diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d3c2167..b2ea7be 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,5 +17,22 @@ jobs:
       - run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
       - uses: Swatinem/rust-cache@v2
       - run: cargo fmt --all --check
-      - run: cargo build --workspace
-      - run: cargo test --workspace
+      # --locked here so the lock is checked on every PR, not first discovered
+      # at release time. It is also what makes CI agree with the greentree
+      # `test` check, which has always passed --locked: without it CI was green
+      # on a tree the repo's own gate refused.
+      - run: cargo build --workspace --locked
+      - run: cargo test --workspace --locked
+
+  # The npm distribution. No build, no network, no credentials — it is four
+  # descriptions of the same platform list, checked against each other, plus
+  # the launcher run as a real child process. The one that matters most is the
+  # cross-check against release.yml's build matrix: a target added there and
+  # not here publishes tarballs that `npm install` can never reach.
+  npm:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: "22" }
+      - run: node --test npm/test/*.test.mjs
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 287cf97..162c677 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,12 @@
 #
 # Tags arrive from the source-of-truth sync (the private reachpad-infra repo
 # pushes a snapshot and its cli-v* tag together).
+#
+# Three things leave this workflow: a GitHub release, five npm packages, and
+# nothing else. The npm packages carry these same binaries — see npm/README.md
+# for why that install path exists at all (short version: npm never stamps
+# com.apple.quarantine, so an ad-hoc signed binary installed that way does not
+# meet Gatekeeper).
 name: release
 on:
   push:
@@ -22,6 +28,10 @@ jobs:
             runner: ubuntu-24.04-arm
           - target: aarch64-apple-darwin
             runner: macos-14
+          # Cross-compiled from the same arm64 runner: the macOS SDK carries
+          # both slices, so this needs a target, not a second machine.
+          - target: x86_64-apple-darwin
+            runner: macos-14
     runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v4
@@ -38,8 +48,85 @@ jobs:
           else
             sudo apt-get update && sudo apt-get install -y protobuf-compiler musl-tools
           fi
+      # --locked is the difference between "built from this source" and "built
+      # from this source and these exact dependency versions". Without it cargo
+      # re-resolves on the runner, so the committed lock describes nothing that
+      # was ever built, two builds of ONE tag can differ, and a transitive
+      # dependency that publishes a semver-compatible release between them is
+      # picked up with nobody deciding to. That is the hole the provenance
+      # claim at the top of this file must not have. It fails loudly if the
+      # lock and the manifest ever disagree again, which is the point.
       - name: build
-        run: cargo build --release -p reach --target ${{ matrix.target }}
+        run: cargo build --release --locked -p reach --target ${{ matrix.target }}
+
+      # --- macOS: Developer ID signature + notarization ---------------------
+      #
+      # Without this the binary is only ad-hoc signed (the linker's own
+      # signature). Ad-hoc is enough to EXECUTE on Apple silicon, which is why
+      # `brew install` and the curl installer work today — neither stamps
+      # com.apple.quarantine. It is NOT enough for anything that does stamp it:
+      # a browser download from the releases page hits "Apple could not verify
+      # reachpad is free of malware", and no amount of packaging fixes that.
+      # Only a Developer ID signature that Apple has notarized clears it.
+      #
+      # The step is skipped, loudly, when the secrets are absent, because the
+      # alternative is a release that silently ships unsigned binaries under a
+      # workflow that claims to sign them. Set up (once):
+      #
+      #   MACOS_CERTIFICATE      base64 of the Developer ID Application .p12
+      #   MACOS_CERTIFICATE_PWD  its export password
+      #   MACOS_SIGN_IDENTITY    e.g. "Developer ID Application: … (TEAMID)"
+      #   MACOS_NOTARY_KEY       base64 of the App Store Connect .p8 key
+      #   MACOS_NOTARY_KEY_ID    the key id
+      #   MACOS_NOTARY_ISSUER    the issuer uuid
+      - name: sign and notarize (macOS, when the signing secrets exist)
+        if: runner.os == 'macOS'
+        env:
+          CERT: ${{ secrets.MACOS_CERTIFICATE }}
+          CERT_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
+          IDENTITY: ${{ secrets.MACOS_SIGN_IDENTITY }}
+          NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
+          NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
+          NOTARY_ISSUER: ${{ secrets.MACOS_NOTARY_ISSUER }}
+          BINARY: target/${{ matrix.target }}/release/reachpad
+        run: |
+          if [ -z "$CERT" ]; then
+            echo "::warning title=Unsigned macOS binary::MACOS_CERTIFICATE is not set. This release ships an ad-hoc signed binary: it runs from brew, npm and the curl installer, but a browser download will be blocked by Gatekeeper. See the comment in .github/workflows/release.yml."
+            exit 0
+          fi
+          keychain="$RUNNER_TEMP/build.keychain"
+          password="$(uuidgen)"
+          security create-keychain -p "$password" "$keychain"
+          security set-keychain-settings -lut 21600 "$keychain"
+          security unlock-keychain -p "$password" "$keychain"
+          security list-keychains -d user -s "$keychain" $(security list-keychains -d user | tr -d '"')
+          echo "$CERT" | base64 --decode > "$RUNNER_TEMP/cert.p12"
+          security import "$RUNNER_TEMP/cert.p12" -k "$keychain" -P "$CERT_PWD" \
+            -T /usr/bin/codesign -T /usr/bin/security
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$password" "$keychain"
+          rm -f "$RUNNER_TEMP/cert.p12"
+
+          # --options runtime is what notarization requires; --timestamp is
+          # what keeps the signature valid after the certificate expires.
+          codesign --force --timestamp --options runtime \
+            --sign "$IDENTITY" "$BINARY"
+          codesign --verify --strict --verbose=2 "$BINARY"
+
+          # notarytool takes an archive, not a bare executable.
+          echo "$NOTARY_KEY" | base64 --decode > "$RUNNER_TEMP/notary.p8"
+          ditto -c -k "$BINARY" "$RUNNER_TEMP/notarize.zip"
+          xcrun notarytool submit "$RUNNER_TEMP/notarize.zip" \
+            --key "$RUNNER_TEMP/notary.p8" \
+            --key-id "$NOTARY_KEY_ID" \
+            --issuer "$NOTARY_ISSUER" \
+            --wait --timeout 30m
+          rm -f "$RUNNER_TEMP/notary.p8"
+
+          # A bare Mach-O cannot be stapled — the ticket has nowhere to live.
+          # Gatekeeper falls back to an online notarization check instead,
+          # which is why this workflow does not attempt `stapler staple`.
+          echo "signed and notarized: $(codesign -dv --verbose=4 "$BINARY" 2>&1 | grep -i '^Authority' | head -1)"
+
       - name: package
         run: |
           cd target/${{ matrix.target }}/release
@@ -60,6 +147,12 @@ jobs:
           merge-multiple: true
       - name: combined checksum file
         run: cat *.sha256 > SHA256SUMS
+      # The body carries the macOS quarantine note on purpose. Downloading a
+      # tarball from THIS page in a browser is the one install path that
+      # stamps com.apple.quarantine, and until the binaries are notarized it
+      # is also the one that meets Gatekeeper. Someone who hits "Apple could
+      # not verify reachpad is free of malware" with no explanation next to
+      # the download concludes the binary is malware, not that it is unsigned.
       - name: create release
         uses: softprops/action-gh-release@v2
         with:
@@ -67,3 +160,90 @@ jobs:
             *.tar.gz
             SHA256SUMS
           fail_on_unmatched_files: true
+          body: |
+            ## Install
+
+            ```sh
+            brew install reachpad/tap/reachpad     # macOS, Linux
+            npm install -g @reachpad/cli           # anywhere Node 18+ runs
+            curl -fsSL https://reachpad.dev/install | sh
+            ```
+
+            All three deliver the binaries below, and none of them hits the
+            macOS warning described next.
+
+            ## Downloading a tarball here, on macOS
+
+            These binaries are ad-hoc signed, not yet Developer ID signed and
+            notarized. A **browser** download tags the file with
+            `com.apple.quarantine`, and macOS then refuses it with "Apple
+            could not verify reachpad is free of malware". The file is fine —
+            it is unsigned, not unsafe — and any of the three commands above
+            avoids the tag entirely. If you want this exact tarball anyway:
+
+            ```sh
+            shasum -a 256 -c SHA256SUMS --ignore-missing
+            xattr -d com.apple.quarantine reachpad
+            ```
+
+            Verify the checksum first, as above; that is the check the
+            signature would otherwise be doing for you.
+
+  # The same binaries, on npm. Separate job so a registry outage cannot lose
+  # the GitHub release, and `needs: publish` so npm never advertises a version
+  # whose release page does not exist yet.
+  npm:
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write # Trusted Publishing: the whole mechanism
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: "22", registry-url: "https://registry.npmjs.org" }
+      # Node 22 ships npm 10, which predates OIDC publishing entirely. A floor
+      # rather than @latest, so a future npm cannot change a release out from
+      # under us on an unrelated day.
+      - name: npm new enough to speak OIDC
+        run: npm install -g npm@^11.5.1
+      - uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+          merge-multiple: true
+      - name: the release's own checksums, not the artifacts' word for it
+        run: |
+          cd artifacts && cat *.sha256 > SHA256SUMS && ls -l
+      - name: stamp the tag's version and stage the binaries
+        run: |
+          version="${GITHUB_REF_NAME#cli-v}"
+          node npm/prepare.mjs --version "$version" --artifacts artifacts
+      - run: node --test npm/test/*.test.mjs
+      # Idempotent on purpose: five publishes in a row, and the fourth failing
+      # must leave a re-runnable tag rather than a half-published version that
+      # npm then refuses to accept again. The platform packages go FIRST —
+      # @reachpad/cli names them as optional dependencies, and a main package
+      # published before them is one npm resolves to nothing for a while.
+      - name: publish
+        run: |
+          version=$(node -p "require('./npm/cli/package.json').version")
+          for dir in darwin-arm64 darwin-x64 linux-x64 linux-arm64 cli; do
+            name=$(node -p "require('./npm/$dir/package.json').name")
+            if npm view "$name@$version" version >/dev/null 2>&1; then
+              echo "$name@$version is already on npm; leaving it alone"
+              continue
+            fi
+            if npm publish "npm/$dir"; then
+              continue
+            fi
+            # A publish can fail for ordinary reasons, but there is exactly one
+            # that is guaranteed to happen once and reads as an unrelated auth
+            # error when it does: npm Trusted Publishing can only be configured
+            # on a package that ALREADY EXISTS, so the first version of each of
+            # these five has to be pushed by hand. Say so here rather than
+            # leaving ENEEDAUTH next to a green release.
+            if ! npm view "$name" version >/dev/null 2>&1; then
+              echo "::error title=$name has never been published::OIDC cannot publish a package that does not exist yet. Publish each of the five once by hand, then configure the trusted publisher for each at npmjs.com (Settings -> Trusted Publisher -> GitHub Actions; org Reachpad, repo reachpad-cli, workflow release.yml, environment blank). The commands are in npm/README.md. Re-running this tag afterwards is safe: publishes already done are skipped."
+            fi
+            exit 1
+          done
diff --git a/.gitignore b/.gitignore
index 6b3e392..f531679 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,4 @@
 /target
 *.profraw
+npm/*/bin/reachpad
+npm/node_modules
diff --git a/Cargo.lock b/Cargo.lock
index ef78b1f..4c7df99 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,29 +2,6 @@
 # It is not intended for manual editing.
 version = 4
 
-[[package]]
-name = "aead"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
-dependencies = [
- "crypto-common 0.1.7",
- "generic-array",
-]
-
-[[package]]
-name = "ahash"
-version = "0.8.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
-dependencies = [
- "cfg-if",
- "getrandom 0.3.4",
- "once_cell",
- "version_check",
- "zerocopy",
-]
-
 [[package]]
 name = "aho-corasick"
 version = "1.1.4"
@@ -34,21 +11,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "allocator-api2"
-version = "0.2.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
-
-[[package]]
-name = "android_system_properties"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "anstream"
 version = "1.0.0"
@@ -105,15 +67,6 @@ version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
-[[package]]
-name = "arc-swap"
-version = "1.9.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c049c0be4daef0b145cb3555416b3b8ef5b7888a38aea1a3a155801fe7b0810b"
-dependencies = [
- "rustversion",
-]
-
 [[package]]
 name = "arrayref"
 version = "0.3.9"
@@ -126,12 +79,6 @@ version = "0.7.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
 
-[[package]]
-name = "ascii"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d92bec98840b8f03a5ff5413de5293bfcd8bf96467cf5452609f939ec6f5de16"
-
 [[package]]
 name = "asn1-rs"
 version = "0.7.2"
@@ -172,2304 +119,703 @@ dependencies = [
 ]
 
 [[package]]
-name = "async-channel"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "924ed96dd52d1b75e9c1a3e6275715fd320f5f9439fb5a4a11fa51f4221158d2"
-dependencies = [
- "concurrent-queue",
- "event-listener-strategy",
- "futures-core",
- "pin-project-lite",
-]
-
-[[package]]
-name = "async-executor"
-version = "1.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c96bf972d85afc50bf5ab8fe2d54d1586b4e0b46c97c50a0c9e71e2f7bcd812a"
+name = "authz"
+version = "0.3.0"
 dependencies = [
- "async-task",
- "concurrent-queue",
- "fastrand",
- "futures-lite",
- "pin-project-lite",
- "slab",
+ "biscuit-auth",
+ "blake3",
+ "hex",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
-name = "async-fs"
-version = "2.2.0"
+name = "autocfg"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8034a681df4aed8b8edbd7fbe472401ecf009251c8b40556b304567052e294c5"
-dependencies = [
- "async-lock",
- "blocking",
- "futures-lite",
-]
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
-name = "async-io"
-version = "2.6.0"
+name = "base64"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "456b8a8feb6f42d237746d4b3e9a178494627745c3c56c6ea55d92ba50d026fc"
-dependencies = [
- "autocfg",
- "cfg-if",
- "concurrent-queue",
- "futures-io",
- "futures-lite",
- "parking",
- "polling",
- "rustix 1.1.4",
- "slab",
- "windows-sys 0.61.2",
-]
+checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
 [[package]]
-name = "async-lock"
-version = "3.4.2"
+name = "base64"
+version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
-dependencies = [
- "event-listener",
- "event-listener-strategy",
- "pin-project-lite",
-]
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
-name = "async-net"
-version = "2.0.0"
+name = "base64ct"
+version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b948000fad4873c1c9339d60f2623323a0cfd3816e5181033c6a5cb68b2accf7"
-dependencies = [
- "async-io",
- "blocking",
- "futures-lite",
-]
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
-name = "async-process"
-version = "2.5.0"
+name = "biscuit-auth"
+version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc50921ec0055cdd8a16de48773bfeec5c972598674347252c0399676be7da75"
+checksum = "95490f2c91dc452247d00a2fb4779bcedb7693e669354fa1fe2a96679f4950cc"
 dependencies = [
- "async-channel",
- "async-io",
- "async-lock",
- "async-signal",
- "async-task",
- "blocking",
- "cfg-if",
- "event-listener",
- "futures-lite",
- "rustix 1.1.4",
+ "base64 0.13.1",
+ "biscuit-parser",
+ "biscuit-quote",
+ "ed25519-dalek",
+ "getrandom 0.1.16",
+ "hex",
+ "nom",
+ "prost 0.10.4",
+ "prost-types 0.10.1",
+ "rand 0.8.7",
+ "rand_core 0.6.4",
+ "regex",
+ "sha2 0.9.9",
+ "thiserror 1.0.69",
+ "time",
+ "zeroize",
 ]
 
 [[package]]
-name = "async-signal"
-version = "0.2.14"
+name = "biscuit-parser"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52b5aaafa020cf5053a01f2a60e8ff5dccf550f0f77ec54a4e47285ac2bab485"
+checksum = "1b9fd6da963e73f7e6db729c3bd76784863ba405b15acbbb5cb08ebc2adbd3bf"
 dependencies = [
- "async-io",
- "async-lock",
- "atomic-waker",
- "cfg-if",
- "futures-core",
- "futures-io",
- "rustix 1.1.4",
- "signal-hook-registry",
- "slab",
- "windows-sys 0.61.2",
+ "hex",
+ "nom",
+ "proc-macro2",
+ "quote",
+ "thiserror 1.0.69",
+ "time",
 ]
 
 [[package]]
-name = "async-task"
-version = "4.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
-
-[[package]]
-name = "async-trait"
-version = "0.1.91"
+name = "biscuit-quote"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae36dc4177970ef04fde5178d3e2429882def40e57a451f919c098f72baa6cec"
+checksum = "0071fe3634b644a8df1434e3e14841e480c4238059c66a94e479b7eff98c2bd3"
 dependencies = [
+ "biscuit-parser",
+ "proc-macro-error",
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 1.0.109",
 ]
 
 [[package]]
-name = "atoi"
-version = "2.0.0"
+name = "bit-set"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f28d99ec8bfea296261ca1af174f24225171fea9664ba9003cbebee704810528"
+checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
 dependencies = [
- "num-traits",
+ "bit-vec 0.8.0",
 ]
 
 [[package]]
-name = "atomic-waker"
-version = "1.1.2"
+name = "bit-vec"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
 
 [[package]]
-name = "authz"
-version = "0.3.0"
+name = "bit-vec"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
 dependencies = [
- "biscuit-auth",
- "blake3",
- "hex",
- "thiserror 2.0.19",
+ "serde",
 ]
 
 [[package]]
-name = "autocfg"
-version = "1.5.1"
+name = "bitflags"
+version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 
 [[package]]
-name = "aws-credential-types"
-version = "1.3.0"
+name = "blake3"
+version = "1.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e93964ffdaf57857f544be3666a5f57570bb699e934700f11b49708f61bb556e"
+checksum = "0aa83c34e62843d924f905e0f5c866eb1dd6545fc4d719e803d9ba6030371fce"
 dependencies = [
- "aws-smithy-async",
- "aws-smithy-runtime-api",
- "aws-smithy-types",
- "zeroize",
+ "arrayref",
+ "arrayvec",
+ "cc",
+ "cfg-if",
+ "constant_time_eq",
+ "cpufeatures 0.3.0",
 ]
 
 [[package]]
-name = "aws-lc-rs"
-version = "1.17.3"
+name = "block-buffer"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00bdb5da18dac48ca2cc7cd4a98e533e8635a58e2361d13a1a4ee3888e0d72f1"
+checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
 dependencies = [
- "aws-lc-sys",
- "untrusted 0.7.1",
- "zeroize",
+ "generic-array",
 ]
 
 [[package]]
-name = "aws-lc-sys"
-version = "0.43.0"
+name = "block-buffer"
+version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43103168cc76fe62678a375e722fc9cb3a0146159ac5828bc4f0dfd755c2224c"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
 dependencies = [
- "cc",
- "cmake",
- "dunce",
- "fs_extra",
- "pkg-config",
+ "generic-array",
 ]
 
 [[package]]
-name = "aws-runtime"
-version = "1.9.1"
+name = "bumpalo"
+version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9007227e10b5fed2f3e0a2beff489211e2b5604c400b7a9d5d81ca9d64c24bb"
-dependencies = [
- "aws-credential-types",
- "aws-sigv4",
- "aws-smithy-async",
- "aws-smithy-http",
- "aws-smithy-runtime",
- "aws-smithy-runtime-api",
- "aws-smithy-types",
- "aws-types",
- "bytes",
- "bytes-utils",
- "fastrand",
- "http 1.5.0",
- "http-body 1.1.0",
- "percent-encoding",
- "pin-project-lite",
- "tracing",
- "uuid",
-]
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
 [[package]]
-name = "aws-sdk-ec2"
-version = "1.245.0"
+name = "byteorder"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ea0c210d0644edd89684295ea7b1f17a5c34c11c1ddc0febb9f809af4876ba4"
-dependencies = [
- "arc-swap",
- "aws-credential-types",
- "aws-runtime",
- "aws-smithy-async",
- "aws-smithy-http",
- "aws-smithy-json",
- "aws-smithy-observability",
- "aws-smithy-query",
- "aws-smithy-runtime",
- "aws-smithy-runtime-api",
- "aws-smithy-schema",
- "aws-smithy-types",
- "aws-smithy-xml",
- "aws-types",
- "fastrand",
- "http 0.2.12",
- "http 1.5.0",
- "regex-lite",
- "tracing",
-]
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
-name = "aws-sdk-kms"
-version = "1.114.0"
+name = "bytes"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0b7d906608ee41e7ddea9983577ba82200435644d567d63dc34e822e088b453"
-dependencies = [
- "arc-swap",
- "aws-credential-types",
- "aws-runtime",
- "aws-smithy-async",
- "aws-smithy-http",
- "aws-smithy-json",
- "aws-smithy-observability",
- "aws-smithy-runtime",
- "aws-smithy-runtime-api",
- "aws-smithy-schema",
- "aws-smithy-types",
- "aws-types",
- "bytes",
- "fastrand",
- "http 0.2.12",
- "http 1.5.0",
- "regex-lite",
- "tracing",
-]
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
-name = "aws-sigv4"
-version = "1.5.1"
+name = "cc"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "723c2234ad7511ceef63eab016b7ba6ff7c55590fefb96fa8467af014a07309f"
+checksum = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9"
 dependencies = [
- "aws-credential-types",
- "aws-smithy-http",
- "aws-smithy-runtime-api",
- "aws-smithy-types",
- "bytes",
- "form_urlencoded",
- "hex",
- "hmac 0.13.0",
- "http 0.2.12",
- "http 1.5.0",
- "percent-encoding",
- "sha2 0.11.0",
- "time",
- "tracing",
+ "find-msvc-tools",
+ "shlex",
 ]
 
 [[package]]
-name = "aws-smithy-async"
-version = "1.3.0"
+name = "cfg-if"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f02e407fb3b54891734224b9ffac8a71fdd35f542500fa1af95754a6b2beb316"
-dependencies = [
- "futures-util",
- "pin-project-lite",
- "tokio",
-]
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
-name = "aws-smithy-http"
-version = "0.64.0"
+name = "cfg_aliases"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37843d9add67c3aff5856f409c6dc315d3cdff60f9c0cb5b670dab1e9920306d"
-dependencies = [
- "aws-smithy-runtime-api",
- "aws-smithy-types",
- "bytes",
- "bytes-utils",
- "futures-core",
- "futures-util",
- "http 1.5.0",
- "http-body 1.1.0",
- "http-body-util",
- "percent-encoding",
- "pin-project-lite",
- "pin-utils",
- "tracing",
-]
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
-name = "aws-smithy-http-client"
-version = "1.2.0"
+name = "chacha20"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "635d23afda0a6ab48d666c4d447c4873e8d1e83518a2be2093122397e50b838e"
-dependencies = [
- "aws-smithy-async",
- "aws-smithy-runtime-api",
- "aws-smithy-types",
- "h2 0.3.27",
- "h2 0.4.15",
- "http 0.2.12",
- "http-body 0.4.6",
- "hyper 0.14.32",
- "hyper-rustls 0.24.2",
- "pin-project-lite",
- "rustls 0.21.12",
- "rustls-native-certs",
- "tokio",
- "tracing",
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
-name = "aws-smithy-json"
-version = "0.63.0"
+name = "clap"
+version = "4.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3dc65a121adb4b33729919fcfa14fa36fb33c1555a8f06bb0e2188dbfdc1d9ef"
+checksum = "d91e0c145792ef73a6ad36d27c75ac09f1832222a3c209689d90f534685ee5b7"
 dependencies = [
- "aws-smithy-runtime-api",
- "aws-smithy-schema",
- "aws-smithy-types",
+ "clap_builder",
+ "clap_derive",
 ]
 
 [[package]]
-name = "aws-smithy-observability"
-version = "0.3.0"
+name = "clap_builder"
+version = "4.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e86338c869539a581bf161247762a6e87f92c5c075060057b5ed6d06632ed0c"
+checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
 dependencies = [
- "aws-smithy-runtime-api",
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
 ]
 
 [[package]]
-name = "aws-smithy-query"
-version = "0.62.0"
+name = "clap_complete"
+version = "4.6.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "512346c7212ab7436df2d77a16d976a468ae44a418835511d2a69269810aaf62"
+checksum = "3be2ad0423bdbbb0e25bc89add796f3559706d4a95e1bc98e4d9662a957b6a19"
 dependencies = [
- "aws-smithy-runtime-api",
- "aws-smithy-schema",
- "aws-smithy-types",
- "aws-smithy-xml",
- "urlencoding",
+ "clap",
 ]
 
 [[package]]
-name = "aws-smithy-runtime"
-version = "1.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07505b34e8f4b3591a4fa69e9792b52289b95488dbbc68c3c0075b7bedb245e1"
-dependencies = [
- "aws-smithy-async",
- "aws-smithy-http",
- "aws-smithy-http-client",
- "aws-smithy-observability",
- "aws-smithy-runtime-api",
- "aws-smithy-schema",
- "aws-smithy-types",
- "bytes",
- "fastrand",
- "http 0.2.12",
- "http 1.5.0",
- "http-body 0.4.6",
- "http-body 1.1.0",
- "http-body-util",
- "pin-project-lite",
- "pin-utils",
- "tokio",
- "tracing",
-]
-
-[[package]]
-name = "aws-smithy-runtime-api"
-version = "1.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b98f2e1fd67ec06618f9c291e5e495a468e60519e44c9c1979cd0521f3affdb"
-dependencies = [
- "aws-smithy-async",
- "aws-smithy-runtime-api-macros",
- "aws-smithy-types",
- "bytes",
- "http 0.2.12",
- "http 1.5.0",
- "pin-project-lite",
- "tokio",
- "tracing",
- "zeroize",
-]
-
-[[package]]
-name = "aws-smithy-runtime-api-macros"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "221eaa237ddf1ca79b60d1372aad77e47f9c0ea5b3ce5099da8c61d027dc77b3"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "aws-smithy-schema"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d56e0a4e53127a632224e43633b0fe045fa9e1e3cfc68b9830f1115e103f910"
-dependencies = [
- "aws-smithy-runtime-api",
- "aws-smithy-types",
- "http 1.5.0",
-]
-
-[[package]]
-name = "aws-smithy-types"
-version = "1.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6dc683efb34b9e755675b37fedbe0103141e5b6df7bdc9eb6967756a8c167d8"
-dependencies = [
- "base64-simd",
- "bytes",
- "bytes-utils",
- "futures-core",
- "http 0.2.12",
- "http 1.5.0",
- "http-body 0.4.6",
- "http-body 1.1.0",
- "http-body-util",
- "itoa",
- "num-integer",
- "pin-project-lite",
- "pin-utils",
- "ryu",
- "serde",
- "time",
- "tokio",
- "tokio-util",
-]
-
-[[package]]
-name = "aws-smithy-xml"
-version = "0.62.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce84f71c72fee2cbbadde6e7d082f5fb466e3a84733855295fa7aafd1b31b7d8"
-dependencies = [
- "aws-smithy-runtime-api",
- "aws-smithy-schema",
- "aws-smithy-types",
- "xmlparser",
-]
-
-[[package]]
-name = "aws-types"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eec1cd5469f328c782dc3e33d4153cf118a54e33cbb3356d60d16f89883e1f94"
-dependencies = [
- "aws-credential-types",
- "aws-smithy-async",
- "aws-smithy-runtime-api",
- "aws-smithy-schema",
- "aws-smithy-types",
- "rustc_version",
- "tracing",
-]
-
-[[package]]
-name = "axum"
-version = "0.7.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
-dependencies = [
- "async-trait",
- "axum-core",
- "base64 0.22.1",
- "bytes",
- "futures-util",
- "http 1.5.0",
- "http-body 1.1.0",
- "http-body-util",
- "hyper 1.11.0",
- "hyper-util",
- "itoa",
- "matchit",
- "memchr",
- "mime",
- "percent-encoding",
- "pin-project-lite",
- "rustversion",
- "serde",
- "serde_json",
- "serde_path_to_error",
- "serde_urlencoded",
- "sha1",
- "sync_wrapper",
- "tokio",
- "tokio-tungstenite",
- "tower",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "axum-core"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
-dependencies = [
- "async-trait",
- "bytes",
- "futures-util",
- "http 1.5.0",
- "http-body 1.1.0",
- "http-body-util",
- "mime",
- "pin-project-lite",
- "rustversion",
- "sync_wrapper",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "base64"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
-
-[[package]]
-name = "base64"
-version = "0.22.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
-
-[[package]]
-name = "base64-simd"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "339abbe78e73178762e23bea9dfd08e697eb3f3301cd4be981c0f78ba5859195"
-dependencies = [
- "outref",
- "vsimd",
-]
-
-[[package]]
-name = "base64ct"
-version = "1.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
-
-[[package]]
-name = "bindgen"
-version = "0.69.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "271383c67ccabffb7381723dea0672a673f292304fcb45c01cc648c7a8d58088"
-dependencies = [
- "bitflags",
- "cexpr",
- "clang-sys",
- "itertools 0.10.5",
- "lazy_static",
- "lazycell",
- "log",
- "prettyplease",
- "proc-macro2",
- "quote",
- "regex",
- "rustc-hash 1.1.0",
- "shlex 1.3.0",
- "syn 2.0.119",
- "which",
-]
-
-[[package]]
-name = "biscuit-auth"
-version = "5.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95490f2c91dc452247d00a2fb4779bcedb7693e669354fa1fe2a96679f4950cc"
-dependencies = [
- "base64 0.13.1",
- "biscuit-parser",
- "biscuit-quote",
- "ed25519-dalek",
- "getrandom 0.1.16",
- "hex",
- "nom",
- "prost 0.10.4",
- "prost-types 0.10.1",
- "rand 0.8.7",
- "rand_core 0.6.4",
- "regex",
- "sha2 0.9.9",
- "thiserror 1.0.69",
- "time",
- "zeroize",
-]
-
-[[package]]
-name = "biscuit-parser"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9fd6da963e73f7e6db729c3bd76784863ba405b15acbbb5cb08ebc2adbd3bf"
-dependencies = [
- "hex",
- "nom",
- "proc-macro2",
- "quote",
- "thiserror 1.0.69",
- "time",
-]
-
-[[package]]
-name = "biscuit-quote"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0071fe3634b644a8df1434e3e14841e480c4238059c66a94e479b7eff98c2bd3"
-dependencies = [
- "biscuit-parser",
- "proc-macro-error",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "bit-set"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
-dependencies = [
- "bit-vec 0.8.0",
-]
-
-[[package]]
-name = "bit-vec"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
-
-[[package]]
-name = "bit-vec"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "bitflags"
-version = "2.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
-dependencies = [
- "serde_core",
-]
-
-[[package]]
-name = "bitmaps"
-version = "3.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1d084b0137aaa901caf9f1e8b21daa6aa24d41cd806e111335541eff9683bd6"
-
-[[package]]
-name = "blake3"
-version = "1.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0aa83c34e62843d924f905e0f5c866eb1dd6545fc4d719e803d9ba6030371fce"
-dependencies = [
- "arrayref",
- "arrayvec",
- "cc",
- "cfg-if",
- "constant_time_eq",
- "cpufeatures 0.3.0",
-]
-
-[[package]]
-name = "block-buffer"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
-dependencies = [
- "generic-array",
-]
-
-[[package]]
-name = "block-buffer"
-version = "0.10.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
-dependencies = [
- "generic-array",
-]
-
-[[package]]
-name = "block-buffer"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
-dependencies = [
- "hybrid-array",
-]
-
-[[package]]
-name = "blockd"
-version = "0.3.0"
-dependencies = [
- "anyhow",
- "async-trait",
- "blake3",
- "cas",
- "clap",
- "futures",
- "hex",
- "libublk",
- "nix 0.31.3",
- "object_store",
- "proptest",
- "prost 0.13.5",
- "proto",
- "runtime",
- "serde",
- "serde_json",
- "statemachines",
- "store",
- "tempfile",
- "thiserror 2.0.19",
- "tokio",
- "tracing",
-]
-
-[[package]]
-name = "blocking"
-version = "1.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e83f8d02be6967315521be875afa792a316e28d57b5a2d401897e2a7921b7f21"
-dependencies = [
- "async-channel",
- "async-task",
- "futures-io",
- "futures-lite",
- "piper",
-]
-
-[[package]]
-name = "bumpalo"
-version = "3.20.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
-
-[[package]]
-name = "byteorder"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
-
-[[package]]
-name = "bytes"
-version = "1.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
-
-[[package]]
-name = "bytes-utils"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dafe3a8757b027e2be6e4e5601ed563c55989fcf1546e933c66c8eb3a058d35"
-dependencies = [
- "bytes",
- "either",
-]
-
-[[package]]
-name = "cas"
-version = "0.3.0"
-dependencies = [
- "async-trait",
- "blake3",
- "futures",
- "hex",
- "object_store",
- "proptest",
- "prost 0.13.5",
- "proto",
- "statemachines",
- "store",
- "tempfile",
- "thiserror 2.0.19",
- "tokio",
- "tracing",
- "zstd",
-]
-
-[[package]]
-name = "cc"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9"
-dependencies = [
- "find-msvc-tools",
- "jobserver",
- "libc",
- "shlex 2.0.1",
-]
-
-[[package]]
-name = "cexpr"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
-dependencies = [
- "nom",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
-
-[[package]]
-name = "cfg_aliases"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
-
-[[package]]
-name = "chacha20"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
-dependencies = [
- "cfg-if",
- "cipher",
- "cpufeatures 0.2.17",
-]
-
-[[package]]
-name = "chacha20"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.0",
- "rand_core 0.10.1",
-]
-
-[[package]]
-name = "chacha20poly1305"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
-dependencies = [
- "aead",
- "chacha20 0.9.1",
- "cipher",
- "poly1305",
- "zeroize",
-]
-
-[[package]]
-name = "choice"
-version = "0.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3b71fc821deaf602a933ada5c845d088156d0cdf2ebf43ede390afe93466553"
-
-[[package]]
-name = "chrono"
-version = "0.4.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
-dependencies = [
- "iana-time-zone",
- "num-traits",
- "serde",
- "windows-link",
-]
-
-[[package]]
-name = "chunked_transfer"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e4de3bc4ea267985becf712dc6d9eed8b04c953b3fcfb339ebc87acd9804901"
-
-[[package]]
-name = "cipher"
-version = "0.4.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
-dependencies = [
- "crypto-common 0.1.7",
- "inout",
- "zeroize",
-]
-
-[[package]]
-name = "clang-sys"
-version = "1.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "157a8ba7b480713b56f4c09fd13fc3e0a22a5dfab8097ba61cbc5feef950788a"
-dependencies = [
- "glob",
- "libc",
- "libloading",
-]
-
-[[package]]
-name = "clap"
-version = "4.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d91e0c145792ef73a6ad36d27c75ac09f1832222a3c209689d90f534685ee5b7"
-dependencies = [
- "clap_builder",
- "clap_derive",
-]
-
-[[package]]
-name = "clap_builder"
-version = "4.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
-dependencies = [
- "anstream",
- "anstyle",
- "clap_lex",
- "strsim",
-]
-
-[[package]]
-name = "clap_complete"
-version = "4.6.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3be2ad0423bdbbb0e25bc89add796f3559706d4a95e1bc98e4d9662a957b6a19"
-dependencies = [
- "clap",
-]
-
-[[package]]
-name = "clap_derive"
-version = "4.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "clap_lex"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
-
-[[package]]
-name = "cmake"
-version = "0.1.58"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "cmov"
-version = "0.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
-
-[[package]]
-name = "colorchoice"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
-
-[[package]]
-name = "combine"
-version = "4.6.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
-dependencies = [
- "bytes",
- "memchr",
-]
-
-[[package]]
-name = "concurrent-queue"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "const-oid"
-version = "0.9.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
-
-[[package]]
-name = "const-oid"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
-
-[[package]]
-name = "constant_time_eq"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
-
-[[package]]
-name = "controld"
-version = "0.3.0"
-dependencies = [
- "anyhow",
- "authz",
- "aws-credential-types",
- "aws-sdk-ec2",
- "aws-types",
- "axum",
- "base64 0.22.1",
- "blake3",
- "blockd",
- "chacha20poly1305",
- "futures",
- "hex",
- "http-body-util",
- "hyper 1.11.0",
- "hyper-util",
- "object_store",
- "pgtest",
- "proto",
- "rand 0.8.7",
- "rcgen",
- "runtime",
- "rustls 0.23.43",
- "rustls-pemfile",
- "serde",
- "serde_json",
- "sqlx",
- "statemachines",
- "store",
- "thiserror 2.0.19",
- "time",
- "tokio",
- "tokio-rustls 0.26.4",
- "tracing",
- "tracing-subscriber",
- "x509-parser",
-]
-
-[[package]]
-name = "core-foundation"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
-[[package]]
-name = "core-foundation-sys"
-version = "0.8.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
-
-[[package]]
-name = "cpufeatures"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "cpufeatures"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "crc"
-version = "3.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
-dependencies = [
- "crc-catalog",
-]
-
-[[package]]
-name = "crc-catalog"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
-
-[[package]]
-name = "crossbeam-queue"
-version = "0.3.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "803d13fb3b09d88be9f4dbc29062c66b19bf7170867ceb746d2a8689bf6c7a26"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
-
-[[package]]
-name = "crypto-common"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
-dependencies = [
- "generic-array",
- "rand_core 0.6.4",
- "typenum",
-]
-
-[[package]]
-name = "crypto-common"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
-dependencies = [
- "hybrid-array",
-]
-
-[[package]]
-name = "ctutils"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
-dependencies = [
- "cmov",
-]
-
-[[package]]
-name = "curve25519-dalek"
-version = "4.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "curve25519-dalek-derive",
- "digest 0.10.7",
- "fiat-crypto",
- "rustc_version",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "curve25519-dalek-derive"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "darling"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0"
-dependencies = [
- "darling_core",
- "darling_macro",
-]
-
-[[package]]
-name = "darling_core"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4"
-dependencies = [
- "fnv",
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "darling_macro"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
-dependencies = [
- "darling_core",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "dashmap"
-version = "6.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6361d5c062261c78a176addb82d4c821ae42bed6089de0e12603cd25de2059c"
-dependencies = [
- "cfg-if",
- "crossbeam-utils",
- "hashbrown 0.14.5",
- "lock_api",
- "once_cell",
- "parking_lot_core",
-]
-
-[[package]]
-name = "data-encoding"
-version = "2.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
-
-[[package]]
-name = "der"
-version = "0.7.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
-dependencies = [
- "const-oid 0.9.6",
- "pem-rfc7468",
- "zeroize",
-]
-
-[[package]]
-name = "der-parser"
-version = "10.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6"
-dependencies = [
- "asn1-rs",
- "displaydoc",
- "nom",
- "num-bigint",
- "num-traits",
- "rusticata-macros",
-]
-
-[[package]]
-name = "deranged"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
-
-[[package]]
-name = "derive_setters"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7e6f6fa1f03c14ae082120b84b3c7fbd7b8588d924cf2d7c3daf9afd49df8b9"
-dependencies = [
- "darling",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "digest"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
-dependencies = [
- "generic-array",
-]
-
-[[package]]
-name = "digest"
-version = "0.10.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
-dependencies = [
- "block-buffer 0.10.4",
- "const-oid 0.9.6",
- "crypto-common 0.1.7",
- "subtle",
-]
-
-[[package]]
-name = "digest"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
-dependencies = [
- "block-buffer 0.12.1",
- "const-oid 0.10.2",
- "crypto-common 0.2.2",
- "ctutils",
-]
-
-[[package]]
-name = "displaydoc"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "dotenvy"
-version = "0.15.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
-
-[[package]]
-name = "dunce"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
-
-[[package]]
-name = "ed25519"
-version = "2.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
-dependencies = [
- "pkcs8",
- "signature",
-]
-
-[[package]]
-name = "ed25519-dalek"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
-dependencies = [
- "curve25519-dalek",
- "ed25519",
- "rand_core 0.6.4",
- "serde",
- "sha2 0.10.9",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "either"
-version = "1.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "equivalent"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
-
-[[package]]
-name = "errno"
-version = "0.3.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
-dependencies = [
- "libc",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "etcetera"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "136d1b5283a1ab77bd9257427ffd09d8667ced0570b6f938942bc7568ed5b943"
-dependencies = [
- "cfg-if",
- "home",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "event-listener"
-version = "5.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
-dependencies = [
- "parking",
- "pin-project-lite",
-]
-
-[[package]]
-name = "event-listener-strategy"
-version = "0.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
-dependencies = [
- "event-listener",
- "pin-project-lite",
-]
-
-[[package]]
-name = "eventlog"
-version = "0.3.0"
-dependencies = [
- "base64 0.22.1",
- "hex",
- "percent-encoding",
- "proptest",
- "prost 0.13.5",
- "proto",
- "store",
- "thiserror 2.0.19",
- "tokio",
- "zstd",
-]
-
-[[package]]
-name = "fastbloom"
-version = "0.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef975e30683b2d965054bb0a836f8973857c4ebf6acf274fe46617cd285060d8"
-dependencies = [
- "foldhash 0.2.0",
- "libm",
- "portable-atomic",
- "siphasher",
-]
-
-[[package]]
-name = "fastrand"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
-
-[[package]]
-name = "fiat-crypto"
-version = "0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
-
-[[package]]
-name = "find-msvc-tools"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
-
-[[package]]
-name = "fixedbitset"
-version = "0.5.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
-
-[[package]]
-name = "flume"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da0e4dd2a88388a1f4ccc7c9ce104604dab68d9f408dc34cd45823d5a9069095"
-dependencies = [
- "futures-core",
- "futures-sink",
- "spin",
-]
-
-[[package]]
-name = "fnv"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-
-[[package]]
-name = "foldhash"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
-
-[[package]]
-name = "foldhash"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
-
-[[package]]
-name = "form_urlencoded"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
-dependencies = [
- "percent-encoding",
-]
-
-[[package]]
-name = "fs_extra"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
-
-[[package]]
-name = "futures"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a88cf1f829d945f548cf8fec32c61b1f202b6d93b45848602fc02af4b12ad218"
-dependencies = [
- "futures-channel",
- "futures-core",
- "futures-executor",
- "futures-io",
- "futures-sink",
- "futures-task",
- "futures-util",
-]
-
-[[package]]
-name = "futures-channel"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae"
-dependencies = [
- "futures-core",
- "futures-sink",
-]
-
-[[package]]
-name = "futures-core"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
-
-[[package]]
-name = "futures-executor"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458"
-dependencies = [
- "futures-core",
- "futures-task",
- "futures-util",
-]
-
-[[package]]
-name = "futures-intrusive"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
-dependencies = [
- "futures-core",
- "lock_api",
- "parking_lot",
-]
-
-[[package]]
-name = "futures-io"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"
-
-[[package]]
-name = "futures-lite"
-version = "2.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f78e10609fe0e0b3f4157ffab1876319b5b0db102a2c60dc4626306dc46b44ad"
-dependencies = [
- "fastrand",
- "futures-core",
- "futures-io",
- "parking",
- "pin-project-lite",
-]
-
-[[package]]
-name = "futures-macro"
-version = "0.3.33"
+name = "clap_derive"
+version = "4.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
+checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
 dependencies = [
+ "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.3",
 ]
 
 [[package]]
-name = "futures-sink"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"
-
-[[package]]
-name = "futures-task"
-version = "0.3.33"
+name = "clap_lex"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 
 [[package]]
-name = "futures-timer"
-version = "3.0.4"
+name = "colorchoice"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af43fadb8a98512d547e37b4e92e0ced13e205c061b87b4623eff01d918d6968"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
 [[package]]
-name = "futures-util"
-version = "0.3.33"
+name = "combine"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
-dependencies = [
- "futures-channel",
- "futures-core",
- "futures-io",
- "futures-macro",
- "futures-sink",
- "futures-task",
- "memchr",
- "pin-project-lite",
- "slab",
-]
-
-[[package]]
-name = "gatewayd"
-version = "0.3.0"
+checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
 dependencies = [
- "anyhow",
- "authz",
- "axum",
- "base64 0.22.1",
- "blake3",
  "bytes",
- "clap",
- "eventlog",
- "hex",
- "proto",
- "runtime",
- "serde_json",
- "thiserror 2.0.19",
- "tokio",
- "tracing",
- "tracing-subscriber",
+ "memchr",
 ]
 
 [[package]]
-name = "generic-array"
-version = "0.14.7"
+name = "const-oid"
+version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-dependencies = [
- "typenum",
- "version_check",
-]
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
 [[package]]
-name = "getrandom"
-version = "0.1.16"
+name = "constant_time_eq"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi 0.9.0+wasi-snapshot-preview1",
-]
+checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
 
 [[package]]
-name = "getrandom"
-version = "0.2.17"
+name = "core-foundation"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
 dependencies = [
- "cfg-if",
- "js-sys",
+ "core-foundation-sys",
  "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
- "wasm-bindgen",
 ]
 
 [[package]]
-name = "getrandom"
-version = "0.3.4"
+name = "core-foundation-sys"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
-dependencies = [
- "cfg-if",
- "libc",
- "r-efi 5.3.0",
- "wasip2",
-]
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
-name = "getrandom"
-version = "0.4.3"
+name = "cpufeatures"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
 dependencies = [
- "cfg-if",
- "js-sys",
  "libc",
- "r-efi 6.0.0",
- "rand_core 0.10.1",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "glob"
-version = "0.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
-
-[[package]]
-name = "h2"
-version = "0.3.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0beca50380b1fc32983fc1cb4587bfa4bb9e78fc259aad4a0032d2080309222d"
-dependencies = [
- "bytes",
- "fnv",
- "futures-core",
- "futures-sink",
- "futures-util",
- "http 0.2.12",
- "indexmap",
- "slab",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
-[[package]]
-name = "h2"
-version = "0.4.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
-dependencies = [
- "atomic-waker",
- "bytes",
- "fnv",
- "futures-core",
- "futures-sink",
- "http 1.5.0",
- "indexmap",
- "slab",
- "tokio",
- "tokio-util",
- "tracing",
 ]
 
 [[package]]
-name = "hashbrown"
-version = "0.14.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-
-[[package]]
-name = "hashbrown"
-version = "0.15.5"
+name = "cpufeatures"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
 dependencies = [
- "allocator-api2",
- "equivalent",
- "foldhash 0.1.5",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.17.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+ "libc",
+]
 
 [[package]]
-name = "hashlink"
-version = "0.10.0"
+name = "crypto-common"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
- "hashbrown 0.15.5",
+ "generic-array",
+ "typenum",
 ]
 
 [[package]]
-name = "heck"
-version = "0.5.0"
+name = "curve25519-dalek"
+version = "4.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "curve25519-dalek-derive",
+ "digest 0.10.7",
+ "fiat-crypto",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
 
 [[package]]
-name = "hermit-abi"
-version = "0.5.2"
+name = "curve25519-dalek-derive"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
 
 [[package]]
-name = "hex"
-version = "0.4.3"
+name = "data-encoding"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
 
 [[package]]
-name = "hkdf"
-version = "0.12.4"
+name = "der"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
- "hmac 0.12.1",
+ "const-oid",
+ "zeroize",
 ]
 
 [[package]]
-name = "hmac"
-version = "0.12.1"
+name = "der-parser"
+version = "10.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6"
 dependencies = [
- "digest 0.10.7",
+ "asn1-rs",
+ "displaydoc",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
 ]
 
 [[package]]
-name = "hmac"
-version = "0.13.0"
+name = "deranged"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
-dependencies = [
- "digest 0.11.3",
-]
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 
 [[package]]
-name = "home"
-version = "0.5.12"
+name = "digest"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
 dependencies = [
- "windows-sys 0.61.2",
+ "generic-array",
 ]
 
 [[package]]
-name = "http"
-version = "0.2.12"
+name = "digest"
+version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
- "bytes",
- "fnv",
- "itoa",
+ "block-buffer 0.10.4",
+ "crypto-common",
 ]
 
 [[package]]
-name = "http"
-version = "1.5.0"
+name = "displaydoc"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
 dependencies = [
- "bytes",
- "itoa",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
 ]
 
 [[package]]
-name = "http-body"
-version = "0.4.6"
+name = "ed25519"
+version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
- "bytes",
- "http 0.2.12",
- "pin-project-lite",
+ "pkcs8",
+ "signature",
 ]
 
 [[package]]
-name = "http-body"
-version = "1.1.0"
+name = "ed25519-dalek"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
 dependencies = [
- "bytes",
- "http 1.5.0",
+ "curve25519-dalek",
+ "ed25519",
+ "rand_core 0.6.4",
+ "serde",
+ "sha2 0.10.9",
+ "subtle",
+ "zeroize",
 ]
 
 [[package]]
-name = "http-body-util"
-version = "0.1.4"
+name = "either"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
-dependencies = [
- "bytes",
- "futures-core",
- "http 1.5.0",
- "http-body 1.1.0",
- "pin-project-lite",
-]
+checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
 
 [[package]]
-name = "httparse"
-version = "1.10.1"
+name = "equivalent"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
-name = "httpdate"
-version = "1.0.3"
+name = "errno"
+version = "0.3.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
 
 [[package]]
-name = "hub"
-version = "0.3.0"
+name = "fastbloom"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef975e30683b2d965054bb0a836f8973857c4ebf6acf274fe46617cd285060d8"
 dependencies = [
- "anyhow",
- "authz",
- "axum",
- "base64 0.22.1",
- "blake3",
- "bytes",
- "clap",
- "eventlog",
- "futures",
- "hex",
- "hyper 1.11.0",
- "hyper-util",
- "instant-acme",
- "object_store",
- "pgtest",
- "prost 0.13.5",
- "proto",
- "quinn",
- "rcgen",
- "runtime",
- "rustls 0.23.43",
- "rustls-pemfile",
- "serde",
- "serde_json",
- "sqlx",
- "statemachines",
- "store",
- "thiserror 2.0.19",
- "tokio",
- "tokio-rustls 0.26.4",
- "tokio-tungstenite",
- "tracing",
- "x509-parser",
+ "foldhash",
+ "libm",
+ "portable-atomic",
+ "siphasher",
 ]
 
 [[package]]
-name = "humantime"
-version = "2.4.0"
+name = "fastrand"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15cdd26707701c53297e2fa6afb323d55fbc1d0810c3aec078ae3ef0424c3c15"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
 
 [[package]]
-name = "hybrid-array"
-version = "0.4.14"
+name = "fiat-crypto"
+version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
-dependencies = [
- "typenum",
-]
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
 [[package]]
-name = "hyper"
-version = "0.14.32"
+name = "find-msvc-tools"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7"
-dependencies = [
- "bytes",
- "futures-channel",
- "futures-core",
- "futures-util",
- "h2 0.3.27",
- "http 0.2.12",
- "http-body 0.4.6",
- "httparse",
- "httpdate",
- "itoa",
- "pin-project-lite",
- "socket2 0.5.10",
- "tokio",
- "tower-service",
- "tracing",
- "want",
-]
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
 [[package]]
-name = "hyper"
-version = "1.11.0"
+name = "fixedbitset"
+version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72"
-dependencies = [
- "atomic-waker",
- "bytes",
- "futures-channel",
- "futures-core",
- "h2 0.4.15",
- "http 1.5.0",
- "http-body 1.1.0",
- "httparse",
- "httpdate",
- "itoa",
- "pin-project-lite",
- "smallvec",
- "tokio",
- "want",
-]
+checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
 
 [[package]]
-name = "hyper-rustls"
-version = "0.24.2"
+name = "fnv"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
-dependencies = [
- "futures-util",
- "http 0.2.12",
- "hyper 0.14.32",
- "log",
- "rustls 0.21.12",
- "tokio",
- "tokio-rustls 0.24.1",
-]
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
-name = "hyper-rustls"
-version = "0.27.9"
+name = "foldhash"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
-dependencies = [
- "http 1.5.0",
- "hyper 1.11.0",
- "hyper-util",
- "rustls 0.23.43",
- "rustls-native-certs",
- "rustls-platform-verifier",
- "tokio",
- "tokio-rustls 0.26.4",
- "tower-service",
-]
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
 [[package]]
-name = "hyper-util"
-version = "0.1.20"
+name = "futures"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+checksum = "a88cf1f829d945f548cf8fec32c61b1f202b6d93b45848602fc02af4b12ad218"
 dependencies = [
- "base64 0.22.1",
- "bytes",
  "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
  "futures-util",
- "http 1.5.0",
- "http-body 1.1.0",
- "hyper 1.11.0",
- "ipnet",
- "libc",
- "percent-encoding",
- "pin-project-lite",
- "socket2 0.6.5",
- "tokio",
- "tower-service",
- "tracing",
 ]
 
 [[package]]
-name = "iana-time-zone"
-version = "0.1.65"
+name = "futures-channel"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae"
 dependencies = [
- "android_system_properties",
- "core-foundation-sys",
- "iana-time-zone-haiku",
- "js-sys",
- "log",
- "wasm-bindgen",
- "windows-core",
+ "futures-core",
+ "futures-sink",
 ]
 
 [[package]]
-name = "iana-time-zone-haiku"
-version = "0.1.2"
+name = "futures-core"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
-dependencies = [
- "cc",
-]
+checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
 
 [[package]]
-name = "icu_collections"
-version = "2.2.0"
+name = "futures-executor"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458"
 dependencies = [
- "displaydoc",
- "potential_utf",
- "utf8_iter",
- "yoke",
- "zerofrom",
- "zerovec",
+ "futures-core",
+ "futures-task",
+ "futures-util",
 ]
 
 [[package]]
-name = "icu_locale_core"
-version = "2.2.0"
+name = "futures-io"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
 dependencies = [
- "displaydoc",
- "litemap",
- "tinystr",
- "writeable",
- "zerovec",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
 ]
 
 [[package]]
-name = "icu_normalizer"
-version = "2.2.0"
+name = "futures-sink"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
-dependencies = [
- "icu_collections",
- "icu_normalizer_data",
- "icu_properties",
- "icu_provider",
- "smallvec",
- "zerovec",
-]
+checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"
 
 [[package]]
-name = "icu_normalizer_data"
-version = "2.2.0"
+name = "futures-task"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
 
 [[package]]
-name = "icu_properties"
-version = "2.2.0"
+name = "futures-util"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
 dependencies = [
- "icu_collections",
- "icu_locale_core",
- "icu_properties_data",
- "icu_provider",
- "zerotrie",
- "zerovec",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
 ]
 
 [[package]]
-name = "icu_properties_data"
-version = "2.2.0"
+name = "generic-array"
+version = "0.14.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
 
 [[package]]
-name = "icu_provider"
-version = "2.2.0"
+name = "getrandom"
+version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
 dependencies = [
- "displaydoc",
- "icu_locale_core",
- "writeable",
- "yoke",
- "zerofrom",
- "zerotrie",
- "zerovec",
+ "cfg-if",
+ "libc",
+ "wasi 0.9.0+wasi-snapshot-preview1",
 ]
 
 [[package]]
-name = "id-set"
-version = "0.2.2"
+name = "getrandom"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9633fadf6346456cf8531119ba4838bc6d82ac4ce84d9852126dd2aa34d49264"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasm-bindgen",
+]
 
 [[package]]
-name = "ident_case"
-version = "1.0.1"
+name = "getrandom"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
 
 [[package]]
-name = "idna"
-version = "1.1.0"
+name = "getrandom"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
- "idna_adapter",
- "smallvec",
- "utf8_iter",
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 6.0.0",
+ "rand_core 0.10.1",
+ "wasm-bindgen",
 ]
 
 [[package]]
-name = "idna_adapter"
-version = "1.2.2"
+name = "hashbrown"
+version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
-dependencies = [
- "icu_normalizer",
- "icu_properties",
-]
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 
 [[package]]
-name = "indexmap"
-version = "2.14.0"
+name = "heck"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
-dependencies = [
- "equivalent",
- "hashbrown 0.17.1",
-]
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
-name = "inout"
-version = "0.1.4"
+name = "hex"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
-dependencies = [
- "generic-array",
-]
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
-name = "instant-acme"
-version = "0.8.5"
+name = "http"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f05ad37c421b962354c358d347d4a6130151df9407978372d3ad7f0c8f71a64"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
 dependencies = [
- "async-trait",
- "aws-lc-rs",
- "base64 0.22.1",
  "bytes",
- "http 1.5.0",
- "http-body 1.1.0",
- "http-body-util",
- "httpdate",
- "hyper 1.11.0",
- "hyper-rustls 0.27.9",
- "hyper-util",
- "rcgen",
- "rustls 0.23.43",
- "rustls-pki-types",
- "serde",
- "serde_json",
- "thiserror 2.0.19",
- "tokio",
+ "itoa",
 ]
 
 [[package]]
-name = "io-uring"
-version = "0.7.13"
+name = "httparse"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9080b15e63775b9a2ac7dca720f7050a8b955e092ea0f6020a4a80f69998cdc0"
-dependencies = [
- "bindgen",
- "bitflags",
- "cfg-if",
- "libc",
-]
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
 [[package]]
-name = "ipnet"
-version = "2.12.0"
+name = "indexmap"
+version = "2.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
 
 [[package]]
 name = "is_terminal_polyfill"
@@ -2486,15 +832,6 @@ dependencies = [
  "either",
 ]
 
-[[package]]
-name = "itertools"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
-dependencies = [
- "either",
-]
-
 [[package]]
 name = "itertools"
 version = "0.14.0"
@@ -2559,16 +896,6 @@ dependencies = [
  "syn 2.0.119",
 ]
 
-[[package]]
-name = "jobserver"
-version = "0.1.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
-dependencies = [
- "getrandom 0.4.3",
- "libc",
-]
-
 [[package]]
 name = "js-sys"
 version = "0.3.103"
@@ -2585,15 +912,6 @@ name = "lazy_static"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
-dependencies = [
- "spin",
-]
-
-[[package]]
-name = "lazycell"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libc"
@@ -2601,97 +919,18 @@ version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
-[[package]]
-name = "libloading"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
-dependencies = [
- "cfg-if",
- "windows-link",
-]
-
 [[package]]
 name = "libm"
 version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
-[[package]]
-name = "libredox"
-version = "0.1.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c943259e342f1e06ff2da7a83eabdfe7f92ce10262688dbf1895ff0b3e6e4652"
-dependencies = [
- "bitflags",
- "libc",
- "plain",
- "redox_syscall 0.9.1",
-]
-
-[[package]]
-name = "libsqlite3-sys"
-version = "0.30.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
-dependencies = [
- "pkg-config",
- "vcpkg",
-]
-
-[[package]]
-name = "libublk"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd0cc4f0d9771dc50a2807a495e80287911d1bf4871fad45663753692db7c432"
-dependencies = [
- "async-lock",
- "bitflags",
- "bitmaps",
- "derive_setters",
- "futures-timer",
- "io-uring",
- "libc",
- "libublk-rs-sys",
- "log",
- "serde",
- "serde_json",
- "slab",
- "smol",
- "thiserror 1.0.69",
-]
-
-[[package]]
-name = "libublk-rs-sys"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ab204ac509937ddb9ca815e642e204f8944bb98c8f0dd613a7c2567c774e593"
-dependencies = [
- "anyhow",
- "bindgen",
- "libc",
- "regex",
- "serde",
-]
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
-
 [[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
-[[package]]
-name = "litemap"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
-
 [[package]]
 name = "lock_api"
 version = "0.4.14"
@@ -2713,52 +952,12 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
 
-[[package]]
-name = "matchers"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
-dependencies = [
- "regex-automata",
-]
-
-[[package]]
-name = "matchit"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
-
-[[package]]
-name = "md-5"
-version = "0.10.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
-dependencies = [
- "cfg-if",
- "digest 0.10.7",
-]
-
 [[package]]
 name = "memchr"
 version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
-[[package]]
-name = "memoffset"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "mime"
-version = "0.3.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
-
 [[package]]
 name = "minimal-lexical"
 version = "0.2.1"
@@ -2766,111 +965,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
-name = "mio"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
-dependencies = [
- "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "mirrord"
-version = "0.3.0"
-dependencies = [
- "anyhow",
- "authz",
- "axum",
- "base64 0.22.1",
- "biscuit-auth",
- "blake3",
- "clap",
- "eventlog",
- "prost 0.13.5",
- "proto",
- "runtime",
- "serde",
- "serde_json",
- "thiserror 2.0.19",
- "tokio",
- "tracing",
- "tracing-subscriber",
-]
-
-[[package]]
-name = "multimap"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d87ecb2933e8aeadb3e3a02b828fed80a7528047e68b4f424523a0981a3a084"
-
-[[package]]
-name = "nix"
-version = "0.27.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
-dependencies = [
- "bitflags",
- "cfg-if",
- "libc",
-]
-
-[[package]]
-name = "nix"
-version = "0.31.3"
+name = "mio"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
 dependencies = [
- "bitflags",
- "cfg-if",
- "cfg_aliases",
  "libc",
- "memoffset",
-]
-
-[[package]]
-name = "noded"
-version = "0.3.0"
-dependencies = [
- "anyhow",
- "authz",
- "axum",
- "base64 0.22.1",
- "bytes",
- "clap",
- "controld",
- "eventlog",
- "hex",
- "hub",
- "nix 0.31.3",
- "prost 0.13.5",
- "proto",
- "quinn",
- "rand 0.8.7",
- "rcgen",
- "runtime",
- "rustls 0.23.43",
- "rustls-pemfile",
- "rustls-platform-verifier",
- "serde",
- "serde_json",
- "statemachines",
- "store",
- "tempfile",
- "thiserror 2.0.19",
- "tokio",
- "tokio-rustls 0.26.4",
- "tracing",
- "userfaultfd",
- "x509-parser",
+ "wasi 0.11.1+wasi-snapshot-preview1",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
-name = "nohash-hasher"
-version = "0.2.0"
+name = "multimap"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
+checksum = "1d87ecb2933e8aeadb3e3a02b828fed80a7528047e68b4f424523a0981a3a084"
 
 [[package]]
 name = "nom"
@@ -2882,15 +991,6 @@ dependencies = [
  "minimal-lexical",
 ]
 
-[[package]]
-name = "nu-ansi-term"
-version = "0.50.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
-dependencies = [
- "windows-sys 0.61.2",
-]
-
 [[package]]
 name = "num-bigint"
 version = "0.4.8"
@@ -2901,22 +1001,6 @@ dependencies = [
  "num-traits",
 ]
 
-[[package]]
-name = "num-bigint-dig"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
-dependencies = [
- "lazy_static",
- "libm",
- "num-integer",
- "num-iter",
- "num-traits",
- "rand 0.8.7",
- "smallvec",
- "zeroize",
-]
-
 [[package]]
 name = "num-conv"
 version = "0.2.2"
@@ -2932,16 +1016,6 @@ dependencies = [
  "num-traits",
 ]
 
-[[package]]
-name = "num-iter"
-version = "0.1.46"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c92800bd69a1eac91786bcfe9da64a897eb72911b8dc3095decbd07429e8048b"
-dependencies = [
- "num-integer",
- "num-traits",
-]
-
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -2949,37 +1023,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
  "autocfg",
- "libm",
-]
-
-[[package]]
-name = "object_store"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3cfccb68961a56facde1163f9319e0d15743352344e7808a11795fb99698dcaf"
-dependencies = [
- "async-trait",
- "base64 0.22.1",
- "bytes",
- "chrono",
- "futures",
- "humantime",
- "hyper 1.11.0",
- "itertools 0.13.0",
- "md-5",
- "parking_lot",
- "percent-encoding",
- "quick-xml",
- "rand 0.8.7",
- "reqwest",
- "ring",
- "serde",
- "serde_json",
- "snafu",
- "tokio",
- "tracing",
- "url",
- "walkdir",
 ]
 
 [[package]]
@@ -3015,18 +1058,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
-[[package]]
-name = "outref"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a80800c0488c3a21695ea981a54918fbb37abf04f4d0720c453632255e2ff0e"
-
-[[package]]
-name = "parking"
-version = "2.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
-
 [[package]]
 name = "parking_lot"
 version = "0.12.5"
@@ -3045,7 +1076,7 @@ checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.5.18",
+ "redox_syscall",
  "smallvec",
  "windows-link",
 ]
@@ -3060,21 +1091,6 @@ dependencies = [
  "serde_core",
 ]
 
-[[package]]
-name = "pem-rfc7468"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
-dependencies = [
- "base64ct",
-]
-
-[[package]]
-name = "percent-encoding"
-version = "2.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
-
 [[package]]
 name = "petgraph"
 version = "0.7.1"
@@ -3085,44 +1101,12 @@ dependencies = [
  "indexmap",
 ]
 
-[[package]]
-name = "pgtest"
-version = "0.3.0"
-
 [[package]]
 name = "pin-project-lite"
 version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
-[[package]]
-name = "pin-utils"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
-
-[[package]]
-name = "piper"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c835479a4443ded371d6c535cbfd8d31ad92c5d23ae9770a61bc155e4992a3c1"
-dependencies = [
- "atomic-waker",
- "fastrand",
- "futures-io",
-]
-
-[[package]]
-name = "pkcs1"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
-dependencies = [
- "der",
- "pkcs8",
- "spki",
-]
-
 [[package]]
 name = "pkcs8"
 version = "0.10.2"
@@ -3133,58 +1117,12 @@ dependencies = [
  "spki",
 ]
 
-[[package]]
-name = "pkg-config"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
-
-[[package]]
-name = "plain"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
-
-[[package]]
-name = "polling"
-version = "3.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d0e4f59085d47d8241c88ead0f274e8a0cb551f3625263c05eb8dd897c34218"
-dependencies = [
- "cfg-if",
- "concurrent-queue",
- "hermit-abi",
- "pin-project-lite",
- "rustix 1.1.4",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "poly1305"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
-dependencies = [
- "cpufeatures 0.2.17",
- "opaque-debug",
- "universal-hash",
-]
-
 [[package]]
 name = "portable-atomic"
 version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3"
 
-[[package]]
-name = "potential_utf"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
-dependencies = [
- "zerovec",
-]
-
 [[package]]
 name = "powerfmt"
 version = "0.2.0"
@@ -3364,16 +1302,6 @@ version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
 
-[[package]]
-name = "quick-xml"
-version = "0.37.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "331e97a1af0bf59823e6eadffe373d7b27f485be8748f71471c662c1f269b7fb"
-dependencies = [
- "memchr",
- "serde",
-]
-
 [[package]]
 name = "quinn"
 version = "0.11.11"
@@ -3385,9 +1313,9 @@ dependencies = [
  "pin-project-lite",
  "quinn-proto",
  "quinn-udp",
- "rustc-hash 2.1.3",
- "rustls 0.23.43",
- "socket2 0.6.5",
+ "rustc-hash",
+ "rustls",
+ "socket2",
  "thiserror 2.0.19",
  "tokio",
  "tracing",
@@ -3407,8 +1335,8 @@ dependencies = [
  "rand 0.10.2",
  "rand_pcg",
  "ring",
- "rustc-hash 2.1.3",
- "rustls 0.23.43",
+ "rustc-hash",
+ "rustls",
  "rustls-pki-types",
  "rustls-platform-verifier",
  "slab",
@@ -3427,7 +1355,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.6.5",
+ "socket2",
  "tracing",
  "windows-sys 0.61.2",
 ]
@@ -3480,7 +1408,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
- "chacha20 0.10.1",
+ "chacha20",
  "getrandom 0.4.3",
  "rand_core 0.10.1",
 ]
@@ -3529,16 +1457,6 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 
-[[package]]
-name = "rand_distr"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32cb0b9bc82b0a0876c2dd994a7e7a2683d3e7390ca40e6886785ef0c7e3ee31"
-dependencies = [
- "num-traits",
- "rand 0.8.7",
-]
-
 [[package]]
 name = "rand_pcg"
 version = "0.10.2"
@@ -3563,7 +1481,6 @@ version = "0.14.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "57f6d249aad744e274e682777a50283a225a32705394ee6d5fcc01efa25e4055"
 dependencies = [
- "aws-lc-rs",
  "pem",
  "ring",
  "rustls-pki-types",
@@ -3584,24 +1501,19 @@ dependencies = [
  "bytes",
  "clap",
  "clap_complete",
- "controld",
- "eventlog",
  "futures",
- "hub",
  "prost 0.13.5",
  "proto",
  "quinn",
  "rcgen",
- "runtime",
- "rustls 0.23.43",
+ "rustls",
  "rustls-pemfile",
  "rustls-platform-verifier",
  "serde",
  "serde_json",
- "store",
  "thiserror 2.0.19",
  "tokio",
- "tokio-rustls 0.26.4",
+ "tokio-rustls",
  "tokio-tungstenite",
  "tracing",
 ]
@@ -3615,15 +1527,6 @@ dependencies = [
  "bitflags",
 ]
 
-[[package]]
-name = "redox_syscall"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07507be7b4a5f9f26eeb41eeaebb1f5a7ff29dfb29739facc21d35bf8b11c21e"
-dependencies = [
- "bitflags",
-]
-
 [[package]]
 name = "regex"
 version = "1.13.1"
@@ -3647,60 +1550,12 @@ dependencies = [
  "regex-syntax",
 ]
 
-[[package]]
-name = "regex-lite"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cab834c73d247e67f4fae452806d17d3c7501756d98c8808d7c9c7aa7d18f973"
-
 [[package]]
 name = "regex-syntax"
 version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
-[[package]]
-name = "reqwest"
-version = "0.12.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
-dependencies = [
- "base64 0.22.1",
- "bytes",
- "futures-core",
- "futures-util",
- "h2 0.4.15",
- "http 1.5.0",
- "http-body 1.1.0",
- "http-body-util",
- "hyper 1.11.0",
- "hyper-rustls 0.27.9",
- "hyper-util",
- "js-sys",
- "log",
- "percent-encoding",
- "pin-project-lite",
- "quinn",
- "rustls 0.23.43",
- "rustls-native-certs",
- "rustls-pki-types",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper",
- "tokio",
- "tokio-rustls 0.26.4",
- "tokio-util",
- "tower",
- "tower-http",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "wasm-streams",
- "web-sys",
-]
-
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -3711,45 +1566,10 @@ dependencies = [
  "cfg-if",
  "getrandom 0.2.17",
  "libc",
- "untrusted 0.9.0",
+ "untrusted",
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "rsa"
-version = "0.9.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
-dependencies = [
- "const-oid 0.9.6",
- "digest 0.10.7",
- "num-bigint-dig",
- "num-integer",
- "num-traits",
- "pkcs1",
- "pkcs8",
- "rand_core 0.6.4",
- "signature",
- "spki",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "runtime"
-version = "0.3.0"
-dependencies = [
- "thiserror 2.0.19",
- "tracing",
- "tracing-subscriber",
-]
-
-[[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
 [[package]]
 name = "rustc-hash"
 version = "2.1.3"
@@ -3774,19 +1594,6 @@ dependencies = [
  "nom",
 ]
 
-[[package]]
-name = "rustix"
-version = "0.38.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
-dependencies = [
- "bitflags",
- "errno",
- "libc",
- "linux-raw-sys 0.4.15",
- "windows-sys 0.52.0",
-]
-
 [[package]]
 name = "rustix"
 version = "1.1.4"
@@ -3796,33 +1603,20 @@ dependencies = [
  "bitflags",
  "errno",
  "libc",
- "linux-raw-sys 0.12.1",
+ "linux-raw-sys",
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "rustls"
-version = "0.21.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
-dependencies = [
- "log",
- "ring",
- "rustls-webpki 0.101.7",
- "sct",
-]
-
 [[package]]
 name = "rustls"
 version = "0.23.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
 dependencies = [
- "aws-lc-rs",
  "once_cell",
  "ring",
  "rustls-pki-types",
- "rustls-webpki 0.103.13",
+ "rustls-webpki",
  "subtle",
  "zeroize",
 ]
@@ -3869,10 +1663,10 @@ dependencies = [
  "jni",
  "log",
  "once_cell",
- "rustls 0.23.43",
+ "rustls",
  "rustls-native-certs",
  "rustls-platform-verifier-android",
- "rustls-webpki 0.103.13",
+ "rustls-webpki",
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
@@ -3885,26 +1679,15 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
-[[package]]
-name = "rustls-webpki"
-version = "0.101.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
-dependencies = [
- "ring",
- "untrusted 0.9.0",
-]
-
 [[package]]
 name = "rustls-webpki"
 version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
- "aws-lc-rs",
  "ring",
  "rustls-pki-types",
- "untrusted 0.9.0",
+ "untrusted",
 ]
 
 [[package]]
@@ -3925,12 +1708,6 @@ dependencies = [
  "wait-timeout",
 ]
 
-[[package]]
-name = "ryu"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
-
 [[package]]
 name = "same-file"
 version = "1.0.6"
@@ -3949,27 +1726,11 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "scoped-tls"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
-
 [[package]]
 name = "scopeguard"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
-
-[[package]]
-name = "sct"
-version = "0.7.1"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
-dependencies = [
- "ring",
- "untrusted 0.9.0",
-]
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "security-framework"
@@ -4043,29 +1804,6 @@ dependencies = [
  "zmij",
 ]
 
-[[package]]
-name = "serde_path_to_error"
-version = "0.1.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
-dependencies = [
- "itoa",
- "serde",
- "serde_core",
-]
-
-[[package]]
-name = "serde_urlencoded"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
-dependencies = [
- "form_urlencoded",
- "itoa",
- "ryu",
- "serde",
-]
-
 [[package]]
 name = "sha1"
 version = "0.10.7"
@@ -4101,32 +1839,6 @@ dependencies = [
  "digest 0.10.7",
 ]
 
-[[package]]
-name = "sha2"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.0",
- "digest 0.11.3",
-]
-
-[[package]]
-name = "sharded-slab"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
-dependencies = [
- "lazy_static",
-]
-
-[[package]]
-name = "shlex"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
-
 [[package]]
 name = "shlex"
 version = "2.0.1"
@@ -4147,414 +1859,63 @@ dependencies = [
 name = "signature"
 version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
-dependencies = [
- "digest 0.10.7",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "sim"
-version = "0.3.0"
-dependencies = [
- "anyhow",
- "authz",
- "base64 0.22.1",
- "bytes",
- "cas",
- "eventlog",
- "futures",
- "hex",
- "percent-encoding",
- "proptest",
- "prost 0.13.5",
- "proto",
- "rand 0.8.7",
- "rand_chacha 0.3.1",
- "statemachines",
- "stateright",
- "store",
- "tokio",
- "tracing",
- "turmoil",
-]
-
-[[package]]
-name = "simd_cesu8"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
-dependencies = [
- "rustc_version",
- "simdutf8",
-]
-
-[[package]]
-name = "simdutf8"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
-
-[[package]]
-name = "siphasher"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
-
-[[package]]
-name = "slab"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
-
-[[package]]
-name = "smallvec"
-version = "1.15.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "smol"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a33bd3e260892199c3ccfc487c88b2da2265080acb316cd920da72fdfd7c599f"
-dependencies = [
- "async-channel",
- "async-executor",
- "async-fs",
- "async-io",
- "async-lock",
- "async-net",
- "async-process",
- "blocking",
- "futures-lite",
-]
-
-[[package]]
-name = "snafu"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e84b3f4eacbf3a1ce05eac6763b4d629d60cbc94d632e4092c54ade71f1e1a2"
-dependencies = [
- "snafu-derive",
-]
-
-[[package]]
-name = "snafu-derive"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "socket2"
-version = "0.5.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
-dependencies = [
- "libc",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "socket2"
-version = "0.6.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
-dependencies = [
- "libc",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "spin"
-version = "0.9.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
-dependencies = [
- "lock_api",
-]
-
-[[package]]
-name = "spki"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
-dependencies = [
- "base64ct",
- "der",
-]
-
-[[package]]
-name = "sqlx"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fefb893899429669dcdd979aff487bd78f4064e5e7907e4269081e0ef7d97dc"
-dependencies = [
- "sqlx-core",
- "sqlx-macros",
- "sqlx-mysql",
- "sqlx-postgres",
- "sqlx-sqlite",
-]
-
-[[package]]
-name = "sqlx-core"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee6798b1838b6a0f69c007c133b8df5866302197e404e8b6ee8ed3e3a5e68dc6"
-dependencies = [
- "base64 0.22.1",
- "bytes",
- "chrono",
- "crc",
- "crossbeam-queue",
- "either",
- "event-listener",
- "futures-core",
- "futures-intrusive",
- "futures-io",
- "futures-util",
- "hashbrown 0.15.5",
- "hashlink",
- "indexmap",
- "log",
- "memchr",
- "once_cell",
- "percent-encoding",
- "rustls 0.23.43",
- "serde",
- "serde_json",
- "sha2 0.10.9",
- "smallvec",
- "thiserror 2.0.19",
- "tokio",
- "tokio-stream",
- "tracing",
- "url",
- "webpki-roots 0.26.11",
-]
-
-[[package]]
-name = "sqlx-macros"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2d452988ccaacfbf5e0bdbc348fb91d7c8af5bee192173ac3636b5fb6e6715d"
-dependencies = [
- "proc-macro2",
- "quote",
- "sqlx-core",
- "sqlx-macros-core",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "sqlx-macros-core"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19a9c1841124ac5a61741f96e1d9e2ec77424bf323962dd894bdb93f37d5219b"
-dependencies = [
- "dotenvy",
- "either",
- "heck",
- "hex",
- "once_cell",
- "proc-macro2",
- "quote",
- "serde",
- "serde_json",
- "sha2 0.10.9",
- "sqlx-core",
- "sqlx-mysql",
- "sqlx-postgres",
- "sqlx-sqlite",
- "syn 2.0.119",
- "tokio",
- "url",
-]
-
-[[package]]
-name = "sqlx-mysql"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa003f0038df784eb8fecbbac13affe3da23b45194bd57dba231c8f48199c526"
-dependencies = [
- "atoi",
- "base64 0.22.1",
- "bitflags",
- "byteorder",
- "bytes",
- "chrono",
- "crc",
- "digest 0.10.7",
- "dotenvy",
- "either",
- "futures-channel",
- "futures-core",
- "futures-io",
- "futures-util",
- "generic-array",
- "hex",
- "hkdf",
- "hmac 0.12.1",
- "itoa",
- "log",
- "md-5",
- "memchr",
- "once_cell",
- "percent-encoding",
- "rand 0.8.7",
- "rsa",
- "serde",
- "sha1",
- "sha2 0.10.9",
- "smallvec",
- "sqlx-core",
- "stringprep",
- "thiserror 2.0.19",
- "tracing",
- "whoami",
-]
-
-[[package]]
-name = "sqlx-postgres"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db58fcd5a53cf07c184b154801ff91347e4c30d17a3562a635ff028ad5deda46"
-dependencies = [
- "atoi",
- "base64 0.22.1",
- "bitflags",
- "byteorder",
- "chrono",
- "crc",
- "dotenvy",
- "etcetera",
- "futures-channel",
- "futures-core",
- "futures-util",
- "hex",
- "hkdf",
- "hmac 0.12.1",
- "home",
- "itoa",
- "log",
- "md-5",
- "memchr",
- "once_cell",
- "rand 0.8.7",
- "serde",
- "serde_json",
- "sha2 0.10.9",
- "smallvec",
- "sqlx-core",
- "stringprep",
- "thiserror 2.0.19",
- "tracing",
- "whoami",
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "rand_core 0.6.4",
 ]
 
 [[package]]
-name = "sqlx-sqlite"
-version = "0.8.6"
+name = "simd_cesu8"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2d12fe70b2c1b4401038055f90f151b78208de1f9f89a7dbfd41587a10c3eea"
+checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
 dependencies = [
- "atoi",
- "chrono",
- "flume",
- "futures-channel",
- "futures-core",
- "futures-executor",
- "futures-intrusive",
- "futures-util",
- "libsqlite3-sys",
- "log",
- "percent-encoding",
- "serde",
- "serde_urlencoded",
- "sqlx-core",
- "thiserror 2.0.19",
- "tracing",
- "url",
+ "rustc_version",
+ "simdutf8",
 ]
 
 [[package]]
-name = "stable_deref_trait"
-version = "1.2.1"
+name = "simdutf8"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
 
 [[package]]
-name = "statemachines"
-version = "0.3.0"
-dependencies = [
- "proptest",
- "serde",
- "serde_json",
- "thiserror 2.0.19",
-]
+name = "siphasher"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
-name = "stateright"
-version = "0.31.0"
+name = "smallvec"
+version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd1157f21b11916f90fe1f2ac9a8d0e09a8813b28701584141060f414eedf6ba"
-dependencies = [
- "ahash",
- "choice",
- "crossbeam-utils",
- "dashmap",
- "id-set",
- "log",
- "nohash-hasher",
- "parking_lot",
- "rand 0.9.5",
- "serde",
- "serde_json",
- "tiny_http",
-]
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
 
 [[package]]
-name = "store"
-version = "0.3.0"
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
- "aws-credential-types",
- "aws-sdk-kms",
- "aws-types",
- "base64 0.22.1",
- "blake3",
- "bytes",
- "cas",
- "chacha20poly1305",
- "eventlog",
- "futures",
- "hex",
- "object_store",
- "proto",
- "serde",
- "serde_json",
- "thiserror 2.0.19",
- "tokio",
+ "libc",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
-name = "stringprep"
-version = "0.1.5"
+name = "spki"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
- "unicode-bidi",
- "unicode-normalization",
- "unicode-properties",
+ "base64ct",
+ "der",
 ]
 
 [[package]]
@@ -4602,15 +1963,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "sync_wrapper"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
-dependencies = [
- "futures-core",
-]
-
 [[package]]
 name = "synstructure"
 version = "0.13.2"
@@ -4631,7 +1983,7 @@ dependencies = [
  "fastrand",
  "getrandom 0.4.3",
  "once_cell",
- "rustix 1.1.4",
+ "rustix",
  "windows-sys 0.61.2",
 ]
 
@@ -4675,15 +2027,6 @@ dependencies = [
  "syn 3.0.3",
 ]
 
-[[package]]
-name = "thread_local"
-version = "1.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
-dependencies = [
- "cfg-if",
-]
-
 [[package]]
 name = "time"
 version = "0.3.54"
@@ -4714,28 +2057,6 @@ dependencies = [
  "time-core",
 ]
 
-[[package]]
-name = "tiny_http"
-version = "0.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "389915df6413a2e74fb181895f933386023c71110878cd0825588928e64cdc82"
-dependencies = [
- "ascii",
- "chunked_transfer",
- "httpdate",
- "log",
-]
-
-[[package]]
-name = "tinystr"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
-dependencies = [
- "displaydoc",
- "zerovec",
-]
-
 [[package]]
 name = "tinyvec"
 version = "1.12.0"
@@ -4763,7 +2084,7 @@ dependencies = [
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.6.5",
+ "socket2",
  "tokio-macros",
  "windows-sys 0.61.2",
 ]
@@ -4779,34 +2100,13 @@ dependencies = [
  "syn 3.0.3",
 ]
 
-[[package]]
-name = "tokio-rustls"
-version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
-dependencies = [
- "rustls 0.21.12",
- "tokio",
-]
-
 [[package]]
 name = "tokio-rustls"
 version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
 dependencies = [
- "rustls 0.23.43",
- "tokio",
-]
-
-[[package]]
-name = "tokio-stream"
-version = "0.1.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b"
-dependencies = [
- "futures-core",
- "pin-project-lite",
+ "rustls",
  "tokio",
 ]
 
@@ -4818,87 +2118,14 @@ checksum = "edc5f74e248dc973e0dbb7b74c7e0d6fcc301c694ff50049504004ef4d0cdcd9"
 dependencies = [
  "futures-util",
  "log",
- "rustls 0.23.43",
+ "rustls",
  "rustls-pki-types",
  "tokio",
- "tokio-rustls 0.26.4",
+ "tokio-rustls",
  "tungstenite",
  "webpki-roots 0.26.11",
 ]
 
-[[package]]
-name = "tokio-util"
-version = "0.7.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
-dependencies = [
- "bytes",
- "futures-core",
- "futures-sink",
- "libc",
- "pin-project-lite",
- "tokio",
-]
-
-[[package]]
-name = "tokio-vsock"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b319ef9394889dab2e1b4f0085b45ba11d0c79dc9d1a9d1afc057d009d0f1c7"
-dependencies = [
- "bytes",
- "futures",
- "libc",
- "tokio",
- "vsock",
-]
-
-[[package]]
-name = "tower"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
-dependencies = [
- "futures-core",
- "futures-util",
- "pin-project-lite",
- "sync_wrapper",
- "tokio",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "tower-http"
-version = "0.6.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
-dependencies = [
- "bitflags",
- "bytes",
- "futures-util",
- "http 1.5.0",
- "http-body 1.1.0",
- "pin-project-lite",
- "tower",
- "tower-layer",
- "tower-service",
- "url",
-]
-
-[[package]]
-name = "tower-layer"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
-
-[[package]]
-name = "tower-service"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
-
 [[package]]
 name = "tracing"
 version = "0.1.44"
@@ -4929,44 +2156,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
 dependencies = [
  "once_cell",
- "valuable",
-]
-
-[[package]]
-name = "tracing-log"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
-dependencies = [
- "log",
- "once_cell",
- "tracing-core",
-]
-
-[[package]]
-name = "tracing-subscriber"
-version = "0.3.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
-dependencies = [
- "matchers",
- "nu-ansi-term",
- "once_cell",
- "regex-automata",
- "sharded-slab",
- "smallvec",
- "thread_local",
- "tracing",
- "tracing-core",
- "tracing-log",
 ]
 
-[[package]]
-name = "try-lock"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
-
 [[package]]
 name = "tungstenite"
 version = "0.24.0"
@@ -4976,175 +2167,52 @@ dependencies = [
  "byteorder",
  "bytes",
  "data-encoding",
- "http 1.5.0",
+ "http",
  "httparse",
  "log",
  "rand 0.8.7",
- "rustls 0.23.43",
+ "rustls",
  "rustls-pki-types",
  "sha1",
  "thiserror 1.0.69",
- "utf-8",
-]
-
-[[package]]
-name = "turmoil"
-version = "0.6.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f0d6c134ef37268c94d50fb74252af1c34c5c88389e2c1af85654da944ceb52"
-dependencies = [
- "bytes",
- "indexmap",
- "rand 0.8.7",
- "rand_distr",
- "scoped-tls",
- "tokio",
- "tracing",
-]
-
-[[package]]
-name = "typenum"
-version = "1.20.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
-
-[[package]]
-name = "unarray"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
-
-[[package]]
-name = "unicode-bidi"
-version = "0.3.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
-
-[[package]]
-name = "unicode-normalization"
-version = "0.1.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
-dependencies = [
- "tinyvec",
-]
-
-[[package]]
-name = "unicode-properties"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
-
-[[package]]
-name = "universal-hash"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
-dependencies = [
- "crypto-common 0.1.7",
- "subtle",
-]
-
-[[package]]
-name = "untrusted"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
-
-[[package]]
-name = "untrusted"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
-
-[[package]]
-name = "url"
-version = "2.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
-dependencies = [
- "form_urlencoded",
- "idna",
- "percent-encoding",
- "serde",
-]
-
-[[package]]
-name = "urlencoding"
-version = "2.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
-
-[[package]]
-name = "userfaultfd"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b3a8a0cb358f7d1b7ee9b6784be122b6f51248a6d9e214d555beb9b44c72aea"
-dependencies = [
- "bitflags",
- "cfg-if",
- "libc",
- "nix 0.27.1",
- "thiserror 1.0.69",
- "userfaultfd-sys",
-]
-
-[[package]]
-name = "userfaultfd-sys"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc91d95a797a81604af22946d0e86656f27feb0b9665c60665cf3554df12d1a8"
-dependencies = [
- "bindgen",
- "cc",
- "cfg-if",
+ "utf-8",
 ]
 
 [[package]]
-name = "utf-8"
-version = "0.7.6"
+name = "typenum"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
 [[package]]
-name = "utf8_iter"
-version = "1.0.4"
+name = "unarray"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
 
 [[package]]
-name = "utf8parse"
-version = "0.2.2"
+name = "unicode-ident"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
-name = "uuid"
-version = "1.24.0"
+name = "untrusted"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
-name = "valuable"
-version = "0.1.1"
+name = "utf-8"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
 
 [[package]]
-name = "vcpkg"
-version = "0.2.15"
+name = "utf8parse"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "version_check"
@@ -5152,22 +2220,6 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
-[[package]]
-name = "vsimd"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64"
-
-[[package]]
-name = "vsock"
-version = "0.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba782755fc073877e567c2253c0be48e4aa9a254c232d36d3985dfae0bd5205"
-dependencies = [
- "libc",
- "nix 0.31.3",
-]
-
 [[package]]
 name = "wait-timeout"
 version = "0.2.1"
@@ -5187,15 +2239,6 @@ dependencies = [
  "winapi-util",
 ]
 
-[[package]]
-name = "want"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
-dependencies = [
- "try-lock",
-]
-
 [[package]]
 name = "wasi"
 version = "0.9.0+wasi-snapshot-preview1"
@@ -5217,12 +2260,6 @@ dependencies = [
  "wit-bindgen",
 ]
 
-[[package]]
-name = "wasite"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
-
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.126"
@@ -5236,16 +2273,6 @@ dependencies = [
  "wasm-bindgen-shared",
 ]
 
-[[package]]
-name = "wasm-bindgen-futures"
-version = "0.4.76"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
 [[package]]
 name = "wasm-bindgen-macro"
 version = "0.2.126"
@@ -5278,29 +2305,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "wasm-streams"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
-dependencies = [
- "futures-util",
- "js-sys",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
-]
-
-[[package]]
-name = "web-sys"
-version = "0.3.103"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
 [[package]]
 name = "web-time"
 version = "1.1.0"
@@ -5338,28 +2342,6 @@ dependencies = [
  "rustls-pki-types",
 ]
 
-[[package]]
-name = "which"
-version = "4.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
-dependencies = [
- "either",
- "home",
- "once_cell",
- "rustix 0.38.44",
-]
-
-[[package]]
-name = "whoami"
-version = "1.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
-dependencies = [
- "libredox",
- "wasite",
-]
-
 [[package]]
 name = "winapi-util"
 version = "0.1.11"
@@ -5369,81 +2351,19 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "windows-core"
-version = "0.62.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
-dependencies = [
- "windows-implement",
- "windows-interface",
- "windows-link",
- "windows-result",
- "windows-strings",
-]
-
-[[package]]
-name = "windows-implement"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "windows-interface"
-version = "0.59.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "windows-link"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
-[[package]]
-name = "windows-result"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-strings"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
-dependencies = [
- "windows-targets 0.48.5",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
@@ -5455,67 +2375,34 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
-dependencies = [
- "windows_aarch64_gnullvm 0.48.5",
- "windows_aarch64_msvc 0.48.5",
- "windows_i686_gnu 0.48.5",
- "windows_i686_msvc 0.48.5",
- "windows_x86_64_gnu 0.48.5",
- "windows_x86_64_gnullvm 0.48.5",
- "windows_x86_64_msvc 0.48.5",
-]
-
 [[package]]
 name = "windows-targets"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
  "windows_i686_gnullvm",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
-
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
@@ -5528,48 +2415,24 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
@@ -5582,34 +2445,6 @@ version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
-[[package]]
-name = "workspaced"
-version = "0.3.0"
-dependencies = [
- "anyhow",
- "base64 0.22.1",
- "blake3",
- "clap",
- "eventlog",
- "hex",
- "nix 0.31.3",
- "prost 0.13.5",
- "proto",
- "runtime",
- "serde",
- "serde_json",
- "thiserror 2.0.19",
- "tokio",
- "tokio-vsock",
- "tracing",
-]
-
-[[package]]
-name = "writeable"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
-
 [[package]]
 name = "x509-parser"
 version = "0.18.1"
@@ -5617,7 +2452,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d43b0f71ce057da06bc0851b23ee24f3f86190b07203dd8f567d0b706a185202"
 dependencies = [
  "asn1-rs",
- "aws-lc-rs",
  "data-encoding",
  "der-parser",
  "lazy_static",
@@ -5629,12 +2463,6 @@ dependencies = [
  "time",
 ]
 
-[[package]]
-name = "xmlparser"
-version = "0.13.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66fee0b777b0f5ac1c69bb06d361268faafa61cd4682ae064a171c16c433e9e4"
-
 [[package]]
 name = "yasna"
 version = "0.6.0"
@@ -5645,29 +2473,6 @@ dependencies = [
  "time",
 ]
 
-[[package]]
-name = "yoke"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
-dependencies = [
- "stable_deref_trait",
- "yoke-derive",
- "zerofrom",
-]
-
-[[package]]
-name = "yoke-derive"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
- "synstructure",
-]
-
 [[package]]
 name = "zerocopy"
 version = "0.8.55"
@@ -5688,96 +2493,14 @@ dependencies = [
  "syn 2.0.119",
 ]
 
-[[package]]
-name = "zerofrom"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
-dependencies = [
- "zerofrom-derive",
-]
-
-[[package]]
-name = "zerofrom-derive"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
- "synstructure",
-]
-
 [[package]]
 name = "zeroize"
 version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 
-[[package]]
-name = "zerotrie"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
-dependencies = [
- "displaydoc",
- "yoke",
- "zerofrom",
-]
-
-[[package]]
-name = "zerovec"
-version = "0.11.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
-dependencies = [
- "yoke",
- "zerofrom",
- "zerovec-derive",
-]
-
-[[package]]
-name = "zerovec-derive"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "zmij"
 version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
-
-[[package]]
-name = "zstd"
-version = "0.13.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
-dependencies = [
- "zstd-safe",
-]
-
-[[package]]
-name = "zstd-safe"
-version = "7.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
-dependencies = [
- "zstd-sys",
-]
-
-[[package]]
-name = "zstd-sys"
-version = "2.0.16+zstd.1.5.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
-dependencies = [
- "cc",
- "pkg-config",
-]
diff --git a/README.md b/README.md
index 9965bb4..f3c8dcc 100644
--- a/README.md
+++ b/README.md
@@ -11,17 +11,27 @@ With Homebrew on Apple silicon macOS or x86_64/arm64 Linux:
 brew install reachpad/tap/reachpad
 ```
 
+With npm, anywhere Node 18+ runs:
+
+```sh
+npm install -g @reachpad/cli
+```
+
 Or with the checksum-verifying installer:
 
 ```sh
 curl -fsSL https://reachpad.dev/install | sh
 ```
 
-Linux x86_64/arm64 (musl, static) and macOS arm64. The script fetches the
-latest release from this repository, verifies its checksum against
+Linux x86_64/arm64 (musl, static) and macOS arm64/x86_64. The script fetches
+the latest release from this repository, verifies its checksum against
 SHA256SUMS, and installs to `~/.local/bin/reachpad` (override with
 `REACHPAD_INSTALL_DIR`).
 
+All three deliver the same binary. `@reachpad/cli` is a launcher around it, not
+a second implementation — see [`npm/README.md`](npm/README.md), which also
+explains the macOS quarantine problem npm sidesteps.
+
 ## Get started
 
 Run Reachpad:
@@ -60,8 +70,10 @@ reachpad completions fish
 ```
 
 `reachpad update` respects how Reachpad was installed: Homebrew installs are
-directed to `brew upgrade reachpad`, while installer-managed binaries
-are updated in place after the release checksum is verified.
+directed to `brew upgrade reachpad` and npm installs to `npm install -g
+@reachpad/cli@latest`, while installer-managed binaries are updated in place
+after the release checksum is verified. Whoever installed the binary owns it —
+a second writer is how a working install becomes a broken one.
 
 Docs: [reachpad.dev/docs/cli](https://reachpad.dev/docs/cli)
 
diff --git a/greentree.yaml b/greentree.yaml
index 0ea417f..7ff281a 100644
--- a/greentree.yaml
+++ b/greentree.yaml
@@ -12,3 +12,12 @@ checks:
     run: shellcheck install.sh && sh -n install.sh
     required_for_publish: true
     watch: false
+  # The npm distribution. No build and no network: it checks that the four
+  # descriptions of the same platform list still agree (release.yml's matrix,
+  # npm/prepare.mjs, the launcher's lookup table, and @reachpad/cli's optional
+  # dependencies), and runs the launcher as a real child process for the three
+  # things a wrapper can silently break — exit codes, signals, and the tty.
+  npm:
+    run: node --test npm/test/*.test.mjs
+    required_for_publish: true
+    watch: false
diff --git a/npm/README.md b/npm/README.md
new file mode 100644
index 0000000..2e057a6
--- /dev/null
+++ b/npm/README.md
@@ -0,0 +1,85 @@
+# The npm distribution
+
+Five packages, published by `.github/workflows/release.yml` on every `cli-v*`
+tag, carrying the same binaries as the GitHub release:
+
+| Directory | Package | Contents |
+| --- | --- | --- |
+| `cli/` | `@reachpad/cli` | the `reachpad` launcher, and the only one anybody installs |
+| `darwin-arm64/` | `@reachpad/cli-darwin-arm64` | `bin/reachpad` for `aarch64-apple-darwin` |
+| `darwin-x64/` | `@reachpad/cli-darwin-x64` | `bin/reachpad` for `x86_64-apple-darwin` |
+| `linux-x64/` | `@reachpad/cli-linux-x64` | `bin/reachpad` for `x86_64-unknown-linux-musl` |
+| `linux-arm64/` | `@reachpad/cli-linux-arm64` | `bin/reachpad` for `aarch64-unknown-linux-musl` |
+
+## Why this exists
+
+**Gatekeeper.** Release binaries are ad-hoc signed by the linker, not
+Developer ID signed and notarized. Ad-hoc is enough to *execute* on Apple
+silicon, so the curl installer and the Homebrew formula both work. It is not
+enough for anything that stamps `com.apple.quarantine` — a browser download
+from the releases page hits "Apple could not verify reachpad is free of
+malware", and so did the Homebrew *cask* we shipped until 2026-08-13, because
+casks quarantine everything they stage. npm never sets that attribute.
+
+The durable fix is notarization, and `release.yml` has the step waiting behind
+six repository secrets. This directory is the fix that needed no Apple account.
+
+**Node is already installed** on machines that run coding agents, and
+`npx @reachpad/cli` needs no install at all.
+
+## Parity
+
+There is nothing to keep in parity. `@reachpad/cli` contains no
+reimplementation of any verb: `bin/reachpad.js` resolves the platform package
+and execs the same Rust binary every other install path delivers. Verbs, flags,
+exit codes and output are identical because they are the same program.
+
+The launcher is only allowed to get three things wrong, and each has a test in
+`test/packages.test.mjs` that runs a real child process:
+
+- **exit codes** — `reachpad run` exits with the *guest's* status, so a wrapper
+  that returns its own breaks every `&&` in every script.
+- **signals** — a guest killed by `SIGTERM` must make the launcher die of
+  `SIGTERM`, not `exit 1`.
+- **the terminal** — stdio is inherited, never piped, or `reachpad attach`
+  gets a non-tty and raw mode has nothing to put in raw mode.
+
+## Versions
+
+Every `package.json` here carries `0.0.0-dev`. The real version comes from the
+tag: `npm/prepare.mjs --version <x.y.z>` stamps all five manifests and the
+exact pins in `optionalDependencies`, then unpacks each release tarball into
+its platform package after checking the release's own SHA256 and reading the
+object header back to confirm it is the architecture it claims.
+
+A version committed here instead would drift the first time somebody bumped
+the Rust workspace and not this directory — and the drift is invisible until a
+user installs a CLI whose `--version` disagrees with the package they asked
+for.
+
+```sh
+node --test npm/test/*.test.mjs        # the whole suite, no network, no build
+```
+
+## First publish (one-time, manual)
+
+npm Trusted Publishing (OIDC) is how these packages are published — there is no
+npm token in this repository, exactly as in `Reachpad/reachpad-mcp`. But a
+trusted publisher can only be configured on a package that already exists, so
+the very first version of each of the five has to be pushed by hand:
+
+```sh
+git checkout cli-v<version>
+gh release download cli-v<version> --dir /tmp/rp-assets
+node npm/prepare.mjs --version <version> --artifacts /tmp/rp-assets
+for d in darwin-arm64 darwin-x64 linux-x64 linux-arm64 cli; do npm publish "npm/$d"; done
+```
+
+Then, at npmjs.com, for **each** of the five packages:
+
+> Settings → Trusted Publisher → GitHub Actions
+> org `Reachpad` · repo `reachpad-cli` · workflow `release.yml` · environment blank
+
+After that every `cli-v*` tag publishes on its own, and the publish step is
+idempotent: a version already on npm is skipped, so a tag whose fourth publish
+failed can simply be re-run.
diff --git a/npm/cli/README.md b/npm/cli/README.md
new file mode 100644
index 0000000..987dd27
--- /dev/null
+++ b/npm/cli/README.md
@@ -0,0 +1,93 @@
+# @reachpad/cli
+
+Durable cloud workspaces for coding agents. Create one, run commands in it,
+pause it, fork it from its last save.
+
+```sh
+npm install -g @reachpad/cli
+reachpad
+```
+
+The guided first run signs you in through WorkOS and lists your workspaces.
+
+## Why npm
+
+This package contains no JavaScript implementation of anything. It is a
+launcher for the same Rust binary that `brew install reachpad/tap/reachpad`
+and `curl -fsSL https://reachpad.dev/install | sh` put on your PATH — same
+verbs, same flags, same exit codes, because it is the same executable.
+
+npm is here for two reasons:
+
+- **No Gatekeeper dialog on macOS.** Our release binaries are ad-hoc signed,
+  not notarized, so macOS blocks them whenever a download stamps them with
+  `com.apple.quarantine` — which a browser download from the releases page
+  does. npm never sets that attribute, so an `npm install` binary just runs.
+- **Node is already there.** On a machine that runs coding agents, it is one
+  command with no new toolchain.
+
+The binary arrives as a platform-specific optional dependency
+(`@reachpad/cli-darwin-arm64` and friends), so it survives `--ignore-scripts`,
+it is pinned by integrity hash in your lockfile, and it installs offline from a
+warm cache.
+
+## Use it without installing
+
+```sh
+npx @reachpad/cli create --name scratch
+npx @reachpad/cli run scratch -- cargo test
+```
+
+## The surface
+
+```
+reachpad create [name]        make a workspace, print its id
+reachpad list                 your workspaces and what each is doing
+reachpad status <ws>          state, save, lease, limits (--wait to block)
+reachpad run <ws> -- <argv>   run one command, waking a paused workspace
+reachpad pause <ws>           save disk and memory, stop the meter
+reachpad fork <ws>            branch new workspaces from the last save
+reachpad archive <ws>         free the slot; deletes nothing
+reachpad events <ws>          live event stream
+
+reachpad auth login|whoami|logout
+reachpad keys mint|list|revoke        rpak1 keys for agents and CI
+reachpad doctor                       check this installation
+reachpad update                       update the way you installed
+reachpad completions bash|zsh|fish
+```
+
+`--json` on any command prints one JSON object instead of prose, and
+`REACHPAD_JSON=1` sets it for a whole session. `reachpad run` without `--json`
+is byte-exact: guest stdout to stdout, guest stderr to stderr, and this process
+exits with the guest's own exit code.
+
+## Updating
+
+```sh
+npm install -g @reachpad/cli@latest
+```
+
+`reachpad update` knows it was installed by npm and prints that command rather
+than writing into `node_modules` behind npm's back.
+
+## Platforms
+
+| Platform | Arch | Package |
+| --- | --- | --- |
+| macOS | Apple silicon | `@reachpad/cli-darwin-arm64` |
+| macOS | Intel | `@reachpad/cli-darwin-x64` |
+| Linux | x86-64 | `@reachpad/cli-linux-x64` |
+| Linux | arm64 | `@reachpad/cli-linux-arm64` |
+
+Linux builds are static musl binaries, so they run on glibc and musl distros
+alike. Windows is not a target yet; use WSL, or open an issue.
+
+## Source
+
+The full CLI source is public at
+[Reachpad/reachpad-cli](https://github.com/Reachpad/reachpad-cli), and the
+binaries in these packages are built from that source by its release workflow
+on GitHub's runners — tag to readable source to workflow run to `SHA256SUMS`.
+
+Docs: <https://reachpad.dev/docs/cli>
diff --git a/npm/cli/bin/reachpad.js b/npm/cli/bin/reachpad.js
new file mode 100644
index 0000000..cfe295a
--- /dev/null
+++ b/npm/cli/bin/reachpad.js
@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+// The `reachpad` command, when reachpad was installed from npm.
+//
+// This is a launcher and nothing else. Every verb, flag and exit code belongs
+// to the Rust binary in the platform package — there is no second
+// implementation to drift, which is the entire reason this package exists in
+// this shape.
+//
+// Three properties the CLI depends on, and how each is kept:
+//
+//   exit codes   `reachpad run` exits with the GUEST's exit code, so a wrapper
+//                that returns its own status silently breaks every `&&` in
+//                every script. The child's status is propagated verbatim, and
+//                a child killed by a signal re-raises that signal here so the
+//                calling shell sees `Terminated`, not `exit 1`.
+//   the terminal `reachpad attach` puts the tty in raw mode. stdio is
+//                inherited, never piped: a pipe would hand the guest a
+//                non-tty and turn an interactive session into a dead prompt.
+//   signals      Ctrl-C must reach the guest, not kill the launcher out from
+//                under it. The no-op handlers below stop Node's default
+//                terminate-on-SIGINT; the child shares this process group, so
+//                the terminal delivers the signal to it directly and we still
+//                get to report how it died.
+
+"use strict";
+
+const { spawnSync } = require("child_process");
+const { resolveBinary } = require("../lib/binary.js");
+
+let binary;
+try {
+  binary = resolveBinary();
+} catch (error) {
+  process.stderr.write(error.message + "\n");
+  process.exit(1);
+}
+
+for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+  process.on(signal, () => {});
+}
+
+const result = spawnSync(binary, process.argv.slice(2), { stdio: "inherit" });
+
+if (result.error) {
+  process.stderr.write(`reachpad: cannot run ${binary}: ${result.error.message}\n`);
+  process.exit(1);
+}
+
+if (result.signal) {
+  // Die the way the child died. Restoring the default disposition first is
+  // what makes this a death rather than a no-op against our own handler.
+  process.removeAllListeners(result.signal);
+  process.kill(process.pid, result.signal);
+}
+
+process.exit(result.status === null ? 1 : result.status);
diff --git a/npm/cli/lib/binary.js b/npm/cli/lib/binary.js
new file mode 100644
index 0000000..2f1e5e0
--- /dev/null
+++ b/npm/cli/lib/binary.js
@@ -0,0 +1,91 @@
+// Where the real CLI is. `@reachpad/cli` ships no code of its own: it resolves
+// the one platform package npm installed for this machine and hands over.
+//
+// The binary rides in optionalDependencies rather than a postinstall download,
+// and that choice is the whole design:
+//
+//   - `npm ci --ignore-scripts` is the default posture of every hardened CI
+//     runner and of most agent sandboxes. A postinstall downloader is simply
+//     absent there; an optional dependency is already unpacked.
+//   - The lockfile pins the binary's integrity hash, so the bytes are the same
+//     on every machine and every replay of a build.
+//   - It works offline from a warm cache.
+//
+// The cost is that npm resolves optional deps by `os`/`cpu` and says nothing
+// when it skips them all, so an unsupported platform surfaces here — which is
+// why the failure below is a paragraph and not a MODULE_NOT_FOUND stack.
+
+"use strict";
+
+// One row per release target. This table and the `release.yml` build matrix
+// are the same list said twice; `npm/test/packages.test.mjs` fails when they
+// stop agreeing, because the way this breaks in production is a new target
+// that ships tarballs nobody can install.
+const PACKAGES = {
+  "darwin arm64": "@reachpad/cli-darwin-arm64",
+  "darwin x64": "@reachpad/cli-darwin-x64",
+  "linux x64": "@reachpad/cli-linux-x64",
+  "linux arm64": "@reachpad/cli-linux-arm64",
+};
+
+/** The platform package for a given `process.platform`/`process.arch` pair. */
+function packageFor(platform, arch) {
+  return PACKAGES[`${platform} ${arch}`];
+}
+
+/** Every package this release publishes, for the CI cross-check. */
+function allPackages() {
+  return Object.values(PACKAGES);
+}
+
+/**
+ * The path of the `reachpad` executable, or a thrown error whose message tells
+ * the reader what to do next.
+ *
+ * `resolve` is injected so the tests can drive both failure shapes without
+ * uninstalling anything.
+ */
+function resolveBinary(
+  platform = process.platform,
+  arch = process.arch,
+  resolve = (specifier) => require.resolve(specifier)
+) {
+  const pkg = packageFor(platform, arch);
+  if (!pkg) {
+    throw new Error(unsupportedPlatform(platform, arch));
+  }
+  try {
+    return resolve(`${pkg}/bin/reachpad`);
+  } catch {
+    throw new Error(missingPackage(pkg));
+  }
+}
+
+function unsupportedPlatform(platform, arch) {
+  return [
+    `reachpad: no prebuilt binary for ${platform}/${arch}.`,
+    "",
+    "Supported: " + Object.keys(PACKAGES).join(", ") + ".",
+    "Windows is not a target yet — run the CLI inside WSL, or tell us you need",
+    "it at https://github.com/Reachpad/reachpad-cli/issues.",
+  ].join("\n");
+}
+
+// The reachable causes, in the order they actually happen. `--omit=optional`
+// is first because it is the one a person types on purpose and then forgets.
+function missingPackage(pkg) {
+  return [
+    `reachpad: ${pkg} is not installed, so there is no binary to run.`,
+    "",
+    "This package carries the CLI itself as an optional dependency. It goes",
+    "missing when the install skipped optional dependencies:",
+    "",
+    "  npm install -g @reachpad/cli          # not --omit=optional, not --no-optional",
+    "",
+    "If that does not fix it, install without npm at all:",
+    "",
+    "  curl -fsSL https://reachpad.dev/install | sh",
+  ].join("\n");
+}
+
+module.exports = { PACKAGES, packageFor, allPackages, resolveBinary };
diff --git a/npm/cli/package.json b/npm/cli/package.json
new file mode 100644
index 0000000..01c76ba
--- /dev/null
+++ b/npm/cli/package.json
@@ -0,0 +1,47 @@
+{
+  "name": "@reachpad/cli",
+  "version": "0.0.0-dev",
+  "description": "Run coding agents in durable cloud workspaces. The Reachpad CLI, installable with npm.",
+  "license": "UNLICENSED",
+  "homepage": "https://reachpad.dev/docs/cli",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Reachpad/reachpad-cli.git",
+    "directory": "npm/cli"
+  },
+  "bugs": {
+    "url": "https://github.com/Reachpad/reachpad-cli/issues"
+  },
+  "bin": {
+    "reachpad": "bin/reachpad.js"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "README.md"
+  ],
+  "keywords": [
+    "reachpad",
+    "cli",
+    "coding-agents",
+    "development-environment",
+    "cloud-development-environment",
+    "sandbox",
+    "agent-infrastructure"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "optionalDependencies": {
+    "@reachpad/cli-darwin-arm64": "0.0.0-dev",
+    "@reachpad/cli-darwin-x64": "0.0.0-dev",
+    "@reachpad/cli-linux-arm64": "0.0.0-dev",
+    "@reachpad/cli-linux-x64": "0.0.0-dev"
+  },
+  "scripts": {
+    "test": "node --test ../test/*.test.mjs"
+  }
+}
diff --git a/npm/darwin-arm64/README.md b/npm/darwin-arm64/README.md
new file mode 100644
index 0000000..e355342
--- /dev/null
+++ b/npm/darwin-arm64/README.md
@@ -0,0 +1,11 @@
+# @reachpad/cli-darwin-arm64
+
+The [reachpad](https://reachpad.dev/docs/cli) CLI binary for macOS on Apple silicon,
+built from public source for the `aarch64-apple-darwin` target.
+
+This package exists so that `npm install -g @reachpad/cli` fetches one
+binary instead of four. Install that instead:
+
+```sh
+npm install -g @reachpad/cli
+```
diff --git a/npm/darwin-arm64/package.json b/npm/darwin-arm64/package.json
new file mode 100644
index 0000000..0c3e132
--- /dev/null
+++ b/npm/darwin-arm64/package.json
@@ -0,0 +1,32 @@
+{
+  "name": "@reachpad/cli-darwin-arm64",
+  "version": "0.0.0-dev",
+  "description": "The reachpad CLI binary for macOS on Apple silicon. Installed automatically by @reachpad/cli; do not depend on it directly.",
+  "license": "UNLICENSED",
+  "homepage": "https://reachpad.dev/docs/cli",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Reachpad/reachpad-cli.git",
+    "directory": "npm/darwin-arm64"
+  },
+  "bugs": {
+    "url": "https://github.com/Reachpad/reachpad-cli/issues"
+  },
+  "os": [
+    "darwin"
+  ],
+  "cpu": [
+    "arm64"
+  ],
+  "files": [
+    "bin"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "preferUnplugged": true,
+  "reachpadTarget": "aarch64-apple-darwin"
+}
diff --git a/npm/darwin-x64/README.md b/npm/darwin-x64/README.md
new file mode 100644
index 0000000..6cb505c
--- /dev/null
+++ b/npm/darwin-x64/README.md
@@ -0,0 +1,11 @@
+# @reachpad/cli-darwin-x64
+
+The [reachpad](https://reachpad.dev/docs/cli) CLI binary for macOS on Intel,
+built from public source for the `x86_64-apple-darwin` target.
+
+This package exists so that `npm install -g @reachpad/cli` fetches one
+binary instead of four. Install that instead:
+
+```sh
+npm install -g @reachpad/cli
+```
diff --git a/npm/darwin-x64/package.json b/npm/darwin-x64/package.json
new file mode 100644
index 0000000..6078a65
--- /dev/null
+++ b/npm/darwin-x64/package.json
@@ -0,0 +1,32 @@
+{
+  "name": "@reachpad/cli-darwin-x64",
+  "version": "0.0.0-dev",
+  "description": "The reachpad CLI binary for macOS on Intel. Installed automatically by @reachpad/cli; do not depend on it directly.",
+  "license": "UNLICENSED",
+  "homepage": "https://reachpad.dev/docs/cli",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Reachpad/reachpad-cli.git",
+    "directory": "npm/darwin-x64"
+  },
+  "bugs": {
+    "url": "https://github.com/Reachpad/reachpad-cli/issues"
+  },
+  "os": [
+    "darwin"
+  ],
+  "cpu": [
+    "x64"
+  ],
+  "files": [
+    "bin"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "preferUnplugged": true,
+  "reachpadTarget": "x86_64-apple-darwin"
+}
diff --git a/npm/linux-arm64/README.md b/npm/linux-arm64/README.md
new file mode 100644
index 0000000..d7bf35f
--- /dev/null
+++ b/npm/linux-arm64/README.md
@@ -0,0 +1,11 @@
+# @reachpad/cli-linux-arm64
+
+The [reachpad](https://reachpad.dev/docs/cli) CLI binary for Linux on arm64,
+built from public source for the `aarch64-unknown-linux-musl` target.
+
+This package exists so that `npm install -g @reachpad/cli` fetches one
+binary instead of four. Install that instead:
+
+```sh
+npm install -g @reachpad/cli
+```
diff --git a/npm/linux-arm64/package.json b/npm/linux-arm64/package.json
new file mode 100644
index 0000000..6c9b39a
--- /dev/null
+++ b/npm/linux-arm64/package.json
@@ -0,0 +1,32 @@
+{
+  "name": "@reachpad/cli-linux-arm64",
+  "version": "0.0.0-dev",
+  "description": "The reachpad CLI binary for Linux on arm64. Installed automatically by @reachpad/cli; do not depend on it directly.",
+  "license": "UNLICENSED",
+  "homepage": "https://reachpad.dev/docs/cli",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Reachpad/reachpad-cli.git",
+    "directory": "npm/linux-arm64"
+  },
+  "bugs": {
+    "url": "https://github.com/Reachpad/reachpad-cli/issues"
+  },
+  "os": [
+    "linux"
+  ],
+  "cpu": [
+    "arm64"
+  ],
+  "files": [
+    "bin"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "preferUnplugged": true,
+  "reachpadTarget": "aarch64-unknown-linux-musl"
+}
diff --git a/npm/linux-x64/README.md b/npm/linux-x64/README.md
new file mode 100644
index 0000000..418c33b
--- /dev/null
+++ b/npm/linux-x64/README.md
@@ -0,0 +1,11 @@
+# @reachpad/cli-linux-x64
+
+The [reachpad](https://reachpad.dev/docs/cli) CLI binary for Linux on x86-64,
+built from public source for the `x86_64-unknown-linux-musl` target.
+
+This package exists so that `npm install -g @reachpad/cli` fetches one
+binary instead of four. Install that instead:
+
+```sh
+npm install -g @reachpad/cli
+```
diff --git a/npm/linux-x64/package.json b/npm/linux-x64/package.json
new file mode 100644
index 0000000..b0903a2
--- /dev/null
+++ b/npm/linux-x64/package.json
@@ -0,0 +1,32 @@
+{
+  "name": "@reachpad/cli-linux-x64",
+  "version": "0.0.0-dev",
+  "description": "The reachpad CLI binary for Linux on x86-64. Installed automatically by @reachpad/cli; do not depend on it directly.",
+  "license": "UNLICENSED",
+  "homepage": "https://reachpad.dev/docs/cli",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Reachpad/reachpad-cli.git",
+    "directory": "npm/linux-x64"
+  },
+  "bugs": {
+    "url": "https://github.com/Reachpad/reachpad-cli/issues"
+  },
+  "os": [
+    "linux"
+  ],
+  "cpu": [
+    "x64"
+  ],
+  "files": [
+    "bin"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "preferUnplugged": true,
+  "reachpadTarget": "x86_64-unknown-linux-musl"
+}
diff --git a/npm/prepare.mjs b/npm/prepare.mjs
new file mode 100644
index 0000000..b8323f7
--- /dev/null
+++ b/npm/prepare.mjs
@@ -0,0 +1,164 @@
+// Turn the release tarballs into publishable npm packages.
+//
+//   node npm/prepare.mjs --version 0.3.0 --artifacts /path/to/release/assets
+//
+// Two jobs, both of which exist because the alternative is a silent wrong
+// answer:
+//
+//   version   The repo carries `0.0.0-dev` in every package.json. The real
+//             version comes from the git tag, stamped here into all five
+//             manifests AND into the exact pins in optionalDependencies. A
+//             version committed to the repo instead would drift the day
+//             someone bumps the Rust workspace and not this directory, and
+//             the drift is invisible until a user installs a CLI whose
+//             `--version` disagrees with the package they asked for.
+//
+//   staging   Each platform package gets `bin/reachpad` unpacked from the
+//             matching release tarball, after its SHA256 is checked against
+//             the release's own SHA256SUMS. The unpacked file is then read
+//             back and its object header compared to the platform it claims:
+//             a matrix mix-up that ships the arm64 binary to Intel Macs is
+//             the failure this catches, and it is one that no test outside
+//             that machine would ever hit.
+
+import { createHash } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { mkdirSync, readFileSync, readdirSync, writeFileSync, chmodSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+/** The five packages, and what each platform one must contain. */
+export const PLATFORMS = [
+  { dir: "darwin-arm64", target: "aarch64-apple-darwin", format: "macho", machine: "arm64" },
+  { dir: "darwin-x64", target: "x86_64-apple-darwin", format: "macho", machine: "x86_64" },
+  { dir: "linux-x64", target: "x86_64-unknown-linux-musl", format: "elf", machine: "x86_64" },
+  { dir: "linux-arm64", target: "aarch64-unknown-linux-musl", format: "elf", machine: "arm64" },
+];
+
+export const PACKAGE_DIRS = ["cli", ...PLATFORMS.map((p) => p.dir)];
+
+/**
+ * Read an executable's header and say which (format, machine) it is really
+ * for. Returns null for anything that is not an object file at all — which is
+ * what a downloaded HTML error page looks like.
+ */
+export function identify(bytes) {
+  if (bytes.length < 20) return null;
+  // ELF: 0x7f 'E' 'L' 'F', then e_machine at offset 18 (little-endian here;
+  // every target we ship is LE).
+  if (bytes[0] === 0x7f && bytes[1] === 0x45 && bytes[2] === 0x4c && bytes[3] === 0x46) {
+    const machine = bytes.readUInt16LE(18);
+    if (machine === 0x3e) return { format: "elf", machine: "x86_64" };
+    if (machine === 0xb7) return { format: "elf", machine: "arm64" };
+    return { format: "elf", machine: `unknown(${machine})` };
+  }
+  // Mach-O 64-bit little-endian (MH_MAGIC_64), cputype in the next word.
+  if (bytes.readUInt32LE(0) === 0xfeedfacf) {
+    const cputype = bytes.readUInt32LE(4);
+    if (cputype === 0x01000007) return { format: "macho", machine: "x86_64" };
+    if (cputype === 0x0100000c) return { format: "macho", machine: "arm64" };
+    return { format: "macho", machine: `unknown(${cputype})` };
+  }
+  return null;
+}
+
+/** `<sha>  <name>` lines, as `shasum -a 256` writes them. */
+export function parseChecksums(text) {
+  const sums = new Map();
+  for (const line of text.split("\n")) {
+    const match = line.match(/^([0-9a-f]{64})\s+\*?(\S+)$/);
+    if (match) sums.set(match[2], match[1]);
+  }
+  return sums;
+}
+
+/** Stamp `version` through one package.json's own version and its exact pins. */
+export function stampManifest(manifest, version) {
+  const stamped = { ...manifest, version };
+  if (stamped.optionalDependencies) {
+    stamped.optionalDependencies = Object.fromEntries(
+      Object.entries(stamped.optionalDependencies).map(([name, pin]) =>
+        name.startsWith("@reachpad/cli-") ? [name, version] : [name, pin]
+      )
+    );
+  }
+  return stamped;
+}
+
+function stampVersions(version) {
+  for (const dir of PACKAGE_DIRS) {
+    const path = join(HERE, dir, "package.json");
+    const manifest = JSON.parse(readFileSync(path, "utf8"));
+    writeFileSync(path, JSON.stringify(stampManifest(manifest, version), null, 2) + "\n");
+  }
+  console.log(`version ${version} stamped into ${PACKAGE_DIRS.length} manifests`);
+}
+
+function stageBinaries(artifacts) {
+  const names = readdirSync(artifacts);
+  const sums = new Map();
+  for (const name of names) {
+    if (name === "SHA256SUMS" || name.endsWith(".sha256")) {
+      for (const [file, sum] of parseChecksums(readFileSync(join(artifacts, name), "utf8"))) {
+        sums.set(file, sum);
+      }
+    }
+  }
+
+  for (const platform of PLATFORMS) {
+    const asset = `reachpad-${platform.target}.tar.gz`;
+    const tarball = join(artifacts, asset);
+    const expected = sums.get(asset);
+    if (!expected) {
+      throw new Error(
+        `${asset} has no SHA256SUMS entry. Publishing an unverified binary is ` +
+          `worse than not publishing: the release's own checksum file is the ` +
+          `only thing tying these bytes to that workflow run.`
+      );
+    }
+    const bytes = readFileSync(tarball);
+    const actual = createHash("sha256").update(bytes).digest("hex");
+    if (actual !== expected) {
+      throw new Error(`${asset} checksum mismatch\n  expected ${expected}\n  got      ${actual}`);
+    }
+
+    const bin = join(HERE, platform.dir, "bin");
+    mkdirSync(bin, { recursive: true });
+    execFileSync("tar", ["xzf", tarball, "-C", bin, "reachpad"]);
+    chmodSync(join(bin, "reachpad"), 0o755);
+
+    const header = readFileSync(join(bin, "reachpad")).subarray(0, 64);
+    const found = identify(header);
+    if (!found || found.format !== platform.format || found.machine !== platform.machine) {
+      throw new Error(
+        `${platform.dir} was staged with the wrong binary: expected ` +
+          `${platform.format}/${platform.machine}, found ` +
+          `${found ? `${found.format}/${found.machine}` : "not an object file"}`
+      );
+    }
+    console.log(`staged ${platform.dir}: ${asset} (${found.format}/${found.machine})`);
+  }
+}
+
+function main(argv) {
+  const args = new Map();
+  for (let i = 0; i < argv.length; i += 2) args.set(argv[i], argv[i + 1]);
+  const version = args.get("--version");
+  const artifacts = args.get("--artifacts");
+  if (!version || !artifacts) {
+    console.error("usage: node npm/prepare.mjs --version <x.y.z> --artifacts <dir>");
+    process.exit(2);
+  }
+  if (!/^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/.test(version)) {
+    console.error(`refusing to publish "${version}": not a semver release version`);
+    process.exit(2);
+  }
+  stampVersions(version);
+  stageBinaries(artifacts);
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  main(process.argv.slice(2));
+}
diff --git a/npm/test/packages.test.mjs b/npm/test/packages.test.mjs
new file mode 100644
index 0000000..9cd91d8
--- /dev/null
+++ b/npm/test/packages.test.mjs
@@ -0,0 +1,269 @@
+// What this suite is defending: the npm packages are a DISTRIBUTION of the
+// Rust binary, so almost nothing here is about behaviour. It is about the four
+// lists that describe the same set of platforms staying the same list — the
+// release matrix, the staging table, the launcher's lookup, and the optional
+// dependencies — plus the two things a launcher can get wrong that no unit
+// test of the CLI would ever notice: exit codes and signals.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { execFileSync, spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { cpSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { PLATFORMS, PACKAGE_DIRS, identify, parseChecksums, stampManifest } from "../prepare.mjs";
+
+const NPM_DIR = dirname(dirname(fileURLToPath(import.meta.url)));
+const REPO = dirname(NPM_DIR);
+const require = createRequire(import.meta.url);
+const { PACKAGES, packageFor, resolveBinary } = require("../cli/lib/binary.js");
+
+const manifest = (dir) => JSON.parse(readFileSync(join(NPM_DIR, dir, "package.json"), "utf8"));
+
+test("every list of platforms is the same list", () => {
+  const staged = PLATFORMS.map((p) => `@reachpad/cli-${p.dir}`).sort();
+
+  // The launcher's lookup table.
+  assert.deepEqual(Object.values(PACKAGES).sort(), staged);
+
+  // What `npm install -g @reachpad/cli` will actually fetch. A package staged
+  // and published but never depended on is a binary nobody can install.
+  assert.deepEqual(Object.keys(manifest("cli").optionalDependencies).sort(), staged);
+
+  // The release matrix. Parsed rather than restated: this is the list that
+  // decides which tarballs exist at all, so it is the one with the last word.
+  const workflow = readFileSync(join(REPO, ".github/workflows/release.yml"), "utf8");
+  const built = [...workflow.matchAll(/^\s*- target:\s*(\S+)/gm)].map((m) => m[1]).sort();
+  assert.deepEqual(
+    PLATFORMS.map((p) => p.target).sort(),
+    built,
+    "release.yml builds a different set of targets than npm/prepare.mjs stages"
+  );
+});
+
+test("each platform package declares the os/cpu npm selects it by", () => {
+  for (const platform of PLATFORMS) {
+    const pkg = manifest(platform.dir);
+    const [os, cpu] = platform.dir.split("-");
+    assert.deepEqual(pkg.os, [os], `${platform.dir} os`);
+    assert.deepEqual(pkg.cpu, [cpu], `${platform.dir} cpu`);
+    assert.equal(pkg.reachpadTarget, platform.target, `${platform.dir} target triple`);
+    // Yarn Berry zips packages into its cache, and an executable inside a zip
+    // cannot be exec'd.
+    assert.equal(pkg.preferUnplugged, true, `${platform.dir} preferUnplugged`);
+  }
+});
+
+test("every package names the repo npm signs provenance against", () => {
+  // npm signs provenance on every OIDC publish and REFUSES the upload when
+  // package.json does not name the repository it was built from. That
+  // rejection arrives after the tarball is built and the attestation is
+  // already in the transparency log, which is a confusing place to learn it.
+  // All five, not just the platform ones: @reachpad/cli is published last, so
+  // a missing field there fails after four packages are already public.
+  for (const dir of PACKAGE_DIRS) {
+    const pkg = manifest(dir);
+    assert.match(pkg.repository?.url ?? "", /Reachpad\/reachpad-cli/, `${dir} repository.url`);
+    assert.equal(pkg.publishConfig?.access, "public", `${dir} publishConfig.access`);
+  }
+});
+
+test("the launcher maps this machine, and refuses the ones we do not ship", () => {
+  assert.equal(packageFor("darwin", "arm64"), "@reachpad/cli-darwin-arm64");
+  assert.equal(packageFor("linux", "x64"), "@reachpad/cli-linux-x64");
+  assert.equal(packageFor("win32", "x64"), undefined);
+
+  assert.throws(() => resolveBinary("win32", "x64"), /no prebuilt binary for win32\/x64[\s\S]*WSL/);
+  assert.throws(() => resolveBinary("sunos", "sparc"), /no prebuilt binary for sunos\/sparc/);
+});
+
+test("a skipped optional dependency explains itself instead of stack-tracing", () => {
+  const boom = () => {
+    throw Object.assign(new Error("Cannot find module"), { code: "MODULE_NOT_FOUND" });
+  };
+  assert.throws(() => resolveBinary("linux", "x64", boom), (error) => {
+    assert.match(error.message, /@reachpad\/cli-linux-x64 is not installed/);
+    assert.match(error.message, /--omit=optional/);
+    assert.match(error.message, /reachpad\.dev\/install/);
+    return true;
+  });
+});
+
+test("object headers are identified, and a downloaded error page is not one", () => {
+  const elf = (machine) => {
+    const b = Buffer.alloc(64);
+    b.write("\x7fELF", 0, "latin1");
+    b.writeUInt16LE(machine, 18);
+    return b;
+  };
+  const macho = (cputype) => {
+    const b = Buffer.alloc(64);
+    b.writeUInt32LE(0xfeedfacf, 0);
+    b.writeUInt32LE(cputype, 4);
+    return b;
+  };
+  assert.deepEqual(identify(elf(0x3e)), { format: "elf", machine: "x86_64" });
+  assert.deepEqual(identify(elf(0xb7)), { format: "elf", machine: "arm64" });
+  assert.deepEqual(identify(macho(0x01000007)), { format: "macho", machine: "x86_64" });
+  assert.deepEqual(identify(macho(0x0100000c)), { format: "macho", machine: "arm64" });
+  assert.equal(identify(Buffer.from("<html>404: Not Found</html>")), null);
+  assert.equal(identify(Buffer.alloc(4)), null);
+});
+
+test("checksums are read the way shasum writes them", () => {
+  const sums = parseChecksums(
+    "abc  not-a-sha\n" +
+      "1".repeat(64) + "  reachpad-x86_64-unknown-linux-musl.tar.gz\n" +
+      "2".repeat(64) + " *reachpad-aarch64-apple-darwin.tar.gz\n"
+  );
+  assert.equal(sums.get("reachpad-x86_64-unknown-linux-musl.tar.gz"), "1".repeat(64));
+  assert.equal(sums.get("reachpad-aarch64-apple-darwin.tar.gz"), "2".repeat(64));
+  assert.equal(sums.get("not-a-sha"), undefined);
+});
+
+test("stamping a version reaches the pins, not just the package's own version", () => {
+  const stamped = stampManifest(manifest("cli"), "1.2.3");
+  assert.equal(stamped.version, "1.2.3");
+  for (const [name, pin] of Object.entries(stamped.optionalDependencies)) {
+    assert.equal(pin, "1.2.3", `${name} pin`);
+  }
+});
+
+test("the repo carries no real version: the tag is the only source", () => {
+  for (const dir of PACKAGE_DIRS) {
+    assert.equal(manifest(dir).version, "0.0.0-dev", `${dir} version`);
+  }
+});
+
+// --- prepare.mjs, end to end on a throwaway copy -----------------------------
+
+function fakeRelease(dir, { corrupt = null, wrongArch = false } = {}) {
+  mkdirSync(dir, { recursive: true });
+  const sums = [];
+  for (const platform of PLATFORMS) {
+    const header = Buffer.alloc(256);
+    const machine = wrongArch && platform.dir === "darwin-x64" ? "arm64" : platform.machine;
+    if (platform.format === "elf") {
+      header.write("\x7fELF", 0, "latin1");
+      header.writeUInt16LE(machine === "x86_64" ? 0x3e : 0xb7, 18);
+    } else {
+      header.writeUInt32LE(0xfeedfacf, 0);
+      header.writeUInt32LE(machine === "x86_64" ? 0x01000007 : 0x0100000c, 4);
+    }
+    const stage = mkdtempSync(join(tmpdir(), "rp-stage-"));
+    writeFileSync(join(stage, "reachpad"), header);
+    const asset = `reachpad-${platform.target}.tar.gz`;
+    execFileSync("tar", ["czf", join(dir, asset), "-C", stage, "reachpad"]);
+    const sum = execFileSync("sha256sum", [join(dir, asset)]).toString().slice(0, 64);
+    sums.push(`${corrupt === platform.dir ? "0".repeat(64) : sum}  ${asset}`);
+  }
+  writeFileSync(join(dir, "SHA256SUMS"), sums.join("\n") + "\n");
+}
+
+function runPrepare(options = {}) {
+  const work = mkdtempSync(join(tmpdir(), "rp-npm-"));
+  cpSync(NPM_DIR, join(work, "npm"), { recursive: true });
+  cpSync(join(REPO, ".github"), join(work, ".github"), { recursive: true });
+  const artifacts = join(work, "artifacts");
+  fakeRelease(artifacts, options);
+  const result = spawnSync(
+    process.execPath,
+    [join(work, "npm/prepare.mjs"), "--version", "9.9.9", "--artifacts", artifacts],
+    { encoding: "utf8" }
+  );
+  return { work, result };
+}
+
+test("prepare stamps the tag's version and stages every platform", () => {
+  const { work, result } = runPrepare();
+  assert.equal(result.status, 0, result.stderr);
+
+  for (const dir of PACKAGE_DIRS) {
+    const pkg = JSON.parse(readFileSync(join(work, "npm", dir, "package.json"), "utf8"));
+    assert.equal(pkg.version, "9.9.9", `${dir} version`);
+  }
+  const cli = JSON.parse(readFileSync(join(work, "npm/cli/package.json"), "utf8"));
+  for (const pin of Object.values(cli.optionalDependencies)) assert.equal(pin, "9.9.9");
+
+  for (const platform of PLATFORMS) {
+    const binary = join(work, "npm", platform.dir, "bin", "reachpad");
+    const found = identify(readFileSync(binary));
+    assert.deepEqual(found, { format: platform.format, machine: platform.machine });
+  }
+});
+
+test("prepare refuses a tarball whose checksum does not match the release", () => {
+  const { result } = runPrepare({ corrupt: "linux-x64" });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /checksum mismatch/);
+});
+
+test("prepare refuses a binary built for the wrong architecture", () => {
+  const { result } = runPrepare({ wrongArch: true });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /darwin-x64 was staged with the wrong binary/);
+});
+
+test("prepare refuses a tag name where a version belongs", () => {
+  // `cli-v0.3.0` is the tag; `0.3.0` is the version. Publishing the former
+  // would put a package on npm that no `@latest` range can ever resolve.
+  const run = spawnSync(
+    process.execPath,
+    [join(NPM_DIR, "prepare.mjs"), "--version", "cli-v0.3.0", "--artifacts", "/nonexistent"],
+    { encoding: "utf8" }
+  );
+  assert.equal(run.status, 2);
+  assert.match(run.stderr, /not a semver release version/);
+});
+
+// --- the launcher, against a real child process ------------------------------
+
+function launcherFixture(script) {
+  const work = mkdtempSync(join(tmpdir(), "rp-run-"));
+  const cli = join(work, "node_modules/@reachpad/cli");
+  cpSync(join(NPM_DIR, "cli"), cli, { recursive: true });
+  const platform = packageFor(process.platform, process.arch);
+  assert.ok(platform, `this test host (${process.platform}/${process.arch}) is not a target`);
+  const bin = join(work, "node_modules", platform, "bin");
+  mkdirSync(bin, { recursive: true });
+  writeFileSync(join(bin, "reachpad"), script);
+  chmodSync(join(bin, "reachpad"), 0o755);
+  return join(cli, "bin/reachpad.js");
+}
+
+test("the guest's exit code is the launcher's exit code", () => {
+  const launcher = launcherFixture("#!/bin/sh\nexit 42\n");
+  const run = spawnSync(process.execPath, [launcher], { encoding: "utf8" });
+  assert.equal(run.status, 42, "`reachpad run` returns the guest's status; a wrapper must not eat it");
+});
+
+test("argv and both output streams pass through unmangled", () => {
+  const launcher = launcherFixture(
+    "#!/bin/sh\nprintf 'out:%s' \"$*\"\nprintf 'err:%s' \"$1\" >&2\n"
+  );
+  const run = spawnSync(process.execPath, [launcher, "run", "ws-1", "--", "ls", "-la"], {
+    encoding: "utf8",
+  });
+  assert.equal(run.stdout, "out:run ws-1 -- ls -la");
+  assert.equal(run.stderr, "err:run");
+  assert.equal(run.status, 0);
+});
+
+test("a guest killed by a signal kills the launcher the same way", () => {
+  const launcher = launcherFixture("#!/bin/sh\nkill -TERM $$\n");
+  const run = spawnSync(process.execPath, [launcher], { encoding: "utf8" });
+  assert.equal(run.signal, "SIGTERM", "the shell must see Terminated, not exit 1");
+});
+
+test("no platform package at all is a paragraph on stderr, not a stack", () => {
+  const work = mkdtempSync(join(tmpdir(), "rp-bare-"));
+  const cli = join(work, "node_modules/@reachpad/cli");
+  cpSync(join(NPM_DIR, "cli"), cli, { recursive: true });
+  const run = spawnSync(process.execPath, [join(cli, "bin/reachpad.js")], { encoding: "utf8" });
+  assert.equal(run.status, 1);
+  assert.doesNotMatch(run.stderr, /at Object|MODULE_NOT_FOUND/);
+  assert.match(run.stderr, /is not installed/);
+});