From 22857d5a294dc27d6024c6a7105bc5975159ad9c Mon Sep 17 00:00:00 2001
From: Michal Ferber <michal@techguywithabeard.com>
Date: Sat, 5 Sep 2026 03:29:32 -0400
Subject: [PATCH 1/2] Register pdfmake Roboto fonts lazily and reject a hung
 getBlob

pdfmake's vfs_fonts.js self-registers against a global, which a bundler
does not provide, so PDF export failed with Roboto-Medium.ttf missing
and getBlob never called back. Load vfs_fonts inside pdf() and time out
the callback so a missing font is an error. The IIFE build still leaves
fonts to the page's script tag.

Closes #1
---
 build/build.mjs      |  16 ++++++
 package.json         |   3 +-
 src/exporters/pdf.js | 119 ++++++++++++++++++++++++++++++++++---------
 test/pdf-vfs.test.js |  70 +++++++++++++++++++++++++
 4 files changed, 184 insertions(+), 24 deletions(-)
 create mode 100644 test/pdf-vfs.test.js

diff --git a/build/build.mjs b/build/build.mjs
index 2aa73bd..d2923de 100644
--- a/build/build.mjs
+++ b/build/build.mjs
@@ -85,6 +85,22 @@ for (const [vendor, global] of Object.entries(VENDOR_GLOBALS)) {
   console.log(`  shim ${vendor.padEnd(10)} -> globalThis.${global}${names.length ? `  (${names.length} named)` : ''}`);
 }
 
+// The offline page loads vfs_fonts.js as a <script> that self-registers against
+// the pdfMake global. Do not bundle the ~768 KB of Roboto into the IIFE, and do
+// not require pdfmake to be installed at build time (it is a peer).
+const vfsStub = join(shimDir, 'pdfmake-vfs_fonts.js');
+await writeFile(
+  vfsStub,
+  [
+    `// Generated by build/build.mjs — do not edit.`,
+    `// Offline page already registered fonts via <script src="vfs_fonts.js">.`,
+    `export default {};`,
+    ``,
+  ].join('\n'),
+);
+alias['pdfmake/build/vfs_fonts.js'] = vfsStub;
+console.log('  shim pdfmake/build/vfs_fonts.js -> empty stub (script-tag VFS)');
+
 await build({
   entryPoints: [join(root, 'src', 'index.js')],
   outfile: join(root, 'dist', 'markdownwizard-tools.iife.js'),
diff --git a/package.json b/package.json
index 8067bf5..ab0170e 100644
--- a/package.json
+++ b/package.json
@@ -18,7 +18,8 @@
   },
   "scripts": {
     "build": "node build/build.mjs",
-    "prepare": "node build/build.mjs"
+    "prepare": "node build/build.mjs",
+    "test": "node --experimental-test-module-mocks --test test/pdf-vfs.test.js"
   },
   "peerDependencies": {
     "marked": ">=12",
diff --git a/src/exporters/pdf.js b/src/exporters/pdf.js
index 2bd2d1c..b3a84c7 100644
--- a/src/exporters/pdf.js
+++ b/src/exporters/pdf.js
@@ -12,32 +12,105 @@ import { inlines, collectImages, loadImages } from '../common.js';
 
 const CONTENT_W = 504; // LETTER (612pt) minus 54pt margins each side
 
+// pdfmake's <script> vfs_fonts.js self-registers against a global. Through a
+// bundler there is no global, so the package that imports pdfmake must register
+// the fonts itself. Loaded lazily inside pdf(): vfs_fonts is ~768 KB of base64
+// and a consumer that only exports .txt must not pay that cost.
+var fontsReady = null;
+
+function vfsHasRoboto(vfs) {
+  return !!(vfs && (vfs['Roboto-Medium.ttf'] || vfs['Roboto-Regular.ttf']));
+}
+
+function unwrapVfs(mod) {
+  var vfs = mod;
+  if (vfs && vfs.default && typeof vfs.default === 'object' && !vfsHasRoboto(vfs)) {
+    vfs = vfs.default;
+  }
+  if (vfs && vfs.pdfMake && vfs.pdfMake.vfs) vfs = vfs.pdfMake.vfs;
+  return vfs;
+}
+
+function applyVfs(lib, vfs) {
+  if (!lib || !vfs) return;
+  if (typeof lib.addVirtualFileSystem === 'function') lib.addVirtualFileSystem(vfs);
+  else lib.vfs = vfs;
+}
+
+function ensureFonts() {
+  if (!fontsReady) fontsReady = loadFonts();
+  return fontsReady;
+}
+
+function loadFonts() {
+  if (vfsHasRoboto(pdfMake && pdfMake.vfs)) {
+    applyVfs(pdfMake, pdfMake.vfs);
+    return Promise.resolve();
+  }
+  return import('pdfmake/build/vfs_fonts.js').then(function (mod) {
+    var vfs = unwrapVfs(mod);
+    if (vfsHasRoboto(vfs)) applyVfs(pdfMake, vfs);
+    // Empty module: the IIFE build aliases this import to a stub because the
+    // offline page already loaded vfs_fonts.js as a <script>. A later getBlob
+    // timeout is the loud failure if fonts are truly missing.
+  });
+}
+
+// getBlob never invokes its callback when a font is missing; it only
+// console.warns. Bound the wait so a missing Roboto is an error, not a stall.
+var GETBLOB_MS = 15000;
+
+export function blobFromPdf(doc, ms) {
+  if (ms == null) ms = GETBLOB_MS;
+  return new Promise(function (resolve, reject) {
+    var settled = false;
+    var timer = setTimeout(function () {
+      finish(new Error(
+        'PDF export timed out after ' + ms + 'ms. ' +
+        'pdfmake does not invoke getBlob when a font is missing from the virtual file system ' +
+        "(File 'Roboto-Medium.ttf' not found)."
+      ));
+    }, ms);
+    function finish(err, blob) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (err) reject(err);
+      else resolve(blob);
+    }
+    try {
+      // pdfmake 0.2 calls the callback; 0.3's getBlob is async and returns a Promise.
+      var ret = doc.getBlob(function (blob) { finish(null, blob); });
+      if (ret && typeof ret.then === 'function') {
+        ret.then(function (blob) { finish(null, blob); }, function (err) { finish(err); });
+      }
+    } catch (e) { finish(e); }
+  });
+}
+
 export function pdf(md, base) {
   var tokens = lex(md);
   return loadImages(collectImages(tokens)).then(function (images) {
-    var dd = {
-      info: { title: base || 'document', creator: 'Markdown Wizard' },
-      pageSize: 'LETTER',
-      pageMargins: [54, 60, 54, 66],
-      defaultStyle: { fontSize: 11, lineHeight: 1.35, color: '#1b1b24' },
-      styles: {
-        h1: { fontSize: 23, bold: true, margin: [0, 14, 0, 6] },
-        h2: { fontSize: 18, bold: true, margin: [0, 13, 0, 5] },
-        h3: { fontSize: 14.5, bold: true, margin: [0, 11, 0, 4] },
-        h4: { fontSize: 12.5, bold: true, margin: [0, 10, 0, 4] },
-        h5: { fontSize: 11.5, bold: true, margin: [0, 9, 0, 3] },
-        h6: { fontSize: 11, bold: true, color: '#666672', margin: [0, 9, 0, 3] }
-      },
-      footer: function (page, total) {
-        return { text: page + ' / ' + total, alignment: 'center', fontSize: 9, color: '#9a9aa6', margin: [0, 24, 0, 0] };
-      },
-      content: blocks(tokens, { images: images })
-    };
-    var pdf = pdfMake.createPdf(dd);
-    return new Promise(function (resolve, reject) {
-      try {
-        pdf.getBlob(function (blob) { resolve(blob); });
-      } catch (e) { reject(e); }
+    return ensureFonts().then(function () {
+      var dd = {
+        info: { title: base || 'document', creator: 'Markdown Wizard' },
+        pageSize: 'LETTER',
+        pageMargins: [54, 60, 54, 66],
+        defaultStyle: { fontSize: 11, lineHeight: 1.35, color: '#1b1b24' },
+        styles: {
+          h1: { fontSize: 23, bold: true, margin: [0, 14, 0, 6] },
+          h2: { fontSize: 18, bold: true, margin: [0, 13, 0, 5] },
+          h3: { fontSize: 14.5, bold: true, margin: [0, 11, 0, 4] },
+          h4: { fontSize: 12.5, bold: true, margin: [0, 10, 0, 4] },
+          h5: { fontSize: 11.5, bold: true, margin: [0, 9, 0, 3] },
+          h6: { fontSize: 11, bold: true, color: '#666672', margin: [0, 9, 0, 3] }
+        },
+        footer: function (page, total) {
+          return { text: page + ' / ' + total, alignment: 'center', fontSize: 9, color: '#9a9aa6', margin: [0, 24, 0, 0] };
+        },
+        content: blocks(tokens, { images: images })
+      };
+      return blobFromPdf(pdfMake.createPdf(dd));
     });
   });
 }
diff --git a/test/pdf-vfs.test.js b/test/pdf-vfs.test.js
new file mode 100644
index 0000000..cb654fd
--- /dev/null
+++ b/test/pdf-vfs.test.js
@@ -0,0 +1,70 @@
+/* The repo had no test runner. node:test is enough to prove the two defects
+   in issue #1 without standing up pdfmake's browser bundle. */
+import assert from 'node:assert/strict';
+import { mock, test } from 'node:test';
+
+const vfs = {
+  'Roboto-Regular.ttf': 'AAAA',
+  'Roboto-Medium.ttf': 'AAAA',
+  'Roboto-Italic.ttf': 'AAAA',
+  'Roboto-MediumItalic.ttf': 'AAAA'
+};
+
+const registered = [];
+let getBlobImpl = function (cb) { cb({ type: 'application/pdf' }); };
+
+mock.module('pdfmake', {
+  exports: {
+    default: {
+      addVirtualFileSystem: function (v) { registered.push(v); },
+      createPdf: function () {
+        return { getBlob: function (cb) { return getBlobImpl(cb); } };
+      }
+    }
+  }
+});
+mock.module('pdfmake/build/vfs_fonts.js', { exports: { default: vfs } });
+mock.module(new URL('../src/core.js', import.meta.url).href, {
+  exports: {
+    lex: function () { return []; },
+    decodeEntities: function (s) { return s || ''; }
+  }
+});
+mock.module(new URL('../src/common.js', import.meta.url).href, {
+  exports: {
+    inlines: function () { return []; },
+    collectImages: function () { return []; },
+    loadImages: function () { return Promise.resolve(new Map()); }
+  }
+});
+
+const { pdf, blobFromPdf } = await import('../src/exporters/pdf.js');
+
+test('pdf() registers Roboto on pdfmake before createPdf', async () => {
+  const blob = await pdf('# Hello', 'hello');
+  assert.equal(registered.length, 1);
+  assert.ok(registered[0]['Roboto-Medium.ttf'], 'addVirtualFileSystem received Roboto-Medium.ttf');
+  assert.equal(blob.type, 'application/pdf');
+});
+
+test('a hung getBlob rejects instead of stalling', async () => {
+  const hung = { getBlob: function () { /* never calls back, as pdfmake 0.2 does when a font is missing */ } };
+  await assert.rejects(
+    () => blobFromPdf(hung, 40),
+    /timed out after 40ms.*Roboto-Medium\.ttf/
+  );
+});
+
+test('a promise getBlob (pdfmake 0.3) resolves', async () => {
+  const doc = { getBlob: async function () { return { type: 'application/pdf' }; } };
+  const blob = await blobFromPdf(doc, 40);
+  assert.equal(blob.type, 'application/pdf');
+});
+
+test('a hung getBlob promise rejects instead of stalling', async () => {
+  const hung = { getBlob: function () { return new Promise(function () { /* never settles */ }); } };
+  await assert.rejects(
+    () => blobFromPdf(hung, 40),
+    /timed out after 40ms.*Roboto-Medium\.ttf/
+  );
+});

From 237bd6eb069bac63292adc54c1f7118afee9a669 Mon Sep 17 00:00:00 2001
From: Michal Ferber <michal@techguywithabeard.com>
Date: Sat, 5 Sep 2026 19:16:59 -0400
Subject: [PATCH 2/2] Run the suite in CI, and make all four tests fail when
 their subject breaks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The PDF fix in this branch was correct; the guard around it was not. Two
problems, both about the record rather than the code.

The repo had no CI at all, so `npm test` was reproducible only by hand. Adopt
`templates/ci-library.yml` (DS §15) with `.nvmrc` at the Node 24 estate floor
and `eslint.config.js` vendored byte-for-byte from `templates/`. The template's
lint gate deliberately fails when there is no lint script, so this adds one;
`textwizard-tools` is the sibling precedent for the same shape.

Lint surfaced four pre-existing defects. Per §15 those are fixed rather than
pinned around: two empty `catch` blocks in `src/core.js` now say why they are
empty, the C0-range character class in `baseName` carries a scoped
`no-control-regex` exemption with its reason, and the dead `ctx` parameter is
removed from `textRuns` and `table` in `src/exporters/pdf.js`.

Two of the four tests did not fail when the thing they guarded was removed.
Both are now mutation-verified:

  - `pdf() registers Roboto … before createPdf` asserted `registered.length`
    only after the promise settled, which is order-blind. The `createPdf` mock
    now captures that length at call time, so registering the fonts *after*
    createPdf is red.
  - The two hung-getBlob tests stalled instead of failing when the timeout
    guard was deleted — node:test has no default per-test timeout, so the suite
    hung until an external killer fired and reported `fail 0`. Both now carry
    an explicit 2000ms timeout, roughly 50x the 40ms they wait for.

Measured, one mutation per test, `npm test` exit code in brackets:

  unmutated                         4 pass                              [0]
  ensureFonts() call deleted        test 1 red                          [1]
  fonts registered after createPdf  test 1 red                          [1]
  timeout guard deleted             tests 2 and 4 red in 4s, not a hang [1]
  promise adoption deleted          test 3 red                          [1]

Still outstanding and declared rather than hidden: §15 also requires the XSS
fixture in any repo whose source renders HTML. The rule is wired but ships no
fixture, so its zero findings here are not yet evidence it fires. The vendored
fixture test imports vitest and this suite is node:test, which makes it a
second-runner decision rather than a side effect of this change.

Closes #1.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRX8K6Ys4CDRDcdknCuPVh
---
 .github/workflows/ci.yml | 123 +++++
 .nvmrc                   |   1 +
 eslint.config.js         | 293 ++++++++++++
 package-lock.json        | 989 ++++++++++++++++++++++++++++++++++++++-
 package.json             |   6 +-
 src/core.js              |   7 +-
 src/exporters/pdf.js     |  16 +-
 test/pdf-vfs.test.js     |  25 +-
 8 files changed, 1444 insertions(+), 16 deletions(-)
 create mode 100644 .github/workflows/ci.yml
 create mode 100644 .nvmrc
 create mode 100644 eslint.config.js

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..0915726
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,123 @@
+# TGWAB CI, library and extension shape—DEV-STANDARDS §15.
+#
+# Place at:  .github/workflows/ci.yml
+#
+# WHEN TO USE THIS INSTEAD OF templates/ci.yml. The site template gates a BUILD:
+# it runs `npm run build`, scans `dist/` for eval and for mailto:, and drives a
+# Playwright harness under the real _headers CSP. A package that ships its source
+# has no dist/, no CSP and no pages, so every one of those steps either fails or
+# passes vacuously. This template is the same contract with the build-shaped
+# gates removed—not a weaker one.
+#
+# Use it for: tool/feature packages consumed by a site (textwizard-tools,
+# punctuationwizard-tools, markdownwizard-tools) and browser extensions whose
+# "build" is a store zip rather than a site.
+# Use templates/ci.yml for: anything that produces a deployable dist/.
+#
+# The job is named `ci` because templates/ruleset-main.json requires the
+# status-check context "ci" (§4). Rename one and you MUST rename both, or merges
+# block forever. A repo whose existing job is named something else must change
+# the ruleset in the SAME change, or the required check never reports.
+#
+# Action SHAs are pinned per §15—a tag is mutable, a SHA is not. Re-resolve
+# before first use:
+#   gh api repos/actions/checkout/git/refs/tags/v7.0.1 --jq .object.sha
+
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions: {}
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  ci:                                   # job name == the required status-check context
+    runs-on: ubuntu-latest
+    # The same value as templates/ci.yml, chosen against the measurement recorded
+    # there. Keep them equal: this comment used to argue for 10 by contrast with
+    # ci.yml's 15, which made it a claim about a second file that went wrong the
+    # moment that file moved.
+    #
+    # A warm run here is 12–15s. The headroom is not for the suite, it is for a
+    # cold npm cache—this template's own first adopter, bookmarkwizard-extension,
+    # spent 301s in `npm ci` on one successful run of four.
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    # A repo that genuinely cannot run one of the gates below uncomments the
+    # matching line and names the REASON—the MUSTER_OPT_OUT=1 pattern. The step
+    # prints it as a run annotation, so the reason travels with every run instead
+    # of living in someone's memory. "Not adopted yet" is not a reason.
+    # env:
+    #   LINT_OPT_OUT: "…"
+    #   TEST_OPT_OUT: "…"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .nvmrc     # never a hardcoded node-version: (§15)
+          cache: npm
+
+      # READ THIS BEFORE ADOPTING: `npm ci` REQUIRES package-lock.json and fails
+      # outright without one. It is not the safe boilerplate it looks like, and
+      # it is the first step that will break.
+      #
+      # Several packages in the estate have a package.json and NO lockfile—they
+      # had no dependencies, so nothing ever generated one. Adding `eslint` as
+      # the first devDependency generates it, which means the adopting PR CREATES
+      # the lockfile as part of the change and must commit it. A repo that adds
+      # this workflow without committing a lockfile fails here on its first run.
+      #
+      # Exits non-zero if package-lock.json has drifted from package.json.
+      - run: npm ci
+
+      # §15 gate: lint MUST run, and MUST fail when there is no lint to run.
+      # Deliberately NOT `npm run lint --if-present`: npm exits 0 when the script
+      # is absent, so that form reports a passing lint which never executed. A
+      # control that passes by not running is the defect class lint exists to
+      # catch, and a library template shipping it would recreate the gap #105
+      # closed.
+      - name: lint
+        run: |
+          set -euo pipefail
+          if [ -n "${LINT_OPT_OUT:-}" ]; then
+            echo "::notice title=lint opted out (§15)::${LINT_OPT_OUT}"
+            exit 0
+          fi
+          if ! node -e "process.exit((require('./package.json').scripts||{}).lint?0:1)"; then
+            echo "::error title=no lint script (§15)::CI MUST run lint. Add a \"lint\" script (eslint .) plus eslint.config.js from templates/, or declare LINT_OPT_OUT with a reason on the ci job."
+            exit 1
+          fi
+          npm run lint
+
+      # §15 gate: the test suite, on the same terms and for the same reason.
+      #
+      # This is not boilerplate symmetry. A repo whose source renders HTML MUST
+      # ship the interpolated-JSON fixture (§15), and a fixture that no CI run
+      # executes is decoration—the precise failure the fixture itself exists to
+      # prevent, one level up. So a repo carrying the fixture and no test script
+      # must fail here rather than quietly skip.
+      - name: test
+        run: |
+          set -euo pipefail
+          if [ -n "${TEST_OPT_OUT:-}" ]; then
+            echo "::notice title=tests opted out (§15)::${TEST_OPT_OUT}"
+            exit 0
+          fi
+          if ! node -e "process.exit((require('./package.json').scripts||{}).test?0:1)"; then
+            echo "::error title=no test script (§15)::A repo shipping the §15 fixture MUST run it. Add a \"test\" script, or declare TEST_OPT_OUT with a reason on the ci job."
+            exit 1
+          fi
+          npm test
+
+      # Production tree only—a dev-tree advisory never reaches a user (§15).
+      - run: npm audit --omit=dev --audit-level=high
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 0000000..a45fd52
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+24
diff --git a/eslint.config.js b/eslint.config.js
new file mode 100644
index 0000000..0115ad8
--- /dev/null
+++ b/eslint.config.js
@@ -0,0 +1,293 @@
+// TGWAB — the interpolated-JSON XSS rule. DEV-STANDARDS §15.
+//
+// Place at:  eslint.config.js  (repo root; merge into an existing flat config)
+// Fixture:   templates/xss-lint-fixture.js  →  test/xss-lint-fixture.test.js
+//
+// WHAT IT CATCHES. `JSON.stringify` interpolated into a template literal that
+// becomes HTML. A string ending `</script>` closes the tag early and everything
+// after it is markup, so a value the user controls becomes script. The remedy is
+// never a different escaper — it is to stop putting data in a script body:
+//
+//     BAD   `<script>window.__D__ = ${JSON.stringify(d)};</script>`
+//     GOOD  `<div id="d" data-payload="${escapeAttr(JSON.stringify(d))}"></div>`
+//           …then JSON.parse(el.dataset.payload) on the client.
+//
+// WHY THE SELECTOR IS A DESCENDANT (` `) AND NOT A DIRECT CHILD (` > `).
+// This is measured, not argued. Both forms were run against the seven-case
+// fixture that ships beside this file:
+//
+//     TemplateLiteral > CallExpression[…]   catches 2 of 5 hazards
+//     TemplateLiteral   CallExpression[…]   catches 5 of 5
+//
+// The three the direct-child form misses are ordinary code, not exotic:
+//
+//     ${n ? JSON.stringify(n) : 'null'}     the call is under a Conditional
+//     ${escapeHtml(JSON.stringify(n))}      the call is an argument
+//     ${xs.map((x) => JSON.stringify(x))}   the call is inside an arrow body
+//
+// In each the CallExpression is a GRANDCHILD of the TemplateLiteral, so `>` does
+// not match. Both forms leave both negative controls alone, so the descendant
+// form is strictly better rather than merely louder. Re-run the fixture before
+// believing this comment.
+//
+// ON `${escapeHtml(JSON.stringify(x))}` — READ THIS BEFORE DECIDING THE RULE IS
+// WRONG. The rule flags it, and it is NOT exploitable: HTML entities are not
+// decoded inside a `<script>` element, so `&lt;/script&gt;` cannot close the tag.
+// What you get is broken JavaScript, not XSS. It is still the wrong pattern, the
+// remedy is the same data attribute, and the flag is correct — but the finding is
+// "this does not work", not "this is a hole". Say that in review, or someone will
+// conclude the rule is wrong rather than that their code is.
+//
+// The rule is deliberately blunt: it does not test whether the literal contains
+// `<script`. A rule gated on that misses every case where the tags come from a
+// wrapper — which is the bug resizewizard-api's rule was written for and does not
+// catch. Blunt plus a declared opt-out beats clever and silent.
+
+import js from '@eslint/js';
+import globals from 'globals';
+
+export default [
+  // ---------------------------------------------------------------------------
+  // WHAT IS NOT LINTED: generated output and vendored code — files nobody here
+  // wrote. Global ignores, so they apply to every block below.
+  //
+  // THE `**/` PREFIXES ARE LOAD-BEARING, and this is measured. A bare `dist/`
+  // matches the REPO-ROOT dist only. The estate keeps 24 `dist/`, 29 `.astro/`,
+  // and 33 `.wrangler/` directories and they are routinely nested —
+  // `herald/ui/dist`, `muster/worker/.wrangler`, `tomatick/site/.astro`. The
+  // shipped `dist/` caught the root one and missed every nested one.
+  //
+  // `vendor` is the one that actually bites in CI, and NOT `dist`: lint runs
+  // before build, so `dist/` does not exist yet on a CI run. `ipcow.com` alone
+  // reports 148 errors, every one of them inside one committed
+  // `public/vendor/leaflet/leaflet.js`. Vendored code sits at six different
+  // depths across the estate and one of them (`mykk.us-extension/worker/src/
+  // vendor`) is UNDER `src/`, so it defeated the old scope too.
+  // ---------------------------------------------------------------------------
+  {
+    ignores: [
+      '**/node_modules/',
+      '**/dist/',
+      '**/build/',
+      '**/.astro/',
+      '**/.wrangler/',
+      '**/vendor/**',
+      '**/*.min.js',
+
+      // The §15 fixture is a SPECIMEN, and this line is what keeps `npm run
+      // lint` green in a repo that complies with §15 by shipping it. Measured:
+      // without this, the fixture's five deliberate hazards become five errors
+      // in every adopting repo, and the obvious "fix" is to delete the control.
+      //
+      // DO NOT rename the test's synthetic lint path to match this pattern. The
+      // test lints the fixture's TEXT under `src/__xss-lint-fixture__.js`; the
+      // leading and trailing underscores are why this ignore does not swallow
+      // it. Rename it to `src/xss-lint-fixture.js` and this ignore swallows the
+      // fixture: ESLint returns one "File ignored" warning and no findings, so
+      // `flaggedCases()` is `[]` and BOTH assertions go RED — `toEqual([case1
+      // ..case5])` and `toContain('case1')`. THE TEST FAILS LOUDLY. Measured
+      // 2026-09-05 on eslint@10.10.0 against this config: the underscored path
+      // reports 5 cases and both assertions green; the renamed path reports 0.
+      //
+      // THIS COMMENT SAID "the test goes green reporting zero findings" UNTIL
+      // 2026-09-05, and shipped that to eleven adopters — counted in
+      // `eslint.config.{js,mjs}` at each default branch, which is a different
+      // population from the fixture generations. The kit's own test
+      // file had already been corrected; this half had not, so the two halves
+      // of one kit contradicted each other and the wrong half was the one every
+      // adopter reads. The reason to keep the underscores is that the rename
+      // DESTROYS THE MEASUREMENT, not that it hides the failure — a control
+      // that passed by not running is the failure this fixture exists to
+      // prevent, and this one does not do that. Re-derive before editing this
+      // paragraph; it has been wrong once. (DS §15 trap 9.)
+      //
+      // That outcome is WHOLE ADOPTION — a repo carrying this config, so this
+      // ignore is present. A repo that merged the §15 blocks into its own
+      // config need not have it, and there the rename changes nothing: the run
+      // still reports 5 and still passes. `xss-lint-fixture.test.js` carries
+      // the full treatment of both shapes. Read which one you are in before
+      // concluding anything from a rename.
+      '**/xss-lint-fixture.js',
+    ],
+  },
+
+  js.configs.recommended,
+  {
+    languageOptions: {
+      ecmaVersion: 2022,
+      sourceType: 'module',
+      // `webextensions` supplies `chrome` and `browser`. Without it every
+      // `chrome.*` call in an extension repo is a `no-undef` error, which is a
+      // large share of the noise in exactly the repos §15 most needs to reach.
+      globals: { ...globals.browser, ...globals.node, ...globals.webextensions },
+    },
+  },
+  {
+    rules: {
+      // ESLint 9 changed `caughtErrors` from 'none' to 'all', so every
+      // `catch (e) {}` that ignores its binding became an error on upgrade.
+      // Measured: 57 of 80 unused-variable findings estate-wide are caught
+      // errors, 33 of them the same copied `test/harness.mjs` across the viewer
+      // family. This restores the pre-9 default rather than editing 33 copies
+      // of a harness to say `catch {}`.
+      'no-unused-vars': ['error', { caughtErrors: 'none' }],
+    },
+  },
+
+  // ---------------------------------------------------------------------------
+  // §15: required in any repo whose source renders HTML.
+  //
+  // WHY THE SCOPE IS `**/*.{js,mjs,cjs}` AND NOT A LIST OF DIRECTORIES OR ONE
+  // EXTENSION. Read this before narrowing either half, because narrowing is how
+  // this rule was inert on arrival — twice, in two unrelated ways.
+  //
+  // (1) THE PATH HALF. The shipped scope was `src/**/*.js`. Five repos have ZERO
+  // files under `src/` — their JavaScript sits at the repo root — so the rule
+  // matched nothing at all in them:
+  //
+  //     copywizard-extension       0 under src/,  5 .js at root
+  //     capturewizard-extension    0 under src/, 10 .js at root
+  //     bookmarkwizard-extension   0 under src/,  6 .js at root
+  //     mykk.us-extension          0 under src/,  2 .js at root
+  //     textwizard-tools           0 under src/,  1 .js at root
+  //
+  // Those are the browser extensions — the repos that render untrusted content
+  // into a DOM, and so the ones this rule exists for. A security control that
+  // covers everything except its highest-risk consumers is not a partial
+  // control; it is a control that passes by not running.
+  //
+  // `*.js` + `src/**/*.js` would have fixed those five and NOTHING ELSE. The
+  // estate already has a third layout and a fourth — `apps/<app>/src/`,
+  // `worker/src/`, `js/`, `functions/` — and an enumerated list meets each new
+  // one by silently matching zero files in it. That is the same defect again,
+  // rediscovered later by whoever is unlucky. The `**/` prefix cannot fail that
+  // way. Its failure mode is the opposite and the safe one: a layout nobody
+  // anticipated gets linted, and if that surfaces vendored or generated code the
+  // answer is a named entry in the ignores above, which is reviewable. Too many
+  // findings is a conversation. Zero findings looks exactly like success.
+  //
+  // (2) THE EXTENSION HALF, which the path fix left behind. `**/*.js` matches
+  // NEITHER `.mjs` NOR `.cjs`. Both are plain JavaScript that ESLint already
+  // parses with no extra dependency and no parser option — they were excluded
+  // only because the pattern named a single extension. Measured by planting ONE
+  // byte-identical hazard three times and reading back which rules fired:
+  //
+  //     file          §15 rule   no-unused-vars (the control)
+  //     hazard.js         1             1
+  //     hazard.mjs        0             1   <-- linted, and not covered
+  //     hazard.cjs        0             1   <-- linted, and not covered
+  //
+  // The control column is the whole point. `no-unused-vars` fired on all three,
+  // so ESLint was demonstrably reading every file: the instrument worked and the
+  // rule still said nothing. Widening the extension is free — same parser, same
+  // dependencies, same fixture result (still 5 of 5, both negative controls
+  // still clean).
+  //
+  // Measured across the 75 local clones with the ignores above applied: 371
+  // `.js` and 149 `.mjs` (no `.cjs` in the estate yet). So the extension half
+  // alone left 149 files of plain JavaScript unreachable — and 25 of the 58
+  // repos that ship any plain JavaScript contain not one `.js` file, so the rule
+  // was FULLY INERT in all 25. `uploadwizard-app` and every `*-viewer.us` are
+  // among them.
+  //
+  // WHAT THIS SCOPE STILL DOES NOT REACH — DECLARED, SO A GREEN RUN IS NOT READ
+  // AS COVERAGE. `.ts`, `.tsx`, and `.astro` are NOT linted by this config. They
+  // need a parser (`typescript-eslint`, `eslint-plugin-astro`), which is a
+  // dependency and an estate-level decision, not a glob edit — deliberately out
+  // of scope here and owned by devops. It is also the larger half: the same scan
+  // counts 315 `.ts` and 290 `.astro` against 520 files of plain JavaScript, and
+  // in an Astro or TS repo the HTML is rendered in exactly the files this rule
+  // cannot see. Widening to `.mjs`/`.cjs` moves the rule from 371 to 520 of
+  // 1,125 source files (33% -> 46%). That closes a plain defect; it does not
+  // finish the job.
+  // ---------------------------------------------------------------------------
+  {
+    files: ['**/*.{js,mjs,cjs}'],
+    rules: {
+      'no-restricted-syntax': [
+        'error',
+        {
+          selector:
+            'TemplateLiteral CallExpression[callee.object.name="JSON"][callee.property.name="stringify"]',
+          message:
+            'Do not interpolate JSON.stringify into a template literal — a value containing "</script>" closes the tag and becomes markup. Pass it through a data attribute and JSON.parse it on the client (DS §15).',
+        },
+      ],
+    },
+  },
+
+  // ---------------------------------------------------------------------------
+  // THE §15 KIT IS VENDORED, SO REPO-LOCAL STYLE DOES NOT APPLY TO IT.
+  //
+  // Both shipped files are specimens, not this repo's code. Their value is the
+  // MEASUREMENT they encode -- a direct-child selector catches 2 of 5 hazards, a
+  // descendant catches 5 of 5. If each repo reformats them to satisfy its own
+  // style config the specimens diverge, the counts stop being comparable across
+  // the estate, and the fixture stops being evidence and becomes decoration.
+  // Any change to either file is a change to the STANDARD, not to the repo: it
+  // lands in tgwab-standards and is re-vendored from there (DS §15).
+  //
+  // WHICH FILE ACTUALLY NEEDS THIS, BECAUSE IT IS NOT THE OBVIOUS ONE. The
+  // unbraced `if (...) continue;` is in xss-lint-fixture.TEST.js, not in the
+  // fixture -- the fixture contains no if/for/continue/break at all. The fixture
+  // is also named in the global ignores above, so it is not linted in a repo
+  // that adopts this config whole. An exemption naming only the fixture would
+  // therefore be scoped to a file that has no offending line AND is not linted:
+  // precise, inherited, and protecting nothing.
+  //
+  // The fixture IS still listed, and honestly: that entry is inert today and was
+  // measured to be. It changes no outcome in either adoption shape -- whole
+  // (fixture globally ignored, never linted) or partial, where repos merge the
+  // §15 blocks into an existing config and keep their own `ignores`
+  // (resizewizard-api is the live example). In the partial shape the fixture is
+  // linted and does report errors, but they are the five deliberate XSS
+  // findings, which no `curly` exemption touches. It is listed because §15
+  // exempts the whole vendored kit from repo-local style and the config should
+  // say what the standard says -- and so a future revision that gives the
+  // fixture a conditional is covered without rediscovering this.
+  //
+  // SCOPED TO TWO FILENAMES, NOT TO A DIRECTORY. The adopting repo's own tests
+  // keep `curly` and every other style rule. An exemption that leaks past its
+  // two files is the silent version of this fix and looks identical to a working
+  // one, so it is verified in both directions.
+  //
+  // KEEP THIS BLOCK LAST AMONG RULE BLOCKS. Flat config is last-wins; hoisted
+  // above a repo's own style block, it is silently overridden.
+  // ---------------------------------------------------------------------------
+  {
+    files: ['**/xss-lint-fixture.js', '**/xss-lint-fixture.test.js'],
+    rules: { curly: 'off' },
+  },
+
+  // ---------------------------------------------------------------------------
+  // THE OPT-OUT IS A DECLARATION, NOT AN ABSENCE.
+  //
+  // A repo that legitimately interpolates JSON into something that is not HTML
+  // uncomments this block and names EVERY path with its reason. The point is the
+  // same as MUSTER_OPT_OUT=1: a silence cannot be reviewed, and a repo that
+  // simply never adopted the rule is indistinguishable from one that considered
+  // it. A named exemption is a claim someone can check.
+  //
+  // Do NOT widen this to a whole directory to make a run green. One line per
+  // reason, and if you cannot write the reason, the exemption is wrong.
+  //
+  // Known exemptions from the sweep of 75 clones, as worked examples:
+  //
+  //   proton-mail-bridge-client — 12 sites under src/: CLI stdout in --json
+  //     mode, a JSON config write, an NDJSON audit append, an AppleScript
+  //     string. None reaches a browser.
+  //   tgwab-packages/packages/auth/src/licenseStore.js — storage payload.
+  //   ipcow.com/apps/checkip/src/index.ts — a JSON API response.
+  //
+  // That last one is why "it returns a Response" cannot be the discriminator: a
+  // Response is exactly what an HTML page is returned as too. The discriminator
+  // is whether the string is ever parsed as HTML, and only a human knows that.
+  // ---------------------------------------------------------------------------
+  // {
+  //   files: [
+  //     'src/cli/output.js',      // --json mode writes to stdout, never a page
+  //     'src/config/write.js',    // JSON config file on disk
+  //   ],
+  //   rules: { 'no-restricted-syntax': 'off' },
+  // },
+];
diff --git a/package-lock.json b/package-lock.json
index 492e7ec..85391fc 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,7 +9,10 @@
       "version": "0.1.0",
       "license": "MIT",
       "devDependencies": {
-        "esbuild": "^0.24.0"
+        "@eslint/js": "^10.0.1",
+        "esbuild": "^0.24.0",
+        "eslint": "^10.9.1",
+        "globals": "^17.12.0"
       },
       "peerDependencies": {
         "docx": ">=8",
@@ -18,6 +21,30 @@
         "pdfmake": ">=0.2"
       }
     },
+    "node_modules/@cacheable/memory": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@cacheable/memory/-/memory-2.2.0.tgz",
+      "integrity": "sha512-CTLKqLItRCEixEAewD3/j9DB3/o96gpTPD4eJ1v+DGOlxZRZncRQkGYqqnAGCscYd6RNeXfGeiuCphsPtqyIfQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@cacheable/utils": "^2.5.0",
+        "@keyv/bigmap": "^1.3.1",
+        "hookified": "^1.15.1",
+        "keyv": "^5.6.0"
+      }
+    },
+    "node_modules/@cacheable/utils": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@cacheable/utils/-/utils-2.5.0.tgz",
+      "integrity": "sha512-buipgOVDkkPXNR5+xBpDw7Zk2n1EvU7qBJCNUcL7rhQ//kfpOXPAvQ511Os0vpLYJ1pZnvudNytkQt2hst3wqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hashery": "^1.5.1",
+        "keyv": "^5.6.0"
+      }
+    },
     "node_modules/@esbuild/aix-ppc64": {
       "version": "0.24.2",
       "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.24.2.tgz",
@@ -443,6 +470,224 @@
         "node": ">=18"
       }
     },
+    "node_modules/@eslint-community/eslint-utils": {
+      "version": "4.10.1",
+      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.10.1.tgz",
+      "integrity": "sha512-cuadcxVFE8sDK6iWJbs8Sn0av2Nrh2QSGQhVlBW9AaAHqHwjWsZHT8LJ4hFGPh7ASBV2deFdM7H/DPjulmh8rg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "eslint-visitor-keys": "^3.4.3"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0"
+      }
+    },
+    "node_modules/@eslint-community/eslint-utils/node_modules/eslint-visitor-keys": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
+      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/@eslint-community/regexpp": {
+      "version": "4.12.2",
+      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.2.tgz",
+      "integrity": "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^12.0.0 || ^14.0.0 || >=16.0.0"
+      }
+    },
+    "node_modules/@eslint/config-array": {
+      "version": "0.23.5",
+      "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.23.5.tgz",
+      "integrity": "sha512-Y3kKLvC1dvTOT+oGlqNQ1XLqK6D1HU2YXPc52NmAlJZbMMWDzGYXMiPRJ8TYD39muD/OTjlZmNJ4ib7dvSrMBA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@eslint/object-schema": "^3.0.5",
+        "debug": "^4.3.1",
+        "minimatch": "^10.2.4"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
+    "node_modules/@eslint/config-helpers": {
+      "version": "0.7.0",
+      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.7.0.tgz",
+      "integrity": "sha512-DObd/KKUsU+FaFv4PLxSRenpXfQWmPXXP3pPZ6/K1PCrMu2vQpMDMuQe/BqYeoLcz8ro0bVDF1RxOJgfVEdhUw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@eslint/core": "^1.2.1"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
+    "node_modules/@eslint/core": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.2.1.tgz",
+      "integrity": "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@types/json-schema": "^7.0.15"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
+    "node_modules/@eslint/js": {
+      "version": "10.0.1",
+      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-10.0.1.tgz",
+      "integrity": "sha512-zeR9k5pd4gxjZ0abRoIaxdc7I3nDktoXZk2qOv9gCNWx3mVwEn32VRhyLaRsDiJjTs0xq/T8mfPtyuXu7GWBcA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      },
+      "funding": {
+        "url": "https://eslint.org/donate"
+      },
+      "peerDependencies": {
+        "eslint": "^10.0.0"
+      },
+      "peerDependenciesMeta": {
+        "eslint": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@eslint/object-schema": {
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@eslint/object-schema/-/object-schema-3.0.5.tgz",
+      "integrity": "sha512-vqTaUEgxzm+YDSdElad6PiRoX4t8VGDjCtt05zn4nU810UIx/uNEV7/lZJ6KwFThKZOzOxzXy48da+No7HZaMw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
+    "node_modules/@eslint/plugin-kit": {
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.7.3.tgz",
+      "integrity": "sha512-IkO+/KEUvwbVpiURZg+P7zF74z5Jxe0UgJxVni+RtoHQ6IZieXaO02kmadomap/q+l6bc/jdPGGqTjhuZnuz1Q==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@eslint/core": "^1.2.1",
+        "levn": "^0.4.1"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
+    "node_modules/@humanfs/core": {
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
+    "node_modules/@humanfs/node": {
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
+        "@humanwhocodes/retry": "^0.4.0"
+      },
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
+    "node_modules/@humanwhocodes/module-importer": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
+      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=12.22"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/nzakas"
+      }
+    },
+    "node_modules/@humanwhocodes/retry": {
+      "version": "0.4.3",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.4.3.tgz",
+      "integrity": "sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/nzakas"
+      }
+    },
+    "node_modules/@keyv/bigmap": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@keyv/bigmap/-/bigmap-1.3.1.tgz",
+      "integrity": "sha512-WbzE9sdmQtKy8vrNPa9BRnwZh5UF4s1KTmSK0KUVLo3eff5BlQNNWDnFOouNpKfPKDnms9xynJjsMYjMaT/aFQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hashery": "^1.4.0",
+        "hookified": "^1.15.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "peerDependencies": {
+        "keyv": "^5.6.0"
+      }
+    },
+    "node_modules/@keyv/serialize": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@keyv/serialize/-/serialize-1.1.1.tgz",
+      "integrity": "sha512-dXn3FZhPv0US+7dtJsIi2R+c7qWYiReoEh5zUntWCf4oSpMNib8FDhSoed6m3QyZdx5hK7iLFkYk3rNxwt8vTA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@noble/ciphers": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/@noble/ciphers/-/ciphers-1.3.0.tgz",
@@ -479,6 +724,27 @@
         "tslib": "^2.8.0"
       }
     },
+    "node_modules/@types/esrecurse": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@types/esrecurse/-/esrecurse-4.3.1.tgz",
+      "integrity": "sha512-xJBAbDifo5hpffDBuHl0Y8ywswbiAp/Wi7Y/GtAgSlZyIABppyurxVueOPE8LUQOxdlgi6Zqce7uoEpqNTeiUw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/estree": {
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/json-schema": {
+      "version": "7.0.15",
+      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
+      "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/node": {
       "version": "25.9.5",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.5.tgz",
@@ -497,6 +763,56 @@
       "optional": true,
       "peer": true
     },
+    "node_modules/acorn": {
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.18.0.tgz",
+      "integrity": "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "acorn": "bin/acorn"
+      },
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/acorn-jsx": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
+      "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      }
+    },
+    "node_modules/ajv": {
+      "version": "6.15.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
+      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.1",
+        "fast-json-stable-stringify": "^2.0.0",
+        "json-schema-traverse": "^0.4.1",
+        "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
     "node_modules/base64-js": {
       "version": "0.0.8",
       "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-0.0.8.tgz",
@@ -507,6 +823,19 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
     "node_modules/brotli": {
       "version": "1.3.3",
       "resolved": "https://registry.npmjs.org/brotli/-/brotli-1.3.3.tgz",
@@ -548,6 +877,20 @@
         "pako": "~1.0.5"
       }
     },
+    "node_modules/cacheable": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/cacheable/-/cacheable-2.5.0.tgz",
+      "integrity": "sha512-60cyAOytib/OzBw1JNSoSV/boK1AtHryDIjvVBk7XbN4ugfkM3+Sry7fEjNgPMGgOjuaZPAp8ruZ0Cxafwyq9g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@cacheable/memory": "^2.2.0",
+        "@cacheable/utils": "^2.5.0",
+        "hookified": "^1.15.0",
+        "keyv": "^5.6.0",
+        "qified": "^0.10.1"
+      }
+    },
     "node_modules/clone": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/clone/-/clone-2.1.2.tgz",
@@ -565,6 +908,46 @@
       "license": "MIT",
       "peer": true
     },
+    "node_modules/cross-spawn": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/deep-is": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
+      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/dfa": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/dfa/-/dfa-1.2.0.tgz",
@@ -641,12 +1024,239 @@
         "@esbuild/win32-x64": "0.24.2"
       }
     },
+    "node_modules/escape-string-regexp": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
+      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/eslint": {
+      "version": "10.10.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.10.0.tgz",
+      "integrity": "sha512-NPXn6r5zl4uET1DAVPaOwzX3rut4c0wcmw3dWJAfOsTM5+TogXo0DDjz8pwm/hL8cyVNpHqeK4JpN0NjnyFFNw==",
+      "dev": true,
+      "license": "MIT",
+      "workspaces": [
+        "packages/*"
+      ],
+      "dependencies": {
+        "@eslint-community/eslint-utils": "^4.8.0",
+        "@eslint-community/regexpp": "^4.12.2",
+        "@eslint/config-array": "^0.23.5",
+        "@eslint/config-helpers": "^0.7.0",
+        "@eslint/core": "^1.2.1",
+        "@eslint/plugin-kit": "^0.7.3",
+        "@humanfs/node": "^0.16.6",
+        "@humanwhocodes/module-importer": "^1.0.1",
+        "@humanwhocodes/retry": "^0.4.2",
+        "@types/estree": "^1.0.6",
+        "ajv": "^6.14.0",
+        "cross-spawn": "^7.0.6",
+        "debug": "^4.3.2",
+        "escape-string-regexp": "^4.0.0",
+        "eslint-scope": "^9.1.2",
+        "eslint-visitor-keys": "^5.0.1",
+        "espree": "^11.2.0",
+        "esquery": "^1.7.0",
+        "esutils": "^2.0.2",
+        "fast-deep-equal": "^3.1.3",
+        "file-entry-cache": "11.1.5 || >11.1.6 <12",
+        "find-up": "^5.0.0",
+        "glob-parent": "^6.0.2",
+        "ignore": "^5.2.0",
+        "imurmurhash": "^0.1.4",
+        "is-glob": "^4.0.0",
+        "json-stable-stringify-without-jsonify": "^1.0.1",
+        "minimatch": "^10.2.5",
+        "natural-compare": "^1.4.0",
+        "optionator": "^0.9.3"
+      },
+      "bin": {
+        "eslint": "bin/eslint.js"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      },
+      "funding": {
+        "url": "https://eslint.org/donate"
+      },
+      "peerDependencies": {
+        "jiti": "*"
+      },
+      "peerDependenciesMeta": {
+        "jiti": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/eslint-scope": {
+      "version": "9.1.2",
+      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-9.1.2.tgz",
+      "integrity": "sha512-xS90H51cKw0jltxmvmHy2Iai1LIqrfbw57b79w/J7MfvDfkIkFZ+kj6zC3BjtUwh150HsSSdxXZcsuv72miDFQ==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "@types/esrecurse": "^4.3.1",
+        "@types/estree": "^1.0.8",
+        "esrecurse": "^4.3.0",
+        "estraverse": "^5.2.0"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/eslint-visitor-keys": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz",
+      "integrity": "sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/espree": {
+      "version": "11.2.0",
+      "resolved": "https://registry.npmjs.org/espree/-/espree-11.2.0.tgz",
+      "integrity": "sha512-7p3DrVEIopW1B1avAGLuCSh1jubc01H2JHc8B4qqGblmg5gI9yumBgACjWo4JlIc04ufug4xJ3SQI8HkS/Rgzw==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "acorn": "^8.16.0",
+        "acorn-jsx": "^5.3.2",
+        "eslint-visitor-keys": "^5.0.1"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/esquery": {
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.7.0.tgz",
+      "integrity": "sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "estraverse": "^5.1.0"
+      },
+      "engines": {
+        "node": ">=0.10"
+      }
+    },
+    "node_modules/esrecurse": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
+      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "estraverse": "^5.2.0"
+      },
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/estraverse": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/esutils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
+      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
       "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "license": "MIT"
+    },
+    "node_modules/fast-json-stable-stringify": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
+      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/fast-levenshtein": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
+      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/file-entry-cache": {
+      "version": "11.1.5",
+      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-11.1.5.tgz",
+      "integrity": "sha512-+PFTHITI08JIGhnNpGNI8T8inUpgZfk3GNEqfT9R2zZV2iFXg3CvqzSl/uEhs7TSGujYRELEANyDvS8Fj7+S7Q==",
+      "dev": true,
       "license": "MIT",
-      "peer": true
+      "dependencies": {
+        "flat-cache": "^6.1.23"
+      }
+    },
+    "node_modules/find-up": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
+      "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "locate-path": "^6.0.0",
+        "path-exists": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/flat-cache": {
+      "version": "6.1.23",
+      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-6.1.23.tgz",
+      "integrity": "sha512-f++BY9pTk+983xK1FLzlLpmM0i0z+jHmx3QESGkURMXujQZz1k5wzwX6hjnQ8goaD0B+sYnDK1yZ6MTyZfUaqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cacheable": "^2.5.0",
+        "flatted": "^3.4.2",
+        "hookified": "^1.15.0"
+      }
+    },
+    "node_modules/flatted": {
+      "version": "3.4.4",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.4.tgz",
+      "integrity": "sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==",
+      "dev": true,
+      "license": "ISC"
     },
     "node_modules/fontkit": {
       "version": "2.0.4",
@@ -666,6 +1276,32 @@
         "unicode-trie": "^2.0.0"
       }
     },
+    "node_modules/glob-parent": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
+      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "is-glob": "^4.0.3"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
+    "node_modules/globals": {
+      "version": "17.12.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-17.12.0.tgz",
+      "integrity": "sha512-cezEd/DTyyht9cvSSURyygXPfy04GtWO/5e6ZPvH7fCtjKz9PYOmuawphw1Ctd1f6C+5JypXfGD7ahNMXvevBA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/hash.js": {
       "version": "1.1.7",
       "resolved": "https://registry.npmjs.org/hash.js/-/hash.js-1.1.7.tgz",
@@ -677,6 +1313,36 @@
         "minimalistic-assert": "^1.0.1"
       }
     },
+    "node_modules/hashery": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/hashery/-/hashery-1.5.1.tgz",
+      "integrity": "sha512-iZyKG96/JwPz1N55vj2Ie2vXbhu440zfUfJvSwEqEbeLluk7NnapfGqa7LH0mOsnDxTF85Mx8/dyR6HfqcbmbQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hookified": "^1.15.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/hookified": {
+      "version": "1.15.1",
+      "resolved": "https://registry.npmjs.org/hookified/-/hookified-1.15.1.tgz",
+      "integrity": "sha512-MvG/clsADq1GPM2KGo2nyfaWVyn9naPiXrqIe4jYjXNZQt238kWyOGrsyc/DmRAQ+Re6yeo6yX/yoNCG5KAEVg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/ignore": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
+      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
     "node_modules/immediate": {
       "version": "3.0.6",
       "resolved": "https://registry.npmjs.org/immediate/-/immediate-3.0.6.tgz",
@@ -684,6 +1350,16 @@
       "license": "MIT",
       "peer": true
     },
+    "node_modules/imurmurhash": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
+      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.8.19"
+      }
+    },
     "node_modules/inherits": {
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
@@ -691,6 +1367,29 @@
       "license": "ISC",
       "peer": true
     },
+    "node_modules/is-extglob": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
+      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-glob": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-extglob": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/isarray": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
@@ -698,6 +1397,13 @@
       "license": "MIT",
       "peer": true
     },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/js-md5": {
       "version": "0.8.3",
       "resolved": "https://registry.npmjs.org/js-md5/-/js-md5-0.8.3.tgz",
@@ -705,6 +1411,20 @@
       "license": "MIT",
       "peer": true
     },
+    "node_modules/json-schema-traverse": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/json-stable-stringify-without-jsonify": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
+      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/jszip": {
       "version": "3.10.1",
       "resolved": "https://registry.npmjs.org/jszip/-/jszip-3.10.1.tgz",
@@ -718,6 +1438,30 @@
         "setimmediate": "^1.0.5"
       }
     },
+    "node_modules/keyv": {
+      "version": "5.6.0",
+      "resolved": "https://registry.npmjs.org/keyv/-/keyv-5.6.0.tgz",
+      "integrity": "sha512-CYDD3SOtsHtyXeEORYRx2qBtpDJFjRTGXUtmNEMGyzYOKj1TE3tycdlho7kA1Ufx9OYWZzg52QFBGALTirzDSw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@keyv/serialize": "^1.1.1"
+      }
+    },
+    "node_modules/levn": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
+      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "prelude-ls": "^1.2.1",
+        "type-check": "~0.4.0"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
     "node_modules/lie": {
       "version": "3.3.0",
       "resolved": "https://registry.npmjs.org/lie/-/lie-3.3.0.tgz",
@@ -739,6 +1483,22 @@
         "unicode-trie": "^2.0.0"
       }
     },
+    "node_modules/locate-path": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
+      "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-locate": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/marked": {
       "version": "18.0.11",
       "resolved": "https://registry.npmjs.org/marked/-/marked-18.0.11.tgz",
@@ -759,6 +1519,29 @@
       "license": "ISC",
       "peer": true
     },
+    "node_modules/minimatch": {
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.8"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/nanoid": {
       "version": "5.1.16",
       "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-5.1.16.tgz",
@@ -778,6 +1561,63 @@
         "node": "^18 || >=20"
       }
     },
+    "node_modules/natural-compare": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
+      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/optionator": {
+      "version": "0.9.4",
+      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
+      "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "deep-is": "^0.1.3",
+        "fast-levenshtein": "^2.0.6",
+        "levn": "^0.4.1",
+        "prelude-ls": "^1.2.1",
+        "type-check": "^0.4.0",
+        "word-wrap": "^1.2.5"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/p-limit": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
+      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "yocto-queue": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/p-locate": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
+      "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-limit": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/pako": {
       "version": "1.0.11",
       "resolved": "https://registry.npmjs.org/pako/-/pako-1.0.11.tgz",
@@ -785,6 +1625,26 @@
       "license": "(MIT AND Zlib)",
       "peer": true
     },
+    "node_modules/path-exists": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
+      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/pdfkit": {
       "version": "0.19.1",
       "resolved": "https://registry.npmjs.org/pdfkit/-/pdfkit-0.19.1.tgz",
@@ -824,6 +1684,16 @@
         "browserify-zlib": "^0.2.0"
       }
     },
+    "node_modules/prelude-ls": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
+      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
     "node_modules/process-nextick-args": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
@@ -831,6 +1701,36 @@
       "license": "MIT",
       "peer": true
     },
+    "node_modules/punycode": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
+      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/qified": {
+      "version": "0.10.1",
+      "resolved": "https://registry.npmjs.org/qified/-/qified-0.10.1.tgz",
+      "integrity": "sha512-+Owyggi9IxT1ePKGafcI87ubSmxol6smwJ+RAHDQlx9+9cPwFWDiKFFCPuWhr9ignlGpZ9vDQLw67N4dcTVFEA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hookified": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/qified/node_modules/hookified": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/hookified/-/hookified-2.2.0.tgz",
+      "integrity": "sha512-p/LgFzRN5FeoD3DLS6bkUapeye6E4SI6yJs6KetENd18S+FBthqYq2amJUWpt5z0EQwwHemidjY5OqJGEKm5uA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/readable-stream": {
       "version": "2.3.8",
       "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
@@ -878,6 +1778,29 @@
       "license": "MIT",
       "peer": true
     },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/string_decoder": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
@@ -902,6 +1825,19 @@
       "license": "0BSD",
       "peer": true
     },
+    "node_modules/type-check": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
+      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "prelude-ls": "^1.2.1"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
     "node_modules/undici-types": {
       "version": "7.24.6",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz",
@@ -959,6 +1895,16 @@
       "license": "MIT",
       "peer": true
     },
+    "node_modules/uri-js": {
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
+      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "punycode": "^2.1.0"
+      }
+    },
     "node_modules/util-deprecate": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
@@ -966,6 +1912,32 @@
       "license": "MIT",
       "peer": true
     },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/word-wrap": {
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
+      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/xml": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/xml/-/xml-1.0.1.tgz",
@@ -998,6 +1970,19 @@
       "engines": {
         "node": ">=12.0.0"
       }
+    },
+    "node_modules/yocto-queue": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
+      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
     }
   }
 }
diff --git a/package.json b/package.json
index ab0170e..b793f67 100644
--- a/package.json
+++ b/package.json
@@ -18,6 +18,7 @@
   },
   "scripts": {
     "build": "node build/build.mjs",
+    "lint": "eslint .",
     "prepare": "node build/build.mjs",
     "test": "node --experimental-test-module-mocks --test test/pdf-vfs.test.js"
   },
@@ -28,6 +29,9 @@
     "pdfmake": ">=0.2"
   },
   "devDependencies": {
-    "esbuild": "^0.24.0"
+    "@eslint/js": "^10.0.1",
+    "esbuild": "^0.24.0",
+    "eslint": "^10.9.1",
+    "globals": "^17.12.0"
   }
 }
diff --git a/src/core.js b/src/core.js
index efb3923..83638de 100644
--- a/src/core.js
+++ b/src/core.js
@@ -50,8 +50,8 @@ export function debounce(fn, ms) {
 
 export const store = {
   get: function (k) { try { return localStorage.getItem('mdw:' + k); } catch (e) { return null; } },
-  set: function (k, v) { try { localStorage.setItem('mdw:' + k, v); } catch (e) {} },
-  del: function (k) { try { localStorage.removeItem('mdw:' + k); } catch (e) {} }
+  set: function (k, v) { try { localStorage.setItem('mdw:' + k, v); } catch (e) { /* storage unavailable or full: a dropped preference is not worth throwing over */ } },
+  del: function (k) { try { localStorage.removeItem('mdw:' + k); } catch (e) { /* as above: nothing to recover from a failed delete */ } }
 };
 
 /* -------------------------------------------------------------- document */
@@ -64,6 +64,9 @@ export function baseName(md, title) {
     if (m) name = m[1].replace(/[*_~`#]/g, '').trim();
   }
   if (!name) name = 'document';
+  // The C0 control range is deliberate: these bytes are illegal in filenames on
+  // every OS, so a download name must have them stripped rather than pass them through.
+  // eslint-disable-next-line no-control-regex
   name = name.replace(/[\\/:*?"<>|\x00-\x1f]/g, '-').replace(/\s+/g, ' ').trim();
   return (name.slice(0, 120) || 'document');
 }
diff --git a/src/exporters/pdf.js b/src/exporters/pdf.js
index b3a84c7..886221e 100644
--- a/src/exporters/pdf.js
+++ b/src/exporters/pdf.js
@@ -117,7 +117,7 @@ export function pdf(md, base) {
 
 /* ------------------------------------------------------------ inline text */
 
-function textRuns(tokens, ctx) {
+function textRuns(tokens) {
   var out = [];
   inlines(tokens).forEach(function (r) {
     if (r.br) { out.push({ text: '\n' }); return; }
@@ -163,7 +163,7 @@ function blocks(tokens, ctx) {
     switch (t.type) {
       case 'space': break;
       case 'heading':
-        out.push({ text: textRuns(t.tokens, ctx), style: 'h' + Math.min(t.depth, 6) });
+        out.push({ text: textRuns(t.tokens), style: 'h' + Math.min(t.depth, 6) });
         break;
       case 'paragraph': case 'text': {
         if (t.type === 'paragraph' && isImageOnlyParagraph(t)) {
@@ -180,7 +180,7 @@ function blocks(tokens, ctx) {
           });
           break;
         }
-        out.push({ text: textRuns(t.tokens != null ? t.tokens : [t], ctx), margin: [0, 3, 0, 8] });
+        out.push({ text: textRuns(t.tokens != null ? t.tokens : [t]), margin: [0, 3, 0, 8] });
         break;
       }
       case 'code':
@@ -226,7 +226,7 @@ function blocks(tokens, ctx) {
         out.push(list(t, ctx));
         break;
       case 'table':
-        out.push(table(t, ctx));
+        out.push(table(t));
         break;
       case 'hr':
         out.push({
@@ -240,7 +240,7 @@ function blocks(tokens, ctx) {
         break;
       }
       default:
-        if (t.tokens) out.push({ text: textRuns(t.tokens, ctx), margin: [0, 3, 0, 8] });
+        if (t.tokens) out.push({ text: textRuns(t.tokens), margin: [0, 3, 0, 8] });
     }
   });
   return out;
@@ -251,7 +251,7 @@ function list(t, ctx) {
     var stack = [];
     (item.tokens || []).forEach(function (bt) {
       if (bt.type === 'text' || bt.type === 'paragraph') {
-        var runsArr = textRuns(bt.tokens != null ? bt.tokens : [bt], ctx);
+        var runsArr = textRuns(bt.tokens != null ? bt.tokens : [bt]);
         if (item.task && stack.length === 0) {
           runsArr.unshift({ text: item.checked ? '[x] ' : '[  ] ', fontSize: 9.5, color: '#666672' });
         }
@@ -270,11 +270,11 @@ function list(t, ctx) {
   return node;
 }
 
-function table(t, ctx) {
+function table(t) {
   var aligns = (t.align || []).map(function (a) { return a || 'left'; });
   function cells(row, isHeader) {
     return row.map(function (c, i) {
-      var o = { text: c ? textRuns(c.tokens, ctx) : '', alignment: aligns[i] || 'left' };
+      var o = { text: c ? textRuns(c.tokens) : '', alignment: aligns[i] || 'left' };
       if (isHeader) { o.bold = true; o.fillColor = '#EFEDF6'; }
       return o;
     });
diff --git a/test/pdf-vfs.test.js b/test/pdf-vfs.test.js
index cb654fd..d19948a 100644
--- a/test/pdf-vfs.test.js
+++ b/test/pdf-vfs.test.js
@@ -3,6 +3,15 @@
 import assert from 'node:assert/strict';
 import { mock, test } from 'node:test';
 
+// node:test has NO default per-test timeout, so a guard that turns a hang into
+// a rejection cannot be tested by simply awaiting it: delete the guard and the
+// test stops reporting at all rather than reporting red. Every test whose
+// subject is that guard therefore carries an explicit `timeout`. 2000ms is
+// ~50x the 40ms the assertions actually wait for — wide enough not to flake on
+// a contended runner, short enough that a broken guard is red in seconds
+// instead of burning to the CI job limit.
+const HANG_GUARD_TIMEOUT = { timeout: 2000 };
+
 const vfs = {
   'Roboto-Regular.ttf': 'AAAA',
   'Roboto-Medium.ttf': 'AAAA',
@@ -11,6 +20,10 @@ const vfs = {
 };
 
 const registered = [];
+// Captured AT CALL TIME. Reading `registered.length` after the whole promise
+// settles is order-blind — it is satisfied just as well by registering the
+// fonts *after* createPdf, which is the defect this suite is named for.
+let registeredWhenCreatePdfRan = -1;
 let getBlobImpl = function (cb) { cb({ type: 'application/pdf' }); };
 
 mock.module('pdfmake', {
@@ -18,6 +31,7 @@ mock.module('pdfmake', {
     default: {
       addVirtualFileSystem: function (v) { registered.push(v); },
       createPdf: function () {
+        registeredWhenCreatePdfRan = registered.length;
         return { getBlob: function (cb) { return getBlobImpl(cb); } };
       }
     }
@@ -42,12 +56,17 @@ const { pdf, blobFromPdf } = await import('../src/exporters/pdf.js');
 
 test('pdf() registers Roboto on pdfmake before createPdf', async () => {
   const blob = await pdf('# Hello', 'hello');
-  assert.equal(registered.length, 1);
+  assert.equal(registered.length, 1, 'addVirtualFileSystem must be called exactly once');
   assert.ok(registered[0]['Roboto-Medium.ttf'], 'addVirtualFileSystem received Roboto-Medium.ttf');
+  assert.equal(
+    registeredWhenCreatePdfRan,
+    1,
+    'fonts must already be registered when createPdf runs — registering them afterwards is the missing-Roboto hang'
+  );
   assert.equal(blob.type, 'application/pdf');
 });
 
-test('a hung getBlob rejects instead of stalling', async () => {
+test('a hung getBlob rejects instead of stalling', HANG_GUARD_TIMEOUT, async () => {
   const hung = { getBlob: function () { /* never calls back, as pdfmake 0.2 does when a font is missing */ } };
   await assert.rejects(
     () => blobFromPdf(hung, 40),
@@ -61,7 +80,7 @@ test('a promise getBlob (pdfmake 0.3) resolves', async () => {
   assert.equal(blob.type, 'application/pdf');
 });
 
-test('a hung getBlob promise rejects instead of stalling', async () => {
+test('a hung getBlob promise rejects instead of stalling', HANG_GUARD_TIMEOUT, async () => {
   const hung = { getBlob: function () { return new Promise(function () { /* never settles */ }); } };
   await assert.rejects(
     () => blobFromPdf(hung, 40),