diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b026f90..3199d7a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -13,7 +13,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [ubuntu-latest, macos-14]
 
     steps:
       - name: Checkout
@@ -41,25 +41,80 @@ jobs:
             ${{ runner.os }}-target-
 
       - name: Build (release)
-        run: cargo build --release --locked
+        run: cargo build --workspace --release --locked
+
+      - name: Format
+        run: cargo fmt --all -- --check
+
+      - name: Clippy
+        run: cargo clippy --workspace --all-targets --locked -- -D warnings
+
+      - name: Test
+        run: cargo test --workspace --locked
 
       - name: Prepare artifact (Linux)
         if: runner.os == 'Linux'
         shell: bash
         run: |
           mkdir -p dist
-          cp target/release/miassistant dist/miassistant-linux-x86_64
+          cp target/release/sensitivity dist/sensitivity-linux-x86_64
+          cp target/release/sensitivity-gui dist/sensitivity-gui-linux-x86_64
 
-      - name: Prepare artifact (Windows)
-        if: runner.os == 'Windows'
-        shell: pwsh
+      - name: Prepare artifact (macOS)
+        if: runner.os == 'macOS'
+        shell: bash
         run: |
-          New-Item -ItemType Directory -Force -Path dist | Out-Null
-          Copy-Item target/release/miassistant.exe dist/miassistant-windows-x86_64.exe
+          mkdir -p dist
+          cp target/release/sensitivity dist/sensitivity-macos-aarch64
+          cp target/release/sensitivity-gui dist/sensitivity-gui-macos-aarch64
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
-          name: miassistant-${{ runner.os }}-x86_64
+          name: sensitivity-${{ runner.os }}-${{ runner.arch }}
           path: dist/*
 
+  windows-native:
+    name: Build native Windows app
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 8.0.x
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo test -p sensitivity --locked
+      - run: cargo clippy -p sensitivity --all-targets --locked -- -D warnings
+      - run: cargo build -p sensitivity --release --locked
+      - name: Publish WinUI 3 app
+        shell: pwsh
+        run: |
+          dotnet publish apps/windows/Sensitivity.WinUI/Sensitivity.WinUI.csproj -c Release -r win-x64 --self-contained true -p:DebugType=None -p:DebugSymbols=false -o native-publish
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          Copy-Item target/release/sensitivity.exe native-publish/sensitivity.exe
+      - uses: actions/upload-artifact@v4
+        with:
+          name: sensitivity-Windows-X64
+          path: native-publish/*
+          if-no-files-found: error
+
+  msrv:
+    name: Minimum Rust 1.88
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@1.88.0
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo check --workspace --locked
+
+  fuzz-target:
+    name: Fuzz target compiles
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: fuzz
+      - run: cargo check --manifest-path fuzz/Cargo.toml --locked
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..4122014
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,130 @@
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  package:
+    name: Package (${{ matrix.name }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: linux-x86_64
+            os: ubuntu-22.04
+            archive: sensitivity-linux-x86_64.tar.gz
+          - name: windows-x86_64
+            os: windows-latest
+            archive: sensitivity-windows-x86_64.zip
+          - name: macos-x86_64
+            os: macos-15-intel
+            archive: sensitivity-macos-x86_64.tar.gz
+          - name: macos-aarch64
+            os: macos-14
+            archive: sensitivity-macos-aarch64.tar.gz
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/setup-dotnet@v4
+        if: runner.os == 'Windows'
+        with:
+          dotnet-version: 8.0.x
+      - uses: Swatinem/rust-cache@v2
+      - name: Test Rust workspace
+        if: runner.os != 'Windows'
+        run: cargo test --workspace --locked
+      - name: Build Rust workspace
+        if: runner.os != 'Windows'
+        run: cargo build --workspace --release --locked
+      - name: Test Windows backend
+        if: runner.os == 'Windows'
+        run: cargo test -p sensitivity --locked
+      - name: Build Windows backend
+        if: runner.os == 'Windows'
+        run: cargo build -p sensitivity --release --locked
+      - name: Publish native Windows app
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          dotnet publish apps/windows/Sensitivity.WinUI/Sensitivity.WinUI.csproj -c Release -r win-x64 --self-contained true -p:DebugType=None -p:DebugSymbols=false -o native-publish
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          Copy-Item target/release/sensitivity.exe native-publish/sensitivity.exe
+      - name: Package Unix
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          mkdir package
+          cp target/release/sensitivity package/sensitivity
+          cp target/release/sensitivity-gui package/sensitivity-gui
+          cp README.md LICENSE package/
+          cp -R docs package/docs
+          mkdir package/completions
+          target/release/sensitivity completions bash > package/completions/sensitivity.bash
+          target/release/sensitivity completions zsh > package/completions/_sensitivity
+          target/release/sensitivity completions fish > package/completions/sensitivity.fish
+          if [ "${{ runner.os }}" = "Linux" ]; then
+            cp packaging/linux/70-sensitivity.rules packaging/linux/install-udev-rule.sh package/
+            chmod +x package/install-udev-rule.sh
+          else
+            mkdir -p package/Sensitivity.app/Contents/MacOS
+            cp target/release/sensitivity-gui package/Sensitivity.app/Contents/MacOS/
+            cp packaging/macos/Info.plist package/Sensitivity.app/Contents/
+            VERSION="$(cargo metadata --format-version 1 --no-deps | sed -n 's/.*\"name\":\"sensitivity\",\"version\":\"\([^\"]*\)\".*/\1/p')"
+            sed -i.bak "s/@VERSION@/$VERSION/g" package/Sensitivity.app/Contents/Info.plist
+            rm package/Sensitivity.app/Contents/Info.plist.bak
+          fi
+          tar -C package -czf "${{ matrix.archive }}" .
+      - name: Package Windows
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory package | Out-Null
+          Copy-Item native-publish/* package -Recurse
+          Copy-Item README.md, LICENSE package/
+          Copy-Item docs package/docs -Recurse
+          Copy-Item packaging/windows/README-WINDOWS.md package/
+          New-Item -ItemType Directory -Force package/completions | Out-Null
+          & target/release/sensitivity.exe completions powershell | Out-File -Encoding utf8 package/completions/_sensitivity.ps1
+          Compress-Archive -Path package/* -DestinationPath "${{ matrix.archive }}"
+      - name: Build Windows installer
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          choco install wixtoolset --no-progress -y
+          $version = (cargo metadata --format-version 1 --no-deps | ConvertFrom-Json).packages[0].version
+          $wixBin = (Resolve-Path "${env:ProgramFiles(x86)}\WiX Toolset v3*\bin" | Select-Object -Last 1).Path
+          & "$wixBin\heat.exe" dir package -cg AppFiles -dr INSTALLFOLDER -srd -gg -var var.PublishDir -out sensitivity-files.wxs
+          & "$wixBin\candle.exe" -arch x64 -dVersion=$version -dPublishDir="$PWD\package" packaging/windows/sensitivity.wxs sensitivity-files.wxs
+          & "$wixBin\light.exe" sensitivity.wixobj sensitivity-files.wixobj -out sensitivity-windows-x86_64.msi
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.name }}
+          path: |
+            ${{ matrix.archive }}
+            sensitivity-*.msi
+          if-no-files-found: error
+
+  publish:
+    if: github.event_name == 'push'
+    needs: package
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist
+          merge-multiple: true
+      - name: Create checksums
+        working-directory: dist
+        run: sha256sum sensitivity-* > SHA256SUMS
+      - name: Publish GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: gh release create "$TAG" dist/* --repo "$GITHUB_REPOSITORY" --verify-tag --generate-notes
diff --git a/.gitignore b/.gitignore
index 378e868..09b2a92 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,5 @@
 /other
-/target
\ No newline at end of file
+/target
+/fuzz/target
+/apps/windows/**/bin
+/apps/windows/**/obj
diff --git a/Cargo.lock b/Cargo.lock
index 79bc9b5..9d2b6cb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3,12 +3,29 @@
 version = 4
 
 [[package]]
-name = "addr2line"
-version = "0.24.2"
+name = "ab_glyph"
+version = "0.2.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
+checksum = "01c0457472c38ea5bd1c3b5ada5e368271cb550be7a4ca4a0b4634e9913f6cc2"
 dependencies = [
- "gimli",
+ "ab_glyph_rasterizer",
+ "owned_ttf_parser",
+]
+
+[[package]]
+name = "ab_glyph_rasterizer"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "366ffbaa4442f4684d91e2cd7c5ea7c4ed8add41959a31447066e279e432b618"
+
+[[package]]
+name = "accesskit"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf203f9d3bd8f29f98833d1fbef628df18f759248a547e7e01cfbf63cda36a99"
+dependencies = [
+ "enumn",
+ "serde",
 ]
 
 [[package]]
@@ -25,23 +42,53 @@ checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
  "cfg-if",
  "cipher",
- "cpufeatures",
+ "cpufeatures 0.2.17",
 ]
 
 [[package]]
-name = "aho-corasick"
-version = "1.1.3"
+name = "ahash"
+version = "0.8.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
 dependencies = [
- "memchr",
+ "cfg-if",
+ "getrandom 0.3.4",
+ "once_cell",
+ "serde",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "android-activity"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f2a1bb052857d5dd49572219344a7332b31b76405648eabac5bc68978251bcd"
+dependencies = [
+ "android-properties",
+ "bitflags 2.13.1",
+ "cc",
+ "jni",
+ "libc",
+ "log",
+ "ndk",
+ "ndk-context",
+ "ndk-sys",
+ "num_enum",
+ "thiserror 2.0.18",
 ]
 
+[[package]]
+name = "android-properties"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc7eb209b1518d6bb87b283c20095f5228ecda460da70b44f0802523dea6da04"
+
 [[package]]
 name = "anstream"
-version = "0.6.20"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ae563653d1938f79b1ab1b5e668c87c76a9930414574a6583a7b7e11a8e6192"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -54,44 +101,76 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.11"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "862ed96ca487e809f1c8e5a8447f6ee2cf102f846893800b20cebdf541fc6bbd"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.7"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e231f6134f61b71076a3eab506c379d4f36122f2af15a9ff04415ea4c3339e2"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.10"
+version = "3.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e0633414522a32ffaac8ac6cc8f748e090c5717661fddeea04219e2344f5f2a"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.99"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0674a1ddeecb70197781e945de4b3b8ffb61fa939a5597bcf48503737663100"
+checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
+
+[[package]]
+name = "arboard"
+version = "3.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0348a1c054491f4bfe6ab86a7b6ab1e44e45d899005de92f58b3df180b36ddaf"
+dependencies = [
+ "clipboard-win",
+ "image",
+ "log",
+ "objc2 0.6.4",
+ "objc2-app-kit 0.3.2",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-foundation 0.3.2",
+ "parking_lot",
+ "percent-encoding",
+ "windows-sys 0.59.0",
+ "x11rb",
+]
+
+[[package]]
+name = "arrayvec"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
+
+[[package]]
+name = "as-raw-xcb-connection"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175571dd1d178ced59193a6fc02dde1b972eb0bc56c892cde9beeceac5bf0f6b"
 
 [[package]]
 name = "atomic-waker"
@@ -100,19 +179,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
-name = "backtrace"
-version = "0.3.75"
+name = "autocfg"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6806a6321ec58106fea15becdad98371e28d92ccbc7c8f1b3b6dd724fe8f1002"
-dependencies = [
- "addr2line",
- "cfg-if",
- "libc",
- "miniz_oxide",
- "object",
- "rustc-demangle",
- "windows-targets 0.52.6",
-]
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "base64"
@@ -120,11 +190,35 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "bit-set"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
+dependencies = [
+ "bit-vec",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
 [[package]]
 name = "bitflags"
-version = "2.9.4"
+version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2261d10cca569e4643e526d8dc2e62e433cc8aba21ab764233731f8d369bf394"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+dependencies = [
+ "serde_core",
+]
 
 [[package]]
 name = "block-buffer"
@@ -144,11 +238,49 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "block2"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c132eebf10f5cad5289222520a4a058514204aed6d791f1cf4fe8088b82d15f"
+dependencies = [
+ "objc2 0.5.2",
+]
+
+[[package]]
+name = "block2"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5"
+dependencies = [
+ "objc2 0.6.4",
+]
+
 [[package]]
 name = "bumpalo"
-version = "3.19.0"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "bytemuck"
+version = "1.25.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6aedf8ae72766347502cf3cb4f41cf5e9cc37d28bee90f1fdaaae15f9cf9424"
+dependencies = [
+ "bytemuck_derive",
+]
+
+[[package]]
+name = "bytemuck_derive"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
+checksum = "f65693059b6b9c588b9f62fed1cedbf0a8b805631457ea162d68f0de186f3de5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
 
 [[package]]
 name = "byteorder"
@@ -156,11 +288,68 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
+[[package]]
+name = "byteorder-lite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
+
 [[package]]
 name = "bytes"
-version = "1.10.1"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "calloop"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b99da2f8558ca23c71f4fd15dc57c906239752dd27ff3c00a1d56b685b7cbfec"
+dependencies = [
+ "bitflags 2.13.1",
+ "log",
+ "polling",
+ "rustix 0.38.44",
+ "slab",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "calloop"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4dbf9978365bac10f54d1d4b04f7ce4427e51f71d61f2fe15e3fed5166474df7"
+dependencies = [
+ "bitflags 2.13.1",
+ "polling",
+ "rustix 1.1.4",
+ "slab",
+ "tracing",
+]
+
+[[package]]
+name = "calloop-wayland-source"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95a66a987056935f7efce4ab5668920b5d0dac4a7c99991a67395f13702ddd20"
+dependencies = [
+ "calloop 0.13.0",
+ "rustix 0.38.44",
+ "wayland-backend",
+ "wayland-client",
+]
+
+[[package]]
+name = "calloop-wayland-source"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+checksum = "138efcf0940a02ebf0cc8d1eff41a1682a46b431630f4c52450d6265876021fa"
+dependencies = [
+ "calloop 0.14.4",
+ "rustix 1.1.4",
+ "wayland-backend",
+ "wayland-client",
+]
 
 [[package]]
 name = "cbc"
@@ -173,19 +362,21 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.36"
+version = "1.2.67"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5252b3d2648e5eedbc1a6f501e3c795e07025c1e93bbf8bbdd6eef7f447a6d54"
+checksum = "e17dd265a7d0f31ef544e1b20e03add05d3b45b491b633b10d67145d2acc1a38"
 dependencies = [
  "find-msvc-tools",
+ "jobserver",
+ "libc",
  "shlex",
 ]
 
 [[package]]
 name = "cfg-if"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fd1289c04a9ea8cb22300a459a72a385d7c73d3259e2ed7dcb2af674838cfa9"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "cfg_aliases"
@@ -193,6 +384,26 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
+[[package]]
+name = "cgl"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ced0551234e87afee12411d535648dd89d2e7f34c78b753395567aff3d447ff"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "chacha20"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core",
+]
+
 [[package]]
 name = "cipher"
 version = "0.4.4"
@@ -205,9 +416,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.47"
+version = "4.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7eac00902d9d136acd712710d71823fb8ac8004ca445a89e73a41d45aa712931"
+checksum = "dd059f9da4f5c36b3787f65d38ccaab1cc315f07b01f89abc8359ee6a8205011"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -215,9 +426,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.47"
+version = "4.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ad9bbf750e73b5884fb8a211a9424a1906c1e156724260fdae972f31d70e1d6"
+checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
 dependencies = [
  "anstream",
  "anstyle",
@@ -225,11 +436,20 @@ dependencies = [
  "strsim",
 ]
 
+[[package]]
+name = "clap_complete"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db8b397918185f0161ff3d6fcaa9e4bfc09b8367caf6e1d4a2848e5477ed027b"
+dependencies = [
+ "clap",
+]
+
 [[package]]
 name = "clap_derive"
-version = "4.5.47"
+version = "4.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbfd7eae0b0f1a6e63d4b13c9c478de77c2eb546fba158ad50b4203dc24b9f9c"
+checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -239,15 +459,52 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "0.7.5"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b94f61472cee1439c0b966b47e3aca9ae07e45d070759512cd390ea2bebc6675"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "clipboard-win"
+version = "5.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bde03770d3df201d4fb868f2c9c59e66a3e4e2bd06692a0fe701e7103c7e84d4"
+dependencies = [
+ "error-code",
+]
+
+[[package]]
+name = "codespan-reporting"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe6d2e5af09e8c8ad56c969f2157a3d4238cebc7c55f0a517728c38f7b200f81"
+dependencies = [
+ "unicode-width",
+]
 
 [[package]]
 name = "colorchoice"
-version = "1.0.4"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "combine"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
 
 [[package]]
 name = "console"
@@ -263,188 +520,517 @@ dependencies = [
 ]
 
 [[package]]
-name = "cpufeatures"
-version = "0.2.17"
+name = "core-foundation"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
 dependencies = [
+ "core-foundation-sys",
  "libc",
 ]
 
 [[package]]
-name = "crypto-common"
-version = "0.1.6"
+name = "core-foundation"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
 dependencies = [
- "generic-array",
- "typenum",
+ "core-foundation-sys",
+ "libc",
 ]
 
 [[package]]
-name = "deranged"
-version = "0.5.3"
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "core-graphics"
+version = "0.23.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d630bccd429a5bb5a64b5e94f693bfc48c9f8566418fda4c494cc94f911f87cc"
+checksum = "c07782be35f9e1140080c6b96f0d44b739e2278479f64e02fdab4e32dfd8b081"
 dependencies = [
- "powerfmt",
+ "bitflags 1.3.2",
+ "core-foundation 0.9.4",
+ "core-graphics-types",
+ "foreign-types",
+ "libc",
 ]
 
 [[package]]
-name = "digest"
-version = "0.10.7"
+name = "core-graphics-types"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+checksum = "45390e6114f68f718cc7a830514a96f903cccd70d02a8f6d9f643ac4ba45afaf"
 dependencies = [
- "block-buffer",
- "crypto-common",
+ "bitflags 1.3.2",
+ "core-foundation 0.9.4",
+ "libc",
 ]
 
 [[package]]
-name = "dirs-next"
-version = "2.0.0"
+name = "cpufeatures"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b98cf8ebf19c3d1b223e151f99a4f9f0690dca41414773390fc824184ac833e1"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
 dependencies = [
- "cfg-if",
- "dirs-sys-next",
+ "libc",
 ]
 
 [[package]]
-name = "dirs-sys-next"
-version = "0.1.2"
+name = "cpufeatures"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ebda144c4fe02d1f7ea1a7d9641b6fc6b580adcfa024ae48797ecdeb6825b4d"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
 dependencies = [
  "libc",
- "redox_users",
- "winapi",
 ]
 
 [[package]]
-name = "displaydoc"
-version = "0.2.5"
+name = "crc32fast"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn",
+ "cfg-if",
 ]
 
 [[package]]
-name = "encode_unicode"
-version = "1.0.0"
+name = "crossbeam-utils"
+version = "0.8.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
 
 [[package]]
-name = "env_filter"
-version = "0.1.3"
+name = "crunchy"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "186e05a59d4c50738528153b83b0b0194d3a29507dfec16eccd4b342903397d0"
-dependencies = [
- "log",
- "regex",
-]
+checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
 [[package]]
-name = "env_logger"
-version = "0.11.8"
+name = "crypto-common"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13c863f0904021b108aa8b2f55046443e6b1ebde8fd4a15c399893aae4fa069f"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
- "anstream",
- "anstyle",
- "env_filter",
- "jiff",
- "log",
+ "generic-array",
+ "typenum",
 ]
 
 [[package]]
-name = "errno"
-version = "0.3.13"
+name = "ctrlc"
+version = "3.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "778e2ac28f6c47af28e4907f13ffd1e1ddbd400980a9abd7c8df189bf578a5ad"
+checksum = "e0b1fab2ae45819af2d0731d60f2afe17227ebb1a1538a236da84c93e9a60162"
 dependencies = [
- "libc",
- "windows-sys 0.60.2",
+ "dispatch2",
+ "nix",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
-name = "fastrand"
-version = "2.3.0"
+name = "cursor-icon"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+checksum = "f27ae1dd37df86211c42e150270f82743308803d90a6f6e6651cd730d5e1732f"
 
 [[package]]
-name = "find-msvc-tools"
-version = "0.1.1"
+name = "digest"
+version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fd99930f64d146689264c637b5af2f0233a933bef0d8570e2526bf9e083192d"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
 
 [[package]]
-name = "fnv"
-version = "1.0.7"
+name = "dispatch"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+checksum = "bd0c93bb4b0c6d9b77f4435b0ae98c24d17f1c45b2ff844c6151a07256ca923b"
 
 [[package]]
-name = "form_urlencoded"
-version = "1.2.2"
+name = "dispatch2"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
 dependencies = [
- "percent-encoding",
+ "bitflags 2.13.1",
+ "block2 0.6.2",
+ "libc",
+ "objc2 0.6.4",
 ]
 
 [[package]]
-name = "futures-channel"
-version = "0.3.31"
+name = "displaydoc"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
 dependencies = [
- "futures-core",
- "futures-sink",
+ "proc-macro2",
+ "quote",
+ "syn",
 ]
 
 [[package]]
-name = "futures-core"
-version = "0.3.31"
+name = "dlib"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
+checksum = "ab8ecd87370524b461f8557c119c405552c396ed91fc0a8eec68679eab26f94a"
+dependencies = [
+ "libloading",
+]
 
 [[package]]
-name = "futures-io"
-version = "0.3.31"
+name = "document-features"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
+checksum = "d4b8a88685455ed29a21542a33abd9cb6510b6b129abadabdcef0f4c55bc8f61"
+dependencies = [
+ "litrs",
+]
 
 [[package]]
-name = "futures-sink"
-version = "0.3.31"
+name = "downcast-rs"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
+checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
 
 [[package]]
-name = "futures-task"
-version = "0.3.31"
+name = "dpi"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
+checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
 
 [[package]]
-name = "futures-util"
-version = "0.3.31"
+name = "ecolor"
+version = "0.33.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
+checksum = "71ddb8ac7643d1dba1bb02110e804406dd459a838efcb14011ced10556711a8e"
 dependencies = [
- "futures-core",
+ "bytemuck",
+ "emath",
+ "serde",
+]
+
+[[package]]
+name = "eframe"
+version = "0.33.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "457481173e6db5ca9fa2be93a58df8f4c7be639587aeb4853b526c6cf87db4e6"
+dependencies = [
+ "ahash",
+ "bytemuck",
+ "document-features",
+ "egui",
+ "egui-wgpu",
+ "egui-winit",
+ "egui_glow",
+ "glow",
+ "glutin",
+ "glutin-winit",
+ "home",
+ "image",
+ "js-sys",
+ "log",
+ "objc2 0.5.2",
+ "objc2-app-kit 0.2.2",
+ "objc2-foundation 0.2.2",
+ "parking_lot",
+ "percent-encoding",
+ "profiling",
+ "raw-window-handle",
+ "ron",
+ "serde",
+ "static_assertions",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "web-time",
+ "windows-sys 0.61.2",
+ "winit",
+]
+
+[[package]]
+name = "egui"
+version = "0.33.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a9b567d356674e9a5121ed3fedfb0a7c31e059fe71f6972b691bcd0bfc284e3"
+dependencies = [
+ "accesskit",
+ "ahash",
+ "bitflags 2.13.1",
+ "emath",
+ "epaint",
+ "log",
+ "nohash-hasher",
+ "profiling",
+ "ron",
+ "serde",
+ "smallvec",
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "egui-wgpu"
+version = "0.33.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e4d209971c84b2352a06174abdba701af1e552ce56b144d96f2bd50a3c91236"
+dependencies = [
+ "ahash",
+ "bytemuck",
+ "document-features",
+ "egui",
+ "epaint",
+ "log",
+ "profiling",
+ "thiserror 2.0.18",
+ "type-map",
+ "web-time",
+ "wgpu",
+ "winit",
+]
+
+[[package]]
+name = "egui-winit"
+version = "0.33.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec6687e5bb551702f4ad10ac428bab12acf9d53047ebb1082d4a0ed8c6251a29"
+dependencies = [
+ "arboard",
+ "bytemuck",
+ "egui",
+ "log",
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
+ "objc2-ui-kit",
+ "profiling",
+ "raw-window-handle",
+ "serde",
+ "smithay-clipboard",
+ "web-time",
+ "webbrowser",
+ "winit",
+]
+
+[[package]]
+name = "egui_glow"
+version = "0.33.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6420863ea1d90e750f75075231a260030ad8a9f30a7cef82cdc966492dc4c4eb"
+dependencies = [
+ "bytemuck",
+ "egui",
+ "glow",
+ "log",
+ "memoffset",
+ "profiling",
+ "wasm-bindgen",
+ "web-sys",
+ "winit",
+]
+
+[[package]]
+name = "emath"
+version = "0.33.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "491bdf728bf25ddd9ad60d4cf1c48588fa82c013a2440b91aa7fc43e34a07c32"
+dependencies = [
+ "bytemuck",
+ "serde",
+]
+
+[[package]]
+name = "encode_unicode"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
+
+[[package]]
+name = "enumn"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f9ed6b3789237c8a0c1c505af1c7eb2c560df6186f01b098c3a1064ea532f38"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "epaint"
+version = "0.33.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "009d0dd3c2163823a0abdb899451ecbc78798dec545ee91b43aff1fa790bab62"
+dependencies = [
+ "ab_glyph",
+ "ahash",
+ "bytemuck",
+ "ecolor",
+ "emath",
+ "epaint_default_fonts",
+ "log",
+ "nohash-hasher",
+ "parking_lot",
+ "profiling",
+ "serde",
+]
+
+[[package]]
+name = "epaint_default_fonts"
+version = "0.33.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c4fbe202b6578d3d56428fa185cdf114a05e49da05f477b3c7f0fbb221f1862"
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "error-code"
+version = "3.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dea2df4cf52843e0452895c455a1a2cfbb842a1e7329671acf418fdc53ed4c59"
+
+[[package]]
+name = "fastrand"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+
+[[package]]
+name = "fax"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caf1079563223d5d59d83c85886a56e586cfd5c1a26292e971a0fa266531ac5a"
+
+[[package]]
+name = "fdeflate"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
+dependencies = [
+ "simd-adler32",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "flate2"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "foreign-types"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
+dependencies = [
+ "foreign-types-macros",
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-macros"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a5c6c585bc94aaf2c7b51dd4c2ba22680844aba4c687be581871a6f518c5742"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa9a19cbb55df58761df49b23516a86d432839add4af60fc256da840f66ed35b"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-core",
  "futures-io",
  "futures-sink",
  "futures-task",
  "memchr",
  "pin-project-lite",
- "pin-utils",
  "slab",
 ]
 
@@ -454,568 +1040,1313 @@ version = "0.14.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
- "typenum",
- "version_check",
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "gethostname"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bd49230192a3797a9a4d6abe9b3eed6f7fa4c8a8a4947977c6f80025f92cbd8"
+dependencies = [
+ "rustix 1.1.4",
+ "windows-link",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 6.0.0",
+ "rand_core",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "gl_generator"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a95dfc23a2b4a9a2f5ab41d194f8bfda3cabec42af4e39f08c339eb2a0c124d"
+dependencies = [
+ "khronos_api",
+ "log",
+ "xml-rs",
+]
+
+[[package]]
+name = "glow"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5e5ea60d70410161c8bf5da3fdfeaa1c72ed2c15f8bbb9d19fe3a4fad085f08"
+dependencies = [
+ "js-sys",
+ "slotmap",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "glutin"
+version = "0.32.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12124de845cacfebedff80e877bb37b5b75c34c5a4c89e47e1cdd67fb6041325"
+dependencies = [
+ "bitflags 2.13.1",
+ "cfg_aliases",
+ "cgl",
+ "dispatch2",
+ "glutin_egl_sys",
+ "glutin_glx_sys",
+ "glutin_wgl_sys",
+ "libloading",
+ "objc2 0.6.4",
+ "objc2-app-kit 0.3.2",
+ "objc2-core-foundation",
+ "objc2-foundation 0.3.2",
+ "once_cell",
+ "raw-window-handle",
+ "wayland-sys",
+ "windows-sys 0.52.0",
+ "x11-dl",
+]
+
+[[package]]
+name = "glutin-winit"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85edca7075f8fc728f28cb8fbb111a96c3b89e930574369e3e9c27eb75d3788f"
+dependencies = [
+ "cfg_aliases",
+ "glutin",
+ "raw-window-handle",
+ "winit",
+]
+
+[[package]]
+name = "glutin_egl_sys"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c4680ba6195f424febdc3ba46e7a42a0e58743f2edb115297b86d7f8ecc02d2"
+dependencies = [
+ "gl_generator",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "glutin_glx_sys"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7bb2938045a88b612499fbcba375a77198e01306f52272e692f8c1f3751185"
+dependencies = [
+ "gl_generator",
+ "x11-dl",
+]
+
+[[package]]
+name = "glutin_wgl_sys"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c4ee00b289aba7a9e5306d57c2d05499b2e5dc427f84ac708bd2c090212cf3e"
+dependencies = [
+ "gl_generator",
+]
+
+[[package]]
+name = "half"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
+dependencies = [
+ "cfg-if",
+ "crunchy",
+ "num-traits",
+ "zerocopy",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hermit-abi"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hexf-parse"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfa686283ad6dd069f105e5ab091b04c62850d3e4cf5d67debad1933f55023df"
+
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "http"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "hyper"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_properties"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+
+[[package]]
+name = "icu_provider"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "image"
+version = "0.25.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85ab80394333c02fe689eaf900ab500fbd0c2213da414687ebf995a65d5a6104"
+dependencies = [
+ "bytemuck",
+ "byteorder-lite",
+ "moxcms",
+ "num-traits",
+ "png",
+ "tiff",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+]
+
+[[package]]
+name = "indicatif"
+version = "0.17.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "183b3088984b400f4cfac3620d5e076c84da5364016b4f49473de574b2586235"
+dependencies = [
+ "console",
+ "number_prefix",
+ "portable-atomic",
+ "unicode-width",
+ "web-time",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "block-padding",
+ "generic-array",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys 0.4.1",
+ "log",
+ "simd_cesu8",
+ "thiserror 2.0.18",
+ "walkdir",
+ "windows-link",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41a652e1f9b6e0275df1f15b32661cf0d4b78d4d87ddec5e0c3c20f097433258"
+dependencies = [
+ "jni-sys 0.4.1",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom 0.4.3",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "khronos_api"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2db585e1d738fc771bf08a151420d3ed193d9d895a36df7f6f8a9456b911ddc"
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "libloading"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
+dependencies = [
+ "cfg-if",
+ "windows-link",
+]
+
+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
+[[package]]
+name = "libredox"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c943259e342f1e06ff2da7a83eabdfe7f92ce10262688dbf1895ff0b3e6e4652"
+dependencies = [
+ "bitflags 2.13.1",
+ "libc",
+ "plain",
+ "redox_syscall 0.9.0",
+]
+
+[[package]]
+name = "libusb1-sys"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da050ade7ac4ff1ba5379af847a10a10a8e284181e060105bf8d86960ce9ce0f"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+
+[[package]]
+name = "litrs"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "memmap2"
+version = "0.9.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
 ]
 
 [[package]]
-name = "getrandom"
-version = "0.2.16"
+name = "mio"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
 dependencies = [
- "cfg-if",
- "js-sys",
  "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
- "wasm-bindgen",
+ "wasi",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
-name = "getrandom"
-version = "0.3.3"
+name = "moxcms"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
+checksum = "bb85c154ba489f01b25c0d36ae69a87e4a1c73a72631fc6c0eb6dde34a73e44b"
 dependencies = [
- "cfg-if",
- "js-sys",
- "libc",
- "r-efi",
- "wasi 0.14.3+wasi-0.2.4",
- "wasm-bindgen",
+ "num-traits",
+ "pxfm",
 ]
 
 [[package]]
-name = "gimli"
-version = "0.31.1"
+name = "naga"
+version = "27.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
+checksum = "066cf25f0e8b11ee0df221219010f213ad429855f57c494f995590c861a9a7d8"
+dependencies = [
+ "arrayvec",
+ "bit-set",
+ "bitflags 2.13.1",
+ "cfg-if",
+ "cfg_aliases",
+ "codespan-reporting",
+ "half",
+ "hashbrown 0.16.1",
+ "hexf-parse",
+ "indexmap",
+ "libm",
+ "log",
+ "num-traits",
+ "once_cell",
+ "rustc-hash 1.1.0",
+ "thiserror 2.0.18",
+ "unicode-ident",
+]
 
 [[package]]
-name = "heck"
-version = "0.5.0"
+name = "ndk"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+checksum = "c3f42e7bbe13d351b6bead8286a43aac9534b82bd3cc43e47037f012ebfd62d4"
+dependencies = [
+ "bitflags 2.13.1",
+ "jni-sys 0.3.1",
+ "log",
+ "ndk-sys",
+ "num_enum",
+ "raw-window-handle",
+ "thiserror 1.0.69",
+]
 
 [[package]]
-name = "hex"
-version = "0.4.3"
+name = "ndk-context"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
 
 [[package]]
-name = "http"
-version = "1.3.1"
+name = "ndk-sys"
+version = "0.6.0+11769913"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4a85d31aea989eead29a3aaf9e1115a180df8282431156e533de47660892565"
+checksum = "ee6cda3051665f1fb8d9e08fc35c96d5a244fb1be711a03b71118828afc9a873"
 dependencies = [
- "bytes",
- "fnv",
- "itoa",
+ "jni-sys 0.3.1",
 ]
 
 [[package]]
-name = "http-body"
-version = "1.0.1"
+name = "nix"
+version = "0.31.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
 dependencies = [
- "bytes",
- "http",
+ "bitflags 2.13.1",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
 ]
 
 [[package]]
-name = "http-body-util"
-version = "0.1.3"
+name = "nohash-hasher"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
-dependencies = [
- "bytes",
- "futures-core",
- "http",
- "http-body",
- "pin-project-lite",
-]
+checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
 
 [[package]]
-name = "httparse"
-version = "1.10.1"
+name = "num-traits"
+version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+ "libm",
+]
 
 [[package]]
-name = "hyper"
-version = "1.7.0"
+name = "num_enum"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb3aa54a13a0dfe7fbe3a59e0c76093041720fdc77b110cc0fc260fafb4dc51e"
+checksum = "5d0bca838442ec211fa11de3a8b0e0e8f3a4522575b5c4c06ed722e005036f26"
 dependencies = [
- "atomic-waker",
- "bytes",
- "futures-channel",
- "futures-core",
- "http",
- "http-body",
- "httparse",
- "itoa",
- "pin-project-lite",
- "pin-utils",
- "smallvec",
- "tokio",
- "want",
+ "num_enum_derive",
+ "rustversion",
 ]
 
 [[package]]
-name = "hyper-rustls"
-version = "0.27.7"
+name = "num_enum_derive"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
+checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8"
 dependencies = [
- "http",
- "hyper",
- "hyper-util",
- "rustls",
- "rustls-pki-types",
- "tokio",
- "tokio-rustls",
- "tower-service",
- "webpki-roots",
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn",
 ]
 
 [[package]]
-name = "hyper-util"
-version = "0.1.16"
+name = "number_prefix"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d9b05277c7e8da2c93a568989bb6207bef0112e8d17df7a6eda4a3cf143bc5e"
-dependencies = [
- "base64",
- "bytes",
- "futures-channel",
- "futures-core",
- "futures-util",
- "http",
- "http-body",
- "hyper",
- "ipnet",
- "libc",
- "percent-encoding",
- "pin-project-lite",
- "socket2",
- "tokio",
- "tower-service",
- "tracing",
-]
+checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"
 
 [[package]]
-name = "icu_collections"
-version = "2.0.0"
+name = "objc-sys"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "200072f5d0e3614556f94a9930d5dc3e0662a652823904c3a75dc3b0af7fee47"
-dependencies = [
- "displaydoc",
- "potential_utf",
- "yoke",
- "zerofrom",
- "zerovec",
-]
+checksum = "cdb91bdd390c7ce1a8607f35f3ca7151b65afc0ff5ff3b34fa350f7d7c7e4310"
 
 [[package]]
-name = "icu_locale_core"
-version = "2.0.0"
+name = "objc2"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cde2700ccaed3872079a65fb1a78f6c0a36c91570f28755dda67bc8f7d9f00a"
+checksum = "46a785d4eeff09c14c487497c162e92766fbb3e4059a71840cecc03d9a50b804"
 dependencies = [
- "displaydoc",
- "litemap",
- "tinystr",
- "writeable",
- "zerovec",
+ "objc-sys",
+ "objc2-encode",
 ]
 
 [[package]]
-name = "icu_normalizer"
-version = "2.0.0"
+name = "objc2"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "436880e8e18df4d7bbc06d58432329d6458cc84531f7ac5f024e93deadb37979"
+checksum = "3a12a8ed07aefc768292f076dc3ac8c48f3781c8f2d5851dd3d98950e8c5a89f"
 dependencies = [
- "displaydoc",
- "icu_collections",
- "icu_normalizer_data",
- "icu_properties",
- "icu_provider",
- "smallvec",
- "zerovec",
+ "objc2-encode",
 ]
 
 [[package]]
-name = "icu_normalizer_data"
-version = "2.0.0"
+name = "objc2-app-kit"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00210d6893afc98edb752b664b8890f0ef174c8adbb8d0be9710fa66fbbf72d3"
+checksum = "e4e89ad9e3d7d297152b17d39ed92cd50ca8063a89a9fa569046d41568891eff"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2 0.5.1",
+ "libc",
+ "objc2 0.5.2",
+ "objc2-core-data",
+ "objc2-core-image",
+ "objc2-foundation 0.2.2",
+ "objc2-quartz-core",
+]
 
 [[package]]
-name = "icu_properties"
-version = "2.0.1"
+name = "objc2-app-kit"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "016c619c1eeb94efb86809b015c58f479963de65bdb6253345c1a1276f22e32b"
+checksum = "d49e936b501e5c5bf01fda3a9452ff86dc3ea98ad5f283e1455153142d97518c"
 dependencies = [
- "displaydoc",
- "icu_collections",
- "icu_locale_core",
- "icu_properties_data",
- "icu_provider",
- "potential_utf",
- "zerotrie",
- "zerovec",
+ "bitflags 2.13.1",
+ "block2 0.6.2",
+ "objc2 0.6.4",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-foundation 0.3.2",
 ]
 
 [[package]]
-name = "icu_properties_data"
-version = "2.0.1"
+name = "objc2-cloud-kit"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "298459143998310acd25ffe6810ed544932242d3f07083eee1084d83a71bd632"
+checksum = "74dd3b56391c7a0596a295029734d3c1c5e7e510a4cb30245f8221ccea96b009"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-core-location",
+ "objc2-foundation 0.2.2",
+]
 
 [[package]]
-name = "icu_provider"
-version = "2.0.0"
+name = "objc2-contacts"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03c80da27b5f4187909049ee2d72f276f0d9f99a42c306bd0131ecfe04d8e5af"
+checksum = "a5ff520e9c33812fd374d8deecef01d4a840e7b41862d849513de77e44aa4889"
 dependencies = [
- "displaydoc",
- "icu_locale_core",
- "stable_deref_trait",
- "tinystr",
- "writeable",
- "yoke",
- "zerofrom",
- "zerotrie",
- "zerovec",
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
 ]
 
 [[package]]
-name = "idna"
-version = "1.1.0"
+name = "objc2-core-data"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+checksum = "617fbf49e071c178c0b24c080767db52958f716d9eabdf0890523aeae54773ef"
 dependencies = [
- "idna_adapter",
- "smallvec",
- "utf8_iter",
+ "bitflags 2.13.1",
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
 ]
 
 [[package]]
-name = "idna_adapter"
-version = "1.2.1"
+name = "objc2-core-foundation"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
 dependencies = [
- "icu_normalizer",
- "icu_properties",
+ "bitflags 2.13.1",
+ "dispatch2",
+ "objc2 0.6.4",
 ]
 
 [[package]]
-name = "indicatif"
-version = "0.17.11"
+name = "objc2-core-graphics"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "183b3088984b400f4cfac3620d5e076c84da5364016b4f49473de574b2586235"
+checksum = "e022c9d066895efa1345f8e33e584b9f958da2fd4cd116792e15e07e4720a807"
 dependencies = [
- "console",
- "number_prefix",
- "portable-atomic",
- "unicode-width",
- "web-time",
+ "bitflags 2.13.1",
+ "dispatch2",
+ "objc2 0.6.4",
+ "objc2-core-foundation",
+ "objc2-io-surface",
 ]
 
 [[package]]
-name = "inout"
-version = "0.1.4"
+name = "objc2-core-image"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+checksum = "55260963a527c99f1819c4f8e3b47fe04f9650694ef348ffd2227e8196d34c80"
 dependencies = [
- "block-padding",
- "generic-array",
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
+ "objc2-metal",
 ]
 
 [[package]]
-name = "io-uring"
-version = "0.7.10"
+name = "objc2-core-location"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "046fa2d4d00aea763528b4950358d0ead425372445dc8ff86312b3c69ff7727b"
+checksum = "000cfee34e683244f284252ee206a27953279d370e309649dc3ee317b37e5781"
 dependencies = [
- "bitflags",
- "cfg-if",
- "libc",
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-contacts",
+ "objc2-foundation 0.2.2",
 ]
 
 [[package]]
-name = "ipnet"
-version = "2.11.0"
+name = "objc2-encode"
+version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
+checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33"
 
 [[package]]
-name = "iri-string"
-version = "0.7.8"
+name = "objc2-foundation"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbc5ebe9c3a1a7a5127f920a418f7585e9e758e911d0466ed004f393b0e380b2"
+checksum = "0ee638a5da3799329310ad4cfa62fbf045d5f56e3ef5ba4149e7452dcf89d5a8"
 dependencies = [
- "memchr",
- "serde",
+ "bitflags 2.13.1",
+ "block2 0.5.1",
+ "dispatch",
+ "libc",
+ "objc2 0.5.2",
 ]
 
 [[package]]
-name = "is_terminal_polyfill"
-version = "1.70.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
-
-[[package]]
-name = "itoa"
-version = "1.0.15"
+name = "objc2-foundation"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
+dependencies = [
+ "bitflags 2.13.1",
+ "objc2 0.6.4",
+ "objc2-core-foundation",
+]
 
 [[package]]
-name = "jiff"
-version = "0.2.15"
+name = "objc2-io-surface"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be1f93b8b1eb69c77f24bbb0afdf66f54b632ee39af40ca21c4365a1d7347e49"
+checksum = "180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d"
 dependencies = [
- "jiff-static",
- "log",
- "portable-atomic",
- "portable-atomic-util",
- "serde",
+ "bitflags 2.13.1",
+ "objc2 0.6.4",
+ "objc2-core-foundation",
 ]
 
 [[package]]
-name = "jiff-static"
-version = "0.2.15"
+name = "objc2-link-presentation"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03343451ff899767262ec32146f6d559dd759fdadf42ff0e227c7c48f72594b4"
+checksum = "a1a1ae721c5e35be65f01a03b6d2ac13a54cb4fa70d8a5da293d7b0020261398"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn",
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-app-kit 0.2.2",
+ "objc2-foundation 0.2.2",
 ]
 
 [[package]]
-name = "js-sys"
-version = "0.3.78"
+name = "objc2-metal"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c0b063578492ceec17683ef2f8c5e89121fbd0b172cbc280635ab7567db2738"
+checksum = "dd0cba1276f6023976a406a14ffa85e1fdd19df6b0f737b063b95f6c8c7aadd6"
 dependencies = [
- "once_cell",
- "wasm-bindgen",
+ "bitflags 2.13.1",
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
 ]
 
 [[package]]
-name = "libc"
-version = "0.2.175"
+name = "objc2-quartz-core"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a82ae493e598baaea5209805c49bbf2ea7de956d50d7da0da1164f9c6d28543"
+checksum = "e42bee7bff906b14b167da2bac5efe6b6a07e6f7c0a21a7308d40c960242dc7a"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
+ "objc2-metal",
+]
 
 [[package]]
-name = "libredox"
-version = "0.1.9"
+name = "objc2-symbols"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "391290121bad3d37fbddad76d8f5d1c1c314cfc646d143d7e07a3086ddff0ce3"
+checksum = "0a684efe3dec1b305badae1a28f6555f6ddd3bb2c2267896782858d5a78404dc"
 dependencies = [
- "bitflags",
- "libc",
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
 ]
 
 [[package]]
-name = "libusb1-sys"
-version = "0.7.0"
+name = "objc2-ui-kit"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da050ade7ac4ff1ba5379af847a10a10a8e284181e060105bf8d86960ce9ce0f"
+checksum = "b8bb46798b20cd6b91cbd113524c490f1686f4c4e8f49502431415f3512e2b6f"
 dependencies = [
- "cc",
- "libc",
- "pkg-config",
- "vcpkg",
+ "bitflags 2.13.1",
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-cloud-kit",
+ "objc2-core-data",
+ "objc2-core-image",
+ "objc2-core-location",
+ "objc2-foundation 0.2.2",
+ "objc2-link-presentation",
+ "objc2-quartz-core",
+ "objc2-symbols",
+ "objc2-uniform-type-identifiers",
+ "objc2-user-notifications",
 ]
 
 [[package]]
-name = "linux-raw-sys"
-version = "0.9.4"
+name = "objc2-uniform-type-identifiers"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd945864f07fe9f5371a27ad7b52a172b4b499999f1d97574c9fa68373937e12"
+checksum = "44fa5f9748dbfe1ca6c0b79ad20725a11eca7c2218bceb4b005cb1be26273bfe"
+dependencies = [
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
+]
 
 [[package]]
-name = "litemap"
-version = "0.8.0"
+name = "objc2-user-notifications"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "241eaef5fd12c88705a01fc1066c48c4b36e0dd4377dcdc7ec3942cea7a69956"
+checksum = "76cfcbf642358e8689af64cee815d139339f3ed8ad05103ed5eaf73db8d84cb3"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2 0.5.1",
+ "objc2 0.5.2",
+ "objc2-core-location",
+ "objc2-foundation 0.2.2",
+]
 
 [[package]]
-name = "log"
-version = "0.4.28"
+name = "once_cell"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
-name = "lru-slab"
-version = "0.1.2"
+name = "once_cell_polyfill"
+version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
 [[package]]
-name = "md-5"
-version = "0.10.6"
+name = "orbclient"
+version = "0.3.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+checksum = "5df339f526ea9a60e371768d50efc2f2508c7203290731565d1f7a6f71d21747"
 dependencies = [
- "cfg-if",
- "digest",
+ "libc",
+ "libredox",
 ]
 
 [[package]]
-name = "memchr"
-version = "2.7.5"
+name = "owned_ttf_parser"
+version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
+checksum = "36820e9051aca1014ddc75770aab4d68bc1e9e632f0f5627c4086bc216fb583b"
+dependencies = [
+ "ttf-parser",
+]
 
 [[package]]
-name = "miniz_oxide"
-version = "0.8.9"
+name = "parking_lot"
+version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
 dependencies = [
- "adler2",
+ "lock_api",
+ "parking_lot_core",
 ]
 
 [[package]]
-name = "mio"
-version = "1.0.4"
+name = "parking_lot_core"
+version = "0.9.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
 dependencies = [
+ "cfg-if",
  "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
- "windows-sys 0.59.0",
+ "redox_syscall 0.5.18",
+ "smallvec",
+ "windows-link",
 ]
 
 [[package]]
-name = "num-conv"
-version = "0.1.0"
+name = "percent-encoding"
+version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
-name = "number_prefix"
-version = "0.4.0"
+name = "pin-project"
+version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"
+checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
+dependencies = [
+ "pin-project-internal",
+]
 
 [[package]]
-name = "object"
-version = "0.36.7"
+name = "pin-project-internal"
+version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
+checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
 dependencies = [
- "memchr",
+ "proc-macro2",
+ "quote",
+ "syn",
 ]
 
 [[package]]
-name = "once_cell"
-version = "1.21.3"
+name = "pin-project-lite"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
-name = "once_cell_polyfill"
-version = "1.70.1"
+name = "pkg-config"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 
 [[package]]
-name = "percent-encoding"
-version = "2.3.2"
+name = "plain"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
 [[package]]
-name = "pin-project-lite"
-version = "0.2.16"
+name = "png"
+version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
+dependencies = [
+ "bitflags 2.13.1",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide",
+]
 
 [[package]]
-name = "pin-utils"
-version = "0.1.0"
+name = "polling"
+version = "3.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+checksum = "5d0e4f59085d47d8241c88ead0f274e8a0cb551f3625263c05eb8dd897c34218"
+dependencies = [
+ "cfg-if",
+ "concurrent-queue",
+ "hermit-abi",
+ "pin-project-lite",
+ "rustix 1.1.4",
+ "windows-sys 0.61.2",
+]
 
 [[package]]
-name = "pkg-config"
-version = "0.3.32"
+name = "pollster"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+checksum = "2f3a9f18d041e6d0e102a0a46750538147e5e8992d3b4873aaafee2520b00ce3"
 
 [[package]]
 name = "portable-atomic"
-version = "1.11.1"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
 
 [[package]]
 name = "portable-atomic-util"
-version = "0.2.4"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8a2f0d8d040d7848a709caf78912debcc3f33ee4b3cac47d73d1e1069e83507"
+checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
 dependencies = [
  "portable-atomic",
 ]
 
 [[package]]
 name = "potential_utf"
-version = "0.1.3"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84df19adbe5b5a0782edcab45899906947ab039ccf4573713735ee7de1e6b08a"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
 dependencies = [
  "zerovec",
 ]
 
 [[package]]
-name = "powerfmt"
-version = "0.2.0"
+name = "proc-macro-crate"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
+dependencies = [
+ "toml_edit",
+]
 
 [[package]]
-name = "ppv-lite86"
-version = "0.2.21"
+name = "proc-macro2"
+version = "1.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
 dependencies = [
- "zerocopy",
+ "unicode-ident",
 ]
 
 [[package]]
-name = "proc-macro2"
-version = "1.0.101"
+name = "profiling"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d595e54a326bc53c1c197b32d295e14b169e3cfeaa8dc82b529f947fba6bcf5"
+
+[[package]]
+name = "pxfm"
+version = "0.1.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d55d956fa96f5ec02be2e13af0e20391a5aa83d6a074e3ad368959d0fab299ea"
+
+[[package]]
+name = "quick-error"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
+
+[[package]]
+name = "quick-xml"
+version = "0.39.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89ae43fd86e4158d6db51ad8e2b80f313af9cc74f5c0e03ccb87de09998732de"
+checksum = "cdcc8dd4e2f670d309a5f0e83fe36dfdc05af317008fea29144da1a2ac858e5e"
 dependencies = [
- "unicode-ident",
+ "memchr",
 ]
 
 [[package]]
 name = "quinn"
-version = "0.11.9"
+version = "0.11.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
 dependencies = [
  "bytes",
  "cfg_aliases",
  "pin-project-lite",
  "quinn-proto",
  "quinn-udp",
- "rustc-hash",
+ "rustc-hash 2.1.3",
  "rustls",
  "socket2",
- "thiserror 2.0.16",
+ "thiserror 2.0.18",
  "tokio",
  "tracing",
  "web-time",
@@ -1023,20 +2354,21 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.13"
+version = "0.11.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1906b49b0c3bc04b5fe5d86a77925ae6524a19b816ae38ce1e426255f1d8a31"
+checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
 dependencies = [
  "bytes",
- "getrandom 0.3.3",
+ "getrandom 0.4.3",
  "lru-slab",
  "rand",
+ "rand_pcg",
  "ring",
- "rustc-hash",
+ "rustc-hash 2.1.3",
  "rustls",
  "rustls-pki-types",
  "slab",
- "thiserror 2.0.16",
+ "thiserror 2.0.18",
  "tinyvec",
  "tracing",
  "web-time",
@@ -1044,23 +2376,23 @@ dependencies = [
 
 [[package]]
 name = "quinn-udp"
-version = "0.5.14"
+version = "0.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694"
 dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.40"
+version = "1.0.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
+checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
 dependencies = [
  "proc-macro2",
 ]
@@ -1071,80 +2403,82 @@ version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
 [[package]]
 name = "rand"
-version = "0.9.2"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
- "rand_chacha",
+ "chacha20",
+ "getrandom 0.4.3",
  "rand_core",
 ]
 
 [[package]]
-name = "rand_chacha"
-version = "0.9.0"
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "rand_pcg"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
 dependencies = [
- "ppv-lite86",
  "rand_core",
 ]
 
 [[package]]
-name = "rand_core"
-version = "0.9.3"
+name = "raw-window-handle"
+version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
-dependencies = [
- "getrandom 0.3.3",
-]
+checksum = "20675572f6f24e9e76ef639bc5552774ed45f1c30e2951e1e99c59888861c539"
 
 [[package]]
-name = "redox_users"
-version = "0.4.6"
+name = "redox_syscall"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
 dependencies = [
- "getrandom 0.2.16",
- "libredox",
- "thiserror 1.0.69",
+ "bitflags 1.3.2",
 ]
 
 [[package]]
-name = "regex"
-version = "1.11.2"
+name = "redox_syscall"
+version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23d7fd106d8c02486a8d64e778353d1cffe08ce79ac2e82f540c86d0facf6912"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "aho-corasick",
- "memchr",
- "regex-automata",
- "regex-syntax",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
-name = "regex-automata"
-version = "0.4.10"
+name = "redox_syscall"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b9458fa0bfeeac22b5ca447c63aaf45f28439a709ccd244698632f9aa6394d6"
+checksum = "c5102a6aaa05aa011a238e178e6bca86d2cb56fc9f586d37cb80f5bca6e07759"
 dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
-name = "regex-syntax"
-version = "0.8.6"
+name = "renderdoc-sys"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caf4aa5b0f434c91fe5c7f1ecb6a5ece2130b02ad2a590589dda5146df959001"
+checksum = "19b30a45b0cd0bcca8037f3d0dc3421eaf95327a17cad11964fb8179b4fc4832"
 
 [[package]]
 name = "reqwest"
-version = "0.12.23"
+version = "0.12.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d429f34c8092b2d42c7c93cec323bb4adeb7c67698f70839adec842ec10c7ceb"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
  "base64",
  "bytes",
@@ -1180,6 +2514,33 @@ dependencies = [
  "webpki-roots",
 ]
 
+[[package]]
+name = "rfd"
+version = "0.17.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20dafead71c16a34e1ff357ddefc8afc11e7d51d6d2b9fbd07eaa48e3e540220"
+dependencies = [
+ "block2 0.6.2",
+ "dispatch2",
+ "js-sys",
+ "libc",
+ "log",
+ "objc2 0.6.4",
+ "objc2-app-kit 0.3.2",
+ "objc2-core-foundation",
+ "objc2-foundation 0.3.2",
+ "percent-encoding",
+ "pollster",
+ "raw-window-handle",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "web-sys",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -1188,12 +2549,25 @@ checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
 dependencies = [
  "cc",
  "cfg-if",
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "libc",
  "untrusted",
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "ron"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db09040cc89e461f1a265139777a2bde7f8d8c67c4936f700c63ce3e2904d468"
+dependencies = [
+ "base64",
+ "bitflags 2.13.1",
+ "serde",
+ "serde_derive",
+ "unicode-ident",
+]
+
 [[package]]
 name = "rusb"
 version = "0.9.4"
@@ -1205,35 +2579,57 @@ dependencies = [
 ]
 
 [[package]]
-name = "rustc-demangle"
-version = "0.1.26"
+name = "rustc-hash"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56f7d92ca342cea22a06f2121d944b4fd82af56988c270852495420f961d4ace"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
 name = "rustc-hash"
-version = "2.1.1"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
 
 [[package]]
 name = "rustix"
-version = "1.0.8"
+version = "0.38.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
+dependencies = [
+ "bitflags 2.13.1",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.4.15",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11181fbabf243db407ef8df94a6ce0b2f9a733bd8be4ad02b4eda9602296cac8"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.1",
  "errno",
  "libc",
- "linux-raw-sys",
- "windows-sys 0.60.2",
+ "linux-raw-sys 0.12.1",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "rustls"
-version = "0.23.31"
+version = "0.23.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0ebcbd2f03de0fc1122ad9bb24b127a5a6cd51d72604a3f3c50ac459762b6cc"
+checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
 dependencies = [
  "once_cell",
  "ring",
@@ -1245,9 +2641,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.12.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79"
+checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046"
 dependencies = [
  "web-time",
  "zeroize",
@@ -1255,9 +2651,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.4"
+version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a17884ae0c1b773f1ccd2bd4a8c72f16da897310a98b0e84bf349ad5ead92fc"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -1266,57 +2662,101 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.22"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
 
 [[package]]
 name = "ryu"
-version = "1.0.20"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "scoped-tls"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
 
 [[package]]
 name = "sensitivity"
-version = "0.1.0"
+version = "1.1.0"
 dependencies = [
  "aes",
  "anyhow",
  "base64",
- "block-padding",
  "byteorder",
  "cbc",
  "clap",
- "dirs-next",
- "env_logger",
+ "clap_complete",
+ "ctrlc",
  "hex",
  "indicatif",
- "log",
  "md-5",
  "reqwest",
  "rusb",
  "serde",
  "serde_json",
  "tempfile",
- "thiserror 1.0.69",
- "time",
- "urlencoding",
+]
+
+[[package]]
+name = "sensitivity-gui"
+version = "1.1.0"
+dependencies = [
+ "anyhow",
+ "eframe",
+ "rfd",
+ "sensitivity",
+ "serde",
+ "serde_json",
 ]
 
 [[package]]
 name = "serde"
-version = "1.0.219"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.219"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1325,14 +2765,15 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.143"
+version = "1.0.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d401abef1d108fbd9cbaebc3e46611f4b1021f714a0597a71f41ee463f5f4a5a"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
 dependencies = [
  "itoa",
  "memchr",
- "ryu",
  "serde",
+ "serde_core",
+ "zmij",
 ]
 
 [[package]]
@@ -1349,37 +2790,146 @@ dependencies = [
 
 [[package]]
 name = "shlex"
-version = "1.3.0"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
+
+[[package]]
+name = "simd_cesu8"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
 
 [[package]]
 name = "slab"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "slotmap"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdd58c3c93c3d278ca835519292445cb4b0d4dc59ccfdf7ceadaab3f8aeb4038"
+dependencies = [
+ "version_check",
+]
 
 [[package]]
 name = "smallvec"
-version = "1.15.1"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "smithay-client-toolkit"
+version = "0.19.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3457dea1f0eb631b4034d61d4d8c32074caa6cd1ab2d59f2327bd8461e2c0016"
+dependencies = [
+ "bitflags 2.13.1",
+ "calloop 0.13.0",
+ "calloop-wayland-source 0.3.0",
+ "cursor-icon",
+ "libc",
+ "log",
+ "memmap2",
+ "rustix 0.38.44",
+ "thiserror 1.0.69",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-csd-frame",
+ "wayland-cursor",
+ "wayland-protocols",
+ "wayland-protocols-wlr",
+ "wayland-scanner",
+ "xkeysym",
+]
+
+[[package]]
+name = "smithay-client-toolkit"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0512da38f5e2b31201a93524adb8d3136276fa4fe4aafab4e1f727a82b534cc0"
+dependencies = [
+ "bitflags 2.13.1",
+ "calloop 0.14.4",
+ "calloop-wayland-source 0.4.1",
+ "cursor-icon",
+ "libc",
+ "log",
+ "memmap2",
+ "rustix 1.1.4",
+ "thiserror 2.0.18",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-csd-frame",
+ "wayland-cursor",
+ "wayland-protocols",
+ "wayland-protocols-experimental",
+ "wayland-protocols-misc",
+ "wayland-protocols-wlr",
+ "wayland-scanner",
+ "xkeysym",
+]
+
+[[package]]
+name = "smithay-clipboard"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71704c03f739f7745053bde45fa203a46c58d25bc5c4efba1d9a60e9dba81226"
+dependencies = [
+ "libc",
+ "smithay-client-toolkit 0.20.0",
+ "wayland-backend",
+]
+
+[[package]]
+name = "smol_str"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+checksum = "dd538fb6910ac1099850255cf94a94df6551fbdd602454387d0adb2d1ca6dead"
+dependencies = [
+ "serde",
+]
 
 [[package]]
 name = "socket2"
-version = "0.6.0"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "233504af464074f9d066d7b5416c5f9b894a5862a6506e306f7b816cdd6f1807"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "stable_deref_trait"
-version = "1.2.0"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
 [[package]]
 name = "strsim"
@@ -1395,9 +2945,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "2.0.106"
+version = "2.0.119"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ede7c438028d4436d71104916910f5bb611972c5cfd7f89b8300a8186e6fada6"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1426,15 +2976,15 @@ dependencies = [
 
 [[package]]
 name = "tempfile"
-version = "3.21.0"
+version = "3.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15b61f8f20e3a6f7e0649d825294eaf317edce30f82cf6026e7e4cb9222a7d1e"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.3",
+ "getrandom 0.4.3",
  "once_cell",
- "rustix",
- "windows-sys 0.60.2",
+ "rustix 1.1.4",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1448,11 +2998,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.16"
+version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3467d614147380f2e4e374161426ff399c91084acd2363eaf549172b3d5e60c0"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
 dependencies = [
- "thiserror-impl 2.0.16",
+ "thiserror-impl 2.0.18",
 ]
 
 [[package]]
@@ -1468,9 +3018,9 @@ dependencies = [
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.16"
+version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c5e1be1c48b9172ee610da68fd9cd2770e7a4056cb3fc98710ee6906f0c7960"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1478,29 +3028,24 @@ dependencies = [
 ]
 
 [[package]]
-name = "time"
-version = "0.3.43"
+name = "tiff"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83bde6f1ec10e72d583d91623c939f623002284ef622b87de38cfd546cbf2031"
+checksum = "b63feaf3343d35b6ca4d50483f94843803b0f51634937cc2ec519fc32232bc52"
 dependencies = [
- "deranged",
- "num-conv",
- "powerfmt",
- "serde",
- "time-core",
+ "fax",
+ "flate2",
+ "half",
+ "quick-error",
+ "weezl",
+ "zune-jpeg",
 ]
 
-[[package]]
-name = "time-core"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40868e7c1d2f0b8d73e4a8c7f0ff63af4f6d19be117e90bd73eb1d62cf831c6b"
-
 [[package]]
 name = "tinystr"
-version = "0.8.1"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d4f6d1145dcb577acf783d4e601bc1d76a13337bb54e6233add580b07344c8b"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
 dependencies = [
  "displaydoc",
  "zerovec",
@@ -1508,9 +3053,9 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.10.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa5fdc3bce6191a1dbc8c02d5c8bffcf557bafa17c124c5264a458f1b0613fa"
+checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
 dependencies = [
  "tinyvec_macros",
 ]
@@ -1523,36 +3068,63 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.47.1"
+version = "1.52.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89e49afdadebb872d3145a5638b59eb0691ea23e46ca484037cfab3b76b95038"
+checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
 dependencies = [
- "backtrace",
  "bytes",
- "io-uring",
  "libc",
  "mio",
  "pin-project-lite",
- "slab",
  "socket2",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "tokio-rustls"
-version = "0.26.2"
+version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e727b36a1a0e8b74c376ac2211e40c2c8af09fb4013c60d910495810f008e9b"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
 dependencies = [
  "rustls",
  "tokio",
 ]
 
+[[package]]
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.25.13+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6975367e4d2ef766d86af01ffad14b622fecc8d4357a998fbc4deb6e9bacaf9b"
+dependencies = [
+ "indexmap",
+ "toml_datetime",
+ "toml_parser",
+ "winnow",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
+dependencies = [
+ "winnow",
+]
+
 [[package]]
 name = "tower"
-version = "0.5.2"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
 dependencies = [
  "futures-core",
  "futures-util",
@@ -1565,20 +3137,20 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.6.6"
+version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adc82fd73de2a9722ac5da747f12383d2bfdb93591ee6c58486e0097890f05f2"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.1",
  "bytes",
  "futures-util",
  "http",
  "http-body",
- "iri-string",
  "pin-project-lite",
  "tower",
  "tower-layer",
  "tower-service",
+ "url",
 ]
 
 [[package]]
@@ -1595,19 +3167,20 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 
 [[package]]
 name = "tracing"
-version = "0.1.41"
+version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
 dependencies = [
+ "log",
  "pin-project-lite",
  "tracing-core",
 ]
 
 [[package]]
 name = "tracing-core"
-version = "0.1.34"
+version = "0.1.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d12581f227e93f094d3af2ae690a574abb8a2b9b7a96e7cfe9647b2b617678"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
 dependencies = [
  "once_cell",
 ]
@@ -1618,23 +3191,44 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
+[[package]]
+name = "ttf-parser"
+version = "0.25.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2df906b07856748fa3f6e0ad0cbaa047052d4a7dd609e231c4f72cee8c36f31"
+
+[[package]]
+name = "type-map"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb30dbbd9036155e74adad6812e9898d03ec374946234fbcebd5dfc7b9187b90"
+dependencies = [
+ "rustc-hash 2.1.3",
+]
+
 [[package]]
 name = "typenum"
-version = "1.18.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.18"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
 
 [[package]]
 name = "unicode-width"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a1a07cc7db3810833284e8d372ccdc6da29741639ecc70c9ec107df0fa6154c"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
 
 [[package]]
 name = "untrusted"
@@ -1644,9 +3238,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "url"
-version = "2.5.7"
+version = "2.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08bc136a29a3d1758e07a9cca267be308aeebf5cfd5a10f3f67ab2097683ef5b"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
 dependencies = [
  "form_urlencoded",
  "idna",
@@ -1654,12 +3248,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "urlencoding"
-version = "2.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
-
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -1684,6 +3272,16 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
 [[package]]
 name = "want"
 version = "0.3.1"
@@ -1700,19 +3298,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
-name = "wasi"
-version = "0.14.3+wasi-0.2.4"
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a51ae83037bdd272a9e28ce236db8c07016dd0d50c27038b3f407533c030c95"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
 dependencies = [
  "wit-bindgen",
 ]
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.101"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e14915cadd45b529bb8d1f343c4ed0ac1de926144b746e2710f9cd05df6603b"
+checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -1721,38 +3319,21 @@ dependencies = [
  "wasm-bindgen-shared",
 ]
 
-[[package]]
-name = "wasm-bindgen-backend"
-version = "0.2.101"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e28d1ba982ca7923fd01448d5c30c6864d0a14109560296a162f80f305fb93bb"
-dependencies = [
- "bumpalo",
- "log",
- "proc-macro2",
- "quote",
- "syn",
- "wasm-bindgen-shared",
-]
-
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.51"
+version = "0.4.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ca85039a9b469b38336411d6d6ced91f3fc87109a2a27b0c197663f5144dffe"
+checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d"
 dependencies = [
- "cfg-if",
  "js-sys",
- "once_cell",
  "wasm-bindgen",
- "web-sys",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.101"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c3d463ae3eff775b0c45df9da45d68837702ac35af998361e2c84e7c5ec1b0d"
+checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -1760,31 +3341,166 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.101"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7bb4ce89b08211f923caf51d527662b75bdc9c9c7aab40f86dcb9fb85ac552aa"
+checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
 dependencies = [
+ "bumpalo",
  "proc-macro2",
  "quote",
  "syn",
- "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.101"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f143854a3b13752c6950862c906306adb27c7e839f7414cec8fea35beab624c1"
+checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
 dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "wayland-backend"
+version = "0.3.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2857dd20b54e916ec7253b3d6b4d5c4d7d4ca2c33c2e11c6c76a99bd8744755d"
+dependencies = [
+ "cc",
+ "downcast-rs",
+ "rustix 1.1.4",
+ "scoped-tls",
+ "smallvec",
+ "wayland-sys",
+]
+
+[[package]]
+name = "wayland-client"
+version = "0.31.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "645c7c96bb74690c3189b5c9cb4ca1627062bb23693a4fad9d8c3de958260144"
+dependencies = [
+ "bitflags 2.13.1",
+ "rustix 1.1.4",
+ "wayland-backend",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-csd-frame"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625c5029dbd43d25e6aa9615e88b829a5cad13b2819c4ae129fdbb7c31ab4c7e"
+dependencies = [
+ "bitflags 2.13.1",
+ "cursor-icon",
+ "wayland-backend",
+]
+
+[[package]]
+name = "wayland-cursor"
+version = "0.31.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a52d18780be9b1314328a3de5f930b73d2200112e3849ca6cb11822793fb34d"
+dependencies = [
+ "rustix 1.1.4",
+ "wayland-client",
+ "xcursor",
+]
+
+[[package]]
+name = "wayland-protocols"
+version = "0.32.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23d0c813de3daa2ed6520af85a3bd49b0e722a3078506899aa9686fea58dc4b6"
+dependencies = [
+ "bitflags 2.13.1",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols-experimental"
+version = "20250721.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40a1f863128dcaaec790d7b4b396cc9b9a7a079e878e18c47e6c2d2c5a8dcbb1"
+dependencies = [
+ "bitflags 2.13.1",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols-misc"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e9567599ef23e09b8dad6e429e5738d4509dfc46b3b21f32841a304d16b29c8"
+dependencies = [
+ "bitflags 2.13.1",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols-plasma"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b6d8cf1eb2c1c31ed1f5643c88a6e53538129d4af80030c8cabd1f9fa884d91"
+dependencies = [
+ "bitflags 2.13.1",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols-wlr"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb04e52f7836d7c7976c78ca0250d61e33873c34156a2a1fc9474828ec268234"
+dependencies = [
+ "bitflags 2.13.1",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-scanner"
+version = "0.31.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c324a910fd86ebdc364a3e61ec1f11737d3b1d6c273c0239ee8ff4bc0d24b4a"
+dependencies = [
+ "proc-macro2",
+ "quick-xml",
+ "quote",
+]
+
+[[package]]
+name = "wayland-sys"
+version = "0.31.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8eab23fefc9e41f8e841df4a9c707e8a8c4ed26e944ef69297184de2785e3be"
+dependencies = [
+ "dlib",
+ "log",
+ "once_cell",
+ "pkg-config",
+]
+
 [[package]]
 name = "web-sys"
-version = "0.3.78"
+version = "0.3.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77e4b637749ff0d92b8fad63aa1f7cff3cbe125fd49c175cd6345e7272638b12"
+checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -1800,42 +3516,147 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "webbrowser"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fc95580916af1e68ff6a7be07446fc5db73ebf71cf092de939bbf5f7e189f72"
+dependencies = [
+ "core-foundation 0.10.1",
+ "jni",
+ "log",
+ "ndk-context",
+ "objc2 0.6.4",
+ "objc2-foundation 0.3.2",
+ "url",
+ "web-sys",
+]
+
 [[package]]
 name = "webpki-roots"
-version = "1.0.2"
+version = "1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e8983c3ab33d6fb807cfcdad2491c4ea8cbc8ed839181c7dfd9c67c83e261b2"
+checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf"
 dependencies = [
  "rustls-pki-types",
 ]
 
 [[package]]
-name = "winapi"
-version = "0.3.9"
+name = "weezl"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a28ac98ddc8b9274cb41bb4d9d4d5c425b6020c50c46f25559911905610b4a88"
+
+[[package]]
+name = "wgpu"
+version = "27.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfe68bac7cde125de7a731c3400723cadaaf1703795ad3f4805f187459cd7a77"
+dependencies = [
+ "arrayvec",
+ "bitflags 2.13.1",
+ "cfg-if",
+ "cfg_aliases",
+ "document-features",
+ "hashbrown 0.16.1",
+ "log",
+ "portable-atomic",
+ "profiling",
+ "raw-window-handle",
+ "smallvec",
+ "static_assertions",
+ "wgpu-core",
+ "wgpu-hal",
+ "wgpu-types",
+]
+
+[[package]]
+name = "wgpu-core"
+version = "27.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+checksum = "27a75de515543b1897b26119f93731b385a19aea165a1ec5f0e3acecc229cae7"
 dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
+ "arrayvec",
+ "bit-set",
+ "bit-vec",
+ "bitflags 2.13.1",
+ "bytemuck",
+ "cfg_aliases",
+ "document-features",
+ "hashbrown 0.16.1",
+ "indexmap",
+ "log",
+ "naga",
+ "once_cell",
+ "parking_lot",
+ "portable-atomic",
+ "profiling",
+ "raw-window-handle",
+ "rustc-hash 1.1.0",
+ "smallvec",
+ "thiserror 2.0.18",
+ "wgpu-core-deps-windows-linux-android",
+ "wgpu-hal",
+ "wgpu-types",
 ]
 
 [[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
+name = "wgpu-core-deps-windows-linux-android"
+version = "27.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+checksum = "71197027d61a71748e4120f05a9242b2ad142e3c01f8c1b47707945a879a03c3"
+dependencies = [
+ "wgpu-hal",
+]
 
 [[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
+name = "wgpu-hal"
+version = "27.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b21cb61c57ee198bc4aff71aeadff4cbb80b927beb912506af9c780d64313ce"
+dependencies = [
+ "bitflags 2.13.1",
+ "cfg-if",
+ "cfg_aliases",
+ "libloading",
+ "log",
+ "naga",
+ "portable-atomic",
+ "portable-atomic-util",
+ "raw-window-handle",
+ "renderdoc-sys",
+ "thiserror 2.0.18",
+ "wgpu-types",
+]
+
+[[package]]
+name = "wgpu-types"
+version = "27.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "afdcf84c395990db737f2dd91628706cb31e86d72e53482320d368e52b5da5eb"
+dependencies = [
+ "bitflags 2.13.1",
+ "bytemuck",
+ "js-sys",
+ "log",
+ "thiserror 2.0.18",
+ "web-sys",
+]
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
 
 [[package]]
 name = "windows-link"
-version = "0.1.3"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
 [[package]]
 name = "windows-sys"
@@ -1843,7 +3664,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
@@ -1852,16 +3673,16 @@ version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
 name = "windows-sys"
-version = "0.60.2"
+version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
 dependencies = [
- "windows-targets 0.53.3",
+ "windows-link",
 ]
 
 [[package]]
@@ -1870,148 +3691,205 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]
 
 [[package]]
-name = "windows-targets"
-version = "0.53.3"
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5fe6031c4041849d7c496a8ded650796e7b6ecc19df1a431c1a363342e5dc91"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.0",
- "windows_aarch64_msvc 0.53.0",
- "windows_i686_gnu 0.53.0",
- "windows_i686_gnullvm 0.53.0",
- "windows_i686_msvc 0.53.0",
- "windows_x86_64_gnu 0.53.0",
- "windows_x86_64_gnullvm 0.53.0",
- "windows_x86_64_msvc 0.53.0",
-]
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
 [[package]]
-name = "windows_aarch64_gnullvm"
+name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
 [[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.0"
+name = "windows_i686_gnu"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86b8d5f90ddd19cb4a147a5fa63ca848db3df085e25fee3cc10b39b6eebae764"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
 [[package]]
-name = "windows_aarch64_msvc"
+name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
 [[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.0"
+name = "windows_i686_msvc"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7651a1f62a11b8cbd5e0d42526e55f2c99886c77e007179efff86c2b137e66c"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
 [[package]]
-name = "windows_i686_gnu"
+name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
 [[package]]
-name = "windows_i686_gnu"
-version = "0.53.0"
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1dc67659d35f387f5f6c479dc4e28f1d4bb90ddd1a5d3da2e5d97b42d6272c3"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
 [[package]]
-name = "windows_i686_gnullvm"
+name = "windows_x86_64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.0"
+name = "winit"
+version = "0.30.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ce6ccbdedbf6d6354471319e781c0dfef054c81fbc7cf83f338a4296c0cae11"
+checksum = "a6755fa58a9f8350bd1e472d4c3fcc25f824ec358933bba33306d0b63df5978d"
+dependencies = [
+ "ahash",
+ "android-activity",
+ "atomic-waker",
+ "bitflags 2.13.1",
+ "block2 0.5.1",
+ "bytemuck",
+ "calloop 0.13.0",
+ "cfg_aliases",
+ "concurrent-queue",
+ "core-foundation 0.9.4",
+ "core-graphics",
+ "cursor-icon",
+ "dpi",
+ "js-sys",
+ "libc",
+ "memmap2",
+ "ndk",
+ "objc2 0.5.2",
+ "objc2-app-kit 0.2.2",
+ "objc2-foundation 0.2.2",
+ "objc2-ui-kit",
+ "orbclient",
+ "percent-encoding",
+ "pin-project",
+ "raw-window-handle",
+ "redox_syscall 0.4.1",
+ "rustix 0.38.44",
+ "smithay-client-toolkit 0.19.2",
+ "smol_str",
+ "tracing",
+ "unicode-segmentation",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-protocols-plasma",
+ "web-sys",
+ "web-time",
+ "windows-sys 0.52.0",
+ "x11-dl",
+ "x11rb",
+ "xkbcommon-dl",
+]
 
 [[package]]
-name = "windows_i686_msvc"
-version = "0.52.6"
+name = "winnow"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
+dependencies = [
+ "memchr",
+]
 
 [[package]]
-name = "windows_i686_msvc"
-version = "0.53.0"
+name = "wit-bindgen"
+version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "581fee95406bb13382d2f65cd4a908ca7b1e4c2f1917f143ba16efe98a589b5d"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
 [[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.6"
+name = "writeable"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
 
 [[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.0"
+name = "x11-dl"
+version = "2.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e55b5ac9ea33f2fc1716d1742db15574fd6fc8dadc51caab1c16a3d3b4190ba"
+checksum = "38735924fedd5314a6e548792904ed8c6de6636285cb9fec04d5b1db85c1516f"
+dependencies = [
+ "libc",
+ "once_cell",
+ "pkg-config",
+]
 
 [[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.6"
+name = "x11rb"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+checksum = "9993aa5be5a26815fe2c3eacfc1fde061fc1a1f094bf1ad2a18bf9c495dd7414"
+dependencies = [
+ "as-raw-xcb-connection",
+ "gethostname",
+ "libc",
+ "libloading",
+ "once_cell",
+ "rustix 1.1.4",
+ "x11rb-protocol",
+]
 
 [[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.0"
+name = "x11rb-protocol"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a6e035dd0599267ce1ee132e51c27dd29437f63325753051e71dd9e42406c57"
+checksum = "ea6fc2961e4ef194dcbfe56bb845534d0dc8098940c7e5c012a258bfec6701bd"
 
 [[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.6"
+name = "xcursor"
+version = "0.3.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+checksum = "bec9e4a500ca8864c5b47b8b482a73d62e4237670e5b5f1d6b9e3cae50f28f2b"
 
 [[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.0"
+name = "xkbcommon-dl"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"
+checksum = "d039de8032a9a8856a6be89cea3e5d12fdd82306ab7c94d74e6deab2460651c5"
+dependencies = [
+ "bitflags 2.13.1",
+ "dlib",
+ "log",
+ "once_cell",
+ "xkeysym",
+]
 
 [[package]]
-name = "wit-bindgen"
-version = "0.45.0"
+name = "xkeysym"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "052283831dbae3d879dc7f51f3d92703a316ca49f91540417d38591826127814"
+checksum = "b9cc00251562a284751c9973bace760d86c0276c471b4be569fe6b068ee97a56"
 
 [[package]]
-name = "writeable"
-version = "0.6.1"
+name = "xml-rs"
+version = "0.8.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea2f10b9bb0928dfb1b42b65e1f9e36f7f54dbdf08457afefb38afcdec4fa2bb"
+checksum = "3ae8337f8a065cfc972643663ea4279e04e7256de865aa66fe25cec5fb912d3f"
 
 [[package]]
 name = "yoke"
-version = "0.8.0"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f41bb01b8226ef4bfd589436a297c53d118f65921786300e427be8d487695cc"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
 dependencies = [
- "serde",
  "stable_deref_trait",
  "yoke-derive",
  "zerofrom",
@@ -2019,9 +3897,9 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.8.0"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38da3c9736e16c5d3c8c597a9aaa5d1fa565d0532ae05e27c24aa62fb32c0ab6"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2031,18 +3909,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.26"
+version = "0.8.54"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1039dd0d3c310cf05de012d8a39ff557cb0d23087fd44cad61df08fc31907a2f"
+checksum = "b7cbbc0a705a0fd05cc3676525980d2bf5a9bc4adac6d6475209a7887cf59d19"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.26"
+version = "0.8.54"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ecf5b4cc5364572d7f4c329661bcc82724222973f2cab6f050a4e5c22f75181"
+checksum = "e2e817b7b52d0c7358d3246da9d69935ebb18116b2b102b4230dac079b4862f5"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2051,18 +3929,18 @@ dependencies = [
 
 [[package]]
 name = "zerofrom"
-version = "0.1.6"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
 dependencies = [
  "zerofrom-derive",
 ]
 
 [[package]]
 name = "zerofrom-derive"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2072,15 +3950,15 @@ dependencies = [
 
 [[package]]
 name = "zeroize"
-version = "1.8.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 
 [[package]]
 name = "zerotrie"
-version = "0.2.2"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36f0bbd478583f79edad978b407914f61b2972f5af6fa089686016be8f9af595"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
 dependencies = [
  "displaydoc",
  "yoke",
@@ -2089,9 +3967,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec"
-version = "0.11.4"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7aa2bd55086f1ab526693ecbe444205da57e25f4489879da80635a46d90e73b"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -2100,11 +3978,32 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.1"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b96237efa0c878c64bd89c436f661be4e46b2f3eff1ebb976f7ef2321d2f58f"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn",
 ]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
+
+[[package]]
+name = "zune-core"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb8a0807f7c01457d0379ba880ba6322660448ddebc890ce29bb64da71fb40f9"
+
+[[package]]
+name = "zune-jpeg"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27bc9d5b815bc103f142aa054f561d9187d191692ec7c2d1e2b4737f8dbd7296"
+dependencies = [
+ "zune-core",
+]
diff --git a/Cargo.toml b/Cargo.toml
index 5412d48..4fdecdd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,36 +1,44 @@
 [package]
 name = "sensitivity"
-version = "0.1.0"
+version = "1.1.0"
 edition = "2021"
 authors = ["HasX <mi@hasx.dev>"]
-description = "SENSITIVITY (MiAssistant reimplementation): ADB-over-USB sideload + Xiaomi ROM validator"
-license = "MIT"
+description = "Sensitivity: a direct-USB Xiaomi Recovery flash and rescue CLI"
+license = "AGPL-3.0-only"
+repository = "https://github.com/Has-X/Sensitivity"
+homepage = "https://github.com/Has-X/Sensitivity"
+readme = "README.md"
+rust-version = "1.88"
+
+[workspace]
+members = [".", "crates/gui"]
+exclude = ["fuzz"]
+resolver = "2"
 
 [dependencies]
 anyhow = "1.0"
-thiserror = "1.0"
 clap = { version = "4.5", features = ["derive"] }
+clap_complete = "4.5"
+ctrlc = "3.4"
 rusb = { version = "0.9", features = ["vendored"] }
 reqwest = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls"] }
 base64 = "0.22"
 aes = "0.8"
 cbc = { version = "0.1", features = ["std"] }
-block-padding = "0.3"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 indicatif = "0.17"
 md-5 = "0.10"
 hex = "0.4"
 byteorder = "1.5"
-time = "0.3"
-log = "0.4"
-env_logger = "0.11"
-dirs-next = "2"
-urlencoding = "2.1"
 
 [dev-dependencies]
 tempfile = "3.10"
 
 [[bin]]
-name = "miassistant"
+name = "sensitivity"
 path = "src/main.rs"
+
+[profile.release]
+lto = "thin"
+strip = "symbols"
diff --git a/README.md b/README.md
index fc3233d..15f7a70 100644
--- a/README.md
+++ b/README.md
@@ -1,97 +1,132 @@
-Sensitivity: Mi Assistant CLI
-=============================
-
-[![License: AGPL v3](https://img.shields.io/badge/License-AGPL_v3-blue.svg)](./LICENSE)
-
-⚠️ **Notice:** Sensitivity is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0).  
-This means it **cannot** be integrated into closed-source or paid “pro tools” (e.g. Hydra, TFM, DFT, etc.).  
-Any redistribution or modification must remain open source under the AGPL.  
-See [License & Usage Notice](#license--usage-notice) for details.
-
----
-
-Sensitivity is a modern, Rust-based reimplementation of Xiaomi’s Mi Assistant flashing flow. It speaks the ADB protocol directly over USB (no adb.exe required), validates Recovery ROMs against Xiaomi’s `miotaV3` endpoint, and sideloads with robust progress, error reporting, and cross-region handling.
-
-Highlights
-- Pure Rust, production-ready, no external ADB needed
-- Direct USB via `rusb` (Mi Assistant interface 0xff/0x42/1)
-- Minimal ADB protocol (CONNECT/OPEN/WRTE/OKAY/CLSE)
-- Xiaomi commands: `getdevice`, `getsn`, `getversion`, `getcodebase`, `getbranch`, `getlanguage`, `getregion`, `getromzone`, `format-data`, `reboot`
-- Validation client for `miotaV3` (AES-128-CBC + Base64 framing)
-- Sideload with correct wipe flag negotiation and proper end-of-transfer handling
-
-Safety First
-- Stock recovery constraints apply: avoid downgrades on locked bootloaders
-- Cross-region flashes may require a data wipe; the tool will honor server guidance or a `--wipe` override
-- FRP remains enforced by the device; flashing does not bypass Google account lock
-
-Build From Source
-- Prerequisites: Rust (stable, 1.70+)
-- Linux:
-  - `cargo build --release` (libusb is built vendored automatically)
-- Windows:
-  - Install a WinUSB driver for the Mi Assistant interface using Zadig (class 0xff / subclass 0x42 / protocol 1)
-  - `cargo build --release` (vendored libusb is compiled automatically)
-
-CI Builds
-- GitHub Actions builds are provided for Linux and Windows (release profile) and upload artifacts.
-
-Install (Artifacts)
-- Download the latest artifact from GitHub Actions (Linux: `miassistant-linux-x86_64`, Windows: `miassistant-windows-x86_64.exe`) and place it in your PATH.
-
-Quick Start
-1) Put device into stock recovery and select “Connect with Mi Assistant”.
-2) Connect via USB.
-3) Read info:
-   `miassistant read-info`
-4) Validate and flash a ROM with automatic token fetching:
-   `miassistant flash "/path/to/rom.zip" --profile global --codename garnet --yes`
-
-Important Flags
-- `--profile <region>` and `--codename <device>`: build the device identity for cross-region (e.g., `--profile global --codename garnet`)
-- `--wipe`: allow/force a data wipe when flashing (sets the final `:1` in `sideload-host`)
-- `--token <string>`: provide validation token manually (advanced; pair with `--wipe` if needed)
-- `--chunk-size <bytes>`: default 65536 (64 KiB)
-- `--verbose` / `-v`: more logs (`-vv` for debug)
-- `--dump-json`: print decrypted validation JSON for inspection
-
-Examples
-- List allowed ROMs for current device (after applying a profile):
-  `miassistant list-allowed-roms --profile global --codename garnet --dump-json`
-- Flash with server token and wipe if required:
-  `miassistant flash "/path/to/rom.zip" --yes`
-- Flash with manual token and forced wipe:
-  `miassistant flash "/path/to/rom.zip" --token <token> --wipe --yes`
-- Download LatestRom from server and flash:
-  `miassistant flash-from-latest --profile global --codename garnet --yes`
-
-Environment (Advanced)
-- `SENSITIVITY_AES_KEY` / `SENSITIVITY_AES_IV`: 32-hex strings to override AES-128-CBC key/iv used for `miotaV3` framing. Defaults mimic the original client.
-
-Troubleshooting
-- Handshake failed / Not detected:
-  - Ensure recovery is in “Connect with Mi Assistant” (not ADB sideload)
-  - On Windows, stop `adb` server or run with exclusive mode; install WinUSB driver
-  - Reconnect USB cable, try another port
-- “Installation aborted”:
-  - Mismatched token vs ROM or missing wipe flag; re-validate and let the tool fetch the token, or use `--wipe` with manual `--token`
-  - Downgrade attempts on a locked bootloader will be refused by recovery
-- EEA/Global cross-flash:
-  - Use `--profile global --codename <device>` and let the tool validate; be prepared for a wipe
-
-Project Name
-- This project is Sensitivity. Any legacy references to “(HasX)” in older materials should be treated as developer attribution only; the tool itself is branded as Sensitivity.
-
----
-
-## License & Usage Notice
-
-This project is licensed under the **GNU Affero General Public License v3.0 (AGPL-3.0)**.  
-
-- ✅ Free to use, study, modify, and share.  
-- ✅ Redistribution allowed only if the source code remains under the AGPL.  
-- ❌ **Not permitted**: integration into closed-source or paid “pro tools” (e.g. Hydra, TFM, DFT, etc.).  
-- ❌ **Not permitted**: repackaging Sensitivity as proprietary software.  
-
-Sensitivity is intended for **learning, research, and legitimate device recovery only**.  
-No Xiaomi proprietary components are included.
+# Sensitivity
+
+Sensitivity is a direct-USB Xiaomi Recovery flash and rescue tool. It is the maintained successor to MiAssistantFork (MAF), with one shared protocol core, a safe CLI, native WinUI 3 on Windows, and a lightweight portable GUI on Linux and macOS.
+
+It speaks the Mi Assistant ADB-like protocol directly over USB, validates official Recovery ROMs with Xiaomi's `miotaV3` service, and streams approved packages to stock recovery. It does not require `adb`, an unlocked bootloader, or proprietary Xiaomi desktop software.
+
+> [!CAUTION]
+> Flashing can erase data or leave a device unable to boot. Use an official Recovery ROM for the exact device and region. Sensitivity does not bypass bootloader, account, anti-rollback, or FRP protections.
+
+## Install
+
+Download the archive for Windows, Linux, or macOS from [GitHub Releases](https://github.com/Has-X/Sensitivity/releases) and extract it. On Windows, open `Sensitivity.App.exe` for the native Fluent Design interface. On Linux or macOS, open `sensitivity-gui`. The `sensitivity` CLI is included on every platform, and releases include SHA-256 checksums.
+
+To build or install from source:
+
+```console
+cargo install --git https://github.com/Has-X/Sensitivity --locked
+# or, from a clone
+cargo build --workspace --release --locked
+```
+
+Linux release archives include an optional desktop-access rule. Install it once with `./install-udev-rule.sh`, reconnect the phone, and use `./install-udev-rule.sh --uninstall` to remove it. Windows archives include a focused WinUSB setup guide for the Mi Assistant interface (class `ff`, subclass `42`, protocol `01`).
+
+## Quick start
+
+In the desktop app, select the detected recovery and ROM, review validation and wipe warnings, then flash. The native Windows interface and portable Unix interface both delegate recovery work to the same Rust implementation.
+
+For the CLI:
+
+1. Boot the phone into stock recovery and choose **Connect with Mi Assistant**.
+2. Connect it directly by USB and run the setup check:
+
+   ```console
+   sensitivity doctor
+   ```
+
+3. Read the detected device identity:
+
+   ```console
+   sensitivity info
+   ```
+
+4. Flash an official Recovery ROM:
+
+   ```console
+   sensitivity flash /path/to/recovery-rom.zip
+   ```
+
+Sensitivity calculates the package MD5, asks Xiaomi's service for approval and the validation token, warns when the response requires a data wipe, and then starts sideloading. Review the displayed device and wipe information before continuing.
+
+Use `sensitivity help` or `sensitivity help <command>` for the complete command reference.
+
+## Common commands
+
+```console
+sensitivity doctor                       # diagnose USB and local ADB coexistence
+sensitivity devices                      # list matching USB interfaces without claiming them
+sensitivity detect                       # verify the direct-USB protocol handshake
+sensitivity info                         # human-readable device information
+sensitivity info --json                  # stable output for scripts
+sensitivity completions bash             # generate shell completion definitions
+sensitivity list-allowed-roms             # query packages accepted for this device
+sensitivity download-latest               # download and verify the latest approved ROM
+sensitivity flash ROM.zip                 # validate and flash a local package
+sensitivity flash-from-latest             # download, validate, and flash
+sensitivity reboot                        # leave recovery
+```
+
+Cross-region validation is advanced and can wipe data:
+
+```console
+sensitivity --profile global --codename garnet flash ROM.zip
+```
+
+The supported profiles are `global`, `eea`, `in`, `ru`, `id`, `tr`, `tw`, and `cn`.
+
+## ADB coexistence
+
+Sensitivity uses direct USB and leaves a local Android Debug Bridge server untouched by default. If `adb` already owns the recovery interface, stop it only for this invocation:
+
+```console
+sensitivity --adb-policy stop doctor
+sensitivity --adb-policy stop flash ROM.zip
+```
+
+Sensitivity never occupies port 5037 and only asks the ADB server to stop when you choose that policy. The Windows app detects likely ownership conflicts, explains the impact, and asks before retrying.
+
+Users and scripts moving from the older project should read [Migrating from MiAssistantFork](docs/MIGRATING_FROM_MAF.md).
+
+## Safety behavior
+
+- HTTPS validation is required unless the advanced `--http` override is supplied.
+- Package integrity is checked before downloaded ROMs are used.
+- Server-requested wipes are shown before flashing; `--yes` is intended for automation.
+- A manual token does not imply permission to wipe; add `--wipe` explicitly when required.
+- Validation tokens are never printed or passed to the Windows presentation layer.
+- `doctor` reports setup problems without changing the ADB server unless explicitly requested.
+- Ctrl-C during sideload requests a graceful close after the current USB operation.
+
+Hardware behavior varies between recovery versions. Offline CI proves builds, parsing, crypto framing, and command behavior; it cannot prove a real flash. Please report the device codename, OS, recovery version, command output, and ROM filename when filing a hardware issue.
+
+## Development
+
+Requirements: Rust 1.88 or newer. `libusb` is built from vendored sources.
+
+```console
+cargo fmt --all -- --check
+cargo test --workspace --locked
+cargo clippy --workspace --all-targets --locked -- -D warnings
+cargo build --workspace --release --locked
+```
+
+The ADB header parser also has an isolated cargo-fuzz target:
+
+```console
+cd fuzz
+cargo +nightly fuzz run adb-header
+```
+
+Tagging a version such as `v1.1.0` builds a self-contained WinUI 3 application and MSI for Windows, portable Linux and macOS applications, `SHA256SUMS`, and a GitHub Release.
+
+The native process boundary, cancellation handshake, and machine-event schema are documented in [Native Windows architecture](docs/WINDOWS_ARCHITECTURE.md).
+
+## Project lineage
+
+Sensitivity fully consolidates the useful parts of [MiAssistantFork](https://github.com/Has-X/MiAssistantFork). The separate MAF implementation is retired: both front ends use Sensitivity's single tested core, while unsafe or redundant MAF behavior is intentionally absent. See the [consolidation ledger](docs/MAF_CONSOLIDATION.md).
+
+## License
+
+Copyright (C) 2025 HasX and contributors. Sensitivity is licensed under the [GNU Affero General Public License v3.0](LICENSE), SPDX identifier `AGPL-3.0-only`.
+
+Commercial use is not categorically prohibited by the AGPL. Distribution or network use of a modified version must satisfy the license's corresponding-source and licensing requirements. No Xiaomi proprietary components are included.
diff --git a/apps/windows/Sensitivity.WinUI/App.xaml b/apps/windows/Sensitivity.WinUI/App.xaml
new file mode 100644
index 0000000..a380083
--- /dev/null
+++ b/apps/windows/Sensitivity.WinUI/App.xaml
@@ -0,0 +1,32 @@
+<Application
+    x:Class="Sensitivity.WinUI.App"
+    xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+    xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
+    <Application.Resources>
+        <ResourceDictionary>
+            <ResourceDictionary.MergedDictionaries>
+                <XamlControlsResources xmlns="using:Microsoft.UI.Xaml.Controls" />
+            </ResourceDictionary.MergedDictionaries>
+
+            <Style x:Key="CardStyle" TargetType="Border">
+                <Setter Property="Background" Value="{ThemeResource CardBackgroundFillColorDefaultBrush}" />
+                <Setter Property="BorderBrush" Value="{ThemeResource CardStrokeColorDefaultBrush}" />
+                <Setter Property="BorderThickness" Value="1" />
+                <Setter Property="CornerRadius" Value="8" />
+                <Setter Property="Padding" Value="20" />
+            </Style>
+            <Style x:Key="PageTitleStyle" TargetType="TextBlock">
+                <Setter Property="FontSize" Value="28" />
+                <Setter Property="FontWeight" Value="SemiBold" />
+            </Style>
+            <Style x:Key="SectionTitleStyle" TargetType="TextBlock">
+                <Setter Property="FontSize" Value="18" />
+                <Setter Property="FontWeight" Value="SemiBold" />
+            </Style>
+            <Style x:Key="CaptionStyle" TargetType="TextBlock">
+                <Setter Property="Foreground" Value="{ThemeResource TextFillColorSecondaryBrush}" />
+                <Setter Property="TextWrapping" Value="Wrap" />
+            </Style>
+        </ResourceDictionary>
+    </Application.Resources>
+</Application>
diff --git a/apps/windows/Sensitivity.WinUI/App.xaml.cs b/apps/windows/Sensitivity.WinUI/App.xaml.cs
new file mode 100644
index 0000000..814dd51
--- /dev/null
+++ b/apps/windows/Sensitivity.WinUI/App.xaml.cs
@@ -0,0 +1,23 @@
+using Microsoft.UI.Xaml;
+
+namespace Sensitivity.WinUI;
+
+public partial class App : Application
+{
+    private Window? _window;
+
+    public App()
+    {
+        InitializeComponent();
+        UnhandledException += (_, args) =>
+        {
+            System.Diagnostics.Debug.WriteLine(args.Exception);
+        };
+    }
+
+    protected override void OnLaunched(LaunchActivatedEventArgs args)
+    {
+        _window = new MainWindow();
+        _window.Activate();
+    }
+}
diff --git a/apps/windows/Sensitivity.WinUI/MainWindow.xaml b/apps/windows/Sensitivity.WinUI/MainWindow.xaml
new file mode 100644
index 0000000..bbb18b7
--- /dev/null
+++ b/apps/windows/Sensitivity.WinUI/MainWindow.xaml
@@ -0,0 +1,232 @@
+<Window
+    x:Class="Sensitivity.WinUI.MainWindow"
+    xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+    xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
+
+    <Grid x:Name="Root">
+        <Grid.RowDefinitions>
+            <RowDefinition Height="48" />
+            <RowDefinition Height="*" />
+        </Grid.RowDefinitions>
+
+        <Grid x:Name="AppTitleBar" Grid.Row="0" Padding="16,0">
+            <Grid.ColumnDefinitions>
+                <ColumnDefinition Width="Auto" />
+                <ColumnDefinition Width="*" />
+            </Grid.ColumnDefinitions>
+            <FontIcon Glyph="&#xE896;" FontSize="16" VerticalAlignment="Center" />
+            <TextBlock Grid.Column="1" Margin="10,0,0,0" Text="Sensitivity" FontWeight="SemiBold" VerticalAlignment="Center" />
+        </Grid>
+
+        <NavigationView
+            x:Name="Navigation"
+            Grid.Row="1"
+            IsBackButtonVisible="Collapsed"
+            IsSettingsVisible="True"
+            PaneDisplayMode="Left"
+            OpenPaneLength="220"
+            SelectionChanged="Navigation_SelectionChanged">
+            <NavigationView.MenuItems>
+                <NavigationViewItem Content="Overview" Tag="overview">
+                    <NavigationViewItem.Icon><SymbolIcon Symbol="Home" /></NavigationViewItem.Icon>
+                </NavigationViewItem>
+                <NavigationViewItem Content="Flash a ROM" Tag="flash">
+                    <NavigationViewItem.Icon><SymbolIcon Symbol="Download" /></NavigationViewItem.Icon>
+                </NavigationViewItem>
+                <NavigationViewItem Content="Recovery actions" Tag="recovery">
+                    <NavigationViewItem.Icon><SymbolIcon Symbol="Repair" /></NavigationViewItem.Icon>
+                </NavigationViewItem>
+                <NavigationViewItem Content="Diagnostics" Tag="diagnostics">
+                    <NavigationViewItem.Icon><SymbolIcon Symbol="View" /></NavigationViewItem.Icon>
+                </NavigationViewItem>
+            </NavigationView.MenuItems>
+
+            <Grid>
+                <InfoBar
+                    x:Name="StatusBar"
+                    Margin="24,16,24,0"
+                    VerticalAlignment="Top"
+                    IsOpen="False"
+                    IsClosable="True" />
+
+                <ScrollViewer x:Name="OverviewPage" Padding="32,72,32,32">
+                    <StackPanel MaxWidth="980" HorizontalAlignment="Left" Spacing="20">
+                        <StackPanel Spacing="6">
+                            <TextBlock Text="Recovery overview" Style="{StaticResource PageTitleStyle}" />
+                            <TextBlock Text="Connect a Xiaomi phone in “Connect with Mi Assistant” mode. Sensitivity validates official packages before anything is written." Style="{StaticResource CaptionStyle}" MaxWidth="720" />
+                        </StackPanel>
+
+                        <Border Style="{StaticResource CardStyle}">
+                            <Grid ColumnSpacing="20">
+                                <Grid.ColumnDefinitions>
+                                    <ColumnDefinition Width="Auto" />
+                                    <ColumnDefinition Width="*" />
+                                    <ColumnDefinition Width="Auto" />
+                                </Grid.ColumnDefinitions>
+                                <Border Width="48" Height="48" CornerRadius="24" Background="{ThemeResource AccentFillColorDefaultBrush}">
+                                    <FontIcon Glyph="&#xE7F8;" FontSize="22" Foreground="White" HorizontalAlignment="Center" VerticalAlignment="Center" />
+                                </Border>
+                                <StackPanel Grid.Column="1" Spacing="4" VerticalAlignment="Center">
+                                    <TextBlock x:Name="ConnectionTitle" Text="No recovery connected" Style="{StaticResource SectionTitleStyle}" />
+                                    <TextBlock x:Name="ConnectionSubtitle" Text="Refresh after the phone is waiting for Mi Assistant." Style="{StaticResource CaptionStyle}" />
+                                </StackPanel>
+                                <Button Grid.Column="2" x:Name="RefreshButton" Click="RefreshButton_Click">
+                                    <StackPanel Orientation="Horizontal" Spacing="8">
+                                        <SymbolIcon Symbol="Refresh" />
+                                        <TextBlock Text="Refresh" />
+                                    </StackPanel>
+                                </Button>
+                            </Grid>
+                        </Border>
+
+                        <Grid ColumnSpacing="20">
+                            <Grid.ColumnDefinitions>
+                                <ColumnDefinition Width="3*" />
+                                <ColumnDefinition Width="2*" />
+                            </Grid.ColumnDefinitions>
+                            <Border Style="{StaticResource CardStyle}">
+                                <StackPanel Spacing="16">
+                                    <TextBlock Text="Selected recovery" Style="{StaticResource SectionTitleStyle}" />
+                                    <ComboBox x:Name="DevicePicker" Header="USB interface" DisplayMemberPath="DisplayName" SelectionChanged="DevicePicker_SelectionChanged" />
+                                    <Button x:Name="ReadInfoButton" Content="Read device information" Style="{StaticResource AccentButtonStyle}" HorizontalAlignment="Left" Click="ReadInfoButton_Click" />
+                                    <Grid RowSpacing="10" ColumnSpacing="20">
+                                        <Grid.ColumnDefinitions>
+                                            <ColumnDefinition Width="Auto" />
+                                            <ColumnDefinition Width="*" />
+                                        </Grid.ColumnDefinitions>
+                                        <Grid.RowDefinitions>
+                                            <RowDefinition Height="Auto" /><RowDefinition Height="Auto" /><RowDefinition Height="Auto" /><RowDefinition Height="Auto" />
+                                        </Grid.RowDefinitions>
+                                        <TextBlock Text="Device" Foreground="{ThemeResource TextFillColorSecondaryBrush}" />
+                                        <TextBlock Grid.Column="1" x:Name="DeviceNameText" Text="—" FontWeight="SemiBold" />
+                                        <TextBlock Grid.Row="1" Text="Version" Foreground="{ThemeResource TextFillColorSecondaryBrush}" />
+                                        <TextBlock Grid.Row="1" Grid.Column="1" x:Name="VersionText" Text="—" />
+                                        <TextBlock Grid.Row="2" Text="Region" Foreground="{ThemeResource TextFillColorSecondaryBrush}" />
+                                        <TextBlock Grid.Row="2" Grid.Column="1" x:Name="RegionText" Text="—" />
+                                        <TextBlock Grid.Row="3" Text="Serial" Foreground="{ThemeResource TextFillColorSecondaryBrush}" />
+                                        <TextBlock Grid.Row="3" Grid.Column="1" x:Name="SerialText" Text="—" FontFamily="Consolas" />
+                                    </Grid>
+                                </StackPanel>
+                            </Border>
+
+                            <Border Grid.Column="1" Style="{StaticResource CardStyle}">
+                                <StackPanel Spacing="14">
+                                    <TextBlock Text="Before flashing" Style="{StaticResource SectionTitleStyle}" />
+                                    <TextBlock Text="1  Use the official Recovery ROM for this exact device and region." TextWrapping="Wrap" />
+                                    <TextBlock Text="2  Keep the computer awake and use a reliable USB cable." TextWrapping="Wrap" />
+                                    <TextBlock Text="3  Read every wipe warning before approving it." TextWrapping="Wrap" />
+                                    <Button Content="Choose a ROM" HorizontalAlignment="Left" Click="GoToFlash_Click" />
+                                </StackPanel>
+                            </Border>
+                        </Grid>
+                    </StackPanel>
+                </ScrollViewer>
+
+                <ScrollViewer x:Name="FlashPage" Padding="32,72,32,32" Visibility="Collapsed">
+                    <StackPanel MaxWidth="900" HorizontalAlignment="Left" Spacing="20">
+                        <StackPanel Spacing="6">
+                            <TextBlock Text="Flash an official ROM" Style="{StaticResource PageTitleStyle}" />
+                            <TextBlock Text="The package is hashed and approved by Xiaomi before the USB transfer starts." Style="{StaticResource CaptionStyle}" />
+                        </StackPanel>
+                        <Border Style="{StaticResource CardStyle}">
+                            <StackPanel Spacing="16">
+                                <TextBlock Text="Recovery ROM" Style="{StaticResource SectionTitleStyle}" />
+                                <Grid ColumnSpacing="12">
+                                    <Grid.ColumnDefinitions><ColumnDefinition Width="*" /><ColumnDefinition Width="Auto" /></Grid.ColumnDefinitions>
+                                    <TextBox x:Name="RomPathText" PlaceholderText="No ROM selected" IsReadOnly="True" />
+                                    <Button Grid.Column="1" Content="Browse…" Click="BrowseRomButton_Click" />
+                                </Grid>
+                                <TextBlock Text="Only official Recovery ROM ZIP files are supported. Fastboot packages cannot be flashed here." Style="{StaticResource CaptionStyle}" />
+                            </StackPanel>
+                        </Border>
+                        <Border Style="{StaticResource CardStyle}">
+                            <StackPanel Spacing="14">
+                                <Grid>
+                                    <TextBlock Text="Flash progress" Style="{StaticResource SectionTitleStyle}" />
+                                    <TextBlock x:Name="ProgressPercentText" Text="" HorizontalAlignment="Right" />
+                                </Grid>
+                                <TextBlock x:Name="OperationStatusText" Text="Ready" Style="{StaticResource CaptionStyle}" />
+                                <ProgressBar x:Name="FlashProgress" Minimum="0" Maximum="100" Value="0" />
+                                <StackPanel Orientation="Horizontal" Spacing="10">
+                                    <Button x:Name="StartFlashButton" Content="Review and flash" Style="{StaticResource AccentButtonStyle}" Click="StartFlashButton_Click" />
+                                    <Button x:Name="CancelFlashButton" Content="Cancel safely" IsEnabled="False" Click="CancelFlashButton_Click" />
+                                    <ProgressRing x:Name="BusyRing" Width="20" Height="20" IsActive="False" />
+                                </StackPanel>
+                            </StackPanel>
+                        </Border>
+                    </StackPanel>
+                </ScrollViewer>
+
+                <ScrollViewer x:Name="RecoveryPage" Padding="32,72,32,32" Visibility="Collapsed">
+                    <StackPanel MaxWidth="900" HorizontalAlignment="Left" Spacing="20">
+                        <StackPanel Spacing="6">
+                            <TextBlock Text="Recovery actions" Style="{StaticResource PageTitleStyle}" />
+                            <TextBlock Text="These commands are sent directly to the selected stock recovery." Style="{StaticResource CaptionStyle}" />
+                        </StackPanel>
+                        <Border Style="{StaticResource CardStyle}">
+                            <Grid ColumnSpacing="20">
+                                <Grid.ColumnDefinitions><ColumnDefinition Width="*" /><ColumnDefinition Width="Auto" /></Grid.ColumnDefinitions>
+                                <StackPanel Spacing="4">
+                                    <TextBlock Text="Reboot the phone" Style="{StaticResource SectionTitleStyle}" />
+                                    <TextBlock Text="Exit recovery and start the installed system." Style="{StaticResource CaptionStyle}" />
+                                </StackPanel>
+                                <Button Grid.Column="1" Content="Reboot" Click="RebootButton_Click" />
+                            </Grid>
+                        </Border>
+                        <Border Style="{StaticResource CardStyle}" BorderBrush="{ThemeResource SystemFillColorCriticalBrush}">
+                            <Grid ColumnSpacing="20">
+                                <Grid.ColumnDefinitions><ColumnDefinition Width="*" /><ColumnDefinition Width="Auto" /></Grid.ColumnDefinitions>
+                                <StackPanel Spacing="4">
+                                    <TextBlock Text="Erase all user data" Style="{StaticResource SectionTitleStyle}" />
+                                    <TextBlock Text="Permanent. The phone is formatted and then rebooted." Style="{StaticResource CaptionStyle}" />
+                                </StackPanel>
+                                <Button Grid.Column="1" Content="Erase data…" Click="EraseDataButton_Click" />
+                            </Grid>
+                        </Border>
+                    </StackPanel>
+                </ScrollViewer>
+
+                <ScrollViewer x:Name="DiagnosticsPage" Padding="32,72,32,32" Visibility="Collapsed">
+                    <StackPanel MaxWidth="900" HorizontalAlignment="Left" Spacing="20">
+                        <StackPanel Spacing="6">
+                            <TextBlock Text="Diagnostics" Style="{StaticResource PageTitleStyle}" />
+                            <TextBlock Text="Check the backend, USB interface, WinUSB access, and local ADB coexistence." Style="{StaticResource CaptionStyle}" />
+                        </StackPanel>
+                        <Border Style="{StaticResource CardStyle}">
+                            <StackPanel Spacing="14">
+                                <StackPanel Orientation="Horizontal" Spacing="10">
+                                    <Button Content="Run diagnostics" Style="{StaticResource AccentButtonStyle}" Click="RunDoctorButton_Click" />
+                                    <Button Content="Copy report" Click="CopyDiagnosticsButton_Click" />
+                                </StackPanel>
+                                <TextBox x:Name="DiagnosticsText" MinHeight="260" IsReadOnly="True" AcceptsReturn="True" TextWrapping="Wrap" FontFamily="Consolas" PlaceholderText="No diagnostic report yet." />
+                            </StackPanel>
+                        </Border>
+                    </StackPanel>
+                </ScrollViewer>
+
+                <ScrollViewer x:Name="SettingsPage" Padding="32,72,32,32" Visibility="Collapsed">
+                    <StackPanel MaxWidth="900" HorizontalAlignment="Left" Spacing="20">
+                        <StackPanel Spacing="6">
+                            <TextBlock Text="Settings" Style="{StaticResource PageTitleStyle}" />
+                            <TextBlock Text="Safe defaults are recommended for most systems." Style="{StaticResource CaptionStyle}" />
+                        </StackPanel>
+                        <Border Style="{StaticResource CardStyle}">
+                            <StackPanel Spacing="18">
+                                <ToggleSwitch x:Name="AutoResolveAdbToggle" IsOn="True" Header="Offer to resolve ADB conflicts" OffContent="Disabled" OnContent="Enabled" />
+                                <TextBlock Text="If Android Debug Bridge owns the recovery interface, Sensitivity asks before stopping its local server and retrying." Style="{StaticResource CaptionStyle}" />
+                                <ToggleSwitch x:Name="StopAdbToggle" IsOn="False" Header="Always stop local ADB before connecting" OffContent="Keep ADB running" OnContent="Stop ADB" />
+                                <TextBlock Text="Leave this off unless the automatic recovery prompt does not work on this computer." Style="{StaticResource CaptionStyle}" />
+                            </StackPanel>
+                        </Border>
+                        <Border Style="{StaticResource CardStyle}">
+                            <StackPanel Spacing="6">
+                                <TextBlock x:Name="AboutVersionText" Text="Sensitivity" Style="{StaticResource SectionTitleStyle}" />
+                                <TextBlock Text="Native WinUI 3 interface · Shared Rust recovery core · AGPL-3.0-only" Style="{StaticResource CaptionStyle}" />
+                            </StackPanel>
+                        </Border>
+                    </StackPanel>
+                </ScrollViewer>
+            </Grid>
+        </NavigationView>
+    </Grid>
+</Window>
diff --git a/apps/windows/Sensitivity.WinUI/MainWindow.xaml.cs b/apps/windows/Sensitivity.WinUI/MainWindow.xaml.cs
new file mode 100644
index 0000000..6def12b
--- /dev/null
+++ b/apps/windows/Sensitivity.WinUI/MainWindow.xaml.cs
@@ -0,0 +1,457 @@
+using Microsoft.UI;
+using Microsoft.UI.Composition.SystemBackdrops;
+using Microsoft.UI.Windowing;
+using Microsoft.UI.Xaml;
+using Microsoft.UI.Xaml.Controls;
+using Microsoft.UI.Xaml.Media;
+using Sensitivity.WinUI.Models;
+using Sensitivity.WinUI.Services;
+using Windows.ApplicationModel.DataTransfer;
+using Windows.Graphics;
+using Windows.Storage.Pickers;
+using WinRT.Interop;
+
+namespace Sensitivity.WinUI;
+
+public sealed partial class MainWindow : Window
+{
+    private readonly SensitivityBackend _backend = new();
+    private CancellationTokenSource? _operationCancellation;
+    private string? _romPath;
+    private bool _busy;
+
+    public MainWindow()
+    {
+        InitializeComponent();
+        Title = "Sensitivity";
+        AboutVersionText.Text = $"Sensitivity {typeof(App).Assembly.GetName().Version?.ToString(3)}";
+        ExtendsContentIntoTitleBar = true;
+        SetTitleBar(AppTitleBar);
+        SystemBackdrop = new MicaBackdrop { Kind = MicaKind.BaseAlt };
+        AppWindow.Resize(new SizeInt32(1120, 760));
+        var settings = SettingsStore.Load();
+        AutoResolveAdbToggle.IsOn = settings.OfferAdbResolution;
+        StopAdbToggle.IsOn = settings.AlwaysStopAdb;
+        if (settings.LastRomPath is { } lastRom && File.Exists(lastRom))
+        {
+            _romPath = lastRom;
+            RomPathText.Text = lastRom;
+        }
+        Navigation.SelectedItem = Navigation.MenuItems[0];
+        Root.Loaded += Root_Loaded;
+        Closed += (_, _) =>
+        {
+            _operationCancellation?.Cancel();
+            SettingsStore.Save(new AppSettings
+            {
+                OfferAdbResolution = AutoResolveAdbToggle.IsOn,
+                AlwaysStopAdb = StopAdbToggle.IsOn,
+                LastRomPath = _romPath
+            });
+        };
+    }
+
+    private async void Root_Loaded(object sender, RoutedEventArgs e)
+    {
+        if (!_backend.IsAvailable)
+        {
+            ShowStatus("Backend missing", "sensitivity.exe was not found beside the application.", InfoBarSeverity.Error);
+            SetInteractive(false);
+            return;
+        }
+        await RefreshDevicesAsync();
+    }
+
+    private void Navigation_SelectionChanged(NavigationView sender, NavigationViewSelectionChangedEventArgs args)
+    {
+        var tag = args.IsSettingsSelected
+            ? "settings"
+            : (args.SelectedItemContainer?.Tag?.ToString() ?? "overview");
+        OverviewPage.Visibility = tag == "overview" ? Visibility.Visible : Visibility.Collapsed;
+        FlashPage.Visibility = tag == "flash" ? Visibility.Visible : Visibility.Collapsed;
+        RecoveryPage.Visibility = tag == "recovery" ? Visibility.Visible : Visibility.Collapsed;
+        DiagnosticsPage.Visibility = tag == "diagnostics" ? Visibility.Visible : Visibility.Collapsed;
+        SettingsPage.Visibility = tag == "settings" ? Visibility.Visible : Visibility.Collapsed;
+    }
+
+    private async void RefreshButton_Click(object sender, RoutedEventArgs e) => await RefreshDevicesAsync();
+
+    private async Task RefreshDevicesAsync()
+    {
+        await RunBusyAsync(async cancellationToken =>
+        {
+            var devices = await _backend.GetDevicesAsync(cancellationToken);
+            DevicePicker.ItemsSource = devices;
+            DevicePicker.SelectedIndex = devices.Count > 0 ? 0 : -1;
+            ConnectionTitle.Text = devices.Count switch
+            {
+                0 => "No recovery connected",
+                1 => "Recovery interface found",
+                _ => $"{devices.Count} recovery interfaces found"
+            };
+            ConnectionSubtitle.Text = devices.Count == 0
+                ? "On the phone, open Connect with Mi Assistant and reconnect USB."
+                : "Select the interface, then read its device information.";
+            if (devices.Count == 0)
+            {
+                ShowStatus("No recovery found", "Check recovery mode, the cable, and the WinUSB driver.", InfoBarSeverity.Warning);
+            }
+            else
+            {
+                StatusBar.IsOpen = false;
+            }
+        }, "Refreshing USB devices…");
+    }
+
+    private async void DevicePicker_SelectionChanged(object sender, SelectionChangedEventArgs e)
+    {
+        ClearDeviceInfo();
+        if (DevicePicker.SelectedItem is UsbDevice)
+        {
+            await ReadDeviceInfoAsync();
+        }
+    }
+
+    private async void ReadInfoButton_Click(object sender, RoutedEventArgs e) => await ReadDeviceInfoAsync();
+
+    private async Task ReadDeviceInfoAsync()
+    {
+        if (DevicePicker.SelectedItem is not UsbDevice device)
+        {
+            ShowStatus("Select a recovery", "Refresh USB devices and select one first.", InfoBarSeverity.Warning);
+            return;
+        }
+
+        await RunBusyAsync(async cancellationToken =>
+        {
+            DeviceInfo info;
+            try
+            {
+                info = await _backend.GetDeviceInfoAsync(device.Index, StopAdbToggle.IsOn, cancellationToken);
+            }
+            catch (Exception error) when (!StopAdbToggle.IsOn
+                && AutoResolveAdbToggle.IsOn
+                && SensitivityBackend.IsUsbOwnershipError(error))
+            {
+                var retry = await ShowChoiceAsync(
+                    "ADB may be using this interface",
+                    "Sensitivity can stop the local ADB server once and retry. Other Android debugging sessions on this computer will disconnect.",
+                    "Stop ADB and retry",
+                    "Keep it running");
+                if (!retry)
+                {
+                    throw;
+                }
+                info = await _backend.GetDeviceInfoAsync(device.Index, true, cancellationToken);
+            }
+
+            DeviceNameText.Text = info.Device;
+            VersionText.Text = info.Version;
+            RegionText.Text = string.IsNullOrWhiteSpace(info.Region) ? info.RomZone : info.Region;
+            SerialText.Text = info.Serial;
+            ConnectionTitle.Text = $"{info.Device} is ready";
+            ConnectionSubtitle.Text = $"Recovery {info.Version} · {info.Region} {info.RomZone}".Trim();
+            ShowStatus("Recovery ready", "The direct USB handshake and device queries succeeded.", InfoBarSeverity.Success);
+        }, "Reading recovery information…");
+    }
+
+    private void GoToFlash_Click(object sender, RoutedEventArgs e)
+    {
+        Navigation.SelectedItem = Navigation.MenuItems[1];
+    }
+
+    private async void BrowseRomButton_Click(object sender, RoutedEventArgs e)
+    {
+        var picker = new FileOpenPicker
+        {
+            SuggestedStartLocation = PickerLocationId.Downloads,
+            ViewMode = PickerViewMode.List
+        };
+        picker.FileTypeFilter.Add(".zip");
+        InitializeWithWindow.Initialize(picker, WindowNative.GetWindowHandle(this));
+        var file = await picker.PickSingleFileAsync();
+        if (file is null)
+        {
+            return;
+        }
+        _romPath = file.Path;
+        RomPathText.Text = file.Path;
+        FlashProgress.Value = 0;
+        ProgressPercentText.Text = string.Empty;
+        OperationStatusText.Text = "Ready to validate and flash";
+    }
+
+    private async void StartFlashButton_Click(object sender, RoutedEventArgs e)
+    {
+        if (_romPath is null || !File.Exists(_romPath))
+        {
+            ShowStatus("Choose a ROM", "Select an official Recovery ROM ZIP before continuing.", InfoBarSeverity.Warning);
+            return;
+        }
+        if (DevicePicker.SelectedItem is not UsbDevice device)
+        {
+            ShowStatus("No recovery selected", "Connect and select a recovery device first.", InfoBarSeverity.Warning);
+            return;
+        }
+        if (!await ShowChoiceAsync(
+            "Validate and flash this ROM?",
+            "Sensitivity will verify the package with Xiaomi before starting the transfer. You will get another warning if validation requires a data wipe.",
+            "Validate and flash",
+            "Cancel"))
+        {
+            return;
+        }
+
+        _operationCancellation = new CancellationTokenSource();
+        SetBusy(true, "Preparing the flash…");
+        FlashProgress.Value = 0;
+        try
+        {
+            var result = await _backend.FlashAsync(
+                device.Index,
+                _romPath,
+                StopAdbToggle.IsOn,
+                HandleBackendEventAsync,
+                _operationCancellation.Token);
+            if (_operationCancellation.IsCancellationRequested)
+            {
+                throw new OperationCanceledException();
+            }
+            if (!result.Succeeded)
+            {
+                throw new InvalidOperationException(result.ErrorMessage);
+            }
+            FlashProgress.Value = 100;
+            ProgressPercentText.Text = "100%";
+            OperationStatusText.Text = "Flash completed";
+            ShowStatus("Flash completed", "Recovery accepted the complete ROM transfer.", InfoBarSeverity.Success);
+        }
+        catch (OperationCanceledException)
+        {
+            OperationStatusText.Text = "Cancelled safely";
+            ShowStatus("Flash cancelled", "Sensitivity requested a graceful close of the USB session.", InfoBarSeverity.Warning);
+        }
+        catch (Exception error)
+        {
+            OperationStatusText.Text = "Flash stopped";
+            ShowStatus("Flash failed", CleanError(error.Message), InfoBarSeverity.Error);
+        }
+        finally
+        {
+            _operationCancellation.Dispose();
+            _operationCancellation = null;
+            SetBusy(false);
+        }
+    }
+
+    private Task<bool?> HandleBackendEventAsync(BackendEvent backendEvent)
+    {
+        return RunOnUiAsync<bool?>(async () =>
+        {
+            switch (backendEvent.Event)
+            {
+                case "status":
+                    OperationStatusText.Text = backendEvent.Message ?? "Working…";
+                    break;
+                case "progress" when backendEvent.Total > 0:
+                    var percent = Math.Clamp(backendEvent.Current * 100d / backendEvent.Total, 0, 100);
+                    FlashProgress.Value = percent;
+                    ProgressPercentText.Text = $"{percent:0}%";
+                    break;
+                case "completed":
+                    OperationStatusText.Text = backendEvent.Message ?? "Completed";
+                    break;
+                case "confirmation_required" when backendEvent.Kind == "data_wipe":
+                    return await ShowChoiceAsync(
+                        "This flash will erase all user data",
+                        backendEvent.Message ?? "Xiaomi requires a permanent data wipe for this package.",
+                        "Erase data and continue",
+                        "Cancel flash");
+                case "error":
+                    OperationStatusText.Text = backendEvent.Message ?? "Operation failed";
+                    break;
+            }
+            return null;
+        });
+    }
+
+    private void CancelFlashButton_Click(object sender, RoutedEventArgs e)
+    {
+        OperationStatusText.Text = "Requesting safe cancellation…";
+        CancelFlashButton.IsEnabled = false;
+        _operationCancellation?.Cancel();
+    }
+
+    private async void RebootButton_Click(object sender, RoutedEventArgs e)
+    {
+        if (DevicePicker.SelectedItem is not UsbDevice device)
+        {
+            ShowStatus("No recovery selected", "Connect and select a recovery device first.", InfoBarSeverity.Warning);
+            return;
+        }
+        await RunBusyAsync(async cancellationToken =>
+        {
+            var result = await _backend.RebootAsync(device.Index, StopAdbToggle.IsOn, cancellationToken);
+            if (!result.Succeeded) throw new InvalidOperationException(result.ErrorMessage);
+            ShowStatus("Reboot requested", "The phone should leave recovery shortly.", InfoBarSeverity.Success);
+        }, "Sending reboot command…");
+    }
+
+    private async void EraseDataButton_Click(object sender, RoutedEventArgs e)
+    {
+        if (DevicePicker.SelectedItem is not UsbDevice device)
+        {
+            ShowStatus("No recovery selected", "Connect and select a recovery device first.", InfoBarSeverity.Warning);
+            return;
+        }
+        if (!await ShowChoiceAsync(
+            "Permanently erase all user data?",
+            "This cannot be undone. Sensitivity will format the phone and request a reboot.",
+            "Erase all data",
+            "Cancel"))
+        {
+            return;
+        }
+        await RunBusyAsync(async cancellationToken =>
+        {
+            var result = await _backend.FormatDataAsync(device.Index, StopAdbToggle.IsOn, cancellationToken);
+            if (!result.Succeeded) throw new InvalidOperationException(result.ErrorMessage);
+            ShowStatus("Erase requested", "Recovery accepted the format and reboot commands.", InfoBarSeverity.Success);
+        }, "Erasing user data…");
+    }
+
+    private async void RunDoctorButton_Click(object sender, RoutedEventArgs e)
+    {
+        var index = (DevicePicker.SelectedItem as UsbDevice)?.Index ?? 0;
+        await RunBusyAsync(async cancellationToken =>
+        {
+            var result = await _backend.RunDoctorAsync(index, StopAdbToggle.IsOn, cancellationToken);
+            DiagnosticsText.Text = string.Join(
+                Environment.NewLine,
+                new[] { result.StandardOutput.Trim(), result.StandardError.Trim() }
+                    .Where(value => !string.IsNullOrWhiteSpace(value)));
+            ShowStatus(
+                result.Succeeded ? "Diagnostics passed" : "Diagnostics found a problem",
+                result.Succeeded ? "USB and recovery communication are ready." : "Review the report for the corrective action.",
+                result.Succeeded ? InfoBarSeverity.Success : InfoBarSeverity.Warning);
+        }, "Running diagnostics…");
+    }
+
+    private void CopyDiagnosticsButton_Click(object sender, RoutedEventArgs e)
+    {
+        if (string.IsNullOrWhiteSpace(DiagnosticsText.Text)) return;
+        var package = new DataPackage();
+        package.SetText(DiagnosticsText.Text);
+        Clipboard.SetContent(package);
+        ShowStatus("Report copied", "The diagnostic report is on the clipboard.", InfoBarSeverity.Success);
+    }
+
+    private async Task RunBusyAsync(Func<CancellationToken, Task> operation, string status)
+    {
+        if (_busy) return;
+        using var cancellation = new CancellationTokenSource();
+        SetBusy(true, status);
+        try
+        {
+            await operation(cancellation.Token);
+        }
+        catch (Exception error)
+        {
+            ShowStatus("Operation failed", CleanError(error.Message), InfoBarSeverity.Error);
+        }
+        finally
+        {
+            SetBusy(false);
+        }
+    }
+
+    private void SetBusy(bool busy, string? status = null)
+    {
+        _busy = busy;
+        BusyRing.IsActive = busy;
+        RefreshButton.IsEnabled = !busy;
+        ReadInfoButton.IsEnabled = !busy;
+        StartFlashButton.IsEnabled = !busy;
+        CancelFlashButton.IsEnabled = busy && _operationCancellation is not null;
+        DevicePicker.IsEnabled = !busy;
+        if (status is not null) OperationStatusText.Text = status;
+    }
+
+    private void SetInteractive(bool enabled)
+    {
+        Navigation.IsEnabled = enabled;
+        RefreshButton.IsEnabled = enabled;
+    }
+
+    private void ClearDeviceInfo()
+    {
+        DeviceNameText.Text = "—";
+        VersionText.Text = "—";
+        RegionText.Text = "—";
+        SerialText.Text = "—";
+    }
+
+    private void ShowStatus(string title, string message, InfoBarSeverity severity)
+    {
+        StatusBar.Title = title;
+        StatusBar.Message = message;
+        StatusBar.Severity = severity;
+        StatusBar.IsOpen = true;
+    }
+
+    private async Task<bool> ShowChoiceAsync(
+        string title,
+        string message,
+        string primaryText,
+        string closeText)
+    {
+        var dialog = new ContentDialog
+        {
+            XamlRoot = Root.XamlRoot,
+            Title = title,
+            Content = new TextBlock { Text = message, TextWrapping = TextWrapping.Wrap, MaxWidth = 480 },
+            PrimaryButtonText = primaryText,
+            CloseButtonText = closeText,
+            DefaultButton = ContentDialogButton.Close
+        };
+        return await dialog.ShowAsync() == ContentDialogResult.Primary;
+    }
+
+    private Task<T> RunOnUiAsync<T>(Func<Task<T>> action)
+    {
+        var completion = new TaskCompletionSource<T>();
+        if (!DispatcherQueue.TryEnqueue(async () =>
+        {
+            try { completion.SetResult(await action()); }
+            catch (Exception error) { completion.SetException(error); }
+        }))
+        {
+            completion.SetException(new InvalidOperationException("The application window is closing."));
+        }
+        return completion.Task;
+    }
+
+    private static string CleanError(string message)
+    {
+        const string prefix = "Error: ";
+        var cleaned = message.Trim();
+        cleaned = cleaned.StartsWith(prefix, StringComparison.OrdinalIgnoreCase)
+            ? cleaned[prefix.Length..]
+            : cleaned;
+        if (cleaned.Contains("No Mi Assistant ADB interface", StringComparison.OrdinalIgnoreCase))
+        {
+            return "No Mi Assistant recovery interface was found. Reconnect the phone after opening Connect with Mi Assistant.";
+        }
+        if (cleaned.Contains("Claiming interface", StringComparison.OrdinalIgnoreCase)
+            || cleaned.Contains("Opening USB device", StringComparison.OrdinalIgnoreCase))
+        {
+            return "Windows could not open the recovery interface. Check WinUSB setup, close other phone tools, or allow Sensitivity to stop local ADB.";
+        }
+        if (cleaned.Contains("Validation HTTP", StringComparison.OrdinalIgnoreCase)
+            || cleaned.Contains("HTTP request failed", StringComparison.OrdinalIgnoreCase))
+        {
+            return "Xiaomi validation could not be reached. Check the internet connection and try again without changing the ROM.";
+        }
+        return cleaned;
+    }
+}
diff --git a/apps/windows/Sensitivity.WinUI/Models/BackendModels.cs b/apps/windows/Sensitivity.WinUI/Models/BackendModels.cs
new file mode 100644
index 0000000..3e96304
--- /dev/null
+++ b/apps/windows/Sensitivity.WinUI/Models/BackendModels.cs
@@ -0,0 +1,81 @@
+using System.Text.Json.Serialization;
+
+namespace Sensitivity.WinUI.Models;
+
+public sealed class UsbDevice
+{
+    [JsonPropertyName("index")]
+    public int Index { get; set; }
+
+    [JsonPropertyName("bus")]
+    public int Bus { get; set; }
+
+    [JsonPropertyName("address")]
+    public int Address { get; set; }
+
+    [JsonPropertyName("vendor_id")]
+    public int VendorId { get; set; }
+
+    [JsonPropertyName("product_id")]
+    public int ProductId { get; set; }
+
+    [JsonPropertyName("protocol")]
+    public int Protocol { get; set; }
+
+    [JsonIgnore]
+    public string DisplayName => $"Recovery device {Index + 1}  ·  {VendorId:x4}:{ProductId:x4}  ·  USB {Bus}/{Address}";
+}
+
+public sealed class DeviceInfo
+{
+    [JsonPropertyName("device")]
+    public string Device { get; set; } = "—";
+
+    [JsonPropertyName("sn")]
+    public string Serial { get; set; } = "—";
+
+    [JsonPropertyName("version")]
+    public string Version { get; set; } = "—";
+
+    [JsonPropertyName("codebase")]
+    public string Codebase { get; set; } = "—";
+
+    [JsonPropertyName("branch")]
+    public string Branch { get; set; } = "—";
+
+    [JsonPropertyName("language")]
+    public string Language { get; set; } = "—";
+
+    [JsonPropertyName("region")]
+    public string Region { get; set; } = "—";
+
+    [JsonPropertyName("romzone")]
+    public string RomZone { get; set; } = "—";
+}
+
+public sealed class BackendEvent
+{
+    [JsonPropertyName("event")]
+    public string Event { get; set; } = string.Empty;
+
+    [JsonPropertyName("kind")]
+    public string? Kind { get; set; }
+
+    [JsonPropertyName("message")]
+    public string? Message { get; set; }
+
+    [JsonPropertyName("current")]
+    public long Current { get; set; }
+
+    [JsonPropertyName("total")]
+    public long Total { get; set; }
+}
+
+public sealed record BackendResult(int ExitCode, string StandardOutput, string StandardError)
+{
+    public bool Succeeded => ExitCode == 0;
+
+    public string ErrorMessage => string.IsNullOrWhiteSpace(StandardError)
+        ? "Sensitivity could not complete the operation."
+        : StandardError.Trim();
+}
diff --git a/apps/windows/Sensitivity.WinUI/Sensitivity.WinUI.csproj b/apps/windows/Sensitivity.WinUI/Sensitivity.WinUI.csproj
new file mode 100644
index 0000000..c761cfd
--- /dev/null
+++ b/apps/windows/Sensitivity.WinUI/Sensitivity.WinUI.csproj
@@ -0,0 +1,25 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <OutputType>WinExe</OutputType>
+    <TargetFramework>net8.0-windows10.0.19041.0</TargetFramework>
+    <TargetPlatformMinVersion>10.0.17763.0</TargetPlatformMinVersion>
+    <EnableWindowsTargeting>true</EnableWindowsTargeting>
+    <RootNamespace>Sensitivity.WinUI</RootNamespace>
+    <AssemblyName>Sensitivity.App</AssemblyName>
+    <ApplicationManifest>app.manifest</ApplicationManifest>
+    <Platforms>x64</Platforms>
+    <PlatformTarget>x64</PlatformTarget>
+    <RuntimeIdentifiers>win-x64</RuntimeIdentifiers>
+    <UseWinUI>true</UseWinUI>
+    <WindowsPackageType>None</WindowsPackageType>
+    <WindowsAppSDKSelfContained>true</WindowsAppSDKSelfContained>
+    <SelfContained>true</SelfContained>
+    <PublishTrimmed>false</PublishTrimmed>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.WindowsAppSDK" Version="1.8.260317003" />
+  </ItemGroup>
+</Project>
diff --git a/apps/windows/Sensitivity.WinUI/Services/SensitivityBackend.cs b/apps/windows/Sensitivity.WinUI/Services/SensitivityBackend.cs
new file mode 100644
index 0000000..e889dd5
--- /dev/null
+++ b/apps/windows/Sensitivity.WinUI/Services/SensitivityBackend.cs
@@ -0,0 +1,255 @@
+using System.Diagnostics;
+using System.Text;
+using System.Text.Json;
+using Sensitivity.WinUI.Models;
+
+namespace Sensitivity.WinUI.Services;
+
+public sealed class SensitivityBackend
+{
+    private static readonly JsonSerializerOptions JsonOptions = new()
+    {
+        PropertyNameCaseInsensitive = true
+    };
+
+    public string ExecutablePath { get; }
+
+    public SensitivityBackend()
+    {
+        ExecutablePath = Path.Combine(AppContext.BaseDirectory, "sensitivity.exe");
+    }
+
+    public bool IsAvailable => File.Exists(ExecutablePath);
+
+    public async Task<IReadOnlyList<UsbDevice>> GetDevicesAsync(CancellationToken cancellationToken)
+    {
+        var result = await RunAsync(["devices", "--json"], cancellationToken);
+        EnsureSuccess(result);
+        return JsonSerializer.Deserialize<List<UsbDevice>>(result.StandardOutput, JsonOptions) ?? [];
+    }
+
+    public async Task<DeviceInfo> GetDeviceInfoAsync(
+        int deviceIndex,
+        bool stopAdb,
+        CancellationToken cancellationToken)
+    {
+        var arguments = GlobalArguments(deviceIndex, stopAdb);
+        arguments.Add("info");
+        arguments.Add("--json");
+        var result = await RunAsync(arguments, cancellationToken);
+        EnsureSuccess(result);
+        return JsonSerializer.Deserialize<DeviceInfo>(result.StandardOutput, JsonOptions)
+            ?? throw new InvalidOperationException("Sensitivity returned incomplete device information.");
+    }
+
+    public async Task<BackendResult> RunDoctorAsync(
+        int deviceIndex,
+        bool stopAdb,
+        CancellationToken cancellationToken)
+    {
+        var arguments = GlobalArguments(deviceIndex, stopAdb);
+        arguments.Add("doctor");
+        return await RunAsync(arguments, cancellationToken);
+    }
+
+    public async Task<BackendResult> RebootAsync(
+        int deviceIndex,
+        bool stopAdb,
+        CancellationToken cancellationToken)
+    {
+        var arguments = GlobalArguments(deviceIndex, stopAdb);
+        arguments.Add("reboot");
+        return await RunAsync(arguments, cancellationToken);
+    }
+
+    public async Task<BackendResult> FormatDataAsync(
+        int deviceIndex,
+        bool stopAdb,
+        CancellationToken cancellationToken)
+    {
+        var arguments = GlobalArguments(deviceIndex, stopAdb);
+        arguments.Add("format-data");
+        arguments.Add("--yes");
+        return await RunAsync(arguments, cancellationToken);
+    }
+
+    public async Task<BackendResult> FlashAsync(
+        int deviceIndex,
+        string romPath,
+        bool stopAdb,
+        Func<BackendEvent, Task<bool?>> onEvent,
+        CancellationToken cancellationToken)
+    {
+        var controlRoot = Path.Combine(Path.GetTempPath(), "Sensitivity", Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(controlRoot);
+        var cancelFile = Path.Combine(controlRoot, "cancel");
+        var approvalFile = Path.Combine(controlRoot, "approve-wipe");
+
+        var arguments = GlobalArguments(deviceIndex, stopAdb);
+        arguments.AddRange([
+            "--machine",
+            "--cancel-file", cancelFile,
+            "--approval-file", approvalFile,
+            "flash", romPath
+        ]);
+
+        try
+        {
+            return await RunAsync(
+                arguments,
+                cancellationToken,
+                async backendEvent =>
+                {
+                    var approved = await onEvent(backendEvent);
+                    if (backendEvent.Event == "confirmation_required")
+                    {
+                        await File.WriteAllTextAsync(
+                            approved == true ? approvalFile : cancelFile,
+                            string.Empty,
+                            CancellationToken.None);
+                    }
+                },
+                cancelFile);
+        }
+        finally
+        {
+            try { Directory.Delete(controlRoot, true); } catch { }
+        }
+    }
+
+    public async Task<BackendResult> RunAsync(
+        IReadOnlyList<string> arguments,
+        CancellationToken cancellationToken,
+        Func<BackendEvent, Task>? onEvent = null,
+        string? gracefulCancelFile = null)
+    {
+        if (!IsAvailable)
+        {
+            throw new FileNotFoundException(
+                "The Sensitivity backend is missing. Reinstall the application or place sensitivity.exe beside Sensitivity.App.exe.",
+                ExecutablePath);
+        }
+
+        using var process = new Process
+        {
+            StartInfo = new ProcessStartInfo
+            {
+                FileName = ExecutablePath,
+                UseShellExecute = false,
+                RedirectStandardOutput = true,
+                RedirectStandardError = true,
+                CreateNoWindow = true,
+                StandardOutputEncoding = Encoding.UTF8,
+                StandardErrorEncoding = Encoding.UTF8
+            },
+            EnableRaisingEvents = true
+        };
+        foreach (var argument in arguments)
+        {
+            process.StartInfo.ArgumentList.Add(argument);
+        }
+
+        if (!process.Start())
+        {
+            throw new InvalidOperationException("Windows could not start the Sensitivity backend.");
+        }
+
+        var output = new StringBuilder();
+        var errors = new StringBuilder();
+        var stdoutTask = ReadOutputAsync(process.StandardOutput, output, onEvent);
+        var stderrTask = ReadOutputAsync(process.StandardError, errors, null);
+        var exitTask = process.WaitForExitAsync(CancellationToken.None);
+
+        using var cancellationRegistration = cancellationToken.Register(() =>
+        {
+            if (gracefulCancelFile is not null)
+            {
+                try { File.WriteAllText(gracefulCancelFile, string.Empty); } catch { }
+            }
+        });
+
+        if (cancellationToken.CanBeCanceled)
+        {
+            var cancellationTask = Task.Delay(Timeout.InfiniteTimeSpan, cancellationToken)
+                .ContinueWith(_ => { }, CancellationToken.None);
+            if (await Task.WhenAny(exitTask, cancellationTask) == cancellationTask)
+            {
+                if (await Task.WhenAny(exitTask, Task.Delay(TimeSpan.FromSeconds(8))) != exitTask)
+                {
+                    try { process.Kill(true); } catch { }
+                }
+            }
+        }
+
+        // A UI callback can fail while the CLI is paused for approval. Request a
+        // graceful close in that case instead of leaving a hidden child process
+        // waiting forever for a control file that will never be created.
+        if (await Task.WhenAny(exitTask, stdoutTask) == stdoutTask && stdoutTask.IsFaulted)
+        {
+            if (gracefulCancelFile is not null)
+            {
+                try { File.WriteAllText(gracefulCancelFile, string.Empty); } catch { }
+            }
+            if (await Task.WhenAny(exitTask, Task.Delay(TimeSpan.FromSeconds(8))) != exitTask)
+            {
+                try { process.Kill(true); } catch { }
+            }
+        }
+
+        await exitTask;
+        await Task.WhenAll(stdoutTask, stderrTask);
+        return new BackendResult(process.ExitCode, output.ToString(), errors.ToString());
+    }
+
+    public static bool IsUsbOwnershipError(Exception error)
+    {
+        var message = error.ToString();
+        return message.Contains("Claiming interface", StringComparison.OrdinalIgnoreCase)
+            || message.Contains("Opening USB device", StringComparison.OrdinalIgnoreCase)
+            || message.Contains("Access denied", StringComparison.OrdinalIgnoreCase)
+            || message.Contains("busy", StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static List<string> GlobalArguments(int deviceIndex, bool stopAdb)
+    {
+        return [
+            "--device-index", deviceIndex.ToString(System.Globalization.CultureInfo.InvariantCulture),
+            "--adb-policy", stopAdb ? "stop" : "keep"
+        ];
+    }
+
+    private static async Task ReadOutputAsync(
+        StreamReader reader,
+        StringBuilder destination,
+        Func<BackendEvent, Task>? onEvent)
+    {
+        while (await reader.ReadLineAsync() is { } line)
+        {
+            destination.AppendLine(line);
+            if (onEvent is null || !line.StartsWith('{'))
+            {
+                continue;
+            }
+            try
+            {
+                var backendEvent = JsonSerializer.Deserialize<BackendEvent>(line, JsonOptions);
+                if (backendEvent is not null)
+                {
+                    await onEvent(backendEvent);
+                }
+            }
+            catch (JsonException)
+            {
+                // Human-readable backend lines can coexist with machine events.
+            }
+        }
+    }
+
+    private static void EnsureSuccess(BackendResult result)
+    {
+        if (!result.Succeeded)
+        {
+            throw new InvalidOperationException(result.ErrorMessage);
+        }
+    }
+}
diff --git a/apps/windows/Sensitivity.WinUI/Services/SettingsStore.cs b/apps/windows/Sensitivity.WinUI/Services/SettingsStore.cs
new file mode 100644
index 0000000..e6f3b5e
--- /dev/null
+++ b/apps/windows/Sensitivity.WinUI/Services/SettingsStore.cs
@@ -0,0 +1,47 @@
+using System.Text.Json;
+
+namespace Sensitivity.WinUI.Services;
+
+public sealed class AppSettings
+{
+    public bool OfferAdbResolution { get; set; } = true;
+    public bool AlwaysStopAdb { get; set; }
+    public string? LastRomPath { get; set; }
+}
+
+public static class SettingsStore
+{
+    private static readonly string SettingsPath = Path.Combine(
+        Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+        "Sensitivity",
+        "settings.json");
+
+    public static AppSettings Load()
+    {
+        try
+        {
+            return File.Exists(SettingsPath)
+                ? JsonSerializer.Deserialize<AppSettings>(File.ReadAllText(SettingsPath)) ?? new AppSettings()
+                : new AppSettings();
+        }
+        catch
+        {
+            return new AppSettings();
+        }
+    }
+
+    public static void Save(AppSettings settings)
+    {
+        try
+        {
+            Directory.CreateDirectory(Path.GetDirectoryName(SettingsPath)!);
+            var temporaryPath = SettingsPath + ".tmp";
+            File.WriteAllText(temporaryPath, JsonSerializer.Serialize(settings));
+            File.Move(temporaryPath, SettingsPath, true);
+        }
+        catch
+        {
+            // A settings failure must never block recovery operations or exit.
+        }
+    }
+}
diff --git a/apps/windows/Sensitivity.WinUI/app.manifest b/apps/windows/Sensitivity.WinUI/app.manifest
new file mode 100644
index 0000000..861c237
--- /dev/null
+++ b/apps/windows/Sensitivity.WinUI/app.manifest
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="utf-8"?>
+<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
+  <assemblyIdentity version="1.0.0.0" name="Sensitivity.App"/>
+  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
+    <application>
+      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
+    </application>
+  </compatibility>
+  <application xmlns="urn:schemas-microsoft-com:asm.v3">
+    <windowsSettings>
+      <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">PerMonitorV2</dpiAware>
+      <longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware>
+    </windowsSettings>
+  </application>
+</assembly>
diff --git a/crates/gui/Cargo.toml b/crates/gui/Cargo.toml
new file mode 100644
index 0000000..8d8d5ff
--- /dev/null
+++ b/crates/gui/Cargo.toml
@@ -0,0 +1,25 @@
+[package]
+name = "sensitivity-gui"
+version = "1.1.0"
+edition = "2021"
+rust-version = "1.88"
+authors = ["HasX <mi@hasx.dev>"]
+description = "Sensitivity graphical Xiaomi Recovery flash and rescue tool"
+license = "AGPL-3.0-only"
+repository = "https://github.com/Has-X/Sensitivity"
+publish = false
+
+[dependencies]
+anyhow = "1"
+eframe = { version = "0.33.3", default-features = false, features = ["default_fonts", "glow", "persistence", "wayland", "x11"] }
+rfd = "0.17.2"
+sensitivity = { version = "1.1.0", path = "../.." }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+[package.metadata.bundle]
+name = "Sensitivity"
+identifier = "dev.hasx.sensitivity"
+category = "public.app-category.utilities"
+short_description = "Xiaomi Recovery flash and rescue tool"
+copyright = "Copyright 2025 HasX and contributors"
diff --git a/crates/gui/src/main.rs b/crates/gui/src/main.rs
new file mode 100644
index 0000000..4725371
--- /dev/null
+++ b/crates/gui/src/main.rs
@@ -0,0 +1,736 @@
+// Copyright (C) 2025 HasX
+// Licensed under the GNU AGPL v3.0. See LICENSE file for details.
+
+#![cfg_attr(target_os = "windows", windows_subsystem = "windows")]
+
+use std::path::PathBuf;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::mpsc::{self, Receiver, Sender};
+use std::sync::Arc;
+use std::thread;
+
+use eframe::egui;
+use sensitivity::mi::{DeviceInfo, MiClient};
+use sensitivity::usb::{UsbDeviceInfo, UsbTransport};
+use sensitivity::{sideload, util, validate};
+
+const SERVER_URL: &str = "https://update.miui.com/updates/miotaV3.php";
+
+fn main() -> eframe::Result<()> {
+    let options = eframe::NativeOptions {
+        viewport: egui::ViewportBuilder::default()
+            .with_inner_size([1040.0, 720.0])
+            .with_min_inner_size([820.0, 560.0]),
+        ..Default::default()
+    };
+    eframe::run_native(
+        "Sensitivity",
+        options,
+        Box::new(|creation_context| Ok(Box::new(SensitivityApp::new(creation_context)))),
+    )
+}
+
+#[derive(Debug)]
+enum Message {
+    Status(String),
+    Error(String),
+    DeviceInfo(DeviceInfo),
+    Roms(String),
+    Validated {
+        path: PathBuf,
+        token: String,
+        erase: bool,
+        md5: String,
+    },
+    Progress {
+        sent: u64,
+        total: u64,
+    },
+    Finished(String),
+}
+
+#[derive(Debug, Clone)]
+struct ValidatedRom {
+    path: PathBuf,
+    token: String,
+    erase: bool,
+    md5: String,
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+enum Language {
+    #[default]
+    En,
+    Es,
+}
+
+#[derive(Default, serde::Serialize, serde::Deserialize)]
+struct PersistedState {
+    rom_path: Option<PathBuf>,
+    stop_adb: bool,
+    language: Language,
+}
+
+struct SensitivityApp {
+    devices: Vec<UsbDeviceInfo>,
+    selected_device: usize,
+    device_info: Option<DeviceInfo>,
+    rom_path: Option<PathBuf>,
+    validated: Option<ValidatedRom>,
+    rom_listing: String,
+    logs: Vec<String>,
+    status: String,
+    progress: Option<(u64, u64)>,
+    busy: bool,
+    stop_adb: bool,
+    language: Language,
+    receiver: Option<Receiver<Message>>,
+    cancel: Option<Arc<AtomicBool>>,
+    confirm_flash: bool,
+    confirm_format: bool,
+}
+
+impl SensitivityApp {
+    fn new(context: &eframe::CreationContext<'_>) -> Self {
+        let persisted = context
+            .storage
+            .and_then(|storage| storage.get_string("sensitivity.state"))
+            .and_then(|json| serde_json::from_str::<PersistedState>(&json).ok())
+            .unwrap_or_default();
+        let mut app = Self {
+            devices: Vec::new(),
+            selected_device: 0,
+            device_info: None,
+            rom_path: persisted.rom_path,
+            validated: None,
+            rom_listing: String::new(),
+            logs: Vec::new(),
+            status: "Connect a phone in Mi Assistant recovery mode.".into(),
+            progress: None,
+            busy: false,
+            stop_adb: persisted.stop_adb,
+            language: persisted.language,
+            receiver: None,
+            cancel: None,
+            confirm_flash: false,
+            confirm_format: false,
+        };
+        app.refresh_devices();
+        app
+    }
+
+    fn log(&mut self, message: impl Into<String>) {
+        self.logs.push(message.into());
+        if self.logs.len() > 400 {
+            self.logs.drain(..self.logs.len() - 400);
+        }
+    }
+
+    fn t(&self, english: &'static str) -> &'static str {
+        if self.language == Language::En {
+            return english;
+        }
+        match english {
+            "Xiaomi Recovery flash and rescue" => "Flasheo y rescate de Xiaomi Recovery",
+            "Recovery device" => "Dispositivo en recovery",
+            "Refresh USB devices" => "Actualizar dispositivos USB",
+            "No matching interface found." => "No se encontró una interfaz compatible.",
+            "Interface" => "Interfaz",
+            "Stop local ADB before opening USB" => "Detener ADB local antes de abrir USB",
+            "Read device info" => "Leer información del dispositivo",
+            "List allowed ROMs" => "Listar ROMs permitidas",
+            "Official Recovery ROM" => "ROM Recovery oficial",
+            "Choose ROM ZIP" => "Elegir ZIP de ROM",
+            "Validate ROM" => "Validar ROM",
+            "Validation requires a data wipe" => "La validación requiere borrar los datos",
+            "Validated; no wipe requested" => "Validada; no se solicita borrado",
+            "Flash validated ROM" => "Flashear ROM validada",
+            "Cancel flash" => "Cancelar flasheo",
+            "Recovery actions" => "Acciones de recovery",
+            "Reboot" => "Reiniciar",
+            "Erase data" => "Borrar datos",
+            "Device information" => "Información del dispositivo",
+            "Read device info to begin." => "Lee la información del dispositivo para comenzar.",
+            "Allowed ROM response" => "Respuesta de ROMs permitidas",
+            "No response loaded." => "No se ha cargado una respuesta.",
+            "Activity" => "Actividad",
+            "Confirm flash" => "Confirmar flasheo",
+            "Xiaomi requires this flash to permanently erase user data." => {
+                "Xiaomi requiere que este flasheo borre permanentemente los datos."
+            }
+            "Flash the validated official ROM now?" => "¿Flashear ahora la ROM oficial validada?",
+            "Keep the phone connected until recovery reports completion." => {
+                "Mantén el teléfono conectado hasta que recovery indique que terminó."
+            }
+            "Cancel" => "Cancelar",
+            "Erase data and flash" => "Borrar datos y flashear",
+            "Flash" => "Flashear",
+            "Confirm data erase" => "Confirmar borrado de datos",
+            "This permanently erases all user data, then reboots the phone." => {
+                "Esto borra permanentemente todos los datos y reinicia el teléfono."
+            }
+            "Erase all data" => "Borrar todos los datos",
+            _ => english,
+        }
+    }
+
+    fn refresh_devices(&mut self) {
+        match UsbTransport::discover() {
+            Ok(devices) => {
+                self.devices = devices;
+                if self.selected_device >= self.devices.len() {
+                    self.selected_device = 0;
+                }
+                self.status = match self.devices.len() {
+                    0 => "No Mi Assistant recovery interface found.".into(),
+                    1 => "One recovery interface found. Read device info to continue.".into(),
+                    count => format!("{count} recovery interfaces found. Select one to continue."),
+                };
+            }
+            Err(error) => {
+                self.devices.clear();
+                self.status = "USB discovery failed.".into();
+                self.log(format!("USB discovery failed: {error:#}"));
+            }
+        }
+    }
+
+    fn start_task<F>(&mut self, status: impl Into<String>, task: F)
+    where
+        F: FnOnce(Sender<Message>) + Send + 'static,
+    {
+        if self.busy {
+            return;
+        }
+        let (sender, receiver) = mpsc::channel();
+        self.receiver = Some(receiver);
+        self.busy = true;
+        self.status = status.into();
+        self.progress = None;
+        thread::spawn(move || task(sender));
+    }
+
+    fn open_client(index: usize, stop_adb: bool) -> anyhow::Result<MiClient> {
+        if stop_adb && util::adb_server::is_running(std::time::Duration::from_millis(200)) {
+            util::adb_server::kill_adb_server(std::time::Duration::from_secs(2))?;
+        }
+        let transport = UsbTransport::open(index, false)?;
+        MiClient::new(transport)
+    }
+
+    fn read_device_info(&mut self) {
+        let index = self.selected_device;
+        let stop_adb = self.stop_adb;
+        self.start_task("Reading device information...", move |sender| {
+            let result =
+                Self::open_client(index, stop_adb).and_then(|mut client| client.read_all_info());
+            match result {
+                Ok(info) => {
+                    let _ = sender.send(Message::DeviceInfo(info));
+                    let _ = sender.send(Message::Status("Device is ready.".into()));
+                }
+                Err(error) => {
+                    let _ = sender.send(Message::Error(format!("{error:#}")));
+                }
+            }
+        });
+    }
+
+    fn list_roms(&mut self) {
+        let Some(info) = self.device_info.clone() else {
+            self.log("Read device info before querying ROMs.");
+            return;
+        };
+        self.start_task("Querying Xiaomi validation service...", move |sender| {
+            let result = (|| -> anyhow::Result<String> {
+                let request = validate::build_request_json(&info, None)?;
+                let response = validate::validate(SERVER_URL, &request)?;
+                Ok(response.full_json.unwrap_or_else(|| {
+                    response
+                        .code_message
+                        .unwrap_or_else(|| "No ROM listing returned.".into())
+                }))
+            })();
+            match result {
+                Ok(listing) => {
+                    let pretty = serde_json::from_str::<serde_json::Value>(&listing)
+                        .and_then(|value| serde_json::to_string_pretty(&value))
+                        .unwrap_or(listing);
+                    let _ = sender.send(Message::Roms(pretty));
+                    let _ = sender.send(Message::Status("ROM query complete.".into()));
+                }
+                Err(error) => {
+                    let _ = sender.send(Message::Error(format!("ROM query failed: {error:#}")));
+                }
+            }
+        });
+    }
+
+    fn choose_rom(&mut self) {
+        if let Some(path) = rfd::FileDialog::new()
+            .add_filter("Recovery ROM", &["zip"])
+            .pick_file()
+        {
+            self.rom_path = Some(path);
+            self.validated = None;
+            self.status = "ROM selected. Validate it before flashing.".into();
+        }
+    }
+
+    fn validate_rom(&mut self) {
+        let Some(info) = self.device_info.clone() else {
+            self.log("Read device info before validating a ROM.");
+            return;
+        };
+        let Some(path) = self.rom_path.clone() else {
+            self.log("Choose an official Recovery ROM ZIP first.");
+            return;
+        };
+        self.start_task("Hashing and validating ROM...", move |sender| {
+            let result = (|| -> anyhow::Result<ValidatedRom> {
+                let md5 = sensitivity::util::md5::md5_file(&path)?;
+                let request = validate::build_request_json(&info, Some(md5.clone()))?;
+                let response = validate::validate(SERVER_URL, &request)?;
+                let token = response
+                    .validate_token
+                    .filter(|token| !token.is_empty())
+                    .ok_or_else(|| anyhow::anyhow!("Xiaomi did not return a validation token"))?;
+                Ok(ValidatedRom {
+                    path,
+                    token,
+                    erase: response.pkgrom_erase == Some(1),
+                    md5,
+                })
+            })();
+            match result {
+                Ok(validated) => {
+                    let _ = sender.send(Message::Validated {
+                        path: validated.path,
+                        token: validated.token,
+                        erase: validated.erase,
+                        md5: validated.md5,
+                    });
+                    let _ =
+                        sender.send(Message::Status("ROM validated and ready to flash.".into()));
+                }
+                Err(error) => {
+                    let _ = sender.send(Message::Error(format!("Validation failed: {error:#}")));
+                }
+            }
+        });
+    }
+
+    fn request_flash(&mut self) {
+        if self.validated.is_none() {
+            self.log("Validate the selected ROM before flashing.");
+            return;
+        }
+        self.confirm_flash = true;
+    }
+
+    fn start_flash(&mut self) {
+        let Some(validated) = self.validated.clone() else {
+            return;
+        };
+        let index = self.selected_device;
+        let stop_adb = self.stop_adb;
+        let cancel = Arc::new(AtomicBool::new(false));
+        self.cancel = Some(Arc::clone(&cancel));
+        self.confirm_flash = false;
+        self.start_task(
+            "Flashing ROM. Do not disconnect the phone...",
+            move |sender| {
+                let result = (|| -> anyhow::Result<()> {
+                    let mut client = Self::open_client(index, stop_adb)?;
+                    sideload::sideload_zip_with_progress(
+                        &mut client,
+                        &validated.path,
+                        64 * 1024,
+                        &validated.token,
+                        validated.erase,
+                        &cancel,
+                        |sent, total| {
+                            let _ = sender.send(Message::Progress { sent, total });
+                        },
+                    )
+                })();
+                match result {
+                    Ok(()) => {
+                        let _ = sender.send(Message::Finished("Flash completed.".into()));
+                    }
+                    Err(error) => {
+                        let _ = sender.send(Message::Error(format!("Flash failed: {error:#}")));
+                    }
+                }
+            },
+        );
+    }
+
+    fn send_recovery_command(&mut self, command: &'static str, success: &'static str) {
+        let index = self.selected_device;
+        let stop_adb = self.stop_adb;
+        self.start_task(format!("Sending {command}..."), move |sender| {
+            let result = Self::open_client(index, stop_adb)
+                .and_then(|mut client| client.simple_command(command));
+            match result {
+                Ok(()) => {
+                    let _ = sender.send(Message::Finished(success.into()));
+                }
+                Err(error) => {
+                    let _ = sender.send(Message::Error(format!("Command failed: {error:#}")));
+                }
+            }
+        });
+    }
+
+    fn format_data(&mut self) {
+        let index = self.selected_device;
+        let stop_adb = self.stop_adb;
+        self.confirm_format = false;
+        self.start_task("Erasing user data...", move |sender| {
+            let result = (|| -> anyhow::Result<()> {
+                let mut client = Self::open_client(index, stop_adb)?;
+                client.simple_command("format-data:")?;
+                client.simple_command("reboot:")?;
+                Ok(())
+            })();
+            match result {
+                Ok(()) => {
+                    let _ = sender.send(Message::Finished("Data erased; reboot requested.".into()));
+                }
+                Err(error) => {
+                    let _ = sender.send(Message::Error(format!("Format failed: {error:#}")));
+                }
+            }
+        });
+    }
+
+    fn drain_messages(&mut self) {
+        let messages = self
+            .receiver
+            .as_ref()
+            .map(|receiver| receiver.try_iter().collect::<Vec<_>>())
+            .unwrap_or_default();
+        for message in messages {
+            match message {
+                Message::Status(status) => self.status = status,
+                Message::Error(error) => {
+                    self.status = "Operation failed.".into();
+                    self.log(error);
+                    self.busy = false;
+                    self.cancel = None;
+                }
+                Message::DeviceInfo(info) => {
+                    self.log(format!("Detected {} ({})", info.device, info.version));
+                    self.device_info = Some(info);
+                    self.validated = None;
+                    self.busy = false;
+                }
+                Message::Roms(roms) => {
+                    self.rom_listing = roms;
+                    self.busy = false;
+                }
+                Message::Validated {
+                    path,
+                    token,
+                    erase,
+                    md5,
+                } => {
+                    self.log(format!("Validated {} (MD5 {md5})", path.display()));
+                    if erase {
+                        self.log("Xiaomi requires a data wipe for this package.");
+                    }
+                    self.validated = Some(ValidatedRom {
+                        path,
+                        token,
+                        erase,
+                        md5,
+                    });
+                    self.busy = false;
+                }
+                Message::Progress { sent, total } => self.progress = Some((sent, total)),
+                Message::Finished(message) => {
+                    self.status = message.clone();
+                    self.log(message);
+                    self.busy = false;
+                    self.cancel = None;
+                }
+            }
+        }
+    }
+
+    fn device_label(device: &UsbDeviceInfo) -> String {
+        format!(
+            "[{}] {:04x}:{:04x} bus {} address {}",
+            device.index, device.vendor_id, device.product_id, device.bus, device.address
+        )
+    }
+}
+
+impl eframe::App for SensitivityApp {
+    fn save(&mut self, storage: &mut dyn eframe::Storage) {
+        let state = PersistedState {
+            rom_path: self.rom_path.clone(),
+            stop_adb: self.stop_adb,
+            language: self.language,
+        };
+        if let Ok(json) = serde_json::to_string(&state) {
+            storage.set_string("sensitivity.state", json);
+        }
+    }
+
+    fn update(&mut self, context: &egui::Context, _frame: &mut eframe::Frame) {
+        context.set_visuals(egui::Visuals::dark());
+        self.drain_messages();
+
+        egui::TopBottomPanel::top("header").show(context, |ui| {
+            ui.horizontal(|ui| {
+                ui.heading("Sensitivity");
+                ui.separator();
+                ui.label(self.t("Xiaomi Recovery flash and rescue"));
+                ui.separator();
+                egui::ComboBox::from_id_salt("language")
+                    .selected_text(match self.language {
+                        Language::En => "EN",
+                        Language::Es => "ES",
+                    })
+                    .show_ui(ui, |ui| {
+                        ui.selectable_value(&mut self.language, Language::En, "EN");
+                        ui.selectable_value(&mut self.language, Language::Es, "ES");
+                    });
+            });
+            ui.label(&self.status);
+        });
+
+        egui::SidePanel::left("actions")
+            .resizable(false)
+            .default_width(300.0)
+            .show(context, |ui| {
+                ui.heading(format!("1. {}", self.t("Recovery device")));
+                if ui.button(self.t("Refresh USB devices")).clicked() && !self.busy {
+                    self.refresh_devices();
+                }
+                if self.devices.is_empty() {
+                    ui.label(self.t("No matching interface found."));
+                } else {
+                    egui::ComboBox::from_label(self.t("Interface"))
+                        .selected_text(Self::device_label(
+                            self.devices
+                                .get(self.selected_device)
+                                .unwrap_or(&self.devices[0]),
+                        ))
+                        .show_ui(ui, |ui| {
+                            for device in &self.devices {
+                                ui.selectable_value(
+                                    &mut self.selected_device,
+                                    device.index,
+                                    Self::device_label(device),
+                                );
+                            }
+                        });
+                }
+                let stop_adb_label = self.t("Stop local ADB before opening USB");
+                ui.checkbox(&mut self.stop_adb, stop_adb_label)
+                    .on_hover_text("Opt in only if ADB owns the Mi Assistant interface.");
+                if ui
+                    .add_enabled(
+                        !self.busy && !self.devices.is_empty(),
+                        egui::Button::new(self.t("Read device info")),
+                    )
+                    .clicked()
+                {
+                    self.read_device_info();
+                }
+                if ui
+                    .add_enabled(
+                        !self.busy && self.device_info.is_some(),
+                        egui::Button::new(self.t("List allowed ROMs")),
+                    )
+                    .clicked()
+                {
+                    self.list_roms();
+                }
+
+                ui.separator();
+                ui.heading(format!("2. {}", self.t("Official Recovery ROM")));
+                if ui
+                    .add_enabled(!self.busy, egui::Button::new(self.t("Choose ROM ZIP")))
+                    .clicked()
+                {
+                    self.choose_rom();
+                }
+                if let Some(path) = &self.rom_path {
+                    ui.small(path.display().to_string());
+                }
+                if ui
+                    .add_enabled(
+                        !self.busy && self.device_info.is_some() && self.rom_path.is_some(),
+                        egui::Button::new(self.t("Validate ROM")),
+                    )
+                    .clicked()
+                {
+                    self.validate_rom();
+                }
+                if let Some(validated) = &self.validated {
+                    ui.label(format!("MD5: {}", validated.md5));
+                    if validated.erase {
+                        ui.colored_label(
+                            egui::Color32::RED,
+                            self.t("Validation requires a data wipe"),
+                        );
+                    } else {
+                        ui.colored_label(
+                            egui::Color32::LIGHT_GREEN,
+                            self.t("Validated; no wipe requested"),
+                        );
+                    }
+                }
+                if ui
+                    .add_enabled(
+                        !self.busy && self.validated.is_some(),
+                        egui::Button::new(self.t("Flash validated ROM")),
+                    )
+                    .clicked()
+                {
+                    self.request_flash();
+                }
+                if let Some(cancel) = &self.cancel {
+                    if ui.button(self.t("Cancel flash")).clicked() {
+                        cancel.store(true, Ordering::Relaxed);
+                        self.status = "Cancellation requested...".into();
+                    }
+                }
+                if let Some((sent, total)) = self.progress {
+                    let fraction = if total == 0 {
+                        0.0
+                    } else {
+                        sent as f32 / total as f32
+                    };
+                    ui.add(egui::ProgressBar::new(fraction.clamp(0.0, 1.0)).show_percentage());
+                    ui.small(format!("{sent} / {total} bytes"));
+                }
+
+                ui.separator();
+                ui.heading(self.t("Recovery actions"));
+                ui.horizontal(|ui| {
+                    if ui
+                        .add_enabled(
+                            !self.busy && !self.devices.is_empty(),
+                            egui::Button::new(self.t("Reboot")),
+                        )
+                        .clicked()
+                    {
+                        self.send_recovery_command("reboot:", "Reboot requested.");
+                    }
+                    if ui
+                        .add_enabled(
+                            !self.busy && !self.devices.is_empty(),
+                            egui::Button::new(self.t("Erase data")),
+                        )
+                        .clicked()
+                    {
+                        self.confirm_format = true;
+                    }
+                });
+            });
+
+        egui::CentralPanel::default().show(context, |ui| {
+            ui.heading(self.t("Device information"));
+            if let Some(info) = &self.device_info {
+                egui::Grid::new("device-info").striped(true).show(ui, |ui| {
+                    for (label, value) in [
+                        ("Device", info.device.as_str()),
+                        ("Version", info.version.as_str()),
+                        ("Serial", info.sn.as_str()),
+                        ("Codebase", info.codebase.as_str()),
+                        ("Branch", info.branch.as_str()),
+                        ("Language", info.language.as_str()),
+                        ("Region", info.region.as_str()),
+                        ("ROM zone", info.romzone.as_str()),
+                    ] {
+                        ui.strong(label);
+                        ui.monospace(value);
+                        ui.end_row();
+                    }
+                });
+            } else {
+                ui.label(self.t("Read device info to begin."));
+            }
+            ui.separator();
+            ui.heading(self.t("Allowed ROM response"));
+            egui::ScrollArea::vertical()
+                .max_height(220.0)
+                .show(ui, |ui| {
+                    if self.rom_listing.is_empty() {
+                        ui.label(self.t("No response loaded."));
+                    } else {
+                        ui.monospace(&self.rom_listing);
+                    }
+                });
+            ui.separator();
+            ui.heading(self.t("Activity"));
+            egui::ScrollArea::vertical()
+                .stick_to_bottom(true)
+                .show(ui, |ui| {
+                    for line in &self.logs {
+                        ui.monospace(line);
+                    }
+                });
+        });
+
+        if self.confirm_flash {
+            let erase = self.validated.as_ref().is_some_and(|rom| rom.erase);
+            egui::Window::new(self.t("Confirm flash"))
+                .collapsible(false)
+                .resizable(false)
+                .anchor(egui::Align2::CENTER_CENTER, [0.0, 0.0])
+                .show(context, |ui| {
+                    if erase {
+                        ui.colored_label(
+                            egui::Color32::RED,
+                            self.t("Xiaomi requires this flash to permanently erase user data."),
+                        );
+                    } else {
+                        ui.label(self.t("Flash the validated official ROM now?"));
+                    }
+                    ui.label(self.t("Keep the phone connected until recovery reports completion."));
+                    ui.horizontal(|ui| {
+                        if ui.button(self.t("Cancel")).clicked() {
+                            self.confirm_flash = false;
+                        }
+                        let label = if erase {
+                            self.t("Erase data and flash")
+                        } else {
+                            self.t("Flash")
+                        };
+                        if ui.button(label).clicked() {
+                            self.start_flash();
+                        }
+                    });
+                });
+        }
+
+        if self.confirm_format {
+            egui::Window::new(self.t("Confirm data erase"))
+                .collapsible(false)
+                .resizable(false)
+                .anchor(egui::Align2::CENTER_CENTER, [0.0, 0.0])
+                .show(context, |ui| {
+                    ui.colored_label(
+                        egui::Color32::RED,
+                        self.t("This permanently erases all user data, then reboots the phone."),
+                    );
+                    ui.horizontal(|ui| {
+                        if ui.button(self.t("Cancel")).clicked() {
+                            self.confirm_format = false;
+                        }
+                        if ui.button(self.t("Erase all data")).clicked() {
+                            self.format_data();
+                        }
+                    });
+                });
+        }
+
+        context.request_repaint_after(std::time::Duration::from_millis(50));
+    }
+}
diff --git a/docs/MAF_CONSOLIDATION.md b/docs/MAF_CONSOLIDATION.md
new file mode 100644
index 0000000..52e3975
--- /dev/null
+++ b/docs/MAF_CONSOLIDATION.md
@@ -0,0 +1,20 @@
+# MiAssistantFork consolidation ledger
+
+MiAssistantFork has been folded into Sensitivity so users and maintainers have one repository and one protocol implementation.
+
+The consolidation audit used MiAssistantFork commit `c26601f5e977ba6abe5fe8b94953b15280d7a8fd` as its source snapshot.
+
+| MAF capability | Sensitivity disposition |
+| --- | --- |
+| Desktop GUI | Replaced on Windows by native WinUI 3 with Fluent Design 2; Linux and macOS retain `sensitivity-gui`. Both use the shared recovery implementation and include multi-device selection, validation, wipe confirmation, progress, cancellation, reboot, and format-data. |
+| Modular core | Replaced by the root `sensitivity` library, consumed by both CLI and GUI. No second ADB/USB/sideload stack remains. |
+| Cancellation/progress callback | Merged into `sideload_zip_with_progress`; the CLI and GUI provide their own presentation. |
+| Permissive recovery USB matching | Merged safely as exact protocol-1 preference with class/subclass fallback only when no exact interface exists. |
+| Fuzzing | Merged as the `fuzz/` cargo-fuzz target for the ADB header decoder. |
+| Precompiled release automation | Replaced with one matrix that builds the CLI and GUI for Linux, Windows, Intel macOS, and Apple Silicon macOS, plus checksums, a Windows MSI, a macOS app bundle, and platform setup guides. |
+| Raw arbitrary ADB command | Omitted. The public interface exposes supported recovery operations rather than an unsafe, hard-to-support escape hatch. |
+| Claimed interrupted-transfer resume | Rejected as unsafe. MAF sends its start block in the protocol field verified by Sensitivity as the wipe flag; values other than zero could request data erasure. |
+| Separate CLI protocol code | Removed as redundancy. Compatibility command names and migration mappings are documented instead. |
+| MAF branding/assets and old WiX metadata | Removed. Release archives are the supported precompiled distribution and carry Sensitivity branding and AGPL metadata. |
+
+The old repository can remain archived online for historical attribution, but it is not needed to build, test, package, or develop Sensitivity.
diff --git a/docs/MIGRATING_FROM_MAF.md b/docs/MIGRATING_FROM_MAF.md
new file mode 100644
index 0000000..ed17ad9
--- /dev/null
+++ b/docs/MIGRATING_FROM_MAF.md
@@ -0,0 +1,33 @@
+# Migrating from MiAssistantFork
+
+Sensitivity is the maintained successor to MiAssistantFork (MAF) and now contains its useful GUI, cancellation, packaging, and fuzz-testing ideas without retaining a duplicate protocol implementation. Verify the connected recovery with `sensitivity doctor`, then replace an existing MAF workflow.
+
+## Command mapping
+
+| MiAssistantFork | Sensitivity | Notes |
+| --- | --- | --- |
+| `miassistant-cli detect` | `sensitivity detect` | Performs the direct-USB protocol handshake. |
+| `miassistant-cli info` | `sensitivity info` | Human-readable by default; add `--json` for scripts. |
+| `miassistant-cli list-roms` | `sensitivity list-allowed-roms` | Uses the connected device identity. |
+| `miassistant-cli flash ROM.zip` | `sensitivity flash ROM.zip` | Hashes, validates, and sideloads the package. |
+| `miassistant-cli sideload ROM.zip --validate TOKEN` | `sensitivity flash ROM.zip --token TOKEN` | Add `--wipe` only when the recovery requires it. |
+| `miassistant-cli format-data` | `sensitivity format-data` | Requires typing `ERASE`, or `--yes` for intentional automation. |
+| `miassistant-cli reboot` | `sensitivity reboot` | Same recovery command. |
+
+The duplicate `miassistant` executable has been retired. Update scripts to use the `sensitivity` name.
+
+## Behavioral differences
+
+- Sensitivity leaves the desktop ADB server alone by default. Use `--adb-policy stop` only when diagnostics show that ADB owns the recovery interface.
+- Sensitivity requires HTTPS for Xiaomi validation unless the hidden advanced override is explicitly supplied.
+- Downloads are written to a hidden partial file and only replace the destination after MD5 verification.
+- Ctrl-C or the GUI Cancel button requests a graceful close after the current USB operation.
+- MAF's claimed resume field is intentionally unavailable: protocol review found that the same field is the verified data-wipe flag, so sending a block offset there could request an unintended wipe.
+- Arbitrary raw ADB commands are not part of the normal interface. Sensitivity exposes the supported Xiaomi recovery operations directly.
+- Windows uses the native `Sensitivity.App.exe` WinUI 3 interface. Linux and macOS use `sensitivity-gui`. Both consume the same tested Rust recovery implementation and include multi-device selection, validation, wipe confirmation, progress, and cancellation.
+
+## Automation changes
+
+Use `sensitivity info --json` rather than parsing labeled text. Generate completion definitions with `sensitivity completions bash`, `zsh`, `fish`, `elvish`, or `powershell`.
+
+Scripts that can erase data must pass `--yes` explicitly. Scripts should not pass `--adb-policy stop` globally; doing so stops a running ADB server even for devices unrelated to the recovery operation.
diff --git a/docs/MODERNIZATION.md b/docs/MODERNIZATION.md
new file mode 100644
index 0000000..593567f
--- /dev/null
+++ b/docs/MODERNIZATION.md
@@ -0,0 +1,33 @@
+# Sensitivity modernization
+
+## Product decision
+
+Sensitivity is the sole maintained product and repository. MiAssistantFork has been consolidated into it, not retained as a parallel implementation or compatibility layer.
+
+The working direct-USB, validation, and sideload behavior remains authoritative. Both `sensitivity` and `sensitivity-gui` consume that one library implementation.
+
+## Experience contract
+
+A new user can download one archive, connect a phone in **Connect with Mi Assistant** recovery mode, and use either a guided GUI or the scriptable CLI without installing Rust, Android platform tools, or Xiaomi desktop software.
+
+Both interfaces must:
+
+- leave unrelated ADB processes alone unless the user explicitly requests otherwise;
+- display destructive actions and require explicit confirmation;
+- validate packages before sideloading;
+- support cancellation without inventing an unverified resume protocol;
+- avoid exposing validation tokens or device serials in normal logs.
+
+## Unified architecture
+
+- The root `sensitivity` library owns USB discovery, ADB framing, Xiaomi commands, validation, download, and sideload.
+- The root CLI owns commands, prompts, diagnostics, JSON output, supervised progress/cancellation events, completions, and automation behavior.
+- `apps/windows/Sensitivity.WinUI` is the native Fluent Design 2 / WinUI 3 presentation layer and supervises the CLI backend without receiving validation tokens.
+- `crates/gui` is the portable Linux/macOS presentation layer and calls the same library operations.
+- Release archives contain both front ends, documentation, and platform setup files.
+
+See [MAF_CONSOLIDATION.md](MAF_CONSOLIDATION.md) for the disposition of MAF-specific features.
+
+## Release gate
+
+CI and offline tests prove compilation, parsing, framing, validation helpers, packaging, and front-end integration. Do not describe a release as hardware-validated until representative real devices have exercised detect/info, normal flash, server-required wipe, cancellation, failure reporting, and reboot. Record sanitized logs without serials or validation tokens.
diff --git a/docs/WINDOWS_ARCHITECTURE.md b/docs/WINDOWS_ARCHITECTURE.md
new file mode 100644
index 0000000..630b2e8
--- /dev/null
+++ b/docs/WINDOWS_ARCHITECTURE.md
@@ -0,0 +1,61 @@
+# Native Windows architecture
+
+Sensitivity's Windows application is an unpackaged, self-contained WinUI 3
+desktop app. It uses Fluent controls and Mica through the stable Windows App
+SDK. The recovery protocol remains in the shared Rust core and is shipped as
+`sensitivity.exe` beside `Sensitivity.App.exe`.
+
+## Process boundary
+
+The app starts the backend with `ProcessStartInfo.ArgumentList`; ROM paths are
+never interpolated into a command line. Standard output and standard error are
+read concurrently so a full pipe cannot stall a recovery operation.
+
+Long-running commands use a private temporary directory containing two
+one-shot control files:
+
+- creating `cancel` requests a graceful USB close;
+- creating `approve-wipe` approves a server-required data wipe.
+
+The backend deletes stale control files before connecting. The app first asks
+for graceful cancellation and only terminates the process tree after an
+eight-second timeout. The temporary directory is removed when the operation
+ends.
+
+## Machine event contract
+
+`sensitivity --machine` writes one JSON object per line. Current events are:
+
+```json
+{"event":"status","message":"Validating ROM with Xiaomi"}
+{"event":"progress","current":1048576,"total":4194304}
+{"event":"confirmation_required","kind":"data_wipe","message":"..."}
+{"event":"completed","message":"Flash completed"}
+{"event":"error","message":"..."}
+```
+
+Unknown event names and extra fields must be ignored by supervisors. Human
+diagnostic text may still appear, so clients should parse only complete JSON
+objects. Exit status remains authoritative: zero is success and non-zero is
+failure.
+
+Validation tokens and raw protocol authentication values are deliberately not
+included in events, diagnostics, settings, or process arguments. App settings
+contain only ADB preferences and the last selected ROM path in the current
+user's local application-data directory.
+
+## ADB coexistence
+
+The safe default is to leave the user's ADB server running. If Windows reports
+that the recovery USB interface is busy, the app offers to stop ADB once and
+retry; it does not silently disrupt another debugging session. Users with a
+persistently conflicting setup can opt into stopping ADB before every direct
+USB connection.
+
+## Build and release
+
+The Windows CI job is the authoritative XAML compilation check because the
+Windows App SDK XAML compiler is a Windows executable. Releases publish the
+WinUI app and Rust backend together, then produce both a portable ZIP and an
+x64 MSI. The MSI shortcut launches only `Sensitivity.App.exe`; the CLI remains
+available for automation and diagnostics.
diff --git a/fuzz/Cargo.lock b/fuzz/Cargo.lock
new file mode 100644
index 0000000..c5190e9
--- /dev/null
+++ b/fuzz/Cargo.lock
@@ -0,0 +1,1740 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aes"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures 0.2.17",
+]
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
+
+[[package]]
+name = "arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bitflags"
+version = "2.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block-padding"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block2"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5"
+dependencies = [
+ "objc2",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "cbc"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
+dependencies = [
+ "cipher",
+]
+
+[[package]]
+name = "cc"
+version = "1.2.67"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17dd265a7d0f31ef544e1b20e03add05d3b45b491b633b10d67145d2acc1a38"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
+[[package]]
+name = "chacha20"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core",
+]
+
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
+[[package]]
+name = "clap"
+version = "4.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd059f9da4f5c36b3787f65d38ccaab1cc315f07b01f89abc8359ee6a8205011"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_complete"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db8b397918185f0161ff3d6fcaa9e4bfc09b8367caf6e1d4a2848e5477ed027b"
+dependencies = [
+ "clap",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "console"
+version = "0.15.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "054ccb5b10f9f2cbf51eb355ca1d05c2d279ce1804688d0db74b4733a5aeafd8"
+dependencies = [
+ "encode_unicode",
+ "libc",
+ "once_cell",
+ "unicode-width",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "ctrlc"
+version = "3.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0b1fab2ae45819af2d0731d60f2afe17227ebb1a1538a236da84c93e9a60162"
+dependencies = [
+ "dispatch2",
+ "nix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "dispatch2"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
+dependencies = [
+ "bitflags",
+ "block2",
+ "libc",
+ "objc2",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "encode_unicode"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-core",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi",
+ "rand_core",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "http"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "hyper"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_properties"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+
+[[package]]
+name = "icu_provider"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indicatif"
+version = "0.17.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "183b3088984b400f4cfac3620d5e076c84da5364016b4f49473de574b2586235"
+dependencies = [
+ "console",
+ "number_prefix",
+ "portable-atomic",
+ "unicode-width",
+ "web-time",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "block-padding",
+ "generic-array",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom 0.4.3",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "libfuzzer-sys"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9fd2f41a1cba099f79a0b6b6c35656cf7c03351a7bae8ff0f28f25270f929d2"
+dependencies = [
+ "arbitrary",
+ "cc",
+]
+
+[[package]]
+name = "libusb1-sys"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da050ade7ac4ff1ba5379af847a10a10a8e284181e060105bf8d86960ce9ce0f"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "litemap"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+
+[[package]]
+name = "log"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "mio"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
+[[package]]
+name = "number_prefix"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"
+
+[[package]]
+name = "objc2"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a12a8ed07aefc768292f076dc3ac8c48f3781c8f2d5851dd3d98950e8c5a89f"
+dependencies = [
+ "objc2-encode",
+]
+
+[[package]]
+name = "objc2-encode"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33"
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
+dependencies = [
+ "bytes",
+ "getrandom 0.4.3",
+ "lru-slab",
+ "rand",
+ "rand_pcg",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "rand_pcg"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
+dependencies = [
+ "rand_core",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "webpki-roots",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rusb"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab9f9ff05b63a786553a4c02943b74b34a988448671001e9a27e2f0565cc05a4"
+dependencies = [
+ "libc",
+ "libusb1-sys",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
+[[package]]
+name = "rustls"
+version = "0.23.42"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
+dependencies = [
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "sensitivity"
+version = "1.1.0"
+dependencies = [
+ "aes",
+ "anyhow",
+ "base64",
+ "byteorder",
+ "cbc",
+ "clap",
+ "clap_complete",
+ "ctrlc",
+ "hex",
+ "indicatif",
+ "md-5",
+ "reqwest",
+ "rusb",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "sensitivity-fuzz"
+version = "0.0.0"
+dependencies = [
+ "libfuzzer-sys",
+ "sensitivity",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.150"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "317fafbbe3f02fc663dad00ea6186197de963cd4190e86a26d8d0fae095539af"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "socket2",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.76"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "writeable"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml
new file mode 100644
index 0000000..c7af8ad
--- /dev/null
+++ b/fuzz/Cargo.toml
@@ -0,0 +1,23 @@
+[package]
+name = "sensitivity-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2021"
+
+[workspace]
+members = ["."]
+resolver = "2"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+sensitivity = { path = ".." }
+
+[[bin]]
+name = "adb-header"
+path = "fuzz_targets/adb_header.rs"
+test = false
+doc = false
+bench = false
diff --git a/fuzz/fuzz_targets/adb_header.rs b/fuzz/fuzz_targets/adb_header.rs
new file mode 100644
index 0000000..90ea3e2
--- /dev/null
+++ b/fuzz/fuzz_targets/adb_header.rs
@@ -0,0 +1,11 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    if data.len() == 24 {
+        let mut header = [0_u8; 24];
+        header.copy_from_slice(data);
+        let _ = sensitivity::adb::decode_header(&header);
+    }
+});
diff --git a/packaging/linux/70-sensitivity.rules b/packaging/linux/70-sensitivity.rules
new file mode 100644
index 0000000..9525cc3
--- /dev/null
+++ b/packaging/linux/70-sensitivity.rules
@@ -0,0 +1,3 @@
+# Xiaomi Communications Co., Ltd. USB devices.
+# Restrict access to the active desktop user through systemd-logind/seatd.
+SUBSYSTEM=="usb", ENV{DEVTYPE}=="usb_device", ATTR{idVendor}=="2717", TAG+="uaccess"
diff --git a/packaging/linux/install-udev-rule.sh b/packaging/linux/install-udev-rule.sh
new file mode 100755
index 0000000..3f2ade2
--- /dev/null
+++ b/packaging/linux/install-udev-rule.sh
@@ -0,0 +1,29 @@
+#!/bin/sh
+set -eu
+
+rule_name=70-sensitivity.rules
+rule_source=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)/$rule_name
+rule_target=/etc/udev/rules.d/$rule_name
+
+if [ "$(id -u)" -ne 0 ]; then
+    if command -v sudo >/dev/null 2>&1; then
+        exec sudo "$0" "$@"
+    fi
+    echo "Run this installer as root (sudo is not installed)." >&2
+    exit 1
+fi
+
+if [ "${1-}" = "--uninstall" ]; then
+    rm -f "$rule_target"
+    echo "Removed $rule_target"
+else
+    install -m 0644 "$rule_source" "$rule_target"
+    echo "Installed $rule_target"
+fi
+
+if command -v udevadm >/dev/null 2>&1; then
+    udevadm control --reload-rules
+    udevadm trigger --subsystem-match=usb --attr-match=idVendor=2717 || true
+fi
+
+echo "Reconnect the phone before running 'sensitivity doctor'."
diff --git a/packaging/macos/Info.plist b/packaging/macos/Info.plist
new file mode 100644
index 0000000..b40d551
--- /dev/null
+++ b/packaging/macos/Info.plist
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>CFBundleName</key>
+  <string>Sensitivity</string>
+  <key>CFBundleDisplayName</key>
+  <string>Sensitivity</string>
+  <key>CFBundleIdentifier</key>
+  <string>dev.hasx.sensitivity</string>
+  <key>CFBundleVersion</key>
+  <string>@VERSION@</string>
+  <key>CFBundleShortVersionString</key>
+  <string>@VERSION@</string>
+  <key>CFBundleExecutable</key>
+  <string>sensitivity-gui</string>
+  <key>CFBundlePackageType</key>
+  <string>APPL</string>
+  <key>NSHighResolutionCapable</key>
+  <true/>
+</dict>
+</plist>
diff --git a/packaging/windows/README-WINDOWS.md b/packaging/windows/README-WINDOWS.md
new file mode 100644
index 0000000..10e0474
--- /dev/null
+++ b/packaging/windows/README-WINDOWS.md
@@ -0,0 +1,24 @@
+# Windows setup
+
+Install the MSI and open **Sensitivity** from the Start menu, or extract the portable ZIP and open `Sensitivity.App.exe`. The Windows interface is a self-contained WinUI 3 application; no separate .NET or Windows App SDK installation is required.
+
+The app includes diagnostics and can explain likely driver or ADB ownership problems. The `sensitivity.exe` CLI remains available for scripts and detailed troubleshooting.
+
+## One-time WinUSB setup
+
+Stock Xiaomi recovery exposes a vendor-specific Mi Assistant USB interface. Windows must associate that interface with its built-in WinUSB driver before Sensitivity can claim it directly.
+
+1. Boot the phone into stock recovery and choose **Connect with Mi Assistant**.
+2. Connect the phone directly, without a USB hub.
+3. Open Zadig as administrator and enable **Options > List All Devices**.
+4. Select the Mi Assistant/Android interface whose class is `ff`, subclass `42`, and protocol `01`. Do not select an unrelated phone interface.
+5. Choose **WinUSB** and install/replace the driver.
+6. Reconnect the phone, open Sensitivity, and select **Diagnostics > Run diagnostics**.
+
+Sensitivity leaves the normal ADB server running by default. If it appears to own the recovery interface, the app asks before stopping ADB and retrying. From the CLI, the equivalent command is:
+
+```powershell
+.\sensitivity.exe --adb-policy stop doctor
+```
+
+The old driver can be restored through Windows Device Manager by uninstalling the selected USB interface and reconnecting the phone.
diff --git a/packaging/windows/sensitivity.wxs b/packaging/windows/sensitivity.wxs
new file mode 100644
index 0000000..456bec0
--- /dev/null
+++ b/packaging/windows/sensitivity.wxs
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi">
+  <Product Id="*" Name="Sensitivity" Language="1033" Version="$(var.Version)"
+           Manufacturer="HasX" UpgradeCode="F2E8C6E4-6B9B-4D1D-9C7E-05E7F3B14F6A">
+    <Package InstallerVersion="500" Compressed="yes" InstallScope="perMachine" Platform="x64"/>
+    <MajorUpgrade DowngradeErrorMessage="A newer version of Sensitivity is already installed."/>
+    <MediaTemplate EmbedCab="yes"/>
+    <Directory Id="TARGETDIR" Name="SourceDir">
+      <Directory Id="ProgramFilesFolder">
+        <Directory Id="INSTALLFOLDER" Name="Sensitivity">
+          <Component Id="ApplicationShortcut" Guid="*" Win64="yes">
+            <Shortcut Id="StartMenuShortcut" Directory="ProgramMenuFolder"
+                      Name="Sensitivity" WorkingDirectory="INSTALLFOLDER"
+                      Target="[INSTALLFOLDER]Sensitivity.App.exe" Advertise="no"/>
+            <RemoveFolder Id="RemoveInstallFolder" Directory="INSTALLFOLDER" On="uninstall"/>
+            <RegistryValue Root="HKLM" Key="Software\HasX\Sensitivity"
+                           Name="Installed" Type="integer" Value="1" KeyPath="yes"/>
+          </Component>
+        </Directory>
+      </Directory>
+      <Directory Id="ProgramMenuFolder" Name="Programs"/>
+    </Directory>
+    <Feature Id="Complete" Title="Sensitivity" Level="1">
+      <ComponentGroupRef Id="AppFiles"/>
+      <ComponentRef Id="ApplicationShortcut"/>
+    </Feature>
+  </Product>
+</Wix>
diff --git a/src/adb.rs b/src/adb.rs
index 75b8604..dd5d7ee 100644
--- a/src/adb.rs
+++ b/src/adb.rs
@@ -4,18 +4,15 @@
 
 use anyhow::{bail, Context, Result};
 use byteorder::{ByteOrder, LittleEndian};
-use std::cmp;
 use std::time::Duration;
 
 use crate::usb::UsbTransport;
 
 const MAX_PAYLOAD: usize = 1 << 20; // 1 MiB cap for safety
+const HEADER_SIZE: usize = 24;
 
 const fn adb_cmd(b: [u8; 4]) -> u32 {
-    (b[0] as u32)
-        | ((b[1] as u32) << 8)
-        | ((b[2] as u32) << 16)
-        | ((b[3] as u32) << 24)
+    (b[0] as u32) | ((b[1] as u32) << 8) | ((b[2] as u32) << 16) | ((b[3] as u32) << 24)
 }
 
 pub const A_CNXN: u32 = adb_cmd(*b"CNXN");
@@ -34,39 +31,75 @@ pub struct AdbPacket {
 
 impl AdbPacket {
     pub fn new(cmd: u32, arg0: u32, arg1: u32, payload: Vec<u8>) -> Self {
-        Self { cmd, arg0, arg1, payload }
+        Self {
+            cmd,
+            arg0,
+            arg1,
+            payload,
+        }
     }
 }
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct AdbHeader {
+    pub cmd: u32,
+    pub arg0: u32,
+    pub arg1: u32,
+    pub payload_len: usize,
+    pub checksum: u32,
+}
+
+pub fn encode_header(packet: &AdbPacket) -> [u8; HEADER_SIZE] {
+    let mut header = [0u8; HEADER_SIZE];
+    LittleEndian::write_u32(&mut header[0..4], packet.cmd);
+    LittleEndian::write_u32(&mut header[4..8], packet.arg0);
+    LittleEndian::write_u32(&mut header[8..12], packet.arg1);
+    LittleEndian::write_u32(&mut header[12..16], packet.payload.len() as u32);
+    // Xiaomi Mi Assistant recovery follows the original client and uses zero.
+    LittleEndian::write_u32(&mut header[16..20], 0);
+    LittleEndian::write_u32(&mut header[20..24], packet.cmd ^ 0xFFFF_FFFF);
+    header
+}
+
+pub fn decode_header(bytes: &[u8; HEADER_SIZE]) -> Result<AdbHeader> {
+    let cmd = LittleEndian::read_u32(&bytes[0..4]);
+    let arg0 = LittleEndian::read_u32(&bytes[4..8]);
+    let arg1 = LittleEndian::read_u32(&bytes[8..12]);
+    let payload_len = LittleEndian::read_u32(&bytes[12..16]) as usize;
+    let checksum = LittleEndian::read_u32(&bytes[16..20]);
+    let magic = LittleEndian::read_u32(&bytes[20..24]);
+
+    if magic != (cmd ^ 0xFFFF_FFFF) {
+        bail!("ADB header magic mismatch for command {cmd:#x}");
+    }
+    if payload_len > MAX_PAYLOAD {
+        bail!("ADB payload too large: {payload_len} bytes");
+    }
+
+    Ok(AdbHeader {
+        cmd,
+        arg0,
+        arg1,
+        payload_len,
+        checksum,
+    })
+}
+
 pub struct AdbConnection {
     usb: UsbTransport,
-    // Some recoveries assume local-id is always 1 (matches miasst.c)
-    local_id_counter: u32,
 }
 
 impl AdbConnection {
     pub fn new(usb: UsbTransport) -> Result<Self> {
-        let mut conn = Self { usb, local_id_counter: 1 };
+        let mut conn = Self { usb };
         // Small settle delay after claiming interface to reduce race on Windows
         std::thread::sleep(Duration::from_millis(200));
         conn.handshake()?;
         Ok(conn)
     }
 
-    fn checksum(data: &[u8]) -> u32 {
-        data.iter().fold(0u32, |acc, &b| acc.wrapping_add(b as u32))
-    }
-
     fn send_packet(&mut self, pkt: &AdbPacket) -> Result<()> {
-        let mut header = [0u8; 24];
-        LittleEndian::write_u32(&mut header[0..4], pkt.cmd);
-        LittleEndian::write_u32(&mut header[4..8], pkt.arg0);
-        LittleEndian::write_u32(&mut header[8..12], pkt.arg1);
-        LittleEndian::write_u32(&mut header[12..16], pkt.payload.len() as u32);
-        // The original C impl sets checksum to 0; mirror that for device compatibility
-        LittleEndian::write_u32(&mut header[16..20], 0);
-        LittleEndian::write_u32(&mut header[20..24], pkt.cmd ^ 0xFFFF_FFFF);
-
+        let header = encode_header(pkt);
         self.usb.write_all(&header)?;
         if !pkt.payload.is_empty() {
             self.usb.write_all(&pkt.payload)?;
@@ -75,26 +108,20 @@ impl AdbConnection {
     }
 
     fn recv_packet(&mut self) -> Result<AdbPacket> {
-        let mut header = [0u8; 24];
-        self.usb.read_exact(&mut header)?;
-        let cmd = LittleEndian::read_u32(&header[0..4]);
-        let arg0 = LittleEndian::read_u32(&header[4..8]);
-        let arg1 = LittleEndian::read_u32(&header[8..12]);
-        let len = LittleEndian::read_u32(&header[12..16]) as usize;
-        let _cksum = LittleEndian::read_u32(&header[16..20]);
-        let magic = LittleEndian::read_u32(&header[20..24]);
-        if magic != (cmd ^ 0xFFFF_FFFF) {
-            bail!("ADB bad magic: {:#x} vs {:#x}", magic, cmd ^ 0xFFFF_FFFF);
-        }
-        if len > MAX_PAYLOAD {
-            bail!("ADB payload too large: {} bytes", len);
-        }
-        let mut payload = vec![0u8; len];
-        if len > 0 {
+        let mut bytes = [0u8; HEADER_SIZE];
+        self.usb.read_exact(&mut bytes)?;
+        let header = decode_header(&bytes)?;
+        let mut payload = vec![0u8; header.payload_len];
+        if header.payload_len > 0 {
             self.usb.read_exact(&mut payload)?;
             // Xiaomi's Mi Assistant mode sets checksum to 0 and does not verify; skip checksum validation here.
         }
-        Ok(AdbPacket { cmd, arg0, arg1, payload })
+        Ok(AdbPacket {
+            cmd: header.cmd,
+            arg0: header.arg0,
+            arg1: header.arg1,
+            payload,
+        })
     }
 
     fn handshake(&mut self) -> Result<()> {
@@ -105,7 +132,9 @@ impl AdbConnection {
 
         // Accept either CNXN or a WRTE with "sideload::" as success, mirroring miasst.c
         for _ in 0..10 {
-            let reply = self.recv_packet().context("Waiting for device reply after CONNECT")?;
+            let reply = self
+                .recv_packet()
+                .context("Waiting for device reply after CONNECT")?;
             match reply.cmd {
                 x if x == A_CNXN => {
                     return Ok(());
@@ -125,19 +154,23 @@ impl AdbConnection {
         bail!("Did not receive expected reply (CNXN/WRTE sideload::) from device after CONNECT");
     }
 
-    pub fn open_service(&mut self, name: &str) -> Result<AdbStream> {
+    pub fn open_service(&mut self, name: &str) -> Result<AdbStream<'_>> {
         let local_id = self.alloc_local_id();
         let mut payload = Vec::from(name.as_bytes());
         if !payload.ends_with(&[0]) {
             payload.push(0);
         }
         self.send_packet(&AdbPacket::new(A_OPEN, local_id, 0, payload))?;
-        loop {
+        for _ in 0..32 {
             let pkt = self.recv_packet()?;
             match pkt.cmd {
                 A_OKAY => {
                     let remote_id = pkt.arg0; // remote sends its id in arg0
-                    return Ok(AdbStream { conn: self, local_id, remote_id });
+                    return Ok(AdbStream {
+                        conn: self,
+                        local_id,
+                        remote_id,
+                    });
                 }
                 A_CLSE => bail!("Stream closed by device while opening {}", name),
                 A_WRTE => {
@@ -147,19 +180,22 @@ impl AdbConnection {
                 _ => {}
             }
         }
+        bail!("Device did not open service {name} after 32 packets")
     }
 
     // Open sideload-host service without consuming the first WRTE request.
     // Returns the stream and an optional pending packet (first WRTE or OKAY already read).
-    pub fn open_sideload(&mut self, name: &str) -> Result<(AdbStream, Option<AdbPacket>)> {
+    pub fn open_sideload(&mut self, name: &str) -> Result<(AdbStream<'_>, Option<AdbPacket>)> {
         let local_id = self.alloc_local_id();
         let mut payload = Vec::from(name.as_bytes());
-        if !payload.ends_with(&[0]) { payload.push(0); }
+        if !payload.ends_with(&[0]) {
+            payload.push(0);
+        }
         self.send_packet(&AdbPacket::new(A_OPEN, local_id, 0, payload))?;
 
         // We need the device's remote id. It can arrive in OKAY or in WRTE.arg0
         let mut remote_id: Option<u32> = None;
-        loop {
+        for _ in 0..32 {
             let pkt = self.recv_packet()?;
             match pkt.cmd {
                 x if x == A_OKAY => {
@@ -168,51 +204,57 @@ impl AdbConnection {
                 }
                 x if x == A_WRTE => {
                     let rid = remote_id.unwrap_or(pkt.arg0);
-                    let stream = AdbStream { conn: self, local_id, remote_id: rid };
+                    let stream = AdbStream {
+                        conn: self,
+                        local_id,
+                        remote_id: rid,
+                    };
                     return Ok((stream, Some(pkt)));
                 }
                 x if x == A_CLSE => bail!("Stream closed by device while opening sideload-host"),
                 _ => { /* ignore */ }
             }
         }
+        bail!("Device did not start sideload after 32 packets")
     }
 
     // Query a short text response service using C-tool semantics: OPEN -> OKAY -> WRTE -> CLSE.
     // We do not send host OKAY/CLSE during this short exchange to mirror miasst.c exactly.
     pub fn query_text(&mut self, name: &str) -> Result<String> {
-        let local_id = 1;
+        let local_id = self.alloc_local_id();
         let mut payload = Vec::from(name.as_bytes());
         if !payload.ends_with(&[0]) {
             payload.push(0);
         }
         self.send_packet(&AdbPacket::new(A_OPEN, local_id, 0, payload))?;
 
-        // First receive: often OKAY, sometimes WRTE
-        let first = self.recv_packet()?;
-        let mut text: Option<String> = None;
-        if first.cmd == A_WRTE {
-            text = Some(String::from_utf8_lossy(&first.payload).to_string());
-        } else if first.cmd != A_OKAY {
-            // Unexpected but continue
-        }
-
-        if text.is_none() {
-            // Second receive: expect WRTE
-            let second = self.recv_packet()?;
-            if second.cmd == A_WRTE {
-                text = Some(String::from_utf8_lossy(&second.payload).to_string());
+        let mut response = Vec::new();
+        for _ in 0..16 {
+            match self.recv_packet() {
+                Ok(packet) if packet.cmd == A_WRTE => {
+                    response.extend_from_slice(&packet.payload);
+                }
+                Ok(packet) if packet.cmd == A_CLSE => break,
+                Ok(_) => {}
+                // Some stock recoveries return the text but omit the final CLSE.
+                Err(_) if !response.is_empty() => break,
+                Err(error) => return Err(error).with_context(|| format!("Reading {name}")),
             }
         }
-
-        // Third receive: consume CLSE (ignore)
-        let _ = self.recv_packet();
-
-        let mut s = text.unwrap_or_default();
-        while s.ends_with('\n') || s.ends_with('\r') { s.pop(); }
+        if response.is_empty() {
+            bail!("Device returned an empty response for {name}");
+        }
+        let mut s = String::from_utf8_lossy(&response).into_owned();
+        while s.ends_with('\n') || s.ends_with('\r') {
+            s.pop();
+        }
         Ok(s)
     }
 
-    fn alloc_local_id(&mut self) -> u32 { 1 }
+    fn alloc_local_id(&mut self) -> u32 {
+        // Preserve the proven stock-recovery behavior used by Xiaomi's tool.
+        1
+    }
 
     pub fn set_timeout(&mut self, dur: Duration) {
         self.usb.set_timeout(dur);
@@ -239,52 +281,16 @@ impl<'a> AdbStream<'a> {
             .send_packet(&AdbPacket::new(A_OKAY, pkt_arg1, pkt_arg0, Vec::new()))
     }
 
-    pub fn send_wrte_mirror(&mut self, pkt_arg0: u32, pkt_arg1: u32, payload: Vec<u8>) -> Result<()> {
+    pub fn send_wrte_mirror(
+        &mut self,
+        pkt_arg0: u32,
+        pkt_arg1: u32,
+        payload: Vec<u8>,
+    ) -> Result<()> {
         // Mirror WRTE with swapped ids like the C tool
         self.conn
             .send_packet(&AdbPacket::new(A_WRTE, pkt_arg1, pkt_arg0, payload))
     }
-    pub fn read_write_or_close(&mut self) -> Result<Option<Vec<u8>>> {
-        loop {
-            let pkt = self.conn.recv_packet()?;
-            match pkt.cmd {
-                A_WRTE => {
-                    // ack and return this chunk
-                    self.conn.send_packet(&AdbPacket::new(A_OKAY, self.local_id, pkt.arg0, Vec::new()))?;
-                    return Ok(Some(pkt.payload));
-                }
-                A_OKAY => {
-                    // ignore keepalive/ack
-                }
-                A_CLSE => return Ok(None),
-                _ => {}
-            }
-        }
-    }
-    pub fn write(&mut self, data: &[u8]) -> Result<()> {
-        let mut off = 0;
-        while off < data.len() {
-            let chunk = cmp::min(64 * 1024, data.len() - off);
-            let payload = data[off..off + chunk].to_vec();
-            self.conn.send_packet(&AdbPacket::new(A_WRTE, self.local_id, self.remote_id, payload))?;
-            // Expect OKAY
-            loop {
-                let pkt = self.conn.recv_packet()?;
-                match pkt.cmd {
-                    A_OKAY => break,
-                    A_WRTE => {
-                        // Reader first, ack it
-                        self.conn.send_packet(&AdbPacket::new(A_OKAY, self.local_id, pkt.arg0, Vec::new()))?;
-                    }
-                    A_CLSE => bail!("Stream closed by device during write"),
-                    _ => {}
-                }
-            }
-            off += chunk;
-        }
-        Ok(())
-    }
-
     pub fn read_to_end(&mut self) -> Result<Vec<u8>> {
         let mut out = Vec::new();
         loop {
@@ -293,14 +299,24 @@ impl<'a> AdbStream<'a> {
                 A_WRTE => {
                     out.extend_from_slice(&pkt.payload);
                     // Ack
-                    self.conn.send_packet(&AdbPacket::new(A_OKAY, self.local_id, pkt.arg0, Vec::new()))?;
+                    self.conn.send_packet(&AdbPacket::new(
+                        A_OKAY,
+                        self.local_id,
+                        pkt.arg0,
+                        Vec::new(),
+                    ))?;
                 }
                 A_OKAY => {
                     // ignore
                 }
                 A_CLSE => {
                     // Mirror close
-                    self.conn.send_packet(&AdbPacket::new(A_CLSE, self.local_id, pkt.arg0, Vec::new()))?;
+                    self.conn.send_packet(&AdbPacket::new(
+                        A_CLSE,
+                        self.local_id,
+                        pkt.arg0,
+                        Vec::new(),
+                    ))?;
                     break;
                 }
                 _ => {}
@@ -310,11 +326,65 @@ impl<'a> AdbStream<'a> {
     }
 
     pub fn close(self) -> Result<()> {
-        self.conn
-            .send_packet(&AdbPacket::new(A_CLSE, self.local_id, self.remote_id, Vec::new()))
+        self.conn.send_packet(&AdbPacket::new(
+            A_CLSE,
+            self.local_id,
+            self.remote_id,
+            Vec::new(),
+        ))
     }
 }
 
 pub fn connect(usb: UsbTransport) -> Result<AdbConnection> {
     AdbConnection::new(usb)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn header_round_trip_preserves_protocol_fields() {
+        let packet = AdbPacket::new(A_OPEN, 12, 34, b"getdevice:\0".to_vec());
+        let header = decode_header(&encode_header(&packet)).unwrap();
+
+        assert_eq!(header.cmd, A_OPEN);
+        assert_eq!(header.arg0, 12);
+        assert_eq!(header.arg1, 34);
+        assert_eq!(header.payload_len, packet.payload.len());
+        assert_eq!(header.checksum, 0);
+    }
+
+    #[test]
+    fn header_is_little_endian_and_uses_adb_magic() {
+        let packet = AdbPacket::new(A_CNXN, 0x0100_0001, 1024 * 1024, Vec::new());
+        let bytes = encode_header(&packet);
+
+        assert_eq!(&bytes[0..4], b"CNXN");
+        assert_eq!(LittleEndian::read_u32(&bytes[20..24]), A_CNXN ^ 0xFFFF_FFFF);
+    }
+
+    #[test]
+    fn malformed_magic_is_rejected_before_payload_read() {
+        let packet = AdbPacket::new(A_OKAY, 1, 2, Vec::new());
+        let mut bytes = encode_header(&packet);
+        bytes[20] ^= 0xff;
+
+        assert!(decode_header(&bytes)
+            .unwrap_err()
+            .to_string()
+            .contains("magic mismatch"));
+    }
+
+    #[test]
+    fn oversized_payload_is_rejected_before_allocation() {
+        let packet = AdbPacket::new(A_WRTE, 1, 2, Vec::new());
+        let mut bytes = encode_header(&packet);
+        LittleEndian::write_u32(&mut bytes[12..16], (MAX_PAYLOAD + 1) as u32);
+
+        assert!(decode_header(&bytes)
+            .unwrap_err()
+            .to_string()
+            .contains("payload too large"));
+    }
+}
diff --git a/src/download.rs b/src/download.rs
index 2e70cd8..97ac9be 100644
--- a/src/download.rs
+++ b/src/download.rs
@@ -4,11 +4,11 @@
 
 use anyhow::{anyhow, bail, Context, Result};
 use indicatif::{ProgressBar, ProgressStyle};
+use md5::Digest;
 use reqwest::blocking::Client;
 use std::fs::{self, File};
 use std::io::{Read, Write};
 use std::path::{Path, PathBuf};
-use md5::Digest; // brings Md5::new() into scope
 
 pub struct LatestInfo {
     pub filename: String, // may contain ?t=...&s=...
@@ -34,7 +34,11 @@ pub fn parse_latest_from_json(json: &str) -> Result<(LatestInfo, Vec<String>)> {
     let mirrors = v
         .get("MirrorList")
         .and_then(|x| x.as_array())
-        .map(|arr| arr.iter().filter_map(|s| s.as_str().map(|t| t.to_string())).collect::<Vec<_>>())
+        .map(|arr| {
+            arr.iter()
+                .filter_map(|s| s.as_str().map(|t| t.to_string()))
+                .collect::<Vec<_>>()
+        })
         .unwrap_or_default();
     Ok((LatestInfo { filename, md5 }, mirrors))
 }
@@ -42,22 +46,52 @@ pub fn parse_latest_from_json(json: &str) -> Result<(LatestInfo, Vec<String>)> {
 pub fn choose_url(mirrors: &[String], filename: &str) -> Option<String> {
     for base in mirrors {
         // Prefer https mirrors
-        if !base.starts_with("https://") { continue; }
-        let url = format!("{}/{}", base.trim_end_matches('/'), filename.trim_start_matches('/'));
+        if !base.starts_with("https://") {
+            continue;
+        }
+        let url = format!(
+            "{}/{}",
+            base.trim_end_matches('/'),
+            filename.trim_start_matches('/')
+        );
         return Some(url);
     }
     // fallback to any mirror
-    mirrors.first().map(|b| format!("{}/{}", b.trim_end_matches('/'), filename))
+    mirrors
+        .first()
+        .map(|b| format!("{}/{}", b.trim_end_matches('/'), filename))
 }
 
-pub fn download_with_md5(client: &Client, url: &str, dest_dir: &Path, expect_md5: &str) -> Result<PathBuf> {
-    fs::create_dir_all(dest_dir).ok();
+pub fn download_with_md5(
+    client: &Client,
+    url: &str,
+    dest_dir: &Path,
+    expect_md5: &str,
+) -> Result<PathBuf> {
+    if expect_md5.len() != 32
+        || !expect_md5
+            .chars()
+            .all(|character| character.is_ascii_hexdigit())
+    {
+        bail!("Expected MD5 must contain exactly 32 hexadecimal characters");
+    }
+    fs::create_dir_all(dest_dir)
+        .with_context(|| format!("create download directory {}", dest_dir.display()))?;
     // derive file name (strip query)
-    let base = url.split('/').last().unwrap_or("download.zip");
+    let base = url.split('/').next_back().unwrap_or("download.zip");
     let base = base.split('?').next().unwrap_or(base);
+    let base = if base.is_empty() {
+        "download.zip"
+    } else {
+        base
+    };
     let dest = dest_dir.join(base);
+    let partial = dest_dir.join(format!(".{base}.part"));
 
-    let resp = client.get(url).send().with_context(|| format!("GET {}", url))?;
+    let resp = client
+        .get(url)
+        .send()
+        .with_context(|| format!("GET {}", url))?;
     if !resp.status().is_success() {
         bail!("Download failed: HTTP {} from {}", resp.status(), url);
     }
@@ -68,21 +102,122 @@ pub fn download_with_md5(client: &Client, url: &str, dest_dir: &Path, expect_md5
         .unwrap()
         .progress_chars("=>-"));
 
-    let mut hasher = md5::Md5::new();
-    let mut file = File::create(&dest).with_context(|| format!("create {}", dest.display()))?;
-    let mut src = resp;
-    let mut buf = [0u8; 128 * 1024];
-    loop {
-        let n = src.read(&mut buf)?;
-        if n == 0 { break; }
-        file.write_all(&buf[..n])?;
-        hasher.update(&buf[..n]);
-        if let Some(total) = len { pb.set_position(std::cmp::min(pb.position()+ (n as u64), total)); } else { pb.inc(n as u64); }
-    }
+    let transfer = (|| -> Result<String> {
+        let mut hasher = md5::Md5::new();
+        let mut file =
+            File::create(&partial).with_context(|| format!("create {}", partial.display()))?;
+        let mut src = resp;
+        let mut buf = [0u8; 128 * 1024];
+        loop {
+            let n = src.read(&mut buf)?;
+            if n == 0 {
+                break;
+            }
+            file.write_all(&buf[..n])?;
+            hasher.update(&buf[..n]);
+            if let Some(total) = len {
+                pb.set_position(std::cmp::min(pb.position() + (n as u64), total));
+            } else {
+                pb.inc(n as u64);
+            }
+        }
+        file.flush()?;
+        Ok(format!("{:x}", hasher.finalize()))
+    })();
     pb.finish_and_clear();
-    let got = format!("{:x}", hasher.finalize());
+    let got = match transfer {
+        Ok(md5) => md5,
+        Err(error) => {
+            let _ = fs::remove_file(&partial);
+            return Err(error).context("Downloading ROM package");
+        }
+    };
     if got.to_lowercase() != expect_md5.to_lowercase() {
-        bail!("MD5 mismatch after download: got {}, expected {}", got, expect_md5);
+        let _ = fs::remove_file(&partial);
+        bail!(
+            "MD5 mismatch after download: got {}, expected {}",
+            got,
+            expect_md5
+        );
     }
+    if dest.exists() {
+        fs::remove_file(&dest)
+            .with_context(|| format!("replace existing download {}", dest.display()))?;
+    }
+    fs::rename(&partial, &dest)
+        .with_context(|| format!("finalize verified download {}", dest.display()))?;
     Ok(dest)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::net::TcpListener;
+    use std::thread;
+
+    fn serve_once(body: &'static [u8]) -> String {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let address = listener.local_addr().unwrap();
+        thread::spawn(move || {
+            let (mut stream, _) = listener.accept().unwrap();
+            let mut request = [0u8; 1024];
+            let _ = stream.read(&mut request);
+            write!(
+                stream,
+                "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
+                body.len()
+            )
+            .unwrap();
+            stream.write_all(body).unwrap();
+        });
+        format!("http://{address}/recovery.zip")
+    }
+
+    #[test]
+    fn parses_latest_rom_and_prefers_https_mirror() {
+        let json = r#"{
+            "LatestRom":{"filename":"rom.zip?t=1","md5":"abc"},
+            "MirrorList":["http://mirror-one", "https://mirror-two"]
+        }"#;
+        let (latest, mirrors) = parse_latest_from_json(json).unwrap();
+
+        assert_eq!(latest.filename, "rom.zip?t=1");
+        assert_eq!(latest.md5, "abc");
+        assert_eq!(
+            choose_url(&mirrors, &latest.filename).unwrap(),
+            "https://mirror-two/rom.zip?t=1"
+        );
+    }
+
+    #[test]
+    fn verified_download_is_atomically_finalized() {
+        let directory = tempfile::tempdir().unwrap();
+        let url = serve_once(b"hello");
+        let path = download_with_md5(
+            &Client::new(),
+            &url,
+            directory.path(),
+            "5d41402abc4b2a76b9719d911017c592",
+        )
+        .unwrap();
+
+        assert_eq!(fs::read(path).unwrap(), b"hello");
+        assert!(!directory.path().join(".recovery.zip.part").exists());
+    }
+
+    #[test]
+    fn checksum_failure_removes_partial_download() {
+        let directory = tempfile::tempdir().unwrap();
+        let url = serve_once(b"corrupt");
+        let result = download_with_md5(
+            &Client::new(),
+            &url,
+            directory.path(),
+            "5d41402abc4b2a76b9719d911017c592",
+        );
+
+        assert!(result.unwrap_err().to_string().contains("MD5 mismatch"));
+        assert!(!directory.path().join("recovery.zip").exists());
+        assert!(!directory.path().join(".recovery.zip.part").exists());
+    }
+}
diff --git a/src/lib.rs b/src/lib.rs
new file mode 100644
index 0000000..f7d2ee4
--- /dev/null
+++ b/src/lib.rs
@@ -0,0 +1,17 @@
+// Copyright (C) 2025 HasX
+// Licensed under the GNU AGPL v3.0. See LICENSE file for details.
+// Website: https://hasx.dev
+
+//! Core implementation for the Sensitivity Xiaomi Recovery tool.
+//!
+//! The library contains USB transport, ADB framing, Xiaomi recovery commands,
+//! validation, download, and sideload behavior. User interaction and argument
+//! parsing live in the `sensitivity` binary.
+
+pub mod adb;
+pub mod download;
+pub mod mi;
+pub mod sideload;
+pub mod usb;
+pub mod util;
+pub mod validate;
diff --git a/src/main.rs b/src/main.rs
index 9544802..7b42598 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -2,96 +2,103 @@
 // Licensed under the GNU AGPL v3.0. See LICENSE file for details.
 // Website: https://hasx.dev
 
-use std::path::PathBuf;
+use std::io::{self, IsTerminal, Write};
+use std::path::{Path, PathBuf};
+use std::process::ExitCode;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::Arc;
+use std::time::Duration;
 
 use anyhow::{bail, Context, Result};
-use clap::{ArgAction, Parser, Subcommand};
-
-mod adb;
-mod sideload;
-mod validate;
-mod usb;
-mod mi;
-mod util;
-mod download;
-
-use crate::mi::MiClient;
-use crate::mi::profile::{apply_profile, RegionProfile};
-use crate::sideload::sideload_zip;
-use crate::usb::UsbTransport;
-use crate::util::logging::{init_logger, LogVerbosity};
-use crate::util::config;
+use clap::{ArgAction, CommandFactory, Parser, Subcommand, ValueEnum};
+use clap_complete::Shell;
+
+use sensitivity::mi::profile::{apply_profile, RegionProfile};
+use sensitivity::mi::{DeviceInfo, MiClient};
+use sensitivity::sideload::{sideload_zip, sideload_zip_with_progress};
+use sensitivity::usb::UsbTransport;
+use sensitivity::{download, util, validate};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, ValueEnum)]
+enum AdbPolicy {
+    /// Leave the user's local ADB server alone.
+    Keep,
+    /// Ask a running ADB server to stop before opening the USB interface.
+    Stop,
+}
 
 #[derive(Debug, Parser)]
-#[command(name = "miassistant", version, about = "SENSITIVITY: Mi Assistant CLI (HasX)")]
+#[command(
+    name = "sensitivity",
+    version,
+    about = "Flash official Xiaomi Recovery ROMs over direct USB",
+    long_about = "Sensitivity is a direct-USB Xiaomi Recovery flash and rescue tool. It does not require adb, an unlocked bootloader, or proprietary Xiaomi desktop software."
+)]
 struct Cli {
+    /// Emit newline-delimited JSON events for a supervising application
+    #[arg(long, global = true, hide = true)]
+    machine: bool,
+
+    /// File whose creation requests graceful cancellation
+    #[arg(long, global = true, hide = true)]
+    cancel_file: Option<PathBuf>,
+
+    /// File whose creation approves a server-required data wipe
+    #[arg(long, global = true, hide = true)]
+    approval_file: Option<PathBuf>,
+
     /// Device index among matching Mi Assistant interfaces
     #[arg(long, default_value_t = 0, global = true)]
     device_index: usize,
 
     /// Chunk size for sideload (bytes)
-    #[arg(long, default_value_t = 65536, global = true)]
+    #[arg(long, default_value_t = 65536, global = true, hide = true)]
     chunk_size: usize,
 
     /// Validation server URL
-    #[arg(long, default_value = "https://update.miui.com/updates/miotaV3.php", global = true)]
+    #[arg(
+        long,
+        default_value = "https://update.miui.com/updates/miotaV3.php",
+        global = true,
+        hide = true
+    )]
     server_url: String,
 
     /// Allow HTTP (insecure). Prints a big warning.
-    #[arg(long, action = ArgAction::SetTrue, global = true)]
+    #[arg(long, action = ArgAction::SetTrue, global = true, hide = true)]
     http: bool,
 
     /// Debug raw USB packets (directions/sizes)
-    #[arg(long, action = ArgAction::SetTrue, global = true)]
+    #[arg(long, action = ArgAction::SetTrue, global = true, hide = true)]
     debug_usb: bool,
 
-    /// Kill local adb server on 127.0.0.1:5037 before connecting
-    #[arg(long, action = ArgAction::SetTrue, global = true)]
-    kill_adb_server: bool,
-
-    /// Do not auto-kill adb server on handshake failure
-    #[arg(long, action = ArgAction::SetTrue, global = true)]
-    no_auto_kill: bool,
-
-    /// Verbose logging
-    #[arg(long, short = 'v', action = ArgAction::Count, global = true)]
-    verbose: u8,
-
-    /// Dump decrypted JSON from validation/list-allowed-roms
-    #[arg(long, action = ArgAction::SetTrue, global = true)]
-    dump_json: bool,
-
-    /// Kill adb server after command completes
-    #[arg(long, action = ArgAction::SetTrue, global = true)]
-    kill_adb_after: bool,
-
-    /// Allow local adb server to run (Windows only). By default we block it for stability.
-    #[arg(long, action = ArgAction::SetTrue, global = true)]
-    allow_adb: bool,
+    /// How to coexist with a local ADB server
+    #[arg(long, value_enum, default_value_t = AdbPolicy::Keep, global = true)]
+    adb_policy: AdbPolicy,
 
     /// Override device fields sent to validation (advanced)
-    #[arg(long, global = true)]
+    #[arg(long, global = true, hide = true)]
     override_device: Option<String>,
-    #[arg(long, global = true)]
+    #[arg(long, global = true, hide = true)]
     override_version: Option<String>,
-    #[arg(long, global = true)]
+    #[arg(long, global = true, hide = true)]
     override_sn: Option<String>,
-    #[arg(long, global = true)]
+    #[arg(long, global = true, hide = true)]
     override_codebase: Option<String>,
-    #[arg(long, global = true)]
+    #[arg(long, global = true, hide = true)]
     override_branch: Option<String>,
-    #[arg(long, global = true)]
+    #[arg(long, global = true, hide = true)]
     override_romzone: Option<String>,
 
     /// Apply a region profile: global, eea, in, ru, id, tr, tw, cn
     #[arg(long, global = true)]
-    profile: Option<String>,
+    profile: Option<RegionProfile>,
     /// Codename to use when building device name from profile (e.g., garnet)
     #[arg(long, global = true)]
     codename: Option<String>,
 
     /// Override MD5 used for server validation (bypasses file hashing)
-    #[arg(long, global = true)]
+    #[arg(long, global = true, hide = true)]
     md5: Option<String>,
 
     #[command(subcommand)]
@@ -100,8 +107,29 @@ struct Cli {
 
 #[derive(Debug, Subcommand)]
 enum Commands {
-    /// Print device and ROM info fields
-    ReadInfo,
+    /// Generate shell completion definitions
+    Completions {
+        /// Shell whose completion format should be generated
+        #[arg(value_enum)]
+        shell: Shell,
+    },
+    /// List matching recovery USB interfaces without opening them
+    Devices {
+        /// Emit stable machine-readable JSON
+        #[arg(long)]
+        json: bool,
+    },
+    /// Check USB access and identify common setup problems
+    Doctor,
+    /// Check that a recovery device can complete the protocol handshake
+    Detect,
+    /// Print device and ROM information
+    #[command(visible_alias = "read-info")]
+    Info {
+        /// Emit stable machine-readable JSON
+        #[arg(long)]
+        json: bool,
+    },
     /// Query the server and list allowed ROMs
     ListAllowedRoms,
     /// Validate and sideload the given Recovery ROM zip
@@ -117,8 +145,12 @@ enum Commands {
         #[arg(long, action = ArgAction::SetTrue)]
         wipe: bool,
     },
-    /// Issue format-data and reboot
-    FormatData,
+    /// Erase user data, then reboot
+    FormatData {
+        /// Confirm the destructive operation without an interactive prompt
+        #[arg(long)]
+        yes: bool,
+    },
     /// Reboot the device
     Reboot,
     /// Download LatestRom reported by server
@@ -139,258 +171,361 @@ enum Commands {
         #[arg(long, action = ArgAction::SetTrue)]
         wipe: bool,
     },
-    /// Persistently set the MD5 used for validation (bypass hashing)
-    SetHash { md5: String },
-    /// Clear the persisted MD5 override
-    ClearHash,
 }
 
-fn main() -> Result<()> {
-    let cli = Cli::parse();
-    // Load persisted state (MD5 override)
-    let mut state = config::load_state();
-    init_logger(match cli.verbose {
-        0 => LogVerbosity::Normal,
-        1 => LogVerbosity::Verbose,
-        _ => LogVerbosity::Debug,
-    });
+fn main() -> ExitCode {
+    let machine = std::env::args_os().any(|argument| argument == "--machine");
+    match run() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            if machine {
+                emit_machine_event(serde_json::json!({
+                    "event": "error",
+                    "message": format!("{error:#}")
+                }));
+            }
+            eprintln!("Error: {error:#}");
+            ExitCode::FAILURE
+        }
+    }
+}
 
+fn run() -> Result<()> {
+    let cli = Cli::parse();
+    reset_control_file(cli.cancel_file.as_deref())?;
+    reset_control_file(cli.approval_file.as_deref())?;
     if !cli.server_url.starts_with("https://") && !cli.http {
-        bail!("Refusing to use non-HTTPS server without --http. Provided: {}", cli.server_url);
+        bail!(
+            "Refusing to use non-HTTPS server without --http. Provided: {}",
+            cli.server_url
+        );
     }
     if cli.http && cli.server_url.starts_with("http://") {
-        eprintln!("WARNING: Using HTTP for validation endpoint: {}", cli.server_url);
+        eprintln!(
+            "WARNING: Using HTTP for validation endpoint: {}",
+            cli.server_url
+        );
     }
 
-    // On Windows, default to exclusive mode: kill adb server and block port 5037 unless --allow-adb is provided.
-    #[cfg(windows)]
-    let mut _adb_block_guard: Option<std::net::TcpListener> = None;
-    #[cfg(windows)]
-    {
-        if !cli.allow_adb {
-            // Proactively kill by protocol
-            let _ = util::adb_server::kill_adb_server(std::time::Duration::from_millis(500));
-            // Fallback: hard kill process
-            util::adb_server::kill_adb_process();
-            // Try to block the port to prevent respawn
-            _adb_block_guard = util::adb_server::block_port_5037();
-            if _adb_block_guard.is_some() {
-                eprintln!("Exclusive mode: adb port 5037 blocked for this session");
-            } else if util::adb_server::is_running(std::time::Duration::from_millis(200)) {
-                eprintln!("Warning: adb server still running on port 5037; stability may be affected");
-            }
-        } else if !cli.kill_adb_server && util::adb_server::is_running(std::time::Duration::from_millis(200)) {
-            eprintln!("Note: adb server appears to be running on 127.0.0.1:5037. It may hold the USB. Pass --kill-adb-server to stop it or omit --allow-adb");
-        }
-        if cli.kill_adb_server {
-            if let Err(e) = util::adb_server::kill_adb_server(std::time::Duration::from_secs(2)) {
-                eprintln!("Warning: failed to kill adb server: {}", e);
-            } else {
-                eprintln!("adb server killed (port 5037)");
-            }
-        }
+    let adb_was_running = util::adb_server::is_running(std::time::Duration::from_millis(200));
+    if cli.adb_policy == AdbPolicy::Stop && adb_was_running {
+        util::adb_server::kill_adb_server(std::time::Duration::from_secs(2))
+            .context("Stopping the local ADB server")?;
+        eprintln!("Stopped the local ADB server for direct USB access.");
     }
 
     // Open USB transport
-    let mut make_client = || -> Result<MiClient> {
+    let make_client = || -> Result<MiClient> {
         let transport = UsbTransport::open(cli.device_index, cli.debug_usb)
             .context("Opening USB Mi Assistant interface via libusb")?;
         MiClient::new(transport).context("Initializing ADB client")
     };
     // Handle config-only subcommands before touching USB
     match &cli.command {
-        Commands::SetHash { md5 } => {
-            if md5.len() != 32 || !md5.chars().all(|c| c.is_ascii_hexdigit()) {
-                bail!("--md5 must be 32 hex chars");
-            }
-            state.override_md5 = Some(md5.to_lowercase());
-            config::save_state(&state).context("saving state")?;
-            println!("MD5 override saved.");
+        Commands::Completions { shell } => {
+            let mut command = Cli::command();
+            clap_complete::generate(*shell, &mut command, "sensitivity", &mut io::stdout());
             return Ok(());
         }
-        Commands::ClearHash => {
-            state.override_md5 = None;
-            config::save_state(&state).context("saving state")?;
-            println!("MD5 override cleared.");
+        Commands::Devices { json } => {
+            let devices =
+                UsbTransport::discover().context("Discovering recovery USB interfaces")?;
+            if *json {
+                println!("{}", serde_json::to_string_pretty(&devices)?);
+            } else if devices.is_empty() {
+                println!("No Mi Assistant recovery interfaces found.");
+                println!(
+                    "Boot stock recovery, choose 'Connect with Mi Assistant', then reconnect USB."
+                );
+            } else {
+                println!("Found {} recovery interface(s):", devices.len());
+                for device in &devices {
+                    print_usb_device(device);
+                }
+            }
             return Ok(());
         }
+        Commands::Doctor => {
+            println!("Sensitivity {}", env!("CARGO_PKG_VERSION"));
+            println!(
+                "Platform: {} {}",
+                std::env::consts::OS,
+                std::env::consts::ARCH
+            );
+            println!(
+                "Local ADB server: {}",
+                if adb_was_running {
+                    "running"
+                } else {
+                    "not running"
+                }
+            );
+            let devices =
+                UsbTransport::discover().context("Discovering recovery USB interfaces")?;
+            println!("Matching recovery interfaces: {}", devices.len());
+            for device in &devices {
+                print_usb_device(device);
+            }
+            if devices.is_empty() {
+                eprintln!("\nNo matching USB interface was detected.");
+                #[cfg(windows)]
+                eprintln!("On Windows, the Mi Assistant interface must use the WinUSB driver.");
+                #[cfg(target_os = "linux")]
+                eprintln!(
+                    "On Linux, reconnect the phone and check USB permissions if access is denied."
+                );
+                bail!("doctor found a USB setup problem");
+            }
+            match make_client() {
+                Ok(_) => {
+                    println!("Recovery USB: ready");
+                    println!("Result: ready to use");
+                    return Ok(());
+                }
+                Err(error) => {
+                    println!("Recovery USB: unavailable");
+                    eprintln!("\n{error:#}");
+                    if adb_was_running
+                        && cli.adb_policy == AdbPolicy::Keep
+                        && adb_may_own_interface(&error)
+                    {
+                        eprintln!(
+                            "\nTry again with `--adb-policy stop` if ADB owns the USB interface."
+                        );
+                    }
+                    #[cfg(windows)]
+                    eprintln!("On Windows, the Mi Assistant interface must use the WinUSB driver.");
+                    #[cfg(target_os = "linux")]
+                    eprintln!("On Linux, reconnect the phone and check USB permissions if access is denied.");
+                    bail!("doctor found a USB setup problem");
+                }
+            }
+        }
         _ => {}
     }
 
-    let mut client = match make_client() {
-        Ok(c) => c,
-        Err(e) => {
-            if !cli.no_auto_kill {
-                eprintln!("Handshake failed. Attempting to kill adb server and retry once…");
-                let _ = util::adb_server::kill_adb_server(std::time::Duration::from_millis(500));
-                #[cfg(windows)]
-                { util::adb_server::kill_adb_process(); }
-                std::thread::sleep(std::time::Duration::from_millis(300));
-                #[cfg(windows)]
-                { if _adb_block_guard.is_none() { _adb_block_guard = util::adb_server::block_port_5037(); } }
-                make_client().context(e)?
-            } else {
-                return Err(e);
-            }
+    let mut client = make_client().map_err(|error| {
+        if adb_was_running
+            && cli.adb_policy == AdbPolicy::Keep
+            && adb_may_own_interface(&error)
+        {
+            error.context(
+                "A local ADB server is running. If it owns this USB interface, retry with --adb-policy stop",
+            )
+        } else {
+            error
         }
-    };
+    })?;
+    let identity = IdentityOptions::from(&cli);
 
     match cli.command {
-        Commands::ReadInfo => {
+        Commands::Completions { .. } => {
+            unreachable!("completions returns before USB command dispatch")
+        }
+        Commands::Devices { .. } => unreachable!("devices returns before USB command dispatch"),
+        Commands::Doctor => unreachable!("doctor returns before USB command dispatch"),
+        Commands::Detect => {
+            println!("Recovery device detected; direct USB handshake succeeded.");
+        }
+        Commands::Info { json } => {
             let info = client.read_all_info().context("Fetching device info")?;
-            println!("{}", info.device);
-            println!("{}", info.version);
-            println!("{}", info.sn);
-            println!("{}", info.codebase);
-            println!("{}", info.branch);
-            println!("{}", info.language);
-            println!("{}", info.region);
-            println!("{}", info.romzone);
+            if json {
+                println!("{}", serde_json::to_string_pretty(&info)?);
+            } else {
+                println!("Device:   {}", info.device);
+                println!("Version:  {}", info.version);
+                println!("Serial:   {}", info.sn);
+                println!("Codebase: {}", info.codebase);
+                println!("Branch:   {}", info.branch);
+                println!("Language: {}", info.language);
+                println!("Region:   {}", info.region);
+                println!("ROM zone: {}", info.romzone);
+            }
         }
         Commands::DownloadLatest { output_dir } => {
-            let mut info = client.read_all_info().context("Fetching device info")?;
-            if let Some(p) = &cli.profile { if let Some(rp) = RegionProfile::from_str(p) { info = apply_profile(&info, rp, cli.codename.as_deref(), true)?; eprintln!("Applied profile: {}", p); } }
-            if let Some(v) = &cli.override_device { info.device = v.clone(); }
-            if let Some(v) = &cli.override_version { info.version = v.clone(); }
-            if let Some(v) = &cli.override_sn { info.sn = v.clone(); }
-            if let Some(v) = &cli.override_codebase { info.codebase = v.clone(); }
-            if let Some(v) = &cli.override_branch { info.branch = v.clone(); }
-            if let Some(v) = &cli.override_romzone { info.romzone = v.clone(); }
-            let req_json = validate::build_request_json(&info, None).context("Building validation request")?;
-            if cli.dump_json { if let Ok(q) = validate::encode_request_b64(&req_json) { eprintln!("Request JSON: {}", req_json); eprintln!("q (base64): {}", q); } }
-            let resp = validate::validate(&cli.server_url, &req_json).context("Validation HTTP call failed")?;
-            let json = resp.full_json.clone().ok_or_else(|| anyhow::anyhow!("No full JSON in response"))?;
-            let (latest, mirrors) = download::parse_latest_from_json(&json).context("Parsing LatestRom from JSON")?;
-            let url = download::choose_url(&mirrors, &latest.filename).ok_or_else(|| anyhow::anyhow!("No mirror URL available"))?;
-            let client_http = reqwest::blocking::Client::builder().user_agent("MiTunes_UserAgent_v3.0").build()?;
+            let info = effective_device_info(
+                &identity,
+                client.read_all_info().context("Fetching device info")?,
+            )?;
+            let req_json =
+                validate::build_request_json(&info, None).context("Building validation request")?;
+            let resp = validate::validate(&cli.server_url, &req_json)
+                .context("Validation HTTP call failed")?;
+            let json = resp
+                .full_json
+                .clone()
+                .ok_or_else(|| anyhow::anyhow!("No full JSON in response"))?;
+            let (latest, mirrors) =
+                download::parse_latest_from_json(&json).context("Parsing LatestRom from JSON")?;
+            let url = download::choose_url(&mirrors, &latest.filename)
+                .ok_or_else(|| anyhow::anyhow!("No mirror URL available"))?;
+            let client_http = reqwest::blocking::Client::builder()
+                .user_agent("MiTunes_UserAgent_v3.0")
+                .build()?;
             let out_dir = output_dir.unwrap_or_else(|| std::env::current_dir().unwrap());
-            let path = download::download_with_md5(&client_http, &url, &out_dir, &latest.md5).context("Downloading LatestRom")?;
+            let path = download::download_with_md5(&client_http, &url, &out_dir, &latest.md5)
+                .context("Downloading LatestRom")?;
             println!("Downloaded to {} (md5 ok)", path.display());
         }
-        Commands::FlashFromLatest { output_dir, yes, wipe } => {
-            let mut info = client.read_all_info().context("Fetching device info")?;
-            if let Some(p) = &cli.profile { if let Some(rp) = RegionProfile::from_str(p) { info = apply_profile(&info, rp, cli.codename.as_deref(), true)?; eprintln!("Applied profile: {}", p); } }
-            if let Some(v) = &cli.override_device { info.device = v.clone(); }
-            if let Some(v) = &cli.override_version { info.version = v.clone(); }
-            if let Some(v) = &cli.override_sn { info.sn = v.clone(); }
-            if let Some(v) = &cli.override_codebase { info.codebase = v.clone(); }
-            if let Some(v) = &cli.override_branch { info.branch = v.clone(); }
-            if let Some(v) = &cli.override_romzone { info.romzone = v.clone(); }
+        Commands::FlashFromLatest {
+            output_dir,
+            yes,
+            wipe,
+        } => {
+            emit_status(cli.machine, "Reading recovery information");
+            let info = effective_device_info(
+                &identity,
+                client.read_all_info().context("Fetching device info")?,
+            )?;
             // Step 1: Get LatestRom info
-            let req_json = validate::build_request_json(&info, None).context("Building validation request")?;
-            let resp1 = validate::validate(&cli.server_url, &req_json).context("Validation HTTP call failed")?;
-            let json = resp1.full_json.clone().ok_or_else(|| anyhow::anyhow!("No full JSON in response"))?;
-            let (latest, mirrors) = download::parse_latest_from_json(&json).context("Parsing LatestRom from JSON")?;
-            let url = download::choose_url(&mirrors, &latest.filename).ok_or_else(|| anyhow::anyhow!("No mirror URL available"))?;
+            let req_json =
+                validate::build_request_json(&info, None).context("Building validation request")?;
+            let resp1 = validate::validate(&cli.server_url, &req_json)
+                .context("Validation HTTP call failed")?;
+            let json = resp1
+                .full_json
+                .clone()
+                .ok_or_else(|| anyhow::anyhow!("No full JSON in response"))?;
+            let (latest, mirrors) =
+                download::parse_latest_from_json(&json).context("Parsing LatestRom from JSON")?;
+            let url = download::choose_url(&mirrors, &latest.filename)
+                .ok_or_else(|| anyhow::anyhow!("No mirror URL available"))?;
             // Step 2: Download
-            let client_http = reqwest::blocking::Client::builder().user_agent("MiTunes_UserAgent_v3.0").build()?;
+            emit_status(cli.machine, "Downloading and verifying the recovery ROM");
+            let client_http = reqwest::blocking::Client::builder()
+                .user_agent("MiTunes_UserAgent_v3.0")
+                .build()?;
             let out_dir = output_dir.unwrap_or_else(|| std::env::current_dir().unwrap());
-            let local_path = download::download_with_md5(&client_http, &url, &out_dir, &latest.md5).context("Downloading LatestRom")?;
+            let local_path = download::download_with_md5(&client_http, &url, &out_dir, &latest.md5)
+                .context("Downloading LatestRom")?;
             // Step 3: Validate for this MD5 and flash
-            let req_json2 = validate::build_request_json(&info, Some(latest.md5.clone())).context("Building validation request")?;
-            if cli.dump_json { if let Ok(q) = validate::encode_request_b64(&req_json2) { eprintln!("Request JSON: {}", req_json2); eprintln!("q (base64): {}", q); } }
-            let resp2 = validate::validate(&cli.server_url, &req_json2).context("Validation HTTP call failed")?;
-            if let Some(msg) = resp2.code_message.as_deref() { println!("Server message: {}", msg); }
+            let req_json2 = validate::build_request_json(&info, Some(latest.md5.clone()))
+                .context("Building validation request")?;
+            let resp2 = validate::validate(&cli.server_url, &req_json2)
+                .context("Validation HTTP call failed")?;
+            if let Some(msg) = resp2.code_message.as_deref() {
+                println!("Server message: {}", msg);
+            }
+            let cancel = install_cancel_handler(cli.cancel_file.as_deref())?;
             if (resp2.pkgrom_erase == Some(1) || wipe) && !yes {
-                println!("NOTICE: Data will be erased during flashing. Press Enter to continue…");
-                let mut s = String::new();
-                let _ = std::io::stdin().read_line(&mut s);
+                confirm_data_wipe_supervised(cli.machine, cli.approval_file.as_deref(), &cancel)?;
             }
-            let token = resp2.validate_token.as_deref().ok_or_else(|| anyhow::anyhow!("Missing Validate token in response"))?.to_string();
-            if cli.verbose > 0 { eprintln!("Using validate token (len {}): {:.8}…", token.len(), token); }
+            let token = resp2
+                .validate_token
+                .as_deref()
+                .ok_or_else(|| anyhow::anyhow!("Missing Validate token in response"))?
+                .to_string();
             let allow_wipe = resp2.pkgrom_erase == Some(1) || wipe;
-            sideload_zip(&mut client, &local_path, cli.chunk_size, &token, allow_wipe).context("Sideload failed")?;
-        }
-        Commands::SetHash { .. } => {
-            // Already handled before USB init
-            return Ok(());
-        }
-        Commands::ClearHash => {
-            // Already handled before USB init
-            return Ok(());
+            emit_status(cli.machine, "Flashing the validated recovery ROM");
+            run_sideload(
+                &mut client,
+                &local_path,
+                cli.chunk_size,
+                &token,
+                allow_wipe,
+                &cancel,
+                cli.machine,
+            )
+            .context("Sideload failed")?;
+            emit_completed(cli.machine, "Flash completed");
         }
         Commands::ListAllowedRoms => {
-            let mut info = client.read_all_info().context("Fetching device info")?;
-            if let Some(p) = &cli.profile { if let Some(rp) = RegionProfile::from_str(p) { info = apply_profile(&info, rp, cli.codename.as_deref(), true)?; eprintln!("Applied profile: {}", p); } }
-            if let Some(v) = &cli.override_device { info.device = v.clone(); }
-            if let Some(v) = &cli.override_version { info.version = v.clone(); }
-            if let Some(v) = &cli.override_sn { info.sn = v.clone(); }
-            if let Some(v) = &cli.override_codebase { info.codebase = v.clone(); }
-            if let Some(v) = &cli.override_branch { info.branch = v.clone(); }
-            if let Some(v) = &cli.override_romzone { info.romzone = v.clone(); }
-            let req_json = validate::build_request_json(&info, None).context("Building validation request")?;
-            if cli.dump_json {
-                if let Ok(q) = validate::encode_request_b64(&req_json) {
-                    eprintln!("Request JSON: {}", req_json);
-                    eprintln!("q (base64): {}", q);
-                }
-            }
-            let resp = validate::validate(&cli.server_url, &req_json).context("Validation HTTP call failed")?;
-            validate::print_allowed_with_options(&resp, cli.dump_json);
+            let info = effective_device_info(
+                &identity,
+                client.read_all_info().context("Fetching device info")?,
+            )?;
+            let req_json =
+                validate::build_request_json(&info, None).context("Building validation request")?;
+            let resp = validate::validate(&cli.server_url, &req_json)
+                .context("Validation HTTP call failed")?;
+            validate::print_allowed(&resp);
         }
-        Commands::Flash { path, yes, token, wipe } => {
+        Commands::Flash {
+            path,
+            yes,
+            token,
+            wipe,
+        } => {
             if !path.exists() {
                 bail!("Zip not found: {}", path.display());
             }
-            let mut info = client.read_all_info().context("Fetching device info")?;
-            if let Some(p) = &cli.profile { if let Some(rp) = RegionProfile::from_str(p) { info = apply_profile(&info, rp, cli.codename.as_deref(), true)?; eprintln!("Applied profile: {}", p); } }
-            if let Some(v) = &cli.override_device { info.device = v.clone(); }
-            if let Some(v) = &cli.override_version { info.version = v.clone(); }
-            if let Some(v) = &cli.override_sn { info.sn = v.clone(); }
-            if let Some(v) = &cli.override_codebase { info.codebase = v.clone(); }
-            if let Some(v) = &cli.override_branch { info.branch = v.clone(); }
-            if let Some(v) = &cli.override_romzone { info.romzone = v.clone(); }
+            emit_status(cli.machine, "Reading recovery information");
+            let info = effective_device_info(
+                &identity,
+                client.read_all_info().context("Fetching device info")?,
+            )?;
+            emit_status(cli.machine, "Checking the ROM package");
             let computed_md5 = util::md5::md5_file(&path).context("Computing MD5 of zip")?;
-            // Determine MD5 to use (CLI > persisted > computed)
-            let used_md5 = if let Some(m) = &cli.md5 { m.clone() } else if let Some(m) = &state.override_md5 { m.clone() } else { computed_md5.clone() };
+            // An explicit one-session override is retained for protocol debugging.
+            let used_md5 = if let Some(m) = &cli.md5 {
+                m.clone()
+            } else {
+                computed_md5.clone()
+            };
             if used_md5.len() != 32 || !used_md5.chars().all(|c| c.is_ascii_hexdigit()) {
                 bail!("Provided MD5 must be 32 hex characters");
             }
             if used_md5.to_lowercase() != computed_md5 {
-                eprintln!("WARNING: Using overridden MD5 {} (computed {})", used_md5, computed_md5);
-            } else {
-                if cli.verbose > 0 { eprintln!("Using MD5 {}", used_md5); }
-            }
-            let req_json = validate::build_request_json(&info, Some(used_md5.clone())).context("Building validation request")?;
-            if cli.dump_json {
-                if let Ok(q) = validate::encode_request_b64(&req_json) {
-                    eprintln!("Request JSON: {}", req_json);
-                    eprintln!("q (base64): {}", q);
-                }
+                eprintln!(
+                    "WARNING: Using overridden MD5 {} (computed {})",
+                    used_md5, computed_md5
+                );
             }
+            let req_json = validate::build_request_json(&info, Some(used_md5.clone()))
+                .context("Building validation request")?;
             let mut resp = validate::ValidateResult::default();
             // Preserve whether CLI provided a token before shadowing it
             let cli_token_provided = token.is_some();
             let token_string = match token {
                 Some(t) => t,
                 None => {
-                    let r = validate::validate(&cli.server_url, &req_json).context("Validation HTTP call failed")?;
-                    if let Some(msg) = r.code_message.as_deref() { println!("Server message: {}", msg); }
-                    if cli.dump_json { if let Some(j) = &r.full_json { eprintln!("Decrypted JSON: {}", j); } }
+                    let r = validate::validate(&cli.server_url, &req_json)
+                        .context("Validation HTTP call failed")?;
+                    if let Some(msg) = r.code_message.as_deref() {
+                        println!("Server message: {}", msg);
+                    }
                     let t = match r.validate_token.as_deref() {
                         Some(t) if !t.is_empty() => t.to_string(),
-                        _ => bail!("Validation did not return a token. Cannot start sideload. Use --dump-json to inspect server response."),
+                        _ => bail!("Validation did not return a token, so the flash cannot start."),
                     };
                     resp = r;
                     t
                 }
             };
-            if cli.verbose > 0 { eprintln!("Using validate token (len {}): {:.8}…", token_string.len(), token_string); }
             if let Some(v) = &resp.pkgrom_validate {
                 if v.is_empty() {
                     eprintln!("No allowed ROMs reported by server (Validate array empty). Proceeding may fail.");
                 }
             }
+            let cancel = install_cancel_handler(cli.cancel_file.as_deref())?;
             if (resp.pkgrom_erase == Some(1) || (cli_token_provided && wipe)) && !yes {
-                println!("NOTICE: Data will be erased during flashing. Press Enter to continue…");
-                let mut s = String::new();
-                let _ = std::io::stdin().read_line(&mut s);
+                confirm_data_wipe_supervised(cli.machine, cli.approval_file.as_deref(), &cancel)?;
             }
-            let allow_wipe = if cli_token_provided { wipe } else { resp.pkgrom_erase == Some(1) || wipe };
-            sideload_zip(&mut client, &path, cli.chunk_size, &token_string, allow_wipe).context("Sideload failed")?;
+            let allow_wipe = if cli_token_provided {
+                wipe
+            } else {
+                resp.pkgrom_erase == Some(1) || wipe
+            };
+            emit_status(cli.machine, "Flashing the validated recovery ROM");
+            run_sideload(
+                &mut client,
+                &path,
+                cli.chunk_size,
+                &token_string,
+                allow_wipe,
+                &cancel,
+                cli.machine,
+            )
+            .context("Sideload failed")?;
+            emit_completed(cli.machine, "Flash completed");
         }
-        Commands::FormatData => {
-            client.simple_command("format-data:").context("format-data:")?;
+        Commands::FormatData { yes } => {
+            if !yes {
+                confirm_data_wipe()?;
+            }
+            client
+                .simple_command("format-data:")
+                .context("format-data:")?;
             client.simple_command("reboot:").context("reboot:")?;
         }
         Commands::Reboot => {
@@ -398,11 +533,287 @@ fn main() -> Result<()> {
         }
     }
 
-    if cli.kill_adb_after {
-        let _ = util::adb_server::kill_adb_server(std::time::Duration::from_millis(500));
-        #[cfg(windows)]
-        { util::adb_server::kill_adb_process(); }
+    Ok(())
+}
+
+fn reset_control_file(path: Option<&Path>) -> Result<()> {
+    if let Some(path) = path {
+        match std::fs::remove_file(path) {
+            Ok(()) => {}
+            Err(error) if error.kind() == io::ErrorKind::NotFound => {}
+            Err(error) => {
+                return Err(error)
+                    .with_context(|| format!("Resetting control file {}", path.display()));
+            }
+        }
+    }
+    Ok(())
+}
+
+fn emit_machine_event(event: serde_json::Value) {
+    println!("{event}");
+    io::stdout().flush().ok();
+}
+
+fn emit_status(machine: bool, message: &str) {
+    if machine {
+        emit_machine_event(serde_json::json!({
+            "event": "status",
+            "message": message
+        }));
+    }
+}
+
+fn emit_completed(machine: bool, message: &str) {
+    if machine {
+        emit_machine_event(serde_json::json!({
+            "event": "completed",
+            "message": message
+        }));
+    }
+}
+
+fn confirm_data_wipe_supervised(
+    machine: bool,
+    approval_file: Option<&Path>,
+    cancel: &AtomicBool,
+) -> Result<()> {
+    if !machine {
+        return confirm_data_wipe();
+    }
+    let approval_file = approval_file.ok_or_else(|| {
+        anyhow::anyhow!("A supervising application must provide --approval-file for a data wipe")
+    })?;
+    emit_machine_event(serde_json::json!({
+        "event": "confirmation_required",
+        "kind": "data_wipe",
+        "message": "Xiaomi requires this flash to permanently erase user data."
+    }));
+    loop {
+        if cancel.load(Ordering::Relaxed) {
+            bail!("Data wipe was not approved");
+        }
+        if approval_file.exists() {
+            let _ = std::fs::remove_file(approval_file);
+            return Ok(());
+        }
+        std::thread::sleep(Duration::from_millis(100));
     }
+}
 
+#[allow(clippy::too_many_arguments)]
+fn run_sideload(
+    client: &mut MiClient,
+    path: &Path,
+    chunk_size: usize,
+    token: &str,
+    allow_wipe: bool,
+    cancel: &AtomicBool,
+    machine: bool,
+) -> Result<()> {
+    if machine {
+        sideload_zip_with_progress(
+            client,
+            path,
+            chunk_size,
+            token,
+            allow_wipe,
+            cancel,
+            |current, total| {
+                emit_machine_event(serde_json::json!({
+                    "event": "progress",
+                    "current": current,
+                    "total": total
+                }));
+            },
+        )
+    } else {
+        sideload_zip(client, path, chunk_size, token, allow_wipe, cancel)
+    }
+}
+
+fn confirm_data_wipe() -> Result<()> {
+    if !io::stdin().is_terminal() {
+        bail!("data wipe requires an interactive terminal; pass --yes to confirm in automation");
+    }
+    eprintln!("WARNING: This operation will permanently erase user data.");
+    eprint!("Type ERASE to continue: ");
+    io::stderr().flush().ok();
+    let mut answer = String::new();
+    io::stdin().read_line(&mut answer)?;
+    if answer.trim() != "ERASE" {
+        bail!("data wipe cancelled");
+    }
     Ok(())
 }
+
+fn install_cancel_handler(cancel_file: Option<&Path>) -> Result<Arc<AtomicBool>> {
+    let cancel = Arc::new(AtomicBool::new(false));
+    let handler_flag = Arc::clone(&cancel);
+    ctrlc::set_handler(move || {
+        handler_flag.store(true, Ordering::Relaxed);
+        eprintln!("\nCancellation requested; closing after the current USB operation...");
+    })
+    .context("Installing Ctrl-C handler")?;
+    if let Some(path) = cancel_file {
+        let path = path.to_path_buf();
+        let file_flag = Arc::clone(&cancel);
+        std::thread::spawn(move || loop {
+            if path.exists() {
+                file_flag.store(true, Ordering::Relaxed);
+                break;
+            }
+            std::thread::sleep(Duration::from_millis(100));
+        });
+    }
+    Ok(cancel)
+}
+
+fn print_usb_device(device: &sensitivity::usb::UsbDeviceInfo) {
+    println!(
+        "  [{}] {:04x}:{:04x} bus {} address {} interface {} endpoints 0x{:02x}/0x{:02x}",
+        device.index,
+        device.vendor_id,
+        device.product_id,
+        device.bus,
+        device.address,
+        device.interface,
+        device.endpoint_in,
+        device.endpoint_out
+    );
+}
+
+fn adb_may_own_interface(error: &anyhow::Error) -> bool {
+    let message = format!("{error:#}");
+    message.contains("Claiming interface") || message.contains("Opening USB device")
+}
+
+struct IdentityOptions {
+    profile: Option<RegionProfile>,
+    codename: Option<String>,
+    device: Option<String>,
+    version: Option<String>,
+    serial: Option<String>,
+    codebase: Option<String>,
+    branch: Option<String>,
+    romzone: Option<String>,
+}
+
+impl From<&Cli> for IdentityOptions {
+    fn from(cli: &Cli) -> Self {
+        Self {
+            profile: cli.profile,
+            codename: cli.codename.clone(),
+            device: cli.override_device.clone(),
+            version: cli.override_version.clone(),
+            serial: cli.override_sn.clone(),
+            codebase: cli.override_codebase.clone(),
+            branch: cli.override_branch.clone(),
+            romzone: cli.override_romzone.clone(),
+        }
+    }
+}
+
+fn effective_device_info(options: &IdentityOptions, mut info: DeviceInfo) -> Result<DeviceInfo> {
+    if let Some(profile) = options.profile {
+        info = apply_profile(&info, profile, options.codename.as_deref())?;
+        eprintln!("Applied profile: {profile:?}");
+    }
+    if let Some(value) = &options.device {
+        info.device = value.clone();
+    }
+    if let Some(value) = &options.version {
+        info.version = value.clone();
+    }
+    if let Some(value) = &options.serial {
+        info.sn = value.clone();
+    }
+    if let Some(value) = &options.codebase {
+        info.codebase = value.clone();
+    }
+    if let Some(value) = &options.branch {
+        info.branch = value.clone();
+    }
+    if let Some(value) = &options.romzone {
+        info.romzone = value.clone();
+    }
+    Ok(info)
+}
+
+#[cfg(test)]
+mod cli_tests {
+    use super::*;
+
+    #[test]
+    fn adb_is_preserved_by_default() {
+        let cli = Cli::try_parse_from(["sensitivity", "detect"]).unwrap();
+        assert_eq!(cli.adb_policy, AdbPolicy::Keep);
+    }
+
+    #[test]
+    fn explicit_stop_policy_parses() {
+        let cli = Cli::try_parse_from(["sensitivity", "--adb-policy", "stop", "doctor"]).unwrap();
+        assert_eq!(cli.adb_policy, AdbPolicy::Stop);
+    }
+
+    #[test]
+    fn read_info_compatibility_alias_parses() {
+        let cli = Cli::try_parse_from(["sensitivity", "read-info", "--json"]).unwrap();
+        assert!(matches!(cli.command, Commands::Info { json: true }));
+    }
+
+    #[test]
+    fn completion_shell_parses_without_usb_options() {
+        let cli = Cli::try_parse_from(["sensitivity", "completions", "bash"]).unwrap();
+        assert!(matches!(
+            cli.command,
+            Commands::Completions { shell: Shell::Bash }
+        ));
+    }
+
+    #[test]
+    fn adb_hint_is_only_used_for_usb_ownership_errors() {
+        assert!(adb_may_own_interface(&anyhow::anyhow!(
+            "Claiming interface 1"
+        )));
+        assert!(!adb_may_own_interface(&anyhow::anyhow!(
+            "No Mi Assistant ADB interface found"
+        )));
+    }
+
+    #[test]
+    fn machine_supervision_options_parse() {
+        let cli = Cli::try_parse_from([
+            "sensitivity",
+            "--machine",
+            "--cancel-file",
+            "cancel.flag",
+            "--approval-file",
+            "approve.flag",
+            "flash",
+            "rom.zip",
+        ])
+        .unwrap();
+        assert!(cli.machine);
+        assert_eq!(cli.cancel_file, Some(PathBuf::from("cancel.flag")));
+        assert_eq!(cli.approval_file, Some(PathBuf::from("approve.flag")));
+    }
+
+    #[test]
+    fn supervised_wipe_requires_an_approval_path() {
+        let cancel = AtomicBool::new(true);
+        assert!(confirm_data_wipe_supervised(true, None, &cancel).is_err());
+    }
+
+    #[test]
+    fn supervised_wipe_consumes_the_approval_file() {
+        let directory = tempfile::tempdir().unwrap();
+        let approval = directory.path().join("approve");
+        std::fs::write(&approval, []).unwrap();
+        let cancel = AtomicBool::new(false);
+
+        confirm_data_wipe_supervised(true, Some(&approval), &cancel).unwrap();
+
+        assert!(!approval.exists());
+    }
+}
diff --git a/src/mi/mod.rs b/src/mi/mod.rs
index 17d8682..c3345f7 100644
--- a/src/mi/mod.rs
+++ b/src/mi/mod.rs
@@ -8,7 +8,7 @@ use crate::adb::{connect, AdbConnection};
 use crate::usb::UsbTransport;
 pub mod profile;
 
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, serde::Serialize)]
 pub struct DeviceInfo {
     pub device: String,
     pub sn: String,
@@ -39,25 +39,38 @@ impl MiClient {
         let language = self.simple_query("getlanguage:")?;
         let region = self.simple_query("getregion:")?;
         let romzone = self.simple_query("getromzone:")?;
-        Ok(DeviceInfo { device, sn, version, codebase, branch, language, region, romzone })
+        Ok(DeviceInfo {
+            device,
+            sn,
+            version,
+            codebase,
+            branch,
+            language,
+            region,
+            romzone,
+        })
     }
 
     pub fn simple_query(&mut self, cmd: &str) -> Result<String> {
-        let text = self.adb.query_text(cmd).with_context(|| format!("query_text {}", cmd))?;
+        let text = self
+            .adb
+            .query_text(cmd)
+            .with_context(|| format!("query_text {}", cmd))?;
         Ok(text)
     }
 
     pub fn simple_command(&mut self, cmd: &str) -> Result<()> {
         let mut s = self.adb.open_service(cmd)?;
+        // Reboot and format-data can deliberately drop USB before CLSE. A
+        // successfully opened service is the recovery's acknowledgement.
         let _ = s.read_to_end();
         Ok(())
     }
 
-    pub fn open_service(&mut self, name: &str) -> Result<crate::adb::AdbStream<'_>> {
-        self.adb.open_service(name)
-    }
-
-    pub fn open_sideload(&mut self, name: &str) -> Result<(crate::adb::AdbStream<'_>, Option<crate::adb::AdbPacket>)> {
+    pub fn open_sideload(
+        &mut self,
+        name: &str,
+    ) -> Result<(crate::adb::AdbStream<'_>, Option<crate::adb::AdbPacket>)> {
         self.adb.open_sideload(name)
     }
 }
diff --git a/src/mi/profile.rs b/src/mi/profile.rs
index e80e01c..162f71a 100644
--- a/src/mi/profile.rs
+++ b/src/mi/profile.rs
@@ -2,37 +2,31 @@
 // Licensed under the GNU AGPL v3.0. See LICENSE file for details.
 // Website: https://hasx.dev
 
-use anyhow::Result;
+use anyhow::{bail, Result};
 
 use crate::mi::DeviceInfo;
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, clap::ValueEnum)]
 pub enum RegionProfile {
+    #[value(alias = "mi")]
     Global,
+    #[value(alias = "eu")]
     Eea,
+    #[value(alias = "india")]
     In,
+    #[value(alias = "russia")]
     Ru,
+    #[value(alias = "indo", alias = "indonesia")]
     Id,
+    #[value(alias = "turkey")]
     Tr,
+    #[value(alias = "taiwan")]
     Tw,
+    #[value(alias = "china")]
     Cn,
 }
 
 impl RegionProfile {
-    pub fn from_str(s: &str) -> Option<Self> {
-        match s.to_ascii_lowercase().as_str() {
-            "global" | "mi" => Some(Self::Global),
-            "eea" | "eu" => Some(Self::Eea),
-            "in" | "india" => Some(Self::In),
-            "ru" | "russia" => Some(Self::Ru),
-            "id" | "indo" | "indonesia" => Some(Self::Id),
-            "tr" | "turkey" => Some(Self::Tr),
-            "tw" | "taiwan" => Some(Self::Tw),
-            "cn" | "china" => Some(Self::Cn),
-            _ => None,
-        }
-    }
-
     fn device_name(&self, codename: &str) -> String {
         match self {
             RegionProfile::Global => format!("{}_global", codename),
@@ -78,17 +72,70 @@ fn replace_version_region_suffix(version: &str, new_suffix: &str) -> String {
     version.to_string()
 }
 
-pub fn apply_profile(info: &DeviceInfo, profile: RegionProfile, codename_override: Option<&str>, keep_codebase: bool) -> Result<DeviceInfo> {
-    let codename = codename_override.map(|s| s.to_string()).unwrap_or_else(|| derive_codename(&info.device));
+pub fn apply_profile(
+    info: &DeviceInfo,
+    profile: RegionProfile,
+    codename_override: Option<&str>,
+) -> Result<DeviceInfo> {
+    let codename = codename_override
+        .map(|s| s.to_string())
+        .unwrap_or_else(|| derive_codename(&info.device));
+    if codename.is_empty()
+        || !codename.chars().all(|character| {
+            character.is_ascii_alphanumeric() || character == '_' || character == '-'
+        })
+    {
+        bail!("invalid device codename: {codename:?}");
+    }
     let device = profile.device_name(&codename);
     let version = replace_version_region_suffix(&info.version, profile.version_suffix());
     let mut out = info.clone();
     out.device = device;
     out.version = version;
     out.branch = "F".to_string();
-    if !keep_codebase {
-        out.codebase = info.codebase.clone(); // keep by default; explicit override controls codebase
-    }
     Ok(out)
 }
 
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn device_info() -> DeviceInfo {
+        DeviceInfo {
+            device: "garnet_in_global".into(),
+            sn: "serial".into(),
+            version: "OS2.0.202.0.VNRINXM".into(),
+            codebase: "15.0".into(),
+            branch: "original".into(),
+            language: "en".into(),
+            region: "IN".into(),
+            romzone: "1".into(),
+        }
+    }
+
+    #[test]
+    fn global_profile_changes_only_expected_identity_fields() {
+        let original = device_info();
+        let changed = apply_profile(&original, RegionProfile::Global, None).unwrap();
+
+        assert_eq!(changed.device, "garnet_global");
+        assert_eq!(changed.version, "OS2.0.202.0.VNRMIXM");
+        assert_eq!(changed.branch, "F");
+        assert_eq!(changed.sn, original.sn);
+        assert_eq!(changed.codebase, original.codebase);
+        assert_eq!(changed.romzone, original.romzone);
+    }
+
+    #[test]
+    fn explicit_codename_is_used_for_region_profile() {
+        let changed = apply_profile(&device_info(), RegionProfile::Eea, Some("ruby")).unwrap();
+        assert_eq!(changed.device, "ruby_eea_global");
+        assert!(changed.version.ends_with("EUXM"));
+    }
+
+    #[test]
+    fn unsafe_or_empty_codename_is_rejected() {
+        assert!(apply_profile(&device_info(), RegionProfile::Global, Some("")).is_err());
+        assert!(apply_profile(&device_info(), RegionProfile::Global, Some("bad value")).is_err());
+    }
+}
diff --git a/src/sideload.rs b/src/sideload.rs
index 7cee999..2a4b796 100644
--- a/src/sideload.rs
+++ b/src/sideload.rs
@@ -5,6 +5,7 @@
 use std::fs::File;
 use std::io::{BufReader, Read, Seek, SeekFrom};
 use std::path::Path;
+use std::sync::atomic::{AtomicBool, Ordering};
 
 use anyhow::{bail, Context, Result};
 use indicatif::{ProgressBar, ProgressStyle};
@@ -12,76 +13,149 @@ use indicatif::{ProgressBar, ProgressStyle};
 use crate::adb::{AdbStream, A_CLSE, A_OKAY, A_WRTE};
 use crate::mi::MiClient;
 
+fn block_window(total: u64, chunk_size: usize, index: u64) -> Option<(u64, usize)> {
+    let offset = index.checked_mul(chunk_size as u64)?;
+    if offset >= total {
+        return None;
+    }
+    let length = std::cmp::min(chunk_size as u64, total - offset) as usize;
+    Some((offset, length))
+}
+
+fn sideload_host_service(
+    total: u64,
+    chunk_size: usize,
+    validate_token: &str,
+    allow_wipe: bool,
+) -> Result<String> {
+    if validate_token.is_empty()
+        || validate_token.contains(':')
+        || !validate_token
+            .chars()
+            .all(|character| character.is_ascii_graphic())
+    {
+        bail!("Validation token contains invalid protocol characters");
+    }
+    // The final field is strictly the wipe flag. It is not a resume offset.
+    Ok(format!(
+        "sideload-host:{total}:{chunk_size}:{validate_token}:{}",
+        u8::from(allow_wipe)
+    ))
+}
+
 pub fn sideload_zip(
     client: &mut MiClient,
     path: &Path,
     chunk_size: usize,
     validate_token: &str,
     allow_wipe: bool,
+    cancel: &AtomicBool,
 ) -> Result<()> {
+    let total = std::fs::metadata(path)
+        .with_context(|| format!("Reading {}", path.display()))?
+        .len();
+    let progress_bar = ProgressBar::new(total);
+    progress_bar.set_style(
+        ProgressStyle::default_bar()
+            .template(
+                "{spinner:.green} [{elapsed_precise}] [{bar:40.cyan/blue}] {bytes}/{total_bytes} ({percent}%)",
+            )
+            .unwrap()
+            .progress_chars("=>-"),
+    );
+    let result = sideload_zip_with_progress(
+        client,
+        path,
+        chunk_size,
+        validate_token,
+        allow_wipe,
+        cancel,
+        |sent, _| progress_bar.set_position(sent),
+    );
+    if cancel.load(Ordering::Relaxed) {
+        progress_bar.abandon_with_message("Cancelled");
+    } else {
+        progress_bar.finish_and_clear();
+    }
+    result
+}
+
+pub fn sideload_zip_with_progress<F>(
+    client: &mut MiClient,
+    path: &Path,
+    chunk_size: usize,
+    validate_token: &str,
+    allow_wipe: bool,
+    cancel: &AtomicBool,
+    mut progress: F,
+) -> Result<()>
+where
+    F: FnMut(u64, u64),
+{
     let file = File::open(path).with_context(|| format!("Opening {}", path.display()))?;
     let total = file.metadata()?.len();
+    if total == 0 {
+        bail!("ROM package is empty: {}", path.display());
+    }
     if chunk_size == 0 || chunk_size > 1024 * 1024 {
         bail!("Invalid chunk size: {}", chunk_size);
     }
 
     // The last field is the wipe flag. Some cross-region updates require data wipe.
     // When server indicates Erase==1, we must send ":1"; otherwise ":0" will make recovery abort.
-    let host_str = format!(
-        "sideload-host:{}:{}:{}:{}",
-        total,
-        chunk_size,
-        validate_token,
-        if allow_wipe { 1 } else { 0 }
-    );
-    let (mut stream, pending) = client.open_sideload(&host_str).context("Opening sideload-host service")?;
+    let host_str = sideload_host_service(total, chunk_size, validate_token, allow_wipe)?;
+    let (mut stream, pending) = client
+        .open_sideload(&host_str)
+        .context("Opening sideload-host service")?;
     // Give the device more time between requests during sideload
     // (some recoveries take >5s before first WRTE)
     stream.set_timeout(std::time::Duration::from_secs(30));
 
-    let pb = ProgressBar::new(total);
-    pb.set_style(ProgressStyle::default_bar()
-        .template("{spinner:.green} [{elapsed_precise}] [{bar:40.cyan/blue}] {bytes}/{total_bytes} ({percent}%)")
-        .unwrap()
-        .progress_chars("=>-"));
+    progress(0, total);
 
     let mut reader = BufReader::new(file);
-    let mut send_block = |index: u64, s: &mut AdbStream<'_>, pkt_arg0: u32, pkt_arg1: u32| -> Result<usize> {
-        let offset = index * (chunk_size as u64);
-        if offset >= total {
-            // Always acknowledge the device's WRTE, even if there's no more data.
-            // Some recoveries request one extra block to signal completion.
+    let mut send_block =
+        |index: u64, s: &mut AdbStream<'_>, pkt_arg0: u32, pkt_arg1: u32| -> Result<u64> {
+            let Some((offset, to_send)) = block_window(total, chunk_size, index) else {
+                // Always acknowledge the device's WRTE, even if there's no more data.
+                // Some recoveries request one extra block to signal completion.
+                s.send_okay_mirror(pkt_arg0, pkt_arg1)?;
+                return Ok(total);
+            };
+            let mut buf = vec![0u8; to_send];
+            reader.seek(SeekFrom::Start(offset))?;
+            reader.read_exact(&mut buf)?;
+            // C tool: send WRTE(arg1,arg0) with data, then OKAY(arg1,arg0)
+            s.send_wrte_mirror(pkt_arg0, pkt_arg1, buf)?;
             s.send_okay_mirror(pkt_arg0, pkt_arg1)?;
-            return Ok(0);
-        }
-        let to_send = std::cmp::min(chunk_size as u64, total - offset) as usize;
-        let mut buf = vec![0u8; to_send];
-        reader.seek(SeekFrom::Start(offset))?;
-        reader.read_exact(&mut buf)?;
-        // C tool: send WRTE(arg1,arg0) with data, then OKAY(arg1,arg0)
-        s.send_wrte_mirror(pkt_arg0, pkt_arg1, buf)?;
-        s.send_okay_mirror(pkt_arg0, pkt_arg1)?;
-        pb.inc(to_send as u64);
-        Ok(to_send)
-    };
+            let end = offset + to_send as u64;
+            progress(end, total);
+            Ok(end)
+        };
 
     // Protocol: device sends OKAY/WRTE cycles. For WRTE, payload is ASCII block index. We mirror OKAYs and for WRTE we send the requested chunk + OKAY.
-    let mut finished = false;
     let mut bytes_sent: u64 = 0;
     let mut final_status: Option<String> = None;
     // Handle pending first packet if WRTE arrived during open
     if let Some(pkt) = pending {
+        if cancel.load(Ordering::Relaxed) {
+            let _ = stream.close();
+            bail!("Sideload cancelled by user");
+        }
         if pkt.cmd == A_WRTE {
             if let Ok(idx) = String::from_utf8_lossy(&pkt.payload).trim().parse::<u64>() {
-                let n = send_block(idx, &mut stream, pkt.arg0, pkt.arg1)?;
-                if n == 0 { finished = true; }
-                bytes_sent = std::cmp::min(total, (idx * chunk_size as u64) + (n as u64));
+                let end = send_block(idx, &mut stream, pkt.arg0, pkt.arg1)?;
+                bytes_sent = bytes_sent.max(end);
             }
         } else if pkt.cmd == A_OKAY {
             stream.send_okay_mirror(pkt.arg0, pkt.arg1)?;
         }
     }
     loop {
+        if cancel.load(Ordering::Relaxed) {
+            let _ = stream.close();
+            bail!("Sideload cancelled by user");
+        }
         // Read next packet; if the device disconnected after sending final status,
         // treat it as end-of-session instead of surfacing a transport error.
         let pkt = match stream.recv_raw() {
@@ -105,9 +179,8 @@ pub fn sideload_zip(
                 let text = String::from_utf8_lossy(&pkt.payload);
                 let trimmed = text.trim();
                 if let Ok(idx) = trimmed.parse::<u64>() {
-                    let n = send_block(idx, &mut stream, pkt.arg0, pkt.arg1)?;
-                    if n == 0 { finished = true; }
-                    bytes_sent = std::cmp::min(total, (idx * chunk_size as u64) + (n as u64));
+                    let end = send_block(idx, &mut stream, pkt.arg0, pkt.arg1)?;
+                    bytes_sent = bytes_sent.max(end);
                 } else {
                     // Treat as final status message. Ack it, record, and proactively end the session.
                     final_status = Some(trimmed.to_string());
@@ -127,20 +200,59 @@ pub fn sideload_zip(
         // Do not break immediately on finished; recovery will send a final status and then close.
     }
 
-    pb.finish_and_clear();
     // If device hasn’t closed yet, attempt to explicitly close the sideload stream
     let _ = stream.close();
     std::thread::sleep(std::time::Duration::from_millis(100));
     if bytes_sent < total {
-        eprintln!("Warning: sent {} of {} bytes", bytes_sent, total);
+        bail!("Sideload ended after {bytes_sent} of {total} bytes");
     }
     // Evaluate final status message (if any) and treat failures as errors.
     if let Some(status) = final_status.as_deref() {
         let s = status.to_ascii_lowercase();
         // Conservative failure heuristics: common stock recovery texts
-        if s.contains("aborted") || s.contains("failed") || s.contains("failure") || s.contains("error") {
+        if s.contains("aborted")
+            || s.contains("failed")
+            || s.contains("failure")
+            || s.contains("error")
+        {
             bail!("Sideload reported failure: {}", status);
         }
     }
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn block_window_handles_full_and_partial_blocks() {
+        assert_eq!(block_window(10, 4, 0), Some((0, 4)));
+        assert_eq!(block_window(10, 4, 1), Some((4, 4)));
+        assert_eq!(block_window(10, 4, 2), Some((8, 2)));
+        assert_eq!(block_window(10, 4, 3), None);
+    }
+
+    #[test]
+    fn absurd_block_index_cannot_overflow_offset() {
+        assert_eq!(block_window(10, 64 * 1024, u64::MAX), None);
+    }
+
+    #[test]
+    fn final_host_field_is_only_the_wipe_flag() {
+        assert_eq!(
+            sideload_host_service(123, 65_536, "token+/=", false).unwrap(),
+            "sideload-host:123:65536:token+/=:0"
+        );
+        assert_eq!(
+            sideload_host_service(123, 65_536, "token+/=", true).unwrap(),
+            "sideload-host:123:65536:token+/=:1"
+        );
+    }
+
+    #[test]
+    fn protocol_delimiters_are_rejected_in_tokens() {
+        assert!(sideload_host_service(123, 65_536, "bad:token", false).is_err());
+        assert!(sideload_host_service(123, 65_536, "", false).is_err());
+    }
+}
diff --git a/src/usb/mod.rs b/src/usb/mod.rs
index 89cd62c..509c029 100644
--- a/src/usb/mod.rs
+++ b/src/usb/mod.rs
@@ -14,64 +14,138 @@ pub struct UsbTransport {
     pub debug_usb: bool,
 }
 
-impl UsbTransport {
-    pub fn open(device_index: usize, debug_usb: bool) -> Result<Self> {
-        let ctx = rusb::Context::new().map_err(|e| {
-            let msg = format!("libusb initialization failed: {}", e);
-            #[cfg(windows)]
-            {
-                eprintln!("{}\nOn Windows, ensure libusb-1.0.dll is installed and the device uses WinUSB (Zadig).", msg);
-            }
-            anyhow::anyhow!(msg)
-        })?;
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct UsbDeviceInfo {
+    pub index: usize,
+    pub bus: u8,
+    pub address: u8,
+    pub vendor_id: u16,
+    pub product_id: u16,
+    pub interface: u8,
+    pub protocol: u8,
+    pub endpoint_in: u8,
+    pub endpoint_out: u8,
+}
+
+struct UsbCandidate {
+    device: rusb::Device<rusb::Context>,
+    info: UsbDeviceInfo,
+}
+
+fn usb_context() -> Result<rusb::Context> {
+    rusb::Context::new().map_err(|error| {
+        anyhow::anyhow!(
+            "libusb initialization failed: {error}. Check that USB support is installed"
+        )
+    })
+}
 
-        let mut matches: Vec<(rusb::Device<rusb::Context>, u8, u8, u8)> = Vec::new();
-        for device in ctx.devices().context("Listing USB devices")?.iter() {
-            // Use active configuration only (mirrors miasst.c)
-            let config = match device.active_config_descriptor() {
-                Ok(c) => c,
-                Err(_) => continue,
-            };
-            for iface in config.interfaces() {
-                for setting in iface.descriptors() {
-                    if setting.class_code() == 0xff
-                        && setting.sub_class_code() == 0x42
-                        && setting.protocol_code() == 0x01
-                    {
-                        let mut ep_in = None;
-                        let mut ep_out = None;
-                        for ep in setting.endpoint_descriptors() {
-                            let addr = ep.address();
-                            if ep.transfer_type() == rusb::TransferType::Bulk {
-                                if addr & 0x80 != 0 { ep_in = Some(addr); } else { ep_out = Some(addr); }
-                            }
-                        }
-                        if let (Some(_in), Some(_out)) = (ep_in, ep_out) {
-                            matches.push((device.clone(), setting.interface_number(), _in, _out));
-                        }
+fn discover_candidates(context: &rusb::Context) -> Result<Vec<UsbCandidate>> {
+    let mut exact_matches = Vec::new();
+    let mut compatible_matches = Vec::new();
+    for device in context.devices().context("Listing USB devices")?.iter() {
+        // Use active configuration only to preserve the working miasst.c behavior.
+        let config = match device.active_config_descriptor() {
+            Ok(configuration) => configuration,
+            Err(_) => continue,
+        };
+        let descriptor = device.device_descriptor().ok();
+        for interface in config.interfaces() {
+            for setting in interface.descriptors() {
+                if setting.class_code() != 0xff || setting.sub_class_code() != 0x42 {
+                    continue;
+                }
+                let mut endpoint_in = None;
+                let mut endpoint_out = None;
+                for endpoint in setting.endpoint_descriptors() {
+                    if endpoint.transfer_type() != rusb::TransferType::Bulk {
+                        continue;
+                    }
+                    if endpoint.address() & 0x80 != 0 {
+                        endpoint_in = Some(endpoint.address());
+                    } else {
+                        endpoint_out = Some(endpoint.address());
+                    }
+                }
+                if let (Some(endpoint_in), Some(endpoint_out)) = (endpoint_in, endpoint_out) {
+                    let candidate = UsbCandidate {
+                        device: device.clone(),
+                        info: UsbDeviceInfo {
+                            index: 0,
+                            bus: device.bus_number(),
+                            address: device.address(),
+                            vendor_id: descriptor.as_ref().map_or(0, |value| value.vendor_id()),
+                            product_id: descriptor.as_ref().map_or(0, |value| value.product_id()),
+                            interface: setting.interface_number(),
+                            protocol: setting.protocol_code(),
+                            endpoint_in,
+                            endpoint_out,
+                        },
+                    };
+                    if setting.protocol_code() == 0x01 {
+                        exact_matches.push(candidate);
+                    } else {
+                        compatible_matches.push(candidate);
                     }
                 }
             }
         }
+    }
+    // Stock recoveries normally expose protocol 1. Some releases report a
+    // different protocol byte despite speaking the same transport, so only
+    // fall back to those interfaces when no exact match exists.
+    let mut matches = if exact_matches.is_empty() {
+        compatible_matches
+    } else {
+        exact_matches
+    };
+    for (index, candidate) in matches.iter_mut().enumerate() {
+        candidate.info.index = index;
+    }
+    Ok(matches)
+}
+
+impl UsbTransport {
+    pub fn discover() -> Result<Vec<UsbDeviceInfo>> {
+        let context = usb_context()?;
+        Ok(discover_candidates(&context)?
+            .into_iter()
+            .map(|candidate| candidate.info)
+            .collect())
+    }
+
+    pub fn open(device_index: usize, debug_usb: bool) -> Result<Self> {
+        let context = usb_context()?;
+        let mut matches = discover_candidates(&context)?;
 
         if matches.is_empty() {
-            bail!("No Mi Assistant ADB interface found (class 0xff, subclass 0x42, protocol 1)");
+            bail!("No Mi Assistant ADB interface found (class 0xff, subclass 0x42)");
         }
         if device_index >= matches.len() {
-            bail!("Device index {} out of range ({} found)", device_index, matches.len());
+            bail!(
+                "Device index {} out of range ({} found)",
+                device_index,
+                matches.len()
+            );
         }
 
-        let (device, interface_number, ep_in, ep_out) = matches.remove(device_index);
-        let mut handle = device.open().context("Opening USB device")?;
+        let candidate = matches.remove(device_index);
+        let handle = candidate.device.open().context("Opening USB device")?;
 
         #[cfg(any(target_os = "linux", target_os = "android"))]
         {
             handle.set_auto_detach_kernel_driver(true).ok();
         }
         handle
-            .claim_interface(interface_number)
-            .with_context(|| format!("Claiming interface {}", interface_number))?;
-        Ok(UsbTransport { handle, ep_in, ep_out, timeout: Duration::from_millis(5000), debug_usb })
+            .claim_interface(candidate.info.interface)
+            .with_context(|| format!("Claiming interface {}", candidate.info.interface))?;
+        Ok(UsbTransport {
+            handle,
+            ep_in: candidate.info.endpoint_in,
+            ep_out: candidate.info.endpoint_out,
+            timeout: Duration::from_millis(5000),
+            debug_usb,
+        })
     }
 
     pub fn set_timeout(&mut self, dur: Duration) {
diff --git a/src/util/adb_server.rs b/src/util/adb_server.rs
index 1a0e35c..e94bd3a 100644
--- a/src/util/adb_server.rs
+++ b/src/util/adb_server.rs
@@ -4,8 +4,8 @@
 
 use anyhow::{Context, Result};
 use std::io::{Read, Write};
-use std::net::{Shutdown, TcpListener, TcpStream};
-use std::time::Duration;
+use std::net::{Shutdown, TcpStream};
+use std::time::{Duration, Instant};
 
 fn connect(port: u16, timeout: Duration) -> Result<TcpStream> {
     let addr = format!("127.0.0.1:{}", port);
@@ -30,10 +30,7 @@ fn read_status(stream: &mut TcpStream) -> Result<String> {
 }
 
 pub fn kill_adb_server(timeout: Duration) -> Result<()> {
-    let mut s = match connect(5037, timeout) {
-        Ok(s) => s,
-        Err(e) => return Err(e),
-    };
+    let mut s = connect(5037, timeout)?;
     // Try host:kill
     send_request(&mut s, "host:kill")?;
     // Read status; server may close immediately on success.
@@ -54,9 +51,21 @@ pub fn kill_adb_server(timeout: Duration) -> Result<()> {
         _ => {}
     }
     let _ = s.shutdown(Shutdown::Both);
+    wait_until_stopped(timeout)?;
     Ok(())
 }
 
+fn wait_until_stopped(timeout: Duration) -> Result<()> {
+    let deadline = Instant::now() + timeout;
+    while Instant::now() < deadline {
+        if !is_running(Duration::from_millis(100)) {
+            return Ok(());
+        }
+        std::thread::sleep(Duration::from_millis(50));
+    }
+    anyhow::bail!("ADB server did not release port 5037 within {timeout:?}")
+}
+
 pub fn is_running(timeout: Duration) -> bool {
     match connect(5037, timeout) {
         Ok(mut s) => {
@@ -66,27 +75,8 @@ pub fn is_running(timeout: Duration) -> bool {
                     return st == "OKAY" || st == "FAIL"; // both indicate a speaking server
                 }
             }
-            true
+            false
         }
         Err(_) => false,
     }
 }
-
-#[cfg(windows)]
-pub fn kill_adb_process() {
-    // Best-effort: use taskkill to terminate adb.exe if present
-    let _ = std::process::Command::new("taskkill")
-        .args(["/F", "/IM", "adb.exe", "/T"]) // force, by image name, include child processes
-        .stdout(std::process::Stdio::null())
-        .stderr(std::process::Stdio::null())
-        .status();
-}
-
-// Bind to 127.0.0.1:5037 to prevent adb server from reappearing during our session.
-// Return the listener so the caller can keep it alive (drop releases the port).
-pub fn block_port_5037() -> Option<TcpListener> {
-    match TcpListener::bind((std::net::Ipv4Addr::LOCALHOST, 5037)) {
-        Ok(l) => Some(l),
-        Err(_) => None,
-    }
-}
diff --git a/src/util/config.rs b/src/util/config.rs
deleted file mode 100644
index f7f7c5e..0000000
--- a/src/util/config.rs
+++ /dev/null
@@ -1,39 +0,0 @@
-// Copyright (C) 2025 HasX
-// Licensed under the GNU AGPL v3.0. See LICENSE file for details.
-// Website: https://hasx.dev
-
-use anyhow::{Context, Result};
-use serde::{Deserialize, Serialize};
-use std::fs;
-use std::path::PathBuf;
-
-#[derive(Debug, Default, Clone, Serialize, Deserialize)]
-pub struct State {
-    pub override_md5: Option<String>,
-}
-
-fn config_path() -> PathBuf {
-    if let Some(dir) = dirs_next::config_dir() {
-        return dir.join("sensitivity").join("state.json");
-    }
-    // Fallback to current directory
-    PathBuf::from(".sensitivity_state.json")
-}
-
-pub fn load_state() -> State {
-    let path = config_path();
-    if let Ok(bytes) = fs::read(&path) {
-        if let Ok(state) = serde_json::from_slice::<State>(&bytes) {
-            return state;
-        }
-    }
-    State::default()
-}
-
-pub fn save_state(state: &State) -> Result<()> {
-    let path = config_path();
-    if let Some(parent) = path.parent() { fs::create_dir_all(parent).ok(); }
-    let bytes = serde_json::to_vec_pretty(state)?;
-    fs::write(&path, bytes).with_context(|| format!("writing {}", path.display()))
-}
-
diff --git a/src/util/logging.rs b/src/util/logging.rs
deleted file mode 100644
index d0ad14a..0000000
--- a/src/util/logging.rs
+++ /dev/null
@@ -1,23 +0,0 @@
-// Copyright (C) 2025 HasX
-// Licensed under the GNU AGPL v3.0. See LICENSE file for details.
-// Website: https://hasx.dev
-
-#[derive(Copy, Clone, Debug)]
-pub enum LogVerbosity {
-    Normal,
-    Verbose,
-    Debug,
-}
-
-pub fn init_logger(verbosity: LogVerbosity) {
-    let level = match verbosity {
-        LogVerbosity::Normal => log::LevelFilter::Info,
-        LogVerbosity::Verbose => log::LevelFilter::Debug,
-        LogVerbosity::Debug => log::LevelFilter::Trace,
-    };
-    let _ = env_logger::Builder::from_default_env()
-        .filter_level(level)
-        .format_timestamp_millis()
-        .try_init();
-}
-
diff --git a/src/util/md5.rs b/src/util/md5.rs
index 58ba072..f8d4e62 100644
--- a/src/util/md5.rs
+++ b/src/util/md5.rs
@@ -38,4 +38,3 @@ mod tests {
         assert_eq!(got, "5eb63bbbe01eeed093cb22bb8f5acdc3");
     }
 }
-
diff --git a/src/util/mod.rs b/src/util/mod.rs
index b677737..938eb70 100644
--- a/src/util/mod.rs
+++ b/src/util/mod.rs
@@ -2,7 +2,5 @@
 // Licensed under the GNU AGPL v3.0. See LICENSE file for details.
 // Website: https://hasx.dev
 
-pub mod md5;
-pub mod logging;
 pub mod adb_server;
-pub mod config;
+pub mod md5;
diff --git a/src/validate.rs b/src/validate.rs
index 1f62687..41a184b 100644
--- a/src/validate.rs
+++ b/src/validate.rs
@@ -5,7 +5,6 @@
 use anyhow::{anyhow, bail, Context, Result};
 use base64::{engine::general_purpose, Engine as _};
 use cbc::cipher::{block_padding::Pkcs7, BlockDecryptMut, BlockEncryptMut, KeyIvInit};
-// (no-op)
 use reqwest::blocking::Client;
 use serde::Deserialize;
 use std::time::Duration;
@@ -15,30 +14,33 @@ use crate::mi::DeviceInfo;
 type Aes128CbcEnc = cbc::Encryptor<aes::Aes128>;
 type Aes128CbcDec = cbc::Decryptor<aes::Aes128>;
 
-// Hardcoded key/iv placeholders; replace with values from original C if needed.
-// AES-128-CBC key/iv as in original C (miasst.c)
+// AES-128-CBC key and IV used by Xiaomi's Mi Assistant validation protocol.
 const DEFAULT_KEY: [u8; 16] = [
-    0x6D, 0x69, 0x75, 0x69, 0x6F, 0x74, 0x61, 0x76,
-    0x61, 0x6C, 0x69, 0x64, 0x65, 0x64, 0x31, 0x31,
+    0x6D, 0x69, 0x75, 0x69, 0x6F, 0x74, 0x61, 0x76, 0x61, 0x6C, 0x69, 0x64, 0x65, 0x64, 0x31, 0x31,
 ];
 const DEFAULT_IV: [u8; 16] = [
-    0x30, 0x31, 0x30, 0x32, 0x30, 0x33, 0x30, 0x34,
-    0x30, 0x35, 0x30, 0x36, 0x30, 0x37, 0x30, 0x38,
+    0x30, 0x31, 0x30, 0x32, 0x30, 0x33, 0x30, 0x34, 0x30, 0x35, 0x30, 0x36, 0x30, 0x37, 0x30, 0x38,
 ];
 
 fn get_key_iv() -> ([u8; 16], [u8; 16]) {
     fn parse_hex_16(s: &str) -> Option<[u8; 16]> {
         let s = s.trim();
-        if s.len() != 32 { return None; }
+        if s.len() != 32 {
+            return None;
+        }
         let mut out = [0u8; 16];
         for i in 0..16 {
-            let byte = u8::from_str_radix(&s[i*2..i*2+2], 16).ok()?;
+            let byte = u8::from_str_radix(&s[i * 2..i * 2 + 2], 16).ok()?;
             out[i] = byte;
         }
         Some(out)
     }
-    let key = std::env::var("SENSITIVITY_AES_KEY").ok().and_then(|v| parse_hex_16(&v));
-    let iv = std::env::var("SENSITIVITY_AES_IV").ok().and_then(|v| parse_hex_16(&v));
+    let key = std::env::var("SENSITIVITY_AES_KEY")
+        .ok()
+        .and_then(|v| parse_hex_16(&v));
+    let iv = std::env::var("SENSITIVITY_AES_IV")
+        .ok()
+        .and_then(|v| parse_hex_16(&v));
     (key.unwrap_or(DEFAULT_KEY), iv.unwrap_or(DEFAULT_IV))
 }
 
@@ -48,12 +50,11 @@ pub struct ValidateResult {
     pub pkgrom_erase: Option<i32>,
     pub code_message: Option<String>,
     pub validate_token: Option<String>,
-    pub raw_plaintext_head: Option<String>,
     pub full_json: Option<String>,
 }
 
 pub fn build_request_json(info: &DeviceInfo, md5_opt: Option<String>) -> Result<String> {
-    let md5 = md5_opt.unwrap_or_else(|| "".to_string());
+    let md5 = md5_opt.unwrap_or_default();
     // Replicate C behavior exactly: inject romzone verbatim (may be non-numeric like F)
     let zone_field = info.romzone.trim().to_string();
     let esc = |s: &str| s.replace('"', "\\\"");
@@ -70,18 +71,13 @@ pub fn build_request_json(info: &DeviceInfo, md5_opt: Option<String>) -> Result<
     Ok(json)
 }
 
-// Expose encoder so CLI can print base64 `q` payload like forked C
-pub fn encode_request_b64(json_body: &str) -> Result<String> {
-    aes128_cbc_encrypt_b64(json_body.as_bytes())
-}
-
 fn aes128_cbc_encrypt_b64(plain: &[u8]) -> Result<String> {
     let (key, iv) = get_key_iv();
     let mut buf = plain.to_vec();
     // reserve space for padding to next multiple of block size
     let bs = 16;
     let pad_len = bs - (buf.len() % bs);
-    buf.extend(std::iter::repeat(0u8).take(pad_len));
+    buf.extend(std::iter::repeat_n(0u8, pad_len));
     let enc_slice = Aes128CbcEnc::new(&key.into(), &iv.into())
         .encrypt_padded_mut::<Pkcs7>(&mut buf, plain.len())?;
     let ciphertext = enc_slice.to_vec();
@@ -97,14 +93,22 @@ fn aes128_cbc_decrypt_b64(b64: &str) -> Result<Vec<u8>> {
     let mut buf = cipher.clone();
     let dec = Aes128CbcDec::new(&key.into(), &iv.into())
         .decrypt_padded_mut::<Pkcs7>(&mut buf)
-        .map_err(|e| anyhow!("AES-128-CBC decrypt failed: {} (cipher {} bytes)", e, cipher.len()))?;
+        .map_err(|e| {
+            anyhow!(
+                "AES-128-CBC decrypt failed: {} (cipher {} bytes)",
+                e,
+                cipher.len()
+            )
+        })?;
     Ok(dec.to_vec())
 }
 
 fn extract_json_braces(text: &str) -> Option<String> {
     let start = text.find('{')?;
     let end = text.rfind('}')?;
-    if end <= start { return None; }
+    if end <= start {
+        return None;
+    }
     Some(text[start..=end].to_string())
 }
 
@@ -117,87 +121,102 @@ enum ValidateField {
 
 #[derive(Debug, Deserialize)]
 struct ResponsePkgRom {
-    #[serde(default)]
-    Validate: Option<ValidateField>,
-    #[serde(default)]
-    Erase: Option<i32>,
-    #[serde(default)]
-    Token: Option<String>,
+    #[serde(default, rename = "Validate")]
+    validate: Option<ValidateField>,
+    #[serde(default, rename = "Erase")]
+    erase: Option<i32>,
+    #[serde(default, rename = "Token")]
+    token: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
-struct ResponseCode { #[serde(default)] message: String }
+struct ResponseCode {
+    #[serde(default)]
+    message: String,
+}
 
 #[derive(Debug, Deserialize)]
-struct ResponseRoot { #[serde(default)] PkgRom: Option<ResponsePkgRom>, #[serde(default)] Code: Option<ResponseCode> }
+struct ResponseRoot {
+    #[serde(default, rename = "PkgRom")]
+    pkg_rom: Option<ResponsePkgRom>,
+    #[serde(default, rename = "Code")]
+    code: Option<ResponseCode>,
+}
 
 pub fn validate(server_url: &str, json_body: &str) -> Result<ValidateResult> {
     let enc = aes128_cbc_encrypt_b64(json_body.as_bytes())?;
-    let form = [
-        ("q", enc.as_str()),
-        ("t", ""),
-        ("s", "1"),
-    ];
-    let client = Client::builder()
-        .timeout(Duration::from_secs(30))
-        .build()?;
+    let form = [("q", enc.as_str()), ("t", ""), ("s", "1")];
+    let client = Client::builder().timeout(Duration::from_secs(30)).build()?;
     let resp = client
         .post(server_url)
         .header("User-Agent", "MiTunes_UserAgent_v3.0")
         .form(&form)
         .send();
-    let resp = match resp { Ok(r) => r, Err(e) => bail!("HTTP request failed: {}", e) };
+    let resp = match resp {
+        Ok(r) => r,
+        Err(e) => bail!("HTTP request failed: {}", e),
+    };
     let status = resp.status();
     let text = resp.text().unwrap_or_default();
     if !status.is_success() {
         let head = text.bytes().take(200).collect::<Vec<_>>();
         let head_hex = hex::encode(&head);
-        bail!("Validation failed: HTTP {}. First {} bytes: {}", status.as_u16(), head.len(), head_hex);
+        bail!(
+            "Validation failed: HTTP {}. First {} bytes: {}",
+            status.as_u16(),
+            head.len(),
+            head_hex
+        );
     }
     if text.trim().is_empty() {
         bail!("Validation failed: empty response body");
     }
     let plain = aes128_cbc_decrypt_b64(&text).context("Decrypting server response")?;
     let preview = String::from_utf8_lossy(&plain);
-    let json_text = extract_json_braces(&preview).ok_or_else(|| anyhow!("No JSON object found in plaintext (len {})", plain.len()))?;
-    let root: ResponseRoot = serde_json::from_str(&json_text).context("Parsing JSON in server response")?;
+    let json_text = extract_json_braces(&preview)
+        .ok_or_else(|| anyhow!("No JSON object found in plaintext (len {})", plain.len()))?;
+    let root: ResponseRoot =
+        serde_json::from_str(&json_text).context("Parsing JSON in server response")?;
     let mut out = ValidateResult::default();
-    if let Some(pkg) = root.PkgRom {
-        if let Some(v) = pkg.Validate {
+    if let Some(pkg) = root.pkg_rom {
+        if let Some(v) = pkg.validate {
             match v {
                 ValidateField::Arr(list) => out.pkgrom_validate = Some(list),
                 ValidateField::Str(s) => out.validate_token = Some(s),
             }
         }
         if out.validate_token.is_none() {
-            if let Some(tok) = pkg.Token { out.validate_token = Some(tok); }
+            if let Some(tok) = pkg.token {
+                out.validate_token = Some(tok);
+            }
+        }
+        out.pkgrom_erase = pkg.erase;
+    }
+    if let Some(code) = root.code {
+        if !code.message.is_empty() {
+            out.code_message = Some(code.message);
         }
-        out.pkgrom_erase = pkg.Erase;
     }
-    if let Some(code) = root.Code { if !code.message.is_empty() { out.code_message = Some(code.message); } }
-    out.raw_plaintext_head = Some(preview.chars().take(200).collect());
     out.full_json = Some(json_text.clone());
     if out.pkgrom_validate.is_none() && out.code_message.is_none() {
         bail!(
-            "Validation response missing expected keys (PkgRom.Validate or Code.message). Plaintext length {}. Head: {}",
-            plain.len(),
-            out.raw_plaintext_head.clone().unwrap_or_default()
+            "Validation response missing expected keys (PkgRom.Validate or Code.message); decrypted payload was {} bytes",
+            plain.len()
         );
     }
     Ok(out)
 }
 
-pub fn print_allowed_with_options(res: &ValidateResult, dump_json: bool) {
-    if dump_json {
-        if let Some(j) = &res.full_json { println!("{}", j); return; }
-    }
+pub fn print_allowed(res: &ValidateResult) {
     // Prefer explicit allowed list (PkgRom.Validate)
     if let Some(list) = &res.pkgrom_validate {
         if list.is_empty() {
             println!("No allowed ROMs reported by server.");
         } else {
             println!("Allowed ROMs:");
-            for s in list { println!("- {}", s); }
+            for s in list {
+                println!("- {}", s);
+            }
         }
         return;
     }
@@ -213,7 +232,9 @@ pub fn print_allowed_with_options(res: &ValidateResult, dump_json: bool) {
                 }
                 let mut printed = false;
                 for (k, v) in obj {
-                    if k == "Icon" { continue; }
+                    if k == "Icon" {
+                        continue;
+                    }
                     if let Some(o) = v.as_object() {
                         let name = o.get("name").and_then(|x| x.as_str());
                         let md5 = o.get("md5").and_then(|x| x.as_str());
@@ -223,17 +244,21 @@ pub fn print_allowed_with_options(res: &ValidateResult, dump_json: bool) {
                         }
                     }
                 }
-                if printed { return; }
+                if printed {
+                    return;
+                }
             }
         }
     }
 
     // Last resort: print server message if any
-    if let Some(msg) = &res.code_message { println!("{}", msg); }
-    else { println!("Server did not include allowed ROM list."); }
+    if let Some(msg) = &res.code_message {
+        println!("{}", msg);
+    } else {
+        println!("Server did not include allowed ROM list.");
+    }
 }
 
-pub fn print_allowed(res: &ValidateResult) { print_allowed_with_options(res, false) }
 #[cfg(test)]
 mod tests {
     use super::*;