERIC      2UL
+#define CK_OTP_FORMAT_BINARY            3UL
+
+/* The following OTP-related defines relate to the CKA_OTP_..._REQUIREMENT
+ * attributes
+ */
+#define CK_OTP_PARAM_IGNORED            0UL
+#define CK_OTP_PARAM_OPTIONAL           1UL
+#define CK_OTP_PARAM_MANDATORY          2UL
+
+/* The following attribute types are defined: */
+#define CKA_CLASS              0x00000000UL
+#define CKA_TOKEN              0x00000001UL
+#define CKA_PRIVATE            0x00000002UL
+#define CKA_LABEL              0x00000003UL
+#define CKA_APPLICATION        0x00000010UL
+#define CKA_VALUE              0x00000011UL
+#define CKA_OBJECT_ID          0x00000012UL
+#define CKA_CERTIFICATE_TYPE   0x00000080UL
+#define CKA_ISSUER             0x00000081UL
+#define CKA_SERIAL_NUMBER      0x00000082UL
+#define CKA_AC_ISSUER          0x00000083UL
+#define CKA_OWNER              0x00000084UL
+#define CKA_ATTR_TYPES         0x00000085UL
+#define CKA_TRUSTED            0x00000086UL
+#define CKA_CERTIFICATE_CATEGORY        0x00000087UL
+#define CKA_JAVA_MIDP_SECURITY_DOMAIN   0x00000088UL
+#define CKA_URL                         0x00000089UL
+#define CKA_HASH_OF_SUBJECT_PUBLIC_KEY  0x0000008AUL
+#define CKA_HASH_OF_ISSUER_PUBLIC_KEY   0x0000008BUL
+#define CKA_NAME_HASH_ALGORITHM         0x0000008CUL
+#define CKA_CHECK_VALUE                 0x00000090UL
+
+#define CKA_KEY_TYPE           0x00000100UL
+#define CKA_SUBJECT            0x00000101UL
+#define CKA_ID                 0x00000102UL
+#define CKA_SENSITIVE          0x00000103UL
+#define CKA_ENCRYPT            0x00000104UL
+#define CKA_DECRYPT            0x00000105UL
+#define CKA_WRAP               0x00000106UL
+#define CKA_UNWRAP             0x00000107UL
+#define CKA_SIGN               0x00000108UL
+#define CKA_SIGN_RECOVER       0x00000109UL
+#define CKA_VERIFY             0x0000010AUL
+#define CKA_VERIFY_RECOVER     0x0000010BUL
+#define CKA_DERIVE             0x0000010CUL
+#define CKA_START_DATE         0x00000110UL
+#define CKA_END_DATE           0x00000111UL
+#define CKA_MODULUS            0x00000120UL
+#define CKA_MODULUS_BITS       0x00000121UL
+#define CKA_PUBLIC_EXPONENT    0x00000122UL
+#define CKA_PRIVATE_EXPONENT   0x00000123UL
+#define CKA_PRIME_1            0x00000124UL
+#define CKA_PRIME_2            0x00000125UL
+#define CKA_EXPONENT_1         0x00000126UL
+#define CKA_EXPONENT_2         0x00000127UL
+#define CKA_COEFFICIENT        0x00000128UL
+#define CKA_PUBLIC_KEY_INFO    0x00000129UL
+#define CKA_PRIME              0x00000130UL
+#define CKA_SUBPRIME           0x00000131UL
+#define CKA_BASE               0x00000132UL
+
+#define CKA_PRIME_BITS         0x00000133UL
+#define CKA_SUBPRIME_BITS      0x00000134UL
+#define CKA_SUB_PRIME_BITS     CKA_SUBPRIME_BITS
+
+#define CKA_VALUE_BITS         0x00000160UL
+#define CKA_VALUE_LEN          0x00000161UL
+#define CKA_EXTRACTABLE        0x00000162UL
+#define CKA_LOCAL              0x00000163UL
+#define CKA_NEVER_EXTRACTABLE  0x00000164UL
+#define CKA_ALWAYS_SENSITIVE   0x00000165UL
+#define CKA_KEY_GEN_MECHANISM  0x00000166UL
+
+#define CKA_MODIFIABLE         0x00000170UL
+#define CKA_COPYABLE           0x00000171UL
+
+#define CKA_DESTROYABLE        0x00000172UL
+
+#define CKA_ECDSA_PARAMS       0x00000180UL /* Deprecated */
+#define CKA_EC_PARAMS          0x00000180UL
+
+#define CKA_EC_POINT           0x00000181UL
+
+#define CKA_SECONDARY_AUTH     0x00000200UL /* Deprecated */
+#define CKA_AUTH_PIN_FLAGS     0x00000201UL /* Deprecated */
+
+#define CKA_ALWAYS_AUTHENTICATE  0x00000202UL
+
+#define CKA_WRAP_WITH_TRUSTED    0x00000210UL
+#define CKA_WRAP_TEMPLATE        (CKF_ARRAY_ATTRIBUTE|0x00000211UL)
+#define CKA_UNWRAP_TEMPLATE      (CKF_ARRAY_ATTRIBUTE|0x00000212UL)
+#define CKA_DERIVE_TEMPLATE      (CKF_ARRAY_ATTRIBUTE|0x00000213UL)
+
+#define CKA_OTP_FORMAT                0x00000220UL
+#define CKA_OTP_LENGTH                0x00000221UL
+#define CKA_OTP_TIME_INTERVAL         0x00000222UL
+#define CKA_OTP_USER_FRIENDLY_MODE    0x00000223UL
+#define CKA_OTP_CHALLENGE_REQUIREMENT 0x00000224UL
+#define CKA_OTP_TIME_REQUIREMENT      0x00000225UL
+#define CKA_OTP_COUNTER_REQUIREMENT   0x00000226UL
+#define CKA_OTP_PIN_REQUIREMENT       0x00000227UL
+#define CKA_OTP_COUNTER               0x0000022EUL
+#define CKA_OTP_TIME                  0x0000022FUL
+#define CKA_OTP_USER_IDENTIFIER       0x0000022AUL
+#define CKA_OTP_SERVICE_IDENTIFIER    0x0000022BUL
+#define CKA_OTP_SERVICE_LOGO          0x0000022CUL
+#define CKA_OTP_SERVICE_LOGO_TYPE     0x0000022DUL
+
+#define CKA_GOSTR3410_PARAMS            0x00000250UL
+#define CKA_GOSTR3411_PARAMS            0x00000251UL
+#define CKA_GOST28147_PARAMS            0x00000252UL
+
+#define CKA_HW_FEATURE_TYPE             0x00000300UL
+#define CKA_RESET_ON_INIT               0x00000301UL
+#define CKA_HAS_RESET                   0x00000302UL
+
+#define CKA_PIXEL_X                     0x00000400UL
+#define CKA_PIXEL_Y                     0x00000401UL
+#define CKA_RESOLUTION                  0x00000402UL
+#define CKA_CHAR_ROWS                   0x00000403UL
+#define CKA_CHAR_COLUMNS                0x00000404UL
+#define CKA_COLOR                       0x00000405UL
+#define CKA_BITS_PER_PIXEL              0x00000406UL
+#define CKA_CHAR_SETS                   0x00000480UL
+#define CKA_ENCODING_METHODS            0x00000481UL
+#define CKA_MIME_TYPES                  0x00000482UL
+#define CKA_MECHANISM_TYPE              0x00000500UL
+#define CKA_REQUIRED_CMS_ATTRIBUTES     0x00000501UL
+#define CKA_DEFAULT_CMS_ATTRIBUTES      0x00000502UL
+#define CKA_SUPPORTED_CMS_ATTRIBUTES    0x00000503UL
+#define CKA_ALLOWED_MECHANISMS          (CKF_ARRAY_ATTRIBUTE|0x00000600UL)
+
+#define CKA_VENDOR_DEFINED              0x80000000UL
+
+/* CK_ATTRIBUTE is a structure that includes the type, length
+ * and value of an attribute
+ */
+typedef struct CK_ATTRIBUTE {
+  CK_ATTRIBUTE_TYPE type;
+  CK_VOID_PTR       pValue;
+  CK_ULONG          ulValueLen;  /* in bytes */
+} CK_ATTRIBUTE;
+
+typedef CK_ATTRIBUTE CK_PTR CK_ATTRIBUTE_PTR;
+
+/* CK_DATE is a structure that defines a date */
+typedef struct CK_DATE{
+  CK_CHAR       year[4];   /* the year ("1900" - "9999") */
+  CK_CHAR       month[2];  /* the month ("01" - "12") */
+  CK_CHAR       day[2];    /* the day   ("01" - "31") */
+} CK_DATE;
+
+
+/* CK_MECHANISM_TYPE is a value that identifies a mechanism
+ * type
+ */
+typedef CK_ULONG          CK_MECHANISM_TYPE;
+
+/* the following mechanism types are defined: */
+#define CKM_RSA_PKCS_KEY_PAIR_GEN      0x00000000UL
+#define CKM_RSA_PKCS                   0x00000001UL
+#define CKM_RSA_9796                   0x00000002UL
+#define CKM_RSA_X_509                  0x00000003UL
+
+#define CKM_MD2_RSA_PKCS               0x00000004UL
+#define CKM_MD5_RSA_PKCS               0x00000005UL
+#define CKM_SHA1_RSA_PKCS              0x00000006UL
+
+#define CKM_RIPEMD128_RSA_PKCS         0x00000007UL
+#define CKM_RIPEMD160_RSA_PKCS         0x00000008UL
+#define CKM_RSA_PKCS_OAEP              0x00000009UL
+
+#define CKM_RSA_X9_31_KEY_PAIR_GEN     0x0000000AUL
+#define CKM_RSA_X9_31                  0x0000000BUL
+#define CKM_SHA1_RSA_X9_31             0x0000000CUL
+#define CKM_RSA_PKCS_PSS               0x0000000DUL
+#define CKM_SHA1_RSA_PKCS_PSS          0x0000000EUL
+
+#define CKM_DSA_KEY_PAIR_GEN           0x00000010UL
+#define CKM_DSA                        0x00000011UL
+#define CKM_DSA_SHA1                   0x00000012UL
+#define CKM_DSA_SHA224                 0x00000013UL
+#define CKM_DSA_SHA256                 0x00000014UL
+#define CKM_DSA_SHA384                 0x00000015UL
+#define CKM_DSA_SHA512                 0x00000016UL
+
+#define CKM_DH_PKCS_KEY_PAIR_GEN       0x00000020UL
+#define CKM_DH_PKCS_DERIVE             0x00000021UL
+
+#define CKM_X9_42_DH_KEY_PAIR_GEN      0x00000030UL
+#define CKM_X9_42_DH_DERIVE            0x00000031UL
+#define CKM_X9_42_DH_HYBRID_DERIVE     0x00000032UL
+#define CKM_X9_42_MQV_DERIVE           0x00000033UL
+
+#define CKM_SHA256_RSA_PKCS            0x00000040UL
+#define CKM_SHA384_RSA_PKCS            0x00000041UL
+#define CKM_SHA512_RSA_PKCS            0x00000042UL
+#define CKM_SHA256_RSA_PKCS_PSS        0x00000043UL
+#define CKM_SHA384_RSA_PKCS_PSS        0x00000044UL
+#define CKM_SHA512_RSA_PKCS_PSS        0x00000045UL
+
+#define CKM_SHA224_RSA_PKCS            0x00000046UL
+#define CKM_SHA224_RSA_PKCS_PSS        0x00000047UL
+
+#define CKM_SHA512_224                 0x00000048UL
+#define CKM_SHA512_224_HMAC            0x00000049UL
+#define CKM_SHA512_224_HMAC_GENERAL    0x0000004AUL
+#define CKM_SHA512_224_KEY_DERIVATION  0x0000004BUL
+#define CKM_SHA512_256                 0x0000004CUL
+#define CKM_SHA512_256_HMAC            0x0000004DUL
+#define CKM_SHA512_256_HMAC_GENERAL    0x0000004EUL
+#define CKM_SHA512_256_KEY_DERIVATION  0x0000004FUL
+
+#define CKM_SHA512_T                   0x00000050UL
+#define CKM_SHA512_T_HMAC              0x00000051UL
+#define CKM_SHA512_T_HMAC_GENERAL      0x00000052UL
+#define CKM_SHA512_T_KEY_DERIVATION    0x00000053UL
+
+#define CKM_RC2_KEY_GEN                0x00000100UL
+#define CKM_RC2_ECB                    0x00000101UL
+#define CKM_RC2_CBC                    0x00000102UL
+#define CKM_RC2_MAC                    0x00000103UL
+
+#define CKM_RC2_MAC_GENERAL            0x00000104UL
+#define CKM_RC2_CBC_PAD                0x00000105UL
+
+#define CKM_RC4_KEY_GEN                0x00000110UL
+#define CKM_RC4                        0x00000111UL
+#define CKM_DES_KEY_GEN                0x00000120UL
+#define CKM_DES_ECB                    0x00000121UL
+#define CKM_DES_CBC                    0x00000122UL
+#define CKM_DES_MAC                    0x00000123UL
+
+#define CKM_DES_MAC_GENERAL            0x00000124UL
+#define CKM_DES_CBC_PAD                0x00000125UL
+
+#define CKM_DES2_KEY_GEN               0x00000130UL
+#define CKM_DES3_KEY_GEN               0x00000131UL
+#define CKM_DES3_ECB                   0x00000132UL
+#define CKM_DES3_CBC                   0x00000133UL
+#define CKM_DES3_MAC                   0x00000134UL
+
+#define CKM_DES3_MAC_GENERAL           0x00000135UL
+#define CKM_DES3_CBC_PAD               0x00000136UL
+#define CKM_DES3_CMAC_GENERAL          0x00000137UL
+#define CKM_DES3_CMAC                  0x00000138UL
+#define CKM_CDMF_KEY_GEN               0x00000140UL
+#define CKM_CDMF_ECB                   0x00000141UL
+#define CKM_CDMF_CBC                   0x00000142UL
+#define CKM_CDMF_MAC                   0x00000143UL
+#define CKM_CDMF_MAC_GENERAL           0x00000144UL
+#define CKM_CDMF_CBC_PAD               0x00000145UL
+
+#define CKM_DES_OFB64                  0x00000150UL
+#define CKM_DES_OFB8                   0x00000151UL
+#define CKM_DES_CFB64                  0x00000152UL
+#define CKM_DES_CFB8                   0x00000153UL
+
+#define CKM_MD2                        0x00000200UL
+
+#define CKM_MD2_HMAC                   0x00000201UL
+#define CKM_MD2_HMAC_GENERAL           0x00000202UL
+
+#define CKM_MD5                        0x00000210UL
+
+#define CKM_MD5_HMAC                   0x00000211UL
+#define CKM_MD5_HMAC_GENERAL           0x00000212UL
+
+#define CKM_SHA_1                      0x00000220UL
+
+#define CKM_SHA_1_HMAC                 0x00000221UL
+#define CKM_SHA_1_HMAC_GENERAL         0x00000222UL
+
+#define CKM_RIPEMD128                  0x00000230UL
+#define CKM_RIPEMD128_HMAC             0x00000231UL
+#define CKM_RIPEMD128_HMAC_GENERAL     0x00000232UL
+#define CKM_RIPEMD160                  0x00000240UL
+#define CKM_RIPEMD160_HMAC             0x00000241UL
+#define CKM_RIPEMD160_HMAC_GENERAL     0x00000242UL
+
+#define CKM_SHA256                     0x00000250UL
+#define CKM_SHA256_HMAC                0x00000251UL
+#define CKM_SHA256_HMAC_GENERAL        0x00000252UL
+#define CKM_SHA224                     0x00000255UL
+#define CKM_SHA224_HMAC                0x00000256UL
+#define CKM_SHA224_HMAC_GENERAL        0x00000257UL
+#define CKM_SHA384                     0x00000260UL
+#define CKM_SHA384_HMAC                0x00000261UL
+#define CKM_SHA384_HMAC_GENERAL        0x00000262UL
+#define CKM_SHA512                     0x00000270UL
+#define CKM_SHA512_HMAC                0x00000271UL
+#define CKM_SHA512_HMAC_GENERAL        0x00000272UL
+#define CKM_SECURID_KEY_GEN            0x00000280UL
+#define CKM_SECURID                    0x00000282UL
+#define CKM_HOTP_KEY_GEN               0x00000290UL
+#define CKM_HOTP                       0x00000291UL
+#define CKM_ACTI                       0x000002A0UL
+#define CKM_ACTI_KEY_GEN               0x000002A1UL
+
+#define CKM_CAST_KEY_GEN               0x00000300UL
+#define CKM_CAST_ECB                   0x00000301UL
+#define CKM_CAST_CBC                   0x00000302UL
+#define CKM_CAST_MAC                   0x00000303UL
+#define CKM_CAST_MAC_GENERAL           0x00000304UL
+#define CKM_CAST_CBC_PAD               0x00000305UL
+#define CKM_CAST3_KEY_GEN              0x00000310UL
+#define CKM_CAST3_ECB                  0x00000311UL
+#define CKM_CAST3_CBC                  0x00000312UL
+#define CKM_CAST3_MAC                  0x00000313UL
+#define CKM_CAST3_MAC_GENERAL          0x00000314UL
+#define CKM_CAST3_CBC_PAD              0x00000315UL
+/* Note that CAST128 and CAST5 are the same algorithm */
+#define CKM_CAST5_KEY_GEN              0x00000320UL
+#define CKM_CAST128_KEY_GEN            0x00000320UL
+#define CKM_CAST5_ECB                  0x00000321UL
+#define CKM_CAST128_ECB                0x00000321UL
+#define CKM_CAST5_CBC                  0x00000322UL /* Deprecated */
+#define CKM_CAST128_CBC                0x00000322UL
+#define CKM_CAST5_MAC                  0x00000323UL /* Deprecated */
+#define CKM_CAST128_MAC                0x00000323UL
+#define CKM_CAST5_MAC_GENERAL          0x00000324UL /* Deprecated */
+#define CKM_CAST128_MAC_GENERAL        0x00000324UL
+#define CKM_CAST5_CBC_PAD              0x00000325UL /* Deprecated */
+#define CKM_CAST128_CBC_PAD            0x00000325UL
+#define CKM_RC5_KEY_GEN                0x00000330UL
+#define CKM_RC5_ECB                    0x00000331UL
+#define CKM_RC5_CBC                    0x00000332UL
+#define CKM_RC5_MAC                    0x00000333UL
+#define CKM_RC5_MAC_GENERAL            0x00000334UL
+#define CKM_RC5_CBC_PAD                0x00000335UL
+#define CKM_IDEA_KEY_GEN               0x00000340UL
+#define CKM_IDEA_ECB                   0x00000341UL
+#define CKM_IDEA_CBC                   0x00000342UL
+#define CKM_IDEA_MAC                   0x00000343UL
+#define CKM_IDEA_MAC_GENERAL           0x00000344UL
+#define CKM_IDEA_CBC_PAD               0x00000345UL
+#define CKM_GENERIC_SECRET_KEY_GEN     0x00000350UL
+#define CKM_CONCATENATE_BASE_AND_KEY   0x00000360UL
+#define CKM_CONCATENATE_BASE_AND_DATA  0x00000362UL
+#define CKM_CONCATENATE_DATA_AND_BASE  0x00000363UL
+#define CKM_XOR_BASE_AND_DATA          0x00000364UL
+#define CKM_EXTRACT_KEY_FROM_KEY       0x00000365UL
+#define CKM_SSL3_PRE_MASTER_KEY_GEN    0x00000370UL
+#define CKM_SSL3_MASTER_KEY_DERIVE     0x00000371UL
+#define CKM_SSL3_KEY_AND_MAC_DERIVE    0x00000372UL
+
+#define CKM_SSL3_MASTER_KEY_DERIVE_DH  0x00000373UL
+#define CKM_TLS_PRE_MASTER_KEY_GEN     0x00000374UL
+#define CKM_TLS_MASTER_KEY_DERIVE      0x00000375UL
+#define CKM_TLS_KEY_AND_MAC_DERIVE     0x00000376UL
+#define CKM_TLS_MASTER_KEY_DERIVE_DH   0x00000377UL
+
+#define CKM_TLS_PRF                    0x00000378UL
+
+#define CKM_SSL3_MD5_MAC               0x00000380UL
+#define CKM_SSL3_SHA1_MAC              0x00000381UL
+#define CKM_MD5_KEY_DERIVATION         0x00000390UL
+#define CKM_MD2_KEY_DERIVATION         0x00000391UL
+#define CKM_SHA1_KEY_DERIVATION        0x00000392UL
+
+#define CKM_SHA256_KEY_DERIVATION      0x00000393UL
+#define CKM_SHA384_KEY_DERIVATION      0x00000394UL
+#define CKM_SHA512_KEY_DERIVATION      0x00000395UL
+#define CKM_SHA224_KEY_DERIVATION      0x00000396UL
+
+#define CKM_PBE_MD2_DES_CBC            0x000003A0UL
+#define CKM_PBE_MD5_DES_CBC            0x000003A1UL
+#define CKM_PBE_MD5_CAST_CBC           0x000003A2UL
+#define CKM_PBE_MD5_CAST3_CBC          0x000003A3UL
+#define CKM_PBE_MD5_CAST5_CBC          0x000003A4UL /* Deprecated */
+#define CKM_PBE_MD5_CAST128_CBC        0x000003A4UL
+#define CKM_PBE_SHA1_CAST5_CBC         0x000003A5UL /* Deprecated */
+#define CKM_PBE_SHA1_CAST128_CBC       0x000003A5UL
+#define CKM_PBE_SHA1_RC4_128           0x000003A6UL
+#define CKM_PBE_SHA1_RC4_40            0x000003A7UL
+#define CKM_PBE_SHA1_DES3_EDE_CBC      0x000003A8UL
+#define CKM_PBE_SHA1_DES2_EDE_CBC      0x000003A9UL
+#define CKM_PBE_SHA1_RC2_128_CBC       0x000003AAUL
+#define CKM_PBE_SHA1_RC2_40_CBC        0x000003ABUL
+
+#define CKM_PKCS5_PBKD2                0x000003B0UL
+
+#define CKM_PBA_SHA1_WITH_SHA1_HMAC    0x000003C0UL
+
+#define CKM_WTLS_PRE_MASTER_KEY_GEN         0x000003D0UL
+#define CKM_WTLS_MASTER_KEY_DERIVE          0x000003D1UL
+#define CKM_WTLS_MASTER_KEY_DERIVE_DH_ECC   0x000003D2UL
+#define CKM_WTLS_PRF                        0x000003D3UL
+#define CKM_WTLS_SERVER_KEY_AND_MAC_DERIVE  0x000003D4UL
+#define CKM_WTLS_CLIENT_KEY_AND_MAC_DERIVE  0x000003D5UL
+
+#define CKM_TLS10_MAC_SERVER                0x000003D6UL
+#define CKM_TLS10_MAC_CLIENT                0x000003D7UL
+#define CKM_TLS12_MAC                       0x000003D8UL
+#define CKM_TLS12_KDF                       0x000003D9UL
+#define CKM_TLS12_MASTER_KEY_DERIVE         0x000003E0UL
+#define CKM_TLS12_KEY_AND_MAC_DERIVE        0x000003E1UL
+#define CKM_TLS12_MASTER_KEY_DERIVE_DH      0x000003E2UL
+#define CKM_TLS12_KEY_SAFE_DERIVE           0x000003E3UL
+#define CKM_TLS_MAC                         0x000003E4UL
+#define CKM_TLS_KDF                         0x000003E5UL
+
+#define CKM_KEY_WRAP_LYNKS             0x00000400UL
+#define CKM_KEY_WRAP_SET_OAEP          0x00000401UL
+
+#define CKM_CMS_SIG                    0x00000500UL
+#define CKM_KIP_DERIVE                 0x00000510UL
+#define CKM_KIP_WRAP                   0x00000511UL
+#define CKM_KIP_MAC                    0x00000512UL
+
+#define CKM_CAMELLIA_KEY_GEN           0x00000550UL
+#define CKM_CAMELLIA_ECB               0x00000551UL
+#define CKM_CAMELLIA_CBC               0x00000552UL
+#define CKM_CAMELLIA_MAC               0x00000553UL
+#define CKM_CAMELLIA_MAC_GENERAL       0x00000554UL
+#define CKM_CAMELLIA_CBC_PAD           0x00000555UL
+#define CKM_CAMELLIA_ECB_ENCRYPT_DATA  0x00000556UL
+#define CKM_CAMELLIA_CBC_ENCRYPT_DATA  0x00000557UL
+#define CKM_CAMELLIA_CTR               0x00000558UL
+
+#define CKM_ARIA_KEY_GEN               0x00000560UL
+#define CKM_ARIA_ECB                   0x00000561UL
+#define CKM_ARIA_CBC                   0x00000562UL
+#define CKM_ARIA_MAC                   0x00000563UL
+#define CKM_ARIA_MAC_GENERAL           0x00000564UL
+#define CKM_ARIA_CBC_PAD               0x00000565UL
+#define CKM_ARIA_ECB_ENCRYPT_DATA      0x00000566UL
+#define CKM_ARIA_CBC_ENCRYPT_DATA      0x00000567UL
+
+#define CKM_SEED_KEY_GEN               0x00000650UL
+#define CKM_SEED_ECB                   0x00000651UL
+#define CKM_SEED_CBC                   0x00000652UL
+#define CKM_SEED_MAC                   0x00000653UL
+#define CKM_SEED_MAC_GENERAL           0x00000654UL
+#define CKM_SEED_CBC_PAD               0x00000655UL
+#define CKM_SEED_ECB_ENCRYPT_DATA      0x00000656UL
+#define CKM_SEED_CBC_ENCRYPT_DATA      0x00000657UL
+
+#define CKM_SKIPJACK_KEY_GEN           0x00001000UL
+#define CKM_SKIPJACK_ECB64             0x00001001UL
+#define CKM_SKIPJACK_CBC64             0x00001002UL
+#define CKM_SKIPJACK_OFB64             0x00001003UL
+#define CKM_SKIPJACK_CFB64             0x00001004UL
+#define CKM_SKIPJACK_CFB32             0x00001005UL
+#define CKM_SKIPJACK_CFB16             0x00001006UL
+#define CKM_SKIPJACK_CFB8              0x00001007UL
+#define CKM_SKIPJACK_WRAP              0x00001008UL
+#define CKM_SKIPJACK_PRIVATE_WRAP      0x00001009UL
+#define CKM_SKIPJACK_RELAYX            0x0000100aUL
+#define CKM_KEA_KEY_PAIR_GEN           0x00001010UL
+#define CKM_KEA_KEY_DERIVE             0x00001011UL
+#define CKM_KEA_DERIVE                 0x00001012UL
+#define CKM_FORTEZZA_TIMESTAMP         0x00001020UL
+#define CKM_BATON_KEY_GEN              0x00001030UL
+#define CKM_BATON_ECB128               0x00001031UL
+#define CKM_BATON_ECB96                0x00001032UL
+#define CKM_BATON_CBC128               0x00001033UL
+#define CKM_BATON_COUNTER              0x00001034UL
+#define CKM_BATON_SHUFFLE              0x00001035UL
+#define CKM_BATON_WRAP                 0x00001036UL
+
+#define CKM_ECDSA_KEY_PAIR_GEN         0x00001040UL /* Deprecated */
+#define CKM_EC_KEY_PAIR_GEN            0x00001040UL
+
+#define CKM_ECDSA                      0x00001041UL
+#define CKM_ECDSA_SHA1                 0x00001042UL
+#define CKM_ECDSA_SHA224               0x00001043UL
+#define CKM_ECDSA_SHA256               0x00001044UL
+#define CKM_ECDSA_SHA384               0x00001045UL
+#define CKM_ECDSA_SHA512               0x00001046UL
+
+#define CKM_ECDH1_DERIVE               0x00001050UL
+#define CKM_ECDH1_COFACTOR_DERIVE      0x00001051UL
+#define CKM_ECMQV_DERIVE               0x00001052UL
+
+#define CKM_ECDH_AES_KEY_WRAP          0x00001053UL
+#define CKM_RSA_AES_KEY_WRAP           0x00001054UL
+
+#define CKM_JUNIPER_KEY_GEN            0x00001060UL
+#define CKM_JUNIPER_ECB128             0x00001061UL
+#define CKM_JUNIPER_CBC128             0x00001062UL
+#define CKM_JUNIPER_COUNTER            0x00001063UL
+#define CKM_JUNIPER_SHUFFLE            0x00001064UL
+#define CKM_JUNIPER_WRAP               0x00001065UL
+#define CKM_FASTHASH                   0x00001070UL
+
+#define CKM_AES_KEY_GEN                0x00001080UL
+#define CKM_AES_ECB                    0x00001081UL
+#define CKM_AES_CBC                    0x00001082UL
+#define CKM_AES_MAC                    0x00001083UL
+#define CKM_AES_MAC_GENERAL            0x00001084UL
+#define CKM_AES_CBC_PAD                0x00001085UL
+#define CKM_AES_CTR                    0x00001086UL
+#define CKM_AES_GCM                    0x00001087UL
+#define CKM_AES_CCM                    0x00001088UL
+#define CKM_AES_CTS                    0x00001089UL
+#define CKM_AES_CMAC                   0x0000108AUL
+#define CKM_AES_CMAC_GENERAL           0x0000108BUL
+
+#define CKM_AES_XCBC_MAC               0x0000108CUL
+#define CKM_AES_XCBC_MAC_96            0x0000108DUL
+#define CKM_AES_GMAC                   0x0000108EUL
+
+#define CKM_BLOWFISH_KEY_GEN           0x00001090UL
+#define CKM_BLOWFISH_CBC               0x00001091UL
+#define CKM_TWOFISH_KEY_GEN            0x00001092UL
+#define CKM_TWOFISH_CBC                0x00001093UL
+#define CKM_BLOWFISH_CBC_PAD           0x00001094UL
+#define CKM_TWOFISH_CBC_PAD            0x00001095UL
+
+#define CKM_DES_ECB_ENCRYPT_DATA       0x00001100UL
+#define CKM_DES_CBC_ENCRYPT_DATA       0x00001101UL
+#define CKM_DES3_ECB_ENCRYPT_DATA      0x00001102UL
+#define CKM_DES3_CBC_ENCRYPT_DATA      0x00001103UL
+#define CKM_AES_ECB_ENCRYPT_DATA       0x00001104UL
+#define CKM_AES_CBC_ENCRYPT_DATA       0x00001105UL
+
+#define CKM_GOSTR3410_KEY_PAIR_GEN     0x00001200UL
+#define CKM_GOSTR3410                  0x00001201UL
+#define CKM_GOSTR3410_WITH_GOSTR3411   0x00001202UL
+#define CKM_GOSTR3410_KEY_WRAP         0x00001203UL
+#define CKM_GOSTR3410_DERIVE           0x00001204UL
+#define CKM_GOSTR3411                  0x00001210UL
+#define CKM_GOSTR3411_HMAC             0x00001211UL
+#define CKM_GOST28147_KEY_GEN          0x00001220UL
+#define CKM_GOST28147_ECB              0x00001221UL
+#define CKM_GOST28147                  0x00001222UL
+#define CKM_GOST28147_MAC              0x00001223UL
+#define CKM_GOST28147_KEY_WRAP         0x00001224UL
+
+#define CKM_DSA_PARAMETER_GEN          0x00002000UL
+#define CKM_DH_PKCS_PARAMETER_GEN      0x00002001UL
+#define CKM_X9_42_DH_PARAMETER_GEN     0x00002002UL
+#define CKM_DSA_PROBABLISTIC_PARAMETER_GEN    0x00002003UL
+#define CKM_DSA_SHAWE_TAYLOR_PARAMETER_GEN    0x00002004UL
+
+#define CKM_AES_OFB                    0x00002104UL
+#define CKM_AES_CFB64                  0x00002105UL
+#define CKM_AES_CFB8                   0x00002106UL
+#define CKM_AES_CFB128                 0x00002107UL
+
+#define CKM_AES_CFB1                   0x00002108UL
+#define CKM_AES_KEY_WRAP               0x00002109UL     /* WAS: 0x00001090 */
+#define CKM_AES_KEY_WRAP_PAD           0x0000210AUL     /* WAS: 0x00001091 */
+
+#define CKM_RSA_PKCS_TPM_1_1           0x00004001UL
+#define CKM_RSA_PKCS_OAEP_TPM_1_1      0x00004002UL
+
+#define CKM_VENDOR_DEFINED             0x80000000UL
+
+typedef CK_MECHANISM_TYPE CK_PTR CK_MECHANISM_TYPE_PTR;
+
+
+/* CK_MECHANISM is a structure that specifies a particular
+ * mechanism
+ */
+typedef struct CK_MECHANISM {
+  CK_MECHANISM_TYPE mechanism;
+  CK_VOID_PTR       pParameter;
+  CK_ULONG          ulParameterLen;  /* in bytes */
+} CK_MECHANISM;
+
+typedef CK_MECHANISM CK_PTR CK_MECHANISM_PTR;
+
+
+/* CK_MECHANISM_INFO provides information about a particular
+ * mechanism
+ */
+typedef struct CK_MECHANISM_INFO {
+    CK_ULONG    ulMinKeySize;
+    CK_ULONG    ulMaxKeySize;
+    CK_FLAGS    flags;
+} CK_MECHANISM_INFO;
+
+/* The flags are defined as follows:
+ *      Bit Flag               Mask          Meaning */
+#define CKF_HW                 0x00000001UL  /* performed by HW */
+
+/* Specify whether or not a mechanism can be used for a particular task */
+#define CKF_ENCRYPT            0x00000100UL
+#define CKF_DECRYPT            0x00000200UL
+#define CKF_DIGEST             0x00000400UL
+#define CKF_SIGN               0x00000800UL
+#define CKF_SIGN_RECOVER       0x00001000UL
+#define CKF_VERIFY             0x00002000UL
+#define CKF_VERIFY_RECOVER     0x00004000UL
+#define CKF_GENERATE           0x00008000UL
+#define CKF_GENERATE_KEY_PAIR  0x00010000UL
+#define CKF_WRAP               0x00020000UL
+#define CKF_UNWRAP             0x00040000UL
+#define CKF_DERIVE             0x00080000UL
+
+/* Describe a token's EC capabilities not available in mechanism
+ * information.
+ */
+#define CKF_EC_F_P             0x00100000UL
+#define CKF_EC_F_2M            0x00200000UL
+#define CKF_EC_ECPARAMETERS    0x00400000UL
+#define CKF_EC_NAMEDCURVE      0x00800000UL
+#define CKF_EC_UNCOMPRESS      0x01000000UL
+#define CKF_EC_COMPRESS        0x02000000UL
+
+#define CKF_EXTENSION          0x80000000UL
+
+typedef CK_MECHANISM_INFO CK_PTR CK_MECHANISM_INFO_PTR;
+
+/* CK_RV is a value that identifies the return value of a
+ * Cryptoki function
+ */
+typedef CK_ULONG          CK_RV;
+
+#define CKR_OK                                0x00000000UL
+#define CKR_CANCEL                            0x00000001UL
+#define CKR_HOST_MEMORY                       0x00000002UL
+#define CKR_SLOT_ID_INVALID                   0x00000003UL
+
+#define CKR_GENERAL_ERROR                     0x00000005UL
+#define CKR_FUNCTION_FAILED                   0x00000006UL
+
+#define CKR_ARGUMENTS_BAD                     0x00000007UL
+#define CKR_NO_EVENT                          0x00000008UL
+#define CKR_NEED_TO_CREATE_THREADS            0x00000009UL
+#define CKR_CANT_LOCK                         0x0000000AUL
+
+#define CKR_ATTRIBUTE_READ_ONLY               0x00000010UL
+#define CKR_ATTRIBUTE_SENSITIVE               0x00000011UL
+#define CKR_ATTRIBUTE_TYPE_INVALID            0x00000012UL
+#define CKR_ATTRIBUTE_VALUE_INVALID           0x00000013UL
+
+#define CKR_ACTION_PROHIBITED                 0x0000001BUL
+
+#define CKR_DATA_INVALID                      0x00000020UL
+#define CKR_DATA_LEN_RANGE                    0x00000021UL
+#define CKR_DEVICE_ERROR                      0x00000030UL
+#define CKR_DEVICE_MEMORY                     0x00000031UL
+#define CKR_DEVICE_REMOVED                    0x00000032UL
+#define CKR_ENCRYPTED_DATA_INVALID            0x00000040UL
+#define CKR_ENCRYPTED_DATA_LEN_RANGE          0x00000041UL
+#define CKR_FUNCTION_CANCELED                 0x00000050UL
+#define CKR_FUNCTION_NOT_PARALLEL             0x00000051UL
+
+#define CKR_FUNCTION_NOT_SUPPORTED            0x00000054UL
+
+#define CKR_KEY_HANDLE_INVALID                0x00000060UL
+
+#define CKR_KEY_SIZE_RANGE                    0x00000062UL
+#define CKR_KEY_TYPE_INCONSISTENT             0x00000063UL
+
+#define CKR_KEY_NOT_NEEDED                    0x00000064UL
+#define CKR_KEY_CHANGED                       0x00000065UL
+#define CKR_KEY_NEEDED                        0x00000066UL
+#define CKR_KEY_INDIGESTIBLE                  0x00000067UL
+#define CKR_KEY_FUNCTION_NOT_PERMITTED        0x00000068UL
+#define CKR_KEY_NOT_WRAPPABLE                 0x00000069UL
+#define CKR_KEY_UNEXTRACTABLE                 0x0000006AUL
+
+#define CKR_MECHANISM_INVALID                 0x00000070UL
+#define CKR_MECHANISM_PARAM_INVALID           0x00000071UL
+
+#define CKR_OBJECT_HANDLE_INVALID             0x00000082UL
+#define CKR_OPERATION_ACTIVE                  0x00000090UL
+#define CKR_OPERATION_NOT_INITIALIZED         0x00000091UL
+#define CKR_PIN_INCORRECT                     0x000000A0UL
+#define CKR_PIN_INVALID                       0x000000A1UL
+#define CKR_PIN_LEN_RANGE                     0x000000A2UL
+
+#define CKR_PIN_EXPIRED                       0x000000A3UL
+#define CKR_PIN_LOCKED                        0x000000A4UL
+
+#define CKR_SESSION_CLOSED                    0x000000B0UL
+#define CKR_SESSION_COUNT                     0x000000B1UL
+#define CKR_SESSION_HANDLE_INVALID            0x000000B3UL
+#define CKR_SESSION_PARALLEL_NOT_SUPPORTED    0x000000B4UL
+#define CKR_SESSION_READ_ONLY                 0x000000B5UL
+#define CKR_SESSION_EXISTS                    0x000000B6UL
+
+#define CKR_SESSION_READ_ONLY_EXISTS          0x000000B7UL
+#define CKR_SESSION_READ_WRITE_SO_EXISTS      0x000000B8UL
+
+#define CKR_SIGNATURE_INVALID                 0x000000C0UL
+#define CKR_SIGNATURE_LEN_RANGE               0x000000C1UL
+#define CKR_TEMPLATE_INCOMPLETE               0x000000D0UL
+#define CKR_TEMPLATE_INCONSISTENT             0x000000D1UL
+#define CKR_TOKEN_NOT_PRESENT                 0x000000E0UL
+#define CKR_TOKEN_NOT_RECOGNIZED              0x000000E1UL
+#define CKR_TOKEN_WRITE_PROTECTED             0x000000E2UL
+#define CKR_UNWRAPPING_KEY_HANDLE_INVALID     0x000000F0UL
+#define CKR_UNWRAPPING_KEY_SIZE_RANGE         0x000000F1UL
+#define CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT  0x000000F2UL
+#define CKR_USER_ALREADY_LOGGED_IN            0x00000100UL
+#define CKR_USER_NOT_LOGGED_IN                0x00000101UL
+#define CKR_USER_PIN_NOT_INITIALIZED          0x00000102UL
+#define CKR_USER_TYPE_INVALID                 0x00000103UL
+
+#define CKR_USER_ANOTHER_ALREADY_LOGGED_IN    0x00000104UL
+#define CKR_USER_TOO_MANY_TYPES               0x00000105UL
+
+#define CKR_WRAPPED_KEY_INVALID               0x00000110UL
+#define CKR_WRAPPED_KEY_LEN_RANGE             0x00000112UL
+#define CKR_WRAPPING_KEY_HANDLE_INVALID       0x00000113UL
+#define CKR_WRAPPING_KEY_SIZE_RANGE           0x00000114UL
+#define CKR_WRAPPING_KEY_TYPE_INCONSISTENT    0x00000115UL
+#define CKR_RANDOM_SEED_NOT_SUPPORTED         0x00000120UL
+
+#define CKR_RANDOM_NO_RNG                     0x00000121UL
+
+#define CKR_DOMAIN_PARAMS_INVALID             0x00000130UL
+
+#define CKR_CURVE_NOT_SUPPORTED               0x00000140UL
+
+#define CKR_BUFFER_TOO_SMALL                  0x00000150UL
+#define CKR_SAVED_STATE_INVALID               0x00000160UL
+#define CKR_INFORMATION_SENSITIVE             0x00000170UL
+#define CKR_STATE_UNSAVEABLE                  0x00000180UL
+
+#define CKR_CRYPTOKI_NOT_INITIALIZED          0x00000190UL
+#define CKR_CRYPTOKI_ALREADY_INITIALIZED      0x00000191UL
+#define CKR_MUTEX_BAD                         0x000001A0UL
+#define CKR_MUTEX_NOT_LOCKED                  0x000001A1UL
+
+#define CKR_NEW_PIN_MODE                      0x000001B0UL
+#define CKR_NEXT_OTP                          0x000001B1UL
+
+#define CKR_EXCEEDED_MAX_ITERATIONS           0x000001B5UL
+#define CKR_FIPS_SELF_TEST_FAILED             0x000001B6UL
+#define CKR_LIBRARY_LOAD_FAILED               0x000001B7UL
+#define CKR_PIN_TOO_WEAK                      0x000001B8UL
+#define CKR_PUBLIC_KEY_INVALID                0x000001B9UL
+
+#define CKR_FUNCTION_REJECTED                 0x00000200UL
+
+#define CKR_VENDOR_DEFINED                    0x80000000UL
+
+
+/* CK_NOTIFY is an application callback that processes events */
+typedef CK_CALLBACK_FUNCTION(CK_RV, CK_NOTIFY)(
+  CK_SESSION_HANDLE hSession,     /* the session's handle */
+  CK_NOTIFICATION   event,
+  CK_VOID_PTR       pApplication  /* passed to C_OpenSession */
+);
+
+
+/* CK_FUNCTION_LIST is a structure holding a Cryptoki spec
+ * version and pointers of appropriate types to all the
+ * Cryptoki functions
+ */
+typedef struct CK_FUNCTION_LIST CK_FUNCTION_LIST;
+
+typedef CK_FUNCTION_LIST CK_PTR CK_FUNCTION_LIST_PTR;
+
+typedef CK_FUNCTION_LIST_PTR CK_PTR CK_FUNCTION_LIST_PTR_PTR;
+
+
+/* CK_CREATEMUTEX is an application callback for creating a
+ * mutex object
+ */
+typedef CK_CALLBACK_FUNCTION(CK_RV, CK_CREATEMUTEX)(
+  CK_VOID_PTR_PTR ppMutex  /* location to receive ptr to mutex */
+);
+
+
+/* CK_DESTROYMUTEX is an application callback for destroying a
+ * mutex object
+ */
+typedef CK_CALLBACK_FUNCTION(CK_RV, CK_DESTROYMUTEX)(
+  CK_VOID_PTR pMutex  /* pointer to mutex */
+);
+
+
+/* CK_LOCKMUTEX is an application callback for locking a mutex */
+typedef CK_CALLBACK_FUNCTION(CK_RV, CK_LOCKMUTEX)(
+  CK_VOID_PTR pMutex  /* pointer to mutex */
+);
+
+
+/* CK_UNLOCKMUTEX is an application callback for unlocking a
+ * mutex
+ */
+typedef CK_CALLBACK_FUNCTION(CK_RV, CK_UNLOCKMUTEX)(
+  CK_VOID_PTR pMutex  /* pointer to mutex */
+);
+
+
+/* CK_C_INITIALIZE_ARGS provides the optional arguments to
+ * C_Initialize
+ */
+typedef struct CK_C_INITIALIZE_ARGS {
+  CK_CREATEMUTEX CreateMutex;
+  CK_DESTROYMUTEX DestroyMutex;
+  CK_LOCKMUTEX LockMutex;
+  CK_UNLOCKMUTEX UnlockMutex;
+  CK_FLAGS flags;
+  CK_VOID_PTR pReserved;
+} CK_C_INITIALIZE_ARGS;
+
+/* flags: bit flags that provide capabilities of the slot
+ *      Bit Flag                           Mask       Meaning
+ */
+#define CKF_LIBRARY_CANT_CREATE_OS_THREADS 0x00000001UL
+#define CKF_OS_LOCKING_OK                  0x00000002UL
+
+typedef CK_C_INITIALIZE_ARGS CK_PTR CK_C_INITIALIZE_ARGS_PTR;
+
+
+/* additional flags for parameters to functions */
+
+/* CKF_DONT_BLOCK is for the function C_WaitForSlotEvent */
+#define CKF_DONT_BLOCK     1
+
+/* CK_RSA_PKCS_MGF_TYPE  is used to indicate the Message
+ * Generation Function (MGF) applied to a message block when
+ * formatting a message block for the PKCS #1 OAEP encryption
+ * scheme.
+ */
+typedef CK_ULONG CK_RSA_PKCS_MGF_TYPE;
+
+typedef CK_RSA_PKCS_MGF_TYPE CK_PTR CK_RSA_PKCS_MGF_TYPE_PTR;
+
+/* The following MGFs are defined */
+#define CKG_MGF1_SHA1         0x00000001UL
+#define CKG_MGF1_SHA256       0x00000002UL
+#define CKG_MGF1_SHA384       0x00000003UL
+#define CKG_MGF1_SHA512       0x00000004UL
+#define CKG_MGF1_SHA224       0x00000005UL
+
+/* CK_RSA_PKCS_OAEP_SOURCE_TYPE  is used to indicate the source
+ * of the encoding parameter when formatting a message block
+ * for the PKCS #1 OAEP encryption scheme.
+ */
+typedef CK_ULONG CK_RSA_PKCS_OAEP_SOURCE_TYPE;
+
+typedef CK_RSA_PKCS_OAEP_SOURCE_TYPE CK_PTR CK_RSA_PKCS_OAEP_SOURCE_TYPE_PTR;
+
+/* The following encoding parameter sources are defined */
+#define CKZ_DATA_SPECIFIED    0x00000001UL
+
+/* CK_RSA_PKCS_OAEP_PARAMS provides the parameters to the
+ * CKM_RSA_PKCS_OAEP mechanism.
+ */
+typedef struct CK_RSA_PKCS_OAEP_PARAMS {
+        CK_MECHANISM_TYPE hashAlg;
+        CK_RSA_PKCS_MGF_TYPE mgf;
+        CK_RSA_PKCS_OAEP_SOURCE_TYPE source;
+        CK_VOID_PTR pSourceData;
+        CK_ULONG ulSourceDataLen;
+} CK_RSA_PKCS_OAEP_PARAMS;
+
+typedef CK_RSA_PKCS_OAEP_PARAMS CK_PTR CK_RSA_PKCS_OAEP_PARAMS_PTR;
+
+/* CK_RSA_PKCS_PSS_PARAMS provides the parameters to the
+ * CKM_RSA_PKCS_PSS mechanism(s).
+ */
+typedef struct CK_RSA_PKCS_PSS_PARAMS {
+        CK_MECHANISM_TYPE    hashAlg;
+        CK_RSA_PKCS_MGF_TYPE mgf;
+        CK_ULONG             sLen;
+} CK_RSA_PKCS_PSS_PARAMS;
+
+typedef CK_RSA_PKCS_PSS_PARAMS CK_PTR CK_RSA_PKCS_PSS_PARAMS_PTR;
+
+typedef CK_ULONG CK_EC_KDF_TYPE;
+
+/* The following EC Key Derivation Functions are defined */
+#define CKD_NULL                 0x00000001UL
+#define CKD_SHA1_KDF             0x00000002UL
+
+/* The following X9.42 DH key derivation functions are defined */
+#define CKD_SHA1_KDF_ASN1        0x00000003UL
+#define CKD_SHA1_KDF_CONCATENATE 0x00000004UL
+#define CKD_SHA224_KDF           0x00000005UL
+#define CKD_SHA256_KDF           0x00000006UL
+#define CKD_SHA384_KDF           0x00000007UL
+#define CKD_SHA512_KDF           0x00000008UL
+#define CKD_CPDIVERSIFY_KDF      0x00000009UL
+
+
+/* CK_ECDH1_DERIVE_PARAMS provides the parameters to the
+ * CKM_ECDH1_DERIVE and CKM_ECDH1_COFACTOR_DERIVE mechanisms,
+ * where each party contributes one key pair.
+ */
+typedef struct CK_ECDH1_DERIVE_PARAMS {
+  CK_EC_KDF_TYPE kdf;
+  CK_ULONG ulSharedDataLen;
+  CK_BYTE_PTR pSharedData;
+  CK_ULONG ulPublicDataLen;
+  CK_BYTE_PTR pPublicData;
+} CK_ECDH1_DERIVE_PARAMS;
+
+typedef CK_ECDH1_DERIVE_PARAMS CK_PTR CK_ECDH1_DERIVE_PARAMS_PTR;
+
+/*
+ * CK_ECDH2_DERIVE_PARAMS provides the parameters to the
+ * CKM_ECMQV_DERIVE mechanism, where each party contributes two key pairs.
+ */
+typedef struct CK_ECDH2_DERIVE_PARAMS {
+  CK_EC_KDF_TYPE kdf;
+  CK_ULONG ulSharedDataLen;
+  CK_BYTE_PTR pSharedData;
+  CK_ULONG ulPublicDataLen;
+  CK_BYTE_PTR pPublicData;
+  CK_ULONG ulPrivateDataLen;
+  CK_OBJECT_HANDLE hPrivateData;
+  CK_ULONG ulPublicDataLen2;
+  CK_BYTE_PTR pPublicData2;
+} CK_ECDH2_DERIVE_PARAMS;
+
+typedef CK_ECDH2_DERIVE_PARAMS CK_PTR CK_ECDH2_DERIVE_PARAMS_PTR;
+
+typedef struct CK_ECMQV_DERIVE_PARAMS {
+  CK_EC_KDF_TYPE kdf;
+  CK_ULONG ulSharedDataLen;
+  CK_BYTE_PTR pSharedData;
+  CK_ULONG ulPublicDataLen;
+  CK_BYTE_PTR pPublicData;
+  CK_ULONG ulPrivateDataLen;
+  CK_OBJECT_HANDLE hPrivateData;
+  CK_ULONG ulPublicDataLen2;
+  CK_BYTE_PTR pPublicData2;
+  CK_OBJECT_HANDLE publicKey;
+} CK_ECMQV_DERIVE_PARAMS;
+
+typedef CK_ECMQV_DERIVE_PARAMS CK_PTR CK_ECMQV_DERIVE_PARAMS_PTR;
+
+/* Typedefs and defines for the CKM_X9_42_DH_KEY_PAIR_GEN and the
+ * CKM_X9_42_DH_PARAMETER_GEN mechanisms
+ */
+typedef CK_ULONG CK_X9_42_DH_KDF_TYPE;
+typedef CK_X9_42_DH_KDF_TYPE CK_PTR CK_X9_42_DH_KDF_TYPE_PTR;
+
+/* CK_X9_42_DH1_DERIVE_PARAMS provides the parameters to the
+ * CKM_X9_42_DH_DERIVE key derivation mechanism, where each party
+ * contributes one key pair
+ */
+typedef struct CK_X9_42_DH1_DERIVE_PARAMS {
+  CK_X9_42_DH_KDF_TYPE kdf;
+  CK_ULONG ulOtherInfoLen;
+  CK_BYTE_PTR pOtherInfo;
+  CK_ULONG ulPublicDataLen;
+  CK_BYTE_PTR pPublicData;
+} CK_X9_42_DH1_DERIVE_PARAMS;
+
+typedef struct CK_X9_42_DH1_DERIVE_PARAMS CK_PTR CK_X9_42_DH1_DERIVE_PARAMS_PTR;
+
+/* CK_X9_42_DH2_DERIVE_PARAMS provides the parameters to the
+ * CKM_X9_42_DH_HYBRID_DERIVE and CKM_X9_42_MQV_DERIVE key derivation
+ * mechanisms, where each party contributes two key pairs
+ */
+typedef struct CK_X9_42_DH2_DERIVE_PARAMS {
+  CK_X9_42_DH_KDF_TYPE kdf;
+  CK_ULONG ulOtherInfoLen;
+  CK_BYTE_PTR pOtherInfo;
+  CK_ULONG ulPublicDataLen;
+  CK_BYTE_PTR pPublicData;
+  CK_ULONG ulPrivateDataLen;
+  CK_OBJECT_HANDLE hPrivateData;
+  CK_ULONG ulPublicDataLen2;
+  CK_BYTE_PTR pPublicData2;
+} CK_X9_42_DH2_DERIVE_PARAMS;
+
+typedef CK_X9_42_DH2_DERIVE_PARAMS CK_PTR CK_X9_42_DH2_DERIVE_PARAMS_PTR;
+
+typedef struct CK_X9_42_MQV_DERIVE_PARAMS {
+  CK_X9_42_DH_KDF_TYPE kdf;
+  CK_ULONG ulOtherInfoLen;
+  CK_BYTE_PTR pOtherInfo;
+  CK_ULONG ulPublicDataLen;
+  CK_BYTE_PTR pPublicData;
+  CK_ULONG ulPrivateDataLen;
+  CK_OBJECT_HANDLE hPrivateData;
+  CK_ULONG ulPublicDataLen2;
+  CK_BYTE_PTR pPublicData2;
+  CK_OBJECT_HANDLE publicKey;
+} CK_X9_42_MQV_DERIVE_PARAMS;
+
+typedef CK_X9_42_MQV_DERIVE_PARAMS CK_PTR CK_X9_42_MQV_DERIVE_PARAMS_PTR;
+
+/* CK_KEA_DERIVE_PARAMS provides the parameters to the
+ * CKM_KEA_DERIVE mechanism
+ */
+typedef struct CK_KEA_DERIVE_PARAMS {
+  CK_BBOOL      isSender;
+  CK_ULONG      ulRandomLen;
+  CK_BYTE_PTR   pRandomA;
+  CK_BYTE_PTR   pRandomB;
+  CK_ULONG      ulPublicDataLen;
+  CK_BYTE_PTR   pPublicData;
+} CK_KEA_DERIVE_PARAMS;
+
+typedef CK_KEA_DERIVE_PARAMS CK_PTR CK_KEA_DERIVE_PARAMS_PTR;
+
+
+/* CK_RC2_PARAMS provides the parameters to the CKM_RC2_ECB and
+ * CKM_RC2_MAC mechanisms.  An instance of CK_RC2_PARAMS just
+ * holds the effective keysize
+ */
+typedef CK_ULONG          CK_RC2_PARAMS;
+
+typedef CK_RC2_PARAMS CK_PTR CK_RC2_PARAMS_PTR;
+
+
+/* CK_RC2_CBC_PARAMS provides the parameters to the CKM_RC2_CBC
+ * mechanism
+ */
+typedef struct CK_RC2_CBC_PARAMS {
+  CK_ULONG      ulEffectiveBits;  /* effective bits (1-1024) */
+  CK_BYTE       iv[8];            /* IV for CBC mode */
+} CK_RC2_CBC_PARAMS;
+
+typedef CK_RC2_CBC_PARAMS CK_PTR CK_RC2_CBC_PARAMS_PTR;
+
+
+/* CK_RC2_MAC_GENERAL_PARAMS provides the parameters for the
+ * CKM_RC2_MAC_GENERAL mechanism
+ */
+typedef struct CK_RC2_MAC_GENERAL_PARAMS {
+  CK_ULONG      ulEffectiveBits;  /* effective bits (1-1024) */
+  CK_ULONG      ulMacLength;      /* Length of MAC in bytes */
+} CK_RC2_MAC_GENERAL_PARAMS;
+
+typedef CK_RC2_MAC_GENERAL_PARAMS CK_PTR \
+  CK_RC2_MAC_GENERAL_PARAMS_PTR;
+
+
+/* CK_RC5_PARAMS provides the parameters to the CKM_RC5_ECB and
+ * CKM_RC5_MAC mechanisms
+ */
+typedef struct CK_RC5_PARAMS {
+  CK_ULONG      ulWordsize;  /* wordsize in bits */
+  CK_ULONG      ulRounds;    /* number of rounds */
+} CK_RC5_PARAMS;
+
+typedef CK_RC5_PARAMS CK_PTR CK_RC5_PARAMS_PTR;
+
+
+/* CK_RC5_CBC_PARAMS provides the parameters to the CKM_RC5_CBC
+ * mechanism
+ */
+typedef struct CK_RC5_CBC_PARAMS {
+  CK_ULONG      ulWordsize;  /* wordsize in bits */
+  CK_ULONG      ulRounds;    /* number of rounds */
+  CK_BYTE_PTR   pIv;         /* pointer to IV */
+  CK_ULONG      ulIvLen;     /* length of IV in bytes */
+} CK_RC5_CBC_PARAMS;
+
+typedef CK_RC5_CBC_PARAMS CK_PTR CK_RC5_CBC_PARAMS_PTR;
+
+
+/* CK_RC5_MAC_GENERAL_PARAMS provides the parameters for the
+ * CKM_RC5_MAC_GENERAL mechanism
+ */
+typedef struct CK_RC5_MAC_GENERAL_PARAMS {
+  CK_ULONG      ulWordsize;   /* wordsize in bits */
+  CK_ULONG      ulRounds;     /* number of rounds */
+  CK_ULONG      ulMacLength;  /* Length of MAC in bytes */
+} CK_RC5_MAC_GENERAL_PARAMS;
+
+typedef CK_RC5_MAC_GENERAL_PARAMS CK_PTR \
+  CK_RC5_MAC_GENERAL_PARAMS_PTR;
+
+/* CK_MAC_GENERAL_PARAMS provides the parameters to most block
+ * ciphers' MAC_GENERAL mechanisms.  Its value is the length of
+ * the MAC
+ */
+typedef CK_ULONG          CK_MAC_GENERAL_PARAMS;
+
+typedef CK_MAC_GENERAL_PARAMS CK_PTR CK_MAC_GENERAL_PARAMS_PTR;
+
+typedef struct CK_DES_CBC_ENCRYPT_DATA_PARAMS {
+  CK_BYTE      iv[8];
+  CK_BYTE_PTR  pData;
+  CK_ULONG     length;
+} CK_DES_CBC_ENCRYPT_DATA_PARAMS;
+
+typedef CK_DES_CBC_ENCRYPT_DATA_PARAMS CK_PTR CK_DES_CBC_ENCRYPT_DATA_PARAMS_PTR;
+
+typedef struct CK_AES_CBC_ENCRYPT_DATA_PARAMS {
+  CK_BYTE      iv[16];
+  CK_BYTE_PTR  pData;
+  CK_ULONG     length;
+} CK_AES_CBC_ENCRYPT_DATA_PARAMS;
+
+typedef CK_AES_CBC_ENCRYPT_DATA_PARAMS CK_PTR CK_AES_CBC_ENCRYPT_DATA_PARAMS_PTR;
+
+/* CK_SKIPJACK_PRIVATE_WRAP_PARAMS provides the parameters to the
+ * CKM_SKIPJACK_PRIVATE_WRAP mechanism
+ */
+typedef struct CK_SKIPJACK_PRIVATE_WRAP_PARAMS {
+  CK_ULONG      ulPasswordLen;
+  CK_BYTE_PTR   pPassword;
+  CK_ULONG      ulPublicDataLen;
+  CK_BYTE_PTR   pPublicData;
+  CK_ULONG      ulPAndGLen;
+  CK_ULONG      ulQLen;
+  CK_ULONG      ulRandomLen;
+  CK_BYTE_PTR   pRandomA;
+  CK_BYTE_PTR   pPrimeP;
+  CK_BYTE_PTR   pBaseG;
+  CK_BYTE_PTR   pSubprimeQ;
+} CK_SKIPJACK_PRIVATE_WRAP_PARAMS;
+
+typedef CK_SKIPJACK_PRIVATE_WRAP_PARAMS CK_PTR \
+  CK_SKIPJACK_PRIVATE_WRAP_PARAMS_PTR;
+
+
+/* CK_SKIPJACK_RELAYX_PARAMS provides the parameters to the
+ * CKM_SKIPJACK_RELAYX mechanism
+ */
+typedef struct CK_SKIPJACK_RELAYX_PARAMS {
+  CK_ULONG      ulOldWrappedXLen;
+  CK_BYTE_PTR   pOldWrappedX;
+  CK_ULONG      ulOldPasswordLen;
+  CK_BYTE_PTR   pOldPassword;
+  CK_ULONG      ulOldPublicDataLen;
+  CK_BYTE_PTR   pOldPublicData;
+  CK_ULONG      ulOldRandomLen;
+  CK_BYTE_PTR   pOldRandomA;
+  CK_ULONG      ulNewPasswordLen;
+  CK_BYTE_PTR   pNewPassword;
+  CK_ULONG      ulNewPublicDataLen;
+  CK_BYTE_PTR   pNewPublicData;
+  CK_ULONG      ulNewRandomLen;
+  CK_BYTE_PTR   pNewRandomA;
+} CK_SKIPJACK_RELAYX_PARAMS;
+
+typedef CK_SKIPJACK_RELAYX_PARAMS CK_PTR \
+  CK_SKIPJACK_RELAYX_PARAMS_PTR;
+
+
+typedef struct CK_PBE_PARAMS {
+  CK_BYTE_PTR      pInitVector;
+  CK_UTF8CHAR_PTR  pPassword;
+  CK_ULONG         ulPasswordLen;
+  CK_BYTE_PTR      pSalt;
+  CK_ULONG         ulSaltLen;
+  CK_ULONG         ulIteration;
+} CK_PBE_PARAMS;
+
+typedef CK_PBE_PARAMS CK_PTR CK_PBE_PARAMS_PTR;
+
+
+/* CK_KEY_WRAP_SET_OAEP_PARAMS provides the parameters to the
+ * CKM_KEY_WRAP_SET_OAEP mechanism
+ */
+typedef struct CK_KEY_WRAP_SET_OAEP_PARAMS {
+  CK_BYTE       bBC;     /* block contents byte */
+  CK_BYTE_PTR   pX;      /* extra data */
+  CK_ULONG      ulXLen;  /* length of extra data in bytes */
+} CK_KEY_WRAP_SET_OAEP_PARAMS;
+
+typedef CK_KEY_WRAP_SET_OAEP_PARAMS CK_PTR CK_KEY_WRAP_SET_OAEP_PARAMS_PTR;
+
+typedef struct CK_SSL3_RANDOM_DATA {
+  CK_BYTE_PTR  pClientRandom;
+  CK_ULONG     ulClientRandomLen;
+  CK_BYTE_PTR  pServerRandom;
+  CK_ULONG     ulServerRandomLen;
+} CK_SSL3_RANDOM_DATA;
+
+
+typedef struct CK_SSL3_MASTER_KEY_DERIVE_PARAMS {
+  CK_SSL3_RANDOM_DATA RandomInfo;
+  CK_VERSION_PTR pVersion;
+} CK_SSL3_MASTER_KEY_DERIVE_PARAMS;
+
+typedef struct CK_SSL3_MASTER_KEY_DERIVE_PARAMS CK_PTR \
+  CK_SSL3_MASTER_KEY_DERIVE_PARAMS_PTR;
+
+typedef struct CK_SSL3_KEY_MAT_OUT {
+  CK_OBJECT_HANDLE hClientMacSecret;
+  CK_OBJECT_HANDLE hServerMacSecret;
+  CK_OBJECT_HANDLE hClientKey;
+  CK_OBJECT_HANDLE hServerKey;
+  CK_BYTE_PTR      pIVClient;
+  CK_BYTE_PTR      pIVServer;
+} CK_SSL3_KEY_MAT_OUT;
+
+typedef CK_SSL3_KEY_MAT_OUT CK_PTR CK_SSL3_KEY_MAT_OUT_PTR;
+
+
+typedef struct CK_SSL3_KEY_MAT_PARAMS {
+  CK_ULONG                ulMacSizeInBits;
+  CK_ULONG                ulKeySizeInBits;
+  CK_ULONG                ulIVSizeInBits;
+  CK_BBOOL                bIsExport;
+  CK_SSL3_RANDOM_DATA     RandomInfo;
+  CK_SSL3_KEY_MAT_OUT_PTR pReturnedKeyMaterial;
+} CK_SSL3_KEY_MAT_PARAMS;
+
+typedef CK_SSL3_KEY_MAT_PARAMS CK_PTR CK_SSL3_KEY_MAT_PARAMS_PTR;
+
+typedef struct CK_TLS_PRF_PARAMS {
+  CK_BYTE_PTR  pSeed;
+  CK_ULONG     ulSeedLen;
+  CK_BYTE_PTR  pLabel;
+  CK_ULONG     ulLabelLen;
+  CK_BYTE_PTR  pOutput;
+  CK_ULONG_PTR pulOutputLen;
+} CK_TLS_PRF_PARAMS;
+
+typedef CK_TLS_PRF_PARAMS CK_PTR CK_TLS_PRF_PARAMS_PTR;
+
+typedef struct CK_WTLS_RANDOM_DATA {
+  CK_BYTE_PTR pClientRandom;
+  CK_ULONG    ulClientRandomLen;
+  CK_BYTE_PTR pServerRandom;
+  CK_ULONG    ulServerRandomLen;
+} CK_WTLS_RANDOM_DATA;
+
+typedef CK_WTLS_RANDOM_DATA CK_PTR CK_WTLS_RANDOM_DATA_PTR;
+
+typedef struct CK_WTLS_MASTER_KEY_DERIVE_PARAMS {
+  CK_MECHANISM_TYPE   DigestMechanism;
+  CK_WTLS_RANDOM_DATA RandomInfo;
+  CK_BYTE_PTR         pVersion;
+} CK_WTLS_MASTER_KEY_DERIVE_PARAMS;
+
+typedef CK_WTLS_MASTER_KEY_DERIVE_PARAMS CK_PTR \
+  CK_WTLS_MASTER_KEY_DERIVE_PARAMS_PTR;
+
+typedef struct CK_WTLS_PRF_PARAMS {
+  CK_MECHANISM_TYPE DigestMechanism;
+  CK_BYTE_PTR       pSeed;
+  CK_ULONG          ulSeedLen;
+  CK_BYTE_PTR       pLabel;
+  CK_ULONG          ulLabelLen;
+  CK_BYTE_PTR       pOutput;
+  CK_ULONG_PTR      pulOutputLen;
+} CK_WTLS_PRF_PARAMS;
+
+typedef CK_WTLS_PRF_PARAMS CK_PTR CK_WTLS_PRF_PARAMS_PTR;
+
+typedef struct CK_WTLS_KEY_MAT_OUT {
+  CK_OBJECT_HANDLE hMacSecret;
+  CK_OBJECT_HANDLE hKey;
+  CK_BYTE_PTR      pIV;
+} CK_WTLS_KEY_MAT_OUT;
+
+typedef CK_WTLS_KEY_MAT_OUT CK_PTR CK_WTLS_KEY_MAT_OUT_PTR;
+
+typedef struct CK_WTLS_KEY_MAT_PARAMS {
+  CK_MECHANISM_TYPE       DigestMechanism;
+  CK_ULONG                ulMacSizeInBits;
+  CK_ULONG                ulKeySizeInBits;
+  CK_ULONG                ulIVSizeInBits;
+  CK_ULONG                ulSequenceNumber;
+  CK_BBOOL                bIsExport;
+  CK_WTLS_RANDOM_DATA     RandomInfo;
+  CK_WTLS_KEY_MAT_OUT_PTR pReturnedKeyMaterial;
+} CK_WTLS_KEY_MAT_PARAMS;
+
+typedef CK_WTLS_KEY_MAT_PARAMS CK_PTR CK_WTLS_KEY_MAT_PARAMS_PTR;
+
+typedef struct CK_CMS_SIG_PARAMS {
+  CK_OBJECT_HANDLE      certificateHandle;
+  CK_MECHANISM_PTR      pSigningMechanism;
+  CK_MECHANISM_PTR      pDigestMechanism;
+  CK_UTF8CHAR_PTR       pContentType;
+  CK_BYTE_PTR           pRequestedAttributes;
+  CK_ULONG              ulRequestedAttributesLen;
+  CK_BYTE_PTR           pRequiredAttributes;
+  CK_ULONG              ulRequiredAttributesLen;
+} CK_CMS_SIG_PARAMS;
+
+typedef CK_CMS_SIG_PARAMS CK_PTR CK_CMS_SIG_PARAMS_PTR;
+
+typedef struct CK_KEY_DERIVATION_STRING_DATA {
+  CK_BYTE_PTR pData;
+  CK_ULONG    ulLen;
+} CK_KEY_DERIVATION_STRING_DATA;
+
+typedef CK_KEY_DERIVATION_STRING_DATA CK_PTR \
+  CK_KEY_DERIVATION_STRING_DATA_PTR;
+
+
+/* The CK_EXTRACT_PARAMS is used for the
+ * CKM_EXTRACT_KEY_FROM_KEY mechanism.  It specifies which bit
+ * of the base key should be used as the first bit of the
+ * derived key
+ */
+typedef CK_ULONG CK_EXTRACT_PARAMS;
+
+typedef CK_EXTRACT_PARAMS CK_PTR CK_EXTRACT_PARAMS_PTR;
+
+/* CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE is used to
+ * indicate the Pseudo-Random Function (PRF) used to generate
+ * key bits using PKCS #5 PBKDF2.
+ */
+typedef CK_ULONG CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE;
+
+typedef CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE CK_PTR \
+                        CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE_PTR;
+
+#define CKP_PKCS5_PBKD2_HMAC_SHA1          0x00000001UL
+#define CKP_PKCS5_PBKD2_HMAC_GOSTR3411     0x00000002UL
+#define CKP_PKCS5_PBKD2_HMAC_SHA224        0x00000003UL
+#define CKP_PKCS5_PBKD2_HMAC_SHA256        0x00000004UL
+#define CKP_PKCS5_PBKD2_HMAC_SHA384        0x00000005UL
+#define CKP_PKCS5_PBKD2_HMAC_SHA512        0x00000006UL
+#define CKP_PKCS5_PBKD2_HMAC_SHA512_224    0x00000007UL
+#define CKP_PKCS5_PBKD2_HMAC_SHA512_256    0x00000008UL
+
+/* CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE is used to indicate the
+ * source of the salt value when deriving a key using PKCS #5
+ * PBKDF2.
+ */
+typedef CK_ULONG CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE;
+
+typedef CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE CK_PTR \
+                        CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE_PTR;
+
+/* The following salt value sources are defined in PKCS #5 v2.0. */
+#define CKZ_SALT_SPECIFIED        0x00000001UL
+
+/* CK_PKCS5_PBKD2_PARAMS is a structure that provides the
+ * parameters to the CKM_PKCS5_PBKD2 mechanism.
+ */
+typedef struct CK_PKCS5_PBKD2_PARAMS {
+        CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE           saltSource;
+        CK_VOID_PTR                                pSaltSourceData;
+        CK_ULONG                                   ulSaltSourceDataLen;
+        CK_ULONG                                   iterations;
+        CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE prf;
+        CK_VOID_PTR                                pPrfData;
+        CK_ULONG                                   ulPrfDataLen;
+        CK_UTF8CHAR_PTR                            pPassword;
+        CK_ULONG_PTR                               ulPasswordLen;
+} CK_PKCS5_PBKD2_PARAMS;
+
+typedef CK_PKCS5_PBKD2_PARAMS CK_PTR CK_PKCS5_PBKD2_PARAMS_PTR;
+
+/* CK_PKCS5_PBKD2_PARAMS2 is a corrected version of the CK_PKCS5_PBKD2_PARAMS
+ * structure that provides the parameters to the CKM_PKCS5_PBKD2 mechanism
+ * noting that the ulPasswordLen field is a CK_ULONG and not a CK_ULONG_PTR.
+ */
+typedef struct CK_PKCS5_PBKD2_PARAMS2 {
+        CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE saltSource;
+        CK_VOID_PTR pSaltSourceData;
+        CK_ULONG ulSaltSourceDataLen;
+        CK_ULONG iterations;
+        CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE prf;
+        CK_VOID_PTR pPrfData;
+        CK_ULONG ulPrfDataLen;
+        CK_UTF8CHAR_PTR pPassword;
+        CK_ULONG ulPasswordLen;
+} CK_PKCS5_PBKD2_PARAMS2;
+
+typedef CK_PKCS5_PBKD2_PARAMS2 CK_PTR CK_PKCS5_PBKD2_PARAMS2_PTR;
+
+typedef CK_ULONG CK_OTP_PARAM_TYPE;
+typedef CK_OTP_PARAM_TYPE CK_PARAM_TYPE; /* backward compatibility */
+
+typedef struct CK_OTP_PARAM {
+    CK_OTP_PARAM_TYPE type;
+    CK_VOID_PTR pValue;
+    CK_ULONG ulValueLen;
+} CK_OTP_PARAM;
+
+typedef CK_OTP_PARAM CK_PTR CK_OTP_PARAM_PTR;
+
+typedef struct CK_OTP_PARAMS {
+    CK_OTP_PARAM_PTR pParams;
+    CK_ULONG ulCount;
+} CK_OTP_PARAMS;
+
+typedef CK_OTP_PARAMS CK_PTR CK_OTP_PARAMS_PTR;
+
+typedef struct CK_OTP_SIGNATURE_INFO {
+    CK_OTP_PARAM_PTR pParams;
+    CK_ULONG ulCount;
+} CK_OTP_SIGNATURE_INFO;
+
+typedef CK_OTP_SIGNATURE_INFO CK_PTR CK_OTP_SIGNATURE_INFO_PTR;
+
+#define CK_OTP_VALUE          0UL
+#define CK_OTP_PIN            1UL
+#define CK_OTP_CHALLENGE      2UL
+#define CK_OTP_TIME           3UL
+#define CK_OTP_COUNTER        4UL
+#define CK_OTP_FLAGS          5UL
+#define CK_OTP_OUTPUT_LENGTH  6UL
+#define CK_OTP_OUTPUT_FORMAT  7UL
+
+#define CKF_NEXT_OTP          0x00000001UL
+#define CKF_EXCLUDE_TIME      0x00000002UL
+#define CKF_EXCLUDE_COUNTER   0x00000004UL
+#define CKF_EXCLUDE_CHALLENGE 0x00000008UL
+#define CKF_EXCLUDE_PIN       0x00000010UL
+#define CKF_USER_FRIENDLY_OTP 0x00000020UL
+
+typedef struct CK_KIP_PARAMS {
+    CK_MECHANISM_PTR  pMechanism;
+    CK_OBJECT_HANDLE  hKey;
+    CK_BYTE_PTR       pSeed;
+    CK_ULONG          ulSeedLen;
+} CK_KIP_PARAMS;
+
+typedef CK_KIP_PARAMS CK_PTR CK_KIP_PARAMS_PTR;
+
+typedef struct CK_AES_CTR_PARAMS {
+    CK_ULONG ulCounterBits;
+    CK_BYTE cb[16];
+} CK_AES_CTR_PARAMS;
+
+typedef CK_AES_CTR_PARAMS CK_PTR CK_AES_CTR_PARAMS_PTR;
+
+typedef struct CK_GCM_PARAMS {
+    CK_BYTE_PTR       pIv;
+    CK_ULONG          ulIvLen;
+    CK_ULONG          ulIvBits;
+    CK_BYTE_PTR       pAAD;
+    CK_ULONG          ulAADLen;
+    CK_ULONG          ulTagBits;
+} CK_GCM_PARAMS;
+
+typedef CK_GCM_PARAMS CK_PTR CK_GCM_PARAMS_PTR;
+
+typedef struct CK_CCM_PARAMS {
+    CK_ULONG          ulDataLen;
+    CK_BYTE_PTR       pNonce;
+    CK_ULONG          ulNonceLen;
+    CK_BYTE_PTR       pAAD;
+    CK_ULONG          ulAADLen;
+    CK_ULONG          ulMACLen;
+} CK_CCM_PARAMS;
+
+typedef CK_CCM_PARAMS CK_PTR CK_CCM_PARAMS_PTR;
+
+/* Deprecated. Use CK_GCM_PARAMS */
+typedef struct CK_AES_GCM_PARAMS {
+  CK_BYTE_PTR pIv;
+  CK_ULONG ulIvLen;
+  CK_ULONG ulIvBits;
+  CK_BYTE_PTR pAAD;
+  CK_ULONG ulAADLen;
+  CK_ULONG ulTagBits;
+} CK_AES_GCM_PARAMS;
+
+typedef CK_AES_GCM_PARAMS CK_PTR CK_AES_GCM_PARAMS_PTR;
+
+/* Deprecated. Use CK_CCM_PARAMS */
+typedef struct CK_AES_CCM_PARAMS {
+    CK_ULONG          ulDataLen;
+    CK_BYTE_PTR       pNonce;
+    CK_ULONG          ulNonceLen;
+    CK_BYTE_PTR       pAAD;
+    CK_ULONG          ulAADLen;
+    CK_ULONG          ulMACLen;
+} CK_AES_CCM_PARAMS;
+
+typedef CK_AES_CCM_PARAMS CK_PTR CK_AES_CCM_PARAMS_PTR;
+
+typedef struct CK_CAMELLIA_CTR_PARAMS {
+    CK_ULONG          ulCounterBits;
+    CK_BYTE           cb[16];
+} CK_CAMELLIA_CTR_PARAMS;
+
+typedef CK_CAMELLIA_CTR_PARAMS CK_PTR CK_CAMELLIA_CTR_PARAMS_PTR;
+
+typedef struct CK_CAMELLIA_CBC_ENCRYPT_DATA_PARAMS {
+    CK_BYTE           iv[16];
+    CK_BYTE_PTR       pData;
+    CK_ULONG          length;
+} CK_CAMELLIA_CBC_ENCRYPT_DATA_PARAMS;
+
+typedef CK_CAMELLIA_CBC_ENCRYPT_DATA_PARAMS CK_PTR \
+                                CK_CAMELLIA_CBC_ENCRYPT_DATA_PARAMS_PTR;
+
+typedef struct CK_ARIA_CBC_ENCRYPT_DATA_PARAMS {
+    CK_BYTE           iv[16];
+    CK_BYTE_PTR       pData;
+    CK_ULONG          length;
+} CK_ARIA_CBC_ENCRYPT_DATA_PARAMS;
+
+typedef CK_ARIA_CBC_ENCRYPT_DATA_PARAMS CK_PTR \
+                                CK_ARIA_CBC_ENCRYPT_DATA_PARAMS_PTR;
+
+typedef struct CK_DSA_PARAMETER_GEN_PARAM {
+    CK_MECHANISM_TYPE  hash;
+    CK_BYTE_PTR        pSeed;
+    CK_ULONG           ulSeedLen;
+    CK_ULONG           ulIndex;
+} CK_DSA_PARAMETER_GEN_PARAM;
+
+typedef CK_DSA_PARAMETER_GEN_PARAM CK_PTR CK_DSA_PARAMETER_GEN_PARAM_PTR;
+
+typedef struct CK_ECDH_AES_KEY_WRAP_PARAMS {
+    CK_ULONG           ulAESKeyBits;
+    CK_EC_KDF_TYPE     kdf;
+    CK_ULONG           ulSharedDataLen;
+    CK_BYTE_PTR        pSharedData;
+} CK_ECDH_AES_KEY_WRAP_PARAMS;
+
+typedef CK_ECDH_AES_KEY_WRAP_PARAMS CK_PTR CK_ECDH_AES_KEY_WRAP_PARAMS_PTR;
+
+typedef CK_ULONG CK_JAVA_MIDP_SECURITY_DOMAIN;
+
+typedef CK_ULONG CK_CERTIFICATE_CATEGORY;
+
+typedef struct CK_RSA_AES_KEY_WRAP_PARAMS {
+    CK_ULONG                      ulAESKeyBits;
+    CK_RSA_PKCS_OAEP_PARAMS_PTR   pOAEPParams;
+} CK_RSA_AES_KEY_WRAP_PARAMS;
+
+typedef CK_RSA_AES_KEY_WRAP_PARAMS CK_PTR CK_RSA_AES_KEY_WRAP_PARAMS_PTR;
+
+typedef struct CK_TLS12_MASTER_KEY_DERIVE_PARAMS {
+    CK_SSL3_RANDOM_DATA       RandomInfo;
+    CK_VERSION_PTR            pVersion;
+    CK_MECHANISM_TYPE         prfHashMechanism;
+} CK_TLS12_MASTER_KEY_DERIVE_PARAMS;
+
+typedef CK_TLS12_MASTER_KEY_DERIVE_PARAMS CK_PTR \
+                                CK_TLS12_MASTER_KEY_DERIVE_PARAMS_PTR;
+
+typedef struct CK_TLS12_KEY_MAT_PARAMS {
+    CK_ULONG                  ulMacSizeInBits;
+    CK_ULONG                  ulKeySizeInBits;
+    CK_ULONG                  ulIVSizeInBits;
+    CK_BBOOL                  bIsExport;
+    CK_SSL3_RANDOM_DATA       RandomInfo;
+    CK_SSL3_KEY_MAT_OUT_PTR   pReturnedKeyMaterial;
+    CK_MECHANISM_TYPE         prfHashMechanism;
+} CK_TLS12_KEY_MAT_PARAMS;
+
+typedef CK_TLS12_KEY_MAT_PARAMS CK_PTR CK_TLS12_KEY_MAT_PARAMS_PTR;
+
+typedef struct CK_TLS_KDF_PARAMS {
+    CK_MECHANISM_TYPE         prfMechanism;
+    CK_BYTE_PTR               pLabel;
+    CK_ULONG                  ulLabelLength;
+    CK_SSL3_RANDOM_DATA       RandomInfo;
+    CK_BYTE_PTR               pContextData;
+    CK_ULONG                  ulContextDataLength;
+} CK_TLS_KDF_PARAMS;
+
+typedef CK_TLS_KDF_PARAMS CK_PTR CK_TLS_KDF_PARAMS_PTR;
+
+typedef struct CK_TLS_MAC_PARAMS {
+    CK_MECHANISM_TYPE         prfHashMechanism;
+    CK_ULONG                  ulMacLength;
+    CK_ULONG                  ulServerOrClient;
+} CK_TLS_MAC_PARAMS;
+
+typedef CK_TLS_MAC_PARAMS CK_PTR CK_TLS_MAC_PARAMS_PTR;
+
+typedef struct CK_GOSTR3410_DERIVE_PARAMS {
+    CK_EC_KDF_TYPE            kdf;
+    CK_BYTE_PTR               pPublicData;
+    CK_ULONG                  ulPublicDataLen;
+    CK_BYTE_PTR               pUKM;
+    CK_ULONG                  ulUKMLen;
+} CK_GOSTR3410_DERIVE_PARAMS;
+
+typedef CK_GOSTR3410_DERIVE_PARAMS CK_PTR CK_GOSTR3410_DERIVE_PARAMS_PTR;
+
+typedef struct CK_GOSTR3410_KEY_WRAP_PARAMS {
+    CK_BYTE_PTR               pWrapOID;
+    CK_ULONG                  ulWrapOIDLen;
+    CK_BYTE_PTR               pUKM;
+    CK_ULONG                  ulUKMLen;
+    CK_OBJECT_HANDLE          hKey;
+} CK_GOSTR3410_KEY_WRAP_PARAMS;
+
+typedef CK_GOSTR3410_KEY_WRAP_PARAMS CK_PTR CK_GOSTR3410_KEY_WRAP_PARAMS_PTR;
+
+typedef struct CK_SEED_CBC_ENCRYPT_DATA_PARAMS {
+    CK_BYTE                   iv[16];
+    CK_BYTE_PTR               pData;
+    CK_ULONG                  length;
+} CK_SEED_CBC_ENCRYPT_DATA_PARAMS;
+
+typedef CK_SEED_CBC_ENCRYPT_DATA_PARAMS CK_PTR \
+                                        CK_SEED_CBC_ENCRYPT_DATA_PARAMS_PTR;
+
+#endif /* _PKCS11T_H_ */
+
diff --git a/PROJECTS/advanced/hsm-emulator/vendor/pkcs11/shim.h b/PROJECTS/advanced/hsm-emulator/vendor/pkcs11/shim.h
new file mode 100644
index 00000000..430af8b9
--- /dev/null
+++ b/PROJECTS/advanced/hsm-emulator/vendor/pkcs11/shim.h
@@ -0,0 +1,18 @@
+// ©AngelaMos | 2026
+// shim.h
+
+#ifndef ANGELAMOS_PKCS11_SHIM_H
+#define ANGELAMOS_PKCS11_SHIM_H
+
+#define CK_PTR *
+#define CK_DECLARE_FUNCTION(returnType, name) returnType name
+#define CK_DECLARE_FUNCTION_POINTER(returnType, name) returnType (*name)
+#define CK_CALLBACK_FUNCTION(returnType, name) returnType (*name)
+
+#ifndef NULL_PTR
+#define NULL_PTR 0
+#endif
+
+#include "pkcs11.h"
+
+#endif
diff --git a/PROJECTS/advanced/monitor-the-situation-dashboard/README.md b/PROJECTS/advanced/monitor-the-situation-dashboard/README.md
index f1585d53..c4b26713 100644
--- a/PROJECTS/advanced/monitor-the-situation-dashboard/README.md
+++ b/PROJECTS/advanced/monitor-the-situation-dashboard/README.md
@@ -21,7 +21,19 @@ README.md
 
 > Operator-grade real-time situational awareness dashboard. Eleven live feeds across cyber, world, and finance — fused into a single 3D-globe SOC view with WebSocket delivery and configurable alerting.
 
-*This is a quick overview — security theory, architecture, and full walkthroughs are in the [learn modules](#learn).*
+<p align="center">
+  <a href="https://youtu.be/4Iv5jKbXbH4">
+    <img src="https://img.shields.io/badge/Watch_on-YouTube-FF0000?logo=youtube&logoColor=white" alt="Watch on YouTube">
+  </a>
+</p>
+
+<p align="center">
+  <a href="https://youtu.be/4Iv5jKbXbH4">
+    <img src="https://img.youtube.com/vi/4Iv5jKbXbH4/maxresdefault.jpg" alt="Video Thumbnail" width="800">
+  </a>
+</p>
+
+*The Learn docs are here: [learn modules](#learn).*
 
 > The phrase "monitoring the situation" is a Twitter/X meme from June 2025. This is the version that actually monitors the situation.
 
diff --git a/PROJECTS/advanced/monitor-the-situation-dashboard/frontend/package.json b/PROJECTS/advanced/monitor-the-situation-dashboard/frontend/package.json
index deff3456..572bf9db 100644
--- a/PROJECTS/advanced/monitor-the-situation-dashboard/frontend/package.json
+++ b/PROJECTS/advanced/monitor-the-situation-dashboard/frontend/package.json
@@ -21,7 +21,7 @@
     "@fontsource/geist-mono": "^5.2.7",
     "@fontsource/inter": "^5.2.8",
     "@tanstack/react-query": "^5.90.12",
-    "axios": "^1.15.2",
+    "axios": "^1.16.0",
     "d3-array": "^3.2.4",
     "d3-scale": "^4.0.2",
     "react": "^19.2.1",
diff --git a/PROJECTS/advanced/monitor-the-situation-dashboard/frontend/pnpm-lock.yaml b/PROJECTS/advanced/monitor-the-situation-dashboard/frontend/pnpm-lock.yaml
index c2acbd0f..b41f35a5 100644
--- a/PROJECTS/advanced/monitor-the-situation-dashboard/frontend/pnpm-lock.yaml
+++ b/PROJECTS/advanced/monitor-the-situation-dashboard/frontend/pnpm-lock.yaml
@@ -24,8 +24,8 @@ importers:
         specifier: ^5.90.12
         version: 5.90.12(react@19.2.1)
       axios:
-        specifier: ^1.15.2
-        version: 1.15.2
+        specifier: ^1.16.0
+        version: 1.16.0
       d3-array:
         specifier: ^3.2.4
         version: 3.2.4
@@ -232,24 +232,28 @@ packages:
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@biomejs/cli-linux-arm64@2.3.8':
     resolution: {integrity: sha512-Uo1OJnIkJgSgF+USx970fsM/drtPcQ39I+JO+Fjsaa9ZdCN1oysQmy6oAGbyESlouz+rzEckLTF6DS7cWse95g==}
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@biomejs/cli-linux-x64-musl@2.3.8':
     resolution: {integrity: sha512-YGLkqU91r1276uwSjiUD/xaVikdxgV1QpsicT0bIA1TaieM6E5ibMZeSyjQ/izBn4tKQthUSsVZacmoJfa3pDA==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@biomejs/cli-linux-x64@2.3.8':
     resolution: {integrity: sha512-QDPMD5bQz6qOVb3kiBui0zKZXASLo0NIQ9JVJio5RveBEFgDgsvJFUvZIbMbUZT3T00M/1wdzwWXk4GIh0KaAw==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@biomejs/cli-win32-arm64@2.3.8':
     resolution: {integrity: sha512-H4IoCHvL1fXKDrTALeTKMiE7GGWFAraDwBYFquE/L/5r1927Te0mYIGseXi4F+lrrwhSWbSGt5qPFswNoBaCxg==}
@@ -393,36 +397,42 @@ packages:
     engines: {node: '>= 10.0.0'}
     cpu: [arm]
     os: [linux]
+    libc: [glibc]
 
   '@parcel/watcher-linux-arm-musl@2.5.1':
     resolution: {integrity: sha512-6E+m/Mm1t1yhB8X412stiKFG3XykmgdIOqhjWj+VL8oHkKABfu/gjFj8DvLrYVHSBNC+/u5PeNrujiSQ1zwd1Q==}
     engines: {node: '>= 10.0.0'}
     cpu: [arm]
     os: [linux]
+    libc: [musl]
 
   '@parcel/watcher-linux-arm64-glibc@2.5.1':
     resolution: {integrity: sha512-LrGp+f02yU3BN9A+DGuY3v3bmnFUggAITBGriZHUREfNEzZh/GO06FF5u2kx8x+GBEUYfyTGamol4j3m9ANe8w==}
     engines: {node: '>= 10.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@parcel/watcher-linux-arm64-musl@2.5.1':
     resolution: {integrity: sha512-cFOjABi92pMYRXS7AcQv9/M1YuKRw8SZniCDw0ssQb/noPkRzA+HBDkwmyOJYp5wXcsTrhxO0zq1U11cK9jsFg==}
     engines: {node: '>= 10.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@parcel/watcher-linux-x64-glibc@2.5.1':
     resolution: {integrity: sha512-GcESn8NZySmfwlTsIur+49yDqSny2IhPeZfXunQi48DMugKeZ7uy1FX83pO0X22sHntJ4Ub+9k34XQCX+oHt2A==}
     engines: {node: '>= 10.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@parcel/watcher-linux-x64-musl@2.5.1':
     resolution: {integrity: sha512-n0E2EQbatQ3bXhcH2D1XIAANAcTZkQICBPVaxMeaCVBtOpBZpWJuf7LwyWPSBDITb7In8mqQgJ7gH8CILCURXg==}
     engines: {node: '>= 10.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@parcel/watcher-win32-arm64@2.5.1':
     resolution: {integrity: sha512-RFzklRvmc3PkjKjry3hLF9wD7ppR4AKcWNzH7kXR7GUe0Igb3Nz8fyPwtZCSquGrhU5HhUNDr/mKBqj7tqA2Vw==}
@@ -484,24 +494,28 @@ packages:
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@rolldown/binding-linux-arm64-musl@1.0.0-beta.50':
     resolution: {integrity: sha512-L0zRdH2oDPkmB+wvuTl+dJbXCsx62SkqcEqdM+79LOcB+PxbAxxjzHU14BuZIQdXcAVDzfpMfaHWzZuwhhBTcw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@rolldown/binding-linux-x64-gnu@1.0.0-beta.50':
     resolution: {integrity: sha512-gyoI8o/TGpQd3OzkJnh1M2kxy1Bisg8qJ5Gci0sXm9yLFzEXIFdtc4EAzepxGvrT2ri99ar5rdsmNG0zP0SbIg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@rolldown/binding-linux-x64-musl@1.0.0-beta.50':
     resolution: {integrity: sha512-zti8A7M+xFDpKlghpcCAzyOi+e5nfUl3QhU023ce5NCgUxRG5zGP2GR9LTydQ1rnIPwZUVBWd4o7NjZDaQxaXA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@rolldown/binding-openharmony-arm64@1.0.0-beta.50':
     resolution: {integrity: sha512-eZUssog7qljrrRU9Mi0eqYEPm3Ch0UwB+qlWPMKSUXHNqhm3TvDZarJQdTevGEfu3EHAXJvBIe0YFYr0TPVaMA==}
@@ -696,8 +710,8 @@ packages:
   asynckit@0.4.0:
     resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
 
-  axios@1.15.2:
-    resolution: {integrity: sha512-wLrXxPtcrPTsNlJmKjkPnNPK2Ihe0hn0wGSaTEiHRPxwjvJwT3hKmXF4dpqxmPO9SoNb2FsYXj/xEo0gHN+D5A==}
+  axios@1.16.0:
+    resolution: {integrity: sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==}
 
   babel-runtime@5.8.38:
     resolution: {integrity: sha512-KpgoA8VE/pMmNCrnEeeXqFG24TIH11Z3ZaimIhJWsin8EbfZy3WzFKUTIan10ZIDgRVvi9EkLbruJElJC9dRlg==}
@@ -913,8 +927,8 @@ packages:
   es-module-lexer@2.1.0:
     resolution: {integrity: sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==}
 
-  es-object-atoms@1.1.1:
-    resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
+  es-object-atoms@1.1.2:
+    resolution: {integrity: sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==}
     engines: {node: '>= 0.4'}
 
   es-set-tostringtag@2.1.0:
@@ -1071,8 +1085,8 @@ packages:
     resolution: {integrity: sha512-fWltioiy5zsSAs9ouEnvhsVJeAXRybGCNNv0lvzpzNOSDbULXRy7ivFWwCCv4I5Am6kSo75hmbsCduOoc2/K4w==}
     engines: {node: '>=20'}
 
-  hasown@2.0.3:
-    resolution: {integrity: sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==}
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
     engines: {node: '>= 0.4'}
 
   hookified@1.14.0:
@@ -1214,24 +1228,28 @@ packages:
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   lightningcss-linux-arm64-musl@1.30.2:
     resolution: {integrity: sha512-5Vh9dGeblpTxWHpOx8iauV02popZDsCYMPIgiuw97OJ5uaDsL86cnqSFs5LZkG3ghHoX5isLgWzMs+eD1YzrnA==}
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   lightningcss-linux-x64-gnu@1.30.2:
     resolution: {integrity: sha512-Cfd46gdmj1vQ+lR6VRTTadNHu6ALuw2pKR9lYq4FnhvgBc4zWY1EtZcAc6EffShbb1MFrIPfLDXD6Xprbnni4w==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   lightningcss-linux-x64-musl@1.30.2:
     resolution: {integrity: sha512-XJaLUUFXb6/QG2lGIW6aIk6jKdtjtcffUT0NKvIqhSBY3hh9Ch+1LCeH80dR9q9LBjG3ewbDjnumefsLsP6aiA==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   lightningcss-win32-arm64-msvc@1.30.2:
     resolution: {integrity: sha512-FZn+vaj7zLv//D/192WFFVA0RgHawIcHqLX9xuWiQt7P0PtdFEVaxgF9rjM/IRYHQXNnk61/H/gb2Ei+kUQ4xQ==}
@@ -2414,7 +2432,7 @@ snapshots:
 
   asynckit@0.4.0: {}
 
-  axios@1.15.2:
+  axios@1.16.0:
     dependencies:
       follow-redirects: 1.16.0
       form-data: 4.0.5
@@ -2609,7 +2627,7 @@ snapshots:
 
   es-module-lexer@2.1.0: {}
 
-  es-object-atoms@1.1.1:
+  es-object-atoms@1.1.2:
     dependencies:
       es-errors: 1.3.0
 
@@ -2618,7 +2636,7 @@ snapshots:
       es-errors: 1.3.0
       get-intrinsic: 1.3.0
       has-tostringtag: 1.0.2
-      hasown: 2.0.3
+      hasown: 2.0.4
 
   escalade@3.2.0: {}
 
@@ -2683,7 +2701,7 @@ snapshots:
       asynckit: 0.4.0
       combined-stream: 1.0.8
       es-set-tostringtag: 2.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       mime-types: 2.1.35
 
   frame-ticker@1.0.3:
@@ -2702,18 +2720,18 @@ snapshots:
       call-bind-apply-helpers: 1.0.2
       es-define-property: 1.0.1
       es-errors: 1.3.0
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
       function-bind: 1.1.2
       get-proto: 1.0.1
       gopd: 1.2.0
       has-symbols: 1.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       math-intrinsics: 1.1.0
 
   get-proto@1.0.1:
     dependencies:
       dunder-proto: 1.0.1
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
 
   glob-parent@5.1.2:
     dependencies:
@@ -2779,7 +2797,7 @@ snapshots:
     dependencies:
       hookified: 1.14.0
 
-  hasown@2.0.3:
+  hasown@2.0.4:
     dependencies:
       function-bind: 1.1.2
 
diff --git a/PROJECTS/advanced/monitor-the-situation-dashboard/frontend/src/pages/settings/index.tsx b/PROJECTS/advanced/monitor-the-situation-dashboard/frontend/src/pages/settings/index.tsx
index 63b67c22..053324ac 100644
--- a/PROJECTS/advanced/monitor-the-situation-dashboard/frontend/src/pages/settings/index.tsx
+++ b/PROJECTS/advanced/monitor-the-situation-dashboard/frontend/src/pages/settings/index.tsx
@@ -9,8 +9,8 @@ import {
   type AlertRule,
   useAlertRules,
   useChangePassword,
-  useLogout,
   useDeleteAlertRule,
+  useLogout,
   useUpdateAlertRule,
   useUpdateEmail,
   useUpdateProfile,
diff --git a/PROJECTS/beginner/c2-beacon/backend/uv.lock b/PROJECTS/beginner/c2-beacon/backend/uv.lock
index e20dcece..84c3cdee 100644
--- a/PROJECTS/beginner/c2-beacon/backend/uv.lock
+++ b/PROJECTS/beginner/c2-beacon/backend/uv.lock
@@ -245,7 +245,7 @@ wheels = [
 
 [[package]]
 name = "fastapi"
-version = "0.129.0"
+version = "0.136.3"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "annotated-doc" },
@@ -254,15 +254,16 @@ dependencies = [
     { name = "typing-extensions" },
     { name = "typing-inspection" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/48/47/75f6bea02e797abff1bca968d5997793898032d9923c1935ae2efdece642/fastapi-0.129.0.tar.gz", hash = "sha256:61315cebd2e65df5f97ec298c888f9de30430dd0612d59d6480beafbc10655af", size = 375450, upload-time = "2026-02-12T13:54:52.541Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/81/2d/ff8d91d7b564d464629a0fd50a4489c97fcb836ac230bf3a7269232a9b1f/fastapi-0.136.3.tar.gz", hash = "sha256:e487fae93ad408e6f47641ee4dfe389864fd7bec92e547ea8498fc13f43e83ab", size = 396410, upload-time = "2026-05-23T18:53:15.192Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/9e/dd/d0ee25348ac58245ee9f90b6f3cbb666bf01f69be7e0911f9851bddbda16/fastapi-0.129.0-py3-none-any.whl", hash = "sha256:b4946880e48f462692b31c083be0432275cbfb6e2274566b1be91479cc1a84ec", size = 102950, upload-time = "2026-02-12T13:54:54.528Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/82/45359b62a067409bd929ae8a56b8ed13e5a8c8a61194b3c236920999ab83/fastapi-0.136.3-py3-none-any.whl", hash = "sha256:3d2a69bdf04b7e9f3afa292c3bc7a98816bbfafa10bc9b45f3f3700d2f761620", size = 117481, upload-time = "2026-05-23T18:53:16.924Z" },
 ]
 
 [package.optional-dependencies]
 standard = [
     { name = "email-validator" },
     { name = "fastapi-cli", extra = ["standard"] },
+    { name = "fastar" },
     { name = "httpx" },
     { name = "jinja2" },
     { name = "pydantic-extra-types" },
@@ -312,70 +313,74 @@ wheels = [
 
 [[package]]
 name = "fastar"
-version = "0.8.0"
+version = "0.11.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/69/e7/f89d54fb04104114dd0552836dc2b47914f416cc0e200b409dd04a33de5e/fastar-0.8.0.tar.gz", hash = "sha256:f4d4d68dbf1c4c2808f0e730fac5843493fc849f70fe3ad3af60dfbaf68b9a12", size = 68524, upload-time = "2025-11-26T02:36:00.72Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/03/0f/0aeb3fc50046617702acc0078b277b58367fd62eb727b9ec733ae0e8bbcc/fastar-0.11.0.tar.gz", hash = "sha256:aa7f100f7313c03fdb20f1385927ba95671071ba308ad0c1763fef295e1895ce", size = 70238, upload-time = "2026-04-13T17:11:17.143Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/58/f1/5b2ff898abac7f1a418284aad285e3a4f68d189c572ab2db0f6c9079dd16/fastar-0.8.0-cp312-cp312-macosx_10_12_x86_64.whl", hash = "sha256:0f10d2adfe40f47ff228f4efaa32d409d732ded98580e03ed37c9535b5fc923d", size = 706369, upload-time = "2025-11-26T02:34:37.783Z" },
-    { url = "https://files.pythonhosted.org/packages/23/60/8046a386dca39154f80c927cbbeeb4b1c1267a3271bffe61552eb9995757/fastar-0.8.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:b930da9d598e3bc69513d131f397e6d6be4643926ef3de5d33d1e826631eb036", size = 629097, upload-time = "2025-11-26T02:34:21.888Z" },
-    { url = "https://files.pythonhosted.org/packages/22/7e/1ae005addc789924a9268da2394d3bb5c6f96836f7e37b7e3d23c2362675/fastar-0.8.0-cp312-cp312-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:9d210da2de733ca801de83e931012349d209f38b92d9630ccaa94bd445bdc9b8", size = 868938, upload-time = "2025-11-26T02:33:51.119Z" },
-    { url = "https://files.pythonhosted.org/packages/a6/77/290a892b073b84bf82e6b2259708dfe79c54f356e252c2dd40180b16fe07/fastar-0.8.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:aa02270721517078a5bd61a38719070ac2537a4aa6b6c48cf369cf2abc59174a", size = 765204, upload-time = "2025-11-26T02:32:47.02Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/00/c3155171b976003af3281f5258189f1935b15d1221bfc7467b478c631216/fastar-0.8.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:83c391e5b789a720e4d0029b9559f5d6dee3226693c5b39c0eab8eaece997e0f", size = 764717, upload-time = "2025-11-26T02:33:02.453Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/43/405b7ad76207b2c11b7b59335b70eac19e4a2653977f5588a1ac8fed54f4/fastar-0.8.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3258d7a78a72793cdd081545da61cabe85b1f37634a1d0b97ffee0ff11d105ef", size = 931502, upload-time = "2025-11-26T02:33:18.619Z" },
-    { url = "https://files.pythonhosted.org/packages/da/8a/a3dde6d37cc3da4453f2845cdf16675b5686b73b164f37e2cc579b057c2c/fastar-0.8.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e6eab95dd985cdb6a50666cbeb9e4814676e59cfe52039c880b69d67cfd44767", size = 821454, upload-time = "2025-11-26T02:33:33.427Z" },
-    { url = "https://files.pythonhosted.org/packages/da/c1/904fe2468609c8990dce9fe654df3fbc7324a8d8e80d8240ae2c89757064/fastar-0.8.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:829b1854166141860887273c116c94e31357213fa8e9fe8baeb18bd6c38aa8d9", size = 821647, upload-time = "2025-11-26T02:34:07Z" },
-    { url = "https://files.pythonhosted.org/packages/c8/73/a0642ab7a400bc07528091785e868ace598fde06fcd139b8f865ec1b6f3c/fastar-0.8.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:b1667eae13f9457a3c737f4376d68e8c3e548353538b28f7e4273a30cb3965cd", size = 986342, upload-time = "2025-11-26T02:34:53.371Z" },
-    { url = "https://files.pythonhosted.org/packages/af/af/60c1bfa6edab72366461a95f053d0f5f7ab1825fe65ca2ca367432cd8629/fastar-0.8.0-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:b864a95229a7db0814cd9ef7987cb713fd43dce1b0d809dd17d9cd6f02fdde3e", size = 1040207, upload-time = "2025-11-26T02:35:10.65Z" },
-    { url = "https://files.pythonhosted.org/packages/f6/a0/0d624290dec622e7fa084b6881f456809f68777d54a314f5dde932714506/fastar-0.8.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:c05fbc5618ce17675a42576fa49858d79734627f0a0c74c0875ab45ee8de340c", size = 1045031, upload-time = "2025-11-26T02:35:28.108Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/74/cf663af53c4706ba88e6b4af44a6b0c3bd7d7ca09f079dc40647a8f06585/fastar-0.8.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:7f41c51ee96f338662ee3c3df4840511ba3f9969606840f1b10b7cb633a3c716", size = 994877, upload-time = "2025-11-26T02:35:45.797Z" },
-    { url = "https://files.pythonhosted.org/packages/52/17/444c8be6e77206050e350da7c338102b6cab384be937fa0b1d6d1f9ede73/fastar-0.8.0-cp312-cp312-win32.whl", hash = "sha256:d949a1a2ea7968b734632c009df0571c94636a5e1622c87a6e2bf712a7334f47", size = 455996, upload-time = "2025-11-26T02:36:26.938Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/34/fc3b5e56d71a17b1904800003d9251716e8fd65f662e1b10a26881698a74/fastar-0.8.0-cp312-cp312-win_amd64.whl", hash = "sha256:fc645994d5b927d769121094e8a649b09923b3c13a8b0b98696d8f853f23c532", size = 490429, upload-time = "2025-11-26T02:36:12.707Z" },
-    { url = "https://files.pythonhosted.org/packages/35/a8/5608cc837417107c594e2e7be850b9365bcb05e99645966a5d6a156285fe/fastar-0.8.0-cp312-cp312-win_arm64.whl", hash = "sha256:d81ee82e8dc78a0adb81728383bd39611177d642a8fa2d601d4ad5ad59e5f3bd", size = 461297, upload-time = "2025-11-26T02:36:03.546Z" },
-    { url = "https://files.pythonhosted.org/packages/d1/a5/79ecba3646e22d03eef1a66fb7fc156567213e2e4ab9faab3bbd4489e483/fastar-0.8.0-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:a3253a06845462ca2196024c7a18f5c0ba4de1532ab1c4bad23a40b332a06a6a", size = 706112, upload-time = "2025-11-26T02:34:39.237Z" },
-    { url = "https://files.pythonhosted.org/packages/0a/03/4f883bce878218a8676c2d7ca09b50c856a5470bb3b7f63baf9521ea6995/fastar-0.8.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:5cbeb3ebfa0980c68ff8b126295cc6b208ccd81b638aebc5a723d810a7a0e5d2", size = 628954, upload-time = "2025-11-26T02:34:23.705Z" },
-    { url = "https://files.pythonhosted.org/packages/4f/f1/892e471f156b03d10ba48ace9384f5a896702a54506137462545f38e40b8/fastar-0.8.0-cp313-cp313-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:1c0d5956b917daac77d333d48b3f0f3ff927b8039d5b32d8125462782369f761", size = 868685, upload-time = "2025-11-26T02:33:53.077Z" },
-    { url = "https://files.pythonhosted.org/packages/39/ba/e24915045852e30014ec6840446975c03f4234d1c9270394b51d3ad18394/fastar-0.8.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:27b404db2b786b65912927ce7f3790964a4bcbde42cdd13091b82a89cd655e1c", size = 765044, upload-time = "2025-11-26T02:32:48.187Z" },
-    { url = "https://files.pythonhosted.org/packages/14/2c/1aa11ac21a99984864c2fca4994e094319ff3a2046e7a0343c39317bd5b9/fastar-0.8.0-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:0902fc89dcf1e7f07b8563032a4159fe2b835e4c16942c76fd63451d0e5f76a3", size = 764322, upload-time = "2025-11-26T02:33:03.859Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/f0/4b91902af39fe2d3bae7c85c6d789586b9fbcf618d7fdb3d37323915906d/fastar-0.8.0-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:069347e2f0f7a8b99bbac8cd1bc0e06c7b4a31dc964fc60d84b95eab3d869dc1", size = 931016, upload-time = "2025-11-26T02:33:19.902Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/97/8fc43a5a9c0a2dc195730f6f7a0f367d171282cd8be2511d0e87c6d2dad0/fastar-0.8.0-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:7fd135306f6bfe9a835918280e0eb440b70ab303e0187d90ab51ca86e143f70d", size = 821308, upload-time = "2025-11-26T02:33:34.664Z" },
-    { url = "https://files.pythonhosted.org/packages/0c/e9/058615b63a7fd27965e8c5966f393ed0c169f7ff5012e1674f21684de3ba/fastar-0.8.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:78d06d6897f43c27154b5f2d0eb930a43a81b7eec73f6f0b0114814d4a10ab38", size = 821171, upload-time = "2025-11-26T02:34:08.498Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/cf/69e16a17961570a755c37ffb5b5aa7610d2e77807625f537989da66f2a9d/fastar-0.8.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a922f8439231fa0c32b15e8d70ff6d415619b9d40492029dabbc14a0c53b5f18", size = 986227, upload-time = "2025-11-26T02:34:55.06Z" },
-    { url = "https://files.pythonhosted.org/packages/fb/83/2100192372e59b56f4ace37d7d9cabda511afd71b5febad1643d1c334271/fastar-0.8.0-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:a739abd51eb766384b4caff83050888e80cd75bbcfec61e6d1e64875f94e4a40", size = 1039395, upload-time = "2025-11-26T02:35:12.166Z" },
-    { url = "https://files.pythonhosted.org/packages/75/15/cdd03aca972f55872efbb7cf7540c3fa7b97a75d626303a3ea46932163dc/fastar-0.8.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:5a65f419d808b23ac89d5cd1b13a2f340f15bc5d1d9af79f39fdb77bba48ff1b", size = 1044766, upload-time = "2025-11-26T02:35:29.62Z" },
-    { url = "https://files.pythonhosted.org/packages/3d/29/945e69e4e2652329ace545999334ec31f1431fbae3abb0105587e11af2ae/fastar-0.8.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:7bb2ae6c0cce58f0db1c9f20495e7557cca2c1ee9c69bbd90eafd54f139171c5", size = 994740, upload-time = "2025-11-26T02:35:47.887Z" },
-    { url = "https://files.pythonhosted.org/packages/4b/5d/dbfe28f8cd1eb484bba0c62e5259b2cf6fea229d6ef43e05c06b5a78c034/fastar-0.8.0-cp313-cp313-win32.whl", hash = "sha256:b28753e0d18a643272597cb16d39f1053842aa43131ad3e260c03a2417d38401", size = 455990, upload-time = "2025-11-26T02:36:28.502Z" },
-    { url = "https://files.pythonhosted.org/packages/e1/01/e965740bd36e60ef4c5aa2cbe42b6c4eb1dc3551009238a97c2e5e96bd23/fastar-0.8.0-cp313-cp313-win_amd64.whl", hash = "sha256:620e5d737dce8321d49a5ebb7997f1fd0047cde3512082c27dc66d6ac8c1927a", size = 490227, upload-time = "2025-11-26T02:36:14.363Z" },
-    { url = "https://files.pythonhosted.org/packages/dd/10/c99202719b83e5249f26902ae53a05aea67d840eeb242019322f20fc171c/fastar-0.8.0-cp313-cp313-win_arm64.whl", hash = "sha256:c4c4bd08df563120cd33e854fe0a93b81579e8571b11f9b7da9e84c37da2d6b6", size = 461078, upload-time = "2025-11-26T02:36:04.94Z" },
-    { url = "https://files.pythonhosted.org/packages/96/4a/9573b87a0ef07580ed111e7230259aec31bb33ca3667963ebee77022ec61/fastar-0.8.0-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:50b36ce654ba44b0e13fae607ae17ee6e1597b69f71df1bee64bb8328d881dfc", size = 706041, upload-time = "2025-11-26T02:34:40.638Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/19/f95444a1d4f375333af49300aa75ee93afa3335c0e40fda528e460ed859c/fastar-0.8.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:63a892762683d7ab00df0227d5ea9677c62ff2cde9b875e666c0be569ed940f3", size = 628617, upload-time = "2025-11-26T02:34:24.893Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/c9/b51481b38b7e3f16ef2b9e233b1a3623386c939d745d6e41bbd389eaae30/fastar-0.8.0-cp314-cp314-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:4ae6a145c1bff592644bde13f2115e0239f4b7babaf506d14e7d208483cf01a5", size = 869299, upload-time = "2025-11-26T02:33:54.274Z" },
-    { url = "https://files.pythonhosted.org/packages/bf/02/3ba1267ee5ba7314e29c431cf82eaa68586f2c40cdfa08be3632b7d07619/fastar-0.8.0-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6ae0ff7c0a1c7e1428404b81faee8aebef466bfd0be25bfe4dabf5d535c68741", size = 764667, upload-time = "2025-11-26T02:32:49.606Z" },
-    { url = "https://files.pythonhosted.org/packages/1b/84/bf33530fd015b5d7c2cc69e0bce4a38d736754a6955487005aab1af6adcd/fastar-0.8.0-cp314-cp314-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:dbfd87dbd217b45c898b2dbcd0169aae534b2c1c5cbe3119510881f6a5ac8ef5", size = 763993, upload-time = "2025-11-26T02:33:05.782Z" },
-    { url = "https://files.pythonhosted.org/packages/da/e0/9564d24e7cea6321a8d921c6d2a457044a476ef197aa4708e179d3d97f0d/fastar-0.8.0-cp314-cp314-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:9a5abd99fcba83ef28c8fe6ae2927edc79053db43a0457a962ed85c9bf150d37", size = 930153, upload-time = "2025-11-26T02:33:21.53Z" },
-    { url = "https://files.pythonhosted.org/packages/35/b1/6f57fcd8d6e192cfebf97e58eb27751640ad93784c857b79039e84387b51/fastar-0.8.0-cp314-cp314-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:91d4c685620c3a9d6b5ae091dbabab4f98b20049b7ecc7976e19cc9016c0d5d6", size = 821177, upload-time = "2025-11-26T02:33:35.839Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/78/9e004ea9f3aa7466f5ddb6f9518780e1d2f0ed3ca55f093632982598bace/fastar-0.8.0-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f77c2f2cad76e9dc7b6701297adb1eba87d0485944b416fc2ccf5516c01219a3", size = 820652, upload-time = "2025-11-26T02:34:09.776Z" },
-    { url = "https://files.pythonhosted.org/packages/42/95/b604ed536544005c9f1aee7c4c74b00150db3d8d535cd8232dc20f947063/fastar-0.8.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:e7f07c4a3dada7757a8fc430a5b4a29e6ef696d2212747213f57086ffd970316", size = 985961, upload-time = "2025-11-26T02:34:56.401Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/7b/fa9d4d96a5d494bdb8699363bb9de8178c0c21a02e1d89cd6f913d127018/fastar-0.8.0-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:90c0c3fe55105c0aed8a83135dbdeb31e683455dbd326a1c48fa44c378b85616", size = 1039316, upload-time = "2025-11-26T02:35:13.807Z" },
-    { url = "https://files.pythonhosted.org/packages/4e/f9/8462789243bc3f33e8401378ec6d54de4e20cfa60c96a0e15e3e9d1389bb/fastar-0.8.0-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:fb9ee51e5bffe0dab3d3126d3a4fac8d8f7235cedcb4b8e74936087ce1c157f3", size = 1045028, upload-time = "2025-11-26T02:35:31.079Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/71/9abb128777e616127194b509e98fcda3db797d76288c1a8c23dd22afc14f/fastar-0.8.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:e380b1e8d30317f52406c43b11e98d11e1d68723bbd031e18049ea3497b59a6d", size = 994677, upload-time = "2025-11-26T02:35:49.391Z" },
-    { url = "https://files.pythonhosted.org/packages/de/c1/b81b3f194853d7ad232a67a1d768f5f51a016f165cfb56cb31b31bbc6177/fastar-0.8.0-cp314-cp314-win32.whl", hash = "sha256:1c4ffc06e9c4a8ca498c07e094670d8d8c0d25b17ca6465b9774da44ea997ab1", size = 456687, upload-time = "2025-11-26T02:36:30.205Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/87/9e0cd4768a98181d56f0cdbab2363404cc15deb93f4aad3b99cd2761bbaa/fastar-0.8.0-cp314-cp314-win_amd64.whl", hash = "sha256:5517a8ad4726267c57a3e0e2a44430b782e00b230bf51c55b5728e758bb3a692", size = 490578, upload-time = "2025-11-26T02:36:16.218Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/1e/580a76cf91847654f2ad6520e956e93218f778540975bc4190d363f709e2/fastar-0.8.0-cp314-cp314-win_arm64.whl", hash = "sha256:58030551046ff4a8616931e52a36c83545ff05996db5beb6e0cd2b7e748aa309", size = 461473, upload-time = "2025-11-26T02:36:06.373Z" },
-    { url = "https://files.pythonhosted.org/packages/58/4c/bdb5c6efe934f68708529c8c9d4055ebef5c4be370621966438f658b29bd/fastar-0.8.0-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:1e7d29b6bfecb29db126a08baf3c04a5ab667f6cea2b7067d3e623a67729c4a6", size = 705570, upload-time = "2025-11-26T02:34:42.01Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/78/f01ac7e71d5a37621bd13598a26e948a12b85ca8042f7ee1a0a8c9f59cda/fastar-0.8.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:05eb7b96940f9526b485f1d0b02393839f0f61cac4b1f60024984f8b326d2640", size = 627761, upload-time = "2025-11-26T02:34:26.152Z" },
-    { url = "https://files.pythonhosted.org/packages/06/45/6df0ecda86ea9d2e95053c1a655d153dee55fc121b6e13ea6d1e246a50b6/fastar-0.8.0-cp314-cp314t-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:619352d8ac011794e2345c462189dc02ba634750d23cd9d86a9267dd71b1f278", size = 869414, upload-time = "2025-11-26T02:33:55.618Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/72/486421f5a8c0c377cc82e7a50c8a8ea899a6ec2aa72bde8f09fb667a2dc8/fastar-0.8.0-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:74ebfecef3fe6d7a90355fac1402fd30636988332a1d33f3e80019a10782bb24", size = 763863, upload-time = "2025-11-26T02:32:51.051Z" },
-    { url = "https://files.pythonhosted.org/packages/d4/64/39f654dbb41a3867fb1f2c8081c014d8f1d32ea10585d84cacbef0b32995/fastar-0.8.0-cp314-cp314t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:2975aca5a639e26a3ab0d23b4b0628d6dd6d521146c3c11486d782be621a35aa", size = 763065, upload-time = "2025-11-26T02:33:07.274Z" },
-    { url = "https://files.pythonhosted.org/packages/4e/bd/c011a34fb3534c4c3301f7c87c4ffd7e47f6113c904c092ddc8a59a303ea/fastar-0.8.0-cp314-cp314t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:afc438eaed8ff0dcdd9308268be5cb38c1db7e94c3ccca7c498ca13a4a4535a3", size = 930530, upload-time = "2025-11-26T02:33:23.117Z" },
-    { url = "https://files.pythonhosted.org/packages/55/9d/aa6e887a7033c571b1064429222bbe09adc9a3c1e04f3d1788ba5838ebd5/fastar-0.8.0-cp314-cp314t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:6ced0a5399cc0a84a858ef0a31ca2d0c24d3bbec4bcda506a9192d8119f3590a", size = 820572, upload-time = "2025-11-26T02:33:37.542Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/9c/7a3a2278a1052e1a5d98646de7c095a00cffd2492b3b84ce730e2f1cd93a/fastar-0.8.0-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ec9b23da8c4c039da3fe2e358973c66976a0c8508aa06d6626b4403cb5666c19", size = 820649, upload-time = "2025-11-26T02:34:11.108Z" },
-    { url = "https://files.pythonhosted.org/packages/02/9e/d38edc1f4438cd047e56137c26d94783ffade42e1b3bde620ccf17b771ef/fastar-0.8.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:dfba078fcd53478032fd0ceed56960ec6b7ff0511cfc013a8a3a4307e3a7bac4", size = 985653, upload-time = "2025-11-26T02:34:57.884Z" },
-    { url = "https://files.pythonhosted.org/packages/69/d9/2147d0c19757e165cd62d41cec3f7b38fad2ad68ab784978b5f81716c7ea/fastar-0.8.0-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:ade56c94c14be356d295fecb47a3fcd473dd43a8803ead2e2b5b9e58feb6dcfa", size = 1038140, upload-time = "2025-11-26T02:35:15.778Z" },
-    { url = "https://files.pythonhosted.org/packages/7f/1d/ec4c717ffb8a308871e9602ec3197d957e238dc0227127ac573ec9bca952/fastar-0.8.0-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:e48d938f9366db5e59441728f70b7f6c1ccfab7eff84f96f9b7e689b07786c52", size = 1045195, upload-time = "2025-11-26T02:35:32.865Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/9f/637334dc8c8f3bb391388b064ae13f0ad9402bc5a6c3e77b8887d0c31921/fastar-0.8.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:79c441dc1482ff51a54fb3f57ae6f7bb3d2cff88fa2cc5d196c519f8aab64a56", size = 994686, upload-time = "2025-11-26T02:35:51.392Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/e2/dfa19a4b260b8ab3581b7484dcb80c09b25324f4daa6b6ae1c7640d1607a/fastar-0.8.0-cp314-cp314t-win32.whl", hash = "sha256:187f61dc739afe45ac8e47ed7fd1adc45d52eac110cf27d579155720507d6fbe", size = 455767, upload-time = "2025-11-26T02:36:34.758Z" },
-    { url = "https://files.pythonhosted.org/packages/51/47/df65c72afc1297797b255f90c4778b5d6f1f0f80282a134d5ab610310ed9/fastar-0.8.0-cp314-cp314t-win_amd64.whl", hash = "sha256:40e9d763cf8bf85ce2fa256e010aa795c0fe3d3bd1326d5c3084e6ce7857127e", size = 489971, upload-time = "2025-11-26T02:36:22.081Z" },
-    { url = "https://files.pythonhosted.org/packages/85/11/0aa8455af26f0ae89e42be67f3a874255ee5d7f0f026fc86e8d56f76b428/fastar-0.8.0-cp314-cp314t-win_arm64.whl", hash = "sha256:e59673307b6a08210987059a2bdea2614fe26e3335d0e5d1a3d95f49a05b1418", size = 460467, upload-time = "2025-11-26T02:36:07.978Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/06/a5773706afc8bd496769786590bbc56d2d0ee419a299cc12ea3f5717fcf3/fastar-0.11.0-cp312-cp312-macosx_10_12_x86_64.whl", hash = "sha256:3c51f1c2cdddbd1420d2897ace7738e36c65e17f6ae84e0bfe763f8d1068bb97", size = 708394, upload-time = "2026-04-13T17:09:57.269Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/a6/d5e2a4e48495616440a21eed07558219ca90243ad00b0502586f95bd4833/fastar-0.11.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:0d9d6b052baf5380baea866675dab6ccd04ec2460d12b1c46f10ce3f4ee6a820", size = 628417, upload-time = "2026-04-13T17:09:42.145Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/69/9816d69ac8265c9e50456637a487ccfb7a9c566efd9dbcd673df9c2558c2/fastar-0.11.0-cp312-cp312-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:bd2f05666d4df7e14885b5c38fefd92a785917387513d33d837ff42ec143a22f", size = 863950, upload-time = "2026-04-13T17:09:11.506Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/0d/f88daad53aff2e754b6b5ff2a7113f72447a34f6ef17cc23ca99988117b7/fastar-0.11.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c1e6e74aba1ae77ca4aedcaf1697cd413319f4c88a5ccbe5b42c709517c5097e", size = 760737, upload-time = "2026-04-13T17:07:55.958Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/a6/82ef4ecd969d50d92ed3ed9dbd8fe77faa24be5e5736f716edc9f4ce8d62/fastar-0.11.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:38ef77fe940bbc9b37a98bd838727f844b11731cd39358a2640ff864fb385086", size = 757603, upload-time = "2026-04-13T17:08:10.623Z" },
+    { url = "https://files.pythonhosted.org/packages/03/35/50249f0d827251f8ac511495e2eacccebda80a00a0ad73e9615b8113b84f/fastar-0.11.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:8955e61b32d6aff82c983217abf80933fd823b0e727586fc72f08043d996fd59", size = 923952, upload-time = "2026-04-13T17:08:25.526Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/d8/faee41659e9c379d906d24eaee6d6833ac8cfef0a5df480e5c2a8d3efb33/fastar-0.11.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:483532442cdb08fbff0169510224eae0836f2f672cea6aacb52847d90fefdc46", size = 816574, upload-time = "2026-04-13T17:08:56.076Z" },
+    { url = "https://files.pythonhosted.org/packages/22/47/0448ea7992b997dad2bf004bfd98eca74b5858630eae080b50c7b17d9ddc/fastar-0.11.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ef5a6071121e05d8287fc75bccb054bcbac8bb0501200a0c0a8feeace5303ea4", size = 819382, upload-time = "2026-04-13T17:09:26.66Z" },
+    { url = "https://files.pythonhosted.org/packages/33/ef/0d63eb43586831b7a6f8b22c4d77125a7c594423af1f4f090fa9541b9b40/fastar-0.11.0-cp312-cp312-manylinux_2_31_riscv64.whl", hash = "sha256:e45e598af5afe8412197d4786efd6cf29be02e7d3d4f6a3461149eae5d7e94f1", size = 885254, upload-time = "2026-04-13T17:08:40.9Z" },
+    { url = "https://files.pythonhosted.org/packages/01/25/edd584675d69e49a165052c3ee886df1c5d574f3e7d813c990306387c623/fastar-0.11.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:2e160919b1c47ddb8538e7e8eb4cd527281b40f0bf75110a75993838ef61f286", size = 971239, upload-time = "2026-04-13T17:10:12.997Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/37/e8bb24f506ba2b08fbaf36c5800e843bd4d542954e9331f00418e2d23349/fastar-0.11.0-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:4bb4dc0fc8f7a6807febcebce8a2f3626ba4955a9263d81ecc630aad83be84c0", size = 1035185, upload-time = "2026-04-13T17:10:30.207Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/bf/be753736296338149ee4cb3e92e2b5423d6ba17c7b951d15218fd7e99bbf/fastar-0.11.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:4ec95af56aa173f6e320e1183001bf108ba59beaf13edd1fc8200648db203588", size = 1072191, upload-time = "2026-04-13T17:10:47.072Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/cd/a81c1aaafb5a22ce57c98ae22f39c89413ed53e4ee6e1b1444b0bd666a6c/fastar-0.11.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:136cf342735464091c39dc3708168f9fdeb9ebea40b1ead937c61afaf46143d9", size = 1028054, upload-time = "2026-04-13T17:11:04.293Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/88/1ce4eed3d70627c95f49ca017f6bbbf2ddcc4b0c601d293259de7689bc20/fastar-0.11.0-cp312-cp312-win32.whl", hash = "sha256:35f23c11b556cc4d3704587faacbc0037f7bdf6c4525cd1d09c70bda4b1c6809", size = 454198, upload-time = "2026-04-13T17:11:45.168Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/1d/26ce92f4331cd61a69840db9ca6115829805eec24f285481a854f578e917/fastar-0.11.0-cp312-cp312-win_amd64.whl", hash = "sha256:920bc56c3c0b8a8ca492904941d1883c1c947c858cd93343356c29122a38f44c", size = 486697, upload-time = "2026-04-13T17:11:31.084Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/96/e6eda4480559c69b05d466e7b5ea9170e81fef3795a73e059959a3258319/fastar-0.11.0-cp312-cp312-win_arm64.whl", hash = "sha256:395248faf89e8a6bd5dc1fd544c8465113b627cb6d7c8b296796b60ebea33593", size = 462591, upload-time = "2026-04-13T17:11:20.577Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/d6/3be260037e86fb694e88d47f583bac3a0188c99cee1a6b257ac26cb6b53c/fastar-0.11.0-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:33f544b08b4541b678e53749b4552a44720d96761fb79c172b005b1089c443ed", size = 707975, upload-time = "2026-04-13T17:09:58.866Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/cd/7867aefb1784662554a335f2952c75a50f0c70585ed0d2210d6cc15e5627/fastar-0.11.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:91c1c792447e4a642745f347ff9847c52af39633071c57ee67ed53c157fc3506", size = 628460, upload-time = "2026-04-13T17:09:43.776Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/2b/d11d84bdd5e0e377771b955755771e3460b290da5809cb78c1b735ee2228/fastar-0.11.0-cp313-cp313-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:881247e6b6eaea59fc6569f9b61447aa6b9fc2ee864e048b4643d69c52745805", size = 863054, upload-time = "2026-04-13T17:09:13.048Z" },
+    { url = "https://files.pythonhosted.org/packages/25/39/d3f428b318fa940b1b6e785b8d54fc895dfb5d5b945ef8d5442ffa904fb2/fastar-0.11.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:863b7929845c9fec92ef6c8d59579cf46af5136655e5342f8df5cebe46cab06c", size = 760247, upload-time = "2026-04-13T17:07:57.396Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/04/03949aee82aabb8ede06ac5a4a5579ffaf98a8fe59ce958494508ff15513/fastar-0.11.0-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:96b4a57df12bf3211662627a3ea29d62ecb314a2434a0d0843f9fc23e47536e5", size = 756512, upload-time = "2026-04-13T17:08:12.415Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/0c/2ca1ae0a3828ca51047962d932b80daca2522db73e8cb9d040cb6ebe28d5/fastar-0.11.0-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ceef1c2c4df7b7b8ebd3f5d718bbf457b9bbdf25ce0bd07870211ec4fbd9aff4", size = 922183, upload-time = "2026-04-13T17:08:27.187Z" },
+    { url = "https://files.pythonhosted.org/packages/65/68/7fe808b1f73a68e686f25434f538c6dc10ef4dfb3db0ace22cd861744bf8/fastar-0.11.0-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:b8e545918441910a779659d4759ad0eef349e935fbdb4668a666d3681567eb05", size = 816394, upload-time = "2026-04-13T17:08:57.657Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/17/07d086080f8a83b8d7966955e29bcdbd6a060f5bd949dc9d5abd3658cead/fastar-0.11.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:28095bb8f821e85fc2764e1a55f03e5e2876dee2abe7cd0ee9420d929905d643", size = 818983, upload-time = "2026-04-13T17:09:28.46Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/e2/2c4edf0910af2e814ff6d65b77a91196d472ca8a9fb2033bd983f6856caa/fastar-0.11.0-cp313-cp313-manylinux_2_31_riscv64.whl", hash = "sha256:0fafb95ecbe70f666a5e9b35dd63974ccdc9bb3d99ccdbd4014a823ec3e659b5", size = 884689, upload-time = "2026-04-13T17:08:42.763Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/ba/04fdcbd6558e60de4ced3b55230fac47675d181252582b2fcec3c74608e5/fastar-0.11.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:af48fed039b94016629dcdad1c95c90c486326dd068de2b0a4df419ee09b6821", size = 970677, upload-time = "2026-04-13T17:10:15.124Z" },
+    { url = "https://files.pythonhosted.org/packages/df/b3/2b860a9658550167dbd5824c85e88d0b4b912bf493e42a6322544d6e483d/fastar-0.11.0-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:74cd96163f39b8638ab4e8d49708ca887959672a22871d8170d01f067319533b", size = 1034026, upload-time = "2026-04-13T17:10:32.318Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/9b/fa42ea1188b144bac4b1b60753dfd449974a4d5eda132029ee7711569f94/fastar-0.11.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:4e8b993cb5613bab495ed482810bedc0986633fcb9a3b55c37ec88e0d6714f6a", size = 1071147, upload-time = "2026-04-13T17:10:48.833Z" },
+    { url = "https://files.pythonhosted.org/packages/95/c8/d2e501556dca9f1fbc9246111a31792fb49ad908fa4927f34938a97a3604/fastar-0.11.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:dfe39d91fc28e37e06162d94afe01050220edb7df554acb5b702b5503e564816", size = 1028377, upload-time = "2026-04-13T17:11:06.374Z" },
+    { url = "https://files.pythonhosted.org/packages/db/33/5f11f23eca0a569cd052507bc45dda2e5468697f8665728d25be44120f7d/fastar-0.11.0-cp313-cp313-win32.whl", hash = "sha256:c5f63d4d99ff4bfb37c659982ec413358bdee747005348756cc50a04d412d989", size = 454089, upload-time = "2026-04-13T17:11:46.821Z" },
+    { url = "https://files.pythonhosted.org/packages/da/2f/35ff03c939cba7a255a9132367873fec6c355fd06a7f84fedcbaf4c8129f/fastar-0.11.0-cp313-cp313-win_amd64.whl", hash = "sha256:8690ed1928d31ded3ada308e1086525fb3871f5fa81e1b69601a3f7774004583", size = 486312, upload-time = "2026-04-13T17:11:32.86Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/71/ee9246cbfcbfd4144558f35e7e9a306ffe0a7564730a5188c45f21d2dab8/fastar-0.11.0-cp313-cp313-win_arm64.whl", hash = "sha256:d977ded9d98a0719a305e0a4d5ee811f1d3e856d853a50acb8ae833c3cd6d5d2", size = 461975, upload-time = "2026-04-13T17:11:22.589Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/cd/3644c48ecac456f928c12d47ec3bed36c36555b17c3859856f1ff860265d/fastar-0.11.0-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:71375bd6f03c2a43eb47bd949ea38ff45434917f9cdac79675c5b9f60de4fa73", size = 707860, upload-time = "2026-04-13T17:10:00.371Z" },
+    { url = "https://files.pythonhosted.org/packages/69/ca/dee04476ae3626b2b040a60ad84628f77e1ffd8444232f2426b0ca1e0d7e/fastar-0.11.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:eddfd9cab16e19ae247fe44bf992cb403ccfe27d3931d6de29a4695d95ad386c", size = 628216, upload-time = "2026-04-13T17:09:45.355Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/5e/9395c7353d079cb4f5be0f7982ce0dc9f2e7dec5fd175eef466729d6023a/fastar-0.11.0-cp314-cp314-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:7c371f1d4386c699018bb64eb2fa785feacf32785559049d2bb72fe4af023f53", size = 864378, upload-time = "2026-04-13T17:09:14.611Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/ba/1e4f67148223ff219612b6281a6000357abbcc2417964fa5c83f11d68fce/fastar-0.11.0-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cad7fa41e3e66554387481c1a09365e4638becd322904932674159d5f4046728", size = 760921, upload-time = "2026-04-13T17:07:59.138Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/82/09d11fb6d12f17993ffaf32ffd30c3c121a11e2966e84f19fb6f66430118/fastar-0.11.0-cp314-cp314-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:cf36652fa71b83761717c9899b98732498f8a2cb6327ff16bbf07f6be85c3437", size = 757012, upload-time = "2026-04-13T17:08:14.186Z" },
+    { url = "https://files.pythonhosted.org/packages/52/1f/5aeeacc4cb65615e2c9292cd9c5b0cd6fb6d2e6ee472ca6adc6c1b1b22ef/fastar-0.11.0-cp314-cp314-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f68ff8c17833053da4841720e95edde80ce45bb994b6b7d51418dddaac70ee47", size = 924510, upload-time = "2026-04-13T17:08:28.741Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/1a/1e5bdabbeaf2e856928956292609f2ff6a650f94480fb8afaca30229e483/fastar-0.11.0-cp314-cp314-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4563ed37a12ea1cdc398af8571258d24b988bf342b7b3bf5451bd5891243280c", size = 816602, upload-time = "2026-04-13T17:08:59.461Z" },
+    { url = "https://files.pythonhosted.org/packages/87/24/f960147910da3bed41a3adfcb026e17d5f50f4cf467a3324237a7088f61a/fastar-0.11.0-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cee63c9875cba3b70dc44338c560facc5d6e763047dcc4a30501f9a68cf5f890", size = 819452, upload-time = "2026-04-13T17:09:29.926Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/f4/3e77d7901d5707fd7f8a352e153c8ae09ea974e6fabad0b7c4eb9944b8d4/fastar-0.11.0-cp314-cp314-manylinux_2_31_riscv64.whl", hash = "sha256:bd76bfffae6d0a91f4ac4a612f721e7aec108db97dccdd120ae063cd66959f27", size = 885254, upload-time = "2026-04-13T17:08:44.285Z" },
+    { url = "https://files.pythonhosted.org/packages/47/01/1585edd5ec47782ae93cd94edf05828e0ab02ef00aec00aea4194a600464/fastar-0.11.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:8f5b707501ec01c1bc0518f741f01d322e50c9adc19a451aa24f67a2316e9397", size = 971496, upload-time = "2026-04-13T17:10:17.024Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/e9/6874c9d1236ded565a0bed54b320ac9f165f287b1d89490fb70f9f323c81/fastar-0.11.0-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:37c0b5a88a657839aad98b0a6c9e4ac4c2c15d6b49c44ee3935c6b08e9d3e479", size = 1034685, upload-time = "2026-04-13T17:10:34.063Z" },
+    { url = "https://files.pythonhosted.org/packages/14/d8/4ab20613ce2983427aee958e39be878dba874aa227c530a845e32429c4f6/fastar-0.11.0-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:6c55f536c62a6efb180c1af0d5182948bff576bbfe6276e8e1359c9c7d2215d8", size = 1072675, upload-time = "2026-04-13T17:10:50.53Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/ae/5ac3b7c20ce4b08f011dd2b979f96caabe64f9b10b157f211ea91bdfadca/fastar-0.11.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:3082eeca59e189b9039335862f4c2780c0c8871d656bfdf559db4414a105b251", size = 1029330, upload-time = "2026-04-13T17:11:08.138Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/e7/37cd6a1d4e288292170b64e19d79ecce2a7de8bb76790323399a2abc4619/fastar-0.11.0-cp314-cp314-win32.whl", hash = "sha256:b201a0a4e29f9fec2a177e13154b8725ec65ab9f83bd6415483efaa2aa18344b", size = 453940, upload-time = "2026-04-13T17:11:48.713Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/1c/795c878b1ee29d79021cf8ed81f18f2b25ccde58453b0d34b9bdc7e025ea/fastar-0.11.0-cp314-cp314-win_amd64.whl", hash = "sha256:868fddb26072a43e870a8819134b9f80ee602931be5a76e6fb873e04da343637", size = 486334, upload-time = "2026-04-13T17:11:34.882Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/a4/113f104301df8bddcc0b3775b611a30cb7610baa3add933c7ccac9386467/fastar-0.11.0-cp314-cp314-win_arm64.whl", hash = "sha256:3db39c9cc42abb0c780a26b299f24dfbc8be455985e969e15336d70d7b2f833b", size = 461534, upload-time = "2026-04-13T17:11:24.329Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/a6/5c5f2c2c8e0c63e56a5636ebc7721589c889e94c0092cec7eb28ae7207e6/fastar-0.11.0-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:49c3299dec5e125e7ebaa27545714da9c7391777366015427e0ae62d548b442b", size = 707156, upload-time = "2026-04-13T17:10:02.176Z" },
+    { url = "https://files.pythonhosted.org/packages/df/f7/982c01b61f0fc135ad2b16d01e6d0ee53cf8791e68827f5f7c5a65b2e5b1/fastar-0.11.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:3328ed1ed56d31f5198350b17dd60449b8d6b9d47abb4688bab6aef4450a165b", size = 627032, upload-time = "2026-04-13T17:09:46.978Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/c3/38f1dac77ae0c71c37b176277c96d830796b8ce2fe69705f917829b53829/fastar-0.11.0-cp314-cp314t-manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:bd3eca3bbfec84a614bcb4143b4ad4f784d0895babc26cfc88436af88ca23c7a", size = 864403, upload-time = "2026-04-13T17:09:16.58Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/f0/e69c363bdb3e5a5848e937b662b5469581ee6682c51bc1c0556494773929/fastar-0.11.0-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ff86a967acb0d621dd24063dda090daa67bf4993b9570e97fe156de88a9006ca", size = 759480, upload-time = "2026-04-13T17:08:00.599Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/29/4d8737590c2a6357d614d7cc7288e8f68e7e449680b8922997cc4349e65e/fastar-0.11.0-cp314-cp314t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:86eaf7c0e985d93a7734168be2fb232b2a8cca53e41431c2782d7c12b12c03b1", size = 756219, upload-time = "2026-04-13T17:08:15.699Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/ec/400de7b3b7d48801908f19cf5462177104395799472671b3e8152b2b04ca/fastar-0.11.0-cp314-cp314t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:91f07b0b8eb67e2f177733a1f884edad7dfb9f8977ffef15927b20cb9604027d", size = 923669, upload-time = "2026-04-13T17:08:30.574Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/01/8926c53da923fed7ab4b96e7fbf7f73b663beb4f02095b654d6fab46f9ad/fastar-0.11.0-cp314-cp314t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f85c896885eb4abf1a635d54dea22cac6ae48d04fc2ea26ae652fcf1febe1220", size = 815729, upload-time = "2026-04-13T17:09:01.204Z" },
+    { url = "https://files.pythonhosted.org/packages/89/f0/5fef4c7946e352651b504b1a4235dac3505e7cfd24020788ab50552e84bf/fastar-0.11.0-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:075c07095c8de4b774ba8f28b9c0a02b1a2cd254da50cbe464dd3bb2432e9158", size = 819812, upload-time = "2026-04-13T17:09:31.907Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/c8/0ebc3298b4a45e7bddc50b169ae6a6f5b80c939394d4befe6e60de535ee7/fastar-0.11.0-cp314-cp314t-manylinux_2_31_riscv64.whl", hash = "sha256:07f028933820c65750baf3383b807ecce1cd9385cf00ce192b79d263ad6b856c", size = 884074, upload-time = "2026-04-13T17:08:45.802Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/9f/7baa4cdff8d6fbca41fa5c764b48a941fed8a9ec6c4cc92de65895a28299/fastar-0.11.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:039f875efa0f01fa43c20bf4e2fc7305489c61d0ac76eda991acfba7820a0e63", size = 969450, upload-time = "2026-04-13T17:10:18.667Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/dc/1ebbfb58a47056ba866494f19efbcdd2ba2897096b94f36e796594b4d05b/fastar-0.11.0-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:fff12452a9a5c6814a012445f26365541cc3d99dcca61f09762e6a389f7a32ea", size = 1033775, upload-time = "2026-04-13T17:10:36.165Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/5f/ce4e3914066f08c99eb8c32952cc07c1a013e81b1db1b0f598130bf6b974/fastar-0.11.0-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:2bf733e09f942b6fa876efe30a90508d1f4caef5630c00fb2a84fba355873712", size = 1072158, upload-time = "2026-04-13T17:10:52.497Z" },
+    { url = "https://files.pythonhosted.org/packages/03/2a/6bca72992c84151c387cc6558f3867f5ebe5fb3684ee6fa9b76280ba4b8e/fastar-0.11.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:d1531fa848fdd3677d2dce0a4b436ea64d9ae38fb8babe2ddbc180dd153cb7a3", size = 1028577, upload-time = "2026-04-13T17:11:09.934Z" },
+    { url = "https://files.pythonhosted.org/packages/83/18/7a7c15657a3da5569b26fc51cde6a80f8d84cb54b3b1aea6d74a103db4ad/fastar-0.11.0-cp314-cp314t-win32.whl", hash = "sha256:5744551bc67c6fc6581cbd0e34a0fd6e2cd0bd30b43e94b1c3119cf35064b162", size = 453601, upload-time = "2026-04-13T17:11:53.726Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/d8/331b59a6de279f3ad75c10c02c40a12f21d64a437d9c3d6f1af2dcbd7a76/fastar-0.11.0-cp314-cp314t-win_amd64.whl", hash = "sha256:f4ce44e3b56c47cf38244b98d29f269b259740a580c47a2552efa5b96a5458fb", size = 486436, upload-time = "2026-04-13T17:11:40.089Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/fd/5390ec4f49100f3ecb9968a392f9e6d039f1e3fe0ecd28443716ff01e589/fastar-0.11.0-cp314-cp314t-win_arm64.whl", hash = "sha256:76c1359314355eafbc6989f20fb1ad565a3d10200117923b9da765a17e2f6f11", size = 461049, upload-time = "2026-04-13T17:11:25.918Z" },
 ]
 
 [[package]]
@@ -458,11 +463,11 @@ wheels = [
 
 [[package]]
 name = "idna"
-version = "3.11"
+version = "3.15"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/0703ccc57f3a7233505399edb88de3cbd678da106337b9fcde432b65ed60/idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902", size = 194582, upload-time = "2025-10-12T14:55:20.501Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/82/77/7b3966d0b9d1d31a36ddf1746926a11dface89a83409bf1483f0237aa758/idna-3.15.tar.gz", hash = "sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc", size = 199245, upload-time = "2026-05-12T22:45:57.011Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/23/408243171aa9aaba178d3e2559159c24c1171a641aa83b67bdd3394ead8e/idna-3.15-py3-none-any.whl", hash = "sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8", size = 72340, upload-time = "2026-05-12T22:45:55.733Z" },
 ]
 
 [[package]]
@@ -1122,15 +1127,15 @@ wheels = [
 
 [[package]]
 name = "starlette"
-version = "0.52.1"
+version = "1.0.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
     { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/c4/68/79977123bb7be889ad680d79a40f339082c1978b5cfcf62c2d8d196873ac/starlette-0.52.1.tar.gz", hash = "sha256:834edd1b0a23167694292e94f597773bc3f89f362be6effee198165a35d62933", size = 2653702, upload-time = "2026-01-18T13:34:11.062Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/08/a3/84e821cc54b4ab50ae6dbc6ac3800a651b65ec35f045cc73785380654057/starlette-1.0.1.tar.gz", hash = "sha256:512399c5f1de7fac99c88572212ded9ddeddef2fb32afa82d724000e88b38f4f", size = 2659596, upload-time = "2026-05-21T21:58:58.433Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/81/0d/13d1d239a25cbfb19e740db83143e95c772a1fe10202dda4b76792b114dd/starlette-0.52.1-py3-none-any.whl", hash = "sha256:0029d43eb3d273bc4f83a08720b4912ea4b071087a3b48db01b7c839f7954d74", size = 74272, upload-time = "2026-01-18T13:34:09.188Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/e1/b2df4bc09a1e51ff664c1e17018a4274b42e5e9352e4a478ea540512dc88/starlette-1.0.1-py3-none-any.whl", hash = "sha256:7c0e69b2ee1c848bd54669d908500117a3ee13de603a21427e5c6fc1adf98dcd", size = 72802, upload-time = "2026-05-21T21:58:56.551Z" },
 ]
 
 [[package]]
diff --git a/PROJECTS/beginner/canary-token-generator/.env.example b/PROJECTS/beginner/canary-token-generator/.env.example
new file mode 100644
index 00000000..e7aa0c74
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/.env.example
@@ -0,0 +1,106 @@
+# =============================================================================
+# ©AngelaMos | 2026
+# .env.example
+# =============================================================================
+# Copy this file to .env and fill in values. .env is gitignored.
+# Run `just init` to auto-generate POSTGRES_PASSWORD + OPERATOR_TOKEN if empty.
+# =============================================================================
+
+# ---------------------------------------------------------------------------
+# Public-facing
+# ---------------------------------------------------------------------------
+APP_NAME=canary-token-generator
+
+# Production nginx host port (compose.yml). Dev compose has its own default
+# of 58495 in dev.compose.yml; do not override NGINX_HOST_PORT in shared .env.
+NGINX_HOST_PORT=22784
+
+# Used to construct trigger URLs embedded in artifacts (e.g. canary docs).
+# Must be the externally-reachable URL of the deployed service.
+PUBLIC_BASE_URL=https://canary.your.domain
+
+# Frontend build-time vars (baked into the bundle by Vite)
+VITE_APP_TITLE="Canary Token Generator"
+VITE_API_URL=/api
+
+# ---------------------------------------------------------------------------
+# Cloudflare Turnstile (free anti-bot)
+# ---------------------------------------------------------------------------
+# Get keys from https://dash.cloudflare.com/?to=/:account/turnstile
+# Leave blank to disable Turnstile in development.
+TURNSTILE_SITE_KEY=
+TURNSTILE_SECRET=
+# Mirror of TURNSTILE_SITE_KEY for frontend (must be the same value)
+VITE_TURNSTILE_SITE_KEY=
+
+# ---------------------------------------------------------------------------
+# Operator (you) — for /api/admin/* endpoints
+# ---------------------------------------------------------------------------
+# Auto-generated by scripts/init.sh if blank.
+# Send as `Authorization: Bearer <token>` to access admin endpoints.
+OPERATOR_TOKEN=
+
+# ---------------------------------------------------------------------------
+# Postgres
+# ---------------------------------------------------------------------------
+# Auto-generated by scripts/init.sh if blank.
+POSTGRES_PASSWORD=
+
+# Dev-only Postgres host port (preserves randomized assignment across projects)
+POSTGRES_DEV_PORT=5447
+
+# ---------------------------------------------------------------------------
+# Redis (dev host port)
+# ---------------------------------------------------------------------------
+REDIS_DEV_PORT=6022
+
+# ---------------------------------------------------------------------------
+# GeoIP (optional — geolocation enrichment of triggered events)
+# ---------------------------------------------------------------------------
+# Register free at https://www.maxmind.com/en/geolite2/signup
+# scripts/init.sh fetches GeoLite2-City.mmdb when both vars are set.
+MAXMIND_ACCOUNT_ID=
+MAXMIND_LICENSE_KEY=
+
+# ---------------------------------------------------------------------------
+# Webhooks (optional)
+# ---------------------------------------------------------------------------
+# When set, webhook payloads are signed with HMAC-SHA256 and an
+# X-Canary-Signature header is added.
+WEBHOOK_HMAC_SECRET=
+
+# ---------------------------------------------------------------------------
+# Fake MySQL TCP server (optional)
+# ---------------------------------------------------------------------------
+# Cloudflare Tunnel does not carry raw TCP — only enable when the canary
+# container's port 3306 is reachable directly (e.g. on a VPS).
+MYSQL_FAKE_ENABLED=false
+MYSQL_HOST_PORT=33606
+
+# ---------------------------------------------------------------------------
+# Logging
+# ---------------------------------------------------------------------------
+LOG_LEVEL=info
+LOG_FORMAT=json
+
+# ---------------------------------------------------------------------------
+# OpenTelemetry (optional — dev compose runs Jaeger)
+# ---------------------------------------------------------------------------
+OTEL_ENABLED=false
+OTEL_EXPORTER_OTLP_ENDPOINT=
+
+# Dev port overrides for jaeger (preserve randomized values)
+JAEGER_UI_PORT=16686
+JAEGER_OTLP_GRPC_PORT=4317
+JAEGER_OTLP_HTTP_PORT=4318
+
+# ---------------------------------------------------------------------------
+# Frontend dev (vite host port)
+# ---------------------------------------------------------------------------
+FRONTEND_HOST_PORT=15723
+
+# ---------------------------------------------------------------------------
+# Cloudflare Tunnel (overlay)
+# ---------------------------------------------------------------------------
+# Required if using cloudflared.compose.yml; obtain from Cloudflare Zero Trust dashboard.
+CLOUDFLARE_TUNNEL_TOKEN=
diff --git a/PROJECTS/beginner/canary-token-generator/.gitignore b/PROJECTS/beginner/canary-token-generator/.gitignore
new file mode 100644
index 00000000..b20c3a8d
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/.gitignore
@@ -0,0 +1,83 @@
+# ©AngelaMos | 2026
+# .gitignore
+
+# ----------------------------------------------------------------------------
+# Dev-only documentation (never committed)
+# ----------------------------------------------------------------------------
+docs/
+
+# ----------------------------------------------------------------------------
+# Environment files (secrets)
+# ----------------------------------------------------------------------------
+.env
+.env.*
+!.env.example
+
+# ----------------------------------------------------------------------------
+# Backend (Go)
+# ----------------------------------------------------------------------------
+backend/bin/
+backend/tmp/
+backend/*.test
+backend/coverage.out
+backend/coverage.html
+backend/.golangci-cache/
+backend/data/
+backend/keys/
+# stray binaries from `go build ./cmd/<name>` run in backend/
+backend/canary
+backend/healthcheck
+backend/buildpdftemplate
+backend/builddocxtemplate
+
+# ----------------------------------------------------------------------------
+# Frontend (Node / Vite)
+# ----------------------------------------------------------------------------
+frontend/node_modules/
+frontend/dist/
+frontend/.vite/
+frontend/.vite-temp/
+frontend/.tmp/
+frontend/.biome_cache/
+frontend/.turbo/
+frontend/coverage/
+
+# ----------------------------------------------------------------------------
+# Local data volumes (when bind-mounted)
+# ----------------------------------------------------------------------------
+data/
+*.mmdb
+*.db
+*.sqlite
+*.sqlite3
+
+# ----------------------------------------------------------------------------
+# OS / Editor
+# ----------------------------------------------------------------------------
+.DS_Store
+Thumbs.db
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# ----------------------------------------------------------------------------
+# Logs
+# ----------------------------------------------------------------------------
+*.log
+logs/
+
+# ----------------------------------------------------------------------------
+# Generic build artifacts
+# ----------------------------------------------------------------------------
+dist/
+build/
+bin/
+
+# ----------------------------------------------------------------------------
+# Linter / pre-commit caches
+# ----------------------------------------------------------------------------
+.cache/
+.pre-commit-cache/
+.ruff_cache/
diff --git a/PROJECTS/beginner/canary-token-generator/README.md b/PROJECTS/beginner/canary-token-generator/README.md
new file mode 100644
index 00000000..baa2f30d
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/README.md
@@ -0,0 +1,154 @@
+```yaml
+ ██████╗ █████╗ ███╗   ██╗ █████╗ ██████╗ ██╗   ██╗
+██╔════╝██╔══██╗████╗  ██║██╔══██╗██╔══██╗╚██╗ ██╔╝
+██║     ███████║██╔██╗ ██║███████║██████╔╝ ╚████╔╝
+██║     ██╔══██║██║╚██╗██║██╔══██║██╔══██╗  ╚██╔╝
+╚██████╗██║  ██║██║ ╚████║██║  ██║██║  ██║   ██║
+ ╚═════╝╚═╝  ╚═╝╚═╝  ╚═══╝╚═╝  ╚═╝╚═╝  ╚═╝   ╚═╝
+```
+
+[![Cybersecurity Projects](https://img.shields.io/badge/Cybersecurity--Projects-Project%20%2332-red?style=flat&logo=github)](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/main/PROJECTS/beginner/canary-token-generator)
+[![Go](https://img.shields.io/badge/Go-1.25+-00ADD8?style=flat&logo=go&logoColor=white)](https://go.dev)
+[![React](https://img.shields.io/badge/React-19-61DAFB?style=flat&logo=react&logoColor=black)](https://react.dev)
+[![PostgreSQL](https://img.shields.io/badge/PostgreSQL-18-4169E1?style=flat&logo=postgresql&logoColor=white)](https://www.postgresql.org)
+[![Redis](https://img.shields.io/badge/Redis-7-DC382D?style=flat&logo=redis&logoColor=white)](https://redis.io)
+[![License: AGPLv3](https://img.shields.io/badge/License-AGPL_v3-purple.svg)](https://www.gnu.org/licenses/agpl-3.0)
+[![Docker](https://img.shields.io/badge/Docker-ready-2496ED?style=flat&logo=docker)](https://www.docker.com)
+[![MITRE Engage](https://img.shields.io/badge/MITRE-Engage-red?style=flat)](https://engage.mitre.org/)
+
+[![Live Demo](https://img.shields.io/badge/Live-iglowinthedark.com-green?style=flat&logo=googlechrome)](https://iglowinthedark.com/)
+
+> Self-hosted honeytoken generator. Mints seven kinds of tripwire artifacts — invisible web bugs, booby-trapped PDF/DOCX files, fake `.env` and kubeconfig credentials, and a real MySQL wire-protocol decoy — then alerts you on Telegram or a webhook the moment an attacker touches one.
+
+*This is a quick overview — security theory, architecture, and full walkthroughs are in the [learn modules](#learn).*
+
+## What It Does
+
+- Seven token types, each disguised as something an attacker would actually try to use: `webbug`, `slowredirect`, `pdf`, `docx`, `envfile`, `kubeconfig`, and a real `mysql` listener that speaks the MySQL v10 handshake
+- Per-token Telegram or webhook alerts the instant a token fires (HMAC-signed for webhooks)
+- Async notification worker pool with per-channel timeouts and dedup gating (15-minute Redis silence window per `{token, source_ip}` so a curious attacker reloading the page doesn't spam you)
+- GeoIP enrichment via MaxMind GeoLite2 (country, region, city, ASN, ASN org) attached to every event
+- Browser fingerprint capture for `slowredirect` tokens via a 3-second JS-collection interstitial before the redirect resolves
+- Public manage URL (UUID-gated) so you can share a single link with a teammate to view triggers without exposing operator credentials
+- Operator-only admin API (constant-time bearer comparison) for global stats, token listing, and force-disable
+- Cloudflare Turnstile on token creation, dual-window rate limiting (per-minute + per-hour) keyed by browser fingerprint
+- Optional Cloudflare Tunnel overlay — expose the service publicly without opening a port or maintaining a TLS cert
+- Defense-grade observability: OpenTelemetry traces, slog structured logs, `/healthz` liveness, graceful shutdown with load-balancer drain delay
+
+## Quick Start
+
+```bash
+just init       # generates .env, .env.development, randomised ports, operator token
+just dev-up     # launches nginx + Vite HMR + Go (Air hot-reload) + Postgres + Redis + Jaeger
+```
+
+Open the URL printed by `just init` (typically `http://localhost:22784`). Mint a token, watch the manage page, then trigger it from another tab and refresh.
+or the live demo at [iglowinthedark.com](https://iglowinthedark.com/)
+
+> [!TIP]
+> This project uses [`just`](https://github.com/casey/just) as a command runner. Type `just` to see every available recipe grouped by area.
+>
+> Install: `curl -sSf https://just.systems/install.sh | bash -s -- --to ~/.local/bin`
+
+## Token Types
+
+| Type | Artifact | Trigger Mechanism | Where You'd Plant It |
+|------|----------|-------------------|----------------------|
+| `webbug` | URL to a 1x1 JPEG | Any HTTP GET on the URL | HTML emails, internal wikis, "do-not-touch" docs |
+| `slowredirect` | URL with a delayed redirect | Click-through; runs fingerprint JS before redirecting to a real destination | Phishing-bait links in honeyfile chat threads, fake admin panel URLs |
+| `pdf` | Patched PDF | Acrobat opens, fires `/AA /O /URI` page-open action | `payroll-q3.pdf` on a shared drive, `vpn-creds.pdf` on a workstation |
+| `docx` | Patched Word doc | Word/LibreOffice loads the footer, which contains a remote URI | `customer-list.docx`, `passwords.docx` in `Documents/` |
+| `envfile` | Plain-text `.env` | Attacker `curl`s the fake `INTERNAL_METRICS_ENDPOINT` baked into the file | Repository roots, `~/.config/`, container `/app/` directories |
+| `kubeconfig` | YAML kubeconfig | Attacker runs `kubectl --kubeconfig=stolen.yaml ...` and our server logs the bearer token | `~/.kube/config`, ops engineer laptops, CI runner home dirs |
+| `mysql` | `mysql://...` connection string | Attacker connects with `mysql` CLI; our TCP listener replies with a real MySQL v10 handshake and an `Access denied` packet | `.env` files, `database.yml`, internal wiki snippets |
+
+The `envfile` generator is the densest of the bunch. It picks recipes from `aws.go`, `db.go`, `github.go`, and `stripe.go`, shuffles the resulting sections, and buries a single canary line (`INTERNAL_METRICS_ENDPOINT=https://your-host/c/{tokenID}`) among plausible production config. The attacker harvesting the file gets a fistful of fake secrets to chase *and* trips the wire as soon as one of those secrets is touched.
+
+## HTTP API
+
+Token creation, manage view, and admin are mounted under `/api/`. Trigger routes live at the root so artifacts can carry short URLs.
+
+| Method | Path | Auth | Purpose |
+|--------|------|------|---------|
+| `POST` | `/api/tokens` | Turnstile + rate limit | Mint a new token (`type`, `memo`, `alert_channel`, channel config, type-specific metadata) |
+| `GET` | `/api/tokens/types` | Public | List available token types and their metadata schemas |
+| `GET` | `/api/m/{manageId}` | Manage UUID | Token details + paginated event feed + dedup silence counter |
+| `DELETE` | `/api/m/{manageId}` | Manage UUID | Soft-disable the token (events stop, history retained) |
+| `GET` | `/api/admin/stats` | Bearer | Tokens count, events count, breakdowns by type and alert channel |
+| `GET` | `/api/admin/tokens` | Bearer | All tokens (offset paginated) |
+| `POST` | `/api/admin/tokens/{id}/disable` | Bearer | Force-disable any token |
+| `GET` | `/healthz` | Public | Liveness + readiness probe (used by Docker healthchecks) |
+| `GET` | `/c/{tokenID}` | Public | **Trigger route.** Records event, fires notification, returns artifact body (pixel, GIF, HTML interstitial, etc.) |
+| `POST` | `/c/{tokenID}/fingerprint` | Public | Receives JSON fingerprint payload from the `slowredirect` interstitial |
+| `*` | `/k/{tokenID}[/*]` | Public | Kubeconfig trigger — matches `kubectl`'s wildcard API paths |
+
+The MySQL listener does not run on HTTP. It's a separate TCP server bound to a configurable address; an attacker using the connection string from the artifact will speak the MySQL wire protocol with our `protocol.go` handshake builder before getting denied.
+
+## Stack
+
+**Backend:** Go 1.25, chi router, pgx + sqlx, goose migrations, koanf config, slog, validator/v10, OpenTelemetry, pdfcpu, MaxMind GeoLite2, miniredis (tests), testcontainers (integration)
+
+**Frontend:** React 19, TypeScript, Vite, TanStack Query, Zod, Axios, Biome, Stylelint
+
+**Storage:** PostgreSQL 18 (`tokens`, `events` tables; INET + JSONB columns), Redis 7 (dedup gate + rate-limit token buckets)
+
+**Infra:** Docker Compose (dev: nginx + Vite HMR + Air + Postgres + Redis + Jaeger; prod: nginx + Go binary + Postgres + Redis), optional `cloudflared` overlay
+
+## Project Layout
+
+```
+canary-token-generator/
+├── backend/
+│   ├── cmd/canary/                main.go — wiring, signal handling, MySQL listener spawn, retention loop
+│   └── internal/
+│       ├── token/                 Service, repository, handler, generator interface
+│       │   └── generators/
+│       │       ├── webbug/        Embedded JPEG pixel
+│       │       ├── pixel/         Shared 1x1 GIF helper used by every "visited" response
+│       │       ├── pdf/           Byte-exact PDF placeholder substitution (76-byte URL window)
+│       │       ├── docx/          ZIP-aware footer rewrite
+│       │       ├── envfile/       Recipe shuffler + canary line injection
+│       │       │   └── recipes/   aws.go, db.go, github.go, stripe.go
+│       │       ├── kubeconfig/    text/template renderer + wildcard /k/ handler
+│       │       ├── mysql/         protocol.go (handshake + auth + err packets), server.go (TCP), handler.go
+│       │       └── slowredirect/  HTML interstitial + fingerprint POST handler
+│       ├── event/                 Event entity, service (geo enrich → insert → dedup → notify), repository
+│       ├── notify/                Worker pool, queue, status writer
+│       │   ├── webhook/           HMAC-signed POSTs with exponential backoff
+│       │   └── telegram/          Bot API client
+│       ├── middleware/            request_id, logging, recovery, realip, fingerprint, ratelimit, turnstile, operator_bearer, headers
+│       ├── geoip/                 MaxMind MMDB lookup wrapper (nop when no DB present)
+│       ├── turnstile/             Cloudflare Turnstile siteverify
+│       ├── admin/                 Stats, listing, force-disable
+│       ├── core/                  DB pool, Redis client, migrations, telemetry, errors, validation, response envelopes
+│       ├── health/                /healthz handler with readiness/shutdown flags
+│       └── server/                chi router shell with graceful shutdown + drain delay
+├── frontend/
+│   └── src/
+│       ├── pages/landing/         Token creation form (type-aware metadata, Turnstile widget, artifact reveal)
+│       └── pages/manage/          Token detail + event table (cursor paginated, GeoIP cells, dedup silence)
+├── infra/
+│   ├── nginx/                     prod.nginx, dev.nginx (Vite proxy)
+│   └── docker/                    Dockerfiles for prod binary, Air hot-reload, Vite HMR
+├── compose.yml                    Production stack
+├── dev.compose.yml                Dev stack with Jaeger
+├── cloudflared.compose.yml        Tunnel overlay
+├── justfile                       Recipes grouped by frontend / backend / lint / compose / tunnel / dev / util
+└── learn/                         You are here
+```
+
+## Learn
+
+This project includes step-by-step learning materials covering deception theory, token mechanics, system design, and a code walkthrough.
+
+| Module | Topic |
+|--------|-------|
+| [00 - Overview](learn/00-OVERVIEW.md) | Prerequisites, quick start, project structure |
+| [01 - Concepts](learn/01-CONCEPTS.md) | Honeytokens, deception defense, Thinkst Canary, MITRE Engage, real breaches |
+| [02 - Architecture](learn/02-ARCHITECTURE.md) | System design, request lifecycle, schema, dedup gate, notification pipeline |
+| [03 - Implementation](learn/03-IMPLEMENTATION.md) | Code walkthrough: generators, trigger handler, event service, MySQL protocol |
+| [04 - Challenges](learn/04-CHALLENGES.md) | Extension ideas — new token types, alert channels, evasion-resistance |
+
+## License
+
+AGPL 3.0
diff --git a/PROJECTS/beginner/canary-token-generator/backend/.air.toml b/PROJECTS/beginner/canary-token-generator/backend/.air.toml
new file mode 100644
index 00000000..14654197
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/.air.toml
@@ -0,0 +1,29 @@
+# ©AngelaMos | 2026
+# .air.toml - Hot reload configuration
+
+root = "."
+tmp_dir = "tmp"
+
+[build]
+cmd = "go build -o ./tmp/main ./cmd/canary"
+bin = "tmp/main"
+full_bin = "./tmp/main"
+include_ext = ["go", "yaml", "yml"]
+exclude_dir = ["tmp", "vendor", "bin", "keys", "migrations"]
+exclude_regex = ["_test\\.go"]
+delay = 1000
+stop_on_error = true
+send_interrupt = true
+kill_delay = 500
+
+[log]
+time = false
+
+[color]
+main = "cyan"
+watcher = "magenta"
+build = "yellow"
+runner = "green"
+
+[misc]
+clean_on_exit = true
diff --git a/PROJECTS/beginner/canary-token-generator/backend/.gitignore b/PROJECTS/beginner/canary-token-generator/backend/.gitignore
new file mode 100644
index 00000000..ba808b80
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/.gitignore
@@ -0,0 +1,40 @@
+# ©AngelaMos | 2026
+# .gitignore
+
+# Binaries
+bin/
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test
+*.test
+coverage.out
+coverage.html
+
+# Build
+tmp/
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Environment
+.env
+.env.local
+.env.*.local
+
+# Vendor (if using)
+vendor/
+
+# Debug
+__debug_bin*
diff --git a/PROJECTS/beginner/canary-token-generator/backend/.golangci.yml b/PROJECTS/beginner/canary-token-generator/backend/.golangci.yml
new file mode 100644
index 00000000..b1e1ef48
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/.golangci.yml
@@ -0,0 +1,132 @@
+# ©AngelaMos | 2026
+# .golangci.yml
+
+version: "2"
+
+linters:
+  default: none
+  enable:
+    - errcheck
+    - govet
+    - gosec
+    - bodyclose
+    - nilerr
+    - errorlint
+    - exhaustive
+    - gocritic
+    - funlen
+    - gocognit
+    - dupl
+    - goconst
+    - ineffassign
+    - unused
+    - unconvert
+    - unparam
+    - testifylint
+    - fatcontext
+
+  settings:
+    errcheck:
+      check-type-assertions: true
+      check-blank: true
+
+    funlen:
+      lines: 100
+      statements: 50
+
+    gocognit:
+      min-complexity: 20
+
+    govet:
+      enable-all: true
+      disable:
+        - fieldalignment
+
+    revive:
+      rules:
+        - name: blank-imports
+        - name: context-as-argument
+        - name: context-keys-type
+        - name: error-return
+        - name: error-strings
+        - name: error-naming
+        - name: exported
+        - name: increment-decrement
+        - name: var-declaration
+        - name: package-comments
+          disabled: true
+        - name: range
+        - name: receiver-naming
+        - name: time-naming
+        - name: unexported-return
+        - name: indent-error-flow
+        - name: errorf
+        - name: empty-block
+        - name: superfluous-else
+        - name: unreachable-code
+
+    staticcheck:
+      checks:
+        - all
+
+    gosec:
+      excludes:
+        - G104
+        - G706
+
+    sloglint:
+      no-mixed-args: true
+      kv-only: true
+      context: all
+
+  exclusions:
+    paths:
+      - vendor
+      - testdata
+    rules:
+      - path: _test\.go
+        linters:
+          - funlen
+          - dupl
+          - goconst
+      - path: internal/notify/telegram/sender\.go
+        linters:
+          - gosec
+        text: "G107|G704"
+      - path: internal/notify/webhook/sender\.go
+        linters:
+          - gosec
+        text: "G107|G704"
+      - path: internal/turnstile/verifier\.go
+        linters:
+          - gosec
+        text: "G107|G704"
+      - path: internal/config/config\.go
+        linters:
+          - gosec
+        text: "G101"
+
+issues:
+  max-same-issues: 50
+
+
+formatters:
+  enable:
+    - gci        # Groups imports
+    - gofumpt    # Whitespace
+    - golines    # Vertical wrap
+  settings:
+    golines:
+      max-len: 80
+      reformat-tags: true
+    goimports:
+      local-prefixes:
+        - github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator
+    gci:
+      sections:
+        - standard
+        - default
+        - prefix(github.com/CarterPerez-dev)
+      custom-order: true
+    gofumpt:
+      extra-rules: true
diff --git a/PROJECTS/beginner/canary-token-generator/backend/cmd/builddocxtemplate/main.go b/PROJECTS/beginner/canary-token-generator/backend/cmd/builddocxtemplate/main.go
new file mode 100644
index 00000000..23aa207b
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/cmd/builddocxtemplate/main.go
@@ -0,0 +1,136 @@
+// ©AngelaMos | 2026
+// main.go
+
+package main
+
+import (
+	"archive/zip"
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+)
+
+const (
+	contentTypesXML = `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">
+  <Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>
+  <Default Extension="xml" ContentType="application/xml"/>
+  <Override PartName="/word/document.xml" ContentType="application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml"/>
+  <Override PartName="/word/footer2.xml" ContentType="application/vnd.openxmlformats-officedocument.wordprocessingml.footer+xml"/>
+</Types>
+`
+
+	packageRelsXML = `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
+  <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="word/document.xml"/>
+</Relationships>
+`
+
+	documentXML = `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<w:document xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">
+  <w:body>
+    <w:p><w:r><w:t xml:space="preserve">Internal document - confidential. Do not redistribute.</w:t></w:r></w:p>
+    <w:sectPr>
+      <w:footerReference w:type="default" r:id="rIdFooter"/>
+      <w:pgSz w:w="12240" w:h="15840"/>
+      <w:pgMar w:top="1440" w:right="1440" w:bottom="1440" w:left="1440" w:header="720" w:footer="720" w:gutter="0"/>
+    </w:sectPr>
+  </w:body>
+</w:document>
+`
+
+	documentRelsXML = `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
+  <Relationship Id="rIdFooter" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/footer" Target="footer2.xml"/>
+</Relationships>
+`
+
+	footer2XML = `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<w:ftr xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main">
+  <w:p>
+    <w:r><w:fldChar w:fldCharType="begin"/></w:r>
+    <w:r><w:instrText xml:space="preserve"> INCLUDEPICTURE "HONEY_TRACK_URL" \d \* MERGEFORMAT </w:instrText></w:r>
+    <w:r><w:fldChar w:fldCharType="end"/></w:r>
+  </w:p>
+</w:ftr>
+`
+
+	pathContentTypes = "[Content_Types].xml"
+	pathPackageRels  = "_rels/.rels"
+	pathDocument     = "word/document.xml"
+	pathDocumentRels = "word/_rels/document.xml.rels"
+	pathFooter2      = "word/footer2.xml"
+
+	dirPerm  os.FileMode = 0o755
+	filePerm os.FileMode = 0o644
+)
+
+type entry struct {
+	name   string
+	body   string
+	method uint16
+}
+
+func entries() []entry {
+	return []entry{
+		{name: pathContentTypes, body: contentTypesXML, method: zip.Store},
+		{name: pathPackageRels, body: packageRelsXML, method: zip.Deflate},
+		{name: pathDocument, body: documentXML, method: zip.Deflate},
+		{name: pathDocumentRels, body: documentRelsXML, method: zip.Store},
+		{name: pathFooter2, body: footer2XML, method: zip.Deflate},
+	}
+}
+
+func main() {
+	out := flag.String("out", "", "output path for template.docx")
+	flag.Parse()
+
+	if *out == "" {
+		log.Fatal("usage: builddocxtemplate -out <path>")
+	}
+
+	if err := buildTemplate(*out); err != nil {
+		log.Fatalf("build docx template: %v", err)
+	}
+
+	fmt.Printf("wrote %s\n", *out)
+}
+
+func buildTemplate(out string) (err error) {
+	cleaned := filepath.Clean(out)
+	if mkErr := os.MkdirAll(filepath.Dir(cleaned), dirPerm); mkErr != nil {
+		return fmt.Errorf("mkdir parent: %w", mkErr)
+	}
+
+	f, oErr := os.OpenFile(
+		cleaned,
+		os.O_CREATE|os.O_TRUNC|os.O_WRONLY,
+		filePerm,
+	)
+	if oErr != nil {
+		return fmt.Errorf("open output: %w", oErr)
+	}
+	defer func() {
+		if cerr := f.Close(); cerr != nil && err == nil {
+			err = fmt.Errorf("close output: %w", cerr)
+		}
+	}()
+
+	w := zip.NewWriter(f)
+	for _, e := range entries() {
+		hdr := &zip.FileHeader{Name: e.name, Method: e.method}
+		fw, cErr := w.CreateHeader(hdr)
+		if cErr != nil {
+			return fmt.Errorf("create %s: %w", e.name, cErr)
+		}
+		if _, wErr := fw.Write([]byte(e.body)); wErr != nil {
+			return fmt.Errorf("write %s: %w", e.name, wErr)
+		}
+	}
+	if zErr := w.Close(); zErr != nil {
+		return fmt.Errorf("close zip writer: %w", zErr)
+	}
+	return nil
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/cmd/buildpdftemplate/main.go b/PROJECTS/beginner/canary-token-generator/backend/cmd/buildpdftemplate/main.go
new file mode 100644
index 00000000..fdc604bb
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/cmd/buildpdftemplate/main.go
@@ -0,0 +1,154 @@
+// ©AngelaMos | 2026
+// main.go
+
+package main
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/pdfcpu/pdfcpu/pkg/api"
+)
+
+const (
+	placeholderRoot   = "HONEY_TRACK_URL_PADDED_TO_FIXED_WIDTH"
+	placeholderLength = 76
+
+	pdfHeader = "%PDF-1.4\n%\xe2\xe3\xcf\xd3\n"
+
+	objCatalog = "1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n"
+	objPages   = "2 0 obj\n<< /Type /Pages /Kids [3 0 R] /Count 1 >>\nendobj\n"
+
+	pageDictFmt = "3 0 obj\n" +
+		"<<\n" +
+		"/Type /Page\n" +
+		"/Parent 2 0 R\n" +
+		"/MediaBox [0 0 612 792]\n" +
+		"/Resources << >>\n" +
+		"/AA << /O << /Type /Action /S /URI /URI (%s) >> >>\n" +
+		">>\nendobj\n"
+
+	xrefHeader     = "xref\n0 4\n"
+	xrefFreeRecord = "0000000000 65535 f \n"
+	xrefRecordFmt  = "%010d 00000 n \n"
+
+	trailerFmt = "trailer\n<< /Size 4 /Root 1 0 R >>\nstartxref\n%d\n%%%%EOF\n"
+
+	dirPerm  os.FileMode = 0o755
+	filePerm os.FileMode = 0o644
+)
+
+func placeholder() string {
+	return placeholderRoot +
+		strings.Repeat("_", placeholderLength-len(placeholderRoot))
+}
+
+func main() {
+	out := flag.String("out", "", "output path for template.pdf")
+	flag.Parse()
+
+	if *out == "" {
+		log.Fatal("usage: buildpdftemplate -out <path>")
+	}
+
+	if err := buildTemplate(*out); err != nil {
+		log.Fatalf("build pdf template: %v", err)
+	}
+
+	fmt.Printf("wrote %s\n", *out)
+}
+
+func buildTemplate(out string) (err error) {
+	cleaned := filepath.Clean(out)
+	if mkErr := os.MkdirAll(filepath.Dir(cleaned), dirPerm); mkErr != nil {
+		return fmt.Errorf("mkdir parent: %w", mkErr)
+	}
+
+	pdfBytes := assemblePDF()
+
+	if vErr := api.Validate(
+		bytes.NewReader(pdfBytes),
+		nil,
+	); vErr != nil {
+		return fmt.Errorf("pdfcpu validate: %w", vErr)
+	}
+
+	full := placeholder()
+	if c := bytes.Count(pdfBytes, []byte(full)); c != 1 {
+		return fmt.Errorf(
+			"full placeholder appears %d times, expected exactly 1",
+			c,
+		)
+	}
+	if c := bytes.Count(pdfBytes, []byte(placeholderRoot)); c != 1 {
+		return fmt.Errorf(
+			"placeholder root appears %d times, expected exactly 1",
+			c,
+		)
+	}
+	if len(full) != placeholderLength {
+		return fmt.Errorf(
+			"placeholder length is %d, expected %d",
+			len(full),
+			placeholderLength,
+		)
+	}
+
+	f, oErr := os.OpenFile(
+		cleaned,
+		os.O_CREATE|os.O_TRUNC|os.O_WRONLY,
+		filePerm,
+	)
+	if oErr != nil {
+		return fmt.Errorf("open output: %w", oErr)
+	}
+	defer func() {
+		if cerr := f.Close(); cerr != nil && err == nil {
+			err = fmt.Errorf("close output: %w", cerr)
+		}
+	}()
+
+	if _, wErr := f.Write(pdfBytes); wErr != nil {
+		return fmt.Errorf("write pdf: %w", wErr)
+	}
+
+	sum := sha256.Sum256(pdfBytes)
+	fmt.Printf("sha256: %x\n", sum)
+	fmt.Printf("size:   %d bytes\n", len(pdfBytes))
+	return nil
+}
+
+func assemblePDF() []byte {
+	pageObj := fmt.Sprintf(pageDictFmt, placeholder())
+
+	var buf bytes.Buffer
+	buf.WriteString(pdfHeader)
+
+	offsets := make([]int, 4)
+
+	offsets[1] = buf.Len()
+	buf.WriteString(objCatalog)
+
+	offsets[2] = buf.Len()
+	buf.WriteString(objPages)
+
+	offsets[3] = buf.Len()
+	buf.WriteString(pageObj)
+
+	xrefOffset := buf.Len()
+	buf.WriteString(xrefHeader)
+	buf.WriteString(xrefFreeRecord)
+	for i := 1; i <= 3; i++ {
+		fmt.Fprintf(&buf, xrefRecordFmt, offsets[i])
+	}
+
+	fmt.Fprintf(&buf, trailerFmt, xrefOffset)
+
+	return buf.Bytes()
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/cmd/canary/main.go b/PROJECTS/beginner/canary-token-generator/backend/cmd/canary/main.go
new file mode 100644
index 00000000..920383a6
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/cmd/canary/main.go
@@ -0,0 +1,506 @@
+// ©AngelaMos | 2026
+// main.go
+
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"os"
+	"os/signal"
+	"sync"
+	"syscall"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/admin"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/config"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/core"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/geoip"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/health"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/middleware"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/notify"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/notify/telegram"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/notify/webhook"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/server"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/mysql"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/registry"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/turnstile"
+)
+
+const (
+	drainDelay         = 5 * time.Second
+	shutdownGraceExtra = 5 * time.Second
+)
+
+func main() {
+	configPath := flag.String("config", "config.yaml", "path to config file")
+	flag.Parse()
+
+	if err := run(*configPath); err != nil {
+		slog.Error("application error", "error", err)
+		os.Exit(1)
+	}
+}
+
+func run(configPath string) error {
+	ctx, stop := signal.NotifyContext(
+		context.Background(),
+		syscall.SIGINT,
+		syscall.SIGTERM,
+	)
+	defer stop()
+
+	cfg, err := config.Load(configPath)
+	if err != nil {
+		return err
+	}
+
+	logger := setupLogger(cfg.Log)
+	slog.SetDefault(logger)
+	logger.Info("starting canary-token-generator",
+		"version", cfg.App.Version,
+		"environment", cfg.App.Environment,
+	)
+
+	if err = middleware.SetTrustedProxyCIDRs(
+		cfg.Server.TrustedProxyCIDRs,
+	); err != nil {
+		return fmt.Errorf("trusted proxy cidrs: %w", err)
+	}
+
+	telemetry := initTelemetry(ctx, cfg, logger)
+
+	db, err := core.NewDatabase(ctx, cfg.Database)
+	if err != nil {
+		return err
+	}
+	logger.Info("database connected")
+
+	if err = core.RunMigrations(db.SQLDB()); err != nil {
+		return fmt.Errorf("run migrations: %w", err)
+	}
+	logger.Info("migrations applied")
+
+	tokenRepo := token.NewRepository(db.DB)
+	eventRepo := event.NewRepository(db.DB)
+
+	rdb, err := core.NewRedis(ctx, cfg.Redis)
+	if err != nil {
+		return err
+	}
+	logger.Info("redis connected")
+
+	geo, geoCloser := openGeoIP(cfg, logger)
+	defer geoCloser()
+
+	notifySvc, eventSvc := buildEventStack(
+		cfg, logger, eventRepo, tokenRepo, rdb, geo,
+	)
+	tokenSvc, verifier, healthH, tokenH := buildHTTPDeps(
+		cfg, logger, db, rdb, eventRepo, tokenRepo, eventSvc,
+	)
+	adminH := admin.NewHandler(tokenRepo, eventRepo, tokenSvc, logger)
+	srv := mountRouter(cfg, logger, rdb, healthH, tokenH, adminH, verifier)
+
+	var wg sync.WaitGroup
+	spawnMySQLListener(ctx, cfg, logger, &wg, tokenSvc, eventSvc)
+	spawnRetentionLoop(ctx, cfg, &wg, eventSvc)
+
+	errChan := make(chan error, 1)
+	go func() { errChan <- srv.Start() }()
+
+	select {
+	case startErr := <-errChan:
+		return startErr
+	case <-ctx.Done():
+		logger.Info("shutdown signal received")
+	}
+
+	shutdownErr := gracefulShutdown(cfg, logger, srv, telemetry, rdb, db)
+	logger.Info("waiting for in-flight notifications")
+	notifyShutdownCtx, notifyShutdownCancel := context.WithTimeout(
+		context.Background(),
+		cfg.Server.ShutdownTimeout,
+	)
+	if nErr := notifySvc.Shutdown(notifyShutdownCtx); nErr != nil {
+		logger.Warn("notify shutdown timed out", "error", nErr)
+	}
+	notifyShutdownCancel()
+	wg.Wait()
+	return shutdownErr
+}
+
+func buildHTTPDeps(
+	cfg *config.Config,
+	logger *slog.Logger,
+	db *core.Database,
+	rdb *core.Redis,
+	eventRepo *event.Repository,
+	tokenRepo *token.Repository,
+	eventSvc *event.Service,
+) (*token.Service, *turnstile.Verifier, *health.Handler, *token.Handler) {
+	genRegistry := registry.Build(registry.Config{
+		BaseURL:         cfg.Canary.BaseURL,
+		MySQLPublicHost: cfg.MySQL.PublicHost,
+		MySQLPublicPort: cfg.MySQL.PublicPort,
+	})
+	tokenSvc := token.NewService(
+		tokenRepo,
+		registryAdapter{r: genRegistry},
+		token.ServiceConfig{
+			BaseURL:   cfg.Canary.BaseURL,
+			ManageURL: cfg.Canary.ManageURL,
+		},
+	)
+	verifier := turnstile.NewVerifier(
+		turnstile.Config{SecretKey: cfg.Turnstile.SecretKey},
+		rdb.Client,
+	)
+	healthH := health.NewHandler(db, rdb)
+	tokenH := token.NewHandler(
+		tokenSvc,
+		&eventRecorderAdapter{svc: eventSvc},
+		&fingerprintRecorderAdapter{
+			repo:   eventRepo,
+			window: cfg.Notify.FingerprintWindow,
+		},
+		eventRepo,
+		eventSvc,
+		logger,
+		cfg.MySQL.Enabled,
+	)
+	return tokenSvc, verifier, healthH, tokenH
+}
+
+func buildEventStack(
+	cfg *config.Config,
+	logger *slog.Logger,
+	eventRepo *event.Repository,
+	tokenRepo *token.Repository,
+	rdb *core.Redis,
+	geo geoip.Lookuper,
+) (*notify.Service, *event.Service) {
+	tgSender := telegram.NewSender(telegram.Config{
+		APIBase:         cfg.Notify.TelegramAPIBase,
+		ManageURL:       cfg.Canary.ManageURL,
+		MaxTries:        cfg.Notify.MaxTries,
+		MaxElapsed:      cfg.Notify.MaxElapsed,
+		InitialInterval: cfg.Notify.InitialInterval,
+	})
+	whSender := webhook.NewSender(webhook.Config{
+		ManageURL:       cfg.Canary.ManageURL,
+		HMACSecret:      cfg.Notify.WebhookHMACSecret,
+		MaxTries:        cfg.Notify.MaxTries,
+		MaxElapsed:      cfg.Notify.MaxElapsed,
+		InitialInterval: cfg.Notify.InitialInterval,
+	})
+
+	notifySvc := notify.NewService(eventRepo,
+		notify.WithLogger(logger),
+		notify.WithSendTimeout(cfg.Notify.SendTimeout),
+	)
+	notifySvc.Register(tgSender, whSender)
+
+	eventSvc := event.NewService(
+		eventRepo,
+		tokenRepo,
+		rdb.Client,
+		notifySvc,
+		event.ServiceConfig{
+			DedupTTL: cfg.Notify.DedupTTL,
+			Logger:   logger,
+			GeoIP:    geo,
+		},
+	)
+	return notifySvc, eventSvc
+}
+
+func openGeoIP(
+	cfg *config.Config,
+	logger *slog.Logger,
+) (geoip.Lookuper, func()) {
+	svc, err := geoip.Open(cfg.GeoIP.Path)
+	if err != nil {
+		logger.Warn("geoip unavailable, enrichment disabled",
+			"path", cfg.GeoIP.Path, "error", err)
+		return geoip.NopService(), func() {}
+	}
+	logger.Info("geoip opened", "path", cfg.GeoIP.Path)
+	return svc, func() {
+		if cErr := svc.Close(); cErr != nil {
+			logger.Warn("geoip close error", "error", cErr)
+		}
+	}
+}
+
+func spawnMySQLListener(
+	ctx context.Context,
+	cfg *config.Config,
+	logger *slog.Logger,
+	wg *sync.WaitGroup,
+	tokenSvc *token.Service,
+	eventSvc *event.Service,
+) {
+	if !cfg.MySQL.Enabled {
+		return
+	}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		handler := mysql.NewHandler(
+			&mysqlTokenLookup{svc: tokenSvc},
+			&eventRecorderAdapter{svc: eventSvc},
+		)
+		if mErr := mysql.Run(ctx, cfg.MySQL.Addr, handler); mErr != nil {
+			logger.Error("mysql server error", "error", mErr)
+		}
+	}()
+}
+
+func spawnRetentionLoop(
+	ctx context.Context,
+	cfg *config.Config,
+	wg *sync.WaitGroup,
+	eventSvc *event.Service,
+) {
+	if cfg.Notify.RetentionInterval <= 0 || cfg.Notify.RetentionLimit <= 0 {
+		return
+	}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		eventSvc.RunRetentionLoop(
+			ctx,
+			cfg.Notify.RetentionInterval,
+			cfg.Notify.RetentionLimit,
+		)
+	}()
+}
+
+func mountRouter(
+	cfg *config.Config,
+	logger *slog.Logger,
+	rdb *core.Redis,
+	healthH *health.Handler,
+	tokenH *token.Handler,
+	adminH *admin.Handler,
+	verifier *turnstile.Verifier,
+) *server.Server {
+	srv := server.New(server.Config{
+		ServerConfig:  cfg.Server,
+		HealthHandler: healthH,
+		Logger:        logger,
+	})
+	r := srv.Router()
+
+	r.Use(middleware.RequestID)
+	r.Use(middleware.Logger(logger))
+	r.Use(middleware.Recovery(logger))
+	r.Use(middleware.SecurityHeaders(cfg.App.Environment == "production"))
+
+	healthH.RegisterRoutes(r)
+	tokenH.RegisterTriggerRoutes(r)
+
+	createMin := middleware.NewRateLimiter(
+		rdb.Client,
+		middleware.RateLimitConfig{
+			Limit: middleware.PerMinute(
+				cfg.RateLimit.CreateMinRate,
+				cfg.RateLimit.CreateMinBurst,
+			),
+			KeyFunc:  keyByCreateMin,
+			FailOpen: true,
+		},
+	).Handler
+	createHour := middleware.NewRateLimiter(
+		rdb.Client,
+		middleware.RateLimitConfig{
+			Limit: middleware.PerHour(
+				cfg.RateLimit.CreateHourRate,
+				cfg.RateLimit.CreateHourBurst,
+			),
+			KeyFunc:  keyByCreateHour,
+			FailOpen: true,
+		},
+	).Handler
+
+	r.Route("/api", func(api chi.Router) {
+		api.Use(middleware.CORS(cfg.CORS))
+		api.Use(
+			middleware.NewRateLimiter(rdb.Client, middleware.RateLimitConfig{
+				Limit: middleware.PerMinute(
+					cfg.RateLimit.Requests,
+					cfg.RateLimit.Burst,
+				),
+				KeyFunc:  middleware.KeyByFingerprint,
+				FailOpen: true,
+			}).Handler,
+		)
+		api.Get("/tokens/types", tokenH.GetTypes)
+		api.With(
+			createMin,
+			createHour,
+			middleware.TurnstileVerify(verifier),
+		).Post("/tokens", tokenH.CreateToken)
+		tokenH.RegisterManageRoutes(api)
+		mountAdminRoutes(api, cfg, logger, adminH)
+	})
+
+	return srv
+}
+
+func mountAdminRoutes(
+	api chi.Router,
+	cfg *config.Config,
+	logger *slog.Logger,
+	adminH *admin.Handler,
+) {
+	if cfg.Operator.Token == "" {
+		logger.Warn("operator admin endpoints disabled",
+			"reason", "OPERATOR_TOKEN unset")
+		return
+	}
+	api.Route("/admin", func(adm chi.Router) {
+		adm.Use(middleware.OperatorBearer(cfg.Operator.Token))
+		adminH.RegisterRoutes(adm)
+	})
+}
+
+func keyByCreateMin(r *http.Request) string {
+	return "ratelimit:create:min:" + middleware.ExtractFingerprint(r)
+}
+
+func keyByCreateHour(r *http.Request) string {
+	return "ratelimit:create:hour:" + middleware.ExtractFingerprint(r)
+}
+
+func gracefulShutdown(
+	cfg *config.Config,
+	logger *slog.Logger,
+	srv *server.Server,
+	telemetry *core.Telemetry,
+	rdb *core.Redis,
+	db *core.Database,
+) error {
+	shutdownCtx, cancel := context.WithTimeout(
+		context.Background(),
+		cfg.Server.ShutdownTimeout+drainDelay+shutdownGraceExtra,
+	)
+	defer cancel()
+
+	var errs []error
+	if err := srv.Shutdown(shutdownCtx, drainDelay); err != nil {
+		logger.Error("server shutdown error", "error", err)
+		errs = append(errs, fmt.Errorf("server shutdown: %w", err))
+	}
+	if telemetry != nil {
+		if err := telemetry.Shutdown(shutdownCtx); err != nil {
+			logger.Error("telemetry shutdown error", "error", err)
+			errs = append(errs, fmt.Errorf("telemetry shutdown: %w", err))
+		}
+	}
+	if err := rdb.Close(); err != nil {
+		logger.Error("redis close error", "error", err)
+		errs = append(errs, fmt.Errorf("redis close: %w", err))
+	}
+	if err := db.Close(); err != nil {
+		logger.Error("database close error", "error", err)
+		errs = append(errs, fmt.Errorf("database close: %w", err))
+	}
+
+	logger.Info("application stopped")
+	return errors.Join(errs...)
+}
+
+func initTelemetry(
+	ctx context.Context,
+	cfg *config.Config,
+	logger *slog.Logger,
+) *core.Telemetry {
+	if !cfg.Otel.Enabled {
+		return nil
+	}
+	t, err := core.NewTelemetry(ctx, cfg.Otel, cfg.App)
+	if err != nil {
+		logger.Warn("telemetry init failed", "error", err)
+		return nil
+	}
+	return t
+}
+
+func setupLogger(cfg config.LogConfig) *slog.Logger {
+	level := slog.LevelInfo
+	switch cfg.Level {
+	case "debug":
+		level = slog.LevelDebug
+	case "warn":
+		level = slog.LevelWarn
+	case "error":
+		level = slog.LevelError
+	}
+	opts := &slog.HandlerOptions{Level: level}
+
+	var handler slog.Handler
+	if cfg.Format == "json" {
+		handler = slog.NewJSONHandler(os.Stdout, opts)
+	} else {
+		handler = slog.NewTextHandler(os.Stdout, opts)
+	}
+	return slog.New(handler)
+}
+
+type registryAdapter struct{ r registry.Registry }
+
+func (a registryAdapter) Get(t token.Type) (token.Generator, bool) {
+	g, ok := a.r[t]
+	return g, ok
+}
+
+type eventRecorderAdapter struct {
+	svc *event.Service
+}
+
+func (a *eventRecorderAdapter) Record(
+	ctx context.Context,
+	t *token.Token,
+	evt *event.Event,
+) error {
+	return a.svc.Record(ctx, t.NotifyInfo(), evt)
+}
+
+type fingerprintRecorderAdapter struct {
+	repo   *event.Repository
+	window time.Duration
+}
+
+func (f *fingerprintRecorderAdapter) AttachFingerprint(
+	ctx context.Context,
+	tokenID, sourceIP string,
+	fingerprint json.RawMessage,
+) error {
+	return f.repo.AttachFingerprint(
+		ctx,
+		tokenID,
+		sourceIP,
+		fingerprint,
+		f.window,
+	)
+}
+
+type mysqlTokenLookup struct{ svc *token.Service }
+
+func (m *mysqlTokenLookup) GetByID(
+	ctx context.Context,
+	id string,
+) (*token.Token, error) {
+	return m.svc.GetByID(ctx, id)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/cmd/healthcheck/main.go b/PROJECTS/beginner/canary-token-generator/backend/cmd/healthcheck/main.go
new file mode 100644
index 00000000..316a34d6
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/cmd/healthcheck/main.go
@@ -0,0 +1,32 @@
+// ©AngelaMos | 2026
+// main.go
+
+package main
+
+import (
+	"net/http"
+	"os"
+	"time"
+)
+
+const (
+	healthURL  = "http://127.0.0.1:8080/healthz"
+	httpDialTO = 2 * time.Second
+)
+
+func main() {
+	os.Exit(run())
+}
+
+func run() int {
+	client := &http.Client{Timeout: httpDialTO}
+	resp, err := client.Get(healthURL)
+	if err != nil {
+		return 1
+	}
+	defer func() { _ = resp.Body.Close() }() //nolint:errcheck // healthcheck binary; close error not actionable
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return 1
+	}
+	return 0
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/config.yaml b/PROJECTS/beginner/canary-token-generator/backend/config.yaml
new file mode 100644
index 00000000..1b1fd5fe
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/config.yaml
@@ -0,0 +1,48 @@
+# ©AngelaMos | 2026
+# config.yaml - Default configuration
+
+app:
+  name: "Canary Token Generator"
+  version: "1.0.0"
+
+server:
+  host: "0.0.0.0"
+  port: 8080
+  read_timeout: 30s
+  write_timeout: 30s
+  idle_timeout: 120s
+  shutdown_timeout: 15s
+
+database:
+  max_open_conns: 25
+  max_idle_conns: 5
+  conn_max_lifetime: 1h
+  conn_max_idle_time: 30m
+
+redis:
+  pool_size: 10
+  min_idle_conns: 5
+
+rate_limit:
+  requests: 100
+  window: 1m
+  burst: 20
+
+cors:
+  allowed_origins:
+    - "http://localhost:3000"
+    - "http://localhost:3420"
+  allowed_methods:
+    - "GET"
+    - "POST"
+    - "PUT"
+    - "PATCH"
+    - "DELETE"
+    - "OPTIONS"
+  allowed_headers:
+    - "Accept"
+    - "Authorization"
+    - "Content-Type"
+    - "X-Request-ID"
+  allow_credentials: true
+  max_age: 300
diff --git a/PROJECTS/beginner/canary-token-generator/backend/go.mod b/PROJECTS/beginner/canary-token-generator/backend/go.mod
new file mode 100644
index 00000000..d03c0a3e
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/go.mod
@@ -0,0 +1,116 @@
+module github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend
+
+go 1.25.7
+
+require (
+	github.com/alicebob/miniredis/v2 v2.38.0
+	github.com/cenkalti/backoff/v5 v5.0.3
+	github.com/go-chi/chi/v5 v5.2.3
+	github.com/go-playground/validator/v10 v10.23.0
+	github.com/go-redis/redis_rate/v10 v10.0.1
+	github.com/google/uuid v1.6.0
+	github.com/jackc/pgx/v5 v5.9.2
+	github.com/jmoiron/sqlx v1.4.0
+	github.com/knadh/koanf/parsers/yaml v1.1.0
+	github.com/knadh/koanf/providers/env v1.1.0
+	github.com/knadh/koanf/providers/file v1.2.1
+	github.com/knadh/koanf/v2 v2.1.2
+	github.com/oschwald/geoip2-golang/v2 v2.1.0
+	github.com/pdfcpu/pdfcpu v0.12.1
+	github.com/pressly/goose/v3 v3.27.1
+	github.com/redis/go-redis/v9 v9.7.3
+	github.com/stretchr/testify v1.11.1
+	github.com/testcontainers/testcontainers-go v0.42.0
+	github.com/testcontainers/testcontainers-go/modules/postgres v0.42.0
+	go.opentelemetry.io/otel v1.43.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0
+	go.opentelemetry.io/otel/sdk v1.43.0
+	go.opentelemetry.io/otel/trace v1.43.0
+	golang.org/x/time v0.14.0
+	google.golang.org/grpc v1.80.0
+	gopkg.in/yaml.v3 v3.0.1
+)
+
+require (
+	dario.cat/mergo v1.0.2 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/containerd/log v0.1.0 // indirect
+	github.com/containerd/platforms v0.2.1 // indirect
+	github.com/cpuguy83/dockercfg v0.3.2 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/go-connections v0.7.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/ebitengine/purego v0.10.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-ole/go-ole v1.2.6 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 // indirect
+	github.com/hhrutter/lzw v1.0.0 // indirect
+	github.com/hhrutter/pkcs7 v0.2.2 // indirect
+	github.com/hhrutter/tiff v1.0.3 // indirect
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	github.com/klauspost/compress v1.18.5 // indirect
+	github.com/knadh/koanf/maps v0.1.2 // indirect
+	github.com/leodido/go-urn v1.4.0 // indirect
+	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
+	github.com/magiconair/properties v1.8.10 // indirect
+	github.com/mattn/go-runewidth v0.0.23 // indirect
+	github.com/mfridman/interpolate v0.0.2 // indirect
+	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/go-archive v0.2.0 // indirect
+	github.com/moby/moby/api v1.54.2 // indirect
+	github.com/moby/moby/client v0.4.1 // indirect
+	github.com/moby/patternmatcher v0.6.1 // indirect
+	github.com/moby/sys/sequential v0.6.0 // indirect
+	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
+	github.com/moby/term v0.5.2 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/oschwald/maxminddb-golang/v2 v2.1.1 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
+	github.com/sethvargo/go-retry v0.3.0 // indirect
+	github.com/shirou/gopsutil/v4 v4.26.3 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/tklauser/go-sysconf v0.3.16 // indirect
+	github.com/tklauser/numcpus v0.11.0 // indirect
+	github.com/yuin/gopher-lua v1.1.1 // indirect
+	github.com/yusufpapurcu/wmi v1.2.4 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 // indirect
+	go.opentelemetry.io/otel/metric v1.43.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.4.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/image v0.39.0 // indirect
+	golang.org/x/net v0.53.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260120221211-b8f7ae30c516 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+)
diff --git a/PROJECTS/beginner/canary-token-generator/backend/go.sum b/PROJECTS/beginner/canary-token-generator/backend/go.sum
new file mode 100644
index 00000000..ab762f4d
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/go.sum
@@ -0,0 +1,290 @@
+dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
+dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
+filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/alicebob/miniredis/v2 v2.38.0 h1:nZAzCR+Lj+Vxk4ZXzm2NuKq2O33RXj1XxJ2e2uP9jiw=
+github.com/alicebob/miniredis/v2 v2.38.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
+github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
+github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
+github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
+github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
+github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
+github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
+github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
+github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA=
+github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
+github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
+github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/docker/go-connections v0.7.0 h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf0mN39c=
+github.com/docker/go-connections v0.7.0/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
+github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
+github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/ebitengine/purego v0.10.0 h1:QIw4xfpWT6GWTzaW5XEKy3HXoqrJGx1ijYHzTF0/ISU=
+github.com/ebitengine/purego v0.10.0/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
+github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
+github.com/go-chi/chi/v5 v5.2.3 h1:WQIt9uxdsAbgIYgid+BpYc+liqQZGMHRaUwp0JUcvdE=
+github.com/go-chi/chi/v5 v5.2.3/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
+github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
+github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
+github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
+github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
+github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
+github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
+github.com/go-playground/validator/v10 v10.23.0 h1:/PwmTwZhS0dPkav3cdK9kV1FsAmrL8sThn8IHr/sO+o=
+github.com/go-playground/validator/v10 v10.23.0/go.mod h1:dbuPbCMFw/DrkbEynArYaCwl3amGuJotoKCe95atGMM=
+github.com/go-redis/redis_rate/v10 v10.0.1 h1:calPxi7tVlxojKunJwQ72kwfozdy25RjA0bCj1h0MUo=
+github.com/go-redis/redis_rate/v10 v10.0.1/go.mod h1:EMiuO9+cjRkR7UvdvwMO7vbgqJkltQHtwbdIQvaBKIU=
+github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
+github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
+github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 h1:TmHmbvxPmaegwhDubVz0lICL0J5Ka2vwTzhoePEXsGE=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0/go.mod h1:qztMSjm835F2bXf+5HKAPIS5qsmQDqZna/PgVt4rWtI=
+github.com/hhrutter/lzw v1.0.0 h1:laL89Llp86W3rRs83LvKbwYRx6INE8gDn0XNb1oXtm0=
+github.com/hhrutter/lzw v1.0.0/go.mod h1:2HC6DJSn/n6iAZfgM3Pg+cP1KxeWc3ezG8bBqW5+WEo=
+github.com/hhrutter/pkcs7 v0.2.2 h1:xMoifoVWah1LNym3C0pomEiLmyJyVIBXt/8oTPyPz+8=
+github.com/hhrutter/pkcs7 v0.2.2/go.mod h1:aEzKz0+ZAlz7YaEMY47jDHL14hVWD6iXt0AgqgAvWgE=
+github.com/hhrutter/tiff v1.0.3 h1:POV5xITOE1Lt5FvP24ylft0LyCmHmc8GkJ1SVlvUyk0=
+github.com/hhrutter/tiff v1.0.3/go.mod h1:zZDLVY4cp9za2FLrryAaGszwWYAUM6DrRiBR0l//mxA=
+github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw=
+github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jmoiron/sqlx v1.4.0 h1:1PLqN7S1UYp5t4SrVVnt4nUVNemrDAtxlulVe+Qgm3o=
+github.com/jmoiron/sqlx v1.4.0/go.mod h1:ZrZ7UsYB/weZdl2Bxg6jCRO9c3YHl8r3ahlKmRT4JLY=
+github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
+github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo=
+github.com/knadh/koanf/maps v0.1.2/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI=
+github.com/knadh/koanf/parsers/yaml v1.1.0 h1:3ltfm9ljprAHt4jxgeYLlFPmUaunuCgu1yILuTXRdM4=
+github.com/knadh/koanf/parsers/yaml v1.1.0/go.mod h1:HHmcHXUrp9cOPcuC+2wrr44GTUB0EC+PyfN3HZD9tFg=
+github.com/knadh/koanf/providers/env v1.1.0 h1:U2VXPY0f+CsNDkvdsG8GcsnK4ah85WwWyJgef9oQMSc=
+github.com/knadh/koanf/providers/env v1.1.0/go.mod h1:QhHHHZ87h9JxJAn2czdEl6pdkNnDh/JS1Vtsyt65hTY=
+github.com/knadh/koanf/providers/file v1.2.1 h1:bEWbtQwYrA+W2DtdBrQWyXqJaJSG3KrP3AESOJYp9wM=
+github.com/knadh/koanf/providers/file v1.2.1/go.mod h1:bp1PM5f83Q+TOUu10J/0ApLBd9uIzg+n9UgthfY+nRA=
+github.com/knadh/koanf/v2 v2.1.2 h1:I2rtLRqXRy1p01m/utEtpZSSA6dcJbgGVuE27kW2PzQ=
+github.com/knadh/koanf/v2 v2.1.2/go.mod h1:Gphfaen0q1Fc1HTgJgSTC4oRX9R2R5ErYMZJy8fLJBo=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
+github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
+github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
+github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
+github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
+github.com/mattn/go-isatty v0.0.21 h1:xYae+lCNBP7QuW4PUnNG61ffM4hVIfm+zUzDuSzYLGs=
+github.com/mattn/go-isatty v0.0.21/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
+github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw=
+github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
+github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mdelapenya/tlscert v0.2.0 h1:7H81W6Z/4weDvZBNOfQte5GpIMo0lGYEeWbkGp5LJHI=
+github.com/mdelapenya/tlscert v0.2.0/go.mod h1:O4njj3ELLnJjGdkN7M/vIVCpZ+Cf0L6muqOG4tLSl8o=
+github.com/mfridman/interpolate v0.0.2 h1:pnuTK7MQIxxFz1Gr+rjSIx9u7qVjf5VOoM/u6BbAxPY=
+github.com/mfridman/interpolate v0.0.2/go.mod h1:p+7uk6oE07mpE/Ik1b8EckO0O4ZXiGAfshKBWLUM9Xg=
+github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
+github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
+github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
+github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8=
+github.com/moby/go-archive v0.2.0/go.mod h1:mNeivT14o8xU+5q1YnNrkQVpK+dnNe/K6fHqnTg4qPU=
+github.com/moby/moby/api v1.54.2 h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg=
+github.com/moby/moby/api v1.54.2/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
+github.com/moby/moby/client v0.4.1 h1:DMQgisVoMkmMs7fp3ROSdiBnoAu8+vo3GggFl06M/wY=
+github.com/moby/moby/client v0.4.1/go.mod h1:z52C9O2POPOsnxZAy//WtKcQ32P+jT/NGeXu/7nfjGQ=
+github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
+github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
+github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
+github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
+github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
+github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
+github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
+github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
+github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
+github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
+github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/oschwald/geoip2-golang/v2 v2.1.0 h1:DjnLhNJu9WHwTrmoiQFvgmyJoczhdnm7LB23UBI2Amo=
+github.com/oschwald/geoip2-golang/v2 v2.1.0/go.mod h1:qdVmcPgrTJ4q2eP9tHq/yldMTdp2VMr33uVdFbHBiBc=
+github.com/oschwald/maxminddb-golang/v2 v2.1.1 h1:lA8FH0oOrM4u7mLvowq8IT6a3Q/qEnqRzLQn9eH5ojc=
+github.com/oschwald/maxminddb-golang/v2 v2.1.1/go.mod h1:PLdx6PR+siSIoXqqy7C7r3SB3KZnhxWr1Dp6g0Hacl8=
+github.com/pdfcpu/pdfcpu v0.12.1 h1:HwoN72zJCj+pPbfMDChYBTZrT7SY0VwgUzqeaId3I20=
+github.com/pdfcpu/pdfcpu v0.12.1/go.mod h1:7KPpVLMavcpliPrtN6o7Kuk3cFtYq8nii3SJnnsK7ps=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
+github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
+github.com/pressly/goose/v3 v3.27.1 h1:6uEvcprBybDmW4hcz3gYujhARhye+GoWKhEWyzD5sh4=
+github.com/pressly/goose/v3 v3.27.1/go.mod h1:maruOxsPnIG2yHHyo8UqKWXYKFcH7Q76csUV7+7KYoM=
+github.com/redis/go-redis/v9 v9.7.3 h1:YpPyAayJV+XErNsatSElgRZZVCwXX9QzkKYNvO7x0wM=
+github.com/redis/go-redis/v9 v9.7.3/go.mod h1:bGUrSggJ9X9GUmZpZNEOQKaANxSGgOEBRltRTZHSvrA=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/sethvargo/go-retry v0.3.0 h1:EEt31A35QhrcRZtrYFDTBg91cqZVnFL2navjDrah2SE=
+github.com/sethvargo/go-retry v0.3.0/go.mod h1:mNX17F0C/HguQMyMyJxcnU471gOZGxCLyYaFyAZraas=
+github.com/shirou/gopsutil/v4 v4.26.3 h1:2ESdQt90yU3oXF/CdOlRCJxrP+Am1aBYubTMTfxJ1qc=
+github.com/shirou/gopsutil/v4 v4.26.3/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
+github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/testcontainers/testcontainers-go v0.42.0 h1:He3IhTzTZOygSXLJPMX7n44XtK+qhjat1nI9cneBbUY=
+github.com/testcontainers/testcontainers-go v0.42.0/go.mod h1:vZjdY1YmUA1qEForxOIOazfsrdyORJAbhi0bp8plN30=
+github.com/testcontainers/testcontainers-go/modules/postgres v0.42.0 h1:GCbb1ndrF7OTDiIvxXyItaDab4qkzTFJ48LKFdM7EIo=
+github.com/testcontainers/testcontainers-go/modules/postgres v0.42.0/go.mod h1:IRPBaI8jXdrNfD0e4Zm7Fbcgaz5shKxOQv4axiL09xs=
+github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=
+github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
+github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=
+github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ=
+github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
+github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
+github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
+github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=
+go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
+go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 h1:Vh5HayB/0HHfOQA7Ctx69E/Y/DcQSMPpKANYVMQ7fBA=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0/go.mod h1:cpgtDBaqD/6ok/UG0jT15/uKjAY8mRA53diogHBg3UI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0 h1:5pojmb1U1AogINhN3SurB+zm/nIcusopeBNp42f45QM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0/go.mod h1:57gTHJSE5S1tqg+EKsLPlTWhpHMsWlVmer+LA926XiA=
+go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
+go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
+go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
+go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
+go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
+go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
+go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
+go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+go.opentelemetry.io/proto/otlp v1.4.0 h1:TA9WRvW6zMwP+Ssb6fLoUIuirti1gGbP28GcKG1jgeg=
+go.opentelemetry.io/proto/otlp v1.4.0/go.mod h1:PPBWZIP98o2ElSqI35IHfu7hIhSwvc5N38Jw8pXuGFY=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/image v0.39.0 h1:skVYidAEVKgn8lZ602XO75asgXBgLj9G/FE3RbuPFww=
+golang.org/x/image v0.39.0/go.mod h1:sIbmppfU+xFLPIG0FoVUTvyBMmgng1/XAMhQ2ft0hpA=
+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
+golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
+google.golang.org/genproto/googleapis/api v0.0.0-20260120221211-b8f7ae30c516 h1:vmC/ws+pLzWjj/gzApyoZuSVrDtF1aod4u/+bbj8hgM=
+google.golang.org/genproto/googleapis/api v0.0.0-20260120221211-b8f7ae30c516/go.mod h1:p3MLuOwURrGBRoEyFHBT3GjUwaCQVKeNqqWxlcISGdw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529 h1:XF8+t6QQiS0o9ArVan/HW8Q7cycNPGsJf6GA2nXxYAg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
+google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
+gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
+modernc.org/libc v1.72.1 h1:db1xwJ6u1kE3KHTFTTbe2GCrczHPKzlURP0aDC4NGD0=
+modernc.org/libc v1.72.1/go.mod h1:HRMiC/PhPGLIPM7GzAFCbI+oSgE3dhZ8FWftmRrHVlY=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/sqlite v1.49.1 h1:dYGHTKcX1sJ+EQDnUzvz4TJ5GbuvhNJa8Fg6ElGx73U=
+modernc.org/sqlite v1.49.1/go.mod h1:m0w8xhwYUVY3H6pSDwc3gkJ/irZT/0YEXwBlhaxQEew=
+pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
+pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/admin/dto.go b/PROJECTS/beginner/canary-token-generator/backend/internal/admin/dto.go
new file mode 100644
index 00000000..20f6ffa3
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/admin/dto.go
@@ -0,0 +1,26 @@
+// ©AngelaMos | 2026
+// dto.go
+
+package admin
+
+import (
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+)
+
+type Stats struct {
+	TokensCount    int64                `json:"tokens_count"`
+	EventsCount    int64                `json:"events_count"`
+	ByType         []token.TypeCount    `json:"by_type"`
+	ByAlertChannel []token.ChannelCount `json:"by_alert_channel"`
+}
+
+type TokenListPage struct {
+	NextOffset int  `json:"next_offset"`
+	HasMore    bool `json:"has_more"`
+}
+
+type TokenListResponse struct {
+	Tokens []token.Response `json:"tokens"`
+	Total  int64            `json:"total"`
+	Page   TokenListPage    `json:"page"`
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/admin/handler.go b/PROJECTS/beginner/canary-token-generator/backend/internal/admin/handler.go
new file mode 100644
index 00000000..4a96574a
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/admin/handler.go
@@ -0,0 +1,257 @@
+// ©AngelaMos | 2026
+// handler.go
+
+package admin
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+)
+
+const (
+	urlParamID = "id"
+
+	queryParamOffset = "offset"
+	queryParamLimit  = "limit"
+
+	defaultPageSize = 50
+	maxPageSize     = 100
+
+	headerContentType = "Content-Type"
+	contentTypeJSON   = "application/json"
+
+	errorCodeNotFound      = "NOT_FOUND"
+	errorCodeBadParam      = "BAD_PARAM"
+	errorCodeInternalError = "INTERNAL_ERROR"
+
+	respMessageNotFound      = "not found"
+	respMessageBadOffset     = "invalid offset"
+	respMessageInternalError = "internal server error"
+)
+
+type TokenRepository interface {
+	ListAll(ctx context.Context, opts token.ListOptions) ([]token.Token, error)
+	CountAll(ctx context.Context) (int64, error)
+	CountByType(ctx context.Context) ([]token.TypeCount, error)
+	CountByAlertChannel(ctx context.Context) ([]token.ChannelCount, error)
+	SetEnabled(ctx context.Context, id string, enabled bool) error
+}
+
+type EventRepository interface {
+	CountAll(ctx context.Context) (int64, error)
+}
+
+type URLBuilder interface {
+	TriggerURL(id string) string
+	ManageURL(manageID string) string
+}
+
+type Handler struct {
+	tokens TokenRepository
+	events EventRepository
+	urls   URLBuilder
+	logger *slog.Logger
+}
+
+func NewHandler(
+	tokens TokenRepository,
+	events EventRepository,
+	urls URLBuilder,
+	logger *slog.Logger,
+) *Handler {
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Handler{
+		tokens: tokens,
+		events: events,
+		urls:   urls,
+		logger: logger,
+	}
+}
+
+func (h *Handler) RegisterRoutes(r chi.Router) {
+	r.Get("/stats", h.GetStats)
+	r.Get("/tokens", h.ListTokens)
+	r.Post("/tokens/{"+urlParamID+"}/disable", h.DisableToken)
+}
+
+func (h *Handler) GetStats(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+
+	tokensCount, err := h.tokens.CountAll(ctx)
+	if err != nil {
+		h.logger.ErrorContext(ctx, "admin: count tokens", "error", err)
+		h.writeInternal(w)
+		return
+	}
+	eventsCount, err := h.events.CountAll(ctx)
+	if err != nil {
+		h.logger.ErrorContext(ctx, "admin: count events", "error", err)
+		h.writeInternal(w)
+		return
+	}
+	byType, err := h.tokens.CountByType(ctx)
+	if err != nil {
+		h.logger.ErrorContext(ctx, "admin: count by type", "error", err)
+		h.writeInternal(w)
+		return
+	}
+	byChannel, err := h.tokens.CountByAlertChannel(ctx)
+	if err != nil {
+		h.logger.ErrorContext(ctx, "admin: count by channel", "error", err)
+		h.writeInternal(w)
+		return
+	}
+
+	stats := Stats{
+		TokensCount:    tokensCount,
+		EventsCount:    eventsCount,
+		ByType:         byType,
+		ByAlertChannel: byChannel,
+	}
+	h.writeJSON(w, http.StatusOK, envelopeData(stats))
+}
+
+func (h *Handler) ListTokens(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+
+	offset, err := parseOffset(r.URL.Query().Get(queryParamOffset))
+	if err != nil {
+		h.writeJSON(w, http.StatusBadRequest, envelopeError(
+			errorCodeBadParam, respMessageBadOffset,
+		))
+		return
+	}
+	limit := parseLimit(r.URL.Query().Get(queryParamLimit))
+
+	rows, err := h.tokens.ListAll(ctx, token.ListOptions{
+		Limit:  limit,
+		Offset: offset,
+	})
+	if err != nil {
+		h.logger.ErrorContext(ctx, "admin: list tokens", "error", err)
+		h.writeInternal(w)
+		return
+	}
+
+	total, err := h.tokens.CountAll(ctx)
+	if err != nil {
+		h.logger.ErrorContext(ctx, "admin: count tokens", "error", err)
+		h.writeInternal(w)
+		return
+	}
+
+	out := make([]token.Response, 0, len(rows))
+	for i := range rows {
+		out = append(out, rows[i].ToResponse(
+			h.urls.TriggerURL(rows[i].ID),
+			h.urls.ManageURL(rows[i].ManageID),
+		))
+	}
+
+	next := offset + len(rows)
+	hasMore := int64(next) < total
+
+	resp := TokenListResponse{
+		Tokens: out,
+		Total:  total,
+		Page: TokenListPage{
+			NextOffset: next,
+			HasMore:    hasMore,
+		},
+	}
+	h.writeJSON(w, http.StatusOK, envelopeData(resp))
+}
+
+func (h *Handler) DisableToken(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, urlParamID)
+	if id == "" {
+		h.writeJSON(w, http.StatusNotFound, envelopeError(
+			errorCodeNotFound, respMessageNotFound,
+		))
+		return
+	}
+
+	if err := h.tokens.SetEnabled(r.Context(), id, false); err != nil {
+		if errors.Is(err, token.ErrNotFound) {
+			h.writeJSON(w, http.StatusNotFound, envelopeError(
+				errorCodeNotFound, respMessageNotFound,
+			))
+			return
+		}
+		h.logger.ErrorContext(r.Context(), "admin: disable token",
+			"error", err, "token_id", id)
+		h.writeInternal(w)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func parseOffset(raw string) (int, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return 0, nil
+	}
+	v, err := strconv.Atoi(raw)
+	if err != nil || v < 0 {
+		return 0, errors.New("invalid offset")
+	}
+	return v, nil
+}
+
+func parseLimit(raw string) int {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return defaultPageSize
+	}
+	v, err := strconv.Atoi(raw)
+	if err != nil || v <= 0 {
+		return defaultPageSize
+	}
+	if v > maxPageSize {
+		return maxPageSize
+	}
+	return v
+}
+
+func (h *Handler) writeJSON(
+	w http.ResponseWriter,
+	status int,
+	body any,
+) {
+	w.Header().Set(headerContentType, contentTypeJSON)
+	w.WriteHeader(status)
+	if err := json.NewEncoder(w).Encode(body); err != nil {
+		h.logger.Warn("write json response", "error", err)
+	}
+}
+
+func (h *Handler) writeInternal(w http.ResponseWriter) {
+	h.writeJSON(w, http.StatusInternalServerError, envelopeError(
+		errorCodeInternalError, respMessageInternalError,
+	))
+}
+
+func envelopeData(data any) map[string]any {
+	return map[string]any{"success": true, "data": data}
+}
+
+func envelopeError(code, message string) map[string]any {
+	return map[string]any{
+		"success": false,
+		"error": map[string]any{
+			"code":    code,
+			"message": message,
+		},
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/admin/handler_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/admin/handler_test.go
new file mode 100644
index 00000000..9876efa2
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/admin/handler_test.go
@@ -0,0 +1,506 @@
+// ©AngelaMos | 2026
+// handler_test.go
+
+package admin_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"sync"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/admin"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+)
+
+const (
+	testBaseURL   = "https://canary.example.com"
+	testManageURL = "https://canary.example.com"
+)
+
+type fakeURLBuilder struct{}
+
+func (fakeURLBuilder) TriggerURL(id string) string {
+	return testBaseURL + "/c/" + id
+}
+
+func (fakeURLBuilder) ManageURL(manageID string) string {
+	return testManageURL + "/m/" + manageID
+}
+
+type fakeTokenRepo struct {
+	mu                sync.Mutex
+	tokens            []token.Token
+	disabledCalls     []string
+	setEnabledErr     error
+	listErr           error
+	countErr          error
+	countByTypeErr    error
+	countByChannelErr error
+}
+
+func newFakeTokenRepo() *fakeTokenRepo {
+	return &fakeTokenRepo{tokens: []token.Token{}}
+}
+
+func (f *fakeTokenRepo) ListAll(
+	_ context.Context,
+	opts token.ListOptions,
+) ([]token.Token, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.listErr != nil {
+		return nil, f.listErr
+	}
+	start := opts.Offset
+	if start > len(f.tokens) {
+		start = len(f.tokens)
+	}
+	end := start + opts.Limit
+	if end > len(f.tokens) {
+		end = len(f.tokens)
+	}
+	out := make([]token.Token, end-start)
+	copy(out, f.tokens[start:end])
+	return out, nil
+}
+
+func (f *fakeTokenRepo) CountAll(_ context.Context) (int64, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.countErr != nil {
+		return 0, f.countErr
+	}
+	return int64(len(f.tokens)), nil
+}
+
+func (f *fakeTokenRepo) CountByType(
+	_ context.Context,
+) ([]token.TypeCount, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.countByTypeErr != nil {
+		return nil, f.countByTypeErr
+	}
+	counts := map[token.Type]int64{}
+	for _, t := range f.tokens {
+		counts[t.Type]++
+	}
+	out := []token.TypeCount{}
+	for typ, c := range counts {
+		out = append(out, token.TypeCount{Type: typ, Count: c})
+	}
+	return out, nil
+}
+
+func (f *fakeTokenRepo) CountByAlertChannel(
+	_ context.Context,
+) ([]token.ChannelCount, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.countByChannelErr != nil {
+		return nil, f.countByChannelErr
+	}
+	counts := map[token.AlertChannel]int64{}
+	for _, t := range f.tokens {
+		counts[t.AlertChannel]++
+	}
+	out := []token.ChannelCount{}
+	for ch, c := range counts {
+		out = append(out, token.ChannelCount{Channel: ch, Count: c})
+	}
+	return out, nil
+}
+
+func (f *fakeTokenRepo) SetEnabled(
+	_ context.Context,
+	id string,
+	enabled bool,
+) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.disabledCalls = append(f.disabledCalls, id)
+	if f.setEnabledErr != nil {
+		return f.setEnabledErr
+	}
+	for i := range f.tokens {
+		if f.tokens[i].ID == id {
+			f.tokens[i].Enabled = enabled
+			return nil
+		}
+	}
+	return token.ErrNotFound
+}
+
+type fakeEventRepo struct {
+	count int64
+	err   error
+}
+
+func (f *fakeEventRepo) CountAll(_ context.Context) (int64, error) {
+	if f.err != nil {
+		return 0, f.err
+	}
+	return f.count, nil
+}
+
+func quietLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+func newRouter(h *admin.Handler) chi.Router {
+	r := chi.NewRouter()
+	h.RegisterRoutes(r)
+	return r
+}
+
+func seedToken(id string, typ token.Type, ch token.AlertChannel) token.Token {
+	return token.Token{
+		ID:           id,
+		ManageID:     "mng-" + id,
+		Type:         typ,
+		AlertChannel: ch,
+		Enabled:      true,
+		Metadata:     json.RawMessage(`{}`),
+	}
+}
+
+func TestAdmin_GetStats_HappyPath(t *testing.T) {
+	repo := newFakeTokenRepo()
+	repo.tokens = []token.Token{
+		seedToken("a01", token.TypeWebbug, token.ChannelTelegram),
+		seedToken("a02", token.TypeWebbug, token.ChannelWebhook),
+		seedToken("a03", token.TypeDocx, token.ChannelTelegram),
+	}
+	events := &fakeEventRepo{count: 17}
+	h := admin.NewHandler(repo, events, fakeURLBuilder{}, quietLogger())
+	r := newRouter(h)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/stats", nil))
+
+	require.Equal(t, http.StatusOK, w.Code)
+	require.Equal(t, "application/json", w.Header().Get("Content-Type"))
+
+	var body struct {
+		Success bool        `json:"success"`
+		Data    admin.Stats `json:"data"`
+	}
+	require.NoError(t, json.NewDecoder(w.Body).Decode(&body))
+	require.True(t, body.Success)
+	require.Equal(t, int64(3), body.Data.TokensCount)
+	require.Equal(t, int64(17), body.Data.EventsCount)
+	require.NotEmpty(t, body.Data.ByType)
+	require.NotEmpty(t, body.Data.ByAlertChannel)
+
+	byType := map[token.Type]int64{}
+	for _, c := range body.Data.ByType {
+		byType[c.Type] = c.Count
+	}
+	require.Equal(t, int64(2), byType[token.TypeWebbug])
+	require.Equal(t, int64(1), byType[token.TypeDocx])
+
+	byChan := map[token.AlertChannel]int64{}
+	for _, c := range body.Data.ByAlertChannel {
+		byChan[c.Channel] = c.Count
+	}
+	require.Equal(t, int64(2), byChan[token.ChannelTelegram])
+	require.Equal(t, int64(1), byChan[token.ChannelWebhook])
+}
+
+func TestAdmin_GetStats_TokenCountFails_500(t *testing.T) {
+	repo := newFakeTokenRepo()
+	repo.countErr = errors.New("db down")
+	events := &fakeEventRepo{}
+	h := admin.NewHandler(repo, events, fakeURLBuilder{}, quietLogger())
+	r := newRouter(h)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/stats", nil))
+
+	require.Equal(t, http.StatusInternalServerError, w.Code)
+	require.Contains(t, w.Body.String(), `"INTERNAL_ERROR"`)
+}
+
+func TestAdmin_GetStats_EventCountFails_500(t *testing.T) {
+	repo := newFakeTokenRepo()
+	events := &fakeEventRepo{err: errors.New("redis down")}
+	h := admin.NewHandler(repo, events, fakeURLBuilder{}, quietLogger())
+	r := newRouter(h)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/stats", nil))
+
+	require.Equal(t, http.StatusInternalServerError, w.Code)
+}
+
+func TestAdmin_ListTokens_DefaultPagination(t *testing.T) {
+	repo := newFakeTokenRepo()
+	for i := range 3 {
+		repo.tokens = append(repo.tokens, seedToken(
+			"t0"+string(rune('a'+i)),
+			token.TypeWebbug,
+			token.ChannelWebhook,
+		))
+	}
+	h := admin.NewHandler(
+		repo,
+		&fakeEventRepo{},
+		fakeURLBuilder{},
+		quietLogger(),
+	)
+	r := newRouter(h)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/tokens", nil))
+
+	require.Equal(t, http.StatusOK, w.Code)
+	var body struct {
+		Success bool                    `json:"success"`
+		Data    admin.TokenListResponse `json:"data"`
+	}
+	require.NoError(t, json.NewDecoder(w.Body).Decode(&body))
+	require.True(t, body.Success)
+	require.Len(t, body.Data.Tokens, 3)
+	require.Equal(t, int64(3), body.Data.Total)
+	require.False(t, body.Data.Page.HasMore)
+	require.Equal(t, 3, body.Data.Page.NextOffset)
+
+	require.Equal(t, testBaseURL+"/c/t0a", body.Data.Tokens[0].TriggerURL)
+	require.Equal(t, testManageURL+"/m/mng-t0a", body.Data.Tokens[0].ManageURL)
+}
+
+func TestAdmin_ListTokens_HasMoreWhenBeyondPage(t *testing.T) {
+	repo := newFakeTokenRepo()
+	for i := range 5 {
+		repo.tokens = append(repo.tokens, seedToken(
+			"row"+string(rune('a'+i)),
+			token.TypeWebbug,
+			token.ChannelWebhook,
+		))
+	}
+	h := admin.NewHandler(
+		repo,
+		&fakeEventRepo{},
+		fakeURLBuilder{},
+		quietLogger(),
+	)
+	r := newRouter(h)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(
+		http.MethodGet,
+		"/tokens?limit=2",
+		nil,
+	))
+	require.Equal(t, http.StatusOK, w.Code)
+
+	var body struct {
+		Data admin.TokenListResponse `json:"data"`
+	}
+	require.NoError(t, json.NewDecoder(w.Body).Decode(&body))
+	require.Len(t, body.Data.Tokens, 2)
+	require.Equal(t, int64(5), body.Data.Total)
+	require.True(t, body.Data.Page.HasMore)
+	require.Equal(t, 2, body.Data.Page.NextOffset)
+}
+
+func TestAdmin_ListTokens_OffsetPagesThrough(t *testing.T) {
+	repo := newFakeTokenRepo()
+	for i := range 5 {
+		repo.tokens = append(repo.tokens, seedToken(
+			"pg"+string(rune('a'+i)),
+			token.TypeWebbug,
+			token.ChannelWebhook,
+		))
+	}
+	h := admin.NewHandler(
+		repo,
+		&fakeEventRepo{},
+		fakeURLBuilder{},
+		quietLogger(),
+	)
+	r := newRouter(h)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(
+		http.MethodGet,
+		"/tokens?limit=2&offset=4",
+		nil,
+	))
+	require.Equal(t, http.StatusOK, w.Code)
+	var body struct {
+		Data admin.TokenListResponse `json:"data"`
+	}
+	require.NoError(t, json.NewDecoder(w.Body).Decode(&body))
+	require.Len(t, body.Data.Tokens, 1)
+	require.False(t, body.Data.Page.HasMore)
+	require.Equal(t, 5, body.Data.Page.NextOffset)
+}
+
+func TestAdmin_ListTokens_InvalidOffset_400(t *testing.T) {
+	repo := newFakeTokenRepo()
+	h := admin.NewHandler(
+		repo,
+		&fakeEventRepo{},
+		fakeURLBuilder{},
+		quietLogger(),
+	)
+	r := newRouter(h)
+
+	for _, badOffset := range []string{"-1", "abc", "1.5"} {
+		w := httptest.NewRecorder()
+		r.ServeHTTP(w, httptest.NewRequest(
+			http.MethodGet, "/tokens?offset="+badOffset, nil,
+		))
+		require.Equal(t, http.StatusBadRequest, w.Code, "offset=%s", badOffset)
+		require.Contains(t, w.Body.String(), `"BAD_PARAM"`)
+	}
+}
+
+func TestAdmin_ListTokens_LimitCappedAt100(t *testing.T) {
+	repo := newFakeTokenRepo()
+	for i := range 150 {
+		repo.tokens = append(repo.tokens, seedToken(
+			"lim"+strconv.Itoa(i),
+			token.TypeWebbug,
+			token.ChannelWebhook,
+		))
+	}
+	h := admin.NewHandler(
+		repo,
+		&fakeEventRepo{},
+		fakeURLBuilder{},
+		quietLogger(),
+	)
+	r := newRouter(h)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(
+		http.MethodGet,
+		"/tokens?limit=500",
+		nil,
+	))
+	require.Equal(t, http.StatusOK, w.Code)
+	var body struct {
+		Data admin.TokenListResponse `json:"data"`
+	}
+	require.NoError(t, json.NewDecoder(w.Body).Decode(&body))
+	require.Len(t, body.Data.Tokens, 100,
+		"limit=500 must be capped to maxPageSize=100")
+}
+
+func TestAdmin_ListTokens_RepoError_500(t *testing.T) {
+	repo := newFakeTokenRepo()
+	repo.listErr = errors.New("db down")
+	h := admin.NewHandler(
+		repo,
+		&fakeEventRepo{},
+		fakeURLBuilder{},
+		quietLogger(),
+	)
+	r := newRouter(h)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/tokens", nil))
+	require.Equal(t, http.StatusInternalServerError, w.Code)
+}
+
+func TestAdmin_DisableToken_HappyPath(t *testing.T) {
+	repo := newFakeTokenRepo()
+	repo.tokens = []token.Token{
+		seedToken("disok0001a", token.TypeWebbug, token.ChannelWebhook),
+	}
+	h := admin.NewHandler(
+		repo,
+		&fakeEventRepo{},
+		fakeURLBuilder{},
+		quietLogger(),
+	)
+	r := newRouter(h)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(
+		http.MethodPost,
+		"/tokens/disok0001a/disable",
+		nil,
+	))
+	require.Equal(t, http.StatusNoContent, w.Code)
+	require.False(t, repo.tokens[0].Enabled)
+	require.Equal(t, []string{"disok0001a"}, repo.disabledCalls)
+}
+
+func TestAdmin_DisableToken_NotFound_404(t *testing.T) {
+	repo := newFakeTokenRepo()
+	h := admin.NewHandler(
+		repo,
+		&fakeEventRepo{},
+		fakeURLBuilder{},
+		quietLogger(),
+	)
+	r := newRouter(h)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(
+		http.MethodPost,
+		"/tokens/missing/disable",
+		nil,
+	))
+	require.Equal(t, http.StatusNotFound, w.Code)
+	require.Contains(t, w.Body.String(), `"NOT_FOUND"`)
+}
+
+func TestAdmin_DisableToken_RepoError_500(t *testing.T) {
+	repo := newFakeTokenRepo()
+	repo.tokens = []token.Token{
+		seedToken("repoerr01a", token.TypeWebbug, token.ChannelWebhook),
+	}
+	repo.setEnabledErr = errors.New("db error")
+	h := admin.NewHandler(
+		repo,
+		&fakeEventRepo{},
+		fakeURLBuilder{},
+		quietLogger(),
+	)
+	r := newRouter(h)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(
+		http.MethodPost,
+		"/tokens/repoerr01a/disable",
+		nil,
+	))
+	require.Equal(t, http.StatusInternalServerError, w.Code)
+	require.Contains(t, w.Body.String(), `"INTERNAL_ERROR"`)
+}
+
+func TestAdmin_DisableToken_GetIsNotRouted(t *testing.T) {
+	repo := newFakeTokenRepo()
+	repo.tokens = []token.Token{
+		seedToken("methodtest1", token.TypeWebbug, token.ChannelWebhook),
+	}
+	h := admin.NewHandler(
+		repo,
+		&fakeEventRepo{},
+		fakeURLBuilder{},
+		quietLogger(),
+	)
+	r := newRouter(h)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(
+		http.MethodGet,
+		"/tokens/methodtest1/disable",
+		nil,
+	))
+	require.Equal(t, http.StatusMethodNotAllowed, w.Code)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/admin/integration_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/admin/integration_test.go
new file mode 100644
index 00000000..331a6f19
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/admin/integration_test.go
@@ -0,0 +1,214 @@
+// ©AngelaMos | 2026
+// integration_test.go
+
+//go:build integration
+
+package admin_test
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"github.com/jmoiron/sqlx"
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/admin"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/middleware"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/testutil"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+)
+
+const (
+	intgBaseURL       = "https://canary.example.com"
+	intgManageURL     = "https://canary.example.com"
+	intgOperatorToken = "test-operator-token-CONSTANT-COMPARE-OK"
+)
+
+type intgURLBuilder struct{}
+
+func (intgURLBuilder) TriggerURL(id string) string {
+	return intgBaseURL + "/c/" + id
+}
+
+func (intgURLBuilder) ManageURL(manageID string) string {
+	return intgManageURL + "/m/" + manageID
+}
+
+type intgStack struct {
+	router    chi.Router
+	tokenRepo *token.Repository
+	eventRepo *event.Repository
+}
+
+func setupIntgStack(t *testing.T) *intgStack {
+	t.Helper()
+	db := sqlx.NewDb(testutil.NewTestDB(t), "pgx")
+
+	tokenRepo := token.NewRepository(db)
+	eventRepo := event.NewRepository(db)
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+
+	adminH := admin.NewHandler(tokenRepo, eventRepo, intgURLBuilder{}, logger)
+
+	r := chi.NewRouter()
+	r.Route("/api", func(api chi.Router) {
+		api.Route("/admin", func(adm chi.Router) {
+			adm.Use(middleware.OperatorBearer(intgOperatorToken))
+			adminH.RegisterRoutes(adm)
+		})
+	})
+
+	return &intgStack{router: r, tokenRepo: tokenRepo, eventRepo: eventRepo}
+}
+
+func seedIntgToken(
+	t *testing.T,
+	repo *token.Repository,
+	id string,
+	typ token.Type,
+	ch token.AlertChannel,
+) *token.Token {
+	t.Helper()
+	tok := &token.Token{
+		ID:           id,
+		ManageID:     uuid.New().String(),
+		Type:         typ,
+		Memo:         "admin-intg",
+		AlertChannel: ch,
+		CreatedIP:    "203.0.113.42",
+		CreatedFP:    "abcdef0123456789",
+		Metadata:     json.RawMessage(`{}`),
+		Enabled:      true,
+	}
+	switch ch {
+	case token.ChannelTelegram:
+		tok.TelegramBot = testutil.Ptr("111:AAA")
+		tok.TelegramChat = testutil.Ptr("12345")
+	case token.ChannelWebhook:
+		tok.WebhookURL = testutil.Ptr("https://example.com/hook")
+	}
+	require.NoError(t, repo.Insert(context.Background(), tok))
+	return tok
+}
+
+func authedGet(t *testing.T, r chi.Router, path, tok string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodGet, path, nil)
+	if tok != "" {
+		req.Header.Set("Authorization", "Bearer "+tok)
+	}
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, req)
+	return w
+}
+
+func authedPost(t *testing.T, r chi.Router, path, tok string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodPost, path, nil)
+	if tok != "" {
+		req.Header.Set("Authorization", "Bearer "+tok)
+	}
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, req)
+	return w
+}
+
+func TestIntegration_AdminBearer_404OnMissing(t *testing.T) {
+	st := setupIntgStack(t)
+	w := authedGet(t, st.router, "/api/admin/stats", "")
+	require.Equal(t, http.StatusNotFound, w.Code,
+		"missing Authorization must return 404, not 401")
+	require.Empty(t, w.Header().Get("WWW-Authenticate"))
+}
+
+func TestIntegration_AdminBearer_404OnWrongToken(t *testing.T) {
+	st := setupIntgStack(t)
+	w := authedGet(t, st.router, "/api/admin/stats", "wrong-token")
+	require.Equal(t, http.StatusNotFound, w.Code)
+}
+
+func TestIntegration_AdminStats_Authorized(t *testing.T) {
+	st := setupIntgStack(t)
+	ctx := context.Background()
+
+	tok := seedIntgToken(t, st.tokenRepo, "adminstats01", token.TypeWebbug, token.ChannelTelegram)
+	seedIntgToken(t, st.tokenRepo, "adminstats02", token.TypeDocx, token.ChannelWebhook)
+
+	require.NoError(t, st.eventRepo.Insert(ctx, &event.Event{
+		TokenID: tok.ID, SourceIP: "203.0.113.50",
+	}))
+
+	w := authedGet(t, st.router, "/api/admin/stats", intgOperatorToken)
+	require.Equal(t, http.StatusOK, w.Code, "body=%s", w.Body.String())
+
+	var body struct {
+		Success bool        `json:"success"`
+		Data    admin.Stats `json:"data"`
+	}
+	require.NoError(t, json.NewDecoder(w.Body).Decode(&body))
+	require.True(t, body.Success)
+	require.GreaterOrEqual(t, body.Data.TokensCount, int64(2))
+	require.GreaterOrEqual(t, body.Data.EventsCount, int64(1))
+	require.NotEmpty(t, body.Data.ByType)
+	require.NotEmpty(t, body.Data.ByAlertChannel)
+}
+
+func TestIntegration_AdminListTokens_Authorized(t *testing.T) {
+	st := setupIntgStack(t)
+
+	for i := range 4 {
+		seedIntgToken(t, st.tokenRepo,
+			"adminlist0"+string(rune('a'+i)),
+			token.TypeWebbug, token.ChannelWebhook)
+	}
+
+	w := authedGet(t, st.router, "/api/admin/tokens?limit=2", intgOperatorToken)
+	require.Equal(t, http.StatusOK, w.Code, "body=%s", w.Body.String())
+
+	var body struct {
+		Data admin.TokenListResponse `json:"data"`
+	}
+	require.NoError(t, json.NewDecoder(w.Body).Decode(&body))
+	require.Len(t, body.Data.Tokens, 2)
+	require.GreaterOrEqual(t, body.Data.Total, int64(4))
+	require.True(t, body.Data.Page.HasMore)
+	require.Equal(t, 2, body.Data.Page.NextOffset)
+
+	require.Contains(t, body.Data.Tokens[0].TriggerURL, "/c/")
+	require.Contains(t, body.Data.Tokens[0].ManageURL, "/m/")
+}
+
+func TestIntegration_AdminDisableToken_Authorized(t *testing.T) {
+	st := setupIntgStack(t)
+	ctx := context.Background()
+
+	tok := seedIntgToken(t, st.tokenRepo, "admindis001a", token.TypeWebbug, token.ChannelWebhook)
+	require.True(t, tok.Enabled)
+
+	w := authedPost(t, st.router,
+		"/api/admin/tokens/"+tok.ID+"/disable",
+		intgOperatorToken)
+	require.Equal(t, http.StatusNoContent, w.Code)
+
+	got, err := st.tokenRepo.GetByID(ctx, tok.ID)
+	require.NoError(t, err)
+	require.False(t, got.Enabled, "disable must persist to DB")
+}
+
+func TestIntegration_AdminDisableToken_NotFound(t *testing.T) {
+	st := setupIntgStack(t)
+
+	w := authedPost(t, st.router,
+		"/api/admin/tokens/admindismiss/disable",
+		intgOperatorToken)
+	require.Equal(t, http.StatusNotFound, w.Code)
+	require.Contains(t, w.Body.String(), `"NOT_FOUND"`)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/config/config.go b/PROJECTS/beginner/canary-token-generator/backend/internal/config/config.go
new file mode 100644
index 00000000..a1b9096e
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/config/config.go
@@ -0,0 +1,395 @@
+// ©AngelaMos | 2026
+// config.go
+
+package config
+
+import (
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/knadh/koanf/parsers/yaml"
+	"github.com/knadh/koanf/providers/env"
+	"github.com/knadh/koanf/providers/file"
+	"github.com/knadh/koanf/v2"
+)
+
+const defaultCanaryBaseURL = "http://localhost:8080"
+
+type Config struct {
+	App       AppConfig       `koanf:"app"`
+	Server    ServerConfig    `koanf:"server"`
+	Database  DatabaseConfig  `koanf:"database"`
+	Redis     RedisConfig     `koanf:"redis"`
+	RateLimit RateLimitConfig `koanf:"rate_limit"`
+	CORS      CORSConfig      `koanf:"cors"`
+	Log       LogConfig       `koanf:"log"`
+	Otel      OtelConfig      `koanf:"otel"`
+	Canary    CanaryConfig    `koanf:"canary"`
+	Turnstile TurnstileConfig `koanf:"turnstile"`
+	MySQL     MySQLConfig     `koanf:"mysql"`
+	Notify    NotifyConfig    `koanf:"notify"`
+	Operator  OperatorConfig  `koanf:"operator"`
+	GeoIP     GeoIPConfig     `koanf:"geoip"`
+}
+
+type OperatorConfig struct {
+	Token string `koanf:"token"`
+}
+
+type GeoIPConfig struct {
+	Path string `koanf:"path"`
+}
+
+type NotifyConfig struct {
+	DedupTTL          time.Duration `koanf:"dedup_ttl"`
+	SendTimeout       time.Duration `koanf:"send_timeout"`
+	MaxTries          uint          `koanf:"max_tries"`
+	MaxElapsed        time.Duration `koanf:"max_elapsed"`
+	InitialInterval   time.Duration `koanf:"initial_interval"`
+	RetentionInterval time.Duration `koanf:"retention_interval"`
+	RetentionLimit    int           `koanf:"retention_limit"`
+	WebhookHMACSecret string        `koanf:"webhook_hmac_secret"`
+	TelegramAPIBase   string        `koanf:"telegram_api_base"`
+	FingerprintWindow time.Duration `koanf:"fingerprint_window"`
+}
+
+type CanaryConfig struct {
+	BaseURL   string `koanf:"base_url"`
+	ManageURL string `koanf:"manage_url"`
+}
+
+type TurnstileConfig struct {
+	SecretKey string `koanf:"secret_key"`
+	SiteKey   string `koanf:"site_key"`
+}
+
+type MySQLConfig struct {
+	Enabled    bool   `koanf:"enabled"`
+	Addr       string `koanf:"addr"`
+	PublicHost string `koanf:"public_host"`
+	PublicPort int    `koanf:"public_port"`
+}
+
+type AppConfig struct {
+	Name        string `koanf:"name"`
+	Version     string `koanf:"version"`
+	Environment string `koanf:"environment"`
+}
+
+type ServerConfig struct {
+	Host              string        `koanf:"host"`
+	Port              int           `koanf:"port"`
+	ReadTimeout       time.Duration `koanf:"read_timeout"`
+	WriteTimeout      time.Duration `koanf:"write_timeout"`
+	IdleTimeout       time.Duration `koanf:"idle_timeout"`
+	ShutdownTimeout   time.Duration `koanf:"shutdown_timeout"`
+	TrustedProxyCIDRs []string      `koanf:"trusted_proxy_cidrs"`
+}
+
+type DatabaseConfig struct {
+	URL             string        `koanf:"url"`
+	MaxOpenConns    int           `koanf:"max_open_conns"`
+	MaxIdleConns    int           `koanf:"max_idle_conns"`
+	ConnMaxLifetime time.Duration `koanf:"conn_max_lifetime"`
+	ConnMaxIdleTime time.Duration `koanf:"conn_max_idle_time"`
+}
+
+type RedisConfig struct {
+	URL          string `koanf:"url"`
+	PoolSize     int    `koanf:"pool_size"`
+	MinIdleConns int    `koanf:"min_idle_conns"`
+}
+
+type RateLimitConfig struct {
+	Requests        int           `koanf:"requests"`
+	Window          time.Duration `koanf:"window"`
+	Burst           int           `koanf:"burst"`
+	CreateMinRate   int           `koanf:"create_min_rate"`
+	CreateMinBurst  int           `koanf:"create_min_burst"`
+	CreateHourRate  int           `koanf:"create_hour_rate"`
+	CreateHourBurst int           `koanf:"create_hour_burst"`
+}
+
+type CORSConfig struct {
+	AllowedOrigins   []string `koanf:"allowed_origins"`
+	AllowedMethods   []string `koanf:"allowed_methods"`
+	AllowedHeaders   []string `koanf:"allowed_headers"`
+	AllowCredentials bool     `koanf:"allow_credentials"`
+	MaxAge           int      `koanf:"max_age"`
+}
+
+type LogConfig struct {
+	Level  string `koanf:"level"`
+	Format string `koanf:"format"`
+}
+
+type OtelConfig struct {
+	Endpoint    string  `koanf:"endpoint"`
+	ServiceName string  `koanf:"service_name"`
+	Enabled     bool    `koanf:"enabled"`
+	Insecure    bool    `koanf:"insecure"`
+	SampleRate  float64 `koanf:"sample_rate"`
+}
+
+var (
+	cfg  *Config
+	once sync.Once
+)
+
+func Load(configPath string) (*Config, error) {
+	var loadErr error
+
+	once.Do(func() {
+		k := koanf.New(".")
+
+		if err := loadDefaults(k); err != nil {
+			loadErr = fmt.Errorf("load defaults: %w", err)
+			return
+		}
+
+		if configPath != "" {
+			if err := k.Load(
+				file.Provider(configPath),
+				yaml.Parser(),
+			); err != nil {
+				loadErr = fmt.Errorf("load config file: %w", err)
+				return
+			}
+		}
+
+		if err := k.Load(
+			env.Provider("", ".", envKeyReplacer),
+			nil,
+		); err != nil {
+			loadErr = fmt.Errorf("load env vars: %w", err)
+			return
+		}
+
+		cfg = &Config{}
+		if err := k.Unmarshal("", cfg); err != nil {
+			loadErr = fmt.Errorf("unmarshal config: %w", err)
+			return
+		}
+
+		if cfg.Canary.ManageURL == "" ||
+			cfg.Canary.ManageURL == defaultCanaryBaseURL {
+			cfg.Canary.ManageURL = cfg.Canary.BaseURL
+		}
+
+		if err := validate(cfg); err != nil {
+			loadErr = fmt.Errorf("validate config: %w", err)
+			return
+		}
+	})
+
+	if loadErr != nil {
+		return nil, loadErr
+	}
+
+	return cfg, nil
+}
+
+func Get() *Config {
+	if cfg == nil {
+		panic("config not loaded: call Load() first")
+	}
+	return cfg
+}
+
+func loadDefaults(k *koanf.Koanf) error {
+	defaults := map[string]any{
+		"app.name":        "Canary Token Generator",
+		"app.version":     "1.0.0",
+		"app.environment": "development",
+
+		"server.host":             "0.0.0.0",
+		"server.port":             8080,
+		"server.read_timeout":     "30s",
+		"server.write_timeout":    "30s",
+		"server.idle_timeout":     "120s",
+		"server.shutdown_timeout": "15s",
+		"server.trusted_proxy_cidrs": []string{
+			"127.0.0.1/32",
+			"::1/128",
+			"10.0.0.0/8",
+			"172.16.0.0/12",
+			"192.168.0.0/16",
+		},
+
+		"database.max_open_conns":     25,
+		"database.max_idle_conns":     5,
+		"database.conn_max_lifetime":  "1h",
+		"database.conn_max_idle_time": "30m",
+
+		"redis.pool_size":      10,
+		"redis.min_idle_conns": 5,
+
+		"rate_limit.requests":          100,
+		"rate_limit.window":            "1m",
+		"rate_limit.burst":             20,
+		"rate_limit.create_min_rate":   5,
+		"rate_limit.create_min_burst":  5,
+		"rate_limit.create_hour_rate":  20,
+		"rate_limit.create_hour_burst": 5,
+
+		"cors.allowed_origins": []string{"http://localhost:3000"},
+		"cors.allowed_methods": []string{
+			"GET",
+			"POST",
+			"PUT",
+			"PATCH",
+			"DELETE",
+			"OPTIONS",
+		},
+		"cors.allowed_headers": []string{
+			"Accept",
+			"Authorization",
+			"Content-Type",
+			"X-Request-ID",
+		},
+		"cors.allow_credentials": true,
+		"cors.max_age":           300,
+
+		"log.level":  "info",
+		"log.format": "json",
+
+		"otel.enabled":      false,
+		"otel.insecure":     true,
+		"otel.sample_rate":  0.1,
+		"otel.service_name": "canary-token-generator",
+
+		"canary.base_url":   defaultCanaryBaseURL,
+		"canary.manage_url": defaultCanaryBaseURL,
+
+		"turnstile.secret_key": "",
+		"turnstile.site_key":   "",
+
+		"mysql.enabled":     false,
+		"mysql.addr":        "0.0.0.0:3306",
+		"mysql.public_host": "localhost",
+		"mysql.public_port": 3306,
+
+		"notify.dedup_ttl":           "15m",
+		"notify.send_timeout":        "30s",
+		"notify.max_tries":           3,
+		"notify.max_elapsed":         "30s",
+		"notify.initial_interval":    "500ms",
+		"notify.retention_interval":  "1h",
+		"notify.retention_limit":     100,
+		"notify.webhook_hmac_secret": "",
+		"notify.telegram_api_base":   "https://api.telegram.org",
+		"notify.fingerprint_window":  "30s",
+
+		"operator.token": "",
+
+		"geoip.path": "/data/GeoLite2-City.mmdb",
+	}
+
+	for key, value := range defaults {
+		if err := k.Set(key, value); err != nil {
+			return fmt.Errorf("set default %s: %w", key, err)
+		}
+	}
+
+	return nil
+}
+
+var envKeyMap = map[string]string{
+	"DATABASE_URL":                 "database.url",
+	"REDIS_URL":                    "redis.url",
+	"APP_ENVIRONMENT":              "app.environment",
+	"HOST":                         "server.host",
+	"PORT":                         "server.port",
+	"LOG_LEVEL":                    "log.level",
+	"LOG_FORMAT":                   "log.format",
+	"RATE_LIMIT_REQUESTS":          "rate_limit.requests",
+	"RATE_LIMIT_WINDOW":            "rate_limit.window",
+	"RATE_LIMIT_BURST":             "rate_limit.burst",
+	"OTEL_ENDPOINT":                "otel.endpoint",
+	"OTEL_EXPORTER_OTLP_ENDPOINT":  "otel.endpoint",
+	"OTEL_SERVICE_NAME":            "otel.service_name",
+	"OTEL_ENABLED":                 "otel.enabled",
+	"OTEL_INSECURE":                "otel.insecure",
+	"OTEL_SAMPLE_RATE":             "otel.sample_rate",
+	"CANARY_BASE_URL":              "canary.base_url",
+	"PUBLIC_BASE_URL":              "canary.base_url",
+	"CANARY_MANAGE_URL":            "canary.manage_url",
+	"TURNSTILE_SECRET_KEY":         "turnstile.secret_key",
+	"TURNSTILE_SITE_KEY":           "turnstile.site_key",
+	"MYSQL_ENABLED":                "mysql.enabled",
+	"MYSQL_ADDR":                   "mysql.addr",
+	"MYSQL_PUBLIC_HOST":            "mysql.public_host",
+	"MYSQL_PUBLIC_PORT":            "mysql.public_port",
+	"RATE_LIMIT_CREATE_MIN_RATE":   "rate_limit.create_min_rate",
+	"RATE_LIMIT_CREATE_MIN_BURST":  "rate_limit.create_min_burst",
+	"RATE_LIMIT_CREATE_HOUR_RATE":  "rate_limit.create_hour_rate",
+	"RATE_LIMIT_CREATE_HOUR_BURST": "rate_limit.create_hour_burst",
+	"NOTIFY_DEDUP_TTL":             "notify.dedup_ttl",
+	"NOTIFY_SEND_TIMEOUT":          "notify.send_timeout",
+	"NOTIFY_MAX_TRIES":             "notify.max_tries",
+	"NOTIFY_MAX_ELAPSED":           "notify.max_elapsed",
+	"NOTIFY_INITIAL_INTERVAL":      "notify.initial_interval",
+	"NOTIFY_RETENTION_INTERVAL":    "notify.retention_interval",
+	"NOTIFY_RETENTION_LIMIT":       "notify.retention_limit",
+	"WEBHOOK_HMAC_SECRET":          "notify.webhook_hmac_secret",
+	"NOTIFY_TELEGRAM_API_BASE":     "notify.telegram_api_base",
+	"NOTIFY_FINGERPRINT_WINDOW":    "notify.fingerprint_window",
+	"OPERATOR_TOKEN":               "operator.token",
+	"GEOLITE_PATH":                 "geoip.path",
+}
+
+func envKeyReplacer(s string) string {
+	if mapped, ok := envKeyMap[s]; ok {
+		return mapped
+	}
+	return ""
+}
+
+func validate(c *Config) error {
+	if c.Database.URL == "" {
+		return fmt.Errorf("DATABASE_URL is required")
+	}
+
+	if c.Redis.URL == "" {
+		return fmt.Errorf("REDIS_URL is required")
+	}
+
+	if c.CORS.AllowCredentials {
+		for _, origin := range c.CORS.AllowedOrigins {
+			if origin == "*" {
+				return fmt.Errorf(
+					"CORS wildcard '*' cannot be used with AllowCredentials",
+				)
+			}
+		}
+	}
+
+	if c.App.Environment == "production" {
+		if c.Otel.Enabled && c.Otel.Insecure {
+			return fmt.Errorf("OTEL_INSECURE must be false in production")
+		}
+	}
+
+	if c.Server.ReadTimeout <= 0 {
+		return fmt.Errorf("server.read_timeout must be positive")
+	}
+
+	if c.Server.WriteTimeout <= 0 {
+		return fmt.Errorf("server.write_timeout must be positive")
+	}
+
+	return nil
+}
+
+func (c *Config) IsProduction() bool {
+	return c.App.Environment == "production"
+}
+
+func (c *Config) IsDevelopment() bool {
+	return c.App.Environment == "development"
+}
+
+func (s *ServerConfig) Address() string {
+	return fmt.Sprintf("%s:%d", s.Host, s.Port)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/core/database.go b/PROJECTS/beginner/canary-token-generator/backend/internal/core/database.go
new file mode 100644
index 00000000..00d3642b
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/core/database.go
@@ -0,0 +1,173 @@
+// ©AngelaMos | 2026
+// database.go
+
+package core
+
+import (
+	"context"
+	crand "crypto/rand"
+	"database/sql"
+	"fmt"
+	"log/slog"
+	"math/big"
+	"time"
+
+	_ "github.com/jackc/pgx/v5/stdlib"
+	"github.com/jmoiron/sqlx"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/config"
+)
+
+type Database struct {
+	DB *sqlx.DB
+}
+
+func (d *Database) SQLDB() *sql.DB {
+	return d.DB.DB
+}
+
+func NewDatabase(
+	ctx context.Context,
+	cfg config.DatabaseConfig,
+) (*Database, error) {
+	db, err := sqlx.ConnectContext(ctx, "pgx", cfg.URL)
+	if err != nil {
+		return nil, fmt.Errorf("connect to database: %w", err)
+	}
+
+	db.SetMaxOpenConns(cfg.MaxOpenConns)
+	db.SetMaxIdleConns(cfg.MaxIdleConns)
+	db.SetConnMaxLifetime(jitteredDuration(cfg.ConnMaxLifetime))
+	db.SetConnMaxIdleTime(cfg.ConnMaxIdleTime)
+
+	pingCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	if pingErr := db.PingContext(pingCtx); pingErr != nil {
+		if closeErr := db.Close(); closeErr != nil {
+			return nil, fmt.Errorf(
+				"ping database: %w (close also failed: %w)",
+				pingErr,
+				closeErr,
+			)
+		}
+		return nil, fmt.Errorf("ping database: %w", pingErr)
+	}
+
+	return &Database{DB: db}, nil
+}
+
+func (d *Database) Close() error {
+	if d.DB != nil {
+		return d.DB.Close()
+	}
+	return nil
+}
+
+func (d *Database) Ping(ctx context.Context) error {
+	pingCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	if err := d.DB.PingContext(pingCtx); err != nil {
+		return fmt.Errorf("database ping failed: %w", err)
+	}
+
+	return nil
+}
+
+func (d *Database) Stats() sql.DBStats {
+	return d.DB.Stats()
+}
+
+type DBTX interface {
+	sqlx.ExtContext
+	sqlx.ExecerContext
+	GetContext(ctx context.Context, dest any, query string, args ...any) error
+	SelectContext(
+		ctx context.Context,
+		dest any,
+		query string,
+		args ...any,
+	) error
+}
+
+func InTx(ctx context.Context, db *sqlx.DB, fn func(tx *sqlx.Tx) error) error {
+	tx, err := db.BeginTxx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("begin transaction: %w", err)
+	}
+
+	defer func() {
+		if p := recover(); p != nil {
+			if rbErr := tx.Rollback(); rbErr != nil {
+				slog.Error(
+					"rollback failed during panic recovery",
+					"error", rbErr,
+				)
+			}
+			panic(p)
+		}
+	}()
+
+	if err := fn(tx); err != nil {
+		if rbErr := tx.Rollback(); rbErr != nil {
+			return fmt.Errorf("rollback failed: %w (original: %w)", rbErr, err)
+		}
+		return err
+	}
+
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("commit transaction: %w", err)
+	}
+
+	return nil
+}
+
+func InTxWithOptions(
+	ctx context.Context,
+	db *sqlx.DB,
+	opts *sql.TxOptions,
+	fn func(tx *sqlx.Tx) error,
+) error {
+	tx, err := db.BeginTxx(ctx, opts)
+	if err != nil {
+		return fmt.Errorf("begin transaction: %w", err)
+	}
+
+	defer func() {
+		if p := recover(); p != nil {
+			if rbErr := tx.Rollback(); rbErr != nil {
+				slog.Error(
+					"rollback failed during panic recovery",
+					"error", rbErr,
+				)
+			}
+			panic(p)
+		}
+	}()
+
+	if err := fn(tx); err != nil {
+		if rbErr := tx.Rollback(); rbErr != nil {
+			return fmt.Errorf("rollback failed: %w (original: %w)", rbErr, err)
+		}
+		return err
+	}
+
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("commit transaction: %w", err)
+	}
+
+	return nil
+}
+
+func jitteredDuration(base time.Duration) time.Duration {
+	maxJitter := int64(base / 7)
+	if maxJitter <= 0 {
+		return base
+	}
+	jitter, err := crand.Int(crand.Reader, big.NewInt(maxJitter))
+	if err != nil {
+		return base
+	}
+	return base + time.Duration(jitter.Int64())
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/core/errors.go b/PROJECTS/beginner/canary-token-generator/backend/internal/core/errors.go
new file mode 100644
index 00000000..a95e2c91
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/core/errors.go
@@ -0,0 +1,113 @@
+// ©AngelaMos | 2026
+// errors.go
+
+package core
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+)
+
+var (
+	ErrNotFound     = errors.New("resource not found")
+	ErrDuplicateKey = errors.New("duplicate key violation")
+	ErrForeignKey   = errors.New("foreign key violation")
+	ErrInvalidInput = errors.New("invalid input")
+	ErrInternal     = errors.New("internal server error")
+	ErrConflict     = errors.New("resource conflict")
+	ErrRateLimited  = errors.New("rate limit exceeded")
+)
+
+type AppError struct {
+	Err        error  `json:"-"`
+	Message    string `json:"message"`
+	StatusCode int    `json:"-"`
+	Code       string `json:"code"`
+}
+
+func (e *AppError) Error() string {
+	if e.Message != "" {
+		return e.Message
+	}
+	if e.Err != nil {
+		return e.Err.Error()
+	}
+	return "unknown error"
+}
+
+func (e *AppError) Unwrap() error {
+	return e.Err
+}
+
+func NewAppError(
+	err error,
+	message string,
+	statusCode int,
+	code string,
+) *AppError {
+	return &AppError{
+		Err:        err,
+		Message:    message,
+		StatusCode: statusCode,
+		Code:       code,
+	}
+}
+
+func NotFoundError(resource string) *AppError {
+	return &AppError{
+		Err:        ErrNotFound,
+		Message:    fmt.Sprintf("%s not found", resource),
+		StatusCode: http.StatusNotFound,
+		Code:       "NOT_FOUND",
+	}
+}
+
+func DuplicateError(field string) *AppError {
+	return &AppError{
+		Err:        ErrDuplicateKey,
+		Message:    fmt.Sprintf("%s already exists", field),
+		StatusCode: http.StatusConflict,
+		Code:       "DUPLICATE",
+	}
+}
+
+func ValidationError(message string) *AppError {
+	return &AppError{
+		Err:        ErrInvalidInput,
+		Message:    message,
+		StatusCode: http.StatusBadRequest,
+		Code:       "VALIDATION_ERROR",
+	}
+}
+
+func InternalError(err error) *AppError {
+	return &AppError{
+		Err:        err,
+		Message:    "internal server error",
+		StatusCode: http.StatusInternalServerError,
+		Code:       "INTERNAL_ERROR",
+	}
+}
+
+func RateLimitError() *AppError {
+	return &AppError{
+		Err:        ErrRateLimited,
+		Message:    "too many requests",
+		StatusCode: http.StatusTooManyRequests,
+		Code:       "RATE_LIMITED",
+	}
+}
+
+func IsAppError(err error) bool {
+	var appErr *AppError
+	return errors.As(err, &appErr)
+}
+
+func GetAppError(err error) *AppError {
+	var appErr *AppError
+	if errors.As(err, &appErr) {
+		return appErr
+	}
+	return InternalError(err)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/core/migrations.go b/PROJECTS/beginner/canary-token-generator/backend/internal/core/migrations.go
new file mode 100644
index 00000000..57384167
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/core/migrations.go
@@ -0,0 +1,33 @@
+// ©AngelaMos | 2026
+// migrations.go
+
+package core
+
+import (
+	"database/sql"
+	"embed"
+	"fmt"
+	"sync"
+
+	"github.com/pressly/goose/v3"
+)
+
+//go:embed migrations/*.sql
+var migrationsFS embed.FS
+
+var gooseMu sync.Mutex
+
+func RunMigrations(db *sql.DB) error {
+	gooseMu.Lock()
+	defer gooseMu.Unlock()
+
+	goose.SetBaseFS(migrationsFS)
+
+	if err := goose.SetDialect("postgres"); err != nil {
+		return fmt.Errorf("goose set dialect: %w", err)
+	}
+	if err := goose.Up(db, "migrations"); err != nil {
+		return fmt.Errorf("goose up: %w", err)
+	}
+	return nil
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/core/migrations/0001_create_tokens.sql b/PROJECTS/beginner/canary-token-generator/backend/internal/core/migrations/0001_create_tokens.sql
new file mode 100644
index 00000000..854430e0
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/core/migrations/0001_create_tokens.sql
@@ -0,0 +1,42 @@
+-- ©AngelaMos | 2026
+-- 0001_create_tokens.sql
+
+-- +goose Up
+-- +goose StatementBegin
+CREATE TABLE tokens (
+    id              VARCHAR(12)  PRIMARY KEY,
+    manage_id       UUID         UNIQUE NOT NULL,
+    type            VARCHAR(32)  NOT NULL,
+    memo            TEXT         NOT NULL DEFAULT '',
+    filename        TEXT,
+
+    alert_channel   VARCHAR(16)  NOT NULL,
+    telegram_bot    TEXT,
+    telegram_chat   TEXT,
+    webhook_url     TEXT,
+
+    created_at      TIMESTAMPTZ  NOT NULL DEFAULT NOW(),
+    created_ip      INET         NOT NULL,
+    created_fp      CHAR(16)     NOT NULL,
+    enabled         BOOLEAN      NOT NULL DEFAULT TRUE,
+
+    trigger_count   BIGINT       NOT NULL DEFAULT 0,
+    last_triggered  TIMESTAMPTZ,
+
+    metadata        JSONB        NOT NULL DEFAULT '{}'::jsonb,
+
+    CONSTRAINT chk_type CHECK (type IN
+        ('webbug', 'slowredirect', 'docx', 'pdf', 'kubeconfig', 'envfile', 'mysql')),
+    CONSTRAINT chk_channel CHECK (alert_channel IN ('telegram', 'webhook')),
+    CONSTRAINT chk_telegram_complete CHECK (
+        alert_channel <> 'telegram' OR
+        (telegram_bot IS NOT NULL AND telegram_chat IS NOT NULL)
+    ),
+    CONSTRAINT chk_webhook_complete CHECK (
+        alert_channel <> 'webhook' OR webhook_url IS NOT NULL
+    )
+);
+-- +goose StatementEnd
+
+-- +goose Down
+DROP TABLE IF EXISTS tokens;
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/core/migrations/0002_create_events.sql b/PROJECTS/beginner/canary-token-generator/backend/internal/core/migrations/0002_create_events.sql
new file mode 100644
index 00000000..7a6c395b
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/core/migrations/0002_create_events.sql
@@ -0,0 +1,33 @@
+-- ©AngelaMos | 2026
+-- 0002_create_events.sql
+
+-- +goose Up
+-- +goose StatementBegin
+CREATE TABLE events (
+    id              BIGSERIAL    PRIMARY KEY,
+    token_id        VARCHAR(12)  NOT NULL REFERENCES tokens(id) ON DELETE CASCADE,
+    triggered_at    TIMESTAMPTZ  NOT NULL DEFAULT NOW(),
+
+    source_ip       INET         NOT NULL,
+    user_agent      TEXT,
+    referer         TEXT,
+
+    geo_country     CHAR(2),
+    geo_region      VARCHAR(64),
+    geo_city        VARCHAR(64),
+    geo_asn         INT,
+    geo_asn_org     VARCHAR(128),
+
+    extra           JSONB        NOT NULL DEFAULT '{}'::jsonb,
+
+    notify_status   VARCHAR(16)  NOT NULL DEFAULT 'pending',
+    notified_at     TIMESTAMPTZ,
+
+    CONSTRAINT chk_notify_status CHECK (
+        notify_status IN ('pending', 'sent', 'failed', 'deduped')
+    )
+);
+-- +goose StatementEnd
+
+-- +goose Down
+DROP TABLE IF EXISTS events;
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/core/migrations/0003_indexes.sql b/PROJECTS/beginner/canary-token-generator/backend/internal/core/migrations/0003_indexes.sql
new file mode 100644
index 00000000..b2d7e8de
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/core/migrations/0003_indexes.sql
@@ -0,0 +1,29 @@
+-- ©AngelaMos | 2026
+-- 0003_indexes.sql
+
+-- +goose Up
+-- +goose StatementBegin
+CREATE INDEX idx_tokens_created_ip      ON tokens(created_ip);
+CREATE INDEX idx_tokens_created_fp      ON tokens(created_fp);
+CREATE INDEX idx_tokens_created_at      ON tokens(created_at DESC);
+CREATE INDEX idx_tokens_type            ON tokens(type);
+CREATE INDEX idx_tokens_trigger_count
+    ON tokens(trigger_count DESC) WHERE trigger_count > 0;
+
+CREATE INDEX idx_events_token_triggered ON events(token_id, triggered_at DESC);
+CREATE INDEX idx_events_source_ip       ON events(source_ip);
+CREATE INDEX idx_events_notify_pending
+    ON events(notify_status) WHERE notify_status = 'pending';
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+DROP INDEX IF EXISTS idx_events_notify_pending;
+DROP INDEX IF EXISTS idx_events_source_ip;
+DROP INDEX IF EXISTS idx_events_token_triggered;
+DROP INDEX IF EXISTS idx_tokens_trigger_count;
+DROP INDEX IF EXISTS idx_tokens_type;
+DROP INDEX IF EXISTS idx_tokens_created_at;
+DROP INDEX IF EXISTS idx_tokens_created_fp;
+DROP INDEX IF EXISTS idx_tokens_created_ip;
+-- +goose StatementEnd
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/core/redis.go b/PROJECTS/beginner/canary-token-generator/backend/internal/core/redis.go
new file mode 100644
index 00000000..6349fcd5
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/core/redis.go
@@ -0,0 +1,63 @@
+// ©AngelaMos | 2026
+// redis.go
+
+package core
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/redis/go-redis/v9"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/config"
+)
+
+type Redis struct {
+	Client *redis.Client
+}
+
+func NewRedis(ctx context.Context, cfg config.RedisConfig) (*Redis, error) {
+	opts, err := redis.ParseURL(cfg.URL)
+	if err != nil {
+		return nil, fmt.Errorf("parse redis url: %w", err)
+	}
+
+	opts.PoolSize = cfg.PoolSize
+	opts.MinIdleConns = cfg.MinIdleConns
+	opts.PoolTimeout = 30 * time.Second
+	opts.ConnMaxIdleTime = 5 * time.Minute
+
+	client := redis.NewClient(opts)
+
+	pingCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	if err := client.Ping(pingCtx).Err(); err != nil {
+		return nil, fmt.Errorf("ping redis: %w", err)
+	}
+
+	return &Redis{Client: client}, nil
+}
+
+func (r *Redis) Close() error {
+	if r.Client != nil {
+		return r.Client.Close()
+	}
+	return nil
+}
+
+func (r *Redis) Ping(ctx context.Context) error {
+	pingCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	if err := r.Client.Ping(pingCtx).Err(); err != nil {
+		return fmt.Errorf("redis ping failed: %w", err)
+	}
+
+	return nil
+}
+
+func (r *Redis) PoolStats() *redis.PoolStats {
+	return r.Client.PoolStats()
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/core/response.go b/PROJECTS/beginner/canary-token-generator/backend/internal/core/response.go
new file mode 100644
index 00000000..a6e29eb3
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/core/response.go
@@ -0,0 +1,112 @@
+// ©AngelaMos | 2026
+// response.go
+
+package core
+
+import (
+	"encoding/json"
+	"log/slog"
+	"net/http"
+)
+
+type Response struct {
+	Success bool   `json:"success"`
+	Data    any    `json:"data,omitempty"`
+	Error   *Error `json:"error,omitempty"`
+	Meta    *Meta  `json:"meta,omitempty"`
+}
+
+type Error struct {
+	Code    string `json:"code"`
+	Message string `json:"message"`
+}
+
+type Meta struct {
+	Page       int `json:"page,omitempty"`
+	PageSize   int `json:"page_size,omitempty"`
+	Total      int `json:"total,omitempty"`
+	TotalPages int `json:"total_pages,omitempty"`
+}
+
+func JSON(w http.ResponseWriter, status int, data any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+
+	response := Response{
+		Success: status >= 200 && status < 300,
+		Data:    data,
+	}
+
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		slog.Error("failed to encode response", "error", err)
+	}
+}
+
+func JSONWithMeta(w http.ResponseWriter, status int, data any, meta *Meta) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+
+	response := Response{
+		Success: true,
+		Data:    data,
+		Meta:    meta,
+	}
+
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		slog.Error("failed to encode response", "error", err)
+	}
+}
+
+func JSONError(w http.ResponseWriter, err error) {
+	appErr := GetAppError(err)
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(appErr.StatusCode)
+
+	response := Response{
+		Success: false,
+		Error: &Error{
+			Code:    appErr.Code,
+			Message: appErr.Message,
+		},
+	}
+
+	if encErr := json.NewEncoder(w).Encode(response); encErr != nil {
+		slog.Error("failed to encode error response", "error", encErr)
+	}
+}
+
+func Created(w http.ResponseWriter, data any) {
+	JSON(w, http.StatusCreated, data)
+}
+
+func OK(w http.ResponseWriter, data any) {
+	JSON(w, http.StatusOK, data)
+}
+
+func NoContent(w http.ResponseWriter) {
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func BadRequest(w http.ResponseWriter, message string) {
+	JSONError(w, ValidationError(message))
+}
+
+func NotFound(w http.ResponseWriter, resource string) {
+	JSONError(w, NotFoundError(resource))
+}
+
+func InternalServerError(w http.ResponseWriter, err error) {
+	slog.Error("internal server error", "error", err)
+	JSONError(w, InternalError(err))
+}
+
+func Paginated(w http.ResponseWriter, data any, page, pageSize, total int) {
+	totalPages := (total + pageSize - 1) / pageSize
+	JSONWithMeta(w, http.StatusOK, data, &Meta{
+		Page:       page,
+		PageSize:   pageSize,
+		Total:      total,
+		TotalPages: totalPages,
+	})
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/core/telemetry.go b/PROJECTS/beginner/canary-token-generator/backend/internal/core/telemetry.go
new file mode 100644
index 00000000..8b40e71b
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/core/telemetry.go
@@ -0,0 +1,147 @@
+// ©AngelaMos | 2026
+// telemetry.go
+
+package core
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
+	"go.opentelemetry.io/otel/propagation"
+	"go.opentelemetry.io/otel/sdk/resource"
+	sdktrace "go.opentelemetry.io/otel/sdk/trace"
+	semconv "go.opentelemetry.io/otel/semconv/v1.24.0"
+	"go.opentelemetry.io/otel/trace"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/config"
+)
+
+type Telemetry struct {
+	TracerProvider *sdktrace.TracerProvider
+	Tracer         trace.Tracer
+}
+
+func NewTelemetry(
+	ctx context.Context,
+	otelCfg config.OtelConfig,
+	appCfg config.AppConfig,
+) (*Telemetry, error) {
+	if !otelCfg.Enabled || otelCfg.Endpoint == "" {
+		noopProvider := sdktrace.NewTracerProvider()
+		return &Telemetry{
+			TracerProvider: noopProvider,
+			Tracer:         noopProvider.Tracer(otelCfg.ServiceName),
+		}, nil
+	}
+
+	opts := []otlptracegrpc.Option{
+		otlptracegrpc.WithEndpoint(otelCfg.Endpoint),
+		otlptracegrpc.WithTimeout(5 * time.Second),
+	}
+
+	if otelCfg.Insecure {
+		opts = append(
+			opts,
+			otlptracegrpc.WithTLSCredentials(insecure.NewCredentials()),
+		)
+	} else {
+		opts = append(
+			opts,
+			otlptracegrpc.WithTLSCredentials(
+				credentials.NewClientTLSFromCert(nil, ""),
+			),
+		)
+	}
+
+	exporter, err := otlptracegrpc.New(ctx, opts...)
+	if err != nil {
+		return nil, fmt.Errorf("create otlp exporter: %w", err)
+	}
+
+	res, err := resource.New(ctx,
+		resource.WithAttributes(
+			semconv.ServiceName(otelCfg.ServiceName),
+			semconv.ServiceVersion(appCfg.Version),
+			attribute.String("environment", appCfg.Environment),
+		),
+		resource.WithHost(),
+		resource.WithProcess(),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("create resource: %w", err)
+	}
+
+	sampleRate := otelCfg.SampleRate
+	if sampleRate <= 0 || sampleRate > 1 {
+		sampleRate = 0.1
+	}
+
+	tp := sdktrace.NewTracerProvider(
+		sdktrace.WithBatcher(exporter,
+			sdktrace.WithBatchTimeout(5*time.Second),
+			sdktrace.WithMaxExportBatchSize(512),
+		),
+		sdktrace.WithResource(res),
+		sdktrace.WithSampler(sdktrace.ParentBased(
+			sdktrace.TraceIDRatioBased(sampleRate),
+		)),
+	)
+
+	otel.SetTracerProvider(tp)
+	otel.SetTextMapPropagator(propagation.NewCompositeTextMapPropagator(
+		propagation.TraceContext{},
+		propagation.Baggage{},
+	))
+
+	return &Telemetry{
+		TracerProvider: tp,
+		Tracer:         tp.Tracer(otelCfg.ServiceName),
+	}, nil
+}
+
+func (t *Telemetry) Shutdown(ctx context.Context) error {
+	if t.TracerProvider == nil {
+		return nil
+	}
+
+	shutdownCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+
+	if err := t.TracerProvider.Shutdown(shutdownCtx); err != nil {
+		return fmt.Errorf("shutdown tracer provider: %w", err)
+	}
+
+	return nil
+}
+
+func SpanFromContext(ctx context.Context) trace.Span {
+	return trace.SpanFromContext(ctx)
+}
+
+func TraceIDFromContext(ctx context.Context) string {
+	span := trace.SpanFromContext(ctx)
+	if span.SpanContext().IsValid() {
+		return span.SpanContext().TraceID().String()
+	}
+	return ""
+}
+
+func AddSpanEvent(
+	ctx context.Context,
+	name string,
+	attrs ...attribute.KeyValue,
+) {
+	span := trace.SpanFromContext(ctx)
+	span.AddEvent(name, trace.WithAttributes(attrs...))
+}
+
+func SetSpanError(ctx context.Context, err error) {
+	span := trace.SpanFromContext(ctx)
+	span.RecordError(err)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/core/validation.go b/PROJECTS/beginner/canary-token-generator/backend/internal/core/validation.go
new file mode 100644
index 00000000..72cd326d
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/core/validation.go
@@ -0,0 +1,42 @@
+// ©AngelaMos | 2026
+// validation.go
+
+package core
+
+import (
+	"errors"
+	"strings"
+
+	"github.com/go-playground/validator/v10"
+)
+
+func FormatValidationError(err error) string {
+	var ve validator.ValidationErrors
+	if errors.As(err, &ve) {
+		messages := make([]string, 0, len(ve))
+		for _, fe := range ve {
+			messages = append(messages, FormatFieldError(fe))
+		}
+		return strings.Join(messages, "; ")
+	}
+	return "validation failed"
+}
+
+func FormatFieldError(fe validator.FieldError) string {
+	field := strings.ToLower(fe.Field())
+
+	switch fe.Tag() {
+	case "required":
+		return field + " is required"
+	case "email":
+		return field + " must be a valid email"
+	case "min":
+		return field + " must be at least " + fe.Param() + " characters"
+	case "max":
+		return field + " must be at most " + fe.Param() + " characters"
+	case "oneof":
+		return field + " must be one of: " + fe.Param()
+	default:
+		return field + " is invalid"
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/event/contract.go b/PROJECTS/beginner/canary-token-generator/backend/internal/event/contract.go
new file mode 100644
index 00000000..265d55a6
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/event/contract.go
@@ -0,0 +1,39 @@
+// ©AngelaMos | 2026
+// contract.go
+
+package event
+
+import (
+	"context"
+	"time"
+)
+
+type NotifyInfo struct {
+	TokenID      string
+	ManageID     string
+	Type         string
+	Memo         string
+	AlertChannel string
+	TelegramBot  string
+	TelegramChat string
+	WebhookURL   string
+}
+
+type Notifier interface {
+	Notify(info NotifyInfo, evt *Event)
+}
+
+type TokenIncrementer interface {
+	IncrementTriggerCount(ctx context.Context, id string) error
+}
+
+type Store interface {
+	Insert(ctx context.Context, e *Event) error
+	UpdateNotifyStatus(
+		ctx context.Context,
+		eventID int64,
+		status NotifyStatus,
+		sentAt *time.Time,
+	) error
+	PruneToLimit(ctx context.Context, perTokenLimit int) (int64, error)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/event/dto.go b/PROJECTS/beginner/canary-token-generator/backend/internal/event/dto.go
new file mode 100644
index 00000000..5f716870
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/event/dto.go
@@ -0,0 +1,49 @@
+// ©AngelaMos | 2026
+// dto.go
+
+package event
+
+import (
+	"encoding/json"
+	"time"
+)
+
+type GeoView struct {
+	Country *string `json:"country"`
+	Region  *string `json:"region"`
+	City    *string `json:"city"`
+	ASN     *int    `json:"asn"`
+	ASNOrg  *string `json:"asn_org"`
+}
+
+type Response struct {
+	ID           int64           `json:"id"`
+	TriggeredAt  time.Time       `json:"triggered_at"`
+	SourceIP     string          `json:"source_ip"`
+	UserAgent    *string         `json:"user_agent"`
+	Referer      *string         `json:"referer"`
+	Geo          GeoView         `json:"geo"`
+	Extra        json.RawMessage `json:"extra"`
+	NotifyStatus NotifyStatus    `json:"notify_status"`
+	NotifiedAt   *time.Time      `json:"notified_at"`
+}
+
+func (e *Event) ToResponse() Response {
+	return Response{
+		ID:          e.ID,
+		TriggeredAt: e.TriggeredAt,
+		SourceIP:    e.SourceIP,
+		UserAgent:   e.UserAgent,
+		Referer:     e.Referer,
+		Geo: GeoView{
+			Country: e.GeoCountry,
+			Region:  e.GeoRegion,
+			City:    e.GeoCity,
+			ASN:     e.GeoASN,
+			ASNOrg:  e.GeoASNOrg,
+		},
+		Extra:        e.Extra,
+		NotifyStatus: e.NotifyStatus,
+		NotifiedAt:   e.NotifiedAt,
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/event/entity.go b/PROJECTS/beginner/canary-token-generator/backend/internal/event/entity.go
new file mode 100644
index 00000000..15ea6c58
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/event/entity.go
@@ -0,0 +1,65 @@
+// ©AngelaMos | 2026
+// entity.go
+
+package event
+
+import (
+	"encoding/json"
+	"time"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/geoip"
+)
+
+type NotifyStatus string
+
+const (
+	NotifyPending NotifyStatus = "pending"
+	NotifySent    NotifyStatus = "sent"
+	NotifyFailed  NotifyStatus = "failed"
+	NotifyDeduped NotifyStatus = "deduped"
+)
+
+func (s NotifyStatus) Valid() bool {
+	switch s {
+	case NotifyPending, NotifySent, NotifyFailed, NotifyDeduped:
+		return true
+	}
+	return false
+}
+
+type Event struct {
+	ID           int64           `db:"id"            json:"id"`
+	TokenID      string          `db:"token_id"      json:"token_id"`
+	TriggeredAt  time.Time       `db:"triggered_at"  json:"triggered_at"`
+	SourceIP     string          `db:"source_ip"     json:"source_ip"`
+	UserAgent    *string         `db:"user_agent"    json:"user_agent"`
+	Referer      *string         `db:"referer"       json:"referer"`
+	GeoCountry   *string         `db:"geo_country"   json:"geo_country"`
+	GeoRegion    *string         `db:"geo_region"    json:"geo_region"`
+	GeoCity      *string         `db:"geo_city"      json:"geo_city"`
+	GeoASN       *int            `db:"geo_asn"       json:"geo_asn"`
+	GeoASNOrg    *string         `db:"geo_asn_org"   json:"geo_asn_org"`
+	Extra        json.RawMessage `db:"extra"         json:"extra"`
+	NotifyStatus NotifyStatus    `db:"notify_status" json:"notify_status"`
+	NotifiedAt   *time.Time      `db:"notified_at"   json:"notified_at"`
+}
+
+func (e *Event) AttachGeoIP(l geoip.Lookup) {
+	e.GeoCountry = nonEmptyPtr(l.Country)
+	e.GeoRegion = nonEmptyPtr(l.Region)
+	e.GeoCity = nonEmptyPtr(l.City)
+	e.GeoASNOrg = nonEmptyPtr(l.ASNOrg)
+	if l.ASN > 0 {
+		asn := l.ASN
+		e.GeoASN = &asn
+		return
+	}
+	e.GeoASN = nil
+}
+
+func nonEmptyPtr(s string) *string {
+	if s == "" {
+		return nil
+	}
+	return &s
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/event/entity_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/event/entity_test.go
new file mode 100644
index 00000000..a1abbd08
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/event/entity_test.go
@@ -0,0 +1,115 @@
+// ©AngelaMos | 2026
+// entity_test.go
+
+package event_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/geoip"
+)
+
+func TestEvent_AttachGeoIP_PopulatesAllFields(t *testing.T) {
+	t.Parallel()
+	e := &event.Event{}
+	e.AttachGeoIP(geoip.Lookup{
+		Country: "US",
+		Region:  "California",
+		City:    "Mountain View",
+		ASN:     15169,
+		ASNOrg:  "Google LLC",
+	})
+
+	require.NotNil(t, e.GeoCountry)
+	require.Equal(t, "US", *e.GeoCountry)
+	require.NotNil(t, e.GeoRegion)
+	require.Equal(t, "California", *e.GeoRegion)
+	require.NotNil(t, e.GeoCity)
+	require.Equal(t, "Mountain View", *e.GeoCity)
+	require.NotNil(t, e.GeoASN)
+	require.Equal(t, 15169, *e.GeoASN)
+	require.NotNil(t, e.GeoASNOrg)
+	require.Equal(t, "Google LLC", *e.GeoASNOrg)
+}
+
+func TestEvent_AttachGeoIP_EmptyLookupLeavesAllNil(t *testing.T) {
+	t.Parallel()
+	e := &event.Event{}
+	e.AttachGeoIP(geoip.Lookup{})
+
+	require.Nil(t, e.GeoCountry)
+	require.Nil(t, e.GeoRegion)
+	require.Nil(t, e.GeoCity)
+	require.Nil(t, e.GeoASN)
+	require.Nil(t, e.GeoASNOrg)
+}
+
+func TestEvent_AttachGeoIP_PartialFieldsPopulated(t *testing.T) {
+	t.Parallel()
+	e := &event.Event{}
+	e.AttachGeoIP(geoip.Lookup{Country: "JP", City: "Tokyo"})
+
+	require.NotNil(t, e.GeoCountry)
+	require.Equal(t, "JP", *e.GeoCountry)
+	require.Nil(t, e.GeoRegion)
+	require.NotNil(t, e.GeoCity)
+	require.Equal(t, "Tokyo", *e.GeoCity)
+	require.Nil(t, e.GeoASN)
+	require.Nil(t, e.GeoASNOrg)
+}
+
+func TestEvent_AttachGeoIP_ZeroASNStaysNil(t *testing.T) {
+	t.Parallel()
+	e := &event.Event{}
+	e.AttachGeoIP(geoip.Lookup{Country: "FR", ASN: 0, ASNOrg: ""})
+	require.Nil(t, e.GeoASN,
+		"ASN=0 (sentinel for missing) must not produce a pointer")
+}
+
+func TestEvent_AttachGeoIP_NegativeASNStaysNil(t *testing.T) {
+	t.Parallel()
+	e := &event.Event{}
+	e.AttachGeoIP(geoip.Lookup{ASN: -1})
+	require.Nil(t, e.GeoASN,
+		"defensive: negative ASN is invalid and must not produce a pointer")
+}
+
+func TestEvent_AttachGeoIP_OverwritesPriorValues(t *testing.T) {
+	t.Parallel()
+	prior := "OLD"
+	priorASN := 99
+	e := &event.Event{
+		GeoCountry: &prior,
+		GeoRegion:  &prior,
+		GeoCity:    &prior,
+		GeoASNOrg:  &prior,
+		GeoASN:     &priorASN,
+	}
+	e.AttachGeoIP(geoip.Lookup{Country: "DE", City: "Berlin"})
+
+	require.NotNil(t, e.GeoCountry)
+	require.Equal(t, "DE", *e.GeoCountry)
+	require.Nil(t, e.GeoRegion,
+		"AttachGeoIP must overwrite a prior value with nil when "+
+			"the new lookup is empty")
+	require.NotNil(t, e.GeoCity)
+	require.Equal(t, "Berlin", *e.GeoCity)
+	require.Nil(t, e.GeoASN)
+	require.Nil(t, e.GeoASNOrg)
+}
+
+func TestEvent_AttachGeoIP_AddressableASNPointer(t *testing.T) {
+	t.Parallel()
+	e := &event.Event{}
+	e.AttachGeoIP(geoip.Lookup{ASN: 64512})
+	require.NotNil(t, e.GeoASN)
+	require.Equal(t, 64512, *e.GeoASN)
+
+	*e.GeoASN = 1
+	require.Equal(t, 1, *e.GeoASN,
+		"ASN pointer must be independently mutable, "+
+			"not aliasing the input Lookup")
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/event/integration_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/event/integration_test.go
new file mode 100644
index 00000000..be1187c1
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/event/integration_test.go
@@ -0,0 +1,676 @@
+// ©AngelaMos | 2026
+// integration_test.go
+
+//go:build integration
+
+package event_test
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/alicebob/miniredis/v2"
+	"github.com/go-chi/chi/v5"
+	"github.com/jmoiron/sqlx"
+	"github.com/redis/go-redis/v9"
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/geoip"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/middleware"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/notify"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/testutil"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/registry"
+)
+
+const (
+	intgManageURL = "https://canary.example.com"
+	intgBaseURL   = "https://canary.example.com"
+	intgTokenMemo = "integration-test-memo"
+)
+
+type capturingSender struct {
+	mu    sync.Mutex
+	calls []captureCall
+}
+
+type captureCall struct {
+	info event.NotifyInfo
+	evt  *event.Event
+}
+
+func (c *capturingSender) Channel() string { return "telegram" }
+
+func (c *capturingSender) Send(
+	_ context.Context,
+	info event.NotifyInfo,
+	evt *event.Event,
+) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.calls = append(c.calls, captureCall{info, evt})
+	return nil
+}
+
+func (c *capturingSender) callCount() int {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return len(c.calls)
+}
+
+type intgStack struct {
+	router    chi.Router
+	notifySvc *notify.Service
+	sender    *capturingSender
+	eventRepo *event.Repository
+	tokenRepo *token.Repository
+	mr        *miniredis.Miniredis
+}
+
+func setupIntgStack(t *testing.T) *intgStack {
+	t.Helper()
+	db := sqlx.NewDb(testutil.NewTestDB(t), "pgx")
+
+	mr, err := miniredis.Run()
+	require.NoError(t, err)
+	t.Cleanup(mr.Close)
+	rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
+	t.Cleanup(func() {
+		if cErr := rdb.Close(); cErr != nil {
+			t.Logf("redis close: %v", cErr)
+		}
+	})
+
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+
+	tokenRepo := token.NewRepository(db)
+	eventRepo := event.NewRepository(db)
+	sender := &capturingSender{}
+
+	notifySvc := notify.NewService(eventRepo,
+		notify.WithLogger(logger),
+		notify.WithSendTimeout(2*time.Second),
+	)
+	notifySvc.Register(sender)
+
+	eventSvc := event.NewService(eventRepo, tokenRepo, rdb, notifySvc, event.ServiceConfig{
+		DedupTTL: 15 * time.Minute,
+		Logger:   logger,
+	})
+
+	genRegistry := registry.Build(registry.Config{
+		BaseURL:         intgBaseURL,
+		MySQLPublicHost: "localhost",
+		MySQLPublicPort: 3306,
+	})
+	tokenSvc := token.NewService(
+		tokenRepo,
+		intgRegistryAdapter{r: genRegistry},
+		token.ServiceConfig{
+			BaseURL:   intgBaseURL,
+			ManageURL: intgManageURL,
+		},
+	)
+
+	tokenH := token.NewHandler(
+		tokenSvc,
+		intgRecorderAdapter{svc: eventSvc},
+		nil,
+		eventRepo,
+		eventSvc,
+		logger,
+		false,
+	)
+
+	r := chi.NewRouter()
+	r.Use(middleware.RequestID)
+	r.Use(middleware.Recovery(logger))
+	tokenH.RegisterTriggerRoutes(r)
+	r.Route("/api", func(api chi.Router) {
+		api.Get("/tokens/types", tokenH.GetTypes)
+		api.Post("/tokens", tokenH.CreateToken)
+		tokenH.RegisterManageRoutes(api)
+	})
+
+	return &intgStack{
+		router:    r,
+		notifySvc: notifySvc,
+		sender:    sender,
+		eventRepo: eventRepo,
+		tokenRepo: tokenRepo,
+		mr:        mr,
+	}
+}
+
+type intgRegistryAdapter struct{ r registry.Registry }
+
+func (a intgRegistryAdapter) Get(t token.Type) (token.Generator, bool) {
+	g, ok := a.r[t]
+	return g, ok
+}
+
+type intgRecorderAdapter struct{ svc *event.Service }
+
+func (a intgRecorderAdapter) Record(
+	ctx context.Context,
+	t *token.Token,
+	evt *event.Event,
+) error {
+	return a.svc.Record(ctx, t.NotifyInfo(), evt)
+}
+
+func TestIntegration_FullCreateAndTriggerFlow(t *testing.T) {
+	t.Parallel()
+	st := setupIntgStack(t)
+
+	createBody := `{
+		"type": "webbug",
+		"memo": "` + intgTokenMemo + `",
+		"alert_channel": "telegram",
+		"telegram_bot": "111:AAA",
+		"telegram_chat": "12345"
+	}`
+	req := httptest.NewRequest(http.MethodPost, "/api/tokens",
+		strings.NewReader(createBody))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	st.router.ServeHTTP(w, req)
+	require.Equal(t, http.StatusCreated, w.Code, "body=%s", w.Body.String())
+
+	var resp struct {
+		Success bool `json:"success"`
+		Data    struct {
+			Token struct {
+				ID         string `json:"id"`
+				ManageID   string `json:"manage_id"`
+				TriggerURL string `json:"trigger_url"`
+				ManageURL  string `json:"manage_url"`
+			} `json:"token"`
+		} `json:"data"`
+	}
+	require.NoError(t, json.NewDecoder(w.Body).Decode(&resp))
+	require.True(t, resp.Success)
+	require.NotEmpty(t, resp.Data.Token.ID)
+	require.Contains(t, resp.Data.Token.TriggerURL, "/c/"+resp.Data.Token.ID)
+	require.Contains(t, resp.Data.Token.ManageURL, "/m/"+resp.Data.Token.ManageID)
+
+	tokenID := resp.Data.Token.ID
+
+	for range 2 {
+		trigReq := httptest.NewRequest(http.MethodGet, "/c/"+tokenID, nil)
+		trigReq.Header.Set("CF-Connecting-IP", "203.0.113.99")
+		trigReq.Header.Set("User-Agent", "IntegrationTest/1.0")
+		tw := httptest.NewRecorder()
+		st.router.ServeHTTP(tw, trigReq)
+		require.Equal(t, http.StatusOK, tw.Code)
+		require.Equal(t, "image/gif", tw.Header().Get("Content-Type"))
+	}
+
+	require.Eventually(t, func() bool {
+		return st.sender.callCount() == 1
+	}, 2*time.Second, 10*time.Millisecond,
+		"only first trigger should fire a notification")
+
+	st.notifySvc.Wait()
+
+	count, err := st.eventRepo.CountByToken(context.Background(), tokenID)
+	require.NoError(t, err)
+	require.Equal(t, int64(2), count, "both events recorded")
+
+	list, err := st.eventRepo.ListByToken(context.Background(), tokenID, event.ListOptions{Limit: 10})
+	require.NoError(t, err)
+	require.Len(t, list.Events, 2)
+
+	statuses := []event.NotifyStatus{list.Events[0].NotifyStatus, list.Events[1].NotifyStatus}
+	var sent, deduped int
+	for _, s := range statuses {
+		switch s {
+		case event.NotifySent:
+			sent++
+		case event.NotifyDeduped:
+			deduped++
+		}
+	}
+	require.Equal(t, 1, sent, "first event eventually marked sent")
+	require.Equal(t, 1, deduped, "duplicate event marked deduped")
+
+	dedupKey := event.DedupKey(tokenID, "203.0.113.99")
+	val, err := st.mr.Get(dedupKey)
+	require.NoError(t, err)
+	require.Equal(t, "2", val, "dedup INCR ran on duplicate")
+
+	tok, err := st.tokenRepo.GetByID(context.Background(), tokenID)
+	require.NoError(t, err)
+	require.Equal(t, int64(2), tok.TriggerCount, "trigger count incremented twice")
+	require.NotNil(t, tok.LastTriggered)
+}
+
+func TestIntegration_DifferentIPsBothNotify(t *testing.T) {
+	t.Parallel()
+	st := setupIntgStack(t)
+
+	createBody := `{
+		"type": "webbug",
+		"memo": "` + intgTokenMemo + `",
+		"alert_channel": "telegram",
+		"telegram_bot": "111:AAA",
+		"telegram_chat": "12345"
+	}`
+	req := httptest.NewRequest(http.MethodPost, "/api/tokens",
+		strings.NewReader(createBody))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	st.router.ServeHTTP(w, req)
+	require.Equal(t, http.StatusCreated, w.Code)
+
+	var resp struct {
+		Data struct {
+			Token struct {
+				ID string `json:"id"`
+			} `json:"token"`
+		} `json:"data"`
+	}
+	require.NoError(t, json.NewDecoder(w.Body).Decode(&resp))
+	tokenID := resp.Data.Token.ID
+
+	ips := []string{"203.0.113.10", "203.0.113.11", "203.0.113.12"}
+	for _, ip := range ips {
+		trigReq := httptest.NewRequest(http.MethodGet, "/c/"+tokenID, nil)
+		trigReq.Header.Set("CF-Connecting-IP", ip)
+		tw := httptest.NewRecorder()
+		st.router.ServeHTTP(tw, trigReq)
+		require.Equal(t, http.StatusOK, tw.Code)
+	}
+
+	require.Eventually(t, func() bool {
+		return st.sender.callCount() == len(ips)
+	}, 2*time.Second, 10*time.Millisecond)
+
+	st.notifySvc.Wait()
+}
+
+func TestIntegration_DedupTTLExpiry(t *testing.T) {
+	t.Parallel()
+	db := sqlx.NewDb(testutil.NewTestDB(t), "pgx")
+	mr, err := miniredis.Run()
+	require.NoError(t, err)
+	t.Cleanup(mr.Close)
+	rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
+	t.Cleanup(func() { _ = rdb.Close() })
+
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	tokenRepo := token.NewRepository(db)
+	eventRepo := event.NewRepository(db)
+	sender := &capturingSender{}
+
+	notifySvc := notify.NewService(eventRepo,
+		notify.WithLogger(logger),
+		notify.WithSendTimeout(2*time.Second),
+	)
+	notifySvc.Register(sender)
+
+	eventSvc := event.NewService(eventRepo, tokenRepo, rdb, notifySvc, event.ServiceConfig{
+		DedupTTL: 50 * time.Millisecond,
+		Logger:   logger,
+	})
+
+	tok := &token.Token{
+		ID:           "intgttl00001",
+		ManageID:     "11111111-1111-1111-1111-111111111111",
+		Type:         token.TypeWebbug,
+		Memo:         "ttl-test",
+		AlertChannel: token.ChannelTelegram,
+		TelegramBot:  testutil.Ptr("111:AAA"),
+		TelegramChat: testutil.Ptr("12345"),
+		CreatedIP:    "203.0.113.1",
+		CreatedFP:    "fp",
+		Metadata:     json.RawMessage(`{}`),
+		Enabled:      true,
+	}
+	require.NoError(t, tokenRepo.Insert(context.Background(), tok))
+
+	rec := func(ip string) {
+		evt := &event.Event{TokenID: tok.ID, SourceIP: ip}
+		require.NoError(t, eventSvc.Record(context.Background(), tok.NotifyInfo(), evt))
+	}
+
+	rec("203.0.113.1")
+	rec("203.0.113.1")
+	notifySvc.Wait()
+	require.Equal(t, 1, sender.callCount(), "second within TTL is deduped")
+
+	mr.FastForward(100 * time.Millisecond)
+
+	rec("203.0.113.1")
+	notifySvc.Wait()
+	require.Equal(t, 2, sender.callCount(), "after TTL expiry next trigger notifies again")
+}
+
+func TestIntegration_ManagePageReturnsTokenAndEventsAndSilencedCount(t *testing.T) {
+	t.Parallel()
+	st := setupIntgStack(t)
+
+	createBody := `{
+		"type": "webbug",
+		"memo": "manage-flow",
+		"alert_channel": "telegram",
+		"telegram_bot": "111:AAA",
+		"telegram_chat": "12345"
+	}`
+	req := httptest.NewRequest(http.MethodPost, "/api/tokens",
+		strings.NewReader(createBody))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	st.router.ServeHTTP(w, req)
+	require.Equal(t, http.StatusCreated, w.Code, "body=%s", w.Body.String())
+
+	var createResp struct {
+		Data struct {
+			Token struct {
+				ID       string `json:"id"`
+				ManageID string `json:"manage_id"`
+			} `json:"token"`
+		} `json:"data"`
+	}
+	require.NoError(t, json.NewDecoder(w.Body).Decode(&createResp))
+	tokenID := createResp.Data.Token.ID
+	manageID := createResp.Data.Token.ManageID
+
+	for range 3 {
+		trigReq := httptest.NewRequest(http.MethodGet, "/c/"+tokenID, nil)
+		trigReq.Header.Set("CF-Connecting-IP", "203.0.113.50")
+		tw := httptest.NewRecorder()
+		st.router.ServeHTTP(tw, trigReq)
+		require.Equal(t, http.StatusOK, tw.Code)
+	}
+	st.notifySvc.Wait()
+
+	mw := httptest.NewRecorder()
+	st.router.ServeHTTP(mw, httptest.NewRequest(http.MethodGet,
+		"/api/m/"+manageID, nil))
+	require.Equal(t, http.StatusOK, mw.Code, "body=%s", mw.Body.String())
+
+	var manageResp struct {
+		Success bool                 `json:"success"`
+		Data    token.ManageResponse `json:"data"`
+	}
+	require.NoError(t, json.NewDecoder(mw.Body).Decode(&manageResp))
+	require.True(t, manageResp.Success)
+
+	require.Equal(t, tokenID, manageResp.Data.Token.ID)
+	require.Equal(t, "https://canary.example.com/c/"+tokenID,
+		manageResp.Data.Token.TriggerURL)
+	require.Equal(t, int64(3), manageResp.Data.Token.TriggerCount)
+
+	require.Equal(t, int64(3), manageResp.Data.EventsTotal,
+		"all 3 events recorded (one sent + two deduped)")
+	require.Equal(t, int64(1), manageResp.Data.EventsSilencedActive,
+		"one unique IP silenced (same source for both dedup hits)")
+
+	require.Len(t, manageResp.Data.Events, 3, "events page payload")
+	require.False(t, manageResp.Data.Page.HasMore,
+		"3 events fits in a 20-page; no next cursor")
+
+	statuses := []event.NotifyStatus{}
+	for _, e := range manageResp.Data.Events {
+		statuses = append(statuses, e.NotifyStatus)
+	}
+	var sent, deduped int
+	for _, s := range statuses {
+		switch s {
+		case event.NotifySent:
+			sent++
+		case event.NotifyDeduped:
+			deduped++
+		}
+	}
+	require.Equal(t, 1, sent)
+	require.Equal(t, 2, deduped)
+}
+
+func TestIntegration_ManagePageReturns404OnUnknownManageID(t *testing.T) {
+	t.Parallel()
+	st := setupIntgStack(t)
+
+	w := httptest.NewRecorder()
+	st.router.ServeHTTP(w, httptest.NewRequest(http.MethodGet,
+		"/api/m/00000000-0000-0000-0000-000000000000", nil))
+	require.Equal(t, http.StatusNotFound, w.Code)
+}
+
+func TestIntegration_ManageDeleteCascadesEvents(t *testing.T) {
+	t.Parallel()
+	st := setupIntgStack(t)
+
+	createBody := `{
+		"type": "webbug",
+		"memo": "delete-flow",
+		"alert_channel": "telegram",
+		"telegram_bot": "111:AAA",
+		"telegram_chat": "12345"
+	}`
+	req := httptest.NewRequest(http.MethodPost, "/api/tokens",
+		strings.NewReader(createBody))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	st.router.ServeHTTP(w, req)
+	require.Equal(t, http.StatusCreated, w.Code)
+
+	var createResp struct {
+		Data struct {
+			Token struct {
+				ID       string `json:"id"`
+				ManageID string `json:"manage_id"`
+			} `json:"token"`
+		} `json:"data"`
+	}
+	require.NoError(t, json.NewDecoder(w.Body).Decode(&createResp))
+
+	for i := range 2 {
+		trigReq := httptest.NewRequest(http.MethodGet, "/c/"+createResp.Data.Token.ID, nil)
+		ip := "203.0.113." + string(rune('1'+i))
+		trigReq.Header.Set("CF-Connecting-IP", ip)
+		tw := httptest.NewRecorder()
+		st.router.ServeHTTP(tw, trigReq)
+		require.Equal(t, http.StatusOK, tw.Code)
+	}
+	st.notifySvc.Wait()
+
+	count, err := st.eventRepo.CountByToken(context.Background(), createResp.Data.Token.ID)
+	require.NoError(t, err)
+	require.Equal(t, int64(2), count)
+
+	dw := httptest.NewRecorder()
+	st.router.ServeHTTP(dw, httptest.NewRequest(http.MethodDelete,
+		"/api/m/"+createResp.Data.Token.ManageID, nil))
+	require.Equal(t, http.StatusNoContent, dw.Code)
+
+	count, err = st.eventRepo.CountByToken(context.Background(), createResp.Data.Token.ID)
+	require.NoError(t, err)
+	require.Equal(t, int64(0), count, "FK cascade removes events")
+
+	tok, err := st.tokenRepo.GetByID(context.Background(), createResp.Data.Token.ID)
+	require.Nil(t, tok)
+	require.ErrorIs(t, err, token.ErrNotFound)
+}
+
+func TestIntegration_RetentionLoopPrunes(t *testing.T) {
+	t.Parallel()
+	db := sqlx.NewDb(testutil.NewTestDB(t), "pgx")
+	tokenRepo := token.NewRepository(db)
+	eventRepo := event.NewRepository(db)
+
+	mr, err := miniredis.Run()
+	require.NoError(t, err)
+	t.Cleanup(mr.Close)
+	rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
+	t.Cleanup(func() { _ = rdb.Close() })
+
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	eventSvc := event.NewService(eventRepo, tokenRepo, rdb, nil, event.ServiceConfig{
+		DedupTTL: 15 * time.Minute,
+		Logger:   logger,
+	})
+
+	tok := &token.Token{
+		ID:           "intgret00001",
+		ManageID:     "22222222-2222-2222-2222-222222222222",
+		Type:         token.TypeWebbug,
+		Memo:         "ret",
+		AlertChannel: token.ChannelTelegram,
+		TelegramBot:  testutil.Ptr("111:AAA"),
+		TelegramChat: testutil.Ptr("12345"),
+		CreatedIP:    "203.0.113.1",
+		CreatedFP:    "fp",
+		Metadata:     json.RawMessage(`{}`),
+		Enabled:      true,
+	}
+	require.NoError(t, tokenRepo.Insert(context.Background(), tok))
+
+	for range 7 {
+		require.NoError(t, eventRepo.Insert(context.Background(), &event.Event{
+			TokenID: tok.ID, SourceIP: "203.0.113.99",
+		}))
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan struct{})
+	go func() {
+		eventSvc.RunRetentionLoop(ctx, 25*time.Millisecond, 3)
+		close(done)
+	}()
+
+	require.Eventually(t, func() bool {
+		n, err := eventRepo.CountByToken(context.Background(), tok.ID)
+		return err == nil && n == 3
+	}, 2*time.Second, 25*time.Millisecond, "retention should prune to 3")
+
+	cancel()
+	<-done
+}
+
+type stubLookuper struct{ result geoip.Lookup }
+
+func (s stubLookuper) Lookup(string) geoip.Lookup { return s.result }
+
+func TestIntegration_GeoEnrichmentPopulatesColumns(t *testing.T) {
+	t.Parallel()
+	db := sqlx.NewDb(testutil.NewTestDB(t), "pgx")
+	mr, err := miniredis.Run()
+	require.NoError(t, err)
+	t.Cleanup(mr.Close)
+	rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
+	t.Cleanup(func() { _ = rdb.Close() })
+
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	tokenRepo := token.NewRepository(db)
+	eventRepo := event.NewRepository(db)
+
+	geo := stubLookuper{result: geoip.Lookup{
+		Country: "US",
+		Region:  "California",
+		City:    "Mountain View",
+		ASN:     15169,
+		ASNOrg:  "Google LLC",
+	}}
+
+	eventSvc := event.NewService(eventRepo, tokenRepo, rdb, nil, event.ServiceConfig{
+		DedupTTL: 15 * time.Minute,
+		Logger:   logger,
+		GeoIP:    geo,
+	})
+
+	tok := &token.Token{
+		ID:           "intggeo00001",
+		ManageID:     "33333333-3333-3333-3333-333333333333",
+		Type:         token.TypeWebbug,
+		Memo:         "geo-test",
+		AlertChannel: token.ChannelTelegram,
+		TelegramBot:  testutil.Ptr("111:AAA"),
+		TelegramChat: testutil.Ptr("12345"),
+		CreatedIP:    "203.0.113.1",
+		CreatedFP:    "fp",
+		Metadata:     json.RawMessage(`{}`),
+		Enabled:      true,
+	}
+	require.NoError(t, tokenRepo.Insert(context.Background(), tok))
+
+	evt := &event.Event{TokenID: tok.ID, SourceIP: "203.0.113.99"}
+	require.NoError(t, eventSvc.Record(context.Background(), tok.NotifyInfo(), evt))
+
+	list, err := eventRepo.ListByToken(context.Background(), tok.ID,
+		event.ListOptions{Limit: 1})
+	require.NoError(t, err)
+	require.Len(t, list.Events, 1)
+
+	row := list.Events[0]
+	require.NotNil(t, row.GeoCountry)
+	require.Equal(t, "US", *row.GeoCountry)
+	require.NotNil(t, row.GeoRegion)
+	require.Equal(t, "California", *row.GeoRegion)
+	require.NotNil(t, row.GeoCity)
+	require.Equal(t, "Mountain View", *row.GeoCity)
+	require.NotNil(t, row.GeoASN)
+	require.Equal(t, 15169, *row.GeoASN)
+	require.NotNil(t, row.GeoASNOrg)
+	require.Equal(t, "Google LLC", *row.GeoASNOrg)
+}
+
+func TestIntegration_GeoEnrichmentLeavesColumnsNullWhenLookupEmpty(t *testing.T) {
+	t.Parallel()
+	db := sqlx.NewDb(testutil.NewTestDB(t), "pgx")
+	mr, err := miniredis.Run()
+	require.NoError(t, err)
+	t.Cleanup(mr.Close)
+	rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
+	t.Cleanup(func() { _ = rdb.Close() })
+
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	tokenRepo := token.NewRepository(db)
+	eventRepo := event.NewRepository(db)
+
+	eventSvc := event.NewService(eventRepo, tokenRepo, rdb, nil, event.ServiceConfig{
+		DedupTTL: 15 * time.Minute,
+		Logger:   logger,
+		GeoIP:    geoip.NopService(),
+	})
+
+	tok := &token.Token{
+		ID:           "intggeo00002",
+		ManageID:     "44444444-4444-4444-4444-444444444444",
+		Type:         token.TypeWebbug,
+		Memo:         "geo-nop",
+		AlertChannel: token.ChannelTelegram,
+		TelegramBot:  testutil.Ptr("111:AAA"),
+		TelegramChat: testutil.Ptr("12345"),
+		CreatedIP:    "203.0.113.1",
+		CreatedFP:    "fp",
+		Metadata:     json.RawMessage(`{}`),
+		Enabled:      true,
+	}
+	require.NoError(t, tokenRepo.Insert(context.Background(), tok))
+
+	evt := &event.Event{TokenID: tok.ID, SourceIP: "203.0.113.42"}
+	require.NoError(t, eventSvc.Record(context.Background(), tok.NotifyInfo(), evt))
+
+	list, err := eventRepo.ListByToken(context.Background(), tok.ID,
+		event.ListOptions{Limit: 1})
+	require.NoError(t, err)
+	require.Len(t, list.Events, 1)
+
+	row := list.Events[0]
+	require.Nil(t, row.GeoCountry)
+	require.Nil(t, row.GeoRegion)
+	require.Nil(t, row.GeoCity)
+	require.Nil(t, row.GeoASN)
+	require.Nil(t, row.GeoASNOrg)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/event/repository.go b/PROJECTS/beginner/canary-token-generator/backend/internal/event/repository.go
new file mode 100644
index 00000000..b6405346
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/event/repository.go
@@ -0,0 +1,249 @@
+// ©AngelaMos | 2026
+// repository.go
+
+package event
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"github.com/jmoiron/sqlx"
+)
+
+var ErrNotFound = errors.New("event not found")
+
+const defaultListLimit = 20
+
+type Repository struct {
+	db *sqlx.DB
+}
+
+func NewRepository(db *sqlx.DB) *Repository {
+	return &Repository{db: db}
+}
+
+const insertSQL = `
+INSERT INTO events (
+    token_id, source_ip, user_agent, referer,
+    geo_country, geo_region, geo_city, geo_asn, geo_asn_org,
+    extra, notify_status
+) VALUES (
+    :token_id, :source_ip, :user_agent, :referer,
+    :geo_country, :geo_region, :geo_city, :geo_asn, :geo_asn_org,
+    :extra, :notify_status
+)
+RETURNING id, triggered_at`
+
+func (r *Repository) Insert(ctx context.Context, e *Event) error {
+	if e.NotifyStatus == "" {
+		e.NotifyStatus = NotifyPending
+	}
+	if len(e.Extra) == 0 {
+		e.Extra = json.RawMessage(`{}`)
+	}
+
+	stmt, err := r.db.PrepareNamedContext(ctx, insertSQL)
+	if err != nil {
+		return fmt.Errorf("prepare insert event: %w", err)
+	}
+	defer func() {
+		if cerr := stmt.Close(); cerr != nil {
+			slog.WarnContext(ctx, "close prepared stmt",
+				"op", "insert_event", "error", cerr)
+		}
+	}()
+
+	if err := stmt.GetContext(ctx, e, e); err != nil {
+		return fmt.Errorf("insert event: %w", err)
+	}
+	return nil
+}
+
+const selectColumns = `
+    id, token_id, triggered_at,
+    source_ip, user_agent, referer,
+    geo_country, geo_region, geo_city, geo_asn, geo_asn_org,
+    extra, notify_status, notified_at`
+
+type ListOptions struct {
+	Cursor int64
+	Limit  int
+}
+
+type ListResult struct {
+	Events     []Event
+	NextCursor int64
+	HasMore    bool
+}
+
+func (r *Repository) ListByToken(
+	ctx context.Context, tokenID string, opts ListOptions,
+) (ListResult, error) {
+	if opts.Limit <= 0 {
+		opts.Limit = defaultListLimit
+	}
+
+	q := `SELECT ` + selectColumns + `
+            FROM events
+           WHERE token_id = $1
+             AND ($2 = 0 OR id < $2)
+           ORDER BY id DESC
+           LIMIT $3`
+
+	var events []Event
+	err := r.db.SelectContext(
+		ctx,
+		&events,
+		q,
+		tokenID,
+		opts.Cursor,
+		opts.Limit+1,
+	)
+	if err != nil {
+		return ListResult{}, fmt.Errorf("list events: %w", err)
+	}
+
+	hasMore := len(events) > opts.Limit
+	if hasMore {
+		events = events[:opts.Limit]
+	}
+
+	var next int64
+	if hasMore && len(events) > 0 {
+		next = events[len(events)-1].ID
+	}
+
+	return ListResult{
+		Events:     events,
+		NextCursor: next,
+		HasMore:    hasMore,
+	}, nil
+}
+
+func (r *Repository) CountByToken(
+	ctx context.Context,
+	tokenID string,
+) (int64, error) {
+	var n int64
+	err := r.db.GetContext(ctx, &n,
+		`SELECT COUNT(*) FROM events WHERE token_id = $1`, tokenID)
+	if err != nil {
+		return 0, fmt.Errorf("count events: %w", err)
+	}
+	return n, nil
+}
+
+func (r *Repository) CountAll(ctx context.Context) (int64, error) {
+	var n int64
+	if err := r.db.GetContext(
+		ctx,
+		&n,
+		`SELECT COUNT(*) FROM events`,
+	); err != nil {
+		return 0, fmt.Errorf("count events: %w", err)
+	}
+	return n, nil
+}
+
+func (r *Repository) AttachFingerprint(
+	ctx context.Context,
+	tokenID, sourceIP string,
+	fingerprint json.RawMessage,
+	window time.Duration,
+) error {
+	q := `
+UPDATE events
+   SET extra = extra || $3::jsonb
+ WHERE id = (
+     SELECT id FROM events
+      WHERE token_id = $1
+        AND source_ip = $2::inet
+        AND triggered_at >= NOW() - $4::interval
+      ORDER BY id DESC
+      LIMIT 1
+ )`
+	res, err := r.db.ExecContext(
+		ctx,
+		q,
+		tokenID,
+		sourceIP,
+		[]byte(fingerprint),
+		fmt.Sprintf("%d milliseconds", window.Milliseconds()),
+	)
+	if err != nil {
+		return fmt.Errorf("attach fingerprint: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("rows affected: %w", err)
+	}
+	if n == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+func (r *Repository) UpdateNotifyStatus(
+	ctx context.Context, eventID int64, status NotifyStatus, sentAt *time.Time,
+) error {
+	q := `
+UPDATE events
+   SET notify_status = $2, notified_at = $3
+ WHERE id = $1`
+	res, err := r.db.ExecContext(ctx, q, eventID, status, sentAt)
+	if err != nil {
+		return fmt.Errorf("update notify status: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("rows affected: %w", err)
+	}
+	if n == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+func (r *Repository) PruneToLimit(
+	ctx context.Context,
+	perTokenLimit int,
+) (int64, error) {
+	if perTokenLimit <= 0 {
+		return 0, errors.New("perTokenLimit must be positive")
+	}
+	q := `
+WITH ranked AS (
+    SELECT id,
+           row_number() OVER (PARTITION BY token_id ORDER BY triggered_at DESC) AS rn
+      FROM events
+)
+DELETE FROM events
+ WHERE id IN (SELECT id FROM ranked WHERE rn > $1)`
+	res, err := r.db.ExecContext(ctx, q, perTokenLimit)
+	if err != nil {
+		return 0, fmt.Errorf("prune events: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return 0, fmt.Errorf("rows affected: %w", err)
+	}
+	return n, nil
+}
+
+func (r *Repository) GetByID(ctx context.Context, id int64) (*Event, error) {
+	var e Event
+	q := `SELECT ` + selectColumns + ` FROM events WHERE id = $1`
+	err := r.db.GetContext(ctx, &e, q, id)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, ErrNotFound
+	}
+	if err != nil {
+		return nil, fmt.Errorf("get event by id: %w", err)
+	}
+	return &e, nil
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/event/repository_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/event/repository_test.go
new file mode 100644
index 00000000..3ec40bd5
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/event/repository_test.go
@@ -0,0 +1,273 @@
+// ©AngelaMos | 2026
+// repository_test.go
+
+//go:build integration
+
+package event_test
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jmoiron/sqlx"
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/testutil"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+)
+
+func newRepos(t *testing.T) (*sqlx.DB, *token.Repository, *event.Repository) {
+	t.Helper()
+	db := sqlx.NewDb(testutil.NewTestDB(t), "pgx")
+	return db, token.NewRepository(db), event.NewRepository(db)
+}
+
+func seedToken(t *testing.T, repo *token.Repository, id string) *token.Token {
+	t.Helper()
+	tok := &token.Token{
+		ID:           id,
+		ManageID:     uuid.New().String(),
+		Type:         token.TypeWebbug,
+		Memo:         "event-test",
+		AlertChannel: token.ChannelWebhook,
+		WebhookURL:   testutil.Ptr("https://example.com/hook"),
+		CreatedIP:    "203.0.113.1",
+		CreatedFP:    "abcdef0123456789",
+		Metadata:     json.RawMessage(`{}`),
+		Enabled:      true,
+	}
+	require.NoError(t, repo.Insert(context.Background(), tok))
+	return tok
+}
+
+func TestRepository_InsertAndCount(t *testing.T) {
+	t.Parallel()
+	_, tokRepo, evtRepo := newRepos(t)
+	ctx := context.Background()
+
+	tok := seedToken(t, tokRepo, "evtinsert001")
+
+	for range 3 {
+		e := &event.Event{
+			TokenID:  tok.ID,
+			SourceIP: "203.0.113.45",
+		}
+		require.NoError(t, evtRepo.Insert(ctx, e))
+		require.NotZero(t, e.ID)
+		require.False(t, e.TriggeredAt.IsZero())
+		require.Equal(t, event.NotifyPending, e.NotifyStatus)
+	}
+
+	count, err := evtRepo.CountByToken(ctx, tok.ID)
+	require.NoError(t, err)
+	require.Equal(t, int64(3), count)
+}
+
+func TestRepository_ListByToken_CursorPagination(t *testing.T) {
+	t.Parallel()
+	_, tokRepo, evtRepo := newRepos(t)
+	ctx := context.Background()
+
+	tok := seedToken(t, tokRepo, "evtcursor001")
+
+	for i := range 5 {
+		e := &event.Event{
+			TokenID:   tok.ID,
+			SourceIP:  "203.0.113.45",
+			UserAgent: testutil.Ptr(string(rune('A' + i))),
+		}
+		require.NoError(t, evtRepo.Insert(ctx, e))
+	}
+
+	page1, err := evtRepo.ListByToken(ctx, tok.ID, event.ListOptions{Limit: 2})
+	require.NoError(t, err)
+	require.Len(t, page1.Events, 2)
+	require.True(t, page1.HasMore)
+	require.NotZero(t, page1.NextCursor)
+	require.Equal(t, "E", *page1.Events[0].UserAgent, "newest first")
+
+	page2, err := evtRepo.ListByToken(ctx, tok.ID, event.ListOptions{
+		Cursor: page1.NextCursor, Limit: 2,
+	})
+	require.NoError(t, err)
+	require.Len(t, page2.Events, 2)
+	require.True(t, page2.HasMore)
+
+	page3, err := evtRepo.ListByToken(ctx, tok.ID, event.ListOptions{
+		Cursor: page2.NextCursor, Limit: 2,
+	})
+	require.NoError(t, err)
+	require.Len(t, page3.Events, 1)
+	require.False(t, page3.HasMore)
+	require.Zero(t, page3.NextCursor)
+}
+
+func TestRepository_FKCascade(t *testing.T) {
+	t.Parallel()
+	_, tokRepo, evtRepo := newRepos(t)
+	ctx := context.Background()
+
+	tok := seedToken(t, tokRepo, "evtcascade01")
+
+	for range 3 {
+		e := &event.Event{TokenID: tok.ID, SourceIP: "203.0.113.45"}
+		require.NoError(t, evtRepo.Insert(ctx, e))
+	}
+
+	require.NoError(t, tokRepo.DeleteByManageID(ctx, tok.ManageID))
+
+	count, err := evtRepo.CountByToken(ctx, tok.ID)
+	require.NoError(t, err)
+	require.Equal(t, int64(0), count, "cascade delete should remove all events")
+}
+
+func TestRepository_CountAll(t *testing.T) {
+	t.Parallel()
+	_, tokRepo, evtRepo := newRepos(t)
+	ctx := context.Background()
+
+	tok := seedToken(t, tokRepo, "evtcntallall")
+
+	base, err := evtRepo.CountAll(ctx)
+	require.NoError(t, err)
+
+	for range 4 {
+		require.NoError(t, evtRepo.Insert(ctx, &event.Event{
+			TokenID:  tok.ID,
+			SourceIP: "203.0.113.99",
+		}))
+	}
+
+	got, err := evtRepo.CountAll(ctx)
+	require.NoError(t, err)
+	require.Equal(t, base+4, got)
+}
+
+func TestRepository_AttachFingerprint(t *testing.T) {
+	t.Parallel()
+	_, tokRepo, evtRepo := newRepos(t)
+	ctx := context.Background()
+
+	tok := seedToken(t, tokRepo, "evtfprint001")
+
+	e := &event.Event{
+		TokenID:  tok.ID,
+		SourceIP: "203.0.113.45",
+		Extra:    json.RawMessage(`{"initial":"value"}`),
+	}
+	require.NoError(t, evtRepo.Insert(ctx, e))
+
+	fp := json.RawMessage(`{"screen":"1920x1080","tz":"America/Los_Angeles"}`)
+	require.NoError(t, evtRepo.AttachFingerprint(ctx, tok.ID, "203.0.113.45", fp, 30*time.Second))
+
+	got, err := evtRepo.GetByID(ctx, e.ID)
+	require.NoError(t, err)
+
+	var merged map[string]any
+	require.NoError(t, json.Unmarshal(got.Extra, &merged))
+	require.Equal(t, "value", merged["initial"])
+	require.Equal(t, "1920x1080", merged["screen"])
+	require.Equal(t, "America/Los_Angeles", merged["tz"])
+}
+
+func TestRepository_AttachFingerprint_NoMatch(t *testing.T) {
+	t.Parallel()
+	_, tokRepo, evtRepo := newRepos(t)
+	ctx := context.Background()
+
+	tok := seedToken(t, tokRepo, "evtfpnomtch1")
+
+	fp := json.RawMessage(`{"screen":"1024x768"}`)
+	err := evtRepo.AttachFingerprint(ctx, tok.ID, "203.0.113.45", fp, 30*time.Second)
+	require.ErrorIs(t, err, event.ErrNotFound)
+}
+
+func TestRepository_UpdateNotifyStatus(t *testing.T) {
+	t.Parallel()
+	_, tokRepo, evtRepo := newRepos(t)
+	ctx := context.Background()
+
+	tok := seedToken(t, tokRepo, "evtnotify001")
+
+	e := &event.Event{TokenID: tok.ID, SourceIP: "203.0.113.45"}
+	require.NoError(t, evtRepo.Insert(ctx, e))
+	require.Equal(t, event.NotifyPending, e.NotifyStatus)
+
+	now := time.Now()
+	require.NoError(t, evtRepo.UpdateNotifyStatus(ctx, e.ID, event.NotifySent, &now))
+
+	got, err := evtRepo.GetByID(ctx, e.ID)
+	require.NoError(t, err)
+	require.Equal(t, event.NotifySent, got.NotifyStatus)
+	require.NotNil(t, got.NotifiedAt)
+}
+
+func TestRepository_PruneToLimit(t *testing.T) {
+	t.Parallel()
+	_, tokRepo, evtRepo := newRepos(t)
+	ctx := context.Background()
+
+	tokA := seedToken(t, tokRepo, "evtpruneaaa1")
+	tokB := seedToken(t, tokRepo, "evtprunebbb1")
+
+	for range 5 {
+		require.NoError(t, evtRepo.Insert(ctx, &event.Event{TokenID: tokA.ID, SourceIP: "203.0.113.10"}))
+	}
+	for range 7 {
+		require.NoError(t, evtRepo.Insert(ctx, &event.Event{TokenID: tokB.ID, SourceIP: "203.0.113.20"}))
+	}
+
+	deleted, err := evtRepo.PruneToLimit(ctx, 3)
+	require.NoError(t, err)
+	require.Equal(t, int64((5-3)+(7-3)), deleted, "should delete 2 from A and 4 from B")
+
+	cntA, err := evtRepo.CountByToken(ctx, tokA.ID)
+	require.NoError(t, err)
+	require.Equal(t, int64(3), cntA)
+
+	cntB, err := evtRepo.CountByToken(ctx, tokB.ID)
+	require.NoError(t, err)
+	require.Equal(t, int64(3), cntB)
+}
+
+func TestRepository_PruneToLimit_KeepsNewest(t *testing.T) {
+	t.Parallel()
+	_, tokRepo, evtRepo := newRepos(t)
+	ctx := context.Background()
+
+	tok := seedToken(t, tokRepo, "evtprunekeep")
+
+	var ids []int64
+	for i := range 5 {
+		e := &event.Event{TokenID: tok.ID, SourceIP: "203.0.113.45", UserAgent: testutil.Ptr(string(rune('A' + i)))}
+		require.NoError(t, evtRepo.Insert(ctx, e))
+		ids = append(ids, e.ID)
+		time.Sleep(2 * time.Millisecond)
+	}
+
+	_, err := evtRepo.PruneToLimit(ctx, 2)
+	require.NoError(t, err)
+
+	cnt, err := evtRepo.CountByToken(ctx, tok.ID)
+	require.NoError(t, err)
+	require.Equal(t, int64(2), cnt)
+
+	_, err = evtRepo.GetByID(ctx, ids[4])
+	require.NoError(t, err, "newest should be kept")
+	_, err = evtRepo.GetByID(ctx, ids[3])
+	require.NoError(t, err, "second-newest should be kept")
+	_, err = evtRepo.GetByID(ctx, ids[0])
+	require.ErrorIs(t, err, event.ErrNotFound, "oldest should be deleted")
+}
+
+func TestRepository_PruneToLimit_RejectsZero(t *testing.T) {
+	t.Parallel()
+	_, _, evtRepo := newRepos(t)
+
+	_, err := evtRepo.PruneToLimit(context.Background(), 0)
+	require.Error(t, err)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/event/service.go b/PROJECTS/beginner/canary-token-generator/backend/internal/event/service.go
new file mode 100644
index 00000000..b07f07b2
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/event/service.go
@@ -0,0 +1,199 @@
+// ©AngelaMos | 2026
+// service.go
+
+package event
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"github.com/redis/go-redis/v9"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/geoip"
+)
+
+const (
+	dedupKeyPrefix    = "dedup:trigger:"
+	dedupActivePrefix = "dedup:active:"
+	defaultDedupTTL   = 15 * time.Minute
+)
+
+type Service struct {
+	repo     Store
+	tokens   TokenIncrementer
+	rdb      *redis.Client
+	notifier Notifier
+	geo      geoip.Lookuper
+	dedupTTL time.Duration
+	logger   *slog.Logger
+}
+
+type ServiceConfig struct {
+	DedupTTL time.Duration
+	Logger   *slog.Logger
+	GeoIP    geoip.Lookuper
+}
+
+func NewService(
+	repo Store,
+	tokens TokenIncrementer,
+	rdb *redis.Client,
+	notifier Notifier,
+	cfg ServiceConfig,
+) *Service {
+	if cfg.DedupTTL <= 0 {
+		cfg.DedupTTL = defaultDedupTTL
+	}
+	if cfg.Logger == nil {
+		cfg.Logger = slog.Default()
+	}
+	return &Service{
+		repo:     repo,
+		tokens:   tokens,
+		rdb:      rdb,
+		notifier: notifier,
+		geo:      cfg.GeoIP,
+		dedupTTL: cfg.DedupTTL,
+		logger:   cfg.Logger,
+	}
+}
+
+func DedupKey(tokenID, sourceIP string) string {
+	return dedupKeyPrefix + tokenID + ":" + sourceIP
+}
+
+func (s *Service) Record(
+	ctx context.Context,
+	info NotifyInfo,
+	evt *Event,
+) error {
+	s.enrichGeo(evt)
+
+	if err := s.repo.Insert(ctx, evt); err != nil {
+		return fmt.Errorf("insert event: %w", err)
+	}
+
+	if s.tokens != nil {
+		if err := s.tokens.IncrementTriggerCount(
+			ctx,
+			info.TokenID,
+		); err != nil {
+			s.logger.WarnContext(ctx, "increment trigger count",
+				"error", err, "token_id", info.TokenID)
+		}
+	}
+
+	first := s.dedupGate(ctx, info.TokenID, evt.SourceIP)
+	if !first {
+		if err := s.repo.UpdateNotifyStatus(
+			ctx, evt.ID, NotifyDeduped, nil,
+		); err != nil {
+			s.logger.WarnContext(ctx, "update notify status deduped",
+				"error", err, "event_id", evt.ID)
+		}
+		return nil
+	}
+
+	if s.notifier != nil {
+		s.notifier.Notify(info, evt)
+	}
+	return nil
+}
+
+func (s *Service) enrichGeo(evt *Event) {
+	if s.geo == nil || evt == nil || evt.SourceIP == "" {
+		return
+	}
+	evt.AttachGeoIP(s.geo.Lookup(evt.SourceIP))
+}
+
+func (s *Service) dedupGate(
+	ctx context.Context,
+	tokenID, sourceIP string,
+) bool {
+	if s.rdb == nil {
+		return true
+	}
+	key := DedupKey(tokenID, sourceIP)
+	set, err := s.rdb.SetNX(ctx, key, 1, s.dedupTTL).Result()
+	if err != nil {
+		s.logger.WarnContext(ctx, "dedup setnx failed (fail-open)",
+			"error", err, "key", key)
+		return true
+	}
+	if set {
+		return true
+	}
+	if _, iErr := s.rdb.Incr(ctx, key).Result(); iErr != nil {
+		s.logger.WarnContext(ctx, "dedup incr failed",
+			"error", iErr, "key", key)
+	}
+	trackKey := dedupActivePrefix + tokenID
+	if _, sErr := s.rdb.SAdd(ctx, trackKey, sourceIP).Result(); sErr != nil {
+		s.logger.WarnContext(ctx, "dedup track add",
+			"error", sErr, "key", trackKey)
+	}
+	if _, eErr := s.rdb.Expire(
+		ctx, trackKey, s.dedupTTL,
+	).Result(); eErr != nil {
+		s.logger.WarnContext(ctx, "dedup track expire",
+			"error", eErr, "key", trackKey)
+	}
+	return false
+}
+
+func (s *Service) CountActiveDedup(
+	ctx context.Context,
+	tokenID string,
+) (int64, error) {
+	if s.rdb == nil {
+		return 0, nil
+	}
+	n, err := s.rdb.SCard(ctx, dedupActivePrefix+tokenID).Result()
+	if errors.Is(err, redis.Nil) {
+		return 0, nil
+	}
+	if err != nil {
+		return 0, fmt.Errorf("dedup count: %w", err)
+	}
+	return n, nil
+}
+
+func (s *Service) RunRetentionLoop(
+	ctx context.Context,
+	interval time.Duration,
+	perTokenLimit int,
+) {
+	if interval <= 0 || perTokenLimit <= 0 {
+		s.logger.WarnContext(ctx, "retention loop disabled (invalid config)",
+			"interval", interval, "limit", perTokenLimit)
+		return
+	}
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+
+	s.logger.InfoContext(ctx, "retention loop started",
+		"interval", interval, "per_token_limit", perTokenLimit)
+
+	for {
+		select {
+		case <-ctx.Done():
+			s.logger.InfoContext(ctx, "retention loop stopped")
+			return
+		case <-ticker.C:
+			n, err := s.repo.PruneToLimit(ctx, perTokenLimit)
+			if err != nil {
+				s.logger.WarnContext(ctx, "retention loop: prune failed",
+					"error", err, "per_token_limit", perTokenLimit)
+				continue
+			}
+			if n > 0 {
+				s.logger.InfoContext(ctx, "retention loop: pruned events",
+					"deleted", n, "per_token_limit", perTokenLimit)
+			}
+		}
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/event/service_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/event/service_test.go
new file mode 100644
index 00000000..6109e5c2
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/event/service_test.go
@@ -0,0 +1,822 @@
+// ©AngelaMos | 2026
+// service_test.go
+
+package event_test
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/alicebob/miniredis/v2"
+	"github.com/redis/go-redis/v9"
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/geoip"
+)
+
+const testTokenID = "tokevtsvc001"
+
+type fakeStore struct {
+	mu             sync.Mutex
+	inserted       []*event.Event
+	insertErr      error
+	statusUpdates  []statusUpdate
+	statusErr      error
+	pruneCount     int64
+	pruneErr       error
+	pruneLastLimit int
+}
+
+type statusUpdate struct {
+	id     int64
+	status event.NotifyStatus
+	sentAt *time.Time
+}
+
+func (f *fakeStore) Insert(_ context.Context, e *event.Event) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.insertErr != nil {
+		return f.insertErr
+	}
+	e.ID = int64(len(f.inserted) + 1)
+	if e.TriggeredAt.IsZero() {
+		e.TriggeredAt = time.Now().UTC()
+	}
+	if e.NotifyStatus == "" {
+		e.NotifyStatus = event.NotifyPending
+	}
+	f.inserted = append(f.inserted, e)
+	return nil
+}
+
+func (f *fakeStore) UpdateNotifyStatus(
+	_ context.Context,
+	id int64,
+	status event.NotifyStatus,
+	sentAt *time.Time,
+) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.statusErr != nil {
+		return f.statusErr
+	}
+	f.statusUpdates = append(f.statusUpdates, statusUpdate{id, status, sentAt})
+	return nil
+}
+
+func (f *fakeStore) PruneToLimit(
+	_ context.Context,
+	perTokenLimit int,
+) (int64, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.pruneLastLimit = perTokenLimit
+	if f.pruneErr != nil {
+		return 0, f.pruneErr
+	}
+	return f.pruneCount, nil
+}
+
+func (f *fakeStore) snapshot() ([]*event.Event, []statusUpdate) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	ev := make([]*event.Event, len(f.inserted))
+	copy(ev, f.inserted)
+	su := make([]statusUpdate, len(f.statusUpdates))
+	copy(su, f.statusUpdates)
+	return ev, su
+}
+
+type fakeIncrementer struct {
+	mu    sync.Mutex
+	calls []string
+	err   error
+}
+
+func (f *fakeIncrementer) IncrementTriggerCount(
+	_ context.Context,
+	id string,
+) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.calls = append(f.calls, id)
+	return f.err
+}
+
+func (f *fakeIncrementer) callCount() int {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return len(f.calls)
+}
+
+type fakeLookuper struct {
+	mu     sync.Mutex
+	called []string
+	result geoip.Lookup
+}
+
+func (f *fakeLookuper) Lookup(ip string) geoip.Lookup {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.called = append(f.called, ip)
+	return f.result
+}
+
+func (f *fakeLookuper) calls() []string {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	out := make([]string, len(f.called))
+	copy(out, f.called)
+	return out
+}
+
+type fakeNotifier struct {
+	mu    sync.Mutex
+	calls []notifyCall
+}
+
+type notifyCall struct {
+	info event.NotifyInfo
+	evt  *event.Event
+}
+
+func (f *fakeNotifier) Notify(info event.NotifyInfo, evt *event.Event) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.calls = append(f.calls, notifyCall{info, evt})
+}
+
+func (f *fakeNotifier) callCount() int {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return len(f.calls)
+}
+
+func setupRedis(t *testing.T) (*redis.Client, *miniredis.Miniredis) {
+	t.Helper()
+	mr, err := miniredis.Run()
+	require.NoError(t, err)
+	t.Cleanup(mr.Close)
+	rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
+	t.Cleanup(func() {
+		if cErr := rdb.Close(); cErr != nil {
+			t.Logf("redis close: %v", cErr)
+		}
+	})
+	return rdb, mr
+}
+
+func sampleInfo() event.NotifyInfo {
+	return event.NotifyInfo{
+		TokenID:      testTokenID,
+		ManageID:     "abcd-1234",
+		Type:         "webbug",
+		Memo:         "test",
+		AlertChannel: "telegram",
+		TelegramBot:  "bot",
+		TelegramChat: "chat",
+	}
+}
+
+func sampleEvent(ip string) *event.Event {
+	return &event.Event{TokenID: testTokenID, SourceIP: ip}
+}
+
+func newSvc(
+	t *testing.T,
+	store event.Store,
+	tokens event.TokenIncrementer,
+	rdb *redis.Client,
+	notifier event.Notifier,
+) *event.Service {
+	t.Helper()
+	return event.NewService(store, tokens, rdb, notifier, event.ServiceConfig{
+		DedupTTL: 15 * time.Minute,
+		Logger:   slog.New(slog.NewTextHandler(testWriter{t}, nil)),
+	})
+}
+
+func newSvcWithGeo(
+	t *testing.T,
+	store event.Store,
+	tokens event.TokenIncrementer,
+	rdb *redis.Client,
+	geo geoip.Lookuper,
+) *event.Service {
+	t.Helper()
+	return event.NewService(store, tokens, rdb, nil, event.ServiceConfig{
+		DedupTTL: 15 * time.Minute,
+		Logger:   slog.New(slog.NewTextHandler(testWriter{t}, nil)),
+		GeoIP:    geo,
+	})
+}
+
+type testWriter struct{ t *testing.T }
+
+func (w testWriter) Write(
+	p []byte,
+) (int, error) {
+	w.t.Log(string(p))
+	return len(p), nil
+}
+
+func TestService_Record_InsertsEvent(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{}
+	inc := &fakeIncrementer{}
+	rdb, _ := setupRedis(t)
+	notifier := &fakeNotifier{}
+	svc := newSvc(t, store, inc, rdb, notifier)
+
+	evt := sampleEvent("203.0.113.1")
+	require.NoError(t, svc.Record(context.Background(), sampleInfo(), evt))
+
+	inserted, _ := store.snapshot()
+	require.Len(t, inserted, 1)
+	require.Equal(t, "203.0.113.1", inserted[0].SourceIP)
+	require.NotZero(t, evt.ID, "Insert assigns ID")
+}
+
+func TestService_Record_IncrementsTriggerCount(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{}
+	inc := &fakeIncrementer{}
+	rdb, _ := setupRedis(t)
+	svc := newSvc(t, store, inc, rdb, nil)
+
+	require.NoError(
+		t,
+		svc.Record(
+			context.Background(),
+			sampleInfo(),
+			sampleEvent("203.0.113.1"),
+		),
+	)
+	require.Equal(t, 1, inc.callCount())
+}
+
+func TestService_Record_FirstTriggerNotifies(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{}
+	inc := &fakeIncrementer{}
+	rdb, _ := setupRedis(t)
+	notifier := &fakeNotifier{}
+	svc := newSvc(t, store, inc, rdb, notifier)
+
+	require.NoError(
+		t,
+		svc.Record(
+			context.Background(),
+			sampleInfo(),
+			sampleEvent("203.0.113.1"),
+		),
+	)
+	require.Equal(t, 1, notifier.callCount())
+
+	_, statusUpdates := store.snapshot()
+	require.Empty(
+		t,
+		statusUpdates,
+		"first trigger should not write 'deduped' status; notify.Service handles sent/failed writeback async",
+	)
+}
+
+func TestService_Record_DuplicateMarksDeduped(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{}
+	inc := &fakeIncrementer{}
+	rdb, mr := setupRedis(t)
+	notifier := &fakeNotifier{}
+	svc := newSvc(t, store, inc, rdb, notifier)
+
+	require.NoError(
+		t,
+		svc.Record(
+			context.Background(),
+			sampleInfo(),
+			sampleEvent("203.0.113.1"),
+		),
+	)
+	require.NoError(
+		t,
+		svc.Record(
+			context.Background(),
+			sampleInfo(),
+			sampleEvent("203.0.113.1"),
+		),
+	)
+
+	require.Equal(t, 1, notifier.callCount(), "duplicate must not notify")
+
+	inserted, statusUpdates := store.snapshot()
+	require.Len(t, inserted, 2, "both events still recorded")
+	require.Len(t, statusUpdates, 1, "duplicate writes deduped status")
+	require.Equal(t, event.NotifyDeduped, statusUpdates[0].status)
+	require.Equal(t, inserted[1].ID, statusUpdates[0].id)
+
+	dedupKey := "dedup:trigger:" + testTokenID + ":203.0.113.1"
+	val, err := mr.Get(dedupKey)
+	require.NoError(t, err)
+	require.Equal(t, "2", val, "INCR bumps counter")
+}
+
+func TestService_Record_DifferentIPsBothNotify(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{}
+	inc := &fakeIncrementer{}
+	rdb, _ := setupRedis(t)
+	notifier := &fakeNotifier{}
+	svc := newSvc(t, store, inc, rdb, notifier)
+
+	require.NoError(
+		t,
+		svc.Record(
+			context.Background(),
+			sampleInfo(),
+			sampleEvent("203.0.113.1"),
+		),
+	)
+	require.NoError(
+		t,
+		svc.Record(
+			context.Background(),
+			sampleInfo(),
+			sampleEvent("203.0.113.2"),
+		),
+	)
+
+	require.Equal(t, 2, notifier.callCount(), "different IPs each notify")
+}
+
+func TestService_Record_DedupTTLExpiry(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{}
+	inc := &fakeIncrementer{}
+	rdb, mr := setupRedis(t)
+	notifier := &fakeNotifier{}
+	svc := event.NewService(store, inc, rdb, notifier, event.ServiceConfig{
+		DedupTTL: 1 * time.Second,
+		Logger:   slog.New(slog.NewTextHandler(testWriter{t}, nil)),
+	})
+
+	require.NoError(
+		t,
+		svc.Record(
+			context.Background(),
+			sampleInfo(),
+			sampleEvent("203.0.113.1"),
+		),
+	)
+	mr.FastForward(2 * time.Second)
+	require.NoError(
+		t,
+		svc.Record(
+			context.Background(),
+			sampleInfo(),
+			sampleEvent("203.0.113.1"),
+		),
+	)
+
+	require.Equal(
+		t,
+		2,
+		notifier.callCount(),
+		"after TTL expiry second trigger notifies again",
+	)
+}
+
+func TestService_Record_DedupKeyShape(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{}
+	inc := &fakeIncrementer{}
+	rdb, mr := setupRedis(t)
+	svc := newSvc(t, store, inc, rdb, nil)
+
+	require.NoError(
+		t,
+		svc.Record(
+			context.Background(),
+			sampleInfo(),
+			sampleEvent("203.0.113.99"),
+		),
+	)
+
+	keys := mr.Keys()
+	require.Contains(t, keys, "dedup:trigger:"+testTokenID+":203.0.113.99")
+}
+
+func TestService_Record_RedisDownFailsOpen(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{}
+	inc := &fakeIncrementer{}
+	rdb, mr := setupRedis(t)
+	notifier := &fakeNotifier{}
+	svc := newSvc(t, store, inc, rdb, notifier)
+
+	mr.Close()
+	require.NoError(
+		t,
+		svc.Record(
+			context.Background(),
+			sampleInfo(),
+			sampleEvent("203.0.113.1"),
+		),
+	)
+	require.Equal(t, 1, notifier.callCount(),
+		"redis down → fail open → still notify so we don't miss alerts")
+}
+
+func TestService_Record_InsertErrorReturns(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{insertErr: errors.New("db down")}
+	inc := &fakeIncrementer{}
+	rdb, _ := setupRedis(t)
+	notifier := &fakeNotifier{}
+	svc := newSvc(t, store, inc, rdb, notifier)
+
+	err := svc.Record(
+		context.Background(),
+		sampleInfo(),
+		sampleEvent("203.0.113.1"),
+	)
+	require.Error(t, err)
+	require.Equal(
+		t,
+		0,
+		notifier.callCount(),
+		"insert failure prevents notify — we don't have an event id to write back to",
+	)
+}
+
+func TestService_Record_IncrementErrorDoesNotPropagate(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{}
+	inc := &fakeIncrementer{err: errors.New("update failed")}
+	rdb, _ := setupRedis(t)
+	notifier := &fakeNotifier{}
+	svc := newSvc(t, store, inc, rdb, notifier)
+
+	require.NoError(
+		t,
+		svc.Record(
+			context.Background(),
+			sampleInfo(),
+			sampleEvent("203.0.113.1"),
+		),
+		"increment failure is best-effort; record should still succeed",
+	)
+	require.Equal(t, 1, notifier.callCount())
+}
+
+func TestService_Record_NilNotifierNoCrash(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{}
+	inc := &fakeIncrementer{}
+	rdb, _ := setupRedis(t)
+	svc := newSvc(t, store, inc, rdb, nil)
+
+	require.NotPanics(t, func() {
+		if err := svc.Record(
+			context.Background(),
+			sampleInfo(),
+			sampleEvent("203.0.113.1"),
+		); err != nil {
+			t.Logf("record: %v", err)
+		}
+	})
+}
+
+func TestService_Record_ConcurrentSafe(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{}
+	inc := &fakeIncrementer{}
+	rdb, _ := setupRedis(t)
+	notifier := &fakeNotifier{}
+	svc := newSvc(t, store, inc, rdb, notifier)
+
+	const n = 20
+	var wg sync.WaitGroup
+	var notified atomic.Int32
+	for i := range n {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			ip := "203.0.113." + strconv.Itoa(i+1)
+			if err := svc.Record(
+				context.Background(),
+				sampleInfo(),
+				sampleEvent(ip),
+			); err == nil {
+				notified.Add(1)
+			}
+		}(i)
+	}
+	wg.Wait()
+	require.Equal(t, int32(n), notified.Load())
+	require.Equal(t, n, notifier.callCount())
+}
+
+func TestService_CountActiveDedup_NoKeysReturnsZero(t *testing.T) {
+	t.Parallel()
+	rdb, _ := setupRedis(t)
+	svc := newSvc(t, &fakeStore{}, &fakeIncrementer{}, rdb, nil)
+
+	n, err := svc.CountActiveDedup(context.Background(), testTokenID)
+	require.NoError(t, err)
+	require.Equal(t, int64(0), n)
+}
+
+func TestService_CountActiveDedup_FirstTriggerOnlyCountsZero(t *testing.T) {
+	t.Parallel()
+	rdb, _ := setupRedis(t)
+	svc := newSvc(t, &fakeStore{}, &fakeIncrementer{}, rdb, nil)
+
+	require.NoError(
+		t,
+		svc.Record(
+			context.Background(),
+			sampleInfo(),
+			sampleEvent("203.0.113.1"),
+		),
+	)
+
+	n, err := svc.CountActiveDedup(context.Background(), testTokenID)
+	require.NoError(t, err)
+	require.Equal(t, int64(0), n,
+		"first trigger fires the notification; nothing silenced yet")
+}
+
+func TestService_CountActiveDedup_CountsSilencedAcrossIPs(t *testing.T) {
+	t.Parallel()
+	rdb, _ := setupRedis(t)
+	svc := newSvc(t, &fakeStore{}, &fakeIncrementer{}, rdb, nil)
+
+	for range 3 {
+		require.NoError(
+			t,
+			svc.Record(
+				context.Background(),
+				sampleInfo(),
+				sampleEvent("203.0.113.1"),
+			),
+		)
+	}
+	for range 5 {
+		require.NoError(
+			t,
+			svc.Record(
+				context.Background(),
+				sampleInfo(),
+				sampleEvent("203.0.113.2"),
+			),
+		)
+	}
+
+	n, err := svc.CountActiveDedup(context.Background(), testTokenID)
+	require.NoError(t, err)
+	require.Equal(t, int64(2), n,
+		"two distinct IPs were silenced (203.0.113.1 and 203.0.113.2)")
+}
+
+func TestService_CountActiveDedup_IgnoresOtherTokens(t *testing.T) {
+	t.Parallel()
+	rdb, _ := setupRedis(t)
+	svc := newSvc(t, &fakeStore{}, &fakeIncrementer{}, rdb, nil)
+
+	for range 3 {
+		require.NoError(
+			t,
+			svc.Record(
+				context.Background(),
+				sampleInfo(),
+				sampleEvent("203.0.113.1"),
+			),
+		)
+	}
+	otherInfo := sampleInfo()
+	otherInfo.TokenID = "tokother0001"
+	for range 4 {
+		require.NoError(
+			t,
+			svc.Record(
+				context.Background(),
+				otherInfo,
+				&event.Event{TokenID: "tokother0001", SourceIP: "203.0.113.5"},
+			),
+		)
+	}
+
+	n, err := svc.CountActiveDedup(context.Background(), testTokenID)
+	require.NoError(t, err)
+	require.Equal(t, int64(1), n,
+		"only this token's silenced IPs counted (one distinct IP)")
+}
+
+func TestService_CountActiveDedup_NilRedisReturnsZero(t *testing.T) {
+	t.Parallel()
+	svc := event.NewService(
+		&fakeStore{},
+		&fakeIncrementer{},
+		nil,
+		nil,
+		event.ServiceConfig{
+			DedupTTL: 15 * time.Minute,
+			Logger:   slog.New(slog.NewTextHandler(testWriter{t}, nil)),
+		},
+	)
+	n, err := svc.CountActiveDedup(context.Background(), testTokenID)
+	require.NoError(t, err)
+	require.Equal(t, int64(0), n)
+}
+
+func TestService_RunRetentionLoop_PrunesAtInterval(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{pruneCount: 5}
+	rdb, _ := setupRedis(t)
+	svc := newSvc(t, store, &fakeIncrementer{}, rdb, nil)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan struct{})
+	go func() {
+		svc.RunRetentionLoop(ctx, 25*time.Millisecond, 100)
+		close(done)
+	}()
+
+	require.Eventually(t, func() bool {
+		store.mu.Lock()
+		defer store.mu.Unlock()
+		return store.pruneLastLimit == 100
+	}, 1*time.Second, 5*time.Millisecond)
+
+	cancel()
+	<-done
+}
+
+func TestService_RunRetentionLoop_StopsOnContextCancel(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{}
+	rdb, _ := setupRedis(t)
+	svc := newSvc(t, store, &fakeIncrementer{}, rdb, nil)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan struct{})
+	go func() {
+		svc.RunRetentionLoop(ctx, 10*time.Millisecond, 50)
+		close(done)
+	}()
+
+	time.Sleep(20 * time.Millisecond)
+	cancel()
+
+	select {
+	case <-done:
+	case <-time.After(500 * time.Millisecond):
+		t.Fatal("retention loop did not stop on cancel")
+	}
+}
+
+func TestService_RunRetentionLoop_ContinuesOnPruneError(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{pruneErr: errors.New("db down")}
+	rdb, _ := setupRedis(t)
+	svc := newSvc(t, store, &fakeIncrementer{}, rdb, nil)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan struct{})
+	go func() {
+		svc.RunRetentionLoop(ctx, 10*time.Millisecond, 50)
+		close(done)
+	}()
+
+	time.Sleep(60 * time.Millisecond)
+	cancel()
+	<-done
+}
+
+func TestService_RunRetentionLoop_DisabledOnInvalidConfig(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{}
+	rdb, _ := setupRedis(t)
+	svc := newSvc(t, store, &fakeIncrementer{}, rdb, nil)
+
+	ctx := context.Background()
+	done := make(chan struct{})
+	go func() {
+		svc.RunRetentionLoop(ctx, 0, 100)
+		close(done)
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(500 * time.Millisecond):
+		t.Fatal(
+			"retention loop should have returned immediately on invalid interval",
+		)
+	}
+
+	require.Equal(t, 0, store.pruneLastLimit)
+}
+
+func TestService_Record_EnrichesGeoBeforeInsert(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{}
+	inc := &fakeIncrementer{}
+	rdb, _ := setupRedis(t)
+	geo := &fakeLookuper{result: geoip.Lookup{
+		Country: "US", Region: "California", City: "Mountain View",
+		ASN: 15169, ASNOrg: "Google LLC",
+	}}
+	svc := newSvcWithGeo(t, store, inc, rdb, geo)
+
+	evt := sampleEvent("203.0.113.1")
+	require.NoError(t, svc.Record(context.Background(), sampleInfo(), evt))
+
+	require.Equal(t, []string{"203.0.113.1"}, geo.calls(),
+		"Record must invoke Lookup exactly once with the event's source IP")
+
+	inserted, _ := store.snapshot()
+	require.Len(t, inserted, 1)
+	got := inserted[0]
+	require.NotNil(t, got.GeoCountry)
+	require.Equal(t, "US", *got.GeoCountry)
+	require.NotNil(t, got.GeoCity)
+	require.Equal(t, "Mountain View", *got.GeoCity)
+	require.NotNil(t, got.GeoASN)
+	require.Equal(t, 15169, *got.GeoASN)
+}
+
+func TestService_Record_NoGeoConfigured_LeavesGeoNil(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{}
+	inc := &fakeIncrementer{}
+	rdb, _ := setupRedis(t)
+	svc := newSvc(t, store, inc, rdb, nil)
+
+	evt := sampleEvent("203.0.113.1")
+	require.NoError(t, svc.Record(context.Background(), sampleInfo(), evt))
+
+	inserted, _ := store.snapshot()
+	require.Len(t, inserted, 1)
+	require.Nil(t, inserted[0].GeoCountry)
+	require.Nil(t, inserted[0].GeoCity)
+	require.Nil(t, inserted[0].GeoASN)
+}
+
+func TestService_Record_EmptySourceIP_SkipsLookup(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{}
+	inc := &fakeIncrementer{}
+	rdb, _ := setupRedis(t)
+	geo := &fakeLookuper{result: geoip.Lookup{Country: "ZZ"}}
+	svc := newSvcWithGeo(t, store, inc, rdb, geo)
+
+	evt := &event.Event{TokenID: testTokenID}
+	require.NoError(t, svc.Record(context.Background(), sampleInfo(), evt))
+
+	require.Empty(t, geo.calls(),
+		"empty source IP must short-circuit the geo lookup "+
+			"(no useful enrichment possible)")
+	inserted, _ := store.snapshot()
+	require.Nil(t, inserted[0].GeoCountry)
+}
+
+func TestService_Record_NopLookuper_LeavesGeoNil(t *testing.T) {
+	t.Parallel()
+	store := &fakeStore{}
+	inc := &fakeIncrementer{}
+	rdb, _ := setupRedis(t)
+	svc := newSvcWithGeo(t, store, inc, rdb, geoip.NopService())
+
+	evt := sampleEvent("203.0.113.1")
+	require.NoError(t, svc.Record(context.Background(), sampleInfo(), evt))
+
+	inserted, _ := store.snapshot()
+	require.Nil(t, inserted[0].GeoCountry,
+		"NopService returns empty Lookup; AttachGeoIP leaves all fields nil")
+}
+
+func TestService_Record_GeoEnrichmentBestEffort_InsertErrorBubbles(
+	t *testing.T,
+) {
+	t.Parallel()
+	store := &fakeStore{insertErr: errors.New("db down")}
+	inc := &fakeIncrementer{}
+	rdb, _ := setupRedis(t)
+	geo := &fakeLookuper{result: geoip.Lookup{Country: "US"}}
+	svc := newSvcWithGeo(t, store, inc, rdb, geo)
+
+	err := svc.Record(context.Background(), sampleInfo(),
+		sampleEvent("203.0.113.1"))
+	require.Error(t, err, "insert error path is unchanged by geo enrichment")
+	require.Equal(t, []string{"203.0.113.1"}, geo.calls(),
+		"enrichment runs even when insert later fails "+
+			"(no upstream side-effect)")
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/geoip/service.go b/PROJECTS/beginner/canary-token-generator/backend/internal/geoip/service.go
new file mode 100644
index 00000000..37e43ca0
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/geoip/service.go
@@ -0,0 +1,99 @@
+// ©AngelaMos | 2026
+// service.go
+
+package geoip
+
+import (
+	"errors"
+	"fmt"
+	"net/netip"
+
+	"github.com/oschwald/geoip2-golang/v2"
+)
+
+type Lookup struct {
+	Country string
+	Region  string
+	City    string
+	ASNOrg  string
+	ASN     int
+}
+
+type Lookuper interface {
+	Lookup(ip string) Lookup
+}
+
+type cityReader interface {
+	City(netip.Addr) (*geoip2.City, error)
+	Close() error
+}
+
+type Service struct {
+	reader cityReader
+}
+
+func Open(path string) (*Service, error) {
+	if path == "" {
+		return nil, errors.New("geoip: path is empty")
+	}
+	r, err := geoip2.Open(path)
+	if err != nil {
+		return nil, fmt.Errorf("geoip open %q: %w", path, err)
+	}
+	return &Service{reader: r}, nil
+}
+
+func (s *Service) Lookup(ip string) Lookup {
+	if s == nil || s.reader == nil || ip == "" {
+		return Lookup{}
+	}
+	addr, err := netip.ParseAddr(ip)
+	if err != nil {
+		return Lookup{}
+	}
+	rec, err := s.reader.City(addr)
+	if err != nil || rec == nil || !rec.HasData() {
+		return Lookup{}
+	}
+	return extractLookup(rec)
+}
+
+func (s *Service) Close() error {
+	if s == nil || s.reader == nil {
+		return nil
+	}
+	return s.reader.Close()
+}
+
+type nopService struct{}
+
+func NopService() Lookuper {
+	return nopService{}
+}
+
+func (nopService) Lookup(string) Lookup {
+	return Lookup{}
+}
+
+func extractLookup(rec *geoip2.City) Lookup {
+	if rec == nil {
+		return Lookup{}
+	}
+	return Lookup{
+		Country: rec.Country.ISOCode,
+		Region:  firstSubdivisionName(rec.Subdivisions),
+		City:    rec.City.Names.English,
+	}
+}
+
+func firstSubdivisionName(subs []geoip2.CitySubdivision) string {
+	for _, s := range subs {
+		if s.Names.English != "" {
+			return s.Names.English
+		}
+		if s.ISOCode != "" {
+			return s.ISOCode
+		}
+	}
+	return ""
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/geoip/service_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/geoip/service_test.go
new file mode 100644
index 00000000..e1d4f112
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/geoip/service_test.go
@@ -0,0 +1,252 @@
+// ©AngelaMos | 2026
+// service_test.go
+
+package geoip
+
+import (
+	"errors"
+	"net/netip"
+	"path/filepath"
+	"testing"
+
+	"github.com/oschwald/geoip2-golang/v2"
+	"github.com/stretchr/testify/require"
+)
+
+type fakeCityReader struct {
+	rec        *geoip2.City
+	err        error
+	calls      int
+	closeCalls int
+	closeErr   error
+}
+
+func (f *fakeCityReader) City(netip.Addr) (*geoip2.City, error) {
+	f.calls++
+	return f.rec, f.err
+}
+
+func (f *fakeCityReader) Close() error {
+	f.closeCalls++
+	return f.closeErr
+}
+
+func newServiceWithFake(r *fakeCityReader) *Service {
+	return &Service{reader: r}
+}
+
+func TestNopService_AlwaysReturnsEmpty(t *testing.T) {
+	t.Parallel()
+	n := NopService()
+	require.Equal(t, Lookup{}, n.Lookup("203.0.113.1"))
+	require.Equal(t, Lookup{}, n.Lookup(""))
+	require.Equal(t, Lookup{}, n.Lookup("not-an-ip"))
+}
+
+func TestNopService_SatisfiesLookuper(t *testing.T) {
+	t.Parallel()
+	var _ Lookuper = NopService()
+}
+
+func TestServiceImplementsLookuper(t *testing.T) {
+	t.Parallel()
+	var _ Lookuper = (*Service)(nil)
+}
+
+func TestOpen_EmptyPathReturnsError(t *testing.T) {
+	t.Parallel()
+	s, err := Open("")
+	require.Error(t, err)
+	require.Nil(t, s)
+}
+
+func TestOpen_NonexistentPathReturnsError(t *testing.T) {
+	t.Parallel()
+	missing := filepath.Join(t.TempDir(), "nonexistent.mmdb")
+	s, err := Open(missing)
+	require.Error(t, err)
+	require.Nil(t, s)
+}
+
+func TestService_Lookup_NilReceiverReturnsEmpty(t *testing.T) {
+	t.Parallel()
+	var s *Service
+	require.Equal(t, Lookup{}, s.Lookup("203.0.113.1"))
+}
+
+func TestService_Lookup_NilReaderReturnsEmpty(t *testing.T) {
+	t.Parallel()
+	s := &Service{}
+	require.Equal(t, Lookup{}, s.Lookup("203.0.113.1"))
+}
+
+func TestService_Lookup_EmptyIPReturnsEmpty(t *testing.T) {
+	t.Parallel()
+	fake := &fakeCityReader{}
+	s := newServiceWithFake(fake)
+	require.Equal(t, Lookup{}, s.Lookup(""))
+	require.Equal(t, 0, fake.calls,
+		"empty IP must short-circuit before reader call")
+}
+
+func TestService_Lookup_MalformedIPReturnsEmpty(t *testing.T) {
+	t.Parallel()
+	fake := &fakeCityReader{}
+	s := newServiceWithFake(fake)
+	for _, bad := range []string{"not-an-ip", "999.999.999.999", "::xyz", " "} {
+		require.Equal(t, Lookup{}, s.Lookup(bad), "input=%q", bad)
+	}
+	require.Equal(t, 0, fake.calls,
+		"malformed IP must short-circuit before reader call")
+}
+
+func TestService_Lookup_ReaderErrorReturnsEmpty(t *testing.T) {
+	t.Parallel()
+	fake := &fakeCityReader{err: errors.New("boom")}
+	s := newServiceWithFake(fake)
+	require.Equal(t, Lookup{}, s.Lookup("203.0.113.1"))
+	require.Equal(t, 1, fake.calls)
+}
+
+func TestService_Lookup_NoDataReturnsEmpty(t *testing.T) {
+	t.Parallel()
+	fake := &fakeCityReader{rec: &geoip2.City{}}
+	s := newServiceWithFake(fake)
+	require.Equal(t, Lookup{}, s.Lookup("203.0.113.1"))
+}
+
+func TestService_Lookup_NilRecordReturnsEmpty(t *testing.T) {
+	t.Parallel()
+	fake := &fakeCityReader{rec: nil}
+	s := newServiceWithFake(fake)
+	require.Equal(t, Lookup{}, s.Lookup("203.0.113.1"))
+}
+
+func TestService_Lookup_PopulatesAllAvailableFields(t *testing.T) {
+	t.Parallel()
+	rec := &geoip2.City{}
+	rec.Country.ISOCode = "US"
+	rec.Country.Names.English = "United States"
+	rec.City.Names.English = "Mountain View"
+	rec.Subdivisions = []geoip2.CitySubdivision{
+		{Names: geoip2.Names{English: "California"}, ISOCode: "CA"},
+	}
+	fake := &fakeCityReader{rec: rec}
+	s := newServiceWithFake(fake)
+
+	got := s.Lookup("203.0.113.1")
+	require.Equal(t, "US", got.Country)
+	require.Equal(t, "California", got.Region)
+	require.Equal(t, "Mountain View", got.City)
+	require.Equal(t, 0, got.ASN,
+		"City db carries no ASN; field is reserved for ASN-db extension")
+	require.Empty(t, got.ASNOrg,
+		"City db carries no ASNOrg; field is reserved for ASN-db extension")
+}
+
+func TestService_Lookup_AcceptsIPv6(t *testing.T) {
+	t.Parallel()
+	rec := &geoip2.City{}
+	rec.Country.ISOCode = "DE"
+	rec.City.Names.English = "Berlin"
+	fake := &fakeCityReader{rec: rec}
+	s := newServiceWithFake(fake)
+
+	got := s.Lookup("2001:db8::1")
+	require.Equal(t, "DE", got.Country)
+	require.Equal(t, "Berlin", got.City)
+}
+
+func TestExtractLookup_NilReturnsEmpty(t *testing.T) {
+	t.Parallel()
+	require.Equal(t, Lookup{}, extractLookup(nil))
+}
+
+func TestExtractLookup_PicksFirstSubdivisionEnglishName(t *testing.T) {
+	t.Parallel()
+	rec := &geoip2.City{}
+	rec.Subdivisions = []geoip2.CitySubdivision{
+		{Names: geoip2.Names{English: "England"}, ISOCode: "ENG"},
+		{Names: geoip2.Names{English: "Oxfordshire"}, ISOCode: "OXF"},
+	}
+	require.Equal(t, "England", extractLookup(rec).Region)
+}
+
+func TestExtractLookup_FallsBackToISOCodeWhenEnglishMissing(t *testing.T) {
+	t.Parallel()
+	rec := &geoip2.City{}
+	rec.Subdivisions = []geoip2.CitySubdivision{
+		{ISOCode: "CA"},
+	}
+	require.Equal(t, "CA", extractLookup(rec).Region)
+}
+
+func TestExtractLookup_NoSubdivisionsLeavesRegionEmpty(t *testing.T) {
+	t.Parallel()
+	rec := &geoip2.City{}
+	rec.Country.ISOCode = "JP"
+	got := extractLookup(rec)
+	require.Empty(t, got.Region)
+	require.Equal(t, "JP", got.Country)
+}
+
+func TestService_Close_NilReceiverIsNoOp(t *testing.T) {
+	t.Parallel()
+	var s *Service
+	require.NoError(t, s.Close())
+}
+
+func TestService_Close_NilReaderIsNoOp(t *testing.T) {
+	t.Parallel()
+	require.NoError(t, (&Service{}).Close())
+}
+
+func TestService_Close_DelegatesToReader(t *testing.T) {
+	t.Parallel()
+	fake := &fakeCityReader{}
+	require.NoError(t, newServiceWithFake(fake).Close())
+	require.Equal(t, 1, fake.closeCalls)
+}
+
+func TestService_Close_PropagatesReaderError(t *testing.T) {
+	t.Parallel()
+	wantErr := errors.New("close failed")
+	fake := &fakeCityReader{closeErr: wantErr}
+	require.ErrorIs(t, newServiceWithFake(fake).Close(), wantErr)
+}
+
+func TestFirstSubdivisionName_EmptySliceReturnsEmpty(t *testing.T) {
+	t.Parallel()
+	require.Empty(t, firstSubdivisionName(nil))
+	require.Empty(t, firstSubdivisionName([]geoip2.CitySubdivision{}))
+}
+
+func TestFirstSubdivisionName_PrefersEnglishName(t *testing.T) {
+	t.Parallel()
+	subs := []geoip2.CitySubdivision{{
+		Names:   geoip2.Names{English: "California"},
+		ISOCode: "CA",
+	}}
+	require.Equal(t, "California", firstSubdivisionName(subs))
+}
+
+func TestFirstSubdivisionName_FallsBackToISOCode(t *testing.T) {
+	t.Parallel()
+	subs := []geoip2.CitySubdivision{{ISOCode: "CA"}}
+	require.Equal(t, "CA", firstSubdivisionName(subs))
+}
+
+func TestFirstSubdivisionName_SkipsEntirelyEmptyEntries(t *testing.T) {
+	t.Parallel()
+	subs := []geoip2.CitySubdivision{
+		{},
+		{Names: geoip2.Names{English: "Oxfordshire"}},
+	}
+	require.Equal(t, "Oxfordshire", firstSubdivisionName(subs))
+}
+
+func TestFirstSubdivisionName_AllEmptyEntriesReturnsEmpty(t *testing.T) {
+	t.Parallel()
+	subs := []geoip2.CitySubdivision{{}, {}, {}}
+	require.Empty(t, firstSubdivisionName(subs))
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/health/handler.go b/PROJECTS/beginner/canary-token-generator/backend/internal/health/handler.go
new file mode 100644
index 00000000..c95c2b8f
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/health/handler.go
@@ -0,0 +1,197 @@
+// ©AngelaMos | 2026
+// handler.go
+
+package health
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"net/http"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+)
+
+type Checker interface {
+	Ping(ctx context.Context) error
+}
+
+type Handler struct {
+	db       Checker
+	redis    Checker
+	ready    atomic.Bool
+	shutdown atomic.Bool
+}
+
+func NewHandler(db, redis Checker) *Handler {
+	h := &Handler{
+		db:    db,
+		redis: redis,
+	}
+	h.ready.Store(true)
+	return h
+}
+
+func (h *Handler) RegisterRoutes(r chi.Router) {
+	r.Get("/healthz", h.Liveness)
+	r.Get("/livez", h.Liveness)
+	r.Get("/readyz", h.Readiness)
+}
+
+func (h *Handler) Liveness(w http.ResponseWriter, r *http.Request) {
+	if h.shutdown.Load() {
+		h.writeStatus(w, http.StatusServiceUnavailable, StatusResponse{
+			Status: "shutting_down",
+		})
+		return
+	}
+
+	h.writeStatus(w, http.StatusOK, StatusResponse{
+		Status: "ok",
+	})
+}
+
+func (h *Handler) Readiness(w http.ResponseWriter, r *http.Request) {
+	if h.shutdown.Load() {
+		h.writeStatus(w, http.StatusServiceUnavailable, StatusResponse{
+			Status: "shutting_down",
+		})
+		return
+	}
+
+	if !h.ready.Load() {
+		h.writeStatus(w, http.StatusServiceUnavailable, StatusResponse{
+			Status: "not_ready",
+		})
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
+	defer cancel()
+
+	checks := h.runHealthChecks(ctx)
+
+	allHealthy := true
+	for _, check := range checks {
+		if !check.Healthy {
+			allHealthy = false
+			break
+		}
+	}
+
+	status := "ok"
+	statusCode := http.StatusOK
+	if !allHealthy {
+		status = "degraded"
+		statusCode = http.StatusServiceUnavailable
+	}
+
+	h.writeStatus(w, statusCode, ReadinessResponse{
+		Status: status,
+		Checks: checks,
+	})
+}
+
+func (h *Handler) runHealthChecks(ctx context.Context) []HealthCheck {
+	var wg sync.WaitGroup
+	checks := make([]HealthCheck, 2)
+
+	wg.Add(2)
+
+	go func() {
+		defer wg.Done()
+		checks[0] = h.checkDatabase(ctx)
+	}()
+
+	go func() {
+		defer wg.Done()
+		checks[1] = h.checkRedis(ctx)
+	}()
+
+	wg.Wait()
+	return checks
+}
+
+func (h *Handler) checkDatabase(ctx context.Context) HealthCheck {
+	check := HealthCheck{
+		Name:    "database",
+		Healthy: true,
+	}
+
+	if h.db == nil {
+		check.Healthy = false
+		check.Message = "database checker not configured"
+		return check
+	}
+
+	start := time.Now()
+	err := h.db.Ping(ctx)
+	check.Latency = time.Since(start).String()
+
+	if err != nil {
+		check.Healthy = false
+		check.Message = "ping failed"
+	}
+
+	return check
+}
+
+func (h *Handler) checkRedis(ctx context.Context) HealthCheck {
+	check := HealthCheck{
+		Name:    "redis",
+		Healthy: true,
+	}
+
+	if h.redis == nil {
+		check.Healthy = false
+		check.Message = "redis checker not configured"
+		return check
+	}
+
+	start := time.Now()
+	err := h.redis.Ping(ctx)
+	check.Latency = time.Since(start).String()
+
+	if err != nil {
+		check.Healthy = false
+		check.Message = "ping failed"
+	}
+
+	return check
+}
+
+func (h *Handler) SetReady(ready bool) {
+	h.ready.Store(ready)
+}
+
+func (h *Handler) SetShutdown(shutdown bool) {
+	h.shutdown.Store(shutdown)
+}
+
+func (h *Handler) writeStatus(w http.ResponseWriter, status int, data any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
+	w.WriteHeader(status)
+	if err := json.NewEncoder(w).Encode(data); err != nil {
+		slog.Error("failed to encode health response", "error", err)
+	}
+}
+
+type StatusResponse struct {
+	Status string `json:"status"`
+}
+
+type ReadinessResponse struct {
+	Status string        `json:"status"`
+	Checks []HealthCheck `json:"checks"`
+}
+
+type HealthCheck struct {
+	Name    string `json:"name"`
+	Healthy bool   `json:"healthy"`
+	Latency string `json:"latency,omitempty"`
+	Message string `json:"message,omitempty"`
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/fingerprint.go b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/fingerprint.go
new file mode 100644
index 00000000..da7a77dd
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/fingerprint.go
@@ -0,0 +1,26 @@
+// ©AngelaMos | 2026
+// fingerprint.go
+
+package middleware
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"net/http"
+)
+
+const (
+	fingerprintHexLen = 16
+
+	rateLimitKeyByFingerprintPrefix = "ratelimit:fp:"
+)
+
+func ExtractFingerprint(r *http.Request) string {
+	raw := RealIP(r) + "|" + r.UserAgent()
+	sum := sha256.Sum256([]byte(raw))
+	return hex.EncodeToString(sum[:])[:fingerprintHexLen]
+}
+
+func KeyByFingerprint(r *http.Request) string {
+	return rateLimitKeyByFingerprintPrefix + ExtractFingerprint(r)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/fingerprint_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/fingerprint_test.go
new file mode 100644
index 00000000..47e5d725
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/fingerprint_test.go
@@ -0,0 +1,187 @@
+// ©AngelaMos | 2026
+// fingerprint_test.go
+
+package middleware_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/middleware"
+)
+
+func newRequest(remote string, headers map[string]string) *http.Request {
+	r := httptest.NewRequest(http.MethodGet, "/", nil)
+	r.RemoteAddr = remote
+	for k, v := range headers {
+		r.Header.Set(k, v)
+	}
+	return r
+}
+
+func TestRealIP_Precedence(t *testing.T) {
+	cases := []struct {
+		name    string
+		headers map[string]string
+		remote  string
+		want    string
+	}{
+		{
+			"CF wins",
+			map[string]string{
+				"CF-Connecting-IP": "203.0.113.10",
+				"X-Forwarded-For":  "198.51.100.1",
+				"X-Real-IP":        "192.0.2.99",
+			},
+			"127.0.0.1:9",
+			"203.0.113.10",
+		},
+		{
+			"XFF leftmost no CF",
+			map[string]string{
+				"X-Forwarded-For": "198.51.100.1, 198.51.100.7",
+				"X-Real-IP":       "192.0.2.99",
+			},
+			"127.0.0.1:9",
+			"198.51.100.1",
+		},
+		{
+			"XFF trailing comma falls through",
+			map[string]string{
+				"X-Forwarded-For": "198.51.100.1, ",
+				"X-Real-IP":       "192.0.2.99",
+			},
+			"127.0.0.1:9",
+			"198.51.100.1",
+		},
+		{
+			"XFF empty entries fall to XRI",
+			map[string]string{
+				"X-Forwarded-For": ", ,",
+				"X-Real-IP":       "192.0.2.99",
+			},
+			"127.0.0.1:9",
+			"192.0.2.99",
+		},
+		{
+			"XRI when no CF or XFF",
+			map[string]string{"X-Real-IP": "192.0.2.99"},
+			"127.0.0.1:9",
+			"192.0.2.99",
+		},
+		{"RemoteAddr IPv4 strips port", nil, "127.0.0.1:9999", "127.0.0.1"},
+		{
+			"RemoteAddr IPv6 strips brackets",
+			nil,
+			"[2001:db8::1]:54321",
+			"2001:db8::1",
+		},
+		{"RemoteAddr loopback IPv6", nil, "[::1]:9", "::1"},
+		{"RemoteAddr no port fallback", nil, "127.0.0.1", "127.0.0.1"},
+		{
+			"XFF mixed IPv4+IPv6 leftmost",
+			map[string]string{
+				"X-Forwarded-For": "198.51.100.1, 2001:db8::dead",
+			},
+			"127.0.0.1:9",
+			"198.51.100.1",
+		},
+		{
+			"CF trimmed",
+			map[string]string{"CF-Connecting-IP": "  203.0.113.10  "},
+			"127.0.0.1:9",
+			"203.0.113.10",
+		},
+	}
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require.Equal(
+				t,
+				tc.want,
+				middleware.RealIP(newRequest(tc.remote, tc.headers)),
+			)
+		})
+	}
+}
+
+func TestRealIP_UntrustedRemoteIgnoresClientHeaders(t *testing.T) {
+	require.NoError(t, middleware.SetTrustedProxyCIDRs(
+		[]string{"127.0.0.1/32", "::1/128"},
+	))
+	t.Cleanup(middleware.ClearTrustedProxyCIDRs)
+
+	r := newRequest("198.51.100.50:443", map[string]string{
+		"CF-Connecting-IP": "evil-spoofed",
+		"X-Forwarded-For":  "evil-spoofed",
+		"X-Real-IP":        "evil-spoofed",
+	})
+	require.Equal(t, "198.51.100.50", middleware.RealIP(r),
+		"requests from outside the trusted-proxy set must ignore "+
+			"client-supplied forwarding headers (audit F5)")
+}
+
+func TestRealIP_TrustedRemoteHonorsClientHeaders(t *testing.T) {
+	require.NoError(t, middleware.SetTrustedProxyCIDRs(
+		[]string{"127.0.0.1/32"},
+	))
+	t.Cleanup(middleware.ClearTrustedProxyCIDRs)
+
+	r := newRequest("127.0.0.1:443", map[string]string{
+		"CF-Connecting-IP": "203.0.113.10",
+	})
+	require.Equal(t, "203.0.113.10", middleware.RealIP(r))
+}
+
+func TestOptionalHeader(t *testing.T) {
+	require.Nil(t, middleware.OptionalHeader(""))
+	require.Nil(t, middleware.OptionalHeader("   "))
+	v := middleware.OptionalHeader("  hello  ")
+	require.NotNil(t, v)
+	require.Equal(t, "hello", *v)
+}
+
+func TestExtractFingerprint_DeterministicAndLength(t *testing.T) {
+	r1 := newRequest("127.0.0.1:9", map[string]string{
+		"CF-Connecting-IP": "203.0.113.10",
+		"User-Agent":       "Mozilla/5.0",
+	})
+	r2 := newRequest("10.0.0.1:9", map[string]string{
+		"CF-Connecting-IP": "203.0.113.10",
+		"User-Agent":       "Mozilla/5.0",
+	})
+
+	fp1 := middleware.ExtractFingerprint(r1)
+	fp2 := middleware.ExtractFingerprint(r2)
+	require.Equal(t, fp1, fp2, "same realIP + UA must yield same fingerprint")
+	require.Len(t, fp1, 16)
+	require.Regexp(t, `^[0-9a-f]{16}$`, fp1)
+}
+
+func TestExtractFingerprint_DifferentIPsDifferentFingerprints(t *testing.T) {
+	a := middleware.ExtractFingerprint(newRequest(
+		"127.0.0.1:9",
+		map[string]string{
+			"CF-Connecting-IP": "203.0.113.1",
+			"User-Agent":       "X",
+		},
+	))
+	b := middleware.ExtractFingerprint(newRequest(
+		"127.0.0.1:9",
+		map[string]string{
+			"CF-Connecting-IP": "203.0.113.2",
+			"User-Agent":       "X",
+		},
+	))
+	require.NotEqual(t, a, b)
+}
+
+func TestKeyByFingerprint_HasPrefix(t *testing.T) {
+	key := middleware.KeyByFingerprint(newRequest("127.0.0.1:9", nil))
+	require.True(t, strings.HasPrefix(key, "ratelimit:fp:"))
+	require.Len(t, key, len("ratelimit:fp:")+16)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/headers.go b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/headers.go
new file mode 100644
index 00000000..18014237
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/headers.go
@@ -0,0 +1,104 @@
+// ©AngelaMos | 2026
+// headers.go
+
+package middleware
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/config"
+)
+
+func SecurityHeaders(isProduction bool) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			h := w.Header()
+
+			h.Set("X-Content-Type-Options", "nosniff")
+			h.Set("X-Frame-Options", "DENY")
+			h.Set("X-XSS-Protection", "1; mode=block")
+			h.Set("Referrer-Policy", "strict-origin-when-cross-origin")
+			h.Set(
+				"Permissions-Policy",
+				"geolocation=(), microphone=(), camera=()",
+			)
+
+			if isProduction {
+				h.Set(
+					"Strict-Transport-Security",
+					"max-age=31536000; includeSubDomains; preload",
+				)
+			}
+
+			h.Set("Content-Security-Policy", buildCSP(isProduction))
+
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+func buildCSP(isProduction bool) string {
+	directives := []string{
+		"default-src 'self'",
+		"script-src 'self' https://challenges.cloudflare.com",
+		"style-src 'self' 'unsafe-inline'",
+		"img-src 'self' data: https:",
+		"font-src 'self'",
+		"connect-src 'self' https://challenges.cloudflare.com",
+		"frame-src https://challenges.cloudflare.com",
+		"frame-ancestors 'none'",
+		"base-uri 'self'",
+		"form-action 'self'",
+	}
+
+	if !isProduction {
+		directives[1] = "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://challenges.cloudflare.com"
+	}
+
+	return strings.Join(directives, "; ")
+}
+
+func CORS(cfg config.CORSConfig) func(http.Handler) http.Handler {
+	allowedOrigins := make(map[string]struct{}, len(cfg.AllowedOrigins))
+	for _, origin := range cfg.AllowedOrigins {
+		allowedOrigins[origin] = struct{}{}
+	}
+
+	methodsStr := strings.Join(cfg.AllowedMethods, ", ")
+	headersStr := strings.Join(cfg.AllowedHeaders, ", ")
+
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			origin := r.Header.Get("Origin")
+
+			if origin != "" {
+				if _, ok := allowedOrigins[origin]; ok {
+					w.Header().Set("Access-Control-Allow-Origin", origin)
+					w.Header().Set("Vary", "Origin")
+
+					if cfg.AllowCredentials {
+						w.Header().
+							Set("Access-Control-Allow-Credentials", "true")
+					}
+				}
+			}
+
+			if r.Method == http.MethodOptions {
+				w.Header().Set("Access-Control-Allow-Methods", methodsStr)
+				w.Header().Set("Access-Control-Allow-Headers", headersStr)
+
+				if cfg.MaxAge > 0 {
+					w.Header().
+						Set("Access-Control-Max-Age", strconv.Itoa(cfg.MaxAge))
+				}
+
+				w.WriteHeader(http.StatusNoContent)
+				return
+			}
+
+			next.ServeHTTP(w, r)
+		})
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/logging.go b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/logging.go
new file mode 100644
index 00000000..13935694
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/logging.go
@@ -0,0 +1,99 @@
+// ©AngelaMos | 2026
+// logging.go
+
+package middleware
+
+import (
+	"context"
+	"log/slog"
+	"net/http"
+	"time"
+
+	"go.opentelemetry.io/otel/trace"
+)
+
+type loggerKey struct{}
+
+func Logger(baseLogger *slog.Logger) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			start := time.Now()
+
+			requestID := GetRequestID(r.Context())
+
+			reqLogger := baseLogger.With(
+				slog.String("request_id", requestID),
+				slog.String("method", r.Method),
+				slog.String("path", r.URL.Path),
+				slog.String("remote_addr", r.RemoteAddr),
+			)
+
+			if span := trace.SpanFromContext(r.Context()); span.SpanContext().
+				IsValid() {
+				reqLogger = reqLogger.With(
+					slog.String(
+						"trace_id",
+						span.SpanContext().TraceID().String(),
+					),
+					slog.String(
+						"span_id",
+						span.SpanContext().SpanID().String(),
+					),
+				)
+			}
+
+			ctx := context.WithValue(r.Context(), loggerKey{}, reqLogger)
+
+			ww := &responseWriter{
+				ResponseWriter: w,
+				status:         http.StatusOK,
+			}
+
+			next.ServeHTTP(ww, r.WithContext(ctx))
+
+			latency := time.Since(start)
+
+			logLevel := slog.LevelInfo
+			if ww.status >= 500 {
+				logLevel = slog.LevelError
+			} else if ww.status >= 400 {
+				logLevel = slog.LevelWarn
+			}
+
+			reqLogger.Log(r.Context(), logLevel, "request completed",
+				slog.Int("status", ww.status),
+				slog.Int("bytes", ww.bytes),
+				slog.Duration("latency", latency),
+				slog.String("user_agent", r.UserAgent()),
+			)
+		})
+	}
+}
+
+func GetLogger(ctx context.Context) *slog.Logger {
+	if logger, ok := ctx.Value(loggerKey{}).(*slog.Logger); ok {
+		return logger
+	}
+	return slog.Default()
+}
+
+type responseWriter struct {
+	http.ResponseWriter
+	status int
+	bytes  int
+}
+
+func (rw *responseWriter) WriteHeader(code int) {
+	rw.status = code
+	rw.ResponseWriter.WriteHeader(code)
+}
+
+func (rw *responseWriter) Write(b []byte) (int, error) {
+	n, err := rw.ResponseWriter.Write(b)
+	rw.bytes += n
+	return n, err
+}
+
+func (rw *responseWriter) Unwrap() http.ResponseWriter {
+	return rw.ResponseWriter
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/operator_bearer.go b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/operator_bearer.go
new file mode 100644
index 00000000..458fd07e
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/operator_bearer.go
@@ -0,0 +1,35 @@
+// ©AngelaMos | 2026
+// operator_bearer.go
+
+package middleware
+
+import (
+	"crypto/subtle"
+	"net/http"
+)
+
+const bearerPrefix = "Bearer "
+
+func OperatorBearer(token string) func(http.Handler) http.Handler {
+	expected := []byte(token)
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if len(expected) == 0 {
+				http.NotFound(w, r)
+				return
+			}
+			auth := r.Header.Get("Authorization")
+			if len(auth) <= len(bearerPrefix) ||
+				auth[:len(bearerPrefix)] != bearerPrefix {
+				http.NotFound(w, r)
+				return
+			}
+			supplied := []byte(auth[len(bearerPrefix):])
+			if subtle.ConstantTimeCompare(supplied, expected) != 1 {
+				http.NotFound(w, r)
+				return
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/operator_bearer_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/operator_bearer_test.go
new file mode 100644
index 00000000..e201df23
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/operator_bearer_test.go
@@ -0,0 +1,185 @@
+// ©AngelaMos | 2026
+// operator_bearer_test.go
+
+package middleware_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/middleware"
+)
+
+const (
+	opTokenCorrect = "s3cr3t-op-token-xyz"
+	opTokenWrong   = "s3cr3t-op-token-XYZ"
+)
+
+func opNextHandler(calls *atomic.Int32) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		calls.Add(1)
+		w.WriteHeader(http.StatusTeapot)
+		if _, err := w.Write([]byte("ok")); err != nil {
+			return
+		}
+	})
+}
+
+func TestOperatorBearer_TableDriven(t *testing.T) {
+	tests := []struct {
+		name           string
+		configuredTok  string
+		authHeader     string
+		setHeader      bool
+		wantStatus     int
+		wantBodyPrefix string
+		wantNextCalled bool
+	}{
+		{
+			name:           "missing Authorization header returns 404",
+			configuredTok:  opTokenCorrect,
+			setHeader:      false,
+			wantStatus:     http.StatusNotFound,
+			wantBodyPrefix: "404",
+			wantNextCalled: false,
+		},
+		{
+			name:           "empty Authorization header returns 404",
+			configuredTok:  opTokenCorrect,
+			authHeader:     "",
+			setHeader:      true,
+			wantStatus:     http.StatusNotFound,
+			wantNextCalled: false,
+		},
+		{
+			name:           "wrong scheme Basic returns 404",
+			configuredTok:  opTokenCorrect,
+			authHeader:     "Basic " + opTokenCorrect,
+			setHeader:      true,
+			wantStatus:     http.StatusNotFound,
+			wantNextCalled: false,
+		},
+		{
+			name:           "lowercase bearer returns 404 (scheme is case-sensitive)",
+			configuredTok:  opTokenCorrect,
+			authHeader:     "bearer " + opTokenCorrect,
+			setHeader:      true,
+			wantStatus:     http.StatusNotFound,
+			wantNextCalled: false,
+		},
+		{
+			name:           "Bearer prefix with no token returns 404",
+			configuredTok:  opTokenCorrect,
+			authHeader:     "Bearer ",
+			setHeader:      true,
+			wantStatus:     http.StatusNotFound,
+			wantNextCalled: false,
+		},
+		{
+			name:           "Bearer with no trailing space returns 404",
+			configuredTok:  opTokenCorrect,
+			authHeader:     "Bearer" + opTokenCorrect,
+			setHeader:      true,
+			wantStatus:     http.StatusNotFound,
+			wantNextCalled: false,
+		},
+		{
+			name:           "wrong token of equal length returns 404",
+			configuredTok:  opTokenCorrect,
+			authHeader:     "Bearer " + opTokenWrong,
+			setHeader:      true,
+			wantStatus:     http.StatusNotFound,
+			wantNextCalled: false,
+		},
+		{
+			name:           "wrong token of different length returns 404",
+			configuredTok:  opTokenCorrect,
+			authHeader:     "Bearer nope",
+			setHeader:      true,
+			wantStatus:     http.StatusNotFound,
+			wantNextCalled: false,
+		},
+		{
+			name:           "correct token passes through to next",
+			configuredTok:  opTokenCorrect,
+			authHeader:     "Bearer " + opTokenCorrect,
+			setHeader:      true,
+			wantStatus:     http.StatusTeapot,
+			wantBodyPrefix: "ok",
+			wantNextCalled: true,
+		},
+		{
+			name:           "empty configured token rejects all requests including matching empty",
+			configuredTok:  "",
+			authHeader:     "Bearer ",
+			setHeader:      true,
+			wantStatus:     http.StatusNotFound,
+			wantNextCalled: false,
+		},
+		{
+			name:           "empty configured token rejects even a Bearer-with-payload",
+			configuredTok:  "",
+			authHeader:     "Bearer anything",
+			setHeader:      true,
+			wantStatus:     http.StatusNotFound,
+			wantNextCalled: false,
+		},
+		{
+			name:           "extra whitespace inside token is not trimmed",
+			configuredTok:  opTokenCorrect,
+			authHeader:     "Bearer  " + opTokenCorrect,
+			setHeader:      true,
+			wantStatus:     http.StatusNotFound,
+			wantNextCalled: false,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			var calls atomic.Int32
+			h := middleware.OperatorBearer(
+				tc.configuredTok,
+			)(
+				opNextHandler(&calls),
+			)
+
+			r := httptest.NewRequest(http.MethodGet, "/admin/x", nil)
+			if tc.setHeader {
+				r.Header.Set("Authorization", tc.authHeader)
+			}
+			w := httptest.NewRecorder()
+			h.ServeHTTP(w, r)
+
+			require.Equal(t, tc.wantStatus, w.Code)
+			if tc.wantNextCalled {
+				require.Equal(t, int32(1), calls.Load())
+			} else {
+				require.Equal(t, int32(0), calls.Load(),
+					"next handler must not be invoked on auth failure")
+			}
+			if tc.wantBodyPrefix != "" {
+				require.Contains(t, w.Body.String(), tc.wantBodyPrefix)
+			}
+		})
+	}
+}
+
+func TestOperatorBearer_NoWWWAuthenticateHeader(t *testing.T) {
+	var calls atomic.Int32
+	h := middleware.OperatorBearer(opTokenCorrect)(opNextHandler(&calls))
+
+	r := httptest.NewRequest(http.MethodGet, "/admin/x", nil)
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+
+	require.Equal(t, http.StatusNotFound, w.Code)
+	require.Empty(
+		t,
+		w.Header().Get("WWW-Authenticate"),
+		"404 hides endpoint existence; WWW-Authenticate would leak the auth scheme",
+	)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/ratelimit.go b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/ratelimit.go
new file mode 100644
index 00000000..ec02d560
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/ratelimit.go
@@ -0,0 +1,257 @@
+// ©AngelaMos | 2026
+// ratelimit.go
+
+package middleware
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	redis_rate "github.com/go-redis/redis_rate/v10"
+	"github.com/redis/go-redis/v9"
+	"golang.org/x/time/rate"
+)
+
+type RateLimitConfig struct {
+	Limit      redis_rate.Limit
+	KeyFunc    func(*http.Request) string
+	FailOpen   bool
+	BypassFunc func(*http.Request) bool
+	OnLimited  func(http.ResponseWriter, *http.Request, *redis_rate.Result)
+}
+
+type RateLimiter struct {
+	limiter  *redis_rate.Limiter
+	fallback *localLimiter
+	config   RateLimitConfig
+}
+
+func NewRateLimiter(rdb *redis.Client, cfg RateLimitConfig) *RateLimiter {
+	if cfg.KeyFunc == nil {
+		cfg.KeyFunc = KeyByIP
+	}
+
+	return &RateLimiter{
+		limiter:  redis_rate.NewLimiter(rdb),
+		fallback: newLocalLimiter(),
+		config:   cfg,
+	}
+}
+
+func (rl *RateLimiter) Handler(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if rl.config.BypassFunc != nil && rl.config.BypassFunc(r) {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		key := rl.config.KeyFunc(r)
+		res, err := rl.allow(r.Context(), key)
+		if err != nil {
+			if rl.config.FailOpen {
+				slog.Warn("rate limiter error, failing open",
+					"error", err,
+					"key", key,
+				)
+				next.ServeHTTP(w, r)
+				return
+			}
+			http.Error(w, "Service Unavailable", http.StatusServiceUnavailable)
+			return
+		}
+
+		setRateLimitHeaders(w, res, rl.config.Limit)
+
+		if res.Allowed == 0 {
+			if rl.config.OnLimited != nil {
+				rl.config.OnLimited(w, r, res)
+				return
+			}
+			writeRateLimitExceeded(w, res)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
+
+func (rl *RateLimiter) allow(
+	ctx context.Context,
+	key string,
+) (*redis_rate.Result, error) {
+	res, err := rl.limiter.Allow(ctx, key, rl.config.Limit)
+	if err != nil {
+		return rl.fallback.allow(key, rl.config.Limit)
+	}
+	return res, nil
+}
+
+func KeyByIP(r *http.Request) string {
+	return "ratelimit:ip:" + RealIP(r)
+}
+
+func setRateLimitHeaders(
+	w http.ResponseWriter,
+	res *redis_rate.Result,
+	limit redis_rate.Limit,
+) {
+	h := w.Header()
+
+	h.Set("X-RateLimit-Limit", strconv.Itoa(limit.Rate))
+	h.Set("X-RateLimit-Remaining", strconv.Itoa(res.Remaining))
+	h.Set("X-RateLimit-Reset", strconv.FormatInt(
+		time.Now().Add(res.ResetAfter).Unix(), 10))
+
+	windowSecs := int(limit.Period.Seconds())
+	h.Set("RateLimit-Policy", fmt.Sprintf(`%d;w=%d`, limit.Rate, windowSecs))
+	h.Set(
+		"RateLimit",
+		fmt.Sprintf(`%d;t=%d`, res.Remaining, int(res.ResetAfter.Seconds())),
+	)
+}
+
+func writeRateLimitExceeded(w http.ResponseWriter, res *redis_rate.Result) {
+	retryAfter := int(res.RetryAfter.Seconds())
+	if retryAfter < 1 {
+		retryAfter = 1
+	}
+
+	w.Header().Set("Retry-After", strconv.Itoa(retryAfter))
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusTooManyRequests)
+
+	response := map[string]any{
+		"success": false,
+		"error": map[string]any{
+			"code": "RATE_LIMITED",
+			"message": fmt.Sprintf(
+				"Rate limit exceeded. Retry after %d seconds.",
+				retryAfter,
+			),
+		},
+	}
+
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		slog.Error("failed to encode rate-limit response", "error", err)
+	}
+}
+
+type limiterEntry struct {
+	limiter    *rate.Limiter
+	lastAccess atomic.Int64
+}
+
+type localLimiter struct {
+	limiters sync.Map
+}
+
+const (
+	cleanupInterval = 5 * time.Minute
+	entryTTL        = 10 * time.Minute
+)
+
+func newLocalLimiter() *localLimiter {
+	l := &localLimiter{}
+	go l.cleanup()
+	return l
+}
+
+func (l *localLimiter) cleanup() {
+	ticker := time.NewTicker(cleanupInterval)
+	defer ticker.Stop()
+
+	for range ticker.C {
+		cutoff := time.Now().Add(-entryTTL).Unix()
+		l.limiters.Range(func(key, value any) bool {
+			entry, ok := value.(*limiterEntry)
+			if ok && entry.lastAccess.Load() < cutoff {
+				l.limiters.Delete(key)
+			}
+			return true
+		})
+	}
+}
+
+func (l *localLimiter) allow(
+	key string,
+	limit redis_rate.Limit,
+) (*redis_rate.Result, error) {
+	ratePerSec := float64(limit.Rate) / limit.Period.Seconds()
+	now := time.Now().Unix()
+
+	entryI, loaded := l.limiters.Load(key)
+	if !loaded {
+		newEntry := &limiterEntry{
+			limiter: rate.NewLimiter(
+				rate.Limit(ratePerSec),
+				limit.Burst,
+			),
+		}
+		newEntry.lastAccess.Store(now)
+		entryI, _ = l.limiters.LoadOrStore(key, newEntry)
+	}
+
+	entry, ok := entryI.(*limiterEntry)
+	if !ok {
+		return nil, fmt.Errorf("invalid limiter entry type")
+	}
+	entry.lastAccess.Store(now)
+
+	allowed := entry.limiter.Allow()
+
+	remaining := int(entry.limiter.Tokens())
+	if remaining < 0 {
+		remaining = 0
+	}
+
+	var retryAfter time.Duration
+	if !allowed {
+		retryAfter = time.Duration(float64(time.Second) / ratePerSec)
+	} else {
+		retryAfter = -1
+	}
+
+	allowedInt := 0
+	if allowed {
+		allowedInt = 1
+	}
+
+	return &redis_rate.Result{
+		Limit:      limit,
+		Allowed:    allowedInt,
+		Remaining:  remaining,
+		RetryAfter: retryAfter,
+		ResetAfter: time.Duration(float64(time.Second) / ratePerSec),
+	}, nil
+}
+
+func PerMinute(rate, burst int) redis_rate.Limit {
+	return redis_rate.Limit{
+		Rate:   rate,
+		Burst:  burst,
+		Period: time.Minute,
+	}
+}
+
+func PerSecond(rate, burst int) redis_rate.Limit {
+	return redis_rate.Limit{
+		Rate:   rate,
+		Burst:  burst,
+		Period: time.Second,
+	}
+}
+
+func PerHour(rate, burst int) redis_rate.Limit {
+	return redis_rate.Limit{
+		Rate:   rate,
+		Burst:  burst,
+		Period: time.Hour,
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/realip.go b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/realip.go
new file mode 100644
index 00000000..f0db7e53
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/realip.go
@@ -0,0 +1,108 @@
+// ©AngelaMos | 2026
+// realip.go
+
+package middleware
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"strings"
+	"sync/atomic"
+)
+
+const (
+	headerCFConnectingIP = "CF-Connecting-IP"
+	headerXForwardedFor  = "X-Forwarded-For"
+	headerXRealIP        = "X-Real-IP"
+)
+
+type proxyTrustState struct {
+	cidrs []*net.IPNet
+}
+
+var trustedProxies atomic.Pointer[proxyTrustState]
+
+func SetTrustedProxyCIDRs(cidrs []string) error {
+	parsed := make([]*net.IPNet, 0, len(cidrs))
+	for _, c := range cidrs {
+		trimmed := strings.TrimSpace(c)
+		if trimmed == "" {
+			continue
+		}
+		_, n, err := net.ParseCIDR(trimmed)
+		if err != nil {
+			return fmt.Errorf("trusted proxy cidr %q: %w", c, err)
+		}
+		parsed = append(parsed, n)
+	}
+	trustedProxies.Store(&proxyTrustState{cidrs: parsed})
+	return nil
+}
+
+func ClearTrustedProxyCIDRs() {
+	trustedProxies.Store(nil)
+}
+
+func isTrustedProxy(remoteAddr string) bool {
+	state := trustedProxies.Load()
+	if state == nil {
+		return true
+	}
+	host, _, err := net.SplitHostPort(remoteAddr)
+	if err != nil {
+		host = remoteAddr
+	}
+	ip := net.ParseIP(host)
+	if ip == nil {
+		return false
+	}
+	for _, n := range state.cidrs {
+		if n.Contains(ip) {
+			return true
+		}
+	}
+	return false
+}
+
+func RealIP(r *http.Request) string {
+	if isTrustedProxy(r.RemoteAddr) {
+		if v := strings.TrimSpace(
+			r.Header.Get(headerCFConnectingIP),
+		); v != "" {
+			return v
+		}
+		if v := firstNonEmptyXFF(
+			r.Header.Get(headerXForwardedFor),
+		); v != "" {
+			return v
+		}
+		if v := strings.TrimSpace(r.Header.Get(headerXRealIP)); v != "" {
+			return v
+		}
+	}
+	if host, _, err := net.SplitHostPort(r.RemoteAddr); err == nil {
+		return host
+	}
+	return r.RemoteAddr
+}
+
+func OptionalHeader(v string) *string {
+	v = strings.TrimSpace(v)
+	if v == "" {
+		return nil
+	}
+	return &v
+}
+
+func firstNonEmptyXFF(header string) string {
+	if header == "" {
+		return ""
+	}
+	for _, p := range strings.Split(header, ",") {
+		if v := strings.TrimSpace(p); v != "" {
+			return v
+		}
+	}
+	return ""
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/recovery.go b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/recovery.go
new file mode 100644
index 00000000..b900c3b5
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/recovery.go
@@ -0,0 +1,46 @@
+// ©AngelaMos | 2026
+// recovery.go
+
+package middleware
+
+import (
+	"log/slog"
+	"net/http"
+	"runtime/debug"
+)
+
+const (
+	recoveryContentType = "application/json"
+	recoveryBody        = `{"success":false,"error":{"code":"INTERNAL_ERROR","message":"internal server error"}}`
+)
+
+func Recovery(logger *slog.Logger) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			defer func() {
+				rec := recover()
+				if rec == nil {
+					return
+				}
+				requestID := ""
+				if rid, ok := r.Context().Value(RequestIDKey).(string); ok {
+					requestID = rid
+				}
+				logger.ErrorContext(r.Context(), "handler panic",
+					"panic", rec,
+					"request_id", requestID,
+					"path", r.URL.Path,
+					"method", r.Method,
+					"stack", string(debug.Stack()),
+				)
+				w.Header().Set("Content-Type", recoveryContentType)
+				w.WriteHeader(http.StatusInternalServerError)
+				if _, err := w.Write([]byte(recoveryBody)); err != nil {
+					logger.WarnContext(r.Context(), "recovery write",
+						"error", err)
+				}
+			}()
+			next.ServeHTTP(w, r)
+		})
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/recovery_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/recovery_test.go
new file mode 100644
index 00000000..c280e4cf
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/recovery_test.go
@@ -0,0 +1,84 @@
+// ©AngelaMos | 2026
+// recovery_test.go
+
+package middleware_test
+
+import (
+	"bytes"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/middleware"
+)
+
+func quietLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+func TestRecovery_PanicReturns500(t *testing.T) {
+	var buf bytes.Buffer
+	logger := slog.New(slog.NewTextHandler(&buf, nil))
+
+	h := middleware.Recovery(
+		logger,
+	)(
+		http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
+			panic("boom")
+		}),
+	)
+
+	w := httptest.NewRecorder()
+	r := httptest.NewRequest(http.MethodGet, "/x", nil)
+	h.ServeHTTP(w, r)
+
+	require.Equal(t, http.StatusInternalServerError, w.Code)
+	require.Contains(t, w.Body.String(), `"INTERNAL_ERROR"`)
+	require.Contains(t, buf.String(), "handler panic")
+	require.Contains(t, buf.String(), "boom")
+}
+
+func TestRecovery_NoPanicPassesThrough(t *testing.T) {
+	h := middleware.Recovery(
+		quietLogger(),
+	)(
+		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusTeapot)
+			if _, err := w.Write([]byte("ok")); err != nil {
+				t.Fatalf("write: %v", err)
+			}
+		}),
+	)
+
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/", nil))
+
+	require.Equal(t, http.StatusTeapot, w.Code)
+	require.Equal(t, "ok", w.Body.String())
+}
+
+func TestRecovery_LogsRequestID(t *testing.T) {
+	var buf bytes.Buffer
+	logger := slog.New(slog.NewTextHandler(&buf, nil))
+
+	chain := middleware.RequestID(
+		middleware.Recovery(
+			logger,
+		)(
+			http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
+				panic("boom")
+			}),
+		),
+	)
+
+	w := httptest.NewRecorder()
+	r := httptest.NewRequest(http.MethodGet, "/x", nil)
+	r.Header.Set("X-Request-ID", "test-rid-123")
+	chain.ServeHTTP(w, r)
+
+	require.Contains(t, buf.String(), "test-rid-123")
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/request_id.go b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/request_id.go
new file mode 100644
index 00000000..5c645fea
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/request_id.go
@@ -0,0 +1,40 @@
+// ©AngelaMos | 2026
+// request_id.go
+
+package middleware
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/google/uuid"
+)
+
+type contextKey string
+
+const RequestIDKey contextKey = "request_id"
+
+const RequestIDHeader = "X-Request-ID"
+
+func RequestID(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requestID := r.Header.Get(RequestIDHeader)
+
+		if requestID == "" {
+			requestID = uuid.New().String()
+		}
+
+		ctx := context.WithValue(r.Context(), RequestIDKey, requestID)
+
+		w.Header().Set(RequestIDHeader, requestID)
+
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+func GetRequestID(ctx context.Context) string {
+	if id, ok := ctx.Value(RequestIDKey).(string); ok {
+		return id
+	}
+	return ""
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/turnstile.go b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/turnstile.go
new file mode 100644
index 00000000..1af60d7c
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/turnstile.go
@@ -0,0 +1,67 @@
+// ©AngelaMos | 2026
+// turnstile.go
+
+package middleware
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+)
+
+const (
+	turnstileHeaderName       = "CF-Turnstile-Response"
+	turnstileBodyFieldName    = "cf_turnstile_response"
+	turnstileMaxBodyBytes     = 1 * 1024 * 1024
+	turnstileErrorContentType = "application/json"
+	turnstileErrorBody        = `{"success":false,"error":{"code":"TURNSTILE_FAILED","message":"turnstile verification failed"}}`
+)
+
+type TurnstileVerifier interface {
+	Verify(ctx context.Context, token, fingerprint string) error
+}
+
+func TurnstileVerify(v TurnstileVerifier) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			tokenStr := extractTurnstileToken(r)
+			fp := ExtractFingerprint(r)
+
+			if err := v.Verify(r.Context(), tokenStr, fp); err != nil {
+				w.Header().Set("Content-Type", turnstileErrorContentType)
+				w.WriteHeader(http.StatusBadRequest)
+				if _, wErr := w.Write([]byte(turnstileErrorBody)); wErr != nil {
+					return
+				}
+				return
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+func extractTurnstileToken(r *http.Request) string {
+	if v := r.Header.Get(turnstileHeaderName); v != "" {
+		return v
+	}
+	if r.Body == nil {
+		return ""
+	}
+	limited := io.LimitReader(r.Body, turnstileMaxBodyBytes)
+	body, err := io.ReadAll(limited)
+	if err != nil {
+		return ""
+	}
+	r.Body = io.NopCloser(bytes.NewReader(body))
+
+	var m map[string]any
+	if err := json.Unmarshal(body, &m); err != nil {
+		return ""
+	}
+	if s, ok := m[turnstileBodyFieldName].(string); ok {
+		return s
+	}
+	return ""
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/turnstile_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/turnstile_test.go
new file mode 100644
index 00000000..2540f091
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/middleware/turnstile_test.go
@@ -0,0 +1,125 @@
+// ©AngelaMos | 2026
+// turnstile_test.go
+
+package middleware_test
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/middleware"
+)
+
+type fakeVerifier struct {
+	calls       atomic.Int32
+	lastToken   atomic.Value
+	lastFP      atomic.Value
+	returnError error
+}
+
+func (f *fakeVerifier) Verify(_ context.Context, token, fp string) error {
+	f.calls.Add(1)
+	f.lastToken.Store(token)
+	f.lastFP.Store(fp)
+	return f.returnError
+}
+
+func okHandler() http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		w.WriteHeader(http.StatusOK)
+		if _, err := w.Write(body); err != nil {
+			return
+		}
+	})
+}
+
+func TestTurnstileVerify_HeaderTokenPasses(t *testing.T) {
+	v := &fakeVerifier{}
+	h := middleware.TurnstileVerify(v)(okHandler())
+
+	r := httptest.NewRequest(http.MethodPost, "/", nil)
+	r.Header.Set("CF-Turnstile-Response", "header-token")
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+
+	require.Equal(t, http.StatusOK, w.Code)
+	require.Equal(t, int32(1), v.calls.Load())
+	require.Equal(t, "header-token", v.lastToken.Load())
+}
+
+func TestTurnstileVerify_BodyTokenPasses(t *testing.T) {
+	v := &fakeVerifier{}
+	h := middleware.TurnstileVerify(v)(okHandler())
+
+	r := httptest.NewRequest(http.MethodPost, "/",
+		strings.NewReader(`{"cf_turnstile_response":"body-token","other":1}`))
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+
+	require.Equal(t, http.StatusOK, w.Code)
+	require.Equal(t, "body-token", v.lastToken.Load())
+}
+
+func TestTurnstileVerify_BodyPreservedForDownstream(t *testing.T) {
+	v := &fakeVerifier{}
+	h := middleware.TurnstileVerify(v)(okHandler())
+
+	body := `{"cf_turnstile_response":"t","foo":"bar"}`
+	r := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(body))
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+
+	require.Equal(t, body, w.Body.String(),
+		"downstream handler must still read the original body")
+}
+
+func TestTurnstileVerify_FailureReturns400(t *testing.T) {
+	v := &fakeVerifier{returnError: errors.New("bad")}
+	h := middleware.TurnstileVerify(v)(okHandler())
+
+	r := httptest.NewRequest(http.MethodPost, "/", nil)
+	r.Header.Set("CF-Turnstile-Response", "tok")
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+
+	require.Equal(t, http.StatusBadRequest, w.Code)
+	require.Contains(t, w.Body.String(), `"TURNSTILE_FAILED"`)
+}
+
+func TestTurnstileVerify_HeaderWinsOverBody(t *testing.T) {
+	v := &fakeVerifier{}
+	h := middleware.TurnstileVerify(v)(okHandler())
+
+	r := httptest.NewRequest(http.MethodPost, "/",
+		strings.NewReader(`{"cf_turnstile_response":"body-token"}`))
+	r.Header.Set("CF-Turnstile-Response", "header-token")
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+
+	require.Equal(t, "header-token", v.lastToken.Load())
+}
+
+func TestTurnstileVerify_NoTokenStillCallsVerifier(t *testing.T) {
+	v := &fakeVerifier{}
+	h := middleware.TurnstileVerify(v)(okHandler())
+
+	r := httptest.NewRequest(http.MethodPost, "/", nil)
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+
+	require.Equal(t, int32(1), v.calls.Load())
+	require.Empty(t, v.lastToken.Load())
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/notify/service.go b/PROJECTS/beginner/canary-token-generator/backend/internal/notify/service.go
new file mode 100644
index 00000000..3dc887f2
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/notify/service.go
@@ -0,0 +1,195 @@
+// ©AngelaMos | 2026
+// service.go
+
+package notify
+
+import (
+	"context"
+	"log/slog"
+	"sync"
+	"time"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+)
+
+const (
+	defaultSendTimeout = 30 * time.Second
+	defaultWorkers     = 8
+	defaultQueueSize   = 256
+)
+
+type Service struct {
+	senders     map[string]Sender
+	status      StatusWriter
+	logger      *slog.Logger
+	sendTimeout time.Duration
+	workers     int
+	queue       chan dispatchJob
+	workerWg    sync.WaitGroup
+	jobWg       sync.WaitGroup
+	closeOnce   sync.Once
+}
+
+type dispatchJob struct {
+	info event.NotifyInfo
+	evt  *event.Event
+}
+
+type Option func(*Service)
+
+func WithLogger(l *slog.Logger) Option {
+	return func(s *Service) { s.logger = l }
+}
+
+func WithSendTimeout(d time.Duration) Option {
+	return func(s *Service) { s.sendTimeout = d }
+}
+
+func WithMaxConcurrent(n int) Option {
+	return func(s *Service) {
+		if n > 0 {
+			s.workers = n
+		}
+	}
+}
+
+func WithQueueSize(n int) Option {
+	return func(s *Service) {
+		if n > 0 {
+			s.queue = make(chan dispatchJob, n)
+		}
+	}
+}
+
+func NewService(status StatusWriter, opts ...Option) *Service {
+	s := &Service{
+		senders:     make(map[string]Sender),
+		status:      status,
+		logger:      slog.Default(),
+		sendTimeout: defaultSendTimeout,
+		workers:     defaultWorkers,
+	}
+	for _, o := range opts {
+		o(s)
+	}
+	if s.queue == nil {
+		s.queue = make(chan dispatchJob, defaultQueueSize)
+	}
+	for range s.workers {
+		s.workerWg.Add(1)
+		go s.worker()
+	}
+	return s
+}
+
+func (s *Service) Register(senders ...Sender) {
+	for _, sender := range senders {
+		if sender == nil {
+			continue
+		}
+		s.senders[sender.Channel()] = sender
+	}
+}
+
+func (s *Service) Notify(info event.NotifyInfo, evt *event.Event) {
+	s.jobWg.Add(1)
+	select {
+	case s.queue <- dispatchJob{info: info, evt: evt}:
+	default:
+		s.jobWg.Done()
+		s.logger.Warn("notify: queue full, dropping",
+			"event_id", evt.ID,
+			"token_id", info.TokenID,
+			"channel", info.AlertChannel,
+		)
+		s.markStatus(
+			context.Background(),
+			evt.ID,
+			event.NotifyFailed,
+			nil,
+		)
+	}
+}
+
+func (s *Service) Wait() {
+	s.jobWg.Wait()
+}
+
+func (s *Service) Shutdown(ctx context.Context) error {
+	s.closeOnce.Do(func() { close(s.queue) })
+	done := make(chan struct{})
+	go func() {
+		s.workerWg.Wait()
+		close(done)
+	}()
+	select {
+	case <-done:
+		return nil
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+func (s *Service) worker() {
+	defer s.workerWg.Done()
+	for job := range s.queue {
+		s.dispatch(job.info, job.evt)
+		s.jobWg.Done()
+	}
+}
+
+func (s *Service) dispatch(info event.NotifyInfo, evt *event.Event) {
+	ctx, cancel := context.WithTimeout(
+		context.Background(),
+		s.sendTimeout,
+	)
+	defer cancel()
+
+	sender, ok := s.senders[info.AlertChannel]
+	if !ok {
+		s.logger.WarnContext(ctx, "notify: no sender registered",
+			"channel", info.AlertChannel,
+			"event_id", evt.ID,
+			"token_id", info.TokenID,
+		)
+		s.markStatus(ctx, evt.ID, event.NotifyFailed, nil)
+		return
+	}
+
+	if err := sender.Send(ctx, info, evt); err != nil {
+		s.logger.WarnContext(ctx, "notify: send failed",
+			"channel", info.AlertChannel,
+			"event_id", evt.ID,
+			"token_id", info.TokenID,
+			"error", err,
+		)
+		s.markStatus(ctx, evt.ID, event.NotifyFailed, nil)
+		return
+	}
+
+	now := time.Now().UTC()
+	s.markStatus(ctx, evt.ID, event.NotifySent, &now)
+}
+
+func (s *Service) markStatus(
+	ctx context.Context,
+	eventID int64,
+	status event.NotifyStatus,
+	sentAt *time.Time,
+) {
+	if s.status == nil {
+		return
+	}
+	if err := s.status.UpdateNotifyStatus(
+		ctx,
+		eventID,
+		status,
+		sentAt,
+	); err != nil {
+		s.logger.WarnContext(ctx, "notify: status writeback failed",
+			"event_id", eventID,
+			"status", status,
+			"error", err,
+		)
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/notify/service_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/notify/service_test.go
new file mode 100644
index 00000000..8c8b601a
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/notify/service_test.go
@@ -0,0 +1,256 @@
+// ©AngelaMos | 2026
+// service_test.go
+
+package notify_test
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/notify"
+)
+
+type fakeSender struct {
+	channel    string
+	calls      atomic.Int32
+	returnErr  error
+	lastInfo   atomic.Value
+	delay      time.Duration
+	respectCtx bool
+}
+
+func (f *fakeSender) Channel() string { return f.channel }
+
+func (f *fakeSender) Send(
+	ctx context.Context,
+	info event.NotifyInfo,
+	_ *event.Event,
+) error {
+	f.calls.Add(1)
+	f.lastInfo.Store(info)
+	if f.delay > 0 {
+		if f.respectCtx {
+			select {
+			case <-time.After(f.delay):
+			case <-ctx.Done():
+				return ctx.Err()
+			}
+		} else {
+			time.Sleep(f.delay)
+		}
+	}
+	return f.returnErr
+}
+
+type fakeStatusWriter struct {
+	mu      sync.Mutex
+	updates []statusUpdate
+	err     error
+}
+
+type statusUpdate struct {
+	eventID int64
+	status  event.NotifyStatus
+	sentAt  *time.Time
+}
+
+func (f *fakeStatusWriter) UpdateNotifyStatus(
+	_ context.Context,
+	id int64,
+	status event.NotifyStatus,
+	sentAt *time.Time,
+) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.updates = append(
+		f.updates,
+		statusUpdate{eventID: id, status: status, sentAt: sentAt},
+	)
+	return f.err
+}
+
+func (f *fakeStatusWriter) snapshot() []statusUpdate {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	out := make([]statusUpdate, len(f.updates))
+	copy(out, f.updates)
+	return out
+}
+
+func sampleEvent(id int64) *event.Event {
+	return &event.Event{
+		ID:          id,
+		TokenID:     "tokfoo000001",
+		TriggeredAt: time.Now().UTC(),
+		SourceIP:    "203.0.113.1",
+	}
+}
+
+func sampleInfo(channel string) event.NotifyInfo {
+	return event.NotifyInfo{
+		TokenID:      "tokfoo000001",
+		ManageID:     "abcd",
+		Type:         "webbug",
+		Memo:         "test",
+		AlertChannel: channel,
+		TelegramBot:  "bot",
+		TelegramChat: "chat",
+		WebhookURL:   "https://example.com/h",
+	}
+}
+
+func newService(
+	t *testing.T,
+	status notify.StatusWriter,
+	senders ...notify.Sender,
+) *notify.Service {
+	t.Helper()
+	svc := notify.NewService(status,
+		notify.WithLogger(slog.New(slog.NewTextHandler(testWriter{t}, nil))),
+		notify.WithSendTimeout(2*time.Second),
+	)
+	svc.Register(senders...)
+	return svc
+}
+
+type testWriter struct{ t *testing.T }
+
+func (w testWriter) Write(
+	p []byte,
+) (int, error) {
+	w.t.Log(string(p))
+	return len(p), nil
+}
+
+func TestService_RoutesByChannel(t *testing.T) {
+	t.Parallel()
+	tg := &fakeSender{channel: "telegram"}
+	wh := &fakeSender{channel: "webhook"}
+	status := &fakeStatusWriter{}
+	svc := newService(t, status, tg, wh)
+
+	svc.Notify(sampleInfo("telegram"), sampleEvent(1))
+	svc.Notify(sampleInfo("webhook"), sampleEvent(2))
+	svc.Wait()
+
+	require.Equal(t, int32(1), tg.calls.Load())
+	require.Equal(t, int32(1), wh.calls.Load())
+}
+
+func TestService_MarksSentOnSuccess(t *testing.T) {
+	t.Parallel()
+	tg := &fakeSender{channel: "telegram"}
+	status := &fakeStatusWriter{}
+	svc := newService(t, status, tg)
+
+	svc.Notify(sampleInfo("telegram"), sampleEvent(1))
+	svc.Wait()
+
+	updates := status.snapshot()
+	require.Len(t, updates, 1)
+	require.Equal(t, int64(1), updates[0].eventID)
+	require.Equal(t, event.NotifySent, updates[0].status)
+	require.NotNil(t, updates[0].sentAt)
+}
+
+func TestService_MarksFailedOnSenderError(t *testing.T) {
+	t.Parallel()
+	tg := &fakeSender{channel: "telegram", returnErr: errors.New("api blew up")}
+	status := &fakeStatusWriter{}
+	svc := newService(t, status, tg)
+
+	svc.Notify(sampleInfo("telegram"), sampleEvent(7))
+	svc.Wait()
+
+	updates := status.snapshot()
+	require.Len(t, updates, 1)
+	require.Equal(t, int64(7), updates[0].eventID)
+	require.Equal(t, event.NotifyFailed, updates[0].status)
+	require.Nil(t, updates[0].sentAt)
+}
+
+func TestService_MarksFailedWhenChannelUnknown(t *testing.T) {
+	t.Parallel()
+	tg := &fakeSender{channel: "telegram"}
+	status := &fakeStatusWriter{}
+	svc := newService(t, status, tg)
+
+	svc.Notify(sampleInfo("smoke-signal"), sampleEvent(99))
+	svc.Wait()
+
+	require.Equal(t, int32(0), tg.calls.Load())
+	updates := status.snapshot()
+	require.Len(t, updates, 1)
+	require.Equal(t, event.NotifyFailed, updates[0].status)
+}
+
+func TestService_NotifyIsAsync(t *testing.T) {
+	t.Parallel()
+	tg := &fakeSender{channel: "telegram", delay: 100 * time.Millisecond}
+	status := &fakeStatusWriter{}
+	svc := newService(t, status, tg)
+
+	start := time.Now()
+	svc.Notify(sampleInfo("telegram"), sampleEvent(1))
+	require.Less(t, time.Since(start), 50*time.Millisecond,
+		"Notify should return immediately, not wait for the send")
+	svc.Wait()
+	require.Equal(t, int32(1), tg.calls.Load())
+}
+
+func TestService_DispatchTimeoutBoundsSender(t *testing.T) {
+	t.Parallel()
+	tg := &fakeSender{
+		channel:    "telegram",
+		delay:      2 * time.Second,
+		respectCtx: true,
+	}
+	status := &fakeStatusWriter{}
+	svc := notify.NewService(status,
+		notify.WithSendTimeout(50*time.Millisecond),
+	)
+	svc.Register(tg)
+
+	svc.Notify(sampleInfo("telegram"), sampleEvent(1))
+	svc.Wait()
+
+	updates := status.snapshot()
+	require.Len(t, updates, 1)
+	require.Equal(t, event.NotifyFailed, updates[0].status,
+		"timeout should mark event failed")
+}
+
+func TestService_StatusWriterErrorDoesNotPanic(t *testing.T) {
+	t.Parallel()
+	tg := &fakeSender{channel: "telegram"}
+	status := &fakeStatusWriter{err: errors.New("db down")}
+	svc := newService(t, status, tg)
+
+	require.NotPanics(t, func() {
+		svc.Notify(sampleInfo("telegram"), sampleEvent(1))
+		svc.Wait()
+	})
+}
+
+func TestService_ConcurrentNotifyAllComplete(t *testing.T) {
+	t.Parallel()
+	tg := &fakeSender{channel: "telegram", delay: 10 * time.Millisecond}
+	status := &fakeStatusWriter{}
+	svc := newService(t, status, tg)
+
+	const n = 50
+	for i := range n {
+		svc.Notify(sampleInfo("telegram"), sampleEvent(int64(i+1)))
+	}
+	svc.Wait()
+	require.Equal(t, int32(n), tg.calls.Load())
+	require.Len(t, status.snapshot(), n)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/notify/telegram/sender.go b/PROJECTS/beginner/canary-token-generator/backend/internal/notify/telegram/sender.go
new file mode 100644
index 00000000..49de6952
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/notify/telegram/sender.go
@@ -0,0 +1,298 @@
+// ©AngelaMos | 2026
+// sender.go
+
+package telegram
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/cenkalti/backoff/v5"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+)
+
+const (
+	Channel = "telegram"
+
+	defaultAPIBase         = "https://api.telegram.org"
+	defaultMaxTries        = 3
+	defaultMaxElapsed      = 30 * time.Second
+	defaultInitialInterval = 500 * time.Millisecond
+	defaultOverallTimeout  = 10 * time.Second
+	defaultDialTimeout     = 5 * time.Second
+
+	uaTruncateRunes = 80
+
+	parseModeMarkdownV2 = "MarkdownV2"
+	contentTypeJSON     = "application/json"
+
+	v2SpecialChars = "_*[]()~`>#+-=|{}.!"
+)
+
+var (
+	ErrChannelNotConfigured = errors.New(
+		"telegram: bot token or chat id not configured",
+	)
+	ErrTelegramAPI = errors.New("telegram: api error")
+)
+
+type Config struct {
+	APIBase         string
+	ManageURL       string
+	HTTPClient      *http.Client
+	MaxTries        uint
+	MaxElapsed      time.Duration
+	InitialInterval time.Duration
+}
+
+type Option func(*Config)
+
+func WithMaxTries(n uint) Option {
+	return func(c *Config) { c.MaxTries = n }
+}
+
+func WithMaxElapsed(d time.Duration) Option {
+	return func(c *Config) { c.MaxElapsed = d }
+}
+
+func WithInitialInterval(d time.Duration) Option {
+	return func(c *Config) { c.InitialInterval = d }
+}
+
+func WithHTTPClient(client *http.Client) Option {
+	return func(c *Config) { c.HTTPClient = client }
+}
+
+type Sender struct {
+	apiBase         string
+	manageURL       string
+	httpClient      *http.Client
+	maxTries        uint
+	maxElapsed      time.Duration
+	initialInterval time.Duration
+}
+
+func NewSender(cfg Config, opts ...Option) *Sender {
+	for _, o := range opts {
+		o(&cfg)
+	}
+	if cfg.APIBase == "" {
+		cfg.APIBase = defaultAPIBase
+	}
+	if cfg.HTTPClient == nil {
+		cfg.HTTPClient = defaultHTTPClient()
+	}
+	if cfg.MaxTries == 0 {
+		cfg.MaxTries = defaultMaxTries
+	}
+	if cfg.MaxElapsed == 0 {
+		cfg.MaxElapsed = defaultMaxElapsed
+	}
+	if cfg.InitialInterval == 0 {
+		cfg.InitialInterval = defaultInitialInterval
+	}
+	return &Sender{
+		apiBase:         strings.TrimRight(cfg.APIBase, "/"),
+		manageURL:       strings.TrimRight(cfg.ManageURL, "/"),
+		httpClient:      cfg.HTTPClient,
+		maxTries:        cfg.MaxTries,
+		maxElapsed:      cfg.MaxElapsed,
+		initialInterval: cfg.InitialInterval,
+	}
+}
+
+func defaultHTTPClient() *http.Client {
+	dialer := &net.Dialer{Timeout: defaultDialTimeout}
+	return &http.Client{
+		Timeout: defaultOverallTimeout,
+		Transport: &http.Transport{
+			DialContext:           dialer.DialContext,
+			TLSHandshakeTimeout:   defaultDialTimeout,
+			ResponseHeaderTimeout: defaultOverallTimeout,
+			ExpectContinueTimeout: time.Second,
+			IdleConnTimeout:       30 * time.Second,
+		},
+	}
+}
+
+func (s *Sender) Channel() string { return Channel }
+
+func (s *Sender) Send(
+	ctx context.Context,
+	info event.NotifyInfo,
+	evt *event.Event,
+) error {
+	if info.TelegramBot == "" || info.TelegramChat == "" {
+		return ErrChannelNotConfigured
+	}
+	endpoint := s.apiBase + "/bot" + info.TelegramBot + "/sendMessage"
+	body, err := json.Marshal(map[string]string{
+		"chat_id":    info.TelegramChat,
+		"text":       buildMessage(info, evt, s.manageURL),
+		"parse_mode": parseModeMarkdownV2,
+	})
+	if err != nil {
+		return fmt.Errorf("telegram: marshal body: %w", err)
+	}
+
+	expBackoff := backoff.NewExponentialBackOff()
+	expBackoff.InitialInterval = s.initialInterval
+	expBackoff.MaxInterval = 5 * time.Second
+
+	_, err = backoff.Retry(
+		ctx,
+		func() (struct{}, error) {
+			return struct{}{}, s.doRequest(ctx, endpoint, body)
+		},
+		backoff.WithBackOff(expBackoff),
+		backoff.WithMaxTries(s.maxTries),
+		backoff.WithMaxElapsedTime(s.maxElapsed),
+	)
+	return err
+}
+
+func (s *Sender) doRequest(
+	ctx context.Context,
+	endpoint string,
+	body []byte,
+) error {
+	req, err := http.NewRequestWithContext(
+		ctx,
+		http.MethodPost,
+		endpoint,
+		bytes.NewReader(body),
+	)
+	if err != nil {
+		return backoff.Permanent(
+			fmt.Errorf("telegram: build request: %w", err),
+		)
+	}
+	req.Header.Set("Content-Type", contentTypeJSON)
+
+	resp, err := s.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("telegram: do request: %w", err)
+	}
+	defer func() {
+		if cErr := resp.Body.Close(); cErr != nil {
+			slog.WarnContext(ctx, "telegram: close body",
+				"error", cErr)
+		}
+	}()
+
+	respBody, rErr := io.ReadAll(io.LimitReader(resp.Body, 4096))
+	if rErr != nil {
+		slog.WarnContext(ctx, "telegram: read body", "error", rErr)
+	}
+
+	switch {
+	case resp.StatusCode >= 200 && resp.StatusCode < 300:
+		return nil
+	case resp.StatusCode >= 400 && resp.StatusCode < 500:
+		return backoff.Permanent(fmt.Errorf(
+			"%w: status=%d body=%s",
+			ErrTelegramAPI, resp.StatusCode, string(respBody),
+		))
+	default:
+		return fmt.Errorf(
+			"%w: status=%d body=%s",
+			ErrTelegramAPI, resp.StatusCode, string(respBody),
+		)
+	}
+}
+
+func buildMessage(
+	info event.NotifyInfo,
+	evt *event.Event,
+	manageURL string,
+) string {
+	var b strings.Builder
+	b.WriteString("🚨 *Canary triggered:* ")
+	b.WriteString(EscapeMD(info.Memo))
+	b.WriteString("\n\n*Type:* ")
+	b.WriteString(EscapeMD(info.Type))
+	b.WriteString("\n*From:* ")
+	b.WriteString(EscapeMD(evt.SourceIP))
+	if loc := formatGeo(evt); loc != "" {
+		b.WriteString(" ")
+		b.WriteString(loc)
+	}
+	b.WriteString("\n*Time:* ")
+	b.WriteString(EscapeMD(evt.TriggeredAt.UTC().Format(time.RFC3339)))
+	if evt.UserAgent != nil && *evt.UserAgent != "" {
+		b.WriteString("\n*UA:* ")
+		b.WriteString(EscapeMD(truncateRunes(*evt.UserAgent, uaTruncateRunes)))
+	}
+	if manageURL != "" && info.ManageID != "" {
+		b.WriteString("\n\n[View full event timeline](")
+		b.WriteString(manageURL + "/m/" + info.ManageID)
+		b.WriteString(")")
+	}
+	return b.String()
+}
+
+func formatGeo(evt *event.Event) string {
+	city := derefStr(evt.GeoCity)
+	country := derefStr(evt.GeoCountry)
+	asnOrg := derefStr(evt.GeoASNOrg)
+
+	var parens string
+	switch {
+	case city != "" && country != "":
+		parens = `\(` + EscapeMD(city) + ", " + EscapeMD(country) + `\)`
+	case country != "":
+		parens = `\(` + EscapeMD(country) + `\)`
+	case city != "":
+		parens = `\(` + EscapeMD(city) + `\)`
+	}
+	if parens == "" && asnOrg == "" {
+		return ""
+	}
+	if asnOrg == "" {
+		return parens
+	}
+	if parens == "" {
+		return "— " + EscapeMD(asnOrg)
+	}
+	return parens + " — " + EscapeMD(asnOrg)
+}
+
+func derefStr(s *string) string {
+	if s == nil {
+		return ""
+	}
+	return *s
+}
+
+func truncateRunes(s string, max int) string {
+	if max <= 0 {
+		return ""
+	}
+	r := []rune(s)
+	if len(r) <= max {
+		return s
+	}
+	return string(r[:max])
+}
+
+func EscapeMD(s string) string {
+	var b strings.Builder
+	b.Grow(len(s) + 8)
+	for _, r := range s {
+		if strings.ContainsRune(v2SpecialChars, r) {
+			b.WriteRune('\\')
+		}
+		b.WriteRune(r)
+	}
+	return b.String()
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/notify/telegram/sender_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/notify/telegram/sender_test.go
new file mode 100644
index 00000000..02411320
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/notify/telegram/sender_test.go
@@ -0,0 +1,391 @@
+// ©AngelaMos | 2026
+// sender_test.go
+
+package telegram_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/notify/telegram"
+)
+
+const (
+	testBotToken = "111222:ABCDEFG"
+	testChatID   = "98765"
+	testMemo     = "prod-db-creds"
+	testTokenID  = "tokabc123def"
+	testManageID = "11111111-2222-3333-4444-555555555555"
+)
+
+func sampleInfo() event.NotifyInfo {
+	return event.NotifyInfo{
+		TokenID:      testTokenID,
+		ManageID:     testManageID,
+		Type:         "envfile",
+		Memo:         testMemo,
+		AlertChannel: "telegram",
+		TelegramBot:  testBotToken,
+		TelegramChat: testChatID,
+	}
+}
+
+func sampleEvent() *event.Event {
+	ua := "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
+	city := "Toronto"
+	country := "CA"
+	asnOrg := "Cloudflare, Inc."
+	return &event.Event{
+		ID:          42,
+		TokenID:     testTokenID,
+		TriggeredAt: time.Date(2026, 5, 14, 12, 30, 0, 0, time.UTC),
+		SourceIP:    "203.0.113.45",
+		UserAgent:   &ua,
+		GeoCity:     &city,
+		GeoCountry:  &country,
+		GeoASNOrg:   &asnOrg,
+	}
+}
+
+type capture struct {
+	calls    atomic.Int32
+	lastURL  atomic.Value
+	lastBody atomic.Value
+}
+
+func writeOK(t *testing.T, w http.ResponseWriter) {
+	t.Helper()
+	w.WriteHeader(http.StatusOK)
+	if _, err := w.Write([]byte(`{"ok":true}`)); err != nil {
+		t.Logf("write: %v", err)
+	}
+}
+
+func newCaptureServer(
+	t *testing.T,
+	handler http.HandlerFunc,
+) (*httptest.Server, *capture) {
+	t.Helper()
+	c := &capture{}
+	srv := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			c.calls.Add(1)
+			c.lastURL.Store(r.URL.String())
+			body, err := io.ReadAll(r.Body)
+			if err != nil {
+				t.Logf("read body: %v", err)
+				return
+			}
+			c.lastBody.Store(body)
+			handler(w, r)
+		}),
+	)
+	t.Cleanup(srv.Close)
+	return srv, c
+}
+
+func loadBody(t *testing.T, c *capture) []byte {
+	t.Helper()
+	raw, ok := c.lastBody.Load().([]byte)
+	require.True(t, ok, "no body captured")
+	return raw
+}
+
+func newSender(
+	t *testing.T,
+	apiBase string,
+	opts ...telegram.Option,
+) *telegram.Sender {
+	t.Helper()
+	cfg := telegram.Config{
+		APIBase:   apiBase,
+		ManageURL: "https://canary.example.com",
+	}
+	for _, o := range opts {
+		o(&cfg)
+	}
+	return telegram.NewSender(cfg)
+}
+
+func TestSender_Channel(t *testing.T) {
+	t.Parallel()
+	s := newSender(t, "https://api.telegram.org")
+	require.Equal(t, "telegram", s.Channel())
+}
+
+func TestSender_Send_PostsToCorrectURL(t *testing.T) {
+	t.Parallel()
+	srv, cap := newCaptureServer(
+		t,
+		func(w http.ResponseWriter, _ *http.Request) { writeOK(t, w) },
+	)
+	s := newSender(t, srv.URL)
+
+	require.NoError(
+		t,
+		s.Send(context.Background(), sampleInfo(), sampleEvent()),
+	)
+	require.Equal(t, int32(1), cap.calls.Load())
+	require.Equal(t, "/bot"+testBotToken+"/sendMessage", cap.lastURL.Load())
+}
+
+func TestSender_Send_BodyShape(t *testing.T) {
+	t.Parallel()
+	srv, cap := newCaptureServer(
+		t,
+		func(w http.ResponseWriter, _ *http.Request) { writeOK(t, w) },
+	)
+	s := newSender(t, srv.URL)
+
+	require.NoError(
+		t,
+		s.Send(context.Background(), sampleInfo(), sampleEvent()),
+	)
+
+	var body map[string]string
+	require.NoError(t, json.Unmarshal(loadBody(t, cap), &body))
+	require.Equal(t, testChatID, body["chat_id"])
+	require.Equal(t, "MarkdownV2", body["parse_mode"])
+	require.NotEmpty(t, body["text"])
+}
+
+func TestSender_Send_MessageContainsKeyFields(t *testing.T) {
+	t.Parallel()
+	srv, cap := newCaptureServer(
+		t,
+		func(w http.ResponseWriter, _ *http.Request) { writeOK(t, w) },
+	)
+	s := newSender(t, srv.URL)
+
+	require.NoError(
+		t,
+		s.Send(context.Background(), sampleInfo(), sampleEvent()),
+	)
+
+	var body map[string]string
+	require.NoError(t, json.Unmarshal(loadBody(t, cap), &body))
+	text := body["text"]
+
+	require.Contains(t, text, "Canary triggered")
+	require.Contains(
+		t,
+		text,
+		`prod\-db\-creds`,
+		"memo escaped (- is V2 special)",
+	)
+	require.Contains(t, text, "envfile")
+	require.Contains(t, text, `203\.0\.113\.45`, "IP dots escaped")
+	require.Contains(t,
+		text,
+		`\(Toronto, CA\)`,
+		"geo wrapping parens escaped (V2 reserved chars)",
+	)
+	require.Contains(t, text, `Cloudflare, Inc\.`, "asn_org . escaped")
+	require.Contains(t, text, "View full event timeline", "manage link present")
+	require.Contains(t,
+		text,
+		"https://canary.example.com/m/"+testManageID,
+		"manage URL present in link",
+	)
+}
+
+func TestSender_Send_TruncatesUserAgentTo80Chars(t *testing.T) {
+	t.Parallel()
+	srv, cap := newCaptureServer(
+		t,
+		func(w http.ResponseWriter, _ *http.Request) { writeOK(t, w) },
+	)
+	s := newSender(t, srv.URL)
+
+	longUA := strings.Repeat("X", 200)
+	evt := sampleEvent()
+	evt.UserAgent = &longUA
+
+	require.NoError(t, s.Send(context.Background(), sampleInfo(), evt))
+
+	var body map[string]string
+	require.NoError(t, json.Unmarshal(loadBody(t, cap), &body))
+	require.Contains(t, body["text"], strings.Repeat("X", 80))
+	require.NotContains(t, body["text"], strings.Repeat("X", 81),
+		"user agent should be truncated to 80 chars")
+}
+
+func TestSender_Send_HandlesNilGeoAndUA(t *testing.T) {
+	t.Parallel()
+	srv, cap := newCaptureServer(
+		t,
+		func(w http.ResponseWriter, _ *http.Request) { writeOK(t, w) },
+	)
+	s := newSender(t, srv.URL)
+
+	evt := &event.Event{
+		ID:          1,
+		TokenID:     testTokenID,
+		TriggeredAt: time.Date(2026, 5, 14, 12, 30, 0, 0, time.UTC),
+		SourceIP:    "203.0.113.45",
+	}
+	require.NoError(t, s.Send(context.Background(), sampleInfo(), evt))
+
+	var body map[string]string
+	require.NoError(t, json.Unmarshal(loadBody(t, cap), &body))
+	require.Contains(t, body["text"], `203\.0\.113\.45`)
+}
+
+func TestSender_Send_EmptyBotReturnsConfigErr(t *testing.T) {
+	t.Parallel()
+	s := newSender(t, "http://unused.test")
+	info := sampleInfo()
+	info.TelegramBot = ""
+	err := s.Send(context.Background(), info, sampleEvent())
+	require.ErrorIs(t, err, telegram.ErrChannelNotConfigured)
+}
+
+func TestSender_Send_EmptyChatReturnsConfigErr(t *testing.T) {
+	t.Parallel()
+	s := newSender(t, "http://unused.test")
+	info := sampleInfo()
+	info.TelegramChat = ""
+	err := s.Send(context.Background(), info, sampleEvent())
+	require.ErrorIs(t, err, telegram.ErrChannelNotConfigured)
+}
+
+func TestSender_Send_RetriesOn5xxThenSucceeds(t *testing.T) {
+	t.Parallel()
+	var attempts atomic.Int32
+	srv := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			n := attempts.Add(1)
+			if n == 1 {
+				w.WriteHeader(http.StatusInternalServerError)
+				return
+			}
+			writeOK(t, w)
+		}),
+	)
+	t.Cleanup(srv.Close)
+
+	s := newSender(t, srv.URL,
+		telegram.WithMaxTries(3),
+		telegram.WithMaxElapsed(2*time.Second),
+		telegram.WithInitialInterval(5*time.Millisecond),
+	)
+	require.NoError(
+		t,
+		s.Send(context.Background(), sampleInfo(), sampleEvent()),
+	)
+	require.Equal(t, int32(2), attempts.Load())
+}
+
+func TestSender_Send_PermanentOn4xx(t *testing.T) {
+	t.Parallel()
+	var attempts atomic.Int32
+	srv := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			attempts.Add(1)
+			w.WriteHeader(http.StatusBadRequest)
+			if _, err := w.Write(
+				[]byte(`{"ok":false,"description":"chat not found"}`),
+			); err != nil {
+				t.Logf("write: %v", err)
+			}
+		}),
+	)
+	t.Cleanup(srv.Close)
+
+	s := newSender(t, srv.URL,
+		telegram.WithMaxTries(5),
+		telegram.WithInitialInterval(5*time.Millisecond),
+	)
+	err := s.Send(context.Background(), sampleInfo(), sampleEvent())
+	require.Error(t, err)
+	require.Equal(t, int32(1), attempts.Load(), "no retry on 4xx")
+}
+
+func TestSender_Send_AbortsAfterMaxTries(t *testing.T) {
+	t.Parallel()
+	var attempts atomic.Int32
+	srv := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			attempts.Add(1)
+			w.WriteHeader(http.StatusServiceUnavailable)
+		}),
+	)
+	t.Cleanup(srv.Close)
+
+	s := newSender(t, srv.URL,
+		telegram.WithMaxTries(3),
+		telegram.WithMaxElapsed(5*time.Second),
+		telegram.WithInitialInterval(2*time.Millisecond),
+	)
+	err := s.Send(context.Background(), sampleInfo(), sampleEvent())
+	require.Error(t, err)
+	require.Equal(t, int32(3), attempts.Load())
+}
+
+func TestSender_Send_RespectsContextCancel(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(
+		http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
+			time.Sleep(2 * time.Second)
+		}),
+	)
+	t.Cleanup(srv.Close)
+
+	s := newSender(t, srv.URL,
+		telegram.WithMaxTries(3),
+		telegram.WithInitialInterval(5*time.Millisecond),
+	)
+	ctx, cancel := context.WithTimeout(
+		context.Background(),
+		100*time.Millisecond,
+	)
+	defer cancel()
+
+	err := s.Send(ctx, sampleInfo(), sampleEvent())
+	require.Error(t, err)
+	require.True(t,
+		errors.Is(err, context.DeadlineExceeded) ||
+			errors.Is(err, context.Canceled),
+		"expected context error, got %v", err,
+	)
+}
+
+func TestEscapeMD(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		in, want string
+	}{
+		{"plain", "plain"},
+		{"a.b", `a\.b`},
+		{"a-b", `a\-b`},
+		{"file.txt", `file\.txt`},
+		{"203.0.113.45", `203\.0\.113\.45`},
+		{"hello!", `hello\!`},
+		{"a_b*c", `a\_b\*c`},
+		{"(parens)", `\(parens\)`},
+		{"[bracket]", `\[bracket\]`},
+		{"~tilde~", `\~tilde\~`},
+		{"`code`", "\\`code\\`"},
+		{"a>b<c", `a\>b<c`},
+		{"a#b", `a\#b`},
+		{"a+b=c", `a\+b\=c`},
+		{"a|b{c}d", `a\|b\{c\}d`},
+		{"unicode—em", "unicode—em"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.in, func(t *testing.T) {
+			require.Equal(t, tc.want, telegram.EscapeMD(tc.in))
+		})
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/notify/types.go b/PROJECTS/beginner/canary-token-generator/backend/internal/notify/types.go
new file mode 100644
index 00000000..0e777303
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/notify/types.go
@@ -0,0 +1,29 @@
+// ©AngelaMos | 2026
+// types.go
+
+package notify
+
+import (
+	"context"
+	"time"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+)
+
+type Sender interface {
+	Channel() string
+	Send(
+		ctx context.Context,
+		info event.NotifyInfo,
+		evt *event.Event,
+	) error
+}
+
+type StatusWriter interface {
+	UpdateNotifyStatus(
+		ctx context.Context,
+		eventID int64,
+		status event.NotifyStatus,
+		sentAt *time.Time,
+	) error
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/notify/webhook/sender.go b/PROJECTS/beginner/canary-token-generator/backend/internal/notify/webhook/sender.go
new file mode 100644
index 00000000..3abc2820
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/notify/webhook/sender.go
@@ -0,0 +1,438 @@
+// ©AngelaMos | 2026
+// sender.go
+
+package webhook
+
+import (
+	"bytes"
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/cenkalti/backoff/v5"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+)
+
+const (
+	Channel = "webhook"
+
+	envelopeVersion = "1"
+	envelopeEvent   = "canary.triggered"
+
+	defaultMaxTries        = 3
+	defaultMaxElapsed      = 30 * time.Second
+	defaultInitialInterval = 500 * time.Millisecond
+	defaultOverallTimeout  = 10 * time.Second
+	defaultDialTimeout     = 5 * time.Second
+
+	contentTypeJSON     = "application/json"
+	signatureHeaderName = "X-Canary-Signature"
+	signaturePrefix     = "sha256="
+)
+
+var (
+	ErrChannelNotConfigured = errors.New(
+		"webhook: webhook URL not configured",
+	)
+	ErrInvalidWebhookURL = errors.New("webhook: invalid url")
+	ErrBlockedHost       = errors.New(
+		"webhook: host resolves to a blocked address range",
+	)
+	ErrWebhookAPI = errors.New("webhook: api error")
+)
+
+type Config struct {
+	ManageURL         string
+	HMACSecret        string
+	HTTPClient        *http.Client
+	MaxTries          uint
+	MaxElapsed        time.Duration
+	InitialInterval   time.Duration
+	AllowPrivateHosts bool
+}
+
+type Option func(*Config)
+
+func WithMaxTries(n uint) Option { return func(c *Config) { c.MaxTries = n } }
+
+func WithMaxElapsed(d time.Duration) Option {
+	return func(c *Config) { c.MaxElapsed = d }
+}
+
+func WithInitialInterval(d time.Duration) Option {
+	return func(c *Config) { c.InitialInterval = d }
+}
+
+func WithHTTPClient(client *http.Client) Option {
+	return func(c *Config) { c.HTTPClient = client }
+}
+
+func WithAllowPrivateHosts(allow bool) Option {
+	return func(c *Config) { c.AllowPrivateHosts = allow }
+}
+
+type Sender struct {
+	manageURL         string
+	hmacSecret        string
+	httpClient        *http.Client
+	maxTries          uint
+	maxElapsed        time.Duration
+	initialInterval   time.Duration
+	allowPrivateHosts bool
+}
+
+func NewSender(cfg Config, opts ...Option) *Sender {
+	for _, o := range opts {
+		o(&cfg)
+	}
+	if cfg.HTTPClient == nil {
+		cfg.HTTPClient = defaultHTTPClient(cfg.AllowPrivateHosts)
+	}
+	if cfg.MaxTries == 0 {
+		cfg.MaxTries = defaultMaxTries
+	}
+	if cfg.MaxElapsed == 0 {
+		cfg.MaxElapsed = defaultMaxElapsed
+	}
+	if cfg.InitialInterval == 0 {
+		cfg.InitialInterval = defaultInitialInterval
+	}
+	return &Sender{
+		manageURL:         strings.TrimRight(cfg.ManageURL, "/"),
+		hmacSecret:        cfg.HMACSecret,
+		httpClient:        cfg.HTTPClient,
+		maxTries:          cfg.MaxTries,
+		maxElapsed:        cfg.MaxElapsed,
+		initialInterval:   cfg.InitialInterval,
+		allowPrivateHosts: cfg.AllowPrivateHosts,
+	}
+}
+
+func defaultHTTPClient(allowPrivateHosts bool) *http.Client {
+	base := &net.Dialer{Timeout: defaultDialTimeout}
+	dialFn := base.DialContext
+	if !allowPrivateHosts {
+		dialFn = func(
+			ctx context.Context,
+			network, addr string,
+		) (net.Conn, error) {
+			if err := preDialIPCheck(addr); err != nil {
+				return nil, err
+			}
+			conn, err := base.DialContext(ctx, network, addr)
+			if err != nil {
+				return nil, err
+			}
+			if err := postDialIPCheck(conn); err != nil {
+				if cErr := conn.Close(); cErr != nil {
+					slog.Warn("webhook: close blocked conn",
+						"error", cErr)
+				}
+				return nil, err
+			}
+			return conn, nil
+		}
+	}
+	return &http.Client{
+		Timeout: defaultOverallTimeout,
+		Transport: &http.Transport{
+			DialContext:           dialFn,
+			TLSHandshakeTimeout:   defaultDialTimeout,
+			ResponseHeaderTimeout: defaultOverallTimeout,
+			ExpectContinueTimeout: time.Second,
+			IdleConnTimeout:       30 * time.Second,
+		},
+	}
+}
+
+func preDialIPCheck(addr string) error {
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		return fmt.Errorf("webhook: split host port: %w", err)
+	}
+	ip := net.ParseIP(host)
+	if ip == nil {
+		return nil
+	}
+	if isBlockedIP(ip) {
+		return fmt.Errorf("%w: dial blocked %s", ErrBlockedHost, ip)
+	}
+	return nil
+}
+
+func postDialIPCheck(conn net.Conn) error {
+	tcpAddr, ok := conn.RemoteAddr().(*net.TCPAddr)
+	if !ok {
+		return nil
+	}
+	if isBlockedIP(tcpAddr.IP) {
+		return fmt.Errorf("%w: dial blocked %s", ErrBlockedHost, tcpAddr.IP)
+	}
+	return nil
+}
+
+func (s *Sender) Channel() string { return Channel }
+
+func (s *Sender) Validate(raw string) error {
+	return validateURL(raw, s.allowPrivateHosts)
+}
+
+func (s *Sender) Send(
+	ctx context.Context,
+	info event.NotifyInfo,
+	evt *event.Event,
+) error {
+	if strings.TrimSpace(info.WebhookURL) == "" {
+		return ErrChannelNotConfigured
+	}
+	if err := validateURL(info.WebhookURL, s.allowPrivateHosts); err != nil {
+		return err
+	}
+
+	body, err := json.Marshal(buildEnvelope(info, evt, s.manageURL))
+	if err != nil {
+		return fmt.Errorf("webhook: marshal envelope: %w", err)
+	}
+
+	expBackoff := backoff.NewExponentialBackOff()
+	expBackoff.InitialInterval = s.initialInterval
+	expBackoff.MaxInterval = 5 * time.Second
+
+	_, err = backoff.Retry(
+		ctx,
+		func() (struct{}, error) {
+			return struct{}{}, s.doRequest(ctx, info.WebhookURL, body)
+		},
+		backoff.WithBackOff(expBackoff),
+		backoff.WithMaxTries(s.maxTries),
+		backoff.WithMaxElapsedTime(s.maxElapsed),
+	)
+	return err
+}
+
+func (s *Sender) doRequest(
+	ctx context.Context,
+	endpoint string,
+	body []byte,
+) error {
+	req, err := http.NewRequestWithContext(
+		ctx,
+		http.MethodPost,
+		endpoint,
+		bytes.NewReader(body),
+	)
+	if err != nil {
+		return backoff.Permanent(
+			fmt.Errorf("webhook: build request: %w", err),
+		)
+	}
+	req.Header.Set("Content-Type", contentTypeJSON)
+	if s.hmacSecret != "" {
+		req.Header.Set(
+			signatureHeaderName,
+			computeSignature(s.hmacSecret, body),
+		)
+	}
+
+	resp, err := s.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("webhook: do request: %w", err)
+	}
+	defer func() {
+		if cErr := resp.Body.Close(); cErr != nil {
+			slog.WarnContext(ctx, "webhook: close body",
+				"error", cErr)
+		}
+	}()
+
+	respBody, rErr := io.ReadAll(io.LimitReader(resp.Body, 4096))
+	if rErr != nil {
+		slog.WarnContext(ctx, "webhook: read body", "error", rErr)
+	}
+
+	switch {
+	case resp.StatusCode >= 200 && resp.StatusCode < 300:
+		return nil
+	case resp.StatusCode >= 400 && resp.StatusCode < 500:
+		return backoff.Permanent(fmt.Errorf(
+			"%w: status=%d body=%s",
+			ErrWebhookAPI, resp.StatusCode, string(respBody),
+		))
+	default:
+		return fmt.Errorf(
+			"%w: status=%d body=%s",
+			ErrWebhookAPI, resp.StatusCode, string(respBody),
+		)
+	}
+}
+
+func validateURL(raw string, allowPrivateHosts bool) error {
+	u, err := url.Parse(raw)
+	if err != nil {
+		return fmt.Errorf("%w: parse: %w", ErrInvalidWebhookURL, err)
+	}
+	scheme := strings.ToLower(u.Scheme)
+	if scheme != "http" && scheme != "https" {
+		return fmt.Errorf(
+			"%w: scheme must be http or https, got %q",
+			ErrInvalidWebhookURL, u.Scheme,
+		)
+	}
+	if u.Host == "" {
+		return fmt.Errorf("%w: missing host", ErrInvalidWebhookURL)
+	}
+	if u.User != nil {
+		return fmt.Errorf("%w: userinfo not allowed", ErrInvalidWebhookURL)
+	}
+	if allowPrivateHosts {
+		return nil
+	}
+	host := u.Hostname()
+	if host == "" {
+		return fmt.Errorf("%w: missing hostname", ErrInvalidWebhookURL)
+	}
+	if ip := net.ParseIP(host); ip != nil {
+		if isBlockedIP(ip) {
+			return fmt.Errorf("%w: %s", ErrBlockedHost, ip)
+		}
+		return nil
+	}
+	ips, lookupErr := net.LookupIP(host)
+	if lookupErr != nil {
+		return fmt.Errorf(
+			"%w: lookup %s: %w",
+			ErrInvalidWebhookURL, host, lookupErr,
+		)
+	}
+	if len(ips) == 0 {
+		return fmt.Errorf("%w: no IPs for %s", ErrInvalidWebhookURL, host)
+	}
+	for _, ip := range ips {
+		if isBlockedIP(ip) {
+			return fmt.Errorf("%w: %s -> %s", ErrBlockedHost, host, ip)
+		}
+	}
+	return nil
+}
+
+func isBlockedIP(ip net.IP) bool {
+	if ip == nil {
+		return true
+	}
+	if ip.IsLoopback() || ip.IsLinkLocalUnicast() ||
+		ip.IsLinkLocalMulticast() || ip.IsMulticast() ||
+		ip.IsUnspecified() {
+		return true
+	}
+	if ip4 := ip.To4(); ip4 != nil {
+		switch {
+		case ip4[0] == 10:
+			return true
+		case ip4[0] == 172 && ip4[1] >= 16 && ip4[1] <= 31:
+			return true
+		case ip4[0] == 192 && ip4[1] == 168:
+			return true
+		case ip4[0] == 100 && ip4[1] >= 64 && ip4[1] <= 127:
+			return true
+		case ip4[0] == 169 && ip4[1] == 254:
+			return true
+		}
+		return false
+	}
+	if len(ip) == net.IPv6len && ip[0]&0xfe == 0xfc {
+		return true
+	}
+	return false
+}
+
+type envelope struct {
+	Version string         `json:"version"`
+	Event   string         `json:"event"`
+	Token   tokenSection   `json:"token"`
+	Trigger triggerSection `json:"trigger"`
+}
+
+type tokenSection struct {
+	ID        string `json:"id"`
+	Type      string `json:"type"`
+	Memo      string `json:"memo"`
+	ManageURL string `json:"manage_url"`
+}
+
+type triggerSection struct {
+	TriggeredAt time.Time       `json:"triggered_at"`
+	SourceIP    string          `json:"source_ip"`
+	UserAgent   string          `json:"user_agent"`
+	Geo         geoSection      `json:"geo"`
+	Extra       json.RawMessage `json:"extra"`
+}
+
+type geoSection struct {
+	Country string `json:"country"`
+	City    string `json:"city"`
+	ASNOrg  string `json:"asn_org"`
+}
+
+func buildEnvelope(
+	info event.NotifyInfo,
+	evt *event.Event,
+	manageURL string,
+) envelope {
+	extra := evt.Extra
+	if len(extra) == 0 {
+		extra = json.RawMessage(`{}`)
+	}
+	return envelope{
+		Version: envelopeVersion,
+		Event:   envelopeEvent,
+		Token: tokenSection{
+			ID:        info.TokenID,
+			Type:      info.Type,
+			Memo:      info.Memo,
+			ManageURL: buildManageURL(manageURL, info.ManageID),
+		},
+		Trigger: triggerSection{
+			TriggeredAt: evt.TriggeredAt.UTC(),
+			SourceIP:    evt.SourceIP,
+			UserAgent:   derefStr(evt.UserAgent),
+			Geo: geoSection{
+				Country: derefStr(evt.GeoCountry),
+				City:    derefStr(evt.GeoCity),
+				ASNOrg:  derefStr(evt.GeoASNOrg),
+			},
+			Extra: extra,
+		},
+	}
+}
+
+func buildManageURL(base, id string) string {
+	if base == "" || id == "" {
+		return ""
+	}
+	return base + "/m/" + id
+}
+
+func derefStr(s *string) string {
+	if s == nil {
+		return ""
+	}
+	return *s
+}
+
+func computeSignature(secret string, body []byte) string {
+	mac := hmac.New(sha256.New, []byte(secret))
+	mac.Write(body)
+	return signaturePrefix + hex.EncodeToString(mac.Sum(nil))
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/notify/webhook/sender_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/notify/webhook/sender_test.go
new file mode 100644
index 00000000..f2d53e7c
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/notify/webhook/sender_test.go
@@ -0,0 +1,435 @@
+// ©AngelaMos | 2026
+// sender_test.go
+
+package webhook_test
+
+import (
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/notify/webhook"
+)
+
+const (
+	testTokenID  = "tokwh01abcde"
+	testManageID = "abcd1111-2222-3333-4444-555555555555"
+)
+
+func sampleEvent() *event.Event {
+	ua := "TestUA/1.0"
+	city := "Toronto"
+	country := "CA"
+	asnOrg := "Test, Inc."
+	asn := 12345
+	return &event.Event{
+		ID:          7,
+		TokenID:     testTokenID,
+		TriggeredAt: time.Date(2026, 5, 14, 12, 30, 0, 0, time.UTC),
+		SourceIP:    "203.0.113.45",
+		UserAgent:   &ua,
+		GeoCity:     &city,
+		GeoCountry:  &country,
+		GeoASN:      &asn,
+		GeoASNOrg:   &asnOrg,
+		Extra:       json.RawMessage(`{"custom":"value"}`),
+	}
+}
+
+func sampleInfo(webhookURL string) event.NotifyInfo {
+	return event.NotifyInfo{
+		TokenID:      testTokenID,
+		ManageID:     testManageID,
+		Type:         "envfile",
+		Memo:         "prod-creds",
+		AlertChannel: "webhook",
+		WebhookURL:   webhookURL,
+	}
+}
+
+type capture struct {
+	calls    atomic.Int32
+	lastBody atomic.Value
+	lastSig  atomic.Value
+}
+
+func newCaptureServer(
+	t *testing.T,
+	handler http.HandlerFunc,
+) (*httptest.Server, *capture) {
+	t.Helper()
+	c := &capture{}
+	srv := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			c.calls.Add(1)
+			body, err := io.ReadAll(r.Body)
+			if err != nil {
+				t.Logf("read body: %v", err)
+				return
+			}
+			c.lastBody.Store(body)
+			c.lastSig.Store(r.Header.Get("X-Canary-Signature"))
+			handler(w, r)
+		}),
+	)
+	t.Cleanup(srv.Close)
+	return srv, c
+}
+
+func loadBody(t *testing.T, c *capture) []byte {
+	t.Helper()
+	raw, ok := c.lastBody.Load().([]byte)
+	require.True(t, ok, "no body captured")
+	return raw
+}
+
+func newSender(t *testing.T, opts ...webhook.Option) *webhook.Sender {
+	t.Helper()
+	return webhook.NewSender(webhook.Config{
+		ManageURL:         "https://canary.example.com",
+		AllowPrivateHosts: true,
+	}, opts...)
+}
+
+func newStrictSender(t *testing.T) *webhook.Sender {
+	t.Helper()
+	return webhook.NewSender(webhook.Config{
+		ManageURL: "https://canary.example.com",
+	})
+}
+
+func TestSender_Channel(t *testing.T) {
+	t.Parallel()
+	require.Equal(t, "webhook", newSender(t).Channel())
+}
+
+func TestSender_Send_PostsToProvidedURL(t *testing.T) {
+	t.Parallel()
+	srv, cap := newCaptureServer(
+		t,
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusNoContent)
+		},
+	)
+	s := newSender(t)
+	require.NoError(
+		t,
+		s.Send(context.Background(), sampleInfo(srv.URL), sampleEvent()),
+	)
+	require.Equal(t, int32(1), cap.calls.Load())
+}
+
+func TestSender_Send_BodyEnvelopeShape(t *testing.T) {
+	t.Parallel()
+	srv, cap := newCaptureServer(
+		t,
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusOK)
+		},
+	)
+	s := newSender(t)
+	require.NoError(
+		t,
+		s.Send(context.Background(), sampleInfo(srv.URL), sampleEvent()),
+	)
+
+	var env map[string]any
+	require.NoError(t, json.Unmarshal(loadBody(t, cap), &env))
+
+	require.Equal(t, "1", env["version"])
+	require.Equal(t, "canary.triggered", env["event"])
+
+	tok, ok := env["token"].(map[string]any)
+	require.True(t, ok)
+	require.Equal(t, testTokenID, tok["id"])
+	require.Equal(t, "envfile", tok["type"])
+	require.Equal(t, "prod-creds", tok["memo"])
+	require.Equal(
+		t,
+		"https://canary.example.com/m/"+testManageID,
+		tok["manage_url"],
+	)
+
+	trig, ok := env["trigger"].(map[string]any)
+	require.True(t, ok)
+	require.Equal(t, "203.0.113.45", trig["source_ip"])
+	require.Equal(t, "TestUA/1.0", trig["user_agent"])
+	require.NotEmpty(t, trig["triggered_at"])
+
+	geo, ok := trig["geo"].(map[string]any)
+	require.True(t, ok)
+	require.Equal(t, "CA", geo["country"])
+	require.Equal(t, "Toronto", geo["city"])
+	require.Equal(t, "Test, Inc.", geo["asn_org"])
+
+	extra, ok := trig["extra"].(map[string]any)
+	require.True(t, ok)
+	require.Equal(t, "value", extra["custom"])
+}
+
+func TestSender_Send_NoSignatureWithoutSecret(t *testing.T) {
+	t.Parallel()
+	srv, cap := newCaptureServer(
+		t,
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusOK)
+		},
+	)
+	s := newSender(t)
+	require.NoError(
+		t,
+		s.Send(context.Background(), sampleInfo(srv.URL), sampleEvent()),
+	)
+	require.Empty(t, cap.lastSig.Load())
+}
+
+func TestSender_Send_HMACSignatureWhenSecretSet(t *testing.T) {
+	t.Parallel()
+	const secret = "topsecret"
+	srv, cap := newCaptureServer(
+		t,
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusOK)
+		},
+	)
+	s := webhook.NewSender(webhook.Config{
+		ManageURL:         "https://canary.example.com",
+		HMACSecret:        secret,
+		AllowPrivateHosts: true,
+	})
+	require.NoError(
+		t,
+		s.Send(context.Background(), sampleInfo(srv.URL), sampleEvent()),
+	)
+
+	body := loadBody(t, cap)
+	mac := hmac.New(sha256.New, []byte(secret))
+	if _, err := mac.Write(body); err != nil {
+		t.Fatal(err)
+	}
+	want := "sha256=" + hex.EncodeToString(mac.Sum(nil))
+
+	require.Equal(t, want, cap.lastSig.Load())
+}
+
+func TestSender_Send_EmptyURLReturnsConfigErr(t *testing.T) {
+	t.Parallel()
+	s := newSender(t)
+	err := s.Send(context.Background(), sampleInfo(""), sampleEvent())
+	require.ErrorIs(t, err, webhook.ErrChannelNotConfigured)
+}
+
+func TestSender_Send_RejectsNonHTTPScheme(t *testing.T) {
+	t.Parallel()
+	cases := []string{
+		"ftp://example.com/hook",
+		"file:///etc/passwd",
+		"javascript:alert(1)",
+		"not-a-url",
+	}
+	for _, u := range cases {
+		t.Run(u, func(t *testing.T) {
+			s := newSender(t)
+			err := s.Send(context.Background(), sampleInfo(u), sampleEvent())
+			require.ErrorIs(t, err, webhook.ErrInvalidWebhookURL)
+		})
+	}
+}
+
+func TestSender_Send_RejectsURLWithoutHost(t *testing.T) {
+	t.Parallel()
+	s := newSender(t)
+	err := s.Send(
+		context.Background(),
+		sampleInfo("http:///nohost"),
+		sampleEvent(),
+	)
+	require.ErrorIs(t, err, webhook.ErrInvalidWebhookURL)
+}
+
+func TestSender_Send_RejectsURLWithUserInfo(t *testing.T) {
+	t.Parallel()
+	s := newSender(t)
+	err := s.Send(
+		context.Background(),
+		sampleInfo("https://user:pass@example.com/h"),
+		sampleEvent(),
+	)
+	require.ErrorIs(t, err, webhook.ErrInvalidWebhookURL)
+}
+
+func TestSender_Send_RetriesOn5xxThenSucceeds(t *testing.T) {
+	t.Parallel()
+	var attempts atomic.Int32
+	srv := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			n := attempts.Add(1)
+			if n == 1 {
+				w.WriteHeader(http.StatusBadGateway)
+				return
+			}
+			w.WriteHeader(http.StatusOK)
+		}),
+	)
+	t.Cleanup(srv.Close)
+	s := newSender(t,
+		webhook.WithMaxTries(3),
+		webhook.WithMaxElapsed(2*time.Second),
+		webhook.WithInitialInterval(5*time.Millisecond),
+	)
+	require.NoError(
+		t,
+		s.Send(context.Background(), sampleInfo(srv.URL), sampleEvent()),
+	)
+	require.Equal(t, int32(2), attempts.Load())
+}
+
+func TestSender_Send_PermanentOn4xx(t *testing.T) {
+	t.Parallel()
+	var attempts atomic.Int32
+	srv := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			attempts.Add(1)
+			w.WriteHeader(http.StatusForbidden)
+		}),
+	)
+	t.Cleanup(srv.Close)
+	s := newSender(t,
+		webhook.WithMaxTries(5),
+		webhook.WithInitialInterval(5*time.Millisecond),
+	)
+	err := s.Send(context.Background(), sampleInfo(srv.URL), sampleEvent())
+	require.Error(t, err)
+	require.Equal(t, int32(1), attempts.Load())
+}
+
+func TestSender_Send_AbortsAfterMaxTries(t *testing.T) {
+	t.Parallel()
+	var attempts atomic.Int32
+	srv := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			attempts.Add(1)
+			w.WriteHeader(http.StatusServiceUnavailable)
+		}),
+	)
+	t.Cleanup(srv.Close)
+	s := newSender(t,
+		webhook.WithMaxTries(3),
+		webhook.WithMaxElapsed(5*time.Second),
+		webhook.WithInitialInterval(2*time.Millisecond),
+	)
+	err := s.Send(context.Background(), sampleInfo(srv.URL), sampleEvent())
+	require.Error(t, err)
+	require.Equal(t, int32(3), attempts.Load())
+}
+
+func TestSender_Validate_BlocksPrivateHosts(t *testing.T) {
+	t.Parallel()
+	s := newStrictSender(t)
+	cases := []string{
+		"http://127.0.0.1/",
+		"http://127.0.0.1:6379/",
+		"http://10.0.0.1/",
+		"http://10.255.255.255/",
+		"http://172.16.0.1/",
+		"http://172.31.255.255/",
+		"http://192.168.1.1/",
+		"http://169.254.169.254/latest/meta-data/",
+		"http://100.64.0.1/",
+		"http://0.0.0.0/",
+		"http://[::1]/",
+		"http://[fd00::1]/",
+		"http://[fe80::1]/",
+	}
+	for _, raw := range cases {
+		raw := raw
+		t.Run(raw, func(t *testing.T) {
+			t.Parallel()
+			err := s.Validate(raw)
+			require.ErrorIsf(
+				t,
+				err,
+				webhook.ErrBlockedHost,
+				"expected ErrBlockedHost for %q",
+				raw,
+			)
+		})
+	}
+}
+
+func TestSender_Validate_AllowsPublicLiteralIPs(t *testing.T) {
+	t.Parallel()
+	s := newStrictSender(t)
+	cases := []string{
+		"https://8.8.8.8/",
+		"https://1.1.1.1/",
+		"http://203.0.113.45:8080/hook",
+		"https://[2001:db8::1]/",
+	}
+	for _, raw := range cases {
+		raw := raw
+		t.Run(raw, func(t *testing.T) {
+			t.Parallel()
+			require.NoError(t, s.Validate(raw))
+		})
+	}
+}
+
+func TestSender_Send_BlocksPrivateHostByDefault(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusOK)
+		}),
+	)
+	t.Cleanup(srv.Close)
+
+	s := newStrictSender(t)
+	err := s.Send(context.Background(), sampleInfo(srv.URL), sampleEvent())
+	require.ErrorIs(
+		t,
+		err,
+		webhook.ErrBlockedHost,
+		"strict sender must refuse to send to loopback URL",
+	)
+}
+
+func TestSender_Send_RespectsContextCancel(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(
+		http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
+			time.Sleep(2 * time.Second)
+		}),
+	)
+	t.Cleanup(srv.Close)
+	s := newSender(t,
+		webhook.WithMaxTries(3),
+		webhook.WithInitialInterval(5*time.Millisecond),
+	)
+	ctx, cancel := context.WithTimeout(
+		context.Background(),
+		100*time.Millisecond,
+	)
+	defer cancel()
+	err := s.Send(ctx, sampleInfo(srv.URL), sampleEvent())
+	require.Error(t, err)
+	require.True(
+		t,
+		errors.Is(err, context.DeadlineExceeded) ||
+			errors.Is(err, context.Canceled),
+		"expected context error, got %v",
+		err,
+	)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/server/e2e_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/server/e2e_test.go
new file mode 100644
index 00000000..f652139d
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/server/e2e_test.go
@@ -0,0 +1,469 @@
+// ©AngelaMos | 2026
+// e2e_test.go
+
+//go:build integration
+
+package server_test
+
+import (
+	"archive/zip"
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"regexp"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/alicebob/miniredis/v2"
+	"github.com/go-chi/chi/v5"
+	"github.com/jmoiron/sqlx"
+	"github.com/redis/go-redis/v9"
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/middleware"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/notify"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/testutil"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/registry"
+)
+
+const (
+	e2eBaseURL       = "https://canary.example.com"
+	e2eManageURL     = "https://canary.example.com"
+	e2eTelegramBot   = "111:AAA"
+	e2eTelegramChat  = "12345"
+	e2eMySQLPubHost  = "localhost"
+	e2eMySQLPubPort  = 3306
+	e2eClientIP      = "203.0.113.10"
+	e2eClientUA      = "E2E/1.0"
+	e2eEventualWait  = 3 * time.Second
+	e2eEventualTick  = 20 * time.Millisecond
+	e2eSendTimeout   = 2 * time.Second
+	e2eDedupTTL      = 15 * time.Minute
+)
+
+type e2eSender struct {
+	mu    sync.Mutex
+	calls []event.NotifyInfo
+}
+
+func (s *e2eSender) Channel() string { return "telegram" }
+
+func (s *e2eSender) Send(
+	_ context.Context,
+	info event.NotifyInfo,
+	_ *event.Event,
+) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.calls = append(s.calls, info)
+	return nil
+}
+
+func (s *e2eSender) count() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return len(s.calls)
+}
+
+type e2eRegistryAdapter struct{ r registry.Registry }
+
+func (a e2eRegistryAdapter) Get(
+	t token.Type,
+) (token.Generator, bool) {
+	g, ok := a.r[t]
+	return g, ok
+}
+
+type e2eRecorderAdapter struct{ svc *event.Service }
+
+func (a e2eRecorderAdapter) Record(
+	ctx context.Context,
+	t *token.Token,
+	evt *event.Event,
+) error {
+	return a.svc.Record(ctx, t.NotifyInfo(), evt)
+}
+
+type e2eStack struct {
+	router    chi.Router
+	notifySvc *notify.Service
+	sender    *e2eSender
+	eventRepo *event.Repository
+	tokenRepo *token.Repository
+}
+
+func setupE2EStack(t *testing.T) *e2eStack {
+	t.Helper()
+
+	db := sqlx.NewDb(testutil.NewTestDB(t), "pgx")
+
+	mr, err := miniredis.Run()
+	require.NoError(t, err)
+	t.Cleanup(mr.Close)
+	rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
+	t.Cleanup(func() {
+		if cErr := rdb.Close(); cErr != nil {
+			t.Logf("redis close: %v", cErr)
+		}
+	})
+
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+
+	tokenRepo := token.NewRepository(db)
+	eventRepo := event.NewRepository(db)
+	sender := &e2eSender{}
+
+	notifySvc := notify.NewService(eventRepo,
+		notify.WithLogger(logger),
+		notify.WithSendTimeout(e2eSendTimeout),
+	)
+	notifySvc.Register(sender)
+
+	eventSvc := event.NewService(
+		eventRepo,
+		tokenRepo,
+		rdb,
+		notifySvc,
+		event.ServiceConfig{
+			DedupTTL: e2eDedupTTL,
+			Logger:   logger,
+		},
+	)
+
+	genReg := registry.Build(registry.Config{
+		BaseURL:         e2eBaseURL,
+		MySQLPublicHost: e2eMySQLPubHost,
+		MySQLPublicPort: e2eMySQLPubPort,
+	})
+	tokenSvc := token.NewService(
+		tokenRepo,
+		e2eRegistryAdapter{r: genReg},
+		token.ServiceConfig{
+			BaseURL:   e2eBaseURL,
+			ManageURL: e2eManageURL,
+		},
+	)
+
+	tokenH := token.NewHandler(
+		tokenSvc,
+		e2eRecorderAdapter{svc: eventSvc},
+		nil,
+		eventRepo,
+		eventSvc,
+		logger,
+		true,
+	)
+
+	r := chi.NewRouter()
+	r.Use(middleware.RequestID)
+	r.Use(middleware.Recovery(logger))
+	tokenH.RegisterTriggerRoutes(r)
+	r.Route("/api", func(api chi.Router) {
+		api.Get("/tokens/types", tokenH.GetTypes)
+		api.Post("/tokens", tokenH.CreateToken)
+		tokenH.RegisterManageRoutes(api)
+	})
+
+	return &e2eStack{
+		router:    r,
+		notifySvc: notifySvc,
+		sender:    sender,
+		eventRepo: eventRepo,
+		tokenRepo: tokenRepo,
+	}
+}
+
+type e2eCreateResponse struct {
+	Success bool `json:"success"`
+	Data    struct {
+		Token    token.Response     `json:"token"`
+		Artifact token.ArtifactJSON `json:"artifact"`
+	} `json:"data"`
+}
+
+func createE2EToken(
+	t *testing.T,
+	st *e2eStack,
+	kind token.Type,
+	metadata string,
+) e2eCreateResponse {
+	t.Helper()
+
+	body := `{
+		"type": "` + string(kind) + `",
+		"memo": "e2e ` + string(kind) + `",
+		"alert_channel": "telegram",
+		"telegram_bot": "` + e2eTelegramBot + `",
+		"telegram_chat": "` + e2eTelegramChat + `"`
+	if metadata != "" {
+		body += `, "metadata": ` + metadata
+	}
+	body += `}`
+
+	req := httptest.NewRequest(
+		http.MethodPost,
+		"/api/tokens",
+		strings.NewReader(body),
+	)
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	st.router.ServeHTTP(w, req)
+	require.Equal(t, http.StatusCreated, w.Code, "body=%s", w.Body.String())
+
+	var resp e2eCreateResponse
+	require.NoError(t, json.NewDecoder(w.Body).Decode(&resp))
+	require.True(t, resp.Success)
+	require.NotEmpty(t, resp.Data.Token.ID)
+	return resp
+}
+
+func extractEmbeddedTriggerURL(
+	t *testing.T,
+	kind token.Type,
+	art token.ArtifactJSON,
+	tokenID string,
+) string {
+	t.Helper()
+	switch art.Kind {
+	case "url":
+		require.NotEmpty(t, art.URL)
+		return art.URL
+	case "file":
+		raw, err := base64.StdEncoding.DecodeString(art.ContentB64)
+		require.NoError(t, err)
+		if kind == token.TypeDocx {
+			return matchTriggerURLInZip(t, raw, tokenID)
+		}
+		return matchTriggerURL(t, raw, tokenID)
+	case "text":
+		return matchTriggerURL(t, []byte(art.Content), tokenID)
+	default:
+		t.Fatalf("unhandled artifact kind for HTTP trigger: %s", art.Kind)
+		return ""
+	}
+}
+
+func matchTriggerURLInZip(
+	t *testing.T,
+	raw []byte,
+	tokenID string,
+) string {
+	t.Helper()
+	r, err := zip.NewReader(bytes.NewReader(raw), int64(len(raw)))
+	require.NoError(t, err, "docx artifact must be a valid zip")
+	needle := []byte("/c/" + tokenID)
+	for _, f := range r.File {
+		rc, oErr := f.Open()
+		if oErr != nil {
+			continue
+		}
+		content, rErr := io.ReadAll(rc)
+		_ = rc.Close()
+		if rErr != nil {
+			continue
+		}
+		if bytes.Contains(content, needle) {
+			return matchTriggerURL(t, content, tokenID)
+		}
+	}
+	t.Fatalf(
+		"docx: no zip member contains /c/%s (members=%d)",
+		tokenID, len(r.File),
+	)
+	return ""
+}
+
+func matchTriggerURL(t *testing.T, raw []byte, tokenID string) string {
+	t.Helper()
+	pattern := regexp.MustCompile(
+		`https?://[A-Za-z0-9.\-:]+/(?:c|k)/` +
+			regexp.QuoteMeta(tokenID) +
+			`(?:\?[A-Za-z0-9_=&\-%.]*)?`,
+	)
+	match := pattern.Find(raw)
+	require.NotNilf(
+		t,
+		match,
+		"embedded trigger URL for token %s not found in artifact (len=%d)",
+		tokenID, len(raw),
+	)
+	return string(match)
+}
+
+func TestE2E_AllTokenTypes_CreateTriggerNotifyRecord(t *testing.T) {
+	st := setupE2EStack(t)
+
+	cases := []struct {
+		name     string
+		kind     token.Type
+		metadata string
+		httpable bool
+	}{
+		{
+			name:     "webbug",
+			kind:     token.TypeWebbug,
+			metadata: "",
+			httpable: true,
+		},
+		{
+			name:     "slowredirect",
+			kind:     token.TypeSlowRedirect,
+			metadata: `{"destination_url":"https://example.com/out"}`,
+			httpable: true,
+		},
+		{
+			name:     "docx",
+			kind:     token.TypeDocx,
+			metadata: "",
+			httpable: true,
+		},
+		{
+			name:     "pdf",
+			kind:     token.TypePDF,
+			metadata: "",
+			httpable: true,
+		},
+		{
+			name:     "kubeconfig",
+			kind:     token.TypeKubeconfig,
+			metadata: "",
+			httpable: true,
+		},
+		{
+			name:     "envfile",
+			kind:     token.TypeEnvfile,
+			metadata: `{"include_keys":["aws"]}`,
+			httpable: true,
+		},
+		{
+			name:     "mysql",
+			kind:     token.TypeMySQL,
+			metadata: "",
+			httpable: false,
+		},
+	}
+
+	var expectedNotifications int
+
+	for _, c := range cases {
+		c := c
+		t.Run(c.name, func(t *testing.T) {
+			resp := createE2EToken(t, st, c.kind, c.metadata)
+			tokenID := resp.Data.Token.ID
+
+			if c.kind == token.TypePDF {
+				raw, err := base64.StdEncoding.DecodeString(
+					resp.Data.Artifact.ContentB64,
+				)
+				require.NoError(t, err)
+				idx := bytes.Index(raw, []byte("/c/"+tokenID))
+				require.GreaterOrEqualf(
+					t,
+					idx,
+					0,
+					"PDF artifact must embed /c/<id> (id=%s)",
+					tokenID,
+				)
+				after := raw[idx+len("/c/"+tokenID)]
+				require.NotEqualf(
+					t,
+					byte('_'),
+					after,
+					"audit finding F2 regression: the byte immediately after "+
+						"the PDF-embedded /c/<id> must not be '_' — otherwise "+
+						"Acrobat fetches /c/<id>____ and the canary silently "+
+						"no-ops on lookup (id=%s, after=%q)",
+					tokenID, after,
+				)
+			}
+
+			if !c.httpable {
+				require.Equal(t, "connection_string", resp.Data.Artifact.Kind)
+				require.NotEmpty(t, resp.Data.Artifact.ConnectionString)
+				return
+			}
+
+			triggerURL := extractEmbeddedTriggerURL(
+				t,
+				c.kind,
+				resp.Data.Artifact,
+				tokenID,
+			)
+			require.NotEmpty(t, triggerURL)
+
+			trigReq := httptest.NewRequest(http.MethodGet, triggerURL, nil)
+			trigReq.Header.Set("CF-Connecting-IP", e2eClientIP)
+			trigReq.Header.Set("User-Agent", e2eClientUA)
+			tw := httptest.NewRecorder()
+			st.router.ServeHTTP(tw, trigReq)
+			require.Truef(
+				t,
+				tw.Code == http.StatusOK ||
+					tw.Code == http.StatusFound ||
+					tw.Code == http.StatusForbidden,
+				"trigger expected 200/302/403 (kubeconfig camouflages "+
+					"as K8s 403), got %d for %s (url=%s)",
+				tw.Code, c.kind, triggerURL,
+			)
+
+			expectedNotifications++
+			require.Eventuallyf(
+				t,
+				func() bool {
+					return st.sender.count() >= expectedNotifications
+				},
+				e2eEventualWait,
+				e2eEventualTick,
+				"notifier should fire for %s (got=%d want>=%d)",
+				c.kind, st.sender.count(), expectedNotifications,
+			)
+
+			count, err := st.eventRepo.CountByToken(
+				context.Background(),
+				tokenID,
+			)
+			require.NoError(t, err)
+			require.GreaterOrEqualf(
+				t,
+				count,
+				int64(1),
+				"at least one event must be recorded for %s",
+				c.kind,
+			)
+
+			manageReq := httptest.NewRequest(
+				http.MethodGet,
+				"/api/m/"+resp.Data.Token.ManageID,
+				nil,
+			)
+			mw := httptest.NewRecorder()
+			st.router.ServeHTTP(mw, manageReq)
+			require.Equal(t, http.StatusOK, mw.Code)
+			var manage struct {
+				Success bool `json:"success"`
+				Data    struct {
+					EventsTotal int64 `json:"events_total"`
+				} `json:"data"`
+			}
+			require.NoError(t, json.NewDecoder(mw.Body).Decode(&manage))
+			require.True(t, manage.Success)
+			require.GreaterOrEqual(
+				t,
+				manage.Data.EventsTotal,
+				int64(1),
+				"manage view must show at least one event for "+c.name,
+			)
+		})
+	}
+
+	st.notifySvc.Wait()
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/server/server.go b/PROJECTS/beginner/canary-token-generator/backend/internal/server/server.go
new file mode 100644
index 00000000..860e760d
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/server/server.go
@@ -0,0 +1,108 @@
+// ©AngelaMos | 2026
+// server.go
+
+package server
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	chimw "github.com/go-chi/chi/v5/middleware"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/config"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/health"
+)
+
+type Server struct {
+	httpServer    *http.Server
+	router        *chi.Mux
+	config        config.ServerConfig
+	healthHandler *health.Handler
+	logger        *slog.Logger
+}
+
+type Config struct {
+	ServerConfig  config.ServerConfig
+	HealthHandler *health.Handler
+	Logger        *slog.Logger
+}
+
+func New(cfg Config) *Server {
+	router := chi.NewRouter()
+
+	router.Use(chimw.CleanPath)
+	router.Use(chimw.StripSlashes)
+
+	return &Server{
+		httpServer: &http.Server{
+			Addr:         cfg.ServerConfig.Address(),
+			Handler:      router,
+			ReadTimeout:  cfg.ServerConfig.ReadTimeout,
+			WriteTimeout: cfg.ServerConfig.WriteTimeout,
+			IdleTimeout:  cfg.ServerConfig.IdleTimeout,
+		},
+		router:        router,
+		config:        cfg.ServerConfig,
+		healthHandler: cfg.HealthHandler,
+		logger:        cfg.Logger,
+	}
+}
+
+func (s *Server) Router() *chi.Mux {
+	return s.router
+}
+
+func (s *Server) Start() error {
+	s.logger.Info("starting HTTP server",
+		"addr", s.config.Address(),
+		"read_timeout", s.config.ReadTimeout,
+		"write_timeout", s.config.WriteTimeout,
+		"idle_timeout", s.config.IdleTimeout,
+	)
+
+	if err := s.httpServer.ListenAndServe(); err != nil &&
+		!errors.Is(err, http.ErrServerClosed) {
+		return fmt.Errorf("http server error: %w", err)
+	}
+
+	return nil
+}
+
+func (s *Server) Shutdown(ctx context.Context, drainDelay time.Duration) error {
+	s.logger.Info("initiating graceful shutdown")
+
+	s.logger.Info("marking server as not ready")
+	if s.healthHandler != nil {
+		s.healthHandler.SetReady(false)
+		s.healthHandler.SetShutdown(true)
+	}
+
+	s.logger.Info("waiting for load balancer to drain",
+		"delay", drainDelay,
+	)
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case <-time.After(drainDelay):
+	}
+
+	s.logger.Info("stopping HTTP server")
+	shutdownCtx, cancel := context.WithTimeout(ctx, s.config.ShutdownTimeout)
+	defer cancel()
+
+	if err := s.httpServer.Shutdown(shutdownCtx); err != nil {
+		return fmt.Errorf("http server shutdown: %w", err)
+	}
+
+	s.logger.Info("HTTP server stopped gracefully")
+	return nil
+}
+
+func (s *Server) Address() string {
+	return s.httpServer.Addr
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/testutil/postgres.go b/PROJECTS/beginner/canary-token-generator/backend/internal/testutil/postgres.go
new file mode 100644
index 00000000..52fc1af6
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/testutil/postgres.go
@@ -0,0 +1,62 @@
+// ©AngelaMos | 2026
+// postgres.go
+
+package testutil
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+	"time"
+
+	_ "github.com/jackc/pgx/v5/stdlib"
+	"github.com/stretchr/testify/require"
+	"github.com/testcontainers/testcontainers-go"
+	tcpostgres "github.com/testcontainers/testcontainers-go/modules/postgres"
+	"github.com/testcontainers/testcontainers-go/wait"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/core"
+)
+
+func NewTestDB(t *testing.T) *sql.DB {
+	t.Helper()
+
+	ctx := context.Background()
+
+	pgContainer, err := tcpostgres.Run(ctx, "postgres:18-alpine",
+		tcpostgres.WithDatabase("canary_test"),
+		tcpostgres.WithUsername("test"),
+		tcpostgres.WithPassword("test"),
+		testcontainers.WithWaitStrategy(
+			wait.ForLog("database system is ready to accept connections").
+				WithOccurrence(2).
+				WithStartupTimeout(60*time.Second),
+		),
+	)
+	require.NoError(t, err)
+
+	t.Cleanup(func() {
+		if termErr := pgContainer.Terminate(
+			context.Background(),
+		); termErr != nil {
+			t.Logf("postgres container terminate: %v", termErr)
+		}
+	})
+
+	connStr, err := pgContainer.ConnectionString(ctx, "sslmode=disable")
+	require.NoError(t, err)
+
+	db, err := sql.Open("pgx", connStr)
+	require.NoError(t, err)
+
+	t.Cleanup(func() {
+		if closeErr := db.Close(); closeErr != nil {
+			t.Logf("db close: %v", closeErr)
+		}
+	})
+
+	require.NoError(t, db.Ping())
+	require.NoError(t, core.RunMigrations(db))
+
+	return db
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/testutil/ptr.go b/PROJECTS/beginner/canary-token-generator/backend/internal/testutil/ptr.go
new file mode 100644
index 00000000..e7830ca0
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/testutil/ptr.go
@@ -0,0 +1,6 @@
+// ©AngelaMos | 2026
+// ptr.go
+
+package testutil
+
+func Ptr[T any](v T) *T { return &v }
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/contract.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/contract.go
new file mode 100644
index 00000000..2683d586
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/contract.go
@@ -0,0 +1,72 @@
+// ©AngelaMos | 2026
+// contract.go
+
+package token
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+)
+
+type ArtifactKind string
+
+const (
+	KindURL              ArtifactKind = "url"
+	KindFile             ArtifactKind = "file"
+	KindText             ArtifactKind = "text"
+	KindConnectionString ArtifactKind = "connection_string"
+)
+
+type Artifact struct {
+	Kind             ArtifactKind
+	URL              string
+	Filename         string
+	Content          []byte
+	ContentType      string
+	ConnectionString string
+	DestinationURL   string
+}
+
+type TriggerResponse struct {
+	StatusCode   int
+	ContentType  string
+	Body         []byte
+	RedirectURL  string
+	ExtraHeaders map[string]string
+}
+
+type Generator interface {
+	Type() Type
+	Generate(
+		ctx context.Context,
+		t *Token,
+		baseURL string,
+	) (Artifact, error)
+	Trigger(
+		ctx context.Context,
+		t *Token,
+		r *http.Request,
+	) (*event.Event, *TriggerResponse, error)
+}
+
+func (t *Token) NotifyInfo() event.NotifyInfo {
+	return event.NotifyInfo{
+		TokenID:      t.ID,
+		ManageID:     t.ManageID,
+		Type:         string(t.Type),
+		Memo:         t.Memo,
+		AlertChannel: string(t.AlertChannel),
+		TelegramBot:  derefString(t.TelegramBot),
+		TelegramChat: derefString(t.TelegramChat),
+		WebhookURL:   derefString(t.WebhookURL),
+	}
+}
+
+func derefString(s *string) string {
+	if s == nil {
+		return ""
+	}
+	return *s
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/dto.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/dto.go
new file mode 100644
index 00000000..9165c3d2
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/dto.go
@@ -0,0 +1,98 @@
+// ©AngelaMos | 2026
+// dto.go
+
+package token
+
+import (
+	"encoding/json"
+	"time"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+)
+
+type CreateRequest struct {
+	Type          Type            `json:"type"                  validate:"required,oneof=webbug slowredirect docx pdf kubeconfig envfile mysql"`
+	Memo          string          `json:"memo"                  validate:"max=256"`
+	Filename      string          `json:"filename"              validate:"max=128"`
+	AlertChannel  AlertChannel    `json:"alert_channel"         validate:"required,oneof=telegram webhook"`
+	TelegramBot   string          `json:"telegram_bot"          validate:"required_if=AlertChannel telegram"`
+	TelegramChat  string          `json:"telegram_chat"         validate:"required_if=AlertChannel telegram"`
+	WebhookURL    string          `json:"webhook_url"           validate:"required_if=AlertChannel webhook,omitempty,url"`
+	Metadata      json.RawMessage `json:"metadata"`
+	TurnstileResp string          `json:"cf_turnstile_response"`
+}
+
+type Response struct {
+	ID            string          `json:"id"`
+	ManageID      string          `json:"manage_id"`
+	Type          Type            `json:"type"`
+	Memo          string          `json:"memo"`
+	Filename      *string         `json:"filename"`
+	AlertChannel  AlertChannel    `json:"alert_channel"`
+	CreatedAt     time.Time       `json:"created_at"`
+	TriggerCount  int64           `json:"trigger_count"`
+	LastTriggered *time.Time      `json:"last_triggered"`
+	Enabled       bool            `json:"enabled"`
+	TriggerURL    string          `json:"trigger_url"`
+	ManageURL     string          `json:"manage_url"`
+	Metadata      json.RawMessage `json:"metadata,omitempty"`
+}
+
+func (t *Token) ToResponse(triggerURL, manageURL string) Response {
+	return Response{
+		ID:            t.ID,
+		ManageID:      t.ManageID,
+		Type:          t.Type,
+		Memo:          t.Memo,
+		Filename:      t.Filename,
+		AlertChannel:  t.AlertChannel,
+		CreatedAt:     t.CreatedAt,
+		TriggerCount:  t.TriggerCount,
+		LastTriggered: t.LastTriggered,
+		Enabled:       t.Enabled,
+		TriggerURL:    triggerURL,
+		ManageURL:     manageURL,
+		Metadata:      t.Metadata,
+	}
+}
+
+type ManageTokenView struct {
+	ID            string       `json:"id"`
+	Type          Type         `json:"type"`
+	Memo          string       `json:"memo"`
+	Filename      *string      `json:"filename"`
+	AlertChannel  AlertChannel `json:"alert_channel"`
+	CreatedAt     time.Time    `json:"created_at"`
+	TriggerCount  int64        `json:"trigger_count"`
+	LastTriggered *time.Time   `json:"last_triggered"`
+	Enabled       bool         `json:"enabled"`
+	TriggerURL    string       `json:"trigger_url"`
+}
+
+type ManagePage struct {
+	NextCursor string `json:"next_cursor"`
+	HasMore    bool   `json:"has_more"`
+}
+
+type ManageResponse struct {
+	Token                ManageTokenView  `json:"token"`
+	Events               []event.Response `json:"events"`
+	EventsTotal          int64            `json:"events_total"`
+	EventsSilencedActive int64            `json:"events_silenced_active"`
+	Page                 ManagePage       `json:"page"`
+}
+
+func (t *Token) ToManageView(triggerURL string) ManageTokenView {
+	return ManageTokenView{
+		ID:            t.ID,
+		Type:          t.Type,
+		Memo:          t.Memo,
+		Filename:      t.Filename,
+		AlertChannel:  t.AlertChannel,
+		CreatedAt:     t.CreatedAt,
+		TriggerCount:  t.TriggerCount,
+		LastTriggered: t.LastTriggered,
+		Enabled:       t.Enabled,
+		TriggerURL:    triggerURL,
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/entity.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/entity.go
new file mode 100644
index 00000000..c85e20b6
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/entity.go
@@ -0,0 +1,64 @@
+// ©AngelaMos | 2026
+// entity.go
+
+package token
+
+import (
+	"encoding/json"
+	"time"
+)
+
+type Type string
+
+const (
+	TypeWebbug       Type = "webbug"
+	TypeSlowRedirect Type = "slowredirect"
+	TypeDocx         Type = "docx"
+	TypePDF          Type = "pdf"
+	TypeKubeconfig   Type = "kubeconfig"
+	TypeEnvfile      Type = "envfile"
+	TypeMySQL        Type = "mysql"
+)
+
+func (t Type) Valid() bool {
+	switch t {
+	case TypeWebbug, TypeSlowRedirect, TypeDocx, TypePDF,
+		TypeKubeconfig, TypeEnvfile, TypeMySQL:
+		return true
+	}
+	return false
+}
+
+type AlertChannel string
+
+const (
+	ChannelTelegram AlertChannel = "telegram"
+	ChannelWebhook  AlertChannel = "webhook"
+)
+
+func (c AlertChannel) Valid() bool {
+	switch c {
+	case ChannelTelegram, ChannelWebhook:
+		return true
+	}
+	return false
+}
+
+type Token struct {
+	ID            string          `db:"id"             json:"id"`
+	ManageID      string          `db:"manage_id"      json:"manage_id"`
+	Type          Type            `db:"type"           json:"type"`
+	Memo          string          `db:"memo"           json:"memo"`
+	Filename      *string         `db:"filename"       json:"filename"`
+	AlertChannel  AlertChannel    `db:"alert_channel"  json:"alert_channel"`
+	TelegramBot   *string         `db:"telegram_bot"   json:"-"`
+	TelegramChat  *string         `db:"telegram_chat"  json:"-"`
+	WebhookURL    *string         `db:"webhook_url"    json:"-"`
+	CreatedAt     time.Time       `db:"created_at"     json:"created_at"`
+	CreatedIP     string          `db:"created_ip"     json:"-"`
+	CreatedFP     string          `db:"created_fp"     json:"-"`
+	Enabled       bool            `db:"enabled"        json:"enabled"`
+	TriggerCount  int64           `db:"trigger_count"  json:"trigger_count"`
+	LastTriggered *time.Time      `db:"last_triggered" json:"last_triggered"`
+	Metadata      json.RawMessage `db:"metadata"       json:"metadata"`
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/docx/generator.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/docx/generator.go
new file mode 100644
index 00000000..3b8ed5b4
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/docx/generator.go
@@ -0,0 +1,152 @@
+// ©AngelaMos | 2026
+// generator.go
+
+package docx
+
+import (
+	"archive/zip"
+	"bytes"
+	"context"
+	_ "embed"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/middleware"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/pixel"
+)
+
+const (
+	headerReferer      = "Referer"
+	headerCacheControl = "Cache-Control"
+	headerPragma       = "Pragma"
+
+	cacheControlNoStore = "no-store, no-cache, must-revalidate, max-age=0"
+	pragmaNoCache       = "no-cache"
+
+	triggerPathPrefix = "/c/"
+
+	placeholder = "HONEY_TRACK_URL"
+	footerEntry = "word/footer2.xml"
+
+	contentType     = "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
+	defaultFilename = "Document.docx"
+)
+
+//go:embed template/template.docx
+var docxTemplate []byte
+
+type Generator struct{}
+
+func New() *Generator { return &Generator{} }
+
+func (g *Generator) Type() token.Type { return token.TypeDocx }
+
+func (g *Generator) Generate(
+	_ context.Context,
+	t *token.Token,
+	baseURL string,
+) (generators.Artifact, error) {
+	triggerURL := strings.TrimRight(baseURL, "/") + triggerPathPrefix + t.ID
+
+	patched, err := patchTemplate(docxTemplate, triggerURL)
+	if err != nil {
+		return generators.Artifact{}, err
+	}
+
+	return generators.Artifact{
+		Kind:        generators.KindFile,
+		Filename:    resolveFilename(t.Filename),
+		Content:     patched,
+		ContentType: contentType,
+	}, nil
+}
+
+func (g *Generator) Trigger(
+	_ context.Context,
+	t *token.Token,
+	r *http.Request,
+) (*event.Event, *generators.TriggerResponse, error) {
+	resp := &generators.TriggerResponse{
+		StatusCode:  http.StatusOK,
+		ContentType: pixel.ContentType,
+		Body:        pixel.Clone(),
+		ExtraHeaders: map[string]string{
+			headerCacheControl: cacheControlNoStore,
+			headerPragma:       pragmaNoCache,
+		},
+	}
+
+	if t == nil {
+		return nil, resp, nil
+	}
+
+	evt := &event.Event{
+		TokenID:   t.ID,
+		SourceIP:  middleware.RealIP(r),
+		UserAgent: middleware.OptionalHeader(r.UserAgent()),
+		Referer:   middleware.OptionalHeader(r.Header.Get(headerReferer)),
+	}
+	return evt, resp, nil
+}
+
+func resolveFilename(name *string) string {
+	if name == nil {
+		return defaultFilename
+	}
+	trimmed := strings.TrimSpace(*name)
+	if trimmed == "" {
+		return defaultFilename
+	}
+	return trimmed
+}
+
+func patchTemplate(template []byte, triggerURL string) ([]byte, error) {
+	in, err := zip.NewReader(bytes.NewReader(template), int64(len(template)))
+	if err != nil {
+		return nil, fmt.Errorf("docx: parse template: %w", err)
+	}
+
+	var out bytes.Buffer
+	w := zip.NewWriter(&out)
+	for _, f := range in.File {
+		rc, oErr := f.Open()
+		if oErr != nil {
+			return nil, fmt.Errorf("docx: open %s: %w", f.Name, oErr)
+		}
+		body, rErr := io.ReadAll(rc)
+		cErr := rc.Close()
+		if rErr != nil {
+			return nil, fmt.Errorf("docx: read %s: %w", f.Name, rErr)
+		}
+		if cErr != nil {
+			return nil, fmt.Errorf("docx: close %s: %w", f.Name, cErr)
+		}
+
+		if f.Name == footerEntry {
+			body = bytes.Replace(
+				body,
+				[]byte(placeholder),
+				[]byte(triggerURL),
+				1,
+			)
+		}
+
+		hdr := &zip.FileHeader{Name: f.Name, Method: f.Method}
+		fw, hErr := w.CreateHeader(hdr)
+		if hErr != nil {
+			return nil, fmt.Errorf("docx: create %s: %w", f.Name, hErr)
+		}
+		if _, wErr := fw.Write(body); wErr != nil {
+			return nil, fmt.Errorf("docx: write %s: %w", f.Name, wErr)
+		}
+	}
+	if err := w.Close(); err != nil {
+		return nil, fmt.Errorf("docx: close zip writer: %w", err)
+	}
+	return out.Bytes(), nil
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/docx/generator_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/docx/generator_test.go
new file mode 100644
index 00000000..6c24bd73
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/docx/generator_test.go
@@ -0,0 +1,591 @@
+// ©AngelaMos | 2026
+// generator_test.go
+
+package docx_test
+
+import (
+	"archive/zip"
+	"bytes"
+	"context"
+	_ "embed"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/docx"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/pixel"
+)
+
+//go:embed template/template.docx
+var rawTemplate []byte
+
+const (
+	testBaseURL              = "https://canary.example.com"
+	placeholderLiteral       = "HONEY_TRACK_URL"
+	footerEntryName          = "word/footer2.xml"
+	docxContentTypeMIME      = "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
+	defaultFilename          = "Document.docx"
+	cacheControlNoStoreValue = "no-store, no-cache, must-revalidate, max-age=0"
+	pragmaNoCacheValue       = "no-cache"
+	gifByteLength            = 43
+)
+
+func newDocxToken(id string) *token.Token {
+	return &token.Token{
+		ID:           id,
+		ManageID:     "manage-" + id,
+		Type:         token.TypeDocx,
+		Memo:         "unit test docx",
+		AlertChannel: token.ChannelWebhook,
+		Enabled:      true,
+	}
+}
+
+func newDocxTokenWithFilename(id, filename string) *token.Token {
+	tok := newDocxToken(id)
+	tok.Filename = &filename
+	return tok
+}
+
+func readFooterXML(t *testing.T, archive []byte) []byte {
+	t.Helper()
+	r, err := zip.NewReader(
+		bytes.NewReader(archive),
+		int64(len(archive)),
+	)
+	require.NoError(t, err)
+	for _, f := range r.File {
+		if f.Name != footerEntryName {
+			continue
+		}
+		rc, oErr := f.Open()
+		require.NoError(t, oErr)
+		body, rErr := io.ReadAll(rc)
+		require.NoError(t, rc.Close())
+		require.NoError(t, rErr)
+		return body
+	}
+	t.Fatalf("entry %q not found in zip", footerEntryName)
+	return nil
+}
+
+func zipEntryBodies(t *testing.T, archive []byte) map[string][]byte {
+	t.Helper()
+	r, err := zip.NewReader(
+		bytes.NewReader(archive),
+		int64(len(archive)),
+	)
+	require.NoError(t, err)
+	out := make(map[string][]byte, len(r.File))
+	for _, f := range r.File {
+		rc, oErr := f.Open()
+		require.NoError(t, oErr)
+		body, rErr := io.ReadAll(rc)
+		require.NoError(t, rc.Close())
+		require.NoError(t, rErr)
+		out[f.Name] = body
+	}
+	return out
+}
+
+func zipEntryMethods(t *testing.T, archive []byte) map[string]uint16 {
+	t.Helper()
+	r, err := zip.NewReader(
+		bytes.NewReader(archive),
+		int64(len(archive)),
+	)
+	require.NoError(t, err)
+	out := make(map[string]uint16, len(r.File))
+	for _, f := range r.File {
+		out[f.Name] = f.Method
+	}
+	return out
+}
+
+func TestGenerator_TypeIsDocx(t *testing.T) {
+	g := docx.New()
+	require.Equal(t, token.TypeDocx, g.Type())
+}
+
+func TestGenerate_ArtifactKindIsFile(t *testing.T) {
+	g := docx.New()
+	art, err := g.Generate(
+		context.Background(),
+		newDocxToken("abc"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+	require.Equal(t, generators.KindFile, art.Kind)
+}
+
+func TestGenerate_ContentTypeIsDocxMIME(t *testing.T) {
+	g := docx.New()
+	art, err := g.Generate(
+		context.Background(),
+		newDocxToken("abc"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+	require.Equal(t, docxContentTypeMIME, art.ContentType)
+}
+
+func TestGenerate_Filename(t *testing.T) {
+	g := docx.New()
+
+	t.Run("nil Filename defaults to Document.docx", func(t *testing.T) {
+		art, err := g.Generate(
+			context.Background(),
+			newDocxToken("abc"),
+			testBaseURL,
+		)
+		require.NoError(t, err)
+		require.Equal(t, defaultFilename, art.Filename)
+	})
+
+	t.Run(
+		"empty Filename pointer defaults to Document.docx",
+		func(t *testing.T) {
+			art, err := g.Generate(
+				context.Background(),
+				newDocxTokenWithFilename("abc", ""),
+				testBaseURL,
+			)
+			require.NoError(t, err)
+			require.Equal(t, defaultFilename, art.Filename)
+		},
+	)
+
+	t.Run(
+		"whitespace-only Filename defaults to Document.docx",
+		func(t *testing.T) {
+			art, err := g.Generate(
+				context.Background(),
+				newDocxTokenWithFilename("abc", "   "),
+				testBaseURL,
+			)
+			require.NoError(t, err)
+			require.Equal(t, defaultFilename, art.Filename)
+		},
+	)
+
+	t.Run("set Filename is preserved (trimmed)", func(t *testing.T) {
+		art, err := g.Generate(
+			context.Background(),
+			newDocxTokenWithFilename("abc", "  Q4-Plan.docx  "),
+			testBaseURL,
+		)
+		require.NoError(t, err)
+		require.Equal(t, "Q4-Plan.docx", art.Filename)
+	})
+}
+
+func TestGenerate_TriggerURL(t *testing.T) {
+	g := docx.New()
+
+	t.Run("base URL trailing slash trimmed", func(t *testing.T) {
+		artA, err := g.Generate(
+			context.Background(),
+			newDocxToken("tk1"),
+			"https://canary.example.com",
+		)
+		require.NoError(t, err)
+		artB, err := g.Generate(
+			context.Background(),
+			newDocxToken("tk1"),
+			"https://canary.example.com/",
+		)
+		require.NoError(t, err)
+
+		bodyA := readFooterXML(t, artA.Content)
+		bodyB := readFooterXML(t, artB.Content)
+		require.Contains(t, string(bodyA), "https://canary.example.com/c/tk1")
+		require.Contains(t, string(bodyB), "https://canary.example.com/c/tk1")
+	})
+
+	t.Run("base URL subpath preserved", func(t *testing.T) {
+		art, err := g.Generate(
+			context.Background(),
+			newDocxToken("tk2"),
+			"https://example.com/canary",
+		)
+		require.NoError(t, err)
+		body := readFooterXML(t, art.Content)
+		require.Contains(t, string(body), "https://example.com/canary/c/tk2")
+	})
+
+	t.Run("different token ids produce distinct outputs", func(t *testing.T) {
+		artA, err := g.Generate(
+			context.Background(),
+			newDocxToken("aaa"),
+			testBaseURL,
+		)
+		require.NoError(t, err)
+		artB, err := g.Generate(
+			context.Background(),
+			newDocxToken("bbb"),
+			testBaseURL,
+		)
+		require.NoError(t, err)
+		require.NotEqual(t, artA.Content, artB.Content)
+	})
+}
+
+func TestGenerate_OutputIsValidZip(t *testing.T) {
+	g := docx.New()
+	art, err := g.Generate(
+		context.Background(),
+		newDocxToken("abc"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+
+	r, zErr := zip.NewReader(
+		bytes.NewReader(art.Content),
+		int64(len(art.Content)),
+	)
+	require.NoError(t, zErr, "generated docx must parse as a zip archive")
+	require.NotEmpty(t, r.File, "zip must contain at least one entry")
+}
+
+func TestGenerate_FooterContainsTriggerURL(t *testing.T) {
+	g := docx.New()
+	art, err := g.Generate(
+		context.Background(),
+		newDocxToken("token42"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+
+	body := readFooterXML(t, art.Content)
+	require.Contains(
+		t,
+		string(body),
+		"https://canary.example.com/c/token42",
+		"footer must reference the canary trigger URL after substitution",
+	)
+}
+
+func TestGenerate_FooterDoesNotContainPlaceholder(t *testing.T) {
+	g := docx.New()
+	art, err := g.Generate(
+		context.Background(),
+		newDocxToken("xyz"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+
+	body := readFooterXML(t, art.Content)
+	require.NotContains(
+		t,
+		string(body),
+		placeholderLiteral,
+		"placeholder must be fully substituted in footer2.xml",
+	)
+}
+
+func TestGenerate_OtherEntriesUnchanged(t *testing.T) {
+	g := docx.New()
+	art, err := g.Generate(
+		context.Background(),
+		newDocxToken("abc"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+
+	templateBodies := zipEntryBodies(t, rawTemplate)
+	outputBodies := zipEntryBodies(t, art.Content)
+	require.Len(
+		t,
+		outputBodies,
+		len(templateBodies),
+		"output must have the same entry count as the template",
+	)
+
+	for name, tmplBody := range templateBodies {
+		outBody, ok := outputBodies[name]
+		require.True(t, ok, "output missing template entry %q", name)
+		if name == footerEntryName {
+			require.NotEqual(
+				t,
+				tmplBody,
+				outBody,
+				"footer2.xml must change after substitution",
+			)
+			continue
+		}
+		require.Equal(
+			t,
+			tmplBody,
+			outBody,
+			"non-footer entry %q must be byte-identical to template",
+			name,
+		)
+	}
+}
+
+func TestGenerate_PreservesCompressionMethods(t *testing.T) {
+	g := docx.New()
+	art, err := g.Generate(
+		context.Background(),
+		newDocxToken("abc"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+
+	templateMethods := zipEntryMethods(t, rawTemplate)
+	outputMethods := zipEntryMethods(t, art.Content)
+
+	hasStore, hasDeflate := false, false
+	for _, m := range templateMethods {
+		switch m {
+		case zip.Store:
+			hasStore = true
+		case zip.Deflate:
+			hasDeflate = true
+		}
+	}
+	require.True(
+		t,
+		hasStore && hasDeflate,
+		"template must mix STORE and DEFLATE for this test to be a real regression guard",
+	)
+
+	for name, tmplMethod := range templateMethods {
+		outMethod, ok := outputMethods[name]
+		require.True(t, ok, "output missing template entry %q", name)
+		require.Equal(
+			t,
+			tmplMethod,
+			outMethod,
+			"entry %q method mismatch (template=%d, output=%d)",
+			name,
+			tmplMethod,
+			outMethod,
+		)
+	}
+}
+
+func TestTrigger_ReturnsGIFLikeWebbug(t *testing.T) {
+	g := docx.New()
+	tok := newDocxToken("abc")
+	r := httptest.NewRequest(http.MethodGet, "/c/abc", nil)
+
+	_, resp, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	require.Equal(t, pixel.ContentType, resp.ContentType)
+	require.Len(t, resp.Body, gifByteLength)
+	require.Equal(t, pixel.Clone(), resp.Body)
+	require.Equal(
+		t,
+		cacheControlNoStoreValue,
+		resp.ExtraHeaders["Cache-Control"],
+	)
+	require.Equal(t, pragmaNoCacheValue, resp.ExtraHeaders["Pragma"])
+}
+
+func TestTrigger_RecordsEventWithRequestMetadata(t *testing.T) {
+	g := docx.New()
+	tok := newDocxToken("token1")
+
+	t.Run(
+		"captures token id, source ip, user agent, referer",
+		func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "/c/token1", nil)
+			r.Header.Set("CF-Connecting-IP", "203.0.113.50")
+			r.Header.Set("User-Agent", "LibreOffice/24.2")
+			r.Header.Set("Referer", "https://victim.example.com/inbox")
+
+			evt, _, err := g.Trigger(context.Background(), tok, r)
+			require.NoError(t, err)
+			require.NotNil(t, evt)
+			require.Equal(t, "token1", evt.TokenID)
+			require.Equal(t, "203.0.113.50", evt.SourceIP)
+			require.NotNil(t, evt.UserAgent)
+			require.Equal(t, "LibreOffice/24.2", *evt.UserAgent)
+			require.NotNil(t, evt.Referer)
+			require.Equal(t, "https://victim.example.com/inbox", *evt.Referer)
+		},
+	)
+
+	t.Run("source ip precedence", func(t *testing.T) {
+		cases := []struct {
+			name    string
+			headers map[string]string
+			remote  string
+			wantIP  string
+		}{
+			{
+				name: "CF wins over XFF and XRI",
+				headers: map[string]string{
+					"CF-Connecting-IP": "203.0.113.10",
+					"X-Forwarded-For":  "198.51.100.1, 198.51.100.2",
+					"X-Real-IP":        "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "203.0.113.10",
+			},
+			{
+				name: "XFF leftmost wins over XRI when no CF",
+				headers: map[string]string{
+					"X-Forwarded-For": "198.51.100.1, 198.51.100.7",
+					"X-Real-IP":       "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "198.51.100.1",
+			},
+			{
+				name: "XFF trailing-comma falls through to last non-empty",
+				headers: map[string]string{
+					"X-Forwarded-For": "198.51.100.1, ",
+					"X-Real-IP":       "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "198.51.100.1",
+			},
+			{
+				name: "XFF entirely empty entries fall through to XRI",
+				headers: map[string]string{
+					"X-Forwarded-For": ", ,",
+					"X-Real-IP":       "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "192.0.2.99",
+			},
+			{
+				name: "XRI when no CF or XFF",
+				headers: map[string]string{
+					"X-Real-IP": "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "192.0.2.99",
+			},
+			{
+				name:    "RemoteAddr IPv4 strips port",
+				headers: nil,
+				remote:  "127.0.0.1:9999",
+				wantIP:  "127.0.0.1",
+			},
+			{
+				name:    "RemoteAddr IPv6 strips brackets and port",
+				headers: nil,
+				remote:  "[2001:db8::1]:54321",
+				wantIP:  "2001:db8::1",
+			},
+			{
+				name:    "RemoteAddr loopback IPv6 strips brackets and port",
+				headers: nil,
+				remote:  "[::1]:9999",
+				wantIP:  "::1",
+			},
+			{
+				name:    "RemoteAddr without port falls back to raw value",
+				headers: nil,
+				remote:  "127.0.0.1",
+				wantIP:  "127.0.0.1",
+			},
+			{
+				name: "XFF mixed IPv4+IPv6 leftmost",
+				headers: map[string]string{
+					"X-Forwarded-For": "198.51.100.1, 2001:db8::dead",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "198.51.100.1",
+			},
+			{
+				name: "CF value is trimmed of whitespace",
+				headers: map[string]string{
+					"CF-Connecting-IP": "  203.0.113.10  ",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "203.0.113.10",
+			},
+		}
+		for _, tc := range cases {
+			tc := tc
+			t.Run(tc.name, func(t *testing.T) {
+				r := httptest.NewRequest(http.MethodGet, "/c/token1", nil)
+				for k, v := range tc.headers {
+					r.Header.Set(k, v)
+				}
+				r.RemoteAddr = tc.remote
+				evt, _, err := g.Trigger(context.Background(), tok, r)
+				require.NoError(t, err)
+				require.NotNil(t, evt)
+				require.Equal(t, tc.wantIP, evt.SourceIP)
+			})
+		}
+	})
+
+	t.Run(
+		"missing user agent and referer record as nil pointers",
+		func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "/c/token1", nil)
+			r.Header.Del("User-Agent")
+			r.Header.Del("Referer")
+			r.Header.Set("CF-Connecting-IP", "203.0.113.5")
+
+			evt, _, err := g.Trigger(context.Background(), tok, r)
+			require.NoError(t, err)
+			require.NotNil(t, evt)
+			require.Nil(
+				t,
+				evt.UserAgent,
+				"absent user agent must map to nil, not empty string",
+			)
+			require.Nil(
+				t,
+				evt.Referer,
+				"absent referer must map to nil, not empty string",
+			)
+		},
+	)
+}
+
+func TestTrigger_ResponseBodyIsIndependentCopyPerCall(t *testing.T) {
+	g := docx.New()
+	tok := newDocxToken("abc")
+	r := httptest.NewRequest(http.MethodGet, "/c/abc", nil)
+
+	_, resp1, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+	_, resp2, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+
+	resp1.Body[0] = 0x00
+	require.Equal(
+		t,
+		byte(0x47),
+		resp2.Body[0],
+		"each Trigger call must produce an independent body slice",
+	)
+}
+
+func TestTrigger_TokenNotFound_StillReturnsGIF(t *testing.T) {
+	g := docx.New()
+	r := httptest.NewRequest(http.MethodGet, "/c/does-not-exist", nil)
+	r.Header.Set("CF-Connecting-IP", "203.0.113.100")
+	r.Header.Set("User-Agent", "curl/8.0.0")
+
+	evt, resp, err := g.Trigger(context.Background(), nil, r)
+	require.NoError(
+		t,
+		err,
+		"nil-token path must not error (spec §8.5 defense-in-depth)",
+	)
+	require.NotNil(t, resp, "nil-token path must still return GIF response")
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	require.Equal(t, pixel.ContentType, resp.ContentType)
+	require.Equal(t, pixel.Clone(), resp.Body)
+	require.Nil(
+		t,
+		evt,
+		"nil-token path returns nil event so the handler cannot persist a row with empty TokenID (FK violation)",
+	)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/docx/template/template.docx b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/docx/template/template.docx
new file mode 100644
index 00000000..be7405d1
Binary files /dev/null and b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/docx/template/template.docx differ
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/generator.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/generator.go
new file mode 100644
index 00000000..c3d0255a
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/generator.go
@@ -0,0 +1,204 @@
+// ©AngelaMos | 2026
+// generator.go
+
+package envfile
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/json"
+	"fmt"
+	"math/big"
+	"net/http"
+	"strings"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/middleware"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/envfile/recipes"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/pixel"
+)
+
+const (
+	headerReferer      = "Referer"
+	headerCacheControl = "Cache-Control"
+	headerPragma       = "Pragma"
+
+	cacheControlNoStore = "no-store, no-cache, must-revalidate, max-age=0"
+	pragmaNoCache       = "no-cache"
+
+	triggerPathPrefix  = "/c/"
+	metadataIncludeKey = "include_keys"
+
+	contentType     = "text/plain; charset=utf-8"
+	defaultFilename = ".env"
+
+	canaryComment     = "Internal monitoring (Datadog-style integration)"
+	canaryEndpointKey = "INTERNAL_METRICS_ENDPOINT"
+	canaryTokenKey    = "INTERNAL_METRICS_TOKEN"
+	canaryTokenPrefix = "tok_live_"
+	canaryTokenLength = 32
+
+	envfileHeader = "# Production environment\n" +
+		"NODE_ENV=production\n" +
+		"PORT=8080\n\n"
+)
+
+var defaultIncludeKeys = []string{"aws", "db"}
+
+type Generator struct{}
+
+func New() *Generator { return &Generator{} }
+
+func (g *Generator) Type() token.Type { return token.TypeEnvfile }
+
+func (g *Generator) Generate(
+	_ context.Context,
+	t *token.Token,
+	baseURL string,
+) (generators.Artifact, error) {
+	keys := extractIncludeKeys(t.Metadata)
+	triggerURL := strings.TrimRight(baseURL, "/") + triggerPathPrefix + t.ID
+
+	sections := buildSections(keys, triggerURL)
+	if err := shuffleSections(sections); err != nil {
+		return generators.Artifact{}, fmt.Errorf(
+			"envfile: shuffle sections: %w",
+			err,
+		)
+	}
+
+	body := renderSections(sections)
+
+	return generators.Artifact{
+		Kind:        generators.KindText,
+		Filename:    resolveFilename(t.Filename),
+		Content:     body,
+		ContentType: contentType,
+	}, nil
+}
+
+func (g *Generator) Trigger(
+	_ context.Context,
+	t *token.Token,
+	r *http.Request,
+) (*event.Event, *generators.TriggerResponse, error) {
+	resp := &generators.TriggerResponse{
+		StatusCode:  http.StatusOK,
+		ContentType: pixel.ContentType,
+		Body:        pixel.Clone(),
+		ExtraHeaders: map[string]string{
+			headerCacheControl: cacheControlNoStore,
+			headerPragma:       pragmaNoCache,
+		},
+	}
+
+	if t == nil {
+		return nil, resp, nil
+	}
+
+	evt := &event.Event{
+		TokenID:   t.ID,
+		SourceIP:  middleware.RealIP(r),
+		UserAgent: middleware.OptionalHeader(r.UserAgent()),
+		Referer:   middleware.OptionalHeader(r.Header.Get(headerReferer)),
+	}
+	return evt, resp, nil
+}
+
+func buildSections(keys []string, triggerURL string) [][]recipes.EnvLine {
+	sections := make([][]recipes.EnvLine, 0, len(keys)+1)
+	for _, k := range keys {
+		if r, ok := recipes.Get(k); ok {
+			sections = append(sections, r.Generate())
+		}
+	}
+	sections = append(sections, []recipes.EnvLine{
+		{Comment: canaryComment},
+		{Key: canaryEndpointKey, Value: triggerURL},
+		{
+			Key: canaryTokenKey,
+			Value: canaryTokenPrefix +
+				recipes.RandomAlnumMixed(canaryTokenLength),
+		},
+	})
+	return sections
+}
+
+func shuffleSections(sections [][]recipes.EnvLine) error {
+	for i := len(sections) - 1; i > 0; i-- {
+		jBig, err := rand.Int(rand.Reader, big.NewInt(int64(i+1)))
+		if err != nil {
+			return fmt.Errorf("crypto/rand.Int: %w", err)
+		}
+		j := int(jBig.Int64())
+		sections[i], sections[j] = sections[j], sections[i]
+	}
+	return nil
+}
+
+func renderSections(sections [][]recipes.EnvLine) []byte {
+	var buf bytes.Buffer
+	buf.WriteString(envfileHeader)
+	for _, s := range sections {
+		for _, l := range s {
+			if l.Comment != "" {
+				fmt.Fprintf(&buf, "# %s\n", l.Comment)
+			}
+			if l.Key != "" {
+				fmt.Fprintf(&buf, "%s=%s\n", l.Key, l.Value)
+			}
+		}
+		buf.WriteString("\n")
+	}
+	return buf.Bytes()
+}
+
+func extractIncludeKeys(metadata json.RawMessage) []string {
+	if len(metadata) == 0 {
+		return cloneStrings(defaultIncludeKeys)
+	}
+	var m map[string]json.RawMessage
+	if err := json.Unmarshal(metadata, &m); err != nil {
+		return cloneStrings(defaultIncludeKeys)
+	}
+	raw, ok := m[metadataIncludeKey]
+	if !ok {
+		return cloneStrings(defaultIncludeKeys)
+	}
+	var keys []string
+	if err := json.Unmarshal(raw, &keys); err != nil || len(keys) == 0 {
+		return cloneStrings(defaultIncludeKeys)
+	}
+	out := make([]string, 0, len(keys))
+	for _, k := range keys {
+		k = strings.TrimSpace(k)
+		if k == "" {
+			continue
+		}
+		out = append(out, k)
+	}
+	if len(out) == 0 {
+		return cloneStrings(defaultIncludeKeys)
+	}
+	return out
+}
+
+func cloneStrings(in []string) []string {
+	out := make([]string, len(in))
+	copy(out, in)
+	return out
+}
+
+func resolveFilename(name *string) string {
+	if name == nil {
+		return defaultFilename
+	}
+	trimmed := strings.TrimSpace(*name)
+	if trimmed == "" {
+		return defaultFilename
+	}
+	return trimmed
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/generator_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/generator_test.go
new file mode 100644
index 00000000..43ae75aa
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/generator_test.go
@@ -0,0 +1,594 @@
+// ©AngelaMos | 2026
+// generator_test.go
+
+package envfile_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/envfile"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/pixel"
+)
+
+const (
+	testBaseURL              = "https://canary.example.com"
+	envfileContentTypeMIME   = "text/plain; charset=utf-8"
+	defaultFilenameValue     = ".env"
+	cacheControlNoStoreValue = "no-store, no-cache, must-revalidate, max-age=0"
+	pragmaNoCacheValue       = "no-cache"
+	gifByteLength            = 43
+)
+
+func newEnvfileToken(id string) *token.Token {
+	return &token.Token{
+		ID:           id,
+		ManageID:     "manage-" + id,
+		Type:         token.TypeEnvfile,
+		Memo:         "unit test envfile",
+		AlertChannel: token.ChannelWebhook,
+		Enabled:      true,
+	}
+}
+
+func newEnvfileTokenWithFilename(id, filename string) *token.Token {
+	tok := newEnvfileToken(id)
+	tok.Filename = &filename
+	return tok
+}
+
+func newEnvfileTokenWithIncludeKeys(keys []string) *token.Token {
+	tok := newEnvfileToken("abc")
+	raw, err := json.Marshal(map[string]any{"include_keys": keys})
+	if err != nil {
+		panic(err)
+	}
+	tok.Metadata = raw
+	return tok
+}
+
+func newEnvfileTokenWithRawMetadata(metadata string) *token.Token {
+	tok := newEnvfileToken("abc")
+	tok.Metadata = json.RawMessage(metadata)
+	return tok
+}
+
+func envLines(content []byte) []string {
+	return strings.Split(string(content), "\n")
+}
+
+func TestGenerator_TypeIsEnvfile(t *testing.T) {
+	g := envfile.New()
+	require.Equal(t, token.TypeEnvfile, g.Type())
+}
+
+func TestGenerate_ArtifactKindIsText(t *testing.T) {
+	g := envfile.New()
+	art, err := g.Generate(
+		context.Background(),
+		newEnvfileToken("abc"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+	require.Equal(t, generators.KindText, art.Kind)
+}
+
+func TestGenerate_ContentTypeIsTextPlain(t *testing.T) {
+	g := envfile.New()
+	art, err := g.Generate(
+		context.Background(),
+		newEnvfileToken("abc"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+	require.Equal(t, envfileContentTypeMIME, art.ContentType)
+}
+
+func TestGenerate_Filename(t *testing.T) {
+	g := envfile.New()
+
+	t.Run("nil Filename defaults to .env", func(t *testing.T) {
+		art, err := g.Generate(
+			context.Background(),
+			newEnvfileToken("abc"),
+			testBaseURL,
+		)
+		require.NoError(t, err)
+		require.Equal(t, defaultFilenameValue, art.Filename)
+	})
+
+	t.Run("empty Filename pointer defaults to .env", func(t *testing.T) {
+		art, err := g.Generate(
+			context.Background(),
+			newEnvfileTokenWithFilename("abc", ""),
+			testBaseURL,
+		)
+		require.NoError(t, err)
+		require.Equal(t, defaultFilenameValue, art.Filename)
+	})
+
+	t.Run("whitespace Filename defaults to .env", func(t *testing.T) {
+		art, err := g.Generate(
+			context.Background(),
+			newEnvfileTokenWithFilename("abc", "   "),
+			testBaseURL,
+		)
+		require.NoError(t, err)
+		require.Equal(t, defaultFilenameValue, art.Filename)
+	})
+
+	t.Run("set Filename is preserved (trimmed)", func(t *testing.T) {
+		art, err := g.Generate(
+			context.Background(),
+			newEnvfileTokenWithFilename("abc", "  .env.production  "),
+			testBaseURL,
+		)
+		require.NoError(t, err)
+		require.Equal(t, ".env.production", art.Filename)
+	})
+}
+
+func TestGenerate_ContainsHeader(t *testing.T) {
+	g := envfile.New()
+	art, err := g.Generate(
+		context.Background(),
+		newEnvfileToken("abc"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+	body := string(art.Content)
+	require.Contains(t, body, "# Production environment")
+	require.Contains(t, body, "NODE_ENV=production")
+	require.Contains(t, body, "PORT=8080")
+}
+
+func TestGenerate_EmbedsCanaryURL(t *testing.T) {
+	g := envfile.New()
+	art, err := g.Generate(
+		context.Background(),
+		newEnvfileToken("token42"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+	body := string(art.Content)
+	require.Contains(
+		t,
+		body,
+		"INTERNAL_METRICS_ENDPOINT=https://canary.example.com/c/token42",
+		"envfile must contain the canary URL as the INTERNAL_METRICS_ENDPOINT line",
+	)
+}
+
+func TestGenerate_EmbedsCanaryToken(t *testing.T) {
+	g := envfile.New()
+	art, err := g.Generate(
+		context.Background(),
+		newEnvfileToken("abc"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+	body := string(art.Content)
+	require.Regexp(
+		t,
+		`INTERNAL_METRICS_TOKEN=tok_live_[A-Za-z0-9]{32}`,
+		body,
+		"INTERNAL_METRICS_TOKEN must follow the tok_live_ + 32-alnum format",
+	)
+}
+
+func TestGenerate_TriggerURLTrailingSlashTrim(t *testing.T) {
+	g := envfile.New()
+
+	artA, err := g.Generate(
+		context.Background(),
+		newEnvfileToken("tk1"),
+		"https://canary.example.com",
+	)
+	require.NoError(t, err)
+	artB, err := g.Generate(
+		context.Background(),
+		newEnvfileToken("tk1"),
+		"https://canary.example.com/",
+	)
+	require.NoError(t, err)
+
+	require.Contains(
+		t,
+		string(artA.Content),
+		"INTERNAL_METRICS_ENDPOINT=https://canary.example.com/c/tk1",
+	)
+	require.Contains(
+		t,
+		string(artB.Content),
+		"INTERNAL_METRICS_ENDPOINT=https://canary.example.com/c/tk1",
+	)
+}
+
+func TestGenerate_DefaultIncludeKeysAreAWSAndDB(t *testing.T) {
+	g := envfile.New()
+	art, err := g.Generate(
+		context.Background(),
+		newEnvfileToken("abc"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+	body := string(art.Content)
+	require.Contains(
+		t,
+		body,
+		"AWS_ACCESS_KEY_ID=",
+		"default include_keys should include aws",
+	)
+	require.Contains(
+		t,
+		body,
+		"DATABASE_URL=postgres://",
+		"default include_keys should include db",
+	)
+	require.NotContains(
+		t,
+		body,
+		"STRIPE_SECRET_KEY=",
+		"default include_keys must NOT include stripe",
+	)
+	require.NotContains(
+		t,
+		body,
+		"GITHUB_TOKEN=",
+		"default include_keys must NOT include github",
+	)
+}
+
+func TestGenerate_IncludeKeysFromMetadata(t *testing.T) {
+	g := envfile.New()
+	tok := newEnvfileTokenWithIncludeKeys([]string{"stripe", "github"})
+
+	art, err := g.Generate(context.Background(), tok, testBaseURL)
+	require.NoError(t, err)
+	body := string(art.Content)
+	require.Contains(t, body, "STRIPE_SECRET_KEY=")
+	require.Contains(t, body, "GITHUB_TOKEN=")
+	require.NotContains(t, body, "AWS_ACCESS_KEY_ID=")
+	require.NotContains(t, body, "DATABASE_URL=postgres://")
+}
+
+func TestGenerate_UnknownKeyInMetadataSkipped(t *testing.T) {
+	g := envfile.New()
+	tok := newEnvfileTokenWithIncludeKeys(
+		[]string{"aws", "nonexistent", "stripe"},
+	)
+
+	art, err := g.Generate(context.Background(), tok, testBaseURL)
+	require.NoError(t, err)
+	body := string(art.Content)
+	require.Contains(t, body, "AWS_ACCESS_KEY_ID=")
+	require.Contains(t, body, "STRIPE_SECRET_KEY=")
+	require.NotContains(t, body, "nonexistent")
+}
+
+func TestGenerate_MalformedMetadataFallsBackToDefaults(t *testing.T) {
+	g := envfile.New()
+
+	cases := []struct {
+		name     string
+		metadata string
+	}{
+		{"empty raw", ""},
+		{"invalid json", "{not valid"},
+		{"include_keys is not array", `{"include_keys": "aws"}`},
+		{"include_keys is null", `{"include_keys": null}`},
+		{"include_keys is empty array", `{"include_keys": []}`},
+		{"missing include_keys field", `{"other_field": "value"}`},
+	}
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			tok := newEnvfileTokenWithRawMetadata(tc.metadata)
+			art, err := g.Generate(context.Background(), tok, testBaseURL)
+			require.NoError(t, err)
+			body := string(art.Content)
+			require.Contains(
+				t,
+				body,
+				"AWS_ACCESS_KEY_ID=",
+				"malformed metadata must fall back to aws default",
+			)
+			require.Contains(
+				t,
+				body,
+				"DATABASE_URL=postgres://",
+				"malformed metadata must fall back to db default",
+			)
+		})
+	}
+}
+
+func TestGenerate_IncludeKeysFiltersEmptyStrings(t *testing.T) {
+	g := envfile.New()
+	tok := newEnvfileTokenWithIncludeKeys(
+		[]string{"", "  ", "aws"},
+	)
+	art, err := g.Generate(context.Background(), tok, testBaseURL)
+	require.NoError(t, err)
+	require.Contains(t, string(art.Content), "AWS_ACCESS_KEY_ID=")
+}
+
+func TestGenerate_IncludeKeysAllWhitespaceFallsBackToDefaults(t *testing.T) {
+	g := envfile.New()
+	tok := newEnvfileTokenWithIncludeKeys([]string{"", "  "})
+	art, err := g.Generate(context.Background(), tok, testBaseURL)
+	require.NoError(t, err)
+	body := string(art.Content)
+	require.Contains(t, body, "AWS_ACCESS_KEY_ID=")
+	require.Contains(t, body, "DATABASE_URL=postgres://")
+}
+
+func TestGenerate_SectionShuffleProducesVariableOrder(t *testing.T) {
+	g := envfile.New()
+	tok := newEnvfileTokenWithIncludeKeys(
+		[]string{"aws", "stripe", "github", "db"},
+	)
+
+	canaryPositions := make(map[int]struct{})
+	for range 30 {
+		art, err := g.Generate(context.Background(), tok, testBaseURL)
+		require.NoError(t, err)
+		lines := envLines(art.Content)
+		for i, line := range lines {
+			if strings.HasPrefix(line, "INTERNAL_METRICS_ENDPOINT=") {
+				canaryPositions[i] = struct{}{}
+				break
+			}
+		}
+	}
+	require.Greater(
+		t,
+		len(canaryPositions),
+		1,
+		"shuffle must place the canary section at varying positions across 30 invocations",
+	)
+}
+
+func TestGenerate_DistinctInvocationsProduceDistinctOutputs(t *testing.T) {
+	g := envfile.New()
+	seen := make(map[string]struct{})
+	for range 10 {
+		art, err := g.Generate(
+			context.Background(),
+			newEnvfileToken("abc"),
+			testBaseURL,
+		)
+		require.NoError(t, err)
+		seen[string(art.Content)] = struct{}{}
+	}
+	require.Greater(
+		t,
+		len(seen),
+		8,
+		"random bait + random canary token + shuffle should produce near-unique outputs",
+	)
+}
+
+func TestGenerate_TokenIDDoesNotLeakOutsideCanaryLine(t *testing.T) {
+	g := envfile.New()
+	art, err := g.Generate(
+		context.Background(),
+		newEnvfileToken("uniqueprobe"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+	body := string(art.Content)
+	require.Equal(
+		t,
+		1,
+		strings.Count(body, "uniqueprobe"),
+		"token id must appear exactly once (in the canary URL), never in bait lines",
+	)
+}
+
+func TestTrigger_ReturnsGIFLikeWebbug(t *testing.T) {
+	g := envfile.New()
+	tok := newEnvfileToken("abc")
+	r := httptest.NewRequest(http.MethodGet, "/c/abc", nil)
+
+	_, resp, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	require.Equal(t, pixel.ContentType, resp.ContentType)
+	require.Len(t, resp.Body, gifByteLength)
+	require.Equal(t, pixel.Clone(), resp.Body)
+	require.Equal(
+		t,
+		cacheControlNoStoreValue,
+		resp.ExtraHeaders["Cache-Control"],
+	)
+	require.Equal(t, pragmaNoCacheValue, resp.ExtraHeaders["Pragma"])
+}
+
+func TestTrigger_RecordsEventWithRequestMetadata(t *testing.T) {
+	g := envfile.New()
+	tok := newEnvfileToken("token1")
+
+	t.Run(
+		"captures token id, source ip, user agent, referer",
+		func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "/c/token1", nil)
+			r.Header.Set("CF-Connecting-IP", "203.0.113.50")
+			r.Header.Set("User-Agent", "curl/8.0.0")
+			r.Header.Set("Referer", "https://victim.example.com/")
+
+			evt, _, err := g.Trigger(context.Background(), tok, r)
+			require.NoError(t, err)
+			require.NotNil(t, evt)
+			require.Equal(t, "token1", evt.TokenID)
+			require.Equal(t, "203.0.113.50", evt.SourceIP)
+			require.NotNil(t, evt.UserAgent)
+			require.Equal(t, "curl/8.0.0", *evt.UserAgent)
+			require.NotNil(t, evt.Referer)
+			require.Equal(t, "https://victim.example.com/", *evt.Referer)
+		},
+	)
+
+	t.Run("source ip precedence", func(t *testing.T) {
+		cases := []struct {
+			name    string
+			headers map[string]string
+			remote  string
+			wantIP  string
+		}{
+			{
+				name: "CF wins over XFF and XRI",
+				headers: map[string]string{
+					"CF-Connecting-IP": "203.0.113.10",
+					"X-Forwarded-For":  "198.51.100.1, 198.51.100.2",
+					"X-Real-IP":        "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "203.0.113.10",
+			},
+			{
+				name: "XFF leftmost wins over XRI when no CF",
+				headers: map[string]string{
+					"X-Forwarded-For": "198.51.100.1, 198.51.100.7",
+					"X-Real-IP":       "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "198.51.100.1",
+			},
+			{
+				name: "XFF trailing-comma falls through to last non-empty",
+				headers: map[string]string{
+					"X-Forwarded-For": "198.51.100.1, ",
+					"X-Real-IP":       "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "198.51.100.1",
+			},
+			{
+				name: "XFF entirely empty entries fall through to XRI",
+				headers: map[string]string{
+					"X-Forwarded-For": ", ,",
+					"X-Real-IP":       "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "192.0.2.99",
+			},
+			{
+				name: "XRI when no CF or XFF",
+				headers: map[string]string{
+					"X-Real-IP": "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "192.0.2.99",
+			},
+			{
+				name:    "RemoteAddr IPv4 strips port",
+				headers: nil,
+				remote:  "127.0.0.1:9999",
+				wantIP:  "127.0.0.1",
+			},
+			{
+				name:    "RemoteAddr IPv6 strips brackets and port",
+				headers: nil,
+				remote:  "[2001:db8::1]:54321",
+				wantIP:  "2001:db8::1",
+			},
+			{
+				name:    "RemoteAddr loopback IPv6 strips brackets and port",
+				headers: nil,
+				remote:  "[::1]:9999",
+				wantIP:  "::1",
+			},
+			{
+				name:    "RemoteAddr without port falls back to raw value",
+				headers: nil,
+				remote:  "127.0.0.1",
+				wantIP:  "127.0.0.1",
+			},
+			{
+				name: "XFF mixed IPv4+IPv6 leftmost",
+				headers: map[string]string{
+					"X-Forwarded-For": "198.51.100.1, 2001:db8::dead",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "198.51.100.1",
+			},
+			{
+				name: "CF value is trimmed of whitespace",
+				headers: map[string]string{
+					"CF-Connecting-IP": "  203.0.113.10  ",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "203.0.113.10",
+			},
+		}
+		for _, tc := range cases {
+			tc := tc
+			t.Run(tc.name, func(t *testing.T) {
+				r := httptest.NewRequest(http.MethodGet, "/c/token1", nil)
+				for k, v := range tc.headers {
+					r.Header.Set(k, v)
+				}
+				r.RemoteAddr = tc.remote
+				evt, _, err := g.Trigger(context.Background(), tok, r)
+				require.NoError(t, err)
+				require.NotNil(t, evt)
+				require.Equal(t, tc.wantIP, evt.SourceIP)
+			})
+		}
+	})
+
+	t.Run(
+		"missing user agent and referer record as nil pointers",
+		func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "/c/token1", nil)
+			r.Header.Del("User-Agent")
+			r.Header.Del("Referer")
+			r.Header.Set("CF-Connecting-IP", "203.0.113.5")
+
+			evt, _, err := g.Trigger(context.Background(), tok, r)
+			require.NoError(t, err)
+			require.NotNil(t, evt)
+			require.Nil(t, evt.UserAgent)
+			require.Nil(t, evt.Referer)
+		},
+	)
+}
+
+func TestTrigger_ResponseBodyIsIndependentCopyPerCall(t *testing.T) {
+	g := envfile.New()
+	tok := newEnvfileToken("abc")
+	r := httptest.NewRequest(http.MethodGet, "/c/abc", nil)
+
+	_, resp1, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+	_, resp2, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+
+	resp1.Body[0] = 0x00
+	require.Equal(t, byte(0x47), resp2.Body[0])
+}
+
+func TestTrigger_TokenNotFound_StillReturnsGIF(t *testing.T) {
+	g := envfile.New()
+	r := httptest.NewRequest(http.MethodGet, "/c/does-not-exist", nil)
+	r.Header.Set("CF-Connecting-IP", "203.0.113.100")
+	r.Header.Set("User-Agent", "curl/8.0.0")
+
+	evt, resp, err := g.Trigger(context.Background(), nil, r)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	require.Equal(t, pixel.ContentType, resp.ContentType)
+	require.Equal(t, pixel.Clone(), resp.Body)
+	require.Nil(t, evt)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/aws.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/aws.go
new file mode 100644
index 00000000..c48b467b
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/aws.go
@@ -0,0 +1,48 @@
+// ©AngelaMos | 2026
+// aws.go
+
+package recipes
+
+const (
+	awsAccessKeyPrefix  = "AKIA"
+	awsAccessKeyBodyLen = 16
+	awsSecretBytes      = 30
+
+	awsBucketName = "prod-data-backups"
+)
+
+var awsRegions = []string{
+	"us-east-1",
+	"us-east-2",
+	"us-west-2",
+	"eu-west-1",
+	"eu-central-1",
+	"ap-southeast-1",
+	"ap-northeast-1",
+}
+
+type AWS struct{}
+
+func (AWS) Name() string { return keyAWS }
+
+func (AWS) Generate() []EnvLine {
+	return []EnvLine{
+		{Comment: "AWS S3 production bucket (" + awsBucketName + ")"},
+		{
+			Key:   "AWS_ACCESS_KEY_ID",
+			Value: awsAccessKeyPrefix + RandomAlnumUpper(awsAccessKeyBodyLen),
+		},
+		{
+			Key:   "AWS_SECRET_ACCESS_KEY",
+			Value: RandomBase64(awsSecretBytes),
+		},
+		{
+			Key:   "AWS_REGION",
+			Value: RandomChoice(awsRegions),
+		},
+		{
+			Key:   "AWS_S3_BUCKET",
+			Value: awsBucketName,
+		},
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/aws_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/aws_test.go
new file mode 100644
index 00000000..7e4a076c
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/aws_test.go
@@ -0,0 +1,110 @@
+// ©AngelaMos | 2026
+// aws_test.go
+
+package recipes_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/envfile/recipes"
+)
+
+func linesByKey(
+	t *testing.T,
+	lines []recipes.EnvLine,
+) map[string]recipes.EnvLine {
+	t.Helper()
+	out := make(map[string]recipes.EnvLine, len(lines))
+	for _, l := range lines {
+		if l.Key != "" {
+			out[l.Key] = l
+		}
+	}
+	return out
+}
+
+func TestAWSRecipe_Name(t *testing.T) {
+	require.Equal(t, "aws", recipes.AWS{}.Name())
+}
+
+func TestAWSRecipe_GeneratesExpectedKeys(t *testing.T) {
+	lines := recipes.AWS{}.Generate()
+	byKey := linesByKey(t, lines)
+
+	for _, key := range []string{
+		"AWS_ACCESS_KEY_ID",
+		"AWS_SECRET_ACCESS_KEY",
+		"AWS_REGION",
+		"AWS_S3_BUCKET",
+	} {
+		_, ok := byKey[key]
+		require.True(t, ok, "AWS recipe must emit %s", key)
+	}
+}
+
+func TestAWSRecipe_AccessKeyMatchesAKIAFormat(t *testing.T) {
+	lines := recipes.AWS{}.Generate()
+	byKey := linesByKey(t, lines)
+	require.Regexp(
+		t,
+		`^AKIA[A-Z0-9]{16}$`,
+		byKey["AWS_ACCESS_KEY_ID"].Value,
+		"AWS_ACCESS_KEY_ID must match the AKIA + 16 base32-upper-alnum format gitleaks expects",
+	)
+}
+
+func TestAWSRecipe_SecretAccessKeyIsBase64Like(t *testing.T) {
+	lines := recipes.AWS{}.Generate()
+	byKey := linesByKey(t, lines)
+	require.Regexp(
+		t,
+		`^[A-Za-z0-9+/]+={0,2}$`,
+		byKey["AWS_SECRET_ACCESS_KEY"].Value,
+	)
+	require.GreaterOrEqual(
+		t,
+		len(byKey["AWS_SECRET_ACCESS_KEY"].Value),
+		40,
+		"AWS_SECRET_ACCESS_KEY must be at least 40 chars to match the real-key length floor",
+	)
+}
+
+func TestAWSRecipe_RegionIsAValidAWSRegion(t *testing.T) {
+	lines := recipes.AWS{}.Generate()
+	byKey := linesByKey(t, lines)
+	region := byKey["AWS_REGION"].Value
+	require.Regexp(
+		t,
+		`^[a-z]{2}-[a-z]+-\d+$`,
+		region,
+		"AWS_REGION must match the canonical AWS region pattern (xx-name-n)",
+	)
+}
+
+func TestAWSRecipe_HasLeadingComment(t *testing.T) {
+	lines := recipes.AWS{}.Generate()
+	require.NotEmpty(t, lines)
+	require.NotEmpty(
+		t,
+		lines[0].Comment,
+		"AWS recipe must begin with a comment for bait realism",
+	)
+	require.Empty(t, lines[0].Key, "comment line must not carry a Key/Value")
+}
+
+func TestAWSRecipe_DistinctInvocationsProduceDistinctSecrets(t *testing.T) {
+	seen := make(map[string]struct{})
+	for range 20 {
+		lines := recipes.AWS{}.Generate()
+		byKey := linesByKey(t, lines)
+		seen[byKey["AWS_ACCESS_KEY_ID"].Value] = struct{}{}
+	}
+	require.Greater(
+		t,
+		len(seen),
+		18,
+		"20 invocations should produce near-20 distinct access keys",
+	)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/db.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/db.go
new file mode 100644
index 00000000..81ff86f5
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/db.go
@@ -0,0 +1,56 @@
+// ©AngelaMos | 2026
+// db.go
+
+package recipes
+
+import "fmt"
+
+const (
+	dbPostgresUser = "app_writer"
+	dbPostgresHost = "db.internal"
+	dbPostgresPort = 5432
+	dbPostgresName = "app_prod"
+
+	dbRedisUser = "default"
+	dbRedisHost = "cache-prod.internal"
+	dbRedisPort = 6379
+	dbRedisDB   = 0
+
+	dbPostgresPassLen = 24
+	dbRedisPassLen    = 32
+
+	dbPostgresURLFmt = "postgres://%s:%s@%s:%d/%s?sslmode=require"
+	dbRedisURLFmt    = "redis://%s:%s@%s:%d/%d"
+)
+
+type DB struct{}
+
+func (DB) Name() string { return keyDB }
+
+func (DB) Generate() []EnvLine {
+	pgPass := RandomAlnumMixed(dbPostgresPassLen)
+	redisPass := RandomAlnumMixed(dbRedisPassLen)
+
+	pgURL := fmt.Sprintf(
+		dbPostgresURLFmt,
+		dbPostgresUser,
+		pgPass,
+		dbPostgresHost,
+		dbPostgresPort,
+		dbPostgresName,
+	)
+	redisURL := fmt.Sprintf(
+		dbRedisURLFmt,
+		dbRedisUser,
+		redisPass,
+		dbRedisHost,
+		dbRedisPort,
+		dbRedisDB,
+	)
+
+	return []EnvLine{
+		{Comment: "Primary datastore + cache"},
+		{Key: "DATABASE_URL", Value: pgURL},
+		{Key: "REDIS_URL", Value: redisURL},
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/db_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/db_test.go
new file mode 100644
index 00000000..2bbdbb7d
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/db_test.go
@@ -0,0 +1,75 @@
+// ©AngelaMos | 2026
+// db_test.go
+
+package recipes_test
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/envfile/recipes"
+)
+
+func TestDBRecipe_Name(t *testing.T) {
+	require.Equal(t, "db", recipes.DB{}.Name())
+}
+
+func TestDBRecipe_GeneratesExpectedKeys(t *testing.T) {
+	lines := recipes.DB{}.Generate()
+	byKey := linesByKey(t, lines)
+
+	for _, key := range []string{"DATABASE_URL", "REDIS_URL"} {
+		_, ok := byKey[key]
+		require.True(t, ok, "DB recipe must emit %s", key)
+	}
+}
+
+func TestDBRecipe_DatabaseURLParsesAsPostgres(t *testing.T) {
+	lines := recipes.DB{}.Generate()
+	byKey := linesByKey(t, lines)
+	parsed, err := url.Parse(byKey["DATABASE_URL"].Value)
+	require.NoError(t, err)
+	require.Equal(t, "postgres", parsed.Scheme)
+	require.Equal(t, "db.internal:5432", parsed.Host)
+	require.Equal(t, "/app_prod", parsed.Path)
+	require.Equal(t, "app_writer", parsed.User.Username())
+
+	pw, ok := parsed.User.Password()
+	require.True(t, ok, "DATABASE_URL must carry a password")
+	require.Regexp(t, `^[A-Za-z0-9]{24}$`, pw)
+	require.Equal(t, "require", parsed.Query().Get("sslmode"))
+}
+
+func TestDBRecipe_RedisURLParsesAsRedis(t *testing.T) {
+	lines := recipes.DB{}.Generate()
+	byKey := linesByKey(t, lines)
+	parsed, err := url.Parse(byKey["REDIS_URL"].Value)
+	require.NoError(t, err)
+	require.Equal(t, "redis", parsed.Scheme)
+	require.Equal(t, "cache-prod.internal:6379", parsed.Host)
+	require.Equal(t, "/0", parsed.Path)
+	require.Equal(t, "default", parsed.User.Username())
+
+	pw, ok := parsed.User.Password()
+	require.True(t, ok, "REDIS_URL must carry a password")
+	require.Regexp(t, `^[A-Za-z0-9]{32}$`, pw)
+}
+
+func TestDBRecipe_HasLeadingComment(t *testing.T) {
+	lines := recipes.DB{}.Generate()
+	require.NotEmpty(t, lines)
+	require.NotEmpty(t, lines[0].Comment)
+	require.Empty(t, lines[0].Key)
+}
+
+func TestDBRecipe_DistinctInvocationsProduceDistinctPasswords(t *testing.T) {
+	seen := make(map[string]struct{})
+	for range 20 {
+		lines := recipes.DB{}.Generate()
+		byKey := linesByKey(t, lines)
+		seen[byKey["DATABASE_URL"].Value] = struct{}{}
+	}
+	require.Greater(t, len(seen), 18)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/github.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/github.go
new file mode 100644
index 00000000..2bcf2574
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/github.go
@@ -0,0 +1,42 @@
+// ©AngelaMos | 2026
+// github.go
+
+package recipes
+
+const (
+	githubTokenPrefix    = "ghp_"
+	githubTokenBodyLen   = 36
+	githubChecksumLen    = 6
+	githubDeployKeyBytes = 32
+
+	githubOwnerName = "acme-corp"
+	githubRepoName  = "internal-platform"
+)
+
+type GitHub struct{}
+
+func (GitHub) Name() string { return keyGitHub }
+
+func (GitHub) Generate() []EnvLine {
+	body := RandomAlnumMixed(githubTokenBodyLen)
+	checksum := RandomAlnumMixed(githubChecksumLen)
+	return []EnvLine{
+		{Comment: "GitHub deploy + automation tokens"},
+		{
+			Key:   "GITHUB_TOKEN",
+			Value: githubTokenPrefix + body + checksum,
+		},
+		{
+			Key:   "GITHUB_DEPLOY_KEY",
+			Value: RandomBase64(githubDeployKeyBytes),
+		},
+		{
+			Key:   "GITHUB_OWNER",
+			Value: githubOwnerName,
+		},
+		{
+			Key:   "GITHUB_REPO",
+			Value: githubRepoName,
+		},
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/github_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/github_test.go
new file mode 100644
index 00000000..7199a857
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/github_test.go
@@ -0,0 +1,66 @@
+// ©AngelaMos | 2026
+// github_test.go
+
+package recipes_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/envfile/recipes"
+)
+
+func TestGitHubRecipe_Name(t *testing.T) {
+	require.Equal(t, "github", recipes.GitHub{}.Name())
+}
+
+func TestGitHubRecipe_GeneratesExpectedKeys(t *testing.T) {
+	lines := recipes.GitHub{}.Generate()
+	byKey := linesByKey(t, lines)
+
+	for _, key := range []string{
+		"GITHUB_TOKEN",
+		"GITHUB_DEPLOY_KEY",
+		"GITHUB_OWNER",
+		"GITHUB_REPO",
+	} {
+		_, ok := byKey[key]
+		require.True(t, ok, "GitHub recipe must emit %s", key)
+	}
+}
+
+func TestGitHubRecipe_TokenMatchesGhpFormat(t *testing.T) {
+	lines := recipes.GitHub{}.Generate()
+	byKey := linesByKey(t, lines)
+	require.Regexp(
+		t,
+		`^ghp_[A-Za-z0-9]{42}$`,
+		byKey["GITHUB_TOKEN"].Value,
+		"GITHUB_TOKEN must match ghp_ + 36 base62 body + 6 base62 checksum = 42 trailing chars",
+	)
+}
+
+func TestGitHubRecipe_DeployKeyIsBase64Like(t *testing.T) {
+	lines := recipes.GitHub{}.Generate()
+	byKey := linesByKey(t, lines)
+	require.Regexp(
+		t,
+		`^[A-Za-z0-9+/]+={0,2}$`,
+		byKey["GITHUB_DEPLOY_KEY"].Value,
+	)
+}
+
+func TestGitHubRecipe_OwnerAndRepoAreStable(t *testing.T) {
+	lines := recipes.GitHub{}.Generate()
+	byKey := linesByKey(t, lines)
+	require.Equal(t, "acme-corp", byKey["GITHUB_OWNER"].Value)
+	require.Equal(t, "internal-platform", byKey["GITHUB_REPO"].Value)
+}
+
+func TestGitHubRecipe_HasLeadingComment(t *testing.T) {
+	lines := recipes.GitHub{}.Generate()
+	require.NotEmpty(t, lines)
+	require.NotEmpty(t, lines[0].Comment)
+	require.Empty(t, lines[0].Key)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/recipes.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/recipes.go
new file mode 100644
index 00000000..a37cb0d5
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/recipes.go
@@ -0,0 +1,105 @@
+// ©AngelaMos | 2026
+// recipes.go
+
+package recipes
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"math/big"
+	"sort"
+)
+
+const (
+	alphaUpperAlnum = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+	alphaMixedAlnum = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
+	alphaHexLower   = "0123456789abcdef"
+
+	keyAWS    = "aws"
+	keyStripe = "stripe"
+	keyGitHub = "github"
+	keyDB     = "db"
+)
+
+type EnvLine struct {
+	Comment string
+	Key     string
+	Value   string
+}
+
+type Recipe interface {
+	Name() string
+	Generate() []EnvLine
+}
+
+var registry = map[string]Recipe{
+	keyAWS:    AWS{},
+	keyStripe: Stripe{},
+	keyGitHub: GitHub{},
+	keyDB:     DB{},
+}
+
+func Get(key string) (Recipe, bool) {
+	r, ok := registry[key]
+	return r, ok
+}
+
+func AvailableKeys() []string {
+	keys := make([]string, 0, len(registry))
+	for k := range registry {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+func RandomAlnumUpper(length int) string {
+	return randomString(alphaUpperAlnum, length)
+}
+
+func RandomAlnumMixed(length int) string {
+	return randomString(alphaMixedAlnum, length)
+}
+
+func RandomHexLower(length int) string {
+	return randomString(alphaHexLower, length)
+}
+
+func RandomBase64(byteCount int) string {
+	if byteCount <= 0 {
+		return ""
+	}
+	buf := make([]byte, byteCount)
+	if _, err := rand.Read(buf); err != nil {
+		return ""
+	}
+	return base64.StdEncoding.EncodeToString(buf)
+}
+
+func RandomChoice(choices []string) string {
+	if len(choices) == 0 {
+		return ""
+	}
+	idx, err := rand.Int(rand.Reader, big.NewInt(int64(len(choices))))
+	if err != nil {
+		return choices[0]
+	}
+	return choices[idx.Int64()]
+}
+
+func randomString(alphabet string, length int) string {
+	if length <= 0 || alphabet == "" {
+		return ""
+	}
+	out := make([]byte, length)
+	bigLen := big.NewInt(int64(len(alphabet)))
+	for i := range out {
+		idx, err := rand.Int(rand.Reader, bigLen)
+		if err != nil {
+			out[i] = alphabet[0]
+			continue
+		}
+		out[i] = alphabet[idx.Int64()]
+	}
+	return string(out)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/recipes_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/recipes_test.go
new file mode 100644
index 00000000..7542b978
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/recipes_test.go
@@ -0,0 +1,99 @@
+// ©AngelaMos | 2026
+// recipes_test.go
+
+package recipes_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/envfile/recipes"
+)
+
+func TestGet_KnownKeysReturnRecipes(t *testing.T) {
+	for _, name := range []string{"aws", "stripe", "github", "db"} {
+		r, ok := recipes.Get(name)
+		require.True(t, ok, "Get(%q) must return a recipe", name)
+		require.NotNil(t, r)
+		require.Equal(t, name, r.Name())
+	}
+}
+
+func TestGet_UnknownKeyReturnsFalse(t *testing.T) {
+	r, ok := recipes.Get("nonexistent")
+	require.False(t, ok)
+	require.Nil(t, r)
+}
+
+func TestAvailableKeys_ReturnsSortedSnapshot(t *testing.T) {
+	keys := recipes.AvailableKeys()
+	require.Equal(t, []string{"aws", "db", "github", "stripe"}, keys)
+}
+
+func TestRandomAlnumUpper_LengthAndAlphabet(t *testing.T) {
+	got := recipes.RandomAlnumUpper(20)
+	require.Len(t, got, 20)
+	require.Regexp(t, `^[A-Z0-9]{20}$`, got)
+}
+
+func TestRandomAlnumUpper_ZeroAndNegativeReturnEmpty(t *testing.T) {
+	require.Empty(t, recipes.RandomAlnumUpper(0))
+	require.Empty(t, recipes.RandomAlnumUpper(-1))
+}
+
+func TestRandomAlnumMixed_LengthAndAlphabet(t *testing.T) {
+	got := recipes.RandomAlnumMixed(50)
+	require.Len(t, got, 50)
+	require.Regexp(t, `^[A-Za-z0-9]{50}$`, got)
+}
+
+func TestRandomHexLower_LengthAndAlphabet(t *testing.T) {
+	got := recipes.RandomHexLower(32)
+	require.Len(t, got, 32)
+	require.Regexp(t, `^[0-9a-f]{32}$`, got)
+}
+
+func TestRandomBase64_DecodesToRequestedBytes(t *testing.T) {
+	got := recipes.RandomBase64(30)
+	require.NotEmpty(t, got)
+	require.Regexp(t, `^[A-Za-z0-9+/]+={0,2}$`, got)
+}
+
+func TestRandomBase64_ZeroReturnsEmpty(t *testing.T) {
+	require.Empty(t, recipes.RandomBase64(0))
+	require.Empty(t, recipes.RandomBase64(-5))
+}
+
+func TestRandomChoice_ReturnsOneOf(t *testing.T) {
+	choices := []string{"a", "b", "c", "d", "e"}
+	for range 50 {
+		got := recipes.RandomChoice(choices)
+		require.Contains(t, choices, got)
+	}
+}
+
+func TestRandomChoice_EmptyReturnsEmpty(t *testing.T) {
+	require.Empty(t, recipes.RandomChoice(nil))
+	require.Empty(t, recipes.RandomChoice([]string{}))
+}
+
+func TestRandomChoice_SingleElementAlwaysReturnsIt(t *testing.T) {
+	choices := []string{"only"}
+	for range 20 {
+		require.Equal(t, "only", recipes.RandomChoice(choices))
+	}
+}
+
+func TestRandomness_RepeatedCallsProduceDistinctValues(t *testing.T) {
+	seen := make(map[string]struct{})
+	for range 100 {
+		seen[recipes.RandomAlnumMixed(20)] = struct{}{}
+	}
+	require.Greater(
+		t,
+		len(seen),
+		95,
+		"crypto/rand should produce near-100 distinct 20-char alnum strings out of 100",
+	)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/stripe.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/stripe.go
new file mode 100644
index 00000000..3255101b
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/stripe.go
@@ -0,0 +1,35 @@
+// ©AngelaMos | 2026
+// stripe.go
+
+package recipes
+
+const (
+	stripeSecretPrefix      = "sk_live_"
+	stripePublishablePrefix = "pk_live_"
+	stripeWebhookPrefix     = "whsec_"
+
+	stripeKeyBodyLen     = 24
+	stripeWebhookBodyLen = 32
+)
+
+type Stripe struct{}
+
+func (Stripe) Name() string { return keyStripe }
+
+func (Stripe) Generate() []EnvLine {
+	return []EnvLine{
+		{Comment: "Stripe production keys"},
+		{
+			Key:   "STRIPE_SECRET_KEY",
+			Value: stripeSecretPrefix + RandomAlnumMixed(stripeKeyBodyLen),
+		},
+		{
+			Key:   "STRIPE_PUBLISHABLE_KEY",
+			Value: stripePublishablePrefix + RandomAlnumMixed(stripeKeyBodyLen),
+		},
+		{
+			Key:   "STRIPE_WEBHOOK_SECRET",
+			Value: stripeWebhookPrefix + RandomAlnumMixed(stripeWebhookBodyLen),
+		},
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/stripe_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/stripe_test.go
new file mode 100644
index 00000000..feb939c6
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/envfile/recipes/stripe_test.go
@@ -0,0 +1,78 @@
+// ©AngelaMos | 2026
+// stripe_test.go
+
+package recipes_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/envfile/recipes"
+)
+
+func TestStripeRecipe_Name(t *testing.T) {
+	require.Equal(t, "stripe", recipes.Stripe{}.Name())
+}
+
+func TestStripeRecipe_GeneratesExpectedKeys(t *testing.T) {
+	lines := recipes.Stripe{}.Generate()
+	byKey := linesByKey(t, lines)
+
+	for _, key := range []string{
+		"STRIPE_SECRET_KEY",
+		"STRIPE_PUBLISHABLE_KEY",
+		"STRIPE_WEBHOOK_SECRET",
+	} {
+		_, ok := byKey[key]
+		require.True(t, ok, "Stripe recipe must emit %s", key)
+	}
+}
+
+func TestStripeRecipe_SecretKeyMatchesLiveFormat(t *testing.T) {
+	lines := recipes.Stripe{}.Generate()
+	byKey := linesByKey(t, lines)
+	require.Regexp(
+		t,
+		`^sk_live_[A-Za-z0-9]{24}$`,
+		byKey["STRIPE_SECRET_KEY"].Value,
+	)
+}
+
+func TestStripeRecipe_PublishableKeyMatchesLiveFormat(t *testing.T) {
+	lines := recipes.Stripe{}.Generate()
+	byKey := linesByKey(t, lines)
+	require.Regexp(
+		t,
+		`^pk_live_[A-Za-z0-9]{24}$`,
+		byKey["STRIPE_PUBLISHABLE_KEY"].Value,
+	)
+}
+
+func TestStripeRecipe_WebhookSecretMatchesFormat(t *testing.T) {
+	lines := recipes.Stripe{}.Generate()
+	byKey := linesByKey(t, lines)
+	require.Regexp(
+		t,
+		`^whsec_[A-Za-z0-9]{32}$`,
+		byKey["STRIPE_WEBHOOK_SECRET"].Value,
+	)
+}
+
+func TestStripeRecipe_HasLeadingComment(t *testing.T) {
+	lines := recipes.Stripe{}.Generate()
+	require.NotEmpty(t, lines)
+	require.NotEmpty(t, lines[0].Comment)
+	require.Empty(t, lines[0].Key)
+}
+
+func TestStripeRecipe_KeysAreDistinct(t *testing.T) {
+	lines := recipes.Stripe{}.Generate()
+	byKey := linesByKey(t, lines)
+	require.NotEqual(
+		t,
+		byKey["STRIPE_SECRET_KEY"].Value,
+		byKey["STRIPE_PUBLISHABLE_KEY"].Value,
+		"secret and publishable keys must have different random bodies",
+	)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/generator.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/generator.go
new file mode 100644
index 00000000..604e436d
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/generator.go
@@ -0,0 +1,23 @@
+// ©AngelaMos | 2026
+// generator.go
+
+package generators
+
+import (
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+)
+
+type ArtifactKind = token.ArtifactKind
+
+const (
+	KindURL              = token.KindURL
+	KindFile             = token.KindFile
+	KindText             = token.KindText
+	KindConnectionString = token.KindConnectionString
+)
+
+type Artifact = token.Artifact
+
+type TriggerResponse = token.TriggerResponse
+
+type Generator = token.Generator
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/kubeconfig/generator.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/kubeconfig/generator.go
new file mode 100644
index 00000000..fc63f5bc
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/kubeconfig/generator.go
@@ -0,0 +1,89 @@
+// ©AngelaMos | 2026
+// generator.go
+
+package kubeconfig
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"fmt"
+	"strings"
+	"text/template"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators"
+)
+
+const (
+	triggerPathPrefix = "/k/"
+
+	contentTypeYAML = "application/yaml"
+	defaultFilename = "kubeconfig"
+
+	defaultClusterName = "prod-cluster"
+	defaultUserName    = "svc-backup-reader"
+
+	templateName = "kubeconfig"
+)
+
+//go:embed template.yaml.tmpl
+var templateYAML string
+
+var kubeconfigTemplate = template.Must(
+	template.New(templateName).Parse(templateYAML),
+)
+
+type kubeconfigData struct {
+	APIServerURL string
+	Token        string
+	ClusterName  string
+	UserName     string
+}
+
+type Generator struct{}
+
+func New() *Generator { return &Generator{} }
+
+func (g *Generator) Type() token.Type { return token.TypeKubeconfig }
+
+func (g *Generator) Generate(
+	_ context.Context,
+	t *token.Token,
+	baseURL string,
+) (generators.Artifact, error) {
+	apiServerURL := strings.TrimRight(baseURL, "/") +
+		triggerPathPrefix + t.ID
+	data := kubeconfigData{
+		APIServerURL: apiServerURL,
+		Token:        t.ID,
+		ClusterName:  defaultClusterName,
+		UserName:     defaultUserName,
+	}
+
+	var buf bytes.Buffer
+	if err := kubeconfigTemplate.Execute(&buf, data); err != nil {
+		return generators.Artifact{}, fmt.Errorf(
+			"kubeconfig: render template: %w",
+			err,
+		)
+	}
+
+	return generators.Artifact{
+		Kind:        generators.KindText,
+		Filename:    resolveFilename(t.Filename),
+		Content:     buf.Bytes(),
+		ContentType: contentTypeYAML,
+	}, nil
+}
+
+func resolveFilename(name *string) string {
+	if name == nil {
+		return defaultFilename
+	}
+	trimmed := strings.TrimSpace(*name)
+	if trimmed == "" {
+		return defaultFilename
+	}
+	return trimmed
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/kubeconfig/generator_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/kubeconfig/generator_test.go
new file mode 100644
index 00000000..a8db3b46
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/kubeconfig/generator_test.go
@@ -0,0 +1,292 @@
+// ©AngelaMos | 2026
+// generator_test.go
+
+package kubeconfig_test
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/kubeconfig"
+)
+
+const (
+	testBaseURL             = "https://canary.example.com"
+	expectedKubeconfigMIME  = "application/yaml"
+	defaultFilenameValue    = "kubeconfig"
+	defaultClusterNameValue = "prod-cluster"
+	defaultUserNameValue    = "svc-backup-reader"
+)
+
+type kubeconfigSchema struct {
+	APIVersion     string `yaml:"apiVersion"`
+	Kind           string `yaml:"kind"`
+	CurrentContext string `yaml:"current-context"`
+	Clusters       []struct {
+		Name    string `yaml:"name"`
+		Cluster struct {
+			Server string `yaml:"server"`
+		} `yaml:"cluster"`
+	} `yaml:"clusters"`
+	Contexts []struct {
+		Name    string `yaml:"name"`
+		Context struct {
+			Cluster string `yaml:"cluster"`
+			User    string `yaml:"user"`
+		} `yaml:"context"`
+	} `yaml:"contexts"`
+	Users []struct {
+		Name string `yaml:"name"`
+		User struct {
+			Token string `yaml:"token"`
+		} `yaml:"user"`
+	} `yaml:"users"`
+}
+
+func newKubeconfigToken(id string) *token.Token {
+	return &token.Token{
+		ID:           id,
+		ManageID:     "manage-" + id,
+		Type:         token.TypeKubeconfig,
+		Memo:         "unit test kubeconfig",
+		AlertChannel: token.ChannelWebhook,
+		Enabled:      true,
+	}
+}
+
+func newKubeconfigTokenWithFilename(id, filename string) *token.Token {
+	tok := newKubeconfigToken(id)
+	tok.Filename = &filename
+	return tok
+}
+
+func parseKubeconfig(t *testing.T, content []byte) kubeconfigSchema {
+	t.Helper()
+	var kc kubeconfigSchema
+	require.NoError(
+		t,
+		yaml.Unmarshal(content, &kc),
+		"generated kubeconfig must parse as YAML",
+	)
+	return kc
+}
+
+func TestGenerator_TypeIsKubeconfig(t *testing.T) {
+	g := kubeconfig.New()
+	require.Equal(t, token.TypeKubeconfig, g.Type())
+}
+
+func TestGenerate_ArtifactKindIsText(t *testing.T) {
+	g := kubeconfig.New()
+	art, err := g.Generate(
+		context.Background(),
+		newKubeconfigToken("abc"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+	require.Equal(t, generators.KindText, art.Kind)
+}
+
+func TestGenerate_ContentTypeIsYAML(t *testing.T) {
+	g := kubeconfig.New()
+	art, err := g.Generate(
+		context.Background(),
+		newKubeconfigToken("abc"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+	require.Equal(t, expectedKubeconfigMIME, art.ContentType)
+}
+
+func TestGenerate_Filename(t *testing.T) {
+	g := kubeconfig.New()
+
+	t.Run("nil Filename defaults to kubeconfig", func(t *testing.T) {
+		art, err := g.Generate(
+			context.Background(),
+			newKubeconfigToken("abc"),
+			testBaseURL,
+		)
+		require.NoError(t, err)
+		require.Equal(t, defaultFilenameValue, art.Filename)
+	})
+
+	t.Run(
+		"empty Filename pointer defaults to kubeconfig",
+		func(t *testing.T) {
+			art, err := g.Generate(
+				context.Background(),
+				newKubeconfigTokenWithFilename("abc", ""),
+				testBaseURL,
+			)
+			require.NoError(t, err)
+			require.Equal(t, defaultFilenameValue, art.Filename)
+		},
+	)
+
+	t.Run(
+		"whitespace-only Filename defaults to kubeconfig",
+		func(t *testing.T) {
+			art, err := g.Generate(
+				context.Background(),
+				newKubeconfigTokenWithFilename("abc", "   "),
+				testBaseURL,
+			)
+			require.NoError(t, err)
+			require.Equal(t, defaultFilenameValue, art.Filename)
+		},
+	)
+
+	t.Run("set Filename is preserved (trimmed)", func(t *testing.T) {
+		art, err := g.Generate(
+			context.Background(),
+			newKubeconfigTokenWithFilename("abc", "  prod-kubeconfig  "),
+			testBaseURL,
+		)
+		require.NoError(t, err)
+		require.Equal(t, "prod-kubeconfig", art.Filename)
+	})
+}
+
+func TestGenerate_APIServerURL(t *testing.T) {
+	g := kubeconfig.New()
+
+	t.Run("base URL trailing slash trimmed", func(t *testing.T) {
+		artA, err := g.Generate(
+			context.Background(),
+			newKubeconfigToken("tk1"),
+			"https://canary.example.com",
+		)
+		require.NoError(t, err)
+		artB, err := g.Generate(
+			context.Background(),
+			newKubeconfigToken("tk1"),
+			"https://canary.example.com/",
+		)
+		require.NoError(t, err)
+
+		kcA := parseKubeconfig(t, artA.Content)
+		kcB := parseKubeconfig(t, artB.Content)
+		require.Len(t, kcA.Clusters, 1)
+		require.Len(t, kcB.Clusters, 1)
+		require.Equal(
+			t,
+			"https://canary.example.com/k/tk1",
+			kcA.Clusters[0].Cluster.Server,
+		)
+		require.Equal(
+			t,
+			"https://canary.example.com/k/tk1",
+			kcB.Clusters[0].Cluster.Server,
+		)
+	})
+
+	t.Run("base URL subpath preserved", func(t *testing.T) {
+		art, err := g.Generate(
+			context.Background(),
+			newKubeconfigToken("tk2"),
+			"https://example.com/canary",
+		)
+		require.NoError(t, err)
+		kc := parseKubeconfig(t, art.Content)
+		require.Len(t, kc.Clusters, 1)
+		require.Equal(
+			t,
+			"https://example.com/canary/k/tk2",
+			kc.Clusters[0].Cluster.Server,
+		)
+	})
+
+	t.Run(
+		"different token ids produce distinct outputs",
+		func(t *testing.T) {
+			artA, err := g.Generate(
+				context.Background(),
+				newKubeconfigToken("aaa"),
+				testBaseURL,
+			)
+			require.NoError(t, err)
+			artB, err := g.Generate(
+				context.Background(),
+				newKubeconfigToken("bbb"),
+				testBaseURL,
+			)
+			require.NoError(t, err)
+			require.NotEqual(t, artA.Content, artB.Content)
+		},
+	)
+}
+
+func TestGenerate_YAMLParsesAsKubeconfig(t *testing.T) {
+	g := kubeconfig.New()
+	art, err := g.Generate(
+		context.Background(),
+		newKubeconfigToken("abc123"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+
+	kc := parseKubeconfig(t, art.Content)
+
+	require.Equal(t, "v1", kc.APIVersion)
+	require.Equal(t, "Config", kc.Kind)
+	require.Equal(t, defaultClusterNameValue, kc.CurrentContext)
+
+	require.Len(t, kc.Clusters, 1)
+	require.Equal(t, defaultClusterNameValue, kc.Clusters[0].Name)
+	require.Equal(
+		t,
+		"https://canary.example.com/k/abc123",
+		kc.Clusters[0].Cluster.Server,
+	)
+
+	require.Len(t, kc.Contexts, 1)
+	require.Equal(t, defaultClusterNameValue, kc.Contexts[0].Name)
+	require.Equal(
+		t,
+		defaultClusterNameValue,
+		kc.Contexts[0].Context.Cluster,
+	)
+	require.Equal(t, defaultUserNameValue, kc.Contexts[0].Context.User)
+
+	require.Len(t, kc.Users, 1)
+	require.Equal(t, defaultUserNameValue, kc.Users[0].Name)
+	require.Equal(t, "abc123", kc.Users[0].User.Token)
+}
+
+func TestGenerate_TokenIDEmbeddedAsBearer(t *testing.T) {
+	g := kubeconfig.New()
+	art, err := g.Generate(
+		context.Background(),
+		newKubeconfigToken("super-secret-bearer-id"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+	require.Contains(
+		t,
+		string(art.Content),
+		"super-secret-bearer-id",
+		"kubeconfig must embed the token ID as the bearer token",
+	)
+}
+
+func TestGenerate_ContentEndsWithNewline(t *testing.T) {
+	g := kubeconfig.New()
+	art, err := g.Generate(
+		context.Background(),
+		newKubeconfigToken("abc"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+	require.True(
+		t,
+		strings.HasSuffix(string(art.Content), "\n"),
+		"generated YAML must end with a newline (POSIX convention)",
+	)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/kubeconfig/handler.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/kubeconfig/handler.go
new file mode 100644
index 00000000..0d974032
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/kubeconfig/handler.go
@@ -0,0 +1,160 @@
+// ©AngelaMos | 2026
+// handler.go
+
+package kubeconfig
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"path"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/middleware"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators"
+)
+
+const (
+	headerReferer      = "Referer"
+	headerUserAgent    = "User-Agent"
+	headerCacheControl = "Cache-Control"
+	headerPragma       = "Pragma"
+
+	cacheControlNoStore = "no-store, no-cache, must-revalidate, max-age=0"
+	pragmaNoCache       = "no-cache"
+	contentTypeJSON     = "application/json"
+
+	statusKind       = "Status"
+	statusAPIVersion = "v1"
+	statusFailure    = "Failure"
+	statusReason     = "Forbidden"
+	statusMessageFmt = `%s is forbidden: User "system:anonymous" cannot %s resource "%s" in API group "" in the namespace "default"`
+
+	defaultResource = "resource"
+
+	verbList   = "list"
+	verbCreate = "create"
+	verbUpdate = "update"
+	verbPatch  = "patch"
+	verbDelete = "delete"
+
+	extraKubectlPath   = "kubectl_path"
+	extraKubectlMethod = "kubectl_method"
+	extraKubectlQuery  = "kubectl_query"
+	extraKubectlUA     = "kubectl_ua"
+)
+
+type kubernetesStatus struct {
+	Kind       string         `json:"kind"`
+	APIVersion string         `json:"apiVersion"`
+	Metadata   statusMetadata `json:"metadata"`
+	Status     string         `json:"status"`
+	Message    string         `json:"message"`
+	Reason     string         `json:"reason"`
+	Code       int            `json:"code"`
+}
+
+type statusMetadata struct{}
+
+func (g *Generator) Trigger(
+	_ context.Context,
+	t *token.Token,
+	r *http.Request,
+) (*event.Event, *generators.TriggerResponse, error) {
+	resource := resourceFromPath(r.URL.Path)
+	verb := verbFromMethod(r.Method)
+
+	body, err := buildForbiddenBody(resource, verb)
+	if err != nil {
+		return nil, nil, fmt.Errorf(
+			"kubeconfig: build forbidden response: %w",
+			err,
+		)
+	}
+
+	resp := &generators.TriggerResponse{
+		StatusCode:  http.StatusForbidden,
+		ContentType: contentTypeJSON,
+		Body:        body,
+		ExtraHeaders: map[string]string{
+			headerCacheControl: cacheControlNoStore,
+			headerPragma:       pragmaNoCache,
+		},
+	}
+
+	if t == nil {
+		return nil, resp, nil
+	}
+
+	extra, err := buildKubectlExtra(r)
+	if err != nil {
+		return nil, nil, fmt.Errorf(
+			"kubeconfig: build event extra: %w",
+			err,
+		)
+	}
+
+	evt := &event.Event{
+		TokenID:   t.ID,
+		SourceIP:  middleware.RealIP(r),
+		UserAgent: middleware.OptionalHeader(r.UserAgent()),
+		Referer:   middleware.OptionalHeader(r.Header.Get(headerReferer)),
+		Extra:     extra,
+	}
+	return evt, resp, nil
+}
+
+func buildForbiddenBody(resource, verb string) ([]byte, error) {
+	s := kubernetesStatus{
+		Kind:       statusKind,
+		APIVersion: statusAPIVersion,
+		Status:     statusFailure,
+		Message:    fmt.Sprintf(statusMessageFmt, resource, verb, resource),
+		Reason:     statusReason,
+		Code:       http.StatusForbidden,
+	}
+	body, err := json.Marshal(s)
+	if err != nil {
+		return nil, fmt.Errorf("marshal kubernetes status: %w", err)
+	}
+	return body, nil
+}
+
+func buildKubectlExtra(r *http.Request) (json.RawMessage, error) {
+	extra := map[string]string{
+		extraKubectlPath:   r.URL.Path,
+		extraKubectlMethod: r.Method,
+		extraKubectlQuery:  r.URL.RawQuery,
+		extraKubectlUA:     r.Header.Get(headerUserAgent),
+	}
+	body, err := json.Marshal(extra)
+	if err != nil {
+		return nil, fmt.Errorf("marshal kubectl extra: %w", err)
+	}
+	return body, nil
+}
+
+func resourceFromPath(urlPath string) string {
+	last := path.Base(urlPath)
+	if last == "" || last == "/" || last == "." {
+		return defaultResource
+	}
+	return last
+}
+
+func verbFromMethod(method string) string {
+	switch method {
+	case http.MethodPost:
+		return verbCreate
+	case http.MethodPut:
+		return verbUpdate
+	case http.MethodPatch:
+		return verbPatch
+	case http.MethodDelete:
+		return verbDelete
+	default:
+		return verbList
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/kubeconfig/handler_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/kubeconfig/handler_test.go
new file mode 100644
index 00000000..91f957c4
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/kubeconfig/handler_test.go
@@ -0,0 +1,518 @@
+// ©AngelaMos | 2026
+// handler_test.go
+
+package kubeconfig_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/kubeconfig"
+)
+
+const (
+	cacheControlNoStoreValue = "no-store, no-cache, must-revalidate, max-age=0"
+	pragmaNoCacheValue       = "no-cache"
+	expectedResponseMIME     = "application/json"
+)
+
+type k8sStatusResponse struct {
+	Kind       string                 `json:"kind"`
+	APIVersion string                 `json:"apiVersion"`
+	Metadata   map[string]interface{} `json:"metadata"`
+	Status     string                 `json:"status"`
+	Message    string                 `json:"message"`
+	Reason     string                 `json:"reason"`
+	Code       int                    `json:"code"`
+}
+
+type kubectlExtra struct {
+	KubectlPath   string `json:"kubectl_path"`
+	KubectlMethod string `json:"kubectl_method"`
+	KubectlQuery  string `json:"kubectl_query"`
+	KubectlUA     string `json:"kubectl_ua"`
+}
+
+func parseStatus(t *testing.T, body []byte) k8sStatusResponse {
+	t.Helper()
+	var s k8sStatusResponse
+	require.NoError(
+		t,
+		json.Unmarshal(body, &s),
+		"response body must be valid Kubernetes Status JSON",
+	)
+	return s
+}
+
+func parseKubectlExtra(t *testing.T, raw json.RawMessage) kubectlExtra {
+	t.Helper()
+	var k kubectlExtra
+	require.NoError(t, json.Unmarshal(raw, &k))
+	return k
+}
+
+func TestTrigger_ResponseStatusCodeIs403(t *testing.T) {
+	g := kubeconfig.New()
+	tok := newKubeconfigToken("abc")
+	r := httptest.NewRequest(http.MethodGet, "/k/abc/api/v1/pods", nil)
+
+	_, resp, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+}
+
+func TestTrigger_ResponseContentTypeIsJSON(t *testing.T) {
+	g := kubeconfig.New()
+	tok := newKubeconfigToken("abc")
+	r := httptest.NewRequest(http.MethodGet, "/k/abc/api/v1/pods", nil)
+
+	_, resp, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+	require.Equal(t, expectedResponseMIME, resp.ContentType)
+}
+
+func TestTrigger_CacheHeadersSet(t *testing.T) {
+	g := kubeconfig.New()
+	tok := newKubeconfigToken("abc")
+	r := httptest.NewRequest(http.MethodGet, "/k/abc/api/v1/pods", nil)
+
+	_, resp, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+	require.Equal(
+		t,
+		cacheControlNoStoreValue,
+		resp.ExtraHeaders["Cache-Control"],
+	)
+	require.Equal(t, pragmaNoCacheValue, resp.ExtraHeaders["Pragma"])
+}
+
+func TestTrigger_ResponseIsValidKubernetesStatus(t *testing.T) {
+	g := kubeconfig.New()
+	tok := newKubeconfigToken("abc")
+	r := httptest.NewRequest(http.MethodGet, "/k/abc/api/v1/pods", nil)
+
+	_, resp, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+
+	s := parseStatus(t, resp.Body)
+	require.Equal(t, "Status", s.Kind)
+	require.Equal(t, "v1", s.APIVersion)
+	require.NotNil(t, s.Metadata)
+	require.Empty(t, s.Metadata, "metadata must be empty object {}")
+	require.Equal(t, "Failure", s.Status)
+	require.Equal(t, "Forbidden", s.Reason)
+	require.Equal(t, http.StatusForbidden, s.Code)
+}
+
+func TestTrigger_MessageUsesPathLastSegmentAsResource(t *testing.T) {
+	g := kubeconfig.New()
+	tok := newKubeconfigToken("abc")
+
+	cases := []struct {
+		name     string
+		path     string
+		wantWord string
+	}{
+		{
+			name:     "pods endpoint",
+			path:     "/k/abc/api/v1/namespaces/default/pods",
+			wantWord: "pods",
+		},
+		{
+			name:     "secrets endpoint",
+			path:     "/k/abc/api/v1/secrets",
+			wantWord: "secrets",
+		},
+		{
+			name:     "single-resource get",
+			path:     "/k/abc/api/v1/namespaces/default/pods/web-1",
+			wantWord: "web-1",
+		},
+		{
+			name:     "api version probe",
+			path:     "/k/abc/api/v1",
+			wantWord: "v1",
+		},
+		{
+			name:     "trailing slash path falls back to default",
+			path:     "/k/abc/",
+			wantWord: "abc",
+		},
+		{
+			name:     "non-resource healthz probe",
+			path:     "/k/abc/healthz",
+			wantWord: "healthz",
+		},
+	}
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, tc.path, nil)
+			_, resp, err := g.Trigger(context.Background(), tok, r)
+			require.NoError(t, err)
+			s := parseStatus(t, resp.Body)
+			require.Contains(
+				t,
+				s.Message,
+				tc.wantWord+` is forbidden`,
+				"message must lead with the resource name",
+			)
+			require.Contains(
+				t,
+				s.Message,
+				`resource "`+tc.wantWord+`"`,
+				"message must repeat the resource name in the resource clause",
+			)
+		})
+	}
+}
+
+func TestTrigger_MessageVerbDerivedFromHTTPMethod(t *testing.T) {
+	g := kubeconfig.New()
+	tok := newKubeconfigToken("abc")
+
+	cases := []struct {
+		method   string
+		wantVerb string
+	}{
+		{http.MethodGet, "list"},
+		{http.MethodHead, "list"},
+		{http.MethodPost, "create"},
+		{http.MethodPut, "update"},
+		{http.MethodPatch, "patch"},
+		{http.MethodDelete, "delete"},
+		{http.MethodOptions, "list"},
+	}
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.method, func(t *testing.T) {
+			r := httptest.NewRequest(
+				tc.method,
+				"/k/abc/api/v1/pods",
+				nil,
+			)
+			_, resp, err := g.Trigger(context.Background(), tok, r)
+			require.NoError(t, err)
+			s := parseStatus(t, resp.Body)
+			require.Contains(
+				t,
+				s.Message,
+				`cannot `+tc.wantVerb+` resource`,
+				"message must use the verb mapped from the HTTP method",
+			)
+		})
+	}
+}
+
+func TestTrigger_MessageImpersonatesAnonymousUser(t *testing.T) {
+	g := kubeconfig.New()
+	tok := newKubeconfigToken("abc")
+	r := httptest.NewRequest(http.MethodGet, "/k/abc/api/v1/pods", nil)
+
+	_, resp, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+
+	s := parseStatus(t, resp.Body)
+	require.Contains(
+		t,
+		s.Message,
+		`User "system:anonymous"`,
+		"message must impersonate the anonymous user for verisimilitude",
+	)
+}
+
+func TestTrigger_RecordsEventWithRequestMetadata(t *testing.T) {
+	g := kubeconfig.New()
+	tok := newKubeconfigToken("token1")
+
+	t.Run(
+		"captures token id, source ip, user agent, referer",
+		func(t *testing.T) {
+			r := httptest.NewRequest(
+				http.MethodGet,
+				"/k/token1/api/v1/pods?watch=true",
+				nil,
+			)
+			r.Header.Set("CF-Connecting-IP", "203.0.113.50")
+			r.Header.Set(
+				"User-Agent",
+				"kubectl/v1.30.0 (linux/amd64) kubernetes/9b7f2dd",
+			)
+			r.Header.Set("Referer", "https://victim.example.com/dashboard")
+
+			evt, _, err := g.Trigger(context.Background(), tok, r)
+			require.NoError(t, err)
+			require.NotNil(t, evt)
+			require.Equal(t, "token1", evt.TokenID)
+			require.Equal(t, "203.0.113.50", evt.SourceIP)
+			require.NotNil(t, evt.UserAgent)
+			require.Equal(
+				t,
+				"kubectl/v1.30.0 (linux/amd64) kubernetes/9b7f2dd",
+				*evt.UserAgent,
+			)
+			require.NotNil(t, evt.Referer)
+			require.Equal(
+				t,
+				"https://victim.example.com/dashboard",
+				*evt.Referer,
+			)
+		},
+	)
+
+	t.Run("kubectl_* extra captured", func(t *testing.T) {
+		r := httptest.NewRequest(
+			http.MethodPost,
+			"/k/token1/api/v1/namespaces/default/pods?dryRun=All",
+			nil,
+		)
+		r.Header.Set("CF-Connecting-IP", "203.0.113.50")
+		r.Header.Set("User-Agent", "kubectl/v1.30.0")
+
+		evt, _, err := g.Trigger(context.Background(), tok, r)
+		require.NoError(t, err)
+		require.NotNil(t, evt)
+
+		extra := parseKubectlExtra(t, evt.Extra)
+		require.Equal(
+			t,
+			"/k/token1/api/v1/namespaces/default/pods",
+			extra.KubectlPath,
+		)
+		require.Equal(t, http.MethodPost, extra.KubectlMethod)
+		require.Equal(t, "dryRun=All", extra.KubectlQuery)
+		require.Equal(t, "kubectl/v1.30.0", extra.KubectlUA)
+	})
+
+	t.Run("missing query is empty string in extra", func(t *testing.T) {
+		r := httptest.NewRequest(
+			http.MethodGet,
+			"/k/token1/api/v1/pods",
+			nil,
+		)
+		evt, _, err := g.Trigger(context.Background(), tok, r)
+		require.NoError(t, err)
+		extra := parseKubectlExtra(t, evt.Extra)
+		require.Empty(t, extra.KubectlQuery)
+	})
+
+	t.Run("source ip precedence", func(t *testing.T) {
+		cases := []struct {
+			name    string
+			headers map[string]string
+			remote  string
+			wantIP  string
+		}{
+			{
+				name: "CF wins over XFF and XRI",
+				headers: map[string]string{
+					"CF-Connecting-IP": "203.0.113.10",
+					"X-Forwarded-For":  "198.51.100.1, 198.51.100.2",
+					"X-Real-IP":        "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "203.0.113.10",
+			},
+			{
+				name: "XFF leftmost wins over XRI when no CF",
+				headers: map[string]string{
+					"X-Forwarded-For": "198.51.100.1, 198.51.100.7",
+					"X-Real-IP":       "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "198.51.100.1",
+			},
+			{
+				name: "XFF trailing-comma falls through to last non-empty",
+				headers: map[string]string{
+					"X-Forwarded-For": "198.51.100.1, ",
+					"X-Real-IP":       "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "198.51.100.1",
+			},
+			{
+				name: "XFF entirely empty entries fall through to XRI",
+				headers: map[string]string{
+					"X-Forwarded-For": ", ,",
+					"X-Real-IP":       "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "192.0.2.99",
+			},
+			{
+				name: "XRI when no CF or XFF",
+				headers: map[string]string{
+					"X-Real-IP": "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "192.0.2.99",
+			},
+			{
+				name:    "RemoteAddr IPv4 strips port",
+				headers: nil,
+				remote:  "127.0.0.1:9999",
+				wantIP:  "127.0.0.1",
+			},
+			{
+				name:    "RemoteAddr IPv6 strips brackets and port",
+				headers: nil,
+				remote:  "[2001:db8::1]:54321",
+				wantIP:  "2001:db8::1",
+			},
+			{
+				name:    "RemoteAddr loopback IPv6 strips brackets and port",
+				headers: nil,
+				remote:  "[::1]:9999",
+				wantIP:  "::1",
+			},
+			{
+				name:    "RemoteAddr without port falls back to raw value",
+				headers: nil,
+				remote:  "127.0.0.1",
+				wantIP:  "127.0.0.1",
+			},
+			{
+				name: "XFF mixed IPv4+IPv6 leftmost",
+				headers: map[string]string{
+					"X-Forwarded-For": "198.51.100.1, 2001:db8::dead",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "198.51.100.1",
+			},
+			{
+				name: "CF value is trimmed of whitespace",
+				headers: map[string]string{
+					"CF-Connecting-IP": "  203.0.113.10  ",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "203.0.113.10",
+			},
+		}
+		for _, tc := range cases {
+			tc := tc
+			t.Run(tc.name, func(t *testing.T) {
+				r := httptest.NewRequest(
+					http.MethodGet,
+					"/k/token1/api/v1/pods",
+					nil,
+				)
+				for k, v := range tc.headers {
+					r.Header.Set(k, v)
+				}
+				r.RemoteAddr = tc.remote
+				evt, _, err := g.Trigger(context.Background(), tok, r)
+				require.NoError(t, err)
+				require.NotNil(t, evt)
+				require.Equal(t, tc.wantIP, evt.SourceIP)
+			})
+		}
+	})
+
+	t.Run(
+		"missing user agent and referer record as nil pointers",
+		func(t *testing.T) {
+			r := httptest.NewRequest(
+				http.MethodGet,
+				"/k/token1/api/v1/pods",
+				nil,
+			)
+			r.Header.Del("User-Agent")
+			r.Header.Del("Referer")
+			r.Header.Set("CF-Connecting-IP", "203.0.113.5")
+
+			evt, _, err := g.Trigger(context.Background(), tok, r)
+			require.NoError(t, err)
+			require.NotNil(t, evt)
+			require.Nil(
+				t,
+				evt.UserAgent,
+				"absent user agent must map to nil, not empty string",
+			)
+			require.Nil(
+				t,
+				evt.Referer,
+				"absent referer must map to nil, not empty string",
+			)
+		},
+	)
+}
+
+func TestTrigger_TokenNotFound_StillReturns403(t *testing.T) {
+	g := kubeconfig.New()
+	r := httptest.NewRequest(
+		http.MethodGet,
+		"/k/does-not-exist/api/v1/pods",
+		nil,
+	)
+	r.Header.Set("CF-Connecting-IP", "203.0.113.100")
+	r.Header.Set("User-Agent", "kubectl/v1.30.0")
+
+	evt, resp, err := g.Trigger(context.Background(), nil, r)
+	require.NoError(
+		t,
+		err,
+		"nil-token path must not error (spec §8.5 defense-in-depth)",
+	)
+	require.NotNil(t, resp)
+	require.Equal(
+		t,
+		http.StatusForbidden,
+		resp.StatusCode,
+		"nil-token still returns 403 so attackers cannot distinguish valid vs invalid tokens",
+	)
+	require.Equal(t, expectedResponseMIME, resp.ContentType)
+	require.NotEmpty(t, resp.Body)
+
+	s := parseStatus(t, resp.Body)
+	require.Equal(t, "Status", s.Kind)
+	require.Equal(t, "Failure", s.Status)
+
+	require.Nil(
+		t,
+		evt,
+		"nil-token path returns nil event so the handler cannot persist a row with empty TokenID (FK violation)",
+	)
+}
+
+func TestTrigger_NilTokenResponseShapeMatchesValidToken(t *testing.T) {
+	g := kubeconfig.New()
+	tok := newKubeconfigToken("real-token")
+
+	r1 := httptest.NewRequest(
+		http.MethodGet,
+		"/k/real-token/api/v1/pods",
+		nil,
+	)
+	r2 := httptest.NewRequest(
+		http.MethodGet,
+		"/k/does-not-exist/api/v1/pods",
+		nil,
+	)
+
+	_, respValid, err := g.Trigger(context.Background(), tok, r1)
+	require.NoError(t, err)
+	_, respMissing, err := g.Trigger(context.Background(), nil, r2)
+	require.NoError(t, err)
+
+	sValid := parseStatus(t, respValid.Body)
+	sMissing := parseStatus(t, respMissing.Body)
+
+	require.Equal(t, sValid.Kind, sMissing.Kind)
+	require.Equal(t, sValid.APIVersion, sMissing.APIVersion)
+	require.Equal(t, sValid.Status, sMissing.Status)
+	require.Equal(t, sValid.Reason, sMissing.Reason)
+	require.Equal(t, sValid.Code, sMissing.Code)
+	require.Equal(
+		t,
+		respValid.StatusCode,
+		respMissing.StatusCode,
+		"HTTP status code must be identical so attackers cannot probe token validity by response code",
+	)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/kubeconfig/template.yaml.tmpl b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/kubeconfig/template.yaml.tmpl
new file mode 100644
index 00000000..a9f27864
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/kubeconfig/template.yaml.tmpl
@@ -0,0 +1,18 @@
+# ©AngelaMos | 2026
+# template.yaml.tmpl
+apiVersion: v1
+kind: Config
+current-context: {{.ClusterName}}
+clusters:
+- name: {{.ClusterName}}
+  cluster:
+    server: {{.APIServerURL}}
+contexts:
+- name: {{.ClusterName}}
+  context:
+    cluster: {{.ClusterName}}
+    user: {{.UserName}}
+users:
+- name: {{.UserName}}
+  user:
+    token: {{.Token}}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/generator.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/generator.go
new file mode 100644
index 00000000..5f9fa9a4
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/generator.go
@@ -0,0 +1,103 @@
+// ©AngelaMos | 2026
+// generator.go
+
+package mysql
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators"
+)
+
+const (
+	defaultPublicHost = "localhost"
+	defaultPublicPort = 3306
+	defaultDatabase   = "internal_db"
+
+	connectionStringFmt = "mysql://%s@%s:%d/%s"
+)
+
+type Generator struct {
+	publicHost string
+	publicPort int
+	database   string
+}
+
+func New() *Generator {
+	return NewWithAddress(defaultPublicHost, defaultPublicPort)
+}
+
+func NewWithAddress(host string, port int) *Generator {
+	return &Generator{
+		publicHost: host,
+		publicPort: port,
+		database:   defaultDatabase,
+	}
+}
+
+func (g *Generator) Type() token.Type { return token.TypeMySQL }
+
+func (g *Generator) Generate(
+	_ context.Context,
+	t *token.Token,
+	_ string,
+) (generators.Artifact, error) {
+	username := mysqlUsernamePrefix + t.ID
+
+	newMeta, err := setMySQLUsername(t.Metadata, username)
+	if err != nil {
+		return generators.Artifact{}, fmt.Errorf(
+			"mysql: persist username: %w",
+			err,
+		)
+	}
+	t.Metadata = newMeta
+
+	connStr := fmt.Sprintf(
+		connectionStringFmt,
+		username,
+		g.publicHost,
+		g.publicPort,
+		g.database,
+	)
+
+	return generators.Artifact{
+		Kind:             generators.KindConnectionString,
+		ConnectionString: connStr,
+	}, nil
+}
+
+func (g *Generator) Trigger(
+	_ context.Context,
+	_ *token.Token,
+	_ *http.Request,
+) (*event.Event, *generators.TriggerResponse, error) {
+	return nil, nil, ErrHTTPTriggerNotSupported
+}
+
+func setMySQLUsername(
+	metadata json.RawMessage,
+	username string,
+) (json.RawMessage, error) {
+	m := make(map[string]json.RawMessage)
+	if len(metadata) > 0 {
+		if err := json.Unmarshal(metadata, &m); err != nil {
+			m = make(map[string]json.RawMessage)
+		}
+	}
+	val, err := json.Marshal(username)
+	if err != nil {
+		return nil, fmt.Errorf("marshal mysql_username: %w", err)
+	}
+	m[extraMySQLUsername] = val
+	out, err := json.Marshal(m)
+	if err != nil {
+		return nil, fmt.Errorf("marshal merged metadata: %w", err)
+	}
+	return out, nil
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/generator_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/generator_test.go
new file mode 100644
index 00000000..c0cc926c
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/generator_test.go
@@ -0,0 +1,191 @@
+// ©AngelaMos | 2026
+// generator_test.go
+
+package mysql_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/mysql"
+)
+
+func newMySQLToken(id string) *token.Token {
+	return &token.Token{
+		ID:           id,
+		ManageID:     "manage-" + id,
+		Type:         token.TypeMySQL,
+		Memo:         "unit test mysql",
+		AlertChannel: token.ChannelWebhook,
+		Enabled:      true,
+	}
+}
+
+func TestGenerator_TypeIsMySQL(t *testing.T) {
+	require.Equal(t, token.TypeMySQL, mysql.New().Type())
+}
+
+func TestGenerate_ArtifactKindIsConnectionString(t *testing.T) {
+	g := mysql.New()
+	art, err := g.Generate(context.Background(), newMySQLToken("abc"), "")
+	require.NoError(t, err)
+	require.Equal(t, generators.KindConnectionString, art.Kind)
+}
+
+func TestGenerate_ConnectionStringDefaultLocalhost(t *testing.T) {
+	g := mysql.New()
+	art, err := g.Generate(context.Background(), newMySQLToken("abc"), "")
+	require.NoError(t, err)
+	require.Equal(
+		t,
+		"mysql://canary_abc@localhost:3306/internal_db",
+		art.ConnectionString,
+	)
+}
+
+func TestGenerate_ConnectionStringCustomAddress(t *testing.T) {
+	g := mysql.NewWithAddress("canary.example.com", 13306)
+	art, err := g.Generate(context.Background(), newMySQLToken("xyz"), "")
+	require.NoError(t, err)
+	require.Equal(
+		t,
+		"mysql://canary_xyz@canary.example.com:13306/internal_db",
+		art.ConnectionString,
+	)
+}
+
+func TestGenerate_UsernamePrefixIsCanary_(t *testing.T) {
+	g := mysql.New()
+	art, err := g.Generate(context.Background(), newMySQLToken("probeid"), "")
+	require.NoError(t, err)
+	require.Contains(
+		t,
+		art.ConnectionString,
+		"canary_probeid@",
+		"username must be canary_+token.ID for TCP-side lookup parity",
+	)
+}
+
+func TestGenerate_PersistsMySQLUsernameInMetadata(t *testing.T) {
+	g := mysql.New()
+	tok := newMySQLToken("abc")
+	require.Empty(t, tok.Metadata, "fresh token has no metadata yet")
+
+	_, err := g.Generate(context.Background(), tok, "")
+	require.NoError(t, err)
+
+	require.NotEmpty(
+		t,
+		tok.Metadata,
+		"Generate must persist mysql_username into token metadata",
+	)
+
+	var m map[string]any
+	require.NoError(t, json.Unmarshal(tok.Metadata, &m))
+	require.Equal(t, "canary_abc", m["mysql_username"])
+}
+
+func TestGenerate_PreservesExistingMetadataFields(t *testing.T) {
+	g := mysql.New()
+	tok := newMySQLToken("abc")
+	tok.Metadata = json.RawMessage(`{"existing_field":"keep_me","other":42}`)
+
+	_, err := g.Generate(context.Background(), tok, "")
+	require.NoError(t, err)
+
+	var m map[string]any
+	require.NoError(t, json.Unmarshal(tok.Metadata, &m))
+	require.Equal(t, "keep_me", m["existing_field"])
+	other, ok := m["other"].(float64)
+	require.True(t, ok)
+	require.Equal(t, 42, int(other))
+	require.Equal(t, "canary_abc", m["mysql_username"])
+}
+
+func TestGenerate_MalformedMetadataIsReplaced(t *testing.T) {
+	g := mysql.New()
+	tok := newMySQLToken("abc")
+	tok.Metadata = json.RawMessage(`{not valid json`)
+
+	_, err := g.Generate(context.Background(), tok, "")
+	require.NoError(
+		t,
+		err,
+		"malformed metadata must not block generation — replace with a fresh map",
+	)
+
+	var m map[string]any
+	require.NoError(t, json.Unmarshal(tok.Metadata, &m))
+	require.Equal(t, "canary_abc", m["mysql_username"])
+}
+
+func TestGenerate_OverwritesPriorMySQLUsername(t *testing.T) {
+	g := mysql.New()
+	tok := newMySQLToken("abc")
+	tok.Metadata = json.RawMessage(`{"mysql_username":"stale_value"}`)
+
+	_, err := g.Generate(context.Background(), tok, "")
+	require.NoError(t, err)
+
+	var m map[string]any
+	require.NoError(t, json.Unmarshal(tok.Metadata, &m))
+	require.Equal(
+		t,
+		"canary_abc",
+		m["mysql_username"],
+		"regeneration must overwrite stale mysql_username with the current token's",
+	)
+}
+
+func TestGenerate_BaseURLIgnored(t *testing.T) {
+	g := mysql.New()
+
+	art1, err := g.Generate(
+		context.Background(),
+		newMySQLToken("abc"),
+		"https://canary.example.com",
+	)
+	require.NoError(t, err)
+	art2, err := g.Generate(
+		context.Background(),
+		newMySQLToken("abc"),
+		"https://different.example.com/sub",
+	)
+	require.NoError(t, err)
+	require.Equal(
+		t,
+		art1.ConnectionString,
+		art2.ConnectionString,
+		"baseURL is irrelevant to mysql connection strings",
+	)
+}
+
+func TestTrigger_ReturnsHTTPNotSupportedError(t *testing.T) {
+	g := mysql.New()
+	r := httptest.NewRequest(http.MethodGet, "/c/abc", nil)
+
+	evt, resp, err := g.Trigger(
+		context.Background(),
+		newMySQLToken("abc"),
+		r,
+	)
+	require.Error(t, err)
+	require.ErrorIs(t, err, mysql.ErrHTTPTriggerNotSupported)
+	require.Nil(t, evt, "no event when HTTP-triggered (mysql uses TCP)")
+	require.Nil(t, resp, "no response when HTTP-triggered (mysql uses TCP)")
+}
+
+func TestTrigger_NilTokenAlsoReturnsHTTPNotSupportedError(t *testing.T) {
+	g := mysql.New()
+	r := httptest.NewRequest(http.MethodGet, "/c/abc", nil)
+
+	_, _, err := g.Trigger(context.Background(), nil, r)
+	require.ErrorIs(t, err, mysql.ErrHTTPTriggerNotSupported)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/handler.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/handler.go
new file mode 100644
index 00000000..9a89e940
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/handler.go
@@ -0,0 +1,186 @@
+// ©AngelaMos | 2026
+// handler.go
+
+package mysql
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net"
+	"strings"
+	"time"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+)
+
+const (
+	connectionDeadline = 10 * time.Second
+
+	mysqlUsernamePrefix = "canary_"
+
+	extraMySQLUsername     = "mysql_username"
+	extraMySQLCapabilities = "mysql_client_capabilities"
+	extraMySQLCharset      = "mysql_client_charset"
+
+	capabilitiesFormat = "0x%08x"
+)
+
+type TokenLookup interface {
+	GetByID(ctx context.Context, id string) (*token.Token, error)
+}
+
+type EventRecorder interface {
+	Record(ctx context.Context, t *token.Token, evt *event.Event) error
+}
+
+type Handler struct {
+	tokens TokenLookup
+	events EventRecorder
+}
+
+func NewHandler(tokens TokenLookup, events EventRecorder) *Handler {
+	return &Handler{tokens: tokens, events: events}
+}
+
+func (h *Handler) HandleConnection(ctx context.Context, conn net.Conn) {
+	defer func() {
+		if err := conn.Close(); err != nil {
+			slog.WarnContext(ctx, "mysql: close connection", "error", err)
+		}
+	}()
+
+	if err := conn.SetDeadline(time.Now().Add(connectionDeadline)); err != nil {
+		slog.WarnContext(ctx, "mysql: set deadline", "error", err)
+		return
+	}
+
+	if err := h.writeHandshake(conn); err != nil {
+		return
+	}
+
+	auth, err := ReadClientAuth(conn)
+	if err != nil {
+		return
+	}
+
+	if !strings.HasPrefix(auth.Username, mysqlUsernamePrefix) {
+		return
+	}
+	tokenID := strings.TrimPrefix(auth.Username, mysqlUsernamePrefix)
+
+	tok, err := h.tokens.GetByID(ctx, tokenID)
+	if err != nil || tok == nil {
+		return
+	}
+
+	sourceHost := remoteHost(conn)
+
+	if h.events != nil {
+		if recErr := h.recordEvent(ctx, tok, sourceHost, auth); recErr != nil {
+			slog.WarnContext(
+				ctx,
+				"mysql: record event",
+				"error", recErr,
+				"token_id", tok.ID,
+			)
+		}
+	}
+
+	if wErr := h.writeAccessDenied(
+		conn,
+		auth.Username,
+		sourceHost,
+	); wErr != nil {
+		slog.WarnContext(
+			ctx,
+			"mysql: write err packet",
+			"error", wErr,
+			"token_id", tok.ID,
+		)
+	}
+}
+
+func (h *Handler) writeHandshake(conn net.Conn) error {
+	connID, err := NewRandomConnectionID()
+	if err != nil {
+		return fmt.Errorf("connection id: %w", err)
+	}
+	authData, err := NewRandomAuthData()
+	if err != nil {
+		return fmt.Errorf("auth data: %w", err)
+	}
+	pkt, err := BuildHandshakeV10(connID, authData)
+	if err != nil {
+		return fmt.Errorf("build handshake: %w", err)
+	}
+	if _, err := conn.Write(pkt); err != nil {
+		return fmt.Errorf("write handshake: %w", err)
+	}
+	return nil
+}
+
+func (h *Handler) writeAccessDenied(
+	conn net.Conn,
+	username, sourceHost string,
+) error {
+	pkt, err := BuildAccessDeniedErr(username, sourceHost)
+	if err != nil {
+		return fmt.Errorf("build err packet: %w", err)
+	}
+	if _, err := conn.Write(pkt); err != nil {
+		return fmt.Errorf("write err packet: %w", err)
+	}
+	return nil
+}
+
+func (h *Handler) recordEvent(
+	ctx context.Context,
+	tok *token.Token,
+	sourceHost string,
+	auth *ClientAuth,
+) error {
+	extra, err := buildMySQLExtra(auth)
+	if err != nil {
+		return fmt.Errorf("build extra: %w", err)
+	}
+	evt := &event.Event{
+		TokenID:  tok.ID,
+		SourceIP: sourceHost,
+		Extra:    extra,
+	}
+	if err := h.events.Record(ctx, tok, evt); err != nil {
+		return fmt.Errorf("record: %w", err)
+	}
+	return nil
+}
+
+func buildMySQLExtra(auth *ClientAuth) (json.RawMessage, error) {
+	extra := map[string]any{
+		extraMySQLUsername: auth.Username,
+		extraMySQLCapabilities: fmt.Sprintf(
+			capabilitiesFormat,
+			auth.Capabilities,
+		),
+		extraMySQLCharset: auth.Charset,
+	}
+	body, err := json.Marshal(extra)
+	if err != nil {
+		return nil, fmt.Errorf("marshal mysql extra: %w", err)
+	}
+	return body, nil
+}
+
+func remoteHost(conn net.Conn) string {
+	addr := conn.RemoteAddr()
+	if addr == nil {
+		return ""
+	}
+	host, _, err := net.SplitHostPort(addr.String())
+	if err != nil {
+		return addr.String()
+	}
+	return host
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/handler_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/handler_test.go
new file mode 100644
index 00000000..52d128c7
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/handler_test.go
@@ -0,0 +1,389 @@
+// ©AngelaMos | 2026
+// handler_test.go
+
+package mysql_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/binary"
+	"encoding/json"
+	"errors"
+	"io"
+	"net"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/mysql"
+)
+
+func closeQuietly(t *testing.T, closers ...io.Closer) {
+	t.Helper()
+	for _, c := range closers {
+		if err := c.Close(); err != nil && !errors.Is(err, net.ErrClosed) {
+			t.Logf("close: %v", err)
+		}
+	}
+}
+
+type fakeTokenLookup struct {
+	tokens map[string]*token.Token
+	err    error
+	calls  int32
+}
+
+func (f *fakeTokenLookup) GetByID(
+	_ context.Context,
+	id string,
+) (*token.Token, error) {
+	atomic.AddInt32(&f.calls, 1)
+	if f.err != nil {
+		return nil, f.err
+	}
+	tok, ok := f.tokens[id]
+	if !ok {
+		return nil, nil
+	}
+	return tok, nil
+}
+
+type fakeEventRecorder struct {
+	mu     sync.Mutex
+	events []*event.Event
+	err    error
+}
+
+func (f *fakeEventRecorder) Record(
+	_ context.Context,
+	_ *token.Token,
+	evt *event.Event,
+) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.err != nil {
+		return f.err
+	}
+	f.events = append(f.events, evt)
+	return nil
+}
+
+func (f *fakeEventRecorder) snapshot() []*event.Event {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	out := make([]*event.Event, len(f.events))
+	copy(out, f.events)
+	return out
+}
+
+func newConnPair(t *testing.T) (clientSide, serverSide net.Conn) {
+	t.Helper()
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	defer func() {
+		require.NoError(t, listener.Close())
+	}()
+
+	type accepted struct {
+		conn net.Conn
+		err  error
+	}
+	ch := make(chan accepted, 1)
+	go func() {
+		c, aErr := listener.Accept()
+		ch <- accepted{conn: c, err: aErr}
+	}()
+
+	dialed, err := net.Dial("tcp", listener.Addr().String())
+	require.NoError(t, err)
+
+	a := <-ch
+	require.NoError(t, a.err)
+	return dialed, a.conn
+}
+
+func buildHandshakeResponse41ForHandler(t *testing.T, username string) []byte {
+	t.Helper()
+	var payload bytes.Buffer
+	var caps [4]byte
+	binary.LittleEndian.PutUint32(caps[:], 0x0001a285)
+	payload.Write(caps[:])
+	var maxPkt [4]byte
+	binary.LittleEndian.PutUint32(maxPkt[:], 0x01000000)
+	payload.Write(maxPkt[:])
+	payload.WriteByte(0x21)
+	var filler [23]byte
+	payload.Write(filler[:])
+	payload.WriteString(username)
+	payload.WriteByte(0x00)
+	body := payload.Bytes()
+	out := make([]byte, 4+len(body))
+	n := len(body)
+	out[0] = byte(n & 0xff)
+	out[1] = byte((n >> 8) & 0xff)
+	out[2] = byte((n >> 16) & 0xff)
+	out[3] = 0x01
+	copy(out[4:], body)
+	return out
+}
+
+func readAllAvailable(t *testing.T, conn net.Conn, want int) []byte {
+	t.Helper()
+	require.NoError(t, conn.SetReadDeadline(time.Now().Add(2*time.Second)))
+	buf := make([]byte, want)
+	total := 0
+	for total < want {
+		n, err := conn.Read(buf[total:])
+		if err != nil {
+			break
+		}
+		total += n
+	}
+	return buf[:total]
+}
+
+func TestHandleConnection_WritesHandshakeFirst(t *testing.T) {
+	client, server := newConnPair(t)
+	t.Cleanup(func() { closeQuietly(t, client, server) })
+
+	h := mysql.NewHandler(
+		&fakeTokenLookup{tokens: map[string]*token.Token{}},
+		&fakeEventRecorder{},
+	)
+
+	done := make(chan struct{})
+	go func() {
+		h.HandleConnection(context.Background(), server)
+		close(done)
+	}()
+
+	got := readAllAvailable(t, client, 80)
+	require.NotEmpty(t, got)
+	require.Equal(t, byte(0x00), got[3], "handshake sequence ID 0")
+	require.Equal(t, byte(0x0a), got[4], "protocol version 10")
+	require.Contains(t, string(got), "5.7.40-canary")
+
+	require.NoError(t, client.Close())
+	<-done
+}
+
+func TestHandleConnection_NonCanaryUsernameDropsSilently(t *testing.T) {
+	client, server := newConnPair(t)
+	t.Cleanup(func() { closeQuietly(t, client, server) })
+
+	tok := &token.Token{ID: "abc", Type: token.TypeMySQL}
+	lookup := &fakeTokenLookup{tokens: map[string]*token.Token{"abc": tok}}
+	rec := &fakeEventRecorder{}
+	h := mysql.NewHandler(lookup, rec)
+
+	done := make(chan struct{})
+	go func() {
+		h.HandleConnection(context.Background(), server)
+		close(done)
+	}()
+
+	_ = readAllAvailable(t, client, 80)
+	pkt := buildHandshakeResponse41ForHandler(t, "regular_user")
+	_, err := client.Write(pkt)
+	require.NoError(t, err)
+
+	<-done
+	require.Empty(
+		t,
+		rec.snapshot(),
+		"non-canary_-prefixed username must not produce an event",
+	)
+}
+
+func TestHandleConnection_KnownTokenRecordsEventAndSendsErr(t *testing.T) {
+	client, server := newConnPair(t)
+	t.Cleanup(func() { closeQuietly(t, client, server) })
+
+	tok := &token.Token{ID: "mytoken", Type: token.TypeMySQL}
+	lookup := &fakeTokenLookup{
+		tokens: map[string]*token.Token{"mytoken": tok},
+	}
+	rec := &fakeEventRecorder{}
+	h := mysql.NewHandler(lookup, rec)
+
+	done := make(chan struct{})
+	go func() {
+		h.HandleConnection(context.Background(), server)
+		close(done)
+	}()
+
+	_ = readAllAvailable(t, client, 80)
+	pkt := buildHandshakeResponse41ForHandler(t, "canary_mytoken")
+	_, err := client.Write(pkt)
+	require.NoError(t, err)
+
+	errPkt := readAllAvailable(t, client, 200)
+	require.NotEmpty(t, errPkt)
+	require.Contains(
+		t,
+		string(errPkt),
+		`Access denied for user 'canary_mytoken'`,
+	)
+	require.Contains(t, string(errPkt), "28000")
+
+	<-done
+
+	events := rec.snapshot()
+	require.Len(t, events, 1)
+	require.Equal(t, "mytoken", events[0].TokenID)
+	require.NotEmpty(
+		t,
+		events[0].SourceIP,
+		"source IP must be captured from RemoteAddr",
+	)
+}
+
+func TestHandleConnection_EventExtraContainsKubectlEquivalentFields(
+	t *testing.T,
+) {
+	client, server := newConnPair(t)
+	t.Cleanup(func() { closeQuietly(t, client, server) })
+
+	tok := &token.Token{ID: "extra-probe", Type: token.TypeMySQL}
+	lookup := &fakeTokenLookup{
+		tokens: map[string]*token.Token{"extra-probe": tok},
+	}
+	rec := &fakeEventRecorder{}
+	h := mysql.NewHandler(lookup, rec)
+
+	done := make(chan struct{})
+	go func() {
+		h.HandleConnection(context.Background(), server)
+		close(done)
+	}()
+
+	_ = readAllAvailable(t, client, 80)
+	_, err := client.Write(
+		buildHandshakeResponse41ForHandler(t, "canary_extra-probe"),
+	)
+	require.NoError(t, err)
+	_ = readAllAvailable(t, client, 200)
+	<-done
+
+	events := rec.snapshot()
+	require.Len(t, events, 1)
+	require.NotEmpty(t, events[0].Extra)
+
+	var extra map[string]any
+	require.NoError(t, json.Unmarshal(events[0].Extra, &extra))
+	require.Equal(t, "canary_extra-probe", extra["mysql_username"])
+	require.Equal(
+		t,
+		"0x0001a285",
+		extra["mysql_client_capabilities"],
+		"capabilities formatted as 0x + 8 hex digits",
+	)
+	charset, ok := extra["mysql_client_charset"].(float64)
+	require.True(t, ok, "charset must decode as a JSON number")
+	require.Equal(t, 0x21, int(charset))
+}
+
+func TestHandleConnection_UnknownTokenDoesNotRecordOrErrAdvertise(
+	t *testing.T,
+) {
+	client, server := newConnPair(t)
+	t.Cleanup(func() { closeQuietly(t, client, server) })
+
+	lookup := &fakeTokenLookup{tokens: map[string]*token.Token{}}
+	rec := &fakeEventRecorder{}
+	h := mysql.NewHandler(lookup, rec)
+
+	done := make(chan struct{})
+	go func() {
+		h.HandleConnection(context.Background(), server)
+		close(done)
+	}()
+
+	_ = readAllAvailable(t, client, 80)
+	_, err := client.Write(
+		buildHandshakeResponse41ForHandler(t, "canary_does-not-exist"),
+	)
+	require.NoError(t, err)
+	<-done
+
+	require.Empty(t, rec.snapshot(), "unknown token must not record an event")
+}
+
+func TestHandleConnection_LookupErrorIsSilent(t *testing.T) {
+	client, server := newConnPair(t)
+	t.Cleanup(func() { closeQuietly(t, client, server) })
+
+	lookup := &fakeTokenLookup{err: errors.New("db down")}
+	rec := &fakeEventRecorder{}
+	h := mysql.NewHandler(lookup, rec)
+
+	done := make(chan struct{})
+	go func() {
+		h.HandleConnection(context.Background(), server)
+		close(done)
+	}()
+
+	_ = readAllAvailable(t, client, 80)
+	_, err := client.Write(
+		buildHandshakeResponse41ForHandler(t, "canary_anything"),
+	)
+	require.NoError(t, err)
+	<-done
+
+	require.Empty(t, rec.snapshot())
+}
+
+func TestHandleConnection_NilEventRecorderTolerated(t *testing.T) {
+	client, server := newConnPair(t)
+	t.Cleanup(func() { closeQuietly(t, client, server) })
+
+	tok := &token.Token{ID: "noevents", Type: token.TypeMySQL}
+	lookup := &fakeTokenLookup{tokens: map[string]*token.Token{"noevents": tok}}
+	h := mysql.NewHandler(lookup, nil)
+
+	done := make(chan struct{})
+	go func() {
+		h.HandleConnection(context.Background(), server)
+		close(done)
+	}()
+
+	_ = readAllAvailable(t, client, 80)
+	_, err := client.Write(
+		buildHandshakeResponse41ForHandler(t, "canary_noevents"),
+	)
+	require.NoError(t, err)
+
+	errPkt := readAllAvailable(t, client, 200)
+	require.NotEmpty(
+		t,
+		errPkt,
+		"ERR packet still sent even without recorder wired",
+	)
+	<-done
+}
+
+func TestHandleConnection_BadAuthPacketDropsSilently(t *testing.T) {
+	client, server := newConnPair(t)
+	t.Cleanup(func() { closeQuietly(t, client, server) })
+
+	rec := &fakeEventRecorder{}
+	h := mysql.NewHandler(&fakeTokenLookup{}, rec)
+
+	done := make(chan struct{})
+	go func() {
+		h.HandleConnection(context.Background(), server)
+		close(done)
+	}()
+
+	_ = readAllAvailable(t, client, 80)
+	_, err := client.Write([]byte{0x00, 0x00, 0x00, 0x01})
+	require.NoError(t, err)
+	<-done
+
+	require.Empty(t, rec.snapshot())
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/protocol.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/protocol.go
new file mode 100644
index 00000000..35415b6b
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/protocol.go
@@ -0,0 +1,220 @@
+// ©AngelaMos | 2026
+// protocol.go
+
+package mysql
+
+import (
+	"bytes"
+	"crypto/rand"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+)
+
+const (
+	packetHeaderSize    = 4
+	protocolVersion     = 0x0a
+	serverVersionString = "5.7.40-canary"
+
+	capabilityFlagsLower = uint16(0xf7ff)
+	capabilityFlagsUpper = uint16(0x81ff)
+
+	characterSetUtf8MB4 = 0x21
+	statusFlags         = uint16(0x0002)
+	authPluginDataLen   = byte(0x15)
+
+	authPluginName = "mysql_native_password"
+
+	errPacketHeader      = 0xff
+	errCodeAccessDenied  = uint16(1045)
+	sqlStateMarker       = '#'
+	sqlStateAccessDenied = "28000"
+
+	seqIDServerHandshake byte = 0x00
+	seqIDServerErr       byte = 0x02
+
+	maxPacketSize             = 0x00ffffff
+	handshakeResponseMaxBytes = 64 * 1024
+
+	handshakeResponseFillerLen   = 23
+	handshakeResponseHeaderBytes = 4 + 4 + 1 + handshakeResponseFillerLen
+
+	authPluginDataTotalLen = 20
+	authPluginDataPart1Len = 8
+	authPluginDataPart2Len = 12
+)
+
+var (
+	ErrShortPacket     = errors.New("mysql: short packet header")
+	ErrPacketTooLarge  = errors.New("mysql: packet exceeds max size")
+	ErrInvalidPayload  = errors.New("mysql: invalid payload structure")
+	ErrUsernameMissing = errors.New(
+		"mysql: username missing or unterminated",
+	)
+	ErrHTTPTriggerNotSupported = errors.New(
+		"mysql: Trigger via HTTP is not applicable (use the TCP listener)",
+	)
+)
+
+type ClientAuth struct {
+	Capabilities  uint32
+	MaxPacketSize uint32
+	Charset       uint8
+	Username      string
+}
+
+func BuildHandshakeV10(
+	connID uint32,
+	authData [authPluginDataTotalLen]byte,
+) ([]byte, error) {
+	var payload bytes.Buffer
+	payload.WriteByte(protocolVersion)
+	payload.WriteString(serverVersionString)
+	payload.WriteByte(0x00)
+
+	var connIDBytes [4]byte
+	binary.LittleEndian.PutUint32(connIDBytes[:], connID)
+	payload.Write(connIDBytes[:])
+
+	payload.Write(authData[:authPluginDataPart1Len])
+	payload.WriteByte(0x00)
+
+	var capLower [2]byte
+	binary.LittleEndian.PutUint16(capLower[:], capabilityFlagsLower)
+	payload.Write(capLower[:])
+
+	payload.WriteByte(characterSetUtf8MB4)
+
+	var statusBytes [2]byte
+	binary.LittleEndian.PutUint16(statusBytes[:], statusFlags)
+	payload.Write(statusBytes[:])
+
+	var capUpper [2]byte
+	binary.LittleEndian.PutUint16(capUpper[:], capabilityFlagsUpper)
+	payload.Write(capUpper[:])
+
+	payload.WriteByte(authPluginDataLen)
+
+	var reserved [10]byte
+	payload.Write(reserved[:])
+
+	payload.Write(authData[authPluginDataPart1Len:])
+	payload.WriteByte(0x00)
+
+	payload.WriteString(authPluginName)
+	payload.WriteByte(0x00)
+
+	return wrapPacket(payload.Bytes(), seqIDServerHandshake)
+}
+
+func ReadClientAuth(r io.Reader) (*ClientAuth, error) {
+	payload, err := readPacket(r)
+	if err != nil {
+		return nil, err
+	}
+	if len(payload) < handshakeResponseHeaderBytes+1 {
+		return nil, fmt.Errorf(
+			"%w: have %d bytes, need at least %d",
+			ErrInvalidPayload,
+			len(payload),
+			handshakeResponseHeaderBytes+1,
+		)
+	}
+
+	auth := &ClientAuth{
+		Capabilities:  binary.LittleEndian.Uint32(payload[0:4]),
+		MaxPacketSize: binary.LittleEndian.Uint32(payload[4:8]),
+		Charset:       payload[8],
+	}
+
+	usernameStart := handshakeResponseHeaderBytes
+	rel := bytes.IndexByte(payload[usernameStart:], 0x00)
+	if rel < 0 {
+		return nil, ErrUsernameMissing
+	}
+	auth.Username = string(payload[usernameStart : usernameStart+rel])
+	return auth, nil
+}
+
+func BuildAccessDeniedErr(username, sourceHost string) ([]byte, error) {
+	msg := fmt.Sprintf(
+		`Access denied for user '%s'@'%s' (using password: YES)`,
+		username,
+		sourceHost,
+	)
+
+	var payload bytes.Buffer
+	payload.WriteByte(errPacketHeader)
+
+	var code [2]byte
+	binary.LittleEndian.PutUint16(code[:], errCodeAccessDenied)
+	payload.Write(code[:])
+
+	payload.WriteByte(sqlStateMarker)
+	payload.WriteString(sqlStateAccessDenied)
+	payload.WriteString(msg)
+
+	return wrapPacket(payload.Bytes(), seqIDServerErr)
+}
+
+func wrapPacket(payload []byte, seqID byte) ([]byte, error) {
+	if len(payload) > maxPacketSize {
+		return nil, fmt.Errorf(
+			"%w: payload %d > max %d",
+			ErrPacketTooLarge,
+			len(payload),
+			maxPacketSize,
+		)
+	}
+	out := make([]byte, packetHeaderSize+len(payload))
+	n := len(payload)
+	out[0] = byte(n & 0xff)
+	out[1] = byte((n >> 8) & 0xff)
+	out[2] = byte((n >> 16) & 0xff)
+	out[3] = seqID
+	copy(out[packetHeaderSize:], payload)
+	return out, nil
+}
+
+func readPacket(r io.Reader) ([]byte, error) {
+	var hdr [packetHeaderSize]byte
+	if _, err := io.ReadFull(r, hdr[:]); err != nil {
+		return nil, fmt.Errorf("%w: %w", ErrShortPacket, err)
+	}
+	payloadLen := uint32(hdr[0]) |
+		uint32(hdr[1])<<8 |
+		uint32(hdr[2])<<16
+	if payloadLen > handshakeResponseMaxBytes {
+		return nil, fmt.Errorf(
+			"%w: payload %d > limit %d",
+			ErrPacketTooLarge,
+			payloadLen,
+			handshakeResponseMaxBytes,
+		)
+	}
+	if payloadLen == 0 {
+		return nil, nil
+	}
+	payload := make([]byte, payloadLen)
+	if _, err := io.ReadFull(r, payload); err != nil {
+		return nil, fmt.Errorf("mysql: read payload: %w", err)
+	}
+	return payload, nil
+}
+
+func NewRandomAuthData() ([authPluginDataTotalLen]byte, error) {
+	var data [authPluginDataTotalLen]byte
+	if _, err := rand.Read(data[:]); err != nil {
+		return data, fmt.Errorf("mysql: random auth data: %w", err)
+	}
+	return data, nil
+}
+
+func NewRandomConnectionID() (uint32, error) {
+	var b [4]byte
+	if _, err := rand.Read(b[:]); err != nil {
+		return 0, fmt.Errorf("mysql: random connection id: %w", err)
+	}
+	return binary.LittleEndian.Uint32(b[:]), nil
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/protocol_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/protocol_test.go
new file mode 100644
index 00000000..7a0b8f2f
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/protocol_test.go
@@ -0,0 +1,329 @@
+// ©AngelaMos | 2026
+// protocol_test.go
+
+package mysql_test
+
+import (
+	"bytes"
+	"encoding/binary"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/mysql"
+)
+
+const (
+	packetHeaderSize     = 4
+	expectedProtoVersion = 0x0a
+	expectedCharset      = 0x21
+)
+
+func buildHandshakeResponse41(t *testing.T, username string) []byte {
+	t.Helper()
+	var payload bytes.Buffer
+
+	var caps [4]byte
+	binary.LittleEndian.PutUint32(caps[:], 0x0001a285)
+	payload.Write(caps[:])
+
+	var maxPkt [4]byte
+	binary.LittleEndian.PutUint32(maxPkt[:], 0x01000000)
+	payload.Write(maxPkt[:])
+
+	payload.WriteByte(expectedCharset)
+
+	var filler [23]byte
+	payload.Write(filler[:])
+
+	payload.WriteString(username)
+	payload.WriteByte(0x00)
+
+	body := payload.Bytes()
+	out := make([]byte, packetHeaderSize+len(body))
+	n := len(body)
+	out[0] = byte(n & 0xff)
+	out[1] = byte((n >> 8) & 0xff)
+	out[2] = byte((n >> 16) & 0xff)
+	out[3] = 0x01
+	copy(out[packetHeaderSize:], body)
+	return out
+}
+
+func TestBuildHandshakeV10_HasCorrectPacketHeader(t *testing.T) {
+	auth := [20]byte{
+		1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
+		11, 12, 13, 14, 15, 16, 17, 18, 19, 20,
+	}
+	pkt, err := mysql.BuildHandshakeV10(0xdeadbeef, auth)
+	require.NoError(t, err)
+	require.Greater(t, len(pkt), packetHeaderSize)
+
+	payloadLen := int(pkt[0]) |
+		int(pkt[1])<<8 |
+		int(pkt[2])<<16
+	require.Equal(t, len(pkt)-packetHeaderSize, payloadLen)
+	require.Equal(t, byte(0x00), pkt[3], "server handshake sequence ID is 0")
+}
+
+func TestBuildHandshakeV10_PayloadStartsWithProtocolVersion(t *testing.T) {
+	var auth [20]byte
+	pkt, err := mysql.BuildHandshakeV10(0x1234, auth)
+	require.NoError(t, err)
+	require.Equal(t, byte(expectedProtoVersion), pkt[packetHeaderSize])
+}
+
+func TestBuildHandshakeV10_ContainsServerVersionString(t *testing.T) {
+	var auth [20]byte
+	pkt, err := mysql.BuildHandshakeV10(0x1234, auth)
+	require.NoError(t, err)
+	require.Contains(
+		t,
+		string(pkt),
+		"5.7.40-canary",
+		"handshake must advertise the canary-server version string for verisimilitude",
+	)
+}
+
+func TestBuildHandshakeV10_AdvertisesMySQLNativePassword(t *testing.T) {
+	var auth [20]byte
+	pkt, err := mysql.BuildHandshakeV10(0x1234, auth)
+	require.NoError(t, err)
+	require.Contains(t, string(pkt), "mysql_native_password")
+}
+
+func TestBuildHandshakeV10_EmbedsConnectionIDLittleEndian(t *testing.T) {
+	var auth [20]byte
+	connID := uint32(0xdeadbeef)
+	pkt, err := mysql.BuildHandshakeV10(connID, auth)
+	require.NoError(t, err)
+
+	versionEnd := bytes.IndexByte(
+		pkt[packetHeaderSize+1:],
+		0x00,
+	) + packetHeaderSize + 1
+	require.Greater(t, versionEnd, packetHeaderSize+1)
+	connIDStart := versionEnd + 1
+	got := binary.LittleEndian.Uint32(pkt[connIDStart : connIDStart+4])
+	require.Equal(t, connID, got)
+}
+
+func TestBuildHandshakeV10_EmbedsAuthDataInTwoParts(t *testing.T) {
+	auth := [20]byte{
+		10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
+		20, 21, 22, 23, 24, 25, 26, 27, 28, 29,
+	}
+	pkt, err := mysql.BuildHandshakeV10(0xcafef00d, auth)
+	require.NoError(t, err)
+	require.Contains(
+		t,
+		string(pkt),
+		string(auth[:8]),
+		"first 8 bytes of auth data must appear in handshake",
+	)
+	require.Contains(
+		t,
+		string(pkt),
+		string(auth[8:]),
+		"last 12 bytes of auth data must appear in handshake (after part-1 + filler + caps + ...)",
+	)
+}
+
+func TestReadClientAuth_ExtractsUsername(t *testing.T) {
+	pkt := buildHandshakeResponse41(t, "canary_abc123def456")
+	auth, err := mysql.ReadClientAuth(bytes.NewReader(pkt))
+	require.NoError(t, err)
+	require.NotNil(t, auth)
+	require.Equal(t, "canary_abc123def456", auth.Username)
+}
+
+func TestReadClientAuth_CapturesCapabilities(t *testing.T) {
+	pkt := buildHandshakeResponse41(t, "anyone")
+	auth, err := mysql.ReadClientAuth(bytes.NewReader(pkt))
+	require.NoError(t, err)
+	require.Equal(t, uint32(0x0001a285), auth.Capabilities)
+	require.Equal(t, uint32(0x01000000), auth.MaxPacketSize)
+	require.Equal(t, uint8(expectedCharset), auth.Charset)
+}
+
+func TestReadClientAuth_EmptyUsernameStillParses(t *testing.T) {
+	pkt := buildHandshakeResponse41(t, "")
+	auth, err := mysql.ReadClientAuth(bytes.NewReader(pkt))
+	require.NoError(t, err)
+	require.Empty(t, auth.Username)
+}
+
+func TestReadClientAuth_ShortPayloadReturnsError(t *testing.T) {
+	short := make([]byte, packetHeaderSize+5)
+	short[0] = 0x05
+	_, err := mysql.ReadClientAuth(bytes.NewReader(short))
+	require.Error(t, err)
+	require.ErrorIs(t, err, mysql.ErrInvalidPayload)
+}
+
+func TestReadClientAuth_NoUsernameTerminatorReturnsError(t *testing.T) {
+	var payload bytes.Buffer
+	var caps [4]byte
+	payload.Write(caps[:])
+	var maxPkt [4]byte
+	payload.Write(maxPkt[:])
+	payload.WriteByte(expectedCharset)
+	var filler [23]byte
+	payload.Write(filler[:])
+	payload.WriteString("nocan_terminator_here_no_null")
+	body := payload.Bytes()
+
+	out := make([]byte, packetHeaderSize+len(body))
+	n := len(body)
+	out[0] = byte(n & 0xff)
+	out[1] = byte((n >> 8) & 0xff)
+	out[2] = byte((n >> 16) & 0xff)
+	out[3] = 0x01
+	copy(out[packetHeaderSize:], body)
+
+	_, err := mysql.ReadClientAuth(bytes.NewReader(out))
+	require.Error(t, err)
+	require.ErrorIs(t, err, mysql.ErrUsernameMissing)
+}
+
+func TestReadClientAuth_EmptyReaderReturnsShortPacket(t *testing.T) {
+	_, err := mysql.ReadClientAuth(bytes.NewReader(nil))
+	require.Error(t, err)
+	require.ErrorIs(t, err, mysql.ErrShortPacket)
+}
+
+func TestReadClientAuth_OversizePacketRejected(t *testing.T) {
+	var hdr [packetHeaderSize]byte
+	hdr[0] = 0x01
+	hdr[1] = 0x00
+	hdr[2] = 0x10
+	hdr[3] = 0x01
+
+	r := io.MultiReader(
+		bytes.NewReader(hdr[:]),
+		strings.NewReader(strings.Repeat("X", 70000)),
+	)
+	_, err := mysql.ReadClientAuth(r)
+	require.Error(t, err)
+	require.ErrorIs(t, err, mysql.ErrPacketTooLarge)
+}
+
+func TestBuildAccessDeniedErr_HasCorrectMarkerAndCode(t *testing.T) {
+	pkt, err := mysql.BuildAccessDeniedErr("canary_xyz", "203.0.113.50")
+	require.NoError(t, err)
+	require.Greater(t, len(pkt), packetHeaderSize)
+
+	require.Equal(
+		t,
+		byte(0xff),
+		pkt[packetHeaderSize],
+		"ERR packet header byte",
+	)
+	code := binary.LittleEndian.Uint16(
+		pkt[packetHeaderSize+1 : packetHeaderSize+3],
+	)
+	require.Equal(
+		t,
+		uint16(1045),
+		code,
+		"MySQL error code 1045 (access denied)",
+	)
+}
+
+func TestBuildAccessDeniedErr_HasSQLStateMarkerAnd28000(t *testing.T) {
+	pkt, err := mysql.BuildAccessDeniedErr("canary_xyz", "203.0.113.50")
+	require.NoError(t, err)
+	require.Equal(
+		t,
+		byte('#'),
+		pkt[packetHeaderSize+3],
+		"SQL state marker must be '#'",
+	)
+	require.Equal(
+		t,
+		"28000",
+		string(pkt[packetHeaderSize+4:packetHeaderSize+9]),
+		"SQL state 28000 (invalid authorization)",
+	)
+}
+
+func TestBuildAccessDeniedErr_MessageContainsUserAndHost(t *testing.T) {
+	pkt, err := mysql.BuildAccessDeniedErr("canary_abc", "203.0.113.7")
+	require.NoError(t, err)
+	require.Contains(
+		t,
+		string(pkt),
+		`Access denied for user 'canary_abc'@'203.0.113.7' (using password: YES)`,
+	)
+}
+
+func TestBuildAccessDeniedErr_SequenceIDIs2(t *testing.T) {
+	pkt, err := mysql.BuildAccessDeniedErr("u", "h")
+	require.NoError(t, err)
+	require.Equal(
+		t,
+		byte(0x02),
+		pkt[3],
+		"ERR packet sequence ID is 2 (after handshake=0 and client auth=1)",
+	)
+}
+
+func TestRoundTrip_BuildAndParseUsername(t *testing.T) {
+	cases := []string{
+		"canary_abcdef0123",
+		"canary_xyz",
+		"root",
+		"",
+		"app_user",
+	}
+	for _, name := range cases {
+		name := name
+		t.Run("username="+name, func(t *testing.T) {
+			pkt := buildHandshakeResponse41(t, name)
+			auth, err := mysql.ReadClientAuth(bytes.NewReader(pkt))
+			require.NoError(t, err)
+			require.Equal(t, name, auth.Username)
+		})
+	}
+}
+
+func TestNewRandomAuthData_ReturnsTwentyBytes(t *testing.T) {
+	d, err := mysql.NewRandomAuthData()
+	require.NoError(t, err)
+	require.Len(t, d, 20)
+}
+
+func TestNewRandomAuthData_DistinctCallsProduceDistinctOutputs(t *testing.T) {
+	seen := make(map[[20]byte]struct{})
+	for range 50 {
+		d, err := mysql.NewRandomAuthData()
+		require.NoError(t, err)
+		seen[d] = struct{}{}
+	}
+	require.Greater(
+		t,
+		len(seen),
+		45,
+		"50 calls to NewRandomAuthData should produce near-50 unique values",
+	)
+}
+
+func TestNewRandomConnectionID_DistinctCallsProduceDistinctOutputs(
+	t *testing.T,
+) {
+	seen := make(map[uint32]struct{})
+	for range 50 {
+		id, err := mysql.NewRandomConnectionID()
+		require.NoError(t, err)
+		seen[id] = struct{}{}
+	}
+	require.Greater(t, len(seen), 45)
+}
+
+func TestErrors_AreDistinctSentinels(t *testing.T) {
+	require.NotErrorIs(t, mysql.ErrShortPacket, mysql.ErrPacketTooLarge)
+	require.NotErrorIs(t, mysql.ErrPacketTooLarge, mysql.ErrInvalidPayload)
+	require.NotErrorIs(t, mysql.ErrInvalidPayload, mysql.ErrUsernameMissing)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/server.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/server.go
new file mode 100644
index 00000000..869711dd
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/server.go
@@ -0,0 +1,84 @@
+// ©AngelaMos | 2026
+// server.go
+
+package mysql
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net"
+	"sync"
+	"time"
+)
+
+const (
+	acceptShutdownGrace = 2 * time.Second
+	tcpNetwork          = "tcp"
+)
+
+type ConnectionHandler interface {
+	HandleConnection(ctx context.Context, conn net.Conn)
+}
+
+func Run(
+	ctx context.Context,
+	addr string,
+	h ConnectionHandler,
+) error {
+	if h == nil {
+		return fmt.Errorf("mysql: nil connection handler")
+	}
+	var lc net.ListenConfig
+	listener, err := lc.Listen(ctx, tcpNetwork, addr)
+	if err != nil {
+		return fmt.Errorf("mysql: listen %s: %w", addr, err)
+	}
+	defer func() {
+		if cErr := listener.Close(); cErr != nil &&
+			!errors.Is(cErr, net.ErrClosed) {
+			slog.WarnContext(ctx, "mysql: close listener", "error", cErr)
+		}
+	}()
+
+	slog.InfoContext(
+		ctx,
+		"mysql: listener started",
+		"addr",
+		listener.Addr().String(),
+	)
+
+	go func() {
+		<-ctx.Done()
+		if cErr := listener.Close(); cErr != nil &&
+			!errors.Is(cErr, net.ErrClosed) {
+			slog.WarnContext(
+				ctx,
+				"mysql: shutdown close listener",
+				"error",
+				cErr,
+			)
+		}
+	}()
+
+	var wg sync.WaitGroup
+	for {
+		conn, aErr := listener.Accept()
+		if aErr != nil {
+			if errors.Is(ctx.Err(), context.Canceled) ||
+				errors.Is(aErr, net.ErrClosed) {
+				wg.Wait()
+				return nil
+			}
+			slog.WarnContext(ctx, "mysql: accept", "error", aErr)
+			continue
+		}
+
+		wg.Add(1)
+		go func(c net.Conn) {
+			defer wg.Done()
+			h.HandleConnection(ctx, c)
+		}(conn)
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/server_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/server_test.go
new file mode 100644
index 00000000..a60dbbd9
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/mysql/server_test.go
@@ -0,0 +1,157 @@
+// ©AngelaMos | 2026
+// server_test.go
+
+package mysql_test
+
+import (
+	"context"
+	"errors"
+	"net"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/mysql"
+)
+
+type stubHandler struct {
+	called       atomic.Int32
+	lastCloseErr atomic.Value
+	closed       chan struct{}
+	once         sync.Once
+}
+
+func newStubHandler() *stubHandler {
+	return &stubHandler{closed: make(chan struct{})}
+}
+
+func (s *stubHandler) HandleConnection(_ context.Context, conn net.Conn) {
+	s.called.Add(1)
+	if err := conn.Close(); err != nil && !errors.Is(err, net.ErrClosed) {
+		s.lastCloseErr.Store(err)
+	}
+	s.once.Do(func() { close(s.closed) })
+}
+
+func dialOnce(addr string) error {
+	conn, err := net.DialTimeout("tcp", addr, 2*time.Second)
+	if err != nil {
+		return err
+	}
+	if cErr := conn.Close(); cErr != nil && !errors.Is(cErr, net.ErrClosed) {
+		return cErr
+	}
+	return nil
+}
+
+func runServer(
+	t *testing.T,
+	ctx context.Context,
+	h mysql.ConnectionHandler,
+) (string, <-chan error) {
+	t.Helper()
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	addr := listener.Addr().String()
+	require.NoError(t, listener.Close())
+
+	done := make(chan error, 1)
+	go func() {
+		done <- mysql.Run(ctx, addr, h)
+	}()
+
+	require.Eventually(t, func() bool {
+		return dialOnce(addr) == nil
+	}, 2*time.Second, 25*time.Millisecond, "server must accept on %s", addr)
+
+	return addr, done
+}
+
+func TestRun_NilHandlerReturnsError(t *testing.T) {
+	err := mysql.Run(context.Background(), "127.0.0.1:0", nil)
+	require.Error(t, err)
+}
+
+func TestRun_AcceptsConnectionAndDispatchesToHandler(t *testing.T) {
+	h := newStubHandler()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	addr, done := runServer(t, ctx, h)
+	before := h.called.Load()
+
+	require.NoError(t, dialOnce(addr))
+
+	require.Eventually(t, func() bool {
+		return h.called.Load() > before
+	}, 2*time.Second, 25*time.Millisecond,
+		"single dial must dispatch to handler")
+
+	cancel()
+	require.NoError(t, <-done)
+}
+
+func TestRun_HandlesMultipleConcurrentConnections(t *testing.T) {
+	h := newStubHandler()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	addr, done := runServer(t, ctx, h)
+	before := h.called.Load()
+
+	const n = 10
+	results := make(chan error, n)
+	var wg sync.WaitGroup
+	for range n {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			results <- dialOnce(addr)
+		}()
+	}
+	wg.Wait()
+	close(results)
+
+	for err := range results {
+		require.NoError(t, err)
+	}
+
+	require.Eventually(t, func() bool {
+		return h.called.Load() >= before+int32(n)
+	}, 2*time.Second, 25*time.Millisecond,
+		"all %d connections must be dispatched", n)
+
+	cancel()
+	require.NoError(t, <-done)
+}
+
+func TestRun_ContextCancellationStopsListenerCleanly(t *testing.T) {
+	h := newStubHandler()
+	ctx, cancel := context.WithCancel(context.Background())
+
+	addr, done := runServer(t, ctx, h)
+	require.NoError(t, dialOnce(addr))
+	cancel()
+
+	select {
+	case err := <-done:
+		require.NoError(t, err)
+	case <-time.After(2 * time.Second):
+		t.Fatal("Run did not return within 2s after context cancellation")
+	}
+
+	_, err := net.DialTimeout("tcp", addr, 100*time.Millisecond)
+	require.Error(t, err, "listener must be closed after context cancellation")
+}
+
+func TestRun_InvalidAddressReturnsError(t *testing.T) {
+	err := mysql.Run(
+		context.Background(),
+		"not-a-valid-addr:not-a-port",
+		newStubHandler(),
+	)
+	require.Error(t, err)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/pdf/generator.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/pdf/generator.go
new file mode 100644
index 00000000..11a98f44
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/pdf/generator.go
@@ -0,0 +1,156 @@
+// ©AngelaMos | 2026
+// generator.go
+
+package pdf
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/middleware"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/pixel"
+)
+
+const (
+	headerReferer      = "Referer"
+	headerCacheControl = "Cache-Control"
+	headerPragma       = "Pragma"
+
+	cacheControlNoStore = "no-store, no-cache, must-revalidate, max-age=0"
+	pragmaNoCache       = "no-cache"
+
+	triggerPathPrefix = "/c/"
+
+	placeholderRoot = "HONEY_TRACK_URL_PADDED_TO_FIXED_WIDTH"
+
+	PlaceholderLength = 76
+
+	padChar = "_"
+
+	queryPadPrefix = "?p="
+
+	contentType     = "application/pdf"
+	defaultFilename = "Document.pdf"
+)
+
+var ErrTriggerURLTooLong = errors.New(
+	"pdf: trigger URL exceeds placeholder length",
+)
+
+//go:embed template/template.pdf
+var pdfTemplate []byte
+
+var placeholder = placeholderRoot +
+	strings.Repeat(padChar, PlaceholderLength-len(placeholderRoot))
+
+type Generator struct{}
+
+func New() *Generator { return &Generator{} }
+
+func (g *Generator) Type() token.Type { return token.TypePDF }
+
+func (g *Generator) Generate(
+	_ context.Context,
+	t *token.Token,
+	baseURL string,
+) (generators.Artifact, error) {
+	triggerURL := strings.TrimRight(baseURL, "/") + triggerPathPrefix + t.ID
+
+	if len(triggerURL) > PlaceholderLength {
+		return generators.Artifact{}, fmt.Errorf(
+			"%w: url=%d max=%d",
+			ErrTriggerURLTooLong,
+			len(triggerURL),
+			PlaceholderLength,
+		)
+	}
+
+	padded := padTriggerURL(triggerURL)
+
+	out := bytes.Replace(
+		pdfTemplate,
+		[]byte(placeholder),
+		[]byte(padded),
+		1,
+	)
+
+	if len(out) != len(pdfTemplate) {
+		return generators.Artifact{}, fmt.Errorf(
+			"pdf: substitution changed byte length (was %d, now %d)",
+			len(pdfTemplate),
+			len(out),
+		)
+	}
+	if !bytes.Contains(out, []byte(triggerURL)) {
+		return generators.Artifact{}, fmt.Errorf(
+			"pdf: substitution did not embed trigger URL",
+		)
+	}
+
+	return generators.Artifact{
+		Kind:        generators.KindFile,
+		Filename:    resolveFilename(t.Filename),
+		Content:     out,
+		ContentType: contentType,
+	}, nil
+}
+
+func (g *Generator) Trigger(
+	_ context.Context,
+	t *token.Token,
+	r *http.Request,
+) (*event.Event, *generators.TriggerResponse, error) {
+	resp := &generators.TriggerResponse{
+		StatusCode:  http.StatusOK,
+		ContentType: pixel.ContentType,
+		Body:        pixel.Clone(),
+		ExtraHeaders: map[string]string{
+			headerCacheControl: cacheControlNoStore,
+			headerPragma:       pragmaNoCache,
+		},
+	}
+
+	if t == nil {
+		return nil, resp, nil
+	}
+
+	evt := &event.Event{
+		TokenID:   t.ID,
+		SourceIP:  middleware.RealIP(r),
+		UserAgent: middleware.OptionalHeader(r.UserAgent()),
+		Referer:   middleware.OptionalHeader(r.Header.Get(headerReferer)),
+	}
+	return evt, resp, nil
+}
+
+func resolveFilename(name *string) string {
+	if name == nil {
+		return defaultFilename
+	}
+	trimmed := strings.TrimSpace(*name)
+	if trimmed == "" {
+		return defaultFilename
+	}
+	return trimmed
+}
+
+func padTriggerURL(triggerURL string) string {
+	needed := PlaceholderLength - len(triggerURL)
+	switch {
+	case needed == 0:
+		return triggerURL
+	case needed >= len(queryPadPrefix):
+		return triggerURL + queryPadPrefix +
+			strings.Repeat(padChar, needed-len(queryPadPrefix))
+	default:
+		return triggerURL + strings.Repeat(padChar, needed)
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/pdf/generator_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/pdf/generator_test.go
new file mode 100644
index 00000000..dc2e965d
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/pdf/generator_test.go
@@ -0,0 +1,656 @@
+// ©AngelaMos | 2026
+// generator_test.go
+
+package pdf_test
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/pdfcpu/pdfcpu/pkg/api"
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/pdf"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/pixel"
+)
+
+//go:embed template/template.pdf
+var rawTemplate []byte
+
+const (
+	testBaseURL              = "https://canary.example.com"
+	placeholderRootLiteral   = "HONEY_TRACK_URL_PADDED_TO_FIXED_WIDTH"
+	pdfContentTypeMIME       = "application/pdf"
+	defaultFilename          = "Document.pdf"
+	cacheControlNoStoreValue = "no-store, no-cache, must-revalidate, max-age=0"
+	pragmaNoCacheValue       = "no-cache"
+	gifByteLength            = 43
+	pdfHeaderPrefix          = "%PDF-"
+	pdfTrailer               = "%%EOF\n"
+)
+
+func fullPlaceholder() string {
+	return placeholderRootLiteral +
+		strings.Repeat("_", pdf.PlaceholderLength-len(placeholderRootLiteral))
+}
+
+func newPDFToken(id string) *token.Token {
+	return &token.Token{
+		ID:           id,
+		ManageID:     "manage-" + id,
+		Type:         token.TypePDF,
+		Memo:         "unit test pdf",
+		AlertChannel: token.ChannelWebhook,
+		Enabled:      true,
+	}
+}
+
+func newPDFTokenWithFilename(id, filename string) *token.Token {
+	tok := newPDFToken(id)
+	tok.Filename = &filename
+	return tok
+}
+
+func TestTemplate_PlaceholderRootIsByteLocatableExactlyOnce(t *testing.T) {
+	require.Equal(
+		t,
+		1,
+		bytes.Count(rawTemplate, []byte(placeholderRootLiteral)),
+		"template must contain the placeholder root exactly once as literal bytes",
+	)
+}
+
+func TestTemplate_FullPlaceholderIsByteLocatableExactlyOnce(t *testing.T) {
+	full := fullPlaceholder()
+	require.Len(
+		t,
+		full,
+		pdf.PlaceholderLength,
+		"derived placeholder must be %d bytes",
+		pdf.PlaceholderLength,
+	)
+	require.Equal(
+		t,
+		1,
+		bytes.Count(rawTemplate, []byte(full)),
+		"template must contain the full %d-byte placeholder exactly once as literal bytes (not encoded inside a Flate stream)",
+		pdf.PlaceholderLength,
+	)
+}
+
+func TestTemplate_StartsWithPDFHeader(t *testing.T) {
+	require.True(
+		t,
+		bytes.HasPrefix(rawTemplate, []byte(pdfHeaderPrefix)),
+		"template must start with %q",
+		pdfHeaderPrefix,
+	)
+}
+
+func TestTemplate_EndsWithEOFMarker(t *testing.T) {
+	require.True(
+		t,
+		bytes.HasSuffix(rawTemplate, []byte(pdfTrailer)),
+		"template must end with %q",
+		pdfTrailer,
+	)
+}
+
+func TestTemplate_PdfcpuValidates(t *testing.T) {
+	require.NoError(
+		t,
+		api.Validate(bytes.NewReader(rawTemplate), nil),
+		"template must pass pdfcpu validation",
+	)
+}
+
+func TestGenerator_TypeIsPDF(t *testing.T) {
+	g := pdf.New()
+	require.Equal(t, token.TypePDF, g.Type())
+}
+
+func TestGenerate_ArtifactKindIsFile(t *testing.T) {
+	g := pdf.New()
+	art, err := g.Generate(
+		context.Background(),
+		newPDFToken("abc"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+	require.Equal(t, generators.KindFile, art.Kind)
+}
+
+func TestGenerate_ContentTypeIsPDFMIME(t *testing.T) {
+	g := pdf.New()
+	art, err := g.Generate(
+		context.Background(),
+		newPDFToken("abc"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+	require.Equal(t, pdfContentTypeMIME, art.ContentType)
+}
+
+func TestGenerate_Filename(t *testing.T) {
+	g := pdf.New()
+
+	t.Run("nil Filename defaults to Document.pdf", func(t *testing.T) {
+		art, err := g.Generate(
+			context.Background(),
+			newPDFToken("abc"),
+			testBaseURL,
+		)
+		require.NoError(t, err)
+		require.Equal(t, defaultFilename, art.Filename)
+	})
+
+	t.Run(
+		"empty Filename pointer defaults to Document.pdf",
+		func(t *testing.T) {
+			art, err := g.Generate(
+				context.Background(),
+				newPDFTokenWithFilename("abc", ""),
+				testBaseURL,
+			)
+			require.NoError(t, err)
+			require.Equal(t, defaultFilename, art.Filename)
+		},
+	)
+
+	t.Run(
+		"whitespace-only Filename defaults to Document.pdf",
+		func(t *testing.T) {
+			art, err := g.Generate(
+				context.Background(),
+				newPDFTokenWithFilename("abc", "   "),
+				testBaseURL,
+			)
+			require.NoError(t, err)
+			require.Equal(t, defaultFilename, art.Filename)
+		},
+	)
+
+	t.Run("set Filename is preserved (trimmed)", func(t *testing.T) {
+		art, err := g.Generate(
+			context.Background(),
+			newPDFTokenWithFilename("abc", "  Q4-Plan.pdf  "),
+			testBaseURL,
+		)
+		require.NoError(t, err)
+		require.Equal(t, "Q4-Plan.pdf", art.Filename)
+	})
+}
+
+func TestGenerate_TriggerURL(t *testing.T) {
+	g := pdf.New()
+
+	t.Run("base URL trailing slash trimmed", func(t *testing.T) {
+		artA, err := g.Generate(
+			context.Background(),
+			newPDFToken("tk1"),
+			"https://canary.example.com",
+		)
+		require.NoError(t, err)
+		artB, err := g.Generate(
+			context.Background(),
+			newPDFToken("tk1"),
+			"https://canary.example.com/",
+		)
+		require.NoError(t, err)
+
+		require.Contains(
+			t,
+			string(artA.Content),
+			"https://canary.example.com/c/tk1",
+		)
+		require.Contains(
+			t,
+			string(artB.Content),
+			"https://canary.example.com/c/tk1",
+		)
+	})
+
+	t.Run("base URL subpath preserved", func(t *testing.T) {
+		art, err := g.Generate(
+			context.Background(),
+			newPDFToken("tk2"),
+			"https://example.com/canary",
+		)
+		require.NoError(t, err)
+		require.Contains(
+			t,
+			string(art.Content),
+			"https://example.com/canary/c/tk2",
+		)
+	})
+
+	t.Run(
+		"different token ids produce distinct outputs",
+		func(t *testing.T) {
+			artA, err := g.Generate(
+				context.Background(),
+				newPDFToken("aaa"),
+				testBaseURL,
+			)
+			require.NoError(t, err)
+			artB, err := g.Generate(
+				context.Background(),
+				newPDFToken("bbb"),
+				testBaseURL,
+			)
+			require.NoError(t, err)
+			require.NotEqual(t, artA.Content, artB.Content)
+		},
+	)
+}
+
+func TestGenerate_LengthUnchanged(t *testing.T) {
+	g := pdf.New()
+	art, err := g.Generate(
+		context.Background(),
+		newPDFToken("abc"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+	require.Len(
+		t,
+		art.Content,
+		len(rawTemplate),
+		"output byte length must equal template byte length so xref offsets remain valid",
+	)
+}
+
+func TestGenerate_ContainsTriggerURL(t *testing.T) {
+	g := pdf.New()
+	art, err := g.Generate(
+		context.Background(),
+		newPDFToken("token42"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+
+	require.True(
+		t,
+		bytes.Contains(
+			art.Content,
+			[]byte("https://canary.example.com/c/token42"),
+		),
+		"output must contain the canary trigger URL after substitution",
+	)
+}
+
+func TestGenerate_ByteAfterTokenIDIsNotUnderscore(t *testing.T) {
+	g := pdf.New()
+	art, err := g.Generate(
+		context.Background(),
+		newPDFToken("token42"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+
+	urlPrefix := testBaseURL + "/c/token42"
+	idx := bytes.Index(art.Content, []byte(urlPrefix))
+	require.GreaterOrEqual(
+		t,
+		idx,
+		0,
+		"trigger URL prefix must be present in PDF output",
+	)
+	after := art.Content[idx+len(urlPrefix)]
+	require.NotEqual(
+		t,
+		byte('_'),
+		after,
+		"byte immediately after the token id must not be underscore — "+
+			"otherwise Acrobat fetches /c/token42____ and the canary silently "+
+			"no-ops on lookup (audit finding F2)",
+	)
+}
+
+func TestGenerate_PlaceholderRemoved(t *testing.T) {
+	g := pdf.New()
+	art, err := g.Generate(
+		context.Background(),
+		newPDFToken("xyz"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+
+	require.False(
+		t,
+		bytes.Contains(art.Content, []byte(placeholderRootLiteral)),
+		"placeholder root must be fully substituted out of the output",
+	)
+}
+
+func TestGenerate_TooLongURL_ReturnsError(t *testing.T) {
+	g := pdf.New()
+
+	overLongID := strings.Repeat("x", pdf.PlaceholderLength)
+	_, err := g.Generate(
+		context.Background(),
+		newPDFToken(overLongID),
+		testBaseURL,
+	)
+	require.Error(t, err)
+	require.ErrorIs(t, err, pdf.ErrTriggerURLTooLong)
+}
+
+func TestGenerate_BoundaryURL_AtPlaceholderLength_Succeeds(t *testing.T) {
+	g := pdf.New()
+
+	base := "http://x"
+	prefix := base + "/c/"
+	idLen := pdf.PlaceholderLength - len(prefix)
+	require.Positive(
+		t,
+		idLen,
+		"test base+/c/ must leave room for at least one id char",
+	)
+	id := strings.Repeat("a", idLen)
+
+	art, err := g.Generate(
+		context.Background(),
+		newPDFToken(id),
+		base,
+	)
+	require.NoError(
+		t,
+		err,
+		"URL whose length exactly equals placeholder length must succeed (no padding needed)",
+	)
+	require.True(
+		t,
+		bytes.Contains(art.Content, []byte(prefix+id)),
+		"boundary URL must be present in output",
+	)
+}
+
+func TestGenerate_PdfcpuValidates(t *testing.T) {
+	g := pdf.New()
+	art, err := g.Generate(
+		context.Background(),
+		newPDFToken("validate-me"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+	require.NoError(
+		t,
+		api.Validate(bytes.NewReader(art.Content), nil),
+		"output PDF must remain valid after placeholder substitution",
+	)
+}
+
+func TestGenerate_OutputDifferentFromTemplate(t *testing.T) {
+	g := pdf.New()
+	art, err := g.Generate(
+		context.Background(),
+		newPDFToken("abc"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+	require.NotEqual(
+		t,
+		rawTemplate,
+		art.Content,
+		"output must differ from template after substitution",
+	)
+}
+
+func TestGenerate_SubstitutionAtSamePlaceholderPosition(t *testing.T) {
+	g := pdf.New()
+	art, err := g.Generate(
+		context.Background(),
+		newPDFToken("position-check"),
+		testBaseURL,
+	)
+	require.NoError(t, err)
+
+	placeholderOffset := bytes.Index(
+		rawTemplate,
+		[]byte(placeholderRootLiteral),
+	)
+	require.GreaterOrEqual(t, placeholderOffset, 0)
+
+	urlOffset := bytes.Index(
+		art.Content,
+		[]byte("https://canary.example.com/c/position-check"),
+	)
+	require.Equal(
+		t,
+		placeholderOffset,
+		urlOffset,
+		"trigger URL must occupy the same byte offset the placeholder did",
+	)
+}
+
+func TestTrigger_ReturnsGIFLikeWebbug(t *testing.T) {
+	g := pdf.New()
+	tok := newPDFToken("abc")
+	r := httptest.NewRequest(http.MethodGet, "/c/abc", nil)
+
+	_, resp, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	require.Equal(t, pixel.ContentType, resp.ContentType)
+	require.Len(t, resp.Body, gifByteLength)
+	require.Equal(t, pixel.Clone(), resp.Body)
+	require.Equal(
+		t,
+		cacheControlNoStoreValue,
+		resp.ExtraHeaders["Cache-Control"],
+	)
+	require.Equal(t, pragmaNoCacheValue, resp.ExtraHeaders["Pragma"])
+}
+
+func TestTrigger_RecordsEventWithRequestMetadata(t *testing.T) {
+	g := pdf.New()
+	tok := newPDFToken("token1")
+
+	t.Run(
+		"captures token id, source ip, user agent, referer",
+		func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "/c/token1", nil)
+			r.Header.Set("CF-Connecting-IP", "203.0.113.50")
+			r.Header.Set("User-Agent", "AcrobatReader/2024.001")
+			r.Header.Set("Referer", "https://victim.example.com/share")
+
+			evt, _, err := g.Trigger(context.Background(), tok, r)
+			require.NoError(t, err)
+			require.NotNil(t, evt)
+			require.Equal(t, "token1", evt.TokenID)
+			require.Equal(t, "203.0.113.50", evt.SourceIP)
+			require.NotNil(t, evt.UserAgent)
+			require.Equal(t, "AcrobatReader/2024.001", *evt.UserAgent)
+			require.NotNil(t, evt.Referer)
+			require.Equal(
+				t,
+				"https://victim.example.com/share",
+				*evt.Referer,
+			)
+		},
+	)
+
+	t.Run("source ip precedence", func(t *testing.T) {
+		cases := []struct {
+			name    string
+			headers map[string]string
+			remote  string
+			wantIP  string
+		}{
+			{
+				name: "CF wins over XFF and XRI",
+				headers: map[string]string{
+					"CF-Connecting-IP": "203.0.113.10",
+					"X-Forwarded-For":  "198.51.100.1, 198.51.100.2",
+					"X-Real-IP":        "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "203.0.113.10",
+			},
+			{
+				name: "XFF leftmost wins over XRI when no CF",
+				headers: map[string]string{
+					"X-Forwarded-For": "198.51.100.1, 198.51.100.7",
+					"X-Real-IP":       "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "198.51.100.1",
+			},
+			{
+				name: "XFF trailing-comma falls through to last non-empty",
+				headers: map[string]string{
+					"X-Forwarded-For": "198.51.100.1, ",
+					"X-Real-IP":       "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "198.51.100.1",
+			},
+			{
+				name: "XFF entirely empty entries fall through to XRI",
+				headers: map[string]string{
+					"X-Forwarded-For": ", ,",
+					"X-Real-IP":       "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "192.0.2.99",
+			},
+			{
+				name: "XRI when no CF or XFF",
+				headers: map[string]string{
+					"X-Real-IP": "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "192.0.2.99",
+			},
+			{
+				name:    "RemoteAddr IPv4 strips port",
+				headers: nil,
+				remote:  "127.0.0.1:9999",
+				wantIP:  "127.0.0.1",
+			},
+			{
+				name:    "RemoteAddr IPv6 strips brackets and port",
+				headers: nil,
+				remote:  "[2001:db8::1]:54321",
+				wantIP:  "2001:db8::1",
+			},
+			{
+				name:    "RemoteAddr loopback IPv6 strips brackets and port",
+				headers: nil,
+				remote:  "[::1]:9999",
+				wantIP:  "::1",
+			},
+			{
+				name:    "RemoteAddr without port falls back to raw value",
+				headers: nil,
+				remote:  "127.0.0.1",
+				wantIP:  "127.0.0.1",
+			},
+			{
+				name: "XFF mixed IPv4+IPv6 leftmost",
+				headers: map[string]string{
+					"X-Forwarded-For": "198.51.100.1, 2001:db8::dead",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "198.51.100.1",
+			},
+			{
+				name: "CF value is trimmed of whitespace",
+				headers: map[string]string{
+					"CF-Connecting-IP": "  203.0.113.10  ",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "203.0.113.10",
+			},
+		}
+		for _, tc := range cases {
+			tc := tc
+			t.Run(tc.name, func(t *testing.T) {
+				r := httptest.NewRequest(http.MethodGet, "/c/token1", nil)
+				for k, v := range tc.headers {
+					r.Header.Set(k, v)
+				}
+				r.RemoteAddr = tc.remote
+				evt, _, err := g.Trigger(context.Background(), tok, r)
+				require.NoError(t, err)
+				require.NotNil(t, evt)
+				require.Equal(t, tc.wantIP, evt.SourceIP)
+			})
+		}
+	})
+
+	t.Run(
+		"missing user agent and referer record as nil pointers",
+		func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "/c/token1", nil)
+			r.Header.Del("User-Agent")
+			r.Header.Del("Referer")
+			r.Header.Set("CF-Connecting-IP", "203.0.113.5")
+
+			evt, _, err := g.Trigger(context.Background(), tok, r)
+			require.NoError(t, err)
+			require.NotNil(t, evt)
+			require.Nil(
+				t,
+				evt.UserAgent,
+				"absent user agent must map to nil, not empty string",
+			)
+			require.Nil(
+				t,
+				evt.Referer,
+				"absent referer must map to nil, not empty string",
+			)
+		},
+	)
+}
+
+func TestTrigger_ResponseBodyIsIndependentCopyPerCall(t *testing.T) {
+	g := pdf.New()
+	tok := newPDFToken("abc")
+	r := httptest.NewRequest(http.MethodGet, "/c/abc", nil)
+
+	_, resp1, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+	_, resp2, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+
+	resp1.Body[0] = 0x00
+	require.Equal(
+		t,
+		byte(0x47),
+		resp2.Body[0],
+		"each Trigger call must produce an independent body slice",
+	)
+}
+
+func TestTrigger_TokenNotFound_StillReturnsGIF(t *testing.T) {
+	g := pdf.New()
+	r := httptest.NewRequest(http.MethodGet, "/c/does-not-exist", nil)
+	r.Header.Set("CF-Connecting-IP", "203.0.113.100")
+	r.Header.Set("User-Agent", "AcrobatReader/2024")
+
+	evt, resp, err := g.Trigger(context.Background(), nil, r)
+	require.NoError(
+		t,
+		err,
+		"nil-token path must not error (spec §8.5 defense-in-depth)",
+	)
+	require.NotNil(t, resp, "nil-token path must still return GIF response")
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	require.Equal(t, pixel.ContentType, resp.ContentType)
+	require.Equal(t, pixel.Clone(), resp.Body)
+	require.Nil(
+		t,
+		evt,
+		"nil-token path returns nil event so the handler cannot persist a row with empty TokenID (FK violation)",
+	)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/pdf/template/template.pdf b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/pdf/template/template.pdf
new file mode 100644
index 00000000..71ff8c5e
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/pdf/template/template.pdf
@@ -0,0 +1,28 @@
+%PDF-1.4
+%����
+1 0 obj
+<< /Type /Catalog /Pages 2 0 R >>
+endobj
+2 0 obj
+<< /Type /Pages /Kids [3 0 R] /Count 1 >>
+endobj
+3 0 obj
+<<
+/Type /Page
+/Parent 2 0 R
+/MediaBox [0 0 612 792]
+/Resources << >>
+/AA << /O << /Type /Action /S /URI /URI (HONEY_TRACK_URL_PADDED_TO_FIXED_WIDTH_______________________________________) >> >>
+>>
+endobj
+xref
+0 4
+0000000000 65535 f 
+0000000015 00000 n 
+0000000064 00000 n 
+0000000121 00000 n 
+trailer
+<< /Size 4 /Root 1 0 R >>
+startxref
+334
+%%EOF
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/pixel/pixel.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/pixel/pixel.go
new file mode 100644
index 00000000..dec64e3e
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/pixel/pixel.go
@@ -0,0 +1,23 @@
+// ©AngelaMos | 2026
+// pixel.go
+
+package pixel
+
+import "slices"
+
+var transparentGIF = []byte{
+	0x47, 0x49, 0x46, 0x38, 0x39, 0x61, 0x01, 0x00, 0x01, 0x00, 0x80, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0x21, 0xf9, 0x04, 0x01, 0x00,
+	0x00, 0x00, 0x00, 0x2c, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00,
+	0x00, 0x02, 0x02, 0x44, 0x01, 0x00, 0x3b,
+}
+
+const ContentType = "image/gif"
+
+func Clone() []byte {
+	return slices.Clone(transparentGIF)
+}
+
+func Len() int {
+	return len(transparentGIF)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/pixel/pixel_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/pixel/pixel_test.go
new file mode 100644
index 00000000..7edc0839
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/pixel/pixel_test.go
@@ -0,0 +1,83 @@
+// ©AngelaMos | 2026
+// pixel_test.go
+
+package pixel_test
+
+import (
+	"bytes"
+	"image/gif"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/pixel"
+)
+
+const (
+	expectedLength = 43
+	expectedWidth  = 1
+	expectedHeight = 1
+)
+
+var (
+	gif89aMagic = []byte{0x47, 0x49, 0x46, 0x38, 0x39, 0x61}
+	gifTrailer  = byte(0x3b)
+)
+
+func TestLen_Is43(t *testing.T) {
+	require.Equal(t, expectedLength, pixel.Len())
+}
+
+func TestClone_Length(t *testing.T) {
+	require.Len(t, pixel.Clone(), expectedLength)
+}
+
+func TestClone_MagicBytes(t *testing.T) {
+	g := pixel.Clone()
+	require.True(
+		t,
+		bytes.HasPrefix(g, gif89aMagic),
+		"expected GIF89a magic prefix, got % x",
+		g[:len(gif89aMagic)],
+	)
+	require.Equal(
+		t,
+		gifTrailer,
+		g[len(g)-1],
+		"expected trailing GIF terminator 0x3B",
+	)
+}
+
+func TestClone_DecodesAsImageGIF(t *testing.T) {
+	img, err := gif.Decode(bytes.NewReader(pixel.Clone()))
+	require.NoError(t, err)
+	require.NotNil(t, img)
+
+	bounds := img.Bounds()
+	require.Equal(t, expectedWidth, bounds.Dx())
+	require.Equal(t, expectedHeight, bounds.Dy())
+}
+
+func TestClone_ReturnsIndependentCopy(t *testing.T) {
+	a := pixel.Clone()
+	b := pixel.Clone()
+	require.Equal(t, a, b, "two clones must be byte-equal")
+
+	a[0] = 0x00
+	require.Equal(
+		t,
+		byte(0x47),
+		b[0],
+		"mutating one clone must not affect another",
+	)
+	require.Equal(
+		t,
+		byte(0x47),
+		pixel.Clone()[0],
+		"mutating one clone must not affect the package-internal source",
+	)
+}
+
+func TestContentType_IsImageGIF(t *testing.T) {
+	require.Equal(t, "image/gif", pixel.ContentType)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/registry/registry.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/registry/registry.go
new file mode 100644
index 00000000..e4801823
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/registry/registry.go
@@ -0,0 +1,44 @@
+// ©AngelaMos | 2026
+// registry.go
+
+package registry
+
+import (
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/docx"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/envfile"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/kubeconfig"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/mysql"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/pdf"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/slowredirect"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/webbug"
+)
+
+type Config struct {
+	BaseURL         string
+	MySQLPublicHost string
+	MySQLPublicPort int
+}
+
+type Registry map[token.Type]generators.Generator
+
+func Build(cfg Config) Registry {
+	host := cfg.MySQLPublicHost
+	port := cfg.MySQLPublicPort
+	var mysqlGen *mysql.Generator
+	if host == "" || port == 0 {
+		mysqlGen = mysql.New()
+	} else {
+		mysqlGen = mysql.NewWithAddress(host, port)
+	}
+	return Registry{
+		token.TypeWebbug:       webbug.New(),
+		token.TypeSlowRedirect: slowredirect.New(),
+		token.TypeDocx:         docx.New(),
+		token.TypePDF:          pdf.New(),
+		token.TypeKubeconfig:   kubeconfig.New(),
+		token.TypeEnvfile:      envfile.New(),
+		token.TypeMySQL:        mysqlGen,
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/registry/registry_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/registry/registry_test.go
new file mode 100644
index 00000000..84dd1a53
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/registry/registry_test.go
@@ -0,0 +1,122 @@
+// ©AngelaMos | 2026
+// registry_test.go
+
+package registry_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/registry"
+)
+
+const testBaseURL = "https://canary.example.com"
+
+func TestBuild_RegistersWebbug(t *testing.T) {
+	reg := registry.Build(registry.Config{BaseURL: testBaseURL})
+	g, ok := reg[token.TypeWebbug]
+	require.True(t, ok, "expected webbug generator registered")
+	require.NotNil(t, g)
+	require.Equal(t, token.TypeWebbug, g.Type())
+}
+
+func TestBuild_RegistersSlowRedirect(t *testing.T) {
+	reg := registry.Build(registry.Config{BaseURL: testBaseURL})
+	g, ok := reg[token.TypeSlowRedirect]
+	require.True(t, ok, "expected slowredirect generator registered")
+	require.NotNil(t, g)
+	require.Equal(t, token.TypeSlowRedirect, g.Type())
+}
+
+func TestBuild_RegistersDocx(t *testing.T) {
+	reg := registry.Build(registry.Config{BaseURL: testBaseURL})
+	g, ok := reg[token.TypeDocx]
+	require.True(t, ok, "expected docx generator registered")
+	require.NotNil(t, g)
+	require.Equal(t, token.TypeDocx, g.Type())
+}
+
+func TestBuild_RegistersPDF(t *testing.T) {
+	reg := registry.Build(registry.Config{BaseURL: testBaseURL})
+	g, ok := reg[token.TypePDF]
+	require.True(t, ok, "expected pdf generator registered")
+	require.NotNil(t, g)
+	require.Equal(t, token.TypePDF, g.Type())
+}
+
+func TestBuild_RegistersKubeconfig(t *testing.T) {
+	reg := registry.Build(registry.Config{BaseURL: testBaseURL})
+	g, ok := reg[token.TypeKubeconfig]
+	require.True(t, ok, "expected kubeconfig generator registered")
+	require.NotNil(t, g)
+	require.Equal(t, token.TypeKubeconfig, g.Type())
+}
+
+func TestBuild_RegistersEnvfile(t *testing.T) {
+	reg := registry.Build(registry.Config{BaseURL: testBaseURL})
+	g, ok := reg[token.TypeEnvfile]
+	require.True(t, ok, "expected envfile generator registered")
+	require.NotNil(t, g)
+	require.Equal(t, token.TypeEnvfile, g.Type())
+}
+
+func TestBuild_RegistersMySQL(t *testing.T) {
+	reg := registry.Build(registry.Config{BaseURL: testBaseURL})
+	g, ok := reg[token.TypeMySQL]
+	require.True(t, ok, "expected mysql generator registered")
+	require.NotNil(t, g)
+	require.Equal(t, token.TypeMySQL, g.Type())
+}
+
+func TestBuild_UnknownTypeReturnsZeroValue(t *testing.T) {
+	reg := registry.Build(registry.Config{BaseURL: testBaseURL})
+	g, ok := reg["nonexistent-type"]
+	require.False(t, ok, "unknown type must not be present")
+	require.Nil(t, g, "map zero value for missing key must be nil interface")
+}
+
+func TestBuild_MySQLUsesConfiguredPublicAddress(t *testing.T) {
+	reg := registry.Build(registry.Config{
+		BaseURL:         testBaseURL,
+		MySQLPublicHost: "canary.example.com",
+		MySQLPublicPort: 13306,
+	})
+	g, ok := reg[token.TypeMySQL]
+	require.True(t, ok)
+
+	tok := &token.Token{ID: "abc", Type: token.TypeMySQL}
+	art, err := g.Generate(context.Background(), tok, testBaseURL)
+	require.NoError(t, err)
+	require.Equal(
+		t,
+		"mysql://canary_abc@canary.example.com:13306/internal_db",
+		art.ConnectionString,
+		"mysql connection string must reflect configured public host:port",
+	)
+}
+
+func TestBuild_AllSevenGeneratorsRegistered(t *testing.T) {
+	reg := registry.Build(registry.Config{BaseURL: testBaseURL})
+	require.Len(
+		t,
+		reg,
+		7,
+		"Phase 8 closes the generator set with all 7 types registered (webbug, slowredirect, docx, pdf, kubeconfig, envfile, mysql)",
+	)
+
+	for _, ty := range []token.Type{
+		token.TypeWebbug,
+		token.TypeSlowRedirect,
+		token.TypeDocx,
+		token.TypePDF,
+		token.TypeKubeconfig,
+		token.TypeEnvfile,
+		token.TypeMySQL,
+	} {
+		_, ok := reg[ty]
+		require.True(t, ok, "type %q must be registered", ty)
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/slowredirect/fingerprint_handler.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/slowredirect/fingerprint_handler.go
new file mode 100644
index 00000000..4ec322b4
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/slowredirect/fingerprint_handler.go
@@ -0,0 +1,87 @@
+// ©AngelaMos | 2026
+// fingerprint_handler.go
+
+package slowredirect
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"log/slog"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/middleware"
+)
+
+const (
+	fingerprintWindow     = 30 * time.Second
+	fingerprintMaxBytes   = 64 * 1024
+	urlParamTokenID       = "id"
+	headerContentType     = "Content-Type"
+	contentTypeJSONPrefix = "application/json"
+)
+
+type FingerprintAttacher interface {
+	AttachFingerprint(
+		ctx context.Context,
+		tokenID, sourceIP string,
+		fingerprint json.RawMessage,
+		window time.Duration,
+	) error
+}
+
+type FingerprintHandler struct {
+	attacher FingerprintAttacher
+	window   time.Duration
+}
+
+func NewFingerprintHandler(a FingerprintAttacher) *FingerprintHandler {
+	return &FingerprintHandler{
+		attacher: a,
+		window:   fingerprintWindow,
+	}
+}
+
+func (h *FingerprintHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+
+	tokenID := chi.URLParam(r, urlParamTokenID)
+	if tokenID == "" {
+		w.WriteHeader(http.StatusNoContent)
+		return
+	}
+
+	if !strings.HasPrefix(
+		strings.ToLower(r.Header.Get(headerContentType)),
+		contentTypeJSONPrefix,
+	) {
+		w.WriteHeader(http.StatusNoContent)
+		return
+	}
+
+	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, fingerprintMaxBytes))
+	if err != nil || len(body) == 0 || !json.Valid(body) {
+		w.WriteHeader(http.StatusNoContent)
+		return
+	}
+
+	if err := h.attacher.AttachFingerprint(
+		ctx,
+		tokenID,
+		middleware.RealIP(r),
+		json.RawMessage(body),
+		h.window,
+	); err != nil && !errors.Is(err, event.ErrNotFound) {
+		slog.WarnContext(ctx, "attach fingerprint failed",
+			"token_id", tokenID,
+			"error", err,
+		)
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/slowredirect/fingerprint_handler_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/slowredirect/fingerprint_handler_test.go
new file mode 100644
index 00000000..95e154ef
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/slowredirect/fingerprint_handler_test.go
@@ -0,0 +1,293 @@
+// ©AngelaMos | 2026
+// fingerprint_handler_test.go
+
+//go:build integration
+
+package slowredirect_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"github.com/jmoiron/sqlx"
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/testutil"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/slowredirect"
+)
+
+const (
+	fingerprintRoute = "/c/{id}/fingerprint"
+	clientIP         = "203.0.113.45"
+	jsonContentType  = "application/json"
+)
+
+func newSlowredirectRepos(
+	t *testing.T,
+) (*token.Repository, *event.Repository) {
+	t.Helper()
+	db := sqlx.NewDb(testutil.NewTestDB(t), "pgx")
+	return token.NewRepository(db), event.NewRepository(db)
+}
+
+func seedSlowredirectToken(
+	t *testing.T,
+	repo *token.Repository,
+	id, destination string,
+) *token.Token {
+	t.Helper()
+	metaJSON, err := json.Marshal(map[string]string{
+		"destination_url": destination,
+	})
+	require.NoError(t, err)
+	tok := &token.Token{
+		ID:           id,
+		ManageID:     uuid.New().String(),
+		Type:         token.TypeSlowRedirect,
+		Memo:         "integration-fp",
+		AlertChannel: token.ChannelWebhook,
+		WebhookURL:   testutil.Ptr("https://example.com/hook"),
+		CreatedIP:    clientIP,
+		CreatedFP:    "abcdef0123456789",
+		Metadata:     json.RawMessage(metaJSON),
+		Enabled:      true,
+	}
+	require.NoError(t, repo.Insert(context.Background(), tok))
+	return tok
+}
+
+func seedSlowredirectEvent(
+	t *testing.T,
+	evtRepo *event.Repository,
+	tokenID string,
+) *event.Event {
+	t.Helper()
+	e := &event.Event{
+		TokenID:  tokenID,
+		SourceIP: clientIP,
+		Extra:    json.RawMessage(`{"initial":"value"}`),
+	}
+	require.NoError(t, evtRepo.Insert(context.Background(), e))
+	return e
+}
+
+func mountFingerprintRouter(h http.Handler) http.Handler {
+	r := chi.NewRouter()
+	r.Post(fingerprintRoute, h.ServeHTTP)
+	return r
+}
+
+func postFingerprint(
+	router http.Handler,
+	tokenID, contentType string,
+	body []byte,
+) *httptest.ResponseRecorder {
+	req := httptest.NewRequest(
+		http.MethodPost,
+		"/c/"+tokenID+"/fingerprint",
+		bytes.NewReader(body),
+	)
+	req.Header.Set("CF-Connecting-IP", clientIP)
+	if contentType != "" {
+		req.Header.Set("Content-Type", contentType)
+	}
+	rr := httptest.NewRecorder()
+	router.ServeHTTP(rr, req)
+	return rr
+}
+
+func TestFingerprintHandler_AttachesToRecentEvent(t *testing.T) {
+	t.Parallel()
+	tokRepo, evtRepo := newSlowredirectRepos(t)
+	ctx := context.Background()
+
+	tok := seedSlowredirectToken(t, tokRepo, "fpattach0001",
+		"https://news.example.com")
+	evt := seedSlowredirectEvent(t, evtRepo, tok.ID)
+
+	router := mountFingerprintRouter(slowredirect.NewFingerprintHandler(evtRepo))
+
+	fpBody := []byte(
+		`{"screen":{"w":1920,"h":1080},"timezone":"America/Los_Angeles"}`,
+	)
+	rr := postFingerprint(router, tok.ID, jsonContentType, fpBody)
+	require.Equal(t, http.StatusNoContent, rr.Code)
+
+	got, err := evtRepo.GetByID(ctx, evt.ID)
+	require.NoError(t, err)
+
+	var merged map[string]any
+	require.NoError(t, json.Unmarshal(got.Extra, &merged))
+	require.Equal(t, "value", merged["initial"])
+	require.Equal(t, "America/Los_Angeles", merged["timezone"])
+	screen, ok := merged["screen"].(map[string]any)
+	require.True(t, ok, "screen sub-object must round-trip as nested map")
+	require.EqualValues(t, 1920, screen["w"])
+	require.EqualValues(t, 1080, screen["h"])
+}
+
+func TestFingerprintHandler_NoMatchingEvent_Returns204(t *testing.T) {
+	t.Parallel()
+	tokRepo, evtRepo := newSlowredirectRepos(t)
+
+	tok := seedSlowredirectToken(t, tokRepo, "fpnomatch001",
+		"https://news.example.com")
+
+	router := mountFingerprintRouter(slowredirect.NewFingerprintHandler(evtRepo))
+
+	rr := postFingerprint(
+		router, tok.ID, jsonContentType,
+		[]byte(`{"screen":{"w":800,"h":600}}`),
+	)
+	require.Equal(
+		t,
+		http.StatusNoContent,
+		rr.Code,
+		"no matching event must still return 204 — fingerprint is enrichment, not the trigger",
+	)
+}
+
+func TestFingerprintHandler_InvalidJSON_Returns204AndDoesNotTouchEvent(
+	t *testing.T,
+) {
+	t.Parallel()
+	tokRepo, evtRepo := newSlowredirectRepos(t)
+	ctx := context.Background()
+
+	tok := seedSlowredirectToken(t, tokRepo, "fpinvjson001",
+		"https://news.example.com")
+	evt := seedSlowredirectEvent(t, evtRepo, tok.ID)
+
+	router := mountFingerprintRouter(slowredirect.NewFingerprintHandler(evtRepo))
+
+	rr := postFingerprint(
+		router, tok.ID, jsonContentType,
+		[]byte("not-json-at-all"),
+	)
+	require.Equal(t, http.StatusNoContent, rr.Code)
+
+	got, err := evtRepo.GetByID(ctx, evt.ID)
+	require.NoError(t, err)
+
+	var stored map[string]any
+	require.NoError(t, json.Unmarshal(got.Extra, &stored))
+	require.Equal(
+		t,
+		"value",
+		stored["initial"],
+		"invalid JSON must not corrupt the stored Extra JSONB",
+	)
+}
+
+func TestFingerprintHandler_WrongContentType_Returns204AndDoesNotTouchEvent(
+	t *testing.T,
+) {
+	t.Parallel()
+	tokRepo, evtRepo := newSlowredirectRepos(t)
+	ctx := context.Background()
+
+	tok := seedSlowredirectToken(t, tokRepo, "fpctype00001",
+		"https://news.example.com")
+	evt := seedSlowredirectEvent(t, evtRepo, tok.ID)
+
+	router := mountFingerprintRouter(slowredirect.NewFingerprintHandler(evtRepo))
+
+	rr := postFingerprint(
+		router, tok.ID,
+		"text/plain",
+		[]byte(`{"screen":{"w":1024,"h":768}}`),
+	)
+	require.Equal(
+		t,
+		http.StatusNoContent,
+		rr.Code,
+		"non-JSON content-type must be ignored — handler only processes the embedded template's POST",
+	)
+
+	got, err := evtRepo.GetByID(ctx, evt.ID)
+	require.NoError(t, err)
+
+	var stored map[string]any
+	require.NoError(t, json.Unmarshal(got.Extra, &stored))
+	require.Equal(t, "value", stored["initial"])
+	_, mergedAnyway := stored["screen"]
+	require.False(
+		t,
+		mergedAnyway,
+		"event Extra must not absorb a payload whose content-type was rejected",
+	)
+}
+
+func TestFingerprintHandler_OversizeBody_Returns204AndDoesNotTouchEvent(
+	t *testing.T,
+) {
+	t.Parallel()
+	tokRepo, evtRepo := newSlowredirectRepos(t)
+	ctx := context.Background()
+
+	tok := seedSlowredirectToken(t, tokRepo, "fpoversz0001",
+		"https://news.example.com")
+	evt := seedSlowredirectEvent(t, evtRepo, tok.ID)
+
+	router := mountFingerprintRouter(slowredirect.NewFingerprintHandler(evtRepo))
+
+	const oversizeBytes = 128 * 1024
+	junk := strings.Repeat("A", oversizeBytes)
+	body := []byte(`{"junk":"` + junk + `"}`)
+	require.Greater(t, len(body), 64*1024)
+
+	rr := postFingerprint(router, tok.ID, jsonContentType, body)
+	require.Equal(
+		t,
+		http.StatusNoContent,
+		rr.Code,
+		"body over the 64 KiB cap must still return 204 — no error surfaces to the client",
+	)
+
+	got, err := evtRepo.GetByID(ctx, evt.ID)
+	require.NoError(t, err)
+
+	var stored map[string]any
+	require.NoError(t, json.Unmarshal(got.Extra, &stored))
+	require.Equal(t, "value", stored["initial"])
+	_, mergedAnyway := stored["junk"]
+	require.False(
+		t,
+		mergedAnyway,
+		"oversize body must not be merged into Extra — MaxBytesReader cuts before AttachFingerprint",
+	)
+}
+
+func TestFingerprintHandler_EmptyTokenID_Returns204(t *testing.T) {
+	t.Parallel()
+	_, evtRepo := newSlowredirectRepos(t)
+
+	handler := slowredirect.NewFingerprintHandler(evtRepo)
+	r := chi.NewRouter()
+	r.Post("/c/{id}/fingerprint", handler.ServeHTTP)
+
+	req := httptest.NewRequest(
+		http.MethodPost,
+		"/c//fingerprint",
+		bytes.NewReader([]byte(`{}`)),
+	)
+	req.Header.Set("Content-Type", jsonContentType)
+	rr := httptest.NewRecorder()
+	r.ServeHTTP(rr, req)
+
+	require.Contains(
+		t,
+		[]int{http.StatusNoContent, http.StatusNotFound, http.StatusMovedPermanently},
+		rr.Code,
+		"empty token id must not produce a 5xx — handler's guard returns 204, chi may also redirect or 404 at the routing layer",
+	)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/slowredirect/generator.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/slowredirect/generator.go
new file mode 100644
index 00000000..b25c9645
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/slowredirect/generator.go
@@ -0,0 +1,181 @@
+// ©AngelaMos | 2026
+// generator.go
+
+package slowredirect
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"html/template"
+	"net/http"
+	"strings"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/middleware"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators"
+)
+
+const (
+	headerReferer      = "Referer"
+	headerCSP          = "Content-Security-Policy"
+	headerCacheControl = "Cache-Control"
+	headerPragma       = "Pragma"
+
+	cspOverride         = "default-src 'none'; script-src 'unsafe-inline'; connect-src 'self'"
+	cacheControlNoStore = "no-store, no-cache, must-revalidate, max-age=0"
+	pragmaNoCache       = "no-cache"
+	contentTypeHTML     = "text/html; charset=utf-8"
+
+	triggerPathPrefix     = "/c/"
+	fingerprintPathSuffix = "/fingerprint"
+	metadataDestKey       = "destination_url"
+
+	schemeHTTP  = "http://"
+	schemeHTTPS = "https://"
+
+	enumerationDecoyDestination = "/"
+)
+
+var (
+	ErrMissingDestination = errors.New(
+		"slowredirect: destination_url missing from token metadata",
+	)
+	ErrInvalidDestinationScheme = errors.New(
+		"slowredirect: destination_url must use http:// or https:// scheme",
+	)
+)
+
+//go:embed template.html
+var templateHTML string
+
+var pageTemplate = template.Must(
+	template.New("slowredirect").Parse(templateHTML),
+)
+
+type pageData struct {
+	Destination    string
+	FingerprintURL string
+}
+
+type Generator struct{}
+
+func New() *Generator { return &Generator{} }
+
+func (g *Generator) Type() token.Type { return token.TypeSlowRedirect }
+
+func (g *Generator) Generate(
+	_ context.Context,
+	t *token.Token,
+	baseURL string,
+) (generators.Artifact, error) {
+	dest, err := extractDestination(t.Metadata)
+	if err != nil {
+		return generators.Artifact{}, err
+	}
+	url := strings.TrimRight(baseURL, "/") + triggerPathPrefix + t.ID
+	return generators.Artifact{
+		Kind:           generators.KindURL,
+		URL:            url,
+		DestinationURL: dest,
+	}, nil
+}
+
+func (g *Generator) Trigger(
+	_ context.Context,
+	t *token.Token,
+	r *http.Request,
+) (*event.Event, *generators.TriggerResponse, error) {
+	if t == nil {
+		resp, err := renderDecoyResponse()
+		if err != nil {
+			return nil, nil, err
+		}
+		return nil, resp, nil
+	}
+
+	dest, err := extractDestination(t.Metadata)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	resp, err := renderResponse(dest, t.ID)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	evt := &event.Event{
+		TokenID:   t.ID,
+		SourceIP:  middleware.RealIP(r),
+		UserAgent: middleware.OptionalHeader(r.UserAgent()),
+		Referer:   middleware.OptionalHeader(r.Header.Get(headerReferer)),
+	}
+	return evt, resp, nil
+}
+
+func renderResponse(
+	destination, tokenID string,
+) (*generators.TriggerResponse, error) {
+	return renderWith(pageData{
+		Destination:    destination,
+		FingerprintURL: triggerPathPrefix + tokenID + fingerprintPathSuffix,
+	})
+}
+
+func renderDecoyResponse() (*generators.TriggerResponse, error) {
+	return renderWith(pageData{
+		Destination:    enumerationDecoyDestination,
+		FingerprintURL: enumerationDecoyDestination,
+	})
+}
+
+func renderWith(
+	data pageData,
+) (*generators.TriggerResponse, error) {
+	var body bytes.Buffer
+	if err := pageTemplate.Execute(&body, data); err != nil {
+		return nil, fmt.Errorf("render slowredirect template: %w", err)
+	}
+	return &generators.TriggerResponse{
+		StatusCode:  http.StatusOK,
+		ContentType: contentTypeHTML,
+		Body:        body.Bytes(),
+		ExtraHeaders: map[string]string{
+			headerCSP:          cspOverride,
+			headerCacheControl: cacheControlNoStore,
+			headerPragma:       pragmaNoCache,
+		},
+	}, nil
+}
+
+func extractDestination(metadata json.RawMessage) (string, error) {
+	if len(metadata) == 0 {
+		return "", ErrMissingDestination
+	}
+	var m map[string]json.RawMessage
+	if err := json.Unmarshal(metadata, &m); err != nil {
+		return "", fmt.Errorf("parse token metadata: %w", err)
+	}
+	raw, ok := m[metadataDestKey]
+	if !ok {
+		return "", ErrMissingDestination
+	}
+	var dest string
+	if err := json.Unmarshal(raw, &dest); err != nil {
+		return "", fmt.Errorf("parse destination_url: %w", err)
+	}
+	dest = strings.TrimSpace(dest)
+	if dest == "" {
+		return "", ErrMissingDestination
+	}
+	lower := strings.ToLower(dest)
+	if !strings.HasPrefix(lower, schemeHTTP) &&
+		!strings.HasPrefix(lower, schemeHTTPS) {
+		return "", ErrInvalidDestinationScheme
+	}
+	return dest, nil
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/slowredirect/generator_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/slowredirect/generator_test.go
new file mode 100644
index 00000000..0dfcad35
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/slowredirect/generator_test.go
@@ -0,0 +1,477 @@
+// ©AngelaMos | 2026
+// generator_test.go
+
+package slowredirect_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/slowredirect"
+)
+
+const (
+	cspOverride         = "default-src 'none'; script-src 'unsafe-inline'; connect-src 'self'"
+	cacheControlNoStore = "no-store, no-cache, must-revalidate, max-age=0"
+	pragmaNoCache       = "no-cache"
+	contentTypeHTML     = "text/html; charset=utf-8"
+)
+
+func newSlowRedirectToken(t testing.TB, id, destination string) *token.Token {
+	t.Helper()
+	metadata := json.RawMessage(`{}`)
+	if destination != "" {
+		raw, err := json.Marshal(map[string]string{
+			"destination_url": destination,
+		})
+		require.NoError(t, err)
+		metadata = raw
+	}
+	return &token.Token{
+		ID:           id,
+		ManageID:     "manage-" + id,
+		Type:         token.TypeSlowRedirect,
+		Memo:         "unit test slowredirect",
+		AlertChannel: token.ChannelWebhook,
+		Enabled:      true,
+		Metadata:     metadata,
+	}
+}
+
+func TestGenerator_TypeIsSlowRedirect(t *testing.T) {
+	g := slowredirect.New()
+	require.Equal(t, token.TypeSlowRedirect, g.Type())
+}
+
+func TestGenerate_PersistsDestinationOnToken(t *testing.T) {
+	cases := []struct {
+		name        string
+		baseURL     string
+		id          string
+		destination string
+		wantURL     string
+	}{
+		{
+			name:        "plain destination",
+			baseURL:     "https://canary.example.com",
+			id:          "abc123",
+			destination: "https://news.example.com/article/42",
+			wantURL:     "https://canary.example.com/c/abc123",
+		},
+		{
+			name:        "trailing slash trimmed on base URL",
+			baseURL:     "https://canary.example.com/",
+			id:          "xyz999",
+			destination: "https://news.example.com",
+			wantURL:     "https://canary.example.com/c/xyz999",
+		},
+		{
+			name:        "subpath base URL preserved",
+			baseURL:     "https://example.com/canary",
+			id:          "p7",
+			destination: "https://other.example.com",
+			wantURL:     "https://example.com/canary/c/p7",
+		},
+	}
+
+	g := slowredirect.New()
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			tok := newSlowRedirectToken(t, tc.id, tc.destination)
+			art, err := g.Generate(
+				context.Background(),
+				tok,
+				tc.baseURL,
+			)
+			require.NoError(t, err)
+			require.Equal(t, generators.KindURL, art.Kind)
+			require.Equal(t, tc.wantURL, art.URL)
+			require.Equal(
+				t,
+				tc.destination,
+				art.DestinationURL,
+				"artifact must surface destination_url that was persisted on the token metadata",
+			)
+		})
+	}
+}
+
+func TestGenerate_RejectsMissingDestination(t *testing.T) {
+	cases := []struct {
+		name     string
+		metadata json.RawMessage
+		wantErr  error
+	}{
+		{
+			name:     "empty metadata",
+			metadata: json.RawMessage(``),
+			wantErr:  slowredirect.ErrMissingDestination,
+		},
+		{
+			name:     "empty object",
+			metadata: json.RawMessage(`{}`),
+			wantErr:  slowredirect.ErrMissingDestination,
+		},
+		{
+			name:     "empty destination string",
+			metadata: json.RawMessage(`{"destination_url":""}`),
+			wantErr:  slowredirect.ErrMissingDestination,
+		},
+		{
+			name:     "whitespace destination",
+			metadata: json.RawMessage(`{"destination_url":"   "}`),
+			wantErr:  slowredirect.ErrMissingDestination,
+		},
+		{
+			name:     "wrong key",
+			metadata: json.RawMessage(`{"redirect":"https://example.com"}`),
+			wantErr:  slowredirect.ErrMissingDestination,
+		},
+	}
+
+	g := slowredirect.New()
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			tok := &token.Token{
+				ID:       "missingdest",
+				Type:     token.TypeSlowRedirect,
+				Metadata: tc.metadata,
+			}
+			_, err := g.Generate(
+				context.Background(),
+				tok,
+				"https://canary.example.com",
+			)
+			require.ErrorIs(t, err, tc.wantErr)
+		})
+	}
+}
+
+func TestGenerate_RejectsDangerousDestinationSchemes(t *testing.T) {
+	cases := []struct {
+		name        string
+		destination string
+	}{
+		{name: "javascript: scheme", destination: "javascript:alert(1)"},
+		{
+			name:        "javascript: scheme with mixed case",
+			destination: "JavaScript:alert(1)",
+		},
+		{
+			name:        "data: URI",
+			destination: "data:text/html;base64,PHNjcmlwdD4=",
+		},
+		{name: "file: scheme", destination: "file:///etc/passwd"},
+		{name: "vbscript: scheme", destination: "vbscript:msgbox(1)"},
+		{name: "no scheme", destination: "example.com/path"},
+		{name: "relative path", destination: "/path"},
+		{name: "protocol-relative", destination: "//example.com"},
+	}
+
+	g := slowredirect.New()
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			tok := newSlowRedirectToken(t, "schemecheck1", tc.destination)
+			_, err := g.Generate(
+				context.Background(),
+				tok,
+				"https://canary.example.com",
+			)
+			require.ErrorIs(
+				t,
+				err,
+				slowredirect.ErrInvalidDestinationScheme,
+				"destination scheme %q must be rejected to keep the noscript meta-refresh from following dangerous URIs when JS is disabled",
+				tc.destination,
+			)
+		})
+	}
+}
+
+func TestGenerate_AcceptsHTTPAndHTTPSSchemes(t *testing.T) {
+	g := slowredirect.New()
+	cases := []string{
+		"http://news.example.com",
+		"https://news.example.com",
+		"HTTP://news.example.com",
+		"HtTpS://news.example.com",
+	}
+	for _, dest := range cases {
+		dest := dest
+		t.Run(dest, func(t *testing.T) {
+			tok := newSlowRedirectToken(t, "schemeok0001", dest)
+			art, err := g.Generate(
+				context.Background(),
+				tok,
+				"https://canary.example.com",
+			)
+			require.NoError(t, err)
+			require.Equal(t, dest, art.DestinationURL)
+		})
+	}
+}
+
+func TestTrigger_RendersHTMLWithEscapedDestination(t *testing.T) {
+	g := slowredirect.New()
+
+	t.Run("plain destination renders into JS and noscript", func(t *testing.T) {
+		dest := "https://news.example.com/article"
+		tok := newSlowRedirectToken(t, "plainok01", dest)
+		r := httptest.NewRequest(http.MethodGet, "/c/plainok01", nil)
+		r.Header.Set("CF-Connecting-IP", "203.0.113.7")
+
+		evt, resp, err := g.Trigger(context.Background(), tok, r)
+		require.NoError(t, err)
+		require.NotNil(t, evt)
+		require.NotNil(t, resp)
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		require.Equal(t, contentTypeHTML, resp.ContentType)
+
+		body := string(resp.Body)
+		require.Contains(
+			t,
+			body,
+			`url=https://news.example.com/article`,
+			"noscript meta refresh must point at the destination",
+		)
+		require.Contains(
+			t,
+			body,
+			"https://news.example.com/article",
+			"JS body must include the destination for window.location.replace",
+		)
+		require.Contains(
+			t,
+			body,
+			"/c/plainok01/fingerprint",
+			"JS body must reference the per-token fingerprint endpoint",
+		)
+	})
+
+	t.Run("XSS attempt in destination is neutralized", func(t *testing.T) {
+		hostile := `https://x.example.com/" /></noscript><script>alert(1)</script>`
+		tok := newSlowRedirectToken(t, "xssa001", hostile)
+		r := httptest.NewRequest(http.MethodGet, "/c/xssa001", nil)
+
+		_, resp, err := g.Trigger(context.Background(), tok, r)
+		require.NoError(t, err)
+		body := string(resp.Body)
+
+		require.NotContains(
+			t,
+			body,
+			"<script>alert(1)</script>",
+			"raw script injection must not appear unescaped in any context",
+		)
+		require.NotContains(
+			t,
+			body,
+			`/></noscript><script>`,
+			"attribute-context injection must be HTML-escaped",
+		)
+		require.Equal(
+			t,
+			1,
+			strings.Count(body, "<script>"),
+			"only the trusted inline script tag may appear",
+		)
+		require.Equal(
+			t,
+			1,
+			strings.Count(body, "</script>"),
+			"only the trusted inline script closing tag may appear",
+		)
+	})
+
+	t.Run("script-closing injection is neutralized", func(t *testing.T) {
+		hostile := `https://x.example.com/</script><img src=x onerror=alert(1)>`
+		tok := newSlowRedirectToken(t, "xssb001", hostile)
+		r := httptest.NewRequest(http.MethodGet, "/c/xssb001", nil)
+
+		_, resp, err := g.Trigger(context.Background(), tok, r)
+		require.NoError(t, err)
+		body := string(resp.Body)
+
+		require.NotContains(
+			t,
+			body,
+			"</script><img",
+			"closing-script-tag escape must be applied inside JS contexts",
+		)
+	})
+}
+
+func TestTrigger_DestinationRoundtripsThroughJSStringDecode(t *testing.T) {
+	g := slowredirect.New()
+	const dest = "https://news.example.com/article?utm_source=newsletter&utm_medium=email&id=42"
+
+	tok := newSlowRedirectToken(t, "rndtrip001", dest)
+	r := httptest.NewRequest(http.MethodGet, "/c/rndtrip001", nil)
+
+	_, resp, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+	body := string(resp.Body)
+
+	require.NotContains(
+		t,
+		body,
+		`\\u003D`,
+		"double-backslash unicode escape means {{...|js}} double-ran the JS escaper; browsers would see literal \\u003D text instead of '='",
+	)
+	require.NotContains(
+		t,
+		body,
+		`\\u0026`,
+		"double-backslash unicode escape would corrupt '&' in real query strings",
+	)
+	require.Contains(
+		t,
+		body,
+		`=`,
+		"html/template auto-escape should emit single-backslash \\u003D so JS parser decodes to '='",
+	)
+	require.Contains(
+		t,
+		body,
+		`&`,
+		"html/template auto-escape should emit single-backslash \\u0026 for '&'",
+	)
+}
+
+func TestTrigger_SetsCSPOverride(t *testing.T) {
+	g := slowredirect.New()
+	tok := newSlowRedirectToken(t, "cspok001", "https://news.example.com")
+	r := httptest.NewRequest(http.MethodGet, "/c/cspok001", nil)
+
+	_, resp, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+
+	csp, ok := resp.ExtraHeaders["Content-Security-Policy"]
+	require.True(
+		t,
+		ok,
+		"Content-Security-Policy must be set on trigger response",
+	)
+	require.Equal(t, cspOverride, csp)
+	require.Equal(
+		t,
+		cacheControlNoStore,
+		resp.ExtraHeaders["Cache-Control"],
+		"cache-control must prevent intermediary caching",
+	)
+	require.Equal(
+		t,
+		pragmaNoCache,
+		resp.ExtraHeaders["Pragma"],
+		"pragma must be set for HTTP/1.0 caches",
+	)
+}
+
+func TestTrigger_RecordsEventWithRequestMetadata(t *testing.T) {
+	g := slowredirect.New()
+	tok := newSlowRedirectToken(t, "evtok001", "https://news.example.com")
+	r := httptest.NewRequest(http.MethodGet, "/c/evtok001", nil)
+	r.Header.Set("CF-Connecting-IP", "203.0.113.55")
+	r.Header.Set("User-Agent", "Mozilla/5.0")
+	r.Header.Set("Referer", "https://mail.example.com/inbox")
+
+	evt, _, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+	require.NotNil(t, evt)
+	require.Equal(t, "evtok001", evt.TokenID)
+	require.Equal(t, "203.0.113.55", evt.SourceIP)
+	require.NotNil(t, evt.UserAgent)
+	require.Equal(t, "Mozilla/5.0", *evt.UserAgent)
+	require.NotNil(t, evt.Referer)
+	require.Equal(t, "https://mail.example.com/inbox", *evt.Referer)
+}
+
+func TestTrigger_TokenNotFound_ReturnsNilEvent(t *testing.T) {
+	g := slowredirect.New()
+	r := httptest.NewRequest(http.MethodGet, "/c/does-not-exist", nil)
+	r.Header.Set("CF-Connecting-IP", "203.0.113.100")
+
+	evt, resp, err := g.Trigger(context.Background(), nil, r)
+	require.NoError(
+		t,
+		err,
+		"nil-token path must not error (spec §8.5 defense-in-depth)",
+	)
+	require.NotNil(t, resp)
+	require.Nil(
+		t,
+		evt,
+		"nil-token path returns nil event so the handler cannot accidentally insert an event row with empty TokenID",
+	)
+	require.Equal(
+		t,
+		http.StatusOK,
+		resp.StatusCode,
+		"nil-token path must return 200 — spec §8.5 forbids 404 on /c/* to prevent token-existence enumeration",
+	)
+	require.Equal(
+		t,
+		contentTypeHTML,
+		resp.ContentType,
+		"nil-token response must be indistinguishable in shape from a real slowredirect response",
+	)
+	require.NotEmpty(t, resp.Body)
+}
+
+func TestTrigger_TokenNotFound_HasSameResponseShapeAsValidToken(t *testing.T) {
+	g := slowredirect.New()
+	r := httptest.NewRequest(http.MethodGet, "/c/anything", nil)
+
+	tok := newSlowRedirectToken(t, "shapecmp001", "https://news.example.com")
+	_, validResp, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+
+	_, decoyResp, err := g.Trigger(context.Background(), nil, r)
+	require.NoError(t, err)
+
+	require.Equal(t, validResp.StatusCode, decoyResp.StatusCode)
+	require.Equal(t, validResp.ContentType, decoyResp.ContentType)
+	require.Equal(
+		t,
+		validResp.ExtraHeaders["Content-Security-Policy"],
+		decoyResp.ExtraHeaders["Content-Security-Policy"],
+	)
+	require.Contains(
+		t,
+		string(decoyResp.Body),
+		"<noscript>",
+		"decoy body must keep the noscript+script structure so a scanner cannot fingerprint token presence by body shape",
+	)
+	require.Contains(t, string(decoyResp.Body), "<script>")
+}
+
+func TestTrigger_BodyIsIndependentCopyPerCall(t *testing.T) {
+	g := slowredirect.New()
+	tok := newSlowRedirectToken(t, "indep001", "https://news.example.com")
+	r := httptest.NewRequest(http.MethodGet, "/c/indep001", nil)
+
+	_, resp1, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+	_, resp2, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+
+	resp1.Body[0] = 0x00
+	require.NotEqual(
+		t,
+		byte(0x00),
+		resp2.Body[0],
+		"each Trigger call must produce an independent body slice — shared template buffer would corrupt concurrent responses",
+	)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/slowredirect/template.html b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/slowredirect/template.html
new file mode 100644
index 00000000..c9f35bca
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/slowredirect/template.html
@@ -0,0 +1,45 @@
+<!-- ©AngelaMos | 2026 -->
+<!-- template.html -->
+<!DOCTYPE html>
+<html>
+<head><title>Loading…</title>
+<meta name="viewport" content="width=device-width, initial-scale=1">
+</head>
+<body>
+<noscript><meta http-equiv="refresh" content="0; url={{.Destination}}"></noscript>
+<script>
+(async () => {
+  const fp = {
+    screen: { w: screen.width, h: screen.height },
+    viewport: { w: innerWidth, h: innerHeight },
+    timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+    language: navigator.language,
+    languages: Array.from(navigator.languages || []),
+    platform: navigator.platform,
+    hwConcurrency: navigator.hardwareConcurrency,
+    colorDepth: screen.colorDepth,
+    doNotTrack: navigator.doNotTrack,
+    plugins: Array.from(navigator.plugins || []).map(p => p.name),
+    webgl: (() => {
+      try {
+        const c = document.createElement('canvas').getContext('webgl');
+        if (!c) return null;
+        const ext = c.getExtension('WEBGL_debug_renderer_info');
+        return ext ? { vendor: c.getParameter(ext.UNMASKED_VENDOR_WEBGL), renderer: c.getParameter(ext.UNMASKED_RENDERER_WEBGL) } : null;
+      } catch { return null; }
+    })(),
+    referrer: document.referrer || null
+  };
+  try {
+    await fetch({{.FingerprintURL}}, {
+      method: 'POST',
+      body: JSON.stringify(fp),
+      headers: {'Content-Type': 'application/json'},
+      keepalive: true
+    });
+  } catch (_) { /* swallow */ }
+  window.location.replace({{.Destination}});
+})();
+</script>
+</body>
+</html>
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/webbug/asset/pixel.jpg b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/webbug/asset/pixel.jpg
new file mode 100644
index 00000000..4cc263f1
Binary files /dev/null and b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/webbug/asset/pixel.jpg differ
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/webbug/generator.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/webbug/generator.go
new file mode 100644
index 00000000..2e1e5a6f
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/webbug/generator.go
@@ -0,0 +1,78 @@
+// ©AngelaMos | 2026
+// generator.go
+
+package webbug
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"net/http"
+	"strings"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/middleware"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators"
+)
+
+const (
+	headerReferer      = "Referer"
+	headerCacheControl = "Cache-Control"
+	headerPragma       = "Pragma"
+
+	cacheControlNoStore = "no-store, no-cache, must-revalidate, max-age=0"
+	pragmaNoCache       = "no-cache"
+
+	triggerPathPrefix = "/c/"
+
+	pixelContentType = "image/jpeg"
+)
+
+//go:embed asset/pixel.jpg
+var pixelBytes []byte
+
+type Generator struct{}
+
+func New() *Generator { return &Generator{} }
+
+func (g *Generator) Type() token.Type { return token.TypeWebbug }
+
+func (g *Generator) Generate(
+	_ context.Context,
+	t *token.Token,
+	baseURL string,
+) (generators.Artifact, error) {
+	return generators.Artifact{
+		Kind: generators.KindURL,
+		URL:  strings.TrimRight(baseURL, "/") + triggerPathPrefix + t.ID,
+	}, nil
+}
+
+func (g *Generator) Trigger(
+	_ context.Context,
+	t *token.Token,
+	r *http.Request,
+) (*event.Event, *generators.TriggerResponse, error) {
+	resp := &generators.TriggerResponse{
+		StatusCode:  http.StatusOK,
+		ContentType: pixelContentType,
+		Body:        bytes.Clone(pixelBytes),
+		ExtraHeaders: map[string]string{
+			headerCacheControl: cacheControlNoStore,
+			headerPragma:       pragmaNoCache,
+		},
+	}
+
+	if t == nil {
+		return nil, resp, nil
+	}
+
+	evt := &event.Event{
+		TokenID:   t.ID,
+		SourceIP:  middleware.RealIP(r),
+		UserAgent: middleware.OptionalHeader(r.UserAgent()),
+		Referer:   middleware.OptionalHeader(r.Header.Get(headerReferer)),
+	}
+	return evt, resp, nil
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/webbug/generator_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/webbug/generator_test.go
new file mode 100644
index 00000000..b9bf21fd
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/webbug/generator_test.go
@@ -0,0 +1,304 @@
+// ©AngelaMos | 2026
+// generator_test.go
+
+package webbug_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators/webbug"
+)
+
+const (
+	cacheControlNoStore = "no-store, no-cache, must-revalidate, max-age=0"
+	pragmaNoCache       = "no-cache"
+	pixelContentType    = "image/jpeg"
+	jpegSOI0            = 0xff
+	jpegSOI1            = 0xd8
+)
+
+func newWebbugToken(id string) *token.Token {
+	return &token.Token{
+		ID:           id,
+		ManageID:     "manage-" + id,
+		Type:         token.TypeWebbug,
+		Memo:         "unit test webbug",
+		AlertChannel: token.ChannelWebhook,
+		Enabled:      true,
+	}
+}
+
+func TestGenerator_TypeIsWebbug(t *testing.T) {
+	g := webbug.New()
+	require.Equal(t, token.TypeWebbug, g.Type())
+}
+
+func TestGenerate_ReturnsURLArtifact(t *testing.T) {
+	cases := []struct {
+		name    string
+		baseURL string
+		id      string
+		wantURL string
+	}{
+		{
+			name:    "no trailing slash",
+			baseURL: "https://canary.example.com",
+			id:      "abc123",
+			wantURL: "https://canary.example.com/c/abc123",
+		},
+		{
+			name:    "trailing slash trimmed",
+			baseURL: "https://canary.example.com/",
+			id:      "xyz999",
+			wantURL: "https://canary.example.com/c/xyz999",
+		},
+		{
+			name:    "subpath base URL preserved",
+			baseURL: "https://example.com/canary",
+			id:      "p7",
+			wantURL: "https://example.com/canary/c/p7",
+		},
+	}
+
+	g := webbug.New()
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			art, err := g.Generate(
+				context.Background(),
+				newWebbugToken(tc.id),
+				tc.baseURL,
+			)
+			require.NoError(t, err)
+			require.Equal(t, generators.KindURL, art.Kind)
+			require.Equal(t, tc.wantURL, art.URL)
+		})
+	}
+}
+
+func TestTrigger_RecordsEventWithRequestMetadata(t *testing.T) {
+	g := webbug.New()
+	tok := newWebbugToken("token1")
+
+	t.Run(
+		"captures token id, source ip, user agent, referer",
+		func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "/c/token1", nil)
+			r.Header.Set("CF-Connecting-IP", "203.0.113.50")
+			r.Header.Set("User-Agent", "Mozilla/5.0 (X11; Linux x86_64)")
+			r.Header.Set("Referer", "https://victim.example.com/inbox")
+
+			evt, _, err := g.Trigger(context.Background(), tok, r)
+			require.NoError(t, err)
+			require.NotNil(t, evt)
+			require.Equal(t, "token1", evt.TokenID)
+			require.Equal(t, "203.0.113.50", evt.SourceIP)
+			require.NotNil(t, evt.UserAgent)
+			require.Equal(t, "Mozilla/5.0 (X11; Linux x86_64)", *evt.UserAgent)
+			require.NotNil(t, evt.Referer)
+			require.Equal(t, "https://victim.example.com/inbox", *evt.Referer)
+		},
+	)
+
+	t.Run("source ip precedence", func(t *testing.T) {
+		cases := []struct {
+			name    string
+			headers map[string]string
+			remote  string
+			wantIP  string
+		}{
+			{
+				name: "CF wins over XFF and XRI",
+				headers: map[string]string{
+					"CF-Connecting-IP": "203.0.113.10",
+					"X-Forwarded-For":  "198.51.100.1, 198.51.100.2",
+					"X-Real-IP":        "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "203.0.113.10",
+			},
+			{
+				name: "XFF leftmost wins over XRI when no CF",
+				headers: map[string]string{
+					"X-Forwarded-For": "198.51.100.1, 198.51.100.7",
+					"X-Real-IP":       "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "198.51.100.1",
+			},
+			{
+				name: "XFF trailing-comma falls through to XRI",
+				headers: map[string]string{
+					"X-Forwarded-For": "198.51.100.1, ",
+					"X-Real-IP":       "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "198.51.100.1",
+			},
+			{
+				name: "XFF entirely empty entries fall through to XRI",
+				headers: map[string]string{
+					"X-Forwarded-For": ", ,",
+					"X-Real-IP":       "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "192.0.2.99",
+			},
+			{
+				name: "XRI when no CF or XFF",
+				headers: map[string]string{
+					"X-Real-IP": "192.0.2.99",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "192.0.2.99",
+			},
+			{
+				name:    "RemoteAddr IPv4 strips port",
+				headers: nil,
+				remote:  "127.0.0.1:9999",
+				wantIP:  "127.0.0.1",
+			},
+			{
+				name:    "RemoteAddr IPv6 strips brackets and port",
+				headers: nil,
+				remote:  "[2001:db8::1]:54321",
+				wantIP:  "2001:db8::1",
+			},
+			{
+				name:    "RemoteAddr loopback IPv6 strips brackets and port",
+				headers: nil,
+				remote:  "[::1]:9999",
+				wantIP:  "::1",
+			},
+			{
+				name:    "RemoteAddr without port falls back to raw value",
+				headers: nil,
+				remote:  "127.0.0.1",
+				wantIP:  "127.0.0.1",
+			},
+			{
+				name: "XFF mixed IPv4+IPv6 leftmost",
+				headers: map[string]string{
+					"X-Forwarded-For": "198.51.100.1, 2001:db8::dead",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "198.51.100.1",
+			},
+			{
+				name: "CF value is trimmed of whitespace",
+				headers: map[string]string{
+					"CF-Connecting-IP": "  203.0.113.10  ",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "203.0.113.10",
+			},
+		}
+		for _, tc := range cases {
+			tc := tc
+			t.Run(tc.name, func(t *testing.T) {
+				r := httptest.NewRequest(http.MethodGet, "/c/token1", nil)
+				for k, v := range tc.headers {
+					r.Header.Set(k, v)
+				}
+				r.RemoteAddr = tc.remote
+				evt, _, err := g.Trigger(context.Background(), tok, r)
+				require.NoError(t, err)
+				require.NotNil(t, evt)
+				require.Equal(t, tc.wantIP, evt.SourceIP)
+			})
+		}
+	})
+
+	t.Run(
+		"missing user agent and referer record as nil pointers",
+		func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "/c/token1", nil)
+			r.Header.Del("User-Agent")
+			r.Header.Del("Referer")
+			r.Header.Set("CF-Connecting-IP", "203.0.113.5")
+
+			evt, _, err := g.Trigger(context.Background(), tok, r)
+			require.NoError(t, err)
+			require.NotNil(t, evt)
+			require.Nil(
+				t,
+				evt.UserAgent,
+				"absent user agent must map to nil, not empty string",
+			)
+			require.Nil(
+				t,
+				evt.Referer,
+				"absent referer must map to nil, not empty string",
+			)
+		},
+	)
+}
+
+func TestTrigger_ResponseIsEmbeddedJPEG(t *testing.T) {
+	g := webbug.New()
+	tok := newWebbugToken("abc")
+	r := httptest.NewRequest(http.MethodGet, "/c/abc", nil)
+
+	_, resp, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	require.Equal(t, pixelContentType, resp.ContentType)
+	require.NotEmpty(t, resp.Body, "embedded pixel.jpg must not be empty")
+	require.Equal(t, jpegSOI0, int(resp.Body[0]),
+		"body must begin with JPEG SOI marker 0xff 0xd8")
+	require.Equal(t, jpegSOI1, int(resp.Body[1]),
+		"body must begin with JPEG SOI marker 0xff 0xd8")
+	require.Equal(t, cacheControlNoStore, resp.ExtraHeaders["Cache-Control"])
+	require.Equal(t, pragmaNoCache, resp.ExtraHeaders["Pragma"])
+}
+
+func TestTrigger_ResponseBodyIsIndependentCopyPerCall(t *testing.T) {
+	g := webbug.New()
+	tok := newWebbugToken("abc")
+	r := httptest.NewRequest(http.MethodGet, "/c/abc", nil)
+
+	_, resp1, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+	_, resp2, err := g.Trigger(context.Background(), tok, r)
+	require.NoError(t, err)
+
+	original := resp2.Body[0]
+	resp1.Body[0] = 0x00
+	require.Equal(
+		t,
+		original,
+		resp2.Body[0],
+		"each Trigger call must produce an independent body slice",
+	)
+}
+
+func TestTrigger_TokenNotFound_StillReturnsImage(t *testing.T) {
+	g := webbug.New()
+	r := httptest.NewRequest(http.MethodGet, "/c/does-not-exist", nil)
+	r.Header.Set("CF-Connecting-IP", "203.0.113.100")
+	r.Header.Set("User-Agent", "curl/8.0.0")
+
+	evt, resp, err := g.Trigger(context.Background(), nil, r)
+	require.NoError(
+		t,
+		err,
+		"nil-token path must not error (spec §8.5 defense-in-depth)",
+	)
+	require.NotNil(t, resp, "nil-token path must still return image response")
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	require.Equal(t, pixelContentType, resp.ContentType)
+	require.NotEmpty(t, resp.Body)
+	require.Nil(
+		t,
+		evt,
+		"nil-token path returns nil event so the handler cannot accidentally persist a row with empty TokenID (FK violation)",
+	)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/handler.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/handler.go
new file mode 100644
index 00000000..a4e125d6
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/handler.go
@@ -0,0 +1,515 @@
+// ©AngelaMos | 2026
+// handler.go
+
+package token
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/middleware"
+)
+
+const (
+	urlParamTokenID  = "id"
+	urlParamManageID = "manage_id"
+
+	headerContentType = "Content-Type"
+	headerLocation    = "Location"
+	contentTypeJSON   = "application/json"
+
+	errorCodeValidation     = "VALIDATION_ERROR"
+	errorCodeBadJSON        = "BAD_JSON"
+	errorCodeInternalError  = "INTERNAL_ERROR"
+	errorCodeUnknownType    = "UNKNOWN_TYPE"
+	errorCodeGenerateFailed = "GENERATE_FAILED"
+	errorCodeNotFound       = "NOT_FOUND"
+	errorCodeBadCursor      = "BAD_CURSOR"
+
+	respMessageValidation     = "request validation failed"
+	respMessageBadJSON        = "invalid JSON body"
+	respMessageInternalError  = "internal server error"
+	respMessageGenerateFailed = "artifact generation failed"
+	respMessageUnknownType    = "unknown token type"
+	respMessageNotFound       = "not found"
+	respMessageBadCursor      = "invalid cursor"
+
+	kubeconfigPathPrefix = "/k/"
+
+	createTokenBodyMaxBytes = 64 * 1024
+	fingerprintBodyMaxBytes = 64 * 1024
+
+	manageDefaultPageSize = 20
+	manageMaxPageSize     = 100
+
+	queryParamCursor = "cursor"
+	queryParamLimit  = "limit"
+)
+
+type EventRecorder interface {
+	Record(ctx context.Context, t *Token, evt *event.Event) error
+}
+
+type FingerprintRecorder interface {
+	AttachFingerprint(
+		ctx context.Context,
+		tokenID, sourceIP string,
+		fingerprint json.RawMessage,
+	) error
+}
+
+type EventQuery interface {
+	ListByToken(
+		ctx context.Context,
+		tokenID string,
+		opts event.ListOptions,
+	) (event.ListResult, error)
+	CountByToken(ctx context.Context, tokenID string) (int64, error)
+}
+
+type DedupCounter interface {
+	CountActiveDedup(ctx context.Context, tokenID string) (int64, error)
+}
+
+type Handler struct {
+	svc                 *Service
+	events              EventRecorder
+	fingerprintRecorder FingerprintRecorder
+	eventQuery          EventQuery
+	dedupCounter        DedupCounter
+	logger              *slog.Logger
+	mysqlEnabled        bool
+}
+
+func NewHandler(
+	svc *Service,
+	events EventRecorder,
+	fingerprint FingerprintRecorder,
+	eventQuery EventQuery,
+	dedupCounter DedupCounter,
+	logger *slog.Logger,
+	mysqlEnabled bool,
+) *Handler {
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Handler{
+		svc:                 svc,
+		events:              events,
+		fingerprintRecorder: fingerprint,
+		eventQuery:          eventQuery,
+		dedupCounter:        dedupCounter,
+		logger:              logger,
+		mysqlEnabled:        mysqlEnabled,
+	}
+}
+
+func (h *Handler) RegisterAPIRoutes(r chi.Router) {
+	r.Get("/tokens/types", h.GetTypes)
+	r.Post("/tokens", h.CreateToken)
+}
+
+func (h *Handler) RegisterManageRoutes(r chi.Router) {
+	r.Get("/m/{"+urlParamManageID+"}", h.GetManage)
+	r.Delete("/m/{"+urlParamManageID+"}", h.DeleteManage)
+}
+
+func (h *Handler) RegisterTriggerRoutes(r chi.Router) {
+	r.Get("/c/{"+urlParamTokenID+"}", h.HandleTrigger)
+	r.Post("/c/{"+urlParamTokenID+"}/fingerprint", h.HandleFingerprint)
+	r.HandleFunc("/k/{"+urlParamTokenID+"}", h.HandleTrigger)
+	r.HandleFunc("/k/{"+urlParamTokenID+"}/*", h.HandleTrigger)
+}
+
+func (h *Handler) GetTypes(w http.ResponseWriter, _ *http.Request) {
+	h.writeJSON(w, http.StatusOK, envelopeData(TypeDescriptors(h.mysqlEnabled)))
+}
+
+func (h *Handler) CreateToken(w http.ResponseWriter, r *http.Request) {
+	limited := http.MaxBytesReader(w, r.Body, createTokenBodyMaxBytes)
+	var req CreateRequest
+	if err := json.NewDecoder(limited).Decode(&req); err != nil {
+		h.writeJSON(w, http.StatusBadRequest, envelopeError(
+			errorCodeBadJSON, respMessageBadJSON,
+		))
+		return
+	}
+
+	fp := middleware.ExtractFingerprint(r)
+	ip := middleware.RealIP(r)
+
+	tok, art, err := h.svc.Create(r.Context(), req, fp, ip)
+	if err != nil {
+		h.writeCreateError(w, r, err)
+		return
+	}
+
+	resp := tok.ToResponse(
+		h.svc.TriggerURL(tok.ID),
+		h.svc.ManageURL(tok.ManageID),
+	)
+	h.writeJSON(w, http.StatusCreated, envelopeData(map[string]any{
+		"token":    resp,
+		"artifact": artifactToJSON(art),
+	}))
+}
+
+func (h *Handler) HandleTrigger(w http.ResponseWriter, r *http.Request) {
+	id := strings.TrimRight(chi.URLParam(r, urlParamTokenID), "_")
+	if id == "" {
+		http.NotFound(w, r)
+		return
+	}
+
+	tok, err := h.svc.GetByID(r.Context(), id)
+	if err != nil {
+		h.logger.WarnContext(r.Context(), "trigger lookup failed",
+			"token_id", id, "error", err)
+	}
+	if tok != nil && !tok.Enabled {
+		tok = nil
+	}
+
+	gen, ok := h.resolveGenerator(tok, r)
+	if !ok {
+		http.NotFound(w, r)
+		return
+	}
+
+	evt, resp, gErr := gen.Trigger(r.Context(), tok, r)
+	if gErr != nil {
+		h.logger.WarnContext(r.Context(), "trigger generator failed",
+			"error", gErr, "token_id", id)
+		http.Error(w, respMessageInternalError, http.StatusInternalServerError)
+		return
+	}
+	if resp == nil {
+		http.NotFound(w, r)
+		return
+	}
+
+	if tok != nil && evt != nil && h.events != nil {
+		if recErr := h.events.Record(r.Context(), tok, evt); recErr != nil {
+			h.logger.WarnContext(r.Context(), "record event failed",
+				"error", recErr, "token_id", id)
+		}
+	}
+
+	h.writeTriggerResponse(w, r, resp)
+}
+
+func (h *Handler) GetManage(w http.ResponseWriter, r *http.Request) {
+	manageID := chi.URLParam(r, urlParamManageID)
+	if manageID == "" {
+		h.writeJSON(w, http.StatusNotFound, envelopeError(
+			errorCodeNotFound, respMessageNotFound,
+		))
+		return
+	}
+
+	cursor, err := parseCursor(r.URL.Query().Get(queryParamCursor))
+	if err != nil {
+		h.writeJSON(w, http.StatusBadRequest, envelopeError(
+			errorCodeBadCursor, respMessageBadCursor,
+		))
+		return
+	}
+	limit := parseLimit(r.URL.Query().Get(queryParamLimit))
+
+	tok, err := h.svc.GetByManageID(r.Context(), manageID)
+	if err != nil {
+		h.logger.ErrorContext(r.Context(), "manage: get by manage id",
+			"error", err, "manage_id", manageID)
+		h.writeJSON(w, http.StatusInternalServerError, envelopeError(
+			errorCodeInternalError, respMessageInternalError,
+		))
+		return
+	}
+	if tok == nil {
+		h.writeJSON(w, http.StatusNotFound, envelopeError(
+			errorCodeNotFound, respMessageNotFound,
+		))
+		return
+	}
+
+	events, page, total, silenced := h.gatherManageData(
+		r,
+		tok.ID,
+		cursor,
+		limit,
+	)
+
+	resp := ManageResponse{
+		Token:                tok.ToManageView(h.svc.TriggerURL(tok.ID)),
+		Events:               events,
+		EventsTotal:          total,
+		EventsSilencedActive: silenced,
+		Page:                 page,
+	}
+	h.writeJSON(w, http.StatusOK, envelopeData(resp))
+}
+
+func (h *Handler) DeleteManage(w http.ResponseWriter, r *http.Request) {
+	manageID := chi.URLParam(r, urlParamManageID)
+	if manageID == "" {
+		h.writeJSON(w, http.StatusNotFound, envelopeError(
+			errorCodeNotFound, respMessageNotFound,
+		))
+		return
+	}
+
+	if err := h.svc.DeleteByManageID(r.Context(), manageID); err != nil {
+		if errors.Is(err, ErrNotFound) {
+			h.writeJSON(w, http.StatusNotFound, envelopeError(
+				errorCodeNotFound, respMessageNotFound,
+			))
+			return
+		}
+		h.logger.ErrorContext(r.Context(), "manage: delete",
+			"error", err, "manage_id", manageID)
+		h.writeJSON(w, http.StatusInternalServerError, envelopeError(
+			errorCodeInternalError, respMessageInternalError,
+		))
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func (h *Handler) gatherManageData(
+	r *http.Request,
+	tokenID string,
+	cursor int64,
+	limit int,
+) (events []event.Response, page ManagePage, total, silenced int64) {
+	if h.eventQuery == nil {
+		return nil, ManagePage{}, 0, 0
+	}
+	list, err := h.eventQuery.ListByToken(
+		r.Context(), tokenID, event.ListOptions{Cursor: cursor, Limit: limit},
+	)
+	if err != nil {
+		h.logger.ErrorContext(r.Context(), "manage: list events",
+			"error", err, "token_id", tokenID)
+	}
+	for i := range list.Events {
+		events = append(events, list.Events[i].ToResponse())
+	}
+	if list.HasMore {
+		page = ManagePage{
+			NextCursor: strconv.FormatInt(list.NextCursor, 10),
+			HasMore:    true,
+		}
+	}
+
+	if total, err = h.eventQuery.CountByToken(
+		r.Context(),
+		tokenID,
+	); err != nil {
+		h.logger.ErrorContext(r.Context(), "manage: count events",
+			"error", err, "token_id", tokenID)
+		total = 0
+	}
+
+	if h.dedupCounter != nil {
+		var dErr error
+		if silenced, dErr = h.dedupCounter.CountActiveDedup(
+			r.Context(), tokenID,
+		); dErr != nil {
+			h.logger.WarnContext(r.Context(), "manage: count active dedup",
+				"error", dErr, "token_id", tokenID)
+			silenced = 0
+		}
+	}
+	return events, page, total, silenced
+}
+
+func parseCursor(raw string) (int64, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return 0, nil
+	}
+	v, err := strconv.ParseInt(raw, 10, 64)
+	if err != nil || v < 0 {
+		return 0, fmt.Errorf("invalid cursor: %q", raw)
+	}
+	return v, nil
+}
+
+func parseLimit(raw string) int {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return manageDefaultPageSize
+	}
+	v, err := strconv.Atoi(raw)
+	if err != nil || v <= 0 {
+		return manageDefaultPageSize
+	}
+	if v > manageMaxPageSize {
+		return manageMaxPageSize
+	}
+	return v
+}
+
+func (h *Handler) HandleFingerprint(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, urlParamTokenID)
+	if id == "" || h.fingerprintRecorder == nil {
+		w.WriteHeader(http.StatusNoContent)
+		return
+	}
+
+	limited := http.MaxBytesReader(w, r.Body, fingerprintBodyMaxBytes)
+	var raw json.RawMessage
+	if err := json.NewDecoder(limited).Decode(&raw); err != nil {
+		w.WriteHeader(http.StatusNoContent)
+		return
+	}
+
+	if recErr := h.fingerprintRecorder.AttachFingerprint(
+		r.Context(),
+		id,
+		middleware.RealIP(r),
+		raw,
+	); recErr != nil {
+		h.logger.WarnContext(r.Context(), "attach fingerprint failed",
+			"token_id", id, "error", recErr)
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func (h *Handler) resolveGenerator(
+	tok *Token,
+	r *http.Request,
+) (Generator, bool) {
+	if tok != nil {
+		return h.svc.Generator(tok.Type)
+	}
+	if strings.HasPrefix(r.URL.Path, kubeconfigPathPrefix) {
+		return h.svc.Generator(TypeKubeconfig)
+	}
+	return h.svc.Generator(TypeWebbug)
+}
+
+func (h *Handler) writeCreateError(
+	w http.ResponseWriter,
+	r *http.Request,
+	err error,
+) {
+	switch {
+	case errors.Is(err, ErrUnknownGeneratorType):
+		h.writeJSON(w, http.StatusBadRequest, envelopeError(
+			errorCodeUnknownType, respMessageUnknownType,
+		))
+	case errors.Is(err, ErrInvalidDestinationURL),
+		errors.Is(err, ErrInvalidIncludeKeys):
+		h.writeJSON(w, http.StatusBadRequest, envelopeError(
+			errorCodeValidation, err.Error(),
+		))
+	case errors.Is(err, ErrGenerateFailed):
+		h.logger.ErrorContext(r.Context(), "create token: generator",
+			"error", err)
+		h.writeJSON(w, http.StatusInternalServerError, envelopeError(
+			errorCodeGenerateFailed, respMessageGenerateFailed,
+		))
+	case errors.Is(err, ErrValidation):
+		h.writeJSON(w, http.StatusBadRequest, envelopeError(
+			errorCodeValidation, respMessageValidation,
+		))
+	default:
+		h.logger.ErrorContext(r.Context(), "create token", "error", err)
+		h.writeJSON(w, http.StatusInternalServerError, envelopeError(
+			errorCodeInternalError, respMessageInternalError,
+		))
+	}
+}
+
+func (h *Handler) writeJSON(
+	w http.ResponseWriter,
+	status int,
+	body any,
+) {
+	w.Header().Set(headerContentType, contentTypeJSON)
+	w.WriteHeader(status)
+	if err := json.NewEncoder(w).Encode(body); err != nil {
+		h.logger.Warn("write json response", "error", err)
+	}
+}
+
+func (h *Handler) writeTriggerResponse(
+	w http.ResponseWriter,
+	r *http.Request,
+	resp *TriggerResponse,
+) {
+	for k, v := range resp.ExtraHeaders {
+		w.Header().Set(k, v)
+	}
+	if resp.ContentType != "" {
+		w.Header().Set(headerContentType, resp.ContentType)
+	}
+	if resp.RedirectURL != "" {
+		w.Header().Set(headerLocation, resp.RedirectURL)
+		w.WriteHeader(resp.StatusCode)
+		return
+	}
+	w.WriteHeader(resp.StatusCode)
+	if len(resp.Body) > 0 {
+		if _, err := w.Write(resp.Body); err != nil {
+			h.logger.WarnContext(r.Context(), "write trigger body",
+				"error", err)
+		}
+	}
+}
+
+func envelopeData(data any) map[string]any {
+	return map[string]any{"success": true, "data": data}
+}
+
+func envelopeError(code, message string) map[string]any {
+	return map[string]any{
+		"success": false,
+		"error": map[string]any{
+			"code":    code,
+			"message": message,
+		},
+	}
+}
+
+type ArtifactJSON struct {
+	Kind             string `json:"kind"`
+	URL              string `json:"url,omitempty"`
+	DestinationURL   string `json:"destination_url,omitempty"`
+	Filename         string `json:"filename,omitempty"`
+	ContentType      string `json:"content_type,omitempty"`
+	ContentB64       string `json:"content_b64,omitempty"`
+	Content          string `json:"content,omitempty"`
+	ConnectionString string `json:"connection_string,omitempty"`
+}
+
+func artifactToJSON(a Artifact) ArtifactJSON {
+	out := ArtifactJSON{Kind: string(a.Kind)}
+	switch a.Kind {
+	case KindURL:
+		out.URL = a.URL
+		out.DestinationURL = a.DestinationURL
+	case KindFile:
+		out.Filename = a.Filename
+		out.ContentType = a.ContentType
+		out.ContentB64 = base64.StdEncoding.EncodeToString(a.Content)
+	case KindText:
+		out.Filename = a.Filename
+		out.ContentType = a.ContentType
+		out.Content = string(a.Content)
+	case KindConnectionString:
+		out.ConnectionString = a.ConnectionString
+	}
+	return out
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/handler_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/handler_test.go
new file mode 100644
index 00000000..53a8bb85
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/handler_test.go
@@ -0,0 +1,687 @@
+// ©AngelaMos | 2026
+// handler_test.go
+
+package token_test
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators"
+)
+
+type triggerGen struct {
+	tokenType token.Type
+	artifact  generators.Artifact
+	resp      *generators.TriggerResponse
+	evt       *event.Event
+}
+
+func (g *triggerGen) Type() token.Type { return g.tokenType }
+
+func (g *triggerGen) Generate(
+	_ context.Context,
+	_ *token.Token,
+	_ string,
+) (generators.Artifact, error) {
+	return g.artifact, nil
+}
+
+func (g *triggerGen) Trigger(
+	_ context.Context,
+	_ *token.Token,
+	_ *http.Request,
+) (*event.Event, *generators.TriggerResponse, error) {
+	return g.evt, g.resp, nil
+}
+
+type recordingEvents struct {
+	events []*event.Event
+}
+
+func (r *recordingEvents) Record(
+	_ context.Context,
+	_ *token.Token,
+	e *event.Event,
+) error {
+	r.events = append(r.events, e)
+	return nil
+}
+
+func quietHandlerLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+func newWebbugHandler(
+	t *testing.T,
+	gen token.Generator,
+) (*token.Handler, *fakeRepo, *recordingEvents) {
+	t.Helper()
+	repo := newFakeRepo()
+	rec := &recordingEvents{}
+	svc := token.NewService(
+		repo,
+		token.MapRegistry{token.TypeWebbug: gen},
+		token.ServiceConfig{
+			BaseURL:   "https://canary.example.com",
+			ManageURL: "https://canary.example.com",
+		},
+	)
+	return token.NewHandler(
+		svc,
+		rec,
+		nil,
+		nil,
+		nil,
+		quietHandlerLogger(),
+		false,
+	), repo, rec
+}
+
+func TestGetTypes_Returns7Types(t *testing.T) {
+	svc := token.NewService(newFakeRepo(), token.MapRegistry{},
+		token.ServiceConfig{BaseURL: "https://x.test"})
+	h := token.NewHandler(svc, nil, nil, nil, nil, quietHandlerLogger(), false)
+
+	r := chi.NewRouter()
+	h.RegisterAPIRoutes(r)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/tokens/types", nil))
+
+	require.Equal(t, http.StatusOK, w.Code)
+	var body struct {
+		Success bool                   `json:"success"`
+		Data    []token.TypeDescriptor `json:"data"`
+	}
+	require.NoError(t, json.NewDecoder(w.Body).Decode(&body))
+	require.True(t, body.Success)
+	require.Len(t, body.Data, 7)
+}
+
+func TestCreateToken_HappyPath(t *testing.T) {
+	gen := &triggerGen{
+		tokenType: token.TypeWebbug,
+		artifact: generators.Artifact{
+			Kind: generators.KindURL, URL: "https://canary.example.com/c/x",
+		},
+	}
+	h, _, _ := newWebbugHandler(t, gen)
+
+	r := chi.NewRouter()
+	h.RegisterAPIRoutes(r)
+
+	body := strings.NewReader(`{
+		"type":"webbug","memo":"m","alert_channel":"webhook",
+		"webhook_url":"https://example.com/h","cf_turnstile_response":"t",
+		"metadata":{}
+	}`)
+	req := httptest.NewRequest(http.MethodPost, "/tokens", body)
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusCreated, w.Code)
+
+	var resp struct {
+		Success bool `json:"success"`
+		Data    struct {
+			Token    token.Response     `json:"token"`
+			Artifact token.ArtifactJSON `json:"artifact"`
+		} `json:"data"`
+	}
+	require.NoError(t, json.NewDecoder(w.Body).Decode(&resp))
+	require.True(t, resp.Success)
+	require.Equal(t, token.TypeWebbug, resp.Data.Token.Type)
+	require.NotEmpty(t, resp.Data.Token.ID)
+	require.Contains(t, resp.Data.Token.TriggerURL, "/c/")
+	require.Contains(t, resp.Data.Token.ManageURL, "/m/")
+	require.Equal(t, "url", resp.Data.Artifact.Kind)
+}
+
+func TestCreateToken_BadJSON(t *testing.T) {
+	gen := &triggerGen{tokenType: token.TypeWebbug}
+	h, _, _ := newWebbugHandler(t, gen)
+
+	r := chi.NewRouter()
+	h.RegisterAPIRoutes(r)
+
+	req := httptest.NewRequest(
+		http.MethodPost,
+		"/tokens",
+		strings.NewReader(`{not json`),
+	)
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusBadRequest, w.Code)
+	require.Contains(t, w.Body.String(), "BAD_JSON")
+}
+
+func TestCreateToken_ValidationFailure(t *testing.T) {
+	gen := &triggerGen{tokenType: token.TypeWebbug}
+	h, _, _ := newWebbugHandler(t, gen)
+
+	r := chi.NewRouter()
+	h.RegisterAPIRoutes(r)
+
+	body := strings.NewReader(
+		`{"type":"webbug","memo":"m","cf_turnstile_response":"t"}`,
+	)
+	req := httptest.NewRequest(http.MethodPost, "/tokens", body)
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusBadRequest, w.Code)
+	require.Contains(t, w.Body.String(), "VALIDATION_ERROR")
+}
+
+func TestHandleTrigger_KnownTokenReturnsResponseAndRecordsEvent(t *testing.T) {
+	gen := &triggerGen{
+		tokenType: token.TypeWebbug,
+		artifact:  generators.Artifact{Kind: generators.KindURL},
+		resp: &generators.TriggerResponse{
+			StatusCode:  200,
+			ContentType: "image/gif",
+			Body:        []byte{0x47, 0x49, 0x46, 0x38},
+		},
+		evt: &event.Event{SourceIP: "1.2.3.4"},
+	}
+	h, repo, rec := newWebbugHandler(t, gen)
+
+	tok := &token.Token{
+		ID: "abcdef012345", ManageID: "m", Type: token.TypeWebbug,
+		AlertChannel: token.ChannelWebhook, Enabled: true,
+		Metadata: json.RawMessage(`{}`),
+	}
+	require.NoError(t, repo.Insert(context.Background(), tok))
+
+	r := chi.NewRouter()
+	h.RegisterTriggerRoutes(r)
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/c/abcdef012345", nil)
+	r.ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusOK, w.Code)
+	require.Equal(t, "image/gif", w.Header().Get("Content-Type"))
+	require.Equal(t, []byte{0x47, 0x49, 0x46, 0x38}, w.Body.Bytes())
+	require.Len(t, rec.events, 1)
+}
+
+func TestHandleTrigger_TrimsTrailingUnderscoresFromPaddedID(t *testing.T) {
+	gen := &triggerGen{
+		tokenType: token.TypeWebbug,
+		artifact:  generators.Artifact{Kind: generators.KindURL},
+		resp: &generators.TriggerResponse{
+			StatusCode:  200,
+			ContentType: "image/gif",
+			Body:        []byte{0x47},
+		},
+		evt: &event.Event{SourceIP: "1.2.3.4"},
+	}
+	h, repo, rec := newWebbugHandler(t, gen)
+
+	tok := &token.Token{
+		ID: "abcdef012345", ManageID: "m", Type: token.TypeWebbug,
+		AlertChannel: token.ChannelWebhook, Enabled: true,
+		Metadata: json.RawMessage(`{}`),
+	}
+	require.NoError(t, repo.Insert(context.Background(), tok))
+
+	r := chi.NewRouter()
+	h.RegisterTriggerRoutes(r)
+
+	w := httptest.NewRecorder()
+	padded := "/c/abcdef012345____________________"
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodGet, padded, nil))
+
+	require.Equal(t, http.StatusOK, w.Code)
+	require.Len(t, rec.events, 1,
+		"trailing-underscore padded id must still resolve to the real token "+
+			"so PDFs already in the field (carrying padded URLs) record events "+
+			"instead of silently no-opping (audit finding F2)")
+}
+
+func TestHandleTrigger_UnknownTokenStillReturnsArtifactShape(t *testing.T) {
+	gen := &triggerGen{
+		tokenType: token.TypeWebbug,
+		resp: &generators.TriggerResponse{
+			StatusCode:  200,
+			ContentType: "image/gif",
+			Body:        []byte{0x47, 0x49, 0x46},
+		},
+	}
+	h, _, rec := newWebbugHandler(t, gen)
+
+	r := chi.NewRouter()
+	h.RegisterTriggerRoutes(r)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/c/nonexistent1", nil))
+
+	require.Equal(t, http.StatusOK, w.Code,
+		"unknown tokens still return artifact shape (defense in depth)")
+	require.Empty(t, rec.events, "no event recorded for unknown token")
+}
+
+func TestHandleTrigger_DisabledTokenIsTreatedAsUnknown(t *testing.T) {
+	gen := &triggerGen{
+		tokenType: token.TypeWebbug,
+		resp: &generators.TriggerResponse{
+			StatusCode:  200,
+			ContentType: "image/gif",
+			Body:        []byte{0x47},
+		},
+		evt: &event.Event{SourceIP: "1.2.3.4"},
+	}
+	h, repo, rec := newWebbugHandler(t, gen)
+
+	tok := &token.Token{
+		ID: "disabled1234", ManageID: "m", Type: token.TypeWebbug,
+		AlertChannel: token.ChannelWebhook, Enabled: false,
+		Metadata: json.RawMessage(`{}`),
+	}
+	require.NoError(t, repo.Insert(context.Background(), tok))
+
+	r := chi.NewRouter()
+	h.RegisterTriggerRoutes(r)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/c/disabled1234", nil))
+
+	require.Equal(t, http.StatusOK, w.Code)
+	require.Empty(t, rec.events, "disabled token must not record events")
+}
+
+func TestHandleFingerprint_Returns204WithNoRecorder(t *testing.T) {
+	gen := &triggerGen{tokenType: token.TypeWebbug}
+	h, _, _ := newWebbugHandler(t, gen)
+
+	r := chi.NewRouter()
+	h.RegisterTriggerRoutes(r)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodPost,
+		"/c/anything/fingerprint", strings.NewReader(`{"x":1}`)))
+
+	require.Equal(t, http.StatusNoContent, w.Code)
+}
+
+func TestArtifactToJSON_Kinds(t *testing.T) {
+	cases := []struct {
+		name string
+		in   generators.Artifact
+		want token.ArtifactJSON
+	}{
+		{
+			"url",
+			generators.Artifact{
+				Kind:           generators.KindURL,
+				URL:            "u",
+				DestinationURL: "d",
+			},
+			token.ArtifactJSON{Kind: "url", URL: "u", DestinationURL: "d"},
+		},
+		{
+			"file",
+			generators.Artifact{
+				Kind:        generators.KindFile,
+				Filename:    "f.docx",
+				ContentType: "x",
+				Content:     []byte("hi"),
+			},
+			token.ArtifactJSON{
+				Kind:        "file",
+				Filename:    "f.docx",
+				ContentType: "x",
+				ContentB64:  "aGk=",
+			},
+		},
+		{
+			"text",
+			generators.Artifact{
+				Kind:        generators.KindText,
+				Filename:    ".env",
+				ContentType: "text/plain",
+				Content:     []byte("KEY=v"),
+			},
+			token.ArtifactJSON{
+				Kind:        "text",
+				Filename:    ".env",
+				ContentType: "text/plain",
+				Content:     "KEY=v",
+			},
+		},
+		{
+			"conn",
+			generators.Artifact{
+				Kind:             generators.KindConnectionString,
+				ConnectionString: "mysql://x",
+			},
+			token.ArtifactJSON{
+				Kind:             "connection_string",
+				ConnectionString: "mysql://x",
+			},
+		},
+	}
+	for _, c := range cases {
+		c := c
+		t.Run(c.name, func(t *testing.T) {
+			require.Equal(t, c.want, exposeArtifactToJSON(c.in))
+		})
+	}
+}
+
+func exposeArtifactToJSON(a generators.Artifact) token.ArtifactJSON {
+	gen := &triggerGen{tokenType: token.TypeWebbug, artifact: a}
+	repo := newFakeRepo()
+	svc := token.NewService(repo, token.MapRegistry{token.TypeWebbug: gen},
+		token.ServiceConfig{BaseURL: "https://x"})
+	h := token.NewHandler(svc, nil, nil, nil, nil, quietHandlerLogger(), false)
+
+	r := chi.NewRouter()
+	h.RegisterAPIRoutes(r)
+
+	body := strings.NewReader(
+		`{"type":"webbug","alert_channel":"webhook","webhook_url":"https://x/h","cf_turnstile_response":"t","metadata":{}}`,
+	)
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodPost, "/tokens", body))
+
+	var resp struct {
+		Data struct {
+			Artifact token.ArtifactJSON `json:"artifact"`
+		} `json:"data"`
+	}
+	if jsonErr := json.NewDecoder(w.Body).Decode(&resp); jsonErr != nil {
+		panic(jsonErr)
+	}
+	return resp.Data.Artifact
+}
+
+type fakeEventQuery struct {
+	listResult event.ListResult
+	listErr    error
+	countN     int64
+	countErr   error
+	lastTokID  string
+	lastOpts   event.ListOptions
+}
+
+func (f *fakeEventQuery) ListByToken(
+	_ context.Context,
+	tokenID string,
+	opts event.ListOptions,
+) (event.ListResult, error) {
+	f.lastTokID = tokenID
+	f.lastOpts = opts
+	return f.listResult, f.listErr
+}
+
+func (f *fakeEventQuery) CountByToken(
+	_ context.Context,
+	_ string,
+) (int64, error) {
+	return f.countN, f.countErr
+}
+
+type fakeDedupCounter struct {
+	n   int64
+	err error
+}
+
+func (f *fakeDedupCounter) CountActiveDedup(
+	_ context.Context,
+	_ string,
+) (int64, error) {
+	return f.n, f.err
+}
+
+func newManageHandler(
+	t *testing.T,
+	eq *fakeEventQuery,
+	dc *fakeDedupCounter,
+) (*token.Handler, *fakeRepo) {
+	t.Helper()
+	repo := newFakeRepo()
+	svc := token.NewService(repo, token.MapRegistry{},
+		token.ServiceConfig{
+			BaseURL:   "https://canary.example.com",
+			ManageURL: "https://canary.example.com",
+		})
+	return token.NewHandler(
+			svc,
+			nil,
+			nil,
+			eq,
+			dc,
+			quietHandlerLogger(),
+			false,
+		),
+		repo
+}
+
+func seedToken(t *testing.T, repo *fakeRepo, manageID string) *token.Token {
+	t.Helper()
+	tok := &token.Token{
+		ID:           "tok" + manageID[:8],
+		ManageID:     manageID,
+		Type:         token.TypeWebbug,
+		Memo:         "manage-test",
+		AlertChannel: token.ChannelWebhook,
+		WebhookURL:   strPtr("https://x/h"),
+		CreatedIP:    "1.1.1.1",
+		CreatedFP:    "fp",
+		Metadata:     json.RawMessage(`{}`),
+		Enabled:      true,
+		TriggerCount: 5,
+	}
+	require.NoError(t, repo.Insert(context.Background(), tok))
+	return tok
+}
+
+func strPtr(s string) *string { return &s }
+
+func decodeManage(t *testing.T, body []byte) struct {
+	Success bool                 `json:"success"`
+	Data    token.ManageResponse `json:"data"`
+} {
+	t.Helper()
+	var resp struct {
+		Success bool                 `json:"success"`
+		Data    token.ManageResponse `json:"data"`
+	}
+	require.NoError(t, json.Unmarshal(body, &resp))
+	return resp
+}
+
+func TestGetManage_HappyPath(t *testing.T) {
+	t.Parallel()
+	eq := &fakeEventQuery{
+		countN: 17,
+		listResult: event.ListResult{
+			Events: []event.Event{
+				{ID: 42, TokenID: "x", SourceIP: "1.2.3.4"},
+				{ID: 41, TokenID: "x", SourceIP: "5.6.7.8"},
+			},
+			HasMore: false,
+		},
+	}
+	dc := &fakeDedupCounter{n: 3}
+	h, repo := newManageHandler(t, eq, dc)
+	tok := seedToken(t, repo, "11111111-1111-1111-1111-111111111111")
+
+	r := chi.NewRouter()
+	h.RegisterManageRoutes(r)
+
+	req := httptest.NewRequest(http.MethodGet, "/m/"+tok.ManageID, nil)
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusOK, w.Code, "body=%s", w.Body.String())
+	resp := decodeManage(t, w.Body.Bytes())
+	require.True(t, resp.Success)
+	require.Equal(t, tok.ID, resp.Data.Token.ID)
+	require.Equal(
+		t,
+		"https://canary.example.com/c/"+tok.ID,
+		resp.Data.Token.TriggerURL,
+	)
+	require.Equal(t, int64(5), resp.Data.Token.TriggerCount)
+	require.Len(t, resp.Data.Events, 2)
+	require.Equal(t, int64(17), resp.Data.EventsTotal)
+	require.Equal(t, int64(3), resp.Data.EventsSilencedActive)
+}
+
+func TestGetManage_404OnUnknownManageID(t *testing.T) {
+	t.Parallel()
+	h, _ := newManageHandler(t, &fakeEventQuery{}, &fakeDedupCounter{})
+
+	r := chi.NewRouter()
+	h.RegisterManageRoutes(r)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(
+		w,
+		httptest.NewRequest(http.MethodGet, "/m/does-not-exist", nil),
+	)
+	require.Equal(t, http.StatusNotFound, w.Code)
+	require.Contains(t, w.Body.String(), "NOT_FOUND")
+}
+
+func TestGetManage_400OnBadCursor(t *testing.T) {
+	t.Parallel()
+	h, repo := newManageHandler(t, &fakeEventQuery{}, &fakeDedupCounter{})
+	tok := seedToken(t, repo, "22222222-2222-2222-2222-222222222222")
+
+	r := chi.NewRouter()
+	h.RegisterManageRoutes(r)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodGet,
+		"/m/"+tok.ManageID+"?cursor=notanumber", nil))
+	require.Equal(t, http.StatusBadRequest, w.Code)
+	require.Contains(t, w.Body.String(), "BAD_CURSOR")
+}
+
+func TestGetManage_400OnNegativeCursor(t *testing.T) {
+	t.Parallel()
+	h, repo := newManageHandler(t, &fakeEventQuery{}, &fakeDedupCounter{})
+	tok := seedToken(t, repo, "33333333-3333-3333-3333-333333333333")
+
+	r := chi.NewRouter()
+	h.RegisterManageRoutes(r)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodGet,
+		"/m/"+tok.ManageID+"?cursor=-1", nil))
+	require.Equal(t, http.StatusBadRequest, w.Code)
+}
+
+func TestGetManage_PaginationCursorAndHasMore(t *testing.T) {
+	t.Parallel()
+	full := []event.Event{}
+	for i := 20; i > 0; i-- {
+		full = append(full, event.Event{ID: int64(i), SourceIP: "1.1.1.1"})
+	}
+	eq := &fakeEventQuery{
+		listResult: event.ListResult{
+			Events:     full,
+			HasMore:    true,
+			NextCursor: 1,
+		},
+		countN: 50,
+	}
+	h, repo := newManageHandler(t, eq, &fakeDedupCounter{})
+	tok := seedToken(t, repo, "44444444-4444-4444-4444-444444444444")
+
+	r := chi.NewRouter()
+	h.RegisterManageRoutes(r)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/m/"+tok.ManageID, nil))
+	require.Equal(t, http.StatusOK, w.Code)
+
+	resp := decodeManage(t, w.Body.Bytes())
+	require.Len(t, resp.Data.Events, 20)
+	require.True(t, resp.Data.Page.HasMore)
+	require.Equal(t, "1", resp.Data.Page.NextCursor,
+		"cursor is the ID of the last event returned")
+}
+
+func TestGetManage_LimitParamRespected(t *testing.T) {
+	t.Parallel()
+	eq := &fakeEventQuery{}
+	h, repo := newManageHandler(t, eq, &fakeDedupCounter{})
+	tok := seedToken(t, repo, "55555555-5555-5555-5555-555555555555")
+
+	r := chi.NewRouter()
+	h.RegisterManageRoutes(r)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodGet,
+		"/m/"+tok.ManageID+"?limit=5", nil))
+	require.Equal(t, http.StatusOK, w.Code)
+	require.Equal(t, 5, eq.lastOpts.Limit)
+}
+
+func TestGetManage_LimitCappedAtMax(t *testing.T) {
+	t.Parallel()
+	eq := &fakeEventQuery{}
+	h, repo := newManageHandler(t, eq, &fakeDedupCounter{})
+	tok := seedToken(t, repo, "66666666-6666-6666-6666-666666666666")
+
+	r := chi.NewRouter()
+	h.RegisterManageRoutes(r)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodGet,
+		"/m/"+tok.ManageID+"?limit=999", nil))
+	require.Equal(t, http.StatusOK, w.Code)
+	require.LessOrEqual(t, eq.lastOpts.Limit, 100,
+		"limit should be capped at manageMaxPageSize")
+}
+
+func TestDeleteManage_HappyPath(t *testing.T) {
+	t.Parallel()
+	h, repo := newManageHandler(t, &fakeEventQuery{}, &fakeDedupCounter{})
+	tok := seedToken(t, repo, "77777777-7777-7777-7777-777777777777")
+
+	r := chi.NewRouter()
+	h.RegisterManageRoutes(r)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(
+		w,
+		httptest.NewRequest(http.MethodDelete, "/m/"+tok.ManageID, nil),
+	)
+	require.Equal(t, http.StatusNoContent, w.Code)
+}
+
+func TestDeleteManage_404OnUnknownManageID(t *testing.T) {
+	t.Parallel()
+	h, _ := newManageHandler(t, &fakeEventQuery{}, &fakeDedupCounter{})
+
+	r := chi.NewRouter()
+	h.RegisterManageRoutes(r)
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(
+		w,
+		httptest.NewRequest(http.MethodDelete, "/m/does-not-exist", nil),
+	)
+	require.Equal(t, http.StatusNotFound, w.Code)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/repository.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/repository.go
new file mode 100644
index 00000000..7303653b
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/repository.go
@@ -0,0 +1,223 @@
+// ©AngelaMos | 2026
+// repository.go
+
+package token
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"log/slog"
+
+	"github.com/jmoiron/sqlx"
+)
+
+var ErrNotFound = errors.New("token not found")
+
+const defaultListLimit = 50
+
+type Repository struct {
+	db *sqlx.DB
+}
+
+func NewRepository(db *sqlx.DB) *Repository {
+	return &Repository{db: db}
+}
+
+const insertSQL = `
+INSERT INTO tokens (
+    id, manage_id, type, memo, filename,
+    alert_channel, telegram_bot, telegram_chat, webhook_url,
+    created_ip, created_fp, metadata, enabled
+) VALUES (
+    :id, :manage_id, :type, :memo, :filename,
+    :alert_channel, :telegram_bot, :telegram_chat, :webhook_url,
+    :created_ip, :created_fp, :metadata, :enabled
+)
+RETURNING created_at, trigger_count, last_triggered`
+
+func (r *Repository) Insert(ctx context.Context, t *Token) error {
+	stmt, err := r.db.PrepareNamedContext(ctx, insertSQL)
+	if err != nil {
+		return fmt.Errorf("prepare insert token: %w", err)
+	}
+	defer func() {
+		if cerr := stmt.Close(); cerr != nil {
+			slog.WarnContext(ctx, "close prepared stmt",
+				"op", "insert_token", "error", cerr)
+		}
+	}()
+
+	if err := stmt.GetContext(ctx, t, t); err != nil {
+		return fmt.Errorf("insert token: %w", err)
+	}
+	return nil
+}
+
+const selectColumns = `
+    id, manage_id, type, memo, filename,
+    alert_channel, telegram_bot, telegram_chat, webhook_url,
+    created_at, created_ip, created_fp, enabled,
+    trigger_count, last_triggered, metadata`
+
+func (r *Repository) GetByID(ctx context.Context, id string) (*Token, error) {
+	var t Token
+	q := `SELECT ` + selectColumns + ` FROM tokens WHERE id = $1`
+	err := r.db.GetContext(ctx, &t, q, id)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, ErrNotFound
+	}
+	if err != nil {
+		return nil, fmt.Errorf("get token by id: %w", err)
+	}
+	return &t, nil
+}
+
+func (r *Repository) GetByManageID(
+	ctx context.Context,
+	manageID string,
+) (*Token, error) {
+	var t Token
+	q := `SELECT ` + selectColumns + ` FROM tokens WHERE manage_id = $1`
+	err := r.db.GetContext(ctx, &t, q, manageID)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, ErrNotFound
+	}
+	if err != nil {
+		return nil, fmt.Errorf("get token by manage_id: %w", err)
+	}
+	return &t, nil
+}
+
+func (r *Repository) DeleteByManageID(
+	ctx context.Context,
+	manageID string,
+) error {
+	res, err := r.db.ExecContext(ctx,
+		`DELETE FROM tokens WHERE manage_id = $1`, manageID)
+	if err != nil {
+		return fmt.Errorf("delete token: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("rows affected: %w", err)
+	}
+	if n == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+func (r *Repository) IncrementTriggerCount(
+	ctx context.Context,
+	id string,
+) error {
+	_, err := r.db.ExecContext(ctx, `
+        UPDATE tokens
+           SET trigger_count = trigger_count + 1,
+               last_triggered = NOW()
+         WHERE id = $1`, id)
+	if err != nil {
+		return fmt.Errorf("increment trigger count: %w", err)
+	}
+	return nil
+}
+
+func (r *Repository) SetEnabled(
+	ctx context.Context,
+	id string,
+	enabled bool,
+) error {
+	res, err := r.db.ExecContext(ctx,
+		`UPDATE tokens SET enabled = $2 WHERE id = $1`, id, enabled)
+	if err != nil {
+		return fmt.Errorf("set enabled: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("rows affected: %w", err)
+	}
+	if n == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+type ListOptions struct {
+	Limit  int
+	Offset int
+}
+
+func (r *Repository) ListAll(
+	ctx context.Context,
+	opts ListOptions,
+) ([]Token, error) {
+	if opts.Limit <= 0 {
+		opts.Limit = defaultListLimit
+	}
+	q := `SELECT ` + selectColumns + ` FROM tokens
+            ORDER BY created_at DESC
+            LIMIT $1 OFFSET $2`
+	var tokens []Token
+	if err := r.db.SelectContext(
+		ctx,
+		&tokens,
+		q,
+		opts.Limit,
+		opts.Offset,
+	); err != nil {
+		return nil, fmt.Errorf("list all tokens: %w", err)
+	}
+	return tokens, nil
+}
+
+func (r *Repository) CountAll(ctx context.Context) (int64, error) {
+	var n int64
+	if err := r.db.GetContext(
+		ctx,
+		&n,
+		`SELECT COUNT(*) FROM tokens`,
+	); err != nil {
+		return 0, fmt.Errorf("count tokens: %w", err)
+	}
+	return n, nil
+}
+
+type TypeCount struct {
+	Type  Type  `db:"type"  json:"type"`
+	Count int64 `db:"count" json:"count"`
+}
+
+type ChannelCount struct {
+	Channel AlertChannel `db:"alert_channel" json:"alert_channel"`
+	Count   int64        `db:"count"         json:"count"`
+}
+
+func (r *Repository) CountByType(
+	ctx context.Context,
+) ([]TypeCount, error) {
+	rows := []TypeCount{}
+	q := `SELECT type, COUNT(*) AS count
+	        FROM tokens
+	       GROUP BY type
+	       ORDER BY type`
+	if err := r.db.SelectContext(ctx, &rows, q); err != nil {
+		return nil, fmt.Errorf("count tokens by type: %w", err)
+	}
+	return rows, nil
+}
+
+func (r *Repository) CountByAlertChannel(
+	ctx context.Context,
+) ([]ChannelCount, error) {
+	rows := []ChannelCount{}
+	q := `SELECT alert_channel, COUNT(*) AS count
+	        FROM tokens
+	       GROUP BY alert_channel
+	       ORDER BY alert_channel`
+	if err := r.db.SelectContext(ctx, &rows, q); err != nil {
+		return nil, fmt.Errorf("count tokens by channel: %w", err)
+	}
+	return rows, nil
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/repository_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/repository_test.go
new file mode 100644
index 00000000..b0f9707e
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/repository_test.go
@@ -0,0 +1,262 @@
+// ©AngelaMos | 2026
+// repository_test.go
+
+//go:build integration
+
+package token_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/jmoiron/sqlx"
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/testutil"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+)
+
+func newRepo(t *testing.T) *token.Repository {
+	t.Helper()
+	db := sqlx.NewDb(testutil.NewTestDB(t), "pgx")
+	return token.NewRepository(db)
+}
+
+func sampleWebhookToken(id string) *token.Token {
+	return &token.Token{
+		ID:           id,
+		ManageID:     uuid.New().String(),
+		Type:         token.TypeWebbug,
+		Memo:         "test webbug",
+		AlertChannel: token.ChannelWebhook,
+		WebhookURL:   testutil.Ptr("https://example.com/hook"),
+		CreatedIP:    "203.0.113.10",
+		CreatedFP:    "0123456789abcdef",
+		Metadata:     json.RawMessage(`{}`),
+		Enabled:      true,
+	}
+}
+
+func sampleTelegramToken(id string) *token.Token {
+	return &token.Token{
+		ID:           id,
+		ManageID:     uuid.New().String(),
+		Type:         token.TypeDocx,
+		Memo:         "Q4 bonuses",
+		Filename:     testutil.Ptr("Q4_Bonuses_2024.docx"),
+		AlertChannel: token.ChannelTelegram,
+		TelegramBot:  testutil.Ptr("123456:ABCDEF"),
+		TelegramChat: testutil.Ptr("-1001234567890"),
+		CreatedIP:    "198.51.100.5",
+		CreatedFP:    "fedcba9876543210",
+		Metadata:     json.RawMessage(`{"include_keys":["aws"]}`),
+		Enabled:      true,
+	}
+}
+
+func TestRepository_InsertAndGetByID(t *testing.T) {
+	t.Parallel()
+	repo := newRepo(t)
+	ctx := context.Background()
+
+	tok := sampleWebhookToken("abcdef0123ko")
+	require.NoError(t, repo.Insert(ctx, tok))
+	require.False(t, tok.CreatedAt.IsZero(), "Insert should populate created_at via RETURNING")
+
+	got, err := repo.GetByID(ctx, tok.ID)
+	require.NoError(t, err)
+
+	require.Equal(t, tok.ID, got.ID)
+	require.Equal(t, tok.ManageID, got.ManageID)
+	require.Equal(t, tok.Type, got.Type)
+	require.Equal(t, tok.AlertChannel, got.AlertChannel)
+	require.Equal(t, tok.Memo, got.Memo)
+	require.NotNil(t, got.WebhookURL)
+	require.Equal(t, "https://example.com/hook", *got.WebhookURL)
+	require.True(t, got.Enabled)
+	require.Equal(t, int64(0), got.TriggerCount)
+}
+
+func TestRepository_GetByID_NotFound(t *testing.T) {
+	t.Parallel()
+	repo := newRepo(t)
+
+	_, err := repo.GetByID(context.Background(), "doesnotexist")
+	require.ErrorIs(t, err, token.ErrNotFound)
+}
+
+func TestRepository_GetByManageID(t *testing.T) {
+	t.Parallel()
+	repo := newRepo(t)
+	ctx := context.Background()
+
+	tok := sampleTelegramToken("mngabcdef012")
+	require.NoError(t, repo.Insert(ctx, tok))
+
+	got, err := repo.GetByManageID(ctx, tok.ManageID)
+	require.NoError(t, err)
+
+	require.Equal(t, tok.ID, got.ID)
+	require.Equal(t, token.ChannelTelegram, got.AlertChannel)
+	require.NotNil(t, got.TelegramBot)
+	require.Equal(t, "123456:ABCDEF", *got.TelegramBot)
+}
+
+func TestRepository_GetByManageID_NotFound(t *testing.T) {
+	t.Parallel()
+	repo := newRepo(t)
+
+	_, err := repo.GetByManageID(context.Background(), uuid.New().String())
+	require.ErrorIs(t, err, token.ErrNotFound)
+}
+
+func TestRepository_DeleteByManageID(t *testing.T) {
+	t.Parallel()
+	repo := newRepo(t)
+	ctx := context.Background()
+
+	tok := sampleWebhookToken("delok0123abc")
+	require.NoError(t, repo.Insert(ctx, tok))
+
+	require.NoError(t, repo.DeleteByManageID(ctx, tok.ManageID))
+
+	_, err := repo.GetByID(ctx, tok.ID)
+	require.ErrorIs(t, err, token.ErrNotFound)
+}
+
+func TestRepository_DeleteByManageID_NotFound(t *testing.T) {
+	t.Parallel()
+	repo := newRepo(t)
+
+	err := repo.DeleteByManageID(context.Background(), uuid.New().String())
+	require.True(t, errors.Is(err, token.ErrNotFound))
+}
+
+func TestRepository_IncrementTriggerCount(t *testing.T) {
+	t.Parallel()
+	repo := newRepo(t)
+	ctx := context.Background()
+
+	tok := sampleWebhookToken("trgcount001a")
+	require.NoError(t, repo.Insert(ctx, tok))
+
+	require.NoError(t, repo.IncrementTriggerCount(ctx, tok.ID))
+	require.NoError(t, repo.IncrementTriggerCount(ctx, tok.ID))
+
+	got, err := repo.GetByID(ctx, tok.ID)
+	require.NoError(t, err)
+	require.Equal(t, int64(2), got.TriggerCount)
+	require.NotNil(t, got.LastTriggered)
+}
+
+func TestRepository_SetEnabled(t *testing.T) {
+	t.Parallel()
+	repo := newRepo(t)
+	ctx := context.Background()
+
+	tok := sampleWebhookToken("setenab0001a")
+	require.NoError(t, repo.Insert(ctx, tok))
+
+	require.NoError(t, repo.SetEnabled(ctx, tok.ID, false))
+
+	got, err := repo.GetByID(ctx, tok.ID)
+	require.NoError(t, err)
+	require.False(t, got.Enabled)
+
+	require.NoError(t, repo.SetEnabled(ctx, tok.ID, true))
+	got, err = repo.GetByID(ctx, tok.ID)
+	require.NoError(t, err)
+	require.True(t, got.Enabled)
+}
+
+func TestRepository_SetEnabled_NotFound(t *testing.T) {
+	t.Parallel()
+	repo := newRepo(t)
+
+	err := repo.SetEnabled(context.Background(), "nonexistent", false)
+	require.ErrorIs(t, err, token.ErrNotFound)
+}
+
+func TestRepository_ListAll(t *testing.T) {
+	t.Parallel()
+	repo := newRepo(t)
+	ctx := context.Background()
+
+	for _, id := range []string{"lstaaaaaaaa1", "lstbbbbbbbb2", "lstcccccccc3"} {
+		tok := sampleWebhookToken(id)
+		tok.Memo = "list-test-" + id
+		require.NoError(t, repo.Insert(ctx, tok))
+	}
+
+	got, err := repo.ListAll(ctx, token.ListOptions{Limit: 10})
+	require.NoError(t, err)
+	require.Len(t, got, 3)
+
+	count, err := repo.CountAll(ctx)
+	require.NoError(t, err)
+	require.Equal(t, int64(3), count)
+}
+
+func TestRepository_CountByType(t *testing.T) {
+	t.Parallel()
+	repo := newRepo(t)
+	ctx := context.Background()
+
+	webbug := sampleWebhookToken("cntbytype01a")
+	webbug.Type = token.TypeWebbug
+	require.NoError(t, repo.Insert(ctx, webbug))
+
+	webbug2 := sampleWebhookToken("cntbytype01b")
+	webbug2.Type = token.TypeWebbug
+	require.NoError(t, repo.Insert(ctx, webbug2))
+
+	docx := sampleTelegramToken("cntbytype02a")
+	docx.Type = token.TypeDocx
+	require.NoError(t, repo.Insert(ctx, docx))
+
+	rows, err := repo.CountByType(ctx)
+	require.NoError(t, err)
+
+	got := map[token.Type]int64{}
+	for _, r := range rows {
+		got[r.Type] = r.Count
+	}
+	require.GreaterOrEqual(t, got[token.TypeWebbug], int64(2))
+	require.GreaterOrEqual(t, got[token.TypeDocx], int64(1))
+}
+
+func TestRepository_CountByAlertChannel(t *testing.T) {
+	t.Parallel()
+	repo := newRepo(t)
+	ctx := context.Background()
+
+	wh := sampleWebhookToken("cntbychan01a")
+	require.NoError(t, repo.Insert(ctx, wh))
+
+	tg := sampleTelegramToken("cntbychan02a")
+	require.NoError(t, repo.Insert(ctx, tg))
+
+	rows, err := repo.CountByAlertChannel(ctx)
+	require.NoError(t, err)
+
+	got := map[token.AlertChannel]int64{}
+	for _, r := range rows {
+		got[r.Channel] = r.Count
+	}
+	require.GreaterOrEqual(t, got[token.ChannelWebhook], int64(1))
+	require.GreaterOrEqual(t, got[token.ChannelTelegram], int64(1))
+}
+
+func TestRepository_TypeAndChannelValidation(t *testing.T) {
+	t.Parallel()
+	repo := newRepo(t)
+
+	bad := sampleWebhookToken("badtypee0001")
+	bad.Type = "invalid_type"
+
+	err := repo.Insert(context.Background(), bad)
+	require.Error(t, err, "DB CHECK should reject invalid type")
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/service.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/service.go
new file mode 100644
index 00000000..e0301f6b
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/service.go
@@ -0,0 +1,328 @@
+// ©AngelaMos | 2026
+// service.go
+
+package token
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"math/big"
+	"strings"
+
+	"github.com/go-playground/validator/v10"
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgconn"
+)
+
+const (
+	tokenIDAlphabet = "abcdefghijklmnopqrstuvwxyz0123456789"
+	tokenIDLength   = 12
+
+	metadataDestinationURL = "destination_url"
+	metadataIncludeKeys    = "include_keys"
+
+	pgUniqueViolationCode = "23505"
+	maxTokenIDAttempts    = 5
+)
+
+var (
+	ErrInvalidDestinationURL = errors.New(
+		"token: slowredirect requires metadata.destination_url",
+	)
+	ErrInvalidIncludeKeys = errors.New(
+		"token: envfile metadata.include_keys must be a subset of {aws,stripe,github,db}",
+	)
+	ErrUnknownGeneratorType = errors.New(
+		"token: no generator registered for this type",
+	)
+	ErrGenerateFailed = errors.New("token: artifact generation failed")
+	ErrValidation     = errors.New("token: request validation failed")
+)
+
+var allowedIncludeKeys = map[string]struct{}{
+	"aws": {}, "stripe": {}, "github": {}, "db": {},
+}
+
+type ServiceRepository interface {
+	Insert(ctx context.Context, t *Token) error
+	GetByID(ctx context.Context, id string) (*Token, error)
+	GetByManageID(ctx context.Context, manageID string) (*Token, error)
+	DeleteByManageID(ctx context.Context, manageID string) error
+	IncrementTriggerCount(ctx context.Context, id string) error
+}
+
+type Registry interface {
+	Get(t Type) (Generator, bool)
+}
+
+type MapRegistry map[Type]Generator
+
+func (m MapRegistry) Get(t Type) (Generator, bool) {
+	g, ok := m[t]
+	return g, ok
+}
+
+type ServiceConfig struct {
+	BaseURL   string
+	ManageURL string
+}
+
+type Service struct {
+	repo      ServiceRepository
+	registry  Registry
+	validate  *validator.Validate
+	baseURL   string
+	manageURL string
+}
+
+func NewService(
+	repo ServiceRepository,
+	reg Registry,
+	cfg ServiceConfig,
+) *Service {
+	return &Service{
+		repo:      repo,
+		registry:  reg,
+		validate:  validator.New(),
+		baseURL:   strings.TrimRight(cfg.BaseURL, "/"),
+		manageURL: strings.TrimRight(cfg.ManageURL, "/"),
+	}
+}
+
+func (s *Service) Create(
+	ctx context.Context,
+	req CreateRequest,
+	createdFP, createdIP string,
+) (*Token, Artifact, error) {
+	if err := s.validate.Struct(req); err != nil {
+		return nil, Artifact{}, fmt.Errorf(
+			"%w: %w", ErrValidation, err,
+		)
+	}
+	if err := validateTypeMetadata(req.Type, req.Metadata); err != nil {
+		return nil, Artifact{}, err
+	}
+
+	gen, ok := s.registry.Get(req.Type)
+	if !ok {
+		return nil, Artifact{}, fmt.Errorf(
+			"%w: %s", ErrUnknownGeneratorType, req.Type,
+		)
+	}
+
+	manageID := uuid.NewString()
+	tok := &Token{
+		ManageID:     manageID,
+		Type:         req.Type,
+		Memo:         req.Memo,
+		Filename:     filenamePointer(req.Filename),
+		AlertChannel: req.AlertChannel,
+		TelegramBot:  optionalString(req.TelegramBot),
+		TelegramChat: optionalString(req.TelegramChat),
+		WebhookURL:   optionalString(req.WebhookURL),
+		CreatedIP:    createdIP,
+		CreatedFP:    createdFP,
+		Enabled:      true,
+		Metadata:     normalizeMetadata(req.Metadata),
+	}
+
+	var (
+		art       Artifact
+		insertErr error
+	)
+	for attempt := range maxTokenIDAttempts {
+		id, err := generateTokenID()
+		if err != nil {
+			return nil, Artifact{}, fmt.Errorf(
+				"generate id (attempt %d): %w", attempt, err,
+			)
+		}
+		tok.ID = id
+
+		art, err = gen.Generate(ctx, tok, s.baseURL)
+		if err != nil {
+			return nil, Artifact{}, fmt.Errorf(
+				"%w: %w", ErrGenerateFailed, err,
+			)
+		}
+
+		insertErr = s.repo.Insert(ctx, tok)
+		if insertErr == nil {
+			return tok, art, nil
+		}
+		if !isUniqueViolation(insertErr) {
+			return nil, Artifact{}, fmt.Errorf(
+				"persist token: %w", insertErr,
+			)
+		}
+	}
+	return nil, Artifact{}, fmt.Errorf(
+		"persist token after %d id-collision retries: %w",
+		maxTokenIDAttempts, insertErr,
+	)
+}
+
+func isUniqueViolation(err error) bool {
+	var pgErr *pgconn.PgError
+	return errors.As(err, &pgErr) && pgErr.Code == pgUniqueViolationCode
+}
+
+func (s *Service) GetByID(
+	ctx context.Context,
+	id string,
+) (*Token, error) {
+	tok, err := s.repo.GetByID(ctx, id)
+	if errors.Is(err, ErrNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return tok, nil
+}
+
+func (s *Service) GetByManageID(
+	ctx context.Context,
+	manageID string,
+) (*Token, error) {
+	tok, err := s.repo.GetByManageID(ctx, manageID)
+	if errors.Is(err, ErrNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return tok, nil
+}
+
+func (s *Service) IncrementTriggerCount(
+	ctx context.Context,
+	id string,
+) error {
+	return s.repo.IncrementTriggerCount(ctx, id)
+}
+
+func (s *Service) DeleteByManageID(
+	ctx context.Context,
+	manageID string,
+) error {
+	return s.repo.DeleteByManageID(ctx, manageID)
+}
+
+func (s *Service) TriggerURL(id string) string {
+	return s.baseURL + "/c/" + id
+}
+
+func (s *Service) ManageURL(manageID string) string {
+	return s.manageURL + "/m/" + manageID
+}
+
+func (s *Service) Generator(t Type) (Generator, bool) {
+	return s.registry.Get(t)
+}
+
+func validateTypeMetadata(t Type, metadata json.RawMessage) error {
+	switch t {
+	case TypeSlowRedirect:
+		return validateSlowredirectMetadata(metadata)
+	case TypeEnvfile:
+		return validateEnvfileMetadata(metadata)
+	case TypeWebbug, TypeDocx, TypePDF, TypeKubeconfig, TypeMySQL:
+		return nil
+	}
+	return nil
+}
+
+func validateSlowredirectMetadata(metadata json.RawMessage) error {
+	if len(metadata) == 0 {
+		return ErrInvalidDestinationURL
+	}
+	var m map[string]json.RawMessage
+	if err := json.Unmarshal(metadata, &m); err != nil {
+		return fmt.Errorf(
+			"parse metadata: %w (slowredirect: %w)",
+			err, ErrInvalidDestinationURL,
+		)
+	}
+	raw, ok := m[metadataDestinationURL]
+	if !ok {
+		return ErrInvalidDestinationURL
+	}
+	var dest string
+	if err := json.Unmarshal(raw, &dest); err != nil {
+		return ErrInvalidDestinationURL
+	}
+	dest = strings.TrimSpace(dest)
+	if dest == "" {
+		return ErrInvalidDestinationURL
+	}
+	low := strings.ToLower(dest)
+	if !strings.HasPrefix(low, "http://") &&
+		!strings.HasPrefix(low, "https://") {
+		return ErrInvalidDestinationURL
+	}
+	return nil
+}
+
+func validateEnvfileMetadata(metadata json.RawMessage) error {
+	if len(metadata) == 0 {
+		return nil
+	}
+	var m map[string]json.RawMessage
+	if err := json.Unmarshal(metadata, &m); err != nil {
+		return fmt.Errorf("envfile metadata: %w", err)
+	}
+	raw, ok := m[metadataIncludeKeys]
+	if !ok {
+		return nil
+	}
+	var keys []string
+	if err := json.Unmarshal(raw, &keys); err != nil {
+		return ErrInvalidIncludeKeys
+	}
+	for _, k := range keys {
+		if _, ok := allowedIncludeKeys[k]; !ok {
+			return fmt.Errorf("%w: %q", ErrInvalidIncludeKeys, k)
+		}
+	}
+	return nil
+}
+
+func generateTokenID() (string, error) {
+	out := make([]byte, tokenIDLength)
+	bigLen := big.NewInt(int64(len(tokenIDAlphabet)))
+	for i := range out {
+		idx, err := rand.Int(rand.Reader, bigLen)
+		if err != nil {
+			return "", fmt.Errorf("rand: %w", err)
+		}
+		out[i] = tokenIDAlphabet[idx.Int64()]
+	}
+	return string(out), nil
+}
+
+func filenamePointer(s string) *string {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return nil
+	}
+	return &s
+}
+
+func optionalString(s string) *string {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return nil
+	}
+	return &s
+}
+
+func normalizeMetadata(metadata json.RawMessage) json.RawMessage {
+	if len(metadata) == 0 {
+		return json.RawMessage(`{}`)
+	}
+	return metadata
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/service_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/service_test.go
new file mode 100644
index 00000000..34dd5dbd
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/service_test.go
@@ -0,0 +1,495 @@
+// ©AngelaMos | 2026
+// service_test.go
+
+package token_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"github.com/jackc/pgx/v5/pgconn"
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/event"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token"
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/token/generators"
+)
+
+type fakeRepo struct {
+	mu        sync.Mutex
+	inserted  []*token.Token
+	byID      map[string]*token.Token
+	byManage  map[string]*token.Token
+	insertErr error
+}
+
+func newFakeRepo() *fakeRepo {
+	return &fakeRepo{
+		byID:     map[string]*token.Token{},
+		byManage: map[string]*token.Token{},
+	}
+}
+
+func (f *fakeRepo) Insert(_ context.Context, t *token.Token) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.insertErr != nil {
+		return f.insertErr
+	}
+	f.inserted = append(f.inserted, t)
+	f.byID[t.ID] = t
+	f.byManage[t.ManageID] = t
+	return nil
+}
+
+func (f *fakeRepo) GetByID(_ context.Context, id string) (*token.Token, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	t, ok := f.byID[id]
+	if !ok {
+		return nil, token.ErrNotFound
+	}
+	return t, nil
+}
+
+func (f *fakeRepo) GetByManageID(
+	_ context.Context,
+	manageID string,
+) (*token.Token, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	t, ok := f.byManage[manageID]
+	if !ok {
+		return nil, token.ErrNotFound
+	}
+	return t, nil
+}
+
+func (f *fakeRepo) IncrementTriggerCount(_ context.Context, _ string) error {
+	return nil
+}
+
+func (f *fakeRepo) DeleteByManageID(
+	_ context.Context,
+	manageID string,
+) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	t, ok := f.byManage[manageID]
+	if !ok {
+		return token.ErrNotFound
+	}
+	delete(f.byManage, manageID)
+	delete(f.byID, t.ID)
+	return nil
+}
+
+type fakeGenerator struct {
+	tokenType   token.Type
+	artifact    generators.Artifact
+	generateErr error
+	calls       atomic.Int32
+}
+
+func (g *fakeGenerator) Type() token.Type { return g.tokenType }
+
+func (g *fakeGenerator) Generate(
+	_ context.Context,
+	_ *token.Token,
+	_ string,
+) (generators.Artifact, error) {
+	g.calls.Add(1)
+	if g.generateErr != nil {
+		return generators.Artifact{}, g.generateErr
+	}
+	return g.artifact, nil
+}
+
+func (g *fakeGenerator) Trigger(
+	_ context.Context,
+	_ *token.Token,
+	_ *http.Request,
+) (*event.Event, *generators.TriggerResponse, error) {
+	return nil, nil, nil
+}
+
+func newWebbugReq() token.CreateRequest {
+	return token.CreateRequest{
+		Type:          token.TypeWebbug,
+		Memo:          "test",
+		AlertChannel:  token.ChannelWebhook,
+		WebhookURL:    "https://example.com/hook",
+		TurnstileResp: "stub-token",
+	}
+}
+
+func TestService_Create_GeneratesValidIDAndManageID(t *testing.T) {
+	repo := newFakeRepo()
+	gen := &fakeGenerator{
+		tokenType: token.TypeWebbug,
+		artifact:  generators.Artifact{Kind: generators.KindURL, URL: "x"},
+	}
+	svc := token.NewService(
+		repo,
+		token.MapRegistry{token.TypeWebbug: gen},
+		token.ServiceConfig{
+			BaseURL:   "https://canary.example.com",
+			ManageURL: "https://canary.example.com",
+		},
+	)
+
+	tok, _, err := svc.Create(
+		context.Background(),
+		newWebbugReq(),
+		"fp",
+		"1.2.3.4",
+	)
+	require.NoError(t, err)
+	require.NotNil(t, tok)
+
+	require.Regexp(t, `^[a-z0-9]{12}$`, tok.ID)
+	require.Regexp(
+		t,
+		`^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$`,
+		tok.ManageID,
+	)
+}
+
+func TestService_Create_PersistsToRepo(t *testing.T) {
+	repo := newFakeRepo()
+	gen := &fakeGenerator{
+		tokenType: token.TypeWebbug,
+		artifact:  generators.Artifact{Kind: generators.KindURL},
+	}
+	svc := token.NewService(repo, token.MapRegistry{token.TypeWebbug: gen},
+		token.ServiceConfig{BaseURL: "https://canary.example.com"})
+
+	tok, _, err := svc.Create(
+		context.Background(),
+		newWebbugReq(),
+		"fp",
+		"1.2.3.4",
+	)
+	require.NoError(t, err)
+	require.Len(t, repo.inserted, 1)
+	require.Equal(t, tok.ID, repo.inserted[0].ID)
+	require.Equal(t, "1.2.3.4", repo.inserted[0].CreatedIP)
+	require.Equal(t, "fp", repo.inserted[0].CreatedFP)
+	require.True(t, repo.inserted[0].Enabled)
+}
+
+func TestService_Create_CallsGeneratorWithBaseURL(t *testing.T) {
+	repo := newFakeRepo()
+	gen := &fakeGenerator{
+		tokenType: token.TypeWebbug,
+		artifact:  generators.Artifact{Kind: generators.KindURL, URL: "x"},
+	}
+	svc := token.NewService(repo, token.MapRegistry{token.TypeWebbug: gen},
+		token.ServiceConfig{BaseURL: "https://canary.example.com"})
+
+	_, _, err := svc.Create(
+		context.Background(),
+		newWebbugReq(),
+		"fp",
+		"1.2.3.4",
+	)
+	require.NoError(t, err)
+	require.Equal(t, int32(1), gen.calls.Load())
+}
+
+func TestService_Create_UnknownTypeReturnsError(t *testing.T) {
+	repo := newFakeRepo()
+	svc := token.NewService(repo, token.MapRegistry{},
+		token.ServiceConfig{BaseURL: "https://canary.example.com"})
+
+	_, _, err := svc.Create(
+		context.Background(),
+		newWebbugReq(),
+		"fp",
+		"1.2.3.4",
+	)
+	require.Error(t, err)
+	require.ErrorIs(t, err, token.ErrUnknownGeneratorType)
+}
+
+func TestService_Create_ValidationFails(t *testing.T) {
+	repo := newFakeRepo()
+	gen := &fakeGenerator{tokenType: token.TypeWebbug}
+	svc := token.NewService(repo, token.MapRegistry{token.TypeWebbug: gen},
+		token.ServiceConfig{BaseURL: "https://canary.example.com"})
+
+	req := newWebbugReq()
+	req.AlertChannel = ""
+	_, _, err := svc.Create(context.Background(), req, "fp", "1.2.3.4")
+	require.Error(t, err)
+}
+
+func TestService_Create_SlowredirectMissingDestinationFails(t *testing.T) {
+	repo := newFakeRepo()
+	gen := &fakeGenerator{tokenType: token.TypeSlowRedirect}
+	svc := token.NewService(
+		repo,
+		token.MapRegistry{token.TypeSlowRedirect: gen},
+		token.ServiceConfig{BaseURL: "https://canary.example.com"},
+	)
+
+	req := newWebbugReq()
+	req.Type = token.TypeSlowRedirect
+	_, _, err := svc.Create(context.Background(), req, "fp", "1.2.3.4")
+	require.Error(t, err)
+	require.ErrorIs(t, err, token.ErrInvalidDestinationURL)
+}
+
+func TestService_Create_SlowredirectInvalidSchemeFails(t *testing.T) {
+	repo := newFakeRepo()
+	gen := &fakeGenerator{tokenType: token.TypeSlowRedirect}
+	svc := token.NewService(
+		repo,
+		token.MapRegistry{token.TypeSlowRedirect: gen},
+		token.ServiceConfig{BaseURL: "https://canary.example.com"},
+	)
+
+	req := newWebbugReq()
+	req.Type = token.TypeSlowRedirect
+	req.Metadata = json.RawMessage(`{"destination_url":"javascript:alert(1)"}`)
+	_, _, err := svc.Create(context.Background(), req, "fp", "1.2.3.4")
+	require.ErrorIs(t, err, token.ErrInvalidDestinationURL)
+}
+
+func TestService_Create_SlowredirectValidURLSucceeds(t *testing.T) {
+	repo := newFakeRepo()
+	gen := &fakeGenerator{
+		tokenType: token.TypeSlowRedirect,
+		artifact:  generators.Artifact{Kind: generators.KindURL},
+	}
+	svc := token.NewService(
+		repo,
+		token.MapRegistry{token.TypeSlowRedirect: gen},
+		token.ServiceConfig{BaseURL: "https://canary.example.com"},
+	)
+
+	req := newWebbugReq()
+	req.Type = token.TypeSlowRedirect
+	req.Metadata = json.RawMessage(`{"destination_url":"https://example.com"}`)
+	_, _, err := svc.Create(context.Background(), req, "fp", "1.2.3.4")
+	require.NoError(t, err)
+}
+
+func TestService_Create_EnvfileInvalidKeyFails(t *testing.T) {
+	repo := newFakeRepo()
+	gen := &fakeGenerator{
+		tokenType: token.TypeEnvfile,
+		artifact:  generators.Artifact{Kind: generators.KindText},
+	}
+	svc := token.NewService(repo, token.MapRegistry{token.TypeEnvfile: gen},
+		token.ServiceConfig{BaseURL: "https://canary.example.com"})
+
+	req := newWebbugReq()
+	req.Type = token.TypeEnvfile
+	req.Metadata = json.RawMessage(`{"include_keys":["aws","nonexistent"]}`)
+	_, _, err := svc.Create(context.Background(), req, "fp", "1.2.3.4")
+	require.ErrorIs(t, err, token.ErrInvalidIncludeKeys)
+}
+
+func TestService_Create_EnvfileValidKeysSucceeds(t *testing.T) {
+	repo := newFakeRepo()
+	gen := &fakeGenerator{
+		tokenType: token.TypeEnvfile,
+		artifact:  generators.Artifact{Kind: generators.KindText},
+	}
+	svc := token.NewService(repo, token.MapRegistry{token.TypeEnvfile: gen},
+		token.ServiceConfig{BaseURL: "https://canary.example.com"})
+
+	req := newWebbugReq()
+	req.Type = token.TypeEnvfile
+	req.Metadata = json.RawMessage(`{"include_keys":["aws","stripe"]}`)
+	_, _, err := svc.Create(context.Background(), req, "fp", "1.2.3.4")
+	require.NoError(t, err)
+}
+
+func TestService_Create_GeneratorErrorPropagates(t *testing.T) {
+	repo := newFakeRepo()
+	gen := &fakeGenerator{
+		tokenType:   token.TypeWebbug,
+		generateErr: errors.New("generate failed"),
+	}
+	svc := token.NewService(repo, token.MapRegistry{token.TypeWebbug: gen},
+		token.ServiceConfig{BaseURL: "https://canary.example.com"})
+
+	_, _, err := svc.Create(
+		context.Background(),
+		newWebbugReq(),
+		"fp",
+		"1.2.3.4",
+	)
+	require.ErrorIs(t, err, token.ErrGenerateFailed)
+	require.Empty(t, repo.inserted, "must not persist if generator failed")
+}
+
+func TestService_Create_DistinctIDsAcrossCalls(t *testing.T) {
+	repo := newFakeRepo()
+	gen := &fakeGenerator{
+		tokenType: token.TypeWebbug,
+		artifact:  generators.Artifact{Kind: generators.KindURL},
+	}
+	svc := token.NewService(repo, token.MapRegistry{token.TypeWebbug: gen},
+		token.ServiceConfig{BaseURL: "https://canary.example.com"})
+
+	seen := make(map[string]struct{})
+	for range 30 {
+		tok, _, err := svc.Create(
+			context.Background(),
+			newWebbugReq(),
+			"fp",
+			"1.2.3.4",
+		)
+		require.NoError(t, err)
+		seen[tok.ID] = struct{}{}
+	}
+	require.Greater(
+		t,
+		len(seen),
+		28,
+		"ID generation must be sufficiently random",
+	)
+}
+
+type collisionRepo struct {
+	mu         sync.Mutex
+	collisions int
+	remaining  int
+	inserted   []*token.Token
+	byID       map[string]*token.Token
+}
+
+func newCollisionRepo(collisions int) *collisionRepo {
+	return &collisionRepo{
+		remaining: collisions,
+		byID:      map[string]*token.Token{},
+	}
+}
+
+func (r *collisionRepo) Insert(_ context.Context, t *token.Token) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.remaining > 0 {
+		r.remaining--
+		r.collisions++
+		return &pgconn.PgError{Code: "23505"}
+	}
+	r.inserted = append(r.inserted, t)
+	r.byID[t.ID] = t
+	return nil
+}
+
+func (r *collisionRepo) GetByID(
+	_ context.Context, id string,
+) (*token.Token, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	t, ok := r.byID[id]
+	if !ok {
+		return nil, token.ErrNotFound
+	}
+	return t, nil
+}
+
+func (r *collisionRepo) GetByManageID(
+	_ context.Context, _ string,
+) (*token.Token, error) {
+	return nil, token.ErrNotFound
+}
+
+func (r *collisionRepo) IncrementTriggerCount(
+	_ context.Context, _ string,
+) error {
+	return nil
+}
+
+func (r *collisionRepo) DeleteByManageID(
+	_ context.Context, _ string,
+) error {
+	return token.ErrNotFound
+}
+
+func TestService_Create_RetriesOnTokenIDCollision(t *testing.T) {
+	repo := newCollisionRepo(2)
+	gen := &fakeGenerator{
+		tokenType: token.TypeWebbug,
+		artifact: generators.Artifact{
+			Kind: generators.KindURL,
+			URL:  "https://canary.example.com/c/x",
+		},
+	}
+	svc := token.NewService(
+		repo,
+		token.MapRegistry{token.TypeWebbug: gen},
+		token.ServiceConfig{BaseURL: "https://canary.example.com"},
+	)
+
+	tok, _, err := svc.Create(context.Background(), token.CreateRequest{
+		Type:         token.TypeWebbug,
+		Memo:         "x",
+		AlertChannel: token.ChannelWebhook,
+		WebhookURL:   "https://example.com/h",
+	}, "fp", "ip")
+	require.NoError(t, err)
+	require.NotNil(t, tok)
+	require.Equal(t, 2, repo.collisions,
+		"repo must have rejected exactly two prior IDs")
+	require.Len(t, repo.inserted, 1, "exactly one token persisted")
+	require.Equal(t, int32(3), gen.calls.Load(),
+		"generator called once per attempt (regenerates artifact per id)")
+}
+
+func TestService_Create_GivesUpAfterMaxCollisions(t *testing.T) {
+	repo := newCollisionRepo(10)
+	gen := &fakeGenerator{
+		tokenType: token.TypeWebbug,
+		artifact: generators.Artifact{
+			Kind: generators.KindURL,
+			URL:  "https://canary.example.com/c/x",
+		},
+	}
+	svc := token.NewService(
+		repo,
+		token.MapRegistry{token.TypeWebbug: gen},
+		token.ServiceConfig{BaseURL: "https://canary.example.com"},
+	)
+
+	_, _, err := svc.Create(context.Background(), token.CreateRequest{
+		Type:         token.TypeWebbug,
+		Memo:         "x",
+		AlertChannel: token.ChannelWebhook,
+		WebhookURL:   "https://example.com/h",
+	}, "fp", "ip")
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "id-collision retries")
+}
+
+func TestService_GetByID_NotFoundReturnsNilNil(t *testing.T) {
+	repo := newFakeRepo()
+	svc := token.NewService(repo, token.MapRegistry{},
+		token.ServiceConfig{BaseURL: "https://canary.example.com"})
+
+	tok, err := svc.GetByID(context.Background(), "nope")
+	require.NoError(t, err)
+	require.Nil(t, tok)
+}
+
+func TestService_TriggerURL(t *testing.T) {
+	svc := token.NewService(newFakeRepo(), token.MapRegistry{},
+		token.ServiceConfig{BaseURL: "https://canary.example.com/"})
+	require.Equal(t, "https://canary.example.com/c/abc", svc.TriggerURL("abc"))
+}
+
+func TestService_ManageURL(t *testing.T) {
+	svc := token.NewService(newFakeRepo(), token.MapRegistry{},
+		token.ServiceConfig{ManageURL: "https://canary.example.com/"})
+	require.Equal(t, "https://canary.example.com/m/uuid", svc.ManageURL("uuid"))
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/types.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/types.go
new file mode 100644
index 00000000..c7ba6af0
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/types.go
@@ -0,0 +1,73 @@
+// ©AngelaMos | 2026
+// types.go
+
+package token
+
+type TypeDescriptor struct {
+	Type           Type   `json:"type"`
+	Name           string `json:"name"`
+	Description    string `json:"description"`
+	ArtifactKind   string `json:"artifact_kind"`
+	Enabled        bool   `json:"enabled"`
+	DisabledReason string `json:"disabled_reason,omitempty"`
+}
+
+const mysqlDisabledReason = "Requires direct TCP exposure (port 3306). Not reachable via Cloudflare Tunnel — only enable on a VPS with raw TCP access."
+
+func TypeDescriptors(mysqlEnabled bool) []TypeDescriptor {
+	descriptors := []TypeDescriptor{
+		{
+			Type:         TypeWebbug,
+			Name:         "Web Bug Pixel",
+			Description:  "1x1 transparent GIF that fires when fetched. Embed in HTML emails or web pages.",
+			ArtifactKind: string(KindURL),
+			Enabled:      true,
+		},
+		{
+			Type:         TypeSlowRedirect,
+			Name:         "Slow Redirect",
+			Description:  "Browser-fingerprinting page that redirects to a destination URL after collecting client metadata.",
+			ArtifactKind: string(KindURL),
+			Enabled:      true,
+		},
+		{
+			Type:         TypeDocx,
+			Name:         "Microsoft Word Document",
+			Description:  "DOCX with an embedded INCLUDEPICTURE field that calls home when the document opens.",
+			ArtifactKind: string(KindFile),
+			Enabled:      true,
+		},
+		{
+			Type:         TypePDF,
+			Name:         "PDF Document",
+			Description:  "PDF with an /AA open-action URI that fires in Adobe Acrobat Reader.",
+			ArtifactKind: string(KindFile),
+			Enabled:      true,
+		},
+		{
+			Type:         TypeKubeconfig,
+			Name:         "Kubernetes Config",
+			Description:  "kubeconfig pointing kubectl at a fake K8s API server that records every request.",
+			ArtifactKind: string(KindText),
+			Enabled:      true,
+		},
+		{
+			Type:         TypeEnvfile,
+			Name:         ".env File",
+			Description:  "Plausible production .env with shuffled bait credentials and an embedded canary URL.",
+			ArtifactKind: string(KindText),
+			Enabled:      true,
+		},
+		{
+			Type:         TypeMySQL,
+			Name:         "MySQL Connection String",
+			Description:  "Fake MySQL endpoint that records any authentication attempt.",
+			ArtifactKind: string(KindConnectionString),
+			Enabled:      mysqlEnabled,
+		},
+	}
+	if !mysqlEnabled {
+		descriptors[len(descriptors)-1].DisabledReason = mysqlDisabledReason
+	}
+	return descriptors
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/turnstile/verifier.go b/PROJECTS/beginner/canary-token-generator/backend/internal/turnstile/verifier.go
new file mode 100644
index 00000000..3e63724d
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/turnstile/verifier.go
@@ -0,0 +1,148 @@
+// ©AngelaMos | 2026
+// verifier.go
+
+package turnstile
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/redis/go-redis/v9"
+)
+
+const (
+	DefaultVerifyURL = "https://challenges.cloudflare.com/turnstile/v0/siteverify"
+
+	cacheKeyPrefix    = "turnstile:fp:"
+	cacheTTL          = 5 * time.Minute
+	verifyTimeout     = 10 * time.Second
+	cachedSuccessFlag = "ok"
+
+	contentTypeForm = "application/x-www-form-urlencoded"
+)
+
+var (
+	ErrVerifyFailed = errors.New("turnstile: verification failed")
+	ErrEmptyToken   = errors.New("turnstile: empty response token")
+)
+
+type RedisClient interface {
+	Get(ctx context.Context, key string) *redis.StringCmd
+	SetEx(
+		ctx context.Context,
+		key string,
+		value any,
+		expiration time.Duration,
+	) *redis.StatusCmd
+}
+
+type Config struct {
+	SecretKey string
+	VerifyURL string
+	Client    *http.Client
+}
+
+type Verifier struct {
+	secret    string
+	verifyURL string
+	client    *http.Client
+	rdb       RedisClient
+}
+
+func NewVerifier(cfg Config, rdb RedisClient) *Verifier {
+	client := cfg.Client
+	if client == nil {
+		client = &http.Client{Timeout: verifyTimeout}
+	}
+	verifyURL := cfg.VerifyURL
+	if verifyURL == "" {
+		verifyURL = DefaultVerifyURL
+	}
+	return &Verifier{
+		secret:    cfg.SecretKey,
+		verifyURL: verifyURL,
+		client:    client,
+		rdb:       rdb,
+	}
+}
+
+func (v *Verifier) Verify(
+	ctx context.Context,
+	token, fingerprint string,
+) error {
+	if v.secret == "" {
+		return nil
+	}
+	if strings.TrimSpace(token) == "" {
+		return ErrEmptyToken
+	}
+
+	cacheKey := cacheKeyPrefix + fingerprint
+	if v.rdb != nil {
+		if cached, err := v.rdb.Get(ctx, cacheKey).Result(); err == nil &&
+			cached == cachedSuccessFlag {
+			return nil
+		}
+	}
+
+	if err := v.callSiteverify(ctx, token); err != nil {
+		return err
+	}
+
+	if v.rdb != nil {
+		if cErr := v.rdb.SetEx(
+			ctx,
+			cacheKey,
+			cachedSuccessFlag,
+			cacheTTL,
+		).Err(); cErr != nil {
+			slog.WarnContext(ctx, "turnstile: cache set",
+				"error", cErr, "fingerprint", fingerprint)
+		}
+	}
+	return nil
+}
+
+func (v *Verifier) callSiteverify(ctx context.Context, token string) error {
+	form := url.Values{"secret": {v.secret}, "response": {token}}
+	req, err := http.NewRequestWithContext(
+		ctx,
+		http.MethodPost,
+		v.verifyURL,
+		strings.NewReader(form.Encode()),
+	)
+	if err != nil {
+		return fmt.Errorf("turnstile: build request: %w", err)
+	}
+	req.Header.Set("Content-Type", contentTypeForm)
+
+	resp, err := v.client.Do(req)
+	if err != nil {
+		return fmt.Errorf("turnstile: call siteverify: %w", err)
+	}
+	defer func() {
+		if cErr := resp.Body.Close(); cErr != nil {
+			slog.WarnContext(ctx, "turnstile: close body",
+				"error", cErr)
+		}
+	}()
+
+	var body struct {
+		Success    bool     `json:"success"`
+		ErrorCodes []string `json:"error-codes"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+		return fmt.Errorf("turnstile: decode response: %w", err)
+	}
+	if !body.Success {
+		return fmt.Errorf("%w: %v", ErrVerifyFailed, body.ErrorCodes)
+	}
+	return nil
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/turnstile/verifier_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/turnstile/verifier_test.go
new file mode 100644
index 00000000..730a4800
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/turnstile/verifier_test.go
@@ -0,0 +1,161 @@
+// ©AngelaMos | 2026
+// verifier_test.go
+
+package turnstile_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/redis/go-redis/v9"
+	"github.com/stretchr/testify/require"
+
+	"github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend/internal/turnstile"
+)
+
+type fakeRedis struct {
+	store map[string]string
+}
+
+func (f *fakeRedis) Get(_ context.Context, key string) *redis.StringCmd {
+	cmd := redis.NewStringCmd(context.Background())
+	if v, ok := f.store[key]; ok {
+		cmd.SetVal(v)
+	} else {
+		cmd.SetErr(redis.Nil)
+	}
+	return cmd
+}
+
+func (f *fakeRedis) SetEx(
+	_ context.Context,
+	key string,
+	value any,
+	_ time.Duration,
+) *redis.StatusCmd {
+	cmd := redis.NewStatusCmd(context.Background())
+	if f.store == nil {
+		f.store = make(map[string]string)
+	}
+	if s, ok := value.(string); ok {
+		f.store[key] = s
+	}
+	cmd.SetVal("OK")
+	return cmd
+}
+
+func startMockSiteverify(
+	t *testing.T,
+	success bool,
+	errorCodes []string,
+) (string, *atomic.Int32) {
+	t.Helper()
+	var hits atomic.Int32
+	srv := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			hits.Add(1)
+			w.Header().Set("Content-Type", "application/json")
+			var body string
+			if success {
+				body = `{"success":true}`
+			} else {
+				body = `{"success":false,"error-codes":[`
+				for i, c := range errorCodes {
+					if i > 0 {
+						body += ","
+					}
+					body += `"` + c + `"`
+				}
+				body += `]}`
+			}
+			if _, err := w.Write([]byte(body)); err != nil {
+				t.Errorf("write mock: %v", err)
+			}
+		}),
+	)
+	t.Cleanup(srv.Close)
+	return srv.URL, &hits
+}
+
+func TestVerifier_EmptySecretBypasses(t *testing.T) {
+	v := turnstile.NewVerifier(turnstile.Config{}, &fakeRedis{})
+	require.NoError(t, v.Verify(context.Background(), "irrelevant", "fp"))
+}
+
+func TestVerifier_EmptyTokenReturnsError(t *testing.T) {
+	v := turnstile.NewVerifier(turnstile.Config{SecretKey: "s"}, &fakeRedis{})
+	err := v.Verify(context.Background(), "  ", "fp")
+	require.ErrorIs(t, err, turnstile.ErrEmptyToken)
+}
+
+func TestVerifier_SuccessCachesByFingerprint(t *testing.T) {
+	url, hits := startMockSiteverify(t, true, nil)
+	r := &fakeRedis{}
+	v := turnstile.NewVerifier(turnstile.Config{
+		SecretKey: "secret",
+		VerifyURL: url,
+	}, r)
+
+	require.NoError(t, v.Verify(context.Background(), "tok", "fp1"))
+	require.Equal(t, int32(1), hits.Load())
+
+	require.NoError(t, v.Verify(context.Background(), "tok", "fp1"))
+	require.Equal(
+		t,
+		int32(1),
+		hits.Load(),
+		"cache hit must skip siteverify call",
+	)
+}
+
+func TestVerifier_CacheMissForDifferentFingerprint(t *testing.T) {
+	url, hits := startMockSiteverify(t, true, nil)
+	v := turnstile.NewVerifier(turnstile.Config{
+		SecretKey: "secret",
+		VerifyURL: url,
+	}, &fakeRedis{})
+
+	require.NoError(t, v.Verify(context.Background(), "tok", "fp1"))
+	require.NoError(t, v.Verify(context.Background(), "tok", "fp2"))
+	require.Equal(t, int32(2), hits.Load())
+}
+
+func TestVerifier_FailedSiteverifyReturnsErrVerifyFailed(t *testing.T) {
+	url, _ := startMockSiteverify(t, false, []string{"invalid-input-response"})
+	v := turnstile.NewVerifier(turnstile.Config{
+		SecretKey: "secret",
+		VerifyURL: url,
+	}, &fakeRedis{})
+
+	err := v.Verify(context.Background(), "tok", "fp")
+	require.Error(t, err)
+	require.ErrorIs(t, err, turnstile.ErrVerifyFailed)
+}
+
+func TestVerifier_NilRedisStillWorks(t *testing.T) {
+	url, hits := startMockSiteverify(t, true, nil)
+	v := turnstile.NewVerifier(turnstile.Config{
+		SecretKey: "secret",
+		VerifyURL: url,
+	}, nil)
+
+	require.NoError(t, v.Verify(context.Background(), "tok", "fp"))
+	require.NoError(t, v.Verify(context.Background(), "tok", "fp"))
+	require.Equal(t, int32(2), hits.Load(), "without redis there is no caching")
+}
+
+func TestVerifier_NetworkErrorIsWrapped(t *testing.T) {
+	v := turnstile.NewVerifier(turnstile.Config{
+		SecretKey: "secret",
+		VerifyURL: "http://127.0.0.1:1/never",
+		Client:    &http.Client{Timeout: 100 * time.Millisecond},
+	}, &fakeRedis{})
+
+	err := v.Verify(context.Background(), "tok", "fp")
+	require.Error(t, err)
+	require.NotErrorIs(t, err, turnstile.ErrVerifyFailed)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/cloudflared.compose.yml b/PROJECTS/beginner/canary-token-generator/cloudflared.compose.yml
new file mode 100644
index 00000000..15da674d
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/cloudflared.compose.yml
@@ -0,0 +1,27 @@
+# =============================================================================
+# ©AngelaMos | 2026
+# cloudflared.compose.yml
+# =============================================================================
+# Cloudflare Tunnel for production remote access
+# Usage: docker compose -f compose.yml -f cloudflared.compose.yml up -d
+# =============================================================================
+
+services:
+  cloudflared:
+    image: cloudflare/cloudflared:latest
+    container_name: ${APP_NAME:-canary-token-generator}-tunnel
+    command: tunnel run --token ${CLOUDFLARE_TUNNEL_TOKEN}
+    networks:
+      - app
+    depends_on:
+      nginx:
+        condition: service_started
+    deploy:
+      resources:
+        limits:
+          cpus: '0.5'
+          memory: 128M
+        reservations:
+          cpus: '0.1'
+          memory: 32M
+    restart: unless-stopped
diff --git a/PROJECTS/beginner/canary-token-generator/compose.yml b/PROJECTS/beginner/canary-token-generator/compose.yml
new file mode 100644
index 00000000..80b5b70e
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/compose.yml
@@ -0,0 +1,131 @@
+# =============================================================================
+# ©AngelaMos | 2026
+# compose.yml
+# =============================================================================
+# Production compose: nginx → canary backend → postgres + redis
+# Cloudflare tunnel overlay:
+#   docker compose -f compose.yml -f cloudflared.compose.yml up -d
+# =============================================================================
+
+name: ${APP_NAME:-canary-token-generator}
+
+services:
+  nginx:
+    build:
+      context: .
+      dockerfile: infra/docker/vite.prod
+      args:
+        - VITE_API_URL=${VITE_API_URL:-/api}
+        - VITE_APP_TITLE=${VITE_APP_TITLE:-Canary Token Generator}
+        - VITE_TURNSTILE_SITE_KEY=${VITE_TURNSTILE_SITE_KEY:-}
+    container_name: ${APP_NAME:-canary-token-generator}-nginx
+    ports:
+      - "${NGINX_HOST_PORT:-22784}:80"
+    networks:
+      - app
+    depends_on:
+      canary:
+        condition: service_healthy
+    deploy:
+      resources:
+        limits:
+          cpus: '1.0'
+          memory: 256M
+        reservations:
+          cpus: '0.25'
+          memory: 64M
+    restart: unless-stopped
+
+  canary:
+    build:
+      context: ./backend
+      dockerfile: ../infra/docker/canary.prod
+    container_name: ${APP_NAME:-canary-token-generator}-canary
+    environment:
+      - APP_ENVIRONMENT=production
+      - DATABASE_URL=postgres://canary:${POSTGRES_PASSWORD}@postgres:5432/canary?sslmode=disable
+      - REDIS_URL=redis://redis:6379/0
+      - PUBLIC_BASE_URL=${PUBLIC_BASE_URL}
+      - TURNSTILE_SECRET=${TURNSTILE_SECRET}
+      - OPERATOR_TOKEN=${OPERATOR_TOKEN}
+      - GEOLITE_PATH=/data/GeoLite2-City.mmdb
+      - WEBHOOK_HMAC_SECRET=${WEBHOOK_HMAC_SECRET:-}
+      - MYSQL_FAKE_ENABLED=${MYSQL_FAKE_ENABLED:-false}
+      - LOG_LEVEL=${LOG_LEVEL:-info}
+      - LOG_FORMAT=${LOG_FORMAT:-json}
+      - OTEL_ENABLED=${OTEL_ENABLED:-false}
+      - OTEL_EXPORTER_OTLP_ENDPOINT=${OTEL_EXPORTER_OTLP_ENDPOINT:-}
+    volumes:
+      - geolite:/data:ro
+    networks:
+      - app
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "/healthcheck"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
+    deploy:
+      resources:
+        limits:
+          cpus: '1.0'
+          memory: 256M
+        reservations:
+          cpus: '0.25'
+          memory: 64M
+    restart: unless-stopped
+
+  postgres:
+    image: postgres:18-alpine
+    container_name: ${APP_NAME:-canary-token-generator}-postgres
+    environment:
+      POSTGRES_USER: canary
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: canary
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    networks:
+      - app
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U canary -d canary"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    deploy:
+      resources:
+        limits:
+          memory: 512M
+    restart: unless-stopped
+
+  redis:
+    image: redis:7-alpine
+    container_name: ${APP_NAME:-canary-token-generator}-redis
+    command: redis-server --appendonly yes
+    volumes:
+      - redisdata:/data
+    networks:
+      - app
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    deploy:
+      resources:
+        limits:
+          memory: 128M
+    restart: unless-stopped
+
+networks:
+  app:
+    driver: bridge
+
+volumes:
+  pgdata:
+  redisdata:
+  geolite:
diff --git a/PROJECTS/beginner/canary-token-generator/dev.compose.yml b/PROJECTS/beginner/canary-token-generator/dev.compose.yml
new file mode 100644
index 00000000..a4054b44
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/dev.compose.yml
@@ -0,0 +1,146 @@
+# =============================================================================
+# ©AngelaMos | 2026
+# dev.compose.yml
+# =============================================================================
+# Development compose: nginx → vite (HMR) + canary (Air hot-reload) + Postgres + Redis + Jaeger
+# Uses .env.development
+# =============================================================================
+
+name: ${APP_NAME:-canary-token-generator}-dev
+
+services:
+  nginx:
+    image: nginx:1.27-alpine
+    container_name: ${APP_NAME:-canary-token-generator}-nginx-dev
+    ports:
+      - "${NGINX_HOST_PORT:-22784}:80"
+    volumes:
+      - ./infra/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./infra/nginx/dev.nginx:/etc/nginx/conf.d/default.conf:ro
+    depends_on:
+      frontend:
+        condition: service_started
+      canary:
+        condition: service_healthy
+    networks:
+      - app
+    restart: unless-stopped
+
+  frontend:
+    build:
+      context: ./frontend
+      dockerfile: ../infra/docker/vite.dev
+    container_name: ${APP_NAME:-canary-token-generator}-frontend-dev
+    ports:
+      - "${FRONTEND_HOST_PORT:-15723}:5173"
+    volumes:
+      - ./frontend:/app
+      - frontend_modules:/app/node_modules
+    environment:
+      - VITE_API_URL=${VITE_API_URL:-/api}
+      - VITE_API_TARGET=${VITE_API_TARGET:-http://canary:8080}
+      - VITE_APP_TITLE=${VITE_APP_TITLE:-Canary Token Generator}
+      - VITE_TURNSTILE_SITE_KEY=${VITE_TURNSTILE_SITE_KEY:-}
+    networks:
+      - app
+    restart: unless-stopped
+
+  canary:
+    build:
+      context: ./backend
+      dockerfile: ../infra/docker/canary.dev
+    container_name: ${APP_NAME:-canary-token-generator}-canary-dev
+    volumes:
+      - ./backend:/app
+      - canary_gocache:/root/.cache/go-build
+      - canary_gomodcache:/go/pkg/mod
+    environment:
+      - APP_ENVIRONMENT=development
+      - DATABASE_URL=postgres://canary:canary@postgres:5432/canary?sslmode=disable
+      - REDIS_URL=redis://redis:6379/0
+      - PUBLIC_BASE_URL=${PUBLIC_BASE_URL:-http://localhost:58495}
+      - TURNSTILE_SECRET=${TURNSTILE_SECRET:-}
+      - OPERATOR_TOKEN=${OPERATOR_TOKEN:-dev-operator-token}
+      - GEOLITE_PATH=${GEOLITE_PATH:-/app/testdata/GeoLite2-City.mmdb}
+      - WEBHOOK_HMAC_SECRET=${WEBHOOK_HMAC_SECRET:-}
+      - MYSQL_FAKE_ENABLED=${MYSQL_FAKE_ENABLED:-false}
+      - LOG_LEVEL=debug
+      - LOG_FORMAT=text
+      - OTEL_ENABLED=${OTEL_ENABLED:-true}
+      - OTEL_EXPORTER_OTLP_ENDPOINT=http://jaeger:4317
+      - OTEL_INSECURE=true
+    networks:
+      - app
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:8080/healthz"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    restart: unless-stopped
+
+  postgres:
+    image: postgres:18-alpine
+    container_name: ${APP_NAME:-canary-token-generator}-postgres-dev
+    ports:
+      - "${POSTGRES_DEV_PORT:-5447}:5432"
+    environment:
+      POSTGRES_USER: canary
+      POSTGRES_PASSWORD: canary
+      POSTGRES_DB: canary
+    volumes:
+      - pgdata_dev:/var/lib/postgresql/data
+    networks:
+      - app
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U canary -d canary"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+
+  redis:
+    image: redis:7-alpine
+    container_name: ${APP_NAME:-canary-token-generator}-redis-dev
+    ports:
+      - "${REDIS_DEV_PORT:-6022}:6379"
+    command: redis-server --appendonly yes
+    volumes:
+      - redisdata_dev:/data
+    networks:
+      - app
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+
+  jaeger:
+    image: jaegertracing/all-in-one:1.54
+    container_name: ${APP_NAME:-canary-token-generator}-jaeger-dev
+    ports:
+      - "${JAEGER_UI_PORT:-16686}:16686"
+      - "${JAEGER_OTLP_GRPC_PORT:-4317}:4317"
+      - "${JAEGER_OTLP_HTTP_PORT:-4318}:4318"
+    environment:
+      COLLECTOR_OTLP_ENABLED: "true"
+    networks:
+      - app
+    restart: unless-stopped
+
+networks:
+  app:
+    driver: bridge
+
+volumes:
+  frontend_modules:
+  pgdata_dev:
+  redisdata_dev:
+  canary_gocache:
+  canary_gomodcache:
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/.dockerignore b/PROJECTS/beginner/canary-token-generator/frontend/.dockerignore
new file mode 100644
index 00000000..a0256ec7
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/.dockerignore
@@ -0,0 +1,15 @@
+node_modules
+build
+dist
+.git
+.gitignore
+*.md
+.env*
+.vscode
+.idea
+*.log
+npm-debug.log*
+pnpm-debug.log*
+.DS_Store
+coverage
+.nyc_output
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/.gitignore b/PROJECTS/beginner/canary-token-generator/frontend/.gitignore
new file mode 100644
index 00000000..61cb0c2e
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/.gitignore
@@ -0,0 +1,25 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+node_modules
+dist
+dist-ssr
+*.local
+.vite
+
+# Editor directories and files
+.vscode/*
+!.vscode/extensions.json
+.idea
+.DS_Store
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/.npmrc b/PROJECTS/beginner/canary-token-generator/frontend/.npmrc
new file mode 100644
index 00000000..1f80f77c
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/.npmrc
@@ -0,0 +1,3 @@
+# ©AngelaMos | 2026
+# .npmrc
+strict-dep-builds=false
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/.stylelintignore b/PROJECTS/beginner/canary-token-generator/frontend/.stylelintignore
new file mode 100644
index 00000000..1ae0ac7c
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/.stylelintignore
@@ -0,0 +1,22 @@
+# ©AngelaMos | 2026
+# .stylelintignore
+
+# Dependencies
+node_modules/
+
+# Production builds
+dist/
+build/
+out/
+
+# JS/TS files
+**/*.js
+**/*.jsx
+**/*.ts
+**/*.tsx
+
+# Generated files
+*.min.css
+
+# Error system styles - ignore from linting
+src/core/app/_toastStyles.scss
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/biome.json b/PROJECTS/beginner/canary-token-generator/frontend/biome.json
new file mode 100644
index 00000000..7f29029a
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/biome.json
@@ -0,0 +1,94 @@
+{
+  "$schema": "https://biomejs.dev/schemas/2.3.8/schema.json",
+  "vcs": {
+    "enabled": true,
+    "clientKind": "git",
+    "useIgnoreFile": true
+  },
+  "files": {
+    "includes": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx", "**/*.json"]
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 82,
+    "lineEnding": "lf"
+  },
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "single",
+      "jsxQuoteStyle": "double",
+      "semicolons": "asNeeded",
+      "trailingCommas": "es5",
+      "arrowParentheses": "always"
+    }
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": true,
+      "complexity": {
+        "noExcessiveCognitiveComplexity": {
+          "level": "error",
+          "options": { "maxAllowedComplexity": 25 }
+        },
+        "noForEach": "off",
+        "useLiteralKeys": "off"
+      },
+      "correctness": {
+        "noUnusedVariables": "error",
+        "noUnusedImports": "error",
+        "useExhaustiveDependencies": "warn",
+        "useHookAtTopLevel": "error",
+        "noUndeclaredVariables": "error"
+      },
+      "style": {
+        "useImportType": "error",
+        "useConst": "error",
+        "useTemplate": "error",
+        "useSelfClosingElements": "error",
+        "useFragmentSyntax": "error",
+        "noNonNullAssertion": "error",
+        "useConsistentArrayType": {
+          "level": "error",
+          "options": { "syntax": "shorthand" }
+        },
+        "useNamingConvention": "off"
+      },
+      "suspicious": {
+        "noExplicitAny": "error",
+        "noDebugger": "error",
+        "noConsole": "warn",
+        "noArrayIndexKey": "warn",
+        "noAssignInExpressions": "error",
+        "noDoubleEquals": "error",
+        "noRedeclare": "error",
+        "noVar": "error"
+      },
+      "security": {
+        "noDangerouslySetInnerHtml": "error"
+      },
+      "a11y": {
+        "useAltText": "error",
+        "useAnchorContent": "error",
+        "useKeyWithClickEvents": "error",
+        "noStaticElementInteractions": "error",
+        "useButtonType": "error",
+        "useValidAnchor": "error"
+      }
+    }
+  },
+  "overrides": [
+    {
+      "includes": ["src/main.tsx"],
+      "linter": {
+        "rules": {
+          "style": {
+            "noNonNullAssertion": "off"
+          }
+        }
+      }
+    }
+  ]
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/index.html b/PROJECTS/beginner/canary-token-generator/frontend/index.html
new file mode 100644
index 00000000..db375a7c
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/index.html
@@ -0,0 +1,57 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <!--
+  Canary Token Generator
+  Author(s): © AngelaMos, CarterPerez-dev
+-->
+    <meta charset="UTF-8" />
+    <link
+      rel="icon"
+      type="image/x-icon"
+      href="/assets/favicon.ico"
+    />
+    <link
+      rel="apple-touch-icon"
+      type="image/png"
+      href="/assets/apple-touch-icon.png"
+    />
+    <link
+      rel="manifest"
+      href="/assets/site.webmanifest"
+    />
+    <meta
+      name="viewport"
+      content="width=device-width, initial-scale=1.0, maximum-scale=1"
+    />
+    <title>Canary Token Generator</title>
+    <meta
+      name="description"
+      content="*Cracked*"
+    />
+    <meta
+      name="author"
+      content=" ©AngelaMos | 2026 | CarterPerez-dev"
+    />
+    <link
+      rel="preconnect"
+      href="https://fonts.googleapis.com"
+    />
+    <link
+      rel="preconnect"
+      href="https://fonts.gstatic.com"
+      crossorigin
+    />
+    <link
+      rel="stylesheet"
+      href="https://fonts.googleapis.com/css2?family=Archivo+Black&family=Departure+Mono&family=Space+Grotesk:wght@400;500;600;700&display=swap"
+    />
+  </head>
+  <body>
+    <div id="root"></div>
+    <script
+      type="module"
+      src="/src/main.tsx"
+    ></script>
+  </body>
+</html>
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/package.json b/PROJECTS/beginner/canary-token-generator/frontend/package.json
new file mode 100644
index 00000000..e2f010f8
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/package.json
@@ -0,0 +1,55 @@
+{
+  "name": "canary-token-generator",
+  "private": true,
+  "version": "1.0.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "tsc -b && vite build",
+    "preview": "vite preview",
+    "lint": "biome check .",
+    "lint:fix": "biome check --write .",
+    "format": "biome format --write .",
+    "typecheck": "tsc -b",
+    "lint:scss": "stylelint '**/*.scss'",
+    "lint:scss:fix": "stylelint '**/*.scss' --fix"
+  },
+  "dependencies": {
+    "@tanstack/react-query": "^5.90.12",
+    "axios": "^1.16.0",
+    "react": "^19.2.1",
+    "react-dom": "^19.2.0",
+    "react-error-boundary": "^6.0.0",
+    "react-icon": "^1.0.0",
+    "react-icons": "^5.5.0",
+    "react-router-dom": "^7.1.1",
+    "sonner": "^2.0.7",
+    "zod": "^4.1.13",
+    "zustand": "^5.0.9"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.3.8",
+    "@tanstack/react-query-devtools": "^5.91.1",
+    "@types/node": "^24.10.2",
+    "@types/react": "^19.2.7",
+    "@types/react-dom": "^19.2.3",
+    "@vitejs/plugin-react": "^5.1.1",
+    "sass": "^1.95.0",
+    "stylelint": "^16.26.1",
+    "stylelint-config-prettier-scss": "^1.0.0",
+    "stylelint-config-standard-scss": "^16.0.0",
+    "typescript": "~5.9.3",
+    "vite": "npm:rolldown-vite@7.2.5",
+    "vite-tsconfig-paths": "^5.1.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "vite": "npm:rolldown-vite@7.2.5"
+    },
+    "onlyBuiltDependencies": [
+      "@parcel/watcher",
+      "core-js",
+      "esbuild"
+    ]
+  }
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/pnpm-lock.yaml b/PROJECTS/beginner/canary-token-generator/frontend/pnpm-lock.yaml
new file mode 100644
index 00000000..94244c88
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/pnpm-lock.yaml
@@ -0,0 +1,2623 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+overrides:
+  vite: npm:rolldown-vite@7.2.5
+
+importers:
+
+  .:
+    dependencies:
+      '@tanstack/react-query':
+        specifier: ^5.90.12
+        version: 5.90.12(react@19.2.1)
+      axios:
+        specifier: ^1.16.0
+        version: 1.16.0
+      react:
+        specifier: ^19.2.1
+        version: 19.2.1
+      react-dom:
+        specifier: ^19.2.0
+        version: 19.2.1(react@19.2.1)
+      react-error-boundary:
+        specifier: ^6.0.0
+        version: 6.0.0(react@19.2.1)
+      react-icon:
+        specifier: ^1.0.0
+        version: 1.0.0(babel-runtime@5.8.38)(react@19.2.1)
+      react-icons:
+        specifier: ^5.5.0
+        version: 5.5.0(react@19.2.1)
+      react-router-dom:
+        specifier: ^7.1.1
+        version: 7.10.1(react-dom@19.2.1(react@19.2.1))(react@19.2.1)
+      sonner:
+        specifier: ^2.0.7
+        version: 2.0.7(react-dom@19.2.1(react@19.2.1))(react@19.2.1)
+      zod:
+        specifier: ^4.1.13
+        version: 4.1.13
+      zustand:
+        specifier: ^5.0.9
+        version: 5.0.9(@types/react@19.2.7)(react@19.2.1)
+    devDependencies:
+      '@biomejs/biome':
+        specifier: ^2.3.8
+        version: 2.3.8
+      '@tanstack/react-query-devtools':
+        specifier: ^5.91.1
+        version: 5.91.1(@tanstack/react-query@5.90.12(react@19.2.1))(react@19.2.1)
+      '@types/node':
+        specifier: ^24.10.2
+        version: 24.10.2
+      '@types/react':
+        specifier: ^19.2.7
+        version: 19.2.7
+      '@types/react-dom':
+        specifier: ^19.2.3
+        version: 19.2.3(@types/react@19.2.7)
+      '@vitejs/plugin-react':
+        specifier: ^5.1.1
+        version: 5.1.2(rolldown-vite@7.2.5(@types/node@24.10.2)(sass@1.95.0))
+      sass:
+        specifier: ^1.95.0
+        version: 1.95.0
+      stylelint:
+        specifier: ^16.26.1
+        version: 16.26.1(typescript@5.9.3)
+      stylelint-config-prettier-scss:
+        specifier: ^1.0.0
+        version: 1.0.0(stylelint@16.26.1(typescript@5.9.3))
+      stylelint-config-standard-scss:
+        specifier: ^16.0.0
+        version: 16.0.0(postcss@8.5.6)(stylelint@16.26.1(typescript@5.9.3))
+      typescript:
+        specifier: ~5.9.3
+        version: 5.9.3
+      vite:
+        specifier: npm:rolldown-vite@7.2.5
+        version: rolldown-vite@7.2.5(@types/node@24.10.2)(sass@1.95.0)
+      vite-tsconfig-paths:
+        specifier: ^5.1.0
+        version: 5.1.4(rolldown-vite@7.2.5(@types/node@24.10.2)(sass@1.95.0))(typescript@5.9.3)
+
+packages:
+
+  '@babel/code-frame@7.27.1':
+    resolution: {integrity: sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/compat-data@7.28.5':
+    resolution: {integrity: sha512-6uFXyCayocRbqhZOB+6XcuZbkMNimwfVGFji8CTZnCzOHVGvDqzvitu1re2AU5LROliz7eQPhB8CpAMvnx9EjA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/core@7.28.5':
+    resolution: {integrity: sha512-e7jT4DxYvIDLk1ZHmU/m/mB19rex9sv0c2ftBtjSBv+kVM/902eh0fINUzD7UwLLNR+jU585GxUJ8/EBfAM5fw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/generator@7.28.5':
+    resolution: {integrity: sha512-3EwLFhZ38J4VyIP6WNtt2kUdW9dokXA9Cr4IVIFHuCpZ3H8/YFOl5JjZHisrn1fATPBmKKqXzDFvh9fUwHz6CQ==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-compilation-targets@7.27.2':
+    resolution: {integrity: sha512-2+1thGUUWWjLTYTHZWK1n8Yga0ijBz1XAhUXcKy81rd5g6yh7hGqMp45v7cadSbEHc9G3OTv45SyneRN3ps4DQ==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-globals@7.28.0':
+    resolution: {integrity: sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-imports@7.27.1':
+    resolution: {integrity: sha512-0gSFWUPNXNopqtIPQvlD5WgXYI5GY2kP2cCvoT8kczjbfcfuIljTbcWrulD1CIPIX2gt1wghbDy08yE1p+/r3w==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-transforms@7.28.3':
+    resolution: {integrity: sha512-gytXUbs8k2sXS9PnQptz5o0QnpLL51SwASIORY6XaBKF88nsOT0Zw9szLqlSGQDP/4TljBAD5y98p2U1fqkdsw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/helper-plugin-utils@7.27.1':
+    resolution: {integrity: sha512-1gn1Up5YXka3YYAHGKpbideQ5Yjf1tDa9qYcgysz+cNCXukyLl6DjPXhD3VRwSb8c0J9tA4b2+rHEZtc6R0tlw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-string-parser@7.27.1':
+    resolution: {integrity: sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-identifier@7.28.5':
+    resolution: {integrity: sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-option@7.27.1':
+    resolution: {integrity: sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helpers@7.28.4':
+    resolution: {integrity: sha512-HFN59MmQXGHVyYadKLVumYsA9dBFun/ldYxipEjzA4196jpLZd8UjEEBLkbEkvfYreDqJhZxYAWFPtrfhNpj4w==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/parser@7.28.5':
+    resolution: {integrity: sha512-KKBU1VGYR7ORr3At5HAtUQ+TV3SzRCXmA/8OdDZiLDBIZxVyzXuztPjfLd3BV1PRAQGCMWWSHYhL0F8d5uHBDQ==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  '@babel/plugin-transform-react-jsx-self@7.27.1':
+    resolution: {integrity: sha512-6UzkCs+ejGdZ5mFFC/OCUrv028ab2fp1znZmCZjAOBKiBK2jXD1O+BPSfX8X2qjJ75fZBMSnQn3Rq2mrBJK2mw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-react-jsx-source@7.27.1':
+    resolution: {integrity: sha512-zbwoTsBruTeKB9hSq73ha66iFeJHuaFkUbwvqElnygoNbj/jHRsSeokowZFN3CZ64IvEqcmmkVe89OPXc7ldAw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/runtime@7.28.4':
+    resolution: {integrity: sha512-Q/N6JNWvIvPnLDvjlE1OUBLPQHH6l3CltCEsHIujp45zQUSSh8K+gHnaEX45yAT1nyngnINhvWtzN+Nb9D8RAQ==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/template@7.27.2':
+    resolution: {integrity: sha512-LPDZ85aEJyYSd18/DkjNh4/y1ntkE5KwUHWTiqgRxruuZL2F1yuHligVHLvcHY2vMHXttKFpJn6LwfI7cw7ODw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/traverse@7.28.5':
+    resolution: {integrity: sha512-TCCj4t55U90khlYkVV/0TfkJkAkUg3jZFA3Neb7unZT8CPok7iiRfaX0F+WnqWqt7OxhOn0uBKXCw4lbL8W0aQ==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/types@7.28.5':
+    resolution: {integrity: sha512-qQ5m48eI/MFLQ5PxQj4PFaprjyCTLI37ElWMmNs0K8Lk3dVeOdNpB3ks8jc7yM5CDmVC73eMVk/trk3fgmrUpA==}
+    engines: {node: '>=6.9.0'}
+
+  '@biomejs/biome@2.3.8':
+    resolution: {integrity: sha512-Qjsgoe6FEBxWAUzwFGFrB+1+M8y/y5kwmg5CHac+GSVOdmOIqsAiXM5QMVGZJ1eCUCLlPZtq4aFAQ0eawEUuUA==}
+    engines: {node: '>=14.21.3'}
+    hasBin: true
+
+  '@biomejs/cli-darwin-arm64@2.3.8':
+    resolution: {integrity: sha512-HM4Zg9CGQ3txTPflxD19n8MFPrmUAjaC7PQdLkugeeC0cQ+PiVrd7i09gaBS/11QKsTDBJhVg85CEIK9f50Qww==}
+    engines: {node: '>=14.21.3'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@biomejs/cli-darwin-x64@2.3.8':
+    resolution: {integrity: sha512-lUDQ03D7y/qEao7RgdjWVGCu+BLYadhKTm40HkpJIi6kn8LSv5PAwRlew/DmwP4YZ9ke9XXoTIQDO1vAnbRZlA==}
+    engines: {node: '>=14.21.3'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@biomejs/cli-linux-arm64-musl@2.3.8':
+    resolution: {integrity: sha512-PShR4mM0sjksUMyxbyPNMxoKFPVF48fU8Qe8Sfx6w6F42verbwRLbz+QiKNiDPRJwUoMG1nPM50OBL3aOnTevA==}
+    engines: {node: '>=14.21.3'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@biomejs/cli-linux-arm64@2.3.8':
+    resolution: {integrity: sha512-Uo1OJnIkJgSgF+USx970fsM/drtPcQ39I+JO+Fjsaa9ZdCN1oysQmy6oAGbyESlouz+rzEckLTF6DS7cWse95g==}
+    engines: {node: '>=14.21.3'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@biomejs/cli-linux-x64-musl@2.3.8':
+    resolution: {integrity: sha512-YGLkqU91r1276uwSjiUD/xaVikdxgV1QpsicT0bIA1TaieM6E5ibMZeSyjQ/izBn4tKQthUSsVZacmoJfa3pDA==}
+    engines: {node: '>=14.21.3'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@biomejs/cli-linux-x64@2.3.8':
+    resolution: {integrity: sha512-QDPMD5bQz6qOVb3kiBui0zKZXASLo0NIQ9JVJio5RveBEFgDgsvJFUvZIbMbUZT3T00M/1wdzwWXk4GIh0KaAw==}
+    engines: {node: '>=14.21.3'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@biomejs/cli-win32-arm64@2.3.8':
+    resolution: {integrity: sha512-H4IoCHvL1fXKDrTALeTKMiE7GGWFAraDwBYFquE/L/5r1927Te0mYIGseXi4F+lrrwhSWbSGt5qPFswNoBaCxg==}
+    engines: {node: '>=14.21.3'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@biomejs/cli-win32-x64@2.3.8':
+    resolution: {integrity: sha512-RguzimPoZWtBapfKhKjcWXBVI91tiSprqdBYu7tWhgN8pKRZhw24rFeNZTNf6UiBfjCYCi9eFQs/JzJZIhuK4w==}
+    engines: {node: '>=14.21.3'}
+    cpu: [x64]
+    os: [win32]
+
+  '@cacheable/memory@2.0.6':
+    resolution: {integrity: sha512-7e8SScMocHxcAb8YhtkbMhGG+EKLRIficb1F5sjvhSYsWTZGxvg4KIDp8kgxnV2PUJ3ddPe6J9QESjKvBWRDkg==}
+
+  '@cacheable/utils@2.3.2':
+    resolution: {integrity: sha512-8kGE2P+HjfY8FglaOiW+y8qxcaQAfAhVML+i66XJR3YX5FtyDqn6Txctr3K2FrbxLKixRRYYBWMbuGciOhYNDg==}
+
+  '@csstools/css-parser-algorithms@3.0.5':
+    resolution: {integrity: sha512-DaDeUkXZKjdGhgYaHNJTV9pV7Y9B3b644jCLs9Upc3VeNGg6LWARAT6O+Q+/COo+2gg/bM5rhpMAtf70WqfBdQ==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      '@csstools/css-tokenizer': ^3.0.4
+
+  '@csstools/css-syntax-patches-for-csstree@1.0.20':
+    resolution: {integrity: sha512-8BHsjXfSciZxjmHQOuVdW2b8WLUPts9a+mfL13/PzEviufUEW2xnvQuOlKs9dRBHgRqJ53SF/DUoK9+MZk72oQ==}
+    engines: {node: '>=18'}
+
+  '@csstools/css-tokenizer@3.0.4':
+    resolution: {integrity: sha512-Vd/9EVDiu6PPJt9yAh6roZP6El1xHrdvIVGjyBsHR0RYwNHgL7FJPyIIW4fANJNG6FtyZfvlRPpFI4ZM/lubvw==}
+    engines: {node: '>=18'}
+
+  '@csstools/media-query-list-parser@4.0.3':
+    resolution: {integrity: sha512-HAYH7d3TLRHDOUQK4mZKf9k9Ph/m8Akstg66ywKR4SFAigjs3yBiUeZtFxywiTm5moZMAp/5W/ZuFnNXXYLuuQ==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      '@csstools/css-parser-algorithms': ^3.0.5
+      '@csstools/css-tokenizer': ^3.0.4
+
+  '@csstools/selector-specificity@5.0.0':
+    resolution: {integrity: sha512-PCqQV3c4CoVm3kdPhyeZ07VmBRdH2EpMFA/pd9OASpOEC3aXNGoqPDAZ80D0cLpMBxnmk0+yNhGsEx31hq7Gtw==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      postcss-selector-parser: ^7.0.0
+
+  '@dual-bundle/import-meta-resolve@4.2.1':
+    resolution: {integrity: sha512-id+7YRUgoUX6CgV0DtuhirQWodeeA7Lf4i2x71JS/vtA5pRb/hIGWlw+G6MeXvsM+MXrz0VAydTGElX1rAfgPg==}
+
+  '@emnapi/core@1.7.1':
+    resolution: {integrity: sha512-o1uhUASyo921r2XtHYOHy7gdkGLge8ghBEQHMWmyJFoXlpU58kIrhhN3w26lpQb6dspetweapMn2CSNwQ8I4wg==}
+
+  '@emnapi/runtime@1.7.1':
+    resolution: {integrity: sha512-PVtJr5CmLwYAU9PZDMITZoR5iAOShYREoR45EyyLrbntV50mdePTgUn4AmOw90Ifcj+x2kRjdzr1HP3RrNiHGA==}
+
+  '@emnapi/wasi-threads@1.1.0':
+    resolution: {integrity: sha512-WI0DdZ8xFSbgMjR1sFsKABJ/C5OnRrjT06JXbZKexJGrDuPTzZdDYfFlsgcCXCyf+suG5QU2e/y1Wo2V/OapLQ==}
+
+  '@jridgewell/gen-mapping@0.3.13':
+    resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
+
+  '@jridgewell/remapping@2.3.5':
+    resolution: {integrity: sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==}
+
+  '@jridgewell/resolve-uri@3.1.2':
+    resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==}
+    engines: {node: '>=6.0.0'}
+
+  '@jridgewell/sourcemap-codec@1.5.5':
+    resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
+
+  '@keyv/bigmap@1.3.0':
+    resolution: {integrity: sha512-KT01GjzV6AQD5+IYrcpoYLkCu1Jod3nau1Z7EsEuViO3TZGRacSbO9MfHmbJ1WaOXFtWLxPVj169cn2WNKPkIg==}
+    engines: {node: '>= 18'}
+    peerDependencies:
+      keyv: ^5.5.4
+
+  '@keyv/serialize@1.1.1':
+    resolution: {integrity: sha512-dXn3FZhPv0US+7dtJsIi2R+c7qWYiReoEh5zUntWCf4oSpMNib8FDhSoed6m3QyZdx5hK7iLFkYk3rNxwt8vTA==}
+
+  '@napi-rs/wasm-runtime@1.1.0':
+    resolution: {integrity: sha512-Fq6DJW+Bb5jaWE69/qOE0D1TUN9+6uWhCeZpdnSBk14pjLcCWR7Q8n49PTSPHazM37JqrsdpEthXy2xn6jWWiA==}
+
+  '@nodelib/fs.scandir@2.1.5':
+    resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.stat@2.0.5':
+    resolution: {integrity: sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.walk@1.2.8':
+    resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
+    engines: {node: '>= 8'}
+
+  '@oxc-project/runtime@0.97.0':
+    resolution: {integrity: sha512-yH0zw7z+jEws4dZ4IUKoix5Lh3yhqIJWF9Dc8PWvhpo7U7O+lJrv7ZZL4BeRO0la8LBQFwcCewtLBnVV7hPe/w==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+
+  '@oxc-project/types@0.97.0':
+    resolution: {integrity: sha512-lxmZK4xFrdvU0yZiDwgVQTCvh2gHWBJCBk5ALsrtsBWhs0uDIi+FTOnXRQeQfs304imdvTdaakT/lqwQ8hkOXQ==}
+
+  '@parcel/watcher-android-arm64@2.5.1':
+    resolution: {integrity: sha512-KF8+j9nNbUN8vzOFDpRMsaKBHZ/mcjEjMToVMJOhTozkDonQFFrRcfdLWn6yWKCmJKmdVxSgHiYvTCef4/qcBA==}
+    engines: {node: '>= 10.0.0'}
+    cpu: [arm64]
+    os: [android]
+
+  '@parcel/watcher-darwin-arm64@2.5.1':
+    resolution: {integrity: sha512-eAzPv5osDmZyBhou8PoF4i6RQXAfeKL9tjb3QzYuccXFMQU0ruIc/POh30ePnaOyD1UXdlKguHBmsTs53tVoPw==}
+    engines: {node: '>= 10.0.0'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@parcel/watcher-darwin-x64@2.5.1':
+    resolution: {integrity: sha512-1ZXDthrnNmwv10A0/3AJNZ9JGlzrF82i3gNQcWOzd7nJ8aj+ILyW1MTxVk35Db0u91oD5Nlk9MBiujMlwmeXZg==}
+    engines: {node: '>= 10.0.0'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@parcel/watcher-freebsd-x64@2.5.1':
+    resolution: {integrity: sha512-SI4eljM7Flp9yPuKi8W0ird8TI/JK6CSxju3NojVI6BjHsTyK7zxA9urjVjEKJ5MBYC+bLmMcbAWlZ+rFkLpJQ==}
+    engines: {node: '>= 10.0.0'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@parcel/watcher-linux-arm-glibc@2.5.1':
+    resolution: {integrity: sha512-RCdZlEyTs8geyBkkcnPWvtXLY44BCeZKmGYRtSgtwwnHR4dxfHRG3gR99XdMEdQ7KeiDdasJwwvNSF5jKtDwdA==}
+    engines: {node: '>= 10.0.0'}
+    cpu: [arm]
+    os: [linux]
+    libc: [glibc]
+
+  '@parcel/watcher-linux-arm-musl@2.5.1':
+    resolution: {integrity: sha512-6E+m/Mm1t1yhB8X412stiKFG3XykmgdIOqhjWj+VL8oHkKABfu/gjFj8DvLrYVHSBNC+/u5PeNrujiSQ1zwd1Q==}
+    engines: {node: '>= 10.0.0'}
+    cpu: [arm]
+    os: [linux]
+    libc: [musl]
+
+  '@parcel/watcher-linux-arm64-glibc@2.5.1':
+    resolution: {integrity: sha512-LrGp+f02yU3BN9A+DGuY3v3bmnFUggAITBGriZHUREfNEzZh/GO06FF5u2kx8x+GBEUYfyTGamol4j3m9ANe8w==}
+    engines: {node: '>= 10.0.0'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@parcel/watcher-linux-arm64-musl@2.5.1':
+    resolution: {integrity: sha512-cFOjABi92pMYRXS7AcQv9/M1YuKRw8SZniCDw0ssQb/noPkRzA+HBDkwmyOJYp5wXcsTrhxO0zq1U11cK9jsFg==}
+    engines: {node: '>= 10.0.0'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@parcel/watcher-linux-x64-glibc@2.5.1':
+    resolution: {integrity: sha512-GcESn8NZySmfwlTsIur+49yDqSny2IhPeZfXunQi48DMugKeZ7uy1FX83pO0X22sHntJ4Ub+9k34XQCX+oHt2A==}
+    engines: {node: '>= 10.0.0'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@parcel/watcher-linux-x64-musl@2.5.1':
+    resolution: {integrity: sha512-n0E2EQbatQ3bXhcH2D1XIAANAcTZkQICBPVaxMeaCVBtOpBZpWJuf7LwyWPSBDITb7In8mqQgJ7gH8CILCURXg==}
+    engines: {node: '>= 10.0.0'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@parcel/watcher-win32-arm64@2.5.1':
+    resolution: {integrity: sha512-RFzklRvmc3PkjKjry3hLF9wD7ppR4AKcWNzH7kXR7GUe0Igb3Nz8fyPwtZCSquGrhU5HhUNDr/mKBqj7tqA2Vw==}
+    engines: {node: '>= 10.0.0'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@parcel/watcher-win32-ia32@2.5.1':
+    resolution: {integrity: sha512-c2KkcVN+NJmuA7CGlaGD1qJh1cLfDnQsHjE89E60vUEMlqduHGCdCLJCID5geFVM0dOtA3ZiIO8BoEQmzQVfpQ==}
+    engines: {node: '>= 10.0.0'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@parcel/watcher-win32-x64@2.5.1':
+    resolution: {integrity: sha512-9lHBdJITeNR++EvSQVUcaZoWupyHfXe1jZvGZ06O/5MflPcuPLtEphScIBL+AiCWBO46tDSHzWyD0uDmmZqsgA==}
+    engines: {node: '>= 10.0.0'}
+    cpu: [x64]
+    os: [win32]
+
+  '@parcel/watcher@2.5.1':
+    resolution: {integrity: sha512-dfUnCxiN9H4ap84DvD2ubjw+3vUNpstxa0TneY/Paat8a3R4uQZDLSvWjmznAY/DoahqTHl9V46HF/Zs3F29pg==}
+    engines: {node: '>= 10.0.0'}
+
+  '@rolldown/binding-android-arm64@1.0.0-beta.50':
+    resolution: {integrity: sha512-XlEkrOIHLyGT3avOgzfTFSjG+f+dZMw+/qd+Y3HLN86wlndrB/gSimrJCk4gOhr1XtRtEKfszpadI3Md4Z4/Ag==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [android]
+
+  '@rolldown/binding-darwin-arm64@1.0.0-beta.50':
+    resolution: {integrity: sha512-+JRqKJhoFlt5r9q+DecAGPLZ5PxeLva+wCMtAuoFMWPoZzgcYrr599KQ+Ix0jwll4B4HGP43avu9My8KtSOR+w==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@rolldown/binding-darwin-x64@1.0.0-beta.50':
+    resolution: {integrity: sha512-fFXDjXnuX7/gQZQm/1FoivVtRcyAzdjSik7Eo+9iwPQ9EgtA5/nB2+jmbzaKtMGG3q+BnZbdKHCtOacmNrkIDA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [darwin]
+
+  '@rolldown/binding-freebsd-x64@1.0.0-beta.50':
+    resolution: {integrity: sha512-F1b6vARy49tjmT/hbloplzgJS7GIvwWZqt+tAHEstCh0JIh9sa8FAMVqEmYxDviqKBaAI8iVvUREm/Kh/PD26Q==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@rolldown/binding-linux-arm-gnueabihf@1.0.0-beta.50':
+    resolution: {integrity: sha512-U6cR76N8T8M6lHj7EZrQ3xunLPxSvYYxA8vJsBKZiFZkT8YV4kjgCO3KwMJL0NOjQCPGKyiXO07U+KmJzdPGRw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm]
+    os: [linux]
+
+  '@rolldown/binding-linux-arm64-gnu@1.0.0-beta.50':
+    resolution: {integrity: sha512-ONgyjofCrrE3bnh5GZb8EINSFyR/hmwTzZ7oVuyUB170lboza1VMCnb8jgE6MsyyRgHYmN8Lb59i3NKGrxrYjw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rolldown/binding-linux-arm64-musl@1.0.0-beta.50':
+    resolution: {integrity: sha512-L0zRdH2oDPkmB+wvuTl+dJbXCsx62SkqcEqdM+79LOcB+PxbAxxjzHU14BuZIQdXcAVDzfpMfaHWzZuwhhBTcw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@rolldown/binding-linux-x64-gnu@1.0.0-beta.50':
+    resolution: {integrity: sha512-gyoI8o/TGpQd3OzkJnh1M2kxy1Bisg8qJ5Gci0sXm9yLFzEXIFdtc4EAzepxGvrT2ri99ar5rdsmNG0zP0SbIg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rolldown/binding-linux-x64-musl@1.0.0-beta.50':
+    resolution: {integrity: sha512-zti8A7M+xFDpKlghpcCAzyOi+e5nfUl3QhU023ce5NCgUxRG5zGP2GR9LTydQ1rnIPwZUVBWd4o7NjZDaQxaXA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@rolldown/binding-openharmony-arm64@1.0.0-beta.50':
+    resolution: {integrity: sha512-eZUssog7qljrrRU9Mi0eqYEPm3Ch0UwB+qlWPMKSUXHNqhm3TvDZarJQdTevGEfu3EHAXJvBIe0YFYr0TPVaMA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@rolldown/binding-wasm32-wasi@1.0.0-beta.50':
+    resolution: {integrity: sha512-nmCN0nIdeUnmgeDXiQ+2HU6FT162o+rxnF7WMkBm4M5Ds8qTU7Dzv2Wrf22bo4ftnlrb2hKK6FSwAJSAe2FWLg==}
+    engines: {node: '>=14.0.0'}
+    cpu: [wasm32]
+
+  '@rolldown/binding-win32-arm64-msvc@1.0.0-beta.50':
+    resolution: {integrity: sha512-7kcNLi7Ua59JTTLvbe1dYb028QEPaJPJQHqkmSZ5q3tJueUeb6yjRtx8mw4uIqgWZcnQHAR3PrLN4XRJxvgIkA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [win32]
+
+  '@rolldown/binding-win32-ia32-msvc@1.0.0-beta.50':
+    resolution: {integrity: sha512-lL70VTNvSCdSZkDPPVMwWn/M2yQiYvSoXw9hTLgdIWdUfC3g72UaruezusR6ceRuwHCY1Ayu2LtKqXkBO5LIwg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [ia32]
+    os: [win32]
+
+  '@rolldown/binding-win32-x64-msvc@1.0.0-beta.50':
+    resolution: {integrity: sha512-4qU4x5DXWB4JPjyTne/wBNPqkbQU8J45bl21geERBKtEittleonioACBL1R0PsBu0Aq21SwMK5a9zdBkWSlQtQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [win32]
+
+  '@rolldown/pluginutils@1.0.0-beta.50':
+    resolution: {integrity: sha512-5e76wQiQVeL1ICOZVUg4LSOVYg9jyhGCin+icYozhsUzM+fHE7kddi1bdiE0jwVqTfkjba3jUFbEkoC9WkdvyA==}
+
+  '@rolldown/pluginutils@1.0.0-beta.53':
+    resolution: {integrity: sha512-vENRlFU4YbrwVqNDZ7fLvy+JR1CRkyr01jhSiDpE1u6py3OMzQfztQU2jxykW3ALNxO4kSlqIDeYyD0Y9RcQeQ==}
+
+  '@tanstack/query-core@5.90.12':
+    resolution: {integrity: sha512-T1/8t5DhV/SisWjDnaiU2drl6ySvsHj1bHBCWNXd+/T+Hh1cf6JodyEYMd5sgwm+b/mETT4EV3H+zCVczCU5hg==}
+
+  '@tanstack/query-devtools@5.91.1':
+    resolution: {integrity: sha512-l8bxjk6BMsCaVQH6NzQEE/bEgFy1hAs5qbgXl0xhzezlaQbPk6Mgz9BqEg2vTLPOHD8N4k+w/gdgCbEzecGyNg==}
+
+  '@tanstack/react-query-devtools@5.91.1':
+    resolution: {integrity: sha512-tRnJYwEbH0kAOuToy8Ew7bJw1lX3AjkkgSlf/vzb+NpnqmHPdWM+lA2DSdGQSLi1SU0PDRrrCI1vnZnci96CsQ==}
+    peerDependencies:
+      '@tanstack/react-query': ^5.90.10
+      react: ^18 || ^19
+
+  '@tanstack/react-query@5.90.12':
+    resolution: {integrity: sha512-graRZspg7EoEaw0a8faiUASCyJrqjKPdqJ9EwuDRUF9mEYJ1YPczI9H+/agJ0mOJkPCJDk0lsz5QTrLZ/jQ2rg==}
+    peerDependencies:
+      react: ^18 || ^19
+
+  '@tybys/wasm-util@0.10.1':
+    resolution: {integrity: sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg==}
+
+  '@types/babel__core@7.20.5':
+    resolution: {integrity: sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA==}
+
+  '@types/babel__generator@7.27.0':
+    resolution: {integrity: sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY19zk6EwWqUQ8lg==}
+
+  '@types/babel__template@7.4.4':
+    resolution: {integrity: sha512-h/NUaSyG5EyxBIp8YRxo4RMe2/qQgvyowRwVMzhYhBCONbW8PUsg4lkFMrhgZhUe5z3L3MiLDuvyJ/CaPa2A8A==}
+
+  '@types/babel__traverse@7.28.0':
+    resolution: {integrity: sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==}
+
+  '@types/node@24.10.2':
+    resolution: {integrity: sha512-WOhQTZ4G8xZ1tjJTvKOpyEVSGgOTvJAfDK3FNFgELyaTpzhdgHVHeqW8V+UJvzF5BT+/B54T/1S2K6gd9c7bbA==}
+
+  '@types/react-dom@19.2.3':
+    resolution: {integrity: sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==}
+    peerDependencies:
+      '@types/react': ^19.2.0
+
+  '@types/react@19.2.7':
+    resolution: {integrity: sha512-MWtvHrGZLFttgeEj28VXHxpmwYbor/ATPYbBfSFZEIRK0ecCFLl2Qo55z52Hss+UV9CRN7trSeq1zbgx7YDWWg==}
+
+  '@vitejs/plugin-react@5.1.2':
+    resolution: {integrity: sha512-EcA07pHJouywpzsoTUqNh5NwGayl2PPVEJKUSinGGSxFGYn+shYbqMGBg6FXDqgXum9Ou/ecb+411ssw8HImJQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    peerDependencies:
+      vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
+
+  ajv@8.17.1:
+    resolution: {integrity: sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g==}
+
+  ansi-regex@5.0.1:
+    resolution: {integrity: sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==}
+    engines: {node: '>=8'}
+
+  ansi-styles@4.3.0:
+    resolution: {integrity: sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==}
+    engines: {node: '>=8'}
+
+  argparse@2.0.1:
+    resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
+
+  array-union@2.1.0:
+    resolution: {integrity: sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==}
+    engines: {node: '>=8'}
+
+  astral-regex@2.0.0:
+    resolution: {integrity: sha512-Z7tMw1ytTXt5jqMcOP+OQteU1VuNK9Y02uuJtKQ1Sv69jXQKKg5cibLwGJow8yzZP+eAc18EmLGPal0bp36rvQ==}
+    engines: {node: '>=8'}
+
+  asynckit@0.4.0:
+    resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
+
+  axios@1.16.0:
+    resolution: {integrity: sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==}
+
+  babel-runtime@5.8.38:
+    resolution: {integrity: sha512-KpgoA8VE/pMmNCrnEeeXqFG24TIH11Z3ZaimIhJWsin8EbfZy3WzFKUTIan10ZIDgRVvi9EkLbruJElJC9dRlg==}
+
+  balanced-match@2.0.0:
+    resolution: {integrity: sha512-1ugUSr8BHXRnK23KfuYS+gVMC3LB8QGH9W1iGtDPsNWoQbgtXSExkBu2aDR4epiGWZOjZsj6lDl/N/AqqTC3UA==}
+
+  baseline-browser-mapping@2.9.5:
+    resolution: {integrity: sha512-D5vIoztZOq1XM54LUdttJVc96ggEsIfju2JBvht06pSzpckp3C7HReun67Bghzrtdsq9XdMGbSSB3v3GhMNmAA==}
+    hasBin: true
+
+  braces@3.0.3:
+    resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
+    engines: {node: '>=8'}
+
+  browserslist@4.28.1:
+    resolution: {integrity: sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==}
+    engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
+    hasBin: true
+
+  cacheable@2.3.0:
+    resolution: {integrity: sha512-HHiAvOBmlcR2f3SQ7kdlYD8+AUJG+wlFZ/Ze8tl1Vzvz0MdOh8IYA/EFU4ve8t1/sZ0j4MGi7ST5MoTwHessQA==}
+
+  call-bind-apply-helpers@1.0.2:
+    resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
+    engines: {node: '>= 0.4'}
+
+  callsites@3.1.0:
+    resolution: {integrity: sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==}
+    engines: {node: '>=6'}
+
+  caniuse-lite@1.0.30001759:
+    resolution: {integrity: sha512-Pzfx9fOKoKvevQf8oCXoyNRQ5QyxJj+3O0Rqx2V5oxT61KGx8+n6hV/IUyJeifUci2clnmmKVpvtiqRzgiWjSw==}
+
+  chokidar@4.0.3:
+    resolution: {integrity: sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==}
+    engines: {node: '>= 14.16.0'}
+
+  color-convert@2.0.1:
+    resolution: {integrity: sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==}
+    engines: {node: '>=7.0.0'}
+
+  color-name@1.1.4:
+    resolution: {integrity: sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==}
+
+  colord@2.9.3:
+    resolution: {integrity: sha512-jeC1axXpnb0/2nn/Y1LPuLdgXBLH7aDcHu4KEKfqw3CUhX7ZpfBSlPKyqXE6btIgEzfWtrX3/tyBCaCvXvMkOw==}
+
+  combined-stream@1.0.8:
+    resolution: {integrity: sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==}
+    engines: {node: '>= 0.8'}
+
+  convert-source-map@2.0.0:
+    resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
+
+  cookie@1.1.1:
+    resolution: {integrity: sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==}
+    engines: {node: '>=18'}
+
+  core-js@1.2.7:
+    resolution: {integrity: sha512-ZiPp9pZlgxpWRu0M+YWbm6+aQ84XEfH1JRXvfOc/fILWI0VKhLC2LX13X1NYq4fULzLMq7Hfh43CSo2/aIaUPA==}
+    deprecated: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
+
+  cosmiconfig@9.0.0:
+    resolution: {integrity: sha512-itvL5h8RETACmOTFc4UfIyB2RfEHi71Ax6E/PivVxq9NseKbOWpeyHEOIbmAw1rs8Ak0VursQNww7lf7YtUwzg==}
+    engines: {node: '>=14'}
+    peerDependencies:
+      typescript: '>=4.9.5'
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
+  css-functions-list@3.2.3:
+    resolution: {integrity: sha512-IQOkD3hbR5KrN93MtcYuad6YPuTSUhntLHDuLEbFWE+ff2/XSZNdZG+LcbbIW5AXKg/WFIfYItIzVoHngHXZzA==}
+    engines: {node: '>=12 || >=16'}
+
+  css-tree@3.1.0:
+    resolution: {integrity: sha512-0eW44TGN5SQXU1mWSkKwFstI/22X2bG1nYzZTYMAWjylYURhse752YgbE4Cx46AC+bAvI+/dYTPRk1LqSUnu6w==}
+    engines: {node: ^10 || ^12.20.0 || ^14.13.0 || >=15.0.0}
+
+  cssesc@3.0.0:
+    resolution: {integrity: sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==}
+    engines: {node: '>=4'}
+    hasBin: true
+
+  csstype@3.2.3:
+    resolution: {integrity: sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==}
+
+  debug@4.4.3:
+    resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
+    engines: {node: '>=6.0'}
+    peerDependencies:
+      supports-color: '*'
+    peerDependenciesMeta:
+      supports-color:
+        optional: true
+
+  delayed-stream@1.0.0:
+    resolution: {integrity: sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==}
+    engines: {node: '>=0.4.0'}
+
+  detect-libc@1.0.3:
+    resolution: {integrity: sha512-pGjwhsmsp4kL2RTz08wcOlGN83otlqHeD/Z5T8GXZB+/YcpQ/dgo+lbU8ZsGxV0HIvqqxo9l7mqYwyYMD9bKDg==}
+    engines: {node: '>=0.10'}
+    hasBin: true
+
+  detect-libc@2.1.2:
+    resolution: {integrity: sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==}
+    engines: {node: '>=8'}
+
+  dir-glob@3.0.1:
+    resolution: {integrity: sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==}
+    engines: {node: '>=8'}
+
+  dunder-proto@1.0.1:
+    resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
+    engines: {node: '>= 0.4'}
+
+  electron-to-chromium@1.5.267:
+    resolution: {integrity: sha512-0Drusm6MVRXSOJpGbaSVgcQsuB4hEkMpHXaVstcPmhu5LIedxs1xNK/nIxmQIU/RPC0+1/o0AVZfBTkTNJOdUw==}
+
+  emoji-regex@8.0.0:
+    resolution: {integrity: sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==}
+
+  env-paths@2.2.1:
+    resolution: {integrity: sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==}
+    engines: {node: '>=6'}
+
+  error-ex@1.3.4:
+    resolution: {integrity: sha512-sqQamAnR14VgCr1A618A3sGrygcpK+HEbenA/HiEAkkUwcZIIB/tgWqHFxWgOyDh4nB4JCRimh79dR5Ywc9MDQ==}
+
+  es-define-property@1.0.1:
+    resolution: {integrity: sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==}
+    engines: {node: '>= 0.4'}
+
+  es-errors@1.3.0:
+    resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
+    engines: {node: '>= 0.4'}
+
+  es-object-atoms@1.1.2:
+    resolution: {integrity: sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==}
+    engines: {node: '>= 0.4'}
+
+  es-set-tostringtag@2.1.0:
+    resolution: {integrity: sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==}
+    engines: {node: '>= 0.4'}
+
+  escalade@3.2.0:
+    resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
+    engines: {node: '>=6'}
+
+  fast-deep-equal@3.1.3:
+    resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
+
+  fast-glob@3.3.3:
+    resolution: {integrity: sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==}
+    engines: {node: '>=8.6.0'}
+
+  fast-uri@3.1.2:
+    resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==}
+
+  fastest-levenshtein@1.0.16:
+    resolution: {integrity: sha512-eRnCtTTtGZFpQCwhJiUOuxPQWRXVKYDn0b2PeHfXL6/Zi53SLAzAHfVhVWK2AryC/WH05kGfxhFIPvTF0SXQzg==}
+    engines: {node: '>= 4.9.1'}
+
+  fastq@1.19.1:
+    resolution: {integrity: sha512-GwLTyxkCXjXbxqIhTsMI2Nui8huMPtnxg7krajPJAjnEG/iiOS7i+zCtWGZR9G0NBKbXKh6X9m9UIsYX/N6vvQ==}
+
+  fdir@6.5.0:
+    resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      picomatch: ^3 || ^4
+    peerDependenciesMeta:
+      picomatch:
+        optional: true
+
+  file-entry-cache@11.1.1:
+    resolution: {integrity: sha512-TPVFSDE7q91Dlk1xpFLvFllf8r0HyOMOlnWy7Z2HBku5H3KhIeOGInexrIeg2D64DosVB/JXkrrk6N/7Wriq4A==}
+
+  fill-range@7.1.1:
+    resolution: {integrity: sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==}
+    engines: {node: '>=8'}
+
+  flat-cache@6.1.19:
+    resolution: {integrity: sha512-l/K33newPTZMTGAnnzaiqSl6NnH7Namh8jBNjrgjprWxGmZUuxx/sJNIRaijOh3n7q7ESbhNZC+pvVZMFdeU4A==}
+
+  flatted@3.3.3:
+    resolution: {integrity: sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==}
+
+  follow-redirects@1.16.0:
+    resolution: {integrity: sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==}
+    engines: {node: '>=4.0'}
+    peerDependencies:
+      debug: '*'
+    peerDependenciesMeta:
+      debug:
+        optional: true
+
+  form-data@4.0.5:
+    resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==}
+    engines: {node: '>= 6'}
+
+  fsevents@2.3.3:
+    resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
+    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+    os: [darwin]
+
+  function-bind@1.1.2:
+    resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
+
+  gensync@1.0.0-beta.2:
+    resolution: {integrity: sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
+    engines: {node: '>=6.9.0'}
+
+  get-intrinsic@1.3.0:
+    resolution: {integrity: sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==}
+    engines: {node: '>= 0.4'}
+
+  get-proto@1.0.1:
+    resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
+    engines: {node: '>= 0.4'}
+
+  glob-parent@5.1.2:
+    resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
+    engines: {node: '>= 6'}
+
+  global-modules@2.0.0:
+    resolution: {integrity: sha512-NGbfmJBp9x8IxyJSd1P+otYK8vonoJactOogrVfFRIAEY1ukil8RSKDz2Yo7wh1oihl51l/r6W4epkeKJHqL8A==}
+    engines: {node: '>=6'}
+
+  global-prefix@3.0.0:
+    resolution: {integrity: sha512-awConJSVCHVGND6x3tmMaKcQvwXLhjdkmomy2W+Goaui8YPgYgXJZewhg3fWC+DlfqqQuWg8AwqjGTD2nAPVWg==}
+    engines: {node: '>=6'}
+
+  globby@11.1.0:
+    resolution: {integrity: sha512-jhIXaOzy1sb8IyocaruWSn1TjmnBVs8Ayhcy83rmxNJ8q2uWKCAj3CnJY+KpGSXCueAPc0i05kVvVKtP1t9S3g==}
+    engines: {node: '>=10'}
+
+  globjoin@0.1.4:
+    resolution: {integrity: sha512-xYfnw62CKG8nLkZBfWbhWwDw02CHty86jfPcc2cr3ZfeuK9ysoVPPEUxf21bAD/rWAgk52SuBrLJlefNy8mvFg==}
+
+  globrex@0.1.2:
+    resolution: {integrity: sha512-uHJgbwAMwNFf5mLst7IWLNg14x1CkeqglJb/K3doi4dw6q2IvAAmM/Y81kevy83wP+Sst+nutFTYOGg3d1lsxg==}
+
+  gopd@1.2.0:
+    resolution: {integrity: sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
+    engines: {node: '>= 0.4'}
+
+  has-flag@4.0.0:
+    resolution: {integrity: sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
+    engines: {node: '>=8'}
+
+  has-symbols@1.1.0:
+    resolution: {integrity: sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==}
+    engines: {node: '>= 0.4'}
+
+  has-tostringtag@1.0.2:
+    resolution: {integrity: sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==}
+    engines: {node: '>= 0.4'}
+
+  hashery@1.3.0:
+    resolution: {integrity: sha512-fWltioiy5zsSAs9ouEnvhsVJeAXRybGCNNv0lvzpzNOSDbULXRy7ivFWwCCv4I5Am6kSo75hmbsCduOoc2/K4w==}
+    engines: {node: '>=20'}
+
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
+    engines: {node: '>= 0.4'}
+
+  hookified@1.14.0:
+    resolution: {integrity: sha512-pi1ynXIMFx/uIIwpWJ/5CEtOHLGtnUB0WhGeeYT+fKcQ+WCQbm3/rrkAXnpfph++PgepNqPdTC2WTj8A6k6zoQ==}
+
+  html-tags@3.3.1:
+    resolution: {integrity: sha512-ztqyC3kLto0e9WbNp0aeP+M3kTt+nbaIveGmUxAtZa+8iFgKLUOD4YKM5j+f3QD89bra7UeumolZHKuOXnTmeQ==}
+    engines: {node: '>=8'}
+
+  ignore@5.3.2:
+    resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
+    engines: {node: '>= 4'}
+
+  ignore@7.0.5:
+    resolution: {integrity: sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==}
+    engines: {node: '>= 4'}
+
+  immutable@5.1.4:
+    resolution: {integrity: sha512-p6u1bG3YSnINT5RQmx/yRZBpenIl30kVxkTLDyHLIMk0gict704Q9n+thfDI7lTRm9vXdDYutVzXhzcThxTnXA==}
+
+  import-fresh@3.3.1:
+    resolution: {integrity: sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==}
+    engines: {node: '>=6'}
+
+  imurmurhash@0.1.4:
+    resolution: {integrity: sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==}
+    engines: {node: '>=0.8.19'}
+
+  ini@1.3.8:
+    resolution: {integrity: sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==}
+
+  is-arrayish@0.2.1:
+    resolution: {integrity: sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==}
+
+  is-extglob@2.1.1:
+    resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
+    engines: {node: '>=0.10.0'}
+
+  is-fullwidth-code-point@3.0.0:
+    resolution: {integrity: sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==}
+    engines: {node: '>=8'}
+
+  is-glob@4.0.3:
+    resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
+    engines: {node: '>=0.10.0'}
+
+  is-number@7.0.0:
+    resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
+    engines: {node: '>=0.12.0'}
+
+  is-plain-object@5.0.0:
+    resolution: {integrity: sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==}
+    engines: {node: '>=0.10.0'}
+
+  isexe@2.0.0:
+    resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}
+
+  js-tokens@4.0.0:
+    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
+
+  js-yaml@4.1.1:
+    resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
+    hasBin: true
+
+  jsesc@3.1.0:
+    resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  json-parse-even-better-errors@2.3.1:
+    resolution: {integrity: sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==}
+
+  json-schema-traverse@1.0.0:
+    resolution: {integrity: sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==}
+
+  json5@2.2.3:
+    resolution: {integrity: sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  keyv@5.5.5:
+    resolution: {integrity: sha512-FA5LmZVF1VziNc0bIdCSA1IoSVnDCqE8HJIZZv2/W8YmoAM50+tnUgJR/gQZwEeIMleuIOnRnHA/UaZRNeV4iQ==}
+
+  kind-of@6.0.3:
+    resolution: {integrity: sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==}
+    engines: {node: '>=0.10.0'}
+
+  known-css-properties@0.37.0:
+    resolution: {integrity: sha512-JCDrsP4Z1Sb9JwG0aJ8Eo2r7k4Ou5MwmThS/6lcIe1ICyb7UBJKGRIUUdqc2ASdE/42lgz6zFUnzAIhtXnBVrQ==}
+
+  lightningcss-android-arm64@1.30.2:
+    resolution: {integrity: sha512-BH9sEdOCahSgmkVhBLeU7Hc9DWeZ1Eb6wNS6Da8igvUwAe0sqROHddIlvU06q3WyXVEOYDZ6ykBZQnjTbmo4+A==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [android]
+
+  lightningcss-darwin-arm64@1.30.2:
+    resolution: {integrity: sha512-ylTcDJBN3Hp21TdhRT5zBOIi73P6/W0qwvlFEk22fkdXchtNTOU4Qc37SkzV+EKYxLouZ6M4LG9NfZ1qkhhBWA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [darwin]
+
+  lightningcss-darwin-x64@1.30.2:
+    resolution: {integrity: sha512-oBZgKchomuDYxr7ilwLcyms6BCyLn0z8J0+ZZmfpjwg9fRVZIR5/GMXd7r9RH94iDhld3UmSjBM6nXWM2TfZTQ==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [darwin]
+
+  lightningcss-freebsd-x64@1.30.2:
+    resolution: {integrity: sha512-c2bH6xTrf4BDpK8MoGG4Bd6zAMZDAXS569UxCAGcA7IKbHNMlhGQ89eRmvpIUGfKWNVdbhSbkQaWhEoMGmGslA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [freebsd]
+
+  lightningcss-linux-arm-gnueabihf@1.30.2:
+    resolution: {integrity: sha512-eVdpxh4wYcm0PofJIZVuYuLiqBIakQ9uFZmipf6LF/HRj5Bgm0eb3qL/mr1smyXIS1twwOxNWndd8z0E374hiA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm]
+    os: [linux]
+
+  lightningcss-linux-arm64-gnu@1.30.2:
+    resolution: {integrity: sha512-UK65WJAbwIJbiBFXpxrbTNArtfuznvxAJw4Q2ZGlU8kPeDIWEX1dg3rn2veBVUylA2Ezg89ktszWbaQnxD/e3A==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  lightningcss-linux-arm64-musl@1.30.2:
+    resolution: {integrity: sha512-5Vh9dGeblpTxWHpOx8iauV02popZDsCYMPIgiuw97OJ5uaDsL86cnqSFs5LZkG3ghHoX5isLgWzMs+eD1YzrnA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  lightningcss-linux-x64-gnu@1.30.2:
+    resolution: {integrity: sha512-Cfd46gdmj1vQ+lR6VRTTadNHu6ALuw2pKR9lYq4FnhvgBc4zWY1EtZcAc6EffShbb1MFrIPfLDXD6Xprbnni4w==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  lightningcss-linux-x64-musl@1.30.2:
+    resolution: {integrity: sha512-XJaLUUFXb6/QG2lGIW6aIk6jKdtjtcffUT0NKvIqhSBY3hh9Ch+1LCeH80dR9q9LBjG3ewbDjnumefsLsP6aiA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  lightningcss-win32-arm64-msvc@1.30.2:
+    resolution: {integrity: sha512-FZn+vaj7zLv//D/192WFFVA0RgHawIcHqLX9xuWiQt7P0PtdFEVaxgF9rjM/IRYHQXNnk61/H/gb2Ei+kUQ4xQ==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [win32]
+
+  lightningcss-win32-x64-msvc@1.30.2:
+    resolution: {integrity: sha512-5g1yc73p+iAkid5phb4oVFMB45417DkRevRbt/El/gKXJk4jid+vPFF/AXbxn05Aky8PapwzZrdJShv5C0avjw==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [win32]
+
+  lightningcss@1.30.2:
+    resolution: {integrity: sha512-utfs7Pr5uJyyvDETitgsaqSyjCb2qNRAtuqUeWIAKztsOYdcACf2KtARYXg2pSvhkt+9NfoaNY7fxjl6nuMjIQ==}
+    engines: {node: '>= 12.0.0'}
+
+  lines-and-columns@1.2.4:
+    resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==}
+
+  lodash.truncate@4.4.2:
+    resolution: {integrity: sha512-jttmRe7bRse52OsWIMDLaXxWqRAmtIUccAQ3garviCqJjafXOfNMO0yMfNpdD6zbGaTU0P5Nz7e7gAT6cKmJRw==}
+
+  lru-cache@5.1.1:
+    resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}
+
+  math-intrinsics@1.1.0:
+    resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==}
+    engines: {node: '>= 0.4'}
+
+  mathml-tag-names@2.1.3:
+    resolution: {integrity: sha512-APMBEanjybaPzUrfqU0IMU5I0AswKMH7k8OTLs0vvV4KZpExkTkY87nR/zpbuTPj+gARop7aGUbl11pnDfW6xg==}
+
+  mdn-data@2.12.2:
+    resolution: {integrity: sha512-IEn+pegP1aManZuckezWCO+XZQDplx1366JoVhTpMpBB1sPey/SbveZQUosKiKiGYjg1wH4pMlNgXbCiYgihQA==}
+
+  mdn-data@2.25.0:
+    resolution: {integrity: sha512-T2LPsjgUE/tgMmRXREVmwsux89DwWfNjiynOeXuLd2mX6jphGQ2YE3Ukz7LQ2VOFKiVZU/Ee1GqzHiipZCjymw==}
+
+  meow@13.2.0:
+    resolution: {integrity: sha512-pxQJQzB6djGPXh08dacEloMFopsOqGVRKFPYvPOt9XDZ1HasbgDZA74CJGreSU4G3Ak7EFJGoiH2auq+yXISgA==}
+    engines: {node: '>=18'}
+
+  merge2@1.4.1:
+    resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
+    engines: {node: '>= 8'}
+
+  micromatch@4.0.8:
+    resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
+    engines: {node: '>=8.6'}
+
+  mime-db@1.52.0:
+    resolution: {integrity: sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==}
+    engines: {node: '>= 0.6'}
+
+  mime-types@2.1.35:
+    resolution: {integrity: sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==}
+    engines: {node: '>= 0.6'}
+
+  ms@2.1.3:
+    resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
+
+  nanoid@3.3.11:
+    resolution: {integrity: sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==}
+    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
+    hasBin: true
+
+  node-addon-api@7.1.1:
+    resolution: {integrity: sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==}
+
+  node-releases@2.0.27:
+    resolution: {integrity: sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==}
+
+  normalize-path@3.0.0:
+    resolution: {integrity: sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==}
+    engines: {node: '>=0.10.0'}
+
+  parent-module@1.0.1:
+    resolution: {integrity: sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==}
+    engines: {node: '>=6'}
+
+  parse-json@5.2.0:
+    resolution: {integrity: sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==}
+    engines: {node: '>=8'}
+
+  path-type@4.0.0:
+    resolution: {integrity: sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==}
+    engines: {node: '>=8'}
+
+  picocolors@1.1.1:
+    resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
+
+  picomatch@2.3.1:
+    resolution: {integrity: sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==}
+    engines: {node: '>=8.6'}
+
+  picomatch@4.0.3:
+    resolution: {integrity: sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==}
+    engines: {node: '>=12'}
+
+  postcss-media-query-parser@0.2.3:
+    resolution: {integrity: sha512-3sOlxmbKcSHMjlUXQZKQ06jOswE7oVkXPxmZdoB1r5l0q6gTFTQSHxNxOrCccElbW7dxNytifNEo8qidX2Vsig==}
+
+  postcss-resolve-nested-selector@0.1.6:
+    resolution: {integrity: sha512-0sglIs9Wmkzbr8lQwEyIzlDOOC9bGmfVKcJTaxv3vMmd3uo4o4DerC3En0bnmgceeql9BfC8hRkp7cg0fjdVqw==}
+
+  postcss-safe-parser@7.0.1:
+    resolution: {integrity: sha512-0AioNCJZ2DPYz5ABT6bddIqlhgwhpHZ/l65YAYo0BCIn0xiDpsnTHz0gnoTGk0OXZW0JRs+cDwL8u/teRdz+8A==}
+    engines: {node: '>=18.0'}
+    peerDependencies:
+      postcss: ^8.4.31
+
+  postcss-scss@4.0.9:
+    resolution: {integrity: sha512-AjKOeiwAitL/MXxQW2DliT28EKukvvbEWx3LBmJIRN8KfBGZbRTxNYW0kSqi1COiTZ57nZ9NW06S6ux//N1c9A==}
+    engines: {node: '>=12.0'}
+    peerDependencies:
+      postcss: ^8.4.29
+
+  postcss-selector-parser@7.1.1:
+    resolution: {integrity: sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg==}
+    engines: {node: '>=4'}
+
+  postcss-value-parser@4.2.0:
+    resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==}
+
+  postcss@8.5.6:
+    resolution: {integrity: sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==}
+    engines: {node: ^10 || ^12 || >=14}
+
+  proxy-from-env@2.1.0:
+    resolution: {integrity: sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==}
+    engines: {node: '>=10'}
+
+  qified@0.5.3:
+    resolution: {integrity: sha512-kXuQdQTB6oN3KhI6V4acnBSZx8D2I4xzZvn9+wFLLFCoBNQY/sFnCW6c43OL7pOQ2HvGV4lnWIXNmgfp7cTWhQ==}
+    engines: {node: '>=20'}
+
+  queue-microtask@1.2.3:
+    resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
+
+  react-dom@19.2.1:
+    resolution: {integrity: sha512-ibrK8llX2a4eOskq1mXKu/TGZj9qzomO+sNfO98M6d9zIPOEhlBkMkBUBLd1vgS0gQsLDBzA+8jJBVXDnfHmJg==}
+    peerDependencies:
+      react: ^19.2.1
+
+  react-error-boundary@6.0.0:
+    resolution: {integrity: sha512-gdlJjD7NWr0IfkPlaREN2d9uUZUlksrfOx7SX62VRerwXbMY6ftGCIZua1VG1aXFNOimhISsTq+Owp725b9SiA==}
+    peerDependencies:
+      react: '>=16.13.1'
+
+  react-icon@1.0.0:
+    resolution: {integrity: sha512-VzSlpBHnLanVw79mOxyq98hWDi6DlxK9qPiZ1bAK6bLurMBCaxO/jjyYUrRx9+JGLc/NbnwOmyE/W5Qglbb2QA==}
+    peerDependencies:
+      babel-runtime: ^5.3.3
+      react: '>=0.12.0'
+
+  react-icons@5.5.0:
+    resolution: {integrity: sha512-MEFcXdkP3dLo8uumGI5xN3lDFNsRtrjbOEKDLD7yv76v4wpnEq2Lt2qeHaQOr34I/wPN3s3+N08WkQ+CW37Xiw==}
+    peerDependencies:
+      react: '*'
+
+  react-refresh@0.18.0:
+    resolution: {integrity: sha512-QgT5//D3jfjJb6Gsjxv0Slpj23ip+HtOpnNgnb2S5zU3CB26G/IDPGoy4RJB42wzFE46DRsstbW6tKHoKbhAxw==}
+    engines: {node: '>=0.10.0'}
+
+  react-router-dom@7.10.1:
+    resolution: {integrity: sha512-JNBANI6ChGVjA5bwsUIwJk7LHKmqB4JYnYfzFwyp2t12Izva11elds2jx7Yfoup2zssedntwU0oZ5DEmk5Sdaw==}
+    engines: {node: '>=20.0.0'}
+    peerDependencies:
+      react: '>=18'
+      react-dom: '>=18'
+
+  react-router@7.10.1:
+    resolution: {integrity: sha512-gHL89dRa3kwlUYtRQ+m8NmxGI6CgqN+k4XyGjwcFoQwwCWF6xXpOCUlDovkXClS0d0XJN/5q7kc5W3kiFEd0Yw==}
+    engines: {node: '>=20.0.0'}
+    peerDependencies:
+      react: '>=18'
+      react-dom: '>=18'
+    peerDependenciesMeta:
+      react-dom:
+        optional: true
+
+  react@19.2.1:
+    resolution: {integrity: sha512-DGrYcCWK7tvYMnWh79yrPHt+vdx9tY+1gPZa7nJQtO/p8bLTDaHp4dzwEhQB7pZ4Xe3ok4XKuEPrVuc+wlpkmw==}
+    engines: {node: '>=0.10.0'}
+
+  readdirp@4.1.2:
+    resolution: {integrity: sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==}
+    engines: {node: '>= 14.18.0'}
+
+  require-from-string@2.0.2:
+    resolution: {integrity: sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==}
+    engines: {node: '>=0.10.0'}
+
+  resolve-from@4.0.0:
+    resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
+    engines: {node: '>=4'}
+
+  resolve-from@5.0.0:
+    resolution: {integrity: sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==}
+    engines: {node: '>=8'}
+
+  reusify@1.1.0:
+    resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
+    engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
+
+  rolldown-vite@7.2.5:
+    resolution: {integrity: sha512-u09tdk/huMiN8xwoiBbig197jKdCamQTtOruSalOzbqGje3jdHiV0njQlAW0YvzoahkirFePNQ4RYlfnRQpXZA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    deprecated: Use 7.3.1 for migration purposes. For the most recent updates, migrate to Vite 8 once you're ready.
+    hasBin: true
+    peerDependencies:
+      '@types/node': ^20.19.0 || >=22.12.0
+      esbuild: ^0.25.0
+      jiti: '>=1.21.0'
+      less: ^4.0.0
+      sass: ^1.70.0
+      sass-embedded: ^1.70.0
+      stylus: '>=0.54.8'
+      sugarss: ^5.0.0
+      terser: ^5.16.0
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+      esbuild:
+        optional: true
+      jiti:
+        optional: true
+      less:
+        optional: true
+      sass:
+        optional: true
+      sass-embedded:
+        optional: true
+      stylus:
+        optional: true
+      sugarss:
+        optional: true
+      terser:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+  rolldown@1.0.0-beta.50:
+    resolution: {integrity: sha512-JFULvCNl/anKn99eKjOSEubi0lLmNqQDAjyEMME2T4CwezUDL0i6t1O9xZsu2OMehPnV2caNefWpGF+8TnzB6A==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    hasBin: true
+
+  run-parallel@1.2.0:
+    resolution: {integrity: sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==}
+
+  sass@1.95.0:
+    resolution: {integrity: sha512-9QMjhLq+UkOg/4bb8Lt8A+hJZvY3t+9xeZMKSBtBEgxrXA3ed5Ts4NDreUkYgJP1BTmrscQE/xYhf7iShow6lw==}
+    engines: {node: '>=14.0.0'}
+    hasBin: true
+
+  scheduler@0.27.0:
+    resolution: {integrity: sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==}
+
+  semver@6.3.1:
+    resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
+    hasBin: true
+
+  set-cookie-parser@2.7.2:
+    resolution: {integrity: sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==}
+
+  signal-exit@4.1.0:
+    resolution: {integrity: sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==}
+    engines: {node: '>=14'}
+
+  slash@3.0.0:
+    resolution: {integrity: sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==}
+    engines: {node: '>=8'}
+
+  slice-ansi@4.0.0:
+    resolution: {integrity: sha512-qMCMfhY040cVHT43K9BFygqYbUPFZKHOg7K73mtTWJRb8pyP3fzf4Ixd5SzdEJQ6MRUg/WBnOLxghZtKKurENQ==}
+    engines: {node: '>=10'}
+
+  sonner@2.0.7:
+    resolution: {integrity: sha512-W6ZN4p58k8aDKA4XPcx2hpIQXBRAgyiWVkYhT7CvK6D3iAu7xjvVyhQHg2/iaKJZ1XVJ4r7XuwGL+WGEK37i9w==}
+    peerDependencies:
+      react: ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+      react-dom: ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+
+  source-map-js@1.2.1:
+    resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+    engines: {node: '>=0.10.0'}
+
+  string-width@4.2.3:
+    resolution: {integrity: sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==}
+    engines: {node: '>=8'}
+
+  strip-ansi@6.0.1:
+    resolution: {integrity: sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==}
+    engines: {node: '>=8'}
+
+  stylelint-config-prettier-scss@1.0.0:
+    resolution: {integrity: sha512-Gr2qLiyvJGKeDk0E/+awNTrZB/UtNVPLqCDOr07na/sLekZwm26Br6yYIeBYz3ulsEcQgs5j+2IIMXCC+wsaQA==}
+    engines: {node: 14.* || 16.* || >= 18}
+    hasBin: true
+    peerDependencies:
+      stylelint: '>=15.0.0'
+
+  stylelint-config-recommended-scss@16.0.2:
+    resolution: {integrity: sha512-aUTHhPPWCvFyWaxtckJlCPaXTDFsp4pKO8evXNCsW9OwsaUWyMd6jvcUhSmfGWPrTddvzNqK4rS/UuSLcbVGdQ==}
+    engines: {node: '>=20'}
+    peerDependencies:
+      postcss: ^8.3.3
+      stylelint: ^16.24.0
+    peerDependenciesMeta:
+      postcss:
+        optional: true
+
+  stylelint-config-recommended@17.0.0:
+    resolution: {integrity: sha512-WaMSdEiPfZTSFVoYmJbxorJfA610O0tlYuU2aEwY33UQhSPgFbClrVJYWvy3jGJx+XW37O+LyNLiZOEXhKhJmA==}
+    engines: {node: '>=18.12.0'}
+    peerDependencies:
+      stylelint: ^16.23.0
+
+  stylelint-config-standard-scss@16.0.0:
+    resolution: {integrity: sha512-/FHECLUu+med/e6OaPFpprG86ShC4SYT7Tzb2PTVdDjJsehhFBOioSlWqYFqJxmGPIwO3AMBxNo+kY3dxrbczA==}
+    engines: {node: '>=20'}
+    peerDependencies:
+      postcss: ^8.3.3
+      stylelint: ^16.23.1
+    peerDependenciesMeta:
+      postcss:
+        optional: true
+
+  stylelint-config-standard@39.0.1:
+    resolution: {integrity: sha512-b7Fja59EYHRNOTa3aXiuWnhUWXFU2Nfg6h61bLfAb5GS5fX3LMUD0U5t4S8N/4tpHQg3Acs2UVPR9jy2l1g/3A==}
+    engines: {node: '>=18.12.0'}
+    peerDependencies:
+      stylelint: ^16.23.0
+
+  stylelint-scss@6.13.0:
+    resolution: {integrity: sha512-kZPwFUJkfup2gP1enlrS2h9U5+T5wFoqzJ1n/56AlpwSj28kmFe7ww/QFydvPsg5gLjWchAwWWBLtterynZrOw==}
+    engines: {node: '>=18.12.0'}
+    peerDependencies:
+      stylelint: ^16.8.2
+
+  stylelint@16.26.1:
+    resolution: {integrity: sha512-v20V59/crfc8sVTAtge0mdafI3AdnzQ2KsWe6v523L4OA1bJO02S7MO2oyXDCS6iWb9ckIPnqAFVItqSBQr7jw==}
+    engines: {node: '>=18.12.0'}
+    hasBin: true
+
+  supports-color@7.2.0:
+    resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
+    engines: {node: '>=8'}
+
+  supports-hyperlinks@3.2.0:
+    resolution: {integrity: sha512-zFObLMyZeEwzAoKCyu1B91U79K2t7ApXuQfo8OuxwXLDgcKxuwM+YvcbIhm6QWqz7mHUH1TVytR1PwVVjEuMig==}
+    engines: {node: '>=14.18'}
+
+  svg-tags@1.0.0:
+    resolution: {integrity: sha512-ovssysQTa+luh7A5Weu3Rta6FJlFBBbInjOh722LIt6klpU2/HtdUbszju/G4devcvk8PGt7FCLv5wftu3THUA==}
+
+  table@6.9.0:
+    resolution: {integrity: sha512-9kY+CygyYM6j02t5YFHbNz2FN5QmYGv9zAjVp4lCDjlCw7amdckXlEt/bjMhUIfj4ThGRE4gCUH5+yGnNuPo5A==}
+    engines: {node: '>=10.0.0'}
+
+  tinyglobby@0.2.15:
+    resolution: {integrity: sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==}
+    engines: {node: '>=12.0.0'}
+
+  to-regex-range@5.0.1:
+    resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
+    engines: {node: '>=8.0'}
+
+  tsconfck@3.1.6:
+    resolution: {integrity: sha512-ks6Vjr/jEw0P1gmOVwutM3B7fWxoWBL2KRDb1JfqGVawBmO5UsvmWOQFGHBPl5yxYz4eERr19E6L7NMv+Fej4w==}
+    engines: {node: ^18 || >=20}
+    hasBin: true
+    peerDependencies:
+      typescript: ^5.0.0
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
+  tslib@2.8.1:
+    resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
+
+  typescript@5.9.3:
+    resolution: {integrity: sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==}
+    engines: {node: '>=14.17'}
+    hasBin: true
+
+  undici-types@7.16.0:
+    resolution: {integrity: sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==}
+
+  update-browserslist-db@1.2.2:
+    resolution: {integrity: sha512-E85pfNzMQ9jpKkA7+TJAi4TJN+tBCuWh5rUcS/sv6cFi+1q9LYDwDI5dpUL0u/73EElyQ8d3TEaeW4sPedBqYA==}
+    hasBin: true
+    peerDependencies:
+      browserslist: '>= 4.21.0'
+
+  util-deprecate@1.0.2:
+    resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
+
+  vite-tsconfig-paths@5.1.4:
+    resolution: {integrity: sha512-cYj0LRuLV2c2sMqhqhGpaO3LretdtMn/BVX4cPLanIZuwwrkVl+lK84E/miEXkCHWXuq65rhNN4rXsBcOB3S4w==}
+    peerDependencies:
+      vite: '*'
+    peerDependenciesMeta:
+      vite:
+        optional: true
+
+  which@1.3.1:
+    resolution: {integrity: sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==}
+    hasBin: true
+
+  write-file-atomic@5.0.1:
+    resolution: {integrity: sha512-+QU2zd6OTD8XWIJCbffaiQeH9U73qIqafo1x6V1snCWYGJf6cVE0cDR4D8xRzcEnfI21IFrUPzPGtcPf8AC+Rw==}
+    engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0}
+
+  yallist@3.1.1:
+    resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}
+
+  zod@4.1.13:
+    resolution: {integrity: sha512-AvvthqfqrAhNH9dnfmrfKzX5upOdjUVJYFqNSlkmGf64gRaTzlPwz99IHYnVs28qYAybvAlBV+H7pn0saFY4Ig==}
+
+  zustand@5.0.9:
+    resolution: {integrity: sha512-ALBtUj0AfjJt3uNRQoL1tL2tMvj6Gp/6e39dnfT6uzpelGru8v1tPOGBzayOWbPJvujM8JojDk3E1LxeFisBNg==}
+    engines: {node: '>=12.20.0'}
+    peerDependencies:
+      '@types/react': '>=18.0.0'
+      immer: '>=9.0.6'
+      react: '>=18.0.0'
+      use-sync-external-store: '>=1.2.0'
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      immer:
+        optional: true
+      react:
+        optional: true
+      use-sync-external-store:
+        optional: true
+
+snapshots:
+
+  '@babel/code-frame@7.27.1':
+    dependencies:
+      '@babel/helper-validator-identifier': 7.28.5
+      js-tokens: 4.0.0
+      picocolors: 1.1.1
+
+  '@babel/compat-data@7.28.5': {}
+
+  '@babel/core@7.28.5':
+    dependencies:
+      '@babel/code-frame': 7.27.1
+      '@babel/generator': 7.28.5
+      '@babel/helper-compilation-targets': 7.27.2
+      '@babel/helper-module-transforms': 7.28.3(@babel/core@7.28.5)
+      '@babel/helpers': 7.28.4
+      '@babel/parser': 7.28.5
+      '@babel/template': 7.27.2
+      '@babel/traverse': 7.28.5
+      '@babel/types': 7.28.5
+      '@jridgewell/remapping': 2.3.5
+      convert-source-map: 2.0.0
+      debug: 4.4.3
+      gensync: 1.0.0-beta.2
+      json5: 2.2.3
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/generator@7.28.5':
+    dependencies:
+      '@babel/parser': 7.28.5
+      '@babel/types': 7.28.5
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+      jsesc: 3.1.0
+
+  '@babel/helper-compilation-targets@7.27.2':
+    dependencies:
+      '@babel/compat-data': 7.28.5
+      '@babel/helper-validator-option': 7.27.1
+      browserslist: 4.28.1
+      lru-cache: 5.1.1
+      semver: 6.3.1
+
+  '@babel/helper-globals@7.28.0': {}
+
+  '@babel/helper-module-imports@7.27.1':
+    dependencies:
+      '@babel/traverse': 7.28.5
+      '@babel/types': 7.28.5
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-module-transforms@7.28.3(@babel/core@7.28.5)':
+    dependencies:
+      '@babel/core': 7.28.5
+      '@babel/helper-module-imports': 7.27.1
+      '@babel/helper-validator-identifier': 7.28.5
+      '@babel/traverse': 7.28.5
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-plugin-utils@7.27.1': {}
+
+  '@babel/helper-string-parser@7.27.1': {}
+
+  '@babel/helper-validator-identifier@7.28.5': {}
+
+  '@babel/helper-validator-option@7.27.1': {}
+
+  '@babel/helpers@7.28.4':
+    dependencies:
+      '@babel/template': 7.27.2
+      '@babel/types': 7.28.5
+
+  '@babel/parser@7.28.5':
+    dependencies:
+      '@babel/types': 7.28.5
+
+  '@babel/plugin-transform-react-jsx-self@7.27.1(@babel/core@7.28.5)':
+    dependencies:
+      '@babel/core': 7.28.5
+      '@babel/helper-plugin-utils': 7.27.1
+
+  '@babel/plugin-transform-react-jsx-source@7.27.1(@babel/core@7.28.5)':
+    dependencies:
+      '@babel/core': 7.28.5
+      '@babel/helper-plugin-utils': 7.27.1
+
+  '@babel/runtime@7.28.4': {}
+
+  '@babel/template@7.27.2':
+    dependencies:
+      '@babel/code-frame': 7.27.1
+      '@babel/parser': 7.28.5
+      '@babel/types': 7.28.5
+
+  '@babel/traverse@7.28.5':
+    dependencies:
+      '@babel/code-frame': 7.27.1
+      '@babel/generator': 7.28.5
+      '@babel/helper-globals': 7.28.0
+      '@babel/parser': 7.28.5
+      '@babel/template': 7.27.2
+      '@babel/types': 7.28.5
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/types@7.28.5':
+    dependencies:
+      '@babel/helper-string-parser': 7.27.1
+      '@babel/helper-validator-identifier': 7.28.5
+
+  '@biomejs/biome@2.3.8':
+    optionalDependencies:
+      '@biomejs/cli-darwin-arm64': 2.3.8
+      '@biomejs/cli-darwin-x64': 2.3.8
+      '@biomejs/cli-linux-arm64': 2.3.8
+      '@biomejs/cli-linux-arm64-musl': 2.3.8
+      '@biomejs/cli-linux-x64': 2.3.8
+      '@biomejs/cli-linux-x64-musl': 2.3.8
+      '@biomejs/cli-win32-arm64': 2.3.8
+      '@biomejs/cli-win32-x64': 2.3.8
+
+  '@biomejs/cli-darwin-arm64@2.3.8':
+    optional: true
+
+  '@biomejs/cli-darwin-x64@2.3.8':
+    optional: true
+
+  '@biomejs/cli-linux-arm64-musl@2.3.8':
+    optional: true
+
+  '@biomejs/cli-linux-arm64@2.3.8':
+    optional: true
+
+  '@biomejs/cli-linux-x64-musl@2.3.8':
+    optional: true
+
+  '@biomejs/cli-linux-x64@2.3.8':
+    optional: true
+
+  '@biomejs/cli-win32-arm64@2.3.8':
+    optional: true
+
+  '@biomejs/cli-win32-x64@2.3.8':
+    optional: true
+
+  '@cacheable/memory@2.0.6':
+    dependencies:
+      '@cacheable/utils': 2.3.2
+      '@keyv/bigmap': 1.3.0(keyv@5.5.5)
+      hookified: 1.14.0
+      keyv: 5.5.5
+
+  '@cacheable/utils@2.3.2':
+    dependencies:
+      hashery: 1.3.0
+      keyv: 5.5.5
+
+  '@csstools/css-parser-algorithms@3.0.5(@csstools/css-tokenizer@3.0.4)':
+    dependencies:
+      '@csstools/css-tokenizer': 3.0.4
+
+  '@csstools/css-syntax-patches-for-csstree@1.0.20': {}
+
+  '@csstools/css-tokenizer@3.0.4': {}
+
+  '@csstools/media-query-list-parser@4.0.3(@csstools/css-parser-algorithms@3.0.5(@csstools/css-tokenizer@3.0.4))(@csstools/css-tokenizer@3.0.4)':
+    dependencies:
+      '@csstools/css-parser-algorithms': 3.0.5(@csstools/css-tokenizer@3.0.4)
+      '@csstools/css-tokenizer': 3.0.4
+
+  '@csstools/selector-specificity@5.0.0(postcss-selector-parser@7.1.1)':
+    dependencies:
+      postcss-selector-parser: 7.1.1
+
+  '@dual-bundle/import-meta-resolve@4.2.1': {}
+
+  '@emnapi/core@1.7.1':
+    dependencies:
+      '@emnapi/wasi-threads': 1.1.0
+      tslib: 2.8.1
+    optional: true
+
+  '@emnapi/runtime@1.7.1':
+    dependencies:
+      tslib: 2.8.1
+    optional: true
+
+  '@emnapi/wasi-threads@1.1.0':
+    dependencies:
+      tslib: 2.8.1
+    optional: true
+
+  '@jridgewell/gen-mapping@0.3.13':
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.5.5
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/remapping@2.3.5':
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/resolve-uri@3.1.2': {}
+
+  '@jridgewell/sourcemap-codec@1.5.5': {}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    dependencies:
+      '@jridgewell/resolve-uri': 3.1.2
+      '@jridgewell/sourcemap-codec': 1.5.5
+
+  '@keyv/bigmap@1.3.0(keyv@5.5.5)':
+    dependencies:
+      hashery: 1.3.0
+      hookified: 1.14.0
+      keyv: 5.5.5
+
+  '@keyv/serialize@1.1.1': {}
+
+  '@napi-rs/wasm-runtime@1.1.0':
+    dependencies:
+      '@emnapi/core': 1.7.1
+      '@emnapi/runtime': 1.7.1
+      '@tybys/wasm-util': 0.10.1
+    optional: true
+
+  '@nodelib/fs.scandir@2.1.5':
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      run-parallel: 1.2.0
+
+  '@nodelib/fs.stat@2.0.5': {}
+
+  '@nodelib/fs.walk@1.2.8':
+    dependencies:
+      '@nodelib/fs.scandir': 2.1.5
+      fastq: 1.19.1
+
+  '@oxc-project/runtime@0.97.0': {}
+
+  '@oxc-project/types@0.97.0': {}
+
+  '@parcel/watcher-android-arm64@2.5.1':
+    optional: true
+
+  '@parcel/watcher-darwin-arm64@2.5.1':
+    optional: true
+
+  '@parcel/watcher-darwin-x64@2.5.1':
+    optional: true
+
+  '@parcel/watcher-freebsd-x64@2.5.1':
+    optional: true
+
+  '@parcel/watcher-linux-arm-glibc@2.5.1':
+    optional: true
+
+  '@parcel/watcher-linux-arm-musl@2.5.1':
+    optional: true
+
+  '@parcel/watcher-linux-arm64-glibc@2.5.1':
+    optional: true
+
+  '@parcel/watcher-linux-arm64-musl@2.5.1':
+    optional: true
+
+  '@parcel/watcher-linux-x64-glibc@2.5.1':
+    optional: true
+
+  '@parcel/watcher-linux-x64-musl@2.5.1':
+    optional: true
+
+  '@parcel/watcher-win32-arm64@2.5.1':
+    optional: true
+
+  '@parcel/watcher-win32-ia32@2.5.1':
+    optional: true
+
+  '@parcel/watcher-win32-x64@2.5.1':
+    optional: true
+
+  '@parcel/watcher@2.5.1':
+    dependencies:
+      detect-libc: 1.0.3
+      is-glob: 4.0.3
+      micromatch: 4.0.8
+      node-addon-api: 7.1.1
+    optionalDependencies:
+      '@parcel/watcher-android-arm64': 2.5.1
+      '@parcel/watcher-darwin-arm64': 2.5.1
+      '@parcel/watcher-darwin-x64': 2.5.1
+      '@parcel/watcher-freebsd-x64': 2.5.1
+      '@parcel/watcher-linux-arm-glibc': 2.5.1
+      '@parcel/watcher-linux-arm-musl': 2.5.1
+      '@parcel/watcher-linux-arm64-glibc': 2.5.1
+      '@parcel/watcher-linux-arm64-musl': 2.5.1
+      '@parcel/watcher-linux-x64-glibc': 2.5.1
+      '@parcel/watcher-linux-x64-musl': 2.5.1
+      '@parcel/watcher-win32-arm64': 2.5.1
+      '@parcel/watcher-win32-ia32': 2.5.1
+      '@parcel/watcher-win32-x64': 2.5.1
+    optional: true
+
+  '@rolldown/binding-android-arm64@1.0.0-beta.50':
+    optional: true
+
+  '@rolldown/binding-darwin-arm64@1.0.0-beta.50':
+    optional: true
+
+  '@rolldown/binding-darwin-x64@1.0.0-beta.50':
+    optional: true
+
+  '@rolldown/binding-freebsd-x64@1.0.0-beta.50':
+    optional: true
+
+  '@rolldown/binding-linux-arm-gnueabihf@1.0.0-beta.50':
+    optional: true
+
+  '@rolldown/binding-linux-arm64-gnu@1.0.0-beta.50':
+    optional: true
+
+  '@rolldown/binding-linux-arm64-musl@1.0.0-beta.50':
+    optional: true
+
+  '@rolldown/binding-linux-x64-gnu@1.0.0-beta.50':
+    optional: true
+
+  '@rolldown/binding-linux-x64-musl@1.0.0-beta.50':
+    optional: true
+
+  '@rolldown/binding-openharmony-arm64@1.0.0-beta.50':
+    optional: true
+
+  '@rolldown/binding-wasm32-wasi@1.0.0-beta.50':
+    dependencies:
+      '@napi-rs/wasm-runtime': 1.1.0
+    optional: true
+
+  '@rolldown/binding-win32-arm64-msvc@1.0.0-beta.50':
+    optional: true
+
+  '@rolldown/binding-win32-ia32-msvc@1.0.0-beta.50':
+    optional: true
+
+  '@rolldown/binding-win32-x64-msvc@1.0.0-beta.50':
+    optional: true
+
+  '@rolldown/pluginutils@1.0.0-beta.50': {}
+
+  '@rolldown/pluginutils@1.0.0-beta.53': {}
+
+  '@tanstack/query-core@5.90.12': {}
+
+  '@tanstack/query-devtools@5.91.1': {}
+
+  '@tanstack/react-query-devtools@5.91.1(@tanstack/react-query@5.90.12(react@19.2.1))(react@19.2.1)':
+    dependencies:
+      '@tanstack/query-devtools': 5.91.1
+      '@tanstack/react-query': 5.90.12(react@19.2.1)
+      react: 19.2.1
+
+  '@tanstack/react-query@5.90.12(react@19.2.1)':
+    dependencies:
+      '@tanstack/query-core': 5.90.12
+      react: 19.2.1
+
+  '@tybys/wasm-util@0.10.1':
+    dependencies:
+      tslib: 2.8.1
+    optional: true
+
+  '@types/babel__core@7.20.5':
+    dependencies:
+      '@babel/parser': 7.28.5
+      '@babel/types': 7.28.5
+      '@types/babel__generator': 7.27.0
+      '@types/babel__template': 7.4.4
+      '@types/babel__traverse': 7.28.0
+
+  '@types/babel__generator@7.27.0':
+    dependencies:
+      '@babel/types': 7.28.5
+
+  '@types/babel__template@7.4.4':
+    dependencies:
+      '@babel/parser': 7.28.5
+      '@babel/types': 7.28.5
+
+  '@types/babel__traverse@7.28.0':
+    dependencies:
+      '@babel/types': 7.28.5
+
+  '@types/node@24.10.2':
+    dependencies:
+      undici-types: 7.16.0
+
+  '@types/react-dom@19.2.3(@types/react@19.2.7)':
+    dependencies:
+      '@types/react': 19.2.7
+
+  '@types/react@19.2.7':
+    dependencies:
+      csstype: 3.2.3
+
+  '@vitejs/plugin-react@5.1.2(rolldown-vite@7.2.5(@types/node@24.10.2)(sass@1.95.0))':
+    dependencies:
+      '@babel/core': 7.28.5
+      '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.28.5)
+      '@babel/plugin-transform-react-jsx-source': 7.27.1(@babel/core@7.28.5)
+      '@rolldown/pluginutils': 1.0.0-beta.53
+      '@types/babel__core': 7.20.5
+      react-refresh: 0.18.0
+      vite: rolldown-vite@7.2.5(@types/node@24.10.2)(sass@1.95.0)
+    transitivePeerDependencies:
+      - supports-color
+
+  ajv@8.17.1:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      fast-uri: 3.1.2
+      json-schema-traverse: 1.0.0
+      require-from-string: 2.0.2
+
+  ansi-regex@5.0.1: {}
+
+  ansi-styles@4.3.0:
+    dependencies:
+      color-convert: 2.0.1
+
+  argparse@2.0.1: {}
+
+  array-union@2.1.0: {}
+
+  astral-regex@2.0.0: {}
+
+  asynckit@0.4.0: {}
+
+  axios@1.16.0:
+    dependencies:
+      follow-redirects: 1.16.0
+      form-data: 4.0.5
+      proxy-from-env: 2.1.0
+    transitivePeerDependencies:
+      - debug
+
+  babel-runtime@5.8.38:
+    dependencies:
+      core-js: 1.2.7
+
+  balanced-match@2.0.0: {}
+
+  baseline-browser-mapping@2.9.5: {}
+
+  braces@3.0.3:
+    dependencies:
+      fill-range: 7.1.1
+
+  browserslist@4.28.1:
+    dependencies:
+      baseline-browser-mapping: 2.9.5
+      caniuse-lite: 1.0.30001759
+      electron-to-chromium: 1.5.267
+      node-releases: 2.0.27
+      update-browserslist-db: 1.2.2(browserslist@4.28.1)
+
+  cacheable@2.3.0:
+    dependencies:
+      '@cacheable/memory': 2.0.6
+      '@cacheable/utils': 2.3.2
+      hookified: 1.14.0
+      keyv: 5.5.5
+      qified: 0.5.3
+
+  call-bind-apply-helpers@1.0.2:
+    dependencies:
+      es-errors: 1.3.0
+      function-bind: 1.1.2
+
+  callsites@3.1.0: {}
+
+  caniuse-lite@1.0.30001759: {}
+
+  chokidar@4.0.3:
+    dependencies:
+      readdirp: 4.1.2
+
+  color-convert@2.0.1:
+    dependencies:
+      color-name: 1.1.4
+
+  color-name@1.1.4: {}
+
+  colord@2.9.3: {}
+
+  combined-stream@1.0.8:
+    dependencies:
+      delayed-stream: 1.0.0
+
+  convert-source-map@2.0.0: {}
+
+  cookie@1.1.1: {}
+
+  core-js@1.2.7: {}
+
+  cosmiconfig@9.0.0(typescript@5.9.3):
+    dependencies:
+      env-paths: 2.2.1
+      import-fresh: 3.3.1
+      js-yaml: 4.1.1
+      parse-json: 5.2.0
+    optionalDependencies:
+      typescript: 5.9.3
+
+  css-functions-list@3.2.3: {}
+
+  css-tree@3.1.0:
+    dependencies:
+      mdn-data: 2.12.2
+      source-map-js: 1.2.1
+
+  cssesc@3.0.0: {}
+
+  csstype@3.2.3: {}
+
+  debug@4.4.3:
+    dependencies:
+      ms: 2.1.3
+
+  delayed-stream@1.0.0: {}
+
+  detect-libc@1.0.3:
+    optional: true
+
+  detect-libc@2.1.2: {}
+
+  dir-glob@3.0.1:
+    dependencies:
+      path-type: 4.0.0
+
+  dunder-proto@1.0.1:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-errors: 1.3.0
+      gopd: 1.2.0
+
+  electron-to-chromium@1.5.267: {}
+
+  emoji-regex@8.0.0: {}
+
+  env-paths@2.2.1: {}
+
+  error-ex@1.3.4:
+    dependencies:
+      is-arrayish: 0.2.1
+
+  es-define-property@1.0.1: {}
+
+  es-errors@1.3.0: {}
+
+  es-object-atoms@1.1.2:
+    dependencies:
+      es-errors: 1.3.0
+
+  es-set-tostringtag@2.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      has-tostringtag: 1.0.2
+      hasown: 2.0.4
+
+  escalade@3.2.0: {}
+
+  fast-deep-equal@3.1.3: {}
+
+  fast-glob@3.3.3:
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      '@nodelib/fs.walk': 1.2.8
+      glob-parent: 5.1.2
+      merge2: 1.4.1
+      micromatch: 4.0.8
+
+  fast-uri@3.1.2: {}
+
+  fastest-levenshtein@1.0.16: {}
+
+  fastq@1.19.1:
+    dependencies:
+      reusify: 1.1.0
+
+  fdir@6.5.0(picomatch@4.0.3):
+    optionalDependencies:
+      picomatch: 4.0.3
+
+  file-entry-cache@11.1.1:
+    dependencies:
+      flat-cache: 6.1.19
+
+  fill-range@7.1.1:
+    dependencies:
+      to-regex-range: 5.0.1
+
+  flat-cache@6.1.19:
+    dependencies:
+      cacheable: 2.3.0
+      flatted: 3.3.3
+      hookified: 1.14.0
+
+  flatted@3.3.3: {}
+
+  follow-redirects@1.16.0: {}
+
+  form-data@4.0.5:
+    dependencies:
+      asynckit: 0.4.0
+      combined-stream: 1.0.8
+      es-set-tostringtag: 2.1.0
+      hasown: 2.0.4
+      mime-types: 2.1.35
+
+  fsevents@2.3.3:
+    optional: true
+
+  function-bind@1.1.2: {}
+
+  gensync@1.0.0-beta.2: {}
+
+  get-intrinsic@1.3.0:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      function-bind: 1.1.2
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      has-symbols: 1.1.0
+      hasown: 2.0.4
+      math-intrinsics: 1.1.0
+
+  get-proto@1.0.1:
+    dependencies:
+      dunder-proto: 1.0.1
+      es-object-atoms: 1.1.2
+
+  glob-parent@5.1.2:
+    dependencies:
+      is-glob: 4.0.3
+
+  global-modules@2.0.0:
+    dependencies:
+      global-prefix: 3.0.0
+
+  global-prefix@3.0.0:
+    dependencies:
+      ini: 1.3.8
+      kind-of: 6.0.3
+      which: 1.3.1
+
+  globby@11.1.0:
+    dependencies:
+      array-union: 2.1.0
+      dir-glob: 3.0.1
+      fast-glob: 3.3.3
+      ignore: 5.3.2
+      merge2: 1.4.1
+      slash: 3.0.0
+
+  globjoin@0.1.4: {}
+
+  globrex@0.1.2: {}
+
+  gopd@1.2.0: {}
+
+  has-flag@4.0.0: {}
+
+  has-symbols@1.1.0: {}
+
+  has-tostringtag@1.0.2:
+    dependencies:
+      has-symbols: 1.1.0
+
+  hashery@1.3.0:
+    dependencies:
+      hookified: 1.14.0
+
+  hasown@2.0.4:
+    dependencies:
+      function-bind: 1.1.2
+
+  hookified@1.14.0: {}
+
+  html-tags@3.3.1: {}
+
+  ignore@5.3.2: {}
+
+  ignore@7.0.5: {}
+
+  immutable@5.1.4: {}
+
+  import-fresh@3.3.1:
+    dependencies:
+      parent-module: 1.0.1
+      resolve-from: 4.0.0
+
+  imurmurhash@0.1.4: {}
+
+  ini@1.3.8: {}
+
+  is-arrayish@0.2.1: {}
+
+  is-extglob@2.1.1: {}
+
+  is-fullwidth-code-point@3.0.0: {}
+
+  is-glob@4.0.3:
+    dependencies:
+      is-extglob: 2.1.1
+
+  is-number@7.0.0: {}
+
+  is-plain-object@5.0.0: {}
+
+  isexe@2.0.0: {}
+
+  js-tokens@4.0.0: {}
+
+  js-yaml@4.1.1:
+    dependencies:
+      argparse: 2.0.1
+
+  jsesc@3.1.0: {}
+
+  json-parse-even-better-errors@2.3.1: {}
+
+  json-schema-traverse@1.0.0: {}
+
+  json5@2.2.3: {}
+
+  keyv@5.5.5:
+    dependencies:
+      '@keyv/serialize': 1.1.1
+
+  kind-of@6.0.3: {}
+
+  known-css-properties@0.37.0: {}
+
+  lightningcss-android-arm64@1.30.2:
+    optional: true
+
+  lightningcss-darwin-arm64@1.30.2:
+    optional: true
+
+  lightningcss-darwin-x64@1.30.2:
+    optional: true
+
+  lightningcss-freebsd-x64@1.30.2:
+    optional: true
+
+  lightningcss-linux-arm-gnueabihf@1.30.2:
+    optional: true
+
+  lightningcss-linux-arm64-gnu@1.30.2:
+    optional: true
+
+  lightningcss-linux-arm64-musl@1.30.2:
+    optional: true
+
+  lightningcss-linux-x64-gnu@1.30.2:
+    optional: true
+
+  lightningcss-linux-x64-musl@1.30.2:
+    optional: true
+
+  lightningcss-win32-arm64-msvc@1.30.2:
+    optional: true
+
+  lightningcss-win32-x64-msvc@1.30.2:
+    optional: true
+
+  lightningcss@1.30.2:
+    dependencies:
+      detect-libc: 2.1.2
+    optionalDependencies:
+      lightningcss-android-arm64: 1.30.2
+      lightningcss-darwin-arm64: 1.30.2
+      lightningcss-darwin-x64: 1.30.2
+      lightningcss-freebsd-x64: 1.30.2
+      lightningcss-linux-arm-gnueabihf: 1.30.2
+      lightningcss-linux-arm64-gnu: 1.30.2
+      lightningcss-linux-arm64-musl: 1.30.2
+      lightningcss-linux-x64-gnu: 1.30.2
+      lightningcss-linux-x64-musl: 1.30.2
+      lightningcss-win32-arm64-msvc: 1.30.2
+      lightningcss-win32-x64-msvc: 1.30.2
+
+  lines-and-columns@1.2.4: {}
+
+  lodash.truncate@4.4.2: {}
+
+  lru-cache@5.1.1:
+    dependencies:
+      yallist: 3.1.1
+
+  math-intrinsics@1.1.0: {}
+
+  mathml-tag-names@2.1.3: {}
+
+  mdn-data@2.12.2: {}
+
+  mdn-data@2.25.0: {}
+
+  meow@13.2.0: {}
+
+  merge2@1.4.1: {}
+
+  micromatch@4.0.8:
+    dependencies:
+      braces: 3.0.3
+      picomatch: 2.3.1
+
+  mime-db@1.52.0: {}
+
+  mime-types@2.1.35:
+    dependencies:
+      mime-db: 1.52.0
+
+  ms@2.1.3: {}
+
+  nanoid@3.3.11: {}
+
+  node-addon-api@7.1.1:
+    optional: true
+
+  node-releases@2.0.27: {}
+
+  normalize-path@3.0.0: {}
+
+  parent-module@1.0.1:
+    dependencies:
+      callsites: 3.1.0
+
+  parse-json@5.2.0:
+    dependencies:
+      '@babel/code-frame': 7.27.1
+      error-ex: 1.3.4
+      json-parse-even-better-errors: 2.3.1
+      lines-and-columns: 1.2.4
+
+  path-type@4.0.0: {}
+
+  picocolors@1.1.1: {}
+
+  picomatch@2.3.1: {}
+
+  picomatch@4.0.3: {}
+
+  postcss-media-query-parser@0.2.3: {}
+
+  postcss-resolve-nested-selector@0.1.6: {}
+
+  postcss-safe-parser@7.0.1(postcss@8.5.6):
+    dependencies:
+      postcss: 8.5.6
+
+  postcss-scss@4.0.9(postcss@8.5.6):
+    dependencies:
+      postcss: 8.5.6
+
+  postcss-selector-parser@7.1.1:
+    dependencies:
+      cssesc: 3.0.0
+      util-deprecate: 1.0.2
+
+  postcss-value-parser@4.2.0: {}
+
+  postcss@8.5.6:
+    dependencies:
+      nanoid: 3.3.11
+      picocolors: 1.1.1
+      source-map-js: 1.2.1
+
+  proxy-from-env@2.1.0: {}
+
+  qified@0.5.3:
+    dependencies:
+      hookified: 1.14.0
+
+  queue-microtask@1.2.3: {}
+
+  react-dom@19.2.1(react@19.2.1):
+    dependencies:
+      react: 19.2.1
+      scheduler: 0.27.0
+
+  react-error-boundary@6.0.0(react@19.2.1):
+    dependencies:
+      '@babel/runtime': 7.28.4
+      react: 19.2.1
+
+  react-icon@1.0.0(babel-runtime@5.8.38)(react@19.2.1):
+    dependencies:
+      babel-runtime: 5.8.38
+      react: 19.2.1
+
+  react-icons@5.5.0(react@19.2.1):
+    dependencies:
+      react: 19.2.1
+
+  react-refresh@0.18.0: {}
+
+  react-router-dom@7.10.1(react-dom@19.2.1(react@19.2.1))(react@19.2.1):
+    dependencies:
+      react: 19.2.1
+      react-dom: 19.2.1(react@19.2.1)
+      react-router: 7.10.1(react-dom@19.2.1(react@19.2.1))(react@19.2.1)
+
+  react-router@7.10.1(react-dom@19.2.1(react@19.2.1))(react@19.2.1):
+    dependencies:
+      cookie: 1.1.1
+      react: 19.2.1
+      set-cookie-parser: 2.7.2
+    optionalDependencies:
+      react-dom: 19.2.1(react@19.2.1)
+
+  react@19.2.1: {}
+
+  readdirp@4.1.2: {}
+
+  require-from-string@2.0.2: {}
+
+  resolve-from@4.0.0: {}
+
+  resolve-from@5.0.0: {}
+
+  reusify@1.1.0: {}
+
+  rolldown-vite@7.2.5(@types/node@24.10.2)(sass@1.95.0):
+    dependencies:
+      '@oxc-project/runtime': 0.97.0
+      fdir: 6.5.0(picomatch@4.0.3)
+      lightningcss: 1.30.2
+      picomatch: 4.0.3
+      postcss: 8.5.6
+      rolldown: 1.0.0-beta.50
+      tinyglobby: 0.2.15
+    optionalDependencies:
+      '@types/node': 24.10.2
+      fsevents: 2.3.3
+      sass: 1.95.0
+
+  rolldown@1.0.0-beta.50:
+    dependencies:
+      '@oxc-project/types': 0.97.0
+      '@rolldown/pluginutils': 1.0.0-beta.50
+    optionalDependencies:
+      '@rolldown/binding-android-arm64': 1.0.0-beta.50
+      '@rolldown/binding-darwin-arm64': 1.0.0-beta.50
+      '@rolldown/binding-darwin-x64': 1.0.0-beta.50
+      '@rolldown/binding-freebsd-x64': 1.0.0-beta.50
+      '@rolldown/binding-linux-arm-gnueabihf': 1.0.0-beta.50
+      '@rolldown/binding-linux-arm64-gnu': 1.0.0-beta.50
+      '@rolldown/binding-linux-arm64-musl': 1.0.0-beta.50
+      '@rolldown/binding-linux-x64-gnu': 1.0.0-beta.50
+      '@rolldown/binding-linux-x64-musl': 1.0.0-beta.50
+      '@rolldown/binding-openharmony-arm64': 1.0.0-beta.50
+      '@rolldown/binding-wasm32-wasi': 1.0.0-beta.50
+      '@rolldown/binding-win32-arm64-msvc': 1.0.0-beta.50
+      '@rolldown/binding-win32-ia32-msvc': 1.0.0-beta.50
+      '@rolldown/binding-win32-x64-msvc': 1.0.0-beta.50
+
+  run-parallel@1.2.0:
+    dependencies:
+      queue-microtask: 1.2.3
+
+  sass@1.95.0:
+    dependencies:
+      chokidar: 4.0.3
+      immutable: 5.1.4
+      source-map-js: 1.2.1
+    optionalDependencies:
+      '@parcel/watcher': 2.5.1
+
+  scheduler@0.27.0: {}
+
+  semver@6.3.1: {}
+
+  set-cookie-parser@2.7.2: {}
+
+  signal-exit@4.1.0: {}
+
+  slash@3.0.0: {}
+
+  slice-ansi@4.0.0:
+    dependencies:
+      ansi-styles: 4.3.0
+      astral-regex: 2.0.0
+      is-fullwidth-code-point: 3.0.0
+
+  sonner@2.0.7(react-dom@19.2.1(react@19.2.1))(react@19.2.1):
+    dependencies:
+      react: 19.2.1
+      react-dom: 19.2.1(react@19.2.1)
+
+  source-map-js@1.2.1: {}
+
+  string-width@4.2.3:
+    dependencies:
+      emoji-regex: 8.0.0
+      is-fullwidth-code-point: 3.0.0
+      strip-ansi: 6.0.1
+
+  strip-ansi@6.0.1:
+    dependencies:
+      ansi-regex: 5.0.1
+
+  stylelint-config-prettier-scss@1.0.0(stylelint@16.26.1(typescript@5.9.3)):
+    dependencies:
+      stylelint: 16.26.1(typescript@5.9.3)
+
+  stylelint-config-recommended-scss@16.0.2(postcss@8.5.6)(stylelint@16.26.1(typescript@5.9.3)):
+    dependencies:
+      postcss-scss: 4.0.9(postcss@8.5.6)
+      stylelint: 16.26.1(typescript@5.9.3)
+      stylelint-config-recommended: 17.0.0(stylelint@16.26.1(typescript@5.9.3))
+      stylelint-scss: 6.13.0(stylelint@16.26.1(typescript@5.9.3))
+    optionalDependencies:
+      postcss: 8.5.6
+
+  stylelint-config-recommended@17.0.0(stylelint@16.26.1(typescript@5.9.3)):
+    dependencies:
+      stylelint: 16.26.1(typescript@5.9.3)
+
+  stylelint-config-standard-scss@16.0.0(postcss@8.5.6)(stylelint@16.26.1(typescript@5.9.3)):
+    dependencies:
+      stylelint: 16.26.1(typescript@5.9.3)
+      stylelint-config-recommended-scss: 16.0.2(postcss@8.5.6)(stylelint@16.26.1(typescript@5.9.3))
+      stylelint-config-standard: 39.0.1(stylelint@16.26.1(typescript@5.9.3))
+    optionalDependencies:
+      postcss: 8.5.6
+
+  stylelint-config-standard@39.0.1(stylelint@16.26.1(typescript@5.9.3)):
+    dependencies:
+      stylelint: 16.26.1(typescript@5.9.3)
+      stylelint-config-recommended: 17.0.0(stylelint@16.26.1(typescript@5.9.3))
+
+  stylelint-scss@6.13.0(stylelint@16.26.1(typescript@5.9.3)):
+    dependencies:
+      css-tree: 3.1.0
+      is-plain-object: 5.0.0
+      known-css-properties: 0.37.0
+      mdn-data: 2.25.0
+      postcss-media-query-parser: 0.2.3
+      postcss-resolve-nested-selector: 0.1.6
+      postcss-selector-parser: 7.1.1
+      postcss-value-parser: 4.2.0
+      stylelint: 16.26.1(typescript@5.9.3)
+
+  stylelint@16.26.1(typescript@5.9.3):
+    dependencies:
+      '@csstools/css-parser-algorithms': 3.0.5(@csstools/css-tokenizer@3.0.4)
+      '@csstools/css-syntax-patches-for-csstree': 1.0.20
+      '@csstools/css-tokenizer': 3.0.4
+      '@csstools/media-query-list-parser': 4.0.3(@csstools/css-parser-algorithms@3.0.5(@csstools/css-tokenizer@3.0.4))(@csstools/css-tokenizer@3.0.4)
+      '@csstools/selector-specificity': 5.0.0(postcss-selector-parser@7.1.1)
+      '@dual-bundle/import-meta-resolve': 4.2.1
+      balanced-match: 2.0.0
+      colord: 2.9.3
+      cosmiconfig: 9.0.0(typescript@5.9.3)
+      css-functions-list: 3.2.3
+      css-tree: 3.1.0
+      debug: 4.4.3
+      fast-glob: 3.3.3
+      fastest-levenshtein: 1.0.16
+      file-entry-cache: 11.1.1
+      global-modules: 2.0.0
+      globby: 11.1.0
+      globjoin: 0.1.4
+      html-tags: 3.3.1
+      ignore: 7.0.5
+      imurmurhash: 0.1.4
+      is-plain-object: 5.0.0
+      known-css-properties: 0.37.0
+      mathml-tag-names: 2.1.3
+      meow: 13.2.0
+      micromatch: 4.0.8
+      normalize-path: 3.0.0
+      picocolors: 1.1.1
+      postcss: 8.5.6
+      postcss-resolve-nested-selector: 0.1.6
+      postcss-safe-parser: 7.0.1(postcss@8.5.6)
+      postcss-selector-parser: 7.1.1
+      postcss-value-parser: 4.2.0
+      resolve-from: 5.0.0
+      string-width: 4.2.3
+      supports-hyperlinks: 3.2.0
+      svg-tags: 1.0.0
+      table: 6.9.0
+      write-file-atomic: 5.0.1
+    transitivePeerDependencies:
+      - supports-color
+      - typescript
+
+  supports-color@7.2.0:
+    dependencies:
+      has-flag: 4.0.0
+
+  supports-hyperlinks@3.2.0:
+    dependencies:
+      has-flag: 4.0.0
+      supports-color: 7.2.0
+
+  svg-tags@1.0.0: {}
+
+  table@6.9.0:
+    dependencies:
+      ajv: 8.17.1
+      lodash.truncate: 4.4.2
+      slice-ansi: 4.0.0
+      string-width: 4.2.3
+      strip-ansi: 6.0.1
+
+  tinyglobby@0.2.15:
+    dependencies:
+      fdir: 6.5.0(picomatch@4.0.3)
+      picomatch: 4.0.3
+
+  to-regex-range@5.0.1:
+    dependencies:
+      is-number: 7.0.0
+
+  tsconfck@3.1.6(typescript@5.9.3):
+    optionalDependencies:
+      typescript: 5.9.3
+
+  tslib@2.8.1:
+    optional: true
+
+  typescript@5.9.3: {}
+
+  undici-types@7.16.0: {}
+
+  update-browserslist-db@1.2.2(browserslist@4.28.1):
+    dependencies:
+      browserslist: 4.28.1
+      escalade: 3.2.0
+      picocolors: 1.1.1
+
+  util-deprecate@1.0.2: {}
+
+  vite-tsconfig-paths@5.1.4(rolldown-vite@7.2.5(@types/node@24.10.2)(sass@1.95.0))(typescript@5.9.3):
+    dependencies:
+      debug: 4.4.3
+      globrex: 0.1.2
+      tsconfck: 3.1.6(typescript@5.9.3)
+    optionalDependencies:
+      vite: rolldown-vite@7.2.5(@types/node@24.10.2)(sass@1.95.0)
+    transitivePeerDependencies:
+      - supports-color
+      - typescript
+
+  which@1.3.1:
+    dependencies:
+      isexe: 2.0.0
+
+  write-file-atomic@5.0.1:
+    dependencies:
+      imurmurhash: 0.1.4
+      signal-exit: 4.1.0
+
+  yallist@3.1.1: {}
+
+  zod@4.1.13: {}
+
+  zustand@5.0.9(@types/react@19.2.7)(react@19.2.1):
+    optionalDependencies:
+      '@types/react': 19.2.7
+      react: 19.2.1
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/public/assets/android-chrome-192x192.png b/PROJECTS/beginner/canary-token-generator/frontend/public/assets/android-chrome-192x192.png
new file mode 100644
index 00000000..89759eeb
Binary files /dev/null and b/PROJECTS/beginner/canary-token-generator/frontend/public/assets/android-chrome-192x192.png differ
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/public/assets/android-chrome-512x512.png b/PROJECTS/beginner/canary-token-generator/frontend/public/assets/android-chrome-512x512.png
new file mode 100644
index 00000000..a4dab0c2
Binary files /dev/null and b/PROJECTS/beginner/canary-token-generator/frontend/public/assets/android-chrome-512x512.png differ
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/public/assets/apple-touch-icon.png b/PROJECTS/beginner/canary-token-generator/frontend/public/assets/apple-touch-icon.png
new file mode 100644
index 00000000..640755ad
Binary files /dev/null and b/PROJECTS/beginner/canary-token-generator/frontend/public/assets/apple-touch-icon.png differ
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/public/assets/favicon-16x16.png b/PROJECTS/beginner/canary-token-generator/frontend/public/assets/favicon-16x16.png
new file mode 100644
index 00000000..65e96982
Binary files /dev/null and b/PROJECTS/beginner/canary-token-generator/frontend/public/assets/favicon-16x16.png differ
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/public/assets/favicon-32x32.png b/PROJECTS/beginner/canary-token-generator/frontend/public/assets/favicon-32x32.png
new file mode 100644
index 00000000..323476cd
Binary files /dev/null and b/PROJECTS/beginner/canary-token-generator/frontend/public/assets/favicon-32x32.png differ
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/public/assets/favicon.ico b/PROJECTS/beginner/canary-token-generator/frontend/public/assets/favicon.ico
new file mode 100644
index 00000000..a648b87c
Binary files /dev/null and b/PROJECTS/beginner/canary-token-generator/frontend/public/assets/favicon.ico differ
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/public/assets/site.webmanifest b/PROJECTS/beginner/canary-token-generator/frontend/public/assets/site.webmanifest
new file mode 100644
index 00000000..1dd91123
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/public/assets/site.webmanifest
@@ -0,0 +1 @@
+{"name":"","short_name":"","icons":[{"src":"/android-chrome-192x192.png","sizes":"192x192","type":"image/png"},{"src":"/android-chrome-512x512.png","sizes":"512x512","type":"image/png"}],"theme_color":"#ffffff","background_color":"#ffffff","display":"standalone"}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/App.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/App.tsx
new file mode 100644
index 00000000..bf6a61a7
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/App.tsx
@@ -0,0 +1,21 @@
+// ===================
+// ©AngelaMos | 2026
+// App.tsx
+// ===================
+
+import { QueryClientProvider } from '@tanstack/react-query'
+import { ReactQueryDevtools } from '@tanstack/react-query-devtools'
+import { RouterProvider } from 'react-router-dom'
+import { Toaster } from 'sonner'
+import { queryClient } from '@/core/api'
+import { router } from '@/core/app/routers'
+
+export default function App(): React.ReactElement {
+  return (
+    <QueryClientProvider client={queryClient}>
+      <RouterProvider router={router} />
+      <Toaster />
+      <ReactQueryDevtools initialIsOpen={false} />
+    </QueryClientProvider>
+  )
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/api/client.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/api/client.ts
new file mode 100644
index 00000000..1ef24a24
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/api/client.ts
@@ -0,0 +1,136 @@
+// ===================
+// ©AngelaMos | 2026
+// client.ts
+// ===================
+
+import axios, {
+  type AxiosError,
+  type AxiosInstance,
+  type InternalAxiosRequestConfig,
+} from 'axios'
+import type { ZodType } from 'zod'
+import { ApiError, ApiErrorCode } from '@/core/api'
+import { apiErrorEnvelopeSchema, successEnvelope } from './types/error'
+
+const REQUEST_TIMEOUT_MS = 15000
+const TURNSTILE_HEADER_NAME = 'CF-Turnstile-Response'
+
+const STATUS_FALLBACK_CODE: Readonly<Record<number, ApiErrorCode>> = {
+  400: ApiErrorCode.VALIDATION_ERROR,
+  404: ApiErrorCode.NOT_FOUND,
+  410: ApiErrorCode.NOT_FOUND,
+  429: ApiErrorCode.RATE_LIMITED,
+  500: ApiErrorCode.INTERNAL_ERROR,
+  502: ApiErrorCode.SERVICE_UNAVAILABLE,
+  503: ApiErrorCode.SERVICE_UNAVAILABLE,
+  504: ApiErrorCode.SERVICE_UNAVAILABLE,
+}
+
+const resolveBaseURL = (): string => {
+  const fromEnv = import.meta.env.VITE_API_URL
+  if (typeof fromEnv === 'string' && fromEnv.length > 0) {
+    return fromEnv
+  }
+  return '/api'
+}
+
+export const apiClient: AxiosInstance = axios.create({
+  baseURL: resolveBaseURL(),
+  timeout: REQUEST_TIMEOUT_MS,
+  headers: { 'Content-Type': 'application/json' },
+})
+
+export type TurnstileTokenProvider = () => string | null | undefined
+
+let turnstileProvider: TurnstileTokenProvider | null = null
+
+export function setTurnstileTokenProvider(
+  provider: TurnstileTokenProvider | null
+): void {
+  turnstileProvider = provider
+}
+
+function transformAxiosError(error: AxiosError<unknown>): ApiError {
+  if (!error.response) {
+    return new ApiError('Network error', ApiErrorCode.NETWORK_ERROR, 0)
+  }
+  const { status, data } = error.response
+
+  const parsed = apiErrorEnvelopeSchema.safeParse(data)
+  if (parsed.success) {
+    return new ApiError(
+      parsed.data.error.message,
+      parsed.data.error.code,
+      status,
+      parsed.data.error.fields
+    )
+  }
+
+  const fallback = STATUS_FALLBACK_CODE[status] ?? ApiErrorCode.UNKNOWN_ERROR
+  return new ApiError('Request failed', fallback, status)
+}
+
+apiClient.interceptors.request.use(
+  (config: InternalAxiosRequestConfig): InternalAxiosRequestConfig => {
+    const token = turnstileProvider?.()
+    if (typeof token === 'string' && token.length > 0) {
+      config.headers.set(TURNSTILE_HEADER_NAME, token)
+    }
+    return config
+  },
+  (error: unknown) => Promise.reject(error)
+)
+
+apiClient.interceptors.response.use(
+  (response) => response,
+  (error: unknown) => {
+    if (axios.isAxiosError(error)) {
+      return Promise.reject(transformAxiosError(error))
+    }
+    return Promise.reject(error)
+  }
+)
+
+type ParseIssue = {
+  path: readonly PropertyKey[]
+  message: string
+}
+
+function describeParseFailure(issues: readonly ParseIssue[]): string {
+  const first = issues[0]
+  if (!first) {
+    return 'unknown'
+  }
+  const path = first.path.length > 0 ? first.path.join('.') : '<root>'
+  return `${path}: ${first.message}`
+}
+
+function unwrapEnvelope<T>(data: unknown, schema: ZodType<T>, status: number): T {
+  const parsed = successEnvelope(schema).safeParse(data)
+  if (!parsed.success) {
+    throw new ApiError(
+      `response shape mismatch (${describeParseFailure(parsed.error.issues)})`,
+      ApiErrorCode.PARSE_ERROR,
+      status
+    )
+  }
+  return parsed.data.data
+}
+
+export async function apiGet<T>(path: string, schema: ZodType<T>): Promise<T> {
+  const response = await apiClient.get<unknown>(path)
+  return unwrapEnvelope(response.data, schema, response.status)
+}
+
+export async function apiPost<T>(
+  path: string,
+  body: unknown,
+  schema: ZodType<T>
+): Promise<T> {
+  const response = await apiClient.post<unknown>(path, body)
+  return unwrapEnvelope(response.data, schema, response.status)
+}
+
+export async function apiDelete(path: string): Promise<void> {
+  await apiClient.delete(path)
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/api/hooks/index.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/api/hooks/index.ts
new file mode 100644
index 00000000..90327613
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/api/hooks/index.ts
@@ -0,0 +1,9 @@
+// ===================
+// ©AngelaMos | 2026
+// index.ts
+// ===================
+
+export * from './useCreateToken'
+export * from './useDeleteToken'
+export * from './useManageToken'
+export * from './useTokenTypes'
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/api/hooks/useCreateToken.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/api/hooks/useCreateToken.ts
new file mode 100644
index 00000000..3d4f67fd
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/api/hooks/useCreateToken.ts
@@ -0,0 +1,28 @@
+// ===================
+// ©AngelaMos | 2026
+// useCreateToken.ts
+// ===================
+
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { apiPost } from '../client'
+import {
+  type CreateTokenInput,
+  type CreateTokenResponse,
+  createTokenResponseSchema,
+} from '../types/token'
+
+const CREATE_TOKEN_PATH = '/tokens'
+const MANAGE_KEY_PREFIX = ['canary', 'manage'] as const
+
+export function useCreateToken() {
+  const queryClient = useQueryClient()
+  return useMutation<CreateTokenResponse, Error, CreateTokenInput>({
+    mutationFn: (body) =>
+      apiPost(CREATE_TOKEN_PATH, body, createTokenResponseSchema),
+    onSuccess: (data) => {
+      queryClient.invalidateQueries({
+        queryKey: [...MANAGE_KEY_PREFIX, data.token.manage_id],
+      })
+    },
+  })
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/api/hooks/useDeleteToken.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/api/hooks/useDeleteToken.ts
new file mode 100644
index 00000000..8858a529
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/api/hooks/useDeleteToken.ts
@@ -0,0 +1,23 @@
+// ===================
+// ©AngelaMos | 2026
+// useDeleteToken.ts
+// ===================
+
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { apiDelete } from '../client'
+
+const MANAGE_PATH_PREFIX = '/m/'
+const MANAGE_KEY_PREFIX = ['canary', 'manage'] as const
+
+export function useDeleteToken() {
+  const queryClient = useQueryClient()
+  return useMutation<void, Error, string>({
+    mutationFn: (manageId) =>
+      apiDelete(`${MANAGE_PATH_PREFIX}${encodeURIComponent(manageId)}`),
+    onSuccess: (_data, manageId) => {
+      queryClient.removeQueries({
+        queryKey: [...MANAGE_KEY_PREFIX, manageId],
+      })
+    },
+  })
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/api/hooks/useManageToken.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/api/hooks/useManageToken.ts
new file mode 100644
index 00000000..a7a275f0
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/api/hooks/useManageToken.ts
@@ -0,0 +1,48 @@
+// ===================
+// ©AngelaMos | 2026
+// useManageToken.ts
+// ===================
+
+import { useQuery } from '@tanstack/react-query'
+import { QUERY_STRATEGIES } from '@/core/api'
+import { apiGet } from '../client'
+import { manageResponseSchema } from '../types/event'
+
+const MANAGE_PATH_PREFIX = '/m/'
+const MANAGE_KEY_PREFIX = ['canary', 'manage'] as const
+
+export type UseManageTokenParams = {
+  cursor?: string
+  limit?: number
+}
+
+function buildSearch(params: UseManageTokenParams | undefined): string {
+  if (!params) {
+    return ''
+  }
+  const sp = new URLSearchParams()
+  if (params.cursor !== undefined && params.cursor.length > 0) {
+    sp.set('cursor', params.cursor)
+  }
+  if (params.limit !== undefined) {
+    sp.set('limit', String(params.limit))
+  }
+  const query = sp.toString()
+  return query.length > 0 ? `?${query}` : ''
+}
+
+export function useManageToken(manageId: string, params?: UseManageTokenParams) {
+  const search = buildSearch(params)
+  const path = `${MANAGE_PATH_PREFIX}${encodeURIComponent(manageId)}${search}`
+  return useQuery({
+    queryKey: [
+      ...MANAGE_KEY_PREFIX,
+      manageId,
+      params?.cursor ?? null,
+      params?.limit ?? null,
+    ],
+    queryFn: () => apiGet(path, manageResponseSchema),
+    enabled: manageId.length > 0,
+    ...QUERY_STRATEGIES.frequent,
+  })
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/api/hooks/useTokenTypes.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/api/hooks/useTokenTypes.ts
new file mode 100644
index 00000000..a36500dd
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/api/hooks/useTokenTypes.ts
@@ -0,0 +1,20 @@
+// ===================
+// ©AngelaMos | 2026
+// useTokenTypes.ts
+// ===================
+
+import { useQuery } from '@tanstack/react-query'
+import { QUERY_STRATEGIES } from '@/core/api'
+import { apiGet } from '../client'
+import { typeDescriptorListSchema } from '../types/token'
+
+const TOKEN_TYPES_PATH = '/tokens/types'
+const TOKEN_TYPES_KEY = ['canary', 'token-types'] as const
+
+export function useTokenTypes() {
+  return useQuery({
+    queryKey: TOKEN_TYPES_KEY,
+    queryFn: () => apiGet(TOKEN_TYPES_PATH, typeDescriptorListSchema),
+    ...QUERY_STRATEGIES.static,
+  })
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/api/index.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/api/index.ts
new file mode 100644
index 00000000..d29a44f9
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/api/index.ts
@@ -0,0 +1,8 @@
+// ===================
+// ©AngelaMos | 2026
+// index.ts
+// ===================
+
+export * from './client'
+export * from './hooks'
+export * from './types'
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/api/types/error.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/api/types/error.ts
new file mode 100644
index 00000000..db125a94
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/api/types/error.ts
@@ -0,0 +1,32 @@
+// ===================
+// ©AngelaMos | 2026
+// error.ts
+// ===================
+
+import { type ZodType, z } from 'zod'
+
+export const apiErrorPayloadSchema = z.object({
+  code: z.string(),
+  message: z.string(),
+  fields: z.record(z.string(), z.string()).optional(),
+})
+
+export type ApiErrorPayload = z.infer<typeof apiErrorPayloadSchema>
+
+export const apiErrorEnvelopeSchema = z.object({
+  success: z.literal(false),
+  error: apiErrorPayloadSchema,
+})
+
+export type ApiErrorEnvelope = z.infer<typeof apiErrorEnvelopeSchema>
+
+export const successEnvelope = <T extends ZodType>(data: T) =>
+  z.object({
+    success: z.literal(true),
+    data,
+  })
+
+export type SuccessEnvelope<T> = {
+  success: true
+  data: T
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/api/types/event.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/api/types/event.ts
new file mode 100644
index 00000000..22b18c45
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/api/types/event.ts
@@ -0,0 +1,59 @@
+// ===================
+// ©AngelaMos | 2026
+// event.ts
+// ===================
+
+import { z } from 'zod'
+import { manageTokenViewSchema } from './token'
+
+export const notifyStatusSchema = z.enum(['pending', 'sent', 'failed', 'deduped'])
+
+export type NotifyStatus = z.infer<typeof notifyStatusSchema>
+
+export const geoViewSchema = z.object({
+  country: z.string().nullable(),
+  region: z.string().nullable(),
+  city: z.string().nullable(),
+  asn: z.number().int().nullable(),
+  asn_org: z.string().nullable(),
+})
+
+export type GeoView = z.infer<typeof geoViewSchema>
+
+export const eventExtraSchema = z.record(z.string(), z.unknown())
+
+export type EventExtra = z.infer<typeof eventExtraSchema>
+
+export const eventResponseSchema = z.object({
+  id: z.number().int().nonnegative(),
+  triggered_at: z.iso.datetime(),
+  source_ip: z.string(),
+  user_agent: z.string().nullable(),
+  referer: z.string().nullable(),
+  geo: geoViewSchema,
+  extra: eventExtraSchema,
+  notify_status: notifyStatusSchema,
+  notified_at: z.iso.datetime().nullable(),
+})
+
+export type EventResponse = z.infer<typeof eventResponseSchema>
+
+export const managePageSchema = z.object({
+  next_cursor: z.string(),
+  has_more: z.boolean(),
+})
+
+export type ManagePage = z.infer<typeof managePageSchema>
+
+export const manageResponseSchema = z.object({
+  token: manageTokenViewSchema,
+  events: z
+    .array(eventResponseSchema)
+    .nullish()
+    .transform((v) => v ?? []),
+  events_total: z.number().int().nonnegative(),
+  events_silenced_active: z.number().int().nonnegative(),
+  page: managePageSchema,
+})
+
+export type ManageResponse = z.infer<typeof manageResponseSchema>
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/api/types/index.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/api/types/index.ts
new file mode 100644
index 00000000..bebc57e2
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/api/types/index.ts
@@ -0,0 +1,8 @@
+// ===================
+// ©AngelaMos | 2026
+// index.ts
+// ===================
+
+export * from './error'
+export * from './event'
+export * from './token'
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/api/types/token.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/api/types/token.ts
new file mode 100644
index 00000000..c8c8569a
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/api/types/token.ts
@@ -0,0 +1,180 @@
+// ===================
+// ©AngelaMos | 2026
+// token.ts
+// ===================
+
+import { z } from 'zod'
+
+export const tokenTypeSchema = z.enum([
+  'webbug',
+  'slowredirect',
+  'docx',
+  'pdf',
+  'kubeconfig',
+  'envfile',
+  'mysql',
+])
+
+export type TokenType = z.infer<typeof tokenTypeSchema>
+
+export const alertChannelSchema = z.enum(['telegram', 'webhook'])
+
+export type AlertChannel = z.infer<typeof alertChannelSchema>
+
+export const artifactKindSchema = z.enum([
+  'url',
+  'file',
+  'text',
+  'connection_string',
+])
+
+export type ArtifactKind = z.infer<typeof artifactKindSchema>
+
+export const tokenResponseSchema = z.object({
+  id: z.string(),
+  manage_id: z.string(),
+  type: tokenTypeSchema,
+  memo: z.string(),
+  filename: z.string().nullable(),
+  alert_channel: alertChannelSchema,
+  created_at: z.iso.datetime(),
+  trigger_count: z.number().int().nonnegative(),
+  last_triggered: z.iso.datetime().nullable(),
+  enabled: z.boolean(),
+  trigger_url: z.string(),
+  manage_url: z.string(),
+  metadata: z.unknown().optional(),
+})
+
+export type TokenResponse = z.infer<typeof tokenResponseSchema>
+
+export const manageTokenViewSchema = z.object({
+  id: z.string(),
+  type: tokenTypeSchema,
+  memo: z.string(),
+  filename: z.string().nullable(),
+  alert_channel: alertChannelSchema,
+  created_at: z.iso.datetime(),
+  trigger_count: z.number().int().nonnegative(),
+  last_triggered: z.iso.datetime().nullable(),
+  enabled: z.boolean(),
+  trigger_url: z.string(),
+})
+
+export type ManageTokenView = z.infer<typeof manageTokenViewSchema>
+
+const artifactUrlSchema = z.object({
+  kind: z.literal('url'),
+  url: z.string().optional(),
+  destination_url: z.string().optional(),
+})
+
+const artifactFileSchema = z.object({
+  kind: z.literal('file'),
+  filename: z.string().optional(),
+  content_type: z.string().optional(),
+  content_b64: z.string().optional(),
+})
+
+const artifactTextSchema = z.object({
+  kind: z.literal('text'),
+  filename: z.string().optional(),
+  content_type: z.string().optional(),
+  content: z.string().optional(),
+})
+
+const artifactConnectionStringSchema = z.object({
+  kind: z.literal('connection_string'),
+  connection_string: z.string().optional(),
+})
+
+export const artifactSchema = z.discriminatedUnion('kind', [
+  artifactUrlSchema,
+  artifactFileSchema,
+  artifactTextSchema,
+  artifactConnectionStringSchema,
+])
+
+export type Artifact = z.infer<typeof artifactSchema>
+
+export const typeDescriptorSchema = z.object({
+  type: tokenTypeSchema,
+  name: z.string(),
+  description: z.string(),
+  artifact_kind: artifactKindSchema,
+  enabled: z.boolean().default(true),
+  disabled_reason: z.string().optional(),
+})
+
+export type TypeDescriptor = z.infer<typeof typeDescriptorSchema>
+
+export const typeDescriptorListSchema = z.array(typeDescriptorSchema)
+
+export type TypeDescriptorList = z.infer<typeof typeDescriptorListSchema>
+
+const MEMO_MAX_LENGTH = 256
+const FILENAME_MAX_LENGTH = 128
+
+export const createTokenRequestSchema = z
+  .object({
+    type: tokenTypeSchema,
+    memo: z.string().max(MEMO_MAX_LENGTH).default(''),
+    filename: z.string().max(FILENAME_MAX_LENGTH).optional(),
+    alert_channel: alertChannelSchema,
+    telegram_bot: z.string().optional(),
+    telegram_chat: z.string().optional(),
+    webhook_url: z.url().optional(),
+    metadata: z.unknown().optional(),
+    cf_turnstile_response: z.string().optional(),
+  })
+  .superRefine((value, ctx) => {
+    if (value.alert_channel === 'telegram') {
+      if (!value.telegram_bot) {
+        ctx.addIssue({
+          code: 'custom',
+          path: ['telegram_bot'],
+          message: 'required when alert_channel is telegram',
+        })
+      }
+      if (!value.telegram_chat) {
+        ctx.addIssue({
+          code: 'custom',
+          path: ['telegram_chat'],
+          message: 'required when alert_channel is telegram',
+        })
+      }
+    }
+    if (value.alert_channel === 'webhook' && !value.webhook_url) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['webhook_url'],
+        message: 'required when alert_channel is webhook',
+      })
+    }
+  })
+
+export type CreateTokenRequest = z.infer<typeof createTokenRequestSchema>
+export type CreateTokenInput = z.input<typeof createTokenRequestSchema>
+
+export const createTokenResponseSchema = z.object({
+  token: tokenResponseSchema,
+  artifact: artifactSchema,
+})
+
+export type CreateTokenResponse = z.infer<typeof createTokenResponseSchema>
+
+export const slowredirectMetadataSchema = z.object({
+  destination_url: z.url(),
+})
+
+export type SlowRedirectMetadata = z.infer<typeof slowredirectMetadataSchema>
+
+export const envfileIncludeKeySchema = z.enum(['aws', 'stripe', 'github', 'db'])
+
+export type EnvfileIncludeKey = z.infer<typeof envfileIncludeKeySchema>
+
+export const envfileMetadataSchema = z.object({
+  include_keys: z.array(envfileIncludeKeySchema),
+})
+
+export type EnvfileMetadata = z.infer<typeof envfileMetadataSchema>
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/Button/Button.module.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Button/Button.module.scss
new file mode 100644
index 00000000..bc6d2ba9
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Button/Button.module.scss
@@ -0,0 +1,89 @@
+// ===================
+// ©AngelaMos | 2026
+// Button.module.scss
+// ===================
+
+@use '../../styles/tokens' as *;
+@use '../../styles/fonts' as *;
+
+.button {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  border: $hairline solid $ink;
+  background-color: $ink;
+  color: $paper;
+  font-family: $font-mono;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  cursor: pointer;
+  transition: background-color $duration-fast $ease-out,
+    color $duration-fast $ease-out;
+
+  &[data-size='sm'] {
+    padding-block: $space-1-5;
+    padding-inline: $space-3;
+    font-size: $font-size-3xs;
+  }
+
+  &[data-size='md'] {
+    padding-block: $space-2-5;
+    padding-inline: $space-5;
+    font-size: $font-size-2xs;
+  }
+
+  &[data-size='lg'] {
+    padding-block: $space-3-5;
+    padding-inline: $space-7;
+    font-size: $font-size-xs;
+  }
+
+  &[data-full='true'] {
+    inline-size: 100%;
+  }
+
+  &:hover:not(:disabled) {
+    background-color: $paper;
+    color: $ink;
+  }
+
+  &[data-variant='ghost'] {
+    background-color: transparent;
+    color: $ink;
+
+    &:hover:not(:disabled) {
+      background-color: $ink;
+      color: $paper;
+    }
+  }
+
+  &[data-variant='alarm'] {
+    background-color: $paper;
+    color: $alarm-deep;
+    border-color: $alarm;
+
+    &:hover:not(:disabled) {
+      background-color: $alarm;
+      color: $paper;
+    }
+  }
+
+  &:disabled {
+    cursor: not-allowed;
+    opacity: 0.5;
+  }
+
+  &[data-busy='true'] {
+    cursor: progress;
+
+    .label::after {
+      content: ' …';
+    }
+  }
+}
+
+.label {
+  display: inline-flex;
+  align-items: center;
+  gap: $space-2;
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/Button/index.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Button/index.tsx
new file mode 100644
index 00000000..8af6e6d7
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Button/index.tsx
@@ -0,0 +1,50 @@
+// ===================
+// ©AngelaMos | 2026
+// index.tsx
+// ===================
+
+import type { ButtonHTMLAttributes, PropsWithChildren } from 'react'
+import { forwardRef } from 'react'
+import styles from './Button.module.scss'
+
+type ButtonVariant = 'primary' | 'ghost' | 'alarm'
+type ButtonSize = 'sm' | 'md' | 'lg'
+
+type ButtonProps = PropsWithChildren<
+  Omit<ButtonHTMLAttributes<HTMLButtonElement>, 'className'> & {
+    variant?: ButtonVariant
+    size?: ButtonSize
+    fullWidth?: boolean
+    busy?: boolean
+  }
+>
+
+export const Button = forwardRef<HTMLButtonElement, ButtonProps>(
+  function Button(props, ref) {
+    const {
+      variant = 'primary',
+      size = 'md',
+      fullWidth = false,
+      busy = false,
+      type = 'button',
+      children,
+      disabled,
+      ...rest
+    } = props
+    return (
+      <button
+        {...rest}
+        ref={ref}
+        type={type}
+        disabled={disabled || busy}
+        className={styles.button}
+        data-variant={variant}
+        data-size={size}
+        data-full={fullWidth}
+        data-busy={busy}
+      >
+        <span className={styles.label}>{children}</span>
+      </button>
+    )
+  }
+)
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/CopyField/CopyField.module.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/components/CopyField/CopyField.module.scss
new file mode 100644
index 00000000..b8655cb7
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/CopyField/CopyField.module.scss
@@ -0,0 +1,63 @@
+// ===================
+// ©AngelaMos | 2026
+// CopyField.module.scss
+// ===================
+
+@use '../../styles/tokens' as *;
+@use '../../styles/fonts' as *;
+
+.field {
+  display: grid;
+  grid-template-columns: auto 1fr auto;
+  align-items: stretch;
+  border: $hairline solid $rule;
+  background-color: $paper;
+
+  &[data-full='true'] {
+    inline-size: 100%;
+  }
+}
+
+.label {
+  display: inline-flex;
+  align-items: center;
+  padding-inline: $space-3;
+  background-color: $ink;
+  color: $paper;
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+}
+
+.value {
+  display: inline-flex;
+  align-items: center;
+  padding-block: $space-2;
+  padding-inline: $space-3;
+  font-family: $font-mono;
+  font-size: $font-size-xs;
+  letter-spacing: $tracking-wide;
+  color: $ink;
+  overflow-x: auto;
+  white-space: nowrap;
+}
+
+.copy {
+  padding-block: $space-2;
+  padding-inline: $space-3;
+  border-inline-start: $hairline solid $rule;
+  background-color: $paper-deep;
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink;
+  cursor: pointer;
+  transition: background-color $duration-fast $ease-out;
+
+  &:hover {
+    background-color: $ink;
+    color: $paper;
+  }
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/CopyField/index.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/components/CopyField/index.tsx
new file mode 100644
index 00000000..10369444
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/CopyField/index.tsx
@@ -0,0 +1,49 @@
+// ===================
+// ©AngelaMos | 2026
+// index.tsx
+// ===================
+
+import { useState } from 'react'
+import { toast } from 'sonner'
+import styles from './CopyField.module.scss'
+
+type CopyFieldProps = {
+  value: string
+  label?: string
+  fullWidth?: boolean
+}
+
+const COPY_FEEDBACK_MS = 1200
+
+export function CopyField({
+  value,
+  label,
+  fullWidth = false,
+}: CopyFieldProps): React.ReactElement {
+  const [copied, setCopied] = useState(false)
+
+  async function handleCopy(): Promise<void> {
+    try {
+      await navigator.clipboard.writeText(value)
+      setCopied(true)
+      setTimeout(() => setCopied(false), COPY_FEEDBACK_MS)
+    } catch (_err) {
+      toast.error('Copy failed — your browser blocked clipboard access')
+    }
+  }
+
+  return (
+    <div className={styles.field} data-full={fullWidth}>
+      {label ? <span className={styles.label}>{label}</span> : null}
+      <code className={styles.value}>{value}</code>
+      <button
+        type="button"
+        className={styles.copy}
+        onClick={handleCopy}
+        aria-label={`Copy ${label ?? 'value'}`}
+      >
+        {copied ? 'copied' : 'copy'}
+      </button>
+    </div>
+  )
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/DataRow/DataRow.module.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/components/DataRow/DataRow.module.scss
new file mode 100644
index 00000000..b839dc30
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/DataRow/DataRow.module.scss
@@ -0,0 +1,60 @@
+// ===================
+// ©AngelaMos | 2026
+// DataRow.module.scss
+// ===================
+
+@use '../../styles/tokens' as *;
+@use '../../styles/fonts' as *;
+
+.row {
+  display: grid;
+  grid-template-columns: auto 1fr auto;
+  align-items: baseline;
+  gap: $space-2;
+  font-size: $font-size-sm;
+  line-height: $line-height-snug;
+
+  &[data-alarm='true'] {
+    color: $alarm-deep;
+  }
+}
+
+.label {
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink-mute;
+  white-space: nowrap;
+}
+
+.leader {
+  align-self: end;
+  block-size: $hairline;
+  background-image: linear-gradient(
+    to right,
+    $rule-soft 0,
+    $rule-soft 4px,
+    transparent 4px,
+    transparent 8px
+  );
+  background-size: 8px $hairline;
+  transform: translateY(-3px);
+  min-inline-size: $space-4;
+}
+
+.value {
+  color: inherit;
+  text-align: right;
+  overflow-wrap: anywhere;
+
+  &[data-mono='true'] {
+    font-family: $font-mono;
+    font-size: $font-size-xs;
+    letter-spacing: $tracking-wide;
+  }
+
+  &[data-emphasize='true'] {
+    font-weight: $font-weight-semibold;
+  }
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/DataRow/index.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/components/DataRow/index.tsx
new file mode 100644
index 00000000..67bbe503
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/DataRow/index.tsx
@@ -0,0 +1,32 @@
+// ===================
+// ©AngelaMos | 2026
+// index.tsx
+// ===================
+
+import type { PropsWithChildren, ReactNode } from 'react'
+import styles from './DataRow.module.scss'
+
+type DataRowProps = PropsWithChildren<{
+  label: ReactNode
+  mono?: boolean
+  emphasize?: boolean
+  alarm?: boolean
+}>
+
+export function DataRow({
+  label,
+  children,
+  mono = false,
+  emphasize = false,
+  alarm = false,
+}: DataRowProps): React.ReactElement {
+  return (
+    <div className={styles.row} data-alarm={alarm}>
+      <span className={styles.label}>{label}</span>
+      <span className={styles.leader} aria-hidden="true" />
+      <span className={styles.value} data-mono={mono} data-emphasize={emphasize}>
+        {children}
+      </span>
+    </div>
+  )
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/Field/Field.module.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Field/Field.module.scss
new file mode 100644
index 00000000..4a16cb5a
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Field/Field.module.scss
@@ -0,0 +1,108 @@
+// ===================
+// ©AngelaMos | 2026
+// Field.module.scss
+// ===================
+
+@use '../../styles/tokens' as *;
+@use '../../styles/fonts' as *;
+
+.field {
+  display: flex;
+  flex-direction: column;
+  gap: $space-2;
+}
+
+.head {
+  display: flex;
+  align-items: center;
+  gap: $space-2;
+}
+
+.index {
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink-mute;
+  white-space: nowrap;
+}
+
+.label {
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink;
+  font-weight: $font-weight-semibold;
+  white-space: nowrap;
+}
+
+.required {
+  color: $alarm;
+}
+
+.rule {
+  flex: 1 1 auto;
+  block-size: $hairline;
+  background-color: $rule-hair;
+}
+
+.input,
+.textarea,
+.select {
+  inline-size: 100%;
+  padding-block: $space-2-5;
+  padding-inline: $space-3;
+  border: $hairline solid $rule;
+  background-color: $paper;
+  font-family: $font-sans;
+  font-size: $font-size-base;
+  color: $ink;
+  appearance: none;
+  border-radius: 0;
+  transition: border-color $duration-fast $ease-out;
+
+  &::placeholder {
+    color: $ink-faint;
+  }
+
+  &:focus {
+    outline: none;
+    border-color: $ink;
+    box-shadow: inset 0 0 0 $hairline $ink;
+  }
+
+  .field[data-invalid='true'] & {
+    border-color: $alarm;
+  }
+}
+
+.textarea {
+  min-block-size: 5lh;
+  resize: vertical;
+  font-family: $font-sans;
+  line-height: $line-height-normal;
+}
+
+.select {
+  padding-inline-end: $space-8;
+  background-image: linear-gradient(45deg, transparent 50%, $ink 50%),
+    linear-gradient(135deg, $ink 50%, transparent 50%);
+  background-position: calc(100% - 18px) 50%, calc(100% - 13px) 50%;
+  background-size: 5px 5px, 5px 5px;
+  background-repeat: no-repeat;
+}
+
+.hint {
+  font-size: $font-size-xs;
+  color: $ink-mute;
+  font-family: $font-sans;
+}
+
+.error {
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $alarm;
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/Field/index.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Field/index.tsx
new file mode 100644
index 00000000..54a265de
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Field/index.tsx
@@ -0,0 +1,163 @@
+// ===================
+// ©AngelaMos | 2026
+// index.tsx
+// ===================
+
+import type {
+  InputHTMLAttributes,
+  PropsWithChildren,
+  ReactNode,
+  SelectHTMLAttributes,
+  TextareaHTMLAttributes,
+} from 'react'
+import { forwardRef, useId } from 'react'
+import styles from './Field.module.scss'
+
+type FieldWrapProps = PropsWithChildren<{
+  label: ReactNode
+  hint?: ReactNode
+  error?: ReactNode
+  index?: string
+  required?: boolean
+  htmlFor?: string
+}>
+
+export function FieldWrap({
+  label,
+  hint,
+  error,
+  index,
+  required,
+  htmlFor,
+  children,
+}: FieldWrapProps): React.ReactElement {
+  return (
+    <div className={styles.field} data-invalid={error ? 'true' : 'false'}>
+      <div className={styles.head}>
+        {index ? <span className={styles.index}>{index}</span> : null}
+        <label className={styles.label} htmlFor={htmlFor}>
+          {label}
+          {required ? <span className={styles.required}> *</span> : null}
+        </label>
+        <span className={styles.rule} aria-hidden="true" />
+      </div>
+      {children}
+      {hint && !error ? <p className={styles.hint}>{hint}</p> : null}
+      {error ? (
+        <p className={styles.error} role="alert">
+          {error}
+        </p>
+      ) : null}
+    </div>
+  )
+}
+
+type TextFieldProps = Omit<
+  InputHTMLAttributes<HTMLInputElement>,
+  'className' | 'id'
+> & {
+  label: ReactNode
+  hint?: ReactNode
+  error?: ReactNode
+  index?: string
+}
+
+export const TextField = forwardRef<HTMLInputElement, TextFieldProps>(
+  function TextField(props, ref) {
+    const { label, hint, error, index, required, ...rest } = props
+    const fallbackId = useId()
+    const id = rest.name ? `f-${rest.name}` : fallbackId
+    return (
+      <FieldWrap
+        label={label}
+        hint={hint}
+        error={error}
+        index={index}
+        required={required}
+        htmlFor={id}
+      >
+        <input
+          {...rest}
+          id={id}
+          required={required}
+          ref={ref}
+          className={styles.input}
+        />
+      </FieldWrap>
+    )
+  }
+)
+
+type TextareaFieldProps = Omit<
+  TextareaHTMLAttributes<HTMLTextAreaElement>,
+  'className' | 'id'
+> & {
+  label: ReactNode
+  hint?: ReactNode
+  error?: ReactNode
+  index?: string
+}
+
+export const TextareaField = forwardRef<HTMLTextAreaElement, TextareaFieldProps>(
+  function TextareaField(props, ref) {
+    const { label, hint, error, index, required, ...rest } = props
+    const fallbackId = useId()
+    const id = rest.name ? `f-${rest.name}` : fallbackId
+    return (
+      <FieldWrap
+        label={label}
+        hint={hint}
+        error={error}
+        index={index}
+        required={required}
+        htmlFor={id}
+      >
+        <textarea
+          {...rest}
+          id={id}
+          required={required}
+          ref={ref}
+          className={styles.textarea}
+        />
+      </FieldWrap>
+    )
+  }
+)
+
+type SelectFieldProps = Omit<
+  SelectHTMLAttributes<HTMLSelectElement>,
+  'className' | 'id'
+> & {
+  label: ReactNode
+  hint?: ReactNode
+  error?: ReactNode
+  index?: string
+}
+
+export const SelectField = forwardRef<HTMLSelectElement, SelectFieldProps>(
+  function SelectField(props, ref) {
+    const { label, hint, error, index, required, children, ...rest } = props
+    const fallbackId = useId()
+    const id = rest.name ? `f-${rest.name}` : fallbackId
+    return (
+      <FieldWrap
+        label={label}
+        hint={hint}
+        error={error}
+        index={index}
+        required={required}
+        htmlFor={id}
+      >
+        <select
+          {...rest}
+          id={id}
+          required={required}
+          ref={ref}
+          className={styles.select}
+        >
+          {children}
+        </select>
+      </FieldWrap>
+    )
+  }
+)
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/Glyph/Glyph.module.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Glyph/Glyph.module.scss
new file mode 100644
index 00000000..d29e046c
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Glyph/Glyph.module.scss
@@ -0,0 +1,12 @@
+// ===================
+// ©AngelaMos | 2026
+// Glyph.module.scss
+// ===================
+
+@use '../../styles/tokens' as *;
+
+.glyph {
+  display: block;
+  color: $ink;
+  flex-shrink: 0;
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/Glyph/index.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Glyph/index.tsx
new file mode 100644
index 00000000..286d9f75
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Glyph/index.tsx
@@ -0,0 +1,157 @@
+// ===================
+// ©AngelaMos | 2026
+// index.tsx
+// ===================
+
+import type { TokenType } from '@/api'
+import styles from './Glyph.module.scss'
+
+type GlyphProps = {
+  type: TokenType
+  size?: number
+  title?: string
+}
+
+export function Glyph({
+  type,
+  size = 28,
+  title,
+}: GlyphProps): React.ReactElement {
+  return (
+    <svg
+      className={styles.glyph}
+      viewBox="0 0 24 24"
+      width={size}
+      height={size}
+      role={title ? 'img' : 'presentation'}
+      aria-label={title}
+      fill="none"
+      stroke="currentColor"
+      strokeWidth="1.5"
+      strokeLinecap="square"
+      strokeLinejoin="miter"
+    >
+      {renderGlyph(type)}
+    </svg>
+  )
+}
+
+function renderGlyph(type: TokenType): React.ReactElement {
+  switch (type) {
+    case 'webbug':
+      return <WebbugGlyph />
+    case 'slowredirect':
+      return <SlowRedirectGlyph />
+    case 'docx':
+      return <DocxGlyph />
+    case 'pdf':
+      return <PdfGlyph />
+    case 'kubeconfig':
+      return <KubeconfigGlyph />
+    case 'envfile':
+      return <EnvfileGlyph />
+    case 'mysql':
+      return <MysqlGlyph />
+  }
+}
+
+function WebbugGlyph(): React.ReactElement {
+  return (
+    <>
+      <rect x="3" y="3" width="4" height="4" fill="currentColor" stroke="none" />
+      <rect x="9" y="3" width="4" height="4" />
+      <rect x="15" y="3" width="4" height="4" />
+      <rect x="3" y="9" width="4" height="4" />
+      <rect x="9" y="9" width="4" height="4" />
+      <rect x="15" y="9" width="4" height="4" />
+      <rect x="3" y="15" width="4" height="4" />
+      <rect x="9" y="15" width="4" height="4" />
+      <rect x="15" y="15" width="4" height="4" />
+    </>
+  )
+}
+
+function SlowRedirectGlyph(): React.ReactElement {
+  return (
+    <>
+      <circle cx="3.5" cy="12" r="1" fill="currentColor" stroke="none" />
+      <circle cx="6.5" cy="12" r="1" fill="currentColor" stroke="none" />
+      <circle cx="9.5" cy="12" r="1" fill="currentColor" stroke="none" />
+      <line x1="12" y1="12" x2="20" y2="12" />
+      <polyline points="17,8 21,12 17,16" />
+    </>
+  )
+}
+
+function DocxGlyph(): React.ReactElement {
+  return (
+    <>
+      <path d="M5 3 L15 3 L19 7 L19 21 L5 21 Z" />
+      <line x1="15" y1="3" x2="15" y2="7" />
+      <line x1="15" y1="7" x2="19" y2="7" />
+      <line x1="8" y1="11" x2="16" y2="11" />
+      <line x1="8" y1="14" x2="16" y2="14" />
+      <line x1="8" y1="17" x2="13" y2="17" />
+    </>
+  )
+}
+
+function PdfGlyph(): React.ReactElement {
+  return (
+    <>
+      <path d="M5 3 L15 3 L19 7 L19 21 L5 21 Z" />
+      <line x1="15" y1="3" x2="15" y2="7" />
+      <line x1="15" y1="7" x2="19" y2="7" />
+      <text
+        x="12"
+        y="17"
+        fontFamily="ui-monospace, monospace"
+        fontSize="6"
+        fontWeight="700"
+        textAnchor="middle"
+        fill="currentColor"
+        stroke="none"
+      >
+        PDF
+      </text>
+    </>
+  )
+}
+
+function KubeconfigGlyph(): React.ReactElement {
+  return (
+    <>
+      <polygon points="12,3 19.5,7.5 19.5,16.5 12,21 4.5,16.5 4.5,7.5" />
+      <circle cx="12" cy="12" r="2.5" fill="currentColor" stroke="none" />
+      <line x1="12" y1="3" x2="12" y2="9.5" />
+      <line x1="19.5" y1="7.5" x2="14.2" y2="11" />
+      <line x1="19.5" y1="16.5" x2="14.2" y2="13" />
+      <line x1="12" y1="21" x2="12" y2="14.5" />
+      <line x1="4.5" y1="16.5" x2="9.8" y2="13" />
+      <line x1="4.5" y1="7.5" x2="9.8" y2="11" />
+    </>
+  )
+}
+
+function EnvfileGlyph(): React.ReactElement {
+  return (
+    <>
+      <path d="M8 4 C5 4 5 8 5 12 C5 16 5 20 8 20" />
+      <path d="M16 4 C19 4 19 8 19 12 C19 16 19 20 16 20" />
+      <line x1="8" y1="11.5" x2="16" y2="11.5" />
+      <line x1="8" y1="13.5" x2="16" y2="13.5" />
+      <circle cx="12" cy="8.5" r="0.7" fill="currentColor" stroke="none" />
+      <circle cx="12" cy="16.5" r="0.7" fill="currentColor" stroke="none" />
+    </>
+  )
+}
+
+function MysqlGlyph(): React.ReactElement {
+  return (
+    <>
+      <ellipse cx="12" cy="5.5" rx="7" ry="2.5" />
+      <path d="M5 5.5 L5 11 C5 12.4 8.1 13.5 12 13.5 C15.9 13.5 19 12.4 19 11 L19 5.5" />
+      <path d="M5 11 L5 16.5 C5 17.9 8.1 19 12 19 C15.9 19 19 17.9 19 16.5 L19 11" />
+    </>
+  )
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/Halftone/Halftone.module.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Halftone/Halftone.module.scss
new file mode 100644
index 00000000..3ae9d0f9
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Halftone/Halftone.module.scss
@@ -0,0 +1,24 @@
+// ===================
+// ©AngelaMos | 2026
+// Halftone.module.scss
+// ===================
+
+@use '../../styles/tokens' as *;
+
+.halftone {
+  inline-size: 100%;
+  background-image: $halftone-dots;
+  background-repeat: repeat;
+
+  &[data-density='sparse'] {
+    background-size: 14px 14px;
+  }
+
+  &[data-density='normal'] {
+    background-size: 8px 8px;
+  }
+
+  &[data-density='dense'] {
+    background-size: 5px 5px;
+  }
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/Halftone/index.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Halftone/index.tsx
new file mode 100644
index 00000000..981829d3
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Halftone/index.tsx
@@ -0,0 +1,25 @@
+// ===================
+// ©AngelaMos | 2026
+// index.tsx
+// ===================
+
+import styles from './Halftone.module.scss'
+
+type HalftoneProps = {
+  density?: 'sparse' | 'normal' | 'dense'
+  height?: number
+}
+
+export function Halftone({
+  density = 'normal',
+  height = 24,
+}: HalftoneProps): React.ReactElement {
+  return (
+    <div
+      className={styles.halftone}
+      data-density={density}
+      style={{ blockSize: `${height}px` }}
+      aria-hidden="true"
+    />
+  )
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/Pill/Pill.module.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Pill/Pill.module.scss
new file mode 100644
index 00000000..5682c176
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Pill/Pill.module.scss
@@ -0,0 +1,53 @@
+// ===================
+// ©AngelaMos | 2026
+// Pill.module.scss
+// ===================
+
+@use '../../styles/tokens' as *;
+@use '../../styles/fonts' as *;
+
+.pill {
+  display: inline-flex;
+  align-items: center;
+  gap: $space-1;
+  padding-block: $space-0-5;
+  padding-inline: $space-2;
+  border: $hairline solid $rule;
+  font-family: $font-mono;
+  text-transform: uppercase;
+  letter-spacing: $tracking-wider;
+  white-space: nowrap;
+
+  &[data-size='sm'] {
+    font-size: $font-size-3xs;
+  }
+
+  &[data-size='md'] {
+    font-size: $font-size-2xs;
+    padding-block: $space-1;
+    padding-inline: $space-2-5;
+  }
+
+  &[data-tone='paper'] {
+    background-color: $paper;
+    color: $ink;
+  }
+
+  &[data-tone='ink'] {
+    background-color: $ink;
+    color: $paper;
+    border-color: $ink;
+  }
+
+  &[data-tone='alarm'] {
+    background-color: $alarm-tint;
+    color: $alarm-deep;
+    border-color: $alarm;
+  }
+
+  &[data-tone='signal'] {
+    background-color: $signal-tint;
+    color: $signal;
+    border-color: $signal;
+  }
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/Pill/index.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Pill/index.tsx
new file mode 100644
index 00000000..7b04bc0d
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Pill/index.tsx
@@ -0,0 +1,24 @@
+// ===================
+// ©AngelaMos | 2026
+// index.tsx
+// ===================
+
+import type { PropsWithChildren } from 'react'
+import styles from './Pill.module.scss'
+
+type PillProps = PropsWithChildren<{
+  tone?: 'paper' | 'ink' | 'alarm' | 'signal'
+  size?: 'sm' | 'md'
+}>
+
+export function Pill({
+  children,
+  tone = 'paper',
+  size = 'sm',
+}: PillProps): React.ReactElement {
+  return (
+    <span className={styles.pill} data-tone={tone} data-size={size}>
+      {children}
+    </span>
+  )
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/SerialBar/SerialBar.module.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/components/SerialBar/SerialBar.module.scss
new file mode 100644
index 00000000..eee669f9
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/SerialBar/SerialBar.module.scss
@@ -0,0 +1,44 @@
+// ===================
+// ©AngelaMos | 2026
+// SerialBar.module.scss
+// ===================
+
+@use '../../styles/tokens' as *;
+@use '../../styles/fonts' as *;
+
+.serial {
+  display: inline-grid;
+  grid-template-columns: auto auto;
+  grid-template-rows: auto auto;
+  gap: 0 $space-2;
+  align-items: baseline;
+  font-family: $font-mono;
+  color: $ink;
+}
+
+.prefix {
+  grid-row: 1;
+  grid-column: 1;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink-mute;
+}
+
+.bars {
+  grid-row: 1;
+  grid-column: 2;
+  font-size: $font-size-lg;
+  line-height: 1;
+  letter-spacing: -0.05em;
+  color: $ink;
+}
+
+.code {
+  grid-row: 2;
+  grid-column: 1 / -1;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wide;
+  color: $ink-soft;
+  overflow-wrap: anywhere;
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/SerialBar/index.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/components/SerialBar/index.tsx
new file mode 100644
index 00000000..0c5d23ef
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/SerialBar/index.tsx
@@ -0,0 +1,43 @@
+// ===================
+// ©AngelaMos | 2026
+// index.tsx
+// ===================
+
+import { useMemo } from 'react'
+import styles from './SerialBar.module.scss'
+
+type SerialBarProps = {
+  value: string
+  prefix?: string
+}
+
+const BAR_COUNT = 22
+const FALLBACK_BARS = '▮▯▮▮▯▮▯▯▮▮▯▮▮▯▮▯▮▮▯▮▯▮'
+
+function fingerprintToBars(value: string): string {
+  if (value.length === 0) {
+    return FALLBACK_BARS
+  }
+  let acc = ''
+  for (let i = 0; i < BAR_COUNT; i += 1) {
+    const ch = value.charCodeAt(i % value.length)
+    acc += (ch & 1) === 0 ? '▮' : '▯'
+  }
+  return acc
+}
+
+export function SerialBar({
+  value,
+  prefix = 'SN',
+}: SerialBarProps): React.ReactElement {
+  const bars = useMemo(() => fingerprintToBars(value), [value])
+  return (
+    <div className={styles.serial}>
+      <span className={styles.prefix}>{prefix}</span>
+      <span className={styles.bars} aria-hidden="true">
+        {bars}
+      </span>
+      <span className={styles.code}>{value}</span>
+    </div>
+  )
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/SpecimenCard/SpecimenCard.module.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/components/SpecimenCard/SpecimenCard.module.scss
new file mode 100644
index 00000000..7644d4a1
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/SpecimenCard/SpecimenCard.module.scss
@@ -0,0 +1,110 @@
+// ===================
+// ©AngelaMos | 2026
+// SpecimenCard.module.scss
+// ===================
+
+@use '../../styles/tokens' as *;
+@use '../../styles/fonts' as *;
+@use '../../styles/mixins' as *;
+
+.card {
+  position: relative;
+  padding: $space-8 $space-6 $space-6;
+  border: $hairline solid $rule;
+  background-color: $paper;
+
+  &[data-tone='ink'] {
+    background-color: $ink;
+    color: $paper;
+    border-color: $ink;
+  }
+
+  &[data-tone='alarm'] {
+    border-color: $alarm;
+  }
+
+  &[data-dense='true'] {
+    padding: $space-4 $space-4 $space-3;
+  }
+
+  @include breakpoint-up('md') {
+    padding-inline: $space-8;
+  }
+}
+
+.tag {
+  position: absolute;
+  inset-block-start: calc(-1 * #{$space-3});
+  inset-inline-start: $space-4;
+  padding-block: $space-1;
+  padding-inline: $space-2;
+  background-color: $paper;
+  border: $hairline solid $rule;
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink;
+  white-space: nowrap;
+
+  .card[data-tone='ink'] & {
+    background-color: $ink;
+    color: $paper;
+    border-color: $paper-edge;
+  }
+
+  .card[data-tone='alarm'] & {
+    background-color: $paper;
+    border-color: $alarm;
+    color: $alarm-deep;
+  }
+}
+
+.serial {
+  position: absolute;
+  inset-block-end: calc(-1 * #{$space-3});
+  inset-inline-end: $space-4;
+  padding-block: $space-1;
+  padding-inline: $space-2;
+  background-color: $paper;
+  border: $hairline solid $rule;
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  color: $ink-soft;
+  white-space: nowrap;
+
+  .card[data-tone='ink'] & {
+    background-color: $ink;
+    color: $paper-edge;
+    border-color: $paper-edge;
+  }
+}
+
+.body {
+  display: flex;
+  flex-direction: column;
+  gap: $space-5;
+}
+
+.section {
+  display: flex;
+  flex-direction: column;
+  gap: $space-2;
+}
+
+.sectionHead {
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink-mute;
+  padding-block-end: $space-1;
+  border-block-end: $hairline solid $rule-hair;
+}
+
+.sectionBody {
+  display: flex;
+  flex-direction: column;
+  gap: $space-1-5;
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/SpecimenCard/index.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/components/SpecimenCard/index.tsx
new file mode 100644
index 00000000..38dbc9b6
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/SpecimenCard/index.tsx
@@ -0,0 +1,42 @@
+// ===================
+// ©AngelaMos | 2026
+// index.tsx
+// ===================
+
+import type { PropsWithChildren, ReactNode } from 'react'
+import styles from './SpecimenCard.module.scss'
+
+type SpecimenCardProps = PropsWithChildren<{
+  tag?: ReactNode
+  serial?: ReactNode
+  tone?: 'paper' | 'ink' | 'alarm'
+  dense?: boolean
+}>
+
+export function SpecimenCard({
+  children,
+  tag,
+  serial,
+  tone = 'paper',
+  dense = false,
+}: SpecimenCardProps): React.ReactElement {
+  return (
+    <article className={styles.card} data-tone={tone} data-dense={dense}>
+      {tag ? <span className={styles.tag}>{tag}</span> : null}
+      <div className={styles.body}>{children}</div>
+      {serial ? <span className={styles.serial}>{serial}</span> : null}
+    </article>
+  )
+}
+
+export function SpecimenCardSection({
+  children,
+  label,
+}: PropsWithChildren<{ label?: ReactNode }>): React.ReactElement {
+  return (
+    <section className={styles.section}>
+      {label ? <header className={styles.sectionHead}>{label}</header> : null}
+      <div className={styles.sectionBody}>{children}</div>
+    </section>
+  )
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/Strip/Strip.module.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Strip/Strip.module.scss
new file mode 100644
index 00000000..1fca83f2
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Strip/Strip.module.scss
@@ -0,0 +1,76 @@
+// ===================
+// ©AngelaMos | 2026
+// Strip.module.scss
+// ===================
+
+@use '../../styles/tokens' as *;
+@use '../../styles/fonts' as *;
+
+.strip {
+  display: flex;
+  align-items: center;
+  gap: $space-4;
+  flex-wrap: wrap;
+  padding-block: $space-2;
+  padding-inline: $space-4;
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink-soft;
+
+  &[data-border='bottom'] {
+    border-bottom: $hairline solid $rule;
+  }
+
+  &[data-border='top'] {
+    border-top: $hairline solid $rule;
+  }
+
+  &[data-border='both'] {
+    border-block: $hairline solid $rule;
+  }
+
+  &[data-align='split'] {
+    justify-content: space-between;
+  }
+
+  &[data-align='left'] {
+    justify-content: flex-start;
+  }
+}
+
+.item {
+  display: inline-flex;
+  align-items: baseline;
+  gap: $space-1-5;
+  padding-block: $space-0-5;
+  padding-inline: $space-2;
+  border: $hairline solid $rule;
+  background-color: transparent;
+
+  &[data-inverted='true'] {
+    background-color: $ink;
+    color: $paper;
+    border-color: $ink;
+  }
+}
+
+.mark {
+  display: inline-block;
+  font-size: $font-size-2xs;
+  transform: translateY(1px);
+}
+
+.label {
+  font-weight: $font-weight-semibold;
+  color: $ink-mute;
+
+  &::after {
+    content: '\00a0';
+  }
+}
+
+.value {
+  color: inherit;
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/Strip/index.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Strip/index.tsx
new file mode 100644
index 00000000..4d137728
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/Strip/index.tsx
@@ -0,0 +1,49 @@
+// ===================
+// ©AngelaMos | 2026
+// index.tsx
+// ===================
+
+import type { PropsWithChildren, ReactNode } from 'react'
+import styles from './Strip.module.scss'
+
+type StripProps = PropsWithChildren<{
+  align?: 'left' | 'split'
+  border?: 'bottom' | 'top' | 'both' | 'none'
+}>
+
+export function Strip({
+  children,
+  align = 'split',
+  border = 'bottom',
+}: StripProps): React.ReactElement {
+  return (
+    <div className={styles.strip} data-align={align} data-border={border}>
+      {children}
+    </div>
+  )
+}
+
+type StripItemProps = PropsWithChildren<{
+  inverted?: boolean
+  label?: string
+  mark?: ReactNode
+}>
+
+export function StripItem({
+  children,
+  inverted = false,
+  label,
+  mark,
+}: StripItemProps): React.ReactElement {
+  return (
+    <span className={styles.item} data-inverted={inverted}>
+      {mark ? (
+        <span className={styles.mark} aria-hidden="true">
+          {mark}
+        </span>
+      ) : null}
+      {label ? <span className={styles.label}>{label}</span> : null}
+      <span className={styles.value}>{children}</span>
+    </span>
+  )
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/components/index.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/components/index.tsx
new file mode 100644
index 00000000..8f845a14
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/components/index.tsx
@@ -0,0 +1,15 @@
+// ===================
+// ©AngelaMos | 2026
+// index.tsx
+// ===================
+
+export { Button } from './Button'
+export { CopyField } from './CopyField'
+export { DataRow } from './DataRow'
+export { FieldWrap, SelectField, TextareaField, TextField } from './Field'
+export { Glyph } from './Glyph'
+export { Halftone } from './Halftone'
+export { Pill } from './Pill'
+export { SerialBar } from './SerialBar'
+export { SpecimenCard, SpecimenCardSection } from './SpecimenCard'
+export { Strip, StripItem } from './Strip'
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/config.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/config.ts
new file mode 100644
index 00000000..fa6d5f54
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/config.ts
@@ -0,0 +1,31 @@
+// ===================
+// ©AngelaMos | 2026
+// config.ts
+// ===================
+
+export const ROUTES = {
+  HOME: '/',
+  MANAGE: '/m/:manageId',
+} as const
+
+export type Route = typeof ROUTES
+
+export function manageRoute(manageId: string): string {
+  return `/m/${encodeURIComponent(manageId)}`
+}
+
+export const QUERY_CONFIG = {
+  STALE_TIME: {
+    USER: 1000 * 60 * 5,
+    STATIC: Infinity,
+    FREQUENT: 1000 * 30,
+  },
+  GC_TIME: {
+    DEFAULT: 1000 * 60 * 30,
+    LONG: 1000 * 60 * 60,
+  },
+  RETRY: {
+    DEFAULT: 3,
+    NONE: 0,
+  },
+} as const
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/core/api/errors.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/core/api/errors.ts
new file mode 100644
index 00000000..85a145b8
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/core/api/errors.ts
@@ -0,0 +1,65 @@
+// ===================
+// ©AngelaMos | 2026
+// errors.ts
+// ===================
+
+export const ApiErrorCode = {
+  NETWORK_ERROR: 'NETWORK_ERROR',
+  PARSE_ERROR: 'PARSE_ERROR',
+  UNKNOWN_ERROR: 'UNKNOWN_ERROR',
+  VALIDATION_ERROR: 'VALIDATION_ERROR',
+  BAD_JSON: 'BAD_JSON',
+  BAD_CURSOR: 'BAD_CURSOR',
+  BAD_PARAM: 'BAD_PARAM',
+  UNKNOWN_TYPE: 'UNKNOWN_TYPE',
+  GENERATE_FAILED: 'GENERATE_FAILED',
+  TURNSTILE_FAILED: 'TURNSTILE_FAILED',
+  NOT_FOUND: 'NOT_FOUND',
+  RATE_LIMITED: 'RATE_LIMITED',
+  INTERNAL_ERROR: 'INTERNAL_ERROR',
+  SERVICE_UNAVAILABLE: 'SERVICE_UNAVAILABLE',
+} as const
+
+export type ApiErrorCode = (typeof ApiErrorCode)[keyof typeof ApiErrorCode]
+
+const USER_FACING_COPY: Partial<Record<string, string>> = {
+  [ApiErrorCode.NETWORK_ERROR]:
+    'Unable to reach the server. Check your connection.',
+  [ApiErrorCode.PARSE_ERROR]: 'Server response did not match expected shape.',
+  [ApiErrorCode.UNKNOWN_ERROR]: 'An unexpected error occurred.',
+  [ApiErrorCode.RATE_LIMITED]: 'Too many requests. Wait a moment, then retry.',
+  [ApiErrorCode.SERVICE_UNAVAILABLE]:
+    'Service is temporarily unavailable. Try again shortly.',
+}
+
+export class ApiError extends Error {
+  readonly code: string
+  readonly statusCode: number
+  readonly fields?: Readonly<Record<string, string>>
+
+  constructor(
+    message: string,
+    code: string,
+    statusCode: number,
+    fields?: Record<string, string>
+  ) {
+    super(message)
+    this.name = 'ApiError'
+    this.code = code
+    this.statusCode = statusCode
+    this.fields = fields
+  }
+
+  getUserMessage(): string {
+    if (this.message.length > 0) {
+      return this.message
+    }
+    return USER_FACING_COPY[this.code] ?? 'An unexpected error occurred.'
+  }
+}
+
+declare module '@tanstack/react-query' {
+  interface Register {
+    defaultError: ApiError
+  }
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/core/api/index.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/core/api/index.ts
new file mode 100644
index 00000000..c939d9a8
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/core/api/index.ts
@@ -0,0 +1,7 @@
+// ===================
+// ©AngelaMos | 2026
+// index.ts
+// ===================
+
+export * from './errors'
+export * from './query.config'
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/core/api/query.config.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/core/api/query.config.ts
new file mode 100644
index 00000000..a8f970cc
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/core/api/query.config.ts
@@ -0,0 +1,108 @@
+// ===================
+// ©AngelaMos | 2026
+// query.config.ts
+// ===================
+
+import { MutationCache, QueryCache, QueryClient } from '@tanstack/react-query'
+import { toast } from 'sonner'
+import { QUERY_CONFIG } from '@/config'
+import { ApiError, ApiErrorCode } from './errors'
+
+const NO_RETRY_ERROR_CODES: ReadonlySet<string> = new Set<string>([
+  ApiErrorCode.VALIDATION_ERROR,
+  ApiErrorCode.BAD_JSON,
+  ApiErrorCode.BAD_CURSOR,
+  ApiErrorCode.BAD_PARAM,
+  ApiErrorCode.UNKNOWN_TYPE,
+  ApiErrorCode.NOT_FOUND,
+  ApiErrorCode.TURNSTILE_FAILED,
+  ApiErrorCode.RATE_LIMITED,
+  ApiErrorCode.PARSE_ERROR,
+])
+
+const shouldRetryQuery = (failureCount: number, error: Error): boolean => {
+  if (error instanceof ApiError && NO_RETRY_ERROR_CODES.has(error.code)) {
+    return false
+  }
+  return failureCount < QUERY_CONFIG.RETRY.DEFAULT
+}
+
+const calculateRetryDelay = (attemptIndex: number): number => {
+  const baseDelay = 1000
+  const maxDelay = 30000
+  return Math.min(baseDelay * 2 ** attemptIndex, maxDelay)
+}
+
+const handleQueryCacheError = (
+  error: Error,
+  query: { state: { data: unknown } }
+): void => {
+  if (query.state.data !== undefined) {
+    const message =
+      error instanceof ApiError
+        ? error.getUserMessage()
+        : 'Background update failed'
+    toast.error(message)
+  }
+}
+
+const handleMutationCacheError = (
+  error: Error,
+  _variables: unknown,
+  _context: unknown,
+  mutation: { options: { onError?: unknown } }
+): void => {
+  if (mutation.options.onError === undefined) {
+    const message =
+      error instanceof ApiError ? error.getUserMessage() : 'Operation failed'
+    toast.error(message)
+  }
+}
+
+export const QUERY_STRATEGIES = {
+  standard: {
+    staleTime: QUERY_CONFIG.STALE_TIME.USER,
+    gcTime: QUERY_CONFIG.GC_TIME.DEFAULT,
+  },
+  frequent: {
+    staleTime: QUERY_CONFIG.STALE_TIME.FREQUENT,
+    gcTime: QUERY_CONFIG.GC_TIME.DEFAULT,
+    refetchInterval: QUERY_CONFIG.STALE_TIME.FREQUENT,
+  },
+  static: {
+    staleTime: QUERY_CONFIG.STALE_TIME.STATIC,
+    gcTime: QUERY_CONFIG.GC_TIME.LONG,
+    refetchOnMount: false,
+    refetchOnWindowFocus: false,
+  },
+  auth: {
+    staleTime: QUERY_CONFIG.STALE_TIME.USER,
+    gcTime: QUERY_CONFIG.GC_TIME.DEFAULT,
+    retry: QUERY_CONFIG.RETRY.NONE,
+  },
+} as const
+
+export type QueryStrategy = keyof typeof QUERY_STRATEGIES
+
+export const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      staleTime: QUERY_CONFIG.STALE_TIME.USER,
+      gcTime: QUERY_CONFIG.GC_TIME.DEFAULT,
+      retry: shouldRetryQuery,
+      retryDelay: calculateRetryDelay,
+      refetchOnWindowFocus: true,
+      refetchOnMount: true,
+      refetchOnReconnect: true,
+    },
+    mutations: {
+      retry: QUERY_CONFIG.RETRY.NONE,
+    },
+  },
+  queryCache: new QueryCache({
+    onError: handleQueryCacheError,
+  }),
+  mutationCache: new MutationCache({
+    onError: handleMutationCacheError,
+  }),
+})
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/core/app/routers.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/core/app/routers.tsx
new file mode 100644
index 00000000..9cc93618
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/core/app/routers.tsx
@@ -0,0 +1,30 @@
+// ===================
+// ©AngelaMos | 2026
+// routers.tsx
+// ===================
+
+import { createBrowserRouter, type RouteObject } from 'react-router-dom'
+import { ROUTES } from '@/config'
+import { Shell } from './shell'
+
+const routes: RouteObject[] = [
+  {
+    element: <Shell />,
+    children: [
+      {
+        path: ROUTES.HOME,
+        lazy: () => import('@/pages/landing'),
+      },
+      {
+        path: ROUTES.MANAGE,
+        lazy: () => import('@/pages/manage'),
+      },
+      {
+        path: '*',
+        lazy: () => import('@/pages/notfound'),
+      },
+    ],
+  },
+]
+
+export const router = createBrowserRouter(routes)
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/core/app/shell.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/core/app/shell.tsx
new file mode 100644
index 00000000..cf21c94c
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/core/app/shell.tsx
@@ -0,0 +1,22 @@
+// ===================
+// ©AngelaMos | 2026
+// shell.tsx
+// ===================
+
+import { Suspense } from 'react'
+import { ErrorBoundary } from 'react-error-boundary'
+import { Outlet } from 'react-router-dom'
+
+function ShellErrorFallback({ error }: { error: Error }): React.ReactElement {
+  return <pre>{error.message}</pre>
+}
+
+export function Shell(): React.ReactElement {
+  return (
+    <ErrorBoundary FallbackComponent={ShellErrorFallback}>
+      <Suspense fallback={null}>
+        <Outlet />
+      </Suspense>
+    </ErrorBoundary>
+  )
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/core/lib/index.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/core/lib/index.ts
new file mode 100644
index 00000000..88da7857
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/core/lib/index.ts
@@ -0,0 +1,4 @@
+// ===================
+// ©AngelaMos | 2026
+// index.ts
+// ===================
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/core/turnstile/index.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/core/turnstile/index.tsx
new file mode 100644
index 00000000..eef6586d
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/core/turnstile/index.tsx
@@ -0,0 +1,136 @@
+// ===================
+// ©AngelaMos | 2026
+// index.tsx
+// ===================
+
+import { useEffect, useRef, useState } from 'react'
+import { setTurnstileTokenProvider } from '@/api'
+
+declare global {
+  interface Window {
+    turnstile?: {
+      render: (
+        container: HTMLElement,
+        options: {
+          sitekey: string
+          callback?: (token: string) => void
+          'expired-callback'?: () => void
+          'error-callback'?: () => void
+          theme?: 'light' | 'dark' | 'auto'
+          appearance?: 'always' | 'execute' | 'interaction-only'
+          size?: 'normal' | 'flexible' | 'compact' | 'invisible'
+        }
+      ) => string
+      reset: (widgetId?: string) => void
+      remove: (widgetId?: string) => void
+    }
+    onloadTurnstileCallback?: () => void
+  }
+}
+
+const TURNSTILE_SRC =
+  'https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit&onload=onloadTurnstileCallback'
+const TURNSTILE_SCRIPT_ID = 'cf-turnstile-script'
+
+function loadTurnstileScript(): Promise<void> {
+  if (typeof window === 'undefined') {
+    return Promise.resolve()
+  }
+  if (window.turnstile) {
+    return Promise.resolve()
+  }
+  return new Promise((resolve, reject) => {
+    const existing = document.getElementById(TURNSTILE_SCRIPT_ID)
+    if (existing) {
+      existing.addEventListener('load', () => resolve(), { once: true })
+      existing.addEventListener(
+        'error',
+        () => reject(new Error('turnstile script failed to load')),
+        { once: true }
+      )
+      return
+    }
+    window.onloadTurnstileCallback = () => resolve()
+    const script = document.createElement('script')
+    script.id = TURNSTILE_SCRIPT_ID
+    script.src = TURNSTILE_SRC
+    script.async = true
+    script.defer = true
+    script.addEventListener(
+      'error',
+      () => reject(new Error('turnstile script failed to load')),
+      { once: true }
+    )
+    document.head.appendChild(script)
+  })
+}
+
+type TurnstileProps = {
+  siteKey: string
+  appearance?: 'always' | 'execute' | 'interaction-only'
+}
+
+export function Turnstile({
+  siteKey,
+  appearance = 'always',
+}: TurnstileProps): React.ReactElement {
+  const containerRef = useRef<HTMLDivElement | null>(null)
+  const widgetIdRef = useRef<string | null>(null)
+  const tokenRef = useRef<string | null>(null)
+  const [status, setStatus] = useState<'idle' | 'ready' | 'error'>('idle')
+
+  useEffect(() => {
+    let cancelled = false
+    setTurnstileTokenProvider(() => tokenRef.current)
+    loadTurnstileScript()
+      .then(() => {
+        if (cancelled || !window.turnstile || !containerRef.current) {
+          return
+        }
+        widgetIdRef.current = window.turnstile.render(containerRef.current, {
+          sitekey: siteKey,
+          appearance,
+          callback: (token: string) => {
+            tokenRef.current = token
+            setStatus('ready')
+          },
+          'expired-callback': () => {
+            tokenRef.current = null
+            setStatus('idle')
+          },
+          'error-callback': () => {
+            tokenRef.current = null
+            setStatus('error')
+          },
+        })
+      })
+      .catch(() => {
+        if (!cancelled) {
+          setStatus('error')
+        }
+      })
+    return () => {
+      cancelled = true
+      setTurnstileTokenProvider(null)
+      if (widgetIdRef.current && window.turnstile) {
+        window.turnstile.remove(widgetIdRef.current)
+        widgetIdRef.current = null
+      }
+      tokenRef.current = null
+    }
+  }, [siteKey, appearance])
+
+  return (
+    <div data-turnstile-status={status}>
+      <div ref={containerRef} />
+    </div>
+  )
+}
+
+export function getTurnstileSiteKey(): string | null {
+  const key = import.meta.env.VITE_TURNSTILE_SITE_KEY
+  if (typeof key !== 'string' || key.length === 0) {
+    return null
+  }
+  return key
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/main.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/main.tsx
new file mode 100644
index 00000000..4d4c1fff
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/main.tsx
@@ -0,0 +1,15 @@
+// ===================
+// ©AngelaMos | 2026
+// main.tsx
+// ===================
+
+import { StrictMode } from 'react'
+import { createRoot } from 'react-dom/client'
+import App from './App'
+import './styles.scss'
+
+createRoot(document.getElementById('root')!).render(
+  <StrictMode>
+    <App />
+  </StrictMode>
+)
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/artifact.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/artifact.tsx
new file mode 100644
index 00000000..ee35b324
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/artifact.tsx
@@ -0,0 +1,193 @@
+// ===================
+// ©AngelaMos | 2026
+// artifact.tsx
+// ===================
+
+import { useEffect, useState } from 'react'
+import { toast } from 'sonner'
+import type { Artifact } from '@/api'
+import { CopyField, Pill } from '@/components'
+import styles from './landing.module.scss'
+
+type ArtifactDisplayProps = {
+  artifact: Artifact
+  filenameFallback: string
+}
+
+export function ArtifactDisplay({
+  artifact,
+  filenameFallback,
+}: ArtifactDisplayProps): React.ReactElement {
+  if (artifact.kind === 'url') {
+    return <UrlArtifact artifact={artifact} />
+  }
+  if (artifact.kind === 'file') {
+    return (
+      <FileArtifact artifact={artifact} filenameFallback={filenameFallback} />
+    )
+  }
+  if (artifact.kind === 'text') {
+    return (
+      <TextArtifact artifact={artifact} filenameFallback={filenameFallback} />
+    )
+  }
+  return <ConnectionStringArtifact artifact={artifact} />
+}
+
+function UrlArtifact({
+  artifact,
+}: {
+  artifact: Extract<Artifact, { kind: 'url' }>
+}): React.ReactElement {
+  const url = artifact.url ?? ''
+  return (
+    <div className={styles.artifactStack}>
+      <CopyField label="TRIGGER URL" value={url} fullWidth />
+      {artifact.destination_url ? (
+        <CopyField
+          label="DESTINATION"
+          value={artifact.destination_url}
+          fullWidth
+        />
+      ) : null}
+    </div>
+  )
+}
+
+function FileArtifact({
+  artifact,
+  filenameFallback,
+}: {
+  artifact: Extract<Artifact, { kind: 'file' }>
+  filenameFallback: string
+}): React.ReactElement {
+  const filename = artifact.filename ?? filenameFallback
+  const contentType = artifact.content_type ?? 'application/octet-stream'
+  const href = useBase64ObjectUrl(artifact.content_b64, contentType)
+
+  if (!href) {
+    return <Pill tone="alarm">artifact unreadable</Pill>
+  }
+
+  return (
+    <div className={styles.artifactStack}>
+      <div className={styles.fileBar}>
+        <span className={styles.fileMeta}>
+          <span className={styles.fileLabel}>FILE</span>
+          <span className={styles.fileName}>{filename}</span>
+          <span className={styles.fileType}>{contentType}</span>
+        </span>
+        <a
+          className={styles.downloadBtn}
+          href={href}
+          download={filename}
+          onClick={() => toast.success(`Issuing ${filename}`)}
+        >
+          download
+        </a>
+      </div>
+    </div>
+  )
+}
+
+function TextArtifact({
+  artifact,
+  filenameFallback,
+}: {
+  artifact: Extract<Artifact, { kind: 'text' }>
+  filenameFallback: string
+}): React.ReactElement {
+  const filename = artifact.filename ?? filenameFallback
+  const content = artifact.content ?? ''
+  const contentType = artifact.content_type ?? 'text/plain'
+  const href = useTextObjectUrl(content, contentType)
+
+  return (
+    <div className={styles.artifactStack}>
+      <div className={styles.fileBar}>
+        <span className={styles.fileMeta}>
+          <span className={styles.fileLabel}>TEXT</span>
+          <span className={styles.fileName}>{filename}</span>
+          <span className={styles.fileType}>{contentType}</span>
+        </span>
+        {href ? (
+          <a className={styles.downloadBtn} href={href} download={filename}>
+            download
+          </a>
+        ) : null}
+      </div>
+      <pre className={styles.textPreview}>{content}</pre>
+    </div>
+  )
+}
+
+function ConnectionStringArtifact({
+  artifact,
+}: {
+  artifact: Extract<Artifact, { kind: 'connection_string' }>
+}): React.ReactElement {
+  const value = artifact.connection_string ?? ''
+  return (
+    <div className={styles.artifactStack}>
+      <CopyField label="CONNECTION" value={value} fullWidth />
+      <p className={styles.note}>
+        Open in any MySQL client. The handshake will trip the trap.
+      </p>
+    </div>
+  )
+}
+
+function useBase64ObjectUrl(
+  b64: string | undefined,
+  contentType: string
+): string | null {
+  const [url, setUrl] = useState<string | null>(null)
+  useEffect(() => {
+    if (!b64 || b64.length === 0) {
+      setUrl(null)
+      return
+    }
+    let created: string | null = null
+    try {
+      const bytes = base64ToBytes(b64)
+      const blob = new Blob([bytes], { type: contentType })
+      created = URL.createObjectURL(blob)
+      setUrl(created)
+    } catch (_err) {
+      setUrl(null)
+    }
+    return () => {
+      if (created !== null) {
+        URL.revokeObjectURL(created)
+      }
+    }
+  }, [b64, contentType])
+  return url
+}
+
+function useTextObjectUrl(content: string, contentType: string): string | null {
+  const [url, setUrl] = useState<string | null>(null)
+  useEffect(() => {
+    if (content.length === 0) {
+      setUrl(null)
+      return
+    }
+    const blob = new Blob([content], { type: contentType })
+    const next = URL.createObjectURL(blob)
+    setUrl(next)
+    return () => {
+      URL.revokeObjectURL(next)
+    }
+  }, [content, contentType])
+  return url
+}
+
+function base64ToBytes(b64: string): Uint8Array<ArrayBuffer> {
+  const binary = atob(b64)
+  const len = binary.length
+  const bytes = new Uint8Array(len)
+  for (let i = 0; i < len; i += 1) {
+    bytes[i] = binary.charCodeAt(i)
+  }
+  return bytes
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/copy.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/copy.ts
new file mode 100644
index 00000000..b5ede77e
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/copy.ts
@@ -0,0 +1,61 @@
+// ===================
+// ©AngelaMos | 2026
+// copy.ts
+// ===================
+
+import type { TokenType } from '@/api'
+
+export const PAGE_COPY = {
+  HEADLINE: 'CANARIES',
+  HEADLINE_LATIN: 'Serinus Canaria · token-form (n.)',
+  HEADLINE_PURPOSE:
+    'Field-deployable trip-wires for the quiet hours. Each specimen waits in place, reports when touched, and leaves a forensic note behind.',
+  STRIP_FIELD_STATION: 'FIELD STATION',
+  STRIP_ISSUE: 'ISSUE',
+  STRIP_VOLUME: 'VOL.001',
+  STRIP_FOLIO: 'FOLIO',
+  SECTION_01_INDEX: '01 / SPECIES',
+  SECTION_01_TITLE: 'SELECT SPECIES',
+  SECTION_01_BODY:
+    'Each type lives in a different habitat. Pick the one that fits where the trap will be set.',
+  SECTION_02_INDEX: '02 / FIELD LABEL',
+  SECTION_02_TITLE: 'ANNOTATE THE SPECIMEN',
+  SECTION_02_BODY:
+    'A short note describing where this specimen will be deployed. You will see it again when the trap reports.',
+  SECTION_03_INDEX: '03 / ALERT ROUTE',
+  SECTION_03_TITLE: 'ROUTE THE REPORT',
+  SECTION_03_BODY:
+    'When the trap is touched, where should the message land? Choose one channel.',
+  SECTION_04_INDEX: '04 / SPECIES CONFIG',
+  SECTION_04_BODY: 'Configuration specific to the chosen species.',
+  SECTION_05_INDEX: '05 / VERIFY',
+  SECTION_05_BODY:
+    'A one-touch human check from Cloudflare. Skipped in development.',
+  SUBMIT_LABEL: 'Release specimen',
+  ISSUE_ANOTHER_LABEL: 'Release another',
+  RESULT_HEADLINE: 'SPECIMEN ISSUED',
+  RESULT_BODY:
+    'The trap is live. Keep the manage URL safe — it is the only way back to this dossier.',
+} as const
+
+export const TOKEN_BLURB: Record<TokenType, string> = {
+  webbug:
+    '1×1 transparent pixel. Embed anywhere an <img> works — emails, wiki pages, slide decks.',
+  slowredirect:
+    'A redirect that pauses to fingerprint the visitor before delivering them. Drop-in short link replacement.',
+  docx: 'A Word document that phones home the moment Word renders its footer.',
+  pdf: 'A PDF whose embedded URI action fires in Adobe Reader. Quiet against Chromium / PDF.js.',
+  kubeconfig:
+    'A kubeconfig pointing at a fake Kubernetes API. kubectl calls trigger and are recorded with their verb + path.',
+  envfile:
+    'A plausible-looking .env file with bait credentials and one disguised canary URL.',
+  mysql:
+    'A fake MySQL server that answers the handshake, captures the username, then 1045 ACCESS DENIED.',
+}
+
+export const ARTIFACT_LABEL = {
+  url: 'TRIGGER URL',
+  file: 'DOWNLOAD',
+  text: 'CONTENT',
+  connection_string: 'CONNECTION STRING',
+} as const
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/form-state.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/form-state.ts
new file mode 100644
index 00000000..e3fd3e4d
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/form-state.ts
@@ -0,0 +1,136 @@
+// ===================
+// ©AngelaMos | 2026
+// form-state.ts
+// ===================
+
+import {
+  type CreateTokenInput,
+  createTokenRequestSchema,
+  type EnvfileIncludeKey,
+  type TokenType,
+  type TypeDescriptor,
+} from '@/api'
+import { ApiError } from '@/core/api'
+
+export type FormState = {
+  type: TokenType | ''
+  memo: string
+  filename: string
+  alertChannel: 'telegram' | 'webhook'
+  telegramBot: string
+  telegramChat: string
+  webhookUrl: string
+  slowredirectDestination: string
+  envfileIncludeKeys: EnvfileIncludeKey[]
+}
+
+export const INITIAL_FORM: FormState = {
+  type: '',
+  memo: '',
+  filename: '',
+  alertChannel: 'telegram',
+  telegramBot: '',
+  telegramChat: '',
+  webhookUrl: '',
+  slowredirectDestination: '',
+  envfileIncludeKeys: ['aws', 'stripe', 'db'],
+}
+
+export const FILE_KIND_TYPES = new Set<TokenType>([
+  'docx',
+  'pdf',
+  'kubeconfig',
+  'envfile',
+])
+
+export function descriptorFor(
+  descriptors: TypeDescriptor[],
+  type: TokenType | ''
+): TypeDescriptor | undefined {
+  if (type === '') {
+    return undefined
+  }
+  return descriptors.find((d) => d.type === type)
+}
+
+export function buildPayload(form: FormState): CreateTokenInput {
+  if (form.type === '') {
+    throw new Error('species not selected')
+  }
+  const payload: CreateTokenInput = {
+    type: form.type,
+    memo: form.memo,
+    alert_channel: form.alertChannel,
+  }
+  if (form.filename.length > 0) {
+    payload.filename = form.filename
+  }
+  if (form.alertChannel === 'telegram') {
+    payload.telegram_bot = form.telegramBot
+    payload.telegram_chat = form.telegramChat
+  } else {
+    payload.webhook_url = form.webhookUrl
+  }
+  if (form.type === 'slowredirect') {
+    payload.metadata = { destination_url: form.slowredirectDestination }
+  } else if (form.type === 'envfile') {
+    payload.metadata = { include_keys: form.envfileIncludeKeys }
+  }
+  return payload
+}
+
+export type FieldErrors = Partial<Record<string, string>>
+
+const BACKEND_TO_FORM_FIELD: Readonly<Record<string, string>> = {
+  type: 'type',
+  memo: 'memo',
+  filename: 'filename',
+  alert_channel: 'alert_channel',
+  telegram_bot: 'telegram_bot',
+  telegram_chat: 'telegram_chat',
+  webhook_url: 'webhook_url',
+  'metadata.destination_url': 'metadata.destination_url',
+  'metadata.include_keys': 'metadata.include_keys',
+}
+
+export function buildSubmissionState(error: unknown): {
+  errors: FieldErrors
+} {
+  if (!(error instanceof ApiError) || !error.fields) {
+    return { errors: { form: 'submission failed — try again' } }
+  }
+  const errors: FieldErrors = {}
+  for (const [key, value] of Object.entries(error.fields)) {
+    const mapped = BACKEND_TO_FORM_FIELD[key] ?? key
+    errors[mapped] = value
+  }
+  return { errors }
+}
+
+export function validateForm(form: FormState): {
+  ok: boolean
+  errors: FieldErrors
+  payload: CreateTokenInput | null
+} {
+  if (form.type === '') {
+    return { ok: false, errors: { type: 'select a species' }, payload: null }
+  }
+  let payload: CreateTokenInput
+  try {
+    payload = buildPayload(form)
+  } catch (_err) {
+    return { ok: false, errors: { type: 'select a species' }, payload: null }
+  }
+  const parsed = createTokenRequestSchema.safeParse(payload)
+  if (parsed.success) {
+    return { ok: true, errors: {}, payload }
+  }
+  const errors: FieldErrors = {}
+  for (const issue of parsed.error.issues) {
+    const key = issue.path.join('.') || 'form'
+    if (errors[key] === undefined) {
+      errors[key] = issue.message
+    }
+  }
+  return { ok: false, errors, payload: null }
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/index.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/index.tsx
new file mode 100644
index 00000000..a541d960
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/index.tsx
@@ -0,0 +1,572 @@
+// ===================
+// ©AngelaMos | 2026
+// index.tsx
+// ===================
+
+import { useMemo, useState } from 'react'
+import { toast } from 'sonner'
+import {
+  type CreateTokenResponse,
+  type EnvfileIncludeKey,
+  envfileIncludeKeySchema,
+  type TokenType,
+  type TypeDescriptor,
+  useCreateToken,
+  useTokenTypes,
+} from '@/api'
+import {
+  Button,
+  Halftone,
+  Strip,
+  StripItem,
+  TextareaField,
+  TextField,
+} from '@/components'
+import { getTurnstileSiteKey, Turnstile } from '@/core/turnstile'
+import { PAGE_COPY } from './copy'
+import {
+  buildSubmissionState,
+  FILE_KIND_TYPES,
+  type FieldErrors,
+  type FormState,
+  INITIAL_FORM,
+  validateForm,
+} from './form-state'
+import styles from './landing.module.scss'
+import { ResultView } from './result'
+import { TypePicker } from './type-picker'
+
+const ENVFILE_KEYS = envfileIncludeKeySchema.options
+
+export function Component(): React.ReactElement {
+  const typesQuery = useTokenTypes()
+  const createMutation = useCreateToken()
+  const [form, setForm] = useState<FormState>(INITIAL_FORM)
+  const [errors, setErrors] = useState<FieldErrors>({})
+  const [created, setCreated] = useState<CreateTokenResponse | null>(null)
+  const turnstileSiteKey = useMemo(() => getTurnstileSiteKey(), [])
+
+  function patchForm(next: Partial<FormState>): void {
+    setForm((prev) => ({ ...prev, ...next }))
+  }
+
+  function handleSubmit(event: React.FormEvent<HTMLFormElement>): void {
+    event.preventDefault()
+    const result = validateForm(form)
+    setErrors(result.errors)
+    if (!result.ok || !result.payload) {
+      toast.error('Some fields need attention')
+      return
+    }
+    createMutation.mutate(result.payload, {
+      onSuccess: (data) => {
+        setCreated(data)
+        toast.success('Specimen released')
+      },
+      onError: (error) => {
+        const submission = buildSubmissionState(error)
+        setErrors(submission.errors)
+      },
+    })
+  }
+
+  function handleAnother(): void {
+    setCreated(null)
+    setErrors({})
+    setForm((prev) => ({ ...prev, memo: '', filename: '' }))
+  }
+
+  return (
+    <div className={styles.page}>
+      <Strip>
+        <StripItem label={PAGE_COPY.STRIP_FIELD_STATION}>canary</StripItem>
+        <StripItem label={PAGE_COPY.STRIP_VOLUME}>2026·05</StripItem>
+        <StripItem label={PAGE_COPY.STRIP_ISSUE} inverted>
+          {created ? 'DOSSIER' : 'INTAKE'}
+        </StripItem>
+      </Strip>
+
+      <header className={styles.hero}>
+        <h1 className={styles.headline}>{PAGE_COPY.HEADLINE}</h1>
+        <p className={styles.latin}>{PAGE_COPY.HEADLINE_LATIN}</p>
+        <p className={styles.purpose}>{PAGE_COPY.HEADLINE_PURPOSE}</p>
+      </header>
+
+      <Halftone density="sparse" height={18} />
+
+      <main className={styles.main}>
+        {created ? (
+          <ResultView
+            data={created}
+            onAnother={handleAnother}
+            filenameFallback={form.filename || defaultFilename(form.type)}
+          />
+        ) : (
+          <FormView
+            form={form}
+            errors={errors}
+            descriptors={typesQuery.data ?? []}
+            descriptorsLoading={typesQuery.isLoading}
+            descriptorsError={typesQuery.error}
+            turnstileSiteKey={turnstileSiteKey}
+            submitting={createMutation.isPending}
+            onChange={patchForm}
+            onSubmit={handleSubmit}
+          />
+        )}
+      </main>
+
+      <Strip align="left" border="top">
+        <StripItem label="ROUTING">cloudflare tunnel</StripItem>
+        <StripItem label="ALERTS">telegram / webhook</StripItem>
+        <StripItem label="LICENSE">©AngelaMos 2026</StripItem>
+      </Strip>
+    </div>
+  )
+}
+
+Component.displayName = 'Landing'
+
+type FormViewProps = {
+  form: FormState
+  errors: FieldErrors
+  descriptors: TypeDescriptor[]
+  descriptorsLoading: boolean
+  descriptorsError: Error | null
+  turnstileSiteKey: string | null
+  submitting: boolean
+  onChange: (next: Partial<FormState>) => void
+  onSubmit: (event: React.FormEvent<HTMLFormElement>) => void
+}
+
+function FormView({
+  form,
+  errors,
+  descriptors,
+  descriptorsLoading,
+  descriptorsError,
+  turnstileSiteKey,
+  submitting,
+  onChange,
+  onSubmit,
+}: FormViewProps): React.ReactElement {
+  const showTypeMetadata = form.type === 'slowredirect' || form.type === 'envfile'
+  return (
+    <form className={styles.form} onSubmit={onSubmit} noValidate>
+      <SpeciesSection
+        form={form}
+        errors={errors}
+        descriptors={descriptors}
+        descriptorsLoading={descriptorsLoading}
+        descriptorsError={descriptorsError}
+        onChange={onChange}
+      />
+      <AnnotateSection form={form} errors={errors} onChange={onChange} />
+      <RouteSection form={form} errors={errors} onChange={onChange} />
+      {showTypeMetadata ? (
+        <ConfigSection form={form} errors={errors} onChange={onChange} />
+      ) : null}
+      {turnstileSiteKey ? <VerifySection siteKey={turnstileSiteKey} /> : null}
+      <SubmitFooter submitting={submitting} />
+    </form>
+  )
+}
+
+type SectionPropsBase = {
+  form: FormState
+  errors: FieldErrors
+  onChange: (next: Partial<FormState>) => void
+}
+
+type SpeciesSectionProps = SectionPropsBase & {
+  descriptors: TypeDescriptor[]
+  descriptorsLoading: boolean
+  descriptorsError: Error | null
+}
+
+function SpeciesSection({
+  form,
+  errors,
+  descriptors,
+  descriptorsLoading,
+  descriptorsError,
+  onChange,
+}: SpeciesSectionProps): React.ReactElement {
+  return (
+    <Section
+      index={PAGE_COPY.SECTION_01_INDEX}
+      title={PAGE_COPY.SECTION_01_TITLE}
+      body={PAGE_COPY.SECTION_01_BODY}
+    >
+      {descriptorsError ? (
+        <p className={styles.errorBlock}>
+          Could not load species catalog. Try again in a moment.
+        </p>
+      ) : descriptorsLoading ? (
+        <p className={styles.statusBlock}>Loading species catalog…</p>
+      ) : (
+        <TypePicker
+          descriptors={descriptors}
+          value={form.type}
+          onChange={(t) => onChange({ type: t })}
+          invalid={errors.type !== undefined}
+        />
+      )}
+      {errors.type ? <p className={styles.fieldError}>{errors.type}</p> : null}
+    </Section>
+  )
+}
+
+function AnnotateSection({
+  form,
+  errors,
+  onChange,
+}: SectionPropsBase): React.ReactElement {
+  const showFilename =
+    form.type !== '' && FILE_KIND_TYPES.has(form.type as TokenType)
+  return (
+    <Section
+      index={PAGE_COPY.SECTION_02_INDEX}
+      title={PAGE_COPY.SECTION_02_TITLE}
+      body={PAGE_COPY.SECTION_02_BODY}
+    >
+      <TextareaField
+        index="A"
+        label="MEMO"
+        name="memo"
+        value={form.memo}
+        maxLength={256}
+        placeholder="Q4 bonuses spreadsheet on file-server"
+        onChange={(e) => onChange({ memo: e.target.value })}
+        error={errors.memo}
+        hint={`${form.memo.length} / 256 characters`}
+      />
+      {showFilename ? (
+        <FilenameField form={form} errors={errors} onChange={onChange} />
+      ) : null}
+    </Section>
+  )
+}
+
+function FilenameField({
+  form,
+  errors,
+  onChange,
+}: SectionPropsBase): React.ReactElement {
+  return (
+    <TextField
+      index="B"
+      label="FILENAME (OPTIONAL)"
+      name="filename"
+      value={form.filename}
+      maxLength={128}
+      placeholder={defaultFilename(form.type)}
+      onChange={(e) => onChange({ filename: e.target.value })}
+      error={errors.filename}
+      hint="What the bait file will be called when it lands somewhere it shouldn't."
+    />
+  )
+}
+
+function RouteSection({
+  form,
+  errors,
+  onChange,
+}: SectionPropsBase): React.ReactElement {
+  return (
+    <Section
+      index={PAGE_COPY.SECTION_03_INDEX}
+      title="ROUTE THE REPORT"
+      body={PAGE_COPY.SECTION_03_BODY}
+    >
+      <ChannelToggle
+        value={form.alertChannel}
+        onChange={(c) => onChange({ alertChannel: c })}
+      />
+      {form.alertChannel === 'telegram' ? (
+        <TelegramFields form={form} errors={errors} onChange={onChange} />
+      ) : (
+        <WebhookField form={form} errors={errors} onChange={onChange} />
+      )}
+    </Section>
+  )
+}
+
+function TelegramFields({
+  form,
+  errors,
+  onChange,
+}: SectionPropsBase): React.ReactElement {
+  return (
+    <div className={styles.subgrid}>
+      <TextField
+        index="A"
+        label="BOT TOKEN"
+        name="telegram_bot"
+        value={form.telegramBot}
+        placeholder="123456789:ABCdefGHIjklMNO..."
+        onChange={(e) => onChange({ telegramBot: e.target.value })}
+        error={errors.telegram_bot}
+      />
+      <TextField
+        index="B"
+        label="CHAT ID"
+        name="telegram_chat"
+        value={form.telegramChat}
+        placeholder="-1001234567890"
+        onChange={(e) => onChange({ telegramChat: e.target.value })}
+        error={errors.telegram_chat}
+      />
+    </div>
+  )
+}
+
+function WebhookField({
+  form,
+  errors,
+  onChange,
+}: SectionPropsBase): React.ReactElement {
+  return (
+    <TextField
+      index="A"
+      label="WEBHOOK URL"
+      name="webhook_url"
+      type="url"
+      value={form.webhookUrl}
+      placeholder="https://hooks.example.com/canary"
+      onChange={(e) => onChange({ webhookUrl: e.target.value })}
+      error={errors.webhook_url}
+      hint="We POST the alert envelope JSON. Optionally HMAC-signed if the server has WEBHOOK_HMAC_SECRET set."
+    />
+  )
+}
+
+function ConfigSection({
+  form,
+  errors,
+  onChange,
+}: SectionPropsBase): React.ReactElement {
+  const body =
+    form.type === 'slowredirect'
+      ? 'Visitors will be fingerprinted, then redirected here.'
+      : 'Bait credentials to ship alongside the disguised canary URL.'
+  return (
+    <Section
+      index={PAGE_COPY.SECTION_04_INDEX}
+      title={descriptorTitle(form.type)}
+      body={body}
+    >
+      {form.type === 'slowredirect' ? (
+        <SlowRedirectField form={form} errors={errors} onChange={onChange} />
+      ) : (
+        <IncludeKeysPicker
+          value={form.envfileIncludeKeys}
+          onChange={(k) => onChange({ envfileIncludeKeys: k })}
+        />
+      )}
+    </Section>
+  )
+}
+
+function SlowRedirectField({
+  form,
+  errors,
+  onChange,
+}: SectionPropsBase): React.ReactElement {
+  return (
+    <TextField
+      index="A"
+      label="DESTINATION URL"
+      name="metadata_destination_url"
+      type="url"
+      value={form.slowredirectDestination}
+      placeholder="https://example.com/landing"
+      onChange={(e) => onChange({ slowredirectDestination: e.target.value })}
+      error={errors['metadata.destination_url']}
+    />
+  )
+}
+
+function VerifySection({ siteKey }: { siteKey: string }): React.ReactElement {
+  return (
+    <Section
+      index={PAGE_COPY.SECTION_05_INDEX}
+      title="VERIFY"
+      body={PAGE_COPY.SECTION_05_BODY}
+    >
+      <div className={styles.turnstile}>
+        <Turnstile siteKey={siteKey} />
+      </div>
+    </Section>
+  )
+}
+
+function SubmitFooter({
+  submitting,
+}: {
+  submitting: boolean
+}): React.ReactElement {
+  return (
+    <div className={styles.submitRow}>
+      <p className={styles.submitNote}>
+        We never see the alert payload — it routes directly from server to your
+        channel.
+      </p>
+      <Button type="submit" size="lg" busy={submitting}>
+        {PAGE_COPY.SUBMIT_LABEL}
+      </Button>
+    </div>
+  )
+}
+
+type SectionProps = React.PropsWithChildren<{
+  index: string
+  title: string
+  body: string
+}>
+
+function Section({
+  index,
+  title,
+  body,
+  children,
+}: SectionProps): React.ReactElement {
+  return (
+    <section className={styles.section}>
+      <header className={styles.sectionHead}>
+        <span className={styles.sectionIndex}>{index}</span>
+        <span className={styles.sectionRule} aria-hidden="true" />
+      </header>
+      <h2 className={styles.sectionTitle}>{title}</h2>
+      <p className={styles.sectionBody}>{body}</p>
+      <div className={styles.sectionContent}>{children}</div>
+    </section>
+  )
+}
+
+type ChannelToggleProps = {
+  value: 'telegram' | 'webhook'
+  onChange: (next: 'telegram' | 'webhook') => void
+}
+
+function ChannelToggle({
+  value,
+  onChange,
+}: ChannelToggleProps): React.ReactElement {
+  return (
+    <fieldset className={styles.channelToggle}>
+      <legend className={styles.srOnly}>Alert channel</legend>
+      <ChannelOption
+        name="alert-channel"
+        value="telegram"
+        active={value === 'telegram'}
+        onChange={() => onChange('telegram')}
+        label="Telegram"
+        note="message lands in a chat"
+      />
+      <ChannelOption
+        name="alert-channel"
+        value="webhook"
+        active={value === 'webhook'}
+        onChange={() => onChange('webhook')}
+        label="Webhook"
+        note="JSON POST to your URL"
+      />
+    </fieldset>
+  )
+}
+
+function ChannelOption({
+  name,
+  value,
+  active,
+  onChange,
+  label,
+  note,
+}: {
+  name: string
+  value: string
+  active: boolean
+  onChange: () => void
+  label: string
+  note: string
+}): React.ReactElement {
+  return (
+    <label className={styles.channelOption} data-active={active}>
+      <input
+        className={styles.srOnly}
+        type="radio"
+        name={name}
+        value={value}
+        checked={active}
+        onChange={onChange}
+      />
+      <span className={styles.channelLabel}>{label}</span>
+      <span className={styles.channelNote}>{note}</span>
+    </label>
+  )
+}
+
+type IncludeKeysPickerProps = {
+  value: EnvfileIncludeKey[]
+  onChange: (next: EnvfileIncludeKey[]) => void
+}
+
+function IncludeKeysPicker({
+  value,
+  onChange,
+}: IncludeKeysPickerProps): React.ReactElement {
+  function toggle(key: EnvfileIncludeKey): void {
+    if (value.includes(key)) {
+      onChange(value.filter((k) => k !== key))
+    } else {
+      onChange([...value, key])
+    }
+  }
+  return (
+    <fieldset className={styles.keyGrid}>
+      <legend className={styles.srOnly}>Include keys</legend>
+      {ENVFILE_KEYS.map((key) => {
+        const checked = value.includes(key)
+        return (
+          <label key={key} className={styles.keyChip} data-selected={checked}>
+            <input
+              className={styles.srOnly}
+              type="checkbox"
+              name="envfile-keys"
+              value={key}
+              checked={checked}
+              onChange={() => toggle(key)}
+            />
+            <span className={styles.keyName}>{key}</span>
+          </label>
+        )
+      })}
+    </fieldset>
+  )
+}
+
+function defaultFilename(type: TokenType | ''): string {
+  switch (type) {
+    case 'docx':
+      return 'Q4_Bonuses_2024.docx'
+    case 'pdf':
+      return 'Confidential_Report.pdf'
+    case 'kubeconfig':
+      return 'kubeconfig'
+    case 'envfile':
+      return '.env'
+    default:
+      return ''
+  }
+}
+
+function descriptorTitle(type: TokenType | ''): string {
+  if (type === 'slowredirect') {
+    return 'SLOWREDIRECT CONFIG'
+  }
+  if (type === 'envfile') {
+    return 'ENVFILE CONFIG'
+  }
+  return 'CONFIG'
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/landing.module.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/landing.module.scss
new file mode 100644
index 00000000..5e207365
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/landing.module.scss
@@ -0,0 +1,628 @@
+// ===================
+// ©AngelaMos | 2026
+// landing.module.scss
+// ===================
+
+@use '../../styles/tokens' as *;
+@use '../../styles/fonts' as *;
+@use '../../styles/mixins' as *;
+
+.page {
+  display: flex;
+  flex-direction: column;
+  flex: 1 1 auto;
+  inline-size: 100%;
+  max-inline-size: 88rem;
+  margin-inline: auto;
+  padding-inline: $space-4;
+  padding-block-end: $space-8;
+  gap: $space-6;
+
+  @include breakpoint-up('md') {
+    padding-inline: $space-8;
+    gap: $space-8;
+  }
+}
+
+.hero {
+  display: flex;
+  flex-direction: column;
+  gap: $space-3;
+  padding-block-start: $space-6;
+  max-inline-size: 56rem;
+
+  @include breakpoint-up('md') {
+    padding-block-start: $space-10;
+  }
+}
+
+.headline {
+  font-family: $font-display;
+  font-size: clamp(3rem, 11vw, 8.5rem);
+  letter-spacing: -0.04em;
+  line-height: 0.88;
+  color: $ink;
+  margin: 0;
+  text-transform: uppercase;
+}
+
+.latin {
+  font-family: $font-mono;
+  font-size: $font-size-xs;
+  letter-spacing: $tracking-wider;
+  color: $ink-soft;
+  margin: 0;
+  text-transform: lowercase;
+  font-style: italic;
+}
+
+.purpose {
+  font-family: $font-sans;
+  font-size: clamp(0.95rem, 1.6vw, 1.125rem);
+  line-height: $line-height-snug;
+  color: $ink;
+  max-inline-size: 42rem;
+  margin: 0;
+  margin-block-start: $space-3;
+  text-wrap: balance;
+}
+
+.main {
+  display: flex;
+  flex-direction: column;
+  flex: 1 1 auto;
+  gap: $space-8;
+  padding-block-start: $space-2;
+}
+
+.form {
+  display: flex;
+  flex-direction: column;
+  gap: $space-10;
+  max-inline-size: 56rem;
+  inline-size: 100%;
+}
+
+.section {
+  display: flex;
+  flex-direction: column;
+  gap: $space-3;
+}
+
+.sectionHead {
+  display: flex;
+  align-items: center;
+  gap: $space-3;
+}
+
+.sectionIndex {
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink-mute;
+  white-space: nowrap;
+}
+
+.sectionRule {
+  flex: 1 1 auto;
+  block-size: $hairline;
+  background-color: $rule-hair;
+}
+
+.sectionTitle {
+  font-family: $font-sans;
+  font-weight: 700;
+  font-size: clamp(1.5rem, 3vw, 2.25rem);
+  letter-spacing: -0.03em;
+  line-height: $line-height-tight;
+  text-transform: uppercase;
+  color: $ink;
+  margin: 0;
+}
+
+.sectionBody {
+  font-family: $font-sans;
+  font-size: $font-size-sm;
+  line-height: $line-height-snug;
+  color: $ink-soft;
+  max-inline-size: 38rem;
+  margin: 0;
+}
+
+.sectionContent {
+  display: flex;
+  flex-direction: column;
+  gap: $space-5;
+  padding-block-start: $space-3;
+}
+
+.typeGrid {
+  display: grid;
+  grid-template-columns: 1fr;
+  gap: $space-3;
+  border: none;
+  padding: 0;
+  margin: 0;
+  min-inline-size: 0;
+
+  &[data-invalid='true'] {
+    outline: $hairline solid $alarm;
+    outline-offset: $space-2;
+  }
+
+  @include breakpoint-up('sm') {
+    grid-template-columns: repeat(2, 1fr);
+  }
+
+  @include breakpoint-up('md') {
+    grid-template-columns: repeat(3, 1fr);
+  }
+
+  @include breakpoint-up('lg') {
+    grid-template-columns: repeat(4, 1fr);
+  }
+}
+
+.srOnly {
+  position: absolute;
+  inline-size: 1px;
+  block-size: 1px;
+  margin: -1px;
+  padding: 0;
+  overflow: hidden;
+  clip: rect(0 0 0 0);
+  clip-path: inset(50%);
+  white-space: nowrap;
+  border: 0;
+}
+
+.typeCard {
+  position: relative;
+  display: grid;
+  grid-template-areas:
+    'idx glyph'
+    'name name'
+    'code code'
+    'blur blur';
+  grid-template-columns: auto 1fr;
+  align-items: start;
+  gap: $space-2 $space-3;
+  padding: $space-4;
+  background-color: $paper;
+  border: $hairline solid $rule;
+  text-align: left;
+  cursor: pointer;
+  transition: background-color $duration-fast $ease-out,
+    color $duration-fast $ease-out;
+
+  &:hover {
+    background-color: $paper-deep;
+  }
+
+  &:focus-visible {
+    outline: $hairline-bold solid $ink;
+    outline-offset: $space-1;
+  }
+
+  &[data-selected='true'] {
+    background-color: $ink;
+    color: $paper;
+    border-color: $ink;
+
+    .typeIndex,
+    .typeCode {
+      color: $paper-edge;
+    }
+
+    .typeBlurb {
+      color: $paper-edge;
+    }
+  }
+
+  &[data-disabled='true'] {
+    cursor: not-allowed;
+    background-color: $paper-deep;
+    border-color: $rule-soft;
+    border-style: dashed;
+    opacity: 0.55;
+
+    &:hover {
+      background-color: $paper-deep;
+    }
+
+    .typeIndex,
+    .typeName,
+    .typeCode,
+    .typeBlurb {
+      color: $ink-mute;
+    }
+
+    .typeGlyph {
+      opacity: 0.5;
+    }
+  }
+}
+
+.typeDisabledTag {
+  position: absolute;
+  inset-block-start: $space-2;
+  inset-inline-end: $space-2;
+  padding-block: 2px;
+  padding-inline: $space-1-5;
+  background-color: $paper;
+  border: $hairline solid $rule-soft;
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink-mute;
+}
+
+.typeIndex {
+  grid-area: idx;
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  color: $ink-mute;
+}
+
+.typeGlyph {
+  grid-area: glyph;
+  justify-self: end;
+  color: inherit;
+}
+
+.typeName {
+  grid-area: name;
+  font-family: $font-sans;
+  font-weight: 700;
+  font-size: $font-size-lg;
+  line-height: $line-height-tight;
+  letter-spacing: -0.02em;
+  color: inherit;
+}
+
+.typeCode {
+  grid-area: code;
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink-mute;
+}
+
+.typeBlurb {
+  grid-area: blur;
+  font-size: $font-size-xs;
+  line-height: $line-height-snug;
+  color: $ink-soft;
+}
+
+.fieldError {
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $alarm;
+  margin: 0;
+}
+
+.errorBlock,
+.statusBlock {
+  padding: $space-4;
+  border: $hairline solid $rule;
+  background-color: $paper-deep;
+  font-family: $font-mono;
+  font-size: $font-size-xs;
+  letter-spacing: $tracking-wide;
+  color: $ink-soft;
+}
+
+.errorBlock {
+  border-color: $alarm;
+  color: $alarm-deep;
+}
+
+.channelToggle {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 0;
+  border: $hairline solid $rule;
+  padding: 0;
+  margin: 0;
+  min-inline-size: 0;
+}
+
+.channelOption {
+  display: flex;
+  flex-direction: column;
+  align-items: flex-start;
+  gap: $space-1;
+  padding-block: $space-3;
+  padding-inline: $space-4;
+  background-color: $paper;
+  text-align: left;
+  cursor: pointer;
+  border: none;
+  transition: background-color $duration-fast $ease-out;
+
+  &:hover {
+    background-color: $paper-deep;
+  }
+
+  & + & {
+    border-inline-start: $hairline solid $rule;
+  }
+
+  &[data-active='true'] {
+    background-color: $ink;
+    color: $paper;
+  }
+}
+
+.channelLabel {
+  font-family: $font-mono;
+  font-size: $font-size-2xs;
+  font-weight: $font-weight-semibold;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: inherit;
+}
+
+.channelNote {
+  font-size: $font-size-xs;
+  color: inherit;
+  opacity: 0.7;
+}
+
+.subgrid {
+  display: grid;
+  grid-template-columns: 1fr;
+  gap: $space-4;
+
+  @include breakpoint-up('md') {
+    grid-template-columns: 1fr 1fr;
+  }
+}
+
+.keyGrid {
+  display: grid;
+  grid-template-columns: repeat(2, 1fr);
+  gap: $space-2;
+  border: none;
+  padding: 0;
+  margin: 0;
+  min-inline-size: 0;
+
+  @include breakpoint-up('sm') {
+    grid-template-columns: repeat(4, 1fr);
+  }
+}
+
+.keyChip {
+  padding-block: $space-3;
+  padding-inline: $space-3;
+  border: $hairline solid $rule;
+  background-color: $paper;
+  font-family: $font-mono;
+  font-size: $font-size-2xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink;
+  cursor: pointer;
+  transition: background-color $duration-fast $ease-out;
+
+  &:hover {
+    background-color: $paper-deep;
+  }
+
+  &[data-selected='true'] {
+    background-color: $ink;
+    color: $paper;
+    border-color: $ink;
+  }
+}
+
+.keyName {
+  display: inline-block;
+}
+
+.turnstile {
+  display: flex;
+  align-items: center;
+  padding: $space-3;
+  border: $hairline solid $rule-hair;
+  background-color: $paper-deep;
+}
+
+.submitRow {
+  display: flex;
+  flex-direction: column;
+  gap: $space-3;
+  align-items: stretch;
+  padding-block-start: $space-4;
+  border-block-start: $hairline solid $rule;
+
+  @include breakpoint-up('md') {
+    flex-direction: row;
+    align-items: center;
+    justify-content: space-between;
+  }
+}
+
+.submitNote {
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wide;
+  text-transform: uppercase;
+  color: $ink-mute;
+  margin: 0;
+  max-inline-size: 28rem;
+}
+
+// ----------------------------------------------------------------------------
+// RESULT
+// ----------------------------------------------------------------------------
+
+.result {
+  display: flex;
+  flex-direction: column;
+  gap: $space-6;
+  max-inline-size: 56rem;
+}
+
+.resultHead {
+  display: grid;
+  grid-template-columns: auto 1fr;
+  grid-template-rows: auto auto;
+  align-items: baseline;
+  gap: $space-2 $space-3;
+}
+
+.resultMarker {
+  grid-row: 1 / span 2;
+  font-size: clamp(2.5rem, 5vw, 4rem);
+  line-height: 1;
+  color: $alarm;
+  align-self: start;
+  font-family: $font-sans;
+}
+
+.resultHeadline {
+  grid-row: 1;
+  grid-column: 2;
+  font-family: $font-display;
+  font-size: clamp(2rem, 5vw, 3.5rem);
+  letter-spacing: -0.03em;
+  line-height: 0.92;
+  text-transform: uppercase;
+  color: $ink;
+  margin: 0;
+}
+
+.resultBody {
+  grid-row: 2;
+  grid-column: 2;
+  font-family: $font-sans;
+  font-size: $font-size-sm;
+  line-height: $line-height-snug;
+  color: $ink-soft;
+  margin: 0;
+}
+
+.resultFoot {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: $space-3;
+  flex-wrap: wrap;
+}
+
+.resultLink {
+  font-family: $font-mono;
+  font-size: $font-size-xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink;
+  text-decoration: none;
+  border-block-end: $hairline solid $ink;
+  padding-block-end: $space-0-5;
+  transition: color $duration-fast $ease-out;
+
+  &:hover {
+    color: $alarm;
+    border-block-end-color: $alarm;
+  }
+}
+
+// ----------------------------------------------------------------------------
+// ARTIFACT
+// ----------------------------------------------------------------------------
+
+.artifactStack {
+  display: flex;
+  flex-direction: column;
+  gap: $space-2;
+}
+
+.fileBar {
+  display: grid;
+  grid-template-columns: 1fr auto;
+  align-items: stretch;
+  border: $hairline solid $rule;
+  background-color: $paper-deep;
+}
+
+.fileMeta {
+  display: flex;
+  flex-direction: column;
+  gap: $space-1;
+  padding-block: $space-3;
+  padding-inline: $space-3;
+}
+
+.fileLabel {
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink-mute;
+}
+
+.fileName {
+  font-family: $font-mono;
+  font-size: $font-size-sm;
+  color: $ink;
+  overflow-wrap: anywhere;
+}
+
+.fileType {
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wide;
+  color: $ink-soft;
+  overflow-wrap: anywhere;
+}
+
+.downloadBtn {
+  display: inline-flex;
+  align-items: center;
+  padding-block: $space-3;
+  padding-inline: $space-5;
+  background-color: $ink;
+  color: $paper;
+  font-family: $font-mono;
+  font-size: $font-size-2xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  text-decoration: none;
+  border-inline-start: $hairline solid $ink;
+  transition: background-color $duration-fast $ease-out,
+    color $duration-fast $ease-out;
+
+  &:hover {
+    background-color: $paper;
+    color: $ink;
+  }
+}
+
+.textPreview {
+  margin: 0;
+  padding: $space-3;
+  max-block-size: 24rem;
+  overflow: auto;
+  background-color: $paper-deep;
+  border: $hairline solid $rule-hair;
+  font-family: $font-mono;
+  font-size: $font-size-xs;
+  line-height: $line-height-snug;
+  color: $ink;
+  white-space: pre;
+}
+
+.note {
+  font-size: $font-size-xs;
+  color: $ink-soft;
+  margin: 0;
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/result.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/result.tsx
new file mode 100644
index 00000000..5bb8b0f1
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/result.tsx
@@ -0,0 +1,100 @@
+// ===================
+// ©AngelaMos | 2026
+// result.tsx
+// ===================
+
+import { Link } from 'react-router-dom'
+import type { CreateTokenResponse } from '@/api'
+import {
+  Button,
+  CopyField,
+  DataRow,
+  Pill,
+  SerialBar,
+  SpecimenCard,
+  SpecimenCardSection,
+} from '@/components'
+import { manageRoute } from '@/config'
+import { ArtifactDisplay } from './artifact'
+import { ARTIFACT_LABEL, PAGE_COPY } from './copy'
+import styles from './landing.module.scss'
+
+type ResultViewProps = {
+  data: CreateTokenResponse
+  onAnother: () => void
+  filenameFallback: string
+}
+
+export function ResultView({
+  data,
+  onAnother,
+  filenameFallback,
+}: ResultViewProps): React.ReactElement {
+  const { token, artifact } = data
+  const managePath = manageRoute(token.manage_id)
+  return (
+    <div className={styles.result}>
+      <header className={styles.resultHead}>
+        <span className={styles.resultMarker}>★</span>
+        <h2 className={styles.resultHeadline}>{PAGE_COPY.RESULT_HEADLINE}</h2>
+        <p className={styles.resultBody}>{PAGE_COPY.RESULT_BODY}</p>
+      </header>
+
+      <SpecimenCard
+        tag={`SPECIES // ${token.type.toUpperCase()}`}
+        serial={<SerialBar value={token.id} prefix="SN" />}
+      >
+        <SpecimenCardSection label="DOSSIER">
+          <DataRow label="memo">{token.memo || '—'}</DataRow>
+          <DataRow label="filename" mono>
+            {token.filename ?? '—'}
+          </DataRow>
+          <DataRow label="alert" emphasize>
+            {token.alert_channel}
+          </DataRow>
+          <DataRow label="created" mono>
+            {formatIso(token.created_at)}
+          </DataRow>
+          <DataRow label="status">
+            <Pill tone={token.enabled ? 'signal' : 'alarm'} size="sm">
+              {token.enabled ? 'armed' : 'disabled'}
+            </Pill>
+          </DataRow>
+        </SpecimenCardSection>
+
+        <SpecimenCardSection label={ARTIFACT_LABEL[artifact.kind]}>
+          <ArtifactDisplay
+            artifact={artifact}
+            filenameFallback={filenameFallback}
+          />
+        </SpecimenCardSection>
+
+        <SpecimenCardSection label="ENDPOINTS">
+          <CopyField label="MANAGE" value={token.manage_url} fullWidth />
+          <CopyField label="TRIGGER" value={token.trigger_url} fullWidth />
+        </SpecimenCardSection>
+      </SpecimenCard>
+
+      <footer className={styles.resultFoot}>
+        <Link to={managePath} className={styles.resultLink}>
+          open dossier →
+        </Link>
+        <Button variant="ghost" onClick={onAnother}>
+          {PAGE_COPY.ISSUE_ANOTHER_LABEL}
+        </Button>
+      </footer>
+    </div>
+  )
+}
+
+function formatIso(iso: string): string {
+  try {
+    const dt = new Date(iso)
+    return dt
+      .toISOString()
+      .replace('T', ' ')
+      .replace(/\.\d+Z$/, ' Z')
+  } catch (_err) {
+    return iso
+  }
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/type-picker.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/type-picker.tsx
new file mode 100644
index 00000000..7e4cfd64
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/landing/type-picker.tsx
@@ -0,0 +1,89 @@
+// ===================
+// ©AngelaMos | 2026
+// type-picker.tsx
+// ===================
+
+import type { TokenType, TypeDescriptor } from '@/api'
+import { Glyph } from '@/components'
+import { TOKEN_BLURB } from './copy'
+import styles from './landing.module.scss'
+
+type TypePickerProps = {
+  descriptors: TypeDescriptor[]
+  value: TokenType | ''
+  onChange: (next: TokenType) => void
+  invalid?: boolean
+  name?: string
+}
+
+export function TypePicker({
+  descriptors,
+  value,
+  onChange,
+  invalid = false,
+  name = 'token-type',
+}: TypePickerProps): React.ReactElement {
+  return (
+    <fieldset className={styles.typeGrid} data-invalid={invalid}>
+      <legend className={styles.srOnly}>Token species</legend>
+      {descriptors.map((d, idx) => (
+        <TypeCard
+          key={d.type}
+          name={name}
+          descriptor={d}
+          index={idx + 1}
+          selected={value === d.type}
+          onSelect={() => onChange(d.type)}
+        />
+      ))}
+    </fieldset>
+  )
+}
+
+type TypeCardProps = {
+  name: string
+  descriptor: TypeDescriptor
+  index: number
+  selected: boolean
+  onSelect: () => void
+}
+
+function TypeCard({
+  name,
+  descriptor,
+  index,
+  selected,
+  onSelect,
+}: TypeCardProps): React.ReactElement {
+  const indexStr = String(index).padStart(2, '0')
+  const disabled = !descriptor.enabled
+  return (
+    <label
+      className={styles.typeCard}
+      data-selected={selected}
+      data-disabled={disabled}
+    >
+      <input
+        className={styles.srOnly}
+        type="radio"
+        name={name}
+        value={descriptor.type}
+        checked={selected}
+        disabled={disabled}
+        onChange={onSelect}
+      />
+      <span className={styles.typeIndex}>{indexStr}</span>
+      <span className={styles.typeGlyph} aria-hidden="true">
+        <Glyph type={descriptor.type} size={36} />
+      </span>
+      <span className={styles.typeName}>{descriptor.name}</span>
+      <span className={styles.typeCode}>{descriptor.type}</span>
+      <span className={styles.typeBlurb}>
+        {disabled && descriptor.disabled_reason
+          ? descriptor.disabled_reason
+          : TOKEN_BLURB[descriptor.type]}
+      </span>
+      {disabled ? <span className={styles.typeDisabledTag}>disabled</span> : null}
+    </label>
+  )
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/pages/manage/copy.ts b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/manage/copy.ts
new file mode 100644
index 00000000..26d8b2d6
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/manage/copy.ts
@@ -0,0 +1,40 @@
+// ===================
+// ©AngelaMos | 2026
+// copy.ts
+// ===================
+
+export const MANAGE_COPY = {
+  HEADLINE_QUIET: 'NO MOVEMENT YET',
+  HEADLINE_LIVE: 'TRAP TRIPPED',
+  HEADLINE_DISABLED: 'TRAP MUTED',
+  PURPOSE_QUIET:
+    'The specimen is in place. Nothing has touched it. Keep this page bookmarked — alerts will fire when something does.',
+  PURPOSE_LIVE:
+    'At least one visitor has tripped the trap. Below are the recorded events, newest first.',
+  PURPOSE_DISABLED:
+    'This specimen still records events for forensic continuity, but no alerts are dispatched. Re-enable from the operator console if needed.',
+  EVENT_LOG_TITLE: 'EVENT LOG',
+  EVENT_LOG_EMPTY:
+    'No events recorded yet. When something touches the trigger URL, it will appear here.',
+  EVENT_LOAD_MORE: 'Load older events',
+  EVENT_LOADING: 'Loading next page…',
+  DELETE_TITLE: 'TERMINATE SPECIMEN',
+  DELETE_BODY:
+    'Cascade-deletes this specimen and every event recorded against it. The trigger URL will no longer fire alerts. This action cannot be undone.',
+  DELETE_CONFIRM: 'Terminate',
+  DELETE_CANCEL: 'Keep alive',
+  DELETE_ARM: 'Mark for termination',
+  BACK_TO_INTAKE: 'New specimen',
+  NOT_FOUND_HEADLINE: 'DOSSIER NOT FOUND',
+  NOT_FOUND_BODY:
+    'The manage ID does not correspond to an active specimen. It may have been terminated or the URL may be malformed.',
+  ERROR_HEADLINE: 'CANNOT REACH ARCHIVE',
+  ERROR_BODY: 'Something went wrong fetching this dossier.',
+} as const
+
+export const NOTIFY_TONE = {
+  sent: 'signal',
+  pending: 'paper',
+  failed: 'alarm',
+  deduped: 'paper',
+} as const
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/pages/manage/event-row.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/manage/event-row.tsx
new file mode 100644
index 00000000..0e805d44
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/manage/event-row.tsx
@@ -0,0 +1,120 @@
+// ===================
+// ©AngelaMos | 2026
+// event-row.tsx
+// ===================
+
+import type { EventExtra, EventResponse, GeoView } from '@/api'
+import { Pill } from '@/components'
+import { NOTIFY_TONE } from './copy'
+import styles from './manage.module.scss'
+
+type EventRowProps = {
+  event: EventResponse
+  index: number
+}
+
+export function EventRow({ event, index }: EventRowProps): React.ReactElement {
+  const tone = NOTIFY_TONE[event.notify_status] ?? 'paper'
+  return (
+    <article className={styles.eventRow}>
+      <header className={styles.eventHead}>
+        <span className={styles.eventIndex}>
+          {String(index).padStart(4, '0')}
+        </span>
+        <time className={styles.eventTime} dateTime={event.triggered_at}>
+          {formatTimestamp(event.triggered_at)}
+        </time>
+        <Pill tone={tone} size="sm">
+          {event.notify_status}
+        </Pill>
+      </header>
+      <div className={styles.eventGrid}>
+        <EventField label="src ip" mono>
+          {event.source_ip}
+        </EventField>
+        <EventField label="geo">{formatGeo(event.geo)}</EventField>
+        {event.geo.asn ? (
+          <EventField label="asn" mono>
+            AS{event.geo.asn}
+            {event.geo.asn_org ? ` · ${event.geo.asn_org}` : ''}
+          </EventField>
+        ) : null}
+        <EventField label="user agent" wide truncate>
+          {event.user_agent ?? '—'}
+        </EventField>
+        {event.referer ? (
+          <EventField label="referer" wide truncate>
+            {event.referer}
+          </EventField>
+        ) : null}
+        {event.notified_at ? (
+          <EventField label="notified" mono>
+            {formatTimestamp(event.notified_at)}
+          </EventField>
+        ) : null}
+      </div>
+      {hasExtraDetails(event.extra) ? (
+        <details className={styles.eventExtra}>
+          <summary>extra fingerprint</summary>
+          <pre className={styles.eventExtraBody}>
+            {JSON.stringify(event.extra, null, 2)}
+          </pre>
+        </details>
+      ) : null}
+    </article>
+  )
+}
+
+type EventFieldProps = React.PropsWithChildren<{
+  label: string
+  mono?: boolean
+  wide?: boolean
+  truncate?: boolean
+}>
+
+function EventField({
+  label,
+  mono = false,
+  wide = false,
+  truncate = false,
+  children,
+}: EventFieldProps): React.ReactElement {
+  return (
+    <div
+      className={styles.eventField}
+      data-mono={mono}
+      data-wide={wide}
+      data-truncate={truncate}
+    >
+      <span className={styles.eventLabel}>{label}</span>
+      <span className={styles.eventValue}>{children}</span>
+    </div>
+  )
+}
+
+function formatTimestamp(iso: string): string {
+  try {
+    const dt = new Date(iso)
+    return dt
+      .toISOString()
+      .replace('T', ' ')
+      .replace(/\.\d+Z$/, 'Z')
+  } catch (_err) {
+    return iso
+  }
+}
+
+function formatGeo(geo: GeoView): string {
+  const parts: string[] = []
+  if (geo.city) parts.push(geo.city)
+  if (geo.region) parts.push(geo.region)
+  if (geo.country) parts.push(geo.country)
+  if (parts.length === 0) {
+    return '—'
+  }
+  return parts.join(' · ')
+}
+
+function hasExtraDetails(extra: EventExtra): boolean {
+  return Object.keys(extra).length > 0
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/pages/manage/index.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/manage/index.tsx
new file mode 100644
index 00000000..71cf4dfd
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/manage/index.tsx
@@ -0,0 +1,421 @@
+// ===================
+// ©AngelaMos | 2026
+// index.tsx
+// ===================
+
+import { useState } from 'react'
+import { Link, useNavigate, useParams } from 'react-router-dom'
+import { toast } from 'sonner'
+import {
+  type ManageResponse,
+  type ManageTokenView,
+  useDeleteToken,
+  useManageToken,
+} from '@/api'
+import {
+  Button,
+  CopyField,
+  DataRow,
+  Halftone,
+  Pill,
+  SerialBar,
+  SpecimenCard,
+  SpecimenCardSection,
+  Strip,
+  StripItem,
+} from '@/components'
+import { ApiError, ApiErrorCode } from '@/core/api'
+import { MANAGE_COPY } from './copy'
+import { EventRow } from './event-row'
+import styles from './manage.module.scss'
+
+const PAGE_SIZE = 20
+
+export function Component(): React.ReactElement {
+  const params = useParams()
+  const manageId = params.manageId ?? ''
+  const [cursor, setCursor] = useState<string | undefined>(undefined)
+  const query = useManageToken(manageId, { cursor, limit: PAGE_SIZE })
+
+  if (manageId.length === 0) {
+    return <ManageNotFound />
+  }
+  if (query.isLoading) {
+    return <ManageLoading />
+  }
+  if (query.error) {
+    if (
+      query.error instanceof ApiError &&
+      query.error.code === ApiErrorCode.NOT_FOUND
+    ) {
+      return <ManageNotFound />
+    }
+    return <ManageError onRetry={() => query.refetch()} />
+  }
+  if (!query.data) {
+    return <ManageNotFound />
+  }
+
+  return (
+    <ManageView
+      manageId={manageId}
+      data={query.data}
+      cursor={cursor}
+      isFetchingNextPage={query.isFetching && cursor !== undefined}
+      onLoadOlder={() => setCursor(query.data?.page.next_cursor)}
+      onResetCursor={() => setCursor(undefined)}
+    />
+  )
+}
+
+Component.displayName = 'Manage'
+
+type ManageViewProps = {
+  manageId: string
+  data: ManageResponse
+  cursor: string | undefined
+  isFetchingNextPage: boolean
+  onLoadOlder: () => void
+  onResetCursor: () => void
+}
+
+function ManageView({
+  manageId,
+  data,
+  cursor,
+  isFetchingNextPage,
+  onLoadOlder,
+  onResetCursor,
+}: ManageViewProps): React.ReactElement {
+  const { token, events, events_total, events_silenced_active, page } = data
+  return (
+    <div className={styles.page}>
+      <Strip>
+        <StripItem label="FIELD STATION">canary</StripItem>
+        <StripItem label="SECTION">dossier</StripItem>
+        <StripItem label="SPECIES" inverted>
+          {token.type}
+        </StripItem>
+      </Strip>
+
+      <DossierHero token={token} eventsTotal={events_total} />
+
+      <Halftone density="sparse" height={18} />
+
+      <DossierCard
+        token={token}
+        eventsTotal={events_total}
+        silenced={events_silenced_active}
+      />
+
+      <EventLogSection
+        events={events}
+        cursorIsSet={cursor !== undefined}
+        hasMore={page.has_more}
+        isFetchingNextPage={isFetchingNextPage}
+        onLoadOlder={onLoadOlder}
+        onResetCursor={onResetCursor}
+      />
+
+      <DeleteSection manageId={manageId} memo={token.memo} />
+
+      <Strip align="left" border="top">
+        <StripItem label="LINK">
+          <Link to="/" className={styles.footerLink}>
+            new specimen ↗
+          </Link>
+        </StripItem>
+        <StripItem label="LICENSE">©AngelaMos 2026</StripItem>
+      </Strip>
+    </div>
+  )
+}
+
+type DossierHeroProps = {
+  token: ManageTokenView
+  eventsTotal: number
+}
+
+function DossierHero({
+  token,
+  eventsTotal,
+}: DossierHeroProps): React.ReactElement {
+  const state = resolveState(token, eventsTotal)
+  const headline =
+    state === 'live'
+      ? MANAGE_COPY.HEADLINE_LIVE
+      : state === 'disabled'
+        ? MANAGE_COPY.HEADLINE_DISABLED
+        : MANAGE_COPY.HEADLINE_QUIET
+  const purpose =
+    state === 'live'
+      ? MANAGE_COPY.PURPOSE_LIVE
+      : state === 'disabled'
+        ? MANAGE_COPY.PURPOSE_DISABLED
+        : MANAGE_COPY.PURPOSE_QUIET
+  return (
+    <header className={styles.hero}>
+      <p className={styles.heroIndex}>DOSSIER · {token.type.toUpperCase()}</p>
+      <h1 className={styles.headline} data-state={state}>
+        {headline}
+      </h1>
+      <p className={styles.purpose}>{purpose}</p>
+      <p className={styles.memo}>{token.memo || 'no memo recorded'}</p>
+    </header>
+  )
+}
+
+type DossierCardProps = {
+  token: ManageTokenView
+  eventsTotal: number
+  silenced: number
+}
+
+function DossierCard({
+  token,
+  eventsTotal,
+  silenced,
+}: DossierCardProps): React.ReactElement {
+  return (
+    <SpecimenCard
+      tag={`SN · ${token.id}`}
+      serial={<SerialBar value={token.id} prefix="SN" />}
+    >
+      <SpecimenCardSection label="STATUS">
+        <DataRow label="armed">
+          <Pill tone={token.enabled ? 'signal' : 'alarm'}>
+            {token.enabled ? 'live' : 'disabled'}
+          </Pill>
+        </DataRow>
+        <DataRow label="triggers" emphasize alarm={eventsTotal > 0}>
+          {eventsTotal}
+        </DataRow>
+        <DataRow label="silenced (15m window)" mono>
+          {silenced}
+        </DataRow>
+        <DataRow label="last seen" mono>
+          {token.last_triggered ? formatTs(token.last_triggered) : 'never'}
+        </DataRow>
+        <DataRow label="created" mono>
+          {formatTs(token.created_at)}
+        </DataRow>
+        <DataRow label="alert" emphasize>
+          {token.alert_channel}
+        </DataRow>
+        {token.filename ? (
+          <DataRow label="filename" mono>
+            {token.filename}
+          </DataRow>
+        ) : null}
+      </SpecimenCardSection>
+
+      <SpecimenCardSection label="ENDPOINT">
+        <CopyField label="TRIGGER" value={token.trigger_url} fullWidth />
+      </SpecimenCardSection>
+    </SpecimenCard>
+  )
+}
+
+type EventLogSectionProps = {
+  events: ManageResponse['events']
+  cursorIsSet: boolean
+  hasMore: boolean
+  isFetchingNextPage: boolean
+  onLoadOlder: () => void
+  onResetCursor: () => void
+}
+
+function EventLogSection({
+  events,
+  cursorIsSet,
+  hasMore,
+  isFetchingNextPage,
+  onLoadOlder,
+  onResetCursor,
+}: EventLogSectionProps): React.ReactElement {
+  return (
+    <section className={styles.eventLog}>
+      <header className={styles.eventLogHead}>
+        <span className={styles.eventLogIndex}>06 / EVENT LOG</span>
+        <span className={styles.eventLogRule} aria-hidden="true" />
+        <span className={styles.eventLogCount}>
+          {events.length} {events.length === 1 ? 'entry' : 'entries'}
+        </span>
+      </header>
+      {events.length === 0 ? (
+        <p className={styles.eventEmpty}>{MANAGE_COPY.EVENT_LOG_EMPTY}</p>
+      ) : (
+        <div className={styles.eventList}>
+          {events.map((event, idx) => (
+            <EventRow key={event.id} event={event} index={idx + 1} />
+          ))}
+        </div>
+      )}
+      <footer className={styles.eventLogFoot}>
+        {cursorIsSet ? (
+          <Button variant="ghost" size="sm" onClick={onResetCursor}>
+            ← back to most recent
+          </Button>
+        ) : (
+          <span />
+        )}
+        {hasMore ? (
+          <Button
+            variant="ghost"
+            size="sm"
+            onClick={onLoadOlder}
+            busy={isFetchingNextPage}
+          >
+            {MANAGE_COPY.EVENT_LOAD_MORE} →
+          </Button>
+        ) : (
+          <span className={styles.eventEnd}>end of log</span>
+        )}
+      </footer>
+    </section>
+  )
+}
+
+type DeleteSectionProps = {
+  manageId: string
+  memo: string
+}
+
+function DeleteSection({
+  manageId,
+  memo,
+}: DeleteSectionProps): React.ReactElement {
+  const [armed, setArmed] = useState(false)
+  const del = useDeleteToken()
+  const navigate = useNavigate()
+
+  function confirm(): void {
+    del.mutate(manageId, {
+      onSuccess: () => {
+        toast.success(`Terminated ${memo || 'unnamed specimen'}`)
+        navigate('/')
+      },
+    })
+  }
+
+  return (
+    <section className={styles.deleteSection}>
+      <header className={styles.deleteHead}>
+        <span className={styles.deleteIndex}>07 / TERMINATION</span>
+        <span className={styles.deleteRule} aria-hidden="true" />
+      </header>
+      <h2 className={styles.deleteTitle}>{MANAGE_COPY.DELETE_TITLE}</h2>
+      <p className={styles.deleteBody}>{MANAGE_COPY.DELETE_BODY}</p>
+      {armed ? (
+        <div className={styles.deleteArmed}>
+          <Button
+            variant="alarm"
+            onClick={confirm}
+            busy={del.isPending}
+            size="md"
+          >
+            {MANAGE_COPY.DELETE_CONFIRM}
+          </Button>
+          <Button
+            variant="ghost"
+            onClick={() => setArmed(false)}
+            disabled={del.isPending}
+            size="md"
+          >
+            {MANAGE_COPY.DELETE_CANCEL}
+          </Button>
+        </div>
+      ) : (
+        <Button variant="ghost" onClick={() => setArmed(true)}>
+          {MANAGE_COPY.DELETE_ARM}
+        </Button>
+      )}
+    </section>
+  )
+}
+
+function ManageLoading(): React.ReactElement {
+  return (
+    <div className={styles.page}>
+      <Strip>
+        <StripItem label="FIELD STATION">canary</StripItem>
+        <StripItem label="STATUS">loading dossier…</StripItem>
+      </Strip>
+      <div className={styles.statusBlock}>fetching specimen record…</div>
+    </div>
+  )
+}
+
+function ManageNotFound(): React.ReactElement {
+  return (
+    <div className={styles.page}>
+      <Strip>
+        <StripItem label="FIELD STATION">canary</StripItem>
+        <StripItem label="STATUS" inverted>
+          unfound
+        </StripItem>
+      </Strip>
+      <header className={styles.hero}>
+        <p className={styles.heroIndex}>404 · DOSSIER</p>
+        <h1 className={styles.headline}>{MANAGE_COPY.NOT_FOUND_HEADLINE}</h1>
+        <p className={styles.purpose}>{MANAGE_COPY.NOT_FOUND_BODY}</p>
+      </header>
+      <Link to="/" className={styles.heroLink}>
+        ← {MANAGE_COPY.BACK_TO_INTAKE}
+      </Link>
+    </div>
+  )
+}
+
+type ManageErrorProps = {
+  onRetry: () => void
+}
+
+function ManageError({ onRetry }: ManageErrorProps): React.ReactElement {
+  return (
+    <div className={styles.page}>
+      <Strip>
+        <StripItem label="FIELD STATION">canary</StripItem>
+        <StripItem label="STATUS" inverted>
+          archive offline
+        </StripItem>
+      </Strip>
+      <header className={styles.hero}>
+        <p className={styles.heroIndex}>5xx · ARCHIVE</p>
+        <h1 className={styles.headline}>{MANAGE_COPY.ERROR_HEADLINE}</h1>
+        <p className={styles.purpose}>{MANAGE_COPY.ERROR_BODY}</p>
+      </header>
+      <div className={styles.heroActions}>
+        <Button onClick={onRetry}>Try again</Button>
+        <Link to="/" className={styles.heroLink}>
+          new specimen
+        </Link>
+      </div>
+    </div>
+  )
+}
+
+function resolveState(
+  token: ManageTokenView,
+  eventsTotal: number
+): 'quiet' | 'live' | 'disabled' {
+  if (!token.enabled) {
+    return 'disabled'
+  }
+  if (eventsTotal > 0) {
+    return 'live'
+  }
+  return 'quiet'
+}
+
+function formatTs(iso: string): string {
+  try {
+    const dt = new Date(iso)
+    return dt
+      .toISOString()
+      .replace('T', ' ')
+      .replace(/\.\d+Z$/, 'Z')
+  } catch (_err) {
+    return iso
+  }
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/pages/manage/manage.module.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/manage/manage.module.scss
new file mode 100644
index 00000000..5442f9c7
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/manage/manage.module.scss
@@ -0,0 +1,377 @@
+// ===================
+// ©AngelaMos | 2026
+// manage.module.scss
+// ===================
+
+@use '../../styles/tokens' as *;
+@use '../../styles/fonts' as *;
+@use '../../styles/mixins' as *;
+
+.page {
+  display: flex;
+  flex-direction: column;
+  flex: 1 1 auto;
+  inline-size: 100%;
+  max-inline-size: 88rem;
+  margin-inline: auto;
+  padding-inline: $space-4;
+  padding-block-end: $space-8;
+  gap: $space-6;
+
+  @include breakpoint-up('md') {
+    padding-inline: $space-8;
+    gap: $space-8;
+  }
+}
+
+.hero {
+  display: flex;
+  flex-direction: column;
+  gap: $space-3;
+  padding-block-start: $space-6;
+  max-inline-size: 56rem;
+
+  @include breakpoint-up('md') {
+    padding-block-start: $space-10;
+  }
+}
+
+.heroIndex {
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink-mute;
+  margin: 0;
+}
+
+.heroLink {
+  font-family: $font-mono;
+  font-size: $font-size-xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink;
+  text-decoration: none;
+  border-block-end: $hairline solid $ink;
+  padding-block-end: $space-0-5;
+  align-self: flex-start;
+  transition: color $duration-fast $ease-out;
+
+  &:hover {
+    color: $alarm;
+    border-block-end-color: $alarm;
+  }
+}
+
+.heroActions {
+  display: flex;
+  align-items: center;
+  gap: $space-4;
+  flex-wrap: wrap;
+}
+
+.headline {
+  font-family: $font-display;
+  font-size: clamp(2.25rem, 8vw, 6rem);
+  letter-spacing: -0.035em;
+  line-height: 0.92;
+  text-transform: uppercase;
+  color: $ink;
+  margin: 0;
+
+  &[data-state='live'] {
+    color: $alarm;
+  }
+
+  &[data-state='disabled'] {
+    color: $ink-mute;
+  }
+}
+
+.purpose {
+  font-family: $font-sans;
+  font-size: clamp(0.95rem, 1.5vw, 1.125rem);
+  line-height: $line-height-snug;
+  color: $ink;
+  max-inline-size: 42rem;
+  margin: 0;
+  text-wrap: balance;
+}
+
+.memo {
+  font-family: $font-mono;
+  font-size: $font-size-xs;
+  letter-spacing: $tracking-wide;
+  color: $ink-soft;
+  padding-inline-start: $space-3;
+  border-inline-start: $hairline-bold solid $rule;
+  margin: 0;
+  max-inline-size: 42rem;
+}
+
+// ----------------------------------------------------------------------------
+// EVENT LOG
+// ----------------------------------------------------------------------------
+
+.eventLog {
+  display: flex;
+  flex-direction: column;
+  gap: $space-4;
+}
+
+.eventLogHead {
+  display: flex;
+  align-items: center;
+  gap: $space-3;
+}
+
+.eventLogIndex {
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink-mute;
+}
+
+.eventLogRule {
+  flex: 1 1 auto;
+  block-size: $hairline;
+  background-color: $rule-hair;
+}
+
+.eventLogCount {
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink-soft;
+}
+
+.eventList {
+  display: flex;
+  flex-direction: column;
+  gap: $space-3;
+}
+
+.eventEmpty {
+  padding: $space-5;
+  border: $hairline dashed $rule-soft;
+  background-color: $paper;
+  font-family: $font-mono;
+  font-size: $font-size-xs;
+  letter-spacing: $tracking-wide;
+  color: $ink-soft;
+  text-align: center;
+}
+
+.eventLogFoot {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: $space-3;
+  padding-block-start: $space-3;
+  border-block-start: $hairline solid $rule-hair;
+}
+
+.eventEnd {
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink-mute;
+}
+
+// ----------------------------------------------------------------------------
+// EVENT ROW
+// ----------------------------------------------------------------------------
+
+.eventRow {
+  display: flex;
+  flex-direction: column;
+  gap: $space-3;
+  padding: $space-4;
+  border: $hairline solid $rule;
+  background-color: $paper;
+}
+
+.eventHead {
+  display: flex;
+  align-items: center;
+  gap: $space-3;
+  flex-wrap: wrap;
+  padding-block-end: $space-2;
+  border-block-end: $hairline solid $rule-hair;
+}
+
+.eventIndex {
+  font-family: $font-mono;
+  font-size: $font-size-2xs;
+  letter-spacing: $tracking-wider;
+  color: $ink-mute;
+}
+
+.eventTime {
+  font-family: $font-mono;
+  font-size: $font-size-xs;
+  letter-spacing: $tracking-wide;
+  color: $ink;
+  flex: 1 1 auto;
+}
+
+.eventGrid {
+  display: grid;
+  grid-template-columns: 1fr;
+  gap: $space-2;
+
+  @include breakpoint-up('sm') {
+    grid-template-columns: repeat(2, 1fr);
+  }
+}
+
+.eventField {
+  display: flex;
+  flex-direction: column;
+  gap: $space-0-5;
+  min-inline-size: 0;
+
+  &[data-wide='true'] {
+    @include breakpoint-up('sm') {
+      grid-column: 1 / -1;
+    }
+  }
+
+  &[data-mono='true'] .eventValue {
+    font-family: $font-mono;
+    font-size: $font-size-xs;
+    letter-spacing: $tracking-wide;
+  }
+
+  &[data-truncate='true'] .eventValue {
+    @include truncate;
+  }
+}
+
+.eventLabel {
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink-mute;
+}
+
+.eventValue {
+  font-family: $font-sans;
+  font-size: $font-size-sm;
+  color: $ink;
+  overflow-wrap: anywhere;
+}
+
+.eventExtra {
+  background-color: $paper-deep;
+  padding: $space-3;
+  font-family: $font-mono;
+  font-size: $font-size-xs;
+  letter-spacing: $tracking-wide;
+
+  summary {
+    cursor: pointer;
+    color: $ink-soft;
+    font-size: $font-size-3xs;
+    letter-spacing: $tracking-wider;
+    text-transform: uppercase;
+  }
+}
+
+.eventExtraBody {
+  margin: $space-2 0 0;
+  white-space: pre-wrap;
+  color: $ink;
+  font-size: $font-size-xs;
+  overflow: auto;
+  max-block-size: 16rem;
+}
+
+// ----------------------------------------------------------------------------
+// DELETE
+// ----------------------------------------------------------------------------
+
+.deleteSection {
+  display: flex;
+  flex-direction: column;
+  gap: $space-3;
+  padding-block-start: $space-6;
+}
+
+.deleteHead {
+  display: flex;
+  align-items: center;
+  gap: $space-3;
+}
+
+.deleteIndex {
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $alarm-deep;
+}
+
+.deleteRule {
+  flex: 1 1 auto;
+  block-size: $hairline;
+  background-color: $alarm;
+}
+
+.deleteTitle {
+  font-family: $font-sans;
+  font-weight: 700;
+  font-size: clamp(1.25rem, 3vw, 1.75rem);
+  letter-spacing: -0.02em;
+  text-transform: uppercase;
+  color: $alarm-deep;
+  margin: 0;
+}
+
+.deleteBody {
+  font-size: $font-size-sm;
+  color: $ink-soft;
+  max-inline-size: 38rem;
+  margin: 0;
+}
+
+.deleteArmed {
+  display: flex;
+  align-items: center;
+  gap: $space-3;
+  flex-wrap: wrap;
+}
+
+// ----------------------------------------------------------------------------
+// FOOTER
+// ----------------------------------------------------------------------------
+
+.footerLink {
+  color: inherit;
+  text-decoration: none;
+  border-block-end: $hairline solid $ink;
+  padding-block-end: $space-0-5;
+
+  &:hover {
+    color: $alarm;
+    border-block-end-color: $alarm;
+  }
+}
+
+// ----------------------------------------------------------------------------
+// LOADING / STATUS
+// ----------------------------------------------------------------------------
+
+.statusBlock {
+  padding: $space-4;
+  border: $hairline solid $rule-hair;
+  background-color: $paper-deep;
+  font-family: $font-mono;
+  font-size: $font-size-xs;
+  letter-spacing: $tracking-wide;
+  color: $ink-soft;
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/pages/notfound/index.tsx b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/notfound/index.tsx
new file mode 100644
index 00000000..49d63fb4
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/notfound/index.tsx
@@ -0,0 +1,34 @@
+// ===================
+// ©AngelaMos | 2026
+// index.tsx
+// ===================
+
+import { Link } from 'react-router-dom'
+import { Strip, StripItem } from '@/components'
+import styles from './notfound.module.scss'
+
+export function Component(): React.ReactElement {
+  return (
+    <div className={styles.page}>
+      <Strip>
+        <StripItem label="FIELD STATION">canary</StripItem>
+        <StripItem label="STATUS" inverted>
+          off-route
+        </StripItem>
+      </Strip>
+      <main className={styles.body}>
+        <p className={styles.index}>404 · OFF-ROUTE</p>
+        <h1 className={styles.headline}>NO SPECIMEN HERE</h1>
+        <p className={styles.purpose}>
+          This path is not part of the catalog. Maybe a typo, maybe a deleted
+          dossier. The intake is still open.
+        </p>
+        <Link to="/" className={styles.link}>
+          ← back to intake
+        </Link>
+      </main>
+    </div>
+  )
+}
+
+Component.displayName = 'NotFound'
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/pages/notfound/notfound.module.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/notfound/notfound.module.scss
new file mode 100644
index 00000000..967a86c0
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/pages/notfound/notfound.module.scss
@@ -0,0 +1,76 @@
+// ===================
+// ©AngelaMos | 2026
+// notfound.module.scss
+// ===================
+
+@use '../../styles/tokens' as *;
+@use '../../styles/fonts' as *;
+@use '../../styles/mixins' as *;
+
+.page {
+  display: flex;
+  flex-direction: column;
+  flex: 1 1 auto;
+  inline-size: 100%;
+  max-inline-size: 56rem;
+  margin-inline: auto;
+  padding-inline: $space-4;
+  padding-block-end: $space-8;
+  gap: $space-8;
+
+  @include breakpoint-up('md') {
+    padding-inline: $space-8;
+  }
+}
+
+.body {
+  display: flex;
+  flex-direction: column;
+  gap: $space-4;
+  padding-block-start: $space-10;
+}
+
+.index {
+  font-family: $font-mono;
+  font-size: $font-size-3xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink-mute;
+  margin: 0;
+}
+
+.headline {
+  font-family: $font-display;
+  font-size: clamp(2.25rem, 8vw, 5.5rem);
+  letter-spacing: -0.035em;
+  line-height: 0.92;
+  text-transform: uppercase;
+  color: $ink;
+  margin: 0;
+}
+
+.purpose {
+  font-family: $font-sans;
+  font-size: clamp(0.95rem, 1.5vw, 1.125rem);
+  color: $ink-soft;
+  max-inline-size: 42rem;
+  margin: 0;
+  text-wrap: balance;
+}
+
+.link {
+  font-family: $font-mono;
+  font-size: $font-size-xs;
+  letter-spacing: $tracking-wider;
+  text-transform: uppercase;
+  color: $ink;
+  text-decoration: none;
+  border-block-end: $hairline solid $ink;
+  padding-block-end: $space-0-5;
+  align-self: flex-start;
+
+  &:hover {
+    color: $alarm;
+    border-block-end-color: $alarm;
+  }
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/styles.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/styles.scss
new file mode 100644
index 00000000..85f83908
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/styles.scss
@@ -0,0 +1,41 @@
+// ===================
+// ©AngelaMos | 2026
+// styles.scss
+// ===================
+
+@forward 'styles/tokens';
+@forward 'styles/fonts';
+@forward 'styles/mixins';
+
+@use 'styles/tokens' as *;
+@use 'styles/fonts' as *;
+@use 'styles/reset';
+
+html,
+body {
+  background-color: $paper;
+  color: $ink;
+}
+
+body {
+  font-family: $font-sans;
+  font-size: $font-size-base;
+  font-weight: $font-weight-regular;
+  line-height: $line-height-normal;
+  letter-spacing: $tracking-normal;
+  background-image: $paper-grain;
+  background-attachment: fixed;
+  background-size: 240px 240px;
+}
+
+::selection {
+  background-color: $ink;
+  color: $paper;
+}
+
+#root {
+  min-height: 100vh;
+  min-height: 100dvh;
+  display: flex;
+  flex-direction: column;
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/styles/_fonts.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/styles/_fonts.scss
new file mode 100644
index 00000000..e83b1f0b
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/styles/_fonts.scss
@@ -0,0 +1,15 @@
+// ===================
+// ©AngelaMos | 2026
+// _fonts.scss
+// ===================
+
+@use 'tokens' as *;
+
+$font-sans: 'Space Grotesk', -apple-system, BlinkMacSystemFont, 'Inter',
+  'Segoe UI', Roboto, 'Helvetica Neue', Arial, system-ui, sans-serif;
+
+$font-display: 'Archivo Black', 'Space Grotesk', -apple-system,
+  BlinkMacSystemFont, 'Inter', system-ui, sans-serif;
+
+$font-mono: 'Departure Mono', ui-monospace, SFMono-Regular, 'SF Mono', Menlo,
+  Consolas, 'Liberation Mono', monospace;
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/styles/_index.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/styles/_index.scss
new file mode 100644
index 00000000..357b9ada
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/styles/_index.scss
@@ -0,0 +1,8 @@
+// ===================
+// ©AngelaMos | 2026
+// _index.scss
+// ===================
+
+@forward 'tokens';
+@forward 'fonts';
+@forward 'mixins';
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/styles/_mixins.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/styles/_mixins.scss
new file mode 100644
index 00000000..b7f96677
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/styles/_mixins.scss
@@ -0,0 +1,120 @@
+// ===================
+// ©AngelaMos | 2026
+// _mixins.scss
+// ===================
+
+@use 'sass:map';
+@use 'sass:list';
+@use 'tokens' as *;
+
+$breakpoints: (
+  'xs': $breakpoint-xs,
+  'sm': $breakpoint-sm,
+  'md': $breakpoint-md,
+  'lg': $breakpoint-lg,
+  'xl': $breakpoint-xl,
+  '2xl': $breakpoint-2xl,
+);
+
+@mixin breakpoint-up($size) {
+  @media (min-width: map.get($breakpoints, $size)) {
+    @content;
+  }
+}
+
+@mixin breakpoint-down($size) {
+  @media (width < map.get($breakpoints, $size)) {
+    @content;
+  }
+}
+
+@mixin flex-center {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+
+@mixin flex-between {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+}
+
+@mixin flex-column {
+  display: flex;
+  flex-direction: column;
+}
+
+@mixin flex-column-center {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+}
+
+@mixin sr-only {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  margin: -1px;
+  padding: 0;
+  overflow: hidden;
+  clip: rect(0 0 0 0);
+  clip-path: inset(50%);
+  white-space: nowrap;
+  border: 0;
+}
+
+@mixin truncate {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+@mixin line-clamp($lines: 2) {
+  display: -webkit-box;
+  -webkit-line-clamp: #{$lines};
+  -webkit-box-orient: vertical;
+  overflow: hidden;
+}
+
+@mixin transition-fast {
+  transition-property: background-color, border-color, color, opacity;
+  transition-duration: $duration-fast;
+  transition-timing-function: $ease-out;
+}
+
+@mixin transition-normal {
+  transition-property: background-color, border-color, color, opacity;
+  transition-duration: $duration-normal;
+  transition-timing-function: $ease-out;
+}
+
+@mixin absolute-fill {
+  position: absolute;
+  inset: 0;
+}
+
+@mixin absolute-center {
+  position: absolute;
+  top: 50%;
+  left: 50%;
+  transform: translate(-50%, -50%);
+}
+
+@mixin hover {
+  @media (hover: hover) and (pointer: fine) {
+    &:hover {
+      @content;
+    }
+  }
+}
+
+@mixin hide-scrollbar {
+  -ms-overflow-style: none;
+  scrollbar-width: none;
+
+  &::-webkit-scrollbar {
+    display: none;
+  }
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/styles/_reset.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/styles/_reset.scss
new file mode 100644
index 00000000..5eded1e9
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/styles/_reset.scss
@@ -0,0 +1,103 @@
+// ===================
+// ©AngelaMos | 2026
+// _reset.scss
+// ===================
+
+*,
+*::before,
+*::after {
+  box-sizing: border-box;
+}
+
+* {
+  margin: 0;
+  padding: 0;
+  -webkit-tap-highlight-color: transparent;
+}
+
+html {
+  font-size: 16px;
+  -moz-text-size-adjust: none;
+  -webkit-text-size-adjust: none;
+  text-size-adjust: none;
+  overflow-x: hidden;
+}
+
+@media (prefers-reduced-motion: no-preference) {
+  html {
+    interpolate-size: allow-keywords;
+    scroll-behavior: smooth;
+  }
+}
+
+body {
+  min-height: 100vh;
+  min-height: 100dvh;
+  line-height: 1.5;
+  text-rendering: optimizeLegibility;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+  overflow-x: hidden;
+}
+
+h1,
+h2,
+h3,
+h4,
+h5,
+h6 {
+  line-height: 1.2;
+  text-wrap: balance;
+  overflow-wrap: break-word;
+}
+
+p {
+  text-wrap: pretty;
+  overflow-wrap: break-word;
+}
+
+img,
+picture,
+video,
+canvas,
+svg {
+  display: block;
+  max-width: 100%;
+  height: auto;
+}
+
+input,
+button,
+textarea,
+select {
+  font: inherit;
+  color: inherit;
+}
+
+button {
+  background: none;
+  border: none;
+  cursor: pointer;
+  text-align: inherit;
+  font-family: inherit;
+}
+
+[hidden] {
+  display: none !important;
+}
+
+[disabled] {
+  cursor: not-allowed;
+  opacity: 0.5;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  *,
+  *::before,
+  *::after {
+    animation-duration: 0.01ms !important;
+    animation-iteration-count: 1 !important;
+    transition-duration: 0.01ms !important;
+    scroll-behavior: auto !important;
+  }
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/src/styles/_tokens.scss b/PROJECTS/beginner/canary-token-generator/frontend/src/styles/_tokens.scss
new file mode 100644
index 00000000..418c8472
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/src/styles/_tokens.scss
@@ -0,0 +1,169 @@
+// ===================
+// ©AngelaMos | 2026
+// _tokens.scss
+// ===================
+
+// ============================================================================
+// COLOR — specimen palette
+// ============================================================================
+$paper: #f1ede4;
+$paper-deep: #ebe5d6;
+$paper-edge: #d9d1bd;
+
+$ink: #14110b;
+$ink-soft: #46402f;
+$ink-mute: #837a64;
+$ink-faint: #b8ad95;
+
+$rule: #1f1b13;
+$rule-soft: #a39879;
+$rule-hair: #d6cdb6;
+
+$alarm: #c4341c;
+$alarm-deep: #8c2210;
+$alarm-tint: #f3d8d0;
+
+$signal: #2b6b3a;
+$signal-tint: #d8e5d6;
+
+// ============================================================================
+// PAPER GRAIN (svg noise, data-uri — overlay at low opacity)
+// ============================================================================
+$paper-grain: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='240' height='240'><filter id='n'><feTurbulence type='fractalNoise' baseFrequency='0.85' numOctaves='2' seed='7'/><feColorMatrix values='0 0 0 0 0.08  0 0 0 0 0.07  0 0 0 0 0.05  0 0 0 0.35 0'/></filter><rect width='100%' height='100%' filter='url(%23n)'/></svg>");
+
+// ============================================================================
+// HALFTONE DOT FIELD (svg, repeats — for separators / tonal patches)
+// ============================================================================
+$halftone-dots: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='10' height='10'><circle cx='1' cy='1' r='1' fill='%2314110b'/></svg>");
+
+// ============================================================================
+// HAIRLINE (the thin printed rule)
+// ============================================================================
+$hairline: 1px;
+$hairline-bold: 2px;
+
+// ============================================================================
+// SPACING (8px base system)
+// ============================================================================
+$space-0: 0;
+$space-px: 1px;
+$space-0-5: 0.125rem;
+$space-1: 0.25rem;
+$space-1-5: 0.375rem;
+$space-2: 0.5rem;
+$space-2-5: 0.625rem;
+$space-3: 0.75rem;
+$space-3-5: 0.875rem;
+$space-4: 1rem;
+$space-5: 1.25rem;
+$space-6: 1.5rem;
+$space-7: 1.75rem;
+$space-8: 2rem;
+$space-9: 2.25rem;
+$space-10: 2.5rem;
+$space-11: 2.75rem;
+$space-12: 3rem;
+$space-14: 3.5rem;
+$space-16: 4rem;
+$space-20: 5rem;
+$space-24: 6rem;
+$space-28: 7rem;
+$space-32: 8rem;
+
+// ============================================================================
+// TYPOGRAPHY SCALE
+// ============================================================================
+$font-size-3xs: 0.625rem;
+$font-size-2xs: 0.6875rem;
+$font-size-xs: 0.75rem;
+$font-size-sm: 0.875rem;
+$font-size-base: 1rem;
+$font-size-lg: 1.125rem;
+$font-size-xl: 1.25rem;
+$font-size-2xl: 1.5rem;
+$font-size-3xl: 1.875rem;
+$font-size-4xl: 2.25rem;
+$font-size-5xl: 3rem;
+
+// ============================================================================
+// FONT WEIGHTS
+// ============================================================================
+$font-weight-regular: 400;
+$font-weight-medium: 500;
+$font-weight-semibold: 600;
+
+// ============================================================================
+// LINE HEIGHTS
+// ============================================================================
+$line-height-none: 1;
+$line-height-tight: 1.2;
+$line-height-snug: 1.375;
+$line-height-normal: 1.5;
+$line-height-relaxed: 1.625;
+
+// ============================================================================
+// LETTER SPACING
+// ============================================================================
+$tracking-tighter: -0.05em;
+$tracking-tight: -0.025em;
+$tracking-normal: 0;
+$tracking-wide: 0.025em;
+$tracking-wider: 0.05em;
+
+// ============================================================================
+// BORDER RADIUS
+// ============================================================================
+$radius-none: 0;
+$radius-xs: 2px;
+$radius-sm: 4px;
+$radius-md: 6px;
+$radius-lg: 8px;
+$radius-xl: 12px;
+$radius-full: 9999px;
+
+// ============================================================================
+// Z-INDEX SCALE
+// ============================================================================
+$z-hide: -1;
+$z-base: 0;
+$z-dropdown: 100;
+$z-sticky: 200;
+$z-fixed: 300;
+$z-overlay: 400;
+$z-modal: 500;
+$z-popover: 600;
+$z-tooltip: 700;
+$z-toast: 800;
+$z-max: 9999;
+
+// ============================================================================
+// TRANSITIONS
+// ============================================================================
+$duration-instant: 0ms;
+$duration-fast: 100ms;
+$duration-normal: 150ms;
+$duration-slow: 200ms;
+
+$ease-out: cubic-bezier(0, 0, 0.2, 1);
+$ease-in-out: cubic-bezier(0.4, 0, 0.2, 1);
+
+// ============================================================================
+// BREAKPOINTS
+// ============================================================================
+$breakpoint-xs: 360px;
+$breakpoint-sm: 480px;
+$breakpoint-md: 768px;
+$breakpoint-lg: 1024px;
+$breakpoint-xl: 1280px;
+$breakpoint-2xl: 1536px;
+
+// ============================================================================
+// CONTAINER WIDTHS
+// ============================================================================
+$container-xs: 20rem;
+$container-sm: 24rem;
+$container-md: 28rem;
+$container-lg: 32rem;
+$container-xl: 36rem;
+$container-2xl: 42rem;
+$container-full: 100%;
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/stylelint.config.js b/PROJECTS/beginner/canary-token-generator/frontend/stylelint.config.js
new file mode 100644
index 00000000..5f8c2eb2
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/stylelint.config.js
@@ -0,0 +1,107 @@
+// ©AngelaMos | 2026
+// stylelint.config.js
+
+/** @type {import('stylelint').Config} */
+export default {
+  extends: ['stylelint-config-standard-scss', 'stylelint-config-prettier-scss'],
+  rules: {
+    'block-no-empty': true,
+    'declaration-no-important': true,
+    'color-no-invalid-hex': true,
+    'property-no-unknown': true,
+    'selector-pseudo-class-no-unknown': [
+      true,
+      {
+        ignorePseudoClasses: ['global'],
+      },
+    ],
+
+    'selector-class-pattern': [
+      '^[a-z]([a-z0-9-]+)?(__[a-z0-9]([a-z0-9-]+)?)?(--[a-z0-9]([a-z0-9-]+)?)?$|^[a-z][a-zA-Z0-9]*$',
+      {
+        message:
+          'Selector should be in BEM format (e.g., .block__element--modifier) or CSS Modules camelCase (e.g., .testButton)',
+      },
+    ],
+
+    'value-keyword-case': [
+      'lower',
+      {
+        camelCaseSvgKeywords: true,
+        ignoreKeywords: [
+          'BlinkMacSystemFont',
+          'SFMono-Regular',
+          'Menlo',
+          'Monaco',
+          'Consolas',
+          'Roboto',
+          'Arial',
+          'Helvetica',
+          'Times',
+          'Georgia',
+          'Verdana',
+          'Tahoma',
+          'Trebuchet',
+          'Impact',
+          'Comic',
+        ],
+      },
+    ],
+
+    'property-no-vendor-prefix': [
+      true,
+      {
+        ignoreProperties: ['text-size-adjust', 'appearance', 'backdrop-filter'],
+      },
+    ],
+    'value-no-vendor-prefix': true,
+    'selector-no-vendor-prefix': true,
+
+    'property-no-deprecated': [
+      true,
+      {
+        ignoreProperties: ['clip'],
+      },
+    ],
+
+    'container-name-pattern': null,
+    'layer-name-pattern': null,
+
+    'scss/at-rule-no-unknown': true,
+    'scss/declaration-nested-properties-no-divided-groups': true,
+    'scss/dollar-variable-no-missing-interpolation': true,
+    'scss/dollar-variable-empty-line-before': null,
+
+    'declaration-empty-line-before': null,
+    'custom-property-empty-line-before': null,
+
+    'no-descending-specificity': null,
+
+    'media-feature-name-no-unknown': [
+      true,
+      {
+        ignoreMediaFeatureNames: ['map'],
+      },
+    ],
+
+    'color-function-notation': null,
+    'hue-degree-notation': null,
+  },
+  ignoreFiles: [
+    'node_modules/**',
+    'dist/**',
+    'build/**',
+    '**/*.js',
+    '**/*.ts',
+    '**/*.tsx',
+  ],
+  overrides: [
+    {
+      files: ['**/styles/_reset.scss', '**/styles/_fonts.scss'],
+      rules: {
+        'declaration-no-important': null,
+        'scss/comment-no-empty': null,
+      },
+    },
+  ],
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/tsconfig.app.json b/PROJECTS/beginner/canary-token-generator/frontend/tsconfig.app.json
new file mode 100644
index 00000000..afe17f60
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/tsconfig.app.json
@@ -0,0 +1,31 @@
+{
+  "compilerOptions": {
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",
+    "target": "ES2022",
+    "useDefineForClassFields": true,
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "types": ["vite/client"],
+    "skipLibCheck": true,
+
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+    "jsx": "react-jsx",
+
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "erasableSyntaxOnly": true,
+    "noFallthroughCasesInSwitch": true,
+    "noUncheckedSideEffectImports": true,
+
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["./src/*"]
+    }
+  },
+  "include": ["src"]
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/tsconfig.json b/PROJECTS/beginner/canary-token-generator/frontend/tsconfig.json
new file mode 100644
index 00000000..1ffef600
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/tsconfig.json
@@ -0,0 +1,7 @@
+{
+  "files": [],
+  "references": [
+    { "path": "./tsconfig.app.json" },
+    { "path": "./tsconfig.node.json" }
+  ]
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/tsconfig.node.json b/PROJECTS/beginner/canary-token-generator/frontend/tsconfig.node.json
new file mode 100644
index 00000000..a96b3e59
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/tsconfig.node.json
@@ -0,0 +1,24 @@
+{
+  "compilerOptions": {
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.node.tsbuildinfo",
+    "target": "ES2023",
+    "lib": ["ES2023"],
+    "module": "ESNext",
+    "types": ["node"],
+    "skipLibCheck": true,
+
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "erasableSyntaxOnly": true,
+    "noFallthroughCasesInSwitch": true,
+    "noUncheckedSideEffectImports": true
+  },
+  "include": ["vite.config.ts"]
+}
diff --git a/PROJECTS/beginner/canary-token-generator/frontend/vite.config.ts b/PROJECTS/beginner/canary-token-generator/frontend/vite.config.ts
new file mode 100644
index 00000000..02260068
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/frontend/vite.config.ts
@@ -0,0 +1,70 @@
+/**
+ * ©AngelaMos | 2026
+ * vite.config.ts
+ */
+
+import path from 'node:path'
+import react from '@vitejs/plugin-react'
+import { defineConfig, loadEnv } from 'vite'
+import tsconfigPaths from 'vite-tsconfig-paths'
+
+export default defineConfig(({ mode }) => {
+  const env = loadEnv(mode, path.resolve(__dirname, '..'), '')
+  const isDev = mode === 'development'
+
+  return {
+    plugins: [react(), tsconfigPaths()],
+
+    resolve: {
+      alias: {
+        '@': path.resolve(__dirname, './src'),
+      },
+    },
+
+    css: {
+      preprocessorOptions: {
+        scss: {},
+      },
+    },
+
+    server: {
+      port: 5173,
+      host: '0.0.0.0',
+      proxy: {
+        '/api': {
+          target: env.VITE_API_TARGET || 'http://localhost:8080',
+          changeOrigin: true,
+        },
+      },
+    },
+
+    build: {
+      target: 'esnext',
+      cssTarget: 'chrome100',
+      sourcemap: isDev ? true : 'hidden',
+      minify: 'oxc',
+      rollupOptions: {
+        output: {
+          manualChunks(id: string): string | undefined {
+            if (id.includes('node_modules')) {
+              if (id.includes('react-dom') || id.includes('react-router')) {
+                return 'vendor-react'
+              }
+              if (id.includes('@tanstack/react-query')) {
+                return 'vendor-query'
+              }
+              if (id.includes('zustand')) {
+                return 'vendor-state'
+              }
+            }
+            return undefined
+          },
+        },
+      },
+    },
+
+    preview: {
+      port: 4173,
+    },
+  }
+})
diff --git a/PROJECTS/beginner/canary-token-generator/infra/docker/canary.dev b/PROJECTS/beginner/canary-token-generator/infra/docker/canary.dev
new file mode 100644
index 00000000..38161551
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/infra/docker/canary.dev
@@ -0,0 +1,25 @@
+# =============================================================================
+# ©AngelaMos | 2026
+# canary.dev
+# =============================================================================
+# Development image: golang:1.25-alpine + Air for hot reload.
+# Source is bind-mounted by dev.compose.yml; Air rebuilds on file change.
+#
+# Build context: ./backend
+# Reads .air.toml from the bind-mounted source.
+# =============================================================================
+
+FROM golang:1.25-alpine
+
+RUN apk add --no-cache git curl wget
+
+RUN go install github.com/air-verse/air@latest
+
+WORKDIR /app
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+EXPOSE 8080
+
+CMD ["air", "-c", ".air.toml"]
diff --git a/PROJECTS/beginner/canary-token-generator/infra/docker/canary.prod b/PROJECTS/beginner/canary-token-generator/infra/docker/canary.prod
new file mode 100644
index 00000000..58428b6b
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/infra/docker/canary.prod
@@ -0,0 +1,48 @@
+# =============================================================================
+# ©AngelaMos | 2026
+# canary.prod
+# =============================================================================
+# Multi-stage build:
+#   Stage 1 (builder)   golang:1.25-alpine, CGO_ENABLED=0, trimpath, ldflags
+#   Stage 2 (final)     gcr.io/distroless/static:nonroot — no shell, non-root
+#
+# Build context: ./backend (set by compose.yml)
+# Result: /canary single static binary, runs as nonroot user.
+# =============================================================================
+
+FROM golang:1.25-alpine AS builder
+
+RUN apk add --no-cache ca-certificates git
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN CGO_ENABLED=0 GOOS=linux go build \
+    -trimpath \
+    -ldflags="-s -w" \
+    -o /out/canary \
+    ./cmd/canary
+
+RUN CGO_ENABLED=0 GOOS=linux go build \
+    -trimpath \
+    -ldflags="-s -w" \
+    -o /out/healthcheck \
+    ./cmd/healthcheck
+
+FROM gcr.io/distroless/static:nonroot AS final
+
+WORKDIR /
+
+COPY --from=builder /out/canary /canary
+COPY --from=builder /out/healthcheck /healthcheck
+COPY --from=builder /src/config.yaml /config.yaml
+
+EXPOSE 8080
+USER nonroot:nonroot
+
+ENTRYPOINT ["/canary"]
+CMD ["-config", "/config.yaml"]
diff --git a/PROJECTS/beginner/canary-token-generator/infra/docker/vite.dev b/PROJECTS/beginner/canary-token-generator/infra/docker/vite.dev
new file mode 100644
index 00000000..2c0ce699
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/infra/docker/vite.dev
@@ -0,0 +1,25 @@
+# =============================================================================
+# ©AngelaMos | 2026
+# vite.dev
+# =============================================================================
+# Development Dockerfile for Vite/React frontend
+# Features: pnpm, HMR support, polling for Docker file watching
+# =============================================================================
+# syntax=docker/dockerfile:1
+
+FROM node:22-slim
+
+RUN corepack enable && corepack prepare pnpm@10.29.1 --activate
+
+WORKDIR /app
+
+COPY package.json pnpm-lock.yaml* .npmrc* ./
+
+RUN --mount=type=cache,target=/root/.local/share/pnpm/store \
+    pnpm install --frozen-lockfile
+
+COPY . .
+
+EXPOSE 5173
+
+CMD ["pnpm", "dev", "--host", "0.0.0.0"]
diff --git a/PROJECTS/beginner/canary-token-generator/infra/docker/vite.prod b/PROJECTS/beginner/canary-token-generator/infra/docker/vite.prod
new file mode 100644
index 00000000..3e232c15
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/infra/docker/vite.prod
@@ -0,0 +1,61 @@
+# =============================================================================
+# ©AngelaMos | 2026
+# vite.prod
+# =============================================================================
+# Production Dockerfile: builds Vite app, serves via Nginx
+# =============================================================================
+# syntax=docker/dockerfile:1
+
+# ============================================================================
+# BUILD STAGE
+# ============================================================================
+FROM node:22-slim AS builder
+
+RUN corepack enable && corepack prepare pnpm@10.29.1 --activate
+
+WORKDIR /app
+
+COPY frontend/package.json frontend/pnpm-lock.yaml* frontend/.npmrc* ./
+
+RUN --mount=type=cache,target=/root/.local/share/pnpm/store \
+    pnpm install --frozen-lockfile
+
+COPY frontend/ .
+
+ARG VITE_API_URL=/api
+ARG VITE_APP_TITLE="My App"
+ARG VITE_TURNSTILE_SITE_KEY=""
+
+ENV VITE_API_URL=${VITE_API_URL} \
+    VITE_APP_TITLE=${VITE_APP_TITLE} \
+    VITE_TURNSTILE_SITE_KEY=${VITE_TURNSTILE_SITE_KEY}
+
+RUN pnpm build
+
+# ============================================================================
+# PRODUCTION STAGE
+# ============================================================================
+FROM nginx:1.27-alpine AS production
+
+RUN rm -rf /usr/share/nginx/html/* && \
+    rm /etc/nginx/conf.d/default.conf
+
+COPY --from=builder /app/dist /usr/share/nginx/html
+
+COPY --chown=nginx:nginx infra/nginx/nginx.prod.conf /etc/nginx/nginx.conf
+COPY --chown=nginx:nginx infra/nginx/prod.nginx /etc/nginx/conf.d/default.conf
+
+RUN chown -R nginx:nginx /usr/share/nginx/html && \
+    chown -R nginx:nginx /var/cache/nginx && \
+    chown -R nginx:nginx /var/log/nginx && \
+    touch /var/run/nginx.pid && \
+    chown -R nginx:nginx /var/run/nginx.pid
+
+USER nginx
+
+EXPOSE 80
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+    CMD wget --no-verbose --tries=1 --spider http://localhost:80/health || exit 1
+
+CMD ["nginx", "-g", "daemon off;"]
diff --git a/PROJECTS/beginner/canary-token-generator/infra/nginx/dev.nginx b/PROJECTS/beginner/canary-token-generator/infra/nginx/dev.nginx
new file mode 100644
index 00000000..45c39dae
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/infra/nginx/dev.nginx
@@ -0,0 +1,65 @@
+# =============================================================================
+# ©AngelaMos | 2026
+# dev.nginx
+# =============================================================================
+# Development server block: proxies to Vite dev server with HMR
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name _;
+
+    access_log /var/log/nginx/access.log main_timed;
+    error_log /var/log/nginx/error.log debug;
+
+    add_header Cache-Control "no-store, no-cache, must-revalidate" always;
+
+    location /health {
+        access_log off;
+        return 200 "healthy\n";
+        add_header Content-Type text/plain;
+    }
+
+    location /api/ {
+        proxy_pass http://canary;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 30s;
+    }
+
+    location /c/ {
+        proxy_pass http://canary;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 30s;
+    }
+
+    location /k/ {
+        proxy_pass http://canary;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 30s;
+    }
+
+    location / {
+        proxy_pass http://frontend_dev;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+        proxy_read_timeout 60s;
+        proxy_buffering off;
+    }
+}
diff --git a/PROJECTS/beginner/canary-token-generator/infra/nginx/nginx.conf b/PROJECTS/beginner/canary-token-generator/infra/nginx/nginx.conf
new file mode 100644
index 00000000..5988ea4d
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/infra/nginx/nginx.conf
@@ -0,0 +1,81 @@
+# ©AngelaMos | 2026
+# nginx.conf
+# Development nginx configuration
+
+user nginx;
+worker_processes auto;
+worker_rlimit_nofile 65535;
+
+error_log /var/log/nginx/error.log warn;
+pid /var/run/nginx.pid;
+
+events {
+    worker_connections 4096;
+    multi_accept on;
+    use epoll;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
+    upstream frontend_dev {
+        server frontend:5173;
+        keepalive 8;
+    }
+
+    upstream canary {
+        server canary:8080;
+        keepalive 16;
+    }
+
+    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
+    limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
+    limit_req_status 429;
+
+    log_format main_timed '$remote_addr - $remote_user [$time_local] '
+                          '"$request" $status $body_bytes_sent '
+                          '"$http_referer" "$http_user_agent" '
+                          'rt=$request_time uct="$upstream_connect_time" '
+                          'uht="$upstream_header_time" urt="$upstream_response_time"';
+
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    types_hash_max_size 2048;
+    server_tokens off;
+
+    client_body_buffer_size 128k;
+    client_header_buffer_size 16k;
+    client_max_body_size 10m;
+    large_client_header_buffers 4 16k;
+
+    client_body_timeout 12s;
+    client_header_timeout 12s;
+    send_timeout 10s;
+
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_min_length 256;
+    gzip_types
+        text/plain
+        text/css
+        text/xml
+        text/javascript
+        application/json
+        application/javascript
+        application/xml+rss
+        application/atom+xml
+        image/svg+xml;
+    gzip_disable "msie6";
+
+    include /etc/nginx/conf.d/*.conf;
+}
diff --git a/PROJECTS/beginner/canary-token-generator/infra/nginx/nginx.prod.conf b/PROJECTS/beginner/canary-token-generator/infra/nginx/nginx.prod.conf
new file mode 100644
index 00000000..506cb8ef
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/infra/nginx/nginx.prod.conf
@@ -0,0 +1,70 @@
+# ©AngelaMos | 2026
+# nginx.prod.conf
+# Production nginx configuration
+
+worker_processes auto;
+worker_rlimit_nofile 65535;
+
+error_log /var/log/nginx/error.log warn;
+pid /var/run/nginx.pid;
+
+events {
+    worker_connections 4096;
+    multi_accept on;
+    use epoll;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    upstream canary {
+        server canary:8080;
+        keepalive 16;
+    }
+
+    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
+    limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
+    limit_req_status 429;
+
+    log_format main_timed '$remote_addr - $remote_user [$time_local] '
+                          '"$request" $status $body_bytes_sent '
+                          '"$http_referer" "$http_user_agent" '
+                          'rt=$request_time uct="$upstream_connect_time" '
+                          'uht="$upstream_header_time" urt="$upstream_response_time"';
+
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    types_hash_max_size 2048;
+    server_tokens off;
+
+    client_body_buffer_size 128k;
+    client_header_buffer_size 16k;
+    client_max_body_size 10m;
+    large_client_header_buffers 4 16k;
+
+    client_body_timeout 12s;
+    client_header_timeout 12s;
+    send_timeout 10s;
+
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_min_length 256;
+    gzip_types
+        text/plain
+        text/css
+        text/xml
+        text/javascript
+        application/json
+        application/javascript
+        application/xml+rss
+        application/atom+xml
+        image/svg+xml;
+    gzip_disable "msie6";
+
+    include /etc/nginx/conf.d/*.conf;
+}
diff --git a/PROJECTS/beginner/canary-token-generator/infra/nginx/prod.nginx b/PROJECTS/beginner/canary-token-generator/infra/nginx/prod.nginx
new file mode 100644
index 00000000..5de1926a
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/infra/nginx/prod.nginx
@@ -0,0 +1,88 @@
+# =============================================================================
+# ©AngelaMos | 2026
+# prod.nginx
+# =============================================================================
+# Production server block: serves built static files
+# Note: SSL handled by Cloudflare, not here
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    access_log /var/log/nginx/access.log main_timed buffer=32k flush=5s;
+    error_log /var/log/nginx/error.log warn;
+
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
+
+    location /health {
+        access_log off;
+        return 200 "healthy\n";
+        add_header Content-Type text/plain;
+    }
+
+    location /api/ {
+        proxy_pass http://canary;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;
+        proxy_read_timeout 30s;
+        limit_req zone=api_limit burst=20 nodelay;
+    }
+
+    location /c/ {
+        proxy_pass http://canary;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;
+        proxy_read_timeout 30s;
+    }
+
+    location /k/ {
+        proxy_pass http://canary;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;
+        proxy_read_timeout 30s;
+    }
+
+    location /assets/ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        access_log off;
+        try_files $uri =404;
+    }
+
+    location ~* \.(jpg|jpeg|png|gif|ico|svg|webp|avif|woff|woff2|ttf|eot|otf)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        access_log off;
+    }
+
+    location / {
+        add_header Cache-Control "no-cache, must-revalidate";
+        try_files $uri $uri/ /index.html;
+    }
+
+    location ~ /\. {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+}
diff --git a/PROJECTS/beginner/canary-token-generator/justfile b/PROJECTS/beginner/canary-token-generator/justfile
new file mode 100644
index 00000000..f7b18231
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/justfile
@@ -0,0 +1,239 @@
+# =============================================================================
+# ©AngelaMos | 2026
+# justfile
+# =============================================================================
+
+set shell := ["bash", "-uc"]
+set windows-shell := ["powershell.exe", "-NoLogo", "-Command"]
+
+project := file_name(justfile_directory())
+version := `git describe --tags --always 2>/dev/null || echo "dev"`
+
+# =============================================================================
+# Default
+# =============================================================================
+
+default:
+    @just --list --unsorted
+
+# =============================================================================
+# Frontend (React + Vite + Biome + Stylelint)
+# =============================================================================
+
+[group('frontend')]
+fe-install:
+    cd frontend && pnpm install --frozen-lockfile
+
+[group('frontend')]
+fe-dev:
+    cd frontend && pnpm dev
+
+[group('frontend')]
+fe-build:
+    cd frontend && pnpm build
+
+[group('frontend')]
+fe-preview:
+    cd frontend && pnpm preview
+
+[group('frontend')]
+biome *ARGS:
+    cd frontend && pnpm biome check . {{ARGS}}
+
+[group('frontend')]
+biome-fix:
+    cd frontend && pnpm biome check --write .
+
+[group('frontend')]
+stylelint *ARGS:
+    cd frontend && pnpm stylelint '**/*.scss' {{ARGS}}
+
+[group('frontend')]
+stylelint-fix:
+    cd frontend && pnpm stylelint '**/*.scss' --fix
+
+[group('frontend')]
+tsc *ARGS:
+    cd frontend && pnpm tsc --noEmit {{ARGS}}
+
+# =============================================================================
+# Backend (Go + golangci-lint + air)
+# =============================================================================
+
+[group('backend')]
+be-tidy:
+    cd backend && go mod tidy
+
+[group('backend')]
+be-vet:
+    cd backend && go vet ./...
+
+[group('backend')]
+be-lint *ARGS:
+    cd backend && golangci-lint run --timeout=5m {{ARGS}}
+
+[group('backend')]
+be-lint-fix:
+    cd backend && golangci-lint run --timeout=5m --fix
+
+[group('backend')]
+be-test *ARGS:
+    cd backend && go test -race ./... {{ARGS}}
+
+[group('backend')]
+be-test-int *ARGS:
+    cd backend && go test -race -tags=integration ./... {{ARGS}}
+
+[group('backend')]
+be-cover:
+    cd backend && go test -race -coverprofile=coverage.out ./... && go tool cover -html=coverage.out -o coverage.html
+
+[group('backend')]
+be-run:
+    cd backend && go run ./cmd/canary
+
+[group('backend')]
+be-build:
+    cd backend && CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o bin/canary ./cmd/canary
+
+[group('backend')]
+be-air:
+    cd backend && air -c .air.toml
+
+# =============================================================================
+# Combined lint + test (CI gate)
+# =============================================================================
+
+[group('lint')]
+lint: be-lint biome stylelint tsc
+
+[group('lint')]
+test: be-test
+
+[group('lint')]
+ci: lint test
+
+# =============================================================================
+# Docker Compose (Production)
+# =============================================================================
+
+[group('compose')]
+up *ARGS:
+    docker compose --env-file .env up {{ARGS}}
+
+[group('compose')]
+start *ARGS:
+    docker compose --env-file .env up -d {{ARGS}}
+
+[group('compose')]
+down *ARGS:
+    docker compose --env-file .env down {{ARGS}}
+
+[group('compose')]
+stop:
+    docker compose --env-file .env stop
+
+[group('compose')]
+build *ARGS:
+    docker compose --env-file .env build {{ARGS}}
+
+[group('compose')]
+rebuild:
+    docker compose --env-file .env build --no-cache
+
+[group('compose')]
+logs *SERVICE:
+    docker compose --env-file .env logs -f {{SERVICE}}
+
+[group('compose')]
+ps:
+    docker compose --env-file .env ps
+
+# =============================================================================
+# Docker Compose (Production + Cloudflare Tunnel)
+# =============================================================================
+
+[group('tunnel')]
+tunnel-up *ARGS:
+    docker compose --env-file .env -f compose.yml -f cloudflared.compose.yml up {{ARGS}}
+
+[group('tunnel')]
+tunnel-start *ARGS:
+    docker compose --env-file .env -f compose.yml -f cloudflared.compose.yml up -d {{ARGS}}
+
+[group('tunnel')]
+tunnel-down *ARGS:
+    docker compose --env-file .env -f compose.yml -f cloudflared.compose.yml down {{ARGS}}
+
+[group('tunnel')]
+tunnel-build *ARGS:
+    docker compose --env-file .env -f compose.yml -f cloudflared.compose.yml build {{ARGS}}
+
+[group('tunnel')]
+tunnel-rebuild:
+    docker compose --env-file .env -f compose.yml -f cloudflared.compose.yml build --no-cache
+
+[group('tunnel')]
+tunnel-logs:
+    docker compose --env-file .env -f compose.yml -f cloudflared.compose.yml logs -f cloudflared
+
+# =============================================================================
+# Docker Compose (Development)
+# =============================================================================
+
+[group('dev')]
+dev-up *ARGS:
+    docker compose --env-file .env.development -f dev.compose.yml up {{ARGS}}
+
+[group('dev')]
+dev-start *ARGS:
+    docker compose --env-file .env.development -f dev.compose.yml up -d {{ARGS}}
+
+[group('dev')]
+dev-down *ARGS:
+    docker compose --env-file .env.development -f dev.compose.yml down {{ARGS}}
+
+[group('dev')]
+dev-stop:
+    docker compose --env-file .env.development -f dev.compose.yml stop
+
+[group('dev')]
+dev-build *ARGS:
+    docker compose --env-file .env.development -f dev.compose.yml build {{ARGS}}
+
+[group('dev')]
+dev-rebuild:
+    docker compose --env-file .env.development -f dev.compose.yml build --no-cache
+
+[group('dev')]
+dev-logs *SERVICE:
+    docker compose --env-file .env.development -f dev.compose.yml logs -f {{SERVICE}}
+
+[group('dev')]
+dev-ps:
+    docker compose --env-file .env.development -f dev.compose.yml ps
+
+# =============================================================================
+# Utilities
+# =============================================================================
+
+[group('util')]
+init:
+    bash scripts/init.sh
+
+[group('util')]
+ports:
+    bash scripts/randomize-ports.sh
+
+[group('util')]
+info:
+    @echo "Project: {{project}}"
+    @echo "Version: {{version}}"
+    @echo "OS: {{os()}} ({{arch()}})"
+    @echo "Module: $(head -1 backend/go.mod | cut -d' ' -f2)"
+
+[group('util')]
+clean:
+    -rm -rf frontend/.biome_cache frontend/dist frontend/.vite frontend/.vite-temp
+    -rm -rf backend/bin backend/tmp backend/coverage.out backend/coverage.html
+    @echo "Build caches cleaned."
diff --git a/PROJECTS/beginner/canary-token-generator/learn/00-OVERVIEW.md b/PROJECTS/beginner/canary-token-generator/learn/00-OVERVIEW.md
new file mode 100644
index 00000000..d62fb196
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/learn/00-OVERVIEW.md
@@ -0,0 +1,207 @@
+<!-- © AngelaMos | 2026 | 00-OVERVIEW.md -->
+
+# Canary Token Generator
+
+## What This Is
+
+A self-hosted honeytoken service. You mint a token through the web UI, drop the resulting artifact somewhere an attacker is likely to find it, and then sit back. The moment the artifact is opened, fetched, or used, the server records the event with IP, GeoIP, user agent, and (for some token types) a browser fingerprint — then fires a Telegram message or webhook to alert you.
+
+It is the open-source spiritual cousin of Thinkst Canary and the Canarytokens.org service. Seven token types ship in the box: an invisible web bug, a slow-redirect link that captures a fingerprint before forwarding the victim onward, booby-trapped PDF and DOCX files, fake `.env` and kubeconfig credentials, and a real MySQL listener that completes the v10 handshake so an attacker's `mysql` CLI shows a plausible "Access denied" error while we log the bearer token they tried.
+
+The backend is Go on chi, with PostgreSQL for tokens and events, Redis for dedup and rate limiting, MaxMind GeoLite2 for IP geolocation, and an async worker pool for outbound notifications. The frontend is React 19 with TanStack Query.
+
+## Why This Matters
+
+Mean time to detection for a breach is, depending on whose annual report you read, somewhere between two and eight *months*. The reason is straightforward: defenders watch the obvious signal sources — failed logins, IDS alerts, EDR telemetry — and skilled attackers know to stay out of those. By the time anyone notices, the attacker has been moving laterally for a long time.
+
+Deception flips the asymmetry. A canary token has zero false-positive rate by construction. No legitimate user will ever connect to a database whose connection string only exists in a planted `.env` file. No real employee will open a PDF named `network-diagram-DO-NOT-SHARE.pdf` that nobody told them about. So when one of those events fires, you don't argue with it — you start the incident response clock and you already know the attacker is past your first-line controls.
+
+This is not theoretical. The most famous canary-driven detection is probably the 2013 Target breach analysis, where investigators reconstructed the attacker's movement through credentialed pivots that would have been visible to honeytokens in those service accounts. More recently, MITRE published the Engage framework — a deliberate counterpart to ATT&CK that catalogues deception techniques and how defenders deploy them in real environments.
+
+If you work on a blue team, this project shows you exactly how the primitives work: how a PDF can be patched byte-exact without breaking it, why the MySQL wire protocol is forgiving enough to fake, how dedup gates prevent a noisy attacker from drowning your alert channel, and how to enrich events with GeoIP and fingerprint data so the triage call goes faster.
+
+## What You'll Learn
+
+**Security Concepts:** Deception-based defense. Honeytoken mechanics across multiple file formats. The MITRE Engage framework and how it complements ATT&CK. Browser fingerprinting (the same technique advertisers use, but pointed at adversaries). Operational security for the canary infrastructure itself — why constant-time bearer comparison matters, why the trigger route returns the artifact body even when the token is invalid (enumeration resistance), and why dedup runs against `{token, source_ip}` rather than just `source_ip`. Detection patterns from real breach reports.
+
+**Technical Skills:** Idiomatic Go service design — domain layout (`token/`, `event/`, `notify/`), generator interface with seven implementations, repository pattern over pgx/sqlx, slog for structured logging, koanf for layered config, goose for migrations, chi for routing. Async worker pools with bounded queues. Redis as a coordination primitive (atomic SETNX-based dedup, token-bucket rate limiting via `go-redis/redis_rate`). MySQL wire-protocol implementation from the spec. PDF byte-exact patching that preserves cross-reference offsets. DOCX manipulation as a ZIP archive. React 19 with TanStack Query, Zod, and a TypeScript-strict build. Docker Compose multi-service orchestration with health checks, drain delays, and a Cloudflare Tunnel overlay for zero-port-exposure deployments.
+
+**Tools:** chi (router), pgx + sqlx (Postgres), goose (migrations), koanf (config), slog (logging), validator/v10 (request validation), pdfcpu (PDF parsing for the build-template command), MaxMind GeoLite2 (IP geolocation), Cloudflare Turnstile (bot mitigation on token creation), Cloudflare Tunnel (publication), miniredis + testcontainers (tests), OpenTelemetry + Jaeger (tracing), TanStack Query + Zod + Vite (frontend), Biome + Stylelint (frontend linting), Air (Go hot reload in dev).
+
+## Prerequisites
+
+### Required
+
+- Go 1.25+
+- Node.js 22+
+- Docker and Docker Compose
+- A passing familiarity with HTTP, TCP, and the request/response lifecycle
+
+### Required Tools
+
+- **just** as a command runner. Install: `curl -sSf https://just.systems/install.sh | bash -s -- --to ~/.local/bin`
+- **pnpm** for Node package management (never npm). Install: `corepack enable && corepack prepare pnpm@latest --activate`
+- **Docker Compose** (bundled with Docker Desktop or installed as a plugin)
+
+### Optional But Useful
+
+- A Telegram bot token + chat ID, or a webhook receiver (e.g. https://webhook.site), so you can see alerts arrive on a real channel
+- A free MaxMind GeoLite2 account to download the City database — without it, events still record but the `geo_*` columns stay null
+- A Cloudflare Turnstile site key + secret if you want to test the bot-mitigation flow on `POST /api/tokens`
+- A Cloudflare Tunnel token if you want to expose your local instance to the public internet through `just tunnel-up`
+
+## Quick Start
+
+```bash
+git clone https://github.com/CarterPerez-dev/Cybersecurity-Projects.git
+cd Cybersecurity-Projects/PROJECTS/beginner/canary-token-generator
+just init        # generates .env + .env.development, picks free random ports, writes an operator token
+just dev-up      # nginx → Vite + Air-reloaded Go → Postgres → Redis → Jaeger
+```
+
+`just init` prints the URL it picked. Typically that's `http://localhost:22784`, but it will pick a different port if 22784 is taken.
+
+Visit that URL. You'll land on the token creation form. Pick `Web Bug` from the dropdown, type "test token" in the memo, choose webhook as the alert channel, paste a https://webhook.site URL, then submit. The page renders the trigger URL and a manage URL.
+
+Open the manage URL in a second tab. Open the trigger URL in a third tab — you should see a tiny broken-image placeholder (the 1x1 JPEG, which the browser does fetch but doesn't render meaningfully). Refresh the manage tab. The event table now has one row: your local IP, your user-agent, an empty GeoIP cell (you're on localhost), and a `pending` notify status that flips to `sent` once the webhook fires.
+
+Check webhook.site. You should see a POST with the token ID, event ID, timestamp, source IP, user agent, and an HMAC-SHA256 signature in the `X-Canary-Signature` header.
+
+Try the other token types from the dropdown. The `.env` and kubeconfig artifacts arrive as downloadable files. The PDF and DOCX arrive as base64-encoded content the UI converts to file downloads. The `slowredirect` token asks you for a destination URL; trigger it in another tab and you'll watch a 3-second interstitial run a fingerprinting script before redirecting you. Open the manage tab afterward — the event row now has a fingerprint JSON blob attached.
+
+## Project Structure
+
+```
+canary-token-generator/
+├── backend/
+│   ├── cmd/canary/main.go            Wiring: config → DB → Redis → GeoIP → notify worker pool → router → MySQL listener → retention loop
+│   ├── cmd/buildpdftemplate/         One-shot tool: bakes the PDF placeholder into template.pdf
+│   ├── cmd/builddocxtemplate/        One-shot tool: bakes the DOCX placeholder into the footer
+│   ├── cmd/healthcheck/              Tiny Docker HEALTHCHECK binary (no curl needed in the image)
+│   └── internal/
+│       ├── token/
+│       │   ├── entity.go             Token domain type + NotifyInfo + Manage view
+│       │   ├── repository.go         pgx/sqlx-backed CRUD
+│       │   ├── service.go            Generate → persist → return artifact
+│       │   ├── handler.go            POST /api/tokens, GET/DELETE /api/m/{manageId}, GET /c/{id} trigger
+│       │   ├── types.go              Type constants (webbug, pdf, ...)
+│       │   ├── dto.go                Create/Manage request/response shapes + validation tags
+│       │   ├── contract.go           Interfaces for repository, generator registry, event recorder
+│       │   └── generators/
+│       │       ├── generator.go      Generator interface + Artifact + TriggerResponse types
+│       │       ├── registry/         Map of Type → Generator
+│       │       ├── webbug/           Embedded JPEG pixel
+│       │       ├── pixel/            Shared 1x1 GIF helper for "visited" responses
+│       │       ├── pdf/              Byte-exact placeholder substitution against embedded template.pdf
+│       │       ├── docx/             ZIP rewrite of word/footer2.xml
+│       │       ├── envfile/          Recipe shuffler + canary line injection
+│       │       │   └── recipes/      aws.go, db.go, github.go, stripe.go — produce realistic fake secrets
+│       │       ├── kubeconfig/       text/template render + wildcard /k/ handler
+│       │       ├── mysql/            protocol.go (handshake/auth/err), server.go (TCP), handler.go, generator.go
+│       │       └── slowredirect/     HTML interstitial + POST /c/{id}/fingerprint handler
+│       ├── event/                    Event entity, service, repository, contract
+│       ├── notify/                   Async worker pool (queue + dispatcher), status writer
+│       │   ├── webhook/              HMAC-signed POST with exponential backoff
+│       │   └── telegram/             Bot sendMessage client
+│       ├── middleware/               request_id, logging, recovery, realip, fingerprint, ratelimit, turnstile, operator_bearer, headers
+│       ├── geoip/                    MaxMind MMDB lookup (nop service when no DB)
+│       ├── turnstile/                Cloudflare siteverify
+│       ├── admin/                    Stats, listing, force-disable
+│       ├── core/                     DB pool, Redis client, migrations driver, telemetry init, errors, response envelopes
+│       ├── health/                   Liveness + readiness flags
+│       └── server/                   chi router shell with drain delay + graceful shutdown
+├── frontend/src/
+│   ├── api/                          Axios client, hooks, types (Zod schemas)
+│   ├── pages/landing/                Token creation form, type-aware metadata, Turnstile widget, artifact reveal
+│   └── pages/manage/                 Token detail + event feed (cursor paginated, GeoIP, dedup silence count)
+├── infra/
+│   ├── nginx/                        prod.nginx, dev.nginx (Vite HMR proxy)
+│   └── docker/                       Dockerfiles for prod binary, Air dev, Vite dev
+├── compose.yml                       Production stack
+├── dev.compose.yml                   Dev stack with Jaeger
+├── cloudflared.compose.yml           Tunnel overlay
+├── justfile                          Recipes grouped by frontend / backend / lint / compose / tunnel / dev / util
+└── learn/                            You are here
+```
+
+## How It Works (Brief)
+
+```
+                       ┌──────────────────────────────┐
+                       │  Operator (browser)          │
+                       │  React 19 + TanStack Query   │
+                       └──────────────┬───────────────┘
+                                      │
+                              POST /api/tokens
+                                      │
+                                      ▼
+┌─────────────────────────────────────────────────────────────────┐
+│  nginx → chi router (Go)                                        │
+│  Middleware chain:                                              │
+│    request_id → logger → recovery → SecurityHeaders → CORS →    │
+│    fingerprint-keyed rate limit → Turnstile → handler           │
+└──────────────────────────────┬──────────────────────────────────┘
+                               │
+                  token.Service.Create()
+                               │
+              ┌────────────────┼─────────────────┐
+              ▼                ▼                 ▼
+       generator.Generate   repo.Insert     return Artifact
+       (webbug | pdf |     (Postgres)       (URL | file |
+        docx | envfile |                     connection string)
+        kubeconfig |
+        slowredirect |
+        mysql)
+
+                          --- attacker opens artifact ---
+
+         ┌──────────────────────────────────────────────┐
+         │  GET /c/{tokenID}   (or TCP for mysql)       │
+         └──────────────────────┬───────────────────────┘
+                                │
+                  token.Handler.HandleTrigger
+                                │
+                  generator.Trigger(token, request)
+                                │
+                  event.Service.Record(notifyInfo, evt)
+                                │
+              ┌─────────────────┼─────────────────┐
+              ▼                 ▼                 ▼
+         geo.Lookup(IP)   repo.Insert(evt)   Redis SETNX
+         (GeoLite2)       (Postgres)         dedup:{id}:{ip}
+                                │                  │
+                                │       ┌──────────┴────────┐
+                                │       ▼                   ▼
+                                │   first hit?          duplicate?
+                                │       │                   │
+                                │   notify.Notify       UpdateNotifyStatus
+                                │       │               (deduped)
+                                │       ▼
+                                │   worker pool (8) → telegram | webhook
+                                │       │
+                                ▼       ▼
+                          UpdateNotifyStatus(sent | failed)
+```
+
+The flow is deliberately small. The trigger handler does almost no work synchronously — it records the event and hands off to the notification worker pool. That asymmetry matters: a curious attacker auto-fetching the URL from a thousand processes won't slow the response and won't crash the alert path either, because the worker queue is bounded and drops with a `failed` status instead of blocking ingestion.
+
+## Next Steps
+
+- [01 - Concepts](01-CONCEPTS.md): The honeytoken idea, Thinkst Canary's commercial product, the MITRE Engage framework, real breaches that honeytokens caught (and ones they would have)
+- [02 - Architecture](02-ARCHITECTURE.md): Schema, request lifecycle, the dedup gate, the notification pipeline, enumeration resistance, why MySQL gets its own listener
+- [03 - Implementation](03-IMPLEMENTATION.md): Walkthroughs of the generators (PDF byte-exact substitution, DOCX ZIP rewrite, MySQL v10 handshake), the trigger handler, the event service, and the worker pool
+- [04 - Challenges](04-CHALLENGES.md): New token types (DNS, SMTP, AWS-API), new alert channels (Slack, PagerDuty), evasion-resistance hardening
+
+## Common Issues
+
+**`just init` says "no free port found":** The init script tries ranges and gives up if everything is in use. Edit `scripts/init.sh` to widen the range, or pass `NGINX_HOST_PORT=...` explicitly in `.env`.
+
+**The Vite dev server logs `optimizing dependencies` forever:** First-run Vite cold start. Wait. Subsequent starts are fast.
+
+**Manage page shows empty GeoIP fields for an IP that's clearly not localhost:** You haven't mounted a GeoLite2 City MMDB. Get a free MaxMind license, drop the `.mmdb` in `data/geoip/GeoLite2-City.mmdb`, set `GEOLITE_PATH` in `.env`, and restart.
+
+**Notification never arrives but `notify_status` says `sent`:** The worker succeeded but Telegram/your webhook receiver rejected silently. Inspect the canary logs (`just logs canary`) for the request body — slog logs every send at debug level.
+
+**Notification stuck at `pending` and never moves:** The worker pool is wedged. Most likely cause is a webhook URL that hangs forever; the 30-second per-job timeout should release it. If it doesn't, you're looking at a goroutine leak — file an issue.
+
+**MySQL listener won't bind:** Port 3306 is probably taken by a local MySQL install. Set `MYSQL_FAKE_PORT` to something else in `.env` (the artifact's connection string uses `MYSQL_PUBLIC_HOST:MYSQL_PUBLIC_PORT`, so the public-facing values can differ from the internal listener address — useful when you're behind a port-forwarder).
diff --git a/PROJECTS/beginner/canary-token-generator/learn/01-CONCEPTS.md b/PROJECTS/beginner/canary-token-generator/learn/01-CONCEPTS.md
new file mode 100644
index 00000000..fa6f365e
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/learn/01-CONCEPTS.md
@@ -0,0 +1,279 @@
+<!-- © AngelaMos | 2026 | 01-CONCEPTS.md -->
+
+# Honeytoken Concepts
+
+This document covers the security theory behind canary tokens — what they are, why they work, how they fit into the broader deception-defense playbook, and how each of the seven token types in this project maps to attacker behaviour we see in real incident reports. Read time is roughly 20-25 minutes.
+
+---
+
+## Deception-Based Defense
+
+### The Core Idea
+
+The standard mental model for defense is a perimeter: walls, gates, guards. Stop the attacker at the edge. The problem is that real adversaries get past the edge routinely. Phishing works. Vulnerable web apps get pwned. Insiders go rogue. By the time a sophisticated attacker is in your network, the perimeter is no longer the question — the question is how long they get to wander around before someone notices.
+
+The industry numbers on that question are bad. The 2024 IBM "Cost of a Data Breach" report puts the global mean time to identify a breach at 194 days. The 2024 Verizon DBIR shows that for breaches involving stolen credentials — the most common pattern — the median time from compromise to detection is measured in months. The 2024 Mandiant M-Trends report puts the global median dwell time at 10 days, which is the first time it's dropped below two weeks, and even that improvement is mostly attributed to ransomware actors who detonate quickly enough to be loud. For stealthy financially-motivated and state-sponsored intrusions, dwell times of 6-12 months are still routine.
+
+That gap is what deception is designed to close. The pitch is straightforward: plant artifacts that no legitimate user has any reason to touch, then watch them. If anyone touches one, you have a high-confidence signal that someone is in your environment who shouldn't be, and you have it independent of whether your EDR, SIEM, or NIDS produced anything.
+
+The first formal articulation of this idea in modern security is usually credited to Clifford Stoll's 1989 book *The Cuckoo's Egg*, where he tracked a KGB-affiliated attacker through Lawrence Berkeley National Lab by leaving fake military documents on accessible systems and waiting for the attacker to read them. The contemporary commercial version is Thinkst Canary, which Haroon Meer started shipping in 2015 and which has had a noticeably outsized impact on how mature security programs think about detection.
+
+### Honeypots vs Honeytokens
+
+These get conflated a lot. They're related but operationally distinct.
+
+A **honeypot** is a fake system — a fake SSH server, a fake industrial control device, a fake database. You stand it up somewhere, attackers find it, you watch what they do. The point is usually intelligence: understanding what the attacker tries, what tools they use, what credentials they have. Cowrie, T-Pot, and Conpot are well-known open-source honeypots.
+
+A **honeytoken** is a fake artifact — a fake credential, a fake document, a fake URL. It lives inside your real environment. The point is usually detection: nobody has any reason to touch it, so the moment somebody does, you know they shouldn't be there.
+
+The two complement each other. Honeypots tell you who's at your perimeter. Honeytokens tell you who's already inside. The tradeoff is mostly operational complexity — a honeypot is a system you have to maintain, monitor, and isolate from the rest of your network. A honeytoken is a file. You drop it where it belongs and forget about it until it fires.
+
+This project builds honeytokens.
+
+### Why Honeytokens Have Near-Zero False Positives
+
+This is the killer feature. A typical EDR alert has a non-trivial false positive rate — legitimate admin behaviour looks weird, IT tools trigger heuristics, edge cases happen. SOC analysts spend a lot of their time chasing alerts that turn out to be benign, which creates alert fatigue, which is one of the ways real breaches go unnoticed.
+
+Canary tokens are designed so that the false-positive rate is structurally close to zero. The token is something nobody has any reason to touch. The `payroll-q3.pdf` on the file share is a file that exists only as bait — no employee was told about it, no automated process indexes it, no backup job opens it. So when the page-open action fires from a workstation in Belarus at 2am, you don't argue with the alert. You wake up the on-call.
+
+The qualifier "structurally close to zero" matters because the rate isn't actually zero. You get false positives when:
+
+- An automated DLP or backup tool *does* open the file (DLP tools that "render" document previews are the classic offender). The fix is to exclude your tooling explicitly or to plant tokens where those tools won't reach.
+- A search-engine crawler hits a URL token that leaked into a public page. The fix is to either tag the page `noindex` or accept the crawler as a benign trigger you've categorized.
+- A staff member stumbles across the bait file out of curiosity. This is rare and is itself useful signal — it tells you a human is browsing places they don't belong.
+
+The dedup gate in this project (15-minute Redis silence per `{token, source_ip}`) is partly a defense against the first two cases. If a crawler hits a URL token, you get one alert, not 200.
+
+### MITRE Engage
+
+MITRE Engage is the defensive companion to ATT&CK. ATT&CK is a taxonomy of what attackers do; Engage is a taxonomy of what defenders can do to deceive, deny, disrupt, and direct adversaries. It launched in 2021 (replacing the older Shield project) and lives at [https://engage.mitre.org/](https://engage.mitre.org/).
+
+The relevant Engage activities for this project:
+
+| Activity ID | Name | What It Means |
+|-------------|------|---------------|
+| EAC0002 | Detect | Get visibility into adversary activity through deception |
+| EAC0003 | Direct | Steer the adversary toward a deception artifact you control |
+| SAC0011 | Lures | Use artifacts to lure adversaries toward deceptive content |
+| SAC0007 | Burn-In | Make deception artifacts look authentic enough to attract interest |
+
+Every token type in this project maps to **SAC0011 Lures**. The `slowredirect` token additionally implements **EAC0003 Direct** by sending the attacker to a controlled destination after the fingerprint capture. Burn-in (SAC0007) — making the artifact look real — is the part of the work that's *not* in the code; it's in how you name your `.env` file, what you put in the memo of your kubeconfig, and how convincingly you place the `customer-list.docx` on the share.
+
+---
+
+## Honeytoken Mechanics
+
+Each token type relies on a specific behaviour of a specific format or protocol. Understanding the mechanism makes it clear *why* the token works and which adversaries it catches.
+
+### 1. Web Bug (HTTP-fetched pixel)
+
+**File:** `backend/internal/token/generators/webbug/generator.go`
+
+**Mechanism:** Any HTTP client that fetches the URL fires the token. The artifact is a URL pointing at a 1x1 JPEG. The response includes `Cache-Control: no-store, no-cache, must-revalidate, max-age=0` and `Pragma: no-cache` so that proxies and the browser cache don't suppress a second fetch.
+
+**Why JPEG instead of the classic 1x1 GIF:** JPEGs are slightly larger and triggered some older anti-tracking heuristics less often during testing. The internal pixel helper in `backend/internal/token/generators/pixel/pixel.go` does provide a GIF, which is used by other generators that just need a non-empty "you visited" body (PDF, DOCX, envfile, slowredirect after fingerprint POST).
+
+**Who you catch:** Anyone who renders an HTML email that contains the URL, anyone who follows a link from a Slack/Teams preview-bot, anyone running a vulnerability scanner that follows URLs. The technique is exactly the same as marketing email pixel-trackers — both sides of the deception/surveillance fence use it.
+
+**Real-world parallel:** In 2016, Mossack Fonseca (the Panama Papers law firm) was breached, and one of the post-mortem recommendations from multiple sources was deploying tracker pixels on internal documents so that exfiltrated copies would phone home when the attackers opened them. Web bugs in the Thinkst Canary product fire this signal routinely in customer environments.
+
+### 2. Slow Redirect (HTML interstitial with fingerprint capture)
+
+**Files:** `backend/internal/token/generators/slowredirect/generator.go` and `fingerprint_handler.go`
+
+**Mechanism:** The artifact is a URL the attacker clicks expecting a normal redirect. The server returns an HTML page (`template.html`) instead. That page runs a fingerprinting script that POSTs back to `/c/{tokenID}/fingerprint` with a JSON payload (canvas hash, WebGL renderer, font list, time-zone offset, CPU cores, etc.). After a 3-5 second delay the page redirects to the operator-specified destination so the attacker doesn't realise anything weird happened.
+
+**Why a delay:** Two reasons. First, the JS needs time to run — fingerprinting is synchronous-ish and finishes in milliseconds, but networks aren't always fast. Second, an instantaneous redirect would feel suspicious; users expect link-shorteners and URL-cleaners to take a beat.
+
+**Why CSP:** The response sets `Content-Security-Policy: default-src 'none'; script-src 'unsafe-inline'; connect-src 'self'` so the inline fingerprinting JS can run but the attacker's browser can't be coerced into loading external resources from our trigger page. Even though *we* control the HTML, treating it like an XSS sink is hygiene that matters when the page is technically attacker-influenced.
+
+**Who you catch:** Anyone who clicks a phishing-bait link in a planted document, in a fake admin panel URL, in a "leaked" Slack message. The fingerprint is the differentiator — for the other URL-based token types you only get IP and User-Agent, both trivially spoofable. Canvas hashes, WebGL renderer strings, and font lists are much harder to spoof reliably and let you correlate the same attacker across multiple fires.
+
+**Real-world parallel:** Browser fingerprinting is the technique advertising networks use to track users across sites without cookies. Same primitive, pointed at adversaries. Mozilla's research at [https://wiki.mozilla.org/Security/Fingerprinting](https://wiki.mozilla.org/Security/Fingerprinting) catalogues the surface in detail.
+
+### 3. PDF (page-open URI action)
+
+**File:** `backend/internal/token/generators/pdf/generator.go`, with embedded template at `template/template.pdf`
+
+**Mechanism:** The PDF spec allows a page to declare an "Additional Action" (`/AA`) dictionary. The `/O` key inside that dictionary specifies an action to take when the page is opened. One legal action type is `/URI`, which causes the PDF reader to fetch a URL. When Acrobat opens the document, it follows the URI; that fires our trigger.
+
+**Why a byte-exact substitution:** A PDF is fundamentally a stream of objects with byte-offset cross-references. If you rewrite a string and accidentally change the file length, every offset in the xref table is wrong and most readers will refuse to open the file. The trick: bake a fixed-width placeholder (`HONEY_TRACK_URL_PADDED_TO_FIXED_WIDTH`, 76 bytes) into the template, then replace it with a URL padded with `?p=____...` until it's exactly 76 bytes. Same length, same offsets, file still valid.
+
+**Why 76 bytes:** Long enough to hold `https://canary.example.com/c/abc123xyz789` plus some headroom for longer hostnames. If the operator's `PUBLIC_BASE_URL` makes the URL exceed 76 characters, the generator returns `ErrTriggerURLTooLong` rather than corrupt the file.
+
+**Caveat:** Chrome and Firefox's built-in PDF viewers (PDFium and PDF.js) deliberately strip Action objects. So this token type only fires when the attacker opens the document in Acrobat, Foxit, Preview, or any other "real" PDF reader. In practice that's most of the relevant cases — attackers exfiltrating documents typically look at them on a workstation with Acrobat or Preview, not in their browser.
+
+**Real-world parallel:** Page-open URI actions are also the mechanism behind a class of PDF malware delivery, which is why some EDR products treat them as suspicious. We're using the same primitive defensively.
+
+### 4. DOCX (footer with remote URI)
+
+**File:** `backend/internal/token/generators/docx/generator.go`
+
+**Mechanism:** A `.docx` file is a ZIP archive with a defined directory structure. The footer (typically `word/footer2.xml`) is an XML fragment that Word renders at the bottom of every page. We bake a placeholder URL into the footer and rewrite the ZIP archive entry with the real URL when the token is minted. When Word, LibreOffice, or Pages opens the document, it loads the footer, sees the URL, and fetches it.
+
+**Why footer2.xml specifically:** Word's relationship files (`.rels`) decide which footer XML the document uses. Different templates use different paths (`footer1.xml`, `footer2.xml`, `footer3.xml`). Our `buildocxtemplate` build tool is responsible for picking the right one for the template we ship; the runtime generator just preserves whichever filename the template uses.
+
+**Why ZIP-aware rewrite:** You cannot just `sed -i` a `.docx` file — the ZIP central directory records the size of each entry, and if you change the entry size without rewriting the central directory the file becomes corrupt. The generator opens the template as a `zip.Reader`, streams each entry to a `zip.Writer`, applies the URL substitution only to the footer entry, and lets the writer rebuild the central directory.
+
+**Who you catch:** Anyone opening the stolen document in Word, LibreOffice, or Pages. Cloud-based viewers (Google Docs, Office Online) sometimes don't fire the request, which is a known limitation.
+
+**Real-world parallel:** Office documents with remote-resource references have been a malware delivery vector for years (Follina / CVE-2022-30190 is the most famous recent example, though that one used MSDT not a footer URI). Same mechanism, pointed defensively.
+
+### 5. Envfile (fake `.env` with embedded canary)
+
+**Files:** `backend/internal/token/generators/envfile/generator.go` and `recipes/{aws,db,github,stripe}.go`
+
+**Mechanism:** The artifact is a plain-text `.env` file containing a mix of fake credentials. The generator picks 2-4 recipes (each producing a realistic block of fake `AWS_ACCESS_KEY_ID=...`, database URL, GitHub token, or Stripe key), shuffles the sections in random order, and then appends a single canary line:
+
+```
+INTERNAL_METRICS_ENDPOINT=https://your-canary-host/c/{tokenID}
+INTERNAL_METRICS_TOKEN=tok_live_{32-char-random}
+```
+
+The first time the attacker tries to use the `INTERNAL_METRICS_ENDPOINT` — typically by curling it as part of recon, or by running the application that consumed the `.env` and hit the endpoint as part of startup — the token fires.
+
+**Why fake credentials matter:** Burn-in. An `.env` that's just `INTERNAL_METRICS_ENDPOINT=...` and nothing else screams honeypot. An `.env` with five sections of plausible AWS/DB/GitHub/Stripe credentials and *one* canary line buried in the middle looks like an unsanitised production config file the developer forgot to gitignore. The recipes are deliberately constructed to match real credential formats (AWS keys start with `AKIA`, Stripe live keys start with `sk_live_`, GitHub PATs start with `ghp_`, etc.).
+
+**Real-world parallel:** Honey credentials in `.env` files are one of the highest-ROI deception placements in modern environments. The reason is that scraping `.env` files is one of the first things automated cloud-credential-stealer malware does (the [TeamTNT campaign](https://www.trendmicro.com/en_us/research/22/g/teamtnt-targeting-aws-alibaba.html) and various successors are well-documented examples). If you plant a single honey `.env` on a developer laptop or CI runner, you catch credential-stealer malware almost immediately on infection.
+
+### 6. Kubeconfig (fake cluster credential)
+
+**Files:** `backend/internal/token/generators/kubeconfig/generator.go`, `handler.go`, template at `template.yaml.tmpl`
+
+**Mechanism:** The artifact is a Kubernetes `kubeconfig` YAML file pointing at our server's `/k/{tokenID}` path. The bearer token in the file is `{tokenID}` itself. When the attacker copies the file to their machine and runs `kubectl --kubeconfig=stolen.yaml get pods`, kubectl tries to authenticate against our server. Our wildcard `/k/{tokenID}/*` route catches the request — including the API path kubectl appends — and fires the trigger.
+
+**Why a wildcard route:** kubectl doesn't just hit `/k/{tokenID}` — it hits `/k/{tokenID}/api/v1/namespaces/default/pods` or similar, depending on the command. The handler in `backend/internal/token/handler.go` registers `r.HandleFunc("/k/{tokenID}", ...)` and `r.HandleFunc("/k/{tokenID}/*", ...)` so kubectl's appended path doesn't bypass the trigger.
+
+**Who you catch:** Anyone running `kubectl` against the stolen config. This is gold for catching post-exploitation lateral-movement attempts in cloud-native environments, where compromised CI runners and developer laptops typically have a `~/.kube/config` with cluster admin or near-admin permissions.
+
+**Real-world parallel:** The [TeamTNT k8s-targeted campaigns](https://www.aquasec.com/blog/teamtnt-attacks-against-kubernetes-clusters/) actively scrape kubeconfig files from compromised hosts. A honey kubeconfig is one of the highest-precision detection signals available for cloud-native shops.
+
+### 7. MySQL (real wire-protocol decoy)
+
+**Files:** `backend/internal/token/generators/mysql/protocol.go`, `server.go`, `handler.go`, `generator.go`
+
+**Mechanism:** This is the most ambitious token. The artifact is a connection string like `mysql://canary_abc123xyz789@db.your-host.com:3306/internal_db`. The username prefix `canary_` (defined in `backend/internal/token/generators/mysql/handler.go` as `mysqlUsernamePrefix`) is how the listener recognises one of our tokens — anything else gets silently dropped. When the attacker uses the `mysql` CLI or a programmatic MySQL client to connect, they hit a TCP listener on our server. Our listener speaks the **real** MySQL v10 wire protocol — sends a `HandshakeV10` packet with server version `5.7.40-canary`, reads the client's auth response, extracts the username, strips the prefix to recover the token ID, and replies with a properly-formatted `ERR_PACKET` carrying SQL state `28000` and the standard MySQL error message:
+
+```
+Access denied for user 'canary_abc123xyz789'@'attacker-ip' (using password: YES)
+```
+
+From the attacker's terminal, this looks exactly like a real MySQL server rejecting their password. They'll probably try a few more times with different passwords, then give up. Each attempt records an event.
+
+**Why a real wire protocol:** Two reasons. First, it catches programmatic clients, not just CLI tools — a leaked connection string is more likely to be tried by an exfil tool's automated credential validator than by a human typing into a terminal, and those tools expect a real protocol. Second, the error message is the giveaway: a TCP listener that just closes the connection or returns garbage would tell the attacker immediately that something is off, and they might pivot to investigating. A real `Access denied` makes them assume the password is just wrong.
+
+**The packet layout** (from `protocol.go`):
+
+```
+Packet:
+  [3 bytes payload length LE] [1 byte sequence id] [payload]
+
+HandshakeV10 payload:
+  protocol version (0x0a) | server version "5.7.40-canary\0" |
+  connection id (4 bytes LE) | auth-plugin-data part 1 (8 bytes) | filler 0x00 |
+  capability flags lower (2 bytes LE = 0xf7ff) | charset (0x21 utf8mb4) |
+  status flags (2 bytes LE = 0x0002) | capability flags upper (2 bytes LE = 0x81ff) |
+  auth-plugin-data length (0x15) | reserved (10 bytes) |
+  auth-plugin-data part 2 (12 bytes) | filler 0x00 |
+  plugin name "mysql_native_password\0"
+
+ERR packet payload:
+  0xff | error code 1045 (LE) | '#' | sql state "28000" |
+  "Access denied for user '<user>'@'<host>' (using password: YES)"
+```
+
+**Real-world parallel:** Connection strings in stolen `.env` files are the bread and butter of post-exploitation credential validation. An automated tool that finds `DATABASE_URL=mysql://...` and tries to connect to it is a routine part of modern attack pipelines. This token type catches that behaviour with high fidelity because it pretends to be exactly the system the attacker is testing for.
+
+---
+
+## Operational Considerations
+
+### Burn-In (Making the Lure Believable)
+
+A canary token only works if the attacker actually touches it. The technical mechanism is the easy part; the social engineering is the hard part. Every deployment decision should ask: "would a real attacker, mid-pivot, find this and decide it's worth investigating?"
+
+A few rules from the Thinkst playbook and from real practitioners:
+
+- **File names matter.** `password.docx` is a cliche and savvy attackers may skip it. `customer-q3-2026.docx` or `Vendor-Onboarding-2024.docx` blends in. Match your real document naming conventions.
+- **Surrounding context matters.** A `.env` file alone in a directory looks staged. A `.env` next to `docker-compose.yml`, `app.py`, `requirements.txt`, and a `node_modules/` directory looks like a real repo somebody forgot to clean up.
+- **Modification timestamps matter.** Use `touch -d "2 weeks ago"` on your honey files so they don't all share a fresh creation time.
+- **Don't deploy too many.** If half the files on a share are canaries, the noise tells the attacker something. Plant a handful per host, in places the attacker has to look for.
+
+### Dedup and Why It Matters
+
+Every honeytoken deployment hits this problem within the first week: somebody scans the URL, or a backup process opens a file, or the attacker's tooling retries on failure, and your alert channel floods. The dedup gate in this project (`backend/internal/event/service.go` + Redis `dedup:trigger:{tokenID}:{sourceIP}`) silences the second-through-Nth event from the same source IP for 15 minutes after the first.
+
+The events are still recorded in Postgres — you don't lose forensic data — but only the first one fires a notification. The manage page shows a "3 duplicate triggers silenced" counter so the operator knows there's noise to investigate.
+
+15 minutes is a deliberate tradeoff. Long enough to cover most retry-loops and scan bursts. Short enough that a returning attacker after lunch produces a fresh alert.
+
+### Enumeration Resistance
+
+A naive trigger handler does this:
+
+```
+GET /c/abc                  → 404 Not Found
+GET /c/abc123xyz789         → 200 OK + pixel + record event
+```
+
+An attacker who finds a leaked log entry mentioning a `/c/...` URL can now enumerate which token IDs are real by trying URLs and watching the status codes. That's bad — it lets them suppress the alert by not actually opening the file, or it tells them the system is a canary and they should pivot.
+
+The trigger handler in this project does this instead:
+
+```
+GET /c/abc                  → 200 OK + pixel  (no event recorded)
+GET /c/abc123xyz789         → 200 OK + pixel  + record event
+```
+
+Same response either way. The attacker cannot distinguish a real token from a fake one without seeing the alert side. For `slowredirect` specifically the response is more involved because the destination URL is required, but the same principle applies: the response for an invalid token serves a generic decoy destination of `/`.
+
+### Operator Token Compromise
+
+The admin API is gated by a single bearer token in `OPERATOR_TOKEN`. If that token leaks, an attacker can list every token you've deployed and which alert channels they fire on — i.e. they get a map of your entire deception infrastructure. The middleware compares with `subtle.ConstantTimeCompare` to prevent timing-based recovery of the token. The deployment guidance is: rotate `OPERATOR_TOKEN` periodically, log all `/api/admin/*` access at the reverse-proxy layer, and treat any unauthorized admin request the same way you'd treat unauthorized access to a SIEM.
+
+---
+
+## Real-World Incidents Where Honeytokens Mattered (Or Would Have)
+
+A short selection from public post-mortems:
+
+**The DNC breach (2016).** APT28 (Fancy Bear) had access to the DNC's network for months. The breach was eventually detected via CrowdStrike's response, not through DNC's own monitoring. Multiple public analyses noted that honey credentials in service accounts and file-share locations would have provided detection signal months earlier; service-account credentials in particular are textbook honeytoken candidates because no human ever logs in with them.
+
+**SolarWinds / SUNBURST (2020).** The supply-chain compromise of the Orion update channel gave APT29 persistent access to thousands of customer networks for an average of ~9 months before public disclosure. The attack relied heavily on legitimate-looking outbound C2 traffic and credentialed lateral movement. Honey credentials in Active Directory service accounts and honey URLs in internal wikis would have given many of the victim networks a high-confidence detection. FireEye's own breach disclosure noted that one of the indicators that ultimately surfaced the campaign was unexpected access to a controlled account, which is functionally equivalent to a honeytoken trip.
+
+**Twilio breach (2022).** A phishing campaign compromised employees' credentials and gave the attackers access to internal systems for several days. Honey credentials in internal tooling — and honey URLs in internal docs that the attackers would have browsed during reconnaissance — were among the post-mortem recommendations Twilio published.
+
+**Uber breach (2022).** A social-engineering compromise of an Uber contractor's account let the attacker pivot to internal admin tools and dump credentials from a PowerShell script that contained a privileged Thycotic password. The attacker reportedly took several hours to escalate, during which honey credentials in the same PowerShell scripts they were combing through would have fired immediately.
+
+The pattern: in every case, the attackers spent meaningful time inside the network looking for credentials, files, and infrastructure to pivot through. Every minute of that is a minute a planted honeytoken could fire.
+
+---
+
+## Mapping to MITRE ATT&CK (Defensive View)
+
+Honeytokens don't map cleanly to ATT&CK because ATT&CK catalogues attacker behaviour, not defender behaviour. They map to MITRE Engage, which we covered above. But here is the inverse mapping — for each token type, the *attacker techniques* it detects:
+
+| Token | Attacker Techniques Detected |
+|-------|------------------------------|
+| `webbug` | T1213 (Data from Information Repositories) — anyone reading planted internal docs; T1114 (Email Collection) if planted in email |
+| `slowredirect` | T1566.002 (Spearphishing Link triage) — anyone clicking your honey-link; T1190 (Exploit Public-Facing Application) — scanners hitting fake admin URLs |
+| `pdf`, `docx` | T1213 (Data from Information Repositories); T1005 (Data from Local System) — anyone exfiltrating planted files |
+| `envfile` | T1552.001 (Credentials in Files); T1078 (Valid Accounts) — anyone using the fake creds |
+| `kubeconfig` | T1552.001 (Credentials in Files); T1078.004 (Cloud Accounts); T1613 (Container and Resource Discovery) |
+| `mysql` | T1552.001; T1078; T1110.001 (Brute Force: Password Guessing) — the password-spray after the first failure |
+
+A defender mapping their detection coverage against ATT&CK can use this table to claim coverage on credential-access and discovery techniques that other detection sources (EDR, NIDS, SIEM) often miss because the attacker behaviour is too quiet to register on signature- or anomaly-based monitoring.
+
+---
+
+## Further Reading
+
+- Thinkst Canary product documentation: [https://docs.canary.tools/](https://docs.canary.tools/) — the commercial reference for how this technology gets used in mature environments.
+- Canarytokens (open-source predecessor): [https://canarytokens.org/generate](https://canarytokens.org/generate) — Thinkst's free hosted version, with a wider token catalogue than this project.
+- MITRE Engage: [https://engage.mitre.org/matrix/](https://engage.mitre.org/matrix/) — the defensive deception matrix.
+- Honeytokens chapter in *The Cuckoo's Egg* by Clifford Stoll (1989) — the original.
+- "Practical Deception Engineering" by Haroon Meer (talks at BSidesLV and DEFCON over the past decade) — the modern doctrine, from the person who built Thinkst.
+- Verizon 2024 DBIR: [https://www.verizon.com/business/resources/reports/dbir/](https://www.verizon.com/business/resources/reports/dbir/) — annual data on dwell time, breach causes, detection sources.
+- IBM Cost of a Data Breach 2024: [https://www.ibm.com/reports/data-breach](https://www.ibm.com/reports/data-breach) — annual MTTI/MTTD numbers.
+
+The architecture and code-walkthrough modules ([02 - Architecture](02-ARCHITECTURE.md), [03 - Implementation](03-IMPLEMENTATION.md)) take the theory above and show you exactly how each piece is implemented.
diff --git a/PROJECTS/beginner/canary-token-generator/learn/02-ARCHITECTURE.md b/PROJECTS/beginner/canary-token-generator/learn/02-ARCHITECTURE.md
new file mode 100644
index 00000000..ec34d1ff
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/learn/02-ARCHITECTURE.md
@@ -0,0 +1,551 @@
+<!-- © AngelaMos | 2026 | 02-ARCHITECTURE.md -->
+
+# Architecture
+
+This document covers the system design. It walks through the request lifecycle for both token creation and token triggering, the schema, the dedup gate, the notification pipeline, and the deployment topology. Read time is roughly 20-25 minutes.
+
+The point is not to recap the code — that's [03 - Implementation](03-IMPLEMENTATION.md) — but to explain *why* each piece exists and why it sits where it does. Architecture decisions only make sense once you understand the constraints they're optimising against.
+
+---
+
+## High-Level Topology
+
+```
+                                   ┌────────────────────────────┐
+                                   │  Cloudflare Tunnel         │
+                                   │  (optional, public ingress)│
+                                   └─────────────┬──────────────┘
+                                                 │
+                                                 ▼
+┌─────────────────────────────────────────────────────────────────────┐
+│  nginx (reverse proxy)                                              │
+│    - Serves /  → frontend static bundle (prod) or Vite (dev)        │
+│    - Proxies /api/* → canary backend                                │
+│    - Proxies /c/*, /k/*, /healthz → canary backend                  │
+└─────────────────────────────────┬───────────────────────────────────┘
+                                  │
+                                  ▼
+┌─────────────────────────────────────────────────────────────────────┐
+│  canary (Go binary, internal port 8080)                             │
+│                                                                     │
+│   chi router with middleware chain:                                 │
+│     CleanPath → StripSlashes → RequestID → Logger → Recovery →      │
+│     SecurityHeaders → (route-specific: CORS, rate limit, Turnstile, │
+│                        operator bearer)                             │
+│                                                                     │
+│   Domains:                                                          │
+│     internal/token/     CRUD + trigger handler + generator registry │
+│     internal/event/     ingestion service with dedup gate           │
+│     internal/notify/    async worker pool                           │
+│     internal/admin/     bearer-gated operator endpoints             │
+│     internal/health/    /healthz                                    │
+│                                                                     │
+│   Background goroutines:                                            │
+│     MySQL TCP listener  (bound to MYSQL_FAKE_ADDR, accepts conns)   │
+│     Retention loop      (prunes events to a per-token limit)        │
+└──────┬───────────────────────────────────────┬──────────────────────┘
+       │                                       │
+       ▼                                       ▼
+┌──────────────────┐                  ┌───────────────────────────┐
+│ PostgreSQL 18    │                  │ Redis 7                   │
+│  tokens          │                  │  dedup:trigger:{id}:{ip}  │
+│  events          │                  │  dedup:active:{id}        │
+│  goose_db_version│                  │  ratelimit:{scope}:{key}  │
+└──────────────────┘                  └───────────────────────────┘
+                                                 │
+                                                 ▼
+                                       ┌───────────────────────┐
+                                       │ External destinations │
+                                       │  - Telegram Bot API   │
+                                       │  - Webhook receivers  │
+                                       │  - Jaeger (OTLP/gRPC) │
+                                       └───────────────────────┘
+```
+
+The shape is conventional for a Go web service: nginx in front, single Go binary in the middle, Postgres and Redis behind. The interesting parts are the dedup gate, the async notification pipeline, and the MySQL listener that lives next to the HTTP server in the same process.
+
+---
+
+## Request Lifecycle 1: Creating a Token
+
+This is the request that runs when the operator clicks "Generate" in the web UI.
+
+```
+Operator (browser)
+  │
+  │  POST /api/tokens
+  │  Content-Type: application/json
+  │  Body: { "type": "envfile", "memo": "team-laptops",
+  │           "alert_channel": "telegram",
+  │           "telegram_bot": "...", "telegram_chat": "...",
+  │           "metadata": { "include_keys": ["aws", "github"] },
+  │           "cf_turnstile_response": "..." }
+  │
+  ▼
+nginx → canary:8080
+  │
+  ▼
+chi middleware chain (in order, see backend/cmd/canary/main.go:298-308):
+  CleanPath, StripSlashes                     normalise URL
+  RequestID                                   attach uuid to ctx
+  Logger                                      slog request_start / request_end
+  Recovery                                    catch panics → 500 + structured log
+  SecurityHeaders                             CSP, HSTS, X-Frame-Options
+  CORS (per-route, /api/* only)               allowed origins from config
+  RateLimiter (per-fingerprint)               token bucket via Redis (KeyByFingerprint)
+  RateLimiter (per-minute, create scope)      separate bucket for token creation
+  RateLimiter (per-hour, create scope)        slow-bleed budget for creation
+  TurnstileVerify                             POST cf-turnstile-response to Cloudflare siteverify
+  │
+  ▼
+token.Handler.CreateToken
+  │
+  │  - validator/v10 on the CreateRequest DTO
+  │  - extract fingerprint = sha256(RealIP + UserAgent)[:16]
+  │
+  ▼
+token.Service.Create
+  │
+  ├─► generator.Generator(type) → e.g. envfile.Generator
+  │      │
+  │      └─► Generate(ctx, token, baseURL) → Artifact
+  │          (envfile picks recipes, shuffles, injects canary line)
+  │
+  ├─► token.Repository.Insert → PostgreSQL
+  │      INSERT INTO tokens (id, manage_id, type, memo, filename,
+  │        alert_channel, telegram_bot, telegram_chat, webhook_url,
+  │        created_at, created_ip, created_fp, enabled, metadata)
+  │      VALUES (...)
+  │
+  └─► Return CreateResponse { token, artifact }
+  │
+  ▼
+HTTP 201 Created
+  Body: {
+    "success": true,
+    "data": {
+      "token": {
+        "id": "abc123xyz789",
+        "manage_id": "9b1d...",
+        "type": "envfile",
+        "trigger_url": "https://canary.example.com/c/abc123xyz789",
+        "manage_url":  "https://canary.example.com/m/9b1d...",
+        ...
+      },
+      "artifact": {
+        "kind": "file",
+        "filename": ".env",
+        "content_b64": "..."
+      }
+    }
+  }
+```
+
+Notes on the chain that aren't obvious from the diagram:
+
+- **Two separate rate limiters on creation.** The fingerprint limiter is wide (default 100/min) and applies to every `/api/*` request — it's there to keep a single tab from hammering the API. The create-min / create-hour limiters are tighter and apply *only* to `POST /api/tokens`. The hour budget exists because a script could happily spread its requests across many minutes and burn through unlimited token IDs if there were no longer-window cap.
+- **Turnstile is verified last in the create chain.** That's so the cheap checks (rate limit) reject obvious abuse before we pay for the Cloudflare round-trip on every request.
+- **The fingerprint is for rate limiting, not authentication.** It's `sha256(RealIP + UserAgent)[:16]` — trivially forgeable by an attacker who knows it exists. The point is to make casual abuse harder, not to bind identity. Authentication for admin endpoints is a separate concern (constant-time bearer compare).
+
+---
+
+## Request Lifecycle 2: Triggering a Token
+
+This is the path that runs when an attacker opens the artifact. It's deliberately fast and free of synchronous side effects.
+
+```
+Attacker (or attacker's tool)
+  │
+  │  GET /c/abc123xyz789
+  │  User-Agent: curl/8.0   (or Acrobat, or Word, or kubectl, or ...)
+  │
+  ▼
+nginx → canary:8080
+  │
+  ▼
+Middleware chain (NO CORS, NO Turnstile, NO operator bearer — trigger routes are root-mounted)
+  │
+  ▼
+token.Handler.HandleTrigger (backend/internal/token/handler.go)
+  │
+  │  - Extract tokenID from URL param
+  │  - Look up token via Repository.GetByID (or treat as "fake" if not found)
+  │  - Resolve Generator by Type
+  │
+  ▼
+generator.Trigger(ctx, token, request) → Event, TriggerResponse, error
+  │
+  │  Generator-specific behaviour:
+  │   webbug       → returns embedded JPEG + cache-control:no-store
+  │   pixel-using  → returns embedded 1x1 GIF + cache-control:no-store
+  │   slowredirect → renders HTML interstitial; later POST /c/{id}/fingerprint
+  │                  attaches fingerprint to the SAME event row's `extra` column
+  │   kubeconfig   → same as webbug response
+  │   mysql        → unreachable here (TCP listener handles MySQL triggers)
+  │
+  │  In every case: returns an Event{ TokenID, SourceIP, UserAgent, Referer, ... }
+  │  with no ID yet (DB assigns BIGSERIAL on insert)
+  │
+  ▼
+Handler writes the HTTP response IMMEDIATELY
+  │  (the attacker's browser gets its bytes before the next steps run)
+  │
+  ▼
+Handler dispatches event.Service.Record asynchronously (or inline, see note)
+  │
+  ▼
+event.Service.Record (backend/internal/event/service.go)
+  │
+  ├─► geoip.Lookuper.Lookup(SourceIP) → enriches evt.Geo* fields
+  │
+  ├─► Repository.Insert → PostgreSQL (assigns evt.ID)
+  │
+  ├─► tokens.IncrementTriggerCount(tokenID) → atomic UPDATE
+  │
+  ├─► dedupGate(tokenID, sourceIP):
+  │      key = "dedup:trigger:{tokenID}:{sourceIP}"
+  │      ok, _ = redis.SetNX(key, 1, 15min)
+  │      if ok:   return true (first hit, will notify)
+  │      if !ok:  redis.Incr(key)
+  │               redis.SAdd("dedup:active:{tokenID}", sourceIP)
+  │               redis.Expire("dedup:active:{tokenID}", 15min)
+  │               return false (suppress notification)
+  │
+  ├─► if dedup says "first hit":
+  │      notify.Service.Notify(notifyInfo, evt) → enqueue dispatchJob
+  │      (returns immediately; worker pool handles delivery)
+  │
+  └─► if dedup says "duplicate":
+         repo.UpdateNotifyStatus(eventID, NotifyDeduped, nil)
+         (the event row stays in the DB for forensics; alert is suppressed)
+```
+
+An important subtlety in the codebase: the trigger handler records the event *synchronously* (DB insert + dedup + notify enqueue) before writing the HTTP response. That keeps the code paths simple and means we don't lose events if the process exits between response and DB insert. The bet is that the insert is fast enough (sub-10ms on a healthy Postgres) that the attacker's client doesn't notice the latency.
+
+The notification *delivery* is async — `event.Service.Record` only *enqueues* a `dispatchJob` and returns immediately. The actual HTTP call to Telegram or the webhook receiver runs on a worker goroutine, so a slow alert destination cannot stall the trigger response. If you wanted to push event recording onto a background queue as well (to absorb DB latency spikes during a flood), the `notify` package's worker-pool pattern would be the model — apply it to event ingestion.
+
+---
+
+## Request Lifecycle 3: MySQL Trigger (TCP, not HTTP)
+
+The MySQL token is special. The artifact is a connection string, not a URL. When the attacker connects, they speak the MySQL v10 wire protocol, not HTTP. So we run a separate TCP listener inside the same process.
+
+```
+Attacker
+  │
+  │  mysql -h db.canary.example.com -P 3306 \
+  │        -u canary_abc123xyz789 -p internal_db
+  │
+  ▼
+TCP listener (backend/internal/token/generators/mysql/server.go)
+  │
+  │  net.Listen("tcp", cfg.MySQL.FakeAddr)
+  │  accept loop spawns a goroutine per connection
+  │
+  ▼
+ConnectionHandler.HandleConnection
+  │
+  │  1. Generate random connection ID + auth-plugin-data
+  │     (crypto/rand for both — must look real to MySQL clients)
+  │
+  │  2. Write HandshakeV10 packet
+  │     (server version "5.7.40-canary", caps 0xf7ff/0x81ff, utf8mb4,
+  │      auth plugin "mysql_native_password")
+  │
+  │  3. Read ClientAuth response
+  │     (32-bit caps, 32-bit max-packet, 1-byte charset, 23-byte filler,
+  │      null-terminated username)
+  │
+  │  4. Extract token ID from username  (strip "canary_" prefix)
+  │
+  │  5. Look up token in DB
+  │     - if found and enabled: build Event, dispatch via event.Service.Record
+  │     - if not found:        still respond with Access denied (enumeration resistance)
+  │
+  │  6. Write ERR packet with sql state 28000
+  │     "Access denied for user 'canary_...'@'attacker-ip' (using password: YES)"
+  │
+  │  7. Close TCP connection
+  │
+  ▼
+Attacker's terminal:
+  ERROR 1045 (28000): Access denied for user 'canary_abc123xyz789'@'1.2.3.4' (using password: YES)
+```
+
+A few design notes:
+
+- **Same `event.Service.Record` path.** The MySQL listener doesn't bypass dedup, GeoIP, or notification. It builds the same `event.Event` struct with `extra = {"client_capabilities": ..., "client_charset": ...}` for forensic data, then hands off to the event service. That keeps the trigger logic uniform across all 7 token types.
+- **No password verification, ever.** We never try to validate the password (we don't have one to validate against). We always return `Access denied`. If we *did* accept the connection, the attacker would expect to be able to run SQL, and we'd have to fake an entire MySQL server — out of scope.
+- **Public vs internal address.** `MYSQL_FAKE_ADDR` is what the listener binds to (e.g. `0.0.0.0:3306` in the container). `MYSQL_PUBLIC_HOST` and `MYSQL_PUBLIC_PORT` are what go into the connection string we hand to the operator (e.g. `db.canary.example.com:3306`). Separating these is what lets the same instance be reachable through a reverse proxy or Cloudflare Tunnel that does port translation.
+
+---
+
+## The Dedup Gate
+
+```
+Attacker repeatedly opens /c/abc123xyz789 from IP 1.2.3.4
+  │
+  │  Hit 1 at T+0s:
+  │     SetNX("dedup:trigger:abc123xyz789:1.2.3.4", 1, 15min) → set=true
+  │     → record event, notify operator
+  │     event.notify_status = sent
+  │
+  │  Hit 2 at T+5s:
+  │     SetNX(...) → set=false (key already exists)
+  │     Incr("dedup:trigger:abc123xyz789:1.2.3.4") → 2
+  │     SAdd("dedup:active:abc123xyz789", "1.2.3.4")
+  │     Expire("dedup:active:abc123xyz789", 15min)
+  │     → record event in DB, mark notify_status = deduped
+  │     → no notification fired
+  │
+  │  Hit 3..N at T+5s..T+900s:
+  │     same as hit 2
+  │
+  │  Hit at T+901s:
+  │     SetNX(...) → set=true again (TTL expired)
+  │     → notify operator (fresh alert)
+```
+
+The dedup gate has three deliberate properties:
+
+**It fails open.** If Redis is unreachable, `dedupGate` returns `true` and the event notifies. The reasoning: a Redis outage shouldn't suppress real attacker activity. The cost is alert noise during a Redis outage, which is preferable to silent failure.
+
+**Per-`{token, source_ip}` not per-token.** Two different attackers hitting the same token from different IPs both fire notifications. That matters for shared honeyfile placements (e.g. a wiki page seen by multiple attackers in the same campaign) — you want each attacker to register as a fresh signal, not be suppressed by an earlier one.
+
+**Events are still recorded.** The `events` table gets the row regardless of dedup outcome. The dedup gate only affects whether a notification is *fired*. The manage page displays a "N duplicate triggers silenced" badge so the operator knows there's quiet activity to investigate.
+
+The `dedup:active:{tokenID}` Redis Set exists purely so the manage page can count distinct silenced IPs. `event.Service.CountActiveDedup` reads it via `SCARD`.
+
+---
+
+## The Notification Pipeline
+
+```
+event.Service.Record (decides to notify)
+  │
+  ▼
+notify.Service.Notify(info, evt)
+  │
+  │  - increment jobWg
+  │  - non-blocking send on s.queue (buffered chan dispatchJob, cap 256)
+  │  - if queue full: drop, mark NotifyFailed, decrement jobWg
+  │
+  ▼
+queue chan dispatchJob  ◄── 8 worker goroutines consume
+  │
+  ▼
+worker.dispatch
+  │
+  │  ctx, cancel := context.WithTimeout(bg, 30s)
+  │
+  ├─► sender = s.senders[info.AlertChannel]
+  │
+  ├─► if not registered: log warn, mark NotifyFailed, return
+  │
+  ├─► sender.Send(ctx, info, evt):
+  │     telegram.Send → POST api.telegram.org/bot{token}/sendMessage
+  │     webhook.Send  → POST {webhook_url}  (HMAC-signed if WEBHOOK_HMAC_SECRET set,
+  │                                          exponential backoff via cenkalti/backoff/v5)
+  │
+  ├─► on error: log warn, mark NotifyFailed
+  │
+  └─► on success: mark NotifySent with notified_at = now
+```
+
+The pipeline has three knobs in config: worker count (default 8), queue size (default 256), and per-job timeout (default 30s). The defaults are sized for a single host with low-to-moderate trigger volume. If you operate a wide canary deployment that fires hundreds of events per minute, raise the worker count and queue size.
+
+The bounded queue is important. An unbounded queue means a slow notification destination (e.g. a webhook receiver that hangs) eventually consumes all process memory. With the bounded queue, a hung sender backs up to the queue cap, then `Notify` starts dropping jobs and marking them `NotifyFailed`. The operator sees those in the manage UI and can decide what to do — typically: switch alert channels, kill the broken receiver, or scale up the worker pool.
+
+The 30-second per-job timeout is what eventually unsticks a hung sender. Even if a webhook receiver TCP-accepts and then never reads, the worker abandons after 30s and moves on.
+
+---
+
+## Schema
+
+### `tokens`
+
+```sql
+CREATE TABLE tokens (
+  id              VARCHAR(12) PRIMARY KEY,
+  manage_id       UUID UNIQUE NOT NULL,
+  type            VARCHAR(32) NOT NULL,
+  memo            TEXT NOT NULL DEFAULT '',
+  filename        TEXT,
+  alert_channel   VARCHAR(16) NOT NULL,
+  telegram_bot    TEXT,
+  telegram_chat   TEXT,
+  webhook_url     TEXT,
+  created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  created_ip      INET NOT NULL,
+  created_fp      CHAR(16) NOT NULL,
+  enabled         BOOLEAN NOT NULL DEFAULT TRUE,
+  trigger_count   BIGINT NOT NULL DEFAULT 0,
+  last_triggered  TIMESTAMPTZ,
+  metadata        JSONB NOT NULL DEFAULT '{}'::jsonb
+);
+```
+
+A few schema decisions worth flagging:
+
+- **`id` is a 12-char base62 string, not a UUID.** This is the value that goes into the trigger URL (`/c/{id}`) and the artifact body (e.g. the PDF placeholder substitution). UUIDs are 36 chars and would push the PDF placeholder to >76 bytes, breaking the byte-exact substitution. 12 chars at base62 gives ~71 bits of entropy — comfortably non-guessable.
+- **`manage_id` is a UUID v4.** This is the *operator-facing* identifier, used in `/api/m/{manageId}` for viewing token + events. Splitting it from `id` means an attacker who triggers a token cannot also enumerate to the manage page from the trigger URL.
+- **`created_ip` is `INET`.** Native Postgres type for IPv4/IPv6. Makes geographic queries via `INET <<= cidr` easy if you want to add them later.
+- **`metadata` is `JSONB`.** Type-specific config lives here (e.g. `{"destination_url": "..."}` for slowredirect, `{"include_keys": ["aws","db"]}` for envfile). Keeping it out of typed columns means new token types don't need migrations.
+
+### `events`
+
+```sql
+CREATE TABLE events (
+  id              BIGSERIAL PRIMARY KEY,
+  token_id        VARCHAR(12) NOT NULL REFERENCES tokens(id) ON DELETE CASCADE,
+  triggered_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  source_ip       INET NOT NULL,
+  user_agent      TEXT,
+  referer         TEXT,
+  geo_country     CHAR(2),
+  geo_region      VARCHAR(64),
+  geo_city        VARCHAR(64),
+  geo_asn         INT,
+  geo_asn_org     VARCHAR(128),
+  extra           JSONB NOT NULL DEFAULT '{}'::jsonb,
+  notify_status   VARCHAR(16) NOT NULL DEFAULT 'pending',
+  notified_at     TIMESTAMPTZ
+);
+```
+
+- **`id` is BIGSERIAL.** Monotonic, dense, and ideal for cursor pagination. The manage page paginates with `WHERE id < cursor ORDER BY id DESC LIMIT N`.
+- **`extra` is JSONB.** Two uses: (a) `slowredirect` token fingerprints get stored here as the raw JS-produced JSON blob; (b) MySQL events carry `{"client_capabilities": 0x..., "client_charset": 0x21}` so investigators can profile the attacking client.
+- **`notify_status` ∈ {pending, sent, failed, deduped}.** The state machine: row inserted as `pending` → dedup decides → either `deduped` (skip notify) or queue for worker → worker writes `sent` or `failed` on completion. The status is what the manage UI uses to badge each row in the table.
+
+### Indexes (migration `0003_indexes.sql`)
+
+- `tokens.manage_id` is UNIQUE NOT NULL — implicit unique index.
+- `events.token_id` — supports the manage page's `WHERE token_id = $1` filter.
+- `events.triggered_at DESC` — supports admin "recent activity" queries.
+- `events.notify_status` — supports filtering pending/failed for retry tooling.
+
+---
+
+## Frontend ↔ Backend Contract
+
+The frontend is a single-page React 19 app. It has two routes:
+
+```
+/                  Landing page (token creation form, artifact reveal after success)
+/m/:manageId       Manage page (token detail + paginated event feed)
+```
+
+State management is **TanStack Query only** — there's no Redux, no Zustand. Every server interaction is a query or mutation:
+
+```typescript
+useTokenTypes()         // GET /api/tokens/types
+useCreateToken()        // POST /api/tokens
+useManageToken(id)      // GET /api/m/:id (cursor-paginated)
+useDeleteToken(id)      // DELETE /api/m/:id
+```
+
+Each hook validates the response body against a Zod schema before handing it to the component. That means the frontend types are the *actual* shape the backend returns, not what we hope it returns — Zod throws if the contract drifts.
+
+The API client (`frontend/src/api/client.ts`) is a thin Axios wrapper with three job-specific behaviours:
+
+1. **Turnstile injection.** If the user has completed the Turnstile widget, `POST /api/tokens` automatically gets the response token in the `CF-Turnstile-Response` header and the JSON body's `cf_turnstile_response` field (the backend accepts either).
+2. **Error normalisation.** HTTP errors are mapped to typed error codes (`VALIDATION_ERROR`, `RATE_LIMITED`, `TURNSTILE_FAILED`, etc.) before being thrown, so components can branch on `err.code` instead of pattern-matching status codes.
+3. **Timeout.** 15 seconds per request. Generation can take a couple of seconds for the PDF/DOCX types because of the embedded-template manipulation, but 15s is generous.
+
+There is no WebSocket and no Server-Sent Events. The manage page polls (via TanStack Query's `refetchInterval`) every few seconds. For a low-volume canary deployment, this is plenty — events fire seconds-to-minutes apart, not milliseconds.
+
+---
+
+## Deployment Topology
+
+### Production (`compose.yml`)
+
+```
+nginx ─┬─→ canary (Go binary)
+       │     ├─→ Postgres
+       │     └─→ Redis
+       │
+       │  static assets from frontend build (mounted in nginx image)
+```
+
+Four services, no Vite, no Air, no Jaeger. The Go binary is built with `CGO_ENABLED=0 -trimpath -ldflags="-s -w"` so the resulting image is a `gcr.io/distroless/static-debian12` with the single binary. The image is around 20 MB.
+
+The `canary` container's `/healthz` is wired into the Docker healthcheck via the tiny `cmd/healthcheck` binary, which is a 1.2 MB statically-linked Go HTTP client. We ship that instead of putting `curl` in the image because distroless doesn't have curl.
+
+### Production with Cloudflare Tunnel (`cloudflared.compose.yml`)
+
+```
+cloudflared (tunnel client) ─→ Cloudflare edge ─→ public internet
+       │
+       └─→ nginx (internal only, no exposed port)
+```
+
+The tunnel overlay swaps the nginx port-mapping for a `cloudflared` sidecar that maintains an outbound TLS connection to Cloudflare's edge. The instance becomes publicly reachable through `your-tunnel-name.your-domain` without opening any inbound port. That's especially useful for self-hosted deployments on residential connections or behind NAT.
+
+### Development (`dev.compose.yml`)
+
+```
+nginx ─┬─→ frontend (Vite HMR)
+       │
+       └─→ canary (Air-reloaded Go)
+             ├─→ Postgres
+             ├─→ Redis
+             └─→ Jaeger  (OTLP/gRPC + UI at :16686)
+```
+
+The dev compose:
+
+- Mounts `frontend/` and `backend/` into the containers so file changes trigger reloads.
+- Runs the backend with `air` (https://github.com/cosmtrek/air) for hot reload on `.go` file changes.
+- Boots Jaeger so OpenTelemetry traces from the backend can be inspected at `http://localhost:16686`.
+- Uses a separate compose project name (`canary-token-generator-dev`) so it doesn't conflict with a running production stack on the same host.
+
+### Why Both Compose Files
+
+A common pitfall is using a single compose file with optional services. The result is fragile: developers have to remember which `--profile` to pass, and CI scripts diverge from local commands. Two files keeps the boundary crisp — `just dev-up` is unambiguously the dev stack, `just up` is unambiguously prod. The `compose.yml` + `cloudflared.compose.yml` override is a separate concern (production with vs without public exposure).
+
+---
+
+## Configuration
+
+The service is configured via `config.yaml` (defaults) overridden by environment variables, loaded with [koanf](https://github.com/knadh/koanf) (see `backend/internal/config/config.go`). The pattern is:
+
+1. Load `config.yaml` for defaults.
+2. Overlay env vars (matching the key path with `__` separators, e.g. `SERVER__PORT=8080` overrides `server.port`).
+3. Validate the resulting struct against `validator/v10` tags.
+
+The interesting env vars:
+
+| Variable | Purpose |
+|----------|---------|
+| `PUBLIC_BASE_URL` | The hostname token URLs are minted against. **This is the thing that goes into your artifacts.** |
+| `OPERATOR_TOKEN` | Bearer token for `/api/admin/*`. Unset → admin routes don't register. |
+| `TURNSTILE_SECRET` | Cloudflare Turnstile server-side secret. Unset → Turnstile middleware is a no-op. |
+| `WEBHOOK_HMAC_SECRET` | Used to sign outbound webhooks with HMAC-SHA256 in `X-Canary-Signature`. |
+| `GEOLITE_PATH` | Path to the GeoLite2-City MMDB. Unset → GeoIP lookups are nop. |
+| `MYSQL_FAKE_ENABLED` | Boolean. If false, the MySQL token type is hidden from `/api/tokens/types` and the listener doesn't spawn. |
+| `MYSQL_FAKE_ADDR` | TCP listener bind address, e.g. `0.0.0.0:3306`. |
+| `MYSQL_PUBLIC_HOST` / `MYSQL_PUBLIC_PORT` | What gets baked into the artifact connection string. |
+| `EVENT_DEDUP_TTL` | Per-`{token, ip}` silence window. Default 15m. |
+| `EVENT_RETENTION_PER_TOKEN` | The retention loop prunes events past this count per token. 0 = no pruning. |
+| `OTEL_EXPORTER_OTLP_ENDPOINT` | Where to send OpenTelemetry traces. Unset → tracing disabled. |
+| `LOG_LEVEL` / `LOG_FORMAT` | `debug|info|warn|error` and `json|text`. |
+| `TRUSTED_PROXY_CIDRS` | Required for correct `RealIP` extraction behind nginx/Cloudflare. |
+
+The `TRUSTED_PROXY_CIDRS` value matters more than people expect. The `RealIP` middleware reads `X-Forwarded-For` only if the immediate peer is in the trusted CIDR list. If you forget to set it for your reverse proxy, every event will show the proxy's IP as the source IP. If you set it too widely, an attacker can spoof their IP by forging `X-Forwarded-For`.
+
+---
+
+## What Isn't In This Architecture (And Why)
+
+A few omissions are deliberate.
+
+**No multi-tenancy.** A single deployment is one operator's canary deployment. If you want per-team isolation, run multiple deployments (cheap, since the binary is small and Postgres/Redis can be shared). Adding multi-tenancy would require auth on token creation, which adds a lot of complexity for a beginner project.
+
+**No alert routing rules.** Every token has a single alert channel chosen at creation. No "if envfile then PagerDuty, else Telegram" routing. That kind of routing is something a real ops team builds on top of the webhook receiver, not in the canary itself.
+
+**No replay or backfill.** If the worker pool drops jobs to `NotifyFailed`, there's no built-in retry loop. The data is in the DB; you can write a one-off script to re-process failed events through a fresh notification call. A cron-style retry job is in `04-CHALLENGES.md` as an extension exercise.
+
+**No clustering.** One process, one host. The dedup gate uses Redis which is shareable, so multi-instance is *possible*, but the MySQL TCP listener and the retention loop aren't designed for leader election. If you genuinely need to scale this past one host, you've outgrown the project's intended audience.
+
+The next document, [03 - Implementation](03-IMPLEMENTATION.md), takes the architecture above and points you at the exact code that implements each piece.
diff --git a/PROJECTS/beginner/canary-token-generator/learn/03-IMPLEMENTATION.md b/PROJECTS/beginner/canary-token-generator/learn/03-IMPLEMENTATION.md
new file mode 100644
index 00000000..8a437249
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/learn/03-IMPLEMENTATION.md
@@ -0,0 +1,612 @@
+<!-- © AngelaMos | 2026 | 03-IMPLEMENTATION.md -->
+
+# Implementation Walkthrough
+
+This document walks through the actual code that implements the architecture in [02 - Architecture](02-ARCHITECTURE.md). For each major piece I'll cite the file paths, the relevant function/type names, and the design decisions baked into the implementation. The point is not to read every line — it's to know exactly where to look when you want to extend or debug a specific behaviour. Read time is roughly 25-30 minutes.
+
+---
+
+## Wiring (`backend/cmd/canary/main.go`)
+
+This is the file you read first to understand how the pieces connect. `run()` does the following, in order:
+
+1. **Load config.** `config.Load(configPath)` reads `config.yaml`, overlays env vars via koanf, validates with `validator/v10`, returns a `*config.Config`.
+2. **Set up logger.** `setupLogger(cfg.Log)` builds a `*slog.Logger` configured for JSON or text output at the configured level, then `slog.SetDefault(logger)` makes it the package-default.
+3. **Configure trusted proxies.** `middleware.SetTrustedProxyCIDRs(cfg.Server.TrustedProxyCIDRs)` parses and stores the CIDRs that `RealIP` is allowed to trust.
+4. **Initialise telemetry.** `initTelemetry(ctx, cfg, logger)` builds the OpenTelemetry SDK + OTLP gRPC exporter if `OTEL_EXPORTER_OTLP_ENDPOINT` is set; otherwise returns a nop tracer.
+5. **Open Postgres.** `core.NewDatabase(ctx, cfg.Database)` creates the connection pool (pgx + sqlx). `core.RunMigrations(db.SQLDB())` runs the goose migrations in `backend/internal/core/migrations/`.
+6. **Open Redis.** `core.NewRedis(ctx, cfg.Redis)` returns a `*redis.Client` with health-check ping at startup.
+7. **Open GeoIP.** `openGeoIP(cfg, logger)` returns a `geoip.Lookuper` and a closer. If `GEOLITE_PATH` is unset or the MMDB fails to open, it returns `geoip.NopService()` so the event service keeps working with empty geo fields.
+8. **Build event + notify stacks.** `buildEventStack` constructs the `notify.Service` worker pool, registers Telegram and webhook senders, and builds the `event.Service` that ties everything together.
+9. **Build HTTP deps.** `buildHTTPDeps` constructs the Turnstile verifier, the health handler, the token service (with the generator registry), and the token HTTP handler.
+10. **Mount the router.** `mountRouter` builds the `*server.Server` (chi router shell) and registers every route under the right middleware chain.
+11. **Spawn the MySQL listener.** `spawnMySQLListener` opens a TCP listener if `cfg.MySQL.FakeEnabled` is true and runs the accept loop in a goroutine.
+12. **Spawn the retention loop.** `spawnRetentionLoop` starts the periodic `event.Service.RunRetentionLoop` goroutine if `cfg.Event.RetentionPerToken > 0`.
+13. **Serve.** `srv.Start()` runs in a goroutine; the main goroutine waits on the signal context (`signal.NotifyContext(SIGINT, SIGTERM)`).
+14. **Graceful shutdown.** When a signal arrives, `srv.Shutdown(ctx, drainDelay)` flips the health endpoint to not-ready, waits `drainDelay` for load balancers to stop sending traffic, then shuts down the HTTP server. The MySQL listener and retention loop bound to the same context exit on their own.
+
+If you only read one file in the codebase, this is the one.
+
+---
+
+## Generator Interface (`backend/internal/token/generators/generator.go`)
+
+Every token type implements this interface:
+
+```go
+type Generator interface {
+    Type() token.Type
+    Generate(ctx context.Context, t *token.Token, baseURL string) (Artifact, error)
+    Trigger(ctx context.Context, t *token.Token, r *http.Request) (*event.Event, *TriggerResponse, error)
+}
+
+type Artifact struct {
+    Kind             ArtifactKind  // KindURL | KindFile | KindText | KindConnectionString
+    URL              string
+    Filename         string
+    Content          []byte
+    ContentType      string
+    ConnectionString string
+}
+
+type TriggerResponse struct {
+    StatusCode   int
+    ContentType  string
+    Body         []byte
+    ExtraHeaders map[string]string
+}
+```
+
+Generators are stateless beyond a few config values baked at construction (e.g. `mysql.Generator` keeps `publicHost`/`publicPort`/`database`). The registry at `backend/internal/token/generators/registry/registry.go` is just a `map[token.Type]Generator` populated at startup.
+
+The same generator handles both creation (`Generate`) and trigger (`Trigger`). That keeps each type's logic in one file. The exceptions are `mysql` (HTTP `Trigger` returns `ErrHTTPTriggerNotSupported`; real triggering happens via TCP) and `slowredirect` (which adds a separate `POST /c/{id}/fingerprint` handler for capturing the fingerprint JSON after the interstitial).
+
+---
+
+## Generators, One By One
+
+### `webbug` (the simplest one)
+
+**File:** `backend/internal/token/generators/webbug/generator.go`
+
+```go
+//go:embed asset/pixel.jpg
+var pixelBytes []byte
+```
+
+`Generate` returns a `KindURL` artifact pointing at `{baseURL}/c/{t.ID}`. `Trigger` returns the embedded JPEG with `Cache-Control: no-store, no-cache, must-revalidate, max-age=0` and `Pragma: no-cache`. The event captures `SourceIP` (via `middleware.RealIP(r)`), `UserAgent`, and `Referer`.
+
+If `t == nil` (unknown token ID), `Trigger` still returns the pixel response but with no event — that's the enumeration-resistance behaviour described in 01-CONCEPTS.md.
+
+This is the template every other HTTP-triggered generator follows.
+
+### `pixel` (the shared helper)
+
+**File:** `backend/internal/token/generators/pixel/pixel.go`
+
+Not a generator; a shared 43-byte transparent GIF that every "visited" response body uses (PDF, DOCX, envfile, slowredirect-after-fingerprint, kubeconfig). The package exposes `ContentType = "image/gif"` and a `Clone()` helper that returns a fresh `[]byte` copy so handlers don't accidentally mutate the shared slice.
+
+Why separate from webbug's JPEG? Two-pixel hygiene: the visible web bug is JPEG because some content-blocking heuristics treat 1x1 GIFs specifically as advertiser pixels; the "you opened a file" response is GIF because it's already an HTTP image response and nobody is going to render it anyway.
+
+### `pdf` (byte-exact substitution)
+
+**File:** `backend/internal/token/generators/pdf/generator.go`
+
+The key constants:
+
+```go
+const (
+    placeholderRoot   = "HONEY_TRACK_URL_PADDED_TO_FIXED_WIDTH"
+    PlaceholderLength = 76
+    padChar           = "_"
+    queryPadPrefix    = "?p="
+)
+
+//go:embed template/template.pdf
+var pdfTemplate []byte
+```
+
+The template (built by `cmd/buildpdftemplate/main.go` with pdfcpu) has the literal `HONEY_TRACK_URL_PADDED_TO_FIXED_WIDTH___________________________________________________` (76 bytes) baked into a `/AA /O /URI` page-open action.
+
+`Generate` builds `triggerURL`, refuses to proceed if it exceeds 76 bytes, pads it with `?p=____...` to be exactly 76 bytes, and runs `bytes.Replace(pdfTemplate, placeholder, padded, 1)`. Two defensive checks then guard against template corruption:
+
+```go
+if len(out) != len(pdfTemplate) {
+    return ..., fmt.Errorf("pdf: substitution changed byte length")
+}
+if !bytes.Contains(out, []byte(triggerURL)) {
+    return ..., fmt.Errorf("pdf: substitution did not embed trigger URL")
+}
+```
+
+Both should be unreachable if the template is correct, but they catch a class of regressions where someone updates the template without re-running `buildpdftemplate`.
+
+`padTriggerURL` is worth flagging because the padding strategy has a corner case: if the URL is exactly 75 bytes (one short of the placeholder length), `?p=` plus zero padding chars is impossible because `?p=` is 3 bytes itself. The function falls back to padding with underscores directly:
+
+```go
+case needed >= len(queryPadPrefix):
+    return triggerURL + queryPadPrefix +
+        strings.Repeat(padChar, needed-len(queryPadPrefix))
+default:
+    return triggerURL + strings.Repeat(padChar, needed)
+```
+
+The plain-underscore tail is technically a malformed URL but PDF readers won't fetch it as a URL anyway — the page-open action invokes the URL via the `/URI` value verbatim, so the underscore-padded one resolves to the same path on our server with garbage trailing chars that we ignore.
+
+### `docx` (ZIP rewrite)
+
+**File:** `backend/internal/token/generators/docx/generator.go`
+
+The whole thing is `patchTemplate(docxTemplate, triggerURL)`. It:
+
+1. Opens the embedded `template.docx` as a `zip.Reader`.
+2. Opens a `bytes.Buffer` and a `zip.Writer` writing into it.
+3. Iterates every entry in the input ZIP.
+4. If the entry name is `word/footer2.xml`, does a single `bytes.Replace(body, "HONEY_TRACK_URL", triggerURL, 1)` on its contents. Otherwise leaves the body alone.
+5. Calls `w.CreateHeader(&zip.FileHeader{Name: f.Name, Method: f.Method})` and writes the body.
+6. Closes the writer (which finalises the central directory).
+
+The `Method: f.Method` part matters. ZIP entries can be `Store` (no compression) or `Deflate` (DEFLATE-compressed). DOCX uses Deflate for most XML entries. If you accidentally rewrite an entry under a different method, Word can usually open it but loses the streaming-decompress fast-path. Preserving the original method keeps the output byte-shape close to a normal DOCX.
+
+Why no length check like in PDF? DOCX is forgiving — the central directory records sizes per-entry, so changing one entry's length doesn't break offsets in other entries. The `zip.Writer` recomputes the central directory from scratch. Word doesn't care.
+
+### `envfile` (recipes + canary line)
+
+**File:** `backend/internal/token/generators/envfile/generator.go`
+
+`Generate` workflow:
+
+```
+keys      = ExtractIncludeKeys(t.Metadata)    // default ["aws", "db"] if absent
+trigger   = baseURL + "/c/" + t.ID
+sections  = BuildSections(keys, trigger)      // per-recipe blocks + canary block
+shuffle   = ShuffleSections(sections)         // crypto/rand Fisher-Yates
+body      = RenderSections(sections)          // adds NODE_ENV=production header
+```
+
+The canary block is:
+
+```go
+sections = append(sections, []recipes.EnvLine{
+    {Comment: "Internal monitoring (Datadog-style integration)"},
+    {Key: "INTERNAL_METRICS_ENDPOINT", Value: triggerURL},
+    {Key: "INTERNAL_METRICS_TOKEN",
+     Value: "tok_live_" + recipes.RandomAlnumMixed(32)},
+})
+```
+
+Note that the comment uses "Datadog-style integration" specifically — the burn-in is the comment that explains *why* this `.env` would contain a `INTERNAL_METRICS_ENDPOINT`, so an attacker reading the file accepts it as a plausible production config detail and tries to ping it.
+
+**Recipes** (`backend/internal/token/generators/envfile/recipes/`):
+
+| File | Produces |
+|------|----------|
+| `aws.go` | `AWS_ACCESS_KEY_ID=AKIA...` (20 chars), `AWS_SECRET_ACCESS_KEY=` (40 base64-ish chars), `AWS_REGION=us-east-1` etc. |
+| `db.go` | `DATABASE_URL=postgresql://...:5432/...`, `REDIS_URL=redis://...`, etc. |
+| `github.go` | `GITHUB_TOKEN=ghp_...` (36-char personal access token shape) |
+| `stripe.go` | `STRIPE_SECRET_KEY=sk_live_...`, `STRIPE_PUBLISHABLE_KEY=pk_live_...` |
+
+The fake values are deliberately constructed to *look* legitimate (AKIA-prefix for AWS, ghp_-prefix for GitHub, sk_live_-prefix for Stripe) without being valid credentials. An attacker who validates them against the real service gets a 401 from the real provider — which actually helps the deception, because their next move is usually "the creds are stale, let me try the next one in this file" and the next one is our canary.
+
+`shuffleSections` is a crypto/rand-driven Fisher-Yates over the section slice. Using crypto/rand instead of `math/rand` is overkill for this purpose, but it gives an unpredictable section order that doesn't reveal a generator seed if an attacker collected many sample artifacts and pattern-analysed them.
+
+### `kubeconfig` (text/template render)
+
+**File:** `backend/internal/token/generators/kubeconfig/generator.go`, with template at `template.yaml.tmpl`
+
+The template (simplified):
+
+```yaml
+apiVersion: v1
+kind: Config
+clusters:
+- name: {{.ClusterName}}
+  cluster:
+    server: {{.APIServerURL}}
+    insecure-skip-tls-verify: true
+contexts:
+- name: {{.ContextName}}
+  context:
+    cluster: {{.ClusterName}}
+    user: {{.UserName}}
+current-context: {{.ContextName}}
+users:
+- name: {{.UserName}}
+  user:
+    token: {{.Token}}
+```
+
+`Generate` fills in `ClusterName` (default `prod-cluster`, overridable via metadata), `UserName` (default `svc-backup-reader`), `APIServerURL = baseURL + "/k/" + t.ID`, and `Token = t.ID`. The default user name is the burn-in — `svc-backup-reader` sounds like a real service account, not "honeypot-user".
+
+**The wildcard handler** (`handler.go` + `token/handler.go`):
+
+```go
+// in token/handler.go RegisterTriggerRoutes:
+r.HandleFunc("/k/{tokenID}", h.HandleTrigger)
+r.HandleFunc("/k/{tokenID}/*", h.HandleTrigger)
+```
+
+kubectl with a kubeconfig pointing at `https://canary.example.com/k/abc123xyz789` won't hit that path directly — it'll hit `https://canary.example.com/k/abc123xyz789/api/v1/namespaces/default/pods` or similar, depending on the command. The `/*` wildcard catches everything kubectl appends. The kubeconfig generator's `Trigger` returns the same pixel response as webbug (just to satisfy the contract — kubectl ignores the response body once it gets a non-2xx).
+
+Actually, look at the response status more carefully: the handler returns 200 OK with a GIF body. kubectl typically expects JSON; it'll fail to parse and emit a connection error. From the attacker's perspective, the kubeconfig "works" enough to suggest the cluster is real but their auth is being rejected — same trick as the MySQL token.
+
+### `mysql` (real wire protocol)
+
+**Files:** `backend/internal/token/generators/mysql/protocol.go`, `server.go`, `handler.go`, `generator.go`
+
+The four files split cleanly:
+
+- `protocol.go` — pure functions: `BuildHandshakeV10`, `ReadClientAuth`, `BuildAccessDeniedErr`, `wrapPacket`, `readPacket`. No I/O dependencies; everything takes `io.Reader`/`io.Writer` or `[]byte`. This is testable in isolation and the test file (`protocol_test.go`) does exactly that — round-trips packets and checks every field.
+- `server.go` — `Server.Run(ctx)` is the accept loop. It dials `net.Listen("tcp", addr)`, then loops `listener.Accept()` and spawns `go handler.HandleConnection(ctx, conn)` per connection. Shutdown is via `listener.Close()` from the parent goroutine.
+- `handler.go` — `Handler.HandleConnection(ctx, conn)` is the per-connection logic.
+- `generator.go` — `Generate` produces the connection string artifact. `Trigger` returns `ErrHTTPTriggerNotSupported` because MySQL doesn't go through the HTTP trigger path.
+
+**The handshake sequence** in `handler.go`:
+
+```go
+func (h *Handler) HandleConnection(ctx context.Context, conn net.Conn) {
+    defer conn.Close()
+    conn.SetDeadline(time.Now().Add(10 * time.Second))
+
+    h.writeHandshake(conn)                  // send HandshakeV10
+    auth, _ := ReadClientAuth(conn)         // read client auth response
+
+    if !strings.HasPrefix(auth.Username, "canary_") {
+        return                              // not our token, just drop
+    }
+    tokenID := strings.TrimPrefix(auth.Username, "canary_")
+
+    tok, _ := h.tokens.GetByID(ctx, tokenID)
+    if tok == nil {
+        return                              // unknown token, just drop
+    }
+
+    sourceHost := remoteHost(conn)
+    h.recordEvent(ctx, tok, sourceHost, auth)
+    h.writeAccessDenied(conn, auth.Username, sourceHost)
+}
+```
+
+Notice the `canary_` prefix gate. Any client that doesn't send a `canary_*` username gets dropped silently — no handshake response, no error. That keeps generic MySQL scanners from extracting our `5.7.40-canary` server version banner via casual probing.
+
+The `extra` JSONB stored on the event records the client's reported capabilities (e.g. `0x81bea285` for a typical `mysql` CLI) and charset (`0x21` for utf8mb4). Different attackers' tools have different capability fingerprints — a `mysql-cli` connection from a Linux host looks different from a Python `mysql-connector` connection looks different from a Go `database/sql` connection. The capability fingerprint is forensic gold.
+
+**The error packet** in `protocol.go`:
+
+```go
+func BuildAccessDeniedErr(username, sourceHost string) ([]byte, error) {
+    msg := fmt.Sprintf(
+        `Access denied for user '%s'@'%s' (using password: YES)`,
+        username, sourceHost,
+    )
+    var payload bytes.Buffer
+    payload.WriteByte(0xff)                           // ERR packet marker
+    binary.LittleEndian.PutUint16(buf[:], 1045)       // MySQL error 1045
+    payload.Write(buf[:])
+    payload.WriteByte('#')                            // SQL state marker
+    payload.WriteString("28000")                      // SQL state for auth fail
+    payload.WriteString(msg)
+    return wrapPacket(payload.Bytes(), seqIDServerErr)
+}
+```
+
+Error code 1045 with SQL state 28000 is the standard MySQL auth-failure code. The message format is verbatim what a real MySQL server emits. If you ran a real MySQL and connected with a wrong password, you'd see the same text byte-for-byte.
+
+### `slowredirect` (HTML interstitial + fingerprint)
+
+**Files:** `backend/internal/token/generators/slowredirect/generator.go`, `fingerprint_handler.go`
+
+**`Generate`** builds a `KindURL` artifact pointing at `/c/{tokenID}` (same as webbug). The interesting part is `Trigger`.
+
+**`Trigger`** renders an HTML template (not embedded as a `[]byte` — embedded as `text/template.Template` parsed at startup) with:
+
+```
+{
+  "FingerprintURL": "/c/{tokenID}/fingerprint",
+  "Destination":    "<operator-supplied destination URL>"
+}
+```
+
+The template includes inline JS that:
+
+1. Collects browser fingerprint signals (canvas, WebGL, fonts, timezone, etc.) using a small fingerprinting helper.
+2. POSTs the JSON blob to `{FingerprintURL}`.
+3. Waits a few seconds (template constant) so the fingerprint POST has time to complete.
+4. Runs `window.location.replace(Destination)`.
+
+The CSP header is set explicitly:
+
+```
+Content-Security-Policy: default-src 'none'; script-src 'unsafe-inline'; connect-src 'self'
+```
+
+This locks the page down so that even if the destination is an attacker-controlled URL passed through the operator's `metadata.destination_url`, the interstitial cannot be coerced into loading external scripts or making cross-origin XHRs.
+
+**`fingerprint_handler.go`** is the POST handler:
+
+```go
+func (g *Generator) HandleFingerprint(w http.ResponseWriter, r *http.Request) {
+    tokenID := chi.URLParam(r, urlParamTokenID)
+
+    body, _ := io.ReadAll(io.LimitReader(r.Body, maxFingerprintBytes))
+
+    // Sanity-check that it's valid JSON; we don't parse the structure.
+    var dummy json.RawMessage
+    if err := json.Unmarshal(body, &dummy); err != nil {
+        w.WriteHeader(http.StatusNoContent)
+        return
+    }
+
+    g.fingerprintRecorder.AttachFingerprint(
+        r.Context(), tokenID, middleware.RealIP(r), body,
+    )
+    w.WriteHeader(http.StatusNoContent)
+}
+```
+
+The fingerprint always returns 204 No Content — even on error. That's deliberate: if the attacker's network panel shows the fingerprint POST returning 400 or 500, they might notice. 204 with empty body is the most boring response possible.
+
+`AttachFingerprint` writes the JSON blob to the *same event row* that the original trigger created, by updating `events.extra` for the most recent event matching `(token_id, source_ip)` within a short time window. That's why the manage page can show a fingerprint column alongside the trigger event: it's the same row.
+
+**Enumeration resistance for slowredirect:** if the token ID is unknown, the response still renders a slowredirect HTML page — but with `Destination = "/"`. The attacker sees a redirect-to-root, which is indistinguishable from a token whose operator chose `/` as the destination. They can't tell the token is fake without seeing our alert side.
+
+---
+
+## The Trigger Handler (`backend/internal/token/handler.go`)
+
+`HandleTrigger` is the function called for every `GET /c/{id}` and `* /k/{id}`. The shape:
+
+```go
+func (h *Handler) HandleTrigger(w http.ResponseWriter, r *http.Request) {
+    id := strings.TrimRight(chi.URLParam(r, urlParamTokenID), "_")
+    if id == "" {
+        http.NotFound(w, r)
+        return
+    }
+
+    tok, _ := h.svc.GetByID(r.Context(), id)
+    if tok != nil && !tok.Enabled {
+        tok = nil   // treat disabled tokens like unknown ones
+    }
+
+    gen, ok := h.resolveGenerator(tok, r)   // picks generator by path (/c/ vs /k/)
+    if !ok {
+        http.NotFound(w, r)
+        return
+    }
+
+    evt, resp, _ := gen.Trigger(r.Context(), tok, r)
+    if resp == nil {
+        http.NotFound(w, r)
+        return
+    }
+
+    if tok != nil && evt != nil {
+        h.events.Record(r.Context(), tok, evt)
+    }
+
+    h.writeTriggerResponse(w, r, resp)
+}
+```
+
+Several things to note:
+
+**Trailing underscore trim.** `strings.TrimRight(id, "_")` handles the PDF padded URL — recall that PDF tokens have `?p=____` padding appended. Most readers strip the query string but some malformed readers send the underscores as part of the path. Trimming `_` is a tolerance for that.
+
+**Disabled tokens look unknown.** When the operator soft-disables a token (`DELETE /api/m/{manageId}`), the row stays in the DB but `enabled=false`. The trigger handler sets `tok = nil` for disabled tokens, which causes `resolveGenerator` to pick the default (webbug) and produces a pixel response with no event recorded — exactly the same behaviour as for a completely unknown token. From the attacker's perspective, there's no way to tell if a token was never minted or was minted-then-disabled.
+
+**`resolveGenerator` picks by path prefix.** If `r.URL.Path` starts with `/k/`, the kubeconfig generator handles it. Otherwise the generator is looked up by `tok.Type`. This is how the wildcard `/k/.../*` route plumbs through to the kubeconfig generator without an explicit type lookup.
+
+**Event recording is synchronous.** As covered in the architecture doc, `h.events.Record` runs *before* `writeTriggerResponse`. The trade-off is bounded by Postgres insert latency (typically sub-10ms).
+
+---
+
+## Event Service (`backend/internal/event/service.go`)
+
+`Service.Record` is the choreographer. The flow:
+
+```go
+func (s *Service) Record(ctx context.Context, info NotifyInfo, evt *Event) error {
+    s.enrichGeo(evt)                              // attach GeoIP if available
+    s.repo.Insert(ctx, evt)                       // assigns evt.ID
+    s.tokens.IncrementTriggerCount(ctx, info.TokenID)
+    first := s.dedupGate(ctx, info.TokenID, evt.SourceIP)
+    if !first {
+        s.repo.UpdateNotifyStatus(ctx, evt.ID, NotifyDeduped, nil)
+        return nil
+    }
+    if s.notifier != nil {
+        s.notifier.Notify(info, evt)              // enqueue, returns immediately
+    }
+    return nil
+}
+```
+
+A subtle correctness property: the event row is inserted *before* the dedup gate check. That means even duplicate-suppressed events are persisted (with `notify_status = deduped`). The manage page can show "3 silenced triggers from 1.2.3.4" because the rows exist; it's just that no alerts fired for them.
+
+The `dedupGate` function uses Redis `SETNX` for atomic first-acquire semantics:
+
+```go
+key := DedupKey(tokenID, sourceIP)           // "dedup:trigger:abc:1.2.3.4"
+set, _ := s.rdb.SetNX(ctx, key, 1, 15*time.Minute).Result()
+if set { return true }                       // first hit
+s.rdb.Incr(ctx, key)
+s.rdb.SAdd(ctx, "dedup:active:"+tokenID, sourceIP)
+s.rdb.Expire(ctx, "dedup:active:"+tokenID, 15*time.Minute)
+return false                                 // duplicate
+```
+
+The second Redis operation (`Incr` + `SAdd` + `Expire`) only runs on duplicates. The active-tracking set lets `CountActiveDedup` return a meaningful "N duplicate triggers silenced" badge to the manage page via `SCARD`.
+
+The retention loop runs in its own goroutine (`RunRetentionLoop`) on a ticker. On each tick it calls `repo.PruneToLimit(perTokenLimit)` which deletes oldest events past the limit for each token. That bounds Postgres storage for high-volume tokens.
+
+---
+
+## Notification Service (`backend/internal/notify/service.go`)
+
+The structure:
+
+```go
+type Service struct {
+    senders     map[string]Sender   // "telegram" → telegramSender, "webhook" → webhookSender
+    status      StatusWriter        // writes back to event.notify_status
+    sendTimeout time.Duration       // 30s default
+    workers     int                 // 8 default
+    queue       chan dispatchJob    // 256 buffered
+    workerWg    sync.WaitGroup      // tracks running workers
+    jobWg       sync.WaitGroup      // tracks in-flight + queued jobs
+}
+```
+
+`Notify` is non-blocking:
+
+```go
+func (s *Service) Notify(info event.NotifyInfo, evt *event.Event) {
+    s.jobWg.Add(1)
+    select {
+    case s.queue <- dispatchJob{info, evt}:
+        // queued
+    default:
+        s.jobWg.Done()
+        s.markStatus(ctx, evt.ID, NotifyFailed, nil)
+    }
+}
+```
+
+The non-blocking send is the load-shedding mechanism. If the queue is full (suggesting all 8 workers are stuck on slow senders), we drop the job and mark it failed rather than block the trigger handler.
+
+Each worker is a simple consumer:
+
+```go
+func (s *Service) worker() {
+    defer s.workerWg.Done()
+    for job := range s.queue {
+        s.dispatch(job.info, job.evt)
+        s.jobWg.Done()
+    }
+}
+
+func (s *Service) dispatch(info, evt) {
+    ctx, cancel := context.WithTimeout(bg, 30*time.Second)
+    defer cancel()
+    sender, ok := s.senders[info.AlertChannel]
+    if !ok { mark failed; return }
+    if err := sender.Send(ctx, info, evt); err != nil { mark failed; return }
+    mark sent, time.Now().UTC()
+}
+```
+
+The `closeOnce.Do(func() { close(s.queue) })` pattern in `Shutdown` ensures the queue is closed exactly once even if shutdown is called twice. After `close(queue)`, workers drain remaining jobs and exit when the channel reads return zero values.
+
+`Wait()` is provided for test code to flush all pending notifications before assertions, via `jobWg.Wait()`.
+
+### Webhook Sender (`backend/internal/notify/webhook/sender.go`)
+
+POSTs a JSON body with `token_id`, `event_id`, `triggered_at`, `source_ip`, `user_agent`, GeoIP fields, and `extra`. If `WEBHOOK_HMAC_SECRET` is set in env, the body is signed with HMAC-SHA256 and the signature goes into `X-Canary-Signature: sha256={hex}`. Retries are via `cenkalti/backoff/v5` — exponential backoff with jitter, max 3 attempts within the 30-second timeout window, only retrying on transient errors (5xx, network errors, but not 4xx).
+
+### Telegram Sender (`backend/internal/notify/telegram/sender.go`)
+
+POSTs to `https://api.telegram.org/bot{TelegramBot}/sendMessage` with `chat_id={TelegramChat}` and a Markdown-formatted message. Retries are limited because Telegram returns proper status codes — a 403 means the bot doesn't have access to the chat, no amount of retries will help.
+
+---
+
+## Middleware (`backend/internal/middleware/`)
+
+Each file is small and single-purpose:
+
+| File | What It Does |
+|------|--------------|
+| `request_id.go` | Generates a UUID per request, attaches to context, exposes via `RequestID(ctx)` |
+| `logging.go` | slog request_start / request_end with method, path, status, duration |
+| `recovery.go` | `defer recover()` panic catcher; logs stack + returns 500 |
+| `headers.go` | CSP, HSTS (prod only), X-Frame-Options, Referrer-Policy, X-Content-Type-Options; CORS middleware reads `cfg.CORS` |
+| `realip.go` | Parses `X-Forwarded-For` and `X-Real-IP` only if the immediate peer is in `TRUSTED_PROXY_CIDRS` |
+| `fingerprint.go` | `ExtractFingerprint(r) = sha256(RealIP(r) + r.UserAgent())[:16]` hex |
+| `ratelimit.go` | Token bucket via Redis (`go-redis/redis_rate`) keyed by a `KeyFunc`; fail-open if Redis is down |
+| `turnstile.go` | Reads response token from header `CF-Turnstile-Response` or JSON body field; calls `Verifier.Verify` |
+| `operator_bearer.go` | Constant-time compare against `OPERATOR_TOKEN`; returns 404 on miss (not 401, to avoid revealing the endpoint exists) |
+
+A few patterns worth absorbing:
+
+**`OptionalHeader`** in `realip.go` (or wherever) returns `*string` — `nil` if empty, pointer to the value otherwise. This is for nullable DB columns (`user_agent`, `referer`) where an empty string is semantically different from "header was absent".
+
+**Bearer middleware returns 404, not 401.** This is a small but deliberate choice. A 401 confirms the endpoint exists and just rejects your credentials. A 404 makes the endpoint look like it doesn't exist at all. An attacker scanning your service for admin endpoints can't distinguish "no admin endpoint here" from "I don't have the bearer". The cost is that legitimate operator typos look like 404s in logs — but operators don't make many typos on the admin endpoint URL.
+
+**Rate limit fail-open.** If Redis is unreachable, the rate limiter logs a warning and lets the request through. The alternative (fail-closed) would mean a Redis outage immediately produces a service outage. For a canary service the trade-off is the right way around: a Redis outage shouldn't suppress real attacker activity.
+
+---
+
+## Frontend (`frontend/src/`)
+
+The shape is two routes:
+
+```
+/                  pages/landing/index.tsx
+/m/:manageId       pages/manage/index.tsx
+```
+
+**State management:** TanStack Query for *everything* server-touching. Each hook in `api/hooks/` validates with Zod:
+
+```typescript
+// frontend/src/api/hooks/useManageToken.ts
+export function useManageToken(manageId: string, cursor?: number) {
+  return useQuery({
+    queryKey: ['manage', manageId, cursor],
+    queryFn: async () => {
+      const res = await api.get(`/m/${manageId}`, { params: { cursor } });
+      return ManageResponseSchema.parse(res.data);
+    },
+    refetchInterval: 5_000,            // poll every 5s for new events
+  });
+}
+```
+
+The Zod schema is the source of truth for the response shape. If the backend drifts, Zod throws on parse and the component error-boundary catches it — much better than silent type mismatches.
+
+**Form state on the landing page** is plain `useState` per field. There's no `react-hook-form` or formal validation library; the input controls are typed (`<input type="url">`) and the backend re-validates on submit anyway. Beginner-readable.
+
+**The artifact reveal** after `useCreateToken` mutates is conditional rendering on the artifact `kind`:
+
+- `kind: "url"` → render `<CopyField>` with the URL
+- `kind: "file"` → render a base64 → Blob download link
+- `kind: "text"` → render an `<textarea readonly>` with the content plus a download button
+- `kind: "connection_string"` → render `<CopyField>` with the connection string
+
+**The manage page** is a single TanStack Query reading the paginated event feed. Pagination is cursor-based — the response includes `page.next_cursor` and `page.has_more`, and the "load more" button calls the same query with a higher cursor. Each event row renders source IP, GeoIP (country flag + city), user agent, timestamp, and `notify_status` as a coloured badge.
+
+---
+
+## Tests
+
+The test stack is opinionated:
+
+- **`stretchr/testify`** for assertions.
+- **`miniredis/v2`** for in-memory Redis. Every test that touches Redis spins up a fresh miniredis on a random port — no shared state across tests.
+- **`testcontainers-go` + `modules/postgres`** for Postgres integration tests. Tests that need a real Postgres get a real Postgres in Docker, migrated fresh per test package.
+- **`testdata/` directories** alongside production code for fixture files (e.g. `backend/internal/token/generators/pdf/testdata/sample.pdf`).
+
+Each generator package has both a unit test (`generator_test.go`) that exercises the pure logic against fixtures and an integration test where applicable. The MySQL package has the most thorough protocol tests — `protocol_test.go` builds packets from spec values and reads them back, asserting on every byte.
+
+The `server` package has an `e2e_test.go` that spins up a real HTTP server with the full middleware chain and exercises the whole CRUD-and-trigger flow. That's the test you run to catch routing/middleware integration bugs.
+
+---
+
+## Where to Look First When Debugging
+
+A short cheat-sheet:
+
+| Symptom | First file |
+|---------|------------|
+| Token creation 400s with a strange message | `backend/internal/token/dto.go` (validator tags) |
+| Token created but trigger 404s | `backend/internal/token/handler.go::HandleTrigger`, `resolveGenerator` |
+| Trigger fires but no event in DB | `backend/internal/event/service.go::Record`, then `repository.go::Insert` |
+| Event in DB but `notify_status = pending` forever | Worker pool is stuck. Check logs for `notify: send failed`. |
+| Event in DB but `notify_status = failed` | Look at sender logs. Webhook URL bad? Telegram chat ID wrong? |
+| Trigger response is the wrong content type | Generator's `Trigger` function — every type sets `ContentType` differently. |
+| Manage page shows 0 events but they're in the DB | Cursor pagination bug. Check `parseCursor` in the handler and the `WHERE id < cursor` in `event/repository.go::ListByToken`. |
+| `RealIP` middleware returns the proxy IP | `TRUSTED_PROXY_CIDRS` env var isn't set or is wrong. |
+| PDF token won't open in Acrobat | Did the template change without re-running `cmd/buildpdftemplate`? Check `Generate`'s byte-length and contains-URL assertions. |
+| DOCX opens but doesn't fire | Check the footer XML actually contains the placeholder. Different Word templates use different footer paths. |
+| MySQL listener won't bind | Port collision. `MYSQL_FAKE_ADDR` is what the listener binds to. |
+
+The next document, [04 - Challenges](04-CHALLENGES.md), proposes extensions you can build on top of this codebase.
diff --git a/PROJECTS/beginner/canary-token-generator/learn/04-CHALLENGES.md b/PROJECTS/beginner/canary-token-generator/learn/04-CHALLENGES.md
new file mode 100644
index 00000000..c80ed321
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/learn/04-CHALLENGES.md
@@ -0,0 +1,251 @@
+<!-- © AngelaMos | 2026 | 04-CHALLENGES.md -->
+
+# Challenges
+
+This document proposes extensions to the canary token generator, organised by difficulty. Each challenge is sized to be a self-contained project on top of the existing codebase. The point is to deepen your understanding of the architecture by pushing it in directions the current design did or did not anticipate.
+
+You don't need to do these in order. Pick ones that interest you.
+
+---
+
+## Easy (1-3 evenings each)
+
+### 1. Add a Slack alert channel
+
+Right now the project supports `telegram` and `webhook`. Slack has a different message format (rich attachments with colour-coded sidebars) and a different auth model (incoming webhook URLs, not bot tokens). Adding it cleanly means:
+
+- New file `backend/internal/notify/slack/sender.go` implementing `notify.Sender` with `Channel() string { return "slack" }` and `Send(ctx, info, evt) error`.
+- Extend `token.AlertChannel` validation in `backend/internal/token/dto.go` (validator tag is `oneof=telegram webhook`).
+- Extend the React form on the landing page to render a Slack incoming-webhook URL field when the operator picks "Slack".
+- Add a config field for an optional `SLACK_WEBHOOK_DEFAULT` if you want default routing.
+- Register the sender in `backend/cmd/canary/main.go::buildEventStack`.
+
+The natural test is `sender_test.go` with a `httptest.NewServer` that captures the POST body and asserts the rich-attachment JSON shape matches what Slack expects.
+
+**Stretch:** add per-token Slack channel routing (the operator picks a channel suffix at token creation time, e.g. `#security-alerts` vs `#oncall`).
+
+### 2. Per-token webhook signing secret
+
+Currently the HMAC secret for webhook signing is a global env var (`WEBHOOK_HMAC_SECRET`). For multi-tenant deployments — or any deployment where different operators receive webhooks at different receivers — the secret should be per-token.
+
+- Add a `webhook_hmac_secret` column to `tokens` (migration in `backend/internal/core/migrations/`).
+- Plumb it through `event.NotifyInfo` and the webhook sender's `Send`.
+- Generate a random secret automatically at token creation if `alert_channel = webhook`, and surface it once in the create response (operator copies it into their receiver configuration).
+- Update the README to document the verification flow on the receiving side.
+
+The interesting bit is the rotation story: if a secret leaks, how does the operator rotate it without redeploying the artifacts (whose URLs are immutable)? The cleanest answer is a `POST /api/m/{manageId}/rotate-secret` endpoint that issues a new secret and returns it once.
+
+### 3. Filter events on the manage page
+
+The manage page paginates events but doesn't filter. Common filter dimensions:
+
+- By source IP (find all events from one IP)
+- By country (find events from a specific country)
+- By time range (last 24h, last 7d, custom)
+- By notify status (show only `failed` to triage delivery problems)
+
+The backend already has the data — `events` table is indexed on `triggered_at`. Add query params to `GET /api/m/{manageId}` and matching UI controls on the manage page. Use the same cursor-pagination pattern; just narrow the `WHERE` clause.
+
+**Why this matters:** in a real deployment, a single canary token can fire hundreds of events over its lifetime (especially if it's a `webbug` planted in a public-ish location). The current "show me the most recent 20" view becomes useless quickly.
+
+### 4. Event retention policy per-token
+
+`event.Service.RunRetentionLoop` prunes events to a per-token global limit (`EVENT_RETENTION_PER_TOKEN`). In practice, different tokens want different retention. A `webbug` planted on a public link might fire frequently and need a rolling 30-day window; a `kubeconfig` planted on a service account might fire rarely and want forever-retention.
+
+- Add a `retention_event_count` column (nullable) and a `retention_max_age` interval column to `tokens`.
+- Modify `repo.PruneToLimit` (and consider renaming it `PruneByPolicy`) to honour per-token settings, falling back to the global default.
+- Update the create form to optionally set retention.
+
+This is a good exercise in handling SQL `NULL` cleanly in Go with `*int` / `*time.Duration` fields and `IS NOT NULL OR ...` in queries.
+
+---
+
+## Medium (a weekend each)
+
+### 5. New token type: DNS resolution canary
+
+A DNS canary fires when a unique subdomain is resolved. The artifact is the hostname; the trigger mechanism is *any* DNS query for that hostname hitting an authoritative server you control.
+
+This requires:
+
+- An authoritative DNS server, either delegated NS-records to your canary infrastructure for `*.canary.example.com`, or a separate listening port that you delegate from a public DNS host. Easiest path: a `miekg/dns` Go server on UDP/53 alongside the HTTP listener.
+- A new generator `backend/internal/token/generators/dnscanary/` that:
+  - `Generate` returns a `KindURL` artifact containing the hostname.
+  - `Trigger` is unused on the HTTP side; the DNS server records the event directly via `event.Service.Record` when a query lands.
+- A new handler that the DNS server calls per-query, extracting the token ID from the leftmost subdomain label.
+
+**The clever part:** DNS queries are very chatty and most of them come from recursive resolvers, not the original querier. The event record should capture both the resolver's IP (from the query packet) and any EDNS Client Subnet (ECS) data, which leaks a /24 of the original querier in many cases. Most real-world canary tokens for DNS use this.
+
+**Why it matters:** DNS canaries catch attackers using `nslookup` or `dig` against hostnames they find in a `.env` or config file. They also catch a class of pre-authentication enumeration tooling that resolves before connecting. Thinkst Canary's DNS token is one of their highest-value primitives.
+
+### 6. New token type: AWS credential canary
+
+A real AWS credential canary is a real `AKIA*` access key + matching secret. The "trigger" is a CloudTrail event for the IAM principal using that key. Real Thinkst tokens use AWS API Gateway + Lambda to detect the access attempts.
+
+For this project, the simplified version is:
+
+- Issue real (but heavily-permission-restricted) AWS access keys via the AWS SDK, scoped to a single IAM user that has no permissions except `sts:GetCallerIdentity` on its own ARN.
+- Poll CloudTrail (or use EventBridge if the operator's account supports it) for `GetCallerIdentity` events using that key.
+- Convert detected events into trigger events on your canary backend.
+
+This is operationally heavier than the other tokens because it requires AWS API access from your canary infrastructure. The challenge is partly the AWS integration and partly the design decision about how the operator supplies their AWS credentials — direct keys, an assumed role, or a separate "AWS adapter" service.
+
+**The cleaner alternative** for an educational project: generate a *fake* AKIA-style key, document the limitation that it only catches attackers who try to use it (not attackers who just exfiltrate it), and rely on a separate sub-token URL embedded in the key's "description" field that fires on retrieval.
+
+### 7. JA3/JA4 fingerprinting on HTTPS trigger requests
+
+Browser fingerprinting (the slowredirect type) requires JS to run. JA3/JA4 fingerprinting works at the TLS handshake level and catches every HTTPS client — including curl, wget, Python `requests`, and headless tools that won't run JS.
+
+- Replace nginx in front with an HTTPS listener that exposes the TLS ClientHello bytes to the application layer. Options: terminate TLS in Go directly with `crypto/tls` (`GetClientHelloInfo` callback) or front with a JA-aware proxy like `Suricata` / `ja4-fingerprinter` / `caddy-tlsmonitor`.
+- Extend the event payload's `extra` JSONB with `ja3_hash`, `ja4_hash`, and `tls_version`.
+- Surface them in the manage page.
+
+The forensic value is large: JA3/JA4 hashes are much harder to spoof than `User-Agent`, and they correlate the same attacker across multiple campaigns. The downside is that running your own TLS termination loses Cloudflare Tunnel as an option (Cloudflare terminates TLS at their edge before forwarding) — you'd need to deploy directly.
+
+### 8. Bulk token operations
+
+Power users want to mint 50 tokens at once with the same alert channel but different memos (one per workstation, say). Right now they have to click 50 times.
+
+- Add `POST /api/tokens/bulk` accepting an array of `CreateRequest` objects.
+- Rate-limit it independently from single-token creation (lower per-minute, but allow larger bursts of bulk requests).
+- Frontend: a "Bulk" tab on the landing page with a CSV upload + per-row form.
+- Return a zip of all artifacts in one response so the operator gets one download.
+
+The interesting backend design problem is partial failure: if 49 tokens succeed and 1 fails, what's the response? Either you persist nothing on any failure (atomic) or you persist what succeeded and return a per-row status (best-effort). The codebase's domain layout suggests best-effort with per-row status is cleaner.
+
+---
+
+## Hard (a week or more each)
+
+### 9. Detection-resistant artifact generation
+
+Every artifact in this project has fingerprintable properties. The PDF placeholder padding produces a URL with a recognisable `?p=__________` query. The webbug pixel is byte-identical across all tokens of that type. The envfile canary uses a fixed `INTERNAL_METRICS_ENDPOINT` key.
+
+A determined attacker who studies one of your tokens can identify others. Hardening:
+
+- **PDF:** randomise the padding chars per-token (use printable URL-safe chars), or rotate among multiple template PDFs with placeholders in different fields (footer text, embedded form action, JS, etc.).
+- **Webbug:** vary the pixel slightly per token. JPEG quantisation noise is enough to produce different SHA256 hashes for a "1x1 JPEG that looks the same".
+- **Envfile:** randomise the canary key name from a list of plausible alternatives (`INTERNAL_METRICS_ENDPOINT`, `OBSERVABILITY_PUSH_URL`, `TELEMETRY_GATEWAY`, etc.). Randomise the position of the canary line within the file.
+- **DOCX:** rotate among several footer styles or embed the URL in different document parts (settings.xml, footnotes, comments, etc.).
+
+The exercise: pick one artifact type and design a configuration system that lets the operator dial how unique the per-token artifact should be (uniform vs randomised). Track the randomisation seed per token so you can reproduce the artifact later if needed.
+
+**Why it matters:** Thinkst's commercial product is hardened against attacker fingerprinting in exactly this way. Open-source canaries are easier to fingerprint by definition (the source code is public), so this kind of work is the bridge between "educational project" and "operational deployment".
+
+### 10. Operator-side retry pipeline for failed notifications
+
+Right now if `notify_status = failed` (queue full, webhook receiver down, transient Telegram error), the event stays at that status forever. Operators have no built-in way to retry.
+
+Build a retry pipeline:
+
+- A new background goroutine (similar to the retention loop) that scans for `notify_status = failed` events with `notified_at IS NULL` and re-queues them on the notify service.
+- Exponential backoff per event — first retry at 1 minute, then 5, then 30 — with a configurable max retry count.
+- A new `retry_count` column on `events` to track attempts.
+- Optional: a manual "retry" button on the manage page that bumps `retry_count = 0` and re-queues immediately.
+
+The hardest design decision is when to give up. After N retries, do you alert the operator via a secondary channel (system-level email, dead-letter file write)? Do you just stop and require manual intervention? The right answer depends on the deployment model.
+
+### 11. Multi-tenant deployment
+
+The current architecture is single-operator. Multi-tenancy means:
+
+- An auth model for token creation (not Turnstile — actual user accounts). Plug in WebAuthn for passwordless or use Cloudflare Access for SSO.
+- A `users` table and a `user_id` foreign key on `tokens`.
+- Manage routes (`/api/m/{manageId}`) become authorisation-aware: the requester must own the token (or use the public manage URL, which becomes a sharing primitive).
+- Admin routes split into "global admin" (the deployment operator) and "per-user admin" (each tenant's view of their own tokens).
+- Per-tenant rate limits — a tenant shouldn't be able to DOS others by exhausting the shared budget.
+- Maybe per-tenant alert channel config (one tenant uses Telegram, another uses webhook, with separate validation).
+
+This is a significant project — multi-tenancy is famously the rewrite that small services try to retrofit and end up rewriting twice. Doing it cleanly means starting from a clear data model and threading the tenant context through every layer.
+
+### 12. Distributed deployment with leader election
+
+The MySQL listener and the retention loop are designed assuming one process. If you want to run multiple `canary` instances behind a load balancer for HA, you need:
+
+- **Leader election** for the retention loop (only one instance should be pruning). Easiest: a Redis key with `SETNX` + TTL renewal as the leader heartbeat. Slightly more robust: use `etcd` or `Consul`.
+- **A shared MySQL listener address.** Each instance can bind to the same `0.0.0.0:3306` if you front them with an NLB; or they all bind to ephemeral ports and a service mesh routes by token-ID hash.
+- **Shared dedup gate** — already works because the gate is in Redis.
+- **Shared notification queue** — currently in-memory per process. Moving it to a Redis stream or a real broker (NATS, Kafka) is the right answer for actual scale.
+
+This is the project where you'd genuinely benefit from running the existing one in production for a while first, hitting the limits, and then designing the shared infrastructure based on what actually breaks rather than what you imagine might.
+
+---
+
+## Defensive Drills (one-off exercises, hours each)
+
+Not really "challenges" in the build-something sense; these are exercises to deepen your understanding by using the canary against yourself.
+
+### A. Pwn-your-own-PDF
+
+Generate a PDF token, save it, then open it in:
+
+1. Chrome (built-in PDF viewer)
+2. Firefox (PDF.js)
+3. Acrobat Reader
+4. macOS Preview
+5. `pdftotext` (Poppler)
+
+Which ones fire? Predict before checking the manage page. The answer is informative about how brittle PDF-based tokens are in practice.
+
+### B. Pwn-your-own-DOCX
+
+Same drill with a DOCX:
+
+1. Microsoft Word (on Windows, on Mac)
+2. LibreOffice
+3. Pages
+4. Google Docs (upload + view)
+5. Office Online (upload + view)
+6. `docx2txt` or `pandoc`
+
+Which fire? What does the resulting fingerprint look like for each?
+
+### C. Trace your own MySQL trigger
+
+Connect to your local instance with the `mysql` CLI from a `canary_*` username. Watch the connection in Wireshark or `tcpdump -A -i lo0 -s 0 -X 'tcp port 3306'`. Identify each packet:
+
+1. Server `HandshakeV10` (the server sends this first)
+2. Client `HandshakeResponse`
+3. Server `ERR_PACKET`
+
+The point is to see how protocol-level the implementation really is. Read the bytes against the [MySQL Internals — Client/Server Protocol](https://dev.mysql.com/doc/internals/en/client-server-protocol.html) documentation.
+
+### D. Try to enumerate
+
+Set up the service. Mint one valid `webbug` token. Then write a script that hits `/c/{random}` URLs with random 12-char IDs and try to detect which ones are real based on:
+
+- Response timing
+- Response headers
+- Response body bytes
+
+If the script can reliably tell real from fake, the enumeration-resistance design has a hole. Find it. Fix it.
+
+### E. Try to DOS the alert channel
+
+Mint a token with a webhook alert channel pointing at a URL you control. Then write a script that hits the trigger URL from many source IPs (use a SOCKS pool, or just hit it from multiple cloud VMs).
+
+How many concurrent IPs does it take before:
+
+1. The notify queue fills up and starts dropping?
+2. The webhook receiver gives up?
+3. The operator notices?
+
+Use the answer to inform the worker pool sizing for your real deployment.
+
+---
+
+## Reading List
+
+If you want to deepen the conceptual side rather than the implementation side, these are the resources that informed the design of this project:
+
+- **Thinkst Canary Tokens** documentation and Haroon Meer's talks (DEFCON, BSidesLV) — the modern canary canon.
+- **MITRE Engage** matrix and example deployments — defensive deception taxonomy.
+- **Tom Limoncelli's "How Complex Systems Fail"** — relevant when designing the dedup gate and failure modes.
+- **The MySQL Internals docs** (Oracle) — needed if you want to extend the MySQL token to support more protocol features.
+- **PDF 1.7 reference (ISO 32000-1)** — needed if you want to extend the PDF token beyond the URI page-open action.
+- **Office Open XML format (ECMA-376)** — needed if you want to extend the DOCX token beyond the footer URI.
+- **2024 Mandiant M-Trends report** and **2024 Verizon DBIR** — dwell-time numbers that make the case for deception.
+
+---
+
+Done. If you build any of these, the project is open to PRs — and if you build #5 (DNS canary) or #9 (detection-resistant artifacts), the maintainers want to talk to you.
diff --git a/PROJECTS/beginner/canary-token-generator/scripts/init.sh b/PROJECTS/beginner/canary-token-generator/scripts/init.sh
new file mode 100755
index 00000000..6c4c152e
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/scripts/init.sh
@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# =============================================================================
+# ©AngelaMos | 2026
+# init.sh
+# =============================================================================
+# Idempotent setup helper.
+#   1. Copies .env.example -> .env if .env is missing
+#   2. Generates POSTGRES_PASSWORD and OPERATOR_TOKEN if their values are blank
+#   3. Downloads GeoLite2-City.mmdb when MAXMIND_ACCOUNT_ID + MAXMIND_LICENSE_KEY are set
+#
+# Safe to run repeatedly: skips already-set values and existing mmdb.
+# =============================================================================
+
+set -euo pipefail
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="$DIR/.env"
+EXAMPLE_FILE="$DIR/.env.example"
+DATA_DIR="$DIR/data"
+MMDB_PATH="$DATA_DIR/GeoLite2-City.mmdb"
+
+# ── ensure .env exists ────────────────────────────────────────────────────────
+if [[ ! -f "$ENV_FILE" ]]; then
+    if [[ ! -f "$EXAMPLE_FILE" ]]; then
+        echo "Error: $EXAMPLE_FILE missing — cannot bootstrap .env" >&2
+        exit 1
+    fi
+    cp "$EXAMPLE_FILE" "$ENV_FILE"
+    echo "  created .env from .env.example"
+fi
+
+# ── secret generator ──────────────────────────────────────────────────────────
+gen_secret() {
+    local key="$1"
+    local current
+    current="$(grep -E "^${key}=" "$ENV_FILE" | head -1 | cut -d= -f2- || true)"
+
+    if [[ -z "$current" ]]; then
+        local newval
+        newval="$(openssl rand -hex 32)"
+        if grep -qE "^${key}=" "$ENV_FILE"; then
+            sed -i "s|^${key}=.*|${key}=${newval}|" "$ENV_FILE"
+        else
+            printf '\n%s=%s\n' "$key" "$newval" >> "$ENV_FILE"
+        fi
+        echo "  generated $key"
+    else
+        echo "  $key already set, skipping"
+    fi
+}
+
+gen_secret POSTGRES_PASSWORD
+gen_secret OPERATOR_TOKEN
+
+# ── geoip database ────────────────────────────────────────────────────────────
+ACCT="$(grep -E "^MAXMIND_ACCOUNT_ID=" "$ENV_FILE" | head -1 | cut -d= -f2- || true)"
+KEY="$(grep -E "^MAXMIND_LICENSE_KEY=" "$ENV_FILE" | head -1 | cut -d= -f2- || true)"
+
+if [[ -n "$ACCT" && -n "$KEY" ]]; then
+    if [[ ! -f "$MMDB_PATH" ]]; then
+        mkdir -p "$DATA_DIR"
+        echo "  downloading GeoLite2-City.mmdb from MaxMind..."
+        tmp_dir="$(mktemp -d)"
+        trap 'rm -rf "$tmp_dir"' EXIT
+        if curl -sSf -u "$ACCT:$KEY" \
+            "https://download.maxmind.com/geoip/databases/GeoLite2-City/download?suffix=tar.gz" \
+            -o "$tmp_dir/geolite.tar.gz"; then
+            tar -xzf "$tmp_dir/geolite.tar.gz" -C "$tmp_dir" --strip-components=1 \
+                "*/GeoLite2-City.mmdb"
+            mv "$tmp_dir/GeoLite2-City.mmdb" "$MMDB_PATH"
+            echo "  GeoLite2-City.mmdb downloaded to $MMDB_PATH"
+        else
+            echo "  Warning: GeoLite2 download failed (check MAXMIND_ACCOUNT_ID and MAXMIND_LICENSE_KEY)" >&2
+        fi
+    else
+        echo "  GeoLite2-City.mmdb already present, skipping"
+    fi
+else
+    echo "  MaxMind credentials not set in .env — geolocation will be disabled"
+fi
+
+# ── done ──────────────────────────────────────────────────────────────────────
+echo ""
+echo "Setup complete. Edit .env to set PUBLIC_BASE_URL + Turnstile keys, then 'just up'."
diff --git a/PROJECTS/beginner/canary-token-generator/scripts/randomize-ports.sh b/PROJECTS/beginner/canary-token-generator/scripts/randomize-ports.sh
new file mode 100755
index 00000000..d0337938
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/scripts/randomize-ports.sh
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# =============================================================================
+# ©AngelaMos | 2026
+# randomize-ports.sh
+# =============================================================================
+# Picks 4 unique random ports (10000-65000) and updates:
+#   .env              -> prod nginx + frontend ports
+#   .env.development  -> dev nginx + frontend ports
+#   compose.yml       -> prod default fallbacks
+#   dev.compose.yml   -> dev default fallbacks
+
+set -euo pipefail
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+mapfile -t ports < <(python3 -c "
+import random
+sample = random.sample(range(10000, 65001), 4)
+for p in sample: print(p)
+")
+
+PROD_NGINX=${ports[0]}
+PROD_FRONTEND=${ports[1]}
+DEV_NGINX=${ports[2]}
+DEV_FRONTEND=${ports[3]}
+
+echo "New ports:"
+echo "  prod  nginx:    $PROD_NGINX"
+echo "  prod  frontend: $PROD_FRONTEND"
+echo "  dev   nginx:    $DEV_NGINX"
+echo "  dev   frontend: $DEV_FRONTEND"
+echo ""
+
+update_env() {
+  local file="$1" nginx_port="$2" frontend_port="$3"
+  sed -i "s/^NGINX_HOST_PORT=.*/NGINX_HOST_PORT=$nginx_port/" "$file"
+  sed -i "s/^FRONTEND_HOST_PORT=.*/FRONTEND_HOST_PORT=$frontend_port/" "$file"
+  echo "  updated $file"
+}
+
+update_compose_defaults() {
+  local file="$1" nginx_port="$2" frontend_port="${3:-}"
+  sed -i "s/\${NGINX_HOST_PORT:-[0-9]\+}/\${NGINX_HOST_PORT:-$nginx_port}/g" "$file"
+  if [[ -n "$frontend_port" ]]; then
+    sed -i "s/\${FRONTEND_HOST_PORT:-[0-9]\+}/\${FRONTEND_HOST_PORT:-$frontend_port}/g" "$file"
+  fi
+  echo "  updated $file"
+}
+
+update_env        "$DIR/.env"              "$PROD_NGINX" "$PROD_FRONTEND"
+update_env        "$DIR/.env.development"  "$DEV_NGINX"  "$DEV_FRONTEND"
+update_compose_defaults "$DIR/compose.yml"     "$PROD_NGINX"
+update_compose_defaults "$DIR/dev.compose.yml" "$DEV_NGINX" "$DEV_FRONTEND"
+
+echo ""
+echo "Done."
diff --git a/PROJECTS/beginner/hash-cracker/main.cpp b/PROJECTS/beginner/hash-cracker/main.cpp
index 08e11112..eacc0703 100644
--- a/PROJECTS/beginner/hash-cracker/main.cpp
+++ b/PROJECTS/beginner/hash-cracker/main.cpp
@@ -29,11 +29,6 @@ Connects to:
   attack/RuleAttack.hpp       - RuleAttack for mutation mode
 */
 
-#include <boost/program_options.hpp>
-#include <expected>
-#include <iostream>
-#include <print>
-#include <string>
 #include "src/attack/BruteForceAttack.hpp"
 #include "src/attack/DictionaryAttack.hpp"
 #include "src/attack/RuleAttack.hpp"
@@ -45,20 +40,31 @@ Connects to:
 #include "src/hash/SHA1Hasher.hpp"
 #include "src/hash/SHA256Hasher.hpp"
 #include "src/hash/SHA512Hasher.hpp"
+#include <boost/program_options.hpp>
+#include <expected>
+#include <iostream>
+#include <print>
+#include <string>
 
 namespace po = boost::program_options;
 
-static std::string build_charset(const std::string& spec) {
+static std::string build_charset(const std::string &spec) {
     std::string result;
 
-    auto has = [&](std::string_view token) {
-        return spec.find(token) != std::string::npos;
-    };
+    auto has = [&](std::string_view token) { return spec.find(token) != std::string::npos; };
 
-    if (has("lower")) { result += config::CHARSET_LOWER; }
-    if (has("upper")) { result += config::CHARSET_UPPER; }
-    if (has("digits")) { result += config::CHARSET_DIGITS; }
-    if (has("special")) { result += config::CHARSET_SPECIAL; }
+    if (has("lower")) {
+        result += config::CHARSET_LOWER;
+    }
+    if (has("upper")) {
+        result += config::CHARSET_UPPER;
+    }
+    if (has("digits")) {
+        result += config::CHARSET_DIGITS;
+    }
+    if (has("special")) {
+        result += config::CHARSET_SPECIAL;
+    }
 
     if (result.empty()) {
         result += config::CHARSET_LOWER;
@@ -69,8 +75,7 @@ static std::string build_charset(const std::string& spec) {
 }
 
 template <Hasher H>
-static auto dispatch_attack(const CrackConfig& cfg)
-    -> std::expected<CrackResult, CrackError> {
+static auto dispatch_attack(const CrackConfig &cfg) -> std::expected<CrackResult, CrackError> {
     if (cfg.bruteforce) {
         return Engine::crack<H, BruteForceAttack>(cfg);
     }
@@ -80,13 +85,17 @@ static auto dispatch_attack(const CrackConfig& cfg)
     return Engine::crack<H, DictionaryAttack>(cfg);
 }
 
-static auto dispatch_hasher(HashType type, const CrackConfig& cfg)
+static auto dispatch_hasher(HashType type, const CrackConfig &cfg)
     -> std::expected<CrackResult, CrackError> {
     switch (type) {
-        case HashType::MD5: return dispatch_attack<MD5Hasher>(cfg);
-        case HashType::SHA1: return dispatch_attack<SHA1Hasher>(cfg);
-        case HashType::SHA256: return dispatch_attack<SHA256Hasher>(cfg);
-        case HashType::SHA512: return dispatch_attack<SHA512Hasher>(cfg);
+        case HashType::MD5:
+            return dispatch_attack<MD5Hasher>(cfg);
+        case HashType::SHA1:
+            return dispatch_attack<SHA1Hasher>(cfg);
+        case HashType::SHA256:
+            return dispatch_attack<SHA256Hasher>(cfg);
+        case HashType::SHA512:
+            return dispatch_attack<SHA512Hasher>(cfg);
     }
     return std::unexpected(CrackError::UnsupportedAlgorithm);
 }
@@ -96,68 +105,77 @@ static std::string json_escape(std::string_view s) {
     result.reserve(s.size());
     for (char c : s) {
         switch (c) {
-            case '"':  result += "\\\""; break;
-            case '\\': result += "\\\\"; break;
-            case '\n': result += "\\n";  break;
-            case '\r': result += "\\r";  break;
-            case '\t': result += "\\t";  break;
-            default:   result += c;      break;
+            case '"':
+                result += "\\\"";
+                break;
+            case '\\':
+                result += "\\\\";
+                break;
+            case '\n':
+                result += "\\n";
+                break;
+            case '\r':
+                result += "\\r";
+                break;
+            case '\t':
+                result += "\\t";
+                break;
+            default:
+                result += c;
+                break;
         }
     }
     return result;
 }
 
-static void write_json_result(const std::string& path,
-                               const CrackResult& result) {
-    auto* f = std::fopen(path.c_str(), "w");
-    if (!f) { return; }
+static void write_json_result(const std::string &path, const CrackResult &result) {
+    auto *f = std::fopen(path.c_str(), "w");
+    if (!f) {
+        return;
+    }
 
     std::fprintf(f,
-        "{\n"
-        "  \"plaintext\": \"%s\",\n"
-        "  \"hash\": \"%s\",\n"
-        "  \"algorithm\": \"%s\",\n"
-        "  \"elapsed_seconds\": %.4f,\n"
-        "  \"candidates_tested\": %zu,\n"
-        "  \"hashes_per_second\": %.2f\n"
-        "}\n",
-        json_escape(result.plaintext).c_str(),
-        json_escape(result.hash).c_str(),
-        json_escape(result.algorithm).c_str(),
-        result.elapsed_seconds,
-        result.candidates_tested,
-        result.hashes_per_second);
+                 "{\n"
+                 "  \"plaintext\": \"%s\",\n"
+                 "  \"hash\": \"%s\",\n"
+                 "  \"algorithm\": \"%s\",\n"
+                 "  \"elapsed_seconds\": %.4f,\n"
+                 "  \"candidates_tested\": %zu,\n"
+                 "  \"hashes_per_second\": %.2f\n"
+                 "}\n",
+                 json_escape(result.plaintext).c_str(), json_escape(result.hash).c_str(),
+                 json_escape(result.algorithm).c_str(), result.elapsed_seconds,
+                 result.candidates_tested, result.hashes_per_second);
 
     std::fclose(f);
 }
 
-int main(int argc, char* argv[]) {
+int main(int argc, char *argv[]) {
     po::options_description desc("hashcracker - Multi-threaded hash cracking tool");
-    desc.add_options()
-        ("help,h", "Show help message")
-        ("hash", po::value<std::string>(), "Target hash to crack")
-        ("type", po::value<std::string>()->default_value("auto"),
-            "Hash type: md5, sha1, sha256, sha512, auto")
-        ("wordlist,w", po::value<std::string>(), "Path to wordlist file")
-        ("bruteforce,b", "Use brute-force attack mode")
-        ("charset", po::value<std::string>()->default_value("lower,digits"),
-            "Character sets: lower,upper,digits,special")
-        ("max-length", po::value<std::size_t>()->default_value(
-            config::DEFAULT_MAX_BRUTE_LENGTH), "Max password length for brute-force")
-        ("rules,r", "Apply mutation rules to dictionary words")
-        ("chain-rules", "Chain mutation rules in combination")
-        ("salt", po::value<std::string>(), "Salt value to prepend/append")
-        ("salt-position", po::value<std::string>()->default_value("prepend"),
-            "Salt position: prepend or append")
-        ("threads,t", po::value<unsigned>()->default_value(
-            config::DEFAULT_THREAD_COUNT), "Thread count (0 = auto)")
-        ("output,o", po::value<std::string>(), "Write JSON result to file");
+    desc.add_options()("help,h", "Show help message")("hash", po::value<std::string>(),
+                                                      "Target hash to crack")(
+        "type", po::value<std::string>()->default_value("auto"),
+        "Hash type: md5, sha1, sha256, sha512, auto")("wordlist,w", po::value<std::string>(),
+                                                      "Path to wordlist file")(
+        "bruteforce,b", "Use brute-force attack mode")(
+        "charset", po::value<std::string>()->default_value("lower,digits"),
+        "Character sets: lower,upper,digits,special")(
+        "max-length", po::value<std::size_t>()->default_value(config::DEFAULT_MAX_BRUTE_LENGTH),
+        "Max password length for brute-force")("rules,r",
+                                               "Apply mutation rules to dictionary words")(
+        "chain-rules", "Chain mutation rules in combination")("salt", po::value<std::string>(),
+                                                              "Salt value to prepend/append")(
+        "salt-position", po::value<std::string>()->default_value("prepend"),
+        "Salt position: prepend or append")(
+        "threads,t", po::value<unsigned>()->default_value(config::DEFAULT_THREAD_COUNT),
+        "Thread count (0 = auto)")("output,o", po::value<std::string>(),
+                                   "Write JSON result to file");
 
     po::variables_map vm;
     try {
         po::store(po::parse_command_line(argc, argv, desc), vm);
         po::notify(vm);
-    } catch (const po::error& e) {
+    } catch (const po::error &e) {
         std::println(stderr, "Error: {}", e.what());
         return 1;
     }
@@ -198,8 +216,7 @@ int main(int argc, char* argv[]) {
     if (cfg.hash_type == "auto") {
         auto detected = HashDetector::detect(cfg.target_hash);
         if (!detected.has_value()) {
-            std::println(stderr, "Error: {}",
-                crack_error_message(detected.error()));
+            std::println(stderr, "Error: {}", crack_error_message(detected.error()));
             return 1;
         }
         hash_type = *detected;
diff --git a/PROJECTS/beginner/hash-cracker/src/attack/BruteForceAttack.cpp b/PROJECTS/beginner/hash-cracker/src/attack/BruteForceAttack.cpp
index a04332e4..71a0709e 100644
--- a/PROJECTS/beginner/hash-cracker/src/attack/BruteForceAttack.cpp
+++ b/PROJECTS/beginner/hash-cracker/src/attack/BruteForceAttack.cpp
@@ -26,8 +26,7 @@ Connects to:
 #include "src/attack/BruteForceAttack.hpp"
 #include <algorithm>
 
-std::size_t BruteForceAttack::compute_keyspace(std::size_t charset_size,
-                                               std::size_t max_length) {
+std::size_t BruteForceAttack::compute_keyspace(std::size_t charset_size, std::size_t max_length) {
     std::size_t total = 0;
     std::size_t power = 1;
     for (std::size_t len = 1; len <= max_length; ++len) {
@@ -37,17 +36,15 @@ std::size_t BruteForceAttack::compute_keyspace(std::size_t charset_size,
     return total;
 }
 
-BruteForceAttack::BruteForceAttack(std::string_view charset,
-                                   std::size_t max_length,
-                                   unsigned thread_index,
-                                   unsigned total_threads)
+BruteForceAttack::BruteForceAttack(std::string_view charset, std::size_t max_length,
+                                   unsigned thread_index, unsigned total_threads)
     : charset_(charset), max_length_(max_length),
       total_keyspace_(compute_keyspace(charset.size(), max_length)) {
     std::size_t per_thread = total_keyspace_ / total_threads;
     std::size_t remainder = total_keyspace_ % total_threads;
 
-    start_index_ = thread_index * per_thread
-        + std::min(static_cast<std::size_t>(thread_index), remainder);
+    start_index_ =
+        thread_index * per_thread + std::min(static_cast<std::size_t>(thread_index), remainder);
     std::size_t my_count = per_thread + (thread_index < remainder ? 1 : 0);
     end_index_ = start_index_ + my_count;
     current_index_ = start_index_;
@@ -83,5 +80,9 @@ std::expected<std::string, AttackComplete> BruteForceAttack::next() {
     return index_to_candidate(current_index_++);
 }
 
-std::size_t BruteForceAttack::total() const { return total_keyspace_; }
-std::size_t BruteForceAttack::progress() const { return current_index_ - start_index_; }
+std::size_t BruteForceAttack::total() const {
+    return total_keyspace_;
+}
+std::size_t BruteForceAttack::progress() const {
+    return current_index_ - start_index_;
+}
diff --git a/PROJECTS/beginner/hash-cracker/src/attack/BruteForceAttack.hpp b/PROJECTS/beginner/hash-cracker/src/attack/BruteForceAttack.hpp
index 27144374..9d58345b 100644
--- a/PROJECTS/beginner/hash-cracker/src/attack/BruteForceAttack.hpp
+++ b/PROJECTS/beginner/hash-cracker/src/attack/BruteForceAttack.hpp
@@ -12,22 +12,22 @@ Connects to:
 
 #pragma once
 
+#include "src/core/Concepts.hpp"
 #include <cstddef>
 #include <expected>
 #include <string>
 #include <string_view>
-#include "src/core/Concepts.hpp"
 
 class BruteForceAttack {
-public:
-    BruteForceAttack(std::string_view charset, std::size_t max_length,
-                     unsigned thread_index, unsigned total_threads);
+  public:
+    BruteForceAttack(std::string_view charset, std::size_t max_length, unsigned thread_index,
+                     unsigned total_threads);
 
     std::expected<std::string, AttackComplete> next();
     std::size_t total() const;
     std::size_t progress() const;
 
-private:
+  private:
     std::string charset_;
     std::size_t max_length_;
     std::size_t total_keyspace_;
@@ -36,6 +36,5 @@ private:
     std::size_t current_index_;
 
     std::string index_to_candidate(std::size_t index) const;
-    static std::size_t compute_keyspace(std::size_t charset_size,
-                                        std::size_t max_length);
+    static std::size_t compute_keyspace(std::size_t charset_size, std::size_t max_length);
 };
diff --git a/PROJECTS/beginner/hash-cracker/src/attack/DictionaryAttack.cpp b/PROJECTS/beginner/hash-cracker/src/attack/DictionaryAttack.cpp
index a3930c7d..03d3387c 100644
--- a/PROJECTS/beginner/hash-cracker/src/attack/DictionaryAttack.cpp
+++ b/PROJECTS/beginner/hash-cracker/src/attack/DictionaryAttack.cpp
@@ -27,9 +27,7 @@ Connects to:
 #include "src/attack/DictionaryAttack.hpp"
 #include <algorithm>
 
-static std::size_t count_lines_in_range(const char* data,
-                                        std::size_t start,
-                                        std::size_t end) {
+static std::size_t count_lines_in_range(const char *data, std::size_t start, std::size_t end) {
     std::size_t count = 0;
     for (std::size_t i = start; i < end; ++i) {
         if (data[i] == '\n') {
@@ -39,23 +37,21 @@ static std::size_t count_lines_in_range(const char* data,
     return count;
 }
 
-static std::size_t find_next_newline(const char* data,
-                                     std::size_t pos,
-                                     std::size_t size) {
+static std::size_t find_next_newline(const char *data, std::size_t pos, std::size_t size) {
     while (pos < size && data[pos] != '\n') {
         ++pos;
     }
     return pos < size ? pos + 1 : size;
 }
 
-std::expected<DictionaryAttack, CrackError> DictionaryAttack::create(
-    std::string_view path, unsigned thread_index, unsigned total_threads) {
+std::expected<DictionaryAttack, CrackError>
+DictionaryAttack::create(std::string_view path, unsigned thread_index, unsigned total_threads) {
     auto file = MappedFile::open(path);
     if (!file.has_value()) {
         return std::unexpected(file.error());
     }
 
-    auto* data = file->data();
+    auto *data = file->data();
     auto file_size = file->size();
 
     std::size_t total_lines = count_lines_in_range(data, 0, file_size);
@@ -66,10 +62,9 @@ std::expected<DictionaryAttack, CrackError> DictionaryAttack::create(
     std::size_t lines_per_thread = total_lines / total_threads;
     std::size_t remainder = total_lines % total_threads;
 
-    std::size_t my_start_line = thread_index * lines_per_thread
-        + std::min(static_cast<std::size_t>(thread_index), remainder);
-    std::size_t my_line_count = lines_per_thread
-        + (thread_index < remainder ? 1 : 0);
+    std::size_t my_start_line = thread_index * lines_per_thread +
+                                std::min(static_cast<std::size_t>(thread_index), remainder);
+    std::size_t my_line_count = lines_per_thread + (thread_index < remainder ? 1 : 0);
 
     std::size_t start_offset = 0;
     for (std::size_t i = 0; i < my_start_line; ++i) {
@@ -116,5 +111,9 @@ std::expected<std::string, AttackComplete> DictionaryAttack::next() {
     return std::unexpected(AttackComplete{});
 }
 
-std::size_t DictionaryAttack::total() const { return total_words_; }
-std::size_t DictionaryAttack::progress() const { return words_read_; }
+std::size_t DictionaryAttack::total() const {
+    return total_words_;
+}
+std::size_t DictionaryAttack::progress() const {
+    return words_read_;
+}
diff --git a/PROJECTS/beginner/hash-cracker/src/attack/DictionaryAttack.hpp b/PROJECTS/beginner/hash-cracker/src/attack/DictionaryAttack.hpp
index 11d6770a..e3abfc47 100644
--- a/PROJECTS/beginner/hash-cracker/src/attack/DictionaryAttack.hpp
+++ b/PROJECTS/beginner/hash-cracker/src/attack/DictionaryAttack.hpp
@@ -14,23 +14,23 @@ Connects to:
 
 #pragma once
 
+#include "src/core/Concepts.hpp"
+#include "src/io/MappedFile.hpp"
 #include <cstddef>
 #include <expected>
 #include <string>
 #include <string_view>
-#include "src/core/Concepts.hpp"
-#include "src/io/MappedFile.hpp"
 
 class DictionaryAttack {
-public:
-    static std::expected<DictionaryAttack, CrackError> create(
-        std::string_view path, unsigned thread_index, unsigned total_threads);
+  public:
+    static std::expected<DictionaryAttack, CrackError>
+    create(std::string_view path, unsigned thread_index, unsigned total_threads);
 
     std::expected<std::string, AttackComplete> next();
     std::size_t total() const;
     std::size_t progress() const;
 
-private:
+  private:
     DictionaryAttack() = default;
 
     MappedFile file_;
diff --git a/PROJECTS/beginner/hash-cracker/src/attack/RuleAttack.cpp b/PROJECTS/beginner/hash-cracker/src/attack/RuleAttack.cpp
index e737a969..4e721769 100644
--- a/PROJECTS/beginner/hash-cracker/src/attack/RuleAttack.cpp
+++ b/PROJECTS/beginner/hash-cracker/src/attack/RuleAttack.cpp
@@ -30,9 +30,9 @@ Connects to:
 RuleAttack::RuleAttack(DictionaryAttack dict, bool chain_rules)
     : dict_(std::move(dict)), chain_rules_(chain_rules) {}
 
-std::expected<RuleAttack, CrackError> RuleAttack::create(
-    std::string_view path, bool chain_rules,
-    unsigned thread_index, unsigned total_threads) {
+std::expected<RuleAttack, CrackError> RuleAttack::create(std::string_view path, bool chain_rules,
+                                                         unsigned thread_index,
+                                                         unsigned total_threads) {
     auto dict = DictionaryAttack::create(path, thread_index, total_threads);
     if (!dict.has_value()) {
         return std::unexpected(dict.error());
@@ -49,14 +49,14 @@ bool RuleAttack::load_next_word() {
     mutations_.clear();
     mutations_.push_back(*word);
 
-    for (auto&& m : RuleSet::apply_all(*word)) {
+    for (auto &&m : RuleSet::apply_all(*word)) {
         mutations_.push_back(std::move(m));
     }
 
     if (chain_rules_) {
         std::vector<std::string> base(mutations_.begin() + 1, mutations_.end());
-        for (const auto& b : base) {
-            for (auto&& m : RuleSet::apply_all(b)) {
+        for (const auto &b : base) {
+            for (auto &&m : RuleSet::apply_all(b)) {
                 mutations_.push_back(std::move(m));
             }
         }
@@ -77,5 +77,9 @@ std::expected<std::string, AttackComplete> RuleAttack::next() {
     return std::move(mutations_[mutation_index_++]);
 }
 
-std::size_t RuleAttack::total() const { return dict_.total(); }
-std::size_t RuleAttack::progress() const { return candidates_yielded_; }
+std::size_t RuleAttack::total() const {
+    return dict_.total();
+}
+std::size_t RuleAttack::progress() const {
+    return candidates_yielded_;
+}
diff --git a/PROJECTS/beginner/hash-cracker/src/attack/RuleAttack.hpp b/PROJECTS/beginner/hash-cracker/src/attack/RuleAttack.hpp
index 34d3bc3c..2fdd80a9 100644
--- a/PROJECTS/beginner/hash-cracker/src/attack/RuleAttack.hpp
+++ b/PROJECTS/beginner/hash-cracker/src/attack/RuleAttack.hpp
@@ -17,25 +17,24 @@ Connects to:
 
 #pragma once
 
+#include "src/attack/DictionaryAttack.hpp"
+#include "src/core/Concepts.hpp"
 #include <cstddef>
 #include <expected>
 #include <string>
 #include <string_view>
 #include <vector>
-#include "src/attack/DictionaryAttack.hpp"
-#include "src/core/Concepts.hpp"
 
 class RuleAttack {
-public:
-    static std::expected<RuleAttack, CrackError> create(
-        std::string_view path, bool chain_rules,
-        unsigned thread_index, unsigned total_threads);
+  public:
+    static std::expected<RuleAttack, CrackError>
+    create(std::string_view path, bool chain_rules, unsigned thread_index, unsigned total_threads);
 
     std::expected<std::string, AttackComplete> next();
     std::size_t total() const;
     std::size_t progress() const;
 
-private:
+  private:
     RuleAttack(DictionaryAttack dict, bool chain_rules);
 
     DictionaryAttack dict_;
diff --git a/PROJECTS/beginner/hash-cracker/src/config/Config.hpp b/PROJECTS/beginner/hash-cracker/src/config/Config.hpp
index 13c53142..32ca264e 100644
--- a/PROJECTS/beginner/hash-cracker/src/config/Config.hpp
+++ b/PROJECTS/beginner/hash-cracker/src/config/Config.hpp
@@ -70,7 +70,7 @@ constexpr std::string_view CYAN = "\033[36m";
 constexpr std::string_view BOLD = "\033[1m";
 constexpr std::string_view DIM = "\033[2m";
 
-}
+} // namespace color
 
 namespace box {
 
@@ -85,7 +85,7 @@ constexpr std::string_view BLOCK_EMPTY = "\u2591";
 constexpr std::string_view BAR_LEFT = "\u2590";
 constexpr std::string_view BAR_RIGHT = "\u258C";
 
-}
+} // namespace box
 
 namespace symbol {
 
@@ -99,9 +99,9 @@ constexpr std::string_view TRIANGLE_UP = "\u25B2";
 constexpr std::string_view STAR = "\u2726";
 constexpr std::string_view DIVIDER_CHAR = "\u2501";
 
-}
+} // namespace symbol
 
-}
+} // namespace config
 
 struct CrackConfig {
     std::string target_hash;
diff --git a/PROJECTS/beginner/hash-cracker/src/core/Concepts.hpp b/PROJECTS/beginner/hash-cracker/src/core/Concepts.hpp
index 59d1ee90..bfacf378 100644
--- a/PROJECTS/beginner/hash-cracker/src/core/Concepts.hpp
+++ b/PROJECTS/beginner/hash-cracker/src/core/Concepts.hpp
@@ -50,12 +50,18 @@ enum class CrackError {
 
 constexpr std::string_view crack_error_message(CrackError e) {
     switch (e) {
-        case CrackError::FileNotFound: return "File not found";
-        case CrackError::InvalidHash: return "Invalid hash format";
-        case CrackError::UnsupportedAlgorithm: return "Unsupported hash algorithm";
-        case CrackError::OpenSSLError: return "OpenSSL internal error";
-        case CrackError::InvalidConfig: return "Invalid configuration";
-        case CrackError::Exhausted: return "All candidates exhausted";
+        case CrackError::FileNotFound:
+            return "File not found";
+        case CrackError::InvalidHash:
+            return "Invalid hash format";
+        case CrackError::UnsupportedAlgorithm:
+            return "Unsupported hash algorithm";
+        case CrackError::OpenSSLError:
+            return "OpenSSL internal error";
+        case CrackError::InvalidConfig:
+            return "Invalid configuration";
+        case CrackError::Exhausted:
+            return "All candidates exhausted";
     }
     return "Unknown error";
 }
diff --git a/PROJECTS/beginner/hash-cracker/src/core/Engine.hpp b/PROJECTS/beginner/hash-cracker/src/core/Engine.hpp
index ba8c48bb..dc4b2293 100644
--- a/PROJECTS/beginner/hash-cracker/src/core/Engine.hpp
+++ b/PROJECTS/beginner/hash-cracker/src/core/Engine.hpp
@@ -31,11 +31,6 @@ Connects to:
 
 #pragma once
 
-#include <chrono>
-#include <cstdio>
-#include <expected>
-#include <string>
-#include <thread>
 #include "src/attack/BruteForceAttack.hpp"
 #include "src/attack/DictionaryAttack.hpp"
 #include "src/attack/RuleAttack.hpp"
@@ -43,26 +38,32 @@ Connects to:
 #include "src/core/Concepts.hpp"
 #include "src/display/Progress.hpp"
 #include "src/threading/ThreadPool.hpp"
+#include <chrono>
+#include <cstdio>
+#include <expected>
+#include <string>
+#include <thread>
 
 class Engine {
-public:
+  public:
     template <Hasher H, AttackStrategy A>
-    static auto crack(const CrackConfig& cfg)
-        -> std::expected<CrackResult, CrackError>;
+    static auto crack(const CrackConfig &cfg) -> std::expected<CrackResult, CrackError>;
 };
 
 template <Hasher H, AttackStrategy A>
-auto Engine::crack(const CrackConfig& cfg)
-    -> std::expected<CrackResult, CrackError> {
-    unsigned thread_count = cfg.thread_count > 0
-        ? cfg.thread_count
-        : std::thread::hardware_concurrency();
+auto Engine::crack(const CrackConfig &cfg) -> std::expected<CrackResult, CrackError> {
+    unsigned thread_count =
+        cfg.thread_count > 0 ? cfg.thread_count : std::thread::hardware_concurrency();
 
     ThreadPool pool(thread_count);
 
     auto attack_name = [&]() -> std::string_view {
-        if (cfg.bruteforce) { return "Brute Force"; }
-        if (cfg.use_rules) { return "Rules"; }
+        if (cfg.bruteforce) {
+            return "Brute Force";
+        }
+        if (cfg.use_rules) {
+            return "Rules";
+        }
         return "Dictionary";
     }();
 
@@ -72,17 +73,20 @@ auto Engine::crack(const CrackConfig& cfg)
             return probe.total();
         } else if constexpr (std::same_as<A, RuleAttack>) {
             auto probe = DictionaryAttack::create(cfg.wordlist_path, 0, 1);
-            if (!probe) { return 0; }
+            if (!probe) {
+                return 0;
+            }
             return probe->total() * 2005;
         } else {
             auto probe = DictionaryAttack::create(cfg.wordlist_path, 0, 1);
-            if (!probe) { return 0; }
+            if (!probe) {
+                return 0;
+            }
             return probe->total();
         }
     }();
 
-    Progress progress(H::name(), attack_name, thread_count,
-                      total_estimate, pool.state().found,
+    Progress progress(H::name(), attack_name, thread_count, total_estimate, pool.state().found,
                       pool.state().tested_count);
 
     if (Progress::is_tty()) {
@@ -97,16 +101,14 @@ auto Engine::crack(const CrackConfig& cfg)
     std::jthread display_thread;
     if (Progress::is_tty()) {
         display_thread = std::jthread([&](std::stop_token st) {
-            while (!st.stop_requested() &&
-                   !pool.state().found.load(std::memory_order_relaxed)) {
+            while (!st.stop_requested() && !pool.state().found.load(std::memory_order_relaxed)) {
                 progress.update();
-                std::this_thread::sleep_for(
-                    std::chrono::milliseconds(config::PROGRESS_UPDATE_MS));
+                std::this_thread::sleep_for(std::chrono::milliseconds(config::PROGRESS_UPDATE_MS));
             }
         });
     }
 
-    pool.run([&](unsigned tid, unsigned total, SharedState& state) {
+    pool.run([&](unsigned tid, unsigned total, SharedState &state) {
         H hasher;
 
         auto create_attack = [&]() {
@@ -114,20 +116,23 @@ auto Engine::crack(const CrackConfig& cfg)
                 return std::expected<BruteForceAttack, CrackError>(
                     BruteForceAttack(cfg.charset, cfg.max_length, tid, total));
             } else if constexpr (std::same_as<A, RuleAttack>) {
-                return RuleAttack::create(
-                    cfg.wordlist_path, cfg.chain_rules, tid, total);
+                return RuleAttack::create(cfg.wordlist_path, cfg.chain_rules, tid, total);
             } else {
                 return DictionaryAttack::create(cfg.wordlist_path, tid, total);
             }
         };
 
         auto attack = create_attack();
-        if (!attack.has_value()) { return; }
+        if (!attack.has_value()) {
+            return;
+        }
 
         std::size_t local_count = 0;
         while (!state.found.load(std::memory_order_relaxed)) {
             auto candidate = attack->next();
-            if (!candidate.has_value()) { break; }
+            if (!candidate.has_value()) {
+                break;
+            }
 
             std::string to_hash = *candidate;
             if (!cfg.salt.empty()) {
@@ -161,18 +166,16 @@ auto Engine::crack(const CrackConfig& cfg)
     auto end = std::chrono::steady_clock::now();
     double elapsed = std::chrono::duration<double>(end - start).count();
     auto tested = pool.state().tested_count.load(std::memory_order_relaxed);
-    double speed = (elapsed > 0.0) ? static_cast<double>(tested) / elapsed : 0.0;
 
-    auto& state = pool.state();
+    auto &state = pool.state();
     if (state.found.load(std::memory_order_relaxed) && state.result.has_value()) {
-        CrackResult result{
-            .plaintext = *state.result,
-            .hash = cfg.target_hash,
-            .algorithm = std::string(H::name()),
-            .elapsed_seconds = elapsed,
-            .candidates_tested = tested,
-            .hashes_per_second = speed
-        };
+        double speed = (elapsed > 0.0) ? static_cast<double>(tested) / elapsed : 0.0;
+        CrackResult result{.plaintext = *state.result,
+                           .hash = cfg.target_hash,
+                           .algorithm = std::string(H::name()),
+                           .elapsed_seconds = elapsed,
+                           .candidates_tested = tested,
+                           .hashes_per_second = speed};
 
         progress.print_cracked(result);
         return result;
diff --git a/PROJECTS/beginner/hash-cracker/src/display/Progress.cpp b/PROJECTS/beginner/hash-cracker/src/display/Progress.cpp
index 7202ee69..c4588e35 100644
--- a/PROJECTS/beginner/hash-cracker/src/display/Progress.cpp
+++ b/PROJECTS/beginner/hash-cracker/src/display/Progress.cpp
@@ -35,13 +35,11 @@ Connects to:
 #include <sys/ioctl.h>
 #include <unistd.h>
 
-Progress::Progress(std::string_view algorithm, std::string_view attack_mode,
-                   unsigned thread_count, std::size_t total_candidates,
-                   const std::atomic<bool>& found,
-                   const std::atomic<std::size_t>& tested)
-    : algorithm_(algorithm), attack_mode_(attack_mode),
-      thread_count_(thread_count), total_(total_candidates),
-      found_(found), tested_(tested),
+Progress::Progress(std::string_view algorithm, std::string_view attack_mode, unsigned thread_count,
+                   std::size_t total_candidates, const std::atomic<bool> &found,
+                   const std::atomic<std::size_t> &tested)
+    : algorithm_(algorithm), attack_mode_(attack_mode), thread_count_(thread_count),
+      total_(total_candidates), found_(found), tested_(tested),
       start_time_(std::chrono::steady_clock::now()) {}
 
 bool Progress::is_tty() {
@@ -85,7 +83,9 @@ std::string Progress::render_bar(double fraction, std::size_t width) const {
     }
 
     auto filled = static_cast<std::size_t>(fraction * static_cast<double>(width));
-    if (filled > width) { filled = width; }
+    if (filled > width) {
+        filled = width;
+    }
 
     std::string bar;
     bar += config::box::BAR_LEFT;
@@ -97,7 +97,9 @@ std::string Progress::render_bar(double fraction, std::size_t width) const {
 }
 
 void Progress::print_banner() const {
-    if (!is_tty()) { return; }
+    if (!is_tty()) {
+        return;
+    }
 
     auto w = terminal_width();
     auto inner_width = (w > 6) ? w - 6 : 40;
@@ -111,68 +113,58 @@ void Progress::print_banner() const {
         bot_border += config::box::HORIZONTAL;
     }
 
-    auto line1 = std::format("  {}  {}  v{}",
-        config::APP_NAME, config::box::VERTICAL, config::VERSION);
-    auto line2 = std::format("  {} {} {} {} {} threads",
-        config::box::VERTICAL, algorithm_, config::box::VERTICAL,
-        attack_mode_, thread_count_);
+    auto line1 =
+        std::format("  {}  {}  v{}", config::APP_NAME, config::box::VERTICAL, config::VERSION);
+    auto line2 = std::format("  {} {} {} {} {} threads", config::box::VERTICAL, algorithm_,
+                             config::box::VERTICAL, attack_mode_, thread_count_);
 
-    std::println("{}{}{}{}{}",
-        config::color::CYAN, config::box::TOP_LEFT,
-        top_border, config::box::TOP_RIGHT, config::color::RESET);
-    std::println("{}{} {:<{}}{}{}", config::color::CYAN,
-        config::box::VERTICAL, line1, inner_width - 1,
-        config::box::VERTICAL, config::color::RESET);
-    std::println("{}{} {:<{}}{}{}", config::color::CYAN,
-        config::box::VERTICAL, line2, inner_width - 1,
-        config::box::VERTICAL, config::color::RESET);
-    std::println("{}{}{}{}{}",
-        config::color::CYAN, config::box::BOTTOM_LEFT,
-        bot_border, config::box::BOTTOM_RIGHT, config::color::RESET);
+    std::println("{}{}{}{}{}", config::color::CYAN, config::box::TOP_LEFT, top_border,
+                 config::box::TOP_RIGHT, config::color::RESET);
+    std::println("{}{} {:<{}}{}{}", config::color::CYAN, config::box::VERTICAL, line1,
+                 inner_width - 1, config::box::VERTICAL, config::color::RESET);
+    std::println("{}{} {:<{}}{}{}", config::color::CYAN, config::box::VERTICAL, line2,
+                 inner_width - 1, config::box::VERTICAL, config::color::RESET);
+    std::println("{}{}{}{}{}", config::color::CYAN, config::box::BOTTOM_LEFT, bot_border,
+                 config::box::BOTTOM_RIGHT, config::color::RESET);
     std::println("");
 }
 
 void Progress::update() {
-    if (!is_tty()) { return; }
+    if (!is_tty()) {
+        return;
+    }
 
     auto now = std::chrono::steady_clock::now();
     double elapsed = std::chrono::duration<double>(now - start_time_).count();
     auto tested_val = tested_.load(std::memory_order_relaxed);
 
-    double fraction = (total_ > 0)
-        ? static_cast<double>(tested_val) / static_cast<double>(total_)
-        : 0.0;
-    if (fraction > 1.0) { fraction = 1.0; }
+    double fraction =
+        (total_ > 0) ? static_cast<double>(tested_val) / static_cast<double>(total_) : 0.0;
+    if (fraction > 1.0) {
+        fraction = 1.0;
+    }
 
-    double speed = (elapsed > 0.0)
-        ? static_cast<double>(tested_val) / elapsed
-        : 0.0;
+    double speed = (elapsed > 0.0) ? static_cast<double>(tested_val) / elapsed : 0.0;
 
     double eta = (speed > 0.0 && total_ > tested_val)
-        ? static_cast<double>(total_ - tested_val) / speed
-        : 0.0;
+                     ? static_cast<double>(total_ - tested_val) / speed
+                     : 0.0;
 
     auto bar_width = terminal_width();
     bar_width = (bar_width > 30) ? bar_width - 20 : 10;
 
     std::print("\033[3A");
 
-    std::println("  {}{} {:.1f}%{}",
-        config::color::YELLOW, render_bar(fraction, bar_width),
-        fraction * 100.0, config::color::RESET);
-    std::println("  {} {} {} {}  {} {} {} ~{}{}",
-        config::symbol::DIAMOND, config::color::CYAN,
-        format_speed(speed), config::color::RESET,
-        config::symbol::TIMER, config::color::CYAN,
-        format_time(elapsed), format_time(eta),
-        config::color::RESET);
-    std::println("  {} {} {} / {} candidates{}",
-        config::symbol::ARROW_RIGHT, config::color::CYAN,
-        format_count(tested_val), format_count(total_),
-        config::color::RESET);
+    std::println("  {}{} {:.1f}%{}", config::color::YELLOW, render_bar(fraction, bar_width),
+                 fraction * 100.0, config::color::RESET);
+    std::println("  {} {} {} {}  {} {} {} ~{}{}", config::symbol::DIAMOND, config::color::CYAN,
+                 format_speed(speed), config::color::RESET, config::symbol::TIMER,
+                 config::color::CYAN, format_time(elapsed), format_time(eta), config::color::RESET);
+    std::println("  {} {} {} / {} candidates{}", config::symbol::ARROW_RIGHT, config::color::CYAN,
+                 format_count(tested_val), format_count(total_), config::color::RESET);
 }
 
-void Progress::print_cracked(const CrackResult& result) const {
+void Progress::print_cracked(const CrackResult &result) const {
     if (!is_tty()) {
         std::println("{}", result.plaintext);
         return;
@@ -180,22 +172,17 @@ void Progress::print_cracked(const CrackResult& result) const {
 
     std::print("\033[3A\033[J");
 
-    std::println("  {}{} CRACKED {}{}{}",
-        config::color::GREEN, config::symbol::CHECK,
-        std::string(30, '-'), config::color::RESET, "");
-    std::println("  {}Password:  {}{}{}",
-        config::color::BOLD, config::color::GREEN,
-        result.plaintext, config::color::RESET);
+    std::println("  {}{} CRACKED {}{}{}", config::color::GREEN, config::symbol::CHECK,
+                 std::string(30, '-'), config::color::RESET, "");
+    std::println("  {}Password:  {}{}{}", config::color::BOLD, config::color::GREEN,
+                 result.plaintext, config::color::RESET);
     std::println("  Hash:      {}", result.hash);
     std::println("  Algorithm: {}", result.algorithm);
-    std::println("  Time:      {} {} {}",
-        format_time(result.elapsed_seconds),
-        config::box::VERTICAL,
-        format_speed(result.hashes_per_second));
+    std::println("  Time:      {} {} {}", format_time(result.elapsed_seconds),
+                 config::box::VERTICAL, format_speed(result.hashes_per_second));
 }
 
-void Progress::print_exhausted(std::string_view hash,
-                                std::string_view algorithm) const {
+void Progress::print_exhausted(std::string_view hash, std::string_view algorithm) const {
     if (!is_tty()) {
         std::println("NOT FOUND");
         return;
@@ -207,11 +194,10 @@ void Progress::print_exhausted(std::string_view hash,
 
     std::print("\033[3A\033[J");
 
-    std::println("  {}{} EXHAUSTED {}{}{}",
-        config::color::RED, config::symbol::CROSS,
-        std::string(30, '-'), config::color::RESET, "");
+    std::println("  {}{} EXHAUSTED {}{}{}", config::color::RED, config::symbol::CROSS,
+                 std::string(30, '-'), config::color::RESET, "");
     std::println("  Hash:      {}", hash);
     std::println("  Algorithm: {}", algorithm);
-    std::println("  Tested:    {} candidates in {}",
-        format_count(tested_val), format_time(elapsed));
+    std::println("  Tested:    {} candidates in {}", format_count(tested_val),
+                 format_time(elapsed));
 }
diff --git a/PROJECTS/beginner/hash-cracker/src/display/Progress.hpp b/PROJECTS/beginner/hash-cracker/src/display/Progress.hpp
index c9e7b304..26715917 100644
--- a/PROJECTS/beginner/hash-cracker/src/display/Progress.hpp
+++ b/PROJECTS/beginner/hash-cracker/src/display/Progress.hpp
@@ -21,25 +21,24 @@ Connects to:
 struct CrackResult;
 
 class Progress {
-public:
-    Progress(std::string_view algorithm, std::string_view attack_mode,
-             unsigned thread_count, std::size_t total_candidates,
-             const std::atomic<bool>& found,
-             const std::atomic<std::size_t>& tested);
+  public:
+    Progress(std::string_view algorithm, std::string_view attack_mode, unsigned thread_count,
+             std::size_t total_candidates, const std::atomic<bool> &found,
+             const std::atomic<std::size_t> &tested);
 
     void print_banner() const;
     void update();
-    void print_cracked(const CrackResult& result) const;
+    void print_cracked(const CrackResult &result) const;
     void print_exhausted(std::string_view hash, std::string_view algorithm) const;
     static bool is_tty();
 
-private:
+  private:
     std::string algorithm_;
     std::string attack_mode_;
     unsigned thread_count_;
     std::size_t total_;
-    const std::atomic<bool>& found_;
-    const std::atomic<std::size_t>& tested_;
+    const std::atomic<bool> &found_;
+    const std::atomic<std::size_t> &tested_;
 
     std::chrono::steady_clock::time_point start_time_;
 
diff --git a/PROJECTS/beginner/hash-cracker/src/hash/EVPHasher.hpp b/PROJECTS/beginner/hash-cracker/src/hash/EVPHasher.hpp
index e2ebd751..116938ca 100644
--- a/PROJECTS/beginner/hash-cracker/src/hash/EVPHasher.hpp
+++ b/PROJECTS/beginner/hash-cracker/src/hash/EVPHasher.hpp
@@ -42,62 +42,59 @@ Connects to:
 namespace evp {
 
 struct MD5Tag {
-    static const EVP_MD* algorithm() { return EVP_md5(); }
+    static const EVP_MD *algorithm() { return EVP_md5(); }
     static constexpr std::string_view name = "MD5";
     static constexpr std::size_t hex_length = 32;
 };
 
 struct SHA1Tag {
-    static const EVP_MD* algorithm() { return EVP_sha1(); }
+    static const EVP_MD *algorithm() { return EVP_sha1(); }
     static constexpr std::string_view name = "SHA1";
     static constexpr std::size_t hex_length = 40;
 };
 
 struct SHA256Tag {
-    static const EVP_MD* algorithm() { return EVP_sha256(); }
+    static const EVP_MD *algorithm() { return EVP_sha256(); }
     static constexpr std::string_view name = "SHA256";
     static constexpr std::size_t hex_length = 64;
 };
 
 struct SHA512Tag {
-    static const EVP_MD* algorithm() { return EVP_sha512(); }
+    static const EVP_MD *algorithm() { return EVP_sha512(); }
     static constexpr std::string_view name = "SHA512";
     static constexpr std::size_t hex_length = 128;
 };
 
-}
+} // namespace evp
 
 inline constexpr std::array<std::array<char, 2>, 256> HEX_TABLE = [] {
     std::array<std::array<char, 2>, 256> t{};
-    constexpr std::array<char, 17> digits = {
-        '0','1','2','3','4','5','6','7',
-        '8','9','a','b','c','d','e','f','\0'};
+    constexpr std::array<char, 17> digits = {'0', '1', '2', '3', '4', '5', '6', '7', '8',
+                                             '9', 'a', 'b', 'c', 'd', 'e', 'f', '\0'};
     for (std::size_t i = 0; i < 256; ++i) {
         t.at(i) = {digits.at(i >> 4), digits.at(i & 0xF)};
     }
     return t;
 }();
 
-template <typename Tag>
-class EVPHasher {
-public:
+template <typename Tag> class EVPHasher {
+  public:
     std::string hash(std::string_view input) const {
-        auto ctx = std::unique_ptr<EVP_MD_CTX, decltype(&EVP_MD_CTX_free)>(
-            EVP_MD_CTX_new(), EVP_MD_CTX_free);
+        auto ctx = std::unique_ptr<EVP_MD_CTX, decltype(&EVP_MD_CTX_free)>(EVP_MD_CTX_new(),
+                                                                           EVP_MD_CTX_free);
 
         std::array<unsigned char, EVP_MAX_MD_SIZE> digest{};
         unsigned int len = 0;
 
-        if (!ctx
-            || !EVP_DigestInit_ex(ctx.get(), Tag::algorithm(), nullptr)
-            || !EVP_DigestUpdate(ctx.get(), input.data(), input.size())
-            || !EVP_DigestFinal_ex(ctx.get(), digest.data(), &len)) {
+        if (!ctx || !EVP_DigestInit_ex(ctx.get(), Tag::algorithm(), nullptr) ||
+            !EVP_DigestUpdate(ctx.get(), input.data(), input.size()) ||
+            !EVP_DigestFinal_ex(ctx.get(), digest.data(), &len)) {
             return "";
         }
 
         std::string hex(static_cast<std::size_t>(len) * 2, '\0');
         for (std::size_t i = 0; i < len; ++i) {
-            hex.at(i * 2)     = HEX_TABLE.at(digest.at(i)).at(0);
+            hex.at(i * 2) = HEX_TABLE.at(digest.at(i)).at(0);
             hex.at(i * 2 + 1) = HEX_TABLE.at(digest.at(i)).at(1);
         }
         return hex;
diff --git a/PROJECTS/beginner/hash-cracker/src/hash/HashDetector.cpp b/PROJECTS/beginner/hash-cracker/src/hash/HashDetector.cpp
index 579f3bcf..d8b9504d 100644
--- a/PROJECTS/beginner/hash-cracker/src/hash/HashDetector.cpp
+++ b/PROJECTS/beginner/hash-cracker/src/hash/HashDetector.cpp
@@ -26,9 +26,7 @@ Connects to:
 
 std::expected<HashType, CrackError> HashDetector::detect(std::string_view hash) {
     auto is_hex = [](char c) {
-        return (c >= '0' && c <= '9') ||
-               (c >= 'a' && c <= 'f') ||
-               (c >= 'A' && c <= 'F');
+        return (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F');
     };
 
     if (!std::ranges::all_of(hash, is_hex)) {
@@ -36,10 +34,15 @@ std::expected<HashType, CrackError> HashDetector::detect(std::string_view hash)
     }
 
     switch (hash.size()) {
-        case config::MD5_HEX_LENGTH: return HashType::MD5;
-        case config::SHA1_HEX_LENGTH: return HashType::SHA1;
-        case config::SHA256_HEX_LENGTH: return HashType::SHA256;
-        case config::SHA512_HEX_LENGTH: return HashType::SHA512;
-        default: return std::unexpected(CrackError::InvalidHash);
+        case config::MD5_HEX_LENGTH:
+            return HashType::MD5;
+        case config::SHA1_HEX_LENGTH:
+            return HashType::SHA1;
+        case config::SHA256_HEX_LENGTH:
+            return HashType::SHA256;
+        case config::SHA512_HEX_LENGTH:
+            return HashType::SHA512;
+        default:
+            return std::unexpected(CrackError::InvalidHash);
     }
 }
diff --git a/PROJECTS/beginner/hash-cracker/src/hash/HashDetector.hpp b/PROJECTS/beginner/hash-cracker/src/hash/HashDetector.hpp
index 4c339fe4..684a90e3 100644
--- a/PROJECTS/beginner/hash-cracker/src/hash/HashDetector.hpp
+++ b/PROJECTS/beginner/hash-cracker/src/hash/HashDetector.hpp
@@ -12,13 +12,13 @@ Connects to:
 
 #pragma once
 
+#include "src/core/Concepts.hpp"
 #include <expected>
 #include <string_view>
-#include "src/core/Concepts.hpp"
 
 enum class HashType { MD5, SHA1, SHA256, SHA512 };
 
 class HashDetector {
-public:
+  public:
     static std::expected<HashType, CrackError> detect(std::string_view hash);
 };
diff --git a/PROJECTS/beginner/hash-cracker/src/io/MappedFile.cpp b/PROJECTS/beginner/hash-cracker/src/io/MappedFile.cpp
index e80eca1d..0ee01086 100644
--- a/PROJECTS/beginner/hash-cracker/src/io/MappedFile.cpp
+++ b/PROJECTS/beginner/hash-cracker/src/io/MappedFile.cpp
@@ -47,15 +47,15 @@ std::expected<MappedFile, CrackError> MappedFile::open(std::string_view path) {
         return std::unexpected(CrackError::InvalidConfig);
     }
 
-    auto* mapped = static_cast<const char*>(
-        mmap(nullptr, file_size, PROT_READ, MAP_PRIVATE, fd, 0));
+    auto *mapped =
+        static_cast<const char *>(mmap(nullptr, file_size, PROT_READ, MAP_PRIVATE, fd, 0));
 
     if (mapped == MAP_FAILED) {
         ::close(fd);
         return std::unexpected(CrackError::FileNotFound);
     }
 
-    madvise(const_cast<char*>(mapped), file_size, MADV_SEQUENTIAL);
+    madvise(const_cast<char *>(mapped), file_size, MADV_SEQUENTIAL);
 
     MappedFile mf;
     mf.data_ = mapped;
@@ -66,23 +66,23 @@ std::expected<MappedFile, CrackError> MappedFile::open(std::string_view path) {
 
 MappedFile::~MappedFile() {
     if (data_ && data_ != MAP_FAILED) {
-        munmap(const_cast<char*>(data_), size_);
+        munmap(const_cast<char *>(data_), size_);
     }
     if (fd_ >= 0) {
         ::close(fd_);
     }
 }
 
-MappedFile::MappedFile(MappedFile&& other) noexcept
+MappedFile::MappedFile(MappedFile &&other) noexcept
     : data_(other.data_), size_(other.size_), fd_(other.fd_) {
     other.data_ = nullptr;
     other.fd_ = -1;
 }
 
-MappedFile& MappedFile::operator=(MappedFile&& other) noexcept {
+MappedFile &MappedFile::operator=(MappedFile &&other) noexcept {
     if (this != &other) {
         if (data_ && data_ != MAP_FAILED) {
-            munmap(const_cast<char*>(data_), size_);
+            munmap(const_cast<char *>(data_), size_);
         }
         if (fd_ >= 0) {
             ::close(fd_);
diff --git a/PROJECTS/beginner/hash-cracker/src/io/MappedFile.hpp b/PROJECTS/beginner/hash-cracker/src/io/MappedFile.hpp
index 35b594e9..98c046db 100644
--- a/PROJECTS/beginner/hash-cracker/src/io/MappedFile.hpp
+++ b/PROJECTS/beginner/hash-cracker/src/io/MappedFile.hpp
@@ -12,28 +12,28 @@ Connects to:
 
 #pragma once
 
+#include "src/core/Concepts.hpp"
 #include <cstddef>
 #include <expected>
 #include <string_view>
-#include "src/core/Concepts.hpp"
 
 class MappedFile {
-public:
+  public:
     MappedFile() = default;
     static std::expected<MappedFile, CrackError> open(std::string_view path);
 
     ~MappedFile();
-    MappedFile(MappedFile&& other) noexcept;
-    MappedFile& operator=(MappedFile&& other) noexcept;
+    MappedFile(MappedFile &&other) noexcept;
+    MappedFile &operator=(MappedFile &&other) noexcept;
 
-    MappedFile(const MappedFile&) = delete;
-    MappedFile& operator=(const MappedFile&) = delete;
+    MappedFile(const MappedFile &) = delete;
+    MappedFile &operator=(const MappedFile &) = delete;
 
-    const char* data() const { return data_; }
+    const char *data() const { return data_; }
     std::size_t size() const { return size_; }
 
-private:
-    const char* data_ = nullptr;
+  private:
+    const char *data_ = nullptr;
     std::size_t size_ = 0;
     int fd_ = -1;
 };
diff --git a/PROJECTS/beginner/hash-cracker/src/rules/RuleSet.cpp b/PROJECTS/beginner/hash-cracker/src/rules/RuleSet.cpp
index 9e0d0318..5974b801 100644
--- a/PROJECTS/beginner/hash-cracker/src/rules/RuleSet.cpp
+++ b/PROJECTS/beginner/hash-cracker/src/rules/RuleSet.cpp
@@ -39,13 +39,13 @@ Connects to:
 #include <ranges>
 #include <utility>
 
-static constexpr std::array<std::pair<char, char>, 6> LEET_MAP = {{
-    {'a', '@'}, {'e', '3'}, {'i', '1'},
-    {'o', '0'}, {'s', '$'}, {'t', '7'}
-}};
+static constexpr std::array<std::pair<char, char>, 6> LEET_MAP = {
+    {{'a', '@'}, {'e', '3'}, {'i', '1'}, {'o', '0'}, {'s', '$'}, {'t', '7'}}};
 
 std::generator<std::string> RuleSet::capitalize_first(std::string_view word) {
-    if (word.empty()) { co_return; }
+    if (word.empty()) {
+        co_return;
+    }
     std::string result(word);
     result[0] = static_cast<char>(std::toupper(static_cast<unsigned char>(result[0])));
     co_yield std::move(result);
@@ -53,18 +53,20 @@ std::generator<std::string> RuleSet::capitalize_first(std::string_view word) {
 
 std::generator<std::string> RuleSet::uppercase_all(std::string_view word) {
     std::string result(word);
-    std::ranges::transform(result, result.begin(), [](unsigned char c) {
-        return static_cast<char>(std::toupper(c));
-    });
+    std::ranges::transform(result, result.begin(),
+                           [](unsigned char c) { return static_cast<char>(std::toupper(c)); });
     co_yield std::move(result);
 }
 
 std::generator<std::string> RuleSet::leet_speak(std::string_view word) {
     std::string result(word);
-    for (auto& c : result) {
+    for (auto &c : result) {
         auto lower = static_cast<char>(std::tolower(static_cast<unsigned char>(c)));
         for (auto [from, to] : LEET_MAP) {
-            if (lower == from) { c = to; break; }
+            if (lower == from) {
+                c = to;
+                break;
+            }
         }
     }
     co_yield std::move(result);
@@ -92,7 +94,9 @@ std::generator<std::string> RuleSet::reverse(std::string_view word) {
 std::generator<std::string> RuleSet::toggle_case(std::string_view word) {
     std::string result(word);
     std::ranges::transform(result, result.begin(), [](unsigned char c) {
-        if (std::islower(c)) { return static_cast<char>(std::toupper(c)); }
+        if (std::islower(c)) {
+            return static_cast<char>(std::toupper(c));
+        }
         return static_cast<char>(std::tolower(c));
     });
     co_yield std::move(result);
diff --git a/PROJECTS/beginner/hash-cracker/src/rules/RuleSet.hpp b/PROJECTS/beginner/hash-cracker/src/rules/RuleSet.hpp
index bf291869..a5b223dc 100644
--- a/PROJECTS/beginner/hash-cracker/src/rules/RuleSet.hpp
+++ b/PROJECTS/beginner/hash-cracker/src/rules/RuleSet.hpp
@@ -17,7 +17,7 @@ Connects to:
 #include <string_view>
 
 class RuleSet {
-public:
+  public:
     static std::generator<std::string> capitalize_first(std::string_view word);
     static std::generator<std::string> uppercase_all(std::string_view word);
     static std::generator<std::string> leet_speak(std::string_view word);
diff --git a/PROJECTS/beginner/hash-cracker/src/threading/ThreadPool.cpp b/PROJECTS/beginner/hash-cracker/src/threading/ThreadPool.cpp
index 27691aed..e7133835 100644
--- a/PROJECTS/beginner/hash-cracker/src/threading/ThreadPool.cpp
+++ b/PROJECTS/beginner/hash-cracker/src/threading/ThreadPool.cpp
@@ -27,18 +27,17 @@ void SharedState::set_result(std::string plaintext) {
 }
 
 ThreadPool::ThreadPool(unsigned thread_count)
-    : thread_count_(thread_count > 0 ? thread_count
-                                     : std::thread::hardware_concurrency()) {}
+    : thread_count_(thread_count > 0 ? thread_count : std::thread::hardware_concurrency()) {}
 
 void ThreadPool::run(WorkFn work) {
     std::vector<std::jthread> threads;
     threads.reserve(thread_count_);
 
     for (unsigned i = 0; i < thread_count_; ++i) {
-        threads.emplace_back([this, &work, i] {
-            work(i, thread_count_, state_);
-        });
+        threads.emplace_back([this, &work, i] { work(i, thread_count_, state_); });
     }
 }
 
-SharedState& ThreadPool::state() { return state_; }
+SharedState &ThreadPool::state() {
+    return state_;
+}
diff --git a/PROJECTS/beginner/hash-cracker/src/threading/ThreadPool.hpp b/PROJECTS/beginner/hash-cracker/src/threading/ThreadPool.hpp
index 0145073d..a70c2078 100644
--- a/PROJECTS/beginner/hash-cracker/src/threading/ThreadPool.hpp
+++ b/PROJECTS/beginner/hash-cracker/src/threading/ThreadPool.hpp
@@ -43,15 +43,15 @@ struct SharedState {
 };
 
 class ThreadPool {
-public:
-    using WorkFn = std::function<void(unsigned thread_id, unsigned total, SharedState&)>;
+  public:
+    using WorkFn = std::function<void(unsigned thread_id, unsigned total, SharedState &)>;
 
     explicit ThreadPool(unsigned thread_count);
 
     void run(WorkFn work);
-    SharedState& state();
+    SharedState &state();
 
-private:
+  private:
     unsigned thread_count_;
     SharedState state_;
 };
diff --git a/PROJECTS/beginner/hash-cracker/tests/test_bruteforce_attack.cpp b/PROJECTS/beginner/hash-cracker/tests/test_bruteforce_attack.cpp
index bcb8b413..27a01d5f 100644
--- a/PROJECTS/beginner/hash-cracker/tests/test_bruteforce_attack.cpp
+++ b/PROJECTS/beginner/hash-cracker/tests/test_bruteforce_attack.cpp
@@ -13,8 +13,8 @@ Connects to:
   attack/BruteForceAttack.hpp - BruteForceAttack tested
 */
 
-#include <gtest/gtest.h>
 #include "src/attack/BruteForceAttack.hpp"
+#include <gtest/gtest.h>
 #include <set>
 #include <vector>
 
@@ -42,8 +42,12 @@ TEST(BruteForceAttackTest, PartitionsKeyspace) {
     BruteForceAttack p0("ab", 2, 0, 2);
     BruteForceAttack p1("ab", 2, 1, 2);
     std::set<std::string> all;
-    while (auto c = p0.next()) { all.insert(*c); }
-    while (auto c = p1.next()) { all.insert(*c); }
+    while (auto c = p0.next()) {
+        all.insert(*c);
+    }
+    while (auto c = p1.next()) {
+        all.insert(*c);
+    }
     EXPECT_EQ(all.size(), 6);
 }
 
diff --git a/PROJECTS/beginner/hash-cracker/tests/test_dictionary_attack.cpp b/PROJECTS/beginner/hash-cracker/tests/test_dictionary_attack.cpp
index c98bc12b..29ff9902 100644
--- a/PROJECTS/beginner/hash-cracker/tests/test_dictionary_attack.cpp
+++ b/PROJECTS/beginner/hash-cracker/tests/test_dictionary_attack.cpp
@@ -14,8 +14,8 @@ Connects to:
   tests/data/small_wordlist.txt - fixture wordlist
 */
 
-#include <gtest/gtest.h>
 #include "src/attack/DictionaryAttack.hpp"
+#include <gtest/gtest.h>
 #include <vector>
 
 TEST(DictionaryAttackTest, ReadsAllWords) {
@@ -38,8 +38,12 @@ TEST(DictionaryAttackTest, PartitionsAcrossThreads) {
     ASSERT_TRUE(p1.has_value());
 
     std::size_t count0 = 0, count1 = 0;
-    while (p0->next()) { ++count0; }
-    while (p1->next()) { ++count1; }
+    while (p0->next()) {
+        ++count0;
+    }
+    while (p1->next()) {
+        ++count1;
+    }
     EXPECT_EQ(count0 + count1, 10);
 }
 
diff --git a/PROJECTS/beginner/hash-cracker/tests/test_engine.cpp b/PROJECTS/beginner/hash-cracker/tests/test_engine.cpp
index 4fe08ffb..22306409 100644
--- a/PROJECTS/beginner/hash-cracker/tests/test_engine.cpp
+++ b/PROJECTS/beginner/hash-cracker/tests/test_engine.cpp
@@ -16,14 +16,13 @@ Connects to:
   tests/data/small_wordlist.txt - fixture wordlist
 */
 
-#include <gtest/gtest.h>
 #include "src/core/Engine.hpp"
 #include "src/hash/SHA256Hasher.hpp"
+#include <gtest/gtest.h>
 
 TEST(EngineTest, CracksSHA256WithDictionary) {
     CrackConfig cfg;
-    cfg.target_hash =
-        "5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8";
+    cfg.target_hash = "5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8";
     cfg.wordlist_path = "tests/data/small_wordlist.txt";
     cfg.thread_count = 2;
 
diff --git a/PROJECTS/beginner/hash-cracker/tests/test_hash_detector.cpp b/PROJECTS/beginner/hash-cracker/tests/test_hash_detector.cpp
index 229d2e50..2e844076 100644
--- a/PROJECTS/beginner/hash-cracker/tests/test_hash_detector.cpp
+++ b/PROJECTS/beginner/hash-cracker/tests/test_hash_detector.cpp
@@ -13,8 +13,8 @@ Connects to:
   core/Concepts.hpp     - CrackError enum for error assertions
 */
 
-#include <gtest/gtest.h>
 #include "src/hash/HashDetector.hpp"
+#include <gtest/gtest.h>
 
 TEST(HashDetectorTest, DetectsMD5) {
     auto result = HashDetector::detect("d41d8cd98f00b204e9800998ecf8427e");
@@ -29,8 +29,8 @@ TEST(HashDetectorTest, DetectsSHA1) {
 }
 
 TEST(HashDetectorTest, DetectsSHA256) {
-    auto result = HashDetector::detect(
-        "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855");
+    auto result =
+        HashDetector::detect("e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855");
     ASSERT_TRUE(result.has_value());
     EXPECT_EQ(*result, HashType::SHA256);
 }
diff --git a/PROJECTS/beginner/hash-cracker/tests/test_hashers.cpp b/PROJECTS/beginner/hash-cracker/tests/test_hashers.cpp
index c9f75e2b..3ef945f1 100644
--- a/PROJECTS/beginner/hash-cracker/tests/test_hashers.cpp
+++ b/PROJECTS/beginner/hash-cracker/tests/test_hashers.cpp
@@ -16,20 +16,19 @@ Connects to:
   hash/EVPHasher.hpp    - underlying implementation
 */
 
-#include <gtest/gtest.h>
 #include "src/hash/MD5Hasher.hpp"
 #include "src/hash/SHA1Hasher.hpp"
 #include "src/hash/SHA256Hasher.hpp"
 #include "src/hash/SHA512Hasher.hpp"
+#include <gtest/gtest.h>
 
 TEST(SHA256HasherTest, KnownVectors) {
     SHA256Hasher hasher;
-    EXPECT_EQ(hasher.hash(""),
-        "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855");
+    EXPECT_EQ(hasher.hash(""), "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855");
     EXPECT_EQ(hasher.hash("password"),
-        "5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8");
+              "5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8");
     EXPECT_EQ(hasher.hash("hello"),
-        "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824");
+              "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824");
 }
 
 TEST(SHA256HasherTest, StaticProperties) {
@@ -68,12 +67,11 @@ TEST(SHA1HasherTest, StaticProperties) {
 
 TEST(SHA512HasherTest, KnownVectors) {
     SHA512Hasher hasher;
-    EXPECT_EQ(hasher.hash(""),
-        "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce"
-        "47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e");
+    EXPECT_EQ(hasher.hash(""), "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce"
+                               "47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e");
     EXPECT_EQ(hasher.hash("password"),
-        "b109f3bbbc244eb82441917ed06d618b9008dd09b3befd1b5e07394c706a8bb9"
-        "80b1d7785e5976ec049b46df5f1326af5a2ea6d103fd07c95385ffab0cacbc86");
+              "b109f3bbbc244eb82441917ed06d618b9008dd09b3befd1b5e07394c706a8bb9"
+              "80b1d7785e5976ec049b46df5f1326af5a2ea6d103fd07c95385ffab0cacbc86");
 }
 
 TEST(SHA512HasherTest, StaticProperties) {
diff --git a/PROJECTS/beginner/hash-cracker/tests/test_rules.cpp b/PROJECTS/beginner/hash-cracker/tests/test_rules.cpp
index 817d9768..be23c135 100644
--- a/PROJECTS/beginner/hash-cracker/tests/test_rules.cpp
+++ b/PROJECTS/beginner/hash-cracker/tests/test_rules.cpp
@@ -17,18 +17,15 @@ Connects to:
   tests/data/small_wordlist.txt - fixture wordlist
 */
 
-#include <gtest/gtest.h>
 #include "src/attack/RuleAttack.hpp"
 #include "src/rules/RuleSet.hpp"
 #include <algorithm>
+#include <gtest/gtest.h>
+#include <ranges>
 #include <vector>
 
 static std::vector<std::string> collect(std::generator<std::string> gen) {
-    std::vector<std::string> out;
-    for (auto&& s : gen) {
-        out.push_back(std::move(s));
-    }
-    return out;
+    return std::ranges::to<std::vector<std::string>>(std::move(gen));
 }
 
 TEST(RuleSetTest, CapitalizeFirst) {
@@ -103,10 +100,14 @@ TEST(RuleAttackTest, ChainRulesProducesMoreCandidates) {
     ASSERT_TRUE(with_chain.has_value());
 
     std::size_t count_without = 0;
-    while (without->next()) { ++count_without; }
+    while (without->next()) {
+        ++count_without;
+    }
 
     std::size_t count_with = 0;
-    while (with_chain->next()) { ++count_with; }
+    while (with_chain->next()) {
+        ++count_with;
+    }
 
     EXPECT_GT(count_with, count_without);
 }
diff --git a/PROJECTS/beginner/keylogger/README.md b/PROJECTS/beginner/keylogger/README.md
index 04940841..e2ad5356 100644
--- a/PROJECTS/beginner/keylogger/README.md
+++ b/PROJECTS/beginner/keylogger/README.md
@@ -14,7 +14,19 @@
 
 > Educational keylogger for security research demonstrating input capture, window tracking, and C2 delivery techniques.
 
-*This is a quick overview — security theory, architecture, and full walkthroughs are in the [learn modules](#learn).*
+<p align="center">
+  <a href="https://youtu.be/gTd8cNlMD1k">
+    <img src="https://img.shields.io/badge/Watch_on-YouTube-FF0000?logo=youtube&logoColor=white" alt="Watch on YouTube">
+  </a>
+</p>
+
+<p align="center">
+  <a href="https://youtu.be/gTd8cNlMD1k">
+    <img src="https://img.youtube.com/vi/gTd8cNlMD1k/maxresdefault.jpg" alt="Video Thumbnail" width="800">
+  </a>
+</p>
+
+*Learn Docs are in the [learn modules](#learn).*
 
 ## What It Does
 
diff --git a/PROJECTS/beginner/keylogger/uv.lock b/PROJECTS/beginner/keylogger/uv.lock
index 6f5c3ec1..6839c17a 100644
--- a/PROJECTS/beginner/keylogger/uv.lock
+++ b/PROJECTS/beginner/keylogger/uv.lock
@@ -87,11 +87,11 @@ sdist = { url = "https://files.pythonhosted.org/packages/a5/f5/397b61091120a9ca5
 
 [[package]]
 name = "idna"
-version = "3.11"
+version = "3.15"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/0703ccc57f3a7233505399edb88de3cbd678da106337b9fcde432b65ed60/idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902", size = 194582, upload-time = "2025-10-12T14:55:20.501Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/82/77/7b3966d0b9d1d31a36ddf1746926a11dface89a83409bf1483f0237aa758/idna-3.15.tar.gz", hash = "sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc", size = 199245, upload-time = "2026-05-12T22:45:57.011Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/23/408243171aa9aaba178d3e2559159c24c1171a641aa83b67bdd3394ead8e/idna-3.15-py3-none-any.whl", hash = "sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8", size = 72340, upload-time = "2026-05-12T22:45:55.733Z" },
 ]
 
 [[package]]
diff --git a/PROJECTS/beginner/linux-cis-hardening-auditor/.shellcheckrc b/PROJECTS/beginner/linux-cis-hardening-auditor/.shellcheckrc
new file mode 100644
index 00000000..03f3651f
--- /dev/null
+++ b/PROJECTS/beginner/linux-cis-hardening-auditor/.shellcheckrc
@@ -0,0 +1,10 @@
+# ©AngelaMos | 2026
+# .shellcheckrc
+#
+# Disabled rules document false-positive systematic patterns in this project
+# SC2034: CURRENT_TEST / SYSROOT pattern read by test framework via introspection
+# SC1090: dynamic source paths in test runner (intentional discovery)
+# SC1091: helper-file sources resolved at runtime, not visible to shellcheck
+disable=SC2034
+disable=SC1090
+disable=SC1091
diff --git a/PROJECTS/beginner/linux-cis-hardening-auditor/src/checks/04_logging.sh b/PROJECTS/beginner/linux-cis-hardening-auditor/src/checks/04_logging.sh
index 074fe665..11dea8e5 100755
--- a/PROJECTS/beginner/linux-cis-hardening-auditor/src/checks/04_logging.sh
+++ b/PROJECTS/beginner/linux-cis-hardening-auditor/src/checks/04_logging.sh
@@ -333,6 +333,7 @@ check_4_2_3() {
     fi
 
     local file_mode
+    # shellcheck disable=SC2016 # literal $FileCreateMode and $2 are regex/awk syntax
     file_mode=$(grep -E '^\s*\$FileCreateMode' "$rsyslog_conf" | tail -1 | awk '{print $2}') || true
 
     if [[ -z "$file_mode" ]]; then
@@ -369,6 +370,7 @@ check_4_2_4() {
         evidence="Found ${rule_count} logging rule(s) in rsyslog.conf"
     else
         local include_count
+        # shellcheck disable=SC2016 # literal $IncludeConfig is regex syntax, not shell
         include_count=$(grep -cE '^\s*\$IncludeConfig|^\s*include\(' "$rsyslog_conf") || true
 
         if [[ "$include_count" -gt 0 ]]; then
diff --git a/PROJECTS/beginner/linux-cis-hardening-auditor/src/lib/report_json.sh b/PROJECTS/beginner/linux-cis-hardening-auditor/src/lib/report_json.sh
index 5b55252d..144eaa00 100755
--- a/PROJECTS/beginner/linux-cis-hardening-auditor/src/lib/report_json.sh
+++ b/PROJECTS/beginner/linux-cis-hardening-auditor/src/lib/report_json.sh
@@ -110,6 +110,7 @@ emit_json_report() {
         local status="${RESULT_STATUS[$id]}"
         local evidence="${RESULT_EVIDENCE[$id]:-}"
         local title="${CTRL_TITLE[$id]}"
+        # shellcheck disable=SC2153 # CTRL_SECTION is a populated global associative array
         local ctrl_section="${CTRL_SECTION[$id]}"
         local level="${CTRL_LEVEL[$id]}"
         local scored="${CTRL_SCORED[$id]}"
diff --git a/PROJECTS/beginner/linux-cis-hardening-auditor/src/lib/utils.sh b/PROJECTS/beginner/linux-cis-hardening-auditor/src/lib/utils.sh
index d2271e6e..82d7aa9b 100755
--- a/PROJECTS/beginner/linux-cis-hardening-auditor/src/lib/utils.sh
+++ b/PROJECTS/beginner/linux-cis-hardening-auditor/src/lib/utils.sh
@@ -25,7 +25,7 @@ fail()    { echo -e "${RED}[✖]${RESET} $1" >&2; exit "$EXIT_FAIL"; }
 
 progress() {
     [[ "$QUIET" == "true" ]] && return
-    printf "\r${DIM}[%s] Checking: %s${RESET}%s" "$1" "$2" "$(printf '%40s')" >&2
+    printf "\r${DIM}[%s] Checking: %s${RESET}%s" "$1" "$2" "$(printf '%40s' '')" >&2
 }
 
 clear_progress() {
@@ -120,6 +120,7 @@ service_is_active() {
 }
 
 package_is_installed() {
+    # shellcheck disable=SC2016 # ${Status} is dpkg-query template syntax, not shell expansion
     if run_cmd dpkg-query -W -f='${Status}' "$1" | grep -q "install ok installed"; then
         return 0
     fi
diff --git a/PROJECTS/beginner/linux-cis-hardening-auditor/tests/test_baseline.sh b/PROJECTS/beginner/linux-cis-hardening-auditor/tests/test_baseline.sh
index 261d25af..1ef691a9 100755
--- a/PROJECTS/beginner/linux-cis-hardening-auditor/tests/test_baseline.sh
+++ b/PROJECTS/beginner/linux-cis-hardening-auditor/tests/test_baseline.sh
@@ -138,11 +138,11 @@ test_baseline_missing_file() {
     CURRENT_TEST="test_baseline_missing_file"
     setup_test "${PROJECT_DIR}/testdata/fixtures"
 
-    local result
-    result=$(load_baseline "/tmp/nonexistent_baseline_12345.json" 2>&1) || true
+    local result rc
+    result=$(load_baseline "/tmp/nonexistent_baseline_12345.json" 2>&1) && rc=0 || rc=$?
 
     ((TEST_TOTAL++)) || true
-    if [[ $? -eq 0 ]] || echo "$result" | grep -q "not found"; then
+    if (( rc == 0 )) || echo "$result" | grep -q "not found"; then
         ((TEST_PASS++)) || true
     else
         ((TEST_FAIL++)) || true
diff --git a/PROJECTS/beginner/network-traffic-analyzer/cpp/include/TUI/view.hpp b/PROJECTS/beginner/network-traffic-analyzer/cpp/include/TUI/view.hpp
index d631d89b..f9815f00 100644
--- a/PROJECTS/beginner/network-traffic-analyzer/cpp/include/TUI/view.hpp
+++ b/PROJECTS/beginner/network-traffic-analyzer/cpp/include/TUI/view.hpp
@@ -10,7 +10,7 @@ class View {
 
   private:
 	static ftxui::Element render_header(const StatsSnapshot &data, const std::string &interface,
-	                                    const std::string &filter);
+										const std::string &filter);
 	static ftxui::Element render_stats(const StatsSnapshot &data);
 
 	static ftxui::Element render_transport(const StatsSnapshot &data);
diff --git a/PROJECTS/beginner/network-traffic-analyzer/cpp/include/packet/IP.hpp b/PROJECTS/beginner/network-traffic-analyzer/cpp/include/packet/IP.hpp
index da3c4584..31e6b720 100644
--- a/PROJECTS/beginner/network-traffic-analyzer/cpp/include/packet/IP.hpp
+++ b/PROJECTS/beginner/network-traffic-analyzer/cpp/include/packet/IP.hpp
@@ -21,8 +21,8 @@ class IP_class {
 	std::string dst;
 
   public:
-	std::string get_source();
-	std::string get_dest();
+	const std::string &get_source() const;
+	const std::string &get_dest() const;
 	// getters
 	/*virtual std::string get_source() = 0;
 	virtual std::string get_dest() = 0;*/
diff --git a/PROJECTS/beginner/network-traffic-analyzer/cpp/main.cpp b/PROJECTS/beginner/network-traffic-analyzer/cpp/main.cpp
index e161f318..0aa37765 100644
--- a/PROJECTS/beginner/network-traffic-analyzer/cpp/main.cpp
+++ b/PROJECTS/beginner/network-traffic-analyzer/cpp/main.cpp
@@ -39,8 +39,8 @@ int main(int argc, char **argv) {
 	/* get a filter, use vector for multiple  */
 	std::vector<filter> filters;
 	if (parser.vm.contains("filter")) {
-		auto &f = parser.vm["filter"].as<std::vector<std::string>>();
-		for (auto &x : f) {
+		const auto &f = parser.vm["filter"].as<std::vector<std::string>>();
+		for (const auto &x : f) {
 			filters.push_back(parse(x));
 			filterString += x + " ";
 		}
@@ -82,13 +82,10 @@ int main(int argc, char **argv) {
 	/* our class for UI */
 	View view;
 	std::mutex render_mtx;
-	std::mutex event_mtx;
 	ftxui::Element current_render = isOffline
 										? view.render(stats.get_snapshot(), interface, filterString, true, timer.load())
 										: ftxui::text("Starting capture...");
 
-	std::mutex screen_mtx;
-
 	auto component = ftxui::Renderer([&] {
 		std::lock_guard<std::mutex> lock(render_mtx);
 		return current_render;
diff --git a/PROJECTS/beginner/network-traffic-analyzer/cpp/src/TUI/view.cpp b/PROJECTS/beginner/network-traffic-analyzer/cpp/src/TUI/view.cpp
index 5a2bf847..4e341a3c 100644
--- a/PROJECTS/beginner/network-traffic-analyzer/cpp/src/TUI/view.cpp
+++ b/PROJECTS/beginner/network-traffic-analyzer/cpp/src/TUI/view.cpp
@@ -161,7 +161,7 @@ ftxui::Element View::render_bandwidth(const StatsSnapshot &data) {
 
 			const double frac = idx_f - static_cast<double>(i0);
 			const double bw = data.bandwidth_history[i0].bytes_per_sec * (1.0 - frac) +
-			                  data.bandwidth_history[i1].bytes_per_sec * frac;
+							  data.bandwidth_history[i1].bytes_per_sec * frac;
 
 			const double v = bw / max_bw;
 			output[x] = static_cast<int>(v * static_cast<double>(height - 1));
diff --git a/PROJECTS/beginner/network-traffic-analyzer/cpp/src/capture/pcapCapture.cpp b/PROJECTS/beginner/network-traffic-analyzer/cpp/src/capture/pcapCapture.cpp
index 5432021d..cb4066a9 100644
--- a/PROJECTS/beginner/network-traffic-analyzer/cpp/src/capture/pcapCapture.cpp
+++ b/PROJECTS/beginner/network-traffic-analyzer/cpp/src/capture/pcapCapture.cpp
@@ -112,7 +112,7 @@ void PcapCapture::stop() {
 /* print all available interfaces */
 void PcapCapture::print_interfaces() {
 	int i = 0;
-	for (pcap_if_t *dev = interfaces; dev != nullptr; dev = dev->next) {
+	for (const pcap_if_t *dev = interfaces; dev != nullptr; dev = dev->next) {
 		printf("%d. %s  ", ++i, dev->name);
 		if (dev->description != nullptr) {
 			printf("(%s)\n", dev->description);
@@ -132,7 +132,7 @@ void PcapCapture::print_interfaces() {
  * @param packet Raw packet bytes
  */
 void PcapCapture::callback(u_char *user, const struct pcap_pkthdr *header, const u_char *packet) {
-	auto * const self = reinterpret_cast<PcapCapture *>(user);
+	auto *const self = reinterpret_cast<PcapCapture *>(user);
 	if (!self->isRunning()) {
 		return;
 	}
diff --git a/PROJECTS/beginner/network-traffic-analyzer/cpp/src/packet/IP.cpp b/PROJECTS/beginner/network-traffic-analyzer/cpp/src/packet/IP.cpp
index ae9e5b9f..6e0e1c13 100644
--- a/PROJECTS/beginner/network-traffic-analyzer/cpp/src/packet/IP.cpp
+++ b/PROJECTS/beginner/network-traffic-analyzer/cpp/src/packet/IP.cpp
@@ -11,13 +11,12 @@
 uint16_t IP_class::get_payload_len() const { return payload_len; }
 
 TransportProtocol IP_class::get_protocol() const { return protocol; }
-std::string IP_class::get_source() { return src; }
-std::string IP_class::get_dest() { return dst; }
+const std::string &IP_class::get_source() const { return src; }
+const std::string &IP_class::get_dest() const { return dst; }
 
 /*** Ipv4 ***/
 IPv4::IPv4(const u_char *data)
-    : ip_hdr(reinterpret_cast<const ip *>(data)),
-      ip_hdr_len(static_cast<int>(ip_hdr->ip_hl) * 4) {
+	: ip_hdr(reinterpret_cast<const ip *>(data)), ip_hdr_len(static_cast<int>(ip_hdr->ip_hl) * 4) {
 	std::array<char, INET_ADDRSTRLEN> src_buf{};
 	inet_ntop(AF_INET, &ip_hdr->ip_src, src_buf.data(), sizeof(src_buf));
 	src = src_buf.data();
@@ -84,8 +83,7 @@ uint16_t IPv4::get_dest_port() { return dest_port; }
 /*** Ipv6 ***/
 
 IPv6::IPv6(const u_char *data)
-    : ip_hdr(reinterpret_cast<const ip6_hdr *>(data)),
-      ptr(reinterpret_cast<const uint8_t *>(ip_hdr + 1)) {
+	: ip_hdr(reinterpret_cast<const ip6_hdr *>(data)), ptr(reinterpret_cast<const uint8_t *>(ip_hdr + 1)) {
 	uint8_t hdr = ip_hdr->ip6_nxt;
 	std::array<char, INET6_ADDRSTRLEN> src{};
 	inet_ntop(AF_INET6, &ip_hdr->ip6_src, src.data(), sizeof(src));
diff --git a/PROJECTS/beginner/network-traffic-analyzer/cpp/src/packet/packet.cpp b/PROJECTS/beginner/network-traffic-analyzer/cpp/src/packet/packet.cpp
index 90cd190b..ebf8ec15 100644
--- a/PROJECTS/beginner/network-traffic-analyzer/cpp/src/packet/packet.cpp
+++ b/PROJECTS/beginner/network-traffic-analyzer/cpp/src/packet/packet.cpp
@@ -15,7 +15,7 @@ ApplicationProtocol Packet::get_application_protocol() {
 			return ApplicationProtocol::DNS;
 		}
 
-		if (transport_protocol == TransportProtocol::TCP && payload_len >= 3) {
+		if (transport_protocol == TransportProtocol::TCP) {
 			if (payload_ptr[0] == 0x16 && payload_ptr[1] == 0x03) {
 				return ApplicationProtocol::HTTPS;
 			}
diff --git a/PROJECTS/beginner/network-traffic-analyzer/cpp/src/stats/protocolStats.cpp b/PROJECTS/beginner/network-traffic-analyzer/cpp/src/stats/protocolStats.cpp
index 74204e2e..19934838 100644
--- a/PROJECTS/beginner/network-traffic-analyzer/cpp/src/stats/protocolStats.cpp
+++ b/PROJECTS/beginner/network-traffic-analyzer/cpp/src/stats/protocolStats.cpp
@@ -2,7 +2,7 @@
 #include "ftxui/dom/table.hpp"
 #include <fstream>
 
-Stats::Stats() { last_tick = std::chrono::steady_clock::now(); }
+Stats::Stats() : last_tick(std::chrono::steady_clock::now()) {}
 /**
  * @brief Aggregates a newly captured packet.
  *
@@ -96,7 +96,7 @@ void Stats::update_transport_stats() {
 	snapshot.transport_rows.push_back({"Proto", "Packets", "Bytes", "%"});
 
 	std::vector<std::pair<TransportProtocol, protocolStats>> tps(transport_map.begin(), transport_map.end());
-	std::sort(tps.begin(), tps.end(), [](auto &a, auto &b) { return a.second.packets > b.second.packets; });
+	std::sort(tps.begin(), tps.end(), [](const auto &a, const auto &b) { return a.second.packets > b.second.packets; });
 
 	for (const auto &[proto, stats] : tps) {
 		double percent = snapshot.total_b ? stats.bytes * 100.0 / snapshot.total_b : 0.0;
@@ -116,7 +116,8 @@ void Stats::update_application_stats() {
 	std::lock_guard<std::mutex> lock(mtx);
 	std::vector<std::pair<ApplicationProtocol, protocolStats>> apps(application_map.begin(), application_map.end());
 
-	std::sort(apps.begin(), apps.end(), [](auto &a, auto &b) { return a.second.packets > b.second.packets; });
+	std::sort(apps.begin(), apps.end(),
+			  [](const auto &a, const auto &b) { return a.second.packets > b.second.packets; });
 
 	snapshot.app_rows.clear();
 	snapshot.app_rows.push_back({"Proto", "Packets", "Bytes (MB)", "%"});
@@ -144,7 +145,8 @@ void Stats::update_ip_stats(size_t limit) {
 	snapshot.rows.push_back({"IP Address", "Packets TX", "Packets RX"});
 	std::vector<std::pair<std::string, IPStats>> ips(ip_map.begin(), ip_map.end());
 
-	std::sort(ips.begin(), ips.end(), [](auto &a, auto &b) { return a.second.packets_sent > b.second.packets_sent; });
+	std::sort(ips.begin(), ips.end(),
+			  [](const auto &a, const auto &b) { return a.second.packets_sent > b.second.packets_sent; });
 
 	size_t count = 0;
 	for (const auto &[ip, s] : ips) {
@@ -166,7 +168,7 @@ void Stats::update_ip_stats(size_t limit) {
 void Stats::update_pairs(size_t limit) {
 	std::lock_guard<std::mutex> lock(mtx);
 	std::vector<std::pair<std::pair<std::string, std::string>, protocolStats>> vec(pairs.begin(), pairs.end());
-	std::sort(vec.begin(), vec.end(), [](auto &a, auto &b) { return a.second.bytes > b.second.bytes; });
+	std::sort(vec.begin(), vec.end(), [](const auto &a, const auto &b) { return a.second.bytes > b.second.bytes; });
 
 	snapshot.pairs_rows.clear();
 	snapshot.pairs_rows.push_back({"Source", "Destination", "bytes received", "%"});
diff --git a/PROJECTS/beginner/simple-port-scanner/main.cpp b/PROJECTS/beginner/simple-port-scanner/main.cpp
index 47f146ff..0f74b276 100644
--- a/PROJECTS/beginner/simple-port-scanner/main.cpp
+++ b/PROJECTS/beginner/simple-port-scanner/main.cpp
@@ -4,41 +4,42 @@ namespace po = boost::program_options;
 
 int main(int argc, char* argv[]) {
 
-	po::options_description desc("Allowed options");
-	desc.add_options()
-		("help,h", "produce help message")
-		("dname,i", po::value<std::string>()->default_value("127.0.0.1"), "set domain name or IP address")
-		("ports,p", po::value<std::string>()->default_value("1-1024"), "set a port range from 1 to n")
-		("threads,t", po::value<int>()->default_value(100), "max concurrent threads")
-		("expiry_time,e", po::value<uint8_t>()->default_value(2)->value_name("sec"), "timeout in seconds")
-		("verbose,v", "verbose output");
+    po::options_description desc("Allowed options");
+    desc.add_options()("help,h", "produce help message")(
+        "dname,i", po::value<std::string>()->default_value("127.0.0.1"),
+        "set domain name or IP address")("ports,p",
+                                         po::value<std::string>()->default_value("1-1024"),
+                                         "set a port range from 1 to n")(
+        "threads,t", po::value<int>()->default_value(100), "max concurrent threads")(
+        "expiry_time,e", po::value<uint8_t>()->default_value(2)->value_name("sec"),
+        "timeout in seconds")("verbose,v", "verbose output");
 
-	po::variables_map vm;
-	po::store(po::parse_command_line(argc, argv, desc), vm);
-	po::notify(vm);
+    po::variables_map vm;
+    po::store(po::parse_command_line(argc, argv, desc), vm);
+    po::notify(vm);
 
-	if (vm.count("help")) {
-		std::cout << desc << "\n";
-		std::cout << "Examples:\n"
-			  << "  Scan common ports on localhost:\n"
-			  << "    ./port_scanner -i 127.0.0.1 -p 1-1024\n\n"
-			  << "  Full TCP port scan:\n"
-			  << "    ./port_scanner -i 192.168.1.1 -p 65535 -t 200\n\n"
-			  << "  Scan with custom timeout:\n"
-			  << "    ./port_scanner -i example.com -p 80-443 -e 5\n\n"
-			  << "  Postscriptum:\n"
-			  << "  Scan only systems you own or have explicit permission to test.\n";
-		return 0;
-	}
-	std::string ip = vm["dname"].as<std::string>();
-	std::string port = vm["ports"].as<std::string>();
-	int threads = vm["threads"].as<int>();
-	uint8_t expiry_time = vm["expiry_time"].as<uint8_t>();
+    if (vm.count("help")) {
+        std::cout << desc << "\n";
+        std::cout << "Examples:\n"
+                  << "  Scan common ports on localhost:\n"
+                  << "    ./port_scanner -i 127.0.0.1 -p 1-1024\n\n"
+                  << "  Full TCP port scan:\n"
+                  << "    ./port_scanner -i 192.168.1.1 -p 65535 -t 200\n\n"
+                  << "  Scan with custom timeout:\n"
+                  << "    ./port_scanner -i example.com -p 80-443 -e 5\n\n"
+                  << "  Postscriptum:\n"
+                  << "  Scan only systems you own or have explicit permission to test.\n";
+        return 0;
+    }
+    std::string ip = vm["dname"].as<std::string>();
+    std::string port = vm["ports"].as<std::string>();
+    int threads = vm["threads"].as<int>();
+    uint8_t expiry_time = vm["expiry_time"].as<uint8_t>();
 
-	PortScanner scanner;
-	scanner.set_options(ip, port, threads, expiry_time);
-	scanner.start();
-	scanner.run();
+    PortScanner scanner;
+    scanner.set_options(ip, port, threads, expiry_time);
+    scanner.start();
+    scanner.run();
 
-	return 0;
+    return 0;
 }
diff --git a/PROJECTS/beginner/simple-port-scanner/src/PortScanner.cpp b/PROJECTS/beginner/simple-port-scanner/src/PortScanner.cpp
index b7c8f429..baff0f86 100644
--- a/PROJECTS/beginner/simple-port-scanner/src/PortScanner.cpp
+++ b/PROJECTS/beginner/simple-port-scanner/src/PortScanner.cpp
@@ -1,193 +1,174 @@
 #include "PortScanner.hpp"
 
 const std::unordered_map<uint16_t, std::string> PortScanner::basicPorts{
-	{21, "FTP"},
-	{22, "SSH"},
-	{23, "TelNet"},
-	{25, "SMTP"},
-	{53, "DNS"},
-	{67, "DHCP server"},
-	{68, "DHCP client"},
-	{80, "HTTP"},
-	{110, "POP3"},
-	{143, "IMAP"},
-	{161, "SNMP"},
-	{443, "HTTPS"},
-	{445, "SMB"},
-	{465, "SMTPS"},
-	{993, "IMAPS"},
-	{1080, "SOCKS"},
-	{1521, "ORACLE DB"},
-	{3306, "MySQL"},
-	{3389, "RDP"},
-	{5432, "PostgreSQL"},
-	{6379, "Redis"},
+    {21, "FTP"},         {22, "SSH"},         {23, "TelNet"},  {25, "SMTP"},   {53, "DNS"},
+    {67, "DHCP server"}, {68, "DHCP client"}, {80, "HTTP"},    {110, "POP3"},  {143, "IMAP"},
+    {161, "SNMP"},       {443, "HTTPS"},      {445, "SMB"},    {465, "SMTPS"}, {993, "IMAPS"},
+    {1080, "SOCKS"},     {1521, "ORACLE DB"}, {3306, "MySQL"}, {3389, "RDP"},  {5432, "PostgreSQL"},
+    {6379, "Redis"},
 };
 
 void PortScanner::parse_port(std::string& port) {
-	auto t = std::find(port.begin(), port.end(), '-');
-	if (t == port.end()) {
-		startPort = 1;
-		endPort = std::stoi(port);
-		return;
-	}
-	auto it = port.begin();
-	std::string s = "", e = "";
-	while (it != port.end()) {
-		if (*it == '-') {
-			break;
-		}
-		s += *it;
-		++it;
-	}
-	++it;
-	while (it != port.end()) {
-		e += *it;
-		++it;
-	}
+    auto t = std::find(port.begin(), port.end(), '-');
+    if (t == port.end()) {
+        startPort = 1;
+        endPort = std::stoi(port);
+        return;
+    }
+    auto it = port.begin();
+    std::string s = "", e = "";
+    while (it != port.end()) {
+        if (*it == '-') {
+            break;
+        }
+        s += *it;
+        ++it;
+    }
+    ++it;
+    while (it != port.end()) {
+        e += *it;
+        ++it;
+    }
 
-	int start = std::stoi(s);
-	int end = std::stoi(e);
-	//check a valid bounds
-	if (start == 0 || end > MAX_PORT || start > end) {
-		startPort = 1;
-		endPort = MAX_PORT;
-	}
-	else {
-		startPort = static_cast<uint16_t>(start);
-		endPort = static_cast<uint16_t>(end);
-	}
+    int start_port = std::stoi(s);
+    int end_port = std::stoi(e);
+    if (start_port == 0 || end_port > MAX_PORT || start_port > end_port) {
+        startPort = 1;
+        endPort = MAX_PORT;
+    } else {
+        startPort = static_cast<uint16_t>(start_port);
+        endPort = static_cast<uint16_t>(end_port);
+    }
 }
-PortScanner::PortScanner(std::string& domainName, std::string& port, int max_threads, std::uint8_t expiry_time) {
-	this->domainName = std::move(domainName);
-	this->MAX_THREADS = max_threads;
-	this->expiry_time = expiry_time;
+PortScanner::PortScanner(std::string& domainName, std::string& port, int max_threads,
+                         std::uint8_t expiry_time) {
+    this->domainName = std::move(domainName);
+    this->MAX_THREADS = max_threads;
+    this->expiry_time = expiry_time;
 
-	parse_port(port);
-	auto result = resolver.resolve(this->domainName, "");
-	endpoint = *result.begin();
-
-	setup_queue();
+    parse_port(port);
+    auto result = resolver.resolve(this->domainName, "");
+    endpoint = *result.begin();
 
+    setup_queue();
 }
 
 void PortScanner::setup_queue() {
-	q = std::queue<uint16_t>();
-	for (int i = startPort; i <= endPort; i++) {
-		q.push(i);
-	}
+    q = std::queue<uint16_t>();
+    for (int i = startPort; i <= endPort; i++) {
+        q.push(i);
+    }
 }
 
+void PortScanner::set_options(std::string& domainName, std::string& port, int max_threads,
+                              std::uint8_t expiry_time) {
+    this->domainName = std::move(domainName);
+    this->MAX_THREADS = max_threads;
+    this->expiry_time = expiry_time;
+    parse_port(port);
 
-void PortScanner::set_options(std::string& domainName, std::string& port, int max_threads, std::uint8_t expiry_time) {
-	this->domainName = std::move(domainName);
-	this->MAX_THREADS = max_threads;
-	this->expiry_time = expiry_time;
-	parse_port(port);
-
-
-	auto result = resolver.resolve(this->domainName, "");
-	endpoint = *result.begin();
-
-
+    auto result = resolver.resolve(this->domainName, "");
+    endpoint = *result.begin();
 }
 
 void PortScanner::set_max_port(std::uint16_t port) {
-	endPort = port;
+    endPort = port;
 }
 void PortScanner::set_max_threads(int value) {
-	MAX_THREADS = value;
+    MAX_THREADS = value;
 }
 
 void PortScanner::set_ip_address(std::string ip) {
-	domainName = std::move(ip);
-
+    domainName = std::move(ip);
 }
 
 void PortScanner::set_expiry_time(std::uint8_t value) {
-	expiry_time = value;
+    expiry_time = value;
 }
 
 void PortScanner::start() {
-	setup_queue();
-	for (int i = 0; i < MAX_THREADS; i++) {
-		boost::asio::post(strand, [this]() {
-			scan();
-		});
-
-	}
+    setup_queue();
+    for (int i = 0; i < MAX_THREADS; i++) {
+        boost::asio::post(strand, [this]() { scan(); });
+    }
 }
 
 void PortScanner::run() {
-	printf("PORT\tSTATE\tSERVICE\tBANNER\n");
-	io.run();
-	printf("\nResult:\n");
-	printf("  Open ports: %d\n", open_ports);
-	printf("  Closed ports: %d\n", closed_ports);
-	printf("  Filtered ports: %d\n", filtered_ports);
+    printf("PORT\tSTATE\tSERVICE\tBANNER\n");
+    io.run();
+    printf("\nResult:\n");
+    printf("  Open ports: %d\n", open_ports);
+    printf("  Closed ports: %d\n", closed_ports);
+    printf("  Filtered ports: %d\n", filtered_ports);
 }
 
 void PortScanner::scan() {
-	if (q.empty() || cnt >= MAX_THREADS) return;
+    if (q.empty() || cnt >= MAX_THREADS)
+        return;
 
-	uint16_t port = q.front();
-	q.pop();
-	++cnt;
+    uint16_t port = q.front();
+    q.pop();
+    ++cnt;
 
-	auto socket = std::make_shared<tcp::socket>(io);
-	auto timer = std::make_shared<boost::asio::steady_timer>(io);
-	auto complete = std::make_shared<bool>(false);
+    auto socket = std::make_shared<tcp::socket>(io);
+    auto timer = std::make_shared<boost::asio::steady_timer>(io);
+    auto complete = std::make_shared<bool>(false);
 
-	tcp::endpoint endpoint(this->endpoint.address(), port);
+    tcp::endpoint target_endpoint(this->endpoint.address(), port);
 
-	timer->expires_after(std::chrono::seconds(expiry_time));
+    timer->expires_after(std::chrono::seconds(expiry_time));
 
-	timer->async_wait(boost::asio::bind_executor(strand, [this, complete, socket, port](boost::system::error_code ec) {
-		if (!ec && !*complete)  {
-			*complete = true;
-			socket->close();
-			printf("%i\t%s\t%s\t%s\n", port, "FILTERED", "NULL", "NULL");
-			++filtered_ports;
-			--cnt;
-			scan();
-		}
+    timer->async_wait(boost::asio::bind_executor(
+        strand, [this, complete, socket, port](boost::system::error_code ec) {
+            if (!ec && !*complete) {
+                *complete = true;
+                socket->close();
+                printf("%i\t%s\t%s\t%s\n", port, "FILTERED", "NULL", "NULL");
+                ++filtered_ports;
+                --cnt;
+                scan();
+            }
+        }));
 
-	}));
+    socket->async_connect(target_endpoint,
+                          boost::asio::bind_executor(strand, [this, socket, timer, port, complete](
+                                                                 boost::system::error_code ec) {
+                              if (*complete)
+                                  return;
+                              *complete = true;
+                              timer->cancel();
 
-	socket->async_connect(endpoint, boost::asio::bind_executor(strand, [this,socket, timer, port, complete](boost::system::error_code ec) {
-		if (*complete) return;
-		*complete = true;
-		timer->cancel();
+                              std::string service = "---";
+                              auto banner = std::make_shared<std::string>("---");
+                              auto it = basicPorts.find(port);
+                              if (it != basicPorts.end()) {
+                                  service = it->second;
+                              }
 
-		std::string service = "---";
-		auto banner = std::make_shared<std::string>("---");
-		auto it = basicPorts.find(port);
-		if (it != basicPorts.end()) {
-			service = it->second;
-		}
+                              if (!ec) {
+                                  auto buf = std::make_shared<std::array<char, 128>>();
 
-		if (!ec) {
-			auto buf = std::make_shared<std::array<char, 128>>();
-
-			socket->async_read_some(boost::asio::buffer(*buf),boost::asio::bind_executor(strand,
-			[this, port, buf, banner, service](boost::system::error_code ec, std::size_t n) {
-				if (!ec && n > 0) {
-					banner->assign(buf->data(), n);
-				}
-				printf("%i\t%sOPEN%s\t%s\t%s\n", port, GREEN,RESET, service.c_str(), banner->c_str());
-				++open_ports;
-				--cnt;
-				scan();
-			}));
-
-		}
-		else{
-			printf("%i\t%sCLOSED%s\t%s\t%s\n", port, RED, RESET, service.c_str(), banner->c_str());
-			++closed_ports;
-			--cnt;
-			scan();
-		}
-
-	}));
+                                  socket->async_read_some(
+                                      boost::asio::buffer(*buf),
+                                      boost::asio::bind_executor(
+                                          strand, [this, port, buf, banner, service](
+                                                      boost::system::error_code ec, std::size_t n) {
+                                              if (!ec && n > 0) {
+                                                  banner->assign(buf->data(), n);
+                                              }
+                                              printf("%i\t%sOPEN%s\t%s\t%s\n", port, GREEN, RESET,
+                                                     service.c_str(), banner->c_str());
+                                              ++open_ports;
+                                              --cnt;
+                                              scan();
+                                          }));
 
+                              } else {
+                                  printf("%i\t%sCLOSED%s\t%s\t%s\n", port, RED, RESET,
+                                         service.c_str(), banner->c_str());
+                                  ++closed_ports;
+                                  --cnt;
+                                  scan();
+                              }
+                          }));
 }
diff --git a/PROJECTS/beginner/simple-port-scanner/src/PortScanner.hpp b/PROJECTS/beginner/simple-port-scanner/src/PortScanner.hpp
index 6f81b4f3..a28147e2 100644
--- a/PROJECTS/beginner/simple-port-scanner/src/PortScanner.hpp
+++ b/PROJECTS/beginner/simple-port-scanner/src/PortScanner.hpp
@@ -1,58 +1,61 @@
 #ifndef PORTSCANNER_HPP
 #define PORTSCANNER_HPP
-#include <boost/asio.hpp>
-#include <string>
-#include <queue>
-#include <unordered_map>
-#include <iostream>
 #include <array>
-#include <memory>
+#include <boost/asio.hpp>
 #include <cstdint>
+#include <iostream>
+#include <memory>
+#include <queue>
 #include <stdio.h>
+#include <string>
+#include <unordered_map>
 
-#define RED   "\033[31m"
+#define RED "\033[31m"
 #define GREEN "\033[32m"
 #define RESET "\033[0m"
 using boost::asio::ip::tcp;
 class PortScanner {
 private:
-	static const std::unordered_map<uint16_t, std::string> basicPorts;
-	static const uint16_t MAX_PORT = 65535;
-	boost::asio::io_context io;
-	boost::asio::ip::tcp::resolver resolver{io};
-	boost::asio::ip::tcp::endpoint endpoint;
-	boost::asio::strand<boost::asio::io_context::executor_type> strand{io.get_executor()};
-	std::queue<std::uint16_t> q;
-	int cnt = 0;
-	int MAX_THREADS = 0;
-	int open_ports = 0;
-	int closed_ports = 0;
-	int filtered_ports = 0;
+    static const std::unordered_map<uint16_t, std::string> basicPorts;
+    static const uint16_t MAX_PORT = 65535;
+    boost::asio::io_context io;
+    boost::asio::ip::tcp::resolver resolver{io};
+    boost::asio::ip::tcp::endpoint endpoint;
+    boost::asio::strand<boost::asio::io_context::executor_type> strand{io.get_executor()};
+    std::queue<std::uint16_t> q;
+    int cnt = 0;
+    int MAX_THREADS = 0;
+    int open_ports = 0;
+    int closed_ports = 0;
+    int filtered_ports = 0;
 
-	std::string domainName;
-	std::uint16_t startPort = 1;
-	std::uint16_t endPort = MAX_PORT;
+    std::string domainName;
+    std::uint16_t startPort = 1;
+    std::uint16_t endPort = MAX_PORT;
 
-	std::uint8_t expiry_time;
+    std::uint8_t expiry_time;
+
+    void scan();
+    void setup_queue();
+    void parse_port(std::string& port);
 
-	void scan();
-	void setup_queue();
-	void parse_port(std::string& port);
 public:
-	PortScanner(std::string& ip_address, std::string& port, int max_threads, std::uint8_t expiry_time);
-	PortScanner(){}
-	~PortScanner() {
+    PortScanner(std::string& ip_address, std::string& port, int max_threads,
+                std::uint8_t expiry_time);
+    PortScanner() {
+    }
+    ~PortScanner() {
+    }
 
-	}
+    void set_options(std::string& domainName, std::string& port, int max_threads,
+                     std::uint8_t expiry_time);
+    void set_max_port(std::uint16_t port);
+    void set_max_threads(int value);
+    void set_ip_address(std::string ip);
+    void set_expiry_time(std::uint8_t value);
 
-	void set_options(std::string& domainName, std::string& port, int max_threads, std::uint8_t expiry_time);
-	void set_max_port(std::uint16_t port);
-	void set_max_threads(int value);
-	void set_ip_address(std::string ip);
-	void set_expiry_time(std::uint8_t value);
-
-	void start();
-	void run();
+    void start();
+    void run();
 };
 
-#endif //PORTSCANNER_HPP
+#endif // PORTSCANNER_HPP
diff --git a/PROJECTS/foundations/hash-identifier/hash_identifier.py b/PROJECTS/foundations/hash-identifier/hash_identifier.py
index b76547d6..959cbd00 100644
--- a/PROJECTS/foundations/hash-identifier/hash_identifier.py
+++ b/PROJECTS/foundations/hash-identifier/hash_identifier.py
@@ -80,8 +80,8 @@ from rich.table import Table
 # =============================================================================
 # Literal["high", "medium", "low"] is a type hint that says "this string
 # can ONLY be one of these three values." Mypy will catch typos like
-# "hgih" at edit time. We chose Literal over an Enum because Carter's
-# style guide prefers Literals for small fixed sets
+# "hgih" at edit time. We chose Literal over an Enum because I
+# prefer Literals for small fixed sets
 
 Confidence = Literal["high", "medium", "low"]
 
diff --git a/PROJECTS/foundations/http-headers-scanner/uv.lock b/PROJECTS/foundations/http-headers-scanner/uv.lock
index ab6394fd..27fbc8d3 100644
--- a/PROJECTS/foundations/http-headers-scanner/uv.lock
+++ b/PROJECTS/foundations/http-headers-scanner/uv.lock
@@ -163,11 +163,11 @@ wheels = [
 
 [[package]]
 name = "idna"
-version = "3.13"
+version = "3.15"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/ce/cc/762dfb036166873f0059f3b7de4565e1b5bc3d6f28a414c13da27e442f99/idna-3.13.tar.gz", hash = "sha256:585ea8fe5d69b9181ec1afba340451fba6ba764af97026f92a91d4eef164a242", size = 194210, upload-time = "2026-04-22T16:42:42.314Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/82/77/7b3966d0b9d1d31a36ddf1746926a11dface89a83409bf1483f0237aa758/idna-3.15.tar.gz", hash = "sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc", size = 199245, upload-time = "2026-05-12T22:45:57.011Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/5d/13/ad7d7ca3808a898b4612b6fe93cde56b53f3034dcde235acb1f0e1df24c6/idna-3.13-py3-none-any.whl", hash = "sha256:892ea0cde124a99ce773decba204c5552b69c3c67ffd5f232eb7696135bc8bb3", size = 68629, upload-time = "2026-04-22T16:42:40.909Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/23/408243171aa9aaba178d3e2559159c24c1171a641aa83b67bdd3394ead8e/idna-3.15-py3-none-any.whl", hash = "sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8", size = 72340, upload-time = "2026-05-12T22:45:55.733Z" },
 ]
 
 [[package]]
diff --git a/PROJECTS/intermediate/api-security-scanner/README.md b/PROJECTS/intermediate/api-security-scanner/README.md
index d7851be3..5570b7ac 100644
--- a/PROJECTS/intermediate/api-security-scanner/README.md
+++ b/PROJECTS/intermediate/api-security-scanner/README.md
@@ -16,7 +16,19 @@
 
 > Full-stack API vulnerability scanner targeting the OWASP API Security Top 10 with configurable scan modules and a React dashboard.
 
-*This is a quick overview — security theory, architecture, and full walkthroughs are in the [learn modules](#learn).*
+<p align="center">
+  <a href="https://youtu.be/CvuvFfh24cE">
+    <img src="https://img.shields.io/badge/Watch_on-YouTube-FF0000?logo=youtube&logoColor=white" alt="Watch on YouTube">
+  </a>
+</p>
+
+<p align="center">
+  <a href="https://youtu.be/CvuvFfh24cE">
+    <img src="https://img.youtube.com/vi/CvuvFfh24cE/maxresdefault.jpg" alt="Video Thumbnail" width="800">
+  </a>
+</p>
+
+*Learn docs here: [learn modules](#learn).*
 
 ## What It Does
 
diff --git a/PROJECTS/intermediate/api-security-scanner/backend/pyproject.toml b/PROJECTS/intermediate/api-security-scanner/backend/pyproject.toml
index 10ad69fd..638a70ab 100644
--- a/PROJECTS/intermediate/api-security-scanner/backend/pyproject.toml
+++ b/PROJECTS/intermediate/api-security-scanner/backend/pyproject.toml
@@ -24,7 +24,7 @@ dependencies = [
     # HTTP client for scanners
     "requests==2.32.5",
     "httpx==0.28.1",
-    "aiohttp==3.13.4",
+    "aiohttp==3.14.0",
     # Settings management
     "pydantic==2.12.5",
     "pydantic-settings==2.12.0",
diff --git a/PROJECTS/intermediate/api-security-scanner/frontend/package.json b/PROJECTS/intermediate/api-security-scanner/frontend/package.json
index a77dad03..ec1da29d 100644
--- a/PROJECTS/intermediate/api-security-scanner/frontend/package.json
+++ b/PROJECTS/intermediate/api-security-scanner/frontend/package.json
@@ -27,7 +27,7 @@
     "@radix-ui/react-tooltip": "^1.2.8",
     "@tanstack/react-query": "^5.90.21",
     "@tanstack/react-query-devtools": "^5.91.3",
-    "axios": "^1.15.2",
+    "axios": "^1.16.0",
     "clsx": "^2.1.1",
     "date-fns": "^4.1.0",
     "immer": "^11.1.4",
@@ -65,5 +65,23 @@
     "typescript-eslint": "^8.56.0",
     "vite": "^7.3.2",
     "vite-tsconfig-paths": "^6.1.1"
+  },
+  "pnpm": {
+    "overrides": {
+      "ajv@<6.14.0": ">=6.14.0",
+      "brace-expansion@<1.1.13": ">=1.1.13",
+      "brace-expansion@>=2.0.0 <2.0.3": ">=2.0.3",
+      "fast-uri@<=3.1.0": ">=3.1.1",
+      "fast-uri@<=3.1.1": ">=3.1.2",
+      "flatted@<3.4.0": ">=3.4.0",
+      "flatted@<=3.4.1": ">=3.4.2",
+      "minimatch@<3.1.3": ">=3.1.3",
+      "minimatch@<3.1.4": ">=3.1.4",
+      "minimatch@>=9.0.0 <9.0.6": ">=9.0.6",
+      "minimatch@>=9.0.0 <9.0.7": ">=9.0.7",
+      "postcss@<8.5.10": ">=8.5.10",
+      "socket.io-parser@>=4.0.0 <4.2.6": ">=4.2.6",
+      "ws@>=8.0.0 <8.20.1": ">=8.20.1"
+    }
   }
 }
diff --git a/PROJECTS/intermediate/api-security-scanner/frontend/pnpm-lock.yaml b/PROJECTS/intermediate/api-security-scanner/frontend/pnpm-lock.yaml
index 642b4f34..84ac2a8e 100644
--- a/PROJECTS/intermediate/api-security-scanner/frontend/pnpm-lock.yaml
+++ b/PROJECTS/intermediate/api-security-scanner/frontend/pnpm-lock.yaml
@@ -4,6 +4,22 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
+overrides:
+  ajv@<6.14.0: '>=6.14.0'
+  brace-expansion@<1.1.13: '>=1.1.13'
+  brace-expansion@>=2.0.0 <2.0.3: '>=2.0.3'
+  fast-uri@<=3.1.0: '>=3.1.1'
+  fast-uri@<=3.1.1: '>=3.1.2'
+  flatted@<3.4.0: '>=3.4.0'
+  flatted@<=3.4.1: '>=3.4.2'
+  minimatch@<3.1.3: '>=3.1.3'
+  minimatch@<3.1.4: '>=3.1.4'
+  minimatch@>=9.0.0 <9.0.6: '>=9.0.6'
+  minimatch@>=9.0.0 <9.0.7: '>=9.0.7'
+  postcss@<8.5.10: '>=8.5.10'
+  socket.io-parser@>=4.0.0 <4.2.6: '>=4.2.6'
+  ws@>=8.0.0 <8.20.1: '>=8.20.1'
+
 importers:
 
   .:
@@ -36,8 +52,8 @@ importers:
         specifier: ^5.91.3
         version: 5.91.3(@tanstack/react-query@5.90.21(react@19.2.4))(react@19.2.4)
       axios:
-        specifier: ^1.15.2
-        version: 1.15.2
+        specifier: ^1.16.0
+        version: 1.16.0
       clsx:
         specifier: ^2.1.1
         version: 2.1.1
@@ -131,7 +147,7 @@ importers:
         version: 1.0.0(stylelint@17.3.0(typescript@5.9.3))
       stylelint-config-standard-scss:
         specifier: ^17.0.0
-        version: 17.0.0(postcss@8.5.9)(stylelint@17.3.0(typescript@5.9.3))
+        version: 17.0.0(postcss@8.5.14)(stylelint@17.3.0(typescript@5.9.3))
       typescript:
         specifier: ~5.9.3
         version: 5.9.3
@@ -252,24 +268,28 @@ packages:
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@biomejs/cli-linux-arm64@2.4.2':
     resolution: {integrity: sha512-DI3Mi7GT2zYNgUTDEbSjl3e1KhoP76OjQdm8JpvZYZWtVDRyLd3w8llSr2TWk1z+U3P44kUBWY3X7H9MD1/DGQ==}
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@biomejs/cli-linux-x64-musl@2.4.2':
     resolution: {integrity: sha512-wbBmTkeAoAYbOQ33f6sfKG7pcRSydQiF+dTYOBjJsnXO2mWEOQHllKlC2YVnedqZFERp2WZhFUoO7TNRwnwEHQ==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@biomejs/cli-linux-x64@2.4.2':
     resolution: {integrity: sha512-GK2ErnrKpWFigYP68cXiCHK4RTL4IUWhK92AFS3U28X/nuAL5+hTuy6hyobc8JZRSt+upXt1nXChK+tuHHx4mA==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@biomejs/cli-win32-arm64@2.4.2':
     resolution: {integrity: sha512-k2uqwLYrNNxnaoiW3RJxoMGnbKda8FuCmtYG3cOtVljs3CzWxaTR+AoXwKGHscC9thax9R4kOrtWqWN0+KdPTw==}
@@ -987,66 +1007,79 @@ packages:
     resolution: {integrity: sha512-L+34Qqil+v5uC0zEubW7uByo78WOCIrBvci69E7sFASRl0X7b/MB6Cqd1lky/CtcSVTydWa2WZwFuWexjS5o6g==}
     cpu: [arm]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-arm-musleabihf@4.60.1':
     resolution: {integrity: sha512-n83O8rt4v34hgFzlkb1ycniJh7IR5RCIqt6mz1VRJD6pmhRi0CXdmfnLu9dIUS6buzh60IvACM842Ffb3xd6Gg==}
     cpu: [arm]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-arm64-gnu@4.60.1':
     resolution: {integrity: sha512-Nql7sTeAzhTAja3QXeAI48+/+GjBJ+QmAH13snn0AJSNL50JsDqotyudHyMbO2RbJkskbMbFJfIJKWA6R1LCJQ==}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-arm64-musl@4.60.1':
     resolution: {integrity: sha512-+pUymDhd0ys9GcKZPPWlFiZ67sTWV5UU6zOJat02M1+PiuSGDziyRuI/pPue3hoUwm2uGfxdL+trT6Z9rxnlMA==}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-loong64-gnu@4.60.1':
     resolution: {integrity: sha512-VSvgvQeIcsEvY4bKDHEDWcpW4Yw7BtlKG1GUT4FzBUlEKQK0rWHYBqQt6Fm2taXS+1bXvJT6kICu5ZwqKCnvlQ==}
     cpu: [loong64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-loong64-musl@4.60.1':
     resolution: {integrity: sha512-4LqhUomJqwe641gsPp6xLfhqWMbQV04KtPp7/dIp0nzPxAkNY1AbwL5W0MQpcalLYk07vaW9Kp1PBhdpZYYcEw==}
     cpu: [loong64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-ppc64-gnu@4.60.1':
     resolution: {integrity: sha512-tLQQ9aPvkBxOc/EUT6j3pyeMD6Hb8QF2BTBnCQWP/uu1lhc9AIrIjKnLYMEroIz/JvtGYgI9dF3AxHZNaEH0rw==}
     cpu: [ppc64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-ppc64-musl@4.60.1':
     resolution: {integrity: sha512-RMxFhJwc9fSXP6PqmAz4cbv3kAyvD1etJFjTx4ONqFP9DkTkXsAMU4v3Vyc5BgzC+anz7nS/9tp4obsKfqkDHg==}
     cpu: [ppc64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-riscv64-gnu@4.60.1':
     resolution: {integrity: sha512-QKgFl+Yc1eEk6MmOBfRHYF6lTxiiiV3/z/BRrbSiW2I7AFTXoBFvdMEyglohPj//2mZS4hDOqeB0H1ACh3sBbg==}
     cpu: [riscv64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-riscv64-musl@4.60.1':
     resolution: {integrity: sha512-RAjXjP/8c6ZtzatZcA1RaQr6O1TRhzC+adn8YZDnChliZHviqIjmvFwHcxi4JKPSDAt6Uhf/7vqcBzQJy0PDJg==}
     cpu: [riscv64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-s390x-gnu@4.60.1':
     resolution: {integrity: sha512-wcuocpaOlaL1COBYiA89O6yfjlp3RwKDeTIA0hM7OpmhR1Bjo9j31G1uQVpDlTvwxGn2nQs65fBFL5UFd76FcQ==}
     cpu: [s390x]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-x64-gnu@4.60.1':
     resolution: {integrity: sha512-77PpsFQUCOiZR9+LQEFg9GClyfkNXj1MP6wRnzYs0EeWbPcHs02AXu4xuUbM1zhwn3wqaizle3AEYg5aeoohhg==}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-x64-musl@4.60.1':
     resolution: {integrity: sha512-5cIATbk5vynAjqqmyBjlciMJl1+R/CwX9oLk/EyiFXDWd95KpHdrOJT//rnUl4cUcskrd0jCCw3wpZnhIHdD9w==}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-openbsd-x64@4.60.1':
     resolution: {integrity: sha512-cl0w09WsCi17mcmWqqglez9Gk8isgeWvoUZ3WiJFYSR3zjBQc2J5/ihSjpl+VLjPqjQ/1hJRcqBfLjssREQILw==}
@@ -1264,9 +1297,6 @@ packages:
     engines: {node: '>=0.4.0'}
     hasBin: true
 
-  ajv@6.12.6:
-    resolution: {integrity: sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==}
-
   ajv@8.18.0:
     resolution: {integrity: sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==}
 
@@ -1343,8 +1373,8 @@ packages:
     resolution: {integrity: sha512-BASOg+YwO2C+346x3LZOeoovTIoTrRqEsqMa6fmfAV0P+U9mFr9NsyOEpiYvFjbc64NMrSswhV50WdXzdb/Z5A==}
     engines: {node: '>=4'}
 
-  axios@1.15.2:
-    resolution: {integrity: sha512-wLrXxPtcrPTsNlJmKjkPnNPK2Ihe0hn0wGSaTEiHRPxwjvJwT3hKmXF4dpqxmPO9SoNb2FsYXj/xEo0gHN+D5A==}
+  axios@1.16.0:
+    resolution: {integrity: sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==}
 
   axobject-query@4.1.0:
     resolution: {integrity: sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==}
@@ -1353,22 +1383,21 @@ packages:
   bail@2.0.2:
     resolution: {integrity: sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==}
 
-  balanced-match@1.0.2:
-    resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
-
   balanced-match@3.0.1:
     resolution: {integrity: sha512-vjtV3hiLqYDNRoiAv0zC4QaGAMPomEoq83PRmYIofPswwZurCeWR5LByXm7SyoL0Zh5+2z0+HC7jG8gSZJUh0w==}
     engines: {node: '>= 16'}
 
+  balanced-match@4.0.4:
+    resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==}
+    engines: {node: 18 || 20 || >=22}
+
   baseline-browser-mapping@2.9.19:
     resolution: {integrity: sha512-ipDqC8FrAl/76p2SSWKSI+H9tFwm7vYqXQrItCuiVPt26Km0jS+NzSsBWAaBusvSbQcfJG+JitdMm+wZAgTYqg==}
     hasBin: true
 
-  brace-expansion@1.1.12:
-    resolution: {integrity: sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==}
-
-  brace-expansion@2.0.2:
-    resolution: {integrity: sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==}
+  brace-expansion@5.0.6:
+    resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==}
+    engines: {node: 18 || 20 || >=22}
 
   braces@3.0.3:
     resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
@@ -1441,9 +1470,6 @@ packages:
   comma-separated-tokens@2.0.3:
     resolution: {integrity: sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==}
 
-  concat-map@0.0.1:
-    resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
-
   convert-source-map@2.0.0:
     resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
 
@@ -1752,14 +1778,11 @@ packages:
     resolution: {integrity: sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==}
     engines: {node: '>=8.6.0'}
 
-  fast-json-stable-stringify@2.1.0:
-    resolution: {integrity: sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==}
-
   fast-levenshtein@2.0.6:
     resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==}
 
-  fast-uri@3.1.0:
-    resolution: {integrity: sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==}
+  fast-uri@3.1.2:
+    resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==}
 
   fastest-levenshtein@1.0.16:
     resolution: {integrity: sha512-eRnCtTTtGZFpQCwhJiUOuxPQWRXVKYDn0b2PeHfXL6/Zi53SLAzAHfVhVWK2AryC/WH05kGfxhFIPvTF0SXQzg==}
@@ -1799,8 +1822,8 @@ packages:
   flat-cache@6.1.20:
     resolution: {integrity: sha512-AhHYqwvN62NVLp4lObVXGVluiABTHapoB57EyegZVmazN+hhGhLTn3uZbOofoTw4DSDvVCadzzyChXhOAvy8uQ==}
 
-  flatted@3.3.3:
-    resolution: {integrity: sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==}
+  flatted@3.4.2:
+    resolution: {integrity: sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==}
 
   follow-redirects@1.16.0:
     resolution: {integrity: sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==}
@@ -1939,8 +1962,8 @@ packages:
     resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==}
     engines: {node: '>= 0.4'}
 
-  hasown@2.0.3:
-    resolution: {integrity: sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==}
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
     engines: {node: '>= 0.4'}
 
   hast-util-to-jsx-runtime@2.3.6:
@@ -2168,9 +2191,6 @@ packages:
   json-parse-even-better-errors@2.3.1:
     resolution: {integrity: sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==}
 
-  json-schema-traverse@0.4.1:
-    resolution: {integrity: sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==}
-
   json-schema-traverse@1.0.0:
     resolution: {integrity: sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==}
 
@@ -2353,8 +2373,9 @@ packages:
     resolution: {integrity: sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==}
     engines: {node: '>= 0.6'}
 
-  minimatch@3.1.2:
-    resolution: {integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==}
+  minimatch@10.2.5:
+    resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==}
+    engines: {node: 18 || 20 || >=22}
 
   minimatch@9.0.5:
     resolution: {integrity: sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==}
@@ -2473,13 +2494,13 @@ packages:
     resolution: {integrity: sha512-0AioNCJZ2DPYz5ABT6bddIqlhgwhpHZ/l65YAYo0BCIn0xiDpsnTHz0gnoTGk0OXZW0JRs+cDwL8u/teRdz+8A==}
     engines: {node: '>=18.0'}
     peerDependencies:
-      postcss: ^8.4.31
+      postcss: '>=8.5.10'
 
   postcss-scss@4.0.9:
     resolution: {integrity: sha512-AjKOeiwAitL/MXxQW2DliT28EKukvvbEWx3LBmJIRN8KfBGZbRTxNYW0kSqi1COiTZ57nZ9NW06S6ux//N1c9A==}
     engines: {node: '>=12.0'}
     peerDependencies:
-      postcss: ^8.4.29
+      postcss: '>=8.5.10'
 
   postcss-selector-parser@7.1.1:
     resolution: {integrity: sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg==}
@@ -2488,12 +2509,8 @@ packages:
   postcss-value-parser@4.2.0:
     resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==}
 
-  postcss@8.5.6:
-    resolution: {integrity: sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==}
-    engines: {node: ^10 || ^12 || >=14}
-
-  postcss@8.5.9:
-    resolution: {integrity: sha512-7a70Nsot+EMX9fFU3064K/kdHWZqGVY+BADLyXc8Dfv+mTLLVl6JzJpPaCZ2kQL9gIJvKXSLMHhqdRRjwQeFtw==}
+  postcss@8.5.14:
+    resolution: {integrity: sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==}
     engines: {node: ^10 || ^12 || >=14}
 
   prelude-ls@1.2.1:
@@ -2515,10 +2532,6 @@ packages:
     resolution: {integrity: sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==}
     engines: {node: '>=10'}
 
-  punycode@2.3.1:
-    resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
-    engines: {node: '>=6'}
-
   qified@0.6.0:
     resolution: {integrity: sha512-tsSGN1x3h569ZSU1u6diwhltLyfUWDp3YbFHedapTmpBl0B3P6U3+Qptg7xu+v+1io1EwhdPyyRHYbEw0KN2FA==}
     engines: {node: '>=20'}
@@ -2755,8 +2768,8 @@ packages:
     resolution: {integrity: sha512-uP0bpjWrjQmUt5DTHq9RuoCBdFJF10cdX9X+a368j/Ft0wmaVgxlrjvK3kjvgCODOMMOz9lcaRzxmso0bTWZ/g==}
     engines: {node: '>=10.0.0'}
 
-  socket.io-parser@4.2.5:
-    resolution: {integrity: sha512-bPMmpy/5WWKHea5Y/jYAP6k74A+hvmRCQaJuJB6I/ML5JZq/KfNieUVo/3Mh7SAqn7TyFdIo6wqYHInG1MU1bQ==}
+  socket.io-parser@4.2.6:
+    resolution: {integrity: sha512-asJqbVBDsBCJx0pTqw3WfesSY0iRX+2xzWEWzrpcH7L6fLzrhyF8WPI8UaeM4YCuDfpwA/cgsdugMsmtz8EJeg==}
     engines: {node: '>=10.0.0'}
 
   sonner@2.0.7:
@@ -2839,7 +2852,7 @@ packages:
     resolution: {integrity: sha512-VkVD9r7jfUT/dq3mA3/I1WXXk2U71rO5wvU2yIil9PW5o1g3UM7Xc82vHmuVJHV7Y8ok5K137fmW5u3HbhtTOA==}
     engines: {node: '>=20'}
     peerDependencies:
-      postcss: ^8.3.3
+      postcss: '>=8.5.10'
       stylelint: ^17.0.0
     peerDependenciesMeta:
       postcss:
@@ -2855,7 +2868,7 @@ packages:
     resolution: {integrity: sha512-uLJS6xgOCBw5EMsDW7Ukji8l28qRoMnkRch15s0qwZpskXvWt9oPzMmcYM307m9GN4MxuWLsQh4I6hU9yI53cQ==}
     engines: {node: '>=20'}
     peerDependencies:
-      postcss: ^8.3.3
+      postcss: '>=8.5.10'
       stylelint: ^17.0.0
     peerDependenciesMeta:
       postcss:
@@ -3001,9 +3014,6 @@ packages:
     peerDependencies:
       browserslist: '>= 4.21.0'
 
-  uri-js@4.4.1:
-    resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
-
   use-callback-ref@1.3.3:
     resolution: {integrity: sha512-jQL3lRnocaFtu3V00JToYz/4QkNWswxijDaCVNZRiRTO3HQDLsdu1ZtmIUvV4yPp+rvWm5j0y0TG/S61cuijTg==}
     engines: {node: '>=10'}
@@ -3119,8 +3129,8 @@ packages:
     resolution: {integrity: sha512-YnlPC6JqnZl6aO4uRc+dx5PHguiR9S6WeoLtpxNT9wIG+BDya7ZNE1q7KOjVgaA73hKhKLpVPgJ5QA9THQ5BRg==}
     engines: {node: ^20.17.0 || >=22.9.0}
 
-  ws@8.18.3:
-    resolution: {integrity: sha512-PEIGCY5tSlUt50cqyMXfCzX+oOPqN0vuGqWzbcJ2xvnkzkq46oOpz7dQaTDBdfICb4N14+GARUDw2XV2N4tvzg==}
+  ws@8.20.1:
+    resolution: {integrity: sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==}
     engines: {node: '>=10.0.0'}
     peerDependencies:
       bufferutil: ^4.0.1
@@ -3448,7 +3458,7 @@ snapshots:
     dependencies:
       '@eslint/object-schema': 2.1.7
       debug: 4.4.3
-      minimatch: 3.1.2
+      minimatch: 9.0.5
     transitivePeerDependencies:
       - supports-color
 
@@ -3462,14 +3472,14 @@ snapshots:
 
   '@eslint/eslintrc@3.3.3':
     dependencies:
-      ajv: 6.12.6
+      ajv: 8.18.0
       debug: 4.4.3
       espree: 10.4.0
       globals: 14.0.0
       ignore: 5.3.2
       import-fresh: 3.3.1
       js-yaml: 4.1.1
-      minimatch: 3.1.2
+      minimatch: 9.0.5
       strip-json-comments: 3.1.1
     transitivePeerDependencies:
       - supports-color
@@ -4158,7 +4168,7 @@ snapshots:
       '@typescript-eslint/types': 8.56.0
       '@typescript-eslint/visitor-keys': 8.56.0
       debug: 4.4.3
-      minimatch: 9.0.5
+      minimatch: 10.2.5
       semver: 7.7.4
       tinyglobby: 0.2.16
       ts-api-utils: 2.4.0(typescript@5.9.3)
@@ -4202,17 +4212,10 @@ snapshots:
 
   acorn@8.15.0: {}
 
-  ajv@6.12.6:
-    dependencies:
-      fast-deep-equal: 3.1.3
-      fast-json-stable-stringify: 2.1.0
-      json-schema-traverse: 0.4.1
-      uri-js: 4.4.1
-
   ajv@8.18.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 3.1.0
+      fast-uri: 3.1.2
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
@@ -4303,7 +4306,7 @@ snapshots:
 
   axe-core@4.11.1: {}
 
-  axios@1.15.2:
+  axios@1.16.0:
     dependencies:
       follow-redirects: 1.16.0
       form-data: 4.0.5
@@ -4315,20 +4318,15 @@ snapshots:
 
   bail@2.0.2: {}
 
-  balanced-match@1.0.2: {}
-
   balanced-match@3.0.1: {}
 
+  balanced-match@4.0.4: {}
+
   baseline-browser-mapping@2.9.19: {}
 
-  brace-expansion@1.1.12:
+  brace-expansion@5.0.6:
     dependencies:
-      balanced-match: 1.0.2
-      concat-map: 0.0.1
-
-  brace-expansion@2.0.2:
-    dependencies:
-      balanced-match: 1.0.2
+      balanced-match: 4.0.4
 
   braces@3.0.3:
     dependencies:
@@ -4402,8 +4400,6 @@ snapshots:
 
   comma-separated-tokens@2.0.3: {}
 
-  concat-map@0.0.1: {}
-
   convert-source-map@2.0.0: {}
 
   cookie@1.1.1: {}
@@ -4549,7 +4545,7 @@ snapshots:
       '@socket.io/component-emitter': 3.1.2
       debug: 4.4.3
       engine.io-parser: 5.2.3
-      ws: 8.18.3
+      ws: 8.20.1
       xmlhttprequest-ssl: 2.1.2
     transitivePeerDependencies:
       - bufferutil
@@ -4653,7 +4649,7 @@ snapshots:
       es-errors: 1.3.0
       get-intrinsic: 1.3.0
       has-tostringtag: 1.0.2
-      hasown: 2.0.3
+      hasown: 2.0.4
 
   es-shim-unscopables@1.1.0:
     dependencies:
@@ -4718,7 +4714,7 @@ snapshots:
       hasown: 2.0.2
       jsx-ast-utils: 3.3.5
       language-tags: 1.0.9
-      minimatch: 3.1.2
+      minimatch: 9.0.5
       object.fromentries: 2.0.8
       safe-regex-test: 1.1.0
       string.prototype.includes: 2.0.1
@@ -4750,7 +4746,7 @@ snapshots:
       estraverse: 5.3.0
       hasown: 2.0.2
       jsx-ast-utils: 3.3.5
-      minimatch: 3.1.2
+      minimatch: 9.0.5
       object.entries: 1.1.9
       object.fromentries: 2.0.8
       object.values: 1.2.1
@@ -4785,7 +4781,7 @@ snapshots:
       '@humanwhocodes/module-importer': 1.0.1
       '@humanwhocodes/retry': 0.4.3
       '@types/estree': 1.0.8
-      ajv: 6.12.6
+      ajv: 8.18.0
       chalk: 4.1.2
       cross-spawn: 7.0.6
       debug: 4.4.3
@@ -4804,7 +4800,7 @@ snapshots:
       is-glob: 4.0.3
       json-stable-stringify-without-jsonify: 1.0.1
       lodash.merge: 4.6.2
-      minimatch: 3.1.2
+      minimatch: 9.0.5
       natural-compare: 1.4.0
       optionator: 0.9.4
     transitivePeerDependencies:
@@ -4844,11 +4840,9 @@ snapshots:
       merge2: 1.4.1
       micromatch: 4.0.8
 
-  fast-json-stable-stringify@2.1.0: {}
-
   fast-levenshtein@2.0.6: {}
 
-  fast-uri@3.1.0: {}
+  fast-uri@3.1.2: {}
 
   fastest-levenshtein@1.0.16: {}
 
@@ -4879,16 +4873,16 @@ snapshots:
 
   flat-cache@4.0.1:
     dependencies:
-      flatted: 3.3.3
+      flatted: 3.4.2
       keyv: 4.5.4
 
   flat-cache@6.1.20:
     dependencies:
       cacheable: 2.3.2
-      flatted: 3.3.3
+      flatted: 3.4.2
       hookified: 1.15.1
 
-  flatted@3.3.3: {}
+  flatted@3.4.2: {}
 
   follow-redirects@1.16.0: {}
 
@@ -4901,7 +4895,7 @@ snapshots:
       asynckit: 0.4.0
       combined-stream: 1.0.8
       es-set-tostringtag: 2.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       mime-types: 2.1.35
 
   fsevents@2.3.3:
@@ -4915,7 +4909,7 @@ snapshots:
       call-bound: 1.0.4
       define-properties: 1.2.1
       functions-have-names: 1.2.3
-      hasown: 2.0.3
+      hasown: 2.0.4
       is-callable: 1.2.7
 
   functions-have-names@1.2.3: {}
@@ -5022,7 +5016,7 @@ snapshots:
     dependencies:
       function-bind: 1.1.2
 
-  hasown@2.0.3:
+  hasown@2.0.4:
     dependencies:
       function-bind: 1.1.2
 
@@ -5247,8 +5241,6 @@ snapshots:
 
   json-parse-even-better-errors@2.3.1: {}
 
-  json-schema-traverse@0.4.1: {}
-
   json-schema-traverse@1.0.0: {}
 
   json-stable-stringify-without-jsonify@1.0.1: {}
@@ -5550,13 +5542,13 @@ snapshots:
     dependencies:
       mime-db: 1.52.0
 
-  minimatch@3.1.2:
+  minimatch@10.2.5:
     dependencies:
-      brace-expansion: 1.1.12
+      brace-expansion: 5.0.6
 
   minimatch@9.0.5:
     dependencies:
-      brace-expansion: 2.0.2
+      brace-expansion: 5.0.6
 
   ms@2.1.3: {}
 
@@ -5673,13 +5665,13 @@ snapshots:
 
   postcss-resolve-nested-selector@0.1.6: {}
 
-  postcss-safe-parser@7.0.1(postcss@8.5.6):
+  postcss-safe-parser@7.0.1(postcss@8.5.14):
     dependencies:
-      postcss: 8.5.6
+      postcss: 8.5.14
 
-  postcss-scss@4.0.9(postcss@8.5.9):
+  postcss-scss@4.0.9(postcss@8.5.14):
     dependencies:
-      postcss: 8.5.9
+      postcss: 8.5.14
 
   postcss-selector-parser@7.1.1:
     dependencies:
@@ -5688,13 +5680,7 @@ snapshots:
 
   postcss-value-parser@4.2.0: {}
 
-  postcss@8.5.6:
-    dependencies:
-      nanoid: 3.3.11
-      picocolors: 1.1.1
-      source-map-js: 1.2.1
-
-  postcss@8.5.9:
+  postcss@8.5.14:
     dependencies:
       nanoid: 3.3.11
       picocolors: 1.1.1
@@ -5714,8 +5700,6 @@ snapshots:
 
   proxy-from-env@2.1.0: {}
 
-  punycode@2.3.1: {}
-
   qified@0.6.0:
     dependencies:
       hookified: 1.15.1
@@ -6022,13 +6006,13 @@ snapshots:
       '@socket.io/component-emitter': 3.1.2
       debug: 4.4.3
       engine.io-client: 6.6.4
-      socket.io-parser: 4.2.5
+      socket.io-parser: 4.2.6
     transitivePeerDependencies:
       - bufferutil
       - supports-color
       - utf-8-validate
 
-  socket.io-parser@4.2.5:
+  socket.io-parser@4.2.6:
     dependencies:
       '@socket.io/component-emitter': 3.1.2
       debug: 4.4.3
@@ -6137,26 +6121,26 @@ snapshots:
     dependencies:
       stylelint: 17.3.0(typescript@5.9.3)
 
-  stylelint-config-recommended-scss@17.0.0(postcss@8.5.9)(stylelint@17.3.0(typescript@5.9.3)):
+  stylelint-config-recommended-scss@17.0.0(postcss@8.5.14)(stylelint@17.3.0(typescript@5.9.3)):
     dependencies:
-      postcss-scss: 4.0.9(postcss@8.5.9)
+      postcss-scss: 4.0.9(postcss@8.5.14)
       stylelint: 17.3.0(typescript@5.9.3)
       stylelint-config-recommended: 18.0.0(stylelint@17.3.0(typescript@5.9.3))
       stylelint-scss: 7.0.0(stylelint@17.3.0(typescript@5.9.3))
     optionalDependencies:
-      postcss: 8.5.9
+      postcss: 8.5.14
 
   stylelint-config-recommended@18.0.0(stylelint@17.3.0(typescript@5.9.3)):
     dependencies:
       stylelint: 17.3.0(typescript@5.9.3)
 
-  stylelint-config-standard-scss@17.0.0(postcss@8.5.9)(stylelint@17.3.0(typescript@5.9.3)):
+  stylelint-config-standard-scss@17.0.0(postcss@8.5.14)(stylelint@17.3.0(typescript@5.9.3)):
     dependencies:
       stylelint: 17.3.0(typescript@5.9.3)
-      stylelint-config-recommended-scss: 17.0.0(postcss@8.5.9)(stylelint@17.3.0(typescript@5.9.3))
+      stylelint-config-recommended-scss: 17.0.0(postcss@8.5.14)(stylelint@17.3.0(typescript@5.9.3))
       stylelint-config-standard: 40.0.0(stylelint@17.3.0(typescript@5.9.3))
     optionalDependencies:
-      postcss: 8.5.9
+      postcss: 8.5.14
 
   stylelint-config-standard@40.0.0(stylelint@17.3.0(typescript@5.9.3)):
     dependencies:
@@ -6207,8 +6191,8 @@ snapshots:
       micromatch: 4.0.8
       normalize-path: 3.0.0
       picocolors: 1.1.1
-      postcss: 8.5.6
-      postcss-safe-parser: 7.0.1(postcss@8.5.6)
+      postcss: 8.5.14
+      postcss-safe-parser: 7.0.1(postcss@8.5.14)
       postcss-selector-parser: 7.1.1
       postcss-value-parser: 4.2.0
       string-width: 8.2.0
@@ -6366,10 +6350,6 @@ snapshots:
       escalade: 3.2.0
       picocolors: 1.1.1
 
-  uri-js@4.4.1:
-    dependencies:
-      punycode: 2.3.1
-
   use-callback-ref@1.3.3(@types/react@19.2.14)(react@19.2.4):
     dependencies:
       react: 19.2.4
@@ -6433,7 +6413,7 @@ snapshots:
       esbuild: 0.27.7
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
-      postcss: 8.5.9
+      postcss: 8.5.14
       rollup: 4.60.1
       tinyglobby: 0.2.16
     optionalDependencies:
@@ -6495,7 +6475,7 @@ snapshots:
       imurmurhash: 0.1.4
       signal-exit: 4.1.0
 
-  ws@8.18.3: {}
+  ws@8.20.1: {}
 
   xmlhttprequest-ssl@2.1.2: {}
 
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/context.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/context.rs
index f409b03d..d9e018bf 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/context.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/context.rs
@@ -61,12 +61,7 @@ pub struct AnalysisContext {
 }
 
 impl AnalysisContext {
-    pub fn new(
-        source: BinarySource,
-        sha256: String,
-        file_name: String,
-        file_size: u64,
-    ) -> Self {
+    pub fn new(source: BinarySource, sha256: String, file_name: String, file_size: u64) -> Self {
         Self {
             source,
             sha256,
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/error.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/error.rs
index 9ed12141..b5e3de0d 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/error.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/error.rs
@@ -25,10 +25,7 @@ pub enum EngineError {
     UnsupportedArchitecture { arch: String },
 
     #[error("pass '{pass}' missing dependency: {dependency}")]
-    MissingDependency {
-        pass: String,
-        dependency: String,
-    },
+    MissingDependency { pass: String, dependency: String },
 
     #[error("pass '{pass}' failed")]
     PassFailed {
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/formats/elf.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/formats/elf.rs
index eec371df..b00b6601 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/formats/elf.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/formats/elf.rs
@@ -25,31 +25,23 @@
 //   types.rs       - Architecture, BinaryFormat, Endianness,
 //                     SectionPermissions
 
+use goblin::elf::Elf;
 use goblin::elf::dynamic::DT_BIND_NOW;
 use goblin::elf::header::{
-    EM_386, EM_AARCH64, EM_ARM, EM_X86_64, ET_CORE, ET_DYN,
-    ET_EXEC, ET_REL,
+    EM_386, EM_AARCH64, EM_ARM, EM_X86_64, ET_CORE, ET_DYN, ET_EXEC, ET_REL,
 };
 use goblin::elf::program_header::{
-    PF_R, PF_W, PF_X, PT_DYNAMIC, PT_GNU_EH_FRAME,
-    PT_GNU_RELRO, PT_GNU_STACK, PT_INTERP, PT_LOAD, PT_NOTE,
-    PT_NULL, PT_PHDR,
-};
-use goblin::elf::section_header::{
-    SHF_ALLOC, SHF_EXECINSTR, SHF_WRITE, SHT_NOBITS,
-    SHT_SYMTAB,
+    PF_R, PF_W, PF_X, PT_DYNAMIC, PT_GNU_EH_FRAME, PT_GNU_RELRO, PT_GNU_STACK, PT_INTERP, PT_LOAD,
+    PT_NOTE, PT_NULL, PT_PHDR,
 };
+use goblin::elf::section_header::{SHF_ALLOC, SHF_EXECINSTR, SHF_WRITE, SHT_NOBITS, SHT_SYMTAB};
 use goblin::elf::sym::STT_FUNC;
-use goblin::elf::Elf;
 
 use super::{
-    detect_common_anomalies, compute_section_hash, ElfInfo,
-    FormatResult, SectionInfo, SegmentInfo,
+    ElfInfo, FormatResult, SectionInfo, SegmentInfo, compute_section_hash, detect_common_anomalies,
 };
 use crate::error::EngineError;
-use crate::types::{
-    Architecture, BinaryFormat, Endianness, SectionPermissions,
-};
+use crate::types::{Architecture, BinaryFormat, Endianness, SectionPermissions};
 
 const EI_OSABI: usize = 7;
 const ELFOSABI_NONE: u8 = 0;
@@ -65,12 +57,8 @@ const ELFOSABI_STANDALONE: u8 = 255;
 const DT_FLAGS: u64 = 30;
 const DF_BIND_NOW: u64 = 0x8;
 
-pub fn parse_elf(
-    elf: &Elf,
-    data: &[u8],
-) -> Result<FormatResult, EngineError> {
-    let architecture =
-        map_architecture(elf.header.e_machine);
+pub fn parse_elf(elf: &Elf, data: &[u8]) -> Result<FormatResult, EngineError> {
+    let architecture = map_architecture(elf.header.e_machine);
     let bits = if elf.is_64 { 64 } else { 32 };
     let endianness = if elf.little_endian {
         Endianness::Little
@@ -85,32 +73,20 @@ pub fn parse_elf(
         .any(|sh| sh.sh_type == SHT_SYMTAB);
     let is_stripped = !has_symtab;
 
-    let has_interp = elf
-        .program_headers
-        .iter()
-        .any(|ph| ph.p_type == PT_INTERP);
-    let is_pie =
-        elf.header.e_type == ET_DYN && has_interp;
+    let has_interp = elf.program_headers.iter().any(|ph| ph.p_type == PT_INTERP);
+    let is_pie = elf.header.e_type == ET_DYN && has_interp;
 
-    let has_debug_info =
-        elf.section_headers.iter().any(|sh| {
-            elf.shdr_strtab
-                .get_at(sh.sh_name)
-                .is_some_and(|name| {
-                    name.starts_with(".debug_")
-                })
-        });
+    let has_debug_info = elf.section_headers.iter().any(|sh| {
+        elf.shdr_strtab
+            .get_at(sh.sh_name)
+            .is_some_and(|name| name.starts_with(".debug_"))
+    });
 
     let sections = build_sections(elf, data);
     let segments = build_segments(elf);
-    let anomalies = detect_common_anomalies(
-        &sections,
-        entry_point,
-        is_stripped,
-    );
+    let anomalies = detect_common_anomalies(&sections, entry_point, is_stripped);
     let elf_info = build_elf_info(elf);
-    let function_hints =
-        collect_function_hints(elf, entry_point);
+    let function_hints = collect_function_hints(elf, entry_point);
 
     Ok(FormatResult {
         format: BinaryFormat::Elf,
@@ -137,11 +113,7 @@ fn map_architecture(machine: u16) -> Architecture {
         EM_X86_64 => Architecture::X86_64,
         EM_ARM => Architecture::Arm,
         EM_AARCH64 => Architecture::Aarch64,
-        other => {
-            Architecture::Other(format!(
-                "elf-machine-{other}"
-            ))
-        }
+        other => Architecture::Other(format!("elf-machine-{other}")),
     }
 }
 
@@ -188,10 +160,7 @@ fn segment_type_name(p_type: u32) -> Option<String> {
     )
 }
 
-fn build_sections(
-    elf: &Elf,
-    data: &[u8],
-) -> Vec<SectionInfo> {
+fn build_sections(elf: &Elf, data: &[u8]) -> Vec<SectionInfo> {
     elf.section_headers
         .iter()
         .skip(1)
@@ -203,32 +172,16 @@ fn build_sections(
                 .to_string();
 
             let is_nobits = shdr.sh_type == SHT_NOBITS;
-            let raw_offset = if is_nobits {
-                0
-            } else {
-                shdr.sh_offset
-            };
-            let raw_size = if is_nobits {
-                0
-            } else {
-                shdr.sh_size
-            };
+            let raw_offset = if is_nobits { 0 } else { shdr.sh_offset };
+            let raw_size = if is_nobits { 0 } else { shdr.sh_size };
 
             let permissions = SectionPermissions {
-                read: (shdr.sh_flags
-                    & u64::from(SHF_ALLOC))
-                    != 0,
-                write: (shdr.sh_flags
-                    & u64::from(SHF_WRITE))
-                    != 0,
-                execute: (shdr.sh_flags
-                    & u64::from(SHF_EXECINSTR))
-                    != 0,
+                read: (shdr.sh_flags & u64::from(SHF_ALLOC)) != 0,
+                write: (shdr.sh_flags & u64::from(SHF_WRITE)) != 0,
+                execute: (shdr.sh_flags & u64::from(SHF_EXECINSTR)) != 0,
             };
 
-            let sha256 = compute_section_hash(
-                data, raw_offset, raw_size,
-            );
+            let sha256 = compute_section_hash(data, raw_offset, raw_size);
 
             SectionInfo {
                 name,
@@ -267,11 +220,9 @@ fn build_segments(elf: &Elf) -> Vec<SegmentInfo> {
 }
 
 fn build_elf_info(elf: &Elf) -> ElfInfo {
-    let os_abi =
-        os_abi_name(elf.header.e_ident[EI_OSABI]);
+    let os_abi = os_abi_name(elf.header.e_ident[EI_OSABI]);
     let elf_type = elf_type_name(elf.header.e_type);
-    let interpreter =
-        elf.interpreter.map(|s| s.to_string());
+    let interpreter = elf.interpreter.map(|s| s.to_string());
 
     let gnu_relro = elf
         .program_headers
@@ -287,23 +238,17 @@ fn build_elf_info(elf: &Elf) -> ElfInfo {
     let mut bind_now = false;
     if let Some(dynamic) = &elf.dynamic {
         for dyn_entry in &dynamic.dyns {
-            let tag = dyn_entry.d_tag as u64;
+            let tag = dyn_entry.d_tag;
             if tag == DT_BIND_NOW {
                 bind_now = true;
             }
-            if tag == DT_FLAGS
-                && (dyn_entry.d_val & DF_BIND_NOW) != 0
-            {
+            if tag == DT_FLAGS && (dyn_entry.d_val & DF_BIND_NOW) != 0 {
                 bind_now = true;
             }
         }
     }
 
-    let needed_libraries = elf
-        .libraries
-        .iter()
-        .map(|s| s.to_string())
-        .collect();
+    let needed_libraries = elf.libraries.iter().map(|s| s.to_string()).collect();
 
     ElfInfo {
         os_abi,
@@ -316,19 +261,12 @@ fn build_elf_info(elf: &Elf) -> ElfInfo {
     }
 }
 
-fn collect_function_hints(
-    elf: &Elf,
-    entry_point: u64,
-) -> Vec<u64> {
+fn collect_function_hints(elf: &Elf, entry_point: u64) -> Vec<u64> {
     let mut hints: Vec<u64> = elf
         .syms
         .iter()
         .chain(elf.dynsyms.iter())
-        .filter(|sym| {
-            sym.st_type() == STT_FUNC
-                && sym.st_value != 0
-                && sym.st_value != entry_point
-        })
+        .filter(|sym| sym.st_type() == STT_FUNC && sym.st_value != 0 && sym.st_value != entry_point)
         .map(|sym| sym.st_value)
         .collect();
     hints.sort_unstable();
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/formats/macho.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/formats/macho.rs
index 17a4c224..7c6e9f2f 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/formats/macho.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/formats/macho.rs
@@ -26,21 +26,16 @@
 //   types.rs       - Architecture, BinaryFormat, Endianness,
 //                     SectionPermissions
 
-use goblin::mach::cputype::{
-    CPU_TYPE_ARM, CPU_TYPE_ARM64, CPU_TYPE_X86,
-    CPU_TYPE_X86_64,
-};
+use goblin::mach::cputype::{CPU_TYPE_ARM, CPU_TYPE_ARM64, CPU_TYPE_X86, CPU_TYPE_X86_64};
 use goblin::mach::load_command::CommandVariant;
 use goblin::mach::{Mach, MachO};
 
 use super::{
-    compute_section_hash, detect_common_anomalies,
-    FormatResult, MachOInfo, SectionInfo, SegmentInfo,
+    FormatResult, MachOInfo, SectionInfo, SegmentInfo, compute_section_hash,
+    detect_common_anomalies,
 };
 use crate::error::EngineError;
-use crate::types::{
-    Architecture, BinaryFormat, Endianness, SectionPermissions,
-};
+use crate::types::{Architecture, BinaryFormat, Endianness, SectionPermissions};
 
 const MH_OBJECT: u32 = 1;
 const MH_EXECUTE: u32 = 2;
@@ -53,34 +48,23 @@ const VM_PROT_READ: u32 = 0x01;
 const VM_PROT_WRITE: u32 = 0x02;
 const VM_PROT_EXECUTE: u32 = 0x04;
 
-pub fn parse_macho(
-    mach: &Mach,
-    data: &[u8],
-) -> Result<FormatResult, EngineError> {
+pub fn parse_macho(mach: &Mach, data: &[u8]) -> Result<FormatResult, EngineError> {
     match mach {
-        Mach::Binary(macho) => {
-            parse_single_macho(macho, data, false)
-        }
+        Mach::Binary(macho) => parse_single_macho(macho, data, false),
         Mach::Fat(fat) => {
             for arch in fat.iter_arches() {
-                let arch = arch.map_err(|e| {
-                    EngineError::InvalidBinary {
-                        reason: e.to_string(),
-                    }
+                let arch = arch.map_err(|e| EngineError::InvalidBinary {
+                    reason: e.to_string(),
                 })?;
                 let offset = arch.offset as usize;
                 let size = arch.size as usize;
                 let end = offset.saturating_add(size);
                 if end <= data.len() {
-                    let macho = MachO::parse(data, offset)
-                        .map_err(|e| {
-                        EngineError::InvalidBinary {
+                    let macho =
+                        MachO::parse(data, offset).map_err(|e| EngineError::InvalidBinary {
                             reason: e.to_string(),
-                        }
-                    })?;
-                    return parse_single_macho(
-                        &macho, data, true,
-                    );
+                        })?;
+                    return parse_single_macho(&macho, data, true);
                 }
             }
             Err(EngineError::InvalidBinary {
@@ -97,8 +81,7 @@ fn parse_single_macho(
     data: &[u8],
     is_universal: bool,
 ) -> Result<FormatResult, EngineError> {
-    let architecture =
-        map_architecture(macho.header.cputype);
+    let architecture = map_architecture(macho.header.cputype);
     let bits = if macho.is_64 { 64 } else { 32 };
     let endianness = if macho.little_endian {
         Endianness::Little
@@ -107,25 +90,20 @@ fn parse_single_macho(
     };
     let entry_point = macho.entry;
 
-    let symbols: Vec<_> =
-        macho.symbols().flatten().collect();
+    let symbols: Vec<_> = macho.symbols().flatten().collect();
     let is_stripped = symbols.is_empty();
 
-    let has_debug_info = macho.segments.iter().any(|seg| {
-        seg.name().is_ok_and(|n| n == "__DWARF")
-    });
+    let has_debug_info = macho
+        .segments
+        .iter()
+        .any(|seg| seg.name().is_ok_and(|n| n == "__DWARF"));
 
     let is_pie = macho.header.flags & 0x0020_0000 != 0;
 
     let sections = build_sections(macho, data);
     let segments = build_segments(macho);
-    let anomalies = detect_common_anomalies(
-        &sections,
-        entry_point,
-        is_stripped,
-    );
-    let macho_info =
-        build_macho_info(macho, is_universal);
+    let anomalies = detect_common_anomalies(&sections, entry_point, is_stripped);
+    let macho_info = build_macho_info(macho, is_universal);
 
     let function_hints: Vec<u64> = macho
         .symbols()
@@ -164,11 +142,7 @@ fn map_architecture(cputype: u32) -> Architecture {
         CPU_TYPE_X86_64 => Architecture::X86_64,
         CPU_TYPE_ARM => Architecture::Arm,
         CPU_TYPE_ARM64 => Architecture::Aarch64,
-        other => {
-            Architecture::Other(format!(
-                "mach-cpu-{other:#x}"
-            ))
-        }
+        other => Architecture::Other(format!("mach-cpu-{other:#x}")),
     }
 }
 
@@ -184,24 +158,19 @@ fn file_type_name(filetype: u32) -> String {
     }
 }
 
-fn cpu_subtype_name(
-    cputype: u32,
-    cpusubtype: u32,
-) -> String {
+fn cpu_subtype_name(cputype: u32, cpusubtype: u32) -> String {
     let subtype = cpusubtype & 0x00FF_FFFF;
     match cputype {
-        CPU_TYPE_X86 | CPU_TYPE_X86_64 => {
-            match subtype {
-                3 => "ALL".into(),
-                4 => "486".into(),
-                8 => "PENTIUM_3".into(),
-                9 => "PENTIUM_M".into(),
-                10 => "PENTIUM_4".into(),
-                11 => "ITANIUM".into(),
-                12 => "XEON".into(),
-                _ => format!("{subtype}"),
-            }
-        }
+        CPU_TYPE_X86 | CPU_TYPE_X86_64 => match subtype {
+            3 => "ALL".into(),
+            4 => "486".into(),
+            8 => "PENTIUM_3".into(),
+            9 => "PENTIUM_M".into(),
+            10 => "PENTIUM_4".into(),
+            11 => "ITANIUM".into(),
+            12 => "XEON".into(),
+            _ => format!("{subtype}"),
+        },
         CPU_TYPE_ARM => match subtype {
             6 => "v6".into(),
             9 => "v7".into(),
@@ -220,34 +189,23 @@ fn cpu_subtype_name(
     }
 }
 
-fn build_sections(
-    macho: &MachO,
-    data: &[u8],
-) -> Vec<SectionInfo> {
+fn build_sections(macho: &MachO, data: &[u8]) -> Vec<SectionInfo> {
     let mut sections = Vec::new();
     for segment in macho.segments.iter() {
         let initprot = segment.initprot;
         let seg_permissions = SectionPermissions {
             read: (initprot & VM_PROT_READ) != 0,
             write: (initprot & VM_PROT_WRITE) != 0,
-            execute: (initprot & VM_PROT_EXECUTE)
-                != 0,
+            execute: (initprot & VM_PROT_EXECUTE) != 0,
         };
         for section_result in segment.into_iter() {
-            let Ok((section, _section_data)) =
-                section_result
-            else {
+            let Ok((section, _section_data)) = section_result else {
                 continue;
             };
-            let name = section
-                .name()
-                .unwrap_or("???")
-                .to_string();
+            let name = section.name().unwrap_or("???").to_string();
             let raw_offset = section.offset as u64;
             let raw_size = section.size;
-            let sha256 = compute_section_hash(
-                data, raw_offset, raw_size,
-            );
+            let sha256 = compute_section_hash(data, raw_offset, raw_size);
 
             sections.push(SectionInfo {
                 name,
@@ -268,16 +226,12 @@ fn build_segments(macho: &MachO) -> Vec<SegmentInfo> {
         .segments
         .iter()
         .map(|seg| {
-            let name = seg
-                .name()
-                .ok()
-                .map(|n| n.to_string());
+            let name = seg.name().ok().map(|n| n.to_string());
             let initprot = seg.initprot;
             let permissions = SectionPermissions {
                 read: (initprot & VM_PROT_READ) != 0,
                 write: (initprot & VM_PROT_WRITE) != 0,
-                execute: (initprot & VM_PROT_EXECUTE)
-                    != 0,
+                execute: (initprot & VM_PROT_EXECUTE) != 0,
             };
 
             SegmentInfo {
@@ -292,16 +246,9 @@ fn build_segments(macho: &MachO) -> Vec<SegmentInfo> {
         .collect()
 }
 
-fn build_macho_info(
-    macho: &MachO,
-    is_universal: bool,
-) -> MachOInfo {
-    let file_type =
-        file_type_name(macho.header.filetype);
-    let cpu_subtype = cpu_subtype_name(
-        macho.header.cputype,
-        macho.header.cpusubtype,
-    );
+fn build_macho_info(macho: &MachO, is_universal: bool) -> MachOInfo {
+    let file_type = file_type_name(macho.header.filetype);
+    let cpu_subtype = cpu_subtype_name(macho.header.cputype, macho.header.cpusubtype);
 
     let mut has_code_signature = false;
     let mut has_function_starts = false;
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/formats/mod.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/formats/mod.rs
index 610a1867..bc6cec08 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/formats/mod.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/formats/mod.rs
@@ -35,9 +35,7 @@ use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 
 use crate::error::EngineError;
-use crate::types::{
-    Architecture, BinaryFormat, Endianness, SectionPermissions,
-};
+use crate::types::{Architecture, BinaryFormat, Endianness, SectionPermissions};
 
 pub const SUSPICIOUS_SECTION_NAMES: &[(&str, &str)] = &[
     ("UPX0", "UPX packer"),
@@ -192,37 +190,22 @@ pub struct MachOInfo {
     pub has_function_starts: bool,
 }
 
-pub fn parse_format(
-    data: &[u8],
-) -> Result<FormatResult, EngineError> {
-    let object =
-        goblin::Object::parse(data).map_err(|e| {
-            EngineError::InvalidBinary {
-                reason: e.to_string(),
-            }
-        })?;
+pub fn parse_format(data: &[u8]) -> Result<FormatResult, EngineError> {
+    let object = goblin::Object::parse(data).map_err(|e| EngineError::InvalidBinary {
+        reason: e.to_string(),
+    })?;
 
     match &object {
-        goblin::Object::Elf(elf_obj) => {
-            elf::parse_elf(elf_obj, data)
-        }
-        goblin::Object::PE(pe_obj) => {
-            pe::parse_pe(pe_obj, data)
-        }
-        goblin::Object::Mach(mach_obj) => {
-            macho::parse_macho(mach_obj, data)
-        }
+        goblin::Object::Elf(elf_obj) => elf::parse_elf(elf_obj, data),
+        goblin::Object::PE(pe_obj) => pe::parse_pe(pe_obj, data),
+        goblin::Object::Mach(mach_obj) => macho::parse_macho(mach_obj, data),
         _ => Err(EngineError::UnsupportedFormat {
             format: "unknown".into(),
         }),
     }
 }
 
-fn compute_section_hash(
-    data: &[u8],
-    offset: u64,
-    size: u64,
-) -> String {
+fn compute_section_hash(data: &[u8], offset: u64, size: u64) -> String {
     if size == 0 {
         return String::new();
     }
@@ -251,53 +234,32 @@ fn detect_common_anomalies(
 ) -> Vec<FormatAnomaly> {
     let mut anomalies = Vec::new();
 
-    let text_section =
-        sections.iter().find(|s| s.name == ".text");
+    let text_section = sections.iter().find(|s| s.name == ".text");
     if let Some(text) = text_section {
-        let text_end =
-            text.virtual_address + text.virtual_size;
-        if entry_point != 0
-            && (entry_point < text.virtual_address
-                || entry_point >= text_end)
-        {
-            anomalies.push(
-                FormatAnomaly::EntryPointOutsideText {
-                    ep: entry_point,
-                    text_range: (
-                        text.virtual_address,
-                        text_end,
-                    ),
-                },
-            );
+        let text_end = text.virtual_address + text.virtual_size;
+        if entry_point != 0 && (entry_point < text.virtual_address || entry_point >= text_end) {
+            anomalies.push(FormatAnomaly::EntryPointOutsideText {
+                ep: entry_point,
+                text_range: (text.virtual_address, text_end),
+            });
         }
     }
 
     if let Some(last) = sections.last() {
-        let last_end =
-            last.virtual_address + last.virtual_size;
-        if entry_point >= last.virtual_address
-            && entry_point < last_end
-        {
-            anomalies.push(
-                FormatAnomaly::EntryPointInLastSection {
-                    ep: entry_point,
-                    section: last.name.clone(),
-                },
-            );
+        let last_end = last.virtual_address + last.virtual_size;
+        if entry_point >= last.virtual_address && entry_point < last_end {
+            anomalies.push(FormatAnomaly::EntryPointInLastSection {
+                ep: entry_point,
+                section: last.name.clone(),
+            });
         }
     }
 
     let ep_in_any = sections.iter().any(|s| {
-        entry_point >= s.virtual_address
-            && entry_point
-                < s.virtual_address + s.virtual_size
+        entry_point >= s.virtual_address && entry_point < s.virtual_address + s.virtual_size
     });
     if !ep_in_any && entry_point != 0 {
-        anomalies.push(
-            FormatAnomaly::EntryPointOutsideSections {
-                ep: entry_point,
-            },
-        );
+        anomalies.push(FormatAnomaly::EntryPointOutsideSections { ep: entry_point });
     }
 
     for (idx, section) in sections.iter().enumerate() {
@@ -308,47 +270,31 @@ fn detect_common_anomalies(
         }
 
         if section.name.is_empty() {
-            anomalies.push(
-                FormatAnomaly::EmptySectionName {
-                    index: idx,
-                },
-            );
+            anomalies.push(FormatAnomaly::EmptySectionName { index: idx });
         }
 
-        if let Some(reason) =
-            check_suspicious_name(&section.name)
-        {
-            anomalies.push(
-                FormatAnomaly::SuspiciousSectionName {
-                    name: section.name.clone(),
-                    reason,
-                },
-            );
+        if let Some(reason) = check_suspicious_name(&section.name) {
+            anomalies.push(FormatAnomaly::SuspiciousSectionName {
+                name: section.name.clone(),
+                reason,
+            });
         }
 
-        if section.permissions.execute
-            && section.virtual_size == 0
-        {
-            anomalies.push(
-                FormatAnomaly::ZeroSizeCodeSection {
-                    name: section.name.clone(),
-                },
-            );
+        if section.permissions.execute && section.virtual_size == 0 {
+            anomalies.push(FormatAnomaly::ZeroSizeCodeSection {
+                name: section.name.clone(),
+            });
         }
 
         if section.raw_size > 0 {
-            let ratio = section.virtual_size as f64
-                / section.raw_size as f64;
+            let ratio = section.virtual_size as f64 / section.raw_size as f64;
             if ratio > VIRTUAL_RAW_RATIO_THRESHOLD {
-                anomalies.push(
-                    FormatAnomaly::VirtualRawSizeMismatch {
-                        name: section.name.clone(),
-                        virtual_size: section
-                            .virtual_size,
-                        raw_size: section.raw_size,
-                        ratio,
-                    },
-                );
+                anomalies.push(FormatAnomaly::VirtualRawSizeMismatch {
+                    name: section.name.clone(),
+                    virtual_size: section.virtual_size,
+                    raw_size: section.raw_size,
+                    ratio,
+                });
             }
         }
     }
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/formats/pe.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/formats/pe.rs
index 226a7a88..b9f3bc1e 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/formats/pe.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/formats/pe.rs
@@ -28,14 +28,11 @@
 use goblin::pe::PE;
 
 use super::{
+    FormatAnomaly, FormatResult, PeDllCharacteristics, PeInfo, SectionInfo, SegmentInfo,
     compute_section_hash, detect_common_anomalies,
-    FormatAnomaly, FormatResult, PeDllCharacteristics, PeInfo,
-    SectionInfo, SegmentInfo,
 };
 use crate::error::EngineError;
-use crate::types::{
-    Architecture, BinaryFormat, Endianness, SectionPermissions,
-};
+use crate::types::{Architecture, BinaryFormat, Endianness, SectionPermissions};
 
 const COFF_MACHINE_I386: u16 = 0x14c;
 const COFF_MACHINE_AMD64: u16 = 0x8664;
@@ -48,8 +45,7 @@ const IMAGE_SCN_MEM_WRITE: u32 = 0x8000_0000;
 const IMAGE_SCN_MEM_EXECUTE: u32 = 0x2000_0000;
 
 const IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE: u16 = 0x0040;
-const IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY: u16 =
-    0x0080;
+const IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY: u16 = 0x0080;
 const IMAGE_DLLCHARACTERISTICS_NX_COMPAT: u16 = 0x0100;
 const IMAGE_DLLCHARACTERISTICS_NO_SEH: u16 = 0x0400;
 const IMAGE_DLLCHARACTERISTICS_GUARD_CF: u16 = 0x4000;
@@ -70,43 +66,30 @@ const PE_TIMESTAMP_MAX_VALID: u32 = 4_102_444_800;
 
 const RICH_SIGNATURE: &[u8] = b"Rich";
 
-pub fn parse_pe(
-    pe: &PE,
-    data: &[u8],
-) -> Result<FormatResult, EngineError> {
-    let architecture = map_architecture(
-        pe.header.coff_header.machine,
-    );
+pub fn parse_pe(pe: &PE, data: &[u8]) -> Result<FormatResult, EngineError> {
+    let architecture = map_architecture(pe.header.coff_header.machine);
     let bits = if pe.is_64 { 64 } else { 32 };
     let endianness = Endianness::Little;
     let entry_point = pe.entry as u64;
 
     let is_stripped = pe.debug_data.is_none();
     let optional = pe.header.optional_header.as_ref();
-    let dll_chars = optional.map_or(0, |oh| {
-        oh.windows_fields.dll_characteristics
-    });
-    let is_pie = (dll_chars
-        & IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE)
-        != 0;
+    let dll_chars = optional.map_or(0, |oh| oh.windows_fields.dll_characteristics);
+    let is_pie = (dll_chars & IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) != 0;
     let has_debug_info = pe.debug_data.is_some();
 
     let sections = build_sections(pe, data);
     let segments = build_segments(pe);
 
-    let timestamp =
-        pe.header.coff_header.time_date_stamp;
-    let image_base = optional
-        .map_or(0, |oh| oh.windows_fields.image_base);
-    let subsystem_raw = optional
-        .map_or(0, |oh| oh.windows_fields.subsystem);
+    let timestamp = pe.header.coff_header.time_date_stamp;
+    let image_base = optional.map_or(0, |oh| oh.windows_fields.image_base);
+    let subsystem_raw = optional.map_or(0, |oh| oh.windows_fields.subsystem);
     let linker_version = optional.map_or_else(
         || "0.0".into(),
         |oh| {
             format!(
                 "{}.{}",
-                oh.standard_fields.major_linker_version,
-                oh.standard_fields.minor_linker_version,
+                oh.standard_fields.major_linker_version, oh.standard_fields.minor_linker_version,
             )
         },
     );
@@ -117,47 +100,29 @@ pub fn parse_pe(
     let max_section_end = pe
         .sections
         .iter()
-        .map(|s| {
-            s.pointer_to_raw_data as u64
-                + s.size_of_raw_data as u64
-        })
+        .map(|s| s.pointer_to_raw_data as u64 + s.size_of_raw_data as u64)
         .max()
         .unwrap_or(0);
     let file_size = data.len() as u64;
-    let has_overlay =
-        max_section_end > 0 && max_section_end < file_size;
+    let has_overlay = max_section_end > 0 && max_section_end < file_size;
     let overlay_size = if has_overlay {
         file_size - max_section_end
     } else {
         0
     };
 
-    let pe_offset =
-        pe.header.dos_header.pe_pointer as usize;
-    let rich_header_present = detect_rich_header(
-        data,
-        pe_offset,
-    );
+    let pe_offset = pe.header.dos_header.pe_pointer as usize;
+    let rich_header_present = detect_rich_header(data, pe_offset);
 
     let pe_info = PeInfo {
         image_base,
         subsystem: subsystem_name(subsystem_raw),
         dll_characteristics: PeDllCharacteristics {
-            aslr: (dll_chars
-                & IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE)
-                != 0,
-            dep: (dll_chars
-                & IMAGE_DLLCHARACTERISTICS_NX_COMPAT)
-                != 0,
-            cfg: (dll_chars
-                & IMAGE_DLLCHARACTERISTICS_GUARD_CF)
-                != 0,
-            no_seh: (dll_chars
-                & IMAGE_DLLCHARACTERISTICS_NO_SEH)
-                != 0,
-            force_integrity: (dll_chars
-                & IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY)
-                != 0,
+            aslr: (dll_chars & IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) != 0,
+            dep: (dll_chars & IMAGE_DLLCHARACTERISTICS_NX_COMPAT) != 0,
+            cfg: (dll_chars & IMAGE_DLLCHARACTERISTICS_GUARD_CF) != 0,
+            no_seh: (dll_chars & IMAGE_DLLCHARACTERISTICS_NO_SEH) != 0,
+            force_integrity: (dll_chars & IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY) != 0,
         },
         timestamp,
         linker_version,
@@ -167,11 +132,7 @@ pub fn parse_pe(
         rich_header_present,
     };
 
-    let mut anomalies = detect_common_anomalies(
-        &sections,
-        entry_point,
-        is_stripped,
-    );
+    let mut anomalies = detect_common_anomalies(&sections, entry_point, is_stripped);
     detect_pe_anomalies(
         &mut anomalies,
         pe,
@@ -213,15 +174,9 @@ fn map_architecture(machine: u16) -> Architecture {
     match machine {
         COFF_MACHINE_I386 => Architecture::X86,
         COFF_MACHINE_AMD64 => Architecture::X86_64,
-        COFF_MACHINE_ARM | COFF_MACHINE_ARMNT => {
-            Architecture::Arm
-        }
+        COFF_MACHINE_ARM | COFF_MACHINE_ARMNT => Architecture::Arm,
         COFF_MACHINE_ARM64 => Architecture::Aarch64,
-        other => {
-            Architecture::Other(format!(
-                "pe-machine-{other:#x}"
-            ))
-        }
+        other => Architecture::Other(format!("pe-machine-{other:#x}")),
     }
 }
 
@@ -232,53 +187,33 @@ fn subsystem_name(subsystem: u16) -> String {
         IMAGE_SUBSYSTEM_WINDOWS_GUI => "GUI".into(),
         IMAGE_SUBSYSTEM_WINDOWS_CUI => "Console".into(),
         IMAGE_SUBSYSTEM_POSIX_CUI => "POSIX".into(),
-        IMAGE_SUBSYSTEM_WINDOWS_CE_GUI => {
-            "Windows CE".into()
-        }
-        IMAGE_SUBSYSTEM_EFI_APPLICATION => {
-            "EFI Application".into()
-        }
-        IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER => {
-            "EFI Boot Service Driver".into()
-        }
-        IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER => {
-            "EFI Runtime Driver".into()
-        }
+        IMAGE_SUBSYSTEM_WINDOWS_CE_GUI => "Windows CE".into(),
+        IMAGE_SUBSYSTEM_EFI_APPLICATION => "EFI Application".into(),
+        IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER => "EFI Boot Service Driver".into(),
+        IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER => "EFI Runtime Driver".into(),
         IMAGE_SUBSYSTEM_XBOX => "Xbox".into(),
         other => format!("Unknown({other})"),
     }
 }
 
-fn build_sections(
-    pe: &PE,
-    data: &[u8],
-) -> Vec<SectionInfo> {
+fn build_sections(pe: &PE, data: &[u8]) -> Vec<SectionInfo> {
     pe.sections
         .iter()
         .map(|section| {
-            let name = section
-                .name()
-                .unwrap_or_default()
-                .to_string();
-            let raw_offset =
-                section.pointer_to_raw_data as u64;
-            let raw_size =
-                section.size_of_raw_data as u64;
+            let name = section.name().unwrap_or_default().to_string();
+            let raw_offset = section.pointer_to_raw_data as u64;
+            let raw_size = section.size_of_raw_data as u64;
             let chars = section.characteristics;
             let permissions = SectionPermissions {
                 read: (chars & IMAGE_SCN_MEM_READ) != 0,
                 write: (chars & IMAGE_SCN_MEM_WRITE) != 0,
-                execute: (chars & IMAGE_SCN_MEM_EXECUTE)
-                    != 0,
+                execute: (chars & IMAGE_SCN_MEM_EXECUTE) != 0,
             };
-            let sha256 = compute_section_hash(
-                data, raw_offset, raw_size,
-            );
+            let sha256 = compute_section_hash(data, raw_offset, raw_size);
 
             SectionInfo {
                 name,
-                virtual_address: section.virtual_address
-                    as u64,
+                virtual_address: section.virtual_address as u64,
                 virtual_size: section.virtual_size as u64,
                 raw_offset,
                 raw_size,
@@ -293,10 +228,7 @@ fn build_segments(_pe: &PE) -> Vec<SegmentInfo> {
     Vec::new()
 }
 
-fn detect_rich_header(
-    data: &[u8],
-    pe_offset: usize,
-) -> bool {
+fn detect_rich_header(data: &[u8], pe_offset: usize) -> bool {
     let end = pe_offset.min(data.len());
     data[..end]
         .windows(RICH_SIGNATURE.len())
@@ -313,34 +245,24 @@ fn detect_pe_anomalies(
     file_size: u64,
 ) {
     if timestamp == 0 {
-        anomalies.push(
-            FormatAnomaly::SuspiciousTimestamp {
-                value: timestamp,
-                reason: "zeroed timestamp".into(),
-            },
-        );
+        anomalies.push(FormatAnomaly::SuspiciousTimestamp {
+            value: timestamp,
+            reason: "zeroed timestamp".into(),
+        });
     } else if timestamp < PE_TIMESTAMP_MIN_VALID {
-        anomalies.push(
-            FormatAnomaly::SuspiciousTimestamp {
-                value: timestamp,
-                reason: "timestamp before 1990".into(),
-            },
-        );
+        anomalies.push(FormatAnomaly::SuspiciousTimestamp {
+            value: timestamp,
+            reason: "timestamp before 1990".into(),
+        });
     } else if timestamp > PE_TIMESTAMP_MAX_VALID {
-        anomalies.push(
-            FormatAnomaly::SuspiciousTimestamp {
-                value: timestamp,
-                reason: "timestamp after 2100".into(),
-            },
-        );
+        anomalies.push(FormatAnomaly::SuspiciousTimestamp {
+            value: timestamp,
+            reason: "timestamp after 2100".into(),
+        });
     }
 
     if has_tls {
-        anomalies.push(
-            FormatAnomaly::TlsCallbacksPresent {
-                count: 1,
-            },
-        );
+        anomalies.push(FormatAnomaly::TlsCallbacksPresent { count: 1 });
     }
 
     if pe.imports.is_empty() {
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/lib.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/lib.rs
index 9b828638..c18d221e 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/lib.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/lib.rs
@@ -52,38 +52,30 @@ pub struct AnalysisEngine {
 
 impl AnalysisEngine {
     pub fn new() -> Result<Self, EngineError> {
-        let passes: Vec<Box<dyn pass::AnalysisPass>> =
-            vec![
-                Box::new(FormatPass),
-                Box::new(ImportPass),
-                Box::new(StringPass),
-                Box::new(EntropyPass),
-                Box::new(DisasmPass),
-                Box::new(ThreatPass),
-            ];
+        let passes: Vec<Box<dyn pass::AnalysisPass>> = vec![
+            Box::new(FormatPass),
+            Box::new(ImportPass),
+            Box::new(StringPass),
+            Box::new(EntropyPass),
+            Box::new(DisasmPass),
+            Box::new(ThreatPass),
+        ];
 
         let pass_manager = PassManager::new(passes);
 
         Ok(Self { pass_manager })
     }
 
-    pub fn analyze(
-        &self,
-        data: &[u8],
-        file_name: &str,
-    ) -> (AnalysisContext, PassReport) {
+    pub fn analyze(&self, data: &[u8], file_name: &str) -> (AnalysisContext, PassReport) {
         let sha256 = compute_sha256(data);
         let file_size = data.len() as u64;
         let mut ctx = AnalysisContext::new(
-            BinarySource::Buffered(Arc::from(
-                data.to_vec(),
-            )),
+            BinarySource::Buffered(Arc::from(data.to_vec())),
             sha256,
             file_name.to_string(),
             file_size,
         );
-        let report =
-            self.pass_manager.run_all(&mut ctx);
+        let report = self.pass_manager.run_all(&mut ctx);
         (ctx, report)
     }
 }
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/pass.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/pass.rs
index 5594abf7..f02956f5 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/pass.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/pass.rs
@@ -33,10 +33,7 @@ mod private {
 pub trait AnalysisPass: private::Sealed + Send + Sync {
     fn name(&self) -> &'static str;
     fn dependencies(&self) -> &[&'static str];
-    fn run(
-        &self,
-        ctx: &mut AnalysisContext,
-    ) -> Result<(), EngineError>;
+    fn run(&self, ctx: &mut AnalysisContext) -> Result<(), EngineError>;
 }
 
 #[derive(Debug, Clone)]
@@ -58,10 +55,7 @@ impl PassReport {
     }
 
     pub fn failed_passes(&self) -> Vec<&PassOutcome> {
-        self.outcomes
-            .iter()
-            .filter(|o| !o.success)
-            .collect()
+        self.outcomes.iter().filter(|o| !o.success).collect()
     }
 }
 
@@ -71,33 +65,23 @@ pub struct PassManager {
 }
 
 impl PassManager {
-    pub fn new(
-        passes: Vec<Box<dyn AnalysisPass>>,
-    ) -> Self {
+    pub fn new(passes: Vec<Box<dyn AnalysisPass>>) -> Self {
         let order = topological_order(&passes);
         Self { passes, order }
     }
 
-    pub fn run_all(
-        &self,
-        ctx: &mut AnalysisContext,
-    ) -> PassReport {
+    pub fn run_all(&self, ctx: &mut AnalysisContext) -> PassReport {
         let mut outcomes = Vec::with_capacity(self.passes.len());
 
         for &idx in &self.order {
             let pass = &self.passes[idx];
             let start = Instant::now();
             let result = pass.run(ctx);
-            let duration_ms =
-                start.elapsed().as_millis() as u64;
+            let duration_ms = start.elapsed().as_millis() as u64;
 
             let outcome = match result {
                 Ok(()) => {
-                    tracing::info!(
-                        pass = pass.name(),
-                        duration_ms,
-                        "pass completed"
-                    );
+                    tracing::info!(pass = pass.name(), duration_ms, "pass completed");
                     PassOutcome {
                         name: pass.name(),
                         success: true,
@@ -128,9 +112,7 @@ impl PassManager {
     }
 }
 
-fn topological_order(
-    passes: &[Box<dyn AnalysisPass>],
-) -> Vec<usize> {
+fn topological_order(passes: &[Box<dyn AnalysisPass>]) -> Vec<usize> {
     let name_to_idx: HashMap<&str, usize> = passes
         .iter()
         .enumerate()
@@ -143,8 +125,7 @@ fn topological_order(
 
     for (idx, pass) in passes.iter().enumerate() {
         for dep_name in pass.dependencies() {
-            if let Some(&dep_idx) = name_to_idx.get(dep_name)
-            {
+            if let Some(&dep_idx) = name_to_idx.get(dep_name) {
                 adjacency[dep_idx].push(idx);
                 in_degree[idx] += 1;
             }
@@ -204,10 +185,7 @@ mod tests {
             &self.deps
         }
 
-        fn run(
-            &self,
-            _ctx: &mut AnalysisContext,
-        ) -> Result<(), EngineError> {
+        fn run(&self, _ctx: &mut AnalysisContext) -> Result<(), EngineError> {
             self.log.lock().unwrap().push(self.name);
             if self.should_fail {
                 return Err(EngineError::PassFailed {
@@ -221,9 +199,7 @@ mod tests {
 
     fn make_ctx() -> AnalysisContext {
         AnalysisContext::new(
-            crate::context::BinarySource::Buffered(
-                Arc::from(vec![0u8; 4]),
-            ),
+            crate::context::BinarySource::Buffered(Arc::from(vec![0u8; 4])),
             "deadbeef".into(),
             "test.bin".into(),
             4,
@@ -295,16 +271,10 @@ mod tests {
         let report = manager.run_all(&mut ctx);
 
         let execution_order = log.lock().unwrap().clone();
-        assert_eq!(
-            execution_order,
-            vec!["first", "second", "third"]
-        );
+        assert_eq!(execution_order, vec!["first", "second", "third"]);
         assert!(!report.all_succeeded());
         assert_eq!(report.failed_passes().len(), 1);
-        assert_eq!(
-            report.failed_passes()[0].name,
-            "second"
-        );
+        assert_eq!(report.failed_passes()[0].name, "second");
     }
 
     #[test]
@@ -343,14 +313,10 @@ mod tests {
         manager.run_all(&mut ctx);
 
         let order = log.lock().unwrap().clone();
-        let format_pos =
-            order.iter().position(|&n| n == "format").unwrap();
-        let imports_pos =
-            order.iter().position(|&n| n == "imports").unwrap();
-        let entropy_pos =
-            order.iter().position(|&n| n == "entropy").unwrap();
-        let score_pos =
-            order.iter().position(|&n| n == "score").unwrap();
+        let format_pos = order.iter().position(|&n| n == "format").unwrap();
+        let imports_pos = order.iter().position(|&n| n == "imports").unwrap();
+        let entropy_pos = order.iter().position(|&n| n == "entropy").unwrap();
+        let score_pos = order.iter().position(|&n| n == "score").unwrap();
 
         assert!(format_pos < imports_pos);
         assert!(format_pos < entropy_pos);
@@ -385,14 +351,12 @@ mod tests {
     fn reports_duration() {
         let log = Arc::new(Mutex::new(Vec::new()));
 
-        let passes: Vec<Box<dyn AnalysisPass>> = vec![
-            Box::new(MockPass {
-                name: "fast",
-                deps: vec![],
-                log: Arc::clone(&log),
-                should_fail: false,
-            }),
-        ];
+        let passes: Vec<Box<dyn AnalysisPass>> = vec![Box::new(MockPass {
+            name: "fast",
+            deps: vec![],
+            log: Arc::clone(&log),
+            should_fail: false,
+        })];
 
         let manager = PassManager::new(passes);
         let mut ctx = make_ctx();
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/disasm.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/disasm.rs
index 4eb68087..a5ed396d 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/disasm.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/disasm.rs
@@ -41,23 +41,16 @@
 //                     FlowControlType
 //   error.rs       - EngineError
 
-use std::collections::{
-    BTreeMap, HashMap, HashSet, VecDeque,
-};
+use std::collections::{BTreeMap, HashMap, HashSet, VecDeque};
 
-use iced_x86::{
-    Decoder, DecoderOptions, FlowControl, Formatter,
-    Instruction, IntelFormatter,
-};
+use iced_x86::{Decoder, DecoderOptions, FlowControl, Formatter, Instruction, IntelFormatter};
 use serde::{Deserialize, Serialize};
 
 use crate::context::AnalysisContext;
 use crate::error::EngineError;
 use crate::formats::SectionInfo;
 use crate::pass::{AnalysisPass, Sealed};
-use crate::types::{
-    Architecture, CfgEdgeType, FlowControlType,
-};
+use crate::types::{Architecture, CfgEdgeType, FlowControlType};
 
 const MAX_FUNCTIONS: usize = 1000;
 const MAX_INSTRUCTIONS: usize = 50_000;
@@ -103,9 +96,7 @@ pub struct InstructionInfo {
     pub flow_control: FlowControlType,
 }
 
-#[derive(
-    Debug, Clone, Default, Serialize, Deserialize,
-)]
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub struct FunctionCfg {
     pub nodes: Vec<CfgNode>,
     pub edges: Vec<CfgEdge>,
@@ -139,17 +130,14 @@ impl AnalysisPass for DisasmPass {
         &["format"]
     }
 
-    fn run(
-        &self,
-        ctx: &mut AnalysisContext,
-    ) -> Result<(), EngineError> {
-        let format_result = ctx
-            .format_result
-            .as_ref()
-            .ok_or_else(|| EngineError::MissingDependency {
-                pass: "disasm".into(),
-                dependency: "format".into(),
-            })?;
+    fn run(&self, ctx: &mut AnalysisContext) -> Result<(), EngineError> {
+        let format_result =
+            ctx.format_result
+                .as_ref()
+                .ok_or_else(|| EngineError::MissingDependency {
+                    pass: "disasm".into(),
+                    dependency: "format".into(),
+                })?;
 
         let arch = &format_result.architecture;
         let bits = match arch {
@@ -157,10 +145,7 @@ impl AnalysisPass for DisasmPass {
             Architecture::X86_64 => 64,
             _ => {
                 ctx.disassembly_result =
-                    Some(empty_result(
-                        format_result.bits,
-                        format_result.entry_point,
-                    ));
+                    Some(empty_result(format_result.bits, format_result.entry_point));
                 return Ok(());
             }
         };
@@ -170,26 +155,15 @@ impl AnalysisPass for DisasmPass {
         let entry_point = format_result.entry_point;
 
         let mut seeds = vec![entry_point];
-        seeds.extend_from_slice(
-            &format_result.function_hints,
-        );
+        seeds.extend_from_slice(&format_result.function_hints);
 
-        let result = disassemble(
-            data,
-            sections,
-            bits,
-            entry_point,
-            &seeds,
-        );
+        let result = disassemble(data, sections, bits, entry_point, &seeds);
         ctx.disassembly_result = Some(result);
         Ok(())
     }
 }
 
-fn empty_result(
-    bits: u8,
-    entry_point: u64,
-) -> DisassemblyResult {
+fn empty_result(bits: u8, entry_point: u64) -> DisassemblyResult {
     DisassemblyResult {
         functions: Vec::new(),
         total_instructions: 0,
@@ -214,34 +188,28 @@ fn disassemble(
     let mut functions = Vec::new();
     let mut visited_functions = HashSet::new();
     let mut total_instructions = 0;
-    let mut function_queue: VecDeque<u64> =
-        seeds.iter().copied().collect();
+    let mut function_queue: VecDeque<u64> = seeds.iter().copied().collect();
 
-    while let Some(func_addr) = function_queue.pop_front()
-    {
-        if functions.len() >= MAX_FUNCTIONS
-            || total_instructions >= MAX_INSTRUCTIONS
-        {
+    while let Some(func_addr) = function_queue.pop_front() {
+        if functions.len() >= MAX_FUNCTIONS || total_instructions >= MAX_INSTRUCTIONS {
             break;
         }
         if !visited_functions.insert(func_addr) {
             continue;
         }
-        if vaddr_to_offset(sections, func_addr).is_none()
-        {
+        if vaddr_to_offset(sections, func_addr).is_none() {
             continue;
         }
 
-        let (func_info, discovered_calls) =
-            disassemble_function(
-                data,
-                sections,
-                &exec_sections,
-                bits,
-                func_addr,
-                func_addr == entry_point,
-                MAX_INSTRUCTIONS - total_instructions,
-            );
+        let (func_info, discovered_calls) = disassemble_function(
+            data,
+            sections,
+            &exec_sections,
+            bits,
+            func_addr,
+            func_addr == entry_point,
+            MAX_INSTRUCTIONS - total_instructions,
+        );
 
         total_instructions += func_info.instruction_count;
         functions.push(func_info);
@@ -273,8 +241,7 @@ fn disassemble_function(
     is_entry_point: bool,
     instruction_budget: usize,
 ) -> (FunctionInfo, Vec<u64>) {
-    let mut decoded: BTreeMap<u64, DecodedInstruction> =
-        BTreeMap::new();
+    let mut decoded: BTreeMap<u64, DecodedInstruction> = BTreeMap::new();
     let mut block_leaders: HashSet<u64> = HashSet::new();
     let mut worklist: VecDeque<u64> = VecDeque::new();
     let mut visited: HashSet<u64> = HashSet::new();
@@ -292,10 +259,7 @@ fn disassemble_function(
             break;
         }
 
-        let offset = match vaddr_to_offset(
-            all_sections,
-            addr,
-        ) {
+        let offset = match vaddr_to_offset(all_sections, addr) {
             Some(o) => o as usize,
             None => continue,
         };
@@ -310,17 +274,10 @@ fn disassemble_function(
         }
 
         let slice = &data[offset..];
-        let mut decoder = Decoder::with_ip(
-            bits,
-            slice,
-            addr,
-            DecoderOptions::NONE,
-        );
+        let mut decoder = Decoder::with_ip(bits, slice, addr, DecoderOptions::NONE);
         let mut instr = Instruction::default();
 
-        while decoder.can_decode()
-            && decoded.len() < instruction_budget
-        {
+        while decoder.can_decode() && decoded.len() < instruction_budget {
             decoder.decode_out(&mut instr);
             let ip = instr.ip();
 
@@ -328,30 +285,21 @@ fn disassemble_function(
                 break;
             }
 
-            if ip != addr
-                && block_leaders.contains(&ip)
-            {
+            if ip != addr && block_leaders.contains(&ip) {
                 break;
             }
 
             let fc = instr.flow_control();
-            let mnemonic = format!("{:?}", instr.mnemonic())
-                .to_ascii_lowercase();
+            let mnemonic = format!("{:?}", instr.mnemonic()).to_ascii_lowercase();
 
             let mut operands_str = String::new();
-            formatter
-                .format(&instr, &mut operands_str);
+            formatter.format(&instr, &mut operands_str);
             let operands = operands_str
                 .split_once(' ')
-                .map_or(String::new(), |(_, ops)| {
-                    ops.to_string()
-                });
+                .map_or(String::new(), |(_, ops)| ops.to_string());
 
-            let instr_bytes = &data
-                [offset + (ip - addr) as usize
-                    ..offset
-                        + (ip - addr) as usize
-                        + instr.len()];
+            let instr_bytes =
+                &data[offset + (ip - addr) as usize..offset + (ip - addr) as usize + instr.len()];
 
             let flow_type = map_flow_control(fc);
 
@@ -374,13 +322,10 @@ fn disassemble_function(
 
             match fc {
                 FlowControl::ConditionalBranch => {
-                    let target =
-                        instr.near_branch_target();
+                    let target = instr.near_branch_target();
                     let fall = instr.next_ip();
 
-                    if let Some(di) =
-                        decoded.get_mut(&ip)
-                    {
+                    if let Some(di) = decoded.get_mut(&ip) {
                         di.branch_target = Some(target);
                         di.fallthrough = Some(fall);
                     }
@@ -392,11 +337,8 @@ fn disassemble_function(
                     break;
                 }
                 FlowControl::UnconditionalBranch => {
-                    let target =
-                        instr.near_branch_target();
-                    if let Some(di) =
-                        decoded.get_mut(&ip)
-                    {
+                    let target = instr.near_branch_target();
+                    if let Some(di) = decoded.get_mut(&ip) {
                         di.branch_target = Some(target);
                     }
                     block_leaders.insert(target);
@@ -410,45 +352,32 @@ fn disassemble_function(
                     break;
                 }
                 FlowControl::Call => {
-                    let target =
-                        instr.near_branch_target();
+                    let target = instr.near_branch_target();
                     if target != 0 {
                         discovered_calls.push(target);
                     }
                 }
                 FlowControl::IndirectCall => {}
-                FlowControl::Next
-                | FlowControl::XbeginXabortXend => {}
+                FlowControl::Next | FlowControl::XbeginXabortXend => {}
             }
         }
     }
 
-    let basic_blocks = build_basic_blocks(
-        &decoded,
-        &block_leaders,
-    );
-    let instruction_count: usize = basic_blocks
-        .iter()
-        .map(|bb| bb.instruction_count)
-        .sum();
+    let basic_blocks = build_basic_blocks(&decoded, &block_leaders);
+    let instruction_count: usize = basic_blocks.iter().map(|bb| bb.instruction_count).sum();
 
-    let size = if let (Some(first), Some(last)) = (
-        decoded.keys().next(),
-        decoded.keys().next_back(),
-    ) {
-        if let Some(last_instr) = decoded.get(last) {
-            last_instr.info.address
-                + last_instr.info.size as u64
-                - first
+    let size =
+        if let (Some(first), Some(last)) = (decoded.keys().next(), decoded.keys().next_back()) {
+            if let Some(last_instr) = decoded.get(last) {
+                last_instr.info.address + last_instr.info.size as u64 - first
+            } else {
+                0
+            }
         } else {
             0
-        }
-    } else {
-        0
-    };
+        };
 
-    let cfg = if instruction_count <= CFG_INSTRUCTION_LIMIT
-    {
+    let cfg = if instruction_count <= CFG_INSTRUCTION_LIMIT {
         build_cfg(&basic_blocks)
     } else {
         FunctionCfg::default()
@@ -483,14 +412,11 @@ fn build_basic_blocks(
     }
 
     let mut blocks: Vec<BasicBlockInfo> = Vec::new();
-    let mut current_instrs: Vec<InstructionInfo> =
-        Vec::new();
+    let mut current_instrs: Vec<InstructionInfo> = Vec::new();
     let mut block_start: Option<u64> = None;
 
     for (&addr, di) in decoded {
-        if leaders.contains(&addr)
-            && !current_instrs.is_empty()
-        {
+        if leaders.contains(&addr) && !current_instrs.is_empty() {
             let bb = finalize_block(
                 &current_instrs,
                 block_start.unwrap_or(addr),
@@ -527,35 +453,24 @@ fn build_basic_blocks(
         }
     }
 
-    if !current_instrs.is_empty() {
-        if let Some(start) = block_start {
-            let bb = finalize_block(
-                &current_instrs,
-                start,
-                decoded,
-                leaders,
-            );
-            blocks.push(bb);
-        }
+    if !current_instrs.is_empty()
+        && let Some(start) = block_start
+    {
+        let bb = finalize_block(&current_instrs, start, decoded, leaders);
+        blocks.push(bb);
     }
 
-    let block_starts: HashSet<u64> =
-        blocks.iter().map(|b| b.start_address).collect();
+    let block_starts: HashSet<u64> = blocks.iter().map(|b| b.start_address).collect();
 
     for block in &mut blocks {
-        block
-            .successors
-            .retain(|s| block_starts.contains(s));
+        block.successors.retain(|s| block_starts.contains(s));
     }
 
     let predecessor_map: HashMap<u64, Vec<u64>> = {
-        let mut map: HashMap<u64, Vec<u64>> =
-            HashMap::new();
+        let mut map: HashMap<u64, Vec<u64>> = HashMap::new();
         for block in &blocks {
             for &succ in &block.successors {
-                map.entry(succ)
-                    .or_default()
-                    .push(block.start_address);
+                map.entry(succ).or_default().push(block.start_address);
             }
         }
         map
@@ -578,8 +493,7 @@ fn finalize_block(
     leaders: &HashSet<u64>,
 ) -> BasicBlockInfo {
     let last = instructions.last().unwrap();
-    let end_address =
-        last.address + last.size as u64 - 1;
+    let end_address = last.address + last.size as u64 - 1;
 
     let mut successors = Vec::new();
     let last_addr = last.address;
@@ -591,14 +505,10 @@ fn finalize_block(
             successors.push(fall);
         } else if !matches!(
             di.info.flow_control,
-            FlowControlType::Branch
-                | FlowControlType::Return
-                | FlowControlType::Interrupt
+            FlowControlType::Branch | FlowControlType::Return | FlowControlType::Interrupt
         ) {
             let next = di.next_ip;
-            if leaders.contains(&next)
-                || decoded.contains_key(&next)
-            {
+            if leaders.contains(&next) || decoded.contains_key(&next) {
                 successors.push(next);
             }
         }
@@ -614,9 +524,7 @@ fn finalize_block(
     }
 }
 
-fn build_cfg(
-    blocks: &[BasicBlockInfo],
-) -> FunctionCfg {
+fn build_cfg(blocks: &[BasicBlockInfo]) -> FunctionCfg {
     let mut nodes = Vec::new();
     let mut edges = Vec::new();
 
@@ -635,40 +543,28 @@ fn build_cfg(
 
         nodes.push(CfgNode {
             id: block.start_address,
-            label: format!(
-                "0x{:x}",
-                block.start_address
-            ),
+            label: format!("0x{:x}", block.start_address),
             instruction_count: block.instruction_count,
             instructions_preview: preview,
         });
 
         let last_instr = block.instructions.last();
         for &succ in &block.successors {
-            let edge_type =
-                if let Some(last) = last_instr {
-                    match last.flow_control {
-                        FlowControlType::ConditionalBranch => {
-                            if succ
-                                == block
-                                    .successors
-                                    .first()
-                                    .copied()
-                                    .unwrap_or(0)
-                            {
-                                CfgEdgeType::ConditionalTrue
-                            } else {
-                                CfgEdgeType::ConditionalFalse
-                            }
+            let edge_type = if let Some(last) = last_instr {
+                match last.flow_control {
+                    FlowControlType::ConditionalBranch => {
+                        if succ == block.successors.first().copied().unwrap_or(0) {
+                            CfgEdgeType::ConditionalTrue
+                        } else {
+                            CfgEdgeType::ConditionalFalse
                         }
-                        FlowControlType::Branch => {
-                            CfgEdgeType::Unconditional
-                        }
-                        _ => CfgEdgeType::Fallthrough,
                     }
-                } else {
-                    CfgEdgeType::Fallthrough
-                };
+                    FlowControlType::Branch => CfgEdgeType::Unconditional,
+                    _ => CfgEdgeType::Fallthrough,
+                }
+            } else {
+                CfgEdgeType::Fallthrough
+            };
 
             edges.push(CfgEdge {
                 from: block.start_address,
@@ -681,99 +577,54 @@ fn build_cfg(
     FunctionCfg { nodes, edges }
 }
 
-fn vaddr_to_offset(
-    sections: &[SectionInfo],
-    vaddr: u64,
-) -> Option<u64> {
+fn vaddr_to_offset(sections: &[SectionInfo], vaddr: u64) -> Option<u64> {
     sections.iter().find_map(|s| {
         if s.raw_size > 0
             && vaddr >= s.virtual_address
-            && vaddr
-                < s.virtual_address + s.virtual_size
+            && vaddr < s.virtual_address + s.virtual_size
         {
-            Some(
-                s.raw_offset
-                    + (vaddr - s.virtual_address),
-            )
+            Some(s.raw_offset + (vaddr - s.virtual_address))
         } else {
             None
         }
     })
 }
 
-fn is_in_exec_section(
-    exec_sections: &[&SectionInfo],
-    vaddr: u64,
-) -> bool {
-    exec_sections.iter().any(|s| {
-        vaddr >= s.virtual_address
-            && vaddr
-                < s.virtual_address + s.virtual_size
-    })
+fn is_in_exec_section(exec_sections: &[&SectionInfo], vaddr: u64) -> bool {
+    exec_sections
+        .iter()
+        .any(|s| vaddr >= s.virtual_address && vaddr < s.virtual_address + s.virtual_size)
 }
 
-fn map_flow_control(
-    fc: FlowControl,
-) -> FlowControlType {
+fn map_flow_control(fc: FlowControl) -> FlowControlType {
     match fc {
-        FlowControl::Next
-        | FlowControl::XbeginXabortXend => {
-            FlowControlType::Next
-        }
-        FlowControl::UnconditionalBranch
-        | FlowControl::IndirectBranch => {
-            FlowControlType::Branch
-        }
-        FlowControl::ConditionalBranch => {
-            FlowControlType::ConditionalBranch
-        }
-        FlowControl::Call
-        | FlowControl::IndirectCall => {
-            FlowControlType::Call
-        }
+        FlowControl::Next | FlowControl::XbeginXabortXend => FlowControlType::Next,
+        FlowControl::UnconditionalBranch | FlowControl::IndirectBranch => FlowControlType::Branch,
+        FlowControl::ConditionalBranch => FlowControlType::ConditionalBranch,
+        FlowControl::Call | FlowControl::IndirectCall => FlowControlType::Call,
         FlowControl::Return => FlowControlType::Return,
-        FlowControl::Interrupt
-        | FlowControl::Exception => {
-            FlowControlType::Interrupt
-        }
+        FlowControl::Interrupt | FlowControl::Exception => FlowControlType::Interrupt,
     }
 }
 
-pub fn disassemble_code(
-    code: &[u8],
-    base_addr: u64,
-    bits: u32,
-) -> Vec<InstructionInfo> {
-    let mut decoder = Decoder::with_ip(
-        bits,
-        code,
-        base_addr,
-        DecoderOptions::NONE,
-    );
+pub fn disassemble_code(code: &[u8], base_addr: u64, bits: u32) -> Vec<InstructionInfo> {
+    let mut decoder = Decoder::with_ip(bits, code, base_addr, DecoderOptions::NONE);
     let mut formatter = IntelFormatter::new();
     let mut instr = Instruction::default();
     let mut result = Vec::new();
 
     while decoder.can_decode() {
         decoder.decode_out(&mut instr);
-        let mnemonic = format!(
-            "{:?}",
-            instr.mnemonic()
-        )
-        .to_ascii_lowercase();
+        let mnemonic = format!("{:?}", instr.mnemonic()).to_ascii_lowercase();
 
         let mut full = String::new();
         formatter.format(&instr, &mut full);
         let operands = full
             .split_once(' ')
-            .map_or(String::new(), |(_, ops)| {
-                ops.to_string()
-            });
+            .map_or(String::new(), |(_, ops)| ops.to_string());
 
-        let start =
-            (instr.ip() - base_addr) as usize;
-        let bytes =
-            code[start..start + instr.len()].to_vec();
+        let start = (instr.ip() - base_addr) as usize;
+        let bytes = code[start..start + instr.len()].to_vec();
 
         result.push(InstructionInfo {
             address: instr.ip(),
@@ -781,9 +632,7 @@ pub fn disassemble_code(
             mnemonic,
             operands,
             size: instr.len() as u8,
-            flow_control: map_flow_control(
-                instr.flow_control(),
-            ),
+            flow_control: map_flow_control(instr.flow_control()),
         });
     }
 
@@ -799,13 +648,8 @@ mod tests {
     use crate::types::SectionPermissions;
 
     fn load_fixture(name: &str) -> Vec<u8> {
-        let path = format!(
-            "{}/tests/fixtures/{name}",
-            env!("CARGO_MANIFEST_DIR"),
-        );
-        std::fs::read(&path).unwrap_or_else(|e| {
-            panic!("fixture {path}: {e}")
-        })
+        let path = format!("{}/tests/fixtures/{name}", env!("CARGO_MANIFEST_DIR"),);
+        std::fs::read(&path).unwrap_or_else(|e| panic!("fixture {path}: {e}"))
     }
 
     fn make_ctx(data: Vec<u8>) -> AnalysisContext {
@@ -820,27 +664,17 @@ mod tests {
 
     #[test]
     fn disassemble_simple_function() {
-        let code: &[u8] = &[
-            0x55, 0x48, 0x89, 0xE5, 0x31, 0xC0,
-            0x5D, 0xC3,
-        ];
-        let instrs =
-            disassemble_code(code, 0x1000, 64);
+        let code: &[u8] = &[0x55, 0x48, 0x89, 0xE5, 0x31, 0xC0, 0x5D, 0xC3];
+        let instrs = disassemble_code(code, 0x1000, 64);
         assert_eq!(instrs.len(), 5);
         assert_eq!(instrs[0].mnemonic, "push");
         assert_eq!(instrs[4].mnemonic, "ret");
-        assert_eq!(
-            instrs[4].flow_control,
-            FlowControlType::Return
-        );
+        assert_eq!(instrs[4].flow_control, FlowControlType::Return);
     }
 
     #[test]
     fn basic_block_split_on_branch() {
-        let code: &[u8] = &[
-            0x31, 0xC0, 0x85, 0xC0, 0x74, 0x02,
-            0x31, 0xC9, 0xC3,
-        ];
+        let code: &[u8] = &[0x31, 0xC0, 0x85, 0xC0, 0x74, 0x02, 0x31, 0xC9, 0xC3];
 
         let sections = vec![SectionInfo {
             name: ".text".into(),
@@ -856,13 +690,7 @@ mod tests {
             sha256: String::new(),
         }];
 
-        let result = disassemble(
-            code,
-            &sections,
-            64,
-            0x1000,
-            &[0x1000],
-        );
+        let result = disassemble(code, &sections, 64, 0x1000, &[0x1000]);
         assert!(!result.functions.is_empty());
         let func = &result.functions[0];
         assert!(
@@ -874,10 +702,7 @@ mod tests {
 
     #[test]
     fn cfg_edges_conditional() {
-        let code: &[u8] = &[
-            0x31, 0xC0, 0x85, 0xC0, 0x74, 0x02,
-            0x31, 0xC9, 0xC3,
-        ];
+        let code: &[u8] = &[0x31, 0xC0, 0x85, 0xC0, 0x74, 0x02, 0x31, 0xC9, 0xC3];
 
         let sections = vec![SectionInfo {
             name: ".text".into(),
@@ -893,47 +718,33 @@ mod tests {
             sha256: String::new(),
         }];
 
-        let result = disassemble(
-            code,
-            &sections,
-            64,
-            0x1000,
-            &[0x1000],
-        );
+        let result = disassemble(code, &sections, 64, 0x1000, &[0x1000]);
         let func = &result.functions[0];
-        assert!(
-            !func.cfg.edges.is_empty(),
-            "CFG should have edges"
-        );
-        assert!(
-            !func.cfg.nodes.is_empty(),
-            "CFG should have nodes"
-        );
+        assert!(!func.cfg.edges.is_empty(), "CFG should have edges");
+        assert!(!func.cfg.nodes.is_empty(), "CFG should have nodes");
     }
 
     #[test]
     fn non_x86_returns_empty() {
         let data = vec![0u8; 64];
         let mut ctx = make_ctx(data);
-        ctx.format_result =
-            Some(crate::formats::FormatResult {
-                format: crate::types::BinaryFormat::Elf,
-                architecture: Architecture::Aarch64,
-                bits: 64,
-                endianness:
-                    crate::types::Endianness::Little,
-                entry_point: 0x1000,
-                is_stripped: false,
-                is_pie: false,
-                has_debug_info: false,
-                sections: Vec::new(),
-                segments: Vec::new(),
-                anomalies: Vec::new(),
-                pe_info: None,
-                elf_info: None,
-                macho_info: None,
-                function_hints: Vec::new(),
-            });
+        ctx.format_result = Some(crate::formats::FormatResult {
+            format: crate::types::BinaryFormat::Elf,
+            architecture: Architecture::Aarch64,
+            bits: 64,
+            endianness: crate::types::Endianness::Little,
+            entry_point: 0x1000,
+            is_stripped: false,
+            is_pie: false,
+            has_debug_info: false,
+            sections: Vec::new(),
+            segments: Vec::new(),
+            anomalies: Vec::new(),
+            pe_info: None,
+            elf_info: None,
+            macho_info: None,
+            function_hints: Vec::new(),
+        });
 
         DisasmPass.run(&mut ctx).unwrap();
         let result = ctx.disassembly_result.unwrap();
@@ -946,28 +757,22 @@ mod tests {
         let data = load_fixture("hello_elf");
         let mut ctx = make_ctx(data);
 
-        crate::passes::format::FormatPass
-            .run(&mut ctx)
-            .unwrap();
+        crate::passes::format::FormatPass.run(&mut ctx).unwrap();
         DisasmPass.run(&mut ctx).unwrap();
 
-        let result =
-            ctx.disassembly_result.as_ref().unwrap();
+        let result = ctx.disassembly_result.as_ref().unwrap();
         assert!(
             result.total_functions > 0,
             "should find at least one function"
         );
         assert!(result.total_instructions > 0);
 
-        let entry_func = result.functions.iter().find(
-            |f| {
-                f.address
-                    == result.entry_function_address
-            },
-        );
+        let entry_func = result
+            .functions
+            .iter()
+            .find(|f| f.address == result.entry_function_address);
         assert!(
-            entry_func.is_some()
-                || !result.functions.is_empty(),
+            entry_func.is_some() || !result.functions.is_empty(),
             "should have disassembled functions"
         );
     }
@@ -977,9 +782,7 @@ mod tests {
         let data = load_fixture("hello_elf");
         let mut ctx = make_ctx(data);
 
-        crate::passes::format::FormatPass
-            .run(&mut ctx)
-            .unwrap();
+        crate::passes::format::FormatPass.run(&mut ctx).unwrap();
         assert!(ctx.disassembly_result.is_none());
 
         DisasmPass.run(&mut ctx).unwrap();
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/entropy.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/entropy.rs
index 69ae98f9..85105a02 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/entropy.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/entropy.rs
@@ -42,9 +42,7 @@ use crate::context::AnalysisContext;
 use crate::error::EngineError;
 use crate::formats::SectionInfo;
 use crate::pass::{AnalysisPass, Sealed};
-use crate::types::{
-    EntropyClassification, EntropyFlag,
-};
+use crate::types::{EntropyClassification, EntropyFlag};
 
 const PLAINTEXT_MAX: f64 = 3.5;
 const NATIVE_CODE_MAX: f64 = 6.0;
@@ -120,34 +118,23 @@ impl AnalysisPass for EntropyPass {
         &["format"]
     }
 
-    fn run(
-        &self,
-        ctx: &mut AnalysisContext,
-    ) -> Result<(), EngineError> {
-        let format_result = ctx
-            .format_result
-            .as_ref()
-            .ok_or_else(|| EngineError::MissingDependency {
-                pass: "entropy".into(),
-                dependency: "format".into(),
-            })?;
+    fn run(&self, ctx: &mut AnalysisContext) -> Result<(), EngineError> {
+        let format_result =
+            ctx.format_result
+                .as_ref()
+                .ok_or_else(|| EngineError::MissingDependency {
+                    pass: "entropy".into(),
+                    dependency: "format".into(),
+                })?;
 
         let data = ctx.data();
-        let result = analyze_entropy(
-            data,
-            &format_result.sections,
-            format_result.entry_point,
-        );
+        let result = analyze_entropy(data, &format_result.sections, format_result.entry_point);
         ctx.entropy_result = Some(result);
         Ok(())
     }
 }
 
-fn analyze_entropy(
-    data: &[u8],
-    sections: &[SectionInfo],
-    entry_point: u64,
-) -> EntropyResult {
+fn analyze_entropy(data: &[u8], sections: &[SectionInfo], entry_point: u64) -> EntropyResult {
     let overall_entropy = shannon_entropy(data);
     let mut section_entropies = Vec::new();
     let mut packing_indicators = Vec::new();
@@ -155,11 +142,7 @@ fn analyze_entropy(
     let mut structural_count = 0;
 
     for section in sections {
-        let section_data = read_section_data(
-            data,
-            section.raw_offset,
-            section.raw_size,
-        );
+        let section_data = read_section_data(data, section.raw_offset, section.raw_size);
         let entropy = if section_data.is_empty() {
             0.0
         } else {
@@ -167,8 +150,7 @@ fn analyze_entropy(
         };
         let classification = classify_entropy(entropy);
         let vr_ratio = if section.raw_size > 0 {
-            section.virtual_size as f64
-                / section.raw_size as f64
+            section.virtual_size as f64 / section.raw_size as f64
         } else {
             0.0
         };
@@ -181,24 +163,18 @@ fn analyze_entropy(
         if vr_ratio > VIRTUAL_RAW_RATIO_THRESHOLD {
             flags.push(EntropyFlag::HighVirtualToRawRatio);
         }
-        if section.raw_size == 0
-            && section.virtual_size > 0
-        {
+        if section.raw_size == 0 && section.virtual_size > 0 {
             flags.push(EntropyFlag::EmptyRawData);
         }
         if section.permissions.is_rwx() {
             flags.push(EntropyFlag::Rwx);
         }
 
-        if let Some(packer) =
-            detect_packer_by_section(&section.name)
-        {
+        if let Some(packer) = detect_packer_by_section(&section.name) {
             flags.push(EntropyFlag::PackerSectionName);
             packing_indicators.push(PackingIndicator {
                 indicator_type: "section_name".into(),
-                description: format!(
-                    "Section name matches {packer} packer"
-                ),
+                description: format!("Section name matches {packer} packer"),
                 evidence: section.name.clone(),
                 packer_name: Some(packer.into()),
             });
@@ -207,17 +183,13 @@ fn analyze_entropy(
             }
         }
 
-        if section.raw_size == 0
-            && section.virtual_size > 0
-            && section.permissions.execute
-        {
+        if section.raw_size == 0 && section.virtual_size > 0 && section.permissions.execute {
             structural_count += 1;
             packing_indicators.push(PackingIndicator {
                 indicator_type: "structural".into(),
-                description:
-                    "Empty raw data with executable \
+                description: "Empty raw data with executable \
                      virtual section"
-                        .into(),
+                    .into(),
                 evidence: format!(
                     "section={} raw=0 virtual={}",
                     section.name, section.virtual_size
@@ -230,13 +202,8 @@ fn analyze_entropy(
             structural_count += 1;
             packing_indicators.push(PackingIndicator {
                 indicator_type: "structural".into(),
-                description:
-                    "High virtual to raw size ratio"
-                        .into(),
-                evidence: format!(
-                    "section={} ratio={vr_ratio:.1}",
-                    section.name
-                ),
+                description: "High virtual to raw size ratio".into(),
+                evidence: format!("section={} ratio={vr_ratio:.1}", section.name),
                 packer_name: None,
             });
         }
@@ -254,38 +221,27 @@ fn analyze_entropy(
         });
     }
 
-    if let Some(ep_section) = find_ep_section(
-        sections,
-        entry_point,
-    ) {
+    if let Some(ep_section) = find_ep_section(sections, entry_point) {
         let ep_file_offset = entry_point
             .wrapping_sub(ep_section.virtual_address)
             .wrapping_add(ep_section.raw_offset);
-        if let Some(&first_byte) =
-            data.get(ep_file_offset as usize)
+        if let Some(&first_byte) = data.get(ep_file_offset as usize)
+            && first_byte == PUSHAD_OPCODE
         {
-            if first_byte == PUSHAD_OPCODE {
-                packing_indicators.push(
-                    PackingIndicator {
-                        indicator_type: "entry_point"
-                            .into(),
-                        description:
-                            "PUSHAD at entry point"
-                                .into(),
-                        evidence: format!(
-                            "byte 0x{PUSHAD_OPCODE:02x} \
+            packing_indicators.push(PackingIndicator {
+                indicator_type: "entry_point".into(),
+                description: "PUSHAD at entry point".into(),
+                evidence: format!(
+                    "byte 0x{PUSHAD_OPCODE:02x} \
                              at EP offset 0x{ep_file_offset:x}"
-                        ),
-                        packer_name: None,
-                    },
-                );
-            }
+                ),
+                packer_name: None,
+            });
         }
     }
 
-    let packing_detected = packer_name.is_some()
-        || structural_count
-            >= STRUCTURAL_INDICATORS_FOR_PACKING;
+    let packing_detected =
+        packer_name.is_some() || structural_count >= STRUCTURAL_INDICATORS_FOR_PACKING;
 
     EntropyResult {
         overall_entropy,
@@ -314,9 +270,7 @@ fn shannon_entropy(data: &[u8]) -> f64 {
         .sum()
 }
 
-fn classify_entropy(
-    entropy: f64,
-) -> EntropyClassification {
+fn classify_entropy(entropy: f64) -> EntropyClassification {
     if entropy < PLAINTEXT_MAX {
         EntropyClassification::Plaintext
     } else if entropy < NATIVE_CODE_MAX {
@@ -330,20 +284,14 @@ fn classify_entropy(
     }
 }
 
-fn detect_packer_by_section(
-    name: &str,
-) -> Option<&'static str> {
+fn detect_packer_by_section(name: &str) -> Option<&'static str> {
     PACKER_SECTION_NAMES
         .iter()
         .find(|&&(section_name, _)| section_name == name)
         .map(|&(_, packer)| packer)
 }
 
-fn read_section_data(
-    data: &[u8],
-    offset: u64,
-    size: u64,
-) -> &[u8] {
+fn read_section_data(data: &[u8], offset: u64, size: u64) -> &[u8] {
     if size == 0 {
         return &[];
     }
@@ -355,14 +303,9 @@ fn read_section_data(
     &data[start..end]
 }
 
-fn find_ep_section(
-    sections: &[SectionInfo],
-    entry_point: u64,
-) -> Option<&SectionInfo> {
+fn find_ep_section(sections: &[SectionInfo], entry_point: u64) -> Option<&SectionInfo> {
     sections.iter().find(|s| {
-        entry_point >= s.virtual_address
-            && entry_point
-                < s.virtual_address + s.virtual_size
+        entry_point >= s.virtual_address && entry_point < s.virtual_address + s.virtual_size
     })
 }
 
@@ -375,13 +318,8 @@ mod tests {
     use crate::types::SectionPermissions;
 
     fn load_fixture(name: &str) -> Vec<u8> {
-        let path = format!(
-            "{}/tests/fixtures/{name}",
-            env!("CARGO_MANIFEST_DIR"),
-        );
-        std::fs::read(&path).unwrap_or_else(|e| {
-            panic!("fixture {path}: {e}")
-        })
+        let path = format!("{}/tests/fixtures/{name}", env!("CARGO_MANIFEST_DIR"),);
+        std::fs::read(&path).unwrap_or_else(|e| panic!("fixture {path}: {e}"))
     }
 
     fn make_ctx(data: Vec<u8>) -> AnalysisContext {
@@ -402,8 +340,7 @@ mod tests {
 
     #[test]
     fn entropy_uniform_distribution() {
-        let data: Vec<u8> =
-            (0..=255u8).cycle().take(1024).collect();
+        let data: Vec<u8> = (0..=255u8).cycle().take(1024).collect();
         let e = shannon_entropy(&data);
         assert!(
             (e - 8.0).abs() < 0.01,
@@ -421,50 +358,20 @@ mod tests {
 
     #[test]
     fn entropy_classification_thresholds() {
-        assert_eq!(
-            classify_entropy(2.0),
-            EntropyClassification::Plaintext
-        );
-        assert_eq!(
-            classify_entropy(5.0),
-            EntropyClassification::NativeCode
-        );
-        assert_eq!(
-            classify_entropy(6.5),
-            EntropyClassification::Compressed
-        );
-        assert_eq!(
-            classify_entropy(7.1),
-            EntropyClassification::Packed
-        );
-        assert_eq!(
-            classify_entropy(7.5),
-            EntropyClassification::Encrypted
-        );
+        assert_eq!(classify_entropy(2.0), EntropyClassification::Plaintext);
+        assert_eq!(classify_entropy(5.0), EntropyClassification::NativeCode);
+        assert_eq!(classify_entropy(6.5), EntropyClassification::Compressed);
+        assert_eq!(classify_entropy(7.1), EntropyClassification::Packed);
+        assert_eq!(classify_entropy(7.5), EntropyClassification::Encrypted);
     }
 
     #[test]
     fn packer_section_name_detection() {
-        assert_eq!(
-            detect_packer_by_section("UPX0"),
-            Some("UPX")
-        );
-        assert_eq!(
-            detect_packer_by_section("UPX1"),
-            Some("UPX")
-        );
-        assert_eq!(
-            detect_packer_by_section(".vmp0"),
-            Some("VMProtect")
-        );
-        assert_eq!(
-            detect_packer_by_section(".themida"),
-            Some("Themida")
-        );
-        assert_eq!(
-            detect_packer_by_section(".text"),
-            None
-        );
+        assert_eq!(detect_packer_by_section("UPX0"), Some("UPX"));
+        assert_eq!(detect_packer_by_section("UPX1"), Some("UPX"));
+        assert_eq!(detect_packer_by_section(".vmp0"), Some("VMProtect"));
+        assert_eq!(detect_packer_by_section(".themida"), Some("Themida"));
+        assert_eq!(detect_packer_by_section(".text"), None);
     }
 
     #[test]
@@ -483,17 +390,11 @@ mod tests {
             sha256: String::new(),
         }];
 
-        let data: Vec<u8> =
-            (0..=255u8).cycle().take(256).collect();
-        let result =
-            analyze_entropy(&data, &sections, 0x1000);
+        let data: Vec<u8> = (0..=255u8).cycle().take(256).collect();
+        let result = analyze_entropy(&data, &sections, 0x1000);
         let text_section = &result.sections[0];
-        assert!(
-            text_section.entropy > HIGH_ENTROPY_THRESHOLD
-        );
-        assert!(text_section
-            .flags
-            .contains(&EntropyFlag::HighEntropy));
+        assert!(text_section.entropy > HIGH_ENTROPY_THRESHOLD);
+        assert!(text_section.flags.contains(&EntropyFlag::HighEntropy));
         assert!(text_section.is_anomalous);
     }
 
@@ -529,27 +430,17 @@ mod tests {
         ];
 
         let data = vec![0u8; 0x4200];
-        let result =
-            analyze_entropy(&data, &sections, 0x11000);
+        let result = analyze_entropy(&data, &sections, 0x11000);
         assert!(result.packing_detected);
-        assert_eq!(
-            result.packer_name,
-            Some("UPX".into())
-        );
+        assert_eq!(result.packer_name, Some("UPX".into()));
         assert!(!result.packing_indicators.is_empty());
     }
 
     #[test]
     fn elf_entropy_analysis() {
         let data = load_fixture("hello_elf");
-        let format_result =
-            crate::formats::parse_format(&data)
-                .unwrap();
-        let result = analyze_entropy(
-            &data,
-            &format_result.sections,
-            format_result.entry_point,
-        );
+        let format_result = crate::formats::parse_format(&data).unwrap();
+        let result = analyze_entropy(&data, &format_result.sections, format_result.entry_point);
 
         assert!(result.overall_entropy > 0.0);
         assert!(!result.sections.is_empty());
@@ -561,9 +452,7 @@ mod tests {
         let data = load_fixture("hello_elf");
         let mut ctx = make_ctx(data);
 
-        crate::passes::format::FormatPass
-            .run(&mut ctx)
-            .unwrap();
+        crate::passes::format::FormatPass.run(&mut ctx).unwrap();
         assert!(ctx.format_result.is_some());
 
         EntropyPass.run(&mut ctx).unwrap();
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/format.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/format.rs
index 273ff2f8..92f207cc 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/format.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/format.rs
@@ -36,12 +36,8 @@ impl AnalysisPass for FormatPass {
         &[]
     }
 
-    fn run(
-        &self,
-        ctx: &mut AnalysisContext,
-    ) -> Result<(), EngineError> {
-        let result =
-            formats::parse_format(ctx.data())?;
+    fn run(&self, ctx: &mut AnalysisContext) -> Result<(), EngineError> {
+        let result = formats::parse_format(ctx.data())?;
         ctx.format_result = Some(result);
         Ok(())
     }
@@ -56,13 +52,8 @@ mod tests {
     use crate::types::{Architecture, BinaryFormat, Endianness};
 
     fn load_fixture(name: &str) -> Vec<u8> {
-        let path = format!(
-            "{}/tests/fixtures/{name}",
-            env!("CARGO_MANIFEST_DIR"),
-        );
-        std::fs::read(&path).unwrap_or_else(|e| {
-            panic!("fixture {path}: {e}")
-        })
+        let path = format!("{}/tests/fixtures/{name}", env!("CARGO_MANIFEST_DIR"),);
+        std::fs::read(&path).unwrap_or_else(|e| panic!("fixture {path}: {e}"))
     }
 
     fn make_ctx(data: Vec<u8>) -> AnalysisContext {
@@ -78,19 +69,12 @@ mod tests {
     #[test]
     fn parse_elf_basic_metadata() {
         let data = load_fixture("hello_elf");
-        let result =
-            formats::parse_format(&data).unwrap();
+        let result = formats::parse_format(&data).unwrap();
 
         assert_eq!(result.format, BinaryFormat::Elf);
-        assert_eq!(
-            result.architecture,
-            Architecture::X86_64
-        );
+        assert_eq!(result.architecture, Architecture::X86_64);
         assert_eq!(result.bits, 64);
-        assert_eq!(
-            result.endianness,
-            Endianness::Little
-        );
+        assert_eq!(result.endianness, Endianness::Little);
         assert!(result.entry_point > 0);
         assert!(result.is_pie);
         assert!(!result.is_stripped);
@@ -99,14 +83,10 @@ mod tests {
     #[test]
     fn parse_elf_sections_present() {
         let data = load_fixture("hello_elf");
-        let result =
-            formats::parse_format(&data).unwrap();
+        let result = formats::parse_format(&data).unwrap();
 
         assert!(!result.sections.is_empty());
-        let text = result
-            .sections
-            .iter()
-            .find(|s| s.name == ".text");
+        let text = result.sections.iter().find(|s| s.name == ".text");
         assert!(text.is_some());
         assert!(text.unwrap().permissions.execute);
     }
@@ -114,41 +94,35 @@ mod tests {
     #[test]
     fn parse_elf_segments_present() {
         let data = load_fixture("hello_elf");
-        let result =
-            formats::parse_format(&data).unwrap();
+        let result = formats::parse_format(&data).unwrap();
 
         assert!(!result.segments.is_empty());
         let load_segments: Vec<_> = result
             .segments
             .iter()
-            .filter(|s| {
-                s.name.as_deref() == Some("LOAD")
-            })
+            .filter(|s| s.name.as_deref() == Some("LOAD"))
             .collect();
         assert!(!load_segments.is_empty());
     }
 
     #[test]
     fn parse_elf_stripped_detection() {
-        let data =
-            load_fixture("hello_elf_stripped");
-        let result =
-            formats::parse_format(&data).unwrap();
+        let data = load_fixture("hello_elf_stripped");
+        let result = formats::parse_format(&data).unwrap();
 
         assert!(result.is_stripped);
-        assert!(result.anomalies.iter().any(|a| {
-            matches!(
-                a,
-                FormatAnomaly::StrippedBinary
-            )
-        }));
+        assert!(
+            result
+                .anomalies
+                .iter()
+                .any(|a| { matches!(a, FormatAnomaly::StrippedBinary) })
+        );
     }
 
     #[test]
     fn parse_elf_info_populated() {
         let data = load_fixture("hello_elf");
-        let result =
-            formats::parse_format(&data).unwrap();
+        let result = formats::parse_format(&data).unwrap();
 
         let elf_info = result.elf_info.unwrap();
         assert!(!elf_info.os_abi.is_empty());
@@ -160,18 +134,10 @@ mod tests {
     #[test]
     fn parse_elf_section_hashes() {
         let data = load_fixture("hello_elf");
-        let result =
-            formats::parse_format(&data).unwrap();
+        let result = formats::parse_format(&data).unwrap();
 
-        let text = result
-            .sections
-            .iter()
-            .find(|s| s.name == ".text")
-            .unwrap();
-        assert!(
-            !text.sha256.is_empty(),
-            ".text section should have a hash"
-        );
+        let text = result.sections.iter().find(|s| s.name == ".text").unwrap();
+        assert!(!text.sha256.is_empty(), ".text section should have a hash");
         assert_eq!(text.sha256.len(), 64);
     }
 
@@ -184,8 +150,8 @@ mod tests {
 
     #[test]
     fn format_pass_populates_context() {
-        use crate::pass::AnalysisPass;
         use super::FormatPass;
+        use crate::pass::AnalysisPass;
 
         let data = load_fixture("hello_elf");
         let mut ctx = make_ctx(data);
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/imports.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/imports.rs
index e5d87b2c..a5fcad22 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/imports.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/imports.rs
@@ -47,6 +47,8 @@ use crate::error::EngineError;
 use crate::pass::{AnalysisPass, Sealed};
 use crate::types::Severity;
 
+type ImportsExportsLibs = (Vec<ImportEntry>, Vec<ExportEntry>, Vec<String>);
+
 pub struct SuspiciousApiDef {
     pub name: &'static str,
     pub tag: &'static str,
@@ -179,11 +181,7 @@ const SUSPICIOUS_COMBINATIONS: &[CombinationDef] = &[
         name: "Process Injection Chain",
         description: "VirtualAllocEx + WriteProcessMemory \
                       + CreateRemoteThread",
-        patterns: &[
-            "VirtualAllocEx",
-            "WriteProcessMemory",
-            "CreateRemoteThread",
-        ],
+        patterns: &["VirtualAllocEx", "WriteProcessMemory", "CreateRemoteThread"],
         mitre_id: "T1055",
         severity: Severity::Critical,
     },
@@ -211,50 +209,35 @@ const SUSPICIOUS_COMBINATIONS: &[CombinationDef] = &[
     CombinationDef {
         name: "DLL Injection",
         description: "LoadLibrary + CreateRemoteThread",
-        patterns: &[
-            "LoadLibrary*",
-            "CreateRemoteThread",
-        ],
+        patterns: &["LoadLibrary*", "CreateRemoteThread"],
         mitre_id: "T1055.001",
         severity: Severity::High,
     },
     CombinationDef {
         name: "Credential Theft",
         description: "OpenProcess + ReadProcessMemory",
-        patterns: &[
-            "OpenProcess",
-            "ReadProcessMemory",
-        ],
+        patterns: &["OpenProcess", "ReadProcessMemory"],
         mitre_id: "T1003",
         severity: Severity::Critical,
     },
     CombinationDef {
         name: "Service Persistence",
         description: "OpenSCManager + CreateService",
-        patterns: &[
-            "OpenSCManager*",
-            "CreateService*",
-        ],
+        patterns: &["OpenSCManager*", "CreateService*"],
         mitre_id: "T1543.003",
         severity: Severity::Medium,
     },
     CombinationDef {
         name: "Registry Persistence",
         description: "RegOpenKeyEx + RegSetValueEx",
-        patterns: &[
-            "RegOpenKeyEx*",
-            "RegSetValueEx*",
-        ],
+        patterns: &["RegOpenKeyEx*", "RegSetValueEx*"],
         mitre_id: "T1547.001",
         severity: Severity::Medium,
     },
     CombinationDef {
         name: "Download and Execute",
         description: "URLDownloadToFile + ShellExecute",
-        patterns: &[
-            "URLDownloadToFile*",
-            "ShellExecute*",
-        ],
+        patterns: &["URLDownloadToFile*", "ShellExecute*"],
         mitre_id: "T1105",
         severity: Severity::High,
     },
@@ -283,11 +266,7 @@ const SUSPICIOUS_COMBINATIONS: &[CombinationDef] = &[
         name: "Linux C2 Connection",
         description: "socket + connect + inet_pton \
                       hardcoded C2 address",
-        patterns: &[
-            "socket",
-            "connect",
-            "inet_pton",
-        ],
+        patterns: &["socket", "connect", "inet_pton"],
         mitre_id: "T1071",
         severity: Severity::High,
     },
@@ -295,12 +274,7 @@ const SUSPICIOUS_COMBINATIONS: &[CombinationDef] = &[
         name: "Linux Network Listener",
         description: "socket + bind + listen + accept \
                       backdoor listener",
-        patterns: &[
-            "socket",
-            "bind",
-            "listen",
-            "accept",
-        ],
+        patterns: &["socket", "bind", "listen", "accept"],
         mitre_id: "T1571",
         severity: Severity::High,
     },
@@ -327,8 +301,7 @@ pub struct ImportResult {
     pub imports: Vec<ImportEntry>,
     pub exports: Vec<ExportEntry>,
     pub libraries: Vec<String>,
-    pub suspicious_combinations:
-        Vec<SuspiciousCombination>,
+    pub suspicious_combinations: Vec<SuspiciousCombination>,
     pub mitre_mappings: Vec<MitreMapping>,
     pub statistics: ImportStatistics,
 }
@@ -389,43 +362,28 @@ impl AnalysisPass for ImportPass {
         &["format"]
     }
 
-    fn run(
-        &self,
-        ctx: &mut AnalysisContext,
-    ) -> Result<(), EngineError> {
+    fn run(&self, ctx: &mut AnalysisContext) -> Result<(), EngineError> {
         let result = analyze_imports(ctx.data())?;
         ctx.import_result = Some(result);
         Ok(())
     }
 }
 
-fn analyze_imports(
-    data: &[u8],
-) -> Result<ImportResult, EngineError> {
-    let object =
-        goblin::Object::parse(data).map_err(|e| {
-            EngineError::InvalidBinary {
-                reason: e.to_string(),
-            }
-        })?;
+fn analyze_imports(data: &[u8]) -> Result<ImportResult, EngineError> {
+    let object = goblin::Object::parse(data).map_err(|e| EngineError::InvalidBinary {
+        reason: e.to_string(),
+    })?;
 
     let (imports, exports, libraries) = match &object {
         goblin::Object::Elf(elf) => extract_elf(elf),
         goblin::Object::PE(pe) => extract_pe(pe),
-        goblin::Object::Mach(mach) => {
-            extract_mach(mach, data)?
-        }
+        goblin::Object::Mach(mach) => extract_mach(mach, data)?,
         _ => (Vec::new(), Vec::new(), Vec::new()),
     };
 
-    let suspicious_combinations =
-        detect_combinations(&imports);
-    let mitre_mappings =
-        collect_mitre_mappings(&imports);
-    let suspicious_count = imports
-        .iter()
-        .filter(|i| i.is_suspicious)
-        .count();
+    let suspicious_combinations = detect_combinations(&imports);
+    let mitre_mappings = collect_mitre_mappings(&imports);
+    let suspicious_count = imports.iter().filter(|i| i.is_suspicious).count();
 
     let statistics = ImportStatistics {
         total_imports: imports.len(),
@@ -444,29 +402,19 @@ fn analyze_imports(
     })
 }
 
-fn extract_elf(
-    elf: &goblin::elf::Elf,
-) -> (Vec<ImportEntry>, Vec<ExportEntry>, Vec<String>) {
-    let libraries: Vec<String> = elf
-        .libraries
-        .iter()
-        .map(|s| s.to_string())
-        .collect();
+fn extract_elf(elf: &goblin::elf::Elf) -> ImportsExportsLibs {
+    let libraries: Vec<String> = elf.libraries.iter().map(|s| s.to_string()).collect();
 
     let mut imports = Vec::new();
     for sym in elf.dynsyms.iter() {
         if !sym.is_import() || sym.st_name == 0 {
             continue;
         }
-        let name = elf
-            .dynstrtab
-            .get_at(sym.st_name)
-            .unwrap_or("");
+        let name = elf.dynstrtab.get_at(sym.st_name).unwrap_or("");
         if name.is_empty() {
             continue;
         }
-        let (is_suspicious, threat_tags) =
-            flag_suspicious(name);
+        let (is_suspicious, threat_tags) = flag_suspicious(name);
         imports.push(ImportEntry {
             library: String::new(),
             function: name.to_string(),
@@ -479,16 +427,10 @@ fn extract_elf(
 
     let mut exports = Vec::new();
     for sym in elf.dynsyms.iter() {
-        if sym.is_import()
-            || sym.st_value == 0
-            || sym.st_name == 0
-        {
+        if sym.is_import() || sym.st_value == 0 || sym.st_name == 0 {
             continue;
         }
-        let name = elf
-            .dynstrtab
-            .get_at(sym.st_name)
-            .unwrap_or("");
+        let name = elf.dynstrtab.get_at(sym.st_name).unwrap_or("");
         if name.is_empty() {
             continue;
         }
@@ -504,17 +446,14 @@ fn extract_elf(
     (imports, exports, libraries)
 }
 
-fn extract_pe(
-    pe: &goblin::pe::PE,
-) -> (Vec<ImportEntry>, Vec<ExportEntry>, Vec<String>) {
+fn extract_pe(pe: &goblin::pe::PE) -> ImportsExportsLibs {
     let mut lib_set = HashSet::new();
     let mut imports = Vec::new();
 
     for import in &pe.imports {
         let dll = import.dll.to_string();
         lib_set.insert(dll.clone());
-        let (is_suspicious, threat_tags) =
-            flag_suspicious(&import.name);
+        let (is_suspicious, threat_tags) = flag_suspicious(&import.name);
         imports.push(ImportEntry {
             library: dll,
             function: import.name.to_string(),
@@ -528,17 +467,12 @@ fn extract_pe(
     let mut exports = Vec::new();
     for export in &pe.exports {
         let is_forwarded = export.reexport.is_some();
-        let forward_target =
-            export.reexport.as_ref().map(|r| match r {
-                goblin::pe::export::Reexport::DLLName {
-                    export: name,
-                    lib,
-                } => format!("{lib}!{name}"),
-                goblin::pe::export::Reexport::DLLOrdinal {
-                    ordinal,
-                    lib,
-                } => format!("{lib}!#{ordinal}"),
-            });
+        let forward_target = export.reexport.as_ref().map(|r| match r {
+            goblin::pe::export::Reexport::DLLName { export: name, lib } => format!("{lib}!{name}"),
+            goblin::pe::export::Reexport::DLLOrdinal { ordinal, lib } => {
+                format!("{lib}!#{ordinal}")
+            }
+        });
         exports.push(ExportEntry {
             name: export.name.map(|s| s.to_string()),
             address: export.rva as u64,
@@ -548,38 +482,24 @@ fn extract_pe(
         });
     }
 
-    let libraries: Vec<String> =
-        lib_set.into_iter().collect();
+    let libraries: Vec<String> = lib_set.into_iter().collect();
     (imports, exports, libraries)
 }
 
-fn extract_mach(
-    mach: &goblin::mach::Mach,
-    data: &[u8],
-) -> Result<
-    (Vec<ImportEntry>, Vec<ExportEntry>, Vec<String>),
-    EngineError,
-> {
+fn extract_mach(mach: &goblin::mach::Mach, data: &[u8]) -> Result<ImportsExportsLibs, EngineError> {
     match mach {
-        goblin::mach::Mach::Binary(macho) => {
-            Ok(extract_single_macho(macho))
-        }
+        goblin::mach::Mach::Binary(macho) => Ok(extract_single_macho(macho)),
         goblin::mach::Mach::Fat(fat) => {
-            for arch in fat.iter_arches() {
-                let arch = arch.map_err(|e| {
-                    EngineError::InvalidBinary {
-                        reason: e.to_string(),
-                    }
-                })?;
-                let macho = goblin::mach::MachO::parse(
-                    data,
-                    arch.offset as usize,
-                )
-                .map_err(|e| {
-                    EngineError::InvalidBinary {
-                        reason: e.to_string(),
-                    }
+            if let Some(arch) = fat.iter_arches().next() {
+                let arch = arch.map_err(|e| EngineError::InvalidBinary {
+                    reason: e.to_string(),
                 })?;
+                let macho =
+                    goblin::mach::MachO::parse(data, arch.offset as usize).map_err(|e| {
+                        EngineError::InvalidBinary {
+                            reason: e.to_string(),
+                        }
+                    })?;
                 return Ok(extract_single_macho(&macho));
             }
             Ok((Vec::new(), Vec::new(), Vec::new()))
@@ -587,14 +507,11 @@ fn extract_mach(
     }
 }
 
-fn extract_single_macho(
-    macho: &goblin::mach::MachO,
-) -> (Vec<ImportEntry>, Vec<ExportEntry>, Vec<String>) {
+fn extract_single_macho(macho: &goblin::mach::MachO) -> ImportsExportsLibs {
     let mut imports = Vec::new();
     if let Ok(macho_imports) = macho.imports() {
         for imp in &macho_imports {
-            let (is_suspicious, threat_tags) =
-                flag_suspicious(imp.name);
+            let (is_suspicious, threat_tags) = flag_suspicious(imp.name);
             imports.push(ImportEntry {
                 library: imp.dylib.to_string(),
                 function: imp.name.to_string(),
@@ -629,9 +546,7 @@ fn extract_single_macho(
     (imports, exports, libraries)
 }
 
-fn flag_suspicious(
-    name: &str,
-) -> (bool, Vec<String>) {
+fn flag_suspicious(name: &str) -> (bool, Vec<String>) {
     let mut tags = Vec::new();
     for api in SUSPICIOUS_APIS {
         if matches_api(name, api.name) {
@@ -642,24 +557,17 @@ fn flag_suspicious(
     (is_suspicious, tags)
 }
 
-fn matches_api(
-    import_name: &str,
-    api_name: &str,
-) -> bool {
+fn matches_api(import_name: &str, api_name: &str) -> bool {
     if import_name == api_name {
         return true;
     }
-    if import_name.starts_with(api_name) {
-        let suffix = &import_name[api_name.len()..];
+    if let Some(suffix) = import_name.strip_prefix(api_name) {
         return suffix == "A" || suffix == "W";
     }
     false
 }
 
-fn matches_pattern(
-    import_name: &str,
-    pattern: &str,
-) -> bool {
+fn matches_pattern(import_name: &str, pattern: &str) -> bool {
     if let Some(prefix) = pattern.strip_suffix('*') {
         import_name.starts_with(prefix)
     } else {
@@ -667,13 +575,8 @@ fn matches_pattern(
     }
 }
 
-fn detect_combinations(
-    imports: &[ImportEntry],
-) -> Vec<SuspiciousCombination> {
-    let function_names: Vec<&str> = imports
-        .iter()
-        .map(|i| i.function.as_str())
-        .collect();
+fn detect_combinations(imports: &[ImportEntry]) -> Vec<SuspiciousCombination> {
+    let function_names: Vec<&str> = imports.iter().map(|i| i.function.as_str()).collect();
     let mut results = Vec::new();
     let mut seen = HashSet::new();
 
@@ -681,12 +584,11 @@ fn detect_combinations(
         if seen.contains(combo.name) {
             continue;
         }
-        let all_matched =
-            combo.patterns.iter().all(|pattern| {
-                function_names.iter().any(|name| {
-                    matches_pattern(name, pattern)
-                })
-            });
+        let all_matched = combo.patterns.iter().all(|pattern| {
+            function_names
+                .iter()
+                .any(|name| matches_pattern(name, pattern))
+        });
         if !all_matched {
             continue;
         }
@@ -697,9 +599,7 @@ fn detect_combinations(
             .filter_map(|pattern| {
                 function_names
                     .iter()
-                    .find(|name| {
-                        matches_pattern(name, pattern)
-                    })
+                    .find(|name| matches_pattern(name, pattern))
                     .map(|name| name.to_string())
             })
             .collect();
@@ -717,18 +617,14 @@ fn detect_combinations(
     results
 }
 
-fn collect_mitre_mappings(
-    imports: &[ImportEntry],
-) -> Vec<MitreMapping> {
+fn collect_mitre_mappings(imports: &[ImportEntry]) -> Vec<MitreMapping> {
     let mut mappings = Vec::new();
     for import in imports {
         if !import.is_suspicious {
             continue;
         }
         for api in SUSPICIOUS_APIS {
-            if matches_api(&import.function, api.name)
-                && !api.mitre_id.is_empty()
-            {
+            if matches_api(&import.function, api.name) && !api.mitre_id.is_empty() {
                 mappings.push(MitreMapping {
                     technique_id: api.mitre_id.into(),
                     api: import.function.clone(),
@@ -748,13 +644,8 @@ mod tests {
     use crate::context::BinarySource;
 
     fn load_fixture(name: &str) -> Vec<u8> {
-        let path = format!(
-            "{}/tests/fixtures/{name}",
-            env!("CARGO_MANIFEST_DIR"),
-        );
-        std::fs::read(&path).unwrap_or_else(|e| {
-            panic!("fixture {path}: {e}")
-        })
+        let path = format!("{}/tests/fixtures/{name}", env!("CARGO_MANIFEST_DIR"),);
+        std::fs::read(&path).unwrap_or_else(|e| panic!("fixture {path}: {e}"))
     }
 
     fn make_ctx(data: Vec<u8>) -> AnalysisContext {
@@ -770,13 +661,9 @@ mod tests {
     #[test]
     fn elf_imports_extracted() {
         let data = load_fixture("hello_elf");
-        let result =
-            analyze_imports(&data).unwrap();
+        let result = analyze_imports(&data).unwrap();
 
-        assert!(
-            !result.imports.is_empty(),
-            "ELF binary should have imports"
-        );
+        assert!(!result.imports.is_empty(), "ELF binary should have imports");
         assert!(
             !result.libraries.is_empty(),
             "ELF binary should list needed libraries"
@@ -786,20 +673,15 @@ mod tests {
 
     #[test]
     fn suspicious_api_flagging() {
-        let (is_suspicious, tags) =
-            flag_suspicious("VirtualAllocEx");
+        let (is_suspicious, tags) = flag_suspicious("VirtualAllocEx");
         assert!(is_suspicious);
         assert!(tags.contains(&"injection".to_string()));
 
-        let (is_suspicious, tags) =
-            flag_suspicious("RegSetValueExW");
+        let (is_suspicious, tags) = flag_suspicious("RegSetValueExW");
         assert!(is_suspicious);
-        assert!(tags.contains(
-            &"persistence".to_string()
-        ));
+        assert!(tags.contains(&"persistence".to_string()));
 
-        let (is_suspicious, _) =
-            flag_suspicious("printf");
+        let (is_suspicious, _) = flag_suspicious("printf");
         assert!(!is_suspicious);
     }
 
@@ -812,9 +694,7 @@ mod tests {
                 address: None,
                 ordinal: None,
                 is_suspicious: true,
-                threat_tags: vec![
-                    "injection".into(),
-                ],
+                threat_tags: vec!["injection".into()],
             },
             ImportEntry {
                 library: "kernel32.dll".into(),
@@ -822,9 +702,7 @@ mod tests {
                 address: None,
                 ordinal: None,
                 is_suspicious: true,
-                threat_tags: vec![
-                    "injection".into(),
-                ],
+                threat_tags: vec!["injection".into()],
             },
             ImportEntry {
                 library: "kernel32.dll".into(),
@@ -832,23 +710,15 @@ mod tests {
                 address: None,
                 ordinal: None,
                 is_suspicious: true,
-                threat_tags: vec![
-                    "injection".into(),
-                ],
+                threat_tags: vec!["injection".into()],
             },
         ];
 
         let combos = detect_combinations(&imports);
         assert_eq!(combos.len(), 1);
-        assert_eq!(
-            combos[0].name,
-            "Process Injection Chain"
-        );
+        assert_eq!(combos[0].name, "Process Injection Chain");
         assert_eq!(combos[0].mitre_id, "T1055");
-        assert_eq!(
-            combos[0].severity,
-            Severity::Critical
-        );
+        assert_eq!(combos[0].severity, Severity::Critical);
     }
 
     #[test]
@@ -868,17 +738,12 @@ mod tests {
                 address: None,
                 ordinal: None,
                 is_suspicious: true,
-                threat_tags: vec![
-                    "persistence".into(),
-                ],
+                threat_tags: vec!["persistence".into()],
             },
         ];
 
         let combos = detect_combinations(&imports);
-        assert!(combos
-            .iter()
-            .any(|c| c.name
-                == "Registry Persistence"));
+        assert!(combos.iter().any(|c| c.name == "Registry Persistence"));
     }
 
     #[test]
@@ -894,8 +759,7 @@ mod tests {
 
         let combos = detect_combinations(&imports);
         assert!(
-            !combos.iter().any(|c| c.name
-                == "Process Injection Chain"),
+            !combos.iter().any(|c| c.name == "Process Injection Chain"),
             "should not detect chain with only one API"
         );
     }
@@ -909,9 +773,7 @@ mod tests {
                 address: None,
                 ordinal: None,
                 is_suspicious: true,
-                threat_tags: vec![
-                    "injection".into(),
-                ],
+                threat_tags: vec!["injection".into()],
             },
             ImportEntry {
                 library: String::new(),
@@ -923,13 +785,9 @@ mod tests {
             },
         ];
 
-        let mappings =
-            collect_mitre_mappings(&imports);
+        let mappings = collect_mitre_mappings(&imports);
         assert_eq!(mappings.len(), 1);
-        assert_eq!(
-            mappings[0].technique_id,
-            "T1055.008"
-        );
+        assert_eq!(mappings[0].technique_id, "T1055.008");
         assert_eq!(mappings[0].api, "ptrace");
     }
 
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/strings.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/strings.rs
index 237a48ca..808a097f 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/strings.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/strings.rs
@@ -70,23 +70,14 @@ const SUSPICIOUS_CATEGORIES: &[StringCategory] = &[
     StringCategory::CryptoWallet,
 ];
 
-const URL_PREFIXES: &[&str] =
-    &["http://", "https://", "ftp://"];
+const URL_PREFIXES: &[&str] = &["http://", "https://", "ftp://"];
 
 const UNIX_PATH_PREFIXES: &[&str] = &[
-    "/etc/", "/tmp/", "/var/", "/bin/", "/usr/",
-    "/dev/", "/proc/", "/sys/", "/opt/", "/home/",
+    "/etc/", "/tmp/", "/var/", "/bin/", "/usr/", "/dev/", "/proc/", "/sys/", "/opt/", "/home/",
     "/root/", "/lib/", "/sbin/",
 ];
 
-const REGISTRY_PREFIXES: &[&str] = &[
-    "HKEY_",
-    "HKLM\\",
-    "HKCU\\",
-    "HKCR\\",
-    "HKCC\\",
-    "HKU\\",
-];
+const REGISTRY_PREFIXES: &[&str] = &["HKEY_", "HKLM\\", "HKCU\\", "HKCR\\", "HKCC\\", "HKU\\"];
 
 const SHELL_INDICATORS: &[&str] = &[
     "cmd.exe",
@@ -108,8 +99,7 @@ const SHELL_INDICATORS: &[&str] = &[
 ];
 
 const PACKER_SIGNATURES: &[&str] = &[
-    "UPX!", "MPRESS", ".themida", ".vmp", ".enigma",
-    "PEC2", "ASPack", "MEW ",
+    "UPX!", "MPRESS", ".themida", ".vmp", ".enigma", "PEC2", "ASPack", "MEW ",
 ];
 
 const DEBUG_ARTIFACTS: &[&str] = &[
@@ -163,8 +153,7 @@ const PERSISTENCE_PATHS: &[&str] = &[
     ".config/autostart",
 ];
 
-const BASE64_CHARS: &[u8] =
-    b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+const BASE64_CHARS: &[u8] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 
 const BASE64_MIN_LENGTH: usize = 20;
 
@@ -215,25 +204,15 @@ impl AnalysisPass for StringPass {
         &["format"]
     }
 
-    fn run(
-        &self,
-        ctx: &mut AnalysisContext,
-    ) -> Result<(), EngineError> {
-        let sections = ctx
-            .format_result
-            .as_ref()
-            .map(|fr| fr.sections.as_slice());
-        let result =
-            extract_strings(ctx.data(), sections);
+    fn run(&self, ctx: &mut AnalysisContext) -> Result<(), EngineError> {
+        let sections = ctx.format_result.as_ref().map(|fr| fr.sections.as_slice());
+        let result = extract_strings(ctx.data(), sections);
         ctx.string_result = Some(result);
         Ok(())
     }
 }
 
-fn extract_strings(
-    data: &[u8],
-    sections: Option<&[SectionInfo]>,
-) -> StringResult {
+fn extract_strings(data: &[u8], sections: Option<&[SectionInfo]>) -> StringResult {
     let mut strings = Vec::new();
 
     extract_ascii(data, sections, &mut strings);
@@ -244,12 +223,8 @@ fn extract_strings(
     let mut suspicious_count = 0;
 
     for s in &strings {
-        *by_encoding
-            .entry(s.encoding.clone())
-            .or_insert(0) += 1;
-        *by_category
-            .entry(s.category.clone())
-            .or_insert(0) += 1;
+        *by_encoding.entry(s.encoding.clone()).or_insert(0) += 1;
+        *by_category.entry(s.category.clone()).or_insert(0) += 1;
         if s.is_suspicious {
             suspicious_count += 1;
         }
@@ -270,17 +245,10 @@ fn extract_strings(
 }
 
 fn is_printable(b: u8) -> bool {
-    (PRINTABLE_MIN..=PRINTABLE_MAX).contains(&b)
-        || b == TAB
-        || b == NEWLINE
-        || b == CARRIAGE_RETURN
+    (PRINTABLE_MIN..=PRINTABLE_MAX).contains(&b) || b == TAB || b == NEWLINE || b == CARRIAGE_RETURN
 }
 
-fn extract_ascii(
-    data: &[u8],
-    sections: Option<&[SectionInfo]>,
-    out: &mut Vec<ExtractedString>,
-) {
+fn extract_ascii(data: &[u8], sections: Option<&[SectionInfo]>, out: &mut Vec<ExtractedString>) {
     let mut start = 0;
     let mut in_run = false;
 
@@ -292,61 +260,18 @@ fn extract_ascii(
             }
         } else if in_run {
             let len = i - start;
-            if len >= MIN_STRING_LENGTH {
-                if let Ok(s) =
-                    std::str::from_utf8(&data[start..i])
-                {
-                    let is_multibyte = s
-                        .bytes()
-                        .any(|b| !b.is_ascii());
-                    let encoding = if is_multibyte {
-                        StringEncoding::Utf8
-                    } else {
-                        StringEncoding::Ascii
-                    };
-                    let category = classify(s);
-                    let is_suspicious =
-                        is_category_suspicious(&category);
-                    let section = sections.and_then(|secs| {
-                        find_section(
-                            secs,
-                            start as u64,
-                        )
-                    });
-                    out.push(ExtractedString {
-                        value: s.to_string(),
-                        offset: start as u64,
-                        encoding,
-                        length: len,
-                        category,
-                        is_suspicious,
-                        section,
-                    });
-                }
-            }
-            in_run = false;
-        }
-    }
-
-    if in_run {
-        let len = data.len() - start;
-        if len >= MIN_STRING_LENGTH {
-            if let Ok(s) =
-                std::str::from_utf8(&data[start..])
+            if len >= MIN_STRING_LENGTH
+                && let Ok(s) = std::str::from_utf8(&data[start..i])
             {
-                let is_multibyte =
-                    s.bytes().any(|b| !b.is_ascii());
+                let is_multibyte = s.bytes().any(|b| !b.is_ascii());
                 let encoding = if is_multibyte {
                     StringEncoding::Utf8
                 } else {
                     StringEncoding::Ascii
                 };
                 let category = classify(s);
-                let is_suspicious =
-                    is_category_suspicious(&category);
-                let section = sections.and_then(|secs| {
-                    find_section(secs, start as u64)
-                });
+                let is_suspicious = is_category_suspicious(&category);
+                let section = sections.and_then(|secs| find_section(secs, start as u64));
                 out.push(ExtractedString {
                     value: s.to_string(),
                     offset: start as u64,
@@ -357,15 +282,38 @@ fn extract_ascii(
                     section,
                 });
             }
+            in_run = false;
+        }
+    }
+
+    if in_run {
+        let len = data.len() - start;
+        if len >= MIN_STRING_LENGTH
+            && let Ok(s) = std::str::from_utf8(&data[start..])
+        {
+            let is_multibyte = s.bytes().any(|b| !b.is_ascii());
+            let encoding = if is_multibyte {
+                StringEncoding::Utf8
+            } else {
+                StringEncoding::Ascii
+            };
+            let category = classify(s);
+            let is_suspicious = is_category_suspicious(&category);
+            let section = sections.and_then(|secs| find_section(secs, start as u64));
+            out.push(ExtractedString {
+                value: s.to_string(),
+                offset: start as u64,
+                encoding,
+                length: len,
+                category,
+                is_suspicious,
+                section,
+            });
         }
     }
 }
 
-fn extract_utf16le(
-    data: &[u8],
-    sections: Option<&[SectionInfo]>,
-    out: &mut Vec<ExtractedString>,
-) {
+fn extract_utf16le(data: &[u8], sections: Option<&[SectionInfo]>, out: &mut Vec<ExtractedString>) {
     let mut i = 0;
     while i + 1 < data.len() {
         let lo = data[i];
@@ -391,14 +339,10 @@ fn extract_utf16le(
             }
 
             if code_units.len() >= MIN_STRING_LENGTH {
-                let value =
-                    String::from_utf16_lossy(&code_units);
+                let value = String::from_utf16_lossy(&code_units);
                 let category = classify(&value);
-                let is_suspicious =
-                    is_category_suspicious(&category);
-                let section = sections.and_then(|secs| {
-                    find_section(secs, start as u64)
-                });
+                let is_suspicious = is_category_suspicious(&category);
+                let section = sections.and_then(|secs| find_section(secs, start as u64));
                 out.push(ExtractedString {
                     value,
                     offset: start as u64,
@@ -417,17 +361,11 @@ fn extract_utf16le(
     }
 }
 
-fn find_section(
-    sections: &[SectionInfo],
-    file_offset: u64,
-) -> Option<String> {
+fn find_section(sections: &[SectionInfo], file_offset: u64) -> Option<String> {
     sections
         .iter()
         .find(|s| {
-            s.raw_size > 0
-                && file_offset >= s.raw_offset
-                && file_offset
-                    < s.raw_offset + s.raw_size
+            s.raw_size > 0 && file_offset >= s.raw_offset && file_offset < s.raw_offset + s.raw_size
         })
         .map(|s| s.name.clone())
 }
@@ -475,17 +413,13 @@ fn classify(s: &str) -> StringCategory {
     StringCategory::Generic
 }
 
-fn is_category_suspicious(
-    category: &StringCategory,
-) -> bool {
+fn is_category_suspicious(category: &StringCategory) -> bool {
     SUSPICIOUS_CATEGORIES.contains(category)
 }
 
 fn is_url(s: &str) -> bool {
     let lower = s.to_ascii_lowercase();
-    URL_PREFIXES
-        .iter()
-        .any(|prefix| lower.starts_with(prefix))
+    URL_PREFIXES.iter().any(|prefix| lower.starts_with(prefix))
 }
 
 fn is_ip_address(s: &str) -> bool {
@@ -521,9 +455,7 @@ fn is_file_path(s: &str) -> bool {
 }
 
 fn is_registry_key(s: &str) -> bool {
-    REGISTRY_PREFIXES
-        .iter()
-        .any(|prefix| s.starts_with(prefix))
+    REGISTRY_PREFIXES.iter().any(|prefix| s.starts_with(prefix))
 }
 
 fn is_shell_command(s: &str) -> bool {
@@ -537,11 +469,10 @@ fn is_crypto_wallet(s: &str) -> bool {
     if s.len() >= BTC_MIN_LENGTH
         && s.len() <= BTC_MAX_LENGTH
         && (s.starts_with('1') || s.starts_with('3'))
-        && s.chars()
-            .all(|c| c.is_ascii_alphanumeric())
-        && !s.chars().any(|c| {
-            c == '0' || c == 'O' || c == 'I' || c == 'l'
-        })
+        && s.chars().all(|c| c.is_ascii_alphanumeric())
+        && !s
+            .chars()
+            .any(|c| c == '0' || c == 'O' || c == 'I' || c == 'l')
     {
         return true;
     }
@@ -572,51 +503,35 @@ fn is_email(s: &str) -> bool {
         return false;
     }
     let local = &s[..at_pos];
-    local
+    local.chars().all(|c| {
+        c.is_ascii_alphanumeric() || c == '.' || c == '_' || c == '%' || c == '+' || c == '-'
+    }) && domain[..dot_pos]
         .chars()
-        .all(|c| c.is_ascii_alphanumeric()
-            || c == '.'
-            || c == '_'
-            || c == '%'
-            || c == '+'
-            || c == '-')
-        && domain[..dot_pos]
-            .chars()
-            .all(|c| c.is_ascii_alphanumeric()
-                || c == '.'
-                || c == '-')
+        .all(|c| c.is_ascii_alphanumeric() || c == '.' || c == '-')
         && tld.chars().all(|c| c.is_ascii_alphabetic())
 }
 
 fn is_suspicious_api(s: &str) -> bool {
-    SUSPICIOUS_APIS
-        .iter()
-        .any(|api| s == api.name)
+    SUSPICIOUS_APIS.iter().any(|api| s == api.name)
 }
 
 fn is_packer_signature(s: &str) -> bool {
-    PACKER_SIGNATURES
-        .iter()
-        .any(|sig| s.contains(sig))
+    PACKER_SIGNATURES.iter().any(|sig| s.contains(sig))
 }
 
 fn is_debug_artifact(s: &str) -> bool {
-    DEBUG_ARTIFACTS
-        .iter()
-        .any(|artifact| s.contains(artifact))
+    DEBUG_ARTIFACTS.iter().any(|artifact| s.contains(artifact))
 }
 
 fn is_anti_analysis(s: &str) -> bool {
     let lower = s.to_ascii_lowercase();
-    ANTI_ANALYSIS_INDICATORS.iter().any(|indicator| {
-        lower.contains(&indicator.to_ascii_lowercase())
-    })
+    ANTI_ANALYSIS_INDICATORS
+        .iter()
+        .any(|indicator| lower.contains(&indicator.to_ascii_lowercase()))
 }
 
 fn is_persistence_path(s: &str) -> bool {
-    PERSISTENCE_PATHS
-        .iter()
-        .any(|path| s.contains(path))
+    PERSISTENCE_PATHS.iter().any(|path| s.contains(path))
 }
 
 fn is_encoded_data(s: &str) -> bool {
@@ -627,9 +542,7 @@ fn is_encoded_data(s: &str) -> bool {
     if trimmed.is_empty() {
         return false;
     }
-    let all_base64 = trimmed
-        .bytes()
-        .all(|b| BASE64_CHARS.contains(&b));
+    let all_base64 = trimmed.bytes().all(|b| BASE64_CHARS.contains(&b));
     if !all_base64 {
         return false;
     }
@@ -645,13 +558,8 @@ mod tests {
     use crate::context::BinarySource;
 
     fn load_fixture(name: &str) -> Vec<u8> {
-        let path = format!(
-            "{}/tests/fixtures/{name}",
-            env!("CARGO_MANIFEST_DIR"),
-        );
-        std::fs::read(&path).unwrap_or_else(|e| {
-            panic!("fixture {path}: {e}")
-        })
+        let path = format!("{}/tests/fixtures/{name}", env!("CARGO_MANIFEST_DIR"),);
+        std::fs::read(&path).unwrap_or_else(|e| panic!("fixture {path}: {e}"))
     }
 
     fn make_ctx(data: Vec<u8>) -> AnalysisContext {
@@ -666,23 +574,12 @@ mod tests {
 
     #[test]
     fn ascii_extraction_min_length() {
-        let data =
-            b"abc\x00abcdef\x00ab\x00longstring\x00";
+        let data = b"abc\x00abcdef\x00ab\x00longstring\x00";
         let result = extract_strings(data, None);
 
-        let values: Vec<&str> = result
-            .strings
-            .iter()
-            .map(|s| s.value.as_str())
-            .collect();
-        assert!(
-            !values.contains(&"abc"),
-            "3-char string should be excluded"
-        );
-        assert!(
-            !values.contains(&"ab"),
-            "2-char string should be excluded"
-        );
+        let values: Vec<&str> = result.strings.iter().map(|s| s.value.as_str()).collect();
+        assert!(!values.contains(&"abc"), "3-char string should be excluded");
+        assert!(!values.contains(&"ab"), "2-char string should be excluded");
         assert!(
             values.contains(&"abcdef"),
             "6-char string should be included"
@@ -704,57 +601,28 @@ mod tests {
         data.push(0x00);
 
         let result = extract_strings(&data, None);
-        let utf16_strings: Vec<&ExtractedString> =
-            result
-                .strings
-                .iter()
-                .filter(|s| {
-                    s.encoding == StringEncoding::Utf16Le
-                })
-                .collect();
-        assert!(
-            !utf16_strings.is_empty(),
-            "should extract UTF-16LE string"
-        );
-        assert!(utf16_strings
+        let utf16_strings: Vec<&ExtractedString> = result
+            .strings
             .iter()
-            .any(|s| s.value.contains("Hello")));
+            .filter(|s| s.encoding == StringEncoding::Utf16Le)
+            .collect();
+        assert!(!utf16_strings.is_empty(), "should extract UTF-16LE string");
+        assert!(utf16_strings.iter().any(|s| s.value.contains("Hello")));
     }
 
     #[test]
     fn category_url() {
-        assert_eq!(
-            classify("https://evil.com/payload"),
-            StringCategory::Url,
-        );
-        assert_eq!(
-            classify("http://malware.ru/dropper"),
-            StringCategory::Url,
-        );
-        assert_eq!(
-            classify("ftp://files.example.com"),
-            StringCategory::Url,
-        );
+        assert_eq!(classify("https://evil.com/payload"), StringCategory::Url,);
+        assert_eq!(classify("http://malware.ru/dropper"), StringCategory::Url,);
+        assert_eq!(classify("ftp://files.example.com"), StringCategory::Url,);
     }
 
     #[test]
     fn category_ip_address() {
-        assert_eq!(
-            classify("192.168.1.1"),
-            StringCategory::IpAddress,
-        );
-        assert_eq!(
-            classify("10.0.0.1"),
-            StringCategory::IpAddress,
-        );
-        assert_ne!(
-            classify("999.999.999.999"),
-            StringCategory::IpAddress,
-        );
-        assert_ne!(
-            classify("1.2.3"),
-            StringCategory::IpAddress,
-        );
+        assert_eq!(classify("192.168.1.1"), StringCategory::IpAddress,);
+        assert_eq!(classify("10.0.0.1"), StringCategory::IpAddress,);
+        assert_ne!(classify("999.999.999.999"), StringCategory::IpAddress,);
+        assert_ne!(classify("1.2.3"), StringCategory::IpAddress,);
     }
 
     #[test]
@@ -763,10 +631,7 @@ mod tests {
             classify("HKLM\\Software\\Microsoft"),
             StringCategory::RegistryKey,
         );
-        assert_eq!(
-            classify("HKEY_LOCAL_MACHINE"),
-            StringCategory::RegistryKey,
-        );
+        assert_eq!(classify("HKEY_LOCAL_MACHINE"), StringCategory::RegistryKey,);
     }
 
     #[test]
@@ -775,22 +640,13 @@ mod tests {
             classify("C:\\Windows\\System32\\notepad.exe"),
             StringCategory::FilePath,
         );
-        assert_eq!(
-            classify("/tmp/output.log"),
-            StringCategory::FilePath,
-        );
-        assert_eq!(
-            classify("\\\\server\\share"),
-            StringCategory::FilePath,
-        );
+        assert_eq!(classify("/tmp/output.log"), StringCategory::FilePath,);
+        assert_eq!(classify("\\\\server\\share"), StringCategory::FilePath,);
     }
 
     #[test]
     fn category_shell_command() {
-        assert_eq!(
-            classify("cmd.exe /c whoami"),
-            StringCategory::ShellCommand,
-        );
+        assert_eq!(classify("cmd.exe /c whoami"), StringCategory::ShellCommand,);
         assert_eq!(
             classify("/bin/bash -c echo hi"),
             StringCategory::ShellCommand,
@@ -799,10 +655,7 @@ mod tests {
 
     #[test]
     fn category_packer_signature() {
-        assert_eq!(
-            classify("UPX!"),
-            StringCategory::PackerSignature,
-        );
+        assert_eq!(classify("UPX!"), StringCategory::PackerSignature,);
         assert_eq!(
             classify("This is .themida packed"),
             StringCategory::PackerSignature,
@@ -815,10 +668,7 @@ mod tests {
             classify("VMware Virtual Platform"),
             StringCategory::AntiAnalysis,
         );
-        assert_eq!(
-            classify("wireshark.exe"),
-            StringCategory::AntiAnalysis,
-        );
+        assert_eq!(classify("wireshark.exe"), StringCategory::AntiAnalysis,);
     }
 
     #[test]
@@ -830,63 +680,34 @@ mod tests {
             ),
             StringCategory::PersistencePath,
         );
-        assert_eq!(
-            classify("/etc/crontab"),
-            StringCategory::PersistencePath,
-        );
+        assert_eq!(classify("/etc/crontab"), StringCategory::PersistencePath,);
     }
 
     #[test]
     fn category_encoded_data() {
         assert_eq!(
-            classify(
-                "SGVsbG8gV29ybGQhIFRoaXMgaXM="
-            ),
-            StringCategory::EncodedData,
-        );
-        assert_ne!(
-            classify("short"),
+            classify("SGVsbG8gV29ybGQhIFRoaXMgaXM="),
             StringCategory::EncodedData,
         );
+        assert_ne!(classify("short"), StringCategory::EncodedData,);
     }
 
     #[test]
     fn category_email() {
-        assert_eq!(
-            classify("user@example.com"),
-            StringCategory::Email,
-        );
+        assert_eq!(classify("user@example.com"), StringCategory::Email,);
     }
 
     #[test]
     fn suspicious_flag_by_category() {
-        assert!(is_category_suspicious(
-            &StringCategory::ShellCommand
-        ));
-        assert!(is_category_suspicious(
-            &StringCategory::AntiAnalysis
-        ));
-        assert!(is_category_suspicious(
-            &StringCategory::PackerSignature
-        ));
-        assert!(is_category_suspicious(
-            &StringCategory::PersistencePath
-        ));
-        assert!(is_category_suspicious(
-            &StringCategory::EncodedData
-        ));
-        assert!(is_category_suspicious(
-            &StringCategory::CryptoWallet
-        ));
-        assert!(is_category_suspicious(
-            &StringCategory::SuspiciousApi
-        ));
-        assert!(!is_category_suspicious(
-            &StringCategory::Generic
-        ));
-        assert!(!is_category_suspicious(
-            &StringCategory::Url
-        ));
+        assert!(is_category_suspicious(&StringCategory::ShellCommand));
+        assert!(is_category_suspicious(&StringCategory::AntiAnalysis));
+        assert!(is_category_suspicious(&StringCategory::PackerSignature));
+        assert!(is_category_suspicious(&StringCategory::PersistencePath));
+        assert!(is_category_suspicious(&StringCategory::EncodedData));
+        assert!(is_category_suspicious(&StringCategory::CryptoWallet));
+        assert!(is_category_suspicious(&StringCategory::SuspiciousApi));
+        assert!(!is_category_suspicious(&StringCategory::Generic));
+        assert!(!is_category_suspicious(&StringCategory::Url));
     }
 
     #[test]
@@ -919,12 +740,11 @@ mod tests {
             virtual_size: 100,
             raw_offset: 10,
             raw_size: 100,
-            permissions:
-                crate::types::SectionPermissions {
-                    read: true,
-                    write: false,
-                    execute: false,
-                },
+            permissions: crate::types::SectionPermissions {
+                read: true,
+                write: false,
+                execute: false,
+            },
             sha256: String::new(),
         }];
 
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/threat.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/threat.rs
index 7aea4450..624b5b91 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/threat.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/passes/threat.rs
@@ -68,9 +68,7 @@ use crate::pass::{AnalysisPass, Sealed};
 use crate::passes::entropy::EntropyResult;
 use crate::passes::imports::ImportResult;
 use crate::passes::strings::StringResult;
-use crate::types::{
-    EntropyFlag, RiskLevel, StringCategory,
-};
+use crate::types::{EntropyFlag, RiskLevel, StringCategory};
 use crate::yara::{YaraMatch, YaraScanner};
 
 const IMPORT_MAX: u32 = 20;
@@ -147,12 +145,10 @@ const HIGH_MAX: u32 = 75;
 const SUMMARY_TOP_N: usize = 5;
 
 const SUSPICIOUS_TLDS: &[&str] = &[
-    ".ru", ".cn", ".tk", ".pw", ".cc", ".top",
-    ".xyz", ".buzz", ".onion",
+    ".ru", ".cn", ".tk", ".pw", ".cc", ".top", ".xyz", ".buzz", ".onion",
 ];
 
-const BASE64_MZ_PREFIXES: &[&str] =
-    &["TVqQ", "TVpQ", "TVoA", "TVpB"];
+const BASE64_MZ_PREFIXES: &[&str] = &["TVqQ", "TVpQ", "TVoA", "TVpB"];
 
 const TIMING_CHECK_FUNCTIONS: &[&str] = &[
     "GetTickCount64",
@@ -161,15 +157,9 @@ const TIMING_CHECK_FUNCTIONS: &[&str] = &[
     "rdtsc",
 ];
 
-const VM_STRINGS: &[&str] = &[
-    "vmware", "virtualbox", "vbox", "qemu",
-    "hyper-v", "xen",
-];
+const VM_STRINGS: &[&str] = &["vmware", "virtualbox", "vbox", "qemu", "hyper-v", "xen"];
 
-const SANDBOX_STRINGS: &[&str] = &[
-    "sandbox", "cuckoo", "wireshark", "procmon",
-    "sandboxie",
-];
+const SANDBOX_STRINGS: &[&str] = &["sandbox", "cuckoo", "wireshark", "procmon", "sandboxie"];
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ThreatResult {
@@ -214,25 +204,17 @@ impl AnalysisPass for ThreatPass {
     }
 
     fn dependencies(&self) -> &[&'static str] {
-        &[
-            "format", "imports", "strings",
-            "entropy", "disasm",
-        ]
+        &["format", "imports", "strings", "entropy", "disasm"]
     }
 
-    fn run(
-        &self,
-        ctx: &mut AnalysisContext,
-    ) -> Result<(), EngineError> {
+    fn run(&self, ctx: &mut AnalysisContext) -> Result<(), EngineError> {
         let yara_scanner = YaraScanner::new()?;
-        let yara_matches =
-            yara_scanner.scan(ctx.data())?;
+        let yara_matches = yara_scanner.scan(ctx.data())?;
 
         let format_result = ctx.format_result.as_ref();
         let import_result = ctx.import_result.as_ref();
         let string_result = ctx.string_result.as_ref();
-        let entropy_result =
-            ctx.entropy_result.as_ref();
+        let entropy_result = ctx.entropy_result.as_ref();
 
         let result = compute_threat_score(
             format_result,
@@ -253,21 +235,13 @@ pub fn compute_threat_score(
     entropy_result: Option<&EntropyResult>,
     yara_matches: &[YaraMatch],
 ) -> ThreatResult {
-    let cat_import =
-        score_imports(import_result, string_result);
+    let cat_import = score_imports(import_result, string_result);
     let cat_entropy = score_entropy(entropy_result);
-    let cat_packing = score_packing(
-        entropy_result,
-        format_result,
-        string_result,
-    );
+    let cat_packing = score_packing(entropy_result, format_result, string_result);
     let cat_strings = score_strings(string_result);
     let cat_sections = score_sections(format_result);
     let cat_ep = score_entry_point(format_result);
-    let cat_anti = score_anti_analysis(
-        import_result,
-        string_result,
-    );
+    let cat_anti = score_anti_analysis(import_result, string_result);
     let cat_yara = score_yara(yara_matches);
 
     let categories = vec![
@@ -281,10 +255,7 @@ pub fn compute_threat_score(
         cat_yara,
     ];
 
-    let total_score: u32 = categories
-        .iter()
-        .map(|c| c.score.min(c.max_score))
-        .sum();
+    let total_score: u32 = categories.iter().map(|c| c.score.min(c.max_score)).sum();
 
     let risk_level = classify_risk(total_score);
 
@@ -293,26 +264,16 @@ pub fn compute_threat_score(
         for combo in &ir.suspicious_combinations {
             if !combo.mitre_id.is_empty() {
                 mitre_techniques.push(MitreMapping {
-                    technique_id: combo
-                        .mitre_id
-                        .clone(),
-                    technique_name: combo
-                        .name
-                        .clone(),
-                    tactic: combo
-                        .description
-                        .clone(),
-                    evidence: combo
-                        .apis
-                        .join(" + "),
+                    technique_id: combo.mitre_id.clone(),
+                    technique_name: combo.name.clone(),
+                    tactic: combo.description.clone(),
+                    evidence: combo.apis.join(" + "),
                 });
             }
         }
         for mapping in &ir.mitre_mappings {
             mitre_techniques.push(MitreMapping {
-                technique_id: mapping
-                    .technique_id
-                    .clone(),
+                technique_id: mapping.technique_id.clone(),
                 technique_name: mapping.tag.clone(),
                 tactic: mapping.tag.clone(),
                 evidence: mapping.api.clone(),
@@ -321,15 +282,9 @@ pub fn compute_threat_score(
     }
 
     let mut seen_techniques = HashSet::new();
-    mitre_techniques.retain(|t| {
-        seen_techniques.insert(t.technique_id.clone())
-    });
+    mitre_techniques.retain(|t| seen_techniques.insert(t.technique_id.clone()));
 
-    let summary = generate_summary(
-        &categories,
-        total_score,
-        &risk_level,
-    );
+    let summary = generate_summary(&categories, total_score, &risk_level);
 
     ThreatResult {
         total_score,
@@ -361,79 +316,39 @@ fn score_imports(
     if let Some(ir) = import_result {
         for combo in &ir.suspicious_combinations {
             let points = match combo.name.as_str() {
-                "Process Injection Chain" => {
-                    INJECTION_CHAIN
-                }
-                "Process Hollowing" => {
-                    HOLLOWING_CHAIN
-                }
-                "Credential Theft" => {
-                    CREDENTIAL_ACCESS
-                }
+                "Process Injection Chain" => INJECTION_CHAIN,
+                "Process Hollowing" => HOLLOWING_CHAIN,
+                "Credential Theft" => CREDENTIAL_ACCESS,
                 "APC Injection" => APC_INJECTION,
                 "DLL Injection" => ANTI_DEBUG_API,
-                "Download and Execute"
-                | "Download and Execute (WinInet)" => {
-                    NETWORK_DOWNLOAD
-                }
-                "Registry Persistence" => {
-                    REGISTRY_RUN_KEYS
-                }
-                "Service Persistence" => {
-                    REGISTRY_RUN_KEYS
-                }
-                "Linux ptrace Injection" => {
-                    LINUX_PTRACE
-                }
-                "Linux RWX Memory" => {
-                    LINUX_RWX_MEMORY
-                }
-                "Linux C2 Connection" => {
-                    LINUX_C2_CONNECTION
-                }
-                "Linux Network Listener" => {
-                    LINUX_NETWORK_LISTENER
-                }
-                "Linux Dynamic Loading" => {
-                    LINUX_DYNAMIC_LOADING
-                }
-                "Linux Process Injection" => {
-                    LINUX_PROCESS_INJECTION
-                }
+                "Download and Execute" | "Download and Execute (WinInet)" => NETWORK_DOWNLOAD,
+                "Registry Persistence" => REGISTRY_RUN_KEYS,
+                "Service Persistence" => REGISTRY_RUN_KEYS,
+                "Linux ptrace Injection" => LINUX_PTRACE,
+                "Linux RWX Memory" => LINUX_RWX_MEMORY,
+                "Linux C2 Connection" => LINUX_C2_CONNECTION,
+                "Linux Network Listener" => LINUX_NETWORK_LISTENER,
+                "Linux Dynamic Loading" => LINUX_DYNAMIC_LOADING,
+                "Linux Process Injection" => LINUX_PROCESS_INJECTION,
                 _ => 3,
             };
             details.push(ScoringDetail {
-                rule: format!(
-                    "{} detected",
-                    combo.name
-                ),
+                rule: format!("{} detected", combo.name),
                 points,
-                evidence: combo
-                    .apis
-                    .join(" + "),
+                evidence: combo.apis.join(" + "),
             });
             raw += points;
         }
 
         for imp in &ir.imports {
-            if imp.is_suspicious
-                && imp
-                    .threat_tags
-                    .iter()
-                    .any(|t| t == "anti-debug")
-            {
-                let pts = if imp.function
-                    == "NtQueryInformationProcess"
-                {
+            if imp.is_suspicious && imp.threat_tags.iter().any(|t| t == "anti-debug") {
+                let pts = if imp.function == "NtQueryInformationProcess" {
                     ANTI_DEBUG_API
                 } else {
                     3
                 };
                 details.push(ScoringDetail {
-                    rule: format!(
-                        "Anti-debug API: {}",
-                        imp.function
-                    ),
+                    rule: format!("Anti-debug API: {}", imp.function),
                     points: pts,
                     evidence: imp.function.clone(),
                 });
@@ -441,17 +356,11 @@ fn score_imports(
             }
         }
 
-        if ir.statistics.total_imports
-            < FEW_IMPORTS_THRESHOLD
-            && ir.statistics.total_imports > 0
-        {
+        if ir.statistics.total_imports < FEW_IMPORTS_THRESHOLD && ir.statistics.total_imports > 0 {
             details.push(ScoringDetail {
                 rule: "Very few imports".into(),
                 points: VERY_FEW_IMPORTS,
-                evidence: format!(
-                    "{} imports",
-                    ir.statistics.total_imports
-                ),
+                evidence: format!("{} imports", ir.statistics.total_imports),
             });
             raw += VERY_FEW_IMPORTS;
         }
@@ -459,30 +368,21 @@ fn score_imports(
 
     if let Some(sr) = string_result {
         let import_names: HashSet<&str> = import_result
-            .map(|ir| {
-                ir.imports
-                    .iter()
-                    .map(|i| i.function.as_str())
-                    .collect()
-            })
+            .map(|ir| ir.imports.iter().map(|i| i.function.as_str()).collect())
             .unwrap_or_default();
         let string_only_apis = sr
             .strings
             .iter()
             .filter(|s| {
-                s.category
-                    == StringCategory::SuspiciousApi
-                    && !import_names
-                        .contains(s.value.as_str())
+                s.category == StringCategory::SuspiciousApi
+                    && !import_names.contains(s.value.as_str())
             })
             .count();
         if string_only_apis > 0 {
             details.push(ScoringDetail {
                 rule: "Suspicious API strings (not imported)".into(),
                 points: 3,
-                evidence: format!(
-                    "{string_only_apis} API names found in strings only"
-                ),
+                evidence: format!("{string_only_apis} API names found in strings only"),
             });
             raw += 3;
         }
@@ -496,45 +396,29 @@ fn score_imports(
     }
 }
 
-fn score_entropy(
-    entropy_result: Option<&EntropyResult>,
-) -> ScoringCategory {
+fn score_entropy(entropy_result: Option<&EntropyResult>) -> ScoringCategory {
     let mut details = Vec::new();
     let mut raw = 0u32;
 
     if let Some(er) = entropy_result {
         let mut high_count = 0u32;
         for section in &er.sections {
-            if section.entropy > HIGH_ENTROPY_THRESHOLD
-                && high_count < HIGH_SECTION_ENTROPY_CAP
-            {
+            if section.entropy > HIGH_ENTROPY_THRESHOLD && high_count < HIGH_SECTION_ENTROPY_CAP {
                 details.push(ScoringDetail {
-                    rule: format!(
-                        "High entropy section: {}",
-                        section.name
-                    ),
+                    rule: format!("High entropy section: {}", section.name),
                     points: HIGH_SECTION_ENTROPY,
-                    evidence: format!(
-                        "entropy={:.2}",
-                        section.entropy
-                    ),
+                    evidence: format!("entropy={:.2}", section.entropy),
                 });
                 raw += HIGH_SECTION_ENTROPY;
                 high_count += 1;
             }
         }
 
-        if er.overall_entropy
-            > VERY_HIGH_ENTROPY_THRESHOLD
-        {
+        if er.overall_entropy > VERY_HIGH_ENTROPY_THRESHOLD {
             details.push(ScoringDetail {
-                rule: "Very high overall entropy"
-                    .into(),
+                rule: "Very high overall entropy".into(),
                 points: VERY_HIGH_OVERALL_ENTROPY,
-                evidence: format!(
-                    "overall={:.2}",
-                    er.overall_entropy
-                ),
+                evidence: format!("overall={:.2}", er.overall_entropy),
             });
             raw += VERY_HIGH_OVERALL_ENTROPY;
         }
@@ -559,47 +443,33 @@ fn score_packing(
     if let Some(er) = entropy_result {
         let mut has_packer_section = false;
         for section in &er.sections {
-            if section
-                .flags
-                .contains(&EntropyFlag::PackerSectionName)
-            {
+            if section.flags.contains(&EntropyFlag::PackerSectionName) {
                 has_packer_section = true;
                 details.push(ScoringDetail {
-                    rule: "Known packer section name"
-                        .into(),
+                    rule: "Known packer section name".into(),
                     points: PACKER_SECTION_NAME,
                     evidence: section.name.clone(),
                 });
                 raw += PACKER_SECTION_NAME;
             }
-            if section
-                .flags
-                .contains(&EntropyFlag::EmptyRawData)
-            {
+            if section.flags.contains(&EntropyFlag::EmptyRawData) {
                 details.push(ScoringDetail {
-                    rule:
-                        "Empty raw with virtual size"
-                            .into(),
+                    rule: "Empty raw with virtual size".into(),
                     points: EMPTY_RAW_WITH_VIRTUAL,
                     evidence: format!(
                         "section={} virtual={}",
-                        section.name,
-                        section.virtual_to_raw_ratio
+                        section.name, section.virtual_to_raw_ratio
                     ),
                 });
                 raw += EMPTY_RAW_WITH_VIRTUAL;
             }
-            if section.flags.contains(
-                &EntropyFlag::HighVirtualToRawRatio,
-            ) {
+            if section.flags.contains(&EntropyFlag::HighVirtualToRawRatio) {
                 details.push(ScoringDetail {
-                    rule: "High virtual/raw ratio"
-                        .into(),
+                    rule: "High virtual/raw ratio".into(),
                     points: HIGH_VR_RATIO,
                     evidence: format!(
                         "section={} ratio={:.1}",
-                        section.name,
-                        section.virtual_to_raw_ratio
+                        section.name, section.virtual_to_raw_ratio
                     ),
                 });
                 raw += HIGH_VR_RATIO;
@@ -618,9 +488,7 @@ fn score_packing(
         let has_pushad = er
             .packing_indicators
             .iter()
-            .any(|pi| {
-                pi.indicator_type == "entry_point"
-            });
+            .any(|pi| pi.indicator_type == "entry_point");
         if has_pushad {
             details.push(ScoringDetail {
                 rule: "PUSHAD at entry point".into(),
@@ -633,20 +501,10 @@ fn score_packing(
         let has_upx_sections = er
             .packing_indicators
             .iter()
-            .any(|pi| {
-                pi.packer_name.as_deref()
-                    == Some("UPX")
-            });
-        let has_upx_magic = string_result
-            .map_or(false, |sr| {
-                sr.strings.iter().any(|s| {
-                    s.value.contains("UPX!")
-                })
-            });
-        if has_packer_section
-            && has_upx_sections
-            && !has_upx_magic
-        {
+            .any(|pi| pi.packer_name.as_deref() == Some("UPX"));
+        let has_upx_magic =
+            string_result.is_some_and(|sr| sr.strings.iter().any(|s| s.value.contains("UPX!")));
+        if has_packer_section && has_upx_sections && !has_upx_magic {
             details.push(ScoringDetail {
                 rule: "Modified UPX".into(),
                 points: MODIFIED_UPX,
@@ -657,19 +515,20 @@ fn score_packing(
     }
 
     if let Some(fr) = format_result {
-        let suspicious_section_count =
-            fr.sections.iter().filter(|s| {
+        let suspicious_section_count = fr
+            .sections
+            .iter()
+            .filter(|s| {
                 crate::formats::SUSPICIOUS_SECTION_NAMES
                     .iter()
                     .any(|&(sus, _)| s.name == sus)
-            }).count();
+            })
+            .count();
         if suspicious_section_count > 0 {
             details.push(ScoringDetail {
                 rule: "Suspicious section names".into(),
                 points: 3,
-                evidence: format!(
-                    "{suspicious_section_count} suspicious section names"
-                ),
+                evidence: format!("{suspicious_section_count} suspicious section names"),
             });
             raw += 3;
         }
@@ -683,31 +542,22 @@ fn score_packing(
     }
 }
 
-fn score_strings(
-    string_result: Option<&StringResult>,
-) -> ScoringCategory {
+fn score_strings(string_result: Option<&StringResult>) -> ScoringCategory {
     let mut details = Vec::new();
     let mut raw = 0u32;
 
     if let Some(sr) = string_result {
-        let has_suspicious_urls =
-            sr.strings.iter().any(|s| {
-                s.category == StringCategory::Url
-                    && SUSPICIOUS_TLDS.iter().any(
-                        |tld| {
-                            s.value
-                                .to_ascii_lowercase()
-                                .contains(tld)
-                        },
-                    )
-            });
+        let has_suspicious_urls = sr.strings.iter().any(|s| {
+            s.category == StringCategory::Url
+                && SUSPICIOUS_TLDS
+                    .iter()
+                    .any(|tld| s.value.to_ascii_lowercase().contains(tld))
+        });
         if has_suspicious_urls {
             details.push(ScoringDetail {
-                rule: "C2/malicious URL patterns"
-                    .into(),
+                rule: "C2/malicious URL patterns".into(),
                 points: C2_PATTERN,
-                evidence: "URL with suspicious TLD"
-                    .into(),
+                evidence: "URL with suspicious TLD".into(),
             });
             raw += C2_PATTERN;
         }
@@ -715,37 +565,27 @@ fn score_strings(
         let has_shell_commands = sr
             .strings
             .iter()
-            .any(|s| {
-                s.category == StringCategory::ShellCommand
-            });
+            .any(|s| s.category == StringCategory::ShellCommand);
         if has_shell_commands {
             details.push(ScoringDetail {
-                rule: "Suspicious shell commands"
-                    .into(),
+                rule: "Suspicious shell commands".into(),
                 points: SUSPICIOUS_COMMANDS,
-                evidence: "Shell command strings found"
-                    .into(),
+                evidence: "Shell command strings found".into(),
             });
             raw += SUSPICIOUS_COMMANDS;
         }
 
-        let has_base64_pe = sr.strings.iter().any(
-            |s| {
-                s.category == StringCategory::EncodedData
-                    && BASE64_MZ_PREFIXES.iter().any(
-                        |prefix| {
-                            s.value.starts_with(prefix)
-                        },
-                    )
-            },
-        );
+        let has_base64_pe = sr.strings.iter().any(|s| {
+            s.category == StringCategory::EncodedData
+                && BASE64_MZ_PREFIXES
+                    .iter()
+                    .any(|prefix| s.value.starts_with(prefix))
+        });
         if has_base64_pe {
             details.push(ScoringDetail {
-                rule: "Base64-encoded PE header"
-                    .into(),
+                rule: "Base64-encoded PE header".into(),
                 points: BASE64_PE_HEADER,
-                evidence: "TVqQ/TVpQ prefix in Base64"
-                    .into(),
+                evidence: "TVqQ/TVpQ prefix in Base64".into(),
             });
             raw += BASE64_PE_HEADER;
         }
@@ -753,18 +593,12 @@ fn score_strings(
         let has_reg_persistence = sr
             .strings
             .iter()
-            .any(|s| {
-                s.category
-                    == StringCategory::PersistencePath
-            });
+            .any(|s| s.category == StringCategory::PersistencePath);
         if has_reg_persistence {
             details.push(ScoringDetail {
-                rule: "Registry persistence paths"
-                    .into(),
+                rule: "Registry persistence paths".into(),
                 points: REGISTRY_PERSISTENCE,
-                evidence:
-                    "Run/RunOnce registry paths found"
-                        .into(),
+                evidence: "Run/RunOnce registry paths found".into(),
             });
             raw += REGISTRY_PERSISTENCE;
         }
@@ -772,16 +606,12 @@ fn score_strings(
         let has_crypto_wallets = sr
             .strings
             .iter()
-            .any(|s| {
-                s.category
-                    == StringCategory::CryptoWallet
-            });
+            .any(|s| s.category == StringCategory::CryptoWallet);
         if has_crypto_wallets {
             details.push(ScoringDetail {
                 rule: "Crypto wallet addresses".into(),
                 points: CRYPTO_WALLET,
-                evidence: "BTC/ETH address patterns"
-                    .into(),
+                evidence: "BTC/ETH address patterns".into(),
             });
             raw += CRYPTO_WALLET;
         }
@@ -795,76 +625,56 @@ fn score_strings(
     }
 }
 
-fn score_sections(
-    format_result: Option<&FormatResult>,
-) -> ScoringCategory {
+fn score_sections(format_result: Option<&FormatResult>) -> ScoringCategory {
     let mut details = Vec::new();
     let mut raw = 0u32;
 
     if let Some(fr) = format_result {
-        let has_rwx = fr.anomalies.iter().any(|a| {
-            matches!(
-                a,
-                FormatAnomaly::RwxSection { .. }
-            )
-        });
+        let has_rwx = fr
+            .anomalies
+            .iter()
+            .any(|a| matches!(a, FormatAnomaly::RwxSection { .. }));
         if has_rwx {
             details.push(ScoringDetail {
                 rule: "RWX section detected".into(),
                 points: RWX_SECTION,
-                evidence: "Read+Write+Execute section"
-                    .into(),
+                evidence: "Read+Write+Execute section".into(),
             });
             raw += RWX_SECTION;
         }
 
-        let has_empty_name =
-            fr.anomalies.iter().any(|a| {
-                matches!(
-                    a,
-                    FormatAnomaly::EmptySectionName {
-                        ..
-                    }
-                )
-            });
+        let has_empty_name = fr
+            .anomalies
+            .iter()
+            .any(|a| matches!(a, FormatAnomaly::EmptySectionName { .. }));
         if has_empty_name {
             details.push(ScoringDetail {
                 rule: "Empty/null section name".into(),
                 points: EMPTY_SECTION_NAME,
-                evidence:
-                    "Section with empty or null name"
-                        .into(),
+                evidence: "Section with empty or null name".into(),
             });
             raw += EMPTY_SECTION_NAME;
         }
 
         let section_count = fr.sections.len();
-        if section_count > MAX_NORMAL_SECTIONS
-            || section_count == 0
-        {
+        if section_count > MAX_NORMAL_SECTIONS || section_count == 0 {
             details.push(ScoringDetail {
                 rule: "Unusual section count".into(),
                 points: UNUSUAL_SECTION_COUNT,
-                evidence: format!(
-                    "{section_count} sections"
-                ),
+                evidence: format!("{section_count} sections"),
             });
             raw += UNUSUAL_SECTION_COUNT;
         }
 
-        let has_zero_code = fr.sections.iter().any(
-            |s| {
-                (s.name == ".text" || s.name == ".code")
-                    && s.raw_size == 0
-            },
-        );
+        let has_zero_code = fr
+            .sections
+            .iter()
+            .any(|s| (s.name == ".text" || s.name == ".code") && s.raw_size == 0);
         if has_zero_code {
             details.push(ScoringDetail {
                 rule: "Zero-size code section".into(),
                 points: ZERO_SIZE_CODE,
-                evidence:
-                    ".text/.code with raw_size == 0"
-                        .into(),
+                evidence: ".text/.code with raw_size == 0".into(),
             });
             raw += ZERO_SIZE_CODE;
         }
@@ -878,84 +688,62 @@ fn score_sections(
     }
 }
 
-fn score_entry_point(
-    format_result: Option<&FormatResult>,
-) -> ScoringCategory {
+fn score_entry_point(format_result: Option<&FormatResult>) -> ScoringCategory {
     let mut details = Vec::new();
     let mut raw = 0u32;
 
     if let Some(fr) = format_result {
         let ep = fr.entry_point;
 
-        let ep_section = fr.sections.iter().find(|s| {
-            ep >= s.virtual_address
-                && ep < s.virtual_address
-                    + s.virtual_size
-        });
+        let ep_section = fr
+            .sections
+            .iter()
+            .find(|s| ep >= s.virtual_address && ep < s.virtual_address + s.virtual_size);
 
         let in_text = fr.sections.iter().any(|s| {
-            s.name == ".text"
-                && ep >= s.virtual_address
-                && ep < s.virtual_address
-                    + s.virtual_size
+            s.name == ".text" && ep >= s.virtual_address && ep < s.virtual_address + s.virtual_size
         });
 
         if !in_text && ep_section.is_some() {
             details.push(ScoringDetail {
-                rule: "EP outside .text section"
-                    .into(),
+                rule: "EP outside .text section".into(),
                 points: EP_OUTSIDE_TEXT,
-                evidence: format!(
-                    "EP=0x{ep:x} not in .text"
-                ),
+                evidence: format!("EP=0x{ep:x} not in .text"),
             });
             raw += EP_OUTSIDE_TEXT;
         }
 
-        if ep_section.is_none() && !fr.sections.is_empty()
-        {
+        if ep_section.is_none() && !fr.sections.is_empty() {
             details.push(ScoringDetail {
                 rule: "EP outside all sections".into(),
                 points: EP_OUTSIDE_ALL,
-                evidence: format!(
-                    "EP=0x{ep:x} not in any section"
-                ),
+                evidence: format!("EP=0x{ep:x} not in any section"),
             });
             raw += EP_OUTSIDE_ALL;
         }
 
-        if let Some(last) = fr.sections.last() {
-            if ep >= last.virtual_address
-                && ep < last.virtual_address
-                    + last.virtual_size
-                && fr.sections.len() > 1
-            {
-                details.push(ScoringDetail {
-                    rule: "EP in last section".into(),
-                    points: EP_LAST_SECTION,
-                    evidence: format!(
-                        "EP=0x{ep:x} in last section '{}'",
-                        last.name
-                    ),
-                });
-                raw += EP_LAST_SECTION;
-            }
+        if let Some(last) = fr.sections.last()
+            && ep >= last.virtual_address
+            && ep < last.virtual_address + last.virtual_size
+            && fr.sections.len() > 1
+        {
+            details.push(ScoringDetail {
+                rule: "EP in last section".into(),
+                points: EP_LAST_SECTION,
+                evidence: format!("EP=0x{ep:x} in last section '{}'", last.name),
+            });
+            raw += EP_LAST_SECTION;
         }
 
-        let has_tls = fr.anomalies.iter().any(|a| {
-            matches!(
-                a,
-                FormatAnomaly::TlsCallbacksPresent {
-                    ..
-                }
-            )
-        });
+        let has_tls = fr
+            .anomalies
+            .iter()
+            .any(|a| matches!(a, FormatAnomaly::TlsCallbacksPresent { .. }));
         if has_tls {
             details.push(ScoringDetail {
                 rule: "TLS callbacks present".into(),
                 points: TLS_CALLBACKS,
-                evidence: "PE TLS callback entries"
-                    .into(),
+                evidence: "PE TLS callback entries".into(),
             });
             raw += TLS_CALLBACKS;
         }
@@ -976,13 +764,9 @@ fn score_anti_analysis(
     let mut details = Vec::new();
     let mut raw = 0u32;
 
-    let all_names = collect_api_and_string_names(
-        import_result,
-        string_result,
-    );
+    let all_names = collect_api_and_string_names(import_result, string_result);
 
-    if all_names.iter().any(|n| n == "IsDebuggerPresent")
-    {
+    if all_names.iter().any(|n| n == "IsDebuggerPresent") {
         details.push(ScoringDetail {
             rule: "IsDebuggerPresent detected".into(),
             points: IS_DEBUGGER_PRESENT,
@@ -991,16 +775,11 @@ fn score_anti_analysis(
         raw += IS_DEBUGGER_PRESENT;
     }
 
-    if all_names
-        .iter()
-        .any(|n| n == "NtQueryInformationProcess")
-    {
+    if all_names.iter().any(|n| n == "NtQueryInformationProcess") {
         details.push(ScoringDetail {
-            rule: "NtQueryInformationProcess detected"
-                .into(),
+            rule: "NtQueryInformationProcess detected".into(),
             points: NT_QUERY_INFO_PROCESS,
-            evidence: "NtQueryInformationProcess"
-                .into(),
+            evidence: "NtQueryInformationProcess".into(),
         });
         raw += NT_QUERY_INFO_PROCESS;
     }
@@ -1008,83 +787,60 @@ fn score_anti_analysis(
     if let Some(sr) = string_result {
         let has_vm = sr.strings.iter().any(|s| {
             let lower = s.value.to_ascii_lowercase();
-            VM_STRINGS
-                .iter()
-                .any(|vm| lower.contains(vm))
+            VM_STRINGS.iter().any(|vm| lower.contains(vm))
         });
         if has_vm {
             details.push(ScoringDetail {
                 rule: "VM detection strings".into(),
                 points: VM_DETECTION_STRINGS,
-                evidence:
-                    "VMware/VBox/QEMU/Hyper-V strings"
-                        .into(),
+                evidence: "VMware/VBox/QEMU/Hyper-V strings".into(),
             });
             raw += VM_DETECTION_STRINGS;
         }
 
         let has_sandbox = sr.strings.iter().any(|s| {
             let lower = s.value.to_ascii_lowercase();
-            SANDBOX_STRINGS
-                .iter()
-                .any(|sb| lower.contains(sb))
+            SANDBOX_STRINGS.iter().any(|sb| lower.contains(sb))
         });
         if has_sandbox {
             details.push(ScoringDetail {
                 rule: "Sandbox evasion strings".into(),
                 points: SANDBOX_EVASION,
-                evidence:
-                    "sandbox/cuckoo/wireshark strings"
-                        .into(),
+                evidence: "sandbox/cuckoo/wireshark strings".into(),
             });
             raw += SANDBOX_EVASION;
         }
 
-        let has_linux_anti_debug =
-            sr.strings.iter().any(|s| {
-                s.category
-                    == StringCategory::AntiAnalysis
-                    && s.value.contains("TracerPid")
-            });
+        let has_linux_anti_debug = sr
+            .strings
+            .iter()
+            .any(|s| s.category == StringCategory::AntiAnalysis && s.value.contains("TracerPid"));
         if has_linux_anti_debug {
             details.push(ScoringDetail {
-                rule: "Linux ptrace anti-debug"
-                    .into(),
+                rule: "Linux ptrace anti-debug".into(),
                 points: LINUX_PTRACE_CHECK,
-                evidence:
-                    "TracerPid check detected"
-                        .into(),
+                evidence: "TracerPid check detected".into(),
             });
             raw += LINUX_PTRACE_CHECK;
         }
 
-        let has_proc_analysis =
-            sr.strings.iter().any(|s| {
-                s.category
-                    == StringCategory::AntiAnalysis
-                    && (s.value
-                        .contains("/proc/self/maps")
-                        || s.value.contains(
-                            "/proc/self/status",
-                        ))
-            });
+        let has_proc_analysis = sr.strings.iter().any(|s| {
+            s.category == StringCategory::AntiAnalysis
+                && (s.value.contains("/proc/self/maps") || s.value.contains("/proc/self/status"))
+        });
         if has_proc_analysis {
             details.push(ScoringDetail {
                 rule: "/proc/self analysis".into(),
                 points: PROC_SELF_ANALYSIS,
-                evidence:
-                    "Process self-inspection detected"
-                        .into(),
+                evidence: "Process self-inspection detected".into(),
             });
             raw += PROC_SELF_ANALYSIS;
         }
     }
 
-    let has_timing = all_names.iter().any(|n| {
-        TIMING_CHECK_FUNCTIONS
-            .iter()
-            .any(|t| n.contains(t))
-    });
+    let has_timing = all_names
+        .iter()
+        .any(|n| TIMING_CHECK_FUNCTIONS.iter().any(|t| n.contains(t)));
     if has_timing {
         details.push(ScoringDetail {
             rule: "Timing check APIs".into(),
@@ -1102,49 +858,28 @@ fn score_anti_analysis(
     }
 }
 
-fn score_yara(
-    yara_matches: &[YaraMatch],
-) -> ScoringCategory {
+fn score_yara(yara_matches: &[YaraMatch]) -> ScoringCategory {
     let mut details = Vec::new();
     let mut raw = 0u32;
 
     for ym in yara_matches {
-        let category = ym
-            .metadata
-            .category
-            .as_deref()
-            .unwrap_or("");
-        let severity = ym
-            .metadata
-            .severity
-            .as_deref()
-            .unwrap_or("");
+        let category = ym.metadata.category.as_deref().unwrap_or("");
+        let severity = ym.metadata.severity.as_deref().unwrap_or("");
 
-        let points = if category == "malware"
-            || severity == "critical"
-        {
+        let points = if category == "malware" || severity == "critical" {
             YARA_MALWARE_FAMILY
         } else if category == "packer" {
             YARA_PACKER_RULE
-        } else if category == "c2"
-            || category == "credential-access"
-        {
+        } else if category == "c2" || category == "credential-access" {
             YARA_SUSPICIOUS + 2
         } else {
             YARA_SUSPICIOUS
         };
 
         details.push(ScoringDetail {
-            rule: format!(
-                "YARA: {}",
-                ym.rule_name
-            ),
+            rule: format!("YARA: {}", ym.rule_name),
             points,
-            evidence: ym
-                .metadata
-                .description
-                .clone()
-                .unwrap_or_default(),
+            evidence: ym.metadata.description.clone().unwrap_or_default(),
         });
         raw += points;
     }
@@ -1169,9 +904,7 @@ fn collect_api_and_string_names(
     }
     if let Some(sr) = string_result {
         for s in &sr.strings {
-            if s.category
-                == StringCategory::SuspiciousApi
-            {
+            if s.category == StringCategory::SuspiciousApi {
                 names.push(s.value.clone());
             }
         }
@@ -1184,16 +917,13 @@ fn generate_summary(
     total_score: u32,
     risk_level: &RiskLevel,
 ) -> String {
-    let mut all_details: Vec<(&str, &ScoringDetail)> =
-        Vec::new();
+    let mut all_details: Vec<(&str, &ScoringDetail)> = Vec::new();
     for cat in categories {
         for detail in &cat.details {
-            all_details
-                .push((&cat.name, detail));
+            all_details.push((&cat.name, detail));
         }
     }
-    all_details
-        .sort_by(|a, b| b.1.points.cmp(&a.1.points));
+    all_details.sort_by(|a, b| b.1.points.cmp(&a.1.points));
 
     let top: Vec<String> = all_details
         .iter()
@@ -1221,30 +951,15 @@ mod tests {
     #[test]
     fn risk_level_classification() {
         assert_eq!(classify_risk(0), RiskLevel::Benign);
-        assert_eq!(
-            classify_risk(15),
-            RiskLevel::Benign
-        );
+        assert_eq!(classify_risk(15), RiskLevel::Benign);
         assert_eq!(classify_risk(16), RiskLevel::Low);
         assert_eq!(classify_risk(35), RiskLevel::Low);
-        assert_eq!(
-            classify_risk(36),
-            RiskLevel::Medium
-        );
-        assert_eq!(
-            classify_risk(55),
-            RiskLevel::Medium
-        );
+        assert_eq!(classify_risk(36), RiskLevel::Medium);
+        assert_eq!(classify_risk(55), RiskLevel::Medium);
         assert_eq!(classify_risk(56), RiskLevel::High);
         assert_eq!(classify_risk(75), RiskLevel::High);
-        assert_eq!(
-            classify_risk(76),
-            RiskLevel::Critical
-        );
-        assert_eq!(
-            classify_risk(100),
-            RiskLevel::Critical
-        );
+        assert_eq!(classify_risk(76), RiskLevel::Critical);
+        assert_eq!(classify_risk(100), RiskLevel::Critical);
     }
 
     #[test]
@@ -1260,21 +975,14 @@ mod tests {
 
     #[test]
     fn total_is_sum_of_capped() {
-        let result = compute_threat_score(
-            None, None, None, None, &[],
-        );
+        let result = compute_threat_score(None, None, None, None, &[]);
         assert_eq!(result.total_score, 0);
-        assert_eq!(
-            result.risk_level,
-            RiskLevel::Benign
-        );
+        assert_eq!(result.risk_level, RiskLevel::Benign);
     }
 
     #[test]
     fn summary_empty_when_no_threats() {
-        let result = compute_threat_score(
-            None, None, None, None, &[],
-        );
+        let result = compute_threat_score(None, None, None, None, &[]);
         assert!(result.summary.contains("BENIGN"));
         assert!(result.summary.contains("0/100"));
     }
@@ -1285,9 +993,7 @@ mod tests {
             rule_name: "test_malware".into(),
             tags: Vec::new(),
             metadata: crate::yara::YaraMetadata {
-                description: Some(
-                    "Test malware rule".into(),
-                ),
+                description: Some("Test malware rule".into()),
                 category: Some("malware".into()),
                 severity: Some("critical".into()),
             },
@@ -1303,9 +1009,7 @@ mod tests {
             rule_name: "test_packer".into(),
             tags: Vec::new(),
             metadata: crate::yara::YaraMetadata {
-                description: Some(
-                    "Test packer rule".into(),
-                ),
+                description: Some("Test packer rule".into()),
                 category: Some("packer".into()),
                 severity: Some("medium".into()),
             },
@@ -1317,9 +1021,7 @@ mod tests {
 
     #[test]
     fn entropy_scoring() {
-        use crate::passes::entropy::{
-            EntropyResult, SectionEntropy,
-        };
+        use crate::passes::entropy::{EntropyResult, SectionEntropy};
         use crate::types::EntropyClassification;
 
         let er = EntropyResult {
@@ -1328,8 +1030,7 @@ mod tests {
                 name: ".text".into(),
                 entropy: 7.5,
                 size: 4096,
-                classification:
-                    EntropyClassification::Encrypted,
+                classification: EntropyClassification::Encrypted,
                 virtual_to_raw_ratio: 1.0,
                 is_anomalous: true,
                 flags: vec![EntropyFlag::HighEntropy],
@@ -1339,22 +1040,14 @@ mod tests {
             packing_indicators: Vec::new(),
         };
         let cat = score_entropy(Some(&er));
-        assert!(
-            cat.score > 0,
-            "should score for high entropy"
-        );
+        assert!(cat.score > 0, "should score for high entropy");
         assert!(cat.details.len() >= 2);
     }
 
     #[test]
     fn section_rwx_scoring() {
-        use crate::formats::{
-            FormatResult, SectionInfo,
-        };
-        use crate::types::{
-            Architecture, BinaryFormat, Endianness,
-            SectionPermissions,
-        };
+        use crate::formats::{FormatResult, SectionInfo};
+        use crate::types::{Architecture, BinaryFormat, Endianness, SectionPermissions};
 
         let fr = FormatResult {
             format: BinaryFormat::Elf,
@@ -1379,11 +1072,9 @@ mod tests {
                 sha256: String::new(),
             }],
             segments: Vec::new(),
-            anomalies: vec![
-                FormatAnomaly::RwxSection {
-                    name: ".text".into(),
-                },
-            ],
+            anomalies: vec![FormatAnomaly::RwxSection {
+                name: ".text".into(),
+            }],
             pe_info: None,
             elf_info: None,
             macho_info: None,
@@ -1395,17 +1086,12 @@ mod tests {
 
     #[test]
     fn threat_pass_populates_context() {
-        use std::sync::Arc;
         use crate::context::BinarySource;
+        use std::sync::Arc;
 
         fn load_fixture(name: &str) -> Vec<u8> {
-            let path = format!(
-                "{}/tests/fixtures/{name}",
-                env!("CARGO_MANIFEST_DIR"),
-            );
-            std::fs::read(&path).unwrap_or_else(
-                |e| panic!("fixture {path}: {e}"),
-            )
+            let path = format!("{}/tests/fixtures/{name}", env!("CARGO_MANIFEST_DIR"),);
+            std::fs::read(&path).unwrap_or_else(|e| panic!("fixture {path}: {e}"))
         }
 
         let data = load_fixture("hello_elf");
@@ -1417,21 +1103,11 @@ mod tests {
             size,
         );
 
-        crate::passes::format::FormatPass
-            .run(&mut ctx)
-            .unwrap();
-        crate::passes::imports::ImportPass
-            .run(&mut ctx)
-            .unwrap();
-        crate::passes::strings::StringPass
-            .run(&mut ctx)
-            .unwrap();
-        crate::passes::entropy::EntropyPass
-            .run(&mut ctx)
-            .unwrap();
-        crate::passes::disasm::DisasmPass
-            .run(&mut ctx)
-            .unwrap();
+        crate::passes::format::FormatPass.run(&mut ctx).unwrap();
+        crate::passes::imports::ImportPass.run(&mut ctx).unwrap();
+        crate::passes::strings::StringPass.run(&mut ctx).unwrap();
+        crate::passes::entropy::EntropyPass.run(&mut ctx).unwrap();
+        crate::passes::disasm::DisasmPass.run(&mut ctx).unwrap();
 
         assert!(ctx.threat_result.is_none());
         ThreatPass.run(&mut ctx).unwrap();
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/yara.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/yara.rs
index 469a6dce..3ae234d3 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/yara.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/src/yara.rs
@@ -271,58 +271,38 @@ pub struct YaraScanner {
 impl YaraScanner {
     pub fn new() -> Result<Self, EngineError> {
         let mut compiler = yara_x::Compiler::new();
-        compiler.add_source(BUILTIN_RULES).map_err(
-            |e| EngineError::Yara(e.to_string()),
-        )?;
+        compiler
+            .add_source(BUILTIN_RULES)
+            .map_err(|e| EngineError::Yara(e.to_string()))?;
 
         Ok(Self {
             rules: compiler.build(),
         })
     }
 
-    pub fn with_custom_rules(
-        rules_dir: &Path,
-    ) -> Result<Self, EngineError> {
+    pub fn with_custom_rules(rules_dir: &Path) -> Result<Self, EngineError> {
         let mut compiler = yara_x::Compiler::new();
-        compiler.add_source(BUILTIN_RULES).map_err(
-            |e| EngineError::Yara(e.to_string()),
-        )?;
+        compiler
+            .add_source(BUILTIN_RULES)
+            .map_err(|e| EngineError::Yara(e.to_string()))?;
 
         if rules_dir.is_dir() {
             for entry in std::fs::read_dir(rules_dir)
-                .map_err(|e| {
-                    EngineError::Yara(format!(
-                        "failed to read rules dir: {e}"
-                    ))
-                })?
+                .map_err(|e| EngineError::Yara(format!("failed to read rules dir: {e}")))?
             {
-                let entry = entry.map_err(|e| {
-                    EngineError::Yara(format!(
-                        "dir entry error: {e}"
-                    ))
-                })?;
+                let entry =
+                    entry.map_err(|e| EngineError::Yara(format!("dir entry error: {e}")))?;
                 let path = entry.path();
                 if path
                     .extension()
                     .is_some_and(|ext| ext == "yar" || ext == "yara")
                 {
-                    let source = std::fs::read_to_string(
-                        &path,
-                    )
-                    .map_err(|e| {
-                        EngineError::Yara(format!(
-                            "failed to read {}: {e}",
-                            path.display()
-                        ))
+                    let source = std::fs::read_to_string(&path).map_err(|e| {
+                        EngineError::Yara(format!("failed to read {}: {e}", path.display()))
+                    })?;
+                    compiler.add_source(source.as_str()).map_err(|e| {
+                        EngineError::Yara(format!("compile error in {}: {e}", path.display()))
                     })?;
-                    compiler
-                        .add_source(source.as_str())
-                        .map_err(|e| {
-                            EngineError::Yara(format!(
-                                "compile error in {}: {e}",
-                                path.display()
-                            ))
-                        })?;
                 }
             }
         }
@@ -332,22 +312,15 @@ impl YaraScanner {
         })
     }
 
-    pub fn scan(
-        &self,
-        data: &[u8],
-    ) -> Result<Vec<YaraMatch>, EngineError> {
-        let mut scanner =
-            yara_x::Scanner::new(&self.rules);
-        let results = scanner.scan(data).map_err(
-            |e| EngineError::Yara(e.to_string()),
-        )?;
+    pub fn scan(&self, data: &[u8]) -> Result<Vec<YaraMatch>, EngineError> {
+        let mut scanner = yara_x::Scanner::new(&self.rules);
+        let results = scanner
+            .scan(data)
+            .map_err(|e| EngineError::Yara(e.to_string()))?;
 
         let mut matches = Vec::new();
         for rule in results.matching_rules() {
-            let tags: Vec<String> = rule
-                .tags()
-                .map(|t| t.identifier().to_string())
-                .collect();
+            let tags: Vec<String> = rule.tags().map(|t| t.identifier().to_string()).collect();
 
             let mut description = None;
             let mut category = None;
@@ -356,20 +329,17 @@ impl YaraScanner {
                 match key {
                     "description" => {
                         if let yara_x::MetaValue::String(s) = value {
-                            description =
-                                Some(s.to_string());
+                            description = Some(s.to_string());
                         }
                     }
                     "category" => {
                         if let yara_x::MetaValue::String(s) = value {
-                            category =
-                                Some(s.to_string());
+                            category = Some(s.to_string());
                         }
                     }
                     "severity" => {
                         if let yara_x::MetaValue::String(s) = value {
-                            severity =
-                                Some(s.to_string());
+                            severity = Some(s.to_string());
                         }
                     }
                     _ => {}
@@ -378,25 +348,18 @@ impl YaraScanner {
 
             let mut matched_strings = Vec::new();
             for pattern in rule.patterns() {
-                let id = pattern
-                    .identifier()
-                    .to_string();
-                let count =
-                    pattern.matches().count();
+                let id = pattern.identifier().to_string();
+                let count = pattern.matches().count();
                 if count > 0 {
-                    matched_strings.push(
-                        YaraStringMatch {
-                            identifier: id,
-                            match_count: count,
-                        },
-                    );
+                    matched_strings.push(YaraStringMatch {
+                        identifier: id,
+                        match_count: count,
+                    });
                 }
             }
 
             matches.push(YaraMatch {
-                rule_name: rule
-                    .identifier()
-                    .to_string(),
+                rule_name: rule.identifier().to_string(),
                 tags,
                 metadata: YaraMetadata {
                     description,
@@ -435,42 +398,25 @@ mod tests {
         let upx_match = result
             .iter()
             .find(|m| m.rule_name == "suspicious_upx_packed");
-        assert!(
-            upx_match.is_some(),
-            "should detect UPX packer signature"
-        );
-        let meta =
-            &upx_match.unwrap().metadata;
-        assert_eq!(
-            meta.category.as_deref(),
-            Some("packer")
-        );
+        assert!(upx_match.is_some(), "should detect UPX packer signature");
+        let meta = &upx_match.unwrap().metadata;
+        assert_eq!(meta.category.as_deref(), Some("packer"));
     }
 
     #[test]
     fn detects_process_injection() {
         let mut data = Vec::new();
-        data.extend_from_slice(
-            b"\x00\x00VirtualAllocEx\x00\x00",
-        );
-        data.extend_from_slice(
-            b"\x00\x00WriteProcessMemory\x00\x00",
-        );
-        data.extend_from_slice(
-            b"\x00\x00CreateRemoteThread\x00\x00",
-        );
+        data.extend_from_slice(b"\x00\x00VirtualAllocEx\x00\x00");
+        data.extend_from_slice(b"\x00\x00WriteProcessMemory\x00\x00");
+        data.extend_from_slice(b"\x00\x00CreateRemoteThread\x00\x00");
         data.extend_from_slice(&[0u8; 256]);
 
         let scanner = YaraScanner::new().unwrap();
         let result = scanner.scan(&data).unwrap();
-        let injection = result.iter().find(|m| {
-            m.rule_name
-                == "suspicious_process_injection"
-        });
-        assert!(
-            injection.is_some(),
-            "should detect process injection APIs"
-        );
+        let injection = result
+            .iter()
+            .find(|m| m.rule_name == "suspicious_process_injection");
+        assert!(injection.is_some(), "should detect process injection APIs");
     }
 
     #[test]
@@ -480,9 +426,7 @@ mod tests {
         let result = scanner.scan(data).unwrap();
         let suspicious: Vec<_> = result
             .iter()
-            .filter(|m| {
-                m.rule_name != "suspicious_obfuscation"
-            })
+            .filter(|m| m.rule_name != "suspicious_obfuscation")
             .collect();
         assert!(
             suspicious.is_empty(),
@@ -492,13 +436,8 @@ mod tests {
     }
 
     fn load_fixture(name: &str) -> Vec<u8> {
-        let path = format!(
-            "{}/tests/fixtures/{name}",
-            env!("CARGO_MANIFEST_DIR"),
-        );
-        std::fs::read(&path).unwrap_or_else(|e| {
-            panic!("fixture {path}: {e}")
-        })
+        let path = format!("{}/tests/fixtures/{name}", env!("CARGO_MANIFEST_DIR"),);
+        std::fs::read(&path).unwrap_or_else(|e| panic!("fixture {path}: {e}"))
     }
 
     #[test]
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/tests/integration.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/tests/integration.rs
index ed981bda..8b622506 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/tests/integration.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem-engine/tests/integration.rs
@@ -20,24 +20,19 @@
 //   lib.rs   - AnalysisEngine
 //   types.rs - BinaryFormat
 
-use axumortem_engine::types::BinaryFormat;
 use axumortem_engine::AnalysisEngine;
+use axumortem_engine::types::BinaryFormat;
 
 fn load_fixture(name: &str) -> Vec<u8> {
-    let path = format!(
-        "{}/tests/fixtures/{name}",
-        env!("CARGO_MANIFEST_DIR"),
-    );
-    std::fs::read(&path)
-        .unwrap_or_else(|e| panic!("fixture {path}: {e}"))
+    let path = format!("{}/tests/fixtures/{name}", env!("CARGO_MANIFEST_DIR"),);
+    std::fs::read(&path).unwrap_or_else(|e| panic!("fixture {path}: {e}"))
 }
 
 #[test]
 fn full_pipeline_elf() {
     let engine = AnalysisEngine::new().unwrap();
     let data = load_fixture("hello_elf");
-    let (ctx, report) =
-        engine.analyze(&data, "hello_elf");
+    let (ctx, report) = engine.analyze(&data, "hello_elf");
 
     assert!(
         report.all_succeeded(),
@@ -58,8 +53,7 @@ fn full_pipeline_elf() {
     assert!(ctx.entropy_result.is_some());
     assert!(ctx.disassembly_result.is_some());
 
-    let disasm =
-        ctx.disassembly_result.as_ref().unwrap();
+    let disasm = ctx.disassembly_result.as_ref().unwrap();
     assert!(disasm.total_functions > 0);
     assert!(disasm.total_instructions > 0);
 
@@ -73,8 +67,7 @@ fn full_pipeline_elf() {
 fn full_pipeline_stripped_elf() {
     let engine = AnalysisEngine::new().unwrap();
     let data = load_fixture("hello_elf_stripped");
-    let (ctx, report) =
-        engine.analyze(&data, "hello_elf_stripped");
+    let (ctx, report) = engine.analyze(&data, "hello_elf_stripped");
 
     assert!(report.all_succeeded());
 
@@ -98,15 +91,11 @@ fn sha256_computed_correctly() {
 fn invalid_binary_handled() {
     let engine = AnalysisEngine::new().unwrap();
     let data = vec![0xDE, 0xAD, 0xBE, 0xEF];
-    let (_, report) =
-        engine.analyze(&data, "garbage.bin");
+    let (_, report) = engine.analyze(&data, "garbage.bin");
 
     assert!(
         !report.all_succeeded(),
         "invalid binary should cause format pass failure"
     );
-    assert!(report
-        .failed_passes()
-        .iter()
-        .any(|p| p.name == "format"));
+    assert!(report.failed_passes().iter().any(|p| p.name == "format"));
 }
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/db/mod.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/db/mod.rs
index 75be7c84..3643e137 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/db/mod.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/db/mod.rs
@@ -17,8 +17,6 @@ pub mod queries;
 
 use sqlx::PgPool;
 
-pub async fn run_migrations(
-    pool: &PgPool,
-) -> Result<(), sqlx::migrate::MigrateError> {
+pub async fn run_migrations(pool: &PgPool) -> Result<(), sqlx::migrate::MigrateError> {
     sqlx::migrate!("./migrations").run(pool).await
 }
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/db/models.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/db/models.rs
index 2cd314a8..8664db51 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/db/models.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/db/models.rs
@@ -38,6 +38,7 @@ pub struct AnalysisRow {
 }
 
 #[derive(FromRow)]
+#[allow(dead_code)]
 pub struct PassResultRow {
     pub id: Uuid,
     pub analysis_id: Uuid,
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/db/queries.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/db/queries.rs
index 0d6714b0..97fc74a5 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/db/queries.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/db/queries.rs
@@ -22,33 +22,23 @@
 use sqlx::{PgPool, Postgres, Transaction};
 use uuid::Uuid;
 
-use super::models::{
-    AnalysisRow, NewAnalysis, NewPassResult,
-    PassResultRow,
-};
+use super::models::{AnalysisRow, NewAnalysis, NewPassResult, PassResultRow};
 
 pub async fn find_slug_by_sha256(
     pool: &PgPool,
     sha256: &str,
 ) -> Result<Option<String>, sqlx::Error> {
-    sqlx::query_scalar(
-        "SELECT slug FROM analyses WHERE sha256 = $1",
-    )
-    .bind(sha256)
-    .fetch_optional(pool)
-    .await
+    sqlx::query_scalar("SELECT slug FROM analyses WHERE sha256 = $1")
+        .bind(sha256)
+        .fetch_optional(pool)
+        .await
 }
 
-pub async fn find_by_slug(
-    pool: &PgPool,
-    slug: &str,
-) -> Result<Option<AnalysisRow>, sqlx::Error> {
-    sqlx::query_as::<_, AnalysisRow>(
-        "SELECT * FROM analyses WHERE slug = $1",
-    )
-    .bind(slug)
-    .fetch_optional(pool)
-    .await
+pub async fn find_by_slug(pool: &PgPool, slug: &str) -> Result<Option<AnalysisRow>, sqlx::Error> {
+    sqlx::query_as::<_, AnalysisRow>("SELECT * FROM analyses WHERE slug = $1")
+        .bind(slug)
+        .fetch_optional(pool)
+        .await
 }
 
 pub async fn find_pass_results(
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/error.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/error.rs
index b0246d7b..3b0eab09 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/error.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/error.rs
@@ -16,9 +16,9 @@
 //   routes/upload.rs   - returned from upload handler
 //   routes/analysis.rs - returned from analysis lookup
 
+use axum::Json;
 use axum::http::StatusCode;
 use axum::response::{IntoResponse, Response};
-use axum::Json;
 use serde::Serialize;
 
 #[derive(Serialize)]
@@ -32,6 +32,7 @@ struct ErrorDetail {
     message: String,
 }
 
+#[allow(dead_code)]
 pub enum ApiError {
     NoFile,
     FileTooLarge { max_bytes: usize },
@@ -71,37 +72,23 @@ impl IntoResponse for ApiError {
             Self::NoFile => (
                 StatusCode::BAD_REQUEST,
                 "NO_FILE",
-                "No file was provided in the upload"
-                    .to_string(),
+                "No file was provided in the upload".to_string(),
             ),
             Self::FileTooLarge { max_bytes } => (
                 StatusCode::BAD_REQUEST,
                 "FILE_TOO_LARGE",
-                format!(
-                    "File exceeds maximum allowed size of {} bytes",
-                    max_bytes
-                ),
-            ),
-            Self::InvalidBinary { reason } => (
-                StatusCode::BAD_REQUEST,
-                "INVALID_BINARY",
-                reason,
-            ),
-            Self::AnalysisFailed { reason } => (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                "ANALYSIS_FAILED",
-                reason,
+                format!("File exceeds maximum allowed size of {} bytes", max_bytes),
             ),
+            Self::InvalidBinary { reason } => (StatusCode::BAD_REQUEST, "INVALID_BINARY", reason),
+            Self::AnalysisFailed { reason } => {
+                (StatusCode::INTERNAL_SERVER_ERROR, "ANALYSIS_FAILED", reason)
+            }
             Self::NotFound { resource } => (
                 StatusCode::NOT_FOUND,
                 "NOT_FOUND",
                 format!("{resource} not found"),
             ),
-            Self::Internal { reason } => (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                "INTERNAL",
-                reason,
-            ),
+            Self::Internal { reason } => (StatusCode::INTERNAL_SERVER_ERROR, "INTERNAL", reason),
         };
 
         (
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/main.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/main.rs
index 99473535..d2bc8193 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/main.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/main.rs
@@ -49,11 +49,7 @@ async fn main() -> anyhow::Result<()> {
     tracing_subscriber::fmt()
         .with_env_filter(
             EnvFilter::try_from_default_env()
-                .unwrap_or_else(|_| {
-                    EnvFilter::new(
-                        "info,tower_http=debug",
-                    )
-                }),
+                .unwrap_or_else(|_| EnvFilter::new("info,tower_http=debug")),
         )
         .init();
 
@@ -67,10 +63,8 @@ async fn main() -> anyhow::Result<()> {
         .await
         .context("failed to run database migrations")?;
 
-    let engine = axumortem_engine::AnalysisEngine::new()
-        .context(
-            "failed to initialize analysis engine",
-        )?;
+    let engine =
+        axumortem_engine::AnalysisEngine::new().context("failed to initialize analysis engine")?;
 
     let config = Arc::new(config);
 
@@ -83,18 +77,14 @@ async fn main() -> anyhow::Result<()> {
     let layers = ServiceBuilder::new()
         .layer(TraceLayer::new_for_http())
         .layer(middleware::cors::layer(&config))
-        .layer(DefaultBodyLimit::max(
-            config.max_upload_size,
-        ));
+        .layer(DefaultBodyLimit::max(config.max_upload_size));
 
-    let app =
-        routes::api_router().layer(layers).with_state(state);
+    let app = routes::api_router().layer(layers).with_state(state);
 
     let bind_address = config.bind_address();
-    let listener =
-        tokio::net::TcpListener::bind(&bind_address)
-            .await
-            .context("failed to bind TCP listener")?;
+    let listener = tokio::net::TcpListener::bind(&bind_address)
+        .await
+        .context("failed to bind TCP listener")?;
 
     tracing::info!("listening on {}", bind_address);
 
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/middleware/cors.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/middleware/cors.rs
index 63a41a8b..2434a579 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/middleware/cors.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/middleware/cors.rs
@@ -13,17 +13,15 @@
 //   config.rs - AppConfig.cors_origin
 //   main.rs   - applied as tower layer
 
-use axum::http::header::{HeaderName, ACCEPT, CONTENT_TYPE};
 use axum::http::Method;
+use axum::http::header::{ACCEPT, CONTENT_TYPE, HeaderName};
 use tower_http::cors::{Any, CorsLayer};
 
 use crate::config::AppConfig;
 
-const ALLOWED_METHODS: [Method; 3] =
-    [Method::GET, Method::POST, Method::OPTIONS];
+const ALLOWED_METHODS: [Method; 3] = [Method::GET, Method::POST, Method::OPTIONS];
 
-const ALLOWED_HEADERS: [HeaderName; 2] =
-    [CONTENT_TYPE, ACCEPT];
+const ALLOWED_HEADERS: [HeaderName; 2] = [CONTENT_TYPE, ACCEPT];
 
 pub fn layer(config: &AppConfig) -> CorsLayer {
     let base = CorsLayer::new()
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/routes/analysis.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/routes/analysis.rs
index 9f853ae1..25d868be 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/routes/analysis.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/routes/analysis.rs
@@ -17,8 +17,8 @@
 
 use std::collections::HashMap;
 
-use axum::extract::{Path, State};
 use axum::Json;
+use axum::extract::{Path, State};
 use chrono::{DateTime, Utc};
 use serde::Serialize;
 use uuid::Uuid;
@@ -53,15 +53,12 @@ pub async fn get_by_slug(
             resource: format!("analysis '{slug}'"),
         })?;
 
-    let pass_rows =
-        queries::find_pass_results(&state.db, row.id)
-            .await?;
+    let pass_rows = queries::find_pass_results(&state.db, row.id).await?;
 
-    let passes: HashMap<String, serde_json::Value> =
-        pass_rows
-            .into_iter()
-            .map(|p| (p.pass_name, p.result))
-            .collect();
+    let passes: HashMap<String, serde_json::Value> = pass_rows
+        .into_iter()
+        .map(|p| (p.pass_name, p.result))
+        .collect();
 
     Ok(Json(AnalysisResponse {
         id: row.id,
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/routes/health.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/routes/health.rs
index dd308cb7..03ba5e8f 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/routes/health.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/routes/health.rs
@@ -11,8 +11,8 @@
 // Connects to:
 //   state.rs - AppState.db
 
-use axum::extract::State;
 use axum::Json;
+use axum::extract::State;
 use serde::Serialize;
 
 use crate::state::AppState;
@@ -23,15 +23,11 @@ pub(crate) struct HealthResponse {
     database: &'static str,
 }
 
-pub async fn check(
-    State(state): State<AppState>,
-) -> Json<HealthResponse> {
-    let db_status =
-        match sqlx::query("SELECT 1").execute(&state.db).await
-        {
-            Ok(_) => "connected",
-            Err(_) => "disconnected",
-        };
+pub async fn check(State(state): State<AppState>) -> Json<HealthResponse> {
+    let db_status = match sqlx::query("SELECT 1").execute(&state.db).await {
+        Ok(_) => "connected",
+        Err(_) => "disconnected",
+    };
 
     Json(HealthResponse {
         status: "ok",
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/routes/mod.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/routes/mod.rs
index a085ed3a..3a71ae04 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/routes/mod.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/routes/mod.rs
@@ -18,8 +18,8 @@ mod analysis;
 mod health;
 mod upload;
 
-use axum::routing::{get, post};
 use axum::Router;
+use axum::routing::{get, post};
 
 use crate::state::AppState;
 
@@ -27,8 +27,5 @@ pub fn api_router() -> Router<AppState> {
     Router::new()
         .route("/api/health", get(health::check))
         .route("/api/upload", post(upload::handle))
-        .route(
-            "/api/analysis/{slug}",
-            get(analysis::get_by_slug),
-        )
+        .route("/api/analysis/{slug}", get(analysis::get_by_slug))
 }
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/routes/upload.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/routes/upload.rs
index cef05ec4..e1148bb9 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/routes/upload.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/routes/upload.rs
@@ -27,8 +27,8 @@
 use std::collections::HashMap;
 use std::sync::Arc;
 
-use axum::extract::{Multipart, State};
 use axum::Json;
+use axum::extract::{Multipart, State};
 use serde::Serialize;
 use uuid::Uuid;
 
@@ -42,9 +42,7 @@ use crate::state::AppState;
 
 const SLUG_LENGTH: usize = 12;
 
-const PASS_NAME_MAP: &[(&str, &str)] = &[
-    ("disasm", "disassembly"),
-];
+const PASS_NAME_MAP: &[(&str, &str)] = &[("disasm", "disassembly")];
 
 #[derive(Serialize)]
 pub(crate) struct UploadResponse {
@@ -56,32 +54,19 @@ pub async fn handle(
     State(state): State<AppState>,
     mut multipart: Multipart,
 ) -> Result<Json<UploadResponse>, ApiError> {
-    let (file_name, data) =
-        extract_file(&mut multipart).await?;
+    let (file_name, data) = extract_file(&mut multipart).await?;
 
-    let sha256 =
-        axumortem_engine::sha256_hex(&data);
+    let sha256 = axumortem_engine::sha256_hex(&data);
 
-    if let Some(slug) =
-        queries::find_slug_by_sha256(
-            &state.db, &sha256,
-        )
-        .await?
-    {
-        return Ok(Json(UploadResponse {
-            slug,
-            cached: true,
-        }));
+    if let Some(slug) = queries::find_slug_by_sha256(&state.db, &sha256).await? {
+        return Ok(Json(UploadResponse { slug, cached: true }));
     }
 
     let engine = Arc::clone(&state.engine);
     let name_clone = file_name.clone();
 
     let (ctx, report) =
-        tokio::task::spawn_blocking(move || {
-            engine.analyze(&data, &name_clone)
-        })
-        .await?;
+        tokio::task::spawn_blocking(move || engine.analyze(&data, &name_clone)).await?;
 
     let fmt = ctx.format_result.as_ref();
     let threat = ctx.threat_result.as_ref();
@@ -91,29 +76,19 @@ pub async fn handle(
         sha256,
         file_name,
         file_size: ctx.file_size as i64,
-        format: fmt
-            .map(|f| f.format.to_string())
-            .unwrap_or_default(),
-        architecture: fmt
-            .map(|f| f.architecture.to_string())
-            .unwrap_or_default(),
-        entry_point: fmt
-            .map(|f| f.entry_point as i64),
-        threat_score: threat
-            .map(|t| t.total_score as i32),
-        risk_level: threat
-            .map(|t| t.risk_level.to_string()),
+        format: fmt.map(|f| f.format.to_string()).unwrap_or_default(),
+        architecture: fmt.map(|f| f.architecture.to_string()).unwrap_or_default(),
+        entry_point: fmt.map(|f| f.entry_point as i64),
+        threat_score: threat.map(|t| t.total_score as i32),
+        risk_level: threat.map(|t| t.risk_level.to_string()),
         slug: slug.clone(),
     };
 
     let mut tx = state.db.begin().await?;
 
-    let row =
-        queries::insert_analysis(&mut tx, &new_analysis)
-            .await?;
+    let row = queries::insert_analysis(&mut tx, &new_analysis).await?;
 
-    let pass_results =
-        build_pass_results(&ctx, &report, row.id)?;
+    let pass_results = build_pass_results(&ctx, &report, row.id)?;
     for pr in &pass_results {
         queries::insert_pass_result(&mut tx, pr).await?;
     }
@@ -126,9 +101,7 @@ pub async fn handle(
     }))
 }
 
-async fn extract_file(
-    multipart: &mut Multipart,
-) -> Result<(String, Vec<u8>), ApiError> {
+async fn extract_file(multipart: &mut Multipart) -> Result<(String, Vec<u8>), ApiError> {
     while let Some(field) = multipart
         .next_field()
         .await
@@ -137,16 +110,10 @@ async fn extract_file(
         })?
     {
         if field.name() == Some("file") {
-            let name = field
-                .file_name()
-                .unwrap_or("unknown")
-                .to_string();
-            let data = field
-                .bytes()
-                .await
-                .map_err(|e| ApiError::Internal {
-                    reason: e.to_string(),
-                })?;
+            let name = field.file_name().unwrap_or("unknown").to_string();
+            let data = field.bytes().await.map_err(|e| ApiError::Internal {
+                reason: e.to_string(),
+            })?;
             return Ok((name, data.to_vec()));
         }
     }
@@ -181,12 +148,9 @@ fn build_pass_results(
             if let Some(ref r) = ctx.$field {
                 results.push(NewPassResult {
                     analysis_id,
-                    pass_name: api_name($name)
-                        .to_string(),
+                    pass_name: api_name($name).to_string(),
                     result: serde_json::to_value(r)?,
-                    duration_ms: durations
-                        .get($name)
-                        .map(|&d| d as i32),
+                    duration_ms: durations.get($name).map(|&d| d as i32),
                 });
             }
         };
diff --git a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/state.rs b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/state.rs
index 289d12d9..6c398d4a 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/state.rs
+++ b/PROJECTS/intermediate/binary-analysis-tool/backend/crates/axumortem/src/state.rs
@@ -24,5 +24,6 @@ use crate::config::AppConfig;
 pub struct AppState {
     pub db: PgPool,
     pub engine: Arc<AnalysisEngine>,
+    #[allow(dead_code)]
     pub config: Arc<AppConfig>,
 }
diff --git a/PROJECTS/intermediate/binary-analysis-tool/frontend/package.json b/PROJECTS/intermediate/binary-analysis-tool/frontend/package.json
index ec1f5829..30e7273e 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/frontend/package.json
+++ b/PROJECTS/intermediate/binary-analysis-tool/frontend/package.json
@@ -17,7 +17,7 @@
   "dependencies": {
     "@dagrejs/dagre": "^3.0.0",
     "@tanstack/react-query": "^5.90.12",
-    "axios": "^1.15.2",
+    "axios": "^1.16.0",
     "react": "^19.2.1",
     "react-dom": "^19.2.0",
     "react-error-boundary": "^6.0.0",
diff --git a/PROJECTS/intermediate/binary-analysis-tool/frontend/pnpm-lock.yaml b/PROJECTS/intermediate/binary-analysis-tool/frontend/pnpm-lock.yaml
index 2fac4b2d..3863c67c 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/frontend/pnpm-lock.yaml
+++ b/PROJECTS/intermediate/binary-analysis-tool/frontend/pnpm-lock.yaml
@@ -18,8 +18,8 @@ importers:
         specifier: ^5.90.12
         version: 5.90.12(react@19.2.1)
       axios:
-        specifier: ^1.15.2
-        version: 1.15.2
+        specifier: ^1.16.0
+        version: 1.16.0
       react:
         specifier: ^19.2.1
         version: 19.2.1
@@ -199,24 +199,28 @@ packages:
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@biomejs/cli-linux-arm64@2.3.8':
     resolution: {integrity: sha512-Uo1OJnIkJgSgF+USx970fsM/drtPcQ39I+JO+Fjsaa9ZdCN1oysQmy6oAGbyESlouz+rzEckLTF6DS7cWse95g==}
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@biomejs/cli-linux-x64-musl@2.3.8':
     resolution: {integrity: sha512-YGLkqU91r1276uwSjiUD/xaVikdxgV1QpsicT0bIA1TaieM6E5ibMZeSyjQ/izBn4tKQthUSsVZacmoJfa3pDA==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@biomejs/cli-linux-x64@2.3.8':
     resolution: {integrity: sha512-QDPMD5bQz6qOVb3kiBui0zKZXASLo0NIQ9JVJio5RveBEFgDgsvJFUvZIbMbUZT3T00M/1wdzwWXk4GIh0KaAw==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@biomejs/cli-win32-arm64@2.3.8':
     resolution: {integrity: sha512-H4IoCHvL1fXKDrTALeTKMiE7GGWFAraDwBYFquE/L/5r1927Te0mYIGseXi4F+lrrwhSWbSGt5qPFswNoBaCxg==}
@@ -357,36 +361,42 @@ packages:
     engines: {node: '>= 10.0.0'}
     cpu: [arm]
     os: [linux]
+    libc: [glibc]
 
   '@parcel/watcher-linux-arm-musl@2.5.1':
     resolution: {integrity: sha512-6E+m/Mm1t1yhB8X412stiKFG3XykmgdIOqhjWj+VL8oHkKABfu/gjFj8DvLrYVHSBNC+/u5PeNrujiSQ1zwd1Q==}
     engines: {node: '>= 10.0.0'}
     cpu: [arm]
     os: [linux]
+    libc: [musl]
 
   '@parcel/watcher-linux-arm64-glibc@2.5.1':
     resolution: {integrity: sha512-LrGp+f02yU3BN9A+DGuY3v3bmnFUggAITBGriZHUREfNEzZh/GO06FF5u2kx8x+GBEUYfyTGamol4j3m9ANe8w==}
     engines: {node: '>= 10.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@parcel/watcher-linux-arm64-musl@2.5.1':
     resolution: {integrity: sha512-cFOjABi92pMYRXS7AcQv9/M1YuKRw8SZniCDw0ssQb/noPkRzA+HBDkwmyOJYp5wXcsTrhxO0zq1U11cK9jsFg==}
     engines: {node: '>= 10.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@parcel/watcher-linux-x64-glibc@2.5.1':
     resolution: {integrity: sha512-GcESn8NZySmfwlTsIur+49yDqSny2IhPeZfXunQi48DMugKeZ7uy1FX83pO0X22sHntJ4Ub+9k34XQCX+oHt2A==}
     engines: {node: '>= 10.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@parcel/watcher-linux-x64-musl@2.5.1':
     resolution: {integrity: sha512-n0E2EQbatQ3bXhcH2D1XIAANAcTZkQICBPVaxMeaCVBtOpBZpWJuf7LwyWPSBDITb7In8mqQgJ7gH8CILCURXg==}
     engines: {node: '>= 10.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@parcel/watcher-win32-arm64@2.5.1':
     resolution: {integrity: sha512-RFzklRvmc3PkjKjry3hLF9wD7ppR4AKcWNzH7kXR7GUe0Igb3Nz8fyPwtZCSquGrhU5HhUNDr/mKBqj7tqA2Vw==}
@@ -445,24 +455,28 @@ packages:
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@rolldown/binding-linux-arm64-musl@1.0.0-beta.50':
     resolution: {integrity: sha512-L0zRdH2oDPkmB+wvuTl+dJbXCsx62SkqcEqdM+79LOcB+PxbAxxjzHU14BuZIQdXcAVDzfpMfaHWzZuwhhBTcw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@rolldown/binding-linux-x64-gnu@1.0.0-beta.50':
     resolution: {integrity: sha512-gyoI8o/TGpQd3OzkJnh1M2kxy1Bisg8qJ5Gci0sXm9yLFzEXIFdtc4EAzepxGvrT2ri99ar5rdsmNG0zP0SbIg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@rolldown/binding-linux-x64-musl@1.0.0-beta.50':
     resolution: {integrity: sha512-zti8A7M+xFDpKlghpcCAzyOi+e5nfUl3QhU023ce5NCgUxRG5zGP2GR9LTydQ1rnIPwZUVBWd4o7NjZDaQxaXA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@rolldown/binding-openharmony-arm64@1.0.0-beta.50':
     resolution: {integrity: sha512-eZUssog7qljrrRU9Mi0eqYEPm3Ch0UwB+qlWPMKSUXHNqhm3TvDZarJQdTevGEfu3EHAXJvBIe0YFYr0TPVaMA==}
@@ -573,8 +587,8 @@ packages:
   asynckit@0.4.0:
     resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
 
-  axios@1.15.2:
-    resolution: {integrity: sha512-wLrXxPtcrPTsNlJmKjkPnNPK2Ihe0hn0wGSaTEiHRPxwjvJwT3hKmXF4dpqxmPO9SoNb2FsYXj/xEo0gHN+D5A==}
+  axios@1.16.0:
+    resolution: {integrity: sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==}
 
   babel-runtime@5.8.38:
     resolution: {integrity: sha512-KpgoA8VE/pMmNCrnEeeXqFG24TIH11Z3ZaimIhJWsin8EbfZy3WzFKUTIan10ZIDgRVvi9EkLbruJElJC9dRlg==}
@@ -714,8 +728,8 @@ packages:
     resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
     engines: {node: '>= 0.4'}
 
-  es-object-atoms@1.1.1:
-    resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
+  es-object-atoms@1.1.2:
+    resolution: {integrity: sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==}
     engines: {node: '>= 0.4'}
 
   es-set-tostringtag@2.1.0:
@@ -840,8 +854,8 @@ packages:
     resolution: {integrity: sha512-fWltioiy5zsSAs9ouEnvhsVJeAXRybGCNNv0lvzpzNOSDbULXRy7ivFWwCCv4I5Am6kSo75hmbsCduOoc2/K4w==}
     engines: {node: '>=20'}
 
-  hasown@2.0.3:
-    resolution: {integrity: sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==}
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
     engines: {node: '>= 0.4'}
 
   hookified@1.14.0:
@@ -967,24 +981,28 @@ packages:
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   lightningcss-linux-arm64-musl@1.30.2:
     resolution: {integrity: sha512-5Vh9dGeblpTxWHpOx8iauV02popZDsCYMPIgiuw97OJ5uaDsL86cnqSFs5LZkG3ghHoX5isLgWzMs+eD1YzrnA==}
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   lightningcss-linux-x64-gnu@1.30.2:
     resolution: {integrity: sha512-Cfd46gdmj1vQ+lR6VRTTadNHu6ALuw2pKR9lYq4FnhvgBc4zWY1EtZcAc6EffShbb1MFrIPfLDXD6Xprbnni4w==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   lightningcss-linux-x64-musl@1.30.2:
     resolution: {integrity: sha512-XJaLUUFXb6/QG2lGIW6aIk6jKdtjtcffUT0NKvIqhSBY3hh9Ch+1LCeH80dR9q9LBjG3ewbDjnumefsLsP6aiA==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   lightningcss-win32-arm64-msvc@1.30.2:
     resolution: {integrity: sha512-FZn+vaj7zLv//D/192WFFVA0RgHawIcHqLX9xuWiQt7P0PtdFEVaxgF9rjM/IRYHQXNnk61/H/gb2Ei+kUQ4xQ==}
@@ -1877,7 +1895,7 @@ snapshots:
 
   asynckit@0.4.0: {}
 
-  axios@1.15.2:
+  axios@1.16.0:
     dependencies:
       follow-redirects: 1.16.0
       form-data: 4.0.5
@@ -1999,7 +2017,7 @@ snapshots:
 
   es-errors@1.3.0: {}
 
-  es-object-atoms@1.1.1:
+  es-object-atoms@1.1.2:
     dependencies:
       es-errors: 1.3.0
 
@@ -2008,7 +2026,7 @@ snapshots:
       es-errors: 1.3.0
       get-intrinsic: 1.3.0
       has-tostringtag: 1.0.2
-      hasown: 2.0.3
+      hasown: 2.0.4
 
   escalade@3.2.0: {}
 
@@ -2057,7 +2075,7 @@ snapshots:
       asynckit: 0.4.0
       combined-stream: 1.0.8
       es-set-tostringtag: 2.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       mime-types: 2.1.35
 
   fsevents@2.3.3:
@@ -2072,18 +2090,18 @@ snapshots:
       call-bind-apply-helpers: 1.0.2
       es-define-property: 1.0.1
       es-errors: 1.3.0
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
       function-bind: 1.1.2
       get-proto: 1.0.1
       gopd: 1.2.0
       has-symbols: 1.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       math-intrinsics: 1.1.0
 
   get-proto@1.0.1:
     dependencies:
       dunder-proto: 1.0.1
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
 
   glob-parent@5.1.2:
     dependencies:
@@ -2126,7 +2144,7 @@ snapshots:
     dependencies:
       hookified: 1.14.0
 
-  hasown@2.0.3:
+  hasown@2.0.4:
     dependencies:
       function-bind: 1.1.2
 
diff --git a/PROJECTS/intermediate/binary-analysis-tool/frontend/src/pages/landing/index.tsx b/PROJECTS/intermediate/binary-analysis-tool/frontend/src/pages/landing/index.tsx
index 7dc12d35..5aaa5144 100644
--- a/PROJECTS/intermediate/binary-analysis-tool/frontend/src/pages/landing/index.tsx
+++ b/PROJECTS/intermediate/binary-analysis-tool/frontend/src/pages/landing/index.tsx
@@ -109,6 +109,7 @@ export function Component(): React.ReactElement {
           width="100%"
           height="100%"
           preserveAspectRatio="none"
+          aria-hidden="true"
         >
           <filter id="grain-bat">
             <feTurbulence
@@ -248,7 +249,9 @@ export function Component(): React.ReactElement {
 
       <footer className={styles.footer}>
         <span>&copy; ANGELAMOS 2026</span>
-        <span className={styles.footerDesignation}>SYS AXM-BDE // UNIT-001</span>
+        <span className={styles.footerDesignation}>
+          SYS AXM-BDE {'//'} UNIT-001
+        </span>
         <span>AXUMORTEM</span>
       </footer>
     </div>
diff --git a/PROJECTS/intermediate/credential-rotation-enforcer/.ameba.yml b/PROJECTS/intermediate/credential-rotation-enforcer/.ameba.yml
new file mode 100644
index 00000000..d8a14688
--- /dev/null
+++ b/PROJECTS/intermediate/credential-rotation-enforcer/.ameba.yml
@@ -0,0 +1,16 @@
+# ©AngelaMos | 2026
+# .ameba.yml
+#
+# Disabled rules document intentional patterns in this codebase
+# - Naming/BlockParameterName: idiomatic Crystal uses short block params like |c|, |b|
+# - Lint/NotNil: .not_nil! used as explicit runtime contract assertion after upstream
+#   validation; raising NilAssertionError is the desired crash mode for misconfiguration
+# Raised thresholds match the natural shape of dispatch/subscriber handlers
+Naming/BlockParameterName:
+  Enabled: false
+
+Lint/NotNil:
+  Enabled: false
+
+Metrics/CyclomaticComplexity:
+  MaxComplexity: 20
diff --git a/PROJECTS/intermediate/credential-rotation-enforcer/shard.lock b/PROJECTS/intermediate/credential-rotation-enforcer/shard.lock
index 4da0ce31..5c86ac70 100644
--- a/PROJECTS/intermediate/credential-rotation-enforcer/shard.lock
+++ b/PROJECTS/intermediate/credential-rotation-enforcer/shard.lock
@@ -1,5 +1,9 @@
 version: 2.0
 shards:
+  ameba:
+    git: https://github.com/crystal-ameba/ameba.git
+    version: 1.6.4
+
   db:
     git: https://github.com/crystal-lang/crystal-db.git
     version: 0.11.0
diff --git a/PROJECTS/intermediate/credential-rotation-enforcer/shard.yml b/PROJECTS/intermediate/credential-rotation-enforcer/shard.yml
index 0afcc30e..56f75bbc 100644
--- a/PROJECTS/intermediate/credential-rotation-enforcer/shard.yml
+++ b/PROJECTS/intermediate/credential-rotation-enforcer/shard.yml
@@ -33,3 +33,6 @@ development_dependencies:
   webmock:
     github: manastech/webmock.cr
     version: ~> 0.9
+  ameba:
+    github: crystal-ameba/ameba
+    version: ~> 1.6.4
diff --git a/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/aws/signer.cr b/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/aws/signer.cr
index 5e4c8bdd..8d17acd8 100644
--- a/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/aws/signer.cr
+++ b/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/aws/signer.cr
@@ -79,7 +79,7 @@ module CRE::Aws
     end
 
     private def canonical_query(query : String?) : String
-      return "" unless query && !query.empty?
+      return "" if query.nil? || query.empty?
       params = [] of {String, String}
       query.split('&') do |pair|
         eq = pair.index('=')
@@ -99,7 +99,7 @@ module CRE::Aws
     private def canonical_headers_and_list(headers : HTTP::Headers) : {String, String}
       sorted = headers.to_a.map { |name, values|
         {name.downcase, values.first.strip.gsub(/\s+/, " ")}
-      }.sort_by { |entry| entry[0] }
+      }.sort_by! { |entry| entry[0] }
 
       canonical = sorted.map { |k, v| "#{k}:#{v}\n" }.join
       list = sorted.map(&.[0]).join(';')
diff --git a/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/cli/commands/check.cr b/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/cli/commands/check.cr
index 2dc78c15..c8078f6b 100644
--- a/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/cli/commands/check.cr
+++ b/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/cli/commands/check.cr
@@ -32,7 +32,7 @@ module CRE::Cli::Commands
       CRE::Policy::Evaluator.new(bus, persist).evaluate_all
       sleep 0.1.seconds
 
-      violations = drain(ch).select(&.is_a?(CRE::Events::PolicyViolation)).map(&.as(CRE::Events::PolicyViolation))
+      violations = drain(ch).select(CRE::Events::PolicyViolation).map(&.as(CRE::Events::PolicyViolation))
       bus.stop
       persist.close
 
diff --git a/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/demo/tui_demo.cr b/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/demo/tui_demo.cr
index dc0d0212..77b46b80 100644
--- a/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/demo/tui_demo.cr
+++ b/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/demo/tui_demo.cr
@@ -19,7 +19,7 @@ module CRE::Demo
       bus.run
       tui.start
 
-      script_fiber = spawn do
+      spawn do
         run_script(bus, seconds)
       end
 
diff --git a/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/engine/rotation_orchestrator.cr b/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/engine/rotation_orchestrator.cr
index 9fa682d9..bc489b9c 100644
--- a/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/engine/rotation_orchestrator.cr
+++ b/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/engine/rotation_orchestrator.cr
@@ -59,7 +59,7 @@ module CRE::Engine
         @persistence.rotations.update_state(rotation_id, Persistence::RotationState::Applying)
         @bus.publish Events::RotationStepCompleted.new(c.id, rotation_id, :generate)
 
-        current_step = :apply
+        current_step = :apply # ameba:disable Lint/UselessAssign — read in rescue
         @bus.publish Events::RotationStepStarted.new(c.id, rotation_id, :apply)
         rotator.apply(c, new_secret)
         @persistence.rotations.update_state(rotation_id, Persistence::RotationState::Verifying)
@@ -83,8 +83,8 @@ module CRE::Engine
         if (ns = new_secret) && (current_step == :apply || current_step == :verify)
           begin
             rotator.rollback_apply(c, ns)
-          rescue rb
-            Log.error(exception: rb) { "rollback_apply failed for credential #{c.id}" }
+          rescue error
+            Log.error(exception: error) { "rollback_apply failed for credential #{c.id}" }
           end
         end
         finalize_failure(c, rotation_id, current_step, ex)
diff --git a/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/persistence/postgres/postgres_persistence.cr b/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/persistence/postgres/postgres_persistence.cr
index 661dc7a9..213adbe3 100644
--- a/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/persistence/postgres/postgres_persistence.cr
+++ b/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/persistence/postgres/postgres_persistence.cr
@@ -40,11 +40,11 @@ module CRE::Persistence::Postgres
       @audit ||= AuditRepo.new(@db)
     end
 
-    def transaction(&block : ->) : Nil
+    def transaction(& : ->) : Nil
       @db.transaction { yield }
     end
 
-    def with_advisory_lock(key : Int64, &block : ->) : Nil
+    def with_advisory_lock(key : Int64, & : ->) : Nil
       @db.transaction do |tx|
         tx.connection.exec("SELECT pg_advisory_xact_lock($1)", key)
         yield
diff --git a/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/persistence/sqlite/sqlite_persistence.cr b/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/persistence/sqlite/sqlite_persistence.cr
index 58c61c69..076459b1 100644
--- a/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/persistence/sqlite/sqlite_persistence.cr
+++ b/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/persistence/sqlite/sqlite_persistence.cr
@@ -48,11 +48,11 @@ module CRE::Persistence::Sqlite
       @audit ||= AuditRepo.new(@db)
     end
 
-    def transaction(&block : ->) : Nil
+    def transaction(& : ->) : Nil
       @db.transaction { yield }
     end
 
-    def with_advisory_lock(key : Int64, &block : ->) : Nil
+    def with_advisory_lock(key : Int64, & : ->) : Nil
       _ = key # SQLite is single-process; the mutex is sufficient
       @mutex.synchronize { yield }
     end
diff --git a/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/policy/dsl.cr b/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/policy/dsl.cr
index ff7c4b71..47adc99e 100644
--- a/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/policy/dsl.cr
+++ b/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/policy/dsl.cr
@@ -25,7 +25,7 @@ module CRE::Policy::Dsl
   # `enforce :rotate_immediatly` fail at compile time. Splat-symbol args
   # (`notify_via :telegram, :structured_log`) are validated at policy
   # registration time and raise `BuilderError` on typos.
-  def policy(name : String, &block)
+  def policy(name : String, &)
     builder = CRE::Policy::Builder.new(name)
     with builder yield
     CRE::Policy::REGISTRY << builder.build
diff --git a/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/policy/evaluator.cr b/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/policy/evaluator.cr
index 11cc25cc..1d4d2d43 100644
--- a/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/policy/evaluator.cr
+++ b/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/policy/evaluator.cr
@@ -54,7 +54,7 @@ module CRE::Policy
       return if @policies.empty?
 
       seen = Set(UUID).new
-      @policies.group_by(&.max_age).each do |max_age, policies_with_age|
+      @policies.group_by(&.max_age).each do |max_age, _|
         @persistence.credentials.overdue(now, max_age).each do |c|
           next if seen.includes?(c.id)
           seen << c.id
diff --git a/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/rotators/env_file.cr b/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/rotators/env_file.cr
index e33a015a..8ec6ee3b 100644
--- a/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/rotators/env_file.cr
+++ b/PROJECTS/intermediate/credential-rotation-enforcer/src/cre/rotators/env_file.cr
@@ -50,7 +50,7 @@ module CRE::Rotators
       pending = pending_path(path)
 
       existing = File.exists?(path) ? File.read(path) : ""
-      lines = existing.lines(chomp: true).reject { |line| line.strip.starts_with?("#{key}=") }
+      lines = existing.lines(chomp: true).reject(&.strip.starts_with?("#{key}="))
       new_value = String.new(s.ciphertext)
       lines << "#{key}=#{new_value}"
 
diff --git a/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/.golangci.yml b/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/.golangci.yml
index 794b0097..c438ea7c 100644
--- a/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/.golangci.yml
+++ b/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/.golangci.yml
@@ -1,31 +1,39 @@
 # ©AngelaMos | 2026
 # .golangci.yml
+version: "2"
 
 run:
   timeout: 5m
 
 linters:
+  default: none
   enable:
     - errcheck
     - govet
     - staticcheck
     - unused
-    - gosimple
     - ineffassign
-    - typecheck
-    - gofmt
     - gocritic
     - gosec
     - misspell
     - unconvert
     - unparam
     - prealloc
-
-linters-settings:
-  gocritic:
-    enabled-tags:
-      - diagnostic
-      - performance
-  gosec:
-    excludes:
-      - G304
+  settings:
+    errcheck:
+      exclude-functions:
+        - fmt.Fprint
+        - fmt.Fprintf
+        - fmt.Fprintln
+        - (io.Closer).Close
+    gocritic:
+      enabled-tags:
+        - diagnostic
+        - performance
+      disabled-checks:
+        - hugeParam
+        - rangeValCopy
+    gosec:
+      excludes:
+        - G304
+        - G704
diff --git a/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/cli/generate.go b/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/cli/generate.go
index e6b54e5d..8d64f35a 100644
--- a/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/cli/generate.go
+++ b/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/cli/generate.go
@@ -73,7 +73,7 @@ func runGenerate(_ *cobra.Command, args []string) error {
 	}
 
 	if outputFile != "" {
-		if err := os.WriteFile(outputFile, data, 0o644); err != nil {
+		if err := os.WriteFile(outputFile, data, 0o600); err != nil {
 			return fmt.Errorf("write output: %w", err)
 		}
 		fmt.Fprintf(os.Stderr, "  %s SBOM written to %s (%s)\n",
diff --git a/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/cli/vuln.go b/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/cli/vuln.go
index b9490a78..ad00ebc3 100644
--- a/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/cli/vuln.go
+++ b/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/cli/vuln.go
@@ -75,7 +75,7 @@ func runVuln(cmd *cobra.Command, args []string) error {
 }
 
 func queryVulns(ctx context.Context, result *types.ScanResult) (*types.VulnReport, error) {
-	var allPkgs []types.Package
+	allPkgs := make([]types.Package, 0, len(result.Graphs))
 	for _, g := range result.Graphs {
 		allPkgs = append(allPkgs, graph.AllPackages(g)...)
 	}
@@ -85,7 +85,7 @@ func queryVulns(ctx context.Context, result *types.ScanResult) (*types.VulnRepor
 		c, err := vuln.NewCache(vuln.DefaultCachePath(), 24*time.Hour)
 		if err == nil {
 			cache = c
-			defer cache.Close()
+			defer func() { _ = cache.Close() }()
 		}
 	}
 
diff --git a/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/parser/gomod.go b/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/parser/gomod.go
index 584a7647..f9fcb3b4 100644
--- a/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/parser/gomod.go
+++ b/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/parser/gomod.go
@@ -38,7 +38,7 @@ func (p *GoModParser) Parse(dir string) (*types.DependencyGraph, error) {
 	if err != nil {
 		return nil, fmt.Errorf("open go.mod: %w", err)
 	}
-	defer modFile.Close()
+	defer func() { _ = modFile.Close() }()
 
 	var moduleName string
 	directDeps := make(map[string]string)
@@ -120,13 +120,13 @@ func (p *GoModParser) Parse(dir string) (*types.DependencyGraph, error) {
 		graph.AddPackage(pkg)
 	}
 
-	parseGoModGraph(dir, moduleName, graph)
+	parseGoModGraph(dir, graph)
 	computeDepthLevels(graph)
 
 	return graph, nil
 }
 
-func parseGoModGraph(dir, moduleName string, graph *types.DependencyGraph) {
+func parseGoModGraph(dir string, graph *types.DependencyGraph) {
 	cmd := exec.Command("go", "mod", "graph")
 	cmd.Dir = dir
 	out, err := cmd.Output()
@@ -140,8 +140,8 @@ func parseGoModGraph(dir, moduleName string, graph *types.DependencyGraph) {
 		if len(parts) != 2 {
 			continue
 		}
-		parentPURL := goDepToPURL(parts[0], moduleName)
-		childPURL := goDepToPURL(parts[1], moduleName)
+		parentPURL := goDepToPURL(parts[0])
+		childPURL := goDepToPURL(parts[1])
 
 		if _, exists := graph.Nodes[childPURL]; !exists {
 			continue
@@ -154,7 +154,7 @@ func parseGoModGraph(dir, moduleName string, graph *types.DependencyGraph) {
 	}
 }
 
-func goDepToPURL(dep, moduleName string) string {
+func goDepToPURL(dep string) string {
 	if !strings.Contains(dep, "@") {
 		return fmt.Sprintf("pkg:golang/%s", dep)
 	}
@@ -195,7 +195,7 @@ func parseGoSum(path string) map[string][]types.Checksum {
 	if err != nil {
 		return checksums
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 
 	scanner := bufio.NewScanner(f)
 	for scanner.Scan() {
diff --git a/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/vuln/cache.go b/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/vuln/cache.go
index 6a38a8b6..5e082772 100644
--- a/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/vuln/cache.go
+++ b/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/vuln/cache.go
@@ -23,7 +23,7 @@ type Cache struct {
 
 func NewCache(dbPath string, ttl time.Duration) (*Cache, error) {
 	dir := filepath.Dir(dbPath)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
+	if err := os.MkdirAll(dir, 0o750); err != nil {
 		return nil, fmt.Errorf("create cache dir: %w", err)
 	}
 
@@ -40,7 +40,7 @@ func NewCache(dbPath string, ttl time.Duration) (*Cache, error) {
 		PRIMARY KEY (purl, source)
 	)`
 	if _, err := db.Exec(createSQL); err != nil {
-		db.Close()
+		_ = db.Close()
 		return nil, fmt.Errorf("create cache table: %w", err)
 	}
 
diff --git a/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/vuln/cache_test.go b/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/vuln/cache_test.go
index 154e298a..fb87ba07 100644
--- a/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/vuln/cache_test.go
+++ b/PROJECTS/intermediate/sbom-generator-vulnerability-matcher/internal/vuln/cache_test.go
@@ -17,7 +17,7 @@ func TestCachePutGet(t *testing.T) {
 	dbPath := filepath.Join(t.TempDir(), "test.db")
 	cache, err := NewCache(dbPath, 24*time.Hour)
 	require.NoError(t, err)
-	defer cache.Close()
+	defer func() { _ = cache.Close() }()
 
 	matches := []types.VulnMatch{
 		{
@@ -39,7 +39,7 @@ func TestCacheExpiry(t *testing.T) {
 	dbPath := filepath.Join(t.TempDir(), "test.db")
 	cache, err := NewCache(dbPath, 1*time.Millisecond)
 	require.NoError(t, err)
-	defer cache.Close()
+	defer func() { _ = cache.Close() }()
 
 	matches := []types.VulnMatch{
 		{
@@ -60,7 +60,7 @@ func TestCacheMiss(t *testing.T) {
 	dbPath := filepath.Join(t.TempDir(), "test.db")
 	cache, err := NewCache(dbPath, 24*time.Hour)
 	require.NoError(t, err)
-	defer cache.Close()
+	defer func() { _ = cache.Close() }()
 
 	_, ok, err := cache.Get("pkg:golang/nonexistent@v1.0.0", "osv")
 	require.NoError(t, err)
@@ -71,7 +71,7 @@ func TestCacheOverwrite(t *testing.T) {
 	dbPath := filepath.Join(t.TempDir(), "test.db")
 	cache, err := NewCache(dbPath, 24*time.Hour)
 	require.NoError(t, err)
-	defer cache.Close()
+	defer func() { _ = cache.Close() }()
 
 	old := []types.VulnMatch{
 		{Vulnerability: types.Vulnerability{ID: "CVE-OLD"}},
diff --git a/PROJECTS/intermediate/secrets-scanner/go.mod b/PROJECTS/intermediate/secrets-scanner/go.mod
index 6525dfd0..c65c8886 100644
--- a/PROJECTS/intermediate/secrets-scanner/go.mod
+++ b/PROJECTS/intermediate/secrets-scanner/go.mod
@@ -4,7 +4,7 @@ go 1.25.0
 
 require (
 	github.com/fatih/color v1.18.0
-	github.com/go-git/go-git/v5 v5.19.0
+	github.com/go-git/go-git/v5 v5.19.1
 	github.com/hashicorp/golang-lru/v2 v2.0.7
 	github.com/pelletier/go-toml/v2 v2.2.4
 	github.com/sony/gobreaker/v2 v2.4.0
diff --git a/PROJECTS/intermediate/secrets-scanner/go.sum b/PROJECTS/intermediate/secrets-scanner/go.sum
index 2e8c125f..b2661fdb 100644
--- a/PROJECTS/intermediate/secrets-scanner/go.sum
+++ b/PROJECTS/intermediate/secrets-scanner/go.sum
@@ -31,8 +31,8 @@ github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmm
 github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.19.0 h1:+WkVUQZSy/F1Gb13udrMKjIM2PrzsNfDKFSfo5tkMtc=
-github.com/go-git/go-git/v5 v5.19.0/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
+github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00=
+github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
diff --git a/PROJECTS/intermediate/siem-dashboard/frontend/package.json b/PROJECTS/intermediate/siem-dashboard/frontend/package.json
index c3be4639..b7c67166 100644
--- a/PROJECTS/intermediate/siem-dashboard/frontend/package.json
+++ b/PROJECTS/intermediate/siem-dashboard/frontend/package.json
@@ -21,7 +21,7 @@
     "@visx/responsive": "^3.12.0",
     "@visx/shape": "^3.12.0",
     "@visx/xychart": "^3.12.0",
-    "axios": "^1.15.2",
+    "axios": "^1.16.0",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
     "react-error-boundary": "^6.1.0",
diff --git a/PROJECTS/intermediate/siem-dashboard/frontend/pnpm-lock.yaml b/PROJECTS/intermediate/siem-dashboard/frontend/pnpm-lock.yaml
index 163c0394..49778f57 100644
--- a/PROJECTS/intermediate/siem-dashboard/frontend/pnpm-lock.yaml
+++ b/PROJECTS/intermediate/siem-dashboard/frontend/pnpm-lock.yaml
@@ -30,8 +30,8 @@ importers:
         specifier: ^3.12.0
         version: 3.12.0(@react-spring/web@9.7.5(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       axios:
-        specifier: ^1.15.2
-        version: 1.15.2
+        specifier: ^1.16.0
+        version: 1.16.0
       react:
         specifier: ^19.2.4
         version: 19.2.4
@@ -207,30 +207,35 @@ packages:
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@biomejs/cli-linux-arm64@2.4.2':
     resolution: {integrity: sha512-DI3Mi7GT2zYNgUTDEbSjl3e1KhoP76OjQdm8JpvZYZWtVDRyLd3w8llSr2TWk1z+U3P44kUBWY3X7H9MD1/DGQ==}
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@biomejs/cli-linux-x64-musl@2.4.2':
     resolution: {integrity: sha512-wbBmTkeAoAYbOQ33f6sfKG7pcRSydQiF+dTYOBjJsnXO2mWEOQHllKlC2YVnedqZFERp2WZhFUoO7TNRwnwEHQ==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@biomejs/cli-linux-x64@2.3.14':
     resolution: {integrity: sha512-ZsZzQsl9U+wxFrGGS4f6UxREUlgHwmEfu1IrXlgNFrNnd5Th6lIJr8KmSzu/+meSa9f4rzFrbEW9LBBA6ScoMA==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@biomejs/cli-linux-x64@2.4.2':
     resolution: {integrity: sha512-GK2ErnrKpWFigYP68cXiCHK4RTL4IUWhK92AFS3U28X/nuAL5+hTuy6hyobc8JZRSt+upXt1nXChK+tuHHx4mA==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@biomejs/cli-win32-arm64@2.4.2':
     resolution: {integrity: sha512-k2uqwLYrNNxnaoiW3RJxoMGnbKda8FuCmtYG3cOtVljs3CzWxaTR+AoXwKGHscC9thax9R4kOrtWqWN0+KdPTw==}
@@ -367,36 +372,42 @@ packages:
     engines: {node: '>= 10.0.0'}
     cpu: [arm]
     os: [linux]
+    libc: [glibc]
 
   '@parcel/watcher-linux-arm-musl@2.5.6':
     resolution: {integrity: sha512-Ve3gUCG57nuUUSyjBq/MAM0CzArtuIOxsBdQ+ftz6ho8n7s1i9E1Nmk/xmP323r2YL0SONs1EuwqBp2u1k5fxg==}
     engines: {node: '>= 10.0.0'}
     cpu: [arm]
     os: [linux]
+    libc: [musl]
 
   '@parcel/watcher-linux-arm64-glibc@2.5.6':
     resolution: {integrity: sha512-f2g/DT3NhGPdBmMWYoxixqYr3v/UXcmLOYy16Bx0TM20Tchduwr4EaCbmxh1321TABqPGDpS8D/ggOTaljijOA==}
     engines: {node: '>= 10.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@parcel/watcher-linux-arm64-musl@2.5.6':
     resolution: {integrity: sha512-qb6naMDGlbCwdhLj6hgoVKJl2odL34z2sqkC7Z6kzir8b5W65WYDpLB6R06KabvZdgoHI/zxke4b3zR0wAbDTA==}
     engines: {node: '>= 10.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@parcel/watcher-linux-x64-glibc@2.5.6':
     resolution: {integrity: sha512-kbT5wvNQlx7NaGjzPFu8nVIW1rWqV780O7ZtkjuWaPUgpv2NMFpjYERVi0UYj1msZNyCzGlaCWEtzc+exjMGbQ==}
     engines: {node: '>= 10.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@parcel/watcher-linux-x64-musl@2.5.6':
     resolution: {integrity: sha512-1JRFeC+h7RdXwldHzTsmdtYR/Ku8SylLgTU/reMuqdVD7CtLwf0VR1FqeprZ0eHQkO0vqsbvFLXUmYm/uNKJBg==}
     engines: {node: '>= 10.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@parcel/watcher-win32-arm64@2.5.6':
     resolution: {integrity: sha512-3ukyebjc6eGlw9yRt678DxVF7rjXatWiHvTXqphZLvo7aC5NdEgFufVwjFfY51ijYEWpXbqF5jtrK275z52D4Q==}
@@ -482,24 +493,28 @@ packages:
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@rolldown/binding-linux-arm64-musl@1.0.0-beta.50':
     resolution: {integrity: sha512-L0zRdH2oDPkmB+wvuTl+dJbXCsx62SkqcEqdM+79LOcB+PxbAxxjzHU14BuZIQdXcAVDzfpMfaHWzZuwhhBTcw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@rolldown/binding-linux-x64-gnu@1.0.0-beta.50':
     resolution: {integrity: sha512-gyoI8o/TGpQd3OzkJnh1M2kxy1Bisg8qJ5Gci0sXm9yLFzEXIFdtc4EAzepxGvrT2ri99ar5rdsmNG0zP0SbIg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@rolldown/binding-linux-x64-musl@1.0.0-beta.50':
     resolution: {integrity: sha512-zti8A7M+xFDpKlghpcCAzyOi+e5nfUl3QhU023ce5NCgUxRG5zGP2GR9LTydQ1rnIPwZUVBWd4o7NjZDaQxaXA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@rolldown/binding-openharmony-arm64@1.0.0-beta.50':
     resolution: {integrity: sha512-eZUssog7qljrrRU9Mi0eqYEPm3Ch0UwB+qlWPMKSUXHNqhm3TvDZarJQdTevGEfu3EHAXJvBIe0YFYr0TPVaMA==}
@@ -745,8 +760,8 @@ packages:
   asynckit@0.4.0:
     resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
 
-  axios@1.15.2:
-    resolution: {integrity: sha512-wLrXxPtcrPTsNlJmKjkPnNPK2Ihe0hn0wGSaTEiHRPxwjvJwT3hKmXF4dpqxmPO9SoNb2FsYXj/xEo0gHN+D5A==}
+  axios@1.16.0:
+    resolution: {integrity: sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==}
 
   balanced-match@0.4.2:
     resolution: {integrity: sha512-STw03mQKnGUYtoNjmowo4F2cRmIIxYEGiMsjjwla/u5P1lxadj/05WkNaFjNiKTgJkj8KiXbgAiRTmcQRwQNtg==}
@@ -937,8 +952,8 @@ packages:
     resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
     engines: {node: '>= 0.4'}
 
-  es-object-atoms@1.1.1:
-    resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
+  es-object-atoms@1.1.2:
+    resolution: {integrity: sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==}
     engines: {node: '>= 0.4'}
 
   es-set-tostringtag@2.1.0:
@@ -1067,8 +1082,8 @@ packages:
     resolution: {integrity: sha512-Wn2i1In6XFxl8Az55kkgnFRiAlIAushzh26PTjL2AKtQcEfXrcLa7Hn5QOWGZEf3LU057P9TwwZjFyxfS1VuvQ==}
     engines: {node: '>=20'}
 
-  hasown@2.0.3:
-    resolution: {integrity: sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==}
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
     engines: {node: '>= 0.4'}
 
   hookified@1.15.1:
@@ -1201,24 +1216,28 @@ packages:
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   lightningcss-linux-arm64-musl@1.31.1:
     resolution: {integrity: sha512-mVZ7Pg2zIbe3XlNbZJdjs86YViQFoJSpc41CbVmKBPiGmC4YrfeOyz65ms2qpAobVd7WQsbW4PdsSJEMymyIMg==}
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   lightningcss-linux-x64-gnu@1.31.1:
     resolution: {integrity: sha512-xGlFWRMl+0KvUhgySdIaReQdB4FNudfUTARn7q0hh/V67PVGCs3ADFjw+6++kG1RNd0zdGRlEKa+T13/tQjPMA==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   lightningcss-linux-x64-musl@1.31.1:
     resolution: {integrity: sha512-eowF8PrKHw9LpoZii5tdZwnBcYDxRw2rRCyvAXLi34iyeYfqCQNA9rmUM0ce62NlPhCvof1+9ivRaTY6pSKDaA==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   lightningcss-win32-arm64-msvc@1.31.1:
     resolution: {integrity: sha512-aJReEbSEQzx1uBlQizAOBSjcmr9dCdL3XuC/6HLXAxmtErsj2ICo5yYggg1qOODQMtnjNQv2UHb9NpOuFtYe4w==}
@@ -2414,7 +2433,7 @@ snapshots:
 
   asynckit@0.4.0: {}
 
-  axios@1.15.2:
+  axios@1.16.0:
     dependencies:
       follow-redirects: 1.16.0
       form-data: 4.0.5
@@ -2585,7 +2604,7 @@ snapshots:
 
   es-errors@1.3.0: {}
 
-  es-object-atoms@1.1.1:
+  es-object-atoms@1.1.2:
     dependencies:
       es-errors: 1.3.0
 
@@ -2594,7 +2613,7 @@ snapshots:
       es-errors: 1.3.0
       get-intrinsic: 1.3.0
       has-tostringtag: 1.0.2
-      hasown: 2.0.3
+      hasown: 2.0.4
 
   escalade@3.2.0: {}
 
@@ -2643,7 +2662,7 @@ snapshots:
       asynckit: 0.4.0
       combined-stream: 1.0.8
       es-set-tostringtag: 2.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       mime-types: 2.1.35
 
   fsevents@2.3.3:
@@ -2660,18 +2679,18 @@ snapshots:
       call-bind-apply-helpers: 1.0.2
       es-define-property: 1.0.1
       es-errors: 1.3.0
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
       function-bind: 1.1.2
       get-proto: 1.0.1
       gopd: 1.2.0
       has-symbols: 1.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       math-intrinsics: 1.1.0
 
   get-proto@1.0.1:
     dependencies:
       dunder-proto: 1.0.1
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
 
   glob-parent@5.1.2:
     dependencies:
@@ -2714,7 +2733,7 @@ snapshots:
     dependencies:
       hookified: 1.15.1
 
-  hasown@2.0.3:
+  hasown@2.0.4:
     dependencies:
       function-bind: 1.1.2
 
diff --git a/README.md b/README.md
index c32f20df..3aa68579 100644
--- a/README.md
+++ b/README.md
@@ -20,12 +20,12 @@
   </a>
 </div>
 
-<p align="center">Made possible by <a href="https://certgames.com/mentorship"><strong>CertGames</strong></a></p>
+<p align="center">Made possible by <a href="https://certgames.com"><strong>CertGames</strong></a></p>
 
 <h2 align="center"><strong>View Complete Projects:</strong></h2>
 <div align="center">
   <a href="https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/main/PROJECTS">
-    <img src="https://img.shields.io/badge/Full_Source_Code-32/70-blue?style=for-the-badge&logo=github" alt="Projects"/>
+    <img src="https://img.shields.io/badge/Full_Source_Code-33/70-blue?style=for-the-badge&logo=github" alt="Projects"/>
   </a>
 </div>
 
@@ -91,7 +91,7 @@ Tools, courses, certifications, communities, and frameworks for cybersecurity pr
 | **[Hash Cracker](./PROJECTS/beginner/hash-cracker)**<br>Dictionary and brute-force cracking | ![3-4h](https://img.shields.io/badge/⏱️_5--6h-blue) ![C++](https://img.shields.io/badge/C%2B%2B-00599C?logo=cplusplus&logoColor=white) ![Beginner](https://img.shields.io/badge/●_Beginner-green) | Hash algorithms • Dictionary attacks • Password security<br>[Source Code](./PROJECTS/beginner/hash-cracker) \| [Docs](./PROJECTS/beginner/hash-cracker/learn) |
 | **[Steganography Multi-Tool](./SYNOPSES/beginner/Steganography.Multi.Tool.md)**<br>Hide data in images, audio, QR, PDFs, text | ![2-3h](https://img.shields.io/badge/⏱️_8--10h-blue) ![Python](https://img.shields.io/badge/Python-3776AB?logo=python&logoColor=white) ![Beginner](https://img.shields.io/badge/●_Beginner-green) | Multi-format steganography • Zero-width Unicode • Audio LSB • QR exploitation<br>[Learn More](./SYNOPSES/beginner/Steganography.Multi.Tool.md) |
 | **[Ghost on the Wire](./SYNOPSES/beginner/Ghost.On.The.Wire.md)**<br>L2 attack & defense: MAC spoofing + ARP detection | ![2-3h](https://img.shields.io/badge/⏱️_6--8h-blue) ![Python](https://img.shields.io/badge/Python-3776AB?logo=python&logoColor=white) ![Beginner](https://img.shields.io/badge/●_Beginner-green) | ARP protocol • MAC spoofing • MITM detection • L2 trust mapping<br>[Learn More](./SYNOPSES/beginner/Ghost.On.The.Wire.md) |
-| **[Canary Token Generator](./SYNOPSES/beginner/Canary.Token.Generator.md)**<br>Self-hosted honeytokens that alert on access | ![2-3h](https://img.shields.io/badge/⏱️_8--10h-blue) ![Go](https://img.shields.io/badge/Go-00ADD8?logo=go&logoColor=white) ![Beginner](https://img.shields.io/badge/●_Beginner-green) | Deception defense • Honeytokens • Webhook alerting • Intrusion detection<br>[Learn More](./SYNOPSES/beginner/Canary.Token.Generator.md) |
+| **[Canary Token Generator](./PROJECTS/beginner/canary-token-generator)**<br>Self-hosted honeytokens that alert on access | ![2-3h](https://img.shields.io/badge/⏱️_8--10h-blue) ![Go](https://img.shields.io/badge/Go-00ADD8?logo=go&logoColor=white) ![React](https://img.shields.io/badge/React-61DAFB?logo=react&logoColor=black) ![Docker](https://img.shields.io/badge/Docker-2496ED?logo=docker&logoColor=white) ![Beginner](https://img.shields.io/badge/●_Beginner-green) | Deception defense • Honeytokens • MySQL wire protocol • PDF/DOCX patching • Webhook + Telegram alerting<br>[Source Code](./PROJECTS/beginner/canary-token-generator) \| [Docs](./PROJECTS/beginner/canary-token-generator/learn) |
 | **[Security News Scraper](./SYNOPSES/beginner/Security.News.Scraper.md)**<br>Aggregate cybersecurity news | ![3-4h](https://img.shields.io/badge/⏱️_10--14h-blue) ![Python](https://img.shields.io/badge/Python-3776AB?logo=python&logoColor=white) ![Beginner](https://img.shields.io/badge/●_Beginner-green) | Web scraping • CVE parsing • Database storage<br>[Learn More](./SYNOPSES/beginner/Security.News.Scraper.md) |
 | **[Phishing Domain Generator & Quishing Scanner](./SYNOPSES/beginner/Phishing.Domain.Generator.And.Quishing.Scanner.md)**<br>Typosquat generation + QR phishing detection | ![2-3h](https://img.shields.io/badge/⏱️_6--8h-blue) ![Python](https://img.shields.io/badge/Python-3776AB?logo=python&logoColor=white) ![Beginner](https://img.shields.io/badge/●_Beginner-green) | Homoglyph attacks • Typosquatting • QR code analysis • Domain intelligence<br>[Learn More](./SYNOPSES/beginner/Phishing.Domain.Generator.And.Quishing.Scanner.md) |
 | **[SSH Brute Force Detector](./SYNOPSES/beginner/SSH.Brute.Force.Detector.md)**<br>Monitor and block SSH attacks | ![2-4h](https://img.shields.io/badge/⏱️_2--4h-blue) ![Python](https://img.shields.io/badge/Python-3776AB?logo=python&logoColor=white) ![Beginner](https://img.shields.io/badge/●_Beginner-green) | Log parsing • Attack detection • Firewall automation<br>[Learn More](./SYNOPSES/beginner/SSH.Brute.Force.Detector.md) |
@@ -140,7 +140,7 @@ Tools, courses, certifications, communities, and frameworks for cybersecurity pr
 | **[API Rate Limiter](./PROJECTS/advanced/api-rate-limiter)**<br>Distributed rate limiting middleware | ![1w](https://img.shields.io/badge/⏱️_1w-blue) ![Python](https://img.shields.io/badge/Python-3776AB?logo=python&logoColor=white) ![Redis](https://img.shields.io/badge/Redis-DC382D?logo=redis&logoColor=white) ![Advanced](https://img.shields.io/badge/●_Advanced-red) | Token bucket algorithm • Distributed systems • Redis backend<br>[Source Code](./PROJECTS/advanced/api-rate-limiter) \| [Docs](./PROJECTS/advanced/api-rate-limiter/learn) |
 | **[Encrypted Chat Application](./PROJECTS/advanced/encrypted-p2p-chat)**<br>Real-time E2EE messaging | ![1-2w](https://img.shields.io/badge/⏱️_1--2w-blue) ![FastAPI](https://img.shields.io/badge/FastAPI-009688?logo=fastapi) ![SolidJS](https://img.shields.io/badge/SolidJS-2C4F7C?logo=solid) ![PostgreSQL](https://img.shields.io/badge/PostgreSQL-4169E1?logo=postgresql&logoColor=white) ![Advanced](https://img.shields.io/badge/●_Advanced-red) | Signal Protocol • Double Ratchet • WebAuthn • WebSockets<br>[Source Code](./PROJECTS/advanced/encrypted-p2p-chat) \| [Docs](./PROJECTS/advanced/encrypted-p2p-chat/learn) |
 | **[Exploit Development Framework](./SYNOPSES/advanced/Exploit.Development.Framework.md)**<br>Modular exploitation framework | ![3-4w](https://img.shields.io/badge/⏱️_3--4w-blue) ![C++](https://img.shields.io/badge/C%2B%2B-00599C?logo=cplusplus&logoColor=white) ![Advanced](https://img.shields.io/badge/●_Advanced-red) | Exploit development • Payload generation • Plugin architecture<br>[Learn More](./SYNOPSES/advanced/Exploit.Development.Framework.md) |
-| **[AI Threat Detection](./PROJECTS/advanced/ai-threat-detection)**<br>ML-powered nginx threat detection | ![3-4w](https://img.shields.io/badge/⏱️_3--4w-blue) ![FastAPI](https://img.shields.io/badge/FastAPI-009688?logo=fastapi) ![React](https://img.shields.io/badge/React-61DAFB?logo=react&logoColor=black) ![PyTorch](https://img.shields.io/badge/PyTorch-EE4C2C?logo=pytorch&logoColor=white) ![Advanced](https://img.shields.io/badge/●_Advanced-red) | ML ensemble (AE + RF + IF) • ONNX inference • Real-time detection<br>[Source Code](./PROJECTS/advanced/ai-threat-detection) |
+| **[AI Threat Detection](./PROJECTS/advanced/ai-threat-detection)**<br>ML-powered nginx threat detection | ![3-4w](https://img.shields.io/badge/⏱️_3--4w-blue) ![FastAPI](https://img.shields.io/badge/FastAPI-009688?logo=fastapi) ![React](https://img.shields.io/badge/React-61DAFB?logo=react&logoColor=black) ![PyTorch](https://img.shields.io/badge/PyTorch-EE4C2C?logo=pytorch&logoColor=white) ![Advanced](https://img.shields.io/badge/●_Advanced-red) | ML ensemble (AE + RF + IF) • ONNX inference • Real-time detection<br>[Source Code](./PROJECTS/advanced/ai-threat-detection) \| [Docs](./PROJECTS/advanced/ai-threat-detection/learn) |
 | **[Bug Bounty Platform](./PROJECTS/advanced/bug-bounty-platform)**<br>Full vulnerability disclosure platform | ![2-3w](https://img.shields.io/badge/⏱️_2--3w-blue) ![FastAPI](https://img.shields.io/badge/FastAPI-009688?logo=fastapi) ![React](https://img.shields.io/badge/React-61DAFB?logo=react&logoColor=black) ![PostgreSQL](https://img.shields.io/badge/PostgreSQL-4169E1?logo=postgresql&logoColor=white) ![Advanced](https://img.shields.io/badge/●_Advanced-red) | Full-stack development • CVSS scoring • Workflow automation<br>[Source Code](./PROJECTS/advanced/bug-bounty-platform) \| [Docs](./PROJECTS/advanced/bug-bounty-platform/learn) |
 | **[Cloud Security Compliance Dashboard](./SYNOPSES/advanced/Cloud.Security.Compliance.Dashboard.md)**<br>Multi-cloud compliance with CIS, SOC2, HIPAA | ![2-3w](https://img.shields.io/badge/⏱️_2--3w-blue) ![Go](https://img.shields.io/badge/Go-00ADD8?logo=go&logoColor=white) ![React](https://img.shields.io/badge/React-61DAFB?logo=react&logoColor=black) ![AWS](https://img.shields.io/badge/AWS-232F3E?logo=amazonaws) ![Advanced](https://img.shields.io/badge/●_Advanced-red) | CIS benchmarks • SOC2/HIPAA compliance • Cost-security optimization • Drift detection<br>[Learn More](./SYNOPSES/advanced/Cloud.Security.Compliance.Dashboard.md) |
 | **[Malware Analysis Platform](./SYNOPSES/advanced/Malware.Analysis.Platform.md)**<br>Automated sandbox analysis | ![2-3w](https://img.shields.io/badge/⏱️_2--3w-blue) ![Rust](https://img.shields.io/badge/Rust-000000?logo=rust&logoColor=white) ![Docker](https://img.shields.io/badge/Docker-2496ED?logo=docker&logoColor=white) ![Advanced](https://img.shields.io/badge/●_Advanced-red) | Malware analysis • Sandboxing • YARA rules • IOC extraction<br>[Learn More](./SYNOPSES/advanced/Malware.Analysis.Platform.md) |
@@ -151,7 +151,7 @@ Tools, courses, certifications, communities, and frameworks for cybersecurity pr
 | **[Blockchain Smart Contract Auditor](./SYNOPSES/advanced/Blockchain.Smart.Contract.Auditor.md)**<br>Solidity vulnerability analysis | ![3-4w](https://img.shields.io/badge/⏱️_3--4w-blue) ![Python](https://img.shields.io/badge/Python-3776AB?logo=python&logoColor=white) ![Solidity](https://img.shields.io/badge/Solidity-363636?logo=solidity) ![Advanced](https://img.shields.io/badge/●_Advanced-red) | Smart contracts • Static analysis • Solidity security<br>[Learn More](./SYNOPSES/advanced/Blockchain.Smart.Contract.Auditor.md) |
 | **[Adversarial ML Attacker](./SYNOPSES/advanced/Adversarial.ML.Attacker.md)**<br>Generate adversarial examples | ![3-4w](https://img.shields.io/badge/⏱️_3--4w-blue) ![Python](https://img.shields.io/badge/Python-3776AB?logo=python&logoColor=white) ![TensorFlow](https://img.shields.io/badge/TensorFlow-FF6F00?logo=tensorflow&logoColor=white) ![Advanced](https://img.shields.io/badge/●_Advanced-red) | Adversarial ML • FGSM/DeepFool • Model robustness<br>[Learn More](./SYNOPSES/advanced/Adversarial.ML.Attacker.md) |
 | **[Advanced Persistent Threat Simulator](./SYNOPSES/advanced/Advanced.Persistent.Threat.Simulator.md)**<br>Multi-stage APT simulation | ![3-4w](https://img.shields.io/badge/⏱️_3--4w-blue) ![Go](https://img.shields.io/badge/Go-00ADD8?logo=go&logoColor=white) ![Advanced](https://img.shields.io/badge/●_Advanced-red) | APT techniques • C2 infrastructure • Lateral movement<br>[Learn More](./SYNOPSES/advanced/Advanced.Persistent.Threat.Simulator.md) |
-| **[Hardware Security Module Emulator](./SYNOPSES/advanced/Hardware.Security.Module.Emulator.md)**<br>Software HSM with PKCS#11 | ![2-3w](https://img.shields.io/badge/⏱️_2--3w-blue) ![C](https://img.shields.io/badge/C-A8B9CC?logo=c&logoColor=black) ![Advanced](https://img.shields.io/badge/●_Advanced-red) | HSM concepts • PKCS#11 interface • Cryptographic operations<br>[Learn More](./SYNOPSES/advanced/Hardware.Security.Module.Emulator.md) |
+| **[Hardware Security Module Emulator](./PROJECTS/advanced/hsm-emulator)**<br>Software HSM that compiles to a real PKCS#11 `.so` | ![2-3w](https://img.shields.io/badge/⏱️_2--3w-blue) ![Zig](https://img.shields.io/badge/Zig-F7A41D?logo=zig&logoColor=white) ![Advanced](https://img.shields.io/badge/●_Advanced-red) | PKCS#11/Cryptoki C ABI (machine-checked vs OASIS headers) • AES-GCM/CBC • RSA/ECDSA/ECDH • Argon2id + encrypted-at-rest • driven by `pkcs11-tool`<br>[Source Code](./PROJECTS/advanced/hsm-emulator) \| [Docs](./PROJECTS/advanced/hsm-emulator/learn) |
 | **[Network Covert Channel](./SYNOPSES/advanced/Network.Covert.Channel.md)**<br>Data exfiltration techniques | ![3-4w](https://img.shields.io/badge/⏱️_3--4w-blue) ![Rust](https://img.shields.io/badge/Rust-000000?logo=rust&logoColor=white) ![Advanced](https://img.shields.io/badge/●_Advanced-red) | Covert channels • Data exfiltration • Steganography<br>[Learn More](./SYNOPSES/advanced/Network.Covert.Channel.md) |
 | **[Automated Penetration Testing](./SYNOPSES/advanced/Automated.Penetration.Testing.md)**<br>Full pentest automation | ![3-4w](https://img.shields.io/badge/⏱️_3--4w-blue) ![Python](https://img.shields.io/badge/Python-3776AB?logo=python&logoColor=white) ![Advanced](https://img.shields.io/badge/●_Advanced-red) | Pentest automation • Recon to exploitation • Report generation<br>[Learn More](./SYNOPSES/advanced/Automated.Penetration.Testing.md) |
 | **[Haskell Reverse Proxy](./PROJECTS/advanced/haskell-reverse-proxy)**<br>Functional reverse proxy with security middleware | ![2-3w](https://img.shields.io/badge/⏱️_2--3w-blue) ![Haskell](https://img.shields.io/badge/Haskell-5D4F85?logo=haskell&logoColor=white) ![Advanced](https://img.shields.io/badge/●_Advanced-red) | Functional programming • Reverse proxy design • Security middleware • Haskell<br>[Source Code](./PROJECTS/advanced/haskell-reverse-proxy) |