diff --git a/.gitea/scripts/install-linux-build-dependencies.sh b/.gitea/scripts/install-linux-build-dependencies.sh
new file mode 100644
index 0000000..7256e40
--- /dev/null
+++ b/.gitea/scripts/install-linux-build-dependencies.sh
@@ -0,0 +1,68 @@
+#!/bin/sh
+set -eu
+
+target=${1:?usage: install-linux-build-dependencies.sh arm64|x64}
+
+install_packages() {
+    sudo env DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "$@"
+}
+
+case "$target" in
+    arm64)
+        sudo apt-get update
+        install_packages \
+            build-essential \
+            cmake \
+            libgtk-3-dev \
+            libwebkit2gtk-4.1-dev \
+            libxdo-dev \
+            pkg-config
+        ;;
+    x64)
+        if [ "$(dpkg --print-architecture)" != "arm64" ]; then
+            echo "the x64 release build expects an arm64 Ubuntu runner" >&2
+            exit 1
+        fi
+        if [ ! -r /etc/os-release ]; then
+            echo "cannot determine the Ubuntu release" >&2
+            exit 1
+        fi
+        . /etc/os-release
+        if [ "${ID:-}" != "ubuntu" ] || [ -z "${VERSION_CODENAME:-}" ]; then
+            echo "the x64 release build requires an Ubuntu runner" >&2
+            exit 1
+        fi
+
+        sudo dpkg --add-architecture amd64
+        {
+            printf '%s\n' \
+                'Types: deb' \
+                'URIs: http://archive.ubuntu.com/ubuntu' \
+                "Suites: $VERSION_CODENAME ${VERSION_CODENAME}-updates" \
+                'Components: main universe restricted multiverse' \
+                'Architectures: amd64' \
+                'Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg' \
+                '' \
+                'Types: deb' \
+                'URIs: http://security.ubuntu.com/ubuntu' \
+                "Suites: ${VERSION_CODENAME}-security" \
+                'Components: main universe restricted multiverse' \
+                'Architectures: amd64' \
+                'Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg'
+        } | sudo tee /etc/apt/sources.list.d/ruds-amd64.sources >/dev/null
+        sudo apt-get update
+        install_packages \
+            build-essential \
+            cmake \
+            gcc-x86-64-linux-gnu \
+            g++-x86-64-linux-gnu \
+            libgtk-3-dev:amd64 \
+            libwebkit2gtk-4.1-dev:amd64 \
+            libxdo-dev:amd64 \
+            pkg-config
+        ;;
+    *)
+        echo "unsupported Linux build target: $target" >&2
+        exit 1
+        ;;
+esac
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
new file mode 100644
index 0000000..4d6fff6
--- /dev/null
+++ b/.gitea/workflows/release.yml
@@ -0,0 +1,219 @@
+name: Tagged release
+
+on:
+  push:
+    tags:
+      - "*"
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_TOOLCHAIN: 1.97.1
+
+jobs:
+  prepare-release:
+    runs-on: linux-arm64
+    outputs:
+      release_id: ${{ steps.release.outputs.release_id }}
+    steps:
+      - name: Check out the tag
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install the release Rust toolchain
+        run: rustup toolchain install ${RUST_TOOLCHAIN} --profile minimal
+
+      - name: Test release tooling
+        run: cargo +${RUST_TOOLCHAIN} test --locked --package bds-release
+
+      - name: Create draft release
+        id: release
+        env:
+          GITEA_API_URL: ${{ gitea.server_url }}/api/v1
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          GITEA_REF_NAME: ${{ gitea.ref_name }}
+          GITEA_SERVER_URL: ${{ gitea.server_url }}
+          GITEA_SHA: ${{ gitea.sha }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: cargo +${RUST_TOOLCHAIN} run --release --locked --package bds-release -- prepare
+
+  build-macos:
+    needs: prepare-release
+    runs-on: linux-arm64
+    container: ghcr.io/rust-cross/cargo-zigbuild@sha256:82af75c41958c2af2787e8bedd912da7678a9438937e223e9d83d006d747b38b
+    env:
+      CARGO_TARGET_AARCH64_APPLE_DARWIN_RUSTFLAGS: -C link-arg=-mmacosx-version-min=26.0 -C link-arg=-Wl,-rpath,@executable_path/../Resources -C link-arg=-Wl,-headerpad,0x1000
+      CARGO_TARGET_X86_64_APPLE_DARWIN_RUSTFLAGS: -C link-arg=-mmacosx-version-min=26.0 -C link-arg=-Wl,-rpath,@executable_path/../Resources -C link-arg=-Wl,-headerpad,0x1000
+    steps:
+      - name: Check out the tag
+        env:
+          GITEA_REF_NAME: ${{ gitea.ref_name }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          GITEA_SERVER_URL: ${{ gitea.server_url }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          git init
+          git -c http.extraHeader="Authorization: token $GITEA_TOKEN" fetch --depth=1 \
+            "$GITEA_SERVER_URL/$GITEA_REPOSITORY.git" "refs/tags/$GITEA_REF_NAME"
+          git checkout --detach FETCH_HEAD
+
+      - name: Install release Rust targets
+        run: >-
+          rustup toolchain install ${RUST_TOOLCHAIN} --profile minimal
+          --target aarch64-apple-darwin
+          --target x86_64-apple-darwin
+
+      - name: Build, package, and upload macOS releases
+        env:
+          GITEA_API_URL: ${{ gitea.server_url }}/api/v1
+          GITEA_REF_NAME: ${{ gitea.ref_name }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          RELEASE_ID: ${{ needs.prepare-release.outputs.release_id }}
+        run: |
+          set -eu
+          for build in \
+            'aarch64-apple-darwin|aarch64-apple-darwin|darwin-arm64' \
+            'x86_64-apple-darwin|x86_64-apple-darwin|darwin-x64'
+          do
+            target=${build%%|*}
+            rest=${build#*|}
+            build_target=${rest%%|*}
+            platform=${rest#*|}
+            cargo +${RUST_TOOLCHAIN} zigbuild --release --locked --target "$build_target" \
+              --package bds-ui --package bds-cli --package bds-mcp
+            rust_lib_dir=$(rustc +${RUST_TOOLCHAIN} --target "$target" --print target-libdir)
+            cargo +${RUST_TOOLCHAIN} run --release --locked --package bds-release -- package \
+              "$GITEA_REF_NAME" "target/$target/release" "$rust_lib_dir" "$platform" dist --upload
+          done
+
+  build-linux-arm64:
+    needs: prepare-release
+    runs-on: linux-arm64
+    env:
+      CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUSTFLAGS: -C link-arg=-Wl,-rpath,$ORIGIN
+    steps:
+      - name: Check out the tag
+        uses: actions/checkout@v4
+
+      - name: Install native Linux desktop dependencies
+        run: sh .gitea/scripts/install-linux-build-dependencies.sh arm64
+
+      - name: Install the release Rust target
+        run: rustup toolchain install ${RUST_TOOLCHAIN} --profile minimal --target aarch64-unknown-linux-gnu
+
+      - name: Build, package, and upload Linux arm64 release
+        env:
+          GITEA_API_URL: ${{ gitea.server_url }}/api/v1
+          GITEA_REF_NAME: ${{ gitea.ref_name }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          RELEASE_ID: ${{ needs.prepare-release.outputs.release_id }}
+        run: |
+          set -eu
+          target=aarch64-unknown-linux-gnu
+          cargo +${RUST_TOOLCHAIN} build --release --locked --target "$target" \
+            --package bds-ui --package bds-cli --package bds-mcp
+          rust_lib_dir=$(rustc +${RUST_TOOLCHAIN} --target "$target" --print target-libdir)
+          cargo +${RUST_TOOLCHAIN} run --release --locked --package bds-release -- package \
+            "$GITEA_REF_NAME" "target/$target/release" "$rust_lib_dir" linux-arm64 dist --upload
+
+  build-linux-x64:
+    needs: prepare-release
+    runs-on: linux-arm64
+    env:
+      AR_x86_64_unknown_linux_gnu: x86_64-linux-gnu-ar
+      CC_x86_64_unknown_linux_gnu: x86_64-linux-gnu-gcc
+      CXX_x86_64_unknown_linux_gnu: x86_64-linux-gnu-g++
+      CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER: x86_64-linux-gnu-gcc
+      CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS: -C link-arg=-Wl,-rpath,$ORIGIN -L native=/usr/lib/x86_64-linux-gnu
+      PKG_CONFIG_ALLOW_CROSS: "1"
+      PKG_CONFIG_LIBDIR: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/share/pkgconfig
+    steps:
+      - name: Check out the tag
+        uses: actions/checkout@v4
+
+      - name: Install x64 Linux desktop dependencies and cross-linker
+        run: sh .gitea/scripts/install-linux-build-dependencies.sh x64
+
+      - name: Install the release Rust target
+        run: rustup toolchain install ${RUST_TOOLCHAIN} --profile minimal --target x86_64-unknown-linux-gnu
+
+      - name: Build, package, and upload Linux x64 release
+        env:
+          GITEA_API_URL: ${{ gitea.server_url }}/api/v1
+          GITEA_REF_NAME: ${{ gitea.ref_name }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          RELEASE_ID: ${{ needs.prepare-release.outputs.release_id }}
+        run: |
+          set -eu
+          target=x86_64-unknown-linux-gnu
+          cargo +${RUST_TOOLCHAIN} build --release --locked --target "$target" \
+            --package bds-ui --package bds-cli --package bds-mcp
+          rust_lib_dir=$(rustc +${RUST_TOOLCHAIN} --target "$target" --print target-libdir)
+          cargo +${RUST_TOOLCHAIN} run --release --locked --package bds-release -- package \
+            "$GITEA_REF_NAME" "target/$target/release" "$rust_lib_dir" linux-x64 dist --upload
+
+  build-windows:
+    needs: prepare-release
+    runs-on: linux-arm64
+    container: messense/cargo-xwin@sha256:4696dd4e79edf8569fa99c4b06bd99273e0501c7adc983aa61d57945f795bef0
+    env:
+      CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_RUSTFLAGS: -C target-feature=+crt-static
+    steps:
+      - name: Check out the tag
+        env:
+          GITEA_REF_NAME: ${{ gitea.ref_name }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          GITEA_SERVER_URL: ${{ gitea.server_url }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          git init
+          git -c http.extraHeader="Authorization: token $GITEA_TOKEN" fetch --depth=1 \
+            "$GITEA_SERVER_URL/$GITEA_REPOSITORY.git" "refs/tags/$GITEA_REF_NAME"
+          git checkout --detach FETCH_HEAD
+
+      - name: Install the release Rust target
+        run: rustup toolchain install ${RUST_TOOLCHAIN} --profile minimal --target x86_64-pc-windows-msvc
+
+      - name: Build, package, and upload Windows release
+        env:
+          GITEA_API_URL: ${{ gitea.server_url }}/api/v1
+          GITEA_REF_NAME: ${{ gitea.ref_name }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          RELEASE_ID: ${{ needs.prepare-release.outputs.release_id }}
+        run: |
+          set -eu
+          target=x86_64-pc-windows-msvc
+          cargo +${RUST_TOOLCHAIN} xwin build --release --locked --target "$target" \
+            --package bds-ui --package bds-cli --package bds-mcp
+          rust_lib_dir=$(rustc +${RUST_TOOLCHAIN} --target "$target" --print target-libdir)
+          cargo +${RUST_TOOLCHAIN} run --release --locked --package bds-release -- package \
+            "$GITEA_REF_NAME" "target/$target/release" "$rust_lib_dir" windows-x64 dist --upload
+
+  publish-release:
+    needs:
+      - prepare-release
+      - build-macos
+      - build-linux-arm64
+      - build-linux-x64
+      - build-windows
+    runs-on: linux-arm64
+    steps:
+      - name: Check out the tag
+        uses: actions/checkout@v4
+
+      - name: Install the release Rust toolchain
+        run: rustup toolchain install ${RUST_TOOLCHAIN} --profile minimal
+
+      - name: Publish complete release
+        env:
+          GITEA_API_URL: ${{ gitea.server_url }}/api/v1
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          RELEASE_ID: ${{ needs.prepare-release.outputs.release_id }}
+        run: cargo +${RUST_TOOLCHAIN} run --release --locked --package bds-release -- publish
diff --git a/BUILD.md b/BUILD.md
index 0349ad5..3a28da1 100644
--- a/BUILD.md
+++ b/BUILD.md
@@ -20,9 +20,15 @@ Packages are written below `target/release`. The macOS bundle uses the ICNS icon
 
 Windows packaging requires the MSVC Rust toolchain, Visual Studio Build Tools with C++ support, and the Windows SDK. Build each package on its target operating system; these commands do not cross-package installers.
 
+## Automated tagged releases
+
+Pushing a tag runs `.gitea/workflows/release.yml` on Linux arm64. The workflow builds Linux arm64 natively, cross-links Linux x64 with Ubuntu's amd64 development libraries and GNU cross-toolchain, uses Cargo Zigbuild for macOS, Cargo Xwin for Windows x64, and `bds-release` for every packaging and Gitea API operation. It does not require host installations of Python, `curl`, `tar`, `hdiutil`, or NSIS.
+
+The workflow publishes CLI/MCP and desktop artifacts for Linux and macOS on arm64 and x64, plus Windows x64. Linux desktop binaries dynamically use the target system's GTK 3, WebKitGTK 4.1, and libxdo runtime packages. macOS desktop artifacts are ad-hoc-signed `.dmg` files, Unix artifacts are `.tar.gz`, and Windows artifacts are `.zip` files containing the native `.exe` application and its runtime DLLs. The Gitea release remains a draft unless every build and upload succeeds.
+
 ## macOS system requirements
 
-- macOS 13 (Ventura) or later
+- macOS 26 or later
 - Apple Silicon or Intel Mac with Metal or Vulkan support (required by Iced's wgpu backend)
 
 ## Linux system requirements (optional, for CI or cross-platform development)
diff --git a/Cargo.lock b/Cargo.lock
index c496965..aeb7275 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -78,7 +78,7 @@ dependencies = [
  "flate2",
  "foldhash 0.2.0",
  "futures-core",
- "h2",
+ "h2 0.3.27",
  "http 0.2.12",
  "httparse",
  "httpdate",
@@ -89,7 +89,7 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "rand 0.10.2",
- "sha1",
+ "sha1 0.11.0",
  "smallvec",
  "tokio",
  "tokio-util",
@@ -237,7 +237,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99"
 dependencies = [
  "crypto-common 0.2.2",
- "inout",
+ "inout 0.2.2",
 ]
 
 [[package]]
@@ -246,7 +246,7 @@ version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1fc76eaeac4c9164506c466d4ffdd8ec9d0c5bf57ee97177c4d8eceb3a0e138"
 dependencies = [
- "cipher",
+ "cipher 0.5.2",
  "cpubits",
  "cpufeatures 0.3.0",
  "zeroize",
@@ -260,7 +260,7 @@ checksum = "fdf011db2e21ce0d575593d749db5554b47fed37aff429e4dc50bc91ac93a028"
 dependencies = [
  "aead",
  "aes",
- "cipher",
+ "cipher 0.5.2",
  "ctr",
  "ghash",
  "subtle",
@@ -434,6 +434,162 @@ version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d301b3b94cb4b2f23d7917810addbbaff90738e0ca2be692bd027e70d7e0330c"
 
+[[package]]
+name = "apple-bundles"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f40bb8f844cec39fa3aceae717808c2ac3d2b6c474a9dffbeba07a4a945d10"
+dependencies = [
+ "anyhow",
+ "plist",
+ "simple-file-manifest",
+ "walkdir",
+]
+
+[[package]]
+name = "apple-codesign"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f24e9ebdb70a2aee3ca1cea217009fb50776955f0d7678c31d22e48c1524667f"
+dependencies = [
+ "anyhow",
+ "apple-bundles",
+ "apple-flat-package",
+ "apple-xar",
+ "base64 0.22.1",
+ "bcder",
+ "bitflags 2.13.1",
+ "bytes",
+ "chrono",
+ "clap",
+ "cryptographic-message-syntax",
+ "der 0.7.10",
+ "dialoguer",
+ "difference",
+ "digest 0.10.7",
+ "dirs 5.0.1",
+ "elliptic-curve 0.13.8",
+ "env_logger",
+ "figment",
+ "filetime",
+ "glob",
+ "goblin",
+ "hex",
+ "log",
+ "md-5",
+ "minicbor 0.25.1",
+ "num-traits",
+ "object",
+ "oid-registry",
+ "once_cell",
+ "p12",
+ "p256 0.13.2",
+ "pem",
+ "pkcs1 0.7.5",
+ "pkcs8 0.10.2",
+ "plist",
+ "rand 0.8.7",
+ "rasn",
+ "rayon",
+ "regex",
+ "reqwest",
+ "ring",
+ "rsa 0.9.10",
+ "scroll",
+ "security-framework 2.11.1",
+ "security-framework-sys",
+ "semver",
+ "serde",
+ "serde_json",
+ "serde_yaml 0.9.34+deprecated",
+ "sha2 0.10.9",
+ "signature 2.2.0",
+ "simple-file-manifest",
+ "spake2",
+ "spki 0.7.3",
+ "subtle",
+ "tempfile",
+ "thiserror 2.0.19",
+ "tokio",
+ "tungstenite",
+ "uuid",
+ "walkdir",
+ "widestring",
+ "windows-sys 0.59.0",
+ "x509",
+ "x509-certificate",
+ "xml-rs",
+ "yasna",
+ "zeroize",
+ "zip 2.4.2",
+ "zip_structs",
+]
+
+[[package]]
+name = "apple-dmg"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdbc4a77fe34d67a853e2c472f85b571fc8531e7540ef3dc2fec239d0e6ee6ea"
+dependencies = [
+ "anyhow",
+ "byteorder",
+ "crc32fast",
+ "fatfs",
+ "flate2",
+ "fscommon",
+ "getrandom 0.2.17",
+ "gpt",
+ "md5 0.7.0",
+ "plist",
+ "serde",
+ "serde_bytes",
+]
+
+[[package]]
+name = "apple-flat-package"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c9d5a1fd8af4a376cc33d7e816a13f8ce127d52101f5dbc8061fb595397bea0"
+dependencies = [
+ "apple-xar",
+ "cpio-archive",
+ "flate2",
+ "scroll",
+ "serde",
+ "serde-xml-rs",
+ "thiserror 2.0.19",
+]
+
+[[package]]
+name = "apple-xar"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9631e781df71ebd049d7b4988cdae88712324cb20eb127fd79026bc8f1335d93"
+dependencies = [
+ "base64 0.22.1",
+ "bcder",
+ "bzip2",
+ "chrono",
+ "cryptographic-message-syntax",
+ "digest 0.10.7",
+ "flate2",
+ "log",
+ "md-5",
+ "rand 0.8.7",
+ "reqwest",
+ "scroll",
+ "serde",
+ "serde-xml-rs",
+ "sha1 0.10.7",
+ "sha2 0.10.9",
+ "signature 2.2.0",
+ "thiserror 2.0.19",
+ "url",
+ "x509-certificate",
+ "xml-rs",
+ "xz2",
+]
+
 [[package]]
 name = "approx"
 version = "0.5.1"
@@ -448,6 +604,9 @@ name = "arbitrary"
 version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
+dependencies = [
+ "derive_arbitrary",
+]
 
 [[package]]
 name = "arg_enum_proc_macro"
@@ -530,6 +689,44 @@ dependencies = [
  "zbus",
 ]
 
+[[package]]
+name = "asn1-rs"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5493c3bedbacf7fd7382c6346bbd66687d12bbaad3a89a2d2c303ee6cf20b048"
+dependencies = [
+ "asn1-rs-derive",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom 7.1.3",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "965c2d33e53cb6b267e148a4cb0760bc01f4904c1cd4bb4002a085bb016d1490"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "async-broadcast"
 version = "0.7.2"
@@ -858,6 +1055,12 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "base16ct"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
+
 [[package]]
 name = "base16ct"
 version = "1.0.0"
@@ -892,6 +1095,16 @@ version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
+[[package]]
+name = "bcder"
+version = "0.7.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b593e5aeaf7992d388c08a9831c921cd703718064b3e50ba8e6d666d6cf86ca7"
+dependencies = [
+ "bytes",
+ "smallvec",
+]
+
 [[package]]
 name = "bcrypt-pbkdf"
 version = "0.11.0"
@@ -905,7 +1118,7 @@ dependencies = [
 
 [[package]]
 name = "bds-cli"
-version = "0.1.0"
+version = "0.9.0"
 dependencies = [
  "anyhow",
  "bds-core",
@@ -919,7 +1132,7 @@ dependencies = [
 
 [[package]]
 name = "bds-core"
-version = "0.1.0"
+version = "0.9.0"
 dependencies = [
  "axum",
  "base64 0.22.1",
@@ -937,7 +1150,7 @@ dependencies = [
  "libsqlite3-sys",
  "liquid",
  "liquid-core",
- "md5",
+ "md5 0.8.1",
  "mlua",
  "ort",
  "pagefind",
@@ -965,7 +1178,7 @@ dependencies = [
 
 [[package]]
 name = "bds-editor"
-version = "0.1.0"
+version = "0.9.0"
 dependencies = [
  "cosmic-text",
  "iced",
@@ -975,7 +1188,7 @@ dependencies = [
 
 [[package]]
 name = "bds-mcp"
-version = "0.1.0"
+version = "0.9.0"
 dependencies = [
  "bds-core",
  "serde_json",
@@ -984,11 +1197,30 @@ dependencies = [
 
 [[package]]
 name = "bds-package-runtime"
-version = "0.1.0"
+version = "0.9.0"
+
+[[package]]
+name = "bds-release"
+version = "0.9.0"
+dependencies = [
+ "apple-bundles",
+ "apple-codesign",
+ "apple-dmg",
+ "flate2",
+ "icns",
+ "plist",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "simple-file-manifest",
+ "tar",
+ "tempfile",
+ "zip 8.6.0",
+]
 
 [[package]]
 name = "bds-server"
-version = "0.1.0"
+version = "0.9.0"
 dependencies = [
  "anyhow",
  "bds-core",
@@ -1009,7 +1241,7 @@ dependencies = [
 
 [[package]]
 name = "bds-ui"
-version = "0.1.0"
+version = "0.9.0"
 dependencies = [
  "anyhow",
  "bds-core",
@@ -1027,6 +1259,7 @@ dependencies = [
  "regex",
  "rfd",
  "serde_json",
+ "serde_yaml 0.9.34+deprecated",
  "syn 3.0.2",
  "tempfile",
  "tokio",
@@ -1134,6 +1367,16 @@ dependencies = [
  "wyz",
 ]
 
+[[package]]
+name = "bitvec-nom2"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d988fcc40055ceaa85edc55875a08f8abd29018582647fd82ad6128dba14a5f0"
+dependencies = [
+ "bitvec",
+ "nom 7.1.3",
+]
+
 [[package]]
 name = "blake2"
 version = "0.11.0-rc.6"
@@ -1168,6 +1411,15 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "block-padding"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
+dependencies = [
+ "generic-array 0.14.7",
+]
+
 [[package]]
 name = "block-padding"
 version = "0.4.2"
@@ -1215,7 +1467,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "62ce3946557b35e71d1bbe07ec385073ce9eda05043f95de134eb578fcf1a298"
 dependencies = [
  "byteorder",
- "cipher",
+ "cipher 0.5.2",
 ]
 
 [[package]]
@@ -1305,6 +1557,12 @@ version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
+[[package]]
+name = "bytesize"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e93abca9e28e0a1b9877922aacb20576e05d4679ffa78c3d6dc22a26a216659"
+
 [[package]]
 name = "bytestring"
 version = "1.5.1"
@@ -1314,6 +1572,26 @@ dependencies = [
  "bytes",
 ]
 
+[[package]]
+name = "bzip2"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdb116a6ef3f6c3698828873ad02c3014b3c85cadb88496095628e3ef1e347f8"
+dependencies = [
+ "bzip2-sys",
+ "libc",
+]
+
+[[package]]
+name = "bzip2-sys"
+version = "0.1.13+1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225bff33b2141874fe80d71e07d6eec4f85c5c216453dd96388240f96e1acc14"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
+
 [[package]]
 name = "cairo-rs"
 version = "0.18.5"
@@ -1399,13 +1677,22 @@ dependencies = [
  "rustversion",
 ]
 
+[[package]]
+name = "cbc"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
+dependencies = [
+ "cipher 0.4.4",
+]
+
 [[package]]
 name = "cbc"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce2dc9ee5f88d11e0beb842c88b33c8a5cf0d1329c4b19494af42b07dbfe8896"
 dependencies = [
- "cipher",
+ "cipher 0.5.2",
 ]
 
 [[package]]
@@ -1455,7 +1742,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
  "cfg-if",
- "cipher",
+ "cipher 0.5.2",
  "cpufeatures 0.3.0",
  "rand_core 0.10.1",
  "zeroize",
@@ -1476,6 +1763,16 @@ dependencies = [
  "windows-link 0.2.1",
 ]
 
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common 0.1.7",
+ "inout 0.1.4",
+]
+
 [[package]]
 name = "cipher"
 version = "0.5.2"
@@ -1484,7 +1781,7 @@ checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
 dependencies = [
  "block-buffer 0.12.1",
  "crypto-common 0.2.2",
- "inout",
+ "inout 0.2.2",
  "zeroize",
 ]
 
@@ -1679,6 +1976,19 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "console"
+version = "0.15.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "054ccb5b10f9f2cbf51eb355ca1d05c2d279ce1804688d0db74b4733a5aeafd8"
+dependencies = [
+ "encode_unicode",
+ "libc",
+ "once_cell",
+ "unicode-width",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "console"
 version = "0.16.4"
@@ -1691,6 +2001,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
 [[package]]
 name = "const-oid"
 version = "0.10.2"
@@ -1704,7 +2020,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4481a617ad9a412be3b97c5d403fef8ed023103368908b9c50af598ff467cc1e"
 dependencies = [
  "const_format_proc_macros",
- "konst",
+ "konst 0.2.20",
 ]
 
 [[package]]
@@ -1718,6 +2034,15 @@ dependencies = [
  "unicode-xid",
 ]
 
+[[package]]
+name = "const_panic"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e262cdaac42494e3ae34c43969f9cdeb7da178bdb4b66fa6a1ea2edb4c8ae652"
+dependencies = [
+ "typewit",
+]
+
 [[package]]
 name = "convert_case"
 version = "0.10.0"
@@ -1758,6 +2083,15 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "cookie-factory"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9885fa71e26b8ab7855e2ec7cae6e9b380edff76cd052e07c683a0319d51b3a2"
+dependencies = [
+ "futures",
+]
+
 [[package]]
 name = "cookie_store"
 version = "0.22.1"
@@ -1811,7 +2145,7 @@ dependencies = [
  "bitflags 1.3.2",
  "core-foundation 0.9.4",
  "core-graphics-types 0.1.3",
- "foreign-types",
+ "foreign-types 0.5.0",
  "libc",
 ]
 
@@ -1870,6 +2204,18 @@ dependencies = [
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "cpio-archive"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f11d34b07689c21889fc89bd7cc885b3244b0157bbededf4a1c159832cd0df05"
+dependencies = [
+ "chrono",
+ "is_executable",
+ "simple-file-manifest",
+ "thiserror 1.0.69",
+]
+
 [[package]]
 name = "cpubits"
 version = "0.1.1"
@@ -1894,6 +2240,21 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "crc"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
+dependencies = [
+ "crc-catalog",
+]
+
+[[package]]
+name = "crc-catalog"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
+
 [[package]]
 name = "crc32fast"
 version = "1.5.0"
@@ -1989,6 +2350,18 @@ dependencies = [
  "wgpu",
 ]
 
+[[package]]
+name = "crypto-bigint"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
+dependencies = [
+ "generic-array 0.14.7",
+ "rand_core 0.6.4",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "crypto-bigint"
 version = "0.7.5"
@@ -2033,10 +2406,27 @@ version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3633a51a39c69ebbaa4feaa694bd83d241e4093901c84a0963b19d9bb3f0cf8f"
 dependencies = [
- "crypto-bigint",
+ "crypto-bigint 0.7.5",
  "rand_core 0.10.1",
 ]
 
+[[package]]
+name = "cryptographic-message-syntax"
+version = "0.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97a99e58d7755c646cb3f2a138d99f90da4c495282e1700b82daff8a48759ce0"
+dependencies = [
+ "bcder",
+ "bytes",
+ "chrono",
+ "hex",
+ "pem",
+ "reqwest",
+ "ring",
+ "signature 2.2.0",
+ "x509-certificate",
+]
+
 [[package]]
 name = "csscolorparser"
 version = "0.6.2"
@@ -2108,7 +2498,7 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baaca1c4b237092596f64d571e9db6ce4109c4ef9742e27590f1709594461f21"
 dependencies = [
- "cipher",
+ "cipher 0.5.2",
 ]
 
 [[package]]
@@ -2127,6 +2517,21 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f27ae1dd37df86211c42e150270f82743308803d90a6f6e6651cd730d5e1732f"
 
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "curve25519-dalek-derive",
+ "fiat-crypto 0.2.9",
+ "rand_core 0.6.4",
+ "rustc_version",
+ "subtle",
+]
+
 [[package]]
 name = "curve25519-dalek"
 version = "5.0.0"
@@ -2137,7 +2542,7 @@ dependencies = [
  "cpufeatures 0.3.0",
  "curve25519-dalek-derive",
  "digest 0.11.3",
- "fiat-crypto",
+ "fiat-crypto 0.3.0",
  "rand_core 0.10.1",
  "rustc_version",
  "subtle",
@@ -2360,9 +2765,41 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "708b509edf7889e53d7efb0ffadd994cc6c2345ccb62f55cfd6b0682165e4fa6"
 dependencies = [
  "dbus",
+ "openssl",
  "zeroize",
 ]
 
+[[package]]
+name = "defmt"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1"
+dependencies = [
+ "bitflags 1.3.2",
+ "defmt-macros",
+]
+
+[[package]]
+name = "defmt-macros"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8"
+dependencies = [
+ "defmt-parser",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "defmt-parser"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
+dependencies = [
+ "thiserror 2.0.19",
+]
+
 [[package]]
 name = "delegate"
 version = "0.13.5"
@@ -2380,14 +2817,25 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5729f5117e208430e437df2f4843f5e5952997175992d1414f94c57d61e270b4"
 
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid 0.9.6",
+ "pem-rfc7468 0.7.0",
+ "zeroize",
+]
+
 [[package]]
 name = "der"
 version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a69dedd701da44b0536442edf09c81a64b0ab97a7a4a5e3d1971f00027cbc63d"
 dependencies = [
- "const-oid",
- "pem-rfc7468",
+ "const-oid 0.10.2",
+ "pem-rfc7468 1.0.0",
  "zeroize",
 ]
 
@@ -2397,6 +2845,17 @@ version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 
+[[package]]
+name = "derive_arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "derive_builder"
 version = "0.20.2"
@@ -2451,13 +2910,35 @@ dependencies = [
  "unicode-xid",
 ]
 
+[[package]]
+name = "des"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffdd80ce8ce993de27e9f063a444a4d53ce8e8db4c1f00cc03af5ad5a9867a1e"
+dependencies = [
+ "cipher 0.4.4",
+]
+
 [[package]]
 name = "des"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "916a94e407b54f9034d71dd748234cd1e516ced6284009906ae246f177eafe5a"
 dependencies = [
- "cipher",
+ "cipher 0.5.2",
+]
+
+[[package]]
+name = "dialoguer"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "658bce805d770f407bc62102fca7c2c64ceef2fbcb2b8bd19d2765ce093980de"
+dependencies = [
+ "console 0.15.11",
+ "shell-words",
+ "tempfile",
+ "thiserror 1.0.69",
+ "zeroize",
 ]
 
 [[package]]
@@ -2512,6 +2993,12 @@ version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "56254986775e3233ffa9c4d7d3faaf6d36a2c09d30b20687e9f88bc8bafc16c8"
 
+[[package]]
+name = "difference"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "524cbf6897b527295dff137cec09ecf3a05f4fddffd7dfcd1585403449e74198"
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -2519,7 +3006,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer 0.10.4",
+ "const-oid 0.9.6",
  "crypto-common 0.1.7",
+ "subtle",
 ]
 
 [[package]]
@@ -2529,7 +3018,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
  "block-buffer 0.12.1",
- "const-oid",
+ "const-oid 0.10.2",
  "crypto-common 0.2.2",
  "ctutils",
 ]
@@ -2697,18 +3186,31 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
 
+[[package]]
+name = "ecdsa"
+version = "0.16.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
+dependencies = [
+ "der 0.7.10",
+ "digest 0.10.7",
+ "elliptic-curve 0.13.8",
+ "signature 2.2.0",
+ "spki 0.7.3",
+]
+
 [[package]]
 name = "ecdsa"
 version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0681a4fc24c767085329728d8dfba959af91228aa4610cca4f8ce317ba46ae0"
 dependencies = [
- "der",
+ "der 0.8.1",
  "digest 0.11.3",
- "elliptic-curve",
+ "elliptic-curve 0.14.1",
  "rfc6979",
- "signature",
- "spki",
+ "signature 3.0.0",
+ "spki 0.8.0",
  "zeroize",
 ]
 
@@ -2718,8 +3220,8 @@ version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29fcf32e6c73d1079f83ab4d782de2d81620346a5f38c6237a86a22f8368980a"
 dependencies = [
- "pkcs8",
- "signature",
+ "pkcs8 0.11.0",
+ "signature 3.0.0",
 ]
 
 [[package]]
@@ -2728,12 +3230,12 @@ version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ebaa1a2bf1290ab3bfe5a7b771d050ebffab2711c19a81691c683a5144a25de"
 dependencies = [
- "curve25519-dalek",
+ "curve25519-dalek 5.0.0",
  "ed25519",
  "rand_core 0.10.1",
  "serde",
  "sha2 0.11.0",
- "signature",
+ "signature 3.0.0",
  "subtle",
  "zeroize",
 ]
@@ -2744,24 +3246,43 @@ version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
 
+[[package]]
+name = "elliptic-curve"
+version = "0.13.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
+dependencies = [
+ "base16ct 0.2.0",
+ "crypto-bigint 0.5.5",
+ "digest 0.10.7",
+ "ff 0.13.1",
+ "generic-array 0.14.7",
+ "group 0.13.0",
+ "pkcs8 0.10.2",
+ "rand_core 0.6.4",
+ "sec1 0.7.3",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "elliptic-curve"
 version = "0.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d65aa39b3a5c1c9c1b745c9a019234bb7a21b77abcb4f4d266d706e2d577d65"
 dependencies = [
- "base16ct",
- "crypto-bigint",
+ "base16ct 1.0.0",
+ "crypto-bigint 0.7.5",
  "crypto-common 0.2.2",
  "digest 0.11.3",
- "ff",
- "group",
- "hkdf",
+ "ff 0.14.0",
+ "group 0.14.0",
+ "hkdf 0.13.0",
  "hybrid-array",
- "pem-rfc7468",
- "pkcs8",
+ "pem-rfc7468 1.0.0",
+ "pkcs8 0.11.0",
  "rand_core 0.10.1",
- "sec1",
+ "sec1 0.8.1",
  "subtle",
  "zeroize",
 ]
@@ -2829,6 +3350,29 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "env_filter"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "900d271a03799a1ee8d1ca9b19893b48ca674a9284fefcfb85f05e74ed314217"
+dependencies = [
+ "log",
+ "regex",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.11.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de671bd27a75a797dc9ae289ba1e77276e75e2026408aab65185384e2d5cd3f6"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "env_filter",
+ "jiff",
+ "log",
+]
+
 [[package]]
 name = "envy"
 version = "0.4.2"
@@ -3002,6 +3546,18 @@ version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
 
+[[package]]
+name = "fatfs"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05669f8e7e2d7badc545c513710f0eba09c2fbef683eb859fd79c46c355048e0"
+dependencies = [
+ "bitflags 1.3.2",
+ "byteorder",
+ "chrono",
+ "log",
+]
+
 [[package]]
 name = "fax"
 version = "0.2.7"
@@ -3017,6 +3573,22 @@ dependencies = [
  "simd-adler32",
 ]
 
+[[package]]
+name = "fearless_simd"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97b65636e5b9ef369943878ac74335ba1c55c1cb6adbf1e2c293c624248d693"
+
+[[package]]
+name = "ff"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
+dependencies = [
+ "rand_core 0.6.4",
+ "subtle",
+]
+
 [[package]]
 name = "ff"
 version = "0.14.0"
@@ -3027,6 +3599,12 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
 [[package]]
 name = "fiat-crypto"
 version = "0.3.0"
@@ -3043,6 +3621,20 @@ dependencies = [
  "rustc_version",
 ]
 
+[[package]]
+name = "figment"
+version = "0.10.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cb01cd46b0cf372153850f4c6c272d9cbea2da513e07538405148f95bd789f3"
+dependencies = [
+ "atomic",
+ "pear",
+ "serde",
+ "toml 0.8.2",
+ "uncased",
+ "version_check",
+]
+
 [[package]]
 name = "filedescriptor"
 version = "0.8.3"
@@ -3054,6 +3646,16 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "filetime"
+version = "0.2.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759"
+dependencies = [
+ "cfg-if",
+ "libc",
+]
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.9"
@@ -3080,6 +3682,7 @@ checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
+ "zlib-rs",
 ]
 
 [[package]]
@@ -3188,6 +3791,15 @@ dependencies = [
  "ttf-parser",
 ]
 
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared 0.1.1",
+]
+
 [[package]]
 name = "foreign-types"
 version = "0.5.0"
@@ -3195,7 +3807,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
 dependencies = [
  "foreign-types-macros",
- "foreign-types-shared",
+ "foreign-types-shared 0.3.1",
 ]
 
 [[package]]
@@ -3209,6 +3821,12 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
 [[package]]
 name = "foreign-types-shared"
 version = "0.3.1"
@@ -3230,6 +3848,15 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
 
+[[package]]
+name = "fscommon"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "315ce685aca5ddcc5a3e7e436ef47d4a5d0064462849b6f0f628c28140103531"
+dependencies = [
+ "log",
+]
+
 [[package]]
 name = "funty"
 version = "2.0.0"
@@ -3436,6 +4063,7 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
  "typenum",
  "version_check",
+ "zeroize",
 ]
 
 [[package]]
@@ -3670,6 +4298,29 @@ dependencies = [
  "system-deps",
 ]
 
+[[package]]
+name = "goblin"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daa0a64d21a7eb230583b4c5f4e23b7e4e57974f96620f42a7e75e08ae66d745"
+dependencies = [
+ "log",
+ "plain",
+ "scroll",
+]
+
+[[package]]
+name = "gpt"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3696fafb1ecdcc2ae3ce337de73e9202806068594b77d22fdf2f3573c5ec2219"
+dependencies = [
+ "bitflags 2.13.1",
+ "crc",
+ "simple-bytes",
+ "uuid",
+]
+
 [[package]]
 name = "gpu-alloc"
 version = "0.6.2"
@@ -3721,13 +4372,24 @@ dependencies = [
  "bitflags 2.13.1",
 ]
 
+[[package]]
+name = "group"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
+dependencies = [
+ "ff 0.13.1",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
 [[package]]
 name = "group"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7fd1a1c7a5206c5b7a3f5a0d7ccd3ff85d0c8f5133d62a02680255b0004af5f4"
 dependencies = [
- "ff",
+ "ff 0.14.0",
  "rand_core 0.10.1",
  "subtle",
 ]
@@ -3813,6 +4475,25 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "h2"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http 1.4.2",
+ "indexmap 2.14.0",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
 [[package]]
 name = "half"
 version = "2.7.1"
@@ -3844,6 +4525,15 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.15.5"
@@ -3877,6 +4567,15 @@ dependencies = [
  "foldhash 0.2.0",
 ]
 
+[[package]]
+name = "hayro-jpeg2000"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c75ab947623ef4ccaa7acf0579edf7cbb5a73838e3839a7be73335e522f433a1"
+dependencies = [
+ "fearless_simd",
+]
+
 [[package]]
 name = "heck"
 version = "0.4.1"
@@ -3933,13 +4632,31 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac 0.12.1",
+]
+
 [[package]]
 name = "hkdf"
 version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4aaa26c720c68b866f2c96ef5c1264b3e6f473fe5d4ce61cd44bbe913e553018"
 dependencies = [
- "hmac",
+ "hmac 0.13.0",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -4084,6 +4801,7 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-core",
+ "h2 0.4.15",
  "http 1.4.2",
  "http-body",
  "httparse",
@@ -4105,6 +4823,7 @@ dependencies = [
  "hyper",
  "hyper-util",
  "rustls",
+ "rustls-native-certs 0.8.4",
  "tokio",
  "tokio-rustls",
  "tower-service",
@@ -4351,6 +5070,17 @@ dependencies = [
  "winit",
 ]
 
+[[package]]
+name = "icns"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "467efeb2c1e570cebb9863f9173447f8fe92303d66adc97cb89ac824b60e7a0f"
+dependencies = [
+ "byteorder",
+ "hayro-jpeg2000",
+ "png 0.18.1",
+]
+
 [[package]]
 name = "icu_collections"
 version = "2.2.0"
@@ -4567,7 +5297,7 @@ version = "0.18.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9433806cd6b4ec1aba79c021c7e4c58fb4c3b9977c085062e611ac929998fb0c"
 dependencies = [
- "console",
+ "console 0.16.4",
  "portable-atomic",
  "unicode-width",
  "unit-prefix",
@@ -4583,13 +5313,29 @@ dependencies = [
  "rustversion",
 ]
 
+[[package]]
+name = "inlinable_string"
+version = "0.1.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8fae54786f62fb2918dcfae3d568594e50eb9b5c25bf04371af6fe7516452fb"
+
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "block-padding 0.3.3",
+ "generic-array 0.14.7",
+]
+
 [[package]]
 name = "inout"
 version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
 dependencies = [
- "block-padding",
+ "block-padding 0.4.2",
  "hybrid-array",
 ]
 
@@ -4673,12 +5419,30 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "is_executable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82cb6a9f675da968c63b6208c641b9dca58fc0133ae53375736b1767b0cab8bd"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "is_terminal_polyfill"
 version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
 
+[[package]]
+name = "itertools"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itertools"
 version = "0.14.0"
@@ -4726,6 +5490,42 @@ dependencies = [
  "system-deps",
 ]
 
+[[package]]
+name = "jiff"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "668b7183bd07af9a4885f5c35b0cc5c83c4607a913c16b7e17291832910d2dcc"
+dependencies = [
+ "defmt",
+ "jiff-core",
+ "jiff-static",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+]
+
+[[package]]
+name = "jiff-core"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7feca88439efe53da3754500c1851dedf3cb36c524dd5cf8225cc0794de95d09"
+dependencies = [
+ "defmt",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a69dcb3a21cfb32ce1cd056169337ca284af0766dd766e7878819b251a49204"
+dependencies = [
+ "jiff-core",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "jni"
 version = "0.21.1"
@@ -4881,6 +5681,7 @@ dependencies = [
  "byteorder",
  "dbus-secret-service",
  "log",
+ "openssl",
  "security-framework 2.11.1",
  "security-framework 3.7.0",
  "windows-sys 0.60.2",
@@ -4913,6 +5714,26 @@ dependencies = [
  "konst_macro_rules",
 ]
 
+[[package]]
+name = "konst"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97feab15b395d1860944abe6a8dd8ed9f8eadfae01750fada8427abda531d887"
+dependencies = [
+ "const_panic",
+ "konst_kernel",
+ "typewit",
+]
+
+[[package]]
+name = "konst_kernel"
+version = "0.3.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4b1eb7788f3824c629b1116a7a9060d6e898c358ebff59070093d51103dcc3c"
+dependencies = [
+ "typewit",
+]
+
 [[package]]
 name = "konst_macro_rules"
 version = "0.2.19"
@@ -4967,6 +5788,9 @@ name = "lazy_static"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin",
+]
 
 [[package]]
 name = "lebe"
@@ -5043,6 +5867,7 @@ version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "328c4789d42200f1eeec05bd86c9c13c7f091d2ba9a6ea35acdf51f31bc0f043"
 dependencies = [
+ "cc",
  "pkg-config",
 ]
 
@@ -5399,6 +6224,17 @@ version = "0.15.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e20f57f9918e5bd7bc58c22cdd70a6afc7375d4dd9683af5f2b34bd3d2bba619"
 
+[[package]]
+name = "lzma-sys"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fda04ab3764e6cde78b9974eec4f779acaba7c4e84b36eca3cf77c581b85d27"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+]
+
 [[package]]
 name = "mac_address"
 version = "1.1.8"
@@ -5494,6 +6330,22 @@ dependencies = [
  "rayon",
 ]
 
+[[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "md5"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "490cc448043f947bae3cbee9c203358d62dbee0db12107a74be5c30ccfd09771"
+
 [[package]]
 name = "md5"
 version = "0.8.1"
@@ -5539,7 +6391,7 @@ dependencies = [
  "bitflags 2.13.1",
  "block",
  "core-graphics-types 0.2.0",
- "foreign-types",
+ "foreign-types 0.5.0",
  "log",
  "objc",
  "paste",
@@ -5582,13 +6434,33 @@ dependencies = [
  "unicase",
 ]
 
+[[package]]
+name = "minicbor"
+version = "0.25.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0452a60c1863c1f50b5f77cd295e8d2786849f35883f0b9e18e7e6e1b5691b0"
+dependencies = [
+ "minicbor-derive 0.15.3",
+]
+
 [[package]]
 name = "minicbor"
 version = "2.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b7a5041e12946f8b7d3f5a9d96383a19d694b9335457c522be7815b9abafb02"
 dependencies = [
- "minicbor-derive",
+ "minicbor-derive 0.19.4",
+]
+
+[[package]]
+name = "minicbor-derive"
+version = "0.15.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd2209fff77f705b00c737016a48e73733d7fbccb8b007194db148f03561fb70"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -5648,7 +6520,7 @@ dependencies = [
  "hybrid-array",
  "kem",
  "module-lattice",
- "pkcs8",
+ "pkcs8 0.11.0",
  "rand_core 0.10.1",
  "sha3 0.11.0",
 ]
@@ -5926,6 +6798,22 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
+dependencies = [
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.7",
+ "smallvec",
+ "zeroize",
+]
+
 [[package]]
 name = "num-complex"
 version = "0.4.6"
@@ -5962,6 +6850,16 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-iter"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c92800bd69a1eac91786bcfe9da64a897eb72911b8dc3095decbd07429e8048b"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
 [[package]]
 name = "num-rational"
 version = "0.4.2"
@@ -6442,6 +7340,29 @@ dependencies = [
  "objc2-foundation 0.3.2",
 ]
 
+[[package]]
+name = "object"
+version = "0.36.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
+dependencies = [
+ "crc32fast",
+ "flate2",
+ "hashbrown 0.15.5",
+ "indexmap 2.14.0",
+ "memchr",
+ "ruzstd",
+]
+
+[[package]]
+name = "oid-registry"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8d8034d9489cdaf79228eb9f6a3b8d7bb32ba00d6645ebd48eef4077ceb5bd9"
+dependencies = [
+ "asn1-rs",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -6486,6 +7407,65 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "openssl"
+version = "0.10.81"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
+dependencies = [
+ "bitflags 2.13.1",
+ "cfg-if",
+ "foreign-types 0.3.2",
+ "libc",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "openssl-src"
+version = "300.6.1+3.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46eb8fb9fb3b61ce1c0f8a026c4c1a0714d3a9e138e7fbde78753ce2babc3846"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
+dependencies = [
+ "cc",
+ "libc",
+ "openssl-src",
+ "pkg-config",
+ "vcpkg",
+]
+
 [[package]]
 name = "option-ext"
 version = "0.2.0"
@@ -6578,16 +7558,44 @@ dependencies = [
  "ttf-parser",
 ]
 
+[[package]]
+name = "p12"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4873306de53fe82e7e484df31e1e947d61514b6ea2ed6cd7b45d63006fd9224"
+dependencies = [
+ "cbc 0.1.2",
+ "cipher 0.4.4",
+ "des 0.8.1",
+ "getrandom 0.2.17",
+ "hmac 0.12.1",
+ "lazy_static",
+ "rc2",
+ "sha1 0.10.7",
+ "yasna",
+]
+
+[[package]]
+name = "p256"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
+dependencies = [
+ "ecdsa 0.16.9",
+ "elliptic-curve 0.13.8",
+ "primeorder 0.13.6",
+]
+
 [[package]]
 name = "p256"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2c9239b2dbc807adbbe147e8cf72ea7450c3a0aabe62cb8e75ff4ec22e1f72a"
 dependencies = [
- "ecdsa",
- "elliptic-curve",
+ "ecdsa 0.17.0",
+ "elliptic-curve 0.14.1",
  "primefield",
- "primeorder",
+ "primeorder 0.14.0",
  "sha2 0.11.0",
 ]
 
@@ -6597,11 +7605,11 @@ version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d17b851e6b3e378ab4ecb07fa2ed23f4d15f075735f8fec9fa1e7bdce5f8301f"
 dependencies = [
- "ecdsa",
- "elliptic-curve",
- "fiat-crypto",
+ "ecdsa 0.17.0",
+ "elliptic-curve 0.14.1",
+ "fiat-crypto 0.3.0",
  "primefield",
- "primeorder",
+ "primeorder 0.14.0",
  "sha2 0.11.0",
 ]
 
@@ -6611,11 +7619,11 @@ version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ad64cc32c2dc466317c12ee5853e61f159f9eab1fe7efade0395dc2e7b43449"
 dependencies = [
- "base16ct",
- "ecdsa",
- "elliptic-curve",
+ "base16ct 1.0.0",
+ "ecdsa 0.17.0",
+ "elliptic-curve 0.14.1",
  "primefield",
- "primeorder",
+ "primeorder 0.14.0",
  "sha2 0.11.0",
 ]
 
@@ -6625,7 +7633,7 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4f3a5ae18f65a85c67a77d18d42d3606c07948e3c17c1e5f74852b26589e88a5"
 dependencies = [
- "base16ct",
+ "base16ct 1.0.0",
  "byteorder",
  "bytes",
  "delegate",
@@ -6652,7 +7660,7 @@ dependencies = [
  "base64 0.22.1",
  "bit-set 0.10.0",
  "clap",
- "console",
+ "console 0.16.4",
  "convert_case 0.11.0",
  "either",
  "emojis",
@@ -6664,7 +7672,7 @@ dependencies = [
  "lazy_static",
  "lexical-core",
  "lol_html",
- "minicbor",
+ "minicbor 2.2.2",
  "minifier",
  "pagefind_stem",
  "path-slash",
@@ -6803,7 +7811,49 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "112d82ceb8c5bf524d9af484d4e4970c9fd5a0cc15ba14ad93dccd28873b0629"
 dependencies = [
  "digest 0.11.3",
- "hmac",
+ "hmac 0.13.0",
+]
+
+[[package]]
+name = "pear"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdeeaa00ce488657faba8ebf44ab9361f9365a97bd39ffb8a60663f57ff4b467"
+dependencies = [
+ "inlinable_string",
+ "pear_codegen",
+ "yansi",
+]
+
+[[package]]
+name = "pear_codegen"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4bab5b985dc082b345f812b7df84e1bef27e7207b39e448439ba8bd69c93f147"
+dependencies = [
+ "proc-macro2",
+ "proc-macro2-diagnostics",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "pem"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
+dependencies = [
+ "base64 0.22.1",
+ "serde_core",
+]
+
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
 ]
 
 [[package]]
@@ -7027,14 +8077,25 @@ dependencies = [
  "futures-io",
 ]
 
+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der 0.7.10",
+ "pkcs8 0.10.2",
+ "spki 0.7.3",
+]
+
 [[package]]
 name = "pkcs1"
 version = "0.8.0-rc.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "986d2e952779af96ea048f160fd9194e1751b4faea78bcf3ceb456efe008088e"
 dependencies = [
- "der",
- "spki",
+ "der 0.8.1",
+ "spki 0.8.0",
 ]
 
 [[package]]
@@ -7045,13 +8106,23 @@ checksum = "63d440a804ec8d6fafbb6b84471e013286658d373248927692ab3366686220ca"
 dependencies = [
  "aes",
  "aes-gcm",
- "cbc",
- "der",
+ "cbc 0.2.1",
+ "der 0.8.1",
  "pbkdf2",
  "rand_core 0.10.1",
  "scrypt",
  "sha2 0.11.0",
- "spki",
+ "spki 0.8.0",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der 0.7.10",
+ "spki 0.7.3",
 ]
 
 [[package]]
@@ -7060,10 +8131,10 @@ version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
 dependencies = [
- "der",
+ "der 0.8.1",
  "pkcs5",
  "rand_core 0.10.1",
- "spki",
+ "spki 0.8.0",
 ]
 
 [[package]]
@@ -7244,21 +8315,30 @@ version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c555a6e4eb7d4e158fcb028c835c3b8642206ddc279b5c6b202ef9a8bdb592f4"
 dependencies = [
- "crypto-bigint",
+ "crypto-bigint 0.7.5",
  "crypto-common 0.2.2",
- "ff",
+ "ff 0.14.0",
  "rand_core 0.10.1",
  "subtle",
  "zeroize",
 ]
 
+[[package]]
+name = "primeorder"
+version = "0.13.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
+dependencies = [
+ "elliptic-curve 0.13.8",
+]
+
 [[package]]
 name = "primeorder"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5c9f42978c78a00e3d68f69fc03e57a234debae69da4020a4fb588fcdcd07b06"
 dependencies = [
- "elliptic-curve",
+ "elliptic-curve 0.14.1",
  "once_cell",
  "primefield",
  "serdect",
@@ -7327,6 +8407,19 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "proc-macro2-diagnostics"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "version_check",
+ "yansi",
+]
+
 [[package]]
 name = "profiling"
 version = "1.0.18"
@@ -7646,6 +8739,45 @@ version = "1.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "973443cf09a9c8656b574a866ab68dfa19f0867d0340648c7d2f6a71b8a8ea68"
 
+[[package]]
+name = "rasn"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e442690f86da40561d5548e7ffb4a18af90d1c1b3536090de847ca2d5a3a6426"
+dependencies = [
+ "arrayvec",
+ "bitvec",
+ "bitvec-nom2",
+ "bytes",
+ "chrono",
+ "either",
+ "hashbrown 0.14.5",
+ "konst 0.3.17",
+ "nom 7.1.3",
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+ "once_cell",
+ "rasn-derive",
+ "serde_json",
+ "snafu",
+]
+
+[[package]]
+name = "rasn-derive"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96b0d374c7e4e985e6bc97ca7e7ad1d9642a8415db2017777d6e383002edaab2"
+dependencies = [
+ "either",
+ "itertools 0.13.0",
+ "proc-macro2",
+ "quote",
+ "rayon",
+ "syn 2.0.119",
+ "uuid",
+]
+
 [[package]]
 name = "ratatui"
 version = "0.30.2"
@@ -7866,6 +8998,15 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "rc2"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62c64daa8e9438b84aaae55010a93f396f8e60e3911590fcba770d04643fc1dd"
+dependencies = [
+ "cipher 0.4.4",
+]
+
 [[package]]
 name = "read-fonts"
 version = "0.35.0"
@@ -8021,6 +9162,7 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
+ "h2 0.4.15",
  "http 1.4.2",
  "http-body",
  "http-body-util",
@@ -8033,6 +9175,7 @@ dependencies = [
  "pin-project-lite",
  "quinn",
  "rustls",
+ "rustls-native-certs 0.8.4",
  "rustls-pki-types",
  "serde",
  "serde_json",
@@ -8075,8 +9218,8 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4a459cddafb3fe76b31fd8f1108007566c40301feb64dc7b54656eb7388172b"
 dependencies = [
- "crypto-bigint",
- "hmac",
+ "crypto-bigint 0.7.5",
+ "hmac 0.13.0",
 ]
 
 [[package]]
@@ -8142,22 +9285,42 @@ version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c20b6793b5c2fa6553b250154b78d6d0db37e72700ae35fad9387a46f487c97"
 
+[[package]]
+name = "rsa"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
+dependencies = [
+ "const-oid 0.9.6",
+ "digest 0.10.7",
+ "num-bigint-dig",
+ "num-integer",
+ "num-traits",
+ "pkcs1 0.7.5",
+ "pkcs8 0.10.2",
+ "rand_core 0.6.4",
+ "signature 2.2.0",
+ "spki 0.7.3",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "rsa"
 version = "0.10.0-rc.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "30b2aa4ba0d89f73d1e332df05be0eeab8840351c36ca5654341dfdb57bb3caf"
 dependencies = [
- "const-oid",
- "crypto-bigint",
+ "const-oid 0.10.2",
+ "crypto-bigint 0.7.5",
  "crypto-primes",
  "digest 0.11.3",
- "pkcs1",
- "pkcs8",
+ "pkcs1 0.8.0-rc.4",
+ "pkcs8 0.11.0",
  "rand_core 0.10.1",
  "sha2 0.11.0",
- "signature",
- "spki",
+ "signature 3.0.0",
+ "spki 0.8.0",
  "zeroize",
 ]
 
@@ -8209,21 +9372,21 @@ dependencies = [
  "aes",
  "aws-lc-rs",
  "bitflags 2.13.1",
- "block-padding",
+ "block-padding 0.4.2",
  "byteorder",
  "bytes",
- "cbc",
- "cipher",
- "crypto-bigint",
+ "cbc 0.2.1",
+ "cipher 0.5.2",
+ "crypto-bigint 0.7.5",
  "ctr",
- "curve25519-dalek",
+ "curve25519-dalek 5.0.0",
  "data-encoding",
  "delegate",
- "der",
+ "der 0.8.1",
  "digest 0.11.3",
- "ecdsa",
+ "ecdsa 0.17.0",
  "ed25519-dalek",
- "elliptic-curve",
+ "elliptic-curve 0.14.1",
  "enum_dispatch",
  "flate2",
  "futures",
@@ -8231,37 +9394,37 @@ dependencies = [
  "getrandom 0.4.3",
  "ghash",
  "hex-literal",
- "hmac",
- "inout",
+ "hmac 0.13.0",
+ "inout 0.2.2",
  "internal-russh-num-bigint",
  "keccak",
  "log",
- "md5",
+ "md5 0.8.1",
  "ml-kem",
  "module-lattice",
  "num-bigint",
- "p256",
+ "p256 0.14.0",
  "p384",
  "p521",
  "pageant",
  "pbkdf2",
- "pkcs1",
+ "pkcs1 0.8.0-rc.4",
  "pkcs5",
- "pkcs8",
+ "pkcs8 0.11.0",
  "polyval",
  "rand 0.10.2",
  "rand_core 0.10.1",
- "rsa",
+ "rsa 0.10.0-rc.18",
  "russh-cryptovec",
  "russh-util",
  "salsa20",
  "scrypt",
- "sec1",
- "sha1",
+ "sec1 0.8.1",
+ "sha1 0.11.0",
  "sha2 0.11.0",
  "sha3 0.12.0",
- "signature",
- "spki",
+ "signature 3.0.0",
+ "spki 0.8.0",
  "ssh-encoding",
  "ssh-key",
  "subtle",
@@ -8348,6 +9511,15 @@ dependencies = [
  "semver",
 ]
 
+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+dependencies = [
+ "nom 7.1.3",
+]
+
 [[package]]
 name = "rustix"
 version = "0.38.44"
@@ -8389,6 +9561,40 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "rustls-native-certs"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5bfb394eeed242e909609f56089eecfe5fda225042e8b171791b9c95f5931e5"
+dependencies = [
+ "openssl-probe 0.1.6",
+ "rustls-pemfile",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework 2.11.1",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
+dependencies = [
+ "openssl-probe 0.2.1",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework 3.7.0",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "rustls-pki-types"
 version = "1.15.0"
@@ -8434,6 +9640,15 @@ dependencies = [
  "unicode-script",
 ]
 
+[[package]]
+name = "ruzstd"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fad02996bfc73da3e301efe90b1837be9ed8f4a462b6ed410aa35d00381de89f"
+dependencies = [
+ "twox-hash",
+]
+
 [[package]]
 name = "ryu"
 version = "1.0.23"
@@ -8469,7 +9684,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2f874456e72520ff1375a06c588eaf074b0f01f9e9e1aada45bd9b7954a6e42c"
 dependencies = [
  "cfg-if",
- "cipher",
+ "cipher 0.5.2",
 ]
 
 [[package]]
@@ -8481,6 +9696,15 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "scoped-tls"
 version = "1.0.1"
@@ -8499,6 +9723,26 @@ version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d68f2ec51b097e4c1a75b681a8bec621909b5e91f15bb7b840c4f2f7b01148b2"
 
+[[package]]
+name = "scroll"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ab8598aa408498679922eff7fa985c25d58a90771bd6be794434c5277eab1a6"
+dependencies = [
+ "scroll_derive",
+]
+
+[[package]]
+name = "scroll_derive"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1783eabc414609e28a5ba76aee5ddd52199f7107a0b24c2e9746a1ecc34a683d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "scrypt"
 version = "0.12.0"
@@ -8524,15 +9768,29 @@ dependencies = [
  "tiny-skia",
 ]
 
+[[package]]
+name = "sec1"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
+dependencies = [
+ "base16ct 0.2.0",
+ "der 0.7.10",
+ "generic-array 0.14.7",
+ "pkcs8 0.10.2",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "sec1"
 version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d"
 dependencies = [
- "base16ct",
+ "base16ct 1.0.0",
  "ctutils",
- "der",
+ "der 0.8.1",
  "hybrid-array",
  "subtle",
  "zeroize",
@@ -8644,6 +9902,28 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "serde-xml-rs"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb3aa78ecda1ebc9ec9847d5d3aba7d618823446a049ba2491940506da6e2782"
+dependencies = [
+ "log",
+ "serde",
+ "thiserror 1.0.69",
+ "xml-rs",
+]
+
+[[package]]
+name = "serde_bytes"
+version = "0.11.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
 [[package]]
 name = "serde_core"
 version = "1.0.229"
@@ -8760,7 +10040,7 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66cf8fedced2fcf12406bcb34223dffb92eaf34908ede12fed414c82b7f00b3e"
 dependencies = [
- "base16ct",
+ "base16ct 1.0.0",
  "serde",
 ]
 
@@ -8784,6 +10064,17 @@ dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "sha1"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
 [[package]]
 name = "sha1"
 version = "0.11.0"
@@ -8838,6 +10129,12 @@ dependencies = [
  "sponge-cursor",
 ]
 
+[[package]]
+name = "shell-words"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc6fe69c597f9c37bfeeeeeb33da3530379845f10be461a66d16d03eca2ded77"
+
 [[package]]
 name = "shlex"
 version = "2.0.1"
@@ -8875,6 +10172,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest 0.10.7",
+ "rand_core 0.6.4",
+]
+
 [[package]]
 name = "signature"
 version = "3.0.0"
@@ -8916,6 +10223,18 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
 
+[[package]]
+name = "simple-bytes"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c11532d9d241904f095185f35dcdaf930b1427a94d5b01d7002d74ba19b44cc4"
+
+[[package]]
+name = "simple-file-manifest"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5dd19be0257552dd56d1bb6946f89f193c6e5b9f13cc9327c4bc84a357507c74"
+
 [[package]]
 name = "simplecss"
 version = "0.2.2"
@@ -9044,6 +10363,27 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "snafu"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e84b3f4eacbf3a1ce05eac6763b4d629d60cbc94d632e4092c54ade71f1e1a2"
+dependencies = [
+ "snafu-derive",
+]
+
+[[package]]
+name = "snafu-derive"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "socket2"
 version = "0.5.10"
@@ -9132,6 +10472,24 @@ dependencies = [
  "system-deps",
 ]
 
+[[package]]
+name = "spake2"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5482afe85a0b6ce956c945401598dbc527593c77ba51d0a87a586938b1b893a"
+dependencies = [
+ "curve25519-dalek 4.1.3",
+ "hkdf 0.12.4",
+ "rand_core 0.6.4",
+ "sha2 0.10.9",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
+
 [[package]]
 name = "spirv"
 version = "0.3.0+sdk-1.3.268.0"
@@ -9141,6 +10499,16 @@ dependencies = [
  "bitflags 2.13.1",
 ]
 
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der 0.7.10",
+]
+
 [[package]]
 name = "spki"
 version = "0.8.0"
@@ -9148,7 +10516,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d9efca8738c78ee9484207732f728b1ef517bbb1833d6fc0879ca898a522f6f"
 dependencies = [
  "base64ct",
- "der",
+ "der 0.8.1",
 ]
 
 [[package]]
@@ -9191,9 +10559,9 @@ dependencies = [
  "aes",
  "aes-gcm",
  "chacha20",
- "cipher",
+ "cipher 0.5.2",
  "ctutils",
- "des",
+ "des 0.9.0",
  "poly1305",
  "ssh-encoding",
  "zeroize",
@@ -9207,10 +10575,10 @@ checksum = "7b54d0ed0498daf3f78d82e00e28c8eec9d75a067c4cfbcc7a0f7d0f4077749e"
 dependencies = [
  "base64ct",
  "bytes",
- "crypto-bigint",
+ "crypto-bigint 0.7.5",
  "ctutils",
  "digest 0.11.3",
- "pem-rfc7468",
+ "pem-rfc7468 1.0.0",
  "zeroize",
 ]
 
@@ -9225,16 +10593,16 @@ dependencies = [
  "ctutils",
  "ed25519-dalek",
  "hex",
- "hmac",
- "p256",
+ "hmac 0.13.0",
+ "p256 0.14.0",
  "p384",
  "p521",
  "rand_core 0.10.1",
- "rsa",
- "sec1",
- "sha1",
+ "rsa 0.10.0-rc.18",
+ "sec1 0.8.1",
+ "sha1 0.11.0",
  "sha2 0.11.0",
- "signature",
+ "signature 3.0.0",
  "ssh-cipher",
  "ssh-encoding",
  "zeroize",
@@ -9465,6 +10833,17 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
 
+[[package]]
+name = "tar"
+version = "0.4.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
+dependencies = [
+ "filetime",
+ "libc",
+ "xattr",
+]
+
 [[package]]
 name = "target-lexicon"
 version = "0.12.16"
@@ -10067,6 +11446,27 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "tungstenite"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18e5b8366ee7a95b16d32197d0b2604b43a0be89dc5fac9f8e96ccafbaedda8a"
+dependencies = [
+ "byteorder",
+ "bytes",
+ "data-encoding",
+ "http 1.4.2",
+ "httparse",
+ "log",
+ "rand 0.8.7",
+ "rustls",
+ "rustls-native-certs 0.7.3",
+ "rustls-pki-types",
+ "sha1 0.10.7",
+ "thiserror 1.0.69",
+ "utf-8",
+]
+
 [[package]]
 name = "twelf"
 version = "0.15.0"
@@ -10084,6 +11484,16 @@ dependencies = [
  "toml 0.5.11",
 ]
 
+[[package]]
+name = "twox-hash"
+version = "1.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fee6b57c6a41524a810daee9286c02d7752c4253064d0b05472833a438f675"
+dependencies = [
+ "cfg-if",
+ "static_assertions",
+]
+
 [[package]]
 name = "type-map"
 version = "0.5.1"
@@ -10113,6 +11523,12 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "typed-path"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
+
 [[package]]
 name = "typeid"
 version = "1.0.3"
@@ -10125,6 +11541,21 @@ version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
+[[package]]
+name = "typewit"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "214ca0b2191785cbc06209b9ca1861e048e39b5ba33574b3cedd58363d5bb5f6"
+dependencies = [
+ "typewit_proc_macros",
+]
+
+[[package]]
+name = "typewit_proc_macros"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e36a83ea2b3c704935a01b4642946aadd445cea40b10935e3f8bd8052b8193d6"
+
 [[package]]
 name = "ucd-trie"
 version = "0.1.7"
@@ -10142,6 +11573,15 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "uncased"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1b88fcfe09e89d3866a5c11019378088af2d24c3fbd4f0543f96b479ec90697"
+dependencies = [
+ "version_check",
+]
+
 [[package]]
 name = "unic-langid"
 version = "0.9.6"
@@ -10391,6 +11831,12 @@ dependencies = [
  "xmlwriter",
 ]
 
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
 [[package]]
 name = "utf8-zero"
 version = "0.8.1"
@@ -11116,6 +12562,12 @@ dependencies = [
  "safe_arch",
 ]
 
+[[package]]
+name = "widestring"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471"
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -11828,8 +13280,8 @@ version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab12e7090f27e2ffd9322651492942d50c2926094af30601e1964337db39daf1"
 dependencies = [
- "ff",
- "group",
+ "ff 0.14.0",
+ "group 0.14.0",
  "hybrid-array",
 ]
 
@@ -11934,6 +13386,45 @@ version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ea6fc2961e4ef194dcbfe56bb845534d0dc8098940c7e5c012a258bfec6701bd"
 
+[[package]]
+name = "x509"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca3cec94c3999f31341553f358ef55f65fc031291a022cd42ec0ce7219560c76"
+dependencies = [
+ "chrono",
+ "cookie-factory",
+]
+
+[[package]]
+name = "x509-certificate"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57b9f8bcae7c1f36479821ae826d75050c60ce55146fd86d3553ed2573e2762"
+dependencies = [
+ "bcder",
+ "bytes",
+ "chrono",
+ "der 0.7.10",
+ "hex",
+ "pem",
+ "ring",
+ "signature 2.2.0",
+ "spki 0.7.3",
+ "thiserror 1.0.69",
+ "zeroize",
+]
+
+[[package]]
+name = "xattr"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
+dependencies = [
+ "libc",
+ "rustix 1.1.4",
+]
+
 [[package]]
 name = "xcursor"
 version = "0.3.10"
@@ -11981,6 +13472,15 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec7a2a501ed189703dba8b08142f057e887dfc4b2cc4db2d343ac6376ba3e0b9"
 
+[[package]]
+name = "xz2"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "388c44dc09d76f1536602ead6d325eb532f5c122f17782bd57fb47baeeb767e2"
+dependencies = [
+ "lzma-sys",
+]
+
 [[package]]
 name = "y4m"
 version = "0.8.0"
@@ -12002,6 +13502,12 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
 
+[[package]]
+name = "yasna"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd"
+
 [[package]]
 name = "yazi"
 version = "0.2.1"
@@ -12193,12 +13699,72 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "zip"
+version = "2.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fabe6324e908f85a1c52063ce7aa26b68dcb7eb6dbc83a2d148403c9bc3eba50"
+dependencies = [
+ "arbitrary",
+ "crc32fast",
+ "crossbeam-utils",
+ "displaydoc",
+ "flate2",
+ "indexmap 2.14.0",
+ "memchr",
+ "thiserror 2.0.19",
+ "zopfli",
+]
+
+[[package]]
+name = "zip"
+version = "8.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+dependencies = [
+ "crc32fast",
+ "flate2",
+ "indexmap 2.14.0",
+ "memchr",
+ "typed-path",
+ "zopfli",
+]
+
+[[package]]
+name = "zip_structs"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce824a6bfffe8942820fa36d24973b7c83a40896749a42e33de0abdd11750ee5"
+dependencies = [
+ "byteorder",
+ "bytesize",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "zlib-rs"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34b31d188d9d685a4f9c7b46d6e36631b07058d2cfe190267adce54dc230bf12"
+
 [[package]]
 name = "zmij"
 version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
 
+[[package]]
+name = "zopfli"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249"
+dependencies = [
+ "bumpalo",
+ "crc32fast",
+ "log",
+ "simd-adler32",
+]
+
 [[package]]
 name = "zstd"
 version = "0.13.3"
diff --git a/Cargo.toml b/Cargo.toml
index 831a1a4..319a1c0 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -8,11 +8,12 @@ members = [
     "crates/bds-mcp",
     "crates/bds-server",
     "crates/bds-package-runtime",
+    "crates/bds-release",
 ]
 
 [workspace.package]
 edition = "2024"
-version = "0.1.0"
+version = "0.9.0"
 license = "MIT"
 authors = ["Georg Bauer <gb@rfc1437.de>"]
 
@@ -52,7 +53,7 @@ regex = "1"
 rayon = "1.10"
 pagefind = "1.5.2"
 reqwest = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls"] }
-keyring = { version = "3", features = ["apple-native", "windows-native", "sync-secret-service"] }
+keyring = { version = "3", features = ["apple-native", "windows-native", "sync-secret-service", "vendored"] }
 diesel = { version = "2.3.11", features = ["sqlite", "returning_clauses_for_sqlite_3_35"] }
 diesel_migrations = "2.3.2"
 libsqlite3-sys = { version = "0.37.0", features = ["bundled"] }
@@ -84,5 +85,16 @@ bds-editor = { path = "crates/bds-editor" }
 bds-mcp = { path = "crates/bds-mcp" }
 bds-server = { path = "crates/bds-server" }
 
+# Portable release packaging
+apple-bundles = "0.21"
+apple-codesign = { version = "0.29", default-features = false }
+apple-dmg = "0.5"
+flate2 = "1"
+icns = "0.4"
+plist = "1"
+simple-file-manifest = "0.11"
+tar = "0.4"
+zip = { version = "8.6", default-features = false, features = ["deflate"] }
+
 [profile.release]
 strip = "symbols"
diff --git a/README.md b/README.md
index f3121e9..78cde48 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,8 @@ Packaged executables share native `bds-core` and `bds-server` dynamic libraries.
 
 Local macOS packages are ad-hoc signed without hardened runtime. A Developer ID and notarization remain optional release-channel steps for downloads that should pass Gatekeeper without a user override.
 
+Pushing a tag creates a draft Gitea release, builds native artifacts on the Linux arm64 runner, and publishes only after every target succeeds. Releases contain CLI/MCP and desktop downloads for Linux arm64/x64, macOS arm64/x64, and Windows x64. Linux desktop binaries are dynamically linked to the GTK 3, WebKitGTK 4.1, and libxdo packages supplied by the target Ubuntu architecture. macOS desktop downloads are ad-hoc-signed DMGs; Unix archives use `.tar.gz` and Windows uses `.zip`. All release packaging and Gitea API work is performed by the workspace's Rust release utility.
+
 ## Repository Map
 
 - `crates/bds-core` — data, engines, rendering, AI, publishing, and Lua
@@ -47,6 +49,7 @@ Local macOS packages are ad-hoc signed without hardened runtime. A Developer ID
 - `crates/bds-cli` — headless automation CLI over the shared engines
 - `crates/bds-mcp` — packaged stdio MCP transport over the shared MCP engine
 - `crates/bds-server` — reusable headless host, SSH transport, remote protocol, and desktop client library
+- `crates/bds-release` — portable tagged-release packaging and Gitea publishing utility
 - `specs` — authoritative Allium behavior specifications
 - `fixtures` — compatibility projects and generated-site fixtures
 - `locales` — UI and native-menu translations
diff --git a/crates/bds-editor/src/widget.rs b/crates/bds-editor/src/widget.rs
index c006ac8..df23dd8 100644
--- a/crates/bds-editor/src/widget.rs
+++ b/crates/bds-editor/src/widget.rs
@@ -822,7 +822,6 @@ where
                         }
                     }
                     shell.capture_event();
-                    return;
                 } else {
                     state.is_focused = false;
                 }
@@ -871,7 +870,6 @@ where
                         buf.set_cursor(clamped_line, clamped_col);
                     }
                     shell.capture_event();
-                    return;
                 }
             }
             Event::Mouse(mouse::Event::WheelScrolled { delta }) if cursor.is_over(bounds) => {
@@ -885,7 +883,6 @@ where
                 let max_scroll = total.saturating_sub(vis);
                 buf.scroll_by_clamped(lines, max_scroll);
                 shell.capture_event();
-                return;
             }
             Event::Keyboard(keyboard::Event::KeyPressed {
                 key,
@@ -1099,7 +1096,6 @@ where
                     _ => return,
                 }
                 shell.capture_event();
-                return;
             }
             _ => {}
         }
diff --git a/crates/bds-release/Cargo.toml b/crates/bds-release/Cargo.toml
new file mode 100644
index 0000000..b1dc187
--- /dev/null
+++ b/crates/bds-release/Cargo.toml
@@ -0,0 +1,24 @@
+[package]
+name = "bds-release"
+edition.workspace = true
+version.workspace = true
+license.workspace = true
+authors.workspace = true
+publish = false
+
+[dependencies]
+apple-bundles.workspace = true
+apple-codesign.workspace = true
+apple-dmg.workspace = true
+flate2.workspace = true
+icns.workspace = true
+plist.workspace = true
+reqwest.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+simple-file-manifest.workspace = true
+tar.workspace = true
+zip.workspace = true
+
+[dev-dependencies]
+tempfile = "3"
diff --git a/crates/bds-release/src/gitea.rs b/crates/bds-release/src/gitea.rs
new file mode 100644
index 0000000..88829ad
--- /dev/null
+++ b/crates/bds-release/src/gitea.rs
@@ -0,0 +1,424 @@
+use reqwest::{
+    StatusCode,
+    blocking::{Body, Client},
+};
+use serde::{Deserialize, Serialize};
+use std::{
+    collections::BTreeSet,
+    env,
+    error::Error,
+    fs::{File, OpenOptions},
+    io::Write,
+    path::Path,
+    process::Command,
+    thread,
+    time::Duration,
+};
+
+#[derive(Debug, Deserialize)]
+struct Issue {
+    number: u64,
+    title: String,
+    html_url: String,
+    state: String,
+    #[serde(default)]
+    labels: Vec<Label>,
+}
+
+#[derive(Debug, Deserialize)]
+struct Label {
+    name: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct Release {
+    id: u64,
+    draft: bool,
+    #[serde(default)]
+    assets: Option<Vec<Asset>>,
+}
+
+#[derive(Debug, Deserialize)]
+struct Asset {
+    id: u64,
+}
+
+#[derive(Serialize)]
+struct ReleasePayload<'a> {
+    tag_name: &'a str,
+    target_commitish: &'a str,
+    name: &'a str,
+    body: String,
+    draft: bool,
+    prerelease: bool,
+}
+
+struct Gitea {
+    client: Client,
+    api_url: String,
+    repository: String,
+    token: String,
+}
+
+impl Gitea {
+    fn from_environment() -> Result<Self, Box<dyn Error>> {
+        Ok(Self {
+            client: Client::builder().build()?,
+            api_url: required_env("GITEA_API_URL")?
+                .trim_end_matches('/')
+                .to_owned(),
+            repository: required_env("GITEA_REPOSITORY")?,
+            token: required_env("GITEA_TOKEN")?,
+        })
+    }
+
+    fn url(&self, path: &str) -> String {
+        format!("{}{path}", self.api_url)
+    }
+
+    fn issue(&self, number: u64) -> Result<Issue, Box<dyn Error>> {
+        Ok(self
+            .client
+            .get(self.url(&format!("/repos/{}/issues/{number}", self.repository)))
+            .header("Authorization", format!("token {}", self.token))
+            .send()?
+            .error_for_status()?
+            .json()?)
+    }
+
+    fn release_for_tag(&self, tag: &str) -> Result<Option<Release>, Box<dyn Error>> {
+        let response = self
+            .client
+            .get(self.url(&format!(
+                "/repos/{}/releases/tags/{}",
+                self.repository,
+                percent_encode(tag)
+            )))
+            .header("Authorization", format!("token {}", self.token))
+            .send()?;
+        if response.status() == StatusCode::NOT_FOUND {
+            Ok(None)
+        } else {
+            Ok(Some(response.error_for_status()?.json()?))
+        }
+    }
+
+    fn create_release(&self, payload: &ReleasePayload<'_>) -> Result<Release, Box<dyn Error>> {
+        Ok(self
+            .client
+            .post(self.url(&format!("/repos/{}/releases", self.repository)))
+            .header("Authorization", format!("token {}", self.token))
+            .json(payload)
+            .send()?
+            .error_for_status()?
+            .json()?)
+    }
+
+    fn update_release(
+        &self,
+        release_id: u64,
+        payload: &impl Serialize,
+    ) -> Result<Release, Box<dyn Error>> {
+        Ok(self
+            .client
+            .patch(self.url(&format!("/repos/{}/releases/{release_id}", self.repository)))
+            .header("Authorization", format!("token {}", self.token))
+            .json(payload)
+            .send()?
+            .error_for_status()?
+            .json()?)
+    }
+
+    fn delete_asset(&self, release_id: u64, asset_id: u64) -> Result<(), Box<dyn Error>> {
+        self.client
+            .delete(self.url(&format!(
+                "/repos/{}/releases/{release_id}/assets/{asset_id}",
+                self.repository
+            )))
+            .header("Authorization", format!("token {}", self.token))
+            .send()?
+            .error_for_status()?;
+        Ok(())
+    }
+
+    fn upload_asset(&self, release_id: u64, path: &Path) -> Result<(), Box<dyn Error>> {
+        let name = path
+            .file_name()
+            .and_then(|name| name.to_str())
+            .ok_or_else(|| format!("invalid release asset name: {}", path.display()))?;
+        for attempt in 1..=3 {
+            let file = File::open(path)?;
+            let length = file.metadata()?.len();
+            let body = Body::sized(file, length);
+            let response = self
+                .client
+                .post(self.url(&format!(
+                    "/repos/{}/releases/{release_id}/assets",
+                    self.repository
+                )))
+                .query(&[("name", name)])
+                .header("Authorization", format!("token {}", self.token))
+                .header("Content-Type", "application/octet-stream")
+                .body(body)
+                .send();
+            match response {
+                Ok(response) if response.status().is_success() => {
+                    println!("uploaded {}", path.display());
+                    return Ok(());
+                }
+                Ok(response)
+                    if attempt < 3
+                        && (response.status().is_server_error()
+                            || response.status() == StatusCode::TOO_MANY_REQUESTS) => {}
+                Ok(response) => {
+                    return Err(response.error_for_status().unwrap_err().into());
+                }
+                Err(error) if attempt < 3 => {
+                    eprintln!("asset upload attempt {attempt} failed: {error}");
+                }
+                Err(error) => return Err(error.into()),
+            }
+            thread::sleep(Duration::from_secs(attempt));
+        }
+        unreachable!("upload retry loop always returns")
+    }
+}
+
+pub(crate) fn prepare() -> Result<(), Box<dyn Error>> {
+    let gitea = Gitea::from_environment()?;
+    let tag = required_env("GITEA_REF_NAME")?;
+    let sha = required_env("GITEA_SHA")?;
+    let server = required_env("GITEA_SERVER_URL")?;
+    let messages = commit_messages(&sha)?;
+    let issues = issue_numbers(&messages)
+        .into_iter()
+        .map(|number| gitea.issue(number))
+        .collect::<Result<Vec<_>, _>>()?;
+    let closed = issues
+        .iter()
+        .filter(|issue| issue.state == "closed")
+        .collect::<Vec<_>>();
+    let payload = ReleasePayload {
+        tag_name: &tag,
+        target_commitish: &sha,
+        name: &tag,
+        body: release_body(closed.iter().copied(), &server, &gitea.repository, &sha),
+        draft: true,
+        prerelease: false,
+    };
+
+    let release = if let Some(existing) = gitea.release_for_tag(&tag)? {
+        if !existing.draft {
+            return Err(format!("release {tag} is already published").into());
+        }
+        for asset in existing.assets.unwrap_or_default() {
+            gitea.delete_asset(existing.id, asset.id)?;
+        }
+        gitea.update_release(existing.id, &payload)?
+    } else {
+        gitea.create_release(&payload)?
+    };
+
+    let output_path = required_env("GITHUB_OUTPUT")?;
+    writeln!(
+        OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(output_path)?,
+        "release_id={}",
+        release.id
+    )?;
+    Ok(())
+}
+
+pub(crate) fn upload<'a>(paths: impl Iterator<Item = &'a Path>) -> Result<(), Box<dyn Error>> {
+    let gitea = Gitea::from_environment()?;
+    let release_id = required_env("RELEASE_ID")?.parse()?;
+    for path in paths {
+        gitea.upload_asset(release_id, path)?;
+    }
+    Ok(())
+}
+
+pub(crate) fn publish() -> Result<(), Box<dyn Error>> {
+    let gitea = Gitea::from_environment()?;
+    let release_id = required_env("RELEASE_ID")?.parse()?;
+    gitea.update_release(release_id, &serde_json::json!({ "draft": false }))?;
+    Ok(())
+}
+
+fn required_env(name: &str) -> Result<String, Box<dyn Error>> {
+    env::var(name).map_err(|_| format!("required environment variable {name} is missing").into())
+}
+
+fn commit_messages(sha: &str) -> Result<String, Box<dyn Error>> {
+    let previous = Command::new("git")
+        .args(["describe", "--tags", "--abbrev=0", &format!("{sha}^")])
+        .output()?;
+    let previous = if previous.status.success() {
+        String::from_utf8(previous.stdout)?.trim().to_owned()
+    } else {
+        String::new()
+    };
+    let revision = if previous.is_empty() {
+        sha.to_owned()
+    } else {
+        format!("{previous}..{sha}")
+    };
+    let output = Command::new("git")
+        .args(["log", "--format=%s%n%b", &revision])
+        .output()?;
+    if !output.status.success() {
+        return Err(format!("git log failed for {revision}").into());
+    }
+    Ok(String::from_utf8(output.stdout)?)
+}
+
+fn issue_numbers(message: &str) -> Vec<u64> {
+    let bytes = message.as_bytes();
+    let mut numbers = BTreeSet::new();
+    let mut index = 0;
+    while index < bytes.len() {
+        if bytes[index] != b'#' {
+            index += 1;
+            continue;
+        }
+        let start = index + 1;
+        let mut end = start;
+        while end < bytes.len() && bytes[end].is_ascii_digit() {
+            end += 1;
+        }
+        if end > start
+            && let Ok(number) = message[start..end].parse()
+        {
+            numbers.insert(number);
+        }
+        index = end.max(index + 1);
+    }
+    numbers.into_iter().collect()
+}
+
+fn release_body<'a>(
+    issues: impl Iterator<Item = &'a Issue>,
+    server: &str,
+    repository: &str,
+    sha: &str,
+) -> String {
+    let mut fixes = Vec::new();
+    let mut improvements = Vec::new();
+    let mut other = Vec::new();
+    for issue in issues {
+        let title = issue.title.split_whitespace().collect::<Vec<_>>().join(" ");
+        let entry = format!(
+            "- [#{} {}]({})",
+            issue.number,
+            markdown(&title),
+            issue.html_url
+        );
+        let labels = issue
+            .labels
+            .iter()
+            .map(|label| label.name.as_str())
+            .collect::<BTreeSet<_>>();
+        if labels.contains("bug") {
+            fixes.push(entry);
+        } else if labels.contains("enhancement") {
+            improvements.push(entry);
+        } else {
+            other.push(entry);
+        }
+    }
+    let mut sections = Vec::new();
+    for (title, entries) in [
+        ("Fixes", fixes),
+        ("Improvements", improvements),
+        ("Other changes", other),
+    ] {
+        if !entries.is_empty() {
+            sections.push(format!("## {title}\n{}", entries.join("\n")));
+        }
+    }
+    if sections.is_empty() {
+        sections.push("No closed issues were linked from commits in this release.".to_owned());
+    }
+    let short_sha = &sha[..sha.len().min(12)];
+    sections.push(format!(
+        "Built from [{short_sha}]({}/{repository}/commit/{sha}).",
+        server.trim_end_matches('/')
+    ));
+    sections.join("\n\n")
+}
+
+fn markdown(text: &str) -> String {
+    text.replace('\\', "\\\\")
+        .replace('[', "\\[")
+        .replace(']', "\\]")
+}
+
+fn percent_encode(value: &str) -> String {
+    let mut encoded = String::new();
+    for byte in value.bytes() {
+        if byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'.' | b'_' | b'~') {
+            encoded.push(char::from(byte));
+        } else {
+            encoded.push('%');
+            encoded.push_str(&format!("{byte:02X}"));
+        }
+    }
+    encoded
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn issue_references_are_unique_and_sorted() {
+        assert_eq!(
+            issue_numbers("Fix #12, refs #3 and #12; ignore #x"),
+            [3, 12]
+        );
+    }
+
+    #[test]
+    fn release_notes_are_grouped_linked_and_escaped() {
+        let issues = [
+            Issue {
+                number: 12,
+                title: "Fix [unlock]".to_owned(),
+                html_url: "https://example.test/issues/12".to_owned(),
+                state: "closed".to_owned(),
+                labels: vec![Label {
+                    name: "bug".to_owned(),
+                }],
+            },
+            Issue {
+                number: 3,
+                title: "Add search".to_owned(),
+                html_url: "https://example.test/issues/3".to_owned(),
+                state: "closed".to_owned(),
+                labels: vec![Label {
+                    name: "enhancement".to_owned(),
+                }],
+            },
+        ];
+        let body = release_body(
+            issues.iter(),
+            "https://example.test",
+            "owner/repo",
+            "1234567890abcdef",
+        );
+        assert!(body.contains("## Fixes\n- [#12 Fix \\[unlock\\]]"));
+        assert!(body.contains("## Improvements\n- [#3 Add search]"));
+        assert!(
+            body.contains(
+                "[1234567890ab](https://example.test/owner/repo/commit/1234567890abcdef)"
+            )
+        );
+    }
+
+    #[test]
+    fn release_tag_is_encoded_as_one_api_path_segment() {
+        assert_eq!(percent_encode("release/1+beta"), "release%2F1%2Bbeta");
+    }
+}
diff --git a/crates/bds-release/src/main.rs b/crates/bds-release/src/main.rs
new file mode 100644
index 0000000..c3c2e5c
--- /dev/null
+++ b/crates/bds-release/src/main.rs
@@ -0,0 +1,43 @@
+mod gitea;
+mod packaging;
+
+use std::{env, error::Error, path::Path};
+
+fn main() -> Result<(), Box<dyn Error>> {
+    let args = env::args().skip(1).collect::<Vec<_>>();
+    match args.as_slice() {
+        [command] if command == "prepare" => gitea::prepare(),
+        [command] if command == "publish" => gitea::publish(),
+        [command, paths @ ..] if command == "upload" && !paths.is_empty() => {
+            gitea::upload(paths.iter().map(Path::new))
+        }
+        [command, tag, release_dir, rust_lib_dir, platform, dist_dir]
+            if command == "package" =>
+        {
+            packaging::package(
+                tag,
+                Path::new(release_dir),
+                Path::new(rust_lib_dir),
+                platform,
+                Path::new(dist_dir),
+            )?;
+            Ok(())
+        }
+        [command, tag, release_dir, rust_lib_dir, platform, dist_dir, upload]
+            if command == "package" && upload == "--upload" =>
+        {
+            let assets = packaging::package(
+                tag,
+                Path::new(release_dir),
+                Path::new(rust_lib_dir),
+                platform,
+                Path::new(dist_dir),
+            )?;
+            gitea::upload(assets.iter().map(|path| path.as_path()))
+        }
+        _ => Err(
+            "usage: bds-release prepare|publish|upload <asset>...|package <tag> <release-dir> <rust-lib-dir> <platform> <dist-dir> [--upload]"
+                .into(),
+        ),
+    }
+}
diff --git a/crates/bds-release/src/packaging.rs b/crates/bds-release/src/packaging.rs
new file mode 100644
index 0000000..5e06c67
--- /dev/null
+++ b/crates/bds-release/src/packaging.rs
@@ -0,0 +1,561 @@
+use apple_bundles::MacOsApplicationBundleBuilder;
+use apple_codesign::{SigningSettings, UnifiedSigner};
+use flate2::{Compression, write::GzEncoder};
+use icns::{IconFamily, Image};
+use plist::{Dictionary, Value};
+use simple_file_manifest::FileEntry;
+use std::{
+    error::Error,
+    ffi::OsStr,
+    fs::{self, File},
+    io::{self, BufReader},
+    path::{Path, PathBuf},
+};
+use zip::{CompressionMethod, ZipWriter, write::SimpleFileOptions};
+
+const APP_NAME: &str = "Blogging Desktop Server";
+const APP_EXECUTABLE: &str = "bds-ui";
+const BUNDLE_ID: &str = "de.rfc1437.ruds";
+const MIB: u64 = 1024 * 1024;
+const LC_LOAD_DYLIB: u32 = 0x0c;
+const LC_ID_DYLIB: u32 = 0x0d;
+const LC_LOAD_WEAK_DYLIB: u32 = 0x8000_0018;
+const LC_REEXPORT_DYLIB: u32 = 0x8000_001f;
+const LC_LAZY_LOAD_DYLIB: u32 = 0x20;
+const LC_LOAD_UPWARD_DYLIB: u32 = 0x8000_0023;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum Platform {
+    MacOs,
+    Linux,
+    Windows,
+}
+
+impl Platform {
+    fn from_label(label: &str) -> Result<Self, Box<dyn Error>> {
+        if label.starts_with("darwin-") {
+            Ok(Self::MacOs)
+        } else if label.starts_with("linux-") {
+            Ok(Self::Linux)
+        } else if label.starts_with("windows-") {
+            Ok(Self::Windows)
+        } else {
+            Err(format!("unsupported release platform: {label}").into())
+        }
+    }
+
+    fn executable(self, name: &str) -> String {
+        if self == Self::Windows {
+            format!("{name}.exe")
+        } else {
+            name.to_owned()
+        }
+    }
+
+    fn shared_libraries(self) -> [&'static str; 2] {
+        match self {
+            Self::MacOs => ["libbds_core.dylib", "libbds_server.dylib"],
+            Self::Linux => ["libbds_core.so", "libbds_server.so"],
+            Self::Windows => ["bds_core.dll", "bds_server.dll"],
+        }
+    }
+
+    fn is_dynamic_std(self, path: &Path) -> bool {
+        let name = path.file_name().and_then(OsStr::to_str).unwrap_or_default();
+        match self {
+            Self::MacOs => name.starts_with("libstd-") && name.ends_with(".dylib"),
+            Self::Linux => name.starts_with("libstd-") && name.ends_with(".so"),
+            Self::Windows => name.starts_with("std-") && name.ends_with(".dll"),
+        }
+    }
+}
+
+pub(crate) fn package(
+    release_tag: &str,
+    release_dir: &Path,
+    rust_lib_dir: &Path,
+    platform_label: &str,
+    dist_dir: &Path,
+) -> Result<Vec<PathBuf>, Box<dyn Error>> {
+    let platform = Platform::from_label(platform_label)?;
+    fs::create_dir_all(dist_dir)?;
+    let version = safe_tag(release_tag);
+    let runtime = runtime_files(platform, release_dir, rust_lib_dir)?;
+
+    let cli_files = executable_files(platform, release_dir, &["bds-cli", "bds-mcp"])?;
+    let cli_name = format!("bds-cli-{version}-{platform_label}");
+    let desktop_name = format!("bds-desktop-{version}-{platform_label}");
+    let cli_asset = match platform {
+        Platform::Windows => {
+            let path = dist_dir.join(format!("{cli_name}.zip"));
+            zip_archive(&path, &cli_name, cli_files.iter().chain(&runtime))?;
+            path
+        }
+        Platform::MacOs | Platform::Linux => {
+            let path = dist_dir.join(format!("{cli_name}.tar.gz"));
+            tar_gz_archive(&path, &cli_name, cli_files.iter().chain(&runtime))?;
+            path
+        }
+    };
+
+    let desktop_files = executable_files(
+        platform,
+        release_dir,
+        &[APP_EXECUTABLE, "bds-cli", "bds-mcp"],
+    )?;
+
+    let desktop_asset = match platform {
+        Platform::MacOs => {
+            let path = dist_dir.join(format!("{desktop_name}.dmg"));
+            macos_dmg(release_tag, &path, desktop_files.iter().chain(&runtime))?;
+            path
+        }
+        Platform::Linux => {
+            let path = dist_dir.join(format!("{desktop_name}.tar.gz"));
+            tar_gz_archive(&path, &desktop_name, desktop_files.iter().chain(&runtime))?;
+            path
+        }
+        Platform::Windows => {
+            let path = dist_dir.join(format!("{desktop_name}.zip"));
+            zip_archive(&path, &desktop_name, desktop_files.iter().chain(&runtime))?;
+            path
+        }
+    };
+
+    println!("created {}", cli_asset.display());
+    println!("created {}", desktop_asset.display());
+    Ok(vec![cli_asset, desktop_asset])
+}
+
+fn executable_files(
+    platform: Platform,
+    release_dir: &Path,
+    names: &[&str],
+) -> Result<Vec<(PathBuf, String)>, Box<dyn Error>> {
+    names
+        .iter()
+        .map(|name| {
+            let file_name = platform.executable(name);
+            let path = release_dir.join(&file_name);
+            require_file(&path)?;
+            Ok((path, file_name))
+        })
+        .collect()
+}
+
+fn runtime_files(
+    platform: Platform,
+    release_dir: &Path,
+    rust_lib_dir: &Path,
+) -> Result<Vec<(PathBuf, String)>, Box<dyn Error>> {
+    let mut files = platform
+        .shared_libraries()
+        .into_iter()
+        .map(|name| {
+            let path = release_dir.join(name);
+            require_file(&path)?;
+            Ok((path, name.to_owned()))
+        })
+        .collect::<Result<Vec<_>, Box<dyn Error>>>()?;
+    let mut std_libraries = fs::read_dir(rust_lib_dir)?
+        .filter_map(Result::ok)
+        .map(|entry| entry.path())
+        .filter(|path| platform.is_dynamic_std(path))
+        .collect::<Vec<_>>();
+    std_libraries.sort();
+    for path in std_libraries {
+        let name = path
+            .file_name()
+            .and_then(OsStr::to_str)
+            .ok_or_else(|| format!("invalid runtime filename: {}", path.display()))?
+            .to_owned();
+        files.push((path, name));
+    }
+    Ok(files)
+}
+
+fn require_file(path: &Path) -> Result<(), Box<dyn Error>> {
+    if path.is_file() {
+        Ok(())
+    } else {
+        Err(format!("release file is missing: {}", path.display()).into())
+    }
+}
+
+fn ensure_new(path: &Path) -> Result<(), Box<dyn Error>> {
+    if path.try_exists()? {
+        Err(format!("output already exists: {}", path.display()).into())
+    } else {
+        Ok(())
+    }
+}
+
+fn tar_gz_archive<'a>(
+    output: &Path,
+    root: &str,
+    files: impl Iterator<Item = &'a (PathBuf, String)>,
+) -> Result<(), Box<dyn Error>> {
+    ensure_new(output)?;
+    let encoder = GzEncoder::new(File::create(output)?, Compression::best());
+    let mut archive = tar::Builder::new(encoder);
+    for (source, name) in files {
+        archive.append_path_with_name(source, Path::new(root).join(name))?;
+    }
+    archive.into_inner()?.finish()?;
+    Ok(())
+}
+
+fn zip_archive<'a>(
+    output: &Path,
+    root: &str,
+    files: impl Iterator<Item = &'a (PathBuf, String)>,
+) -> Result<(), Box<dyn Error>> {
+    ensure_new(output)?;
+    let mut archive = ZipWriter::new(File::create(output)?);
+    let options = SimpleFileOptions::default()
+        .compression_method(CompressionMethod::Deflated)
+        .unix_permissions(0o755);
+    for (source, name) in files {
+        archive.start_file(format!("{root}/{name}"), options)?;
+        io::copy(&mut File::open(source)?, &mut archive)?;
+    }
+    archive.finish()?;
+    Ok(())
+}
+
+fn macos_dmg<'a>(
+    release_tag: &str,
+    output: &Path,
+    files: impl Iterator<Item = &'a (PathBuf, String)>,
+) -> Result<(), Box<dyn Error>> {
+    let files = files.collect::<Vec<_>>();
+    ensure_new(output)?;
+    let version = bundle_version(release_tag)?;
+    let output_dir = output.parent().unwrap_or_else(|| Path::new("."));
+    let bundle_path = output_dir.join(format!("{APP_NAME}.app"));
+    ensure_new(&bundle_path)?;
+
+    let mut bundle = MacOsApplicationBundleBuilder::new(APP_NAME)?;
+    bundle.set_info_plist_required_keys(APP_NAME, BUNDLE_ID, version, "RuDS", APP_EXECUTABLE)?;
+    bundle.set_info_plist_key("CFBundleShortVersionString", version)?;
+    bundle.set_info_plist_key("CFBundleIconFile", format!("{APP_NAME}.icns"))?;
+    bundle.set_info_plist_key("CFBundlePackageType", "APPL")?;
+    bundle.set_info_plist_key(
+        "LSApplicationCategoryType",
+        "public.app-category.productivity",
+    )?;
+    bundle.set_info_plist_key("LSMinimumSystemVersion", "26.0")?;
+    bundle.set_info_plist_key("NSHighResolutionCapable", true)?;
+    bundle.set_info_plist_key("CFBundleURLTypes", url_types())?;
+    bundle.add_icon(icns()?)?;
+
+    for (source, name) in &files {
+        let entry = FileEntry::new_from_path(source, true);
+        if name.ends_with(".dylib") {
+            bundle.add_file_resources(name, entry)?;
+        } else {
+            bundle.add_file_macos(name, entry)?;
+        }
+    }
+    let materialized = bundle.materialize_bundle(output_dir)?;
+    let runtime_names = files
+        .iter()
+        .filter(|(_, name)| name.ends_with(".dylib"))
+        .map(|(_, name)| name.clone())
+        .collect::<Vec<_>>();
+    for (_, name) in &files {
+        let staged = if name.ends_with(".dylib") {
+            materialized.join("Contents/Resources").join(name)
+        } else {
+            materialized.join("Contents/MacOS").join(name)
+        };
+        rewrite_macho_rpaths(&staged, &runtime_names)?;
+    }
+    let signer = UnifiedSigner::new(SigningSettings::default());
+    signer.sign_path_in_place(&materialized)?;
+    apple_dmg::create_dmg(
+        &materialized,
+        output,
+        APP_NAME,
+        dmg_sectors(directory_size(&materialized)?)?,
+    )?;
+    signer.sign_path_in_place(output)?;
+    fs::remove_dir_all(materialized)?;
+    Ok(())
+}
+
+fn rewrite_macho_rpaths(path: &Path, runtime_names: &[String]) -> Result<(), Box<dyn Error>> {
+    let mut bytes = fs::read(path)?;
+    if read_u32(&bytes, 0)? != 0xfeed_facf {
+        return Err(format!(
+            "release file is not a 64-bit little-endian Mach-O: {}",
+            path.display()
+        )
+        .into());
+    }
+    let command_count = read_u32(&bytes, 16)? as usize;
+    let commands_size = read_u32(&bytes, 20)? as usize;
+    let commands_end = 32_usize
+        .checked_add(commands_size)
+        .filter(|end| *end <= bytes.len())
+        .ok_or_else(|| format!("invalid Mach-O load commands in {}", path.display()))?;
+    let mut command_start = 32_usize;
+    for _ in 0..command_count {
+        let command = read_u32(&bytes, command_start)?;
+        let command_size = read_u32(&bytes, command_start + 4)? as usize;
+        let command_end = command_start
+            .checked_add(command_size)
+            .filter(|end| command_size >= 8 && *end <= commands_end)
+            .ok_or_else(|| format!("invalid Mach-O load command in {}", path.display()))?;
+        if is_dylib_command(command) {
+            if command_size < 24 {
+                return Err(format!("invalid Mach-O dylib command in {}", path.display()).into());
+            }
+            let name_offset = read_u32(&bytes, command_start + 8)? as usize;
+            let name_start = command_start
+                .checked_add(name_offset)
+                .filter(|start| name_offset >= 24 && *start < command_end)
+                .ok_or_else(|| format!("invalid Mach-O dylib name in {}", path.display()))?;
+            let name_length = bytes[name_start..command_end]
+                .iter()
+                .position(|byte| *byte == 0)
+                .ok_or_else(|| format!("unterminated Mach-O dylib name in {}", path.display()))?;
+            let current = std::str::from_utf8(&bytes[name_start..name_start + name_length])?;
+            let file_name = current.rsplit('/').next().unwrap_or(current);
+            if runtime_names.iter().any(|runtime| runtime == file_name) {
+                let replacement = format!("@rpath/{file_name}");
+                let capacity = command_end - name_start;
+                if replacement.len() + 1 > capacity {
+                    return Err(format!(
+                        "Mach-O load command has no room for {replacement} in {}",
+                        path.display()
+                    )
+                    .into());
+                }
+                bytes[name_start..command_end].fill(0);
+                bytes[name_start..name_start + replacement.len()]
+                    .copy_from_slice(replacement.as_bytes());
+            }
+        }
+        command_start = command_end;
+    }
+    if command_start != commands_end {
+        return Err(format!("inconsistent Mach-O load commands in {}", path.display()).into());
+    }
+    fs::write(path, bytes)?;
+    Ok(())
+}
+
+fn read_u32(bytes: &[u8], offset: usize) -> Result<u32, Box<dyn Error>> {
+    let value = bytes
+        .get(offset..offset + 4)
+        .ok_or("truncated Mach-O data")?;
+    Ok(u32::from_le_bytes(value.try_into()?))
+}
+
+fn is_dylib_command(command: u32) -> bool {
+    matches!(
+        command,
+        LC_LOAD_DYLIB
+            | LC_ID_DYLIB
+            | LC_LOAD_WEAK_DYLIB
+            | LC_REEXPORT_DYLIB
+            | LC_LAZY_LOAD_DYLIB
+            | LC_LOAD_UPWARD_DYLIB
+    )
+}
+
+fn url_types() -> Value {
+    let mut url_type = Dictionary::new();
+    url_type.insert("CFBundleURLName".to_owned(), BUNDLE_ID.into());
+    url_type.insert(
+        "CFBundleURLSchemes".to_owned(),
+        Value::Array(vec!["ruds".into()]),
+    );
+    Value::Array(vec![Value::Dictionary(url_type)])
+}
+
+fn icns() -> Result<Vec<u8>, Box<dyn Error>> {
+    let path = Path::new(env!("CARGO_MANIFEST_DIR")).join("../bds-ui/assets/app-icons/bds.png");
+    let image = Image::read_png(BufReader::new(File::open(path)?))?;
+    let mut family = IconFamily::new();
+    family.add_icon(&image)?;
+    let mut bytes = Vec::new();
+    family.write(&mut bytes)?;
+    Ok(bytes)
+}
+
+fn bundle_version(tag: &str) -> Result<&str, Box<dyn Error>> {
+    let version = tag.strip_prefix('v').unwrap_or(tag);
+    let version = version.split(['-', '+']).next().unwrap_or_default();
+    let parts = version.split('.').collect::<Vec<_>>();
+    if !(1..=3).contains(&parts.len())
+        || parts
+            .iter()
+            .any(|part| part.is_empty() || !part.bytes().all(|byte| byte.is_ascii_digit()))
+    {
+        return Err(format!("release tag is not a numeric Apple bundle version: {tag}").into());
+    }
+    Ok(version)
+}
+
+fn safe_tag(tag: &str) -> String {
+    tag.chars()
+        .map(|character| {
+            if character.is_ascii_alphanumeric() || matches!(character, '.' | '_' | '-') {
+                character
+            } else {
+                '-'
+            }
+        })
+        .collect()
+}
+
+fn directory_size(path: &Path) -> io::Result<u64> {
+    fs::read_dir(path)?.try_fold(0_u64, |total, entry| {
+        let entry = entry?;
+        let metadata = entry.metadata()?;
+        let size = if metadata.is_dir() {
+            directory_size(&entry.path())?
+        } else {
+            metadata.len()
+        };
+        total
+            .checked_add(size)
+            .ok_or_else(|| io::Error::other("bundle size overflow"))
+    })
+}
+
+fn dmg_sectors(bundle_bytes: u64) -> Result<u32, Box<dyn Error>> {
+    let capacity = bundle_bytes
+        .checked_add((bundle_bytes / 10).max(16 * MIB))
+        .ok_or("DMG capacity overflow")?
+        .max(64 * MIB);
+    Ok(u32::try_from(capacity.div_ceil(512))?)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Read;
+    use tempfile::tempdir;
+
+    #[test]
+    fn apple_bundle_version_comes_from_semver_tag() {
+        assert_eq!(bundle_version("v1.2.3").unwrap(), "1.2.3");
+        assert_eq!(bundle_version("2.0.0-rc.1").unwrap(), "2.0.0");
+        assert!(bundle_version("nightly").is_err());
+        assert!(bundle_version("1.2.3.4").is_err());
+    }
+
+    #[test]
+    fn asset_tag_is_safe_for_paths_and_urls() {
+        assert_eq!(safe_tag("release/1 + beta"), "release-1---beta");
+    }
+
+    #[test]
+    fn dmg_capacity_has_filesystem_headroom() {
+        let sectors = dmg_sectors(100 * MIB).unwrap();
+        assert!(u64::from(sectors) * 512 >= 116 * MIB);
+        assert_eq!(dmg_sectors(1).unwrap(), 131_072);
+    }
+
+    #[test]
+    fn windows_package_contains_the_app_without_dynamic_std() {
+        let temp = tempdir().unwrap();
+        let release = temp.path().join("release");
+        let rust_libs = temp.path().join("rust-libs");
+        let dist = temp.path().join("dist");
+        fs::create_dir(&release).unwrap();
+        fs::create_dir(&rust_libs).unwrap();
+        for file in [
+            "bds-ui.exe",
+            "bds-cli.exe",
+            "bds-mcp.exe",
+            "bds_core.dll",
+            "bds_server.dll",
+        ] {
+            fs::write(release.join(file), format!("MZ-{file}")).unwrap();
+        }
+        let assets = package("v1.2.3", &release, &rust_libs, "windows-x64", &dist).unwrap();
+        assert_eq!(assets.len(), 2);
+
+        let desktop = dist.join("bds-desktop-v1.2.3-windows-x64.zip");
+        let mut archive = zip::ZipArchive::new(File::open(desktop).unwrap()).unwrap();
+        let mut contents = Vec::new();
+        archive
+            .by_name("bds-desktop-v1.2.3-windows-x64/bds-ui.exe")
+            .unwrap()
+            .read_to_end(&mut contents)
+            .unwrap();
+        assert_eq!(contents, b"MZ-bds-ui.exe");
+        assert!(
+            archive
+                .by_name("bds-desktop-v1.2.3-windows-x64/bds_core.dll")
+                .is_ok()
+        );
+    }
+
+    #[test]
+    fn linux_package_contains_the_desktop_application() {
+        let temp = tempdir().unwrap();
+        let release = temp.path().join("release");
+        let rust_libs = temp.path().join("rust-libs");
+        let dist = temp.path().join("dist");
+        fs::create_dir(&release).unwrap();
+        fs::create_dir(&rust_libs).unwrap();
+        for file in [
+            "bds-ui",
+            "bds-cli",
+            "bds-mcp",
+            "libbds_core.so",
+            "libbds_server.so",
+        ] {
+            fs::write(release.join(file), file).unwrap();
+        }
+
+        let assets = package("v1.2.3", &release, &rust_libs, "linux-arm64", &dist).unwrap();
+
+        assert_eq!(
+            assets,
+            [
+                dist.join("bds-cli-v1.2.3-linux-arm64.tar.gz"),
+                dist.join("bds-desktop-v1.2.3-linux-arm64.tar.gz"),
+            ]
+        );
+
+        let desktop = File::open(dist.join("bds-desktop-v1.2.3-linux-arm64.tar.gz")).unwrap();
+        let decoder = flate2::read::GzDecoder::new(desktop);
+        let mut archive = tar::Archive::new(decoder);
+        let names = archive
+            .entries()
+            .unwrap()
+            .map(|entry| entry.unwrap().path().unwrap().into_owned())
+            .collect::<Vec<_>>();
+        assert!(names.iter().any(|name| name.ends_with("bds-ui")));
+        assert!(names.iter().any(|name| name.ends_with("libbds_core.so")));
+    }
+
+    #[test]
+    fn macho_runtime_install_names_are_rewritten_to_rpath() {
+        let temp = tempdir().unwrap();
+        let macho = temp.path().join("libbds_core.dylib");
+        let old_name = b"/build/target/release/libbds_core.dylib\0";
+        let command_size = (24 + old_name.len()).div_ceil(8) * 8;
+        let mut bytes = vec![0_u8; 32 + command_size];
+        bytes[0..4].copy_from_slice(&0xfeedfacf_u32.to_le_bytes());
+        bytes[16..20].copy_from_slice(&1_u32.to_le_bytes());
+        bytes[20..24].copy_from_slice(&(command_size as u32).to_le_bytes());
+        bytes[32..36].copy_from_slice(&LC_ID_DYLIB.to_le_bytes());
+        bytes[36..40].copy_from_slice(&(command_size as u32).to_le_bytes());
+        bytes[40..44].copy_from_slice(&24_u32.to_le_bytes());
+        bytes[56..56 + old_name.len()].copy_from_slice(old_name);
+        fs::write(&macho, bytes).unwrap();
+
+        rewrite_macho_rpaths(&macho, &["libbds_core.dylib".to_owned()]).unwrap();
+
+        let rewritten = fs::read(macho).unwrap();
+        let name_end = rewritten[56..].iter().position(|byte| *byte == 0).unwrap();
+        assert_eq!(&rewritten[56..56 + name_end], b"@rpath/libbds_core.dylib");
+    }
+}
diff --git a/crates/bds-ui/Cargo.toml b/crates/bds-ui/Cargo.toml
index 536481e..93de27f 100644
--- a/crates/bds-ui/Cargo.toml
+++ b/crates/bds-ui/Cargo.toml
@@ -29,6 +29,7 @@ objc2-foundation = { version = "0.3", features = ["objc2-core-services"] }
 
 [dev-dependencies]
 fluent-syntax = { workspace = true }
+serde_yaml = { workspace = true }
 syn = { version = "3", features = ["full", "visit"] }
 tempfile = "3"
 
diff --git a/crates/bds-ui/src/app.rs b/crates/bds-ui/src/app.rs
index 9279aff..0e8f769 100644
--- a/crates/bds-ui/src/app.rs
+++ b/crates/bds-ui/src/app.rs
@@ -3872,7 +3872,7 @@ impl BdsApp {
                 menu::action_enabled(
                     action,
                     self.active_project.is_some(),
-                    self.active_tab_type(),
+                    self.active_tab_type().as_ref(),
                     self.offline_mode,
                     !self.search_index_rebuild_running,
                 ) && (action != MenuAction::DisconnectServer || self.remote_client.is_some())
diff --git a/crates/bds-ui/tests/packaging_assets.rs b/crates/bds-ui/tests/packaging_assets.rs
index 5c39648..358eb38 100644
--- a/crates/bds-ui/tests/packaging_assets.rs
+++ b/crates/bds-ui/tests/packaging_assets.rs
@@ -60,6 +60,7 @@ fn desktop_packages_have_native_icons_and_cargo_commands() {
     assert!(workspace_manifest.contains("Georg Bauer <gb@rfc1437.de>"));
     assert!(workspace_manifest.contains("strip = \"symbols\""));
     assert!(workspace_manifest.contains("ort-download-binaries-rustls-tls"));
+    assert!(workspace_manifest.contains("\"sync-secret-service\", \"vendored\""));
 
     let core_manifest =
         fs::read_to_string(Path::new(CRATE_DIR).join("../bds-core/Cargo.toml")).unwrap();
@@ -82,3 +83,86 @@ fn desktop_packages_have_native_icons_and_cargo_commands() {
     assert!(packager.contains("CARGO_PACKAGER_FORMAT"));
     assert!(!packager.contains("--options"));
 }
+
+#[test]
+fn tagged_releases_are_built_and_packaged_with_rust_tools() {
+    let workspace = Path::new(CRATE_DIR).join("../..");
+    let manifest = fs::read_to_string(workspace.join("Cargo.toml")).unwrap();
+    assert!(manifest.contains("\"crates/bds-release\""));
+    for dependency in [
+        "apple-bundles = \"0.21\"",
+        "apple-codesign = { version = \"0.29\", default-features = false }",
+        "apple-dmg = \"0.5\"",
+    ] {
+        assert!(manifest.contains(dependency), "missing {dependency}");
+    }
+
+    let release_manifest =
+        fs::read_to_string(workspace.join("crates/bds-release/Cargo.toml")).unwrap();
+    for dependency in [
+        "apple-bundles.workspace = true",
+        "apple-codesign.workspace = true",
+        "apple-dmg.workspace = true",
+        "flate2",
+        "tar",
+        "zip",
+    ] {
+        assert!(
+            release_manifest.contains(dependency),
+            "release packager is missing {dependency}"
+        );
+    }
+
+    let workflow = fs::read_to_string(workspace.join(".gitea/workflows/release.yml")).unwrap();
+    serde_yaml::from_str::<serde_yaml::Value>(&workflow).expect("valid release workflow YAML");
+    for required in [
+        "tags:",
+        "runs-on: linux-arm64",
+        "cargo-zigbuild",
+        "aarch64-apple-darwin",
+        "x86_64-apple-darwin",
+        "aarch64-unknown-linux-gnu",
+        "x86_64-unknown-linux-gnu",
+        "cargo-xwin",
+        "x86_64-pc-windows-msvc",
+        "bds-release",
+        "prepare",
+        "package",
+        "publish",
+        "PKG_CONFIG_ALLOW_CROSS",
+        "CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER",
+    ] {
+        assert!(
+            workflow.contains(required),
+            "release workflow is missing {required}"
+        );
+    }
+    for forbidden in ["python", "curl ", "hdiutil", "makensis", "tar -"] {
+        assert!(
+            !workflow.contains(forbidden),
+            "release workflow must not use host tool {forbidden}"
+        );
+    }
+
+    let linux_dependencies =
+        fs::read_to_string(workspace.join(".gitea/scripts/install-linux-build-dependencies.sh"))
+            .unwrap();
+    for required in [
+        "libwebkit2gtk-4.1-dev",
+        "libgtk-3-dev",
+        "libxdo-dev",
+        "libwebkit2gtk-4.1-dev:amd64",
+        "gcc-x86-64-linux-gnu",
+    ] {
+        assert!(
+            linux_dependencies.contains(required),
+            "Linux dependency setup is missing {required}"
+        );
+    }
+
+    let release_source =
+        fs::read_to_string(workspace.join("crates/bds-release/src/packaging.rs")).unwrap();
+    assert!(release_source.contains("LC_ID_DYLIB"));
+    assert!(release_source.contains("rewrite_macho_rpaths"));
+    assert!(!release_source.contains("Linux releases contain the portable CLI tools"));
+}