diff --git a/.bazelignore b/.bazelignore
deleted file mode 100644
index 92d46f3..0000000
--- a/.bazelignore
+++ /dev/null
@@ -1,10 +0,0 @@
-.build
-.derived-data
-.git
-.nscloud-cache
-Apple/build
-ci-artifacts
-dist
-publish
-release
-target
diff --git a/.bazelversion b/.bazelversion
deleted file mode 100644
index 47da986..0000000
--- a/.bazelversion
+++ /dev/null
@@ -1 +0,0 @@
-9.1.0
diff --git a/.cargo/config.toml b/.cargo/config.toml
index 767d03a..302ce48 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -1,3 +1,6 @@
+[target.'cfg(unix)']
+runner = "sudo -E"
+
 [alias] # command aliases
 rr = "run --release"
 bb = "build --release"
diff --git a/.forgejo/actions/decrypt-release-secrets/action.yml b/.forgejo/actions/decrypt-release-secrets/action.yml
deleted file mode 100644
index f9b8590..0000000
--- a/.forgejo/actions/decrypt-release-secrets/action.yml
+++ /dev/null
@@ -1,327 +0,0 @@
-name: Decrypt Release Secrets
-description: Decrypts age-sealed Burrow release secrets and exports CI paths/env.
-inputs:
-  root:
-    description: Repository root
-    required: false
-    default: .
-runs:
-  using: composite
-  steps:
-    - shell: bash
-      run: |
-        set -euo pipefail
-
-        ROOT_INPUT='${{ inputs.root }}'
-        ROOT="$(cd "$ROOT_INPUT" && pwd)"
-
-        resolve_nix_bin() {
-          local candidate
-          for candidate in \
-            "${NIX_BIN:-}" \
-            "$(command -v nix 2>/dev/null || true)" \
-            /nix/var/nix/profiles/default/bin/nix \
-            "${HOME:-}/.nix-profile/bin/nix" \
-            "${HOME:-}/.local/state/nix/profile/bin/nix" \
-            /Users/runner/.nix-profile/bin/nix \
-            /Users/runner/.local/state/nix/profile/bin/nix \
-            /home/runner/.nix-profile/bin/nix \
-            /home/runner/.local/state/nix/profile/bin/nix \
-            ; do
-            if [[ -n "$candidate" && -x "$candidate" ]]; then
-              printf '%s\n' "$candidate"
-              return 0
-            fi
-          done
-          return 1
-        }
-
-        resolve_decrypt_tool() {
-          local candidate
-          for candidate in \
-            "${AGE_BIN:-}" \
-            "$(command -v age 2>/dev/null || true)" \
-            /opt/homebrew/bin/age \
-            /usr/local/bin/age \
-            /usr/bin/age \
-            /run/current-system/sw/bin/age \
-            /etc/profiles/per-user/runner/bin/age \
-            "${HOME:-}/.nix-profile/bin/age" \
-            "${HOME:-}/.local/state/nix/profile/bin/age" \
-            /Users/runner/.nix-profile/bin/age \
-            /Users/runner/.local/state/nix/profile/bin/age \
-            /home/runner/.nix-profile/bin/age \
-            /home/runner/.local/state/nix/profile/bin/age \
-            ; do
-            if [[ -n "$candidate" && -x "$candidate" ]]; then
-              printf 'age:%s\n' "$candidate"
-              return 0
-            fi
-          done
-          for candidate in \
-            "${AGENIX_BIN:-}" \
-            "$(command -v agenix 2>/dev/null || true)" \
-            ; do
-            if [[ -n "$candidate" && -x "$candidate" ]]; then
-              printf 'agenix:%s\n' "$candidate"
-              return 0
-            fi
-          done
-          local nix_bin
-          nix_bin="$(resolve_nix_bin || true)"
-          if [[ -n "$nix_bin" ]]; then
-            local built
-            built="$("$nix_bin" --extra-experimental-features 'nix-command flakes' build --no-link "$ROOT#age" --print-out-paths 2>/dev/null | tail -n 1 || true)"
-            if [[ -n "$built" && -x "$built/bin/age" ]]; then
-              printf 'age:%s\n' "$built/bin/age"
-              return 0
-            fi
-            built="$("$nix_bin" --extra-experimental-features 'nix-command flakes' build --no-link "$ROOT#agenix" --print-out-paths 2>/dev/null | tail -n 1 || true)"
-            if [[ -n "$built" && -x "$built/bin/agenix" ]]; then
-              printf 'agenix:%s\n' "$built/bin/agenix"
-              return 0
-            fi
-          fi
-          echo "::error ::age or agenix is required to decrypt release secrets but neither is available." >&2
-          exit 1
-        }
-
-        decrypt_tool="$(resolve_decrypt_tool)"
-        decrypt_kind="${decrypt_tool%%:*}"
-        decrypt_bin="${decrypt_tool#*:}"
-        KEY="${AGE_IDENTITY_PATH:-}"
-        if [[ -z "$KEY" || ! -s "$KEY" ]]; then
-          echo "::error ::Missing age identity. Run Scripts/resolve-age-identity.sh before this action." >&2
-          exit 1
-        fi
-
-        decrypt_age_file() {
-          local file_path="$1"
-          if [[ "$decrypt_kind" == "agenix" ]]; then
-            local agenix_path="$file_path"
-            if [[ "$file_path" == "$ROOT/"* ]]; then
-              agenix_path="${file_path#"$ROOT"/}"
-            fi
-            (cd "$ROOT" && "$decrypt_bin" --identity "$KEY" --decrypt "$agenix_path")
-          else
-            "$decrypt_bin" --decrypt -i "$KEY" "$file_path"
-          fi
-        }
-
-        write_env() {
-          local name="$1"
-          local value="$2"
-          echo "${name}=${value}" >> "$GITHUB_ENV"
-        }
-
-        mask_multiline() {
-          local value="$1"
-          echo "::add-mask::${value}"
-          while IFS= read -r line; do
-            [[ -n "$line" ]] || continue
-            echo "::add-mask::${line}"
-          done <<<"$value"
-        }
-
-        decrypt_env_optional() {
-          local name="$1"
-          local file="$2"
-          if [[ ! -f "$file" ]]; then
-            echo "::notice ::Skipping optional release secret ${file}"
-            return 0
-          fi
-          local value
-          value="$(decrypt_age_file "$file")"
-          mask_multiline "$value"
-          {
-            echo "${name}<<EOF"
-            printf '%s\n' "$value"
-            echo "EOF"
-          } >> "$GITHUB_ENV"
-        }
-
-        decrypt_file_optional() {
-          local name="$1"
-          local file="$2"
-          local suffix="$3"
-          if [[ ! -f "$file" ]]; then
-            echo "::notice ::Skipping optional release secret ${file}"
-            return 0
-          fi
-          local temp_dir="${RUNNER_TEMP:-/tmp}"
-          local temp_file
-          temp_file="$(mktemp "${temp_dir}/${name}.XXXXXX")"
-          if [[ -n "$suffix" ]]; then
-            local with_suffix="${temp_file}.${suffix}"
-            mv "$temp_file" "$with_suffix"
-            temp_file="$with_suffix"
-          fi
-          decrypt_age_file "$file" > "$temp_file"
-          chmod 600 "$temp_file"
-          write_env "$name" "$temp_file"
-        }
-
-        decrypt_dotenv_optional() {
-          local file="$1"
-          if [[ ! -f "$file" ]]; then
-            echo "::notice ::Skipping optional release secret ${file}"
-            return 0
-          fi
-          local temp_file
-          temp_file="$(mktemp "${RUNNER_TEMP:-/tmp}/burrow-release-dotenv.XXXXXX")"
-          decrypt_age_file "$file" > "$temp_file"
-          # shellcheck disable=SC1090
-          set -a
-          source "$temp_file"
-          set +a
-          rm -f "$temp_file"
-
-          if [[ -z "${MINIO_ROOT_USER:-}" || -z "${MINIO_ROOT_PASSWORD:-}" ]]; then
-            echo "::error ::${file} must define MINIO_ROOT_USER and MINIO_ROOT_PASSWORD." >&2
-            exit 1
-          fi
-          echo "::add-mask::${MINIO_ROOT_USER}"
-          echo "::add-mask::${MINIO_ROOT_PASSWORD}"
-          {
-            echo "AWS_ACCESS_KEY_ID=${MINIO_ROOT_USER}"
-            echo "AWS_SECRET_ACCESS_KEY=${MINIO_ROOT_PASSWORD}"
-            echo "AWS_DEFAULT_REGION=${BLOB_REGION:-hel1}"
-            echo "AWS_REGION=${BLOB_REGION:-hel1}"
-            echo "AWS_S3_ENDPOINT_URL=https://${BLOB_ENDPOINT:-hel1.your-objectstorage.com}"
-          } >> "$GITHUB_ENV"
-        }
-
-        decode_base64_stream() {
-          if command -v base64 >/dev/null 2>&1; then
-            base64 -d 2>/dev/null || base64 -D
-          elif command -v openssl >/dev/null 2>&1; then
-            openssl base64 -d -A
-          else
-            echo "::error ::base64 or openssl is required to decode release secrets." >&2
-            return 127
-          fi
-        }
-
-        decode_base64_to_file() {
-          local output="$1"
-          decode_base64_stream > "$output"
-        }
-
-        decrypt_appstore_connect() {
-          local file="$ROOT/secrets/apple/appstore-connect.env.age"
-          if [[ ! -f "$file" ]]; then
-            echo "::notice ::Skipping optional release secret ${file}"
-            return 0
-          fi
-
-          local temp_file key_path key_value
-          temp_file="$(mktemp "${RUNNER_TEMP:-/tmp}/burrow-asc-env.XXXXXX")"
-          decrypt_age_file "$file" > "$temp_file"
-          # shellcheck disable=SC1090
-          set -a
-          source "$temp_file"
-          set +a
-          rm -f "$temp_file"
-
-          if [[ -z "${ASC_API_KEY_ID:-}" || -z "${ASC_API_ISSUER_ID:-}" ]]; then
-            echo "::error ::${file} must define ASC_API_KEY_ID and ASC_API_ISSUER_ID." >&2
-            exit 1
-          fi
-
-          key_path="$(mktemp "${RUNNER_TEMP:-/tmp}/burrow-asc-key.XXXXXX.p8")"
-          if [[ -n "${ASC_API_KEY_BASE64:-}" ]]; then
-            printf '%s' "$ASC_API_KEY_BASE64" | decode_base64_to_file "$key_path"
-          elif [[ -n "${ASC_API_KEY_P8_BASE64:-}" ]]; then
-            printf '%s' "$ASC_API_KEY_P8_BASE64" | decode_base64_to_file "$key_path"
-          elif [[ -n "${APPSTORE_KEY:-}" ]]; then
-            printf '%s\n' "$APPSTORE_KEY" > "$key_path"
-          elif [[ -n "${ASC_API_KEY:-}" ]]; then
-            printf '%s\n' "$ASC_API_KEY" > "$key_path"
-          else
-            echo "::error ::${file} must define ASC_API_KEY_BASE64 or ASC_API_KEY." >&2
-            exit 1
-          fi
-          chmod 600 "$key_path"
-          key_value="$(cat "$key_path")"
-          mask_multiline "$key_value"
-          echo "::add-mask::${ASC_API_KEY_ID}"
-          echo "::add-mask::${ASC_API_ISSUER_ID}"
-          write_env ASC_API_KEY_ID "$ASC_API_KEY_ID"
-          write_env ASC_API_ISSUER_ID "$ASC_API_ISSUER_ID"
-          write_env ASC_API_KEY_PATH "$key_path"
-        }
-
-        decrypt_distribution_signing() {
-          local file="$ROOT/secrets/apple/distribution-signing.env.age"
-          if [[ ! -f "$file" ]]; then
-            echo "::notice ::Skipping optional release secret ${file}"
-            return 0
-          fi
-
-          local temp_file cert_path cert_password cert_base64
-          temp_file="$(mktemp "${RUNNER_TEMP:-/tmp}/burrow-signing-env.XXXXXX")"
-          decrypt_age_file "$file" > "$temp_file"
-          # shellcheck disable=SC1090
-          set -a
-          source "$temp_file"
-          set +a
-          rm -f "$temp_file"
-
-          cert_base64="${APPLE_SIGNING_CERTIFICATE_BASE64:-${APPLE_DISTRIBUTION_CERTIFICATE_BASE64:-}}"
-          cert_password="${APPLE_SIGNING_CERTIFICATE_PASSWORD:-${APPLE_DISTRIBUTION_CERTIFICATE_PASSWORD:-}}"
-          if [[ -z "$cert_password" && -n "${APPLE_SIGNING_CERTIFICATE_PASSWORD_BASE64:-}" ]]; then
-            cert_password="$(printf '%s' "$APPLE_SIGNING_CERTIFICATE_PASSWORD_BASE64" | decode_base64_stream)"
-          fi
-          if [[ -z "$cert_base64" || -z "$cert_password" ]]; then
-            echo "::error ::${file} must define APPLE_SIGNING_CERTIFICATE_BASE64 and APPLE_SIGNING_CERTIFICATE_PASSWORD." >&2
-            exit 1
-          fi
-
-          cert_path="$(mktemp "${RUNNER_TEMP:-/tmp}/burrow-apple-signing.XXXXXX.p12")"
-          printf '%s' "$cert_base64" | decode_base64_to_file "$cert_path"
-          chmod 600 "$cert_path"
-          echo "::add-mask::${cert_password}"
-          write_env APPLE_SIGNING_CERTIFICATE_PATH "$cert_path"
-          write_env APPLE_SIGNING_CERTIFICATE_PASSWORD "$cert_password"
-          write_env APPLE_KEYCHAIN_PASSWORD "$cert_password"
-        }
-
-        decrypt_sparkle() {
-          local file="$ROOT/secrets/apple/sparkle.env.age"
-          if [[ ! -f "$file" ]]; then
-            echo "::notice ::Skipping optional release secret ${file}"
-            return 0
-          fi
-
-          local temp_file key_path key_base64 key_value
-          temp_file="$(mktemp "${RUNNER_TEMP:-/tmp}/burrow-sparkle-env.XXXXXX")"
-          decrypt_age_file "$file" > "$temp_file"
-          # shellcheck disable=SC1090
-          set -a
-          source "$temp_file"
-          set +a
-          rm -f "$temp_file"
-
-          key_base64="${SPARKLE_EDDSA_KEY_BASE64:-${SPARKLE_PRIVATE_KEY_BASE64:-}}"
-          key_path="$(mktemp "${RUNNER_TEMP:-/tmp}/burrow-sparkle-eddsa.XXXXXX.key")"
-          if [[ -n "$key_base64" ]]; then
-            printf '%s' "$key_base64" | decode_base64_to_file "$key_path"
-          elif [[ -n "${SPARKLE_EDDSA_KEY:-}" ]]; then
-            printf '%s\n' "$SPARKLE_EDDSA_KEY" > "$key_path"
-          elif [[ -n "${SPARKLE_PRIVATE_KEY:-}" ]]; then
-            printf '%s\n' "$SPARKLE_PRIVATE_KEY" > "$key_path"
-          else
-            echo "::error ::${file} must define SPARKLE_EDDSA_KEY_BASE64 or SPARKLE_EDDSA_KEY." >&2
-            exit 1
-          fi
-          chmod 600 "$key_path"
-          key_value="$(cat "$key_path")"
-          mask_multiline "$key_value"
-          write_env SPARKLE_EDDSA_KEY_PATH "$key_path"
-        }
-
-        decrypt_appstore_connect
-        decrypt_distribution_signing
-        decrypt_sparkle
-
-        decrypt_dotenv_optional "$ROOT/secrets/hetzner/object-storage.age"
diff --git a/.forgejo/workflows/apple-developer-id-kms-csr.yml b/.forgejo/workflows/apple-developer-id-kms-csr.yml
deleted file mode 100644
index 4c8901b..0000000
--- a/.forgejo/workflows/apple-developer-id-kms-csr.yml
+++ /dev/null
@@ -1,98 +0,0 @@
-name: "Apple: Developer ID KMS CSR"
-run-name: "Apple: Developer ID KMS CSR (${{ github.event.inputs.kms_key || 'apple-developer-id-application' }})"
-
-on:
-  workflow_dispatch:
-    inputs:
-      kms_key:
-        description: Google KMS key name in the Burrow identity key ring
-        required: false
-        default: apple-developer-id-application
-      kms_version:
-        description: Google KMS key version
-        required: false
-        default: "1"
-      common_name:
-        description: CSR common name
-        required: false
-        default: Burrow Developer ID Application
-      email_address:
-        description: CSR email address
-        required: false
-        default: release@burrow.net
-
-permissions:
-  contents: read
-
-concurrency:
-  group: apple-developer-id-kms-csr-${{ github.ref }}
-  cancel-in-progress: false
-
-env:
-  BURROW_GOOGLE_PROJECT_ID: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
-  GOOGLE_CLOUD_PROJECT: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
-  BURROW_GOOGLE_PROJECT_NUMBER: ${{ vars.GOOGLE_PROJECT_NUMBER || '416198671487' }}
-  BURROW_GOOGLE_WIF_POOL_ID: ${{ vars.BURROW_GOOGLE_WIF_POOL_ID || 'burrow-authentik' }}
-  BURROW_GOOGLE_WIF_PROVIDER_ID: ${{ vars.BURROW_GOOGLE_WIF_PROVIDER_ID || 'forgejo-runners' }}
-  BURROW_GOOGLE_WIF_SERVICE_ACCOUNT: ${{ vars.BURROW_GOOGLE_WIF_SERVICE_ACCOUNT || 'burrow-forgejo-runner@project-88c23ce9-918a-470a-b33.iam.gserviceaccount.com' }}
-  BURROW_AUTHENTIK_WIF_ISSUER: ${{ vars.BURROW_AUTHENTIK_WIF_ISSUER || 'https://auth.burrow.net/application/o/google-cloud/' }}
-  BURROW_AUTHENTIK_WIF_AUDIENCE: ${{ vars.BURROW_AUTHENTIK_WIF_AUDIENCE || 'google-wif.burrow.net' }}
-  BURROW_AUTHENTIK_WIF_CLIENT_ID: ${{ vars.BURROW_AUTHENTIK_WIF_CLIENT_ID || 'google-wif.burrow.net' }}
-  BURROW_AUTHENTIK_WIF_CLIENT_SECRET: ${{ secrets.BURROW_AUTHENTIK_WIF_CLIENT_SECRET }}
-  BURROW_KMS_LOCATION: global
-  BURROW_KMS_KEYRING: burrow-identity
-
-jobs:
-  csr:
-    name: Generate CSR
-    runs-on: [self-hosted, linux, x86_64, burrow-forge]
-    timeout-minutes: 20
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Ensure Nix
-        shell: bash
-        run: bash Scripts/ci/ensure-nix.sh
-
-      - name: Authenticate Google WIF
-        shell: bash
-        run: nix develop .#ci -c Scripts/ci/google-wif-auth.sh
-
-      - name: Generate KMS-backed CSR
-        shell: bash
-        env:
-          BURROW_APPLE_DEVELOPER_ID_KMS_KEY: ${{ github.event.inputs.kms_key || 'apple-developer-id-application' }}
-          BURROW_KMS_VERSION: ${{ github.event.inputs.kms_version || '1' }}
-          BURROW_APPLE_DEVELOPER_ID_CSR_COMMON_NAME: ${{ github.event.inputs.common_name || 'Burrow Developer ID Application' }}
-          BURROW_APPLE_DEVELOPER_ID_CSR_EMAIL: ${{ github.event.inputs.email_address || 'release@burrow.net' }}
-        run: |
-          set -euo pipefail
-          mkdir -p dist/apple-developer-id
-          nix develop .#ci -c Scripts/apple/google-kms-csr.py \
-            --output dist/apple-developer-id/developer-id-application.certSigningRequest \
-            --public-key-output dist/apple-developer-id/google-kms-public-key.pem
-          if command -v openssl >/dev/null 2>&1; then
-            openssl req -in dist/apple-developer-id/developer-id-application.certSigningRequest -noout -verify
-          fi
-          cat > dist/apple-developer-id/README.txt <<'EOF'
-          This CSR is backed by a non-exportable Google Cloud KMS key in the Burrow
-          identity key ring. Apple currently documents Developer ID certificate creation
-          through the Developer website or Xcode, not App Store Connect API creation.
-
-          Upload developer-id-application.certSigningRequest in:
-          Certificates, Identifiers & Profiles -> Certificates -> + -> Developer ID ->
-          Developer ID Application.
-
-          Keep the returned .cer file with release artifacts. The private key remains in
-          Google Cloud KMS and is never exported as a p12.
-          EOF
-
-      - name: Upload CSR Artifact
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
-        with:
-          name: burrow-developer-id-kms-csr
-          path: dist/apple-developer-id
diff --git a/.forgejo/workflows/apple-distribute-testers.yml b/.forgejo/workflows/apple-distribute-testers.yml
deleted file mode 100644
index f108237..0000000
--- a/.forgejo/workflows/apple-distribute-testers.yml
+++ /dev/null
@@ -1,530 +0,0 @@
-name: "Apple: Distribute Testers"
-run-name: "Apple: Distribute Testers (${{ github.ref_name }})"
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_number_override:
-        description: Optional explicit build number
-        required: false
-        default: ""
-      upload_app_store:
-        description: Upload iOS artifact to App Store Connect and TestFlight
-        required: false
-        default: "true"
-      upload_sparkle:
-        description: Publish Sparkle appcast and macOS artifact
-        required: false
-        default: "true"
-      sparkle_channel:
-        description: Sparkle channel, defaults to build-<number>
-        required: false
-        default: ""
-      sparkle_point_main:
-        description: Update Sparkle main channel pointers
-        required: false
-        default: "true"
-      testflight_distribute_external:
-        description: Distribute to external TestFlight groups
-        required: false
-        default: "false"
-      testflight_groups:
-        description: Optional comma-separated TestFlight groups
-        required: false
-        default: ""
-      ios_uses_non_exempt_encryption:
-        description: Set true only when the iOS build uses non-exempt encryption
-        required: false
-        default: "false"
-
-permissions:
-  actions: write
-  contents: read
-
-concurrency:
-  group: burrow-apple-distribute-testers-${{ github.ref }}
-  cancel-in-progress: true
-
-env:
-  BURROW_RELEASE_GCS_BUCKET: ${{ vars.BURROW_RELEASE_GCS_BUCKET || 'burrow-net-releases' }}
-  BURROW_RELEASE_GCS_BACKUP: ${{ vars.BURROW_RELEASE_GCS_BACKUP || 'true' }}
-  BURROW_RELEASE_GARAGE_BUCKET: ${{ vars.BURROW_RELEASE_GARAGE_BUCKET || 'burrow-releases' }}
-  BURROW_RELEASE_REQUIRE_GARAGE: ${{ vars.BURROW_RELEASE_REQUIRE_GARAGE || 'true' }}
-  BURROW_GARAGE_ENDPOINT: ${{ vars.BURROW_GARAGE_ENDPOINT || 'https://objects.burrow.net' }}
-  BURROW_GARAGE_REGION: ${{ vars.BURROW_GARAGE_REGION || 'garage' }}
-  AWS_ACCESS_KEY_ID: ${{ secrets.BURROW_GARAGE_ACCESS_KEY_ID }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets.BURROW_GARAGE_SECRET_ACCESS_KEY }}
-  BURROW_GOOGLE_PROJECT_ID: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
-  GOOGLE_CLOUD_PROJECT: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
-  BURROW_GOOGLE_PROJECT_NUMBER: ${{ vars.GOOGLE_PROJECT_NUMBER || '416198671487' }}
-  BURROW_GOOGLE_WIF_POOL_ID: ${{ vars.BURROW_GOOGLE_WIF_POOL_ID || 'burrow-authentik' }}
-  BURROW_GOOGLE_WIF_PROVIDER_ID: ${{ vars.BURROW_GOOGLE_WIF_PROVIDER_ID || 'forgejo-runners' }}
-  BURROW_GOOGLE_WIF_SERVICE_ACCOUNT: ${{ vars.BURROW_GOOGLE_WIF_SERVICE_ACCOUNT || 'burrow-forgejo-runner@project-88c23ce9-918a-470a-b33.iam.gserviceaccount.com' }}
-  BURROW_AUTHENTIK_WIF_ISSUER: ${{ vars.BURROW_AUTHENTIK_WIF_ISSUER || 'https://auth.burrow.net/application/o/google-cloud/' }}
-  BURROW_AUTHENTIK_WIF_AUDIENCE: ${{ vars.BURROW_AUTHENTIK_WIF_AUDIENCE || 'google-wif.burrow.net' }}
-  BURROW_AUTHENTIK_WIF_CLIENT_ID: ${{ vars.BURROW_AUTHENTIK_WIF_CLIENT_ID || 'google-wif.burrow.net' }}
-  BURROW_AUTHENTIK_WIF_CLIENT_SECRET: ${{ secrets.BURROW_AUTHENTIK_WIF_CLIENT_SECRET }}
-  BURROW_NIX_CACHE_URL: ${{ vars.BURROW_NIX_CACHE_URL || 'https://nix.burrow.net/burrow' }}
-  BURROW_NIX_CACHE_PUBLIC_KEY: ${{ vars.BURROW_NIX_CACHE_PUBLIC_KEY }}
-  BURROW_APPLE_BUNDLE_ID: ${{ vars.BURROW_APPLE_BUNDLE_ID || 'net.burrow.app' }}
-  BURROW_APPLE_NETWORK_EXTENSION_BUNDLE_ID: ${{ vars.BURROW_APPLE_NETWORK_EXTENSION_BUNDLE_ID || 'net.burrow.app.network' }}
-  BURROW_IOS_DISTRIBUTION_CERTIFICATE_ID: ${{ vars.BURROW_IOS_DISTRIBUTION_CERTIFICATE_ID || '3G42677598' }}
-  BURROW_DEVELOPER_ID_CERTIFICATE_ID: ${{ vars.BURROW_DEVELOPER_ID_CERTIFICATE_ID || '9JKN6HXBHC' }}
-  BURROW_APPLE_SIGNING_MODE: google-kms-staged
-  BURROW_NOTARIZE_MACOS: ${{ vars.BURROW_NOTARIZE_MACOS || 'true' }}
-  BURROW_SPARKLE_SIGN_WITH_KMS: ${{ vars.BURROW_SPARKLE_SIGN_WITH_KMS || 'true' }}
-  BURROW_SPARKLE_KMS_KEY: ${{ vars.BURROW_SPARKLE_KMS_KEY || 'sparkle-ed25519' }}
-  BURROW_SPARKLE_KMS_VERSION: ${{ vars.BURROW_SPARKLE_KMS_VERSION || '1' }}
-  BURROW_SPARKLE_FEED_URL: ${{ vars.BURROW_SPARKLE_FEED_URL || 'https://releases.burrow.net/sparkle/appcast.xml' }}
-  BURROW_SPARKLE_PUBLIC_ED_KEY: ${{ vars.BURROW_SPARKLE_PUBLIC_ED_KEY || 'uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=' }}
-  BURROW_KMS_LOCATION: ${{ vars.BURROW_KMS_LOCATION || 'global' }}
-  BURROW_KMS_KEYRING: ${{ vars.BURROW_KMS_KEYRING || 'burrow-identity' }}
-  TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS: ${{ vars.TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS || '7200' }}
-  BURROW_VERSION_REQUIRE_REMOTE: "1"
-
-jobs:
-  prepare:
-    name: Prepare Apple Distribution
-    runs-on: namespace-profile-linux-medium-apple-v2
-    outputs:
-      build_number: ${{ steps.plan.outputs.build_number }}
-      sparkle_channel: ${{ steps.plan.outputs.sparkle_channel }}
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Fetch Build Tags
-        shell: bash
-        run: git fetch --force --prune origin "+refs/tags/builds/*:refs/tags/builds/*"
-
-      - name: Compute Apple Distribution Plan
-        id: plan
-        shell: bash
-        env:
-          BUILD_NUMBER_OVERRIDE: ${{ github.event.inputs.build_number_override || '' }}
-          SPARKLE_CHANNEL_INPUT: ${{ github.event.inputs.sparkle_channel || '' }}
-        run: |
-          set -euo pipefail
-          if [[ -n "$BUILD_NUMBER_OVERRIDE" ]]; then
-            build_number="$BUILD_NUMBER_OVERRIDE"
-          else
-            build_number="$(Scripts/version.sh pre-increment)"
-          fi
-          channel="$SPARKLE_CHANNEL_INPUT"
-          if [[ -z "$channel" ]]; then
-            channel="build-${build_number}"
-          fi
-          echo "build_number=${build_number}" >> "$GITHUB_OUTPUT"
-          echo "sparkle_channel=${channel}" >> "$GITHUB_OUTPUT"
-          printf 'build_number=%s\nsparkle_channel=%s\n' "$build_number" "$channel"
-
-  build-ios:
-    name: Build Apple iOS
-    needs: prepare
-    runs-on: namespace-profile-macos-large-apple-v2
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-          submodules: recursive
-
-      - name: Select Apple SDK
-        shell: bash
-        run: |
-          set -euo pipefail
-          xcrun --find swiftc
-          xcrun --sdk iphoneos --show-sdk-path
-          xcrun --sdk iphonesimulator --show-sdk-path
-
-      - name: Prepare Rust Apple Targets
-        shell: bash
-        run: |
-          set -euo pipefail
-          if ! command -v rustup >/dev/null 2>&1; then
-            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
-            export PATH="$HOME/.cargo/bin:$PATH"
-          fi
-          rustup target add aarch64-apple-ios aarch64-apple-ios-sim x86_64-apple-ios
-
-      - name: Bootstrap Runner Environment
-        shell: bash
-        run: |
-          set -euo pipefail
-          runner_home="${RUNNER_HOME:-}"
-          if [[ -z "$runner_home" ]]; then
-            runner_home="$(python3 -c 'import os,pwd; print(pwd.getpwuid(os.getuid()).pw_dir)' 2>/dev/null || true)"
-            if [[ -z "$runner_home" ]]; then
-              runner_home="$PWD/.home"
-            fi
-          fi
-          mkdir -p "$runner_home" "$PWD/.tmp"
-          {
-            echo "HOME=$runner_home"
-            echo "XDG_CACHE_HOME=$runner_home/.cache"
-            echo "XDG_CONFIG_HOME=$runner_home/.config"
-            echo "XDG_DATA_HOME=$runner_home/.local/share"
-            echo "TMPDIR=$PWD/.tmp"
-            echo "TMP=$PWD/.tmp"
-          } >> "$GITHUB_ENV"
-
-      - name: Ensure Nix
-        shell: bash
-        run: bash Scripts/ci/ensure-nix.sh
-
-      - name: Namespace Cache
-        shell: bash
-        run: |
-          set -euo pipefail
-          bash Scripts/ci/nscloud-cache.sh bazel
-
-      - name: Build Staged iOS Artifact
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }}
-        run: |
-          set -euo pipefail
-          bazel_args=()
-          if [[ -n "${BURROW_BAZEL_NSCCACHE_BAZELRC:-}" && -f "${BURROW_BAZEL_NSCCACHE_BAZELRC:-}" ]]; then
-            bazel_args+=("--bazelrc=${BURROW_BAZEL_NSCCACHE_BAZELRC}")
-          fi
-          NIX_BIN="$(bash Scripts/ci/resolve-nix-bin.sh)"
-          ci_path="$("$NIX_BIN" develop .#ci --command bash -lc 'printf "%s" "$PATH"')"
-          ci_protoc="$("$NIX_BIN" develop .#ci --command bash -lc 'command -v protoc')"
-          "$NIX_BIN" develop .#ci --command bazel "${bazel_args[@]}" build \
-            --verbose_failures \
-            --show_timestamps \
-            --experimental_ui_max_stdouterr_bytes=16777216 \
-            --action_env=PATH="$ci_path" \
-            --action_env=PROTOC="$ci_protoc" \
-            --action_env=BUILD_WORKSPACE_DIRECTORY="$PWD" \
-            --action_env=BUILD_NUMBER="$BUILD_NUMBER" \
-            --action_env=BURROW_RELEASE_OUT="$PWD/dist/builds/$BUILD_NUMBER" \
-            --action_env=BURROW_APPLE_SIGNING_MODE="$BURROW_APPLE_SIGNING_MODE" \
-            --action_env=BURROW_APPLE_REQUIRE_SIGNING=true \
-            --action_env=BURROW_APPLE_BUNDLE_ID="$BURROW_APPLE_BUNDLE_ID" \
-            --action_env=BURROW_APPLE_NETWORK_EXTENSION_BUNDLE_ID="$BURROW_APPLE_NETWORK_EXTENSION_BUNDLE_ID" \
-            --action_env=HOME="$HOME" \
-            --action_env=XDG_CACHE_HOME="$XDG_CACHE_HOME" \
-            //bazel/apple:release_ios_stamp
-
-      - name: Upload Staged iOS Artifact
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
-        with:
-          name: burrow-apple-ios-${{ needs.prepare.outputs.build_number }}
-          path: |
-            dist/builds/${{ needs.prepare.outputs.build_number }}/apple/Burrow-iOS-${{ needs.prepare.outputs.build_number }}.unsigned.ipa
-            dist/builds/${{ needs.prepare.outputs.build_number }}/apple/Burrow-iOS-${{ needs.prepare.outputs.build_number }}.unsigned.ipa.sha256
-          if-no-files-found: error
-
-  build-macos:
-    name: Build Apple macOS
-    needs: prepare
-    runs-on: namespace-profile-macos-large-apple-v2
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-          submodules: recursive
-
-      - name: Select Apple SDK
-        shell: bash
-        run: |
-          set -euo pipefail
-          xcrun --find swiftc
-          xcrun --sdk macosx --show-sdk-path
-
-      - name: Prepare Rust Apple Targets
-        shell: bash
-        run: |
-          set -euo pipefail
-          if ! command -v rustup >/dev/null 2>&1; then
-            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
-            export PATH="$HOME/.cargo/bin:$PATH"
-          fi
-          rustup target add aarch64-apple-darwin x86_64-apple-darwin
-
-      - name: Bootstrap Runner Environment
-        shell: bash
-        run: |
-          set -euo pipefail
-          runner_home="${RUNNER_HOME:-}"
-          if [[ -z "$runner_home" ]]; then
-            runner_home="$(python3 -c 'import os,pwd; print(pwd.getpwuid(os.getuid()).pw_dir)' 2>/dev/null || true)"
-            if [[ -z "$runner_home" ]]; then
-              runner_home="$PWD/.home"
-            fi
-          fi
-          mkdir -p "$runner_home" "$PWD/.tmp"
-          {
-            echo "HOME=$runner_home"
-            echo "XDG_CACHE_HOME=$runner_home/.cache"
-            echo "XDG_CONFIG_HOME=$runner_home/.config"
-            echo "XDG_DATA_HOME=$runner_home/.local/share"
-            echo "TMPDIR=$PWD/.tmp"
-            echo "TMP=$PWD/.tmp"
-          } >> "$GITHUB_ENV"
-
-      - name: Ensure Nix
-        shell: bash
-        run: bash Scripts/ci/ensure-nix.sh
-
-      - name: Namespace Cache
-        shell: bash
-        run: |
-          set -euo pipefail
-          bash Scripts/ci/nscloud-cache.sh bazel
-
-      - name: Build Staged macOS Artifact
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }}
-        run: |
-          set -euo pipefail
-          bazel_args=()
-          if [[ -n "${BURROW_BAZEL_NSCCACHE_BAZELRC:-}" && -f "${BURROW_BAZEL_NSCCACHE_BAZELRC:-}" ]]; then
-            bazel_args+=("--bazelrc=${BURROW_BAZEL_NSCCACHE_BAZELRC}")
-          fi
-          NIX_BIN="$(bash Scripts/ci/resolve-nix-bin.sh)"
-          ci_path="$("$NIX_BIN" develop .#ci --command bash -lc 'printf "%s" "$PATH"')"
-          ci_protoc="$("$NIX_BIN" develop .#ci --command bash -lc 'command -v protoc')"
-          "$NIX_BIN" develop .#ci --command bazel "${bazel_args[@]}" build \
-            --verbose_failures \
-            --show_timestamps \
-            --experimental_ui_max_stdouterr_bytes=16777216 \
-            --action_env=PATH="$ci_path" \
-            --action_env=PROTOC="$ci_protoc" \
-            --action_env=BUILD_WORKSPACE_DIRECTORY="$PWD" \
-            --action_env=BUILD_NUMBER="$BUILD_NUMBER" \
-            --action_env=BURROW_RELEASE_OUT="$PWD/dist/builds/$BUILD_NUMBER" \
-            --action_env=BURROW_APPLE_SIGNING_MODE="$BURROW_APPLE_SIGNING_MODE" \
-            --action_env=BURROW_APPLE_REQUIRE_SIGNING=true \
-            --action_env=BURROW_APPLE_BUNDLE_ID="$BURROW_APPLE_BUNDLE_ID" \
-            --action_env=BURROW_APPLE_NETWORK_EXTENSION_BUNDLE_ID="$BURROW_APPLE_NETWORK_EXTENSION_BUNDLE_ID" \
-            --action_env=BURROW_SPARKLE_FEED_URL="$BURROW_SPARKLE_FEED_URL" \
-            --action_env=BURROW_SPARKLE_PUBLIC_ED_KEY="$BURROW_SPARKLE_PUBLIC_ED_KEY" \
-            --action_env=HOME="$HOME" \
-            --action_env=XDG_CACHE_HOME="$XDG_CACHE_HOME" \
-            //bazel/apple:release_macos_stamp
-
-      - name: Upload Staged macOS Artifact
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
-        with:
-          name: burrow-apple-macos-${{ needs.prepare.outputs.build_number }}
-          path: |
-            dist/builds/${{ needs.prepare.outputs.build_number }}/apple/Burrow-macOS-${{ needs.prepare.outputs.build_number }}.unsigned.zip
-            dist/builds/${{ needs.prepare.outputs.build_number }}/apple/Burrow-macOS-${{ needs.prepare.outputs.build_number }}.unsigned.zip.sha256
-          if-no-files-found: error
-
-  sign-apple:
-    name: Sign Apple Artifacts
-    needs:
-      - prepare
-      - build-ios
-      - build-macos
-    runs-on: namespace-profile-linux-medium-apple-v2
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Ensure Nix
-        shell: bash
-        run: bash Scripts/ci/ensure-nix.sh
-
-      - name: Configure Age
-        shell: bash
-        env:
-          AGE_FORGE_SSH_KEY: ${{ secrets.AGE_FORGE_SSH_KEY }}
-        run: Scripts/resolve-age-identity.sh >> "$GITHUB_ENV"
-
-      - name: Decrypt Release Secrets
-        uses: ./.forgejo/actions/decrypt-release-secrets
-
-      - name: Validate App Store Credentials
-        shell: bash
-        run: Scripts/ci/check-release-config.sh app-store
-
-      - name: Authenticate Google WIF
-        shell: bash
-        run: nix develop .#ci -c Scripts/ci/google-wif-auth.sh
-
-      - name: Download Staged Apple Artifacts
-        uses: https://code.forgejo.org/actions/download-artifact@v3
-        with:
-          path: dist/downloaded
-
-      - name: Prepare Staged Apple Directory
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }}
-        run: |
-          set -euo pipefail
-          mkdir -p "dist/builds/${BUILD_NUMBER}/apple"
-          find dist/downloaded -type f -name 'Burrow-*.unsigned.*' -exec cp -v {} "dist/builds/${BUILD_NUMBER}/apple/" \;
-          find "dist/builds/${BUILD_NUMBER}/apple" -type f -print | sort
-
-      - name: Sync Apple Provisioning Profiles
-        shell: bash
-        run: nix develop .#ci -c Scripts/ci/sync-apple-provisioning-profiles.sh all
-
-      - name: Sign Apple Artifacts With KMS
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }}
-          SPARKLE_CHANNEL: ${{ needs.prepare.outputs.sparkle_channel }}
-        run: nix develop .#ci -c Scripts/apple/sign-release-artifacts-kms.sh all
-
-      - name: Upload Signed Apple Artifacts To Release Storage
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }}
-        run: nix develop .#ci -c Scripts/ci/upload-release-storage.sh
-
-      - name: Upload Signed Apple Artifacts
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
-        with:
-          name: burrow-apple-signed-${{ needs.prepare.outputs.build_number }}
-          path: |
-            dist/builds/${{ needs.prepare.outputs.build_number }}/apple/Burrow-iOS-${{ needs.prepare.outputs.build_number }}.ipa
-            dist/builds/${{ needs.prepare.outputs.build_number }}/apple/Burrow-iOS-${{ needs.prepare.outputs.build_number }}.ipa.sha256
-            dist/builds/${{ needs.prepare.outputs.build_number }}/apple/Burrow-macOS-${{ needs.prepare.outputs.build_number }}.zip
-            dist/builds/${{ needs.prepare.outputs.build_number }}/apple/Burrow-macOS-${{ needs.prepare.outputs.build_number }}.zip.sha256
-            dist/builds/${{ needs.prepare.outputs.build_number }}/sparkle/**
-          if-no-files-found: error
-
-  upload-testflight:
-    name: Upload TestFlight
-    needs:
-      - prepare
-      - sign-apple
-    if: ${{ github.event.inputs.upload_app_store == 'true' }}
-    runs-on: namespace-profile-macos-large-testflight
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Ensure Nix
-        shell: bash
-        run: bash Scripts/ci/ensure-nix.sh
-
-      - name: Configure Age
-        shell: bash
-        env:
-          AGE_FORGE_SSH_KEY: ${{ secrets.AGE_FORGE_SSH_KEY }}
-        run: Scripts/resolve-age-identity.sh >> "$GITHUB_ENV"
-
-      - name: Decrypt Release Secrets
-        uses: ./.forgejo/actions/decrypt-release-secrets
-
-      - name: Download Signed Apple Artifacts
-        uses: https://code.forgejo.org/actions/download-artifact@v3
-        with:
-          name: burrow-apple-signed-${{ needs.prepare.outputs.build_number }}
-          path: publish
-
-      - name: Upload iOS IPA To App Store Connect
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }}
-        run: |
-          set -euo pipefail
-          Scripts/ci/check-release-config.sh app-store
-          key_dir="${RUNNER_TEMP:-/tmp}/burrow-asc"
-          altool_key_dir="${HOME}/.appstoreconnect/private_keys"
-          mkdir -p "$key_dir" "$altool_key_dir"
-          key_path="$key_dir/AuthKey_${ASC_API_KEY_ID}.p8"
-          if [[ -n "${ASC_API_KEY_PATH:-}" && -f "${ASC_API_KEY_PATH:-}" ]]; then
-            cp "$ASC_API_KEY_PATH" "$key_path"
-          else
-            printf '%s' "$ASC_API_KEY_BASE64" | base64 --decode > "$key_path"
-          fi
-          cp "$key_path" "$altool_key_dir/AuthKey_${ASC_API_KEY_ID}.p8"
-          chmod 600 "$key_path" "$altool_key_dir/AuthKey_${ASC_API_KEY_ID}.p8"
-          ipa="publish/apple/Burrow-iOS-${BUILD_NUMBER}.ipa"
-          if [[ ! -s "$ipa" ]]; then
-            echo "::error ::No signed iOS IPA found at $ipa" >&2
-            find publish -type f -print | sort
-            exit 1
-          fi
-          upload_log="${RUNNER_TEMP:-/tmp}/burrow-altool-ios-${BUILD_NUMBER}.log"
-          set +e
-          xcrun altool --upload-app \
-            --type ios \
-            --file "$ipa" \
-            --apiKey "$ASC_API_KEY_ID" \
-            --apiIssuer "$ASC_API_ISSUER_ID" 2>&1 | tee "$upload_log"
-          altool_status=${PIPESTATUS[0]}
-          set -e
-          if (( altool_status != 0 )) || grep -Eq 'UPLOAD FAILED|Validation failed|ERROR:' "$upload_log"; then
-            echo "::error ::altool reported upload validation failure for $ipa" >&2
-            exit 1
-          fi
-
-      - name: Distribute iOS Build To TestFlight
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }}
-          TESTFLIGHT_DISTRIBUTE_EXTERNAL: ${{ github.event.inputs.testflight_distribute_external || 'false' }}
-          TESTFLIGHT_GROUPS: ${{ github.event.inputs.testflight_groups || '' }}
-          IOS_USES_NON_EXEMPT_ENCRYPTION: ${{ github.event.inputs.ios_uses_non_exempt_encryption || 'false' }}
-        run: Scripts/ci/distribute-testflight.sh
-
-  publish-sparkle:
-    name: Publish Sparkle
-    needs:
-      - prepare
-      - sign-apple
-    if: ${{ github.event.inputs.upload_sparkle == 'true' }}
-    runs-on: namespace-profile-linux-medium-apple-v2
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Ensure Nix
-        shell: bash
-        run: bash Scripts/ci/ensure-nix.sh
-
-      - name: Authenticate Google WIF
-        shell: bash
-        run: nix develop .#ci -c Scripts/ci/google-wif-auth.sh
-
-      - name: Download Signed Apple Artifacts
-        uses: https://code.forgejo.org/actions/download-artifact@v3
-        with:
-          name: burrow-apple-signed-${{ needs.prepare.outputs.build_number }}
-          path: publish
-
-      - name: Publish Sparkle Channel
-        shell: bash
-        env:
-          CHANNEL: ${{ needs.prepare.outputs.sparkle_channel }}
-          SPARKLE_POINT_MAIN: ${{ github.event.inputs.sparkle_point_main || 'true' }}
-        run: |
-          set -euo pipefail
-          if [[ ! -f "publish/sparkle/${CHANNEL}/appcast.xml" ]]; then
-            echo "::error ::No Sparkle appcast staged for channel ${CHANNEL}" >&2
-            find publish -type f -print | sort
-            exit 1
-          fi
-          nix develop .#ci -c gcloud storage rsync --recursive "publish/sparkle/${CHANNEL}" "gs://${BURROW_RELEASE_GCS_BUCKET}/sparkle/${CHANNEL}"
-          if [[ "$SPARKLE_POINT_MAIN" == "true" ]]; then
-            printf '%s\n' "$CHANNEL" > main-channel.txt
-            nix develop .#ci -c gcloud storage cp main-channel.txt "gs://${BURROW_RELEASE_GCS_BUCKET}/sparkle/main-channel.txt"
-            nix develop .#ci -c gcloud storage cp "publish/sparkle/${CHANNEL}/appcast.xml" "gs://${BURROW_RELEASE_GCS_BUCKET}/sparkle/appcast.xml"
-            nix develop .#ci -c gcloud storage rsync --recursive "publish/sparkle/${CHANNEL}" "gs://${BURROW_RELEASE_GCS_BUCKET}/sparkle/default"
-          fi
diff --git a/.forgejo/workflows/apple-ios-distribution-kms-csr.yml b/.forgejo/workflows/apple-ios-distribution-kms-csr.yml
deleted file mode 100644
index d9cb614..0000000
--- a/.forgejo/workflows/apple-ios-distribution-kms-csr.yml
+++ /dev/null
@@ -1,99 +0,0 @@
-name: "Apple: iOS Distribution KMS CSR"
-run-name: "Apple: iOS Distribution KMS CSR (${{ github.event.inputs.kms_key || 'apple-ios-distribution' }})"
-
-on:
-  workflow_dispatch:
-    inputs:
-      kms_key:
-        description: Google KMS key name in the Burrow identity key ring
-        required: false
-        default: apple-ios-distribution
-      kms_version:
-        description: Google KMS key version
-        required: false
-        default: "1"
-      common_name:
-        description: CSR common name
-        required: false
-        default: Burrow iOS Distribution
-      email_address:
-        description: CSR email address
-        required: false
-        default: release@burrow.net
-
-permissions:
-  contents: read
-
-concurrency:
-  group: apple-ios-distribution-kms-csr-${{ github.ref }}
-  cancel-in-progress: false
-
-env:
-  BURROW_GOOGLE_PROJECT_ID: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
-  GOOGLE_CLOUD_PROJECT: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
-  BURROW_GOOGLE_PROJECT_NUMBER: ${{ vars.GOOGLE_PROJECT_NUMBER || '416198671487' }}
-  BURROW_GOOGLE_WIF_POOL_ID: ${{ vars.BURROW_GOOGLE_WIF_POOL_ID || 'burrow-authentik' }}
-  BURROW_GOOGLE_WIF_PROVIDER_ID: ${{ vars.BURROW_GOOGLE_WIF_PROVIDER_ID || 'forgejo-runners' }}
-  BURROW_GOOGLE_WIF_SERVICE_ACCOUNT: ${{ vars.BURROW_GOOGLE_WIF_SERVICE_ACCOUNT || 'burrow-forgejo-runner@project-88c23ce9-918a-470a-b33.iam.gserviceaccount.com' }}
-  BURROW_AUTHENTIK_WIF_ISSUER: ${{ vars.BURROW_AUTHENTIK_WIF_ISSUER || 'https://auth.burrow.net/application/o/google-cloud/' }}
-  BURROW_AUTHENTIK_WIF_AUDIENCE: ${{ vars.BURROW_AUTHENTIK_WIF_AUDIENCE || 'google-wif.burrow.net' }}
-  BURROW_AUTHENTIK_WIF_CLIENT_ID: ${{ vars.BURROW_AUTHENTIK_WIF_CLIENT_ID || 'google-wif.burrow.net' }}
-  BURROW_AUTHENTIK_WIF_CLIENT_SECRET: ${{ secrets.BURROW_AUTHENTIK_WIF_CLIENT_SECRET }}
-  BURROW_KMS_LOCATION: global
-  BURROW_KMS_KEYRING: burrow-identity
-
-jobs:
-  csr:
-    name: Generate CSR
-    runs-on: [self-hosted, linux, x86_64, burrow-forge]
-    timeout-minutes: 20
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Ensure Nix
-        shell: bash
-        run: bash Scripts/ci/ensure-nix.sh
-
-      - name: Authenticate Google WIF
-        shell: bash
-        run: nix develop .#ci -c Scripts/ci/google-wif-auth.sh
-
-      - name: Generate KMS-backed CSR
-        shell: bash
-        run: |
-          set -euo pipefail
-          mkdir -p dist/apple-ios-distribution
-          nix develop .#ci -c Scripts/apple/google-kms-csr.py \
-            --kms-key "${{ github.event.inputs.kms_key || 'apple-ios-distribution' }}" \
-            --kms-version "${{ github.event.inputs.kms_version || '1' }}" \
-            --common-name "${{ github.event.inputs.common_name || 'Burrow iOS Distribution' }}" \
-            --email-address "${{ github.event.inputs.email_address || 'release@burrow.net' }}" \
-            --output dist/apple-ios-distribution/ios-distribution.certSigningRequest \
-            --public-key-output dist/apple-ios-distribution/google-kms-public-key.pem
-          if command -v openssl >/dev/null 2>&1; then
-            openssl req -in dist/apple-ios-distribution/ios-distribution.certSigningRequest -noout -verify
-          fi
-          cat > dist/apple-ios-distribution/README.txt <<'EOF'
-          This CSR is backed by a non-exportable Google Cloud KMS key in the Burrow
-          identity key ring.
-
-          Create an iOS Distribution certificate explicitly through App Store Connect:
-
-          Scripts/apple/create-asc-certificate.mjs \
-            --certificate-type IOS_DISTRIBUTION \
-            --csr-file ios-distribution.certSigningRequest \
-            --out-dir Apple/Certificates
-
-          Keep the returned .cer file with release artifacts. The private key remains in
-          Google Cloud KMS and is never exported as a p12.
-          EOF
-
-      - name: Upload CSR Artifact
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
-        with:
-          name: burrow-ios-distribution-kms-csr
-          path: dist/apple-ios-distribution
diff --git a/.forgejo/workflows/backup-garage-storage.yml b/.forgejo/workflows/backup-garage-storage.yml
deleted file mode 100644
index 77d08aa..0000000
--- a/.forgejo/workflows/backup-garage-storage.yml
+++ /dev/null
@@ -1,67 +0,0 @@
-name: "Backup: Garage Storage"
-run-name: "Backup Garage Storage (${{ github.event.inputs.set || 'all' }})"
-
-on:
-  schedule:
-    - cron: "17 9 * * *"
-  workflow_dispatch:
-    inputs:
-      set:
-        description: "Comma-separated backup set: all, releases, packages, nix-cache"
-        required: false
-        default: all
-      delete_unmatched:
-        description: Delete destination objects that are missing from Garage
-        required: false
-        default: "false"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: backup-garage-storage-${{ github.event.inputs.set || 'all' }}
-  cancel-in-progress: false
-
-jobs:
-  backup:
-    name: Mirror Garage To GCS
-    runs-on: namespace-profile-linux-medium
-    timeout-minutes: 90
-    env:
-      BURROW_GARAGE_ENDPOINT: ${{ vars.BURROW_GARAGE_ENDPOINT || 'https://objects.burrow.net' }}
-      BURROW_GARAGE_REGION: ${{ vars.BURROW_GARAGE_REGION || 'garage' }}
-      BURROW_GARAGE_BACKUP_SET: ${{ github.event.inputs.set || 'all' }}
-      BURROW_GARAGE_BACKUP_DELETE: ${{ github.event.inputs.delete_unmatched || 'false' }}
-      BURROW_RELEASE_GARAGE_BUCKET: ${{ vars.BURROW_RELEASE_GARAGE_BUCKET || 'burrow-releases' }}
-      BURROW_PACKAGE_GARAGE_BUCKET: ${{ vars.BURROW_PACKAGE_GARAGE_BUCKET || 'burrow-packages' }}
-      BURROW_NIX_CACHE_GARAGE_BUCKET: ${{ vars.BURROW_NIX_CACHE_GARAGE_BUCKET || 'attic' }}
-      BURROW_RELEASE_GCS_BUCKET: ${{ vars.BURROW_RELEASE_GCS_BUCKET || 'burrow-net-releases' }}
-      BURROW_PACKAGE_GCS_BUCKET: ${{ vars.BURROW_PACKAGE_GCS_BUCKET || 'burrow-net-packages' }}
-      BURROW_NIX_CACHE_GCS_BUCKET: ${{ vars.BURROW_NIX_CACHE_GCS_BUCKET || 'burrow-net-nix-cache' }}
-      AWS_ACCESS_KEY_ID: ${{ secrets.BURROW_GARAGE_BACKUP_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.BURROW_GARAGE_BACKUP_SECRET_ACCESS_KEY }}
-      BURROW_GOOGLE_PROJECT_ID: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
-      GOOGLE_CLOUD_PROJECT: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
-      BURROW_GOOGLE_PROJECT_NUMBER: ${{ vars.GOOGLE_PROJECT_NUMBER || '416198671487' }}
-      BURROW_GOOGLE_WIF_POOL_ID: ${{ vars.BURROW_GOOGLE_WIF_POOL_ID || 'burrow-authentik' }}
-      BURROW_GOOGLE_WIF_PROVIDER_ID: ${{ vars.BURROW_GOOGLE_WIF_PROVIDER_ID || 'forgejo-runners' }}
-      BURROW_GOOGLE_WIF_SERVICE_ACCOUNT: ${{ vars.BURROW_GOOGLE_WIF_SERVICE_ACCOUNT || 'burrow-forgejo-runner@project-88c23ce9-918a-470a-b33.iam.gserviceaccount.com' }}
-      BURROW_AUTHENTIK_WIF_ISSUER: ${{ vars.BURROW_AUTHENTIK_WIF_ISSUER || 'https://auth.burrow.net/application/o/google-cloud/' }}
-      BURROW_AUTHENTIK_WIF_AUDIENCE: ${{ vars.BURROW_AUTHENTIK_WIF_AUDIENCE || 'google-wif.burrow.net' }}
-      BURROW_AUTHENTIK_WIF_CLIENT_ID: ${{ vars.BURROW_AUTHENTIK_WIF_CLIENT_ID || 'google-wif.burrow.net' }}
-      BURROW_AUTHENTIK_WIF_CLIENT_SECRET: ${{ secrets.BURROW_AUTHENTIK_WIF_CLIENT_SECRET }}
-      BURROW_NIX_CACHE_URL: ${{ vars.BURROW_NIX_CACHE_URL || 'https://nix.burrow.net/burrow' }}
-      BURROW_NIX_CACHE_PUBLIC_KEY: ${{ vars.BURROW_NIX_CACHE_PUBLIC_KEY }}
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Ensure Nix
-        shell: bash
-        run: bash Scripts/ci/ensure-nix.sh
-
-      - name: Mirror Garage Buckets To GCS
-        shell: bash
-        run: nix develop .#ci -c Scripts/ci/backup-garage-to-gcs.sh
diff --git a/.forgejo/workflows/build-android.yml b/.forgejo/workflows/build-android.yml
deleted file mode 100644
index 0cc61cd..0000000
--- a/.forgejo/workflows/build-android.yml
+++ /dev/null
@@ -1,74 +0,0 @@
-name: "Build: Android"
-run-name: "Build: Android (${{ github.ref_name }})"
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - ".forgejo/workflows/build-android.yml"
-      - "Android/**"
-      - "BUILD.bazel"
-      - "MODULE.bazel"
-      - "MODULE.bazel.lock"
-      - "bazel/android/**"
-      - "Cargo.lock"
-      - "Cargo.toml"
-      - "crates/burrow-core/**"
-      - "crates/burrow-mobile-ffi/**"
-      - "rust-toolchain.toml"
-      - "Scripts/ci/nscloud-cache.sh"
-  pull_request:
-    paths:
-      - ".forgejo/workflows/build-android.yml"
-      - "Android/**"
-      - "BUILD.bazel"
-      - "MODULE.bazel"
-      - "MODULE.bazel.lock"
-      - "bazel/android/**"
-      - "Cargo.lock"
-      - "Cargo.toml"
-      - "crates/burrow-core/**"
-      - "crates/burrow-mobile-ffi/**"
-      - "rust-toolchain.toml"
-      - "Scripts/ci/nscloud-cache.sh"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: burrow-build-android-${{ github.ref }}
-  cancel-in-progress: true
-
-env:
-  BURROW_NIX_CACHE_URL: ${{ vars.BURROW_NIX_CACHE_URL || 'https://nix.burrow.net/burrow' }}
-  BURROW_NIX_CACHE_PUBLIC_KEY: ${{ vars.BURROW_NIX_CACHE_PUBLIC_KEY }}
-
-jobs:
-  stub:
-    name: Android Rust Core Stub
-    runs-on: namespace-profile-linux-medium
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Configure Cache
-        shell: bash
-        run: |
-          set -euo pipefail
-          bash Scripts/ci/ensure-nix.sh
-          nix develop .#ci -c Scripts/ci/nscloud-cache.sh bazel
-
-      - name: Build Android Stub Check
-        shell: bash
-        run: |
-          set -euo pipefail
-          if [[ -n "${BURROW_BAZEL_NSCCACHE_BAZELRC:-}" ]]; then
-            bazel --bazelrc="$BURROW_BAZEL_NSCCACHE_BAZELRC" build //bazel/android:check_stub_stamp
-          else
-            bazel build //bazel/android:check_stub_stamp
-          fi
diff --git a/.forgejo/workflows/build-release.yml b/.forgejo/workflows/build-release.yml
deleted file mode 100644
index 85c2e76..0000000
--- a/.forgejo/workflows/build-release.yml
+++ /dev/null
@@ -1,480 +0,0 @@
-name: "Build: Release"
-run-name: "Build: Release (${{ github.ref_name }})"
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_number_override:
-        description: Optional explicit build number
-        required: false
-        default: ""
-      upload_app_store:
-        description: Trigger downstream App Store Connect upload workflow
-        required: false
-        default: "true"
-      upload_sparkle:
-        description: Trigger downstream Sparkle publish workflow
-        required: false
-        default: "true"
-      upload_microsoft_store:
-        description: Trigger downstream Microsoft Store beta upload workflow
-        required: false
-        default: "false"
-      sparkle_point_main:
-        description: Update Sparkle main channel pointers
-        required: false
-        default: "true"
-      testflight_distribute_external:
-        description: Distribute to external TestFlight groups
-        required: false
-        default: "false"
-      testflight_groups:
-        description: Optional comma-separated TestFlight groups for external distribution
-        required: false
-        default: ""
-      ios_uses_non_exempt_encryption:
-        description: Set true only when the iOS build uses non-exempt encryption
-        required: false
-        default: "false"
-  push:
-    tags:
-      - "release/*"
-
-permissions:
-  actions: write
-  contents: write
-
-concurrency:
-  group: burrow-build-release-${{ github.ref }}
-  cancel-in-progress: true
-
-env:
-  BURROW_RELEASE_GCS_BUCKET: ${{ vars.BURROW_RELEASE_GCS_BUCKET || 'burrow-net-releases' }}
-  BURROW_RELEASE_GCS_BACKUP: ${{ vars.BURROW_RELEASE_GCS_BACKUP || 'true' }}
-  BURROW_RELEASE_GARAGE_BUCKET: ${{ vars.BURROW_RELEASE_GARAGE_BUCKET || 'burrow-releases' }}
-  BURROW_RELEASE_REQUIRE_GARAGE: ${{ vars.BURROW_RELEASE_REQUIRE_GARAGE || 'true' }}
-  BURROW_GARAGE_ENDPOINT: ${{ vars.BURROW_GARAGE_ENDPOINT || 'https://objects.burrow.net' }}
-  BURROW_GARAGE_REGION: ${{ vars.BURROW_GARAGE_REGION || 'garage' }}
-  AWS_ACCESS_KEY_ID: ${{ secrets.BURROW_GARAGE_ACCESS_KEY_ID }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets.BURROW_GARAGE_SECRET_ACCESS_KEY }}
-  BURROW_NIX_CACHE_URL: ${{ vars.BURROW_NIX_CACHE_URL || 'https://nix.burrow.net/burrow' }}
-  BURROW_NIX_CACHE_PUBLIC_KEY: ${{ vars.BURROW_NIX_CACHE_PUBLIC_KEY }}
-  BURROW_GOOGLE_PROJECT_ID: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
-  GOOGLE_CLOUD_PROJECT: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
-  BURROW_GOOGLE_PROJECT_NUMBER: ${{ vars.GOOGLE_PROJECT_NUMBER || '416198671487' }}
-  BURROW_GOOGLE_WIF_POOL_ID: ${{ vars.BURROW_GOOGLE_WIF_POOL_ID || 'burrow-authentik' }}
-  BURROW_GOOGLE_WIF_PROVIDER_ID: ${{ vars.BURROW_GOOGLE_WIF_PROVIDER_ID || 'forgejo-runners' }}
-  BURROW_GOOGLE_WIF_SERVICE_ACCOUNT: ${{ vars.BURROW_GOOGLE_WIF_SERVICE_ACCOUNT || 'burrow-forgejo-runner@project-88c23ce9-918a-470a-b33.iam.gserviceaccount.com' }}
-  BURROW_AUTHENTIK_WIF_ISSUER: ${{ vars.BURROW_AUTHENTIK_WIF_ISSUER || 'https://auth.burrow.net/application/o/google-cloud/' }}
-  BURROW_AUTHENTIK_WIF_AUDIENCE: ${{ vars.BURROW_AUTHENTIK_WIF_AUDIENCE || 'google-wif.burrow.net' }}
-  BURROW_AUTHENTIK_WIF_CLIENT_ID: ${{ vars.BURROW_AUTHENTIK_WIF_CLIENT_ID || 'google-wif.burrow.net' }}
-  BURROW_AUTHENTIK_WIF_CLIENT_SECRET: ${{ secrets.BURROW_AUTHENTIK_WIF_CLIENT_SECRET }}
-  BURROW_APPLE_BUNDLE_ID: ${{ vars.BURROW_APPLE_BUNDLE_ID || 'net.burrow.app' }}
-  BURROW_APPLE_NETWORK_EXTENSION_BUNDLE_ID: ${{ vars.BURROW_APPLE_NETWORK_EXTENSION_BUNDLE_ID || 'net.burrow.app.network' }}
-  BURROW_IOS_DISTRIBUTION_CERTIFICATE_ID: ${{ vars.BURROW_IOS_DISTRIBUTION_CERTIFICATE_ID || '3G42677598' }}
-  BURROW_DEVELOPER_ID_CERTIFICATE_ID: ${{ vars.BURROW_DEVELOPER_ID_CERTIFICATE_ID || '9JKN6HXBHC' }}
-  BURROW_APPLE_CREATE_MISSING_BUNDLE_IDS: ${{ vars.BURROW_APPLE_CREATE_MISSING_BUNDLE_IDS || 'false' }}
-  BURROW_APPLE_ENABLE_CAPABILITIES: ${{ vars.BURROW_APPLE_ENABLE_CAPABILITIES || 'false' }}
-  BURROW_APPLE_SIGNING_MODE: ${{ vars.BURROW_APPLE_SIGNING_MODE || 'google-kms-staged' }}
-  BURROW_NOTARIZE_MACOS: ${{ vars.BURROW_NOTARIZE_MACOS || 'true' }}
-  BURROW_SPARKLE_SIGN_WITH_KMS: ${{ vars.BURROW_SPARKLE_SIGN_WITH_KMS || 'true' }}
-  BURROW_SPARKLE_KMS_KEY: ${{ vars.BURROW_SPARKLE_KMS_KEY || 'sparkle-ed25519' }}
-  BURROW_SPARKLE_KMS_VERSION: ${{ vars.BURROW_SPARKLE_KMS_VERSION || '1' }}
-  BURROW_SPARKLE_FEED_URL: ${{ vars.BURROW_SPARKLE_FEED_URL || 'https://releases.burrow.net/sparkle/appcast.xml' }}
-  BURROW_SPARKLE_PUBLIC_ED_KEY: ${{ vars.BURROW_SPARKLE_PUBLIC_ED_KEY || 'uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=' }}
-  BURROW_VERSION_REQUIRE_REMOTE: "1"
-
-jobs:
-  prepare:
-    name: Prepare
-    runs-on: namespace-profile-linux-medium
-    outputs:
-      do_release: ${{ steps.plan.outputs.do_release }}
-      build_number: ${{ steps.plan.outputs.build_number }}
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Fetch Build Tags
-        shell: bash
-        run: git fetch --force --prune origin "+refs/tags/builds/*:refs/tags/builds/*"
-
-      - name: Compute Release Plan
-        id: plan
-        shell: bash
-        env:
-          BURROW_BUILD_NUMBER_OVERRIDE: ${{ github.event.inputs.build_number_override || '' }}
-        run: |
-          set -euo pipefail
-          status="$(Scripts/version.sh status)"
-          if [[ "$status" == "clean" ]]; then
-            echo "do_release=false" >> "$GITHUB_OUTPUT"
-            echo "build_number=" >> "$GITHUB_OUTPUT"
-            echo "No unreleased changes."
-            exit 0
-          fi
-          build_number="$(Scripts/version.sh pre-increment)"
-          echo "do_release=true" >> "$GITHUB_OUTPUT"
-          echo "build_number=${build_number}" >> "$GITHUB_OUTPUT"
-
-  build-linux:
-    name: Build (Linux)
-    needs: prepare
-    if: ${{ needs.prepare.outputs.do_release == 'true' }}
-    runs-on: namespace-profile-linux-medium
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Build Linux Release
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }}
-        run: |
-          set -euo pipefail
-          bash Scripts/ci/ensure-nix.sh
-          nix develop .#ci -c Scripts/ci/nscloud-cache.sh nix
-          nix develop .#ci -c Scripts/ci/package-release-artifacts.sh linux
-
-      - name: Upload Linux Artifacts
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
-        with:
-          name: burrow-linux-${{ needs.prepare.outputs.build_number }}
-          path: dist/builds/${{ needs.prepare.outputs.build_number }}/linux/*
-          if-no-files-found: error
-
-      - name: Upload Linux Artifacts To Release Storage
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }}
-        run: |
-          set -euo pipefail
-          bash Scripts/ci/ensure-nix.sh
-          nix develop .#ci -c Scripts/ci/upload-release-storage.sh
-
-  build-windows:
-    name: Build (Windows Stub)
-    needs: prepare
-    if: ${{ needs.prepare.outputs.do_release == 'true' }}
-    runs-on: namespace-profile-windows-large
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Build Rust Stub
-        shell: pwsh
-        env:
-          BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }}
-        run: |
-          if (-not (Get-Command cargo -ErrorAction SilentlyContinue)) {
-            Invoke-WebRequest -Uri "https://win.rustup.rs" -OutFile "rustup-init.exe"
-            .\rustup-init.exe -y --profile minimal --default-toolchain stable
-            $env:Path = "$env:USERPROFILE\.cargo\bin;$env:Path"
-          }
-          cargo build --locked --release -p burrow-windows-stub
-          New-Item -ItemType Directory -Force -Path "dist/builds/$env:BUILD_NUMBER/windows/burrow-$env:BUILD_NUMBER-x86_64-pc-windows-msvc" | Out-Null
-          Copy-Item "target/release/burrow.exe" "dist/builds/$env:BUILD_NUMBER/windows/burrow-$env:BUILD_NUMBER-x86_64-pc-windows-msvc/burrow.exe"
-          Copy-Item "README.md" "dist/builds/$env:BUILD_NUMBER/windows/burrow-$env:BUILD_NUMBER-x86_64-pc-windows-msvc/README.md"
-          Compress-Archive -Path "dist/builds/$env:BUILD_NUMBER/windows/burrow-$env:BUILD_NUMBER-x86_64-pc-windows-msvc" -DestinationPath "dist/builds/$env:BUILD_NUMBER/windows/burrow-$env:BUILD_NUMBER-x86_64-pc-windows-msvc.zip" -Force
-          Get-FileHash "dist/builds/$env:BUILD_NUMBER/windows/burrow-$env:BUILD_NUMBER-x86_64-pc-windows-msvc.zip" -Algorithm SHA256 | ForEach-Object { "$($_.Hash.ToLower())  burrow-$env:BUILD_NUMBER-x86_64-pc-windows-msvc.zip" } | Set-Content "dist/builds/$env:BUILD_NUMBER/windows/burrow-$env:BUILD_NUMBER-x86_64-pc-windows-msvc.zip.sha256"
-
-      - name: Upload Windows Artifacts
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
-        with:
-          name: burrow-windows-${{ needs.prepare.outputs.build_number }}
-          path: dist/builds/${{ needs.prepare.outputs.build_number }}/windows/*
-          if-no-files-found: error
-
-  build-apple:
-    name: Build (Apple ${{ matrix.platform_name }})
-    needs: prepare
-    if: ${{ needs.prepare.outputs.do_release == 'true' }}
-    runs-on: namespace-profile-macos-large
-    strategy:
-      fail-fast: false
-      max-parallel: 2
-      matrix:
-        include:
-          - platform: ios
-            platform_name: iOS
-            bazel_target: //bazel/apple:release_ios_stamp
-          - platform: macos
-            platform_name: macOS
-            bazel_target: //bazel/apple:release_macos_stamp
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-          submodules: recursive
-
-      - name: Select Apple SDK
-        shell: bash
-        run: |
-          set -euo pipefail
-          if ! command -v xcrun >/dev/null 2>&1; then
-            echo "::error ::xcrun is required for Apple release builds" >&2
-            exit 1
-          fi
-          xcrun --find swiftc
-          xcrun --sdk macosx --show-sdk-path
-          xcrun --sdk iphoneos --show-sdk-path
-          xcrun --sdk iphonesimulator --show-sdk-path
-
-      - name: Prepare Rust Apple Targets
-        shell: bash
-        env:
-          PLATFORM: ${{ matrix.platform }}
-        run: |
-          set -euo pipefail
-          if ! command -v rustup >/dev/null 2>&1; then
-            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
-            export PATH="$HOME/.cargo/bin:$PATH"
-          fi
-          case "$PLATFORM" in
-            ios)
-              rustup target add aarch64-apple-ios aarch64-apple-ios-sim x86_64-apple-ios
-              ;;
-            macos)
-              rustup target add aarch64-apple-darwin x86_64-apple-darwin
-              ;;
-            *)
-              echo "::error ::unsupported Apple platform ${PLATFORM}" >&2
-              exit 1
-              ;;
-          esac
-
-      - name: Bootstrap Runner Environment
-        shell: bash
-        run: |
-          set -euo pipefail
-          runner_home="${RUNNER_HOME:-}"
-          if [[ -z "$runner_home" ]]; then
-            runner_home="$(python3 -c 'import os,pwd; print(pwd.getpwuid(os.getuid()).pw_dir)' 2>/dev/null || true)"
-            if [[ -z "$runner_home" ]]; then
-              runner_home="$PWD/.home"
-            fi
-          fi
-          mkdir -p "$runner_home" "$PWD/.tmp"
-          {
-            echo "HOME=$runner_home"
-            echo "XDG_CACHE_HOME=$runner_home/.cache"
-            echo "XDG_CONFIG_HOME=$runner_home/.config"
-            echo "XDG_DATA_HOME=$runner_home/.local/share"
-            echo "TMPDIR=$PWD/.tmp"
-            echo "TMP=$PWD/.tmp"
-          } >> "$GITHUB_ENV"
-
-      - name: Ensure Nix
-        shell: bash
-        run: bash Scripts/ci/ensure-nix.sh
-
-      - name: Namespace Cache
-        shell: bash
-        run: |
-          set -euo pipefail
-          NIX_BIN="$(bash Scripts/ci/resolve-nix-bin.sh)"
-          "$NIX_BIN" develop .#ci --command bash Scripts/ci/nscloud-cache.sh bazel
-
-      - name: Configure Age
-        id: age_apple
-        continue-on-error: true
-        shell: bash
-        env:
-          AGE_FORGE_SSH_KEY: ${{ secrets.AGE_FORGE_SSH_KEY }}
-        run: Scripts/resolve-age-identity.sh >> "$GITHUB_ENV"
-
-      - name: Decrypt Release Secrets
-        if: ${{ steps.age_apple.outcome == 'success' }}
-        uses: ./.forgejo/actions/decrypt-release-secrets
-
-      - name: Sync Apple Provisioning Profiles
-        shell: bash
-        env:
-          PLATFORM: ${{ matrix.platform }}
-        run: |
-          set -euo pipefail
-          NIX_BIN="$(bash Scripts/ci/resolve-nix-bin.sh)"
-          "$NIX_BIN" develop .#ci --command Scripts/ci/sync-apple-provisioning-profiles.sh "$PLATFORM"
-
-      - name: Install Apple Signing Assets
-        shell: bash
-        run: Scripts/ci/install-apple-signing-assets.sh
-
-      - name: Build Apple Release
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }}
-          PLATFORM: ${{ matrix.platform }}
-          UPLOAD_APP_STORE: ${{ github.event.inputs.upload_app_store || 'true' }}
-          UPLOAD_SPARKLE: ${{ github.event.inputs.upload_sparkle || 'true' }}
-          SPARKLE_CHANNEL: build-${{ needs.prepare.outputs.build_number }}
-        run: |
-          set -euo pipefail
-          require_signing=false
-          if [[ "$UPLOAD_APP_STORE" == "true" && "$PLATFORM" == "ios" ]]; then
-            require_signing=true
-          fi
-          if [[ "$UPLOAD_SPARKLE" == "true" && "$PLATFORM" == "macos" ]]; then
-            require_signing=true
-          fi
-
-          bazel_args=()
-          if [[ -n "${BURROW_BAZEL_NSCCACHE_BAZELRC:-}" && -f "${BURROW_BAZEL_NSCCACHE_BAZELRC:-}" ]]; then
-            bazel_args+=("--bazelrc=${BURROW_BAZEL_NSCCACHE_BAZELRC}")
-          fi
-
-          NIX_BIN="$(bash Scripts/ci/resolve-nix-bin.sh)"
-          ci_path="$("$NIX_BIN" develop .#ci --command bash -lc 'printf "%s" "$PATH"')"
-          ci_protoc="$("$NIX_BIN" develop .#ci --command bash -lc 'command -v protoc')"
-          "$NIX_BIN" develop .#ci --command bazel "${bazel_args[@]}" build \
-            --verbose_failures \
-            --show_timestamps \
-            --experimental_ui_max_stdouterr_bytes=16777216 \
-            --action_env=PATH="$ci_path" \
-            --action_env=PROTOC="$ci_protoc" \
-            --action_env=BUILD_WORKSPACE_DIRECTORY="$PWD" \
-            --action_env=BUILD_NUMBER="$BUILD_NUMBER" \
-            --action_env=BURROW_RELEASE_OUT="$PWD/dist/builds/$BUILD_NUMBER" \
-            --action_env=BURROW_APPLE_SIGNING_READY="${BURROW_APPLE_SIGNING_READY:-0}" \
-            --action_env=BURROW_APPLE_SIGNING_MODE="${BURROW_APPLE_SIGNING_MODE:-keychain}" \
-            --action_env=BURROW_APPLE_REQUIRE_SIGNING="$require_signing" \
-            --action_env=BURROW_APPLE_BUNDLE_ID="${BURROW_APPLE_BUNDLE_ID:-}" \
-            --action_env=BURROW_APPLE_NETWORK_EXTENSION_BUNDLE_ID="${BURROW_APPLE_NETWORK_EXTENSION_BUNDLE_ID:-}" \
-            --action_env=BURROW_APPLE_KEYCHAIN_PATH="${BURROW_APPLE_KEYCHAIN_PATH:-}" \
-            --action_env=BURROW_NOTARIZE_MACOS="${BURROW_NOTARIZE_MACOS:-false}" \
-            --action_env=BURROW_SPARKLE_SIGN_WITH_KMS="${BURROW_SPARKLE_SIGN_WITH_KMS:-false}" \
-            --action_env=BURROW_SPARKLE_KMS_KEY="${BURROW_SPARKLE_KMS_KEY:-sparkle-ed25519}" \
-            --action_env=BURROW_SPARKLE_KMS_VERSION="${BURROW_SPARKLE_KMS_VERSION:-1}" \
-            --action_env=BURROW_SPARKLE_FEED_URL="${BURROW_SPARKLE_FEED_URL:-https://releases.burrow.net/sparkle/appcast.xml}" \
-            --action_env=BURROW_SPARKLE_PUBLIC_ED_KEY="${BURROW_SPARKLE_PUBLIC_ED_KEY:-}" \
-            --action_env=GOOGLE_CLOUD_PROJECT="${GOOGLE_CLOUD_PROJECT:-}" \
-            --action_env=ASC_API_KEY_ID="${ASC_API_KEY_ID:-}" \
-            --action_env=ASC_API_ISSUER_ID="${ASC_API_ISSUER_ID:-}" \
-            --action_env=ASC_API_KEY_PATH="${ASC_API_KEY_PATH:-}" \
-            --action_env=SPARKLE_CHANNEL="$SPARKLE_CHANNEL" \
-            --action_env=HOME="$HOME" \
-            --action_env=XDG_CACHE_HOME="$XDG_CACHE_HOME" \
-            "${{ matrix.bazel_target }}"
-
-      - name: Upload Apple Artifacts
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
-        with:
-          name: burrow-apple-${{ matrix.platform }}-${{ needs.prepare.outputs.build_number }}
-          path: |
-            dist/builds/${{ needs.prepare.outputs.build_number }}/apple/*
-            dist/builds/${{ needs.prepare.outputs.build_number }}/sparkle/**
-          if-no-files-found: error
-
-      - name: Upload Apple Artifacts To Release Storage
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }}
-        run: |
-          set -euo pipefail
-          bash Scripts/ci/ensure-nix.sh
-          nix develop .#ci -c Scripts/ci/upload-release-storage.sh
-
-  publish:
-    name: Publish (Forgejo)
-    needs:
-      - prepare
-      - build-linux
-      - build-windows
-      - build-apple
-    if: ${{ always() && needs.prepare.outputs.do_release == 'true' }}
-    runs-on: namespace-profile-linux-medium
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Download Artifacts
-        uses: https://code.forgejo.org/actions/download-artifact@v3
-        with:
-          path: dist/downloaded
-
-      - name: Prepare Release Assets
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }}
-        run: |
-          set -euo pipefail
-          mkdir -p dist
-          mkdir -p "dist/builds/${BUILD_NUMBER}/windows"
-          find dist/downloaded -path '*/burrow-windows-*/*' -type f -exec cp {} "dist/builds/${BUILD_NUMBER}/windows/" \;
-          find dist/downloaded -type f \( -name '*.tar.gz' -o -name '*.zip' -o -name '*.sha256' -o -name '*.ipa' -o -name '*.pkg' -o -name '*.dmg' -o -name 'README*.txt' \) -exec cp {} dist/ \;
-          rm -rf dist/downloaded
-          find dist -maxdepth 1 -type f -print | sort
-
-      - name: Upload Windows Artifacts To Release Storage
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }}
-        run: |
-          set -euo pipefail
-          if ! find "dist/builds/${BUILD_NUMBER}/windows" -type f -print -quit | grep -q .; then
-            echo "::warning ::No Windows artifacts staged for release storage upload."
-            exit 0
-          fi
-          bash Scripts/ci/ensure-nix.sh
-          nix develop .#ci -c Scripts/ci/upload-release-storage.sh
-
-      - name: Tag Build
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }}
-        run: |
-          set -euo pipefail
-          tag="builds/${BUILD_NUMBER}"
-          head_commit="$(git rev-parse HEAD)"
-          remote_commit="$(git ls-remote --tags --refs origin "refs/tags/${tag}" | awk 'NR==1 { print $1 }')"
-          if [[ -n "$remote_commit" && "$remote_commit" != "$head_commit" ]]; then
-            echo "::error ::Remote tag ${tag} already points at ${remote_commit}, not ${head_commit}" >&2
-            exit 1
-          fi
-          git tag -f "$tag" "$head_commit"
-          git push --quiet --no-verify origin "refs/tags/${tag}:refs/tags/${tag}"
-
-      - name: Publish Forgejo Release
-        shell: bash
-        env:
-          RELEASE_TAG: builds/${{ needs.prepare.outputs.build_number }}
-          API_URL: ${{ github.api_url }}
-          REPOSITORY: ${{ github.repository }}
-          TOKEN: ${{ github.token }}
-        run: Scripts/ci/publish-forgejo-release.sh
-
-      - name: Dispatch Store Uploads
-        shell: bash
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-          BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }}
-          UPLOAD_APP_STORE: ${{ github.event.inputs.upload_app_store || 'true' }}
-          UPLOAD_SPARKLE: ${{ github.event.inputs.upload_sparkle || 'true' }}
-          UPLOAD_MICROSOFT_STORE: ${{ github.event.inputs.upload_microsoft_store || 'false' }}
-          SPARKLE_POINT_MAIN: ${{ github.event.inputs.sparkle_point_main || 'true' }}
-          TESTFLIGHT_DISTRIBUTE_EXTERNAL: ${{ github.event.inputs.testflight_distribute_external || 'false' }}
-          TESTFLIGHT_GROUPS: ${{ github.event.inputs.testflight_groups || '' }}
-          IOS_USES_NON_EXEMPT_ENCRYPTION: ${{ github.event.inputs.ios_uses_non_exempt_encryption || 'false' }}
-        run: |
-          set -euo pipefail
-          inputs="$(python3 -c 'import json, os; print(json.dumps({"build_number":os.environ["BUILD_NUMBER"],"upload_app_store":os.environ["UPLOAD_APP_STORE"],"upload_sparkle":os.environ["UPLOAD_SPARKLE"],"upload_microsoft_store":os.environ["UPLOAD_MICROSOFT_STORE"],"sparkle_point_main":os.environ["SPARKLE_POINT_MAIN"],"testflight_distribute_external":os.environ["TESTFLIGHT_DISTRIBUTE_EXTERNAL"],"testflight_groups":os.environ["TESTFLIGHT_GROUPS"],"ios_uses_non_exempt_encryption":os.environ["IOS_USES_NON_EXEMPT_ENCRYPTION"]}))')"
-          curl -fsS \
-            -X POST \
-            -H "Authorization: token ${GITHUB_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "{\"ref\":\"main\",\"inputs\":${inputs}}" \
-            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/actions/workflows/publish-store-uploads.yml/dispatches"
diff --git a/.forgejo/workflows/build-rust.yml b/.forgejo/workflows/build-rust.yml
deleted file mode 100644
index 9ed49e1..0000000
--- a/.forgejo/workflows/build-rust.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-name: Build Rust
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - "**"
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  rust:
-    name: Cargo Test
-    runs-on: [self-hosted, linux, x86_64, burrow-forge]
-    steps:
-      - name: Checkout
-        shell: bash
-        run: |
-          set -euo pipefail
-          repo_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
-          if [ ! -d .git ]; then
-            git init .
-          fi
-          if git remote get-url origin >/dev/null 2>&1; then
-            git remote set-url origin "${repo_url}"
-          else
-            git remote add origin "${repo_url}"
-          fi
-          git fetch --force --tags origin "${GITHUB_SHA}"
-          git checkout --force --detach FETCH_HEAD
-          git clean -ffdqx
-
-      - name: Test
-        shell: bash
-        run: |
-          set -euo pipefail
-          nix develop .#ci -c cargo test --workspace --all-features
diff --git a/.forgejo/workflows/build-site.yml b/.forgejo/workflows/build-site.yml
deleted file mode 100644
index 67be5bb..0000000
--- a/.forgejo/workflows/build-site.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-name: Build Site
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - "**"
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  site:
-    name: Next.js Build
-    runs-on: [self-hosted, linux, x86_64, burrow-forge]
-    steps:
-      - name: Checkout
-        shell: bash
-        run: |
-          set -euo pipefail
-          repo_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
-          if [ ! -d .git ]; then
-            git init .
-          fi
-          if git remote get-url origin >/dev/null 2>&1; then
-            git remote set-url origin "${repo_url}"
-          else
-            git remote add origin "${repo_url}"
-          fi
-          git fetch --force --tags origin "${GITHUB_SHA}"
-          git checkout --force --detach FETCH_HEAD
-          git clean -ffdqx
-
-      - name: Build
-        shell: bash
-        run: |
-          set -euo pipefail
-          nix develop .#ci -c bash -lc 'cd site && npm ci --no-audit --no-fund && npm run build'
diff --git a/.forgejo/workflows/distribute-testflight.yml b/.forgejo/workflows/distribute-testflight.yml
deleted file mode 100644
index 8962c9a..0000000
--- a/.forgejo/workflows/distribute-testflight.yml
+++ /dev/null
@@ -1,71 +0,0 @@
-name: "Apple: Distribute TestFlight"
-run-name: "Apple: Distribute TestFlight (Build ${{ inputs.build_number }})"
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_number:
-        description: Already-uploaded App Store Connect build number
-        required: true
-      testflight_distribute_external:
-        description: Distribute to external TestFlight groups
-        required: false
-        default: "false"
-      testflight_groups:
-        description: Optional comma-separated TestFlight groups
-        required: false
-        default: ""
-      ios_uses_non_exempt_encryption:
-        description: Set true only when the iOS build uses non-exempt encryption
-        required: false
-        default: "false"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: burrow-distribute-testflight-${{ inputs.build_number }}
-  cancel-in-progress: true
-
-env:
-  BURROW_NIX_CACHE_URL: ${{ vars.BURROW_NIX_CACHE_URL || 'https://nix.burrow.net/burrow' }}
-  BURROW_NIX_CACHE_PUBLIC_KEY: ${{ vars.BURROW_NIX_CACHE_PUBLIC_KEY }}
-  BURROW_APPLE_BUNDLE_ID: ${{ vars.BURROW_APPLE_BUNDLE_ID || 'net.burrow.app' }}
-  TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS: ${{ vars.TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS || '7200' }}
-
-jobs:
-  distribute-ios-testflight:
-    name: Distribute (TestFlight iOS Testers)
-    runs-on: namespace-profile-linux-testflight
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Ensure Nix
-        shell: bash
-        run: bash Scripts/ci/ensure-nix.sh
-
-      - name: Configure Age
-        shell: bash
-        env:
-          AGE_FORGE_SSH_KEY: ${{ secrets.AGE_FORGE_SSH_KEY }}
-        run: Scripts/resolve-age-identity.sh >> "$GITHUB_ENV"
-
-      - name: Decrypt Release Secrets
-        uses: ./.forgejo/actions/decrypt-release-secrets
-
-      - name: Validate App Store Credentials
-        shell: bash
-        run: Scripts/ci/check-release-config.sh app-store
-
-      - name: Distribute iOS Build To TestFlight
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ inputs.build_number }}
-          TESTFLIGHT_DISTRIBUTE_EXTERNAL: ${{ inputs.testflight_distribute_external || 'false' }}
-          TESTFLIGHT_GROUPS: ${{ inputs.testflight_groups || '' }}
-          IOS_USES_NON_EXEMPT_ENCRYPTION: ${{ inputs.ios_uses_non_exempt_encryption || 'false' }}
-        run: Scripts/ci/distribute-testflight.sh
diff --git a/.forgejo/workflows/infra-opentofu.yml b/.forgejo/workflows/infra-opentofu.yml
deleted file mode 100644
index dad4f01..0000000
--- a/.forgejo/workflows/infra-opentofu.yml
+++ /dev/null
@@ -1,237 +0,0 @@
-name: "Infra: OpenTofu"
-run-name: "Infra: OpenTofu (${{ github.event.inputs.stack || 'grafana' }} ${{ github.event.inputs.mode || 'validate' }})"
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - ".forgejo/workflows/infra-opentofu.yml"
-      - "Scripts/grafana-tofu.sh"
-      - "Scripts/identity-tofu.sh"
-      - "Scripts/openbao-tofu.sh"
-      - "Scripts/releases-tofu.sh"
-      - "infra/grafana/**"
-      - "infra/identity/**"
-      - "infra/openbao/**"
-      - "infra/releases/**"
-      - "services/grafana/**"
-  workflow_dispatch:
-    inputs:
-      stack:
-        description: OpenTofu stack to run
-        required: true
-        default: grafana
-        type: choice
-        options:
-          - grafana
-          - identity
-          - openbao
-          - releases
-      mode:
-        description: OpenTofu mode
-        required: true
-        default: plan
-        type: choice
-        options:
-          - fmt
-          - validate
-          - plan
-          - apply
-          - import
-      apply_confirmation:
-        description: Type apply-burrow-<stack>-tofu to run apply
-        required: false
-        default: ""
-      import_address:
-        description: OpenTofu resource address for import mode
-        required: false
-        default: ""
-      import_id:
-        description: Provider import id for import mode
-        required: false
-        default: ""
-
-permissions:
-  contents: read
-
-concurrency:
-  group: infra-opentofu-${{ github.ref }}-${{ github.event.inputs.stack || 'grafana' }}
-  cancel-in-progress: false
-
-jobs:
-  opentofu:
-    name: OpenTofu (${{ github.event.inputs.stack || 'grafana' }})
-    runs-on: [self-hosted, linux, x86_64, burrow-forge]
-    timeout-minutes: 30
-    env:
-      MODE: ${{ github.event.inputs.mode || 'validate' }}
-      STACK: ${{ github.event.inputs.stack || 'grafana' }}
-      APPLY_CONFIRMATION: ${{ github.event.inputs.apply_confirmation || '' }}
-      IMPORT_ADDRESS: ${{ github.event.inputs.import_address || '' }}
-      IMPORT_ID: ${{ github.event.inputs.import_id || '' }}
-      TF_INPUT: "false"
-      TF_IN_AUTOMATION: "true"
-      TF_VAR_grafana_url: ${{ vars.GRAFANA_URL || 'https://graphs.burrow.net' }}
-      TF_VAR_google_project_id: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
-      TF_VAR_google_project_number: ${{ vars.GOOGLE_PROJECT_NUMBER || '416198671487' }}
-      TF_VAR_google_runner_service_account_email: ${{ vars.BURROW_GOOGLE_WIF_SERVICE_ACCOUNT || 'burrow-forgejo-runner@project-88c23ce9-918a-470a-b33.iam.gserviceaccount.com' }}
-      TF_VAR_google_wif_runner_client_id: ${{ vars.BURROW_AUTHENTIK_WIF_CLIENT_ID || 'google-wif.burrow.net' }}
-      TF_VAR_google_release_bucket_name: ${{ vars.BURROW_RELEASE_GCS_BUCKET || 'burrow-net-releases' }}
-      TF_VAR_google_package_bucket_name: ${{ vars.BURROW_PACKAGE_GCS_BUCKET || 'burrow-net-packages' }}
-      TF_VAR_google_nix_cache_bucket_name: ${{ vars.BURROW_NIX_CACHE_GCS_BUCKET || 'burrow-net-nix-cache' }}
-      TF_VAR_google_nix_cache_public_read: ${{ vars.BURROW_NIX_CACHE_GCS_PUBLIC_READ || 'false' }}
-      TF_VAR_google_storage_location: ${{ vars.BURROW_GCS_LOCATION || 'US' }}
-      BURROW_GOOGLE_PROJECT_ID: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
-      GOOGLE_CLOUD_PROJECT: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
-      BURROW_GOOGLE_PROJECT_NUMBER: ${{ vars.GOOGLE_PROJECT_NUMBER || '416198671487' }}
-      BURROW_GOOGLE_WIF_POOL_ID: ${{ vars.BURROW_GOOGLE_WIF_POOL_ID || 'burrow-authentik' }}
-      BURROW_GOOGLE_WIF_PROVIDER_ID: ${{ vars.BURROW_GOOGLE_WIF_PROVIDER_ID || 'forgejo-runners' }}
-      BURROW_GOOGLE_WIF_SERVICE_ACCOUNT: ${{ vars.BURROW_GOOGLE_WIF_SERVICE_ACCOUNT || 'burrow-forgejo-runner@project-88c23ce9-918a-470a-b33.iam.gserviceaccount.com' }}
-      BURROW_AUTHENTIK_WIF_ISSUER: ${{ vars.BURROW_AUTHENTIK_WIF_ISSUER || 'https://auth.burrow.net/application/o/google-cloud/' }}
-      BURROW_AUTHENTIK_WIF_AUDIENCE: ${{ vars.BURROW_AUTHENTIK_WIF_AUDIENCE || 'google-wif.burrow.net' }}
-      BURROW_AUTHENTIK_WIF_CLIENT_ID: ${{ vars.BURROW_AUTHENTIK_WIF_CLIENT_ID || 'google-wif.burrow.net' }}
-      BURROW_AUTHENTIK_WIF_CLIENT_SECRET: ${{ secrets.BURROW_AUTHENTIK_WIF_CLIENT_SECRET }}
-      BURROW_NIX_CACHE_URL: ${{ vars.BURROW_NIX_CACHE_URL || 'https://nix.burrow.net/burrow' }}
-      BURROW_NIX_CACHE_PUBLIC_KEY: ${{ vars.BURROW_NIX_CACHE_PUBLIC_KEY }}
-      OPENTOFU_STATE_BUCKET: ${{ vars.OPENTOFU_STATE_BUCKET || '' }}
-      OPENTOFU_STATE_REGION: ${{ vars.OPENTOFU_STATE_REGION || vars.AWS_REGION || 'us-west-2' }}
-      OPENTOFU_STATE_DYNAMODB_TABLE: ${{ vars.OPENTOFU_STATE_DYNAMODB_TABLE || '' }}
-    steps:
-      - name: Checkout
-        shell: bash
-        run: |
-          set -euo pipefail
-          repo_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
-          if [ ! -d .git ]; then
-            git init .
-          fi
-          if git remote get-url origin >/dev/null 2>&1; then
-            git remote set-url origin "${repo_url}"
-          else
-            git remote add origin "${repo_url}"
-          fi
-          git fetch --force --tags origin "${GITHUB_SHA}"
-          git checkout --force --detach FETCH_HEAD
-          git clean -ffdqx
-
-      - name: Validate Request
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          case "$STACK" in
-            grafana|identity|openbao|releases) ;;
-            *)
-              echo "::error ::Unsupported OpenTofu stack: $STACK" >&2
-              exit 2
-              ;;
-          esac
-
-          case "$MODE" in
-            fmt|validate|plan|apply|import) ;;
-            *)
-              echo "::error ::Unsupported OpenTofu mode: $MODE" >&2
-              exit 2
-              ;;
-          esac
-
-          if [[ "${GITHUB_EVENT_NAME}" != "workflow_dispatch" && "$MODE" != "validate" ]]; then
-            echo "::error ::Non-manual runs may only validate." >&2
-            exit 2
-          fi
-
-          if [[ "$MODE" == "apply" && "$APPLY_CONFIRMATION" != "apply-burrow-${STACK}-tofu" ]]; then
-            echo "::error ::apply_confirmation must be exactly apply-burrow-${STACK}-tofu." >&2
-            exit 1
-          fi
-
-          if [[ "$MODE" == "import" && ( -z "$IMPORT_ADDRESS" || -z "$IMPORT_ID" ) ]]; then
-            echo "::error ::import mode requires import_address and import_id." >&2
-            exit 2
-          fi
-
-      - name: Configure Age
-        if: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.mode == 'plan' || github.event.inputs.mode == 'apply' || github.event.inputs.mode == 'import') }}
-        shell: bash
-        env:
-          AGE_FORGE_SSH_KEY: ${{ secrets.AGE_FORGE_SSH_KEY }}
-        run: Scripts/resolve-age-identity.sh >> "$GITHUB_ENV"
-
-      - name: Configure Grafana Provider Auth
-        if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.stack == 'grafana' && (github.event.inputs.mode == 'plan' || github.event.inputs.mode == 'apply' || github.event.inputs.mode == 'import') }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          : "${AGE_IDENTITY_PATH:?AGE_IDENTITY_PATH is required}"
-          agenix="$(nix build --no-link .#agenix --print-out-paths | tail -n1)/bin/agenix"
-          password="$("$agenix" --identity "$AGE_IDENTITY_PATH" --decrypt secrets/infra/grafana-admin-password.age | tr -d '\r')"
-
-          echo "::add-mask::${password}"
-          {
-            echo "TF_VAR_grafana_auth<<EOF"
-            printf 'admin:%s\n' "$password"
-            echo "EOF"
-          } >> "$GITHUB_ENV"
-
-      - name: Configure OpenTofu Backend
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          stack_dir="infra/${STACK}"
-          rm -f "${stack_dir}/backend.hcl"
-          if [[ -n "$OPENTOFU_STATE_BUCKET" ]]; then
-            {
-              printf 'bucket = "%s"\n' "$OPENTOFU_STATE_BUCKET"
-              printf 'key = "%s"\n' "${STACK}/${STACK}.tfstate"
-              printf 'region = "%s"\n' "$OPENTOFU_STATE_REGION"
-              printf 'encrypt = true\n'
-              if [[ -n "$OPENTOFU_STATE_DYNAMODB_TABLE" ]]; then
-                printf 'dynamodb_table = "%s"\n' "$OPENTOFU_STATE_DYNAMODB_TABLE"
-              fi
-            } > "${stack_dir}/backend.hcl"
-          elif [[ "$MODE" == "apply" || "$MODE" == "import" ]]; then
-            echo "::error ::OPENTOFU_STATE_BUCKET is required for apply/import." >&2
-            exit 1
-          fi
-
-      - name: Authenticate Google WIF
-        if: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.stack == 'identity' || github.event.inputs.stack == 'releases') && (github.event.inputs.mode == 'plan' || github.event.inputs.mode == 'apply' || github.event.inputs.mode == 'import') }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          nix develop .#ci -c Scripts/ci/google-wif-auth.sh
-
-      - name: Run OpenTofu
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          stack_script="Scripts/${STACK}-tofu.sh"
-          case "$MODE" in
-            fmt)
-              nix develop .#ci -c tofu -chdir="infra/${STACK}" fmt -check
-              ;;
-            validate)
-              "$stack_script" init -backend=false
-              "$stack_script" validate
-              ;;
-            plan)
-              if [[ -f "infra/${STACK}/backend.hcl" ]]; then
-                "$stack_script" init -backend-config=backend.hcl
-              else
-                "$stack_script" init -backend=false
-              fi
-              "$stack_script" plan
-              ;;
-            apply)
-              "$stack_script" init -backend-config=backend.hcl
-              "$stack_script" apply -auto-approve
-              ;;
-            import)
-              "$stack_script" init -backend-config=backend.hcl
-              "$stack_script" import "$IMPORT_ADDRESS" "$IMPORT_ID"
-              ;;
-          esac
diff --git a/.forgejo/workflows/lint-governance.yml b/.forgejo/workflows/lint-governance.yml
deleted file mode 100644
index 2db94cc..0000000
--- a/.forgejo/workflows/lint-governance.yml
+++ /dev/null
@@ -1,38 +0,0 @@
-name: Lint Governance
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - "**"
-  workflow_dispatch:
-
-jobs:
-  governance:
-    name: BEP Metadata
-    runs-on: [self-hosted, linux, x86_64, burrow-forge]
-    steps:
-      - name: Checkout
-        shell: bash
-        run: |
-          set -euo pipefail
-          repo_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
-          if [ ! -d .git ]; then
-            git init .
-          fi
-          if git remote get-url origin >/dev/null 2>&1; then
-            git remote set-url origin "${repo_url}"
-          else
-            git remote add origin "${repo_url}"
-          fi
-          git fetch --force --tags origin "${GITHUB_SHA}"
-          git checkout --force --detach FETCH_HEAD
-          git clean -ffdqx
-
-      - name: Validate BEP metadata
-        shell: bash
-        run: |
-          set -euo pipefail
-          python3 Scripts/check-bep-metadata.py
diff --git a/.forgejo/workflows/publish-nix-cache.yml b/.forgejo/workflows/publish-nix-cache.yml
deleted file mode 100644
index 5ff5d27..0000000
--- a/.forgejo/workflows/publish-nix-cache.yml
+++ /dev/null
@@ -1,63 +0,0 @@
-name: "Cache: Publish Nix"
-run-name: "Publish Nix Cache (${{ github.ref_name }})"
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - ".forgejo/workflows/publish-nix-cache.yml"
-      - "Cargo.lock"
-      - "Cargo.toml"
-      - "flake.lock"
-      - "flake.nix"
-      - "crates/**"
-      - "services/forgejo-nsc/**"
-      - "nixos/**"
-      - "Scripts/ci/ensure-nix.sh"
-      - "Scripts/ci/publish-nix-cache.sh"
-  workflow_dispatch:
-    inputs:
-      attrs:
-        description: Space-separated flake attrs to build and push
-        required: false
-        default: ".#burrow .#forgejo-nsc-dispatcher .#forgejo-nsc-autoscaler"
-      required:
-        description: Fail when the cache push token is missing
-        required: false
-        default: "false"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: publish-nix-cache-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  publish:
-    name: Publish Nix Cache
-    runs-on: namespace-profile-linux-medium
-    timeout-minutes: 45
-    env:
-      BURROW_NIX_CACHE_SERVER_NAME: ${{ vars.BURROW_NIX_CACHE_SERVER_NAME || 'burrow' }}
-      BURROW_NIX_CACHE_SERVER_URL: ${{ vars.BURROW_NIX_CACHE_SERVER_URL || 'https://nix.burrow.net' }}
-      BURROW_NIX_CACHE_NAME: ${{ vars.BURROW_NIX_CACHE_NAME || 'burrow' }}
-      BURROW_NIX_CACHE_URL: ${{ vars.BURROW_NIX_CACHE_URL || 'https://nix.burrow.net/burrow' }}
-      BURROW_NIX_CACHE_PUBLIC_KEY: ${{ vars.BURROW_NIX_CACHE_PUBLIC_KEY }}
-      BURROW_NIX_CACHE_PUSH_TOKEN: ${{ secrets.BURROW_NIX_CACHE_PUSH_TOKEN }}
-      BURROW_NIX_CACHE_ATTRS: ${{ github.event.inputs.attrs || '.#burrow .#forgejo-nsc-dispatcher .#forgejo-nsc-autoscaler' }}
-      BURROW_NIX_CACHE_REQUIRED: ${{ github.event.inputs.required || 'false' }}
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Ensure Nix
-        shell: bash
-        run: bash Scripts/ci/ensure-nix.sh
-
-      - name: Publish Cache Paths
-        shell: bash
-        run: nix develop .#ci -c Scripts/ci/publish-nix-cache.sh
diff --git a/.forgejo/workflows/publish-package-repositories.yml b/.forgejo/workflows/publish-package-repositories.yml
deleted file mode 100644
index 315e43b..0000000
--- a/.forgejo/workflows/publish-package-repositories.yml
+++ /dev/null
@@ -1,148 +0,0 @@
-name: "Publish: Package Repositories"
-run-name: "Publish Package Repositories (${{ github.event.inputs.channel || 'stable' }})"
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_number:
-        description: Build number or release label for package artifact paths
-        required: false
-        default: ""
-      channel:
-        description: Native package repository channel
-        required: true
-        default: stable
-        type: choice
-        options:
-          - stable
-          - beta
-          - nightly
-      publish_gcs:
-        description: Publish repository tree to configured package storage targets
-        required: false
-        default: "true"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: publish-package-repositories-${{ github.ref }}-${{ github.event.inputs.channel || 'stable' }}
-  cancel-in-progress: false
-
-jobs:
-  publish:
-    name: Build Native Repositories
-    runs-on: [self-hosted, linux, x86_64, burrow-forge]
-    timeout-minutes: 45
-    env:
-      BUILD_NUMBER: ${{ github.event.inputs.build_number || github.sha }}
-      BURROW_PACKAGE_CHANNEL: ${{ github.event.inputs.channel || 'stable' }}
-      BURROW_KMS_LOCATION: ${{ vars.BURROW_KMS_LOCATION || 'global' }}
-      BURROW_KMS_KEYRING: ${{ vars.BURROW_KMS_KEYRING || 'burrow-identity' }}
-      BURROW_KMS_VERSION: ${{ vars.BURROW_KMS_VERSION || '1' }}
-      BURROW_GOOGLE_PROJECT_ID: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
-      GOOGLE_CLOUD_PROJECT: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
-      BURROW_GOOGLE_PROJECT_NUMBER: ${{ vars.GOOGLE_PROJECT_NUMBER || '416198671487' }}
-      BURROW_GOOGLE_WIF_POOL_ID: ${{ vars.BURROW_GOOGLE_WIF_POOL_ID || 'burrow-authentik' }}
-      BURROW_GOOGLE_WIF_PROVIDER_ID: ${{ vars.BURROW_GOOGLE_WIF_PROVIDER_ID || 'forgejo-runners' }}
-      BURROW_GOOGLE_WIF_SERVICE_ACCOUNT: ${{ vars.BURROW_GOOGLE_WIF_SERVICE_ACCOUNT || 'burrow-forgejo-runner@project-88c23ce9-918a-470a-b33.iam.gserviceaccount.com' }}
-      BURROW_AUTHENTIK_WIF_ISSUER: ${{ vars.BURROW_AUTHENTIK_WIF_ISSUER || 'https://auth.burrow.net/application/o/google-cloud/' }}
-      BURROW_AUTHENTIK_WIF_AUDIENCE: ${{ vars.BURROW_AUTHENTIK_WIF_AUDIENCE || 'google-wif.burrow.net' }}
-      BURROW_AUTHENTIK_WIF_CLIENT_ID: ${{ vars.BURROW_AUTHENTIK_WIF_CLIENT_ID || 'google-wif.burrow.net' }}
-      BURROW_AUTHENTIK_WIF_CLIENT_SECRET: ${{ secrets.BURROW_AUTHENTIK_WIF_CLIENT_SECRET }}
-      BURROW_PACKAGE_GCS_BUCKET: ${{ vars.BURROW_PACKAGE_GCS_BUCKET || 'burrow-net-packages' }}
-      BURROW_PACKAGE_GCS_PREFIX: ${{ vars.BURROW_PACKAGE_GCS_PREFIX || '' }}
-      BURROW_PACKAGE_GCS_BACKUP: ${{ vars.BURROW_PACKAGE_GCS_BACKUP || 'true' }}
-      BURROW_PACKAGE_GARAGE_BUCKET: ${{ vars.BURROW_PACKAGE_GARAGE_BUCKET || 'burrow-packages' }}
-      BURROW_PACKAGE_GARAGE_PREFIX: ${{ vars.BURROW_PACKAGE_GARAGE_PREFIX || vars.BURROW_PACKAGE_GCS_PREFIX || '' }}
-      BURROW_PACKAGE_REQUIRE_GARAGE: ${{ vars.BURROW_PACKAGE_REQUIRE_GARAGE || 'true' }}
-      BURROW_GARAGE_ENDPOINT: ${{ vars.BURROW_GARAGE_ENDPOINT || 'https://objects.burrow.net' }}
-      BURROW_GARAGE_REGION: ${{ vars.BURROW_GARAGE_REGION || 'garage' }}
-      AWS_ACCESS_KEY_ID: ${{ secrets.BURROW_GARAGE_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.BURROW_GARAGE_SECRET_ACCESS_KEY }}
-      BURROW_NIX_CACHE_URL: ${{ vars.BURROW_NIX_CACHE_URL || 'https://nix.burrow.net/burrow' }}
-      BURROW_NIX_CACHE_PUBLIC_KEY: ${{ vars.BURROW_NIX_CACHE_PUBLIC_KEY }}
-    steps:
-      - name: Checkout
-        shell: bash
-        run: |
-          set -euo pipefail
-          repo_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
-          if [ ! -d .git ]; then
-            git init .
-          fi
-          if git remote get-url origin >/dev/null 2>&1; then
-            git remote set-url origin "${repo_url}"
-          else
-            git remote add origin "${repo_url}"
-          fi
-          git fetch --force --tags origin "${GITHUB_SHA}"
-          git checkout --force --detach FETCH_HEAD
-          git clean -ffdqx
-
-      - name: Ensure Nix
-        shell: bash
-        run: bash Scripts/ci/ensure-nix.sh
-
-      - name: Build Linux Packages
-        shell: bash
-        run: |
-          set -euo pipefail
-          export BURROW_RELEASE_OUT="$PWD/dist/builds/$BUILD_NUMBER"
-          nix develop .#ci -c Scripts/ci/package-release-artifacts.sh linux
-
-      - name: Authenticate Google WIF
-        shell: bash
-        run: |
-          set -euo pipefail
-          nix develop .#ci -c Scripts/ci/google-wif-auth.sh
-
-      - name: Export KMS Public Keys
-        shell: bash
-        run: |
-          set -euo pipefail
-          mkdir -p "$PWD/.kms"
-
-          export BURROW_APT_REPO_KMS_KEY="${BURROW_APT_REPO_KMS_KEY:-package-apt-repository}"
-          export BURROW_RPM_REPO_KMS_KEY="${BURROW_RPM_REPO_KMS_KEY:-package-rpm-repository}"
-          export BURROW_PACMAN_REPO_KMS_KEY="${BURROW_PACMAN_REPO_KMS_KEY:-package-pacman-repository}"
-
-          for item in \
-            "APT:${BURROW_APT_REPO_KMS_KEY}:apt" \
-            "RPM:${BURROW_RPM_REPO_KMS_KEY}:rpm" \
-            "PACMAN:${BURROW_PACMAN_REPO_KMS_KEY}:pacman"
-          do
-            IFS=: read -r env_prefix key_name file_prefix <<< "$item"
-            pem="$PWD/.kms/${file_prefix}.pem"
-            nix develop .#ci -c gcloud kms keys versions get-public-key "$BURROW_KMS_VERSION" \
-              --location "$BURROW_KMS_LOCATION" \
-              --keyring "$BURROW_KMS_KEYRING" \
-              --key "$key_name" \
-              --project "$GOOGLE_CLOUD_PROJECT" \
-              --output-file "$pem"
-            echo "BURROW_${env_prefix}_REPO_KMS_PUBLIC_KEY_PEM=$pem" >> "$GITHUB_ENV"
-            echo "BURROW_${env_prefix}_REPO_KMS_KEY=$key_name" >> "$GITHUB_ENV"
-          done
-
-      - name: Build Repository Metadata
-        shell: bash
-        run: |
-          set -euo pipefail
-          export BURROW_PACKAGE_INPUT_DIR="$PWD/dist/builds/$BUILD_NUMBER/linux"
-          export BURROW_PACKAGE_REPOSITORY_DIR="$PWD/dist/builds/$BUILD_NUMBER/repositories"
-          nix develop .#ci -c Scripts/package/build-repositories.sh all
-
-      - name: Upload Repository Artifact
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
-        with:
-          name: burrow-package-repositories-${{ github.event.inputs.channel || 'stable' }}-${{ github.event.inputs.build_number || github.sha }}
-          path: dist/builds/${{ github.event.inputs.build_number || github.sha }}/repositories/**
-          if-no-files-found: error
-
-      - name: Publish Package Repository To Storage
-        if: ${{ github.event.inputs.publish_gcs == 'true' }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          export BURROW_PACKAGE_REPOSITORY_DIR="$PWD/dist/builds/$BUILD_NUMBER/repositories"
-          nix develop .#ci -c Scripts/ci/upload-package-storage.sh
diff --git a/.forgejo/workflows/publish-store-uploads.yml b/.forgejo/workflows/publish-store-uploads.yml
deleted file mode 100644
index 904abce..0000000
--- a/.forgejo/workflows/publish-store-uploads.yml
+++ /dev/null
@@ -1,385 +0,0 @@
-name: "Publish: Release Uploads"
-run-name: "Publish: Release Uploads (Build ${{ inputs.build_number }})"
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_number:
-        description: Build number to publish
-        required: true
-      upload_app_store:
-        description: Upload iOS/macOS/visionOS artifacts to App Store Connect
-        required: false
-        default: "true"
-      distribute_testflight:
-        description: Distribute an already-uploaded iOS build to TestFlight
-        required: false
-        default: "false"
-      upload_sparkle:
-        description: Publish Sparkle artifacts
-        required: false
-        default: "true"
-      upload_microsoft_store:
-        description: Upload Windows package to Microsoft Partner Center beta lane
-        required: false
-        default: "false"
-      sparkle_channel:
-        description: Sparkle channel, defaults to build-<number>
-        required: false
-        default: ""
-      sparkle_point_main:
-        description: Point Sparkle main appcast/default channel to selected channel
-        required: false
-        default: "true"
-      testflight_distribute_external:
-        description: Distribute to external TestFlight groups
-        required: false
-        default: "false"
-      testflight_groups:
-        description: Optional comma-separated TestFlight groups for external distribution
-        required: false
-        default: ""
-      ios_uses_non_exempt_encryption:
-        description: Set true only when the iOS build uses non-exempt encryption
-        required: false
-        default: "false"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: burrow-publish-store-uploads-${{ inputs.build_number }}
-  cancel-in-progress: true
-
-env:
-  BURROW_RELEASE_GCS_BUCKET: ${{ vars.BURROW_RELEASE_GCS_BUCKET || 'burrow-net-releases' }}
-  BURROW_GOOGLE_PROJECT_ID: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
-  GOOGLE_CLOUD_PROJECT: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
-  BURROW_GOOGLE_PROJECT_NUMBER: ${{ vars.GOOGLE_PROJECT_NUMBER || '416198671487' }}
-  BURROW_GOOGLE_WIF_POOL_ID: ${{ vars.BURROW_GOOGLE_WIF_POOL_ID || 'burrow-authentik' }}
-  BURROW_GOOGLE_WIF_PROVIDER_ID: ${{ vars.BURROW_GOOGLE_WIF_PROVIDER_ID || 'forgejo-runners' }}
-  BURROW_GOOGLE_WIF_SERVICE_ACCOUNT: ${{ vars.BURROW_GOOGLE_WIF_SERVICE_ACCOUNT || 'burrow-forgejo-runner@project-88c23ce9-918a-470a-b33.iam.gserviceaccount.com' }}
-  BURROW_AUTHENTIK_WIF_ISSUER: ${{ vars.BURROW_AUTHENTIK_WIF_ISSUER || 'https://auth.burrow.net/application/o/google-cloud/' }}
-  BURROW_AUTHENTIK_WIF_AUDIENCE: ${{ vars.BURROW_AUTHENTIK_WIF_AUDIENCE || 'google-wif.burrow.net' }}
-  BURROW_AUTHENTIK_WIF_CLIENT_ID: ${{ vars.BURROW_AUTHENTIK_WIF_CLIENT_ID || 'google-wif.burrow.net' }}
-  BURROW_AUTHENTIK_WIF_CLIENT_SECRET: ${{ secrets.BURROW_AUTHENTIK_WIF_CLIENT_SECRET }}
-  BURROW_NIX_CACHE_URL: ${{ vars.BURROW_NIX_CACHE_URL || 'https://nix.burrow.net/burrow' }}
-  BURROW_NIX_CACHE_PUBLIC_KEY: ${{ vars.BURROW_NIX_CACHE_PUBLIC_KEY }}
-  BURROW_APPLE_BUNDLE_ID: ${{ vars.BURROW_APPLE_BUNDLE_ID || 'net.burrow.app' }}
-  BURROW_APPLE_NETWORK_EXTENSION_BUNDLE_ID: ${{ vars.BURROW_APPLE_NETWORK_EXTENSION_BUNDLE_ID || 'net.burrow.app.network' }}
-  BURROW_IOS_DISTRIBUTION_CERTIFICATE_ID: ${{ vars.BURROW_IOS_DISTRIBUTION_CERTIFICATE_ID || '3G42677598' }}
-  BURROW_DEVELOPER_ID_CERTIFICATE_ID: ${{ vars.BURROW_DEVELOPER_ID_CERTIFICATE_ID || '9JKN6HXBHC' }}
-  BURROW_APPLE_SIGNING_MODE: ${{ vars.BURROW_APPLE_SIGNING_MODE || 'google-kms-staged' }}
-  BURROW_NOTARIZE_MACOS: ${{ vars.BURROW_NOTARIZE_MACOS || 'true' }}
-  BURROW_SPARKLE_SIGN_WITH_KMS: ${{ vars.BURROW_SPARKLE_SIGN_WITH_KMS || 'true' }}
-  BURROW_SPARKLE_KMS_KEY: ${{ vars.BURROW_SPARKLE_KMS_KEY || 'sparkle-ed25519' }}
-  BURROW_SPARKLE_KMS_VERSION: ${{ vars.BURROW_SPARKLE_KMS_VERSION || '1' }}
-  BURROW_KMS_LOCATION: ${{ vars.BURROW_KMS_LOCATION || 'global' }}
-  BURROW_KMS_KEYRING: ${{ vars.BURROW_KMS_KEYRING || 'burrow-identity' }}
-  TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS: ${{ vars.TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS || '7200' }}
-
-jobs:
-  sign-apple-kms:
-    name: Sign (Apple KMS)
-    if: ${{ inputs.upload_app_store == 'true' || inputs.upload_sparkle == 'true' }}
-    runs-on: namespace-profile-linux-medium
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Ensure Nix
-        shell: bash
-        run: bash Scripts/ci/ensure-nix.sh
-
-      - name: Configure Age
-        shell: bash
-        env:
-          AGE_FORGE_SSH_KEY: ${{ secrets.AGE_FORGE_SSH_KEY }}
-        run: Scripts/resolve-age-identity.sh >> "$GITHUB_ENV"
-
-      - name: Decrypt Release Secrets
-        uses: ./.forgejo/actions/decrypt-release-secrets
-
-      - name: Validate App Store Credentials
-        shell: bash
-        run: Scripts/ci/check-release-config.sh app-store
-
-      - name: Download Staged Apple Artifacts
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ inputs.build_number }}
-        run: |
-          set -euo pipefail
-          nix develop .#ci -c Scripts/ci/google-wif-auth.sh
-          mkdir -p "dist/builds/${BUILD_NUMBER}/apple"
-          nix develop .#ci -c gcloud storage rsync --recursive "gs://${BURROW_RELEASE_GCS_BUCKET}/builds/${BUILD_NUMBER}/apple" "dist/builds/${BUILD_NUMBER}/apple"
-          find "dist/builds/${BUILD_NUMBER}/apple" -type f -print | sort
-
-      - name: Sync Apple Provisioning Profiles
-        shell: bash
-        run: nix develop .#ci -c Scripts/ci/sync-apple-provisioning-profiles.sh all
-
-      - name: Sign Apple Artifacts With KMS
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ inputs.build_number }}
-          SPARKLE_CHANNEL_INPUT: ${{ inputs.sparkle_channel }}
-        run: |
-          set -euo pipefail
-          channel="${SPARKLE_CHANNEL_INPUT:-}"
-          if [[ -z "$channel" ]]; then
-            channel="build-${BUILD_NUMBER}"
-          fi
-          SPARKLE_CHANNEL="$channel" nix develop .#ci -c Scripts/apple/sign-release-artifacts-kms.sh all
-
-      - name: Upload Signed Apple Artifacts
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ inputs.build_number }}
-        run: nix develop .#ci -c Scripts/ci/upload-release-storage.sh
-
-  upload-app-store:
-    name: Upload (App Store Connect)
-    needs: sign-apple-kms
-    if: ${{ inputs.upload_app_store == 'true' }}
-    runs-on: namespace-profile-macos-large
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Ensure Nix
-        shell: bash
-        run: bash Scripts/ci/ensure-nix.sh
-
-      - name: Configure Age
-        shell: bash
-        env:
-          AGE_FORGE_SSH_KEY: ${{ secrets.AGE_FORGE_SSH_KEY }}
-        run: Scripts/resolve-age-identity.sh >> "$GITHUB_ENV"
-
-      - name: Decrypt Release Secrets
-        uses: ./.forgejo/actions/decrypt-release-secrets
-
-      - name: Validate App Store Credentials
-        shell: bash
-        run: Scripts/ci/check-release-config.sh app-store
-
-      - name: Download Apple Artifacts From GCS
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ inputs.build_number }}
-        run: |
-          set -euo pipefail
-          nix develop .#ci -c Scripts/ci/google-wif-auth.sh
-          mkdir -p publish/apple
-          nix develop .#ci -c gcloud storage rsync --recursive "gs://${BURROW_RELEASE_GCS_BUCKET}/builds/${BUILD_NUMBER}/apple" publish/apple
-          find publish/apple -type f -print | sort
-
-      - name: Upload Apple Packages
-        shell: bash
-        run: |
-          set -euo pipefail
-          Scripts/ci/check-release-config.sh app-store
-          key_dir="${RUNNER_TEMP:-/tmp}/burrow-asc"
-          altool_key_dir="${HOME}/.appstoreconnect/private_keys"
-          mkdir -p "$key_dir" "$altool_key_dir"
-          key_path="$key_dir/AuthKey_${ASC_API_KEY_ID}.p8"
-          if [[ -n "${ASC_API_KEY_PATH:-}" && -f "${ASC_API_KEY_PATH:-}" ]]; then
-            cp "$ASC_API_KEY_PATH" "$key_path"
-          else
-            printf '%s' "$ASC_API_KEY_BASE64" | base64 --decode > "$key_path"
-          fi
-          cp "$key_path" "$altool_key_dir/AuthKey_${ASC_API_KEY_ID}.p8"
-          chmod 600 "$key_path" "$altool_key_dir/AuthKey_${ASC_API_KEY_ID}.p8"
-          shopt -s nullglob
-          artifacts=()
-          for artifact in publish/apple/*.ipa publish/apple/*.pkg; do
-            [[ "$artifact" == *.unsigned.ipa ]] && continue
-            artifacts+=("$artifact")
-          done
-          if (( ${#artifacts[@]} == 0 )); then
-            echo "::error ::No Apple upload artifacts found for build ${{ inputs.build_number }}."
-            exit 1
-          fi
-          for artifact in "${artifacts[@]}"; do
-            upload_type="ios"
-            if [[ "$artifact" == *.pkg ]]; then
-              upload_type="macos"
-            fi
-            upload_log="${RUNNER_TEMP:-/tmp}/burrow-altool-${upload_type}-$(basename "$artifact").log"
-            set +e
-            xcrun altool --upload-app \
-              --type "$upload_type" \
-              --file "$artifact" \
-              --apiKey "$ASC_API_KEY_ID" \
-              --apiIssuer "$ASC_API_ISSUER_ID" 2>&1 | tee "$upload_log"
-            altool_status=${PIPESTATUS[0]}
-            set -e
-            if (( altool_status != 0 )) || grep -Eq 'UPLOAD FAILED|Validation failed|ERROR:' "$upload_log"; then
-              echo "::error ::altool reported upload validation failure for $artifact" >&2
-              exit 1
-            fi
-          done
-
-  release-ios-testflight:
-    name: Release (TestFlight iOS Testers)
-    needs: upload-app-store
-    if: ${{ inputs.upload_app_store == 'true' }}
-    runs-on: namespace-profile-linux-testflight
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Ensure Nix
-        shell: bash
-        run: bash Scripts/ci/ensure-nix.sh
-
-      - name: Configure Age
-        shell: bash
-        env:
-          AGE_FORGE_SSH_KEY: ${{ secrets.AGE_FORGE_SSH_KEY }}
-        run: Scripts/resolve-age-identity.sh >> "$GITHUB_ENV"
-
-      - name: Decrypt Release Secrets
-        uses: ./.forgejo/actions/decrypt-release-secrets
-
-      - name: Validate App Store Credentials
-        shell: bash
-        run: Scripts/ci/check-release-config.sh app-store
-
-      - name: Distribute iOS Build To TestFlight
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ inputs.build_number }}
-          TESTFLIGHT_DISTRIBUTE_EXTERNAL: ${{ inputs.testflight_distribute_external || 'false' }}
-          TESTFLIGHT_GROUPS: ${{ inputs.testflight_groups || '' }}
-          IOS_USES_NON_EXEMPT_ENCRYPTION: ${{ inputs.ios_uses_non_exempt_encryption || 'false' }}
-        run: Scripts/ci/distribute-testflight.sh
-
-  distribute-ios-testflight:
-    name: Distribute (TestFlight iOS Testers)
-    if: ${{ inputs.upload_app_store != 'true' && inputs.distribute_testflight == 'true' }}
-    runs-on: namespace-profile-linux-testflight
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Ensure Nix
-        shell: bash
-        run: bash Scripts/ci/ensure-nix.sh
-
-      - name: Configure Age
-        shell: bash
-        env:
-          AGE_FORGE_SSH_KEY: ${{ secrets.AGE_FORGE_SSH_KEY }}
-        run: Scripts/resolve-age-identity.sh >> "$GITHUB_ENV"
-
-      - name: Decrypt Release Secrets
-        uses: ./.forgejo/actions/decrypt-release-secrets
-
-      - name: Validate App Store Credentials
-        shell: bash
-        run: Scripts/ci/check-release-config.sh app-store
-
-      - name: Distribute iOS Build To TestFlight
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ inputs.build_number }}
-          TESTFLIGHT_DISTRIBUTE_EXTERNAL: ${{ inputs.testflight_distribute_external || 'false' }}
-          TESTFLIGHT_GROUPS: ${{ inputs.testflight_groups || '' }}
-          IOS_USES_NON_EXEMPT_ENCRYPTION: ${{ inputs.ios_uses_non_exempt_encryption || 'false' }}
-        run: Scripts/ci/distribute-testflight.sh
-
-  upload-sparkle:
-    name: Upload (Sparkle)
-    needs: sign-apple-kms
-    if: ${{ inputs.upload_sparkle == 'true' }}
-    runs-on: namespace-profile-linux-medium
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Resolve Sparkle Channel
-        id: channel
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ inputs.build_number }}
-        run: |
-          set -euo pipefail
-          channel="${{ inputs.sparkle_channel }}"
-          if [[ -z "$channel" ]]; then
-            channel="build-${BUILD_NUMBER}"
-          fi
-          echo "channel=$channel" >> "$GITHUB_OUTPUT"
-
-      - name: Ensure Nix
-        shell: bash
-        run: bash Scripts/ci/ensure-nix.sh
-
-      - name: Publish Sparkle Channel
-        shell: bash
-        env:
-          BUILD_NUMBER: ${{ inputs.build_number }}
-          CHANNEL: ${{ steps.channel.outputs.channel }}
-          SPARKLE_POINT_MAIN: ${{ inputs.sparkle_point_main }}
-        run: |
-          set -euo pipefail
-          nix develop .#ci -c Scripts/ci/google-wif-auth.sh
-          mkdir -p "publish/sparkle/${CHANNEL}"
-          nix develop .#ci -c gcloud storage rsync --recursive "gs://${BURROW_RELEASE_GCS_BUCKET}/builds/${BUILD_NUMBER}/sparkle/${CHANNEL}" "publish/sparkle/${CHANNEL}" || true
-          if [[ ! -f "publish/sparkle/${CHANNEL}/appcast.xml" ]]; then
-            echo "::warning ::No Sparkle appcast staged for build ${BUILD_NUMBER}; skipping Sparkle publish."
-            find "publish/sparkle/${CHANNEL}" -maxdepth 2 -type f -print || true
-            exit 0
-          fi
-          nix develop .#ci -c gcloud storage rsync --recursive "publish/sparkle/${CHANNEL}" "gs://${BURROW_RELEASE_GCS_BUCKET}/sparkle/${CHANNEL}"
-          if [[ "$SPARKLE_POINT_MAIN" == "true" ]]; then
-            printf '%s\n' "$CHANNEL" > main-channel.txt
-            nix develop .#ci -c gcloud storage cp main-channel.txt "gs://${BURROW_RELEASE_GCS_BUCKET}/sparkle/main-channel.txt"
-            nix develop .#ci -c gcloud storage cp "publish/sparkle/${CHANNEL}/appcast.xml" "gs://${BURROW_RELEASE_GCS_BUCKET}/sparkle/appcast.xml"
-            nix develop .#ci -c gcloud storage rsync --recursive "publish/sparkle/${CHANNEL}" "gs://${BURROW_RELEASE_GCS_BUCKET}/sparkle/default"
-          fi
-
-  upload-microsoft-store:
-    name: Upload (Microsoft Store Beta)
-    if: ${{ inputs.upload_microsoft_store == 'true' }}
-    runs-on: namespace-profile-windows-large
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Validate Microsoft Store Credentials
-        shell: pwsh
-        env:
-          MICROSOFT_TENANT_ID: ${{ secrets.MICROSOFT_TENANT_ID }}
-          MICROSOFT_CLIENT_ID: ${{ secrets.MICROSOFT_CLIENT_ID }}
-          MICROSOFT_CLIENT_SECRET: ${{ secrets.MICROSOFT_CLIENT_SECRET }}
-        run: |
-          foreach ($name in "MICROSOFT_TENANT_ID","MICROSOFT_CLIENT_ID","MICROSOFT_CLIENT_SECRET") {
-            if ([string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($name))) {
-              throw "missing required environment variable: $name"
-            }
-          }
-
-      - name: Stop Until Store Package Exists
-        shell: pwsh
-        run: |
-          Write-Host "::warning ::Burrow only builds a Windows Rust stub today; Microsoft Store package upload is wired for credentials but waits on MSIX packaging."
diff --git a/.forgejo/workflows/release-if-needed.yml b/.forgejo/workflows/release-if-needed.yml
deleted file mode 100644
index cc39214..0000000
--- a/.forgejo/workflows/release-if-needed.yml
+++ /dev/null
@@ -1,92 +0,0 @@
-name: "Release: If Needed"
-run-name: "Release: If Needed (${{ github.ref_name }})"
-
-on:
-  push:
-    branches:
-      - main
-  schedule:
-    - cron: "*/30 * * * *"
-  workflow_dispatch:
-    inputs:
-      upload_app_store:
-        description: Trigger downstream App Store Connect upload workflow
-        required: false
-        default: "true"
-      upload_sparkle:
-        description: Trigger downstream Sparkle publish workflow
-        required: false
-        default: "true"
-      upload_microsoft_store:
-        description: Trigger downstream Microsoft Store beta upload workflow
-        required: false
-        default: "false"
-      sparkle_point_main:
-        description: Update Sparkle main channel pointers
-        required: false
-        default: "true"
-      testflight_distribute_external:
-        description: Distribute to external TestFlight groups
-        required: false
-        default: "false"
-      testflight_groups:
-        description: Optional comma-separated TestFlight groups for external distribution
-        required: false
-        default: ""
-      ios_uses_non_exempt_encryption:
-        description: Set true only when the iOS build uses non-exempt encryption
-        required: false
-        default: "false"
-
-permissions:
-  contents: read
-  actions: write
-
-concurrency:
-  group: burrow-release-if-needed-main
-  cancel-in-progress: true
-
-env:
-  GITHUB_TOKEN: ${{ github.token }}
-  BURROW_VERSION_REQUIRE_REMOTE: "1"
-
-jobs:
-  check:
-    name: Check (Release Needed)
-    runs-on: namespace-profile-linux-medium
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Fetch Build Tags
-        shell: bash
-        run: git fetch --force --prune origin "+refs/tags/builds/*:refs/tags/builds/*"
-
-      - name: Dispatch Release Build
-        shell: bash
-        env:
-          UPLOAD_APP_STORE: ${{ github.event.inputs.upload_app_store || 'true' }}
-          UPLOAD_SPARKLE: ${{ github.event.inputs.upload_sparkle || 'true' }}
-          UPLOAD_MICROSOFT_STORE: ${{ github.event.inputs.upload_microsoft_store || 'false' }}
-          SPARKLE_POINT_MAIN: ${{ github.event.inputs.sparkle_point_main || 'true' }}
-          TESTFLIGHT_DISTRIBUTE_EXTERNAL: ${{ github.event.inputs.testflight_distribute_external || 'false' }}
-          TESTFLIGHT_GROUPS: ${{ github.event.inputs.testflight_groups || '' }}
-          IOS_USES_NON_EXEMPT_ENCRYPTION: ${{ github.event.inputs.ios_uses_non_exempt_encryption || 'false' }}
-        run: |
-          set -euo pipefail
-          status="$(Scripts/version.sh status)"
-          if [[ "$status" == "clean" ]]; then
-            echo "No unreleased changes."
-            exit 0
-          fi
-          inputs="$(python3 -c 'import json, os; print(json.dumps({"upload_app_store":os.environ["UPLOAD_APP_STORE"],"upload_sparkle":os.environ["UPLOAD_SPARKLE"],"upload_microsoft_store":os.environ["UPLOAD_MICROSOFT_STORE"],"sparkle_point_main":os.environ["SPARKLE_POINT_MAIN"],"testflight_distribute_external":os.environ["TESTFLIGHT_DISTRIBUTE_EXTERNAL"],"testflight_groups":os.environ["TESTFLIGHT_GROUPS"],"ios_uses_non_exempt_encryption":os.environ["IOS_USES_NON_EXEMPT_ENCRYPTION"]}))')"
-          curl -fsS \
-            -X POST \
-            -H "Authorization: token ${GITHUB_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "{\"ref\":\"main\",\"inputs\":${inputs}}" \
-            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/actions/workflows/build-release.yml/dispatches"
-          echo "Dispatched build-release.yml (status=${status})."
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
deleted file mode 100644
index cf05fd3..0000000
--- a/.forgejo/workflows/release.yml
+++ /dev/null
@@ -1,77 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - "v*"
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
-
-env:
-  BURROW_NIX_CACHE_URL: ${{ vars.BURROW_NIX_CACHE_URL || 'https://nix.burrow.net/burrow' }}
-  BURROW_NIX_CACHE_PUBLIC_KEY: ${{ vars.BURROW_NIX_CACHE_PUBLIC_KEY }}
-
-jobs:
-  release:
-    name: Release Build
-    runs-on: namespace-profile-linux-medium
-    steps:
-      - name: Checkout
-        uses: https://code.forgejo.org/actions/checkout@v4
-        with:
-          token: ${{ github.token }}
-          fetch-depth: 0
-
-      - name: Bootstrap Nix
-        shell: bash
-        run: |
-          set -euo pipefail
-          chmod +x Scripts/ci/ensure-nix.sh
-          Scripts/ci/ensure-nix.sh
-
-      - name: Build release artifacts
-        shell: bash
-        env:
-          RELEASE_REF: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-          ref="${RELEASE_REF:-manual-${GITHUB_SHA::7}}"
-          export RELEASE_REF="${ref}"
-          chmod +x Scripts/ci/build-release-artifacts.sh
-          nix develop .#ci -c Scripts/ci/build-release-artifacts.sh
-
-      - name: Flatten release assets
-        shell: bash
-        env:
-          RELEASE_REF: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-          ref="${RELEASE_REF:-manual-${GITHUB_SHA::7}}"
-          mkdir -p dist/release-assets
-          find "dist/builds/${ref}" -type f \( -name '*.tar.gz' -o -name '*.zip' -o -name '*.sha256' -o -name 'README.txt' \) -exec cp {} dist/release-assets/ \;
-          rm -rf dist/builds
-          cp dist/release-assets/* dist/
-          find dist -maxdepth 1 -type f -print | sort
-
-      - name: Upload release artifacts
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
-        with:
-          name: burrow-release-${{ github.ref_name }}
-          path: dist/*
-          if-no-files-found: error
-
-      - name: Publish Forgejo release
-        if: startsWith(github.ref, 'refs/tags/')
-        shell: bash
-        env:
-          RELEASE_TAG: ${{ github.ref_name }}
-          API_URL: ${{ github.api_url }}
-          REPOSITORY: ${{ github.repository }}
-          TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          chmod +x Scripts/ci/publish-forgejo-release.sh
-          nix develop .#ci -c Scripts/ci/publish-forgejo-release.sh
diff --git a/.github/actions/archive/action.yml b/.github/actions/archive/action.yml
index e49eb0d..c34bd3c 100644
--- a/.github/actions/archive/action.yml
+++ b/.github/actions/archive/action.yml
@@ -26,18 +26,18 @@ runs:
     run: |
       echo "${{ inputs.app-store-key }}" > AuthKey_${{ inputs.app-store-key-id }}.p8
 
-      xcodebuild clean archive \
+      xcodebuild archive \
         -allowProvisioningUpdates \
         -allowProvisioningDeviceRegistration \
-        -skipPackagePluginValidation \
-        -skipMacroValidation \
-        -onlyUsePackageVersionsFromResolvedFile \
         -authenticationKeyID ${{ inputs.app-store-key-id }} \
         -authenticationKeyIssuerID ${{ inputs.app-store-key-issuer-id }} \
         -authenticationKeyPath "${PWD}/AuthKey_${{ inputs.app-store-key-id }}.p8" \
+        -onlyUsePackageVersionsFromResolvedFile \
         -scheme '${{ inputs.scheme }}' \
         -destination '${{ inputs.destination }}' \
         -archivePath '${{ inputs.archive-path }}' \
         -resultBundlePath BuildResults.xcresult
 
+      ./Tools/xcresulttool-github BuildResults.xcresult
+      
       rm -rf AuthKey_${{ inputs.app-store-key-id }}.p8
diff --git a/.github/actions/build-for-testing/action.yml b/.github/actions/build-for-testing/action.yml
index 185c4ab..ce91b43 100644
--- a/.github/actions/build-for-testing/action.yml
+++ b/.github/actions/build-for-testing/action.yml
@@ -18,36 +18,32 @@ inputs:
 runs:
   using: composite
   steps:
-  - name: Xcode Cache
+  - name: Cache Swift Packages
     uses: actions/cache@v3
     with:
       path: |
         Apple/PackageCache
         Apple/SourcePackages
-        Apple/DerivedData
       key: ${{ runner.os }}-${{ inputs.scheme }}-${{ hashFiles('**/Package.resolved') }}
       restore-keys: |
-        ${{ runner.os }}-${{ inputs.scheme }}-${{ hashFiles('**/Package.resolved') }}
         ${{ runner.os }}-${{ inputs.scheme }}-
-        ${{ runner.os }}-
   - name: Build
     shell: bash
     working-directory: Apple
     run: |
       echo "${{ inputs.app-store-key }}" > AuthKey_${{ inputs.app-store-key-id }}.p8
 
-      xcodebuild build-for-testing \
+      xcodebuild clean build-for-testing \
         -allowProvisioningUpdates \
         -allowProvisioningDeviceRegistration \
-        -skipPackagePluginValidation \
-        -skipMacroValidation \
-        -onlyUsePackageVersionsFromResolvedFile \
         -authenticationKeyID ${{ inputs.app-store-key-id }} \
         -authenticationKeyIssuerID ${{ inputs.app-store-key-issuer-id }} \
         -authenticationKeyPath "${PWD}/AuthKey_${{ inputs.app-store-key-id }}.p8" \
+        -onlyUsePackageVersionsFromResolvedFile \
         -clonedSourcePackagesDirPath SourcePackages \
         -packageCachePath $PWD/PackageCache \
-        -derivedDataPath $PWD/DerivedData \
+        -skipPackagePluginValidation \
+        -skipMacroValidation \
         -scheme '${{ inputs.scheme }}' \
         -destination '${{ inputs.destination }}' \
         -resultBundlePath BuildResults.xcresult
diff --git a/.github/actions/download-profiles/action.yml b/.github/actions/download-profiles/action.yml
deleted file mode 100644
index 32b615c..0000000
--- a/.github/actions/download-profiles/action.yml
+++ /dev/null
@@ -1,30 +0,0 @@
-name: Download Provisioning Profiles
-inputs:
-  app-store-key:
-    description: App Store key in PEM PKCS#8 format
-    required: true
-  app-store-key-id:
-    description: App Store key ID
-    required: true
-  app-store-key-issuer-id:
-    description: App Store key issuer ID
-    required: true
-runs:
-  using: composite
-  steps:
-  - shell: bash
-    env:
-      FASTLANE_OPT_OUT_USAGE: 'YES'
-    run: |
-      APP_STORE_KEY=$(echo "${{ inputs.app-store-key }}" | jq -sR .)
-      cat << EOF > api-key.json
-      {
-        "key_id": "${{ inputs.app-store-key-id }}",
-        "issuer_id": "${{ inputs.app-store-key-issuer-id }}",
-        "key": $APP_STORE_KEY
-      }
-      EOF
-
-      fastlane sigh download_all --api_key_path api-key.json
-
-      rm -rf api-key.json
diff --git a/.github/actions/export/action.yml b/.github/actions/export/action.yml
index 75b748f..bf007a7 100644
--- a/.github/actions/export/action.yml
+++ b/.github/actions/export/action.yml
@@ -1,4 +1,4 @@
-name: Export
+name: Notarize
 inputs:
   app-store-key:
     description: App Store key in PEM PKCS#8 format
@@ -12,8 +12,11 @@ inputs:
   archive-path:
     description: Xcode archive path
     required: true
-  export-options:
-    description: The export options in JSON format
+  destination:
+    description: The Xcode export destination. This can either be "export" or "upload"
+    required: true
+  method:
+    description: The Xcode export method. This can be one of app-store, validation, ad-hoc, package, enterprise, development, developer-id, or mac-application.
     required: true
   export-path:
     description: The path to export the archive to
@@ -21,20 +24,19 @@ inputs:
 runs:
   using: composite
   steps:
-  - shell: bash
+  - id: notarize
+    shell: bash
     working-directory: Apple
     run: |
       echo "${{ inputs.app-store-key }}" > AuthKey_${{ inputs.app-store-key-id }}.p8
 
-      echo '${{ inputs.export-options }}' | plutil -convert xml1 -o ExportOptions.plist -
+      echo '{"destination":"${{ inputs.destination }}","method":"${{ inputs.method }}"}' \
+        | plutil -convert xml1 -o ExportOptions.plist -
 
       xcodebuild \
         -exportArchive \
         -allowProvisioningUpdates \
         -allowProvisioningDeviceRegistration \
-        -skipPackagePluginValidation \
-        -skipMacroValidation \
-        -onlyUsePackageVersionsFromResolvedFile \
         -authenticationKeyID ${{ inputs.app-store-key-id }} \
         -authenticationKeyIssuerID ${{ inputs.app-store-key-issuer-id }} \
         -authenticationKeyPath "${PWD}/AuthKey_${{ inputs.app-store-key-id }}.p8" \
diff --git a/.github/actions/notarize/action.yml b/.github/actions/notarize/action.yml
deleted file mode 100644
index efd2159..0000000
--- a/.github/actions/notarize/action.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-name: Notarize
-inputs:
-  app-store-key:
-    description: App Store key in PEM PKCS#8 format
-    required: true
-  app-store-key-id:
-    description: App Store key ID
-    required: true
-  app-store-key-issuer-id:
-    description: App Store key issuer ID
-    required: true
-runs:
-  using: composite
-  steps:
-  - id: notarize
-    shell: bash
-    working-directory: Apple
-    run: |
-      echo "${{ inputs.app-store-key }}" > AuthKey_${{ inputs.app-store-key-id }}.p8
-
-      ditto -c -k --keepParent Release/Burrow.app Upload.zip
-      xcrun notarytool submit --wait --issuer ${{ inputs.app-store-key-issuer-id }} --key-id ${{ inputs.app-store-key-id }} --key "${PWD}/AuthKey_${{ inputs.app-store-key-id }}.p8" Upload.zip
-      xcrun stapler staple Release/Burrow.app
-
-      rm -rf AuthKey_${{ inputs.app-store-key-id }}.p8 Release
diff --git a/.github/actions/test-without-building/action.yml b/.github/actions/test-without-building/action.yml
index a097d4a..5903d07 100644
--- a/.github/actions/test-without-building/action.yml
+++ b/.github/actions/test-without-building/action.yml
@@ -18,6 +18,9 @@ inputs:
 runs:
   using: composite
   steps:
+  - shell: bash
+    id: vars
+    run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
   - shell: bash
     working-directory: Apple
     run: |
@@ -25,10 +28,10 @@ runs:
       -scheme '${{ inputs.scheme }}' \
       -destination '${{ inputs.destination }}' \
       ${{ inputs.test-plan && '-testPlan ' }}${{ inputs.test-plan }} \
-      -resultBundlePath "${{ inputs.artifact-prefix }}.xcresult"
+      -resultBundlePath "${{ inputs.artifact-prefix }}-${{ steps.vars.outputs.sha_short }}.xcresult"
   - uses: kishikawakatsumi/xcresulttool@v1
     if: always()
     with:
-      path: Apple/${{ inputs.artifact-prefix }}.xcresult
+      path: Apple/${{ inputs.artifact-prefix }}-${{ steps.vars.outputs.sha_short }}.xcresult
       title: ${{ inputs.check-name }}
       show-passed-tests: false
diff --git a/.github/workflows/build-appimage.yml b/.github/workflows/build-appimage.yml
deleted file mode 100644
index bd29b07..0000000
--- a/.github/workflows/build-appimage.yml
+++ /dev/null
@@ -1,29 +0,0 @@
-name: Build AppImage
-on:
-  push:
-    branches:  
-    - main
-  pull_request:
-    branches:
-    - "*"
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-jobs:
-  appimage:
-    name: Build AppImage
-    runs-on: ubuntu-latest
-    container: docker
-    steps:
-    - uses: actions/checkout@v4
-    - name: Build AppImage
-      run: |
-        docker build -t appimage-builder . -f burrow-gtk/build-aux/Dockerfile
-        docker create --name temp appimage-builder
-        docker cp temp:/app/burrow-gtk/build-appimage/Burrow-x86_64.AppImage .
-        docker rm temp
-    - uses: actions/upload-artifact@v4
-      name: Upload to GitHub
-      with:
-        name: AppImage
-        path: Burrow-x86_64.AppImage
diff --git a/.github/workflows/build-apple.yml b/.github/workflows/build-apple.yml
index 5a135b4..da0f56a 100644
--- a/.github/workflows/build-apple.yml
+++ b/.github/workflows/build-apple.yml
@@ -1,7 +1,7 @@
-name: Build Apple Apps
+name: Apple Build
 on:
   push:
-    branches:
+    branches:  
     - main
   pull_request:
     branches:
@@ -12,7 +12,7 @@ concurrency:
 jobs:
   build:
     name: Build App (${{ matrix.platform }})
-    runs-on: macos-14
+    runs-on: macos-13
     strategy:
       fail-fast: false
       matrix:
@@ -24,7 +24,7 @@ jobs:
           rust-targets:
           - aarch64-apple-ios
         - scheme: App
-          destination: platform=iOS Simulator,OS=18.0,name=iPhone 15 Pro
+          destination: platform=iOS Simulator,OS=17.2,name=iPhone 15 Pro
           platform: iOS Simulator
           sdk-name: iphonesimulator
           rust-targets:
@@ -38,8 +38,7 @@ jobs:
           - x86_64-apple-darwin
           - aarch64-apple-darwin
     env:
-      DEVELOPER_DIR: /Applications/Xcode_16.0.app/Contents/Developer
-      PROTOC_PATH: /opt/homebrew/bin/protoc
+      DEVELOPER_DIR: /Applications/Xcode_15.2.app/Contents/Developer
     steps:
     - name: Checkout
       uses: actions/checkout@v3
@@ -54,11 +53,8 @@ jobs:
     - name: Install Rust
       uses: dtolnay/rust-toolchain@stable
       with:
-        toolchain: 1.85.0
+        toolchain: stable
         targets: ${{ join(matrix.rust-targets, ', ') }}
-    - name: Install Protobuf
-      shell: bash
-      run: brew install protobuf
     - name: Build
       id: build
       uses: ./.github/actions/build-for-testing
@@ -68,7 +64,7 @@ jobs:
         app-store-key: ${{ secrets.APPSTORE_KEY }}
         app-store-key-id: ${{ secrets.APPSTORE_KEY_ID }}
         app-store-key-issuer-id: ${{ secrets.APPSTORE_KEY_ISSUER_ID }}
-    - name: Run Unit Tests
+    - name: Xcode Unit Test
       if: ${{ matrix.xcode-unit-test != '' }}
       continue-on-error: true
       uses: ./.github/actions/test-without-building
@@ -78,7 +74,7 @@ jobs:
         test-plan: ${{ matrix.xcode-unit-test }}
         artifact-prefix: unit-tests-${{ matrix.sdk-name }}
         check-name: Xcode Unit Tests (${{ matrix.platform }})
-    - name: Run UI Tests
+    - name: Xcode UI Test
       if: ${{ matrix.xcode-ui-test != '' }}
       continue-on-error: true
       uses: ./.github/actions/test-without-building
diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
index 6a3dae1..1ce7a9a 100644
--- a/.github/workflows/build-docker.yml
+++ b/.github/workflows/build-docker.yml
@@ -6,9 +6,6 @@ on:
   pull_request:
     branches:
     - "*"
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
 jobs:
   build:
     name: Build Docker Image
@@ -36,7 +33,6 @@ jobs:
         images: ghcr.io/${{ github.repository }}
         tags: |
           type=sha
-          type=match,pattern=builds/(.*),group=1
           type=raw,value=latest,enable={{is_default_branch}}
     - name: Build and Push
       uses: docker/build-push-action@v4
diff --git a/.github/workflows/build-flatpak.yml b/.github/workflows/build-flatpak.yml
index d74eec3..e0e804e 100644
--- a/.github/workflows/build-flatpak.yml
+++ b/.github/workflows/build-flatpak.yml
@@ -1,4 +1,7 @@
-on: workflow_dispatch
+on:
+  push:
+    branches: [main]
+  pull_request:
 name: Build Flatpak
 jobs:
   flatpak:
diff --git a/.github/workflows/build-rpm.yml b/.github/workflows/build-rpm.yml
index 029bf16..fd5837c 100644
--- a/.github/workflows/build-rpm.yml
+++ b/.github/workflows/build-rpm.yml
@@ -1,11 +1,16 @@
-on: workflow_dispatch
 name: Build RPM
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches:
+    - "*"
 jobs:
   build:
     name: Build RPM
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v3
     - uses: Swatinem/rust-cache@v2
     - name: Install RPM
       run: cargo install cargo-generate-rpm
@@ -15,3 +20,4 @@ jobs:
         strip -s target/release/burrow
     - name: Build RPM
       run: cargo generate-rpm -p burrow
+
diff --git a/.github/workflows/build-rust.yml b/.github/workflows/build-rust.yml
index cbbdd81..4c3782a 100644
--- a/.github/workflows/build-rust.yml
+++ b/.github/workflows/build-rust.yml
@@ -1,4 +1,4 @@
-name: Build Rust Crate
+name: Rust Build
 on:
   push:
     branches:
@@ -6,9 +6,6 @@ on:
   pull_request:
     branches:
     - "*"
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
 jobs:
   build:
     name: Build Crate (${{ matrix.platform }})
@@ -24,21 +21,15 @@ jobs:
           - x86_64-unknown-linux-gnu
           targets:
           - aarch64-unknown-linux-gnu
-        - os: macos-13
-          platform: macOS (Intel)
-          xcode: /Applications/Xcode_15.2.app
+        - os: macos-12
+          platform: macOS
           test-targets:
           - x86_64-apple-darwin
           targets:
-          - x86_64-apple-ios
-        - os: macos-14
-          platform: macOS
-          xcode: /Applications/Xcode_16.0.app
-          test-targets:
           - aarch64-apple-darwin
-          targets:
           - aarch64-apple-ios
           - aarch64-apple-ios-sim
+          - x86_64-apple-ios
         - os: windows-2022
           platform: Windows
           test-targets:
@@ -47,11 +38,10 @@ jobs:
           - aarch64-pc-windows-msvc
     runs-on: ${{ matrix.os }}
     env:
-      DEVELOPER_DIR: ${{ matrix.xcode }}/Contents/Developer
+      DEVELOPER_DIR: /Applications/Xcode_14.2.app/Contents/Developer
       CARGO_INCREMENTAL: 0
       CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
       RUST_BACKTRACE: short
-      PROTOC_VERSION: 3.25.1
     steps:
     - name: Checkout
       uses: actions/checkout@v3
@@ -64,25 +54,21 @@ jobs:
       run: |
         sudo apt-get update
         sudo apt-get install -y ${{ join(matrix.packages, ' ') }}
-    - name: Configure LLVM
+    - name: Install Windows Deps
       if: matrix.os == 'windows-2022'
       shell: bash
       run: echo "C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\Llvm\x64\bin" >> $GITHUB_PATH
-    - name: Install protoc
-      uses: taiki-e/install-action@v2
-      with:
-        tool: protoc@${{ env.PROTOC_VERSION }}
     - name: Install Rust
       uses: dtolnay/rust-toolchain@stable
       with:
-        toolchain: 1.85.0
+        toolchain: stable
         components: rustfmt
         targets: ${{ join(matrix.targets, ', ') }}
     - name: Setup Rust Cache
       uses: Swatinem/rust-cache@v2
     - name: Build
       shell: bash
-      run: cargo build --locked --verbose --workspace --all-features --target ${{ join(matrix.targets, ' --target ') }} --target ${{ join(matrix.test-targets, ' --target ') }}
+      run: cargo build --verbose --workspace --all-features --target ${{ join(matrix.targets, ' --target ') }} --target ${{ join(matrix.test-targets, ' --target ') }}
     - name: Test
       shell: bash
-      run: cargo test --locked --verbose --workspace --all-features --target ${{ join(matrix.test-targets, ' --target ') }}
+      run: cargo test --verbose --workspace --all-features --target ${{ join(matrix.test-targets, ' --target ') }}
diff --git a/.github/workflows/lint-git.yml b/.github/workflows/lint-git.yml
index 2f7c72e..aefe199 100644
--- a/.github/workflows/lint-git.yml
+++ b/.github/workflows/lint-git.yml
@@ -8,14 +8,13 @@ jobs:
     name: Git Lint
     runs-on: ubuntu-latest
     steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-      with:
-        ref: ${{ github.event.pull_request.head.sha }}
-        fetch-depth: 0
-    - name: Install
-      shell: bash
-      run: python -m pip install gitlint
-    - name: Lint
-      shell: bash
-      run: gitlint --commits "${{ github.event.pull_request.base.sha }}..HEAD"
+      - uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - name: Install Gitlint
+        shell: bash
+        run: python -m pip install gitlint
+      - name: Run Gitlint
+        shell: bash
+        run: gitlint --commits "${{ github.event.pull_request.base.sha }}..HEAD"
diff --git a/.github/workflows/lint-governance.yml b/.github/workflows/lint-governance.yml
deleted file mode 100644
index 08b665c..0000000
--- a/.github/workflows/lint-governance.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: Governance Lint
-
-on:
-  pull_request:
-    branches:
-      - "*"
-
-jobs:
-  governance:
-    name: BEP Metadata
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0
-
-      - name: Validate BEP metadata
-        shell: bash
-        run: |
-          set -euo pipefail
-          python3 Scripts/check-bep-metadata.py
diff --git a/.github/workflows/lint-swift.yml b/.github/workflows/lint-swift.yml
index 857f575..7e62afd 100644
--- a/.github/workflows/lint-swift.yml
+++ b/.github/workflows/lint-swift.yml
@@ -1,5 +1,8 @@
 name: Swift Lint
 on:
+  push:
+    branches:
+    - main
   pull_request:
     branches:
     - "*"
@@ -11,6 +14,8 @@ jobs:
       image: ghcr.io/realm/swiftlint:latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v3
+      with:
+        ssh-key: ${{ secrets.DEPLOY_KEY }}
     - name: Lint
-      run: swiftlint lint --strict --reporter github-actions-logging
+      run: swiftlint lint --reporter github-actions-logging
diff --git a/.github/workflows/release-apple.yml b/.github/workflows/release-apple.yml
index b36ed73..3ea185d 100644
--- a/.github/workflows/release-apple.yml
+++ b/.github/workflows/release-apple.yml
@@ -1,120 +1,65 @@
-name: Release (Apple)
+name: Build Apple Release
 on:
   release:
     types:
     - created
 jobs:
   build:
-    name: Build ${{ matrix.platform }} Release
-    runs-on: macos-14
-    permissions:
-      contents: write
+    name: Build ${{ matrix.configuration['platform'] }} Release
+    runs-on: macos-13
     strategy:
       fail-fast: false
       matrix:
-        include:
-        - platform: iOS
-          rust-targets:
-          - aarch64-apple-ios
-        - platform: macOS
-          rust-targets:
-          - x86_64-apple-darwin
-          - aarch64-apple-darwin
+        configuration:
+        - scheme: App (iOS)
+          destination: generic/platform=iOS
+          platform: iOS
+          method: ad-hoc
+          artifact-file: Apple/Release/Burrow.ipa
+        - scheme: App (macOS)
+          destination: generic/platform=macOS
+          platform: macOS
+          method: mac-application
+          artifact-file: Burrow.app.txz
     env:
-      DEVELOPER_DIR: /Applications/Xcode_16.0.app/Contents/Developer
-      PROTOC_PATH: /opt/homebrew/bin/protoc
+      DEVELOPER_DIR: /Applications/Xcode_15.2.app/Contents/Developer
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v3
       with:
-        fetch-depth: 0
+        ssh-key: ${{ secrets.DEPLOY_KEY }}
+        submodules: recursive
     - name: Import Certificate
       uses: ./.github/actions/import-cert
       with:
         certificate: ${{ secrets.DEVELOPER_CERT }}
         password: ${{ secrets.DEVELOPER_CERT_PASSWORD }}
-    - name: Download Provisioning Profiles
-      uses: ./.github/actions/download-profiles
-      with:
-        app-store-key: ${{ secrets.APPSTORE_KEY }}
-        app-store-key-id: ${{ secrets.APPSTORE_KEY_ID }}
-        app-store-key-issuer-id: ${{ secrets.APPSTORE_KEY_ISSUER_ID }}
-    - name: Install Provisioning Profiles
-      shell: bash
-      run: |
-        mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles/
-        cp -f Apple/Profiles/* ~/Library/MobileDevice/Provisioning\ Profiles/
-    - name: Install Rust
-      uses: dtolnay/rust-toolchain@stable
-      with:
-        toolchain: 1.85.0
-        targets: ${{ join(matrix.rust-targets, ', ') }}
-    - name: Install Protobuf
-      shell: bash
-      run: brew install protobuf
-    - name: Configure Version
-      id: version
-      shell: bash
-      run: echo "BUILD_NUMBER=$(Tools/version.sh)" >> $GITHUB_OUTPUT
     - name: Archive
       uses: ./.github/actions/archive
       with:
-        scheme: App
-        destination: generic/platform=${{ matrix.platform }}
+        scheme: ${{ matrix.configuration['scheme'] }}
+        destination: ${{ matrix.configuration['destination'] }}
         app-store-key: ${{ secrets.APPSTORE_KEY }}
         app-store-key-id: ${{ secrets.APPSTORE_KEY_ID }}
         app-store-key-issuer-id: ${{ secrets.APPSTORE_KEY_ISSUER_ID }}
         archive-path: Burrow.xcarchive
-    - name: Export
+    - name: Export Locally
       uses: ./.github/actions/export
       with:
-        method: ${{ matrix.platform == 'macOS' && 'developer-id' || 'ad-hoc' }}
+        method: ${{ matrix.configuration['method'] }}
         destination: export
         app-store-key: ${{ secrets.APPSTORE_KEY }}
         app-store-key-id: ${{ secrets.APPSTORE_KEY_ID }}
         app-store-key-issuer-id: ${{ secrets.APPSTORE_KEY_ISSUER_ID }}
         archive-path: Burrow.xcarchive
-        export-options: |
-          {"teamID":"P6PV2R9443","destination":"export","method":"developer-id","provisioningProfiles":{"com.hackclub.burrow":"Burrow Developer ID","com.hackclub.burrow.network":"Burrow Network Developer ID"},"signingCertificate":"Developer ID Application","signingStyle":"manual"}
         export-path: Release
-    - name: Notarize
-      if: ${{ matrix.platform == 'macOS' }}
-      uses: ./.github/actions/notarize
-      with:
-        app-store-key: ${{ secrets.APPSTORE_KEY }}
-        app-store-key-id: ${{ secrets.APPSTORE_KEY_ID }}
-        app-store-key-issuer-id: ${{ secrets.APPSTORE_KEY_ISSUER_ID }}
-    - name: Compress (iOS)
-      if: ${{ matrix.platform == 'iOS' }}
+    - name: Compress
+      if: ${{ matrix.configuration['platform'] == 'macOS' }}
       shell: bash
-      run: |
-        cp Apple/Release/Burrow.ipa Burrow.ipa
-        aa archive -a lzma -b 8m -d Apple -subdir Burrow.xcarchive -o Burrow-${{ matrix.platform }}.xcarchive.aar
-        rm -rf Apple/Release
-    - name: Compress (macOS)
-      if: ${{ matrix.platform == 'macOS' }}
-      shell: bash
-      run: |
-        aa archive -a lzma -b 8m -d Apple/Release -subdir Burrow.app -o Burrow.app.aar
-        aa archive -a lzma -b 8m -d Apple -subdir Burrow.xcarchive -o Burrow-${{ matrix.platform }}.xcarchive.aar
-        rm -rf Apple/Release
-    - name: Upload to GitHub
-      uses: SierraSoftworks/gh-releases@v1.0.7
+      run: tar --options xz:compression-level=9 -C Apple/Release -cJf Burrow.app.txz ./
+    - name: Attach Artifact
+      uses: SierraSoftworks/gh-releases@v1.0.6
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
-        release_tag: ${{ github.ref_name }}
-        overwrite: 'true'
-        files: |
-          ${{ matrix.platform == 'macOS' && 'Burrow.aap.aar' || 'Burrow.ipa' }}
-          Burrow-${{ matrix.platform }}.xcarchive.aar
-    - name: Upload to App Store Connect
-      if: ${{ matrix.platform == 'iOS' }}
-      uses: ./.github/actions/export
-      with:
-        app-store-key: ${{ secrets.APPSTORE_KEY }}
-        app-store-key-id: ${{ secrets.APPSTORE_KEY_ID }}
-        app-store-key-issuer-id: ${{ secrets.APPSTORE_KEY_ISSUER_ID }}
-        archive-path: Burrow.xcarchive
-        export-options: |
-          {"method": "app-store", "destination": "upload"}
-        export-path: Release
+        overwrite: 'false'
+        files: ${{ matrix.configuration['artifact-file'] }}
diff --git a/.github/workflows/release-if-needed.yaml b/.github/workflows/release-if-needed.yaml
deleted file mode 100644
index 79f0d63..0000000
--- a/.github/workflows/release-if-needed.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: Create Release If Needed
-on:
-  workflow_dispatch:
-  schedule:
-  - cron: '0 10 * * *'
-concurrency:
-  group: ${{ github.workflow }}
-jobs:
-  create:
-    name: Create Release If Needed
-    runs-on: ubuntu-latest
-    env:
-      GH_TOKEN: ${{ github.token }}
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-    - shell: bash
-      run: |
-        if [[ $(Tools/version.sh status) == "dirty" ]]; then
-          gh workflow run release-now.yml
-        fi
diff --git a/.github/workflows/release-linux.yml b/.github/workflows/release-linux.yml
deleted file mode 100644
index 7db9bcf..0000000
--- a/.github/workflows/release-linux.yml
+++ /dev/null
@@ -1,29 +0,0 @@
-name: Release (Linux)
-on:
-  release:
-    types:
-    - created
-jobs:
-  appimage:
-    name: Build AppImage
-    runs-on: ubuntu-latest
-    container: docker
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-    - name: Build AppImage
-      run: |
-        docker build -t appimage-builder . -f burrow-gtk/build-aux/Dockerfile
-        docker create --name temp appimage-builder
-        docker cp temp:/app/burrow-gtk/build-appimage/Burrow-x86_64.AppImage .
-        docker rm temp
-    - name: Attach Artifacts
-      uses: SierraSoftworks/gh-releases@v1.0.7
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-        release_tag: ${{ github.ref_name }}
-        overwrite: "true"
-        files: |
-          Burrow-x86_64.AppImage
diff --git a/.github/workflows/release-now.yml b/.github/workflows/release-now.yml
deleted file mode 100644
index 229f6c9..0000000
--- a/.github/workflows/release-now.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-name: Create Release
-on: workflow_dispatch
-concurrency:
-  group: ${{ github.workflow }}
-jobs:
-  create:
-    env:
-      GH_TOKEN: ${{ secrets.GH_RELEASE_TOKEN }}
-    name: Create Release
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-    - shell: bash
-      run: Tools/version.sh increment
diff --git a/.gitignore b/.gitignore
index 8237d1a..dc886ed 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,32 +1,8 @@
 # Xcode
 xcuserdata
-Apple/build/
-.derived-data/
-AuthKey_*.p8
-burrow-certs-pass.txt
-*.p12
-
-# Swift
-Apple/Package/.swiftpm/
 
 # Rust
 target/
-.env
-
-# Bazel
-bazel-*
 
 .DS_STORE
 .idea/
-
-tmp/
-.cache/
-intake/
-dist/
-publish/
-release/
-ci-artifacts/
-
-*.db
-*.sqlite3
-*.sock
diff --git a/.swiftlint.yml b/.swiftlint.yml
index 8efc85e..d609718 100644
--- a/.swiftlint.yml
+++ b/.swiftlint.yml
@@ -30,6 +30,7 @@ opt_in_rules:
 - function_default_parameter_at_end
 - ibinspectable_in_extension
 - identical_operands
+- implicitly_unwrapped_optional
 - indentation_width
 - joined_default_parameter
 - last_where
@@ -45,6 +46,7 @@ opt_in_rules:
 - multiline_parameters
 - multiline_parameters_brackets
 - no_extension_access_modifier
+- no_grouping_extension
 - nslocalizedstring_key
 - nslocalizedstring_require_bundle
 - number_separator
@@ -74,7 +76,9 @@ opt_in_rules:
 - sorted_first_last
 - sorted_imports
 - static_operator
+- strict_fileprivate
 - strong_iboutlet
+- switch_case_on_newline
 - test_case_accessibility
 - toggle_bool
 - trailing_closure
@@ -93,5 +97,3 @@ disabled_rules:
 - force_try
 - nesting
 - todo
-- trailing_comma
-- switch_case_on_newline
diff --git a/.vscode/settings.json b/.vscode/settings.json
index eb85504..3c714be 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -1,26 +1,18 @@
 {
-  "files.autoSave": "onFocusChange",
-  "files.defaultLanguage": "rust",
-  "editor.formatOnPaste": true,
-  "editor.formatOnSave": true,
-  "files.trimTrailingWhitespace": true,
-  "editor.suggest.preview": true,
-  "editor.acceptSuggestionOnEnter": "on",
-  "rust-analyzer.restartServerOnConfigChange": true,
-  "rust-analyzer.cargo.features": "all",
-  "rust-analyzer.rustfmt.extraArgs": ["+nightly"],
-  "[rust]": {
-    "editor.defaultFormatter": "rust-lang.rust-analyzer"
-  },
-  "rust-analyzer.inlayHints.typeHints.enable": false,
-  "rust-analyzer.linkedProjects": [
-    "./burrow/Cargo.toml"
-  ],
-  "[yaml]": {
-    "editor.insertSpaces": true,
-    "editor.tabSize": 2,
-    "editor.autoIndent": "advanced",
-    "diffEditor.ignoreTrimWhitespace": false,
-    "editor.formatOnSave": false
-  }
-}
+    "files.autoSave": "onFocusChange",
+    "files.defaultLanguage": "rust",
+    "editor.formatOnPaste": true,
+    "editor.formatOnSave": true,
+    "files.trimTrailingWhitespace": true,
+    "editor.suggest.preview": true,
+    "editor.acceptSuggestionOnEnter": "on",
+    "rust-analyzer.restartServerOnConfigChange": true,
+    "rust-analyzer.cargo.features": "all",
+    "rust-analyzer.rustfmt.extraArgs": [
+        "+nightly"
+    ],
+    "[rust]": {
+        "editor.defaultFormatter": "rust-lang.rust-analyzer",
+    },
+    "rust-analyzer.inlayHints.typeHints.enable": false
+}
\ No newline at end of file
diff --git a/AGENTS.md b/AGENTS.md
deleted file mode 100644
index 0ca7ced..0000000
--- a/AGENTS.md
+++ /dev/null
@@ -1,14 +0,0 @@
-# instructions for agents
-
-1. Spell the project name as `Burrow` in user-facing copy and `burrow` in code, package, and protocol identifiers unless an existing integration requires a different literal.
-2. Read [CONSTITUTION.md](CONSTITUTION.md) before changing Apple clients, the daemon, the control plane, forge infrastructure, identity, or security-sensitive code.
-3. Anchor non-trivial changes in a Burrow Evolution Proposal (BEP) under [evolution/](evolution/README.md) so future contributors can inherit the rationale, safeguards, and rollout shape.
-4. Before touching the Apple app, daemon IPC, or Tailnet flows, review:
-   - [evolution/proposals/BEP-0002-control-plane-bootstrap-and-local-auth.md](evolution/proposals/BEP-0002-control-plane-bootstrap-and-local-auth.md)
-   - [evolution/proposals/BEP-0003-connect-ip-and-negotiation-roadmap.md](evolution/proposals/BEP-0003-connect-ip-and-negotiation-roadmap.md)
-   - [evolution/proposals/BEP-0005-daemon-ipc-and-apple-boundary.md](evolution/proposals/BEP-0005-daemon-ipc-and-apple-boundary.md)
-   - [evolution/proposals/BEP-0006-tailnet-authority-first-control-plane.md](evolution/proposals/BEP-0006-tailnet-authority-first-control-plane.md)
-5. Apple clients must talk only to the daemon over gRPC. Do not add direct HTTP, control-plane, or helper-process calls from Swift UI code.
-6. Treat Tailnet as one protocol family. Tailscale-managed and self-hosted Headscale-style deployments differ by authority, policy, and auth details, not by a separate user-facing protocol surface.
-7. Maintain canonical identity and operator metadata in [contributors.nix](contributors.nix). If Burrow forge, Authentik, Headscale, or admin/group mappings need to change, edit that registry first and derive runtime configuration from it.
-8. When process or architecture is unclear, stop and draft or update a BEP instead of improvising durable behavior in code.
diff --git a/Android/README.md b/Android/README.md
deleted file mode 100644
index 755b722..0000000
--- a/Android/README.md
+++ /dev/null
@@ -1,14 +0,0 @@
-# Burrow Android
-
-The Android app starts as a Kotlin shell linked to `crates/burrow-mobile-ffi`,
-which exposes the cross-platform `burrow-core` crate through JNI.
-
-The current stub proves the package shape and Rust core boundary. Full VPN
-support must use Android `VpnService` and keep platform consent, Play Store
-policy, and disclosure requirements in the release lane.
-
-The Bazel entrypoint is:
-
-```sh
-bazel build //bazel/android:check_stub_stamp
-```
diff --git a/Android/app/build.gradle.kts b/Android/app/build.gradle.kts
deleted file mode 100644
index cb1a8ac..0000000
--- a/Android/app/build.gradle.kts
+++ /dev/null
@@ -1,21 +0,0 @@
-plugins {
-    id("com.android.application")
-    id("org.jetbrains.kotlin.android")
-}
-
-android {
-    namespace = "net.burrow.android"
-    compileSdk = 36
-
-    defaultConfig {
-        applicationId = "net.burrow.android"
-        minSdk = 26
-        targetSdk = 36
-        versionCode = 1
-        versionName = "0.1.0"
-    }
-}
-
-kotlin {
-    jvmToolchain(17)
-}
diff --git a/Android/app/src/main/AndroidManifest.xml b/Android/app/src/main/AndroidManifest.xml
deleted file mode 100644
index 2bb3a13..0000000
--- a/Android/app/src/main/AndroidManifest.xml
+++ /dev/null
@@ -1,18 +0,0 @@
-<manifest xmlns:android="http://schemas.android.com/apk/res/android">
-    <application
-        android:allowBackup="false"
-        android:icon="@mipmap/ic_launcher"
-        android:label="@string/app_name"
-        android:roundIcon="@mipmap/ic_launcher_round"
-        android:supportsRtl="true"
-        android:theme="@style/BurrowTheme">
-        <activity
-            android:name=".MainActivity"
-            android:exported="true">
-            <intent-filter>
-                <action android:name="android.intent.action.MAIN" />
-                <category android:name="android.intent.category.LAUNCHER" />
-            </intent-filter>
-        </activity>
-    </application>
-</manifest>
diff --git a/Android/app/src/main/java/net/burrow/android/BurrowCore.kt b/Android/app/src/main/java/net/burrow/android/BurrowCore.kt
deleted file mode 100644
index cf286ba..0000000
--- a/Android/app/src/main/java/net/burrow/android/BurrowCore.kt
+++ /dev/null
@@ -1,9 +0,0 @@
-package net.burrow.android
-
-object BurrowCore {
-    init {
-        System.loadLibrary("burrow_mobile_ffi")
-    }
-
-    external fun version(): String
-}
diff --git a/Android/app/src/main/java/net/burrow/android/MainActivity.kt b/Android/app/src/main/java/net/burrow/android/MainActivity.kt
deleted file mode 100644
index 810a403..0000000
--- a/Android/app/src/main/java/net/burrow/android/MainActivity.kt
+++ /dev/null
@@ -1,32 +0,0 @@
-package net.burrow.android
-
-import android.app.Activity
-import android.os.Bundle
-import android.widget.LinearLayout
-import android.widget.TextView
-
-class MainActivity : Activity() {
-    override fun onCreate(savedInstanceState: Bundle?) {
-        super.onCreate(savedInstanceState)
-
-        val versionText = runCatching { BurrowCore.version() }
-            .getOrElse { "burrow-core unavailable" }
-
-        val root = LinearLayout(this).apply {
-            orientation = LinearLayout.VERTICAL
-            setPadding(40, 40, 40, 40)
-        }
-
-        root.addView(TextView(this).apply {
-            text = getString(R.string.app_name)
-            textSize = 24f
-        })
-
-        root.addView(TextView(this).apply {
-            text = versionText
-            textSize = 14f
-        })
-
-        setContentView(root)
-    }
-}
diff --git a/Android/app/src/main/res/mipmap-hdpi/ic_launcher.png b/Android/app/src/main/res/mipmap-hdpi/ic_launcher.png
deleted file mode 100644
index 5d973f2..0000000
Binary files a/Android/app/src/main/res/mipmap-hdpi/ic_launcher.png and /dev/null differ
diff --git a/Android/app/src/main/res/mipmap-hdpi/ic_launcher_round.png b/Android/app/src/main/res/mipmap-hdpi/ic_launcher_round.png
deleted file mode 100644
index 5d973f2..0000000
Binary files a/Android/app/src/main/res/mipmap-hdpi/ic_launcher_round.png and /dev/null differ
diff --git a/Android/app/src/main/res/mipmap-mdpi/ic_launcher.png b/Android/app/src/main/res/mipmap-mdpi/ic_launcher.png
deleted file mode 100644
index 68cf88b..0000000
Binary files a/Android/app/src/main/res/mipmap-mdpi/ic_launcher.png and /dev/null differ
diff --git a/Android/app/src/main/res/mipmap-mdpi/ic_launcher_round.png b/Android/app/src/main/res/mipmap-mdpi/ic_launcher_round.png
deleted file mode 100644
index 68cf88b..0000000
Binary files a/Android/app/src/main/res/mipmap-mdpi/ic_launcher_round.png and /dev/null differ
diff --git a/Android/app/src/main/res/mipmap-xhdpi/ic_launcher.png b/Android/app/src/main/res/mipmap-xhdpi/ic_launcher.png
deleted file mode 100644
index 2f341d8..0000000
Binary files a/Android/app/src/main/res/mipmap-xhdpi/ic_launcher.png and /dev/null differ
diff --git a/Android/app/src/main/res/mipmap-xhdpi/ic_launcher_round.png b/Android/app/src/main/res/mipmap-xhdpi/ic_launcher_round.png
deleted file mode 100644
index 2f341d8..0000000
Binary files a/Android/app/src/main/res/mipmap-xhdpi/ic_launcher_round.png and /dev/null differ
diff --git a/Android/app/src/main/res/mipmap-xxhdpi/ic_launcher.png b/Android/app/src/main/res/mipmap-xxhdpi/ic_launcher.png
deleted file mode 100644
index ed3c1ba..0000000
Binary files a/Android/app/src/main/res/mipmap-xxhdpi/ic_launcher.png and /dev/null differ
diff --git a/Android/app/src/main/res/mipmap-xxhdpi/ic_launcher_round.png b/Android/app/src/main/res/mipmap-xxhdpi/ic_launcher_round.png
deleted file mode 100644
index ed3c1ba..0000000
Binary files a/Android/app/src/main/res/mipmap-xxhdpi/ic_launcher_round.png and /dev/null differ
diff --git a/Android/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png b/Android/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png
deleted file mode 100644
index 3e052d2..0000000
Binary files a/Android/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png and /dev/null differ
diff --git a/Android/app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.png b/Android/app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.png
deleted file mode 100644
index 3e052d2..0000000
Binary files a/Android/app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.png and /dev/null differ
diff --git a/Android/app/src/main/res/values/strings.xml b/Android/app/src/main/res/values/strings.xml
deleted file mode 100644
index 2f79d4b..0000000
--- a/Android/app/src/main/res/values/strings.xml
+++ /dev/null
@@ -1,3 +0,0 @@
-<resources>
-    <string name="app_name">Burrow</string>
-</resources>
diff --git a/Android/app/src/main/res/values/styles.xml b/Android/app/src/main/res/values/styles.xml
deleted file mode 100644
index 3bc0947..0000000
--- a/Android/app/src/main/res/values/styles.xml
+++ /dev/null
@@ -1,8 +0,0 @@
-<resources>
-    <style name="BurrowTheme" parent="android:style/Theme.Material.Light.NoActionBar">
-        <item name="android:fontFamily">sans</item>
-        <item name="android:windowLightStatusBar">true</item>
-        <item name="android:navigationBarColor">#ffffff</item>
-        <item name="android:statusBarColor">#ffffff</item>
-    </style>
-</resources>
diff --git a/Android/build.gradle.kts b/Android/build.gradle.kts
deleted file mode 100644
index 60678e4..0000000
--- a/Android/build.gradle.kts
+++ /dev/null
@@ -1,4 +0,0 @@
-plugins {
-    id("com.android.application") version "8.10.1" apply false
-    id("org.jetbrains.kotlin.android") version "2.1.21" apply false
-}
diff --git a/Android/settings.gradle.kts b/Android/settings.gradle.kts
deleted file mode 100644
index a4925f9..0000000
--- a/Android/settings.gradle.kts
+++ /dev/null
@@ -1,18 +0,0 @@
-pluginManagement {
-    repositories {
-        google()
-        mavenCentral()
-        gradlePluginPortal()
-    }
-}
-
-dependencyResolutionManagement {
-    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
-    repositories {
-        google()
-        mavenCentral()
-    }
-}
-
-rootProject.name = "BurrowAndroid"
-include(":app")
diff --git a/Apple/App/App-iOS.entitlements b/Apple/App/App-iOS.entitlements
index 53fcbb7..02ee960 100644
--- a/Apple/App/App-iOS.entitlements
+++ b/Apple/App/App-iOS.entitlements
@@ -2,11 +2,6 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>com.apple.developer.associated-domains</key>
-	<array>
-		<string>applinks:burrow.rs?mode=developer</string>
-		<string>webcredentials:burrow.rs?mode=developer</string>
-	</array>
 	<key>com.apple.developer.networking.networkextension</key>
 	<array>
 		<string>packet-tunnel-provider</string>
diff --git a/Apple/App/App-macOS.entitlements b/Apple/App/App-macOS.entitlements
index 53fcbb7..02ee960 100644
--- a/Apple/App/App-macOS.entitlements
+++ b/Apple/App/App-macOS.entitlements
@@ -2,11 +2,6 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>com.apple.developer.associated-domains</key>
-	<array>
-		<string>applinks:burrow.rs?mode=developer</string>
-		<string>webcredentials:burrow.rs?mode=developer</string>
-	</array>
 	<key>com.apple.developer.networking.networkextension</key>
 	<array>
 		<string>packet-tunnel-provider</string>
diff --git a/Apple/App/App.xcconfig b/Apple/App/App.xcconfig
index 05fbc27..1d63205 100644
--- a/Apple/App/App.xcconfig
+++ b/Apple/App/App.xcconfig
@@ -10,20 +10,9 @@ INFOPLIST_KEY_UILaunchScreen_Generation[sdk=iphone*] = YES
 INFOPLIST_KEY_UIStatusBarStyle[sdk=iphone*] = UIStatusBarStyleDefault
 INFOPLIST_KEY_UISupportedInterfaceOrientations_iPad[sdk=iphone*] = UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight
 INFOPLIST_KEY_UISupportedInterfaceOrientations_iPhone[sdk=iphone*] = UIInterfaceOrientationPortrait UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight
-ASSETCATALOG_COMPILER_ALTERNATE_APPICON_NAMES[sdk=iphone*] = BurrowPanel02 BurrowPanel03 BurrowPanel04 BurrowPanel05 BurrowPanel06
-ASSETCATALOG_COMPILER_INCLUDE_ALL_APPICON_ASSETS[sdk=iphone*] = YES
 TARGETED_DEVICE_FAMILY[sdk=iphone*] = 1,2
-EXCLUDED_SOURCE_FILE_NAMES = MainMenu.xib
 
-EXCLUDED_SOURCE_FILE_NAMES[sdk=macosx*] =
-INFOPLIST_KEY_LSUIElement[sdk=macosx*] = YES
-INFOPLIST_KEY_NSMainNibFile[sdk=macosx*] = MainMenu
-INFOPLIST_KEY_NSPrincipalClass[sdk=macosx*] = NSApplication
 INFOPLIST_KEY_LSApplicationCategoryType[sdk=macosx*] = public.app-category.utilities
-BURROW_SPARKLE_FEED_URL = https:/$()/releases.burrow.net/sparkle/appcast.xml
-BURROW_SPARKLE_PUBLIC_ED_KEY = uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=
-INFOPLIST_KEY_SUFeedURL[sdk=macosx*] = $(BURROW_SPARKLE_FEED_URL)
-INFOPLIST_KEY_SUPublicEDKey[sdk=macosx*] = $(BURROW_SPARKLE_PUBLIC_ED_KEY)
 
 CODE_SIGN_ENTITLEMENTS = App/App-iOS.entitlements
 CODE_SIGN_ENTITLEMENTS[sdk=macosx*] = App/App-macOS.entitlements
diff --git a/Apple/App/AppDelegate.swift b/Apple/App/AppDelegate.swift
index 8eccc07..f42b52f 100644
--- a/Apple/App/AppDelegate.swift
+++ b/Apple/App/AppDelegate.swift
@@ -1,19 +1,9 @@
 #if os(macOS)
 import AppKit
-import BurrowUI
-import Sparkle
 import SwiftUI
 
-@main
 @MainActor
 class AppDelegate: NSObject, NSApplicationDelegate {
-    private var windowController: NSWindowController?
-    private let updaterController = SPUStandardUpdaterController(
-        startingUpdater: true,
-        updaterDelegate: nil,
-        userDriverDelegate: nil
-    )
-
     private let quitItem: NSMenuItem = {
         let quitItem = NSMenuItem(
             title: "Quit Burrow",
@@ -25,29 +15,8 @@ class AppDelegate: NSObject, NSApplicationDelegate {
         return quitItem
     }()
 
-    private lazy var openItem: NSMenuItem = {
-        let item = NSMenuItem(
-            title: "Open Burrow",
-            action: #selector(openWindow),
-            keyEquivalent: "o"
-        )
-        item.target = self
-        item.keyEquivalentModifierMask = .command
-        return item
-    }()
-
-    private lazy var checkForUpdatesItem: NSMenuItem = {
-        let item = NSMenuItem(
-            title: "Check for Updates...",
-            action: #selector(checkForUpdates(_:)),
-            keyEquivalent: ""
-        )
-        item.target = self
-        return item
-    }()
-
     private let toggleItem: NSMenuItem = {
-        let toggleView = NSHostingView(rootView: MenuItemToggleView())
+        let toggleView = NSHostingView(rootView: MenuItemToggleView(tunnel: BurrowApp.tunnel))
         toggleView.frame.size = CGSize(width: 300, height: 32)
         toggleView.autoresizingMask = [.width]
 
@@ -60,8 +29,6 @@ class AppDelegate: NSObject, NSApplicationDelegate {
         let menu = NSMenu()
         menu.items = [
             toggleItem,
-            openItem,
-            checkForUpdatesItem,
             .separator(),
             quitItem
         ]
@@ -72,7 +39,7 @@ class AppDelegate: NSObject, NSApplicationDelegate {
         let statusBar = NSStatusBar.system
         let statusItem = statusBar.statusItem(withLength: NSStatusItem.squareLength)
         if let button = statusItem.button {
-            button.image = NSImage(systemSymbolName: "pipe.and.drop.fill", accessibilityDescription: nil)
+            button.image = NSImage(systemSymbolName: "network.badge.shield.half.filled", accessibilityDescription: nil)
         }
         return statusItem
     }()
@@ -80,33 +47,5 @@ class AppDelegate: NSObject, NSApplicationDelegate {
     func applicationDidFinishLaunching(_ notification: Notification) {
         statusItem.menu = menu
     }
-
-    @objc
-    private func openWindow() {
-        if let window = windowController?.window {
-            window.makeKeyAndOrderFront(nil)
-            NSApplication.shared.activate(ignoringOtherApps: true)
-            return
-        }
-
-        let contentView = BurrowView()
-        let hostingController = NSHostingController(rootView: contentView)
-        let window = NSWindow(contentViewController: hostingController)
-        window.title = "Burrow"
-        window.setContentSize(NSSize(width: 820, height: 720))
-        window.styleMask.insert([.titled, .closable, .miniaturizable, .resizable])
-        window.center()
-
-        let controller = NSWindowController(window: window)
-        controller.shouldCascadeWindows = true
-        controller.showWindow(nil)
-        windowController = controller
-        NSApplication.shared.activate(ignoringOtherApps: true)
-    }
-
-    @objc
-    private func checkForUpdates(_ sender: Any?) {
-        updaterController.checkForUpdates(sender)
-    }
 }
 #endif
diff --git a/Apple/App/Assets.xcassets/AccentColor.colorset/Contents.json b/Apple/App/Assets.xcassets/AccentColor.colorset/Contents.json
new file mode 100644
index 0000000..eb87897
--- /dev/null
+++ b/Apple/App/Assets.xcassets/AccentColor.colorset/Contents.json
@@ -0,0 +1,11 @@
+{
+  "colors" : [
+    {
+      "idiom" : "universal"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}
diff --git a/Apple/App/Assets.xcassets/AppIcon.appiconset/Contents.json b/Apple/App/Assets.xcassets/AppIcon.appiconset/Contents.json
new file mode 100644
index 0000000..532cd72
--- /dev/null
+++ b/Apple/App/Assets.xcassets/AppIcon.appiconset/Contents.json
@@ -0,0 +1,63 @@
+{
+  "images" : [
+    {
+      "idiom" : "universal",
+      "platform" : "ios",
+      "size" : "1024x1024"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "16x16"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "16x16"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "32x32"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "32x32"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "128x128"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "128x128"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "256x256"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "256x256"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "512x512"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "512x512"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}
diff --git a/Apple/UI/Assets.xcassets/Contents.json b/Apple/App/Assets.xcassets/Contents.json
similarity index 100%
rename from Apple/UI/Assets.xcassets/Contents.json
rename to Apple/App/Assets.xcassets/Contents.json
diff --git a/Apple/App/BurrowApp.swift b/Apple/App/BurrowApp.swift
index 45529dc..e8aed86 100644
--- a/Apple/App/BurrowApp.swift
+++ b/Apple/App/BurrowApp.swift
@@ -1,46 +1,21 @@
-#if !os(macOS)
-import BurrowUI
 import SwiftUI
-#if os(iOS)
-import UIKit
-#endif
 
-@MainActor
 @main
+@MainActor
 struct BurrowApp: App {
+    static let tunnel = Tunnel { manager, proto in
+        proto.serverAddress = "hackclub.com"
+        manager.localizedDescription = "Burrow"
+    }
+
+    #if os(macOS)
+    @NSApplicationDelegateAdaptor(AppDelegate.self)
+    var delegate
+    #endif
+
     var body: some Scene {
         WindowGroup {
-            #if os(iOS)
-            BurrowView(appIconManager: UIKitAppIconManager())
-            #else
-            BurrowView()
-            #endif
+            TunnelView(tunnel: Self.tunnel)
         }
     }
 }
-
-#if os(iOS)
-@MainActor
-private struct UIKitAppIconManager: AppIconManaging {
-    var supportsAlternateIcons: Bool {
-        UIApplication.shared.supportsAlternateIcons
-    }
-
-    var alternateIconName: String? {
-        UIApplication.shared.alternateIconName
-    }
-
-    func setAlternateIconName(_ iconName: String?) async throws {
-        try await withCheckedThrowingContinuation { (continuation: CheckedContinuation<Void, any Error>) in
-            UIApplication.shared.setAlternateIconName(iconName) { error in
-                if let error {
-                    continuation.resume(throwing: error)
-                } else {
-                    continuation.resume(returning: ())
-                }
-            }
-        }
-    }
-}
-#endif
-#endif
diff --git a/Apple/App/MainMenu.xib b/Apple/App/MainMenu.xib
deleted file mode 100644
index 50ba431..0000000
--- a/Apple/App/MainMenu.xib
+++ /dev/null
@@ -1,679 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="23091" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES" customObjectInstantitationMethod="direct">
-    <dependencies>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="23091"/>
-    </dependencies>
-    <objects>
-        <customObject id="-2" userLabel="File's Owner" customClass="NSApplication">
-            <connections>
-                <outlet property="delegate" destination="Voe-Tx-rLC" id="GzC-gU-4Uq"/>
-            </connections>
-        </customObject>
-        <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
-        <customObject id="-3" userLabel="Application" customClass="NSObject"/>
-        <customObject id="Voe-Tx-rLC" customClass="AppDelegate" customModule="BurrowApp" customModuleProvider="target"/>
-        <customObject id="YLy-65-1bz" customClass="NSFontManager"/>
-        <menu title="Main Menu" systemMenu="main" id="AYu-sK-qS6">
-            <items>
-                <menuItem title="Burrow" id="1Xt-HY-uBw">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <menu key="submenu" title="Burrow" systemMenu="apple" id="uQy-DD-JDr">
-                        <items>
-                            <menuItem title="About Burrow" id="5kV-Vb-QxS">
-                                <modifierMask key="keyEquivalentModifierMask"/>
-                                <connections>
-                                    <action selector="orderFrontStandardAboutPanel:" target="-1" id="Exp-CZ-Vem"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem isSeparatorItem="YES" id="VOq-y0-SEH"/>
-                            <menuItem title="Preferences…" keyEquivalent="," id="BOF-NM-1cW"/>
-                            <menuItem isSeparatorItem="YES" id="wFC-TO-SCJ"/>
-                            <menuItem title="Services" id="NMo-om-nkz">
-                                <modifierMask key="keyEquivalentModifierMask"/>
-                                <menu key="submenu" title="Services" systemMenu="services" id="hz9-B4-Xy5"/>
-                            </menuItem>
-                            <menuItem isSeparatorItem="YES" id="4je-JR-u6R"/>
-                            <menuItem title="Hide Burrow" keyEquivalent="h" id="Olw-nP-bQN">
-                                <connections>
-                                    <action selector="hide:" target="-1" id="PnN-Uc-m68"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem title="Hide Others" keyEquivalent="h" id="Vdr-fp-XzO">
-                                <modifierMask key="keyEquivalentModifierMask" option="YES" command="YES"/>
-                                <connections>
-                                    <action selector="hideOtherApplications:" target="-1" id="VT4-aY-XCT"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem title="Show All" id="Kd2-mp-pUS">
-                                <modifierMask key="keyEquivalentModifierMask"/>
-                                <connections>
-                                    <action selector="unhideAllApplications:" target="-1" id="Dhg-Le-xox"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem isSeparatorItem="YES" id="kCx-OE-vgT"/>
-                            <menuItem title="Quit Burrow" keyEquivalent="q" id="4sb-4s-VLi">
-                                <connections>
-                                    <action selector="terminate:" target="-1" id="Te7-pn-YzF"/>
-                                </connections>
-                            </menuItem>
-                        </items>
-                    </menu>
-                </menuItem>
-                <menuItem title="File" id="dMs-cI-mzQ">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <menu key="submenu" title="File" id="bib-Uj-vzu">
-                        <items>
-                            <menuItem title="New" keyEquivalent="n" id="Was-JA-tGl">
-                                <connections>
-                                    <action selector="newDocument:" target="-1" id="4Si-XN-c54"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem title="Open…" keyEquivalent="o" id="IAo-SY-fd9">
-                                <connections>
-                                    <action selector="openDocument:" target="-1" id="bVn-NM-KNZ"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem title="Open Recent" id="tXI-mr-wws">
-                                <modifierMask key="keyEquivalentModifierMask"/>
-                                <menu key="submenu" title="Open Recent" systemMenu="recentDocuments" id="oas-Oc-fiZ">
-                                    <items>
-                                        <menuItem title="Clear Menu" id="vNY-rz-j42">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <connections>
-                                                <action selector="clearRecentDocuments:" target="-1" id="Daa-9d-B3U"/>
-                                            </connections>
-                                        </menuItem>
-                                    </items>
-                                </menu>
-                            </menuItem>
-                            <menuItem isSeparatorItem="YES" id="m54-Is-iLE"/>
-                            <menuItem title="Close" keyEquivalent="w" id="DVo-aG-piG">
-                                <connections>
-                                    <action selector="performClose:" target="-1" id="HmO-Ls-i7Q"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem title="Save…" keyEquivalent="s" id="pxx-59-PXV">
-                                <connections>
-                                    <action selector="saveDocument:" target="-1" id="teZ-XB-qJY"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem title="Save As…" keyEquivalent="S" id="Bw7-FT-i3A">
-                                <connections>
-                                    <action selector="saveDocumentAs:" target="-1" id="mDf-zr-I0C"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem title="Revert to Saved" keyEquivalent="r" id="KaW-ft-85H">
-                                <connections>
-                                    <action selector="revertDocumentToSaved:" target="-1" id="iJ3-Pv-kwq"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem isSeparatorItem="YES" id="aJh-i4-bef"/>
-                            <menuItem title="Page Setup…" keyEquivalent="P" id="qIS-W8-SiK">
-                                <modifierMask key="keyEquivalentModifierMask" shift="YES" command="YES"/>
-                                <connections>
-                                    <action selector="runPageLayout:" target="-1" id="Din-rz-gC5"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem title="Print…" keyEquivalent="p" id="aTl-1u-JFS">
-                                <connections>
-                                    <action selector="print:" target="-1" id="qaZ-4w-aoO"/>
-                                </connections>
-                            </menuItem>
-                        </items>
-                    </menu>
-                </menuItem>
-                <menuItem title="Edit" id="5QF-Oa-p0T">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <menu key="submenu" title="Edit" id="W48-6f-4Dl">
-                        <items>
-                            <menuItem title="Undo" keyEquivalent="z" id="dRJ-4n-Yzg">
-                                <connections>
-                                    <action selector="undo:" target="-1" id="M6e-cu-g7V"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem title="Redo" keyEquivalent="Z" id="6dh-zS-Vam">
-                                <connections>
-                                    <action selector="redo:" target="-1" id="oIA-Rs-6OD"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem isSeparatorItem="YES" id="WRV-NI-Exz"/>
-                            <menuItem title="Cut" keyEquivalent="x" id="uRl-iY-unG">
-                                <connections>
-                                    <action selector="cut:" target="-1" id="YJe-68-I9s"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem title="Copy" keyEquivalent="c" id="x3v-GG-iWU">
-                                <connections>
-                                    <action selector="copy:" target="-1" id="G1f-GL-Joy"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem title="Paste" keyEquivalent="v" id="gVA-U4-sdL">
-                                <connections>
-                                    <action selector="paste:" target="-1" id="UvS-8e-Qdg"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem title="Paste and Match Style" keyEquivalent="V" id="WeT-3V-zwk">
-                                <modifierMask key="keyEquivalentModifierMask" option="YES" command="YES"/>
-                                <connections>
-                                    <action selector="pasteAsPlainText:" target="-1" id="cEh-KX-wJQ"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem title="Delete" id="pa3-QI-u2k">
-                                <modifierMask key="keyEquivalentModifierMask"/>
-                                <connections>
-                                    <action selector="delete:" target="-1" id="0Mk-Ml-PaM"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem title="Select All" keyEquivalent="a" id="Ruw-6m-B2m">
-                                <connections>
-                                    <action selector="selectAll:" target="-1" id="VNm-Mi-diN"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem isSeparatorItem="YES" id="uyl-h8-XO2"/>
-                            <menuItem title="Find" id="4EN-yA-p0u">
-                                <modifierMask key="keyEquivalentModifierMask"/>
-                                <menu key="submenu" title="Find" id="1b7-l0-nxx">
-                                    <items>
-                                        <menuItem title="Find…" tag="1" keyEquivalent="f" id="Xz5-n4-O0W">
-                                            <connections>
-                                                <action selector="performFindPanelAction:" target="-1" id="cD7-Qs-BN4"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Find and Replace…" tag="12" keyEquivalent="f" id="YEy-JH-Tfz">
-                                            <modifierMask key="keyEquivalentModifierMask" option="YES" command="YES"/>
-                                            <connections>
-                                                <action selector="performFindPanelAction:" target="-1" id="WD3-Gg-5AJ"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Find Next" tag="2" keyEquivalent="g" id="q09-fT-Sye">
-                                            <connections>
-                                                <action selector="performFindPanelAction:" target="-1" id="NDo-RZ-v9R"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Find Previous" tag="3" keyEquivalent="G" id="OwM-mh-QMV">
-                                            <connections>
-                                                <action selector="performFindPanelAction:" target="-1" id="HOh-sY-3ay"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Use Selection for Find" tag="7" keyEquivalent="e" id="buJ-ug-pKt">
-                                            <connections>
-                                                <action selector="performFindPanelAction:" target="-1" id="U76-nv-p5D"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Jump to Selection" keyEquivalent="j" id="S0p-oC-mLd">
-                                            <connections>
-                                                <action selector="centerSelectionInVisibleArea:" target="-1" id="IOG-6D-g5B"/>
-                                            </connections>
-                                        </menuItem>
-                                    </items>
-                                </menu>
-                            </menuItem>
-                            <menuItem title="Spelling and Grammar" id="Dv1-io-Yv7">
-                                <modifierMask key="keyEquivalentModifierMask"/>
-                                <menu key="submenu" title="Spelling" id="3IN-sU-3Bg">
-                                    <items>
-                                        <menuItem title="Show Spelling and Grammar" keyEquivalent=":" id="HFo-cy-zxI">
-                                            <connections>
-                                                <action selector="showGuessPanel:" target="-1" id="vFj-Ks-hy3"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Check Document Now" keyEquivalent=";" id="hz2-CU-CR7">
-                                            <connections>
-                                                <action selector="checkSpelling:" target="-1" id="fz7-VC-reM"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem isSeparatorItem="YES" id="bNw-od-mp5"/>
-                                        <menuItem title="Check Spelling While Typing" id="rbD-Rh-wIN">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <connections>
-                                                <action selector="toggleContinuousSpellChecking:" target="-1" id="7w6-Qz-0kB"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Check Grammar With Spelling" id="mK6-2p-4JG">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <connections>
-                                                <action selector="toggleGrammarChecking:" target="-1" id="muD-Qn-j4w"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Correct Spelling Automatically" id="78Y-hA-62v">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <connections>
-                                                <action selector="toggleAutomaticSpellingCorrection:" target="-1" id="2lM-Qi-WAP"/>
-                                            </connections>
-                                        </menuItem>
-                                    </items>
-                                </menu>
-                            </menuItem>
-                            <menuItem title="Substitutions" id="9ic-FL-obx">
-                                <modifierMask key="keyEquivalentModifierMask"/>
-                                <menu key="submenu" title="Substitutions" id="FeM-D8-WVr">
-                                    <items>
-                                        <menuItem title="Show Substitutions" id="z6F-FW-3nz">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <connections>
-                                                <action selector="orderFrontSubstitutionsPanel:" target="-1" id="oku-mr-iSq"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem isSeparatorItem="YES" id="gPx-C9-uUO"/>
-                                        <menuItem title="Smart Copy/Paste" id="9yt-4B-nSM">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <connections>
-                                                <action selector="toggleSmartInsertDelete:" target="-1" id="3IJ-Se-DZD"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Smart Quotes" id="hQb-2v-fYv">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <connections>
-                                                <action selector="toggleAutomaticQuoteSubstitution:" target="-1" id="ptq-xd-QOA"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Smart Dashes" id="rgM-f4-ycn">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <connections>
-                                                <action selector="toggleAutomaticDashSubstitution:" target="-1" id="oCt-pO-9gS"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Smart Links" id="cwL-P1-jid">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <connections>
-                                                <action selector="toggleAutomaticLinkDetection:" target="-1" id="Gip-E3-Fov"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Data Detectors" id="tRr-pd-1PS">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <connections>
-                                                <action selector="toggleAutomaticDataDetection:" target="-1" id="R1I-Nq-Kbl"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Text Replacement" id="HFQ-gK-NFA">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <connections>
-                                                <action selector="toggleAutomaticTextReplacement:" target="-1" id="DvP-Fe-Py6"/>
-                                            </connections>
-                                        </menuItem>
-                                    </items>
-                                </menu>
-                            </menuItem>
-                            <menuItem title="Transformations" id="2oI-Rn-ZJC">
-                                <modifierMask key="keyEquivalentModifierMask"/>
-                                <menu key="submenu" title="Transformations" id="c8a-y6-VQd">
-                                    <items>
-                                        <menuItem title="Make Upper Case" id="vmV-6d-7jI">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <connections>
-                                                <action selector="uppercaseWord:" target="-1" id="sPh-Tk-edu"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Make Lower Case" id="d9M-CD-aMd">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <connections>
-                                                <action selector="lowercaseWord:" target="-1" id="iUZ-b5-hil"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Capitalize" id="UEZ-Bs-lqG">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <connections>
-                                                <action selector="capitalizeWord:" target="-1" id="26H-TL-nsh"/>
-                                            </connections>
-                                        </menuItem>
-                                    </items>
-                                </menu>
-                            </menuItem>
-                            <menuItem title="Speech" id="xrE-MZ-jX0">
-                                <modifierMask key="keyEquivalentModifierMask"/>
-                                <menu key="submenu" title="Speech" id="3rS-ZA-NoH">
-                                    <items>
-                                        <menuItem title="Start Speaking" id="Ynk-f8-cLZ">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <connections>
-                                                <action selector="startSpeaking:" target="-1" id="654-Ng-kyl"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Stop Speaking" id="Oyz-dy-DGm">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <connections>
-                                                <action selector="stopSpeaking:" target="-1" id="dX8-6p-jy9"/>
-                                            </connections>
-                                        </menuItem>
-                                    </items>
-                                </menu>
-                            </menuItem>
-                        </items>
-                    </menu>
-                </menuItem>
-                <menuItem title="Format" id="jxT-CU-nIS">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <menu key="submenu" title="Format" id="GEO-Iw-cKr">
-                        <items>
-                            <menuItem title="Font" id="Gi5-1S-RQB">
-                                <modifierMask key="keyEquivalentModifierMask"/>
-                                <menu key="submenu" title="Font" systemMenu="font" id="aXa-aM-Jaq">
-                                    <items>
-                                        <menuItem title="Show Fonts" keyEquivalent="t" id="Q5e-8K-NDq">
-                                            <connections>
-                                                <action selector="orderFrontFontPanel:" target="YLy-65-1bz" id="WHr-nq-2xA"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Bold" tag="2" keyEquivalent="b" id="GB9-OM-e27">
-                                            <connections>
-                                                <action selector="addFontTrait:" target="YLy-65-1bz" id="hqk-hr-sYV"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Italic" tag="1" keyEquivalent="i" id="Vjx-xi-njq">
-                                            <connections>
-                                                <action selector="addFontTrait:" target="YLy-65-1bz" id="IHV-OB-c03"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Underline" keyEquivalent="u" id="WRG-CD-K1S">
-                                            <connections>
-                                                <action selector="underline:" target="-1" id="FYS-2b-JAY"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem isSeparatorItem="YES" id="5gT-KC-WSO"/>
-                                        <menuItem title="Bigger" tag="3" keyEquivalent="+" id="Ptp-SP-VEL">
-                                            <connections>
-                                                <action selector="modifyFont:" target="YLy-65-1bz" id="Uc7-di-UnL"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Smaller" tag="4" keyEquivalent="-" id="i1d-Er-qST">
-                                            <connections>
-                                                <action selector="modifyFont:" target="YLy-65-1bz" id="HcX-Lf-eNd"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem isSeparatorItem="YES" id="kx3-Dk-x3B"/>
-                                        <menuItem title="Kern" id="jBQ-r6-VK2">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <menu key="submenu" title="Kern" id="tlD-Oa-oAM">
-                                                <items>
-                                                    <menuItem title="Use Default" id="GUa-eO-cwY">
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                        <connections>
-                                                            <action selector="useStandardKerning:" target="-1" id="6dk-9l-Ckg"/>
-                                                        </connections>
-                                                    </menuItem>
-                                                    <menuItem title="Use None" id="cDB-IK-hbR">
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                        <connections>
-                                                            <action selector="turnOffKerning:" target="-1" id="U8a-gz-Maa"/>
-                                                        </connections>
-                                                    </menuItem>
-                                                    <menuItem title="Tighten" id="46P-cB-AYj">
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                        <connections>
-                                                            <action selector="tightenKerning:" target="-1" id="hr7-Nz-8ro"/>
-                                                        </connections>
-                                                    </menuItem>
-                                                    <menuItem title="Loosen" id="ogc-rX-tC1">
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                        <connections>
-                                                            <action selector="loosenKerning:" target="-1" id="8i4-f9-FKE"/>
-                                                        </connections>
-                                                    </menuItem>
-                                                </items>
-                                            </menu>
-                                        </menuItem>
-                                        <menuItem title="Ligatures" id="o6e-r0-MWq">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <menu key="submenu" title="Ligatures" id="w0m-vy-SC9">
-                                                <items>
-                                                    <menuItem title="Use Default" id="agt-UL-0e3">
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                        <connections>
-                                                            <action selector="useStandardLigatures:" target="-1" id="7uR-wd-Dx6"/>
-                                                        </connections>
-                                                    </menuItem>
-                                                    <menuItem title="Use None" id="J7y-lM-qPV">
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                        <connections>
-                                                            <action selector="turnOffLigatures:" target="-1" id="iX2-gA-Ilz"/>
-                                                        </connections>
-                                                    </menuItem>
-                                                    <menuItem title="Use All" id="xQD-1f-W4t">
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                        <connections>
-                                                            <action selector="useAllLigatures:" target="-1" id="KcB-kA-TuK"/>
-                                                        </connections>
-                                                    </menuItem>
-                                                </items>
-                                            </menu>
-                                        </menuItem>
-                                        <menuItem title="Baseline" id="OaQ-X3-Vso">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <menu key="submenu" title="Baseline" id="ijk-EB-dga">
-                                                <items>
-                                                    <menuItem title="Use Default" id="3Om-Ey-2VK">
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                        <connections>
-                                                            <action selector="unscript:" target="-1" id="0vZ-95-Ywn"/>
-                                                        </connections>
-                                                    </menuItem>
-                                                    <menuItem title="Superscript" id="Rqc-34-cIF">
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                        <connections>
-                                                            <action selector="superscript:" target="-1" id="3qV-fo-wpU"/>
-                                                        </connections>
-                                                    </menuItem>
-                                                    <menuItem title="Subscript" id="I0S-gh-46l">
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                        <connections>
-                                                            <action selector="subscript:" target="-1" id="Q6W-4W-IGz"/>
-                                                        </connections>
-                                                    </menuItem>
-                                                    <menuItem title="Raise" id="2h7-ER-AoG">
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                        <connections>
-                                                            <action selector="raiseBaseline:" target="-1" id="4sk-31-7Q9"/>
-                                                        </connections>
-                                                    </menuItem>
-                                                    <menuItem title="Lower" id="1tx-W0-xDw">
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                        <connections>
-                                                            <action selector="lowerBaseline:" target="-1" id="OF1-bc-KW4"/>
-                                                        </connections>
-                                                    </menuItem>
-                                                </items>
-                                            </menu>
-                                        </menuItem>
-                                        <menuItem isSeparatorItem="YES" id="Ndw-q3-faq"/>
-                                        <menuItem title="Show Colors" keyEquivalent="C" id="bgn-CT-cEk">
-                                            <connections>
-                                                <action selector="orderFrontColorPanel:" target="-1" id="mSX-Xz-DV3"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem isSeparatorItem="YES" id="iMs-zA-UFJ"/>
-                                        <menuItem title="Copy Style" keyEquivalent="c" id="5Vv-lz-BsD">
-                                            <modifierMask key="keyEquivalentModifierMask" option="YES" command="YES"/>
-                                            <connections>
-                                                <action selector="copyFont:" target="-1" id="GJO-xA-L4q"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Paste Style" keyEquivalent="v" id="vKC-jM-MkH">
-                                            <modifierMask key="keyEquivalentModifierMask" option="YES" command="YES"/>
-                                            <connections>
-                                                <action selector="pasteFont:" target="-1" id="JfD-CL-leO"/>
-                                            </connections>
-                                        </menuItem>
-                                    </items>
-                                </menu>
-                            </menuItem>
-                            <menuItem title="Text" id="Fal-I4-PZk">
-                                <modifierMask key="keyEquivalentModifierMask"/>
-                                <menu key="submenu" title="Text" id="d9c-me-L2H">
-                                    <items>
-                                        <menuItem title="Align Left" keyEquivalent="{" id="ZM1-6Q-yy1">
-                                            <connections>
-                                                <action selector="alignLeft:" target="-1" id="zUv-R1-uAa"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Center" keyEquivalent="|" id="VIY-Ag-zcb">
-                                            <connections>
-                                                <action selector="alignCenter:" target="-1" id="spX-mk-kcS"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Justify" id="J5U-5w-g23">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <connections>
-                                                <action selector="alignJustified:" target="-1" id="ljL-7U-jND"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Align Right" keyEquivalent="}" id="wb2-vD-lq4">
-                                            <connections>
-                                                <action selector="alignRight:" target="-1" id="r48-bG-YeY"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem isSeparatorItem="YES" id="4s2-GY-VfK"/>
-                                        <menuItem title="Writing Direction" id="H1b-Si-o9J">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <menu key="submenu" title="Writing Direction" id="8mr-sm-Yjd">
-                                                <items>
-                                                    <menuItem title="Paragraph" enabled="NO" id="ZvO-Gk-QUH">
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                    </menuItem>
-                                                    <menuItem id="YGs-j5-SAR">
-                                                        <string key="title">	Default</string>
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                        <connections>
-                                                            <action selector="makeBaseWritingDirectionNatural:" target="-1" id="qtV-5e-UBP"/>
-                                                        </connections>
-                                                    </menuItem>
-                                                    <menuItem id="Lbh-J2-qVU">
-                                                        <string key="title">	Left to Right</string>
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                        <connections>
-                                                            <action selector="makeBaseWritingDirectionLeftToRight:" target="-1" id="S0X-9S-QSf"/>
-                                                        </connections>
-                                                    </menuItem>
-                                                    <menuItem id="jFq-tB-4Kx">
-                                                        <string key="title">	Right to Left</string>
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                        <connections>
-                                                            <action selector="makeBaseWritingDirectionRightToLeft:" target="-1" id="5fk-qB-AqJ"/>
-                                                        </connections>
-                                                    </menuItem>
-                                                    <menuItem isSeparatorItem="YES" id="swp-gr-a21"/>
-                                                    <menuItem title="Selection" enabled="NO" id="cqv-fj-IhA">
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                    </menuItem>
-                                                    <menuItem id="Nop-cj-93Q">
-                                                        <string key="title">	Default</string>
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                        <connections>
-                                                            <action selector="makeTextWritingDirectionNatural:" target="-1" id="lPI-Se-ZHp"/>
-                                                        </connections>
-                                                    </menuItem>
-                                                    <menuItem id="BgM-ve-c93">
-                                                        <string key="title">	Left to Right</string>
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                        <connections>
-                                                            <action selector="makeTextWritingDirectionLeftToRight:" target="-1" id="caW-Bv-w94"/>
-                                                        </connections>
-                                                    </menuItem>
-                                                    <menuItem id="RB4-Sm-HuC">
-                                                        <string key="title">	Right to Left</string>
-                                                        <modifierMask key="keyEquivalentModifierMask"/>
-                                                        <connections>
-                                                            <action selector="makeTextWritingDirectionRightToLeft:" target="-1" id="EXD-6r-ZUu"/>
-                                                        </connections>
-                                                    </menuItem>
-                                                </items>
-                                            </menu>
-                                        </menuItem>
-                                        <menuItem isSeparatorItem="YES" id="fKy-g9-1gm"/>
-                                        <menuItem title="Show Ruler" id="vLm-3I-IUL">
-                                            <modifierMask key="keyEquivalentModifierMask"/>
-                                            <connections>
-                                                <action selector="toggleRuler:" target="-1" id="FOx-HJ-KwY"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Copy Ruler" keyEquivalent="c" id="MkV-Pr-PK5">
-                                            <modifierMask key="keyEquivalentModifierMask" control="YES" command="YES"/>
-                                            <connections>
-                                                <action selector="copyRuler:" target="-1" id="71i-fW-3W2"/>
-                                            </connections>
-                                        </menuItem>
-                                        <menuItem title="Paste Ruler" keyEquivalent="v" id="LVM-kO-fVI">
-                                            <modifierMask key="keyEquivalentModifierMask" control="YES" command="YES"/>
-                                            <connections>
-                                                <action selector="pasteRuler:" target="-1" id="cSh-wd-qM2"/>
-                                            </connections>
-                                        </menuItem>
-                                    </items>
-                                </menu>
-                            </menuItem>
-                        </items>
-                    </menu>
-                </menuItem>
-                <menuItem title="View" id="H8h-7b-M4v">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <menu key="submenu" title="View" id="HyV-fh-RgO">
-                        <items>
-                            <menuItem title="Show Toolbar" keyEquivalent="t" id="snW-S8-Cw5">
-                                <modifierMask key="keyEquivalentModifierMask" option="YES" command="YES"/>
-                                <connections>
-                                    <action selector="toggleToolbarShown:" target="-1" id="BXY-wc-z0C"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem title="Customize Toolbar…" id="1UK-8n-QPP">
-                                <modifierMask key="keyEquivalentModifierMask"/>
-                                <connections>
-                                    <action selector="runToolbarCustomizationPalette:" target="-1" id="pQI-g3-MTW"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem isSeparatorItem="YES" id="hB3-LF-h0Y"/>
-                            <menuItem title="Show Sidebar" keyEquivalent="s" id="kIP-vf-haE">
-                                <modifierMask key="keyEquivalentModifierMask" control="YES" command="YES"/>
-                                <connections>
-                                    <action selector="toggleSidebar:" target="-1" id="iwa-gc-5KM"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem title="Enter Full Screen" keyEquivalent="f" id="4J7-dP-txa">
-                                <modifierMask key="keyEquivalentModifierMask" control="YES" command="YES"/>
-                                <connections>
-                                    <action selector="toggleFullScreen:" target="-1" id="dU3-MA-1Rq"/>
-                                </connections>
-                            </menuItem>
-                        </items>
-                    </menu>
-                </menuItem>
-                <menuItem title="Window" id="aUF-d1-5bR">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <menu key="submenu" title="Window" systemMenu="window" id="Td7-aD-5lo">
-                        <items>
-                            <menuItem title="Minimize" keyEquivalent="m" id="OY7-WF-poV">
-                                <connections>
-                                    <action selector="performMiniaturize:" target="-1" id="VwT-WD-YPe"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem title="Zoom" id="R4o-n2-Eq4">
-                                <modifierMask key="keyEquivalentModifierMask"/>
-                                <connections>
-                                    <action selector="performZoom:" target="-1" id="DIl-cC-cCs"/>
-                                </connections>
-                            </menuItem>
-                            <menuItem isSeparatorItem="YES" id="eu3-7i-yIM"/>
-                            <menuItem title="Bring All to Front" id="LE2-aR-0XJ">
-                                <modifierMask key="keyEquivalentModifierMask"/>
-                                <connections>
-                                    <action selector="arrangeInFront:" target="-1" id="DRN-fu-gQh"/>
-                                </connections>
-                            </menuItem>
-                        </items>
-                    </menu>
-                </menuItem>
-                <menuItem title="Help" id="wpr-3q-Mcd">
-                    <modifierMask key="keyEquivalentModifierMask"/>
-                    <menu key="submenu" title="Help" systemMenu="help" id="F2S-fz-NVQ">
-                        <items>
-                            <menuItem title="Burrow Help" keyEquivalent="?" id="FKE-Sm-Kum">
-                                <connections>
-                                    <action selector="showHelp:" target="-1" id="y7X-2Q-9no"/>
-                                </connections>
-                            </menuItem>
-                        </items>
-                    </menu>
-                </menuItem>
-            </items>
-            <point key="canvasLocation" x="200" y="121"/>
-        </menu>
-    </objects>
-</document>
diff --git a/Apple/App/Menu/MenuView.swift b/Apple/App/Menu/MenuView.swift
new file mode 100644
index 0000000..eab8da2
--- /dev/null
+++ b/Apple/App/Menu/MenuView.swift
@@ -0,0 +1,60 @@
+//
+//  MenuView.swift
+//  App
+//
+//  Created by Thomas Stubblefield on 5/13/23.
+//
+
+import SwiftUI
+
+struct MenuItemToggleView: View {
+    var tunnel: Tunnel
+
+    var body: some View {
+        HStack {
+            Text("Burrow")
+                .font(.headline)
+            Spacer()
+            Toggle("Burrow", isOn: tunnel.isOn)
+                .labelsHidden()
+                .disabled(tunnel.isDisabled)
+                .toggleStyle(.switch)
+        }
+        .padding(.horizontal, 4)
+        .padding(10)
+        .frame(minWidth: 300, minHeight: 32, maxHeight: 32)
+    }
+}
+
+extension Tunnel {
+    var isDisabled: Bool {
+        switch self.status {
+        case .disconnected, .permissionRequired, .connected:
+            return false
+        case .unknown, .disabled, .connecting, .reasserting, .disconnecting, .invalid, .configurationReadWriteFailed:
+            return true
+        }
+    }
+
+    var isOn: Binding<Bool> {
+        Binding {
+            switch self.status {
+            case .connecting, .reasserting, .connected:
+                true
+            default:
+                false
+            }
+        } set: { newValue in
+            switch (self.status, newValue) {
+            case (.permissionRequired, true):
+                Task { try await self.configure() }
+            case (.disconnected, true):
+                try? self.start()
+            case (.connected, false):
+                self.stop()
+            default:
+                return
+            }
+        }
+    }
+}
diff --git a/Apple/UI/NetworkExtension+Async.swift b/Apple/App/NetworkExtension+Async.swift
similarity index 82%
rename from Apple/UI/NetworkExtension+Async.swift
rename to Apple/App/NetworkExtension+Async.swift
index 5820e7f..4833efb 100644
--- a/Apple/UI/NetworkExtension+Async.swift
+++ b/Apple/App/NetworkExtension+Async.swift
@@ -1,6 +1,6 @@
 import NetworkExtension
 
-extension NEVPNManager: @unchecked @retroactive Sendable {
+extension NEVPNManager {
     func remove() async throws {
         _ = try await withUnsafeThrowingContinuation { continuation in
             removeFromPreferences(completionHandler: completion(continuation))
@@ -14,7 +14,7 @@ extension NEVPNManager: @unchecked @retroactive Sendable {
     }
 }
 
-extension NETunnelProviderManager: @unchecked @retroactive Sendable {
+extension NETunnelProviderManager {
     class var managers: [NETunnelProviderManager] {
         get async throws {
             try await withUnsafeThrowingContinuation { continuation in
@@ -34,7 +34,7 @@ private func completion(_ continuation: UnsafeContinuation<Void, Error>) -> (Err
     }
 }
 
-private func completion<T: Sendable>(_ continuation: UnsafeContinuation<T, Error>) -> (T?, Error?) -> Void {
+private func completion<T>(_ continuation: UnsafeContinuation<T, Error>) -> (T?, Error?) -> Void {
     return { value, error in
         if let error {
             continuation.resume(throwing: error)
diff --git a/Apple/App/Status.swift b/Apple/App/Status.swift
new file mode 100644
index 0000000..c08cdd1
--- /dev/null
+++ b/Apple/App/Status.swift
@@ -0,0 +1,42 @@
+import Foundation
+import NetworkExtension
+
+extension Tunnel {
+    enum Status: CustomStringConvertible, Equatable, Hashable {
+        case unknown
+        case permissionRequired
+        case disabled
+        case connecting
+        case connected(Date)
+        case disconnecting
+        case disconnected
+        case reasserting
+        case invalid
+        case configurationReadWriteFailed
+
+        var description: String {
+            switch self {
+            case .unknown:
+                return "Unknown"
+            case .permissionRequired:
+                return "Permission Required"
+            case .disconnected:
+                return "Disconnected"
+            case .disabled:
+                return "Disabled"
+            case .connecting:
+                return "Connecting"
+            case .connected:
+                return "Connected"
+            case .disconnecting:
+                return "Disconnecting"
+            case .reasserting:
+                return "Reasserting"
+            case .invalid:
+                return "Invalid"
+            case .configurationReadWriteFailed:
+                return "System Error"
+            }
+        }
+    }
+}
diff --git a/Apple/App/Tunnel.swift b/Apple/App/Tunnel.swift
new file mode 100644
index 0000000..5542170
--- /dev/null
+++ b/Apple/App/Tunnel.swift
@@ -0,0 +1,146 @@
+import BurrowShared
+import NetworkExtension
+import SwiftUI
+
+@Observable
+class Tunnel {
+    private(set) var status: Status = .unknown
+    private var error: NEVPNError?
+
+    private let logger = Logger.logger(for: Tunnel.self)
+    private let bundleIdentifier: String
+    private let configure: (NETunnelProviderManager, NETunnelProviderProtocol) -> Void
+    private var tasks: [Task<Void, Error>] = []
+
+    // Each manager corresponds to one entry in the Settings app.
+    // Our goal is to maintain a single manager, so we create one if none exist and delete extra if there are any.
+    private var managers: [NEVPNManager]? {
+        didSet { status = currentStatus }
+    }
+
+    private var currentStatus: Status {
+        guard let managers = managers else {
+            guard let error = error else {
+                return .unknown
+            }
+
+            switch error.code {
+            case .configurationReadWriteFailed:
+                return .configurationReadWriteFailed
+            default:
+                return .unknown
+            }
+        }
+
+        guard let manager = managers.first else {
+            return .permissionRequired
+        }
+
+        guard manager.isEnabled else {
+            return .disabled
+        }
+
+        return manager.connection.tunnelStatus
+    }
+
+    convenience init(configure: @escaping (NETunnelProviderManager, NETunnelProviderProtocol) -> Void) {
+        self.init("com.hackclub.burrow.network", configure: configure)
+    }
+
+    init(_ bundleIdentifier: String, configure: @escaping (NETunnelProviderManager, NETunnelProviderProtocol) -> Void) {
+        self.bundleIdentifier = bundleIdentifier
+        self.configure = configure
+
+        let center = NotificationCenter.default
+        let configurationChanged = Task {
+            for try await _ in center.notifications(named: .NEVPNConfigurationChange).map({ _ in () }) {
+                await update()
+            }
+        }
+        let statusChanged = Task {
+            for try await _ in center.notifications(named: .NEVPNStatusDidChange).map({ _ in () }) {
+                await MainActor.run {
+                    status = currentStatus
+                }
+            }
+        }
+        tasks = [configurationChanged, statusChanged]
+
+        Task { await update() }
+    }
+
+    private func update() async {
+        do {
+            let updated = try await NETunnelProviderManager.managers
+            await MainActor.run {
+                managers = updated
+            }
+        } catch let vpnError as NEVPNError {
+            error = vpnError
+        } catch {
+            logger.error("Failed to update VPN configurations: \(error)")
+        }
+    }
+
+    func configure() async throws {
+        if managers == nil {
+            await update()
+        }
+
+        guard let managers = managers else { return }
+
+        if managers.count > 1 {
+            try await withThrowingTaskGroup(of: Void.self, returning: Void.self) { group in
+                for manager in managers.suffix(from: 1) {
+                    group.addTask { try await manager.remove() }
+                }
+                try await group.waitForAll()
+            }
+        }
+
+        if managers.isEmpty {
+            let manager = NETunnelProviderManager()
+            let proto = NETunnelProviderProtocol()
+            proto.providerBundleIdentifier = bundleIdentifier
+            configure(manager, proto)
+
+            manager.protocolConfiguration = proto
+            try await manager.save()
+        }
+    }
+
+    func start() throws {
+        guard let manager = managers?.first else { return }
+        try manager.connection.startVPNTunnel()
+    }
+
+    func stop() {
+        guard let manager = managers?.first else { return }
+        manager.connection.stopVPNTunnel()
+    }
+
+    deinit {
+        tasks.forEach { $0.cancel() }
+    }
+}
+
+extension NEVPNConnection {
+    var tunnelStatus: Tunnel.Status {
+        switch status {
+        case .connected:
+            .connected(connectedDate!)
+        case .connecting:
+            .connecting
+        case .disconnecting:
+            .disconnecting
+        case .disconnected:
+            .disconnected
+        case .reasserting:
+            .reasserting
+        case .invalid:
+            .invalid
+        @unknown default:
+            .unknown
+        }
+    }
+}
diff --git a/Apple/App/TunnelView.swift b/Apple/App/TunnelView.swift
new file mode 100644
index 0000000..dd91603
--- /dev/null
+++ b/Apple/App/TunnelView.swift
@@ -0,0 +1,34 @@
+import SwiftUI
+
+struct TunnelView: View {
+    var tunnel: Tunnel
+
+    var body: some View {
+        VStack {
+            Text(verbatim: tunnel.status.description)
+            switch tunnel.status {
+            case .connected:
+                Button("Disconnect", action: stop)
+            case .permissionRequired:
+                Button("Allow", action: configure)
+            case .disconnected:
+                Button("Start", action: start)
+            default:
+                EmptyView()
+            }
+        }
+        .padding()
+    }
+
+    private func start() {
+        try? tunnel.start()
+    }
+
+    private func stop() {
+        tunnel.stop()
+    }
+
+    private func configure() {
+        Task { try await tunnel.configure() }
+    }
+}
diff --git a/Apple/AppUITests/BurrowUITests.swift b/Apple/AppUITests/BurrowUITests.swift
deleted file mode 100644
index b7d8111..0000000
--- a/Apple/AppUITests/BurrowUITests.swift
+++ /dev/null
@@ -1,439 +0,0 @@
-import XCTest
-import UIKit
-
-@MainActor
-final class BurrowTailnetLoginUITests: XCTestCase {
-    private enum TailnetLoginMode: String, Decodable {
-        case tailscale
-        case discovered
-    }
-
-    private struct TestConfig: Decodable {
-        let email: String
-        let username: String
-        let password: String
-        let mode: TailnetLoginMode?
-    }
-
-    override func setUpWithError() throws {
-        continueAfterFailure = false
-    }
-
-    func testTailnetLoginThroughAuthentikWebSession() throws {
-        let config = try loadTestConfig()
-        let email = config.email
-        let username = config.username
-        let password = config.password
-        let mode = config.mode ?? .tailscale
-        let browserIdentity = mode == .tailscale ? email : username
-
-        let app = XCUIApplication()
-        app.launch()
-
-        let tailnetButton = app.buttons["quick-add-tailnet"]
-        XCTAssertTrue(tailnetButton.waitForExistence(timeout: 15), "Tailnet add button did not appear")
-        tailnetButton.tap()
-
-        configureTailnetIfNeeded(in: app, mode: mode)
-
-        let discoveryField = app.textFields["tailnet-discovery-email"]
-        XCTAssertTrue(discoveryField.waitForExistence(timeout: 10), "Tailnet discovery email field did not appear")
-        replaceText(in: discoveryField, with: email)
-
-        let serverCard = app.descendants(matching: .any)
-            .matching(identifier: "tailnet-server-card")
-            .firstMatch
-        XCTAssertTrue(serverCard.waitForExistence(timeout: 5), "Tailnet server card did not appear")
-
-        let signInButton = app.buttons["tailnet-start-sign-in"]
-        XCTAssertTrue(signInButton.waitForExistence(timeout: 10), "Tailnet sign-in button did not appear")
-        signInButton.tap()
-
-        acceptAuthenticationPromptIfNeeded(in: app, timeout: 20)
-
-        let webSession = webAuthenticationSession()
-        XCTAssertTrue(webSession.waitForExistence(timeout: 20), "Safari authentication session did not appear")
-
-        signIntoAuthentik(in: webSession, username: browserIdentity, password: password)
-
-        app.activate()
-        XCTAssertTrue(
-            waitForTailnetSignedIn(in: app, timeout: 60),
-            "Tailnet sign-in never reached the running state"
-        )
-    }
-
-    private func configureTailnetIfNeeded(in app: XCUIApplication, mode: TailnetLoginMode) {
-        guard mode == .discovered else { return }
-
-        openTailnetMenu(in: app)
-        tapMenuButton(named: "Edit Custom Server", in: app)
-
-        openTailnetMenu(in: app)
-        tapMenuButton(named: "Show Advanced Settings", in: app)
-
-        let authorityField = app.textFields["tailnet-authority"]
-        XCTAssertTrue(authorityField.waitForExistence(timeout: 10), "Tailnet authority field did not appear")
-        replaceText(in: authorityField, with: "")
-    }
-
-    private func openTailnetMenu(in app: XCUIApplication) {
-        let moreButton = app.buttons["More"]
-        XCTAssertTrue(moreButton.waitForExistence(timeout: 5), "Tailnet menu button did not appear")
-        moreButton.tap()
-    }
-
-    private func tapMenuButton(named title: String, in app: XCUIApplication) {
-        let menuButton = firstExistingElement(
-            from: [
-                app.buttons[title],
-                app.descendants(matching: .button)[title],
-            ],
-            timeout: 5
-        )
-        XCTAssertTrue(menuButton.exists, "Menu action \(title) did not appear")
-        menuButton.tap()
-    }
-
-    private func acceptAuthenticationPromptIfNeeded(
-        in app: XCUIApplication,
-        timeout: TimeInterval
-    ) {
-        let springboard = XCUIApplication(bundleIdentifier: "com.apple.springboard")
-        let deadline = Date().addingTimeInterval(timeout)
-
-        repeat {
-            let promptCandidates = [
-                springboard.buttons["Continue"],
-                springboard.buttons["Allow"],
-                app.buttons["Continue"],
-                app.buttons["Allow"],
-            ]
-
-            for button in promptCandidates where button.exists && button.isHittable {
-                button.tap()
-                return
-            }
-
-            RunLoop.current.run(until: Date().addingTimeInterval(0.25))
-        } while Date() < deadline
-
-        let promptCandidates = [
-            springboard.buttons["Continue"],
-            springboard.buttons["Allow"],
-            app.buttons["Continue"],
-            app.buttons["Allow"],
-        ]
-
-        for button in promptCandidates where button.exists {
-            button.tap()
-            return
-        }
-    }
-
-    private func webAuthenticationSession() -> XCUIApplication {
-        let safariViewService = XCUIApplication(bundleIdentifier: "com.apple.SafariViewService")
-        if safariViewService.waitForExistence(timeout: 5) {
-            return safariViewService
-        }
-
-        let safari = XCUIApplication(bundleIdentifier: "com.apple.mobilesafari")
-        _ = safari.waitForExistence(timeout: 5)
-        return safari
-    }
-
-    private func signIntoAuthentik(in webSession: XCUIApplication, username: String, password: String) {
-        followTailnetRedirectIfNeeded(in: webSession)
-
-        if !webSession.exists {
-            return
-        }
-
-        let immediatePasswordField = firstExistingSecureField(in: webSession, timeout: 2)
-        if immediatePasswordField.exists {
-            replaceSecureText(in: immediatePasswordField, within: webSession, with: password)
-            submitAuthenticationForm(in: webSession, focusedField: immediatePasswordField)
-            return
-        }
-
-        let usernameField = firstExistingElement(
-            in: webSession,
-            queries: [
-                { $0.textFields["Username"] },
-                { $0.textFields["Email or Username"] },
-                { $0.textFields["Email address"] },
-                { $0.textFields["Email"] },
-                { $0.webViews.textFields["Username"] },
-                { $0.webViews.textFields["Email or Username"] },
-                { $0.descendants(matching: .textField).firstMatch },
-            ],
-            timeout: 12
-        )
-        if !usernameField.exists {
-            return
-        }
-        replaceText(in: usernameField, with: username)
-
-        tapFirstExistingButton(
-            in: webSession,
-            titles: ["Continue", "Next", "Sign In", "Log in", "Login"],
-            timeout: 5
-        )
-
-        let passwordField = firstExistingSecureField(in: webSession, timeout: 20)
-        XCTAssertTrue(passwordField.exists, "Authentik password field did not appear")
-        replaceSecureText(in: passwordField, within: webSession, with: password)
-        submitAuthenticationForm(in: webSession, focusedField: passwordField)
-    }
-
-    private func followTailnetRedirectIfNeeded(in webSession: XCUIApplication) {
-        let redirectCandidates = [
-            webSession.links["Found"],
-            webSession.webViews.links["Found"],
-            webSession.buttons["Found"],
-            webSession.webViews.buttons["Found"],
-        ]
-
-        let redirectLink = firstExistingElement(from: redirectCandidates, timeout: 8)
-        if redirectLink.exists {
-            redirectLink.tap()
-        }
-    }
-
-    private func firstExistingSecureField(in app: XCUIApplication, timeout: TimeInterval) -> XCUIElement {
-        let candidates = [
-            app.descendants(matching: .secureTextField).firstMatch,
-            app.secureTextFields["Password"],
-            app.secureTextFields["Password or Token"],
-            app.webViews.secureTextFields["Password"],
-            app.webViews.secureTextFields["Password or Token"],
-        ]
-
-        return firstExistingElement(from: candidates, timeout: timeout)
-    }
-
-    private func tapFirstExistingButton(
-        in app: XCUIApplication,
-        titles: [String],
-        timeout: TimeInterval
-    ) {
-        let candidates = titles.flatMap { title in
-            [
-                app.buttons[title],
-                app.webViews.buttons[title],
-            ]
-        } + [app.descendants(matching: .button).firstMatch]
-
-        let button = firstExistingElement(from: candidates, timeout: timeout)
-        XCTAssertTrue(button.exists, "Expected one of \(titles.joined(separator: ", ")) to appear")
-        button.tap()
-    }
-
-    private func submitAuthenticationForm(in app: XCUIApplication, focusedField: XCUIElement) {
-        focus(focusedField)
-        focusedField.typeText("\n")
-        if waitForAny(
-            [
-                { !focusedField.exists },
-                { !app.staticTexts["Burrow Tailnet Authentication"].exists },
-            ],
-            timeout: 1.5
-        ) {
-            return
-        }
-
-        let keyboard = app.keyboards.firstMatch
-        if keyboard.waitForExistence(timeout: 2) {
-            let keyboardCandidates = [
-                "Return",
-                "return",
-                "Go",
-                "go",
-                "Continue",
-                "continue",
-                "Done",
-                "done",
-                "Join",
-                "join",
-                "Sign In",
-                "Log In",
-                "Login",
-            ]
-            for title in keyboardCandidates {
-                let key = keyboard.buttons[title]
-                if key.exists && key.isHittable {
-                    key.tap()
-                    return
-                }
-            }
-
-            if let lastKey = keyboard.buttons.allElementsBoundByIndex.last,
-               lastKey.exists,
-               lastKey.isHittable
-            {
-                lastKey.tap()
-                return
-            }
-        }
-
-        tapFirstExistingButton(
-            in: app,
-            titles: ["Continue", "Sign In", "Log in", "Login"],
-            timeout: 5
-        )
-    }
-
-    private func loadTestConfig() throws -> TestConfig {
-        let environment = ProcessInfo.processInfo.environment
-        if let email = nonEmptyEnvironment("BURROW_UI_TEST_EMAIL"),
-           let password = nonEmptyEnvironment("BURROW_UI_TEST_PASSWORD")
-        {
-            return TestConfig(
-                email: email,
-                username: nonEmptyEnvironment("BURROW_UI_TEST_USERNAME") ?? email,
-                password: password,
-                mode: nonEmptyEnvironment("BURROW_UI_TEST_TAILNET_MODE")
-                    .flatMap(TailnetLoginMode.init(rawValue:))
-            )
-        }
-
-        let configPath = environment["BURROW_UI_TEST_CONFIG_PATH"] ?? "/tmp/burrow-ui-test-config.json"
-        let configURL = URL(fileURLWithPath: configPath)
-        guard FileManager.default.fileExists(atPath: configURL.path) else {
-            throw XCTSkip(
-                "Missing UI test configuration. Expected env vars or config file at \(configURL.path)"
-            )
-        }
-
-        let data = try Data(contentsOf: configURL)
-        return try JSONDecoder().decode(TestConfig.self, from: data)
-    }
-
-    private func nonEmptyEnvironment(_ key: String) -> String? {
-        guard let value = ProcessInfo.processInfo.environment[key]?
-            .trimmingCharacters(in: .whitespacesAndNewlines),
-            !value.isEmpty
-        else {
-            return nil
-        }
-        return value
-    }
-
-    private func waitForFieldValue(
-        _ field: XCUIElement,
-        containing substring: String,
-        timeout: TimeInterval
-    ) -> Bool {
-        let predicate = NSPredicate(format: "value CONTAINS %@", substring)
-        let expectation = XCTNSPredicateExpectation(predicate: predicate, object: field)
-        return XCTWaiter.wait(for: [expectation], timeout: timeout) == .completed
-    }
-
-    private func waitForButtonLabel(
-        _ button: XCUIElement,
-        equals expected: String,
-        timeout: TimeInterval
-    ) -> Bool {
-        let predicate = NSPredicate(format: "label == %@", expected)
-        let expectation = XCTNSPredicateExpectation(predicate: predicate, object: button)
-        return XCTWaiter.wait(for: [expectation], timeout: timeout) == .completed
-    }
-
-    private func waitForTailnetSignedIn(in app: XCUIApplication, timeout: TimeInterval) -> Bool {
-        let button = app.buttons["tailnet-start-sign-in"]
-        let deadline = Date().addingTimeInterval(timeout)
-
-        repeat {
-            acceptAuthenticationPromptIfNeeded(in: app, timeout: 1)
-            if button.exists, button.label == "Signed In" {
-                return true
-            }
-            RunLoop.current.run(until: Date().addingTimeInterval(0.3))
-        } while Date() < deadline
-
-        return button.exists && button.label == "Signed In"
-    }
-
-    private func waitForAny(_ conditions: [() -> Bool], timeout: TimeInterval) -> Bool {
-        let deadline = Date().addingTimeInterval(timeout)
-        repeat {
-            if conditions.contains(where: { $0() }) {
-                return true
-            }
-            RunLoop.current.run(until: Date().addingTimeInterval(0.2))
-        } while Date() < deadline
-        return conditions.contains(where: { $0() })
-    }
-
-    private func firstExistingElement(
-        in app: XCUIApplication,
-        queries: [(XCUIApplication) -> XCUIElement],
-        timeout: TimeInterval
-    ) -> XCUIElement {
-        firstExistingElement(from: queries.map { $0(app) }, timeout: timeout)
-    }
-
-    private func firstExistingElement(from candidates: [XCUIElement], timeout: TimeInterval) -> XCUIElement {
-        let deadline = Date().addingTimeInterval(timeout)
-        repeat {
-            for candidate in candidates where candidate.exists {
-                return candidate
-            }
-            RunLoop.current.run(until: Date().addingTimeInterval(0.2))
-        } while Date() < deadline
-
-        return candidates[0]
-    }
-
-    private func replaceText(in element: XCUIElement, with value: String) {
-        focus(element)
-        clearText(in: element)
-        element.typeText(value)
-    }
-
-    private func replaceSecureText(in element: XCUIElement, within app: XCUIApplication, with value: String) {
-        UIPasteboard.general.string = value
-        focus(element)
-        for revealMenu in [
-            { element.doubleTap() },
-            { element.press(forDuration: 1.2) },
-        ] {
-            revealMenu()
-            let pasteButton = firstExistingElement(from: pasteCandidates(in: app), timeout: 3)
-            if pasteButton.exists {
-                pasteButton.tap()
-                return
-            }
-        }
-
-        focus(element)
-        element.typeText(value)
-    }
-
-    private func clearText(in element: XCUIElement) {
-        guard let currentValue = element.value as? String, !currentValue.isEmpty else {
-            return
-        }
-
-        let deleteSequence = String(repeating: XCUIKeyboardKey.delete.rawValue, count: currentValue.count)
-        element.typeText(deleteSequence)
-    }
-
-    private func focus(_ element: XCUIElement) {
-        element.coordinate(withNormalizedOffset: CGVector(dx: 0.5, dy: 0.5)).tap()
-        RunLoop.current.run(until: Date().addingTimeInterval(0.3))
-    }
-
-    private func pasteCandidates(in app: XCUIApplication) -> [XCUIElement] {
-        let pasteLabels = ["Paste", "Incolla", "Paste from Clipboard"]
-        return pasteLabels.flatMap { label in
-            [
-                app.menuItems[label],
-                app.buttons[label],
-                app.webViews.buttons[label],
-                app.descendants(matching: .button).matching(NSPredicate(format: "label == %@", label)).firstMatch,
-                app.descendants(matching: .menuItem).matching(NSPredicate(format: "label == %@", label)).firstMatch,
-            ]
-        }
-    }
-}
diff --git a/Apple/Burrow.xcodeproj/project.pbxproj b/Apple/Burrow.xcodeproj/project.pbxproj
index 71de427..428d9ab 100644
--- a/Apple/Burrow.xcodeproj/project.pbxproj
+++ b/Apple/Burrow.xcodeproj/project.pbxproj
@@ -7,58 +7,42 @@
 	objects = {
 
 /* Begin PBXBuildFile section */
+		0B28F1562ABF463A000D44B0 /* DataTypes.swift in Sources */ = {isa = PBXBuildFile; fileRef = 0B28F1552ABF463A000D44B0 /* DataTypes.swift */; };
+		0B46E8E02AC918CA00BA2A3C /* Client.swift in Sources */ = {isa = PBXBuildFile; fileRef = 0B46E8DF2AC918CA00BA2A3C /* Client.swift */; };
+		43AA26D82A10004900F14CE6 /* MenuView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 43AA26D72A10004900F14CE6 /* MenuView.swift */; };
+		D00117312B2FFFC900D87C25 /* NWConnection+Async.swift in Sources */ = {isa = PBXBuildFile; fileRef = D00117302B2FFFC900D87C25 /* NWConnection+Async.swift */; };
+		D00117332B3001A400D87C25 /* NewlineProtocolFramer.swift in Sources */ = {isa = PBXBuildFile; fileRef = D00117322B3001A400D87C25 /* NewlineProtocolFramer.swift */; };
+		D001173B2B30341C00D87C25 /* Logging.swift in Sources */ = {isa = PBXBuildFile; fileRef = D001173A2B30341C00D87C25 /* Logging.swift */; };
+		D00117442B30372900D87C25 /* libBurrowShared.a in Frameworks */ = {isa = PBXBuildFile; fileRef = D00117382B30341C00D87C25 /* libBurrowShared.a */; };
+		D00117452B30372C00D87C25 /* libBurrowShared.a in Frameworks */ = {isa = PBXBuildFile; fileRef = D00117382B30341C00D87C25 /* libBurrowShared.a */; };
 		D00AA8972A4669BC005C8102 /* AppDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = D00AA8962A4669BC005C8102 /* AppDelegate.swift */; };
-		D11000012F70000100112233 /* BurrowUITests.swift in Sources */ = {isa = PBXBuildFile; fileRef = D11000042F70000100112233 /* BurrowUITests.swift */; };
 		D020F65829E4A697002790F6 /* PacketTunnelProvider.swift in Sources */ = {isa = PBXBuildFile; fileRef = D020F65729E4A697002790F6 /* PacketTunnelProvider.swift */; };
 		D020F65D29E4A697002790F6 /* BurrowNetworkExtension.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = D020F65329E4A697002790F6 /* BurrowNetworkExtension.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
-		D03383AD2C8E67E300F7C44E /* SwiftProtobuf in Frameworks */ = {isa = PBXBuildFile; productRef = D078F7E22C8DA375008A8CEC /* SwiftProtobuf */; };
-		D03383AE2C8E67E300F7C44E /* NIO in Frameworks */ = {isa = PBXBuildFile; productRef = D044EE902C8DAB2000778185 /* NIO */; };
-		D03383AF2C8E67E300F7C44E /* NIOConcurrencyHelpers in Frameworks */ = {isa = PBXBuildFile; productRef = D044EE922C8DAB2000778185 /* NIOConcurrencyHelpers */; };
-		D03383B02C8E67E300F7C44E /* NIOTransportServices in Frameworks */ = {isa = PBXBuildFile; productRef = D044EE952C8DAB2800778185 /* NIOTransportServices */; };
 		D05B9F7629E39EEC008CB1F9 /* BurrowApp.swift in Sources */ = {isa = PBXBuildFile; fileRef = D05B9F7529E39EEC008CB1F9 /* BurrowApp.swift */; };
-		D09150422B9D2AF700BE3CB0 /* MainMenu.xib in Resources */ = {isa = PBXBuildFile; fileRef = D09150412B9D2AF700BE3CB0 /* MainMenu.xib */; platformFilters = (macos, ); };
-		D0A11C102F90000100112233 /* DequeModule in Frameworks */ = {isa = PBXBuildFile; productRef = D0A11C0F2F90000100112233 /* DequeModule */; };
-		D0B1D1102C436152004B7823 /* AsyncAlgorithms in Frameworks */ = {isa = PBXBuildFile; productRef = D0B1D10F2C436152004B7823 /* AsyncAlgorithms */; };
+		D05B9F7829E39EEC008CB1F9 /* TunnelView.swift in Sources */ = {isa = PBXBuildFile; fileRef = D05B9F7729E39EEC008CB1F9 /* TunnelView.swift */; };
+		D05B9F7A29E39EED008CB1F9 /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = D05B9F7929E39EED008CB1F9 /* Assets.xcassets */; };
+		D08252762B5C9FC4005DA378 /* Constants.swift in Sources */ = {isa = PBXBuildFile; fileRef = D08252752B5C9FC4005DA378 /* Constants.swift */; };
+		D0BCC5FD2A086D4700AD070D /* NetworkExtension+Async.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0BCC5FC2A086D4700AD070D /* NetworkExtension+Async.swift */; };
+		D0BCC5FF2A086E1C00AD070D /* Status.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0BCC5FE2A086E1C00AD070D /* Status.swift */; };
+		D0BCC6082A0981FE00AD070D /* Tunnel.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0B98FC629FDC5B5004E7149 /* Tunnel.swift */; };
 		D0BCC6092A09A03E00AD070D /* libburrow.a in Frameworks */ = {isa = PBXBuildFile; fileRef = D0BCC6032A09535900AD070D /* libburrow.a */; };
-		D0BF09522C8E66F6000D8DEC /* BurrowConfiguration.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = D0D4E5622C8D9BF4007F820A /* BurrowConfiguration.framework */; };
-		D0BF09552C8E66FD000D8DEC /* BurrowConfiguration.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = D0D4E5622C8D9BF4007F820A /* BurrowConfiguration.framework */; };
-		D0D4E53A2C8D996F007F820A /* BurrowCore.framework in Embed Frameworks */ = {isa = PBXBuildFile; fileRef = D0D4E5312C8D996F007F820A /* BurrowCore.framework */; settings = {ATTRIBUTES = (CodeSignOnCopy, RemoveHeadersOnCopy, ); }; };
-		D0D4E56B2C8D9C2F007F820A /* Logging.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0D4E49A2C8D921A007F820A /* Logging.swift */; };
-		D0D4E5702C8D9C62007F820A /* BurrowCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = D0D4E5312C8D996F007F820A /* BurrowCore.framework */; };
-		D0D4E5722C8D9C6F007F820A /* Network.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0D4E49E2C8D921A007F820A /* Network.swift */; };
-		D0D4E5732C8D9C6F007F820A /* WireGuard.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0D4E49F2C8D921A007F820A /* WireGuard.swift */; };
-		D0D4E5742C8D9C6F007F820A /* BurrowView.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0D4E4A22C8D921A007F820A /* BurrowView.swift */; };
-		D0D4E5752C8D9C6F007F820A /* FloatingButtonStyle.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0D4E4A32C8D921A007F820A /* FloatingButtonStyle.swift */; };
-		D0D4E5762C8D9C6F007F820A /* MenuItemToggleView.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0D4E4A42C8D921A007F820A /* MenuItemToggleView.swift */; };
-		D0D4E5772C8D9C6F007F820A /* NetworkCarouselView.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0D4E4A52C8D921A007F820A /* NetworkCarouselView.swift */; };
-		D0D4E5782C8D9C6F007F820A /* NetworkExtension+Async.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0D4E4A62C8D921A007F820A /* NetworkExtension+Async.swift */; };
-		D0D4E5792C8D9C6F007F820A /* NetworkExtensionTunnel.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0D4E4A72C8D921A007F820A /* NetworkExtensionTunnel.swift */; };
-		D0D4E57A2C8D9C6F007F820A /* NetworkView.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0D4E4A82C8D921A007F820A /* NetworkView.swift */; };
-		D0D4E57C2C8D9C6F007F820A /* Tunnel.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0D4E4AA2C8D921A007F820A /* Tunnel.swift */; };
-		D0D4E57D2C8D9C6F007F820A /* TunnelButton.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0D4E4AB2C8D921A007F820A /* TunnelButton.swift */; };
-		D0D4E57E2C8D9C6F007F820A /* TunnelStatusView.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0D4E4AC2C8D921A007F820A /* TunnelStatusView.swift */; };
-		D0D4E5812C8D9C94007F820A /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = D0D4E4A12C8D921A007F820A /* Assets.xcassets */; };
-		D0D4E5892C8D9C94007F820A /* BurrowUI.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = D0D4E5582C8D9BF2007F820A /* BurrowUI.framework */; };
-		D0D4E58A2C8D9C9E007F820A /* BurrowUI.framework in Embed Frameworks */ = {isa = PBXBuildFile; fileRef = D0D4E5582C8D9BF2007F820A /* BurrowUI.framework */; settings = {ATTRIBUTES = (CodeSignOnCopy, RemoveHeadersOnCopy, ); }; };
-		D0D4E58B2C8D9CA4007F820A /* BurrowConfiguration.framework in Embed Frameworks */ = {isa = PBXBuildFile; fileRef = D0D4E5622C8D9BF4007F820A /* BurrowConfiguration.framework */; settings = {ATTRIBUTES = (CodeSignOnCopy, RemoveHeadersOnCopy, ); }; };
-		D0D4E5922C8D9D15007F820A /* Constants.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0D4E58F2C8D9D0A007F820A /* Constants.swift */; };
-		D0D4E5A62C8D9E65007F820A /* BurrowCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = D0D4E5312C8D996F007F820A /* BurrowCore.framework */; };
-		D0F4FAD32C8DC79C0068730A /* BurrowCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = D0D4E5312C8D996F007F820A /* BurrowCore.framework */; };
-		D0F7594E2C8DAB6B00126CF3 /* GRPC in Frameworks */ = {isa = PBXBuildFile; productRef = D078F7E02C8DA375008A8CEC /* GRPC */; };
-		D0FA10012D10200100112233 /* burrow.pb.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0FA10032D10200100112233 /* burrow.pb.swift */; };
-		D0FA10022D10200100112233 /* burrow.grpc.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0FA10042D10200100112233 /* burrow.grpc.swift */; };
-		D0F7597E2C8DB30500126CF3 /* CGRPCZlib in Frameworks */ = {isa = PBXBuildFile; productRef = D0F7597D2C8DB30500126CF3 /* CGRPCZlib */; };
-		D0F7598D2C8DB3DA00126CF3 /* Client.swift in Sources */ = {isa = PBXBuildFile; fileRef = D0D4E4992C8D921A007F820A /* Client.swift */; };
-		D0C0DE102FA0000100112233 /* Sparkle in Frameworks */ = {isa = PBXBuildFile; platformFilters = (macos, ); productRef = D0C0DE122FA0000100112233 /* Sparkle */; };
+		D0BCC60A2A09A0B800AD070D /* build-rust.sh in Resources */ = {isa = PBXBuildFile; fileRef = D0B98FBF29FD8072004E7149 /* build-rust.sh */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
-		D11000022F70000100112233 /* PBXContainerItemProxy */ = {
+		D00117462B30373100D87C25 /* PBXContainerItemProxy */ = {
 			isa = PBXContainerItemProxy;
 			containerPortal = D05B9F6A29E39EEC008CB1F9 /* Project object */;
 			proxyType = 1;
-			remoteGlobalIDString = D05B9F7129E39EEC008CB1F9;
-			remoteInfo = App;
+			remoteGlobalIDString = D00117372B30341C00D87C25;
+			remoteInfo = Shared;
+		};
+		D00117482B30373500D87C25 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = D05B9F6A29E39EEC008CB1F9 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = D00117372B30341C00D87C25;
+			remoteInfo = Shared;
 		};
 		D020F65B29E4A697002790F6 /* PBXContainerItemProxy */ = {
 			isa = PBXContainerItemProxy;
@@ -67,48 +51,6 @@
 			remoteGlobalIDString = D020F65229E4A697002790F6;
 			remoteInfo = BurrowNetworkExtension;
 		};
-		D0BF09502C8E66F1000D8DEC /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = D05B9F6A29E39EEC008CB1F9 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = D0D4E55A2C8D9BF4007F820A;
-			remoteInfo = Configuration;
-		};
-		D0BF09532C8E66FA000D8DEC /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = D05B9F6A29E39EEC008CB1F9 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = D0D4E55A2C8D9BF4007F820A;
-			remoteInfo = Configuration;
-		};
-		D0D4E56E2C8D9C5D007F820A /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = D05B9F6A29E39EEC008CB1F9 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = D0D4E5302C8D996F007F820A;
-			remoteInfo = Core;
-		};
-		D0D4E57F2C8D9C78007F820A /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = D05B9F6A29E39EEC008CB1F9 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = D0D4E5302C8D996F007F820A;
-			remoteInfo = Core;
-		};
-		D0D4E5872C8D9C88007F820A /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = D05B9F6A29E39EEC008CB1F9 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = D0D4E5502C8D9BF2007F820A;
-			remoteInfo = UI;
-		};
-		D0F4FAD12C8DC7960068730A /* PBXContainerItemProxy */ = {
-			isa = PBXContainerItemProxy;
-			containerPortal = D05B9F6A29E39EEC008CB1F9 /* Project object */;
-			proxyType = 1;
-			remoteGlobalIDString = D0D4E5302C8D996F007F820A;
-			remoteInfo = Core;
-		};
 /* End PBXContainerItemProxy section */
 
 /* Begin PBXCopyFilesBuildPhase section */
@@ -123,27 +65,19 @@
 			name = "Embed Foundation Extensions";
 			runOnlyForDeploymentPostprocessing = 0;
 		};
-		D0D4E53F2C8D996F007F820A /* Embed Frameworks */ = {
-			isa = PBXCopyFilesBuildPhase;
-			buildActionMask = 2147483647;
-			dstPath = "";
-			dstSubfolderSpec = 10;
-			files = (
-				D0D4E58B2C8D9CA4007F820A /* BurrowConfiguration.framework in Embed Frameworks */,
-				D0D4E58A2C8D9C9E007F820A /* BurrowUI.framework in Embed Frameworks */,
-				D0D4E53A2C8D996F007F820A /* BurrowCore.framework in Embed Frameworks */,
-			);
-			name = "Embed Frameworks";
-			runOnlyForDeploymentPostprocessing = 0;
-		};
 /* End PBXCopyFilesBuildPhase section */
 
 /* Begin PBXFileReference section */
-		D00117422B30348D00D87C25 /* Configuration.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = Configuration.xcconfig; sourceTree = "<group>"; };
+		0B28F1552ABF463A000D44B0 /* DataTypes.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = DataTypes.swift; sourceTree = "<group>"; };
+		0B46E8DF2AC918CA00BA2A3C /* Client.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Client.swift; sourceTree = "<group>"; };
+		43AA26D72A10004900F14CE6 /* MenuView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = MenuView.swift; sourceTree = "<group>"; };
+		D00117302B2FFFC900D87C25 /* NWConnection+Async.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = "NWConnection+Async.swift"; sourceTree = "<group>"; };
+		D00117322B3001A400D87C25 /* NewlineProtocolFramer.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NewlineProtocolFramer.swift; sourceTree = "<group>"; };
+		D00117382B30341C00D87C25 /* libBurrowShared.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = libBurrowShared.a; sourceTree = BUILT_PRODUCTS_DIR; };
+		D001173A2B30341C00D87C25 /* Logging.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Logging.swift; sourceTree = "<group>"; };
+		D00117412B30347800D87C25 /* module.modulemap */ = {isa = PBXFileReference; lastKnownFileType = "sourcecode.module-map"; path = module.modulemap; sourceTree = "<group>"; };
+		D00117422B30348D00D87C25 /* Shared.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = Shared.xcconfig; sourceTree = "<group>"; };
 		D00AA8962A4669BC005C8102 /* AppDelegate.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = AppDelegate.swift; sourceTree = "<group>"; };
-		D11000032F70000100112233 /* BurrowUITests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = BurrowUITests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
-		D11000042F70000100112233 /* BurrowUITests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BurrowUITests.swift; sourceTree = "<group>"; };
-		D11000052F70000100112233 /* UITests.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = UITests.xcconfig; sourceTree = "<group>"; };
 		D020F63D29E4A1FF002790F6 /* Identity.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = Identity.xcconfig; sourceTree = "<group>"; };
 		D020F64029E4A1FF002790F6 /* Compiler.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = Compiler.xcconfig; sourceTree = "<group>"; };
 		D020F64229E4A1FF002790F6 /* Info.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
@@ -158,45 +92,23 @@
 		D020F66729E4A95D002790F6 /* NetworkExtension-iOS.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = "NetworkExtension-iOS.entitlements"; sourceTree = "<group>"; };
 		D020F66829E4AA74002790F6 /* App-iOS.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = "App-iOS.entitlements"; sourceTree = "<group>"; };
 		D020F66929E4AA74002790F6 /* App-macOS.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = "App-macOS.entitlements"; sourceTree = "<group>"; };
-		D04A3E1D2BAF465F0043EC85 /* Version.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = Version.xcconfig; sourceTree = "<group>"; };
 		D05B9F7229E39EEC008CB1F9 /* Burrow.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = Burrow.app; sourceTree = BUILT_PRODUCTS_DIR; };
 		D05B9F7529E39EEC008CB1F9 /* BurrowApp.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BurrowApp.swift; sourceTree = "<group>"; };
-		D09150412B9D2AF700BE3CB0 /* MainMenu.xib */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = file.xib; path = MainMenu.xib; sourceTree = "<group>"; };
+		D05B9F7729E39EEC008CB1F9 /* TunnelView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = TunnelView.swift; sourceTree = "<group>"; };
+		D05B9F7929E39EED008CB1F9 /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
+		D08252742B5C9DEB005DA378 /* Constants.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = Constants.h; sourceTree = "<group>"; };
+		D08252752B5C9FC4005DA378 /* Constants.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Constants.swift; sourceTree = "<group>"; };
 		D0B98FBF29FD8072004E7149 /* build-rust.sh */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = "build-rust.sh"; sourceTree = "<group>"; };
+		D0B98FC629FDC5B5004E7149 /* Tunnel.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Tunnel.swift; sourceTree = "<group>"; };
 		D0B98FD829FDDB6F004E7149 /* libburrow.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = libburrow.h; sourceTree = "<group>"; };
 		D0B98FDC29FDDDCF004E7149 /* module.modulemap */ = {isa = PBXFileReference; lastKnownFileType = "sourcecode.module-map"; path = module.modulemap; sourceTree = "<group>"; };
+		D0BCC5FC2A086D4700AD070D /* NetworkExtension+Async.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = "NetworkExtension+Async.swift"; sourceTree = "<group>"; };
+		D0BCC5FE2A086E1C00AD070D /* Status.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Status.swift; sourceTree = "<group>"; };
 		D0BCC6032A09535900AD070D /* libburrow.a */ = {isa = PBXFileReference; lastKnownFileType = archive.ar; path = libburrow.a; sourceTree = BUILT_PRODUCTS_DIR; };
-		D0BF09582C8E6789000D8DEC /* UI.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = UI.xcconfig; sourceTree = "<group>"; };
-		D0D4E4952C8D921A007F820A /* burrow.proto */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.protobuf; path = burrow.proto; sourceTree = "<group>"; };
-		D0D4E4992C8D921A007F820A /* Client.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Client.swift; sourceTree = "<group>"; };
-		D0D4E49A2C8D921A007F820A /* Logging.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Logging.swift; sourceTree = "<group>"; };
-		D0D4E49E2C8D921A007F820A /* Network.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Network.swift; sourceTree = "<group>"; };
-		D0D4E49F2C8D921A007F820A /* WireGuard.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WireGuard.swift; sourceTree = "<group>"; };
-		D0D4E4A12C8D921A007F820A /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
-		D0D4E4A22C8D921A007F820A /* BurrowView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BurrowView.swift; sourceTree = "<group>"; };
-		D0D4E4A32C8D921A007F820A /* FloatingButtonStyle.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = FloatingButtonStyle.swift; sourceTree = "<group>"; };
-		D0D4E4A42C8D921A007F820A /* MenuItemToggleView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = MenuItemToggleView.swift; sourceTree = "<group>"; };
-		D0D4E4A52C8D921A007F820A /* NetworkCarouselView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NetworkCarouselView.swift; sourceTree = "<group>"; };
-		D0D4E4A62C8D921A007F820A /* NetworkExtension+Async.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = "NetworkExtension+Async.swift"; sourceTree = "<group>"; };
-		D0D4E4A72C8D921A007F820A /* NetworkExtensionTunnel.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NetworkExtensionTunnel.swift; sourceTree = "<group>"; };
-		D0D4E4A82C8D921A007F820A /* NetworkView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NetworkView.swift; sourceTree = "<group>"; };
-		D0D4E4AA2C8D921A007F820A /* Tunnel.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Tunnel.swift; sourceTree = "<group>"; };
-		D0D4E4AB2C8D921A007F820A /* TunnelButton.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = TunnelButton.swift; sourceTree = "<group>"; };
-		D0D4E4AC2C8D921A007F820A /* TunnelStatusView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = TunnelStatusView.swift; sourceTree = "<group>"; };
-		D0D4E4F62C8D932D007F820A /* Debug.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = Debug.xcconfig; sourceTree = "<group>"; };
-		D0D4E4F72C8D941D007F820A /* Framework.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = Framework.xcconfig; sourceTree = "<group>"; };
-		D0D4E5312C8D996F007F820A /* BurrowCore.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = BurrowCore.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		D0D4E5582C8D9BF2007F820A /* BurrowUI.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = BurrowUI.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		D0D4E5622C8D9BF4007F820A /* BurrowConfiguration.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = BurrowConfiguration.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		D0D4E58E2C8D9D0A007F820A /* Constants.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = Constants.h; sourceTree = "<group>"; };
-		D0D4E58F2C8D9D0A007F820A /* Constants.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Constants.swift; sourceTree = "<group>"; };
-		D0D4E5902C8D9D0A007F820A /* module.modulemap */ = {isa = PBXFileReference; lastKnownFileType = "sourcecode.module-map"; path = module.modulemap; sourceTree = "<group>"; };
-		D0FA10032D10200100112233 /* burrow.pb.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Generated/burrow.pb.swift; sourceTree = "<group>"; };
-		D0FA10042D10200100112233 /* burrow.grpc.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Generated/burrow.grpc.swift; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
-		D11000062F70000100112233 /* Frameworks */ = {
+		D00117352B30341C00D87C25 /* Frameworks */ = {
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
@@ -207,10 +119,8 @@
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				D0BF09522C8E66F6000D8DEC /* BurrowConfiguration.framework in Frameworks */,
-				D0D4E5A62C8D9E65007F820A /* BurrowCore.framework in Frameworks */,
+				D00117442B30372900D87C25 /* libBurrowShared.a in Frameworks */,
 				D0BCC6092A09A03E00AD070D /* libburrow.a in Frameworks */,
-				D0B1D1102C436152004B7823 /* AsyncAlgorithms in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -218,38 +128,41 @@
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				D0BF09552C8E66FD000D8DEC /* BurrowConfiguration.framework in Frameworks */,
-				D0F4FAD32C8DC79C0068730A /* BurrowCore.framework in Frameworks */,
-				D0D4E5892C8D9C94007F820A /* BurrowUI.framework in Frameworks */,
-				D0C0DE102FA0000100112233 /* Sparkle in Frameworks */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		D078F7CF2C8DA213008A8CEC /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				D03383B02C8E67E300F7C44E /* NIOTransportServices in Frameworks */,
-				D03383AF2C8E67E300F7C44E /* NIOConcurrencyHelpers in Frameworks */,
-				D03383AE2C8E67E300F7C44E /* NIO in Frameworks */,
-				D03383AD2C8E67E300F7C44E /* SwiftProtobuf in Frameworks */,
-				D0F7594E2C8DAB6B00126CF3 /* GRPC in Frameworks */,
-				D0F7597E2C8DB30500126CF3 /* CGRPCZlib in Frameworks */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		D0D4E5532C8D9BF2007F820A /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				D0A11C102F90000100112233 /* DequeModule in Frameworks */,
-				D0D4E5702C8D9C62007F820A /* BurrowCore.framework in Frameworks */,
+				D00117452B30372C00D87C25 /* libBurrowShared.a in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
 /* End PBXFrameworksBuildPhase section */
 
 /* Begin PBXGroup section */
+		43AA26D62A0FFFD000F14CE6 /* Menu */ = {
+			isa = PBXGroup;
+			children = (
+				43AA26D72A10004900F14CE6 /* MenuView.swift */,
+			);
+			path = Menu;
+			sourceTree = "<group>";
+		};
+		D00117392B30341C00D87C25 /* Shared */ = {
+			isa = PBXGroup;
+			children = (
+				D001173A2B30341C00D87C25 /* Logging.swift */,
+				D08252752B5C9FC4005DA378 /* Constants.swift */,
+				D00117422B30348D00D87C25 /* Shared.xcconfig */,
+				D001173F2B30347800D87C25 /* Constants */,
+			);
+			path = Shared;
+			sourceTree = "<group>";
+		};
+		D001173F2B30347800D87C25 /* Constants */ = {
+			isa = PBXGroup;
+			children = (
+				D08252742B5C9DEB005DA378 /* Constants.h */,
+				D00117412B30347800D87C25 /* module.modulemap */,
+			);
+			path = Constants;
+			sourceTree = "<group>";
+		};
 		D00117432B30372900D87C25 /* Frameworks */ = {
 			isa = PBXGroup;
 			children = (
@@ -263,14 +176,8 @@
 				D020F63D29E4A1FF002790F6 /* Identity.xcconfig */,
 				D020F64A29E4A452002790F6 /* App.xcconfig */,
 				D020F66329E4A703002790F6 /* Extension.xcconfig */,
-				D0D4E4F72C8D941D007F820A /* Framework.xcconfig */,
 				D020F64029E4A1FF002790F6 /* Compiler.xcconfig */,
-				D0D4E4F62C8D932D007F820A /* Debug.xcconfig */,
-				D11000052F70000100112233 /* UITests.xcconfig */,
-				D04A3E1D2BAF465F0043EC85 /* Version.xcconfig */,
 				D020F64229E4A1FF002790F6 /* Info.plist */,
-				D0D4E5912C8D9D0A007F820A /* Constants */,
-				D00117422B30348D00D87C25 /* Configuration.xcconfig */,
 			);
 			path = Configuration;
 			sourceTree = "<group>";
@@ -279,6 +186,10 @@
 			isa = PBXGroup;
 			children = (
 				D020F65729E4A697002790F6 /* PacketTunnelProvider.swift */,
+				0B46E8DF2AC918CA00BA2A3C /* Client.swift */,
+				0B28F1552ABF463A000D44B0 /* DataTypes.swift */,
+				D00117322B3001A400D87C25 /* NewlineProtocolFramer.swift */,
+				D00117302B2FFFC900D87C25 /* NWConnection+Async.swift */,
 				D020F65929E4A697002790F6 /* Info.plist */,
 				D020F66729E4A95D002790F6 /* NetworkExtension-iOS.entitlements */,
 				D020F66629E4A95D002790F6 /* NetworkExtension-macOS.entitlements */,
@@ -292,10 +203,8 @@
 			isa = PBXGroup;
 			children = (
 				D05B9F7429E39EEC008CB1F9 /* App */,
-				D11000072F70000100112233 /* AppUITests */,
 				D020F65629E4A697002790F6 /* NetworkExtension */,
-				D0D4E49C2C8D921A007F820A /* Core */,
-				D0D4E4AD2C8D921A007F820A /* UI */,
+				D00117392B30341C00D87C25 /* Shared */,
 				D020F63C29E4A1FF002790F6 /* Configuration */,
 				D05B9F7329E39EEC008CB1F9 /* Products */,
 				D00117432B30372900D87C25 /* Frameworks */,
@@ -306,12 +215,8 @@
 			isa = PBXGroup;
 			children = (
 				D05B9F7229E39EEC008CB1F9 /* Burrow.app */,
-				D11000032F70000100112233 /* BurrowUITests.xctest */,
 				D020F65329E4A697002790F6 /* BurrowNetworkExtension.appex */,
-				D0BCC6032A09535900AD070D /* libburrow.a */,
-				D0D4E5312C8D996F007F820A /* BurrowCore.framework */,
-				D0D4E5582C8D9BF2007F820A /* BurrowUI.framework */,
-				D0D4E5622C8D9BF4007F820A /* BurrowConfiguration.framework */,
+				D00117382B30341C00D87C25 /* libBurrowShared.a */,
 			);
 			name = Products;
 			sourceTree = "<group>";
@@ -319,9 +224,14 @@
 		D05B9F7429E39EEC008CB1F9 /* App */ = {
 			isa = PBXGroup;
 			children = (
+				43AA26D62A0FFFD000F14CE6 /* Menu */,
 				D05B9F7529E39EEC008CB1F9 /* BurrowApp.swift */,
 				D00AA8962A4669BC005C8102 /* AppDelegate.swift */,
-				D09150412B9D2AF700BE3CB0 /* MainMenu.xib */,
+				D05B9F7729E39EEC008CB1F9 /* TunnelView.swift */,
+				D0B98FC629FDC5B5004E7149 /* Tunnel.swift */,
+				D0BCC5FE2A086E1C00AD070D /* Status.swift */,
+				D0BCC5FC2A086D4700AD070D /* NetworkExtension+Async.swift */,
+				D05B9F7929E39EED008CB1F9 /* Assets.xcassets */,
 				D020F66829E4AA74002790F6 /* App-iOS.entitlements */,
 				D020F66929E4AA74002790F6 /* App-macOS.entitlements */,
 				D020F64929E4A34B002790F6 /* App.xcconfig */,
@@ -329,103 +239,36 @@
 			path = App;
 			sourceTree = "<group>";
 		};
-		D11000072F70000100112233 /* AppUITests */ = {
-			isa = PBXGroup;
-			children = (
-				D11000042F70000100112233 /* BurrowUITests.swift */,
-			);
-			path = AppUITests;
-			sourceTree = "<group>";
-		};
 		D0B98FD729FDDB57004E7149 /* libburrow */ = {
 			isa = PBXGroup;
 			children = (
 				D0B98FBF29FD8072004E7149 /* build-rust.sh */,
 				D0B98FDC29FDDDCF004E7149 /* module.modulemap */,
 				D0B98FD829FDDB6F004E7149 /* libburrow.h */,
+				D0BCC6032A09535900AD070D /* libburrow.a */,
 			);
 			path = libburrow;
 			sourceTree = "<group>";
 		};
-		D0D4E4982C8D921A007F820A /* Client */ = {
-			isa = PBXGroup;
-			children = (
-				D0D4E4952C8D921A007F820A /* burrow.proto */,
-				D0FA10032D10200100112233 /* burrow.pb.swift */,
-				D0FA10042D10200100112233 /* burrow.grpc.swift */,
-			);
-			path = Client;
-			sourceTree = "<group>";
-		};
-		D0D4E49C2C8D921A007F820A /* Core */ = {
-			isa = PBXGroup;
-			children = (
-				D0D4E49A2C8D921A007F820A /* Logging.swift */,
-				D0D4E4992C8D921A007F820A /* Client.swift */,
-				D0D4E4982C8D921A007F820A /* Client */,
-			);
-			path = Core;
-			sourceTree = "<group>";
-		};
-		D0D4E4A02C8D921A007F820A /* Networks */ = {
-			isa = PBXGroup;
-			children = (
-				D0D4E49E2C8D921A007F820A /* Network.swift */,
-				D0D4E49F2C8D921A007F820A /* WireGuard.swift */,
-			);
-			path = Networks;
-			sourceTree = "<group>";
-		};
-		D0D4E4AD2C8D921A007F820A /* UI */ = {
-			isa = PBXGroup;
-			children = (
-				D0D4E4A22C8D921A007F820A /* BurrowView.swift */,
-				D0D4E4A02C8D921A007F820A /* Networks */,
-				D0D4E4A32C8D921A007F820A /* FloatingButtonStyle.swift */,
-				D0D4E4A42C8D921A007F820A /* MenuItemToggleView.swift */,
-				D0D4E4A52C8D921A007F820A /* NetworkCarouselView.swift */,
-				D0D4E4A62C8D921A007F820A /* NetworkExtension+Async.swift */,
-				D0D4E4A72C8D921A007F820A /* NetworkExtensionTunnel.swift */,
-				D0D4E4A82C8D921A007F820A /* NetworkView.swift */,
-				D0D4E4AA2C8D921A007F820A /* Tunnel.swift */,
-				D0D4E4AB2C8D921A007F820A /* TunnelButton.swift */,
-				D0D4E4AC2C8D921A007F820A /* TunnelStatusView.swift */,
-				D0D4E4A12C8D921A007F820A /* Assets.xcassets */,
-				D0BF09582C8E6789000D8DEC /* UI.xcconfig */,
-			);
-			path = UI;
-			sourceTree = "<group>";
-		};
-		D0D4E5912C8D9D0A007F820A /* Constants */ = {
-			isa = PBXGroup;
-			children = (
-				D0D4E58E2C8D9D0A007F820A /* Constants.h */,
-				D0D4E58F2C8D9D0A007F820A /* Constants.swift */,
-				D0D4E5902C8D9D0A007F820A /* module.modulemap */,
-			);
-			path = Constants;
-			sourceTree = "<group>";
-		};
 /* End PBXGroup section */
 
 /* Begin PBXNativeTarget section */
-		D11000082F70000100112233 /* BurrowUITests */ = {
+		D00117372B30341C00D87C25 /* Shared */ = {
 			isa = PBXNativeTarget;
-			buildConfigurationList = D110000E2F70000100112233 /* Build configuration list for PBXNativeTarget "BurrowUITests" */;
+			buildConfigurationList = D001173C2B30341C00D87C25 /* Build configuration list for PBXNativeTarget "Shared" */;
 			buildPhases = (
-				D110000A2F70000100112233 /* Sources */,
-				D11000062F70000100112233 /* Frameworks */,
-				D11000092F70000100112233 /* Resources */,
+				D00117342B30341C00D87C25 /* Sources */,
+				D00117352B30341C00D87C25 /* Frameworks */,
 			);
 			buildRules = (
 			);
 			dependencies = (
-				D110000B2F70000100112233 /* PBXTargetDependency */,
+				D082527D2B5DEB80005DA378 /* PBXTargetDependency */,
 			);
-			name = BurrowUITests;
-			productName = BurrowUITests;
-			productReference = D11000032F70000100112233 /* BurrowUITests.xctest */;
-			productType = "com.apple.product-type.bundle.ui-testing";
+			name = Shared;
+			productName = Shared;
+			productReference = D00117382B30341C00D87C25 /* libBurrowShared.a */;
+			productType = "com.apple.product-type.library.static";
 		};
 		D020F65229E4A697002790F6 /* NetworkExtension */ = {
 			isa = PBXNativeTarget;
@@ -434,12 +277,13 @@
 				D0BCC60B2A09A0C100AD070D /* Compile Rust */,
 				D020F64F29E4A697002790F6 /* Sources */,
 				D020F65029E4A697002790F6 /* Frameworks */,
+				D020F65129E4A697002790F6 /* Resources */,
 			);
 			buildRules = (
 			);
 			dependencies = (
-				D0BF09512C8E66F1000D8DEC /* PBXTargetDependency */,
-				D0D4E5802C8D9C78007F820A /* PBXTargetDependency */,
+				D08252792B5DEB78005DA378 /* PBXTargetDependency */,
+				D00117492B30373500D87C25 /* PBXTargetDependency */,
 			);
 			name = NetworkExtension;
 			productName = BurrowNetworkExtension;
@@ -453,89 +297,20 @@
 				D05B9F6E29E39EEC008CB1F9 /* Sources */,
 				D05B9F6F29E39EEC008CB1F9 /* Frameworks */,
 				D05B9F7029E39EEC008CB1F9 /* Resources */,
-				D0D4E53F2C8D996F007F820A /* Embed Frameworks */,
 				D020F66129E4A697002790F6 /* Embed Foundation Extensions */,
 			);
 			buildRules = (
 			);
 			dependencies = (
-				D0BF09542C8E66FA000D8DEC /* PBXTargetDependency */,
-				D0F4FAD22C8DC7960068730A /* PBXTargetDependency */,
-				D0D4E5882C8D9C88007F820A /* PBXTargetDependency */,
+				D082527B2B5DEB7D005DA378 /* PBXTargetDependency */,
+				D00117472B30373100D87C25 /* PBXTargetDependency */,
 				D020F65C29E4A697002790F6 /* PBXTargetDependency */,
 			);
 			name = App;
-			packageProductDependencies = (
-				D0C0DE122FA0000100112233 /* Sparkle */,
-			);
 			productName = Burrow;
 			productReference = D05B9F7229E39EEC008CB1F9 /* Burrow.app */;
 			productType = "com.apple.product-type.application";
 		};
-		D0D4E5302C8D996F007F820A /* Core */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = D0D4E53C2C8D996F007F820A /* Build configuration list for PBXNativeTarget "Core" */;
-			buildPhases = (
-				D0D4E52D2C8D996F007F820A /* Sources */,
-				D078F7CF2C8DA213008A8CEC /* Frameworks */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-				D0F7598A2C8DB34200126CF3 /* PBXTargetDependency */,
-			);
-			name = Core;
-			packageProductDependencies = (
-				D078F7E02C8DA375008A8CEC /* GRPC */,
-				D078F7E22C8DA375008A8CEC /* SwiftProtobuf */,
-				D044EE902C8DAB2000778185 /* NIO */,
-				D044EE922C8DAB2000778185 /* NIOConcurrencyHelpers */,
-				D044EE952C8DAB2800778185 /* NIOTransportServices */,
-				D0F7597D2C8DB30500126CF3 /* CGRPCZlib */,
-			);
-			productName = Core;
-			productReference = D0D4E5312C8D996F007F820A /* BurrowCore.framework */;
-			productType = "com.apple.product-type.framework";
-		};
-		D0D4E5502C8D9BF2007F820A /* UI */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = D0D4E5552C8D9BF2007F820A /* Build configuration list for PBXNativeTarget "UI" */;
-			buildPhases = (
-				D0D4E5522C8D9BF2007F820A /* Sources */,
-				D0D4E5532C8D9BF2007F820A /* Frameworks */,
-				D0D4E5542C8D9BF2007F820A /* Resources */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-				D0D4E56F2C8D9C5D007F820A /* PBXTargetDependency */,
-			);
-			name = UI;
-			packageProductDependencies = (
-				D0A11C0F2F90000100112233 /* DequeModule */,
-			);
-			productName = Core;
-			productReference = D0D4E5582C8D9BF2007F820A /* BurrowUI.framework */;
-			productType = "com.apple.product-type.framework";
-		};
-		D0D4E55A2C8D9BF4007F820A /* Configuration */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = D0D4E55F2C8D9BF4007F820A /* Build configuration list for PBXNativeTarget "Configuration" */;
-			buildPhases = (
-				D0F759912C8DB49E00126CF3 /* Configure Version */,
-				D0D4E55C2C8D9BF4007F820A /* Sources */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-			);
-			name = Configuration;
-			packageProductDependencies = (
-			);
-			productName = Core;
-			productReference = D0D4E5622C8D9BF4007F820A /* BurrowConfiguration.framework */;
-			productType = "com.apple.product-type.framework";
-		};
 /* End PBXNativeTarget section */
 
 /* Begin PBXProject section */
@@ -543,12 +318,11 @@
 			isa = PBXProject;
 			attributes = {
 				BuildIndependentTargetsInParallel = 1;
-				LastSwiftUpdateCheck = 1600;
-				LastUpgradeCheck = 1520;
+				LastSwiftUpdateCheck = 1510;
+				LastUpgradeCheck = 1430;
 				TargetAttributes = {
-					D11000082F70000100112233 = {
-						CreatedOnToolsVersion = 16.0;
-						TestTargetID = D05B9F7129E39EEC008CB1F9;
+					D00117372B30341C00D87C25 = {
+						CreatedOnToolsVersion = 15.1;
 					};
 					D020F65229E4A697002790F6 = {
 						CreatedOnToolsVersion = 14.3;
@@ -556,9 +330,6 @@
 					D05B9F7129E39EEC008CB1F9 = {
 						CreatedOnToolsVersion = 14.3;
 					};
-					D0D4E5302C8D996F007F820A = {
-						CreatedOnToolsVersion = 16.0;
-					};
 				};
 			};
 			buildConfigurationList = D05B9F6D29E39EEC008CB1F9 /* Build configuration list for PBXProject "Burrow" */;
@@ -571,33 +342,25 @@
 			);
 			mainGroup = D05B9F6929E39EEC008CB1F9;
 			packageReferences = (
-				D0B1D10E2C436152004B7823 /* XCRemoteSwiftPackageReference "swift-async-algorithms" */,
-				D0D4E4822C8D8EF6007F820A /* XCRemoteSwiftPackageReference "grpc-swift" */,
-				D0D4E4852C8D8F29007F820A /* XCRemoteSwiftPackageReference "swift-protobuf" */,
-				D044EE8F2C8DAB2000778185 /* XCRemoteSwiftPackageReference "swift-nio" */,
-				D044EE942C8DAB2800778185 /* XCRemoteSwiftPackageReference "swift-nio-transport-services" */,
-				D0A11C0D2F90000100112233 /* XCRemoteSwiftPackageReference "swift-collections" */,
-				D0C0DE112FA0000100112233 /* XCRemoteSwiftPackageReference "Sparkle" */,
+				D08252772B5DEB6E005DA378 /* XCRemoteSwiftPackageReference "SwiftLint" */,
 			);
 			productRefGroup = D05B9F7329E39EEC008CB1F9 /* Products */;
 			projectDirPath = "";
 			projectRoot = "";
 			targets = (
 				D05B9F7129E39EEC008CB1F9 /* App */,
-				D11000082F70000100112233 /* BurrowUITests */,
 				D020F65229E4A697002790F6 /* NetworkExtension */,
-				D0D4E5502C8D9BF2007F820A /* UI */,
-				D0D4E5302C8D996F007F820A /* Core */,
-				D0D4E55A2C8D9BF4007F820A /* Configuration */,
+				D00117372B30341C00D87C25 /* Shared */,
 			);
 		};
 /* End PBXProject section */
 
 /* Begin PBXResourcesBuildPhase section */
-		D11000092F70000100112233 /* Resources */ = {
+		D020F65129E4A697002790F6 /* Resources */ = {
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				D0BCC60A2A09A0B800AD070D /* build-rust.sh in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -605,15 +368,7 @@
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				D09150422B9D2AF700BE3CB0 /* MainMenu.xib in Resources */,
-				D0D4E5812C8D9C94007F820A /* Assets.xcassets in Resources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		D0D4E5542C8D9BF2007F820A /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
+				D05B9F7A29E39EED008CB1F9 /* Assets.xcassets in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -640,36 +395,15 @@
 			shellScript = "\"${PROJECT_DIR}/NetworkExtension/libburrow/build-rust.sh\"\n";
 			showEnvVarsInLog = 0;
 		};
-		D0F759912C8DB49E00126CF3 /* Configure Version */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputFileListPaths = (
-			);
-			inputPaths = (
-				"$(PROJECT_DIR)/../Tools/version.sh",
-				"$(PROJECT_DIR)/../.git",
-			);
-			name = "Configure Version";
-			outputFileListPaths = (
-			);
-			outputPaths = (
-				"$(PROJECT_DIR)/Configuration/Version.xcconfig",
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "\"$PROJECT_DIR/../Tools/version.sh\"\n";
-			showEnvVarsInLog = 0;
-		};
 /* End PBXShellScriptBuildPhase section */
 
 /* Begin PBXSourcesBuildPhase section */
-		D110000A2F70000100112233 /* Sources */ = {
+		D00117342B30341C00D87C25 /* Sources */ = {
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				D11000012F70000100112233 /* BurrowUITests.swift in Sources */,
+				D001173B2B30341C00D87C25 /* Logging.swift in Sources */,
+				D08252762B5C9FC4005DA378 /* Constants.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -677,6 +411,10 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				D00117332B3001A400D87C25 /* NewlineProtocolFramer.swift in Sources */,
+				0B28F1562ABF463A000D44B0 /* DataTypes.swift in Sources */,
+				D00117312B2FFFC900D87C25 /* NWConnection+Async.swift in Sources */,
+				0B46E8E02AC918CA00BA2A3C /* Client.swift in Sources */,
 				D020F65829E4A697002790F6 /* PacketTunnelProvider.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
@@ -685,109 +423,59 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				D0BCC6082A0981FE00AD070D /* Tunnel.swift in Sources */,
+				43AA26D82A10004900F14CE6 /* MenuView.swift in Sources */,
+				D05B9F7829E39EEC008CB1F9 /* TunnelView.swift in Sources */,
+				D0BCC5FF2A086E1C00AD070D /* Status.swift in Sources */,
 				D00AA8972A4669BC005C8102 /* AppDelegate.swift in Sources */,
 				D05B9F7629E39EEC008CB1F9 /* BurrowApp.swift in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		D0D4E52D2C8D996F007F820A /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				D0FA10012D10200100112233 /* burrow.pb.swift in Sources */,
-				D0FA10022D10200100112233 /* burrow.grpc.swift in Sources */,
-				D0F7598D2C8DB3DA00126CF3 /* Client.swift in Sources */,
-				D0D4E56B2C8D9C2F007F820A /* Logging.swift in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		D0D4E5522C8D9BF2007F820A /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				D0D4E5722C8D9C6F007F820A /* Network.swift in Sources */,
-				D0D4E5732C8D9C6F007F820A /* WireGuard.swift in Sources */,
-				D0D4E5742C8D9C6F007F820A /* BurrowView.swift in Sources */,
-				D0D4E5752C8D9C6F007F820A /* FloatingButtonStyle.swift in Sources */,
-				D0D4E5762C8D9C6F007F820A /* MenuItemToggleView.swift in Sources */,
-				D0D4E5772C8D9C6F007F820A /* NetworkCarouselView.swift in Sources */,
-				D0D4E5782C8D9C6F007F820A /* NetworkExtension+Async.swift in Sources */,
-				D0D4E5792C8D9C6F007F820A /* NetworkExtensionTunnel.swift in Sources */,
-				D0D4E57A2C8D9C6F007F820A /* NetworkView.swift in Sources */,
-				D0D4E57C2C8D9C6F007F820A /* Tunnel.swift in Sources */,
-				D0D4E57D2C8D9C6F007F820A /* TunnelButton.swift in Sources */,
-				D0D4E57E2C8D9C6F007F820A /* TunnelStatusView.swift in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-		D0D4E55C2C8D9BF4007F820A /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				D0D4E5922C8D9D15007F820A /* Constants.swift in Sources */,
+				D0BCC5FD2A086D4700AD070D /* NetworkExtension+Async.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
 /* End PBXSourcesBuildPhase section */
 
 /* Begin PBXTargetDependency section */
-		D110000B2F70000100112233 /* PBXTargetDependency */ = {
+		D00117472B30373100D87C25 /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
-			target = D05B9F7129E39EEC008CB1F9 /* App */;
-			targetProxy = D11000022F70000100112233 /* PBXContainerItemProxy */;
+			target = D00117372B30341C00D87C25 /* Shared */;
+			targetProxy = D00117462B30373100D87C25 /* PBXContainerItemProxy */;
+		};
+		D00117492B30373500D87C25 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = D00117372B30341C00D87C25 /* Shared */;
+			targetProxy = D00117482B30373500D87C25 /* PBXContainerItemProxy */;
 		};
 		D020F65C29E4A697002790F6 /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
 			target = D020F65229E4A697002790F6 /* NetworkExtension */;
 			targetProxy = D020F65B29E4A697002790F6 /* PBXContainerItemProxy */;
 		};
-		D0BF09512C8E66F1000D8DEC /* PBXTargetDependency */ = {
+		D08252792B5DEB78005DA378 /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
-			target = D0D4E55A2C8D9BF4007F820A /* Configuration */;
-			targetProxy = D0BF09502C8E66F1000D8DEC /* PBXContainerItemProxy */;
+			productRef = D08252782B5DEB78005DA378 /* SwiftLintPlugin */;
 		};
-		D0BF09542C8E66FA000D8DEC /* PBXTargetDependency */ = {
+		D082527B2B5DEB7D005DA378 /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
-			target = D0D4E55A2C8D9BF4007F820A /* Configuration */;
-			targetProxy = D0BF09532C8E66FA000D8DEC /* PBXContainerItemProxy */;
+			productRef = D082527A2B5DEB7D005DA378 /* SwiftLintPlugin */;
 		};
-		D0D4E56F2C8D9C5D007F820A /* PBXTargetDependency */ = {
+		D082527D2B5DEB80005DA378 /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
-			target = D0D4E5302C8D996F007F820A /* Core */;
-			targetProxy = D0D4E56E2C8D9C5D007F820A /* PBXContainerItemProxy */;
-		};
-		D0D4E5802C8D9C78007F820A /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			target = D0D4E5302C8D996F007F820A /* Core */;
-			targetProxy = D0D4E57F2C8D9C78007F820A /* PBXContainerItemProxy */;
-		};
-		D0D4E5882C8D9C88007F820A /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			target = D0D4E5502C8D9BF2007F820A /* UI */;
-			targetProxy = D0D4E5872C8D9C88007F820A /* PBXContainerItemProxy */;
-		};
-		D0F4FAD22C8DC7960068730A /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			target = D0D4E5302C8D996F007F820A /* Core */;
-			targetProxy = D0F4FAD12C8DC7960068730A /* PBXContainerItemProxy */;
-		};
-		D0F7598A2C8DB34200126CF3 /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			productRef = D0F759892C8DB34200126CF3 /* GRPC */;
+			productRef = D082527C2B5DEB80005DA378 /* SwiftLintPlugin */;
 		};
 /* End PBXTargetDependency section */
 
 /* Begin XCBuildConfiguration section */
-		D110000C2F70000100112233 /* Debug */ = {
+		D001173D2B30341C00D87C25 /* Debug */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = D11000052F70000100112233 /* UITests.xcconfig */;
+			baseConfigurationReference = D00117422B30348D00D87C25 /* Shared.xcconfig */;
 			buildSettings = {
 			};
 			name = Debug;
 		};
-		D110000D2F70000100112233 /* Release */ = {
+		D001173E2B30341C00D87C25 /* Release */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = D11000052F70000100112233 /* UITests.xcconfig */;
+			baseConfigurationReference = D00117422B30348D00D87C25 /* Shared.xcconfig */;
 			buildSettings = {
 			};
 			name = Release;
@@ -834,56 +522,14 @@
 			};
 			name = Release;
 		};
-		D0D4E53D2C8D996F007F820A /* Debug */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = D0D4E4F72C8D941D007F820A /* Framework.xcconfig */;
-			buildSettings = {
-			};
-			name = Debug;
-		};
-		D0D4E53E2C8D996F007F820A /* Release */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = D0D4E4F72C8D941D007F820A /* Framework.xcconfig */;
-			buildSettings = {
-			};
-			name = Release;
-		};
-		D0D4E5562C8D9BF2007F820A /* Debug */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = D0BF09582C8E6789000D8DEC /* UI.xcconfig */;
-			buildSettings = {
-			};
-			name = Debug;
-		};
-		D0D4E5572C8D9BF2007F820A /* Release */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = D0BF09582C8E6789000D8DEC /* UI.xcconfig */;
-			buildSettings = {
-			};
-			name = Release;
-		};
-		D0D4E5602C8D9BF4007F820A /* Debug */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = D00117422B30348D00D87C25 /* Configuration.xcconfig */;
-			buildSettings = {
-			};
-			name = Debug;
-		};
-		D0D4E5612C8D9BF4007F820A /* Release */ = {
-			isa = XCBuildConfiguration;
-			baseConfigurationReference = D00117422B30348D00D87C25 /* Configuration.xcconfig */;
-			buildSettings = {
-			};
-			name = Release;
-		};
 /* End XCBuildConfiguration section */
 
 /* Begin XCConfigurationList section */
-		D110000E2F70000100112233 /* Build configuration list for PBXNativeTarget "BurrowUITests" */ = {
+		D001173C2B30341C00D87C25 /* Build configuration list for PBXNativeTarget "Shared" */ = {
 			isa = XCConfigurationList;
 			buildConfigurations = (
-				D110000C2F70000100112233 /* Debug */,
-				D110000D2F70000100112233 /* Release */,
+				D001173D2B30341C00D87C25 /* Debug */,
+				D001173E2B30341C00D87C25 /* Release */,
 			);
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Release;
@@ -915,144 +561,34 @@
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Release;
 		};
-		D0D4E53C2C8D996F007F820A /* Build configuration list for PBXNativeTarget "Core" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				D0D4E53D2C8D996F007F820A /* Debug */,
-				D0D4E53E2C8D996F007F820A /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		D0D4E5552C8D9BF2007F820A /* Build configuration list for PBXNativeTarget "UI" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				D0D4E5562C8D9BF2007F820A /* Debug */,
-				D0D4E5572C8D9BF2007F820A /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		D0D4E55F2C8D9BF4007F820A /* Build configuration list for PBXNativeTarget "Configuration" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				D0D4E5602C8D9BF4007F820A /* Debug */,
-				D0D4E5612C8D9BF4007F820A /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
 /* End XCConfigurationList section */
 
 /* Begin XCRemoteSwiftPackageReference section */
-		D044EE8F2C8DAB2000778185 /* XCRemoteSwiftPackageReference "swift-nio" */ = {
+		D08252772B5DEB6E005DA378 /* XCRemoteSwiftPackageReference "SwiftLint" */ = {
 			isa = XCRemoteSwiftPackageReference;
-			repositoryURL = "https://github.com/apple/swift-nio.git";
+			repositoryURL = "https://github.com/realm/SwiftLint.git";
 			requirement = {
 				kind = upToNextMajorVersion;
-				minimumVersion = 2.72.0;
-			};
-		};
-		D044EE942C8DAB2800778185 /* XCRemoteSwiftPackageReference "swift-nio-transport-services" */ = {
-			isa = XCRemoteSwiftPackageReference;
-			repositoryURL = "https://github.com/apple/swift-nio-transport-services.git";
-			requirement = {
-				kind = upToNextMajorVersion;
-				minimumVersion = 1.21.0;
-			};
-		};
-		D0A11C0D2F90000100112233 /* XCRemoteSwiftPackageReference "swift-collections" */ = {
-			isa = XCRemoteSwiftPackageReference;
-			repositoryURL = "https://github.com/apple/swift-collections.git";
-			requirement = {
-				kind = upToNextMajorVersion;
-				minimumVersion = 1.1.3;
-			};
-		};
-		D0B1D10E2C436152004B7823 /* XCRemoteSwiftPackageReference "swift-async-algorithms" */ = {
-			isa = XCRemoteSwiftPackageReference;
-			repositoryURL = "https://github.com/apple/swift-async-algorithms.git";
-			requirement = {
-				kind = upToNextMajorVersion;
-				minimumVersion = 1.0.1;
-			};
-		};
-		D0C0DE112FA0000100112233 /* XCRemoteSwiftPackageReference "Sparkle" */ = {
-			isa = XCRemoteSwiftPackageReference;
-			repositoryURL = "https://github.com/sparkle-project/Sparkle.git";
-			requirement = {
-				kind = upToNextMajorVersion;
-				minimumVersion = 2.9.2;
-			};
-		};
-		D0D4E4822C8D8EF6007F820A /* XCRemoteSwiftPackageReference "grpc-swift" */ = {
-			isa = XCRemoteSwiftPackageReference;
-			repositoryURL = "https://github.com/grpc/grpc-swift.git";
-			requirement = {
-				kind = upToNextMajorVersion;
-				minimumVersion = 1.23.0;
-			};
-		};
-		D0D4E4852C8D8F29007F820A /* XCRemoteSwiftPackageReference "swift-protobuf" */ = {
-			isa = XCRemoteSwiftPackageReference;
-			repositoryURL = "https://github.com/apple/swift-protobuf.git";
-			requirement = {
-				kind = upToNextMajorVersion;
-				minimumVersion = 1.28.1;
+				minimumVersion = 0.54.0;
 			};
 		};
 /* End XCRemoteSwiftPackageReference section */
 
 /* Begin XCSwiftPackageProductDependency section */
-		D044EE902C8DAB2000778185 /* NIO */ = {
+		D08252782B5DEB78005DA378 /* SwiftLintPlugin */ = {
 			isa = XCSwiftPackageProductDependency;
-			package = D044EE8F2C8DAB2000778185 /* XCRemoteSwiftPackageReference "swift-nio" */;
-			productName = NIO;
+			package = D08252772B5DEB6E005DA378 /* XCRemoteSwiftPackageReference "SwiftLint" */;
+			productName = "plugin:SwiftLintPlugin";
 		};
-		D044EE922C8DAB2000778185 /* NIOConcurrencyHelpers */ = {
+		D082527A2B5DEB7D005DA378 /* SwiftLintPlugin */ = {
 			isa = XCSwiftPackageProductDependency;
-			package = D044EE8F2C8DAB2000778185 /* XCRemoteSwiftPackageReference "swift-nio" */;
-			productName = NIOConcurrencyHelpers;
+			package = D08252772B5DEB6E005DA378 /* XCRemoteSwiftPackageReference "SwiftLint" */;
+			productName = "plugin:SwiftLintPlugin";
 		};
-		D044EE952C8DAB2800778185 /* NIOTransportServices */ = {
+		D082527C2B5DEB80005DA378 /* SwiftLintPlugin */ = {
 			isa = XCSwiftPackageProductDependency;
-			package = D044EE942C8DAB2800778185 /* XCRemoteSwiftPackageReference "swift-nio-transport-services" */;
-			productName = NIOTransportServices;
-		};
-		D078F7E02C8DA375008A8CEC /* GRPC */ = {
-			isa = XCSwiftPackageProductDependency;
-			package = D0D4E4822C8D8EF6007F820A /* XCRemoteSwiftPackageReference "grpc-swift" */;
-			productName = GRPC;
-		};
-		D078F7E22C8DA375008A8CEC /* SwiftProtobuf */ = {
-			isa = XCSwiftPackageProductDependency;
-			package = D0D4E4852C8D8F29007F820A /* XCRemoteSwiftPackageReference "swift-protobuf" */;
-			productName = SwiftProtobuf;
-		};
-		D0A11C0F2F90000100112233 /* DequeModule */ = {
-			isa = XCSwiftPackageProductDependency;
-			package = D0A11C0D2F90000100112233 /* XCRemoteSwiftPackageReference "swift-collections" */;
-			productName = DequeModule;
-		};
-		D0B1D10F2C436152004B7823 /* AsyncAlgorithms */ = {
-			isa = XCSwiftPackageProductDependency;
-			package = D0B1D10E2C436152004B7823 /* XCRemoteSwiftPackageReference "swift-async-algorithms" */;
-			productName = AsyncAlgorithms;
-		};
-		D0C0DE122FA0000100112233 /* Sparkle */ = {
-			isa = XCSwiftPackageProductDependency;
-			package = D0C0DE112FA0000100112233 /* XCRemoteSwiftPackageReference "Sparkle" */;
-			productName = Sparkle;
-		};
-		D0F7597D2C8DB30500126CF3 /* CGRPCZlib */ = {
-			isa = XCSwiftPackageProductDependency;
-			package = D0D4E4822C8D8EF6007F820A /* XCRemoteSwiftPackageReference "grpc-swift" */;
-			productName = CGRPCZlib;
-		};
-		D0F759892C8DB34200126CF3 /* GRPC */ = {
-			isa = XCSwiftPackageProductDependency;
-			package = D0D4E4822C8D8EF6007F820A /* XCRemoteSwiftPackageReference "grpc-swift" */;
-			productName = GRPC;
+			package = D08252772B5DEB6E005DA378 /* XCRemoteSwiftPackageReference "SwiftLint" */;
+			productName = "plugin:SwiftLintPlugin";
 		};
 /* End XCSwiftPackageProductDependency section */
 	};
diff --git a/Apple/Burrow.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved b/Apple/Burrow.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
index a633fc0..7522840 100644
--- a/Apple/Burrow.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
+++ b/Apple/Burrow.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
@@ -1,132 +1,86 @@
 {
-  "originHash" : "5d81b59cbecacd7aae6aa598b32e3513c636250dadab9280a55b905bb0e0ee60",
   "pins" : [
     {
-      "identity" : "grpc-swift",
+      "identity" : "collectionconcurrencykit",
       "kind" : "remoteSourceControl",
-      "location" : "https://github.com/grpc/grpc-swift.git",
+      "location" : "https://github.com/JohnSundell/CollectionConcurrencyKit.git",
       "state" : {
-        "revision" : "6a90b7e77e29f9bda6c2b3a4165a40d6c02cfda1",
-        "version" : "1.23.0"
+        "revision" : "b4f23e24b5a1bff301efc5e70871083ca029ff95",
+        "version" : "0.2.0"
       }
     },
     {
-      "identity" : "sparkle",
+      "identity" : "cryptoswift",
       "kind" : "remoteSourceControl",
-      "location" : "https://github.com/sparkle-project/Sparkle.git",
+      "location" : "https://github.com/krzyzanowskim/CryptoSwift.git",
       "state" : {
-        "revision" : "6276ba2b404829d139c45ff98427cf90e2efc59b",
-        "version" : "2.9.2"
+        "revision" : "7892a123f7e8d0fe62f9f03728b17bbd4f94df5c",
+        "version" : "1.8.1"
       }
     },
     {
-      "identity" : "swift-async-algorithms",
+      "identity" : "sourcekitten",
       "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-async-algorithms.git",
+      "location" : "https://github.com/jpsim/SourceKitten.git",
       "state" : {
-        "revision" : "6ae9a051f76b81cc668305ceed5b0e0a7fd93d20",
-        "version" : "1.0.1"
+        "revision" : "b6dc09ee51dfb0c66e042d2328c017483a1a5d56",
+        "version" : "0.34.1"
       }
     },
     {
-      "identity" : "swift-atomics",
+      "identity" : "swift-argument-parser",
       "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-atomics.git",
+      "location" : "https://github.com/apple/swift-argument-parser.git",
       "state" : {
-        "revision" : "cd142fd2f64be2100422d658e7411e39489da985",
-        "version" : "1.2.0"
+        "revision" : "fee6933f37fde9a5e12a1e4aeaa93fe60116ff2a",
+        "version" : "1.2.2"
       }
     },
     {
-      "identity" : "swift-collections",
+      "identity" : "swift-syntax",
       "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-collections.git",
+      "location" : "https://github.com/apple/swift-syntax.git",
       "state" : {
-        "revision" : "9bf03ff58ce34478e66aaee630e491823326fd06",
-        "version" : "1.1.3"
+        "revision" : "6ad4ea24b01559dde0773e3d091f1b9e36175036",
+        "version" : "509.0.2"
       }
     },
     {
-      "identity" : "swift-http-types",
+      "identity" : "swiftlint",
       "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-http-types",
+      "location" : "https://github.com/realm/SwiftLint.git",
       "state" : {
-        "revision" : "ae67c8178eb46944fd85e4dc6dd970e1f3ed6ccd",
-        "version" : "1.3.0"
+        "revision" : "f17a4f9dfb6a6afb0408426354e4180daaf49cee",
+        "version" : "0.54.0"
       }
     },
     {
-      "identity" : "swift-log",
+      "identity" : "swiftytexttable",
       "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-log.git",
+      "location" : "https://github.com/scottrhoyt/SwiftyTextTable.git",
       "state" : {
-        "revision" : "9cb486020ebf03bfa5b5df985387a14a98744537",
-        "version" : "1.6.1"
+        "revision" : "c6df6cf533d120716bff38f8ff9885e1ce2a4ac3",
+        "version" : "0.9.0"
       }
     },
     {
-      "identity" : "swift-nio",
+      "identity" : "swxmlhash",
       "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-nio.git",
+      "location" : "https://github.com/drmohundro/SWXMLHash.git",
       "state" : {
-        "revision" : "9746cf80e29edfef2a39924a66731249223f42a3",
-        "version" : "2.72.0"
+        "revision" : "4d0f62f561458cbe1f732171e625f03195151b60",
+        "version" : "7.0.1"
       }
     },
     {
-      "identity" : "swift-nio-extras",
+      "identity" : "yams",
       "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-nio-extras.git",
+      "location" : "https://github.com/jpsim/Yams.git",
       "state" : {
-        "revision" : "d1ead62745cc3269e482f1c51f27608057174379",
-        "version" : "1.24.0"
-      }
-    },
-    {
-      "identity" : "swift-nio-http2",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-nio-http2.git",
-      "state" : {
-        "revision" : "b5f7062b60e4add1e8c343ba4eb8da2e324b3a94",
-        "version" : "1.34.0"
-      }
-    },
-    {
-      "identity" : "swift-nio-ssl",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-nio-ssl.git",
-      "state" : {
-        "revision" : "7b84abbdcef69cc3be6573ac12440220789dcd69",
-        "version" : "2.27.2"
-      }
-    },
-    {
-      "identity" : "swift-nio-transport-services",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-nio-transport-services.git",
-      "state" : {
-        "revision" : "38ac8221dd20674682148d6451367f89c2652980",
-        "version" : "1.21.0"
-      }
-    },
-    {
-      "identity" : "swift-protobuf",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-protobuf.git",
-      "state" : {
-        "revision" : "edb6ed4919f7756157fe02f2552b7e3850a538e5",
-        "version" : "1.28.1"
-      }
-    },
-    {
-      "identity" : "swift-system",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-system.git",
-      "state" : {
-        "revision" : "d2ba781702a1d8285419c15ee62fd734a9437ff5",
-        "version" : "1.3.2"
+        "revision" : "0d9ee7ea8c4ebd4a489ad7a73d5c6cad55d6fed3",
+        "version" : "5.0.6"
       }
     }
   ],
-  "version" : 3
+  "version" : 2
 }
diff --git a/Apple/Burrow.xcodeproj/xcshareddata/xcschemes/App.xcscheme b/Apple/Burrow.xcodeproj/xcshareddata/xcschemes/App.xcscheme
index f580ea7..c63f8e6 100644
--- a/Apple/Burrow.xcodeproj/xcshareddata/xcschemes/App.xcscheme
+++ b/Apple/Burrow.xcodeproj/xcshareddata/xcschemes/App.xcscheme
@@ -1,11 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "1600"
+   LastUpgradeVersion = "1510"
    version = "1.7">
    <BuildAction
       parallelizeBuildables = "YES"
-      buildImplicitDependencies = "YES"
-      buildArchitectures = "Automatic">
+      buildImplicitDependencies = "YES">
       <BuildActionEntries>
          <BuildActionEntry
             buildForTesting = "YES"
@@ -28,20 +27,7 @@
       selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
       selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
       shouldUseLaunchSchemeArgsEnv = "YES"
-      shouldAutocreateTestPlan = "NO">
-      <Testables>
-         <TestableReference
-            skipped = "NO"
-            parallelizable = "YES">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "D11000082F70000100112233"
-               BuildableName = "BurrowUITests.xctest"
-               BlueprintName = "BurrowUITests"
-               ReferencedContainer = "container:Burrow.xcodeproj">
-            </BuildableReference>
-         </TestableReference>
-      </Testables>
+      shouldAutocreateTestPlan = "YES">
    </TestAction>
    <LaunchAction
       buildConfiguration = "Debug"
diff --git a/Apple/Burrow.xcodeproj/xcshareddata/xcschemes/NetworkExtension.xcscheme b/Apple/Burrow.xcodeproj/xcshareddata/xcschemes/NetworkExtension.xcscheme
index 316c96e..12e8206 100644
--- a/Apple/Burrow.xcodeproj/xcshareddata/xcschemes/NetworkExtension.xcscheme
+++ b/Apple/Burrow.xcodeproj/xcshareddata/xcschemes/NetworkExtension.xcscheme
@@ -1,12 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "1600"
-   wasCreatedForAppExtension = "YES"
+   LastUpgradeVersion = "1510"
    version = "2.0">
    <BuildAction
       parallelizeBuildables = "YES"
-      buildImplicitDependencies = "YES"
-      buildArchitectures = "Automatic">
+      buildImplicitDependencies = "YES">
       <BuildActionEntries>
          <BuildActionEntry
             buildForTesting = "YES"
diff --git a/Apple/Certificates/README.md b/Apple/Certificates/README.md
deleted file mode 100644
index a579568..0000000
--- a/Apple/Certificates/README.md
+++ /dev/null
@@ -1,41 +0,0 @@
-# Apple Certificates
-
-Public Apple certificate material that can be inspected by release tooling lives
-here. Private keys do not belong in this directory.
-
-## Developer ID Application
-
-- Apple certificate id: `9JKN6HXBHC`
-- Certificate file: `Apple/Certificates/developer-id-application-9JKN6HXBHC.cer`
-- Subject: `Developer ID Application: Conrad Kramer (87PW93R2ZR)`
-- Issuer: `Developer ID Certification Authority`, `G2`
-- Team id: `87PW93R2ZR`
-- Validity: `2026-06-07T12:13:47Z` through `2031-06-08T12:13:46Z`
-- SHA-256 fingerprint: `7B:2D:58:A5:BB:1E:34:5E:FB:FF:7F:E0:A1:CA:4F:B1:5B:6E:08:AF:CE:FD:BE:D0:2B:0A:E9:9C:82:E3:4F:74`
-- Google KMS key:
-  `projects/project-88c23ce9-918a-470a-b33/locations/global/keyRings/burrow-identity/cryptoKeys/apple-developer-id-application/cryptoKeyVersions/1`
-- KMS public-key SHA-256:
-  `9cfaf4755158f445f20a215ef52e7a7ba00da1a310e2e934ba7db5dbb29d2869`
-
-The certificate was created from a CSR signed by the non-exportable Google KMS
-key above. There is no `.p12` for this identity. Release signing must use a
-signer that delegates the relevant Apple code-signing operations to Google KMS.
-
-## iOS Distribution
-
-- Apple certificate id: `3G42677598`
-- Certificate file: `Apple/Certificates/ios-distribution-3G42677598.cer`
-- Subject: `iPhone Distribution: Conrad Kramer (87PW93R2ZR)`
-- Issuer: `Apple Worldwide Developer Relations Certification Authority`, `G3`
-- Team id: `87PW93R2ZR`
-- Validity: `2026-06-07T12:21:32Z` through `2027-06-07T12:21:31Z`
-- SHA-256 fingerprint: `5A:2F:BA:6E:FB:CA:2D:58:01:1F:A0:C8:0F:CF:6B:58:BE:AA:73:7F:4E:F8:06:1C:8A:14:1B:22:8A:2A:29:2B`
-- Google KMS key:
-  `projects/project-88c23ce9-918a-470a-b33/locations/global/keyRings/burrow-identity/cryptoKeys/apple-ios-distribution/cryptoKeyVersions/1`
-- KMS public-key SHA-256:
-  `f8613ce059de90b29acf01cbd4a7deb37567653bd154bdf6c447098b5c4fae91`
-
-The certificate was created from a CSR signed by the non-exportable Google KMS
-key above through App Store Connect certificate creation. There is no `.p12`
-for this identity. iOS signing requires a signing path that can delegate Apple
-code-signing operations to Google KMS.
diff --git a/Apple/Certificates/developer-id-application-9JKN6HXBHC.cer b/Apple/Certificates/developer-id-application-9JKN6HXBHC.cer
deleted file mode 100644
index 3e4d20d..0000000
Binary files a/Apple/Certificates/developer-id-application-9JKN6HXBHC.cer and /dev/null differ
diff --git a/Apple/Certificates/ios-distribution-3G42677598.cer b/Apple/Certificates/ios-distribution-3G42677598.cer
deleted file mode 100644
index f145b1e..0000000
Binary files a/Apple/Certificates/ios-distribution-3G42677598.cer and /dev/null differ
diff --git a/Apple/Configuration/App.xcconfig b/Apple/Configuration/App.xcconfig
index e0946f4..8448773 100644
--- a/Apple/Configuration/App.xcconfig
+++ b/Apple/Configuration/App.xcconfig
@@ -1,8 +1,10 @@
-LD_EXPORT_SYMBOLS = NO
 SKIP_INSTALL = NO
+MERGED_BINARY_TYPE = manual
 
-LD_RUNPATH_SEARCH_PATHS = $(inherited) @executable_path/Frameworks
+LD_RUNPATH_SEARCH_PATHS[sdk=iphone*] = $(inherited) @executable_path/Frameworks
 LD_RUNPATH_SEARCH_PATHS[sdk=macosx*] = $(inherited) @executable_path/../Frameworks
 
 ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon
 ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor
+
+ENABLE_PREVIEWS = YES
diff --git a/Apple/Configuration/Compiler.xcconfig b/Apple/Configuration/Compiler.xcconfig
index a5f4339..aa486a7 100644
--- a/Apple/Configuration/Compiler.xcconfig
+++ b/Apple/Configuration/Compiler.xcconfig
@@ -1,43 +1,61 @@
 #include "Identity.xcconfig"
-#include "Debug.xcconfig"
-#include "Version.xcconfig"
 
 SDKROOT = auto
 ALLOW_TARGET_PLATFORM_SPECIALIZATION = YES
 
 SUPPORTED_PLATFORMS = iphoneos iphonesimulator macosx
-SWIFT_VERSION = 6.0
 IPHONEOS_DEPLOYMENT_TARGET = 17.0
 MACOSX_DEPLOYMENT_TARGET = 14.0
 SUPPORTS_MAC_DESIGNED_FOR_IPHONE_IPAD = NO
 SUPPORTS_MACCATALYST = NO
 
+ALWAYS_SEARCH_USER_PATHS = NO
 PRODUCT_NAME = $(TARGET_NAME:c99extidentifier)
 PRODUCT_BUNDLE_IDENTIFIER = $(APP_BUNDLE_IDENTIFIER).$(PRODUCT_NAME)
+CURRENT_PROJECT_VERSION = 1
 MARKETING_VERSION = 0.1
 
 SKIP_INSTALL = YES
 
 CODE_SIGN_IDENTITY = Apple Development
 
-GENERATE_INFOPLIST_FILE = YES
 INFOPLIST_FILE = Configuration/Info.plist
+GENERATE_INFOPLIST_FILE = YES
 INFOPLIST_KEY_NSHumanReadableCopyright = Copyright © 2023-2024 Hack Club
 INFOPLIST_KEY_CFBundleDisplayName = Burrow
 
-ENABLE_APP_SANDBOX[sdk=macosx*] = YES
-
 ENABLE_BITCODE = NO
-ALWAYS_SEARCH_USER_PATHS = NO
+
+ENABLE_APP_SANDBOX[sdk=macosx*] = YES
+ENABLE_HARDENED_RUNTIME[sdk=macosx*] = YES
 COMBINE_HIDPI_IMAGES = YES
-EAGER_LINKING = YES
+COPY_PHASE_STRIP = NO
+
 FUSE_BUILD_SCRIPT_PHASES = YES
-SWIFT_EMIT_LOC_STRINGS = YES
-LOCALIZATION_PREFERS_STRING_CATALOGS = YES
-ENABLE_DEBUG_DYLIB = NO
 
 APP_GROUP_IDENTIFIER = group.$(APP_BUNDLE_IDENTIFIER)
 APP_GROUP_IDENTIFIER[sdk=macosx*] = $(DEVELOPMENT_TEAM).$(APP_BUNDLE_IDENTIFIER)
 NETWORK_EXTENSION_BUNDLE_IDENTIFIER = $(APP_BUNDLE_IDENTIFIER).network
 
-OTHER_SWIFT_FLAGS = $(inherited)
+// Swift
+SWIFT_VERSION = 5.0
+SWIFT_EMIT_LOC_STRINGS = YES
+
+// Release
+DEBUG_INFORMATION_FORMAT = dwarf-with-dsym
+SWIFT_COMPILATION_MODE = wholemodule
+SWIFT_OPTIMIZATION_LEVEL = -Osize
+LLVM_LTO = YES
+DEAD_CODE_STRIPPING = YES
+VALIDATE_PRODUCT = YES
+
+// Debug
+ONLY_ACTIVE_ARCH[config=Debug] = YES
+DEBUG_INFORMATION_FORMAT[config=Debug] = dwarf
+ENABLE_TESTABILITY[config=Debug] = YES
+SWIFT_OPTIMIZATION_LEVEL[config=Debug] = -Onone
+SWIFT_ACTIVE_COMPILATION_CONDITIONS[config=Debug] = DEBUG
+SWIFT_COMPILATION_MODE[config=Debug] = singlefile
+LLVM_LTO[config=Debug] = NO
+DEAD_CODE_STRIPPING[config=Debug] = NO
+VALIDATE_PRODUCT[config=Debug] = NO
diff --git a/Apple/Configuration/Configuration.xcconfig b/Apple/Configuration/Configuration.xcconfig
deleted file mode 100644
index 622950a..0000000
--- a/Apple/Configuration/Configuration.xcconfig
+++ /dev/null
@@ -1,4 +0,0 @@
-#include "Framework.xcconfig"
-
-SWIFT_INCLUDE_PATHS = $(PROJECT_DIR)/Configuration/Constants
-GCC_PREPROCESSOR_DEFINITIONS = APP_BUNDLE_IDENTIFIER=$(APP_BUNDLE_IDENTIFIER) APP_GROUP_IDENTIFIER=$(APP_GROUP_IDENTIFIER) NETWORK_EXTENSION_BUNDLE_IDENTIFIER=$(NETWORK_EXTENSION_BUNDLE_IDENTIFIER)
diff --git a/Apple/Configuration/Constants/Constants.swift b/Apple/Configuration/Constants/Constants.swift
deleted file mode 100644
index 95d8c78..0000000
--- a/Apple/Configuration/Constants/Constants.swift
+++ /dev/null
@@ -1,56 +0,0 @@
-@_implementationOnly import CConstants
-import Foundation
-import OSLog
-
-public enum Constants {
-    enum Error: Swift.Error {
-        case invalidAppGroupIdentifier
-    }
-
-    public static let bundleIdentifier = AppBundleIdentifier
-    public static let appGroupIdentifier = AppGroupIdentifier
-    public static let networkExtensionBundleIdentifier = NetworkExtensionBundleIdentifier
-
-    public static var socketURL: URL {
-        get throws {
-            try groupContainerURL.appending(component: "burrow.sock", directoryHint: .notDirectory)
-        }
-    }
-    public static var databaseURL: URL {
-        get throws {
-            try groupContainerURL.appending(component: "burrow.db", directoryHint: .notDirectory)
-        }
-    }
-
-    private static var groupContainerURL: URL {
-        get throws { try _groupContainerURL.get() }
-    }
-    private static let _groupContainerURL: Result<URL, Error> = {
-        switch FileManager.default.containerURL(forSecurityApplicationGroupIdentifier: appGroupIdentifier) {
-        case .some(let url): .success(url)
-        case .none:
-            fallbackContainerURL().mapError { _ in .invalidAppGroupIdentifier }
-        }
-    }()
-
-    private static func fallbackContainerURL() -> Result<URL, any Swift.Error> {
-#if targetEnvironment(simulator)
-        Result {
-            // The simulator app's Application Support path lives inside its sandbox container,
-            // so the host daemon cannot reach it. Use a shared host temp location instead.
-            let url = URL(filePath: "/tmp", directoryHint: .isDirectory)
-                .appending(component: bundleIdentifier, directoryHint: .isDirectory)
-                .appending(component: "SimulatorFallback", directoryHint: .isDirectory)
-            try FileManager.default.createDirectory(at: url, withIntermediateDirectories: true)
-            return url
-        }
-#else
-        .failure(Error.invalidAppGroupIdentifier)
-#endif
-    }
-}
-
-extension Logger {
-    @_dynamicReplacement(for: subsystem)
-    public static var subsystem: String { Constants.bundleIdentifier }
-}
diff --git a/Apple/Configuration/Debug.xcconfig b/Apple/Configuration/Debug.xcconfig
deleted file mode 100644
index 9529dbd..0000000
--- a/Apple/Configuration/Debug.xcconfig
+++ /dev/null
@@ -1,26 +0,0 @@
-// Release
-DEBUG_INFORMATION_FORMAT = dwarf-with-dsym
-SWIFT_COMPILATION_MODE = wholemodule
-SWIFT_OPTIMIZATION_LEVEL = -Osize
-LLVM_LTO = YES
-DEAD_CODE_STRIPPING = YES
-STRIP_INSTALLED_PRODUCT = YES
-STRIP_SWIFT_SYMBOLS = YES
-COPY_PHASE_STRIP = NO
-VALIDATE_PRODUCT = YES
-ENABLE_MODULE_VERIFIER = YES
-
-// Debug
-ONLY_ACTIVE_ARCH[config=Debug] = YES
-DEBUG_INFORMATION_FORMAT[config=Debug] = dwarf
-ENABLE_TESTABILITY[config=Debug] = YES
-GCC_PREPROCESSOR_DEFINITIONS[config=Debug] = DEBUG=1 $(inherited)
-SWIFT_OPTIMIZATION_LEVEL[config=Debug] = -Onone
-SWIFT_ACTIVE_COMPILATION_CONDITIONS[config=Debug] = DEBUG
-SWIFT_COMPILATION_MODE[config=Debug] = singlefile
-LLVM_LTO[config=Debug] = NO
-DEAD_CODE_STRIPPING[config=Debug] = NO
-VALIDATE_PRODUCT[config=Debug] = NO
-STRIP_INSTALLED_PRODUCT[config=Debug] = NO
-STRIP_SWIFT_SYMBOLS[config=Debug] = NO
-ENABLE_MODULE_VERIFIER[config=Debug] = NO
diff --git a/Apple/Configuration/Extension.xcconfig b/Apple/Configuration/Extension.xcconfig
index 5885c31..f8d90a3 100644
--- a/Apple/Configuration/Extension.xcconfig
+++ b/Apple/Configuration/Extension.xcconfig
@@ -1,6 +1,4 @@
-LD_EXPORT_SYMBOLS = NO
-
-OTHER_SWIFT_FLAGS = $(inherited) -Xfrontend -disable-autolink-framework -Xfrontend UIKit -Xfrontend -disable-autolink-framework -Xfrontend AppKit -Xfrontend -disable-autolink-framework -Xfrontend SwiftUI
+MERGED_BINARY_TYPE = manual
 
 LD_RUNPATH_SEARCH_PATHS = $(inherited) @executable_path/Frameworks @executable_path/../../Frameworks
-LD_RUNPATH_SEARCH_PATHS[sdk=macosx*] = $(inherited) @executable_path/../Frameworks @executable_path/../../../../Frameworks
+LD_RUNPATH_SEARCH_PATHS[sdk=macos*] = $(inherited) @executable_path/../Frameworks @executable_path/../../../../Frameworks
diff --git a/Apple/Configuration/Framework.xcconfig b/Apple/Configuration/Framework.xcconfig
deleted file mode 100644
index 6fa4f19..0000000
--- a/Apple/Configuration/Framework.xcconfig
+++ /dev/null
@@ -1,14 +0,0 @@
-PRODUCT_NAME = Burrow$(TARGET_NAME:c99extidentifier)
-PRODUCT_BUNDLE_IDENTIFIER = $(APP_BUNDLE_IDENTIFIER).$(TARGET_NAME:c99extidentifier)
-APPLICATION_EXTENSION_API_ONLY = YES
-SWIFT_INSTALL_OBJC_HEADER = NO
-SWIFT_SKIP_AUTOLINKING_FRAMEWORKS = YES
-SWIFT_SKIP_AUTOLINKING_LIBRARIES = YES
-
-LD_RUNPATH_SEARCH_PATHS = $(inherited) @executable_path/Frameworks @loader_path/Frameworks
-LD_RUNPATH_SEARCH_PATHS[sdk=macosx*] = $(inherited) @executable_path/../Frameworks @loader_path/Frameworks
-
-DYLIB_INSTALL_NAME_BASE = @rpath
-DYLIB_COMPATIBILITY_VERSION = 1
-DYLIB_CURRENT_VERSION = 1
-VERSIONING_SYSTEM =
diff --git a/Apple/Configuration/Info.plist b/Apple/Configuration/Info.plist
index 519d374..7632dad 100644
--- a/Apple/Configuration/Info.plist
+++ b/Apple/Configuration/Info.plist
@@ -4,9 +4,5 @@
 <dict>
 	<key>CFBundleName</key>
 	<string>$(INFOPLIST_KEY_CFBundleDisplayName)</string>
-	<key>SUFeedURL</key>
-	<string>$(BURROW_SPARKLE_FEED_URL)</string>
-	<key>SUPublicEDKey</key>
-	<string>$(BURROW_SPARKLE_PUBLIC_ED_KEY)</string>
 </dict>
 </plist>
diff --git a/Apple/Configuration/UITests.xcconfig b/Apple/Configuration/UITests.xcconfig
deleted file mode 100644
index a97e290..0000000
--- a/Apple/Configuration/UITests.xcconfig
+++ /dev/null
@@ -1,14 +0,0 @@
-#include "Compiler.xcconfig"
-
-SUPPORTED_PLATFORMS = iphonesimulator iphoneos
-TARGETED_DEVICE_FAMILY[sdk=iphone*] = 1,2
-
-PRODUCT_NAME = $(TARGET_NAME)
-PRODUCT_BUNDLE_IDENTIFIER = $(APP_BUNDLE_IDENTIFIER).uitests
-
-STRING_CATALOG_GENERATE_SYMBOLS = NO
-SWIFT_EMIT_LOC_STRINGS = NO
-
-ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES
-LD_RUNPATH_SEARCH_PATHS = $(inherited) @executable_path/Frameworks @loader_path/Frameworks
-TEST_TARGET_NAME = App
diff --git a/Apple/Configuration/Version.xcconfig b/Apple/Configuration/Version.xcconfig
deleted file mode 100644
index e69de29..0000000
diff --git a/Apple/Core/Client.swift b/Apple/Core/Client.swift
deleted file mode 100644
index 7d4cfc7..0000000
--- a/Apple/Core/Client.swift
+++ /dev/null
@@ -1,508 +0,0 @@
-import Foundation
-import GRPC
-import NIOTransportServices
-import SwiftProtobuf
-
-public typealias TunnelClient = Burrow_TunnelAsyncClient
-public typealias NetworksClient = Burrow_NetworksAsyncClient
-
-public protocol Client {
-    init(channel: GRPCChannel)
-}
-
-extension Client {
-    public static func unix(socketURL: URL) -> Self {
-        let group = NIOTSEventLoopGroup()
-        let configuration = ClientConnection.Configuration.default(
-            target: .unixDomainSocket(socketURL.path),
-            eventLoopGroup: group
-        )
-        return Self(channel: ClientConnection(configuration: configuration))
-    }
-}
-
-extension TunnelClient: Client {
-    public init(channel: any GRPCChannel) {
-        self.init(channel: channel, defaultCallOptions: .init(), interceptors: .none)
-    }
-}
-
-extension NetworksClient: Client {
-    public init(channel: any GRPCChannel) {
-        self.init(channel: channel, defaultCallOptions: .init(), interceptors: .none)
-    }
-}
-
-public struct Burrow_TailnetDiscoverRequest: Sendable {
-    public var email: String = ""
-    public var unknownFields = SwiftProtobuf.UnknownStorage()
-
-    public init() {}
-}
-
-public struct Burrow_TailnetDiscoverResponse: Sendable {
-    public var domain: String = ""
-    public var authority: String = ""
-    public var oidcIssuer: String = ""
-    public var managed: Bool = false
-    public var unknownFields = SwiftProtobuf.UnknownStorage()
-
-    public init() {}
-}
-
-public struct Burrow_TailnetProbeRequest: Sendable {
-    public var authority: String = ""
-    public var unknownFields = SwiftProtobuf.UnknownStorage()
-
-    public init() {}
-}
-
-public struct Burrow_TailnetProbeResponse: Sendable {
-    public var authority: String = ""
-    public var statusCode: Int32 = 0
-    public var summary: String = ""
-    public var detail: String = ""
-    public var reachable: Bool = false
-    public var unknownFields = SwiftProtobuf.UnknownStorage()
-
-    public init() {}
-}
-
-public struct Burrow_TailnetLoginStartRequest: Sendable {
-    public var accountName: String = ""
-    public var identityName: String = ""
-    public var hostname: String = ""
-    public var authority: String = ""
-    public var unknownFields = SwiftProtobuf.UnknownStorage()
-
-    public init() {}
-}
-
-public struct Burrow_TailnetLoginStatusRequest: Sendable {
-    public var sessionID: String = ""
-    public var unknownFields = SwiftProtobuf.UnknownStorage()
-
-    public init() {}
-}
-
-public struct Burrow_TailnetLoginCancelRequest: Sendable {
-    public var sessionID: String = ""
-    public var unknownFields = SwiftProtobuf.UnknownStorage()
-
-    public init() {}
-}
-
-public struct Burrow_TailnetLoginStatusResponse: Sendable {
-    public var sessionID: String = ""
-    public var backendState: String = ""
-    public var authURL: String = ""
-    public var running: Bool = false
-    public var needsLogin: Bool = false
-    public var tailnetName: String = ""
-    public var magicDNSSuffix: String = ""
-    public var selfDNSName: String = ""
-    public var tailnetIPs: [String] = []
-    public var health: [String] = []
-    public var unknownFields = SwiftProtobuf.UnknownStorage()
-
-    public init() {}
-}
-
-public struct Burrow_TunnelPacket: Sendable {
-    public var payload = Data()
-    public var unknownFields = SwiftProtobuf.UnknownStorage()
-
-    public init() {}
-}
-
-extension Burrow_TailnetDiscoverRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
-    public static let protoMessageName: String = "burrow.TailnetDiscoverRequest"
-    public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-        1: .same(proto: "email")
-    ]
-
-    public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
-        while let fieldNumber = try decoder.nextFieldNumber() {
-            switch fieldNumber {
-            case 1: try decoder.decodeSingularStringField(value: &self.email)
-            default: break
-            }
-        }
-    }
-
-    public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
-        if !self.email.isEmpty {
-            try visitor.visitSingularStringField(value: self.email, fieldNumber: 1)
-        }
-        try unknownFields.traverse(visitor: &visitor)
-    }
-}
-
-extension Burrow_TailnetDiscoverResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
-    public static let protoMessageName: String = "burrow.TailnetDiscoverResponse"
-    public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-        1: .same(proto: "domain"),
-        2: .same(proto: "authority"),
-        3: .same(proto: "oidc_issuer"),
-        4: .same(proto: "managed"),
-    ]
-
-    public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
-        while let fieldNumber = try decoder.nextFieldNumber() {
-            switch fieldNumber {
-            case 1: try decoder.decodeSingularStringField(value: &self.domain)
-            case 2: try decoder.decodeSingularStringField(value: &self.authority)
-            case 3: try decoder.decodeSingularStringField(value: &self.oidcIssuer)
-            case 4: try decoder.decodeSingularBoolField(value: &self.managed)
-            default: break
-            }
-        }
-    }
-
-    public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
-        if !self.domain.isEmpty {
-            try visitor.visitSingularStringField(value: self.domain, fieldNumber: 1)
-        }
-        if !self.authority.isEmpty {
-            try visitor.visitSingularStringField(value: self.authority, fieldNumber: 2)
-        }
-        if !self.oidcIssuer.isEmpty {
-            try visitor.visitSingularStringField(value: self.oidcIssuer, fieldNumber: 3)
-        }
-        if self.managed {
-            try visitor.visitSingularBoolField(value: self.managed, fieldNumber: 4)
-        }
-        try unknownFields.traverse(visitor: &visitor)
-    }
-}
-
-extension Burrow_TailnetProbeRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
-    public static let protoMessageName: String = "burrow.TailnetProbeRequest"
-    public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-        1: .same(proto: "authority")
-    ]
-
-    public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
-        while let fieldNumber = try decoder.nextFieldNumber() {
-            switch fieldNumber {
-            case 1: try decoder.decodeSingularStringField(value: &self.authority)
-            default: break
-            }
-        }
-    }
-
-    public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
-        if !self.authority.isEmpty {
-            try visitor.visitSingularStringField(value: self.authority, fieldNumber: 1)
-        }
-        try unknownFields.traverse(visitor: &visitor)
-    }
-}
-
-extension Burrow_TailnetProbeResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
-    public static let protoMessageName: String = "burrow.TailnetProbeResponse"
-    public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-        1: .same(proto: "authority"),
-        2: .same(proto: "status_code"),
-        3: .same(proto: "summary"),
-        4: .same(proto: "detail"),
-        5: .same(proto: "reachable"),
-    ]
-
-    public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
-        while let fieldNumber = try decoder.nextFieldNumber() {
-            switch fieldNumber {
-            case 1: try decoder.decodeSingularStringField(value: &self.authority)
-            case 2: try decoder.decodeSingularInt32Field(value: &self.statusCode)
-            case 3: try decoder.decodeSingularStringField(value: &self.summary)
-            case 4: try decoder.decodeSingularStringField(value: &self.detail)
-            case 5: try decoder.decodeSingularBoolField(value: &self.reachable)
-            default: break
-            }
-        }
-    }
-
-    public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
-        if !self.authority.isEmpty {
-            try visitor.visitSingularStringField(value: self.authority, fieldNumber: 1)
-        }
-        if self.statusCode != 0 {
-            try visitor.visitSingularInt32Field(value: self.statusCode, fieldNumber: 2)
-        }
-        if !self.summary.isEmpty {
-            try visitor.visitSingularStringField(value: self.summary, fieldNumber: 3)
-        }
-        if !self.detail.isEmpty {
-            try visitor.visitSingularStringField(value: self.detail, fieldNumber: 4)
-        }
-        if self.reachable {
-            try visitor.visitSingularBoolField(value: self.reachable, fieldNumber: 5)
-        }
-        try unknownFields.traverse(visitor: &visitor)
-    }
-}
-
-extension Burrow_TailnetLoginStartRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
-    public static let protoMessageName: String = "burrow.TailnetLoginStartRequest"
-    public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-        1: .standard(proto: "account_name"),
-        2: .standard(proto: "identity_name"),
-        3: .same(proto: "hostname"),
-        4: .same(proto: "authority"),
-    ]
-
-    public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
-        while let fieldNumber = try decoder.nextFieldNumber() {
-            switch fieldNumber {
-            case 1: try decoder.decodeSingularStringField(value: &self.accountName)
-            case 2: try decoder.decodeSingularStringField(value: &self.identityName)
-            case 3: try decoder.decodeSingularStringField(value: &self.hostname)
-            case 4: try decoder.decodeSingularStringField(value: &self.authority)
-            default: break
-            }
-        }
-    }
-
-    public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
-        if !self.accountName.isEmpty {
-            try visitor.visitSingularStringField(value: self.accountName, fieldNumber: 1)
-        }
-        if !self.identityName.isEmpty {
-            try visitor.visitSingularStringField(value: self.identityName, fieldNumber: 2)
-        }
-        if !self.hostname.isEmpty {
-            try visitor.visitSingularStringField(value: self.hostname, fieldNumber: 3)
-        }
-        if !self.authority.isEmpty {
-            try visitor.visitSingularStringField(value: self.authority, fieldNumber: 4)
-        }
-        try unknownFields.traverse(visitor: &visitor)
-    }
-}
-
-extension Burrow_TailnetLoginStatusRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
-    public static let protoMessageName: String = "burrow.TailnetLoginStatusRequest"
-    public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-        1: .standard(proto: "session_id")
-    ]
-
-    public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
-        while let fieldNumber = try decoder.nextFieldNumber() {
-            switch fieldNumber {
-            case 1: try decoder.decodeSingularStringField(value: &self.sessionID)
-            default: break
-            }
-        }
-    }
-
-    public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
-        if !self.sessionID.isEmpty {
-            try visitor.visitSingularStringField(value: self.sessionID, fieldNumber: 1)
-        }
-        try unknownFields.traverse(visitor: &visitor)
-    }
-}
-
-extension Burrow_TailnetLoginCancelRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
-    public static let protoMessageName: String = "burrow.TailnetLoginCancelRequest"
-    public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-        1: .standard(proto: "session_id")
-    ]
-
-    public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
-        while let fieldNumber = try decoder.nextFieldNumber() {
-            switch fieldNumber {
-            case 1: try decoder.decodeSingularStringField(value: &self.sessionID)
-            default: break
-            }
-        }
-    }
-
-    public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
-        if !self.sessionID.isEmpty {
-            try visitor.visitSingularStringField(value: self.sessionID, fieldNumber: 1)
-        }
-        try unknownFields.traverse(visitor: &visitor)
-    }
-}
-
-extension Burrow_TailnetLoginStatusResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
-    public static let protoMessageName: String = "burrow.TailnetLoginStatusResponse"
-    public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-        1: .standard(proto: "session_id"),
-        2: .standard(proto: "backend_state"),
-        3: .standard(proto: "auth_url"),
-        4: .same(proto: "running"),
-        5: .standard(proto: "needs_login"),
-        6: .standard(proto: "tailnet_name"),
-        7: .standard(proto: "magic_dns_suffix"),
-        8: .standard(proto: "self_dns_name"),
-        9: .standard(proto: "tailnet_ips"),
-        10: .same(proto: "health"),
-    ]
-
-    public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
-        while let fieldNumber = try decoder.nextFieldNumber() {
-            switch fieldNumber {
-            case 1: try decoder.decodeSingularStringField(value: &self.sessionID)
-            case 2: try decoder.decodeSingularStringField(value: &self.backendState)
-            case 3: try decoder.decodeSingularStringField(value: &self.authURL)
-            case 4: try decoder.decodeSingularBoolField(value: &self.running)
-            case 5: try decoder.decodeSingularBoolField(value: &self.needsLogin)
-            case 6: try decoder.decodeSingularStringField(value: &self.tailnetName)
-            case 7: try decoder.decodeSingularStringField(value: &self.magicDNSSuffix)
-            case 8: try decoder.decodeSingularStringField(value: &self.selfDNSName)
-            case 9: try decoder.decodeRepeatedStringField(value: &self.tailnetIPs)
-            case 10: try decoder.decodeRepeatedStringField(value: &self.health)
-            default: break
-            }
-        }
-    }
-
-    public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
-        if !self.sessionID.isEmpty {
-            try visitor.visitSingularStringField(value: self.sessionID, fieldNumber: 1)
-        }
-        if !self.backendState.isEmpty {
-            try visitor.visitSingularStringField(value: self.backendState, fieldNumber: 2)
-        }
-        if !self.authURL.isEmpty {
-            try visitor.visitSingularStringField(value: self.authURL, fieldNumber: 3)
-        }
-        if self.running {
-            try visitor.visitSingularBoolField(value: self.running, fieldNumber: 4)
-        }
-        if self.needsLogin {
-            try visitor.visitSingularBoolField(value: self.needsLogin, fieldNumber: 5)
-        }
-        if !self.tailnetName.isEmpty {
-            try visitor.visitSingularStringField(value: self.tailnetName, fieldNumber: 6)
-        }
-        if !self.magicDNSSuffix.isEmpty {
-            try visitor.visitSingularStringField(value: self.magicDNSSuffix, fieldNumber: 7)
-        }
-        if !self.selfDNSName.isEmpty {
-            try visitor.visitSingularStringField(value: self.selfDNSName, fieldNumber: 8)
-        }
-        if !self.tailnetIPs.isEmpty {
-            try visitor.visitRepeatedStringField(value: self.tailnetIPs, fieldNumber: 9)
-        }
-        if !self.health.isEmpty {
-            try visitor.visitRepeatedStringField(value: self.health, fieldNumber: 10)
-        }
-        try unknownFields.traverse(visitor: &visitor)
-    }
-}
-
-extension Burrow_TunnelPacket: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
-    public static let protoMessageName: String = "burrow.TunnelPacket"
-    public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-        1: .same(proto: "payload")
-    ]
-
-    public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
-        while let fieldNumber = try decoder.nextFieldNumber() {
-            switch fieldNumber {
-            case 1: try decoder.decodeSingularBytesField(value: &self.payload)
-            default: break
-            }
-        }
-    }
-
-    public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
-        if !self.payload.isEmpty {
-            try visitor.visitSingularBytesField(value: self.payload, fieldNumber: 1)
-        }
-        try unknownFields.traverse(visitor: &visitor)
-    }
-}
-
-public struct TailnetClient: Client, GRPCClient {
-    public let channel: GRPCChannel
-    public var defaultCallOptions: CallOptions
-
-    public init(channel: any GRPCChannel) {
-        self.channel = channel
-        self.defaultCallOptions = .init()
-    }
-
-    public func discover(
-        _ request: Burrow_TailnetDiscoverRequest,
-        callOptions: CallOptions? = nil
-    ) async throws -> Burrow_TailnetDiscoverResponse {
-        try await self.performAsyncUnaryCall(
-            path: "/burrow.TailnetControl/Discover",
-            request: request,
-            callOptions: callOptions ?? self.defaultCallOptions,
-            interceptors: []
-        )
-    }
-
-    public func probe(
-        _ request: Burrow_TailnetProbeRequest,
-        callOptions: CallOptions? = nil
-    ) async throws -> Burrow_TailnetProbeResponse {
-        try await self.performAsyncUnaryCall(
-            path: "/burrow.TailnetControl/Probe",
-            request: request,
-            callOptions: callOptions ?? self.defaultCallOptions,
-            interceptors: []
-        )
-    }
-
-    public func loginStart(
-        _ request: Burrow_TailnetLoginStartRequest,
-        callOptions: CallOptions? = nil
-    ) async throws -> Burrow_TailnetLoginStatusResponse {
-        try await self.performAsyncUnaryCall(
-            path: "/burrow.TailnetControl/LoginStart",
-            request: request,
-            callOptions: callOptions ?? self.defaultCallOptions,
-            interceptors: []
-        )
-    }
-
-    public func loginStatus(
-        _ request: Burrow_TailnetLoginStatusRequest,
-        callOptions: CallOptions? = nil
-    ) async throws -> Burrow_TailnetLoginStatusResponse {
-        try await self.performAsyncUnaryCall(
-            path: "/burrow.TailnetControl/LoginStatus",
-            request: request,
-            callOptions: callOptions ?? self.defaultCallOptions,
-            interceptors: []
-        )
-    }
-
-    public func loginCancel(
-        _ request: Burrow_TailnetLoginCancelRequest,
-        callOptions: CallOptions? = nil
-    ) async throws -> Burrow_Empty {
-        try await self.performAsyncUnaryCall(
-            path: "/burrow.TailnetControl/LoginCancel",
-            request: request,
-            callOptions: callOptions ?? self.defaultCallOptions,
-            interceptors: []
-        )
-    }
-}
-
-public struct TunnelPacketClient: Client, GRPCClient {
-    public let channel: GRPCChannel
-    public var defaultCallOptions: CallOptions
-
-    public init(channel: any GRPCChannel) {
-        self.channel = channel
-        self.defaultCallOptions = .init()
-    }
-
-    public func makeTunnelPacketsCall(
-        callOptions: CallOptions? = nil
-    ) -> GRPCAsyncBidirectionalStreamingCall<Burrow_TunnelPacket, Burrow_TunnelPacket> {
-        self.makeAsyncBidirectionalStreamingCall(
-            path: "/burrow.Tunnel/TunnelPackets",
-            callOptions: callOptions ?? self.defaultCallOptions,
-            interceptors: []
-        )
-    }
-}
diff --git a/Apple/Core/Client/Generated/burrow.grpc.swift b/Apple/Core/Client/Generated/burrow.grpc.swift
deleted file mode 100644
index d1f848c..0000000
--- a/Apple/Core/Client/Generated/burrow.grpc.swift
+++ /dev/null
@@ -1,761 +0,0 @@
-//
-// DO NOT EDIT.
-// swift-format-ignore-file
-//
-// Generated by the protocol buffer compiler.
-// Source: burrow.proto
-//
-import GRPC
-import NIO
-import NIOConcurrencyHelpers
-import SwiftProtobuf
-
-
-/// Usage: instantiate `Burrow_TunnelClient`, then call methods of this protocol to make API calls.
-public protocol Burrow_TunnelClientProtocol: GRPCClient {
-  var serviceName: String { get }
-  var interceptors: Burrow_TunnelClientInterceptorFactoryProtocol? { get }
-
-  func tunnelConfiguration(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions?,
-    handler: @escaping (Burrow_TunnelConfigurationResponse) -> Void
-  ) -> ServerStreamingCall<Burrow_Empty, Burrow_TunnelConfigurationResponse>
-
-  func tunnelStart(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions?
-  ) -> UnaryCall<Burrow_Empty, Burrow_Empty>
-
-  func tunnelStop(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions?
-  ) -> UnaryCall<Burrow_Empty, Burrow_Empty>
-
-  func tunnelStatus(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions?,
-    handler: @escaping (Burrow_TunnelStatusResponse) -> Void
-  ) -> ServerStreamingCall<Burrow_Empty, Burrow_TunnelStatusResponse>
-}
-
-extension Burrow_TunnelClientProtocol {
-  public var serviceName: String {
-    return "burrow.Tunnel"
-  }
-
-  /// Server streaming call to TunnelConfiguration
-  ///
-  /// - Parameters:
-  ///   - request: Request to send to TunnelConfiguration.
-  ///   - callOptions: Call options.
-  ///   - handler: A closure called when each response is received from the server.
-  /// - Returns: A `ServerStreamingCall` with futures for the metadata and status.
-  public func tunnelConfiguration(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions? = nil,
-    handler: @escaping (Burrow_TunnelConfigurationResponse) -> Void
-  ) -> ServerStreamingCall<Burrow_Empty, Burrow_TunnelConfigurationResponse> {
-    return self.makeServerStreamingCall(
-      path: Burrow_TunnelClientMetadata.Methods.tunnelConfiguration.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeTunnelConfigurationInterceptors() ?? [],
-      handler: handler
-    )
-  }
-
-  /// Unary call to TunnelStart
-  ///
-  /// - Parameters:
-  ///   - request: Request to send to TunnelStart.
-  ///   - callOptions: Call options.
-  /// - Returns: A `UnaryCall` with futures for the metadata, status and response.
-  public func tunnelStart(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions? = nil
-  ) -> UnaryCall<Burrow_Empty, Burrow_Empty> {
-    return self.makeUnaryCall(
-      path: Burrow_TunnelClientMetadata.Methods.tunnelStart.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeTunnelStartInterceptors() ?? []
-    )
-  }
-
-  /// Unary call to TunnelStop
-  ///
-  /// - Parameters:
-  ///   - request: Request to send to TunnelStop.
-  ///   - callOptions: Call options.
-  /// - Returns: A `UnaryCall` with futures for the metadata, status and response.
-  public func tunnelStop(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions? = nil
-  ) -> UnaryCall<Burrow_Empty, Burrow_Empty> {
-    return self.makeUnaryCall(
-      path: Burrow_TunnelClientMetadata.Methods.tunnelStop.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeTunnelStopInterceptors() ?? []
-    )
-  }
-
-  /// Server streaming call to TunnelStatus
-  ///
-  /// - Parameters:
-  ///   - request: Request to send to TunnelStatus.
-  ///   - callOptions: Call options.
-  ///   - handler: A closure called when each response is received from the server.
-  /// - Returns: A `ServerStreamingCall` with futures for the metadata and status.
-  public func tunnelStatus(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions? = nil,
-    handler: @escaping (Burrow_TunnelStatusResponse) -> Void
-  ) -> ServerStreamingCall<Burrow_Empty, Burrow_TunnelStatusResponse> {
-    return self.makeServerStreamingCall(
-      path: Burrow_TunnelClientMetadata.Methods.tunnelStatus.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeTunnelStatusInterceptors() ?? [],
-      handler: handler
-    )
-  }
-}
-
-@available(*, deprecated)
-extension Burrow_TunnelClient: @unchecked Sendable {}
-
-@available(*, deprecated, renamed: "Burrow_TunnelNIOClient")
-public final class Burrow_TunnelClient: Burrow_TunnelClientProtocol {
-  private let lock = Lock()
-  private var _defaultCallOptions: CallOptions
-  private var _interceptors: Burrow_TunnelClientInterceptorFactoryProtocol?
-  public let channel: GRPCChannel
-  public var defaultCallOptions: CallOptions {
-    get { self.lock.withLock { return self._defaultCallOptions } }
-    set { self.lock.withLockVoid { self._defaultCallOptions = newValue } }
-  }
-  public var interceptors: Burrow_TunnelClientInterceptorFactoryProtocol? {
-    get { self.lock.withLock { return self._interceptors } }
-    set { self.lock.withLockVoid { self._interceptors = newValue } }
-  }
-
-  /// Creates a client for the burrow.Tunnel service.
-  ///
-  /// - Parameters:
-  ///   - channel: `GRPCChannel` to the service host.
-  ///   - defaultCallOptions: Options to use for each service call if the user doesn't provide them.
-  ///   - interceptors: A factory providing interceptors for each RPC.
-  public init(
-    channel: GRPCChannel,
-    defaultCallOptions: CallOptions = CallOptions(),
-    interceptors: Burrow_TunnelClientInterceptorFactoryProtocol? = nil
-  ) {
-    self.channel = channel
-    self._defaultCallOptions = defaultCallOptions
-    self._interceptors = interceptors
-  }
-}
-
-public struct Burrow_TunnelNIOClient: Burrow_TunnelClientProtocol {
-  public var channel: GRPCChannel
-  public var defaultCallOptions: CallOptions
-  public var interceptors: Burrow_TunnelClientInterceptorFactoryProtocol?
-
-  /// Creates a client for the burrow.Tunnel service.
-  ///
-  /// - Parameters:
-  ///   - channel: `GRPCChannel` to the service host.
-  ///   - defaultCallOptions: Options to use for each service call if the user doesn't provide them.
-  ///   - interceptors: A factory providing interceptors for each RPC.
-  public init(
-    channel: GRPCChannel,
-    defaultCallOptions: CallOptions = CallOptions(),
-    interceptors: Burrow_TunnelClientInterceptorFactoryProtocol? = nil
-  ) {
-    self.channel = channel
-    self.defaultCallOptions = defaultCallOptions
-    self.interceptors = interceptors
-  }
-}
-
-@available(macOS 10.15, iOS 13, tvOS 13, watchOS 6, *)
-public protocol Burrow_TunnelAsyncClientProtocol: GRPCClient {
-  static var serviceDescriptor: GRPCServiceDescriptor { get }
-  var interceptors: Burrow_TunnelClientInterceptorFactoryProtocol? { get }
-
-  func makeTunnelConfigurationCall(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions?
-  ) -> GRPCAsyncServerStreamingCall<Burrow_Empty, Burrow_TunnelConfigurationResponse>
-
-  func makeTunnelStartCall(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions?
-  ) -> GRPCAsyncUnaryCall<Burrow_Empty, Burrow_Empty>
-
-  func makeTunnelStopCall(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions?
-  ) -> GRPCAsyncUnaryCall<Burrow_Empty, Burrow_Empty>
-
-  func makeTunnelStatusCall(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions?
-  ) -> GRPCAsyncServerStreamingCall<Burrow_Empty, Burrow_TunnelStatusResponse>
-}
-
-@available(macOS 10.15, iOS 13, tvOS 13, watchOS 6, *)
-extension Burrow_TunnelAsyncClientProtocol {
-  public static var serviceDescriptor: GRPCServiceDescriptor {
-    return Burrow_TunnelClientMetadata.serviceDescriptor
-  }
-
-  public var interceptors: Burrow_TunnelClientInterceptorFactoryProtocol? {
-    return nil
-  }
-
-  public func makeTunnelConfigurationCall(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions? = nil
-  ) -> GRPCAsyncServerStreamingCall<Burrow_Empty, Burrow_TunnelConfigurationResponse> {
-    return self.makeAsyncServerStreamingCall(
-      path: Burrow_TunnelClientMetadata.Methods.tunnelConfiguration.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeTunnelConfigurationInterceptors() ?? []
-    )
-  }
-
-  public func makeTunnelStartCall(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions? = nil
-  ) -> GRPCAsyncUnaryCall<Burrow_Empty, Burrow_Empty> {
-    return self.makeAsyncUnaryCall(
-      path: Burrow_TunnelClientMetadata.Methods.tunnelStart.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeTunnelStartInterceptors() ?? []
-    )
-  }
-
-  public func makeTunnelStopCall(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions? = nil
-  ) -> GRPCAsyncUnaryCall<Burrow_Empty, Burrow_Empty> {
-    return self.makeAsyncUnaryCall(
-      path: Burrow_TunnelClientMetadata.Methods.tunnelStop.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeTunnelStopInterceptors() ?? []
-    )
-  }
-
-  public func makeTunnelStatusCall(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions? = nil
-  ) -> GRPCAsyncServerStreamingCall<Burrow_Empty, Burrow_TunnelStatusResponse> {
-    return self.makeAsyncServerStreamingCall(
-      path: Burrow_TunnelClientMetadata.Methods.tunnelStatus.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeTunnelStatusInterceptors() ?? []
-    )
-  }
-}
-
-@available(macOS 10.15, iOS 13, tvOS 13, watchOS 6, *)
-extension Burrow_TunnelAsyncClientProtocol {
-  public func tunnelConfiguration(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions? = nil
-  ) -> GRPCAsyncResponseStream<Burrow_TunnelConfigurationResponse> {
-    return self.performAsyncServerStreamingCall(
-      path: Burrow_TunnelClientMetadata.Methods.tunnelConfiguration.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeTunnelConfigurationInterceptors() ?? []
-    )
-  }
-
-  public func tunnelStart(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions? = nil
-  ) async throws -> Burrow_Empty {
-    return try await self.performAsyncUnaryCall(
-      path: Burrow_TunnelClientMetadata.Methods.tunnelStart.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeTunnelStartInterceptors() ?? []
-    )
-  }
-
-  public func tunnelStop(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions? = nil
-  ) async throws -> Burrow_Empty {
-    return try await self.performAsyncUnaryCall(
-      path: Burrow_TunnelClientMetadata.Methods.tunnelStop.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeTunnelStopInterceptors() ?? []
-    )
-  }
-
-  public func tunnelStatus(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions? = nil
-  ) -> GRPCAsyncResponseStream<Burrow_TunnelStatusResponse> {
-    return self.performAsyncServerStreamingCall(
-      path: Burrow_TunnelClientMetadata.Methods.tunnelStatus.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeTunnelStatusInterceptors() ?? []
-    )
-  }
-}
-
-@available(macOS 10.15, iOS 13, tvOS 13, watchOS 6, *)
-public struct Burrow_TunnelAsyncClient: Burrow_TunnelAsyncClientProtocol {
-  public var channel: GRPCChannel
-  public var defaultCallOptions: CallOptions
-  public var interceptors: Burrow_TunnelClientInterceptorFactoryProtocol?
-
-  public init(
-    channel: GRPCChannel,
-    defaultCallOptions: CallOptions = CallOptions(),
-    interceptors: Burrow_TunnelClientInterceptorFactoryProtocol? = nil
-  ) {
-    self.channel = channel
-    self.defaultCallOptions = defaultCallOptions
-    self.interceptors = interceptors
-  }
-}
-
-public protocol Burrow_TunnelClientInterceptorFactoryProtocol: Sendable {
-
-  /// - Returns: Interceptors to use when invoking 'tunnelConfiguration'.
-  func makeTunnelConfigurationInterceptors() -> [ClientInterceptor<Burrow_Empty, Burrow_TunnelConfigurationResponse>]
-
-  /// - Returns: Interceptors to use when invoking 'tunnelStart'.
-  func makeTunnelStartInterceptors() -> [ClientInterceptor<Burrow_Empty, Burrow_Empty>]
-
-  /// - Returns: Interceptors to use when invoking 'tunnelStop'.
-  func makeTunnelStopInterceptors() -> [ClientInterceptor<Burrow_Empty, Burrow_Empty>]
-
-  /// - Returns: Interceptors to use when invoking 'tunnelStatus'.
-  func makeTunnelStatusInterceptors() -> [ClientInterceptor<Burrow_Empty, Burrow_TunnelStatusResponse>]
-}
-
-public enum Burrow_TunnelClientMetadata {
-  public static let serviceDescriptor = GRPCServiceDescriptor(
-    name: "Tunnel",
-    fullName: "burrow.Tunnel",
-    methods: [
-      Burrow_TunnelClientMetadata.Methods.tunnelConfiguration,
-      Burrow_TunnelClientMetadata.Methods.tunnelStart,
-      Burrow_TunnelClientMetadata.Methods.tunnelStop,
-      Burrow_TunnelClientMetadata.Methods.tunnelStatus,
-    ]
-  )
-
-  public enum Methods {
-    public static let tunnelConfiguration = GRPCMethodDescriptor(
-      name: "TunnelConfiguration",
-      path: "/burrow.Tunnel/TunnelConfiguration",
-      type: GRPCCallType.serverStreaming
-    )
-
-    public static let tunnelStart = GRPCMethodDescriptor(
-      name: "TunnelStart",
-      path: "/burrow.Tunnel/TunnelStart",
-      type: GRPCCallType.unary
-    )
-
-    public static let tunnelStop = GRPCMethodDescriptor(
-      name: "TunnelStop",
-      path: "/burrow.Tunnel/TunnelStop",
-      type: GRPCCallType.unary
-    )
-
-    public static let tunnelStatus = GRPCMethodDescriptor(
-      name: "TunnelStatus",
-      path: "/burrow.Tunnel/TunnelStatus",
-      type: GRPCCallType.serverStreaming
-    )
-  }
-}
-
-/// Usage: instantiate `Burrow_NetworksClient`, then call methods of this protocol to make API calls.
-public protocol Burrow_NetworksClientProtocol: GRPCClient {
-  var serviceName: String { get }
-  var interceptors: Burrow_NetworksClientInterceptorFactoryProtocol? { get }
-
-  func networkAdd(
-    _ request: Burrow_Network,
-    callOptions: CallOptions?
-  ) -> UnaryCall<Burrow_Network, Burrow_Empty>
-
-  func networkList(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions?,
-    handler: @escaping (Burrow_NetworkListResponse) -> Void
-  ) -> ServerStreamingCall<Burrow_Empty, Burrow_NetworkListResponse>
-
-  func networkReorder(
-    _ request: Burrow_NetworkReorderRequest,
-    callOptions: CallOptions?
-  ) -> UnaryCall<Burrow_NetworkReorderRequest, Burrow_Empty>
-
-  func networkDelete(
-    _ request: Burrow_NetworkDeleteRequest,
-    callOptions: CallOptions?
-  ) -> UnaryCall<Burrow_NetworkDeleteRequest, Burrow_Empty>
-}
-
-extension Burrow_NetworksClientProtocol {
-  public var serviceName: String {
-    return "burrow.Networks"
-  }
-
-  /// Unary call to NetworkAdd
-  ///
-  /// - Parameters:
-  ///   - request: Request to send to NetworkAdd.
-  ///   - callOptions: Call options.
-  /// - Returns: A `UnaryCall` with futures for the metadata, status and response.
-  public func networkAdd(
-    _ request: Burrow_Network,
-    callOptions: CallOptions? = nil
-  ) -> UnaryCall<Burrow_Network, Burrow_Empty> {
-    return self.makeUnaryCall(
-      path: Burrow_NetworksClientMetadata.Methods.networkAdd.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeNetworkAddInterceptors() ?? []
-    )
-  }
-
-  /// Server streaming call to NetworkList
-  ///
-  /// - Parameters:
-  ///   - request: Request to send to NetworkList.
-  ///   - callOptions: Call options.
-  ///   - handler: A closure called when each response is received from the server.
-  /// - Returns: A `ServerStreamingCall` with futures for the metadata and status.
-  public func networkList(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions? = nil,
-    handler: @escaping (Burrow_NetworkListResponse) -> Void
-  ) -> ServerStreamingCall<Burrow_Empty, Burrow_NetworkListResponse> {
-    return self.makeServerStreamingCall(
-      path: Burrow_NetworksClientMetadata.Methods.networkList.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeNetworkListInterceptors() ?? [],
-      handler: handler
-    )
-  }
-
-  /// Unary call to NetworkReorder
-  ///
-  /// - Parameters:
-  ///   - request: Request to send to NetworkReorder.
-  ///   - callOptions: Call options.
-  /// - Returns: A `UnaryCall` with futures for the metadata, status and response.
-  public func networkReorder(
-    _ request: Burrow_NetworkReorderRequest,
-    callOptions: CallOptions? = nil
-  ) -> UnaryCall<Burrow_NetworkReorderRequest, Burrow_Empty> {
-    return self.makeUnaryCall(
-      path: Burrow_NetworksClientMetadata.Methods.networkReorder.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeNetworkReorderInterceptors() ?? []
-    )
-  }
-
-  /// Unary call to NetworkDelete
-  ///
-  /// - Parameters:
-  ///   - request: Request to send to NetworkDelete.
-  ///   - callOptions: Call options.
-  /// - Returns: A `UnaryCall` with futures for the metadata, status and response.
-  public func networkDelete(
-    _ request: Burrow_NetworkDeleteRequest,
-    callOptions: CallOptions? = nil
-  ) -> UnaryCall<Burrow_NetworkDeleteRequest, Burrow_Empty> {
-    return self.makeUnaryCall(
-      path: Burrow_NetworksClientMetadata.Methods.networkDelete.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeNetworkDeleteInterceptors() ?? []
-    )
-  }
-}
-
-@available(*, deprecated)
-extension Burrow_NetworksClient: @unchecked Sendable {}
-
-@available(*, deprecated, renamed: "Burrow_NetworksNIOClient")
-public final class Burrow_NetworksClient: Burrow_NetworksClientProtocol {
-  private let lock = Lock()
-  private var _defaultCallOptions: CallOptions
-  private var _interceptors: Burrow_NetworksClientInterceptorFactoryProtocol?
-  public let channel: GRPCChannel
-  public var defaultCallOptions: CallOptions {
-    get { self.lock.withLock { return self._defaultCallOptions } }
-    set { self.lock.withLockVoid { self._defaultCallOptions = newValue } }
-  }
-  public var interceptors: Burrow_NetworksClientInterceptorFactoryProtocol? {
-    get { self.lock.withLock { return self._interceptors } }
-    set { self.lock.withLockVoid { self._interceptors = newValue } }
-  }
-
-  /// Creates a client for the burrow.Networks service.
-  ///
-  /// - Parameters:
-  ///   - channel: `GRPCChannel` to the service host.
-  ///   - defaultCallOptions: Options to use for each service call if the user doesn't provide them.
-  ///   - interceptors: A factory providing interceptors for each RPC.
-  public init(
-    channel: GRPCChannel,
-    defaultCallOptions: CallOptions = CallOptions(),
-    interceptors: Burrow_NetworksClientInterceptorFactoryProtocol? = nil
-  ) {
-    self.channel = channel
-    self._defaultCallOptions = defaultCallOptions
-    self._interceptors = interceptors
-  }
-}
-
-public struct Burrow_NetworksNIOClient: Burrow_NetworksClientProtocol {
-  public var channel: GRPCChannel
-  public var defaultCallOptions: CallOptions
-  public var interceptors: Burrow_NetworksClientInterceptorFactoryProtocol?
-
-  /// Creates a client for the burrow.Networks service.
-  ///
-  /// - Parameters:
-  ///   - channel: `GRPCChannel` to the service host.
-  ///   - defaultCallOptions: Options to use for each service call if the user doesn't provide them.
-  ///   - interceptors: A factory providing interceptors for each RPC.
-  public init(
-    channel: GRPCChannel,
-    defaultCallOptions: CallOptions = CallOptions(),
-    interceptors: Burrow_NetworksClientInterceptorFactoryProtocol? = nil
-  ) {
-    self.channel = channel
-    self.defaultCallOptions = defaultCallOptions
-    self.interceptors = interceptors
-  }
-}
-
-@available(macOS 10.15, iOS 13, tvOS 13, watchOS 6, *)
-public protocol Burrow_NetworksAsyncClientProtocol: GRPCClient {
-  static var serviceDescriptor: GRPCServiceDescriptor { get }
-  var interceptors: Burrow_NetworksClientInterceptorFactoryProtocol? { get }
-
-  func makeNetworkAddCall(
-    _ request: Burrow_Network,
-    callOptions: CallOptions?
-  ) -> GRPCAsyncUnaryCall<Burrow_Network, Burrow_Empty>
-
-  func makeNetworkListCall(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions?
-  ) -> GRPCAsyncServerStreamingCall<Burrow_Empty, Burrow_NetworkListResponse>
-
-  func makeNetworkReorderCall(
-    _ request: Burrow_NetworkReorderRequest,
-    callOptions: CallOptions?
-  ) -> GRPCAsyncUnaryCall<Burrow_NetworkReorderRequest, Burrow_Empty>
-
-  func makeNetworkDeleteCall(
-    _ request: Burrow_NetworkDeleteRequest,
-    callOptions: CallOptions?
-  ) -> GRPCAsyncUnaryCall<Burrow_NetworkDeleteRequest, Burrow_Empty>
-}
-
-@available(macOS 10.15, iOS 13, tvOS 13, watchOS 6, *)
-extension Burrow_NetworksAsyncClientProtocol {
-  public static var serviceDescriptor: GRPCServiceDescriptor {
-    return Burrow_NetworksClientMetadata.serviceDescriptor
-  }
-
-  public var interceptors: Burrow_NetworksClientInterceptorFactoryProtocol? {
-    return nil
-  }
-
-  public func makeNetworkAddCall(
-    _ request: Burrow_Network,
-    callOptions: CallOptions? = nil
-  ) -> GRPCAsyncUnaryCall<Burrow_Network, Burrow_Empty> {
-    return self.makeAsyncUnaryCall(
-      path: Burrow_NetworksClientMetadata.Methods.networkAdd.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeNetworkAddInterceptors() ?? []
-    )
-  }
-
-  public func makeNetworkListCall(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions? = nil
-  ) -> GRPCAsyncServerStreamingCall<Burrow_Empty, Burrow_NetworkListResponse> {
-    return self.makeAsyncServerStreamingCall(
-      path: Burrow_NetworksClientMetadata.Methods.networkList.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeNetworkListInterceptors() ?? []
-    )
-  }
-
-  public func makeNetworkReorderCall(
-    _ request: Burrow_NetworkReorderRequest,
-    callOptions: CallOptions? = nil
-  ) -> GRPCAsyncUnaryCall<Burrow_NetworkReorderRequest, Burrow_Empty> {
-    return self.makeAsyncUnaryCall(
-      path: Burrow_NetworksClientMetadata.Methods.networkReorder.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeNetworkReorderInterceptors() ?? []
-    )
-  }
-
-  public func makeNetworkDeleteCall(
-    _ request: Burrow_NetworkDeleteRequest,
-    callOptions: CallOptions? = nil
-  ) -> GRPCAsyncUnaryCall<Burrow_NetworkDeleteRequest, Burrow_Empty> {
-    return self.makeAsyncUnaryCall(
-      path: Burrow_NetworksClientMetadata.Methods.networkDelete.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeNetworkDeleteInterceptors() ?? []
-    )
-  }
-}
-
-@available(macOS 10.15, iOS 13, tvOS 13, watchOS 6, *)
-extension Burrow_NetworksAsyncClientProtocol {
-  public func networkAdd(
-    _ request: Burrow_Network,
-    callOptions: CallOptions? = nil
-  ) async throws -> Burrow_Empty {
-    return try await self.performAsyncUnaryCall(
-      path: Burrow_NetworksClientMetadata.Methods.networkAdd.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeNetworkAddInterceptors() ?? []
-    )
-  }
-
-  public func networkList(
-    _ request: Burrow_Empty,
-    callOptions: CallOptions? = nil
-  ) -> GRPCAsyncResponseStream<Burrow_NetworkListResponse> {
-    return self.performAsyncServerStreamingCall(
-      path: Burrow_NetworksClientMetadata.Methods.networkList.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeNetworkListInterceptors() ?? []
-    )
-  }
-
-  public func networkReorder(
-    _ request: Burrow_NetworkReorderRequest,
-    callOptions: CallOptions? = nil
-  ) async throws -> Burrow_Empty {
-    return try await self.performAsyncUnaryCall(
-      path: Burrow_NetworksClientMetadata.Methods.networkReorder.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeNetworkReorderInterceptors() ?? []
-    )
-  }
-
-  public func networkDelete(
-    _ request: Burrow_NetworkDeleteRequest,
-    callOptions: CallOptions? = nil
-  ) async throws -> Burrow_Empty {
-    return try await self.performAsyncUnaryCall(
-      path: Burrow_NetworksClientMetadata.Methods.networkDelete.path,
-      request: request,
-      callOptions: callOptions ?? self.defaultCallOptions,
-      interceptors: self.interceptors?.makeNetworkDeleteInterceptors() ?? []
-    )
-  }
-}
-
-@available(macOS 10.15, iOS 13, tvOS 13, watchOS 6, *)
-public struct Burrow_NetworksAsyncClient: Burrow_NetworksAsyncClientProtocol {
-  public var channel: GRPCChannel
-  public var defaultCallOptions: CallOptions
-  public var interceptors: Burrow_NetworksClientInterceptorFactoryProtocol?
-
-  public init(
-    channel: GRPCChannel,
-    defaultCallOptions: CallOptions = CallOptions(),
-    interceptors: Burrow_NetworksClientInterceptorFactoryProtocol? = nil
-  ) {
-    self.channel = channel
-    self.defaultCallOptions = defaultCallOptions
-    self.interceptors = interceptors
-  }
-}
-
-public protocol Burrow_NetworksClientInterceptorFactoryProtocol: Sendable {
-
-  /// - Returns: Interceptors to use when invoking 'networkAdd'.
-  func makeNetworkAddInterceptors() -> [ClientInterceptor<Burrow_Network, Burrow_Empty>]
-
-  /// - Returns: Interceptors to use when invoking 'networkList'.
-  func makeNetworkListInterceptors() -> [ClientInterceptor<Burrow_Empty, Burrow_NetworkListResponse>]
-
-  /// - Returns: Interceptors to use when invoking 'networkReorder'.
-  func makeNetworkReorderInterceptors() -> [ClientInterceptor<Burrow_NetworkReorderRequest, Burrow_Empty>]
-
-  /// - Returns: Interceptors to use when invoking 'networkDelete'.
-  func makeNetworkDeleteInterceptors() -> [ClientInterceptor<Burrow_NetworkDeleteRequest, Burrow_Empty>]
-}
-
-public enum Burrow_NetworksClientMetadata {
-  public static let serviceDescriptor = GRPCServiceDescriptor(
-    name: "Networks",
-    fullName: "burrow.Networks",
-    methods: [
-      Burrow_NetworksClientMetadata.Methods.networkAdd,
-      Burrow_NetworksClientMetadata.Methods.networkList,
-      Burrow_NetworksClientMetadata.Methods.networkReorder,
-      Burrow_NetworksClientMetadata.Methods.networkDelete,
-    ]
-  )
-
-  public enum Methods {
-    public static let networkAdd = GRPCMethodDescriptor(
-      name: "NetworkAdd",
-      path: "/burrow.Networks/NetworkAdd",
-      type: GRPCCallType.unary
-    )
-
-    public static let networkList = GRPCMethodDescriptor(
-      name: "NetworkList",
-      path: "/burrow.Networks/NetworkList",
-      type: GRPCCallType.serverStreaming
-    )
-
-    public static let networkReorder = GRPCMethodDescriptor(
-      name: "NetworkReorder",
-      path: "/burrow.Networks/NetworkReorder",
-      type: GRPCCallType.unary
-    )
-
-    public static let networkDelete = GRPCMethodDescriptor(
-      name: "NetworkDelete",
-      path: "/burrow.Networks/NetworkDelete",
-      type: GRPCCallType.unary
-    )
-  }
-}
-
diff --git a/Apple/Core/Client/Generated/burrow.pb.swift b/Apple/Core/Client/Generated/burrow.pb.swift
deleted file mode 100644
index fccd769..0000000
--- a/Apple/Core/Client/Generated/burrow.pb.swift
+++ /dev/null
@@ -1,598 +0,0 @@
-// DO NOT EDIT.
-// swift-format-ignore-file
-// swiftlint:disable all
-//
-// Generated by the Swift generator plugin for the protocol buffer compiler.
-// Source: burrow.proto
-//
-// For information on using the generated types, please see the documentation:
-//   https://github.com/apple/swift-protobuf/
-
-import Foundation
-import SwiftProtobuf
-
-// If the compiler emits an error on this type, it is because this file
-// was generated by a version of the `protoc` Swift plug-in that is
-// incompatible with the version of SwiftProtobuf to which you are linking.
-// Please ensure that you are building against the same version of the API
-// that was used to generate this file.
-fileprivate struct _GeneratedWithProtocGenSwiftVersion: SwiftProtobuf.ProtobufAPIVersionCheck {
-  struct _2: SwiftProtobuf.ProtobufAPIVersion_2 {}
-  typealias Version = _2
-}
-
-public enum Burrow_NetworkType: SwiftProtobuf.Enum, Swift.CaseIterable {
-  public typealias RawValue = Int
-  case wireGuard // = 0
-  case tailnet // = 1
-  case UNRECOGNIZED(Int)
-
-  public init() {
-    self = .wireGuard
-  }
-
-  public init?(rawValue: Int) {
-    switch rawValue {
-    case 0: self = .wireGuard
-    case 1: self = .tailnet
-    default: self = .UNRECOGNIZED(rawValue)
-    }
-  }
-
-  public var rawValue: Int {
-    switch self {
-    case .wireGuard: return 0
-    case .tailnet: return 1
-    case .UNRECOGNIZED(let i): return i
-    }
-  }
-
-  // The compiler won't synthesize support with the UNRECOGNIZED case.
-  public static let allCases: [Burrow_NetworkType] = [
-    .wireGuard,
-    .tailnet,
-  ]
-
-}
-
-public enum Burrow_State: SwiftProtobuf.Enum, Swift.CaseIterable {
-  public typealias RawValue = Int
-  case stopped // = 0
-  case running // = 1
-  case UNRECOGNIZED(Int)
-
-  public init() {
-    self = .stopped
-  }
-
-  public init?(rawValue: Int) {
-    switch rawValue {
-    case 0: self = .stopped
-    case 1: self = .running
-    default: self = .UNRECOGNIZED(rawValue)
-    }
-  }
-
-  public var rawValue: Int {
-    switch self {
-    case .stopped: return 0
-    case .running: return 1
-    case .UNRECOGNIZED(let i): return i
-    }
-  }
-
-  // The compiler won't synthesize support with the UNRECOGNIZED case.
-  public static let allCases: [Burrow_State] = [
-    .stopped,
-    .running,
-  ]
-
-}
-
-public struct Burrow_NetworkReorderRequest: Sendable {
-  // SwiftProtobuf.Message conformance is added in an extension below. See the
-  // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
-  // methods supported on all messages.
-
-  public var id: Int32 = 0
-
-  public var index: Int32 = 0
-
-  public var unknownFields = SwiftProtobuf.UnknownStorage()
-
-  public init() {}
-}
-
-public struct Burrow_WireGuardPeer: Sendable {
-  // SwiftProtobuf.Message conformance is added in an extension below. See the
-  // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
-  // methods supported on all messages.
-
-  public var endpoint: String = String()
-
-  public var subnet: [String] = []
-
-  public var unknownFields = SwiftProtobuf.UnknownStorage()
-
-  public init() {}
-}
-
-public struct Burrow_WireGuardNetwork: Sendable {
-  // SwiftProtobuf.Message conformance is added in an extension below. See the
-  // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
-  // methods supported on all messages.
-
-  public var address: String = String()
-
-  public var dns: String = String()
-
-  public var peer: [Burrow_WireGuardPeer] = []
-
-  public var unknownFields = SwiftProtobuf.UnknownStorage()
-
-  public init() {}
-}
-
-public struct Burrow_NetworkDeleteRequest: Sendable {
-  // SwiftProtobuf.Message conformance is added in an extension below. See the
-  // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
-  // methods supported on all messages.
-
-  public var id: Int32 = 0
-
-  public var unknownFields = SwiftProtobuf.UnknownStorage()
-
-  public init() {}
-}
-
-public struct Burrow_Network: @unchecked Sendable {
-  // SwiftProtobuf.Message conformance is added in an extension below. See the
-  // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
-  // methods supported on all messages.
-
-  public var id: Int32 = 0
-
-  public var type: Burrow_NetworkType = .wireGuard
-
-  public var payload: Data = Data()
-
-  public var unknownFields = SwiftProtobuf.UnknownStorage()
-
-  public init() {}
-}
-
-public struct Burrow_NetworkListResponse: Sendable {
-  // SwiftProtobuf.Message conformance is added in an extension below. See the
-  // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
-  // methods supported on all messages.
-
-  public var network: [Burrow_Network] = []
-
-  public var unknownFields = SwiftProtobuf.UnknownStorage()
-
-  public init() {}
-}
-
-public struct Burrow_Empty: Sendable {
-  // SwiftProtobuf.Message conformance is added in an extension below. See the
-  // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
-  // methods supported on all messages.
-
-  public var unknownFields = SwiftProtobuf.UnknownStorage()
-
-  public init() {}
-}
-
-public struct Burrow_TunnelStatusResponse: Sendable {
-  // SwiftProtobuf.Message conformance is added in an extension below. See the
-  // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
-  // methods supported on all messages.
-
-  public var state: Burrow_State = .stopped
-
-  public var start: SwiftProtobuf.Google_Protobuf_Timestamp {
-    get {return _start ?? SwiftProtobuf.Google_Protobuf_Timestamp()}
-    set {_start = newValue}
-  }
-  /// Returns true if `start` has been explicitly set.
-  public var hasStart: Bool {return self._start != nil}
-  /// Clears the value of `start`. Subsequent reads from it will return its default value.
-  public mutating func clearStart() {self._start = nil}
-
-  public var unknownFields = SwiftProtobuf.UnknownStorage()
-
-  public init() {}
-
-  fileprivate var _start: SwiftProtobuf.Google_Protobuf_Timestamp? = nil
-}
-
-public struct Burrow_TunnelConfigurationResponse: Sendable {
-  // SwiftProtobuf.Message conformance is added in an extension below. See the
-  // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
-  // methods supported on all messages.
-
-  public var addresses: [String] = []
-
-  public var mtu: Int32 = 0
-
-  public var routes: [String] = []
-
-  public var dnsServers: [String] = []
-
-  public var searchDomains: [String] = []
-
-  public var includeDefaultRoute: Bool = false
-
-  public var unknownFields = SwiftProtobuf.UnknownStorage()
-
-  public init() {}
-}
-
-// MARK: - Code below here is support for the SwiftProtobuf runtime.
-
-fileprivate let _protobuf_package = "burrow"
-
-extension Burrow_NetworkType: SwiftProtobuf._ProtoNameProviding {
-  public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-    0: .same(proto: "WireGuard"),
-    1: .same(proto: "Tailnet"),
-  ]
-}
-
-extension Burrow_State: SwiftProtobuf._ProtoNameProviding {
-  public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-    0: .same(proto: "Stopped"),
-    1: .same(proto: "Running"),
-  ]
-}
-
-extension Burrow_NetworkReorderRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
-  public static let protoMessageName: String = _protobuf_package + ".NetworkReorderRequest"
-  public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-    1: .same(proto: "id"),
-    2: .same(proto: "index"),
-  ]
-
-  public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
-    while let fieldNumber = try decoder.nextFieldNumber() {
-      // The use of inline closures is to circumvent an issue where the compiler
-      // allocates stack space for every case branch when no optimizations are
-      // enabled. https://github.com/apple/swift-protobuf/issues/1034
-      switch fieldNumber {
-      case 1: try { try decoder.decodeSingularInt32Field(value: &self.id) }()
-      case 2: try { try decoder.decodeSingularInt32Field(value: &self.index) }()
-      default: break
-      }
-    }
-  }
-
-  public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
-    if self.id != 0 {
-      try visitor.visitSingularInt32Field(value: self.id, fieldNumber: 1)
-    }
-    if self.index != 0 {
-      try visitor.visitSingularInt32Field(value: self.index, fieldNumber: 2)
-    }
-    try unknownFields.traverse(visitor: &visitor)
-  }
-
-  public static func ==(lhs: Burrow_NetworkReorderRequest, rhs: Burrow_NetworkReorderRequest) -> Bool {
-    if lhs.id != rhs.id {return false}
-    if lhs.index != rhs.index {return false}
-    if lhs.unknownFields != rhs.unknownFields {return false}
-    return true
-  }
-}
-
-extension Burrow_WireGuardPeer: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
-  public static let protoMessageName: String = _protobuf_package + ".WireGuardPeer"
-  public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-    1: .same(proto: "endpoint"),
-    2: .same(proto: "subnet"),
-  ]
-
-  public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
-    while let fieldNumber = try decoder.nextFieldNumber() {
-      // The use of inline closures is to circumvent an issue where the compiler
-      // allocates stack space for every case branch when no optimizations are
-      // enabled. https://github.com/apple/swift-protobuf/issues/1034
-      switch fieldNumber {
-      case 1: try { try decoder.decodeSingularStringField(value: &self.endpoint) }()
-      case 2: try { try decoder.decodeRepeatedStringField(value: &self.subnet) }()
-      default: break
-      }
-    }
-  }
-
-  public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
-    if !self.endpoint.isEmpty {
-      try visitor.visitSingularStringField(value: self.endpoint, fieldNumber: 1)
-    }
-    if !self.subnet.isEmpty {
-      try visitor.visitRepeatedStringField(value: self.subnet, fieldNumber: 2)
-    }
-    try unknownFields.traverse(visitor: &visitor)
-  }
-
-  public static func ==(lhs: Burrow_WireGuardPeer, rhs: Burrow_WireGuardPeer) -> Bool {
-    if lhs.endpoint != rhs.endpoint {return false}
-    if lhs.subnet != rhs.subnet {return false}
-    if lhs.unknownFields != rhs.unknownFields {return false}
-    return true
-  }
-}
-
-extension Burrow_WireGuardNetwork: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
-  public static let protoMessageName: String = _protobuf_package + ".WireGuardNetwork"
-  public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-    1: .same(proto: "address"),
-    2: .same(proto: "dns"),
-    3: .same(proto: "peer"),
-  ]
-
-  public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
-    while let fieldNumber = try decoder.nextFieldNumber() {
-      // The use of inline closures is to circumvent an issue where the compiler
-      // allocates stack space for every case branch when no optimizations are
-      // enabled. https://github.com/apple/swift-protobuf/issues/1034
-      switch fieldNumber {
-      case 1: try { try decoder.decodeSingularStringField(value: &self.address) }()
-      case 2: try { try decoder.decodeSingularStringField(value: &self.dns) }()
-      case 3: try { try decoder.decodeRepeatedMessageField(value: &self.peer) }()
-      default: break
-      }
-    }
-  }
-
-  public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
-    if !self.address.isEmpty {
-      try visitor.visitSingularStringField(value: self.address, fieldNumber: 1)
-    }
-    if !self.dns.isEmpty {
-      try visitor.visitSingularStringField(value: self.dns, fieldNumber: 2)
-    }
-    if !self.peer.isEmpty {
-      try visitor.visitRepeatedMessageField(value: self.peer, fieldNumber: 3)
-    }
-    try unknownFields.traverse(visitor: &visitor)
-  }
-
-  public static func ==(lhs: Burrow_WireGuardNetwork, rhs: Burrow_WireGuardNetwork) -> Bool {
-    if lhs.address != rhs.address {return false}
-    if lhs.dns != rhs.dns {return false}
-    if lhs.peer != rhs.peer {return false}
-    if lhs.unknownFields != rhs.unknownFields {return false}
-    return true
-  }
-}
-
-extension Burrow_NetworkDeleteRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
-  public static let protoMessageName: String = _protobuf_package + ".NetworkDeleteRequest"
-  public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-    1: .same(proto: "id"),
-  ]
-
-  public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
-    while let fieldNumber = try decoder.nextFieldNumber() {
-      // The use of inline closures is to circumvent an issue where the compiler
-      // allocates stack space for every case branch when no optimizations are
-      // enabled. https://github.com/apple/swift-protobuf/issues/1034
-      switch fieldNumber {
-      case 1: try { try decoder.decodeSingularInt32Field(value: &self.id) }()
-      default: break
-      }
-    }
-  }
-
-  public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
-    if self.id != 0 {
-      try visitor.visitSingularInt32Field(value: self.id, fieldNumber: 1)
-    }
-    try unknownFields.traverse(visitor: &visitor)
-  }
-
-  public static func ==(lhs: Burrow_NetworkDeleteRequest, rhs: Burrow_NetworkDeleteRequest) -> Bool {
-    if lhs.id != rhs.id {return false}
-    if lhs.unknownFields != rhs.unknownFields {return false}
-    return true
-  }
-}
-
-extension Burrow_Network: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
-  public static let protoMessageName: String = _protobuf_package + ".Network"
-  public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-    1: .same(proto: "id"),
-    2: .same(proto: "type"),
-    3: .same(proto: "payload"),
-  ]
-
-  public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
-    while let fieldNumber = try decoder.nextFieldNumber() {
-      // The use of inline closures is to circumvent an issue where the compiler
-      // allocates stack space for every case branch when no optimizations are
-      // enabled. https://github.com/apple/swift-protobuf/issues/1034
-      switch fieldNumber {
-      case 1: try { try decoder.decodeSingularInt32Field(value: &self.id) }()
-      case 2: try { try decoder.decodeSingularEnumField(value: &self.type) }()
-      case 3: try { try decoder.decodeSingularBytesField(value: &self.payload) }()
-      default: break
-      }
-    }
-  }
-
-  public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
-    if self.id != 0 {
-      try visitor.visitSingularInt32Field(value: self.id, fieldNumber: 1)
-    }
-    if self.type != .wireGuard {
-      try visitor.visitSingularEnumField(value: self.type, fieldNumber: 2)
-    }
-    if !self.payload.isEmpty {
-      try visitor.visitSingularBytesField(value: self.payload, fieldNumber: 3)
-    }
-    try unknownFields.traverse(visitor: &visitor)
-  }
-
-  public static func ==(lhs: Burrow_Network, rhs: Burrow_Network) -> Bool {
-    if lhs.id != rhs.id {return false}
-    if lhs.type != rhs.type {return false}
-    if lhs.payload != rhs.payload {return false}
-    if lhs.unknownFields != rhs.unknownFields {return false}
-    return true
-  }
-}
-
-extension Burrow_NetworkListResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
-  public static let protoMessageName: String = _protobuf_package + ".NetworkListResponse"
-  public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-    1: .same(proto: "network"),
-  ]
-
-  public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
-    while let fieldNumber = try decoder.nextFieldNumber() {
-      // The use of inline closures is to circumvent an issue where the compiler
-      // allocates stack space for every case branch when no optimizations are
-      // enabled. https://github.com/apple/swift-protobuf/issues/1034
-      switch fieldNumber {
-      case 1: try { try decoder.decodeRepeatedMessageField(value: &self.network) }()
-      default: break
-      }
-    }
-  }
-
-  public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
-    if !self.network.isEmpty {
-      try visitor.visitRepeatedMessageField(value: self.network, fieldNumber: 1)
-    }
-    try unknownFields.traverse(visitor: &visitor)
-  }
-
-  public static func ==(lhs: Burrow_NetworkListResponse, rhs: Burrow_NetworkListResponse) -> Bool {
-    if lhs.network != rhs.network {return false}
-    if lhs.unknownFields != rhs.unknownFields {return false}
-    return true
-  }
-}
-
-extension Burrow_Empty: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
-  public static let protoMessageName: String = _protobuf_package + ".Empty"
-  public static let _protobuf_nameMap = SwiftProtobuf._NameMap()
-
-  public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
-    // Load everything into unknown fields
-    while try decoder.nextFieldNumber() != nil {}
-  }
-
-  public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
-    try unknownFields.traverse(visitor: &visitor)
-  }
-
-  public static func ==(lhs: Burrow_Empty, rhs: Burrow_Empty) -> Bool {
-    if lhs.unknownFields != rhs.unknownFields {return false}
-    return true
-  }
-}
-
-extension Burrow_TunnelStatusResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
-  public static let protoMessageName: String = _protobuf_package + ".TunnelStatusResponse"
-  public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-    1: .same(proto: "state"),
-    2: .same(proto: "start"),
-  ]
-
-  public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
-    while let fieldNumber = try decoder.nextFieldNumber() {
-      // The use of inline closures is to circumvent an issue where the compiler
-      // allocates stack space for every case branch when no optimizations are
-      // enabled. https://github.com/apple/swift-protobuf/issues/1034
-      switch fieldNumber {
-      case 1: try { try decoder.decodeSingularEnumField(value: &self.state) }()
-      case 2: try { try decoder.decodeSingularMessageField(value: &self._start) }()
-      default: break
-      }
-    }
-  }
-
-  public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
-    // The use of inline closures is to circumvent an issue where the compiler
-    // allocates stack space for every if/case branch local when no optimizations
-    // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and
-    // https://github.com/apple/swift-protobuf/issues/1182
-    if self.state != .stopped {
-      try visitor.visitSingularEnumField(value: self.state, fieldNumber: 1)
-    }
-    try { if let v = self._start {
-      try visitor.visitSingularMessageField(value: v, fieldNumber: 2)
-    } }()
-    try unknownFields.traverse(visitor: &visitor)
-  }
-
-  public static func ==(lhs: Burrow_TunnelStatusResponse, rhs: Burrow_TunnelStatusResponse) -> Bool {
-    if lhs.state != rhs.state {return false}
-    if lhs._start != rhs._start {return false}
-    if lhs.unknownFields != rhs.unknownFields {return false}
-    return true
-  }
-}
-
-extension Burrow_TunnelConfigurationResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
-  public static let protoMessageName: String = _protobuf_package + ".TunnelConfigurationResponse"
-  public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
-    1: .same(proto: "addresses"),
-    2: .same(proto: "mtu"),
-    3: .same(proto: "routes"),
-    4: .standard(proto: "dns_servers"),
-    5: .standard(proto: "search_domains"),
-    6: .standard(proto: "include_default_route"),
-  ]
-
-  public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
-    while let fieldNumber = try decoder.nextFieldNumber() {
-      // The use of inline closures is to circumvent an issue where the compiler
-      // allocates stack space for every case branch when no optimizations are
-      // enabled. https://github.com/apple/swift-protobuf/issues/1034
-      switch fieldNumber {
-      case 1: try { try decoder.decodeRepeatedStringField(value: &self.addresses) }()
-      case 2: try { try decoder.decodeSingularInt32Field(value: &self.mtu) }()
-      case 3: try { try decoder.decodeRepeatedStringField(value: &self.routes) }()
-      case 4: try { try decoder.decodeRepeatedStringField(value: &self.dnsServers) }()
-      case 5: try { try decoder.decodeRepeatedStringField(value: &self.searchDomains) }()
-      case 6: try { try decoder.decodeSingularBoolField(value: &self.includeDefaultRoute) }()
-      default: break
-      }
-    }
-  }
-
-  public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
-    if !self.addresses.isEmpty {
-      try visitor.visitRepeatedStringField(value: self.addresses, fieldNumber: 1)
-    }
-    if self.mtu != 0 {
-      try visitor.visitSingularInt32Field(value: self.mtu, fieldNumber: 2)
-    }
-    if !self.routes.isEmpty {
-      try visitor.visitRepeatedStringField(value: self.routes, fieldNumber: 3)
-    }
-    if !self.dnsServers.isEmpty {
-      try visitor.visitRepeatedStringField(value: self.dnsServers, fieldNumber: 4)
-    }
-    if !self.searchDomains.isEmpty {
-      try visitor.visitRepeatedStringField(value: self.searchDomains, fieldNumber: 5)
-    }
-    if self.includeDefaultRoute {
-      try visitor.visitSingularBoolField(value: self.includeDefaultRoute, fieldNumber: 6)
-    }
-    try unknownFields.traverse(visitor: &visitor)
-  }
-
-  public static func ==(lhs: Burrow_TunnelConfigurationResponse, rhs: Burrow_TunnelConfigurationResponse) -> Bool {
-    if lhs.addresses != rhs.addresses {return false}
-    if lhs.mtu != rhs.mtu {return false}
-    if lhs.routes != rhs.routes {return false}
-    if lhs.dnsServers != rhs.dnsServers {return false}
-    if lhs.searchDomains != rhs.searchDomains {return false}
-    if lhs.includeDefaultRoute != rhs.includeDefaultRoute {return false}
-    if lhs.unknownFields != rhs.unknownFields {return false}
-    return true
-  }
-}
diff --git a/Apple/Core/Client/burrow.proto b/Apple/Core/Client/burrow.proto
deleted file mode 120000
index 03e86a5..0000000
--- a/Apple/Core/Client/burrow.proto
+++ /dev/null
@@ -1 +0,0 @@
-../../../proto/burrow.proto
\ No newline at end of file
diff --git a/Apple/Core/Client/google/protobuf/timestamp.proto b/Apple/Core/Client/google/protobuf/timestamp.proto
deleted file mode 100644
index 7db2f6a..0000000
--- a/Apple/Core/Client/google/protobuf/timestamp.proto
+++ /dev/null
@@ -1,64 +0,0 @@
-// Protocol Buffers - Google's data interchange format
-// Copyright 2008 Google Inc.  All rights reserved.
-// https://developers.google.com/protocol-buffers/
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//     * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived from
-// this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-syntax = "proto3";
-
-package google.protobuf;
-
-option cc_enable_arenas = true;
-option go_package = "google.golang.org/protobuf/types/known/timestamppb";
-option java_package = "com.google.protobuf";
-option java_outer_classname = "TimestampProto";
-option java_multiple_files = true;
-option objc_class_prefix = "GPB";
-option csharp_namespace = "Google.Protobuf.WellKnownTypes";
-
-// A Timestamp represents a point in time independent of any time zone or local
-// calendar, encoded as a count of seconds and fractions of seconds at
-// nanosecond resolution. The count is relative to an epoch at UTC midnight on
-// January 1, 1970, in the proleptic Gregorian calendar which extends the
-// Gregorian calendar backwards to year one.
-//
-// All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap
-// second table is needed for interpretation, using a 24-hour linear smear.
-//
-// The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By
-// restricting to that range, we ensure that we can convert to and from RFC
-// 3339 date strings.
-message Timestamp {
-  // Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z.
-  // Must be from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z inclusive.
-  int64 seconds = 1;
-
-  // Non-negative fractions of a second at nanosecond resolution. Negative
-  // second values with fractions must still have non-negative nanos values
-  // that count forward in time. Must be from 0 to 999,999,999 inclusive.
-  int32 nanos = 2;
-}
diff --git a/Apple/NetworkExtension/Client.swift b/Apple/NetworkExtension/Client.swift
new file mode 100644
index 0000000..a924c29
--- /dev/null
+++ b/Apple/NetworkExtension/Client.swift
@@ -0,0 +1,60 @@
+import BurrowShared
+import Foundation
+import Network
+
+final class Client {
+    let connection: NWConnection
+
+    private let logger: Logger = Logger.logger(for: Client.self)
+    private var generator = SystemRandomNumberGenerator()
+
+    convenience init() throws {
+        self.init(url: try Constants.socketURL)
+    }
+
+    init(url: URL) {
+        let endpoint: NWEndpoint
+        if url.isFileURL {
+            endpoint = .unix(path: url.path(percentEncoded: false))
+        } else {
+            endpoint = .url(url)
+        }
+
+        let parameters = NWParameters.tcp
+        parameters.defaultProtocolStack
+            .applicationProtocols
+            .insert(NWProtocolFramer.Options(definition: NewlineProtocolFramer.definition), at: 0)
+        connection = NWConnection(to: endpoint, using: parameters)
+        connection.start(queue: .global())
+    }
+
+    func request<U: Decodable>(_ request: any Request, type: U.Type = U.self) async throws -> U {
+        do {
+            var copy = request
+            copy.id = generator.next(upperBound: UInt.max)
+            let content = try JSONEncoder().encode(copy)
+            logger.debug("> \(String(decoding: content, as: UTF8.self))")
+
+            try await self.connection.send(content: content)
+            let (response, _, _) = try await connection.receiveMessage()
+
+            logger.debug("< \(String(decoding: response, as: UTF8.self))")
+            return try JSONDecoder().decode(U.self, from: response)
+        } catch {
+            logger.error("\(error, privacy: .public)")
+            throw error
+        }
+    }
+
+    deinit {
+        connection.cancel()
+    }
+}
+
+extension Constants {
+    static var socketURL: URL {
+        get throws {
+            try groupContainerURL.appending(component: "burrow.sock", directoryHint: .notDirectory)
+        }
+    }
+}
diff --git a/Apple/NetworkExtension/DataTypes.swift b/Apple/NetworkExtension/DataTypes.swift
new file mode 100644
index 0000000..391bfed
--- /dev/null
+++ b/Apple/NetworkExtension/DataTypes.swift
@@ -0,0 +1,61 @@
+import Foundation
+
+// swiftlint:disable identifier_name
+enum BurrowError: Error {
+    case addrDoesntExist
+    case resultIsError
+    case cantParseResult
+    case resultIsNone
+}
+
+protocol Request: Codable where Command: Codable {
+    associatedtype Command
+
+    var id: UInt { get set }
+    var command: Command { get set }
+}
+
+struct BurrowSingleCommand: Request {
+    var id: UInt
+    var command: String
+}
+
+struct BurrowRequest<T>: Request where T: Codable {
+    var id: UInt
+    var command: T
+}
+
+struct BurrowStartRequest: Codable {
+    struct TunOptions: Codable {
+        let name: String?
+        let no_pi: Bool
+        let tun_excl: Bool
+        let tun_retrieve: Bool
+        let address: String?
+    }
+    struct StartOptions: Codable {
+        let tun: TunOptions
+    }
+    let Start: StartOptions
+}
+
+struct Response<T>: Decodable where T: Decodable {
+    var id: UInt
+    var result: T
+}
+
+struct BurrowResult<T>: Codable where T: Codable {
+    var Ok: T?
+    var Err: String?
+}
+
+struct ServerConfigData: Codable {
+    struct InternalConfig: Codable {
+        let address: String?
+        let name: String?
+        let mtu: Int32?
+    }
+    let ServerConfig: InternalConfig
+}
+
+// swiftlint:enable identifier_name
diff --git a/Apple/NetworkExtension/NWConnection+Async.swift b/Apple/NetworkExtension/NWConnection+Async.swift
new file mode 100644
index 0000000..c21fdc0
--- /dev/null
+++ b/Apple/NetworkExtension/NWConnection+Async.swift
@@ -0,0 +1,32 @@
+import Foundation
+import Network
+
+extension NWConnection {
+    // swiftlint:disable:next large_tuple
+    func receiveMessage() async throws -> (Data, NWConnection.ContentContext?, Bool) {
+        try await withUnsafeThrowingContinuation { continuation in
+            receiveMessage { completeContent, contentContext, isComplete, error in
+                if let error {
+                    continuation.resume(throwing: error)
+                } else {
+                    guard let completeContent = completeContent else {
+                        fatalError("Both error and completeContent were nil")
+                    }
+                    continuation.resume(returning: (completeContent, contentContext, isComplete))
+                }
+            }
+        }
+    }
+
+    func send(content: Data) async throws {
+        try await withCheckedThrowingContinuation { (continuation: CheckedContinuation<Void, Error>) in
+            send(content: content, completion: .contentProcessed { error in
+                if let error {
+                    continuation.resume(throwing: error)
+                } else {
+                    continuation.resume(returning: ())
+                }
+            })
+        }
+    }
+}
diff --git a/Apple/NetworkExtension/NewlineProtocolFramer.swift b/Apple/NetworkExtension/NewlineProtocolFramer.swift
new file mode 100644
index 0000000..d2f71e5
--- /dev/null
+++ b/Apple/NetworkExtension/NewlineProtocolFramer.swift
@@ -0,0 +1,54 @@
+import Foundation
+import Network
+
+final class NewlineProtocolFramer: NWProtocolFramerImplementation {
+    private static let delimeter: UInt8 = 10 // `\n`
+
+    static let definition = NWProtocolFramer.Definition(implementation: NewlineProtocolFramer.self)
+    static let label = "Lines"
+
+    init(framer: NWProtocolFramer.Instance) { }
+
+    func start(framer: NWProtocolFramer.Instance) -> NWProtocolFramer.StartResult { .ready }
+    func stop(framer: NWProtocolFramer.Instance) -> Bool { true }
+
+    func wakeup(framer: NWProtocolFramer.Instance) { }
+    func cleanup(framer: NWProtocolFramer.Instance) { }
+
+    func handleInput(framer: NWProtocolFramer.Instance) -> Int {
+        while true {
+            var result: [Data] = []
+            let parsed = framer.parseInput(minimumIncompleteLength: 1, maximumLength: 16_000) { buffer, _ in
+                guard let buffer else { return 0 }
+                var lines = buffer
+                    .split(separator: Self.delimeter, omittingEmptySubsequences: false)
+                    .map { Data($0) }
+                guard lines.count > 1 else { return 0 }
+                _ = lines.popLast()
+
+                result = lines
+                return lines.reduce(lines.count) { $0 + $1.count }
+            }
+
+            guard parsed && !result.isEmpty else { break }
+
+            for line in result {
+                framer.deliverInput(data: line, message: .init(instance: framer), isComplete: true)
+            }
+        }
+        return 0
+    }
+
+    func handleOutput(
+        framer: NWProtocolFramer.Instance,
+        message: NWProtocolFramer.Message,
+        messageLength: Int,
+        isComplete: Bool
+    ) {
+        do {
+            try framer.writeOutputNoCopy(length: messageLength)
+            framer.writeOutput(data: [Self.delimeter])
+        } catch {
+        }
+    }
+}
diff --git a/Apple/NetworkExtension/PacketTunnelProvider.swift b/Apple/NetworkExtension/PacketTunnelProvider.swift
index 3f3d8b4..9231676 100644
--- a/Apple/NetworkExtension/PacketTunnelProvider.swift
+++ b/Apple/NetworkExtension/PacketTunnelProvider.swift
@@ -1,326 +1,58 @@
-import AsyncAlgorithms
-import BurrowConfiguration
-import BurrowCore
-import GRPC
+import BurrowShared
 import libburrow
 import NetworkExtension
 import os
 
-private final class SendableCallbackBox<Callback>: @unchecked Sendable {
-    let callback: Callback
-
-    init(_ callback: Callback) {
-        self.callback = callback
-    }
-}
-
-final class PacketTunnelProvider: NEPacketTunnelProvider, @unchecked Sendable {
-    enum Error: Swift.Error {
-        case missingTunnelConfiguration
-    }
-
+class PacketTunnelProvider: NEPacketTunnelProvider {
     private let logger = Logger.logger(for: PacketTunnelProvider.self)
-    private var packetCall: GRPCAsyncBidirectionalStreamingCall<Burrow_TunnelPacket, Burrow_TunnelPacket>?
-    private var inboundPacketTask: Task<Void, Never>?
-    private var outboundPacketTask: Task<Void, Never>?
 
-    private var client: TunnelClient {
-        get throws { try _client.get() }
-    }
-    private let _client: Result<TunnelClient, Swift.Error> = Result {
-        try TunnelClient.unix(socketURL: Constants.socketURL)
-    }
-
-    override init() {
+    override func startTunnel(options: [String: NSObject]? = nil) async throws {
         do {
-            libburrow.spawnInProcess(
-                socketPath: try Constants.socketURL.path(percentEncoded: false),
-                databasePath: try Constants.databaseURL.path(percentEncoded: false)
-            )
-        } catch {
-            logger.error("Failed to spawn networking thread: \(error)")
-        }
-    }
+            libburrow.spawnInProcess(socketPath: try Constants.socketURL.path)
 
-    override func startTunnel(
-        options: [String: NSObject]?,
-        completionHandler: @escaping (Swift.Error?) -> Void
-    ) {
-        let completion = SendableCallbackBox(completionHandler)
-        Task {
-            do {
-                _ = try await client.tunnelStart(.init())
-                let configuration = try await Array(client.tunnelConfiguration(.init()).prefix(1)).first
-                guard let settings = configuration?.settings else {
-                    throw Error.missingTunnelConfiguration
-                }
-                try await setTunnelNetworkSettings(settings)
-                try startPacketBridge()
-                logger.log("Started tunnel with network settings: \(settings)")
-                completion.callback(nil)
-            } catch {
-                logger.error("Failed to start tunnel: \(error)")
-                stopPacketBridge()
-                completion.callback(error)
+            let client = try Client()
+
+            let command = BurrowRequest(id: 0, command: "ServerConfig")
+            let data = try await client.request(command, type: Response<BurrowResult<ServerConfigData>>.self)
+
+            let encoded = try JSONEncoder().encode(data.result)
+            self.logger.log("Received final data: \(String(decoding: encoded, as: UTF8.self))")
+            guard let serverconfig = data.result.Ok else {
+                throw BurrowError.resultIsError
             }
-        }
-    }
-
-    override func stopTunnel(
-        with reason: NEProviderStopReason,
-        completionHandler: @escaping () -> Void
-    ) {
-        let completion = SendableCallbackBox(completionHandler)
-        Task {
-            stopPacketBridge()
-            do {
-                _ = try await client.tunnelStop(.init())
-                logger.log("Stopped client")
-            } catch {
-                logger.error("Failed to stop tunnel: \(error)")
+            guard let tunNs = generateTunSettings(from: serverconfig) else {
+                throw BurrowError.addrDoesntExist
             }
-            completion.callback()
-        }
-    }
-}
+            try await self.setTunnelNetworkSettings(tunNs)
+            self.logger.info("Set remote tunnel address to \(tunNs.tunnelRemoteAddress)")
 
-extension PacketTunnelProvider {
-    private func startPacketBridge() throws {
-        stopPacketBridge()
-
-        let packetClient = TunnelPacketClient.unix(socketURL: try Constants.socketURL)
-        let call = packetClient.makeTunnelPacketsCall()
-        self.packetCall = call
-
-        inboundPacketTask = Task { [weak self] in
-            guard let self else { return }
-            do {
-                for try await packet in call.responseStream {
-                    let payload = packet.payload
-                    self.packetFlow.writePackets(
-                        [payload],
-                        withProtocols: [Self.protocolNumber(for: payload)]
+            let startRequest = BurrowRequest(
+                id: .random(in: (.min)..<(.max)),
+                command: BurrowStartRequest(
+                    Start: BurrowStartRequest.StartOptions(
+                        tun: BurrowStartRequest.TunOptions(
+                            name: nil, no_pi: false, tun_excl: false, tun_retrieve: true, address: nil
+                        )
                     )
-                }
-            } catch {
-                guard !Task.isCancelled else { return }
-                self.logger.error("Tunnel packet receive loop failed: \(error)")
-            }
-        }
-
-        outboundPacketTask = Task { [weak self] in
-            guard let self else { return }
-            defer { call.requestStream.finish() }
-            do {
-                while !Task.isCancelled {
-                    let packets = await self.readPacketsBatch()
-                    for (payload, _) in packets {
-                        var packet = Burrow_TunnelPacket()
-                        packet.payload = payload
-                        try await call.requestStream.send(packet)
-                    }
-                }
-            } catch {
-                guard !Task.isCancelled else { return }
-                self.logger.error("Tunnel packet send loop failed: \(error)")
-            }
-        }
-    }
-
-    private func stopPacketBridge() {
-        inboundPacketTask?.cancel()
-        inboundPacketTask = nil
-        outboundPacketTask?.cancel()
-        outboundPacketTask = nil
-        packetCall?.cancel()
-        packetCall = nil
-    }
-
-    private func readPacketsBatch() async -> [(Data, NSNumber)] {
-        await withCheckedContinuation { continuation in
-            packetFlow.readPackets { packets, protocols in
-                continuation.resume(returning: Array(zip(packets, protocols)))
-            }
-        }
-    }
-
-    private static func protocolNumber(for payload: Data) -> NSNumber {
-        guard let version = payload.first.map({ $0 >> 4 }) else {
-            return NSNumber(value: AF_INET)
-        }
-        switch version {
-        case 6:
-            return NSNumber(value: AF_INET6)
-        default:
-            return NSNumber(value: AF_INET)
-        }
-    }
-}
-
-extension Burrow_TunnelConfigurationResponse {
-    fileprivate var settings: NEPacketTunnelNetworkSettings {
-        let parsedAddresses = addresses.compactMap(ParsedTunnelAddress.init(rawValue:))
-        let ipv4Addresses = parsedAddresses.compactMap(\.ipv4Address)
-        let ipv6Addresses = parsedAddresses.compactMap(\.ipv6Address)
-        let parsedRoutes = routes.compactMap(ParsedTunnelRoute.init(rawValue:))
-        var ipv4Routes = parsedRoutes.compactMap(\.ipv4Route)
-        var ipv6Routes = parsedRoutes.compactMap(\.ipv6Route)
-        if includeDefaultRoute {
-            ipv4Routes.append(.default())
-            ipv6Routes.append(.default())
-        }
-
-        let settings = NEPacketTunnelNetworkSettings(tunnelRemoteAddress: "1.1.1.1")
-        settings.mtu = NSNumber(value: mtu)
-        if !ipv4Addresses.isEmpty {
-            let ipv4Settings = NEIPv4Settings(
-                addresses: ipv4Addresses.map(\.address),
-                subnetMasks: ipv4Addresses.map(\.subnetMask)
+                )
             )
-            if !ipv4Routes.isEmpty {
-                ipv4Settings.includedRoutes = ipv4Routes
-            }
-            settings.ipv4Settings = ipv4Settings
+            let response = try await client.request(startRequest, type: Response<BurrowResult<String>>.self)
+            self.logger.log("Received start server response: \(String(describing: response.result))")
+        } catch {
+            self.logger.error("Failed to start tunnel: \(error)")
+            throw error
         }
-        if !ipv6Addresses.isEmpty {
-            let ipv6Settings = NEIPv6Settings(
-                addresses: ipv6Addresses.map(\.address),
-                networkPrefixLengths: ipv6Addresses.map(\.prefixLength)
-            )
-            if !ipv6Routes.isEmpty {
-                ipv6Settings.includedRoutes = ipv6Routes
-            }
-            settings.ipv6Settings = ipv6Settings
-        }
-        if !dnsServers.isEmpty {
-            let dnsSettings = NEDNSSettings(servers: dnsServers)
-            if !searchDomains.isEmpty {
-                dnsSettings.matchDomains = searchDomains
-            }
-            settings.dnsSettings = dnsSettings
-        }
-        return settings
-    }
-}
-
-private struct ParsedTunnelAddress {
-    struct IPv4AddressSetting {
-        let address: String
-        let subnetMask: String
     }
 
-    struct IPv6AddressSetting {
-        let address: String
-        let prefixLength: NSNumber
-    }
-
-    let ipv4Address: IPv4AddressSetting?
-    let ipv6Address: IPv6AddressSetting?
-
-    init?(rawValue: String) {
-        let components = rawValue.split(separator: "/", maxSplits: 1).map(String.init)
-        let address = components.first?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
-        guard !address.isEmpty else {
+    private func generateTunSettings(from: ServerConfigData) -> NETunnelNetworkSettings? {
+        let cfig = from.ServerConfig
+        guard let addr = cfig.address else {
             return nil
         }
-
-        let prefix = components.count == 2 ? Int(components[1]) : nil
-        if IPv4Address(address) != nil {
-            let prefixLength = prefix ?? 32
-            guard (0 ... 32).contains(prefixLength) else {
-                return nil
-            }
-            ipv4Address = IPv4AddressSetting(
-                address: address,
-                subnetMask: Self.ipv4SubnetMask(prefixLength: prefixLength)
-            )
-            ipv6Address = nil
-            return
-        }
-
-        if IPv6Address(address) != nil {
-            let prefixLength = prefix ?? 128
-            guard (0 ... 128).contains(prefixLength) else {
-                return nil
-            }
-            ipv4Address = nil
-            ipv6Address = IPv6AddressSetting(
-                address: address,
-                prefixLength: NSNumber(value: prefixLength)
-            )
-            return
-        }
-
-        return nil
-    }
-
-    private static func ipv4SubnetMask(prefixLength: Int) -> String {
-        guard prefixLength > 0 else {
-            return "0.0.0.0"
-        }
-        let mask = UInt32.max << (32 - prefixLength)
-        let octets = [
-            (mask >> 24) & 0xff,
-            (mask >> 16) & 0xff,
-            (mask >> 8) & 0xff,
-            mask & 0xff,
-        ]
-        return octets.map(String.init).joined(separator: ".")
-    }
-}
-
-private struct ParsedTunnelRoute {
-    let ipv4Route: NEIPv4Route?
-    let ipv6Route: NEIPv6Route?
-
-    init?(rawValue: String) {
-        let components = rawValue.split(separator: "/", maxSplits: 1).map(String.init)
-        let address = components.first?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
-        guard !address.isEmpty else {
-            return nil
-        }
-
-        let prefix = components.count == 2 ? Int(components[1]) : nil
-        if IPv4Address(address) != nil {
-            let prefixLength = prefix ?? 32
-            guard (0 ... 32).contains(prefixLength) else {
-                return nil
-            }
-            ipv4Route = NEIPv4Route(
-                destinationAddress: address,
-                subnetMask: Self.ipv4SubnetMask(prefixLength: prefixLength)
-            )
-            ipv6Route = nil
-            return
-        }
-
-        if IPv6Address(address) != nil {
-            let prefixLength = prefix ?? 128
-            guard (0 ... 128).contains(prefixLength) else {
-                return nil
-            }
-            ipv4Route = nil
-            ipv6Route = NEIPv6Route(
-                destinationAddress: address,
-                networkPrefixLength: NSNumber(value: prefixLength)
-            )
-            return
-        }
-
-        return nil
-    }
-
-    private static func ipv4SubnetMask(prefixLength: Int) -> String {
-        var mask = UInt32.max << (32 - prefixLength)
-        if prefixLength == 0 {
-            mask = 0
-        }
-        let octets = [
-            String((mask >> 24) & 0xff),
-            String((mask >> 16) & 0xff),
-            String((mask >> 8) & 0xff),
-            String(mask & 0xff),
-        ]
-        return octets.joined(separator: ".")
+        // Using a makeshift remote tunnel address
+        let nst = NEPacketTunnelNetworkSettings(tunnelRemoteAddress: "1.1.1.1")
+        nst.ipv4Settings = NEIPv4Settings(addresses: [addr], subnetMasks: ["255.255.255.0"])
+        logger.log("Initialized ipv4 settings: \(nst.ipv4Settings)")
+        return nst
     }
 }
diff --git a/Apple/NetworkExtension/libburrow/build-rust.sh b/Apple/NetworkExtension/libburrow/build-rust.sh
index 81cb901..1ac73fb 100755
--- a/Apple/NetworkExtension/libburrow/build-rust.sh
+++ b/Apple/NetworkExtension/libburrow/build-rust.sh
@@ -45,27 +45,6 @@ for ARCH in "${BURROW_ARCHS[@]}"; do
     esac
 done
 
-if [[ -x "$(command -v rustup)" ]]; then
-    INSTALLED_TARGETS="$(rustup target list --installed)"
-    MISSING_TARGETS=()
-    for TARGET in "${RUST_TARGETS[@]}"; do
-        if ! grep -qx "$TARGET" <<< "$INSTALLED_TARGETS"; then
-            MISSING_TARGETS+=("$TARGET")
-        fi
-    done
-    if (( ${#MISSING_TARGETS[@]} > 0 )); then
-        rustup target add "${MISSING_TARGETS[@]}"
-    fi
-else
-    SYSROOT="$(rustc --print sysroot)"
-    for TARGET in "${RUST_TARGETS[@]}"; do
-        if [[ ! -d "${SYSROOT}/lib/rustlib/${TARGET}" ]]; then
-            echo "error: Rust target ${TARGET} is not installed and rustup is unavailable" >&2
-            exit 1
-        fi
-    done
-fi
-
 # Pass all RUST_TARGETS in a single invocation
 CARGO_ARGS=()
 for TARGET in "${RUST_TARGETS[@]}"; do
@@ -77,50 +56,25 @@ CARGO_ARGS+=("--lib")
 
 # Pass the configuration (Debug or Release) through to cargo
 if [[ $SWIFT_ACTIVE_COMPILATION_CONDITIONS == *DEBUG* ]]; then
-    CARGO_TARGET_SUBDIR="debug"
+    CARGO_DIR="debug"
 else
     CARGO_ARGS+=("--release")
-    CARGO_TARGET_SUBDIR="release"
+    CARGO_DIR="release"
 fi
 
 if [[ -x "$(command -v rustup)" ]]; then
-    CARGO_PATH="$(dirname "$(rustup which cargo)"):/usr/bin"
+    CARGO_PATH="$(dirname $(rustup which cargo)):/usr/bin"
 else
-    CARGO_PATH="$(dirname "$(command -v cargo)"):/usr/bin"
+    CARGO_PATH="$(dirname $(readlink -f $(which cargo))):/usr/bin"
 fi
 
-if [[ -n "${PROTOC:-}" ]]; then
-    if [[ ! -x "$PROTOC" ]]; then
-        echo "error: PROTOC is set but is not executable: $PROTOC" >&2
-        exit 127
-    fi
-elif ! PROTOC="$(command -v protoc 2>/dev/null)"; then
-    echo 'error: Unable to find protoc; pass PROTOC or include it in PATH for the Xcode Rust build phase' >&2
-    exit 127
-fi
-CARGO_PATH="$(dirname $PROTOC):$CARGO_PATH"
-
 # Run cargo without the various environment variables set by Xcode.
 # Those variables can confuse cargo and the build scripts it runs.
-CARGO_ENV=(
-    "PATH=$CARGO_PATH"
-    "PROTOC=$PROTOC"
-    "CARGO_TARGET_DIR=${CONFIGURATION_TEMP_DIR}/target"
-)
-
-if [[ -n "$IPHONEOS_DEPLOYMENT_TARGET" ]]; then
-    CARGO_ENV+=("IPHONEOS_DEPLOYMENT_TARGET=$IPHONEOS_DEPLOYMENT_TARGET")
-fi
-
-if [[ -n "$MACOSX_DEPLOYMENT_TARGET" ]]; then
-    CARGO_ENV+=("MACOSX_DEPLOYMENT_TARGET=$MACOSX_DEPLOYMENT_TARGET")
-fi
-
-env -i "${CARGO_ENV[@]}" cargo build "${CARGO_ARGS[@]}"
+env -i PATH="$CARGO_PATH" cargo build "${CARGO_ARGS[@]}"
 
 mkdir -p "${BUILT_PRODUCTS_DIR}"
 
 # Use `lipo` to merge the architectures together into BUILT_PRODUCTS_DIR
 /usr/bin/xcrun --sdk $PLATFORM_NAME lipo \
-    -create $(printf "${CONFIGURATION_TEMP_DIR}/target/%q/${CARGO_TARGET_SUBDIR}/libburrow.a " "${RUST_TARGETS[@]}") \
+    -create $(printf "${PROJECT_DIR}/../target/%q/${CARGO_DIR}/libburrow.a " "${RUST_TARGETS[@]}") \
     -output "${BUILT_PRODUCTS_DIR}/libburrow.a"
diff --git a/Apple/NetworkExtension/libburrow/libburrow.h b/Apple/NetworkExtension/libburrow/libburrow.h
index 59b4734..e500de4 100644
--- a/Apple/NetworkExtension/libburrow/libburrow.h
+++ b/Apple/NetworkExtension/libburrow/libburrow.h
@@ -1,2 +1,2 @@
-__attribute__((__swift_name__("spawnInProcess(socketPath:databasePath:)")))
-extern void spawn_in_process(const char * __nullable socket_path, const char * __nullable db_path);
+__attribute__((__swift_name__("spawnInProcess(socketPath:)")))
+extern void spawn_in_process(const char * __nullable path);
diff --git a/Apple/Profiles/Burrow_Developer_ID.provisionprofile b/Apple/Profiles/Burrow_Developer_ID.provisionprofile
deleted file mode 100644
index 3ecd831..0000000
Binary files a/Apple/Profiles/Burrow_Developer_ID.provisionprofile and /dev/null differ
diff --git a/Apple/Profiles/Burrow_Network_Developer_ID.provisionprofile b/Apple/Profiles/Burrow_Network_Developer_ID.provisionprofile
deleted file mode 100644
index 3ce7e37..0000000
Binary files a/Apple/Profiles/Burrow_Network_Developer_ID.provisionprofile and /dev/null differ
diff --git a/Apple/Shared/Constants.swift b/Apple/Shared/Constants.swift
new file mode 100644
index 0000000..cb56cb3
--- /dev/null
+++ b/Apple/Shared/Constants.swift
@@ -0,0 +1,22 @@
+@_implementationOnly import Constants
+
+public enum Constants {
+    enum Error: Swift.Error {
+        case invalidAppGroupIdentifier
+    }
+
+    public static let bundleIdentifier = AppBundleIdentifier
+    public static let appGroupIdentifier = AppGroupIdentifier
+
+    public static var groupContainerURL: URL {
+        get throws { try _groupContainerURL.get() }
+    }
+
+    private static let _groupContainerURL: Result<URL, Error> = {
+        guard let groupContainerURL = FileManager.default
+            .containerURL(forSecurityApplicationGroupIdentifier: appGroupIdentifier) else {
+            return .failure(.invalidAppGroupIdentifier)
+        }
+        return .success(groupContainerURL)
+    }()
+}
diff --git a/Apple/Configuration/Constants/Constants.h b/Apple/Shared/Constants/Constants.h
similarity index 74%
rename from Apple/Configuration/Constants/Constants.h
rename to Apple/Shared/Constants/Constants.h
index 5278b61..09806c5 100644
--- a/Apple/Configuration/Constants/Constants.h
+++ b/Apple/Shared/Constants/Constants.h
@@ -7,6 +7,5 @@ NS_ASSUME_NONNULL_BEGIN
 
 static NSString * const AppBundleIdentifier = MACRO_STRING(APP_BUNDLE_IDENTIFIER);
 static NSString * const AppGroupIdentifier = MACRO_STRING(APP_GROUP_IDENTIFIER);
-static NSString * const NetworkExtensionBundleIdentifier = MACRO_STRING(NETWORK_EXTENSION_BUNDLE_IDENTIFIER);
 
 NS_ASSUME_NONNULL_END
diff --git a/Apple/Configuration/Constants/module.modulemap b/Apple/Shared/Constants/module.modulemap
similarity index 66%
rename from Apple/Configuration/Constants/module.modulemap
rename to Apple/Shared/Constants/module.modulemap
index 0e60f32..7ee21fc 100644
--- a/Apple/Configuration/Constants/module.modulemap
+++ b/Apple/Shared/Constants/module.modulemap
@@ -1,4 +1,4 @@
-module CConstants {
+module Constants {
     header "Constants.h"
     export *
 }
diff --git a/Apple/Core/Logging.swift b/Apple/Shared/Logging.swift
similarity index 88%
rename from Apple/Core/Logging.swift
rename to Apple/Shared/Logging.swift
index ba40888..36f024c 100644
--- a/Apple/Core/Logging.swift
+++ b/Apple/Shared/Logging.swift
@@ -4,7 +4,7 @@ import os
 extension Logger {
     private static let loggers: OSAllocatedUnfairLock<[String: Logger]> = OSAllocatedUnfairLock(initialState: [:])
 
-    public dynamic static var subsystem: String { "com.hackclub.burrow" }
+    public static let subsystem = Constants.bundleIdentifier
 
     public static func logger(for type: Any.Type) -> Logger {
         let category = String(describing: type)
diff --git a/Apple/Shared/Shared.xcconfig b/Apple/Shared/Shared.xcconfig
new file mode 100644
index 0000000..50718bd
--- /dev/null
+++ b/Apple/Shared/Shared.xcconfig
@@ -0,0 +1,5 @@
+PRODUCT_NAME = BurrowShared
+MERGEABLE_LIBRARY = YES
+
+SWIFT_INCLUDE_PATHS = $(PROJECT_DIR)/Shared/Constants
+GCC_PREPROCESSOR_DEFINITIONS = APP_BUNDLE_IDENTIFIER=$(APP_BUNDLE_IDENTIFIER) APP_GROUP_IDENTIFIER=$(APP_GROUP_IDENTIFIER)
diff --git a/Apple/UI/Assets.xcassets/AccentColor.colorset/Contents.json b/Apple/UI/Assets.xcassets/AccentColor.colorset/Contents.json
deleted file mode 100644
index 127b747..0000000
--- a/Apple/UI/Assets.xcassets/AccentColor.colorset/Contents.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  "colors" : [
-    {
-      "color" : {
-        "color-space" : "srgb",
-        "components" : {
-          "alpha" : "1.000",
-          "blue" : "0x31",
-          "green" : "0x7A",
-          "red" : "0xB7"
-        }
-      },
-      "idiom" : "universal"
-    }
-  ],
-  "info" : {
-    "author" : "xcode",
-    "version" : 1
-  }
-}
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/Contents.json b/Apple/UI/Assets.xcassets/AppIcon.appiconset/Contents.json
deleted file mode 100644
index 092f7cd..0000000
--- a/Apple/UI/Assets.xcassets/AppIcon.appiconset/Contents.json
+++ /dev/null
@@ -1,218 +0,0 @@
-{
-  "images": [
-    {
-      "filename": "ios-panel-01-40.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "20x20"
-    },
-    {
-      "filename": "ios-panel-01-60.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "20x20"
-    },
-    {
-      "filename": "ios-panel-01-29.png",
-      "idiom": "iphone",
-      "scale": "1x",
-      "size": "29x29"
-    },
-    {
-      "filename": "ios-panel-01-58.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "29x29"
-    },
-    {
-      "filename": "ios-panel-01-87.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "29x29"
-    },
-    {
-      "filename": "ios-panel-01-80.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "40x40"
-    },
-    {
-      "filename": "ios-panel-01-120.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "40x40"
-    },
-    {
-      "filename": "ios-panel-01-57.png",
-      "idiom": "iphone",
-      "scale": "1x",
-      "size": "57x57"
-    },
-    {
-      "filename": "ios-panel-01-114.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "57x57"
-    },
-    {
-      "filename": "ios-panel-01-120.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "60x60"
-    },
-    {
-      "filename": "ios-panel-01-180.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "60x60"
-    },
-    {
-      "filename": "ios-panel-01-20.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "20x20"
-    },
-    {
-      "filename": "ios-panel-01-40.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "20x20"
-    },
-    {
-      "filename": "ios-panel-01-29.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "29x29"
-    },
-    {
-      "filename": "ios-panel-01-58.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "29x29"
-    },
-    {
-      "filename": "ios-panel-01-40.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "40x40"
-    },
-    {
-      "filename": "ios-panel-01-80.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "40x40"
-    },
-    {
-      "filename": "ios-panel-01-50.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "50x50"
-    },
-    {
-      "filename": "ios-panel-01-100.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "50x50"
-    },
-    {
-      "filename": "ios-panel-01-72.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "72x72"
-    },
-    {
-      "filename": "ios-panel-01-144.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "72x72"
-    },
-    {
-      "filename": "ios-panel-01-76.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "76x76"
-    },
-    {
-      "filename": "ios-panel-01-152.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "76x76"
-    },
-    {
-      "filename": "ios-panel-01-167.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "83.5x83.5"
-    },
-    {
-      "filename": "ios-panel-01-1024.png",
-      "idiom": "ios-marketing",
-      "scale": "1x",
-      "size": "1024x1024"
-    },
-    {
-      "filename": "mac-panel-05-16.png",
-      "idiom": "mac",
-      "scale": "1x",
-      "size": "16x16"
-    },
-    {
-      "filename": "mac-panel-05-32.png",
-      "idiom": "mac",
-      "scale": "2x",
-      "size": "16x16"
-    },
-    {
-      "filename": "mac-panel-05-32.png",
-      "idiom": "mac",
-      "scale": "1x",
-      "size": "32x32"
-    },
-    {
-      "filename": "mac-panel-05-64.png",
-      "idiom": "mac",
-      "scale": "2x",
-      "size": "32x32"
-    },
-    {
-      "filename": "mac-panel-05-128.png",
-      "idiom": "mac",
-      "scale": "1x",
-      "size": "128x128"
-    },
-    {
-      "filename": "mac-panel-05-256.png",
-      "idiom": "mac",
-      "scale": "2x",
-      "size": "128x128"
-    },
-    {
-      "filename": "mac-panel-05-256.png",
-      "idiom": "mac",
-      "scale": "1x",
-      "size": "256x256"
-    },
-    {
-      "filename": "mac-panel-05-512.png",
-      "idiom": "mac",
-      "scale": "2x",
-      "size": "256x256"
-    },
-    {
-      "filename": "mac-panel-05-512.png",
-      "idiom": "mac",
-      "scale": "1x",
-      "size": "512x512"
-    },
-    {
-      "filename": "mac-panel-05-1024.png",
-      "idiom": "mac",
-      "scale": "2x",
-      "size": "512x512"
-    }
-  ],
-  "info": {
-    "author": "xcode",
-    "version": 1
-  }
-}
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-100.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-100.png
deleted file mode 100644
index dbe8e53..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-100.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-1024.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-1024.png
deleted file mode 100644
index e335771..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-1024.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-114.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-114.png
deleted file mode 100644
index af8f95a..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-114.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-120.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-120.png
deleted file mode 100644
index eea76eb..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-120.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-144.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-144.png
deleted file mode 100644
index ed3c1ba..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-144.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-152.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-152.png
deleted file mode 100644
index 2c7a7cd..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-152.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-167.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-167.png
deleted file mode 100644
index 7ce3660..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-167.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-180.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-180.png
deleted file mode 100644
index 488ac42..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-180.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-20.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-20.png
deleted file mode 100644
index bd3cc95..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-20.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-29.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-29.png
deleted file mode 100644
index 227cb6c..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-29.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-40.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-40.png
deleted file mode 100644
index c0ef687..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-40.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-50.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-50.png
deleted file mode 100644
index 377281b..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-50.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-57.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-57.png
deleted file mode 100644
index b9b88e1..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-57.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-58.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-58.png
deleted file mode 100644
index 0847ee9..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-58.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-60.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-60.png
deleted file mode 100644
index cd8358b..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-60.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-72.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-72.png
deleted file mode 100644
index 5d973f2..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-72.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-76.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-76.png
deleted file mode 100644
index 1cde009..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-76.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-80.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-80.png
deleted file mode 100644
index ecf97e9..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-80.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-87.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-87.png
deleted file mode 100644
index e1f3193..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/ios-panel-01-87.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-1024.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-1024.png
deleted file mode 100644
index 065e8b6..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-1024.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-128.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-128.png
deleted file mode 100644
index f4bd4bc..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-128.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-16.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-16.png
deleted file mode 100644
index 30e2ad9..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-16.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-256.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-256.png
deleted file mode 100644
index d919e9c..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-256.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-32.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-32.png
deleted file mode 100644
index 3c1fd9f..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-32.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-512.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-512.png
deleted file mode 100644
index 441a139..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-512.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-64.png b/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-64.png
deleted file mode 100644
index e6a72db..0000000
Binary files a/Apple/UI/Assets.xcassets/AppIcon.appiconset/mac-panel-05-64.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel01Preview.imageset/Contents.json b/Apple/UI/Assets.xcassets/BurrowPanel01Preview.imageset/Contents.json
deleted file mode 100644
index d6ee58c..0000000
--- a/Apple/UI/Assets.xcassets/BurrowPanel01Preview.imageset/Contents.json
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "images": [
-    {
-      "filename": "preview.png",
-      "idiom": "universal",
-      "scale": "1x"
-    }
-  ],
-  "info": {
-    "author": "xcode",
-    "version": 1
-  }
-}
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel01Preview.imageset/preview.png b/Apple/UI/Assets.xcassets/BurrowPanel01Preview.imageset/preview.png
deleted file mode 100644
index 561abcb..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel01Preview.imageset/preview.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-100.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-100.png
deleted file mode 100644
index 48c06a4..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-100.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-1024.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-1024.png
deleted file mode 100644
index 278575e..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-1024.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-114.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-114.png
deleted file mode 100644
index 411802b..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-114.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-120.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-120.png
deleted file mode 100644
index 95473ee..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-120.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-144.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-144.png
deleted file mode 100644
index 2b2afb9..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-144.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-152.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-152.png
deleted file mode 100644
index 0668af2..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-152.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-167.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-167.png
deleted file mode 100644
index 5486437..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-167.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-180.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-180.png
deleted file mode 100644
index 18111cf..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-180.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-20.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-20.png
deleted file mode 100644
index b0df643..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-20.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-29.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-29.png
deleted file mode 100644
index 49d677b..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-29.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-40.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-40.png
deleted file mode 100644
index 1fb9e0f..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-40.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-50.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-50.png
deleted file mode 100644
index c73d033..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-50.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-57.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-57.png
deleted file mode 100644
index c55bc86..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-57.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-58.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-58.png
deleted file mode 100644
index 470ab9c..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-58.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-60.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-60.png
deleted file mode 100644
index 914fe25..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-60.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-72.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-72.png
deleted file mode 100644
index 463a7cc..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-72.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-76.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-76.png
deleted file mode 100644
index 7080ec3..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-76.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-80.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-80.png
deleted file mode 100644
index 90be22c..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-80.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-87.png b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-87.png
deleted file mode 100644
index f494783..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/BurrowPanel02-87.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/Contents.json b/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/Contents.json
deleted file mode 100644
index a6ab553..0000000
--- a/Apple/UI/Assets.xcassets/BurrowPanel02.appiconset/Contents.json
+++ /dev/null
@@ -1,158 +0,0 @@
-{
-  "images": [
-    {
-      "filename": "BurrowPanel02-40.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel02-60.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel02-29.png",
-      "idiom": "iphone",
-      "scale": "1x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel02-58.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel02-87.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel02-80.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel02-120.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel02-57.png",
-      "idiom": "iphone",
-      "scale": "1x",
-      "size": "57x57"
-    },
-    {
-      "filename": "BurrowPanel02-114.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "57x57"
-    },
-    {
-      "filename": "BurrowPanel02-120.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "60x60"
-    },
-    {
-      "filename": "BurrowPanel02-180.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "60x60"
-    },
-    {
-      "filename": "BurrowPanel02-20.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel02-40.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel02-29.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel02-58.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel02-40.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel02-80.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel02-50.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "50x50"
-    },
-    {
-      "filename": "BurrowPanel02-100.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "50x50"
-    },
-    {
-      "filename": "BurrowPanel02-72.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "72x72"
-    },
-    {
-      "filename": "BurrowPanel02-144.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "72x72"
-    },
-    {
-      "filename": "BurrowPanel02-76.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "76x76"
-    },
-    {
-      "filename": "BurrowPanel02-152.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "76x76"
-    },
-    {
-      "filename": "BurrowPanel02-167.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "83.5x83.5"
-    },
-    {
-      "filename": "BurrowPanel02-1024.png",
-      "idiom": "ios-marketing",
-      "scale": "1x",
-      "size": "1024x1024"
-    }
-  ],
-  "info": {
-    "author": "xcode",
-    "version": 1
-  }
-}
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02Preview.imageset/Contents.json b/Apple/UI/Assets.xcassets/BurrowPanel02Preview.imageset/Contents.json
deleted file mode 100644
index d6ee58c..0000000
--- a/Apple/UI/Assets.xcassets/BurrowPanel02Preview.imageset/Contents.json
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "images": [
-    {
-      "filename": "preview.png",
-      "idiom": "universal",
-      "scale": "1x"
-    }
-  ],
-  "info": {
-    "author": "xcode",
-    "version": 1
-  }
-}
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel02Preview.imageset/preview.png b/Apple/UI/Assets.xcassets/BurrowPanel02Preview.imageset/preview.png
deleted file mode 100644
index f6d9feb..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel02Preview.imageset/preview.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-100.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-100.png
deleted file mode 100644
index 8d72c1b..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-100.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-1024.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-1024.png
deleted file mode 100644
index 6f40b0a..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-1024.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-114.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-114.png
deleted file mode 100644
index 9d44be4..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-114.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-120.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-120.png
deleted file mode 100644
index 434c1a8..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-120.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-144.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-144.png
deleted file mode 100644
index d837b45..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-144.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-152.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-152.png
deleted file mode 100644
index c507534..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-152.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-167.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-167.png
deleted file mode 100644
index e79fc1e..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-167.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-180.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-180.png
deleted file mode 100644
index 7022128..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-180.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-20.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-20.png
deleted file mode 100644
index 28468f0..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-20.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-29.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-29.png
deleted file mode 100644
index b4dc026..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-29.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-40.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-40.png
deleted file mode 100644
index 2ed0ee4..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-40.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-50.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-50.png
deleted file mode 100644
index 7015cf1..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-50.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-57.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-57.png
deleted file mode 100644
index 6cfb78d..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-57.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-58.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-58.png
deleted file mode 100644
index 1efe951..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-58.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-60.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-60.png
deleted file mode 100644
index e007091..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-60.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-72.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-72.png
deleted file mode 100644
index f82f554..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-72.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-76.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-76.png
deleted file mode 100644
index 5f92d14..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-76.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-80.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-80.png
deleted file mode 100644
index 37337e7..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-80.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-87.png b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-87.png
deleted file mode 100644
index e37171c..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/BurrowPanel03-87.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/Contents.json b/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/Contents.json
deleted file mode 100644
index 923e927..0000000
--- a/Apple/UI/Assets.xcassets/BurrowPanel03.appiconset/Contents.json
+++ /dev/null
@@ -1,158 +0,0 @@
-{
-  "images": [
-    {
-      "filename": "BurrowPanel03-40.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel03-60.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel03-29.png",
-      "idiom": "iphone",
-      "scale": "1x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel03-58.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel03-87.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel03-80.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel03-120.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel03-57.png",
-      "idiom": "iphone",
-      "scale": "1x",
-      "size": "57x57"
-    },
-    {
-      "filename": "BurrowPanel03-114.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "57x57"
-    },
-    {
-      "filename": "BurrowPanel03-120.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "60x60"
-    },
-    {
-      "filename": "BurrowPanel03-180.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "60x60"
-    },
-    {
-      "filename": "BurrowPanel03-20.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel03-40.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel03-29.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel03-58.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel03-40.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel03-80.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel03-50.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "50x50"
-    },
-    {
-      "filename": "BurrowPanel03-100.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "50x50"
-    },
-    {
-      "filename": "BurrowPanel03-72.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "72x72"
-    },
-    {
-      "filename": "BurrowPanel03-144.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "72x72"
-    },
-    {
-      "filename": "BurrowPanel03-76.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "76x76"
-    },
-    {
-      "filename": "BurrowPanel03-152.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "76x76"
-    },
-    {
-      "filename": "BurrowPanel03-167.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "83.5x83.5"
-    },
-    {
-      "filename": "BurrowPanel03-1024.png",
-      "idiom": "ios-marketing",
-      "scale": "1x",
-      "size": "1024x1024"
-    }
-  ],
-  "info": {
-    "author": "xcode",
-    "version": 1
-  }
-}
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03Preview.imageset/Contents.json b/Apple/UI/Assets.xcassets/BurrowPanel03Preview.imageset/Contents.json
deleted file mode 100644
index d6ee58c..0000000
--- a/Apple/UI/Assets.xcassets/BurrowPanel03Preview.imageset/Contents.json
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "images": [
-    {
-      "filename": "preview.png",
-      "idiom": "universal",
-      "scale": "1x"
-    }
-  ],
-  "info": {
-    "author": "xcode",
-    "version": 1
-  }
-}
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel03Preview.imageset/preview.png b/Apple/UI/Assets.xcassets/BurrowPanel03Preview.imageset/preview.png
deleted file mode 100644
index 76d432e..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel03Preview.imageset/preview.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-100.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-100.png
deleted file mode 100644
index 3c70fad..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-100.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-1024.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-1024.png
deleted file mode 100644
index 4925f9f..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-1024.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-114.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-114.png
deleted file mode 100644
index 6ea1195..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-114.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-120.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-120.png
deleted file mode 100644
index b07aa10..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-120.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-144.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-144.png
deleted file mode 100644
index 783367c..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-144.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-152.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-152.png
deleted file mode 100644
index 5a13fd3..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-152.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-167.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-167.png
deleted file mode 100644
index 694d1f1..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-167.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-180.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-180.png
deleted file mode 100644
index af7e0fb..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-180.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-20.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-20.png
deleted file mode 100644
index 6889afc..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-20.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-29.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-29.png
deleted file mode 100644
index 81f027c..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-29.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-40.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-40.png
deleted file mode 100644
index 6fc8b68..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-40.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-50.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-50.png
deleted file mode 100644
index cf8d516..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-50.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-57.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-57.png
deleted file mode 100644
index 6bddc05..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-57.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-58.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-58.png
deleted file mode 100644
index c80a63f..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-58.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-60.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-60.png
deleted file mode 100644
index 22bf565..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-60.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-72.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-72.png
deleted file mode 100644
index 1ce020b..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-72.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-76.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-76.png
deleted file mode 100644
index d0f2173..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-76.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-80.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-80.png
deleted file mode 100644
index 3d4be54..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-80.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-87.png b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-87.png
deleted file mode 100644
index 0de4b64..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/BurrowPanel04-87.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/Contents.json b/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/Contents.json
deleted file mode 100644
index ee5c59a..0000000
--- a/Apple/UI/Assets.xcassets/BurrowPanel04.appiconset/Contents.json
+++ /dev/null
@@ -1,158 +0,0 @@
-{
-  "images": [
-    {
-      "filename": "BurrowPanel04-40.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel04-60.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel04-29.png",
-      "idiom": "iphone",
-      "scale": "1x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel04-58.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel04-87.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel04-80.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel04-120.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel04-57.png",
-      "idiom": "iphone",
-      "scale": "1x",
-      "size": "57x57"
-    },
-    {
-      "filename": "BurrowPanel04-114.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "57x57"
-    },
-    {
-      "filename": "BurrowPanel04-120.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "60x60"
-    },
-    {
-      "filename": "BurrowPanel04-180.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "60x60"
-    },
-    {
-      "filename": "BurrowPanel04-20.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel04-40.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel04-29.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel04-58.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel04-40.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel04-80.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel04-50.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "50x50"
-    },
-    {
-      "filename": "BurrowPanel04-100.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "50x50"
-    },
-    {
-      "filename": "BurrowPanel04-72.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "72x72"
-    },
-    {
-      "filename": "BurrowPanel04-144.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "72x72"
-    },
-    {
-      "filename": "BurrowPanel04-76.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "76x76"
-    },
-    {
-      "filename": "BurrowPanel04-152.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "76x76"
-    },
-    {
-      "filename": "BurrowPanel04-167.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "83.5x83.5"
-    },
-    {
-      "filename": "BurrowPanel04-1024.png",
-      "idiom": "ios-marketing",
-      "scale": "1x",
-      "size": "1024x1024"
-    }
-  ],
-  "info": {
-    "author": "xcode",
-    "version": 1
-  }
-}
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04Preview.imageset/Contents.json b/Apple/UI/Assets.xcassets/BurrowPanel04Preview.imageset/Contents.json
deleted file mode 100644
index d6ee58c..0000000
--- a/Apple/UI/Assets.xcassets/BurrowPanel04Preview.imageset/Contents.json
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "images": [
-    {
-      "filename": "preview.png",
-      "idiom": "universal",
-      "scale": "1x"
-    }
-  ],
-  "info": {
-    "author": "xcode",
-    "version": 1
-  }
-}
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel04Preview.imageset/preview.png b/Apple/UI/Assets.xcassets/BurrowPanel04Preview.imageset/preview.png
deleted file mode 100644
index 36b526c..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel04Preview.imageset/preview.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-100.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-100.png
deleted file mode 100644
index caed322..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-100.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-1024.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-1024.png
deleted file mode 100644
index 065e8b6..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-1024.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-114.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-114.png
deleted file mode 100644
index a6a5dfa..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-114.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-120.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-120.png
deleted file mode 100644
index 184604d..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-120.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-144.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-144.png
deleted file mode 100644
index 89a64a9..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-144.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-152.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-152.png
deleted file mode 100644
index 339670e..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-152.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-167.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-167.png
deleted file mode 100644
index ac23f7c..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-167.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-180.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-180.png
deleted file mode 100644
index d2c8089..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-180.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-20.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-20.png
deleted file mode 100644
index 821044f..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-20.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-29.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-29.png
deleted file mode 100644
index b20c630..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-29.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-40.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-40.png
deleted file mode 100644
index 9fa18b5..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-40.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-50.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-50.png
deleted file mode 100644
index 619429d..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-50.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-57.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-57.png
deleted file mode 100644
index bde5672..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-57.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-58.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-58.png
deleted file mode 100644
index 8d8311d..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-58.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-60.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-60.png
deleted file mode 100644
index 5d37b74..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-60.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-72.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-72.png
deleted file mode 100644
index a3624bf..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-72.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-76.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-76.png
deleted file mode 100644
index 35730d1..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-76.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-80.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-80.png
deleted file mode 100644
index 43ad408..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-80.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-87.png b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-87.png
deleted file mode 100644
index 1e7bbdf..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/BurrowPanel05-87.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/Contents.json b/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/Contents.json
deleted file mode 100644
index a1e0e4b..0000000
--- a/Apple/UI/Assets.xcassets/BurrowPanel05.appiconset/Contents.json
+++ /dev/null
@@ -1,158 +0,0 @@
-{
-  "images": [
-    {
-      "filename": "BurrowPanel05-40.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel05-60.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel05-29.png",
-      "idiom": "iphone",
-      "scale": "1x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel05-58.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel05-87.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel05-80.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel05-120.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel05-57.png",
-      "idiom": "iphone",
-      "scale": "1x",
-      "size": "57x57"
-    },
-    {
-      "filename": "BurrowPanel05-114.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "57x57"
-    },
-    {
-      "filename": "BurrowPanel05-120.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "60x60"
-    },
-    {
-      "filename": "BurrowPanel05-180.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "60x60"
-    },
-    {
-      "filename": "BurrowPanel05-20.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel05-40.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel05-29.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel05-58.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel05-40.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel05-80.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel05-50.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "50x50"
-    },
-    {
-      "filename": "BurrowPanel05-100.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "50x50"
-    },
-    {
-      "filename": "BurrowPanel05-72.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "72x72"
-    },
-    {
-      "filename": "BurrowPanel05-144.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "72x72"
-    },
-    {
-      "filename": "BurrowPanel05-76.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "76x76"
-    },
-    {
-      "filename": "BurrowPanel05-152.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "76x76"
-    },
-    {
-      "filename": "BurrowPanel05-167.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "83.5x83.5"
-    },
-    {
-      "filename": "BurrowPanel05-1024.png",
-      "idiom": "ios-marketing",
-      "scale": "1x",
-      "size": "1024x1024"
-    }
-  ],
-  "info": {
-    "author": "xcode",
-    "version": 1
-  }
-}
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05Preview.imageset/Contents.json b/Apple/UI/Assets.xcassets/BurrowPanel05Preview.imageset/Contents.json
deleted file mode 100644
index d6ee58c..0000000
--- a/Apple/UI/Assets.xcassets/BurrowPanel05Preview.imageset/Contents.json
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "images": [
-    {
-      "filename": "preview.png",
-      "idiom": "universal",
-      "scale": "1x"
-    }
-  ],
-  "info": {
-    "author": "xcode",
-    "version": 1
-  }
-}
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel05Preview.imageset/preview.png b/Apple/UI/Assets.xcassets/BurrowPanel05Preview.imageset/preview.png
deleted file mode 100644
index d919e9c..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel05Preview.imageset/preview.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-100.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-100.png
deleted file mode 100644
index c723bc5..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-100.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-1024.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-1024.png
deleted file mode 100644
index 54336b2..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-1024.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-114.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-114.png
deleted file mode 100644
index f0d4a55..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-114.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-120.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-120.png
deleted file mode 100644
index cf95959..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-120.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-144.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-144.png
deleted file mode 100644
index b1bb422..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-144.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-152.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-152.png
deleted file mode 100644
index a44333c..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-152.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-167.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-167.png
deleted file mode 100644
index adb7652..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-167.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-180.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-180.png
deleted file mode 100644
index 0e64715..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-180.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-20.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-20.png
deleted file mode 100644
index d9d652b..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-20.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-29.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-29.png
deleted file mode 100644
index e200e3c..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-29.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-40.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-40.png
deleted file mode 100644
index 3db6db7..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-40.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-50.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-50.png
deleted file mode 100644
index 7f3b15e..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-50.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-57.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-57.png
deleted file mode 100644
index 49fd3f6..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-57.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-58.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-58.png
deleted file mode 100644
index 7f7c2ff..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-58.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-60.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-60.png
deleted file mode 100644
index da1f3ca..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-60.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-72.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-72.png
deleted file mode 100644
index 1a9e3dc..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-72.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-76.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-76.png
deleted file mode 100644
index e4407db..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-76.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-80.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-80.png
deleted file mode 100644
index 0c0b7f4..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-80.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-87.png b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-87.png
deleted file mode 100644
index 3740748..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/BurrowPanel06-87.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/Contents.json b/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/Contents.json
deleted file mode 100644
index 91d9323..0000000
--- a/Apple/UI/Assets.xcassets/BurrowPanel06.appiconset/Contents.json
+++ /dev/null
@@ -1,158 +0,0 @@
-{
-  "images": [
-    {
-      "filename": "BurrowPanel06-40.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel06-60.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel06-29.png",
-      "idiom": "iphone",
-      "scale": "1x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel06-58.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel06-87.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel06-80.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel06-120.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel06-57.png",
-      "idiom": "iphone",
-      "scale": "1x",
-      "size": "57x57"
-    },
-    {
-      "filename": "BurrowPanel06-114.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "57x57"
-    },
-    {
-      "filename": "BurrowPanel06-120.png",
-      "idiom": "iphone",
-      "scale": "2x",
-      "size": "60x60"
-    },
-    {
-      "filename": "BurrowPanel06-180.png",
-      "idiom": "iphone",
-      "scale": "3x",
-      "size": "60x60"
-    },
-    {
-      "filename": "BurrowPanel06-20.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel06-40.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "20x20"
-    },
-    {
-      "filename": "BurrowPanel06-29.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel06-58.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "29x29"
-    },
-    {
-      "filename": "BurrowPanel06-40.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel06-80.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "40x40"
-    },
-    {
-      "filename": "BurrowPanel06-50.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "50x50"
-    },
-    {
-      "filename": "BurrowPanel06-100.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "50x50"
-    },
-    {
-      "filename": "BurrowPanel06-72.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "72x72"
-    },
-    {
-      "filename": "BurrowPanel06-144.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "72x72"
-    },
-    {
-      "filename": "BurrowPanel06-76.png",
-      "idiom": "ipad",
-      "scale": "1x",
-      "size": "76x76"
-    },
-    {
-      "filename": "BurrowPanel06-152.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "76x76"
-    },
-    {
-      "filename": "BurrowPanel06-167.png",
-      "idiom": "ipad",
-      "scale": "2x",
-      "size": "83.5x83.5"
-    },
-    {
-      "filename": "BurrowPanel06-1024.png",
-      "idiom": "ios-marketing",
-      "scale": "1x",
-      "size": "1024x1024"
-    }
-  ],
-  "info": {
-    "author": "xcode",
-    "version": 1
-  }
-}
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06Preview.imageset/Contents.json b/Apple/UI/Assets.xcassets/BurrowPanel06Preview.imageset/Contents.json
deleted file mode 100644
index d6ee58c..0000000
--- a/Apple/UI/Assets.xcassets/BurrowPanel06Preview.imageset/Contents.json
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "images": [
-    {
-      "filename": "preview.png",
-      "idiom": "universal",
-      "scale": "1x"
-    }
-  ],
-  "info": {
-    "author": "xcode",
-    "version": 1
-  }
-}
diff --git a/Apple/UI/Assets.xcassets/BurrowPanel06Preview.imageset/preview.png b/Apple/UI/Assets.xcassets/BurrowPanel06Preview.imageset/preview.png
deleted file mode 100644
index 7c63df0..0000000
Binary files a/Apple/UI/Assets.xcassets/BurrowPanel06Preview.imageset/preview.png and /dev/null differ
diff --git a/Apple/UI/Assets.xcassets/WireGuard.colorset/Contents.json b/Apple/UI/Assets.xcassets/WireGuard.colorset/Contents.json
deleted file mode 100644
index 092ec69..0000000
--- a/Apple/UI/Assets.xcassets/WireGuard.colorset/Contents.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  "colors" : [
-    {
-      "color" : {
-        "color-space" : "srgb",
-        "components" : {
-          "alpha" : "1.000",
-          "blue" : "0x1A",
-          "green" : "0x17",
-          "red" : "0x88"
-        }
-      },
-      "idiom" : "universal"
-    }
-  ],
-  "info" : {
-    "author" : "xcode",
-    "version" : 1
-  }
-}
diff --git a/Apple/UI/Assets.xcassets/WireGuard.imageset/Contents.json b/Apple/UI/Assets.xcassets/WireGuard.imageset/Contents.json
deleted file mode 100644
index e7fe15a..0000000
--- a/Apple/UI/Assets.xcassets/WireGuard.imageset/Contents.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "images" : [
-    {
-      "filename" : "WireGuard.svg",
-      "idiom" : "universal"
-    }
-  ],
-  "info" : {
-    "author" : "xcode",
-    "version" : 1
-  },
-  "properties" : {
-    "preserves-vector-representation" : true
-  }
-}
diff --git a/Apple/UI/Assets.xcassets/WireGuard.imageset/WireGuard.svg b/Apple/UI/Assets.xcassets/WireGuard.imageset/WireGuard.svg
deleted file mode 100644
index 9520f89..0000000
--- a/Apple/UI/Assets.xcassets/WireGuard.imageset/WireGuard.svg
+++ /dev/null
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<svg viewBox="0 0 46 79" xmlns="http://www.w3.org/2000/svg">
-  <g stroke-width=".265" transform="matrix(1, 0, 0, 1, 144.316635, -78.301682)">
-    <path d="M -131.805 103.359 C -123.863 98.5 -113.717 101.469 -109.915 108.776 C -109.195 110.161 -109.103 112.293 -109.559 113.746 C -111.135 118.761 -114.855 121.574 -119.961 122.769 C -118.455 121.48 -117.257 120.019 -116.876 117.999 C -116.474 116.064 -116.911 114.05 -118.078 112.455 C -119.937 109.901 -123.263 108.888 -126.23 109.971 C -129.373 111.164 -131.095 114.033 -130.785 117.56 C -130.497 120.836 -128.011 122.959 -123.36 123.765 C -124.056 124.133 -124.591 124.404 -125.115 124.696 C -127.245 125.863 -129.099 127.475 -130.55 129.423 C -131.022 130.06 -131.347 130.112 -132.066 129.672 C -141.415 123.955 -142.016 109.605 -131.806 103.359 L -131.805 103.359 Z M -138.803 138.688 C -140.305 139.07 -141.761 139.634 -143.296 140.138 C -142.545 135.071 -136.612 130.404 -131.594 130.936 C -133.048 132.939 -133.896 135.317 -134.039 137.787 C -135.707 138.094 -137.278 138.301 -138.803 138.688 Z M -106.844 89.217 C -105.36 89.271 -103.873 89.248 -102.388 89.284 C -102.017 89.308 -101.649 89.359 -101.285 89.437 C -101.617 89.947 -101.992 90.428 -102.406 90.875 C -102.937 91.37 -103.537 91.853 -104.302 91.101 C -104.486 90.92 -104.921 90.962 -105.241 90.958 C -106.718 90.938 -108.197 90.891 -109.672 90.947 C -110.951 90.988 -112.227 91.118 -113.488 91.336 C -113.725 91.379 -114.078 92.165 -113.969 92.455 C -113.713 93.139 -113.339 93.893 -112.785 94.331 C -110.737 95.947 -108.559 97.399 -106.501 99.004 C -104.502 100.564 -102.641 102.274 -101.507 104.628 C -100.03 107.694 -99.987 110.91 -100.624 114.139 C -101.688 119.531 -104.416 123.998 -108.835 127.242 C -110.615 128.55 -112.819 129.292 -114.858 130.231 C -116.652 131.057 -118.498 131.769 -120.295 132.586 C -123.536 134.06 -125.357 137.577 -124.822 141.235 C -124.33 144.591 -121.386 147.392 -118.013 147.97 C -113.967 148.664 -109.792 146.034 -108.802 141.922 C -107.689 137.297 -110.202 133.168 -114.905 131.917 C -115.112 131.862 -115.32 131.81 -115.752 131.698 C -114.494 131.136 -113.407 130.735 -112.404 130.183 C -110.654 129.22 -108.936 128.201 -107.249 127.124 C -106.754 126.807 -106.486 126.807 -106.063 127.173 C -102.828 129.969 -100.899 133.448 -100.358 137.713 C -99.462 144.773 -102.804 151.259 -109.108 154.584 C -118.86 159.727 -130.794 153.873 -132.948 143.061 C -134.794 133.799 -128.257 125.399 -120.391 123.777 C -117.008 123.079 -113.914 121.671 -111.509 119.065 C -109.957 117.384 -109.205 115.942 -108.948 115.291 C -108.471 114.071 -108.227 112.772 -108.228 111.462 C -108.28 110.329 -108.546 109.216 -109.013 108.182 C -109.834 106.31 -112.98 103.332 -113.759 102.704 L -121.168 96.904 C -121.429 96.689 -121.723 96.705 -122.36 96.748 C -123.117 96.799 -125.053 96.906 -125.888 96.688 C -125.212 96.176 -123.371 95.432 -122.58 94.834 C -124.98 93.212 -127.721 93.798 -130.237 93.313 C -129.655 92.23 -126.776 90.564 -125.139 90.379 C -125.236 89.464 -125.385 88.556 -125.585 87.659 C -125.685 87.291 -126.096 86.934 -126.455 86.723 C -127.324 86.214 -128.246 85.793 -129.246 85.286 C -128.35 84.707 -127.313 84.386 -126.247 84.358 C -125.238 84.32 -124.228 84.418 -123.245 84.651 C -121.461 85.058 -120.037 84.792 -118.618 83.58 C -119.735 83.13 -120.852 82.719 -121.935 82.233 C -123.003 81.746 -124.043 81.202 -125.052 80.604 C -122.241 80.994 -119.523 82.048 -116.649 81.663 C -116.625 81.532 -116.6 81.402 -116.576 81.271 C -118.724 80.771 -120.873 80.271 -123.251 79.717 C -119.272 79.353 -115.567 79.293 -112.059 81.002 C -111.072 81.482 -110.039 81.88 -109.093 82.43 C -108.631 82.697 -108.321 83.225 -107.942 83.636 C -107.641 83.962 -107.4 84.399 -107.03 84.595 C -105.628 85.341 -104.084 85.37 -102.512 85.333 C -102.5 85.154 -102.489 84.986 -102.477 84.806 C -100.894 85.3 -99.113 87.125 -99.116 88.458 C -101.68 88.458 -104.242 88.449 -106.804 88.473 C -107.077 88.475 -107.349 88.675 -107.622 88.784 C -107.363 88.935 -107.108 89.207 -106.844 89.217 Z" style="fill: rgb(255, 255, 255);"/>
-  </g>
-</svg>
\ No newline at end of file
diff --git a/Apple/UI/Assets.xcassets/WireGuardTitle.imageset/Contents.json b/Apple/UI/Assets.xcassets/WireGuardTitle.imageset/Contents.json
deleted file mode 100644
index 782dd12..0000000
--- a/Apple/UI/Assets.xcassets/WireGuardTitle.imageset/Contents.json
+++ /dev/null
@@ -1,21 +0,0 @@
-{
-  "images" : [
-    {
-      "filename" : "WireGuardTitle.svg",
-      "idiom" : "universal",
-      "scale" : "1x"
-    },
-    {
-      "idiom" : "universal",
-      "scale" : "2x"
-    },
-    {
-      "idiom" : "universal",
-      "scale" : "3x"
-    }
-  ],
-  "info" : {
-    "author" : "xcode",
-    "version" : 1
-  }
-}
diff --git a/Apple/UI/Assets.xcassets/WireGuardTitle.imageset/WireGuardTitle.svg b/Apple/UI/Assets.xcassets/WireGuardTitle.imageset/WireGuardTitle.svg
deleted file mode 100644
index 64946da..0000000
--- a/Apple/UI/Assets.xcassets/WireGuardTitle.imageset/WireGuardTitle.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<svg width="1538" height="210" viewBox="0 0 1538 210" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M65.7132 204.476L0.500244 4.49222H24.9555L74.5901 158.827L125.493 4.49222H147.774L198.496 158.467L248.311 4.49222H272.041L207.009 204.476H188.895L136.182 43.4409L84.0113 204.476H65.7132ZM267.577 204.476V49.4109H292.213V204.476H267.577ZM349.324 136.908V204.476H325.051V50.1407H431.568C447.387 50.1407 459.766 53.9449 468.703 61.5533C477.638 69.1618 482.107 79.7288 482.107 93.2544C482.288 103.759 478.504 113.946 471.51 121.785C464.445 129.818 455.237 134.739 443.885 136.548L486.817 204.478H460.551L416.713 136.91L349.324 136.908ZM349.324 114.265H431.565C439.898 114.265 446.268 112.453 450.676 108.83C455.083 105.207 457.287 100.014 457.288 93.2518C457.288 86.49 455.084 81.3275 450.676 77.7643C446.266 74.2033 439.896 72.422 431.565 72.4202H349.324V114.265ZM504.99 204.476V49.7808H650.085V72.4241H529.259V111.008H608.602V133.289H529.259V182.198H656.785V204.48H504.98L504.99 204.476ZM827.46 150.318V120.972H772.934V97.9663H852.277V158.107C842.614 174.773 830.025 187.543 814.508 196.419C798.989 205.296 781.387 209.734 761.704 209.734C731.752 209.734 707.026 199.861 687.524 180.116C668.02 160.371 658.269 135.343 658.269 105.031C658.269 74.5986 668.051 49.5097 687.615 29.7643C707.179 10.0196 731.876 0.147217 761.704 0.147217C780.181 0.147217 797.028 4.19276 812.244 12.2839C827.443 20.3602 840.25 32.2924 849.379 46.8828L828.547 61.7363C822.413 49.9333 812.97 40.1755 801.375 33.6582C789.281 26.8286 775.592 23.3281 761.704 23.5135C739.242 23.5135 720.644 31.2122 705.911 46.6097C691.175 62.0066 683.808 81.4796 683.81 105.029C683.81 128.578 691.177 148.021 705.911 163.358C720.643 178.696 739.241 186.365 761.704 186.363C775.711 186.363 788.18 183.344 799.111 177.306C810.039 171.269 819.488 162.274 827.46 150.318ZM879.358 50.1436H903.631V149.231C903.631 164.085 907.134 174.108 914.138 179.301C921.141 184.494 935.029 187.091 955.802 187.09C976.693 187.09 990.642 184.494 997.647 179.301C1004.65 174.11 1008.15 164.087 1008.15 149.231V50.1436H1032.25V155.57C1032.25 174.531 1026.24 188.238 1014.22 196.691C1002.2 205.142 982.61 209.369 955.439 209.372C928.386 209.372 908.943 205.205 897.11 196.872C885.273 188.539 879.355 174.772 879.357 155.57L879.358 50.1436ZM1028.45 204.476L1107.07 49.7808H1122.29L1201.63 204.476H1175.73L1155.62 165.167H1073.92L1053.99 204.476H1028.45ZM1084.43 144.698H1144.93L1114.86 85.4626L1084.43 144.698ZM1228.55 136.908V204.476H1204.27V50.1406H1310.79C1326.61 50.1406 1338.99 53.9448 1347.93 61.5532C1356.86 69.1617 1361.33 79.7287 1361.33 93.2543C1361.51 103.759 1357.73 113.945 1350.73 121.784C1343.67 129.817 1334.46 134.739 1323.11 136.548L1366.04 204.478H1339.77L1295.94 136.91L1228.55 136.908ZM1228.55 114.265H1310.79C1319.12 114.265 1325.49 112.453 1329.9 108.83C1334.31 105.207 1336.51 100.014 1336.51 93.2517C1336.51 86.4899 1334.31 81.3274 1329.9 77.7642C1325.49 74.2032 1319.12 72.4218 1310.79 72.4201H1228.55V114.265ZM1453.24 49.7818C1478.48 49.7818 1498.83 56.9973 1514.29 71.4281C1529.74 85.861 1537.47 104.61 1537.47 127.674C1537.47 150.983 1529.9 169.611 1514.74 183.559C1499.58 197.506 1479.08 204.48 1453.24 204.481H1384.59V49.786H1453.24L1453.24 49.7818ZM1453.6 72.0631H1408.86V182.2H1453.6C1471.96 182.2 1486.39 177.278 1496.9 167.436C1507.4 157.595 1512.66 144.221 1512.66 127.312C1512.66 111.009 1507.22 97.7246 1496.35 87.4596C1485.48 77.1966 1471.23 72.0651 1453.6 72.0631Z" fill="white"/>
-</svg>
diff --git a/Apple/UI/BurrowView.swift b/Apple/UI/BurrowView.swift
deleted file mode 100644
index 8145928..0000000
--- a/Apple/UI/BurrowView.swift
+++ /dev/null
@@ -1,1886 +0,0 @@
-import BurrowConfiguration
-import Foundation
-import SwiftUI
-#if canImport(AuthenticationServices)
-import AuthenticationServices
-#endif
-
-@MainActor
-public protocol AppIconManaging {
-    var supportsAlternateIcons: Bool { get }
-    var alternateIconName: String? { get }
-    func setAlternateIconName(_ iconName: String?) async throws
-}
-
-public struct BurrowView: View {
-    private let appIconManager: (any AppIconManaging)?
-
-    @State private var networkViewModel: NetworkViewModel
-    @State private var accountStore = NetworkAccountStore()
-    @State private var activeSheet: ConfigurationSheet?
-    @State private var didRunAutomation = false
-    #if os(iOS)
-    @State private var selectedAppIconName: String?
-    @State private var appIconError: String?
-    @State private var isSettingAppIcon = false
-    #endif
-
-    public var body: some View {
-        NavigationStack {
-            ScrollView {
-                VStack(alignment: .leading, spacing: 24) {
-                    HStack(alignment: .top) {
-                        VStack(alignment: .leading, spacing: 6) {
-                            Text("Burrow")
-                                .font(.largeTitle)
-                                .fontWeight(.bold)
-                            if showsHeaderSubtitle {
-                                Text("Networks and accounts")
-                                    .font(.headline)
-                                    .foregroundStyle(.secondary)
-                            }
-                        }
-                        if showsToolbarAddMenu {
-                            Spacer()
-                            Menu {
-                                Button("Add WireGuard Network") {
-                                    activeSheet = .wireGuard
-                                }
-                                Button("Save Tor Account") {
-                                    activeSheet = .tor
-                                }
-                                Button("Add Tailnet Account") {
-                                    activeSheet = .tailnet
-                                }
-                            } label: {
-                                Image(systemName: "plus.circle.fill")
-                                    .font(.title)
-                                    .accessibilityLabel("Add")
-                            }
-                        }
-                    }
-                    .padding(.top)
-
-                    if showsInlineQuickActions {
-                        quickAddSection
-                    }
-
-                    if showsAppIconSection {
-                        appIconSection
-                    }
-
-                    VStack(alignment: .leading, spacing: 12) {
-                        sectionHeader(
-                            title: "Networks",
-                            detail: showsInlineQuickActions
-                                ? nil
-                                : "Stored daemon networks and their active account selectors"
-                        )
-                        if let connectionError = networkViewModel.connectionError {
-                            Text(connectionError)
-                                .font(.footnote)
-                                .foregroundStyle(.secondary)
-                        }
-                        NetworkCarouselView(networks: networkViewModel.cards)
-                    }
-
-                    if showsAccountsSection {
-                        VStack(alignment: .leading, spacing: 12) {
-                            sectionHeader(
-                                title: "Accounts",
-                                detail: showsInlineQuickActions
-                                    ? nil
-                                    : "Per-network identities and sign-in state"
-                            )
-                            if accountStore.accounts.isEmpty {
-                                ContentUnavailableView(
-                                    "No Accounts Yet",
-                                    systemImage: "person.crop.circle.badge.plus",
-                                    description: Text("Save a Tor account or sign in to Tailnet to keep network identities ready on this device.")
-                                )
-                                .frame(maxWidth: .infinity, minHeight: 180)
-                            } else {
-                                LazyVStack(spacing: 12) {
-                                    ForEach(accountStore.accounts) { account in
-                                        AccountRowView(
-                                            account: account,
-                                            hasSecret: accountStore.hasStoredSecret(for: account)
-                                        )
-                                    }
-                                }
-                            }
-                        }
-                    }
-
-                    VStack(alignment: .leading, spacing: 8) {
-                        sectionHeader(
-                            title: "Tunnel",
-                            detail: showsInlineQuickActions ? nil : "Current system extension state"
-                        )
-                        TunnelStatusView()
-                        TunnelButton()
-                            .padding(.bottom)
-                    }
-                }
-                .padding()
-            }
-        }
-        .sheet(item: $activeSheet) { sheet in
-            ConfigurationSheetView(
-                sheet: sheet,
-                networkViewModel: networkViewModel,
-                accountStore: accountStore
-            )
-        }
-        .onAppear {
-            runAutomationIfNeeded()
-            refreshAppIconSelection()
-        }
-    }
-
-    public init(appIconManager: (any AppIconManaging)? = nil) {
-        self.appIconManager = appIconManager
-        _networkViewModel = State(
-            initialValue: NetworkViewModel(
-                socketURLResult: Result { try Constants.socketURL }
-            )
-        )
-    }
-
-    private func runAutomationIfNeeded() {
-        guard !didRunAutomation,
-              let automation = BurrowAutomationConfig.current,
-              automation.action == .tailnetLogin || automation.action == .tailnetProbe
-        else {
-            return
-        }
-        didRunAutomation = true
-        activeSheet = .tailnet
-    }
-
-    private func refreshAppIconSelection() {
-        #if os(iOS)
-        selectedAppIconName = appIconManager?.alternateIconName
-        #endif
-    }
-
-    @ViewBuilder
-    private var quickAddSection: some View {
-        VStack(alignment: .leading, spacing: 12) {
-            sectionHeader(title: "Add", detail: nil)
-            VStack(spacing: 12) {
-                ForEach(ConfigurationSheet.allCases) { sheet in
-                    QuickAddButton(sheet: sheet) {
-                        activeSheet = sheet
-                    }
-                }
-            }
-        }
-    }
-
-    @ViewBuilder
-    private var appIconSection: some View {
-        #if os(iOS)
-        VStack(alignment: .leading, spacing: 12) {
-            sectionHeader(title: "App Icon", detail: nil)
-            LazyVGrid(
-                columns: [GridItem(.adaptive(minimum: 86), spacing: 12)],
-                alignment: .leading,
-                spacing: 12
-            ) {
-                ForEach(AppIconChoice.allCases) { choice in
-                    let isSelected = selectedAppIconName == choice.alternateIconName
-                    Button {
-                        setAppIcon(choice)
-                    } label: {
-                        VStack(spacing: 8) {
-                            Image(choice.previewAssetName)
-                                .resizable()
-                                .aspectRatio(1, contentMode: .fit)
-                                .frame(width: 72, height: 72)
-                                .clipShape(RoundedRectangle(cornerRadius: 16, style: .continuous))
-                                .overlay {
-                                    RoundedRectangle(cornerRadius: 16, style: .continuous)
-                                        .stroke(isSelected ? Color.accentColor : Color.clear, lineWidth: 3)
-                                }
-                                .shadow(color: .black.opacity(0.18), radius: 5, y: 2)
-                            Text(choice.title)
-                                .font(.caption2.weight(.semibold))
-                                .foregroundStyle(isSelected ? Color.accentColor : Color.primary)
-                                .lineLimit(1)
-                                .minimumScaleFactor(0.75)
-                        }
-                        .frame(width: 86, height: 104)
-                        .contentShape(Rectangle())
-                    }
-                    .buttonStyle(.plain)
-                    .disabled(isSettingAppIcon)
-                    .accessibilityLabel(choice.accessibilityLabel)
-                }
-            }
-            if let appIconError {
-                Text(appIconError)
-                    .font(.footnote)
-                    .foregroundStyle(.secondary)
-            }
-        }
-        #else
-        EmptyView()
-        #endif
-    }
-
-    #if os(iOS)
-    private func setAppIcon(_ choice: AppIconChoice) {
-        guard let appIconManager, appIconManager.supportsAlternateIcons else {
-            return
-        }
-        guard selectedAppIconName != choice.alternateIconName else {
-            return
-        }
-
-        isSettingAppIcon = true
-        appIconError = nil
-        Task { @MainActor in
-            do {
-                try await appIconManager.setAlternateIconName(choice.alternateIconName)
-                selectedAppIconName = appIconManager.alternateIconName
-            } catch {
-                appIconError = error.localizedDescription
-                selectedAppIconName = appIconManager.alternateIconName
-            }
-            isSettingAppIcon = false
-        }
-    }
-    #endif
-
-    @ViewBuilder
-    private func sectionHeader(title: String, detail: String?) -> some View {
-        VStack(alignment: .leading, spacing: 4) {
-            Text(title)
-                .font(.title2.weight(.semibold))
-            if let detail, !detail.isEmpty {
-                Text(detail)
-                    .font(.subheadline)
-                    .foregroundStyle(.secondary)
-            }
-        }
-    }
-
-    private var showsInlineQuickActions: Bool {
-        #if os(iOS)
-        true
-        #else
-        false
-        #endif
-    }
-
-    private var showsToolbarAddMenu: Bool {
-        !showsInlineQuickActions
-    }
-
-    private var showsHeaderSubtitle: Bool {
-        !showsInlineQuickActions
-    }
-
-    private var showsAccountsSection: Bool {
-        #if os(iOS)
-        !accountStore.accounts.isEmpty
-        #else
-        true
-        #endif
-    }
-
-    private var showsAppIconSection: Bool {
-        #if os(iOS)
-        appIconManager?.supportsAlternateIcons == true
-        #else
-        false
-        #endif
-    }
-}
-
-private enum AppIconChoice: CaseIterable, Identifiable {
-    case guardian
-    case field
-    case burrow
-    case sentinel
-    case stride
-    case post
-
-    var id: String { previewAssetName }
-
-    var title: String {
-        switch self {
-        case .guardian:
-            "Guardian"
-        case .field:
-            "Field"
-        case .burrow:
-            "Burrow"
-        case .sentinel:
-            "Sentinel"
-        case .stride:
-            "Stride"
-        case .post:
-            "Post"
-        }
-    }
-
-    var previewAssetName: String {
-        switch self {
-        case .guardian:
-            "BurrowPanel01Preview"
-        case .field:
-            "BurrowPanel02Preview"
-        case .burrow:
-            "BurrowPanel03Preview"
-        case .sentinel:
-            "BurrowPanel04Preview"
-        case .stride:
-            "BurrowPanel05Preview"
-        case .post:
-            "BurrowPanel06Preview"
-        }
-    }
-
-    var alternateIconName: String? {
-        switch self {
-        case .guardian:
-            nil
-        case .field:
-            "BurrowPanel02"
-        case .burrow:
-            "BurrowPanel03"
-        case .sentinel:
-            "BurrowPanel04"
-        case .stride:
-            "BurrowPanel05"
-        case .post:
-            "BurrowPanel06"
-        }
-    }
-
-    var accessibilityLabel: String {
-        "\(title) app icon"
-    }
-}
-
-private enum ConfigurationSheet: String, CaseIterable, Identifiable {
-    case wireGuard
-    case tor
-    case tailnet
-
-    var id: String { rawValue }
-
-    var kind: AccountNetworkKind {
-        switch self {
-        case .wireGuard: .wireGuard
-        case .tor: .tor
-        case .tailnet: .tailnet
-        }
-    }
-
-    var iconName: String {
-        switch self {
-        case .wireGuard:
-            "wave.3.right"
-        case .tor:
-            "shield.lefthalf.filled.badge.checkmark"
-        case .tailnet:
-            "network.badge.shield.half.filled"
-        }
-    }
-
-    var quickActionTitle: String {
-        switch self {
-        case .wireGuard:
-            "WireGuard"
-        case .tor:
-            "Tor"
-        case .tailnet:
-            "Tailnet"
-        }
-    }
-
-    var quickActionSubtitle: String {
-        switch self {
-        case .wireGuard:
-            "Import a tunnel"
-        case .tor:
-            "Save an Arti profile"
-        case .tailnet:
-            "Sign in or save a control plane"
-        }
-    }
-
-    var quickActionColor: Color {
-        switch self {
-        case .wireGuard:
-            .blue
-        case .tor, .tailnet:
-            kind.accentColor
-        }
-    }
-}
-
-private struct QuickAddButton: View {
-    let sheet: ConfigurationSheet
-    let action: () -> Void
-
-    var body: some View {
-        Button(action: action) {
-            HStack(spacing: 14) {
-                Image(systemName: sheet.iconName)
-                    .font(.title3.weight(.semibold))
-                    .frame(width: 24)
-
-                VStack(alignment: .leading, spacing: 4) {
-                    Text(sheet.quickActionTitle)
-                        .font(.headline)
-                    Text(sheet.quickActionSubtitle)
-                        .font(.caption)
-                        .opacity(0.88)
-                }
-
-                Spacer()
-            }
-            .frame(maxWidth: .infinity, minHeight: 64, alignment: .leading)
-        }
-        .accessibilityIdentifier("quick-add-\(sheet.rawValue)")
-        .buttonStyle(.floating(color: sheet.quickActionColor, cornerRadius: 18))
-    }
-}
-
-private struct AccountDraft {
-    var title = ""
-    var accountName = ""
-    var identityName = ""
-    var wireGuardConfig = ""
-
-    var discoveryEmail = ""
-    var authority = ""
-    var tailnet = ""
-    var hostname = ProcessInfo.processInfo.hostName
-    var username = ""
-    var secret = ""
-    var authMode: AccountAuthMode = .none
-
-    var torAddresses = "100.64.0.2/32"
-    var torDNS = "1.1.1.1, 1.0.0.1"
-    var torMTU = "1400"
-    var torListen = "127.0.0.1:9040"
-
-    init(sheet: ConfigurationSheet) {
-        switch sheet {
-        case .wireGuard:
-            break
-        case .tor:
-            title = "Default Tor"
-            accountName = "default"
-            identityName = "apple"
-        case .tailnet:
-            title = "Tailnet"
-            accountName = "default"
-            identityName = "apple"
-            authority = TailnetProvider.tailscale.defaultAuthority ?? ""
-            authMode = .web
-        }
-    }
-}
-
-private struct ConfigurationSheetView: View {
-    @Environment(\.dismiss) private var dismiss
-
-    let sheet: ConfigurationSheet
-    let networkViewModel: NetworkViewModel
-    let accountStore: NetworkAccountStore
-
-    @State private var draft: AccountDraft
-    @State private var isSubmitting = false
-    @State private var errorMessage: String?
-    @State private var discoveryStatus: TailnetDiscoveryResponse?
-    @State private var discoveryError: String?
-    @State private var isDiscoveringTailnet = false
-    @State private var authorityProbeStatus: TailnetAuthorityProbeStatus?
-    @State private var authorityProbeError: String?
-    @State private var isProbingAuthority = false
-    @State private var tailnetLoginStatus: TailnetLoginStatus?
-    @State private var tailnetLoginError: String?
-    @State private var tailnetLoginSessionID: String?
-    @State private var isStartingTailnetLogin = false
-    @State private var tailnetPresentedAuthURL: URL?
-    @State private var preserveTailnetLoginSession = false
-    @State private var usesCustomTailnetAuthority = false
-    @State private var showsAdvancedTailnetSettings = false
-    @State private var browserAuthenticator = TailnetBrowserAuthenticator()
-    @State private var tailnetLoginPollTask: Task<Void, Never>?
-    @State private var tailnetDiscoveryTask: Task<Void, Never>?
-    @State private var tailnetProbeTask: Task<Void, Never>?
-    @State private var didRunAutomation = false
-
-    init(
-        sheet: ConfigurationSheet,
-        networkViewModel: NetworkViewModel,
-        accountStore: NetworkAccountStore
-    ) {
-        self.sheet = sheet
-        self.networkViewModel = networkViewModel
-        self.accountStore = accountStore
-        _draft = State(initialValue: AccountDraft(sheet: sheet))
-    }
-
-    var body: some View {
-        NavigationStack {
-            Form {
-                Section {
-                    sheetSummaryCard
-                }
-                .listRowInsets(.init(top: 4, leading: 0, bottom: 4, trailing: 0))
-                .listRowBackground(Color.clear)
-
-                if showsIdentitySection {
-                    Section("Identity") {
-                        identityFields
-                    }
-                }
-
-                switch sheet {
-                case .wireGuard:
-                    Section("WireGuard Configuration") {
-                        TextEditor(text: $draft.wireGuardConfig)
-                            .font(.body.monospaced())
-                            .frame(minHeight: wireGuardEditorHeight)
-                            .contextMenu {
-                                wireGuardContextActions
-                            }
-                    }
-                case .tor:
-                    Section("Tor Preferences") {
-                        TextField("Virtual Addresses", text: $draft.torAddresses)
-                        TextField("DNS Resolvers", text: $draft.torDNS)
-                        TextField("MTU", text: $draft.torMTU)
-                        TextField("Transparent Listener", text: $draft.torListen)
-                    }
-                case .tailnet:
-                    tailnetSections
-                }
-
-                if let errorMessage {
-                    Section {
-                        Text(errorMessage)
-                            .foregroundStyle(.red)
-                    }
-                }
-            }
-            .navigationTitle(sheet.kind.title)
-            #if os(iOS)
-            .navigationBarTitleDisplayMode(.inline)
-            #endif
-            .toolbar {
-                ToolbarItem(placement: .cancellationAction) {
-                    Button("Cancel") {
-                        Task { @MainActor in
-                            await cancelTailnetLoginIfNeeded()
-                            dismiss()
-                        }
-                    }
-                }
-                #if os(iOS)
-                ToolbarItem(placement: .topBarTrailing) {
-                    Menu {
-                        sheetMenuActions
-                    } label: {
-                        Image(systemName: "ellipsis.circle")
-                    }
-                    .accessibilityLabel("More")
-                }
-                #else
-                ToolbarItem(placement: .primaryAction) {
-                    Menu {
-                        sheetMenuActions
-                    } label: {
-                        Image(systemName: "ellipsis.circle")
-                    }
-                    .accessibilityLabel("More")
-                }
-                #endif
-                if !showsBottomActionButton {
-                    ToolbarItem(placement: .confirmationAction) {
-                        Button(confirmationTitle) {
-                            submit()
-                        }
-                        .disabled(isSubmitting || submissionDisabled)
-                    }
-                }
-            }
-        }
-        #if os(macOS)
-        .frame(minWidth: 520, minHeight: 620)
-        #endif
-        .safeAreaInset(edge: .bottom) {
-            if showsBottomActionButton {
-                bottomActionBar
-            }
-        }
-        .onAppear {
-            runAutomationIfNeeded()
-        }
-        .onChange(of: draft.authority) { _, _ in
-            resetAuthorityProbe()
-            if sheet == .tailnet, usesCustomTailnetAuthority {
-                scheduleTailnetAuthorityProbe()
-            }
-        }
-        .onChange(of: draft.discoveryEmail) { _, _ in
-            resetTailnetDiscoveryFeedback()
-            if sheet == .tailnet, !usesCustomTailnetAuthority {
-                scheduleTailnetDiscovery()
-            }
-        }
-        .onChange(of: draft.authMode) { _, newMode in
-            guard newMode != .web else { return }
-            Task { @MainActor in
-                await cancelTailnetLoginIfNeeded()
-            }
-        }
-        .onDisappear {
-            tailnetLoginPollTask?.cancel()
-            tailnetDiscoveryTask?.cancel()
-            tailnetProbeTask?.cancel()
-            browserAuthenticator.cancel()
-            if !preserveTailnetLoginSession {
-                Task { @MainActor in
-                    await cancelTailnetLoginIfNeeded()
-                }
-            }
-        }
-    }
-
-    @ViewBuilder
-    private var identityFields: some View {
-        TextField("Title", text: $draft.title)
-        TextField("Account", text: $draft.accountName)
-        TextField("Identity", text: $draft.identityName)
-        if sheet == .tailnet {
-            TextField("Hostname", text: $draft.hostname)
-                .burrowLoginField()
-                .autocorrectionDisabled()
-        }
-    }
-
-    @ViewBuilder
-    private var tailnetSections: some View {
-        Section("Connection") {
-            TextField("Email address", text: $draft.discoveryEmail)
-                .burrowEmailField()
-                .burrowLoginField()
-                .autocorrectionDisabled()
-                .accessibilityIdentifier("tailnet-discovery-email")
-            .submitLabel(.continue)
-            .onSubmit {
-                if !usesCustomTailnetAuthority {
-                    scheduleTailnetDiscovery(immediate: true)
-                }
-            }
-
-            tailnetServerCard
-
-            if showsAdvancedTailnetSettings {
-                if usesCustomTailnetAuthority {
-                    TextField("Server URL", text: $draft.authority)
-                        .burrowLoginField()
-                        .autocorrectionDisabled()
-                        .accessibilityIdentifier("tailnet-authority")
-                } else {
-                    TextField("Tailnet", text: $draft.tailnet)
-                        .burrowLoginField()
-                        .autocorrectionDisabled()
-                        .accessibilityIdentifier("tailnet-name")
-                }
-            }
-        }
-
-        Section("Authentication") {
-            if showsAdvancedTailnetSettings {
-                Picker("Authentication", selection: $draft.authMode) {
-                    ForEach(availableTailnetAuthModes) { mode in
-                        Text(mode.title).tag(mode)
-                    }
-                }
-                .pickerStyle(.menu)
-            }
-
-            if draft.authMode == .web {
-                Button {
-                    startTailnetLogin()
-                } label: {
-                    Label {
-                        Text(isStartingTailnetLogin ? "Starting Sign-In" : tailnetSignInActionTitle)
-                    } icon: {
-                        Image(systemName: isStartingTailnetLogin ? "hourglass" : "person.badge.key")
-                    }
-                }
-                .buttonStyle(.borderless)
-                .disabled(isStartingTailnetLogin || tailnetLoginActionDisabled)
-                .accessibilityIdentifier("tailnet-start-sign-in")
-
-                if let tailnetLoginStatus {
-                    tailnetLoginCard(status: tailnetLoginStatus, failure: nil)
-                } else if let tailnetLoginError {
-                    tailnetLoginCard(status: nil, failure: tailnetLoginError)
-                }
-            } else {
-                TextField("Username", text: $draft.username)
-                    .burrowLoginField()
-                    .autocorrectionDisabled()
-                if draft.authMode != .none {
-                    SecureField(
-                        draft.authMode == .password ? "Password" : "Preauth Key",
-                        text: $draft.secret
-                    )
-                }
-            }
-
-            Text(tailnetAuthenticationFootnote)
-                .font(.footnote)
-                .foregroundStyle(.secondary)
-        }
-    }
-
-    private var sheetSummaryCard: some View {
-        VStack(alignment: .leading, spacing: 10) {
-            HStack(spacing: 12) {
-                Image(systemName: sheet.iconName)
-                    .font(.title3.weight(.semibold))
-                    .foregroundStyle(sheetAccentColor)
-                    .frame(width: 28, height: 28)
-                    .background(
-                        Circle()
-                            .fill(sheetAccentColor.opacity(0.14))
-                    )
-
-                VStack(alignment: .leading, spacing: 3) {
-                    Text(summaryTitle)
-                        .font(.headline)
-                    Text(sheet.kind.subtitle)
-                        .font(.footnote)
-                        .foregroundStyle(.secondary)
-                }
-
-                Spacer()
-            }
-
-            if let availabilityNote = sheet.kind.availabilityNote {
-                Text(availabilityNote)
-                    .font(.footnote)
-                    .foregroundStyle(.secondary)
-            }
-
-            if sheet == .tailnet {
-                labeledValue("Server", tailnetServerDisplayLabel)
-                if let connectionSummary = tailnetConnectionSummary {
-                    Text(connectionSummary)
-                        .font(.footnote.weight(.medium))
-                        .foregroundStyle(tailnetConnectionSummaryColor)
-                }
-                if tailnetLoginStatus?.running == true {
-                    HStack(spacing: 8) {
-                        summaryBadge("Signed In")
-                    }
-                }
-            }
-        }
-        .padding(14)
-        .background(
-            RoundedRectangle(cornerRadius: 18)
-                .fill(.thinMaterial)
-        )
-    }
-
-    private var tailnetServerCard: some View {
-        VStack(alignment: .leading, spacing: 8) {
-            HStack(alignment: .top, spacing: 12) {
-                VStack(alignment: .leading, spacing: 4) {
-                    Text(usesCustomTailnetAuthority ? "Custom Server" : "Server")
-                        .font(.subheadline.weight(.medium))
-                    Text(tailnetServerDisplayLabel)
-                        .font(.footnote.monospaced())
-                        .foregroundStyle(.secondary)
-                        .textSelection(.enabled)
-                }
-
-                Spacer()
-
-                if isDiscoveringTailnet || isProbingAuthority {
-                    ProgressView()
-                        .controlSize(.small)
-                } else if let summary = tailnetConnectionSummary {
-                    Text(summary)
-                        .font(.caption.weight(.medium))
-                        .foregroundStyle(tailnetConnectionSummaryColor)
-                }
-            }
-
-            if let detail = tailnetServerDetail {
-                Text(detail)
-                    .font(.footnote)
-                    .foregroundStyle(.secondary)
-            }
-        }
-        .padding(12)
-        .background(
-            RoundedRectangle(cornerRadius: 16)
-                .fill(.thinMaterial)
-        )
-        .accessibilityIdentifier("tailnet-server-card")
-    }
-
-    private func tailnetAuthorityProbeCard(
-        status: TailnetAuthorityProbeStatus?,
-        failure: String?
-    ) -> some View {
-        VStack(alignment: .leading, spacing: 6) {
-            if let status {
-                Text(status.summary)
-                    .font(.subheadline.weight(.medium))
-                Text(status.detail ?? "HTTP \(status.statusCode) from \(status.authority)")
-                    .font(.footnote)
-                    .foregroundStyle(.secondary)
-                    .textSelection(.enabled)
-            } else if let failure {
-                Text("Connection failed")
-                    .font(.subheadline.weight(.medium))
-                    .foregroundStyle(.red)
-                Text(failure)
-                    .font(.footnote)
-                    .foregroundStyle(.secondary)
-            }
-        }
-        .padding(12)
-        .background(
-            RoundedRectangle(cornerRadius: 16)
-                .fill(.thinMaterial)
-        )
-        .accessibilityIdentifier("tailnet-authority-probe-card")
-    }
-
-    private func tailnetDiscoveryCard(
-        status: TailnetDiscoveryResponse?,
-        failure: String?
-    ) -> some View {
-        VStack(alignment: .leading, spacing: 6) {
-            if let status {
-                Text("Discovered Tailnet Server")
-                    .font(.subheadline.weight(.medium))
-                Text(status.authority)
-                    .font(.footnote.monospaced())
-                    .foregroundStyle(.secondary)
-                    .textSelection(.enabled)
-                Text(status.provider == .tailscale ? "Managed authority" : "Custom authority")
-                    .font(.footnote)
-                    .foregroundStyle(.secondary)
-                if let oidcIssuer = status.oidcIssuer {
-                    Text("OIDC: \(oidcIssuer)")
-                        .font(.footnote)
-                        .foregroundStyle(.secondary)
-                        .lineLimit(3)
-                        .textSelection(.enabled)
-                }
-            } else if let failure {
-                Text("Discovery failed")
-                    .font(.subheadline.weight(.medium))
-                    .foregroundStyle(.red)
-                Text(failure)
-                    .font(.footnote)
-                    .foregroundStyle(.secondary)
-            }
-        }
-        .padding(12)
-        .background(
-            RoundedRectangle(cornerRadius: 16)
-                .fill(.thinMaterial)
-        )
-        .accessibilityIdentifier("tailnet-discovery-card")
-    }
-
-    private func tailnetLoginCard(
-        status: TailnetLoginStatus?,
-        failure: String?
-    ) -> some View {
-        VStack(alignment: .leading, spacing: 6) {
-            if let status {
-                Text(status.running ? "Signed In" : status.needsLogin ? "Browser Sign-In Required" : "Checking Sign-In")
-                    .font(.subheadline.weight(.medium))
-                if let tailnetName = status.tailnetName, !tailnetName.isEmpty {
-                    Text("Tailnet: \(tailnetName)")
-                        .font(.footnote)
-                        .foregroundStyle(.secondary)
-                }
-                if let selfDNSName = status.selfDNSName, !selfDNSName.isEmpty {
-                    Text(selfDNSName)
-                        .font(.footnote.monospaced())
-                        .foregroundStyle(.secondary)
-                        .textSelection(.enabled)
-                }
-                if !status.tailnetIPs.isEmpty {
-                    Text(status.tailnetIPs.joined(separator: ", "))
-                        .font(.footnote.monospaced())
-                        .foregroundStyle(.secondary)
-                        .textSelection(.enabled)
-                }
-                if !status.health.isEmpty {
-                    Text(status.health.joined(separator: " • "))
-                        .font(.footnote)
-                        .foregroundStyle(.secondary)
-                }
-            } else if let failure {
-                Text("Sign-In failed")
-                    .font(.subheadline.weight(.medium))
-                    .foregroundStyle(.red)
-                Text(failure)
-                    .font(.footnote)
-                    .foregroundStyle(.secondary)
-            }
-        }
-        .padding(12)
-        .background(
-            RoundedRectangle(cornerRadius: 16)
-                .fill(.thinMaterial)
-        )
-        .accessibilityIdentifier("tailnet-login-card")
-    }
-
-    private func summaryBadge(_ label: String) -> some View {
-        Text(label)
-            .font(.caption.weight(.medium))
-            .foregroundStyle(.secondary)
-            .padding(.horizontal, 10)
-            .padding(.vertical, 5)
-            .background(
-                Capsule()
-                    .fill(.white.opacity(0.5))
-            )
-    }
-
-    @ViewBuilder
-    private var bottomActionBar: some View {
-        VStack(spacing: 0) {
-            Divider()
-                .overlay(.white.opacity(0.3))
-            Button(confirmationTitle) {
-                submit()
-            }
-            .buttonStyle(.floating(color: sheetAccentColor, cornerRadius: 18))
-            .disabled(isSubmitting || submissionDisabled)
-            .padding(.horizontal)
-            .padding(.top, 12)
-            .padding(.bottom, 8)
-        }
-        .background(.ultraThinMaterial)
-    }
-
-    @ViewBuilder
-    private var sheetMenuActions: some View {
-        Button("Use Suggested Identity") {
-            applySuggestedIdentity()
-        }
-
-        switch sheet {
-        case .wireGuard:
-            Button("Paste Configuration") {
-                pasteWireGuardConfiguration()
-            }
-            .disabled(clipboardString?.isEmpty ?? true)
-
-            Button("Clear Configuration", role: .destructive) {
-                draft.wireGuardConfig = ""
-            }
-            .disabled(draft.wireGuardConfig.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty)
-
-        case .tor:
-            Menu("Presets") {
-                Button("Recommended Tor Defaults") {
-                    applyTorDefaults()
-                }
-                Button("Restore Suggested Identity") {
-                    applySuggestedIdentity()
-                }
-            }
-
-        case .tailnet:
-            Button(usesCustomTailnetAuthority ? "Use Automatic Server" : "Edit Custom Server") {
-                toggleTailnetAuthorityMode()
-            }
-
-            Button(showsAdvancedTailnetSettings ? "Hide Advanced Settings" : "Show Advanced Settings") {
-                showsAdvancedTailnetSettings.toggle()
-            }
-
-            if showsAdvancedTailnetSettings, availableTailnetAuthModes.count > 1 {
-                Menu("Authentication") {
-                    ForEach(availableTailnetAuthModes) { mode in
-                        Button(mode.title) {
-                            draft.authMode = mode
-                            if mode == .none {
-                                draft.secret = ""
-                            }
-                        }
-                    }
-                }
-            }
-
-            Button("Refresh Server Lookup") {
-                scheduleTailnetDiscovery(immediate: true)
-            }
-            .disabled(usesCustomTailnetAuthority || normalizedOptional(draft.discoveryEmail) == nil)
-        }
-    }
-
-    @ViewBuilder
-    private var wireGuardContextActions: some View {
-        Button("Paste Configuration") {
-            pasteWireGuardConfiguration()
-        }
-        .disabled(clipboardString?.isEmpty ?? true)
-
-        Button("Clear", role: .destructive) {
-            draft.wireGuardConfig = ""
-        }
-        .disabled(draft.wireGuardConfig.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty)
-    }
-
-    private var sheetAccentColor: Color {
-        switch sheet {
-        case .wireGuard:
-            .blue
-        case .tor, .tailnet:
-            sheet.kind.accentColor
-        }
-    }
-
-    private var summaryTitle: String {
-        switch sheet {
-        case .wireGuard:
-            "Import WireGuard"
-        case .tor:
-            "Configure Tor"
-        case .tailnet:
-            "Connect Tailnet"
-        }
-    }
-
-    private var showsBottomActionButton: Bool {
-        #if os(iOS)
-        return true
-        #else
-        return false
-        #endif
-    }
-
-    private var showsIdentitySection: Bool {
-        switch sheet {
-        case .wireGuard, .tor:
-            return true
-        case .tailnet:
-            return showsAdvancedTailnetSettings
-        }
-    }
-
-    private var wireGuardEditorHeight: CGFloat {
-        #if os(iOS)
-        180
-        #else
-        220
-        #endif
-    }
-
-    private var confirmationTitle: String {
-        switch sheet {
-        case .wireGuard:
-            return "Add Network"
-        case .tor:
-            return "Save Account"
-        case .tailnet:
-            return "Save Account"
-        }
-    }
-
-    private var tailnetLoginActionDisabled: Bool {
-        switch sheet {
-        case .tailnet:
-            if usesCustomTailnetAuthority {
-                return normalizedOptional(draft.authority) == nil
-            }
-            return false
-        case .wireGuard, .tor:
-            return true
-        }
-    }
-
-    private var submissionDisabled: Bool {
-        switch sheet {
-        case .wireGuard:
-            return draft.wireGuardConfig.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
-        case .tor:
-            return normalizedOptional(draft.accountName) == nil || normalizedOptional(draft.identityName) == nil
-        case .tailnet:
-            if normalizedOptional(draft.accountName) == nil || normalizedOptional(draft.identityName) == nil {
-                return true
-            }
-            if normalizedOptional(draft.authority) == nil {
-                return true
-            }
-            if draft.authMode == .web {
-                return tailnetLoginStatus?.running != true
-            }
-            if draft.authMode != .none && normalizedOptional(draft.secret) == nil {
-                return true
-            }
-            return false
-        }
-    }
-
-    private var tailnetServerDisplayLabel: String {
-        if usesCustomTailnetAuthority {
-            return normalizedOptional(draft.authority)
-                ?? "Enter a custom Tailnet server"
-        }
-        return TailnetProvider.tailscale.defaultAuthority ?? "Tailscale managed"
-    }
-
-    private var tailnetServerDetail: String? {
-        if usesCustomTailnetAuthority {
-            if let discovery = discoveryStatus {
-                return "Discovered from \(discovery.domain)."
-            }
-            if let discoveryError {
-                return discoveryError
-            }
-            return "Use a custom Tailnet authority when your domain does not advertise one."
-        }
-        return "Continue with Tailscale, or open advanced settings to use a custom server."
-    }
-
-    private var tailnetConnectionSummary: String? {
-        if isDiscoveringTailnet {
-            return "Finding server"
-        }
-        if isProbingAuthority {
-            return "Checking"
-        }
-        if let authorityProbeStatus {
-            return authorityProbeStatus.summary
-        }
-        if authorityProbeError != nil {
-            return "Unavailable"
-        }
-        return nil
-    }
-
-    private var tailnetConnectionSummaryColor: Color {
-        if authorityProbeError != nil {
-            return .red
-        }
-        return .secondary
-    }
-
-    private func submit() {
-        isSubmitting = true
-        errorMessage = nil
-
-        Task { @MainActor in
-            defer { isSubmitting = false }
-            do {
-                switch sheet {
-                case .wireGuard:
-                    try await submitWireGuard()
-                    dismiss()
-                case .tor:
-                    try submitTor()
-                    dismiss()
-                case .tailnet:
-                    try await submitTailnet()
-                }
-            } catch {
-                errorMessage = error.localizedDescription
-            }
-        }
-    }
-
-    private func submitWireGuard() async throws {
-        let networkID = try await networkViewModel.addWireGuardNetwork(
-            configText: draft.wireGuardConfig
-        )
-
-        let title = titleOrFallback("WireGuard \(networkID)")
-        let record = NetworkAccountRecord(
-            id: UUID(),
-            kind: .wireGuard,
-            title: title,
-            authority: nil,
-            provider: nil,
-            accountName: normalized(draft.accountName, fallback: "default"),
-            identityName: normalized(draft.identityName, fallback: "network-\(networkID)"),
-            hostname: nil,
-            username: nil,
-            tailnet: nil,
-            authMode: .none,
-            note: "Linked to daemon network #\(networkID).",
-            createdAt: .now,
-            updatedAt: .now
-        )
-        try accountStore.upsert(record, secret: nil)
-    }
-
-    private func submitTor() throws {
-        let title = titleOrFallback("Tor \(normalized(draft.identityName, fallback: "apple"))")
-        let note = [
-            "Addresses: \(csvSummary(draft.torAddresses))",
-            "DNS: \(csvSummary(draft.torDNS))",
-            "MTU: \(normalized(draft.torMTU, fallback: "1400"))",
-            "Listen: \(normalized(draft.torListen, fallback: "127.0.0.1:9040"))",
-        ].joined(separator: " • ")
-
-        let record = NetworkAccountRecord(
-            id: UUID(),
-            kind: .tor,
-            title: title,
-            authority: "arti://local",
-            provider: nil,
-            accountName: normalized(draft.accountName, fallback: "default"),
-            identityName: normalized(draft.identityName, fallback: "apple"),
-            hostname: nil,
-            username: nil,
-            tailnet: nil,
-            authMode: .none,
-            note: note,
-            createdAt: .now,
-            updatedAt: .now
-        )
-        try accountStore.upsert(record, secret: nil)
-    }
-
-    private func submitTailnet() async throws {
-        let secret = (draft.authMode == .none || draft.authMode == .web) ? nil : draft.secret
-        let username = normalizedOptional(draft.username)
-        preserveTailnetLoginSession = draft.authMode == .web && tailnetLoginStatus?.running == true
-        try await saveTailnetAccount(secret: secret, username: username)
-        dismiss()
-    }
-
-    private func runAutomationIfNeeded() {
-        guard !didRunAutomation,
-              sheet == .tailnet,
-              let automation = BurrowAutomationConfig.current,
-              automation.action == .tailnetLogin || automation.action == .tailnetProbe
-        else {
-            return
-        }
-
-        didRunAutomation = true
-        draft.title = automation.title ?? draft.title
-        draft.accountName = automation.accountName ?? draft.accountName
-        draft.identityName = automation.identityName ?? draft.identityName
-        draft.hostname = automation.hostname ?? draft.hostname
-
-        Task { @MainActor in
-            switch automation.action {
-            case .tailnetLogin:
-                applyTailnetDefaults(for: .tailscale)
-                startTailnetLogin()
-            case .tailnetProbe:
-                usesCustomTailnetAuthority = true
-                showsAdvancedTailnetSettings = true
-                draft.authority = automation.authority ?? TailnetProvider.headscale.defaultAuthority ?? draft.authority
-                probeTailnetAuthority()
-            }
-        }
-    }
-
-    private func saveTailnetAccount(secret: String?, username: String?) async throws {
-        let provider = inferredTailnetProvider
-        let title = titleOrFallback(
-            hostnameFallback(from: draft.authority, fallback: "Tailnet")
-        )
-
-        let payload = TailnetNetworkPayload(
-            provider: provider,
-            authority: normalizedOptional(draft.authority) ?? normalizedOptional(provider.defaultAuthority ?? ""),
-            account: normalized(draft.accountName, fallback: "default"),
-            identity: normalized(draft.identityName, fallback: "apple"),
-            tailnet: normalizedOptional(draft.tailnet),
-            hostname: normalizedOptional(draft.hostname)
-        )
-
-        var noteParts: [String] = [
-            "Server: \(hostnameFallback(from: payload.authority ?? "", fallback: "tailnet"))",
-        ]
-
-        if showsAdvancedTailnetSettings || draft.authMode != .web {
-            noteParts.append("Auth: \(draft.authMode.title)")
-        }
-
-        if draft.authMode == .web, tailnetLoginStatus?.running == true {
-            noteParts.append("Browser sign-in complete")
-        }
-
-        do {
-            let networkID = try await networkViewModel.addTailnetNetwork(payload: payload)
-            noteParts.append("Linked to daemon network #\(networkID)")
-        } catch {
-            noteParts.append("Daemon network add pending")
-        }
-
-        let record = NetworkAccountRecord(
-            id: UUID(),
-            kind: .tailnet,
-            title: title,
-            authority: payload.authority,
-            provider: provider,
-            accountName: payload.account,
-            identityName: payload.identity,
-            hostname: payload.hostname,
-            username: username,
-            tailnet: payload.tailnet,
-            authMode: draft.authMode,
-            note: noteParts.joined(separator: " • "),
-            createdAt: .now,
-            updatedAt: .now
-        )
-        try accountStore.upsert(record, secret: secret)
-    }
-
-    private func applySuggestedIdentity() {
-        let defaults = AccountDraft(sheet: sheet)
-        if draft.title.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty {
-            draft.title = defaults.title
-        }
-        draft.accountName = defaults.accountName
-        draft.identityName = defaults.identityName
-        if sheet == .tailnet {
-            draft.hostname = defaults.hostname
-        }
-    }
-
-    private func applyTorDefaults() {
-        let defaults = AccountDraft(sheet: .tor)
-        draft.title = defaults.title
-        draft.accountName = defaults.accountName
-        draft.identityName = defaults.identityName
-        draft.torAddresses = defaults.torAddresses
-        draft.torDNS = defaults.torDNS
-        draft.torMTU = defaults.torMTU
-        draft.torListen = defaults.torListen
-    }
-
-    private func applyTailnetDefaults(for provider: TailnetProvider) {
-        resetTailnetDiscoveryFeedback()
-        usesCustomTailnetAuthority = provider != .tailscale
-        draft.authority = provider.defaultAuthority ?? ""
-        if !availableTailnetAuthModes.contains(draft.authMode) {
-            draft.authMode = .web
-        }
-    }
-
-    private func startTailnetLogin() {
-        isStartingTailnetLogin = true
-        tailnetLoginError = nil
-        preserveTailnetLoginSession = false
-
-        Task { @MainActor in
-            defer { isStartingTailnetLogin = false }
-            do {
-                let authority = try await resolveTailnetAuthorityForLogin()
-                let status = try await networkViewModel.startTailnetLogin(
-                    accountName: normalized(draft.accountName, fallback: "default"),
-                    identityName: normalized(draft.identityName, fallback: "apple"),
-                    hostname: normalizedOptional(draft.hostname),
-                    authority: authority
-                )
-                tailnetLoginSessionID = status.sessionID
-                updateTailnetLoginStatus(status)
-                beginTailnetLoginPolling(sessionID: status.sessionID)
-            } catch {
-                tailnetLoginError = error.localizedDescription
-            }
-        }
-    }
-
-    private func probeTailnetAuthority() {
-        guard let authority = normalizedOptional(draft.authority) else {
-            authorityProbeStatus = nil
-            authorityProbeError = "Enter a server URL first."
-            return
-        }
-
-        isProbingAuthority = true
-        authorityProbeStatus = nil
-        authorityProbeError = nil
-
-        Task { @MainActor in
-            defer { isProbingAuthority = false }
-            do {
-                authorityProbeStatus = try await networkViewModel.probeTailnetAuthority(authority)
-            } catch {
-                authorityProbeError = error.localizedDescription
-            }
-        }
-    }
-
-    private func resetAuthorityProbe() {
-        tailnetProbeTask?.cancel()
-        authorityProbeStatus = nil
-        authorityProbeError = nil
-        tailnetLoginError = nil
-    }
-
-    private func resetTailnetDiscoveryFeedback() {
-        tailnetDiscoveryTask?.cancel()
-        discoveryStatus = nil
-        discoveryError = nil
-    }
-
-    private func discoverTailnetAuthority() {
-        guard let email = normalizedOptional(draft.discoveryEmail) else {
-            discoveryStatus = nil
-            discoveryError = "Enter an email address first."
-            return
-        }
-
-        isDiscoveringTailnet = true
-        discoveryStatus = nil
-        discoveryError = nil
-
-        Task { @MainActor in
-            defer { isDiscoveringTailnet = false }
-            do {
-                let discovery = try await networkViewModel.discoverTailnet(email: email)
-                discoveryStatus = discovery
-                draft.authority = discovery.authority
-                probeTailnetAuthority()
-            } catch {
-                discoveryError = error.localizedDescription
-            }
-        }
-    }
-
-    private func scheduleTailnetDiscovery(immediate: Bool = false) {
-        guard sheet == .tailnet else { return }
-        tailnetDiscoveryTask?.cancel()
-
-        guard !usesCustomTailnetAuthority else {
-            discoveryStatus = nil
-            discoveryError = nil
-            return
-        }
-
-        guard normalizedOptional(draft.discoveryEmail) != nil else {
-            discoveryStatus = nil
-            discoveryError = nil
-            draft.authority = TailnetProvider.tailscale.defaultAuthority ?? ""
-            return
-        }
-
-        tailnetDiscoveryTask = Task { @MainActor in
-            if !immediate {
-                try? await Task.sleep(for: .milliseconds(450))
-            }
-            guard !Task.isCancelled else { return }
-            discoverTailnetAuthority()
-        }
-    }
-
-    private func scheduleTailnetAuthorityProbe() {
-        guard sheet == .tailnet else { return }
-        tailnetProbeTask?.cancel()
-        guard normalizedOptional(draft.authority) != nil else { return }
-
-        tailnetProbeTask = Task { @MainActor in
-            try? await Task.sleep(for: .milliseconds(300))
-            guard !Task.isCancelled else { return }
-            probeTailnetAuthority()
-        }
-    }
-
-    private func toggleTailnetAuthorityMode() {
-        let discoveredAuthority = discoveryStatus?.authority
-        usesCustomTailnetAuthority.toggle()
-        resetTailnetDiscoveryFeedback()
-        resetAuthorityProbe()
-        if usesCustomTailnetAuthority {
-            draft.authority = discoveredAuthority ?? draft.authority
-        } else {
-            draft.authority = TailnetProvider.tailscale.defaultAuthority ?? ""
-            scheduleTailnetDiscovery(immediate: normalizedOptional(draft.discoveryEmail) != nil)
-        }
-    }
-
-    private func resolveTailnetAuthorityForLogin() async throws -> String {
-        if !usesCustomTailnetAuthority {
-            let authority = TailnetProvider.tailscale.defaultAuthority ?? ""
-            draft.authority = authority
-            scheduleTailnetAuthorityProbe()
-            return authority
-        }
-
-        if let authority = normalizedOptional(draft.authority) {
-            return authority
-        }
-
-        if let email = normalizedOptional(draft.discoveryEmail) {
-            let discovery = try await networkViewModel.discoverTailnet(email: email)
-            discoveryStatus = discovery
-            discoveryError = nil
-            draft.authority = discovery.authority
-            scheduleTailnetAuthorityProbe()
-            return discovery.authority
-        }
-
-        throw NSError(domain: "BurrowTailnet", code: 1, userInfo: [
-            NSLocalizedDescriptionKey: "Enter an email address or a custom server URL first."
-        ])
-    }
-
-    private func beginTailnetLoginPolling(sessionID: String) {
-        tailnetLoginPollTask?.cancel()
-        tailnetLoginPollTask = Task { @MainActor in
-            while !Task.isCancelled {
-                do {
-                    let status = try await networkViewModel.tailnetLoginStatus(sessionID: sessionID)
-                    updateTailnetLoginStatus(status)
-                    if status.running {
-                        tailnetLoginPollTask = nil
-                        return
-                    }
-                } catch {
-                    tailnetLoginError = error.localizedDescription
-                    tailnetLoginPollTask = nil
-                    return
-                }
-                try? await Task.sleep(for: .seconds(1))
-            }
-        }
-    }
-
-    private func updateTailnetLoginStatus(_ status: TailnetLoginStatus) {
-        tailnetLoginStatus = status
-        tailnetLoginError = nil
-        tailnetLoginSessionID = status.sessionID
-
-        if status.running {
-            browserAuthenticator.cancel()
-            tailnetPresentedAuthURL = nil
-            return
-        }
-
-        guard let authURL = status.authURL else {
-            return
-        }
-
-        if tailnetPresentedAuthURL != authURL {
-            tailnetPresentedAuthURL = authURL
-            browserAuthenticator.start(url: authURL) { [sessionID = status.sessionID] in
-                Task { @MainActor in
-                    if tailnetLoginStatus?.running != true {
-                        tailnetLoginSessionID = sessionID
-                    }
-                }
-            }
-        }
-    }
-
-    private func cancelTailnetLoginIfNeeded() async {
-        tailnetLoginPollTask?.cancel()
-        tailnetLoginPollTask = nil
-        browserAuthenticator.cancel()
-        tailnetPresentedAuthURL = nil
-
-        guard tailnetLoginStatus?.running != true,
-              let sessionID = tailnetLoginSessionID
-        else {
-            return
-        }
-
-        do {
-            try await networkViewModel.cancelTailnetLogin(sessionID: sessionID)
-        } catch {
-            tailnetLoginError = error.localizedDescription
-        }
-
-        tailnetLoginStatus = nil
-        tailnetLoginSessionID = nil
-    }
-
-    private func pasteWireGuardConfiguration() {
-        guard let clipboardString else { return }
-        draft.wireGuardConfig = clipboardString
-    }
-
-    private var clipboardString: String? {
-        #if canImport(UIKit)
-        UIPasteboard.general.string
-        #elseif canImport(AppKit)
-        NSPasteboard.general.string(forType: .string)
-        #else
-        nil
-        #endif
-    }
-
-    private func normalized(_ value: String, fallback: String) -> String {
-        let trimmed = value.trimmingCharacters(in: .whitespacesAndNewlines)
-        return trimmed.isEmpty ? fallback : trimmed
-    }
-
-    private func normalizedOptional(_ value: String) -> String? {
-        let trimmed = value.trimmingCharacters(in: .whitespacesAndNewlines)
-        return trimmed.isEmpty ? nil : trimmed
-    }
-
-    private func titleOrFallback(_ fallback: String) -> String {
-        normalized(draft.title, fallback: fallback)
-    }
-
-    private func csvSummary(_ value: String) -> String {
-        value
-            .split(separator: ",")
-            .map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
-            .filter { !$0.isEmpty }
-            .joined(separator: ", ")
-    }
-
-    private func hostnameFallback(from value: String, fallback: String) -> String {
-        guard let url = URL(string: value), let host = url.host, !host.isEmpty else {
-            let trimmed = value.trimmingCharacters(in: .whitespacesAndNewlines)
-            return trimmed.isEmpty ? fallback : trimmed
-        }
-        return host
-    }
-
-    private var availableTailnetAuthModes: [AccountAuthMode] {
-        [.web, .none, .password, .preauthKey]
-    }
-
-    private var tailnetSignInActionTitle: String {
-        if tailnetLoginStatus?.running == true {
-            return "Signed In"
-        }
-        if tailnetLoginSessionID != nil {
-            return "Resume Sign-In"
-        }
-        return "Continue with Tailscale"
-    }
-
-    private var tailnetAuthenticationFootnote: String {
-        switch draft.authMode {
-        case .web:
-            if usesCustomTailnetAuthority {
-                return "Burrow signs in through the daemon using your custom Tailnet server."
-            }
-            return "Burrow signs in through the daemon using Tailscale's managed browser flow."
-        case .none:
-            return "Save the authority only. Useful when the control plane handles authentication elsewhere."
-        case .password, .preauthKey:
-            return "Tailnet account material stays on-device. Burrow stores the authority and credentials for daemon-managed registration and refresh."
-        }
-    }
-
-    private var inferredTailnetProvider: TailnetProvider {
-        TailnetProvider.inferred(
-            authority: normalizedOptional(draft.authority),
-            explicit: discoveryStatus?.provider
-        )
-    }
-
-    @ViewBuilder
-    private func labeledValue(_ label: String, _ value: String) -> some View {
-        VStack(alignment: .leading, spacing: 2) {
-            Text(label)
-                .font(.caption)
-                .foregroundStyle(.secondary)
-            Text(value)
-                .font(.body.monospaced())
-        }
-    }
-}
-
-private struct AccountRowView: View {
-    let account: NetworkAccountRecord
-    let hasSecret: Bool
-
-    var body: some View {
-        VStack(alignment: .leading, spacing: 10) {
-            HStack(alignment: .top) {
-                VStack(alignment: .leading, spacing: 4) {
-                    Text(account.title)
-                        .font(.headline)
-                    Text(account.kind.title)
-                    .font(.subheadline)
-                    .foregroundStyle(account.kind.accentColor)
-                }
-                Spacer()
-                if hasSecret {
-                    Label("Credential stored", systemImage: "key.fill")
-                        .font(.caption)
-                        .foregroundStyle(.secondary)
-                }
-            }
-
-            if let authority = account.authority {
-                labeledValue("Authority", authority)
-            }
-
-            labeledValue("Account", account.accountName)
-            labeledValue("Identity", account.identityName)
-
-            if let hostname = account.hostname {
-                labeledValue("Hostname", hostname)
-            }
-
-            if let username = account.username {
-                labeledValue("Username", username)
-            }
-
-            if let tailnet = account.tailnet {
-                labeledValue("Tailnet", tailnet)
-            }
-
-            if let note = account.note {
-                Text(note)
-                    .font(.footnote)
-                    .foregroundStyle(.secondary)
-            }
-        }
-        .padding()
-        .frame(maxWidth: .infinity, alignment: .leading)
-        .background(
-            RoundedRectangle(cornerRadius: 16)
-                .fill(.thinMaterial)
-        )
-    }
-
-    @ViewBuilder
-    private func labeledValue(_ label: String, _ value: String) -> some View {
-        VStack(alignment: .leading, spacing: 2) {
-            Text(label)
-                .font(.caption)
-                .foregroundStyle(.secondary)
-            Text(value)
-                .font(.body.monospaced())
-        }
-    }
-}
-
-private extension View {
-    @ViewBuilder
-    func burrowLoginField() -> some View {
-        #if os(iOS)
-        textInputAutocapitalization(.never)
-        #else
-        self
-        #endif
-    }
-
-    @ViewBuilder
-    func burrowEmailField() -> some View {
-        #if os(iOS)
-        textInputAutocapitalization(.never)
-            .keyboardType(.emailAddress)
-        #else
-        self
-        #endif
-    }
-}
-
-#if canImport(AuthenticationServices)
-@MainActor
-private final class TailnetBrowserAuthenticator: NSObject {
-    private var session: ASWebAuthenticationSession?
-    private static var prefersEphemeralSessionForCurrentProcess: Bool {
-        let rawValue = ProcessInfo.processInfo.environment["BURROW_UI_TEST_EPHEMERAL_AUTH"]?
-            .trimmingCharacters(in: .whitespacesAndNewlines)
-            .lowercased()
-        return rawValue == "1" || rawValue == "true" || rawValue == "yes"
-    }
-
-    func start(url: URL, onDismiss: @escaping @Sendable () -> Void) {
-        cancel()
-        let session = ASWebAuthenticationSession(url: url, callbackURLScheme: nil) { _, _ in
-            onDismiss()
-        }
-        session.presentationContextProvider = self
-        session.prefersEphemeralWebBrowserSession = Self.prefersEphemeralSessionForCurrentProcess
-        self.session = session
-        _ = session.start()
-    }
-
-    func cancel() {
-        session?.cancel()
-        session = nil
-    }
-}
-
-extension TailnetBrowserAuthenticator: ASWebAuthenticationPresentationContextProviding {
-    func presentationAnchor(for session: ASWebAuthenticationSession) -> ASPresentationAnchor {
-        #if canImport(AppKit)
-        return NSApplication.shared.keyWindow
-            ?? NSApplication.shared.windows.first
-            ?? ASPresentationAnchor()
-        #elseif canImport(UIKit)
-        return ASPresentationAnchor()
-        #else
-        return ASPresentationAnchor()
-        #endif
-    }
-}
-#else
-@MainActor
-private final class TailnetBrowserAuthenticator {
-    func start(url: URL, onDismiss: @escaping @Sendable () -> Void) {
-        _ = url
-        onDismiss()
-    }
-
-    func cancel() {}
-}
-#endif
-
-private struct BurrowAutomationConfig {
-    enum Action: String {
-        case tailnetLogin = "tailnet-login"
-        case tailnetProbe = "tailnet-probe"
-    }
-
-    let action: Action
-    let title: String?
-    let accountName: String?
-    let identityName: String?
-    let hostname: String?
-    let authority: String?
-
-    static let current: BurrowAutomationConfig? = {
-        let environment = ProcessInfo.processInfo.environment
-        guard let rawAction = environment["BURROW_UI_AUTOMATION"],
-              let action = Action(rawValue: rawAction)
-        else {
-            return nil
-        }
-
-        return BurrowAutomationConfig(
-            action: action,
-            title: environment["BURROW_UI_AUTOMATION_TITLE"],
-            accountName: environment["BURROW_UI_AUTOMATION_ACCOUNT"],
-            identityName: environment["BURROW_UI_AUTOMATION_IDENTITY"],
-            hostname: environment["BURROW_UI_AUTOMATION_HOSTNAME"],
-            authority: environment["BURROW_UI_AUTOMATION_AUTHORITY"]
-        )
-    }()
-}
-
-#if DEBUG
-struct NetworkView_Previews: PreviewProvider {
-    static var previews: some View {
-        BurrowView()
-            .environment(\.tunnel, PreviewTunnel())
-    }
-}
-#endif
diff --git a/Apple/UI/FloatingButtonStyle.swift b/Apple/UI/FloatingButtonStyle.swift
deleted file mode 100644
index 53ab5ed..0000000
--- a/Apple/UI/FloatingButtonStyle.swift
+++ /dev/null
@@ -1,50 +0,0 @@
-import SwiftUI
-
-struct FloatingButtonStyle: ButtonStyle {
-    static let duration = 0.08
-
-    var color: Color
-    var cornerRadius: CGFloat
-
-    func makeBody(configuration: Configuration) -> some View {
-        configuration.label
-            .font(.headline)
-            .foregroundColor(.white)
-            .frame(minHeight: 48)
-            .padding(.horizontal)
-            .background(
-                RoundedRectangle(cornerRadius: cornerRadius)
-                    .fill(
-                        LinearGradient(
-                            colors: [
-                                configuration.isPressed ? color.opacity(0.9) : color.opacity(0.9),
-                                configuration.isPressed ? color.opacity(0.9) : color
-                            ],
-                            startPoint: .init(x: 0.2, y: 0),
-                            endPoint: .init(x: 0.8, y: 1)
-                        )
-                    )
-                    .background(
-                        RoundedRectangle(cornerRadius: cornerRadius)
-                            .fill(configuration.isPressed ? .black : .white)
-                    )
-            )
-            .shadow(color: .black.opacity(configuration.isPressed ? 0.0 : 0.1), radius: 2.5, x: 0, y: 2)
-            .scaleEffect(configuration.isPressed ? 0.975 : 1.0)
-            .padding(.bottom, 2)
-            .animation(
-                configuration.isPressed ? .easeOut(duration: Self.duration) : .easeIn(duration: Self.duration),
-                value: configuration.isPressed
-            )
-    }
-}
-
-extension ButtonStyle where Self == FloatingButtonStyle {
-    static var floating: FloatingButtonStyle {
-        floating()
-    }
-
-    static func floating(color: Color = .accentColor, cornerRadius: CGFloat = 10) -> FloatingButtonStyle {
-        FloatingButtonStyle(color: color, cornerRadius: cornerRadius)
-    }
-}
diff --git a/Apple/UI/MenuItemToggleView.swift b/Apple/UI/MenuItemToggleView.swift
deleted file mode 100644
index ef5e8ee..0000000
--- a/Apple/UI/MenuItemToggleView.swift
+++ /dev/null
@@ -1,67 +0,0 @@
-//
-//  MenuItemToggleView.swift
-//  App
-//
-//  Created by Thomas Stubblefield on 5/13/23.
-//
-
-import SwiftUI
-
-public struct MenuItemToggleView: View {
-    @Environment(\.tunnel)
-    var tunnel: Tunnel
-
-    public var body: some View {
-        HStack {
-            VStack(alignment: .leading) {
-                Text("Burrow")
-                    .font(.headline)
-                Text(tunnel.status.description)
-                    .font(.subheadline)
-            }
-            Spacer()
-            Toggle(isOn: tunnel.toggleIsOn) {
-            }
-                .disabled(tunnel.toggleDisabled)
-                .toggleStyle(.switch)
-        }
-        .accessibilityElement(children: .combine)
-        .padding(.horizontal, 4)
-        .padding(10)
-        .frame(minWidth: 300, minHeight: 32, maxHeight: 32)
-    }
-
-    public init() {
-    }
-}
-
-extension Tunnel {
-    @MainActor fileprivate var toggleDisabled: Bool {
-        switch status {
-        case .disconnected, .permissionRequired, .connected, .disconnecting:
-            false
-        case .unknown, .disabled, .connecting, .reasserting, .invalid, .configurationReadWriteFailed:
-            true
-        }
-    }
-
-    @MainActor var toggleIsOn: Binding<Bool> {
-        Binding {
-            switch status {
-            case .connecting, .reasserting, .connected:
-                true
-            default:
-                false
-            }
-        } set: { newValue in
-            switch (status, newValue) {
-            case (.permissionRequired, true):
-                enable()
-            case (_, true):
-                start()
-            case (_, false):
-                stop()
-            }
-        }
-    }
-}
diff --git a/Apple/UI/NetworkCarouselView.swift b/Apple/UI/NetworkCarouselView.swift
deleted file mode 100644
index e7368db..0000000
--- a/Apple/UI/NetworkCarouselView.swift
+++ /dev/null
@@ -1,61 +0,0 @@
-import SwiftUI
-
-struct NetworkCarouselView: View {
-    var networks: [NetworkCardModel]
-
-    var body: some View {
-        Group {
-            if networks.isEmpty {
-                #if os(iOS)
-                VStack(alignment: .leading, spacing: 6) {
-                    Text("No stored networks yet")
-                        .font(.headline)
-                    Text("WireGuard and Tailnet networks show up here as soon as you add one.")
-                        .font(.footnote)
-                        .foregroundStyle(.secondary)
-                }
-                .frame(maxWidth: .infinity, alignment: .leading)
-                .padding()
-                .background(
-                    RoundedRectangle(cornerRadius: 18)
-                        .fill(.thinMaterial)
-                )
-                #else
-                ContentUnavailableView(
-                    "No Networks Yet",
-                    systemImage: "network.slash",
-                    description: Text("Add a WireGuard network, or save a Tailnet account so Burrow can store a managed network when the daemon is reachable.")
-                )
-                .frame(maxWidth: .infinity, minHeight: 175)
-                #endif
-            } else {
-                ScrollView(.horizontal) {
-                    LazyHStack {
-                        ForEach(networks) { network in
-                            NetworkView(network: network)
-                                .containerRelativeFrame(.horizontal, count: 10, span: 7, spacing: 0, alignment: .center)
-                                .scrollTransition(.interactive, axis: .horizontal) { content, phase in
-                                    content
-                                        .scaleEffect(1.0 - abs(phase.value) * 0.1)
-                                }
-                        }
-                    }
-                }
-                .scrollTargetLayout()
-                .scrollClipDisabled()
-                .scrollIndicators(.hidden)
-                .defaultScrollAnchor(.center)
-                .scrollTargetBehavior(.viewAligned)
-                .containerRelativeFrame(.horizontal)
-            }
-        }
-    }
-}
-
-#if DEBUG
-struct NetworkCarouselView_Previews: PreviewProvider {
-    static var previews: some View {
-        NetworkCarouselView(networks: [WireGuardCard(id: 1, detail: "10.13.13.2/24 · wg.burrow.rs:51820").card])
-    }
-}
-#endif
diff --git a/Apple/UI/NetworkExtensionTunnel.swift b/Apple/UI/NetworkExtensionTunnel.swift
deleted file mode 100644
index 23559f3..0000000
--- a/Apple/UI/NetworkExtensionTunnel.swift
+++ /dev/null
@@ -1,171 +0,0 @@
-import BurrowCore
-import NetworkExtension
-
-@Observable
-public final class NetworkExtensionTunnel: Tunnel {
-    @MainActor public private(set) var status: TunnelStatus = .unknown
-    @MainActor private var error: NEVPNError?
-
-    private let logger = Logger.logger(for: Tunnel.self)
-    private let bundleIdentifier: String
-    private let configurationChanged: Task<Void, Error>
-    private let statusChanged: Task<Void, Error>
-
-    // Each manager corresponds to one entry in the Settings app.
-    // Our goal is to maintain a single manager, so we create one if none exist and delete any extra.
-    @MainActor private var managers: [NEVPNManager]? {
-        didSet { Task { await updateStatus() } }
-    }
-
-    @MainActor private var currentStatus: TunnelStatus {
-        guard let managers = managers else {
-            guard let error = error else {
-                return .unknown
-            }
-
-            switch error.code {
-            case .configurationReadWriteFailed:
-                return .configurationReadWriteFailed
-            default:
-                return .unknown
-            }
-        }
-
-        guard let manager = managers.first else {
-            return .permissionRequired
-        }
-
-        guard manager.isEnabled else {
-            return .disabled
-        }
-
-        return manager.connection.tunnelStatus
-    }
-
-    public init(bundleIdentifier: String) {
-        self.bundleIdentifier = bundleIdentifier
-
-        let center = NotificationCenter.default
-        let tunnel: OSAllocatedUnfairLock<NetworkExtensionTunnel?> = .init(initialState: .none)
-        configurationChanged = Task {
-            for try await _ in center.notifications(named: .NEVPNConfigurationChange) {
-                try Task.checkCancellation()
-                await tunnel.withLock { $0 }?.update()
-            }
-        }
-        statusChanged = Task {
-            for try await _ in center.notifications(named: .NEVPNStatusDidChange) {
-                try Task.checkCancellation()
-                await tunnel.withLock { $0 }?.updateStatus()
-            }
-        }
-        tunnel.withLock { $0 = self }
-
-        Task { await update() }
-    }
-
-    private func update() async {
-        do {
-            let result = try await NETunnelProviderManager.managers
-            await MainActor.run {
-                managers = result
-                status = currentStatus
-            }
-            await self.updateStatus()
-        } catch let vpnError as NEVPNError {
-            await MainActor.run {
-                error = vpnError
-            }
-        } catch {
-            logger.error("Failed to update VPN configurations: \(error)")
-        }
-    }
-
-    private func updateStatus() async {
-        await MainActor.run {
-            status = currentStatus
-        }
-    }
-
-    func configure() async throws {
-        let managers = try await NETunnelProviderManager.managers
-        if managers.count > 1 {
-            try await withThrowingTaskGroup(of: Void.self, returning: Void.self) { group in
-                for manager in managers.suffix(from: 1) {
-                    group.addTask { try await manager.remove() }
-                }
-                try await group.waitForAll()
-            }
-        }
-
-        guard managers.isEmpty else { return }
-
-        let manager = NETunnelProviderManager()
-        manager.localizedDescription = "Burrow"
-
-        let proto = NETunnelProviderProtocol()
-        proto.providerBundleIdentifier = bundleIdentifier
-        proto.serverAddress = "burrow.rs"
-
-        manager.protocolConfiguration = proto
-        try await manager.save()
-    }
-
-    public func start() {
-        Task {
-            guard let manager = try await NETunnelProviderManager.managers.first else { return }
-            do {
-                if !manager.isEnabled {
-                    manager.isEnabled = true
-                    try await manager.save()
-                }
-                try manager.connection.startVPNTunnel()
-            } catch {
-                logger.error("Failed to start: \(error)")
-            }
-        }
-    }
-
-    public func stop() {
-        Task {
-            guard let manager = try await NETunnelProviderManager.managers.first else { return }
-            manager.connection.stopVPNTunnel()
-        }
-    }
-
-    public func enable() {
-        Task {
-            do {
-                try await configure()
-            } catch {
-                logger.error("Failed to enable: \(error)")
-            }
-        }
-    }
-
-    deinit {
-        configurationChanged.cancel()
-        statusChanged.cancel()
-    }
-}
-
-extension NEVPNConnection {
-    fileprivate var tunnelStatus: TunnelStatus {
-        switch status {
-        case .connected:
-            .connected(connectedDate!)
-        case .connecting:
-            .connecting
-        case .disconnecting:
-            .disconnecting
-        case .disconnected:
-            .disconnected
-        case .reasserting:
-            .reasserting
-        case .invalid:
-            .invalid
-        @unknown default:
-            .unknown
-        }
-    }
-}
diff --git a/Apple/UI/NetworkView.swift b/Apple/UI/NetworkView.swift
deleted file mode 100644
index 437adce..0000000
--- a/Apple/UI/NetworkView.swift
+++ /dev/null
@@ -1,38 +0,0 @@
-import SwiftUI
-
-struct NetworkView<Content: View>: View {
-    var color: Color
-    var content: () -> Content
-
-    private var gradient: LinearGradient {
-        LinearGradient(
-            colors: [
-                color.opacity(0.8),
-                color
-            ],
-            startPoint: .init(x: 0.2, y: 0),
-            endPoint: .init(x: 0.8, y: 1)
-        )
-    }
-
-    var body: some View {
-        content()
-            .frame(maxWidth: .infinity, minHeight: 175, maxHeight: 175)
-            .background(
-                RoundedRectangle(cornerRadius: 10)
-                    .fill(gradient)
-                    .background(
-                        RoundedRectangle(cornerRadius: 10)
-                            .fill(.white)
-                    )
-            )
-            .shadow(color: .black.opacity(0.1), radius: 3.0, x: 0, y: 2)
-    }
-}
-
-extension NetworkView where Content == AnyView {
-    init(network: NetworkCardModel) {
-        color = network.backgroundColor
-        content = { network.label }
-    }
-}
diff --git a/Apple/UI/Networks/Network.swift b/Apple/UI/Networks/Network.swift
deleted file mode 100644
index 35bd0e1..0000000
--- a/Apple/UI/Networks/Network.swift
+++ /dev/null
@@ -1,623 +0,0 @@
-import BurrowConfiguration
-import BurrowCore
-import Foundation
-import Security
-import SwiftProtobuf
-import SwiftUI
-
-struct NetworkCardModel: Identifiable {
-    let id: Int32
-    let backgroundColor: Color
-    let label: AnyView
-}
-
-struct TailnetNetworkPayload: Codable, Sendable {
-    var provider: TailnetProvider
-    var authority: String?
-    var account: String
-    var identity: String
-    var tailnet: String?
-    var hostname: String?
-
-    func encoded() throws -> Data {
-        let encoder = JSONEncoder()
-        encoder.outputFormatting = [.prettyPrinted, .sortedKeys]
-        return try encoder.encode(self)
-    }
-}
-
-struct TailnetDiscoveryResponse: Codable, Sendable {
-    var domain: String
-    var provider: TailnetProvider
-    var authority: String
-    var oidcIssuer: String?
-}
-
-struct TailnetAuthorityProbeStatus: Sendable {
-    var authority: String
-    var statusCode: Int
-    var summary: String
-    var detail: String?
-}
-
-struct TailnetLoginStatus: Sendable {
-    var sessionID: String
-    var backendState: String
-    var authURL: URL?
-    var running: Bool
-    var needsLogin: Bool
-    var tailnetName: String?
-    var magicDNSSuffix: String?
-    var selfDNSName: String?
-    var tailnetIPs: [String]
-    var health: [String]
-}
-
-enum TailnetDiscoveryClient {
-    static func discover(email: String, socketURL: URL) async throws -> TailnetDiscoveryResponse {
-        var request = Burrow_TailnetDiscoverRequest()
-        request.email = email
-
-        let response = try await TailnetClient.unix(socketURL: socketURL).discover(request)
-        return TailnetDiscoveryResponse(
-            domain: response.domain,
-            provider: response.managed ? .tailscale : .headscale,
-            authority: response.authority,
-            oidcIssuer: response.oidcIssuer.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
-                ? nil
-                : response.oidcIssuer
-        )
-    }
-}
-
-enum TailnetAuthorityProbeClient {
-    static func probe(authority: String, socketURL: URL) async throws -> TailnetAuthorityProbeStatus {
-        var request = Burrow_TailnetProbeRequest()
-        request.authority = authority
-
-        let response = try await TailnetClient.unix(socketURL: socketURL).probe(request)
-        return TailnetAuthorityProbeStatus(
-            authority: response.authority,
-            statusCode: Int(response.statusCode),
-            summary: response.summary,
-            detail: response.detail.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
-                ? nil
-                : response.detail
-        )
-    }
-}
-
-enum TailnetLoginClient {
-    static func start(
-        accountName: String,
-        identityName: String,
-        hostname: String?,
-        authority: String,
-        socketURL: URL
-    ) async throws -> TailnetLoginStatus {
-        var request = Burrow_TailnetLoginStartRequest()
-        request.accountName = accountName
-        request.identityName = identityName
-        request.hostname = hostname ?? ""
-        request.authority = authority
-        let response = try await TailnetClient.unix(socketURL: socketURL).loginStart(request)
-        return decode(response)
-    }
-
-    static func status(sessionID: String, socketURL: URL) async throws -> TailnetLoginStatus {
-        var request = Burrow_TailnetLoginStatusRequest()
-        request.sessionID = sessionID
-        let response = try await TailnetClient.unix(socketURL: socketURL).loginStatus(request)
-        return decode(response)
-    }
-
-    static func cancel(sessionID: String, socketURL: URL) async throws {
-        var request = Burrow_TailnetLoginCancelRequest()
-        request.sessionID = sessionID
-        _ = try await TailnetClient.unix(socketURL: socketURL).loginCancel(request)
-    }
-
-    private static func decode(_ response: Burrow_TailnetLoginStatusResponse) -> TailnetLoginStatus {
-        TailnetLoginStatus(
-            sessionID: response.sessionID,
-            backendState: response.backendState,
-            authURL: URL(string: response.authURL.trimmingCharacters(in: .whitespacesAndNewlines)),
-            running: response.running,
-            needsLogin: response.needsLogin,
-            tailnetName: response.tailnetName.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
-                ? nil
-                : response.tailnetName,
-            magicDNSSuffix: response.magicDNSSuffix.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
-                ? nil
-                : response.magicDNSSuffix,
-            selfDNSName: response.selfDNSName.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
-                ? nil
-                : response.selfDNSName,
-            tailnetIPs: response.tailnetIPs,
-            health: response.health
-        )
-    }
-}
-
-@Observable
-@MainActor
-final class NetworkViewModel: Sendable {
-    private(set) var networks: [Burrow_Network] = []
-    private(set) var connectionError: String?
-    private let socketURLResult: Result<URL, Error>
-
-    @ObservationIgnored private var task: Task<Void, Never>?
-
-    init(socketURLResult: Result<URL, Error>) {
-        self.socketURLResult = socketURLResult
-        startStreaming()
-    }
-
-    deinit {
-        task?.cancel()
-    }
-
-    var cards: [NetworkCardModel] {
-        networks.map(Self.makeCard(for:))
-    }
-
-    var nextNetworkID: Int32 {
-        (networks.map(\.id).max() ?? 0) + 1
-    }
-
-    func addWireGuardNetwork(configText: String) async throws -> Int32 {
-        try await addNetwork(type: .wireGuard, payload: Data(configText.utf8))
-    }
-
-    func addTailnetNetwork(payload: TailnetNetworkPayload) async throws -> Int32 {
-        try await addNetwork(type: .tailnet, payload: payload.encoded())
-    }
-
-    func discoverTailnet(email: String) async throws -> TailnetDiscoveryResponse {
-        let socketURL = try socketURLResult.get()
-        return try await TailnetDiscoveryClient.discover(email: email, socketURL: socketURL)
-    }
-
-    func probeTailnetAuthority(_ authority: String) async throws -> TailnetAuthorityProbeStatus {
-        let socketURL = try socketURLResult.get()
-        return try await TailnetAuthorityProbeClient.probe(authority: authority, socketURL: socketURL)
-    }
-
-    func startTailnetLogin(
-        accountName: String,
-        identityName: String,
-        hostname: String?,
-        authority: String
-    ) async throws -> TailnetLoginStatus {
-        let socketURL = try socketURLResult.get()
-        return try await TailnetLoginClient.start(
-            accountName: accountName,
-            identityName: identityName,
-            hostname: hostname,
-            authority: authority,
-            socketURL: socketURL
-        )
-    }
-
-    func tailnetLoginStatus(sessionID: String) async throws -> TailnetLoginStatus {
-        let socketURL = try socketURLResult.get()
-        return try await TailnetLoginClient.status(sessionID: sessionID, socketURL: socketURL)
-    }
-
-    func cancelTailnetLogin(sessionID: String) async throws {
-        let socketURL = try socketURLResult.get()
-        try await TailnetLoginClient.cancel(sessionID: sessionID, socketURL: socketURL)
-    }
-
-    private func addNetwork(type: Burrow_NetworkType, payload: Data) async throws -> Int32 {
-        let socketURL = try socketURLResult.get()
-        let networkID = nextNetworkID
-        let request = Burrow_Network.with {
-            $0.id = networkID
-            $0.type = type
-            $0.payload = payload
-        }
-
-        let client = NetworksClient.unix(socketURL: socketURL)
-        _ = try await client.networkAdd(request)
-        return networkID
-    }
-
-    private func startStreaming() {
-        task?.cancel()
-        let socketURLResult = self.socketURLResult
-        task = Task { [weak self] in
-            do {
-                let socketURL = try socketURLResult.get()
-                let client = NetworksClient.unix(socketURL: socketURL)
-                for try await response in client.networkList(.init()) {
-                    guard !Task.isCancelled else { return }
-                    await MainActor.run {
-                        guard let self else { return }
-                        self.networks = response.network
-                        self.connectionError = nil
-                    }
-                }
-            } catch {
-                guard !Task.isCancelled else { return }
-                await MainActor.run {
-                    guard let self else { return }
-                    self.connectionError = error.localizedDescription
-                }
-            }
-        }
-    }
-
-    private static func makeCard(for network: Burrow_Network) -> NetworkCardModel {
-        switch network.type {
-        case .wireGuard:
-            WireGuardCard(network: network).card
-        case .tailnet:
-            TailnetCard(network: network).card
-        case .UNRECOGNIZED(let rawValue):
-            unsupportedCard(
-                id: network.id,
-                title: "Unknown Network",
-                detail: "Type \(rawValue) is not recognized by this build."
-            )
-        @unknown default:
-            unsupportedCard(
-                id: network.id,
-                title: "Unsupported Network",
-                detail: "Update Burrow to view this network."
-            )
-        }
-    }
-
-    private static func unsupportedCard(id: Int32, title: String, detail: String) -> NetworkCardModel {
-        NetworkCardModel(
-            id: id,
-            backgroundColor: .gray.opacity(0.85),
-            label: AnyView(
-                VStack(alignment: .leading, spacing: 12) {
-                    Text(title)
-                        .font(.title3.weight(.semibold))
-                        .foregroundStyle(.white)
-                    Text(detail)
-                        .font(.body)
-                        .foregroundStyle(.white.opacity(0.9))
-                    Spacer()
-                    Text("Network #\(id)")
-                        .font(.footnote.monospaced())
-                        .foregroundStyle(.white.opacity(0.8))
-                }
-                .padding()
-                .frame(maxWidth: .infinity, alignment: .leading)
-            )
-        )
-    }
-}
-
-enum TailnetProvider: String, CaseIterable, Codable, Identifiable, Sendable {
-    case tailscale
-    case headscale
-    case burrow
-
-    var id: String { rawValue }
-
-    var title: String {
-        switch self {
-        case .tailscale: "Tailscale"
-        case .headscale: "Custom Tailnet"
-        case .burrow: "Burrow"
-        }
-    }
-
-    var defaultAuthority: String? {
-        switch self {
-        case .tailscale:
-            "https://controlplane.tailscale.com"
-        case .headscale:
-            "https://ts.burrow.net"
-        case .burrow:
-            nil
-        }
-    }
-
-    var subtitle: String {
-        switch self {
-        case .tailscale:
-            "Managed Tailnet authority."
-        case .headscale:
-            "Custom Tailnet control server."
-        case .burrow:
-            "Burrow-native Tailnet authority."
-        }
-    }
-
-    static func inferred(authority: String?, explicit: TailnetProvider?) -> TailnetProvider {
-        if explicit == .burrow {
-            return .burrow
-        }
-        if isManagedTailscaleAuthority(authority) {
-            return .tailscale
-        }
-        return .headscale
-    }
-
-    static func isManagedTailscaleAuthority(_ authority: String?) -> Bool {
-        guard let normalized = authority?
-            .trimmingCharacters(in: .whitespacesAndNewlines)
-            .lowercased()
-            .trimmingCharacters(in: CharacterSet(charactersIn: "/")),
-              !normalized.isEmpty
-        else {
-            return false
-        }
-
-        return normalized == "https://controlplane.tailscale.com"
-            || normalized == "http://controlplane.tailscale.com"
-            || normalized == "controlplane.tailscale.com"
-    }
-}
-
-enum AccountNetworkKind: String, CaseIterable, Codable, Identifiable, Sendable {
-    case wireGuard
-    case tor
-    case tailnet
-
-    var id: String { rawValue }
-
-    var title: String {
-        switch self {
-        case .wireGuard: "WireGuard"
-        case .tor: "Tor"
-        case .tailnet: "Tailnet"
-        }
-    }
-
-    var subtitle: String {
-        switch self {
-        case .wireGuard: "Import a tunnel and optional account metadata."
-        case .tor: "Store Arti account and identity preferences."
-        case .tailnet: "Save Tailnet authority, identity defaults, and login material."
-        }
-    }
-
-    var accentColor: Color {
-        switch self {
-        case .wireGuard: .init("WireGuard")
-        case .tor: .orange
-        case .tailnet: .mint
-        }
-    }
-
-    var actionTitle: String {
-        switch self {
-        case .wireGuard: "Add Network"
-        case .tor: "Save Account"
-        case .tailnet: "Save Account"
-        }
-    }
-
-    var availabilityNote: String? {
-        switch self {
-        case .wireGuard:
-            nil
-        case .tor:
-            "Tor account preferences are stored on Apple now. The managed Tor runtime is not wired on Apple in this branch yet."
-        case .tailnet:
-            "Tailnet accounts can sign in from Apple now. The managed Apple runtime is still pending, but Tailnet networks can already be stored in the daemon."
-        }
-    }
-}
-
-enum AccountAuthMode: String, CaseIterable, Codable, Identifiable, Sendable {
-    case web
-    case none
-    case password
-    case preauthKey
-
-    var id: String { rawValue }
-
-    var title: String {
-        switch self {
-        case .web: "Browser Sign-In"
-        case .none: "None"
-        case .password: "Password"
-        case .preauthKey: "Preauth Key"
-        }
-    }
-}
-
-struct NetworkAccountRecord: Codable, Identifiable, Hashable, Sendable {
-    let id: UUID
-    var kind: AccountNetworkKind
-    var title: String
-    var authority: String?
-    var provider: TailnetProvider?
-    var accountName: String
-    var identityName: String
-    var hostname: String?
-    var username: String?
-    var tailnet: String?
-    var authMode: AccountAuthMode
-    var note: String?
-    var createdAt: Date
-    var updatedAt: Date
-}
-
-struct TailnetCard {
-    var id: Int32
-    var title: String
-    var detail: String
-
-    init(network: Burrow_Network) {
-        let payload = (try? JSONDecoder().decode(TailnetNetworkPayload.self, from: network.payload))
-        id = network.id
-        title = payload?.tailnet ?? payload?.hostname ?? "Tailnet"
-        detail = [
-            payload?.authority.flatMap { URL(string: $0)?.host } ?? payload?.authority,
-            payload?.authority,
-            payload.map { "Account: \($0.account)" },
-        ]
-        .compactMap { $0 }
-        .joined(separator: " · ")
-        .ifEmpty("Stored Tailnet configuration")
-    }
-
-    var card: NetworkCardModel {
-        NetworkCardModel(
-            id: id,
-            backgroundColor: .mint,
-            label: AnyView(
-                VStack(alignment: .leading, spacing: 12) {
-                    HStack {
-                        VStack(alignment: .leading, spacing: 4) {
-                            Text("Tailnet")
-                                .font(.headline)
-                                .foregroundStyle(.white.opacity(0.85))
-                            Text(title)
-                                .font(.title3.weight(.semibold))
-                                .foregroundStyle(.white)
-                        }
-                        Spacer()
-                    }
-                    Spacer()
-                    Text(detail)
-                        .font(.body.monospaced())
-                        .foregroundStyle(.white.opacity(0.92))
-                        .lineLimit(4)
-                }
-                .padding()
-                .frame(maxWidth: .infinity, alignment: .leading)
-            )
-        )
-    }
-}
-
-@Observable
-@MainActor
-final class NetworkAccountStore {
-    private static let storageKey = "burrow.network-accounts"
-
-    private let defaults: UserDefaults
-    private(set) var accounts: [NetworkAccountRecord] = []
-
-    init(defaults: UserDefaults = UserDefaults(suiteName: Constants.appGroupIdentifier) ?? .standard) {
-        self.defaults = defaults
-        load()
-    }
-
-    func upsert(_ record: NetworkAccountRecord, secret: String?) throws {
-        if let index = accounts.firstIndex(where: { $0.id == record.id }) {
-            accounts[index] = record
-        } else {
-            accounts.append(record)
-        }
-        accounts.sort {
-            if $0.kind == $1.kind {
-                return $0.title.localizedCaseInsensitiveCompare($1.title) == .orderedAscending
-            }
-            return $0.kind.rawValue < $1.kind.rawValue
-        }
-        try persist()
-        if let secret, !secret.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty {
-            try AccountSecretStore.store(secret, for: record.id)
-        } else {
-            try AccountSecretStore.removeSecret(for: record.id)
-        }
-    }
-
-    func delete(_ record: NetworkAccountRecord) throws {
-        accounts.removeAll { $0.id == record.id }
-        try persist()
-        try AccountSecretStore.removeSecret(for: record.id)
-    }
-
-    func hasStoredSecret(for record: NetworkAccountRecord) -> Bool {
-        AccountSecretStore.hasSecret(for: record.id)
-    }
-
-    private func load() {
-        guard let data = defaults.data(forKey: Self.storageKey) else {
-            accounts = []
-            return
-        }
-
-        do {
-            accounts = try JSONDecoder().decode([NetworkAccountRecord].self, from: data)
-        } catch {
-            accounts = []
-        }
-    }
-
-    private func persist() throws {
-        let data = try JSONEncoder().encode(accounts)
-        defaults.set(data, forKey: Self.storageKey)
-    }
-}
-
-private enum AccountSecretStore {
-    private static let service = "\(Constants.bundleIdentifier).accounts"
-
-    static func hasSecret(for accountID: UUID) -> Bool {
-        let query = baseQuery(for: accountID)
-        return SecItemCopyMatching(query as CFDictionary, nil) == errSecSuccess
-    }
-
-    static func store(_ secret: String, for accountID: UUID) throws {
-        let data = Data(secret.utf8)
-        let query = baseQuery(for: accountID)
-        let status = SecItemCopyMatching(query as CFDictionary, nil)
-
-        if status == errSecSuccess {
-            let updateStatus = SecItemUpdate(
-                query as CFDictionary,
-                [kSecValueData as String: data] as CFDictionary
-            )
-            guard updateStatus == errSecSuccess else {
-                throw AccountSecretStoreError.osStatus(updateStatus)
-            }
-            return
-        }
-
-        var item = query
-        item[kSecValueData as String] = data
-        item[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
-        let addStatus = SecItemAdd(item as CFDictionary, nil)
-        guard addStatus == errSecSuccess else {
-            throw AccountSecretStoreError.osStatus(addStatus)
-        }
-    }
-
-    static func removeSecret(for accountID: UUID) throws {
-        let status = SecItemDelete(baseQuery(for: accountID) as CFDictionary)
-        guard status == errSecSuccess || status == errSecItemNotFound else {
-            throw AccountSecretStoreError.osStatus(status)
-        }
-    }
-
-    private static func baseQuery(for accountID: UUID) -> [String: Any] {
-        [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: service,
-            kSecAttrAccount as String: accountID.uuidString,
-        ]
-    }
-}
-
-private enum AccountSecretStoreError: LocalizedError {
-    case osStatus(OSStatus)
-
-    var errorDescription: String? {
-        switch self {
-        case .osStatus(let status):
-            if let message = SecCopyErrorMessageString(status, nil) as String? {
-                return message
-            }
-            return "Keychain error \(status)"
-        }
-    }
-}
-
-private extension String {
-    func ifEmpty(_ fallback: @autoclosure () -> String) -> String {
-        isEmpty ? fallback() : self
-    }
-}
diff --git a/Apple/UI/Networks/WireGuard.swift b/Apple/UI/Networks/WireGuard.swift
deleted file mode 100644
index c0426cd..0000000
--- a/Apple/UI/Networks/WireGuard.swift
+++ /dev/null
@@ -1,77 +0,0 @@
-import BurrowCore
-import Foundation
-import SwiftUI
-
-struct WireGuardCard {
-    var id: Int32
-    var title: String
-    var detail: String
-
-    init(id: Int32, title: String = "WireGuard", detail: String = "Stored configuration") {
-        self.id = id
-        self.title = title
-        self.detail = detail
-    }
-
-    init(network: Burrow_Network) {
-        let payload = String(data: network.payload, encoding: .utf8) ?? ""
-        let address = Self.firstValue(for: "Address", in: payload)
-        let endpoint = Self.firstValue(for: "Endpoint", in: payload)
-        self.id = network.id
-        self.title = "WireGuard"
-        self.detail = [address, endpoint]
-            .compactMap { $0 }
-            .filter { !$0.isEmpty }
-            .joined(separator: " · ")
-            .ifEmpty("Stored configuration")
-    }
-
-    var card: NetworkCardModel {
-        NetworkCardModel(
-            id: id,
-            backgroundColor: .init("WireGuard"),
-            label: AnyView(label)
-        )
-    }
-
-    private var label: some View {
-        GeometryReader { reader in
-            VStack(alignment: .leading) {
-                HStack {
-                    Image("WireGuard")
-                        .resizable()
-                        .aspectRatio(contentMode: .fit)
-                    Image("WireGuardTitle")
-                        .resizable()
-                        .aspectRatio(contentMode: .fit)
-                        .frame(width: reader.size.width / 2)
-                    Spacer()
-                }
-                .frame(maxWidth: .infinity, maxHeight: reader.size.height / 4)
-                Spacer()
-                Text(detail)
-                    .foregroundStyle(.white)
-                    .font(.body.monospaced())
-                    .lineLimit(3)
-            }
-            .padding()
-            .frame(maxWidth: .infinity)
-        }
-    }
-
-    private static func firstValue(for key: String, in config: String) -> String? {
-        config
-            .split(whereSeparator: \.isNewline)
-            .map(String.init)
-            .first(where: { $0.hasPrefix("\(key) = ") })?
-            .split(separator: "=", maxSplits: 1)
-            .last
-            .map { $0.trimmingCharacters(in: .whitespaces) }
-    }
-}
-
-private extension String {
-    func ifEmpty(_ fallback: @autoclosure () -> String) -> String {
-        isEmpty ? fallback() : self
-    }
-}
diff --git a/Apple/UI/Tunnel.swift b/Apple/UI/Tunnel.swift
deleted file mode 100644
index 4ec9320..0000000
--- a/Apple/UI/Tunnel.swift
+++ /dev/null
@@ -1,61 +0,0 @@
-import BurrowConfiguration
-import NetworkExtension
-import SwiftUI
-
-protocol Tunnel: Sendable {
-    @MainActor var status: TunnelStatus { get }
-
-    func start()
-    func stop()
-    func enable()
-}
-
-public enum TunnelStatus: Sendable, Equatable, Hashable {
-    case unknown
-    case permissionRequired
-    case disabled
-    case connecting
-    case connected(Date)
-    case disconnecting
-    case disconnected
-    case reasserting
-    case invalid
-    case configurationReadWriteFailed
-}
-
-struct TunnelKey: EnvironmentKey {
-    static var defaultValue: any Tunnel {
-        NetworkExtensionTunnel(bundleIdentifier: Constants.networkExtensionBundleIdentifier)
-    }
-}
-
-extension EnvironmentValues {
-    var tunnel: any Tunnel {
-        get { self[TunnelKey.self] }
-        set { self[TunnelKey.self] = newValue }
-    }
-}
-
-#if DEBUG
-@Observable
-@MainActor
-final class PreviewTunnel: Tunnel {
-    private(set) var status: TunnelStatus = .permissionRequired
-
-    nonisolated func start() {
-        set(.connected(.now))
-    }
-
-    nonisolated func stop() {
-        set(.disconnected)
-    }
-
-    nonisolated func enable() {
-        set(.disconnected)
-    }
-
-    nonisolated private func set(_ status: TunnelStatus) {
-        Task { @MainActor in self.status = status }
-    }
-}
-#endif
diff --git a/Apple/UI/TunnelButton.swift b/Apple/UI/TunnelButton.swift
deleted file mode 100644
index d0222d4..0000000
--- a/Apple/UI/TunnelButton.swift
+++ /dev/null
@@ -1,73 +0,0 @@
-import SwiftUI
-
-struct TunnelButton: View {
-    @Environment(\.tunnel)
-    var tunnel: any Tunnel
-
-    private var action: Action? { tunnel.action }
-
-    var body: some View {
-        Button {
-            if let action {
-                tunnel.perform(action)
-            }
-        } label: {
-            Text(action.description)
-        }
-        .disabled(action.isDisabled)
-        .padding(.horizontal)
-        .buttonStyle(.floating)
-    }
-}
-
-extension Tunnel {
-    @MainActor fileprivate var action: TunnelButton.Action? {
-        switch status {
-        case .permissionRequired, .invalid:
-            .enable
-        case .disabled, .disconnecting, .disconnected:
-            .start
-        case .connecting, .connected, .reasserting:
-            .stop
-        case .unknown, .configurationReadWriteFailed:
-            nil
-        }
-    }
-}
-
-extension TunnelButton {
-    fileprivate enum Action {
-        case enable
-        case start
-        case stop
-    }
-}
-
-extension TunnelButton.Action? {
-    var description: LocalizedStringKey {
-        switch self {
-        case .enable: "Enable"
-        case .start: "Start"
-        case .stop: "Stop"
-        case .none: "Start"
-        }
-    }
-
-    var isDisabled: Bool {
-        if case .none = self {
-            true
-        } else {
-            false
-        }
-    }
-}
-
-extension Tunnel {
-    fileprivate func perform(_ action: TunnelButton.Action) {
-        switch action {
-        case .enable: enable()
-        case .start: start()
-        case .stop: stop()
-        }
-    }
-}
diff --git a/Apple/UI/TunnelStatusView.swift b/Apple/UI/TunnelStatusView.swift
deleted file mode 100644
index 15717ec..0000000
--- a/Apple/UI/TunnelStatusView.swift
+++ /dev/null
@@ -1,37 +0,0 @@
-import SwiftUI
-
-struct TunnelStatusView: View {
-    @Environment(\.tunnel)
-    var tunnel: any Tunnel
-
-    var body: some View {
-        Text(tunnel.status.description)
-    }
-}
-
-extension TunnelStatus: CustomStringConvertible {
-    public var description: String {
-        switch self {
-        case .unknown:
-            "Unknown"
-        case .permissionRequired:
-            "Permission Required"
-        case .disconnected:
-            "Disconnected"
-        case .disabled:
-            "Disabled"
-        case .connecting:
-            "Connecting…"
-        case .connected:
-            "Connected"
-        case .disconnecting:
-            "Disconnecting…"
-        case .reasserting:
-            "Reasserting…"
-        case .invalid:
-            "Invalid"
-        case .configurationReadWriteFailed:
-            "System Error"
-        }
-    }
-}
diff --git a/Apple/UI/UI.xcconfig b/Apple/UI/UI.xcconfig
deleted file mode 100644
index b44d676..0000000
--- a/Apple/UI/UI.xcconfig
+++ /dev/null
@@ -1,3 +0,0 @@
-#include "../Configuration/Framework.xcconfig"
-
-ENABLE_PREVIEWS = YES
diff --git a/BUILD.bazel b/BUILD.bazel
deleted file mode 100644
index d67b251..0000000
--- a/BUILD.bazel
+++ /dev/null
@@ -1,69 +0,0 @@
-filegroup(
-    name = "apple_project_files",
-    srcs = glob(
-        [
-            "Apple/**",
-            "Scripts/ci/install-apple-signing-assets.sh",
-            "Scripts/ci/package-apple-artifacts.sh",
-            "Scripts/version.sh",
-        ],
-        exclude = [
-            "Apple/build/**",
-            "Apple/**/xcuserdata/**",
-        ],
-    ),
-    visibility = ["//visibility:public"],
-)
-
-filegroup(
-    name = "android_project_files",
-    srcs = glob(
-        [
-            "Android/**",
-        ],
-        exclude = [
-            "Android/.gradle/**",
-            "Android/**/build/**",
-        ],
-    ),
-    visibility = ["//visibility:public"],
-)
-
-filegroup(
-    name = "mobile_rust_core_files",
-    srcs = glob(
-        [
-            "crates/burrow-core/**",
-            "crates/burrow-mobile-ffi/**",
-        ],
-    ) + [
-        "Cargo.lock",
-        "Cargo.toml",
-        "rust-toolchain.toml",
-    ],
-    visibility = ["//visibility:public"],
-)
-
-alias(
-    name = "apple_release_ios",
-    actual = "//bazel/apple:release_ios_stamp",
-    visibility = ["//visibility:public"],
-)
-
-alias(
-    name = "apple_release_macos",
-    actual = "//bazel/apple:release_macos_stamp",
-    visibility = ["//visibility:public"],
-)
-
-alias(
-    name = "apple_release_all",
-    actual = "//bazel/apple:release_all_stamp",
-    visibility = ["//visibility:public"],
-)
-
-alias(
-    name = "android_check_stub",
-    actual = "//bazel/android:check_stub_stamp",
-    visibility = ["//visibility:public"],
-)
diff --git a/CONSTITUTION.md b/CONSTITUTION.md
deleted file mode 100644
index f97e683..0000000
--- a/CONSTITUTION.md
+++ /dev/null
@@ -1,38 +0,0 @@
-# Burrow Constitution
-
-1. Mission
-
-Burrow exists to build a proper VPN: fast, inspectable, deployable on infrastructure the project controls, and legible enough that future contributors can extend it without guesswork.
-
-2. Commitments
-
-- Protocol work must favor correctness over novelty. Burrow does not claim support for a transport or control-plane feature until the wire format, state handling, and recovery behavior are implemented and tested.
-- Security is a design constraint, not a cleanup phase. Key material, bootstrap credentials, control-plane tokens, and routing policy must have explicit storage and rotation paths.
-- Performance matters. Burrow should avoid needless copies, hidden blocking, and ad hoc process graphs that make packet forwarding or control-plane convergence harder to reason about.
-- Source, infrastructure, and release logic live in the repository. If the forge cannot be rebuilt from the tree, the work is incomplete.
-- Non-trivial changes require a Burrow Evolution Proposal. Durable rationale belongs in the repository, not only in chat.
-
-3. Infrastructure
-
-Burrow controls its own forge, runners, deployment automation, and edge configuration for `burrow.net` and `burrow.rs`.
-
-- Dedicated compute is preferred over SaaS dependencies when the dependency would hold release, source, or identity authority.
-- Secrets may be bootstrapped from local intake for initial bring-up, but long-lived operation must converge on encrypted, versioned secret handling.
-- Production access must be attributable. Automation identities, SSH keys, and service accounts must be named and documented.
-
-4. Contributors
-
-- Read this constitution before drafting product, protocol, or infrastructure changes.
-- Capture intent, testing expectations, and rollback procedures in proposals.
-- Prefer reversible migrations. If a change is destructive, document the preconditions and teardown plan first.
-- Security-sensitive work requires explicit reviewer attention, even when the implementation is performed by an agent.
-
-5. Governance
-
-- Burrow Evolution Proposals (BEPs) are the primary design record for architectural, protocol, forge, and deployment changes.
-- Accepted proposals are authoritative until superseded.
-- Constitutional changes require a dedicated proposal that quotes the affected text and records the decision.
-
-6. Origin
-
-Burrow started as a firewall-burrowing client and now carries its own transport, daemon, mesh, and control-plane work. This constitution exists so the project can finish that evolution coherently.
diff --git a/Cargo.lock b/Cargo.lock
index 020c072..85f11e7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1,21 +1,21 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 4
+version = 3
 
 [[package]]
 name = "addr2line"
-version = "0.24.2"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
+checksum = "8a30b2e23b9e17a9f90641c7ab1549cd9b44f296d3ccbf309d2863cfe398a0cb"
 dependencies = [
  "gimli",
 ]
 
 [[package]]
-name = "adler2"
-version = "2.0.1"
+name = "adler"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
 [[package]]
 name = "aead"
@@ -29,413 +29,129 @@ dependencies = [
 
 [[package]]
 name = "aes"
-version = "0.8.4"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+checksum = "ac1f845298e95f983ff1944b728ae08b8cebab80d684f0a832ed0fc74dfa27e2"
 dependencies = [
  "cfg-if",
  "cipher",
  "cpufeatures",
- "zeroize",
 ]
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.3"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
 dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "alloca"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5a7d05ea6aea7e9e64d25b9156ba2fee3fdd659e34e41063cd2fc7cd020d7f4"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "amplify"
-version = "4.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f7fb4ac7c881e54a8e7015e399b6112a2a5bc958b6c89ac510840ff20273b31"
-dependencies = [
- "amplify_derive",
- "amplify_num",
- "ascii",
- "getrandom 0.2.16",
- "getrandom 0.3.3",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "amplify_derive"
-version = "4.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a6309e6b8d89b36b9f959b7a8fa093583b94922a0f6438a24fb08936de4d428"
-dependencies = [
- "amplify_syn",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "amplify_num"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99bcb75a2982047f733547042fc3968c0f460dfcf7d90b90dea3b2744580e9ad"
-dependencies = [
- "wasm-bindgen",
-]
-
-[[package]]
-name = "amplify_syn"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7736fb8d473c0d83098b5bac44df6a561e20470375cd8bcae30516dc889fd62a"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "android_system_properties"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "anes"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"
-
 [[package]]
 name = "anstream"
-version = "0.6.20"
+version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ae563653d1938f79b1ab1b5e668c87c76a9930414574a6583a7b7e11a8e6192"
+checksum = "6e2e1ebcb11de5c03c67de28a7df593d32191b44939c482e97702baaaa6ab6a5"
 dependencies = [
  "anstyle",
  "anstyle-parse",
  "anstyle-query",
  "anstyle-wincon",
  "colorchoice",
- "is_terminal_polyfill",
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle"
-version = "1.0.11"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "862ed96ca487e809f1c8e5a8447f6ee2cf102f846893800b20cebdf541fc6bbd"
+checksum = "7079075b41f533b8c61d2a4d073c4676e1f8b249ff94a393b0595db304e0dd87"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.7"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
+checksum = "c75ac65da39e5fe5ab759307499ddad880d724eed2f6ce5b5e8a26f4f387928c"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.1.4"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e231f6134f61b71076a3eab506c379d4f36122f2af15a9ff04415ea4c3339e2"
+checksum = "e28923312444cdd728e4738b3f9c9cac739500909bb3d3c94b43551b16517648"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.10"
+version = "3.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e0633414522a32ffaac8ac6cc8f748e090c5717661fddeea04219e2344f5f2a"
+checksum = "1cd54b81ec8d6180e24654d0b371ad22fc3dd083b6ff8ba325b72e00c87660a7"
 dependencies = [
  "anstyle",
- "once_cell_polyfill",
- "windows-sys 0.60.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.100"
+version = "1.0.79"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
-
-[[package]]
-name = "argon2"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
-dependencies = [
- "base64ct",
- "blake2",
- "cpufeatures",
- "password-hash 0.5.0",
-]
-
-[[package]]
-name = "arrayvec"
-version = "0.7.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
-
-[[package]]
-name = "arti-client"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e89842cae6e3bda0fd128a5c66eb3392ed412065dc698c77d9fcc4b77e4159f2"
-dependencies = [
- "async-trait",
- "cfg-if",
- "derive-deftly",
- "derive_builder_fork_arti",
- "derive_more",
- "educe",
- "fs-mistrust",
- "futures",
- "hostname-validator",
- "humantime",
- "humantime-serde",
- "libc",
- "once_cell",
- "postage",
- "rand 0.9.2",
- "safelog",
- "serde",
- "thiserror 2.0.16",
- "time",
- "tor-async-utils",
- "tor-basic-utils",
- "tor-chanmgr",
- "tor-circmgr",
- "tor-config",
- "tor-config-path",
- "tor-dircommon",
- "tor-dirmgr",
- "tor-error",
- "tor-guardmgr",
- "tor-keymgr",
- "tor-linkspec",
- "tor-llcrypto",
- "tor-memquota",
- "tor-netdir",
- "tor-netdoc",
- "tor-persist",
- "tor-proto",
- "tor-protover",
- "tor-rtcompat",
- "tracing",
- "void",
-]
-
-[[package]]
-name = "ascii"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d92bec98840b8f03a5ff5413de5293bfcd8bf96467cf5452609f939ec6f5de16"
-
-[[package]]
-name = "asn1-rs"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56624a96882bb8c26d61312ae18cb45868e5a9992ea73c58e45c3101e56a1e60"
-dependencies = [
- "asn1-rs-derive",
- "asn1-rs-impl",
- "displaydoc",
- "nom 7.1.3",
- "num-traits",
- "rusticata-macros",
- "thiserror 2.0.16",
-]
-
-[[package]]
-name = "asn1-rs-derive"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
- "synstructure",
-]
-
-[[package]]
-name = "asn1-rs-impl"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "assert_matches"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b34d609dfbaf33d6889b2b7106d3ca345eacad44200913df5ba02bfd31d2ba9"
+checksum = "080e9890a082662b09c1ad45f567faeeb47f22b5fb23895fbe1e651e718e25ca"
 
 [[package]]
 name = "async-channel"
-version = "2.5.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "924ed96dd52d1b75e9c1a3e6275715fd320f5f9439fb5a4a11fa51f4221158d2"
+checksum = "1ca33f4bc4ed1babef42cad36cc1f51fa88be00420404e5b1e80ab1b18f7678c"
 dependencies = [
  "concurrent-queue",
+ "event-listener",
  "event-listener-strategy",
  "futures-core",
  "pin-project-lite",
 ]
 
-[[package]]
-name = "async-compression"
-version = "0.4.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93c1f86859c1af3d514fa19e8323147ff10ea98684e6c7b307912509f50e67b2"
-dependencies = [
- "compression-codecs",
- "compression-core",
- "futures-core",
- "futures-io",
- "pin-project-lite",
-]
-
-[[package]]
-name = "async-native-tls"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9343dc5acf07e79ff82d0c37899f079db3534d99f189a1837c8e549c99405bec"
-dependencies = [
- "futures-util",
- "native-tls",
- "thiserror 1.0.69",
- "url",
-]
-
 [[package]]
 name = "async-stream"
-version = "0.2.1"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22068c0c19514942eefcfd4daf8976ef1aad84e61539f95cd200c35202f80af5"
+checksum = "cd56dd203fef61ac097dd65721a419ddccb106b2d2b70ba60a6b529f03961a51"
 dependencies = [
- "async-stream-impl 0.2.1",
- "futures-core",
-]
-
-[[package]]
-name = "async-stream"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b5a71a6f37880a80d1d7f19efd781e4b5de42c88f0722cc13bcb6cc2cfe8476"
-dependencies = [
- "async-stream-impl 0.3.6",
+ "async-stream-impl",
  "futures-core",
  "pin-project-lite",
 ]
 
 [[package]]
 name = "async-stream-impl"
-version = "0.2.1"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25f9db3b38af870bf7e5cc649167533b493928e50744e2c30ae350230b414670"
+checksum = "16e62a023e7c117e27523144c5d2459f4397fcc3cab0085af8e2224f643a0193"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "async-stream-impl"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
 name = "async-trait"
-version = "0.1.89"
+version = "0.1.77"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+checksum = "c980ee35e870bd1a4d2c8294d4c04d0499e67bca1e4b5cefcc693c2fa00caea9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
-[[package]]
-name = "async_executors"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a982d2f86de6137cc05c9db9a915a19886c97911f9790d04f174cede74be01a5"
-dependencies = [
- "blanket",
- "futures-core",
- "futures-task",
- "futures-util",
- "pin-project",
- "rustc_version",
- "tokio",
-]
-
-[[package]]
-name = "asynchronous-codec"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a860072022177f903e59730004fb5dc13db9275b79bb2aef7ba8ce831956c233"
-dependencies = [
- "bytes",
- "futures-sink",
- "futures-util",
- "memchr",
- "pin-project-lite",
-]
-
-[[package]]
-name = "atomic"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c59bdb34bc650a32731b31bd8f0829cc15d24a708ee31559e0bb34f2bc320cba"
-
-[[package]]
-name = "atomic"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a89cbf775b137e9b968e67227ef7f775587cde3fd31b0d8599dbd0f598a48340"
-dependencies = [
- "bytemuck",
-]
-
-[[package]]
-name = "atomic-waker"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
-
 [[package]]
 name = "autocfg"
-version = "1.5.0"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
 
 [[package]]
 name = "axum"
@@ -444,13 +160,13 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3b829e4e32b91e643de6eafe82b1d90675f5874230191a4ffbc1b336dec4d6bf"
 dependencies = [
  "async-trait",
- "axum-core 0.3.4",
+ "axum-core",
  "bitflags 1.3.2",
  "bytes",
  "futures-util",
- "http 0.2.12",
- "http-body 0.4.6",
- "hyper 0.14.32",
+ "http",
+ "http-body",
+ "hyper",
  "itoa",
  "matchit",
  "memchr",
@@ -459,46 +175,12 @@ dependencies = [
  "pin-project-lite",
  "rustversion",
  "serde",
- "sync_wrapper 0.1.2",
- "tower 0.4.13",
+ "sync_wrapper",
+ "tower",
  "tower-layer",
  "tower-service",
 ]
 
-[[package]]
-name = "axum"
-version = "0.7.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
-dependencies = [
- "async-trait",
- "axum-core 0.4.5",
- "bytes",
- "futures-util",
- "http 1.3.1",
- "http-body 1.0.1",
- "http-body-util",
- "hyper 1.7.0",
- "hyper-util",
- "itoa",
- "matchit",
- "memchr",
- "mime",
- "percent-encoding",
- "pin-project-lite",
- "rustversion",
- "serde",
- "serde_json",
- "serde_path_to_error",
- "serde_urlencoded",
- "sync_wrapper 1.0.2",
- "tokio",
- "tower 0.5.2",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
 [[package]]
 name = "axum-core"
 version = "0.3.4"
@@ -508,83 +190,40 @@ dependencies = [
  "async-trait",
  "bytes",
  "futures-util",
- "http 0.2.12",
- "http-body 0.4.6",
+ "http",
+ "http-body",
  "mime",
  "rustversion",
  "tower-layer",
  "tower-service",
 ]
 
-[[package]]
-name = "axum-core"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
-dependencies = [
- "async-trait",
- "bytes",
- "futures-util",
- "http 1.3.1",
- "http-body 1.0.1",
- "http-body-util",
- "mime",
- "pin-project-lite",
- "rustversion",
- "sync_wrapper 1.0.2",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
 [[package]]
 name = "backtrace"
-version = "0.3.75"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6806a6321ec58106fea15becdad98371e28d92ccbc7c8f1b3b6dd724fe8f1002"
+checksum = "2089b7e3f35b9dd2d0ed921ead4f6d318c27680d4a5bd167b3ee120edb105837"
 dependencies = [
  "addr2line",
+ "cc",
  "cfg-if",
  "libc",
  "miniz_oxide",
  "object",
  "rustc-demangle",
- "windows-targets 0.52.6",
 ]
 
-[[package]]
-name = "base16ct"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
-
 [[package]]
 name = "base64"
 version = "0.21.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
-[[package]]
-name = "base64"
-version = "0.22.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
-
 [[package]]
 name = "base64ct"
-version = "1.8.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55248b47b0caf0546f7988906588779981c43bb1bc9d0c44087278f80cdb44ba"
-
-[[package]]
-name = "bincode"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36eaf5d7b090263e8150820482d5d93cd964a81e4019913c972f4edcc6edb740"
-dependencies = [
- "serde",
- "unty",
-]
+checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
 
 [[package]]
 name = "bindgen"
@@ -602,7 +241,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "rustc-hash 1.1.0",
+ "rustc-hash",
  "shlex",
  "syn 1.0.109",
  "which",
@@ -625,9 +264,9 @@ dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "rustc-hash 1.1.0",
+ "rustc-hash",
  "shlex",
- "syn 2.0.106",
+ "syn 2.0.48",
  "which",
 ]
 
@@ -639,21 +278,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.9.4"
+version = "2.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2261d10cca569e4643e526d8dc2e62e433cc8aba21ab764233731f8d369bf394"
-
-[[package]]
-name = "bitvec"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bc2832c24239b0141d5674bb9174f9d68a8b5b3f2753311927c172ca46f7e9c"
-dependencies = [
- "funty",
- "radium",
- "tap",
- "wyz",
-]
+checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
 
 [[package]]
 name = "blake2"
@@ -664,17 +291,6 @@ dependencies = [
  "digest",
 ]
 
-[[package]]
-name = "blanket"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0b121a9fe0df916e362fb3271088d071159cdf11db0e4182d02152850756eff"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
@@ -684,22 +300,11 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "bstr"
-version = "1.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63044e1ae8e69f3b5a92c736ca6269b8d12fa7efe39bf34ddb06d102cf0e2cab"
-dependencies = [
- "memchr",
- "regex-automata",
- "serde",
-]
-
 [[package]]
 name = "bumpalo"
-version = "3.19.0"
+version = "3.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
+checksum = "7f30e7476521f6f8af1a1c4c0b8cc94f0bee37d91763d0ca2665f299b6cd8aec"
 
 [[package]]
 name = "burrow"
@@ -707,57 +312,32 @@ version = "0.1.0"
 dependencies = [
  "aead",
  "anyhow",
- "argon2",
- "arti-client",
  "async-channel",
- "async-stream 0.2.1",
- "axum 0.7.9",
- "base64 0.21.7",
+ "base64",
  "blake2",
- "bytes",
  "caps",
  "chacha20poly1305",
  "clap",
  "console",
  "console-subscriber",
- "dotenv",
  "fehler",
  "futures",
- "hickory-proto",
  "hmac",
- "hyper-util",
  "insta",
  "ip_network",
  "ip_network_table",
- "ipnetwork",
- "libc",
  "libsystemd",
  "log",
- "netstack-smoltcp",
  "nix 0.27.1",
  "once_cell",
  "parking_lot",
- "prost 0.13.5",
- "prost-types 0.13.5",
- "rand 0.8.5",
- "rand_core 0.6.4",
- "reqwest 0.12.23",
+ "rand",
+ "rand_core",
  "ring",
- "rusqlite",
- "rust-ini",
- "schemars 0.8.22",
+ "schemars",
  "serde",
  "serde_json",
- "subtle",
- "tempfile",
  "tokio",
- "tokio-stream",
- "tokio-util",
- "toml 0.8.23",
- "tonic 0.12.3",
- "tonic-build",
- "tor-rtcompat",
- "tower 0.4.13",
  "tracing",
  "tracing-journald",
  "tracing-log 0.1.4",
@@ -767,34 +347,6 @@ dependencies = [
  "x25519-dalek",
 ]
 
-[[package]]
-name = "burrow-core"
-version = "0.1.0"
-
-[[package]]
-name = "burrow-mobile-ffi"
-version = "0.1.0"
-dependencies = [
- "burrow-core",
- "jni",
-]
-
-[[package]]
-name = "burrow-windows-stub"
-version = "0.1.0"
-
-[[package]]
-name = "by_address"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64fa3c856b712db6612c019f14756e64e4bcea13337a6b33b696333a9eaa2d06"
-
-[[package]]
-name = "bytemuck"
-version = "1.25.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
-
 [[package]]
 name = "byteorder"
 version = "1.5.0"
@@ -803,9 +355,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.10.1"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
 
 [[package]]
 name = "bzip2"
@@ -819,11 +371,12 @@ dependencies = [
 
 [[package]]
 name = "bzip2-sys"
-version = "0.1.13+1.0.8"
+version = "0.1.11+1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "225bff33b2141874fe80d71e07d6eec4f85c5c216453dd96388240f96e1acc14"
+checksum = "736a955f3fa7875102d57c82b8cac37ec45224a07fd32d58f9f7a186b6cd4cdc"
 dependencies = [
  "cc",
+ "libc",
  "pkg-config",
 ]
 
@@ -834,59 +387,33 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "190baaad529bcfbde9e1a19022c42781bdb6ff9de25721abdb8fd98c0807730b"
 dependencies = [
  "libc",
- "thiserror 1.0.69",
+ "thiserror",
 ]
 
-[[package]]
-name = "caret"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "beae2cb9f60bc3f21effaaf9c64e51f6627edd54eedc9199ba07f519ef2a2101"
-
-[[package]]
-name = "cast"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
-
 [[package]]
 name = "cc"
-version = "1.2.38"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80f41ae168f955c12fb8960b057d70d0ca153fb83182b57d86380443527be7e9"
+checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
 dependencies = [
- "find-msvc-tools",
  "jobserver",
  "libc",
- "shlex",
 ]
 
-[[package]]
-name = "cesu8"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
-
 [[package]]
 name = "cexpr"
 version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
 dependencies = [
- "nom 7.1.3",
+ "nom",
 ]
 
 [[package]]
 name = "cfg-if"
-version = "1.0.3"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fd1289c04a9ea8cb22300a459a72a385d7c73d3259e2ed7dcb2af674838cfa9"
-
-[[package]]
-name = "cfg_aliases"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chacha20"
@@ -912,45 +439,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "chrono"
-version = "0.4.42"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "145052bdd345b87320e369255277e3fb5152762ad123a901ef5c262dd38fe8d2"
-dependencies = [
- "iana-time-zone",
- "num-traits",
- "serde",
- "windows-link 0.2.1",
-]
-
-[[package]]
-name = "ciborium"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42e69ffd6f0917f5c029256a24d0161db17cea3997d185db0d35926308770f0e"
-dependencies = [
- "ciborium-io",
- "ciborium-ll",
- "serde",
-]
-
-[[package]]
-name = "ciborium-io"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05afea1e0a06c9be33d539b876f1ce3692f4afea2cb41f740e7743225ed1c757"
-
-[[package]]
-name = "ciborium-ll"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57663b653d948a338bfb3eeba9bb2fd5fcfaecb9e199e87e1eda4d9e8b240fd9"
-dependencies = [
- "ciborium-io",
- "half",
-]
-
 [[package]]
 name = "cipher"
 version = "0.4.4"
@@ -964,20 +452,20 @@ dependencies = [
 
 [[package]]
 name = "clang-sys"
-version = "1.8.1"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
+checksum = "67523a3b4be3ce1989d607a828d036249522dd9c1c8de7f4dd2dae43a37369d1"
 dependencies = [
  "glob",
  "libc",
- "libloading 0.8.9",
+ "libloading 0.8.1",
 ]
 
 [[package]]
 name = "clap"
-version = "4.5.48"
+version = "4.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2134bb3ea021b78629caa971416385309e0131b351b25e01dc16fb54e1b5fae"
+checksum = "1e578d6ec4194633722ccf9544794b71b1385c3c027efe0c55db226fc880865c"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -985,100 +473,60 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.48"
+version = "4.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2ba64afa3c0a6df7fa517765e31314e983f51dda798ffba27b988194fb65dc9"
+checksum = "4df4df40ec50c46000231c914968278b1eb05098cf8f1b3a518a95030e71d1c7"
 dependencies = [
  "anstream",
  "anstyle",
  "clap_lex",
- "strsim 0.11.1",
+ "strsim",
 ]
 
 [[package]]
 name = "clap_derive"
-version = "4.5.47"
+version = "4.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbfd7eae0b0f1a6e63d4b13c9c478de77c2eb546fba158ad50b4203dc24b9f9c"
+checksum = "cf9804afaaf59a91e75b022a30fb7229a7901f60c755489cc61c9b423b836442"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.7.5"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b94f61472cee1439c0b966b47e3aca9ae07e45d070759512cd390ea2bebc6675"
-
-[[package]]
-name = "coarsetime"
-version = "0.1.37"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e58eb270476aa4fc7843849f8a35063e8743b4dbcdf6dd0f8ea0886980c204c2"
-dependencies = [
- "libc",
- "wasix",
- "wasm-bindgen",
-]
+checksum = "702fc72eb24e5a1e48ce58027a675bc24edd52096d5397d4aea7c6dd9eca0bd1"
 
 [[package]]
 name = "colorchoice"
-version = "1.0.4"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
-
-[[package]]
-name = "combine"
-version = "4.6.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
-dependencies = [
- "bytes",
- "memchr",
-]
-
-[[package]]
-name = "compression-codecs"
-version = "0.4.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "680dc087785c5230f8e8843e2e57ac7c1c90488b6a91b88caa265410568f441b"
-dependencies = [
- "compression-core",
- "flate2",
- "liblzma",
- "zstd 0.13.3",
- "zstd-safe 7.2.4",
-]
-
-[[package]]
-name = "compression-core"
-version = "0.4.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75984efb6ed102a0d42db99afb6c1948f0380d1d91808d5529916e6c08b49d8d"
+checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
 
 [[package]]
 name = "concurrent-queue"
-version = "2.5.0"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+checksum = "d16048cd947b08fa32c24458a22f5dc5e835264f689f4f5653210c69fd107363"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "console"
-version = "0.15.11"
+version = "0.15.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "054ccb5b10f9f2cbf51eb355ca1d05c2d279ce1804688d0db74b4733a5aeafd8"
+checksum = "0e1f83fc076bd6dd27517eacdf25fef6c4dfe5f1d7448bafaaf3a26f13b5e4eb"
 dependencies = [
  "encode_unicode",
+ "lazy_static",
  "libc",
- "once_cell",
- "unicode-width 0.2.1",
- "windows-sys 0.59.0",
+ "unicode-width",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1088,9 +536,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fd326812b3fd01da5bb1af7d340d0d555fd3d4b641e7f1dfcf5962a902952787"
 dependencies = [
  "futures-core",
- "prost 0.12.6",
- "prost-types 0.12.6",
- "tonic 0.10.2",
+ "prost",
+ "prost-types",
+ "tonic",
  "tracing-core",
 ]
 
@@ -1106,68 +554,24 @@ dependencies = [
  "futures-task",
  "hdrhistogram",
  "humantime",
- "prost-types 0.12.6",
+ "prost-types",
  "serde",
  "serde_json",
  "thread_local",
  "tokio",
  "tokio-stream",
- "tonic 0.10.2",
+ "tonic",
  "tracing",
  "tracing-core",
  "tracing-subscriber",
 ]
 
-[[package]]
-name = "const-oid"
-version = "0.9.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
-
-[[package]]
-name = "const-random"
-version = "0.1.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87e00182fe74b066627d63b85fd550ac2998d4b0bd86bfed477a0ae4c7c71359"
-dependencies = [
- "const-random-macro",
-]
-
-[[package]]
-name = "const-random-macro"
-version = "0.1.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9d839f2a20b0aee515dc581a6172f2321f96cab76c1a38a4c584a194955390e"
-dependencies = [
- "getrandom 0.2.16",
- "once_cell",
- "tiny-keccak",
-]
-
 [[package]]
 name = "constant_time_eq"
 version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc"
 
-[[package]]
-name = "convert_case"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb402b8d4c85569410425650ce3eddc7d698ed96d39a73f941b08fb63082f1e7"
-dependencies = [
- "unicode-segmentation",
-]
-
-[[package]]
-name = "cookie-factory"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9885fa71e26b8ab7855e2ec7cae6e9b380edff76cd052e07c683a0319d51b3a2"
-dependencies = [
- "futures",
-]
-
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
@@ -1180,139 +584,42 @@ dependencies = [
 
 [[package]]
 name = "core-foundation-sys"
-version = "0.8.7"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.17"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "crc32fast"
-version = "1.5.0"
+version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
 dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "criterion"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "950046b2aa2492f9a536f5f4f9a3de7b9e2476e575e05bd6c333371add4d98f3"
-dependencies = [
- "alloca",
- "anes",
- "cast",
- "ciborium",
- "clap",
- "criterion-plot",
- "itertools 0.13.0",
- "num-traits",
- "oorandom",
- "page_size",
- "plotters",
- "rayon",
- "regex",
- "serde",
- "serde_json",
- "tinytemplate",
- "walkdir",
-]
-
-[[package]]
-name = "criterion-cycles-per-byte"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5396de42a52e9e5d8f67ef0702dae30451f310a9ba1c3094dcf228f0be0e54bc"
-dependencies = [
- "cfg-if",
- "criterion",
-]
-
-[[package]]
-name = "criterion-plot"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8d80a2f4f5b554395e47b5d8305bc3d27813bacb73493eb1001e8f76dae29ea"
-dependencies = [
- "cast",
- "itertools 0.13.0",
-]
-
-[[package]]
-name = "critical-section"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
-
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.15"
+version = "0.5.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-deque"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
-dependencies = [
- "crossbeam-epoch",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-epoch"
-version = "0.9.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-queue"
-version = "0.3.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f58bbc28f91df819d0aa2a2c00cd19754769c2fad90579b3592b1c9ba7a3115"
+checksum = "176dc175b78f56c0f321911d9c8eb2b77a78a4860b9c19db83835fea1a46649b"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.21"
+version = "0.8.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
-
-[[package]]
-name = "crunchy"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
-
-[[package]]
-name = "crypto-bigint"
-version = "0.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
-dependencies = [
- "generic-array",
- "rand_core 0.6.4",
- "subtle",
- "zeroize",
-]
+checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"
 
 [[package]]
 name = "crypto-common"
@@ -1321,30 +628,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
 dependencies = [
  "generic-array",
- "rand_core 0.6.4",
+ "rand_core",
  "typenum",
 ]
 
-[[package]]
-name = "ctr"
-version = "0.9.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
-dependencies = [
- "cipher",
-]
-
 [[package]]
 name = "curve25519-dalek"
-version = "4.1.3"
+version = "4.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+checksum = "e89b8c6a2e4b1f45971ad09761aafb85514a84744b67a95e32c3cc1352d1f65c"
 dependencies = [
  "cfg-if",
  "cpufeatures",
  "curve25519-dalek-derive",
- "digest",
  "fiat-crypto",
+ "platforms",
  "rustc_version",
  "subtle",
  "zeroize",
@@ -1358,273 +656,16 @@ checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "darling"
-version = "0.14.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b750cb3417fd1b327431a470f388520309479ab0bf5e323505daf0290cd3850"
-dependencies = [
- "darling_core 0.14.4",
- "darling_macro 0.14.4",
-]
-
-[[package]]
-name = "darling"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0"
-dependencies = [
- "darling_core 0.21.3",
- "darling_macro 0.21.3",
-]
-
-[[package]]
-name = "darling"
-version = "0.23.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
-dependencies = [
- "darling_core 0.23.0",
- "darling_macro 0.23.0",
-]
-
-[[package]]
-name = "darling_core"
-version = "0.14.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "109c1ca6e6b7f82cc233a97004ea8ed7ca123a9af07a8230878fcfda9b158bf0"
-dependencies = [
- "fnv",
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim 0.10.0",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "darling_core"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4"
-dependencies = [
- "fnv",
- "ident_case",
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "darling_core"
-version = "0.23.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
-dependencies = [
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim 0.11.1",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "darling_macro"
-version = "0.14.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4aab4dbc9f7611d8b55048a3a16d2d010c2c8334e46304b40ac1cc14bf3b48e"
-dependencies = [
- "darling_core 0.14.4",
- "quote",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "darling_macro"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
-dependencies = [
- "darling_core 0.21.3",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "darling_macro"
-version = "0.23.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
-dependencies = [
- "darling_core 0.23.0",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "data-encoding"
-version = "2.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
-
-[[package]]
-name = "defmt"
-version = "0.3.100"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0963443817029b2024136fc4dd07a5107eb8f977eaf18fcd1fdeb11306b64ad"
-dependencies = [
- "defmt 1.0.1",
-]
-
-[[package]]
-name = "defmt"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "548d977b6da32fa1d1fda2876453da1e7df63ad0304c8b3dae4dbe7b96f39b78"
-dependencies = [
- "bitflags 1.3.2",
- "defmt-macros",
-]
-
-[[package]]
-name = "defmt-macros"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d4fc12a85bcf441cfe44344c4b72d58493178ce635338a3f3b78943aceb258e"
-dependencies = [
- "defmt-parser",
- "proc-macro-error2",
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "defmt-parser"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
-dependencies = [
- "thiserror 2.0.16",
-]
-
-[[package]]
-name = "der"
-version = "0.7.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
-dependencies = [
- "const-oid",
- "pem-rfc7468",
- "zeroize",
-]
-
-[[package]]
-name = "der-parser"
-version = "10.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6"
-dependencies = [
- "asn1-rs",
- "cookie-factory",
- "displaydoc",
- "nom 7.1.3",
- "num-traits",
- "rusticata-macros",
+ "syn 2.0.48",
 ]
 
 [[package]]
 name = "deranged"
-version = "0.5.3"
+version = "0.3.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d630bccd429a5bb5a64b5e94f693bfc48c9f8566418fda4c494cc94f911f87cc"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
 dependencies = [
  "powerfmt",
- "serde",
-]
-
-[[package]]
-name = "derive-deftly"
-version = "1.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "284db66a66f03c3dafbe17360d959eb76b83f77cfe191677e2a7899c0da291f3"
-dependencies = [
- "derive-deftly-macros",
- "heck",
-]
-
-[[package]]
-name = "derive-deftly-macros"
-version = "1.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caef6056a5788d05d173cdc3c562ac28ae093828f851f69378b74e4e3d578e41"
-dependencies = [
- "heck",
- "indexmap 2.11.4",
- "itertools 0.14.0",
- "proc-macro-crate",
- "proc-macro2",
- "quote",
- "sha3",
- "strum",
- "syn 2.0.106",
- "void",
-]
-
-[[package]]
-name = "derive_builder_core_fork_arti"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24c1b715c79be6328caa9a5e1a387a196ea503740f0722ec3dd8f67a9e72314d"
-dependencies = [
- "darling 0.14.4",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "derive_builder_fork_arti"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3eae24d595f4d0ecc90a9a5a6d11c2bd8dafe2375ec4a1ec63250e5ade7d228"
-dependencies = [
- "derive_builder_macro_fork_arti",
-]
-
-[[package]]
-name = "derive_builder_macro_fork_arti"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69887769a2489cd946bf782eb2b1bb2cb7bc88551440c94a765d4f040c08ebf3"
-dependencies = [
- "derive_builder_core_fork_arti",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "derive_more"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "093242cf7570c207c83073cf82f79706fe7b8317e98620a47d5be7c3d8497678"
-dependencies = [
- "derive_more-impl",
-]
-
-[[package]]
-name = "derive_more-impl"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bda628edc44c4bb645fbe0f758797143e4e07926f7ebf4e9bdfbd3d2ce621df3"
-dependencies = [
- "convert_case",
- "proc-macro2",
- "quote",
- "syn 2.0.106",
- "unicode-xid",
 ]
 
 [[package]]
@@ -1634,259 +675,58 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer",
- "const-oid",
  "crypto-common",
  "subtle",
 ]
 
-[[package]]
-name = "directories"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16f5094c54661b38d03bd7e50df373292118db60b585c08a411c6d840017fe7d"
-dependencies = [
- "dirs-sys",
-]
-
-[[package]]
-name = "dirs"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
-dependencies = [
- "dirs-sys",
-]
-
-[[package]]
-name = "dirs-sys"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
-dependencies = [
- "libc",
- "option-ext",
- "redox_users",
- "windows-sys 0.61.0",
-]
-
-[[package]]
-name = "displaydoc"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "dlv-list"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "442039f5147480ba31067cb00ada1adae6892028e40e45fc5de7b7df6dcc1b5f"
-dependencies = [
- "const-random",
-]
-
-[[package]]
-name = "dotenv"
-version = "0.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77c90badedccf4105eca100756a0b1289e191f6fcbdadd3cee1d2f614f97da8f"
-
-[[package]]
-name = "downcast-rs"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "117240f60069e65410b3ae1bb213295bd828f707b5bec6596a1afc8793ce0cbc"
-
 [[package]]
 name = "dyn-clone"
-version = "1.0.20"
+version = "1.0.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
-
-[[package]]
-name = "ecdsa"
-version = "0.16.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
-dependencies = [
- "der",
- "digest",
- "elliptic-curve",
- "rfc6979",
- "signature",
- "spki",
-]
-
-[[package]]
-name = "ed25519"
-version = "2.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
-dependencies = [
- "pkcs8",
- "signature",
-]
-
-[[package]]
-name = "ed25519-dalek"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
-dependencies = [
- "curve25519-dalek",
- "ed25519",
- "merlin",
- "rand_core 0.6.4",
- "serde",
- "sha2",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "educe"
-version = "0.4.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f0042ff8246a363dbe77d2ceedb073339e85a804b9a47636c6e016a9a32c05f"
-dependencies = [
- "enum-ordinalize",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
+checksum = "545b22097d44f8a9581187cdf93de7a71e4722bf51200cfaba810865b49a495d"
 
 [[package]]
 name = "either"
-version = "1.15.0"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
-
-[[package]]
-name = "elliptic-curve"
-version = "0.13.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
-dependencies = [
- "base16ct",
- "crypto-bigint",
- "digest",
- "ff",
- "generic-array",
- "group",
- "pkcs8",
- "rand_core 0.6.4",
- "sec1",
- "subtle",
- "zeroize",
-]
+checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
 
 [[package]]
 name = "encode_unicode"
-version = "1.0.0"
+version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
+checksum = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f"
 
 [[package]]
 name = "encoding_rs"
-version = "0.8.35"
+version = "0.8.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+checksum = "7268b386296a025e474d5140678f75d6de9493ae55a5d709eeb9dd08149945e1"
 dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "enum-as-inner"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "enum-ordinalize"
-version = "3.1.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bf1fa3f06bbff1ea5b1a9c7b14aa992a39657db60a2759457328d7e058f49ee"
-dependencies = [
- "num-bigint",
- "num-traits",
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "enum_dispatch"
-version = "0.3.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa18ce2bc66555b3218614519ac839ddb759a7d6720732f979ef8d13be147ecd"
-dependencies = [
- "once_cell",
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "enumset"
-version = "1.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25b07a8dfbbbfc0064c0a6bdf9edcf966de6b1c33ce344bdeca3b41615452634"
-dependencies = [
- "enumset_derive",
-]
-
-[[package]]
-name = "enumset_derive"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f43e744e4ea338060faee68ed933e46e722fb7f3617e722a5772d7e856d8b3ce"
-dependencies = [
- "darling 0.21.3",
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
 [[package]]
 name = "equivalent"
-version = "1.0.2"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
 [[package]]
 name = "errno"
-version = "0.3.14"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+checksum = "a258e46cdc063eb8519c00b9fc845fc47bcfca4130e2f08e88665ceda8474245"
 dependencies = [
  "libc",
- "windows-sys 0.61.0",
-]
-
-[[package]]
-name = "etherparse"
-version = "0.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8d8a704b617484e9d867a0423cd45f7577f008c4068e2e33378f8d3860a6d73"
-dependencies = [
- "arrayvec",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "event-listener"
-version = "5.4.1"
+version = "4.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+checksum = "67b215c49b2b248c855fb73579eb1f4f26c38ffdc12973e20e07b91d78d5646e"
 dependencies = [
  "concurrent-queue",
  "parking",
@@ -1895,31 +735,19 @@ dependencies = [
 
 [[package]]
 name = "event-listener-strategy"
-version = "0.5.4"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
+checksum = "958e4d70b6d5e81971bebec42271ec641e7ff4e170a6fa605f2b8a8b65cb97d3"
 dependencies = [
  "event-listener",
  "pin-project-lite",
 ]
 
-[[package]]
-name = "fallible-iterator"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
-
-[[package]]
-name = "fallible-streaming-iterator"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
-
 [[package]]
 name = "fastrand"
-version = "2.3.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
 
 [[package]]
 name = "fehler"
@@ -1941,92 +769,28 @@ dependencies = [
  "syn 1.0.109",
 ]
 
-[[package]]
-name = "ff"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
-dependencies = [
- "rand_core 0.6.4",
- "subtle",
-]
-
 [[package]]
 name = "fiat-crypto"
-version = "0.2.9"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
-
-[[package]]
-name = "figment"
-version = "0.10.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8cb01cd46b0cf372153850f4c6c272d9cbea2da513e07538405148f95bd789f3"
-dependencies = [
- "atomic 0.6.1",
- "serde",
- "toml 0.8.23",
- "uncased",
- "version_check",
-]
-
-[[package]]
-name = "filetime"
-version = "0.2.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f98844151eee8917efc50bd9e8318cb963ae8b297431495d3f758616ea5c57db"
-dependencies = [
- "cfg-if",
- "libc",
- "libredox",
-]
-
-[[package]]
-name = "find-msvc-tools"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ced73b1dacfc750a6db6c0a0c3a3853c8b41997e2e2c563dc90804ae6867959"
-
-[[package]]
-name = "fixedbitset"
-version = "0.5.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
+checksum = "27573eac26f4dd11e2b1916c3fe1baa56407c83c71a773a8ba17ec0bca03b6b7"
 
 [[package]]
 name = "flate2"
-version = "1.1.2"
+version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a3d7db9596fecd151c5f638c0ee5d5bd487b6e0ea232e5dc96d5250f6f94b1d"
+checksum = "46303f565772937ffe1d394a4fac6f411c6013172fadde9dcdb1e147a086940e"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
 ]
 
-[[package]]
-name = "fluid-let"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "749cff877dc1af878a0b31a41dd221a753634401ea0ef2f87b62d3171522485a"
-
 [[package]]
 name = "fnv"
 version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
-[[package]]
-name = "foldhash"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
-
-[[package]]
-name = "foldhash"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
-
 [[package]]
 name = "foreign-types"
 version = "0.3.2"
@@ -2044,49 +808,18 @@ checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
 
 [[package]]
 name = "form_urlencoded"
-version = "1.2.2"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456"
 dependencies = [
  "percent-encoding",
 ]
 
-[[package]]
-name = "fs-mistrust"
-version = "0.14.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f5ac9f88fd18733e0f9ce1f4a95c40eb1d4f83131bf1472e81d1f128fefb7c2"
-dependencies = [
- "derive_builder_fork_arti",
- "dirs",
- "libc",
- "pwd-grp",
- "serde",
- "thiserror 2.0.16",
- "walkdir",
-]
-
-[[package]]
-name = "fslock"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04412b8935272e3a9bae6f48c7bfff74c2911f60525404edfdd28e49884c3bfb"
-dependencies = [
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "funty"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
-
 [[package]]
 name = "futures"
-version = "0.3.31"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
+checksum = "645c6916888f6cb6350d2550b80fb63e734897a8498abe35cfb732b6487804b0"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -2099,9 +832,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.31"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
+checksum = "eac8f7d7865dcb88bd4373ab671c8cf4508703796caa2b1985a9ca867b3fcb78"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -2109,15 +842,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.31"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
+checksum = "dfc6580bb841c5a68e9ef15c77ccc837b40a7504914d52e47b8b0e9bbda25a1d"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.31"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
+checksum = "a576fc72ae164fca6b9db127eaa9a9dda0d61316034f33a0a0d4eda41f02b01d"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -2126,38 +859,38 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.31"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
+checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.31"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
+checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.31"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
+checksum = "9fb8e00e87438d937621c1c6269e53f536c14d3fbd6a042bb24879e57d474fb5"
 
 [[package]]
 name = "futures-task"
-version = "0.3.31"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
+checksum = "38d84fa142264698cdce1a9f9172cf383a0c82de1bddcf3092901442c4097004"
 
 [[package]]
 name = "futures-util"
-version = "0.3.31"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
+checksum = "3d6401deb83407ab3da39eba7e33987a73c3df0c82b4bb5813ee871c19c41d48"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -2179,148 +912,50 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
  "typenum",
  "version_check",
- "zeroize",
 ]
 
 [[package]]
 name = "getrandom"
-version = "0.2.16"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
-dependencies = [
- "cfg-if",
- "js-sys",
- "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
-dependencies = [
- "cfg-if",
- "js-sys",
- "libc",
- "r-efi 5.3.0",
- "wasi 0.14.7+wasi-0.2.4",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
 dependencies = [
  "cfg-if",
  "libc",
- "r-efi 6.0.0",
- "wasip2",
- "wasip3",
-]
-
-[[package]]
-name = "getset"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cf0fc11e47561d47397154977bc219f4cf809b2974facc3ccb3b89e2436f912"
-dependencies = [
- "proc-macro-error2",
- "proc-macro2",
- "quote",
- "syn 2.0.106",
+ "wasi",
 ]
 
 [[package]]
 name = "gimli"
-version = "0.31.1"
+version = "0.28.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
+checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
 
 [[package]]
 name = "glob"
-version = "0.3.3"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
-
-[[package]]
-name = "glob-match"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9985c9503b412198aa4197559e9a318524ebc4519c229bfa05a535828c950b9d"
-
-[[package]]
-name = "group"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
-dependencies = [
- "ff",
- "rand_core 0.6.4",
- "subtle",
-]
+checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
 
 [[package]]
 name = "h2"
-version = "0.3.27"
+version = "0.3.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0beca50380b1fc32983fc1cb4587bfa4bb9e78fc259aad4a0032d2080309222d"
+checksum = "bb2c4422095b67ee78da96fbb51a4cc413b3b25883c7717ff7ca1ab31022c9c9"
 dependencies = [
  "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
  "futures-util",
- "http 0.2.12",
- "indexmap 2.11.4",
+ "http",
+ "indexmap 2.1.0",
  "slab",
  "tokio",
  "tokio-util",
  "tracing",
 ]
 
-[[package]]
-name = "h2"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c0b69cfcb4e1b9f1bf2f53f95f766e4661169728ec61cd3fe5a0166f2d1386"
-dependencies = [
- "atomic-waker",
- "bytes",
- "fnv",
- "futures-core",
- "futures-sink",
- "http 1.3.1",
- "indexmap 2.11.4",
- "slab",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
-[[package]]
-name = "half"
-version = "2.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
-dependencies = [
- "cfg-if",
- "crunchy",
- "zerocopy",
-]
-
-[[package]]
-name = "hash32"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47d60b12902ba28e2730cd37e95b8c9223af2808df9e902d4df49588d1470606"
-dependencies = [
- "byteorder",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.12.3"
@@ -2329,36 +964,9 @@ checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
 [[package]]
 name = "hashbrown"
-version = "0.14.5"
+version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-
-[[package]]
-name = "hashbrown"
-version = "0.15.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
-dependencies = [
- "foldhash 0.1.5",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.16.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
-dependencies = [
- "foldhash 0.2.0",
-]
-
-[[package]]
-name = "hashlink"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea0b22561a9c04a7cb1a302c013e0259cd3b4bb619f145b32f72b8b4bcbed230"
-dependencies = [
- "hashbrown 0.16.1",
-]
+checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
 
 [[package]]
 name = "hdrhistogram"
@@ -2366,28 +974,24 @@ version = "7.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "765c9198f173dd59ce26ff9f95ef0aafd0a0fe01fb9d72841bc5066a4c06511d"
 dependencies = [
- "base64 0.21.7",
+ "base64",
  "byteorder",
  "flate2",
- "nom 7.1.3",
+ "nom",
  "num-traits",
 ]
 
 [[package]]
-name = "heapless"
-version = "0.8.0"
+name = "heck"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bfb9eb618601c89945a70e254898da93b13be0388091d42117462b265bb3fad"
-dependencies = [
- "hash32",
- "stable_deref_trait",
-]
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
 
 [[package]]
-name = "heck"
-version = "0.5.0"
+name = "hermit-abi"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+checksum = "5d3d0e0f38255e7fa3cf31335b3a56f05febd18025f4db5ef7a0cfb4f8da651f"
 
 [[package]]
 name = "hex"
@@ -2395,40 +999,6 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
-[[package]]
-name = "hickory-proto"
-version = "0.25.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8a6fe56c0038198998a6f217ca4e7ef3a5e51f46163bd6dd60b5c71ca6c6502"
-dependencies = [
- "async-trait",
- "cfg-if",
- "data-encoding",
- "enum-as-inner",
- "futures-channel",
- "futures-io",
- "futures-util",
- "idna",
- "ipnet",
- "once_cell",
- "rand 0.9.2",
- "ring",
- "thiserror 2.0.16",
- "tinyvec",
- "tokio",
- "tracing",
- "url",
-]
-
-[[package]]
-name = "hkdf"
-version = "0.12.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
-dependencies = [
- "hmac",
-]
-
 [[package]]
 name = "hmac"
 version = "0.12.1"
@@ -2440,35 +1010,18 @@ dependencies = [
 
 [[package]]
 name = "home"
-version = "0.5.11"
+version = "0.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf"
+checksum = "e3d1354bf6b7235cb4a0576c2619fd4ed18183f689b12b006a0ee7329eeff9a5"
 dependencies = [
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "hostname-validator"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f558a64ac9af88b5ba400d99b579451af0d39c6d360980045b91aac966d705e2"
-
-[[package]]
-name = "http"
-version = "0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
-dependencies = [
- "bytes",
- "fnv",
- "itoa",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "http"
-version = "1.3.1"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4a85d31aea989eead29a3aaf9e1115a180df8282431156e533de47660892565"
+checksum = "8947b1a6fad4393052c7ba1f4cd97bed3e953a95c79c92ad9b051a04611d9fbb"
 dependencies = [
  "bytes",
  "fnv",
@@ -2482,38 +1035,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
 dependencies = [
  "bytes",
- "http 0.2.12",
- "pin-project-lite",
-]
-
-[[package]]
-name = "http-body"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
-dependencies = [
- "bytes",
- "http 1.3.1",
-]
-
-[[package]]
-name = "http-body-util"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
-dependencies = [
- "bytes",
- "futures-core",
- "http 1.3.1",
- "http-body 1.0.1",
+ "http",
  "pin-project-lite",
 ]
 
 [[package]]
 name = "httparse"
-version = "1.10.1"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
 
 [[package]]
 name = "httpdate"
@@ -2523,109 +1053,46 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "humantime"
-version = "2.3.0"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "135b12329e5e3ce057a9f972339ea52bc954fe1e9358ef27f95e89716fbc5424"
-
-[[package]]
-name = "humantime-serde"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57a3db5ea5923d99402c94e9feb261dc5ee9b4efa158b0315f788cf549cc200c"
-dependencies = [
- "humantime",
- "serde",
-]
+checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 
 [[package]]
 name = "hyper"
-version = "0.14.32"
+version = "0.14.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7"
+checksum = "bf96e135eb83a2a8ddf766e426a841d8ddd7449d5f00d34ea02b41d2f19eef80"
 dependencies = [
  "bytes",
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2 0.3.27",
- "http 0.2.12",
- "http-body 0.4.6",
+ "h2",
+ "http",
+ "http-body",
  "httparse",
  "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2 0.5.10",
+ "socket2 0.5.5",
  "tokio",
  "tower-service",
  "tracing",
  "want",
 ]
 
-[[package]]
-name = "hyper"
-version = "1.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb3aa54a13a0dfe7fbe3a59e0c76093041720fdc77b110cc0fc260fafb4dc51e"
-dependencies = [
- "atomic-waker",
- "bytes",
- "futures-channel",
- "futures-core",
- "h2 0.4.12",
- "http 1.3.1",
- "http-body 1.0.1",
- "httparse",
- "httpdate",
- "itoa",
- "pin-project-lite",
- "pin-utils",
- "smallvec",
- "tokio",
- "want",
-]
-
-[[package]]
-name = "hyper-rustls"
-version = "0.27.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
-dependencies = [
- "http 1.3.1",
- "hyper 1.7.0",
- "hyper-util",
- "rustls",
- "rustls-pki-types",
- "tokio",
- "tokio-rustls",
- "tower-service",
- "webpki-roots",
-]
-
 [[package]]
 name = "hyper-timeout"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbb958482e8c7be4bc3cf272a766a2b0bf1a6755e7a6ae777f017a31d11b13b1"
 dependencies = [
- "hyper 0.14.32",
+ "hyper",
  "pin-project-lite",
  "tokio",
  "tokio-io-timeout",
 ]
 
-[[package]]
-name = "hyper-timeout"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
-dependencies = [
- "hyper 1.7.0",
- "hyper-util",
- "pin-project-lite",
- "tokio",
- "tower-service",
-]
-
 [[package]]
 name = "hyper-tls"
 version = "0.5.0"
@@ -2633,177 +1100,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
 dependencies = [
  "bytes",
- "hyper 0.14.32",
+ "hyper",
  "native-tls",
  "tokio",
  "tokio-native-tls",
 ]
 
-[[package]]
-name = "hyper-util"
-version = "0.1.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c6995591a8f1380fcb4ba966a252a4b29188d51d2b89e3a252f5305be65aea8"
-dependencies = [
- "base64 0.22.1",
- "bytes",
- "futures-channel",
- "futures-core",
- "futures-util",
- "http 1.3.1",
- "http-body 1.0.1",
- "hyper 1.7.0",
- "ipnet",
- "libc",
- "percent-encoding",
- "pin-project-lite",
- "socket2 0.6.3",
- "tokio",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "iana-time-zone"
-version = "0.1.64"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33e57f83510bb73707521ebaffa789ec8caf86f9657cad665b092b581d40e9fb"
-dependencies = [
- "android_system_properties",
- "core-foundation-sys",
- "iana-time-zone-haiku",
- "js-sys",
- "log",
- "wasm-bindgen",
- "windows-core 0.62.2",
-]
-
-[[package]]
-name = "iana-time-zone-haiku"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "icu_collections"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "200072f5d0e3614556f94a9930d5dc3e0662a652823904c3a75dc3b0af7fee47"
-dependencies = [
- "displaydoc",
- "potential_utf",
- "yoke",
- "zerofrom",
- "zerovec",
-]
-
-[[package]]
-name = "icu_locale_core"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cde2700ccaed3872079a65fb1a78f6c0a36c91570f28755dda67bc8f7d9f00a"
-dependencies = [
- "displaydoc",
- "litemap",
- "tinystr",
- "writeable",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "436880e8e18df4d7bbc06d58432329d6458cc84531f7ac5f024e93deadb37979"
-dependencies = [
- "displaydoc",
- "icu_collections",
- "icu_normalizer_data",
- "icu_properties",
- "icu_provider",
- "smallvec",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer_data"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00210d6893afc98edb752b664b8890f0ef174c8adbb8d0be9710fa66fbbf72d3"
-
-[[package]]
-name = "icu_properties"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "016c619c1eeb94efb86809b015c58f479963de65bdb6253345c1a1276f22e32b"
-dependencies = [
- "displaydoc",
- "icu_collections",
- "icu_locale_core",
- "icu_properties_data",
- "icu_provider",
- "potential_utf",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "icu_properties_data"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "298459143998310acd25ffe6810ed544932242d3f07083eee1084d83a71bd632"
-
-[[package]]
-name = "icu_provider"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03c80da27b5f4187909049ee2d72f276f0d9f99a42c306bd0131ecfe04d8e5af"
-dependencies = [
- "displaydoc",
- "icu_locale_core",
- "stable_deref_trait",
- "tinystr",
- "writeable",
- "yoke",
- "zerofrom",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "id-arena"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
-
-[[package]]
-name = "ident_case"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
-
 [[package]]
 name = "idna"
-version = "1.1.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+checksum = "634d9b1461af396cad843f47fdba5597a4f9e6ddd4bfb6ff5d85028c25cb12f6"
 dependencies = [
- "idna_adapter",
- "smallvec",
- "utf8_iter",
-]
-
-[[package]]
-name = "idna_adapter"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
-dependencies = [
- "icu_normalizer",
- "icu_properties",
+ "unicode-bidi",
+ "unicode-normalization",
 ]
 
 [[package]]
@@ -2814,80 +1124,39 @@ checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
 dependencies = [
  "autocfg",
  "hashbrown 0.12.3",
- "serde",
 ]
 
 [[package]]
 name = "indexmap"
-version = "2.11.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b0f83760fb341a774ed326568e19f5a863af4a952def8c39f9ab92fd95b88e5"
+checksum = "d530e1a18b1cb4c484e6e34556a0d948706958449fca0cab753d649f2bce3d1f"
 dependencies = [
  "equivalent",
- "hashbrown 0.16.1",
- "serde",
- "serde_core",
-]
-
-[[package]]
-name = "inotify"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd5b3eaf1a28b758ac0faa5a4254e8ab2705605496f1b1f3fbbc3988ad73d199"
-dependencies = [
- "bitflags 2.9.4",
- "inotify-sys",
- "libc",
-]
-
-[[package]]
-name = "inotify-sys"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e05c02b5e89bff3b946cedeca278abc628fe811e604f027c45a8aa3cf793d0eb"
-dependencies = [
- "libc",
+ "hashbrown 0.14.3",
 ]
 
 [[package]]
 name = "inout"
-version = "0.1.4"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
 dependencies = [
  "generic-array",
 ]
 
 [[package]]
 name = "insta"
-version = "1.43.2"
+version = "1.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46fdb647ebde000f43b5b53f773c30cf9b0cb4300453208713fa38b2c70935a0"
+checksum = "5d64600be34b2fcfc267740a243fa7744441bb4947a619ac4e5bb6507f35fbfc"
 dependencies = [
  "console",
- "once_cell",
+ "lazy_static",
+ "linked-hash-map",
  "serde",
  "similar",
-]
-
-[[package]]
-name = "inventory"
-version = "0.3.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4f0c30c76f2f4ccee3fe55a2435f691ca00c0e4bd87abe4f4a851b1d4dac39b"
-dependencies = [
- "rustversion",
-]
-
-[[package]]
-name = "io-uring"
-version = "0.7.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "046fa2d4d00aea763528b4950358d0ead425372445dc8ff86312b3c69ff7727b"
-dependencies = [
- "bitflags 2.9.4",
- "cfg-if",
- "libc",
+ "yaml-rust",
 ]
 
 [[package]]
@@ -2914,171 +1183,48 @@ checksum = "8e537132deb99c0eb4b752f0346b6a836200eaaa3516dd7e5514b63930a09e5d"
 
 [[package]]
 name = "ipnet"
-version = "2.11.0"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
-
-[[package]]
-name = "ipnetwork"
-version = "0.21.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf370abdafd54d13e54a620e8c3e1145f28e46cc9d704bc6d94414559df41763"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "iri-string"
-version = "0.7.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbc5ebe9c3a1a7a5127f920a418f7585e9e758e911d0466ed004f393b0e380b2"
-dependencies = [
- "memchr",
- "serde",
-]
-
-[[package]]
-name = "is_terminal_polyfill"
-version = "1.70.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
+checksum = "8f518f335dce6725a761382244631d86cf0ccb2863413590b31338feb467f9c3"
 
 [[package]]
 name = "itertools"
-version = "0.12.1"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
-dependencies = [
- "either",
-]
-
-[[package]]
-name = "itertools"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
-dependencies = [
- "either",
-]
-
-[[package]]
-name = "itertools"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+checksum = "b1c173a5686ce8bfa551b3563d0c2170bf24ca44da99c7ca4bfdab5418c3fe57"
 dependencies = [
  "either",
 ]
 
 [[package]]
 name = "itoa"
-version = "1.0.15"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
-
-[[package]]
-name = "jni"
-version = "0.21.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97"
-dependencies = [
- "cesu8",
- "cfg-if",
- "combine",
- "jni-sys 0.3.1",
- "log",
- "thiserror 1.0.69",
- "walkdir",
- "windows-sys 0.45.0",
-]
-
-[[package]]
-name = "jni-sys"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41a652e1f9b6e0275df1f15b32661cf0d4b78d4d87ddec5e0c3c20f097433258"
-dependencies = [
- "jni-sys 0.4.1",
-]
-
-[[package]]
-name = "jni-sys"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
-dependencies = [
- "jni-sys-macros",
-]
-
-[[package]]
-name = "jni-sys-macros"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
-dependencies = [
- "quote",
- "syn 2.0.106",
-]
+checksum = "b1a46d1a171d865aa5f83f92695765caa047a9b4cbae2cbf37dbd613a793fd4c"
 
 [[package]]
 name = "jobserver"
-version = "0.1.34"
+version = "0.1.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
+checksum = "8c37f63953c4c63420ed5fd3d6d398c719489b9f872b9fa683262f8edd363c7d"
 dependencies = [
- "getrandom 0.3.3",
  "libc",
 ]
 
 [[package]]
 name = "js-sys"
-version = "0.3.93"
+version = "0.3.67"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "797146bb2677299a1eb6b7b50a890f4c361b29ef967addf5b2fa45dae1bb6d7d"
+checksum = "9a1d36f1235bc969acba30b7f5990b864423a6068a10f7c90ae8f0112e3a59d1"
 dependencies = [
- "cfg-if",
- "futures-util",
- "once_cell",
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "keccak"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
-dependencies = [
- "cpufeatures",
-]
-
-[[package]]
-name = "kqueue"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eac30106d7dce88daf4a3fcb4879ea939476d5074a9b7ddd0fb97fa4bed5596a"
-dependencies = [
- "kqueue-sys",
- "libc",
-]
-
-[[package]]
-name = "kqueue-sys"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed9625ffda8729b85e45cf04090035ac368927b8cebc34898e7c120f52e4838b"
-dependencies = [
- "bitflags 1.3.2",
- "libc",
-]
-
 [[package]]
 name = "lazy_static"
-version = "1.5.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
-dependencies = [
- "spin",
-]
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "lazycell"
@@ -3086,17 +1232,11 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
-[[package]]
-name = "leb128fmt"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
-
 [[package]]
 name = "libc"
-version = "0.2.176"
+version = "0.2.152"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58f929b4d672ea937a23a1ab494143d968337a5f47e56d0815df1e0890ddf174"
+checksum = "13e3bf6590cbc649f4d1a3eefc9d5d6eb746f5200ffb04e5e142700b8faa56e7"
 
 [[package]]
 name = "libloading"
@@ -3110,104 +1250,49 @@ dependencies = [
 
 [[package]]
 name = "libloading"
-version = "0.8.9"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
+checksum = "c571b676ddfc9a8c12f1f3d3085a7b163966a8fd8098a90640953ce5f6170161"
 dependencies = [
  "cfg-if",
- "windows-link 0.2.1",
-]
-
-[[package]]
-name = "liblzma"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6033b77c21d1f56deeae8014eb9fbe7bdf1765185a6c508b5ca82eeaed7f899"
-dependencies = [
- "liblzma-sys",
-]
-
-[[package]]
-name = "liblzma-sys"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f2db66f3268487b5033077f266da6777d057949b8f93c8ad82e441df25e6186"
-dependencies = [
- "cc",
- "libc",
- "pkg-config",
-]
-
-[[package]]
-name = "libm"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
-
-[[package]]
-name = "libredox"
-version = "0.1.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ddbf48fd451246b1f8c2610bd3b4ac0cc6e149d89832867093ab69a17194f08"
-dependencies = [
- "bitflags 2.9.4",
- "libc",
- "plain",
- "redox_syscall 0.7.3",
-]
-
-[[package]]
-name = "libsqlite3-sys"
-version = "0.36.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95b4103cffefa72eb8428cb6b47d6627161e51c2739fc5e3b734584157bc642a"
-dependencies = [
- "cc",
- "pkg-config",
- "vcpkg",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
 name = "libsystemd"
-version = "0.7.2"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19c97a761fc86953c5b885422b22c891dbf5bcb9dcc99d0110d6ce4c052759f0"
+checksum = "c592dc396b464005f78a5853555b9f240bc5378bf5221acc4e129910b2678869"
 dependencies = [
  "hmac",
  "libc",
  "log",
- "nix 0.29.0",
- "nom 8.0.0",
+ "nix 0.27.1",
+ "nom",
  "once_cell",
  "serde",
  "sha2",
- "thiserror 2.0.16",
+ "thiserror",
  "uuid",
 ]
 
 [[package]]
-name = "linux-raw-sys"
-version = "0.4.15"
+name = "linked-hash-map"
+version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
+checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.11.0"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
-
-[[package]]
-name = "litemap"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "241eaef5fd12c88705a01fc1066c48c4b36e0dd4377dcdc7ec3942cea7a69956"
+checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
 
 [[package]]
 name = "lock_api"
-version = "0.4.13"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96936507f153605bddfcda068dd804796c84324ed2510809e5b2a624c81da765"
+checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -3215,29 +1300,17 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.28"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
-
-[[package]]
-name = "lru-slab"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
-
-[[package]]
-name = "managed"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ca88d725a0a943b096803bd34e73a4437208b6077654cc4ecb2947a5f91618d"
+checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
 
 [[package]]
 name = "matchers"
-version = "0.2.0"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+checksum = "8263075bb86c5a1b1427b5ae862e8889656f126e9f77c484496e8b47cf5c5558"
 dependencies = [
- "regex-automata",
+ "regex-automata 0.1.10",
 ]
 
 [[package]]
@@ -3248,18 +1321,9 @@ checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
 
 [[package]]
 name = "memchr"
-version = "2.7.5"
+version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
-
-[[package]]
-name = "memmap2"
-version = "0.9.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714098028fe011992e1c3962653c96b2d578c4b4bce9036e15ff220319b1e0e3"
-dependencies = [
- "libc",
-]
+checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
 
 [[package]]
 name = "memoffset"
@@ -3272,25 +1336,13 @@ dependencies = [
 
 [[package]]
 name = "memoffset"
-version = "0.9.1"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
 dependencies = [
  "autocfg",
 ]
 
-[[package]]
-name = "merlin"
-version = "3.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58c38e2799fc0978b65dfff8023ec7843e2330bb462f19198840b34b6582397d"
-dependencies = [
- "byteorder",
- "keccak",
- "rand_core 0.6.4",
- "zeroize",
-]
-
 [[package]]
 name = "miette"
 version = "5.10.0"
@@ -3299,8 +1351,8 @@ checksum = "59bb584eaeeab6bd0226ccf3509a69d7936d148cf3d036ad350abe35e8c6856e"
 dependencies = [
  "miette-derive",
  "once_cell",
- "thiserror 1.0.69",
- "unicode-width 0.1.14",
+ "thiserror",
+ "unicode-width",
 ]
 
 [[package]]
@@ -3311,7 +1363,7 @@ checksum = "49e7bc1560b95a3c4a25d03de42fe76ca718ab92d1a22a55b9b4cf67b3ae635c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
@@ -3328,37 +1380,31 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.8.9"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
 dependencies = [
- "adler2",
+ "adler",
 ]
 
 [[package]]
 name = "mio"
-version = "1.0.4"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
+checksum = "8f3d0b296e374a4e6f3c7b0a1f5a51d748a0d34c85e7dc48fc3fa9a87657fe09"
 dependencies = [
  "libc",
- "log",
- "wasi 0.11.1+wasi-snapshot-preview1",
- "windows-sys 0.59.0",
+ "wasi",
+ "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "multimap"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d87ecb2933e8aeadb3e3a02b828fed80a7528047e68b4f424523a0981a3a084"
-
 [[package]]
 name = "native-tls"
-version = "0.2.14"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87de3442987e9dbec73158d5c715e7ad9072fda936bb03d19d7fa10e00520f0e"
+checksum = "07226173c32f2926027b63cce4bcd8076c3552846cbe7925f3aaffeac0a3b92e"
 dependencies = [
+ "lazy_static",
  "libc",
  "log",
  "openssl",
@@ -3370,22 +1416,6 @@ dependencies = [
  "tempfile",
 ]
 
-[[package]]
-name = "netstack-smoltcp"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab8eb143b5f4a5907f5ac72a929edf6c9d9454485cf5a3a35ce8fd3c62165adf"
-dependencies = [
- "etherparse",
- "futures",
- "rand 0.8.5",
- "smoltcp",
- "spin",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
 [[package]]
 name = "nix"
 version = "0.26.4"
@@ -3405,23 +1435,10 @@ version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.4.2",
  "cfg-if",
  "libc",
- "memoffset 0.9.1",
-]
-
-[[package]]
-name = "nix"
-version = "0.29.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
-dependencies = [
- "bitflags 2.9.4",
- "cfg-if",
- "cfg_aliases",
- "libc",
- "memoffset 0.9.1",
+ "memoffset 0.9.0",
 ]
 
 [[package]]
@@ -3435,220 +1452,62 @@ dependencies = [
 ]
 
 [[package]]
-name = "nom"
-version = "8.0.0"
+name = "nu-ansi-term"
+version = "0.46.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "nonany"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6b8866ec53810a9a4b3d434a29801e78c707430a9ae11c2db4b8b62bb9675a0"
-
-[[package]]
-name = "notify"
-version = "8.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d3d07927151ff8575b7087f245456e549fea62edf0ec4e565a5ee50c8402bc3"
-dependencies = [
- "bitflags 2.9.4",
- "inotify",
- "kqueue",
- "libc",
- "log",
- "mio",
- "notify-types",
- "walkdir",
- "windows-sys 0.60.2",
-]
-
-[[package]]
-name = "notify-types"
-version = "2.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42b8cfee0e339a0337359f3c88165702ac6e600dc01c0cc9579a92d62b08477a"
-dependencies = [
- "bitflags 2.9.4",
-]
-
-[[package]]
-name = "ntapi"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3b335231dfd352ffb0f8017f3b6027a4917f7df785ea2143d8af2adc66980ae"
+checksum = "77a8165726e8236064dbb45459242600304b42a5ea24ee2948e18e023bf7ba84"
 dependencies = [
+ "overload",
  "winapi",
 ]
 
-[[package]]
-name = "nu-ansi-term"
-version = "0.50.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4a28e057d01f97e61255210fcff094d74ed0466038633e95017f5beb68e4399"
-dependencies = [
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "num-bigint"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
-dependencies = [
- "num-integer",
- "num-traits",
-]
-
-[[package]]
-name = "num-bigint-dig"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
-dependencies = [
- "lazy_static",
- "libm",
- "num-integer",
- "num-iter",
- "num-traits",
- "rand 0.8.5",
- "smallvec",
- "zeroize",
-]
-
-[[package]]
-name = "num-conv"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6673768db2d862beb9b39a78fdcb1a69439615d5794a1be50caa9bc92c81967"
-
-[[package]]
-name = "num-integer"
-version = "0.1.46"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
-dependencies = [
- "num-traits",
-]
-
-[[package]]
-name = "num-iter"
-version = "0.1.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
-dependencies = [
- "autocfg",
- "num-integer",
- "num-traits",
-]
-
 [[package]]
 name = "num-traits"
-version = "0.2.19"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
 dependencies = [
  "autocfg",
- "libm",
 ]
 
 [[package]]
-name = "num_enum"
-version = "0.7.5"
+name = "num_cpus"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1207a7e20ad57b847bbddc6776b968420d38292bbfe2089accff5e19e82454c"
-dependencies = [
- "num_enum_derive",
- "rustversion",
-]
-
-[[package]]
-name = "num_enum_derive"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff32365de1b6743cb203b710788263c44a03de03802daf96092f2da4fe6ba4d7"
-dependencies = [
- "proc-macro-crate",
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "objc2-core-foundation"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
-dependencies = [
- "bitflags 2.9.4",
-]
-
-[[package]]
-name = "objc2-io-kit"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33fafba39597d6dc1fb709123dfa8289d39406734be322956a69f0931c73bb15"
+checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
 dependencies = [
+ "hermit-abi",
  "libc",
- "objc2-core-foundation",
 ]
 
 [[package]]
 name = "object"
-version = "0.36.7"
+version = "0.32.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
+checksum = "a6a622008b6e321afc04970976f62ee297fdbaa6f95318ca343e3eebb9648441"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
-dependencies = [
- "critical-section",
- "portable-atomic",
-]
-
-[[package]]
-name = "once_cell_polyfill"
-version = "1.70.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad"
-
-[[package]]
-name = "oneshot-fused-workaround"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e17b52d0e4a06a4c7eb8d2943c0015fa628cf4ccc409429cebc0f5bed6d33a82"
-dependencies = [
- "futures",
-]
-
-[[package]]
-name = "oorandom"
-version = "11.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "opaque-debug"
-version = "0.3.1"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
 
 [[package]]
 name = "openssl"
-version = "0.10.73"
+version = "0.10.63"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8505734d46c8ab1e19a1dce3aef597ad87dcb4c37e7188231769bd6bd51cebf8"
+checksum = "15c9d69dd87a29568d4d017cfe8ec518706046a05184e5aea92d0af890b803c8"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.4.2",
  "cfg-if",
  "foreign-types",
  "libc",
@@ -3665,20 +1524,20 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
 name = "openssl-probe"
-version = "0.1.6"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
+checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.109"
+version = "0.9.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90096e2e47630d78b7d1c20952dc621f957103f8bc2c8359ec81290d75238571"
+checksum = "22e1bf214306098e4832460f797824c05d25aacdf896f64a985fb0fd992454ae"
 dependencies = [
  "cc",
  "libc",
@@ -3687,98 +1546,22 @@ dependencies = [
 ]
 
 [[package]]
-name = "option-ext"
-version = "0.2.0"
+name = "overload"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
-
-[[package]]
-name = "ordered-float"
-version = "2.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68f19d67e5a2795c94e73e0bb1cc1a7edeb2e28efd39e2e1c9b7a40c1108b11c"
-dependencies = [
- "num-traits",
-]
-
-[[package]]
-name = "ordered-multimap"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49203cdcae0030493bad186b28da2fa25645fa276a51b6fec8010d281e02ef79"
-dependencies = [
- "dlv-list",
- "hashbrown 0.14.5",
-]
-
-[[package]]
-name = "os_str_bytes"
-version = "6.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2355d85b9a3786f481747ced0e0ff2ba35213a1f9bd406ed906554d7af805a1"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "p256"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
-dependencies = [
- "ecdsa",
- "elliptic-curve",
- "primeorder",
- "sha2",
-]
-
-[[package]]
-name = "p384"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
-dependencies = [
- "ecdsa",
- "elliptic-curve",
- "primeorder",
- "sha2",
-]
-
-[[package]]
-name = "p521"
-version = "0.13.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fc9e2161f1f215afdfce23677034ae137bbd45016a880c2eb3ba8eb95f085b2"
-dependencies = [
- "base16ct",
- "ecdsa",
- "elliptic-curve",
- "primeorder",
- "rand_core 0.6.4",
- "sha2",
-]
-
-[[package]]
-name = "page_size"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30d5b2194ed13191c1999ae0704b7839fb18384fa22e49b57eeaa97d79ce40da"
-dependencies = [
- "libc",
- "winapi",
-]
+checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
 
 [[package]]
 name = "parking"
-version = "2.2.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+checksum = "bb813b8af86854136c6922af0598d719255ecb2179515e6e7730d468f05c9cae"
 
 [[package]]
 name = "parking_lot"
-version = "0.12.4"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70d58bf43669b5795d1576d0641cfb6fbb2057bf629506267a92807158584a13"
+checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
 dependencies = [
  "lock_api",
  "parking_lot_core",
@@ -3786,15 +1569,15 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.11"
+version = "0.9.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc838d2a56b5b1a6c25f55575dfc605fabb63bb2365f6c2353ef9159aa69e4a5"
+checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.5.17",
+ "redox_syscall",
  "smallvec",
- "windows-targets 0.52.6",
+ "windows-targets 0.48.5",
 ]
 
 [[package]]
@@ -3804,27 +1587,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7676374caaee8a325c9e7a2ae557f216c5563a171d6997b0ef8a65af35147700"
 dependencies = [
  "base64ct",
- "rand_core 0.6.4",
+ "rand_core",
  "subtle",
 ]
 
-[[package]]
-name = "password-hash"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
-dependencies = [
- "base64ct",
- "rand_core 0.6.4",
- "subtle",
-]
-
-[[package]]
-name = "paste"
-version = "1.0.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
-
 [[package]]
 name = "pbkdf2"
 version = "0.11.0"
@@ -3833,7 +1599,7 @@ checksum = "83a0692ec44e4cf1ef28ca317f14f8f07da2d95ec3fa01f86e4467b725e60917"
 dependencies = [
  "digest",
  "hmac",
- "password-hash 0.4.2",
+ "password-hash",
  "sha2",
 ]
 
@@ -3843,99 +1609,37 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
 
-[[package]]
-name = "pem-rfc7468"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
-dependencies = [
- "base64ct",
-]
-
 [[package]]
 name = "percent-encoding"
-version = "2.3.2"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
-
-[[package]]
-name = "petgraph"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3672b37090dbd86368a4145bc067582552b29c27377cad4e0a306c97f9bd7772"
-dependencies = [
- "fixedbitset",
- "indexmap 2.11.4",
-]
-
-[[package]]
-name = "phf"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
-dependencies = [
- "phf_macros",
- "phf_shared",
- "serde",
-]
-
-[[package]]
-name = "phf_generator"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
-dependencies = [
- "fastrand",
- "phf_shared",
-]
-
-[[package]]
-name = "phf_macros"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
-dependencies = [
- "phf_generator",
- "phf_shared",
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "phf_shared"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
-dependencies = [
- "siphasher",
-]
+checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "pin-project"
-version = "1.1.10"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677f1add503faace112b9f1373e43e9e054bfdd22ff1a63c1bc485eaec6a6a8a"
+checksum = "0302c4a0442c456bd56f841aee5c3bfd17967563f6fadc9ceb9f9c23cf3807e0"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.1.10"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e918e4ff8c4549eb882f14b3a4bc8c8bc93de829416eacf579f1207a8fbf861"
+checksum = "266c042b60c9c76b8d53061e52b2e0d1116abc57cefc8c5cd671619a56ac3690"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.16"
+version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
 
 [[package]]
 name = "pin-utils"
@@ -3943,66 +1647,17 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
-[[package]]
-name = "pkcs1"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
-dependencies = [
- "der",
- "pkcs8",
- "spki",
-]
-
-[[package]]
-name = "pkcs8"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
-dependencies = [
- "der",
- "spki",
-]
-
 [[package]]
 name = "pkg-config"
-version = "0.3.32"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+checksum = "2900ede94e305130c13ddd391e0ab7cbaeb783945ae07a279c268cb05109c6cb"
 
 [[package]]
-name = "plain"
-version = "0.2.3"
+name = "platforms"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
-
-[[package]]
-name = "plotters"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5aeb6f403d7a4911efb1e33402027fc44f29b5bf6def3effcc22d7bb75f2b747"
-dependencies = [
- "num-traits",
- "plotters-backend",
- "plotters-svg",
- "wasm-bindgen",
- "web-sys",
-]
-
-[[package]]
-name = "plotters-backend"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df42e13c12958a16b3f7f4386b9ab1f3e7933914ecea48da7139435263a4172a"
-
-[[package]]
-name = "plotters-svg"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51bae2ac328883f7acdfea3d66a7c35751187f870bc81f94563733a154d7a670"
-dependencies = [
- "plotters-backend",
-]
+checksum = "626dec3cac7cc0e1577a2ec3fc496277ec2baa084bebad95bb6fdbfae235f84c"
 
 [[package]]
 name = "poly1305"
@@ -4015,36 +1670,6 @@ dependencies = [
  "universal-hash",
 ]
 
-[[package]]
-name = "portable-atomic"
-version = "1.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
-
-[[package]]
-name = "postage"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af3fb618632874fb76937c2361a7f22afd393c982a2165595407edc75b06d3c1"
-dependencies = [
- "atomic 0.5.3",
- "crossbeam-queue",
- "futures",
- "parking_lot",
- "pin-project",
- "static_assertions",
- "thiserror 1.0.69",
-]
-
-[[package]]
-name = "potential_utf"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84df19adbe5b5a0782edcab45899906947ab039ccf4573713735ee7de1e6b08a"
-dependencies = [
- "zerovec",
-]
-
 [[package]]
 name = "powerfmt"
 version = "0.2.0"
@@ -4053,261 +1678,70 @@ checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
 [[package]]
 name = "ppv-lite86"
-version = "0.2.21"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
-dependencies = [
- "zerocopy",
-]
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "prettyplease"
-version = "0.2.37"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+checksum = "a41cf62165e97c7f814d2221421dbb9afcbcdb0a88068e5ea206e19951c2cbb5"
 dependencies = [
  "proc-macro2",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "primeorder"
-version = "0.13.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
-dependencies = [
- "elliptic-curve",
-]
-
-[[package]]
-name = "priority-queue"
-version = "2.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93980406f12d9f8140ed5abe7155acb10bb1e69ea55c88960b9c2f117445ef96"
-dependencies = [
- "equivalent",
- "indexmap 2.11.4",
- "serde",
-]
-
-[[package]]
-name = "proc-macro-crate"
-version = "3.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983"
-dependencies = [
- "toml_edit 0.23.7",
-]
-
-[[package]]
-name = "proc-macro-error-attr2"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96de42df36bb9bba5542fe9f1a054b8cc87e172759a1868aa05c1f3acc89dfc5"
-dependencies = [
- "proc-macro2",
- "quote",
-]
-
-[[package]]
-name = "proc-macro-error2"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11ec05c52be0a07b08061f7dd003e7d7092e0472bc731b4af7bb1ef876109802"
-dependencies = [
- "proc-macro-error-attr2",
- "proc-macro2",
- "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.101"
+version = "1.0.78"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89ae43fd86e4158d6db51ad8e2b80f313af9cc74f5c0e03ccb87de09998732de"
+checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "prost"
-version = "0.12.6"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "deb1435c188b76130da55f17a466d252ff7b1418b2ad3e037d127b94e3411f29"
+checksum = "146c289cda302b98a28d40c8b3b90498d6e526dd24ac2ecea73e4e491685b94a"
 dependencies = [
  "bytes",
- "prost-derive 0.12.6",
-]
-
-[[package]]
-name = "prost"
-version = "0.13.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2796faa41db3ec313a31f7624d9286acf277b52de526150b7e69f3debf891ee5"
-dependencies = [
- "bytes",
- "prost-derive 0.13.5",
-]
-
-[[package]]
-name = "prost-build"
-version = "0.13.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
-dependencies = [
- "heck",
- "itertools 0.14.0",
- "log",
- "multimap",
- "once_cell",
- "petgraph",
- "prettyplease",
- "prost 0.13.5",
- "prost-types 0.13.5",
- "regex",
- "syn 2.0.106",
- "tempfile",
+ "prost-derive",
 ]
 
 [[package]]
 name = "prost-derive"
-version = "0.12.6"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81bddcdb20abf9501610992b6759a4c888aef7d1a7247ef75e2404275ac24af1"
+checksum = "efb6c9a1dd1def8e2124d17e83a20af56f1570d6c2d2bd9e266ccb768df3840e"
 dependencies = [
  "anyhow",
- "itertools 0.12.1",
+ "itertools",
  "proc-macro2",
  "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "prost-derive"
-version = "0.13.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
-dependencies = [
- "anyhow",
- "itertools 0.14.0",
- "proc-macro2",
- "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
 name = "prost-types"
-version = "0.12.6"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9091c90b0a32608e984ff2fa4091273cbdd755d54935c51d520887f4a1dbd5b0"
+checksum = "193898f59edcf43c26227dcd4c8427f00d99d61e95dcde58dabd49fa291d470e"
 dependencies = [
- "prost 0.12.6",
-]
-
-[[package]]
-name = "prost-types"
-version = "0.13.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52c2c1bf36ddb1a1c396b3601a3cec27c2462e45f07c386894ec3ccf5332bd16"
-dependencies = [
- "prost 0.13.5",
-]
-
-[[package]]
-name = "pwd-grp"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e2023f41b5fcb7c30eb5300a5733edfaa9e0e0d502d51b586f65633fd39e40c"
-dependencies = [
- "derive-deftly",
- "libc",
- "paste",
- "thiserror 2.0.16",
-]
-
-[[package]]
-name = "quinn"
-version = "0.11.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
-dependencies = [
- "bytes",
- "cfg_aliases",
- "pin-project-lite",
- "quinn-proto",
- "quinn-udp",
- "rustc-hash 2.1.1",
- "rustls",
- "socket2 0.6.3",
- "thiserror 2.0.16",
- "tokio",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-proto"
-version = "0.11.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1906b49b0c3bc04b5fe5d86a77925ae6524a19b816ae38ce1e426255f1d8a31"
-dependencies = [
- "bytes",
- "getrandom 0.3.3",
- "lru-slab",
- "rand 0.9.2",
- "ring",
- "rustc-hash 2.1.1",
- "rustls",
- "rustls-pki-types",
- "slab",
- "thiserror 2.0.16",
- "tinyvec",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-udp"
-version = "0.5.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
-dependencies = [
- "cfg_aliases",
- "libc",
- "once_cell",
- "socket2 0.6.3",
- "tracing",
- "windows-sys 0.60.2",
+ "prost",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.40"
+version = "1.0.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
+checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
 dependencies = [
  "proc-macro2",
 ]
 
-[[package]]
-name = "r-efi"
-version = "5.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
-
-[[package]]
-name = "r-efi"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
-
-[[package]]
-name = "radium"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
-
 [[package]]
 name = "rand"
 version = "0.8.5"
@@ -4315,18 +1749,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
- "rand_chacha 0.3.1",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand"
-version = "0.9.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
-dependencies = [
- "rand_chacha 0.9.0",
- "rand_core 0.9.3",
+ "rand_chacha",
+ "rand_core",
 ]
 
 [[package]]
@@ -4336,17 +1760,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.9.3",
+ "rand_core",
 ]
 
 [[package]]
@@ -4355,151 +1769,77 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom 0.2.16",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
-dependencies = [
- "getrandom 0.3.3",
-]
-
-[[package]]
-name = "rand_jitter"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b16df48f071248e67b8fc5e866d9448d45c08ad8b672baaaf796e2f15e606ff0"
-dependencies = [
- "libc",
- "rand_core 0.9.3",
- "winapi",
-]
-
-[[package]]
-name = "rayon"
-version = "1.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "368f01d005bf8fd9b1206fb6fa653e6c4a81ceb1466406b81792d87c5677a58f"
-dependencies = [
- "either",
- "rayon-core",
-]
-
-[[package]]
-name = "rayon-core"
-version = "1.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
-dependencies = [
- "crossbeam-deque",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "rdrand"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d92195228612ac8eed47adbc2ed0f04e513a4ccb98175b6f2bd04d963b533655"
-dependencies = [
- "rand_core 0.6.4",
+ "getrandom",
 ]
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.17"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5407465600fb0548f1442edf71dd20683c6ed326200ace4b1ef0763521bb3b77"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
 dependencies = [
- "bitflags 2.9.4",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce70a74e890531977d37e532c34d45e9055d2409ed08ddba14529471ed0be16"
-dependencies = [
- "bitflags 2.9.4",
-]
-
-[[package]]
-name = "redox_users"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
-dependencies = [
- "getrandom 0.2.16",
- "libredox",
- "thiserror 2.0.16",
-]
-
-[[package]]
-name = "ref-cast"
-version = "1.0.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
-dependencies = [
- "ref-cast-impl",
-]
-
-[[package]]
-name = "ref-cast-impl"
-version = "1.0.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
+ "bitflags 1.3.2",
 ]
 
 [[package]]
 name = "regex"
-version = "1.11.2"
+version = "1.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23d7fd106d8c02486a8d64e778353d1cffe08ce79ac2e82f540c86d0facf6912"
+checksum = "b62dbe01f0b06f9d8dc7d49e05a0785f153b00b2c227856282f671e0318c9b15"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-automata",
- "regex-syntax",
+ "regex-automata 0.4.5",
+ "regex-syntax 0.8.2",
 ]
 
 [[package]]
 name = "regex-automata"
-version = "0.4.10"
+version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b9458fa0bfeeac22b5ca447c63aaf45f28439a709ccd244698632f9aa6394d6"
+checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
+dependencies = [
+ "regex-syntax 0.6.29",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5bb987efffd3c6d0d8f5f89510bb458559eab11e4f869acb20bf845e016259cd"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax",
+ "regex-syntax 0.8.2",
 ]
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.6"
+version = "0.6.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caf4aa5b0f434c91fe5c7f1ecb6a5ece2130b02ad2a590589dda5146df959001"
+checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
 [[package]]
 name = "reqwest"
-version = "0.11.27"
+version = "0.11.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd67538700a17451e7cba03ac727fb961abb7607553461627b97de0b89cf4a62"
+checksum = "37b1ae8d9ac08420c66222fb9096fc5de435c3c48542bc5336c51892cffafb41"
 dependencies = [
- "base64 0.21.7",
+ "base64",
  "bytes",
  "encoding_rs",
  "futures-core",
  "futures-util",
- "h2 0.3.27",
- "http 0.2.12",
- "http-body 0.4.6",
- "hyper 0.14.32",
+ "h2",
+ "http",
+ "http-body",
+ "hyper",
  "hyper-tls",
  "ipnet",
  "js-sys",
@@ -4509,11 +1849,9 @@ dependencies = [
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
- "rustls-pemfile",
  "serde",
  "serde_json",
  "serde_urlencoded",
- "sync_wrapper 0.1.2",
  "system-configuration",
  "tokio",
  "tokio-native-tls",
@@ -4525,139 +1863,25 @@ dependencies = [
  "winreg",
 ]
 
-[[package]]
-name = "reqwest"
-version = "0.12.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d429f34c8092b2d42c7c93cec323bb4adeb7c67698f70839adec842ec10c7ceb"
-dependencies = [
- "base64 0.22.1",
- "bytes",
- "futures-core",
- "http 1.3.1",
- "http-body 1.0.1",
- "http-body-util",
- "hyper 1.7.0",
- "hyper-rustls",
- "hyper-util",
- "js-sys",
- "log",
- "percent-encoding",
- "pin-project-lite",
- "quinn",
- "rustls",
- "rustls-pki-types",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper 1.0.2",
- "tokio",
- "tokio-rustls",
- "tower 0.5.2",
- "tower-http",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
- "webpki-roots",
-]
-
-[[package]]
-name = "retry-error"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c322ea521636c5a3f13685a6266055b2dda7e54e2be35214d7c2a5d0672a5db"
-dependencies = [
- "humantime",
-]
-
-[[package]]
-name = "rfc6979"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
-dependencies = [
- "hmac",
- "subtle",
-]
-
 [[package]]
 name = "ring"
-version = "0.17.14"
+version = "0.17.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+checksum = "688c63d65483050968b2a8937f7995f443e27041a0f7700aa59b0822aedebb74"
 dependencies = [
  "cc",
- "cfg-if",
- "getrandom 0.2.16",
+ "getrandom",
  "libc",
+ "spin",
  "untrusted",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "rsa"
-version = "0.9.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
-dependencies = [
- "const-oid",
- "digest",
- "num-bigint-dig",
- "num-integer",
- "num-traits",
- "pkcs1",
- "pkcs8",
- "rand_core 0.6.4",
- "sha2",
- "signature",
- "spki",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "rsqlite-vfs"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8a1f2315036ef6b1fbacd1972e8ee7688030b0a2121edfc2a6550febd41574d"
-dependencies = [
- "hashbrown 0.16.1",
- "thiserror 2.0.16",
-]
-
-[[package]]
-name = "rusqlite"
-version = "0.38.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1c93dd1c9683b438c392c492109cb702b8090b2bfc8fed6f6e4eb4523f17af3"
-dependencies = [
- "bitflags 2.9.4",
- "fallible-iterator",
- "fallible-streaming-iterator",
- "hashlink",
- "libsqlite3-sys",
- "smallvec",
- "sqlite-wasm-rs",
- "time",
-]
-
-[[package]]
-name = "rust-ini"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "796e8d2b6696392a43bea58116b667fb4c29727dc5abd27d6acf338bb4f688c7"
-dependencies = [
- "cfg-if",
- "ordered-multimap",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.26"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56f7d92ca342cea22a06f2121d944b4fd82af56988c270852495420f961d4ace"
+checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
 
 [[package]]
 name = "rustc-hash"
@@ -4665,163 +1889,54 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
-[[package]]
-name = "rustc-hash"
-version = "2.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
-
 [[package]]
 name = "rustc_version"
-version = "0.4.1"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
 dependencies = [
  "semver",
 ]
 
-[[package]]
-name = "rusticata-macros"
-version = "4.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
-dependencies = [
- "nom 7.1.3",
-]
-
 [[package]]
 name = "rustix"
-version = "0.38.44"
+version = "0.38.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
+checksum = "322394588aaf33c24007e8bb3238ee3e4c5c09c084ab32bc73890b99ff326bca"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.4.2",
  "errno",
  "libc",
- "linux-raw-sys 0.4.15",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "rustix"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd15f8a2c5551a84d56efdc1cd049089e409ac19a3072d5037a17fd70719ff3e"
-dependencies = [
- "bitflags 2.9.4",
- "errno",
- "libc",
- "linux-raw-sys 0.11.0",
- "windows-sys 0.61.0",
-]
-
-[[package]]
-name = "rustls"
-version = "0.23.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a9586e9ee2b4f8fab52a0048ca7334d7024eef48e2cb9407e3497bb7cab7fa7"
-dependencies = [
- "once_cell",
- "ring",
- "rustls-pki-types",
- "rustls-webpki",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "rustls-pemfile"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
-dependencies = [
- "base64 0.21.7",
-]
-
-[[package]]
-name = "rustls-pki-types"
-version = "1.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79"
-dependencies = [
- "web-time",
- "zeroize",
-]
-
-[[package]]
-name = "rustls-webpki"
-version = "0.103.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ffdfa2f5286e2247234e03f680868ac2815974dc39e00ea15adc445d0aafe52"
-dependencies = [
- "ring",
- "rustls-pki-types",
- "untrusted",
+ "linux-raw-sys",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "rustversion"
-version = "1.0.22"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+checksum = "7ffc183a10b4478d04cbbbfc96d0873219d962dd5accaff2ffbd4ceb7df837f4"
 
 [[package]]
 name = "ryu"
-version = "1.0.20"
+version = "1.0.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
-
-[[package]]
-name = "safelog"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee9f10dd250956c65d58a19507dd06ff976f898560fe843580d05134541f0898"
-dependencies = [
- "derive_more",
- "educe",
- "either",
- "fluid-let",
- "thiserror 2.0.16",
-]
-
-[[package]]
-name = "same-file"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "sanitize-filename"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc984f4f9ceb736a7bb755c3e3bd17dc56370af2600c9780dcc48c66453da34d"
-dependencies = [
- "regex",
-]
-
-[[package]]
-name = "saturating-time"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b63583a1dd0647d1484228529ab4ecaa874048d2956f117362aa5f5826456230"
+checksum = "f98d2aa92eebf49b69786be48e4477826b256916e84a57ff2a4f21923b48eb4c"
 
 [[package]]
 name = "schannel"
-version = "0.1.28"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "891d81b926048e76efe18581bf793546b4c0eaf8448d72be8de2bbee5fd166e1"
+checksum = "fbc91545643bcf3a0bbb6569265615222618bdf33ce4ffbbd13c4bbd4c093534"
 dependencies = [
- "windows-sys 0.61.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "schemars"
-version = "0.8.22"
+version = "0.8.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fbf2ae1b8bc8e02df939598064d22402220cd5bbcca1c76f7d6a310974d5615"
+checksum = "45a28f4c49489add4ce10783f7911893516f15afe45d015608d41faca6bc4d29"
 dependencies = [
  "dyn-clone",
  "schemars_derive",
@@ -4829,40 +1944,16 @@ dependencies = [
  "serde_json",
 ]
 
-[[package]]
-name = "schemars"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
-dependencies = [
- "dyn-clone",
- "ref-cast",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "schemars"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
-dependencies = [
- "dyn-clone",
- "ref-cast",
- "serde",
- "serde_json",
-]
-
 [[package]]
 name = "schemars_derive"
-version = "0.8.22"
+version = "0.8.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32e265784ad618884abaea0600a9adf15393368d840e0222d101a072f3f7534d"
+checksum = "c767fd6fa65d9ccf9cf026122c1b555f2ef9a4f0cea69da4d7dbc3e258d30967"
 dependencies = [
  "proc-macro2",
  "quote",
  "serde_derive_internals",
- "syn 2.0.106",
+ "syn 1.0.109",
 ]
 
 [[package]]
@@ -4871,27 +1962,13 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
-[[package]]
-name = "sec1"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
-dependencies = [
- "base16ct",
- "der",
- "generic-array",
- "pkcs8",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "security-framework"
-version = "2.11.1"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
+checksum = "05b64fb303737d99b81884b2c63433e9ae28abebe5eb5045dcdd175dc2ecf4de"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 1.3.2",
  "core-foundation",
  "core-foundation-sys",
  "libc",
@@ -4900,9 +1977,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.15.0"
+version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc1f0cbffaac4852523ce30d8bd3c5cdc873501d96ff467ca09b6767bb8cd5c0"
+checksum = "e932934257d3b408ed8f30db49d85ea163bfe74961f017f405b025af298f0c7a"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -4910,111 +1987,50 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.27"
+version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+checksum = "b97ed7a9823b74f99c7742f5336af7be5ecd3eeafcb1507d1fa93347b1d589b0"
 
 [[package]]
 name = "serde"
-version = "1.0.228"
+version = "1.0.196"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
-dependencies = [
- "serde_core",
- "serde_derive",
-]
-
-[[package]]
-name = "serde-value"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3a1a3341211875ef120e117ea7fd5228530ae7e7036a779fdc9117be6b3282c"
-dependencies = [
- "ordered-float",
- "serde",
-]
-
-[[package]]
-name = "serde_core"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+checksum = "870026e60fa08c69f064aa766c10f10b1d62db9ccd4d0abb206472bee0ce3b32"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.228"
+version = "1.0.196"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+checksum = "33c85360c95e7d137454dc81d9a4ed2b8efd8fbe19cee57357b32b9771fccb67"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
 name = "serde_derive_internals"
-version = "0.29.1"
+version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
+checksum = "85bf8229e7920a9f636479437026331ce11aa132b4dde37d121944a44d6e5f3c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "serde_ignored"
-version = "0.1.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "115dffd5f3853e06e746965a20dcbae6ee747ae30b543d91b0e089668bb07798"
-dependencies = [
- "serde",
- "serde_core",
+ "syn 1.0.109",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.145"
+version = "1.0.112"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
+checksum = "4d1bd37ce2324cf3bf85e5a25f96eb4baf0d5aa6eba43e7ae8958870c4ec48ed"
 dependencies = [
  "itoa",
- "memchr",
  "ryu",
  "serde",
- "serde_core",
-]
-
-[[package]]
-name = "serde_path_to_error"
-version = "0.1.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
-dependencies = [
- "itoa",
- "serde",
- "serde_core",
-]
-
-[[package]]
-name = "serde_spanned"
-version = "0.6.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "serde_spanned"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "876ac351060d4f882bb1032b6369eb0aef79ad9df1ea8bc404874d8cc3d0cd98"
-dependencies = [
- "serde_core",
 ]
 
 [[package]]
@@ -5029,37 +2045,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "serde_with"
-version = "3.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd5414fad8e6907dbdd5bc441a50ae8d6e26151a03b1de04d89a5576de61d01f"
-dependencies = [
- "base64 0.22.1",
- "chrono",
- "hex",
- "indexmap 1.9.3",
- "indexmap 2.11.4",
- "schemars 0.9.0",
- "schemars 1.2.1",
- "serde_core",
- "serde_json",
- "serde_with_macros",
- "time",
-]
-
-[[package]]
-name = "serde_with_macros"
-version = "3.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3db8978e608f1fe7357e211969fd9abdcae80bac1ba7a3369bb7eb6b404eb65"
-dependencies = [
- "darling 0.23.0",
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
 [[package]]
 name = "sha-1"
 version = "0.10.1"
@@ -5084,25 +2069,15 @@ dependencies = [
 
 [[package]]
 name = "sha2"
-version = "0.10.9"
+version = "0.10.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
 dependencies = [
  "cfg-if",
  "cpufeatures",
  "digest",
 ]
 
-[[package]]
-name = "sha3"
-version = "0.10.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75872d278a8f37ef87fa0ddbda7802605cb18344497949862c0d4dcb291eba60"
-dependencies = [
- "digest",
- "keccak",
-]
-
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -5112,122 +2087,51 @@ dependencies = [
  "lazy_static",
 ]
 
-[[package]]
-name = "shellexpand"
-version = "3.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32824fab5e16e6c4d86dc1ba84489390419a39f97699852b66480bb87d297ed8"
-dependencies = [
- "bstr",
- "dirs",
- "os_str_bytes",
-]
-
 [[package]]
 name = "shlex"
 version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
-[[package]]
-name = "signal-hook-registry"
-version = "1.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2a4719bff48cee6b39d12c020eeb490953ad2443b7055bd0b21fca26bd8c28b"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "signature"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
-dependencies = [
- "digest",
- "rand_core 0.6.4",
-]
-
 [[package]]
 name = "similar"
-version = "2.7.0"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbbb5d9659141646ae647b42fe094daf6c6192d1620870b449d9557f748b2daa"
-
-[[package]]
-name = "siphasher"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2aa850e253778c88a04c3d7323b043aeda9d3e30d5971937c1855769763678e"
+checksum = "32fea41aca09ee824cc9724996433064c89f7777e60762749a4170a14abbfa21"
 
 [[package]]
 name = "slab"
-version = "0.4.11"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
-
-[[package]]
-name = "slotmap"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdd58c3c93c3d278ca835519292445cb4b0d4dc59ccfdf7ceadaab3f8aeb4038"
+checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
 dependencies = [
- "serde",
- "version_check",
-]
-
-[[package]]
-name = "slotmap-careful"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed92816c1fbb29891a525b92d5fa95757c9dee47044f76c8e06ceb1e052a8d64"
-dependencies = [
- "paste",
- "serde",
- "slotmap",
- "thiserror 2.0.16",
- "void",
+ "autocfg",
 ]
 
 [[package]]
 name = "smallvec"
-version = "1.15.1"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+checksum = "e6ecd384b10a64542d77071bd64bd7b231f4ed5940fba55e98c3de13824cf3d7"
 
 [[package]]
-name = "smoltcp"
-version = "0.12.0"
+name = "socket2"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dad095989c1533c1c266d9b1e8d70a1329dd3723c3edac6d03bbd67e7bf6f4bb"
+checksum = "9f7916fc008ca5542385b89a3d3ce689953c143e9304a9bf8beec1de48994c0d"
 dependencies = [
- "bitflags 1.3.2",
- "byteorder",
- "cfg-if",
- "defmt 0.3.100",
- "heapless",
- "log",
- "managed",
+ "libc",
+ "winapi",
 ]
 
 [[package]]
 name = "socket2"
-version = "0.5.10"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
+checksum = "7b5fac59a5cb5dd637972e5fca70daf0523c9067fcdc4842f053dae04a18f8e9"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "socket2"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
-dependencies = [
- "libc",
- "windows-sys 0.61.0",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -5235,73 +2139,6 @@ name = "spin"
 version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
-dependencies = [
- "lock_api",
-]
-
-[[package]]
-name = "spki"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
-dependencies = [
- "base64ct",
- "der",
-]
-
-[[package]]
-name = "sqlite-wasm-rs"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f4206ed3a67690b9c29b77d728f6acc3ce78f16bf846d83c94f76400320181b"
-dependencies = [
- "cc",
- "js-sys",
- "rsqlite-vfs",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "ssh-cipher"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caac132742f0d33c3af65bfcde7f6aa8f62f0e991d80db99149eb9d44708784f"
-dependencies = [
- "cipher",
- "ssh-encoding",
-]
-
-[[package]]
-name = "ssh-encoding"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb9242b9ef4108a78e8cd1a2c98e193ef372437f8c22be363075233321dd4a15"
-dependencies = [
- "base64ct",
- "pem-rfc7468",
- "sha2",
-]
-
-[[package]]
-name = "ssh-key"
-version = "0.6.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b86f5297f0f04d08cabaa0f6bff7cb6aec4d9c3b49d87990d63da9d9156a8c3"
-dependencies = [
- "num-bigint-dig",
- "p256",
- "p384",
- "p521",
- "rand_core 0.6.4",
- "rsa",
- "sec1",
- "sha2",
- "signature",
- "ssh-cipher",
- "ssh-encoding",
- "subtle",
- "zeroize",
-]
 
 [[package]]
 name = "ssri"
@@ -5309,66 +2146,27 @@ version = "9.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "da7a2b3c2bc9693bcb40870c4e9b5bf0d79f9cb46273321bf855ec513e919082"
 dependencies = [
- "base64 0.21.7",
+ "base64",
  "digest",
  "hex",
  "miette",
  "sha-1",
  "sha2",
- "thiserror 1.0.69",
+ "thiserror",
  "xxhash-rust",
 ]
 
-[[package]]
-name = "stable_deref_trait"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
-
-[[package]]
-name = "static_assertions"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
-
 [[package]]
 name = "strsim"
 version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
-[[package]]
-name = "strsim"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
-
-[[package]]
-name = "strum"
-version = "0.27.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf"
-dependencies = [
- "strum_macros",
-]
-
-[[package]]
-name = "strum_macros"
-version = "0.27.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
 [[package]]
 name = "subtle"
-version = "2.6.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
 
 [[package]]
 name = "syn"
@@ -5383,9 +2181,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.106"
+version = "2.0.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ede7c438028d4436d71104916910f5bb611972c5cfd7f89b8300a8186e6fada6"
+checksum = "0f3531638e407dfc0814761abb7c00a5b54992b849452a0646b7f65c9f770f3f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5398,40 +2196,6 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
 
-[[package]]
-name = "sync_wrapper"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
-dependencies = [
- "futures-core",
-]
-
-[[package]]
-name = "synstructure"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "sysinfo"
-version = "0.36.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "252800745060e7b9ffb7b2badbd8b31cfa4aa2e61af879d0a3bf2a317c20217d"
-dependencies = [
- "libc",
- "memchr",
- "ntapi",
- "objc2-core-foundation",
- "objc2-io-kit",
- "windows 0.61.3",
-]
-
 [[package]]
 name = "system-configuration"
 version = "0.5.1"
@@ -5453,140 +2217,72 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "tap"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
-
 [[package]]
 name = "tempfile"
-version = "3.23.0"
+version = "3.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
+checksum = "01ce4141aa927a6d1bd34a041795abd0db1cccba5d5f24b009f694bdf3a1f3fa"
 dependencies = [
+ "cfg-if",
  "fastrand",
- "getrandom 0.3.3",
- "once_cell",
- "rustix 1.1.2",
- "windows-sys 0.61.0",
+ "redox_syscall",
+ "rustix",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "thiserror"
-version = "1.0.69"
+version = "1.0.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+checksum = "d54378c645627613241d077a3a79db965db602882668f9136ac42af9ecb730ad"
 dependencies = [
- "thiserror-impl 1.0.69",
-]
-
-[[package]]
-name = "thiserror"
-version = "2.0.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3467d614147380f2e4e374161426ff399c91084acd2363eaf549172b3d5e60c0"
-dependencies = [
- "thiserror-impl 2.0.16",
+ "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.69"
+version = "1.0.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+checksum = "fa0faa943b50f3db30a20aa7e265dbc66076993efed8463e8de414e5d06d3471"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "2.0.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c5e1be1c48b9172ee610da68fd9cd2770e7a4056cb3fc98710ee6906f0c7960"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
 name = "thread_local"
-version = "1.1.9"
+version = "1.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+checksum = "3fdd6f064ccff2d6567adcb3873ca630700f00b5ad3f060c25b5dcfd9a4ce152"
 dependencies = [
  "cfg-if",
+ "once_cell",
 ]
 
 [[package]]
 name = "time"
-version = "0.3.47"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+checksum = "f657ba42c3f86e7680e53c8cd3af8abbe56b5491790b46e22e19c0d57463583e"
 dependencies = [
  "deranged",
- "itoa",
- "js-sys",
- "num-conv",
  "powerfmt",
- "serde_core",
+ "serde",
  "time-core",
- "time-macros",
 ]
 
 [[package]]
 name = "time-core"
-version = "0.1.8"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
-
-[[package]]
-name = "time-macros"
-version = "0.2.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
-dependencies = [
- "num-conv",
- "time-core",
-]
-
-[[package]]
-name = "tiny-keccak"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c9d3793400a45f954c52e73d068316d76b6f4e36977e3fcebb13a2721e80237"
-dependencies = [
- "crunchy",
-]
-
-[[package]]
-name = "tinystr"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d4f6d1145dcb577acf783d4e601bc1d76a13337bb54e6233add580b07344c8b"
-dependencies = [
- "displaydoc",
- "zerovec",
-]
-
-[[package]]
-name = "tinytemplate"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be4d6b5f19ff7664e8c98d03e2139cb510db9b0a60b55f8e8709b689d939b6bc"
-dependencies = [
- "serde",
- "serde_json",
-]
+checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "tinyvec"
-version = "1.10.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa5fdc3bce6191a1dbc8c02d5c8bffcf557bafa17c124c5264a458f1b0613fa"
+checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
 dependencies = [
  "tinyvec_macros",
 ]
@@ -5599,29 +2295,27 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.47.1"
+version = "1.35.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89e49afdadebb872d3145a5638b59eb0691ea23e46ca484037cfab3b76b95038"
+checksum = "c89b4efa943be685f629b149f53829423f8f5531ea21249408e8e2f8671ec104"
 dependencies = [
  "backtrace",
  "bytes",
- "io-uring",
  "libc",
  "mio",
+ "num_cpus",
  "pin-project-lite",
- "signal-hook-registry",
- "slab",
- "socket2 0.6.3",
+ "socket2 0.5.5",
  "tokio-macros",
  "tracing",
- "windows-sys 0.59.0",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
 name = "tokio-io-timeout"
-version = "1.2.1"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bd86198d9ee903fedd2f9a2e72014287c0d9167e4ae43b5853007205dda1b76"
+checksum = "30b74022ada614a1b4834de765f9bb43877f910cc8ce4be40e89042c9223a8bf"
 dependencies = [
  "pin-project-lite",
  "tokio",
@@ -5629,13 +2323,13 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.5.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
+checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
@@ -5648,21 +2342,11 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "tokio-rustls"
-version = "0.26.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f63835928ca123f1bef57abbcd23bb2ba0ac9ae1235f1e65bda0d06e7786bd"
-dependencies = [
- "rustls",
- "tokio",
-]
-
 [[package]]
 name = "tokio-stream"
-version = "0.1.17"
+version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eca58d7bba4a75707817a2c44174253f9236b2d5fbd055602e9d5c07c139a047"
+checksum = "397c988d37662c7dda6d2208364a706264bf3d6138b11d436cbac0ad38832842"
 dependencies = [
  "futures-core",
  "pin-project-lite",
@@ -5671,1134 +2355,45 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.18"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+checksum = "5419f34732d9eb6ee4c3578b7989078579b7f039cbbb9ca2c4da015749371e15"
 dependencies = [
  "bytes",
  "futures-core",
- "futures-io",
  "futures-sink",
  "pin-project-lite",
  "tokio",
+ "tracing",
 ]
 
-[[package]]
-name = "toml"
-version = "0.8.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
-dependencies = [
- "serde",
- "serde_spanned 0.6.9",
- "toml_datetime 0.6.11",
- "toml_edit 0.22.27",
-]
-
-[[package]]
-name = "toml"
-version = "0.9.12+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
-dependencies = [
- "indexmap 2.11.4",
- "serde_core",
- "serde_spanned 1.1.0",
- "toml_datetime 0.7.5+spec-1.1.0",
- "toml_parser",
- "toml_writer",
- "winnow 0.7.13",
-]
-
-[[package]]
-name = "toml_datetime"
-version = "0.6.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "toml_datetime"
-version = "0.7.5+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
-dependencies = [
- "serde_core",
-]
-
-[[package]]
-name = "toml_edit"
-version = "0.22.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
-dependencies = [
- "indexmap 2.11.4",
- "serde",
- "serde_spanned 0.6.9",
- "toml_datetime 0.6.11",
- "toml_write",
- "winnow 0.7.13",
-]
-
-[[package]]
-name = "toml_edit"
-version = "0.23.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6485ef6d0d9b5d0ec17244ff7eb05310113c3f316f2d14200d4de56b3cb98f8d"
-dependencies = [
- "indexmap 2.11.4",
- "toml_datetime 0.7.5+spec-1.1.0",
- "toml_parser",
- "winnow 0.7.13",
-]
-
-[[package]]
-name = "toml_parser"
-version = "1.1.0+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2334f11ee363607eb04df9b8fc8a13ca1715a72ba8662a26ac285c98aabb4011"
-dependencies = [
- "winnow 1.0.1",
-]
-
-[[package]]
-name = "toml_write"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
-
-[[package]]
-name = "toml_writer"
-version = "1.1.0+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d282ade6016312faf3e41e57ebbba0c073e4056dab1232ab1cb624199648f8ed"
-
 [[package]]
 name = "tonic"
 version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d560933a0de61cf715926b9cac824d4c883c2c43142f787595e48280c40a1d0e"
 dependencies = [
- "async-stream 0.3.6",
+ "async-stream",
  "async-trait",
- "axum 0.6.20",
- "base64 0.21.7",
+ "axum",
+ "base64",
  "bytes",
- "h2 0.3.27",
- "http 0.2.12",
- "http-body 0.4.6",
- "hyper 0.14.32",
- "hyper-timeout 0.4.1",
+ "h2",
+ "http",
+ "http-body",
+ "hyper",
+ "hyper-timeout",
  "percent-encoding",
  "pin-project",
- "prost 0.12.6",
+ "prost",
  "tokio",
  "tokio-stream",
- "tower 0.4.13",
+ "tower",
  "tower-layer",
  "tower-service",
  "tracing",
 ]
 
-[[package]]
-name = "tonic"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877c5b330756d856ffcc4553ab34a5684481ade925ecc54bcd1bf02b1d0d4d52"
-dependencies = [
- "async-stream 0.3.6",
- "async-trait",
- "axum 0.7.9",
- "base64 0.22.1",
- "bytes",
- "h2 0.4.12",
- "http 1.3.1",
- "http-body 1.0.1",
- "http-body-util",
- "hyper 1.7.0",
- "hyper-timeout 0.5.2",
- "hyper-util",
- "percent-encoding",
- "pin-project",
- "prost 0.13.5",
- "socket2 0.5.10",
- "tokio",
- "tokio-stream",
- "tower 0.4.13",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "tonic-build"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9557ce109ea773b399c9b9e5dca39294110b74f1f342cb347a80d1fce8c26a11"
-dependencies = [
- "prettyplease",
- "proc-macro2",
- "prost-build",
- "prost-types 0.13.5",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "tor-async-utils"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "895c61a46909134501c6815eceeb66c9c80fc494ee89429821b0f05ccf34b4f5"
-dependencies = [
- "derive-deftly",
- "educe",
- "futures",
- "oneshot-fused-workaround",
- "pin-project",
- "postage",
- "thiserror 2.0.16",
- "void",
-]
-
-[[package]]
-name = "tor-basic-utils"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fac6e4d7e131b7d69bc85558383cd4ac61e46b4dd0d4ed51632f28fac98cac0c"
-dependencies = [
- "derive_more",
- "hex",
- "itertools 0.14.0",
- "libc",
- "paste",
- "rand 0.9.2",
- "rand_chacha 0.9.0",
- "serde",
- "slab",
- "smallvec",
- "thiserror 2.0.16",
- "weak-table",
-]
-
-[[package]]
-name = "tor-bytes"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64454947258e49f238a5f06a06250a0c54598a1c7409898b5c79505e6a99e7af"
-dependencies = [
- "bytes",
- "derive-deftly",
- "digest",
- "educe",
- "getrandom 0.4.2",
- "safelog",
- "thiserror 2.0.16",
- "tor-error",
- "tor-llcrypto",
- "zeroize",
-]
-
-[[package]]
-name = "tor-cell"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ab0c79bc92a957e85959cf397a2d8f9c8294c35fa4f65247a9393b20ac95551"
-dependencies = [
- "amplify",
- "bitflags 2.9.4",
- "bytes",
- "caret",
- "derive-deftly",
- "derive_more",
- "educe",
- "itertools 0.14.0",
- "paste",
- "rand 0.9.2",
- "smallvec",
- "thiserror 2.0.16",
- "tor-basic-utils",
- "tor-bytes",
- "tor-cert",
- "tor-error",
- "tor-linkspec",
- "tor-llcrypto",
- "tor-memquota",
- "tor-protover",
- "tor-units",
- "void",
-]
-
-[[package]]
-name = "tor-cert"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "debc911738298ee801fce4577c36a50c55295b0bb9c5519461b83cc486a1f86e"
-dependencies = [
- "caret",
- "derive_builder_fork_arti",
- "derive_more",
- "digest",
- "thiserror 2.0.16",
- "tor-bytes",
- "tor-checkable",
- "tor-error",
- "tor-llcrypto",
-]
-
-[[package]]
-name = "tor-chanmgr"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7af5b7c2f1e16d1304b5185fcbc91ca5c8df991c21be00702f925f055573eea1"
-dependencies = [
- "async-trait",
- "caret",
- "cfg-if",
- "derive-deftly",
- "derive_more",
- "educe",
- "futures",
- "oneshot-fused-workaround",
- "percent-encoding",
- "postage",
- "rand 0.9.2",
- "safelog",
- "serde",
- "serde_with",
- "thiserror 2.0.16",
- "tor-async-utils",
- "tor-basic-utils",
- "tor-cell",
- "tor-config",
- "tor-error",
- "tor-keymgr",
- "tor-linkspec",
- "tor-llcrypto",
- "tor-memquota",
- "tor-netdir",
- "tor-proto",
- "tor-rtcompat",
- "tor-socksproto",
- "tor-units",
- "tracing",
- "url",
- "void",
-]
-
-[[package]]
-name = "tor-checkable"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15b13a5b50bb55037f2e81b25dde42f420d57c75154216b8ef989006cea3ebee"
-dependencies = [
- "humantime",
- "signature",
- "thiserror 2.0.16",
- "tor-llcrypto",
-]
-
-[[package]]
-name = "tor-circmgr"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b878f3f7c6be0c7f130d90b347ada2e7c46519dfbdde8273eae2e5d1792caa87"
-dependencies = [
- "amplify",
- "async-trait",
- "cfg-if",
- "derive-deftly",
- "derive_builder_fork_arti",
- "derive_more",
- "downcast-rs",
- "dyn-clone",
- "educe",
- "futures",
- "humantime-serde",
- "itertools 0.14.0",
- "once_cell",
- "oneshot-fused-workaround",
- "pin-project",
- "rand 0.9.2",
- "retry-error",
- "safelog",
- "serde",
- "thiserror 2.0.16",
- "tor-async-utils",
- "tor-basic-utils",
- "tor-cell",
- "tor-chanmgr",
- "tor-config",
- "tor-dircommon",
- "tor-error",
- "tor-guardmgr",
- "tor-linkspec",
- "tor-memquota",
- "tor-netdir",
- "tor-netdoc",
- "tor-persist",
- "tor-proto",
- "tor-protover",
- "tor-relay-selection",
- "tor-rtcompat",
- "tor-units",
- "tracing",
- "void",
- "weak-table",
-]
-
-[[package]]
-name = "tor-config"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3cbc74a00ab15bb986e3747c6969e40a58a63065d6f99077e7ee2f4657bb8b03"
-dependencies = [
- "amplify",
- "cfg-if",
- "derive-deftly",
- "derive_builder_fork_arti",
- "educe",
- "either",
- "figment",
- "fs-mistrust",
- "futures",
- "humantime-serde",
- "itertools 0.14.0",
- "notify",
- "paste",
- "postage",
- "regex",
- "serde",
- "serde-value",
- "serde_ignored",
- "strum",
- "thiserror 2.0.16",
- "toml 0.9.12+spec-1.1.0",
- "tor-basic-utils",
- "tor-error",
- "tor-rtcompat",
- "tracing",
- "void",
-]
-
-[[package]]
-name = "tor-config-path"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3005ab7b9a26a7271e5adf3dfb4ae18c09a943e32aeccc4f6d1c53a60de74b8d"
-dependencies = [
- "directories",
- "serde",
- "shellexpand",
- "thiserror 2.0.16",
- "tor-error",
- "tor-general-addr",
-]
-
-[[package]]
-name = "tor-consdiff"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6bfa2b7b71c72830f61c48da4bb3e13191e0c0e1404b9c5168c795e4f5feb4a8"
-dependencies = [
- "digest",
- "hex",
- "thiserror 2.0.16",
- "tor-llcrypto",
-]
-
-[[package]]
-name = "tor-dirclient"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ccd6fac844ac77c33ccdfcb56bf23ff40ebbb821ea708be79a481ec30e8c39c"
-dependencies = [
- "async-compression",
- "base64ct",
- "derive_more",
- "futures",
- "hex",
- "http 1.3.1",
- "httparse",
- "httpdate",
- "itertools 0.14.0",
- "memchr",
- "thiserror 2.0.16",
- "tor-circmgr",
- "tor-error",
- "tor-linkspec",
- "tor-llcrypto",
- "tor-netdoc",
- "tor-proto",
- "tor-rtcompat",
- "tracing",
-]
-
-[[package]]
-name = "tor-dircommon"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd0cf39a3c30321d145a4d60753ae7ef5bb58a66a00ac9e2bfc30bd823faf2a4"
-dependencies = [
- "base64ct",
- "derive-deftly",
- "getset",
- "humantime",
- "humantime-serde",
- "serde",
- "tor-basic-utils",
- "tor-checkable",
- "tor-config",
- "tor-linkspec",
- "tor-llcrypto",
- "tor-netdoc",
- "tracing",
-]
-
-[[package]]
-name = "tor-dirmgr"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b52919aa9dbb82a354c5b904bef82e91beb702b9f8ad14e6eac4237d6128bf67"
-dependencies = [
- "async-trait",
- "base64ct",
- "derive_builder_fork_arti",
- "derive_more",
- "digest",
- "educe",
- "event-listener",
- "fs-mistrust",
- "fslock",
- "futures",
- "hex",
- "humantime",
- "humantime-serde",
- "itertools 0.14.0",
- "memmap2",
- "oneshot-fused-workaround",
- "paste",
- "postage",
- "rand 0.9.2",
- "rusqlite",
- "safelog",
- "scopeguard",
- "serde",
- "serde_json",
- "signature",
- "static_assertions",
- "strum",
- "thiserror 2.0.16",
- "time",
- "tor-async-utils",
- "tor-basic-utils",
- "tor-checkable",
- "tor-circmgr",
- "tor-config",
- "tor-consdiff",
- "tor-dirclient",
- "tor-dircommon",
- "tor-error",
- "tor-guardmgr",
- "tor-llcrypto",
- "tor-netdir",
- "tor-netdoc",
- "tor-persist",
- "tor-proto",
- "tor-protover",
- "tor-rtcompat",
- "tracing",
-]
-
-[[package]]
-name = "tor-error"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "595b005e6f571ac3890a34a00f361200aab781fd0218f2c528c86fc7af088df5"
-dependencies = [
- "derive_more",
- "futures",
- "paste",
- "retry-error",
- "static_assertions",
- "strum",
- "thiserror 2.0.16",
- "tracing",
- "void",
-]
-
-[[package]]
-name = "tor-general-addr"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "727b8c8bc01c1587486055edab5c2cd0d5c960f5bb3fac796fc9911872b8b397"
-dependencies = [
- "derive_more",
- "thiserror 2.0.16",
- "void",
-]
-
-[[package]]
-name = "tor-guardmgr"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d337f465a477c0fb3b2faafa4654d70ff9df3590e57d22707591dddb4e4450c1"
-dependencies = [
- "amplify",
- "base64ct",
- "derive-deftly",
- "derive_builder_fork_arti",
- "derive_more",
- "dyn-clone",
- "educe",
- "futures",
- "humantime",
- "humantime-serde",
- "itertools 0.14.0",
- "num_enum",
- "oneshot-fused-workaround",
- "pin-project",
- "postage",
- "rand 0.9.2",
- "safelog",
- "serde",
- "strum",
- "thiserror 2.0.16",
- "tor-async-utils",
- "tor-basic-utils",
- "tor-config",
- "tor-dircommon",
- "tor-error",
- "tor-linkspec",
- "tor-llcrypto",
- "tor-netdir",
- "tor-netdoc",
- "tor-persist",
- "tor-proto",
- "tor-relay-selection",
- "tor-rtcompat",
- "tor-units",
- "tracing",
-]
-
-[[package]]
-name = "tor-hscrypto"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3693cd43f05cd01ac0aaa060dae5c5e53c4364f89e0d769e33cd629a2fd3118"
-dependencies = [
- "data-encoding",
- "derive-deftly",
- "derive_more",
- "digest",
- "hex",
- "humantime",
- "itertools 0.14.0",
- "paste",
- "rand 0.9.2",
- "safelog",
- "serde",
- "signature",
- "subtle",
- "thiserror 2.0.16",
- "tor-basic-utils",
- "tor-bytes",
- "tor-error",
- "tor-key-forge",
- "tor-llcrypto",
- "tor-units",
- "void",
-]
-
-[[package]]
-name = "tor-key-forge"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ade9065ae49cfe2ab020ca9ca9f2b3c5c9b5fc0d8980fa681d8b3a0668e042f"
-dependencies = [
- "derive-deftly",
- "derive_more",
- "downcast-rs",
- "paste",
- "rand 0.9.2",
- "rsa",
- "signature",
- "ssh-key",
- "thiserror 2.0.16",
- "tor-bytes",
- "tor-cert",
- "tor-checkable",
- "tor-error",
- "tor-llcrypto",
-]
-
-[[package]]
-name = "tor-keymgr"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "243c3163d376c4723cd67271fcd6e5d6b498a6865c6b98299640e1be01c38826"
-dependencies = [
- "amplify",
- "arrayvec",
- "cfg-if",
- "derive-deftly",
- "derive_builder_fork_arti",
- "derive_more",
- "downcast-rs",
- "dyn-clone",
- "fs-mistrust",
- "glob-match",
- "humantime",
- "inventory",
- "itertools 0.14.0",
- "rand 0.9.2",
- "safelog",
- "serde",
- "signature",
- "ssh-key",
- "thiserror 2.0.16",
- "tor-basic-utils",
- "tor-bytes",
- "tor-config",
- "tor-config-path",
- "tor-error",
- "tor-hscrypto",
- "tor-key-forge",
- "tor-llcrypto",
- "tor-persist",
- "tracing",
- "visibility",
- "walkdir",
- "zeroize",
-]
-
-[[package]]
-name = "tor-linkspec"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f1ea8786900d6fbe4c9f775d341b1ba01bbd1f750d89bd63be78b6b01e1836"
-dependencies = [
- "base64ct",
- "by_address",
- "caret",
- "derive-deftly",
- "derive_builder_fork_arti",
- "derive_more",
- "hex",
- "itertools 0.14.0",
- "safelog",
- "serde",
- "serde_with",
- "strum",
- "thiserror 2.0.16",
- "tor-basic-utils",
- "tor-bytes",
- "tor-config",
- "tor-llcrypto",
- "tor-memquota",
- "tor-protover",
-]
-
-[[package]]
-name = "tor-llcrypto"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c6989a1c6d06ffd6835e2917edaae4aeef544f8e5fdd68b54cc365f2af523de"
-dependencies = [
- "aes",
- "base64ct",
- "ctr",
- "curve25519-dalek",
- "der-parser",
- "derive-deftly",
- "derive_more",
- "digest",
- "ed25519-dalek",
- "educe",
- "getrandom 0.4.2",
- "hex",
- "rand 0.9.2",
- "rand_chacha 0.9.0",
- "rand_core 0.6.4",
- "rand_core 0.9.3",
- "rand_jitter",
- "rdrand",
- "rsa",
- "safelog",
- "serde",
- "sha1",
- "sha2",
- "sha3",
- "signature",
- "subtle",
- "thiserror 2.0.16",
- "tor-error",
- "tor-memquota-cost",
- "visibility",
- "x25519-dalek",
- "zeroize",
-]
-
-[[package]]
-name = "tor-log-ratelim"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f1cd642180923d12e3fab5996b4aa2189718da7f465df6eb196ce2b9c70e293"
-dependencies = [
- "futures",
- "humantime",
- "thiserror 2.0.16",
- "tor-error",
- "tor-rtcompat",
- "tracing",
- "weak-table",
-]
-
-[[package]]
-name = "tor-memquota"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "599daea60fd3272eb72a795d1c593b45bbe15343cbc702340a81db124c06eed5"
-dependencies = [
- "cfg-if",
- "derive-deftly",
- "derive_more",
- "dyn-clone",
- "educe",
- "futures",
- "itertools 0.14.0",
- "paste",
- "pin-project",
- "serde",
- "slotmap-careful",
- "static_assertions",
- "sysinfo",
- "thiserror 2.0.16",
- "tor-async-utils",
- "tor-basic-utils",
- "tor-config",
- "tor-error",
- "tor-log-ratelim",
- "tor-memquota-cost",
- "tor-rtcompat",
- "tracing",
- "void",
-]
-
-[[package]]
-name = "tor-memquota-cost"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd92b07c0fc24e6d8166a5ff45e5b8654e68d89743c46d01889a16ab74c0b578"
-dependencies = [
- "derive-deftly",
- "itertools 0.14.0",
- "paste",
- "void",
-]
-
-[[package]]
-name = "tor-netdir"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41be8f47f521fc95206d2ba5facac8fb1a5b5b82169bd41ebeecdf46d1e77246"
-dependencies = [
- "async-trait",
- "bitflags 2.9.4",
- "derive_more",
- "futures",
- "humantime",
- "itertools 0.14.0",
- "num_enum",
- "rand 0.9.2",
- "serde",
- "strum",
- "thiserror 2.0.16",
- "tor-basic-utils",
- "tor-error",
- "tor-linkspec",
- "tor-llcrypto",
- "tor-netdoc",
- "tor-protover",
- "tor-units",
- "tracing",
- "typed-index-collections",
-]
-
-[[package]]
-name = "tor-netdoc"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea8bce73d2c78bd78a2a927336ca639cf6bd5d8ad092ebcd0b3fdeaa47dcc77e"
-dependencies = [
- "amplify",
- "base64ct",
- "cipher",
- "derive-deftly",
- "derive_builder_fork_arti",
- "derive_more",
- "digest",
- "educe",
- "enumset",
- "hex",
- "humantime",
- "itertools 0.14.0",
- "memchr",
- "paste",
- "phf",
- "saturating-time",
- "serde",
- "serde_with",
- "signature",
- "smallvec",
- "strum",
- "subtle",
- "thiserror 2.0.16",
- "time",
- "tinystr",
- "tor-basic-utils",
- "tor-bytes",
- "tor-cell",
- "tor-cert",
- "tor-checkable",
- "tor-error",
- "tor-llcrypto",
- "tor-protover",
- "void",
- "zeroize",
-]
-
-[[package]]
-name = "tor-persist"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "507ab4b6a3d59ed0df5804eeed66dcacde75e3be13d3694216cdfdb666bce625"
-dependencies = [
- "derive-deftly",
- "derive_more",
- "filetime",
- "fs-mistrust",
- "fslock",
- "futures",
- "itertools 0.14.0",
- "oneshot-fused-workaround",
- "paste",
- "sanitize-filename",
- "serde",
- "serde_json",
- "thiserror 2.0.16",
- "time",
- "tor-async-utils",
- "tor-basic-utils",
- "tor-error",
- "tracing",
- "void",
-]
-
-[[package]]
-name = "tor-proto"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbfc552d535d36539d5782bb02028590bc472d219e49da51a96810725e80ff56"
-dependencies = [
- "amplify",
- "async-trait",
- "asynchronous-codec",
- "bitvec",
- "bytes",
- "caret",
- "cfg-if",
- "cipher",
- "coarsetime",
- "criterion-cycles-per-byte",
- "derive-deftly",
- "derive_builder_fork_arti",
- "derive_more",
- "digest",
- "educe",
- "enum_dispatch",
- "futures",
- "futures-util",
- "hkdf",
- "hmac",
- "itertools 0.14.0",
- "nonany",
- "oneshot-fused-workaround",
- "pin-project",
- "postage",
- "rand 0.9.2",
- "rand_core 0.9.3",
- "safelog",
- "slotmap-careful",
- "smallvec",
- "static_assertions",
- "subtle",
- "sync_wrapper 1.0.2",
- "thiserror 2.0.16",
- "tokio",
- "tokio-util",
- "tor-async-utils",
- "tor-basic-utils",
- "tor-bytes",
- "tor-cell",
- "tor-cert",
- "tor-checkable",
- "tor-config",
- "tor-error",
- "tor-linkspec",
- "tor-llcrypto",
- "tor-log-ratelim",
- "tor-memquota",
- "tor-protover",
- "tor-relay-crypto",
- "tor-rtcompat",
- "tor-rtmock",
- "tor-units",
- "tracing",
- "typenum",
- "visibility",
- "void",
- "zeroize",
-]
-
-[[package]]
-name = "tor-protover"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aed88527d070c4b7ea4e55a36d2d56d0500e30ca66298b5264f047f7f2f89cfa"
-dependencies = [
- "caret",
- "paste",
- "serde_with",
- "thiserror 2.0.16",
- "tor-basic-utils",
- "tor-bytes",
-]
-
-[[package]]
-name = "tor-relay-crypto"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7e57e9f71b22ae1df63dbccc8e428cb07feec0abd654735109fa563c10bbb90"
-dependencies = [
- "derive-deftly",
- "derive_more",
- "humantime",
- "tor-cert",
- "tor-checkable",
- "tor-error",
- "tor-key-forge",
- "tor-keymgr",
- "tor-llcrypto",
- "tor-persist",
-]
-
-[[package]]
-name = "tor-relay-selection"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a372072ac9dea7d17e49693cc3f3ae77b3abf8125630516c9f2d622239b1920a"
-dependencies = [
- "rand 0.9.2",
- "serde",
- "tor-basic-utils",
- "tor-linkspec",
- "tor-netdir",
- "tor-netdoc",
-]
-
-[[package]]
-name = "tor-rtcompat"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14428b930e59003e801c0c32697c0aeb9b0495ad33ecbe8c6753bdb596233270"
-dependencies = [
- "async-native-tls",
- "async-trait",
- "async_executors",
- "asynchronous-codec",
- "cfg-if",
- "coarsetime",
- "derive_more",
- "dyn-clone",
- "educe",
- "futures",
- "hex",
- "libc",
- "native-tls",
- "paste",
- "pin-project",
- "socket2 0.6.3",
- "thiserror 2.0.16",
- "tokio",
- "tokio-util",
- "tor-error",
- "tor-general-addr",
- "tracing",
- "void",
- "zeroize",
-]
-
-[[package]]
-name = "tor-rtmock"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2da91a432cdaee8a93e0bb21b02f3e9c7667832ccbb4b54e00d9c1214638e70"
-dependencies = [
- "amplify",
- "assert_matches",
- "async-trait",
- "derive-deftly",
- "derive_more",
- "educe",
- "futures",
- "humantime",
- "itertools 0.14.0",
- "oneshot-fused-workaround",
- "pin-project",
- "priority-queue",
- "slotmap-careful",
- "strum",
- "thiserror 2.0.16",
- "tor-error",
- "tor-general-addr",
- "tor-rtcompat",
- "tracing",
- "tracing-test",
- "void",
-]
-
-[[package]]
-name = "tor-socksproto"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adbc9115a2f506d9bb86ae4446f0ca70eb523dc2f5e900a33582e7c39decc23a"
-dependencies = [
- "amplify",
- "caret",
- "derive-deftly",
- "educe",
- "safelog",
- "subtle",
- "thiserror 2.0.16",
- "tor-bytes",
- "tor-error",
-]
-
-[[package]]
-name = "tor-units"
-version = "0.40.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da90e93b4b4aa4ec356ecbe9e19aced36fdd655e94ca459d1915120d873363f0"
-dependencies = [
- "derive-deftly",
- "derive_more",
- "serde",
- "thiserror 2.0.16",
- "tor-memquota",
-]
-
 [[package]]
 name = "tower"
 version = "0.4.13"
@@ -6810,7 +2405,7 @@ dependencies = [
  "indexmap 1.9.3",
  "pin-project",
  "pin-project-lite",
- "rand 0.8.5",
+ "rand",
  "slab",
  "tokio",
  "tokio-util",
@@ -6819,59 +2414,24 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "tower"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9"
-dependencies = [
- "futures-core",
- "futures-util",
- "pin-project-lite",
- "sync_wrapper 1.0.2",
- "tokio",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "tower-http"
-version = "0.6.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adc82fd73de2a9722ac5da747f12383d2bfdb93591ee6c58486e0097890f05f2"
-dependencies = [
- "bitflags 2.9.4",
- "bytes",
- "futures-util",
- "http 1.3.1",
- "http-body 1.0.1",
- "iri-string",
- "pin-project-lite",
- "tower 0.5.2",
- "tower-layer",
- "tower-service",
-]
-
 [[package]]
 name = "tower-layer"
-version = "0.3.3"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+checksum = "c20c8dbed6283a09604c3e69b4b7eeb54e298b8a600d4d5ecb5ad39de609f1d0"
 
 [[package]]
 name = "tower-service"
-version = "0.3.3"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
 
 [[package]]
 name = "tracing"
-version = "0.1.41"
+version = "0.1.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
+checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
 dependencies = [
- "log",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -6879,20 +2439,20 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.30"
+version = "0.1.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81383ab64e72a7a8b8e13130c49e3dab29def6d0c7d76a03087b3cf71c5c6903"
+checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
 name = "tracing-core"
-version = "0.1.34"
+version = "0.1.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d12581f227e93f094d3af2ae690a574abb8a2b9b7a96e7cfe9647b2b617678"
+checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
 dependencies = [
  "once_cell",
  "valuable",
@@ -6900,9 +2460,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-journald"
-version = "0.3.1"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc0b4143302cf1022dac868d521e36e8b27691f72c84b3311750d5188ebba657"
+checksum = "ba316a74e8fc3c3896a850dba2375928a9fa171b085ecddfc7c054d39970f3fd"
 dependencies = [
  "libc",
  "tracing-core",
@@ -6948,14 +2508,14 @@ dependencies = [
 
 [[package]]
 name = "tracing-subscriber"
-version = "0.3.20"
+version = "0.3.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2054a14f5307d601f88daf0553e1cbf472acc4f2c51afab632431cdcd72124d5"
+checksum = "ad0f048c97dbd9faa9b7df56362b8ebcaa52adb06b498c050d2f4e32f90a7a8b"
 dependencies = [
  "matchers",
  "nu-ansi-term",
  "once_cell",
- "regex-automata",
+ "regex",
  "sharded-slab",
  "smallvec",
  "thread_local",
@@ -6964,27 +2524,6 @@ dependencies = [
  "tracing-log 0.2.0",
 ]
 
-[[package]]
-name = "tracing-test"
-version = "0.2.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19a4c448db514d4f24c5ddb9f73f2ee71bfb24c526cf0c570ba142d1119e0051"
-dependencies = [
- "tracing-core",
- "tracing-subscriber",
- "tracing-test-macro",
-]
-
-[[package]]
-name = "tracing-test-macro"
-version = "0.2.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad06847b7afb65c7866a36664b75c40b895e318cea4f71299f013fb22965329d"
-dependencies = [
- "quote",
- "syn 2.0.106",
-]
-
 [[package]]
 name = "try-lock"
 version = "0.2.5"
@@ -7005,73 +2544,51 @@ dependencies = [
  "libloading 0.7.4",
  "log",
  "nix 0.26.4",
- "reqwest 0.11.27",
- "schemars 0.8.22",
+ "reqwest",
+ "schemars",
  "serde",
- "socket2 0.5.10",
+ "socket2 0.4.10",
  "ssri",
  "tempfile",
  "tokio",
  "tracing",
  "widestring",
- "windows 0.48.0",
+ "windows",
  "zip",
 ]
 
-[[package]]
-name = "typed-index-collections"
-version = "3.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "898160f1dfd383b4e92e17f0512a7d62f3c51c44937b23b6ffc3a1614a8eaccd"
-dependencies = [
- "bincode",
- "serde",
-]
-
 [[package]]
 name = "typenum"
-version = "1.18.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
 
 [[package]]
-name = "uncased"
-version = "0.9.10"
+name = "unicode-bidi"
+version = "0.3.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1b88fcfe09e89d3866a5c11019378088af2d24c3fbd4f0543f96b479ec90697"
-dependencies = [
- "version_check",
-]
+checksum = "08f95100a766bf4f8f28f90d77e0a5461bbdb219042e7679bebe79004fed8d75"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.19"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f63a545481291138910575129486daeaf8ac54aee4387fe7906919f7830c7d9d"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
 [[package]]
-name = "unicode-segmentation"
-version = "1.13.2"
+name = "unicode-normalization"
+version = "0.1.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9629274872b2bfaf8d66f5f15725007f635594914870f65218920345aa11aa8c"
+checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+dependencies = [
+ "tinyvec",
+]
 
 [[package]]
 name = "unicode-width"
-version = "0.1.14"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
-
-[[package]]
-name = "unicode-width"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a1a07cc7db3810833284e8d372ccdc6da29741639ecc70c9ec107df0fa6154c"
-
-[[package]]
-name = "unicode-xid"
-version = "0.2.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+checksum = "e51733f11c9c4f72aa0c160008246859e340b00807569a0da0e7a1079b27ba85"
 
 [[package]]
 name = "universal-hash"
@@ -7089,52 +2606,37 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
-[[package]]
-name = "unty"
-version = "0.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d49784317cd0d1ee7ec5c716dd598ec5b4483ea832a2dced265471cc0f690ae"
-
 [[package]]
 name = "url"
-version = "2.5.8"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+checksum = "31e6302e3bb753d46e83516cae55ae196fc0c309407cf11ab35cc51a4c2a4633"
 dependencies = [
  "form_urlencoded",
  "idna",
  "percent-encoding",
- "serde",
 ]
 
-[[package]]
-name = "utf8_iter"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
-
 [[package]]
 name = "utf8parse"
-version = "0.2.2"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
 
 [[package]]
 name = "uuid"
-version = "1.18.1"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f87b8aa10b915a06587d0dec516c282ff295b475d94abf425d62b57710070a2"
+checksum = "f00cc9702ca12d3c81455259621e676d0f7251cec66a21e98fe2e9a37db93b2a"
 dependencies = [
- "js-sys",
  "serde",
- "wasm-bindgen",
 ]
 
 [[package]]
 name = "valuable"
-version = "0.1.1"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
 
 [[package]]
 name = "vcpkg"
@@ -7144,36 +2646,9 @@ checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
 
 [[package]]
 name = "version_check"
-version = "0.9.5"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
-
-[[package]]
-name = "visibility"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d674d135b4a8c1d7e813e2f8d1c9a58308aee4a680323066025e53132218bd91"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "void"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a02e4885ed3bc0f2de90ea6dd45ebcbb66dacffe03547fadbb0eeae2770887d"
-
-[[package]]
-name = "walkdir"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
-dependencies = [
- "same-file",
- "winapi-util",
-]
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
 
 [[package]]
 name = "want"
@@ -7186,74 +2661,52 @@ dependencies = [
 
 [[package]]
 name = "wasi"
-version = "0.11.1+wasi-snapshot-preview1"
+version = "0.11.0+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
-
-[[package]]
-name = "wasi"
-version = "0.14.7+wasi-0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "883478de20367e224c0090af9cf5f9fa85bed63a95c1abf3afc5c083ebc06e8c"
-dependencies = [
- "wasip2",
-]
-
-[[package]]
-name = "wasip2"
-version = "1.0.1+wasi-0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
-dependencies = [
- "wit-bindgen 0.46.0",
-]
-
-[[package]]
-name = "wasip3"
-version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
-dependencies = [
- "wit-bindgen 0.51.0",
-]
-
-[[package]]
-name = "wasix"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1757e0d1f8456693c7e5c6c629bdb54884e032aa0bb53c155f6a39f94440d332"
-dependencies = [
- "wasi 0.11.1+wasi-snapshot-preview1",
-]
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.116"
+version = "0.2.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dc0882f7b5bb01ae8c5215a1230832694481c1a4be062fd410e12ea3da5b631"
+checksum = "b1223296a201415c7fad14792dbefaace9bd52b62d33453ade1c5b5f07555406"
 dependencies = [
  "cfg-if",
- "once_cell",
- "rustversion",
  "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.90"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcdc935b63408d58a32f8cc9738a0bffd8f05cc7c002086c6ef20b7312ad9dcd"
+dependencies = [
+ "bumpalo",
+ "log",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.48",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.66"
+version = "0.4.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19280959e2844181895ef62f065c63e0ca07ece4771b53d89bfdb967d97cbf05"
+checksum = "bde2032aeb86bdfaecc8b261eef3cba735cc426c1f3a3416d1e0791be95fc461"
 dependencies = [
+ "cfg-if",
  "js-sys",
  "wasm-bindgen",
+ "web-sys",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.116"
+version = "0.2.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75973d3066e01d035dbedaad2864c398df42f8dd7b1ea057c35b8407c015b537"
+checksum = "3e4c238561b2d428924c49815533a8b9121c664599558a5d9ec51f8a1740a999"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -7261,95 +2714,33 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.116"
+version = "0.2.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91af5e4be765819e0bcfee7322c14374dc821e35e72fa663a830bbc7dc199eac"
+checksum = "bae1abb6806dc1ad9e560ed242107c0f6c84335f1749dd4e8ddb012ebd5e25a7"
 dependencies = [
- "bumpalo",
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
+ "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.116"
+version = "0.2.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9bf0406a78f02f336bf1e451799cca198e8acde4ffa278f0fb20487b150a633"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "wasm-encoder"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
-dependencies = [
- "leb128fmt",
- "wasmparser",
-]
-
-[[package]]
-name = "wasm-metadata"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
-dependencies = [
- "anyhow",
- "indexmap 2.11.4",
- "wasm-encoder",
- "wasmparser",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
-dependencies = [
- "bitflags 2.9.4",
- "hashbrown 0.15.5",
- "indexmap 2.11.4",
- "semver",
-]
-
-[[package]]
-name = "weak-table"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "323f4da9523e9a669e1eaf9c6e763892769b1d38c623913647bfdc1532fe4549"
+checksum = "4d91413b1c31d7539ba5ef2451af3f0b833a005eb27a631cec32bc0635a8602b"
 
 [[package]]
 name = "web-sys"
-version = "0.3.93"
+version = "0.3.67"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "749466a37ee189057f54748b200186b59a03417a117267baf3fd89cecc9fb837"
+checksum = "58cd2333b6e0be7a39605f0e255892fd7418a682d8da8fe042fe25128794d2ed"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "web-time"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "webpki-roots"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32b130c0d2d49f8b6889abc456e795e82525204f27c42cf767cf0d7734e089b8"
-dependencies = [
- "rustls-pki-types",
-]
-
 [[package]]
 name = "which"
 version = "4.4.2"
@@ -7359,14 +2750,14 @@ dependencies = [
  "either",
  "home",
  "once_cell",
- "rustix 0.38.44",
+ "rustix",
 ]
 
 [[package]]
 name = "widestring"
-version = "1.2.0"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd7cf3379ca1aac9eea11fba24fd7e315d621f8dfe35c8d7d2be8b793726e07d"
+checksum = "653f141f39ec16bba3c5abe400a0c60da7468261cc2cbf36805022876bc721a8"
 
 [[package]]
 name = "winapi"
@@ -7384,15 +2775,6 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
-[[package]]
-name = "winapi-util"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
-dependencies = [
- "windows-sys 0.61.0",
-]
-
 [[package]]
 name = "winapi-x86_64-pc-windows-gnu"
 version = "0.4.0"
@@ -7408,154 +2790,6 @@ dependencies = [
  "windows-targets 0.48.5",
 ]
 
-[[package]]
-name = "windows"
-version = "0.61.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893"
-dependencies = [
- "windows-collections",
- "windows-core 0.61.2",
- "windows-future",
- "windows-link 0.1.3",
- "windows-numerics",
-]
-
-[[package]]
-name = "windows-collections"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8"
-dependencies = [
- "windows-core 0.61.2",
-]
-
-[[package]]
-name = "windows-core"
-version = "0.61.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
-dependencies = [
- "windows-implement",
- "windows-interface",
- "windows-link 0.1.3",
- "windows-result 0.3.4",
- "windows-strings 0.4.2",
-]
-
-[[package]]
-name = "windows-core"
-version = "0.62.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
-dependencies = [
- "windows-implement",
- "windows-interface",
- "windows-link 0.2.1",
- "windows-result 0.4.1",
- "windows-strings 0.5.1",
-]
-
-[[package]]
-name = "windows-future"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e"
-dependencies = [
- "windows-core 0.61.2",
- "windows-link 0.1.3",
- "windows-threading",
-]
-
-[[package]]
-name = "windows-implement"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "windows-interface"
-version = "0.59.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "windows-link"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
-
-[[package]]
-name = "windows-link"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
-
-[[package]]
-name = "windows-numerics"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1"
-dependencies = [
- "windows-core 0.61.2",
- "windows-link 0.1.3",
-]
-
-[[package]]
-name = "windows-result"
-version = "0.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
-dependencies = [
- "windows-link 0.1.3",
-]
-
-[[package]]
-name = "windows-result"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
-dependencies = [
- "windows-link 0.2.1",
-]
-
-[[package]]
-name = "windows-strings"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
-dependencies = [
- "windows-link 0.1.3",
-]
-
-[[package]]
-name = "windows-strings"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
-dependencies = [
- "windows-link 0.2.1",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.45.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
-dependencies = [
- "windows-targets 0.42.2",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.48.0"
@@ -7571,49 +2805,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.59.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.3",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.61.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e201184e40b2ede64bc2ea34968b28e33622acdbbf37104f0e4a33f7abe657aa"
-dependencies = [
- "windows-link 0.2.1",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
-dependencies = [
- "windows_aarch64_gnullvm 0.42.2",
- "windows_aarch64_msvc 0.42.2",
- "windows_i686_gnu 0.42.2",
- "windows_i686_msvc 0.42.2",
- "windows_x86_64_gnu 0.42.2",
- "windows_x86_64_gnullvm 0.42.2",
- "windows_x86_64_msvc 0.42.2",
+ "windows-targets 0.52.0",
 ]
 
 [[package]]
@@ -7633,52 +2825,19 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.52.6"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+checksum = "8a18201040b24831fbb9e4eb208f8892e1f50a37feb53cc7ff887feb8f50e7cd"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
+ "windows_aarch64_gnullvm 0.52.0",
+ "windows_aarch64_msvc 0.52.0",
+ "windows_i686_gnu 0.52.0",
+ "windows_i686_msvc 0.52.0",
+ "windows_x86_64_gnu 0.52.0",
+ "windows_x86_64_gnullvm 0.52.0",
+ "windows_x86_64_msvc 0.52.0",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.53.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5fe6031c4041849d7c496a8ded650796e7b6ecc19df1a431c1a363342e5dc91"
-dependencies = [
- "windows-link 0.1.3",
- "windows_aarch64_gnullvm 0.53.0",
- "windows_aarch64_msvc 0.53.0",
- "windows_i686_gnu 0.53.0",
- "windows_i686_gnullvm 0.53.0",
- "windows_i686_msvc 0.53.0",
- "windows_x86_64_gnu 0.53.0",
- "windows_x86_64_gnullvm 0.53.0",
- "windows_x86_64_msvc 0.53.0",
-]
-
-[[package]]
-name = "windows-threading"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b66463ad2e0ea3bbf808b7f1d371311c80e115c0b71d60efc142cafbcfb057a6"
-dependencies = [
- "windows-link 0.1.3",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
-
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.48.5"
@@ -7687,21 +2846,9 @@ checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.52.6"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86b8d5f90ddd19cb4a147a5fa63ca848db3df085e25fee3cc10b39b6eebae764"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+checksum = "cb7764e35d4db8a7921e09562a0304bf2f93e0a51bfccee0bd0bb0b666b015ea"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -7711,21 +2858,9 @@ checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.52.6"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7651a1f62a11b8cbd5e0d42526e55f2c99886c77e007179efff86c2b137e66c"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+checksum = "bbaa0368d4f1d2aaefc55b6fcfee13f41544ddf36801e793edbbfd7d7df075ef"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -7735,33 +2870,9 @@ checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.6"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1dc67659d35f387f5f6c479dc4e28f1d4bb90ddd1a5d3da2e5d97b42d6272c3"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ce6ccbdedbf6d6354471319e781c0dfef054c81fbc7cf83f338a4296c0cae11"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+checksum = "a28637cb1fa3560a16915793afb20081aba2c92ee8af57b4d5f28e4b3e7df313"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -7771,21 +2882,9 @@ checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.52.6"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "581fee95406bb13382d2f65cd4a908ca7b1e4c2f1917f143ba16efe98a589b5d"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+checksum = "ffe5e8e31046ce6230cc7215707b816e339ff4d4d67c65dffa206fd0f7aa7b9a"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -7795,21 +2894,9 @@ checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.52.6"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e55b5ac9ea33f2fc1716d1742db15574fd6fc8dadc51caab1c16a3d3b4190ba"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+checksum = "3d6fa32db2bc4a2f5abeacf2b69f7992cd09dca97498da74a151a3132c26befd"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -7819,21 +2906,9 @@ checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.52.6"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a6e035dd0599267ce1ee132e51c27dd29437f63325753051e71dd9e42406c57"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+checksum = "1a657e1e9d3f514745a572a6846d3c7aa7dbe1658c056ed9c3344c4109a6949e"
 
 [[package]]
 name = "windows_x86_64_msvc"
@@ -7843,30 +2918,9 @@ checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.52.6"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"
-
-[[package]]
-name = "winnow"
-version = "0.7.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21a0236b59786fed61e2a80582dd500fe61f18b5dca67a4a067d0bc9039339cf"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "winnow"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09dac053f1cd375980747450bfc7250c264eaae0583872e845c0c7cd578872b5"
+checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04"
 
 [[package]]
 name = "winreg"
@@ -7878,203 +2932,38 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "wit-bindgen"
-version = "0.46.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
-
-[[package]]
-name = "wit-bindgen"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
-dependencies = [
- "wit-bindgen-rust-macro",
-]
-
-[[package]]
-name = "wit-bindgen-core"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
-dependencies = [
- "anyhow",
- "heck",
- "wit-parser",
-]
-
-[[package]]
-name = "wit-bindgen-rust"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
-dependencies = [
- "anyhow",
- "heck",
- "indexmap 2.11.4",
- "prettyplease",
- "syn 2.0.106",
- "wasm-metadata",
- "wit-bindgen-core",
- "wit-component",
-]
-
-[[package]]
-name = "wit-bindgen-rust-macro"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
-dependencies = [
- "anyhow",
- "prettyplease",
- "proc-macro2",
- "quote",
- "syn 2.0.106",
- "wit-bindgen-core",
- "wit-bindgen-rust",
-]
-
-[[package]]
-name = "wit-component"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
-dependencies = [
- "anyhow",
- "bitflags 2.9.4",
- "indexmap 2.11.4",
- "log",
- "serde",
- "serde_derive",
- "serde_json",
- "wasm-encoder",
- "wasm-metadata",
- "wasmparser",
- "wit-parser",
-]
-
-[[package]]
-name = "wit-parser"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
-dependencies = [
- "anyhow",
- "id-arena",
- "indexmap 2.11.4",
- "log",
- "semver",
- "serde",
- "serde_derive",
- "serde_json",
- "unicode-xid",
- "wasmparser",
-]
-
-[[package]]
-name = "writeable"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea2f10b9bb0928dfb1b42b65e1f9e36f7f54dbdf08457afefb38afcdec4fa2bb"
-
-[[package]]
-name = "wyz"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f360fc0b24296329c78fda852a1e9ae82de9cf7b27dae4b7f62f118f77b9ed"
-dependencies = [
- "tap",
-]
-
 [[package]]
 name = "x25519-dalek"
-version = "2.0.1"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
+checksum = "fb66477291e7e8d2b0ff1bcb900bf29489a9692816d79874bea351e7a8b6de96"
 dependencies = [
  "curve25519-dalek",
- "rand_core 0.6.4",
+ "rand_core",
  "serde",
  "zeroize",
 ]
 
 [[package]]
 name = "xxhash-rust"
-version = "0.8.15"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdd20c5420375476fbd4394763288da7eb0cc0b8c11deed431a91562af7335d3"
+checksum = "53be06678ed9e83edb1745eb72efc0bbcd7b5c3c35711a860906aed827a13d61"
 
 [[package]]
-name = "yoke"
-version = "0.8.0"
+name = "yaml-rust"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f41bb01b8226ef4bfd589436a297c53d118f65921786300e427be8d487695cc"
+checksum = "56c1936c4cc7a1c9ab21a1ebb602eb942ba868cbd44a99cb7cdc5892335e1c85"
 dependencies = [
- "serde",
- "stable_deref_trait",
- "yoke-derive",
- "zerofrom",
-]
-
-[[package]]
-name = "yoke-derive"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38da3c9736e16c5d3c8c597a9aaa5d1fa565d0532ae05e27c24aa62fb32c0ab6"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
- "synstructure",
-]
-
-[[package]]
-name = "zerocopy"
-version = "0.8.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0894878a5fa3edfd6da3f88c4805f4c8558e2b996227a3d864f47fe11e38282c"
-dependencies = [
- "zerocopy-derive",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.8.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88d2b8d9c68ad2b9e4340d7832716a4d21a22a1154777ad56ea55c51a9cf3831"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "zerofrom"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
-dependencies = [
- "zerofrom-derive",
-]
-
-[[package]]
-name = "zerofrom-derive"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
- "synstructure",
+ "linked-hash-map",
 ]
 
 [[package]]
 name = "zeroize"
-version = "1.8.2"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
 dependencies = [
  "zeroize_derive",
 ]
@@ -8087,40 +2976,7 @@ checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "zerotrie"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36f0bbd478583f79edad978b407914f61b2972f5af6fa089686016be8f9af595"
-dependencies = [
- "displaydoc",
- "yoke",
- "zerofrom",
-]
-
-[[package]]
-name = "zerovec"
-version = "0.11.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7aa2bd55086f1ab526693ecbe444205da57e25f4489879da80635a46d90e73b"
-dependencies = [
- "yoke",
- "zerofrom",
- "zerovec-derive",
-]
-
-[[package]]
-name = "zerovec-derive"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b96237efa0c878c64bd89c436f661be4e46b2f3eff1ebb976f7ef2321d2f58f"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
@@ -8140,7 +2996,7 @@ dependencies = [
  "pbkdf2",
  "sha1",
  "time",
- "zstd 0.11.2+zstd.1.5.2",
+ "zstd",
 ]
 
 [[package]]
@@ -8149,16 +3005,7 @@ version = "0.11.2+zstd.1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "20cc960326ece64f010d2d2107537f26dc589a6573a316bd5b1dba685fa5fde4"
 dependencies = [
- "zstd-safe 5.0.2+zstd.1.5.2",
-]
-
-[[package]]
-name = "zstd"
-version = "0.13.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
-dependencies = [
- "zstd-safe 7.2.4",
+ "zstd-safe",
 ]
 
 [[package]]
@@ -8171,20 +3018,11 @@ dependencies = [
  "zstd-sys",
 ]
 
-[[package]]
-name = "zstd-safe"
-version = "7.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
-dependencies = [
- "zstd-sys",
-]
-
 [[package]]
 name = "zstd-sys"
-version = "2.0.16+zstd.1.5.7"
+version = "2.0.9+zstd.1.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
+checksum = "9e16efa8a874a0481a574084d34cc26fdb3b99627480f785888deb6386506656"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/Cargo.toml b/Cargo.toml
index 13b3e08..44981a2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,15 +1,4 @@
 [workspace]
-members = [
-  "burrow",
-  "tun",
-  "crates/burrow-core",
-  "crates/burrow-mobile-ffi",
-  "crates/burrow-windows-stub",
-]
+members = ["burrow", "tun"]
 resolver = "2"
 exclude = ["burrow-gtk"]
-
-[profile.release]
-lto = true
-panic = "abort"
-opt-level = "z"
diff --git a/Dockerfile b/Dockerfile
index 2c4415e..b1500bb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/library/rust:1.85-slim-bookworm AS builder
+FROM docker.io/library/rust:1.70.0-slim-bookworm AS builder
 
 ARG TARGETPLATFORM
 ARG LLVM_VERSION=16
@@ -8,11 +8,11 @@ ENV KEYRINGS /etc/apt/keyrings
 RUN set -eux && \
     mkdir -p $KEYRINGS && \
     apt-get update && \
-    apt-get install --no-install-recommends -y gpg curl busybox make musl-dev && \
+    apt-get install --no-install-recommends -y gpg curl musl-dev && \
     curl --proto '=https' --tlsv1.2 -sSf https://apt.llvm.org/llvm-snapshot.gpg.key | gpg --dearmor --output $KEYRINGS/llvm.gpg && \
     echo "deb [signed-by=$KEYRINGS/llvm.gpg] http://apt.llvm.org/bookworm/ llvm-toolchain-bookworm-$LLVM_VERSION main" > /etc/apt/sources.list.d/llvm.list && \
     apt-get update && \
-    apt-get install --no-install-recommends -y clang-$LLVM_VERSION llvm-$LLVM_VERSION lld-$LLVM_VERSION build-essential sqlite3 libsqlite3-dev musl musl-tools musl-dev protobuf-compiler libprotobuf-dev && \
+    apt-get install --no-install-recommends -y clang-$LLVM_VERSION llvm-$LLVM_VERSION lld-$LLVM_VERSION && \
     ln -s clang-$LLVM_VERSION /usr/bin/clang && \
     ln -s clang /usr/bin/clang++ && \
     ln -s lld-$LLVM_VERSION /usr/bin/ld.lld && \
@@ -25,47 +25,26 @@ RUN set -eux && \
     rm -rf /var/lib/apt/lists/*
 
 RUN case $TARGETPLATFORM in \
-    "linux/arm64") LLVM_TARGET=aarch64-unknown-linux-musl ;; \
-    "linux/amd64") LLVM_TARGET=x86_64-unknown-linux-musl ;; \
-    *) exit 1 ;; \
+     "linux/arm64") LLVM_TARGET=aarch64-unknown-linux-musl ;; \
+     "linux/amd64") LLVM_TARGET=x86_64-unknown-linux-musl ;; \
+     *) exit 1 ;; \
     esac && \
     rustup target add $LLVM_TARGET
 
-ARG SQLITE_VERSION=3460000
-
-RUN case $TARGETPLATFORM in \
-    "linux/arm64") LLVM_TARGET=aarch64-unknown-linux-musl MUSL_TARGET=aarch64-linux-musl ;; \
-    "linux/amd64") LLVM_TARGET=x86_64-unknown-linux-musl MUSL_TARGET=x86_64-linux-musl ;; \
-    *) exit 1 ;; \
-    esac && \
-    curl --proto '=https' --tlsv1.2 -sSfO https://www.sqlite.org/2024/sqlite-autoconf-$SQLITE_VERSION.tar.gz && \
-    tar xf sqlite-autoconf-$SQLITE_VERSION.tar.gz && \
-    cd sqlite-autoconf-$SQLITE_VERSION && \
-    ./configure --disable-shared --disable-dependency-tracking \
-    CC="clang-$LLVM_VERSION -target $LLVM_TARGET" \
-    CFLAGS="-I/usr/local/include -I/usr/include/$MUSL_TARGET" \
-    LDFLAGS="-L/usr/local/lib -L/usr/lib/$MUSL_TARGET -L/lib/$MUSL_TARGET" && \
-    make && \
-    make install && \
-    cd .. && \
-    rm -rf sqlite-autoconf-$SQLITE_VERSION sqlite-autoconf-$SQLITE_VERSION.tar.gz
-
 ENV CC_x86_64_unknown_linux_musl=clang-$LLVM_VERSION \
     AR_x86_64_unknown_linux_musl=llvm-ar-$LLVM_VERSION \
     CC_aarch64_unknown_linux_musl=clang-$LLVM_VERSION \
     AR_aarch64_unknown_linux_musl=llvm-ar-$LLVM_VERSION \
     CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_RUSTFLAGS="-L/usr/lib/x86_64-linux-musl -L/lib/x86_64-linux-musl -C linker=rust-lld" \
     CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_RUSTFLAGS="-L/usr/lib/aarch64-linux-musl -L/lib/aarch64-linux-musl -C linker=rust-lld" \
-    SQLITE3_STATIC=1 \
-    SQLITE3_INCLUDE_DIR=/usr/local/include \
-    SQLITE3_LIB_DIR=/usr/local/lib
+    CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse
 
 COPY . .
 
 RUN case $TARGETPLATFORM in \
-    "linux/arm64") LLVM_TARGET=aarch64-unknown-linux-musl ;; \
-    "linux/amd64") LLVM_TARGET=x86_64-unknown-linux-musl ;; \
-    *) exit 1 ;; \
+     "linux/arm64") LLVM_TARGET=aarch64-unknown-linux-musl ;; \
+     "linux/amd64") LLVM_TARGET=x86_64-unknown-linux-musl ;; \
+     *) exit 1 ;; \
     esac && \
     cargo install --path burrow --target $LLVM_TARGET
 
@@ -74,8 +53,7 @@ WORKDIR /tmp/rootfs
 RUN set -eux && \
     mkdir -p ./bin ./etc ./tmp ./data && \
     mv /usr/local/cargo/bin/burrow ./bin/burrow && \
-    cp /bin/busybox ./bin/busybox && \
-    echo 'burrow:x:10001:10001::/tmp:/bin/busybox' > ./etc/passwd && \
+    echo 'burrow:x:10001:10001::/tmp:/sbin/nologin' > ./etc/passwd && \
     echo 'burrow:x:10001:' > ./etc/group && \
     chown -R 10001:10001 ./tmp ./data && \
     chmod 0777 ./tmp
@@ -85,8 +63,8 @@ LABEL \
     # https://github.com/opencontainers/image-spec/blob/master/annotations.md
     org.opencontainers.image.title="burrow" \
     org.opencontainers.image.description="Burrow is an open source tool for burrowing through firewalls, built by teenagers at Hack Club." \
-    org.opencontainers.image.url="https://git.burrow.net/hackclub/burrow" \
-    org.opencontainers.image.source="https://git.burrow.net/hackclub/burrow" \
+    org.opencontainers.image.url="https://github.com/hackclub/burrow" \
+    org.opencontainers.image.source="https://github.com/hackclub/burrow" \
     org.opencontainers.image.vendor="hackclub" \
     org.opencontainers.image.licenses="GPL-3.0"
 
@@ -94,6 +72,4 @@ USER 10001:10001
 COPY --from=builder /tmp/rootfs /
 WORKDIR /data
 
-EXPOSE 8080
-
-CMD ["/bin/burrow", "auth-server"]
+ENTRYPOINT ["/bin/burrow"]
diff --git a/MODULE.bazel b/MODULE.bazel
deleted file mode 100644
index 03e942e..0000000
--- a/MODULE.bazel
+++ /dev/null
@@ -1,7 +0,0 @@
-module(
-    name = "burrow",
-    version = "0.1.0",
-)
-
-bazel_dep(name = "platforms", version = "1.0.0")
-bazel_dep(name = "rules_shell", version = "0.6.1")
diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock
deleted file mode 100644
index 28f5c18..0000000
--- a/MODULE.bazel.lock
+++ /dev/null
@@ -1,448 +0,0 @@
-{
-  "lockFileVersion": 26,
-  "registryFileHashes": {
-    "https://bcr.bazel.build/bazel_registry.json": "8a28e4aff06ee60aed2a8c281907fb8bcbf3b753c91fb5a5c57da3215d5b3497",
-    "https://bcr.bazel.build/modules/abseil-cpp/20210324.2/MODULE.bazel": "7cd0312e064fde87c8d1cd79ba06c876bd23630c83466e9500321be55c96ace2",
-    "https://bcr.bazel.build/modules/abseil-cpp/20211102.0/MODULE.bazel": "70390338f7a5106231d20620712f7cccb659cd0e9d073d1991c038eb9fc57589",
-    "https://bcr.bazel.build/modules/abseil-cpp/20230125.1/MODULE.bazel": "89047429cb0207707b2dface14ba7f8df85273d484c2572755be4bab7ce9c3a0",
-    "https://bcr.bazel.build/modules/abseil-cpp/20230802.0.bcr.1/MODULE.bazel": "1c8cec495288dccd14fdae6e3f95f772c1c91857047a098fad772034264cc8cb",
-    "https://bcr.bazel.build/modules/abseil-cpp/20230802.0/MODULE.bazel": "d253ae36a8bd9ee3c5955384096ccb6baf16a1b1e93e858370da0a3b94f77c16",
-    "https://bcr.bazel.build/modules/abseil-cpp/20230802.1/MODULE.bazel": "fa92e2eb41a04df73cdabeec37107316f7e5272650f81d6cc096418fe647b915",
-    "https://bcr.bazel.build/modules/abseil-cpp/20240116.1/MODULE.bazel": "37bcdb4440fbb61df6a1c296ae01b327f19e9bb521f9b8e26ec854b6f97309ed",
-    "https://bcr.bazel.build/modules/abseil-cpp/20240116.2/MODULE.bazel": "73939767a4686cd9a520d16af5ab440071ed75cec1a876bf2fcfaf1f71987a16",
-    "https://bcr.bazel.build/modules/abseil-cpp/20250127.1/MODULE.bazel": "c4a89e7ceb9bf1e25cf84a9f830ff6b817b72874088bf5141b314726e46a57c1",
-    "https://bcr.bazel.build/modules/abseil-cpp/20250512.1/MODULE.bazel": "d209fdb6f36ffaf61c509fcc81b19e81b411a999a934a032e10cd009a0226215",
-    "https://bcr.bazel.build/modules/abseil-cpp/20250814.1/MODULE.bazel": "51f2312901470cdab0dbdf3b88c40cd21c62a7ed58a3de45b365ddc5b11bcab2",
-    "https://bcr.bazel.build/modules/abseil-cpp/20250814.1/source.json": "cea3901d7e299da7320700abbaafe57a65d039f10d0d7ea601c4a66938ea4b0c",
-    "https://bcr.bazel.build/modules/apple_support/1.11.1/MODULE.bazel": "1843d7cd8a58369a444fc6000e7304425fba600ff641592161d9f15b179fb896",
-    "https://bcr.bazel.build/modules/apple_support/1.15.1/MODULE.bazel": "a0556fefca0b1bb2de8567b8827518f94db6a6e7e7d632b4c48dc5f865bc7c85",
-    "https://bcr.bazel.build/modules/apple_support/1.21.0/MODULE.bazel": "ac1824ed5edf17dee2fdd4927ada30c9f8c3b520be1b5fd02a5da15bc10bff3e",
-    "https://bcr.bazel.build/modules/apple_support/1.21.1/MODULE.bazel": "5809fa3efab15d1f3c3c635af6974044bac8a4919c62238cce06acee8a8c11f1",
-    "https://bcr.bazel.build/modules/apple_support/1.24.2/MODULE.bazel": "0e62471818affb9f0b26f128831d5c40b074d32e6dda5a0d3852847215a41ca4",
-    "https://bcr.bazel.build/modules/apple_support/1.24.2/source.json": "2c22c9827093250406c5568da6c54e6fdf0ef06238def3d99c71b12feb057a8d",
-    "https://bcr.bazel.build/modules/bazel_features/1.1.1/MODULE.bazel": "27b8c79ef57efe08efccbd9dd6ef70d61b4798320b8d3c134fd571f78963dbcd",
-    "https://bcr.bazel.build/modules/bazel_features/1.10.0/MODULE.bazel": "f75e8807570484a99be90abcd52b5e1f390362c258bcb73106f4544957a48101",
-    "https://bcr.bazel.build/modules/bazel_features/1.11.0/MODULE.bazel": "f9382337dd5a474c3b7d334c2f83e50b6eaedc284253334cf823044a26de03e8",
-    "https://bcr.bazel.build/modules/bazel_features/1.15.0/MODULE.bazel": "d38ff6e517149dc509406aca0db3ad1efdd890a85e049585b7234d04238e2a4d",
-    "https://bcr.bazel.build/modules/bazel_features/1.17.0/MODULE.bazel": "039de32d21b816b47bd42c778e0454217e9c9caac4a3cf8e15c7231ee3ddee4d",
-    "https://bcr.bazel.build/modules/bazel_features/1.18.0/MODULE.bazel": "1be0ae2557ab3a72a57aeb31b29be347bcdc5d2b1eb1e70f39e3851a7e97041a",
-    "https://bcr.bazel.build/modules/bazel_features/1.19.0/MODULE.bazel": "59adcdf28230d220f0067b1f435b8537dd033bfff8db21335ef9217919c7fb58",
-    "https://bcr.bazel.build/modules/bazel_features/1.21.0/MODULE.bazel": "675642261665d8eea09989aa3b8afb5c37627f1be178382c320d1b46afba5e3b",
-    "https://bcr.bazel.build/modules/bazel_features/1.23.0/MODULE.bazel": "fd1ac84bc4e97a5a0816b7fd7d4d4f6d837b0047cf4cbd81652d616af3a6591a",
-    "https://bcr.bazel.build/modules/bazel_features/1.27.0/MODULE.bazel": "621eeee06c4458a9121d1f104efb80f39d34deff4984e778359c60eaf1a8cb65",
-    "https://bcr.bazel.build/modules/bazel_features/1.28.0/MODULE.bazel": "4b4200e6cbf8fa335b2c3f43e1d6ef3e240319c33d43d60cc0fbd4b87ece299d",
-    "https://bcr.bazel.build/modules/bazel_features/1.3.0/MODULE.bazel": "cdcafe83ec318cda34e02948e81d790aab8df7a929cec6f6969f13a489ccecd9",
-    "https://bcr.bazel.build/modules/bazel_features/1.30.0/MODULE.bazel": "a14b62d05969a293b80257e72e597c2da7f717e1e69fa8b339703ed6731bec87",
-    "https://bcr.bazel.build/modules/bazel_features/1.33.0/MODULE.bazel": "8b8dc9d2a4c88609409c3191165bccec0e4cb044cd7a72ccbe826583303459f6",
-    "https://bcr.bazel.build/modules/bazel_features/1.4.1/MODULE.bazel": "e45b6bb2350aff3e442ae1111c555e27eac1d915e77775f6fdc4b351b758b5d7",
-    "https://bcr.bazel.build/modules/bazel_features/1.42.1/MODULE.bazel": "275a59b5406ff18c01739860aa70ad7ccb3cfb474579411decca11c93b951080",
-    "https://bcr.bazel.build/modules/bazel_features/1.42.1/source.json": "fcd4396b2df85f64f2b3bb436ad870793ecf39180f1d796f913cc9276d355309",
-    "https://bcr.bazel.build/modules/bazel_features/1.9.1/MODULE.bazel": "8f679097876a9b609ad1f60249c49d68bfab783dd9be012faf9d82547b14815a",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.0.3/MODULE.bazel": "bcb0fd896384802d1ad283b4e4eb4d718eebd8cb820b0a2c3a347fb971afd9d8",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.1.1/MODULE.bazel": "1add3e7d93ff2e6998f9e118022c84d163917d912f5afafb3058e3d2f1545b5e",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.2.0/MODULE.bazel": "44fe84260e454ed94ad326352a698422dbe372b21a1ac9f3eab76eb531223686",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.2.1/MODULE.bazel": "f35baf9da0efe45fa3da1696ae906eea3d615ad41e2e3def4aeb4e8bc0ef9a7a",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.3.0/MODULE.bazel": "20228b92868bf5cfc41bda7afc8a8ba2a543201851de39d990ec957b513579c5",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.4.1/MODULE.bazel": "a0dcb779424be33100dcae821e9e27e4f2901d9dfd5333efe5ac6a8d7ab75e1d",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.4.2/MODULE.bazel": "3bd40978e7a1fac911d5989e6b09d8f64921865a45822d8b09e815eaa726a651",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.5.0/MODULE.bazel": "32880f5e2945ce6a03d1fbd588e9198c0a959bb42297b2cfaf1685b7bc32e138",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.6.1/MODULE.bazel": "8fdee2dbaace6c252131c00e1de4b165dc65af02ea278476187765e1a617b917",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.7.0/MODULE.bazel": "0db596f4563de7938de764cc8deeabec291f55e8ec15299718b93c4423e9796d",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.7.1/MODULE.bazel": "3120d80c5861aa616222ec015332e5f8d3171e062e3e804a2a0253e1be26e59b",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.8.1/MODULE.bazel": "88ade7293becda963e0e3ea33e7d54d3425127e0a326e0d17da085a5f1f03ff6",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.8.2/MODULE.bazel": "69ad6927098316848b34a9142bcc975e018ba27f08c4ff403f50c1b6e646ca67",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.8.2/source.json": "34a3c8bcf233b835eb74be9d628899bb32999d3e0eadef1947a0a562a2b16ffb",
-    "https://bcr.bazel.build/modules/buildozer/8.5.1/MODULE.bazel": "a35d9561b3fc5b18797c330793e99e3b834a473d5fbd3d7d7634aafc9bdb6f8f",
-    "https://bcr.bazel.build/modules/buildozer/8.5.1/source.json": "e3386e6ff4529f2442800dee47ad28d3e6487f36a1f75ae39ae56c70f0cd2fbd",
-    "https://bcr.bazel.build/modules/google_benchmark/1.8.2/MODULE.bazel": "a70cf1bba851000ba93b58ae2f6d76490a9feb74192e57ab8e8ff13c34ec50cb",
-    "https://bcr.bazel.build/modules/googletest/1.11.0/MODULE.bazel": "3a83f095183f66345ca86aa13c58b59f9f94a2f81999c093d4eeaa2d262d12f4",
-    "https://bcr.bazel.build/modules/googletest/1.14.0.bcr.1/MODULE.bazel": "22c31a561553727960057361aa33bf20fb2e98584bc4fec007906e27053f80c6",
-    "https://bcr.bazel.build/modules/googletest/1.14.0/MODULE.bazel": "cfbcbf3e6eac06ef9d85900f64424708cc08687d1b527f0ef65aa7517af8118f",
-    "https://bcr.bazel.build/modules/googletest/1.15.2/MODULE.bazel": "6de1edc1d26cafb0ea1a6ab3f4d4192d91a312fd2d360b63adaa213cd00b2108",
-    "https://bcr.bazel.build/modules/googletest/1.17.0/MODULE.bazel": "dbec758171594a705933a29fcf69293d2468c49ec1f2ebca65c36f504d72df46",
-    "https://bcr.bazel.build/modules/googletest/1.17.0/source.json": "38e4454b25fc30f15439c0378e57909ab1fd0a443158aa35aec685da727cd713",
-    "https://bcr.bazel.build/modules/jsoncpp/1.9.5/MODULE.bazel": "31271aedc59e815656f5736f282bb7509a97c7ecb43e927ac1a37966e0578075",
-    "https://bcr.bazel.build/modules/jsoncpp/1.9.6/MODULE.bazel": "2f8d20d3b7d54143213c4dfc3d98225c42de7d666011528dc8fe91591e2e17b0",
-    "https://bcr.bazel.build/modules/jsoncpp/1.9.6/source.json": "a04756d367a2126c3541682864ecec52f92cdee80a35735a3cb249ce015ca000",
-    "https://bcr.bazel.build/modules/libpfm/4.11.0/MODULE.bazel": "45061ff025b301940f1e30d2c16bea596c25b176c8b6b3087e92615adbd52902",
-    "https://bcr.bazel.build/modules/nlohmann_json/3.6.1/MODULE.bazel": "6f7b417dcc794d9add9e556673ad25cb3ba835224290f4f848f8e2db1e1fca74",
-    "https://bcr.bazel.build/modules/nlohmann_json/3.6.1/source.json": "f448c6e8963fdfa7eb831457df83ad63d3d6355018f6574fb017e8169deb43a9",
-    "https://bcr.bazel.build/modules/platforms/0.0.10/MODULE.bazel": "8cb8efaf200bdeb2150d93e162c40f388529a25852b332cec879373771e48ed5",
-    "https://bcr.bazel.build/modules/platforms/0.0.11/MODULE.bazel": "0daefc49732e227caa8bfa834d65dc52e8cc18a2faf80df25e8caea151a9413f",
-    "https://bcr.bazel.build/modules/platforms/0.0.4/MODULE.bazel": "9b328e31ee156f53f3c416a64f8491f7eb731742655a47c9eec4703a71644aee",
-    "https://bcr.bazel.build/modules/platforms/0.0.5/MODULE.bazel": "5733b54ea419d5eaf7997054bb55f6a1d0b5ff8aedf0176fef9eea44f3acda37",
-    "https://bcr.bazel.build/modules/platforms/0.0.6/MODULE.bazel": "ad6eeef431dc52aefd2d77ed20a4b353f8ebf0f4ecdd26a807d2da5aa8cd0615",
-    "https://bcr.bazel.build/modules/platforms/0.0.7/MODULE.bazel": "72fd4a0ede9ee5c021f6a8dd92b503e089f46c227ba2813ff183b71616034814",
-    "https://bcr.bazel.build/modules/platforms/0.0.8/MODULE.bazel": "9f142c03e348f6d263719f5074b21ef3adf0b139ee4c5133e2aa35664da9eb2d",
-    "https://bcr.bazel.build/modules/platforms/0.0.9/MODULE.bazel": "4a87a60c927b56ddd67db50c89acaa62f4ce2a1d2149ccb63ffd871d5ce29ebc",
-    "https://bcr.bazel.build/modules/platforms/1.0.0/MODULE.bazel": "f05feb42b48f1b3c225e4ccf351f367be0371411a803198ec34a389fb22aa580",
-    "https://bcr.bazel.build/modules/platforms/1.0.0/source.json": "f4ff1fd412e0246fd38c82328eb209130ead81d62dcd5a9e40910f867f733d96",
-    "https://bcr.bazel.build/modules/protobuf/21.7/MODULE.bazel": "a5a29bb89544f9b97edce05642fac225a808b5b7be74038ea3640fae2f8e66a7",
-    "https://bcr.bazel.build/modules/protobuf/27.0/MODULE.bazel": "7873b60be88844a0a1d8f80b9d5d20cfbd8495a689b8763e76c6372998d3f64c",
-    "https://bcr.bazel.build/modules/protobuf/29.0-rc2/MODULE.bazel": "6241d35983510143049943fc0d57937937122baf1b287862f9dc8590fc4c37df",
-    "https://bcr.bazel.build/modules/protobuf/29.0-rc3/MODULE.bazel": "33c2dfa286578573afc55a7acaea3cada4122b9631007c594bf0729f41c8de92",
-    "https://bcr.bazel.build/modules/protobuf/29.1/MODULE.bazel": "557c3457560ff49e122ed76c0bc3397a64af9574691cb8201b4e46d4ab2ecb95",
-    "https://bcr.bazel.build/modules/protobuf/3.19.0/MODULE.bazel": "6b5fbb433f760a99a22b18b6850ed5784ef0e9928a72668b66e4d7ccd47db9b0",
-    "https://bcr.bazel.build/modules/protobuf/32.1/MODULE.bazel": "89cd2866a9cb07fee9ff74c41ceace11554f32e0d849de4e23ac55515cfada4d",
-    "https://bcr.bazel.build/modules/protobuf/33.4/MODULE.bazel": "114775b816b38b6d0ca620450d6b02550c60ceedfdc8d9a229833b34a223dc42",
-    "https://bcr.bazel.build/modules/protobuf/33.4/source.json": "555f8686b4c7d6b5ba731fbea13bf656b4bfd9a7ff629c1d9d3f6e1d6155de79",
-    "https://bcr.bazel.build/modules/pybind11_bazel/2.11.1/MODULE.bazel": "88af1c246226d87e65be78ed49ecd1e6f5e98648558c14ce99176da041dc378e",
-    "https://bcr.bazel.build/modules/pybind11_bazel/2.12.0/MODULE.bazel": "e6f4c20442eaa7c90d7190d8dc539d0ab422f95c65a57cc59562170c58ae3d34",
-    "https://bcr.bazel.build/modules/pybind11_bazel/2.12.0/source.json": "6900fdc8a9e95866b8c0d4ad4aba4d4236317b5c1cd04c502df3f0d33afed680",
-    "https://bcr.bazel.build/modules/re2/2023-09-01/MODULE.bazel": "cb3d511531b16cfc78a225a9e2136007a48cf8a677e4264baeab57fe78a80206",
-    "https://bcr.bazel.build/modules/re2/2024-07-02.bcr.1/MODULE.bazel": "b4963dda9b31080be1905ef085ecd7dd6cd47c05c79b9cdf83ade83ab2ab271a",
-    "https://bcr.bazel.build/modules/re2/2024-07-02.bcr.1/source.json": "2ff292be6ef3340325ce8a045ecc326e92cbfab47c7cbab4bd85d28971b97ac4",
-    "https://bcr.bazel.build/modules/re2/2024-07-02/MODULE.bazel": "0eadc4395959969297cbcf31a249ff457f2f1d456228c67719480205aa306daa",
-    "https://bcr.bazel.build/modules/rules_android/0.1.1/MODULE.bazel": "48809ab0091b07ad0182defb787c4c5328bd3a278938415c00a7b69b50c4d3a8",
-    "https://bcr.bazel.build/modules/rules_android/0.1.1/source.json": "e6986b41626ee10bdc864937ffb6d6bf275bb5b9c65120e6137d56e6331f089e",
-    "https://bcr.bazel.build/modules/rules_apple/3.16.0/MODULE.bazel": "0d1caf0b8375942ce98ea944be754a18874041e4e0459401d925577624d3a54a",
-    "https://bcr.bazel.build/modules/rules_apple/4.1.0/MODULE.bazel": "76e10fd4a48038d3fc7c5dc6e63b7063bbf5304a2e3bd42edda6ec660eebea68",
-    "https://bcr.bazel.build/modules/rules_apple/4.1.0/source.json": "8ee81e1708756f81b343a5eb2b2f0b953f1d25c4ab3d4a68dc02754872e80715",
-    "https://bcr.bazel.build/modules/rules_cc/0.0.1/MODULE.bazel": "cb2aa0747f84c6c3a78dad4e2049c154f08ab9d166b1273835a8174940365647",
-    "https://bcr.bazel.build/modules/rules_cc/0.0.10/MODULE.bazel": "ec1705118f7eaedd6e118508d3d26deba2a4e76476ada7e0e3965211be012002",
-    "https://bcr.bazel.build/modules/rules_cc/0.0.13/MODULE.bazel": "0e8529ed7b323dad0775ff924d2ae5af7640b23553dfcd4d34344c7e7a867191",
-    "https://bcr.bazel.build/modules/rules_cc/0.0.15/MODULE.bazel": "6704c35f7b4a72502ee81f61bf88706b54f06b3cbe5558ac17e2e14666cd5dcc",
-    "https://bcr.bazel.build/modules/rules_cc/0.0.16/MODULE.bazel": "7661303b8fc1b4d7f532e54e9d6565771fea666fbdf839e0a86affcd02defe87",
-    "https://bcr.bazel.build/modules/rules_cc/0.0.17/MODULE.bazel": "2ae1d8f4238ec67d7185d8861cb0a2cdf4bc608697c331b95bf990e69b62e64a",
-    "https://bcr.bazel.build/modules/rules_cc/0.0.2/MODULE.bazel": "6915987c90970493ab97393024c156ea8fb9f3bea953b2f3ec05c34f19b5695c",
-    "https://bcr.bazel.build/modules/rules_cc/0.0.6/MODULE.bazel": "abf360251023dfe3efcef65ab9d56beefa8394d4176dd29529750e1c57eaa33f",
-    "https://bcr.bazel.build/modules/rules_cc/0.0.8/MODULE.bazel": "964c85c82cfeb6f3855e6a07054fdb159aced38e99a5eecf7bce9d53990afa3e",
-    "https://bcr.bazel.build/modules/rules_cc/0.0.9/MODULE.bazel": "836e76439f354b89afe6a911a7adf59a6b2518fafb174483ad78a2a2fde7b1c5",
-    "https://bcr.bazel.build/modules/rules_cc/0.1.1/MODULE.bazel": "2f0222a6f229f0bf44cd711dc13c858dad98c62d52bd51d8fc3a764a83125513",
-    "https://bcr.bazel.build/modules/rules_cc/0.1.2/MODULE.bazel": "557ddc3a96858ec0d465a87c0a931054d7dcfd6583af2c7ed3baf494407fd8d0",
-    "https://bcr.bazel.build/modules/rules_cc/0.1.5/MODULE.bazel": "88dfc9361e8b5ae1008ac38f7cdfd45ad738e4fa676a3ad67d19204f045a1fd8",
-    "https://bcr.bazel.build/modules/rules_cc/0.2.0/MODULE.bazel": "b5c17f90458caae90d2ccd114c81970062946f49f355610ed89bebf954f5783c",
-    "https://bcr.bazel.build/modules/rules_cc/0.2.13/MODULE.bazel": "eecdd666eda6be16a8d9dc15e44b5c75133405e820f620a234acc4b1fdc5aa37",
-    "https://bcr.bazel.build/modules/rules_cc/0.2.17/MODULE.bazel": "1849602c86cb60da8613d2de887f9566a6d354a6df6d7009f9d04a14402f9a84",
-    "https://bcr.bazel.build/modules/rules_cc/0.2.17/source.json": "3832f45d145354049137c0090df04629d9c2b5493dc5c2bf46f1834040133a07",
-    "https://bcr.bazel.build/modules/rules_cc/0.2.8/MODULE.bazel": "f1df20f0bf22c28192a794f29b501ee2018fa37a3862a1a2132ae2940a23a642",
-    "https://bcr.bazel.build/modules/rules_foreign_cc/0.9.0/MODULE.bazel": "c9e8c682bf75b0e7c704166d79b599f93b72cfca5ad7477df596947891feeef6",
-    "https://bcr.bazel.build/modules/rules_fuzzing/0.5.2/MODULE.bazel": "40c97d1144356f52905566c55811f13b299453a14ac7769dfba2ac38192337a8",
-    "https://bcr.bazel.build/modules/rules_java/4.0.0/MODULE.bazel": "5a78a7ae82cd1a33cef56dc578c7d2a46ed0dca12643ee45edbb8417899e6f74",
-    "https://bcr.bazel.build/modules/rules_java/5.3.5/MODULE.bazel": "a4ec4f2db570171e3e5eb753276ee4b389bae16b96207e9d3230895c99644b86",
-    "https://bcr.bazel.build/modules/rules_java/6.5.2/MODULE.bazel": "1d440d262d0e08453fa0c4d8f699ba81609ed0e9a9a0f02cd10b3e7942e61e31",
-    "https://bcr.bazel.build/modules/rules_java/7.10.0/MODULE.bazel": "530c3beb3067e870561739f1144329a21c851ff771cd752a49e06e3dc9c2e71a",
-    "https://bcr.bazel.build/modules/rules_java/7.12.2/MODULE.bazel": "579c505165ee757a4280ef83cda0150eea193eed3bef50b1004ba88b99da6de6",
-    "https://bcr.bazel.build/modules/rules_java/7.2.0/MODULE.bazel": "06c0334c9be61e6cef2c8c84a7800cef502063269a5af25ceb100b192453d4ab",
-    "https://bcr.bazel.build/modules/rules_java/7.6.1/MODULE.bazel": "2f14b7e8a1aa2f67ae92bc69d1ec0fa8d9f827c4e17ff5e5f02e91caa3b2d0fe",
-    "https://bcr.bazel.build/modules/rules_java/8.3.2/MODULE.bazel": "7336d5511ad5af0b8615fdc7477535a2e4e723a357b6713af439fe8cf0195017",
-    "https://bcr.bazel.build/modules/rules_java/8.5.1/MODULE.bazel": "d8a9e38cc5228881f7055a6079f6f7821a073df3744d441978e7a43e20226939",
-    "https://bcr.bazel.build/modules/rules_java/8.6.1/MODULE.bazel": "f4808e2ab5b0197f094cabce9f4b006a27766beb6a9975931da07099560ca9c2",
-    "https://bcr.bazel.build/modules/rules_java/9.1.0/MODULE.bazel": "ee63f27e36a3fada80342869361182f120a9819c74320e8e65b1e04ba0cd7a9d",
-    "https://bcr.bazel.build/modules/rules_java/9.1.0/source.json": "da589573c1dee2c9ac4a568b301269a2e8191110ff0345c1a959fa7ea6c4dfd6",
-    "https://bcr.bazel.build/modules/rules_jvm_external/4.4.2/MODULE.bazel": "a56b85e418c83eb1839819f0b515c431010160383306d13ec21959ac412d2fe7",
-    "https://bcr.bazel.build/modules/rules_jvm_external/5.1/MODULE.bazel": "33f6f999e03183f7d088c9be518a63467dfd0be94a11d0055fe2d210f89aa909",
-    "https://bcr.bazel.build/modules/rules_jvm_external/5.2/MODULE.bazel": "d9351ba35217ad0de03816ef3ed63f89d411349353077348a45348b096615036",
-    "https://bcr.bazel.build/modules/rules_jvm_external/6.3/MODULE.bazel": "c998e060b85f71e00de5ec552019347c8bca255062c990ac02d051bb80a38df0",
-    "https://bcr.bazel.build/modules/rules_jvm_external/6.7/MODULE.bazel": "e717beabc4d091ecb2c803c2d341b88590e9116b8bf7947915eeb33aab4f96dd",
-    "https://bcr.bazel.build/modules/rules_jvm_external/6.7/source.json": "5426f412d0a7fc6b611643376c7e4a82dec991491b9ce5cb1cfdd25fe2e92be4",
-    "https://bcr.bazel.build/modules/rules_kotlin/1.9.6/MODULE.bazel": "d269a01a18ee74d0335450b10f62c9ed81f2321d7958a2934e44272fe82dcef3",
-    "https://bcr.bazel.build/modules/rules_kotlin/1.9.6/source.json": "2faa4794364282db7c06600b7e5e34867a564ae91bda7cae7c29c64e9466b7d5",
-    "https://bcr.bazel.build/modules/rules_license/0.0.3/MODULE.bazel": "627e9ab0247f7d1e05736b59dbb1b6871373de5ad31c3011880b4133cafd4bd0",
-    "https://bcr.bazel.build/modules/rules_license/0.0.7/MODULE.bazel": "088fbeb0b6a419005b89cf93fe62d9517c0a2b8bb56af3244af65ecfe37e7d5d",
-    "https://bcr.bazel.build/modules/rules_license/1.0.0/MODULE.bazel": "a7fda60eefdf3d8c827262ba499957e4df06f659330bbe6cdbdb975b768bb65c",
-    "https://bcr.bazel.build/modules/rules_license/1.0.0/source.json": "a52c89e54cc311196e478f8382df91c15f7a2bfdf4c6cd0e2675cc2ff0b56efb",
-    "https://bcr.bazel.build/modules/rules_pkg/0.7.0/MODULE.bazel": "df99f03fc7934a4737122518bb87e667e62d780b610910f0447665a7e2be62dc",
-    "https://bcr.bazel.build/modules/rules_pkg/1.0.1/MODULE.bazel": "5b1df97dbc29623bccdf2b0dcd0f5cb08e2f2c9050aab1092fd39a41e82686ff",
-    "https://bcr.bazel.build/modules/rules_pkg/1.0.1/source.json": "bd82e5d7b9ce2d31e380dd9f50c111d678c3bdaca190cb76b0e1c71b05e1ba8a",
-    "https://bcr.bazel.build/modules/rules_proto/4.0.0/MODULE.bazel": "a7a7b6ce9bee418c1a760b3d84f83a299ad6952f9903c67f19e4edd964894e06",
-    "https://bcr.bazel.build/modules/rules_proto/5.3.0-21.7/MODULE.bazel": "e8dff86b0971688790ae75528fe1813f71809b5afd57facb44dad9e8eca631b7",
-    "https://bcr.bazel.build/modules/rules_proto/6.0.0-rc1/MODULE.bazel": "1e5b502e2e1a9e825eef74476a5a1ee524a92297085015a052510b09a1a09483",
-    "https://bcr.bazel.build/modules/rules_proto/6.0.2/MODULE.bazel": "ce916b775a62b90b61888052a416ccdda405212b6aaeb39522f7dc53431a5e73",
-    "https://bcr.bazel.build/modules/rules_proto/7.1.0/MODULE.bazel": "002d62d9108f75bb807cd56245d45648f38275cb3a99dcd45dfb864c5d74cb96",
-    "https://bcr.bazel.build/modules/rules_proto/7.1.0/source.json": "39f89066c12c24097854e8f57ab8558929f9c8d474d34b2c00ac04630ad8940e",
-    "https://bcr.bazel.build/modules/rules_python/0.10.2/MODULE.bazel": "cc82bc96f2997baa545ab3ce73f196d040ffb8756fd2d66125a530031cd90e5f",
-    "https://bcr.bazel.build/modules/rules_python/0.23.1/MODULE.bazel": "49ffccf0511cb8414de28321f5fcf2a31312b47c40cc21577144b7447f2bf300",
-    "https://bcr.bazel.build/modules/rules_python/0.25.0/MODULE.bazel": "72f1506841c920a1afec76975b35312410eea3aa7b63267436bfb1dd91d2d382",
-    "https://bcr.bazel.build/modules/rules_python/0.28.0/MODULE.bazel": "cba2573d870babc976664a912539b320cbaa7114cd3e8f053c720171cde331ed",
-    "https://bcr.bazel.build/modules/rules_python/0.31.0/MODULE.bazel": "93a43dc47ee570e6ec9f5779b2e64c1476a6ce921c48cc9a1678a91dd5f8fd58",
-    "https://bcr.bazel.build/modules/rules_python/0.33.2/MODULE.bazel": "3e036c4ad8d804a4dad897d333d8dce200d943df4827cb849840055be8d2e937",
-    "https://bcr.bazel.build/modules/rules_python/0.4.0/MODULE.bazel": "9208ee05fd48bf09ac60ed269791cf17fb343db56c8226a720fbb1cdf467166c",
-    "https://bcr.bazel.build/modules/rules_python/1.3.0/MODULE.bazel": "8361d57eafb67c09b75bf4bbe6be360e1b8f4f18118ab48037f2bd50aa2ccb13",
-    "https://bcr.bazel.build/modules/rules_python/1.4.1/MODULE.bazel": "8991ad45bdc25018301d6b7e1d3626afc3c8af8aaf4bc04f23d0b99c938b73a6",
-    "https://bcr.bazel.build/modules/rules_python/1.6.0/MODULE.bazel": "7e04ad8f8d5bea40451cf80b1bd8262552aa73f841415d20db96b7241bd027d8",
-    "https://bcr.bazel.build/modules/rules_python/1.7.0/MODULE.bazel": "d01f995ecd137abf30238ad9ce97f8fc3ac57289c8b24bd0bf53324d937a14f8",
-    "https://bcr.bazel.build/modules/rules_python/1.7.0/source.json": "028a084b65dcf8f4dc4f82f8778dbe65df133f234b316828a82e060d81bdce32",
-    "https://bcr.bazel.build/modules/rules_shell/0.2.0/MODULE.bazel": "fda8a652ab3c7d8fee214de05e7a9916d8b28082234e8d2c0094505c5268ed3c",
-    "https://bcr.bazel.build/modules/rules_shell/0.3.0/MODULE.bazel": "de4402cd12f4cc8fda2354fce179fdb068c0b9ca1ec2d2b17b3e21b24c1a937b",
-    "https://bcr.bazel.build/modules/rules_shell/0.6.1/MODULE.bazel": "72e76b0eea4e81611ef5452aa82b3da34caca0c8b7b5c0c9584338aa93bae26b",
-    "https://bcr.bazel.build/modules/rules_shell/0.6.1/source.json": "20ec05cd5e592055e214b2da8ccb283c7f2a421ea0dc2acbf1aa792e11c03d0c",
-    "https://bcr.bazel.build/modules/rules_swift/1.16.0/MODULE.bazel": "4a09f199545a60d09895e8281362b1ff3bb08bbde69c6fc87aff5b92fcc916ca",
-    "https://bcr.bazel.build/modules/rules_swift/2.1.1/MODULE.bazel": "494900a80f944fc7aa61500c2073d9729dff0b764f0e89b824eb746959bc1046",
-    "https://bcr.bazel.build/modules/rules_swift/2.4.0/MODULE.bazel": "1639617eb1ede28d774d967a738b4a68b0accb40650beadb57c21846beab5efd",
-    "https://bcr.bazel.build/modules/rules_swift/3.1.2/MODULE.bazel": "72c8f5cf9d26427cee6c76c8e3853eb46ce6b0412a081b2b6db6e8ad56267400",
-    "https://bcr.bazel.build/modules/rules_swift/3.1.2/source.json": "e85761f3098a6faf40b8187695e3de6d97944e98abd0d8ce579cb2daf6319a66",
-    "https://bcr.bazel.build/modules/stardoc/0.5.1/MODULE.bazel": "1a05d92974d0c122f5ccf09291442580317cdd859f07a8655f1db9a60374f9f8",
-    "https://bcr.bazel.build/modules/stardoc/0.5.3/MODULE.bazel": "c7f6948dae6999bf0db32c1858ae345f112cacf98f174c7a8bb707e41b974f1c",
-    "https://bcr.bazel.build/modules/stardoc/0.7.0/MODULE.bazel": "05e3d6d30c099b6770e97da986c53bd31844d7f13d41412480ea265ac9e8079c",
-    "https://bcr.bazel.build/modules/stardoc/0.7.2/MODULE.bazel": "fc152419aa2ea0f51c29583fab1e8c99ddefd5b3778421845606ee628629e0e5",
-    "https://bcr.bazel.build/modules/stardoc/0.7.2/source.json": "58b029e5e901d6802967754adf0a9056747e8176f017cfe3607c0851f4d42216",
-    "https://bcr.bazel.build/modules/swift_argument_parser/1.3.1.1/MODULE.bazel": "5e463fbfba7b1701d957555ed45097d7f984211330106ccd1352c6e0af0dcf91",
-    "https://bcr.bazel.build/modules/swift_argument_parser/1.3.1.2/MODULE.bazel": "75aab2373a4bbe2a1260b9bf2a1ebbdbf872d3bd36f80bff058dccd82e89422f",
-    "https://bcr.bazel.build/modules/swift_argument_parser/1.3.1.2/source.json": "5fba48bbe0ba48761f9e9f75f92876cafb5d07c0ce059cc7a8027416de94a05b",
-    "https://bcr.bazel.build/modules/upb/0.0.0-20220923-a547704/MODULE.bazel": "7298990c00040a0e2f121f6c32544bab27d4452f80d9ce51349b1a28f3005c43",
-    "https://bcr.bazel.build/modules/zlib/1.2.11/MODULE.bazel": "07b389abc85fdbca459b69e2ec656ae5622873af3f845e1c9d80fe179f3effa0",
-    "https://bcr.bazel.build/modules/zlib/1.3.1.bcr.5/MODULE.bazel": "eec517b5bbe5492629466e11dae908d043364302283de25581e3eb944326c4ca",
-    "https://bcr.bazel.build/modules/zlib/1.3.1.bcr.5/source.json": "22bc55c47af97246cfc093d0acf683a7869377de362b5d1c552c2c2e16b7a806",
-    "https://bcr.bazel.build/modules/zlib/1.3.1/MODULE.bazel": "751c9940dcfe869f5f7274e1295422a34623555916eb98c174c1e945594bf198"
-  },
-  "selectedYankedVersions": {},
-  "moduleExtensions": {
-    "@@rules_kotlin+//src/main/starlark/core/repositories:bzlmod_setup.bzl%rules_kotlin_extensions": {
-      "general": {
-        "bzlTransitiveDigest": "Ga4z8lQy1YQ5rAMy+dOl0dqcCEBnYNCXku8x3YQmDZI=",
-        "usagesDigest": "QI2z8ZUR+mqtbwsf2fLqYdJAkPOHdOV+tF2yVAUgRzw=",
-        "recordedInputs": [
-          "REPO_MAPPING:rules_kotlin+,bazel_tools bazel_tools"
-        ],
-        "generatedRepoSpecs": {
-          "com_github_jetbrains_kotlin_git": {
-            "repoRuleId": "@@rules_kotlin+//src/main/starlark/core/repositories:compiler.bzl%kotlin_compiler_git_repository",
-            "attributes": {
-              "urls": [
-                "https://github.com/JetBrains/kotlin/releases/download/v1.9.23/kotlin-compiler-1.9.23.zip"
-              ],
-              "sha256": "93137d3aab9afa9b27cb06a824c2324195c6b6f6179d8a8653f440f5bd58be88"
-            }
-          },
-          "com_github_jetbrains_kotlin": {
-            "repoRuleId": "@@rules_kotlin+//src/main/starlark/core/repositories:compiler.bzl%kotlin_capabilities_repository",
-            "attributes": {
-              "git_repository_name": "com_github_jetbrains_kotlin_git",
-              "compiler_version": "1.9.23"
-            }
-          },
-          "com_github_google_ksp": {
-            "repoRuleId": "@@rules_kotlin+//src/main/starlark/core/repositories:ksp.bzl%ksp_compiler_plugin_repository",
-            "attributes": {
-              "urls": [
-                "https://github.com/google/ksp/releases/download/1.9.23-1.0.20/artifacts.zip"
-              ],
-              "sha256": "ee0618755913ef7fd6511288a232e8fad24838b9af6ea73972a76e81053c8c2d",
-              "strip_version": "1.9.23-1.0.20"
-            }
-          },
-          "com_github_pinterest_ktlint": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_file",
-            "attributes": {
-              "sha256": "01b2e0ef893383a50dbeb13970fe7fa3be36ca3e83259e01649945b09d736985",
-              "urls": [
-                "https://github.com/pinterest/ktlint/releases/download/1.3.0/ktlint"
-              ],
-              "executable": true
-            }
-          },
-          "rules_android": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "sha256": "cd06d15dd8bb59926e4d65f9003bfc20f9da4b2519985c27e190cddc8b7a7806",
-              "strip_prefix": "rules_android-0.1.1",
-              "urls": [
-                "https://github.com/bazelbuild/rules_android/archive/v0.1.1.zip"
-              ]
-            }
-          }
-        }
-      }
-    },
-    "@@rules_python+//python/extensions:config.bzl%config": {
-      "general": {
-        "bzlTransitiveDigest": "iibnRYgg8LpcfmH7EAnVwYePC3jsVaJ6Id8XxUjSZps=",
-        "usagesDigest": "ZVSXMAGpD+xzVNPuvF1IoLBkty7TROO0+akMapt1pAg=",
-        "recordedInputs": [
-          "REPO_MAPPING:rules_python+,bazel_tools bazel_tools",
-          "REPO_MAPPING:rules_python+,pypi__build rules_python++config+pypi__build",
-          "REPO_MAPPING:rules_python+,pypi__click rules_python++config+pypi__click",
-          "REPO_MAPPING:rules_python+,pypi__colorama rules_python++config+pypi__colorama",
-          "REPO_MAPPING:rules_python+,pypi__importlib_metadata rules_python++config+pypi__importlib_metadata",
-          "REPO_MAPPING:rules_python+,pypi__installer rules_python++config+pypi__installer",
-          "REPO_MAPPING:rules_python+,pypi__more_itertools rules_python++config+pypi__more_itertools",
-          "REPO_MAPPING:rules_python+,pypi__packaging rules_python++config+pypi__packaging",
-          "REPO_MAPPING:rules_python+,pypi__pep517 rules_python++config+pypi__pep517",
-          "REPO_MAPPING:rules_python+,pypi__pip rules_python++config+pypi__pip",
-          "REPO_MAPPING:rules_python+,pypi__pip_tools rules_python++config+pypi__pip_tools",
-          "REPO_MAPPING:rules_python+,pypi__pyproject_hooks rules_python++config+pypi__pyproject_hooks",
-          "REPO_MAPPING:rules_python+,pypi__setuptools rules_python++config+pypi__setuptools",
-          "REPO_MAPPING:rules_python+,pypi__tomli rules_python++config+pypi__tomli",
-          "REPO_MAPPING:rules_python+,pypi__wheel rules_python++config+pypi__wheel",
-          "REPO_MAPPING:rules_python+,pypi__zipp rules_python++config+pypi__zipp"
-        ],
-        "generatedRepoSpecs": {
-          "rules_python_internal": {
-            "repoRuleId": "@@rules_python+//python/private:internal_config_repo.bzl%internal_config_repo",
-            "attributes": {
-              "transition_setting_generators": {},
-              "transition_settings": []
-            }
-          },
-          "pypi__build": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/e2/03/f3c8ba0a6b6e30d7d18c40faab90807c9bb5e9a1e3b2fe2008af624a9c97/build-1.2.1-py3-none-any.whl",
-              "sha256": "75e10f767a433d9a86e50d83f418e83efc18ede923ee5ff7df93b6cb0306c5d4",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__click": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/00/2e/d53fa4befbf2cfa713304affc7ca780ce4fc1fd8710527771b58311a3229/click-8.1.7-py3-none-any.whl",
-              "sha256": "ae74fb96c20a0277a1d615f1e4d73c8414f5a98db8b799a7931d1582f3390c28",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__colorama": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl",
-              "sha256": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__importlib_metadata": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/2d/0a/679461c511447ffaf176567d5c496d1de27cbe34a87df6677d7171b2fbd4/importlib_metadata-7.1.0-py3-none-any.whl",
-              "sha256": "30962b96c0c223483ed6cc7280e7f0199feb01a0e40cfae4d4450fc6fab1f570",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__installer": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/e5/ca/1172b6638d52f2d6caa2dd262ec4c811ba59eee96d54a7701930726bce18/installer-0.7.0-py3-none-any.whl",
-              "sha256": "05d1933f0a5ba7d8d6296bb6d5018e7c94fa473ceb10cf198a92ccea19c27b53",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__more_itertools": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/50/e2/8e10e465ee3987bb7c9ab69efb91d867d93959095f4807db102d07995d94/more_itertools-10.2.0-py3-none-any.whl",
-              "sha256": "686b06abe565edfab151cb8fd385a05651e1fdf8f0a14191e4439283421f8684",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__packaging": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/49/df/1fceb2f8900f8639e278b056416d49134fb8d84c5942ffaa01ad34782422/packaging-24.0-py3-none-any.whl",
-              "sha256": "2ddfb553fdf02fb784c234c7ba6ccc288296ceabec964ad2eae3777778130bc5",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__pep517": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/25/6e/ca4a5434eb0e502210f591b97537d322546e4833dcb4d470a48c375c5540/pep517-0.13.1-py3-none-any.whl",
-              "sha256": "31b206f67165b3536dd577c5c3f1518e8fbaf38cbc57efff8369a392feff1721",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__pip": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/8a/6a/19e9fe04fca059ccf770861c7d5721ab4c2aebc539889e97c7977528a53b/pip-24.0-py3-none-any.whl",
-              "sha256": "ba0d021a166865d2265246961bec0152ff124de910c5cc39f1156ce3fa7c69dc",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__pip_tools": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/0d/dc/38f4ce065e92c66f058ea7a368a9c5de4e702272b479c0992059f7693941/pip_tools-7.4.1-py3-none-any.whl",
-              "sha256": "4c690e5fbae2f21e87843e89c26191f0d9454f362d8acdbd695716493ec8b3a9",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__pyproject_hooks": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/ae/f3/431b9d5fe7d14af7a32340792ef43b8a714e7726f1d7b69cc4e8e7a3f1d7/pyproject_hooks-1.1.0-py3-none-any.whl",
-              "sha256": "7ceeefe9aec63a1064c18d939bdc3adf2d8aa1988a510afec15151578b232aa2",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__setuptools": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/90/99/158ad0609729111163fc1f674a5a42f2605371a4cf036d0441070e2f7455/setuptools-78.1.1-py3-none-any.whl",
-              "sha256": "c3a9c4211ff4c309edb8b8c4f1cbfa7ae324c4ba9f91ff254e3d305b9fd54561",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__tomli": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/97/75/10a9ebee3fd790d20926a90a2547f0bf78f371b2f13aa822c759680ca7b9/tomli-2.0.1-py3-none-any.whl",
-              "sha256": "939de3e7a6161af0c887ef91b7d41a53e7c5a1ca976325f429cb46ea9bc30ecc",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__wheel": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/7d/cd/d7460c9a869b16c3dd4e1e403cce337df165368c71d6af229a74699622ce/wheel-0.43.0-py3-none-any.whl",
-              "sha256": "55c570405f142630c6b9f72fe09d9b67cf1477fcf543ae5b8dcb1f5b7377da81",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__zipp": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/da/55/a03fd7240714916507e1fcf7ae355bd9d9ed2e6db492595f1a67f61681be/zipp-3.18.2-py3-none-any.whl",
-              "sha256": "dce197b859eb796242b0622af1b8beb0a722d52aa2f57133ead08edd5bf5374e",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          }
-        }
-      }
-    },
-    "@@rules_python+//python/uv:uv.bzl%uv": {
-      "general": {
-        "bzlTransitiveDigest": "ijW9KS7qsIY+yBVvJ+Nr1mzwQox09j13DnE3iIwaeTM=",
-        "usagesDigest": "H8dQoNZcoqP+Mu0tHZTi4KHATzvNkM5ePuEqoQdklIU=",
-        "recordedInputs": [
-          "REPO_MAPPING:rules_python+,bazel_tools bazel_tools",
-          "REPO_MAPPING:rules_python+,platforms platforms"
-        ],
-        "generatedRepoSpecs": {
-          "uv": {
-            "repoRuleId": "@@rules_python+//python/uv/private:uv_toolchains_repo.bzl%uv_toolchains_repo",
-            "attributes": {
-              "toolchain_type": "'@@rules_python+//python/uv:uv_toolchain_type'",
-              "toolchain_names": [
-                "none"
-              ],
-              "toolchain_implementations": {
-                "none": "'@@rules_python+//python:none'"
-              },
-              "toolchain_compatible_with": {
-                "none": [
-                  "@platforms//:incompatible"
-                ]
-              },
-              "toolchain_target_settings": {}
-            }
-          }
-        }
-      }
-    }
-  },
-  "facts": {}
-}
diff --git a/Makefile b/Makefile
index 1a0488c..18b4b27 100644
--- a/Makefile
+++ b/Makefile
@@ -1,63 +1,33 @@
-tun := $(shell ifconfig -l | sed 's/ /\n/g' | grep utun | tail -n 1)
-cargo_console := env RUST_BACKTRACE=1 RUST_LOG=debug RUSTFLAGS='--cfg tokio_unstable' cargo run --all-features --
-cargo_norm := env RUST_BACKTRACE=1 RUST_LOG=debug cargo run --
-sudo_cargo_console := sudo -E env RUST_BACKTRACE=1 RUST_LOG=debug RUSTFLAGS='--cfg tokio_unstable' cargo run --all-features --
-sudo_cargo_norm := sudo -E env RUST_BACKTRACE=1 RUST_LOG=debug cargo run --
+tun_num := $(shell ifconfig | awk -F 'utun|[: ]' '/utun[0-9]/ {print $$2}' | tail -n 1)
+cargo_console := RUST_BACKTRACE=1 RUST_LOG=debug RUSTFLAGS='--cfg tokio_unstable' cargo run --all-features
+cargo_norm := RUST_BACKTRACE=1 RUST_LOG=debug cargo run
 
 check:
 	@cargo check
 
 build:
-	@cargo build
-
-bep-check:
-	@python3 Scripts/check-bep-metadata.py
-
-bep-list:
-	@Scripts/bep list
+	@cargo run build
 
 daemon-console:
-	@$(sudo_cargo_console) daemon
+	@$(cargo_console) daemon
 
 daemon:
-	@$(sudo_cargo_norm) daemon
+	@$(cargo_norm) daemon
 
 start:
-	@$(sudo_cargo_norm) start
-
-stop:
-	@$(cargo_norm) stop
-
-status:
-	@$(cargo_norm) server-status
-
-tunnel-config:
-	@$(cargo_norm) tunnel-config
+	@$(cargo_norm) start
 
 test-dns:
 	@sudo route delete 8.8.8.8
-	@sudo route add 8.8.8.8 -interface $(tun)
+	@sudo route add 8.8.8.8 -interface utun$(tun_num)
 	@dig @8.8.8.8 hackclub.com
 
 test-https:
 	@sudo route delete 193.183.0.162
-	@sudo route add 193.183.0.162 -interface $(tun)
+	@sudo route add 193.183.0.162 -interface utun$(tun_num)
 	@curl -vv https://search.marginalia.nu
 
-v4_target := 146.190.62.39
 test-http:
-	@sudo route delete ${v4_target}
-	@sudo route add ${v4_target} -interface $(tun)
-	@curl -vv ${v4_target}:80
-
-test-ipv4:
-	@sudo route delete ${v4_target}
-	@sudo route add ${v4_target} -interface $(tun)
-	@ping ${v4_target}
-
-v6_target := 2001:4860:4860::8888
-test-ipv6:
-	@sudo route delete ${v6_target}
-	@sudo route -n add -inet6 ${v6_target} -interface $(tun)
-	@echo preparing
-	@sudo ping6 -v ${v6_target}
+	@sudo route delete 146.190.62.39
+	@sudo route add 146.190.62.39 -interface utun$(tun_num)
+	@curl -vv 146.190.62.39:80
diff --git a/README.md b/README.md
index ebb6709..7492039 100644
--- a/README.md
+++ b/README.md
@@ -1,32 +1,20 @@
 # Burrow
 
+![License](https://img.shields.io/github/license/hackclub/burrow) ![Apple Build Status](https://img.shields.io/github/actions/workflow/status/hackclub/burrow/build-apple.yml?branch=main&label=macos%2C%20ios&logo=Apple) ![Crate Build Status](https://img.shields.io/github/actions/workflow/status/hackclub/burrow/build-rust.yml?branch=main&label=crate&logo=Rust)
+
 Burrow is an open source tool for burrowing through firewalls, built by teenagers at [Hack Club](https://hackclub.com/).
 
 `burrow` provides a simple command-line tool to open virtual interfaces and direct traffic through them.
-Routine verification now runs unprivileged with `cargo test --workspace --all-features`; only tunnel startup needs elevation.
-The canonical source forge is [git.burrow.net/hackclub/burrow](https://git.burrow.net/hackclub/burrow).
-
-The repository now carries its own design and deployment record:
-
-- [Constitution](./CONSTITUTION.md)
-- [Agent Instructions](./AGENTS.md)
-- [Burrow Evolution](./evolution/README.md)
-- [WireGuard Rust Lineage](./docs/WIREGUARD_LINEAGE.md)
-- [Protocol Roadmap](./docs/PROTOCOL_ROADMAP.md)
-- [Forward Email Runbook](./docs/FORWARDEMAIL.md)
 
 ## Contributing
 
-Burrow is fully open source, you can fork the repo and start contributing easily. For more information and in-depth discussions, visit the `#burrow` channel on the [Hack Club Slack](https://hackclub.com/slack/), here you can ask for help and talk with other people interested in burrow. Checkout [GETTING_STARTED.md](./docs/GETTING_STARTED.md) for build instructions and [GTK_APP.md](./docs/GTK_APP.md) for the Linux app. Forge and deployment scaffolding live in [`flake.nix`](./flake.nix), [`nixos/`](./nixos), and [`.forgejo/workflows/`](./.forgejo/workflows/). Hosted mail backup operations live in [`docs/FORWARDEMAIL.md`](./docs/FORWARDEMAIL.md) and [`Tools/forwardemail-custom-s3.sh`](./Tools/forwardemail-custom-s3.sh). Platform service and distribution rollout notes live in [`docs/PLATFORM_SERVICES.md`](./docs/PLATFORM_SERVICES.md) and [`docs/DISTRIBUTION.md`](./docs/DISTRIBUTION.md).
-
-Agent and governance-sensitive work should start with [AGENTS.md](./AGENTS.md), [CONSTITUTION.md](./CONSTITUTION.md), and the relevant BEPs under [`evolution/proposals/`](./evolution/proposals/). Identity and bootstrap metadata now live in [`contributors.nix`](./contributors.nix).
+Burrow is fully open source, you can fork the repo and start contributing easily. For more information and in-depth discussions, visit the `#burrow` channel on the [Hack Club Slack](https://hackclub.com/slack/), here you can ask for help and talk with other people interested in burrow! For more information on how to contribute, please see [CONTRIBUTING.md]
 
 The project structure is divided in the following folders: 
 
 ```
 Apple/ # Xcode project for burrow on macOS and iOS
 burrow/ # Higher-level API library for tun and tun-async
-burrow-gtk/ # GTK project for burrow on Linux
 tun/ # Low-level interface to OS networking
     src/
         tokio/ # Async/Tokio code
@@ -48,4 +36,6 @@ Burrow is open source and licensed under the [GNU General Public License v3.0](.
 
 ## Contributors
 
-See the canonical forge history for current contributors.
+<a href="https://github.com/hackclub/burrow/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=hackclub/burrow" />
+</a>
diff --git a/Scripts/_burrow-flake.sh b/Scripts/_burrow-flake.sh
deleted file mode 100755
index 25fb6e1..0000000
--- a/Scripts/_burrow-flake.sh
+++ /dev/null
@@ -1,97 +0,0 @@
-#!/usr/bin/env bash
-
-burrow_require_cmd() {
-  if ! command -v "$1" >/dev/null 2>&1; then
-    echo "missing required command: $1" >&2
-    exit 1
-  fi
-}
-
-burrow_cleanup_flake_tmpdirs() {
-  if [[ "${#BURROW_FLAKE_TMPDIRS[@]}" -eq 0 ]]; then
-    return
-  fi
-  rm -rf "${BURROW_FLAKE_TMPDIRS[@]}"
-}
-
-burrow_prepare_flake_ref() {
-  local input="${1:-.}"
-
-  case "${input}" in
-    path:*|git+*|github:*|tarball+*|http://*|https://*)
-      printf '%s\n' "${input}"
-      return 0
-      ;;
-  esac
-
-  local resolved
-  resolved="$(cd "${input}" && pwd)"
-
-  local cache_root="${BURROW_FLAKE_CACHE_ROOT:-${HOME}/.cache/burrow}"
-  mkdir -p "${cache_root}"
-
-  local copy_root
-  copy_root="$(mktemp -d "${cache_root}/flake-XXXXXX")"
-  mkdir -p "${copy_root}/repo"
-
-  rsync -a \
-    --delete \
-    --exclude '.git' \
-    --exclude '.cache' \
-    --exclude '.derived-data' \
-    --exclude '.direnv' \
-    --exclude 'result' \
-    --exclude 'burrow.sock' \
-    --exclude 'node_modules' \
-    --exclude 'target' \
-    --exclude 'build' \
-    "${resolved}/" "${copy_root}/repo/"
-
-  BURROW_FLAKE_TMPDIRS+=("${copy_root}")
-  printf 'path:%s/repo\n' "${copy_root}"
-}
-
-burrow_resolve_image_artifact() {
-  local store_path="$1"
-
-  if [[ -f "${store_path}" ]]; then
-    printf '%s\n' "${store_path}"
-    return 0
-  fi
-
-  if [[ -d "${store_path}" ]]; then
-    local candidate
-    candidate="$(
-      find "${store_path}" -type f \
-        \( -name '*.raw' -o -name '*.raw.*' -o -name '*.img' -o -name '*.img.*' \) \
-        | sort \
-        | head -n1
-    )"
-    if [[ -n "${candidate}" ]]; then
-      printf '%s\n' "${candidate}"
-      return 0
-    fi
-  fi
-
-  echo "unable to locate disk image artifact under ${store_path}" >&2
-  exit 1
-}
-
-burrow_detect_compression() {
-  local artifact="$1"
-
-  case "${artifact}" in
-    *.bz2)
-      printf 'bz2\n'
-      ;;
-    *.xz)
-      printf 'xz\n'
-      ;;
-    *.zst|*.zstd)
-      printf 'zstd\n'
-      ;;
-    *)
-      printf '\n'
-      ;;
-  esac
-}
diff --git a/Scripts/apple/create-asc-certificate.mjs b/Scripts/apple/create-asc-certificate.mjs
deleted file mode 100755
index 9c530d9..0000000
--- a/Scripts/apple/create-asc-certificate.mjs
+++ /dev/null
@@ -1,164 +0,0 @@
-#!/usr/bin/env node
-import fs from "node:fs";
-import path from "node:path";
-import { webcrypto } from "node:crypto";
-
-const crypto = globalThis.crypto ?? webcrypto;
-
-function b64url(input) {
-  const buf = Buffer.isBuffer(input) ? input : Buffer.from(input);
-  return buf
-    .toString("base64")
-    .replace(/=/g, "")
-    .replace(/\+/g, "-")
-    .replace(/\//g, "_");
-}
-
-function parseArgs(argv) {
-  const out = { _: [] };
-  for (let i = 2; i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg === "--help" || arg === "-h") out.help = true;
-    else if (arg.startsWith("--")) {
-      const key = arg.slice(2);
-      const value = argv[i + 1];
-      if (!value || value.startsWith("--")) throw new Error(`missing value for --${key}`);
-      out[key] = value;
-      i++;
-    } else {
-      out._.push(arg);
-    }
-  }
-  return out;
-}
-
-async function makeJwt({ keyId, issuerId, keyPem }) {
-  const header = { alg: "ES256", kid: keyId, typ: "JWT" };
-  const now = Math.floor(Date.now() / 1000);
-  const payload = { iss: issuerId, exp: now + 20 * 60, aud: "appstoreconnect-v1" };
-  const input = `${b64url(JSON.stringify(header))}.${b64url(JSON.stringify(payload))}`;
-  const pkcs8Der = Buffer.from(
-    keyPem.replace(/-----BEGIN PRIVATE KEY-----|-----END PRIVATE KEY-----|\s+/g, ""),
-    "base64",
-  );
-  const key = await crypto.subtle.importKey(
-    "pkcs8",
-    pkcs8Der,
-    { name: "ECDSA", namedCurve: "P-256" },
-    false,
-    ["sign"],
-  );
-  const sig = await crypto.subtle.sign(
-    { name: "ECDSA", hash: "SHA-256" },
-    key,
-    new TextEncoder().encode(input),
-  );
-  return `${input}.${b64url(Buffer.from(sig))}`;
-}
-
-async function ascFetch(jwt, url, opts = {}) {
-  const res = await fetch(url, {
-    ...opts,
-    headers: {
-      ...(opts.headers ?? {}),
-      Authorization: `Bearer ${jwt}`,
-      "Content-Type": "application/json",
-    },
-  });
-  const text = await res.text();
-  let body;
-  try {
-    body = text ? JSON.parse(text) : {};
-  } catch {
-    body = { raw: text };
-  }
-  if (!res.ok) {
-    throw new Error(`ASC ${res.status} ${url}: ${JSON.stringify(body).slice(0, 2000)}`);
-  }
-  return body;
-}
-
-function certificateFileName(type, id) {
-  return `${type.toLowerCase().replace(/_/g, "-")}-${id}.cer`;
-}
-
-function csrContentForApi(csrFile) {
-  const bytes = fs.readFileSync(csrFile);
-  const text = bytes.toString("ascii");
-  const pemMatch = text.match(/-----BEGIN CERTIFICATE REQUEST-----([\s\S]+?)-----END CERTIFICATE REQUEST-----/);
-  if (pemMatch) {
-    return pemMatch[1].replace(/\s+/g, "");
-  }
-  return bytes.toString("base64");
-}
-
-async function main() {
-  const args = parseArgs(process.argv);
-  if (args.help) {
-    console.log("Usage: create-asc-certificate.mjs --key-id ID --issuer-id ID --key-file AuthKey.p8 --certificate-type IOS_DISTRIBUTION --csr-file file.csr --out-dir DIR");
-    process.exit(0);
-  }
-
-  const keyId = args["key-id"] ?? process.env.APP_STORE_CONNECT_KEY_ID;
-  const issuerId = args["issuer-id"] ?? process.env.APP_STORE_CONNECT_ISSUER_ID;
-  const keyFile = args["key-file"] ?? process.env.APP_STORE_CONNECT_KEY_FILE;
-  const certificateType = args["certificate-type"] ?? "IOS_DISTRIBUTION";
-  const csrFile = args["csr-file"];
-  const outDir = args["out-dir"] ?? ".";
-  const outFile = args["out-file"];
-  const metadataFile = args["metadata-file"];
-
-  if (!keyId || !issuerId || !keyFile || !csrFile) {
-    throw new Error("required: --key-id --issuer-id --key-file --csr-file");
-  }
-
-  const jwt = await makeJwt({
-    keyId,
-    issuerId,
-    keyPem: fs.readFileSync(keyFile, "utf8"),
-  });
-  const csrContent = csrContentForApi(csrFile);
-  const created = await ascFetch(jwt, "https://api.appstoreconnect.apple.com/v1/certificates", {
-    method: "POST",
-    body: JSON.stringify({
-      data: {
-        type: "certificates",
-        attributes: {
-          certificateType,
-          csrContent,
-        },
-      },
-    }),
-  });
-
-  const cert = created?.data;
-  const id = cert?.id;
-  const content = cert?.attributes?.certificateContent;
-  if (!id || !content) {
-    throw new Error(`ASC response did not include certificate id/content: ${JSON.stringify(created).slice(0, 2000)}`);
-  }
-
-  fs.mkdirSync(outDir, { recursive: true });
-  const certificatePath = outFile ?? path.join(outDir, certificateFileName(certificateType, id));
-  fs.writeFileSync(certificatePath, Buffer.from(content, "base64"));
-
-  const metadata = {
-    id,
-    certificateType: cert?.attributes?.certificateType ?? certificateType,
-    displayName: cert?.attributes?.displayName,
-    name: cert?.attributes?.name,
-    platform: cert?.attributes?.platform,
-    expirationDate: cert?.attributes?.expirationDate,
-    serialNumber: cert?.attributes?.serialNumber,
-    certificatePath,
-  };
-  if (metadataFile) {
-    fs.writeFileSync(metadataFile, `${JSON.stringify(metadata, null, 2)}\n`);
-  }
-  process.stdout.write(`${JSON.stringify(metadata, null, 2)}\n`);
-}
-
-main().catch((err) => {
-  console.error(err?.stack || String(err));
-  process.exit(1);
-});
diff --git a/Scripts/apple/google-kms-csr.py b/Scripts/apple/google-kms-csr.py
deleted file mode 100755
index 15a7d89..0000000
--- a/Scripts/apple/google-kms-csr.py
+++ /dev/null
@@ -1,249 +0,0 @@
-#!/usr/bin/env python3
-"""Build an Apple-compatible PKCS#10 CSR backed by Google Cloud KMS.
-
-The script intentionally implements only the RSA/SHA-256 subset Burrow needs for
-Apple Developer ID and iOS Distribution certificate requests. It fetches the KMS
-public key, builds CertificationRequestInfo locally, asks KMS to sign that DER
-payload, and writes a standard PEM CSR.
-"""
-
-from __future__ import annotations
-
-import argparse
-import base64
-import os
-import subprocess
-import sys
-import tempfile
-from pathlib import Path
-
-
-DEFAULT_PROJECT = "project-88c23ce9-918a-470a-b33"
-DEFAULT_LOCATION = "global"
-DEFAULT_KEYRING = "burrow-identity"
-DEFAULT_KEY = "apple-developer-id-application"
-DEFAULT_VERSION = "1"
-DEFAULT_COMMON_NAME = "Burrow Developer ID Application"
-DEFAULT_EMAIL = "release@burrow.net"
-
-
-def der_length(length: int) -> bytes:
-    if length < 0:
-        raise ValueError("negative DER length")
-    if length < 0x80:
-        return bytes([length])
-    encoded = length.to_bytes((length.bit_length() + 7) // 8, "big")
-    return bytes([0x80 | len(encoded)]) + encoded
-
-
-def der(tag: int, body: bytes) -> bytes:
-    return bytes([tag]) + der_length(len(body)) + body
-
-
-def der_sequence(*items: bytes) -> bytes:
-    return der(0x30, b"".join(items))
-
-
-def der_set(*items: bytes) -> bytes:
-    return der(0x31, b"".join(items))
-
-
-def der_integer(value: int) -> bytes:
-    if value < 0:
-        raise ValueError("negative INTEGER is not supported")
-    raw = value.to_bytes(max(1, (value.bit_length() + 7) // 8), "big")
-    if raw[0] & 0x80:
-        raw = b"\x00" + raw
-    return der(0x02, raw)
-
-
-def der_null() -> bytes:
-    return der(0x05, b"")
-
-
-def der_bit_string(value: bytes) -> bytes:
-    return der(0x03, b"\x00" + value)
-
-
-def der_utf8(value: str) -> bytes:
-    return der(0x0C, value.encode("utf-8"))
-
-
-def der_printable(value: str) -> bytes:
-    return der(0x13, value.encode("ascii"))
-
-
-def der_ia5(value: str) -> bytes:
-    return der(0x16, value.encode("ascii"))
-
-
-def der_oid(dotted: str) -> bytes:
-    parts = [int(part) for part in dotted.split(".")]
-    if len(parts) < 2 or parts[0] > 2 or parts[1] > 39:
-        raise ValueError(f"unsupported OID: {dotted}")
-    body = bytes([40 * parts[0] + parts[1]])
-    for value in parts[2:]:
-        if value < 0:
-            raise ValueError(f"negative OID component: {dotted}")
-        encoded = [value & 0x7F]
-        value >>= 7
-        while value:
-            encoded.append(0x80 | (value & 0x7F))
-            value >>= 7
-        body += bytes(reversed(encoded))
-    return der(0x06, body)
-
-
-def name_attribute(oid: str, value_der: bytes) -> bytes:
-    return der_set(der_sequence(der_oid(oid), value_der))
-
-
-def subject_name(common_name: str, email_address: str, country: str | None) -> bytes:
-    attrs: list[bytes] = []
-    if country:
-        if len(country) != 2 or not country.isalpha():
-            raise ValueError("--country must be a two-letter ISO country code")
-        attrs.append(name_attribute("2.5.4.6", der_printable(country.upper())))
-    if email_address:
-        attrs.append(name_attribute("1.2.840.113549.1.9.1", der_ia5(email_address)))
-    attrs.append(name_attribute("2.5.4.3", der_utf8(common_name)))
-    return der_sequence(*attrs)
-
-
-def pem_to_der(pem: bytes) -> bytes:
-    lines = [
-        line.strip()
-        for line in pem.splitlines()
-        if line and not line.startswith(b"-----")
-    ]
-    if not lines:
-        raise ValueError("PEM input did not contain base64 data")
-    return base64.b64decode(b"".join(lines), validate=True)
-
-
-def pem_wrap(label: str, body: bytes) -> str:
-    encoded = base64.b64encode(body).decode("ascii")
-    lines = [f"-----BEGIN {label}-----"]
-    lines.extend(encoded[i : i + 64] for i in range(0, len(encoded), 64))
-    lines.append(f"-----END {label}-----")
-    return "\n".join(lines) + "\n"
-
-
-def run(command: list[str]) -> None:
-    subprocess.run(command, check=True)
-
-
-def fetch_public_key(args: argparse.Namespace, output: Path) -> None:
-    command = [
-        args.gcloud,
-        "kms",
-        "keys",
-        "versions",
-        "get-public-key",
-        args.kms_version,
-        "--location",
-        args.kms_location,
-        "--keyring",
-        args.kms_keyring,
-        "--key",
-        args.kms_key,
-        "--output-file",
-        str(output),
-    ]
-    if args.gcloud_project:
-        command.extend(["--project", args.gcloud_project])
-    run(command)
-
-
-def kms_sign(args: argparse.Namespace, payload: bytes) -> bytes:
-    with tempfile.TemporaryDirectory(prefix="burrow-kms-csr.") as tmp:
-        payload_path = Path(tmp) / "certification-request-info.der"
-        signature_path = Path(tmp) / "signature.b64"
-        payload_path.write_bytes(payload)
-        command = [
-            args.gcloud,
-            "kms",
-            "asymmetric-sign",
-            "--location",
-            args.kms_location,
-            "--keyring",
-            args.kms_keyring,
-            "--key",
-            args.kms_key,
-            "--version",
-            args.kms_version,
-            "--digest-algorithm",
-            "sha256",
-            "--input-file",
-            str(payload_path),
-            "--signature-file",
-            str(signature_path),
-        ]
-        if args.gcloud_project:
-            command.extend(["--project", args.gcloud_project])
-        run(command)
-        signature = signature_path.read_bytes()
-        try:
-            return base64.b64decode(signature.strip(), validate=True)
-        except ValueError:
-            return signature
-
-
-def build_csr(args: argparse.Namespace, spki_der: bytes) -> bytes:
-    cri = der_sequence(
-        der_integer(0),
-        subject_name(args.common_name, args.email_address, args.country),
-        spki_der,
-        b"\xA0\x00",
-    )
-    signature = kms_sign(args, cri)
-    signature_algorithm = der_sequence(
-        der_oid("1.2.840.113549.1.1.11"),
-        der_null(),
-    )
-    return der_sequence(cri, signature_algorithm, der_bit_string(signature))
-
-
-def parse_args(argv: list[str]) -> argparse.Namespace:
-    parser = argparse.ArgumentParser(
-        description="Generate an Apple-compatible CSR backed by a Google Cloud KMS RSA signing key.",
-    )
-    parser.add_argument("--gcloud-project", default=os.environ.get("GOOGLE_CLOUD_PROJECT") or os.environ.get("BURROW_GOOGLE_PROJECT_ID") or DEFAULT_PROJECT)
-    parser.add_argument("--kms-location", default=os.environ.get("BURROW_KMS_LOCATION", DEFAULT_LOCATION))
-    parser.add_argument("--kms-keyring", default=os.environ.get("BURROW_KMS_KEYRING", DEFAULT_KEYRING))
-    parser.add_argument("--kms-key", default=os.environ.get("BURROW_APPLE_KMS_KEY") or os.environ.get("BURROW_APPLE_DEVELOPER_ID_KMS_KEY", DEFAULT_KEY))
-    parser.add_argument("--kms-version", default=os.environ.get("BURROW_KMS_VERSION", DEFAULT_VERSION))
-    parser.add_argument("--common-name", default=os.environ.get("BURROW_APPLE_CSR_COMMON_NAME") or os.environ.get("BURROW_APPLE_DEVELOPER_ID_CSR_COMMON_NAME", DEFAULT_COMMON_NAME))
-    parser.add_argument("--email-address", default=os.environ.get("BURROW_APPLE_CSR_EMAIL") or os.environ.get("BURROW_APPLE_DEVELOPER_ID_CSR_EMAIL", DEFAULT_EMAIL))
-    parser.add_argument("--country", default=os.environ.get("BURROW_APPLE_CSR_COUNTRY") or os.environ.get("BURROW_APPLE_DEVELOPER_ID_CSR_COUNTRY", "US"))
-    parser.add_argument("--public-key-pem", help="Existing KMS public-key PEM path. If omitted, gcloud fetches it.")
-    parser.add_argument("--public-key-output", help="Write the fetched/used public key PEM to this path.")
-    parser.add_argument("--output", default="developer-id-application.certSigningRequest")
-    parser.add_argument("--gcloud", default=os.environ.get("GCLOUD", "gcloud"))
-    return parser.parse_args(argv)
-
-
-def main(argv: list[str]) -> int:
-    args = parse_args(argv)
-    output = Path(args.output)
-
-    with tempfile.TemporaryDirectory(prefix="burrow-kms-csr.") as tmp:
-        public_key_path = Path(args.public_key_pem) if args.public_key_pem else Path(tmp) / "kms-public.pem"
-        if not args.public_key_pem:
-            fetch_public_key(args, public_key_path)
-        public_key_pem = public_key_path.read_bytes()
-        spki_der = pem_to_der(public_key_pem)
-        csr = build_csr(args, spki_der)
-
-    output.parent.mkdir(parents=True, exist_ok=True)
-    output.write_text(pem_wrap("CERTIFICATE REQUEST", csr), encoding="ascii")
-    if args.public_key_output:
-        public_output = Path(args.public_key_output)
-        public_output.parent.mkdir(parents=True, exist_ok=True)
-        public_output.write_bytes(public_key_pem)
-    print(f"wrote {output}")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main(sys.argv[1:]))
diff --git a/Scripts/apple/profile-entitlements.py b/Scripts/apple/profile-entitlements.py
deleted file mode 100755
index 26bd10d..0000000
--- a/Scripts/apple/profile-entitlements.py
+++ /dev/null
@@ -1,120 +0,0 @@
-#!/usr/bin/env python3
-"""Extract signing entitlements from an Apple provisioning profile."""
-
-from __future__ import annotations
-
-import argparse
-import plistlib
-import subprocess
-import sys
-from pathlib import Path
-
-PROFILE_REQUIRED_KEYS = {
-    "application-identifier",
-    "beta-reports-active",
-    "com.apple.developer.team-identifier",
-    "com.apple.developer.default-data-protection",
-    "keychain-access-groups",
-}
-
-
-def decode_profile(path: Path) -> dict:
-    commands = [
-        ["security", "cms", "-D", "-i", str(path)],
-        ["openssl", "smime", "-inform", "DER", "-verify", "-noverify", "-in", str(path)],
-        ["openssl", "cms", "-inform", "DER", "-verify", "-noverify", "-in", str(path)],
-    ]
-    errors: list[str] = []
-    for command in commands:
-        try:
-            proc = subprocess.run(
-                command,
-                check=False,
-                stdout=subprocess.PIPE,
-                stderr=subprocess.PIPE,
-            )
-        except FileNotFoundError:
-            continue
-        if proc.returncode == 0 and proc.stdout:
-            return plistlib.loads(proc.stdout)
-        errors.append(f"{command[0]} exited {proc.returncode}: {proc.stderr.decode(errors='replace').strip()}")
-    raise RuntimeError(f"unable to decode provisioning profile {path}: {'; '.join(errors)}")
-
-
-def load_entitlements_template(path: Path) -> dict:
-    value = plistlib.loads(path.read_bytes())
-    if not isinstance(value, dict):
-        raise RuntimeError(f"entitlements template is not a dictionary: {path}")
-    return value
-
-
-def _has_build_setting(value: object) -> bool:
-    if isinstance(value, str):
-        return "$(" in value
-    if isinstance(value, list):
-        return any(_has_build_setting(item) for item in value)
-    if isinstance(value, dict):
-        return any(_has_build_setting(item) for item in value.values())
-    return False
-
-
-def _filter_list(template_value: list, profile_value: object) -> list:
-    if not isinstance(profile_value, list):
-        return template_value
-    profile_set = set(profile_value)
-    filtered = [item for item in template_value if item in profile_set]
-    return filtered
-
-
-def filter_entitlements(profile_entitlements: dict, template_entitlements: dict) -> dict:
-    filtered = {
-        key: profile_entitlements[key]
-        for key in PROFILE_REQUIRED_KEYS
-        if key in profile_entitlements
-    }
-
-    for key, template_value in template_entitlements.items():
-        if key not in profile_entitlements:
-            print(
-                f"warning: entitlement {key} requested by template but absent from provisioning profile; omitting",
-                file=sys.stderr,
-            )
-            continue
-
-        profile_value = profile_entitlements[key]
-        if _has_build_setting(template_value):
-            filtered[key] = profile_value
-        elif isinstance(template_value, list):
-            filtered[key] = _filter_list(template_value, profile_value)
-        else:
-            filtered[key] = template_value
-
-    return dict(sorted(filtered.items()))
-
-
-def main(argv: list[str]) -> int:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("profile", type=Path)
-    parser.add_argument("--output", "-o", type=Path, required=True)
-    parser.add_argument(
-        "--template",
-        type=Path,
-        help="Optional entitlements template used to filter profile entitlements for a target.",
-    )
-    args = parser.parse_args(argv)
-
-    profile = decode_profile(args.profile)
-    entitlements = profile.get("Entitlements")
-    if not isinstance(entitlements, dict):
-        raise RuntimeError(f"profile has no Entitlements dictionary: {args.profile}")
-
-    if args.template:
-        entitlements = filter_entitlements(entitlements, load_entitlements_template(args.template))
-
-    args.output.parent.mkdir(parents=True, exist_ok=True)
-    args.output.write_bytes(plistlib.dumps(entitlements, fmt=plistlib.FMT_XML))
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main(sys.argv[1:]))
diff --git a/Scripts/apple/sign-release-artifacts-kms.sh b/Scripts/apple/sign-release-artifacts-kms.sh
deleted file mode 100755
index 526c6d6..0000000
--- a/Scripts/apple/sign-release-artifacts-kms.sh
+++ /dev/null
@@ -1,263 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "$repo_root"
-
-platform="${1:-all}"
-build_number="${BUILD_NUMBER:-${RELEASE_BUILD_NUMBER:-${RELEASE_REF:-manual}}}"
-out_root="${BURROW_RELEASE_OUT:-${repo_root}/dist/builds/${build_number}}"
-apple_root="${out_root}/apple"
-bundle_id="${BURROW_APPLE_BUNDLE_ID:-net.burrow.app}"
-network_extension_bundle_id="${BURROW_APPLE_NETWORK_EXTENSION_BUNDLE_ID:-${bundle_id}.network}"
-notarize_macos="${BURROW_NOTARIZE_MACOS:-false}"
-sparkle_sign_with_kms="${BURROW_SPARKLE_SIGN_WITH_KMS:-true}"
-
-truthy() {
-  case "${1:-}" in
-    1|true|TRUE|True|yes|YES|Yes|y|Y|on|ON|On) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-sha256_file() {
-  local file="$1"
-  if command -v shasum >/dev/null 2>&1; then
-    shasum -a 256 "$file" > "${file}.sha256"
-  else
-    sha256sum "$file" > "${file}.sha256"
-  fi
-}
-
-safe_profile_slug() {
-  python3 - "$1" <<'PY'
-import re
-import sys
-
-print(re.sub(r"[^A-Za-z0-9]", "", sys.argv[1]).lower())
-PY
-}
-
-profile_for() {
-  local identifier="$1"
-  local suffix="$2"
-  local slug path
-  slug="$(safe_profile_slug "$identifier")"
-  for path in \
-    ".forgejo/actions/export/${slug}${suffix}.provisionprofile" \
-    ".forgejo/actions/export/${slug}${suffix}.mobileprovision" \
-    "Apple/Profiles/${slug}${suffix}.provisionprofile" \
-    "Apple/Profiles/${slug}${suffix}.mobileprovision"; do
-    if [[ -s "$path" ]]; then
-      printf '%s\n' "$path"
-      return 0
-    fi
-  done
-  return 1
-}
-
-require_tool() {
-  if ! command -v "$1" >/dev/null 2>&1; then
-    echo "error: missing required tool: $1" >&2
-    exit 1
-  fi
-}
-
-extract_profile_entitlements() {
-  local profile="$1"
-  local output="$2"
-  local template="${3:-}"
-  local args=("$profile" --output "$output")
-  if [[ -n "$template" ]]; then
-    args+=(--template "$template")
-  fi
-  Scripts/apple/profile-entitlements.py "${args[@]}"
-}
-
-sign_bundle() {
-  local family="$1"
-  local bundle_path="$2"
-  local entitlements="$3"
-  local runtime_flag=()
-  if [[ "$family" == "developer-id" ]]; then
-    runtime_flag=(--runtime)
-  fi
-  Scripts/apple/sign-with-google-kms.sh \
-    --family "$family" \
-    --path "$bundle_path" \
-    --entitlements "$entitlements" \
-    "${runtime_flag[@]}"
-}
-
-write_notary_api_key_json() {
-  local out="$1"
-  if [[ -z "${ASC_API_KEY_ID:-}" || -z "${ASC_API_ISSUER_ID:-}" || -z "${ASC_API_KEY_PATH:-}" ]]; then
-    echo "macOS notarization requires ASC_API_KEY_ID, ASC_API_ISSUER_ID, and ASC_API_KEY_PATH" >&2
-    exit 1
-  fi
-  rcodesign encode-app-store-connect-api-key \
-    --output-path "$out" \
-    "$ASC_API_ISSUER_ID" \
-    "$ASC_API_KEY_ID" \
-    "$ASC_API_KEY_PATH"
-}
-
-sign_ios() {
-  local unsigned_ipa app_profile ext_profile work_dir app ext app_entitlements ext_entitlements output_ipa
-  unsigned_ipa="${apple_root}/Burrow-iOS-${build_number}.unsigned.ipa"
-  if [[ ! -s "$unsigned_ipa" ]]; then
-    echo "error: missing staged unsigned iOS IPA: $unsigned_ipa" >&2
-    exit 1
-  fi
-
-  app_profile="$(profile_for "$bundle_id" "appstore")" || {
-    echo "error: missing iOS App Store provisioning profile for ${bundle_id}" >&2
-    exit 1
-  }
-  ext_profile="$(profile_for "$network_extension_bundle_id" "appstore")" || {
-    echo "error: missing iOS App Store provisioning profile for ${network_extension_bundle_id}" >&2
-    exit 1
-  }
-
-  work_dir="$(mktemp -d "${TMPDIR:-/tmp}/burrow-ios-kms-sign.XXXXXX")"
-  trap 'rm -rf "${work_dir:-}"' RETURN
-  unzip -q "$unsigned_ipa" -d "$work_dir"
-  app="${work_dir}/Payload/Burrow.app"
-  ext="${app}/PlugIns/BurrowNetworkExtension.appex"
-  if [[ ! -d "$app" || ! -d "$ext" ]]; then
-    echo "error: unsigned IPA is missing Burrow.app or BurrowNetworkExtension.appex" >&2
-    exit 1
-  fi
-
-  cp "$app_profile" "${app}/embedded.mobileprovision"
-  cp "$ext_profile" "${ext}/embedded.mobileprovision"
-  app_entitlements="${work_dir}/app-entitlements.plist"
-  ext_entitlements="${work_dir}/extension-entitlements.plist"
-  extract_profile_entitlements "$app_profile" "$app_entitlements" Apple/App/App-iOS.entitlements
-  extract_profile_entitlements "$ext_profile" "$ext_entitlements" Apple/NetworkExtension/NetworkExtension-iOS.entitlements
-
-  rm -rf "${app}/_CodeSignature" "${ext}/_CodeSignature"
-  sign_bundle ios "$ext" "$ext_entitlements"
-  sign_bundle ios "$app" "$app_entitlements"
-
-  output_ipa="${apple_root}/Burrow-iOS-${build_number}.ipa"
-  rm -f "$output_ipa"
-  (cd "$work_dir" && zip -qry "$output_ipa" Payload)
-  sha256_file "$output_ipa"
-}
-
-write_sparkle_appcast() {
-  local artifact="$1"
-  local channel sparkle_dir length pubdate url
-  channel="${SPARKLE_CHANNEL:-build-${build_number}}"
-  sparkle_dir="${out_root}/sparkle/${channel}"
-  mkdir -p "$sparkle_dir"
-  cp "$artifact" "$sparkle_dir/"
-  length="$(wc -c < "$artifact" | tr -d ' ')"
-  pubdate="$(LC_ALL=C date -u '+%a, %d %b %Y %H:%M:%S +0000')"
-  url="${SPARKLE_DOWNLOAD_PREFIX:-https://releases.burrow.net/sparkle}/${channel}/$(basename "$artifact")"
-  cat > "${sparkle_dir}/appcast.xml" <<EOF
-<?xml version="1.0" encoding="utf-8"?>
-<rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle">
-  <channel>
-    <title>Burrow ${channel}</title>
-    <item>
-      <title>Burrow ${build_number}</title>
-      <pubDate>${pubdate}</pubDate>
-      <sparkle:version>${build_number}</sparkle:version>
-      <sparkle:shortVersionString>0.1</sparkle:shortVersionString>
-      <enclosure url="${url}" sparkle:version="${build_number}" length="${length}" type="application/octet-stream" />
-    </item>
-  </channel>
-</rss>
-EOF
-  if truthy "$sparkle_sign_with_kms"; then
-    Scripts/sparkle/sign-appcast-kms.py \
-      --appcast "${sparkle_dir}/appcast.xml" \
-      --artifact-dir "$sparkle_dir"
-  fi
-}
-
-sign_macos() {
-  local unsigned_zip app_profile ext_profile work_dir app ext app_entitlements ext_entitlements output_zip notary_zip key_json
-  unsigned_zip="${apple_root}/Burrow-macOS-${build_number}.unsigned.zip"
-  if [[ ! -s "$unsigned_zip" ]]; then
-    echo "error: missing staged unsigned macOS ZIP: $unsigned_zip" >&2
-    exit 1
-  fi
-
-  app_profile="$(profile_for "$bundle_id" "developerid")" || {
-    echo "error: missing macOS Developer ID provisioning profile for ${bundle_id}" >&2
-    exit 1
-  }
-  ext_profile="$(profile_for "$network_extension_bundle_id" "developerid")" || {
-    echo "error: missing macOS Developer ID provisioning profile for ${network_extension_bundle_id}" >&2
-    exit 1
-  }
-
-  work_dir="$(mktemp -d "${TMPDIR:-/tmp}/burrow-macos-kms-sign.XXXXXX")"
-  trap 'rm -rf "${work_dir:-}"' RETURN
-  unzip -q "$unsigned_zip" -d "$work_dir"
-  app="$(find "$work_dir" -maxdepth 2 -type d -name 'Burrow.app' -print | head -n 1)"
-  if [[ -z "$app" || ! -d "$app" ]]; then
-    echo "error: unsigned macOS ZIP does not contain Burrow.app" >&2
-    exit 1
-  fi
-
-  ext="${app}/Contents/PlugIns/BurrowNetworkExtension.appex"
-  cp "$app_profile" "${app}/Contents/embedded.provisionprofile"
-  app_entitlements="${work_dir}/app-entitlements.plist"
-  extract_profile_entitlements "$app_profile" "$app_entitlements"
-
-  if [[ -d "$ext" ]]; then
-    cp "$ext_profile" "${ext}/Contents/embedded.provisionprofile"
-    ext_entitlements="${work_dir}/extension-entitlements.plist"
-    extract_profile_entitlements "$ext_profile" "$ext_entitlements"
-    rm -rf "${ext}/Contents/_CodeSignature"
-    sign_bundle developer-id "$ext" "$ext_entitlements"
-  fi
-
-  rm -rf "${app}/Contents/_CodeSignature"
-  sign_bundle developer-id "$app" "$app_entitlements"
-
-  if truthy "$notarize_macos"; then
-    key_json="${work_dir}/notary-api-key.json"
-    notary_zip="${work_dir}/Burrow.notary.zip"
-    write_notary_api_key_json "$key_json"
-    (cd "$(dirname "$app")" && zip -qry "$notary_zip" "$(basename "$app")")
-    rcodesign notary-submit --api-key-file "$key_json" --wait "$notary_zip"
-    rcodesign staple "$app"
-  fi
-
-  output_zip="${apple_root}/Burrow-macOS-${build_number}.zip"
-  rm -f "$output_zip"
-  (cd "$(dirname "$app")" && zip -qry "$output_zip" "$(basename "$app")")
-  sha256_file "$output_zip"
-  write_sparkle_appcast "$output_zip"
-}
-
-require_tool python3
-require_tool unzip
-require_tool zip
-require_tool rcodesign
-require_tool gcloud
-mkdir -p "$apple_root"
-
-case "$platform" in
-  all)
-    sign_ios
-    sign_macos
-    ;;
-  ios)
-    sign_ios
-    ;;
-  macos)
-    sign_macos
-    ;;
-  *)
-    echo "unknown Apple KMS signing platform: $platform" >&2
-    exit 64
-    ;;
-esac
-
-find "$out_root" -type f -print | sort
diff --git a/Scripts/apple/sign-with-google-kms.sh b/Scripts/apple/sign-with-google-kms.sh
deleted file mode 100755
index 33d5c7e..0000000
--- a/Scripts/apple/sign-with-google-kms.sh
+++ /dev/null
@@ -1,263 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "$repo_root"
-
-family=""
-path=""
-entitlements=""
-certificate=""
-kms_key=""
-kms_version=""
-runtime=false
-timestamp_url=""
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/apple/sign-with-google-kms.sh --family ios|developer-id --path <bundle-or-dmg> [options]
-
-Options:
-  --entitlements <plist>    XML entitlements for bundle signing
-  --certificate <cer>       Apple public certificate matching the KMS key
-  --kms-key <name>          Google KMS crypto key name/resource
-  --kms-version <version>   Google KMS crypto key version
-  --runtime                 Set hardened-runtime code-signature flags
-EOF
-}
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --family)
-      family="${2:?missing value for --family}"
-      shift 2
-      ;;
-    --path)
-      path="${2:?missing value for --path}"
-      shift 2
-      ;;
-    --entitlements)
-      entitlements="${2:?missing value for --entitlements}"
-      shift 2
-      ;;
-    --certificate)
-      certificate="${2:?missing value for --certificate}"
-      shift 2
-      ;;
-    --kms-key)
-      kms_key="${2:?missing value for --kms-key}"
-      shift 2
-      ;;
-    --kms-version)
-      kms_version="${2:?missing value for --kms-version}"
-      shift 2
-      ;;
-    --runtime)
-      runtime=true
-      shift
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "error: unknown argument $1" >&2
-      usage >&2
-      exit 64
-      ;;
-  esac
-done
-
-case "$family" in
-  ios)
-    certificate="${certificate:-Apple/Certificates/ios-distribution-3G42677598.cer}"
-    kms_key="${kms_key:-${BURROW_IOS_DISTRIBUTION_KMS_KEY:-apple-ios-distribution}}"
-    kms_version="${kms_version:-${BURROW_IOS_DISTRIBUTION_KMS_VERSION:-1}}"
-    timestamp_url="${BURROW_IOS_CODESIGN_TIMESTAMP_URL:-none}"
-    ;;
-  developer-id)
-    certificate="${certificate:-Apple/Certificates/developer-id-application-9JKN6HXBHC.cer}"
-    kms_key="${kms_key:-${BURROW_DEVELOPER_ID_KMS_KEY:-apple-developer-id-application}}"
-    kms_version="${kms_version:-${BURROW_DEVELOPER_ID_KMS_VERSION:-1}}"
-    timestamp_url="${BURROW_DEVELOPER_ID_TIMESTAMP_URL:-${BURROW_APPLE_TIMESTAMP_URL:-}}"
-    ;;
-  *)
-    echo "error: --family must be ios or developer-id" >&2
-    exit 64
-    ;;
-esac
-
-if [[ -z "$path" ]]; then
-  echo "error: --path is required" >&2
-  exit 64
-fi
-if [[ "$path" != /* ]]; then
-  path="$repo_root/$path"
-fi
-if [[ "$certificate" != /* ]]; then
-  certificate="$repo_root/$certificate"
-fi
-if [[ -n "$entitlements" && "$entitlements" != /* ]]; then
-  entitlements="$repo_root/$entitlements"
-fi
-if [[ ! -e "$path" ]]; then
-  echo "error: signing target does not exist: $path" >&2
-  exit 1
-fi
-if [[ ! -s "$certificate" ]]; then
-  echo "error: Apple certificate is missing or empty: $certificate" >&2
-  exit 1
-fi
-if [[ -n "$entitlements" && ! -s "$entitlements" ]]; then
-  echo "error: entitlements file is missing or empty: $entitlements" >&2
-  exit 1
-fi
-
-require_tool() {
-  if ! command -v "$1" >/dev/null 2>&1; then
-    echo "error: missing required tool: $1" >&2
-    exit 1
-  fi
-}
-
-resolve_module() {
-  local candidate
-  for candidate in \
-    "${BURROW_APPLE_PKCS11_MODULE:-}" \
-    "${BURROW_GCP_KMS_PKCS11_MODULE:-}" \
-    "${BURROW_PKCS11_MODULE:-}" \
-    "$(command -v google-kms-pkcs11-module >/dev/null 2>&1 && google-kms-pkcs11-module || true)" \
-    /nix/store/*-google-kms-pkcs11-*/lib/libkmsp11.so \
-    /nix/store/*-google-kms-pkcs11-*/lib/libkmsp11.dylib; do
-    if [[ -n "$candidate" && -f "$candidate" ]]; then
-      printf '%s\n' "$candidate"
-      return 0
-    fi
-  done
-  return 1
-}
-
-cert_public_key() {
-  local cert_file="$1"
-  local out="$2"
-  if ! openssl x509 -inform DER -in "$cert_file" -pubkey -noout >"$out" 2>/dev/null; then
-    openssl x509 -in "$cert_file" -pubkey -noout >"$out"
-  fi
-}
-
-public_fingerprint() {
-  openssl pkey -pubin -in "$1" -outform DER \
-    | openssl dgst -sha256 -binary \
-    | od -An -tx1 \
-    | tr -d ' \n'
-}
-
-resolve_kms_parts() {
-  local resource="$1"
-  local key_ring="${BURROW_GCP_KMS_KEY_RING:-${GOOGLE_KMS_KEY_RING:-projects/${GOOGLE_CLOUD_PROJECT:-project-88c23ce9-918a-470a-b33}/locations/${BURROW_KMS_LOCATION:-global}/keyRings/${BURROW_KMS_KEYRING:-burrow-identity}}}"
-
-  if [[ "$resource" =~ ^projects/([^/]+)/locations/([^/]+)/keyRings/([^/]+)/cryptoKeys/([^/]+)/cryptoKeyVersions/([^/]+)$ ]]; then
-    printf '%s\n%s\n%s\n%s\n%s\n' "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}" "${BASH_REMATCH[3]}" "${BASH_REMATCH[4]}" "${BASH_REMATCH[5]}"
-    return 0
-  fi
-  if [[ "$resource" =~ ^projects/([^/]+)/locations/([^/]+)/keyRings/([^/]+)/cryptoKeys/([^/]+)$ ]]; then
-    printf '%s\n%s\n%s\n%s\n%s\n' "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}" "${BASH_REMATCH[3]}" "${BASH_REMATCH[4]}" "$kms_version"
-    return 0
-  fi
-  if [[ ! "$key_ring" =~ ^projects/([^/]+)/locations/([^/]+)/keyRings/([^/]+)$ ]]; then
-    echo "error: invalid KMS key ring resource: $key_ring" >&2
-    exit 1
-  fi
-  printf '%s\n%s\n%s\n%s\n%s\n' "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}" "${BASH_REMATCH[3]}" "$resource" "$kms_version"
-}
-
-verify_certificate_matches_kms() {
-  local work_dir="$1"
-  local cert_public="$work_dir/apple-public.pem"
-  local kms_public="$work_dir/kms-public.pem"
-  local project location keyring key version expected actual
-  kms_info="$(resolve_kms_parts "$kms_key")"
-  project="$(printf '%s\n' "$kms_info" | sed -n '1p')"
-  location="$(printf '%s\n' "$kms_info" | sed -n '2p')"
-  keyring="$(printf '%s\n' "$kms_info" | sed -n '3p')"
-  key="$(printf '%s\n' "$kms_info" | sed -n '4p')"
-  version="$(printf '%s\n' "$kms_info" | sed -n '5p')"
-  if [[ -z "$version" ]]; then
-    echo "error: KMS key version is required for Apple release signing" >&2
-    exit 1
-  fi
-
-  cert_public_key "$certificate" "$cert_public"
-  expected="$(public_fingerprint "$cert_public")"
-  gcloud kms keys versions get-public-key "$version" \
-    --project="$project" \
-    --location="$location" \
-    --keyring="$keyring" \
-    --key="$key" \
-    --output-file="$kms_public" >/dev/null
-  actual="$(public_fingerprint "$kms_public")"
-  if [[ "$actual" != "$expected" ]]; then
-    echo "error: Apple certificate public key does not match Google KMS key" >&2
-    echo "family=$family" >&2
-    echo "kms_key=$key" >&2
-    echo "kms_version=$version" >&2
-    echo "certificate_spki_sha256=$expected" >&2
-    echo "kms_spki_sha256=$actual" >&2
-    exit 1
-  fi
-}
-
-require_tool rcodesign
-require_tool openssl
-require_tool od
-require_tool gcloud
-
-if ! rcodesign sign --help 2>&1 | grep -Fq -- "--pkcs11-library"; then
-  echo "error: rcodesign does not include PKCS#11 signing support" >&2
-  exit 1
-fi
-
-module="$(resolve_module || true)"
-if [[ -z "$module" ]]; then
-  echo "error: unable to locate Google KMS PKCS#11 module" >&2
-  exit 1
-fi
-
-work_dir="$(mktemp -d "${TMPDIR:-/tmp}/burrow-apple-kms-sign.XXXXXX")"
-trap 'rm -rf "$work_dir"' EXIT
-
-eval "$(Scripts/release/google-kms-pkcs11-materialize.sh --emit-env)"
-verify_certificate_matches_kms "$work_dir"
-
-real_openssl="$(command -v openssl)"
-export BURROW_REAL_OPENSSL="${BURROW_REAL_OPENSSL:-$real_openssl}"
-export BURROW_OPENSSL="$repo_root/Scripts/release/google-kms-openssl-dgst-shim.sh"
-export BURROW_APPLE_PKCS11_BACKEND=gcp-kms
-export BURROW_APPLE_PKCS11_SIGN_WITH_OPENSSL_PROVIDER=true
-export BURROW_APPLE_PKCS11_SIGN_WITH_GCLOUD=true
-export BURROW_GCP_KMS_ACTIVE_CRYPTO_KEY="$kms_key"
-export BURROW_GCP_KMS_ACTIVE_CRYPTO_KEY_VERSION="$kms_version"
-
-pin="${BURROW_APPLE_PKCS11_PIN:-${BURROW_GCP_KMS_PKCS11_PIN:-${BURROW_PKCS11_PIN:-ignored}}}"
-token_label="${BURROW_APPLE_PKCS11_TOKEN_LABEL:-${BURROW_GCP_KMS_PKCS11_TOKEN_LABEL:-${BURROW_PKCS11_TOKEN_LABEL:-burrow-release}}}"
-
-args=(
-  sign
-  --pkcs11-library "$module"
-  --pkcs11-certificate-file "$certificate"
-  --pkcs11-token-label "$token_label"
-  --pkcs11-key-label "$kms_key"
-  --pkcs11-pin "$pin"
-)
-if [[ -n "$timestamp_url" ]]; then
-  args+=(--timestamp-url "$timestamp_url")
-fi
-if [[ -n "$entitlements" ]]; then
-  args+=(--entitlements-xml-file "$entitlements")
-fi
-if [[ "$runtime" == "true" ]]; then
-  args+=(--code-signature-flags runtime)
-fi
-args+=("$path")
-
-rcodesign "${args[@]}"
diff --git a/Scripts/apple/sync-provisioning-profiles.mjs b/Scripts/apple/sync-provisioning-profiles.mjs
deleted file mode 100755
index 1a592d6..0000000
--- a/Scripts/apple/sync-provisioning-profiles.mjs
+++ /dev/null
@@ -1,331 +0,0 @@
-#!/usr/bin/env node
-import fs from "node:fs";
-import path from "node:path";
-import { webcrypto } from "node:crypto";
-
-const crypto = globalThis.crypto ?? webcrypto;
-
-function b64url(input) {
-  const buf = Buffer.isBuffer(input) ? input : Buffer.from(input);
-  return buf
-    .toString("base64")
-    .replace(/=/g, "")
-    .replace(/\+/g, "-")
-    .replace(/\//g, "_");
-}
-
-function parseArgs(argv) {
-  const out = { _: [] };
-  for (let i = 2; i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg === "--help" || arg === "-h") out.help = true;
-    else if (arg.startsWith("--")) {
-      const key = arg.slice(2);
-      const value = argv[i + 1];
-      if (!value || value.startsWith("--")) throw new Error(`missing value for --${key}`);
-      out[key] = value;
-      i++;
-    } else {
-      out._.push(arg);
-    }
-  }
-  return out;
-}
-
-async function makeJwt({ keyId, issuerId, keyPem }) {
-  const header = { alg: "ES256", kid: keyId, typ: "JWT" };
-  const now = Math.floor(Date.now() / 1000);
-  const payload = { iss: issuerId, exp: now + 20 * 60, aud: "appstoreconnect-v1" };
-  const input = `${b64url(JSON.stringify(header))}.${b64url(JSON.stringify(payload))}`;
-  const pkcs8Der = Buffer.from(
-    keyPem.replace(/-----BEGIN PRIVATE KEY-----|-----END PRIVATE KEY-----|\s+/g, ""),
-    "base64",
-  );
-  const key = await crypto.subtle.importKey(
-    "pkcs8",
-    pkcs8Der,
-    { name: "ECDSA", namedCurve: "P-256" },
-    false,
-    ["sign"],
-  );
-  const sig = await crypto.subtle.sign(
-    { name: "ECDSA", hash: "SHA-256" },
-    key,
-    new TextEncoder().encode(input),
-  );
-  return `${input}.${b64url(Buffer.from(sig))}`;
-}
-
-async function ascFetch(jwt, url, opts = {}) {
-  const res = await fetch(url, {
-    ...opts,
-    headers: {
-      ...(opts.headers ?? {}),
-      Authorization: `Bearer ${jwt}`,
-      "Content-Type": "application/json",
-    },
-  });
-  const text = await res.text();
-  let body;
-  try {
-    body = text ? JSON.parse(text) : {};
-  } catch {
-    body = { raw: text };
-  }
-  if (!res.ok) {
-    throw new Error(`ASC ${res.status} ${url}: ${JSON.stringify(body).slice(0, 2000)}`);
-  }
-  return body;
-}
-
-function truthy(value) {
-  return ["1", "true", "yes", "on"].includes(String(value ?? "").toLowerCase());
-}
-
-function safeFileName(identifier, suffix) {
-  return `${identifier.replace(/[^A-Za-z0-9]/g, "").toLowerCase()}${suffix}`;
-}
-
-function bundleDisplayName(identifier, appId) {
-  return identifier === appId ? "Burrow App" : "Burrow Network Extension";
-}
-
-async function findCertificate(jwt, preferredTypes, preferredId) {
-  const certs = await ascFetch(
-    jwt,
-    "https://api.appstoreconnect.apple.com/v1/certificates?limit=200",
-  );
-  const data = certs.data ?? [];
-  if (preferredId) {
-    const cert = data.find((item) => item?.id === preferredId);
-    if (!cert) throw new Error(`unable to locate certificate id ${preferredId} via ASC API`);
-    const type = cert?.attributes?.certificateType;
-    if (preferredTypes.length && !preferredTypes.includes(type)) {
-      throw new Error(`certificate ${preferredId} has type ${type}, expected ${preferredTypes.join(" or ")}`);
-    }
-    return cert;
-  }
-  for (const type of preferredTypes) {
-    const cert = data.find((item) => item?.attributes?.certificateType === type);
-    if (cert) return cert;
-  }
-  throw new Error(`unable to locate certificate type ${preferredTypes.join(" or ")} via ASC API`);
-}
-
-async function resolveBundle(jwt, target, { createMissing, platform }) {
-  const bundleResp = await ascFetch(
-    jwt,
-    `https://api.appstoreconnect.apple.com/v1/bundleIds?limit=5&filter[identifier]=${encodeURIComponent(target.identifier)}`,
-  );
-  let bundle = (bundleResp.data ?? []).find(
-    (item) => item?.attributes?.identifier === target.identifier,
-  );
-  if (bundle || !createMissing) return bundle;
-
-  const created = await ascFetch(jwt, "https://api.appstoreconnect.apple.com/v1/bundleIds", {
-    method: "POST",
-    body: JSON.stringify({
-      data: {
-        type: "bundleIds",
-        attributes: {
-          identifier: target.identifier,
-          name: target.bundleName ?? target.name,
-          platform,
-        },
-      },
-    }),
-  });
-  bundle = created?.data;
-  if (bundle?.id) {
-    process.stdout.write(`created bundle id ${target.identifier} (${platform})\n`);
-  }
-  return bundle;
-}
-
-async function listCapabilityTypes(jwt, bundleId) {
-  const resp = await ascFetch(
-    jwt,
-    `https://api.appstoreconnect.apple.com/v1/bundleIds/${bundleId}/bundleIdCapabilities`,
-  );
-  return new Set((resp.data ?? []).map((item) => item?.attributes?.capabilityType).filter(Boolean));
-}
-
-async function enableCapability(jwt, bundleId, capabilityType, settings) {
-  await ascFetch(jwt, "https://api.appstoreconnect.apple.com/v1/bundleIdCapabilities", {
-    method: "POST",
-    body: JSON.stringify({
-      data: {
-        type: "bundleIdCapabilities",
-        attributes: {
-          capabilityType,
-          ...(settings ? { settings } : {}),
-        },
-        relationships: {
-          bundleId: {
-            data: {
-              id: bundleId,
-              type: "bundleIds",
-            },
-          },
-        },
-      },
-    }),
-  });
-}
-
-async function profileIncludesCertificate(jwt, profileId, certificateId) {
-  const resp = await ascFetch(
-    jwt,
-    `https://api.appstoreconnect.apple.com/v1/profiles/${profileId}/certificates?limit=200`,
-  );
-  return (resp.data ?? []).some((item) => item?.id === certificateId);
-}
-
-async function ensureCapabilities(jwt, bundle, capabilities) {
-  const existing = await listCapabilityTypes(jwt, bundle.id);
-  for (const capability of capabilities) {
-    if (existing.has(capability.type)) continue;
-    try {
-      await enableCapability(jwt, bundle.id, capability.type, capability.settings);
-      process.stdout.write(`enabled ${capability.type} for ${bundle.attributes.identifier}\n`);
-    } catch (err) {
-      process.stderr.write(`warning: could not enable ${capability.type} for ${bundle.attributes.identifier}: ${err.message}\n`);
-    }
-  }
-}
-
-async function syncTarget(jwt, cert, profileType, target, outDir, options) {
-  const bundle = await resolveBundle(jwt, target, options);
-  if (!bundle) throw new Error(`bundleId not found in ASC: ${target.identifier}`);
-
-  if (options.enableCapabilities && target.capabilities?.length) {
-    await ensureCapabilities(jwt, bundle, target.capabilities);
-  }
-
-  const existing = await ascFetch(
-    jwt,
-    `https://api.appstoreconnect.apple.com/v1/profiles?limit=10&filter[profileType]=${encodeURIComponent(profileType)}&filter[name]=${encodeURIComponent(target.name)}`,
-  );
-  let profileId = (existing.data ?? []).find((item) => item?.attributes?.name === target.name)?.id;
-  if (profileId && options.replaceCertificateMismatch) {
-    const includesCertificate = await profileIncludesCertificate(jwt, profileId, cert.id);
-    if (!includesCertificate) {
-      await ascFetch(jwt, `https://api.appstoreconnect.apple.com/v1/profiles/${profileId}`, {
-        method: "DELETE",
-      });
-      process.stdout.write(`deleted stale profile ${target.name}; it did not include certificate ${cert.id}\n`);
-      profileId = undefined;
-    }
-  }
-  if (!profileId) {
-    const created = await ascFetch(jwt, "https://api.appstoreconnect.apple.com/v1/profiles", {
-      method: "POST",
-      body: JSON.stringify({
-        data: {
-          type: "profiles",
-          attributes: { name: target.name, profileType },
-          relationships: {
-            bundleId: { data: { type: "bundleIds", id: bundle.id } },
-            certificates: { data: [{ type: "certificates", id: cert.id }] },
-          },
-        },
-      }),
-    });
-    profileId = created?.data?.id;
-  }
-  if (!profileId) throw new Error(`failed to resolve/create profile for ${target.identifier}`);
-
-  const profile = await ascFetch(jwt, `https://api.appstoreconnect.apple.com/v1/profiles/${profileId}`);
-  const content = profile?.data?.attributes?.profileContent;
-  if (!content) throw new Error(`profileContent missing for ${target.name} (${profileId})`);
-
-  fs.mkdirSync(outDir, { recursive: true });
-  const profileBytes = Buffer.from(content, "base64");
-  const profilePath = path.join(outDir, target.file);
-  fs.writeFileSync(profilePath, profileBytes);
-  if (target.mobileFile) {
-    fs.writeFileSync(path.join(outDir, target.mobileFile), profileBytes);
-  }
-  process.stdout.write(`synced ${target.identifier} -> ${profilePath}\n`);
-}
-
-async function main() {
-  const args = parseArgs(process.argv);
-  if (args.help) {
-    console.log("Usage: sync-provisioning-profiles.mjs --platform ios|macos|all --key-id ID --issuer-id ID --key-file AuthKey.p8 --out-dir DIR [--ios-certificate-id ID] [--macos-certificate-id ID] [--replace-certificate-mismatch true]");
-    process.exit(0);
-  }
-
-  const platform = args.platform ?? "all";
-  const keyId = args["key-id"];
-  const issuerId = args["issuer-id"];
-  const keyFile = args["key-file"];
-  const outDir = args["out-dir"] ?? ".forgejo/actions/export";
-  const appId = args["app-id"] ?? "net.burrow.app";
-  const networkId = args["network-id"] ?? `${appId}.network`;
-  const iosCertificateId = args["ios-certificate-id"] ?? process.env.BURROW_IOS_DISTRIBUTION_CERTIFICATE_ID;
-  const macosCertificateId = args["macos-certificate-id"] ?? process.env.BURROW_DEVELOPER_ID_CERTIFICATE_ID;
-  const createMissing = truthy(args["create-missing-bundle-ids"]);
-  const enableCapabilities = createMissing || truthy(args["enable-capabilities"]);
-  const replaceCertificateMismatch = truthy(args["replace-certificate-mismatch"]);
-  const bundlePlatform = args["bundle-platform"] ?? "UNIVERSAL";
-  const associatedDomains = (args["associated-domains"] ?? "applinks:burrow.rs?mode=developer,webcredentials:burrow.rs?mode=developer")
-    .split(",")
-    .map((item) => item.trim())
-    .filter(Boolean);
-  const appCapabilities = [
-    { type: "NETWORK_EXTENSIONS" },
-    { type: "APP_GROUPS" },
-    {
-      type: "ASSOCIATED_DOMAINS",
-      settings: [{ key: "ASSOCIATED_DOMAIN_IDS", options: associatedDomains.map((key) => ({ key, enabled: true })) }],
-    },
-  ];
-  const extensionCapabilities = [
-    { type: "NETWORK_EXTENSIONS" },
-    { type: "APP_GROUPS" },
-  ];
-  const options = { createMissing, enableCapabilities, replaceCertificateMismatch, platform: bundlePlatform };
-
-  if (!keyId || !issuerId || !keyFile) throw new Error("required: --key-id --issuer-id --key-file");
-
-  const jwt = await makeJwt({ keyId, issuerId, keyPem: fs.readFileSync(keyFile, "utf8") });
-
-  if (platform === "ios" || platform === "all") {
-    const cert = await findCertificate(jwt, ["IOS_DISTRIBUTION", "DISTRIBUTION", "APPLE_DISTRIBUTION"], iosCertificateId);
-    const targets = [appId, networkId].map((identifier) => ({
-      identifier,
-      name: `${identifier}.app-store`,
-      bundleName: bundleDisplayName(identifier, appId),
-      file: safeFileName(identifier, "appstore.provisionprofile"),
-      mobileFile: safeFileName(identifier, "appstore.mobileprovision"),
-      capabilities: identifier === appId ? appCapabilities : extensionCapabilities,
-    }));
-    for (const target of targets) {
-      await syncTarget(jwt, cert, "IOS_APP_STORE", target, outDir, options);
-    }
-  }
-
-  if (platform === "macos" || platform === "all") {
-    const cert = await findCertificate(
-      jwt,
-      ["DEVELOPER_ID_APPLICATION", "DEVELOPER_ID_APPLICATION_G2"],
-      macosCertificateId,
-    );
-    const targets = [appId, networkId].map((identifier) => ({
-      identifier,
-      name: `${identifier}.developer-id`,
-      bundleName: bundleDisplayName(identifier, appId),
-      file: safeFileName(identifier, "developerid.provisionprofile"),
-      capabilities: identifier === appId ? appCapabilities : extensionCapabilities,
-    }));
-    for (const target of targets) {
-      await syncTarget(jwt, cert, "MAC_APP_DIRECT", target, outDir, options);
-    }
-  }
-}
-
-main().catch((err) => {
-  console.error(err?.stack || String(err));
-  process.exit(1);
-});
diff --git a/Scripts/authentik-sync-1password-oidc.sh b/Scripts/authentik-sync-1password-oidc.sh
deleted file mode 100755
index f523d9a..0000000
--- a/Scripts/authentik-sync-1password-oidc.sh
+++ /dev/null
@@ -1,243 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-authentik_url="${AUTHENTIK_URL:-https://auth.burrow.net}"
-bootstrap_token="${AUTHENTIK_BOOTSTRAP_TOKEN:-}"
-application_slug="${AUTHENTIK_ONEPASSWORD_APPLICATION_SLUG:-onepassword}"
-application_name="${AUTHENTIK_ONEPASSWORD_APPLICATION_NAME:-1Password}"
-provider_name="${AUTHENTIK_ONEPASSWORD_PROVIDER_NAME:-1Password}"
-template_slug="${AUTHENTIK_ONEPASSWORD_TEMPLATE_SLUG:-ts}"
-client_id="${AUTHENTIK_ONEPASSWORD_CLIENT_ID:-1password.burrow.net}"
-launch_url="${AUTHENTIK_ONEPASSWORD_LAUNCH_URL:-https://burrow-team.1password.com/}"
-redirect_uris_json="${AUTHENTIK_ONEPASSWORD_REDIRECT_URIS_JSON:-[
-  \"https://burrow-team.1password.com/sso/oidc/redirect/\",
-  \"onepassword://sso/oidc/redirect\"
-]}"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/authentik-sync-1password-oidc.sh
-
-Required environment:
-  AUTHENTIK_BOOTSTRAP_TOKEN
-
-Optional environment:
-  AUTHENTIK_URL
-  AUTHENTIK_ONEPASSWORD_APPLICATION_SLUG
-  AUTHENTIK_ONEPASSWORD_APPLICATION_NAME
-  AUTHENTIK_ONEPASSWORD_PROVIDER_NAME
-  AUTHENTIK_ONEPASSWORD_TEMPLATE_SLUG
-  AUTHENTIK_ONEPASSWORD_CLIENT_ID
-  AUTHENTIK_ONEPASSWORD_LAUNCH_URL
-  AUTHENTIK_ONEPASSWORD_REDIRECT_URIS_JSON
-EOF
-}
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-if [[ -z "$bootstrap_token" ]]; then
-  echo "error: AUTHENTIK_BOOTSTRAP_TOKEN is required" >&2
-  exit 1
-fi
-
-if ! printf '%s' "$redirect_uris_json" | jq -e 'type == "array" and length > 0' >/dev/null; then
-  echo "error: AUTHENTIK_ONEPASSWORD_REDIRECT_URIS_JSON must be a non-empty JSON array" >&2
-  exit 1
-fi
-
-api() {
-  local method="$1"
-  local path="$2"
-  local data="${3:-}"
-
-  if [[ -n "$data" ]]; then
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      -H "Content-Type: application/json" \
-      -d "$data" \
-      "${authentik_url}${path}"
-  else
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      "${authentik_url}${path}"
-  fi
-}
-
-api_with_status() {
-  local method="$1"
-  local path="$2"
-  local data="${3:-}"
-  local response_file status
-
-  response_file="$(mktemp)"
-  trap 'rm -f "$response_file"' RETURN
-
-  if [[ -n "$data" ]]; then
-    status="$(
-      curl -sS \
-        -o "$response_file" \
-        -w '%{http_code}' \
-        -X "$method" \
-        -H "Authorization: Bearer ${bootstrap_token}" \
-        -H "Content-Type: application/json" \
-        -d "$data" \
-        "${authentik_url}${path}"
-    )"
-  else
-    status="$(
-      curl -sS \
-        -o "$response_file" \
-        -w '%{http_code}' \
-        -X "$method" \
-        -H "Authorization: Bearer ${bootstrap_token}" \
-        "${authentik_url}${path}"
-    )"
-  fi
-
-  printf '%s\n' "$status"
-  cat "$response_file"
-}
-
-wait_for_authentik() {
-  for _ in $(seq 1 90); do
-    if curl -fsS "${authentik_url}/-/health/ready/" >/dev/null 2>&1; then
-      return 0
-    fi
-    sleep 2
-  done
-
-  echo "error: Authentik did not become ready at ${authentik_url}" >&2
-  exit 1
-}
-
-wait_for_authentik
-
-template_provider="$(
-  api GET "/api/v3/providers/oauth2/?page_size=200" \
-    | jq -c --arg template_slug "$template_slug" '.results[]? | select(.assigned_application_slug == $template_slug)' \
-    | head -n1
-)"
-
-if [[ -z "$template_provider" ]]; then
-  echo "error: could not resolve the Authentik OAuth provider template ${template_slug}" >&2
-  exit 1
-fi
-
-authorization_flow="$(printf '%s\n' "$template_provider" | jq -r '.authorization_flow')"
-invalidation_flow="$(printf '%s\n' "$template_provider" | jq -r '.invalidation_flow')"
-property_mappings="$(printf '%s\n' "$template_provider" | jq -c '.property_mappings')"
-signing_key="$(printf '%s\n' "$template_provider" | jq -r '.signing_key')"
-
-provider_payload="$(
-  jq -n \
-    --arg name "$provider_name" \
-    --arg authorization_flow "$authorization_flow" \
-    --arg invalidation_flow "$invalidation_flow" \
-    --arg client_id "$client_id" \
-    --arg signing_key "$signing_key" \
-    --argjson property_mappings "$property_mappings" \
-    --argjson redirect_uris "$redirect_uris_json" \
-    '{
-      name: $name,
-      authorization_flow: $authorization_flow,
-      invalidation_flow: $invalidation_flow,
-      client_type: "public",
-      client_id: $client_id,
-      include_claims_in_id_token: true,
-      redirect_uris: ($redirect_uris | map({matching_mode: "strict", url: .})),
-      property_mappings: $property_mappings,
-      signing_key: $signing_key,
-      issuer_mode: "per_provider",
-      sub_mode: "hashed_user_id"
-    }'
-)"
-
-existing_provider="$(
-  api GET "/api/v3/providers/oauth2/?page_size=200" \
-    | jq -c \
-      --arg application_slug "$application_slug" \
-      --arg provider_name "$provider_name" \
-      '.results[]? | select(.assigned_application_slug == $application_slug or .name == $provider_name)' \
-    | head -n1
-)"
-
-if [[ -n "$existing_provider" ]]; then
-  provider_pk="$(printf '%s\n' "$existing_provider" | jq -r '.pk')"
-  api PATCH "/api/v3/providers/oauth2/${provider_pk}/" "$provider_payload" >/dev/null
-else
-  provider_pk="$(
-    api POST "/api/v3/providers/oauth2/" "$provider_payload" \
-      | jq -r '.pk // empty'
-  )"
-fi
-
-if [[ -z "${provider_pk:-}" ]]; then
-  echo "error: 1Password OIDC provider did not return a primary key" >&2
-  exit 1
-fi
-
-application_payload="$(
-  jq -n \
-    --arg name "$application_name" \
-    --arg slug "$application_slug" \
-    --arg provider "$provider_pk" \
-    --arg launch_url "$launch_url" \
-    '{
-      name: $name,
-      slug: $slug,
-      provider: ($provider | tonumber),
-      meta_launch_url: $launch_url,
-      open_in_new_tab: true,
-      policy_engine_mode: "any"
-    }'
-)"
-
-existing_application="$(
-  api GET "/api/v3/core/applications/?page_size=200" \
-    | jq -c --arg slug "$application_slug" '.results[]? | select(.slug == $slug)' \
-    | head -n1
-)"
-
-if [[ -n "$existing_application" ]]; then
-  application_pk="$(printf '%s\n' "$existing_application" | jq -r '.pk')"
-else
-  create_application_result="$(
-    api_with_status POST "/api/v3/core/applications/" "$application_payload"
-  )"
-  create_application_status="$(printf '%s\n' "$create_application_result" | sed -n '1p')"
-  create_application_body="$(printf '%s\n' "$create_application_result" | sed '1d')"
-
-  if [[ "$create_application_status" =~ ^20[01]$ ]]; then
-    application_pk="$(printf '%s\n' "$create_application_body" | jq -r '.pk // empty')"
-  elif [[ "$create_application_status" == "400" ]] && printf '%s\n' "$create_application_body" | jq -e '
-      (.slug // [] | index("Application with this slug already exists.")) != null
-      or (.provider // [] | index("Application with this provider already exists.")) != null
-    ' >/dev/null; then
-    application_pk="existing-duplicate"
-  else
-    printf '%s\n' "$create_application_body" >&2
-    echo "error: could not reconcile Authentik application ${application_slug}" >&2
-    exit 1
-  fi
-fi
-
-if [[ -z "${application_pk:-}" ]]; then
-  echo "error: 1Password OIDC application did not return a primary key" >&2
-  exit 1
-fi
-
-for _ in $(seq 1 30); do
-  if curl -fsS "${authentik_url}/application/o/${application_slug}/.well-known/openid-configuration" >/dev/null 2>&1; then
-    echo "Synced Authentik 1Password OIDC application ${application_slug} (${application_name})."
-    exit 0
-  fi
-  sleep 2
-done
-
-echo "warning: 1Password OIDC issuer document for ${application_slug} was not immediately readable; keeping reconciled config." >&2
-echo "Synced Authentik 1Password OIDC application ${application_slug} (${application_name})."
diff --git a/Scripts/authentik-sync-burrow-directory.sh b/Scripts/authentik-sync-burrow-directory.sh
deleted file mode 100644
index 68dbcff..0000000
--- a/Scripts/authentik-sync-burrow-directory.sh
+++ /dev/null
@@ -1,273 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-authentik_url="${AUTHENTIK_URL:-https://auth.burrow.net}"
-bootstrap_token="${AUTHENTIK_BOOTSTRAP_TOKEN:-}"
-directory_json="${AUTHENTIK_BURROW_DIRECTORY_JSON:-[]}"
-users_group="${AUTHENTIK_BURROW_USERS_GROUP:-burrow-users}"
-admins_group="${AUTHENTIK_BURROW_ADMINS_GROUP:-burrow-admins}"
-extra_groups_json="${AUTHENTIK_BURROW_EXTRA_GROUPS_JSON:-[]}"
-forgejo_application_slug="${AUTHENTIK_FORGEJO_APPLICATION_SLUG:-}"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/authentik-sync-burrow-directory.sh
-
-Required environment:
-  AUTHENTIK_BOOTSTRAP_TOKEN
-  AUTHENTIK_BURROW_DIRECTORY_JSON
-
-Optional environment:
-  AUTHENTIK_URL
-  AUTHENTIK_BURROW_USERS_GROUP
-  AUTHENTIK_BURROW_ADMINS_GROUP
-  AUTHENTIK_BURROW_EXTRA_GROUPS_JSON
-  AUTHENTIK_FORGEJO_APPLICATION_SLUG
-EOF
-}
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-if [[ -z "$bootstrap_token" ]]; then
-  echo "error: AUTHENTIK_BOOTSTRAP_TOKEN is required" >&2
-  exit 1
-fi
-
-if ! printf '%s' "$directory_json" | jq -e 'type == "array"' >/dev/null; then
-  echo "error: AUTHENTIK_BURROW_DIRECTORY_JSON must be a JSON array" >&2
-  exit 1
-fi
-
-if ! printf '%s' "$extra_groups_json" | jq -e 'type == "array"' >/dev/null; then
-  echo "error: AUTHENTIK_BURROW_EXTRA_GROUPS_JSON must be a JSON array" >&2
-  exit 1
-fi
-
-api() {
-  local method="$1"
-  local path="$2"
-  local data="${3:-}"
-
-  if [[ -n "$data" ]]; then
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      -H "Content-Type: application/json" \
-      -d "$data" \
-      "${authentik_url}${path}"
-  else
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      "${authentik_url}${path}"
-  fi
-}
-
-wait_for_authentik() {
-  for _ in $(seq 1 90); do
-    if curl -fsS "${authentik_url}/-/health/ready/" >/dev/null 2>&1; then
-      return 0
-    fi
-    sleep 2
-  done
-  echo "error: Authentik did not become ready at ${authentik_url}" >&2
-  exit 1
-}
-
-lookup_group_pk() {
-  local group_name="$1"
-
-  api GET "/api/v3/core/groups/?page_size=200&search=${group_name}" \
-    | jq -r --arg name "$group_name" '.results[]? | select(.name == $name) | .pk // empty' \
-    | head -n1
-}
-
-ensure_group() {
-  local group_name="$1"
-  local payload group_pk
-
-  payload="$(
-    jq -cn \
-      --arg name "$group_name" \
-      '{name: $name}'
-  )"
-
-  group_pk="$(lookup_group_pk "$group_name")"
-  if [[ -n "$group_pk" ]]; then
-    api PATCH "/api/v3/core/groups/${group_pk}/" "$payload" >/dev/null
-  else
-    group_pk="$(
-      api POST "/api/v3/core/groups/" "$payload" \
-        | jq -r '.pk // empty'
-    )"
-  fi
-
-  if [[ -z "$group_pk" ]]; then
-    echo "error: could not create Authentik group ${group_name}" >&2
-    exit 1
-  fi
-
-  printf '%s\n' "$group_pk"
-}
-
-lookup_user_pk() {
-  local username="$1"
-
-  api GET "/api/v3/core/users/?page_size=200&search=${username}" \
-    | jq -r --arg username "$username" '.results[]? | select(.username == $username) | .pk // empty' \
-    | head -n1
-}
-
-ensure_user() {
-  local user_spec="$1"
-  local username name email is_admin groups_json password_file effective_groups_json group_name
-  local group_pks_json payload user_pk
-
-  username="$(printf '%s\n' "$user_spec" | jq -r '.username')"
-  name="$(printf '%s\n' "$user_spec" | jq -r '.name')"
-  email="$(printf '%s\n' "$user_spec" | jq -r '.email')"
-  is_admin="$(printf '%s\n' "$user_spec" | jq -r '.isAdmin // false')"
-  groups_json="$(printf '%s\n' "$user_spec" | jq -c '.groups // []')"
-  password_file="$(printf '%s\n' "$user_spec" | jq -r '.passwordFile // empty')"
-
-  if [[ -z "$username" || "$username" == "null" || -z "$email" || "$email" == "null" ]]; then
-    echo "error: each Burrow Authentik user requires username and email" >&2
-    exit 1
-  fi
-
-  effective_groups_json="$(
-    printf '%s\n' "$groups_json" \
-      | jq -c --arg users_group "$users_group" --arg admins_group "$admins_group" --argjson is_admin "$is_admin" '
-          . + [$users_group] + (if $is_admin then [$admins_group] else [] end) | unique
-        '
-  )"
-
-  group_pks_json='[]'
-  while IFS= read -r group_name; do
-    group_pk="$(ensure_group "$group_name")"
-    group_pks_json="$(
-      jq -cn \
-        --argjson current "$group_pks_json" \
-        --arg next "$group_pk" \
-        '$current + [$next]'
-    )"
-  done < <(printf '%s\n' "$effective_groups_json" | jq -r '.[]')
-
-  payload="$(
-    jq -cn \
-      --arg username "$username" \
-      --arg name "$name" \
-      --arg email "$email" \
-      --argjson groups "$group_pks_json" \
-      '{
-        username: $username,
-        name: $name,
-        email: $email,
-        is_active: true,
-        path: "users",
-        groups: $groups
-      }'
-  )"
-
-  user_pk="$(lookup_user_pk "$username")"
-  if [[ -n "$user_pk" ]]; then
-    api PATCH "/api/v3/core/users/${user_pk}/" "$payload" >/dev/null
-  else
-    user_pk="$(
-      api POST "/api/v3/core/users/" "$payload" \
-        | jq -r '.pk // empty'
-    )"
-  fi
-
-  if [[ -z "$user_pk" ]]; then
-    echo "error: could not create Authentik user ${username}" >&2
-    exit 1
-  fi
-
-  if [[ -n "$password_file" ]]; then
-    if [[ ! -s "$password_file" ]]; then
-      echo "error: password file for Authentik user ${username} is missing: ${password_file}" >&2
-      exit 1
-    fi
-
-    api POST "/api/v3/core/users/${user_pk}/set_password/" "$(
-      jq -cn \
-        --arg password "$(tr -d '\r\n' < "$password_file")" \
-        '{password: $password}'
-    )" >/dev/null
-  fi
-}
-
-lookup_application_pk() {
-  local slug="$1"
-
-  api GET "/api/v3/core/applications/?page_size=200" \
-    | jq -r --arg slug "$slug" '.results[]? | select(.slug == $slug) | .pk // empty' \
-    | head -n1
-}
-
-ensure_application_group_binding() {
-  local application_slug="$1"
-  local group_name="$2"
-  local application_pk group_pk existing payload binding_pk
-
-  application_pk="$(lookup_application_pk "$application_slug")"
-  if [[ -z "$application_pk" ]]; then
-    echo "warning: could not resolve Authentik application ${application_slug}; skipping application group binding" >&2
-    return 0
-  fi
-
-  group_pk="$(lookup_group_pk "$group_name")"
-  if [[ -z "$group_pk" ]]; then
-    echo "error: could not resolve Authentik group ${group_name}" >&2
-    exit 1
-  fi
-
-  existing="$(
-    api GET "/api/v3/policies/bindings/?page_size=200&target=${application_pk}" \
-      | jq -c --arg group_pk "$group_pk" '.results[]? | select(.group == $group_pk)' \
-      | head -n1
-  )"
-
-  payload="$(
-    jq -cn \
-      --arg target "$application_pk" \
-      --arg group "$group_pk" \
-      '{
-        group: $group,
-        target: $target,
-        negate: false,
-        enabled: true,
-        order: 100,
-        timeout: 30,
-        failure_result: false
-      }'
-  )"
-
-  if [[ -n "$existing" ]]; then
-    binding_pk="$(printf '%s\n' "$existing" | jq -r '.pk')"
-    api PATCH "/api/v3/policies/bindings/${binding_pk}/" "$payload" >/dev/null
-  else
-    api POST "/api/v3/policies/bindings/" "$payload" >/dev/null
-  fi
-}
-
-wait_for_authentik
-ensure_group "$users_group" >/dev/null
-ensure_group "$admins_group" >/dev/null
-while IFS= read -r group_name; do
-  ensure_group "$group_name" >/dev/null
-done < <(printf '%s\n' "$extra_groups_json" | jq -r '.[]')
-
-while IFS= read -r user_spec; do
-  ensure_user "$user_spec"
-done < <(printf '%s\n' "$directory_json" | jq -c '.[]')
-
-if [[ -n "$forgejo_application_slug" ]]; then
-  ensure_application_group_binding "$forgejo_application_slug" "$users_group"
-fi
-
-echo "Synced Burrow Authentik directory."
diff --git a/Scripts/authentik-sync-forgejo-oidc.sh b/Scripts/authentik-sync-forgejo-oidc.sh
deleted file mode 100644
index b490698..0000000
--- a/Scripts/authentik-sync-forgejo-oidc.sh
+++ /dev/null
@@ -1,249 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-authentik_url="${AUTHENTIK_URL:-https://auth.burrow.net}"
-bootstrap_token="${AUTHENTIK_BOOTSTRAP_TOKEN:-}"
-application_slug="${AUTHENTIK_FORGEJO_APPLICATION_SLUG:-git}"
-application_name="${AUTHENTIK_FORGEJO_APPLICATION_NAME:-burrow.net}"
-provider_name="${AUTHENTIK_FORGEJO_PROVIDER_NAME:-burrow.net}"
-client_id="${AUTHENTIK_FORGEJO_CLIENT_ID:-git.burrow.net}"
-client_secret="${AUTHENTIK_FORGEJO_CLIENT_SECRET:-}"
-launch_url="${AUTHENTIK_FORGEJO_LAUNCH_URL:-https://git.burrow.net/}"
-redirect_uris_json="${AUTHENTIK_FORGEJO_REDIRECT_URIS_JSON:-[
-  \"https://git.burrow.net/user/oauth2/burrow.net/callback\",
-  \"https://git.burrow.net/user/oauth2/authentik/callback\"
-]}"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/authentik-sync-forgejo-oidc.sh
-
-Required environment:
-  AUTHENTIK_BOOTSTRAP_TOKEN
-  AUTHENTIK_FORGEJO_CLIENT_SECRET
-
-Optional environment:
-  AUTHENTIK_URL
-  AUTHENTIK_FORGEJO_APPLICATION_SLUG
-  AUTHENTIK_FORGEJO_APPLICATION_NAME
-  AUTHENTIK_FORGEJO_PROVIDER_NAME
-  AUTHENTIK_FORGEJO_CLIENT_ID
-  AUTHENTIK_FORGEJO_LAUNCH_URL
-  AUTHENTIK_FORGEJO_REDIRECT_URIS_JSON
-EOF
-}
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-if [[ -z "$bootstrap_token" ]]; then
-  echo "error: AUTHENTIK_BOOTSTRAP_TOKEN is required" >&2
-  exit 1
-fi
-
-if [[ -z "$client_secret" || "$client_secret" == PENDING* ]]; then
-  echo "Forgejo OIDC client secret is not configured; skipping Authentik Forgejo sync." >&2
-  exit 0
-fi
-
-if ! printf '%s' "$redirect_uris_json" | jq -e 'type == "array" and length > 0' >/dev/null; then
-  echo "error: AUTHENTIK_FORGEJO_REDIRECT_URIS_JSON must be a non-empty JSON array" >&2
-  exit 1
-fi
-
-api() {
-  local method="$1"
-  local path="$2"
-  local data="${3:-}"
-
-  if [[ -n "$data" ]]; then
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      -H "Content-Type: application/json" \
-      -d "$data" \
-      "${authentik_url}${path}"
-  else
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      "${authentik_url}${path}"
-  fi
-}
-
-api_with_status() {
-  local method="$1"
-  local path="$2"
-  local data="${3:-}"
-  local response_file status
-
-  response_file="$(mktemp)"
-  trap 'rm -f "$response_file"' RETURN
-
-  if [[ -n "$data" ]]; then
-    status="$(
-      curl -sS \
-        -o "$response_file" \
-        -w '%{http_code}' \
-        -X "$method" \
-        -H "Authorization: Bearer ${bootstrap_token}" \
-        -H "Content-Type: application/json" \
-        -d "$data" \
-        "${authentik_url}${path}"
-    )"
-  else
-    status="$(
-      curl -sS \
-        -o "$response_file" \
-        -w '%{http_code}' \
-        -X "$method" \
-        -H "Authorization: Bearer ${bootstrap_token}" \
-        "${authentik_url}${path}"
-    )"
-  fi
-
-  printf '%s\n' "$status"
-  cat "$response_file"
-}
-
-wait_for_authentik() {
-  for _ in $(seq 1 90); do
-    if curl -fsS "${authentik_url}/-/health/ready/" >/dev/null 2>&1; then
-      return 0
-    fi
-    sleep 2
-  done
-  echo "error: Authentik did not become ready at ${authentik_url}" >&2
-  exit 1
-}
-
-wait_for_authentik
-
-template_provider="$(
-  api GET "/api/v3/providers/oauth2/?page_size=200" \
-    | jq -c '.results[]? | select(.assigned_application_slug == "ts")' \
-    | head -n1
-)"
-
-if [[ -z "$template_provider" ]]; then
-  echo "error: could not resolve the Burrow Tailnet OAuth provider template" >&2
-  exit 1
-fi
-
-authorization_flow="$(printf '%s\n' "$template_provider" | jq -r '.authorization_flow')"
-invalidation_flow="$(printf '%s\n' "$template_provider" | jq -r '.invalidation_flow')"
-property_mappings="$(printf '%s\n' "$template_provider" | jq -c '.property_mappings')"
-signing_key="$(printf '%s\n' "$template_provider" | jq -r '.signing_key')"
-
-provider_payload="$(
-  jq -n \
-    --arg name "$provider_name" \
-    --arg authorization_flow "$authorization_flow" \
-    --arg invalidation_flow "$invalidation_flow" \
-    --arg client_id "$client_id" \
-    --arg client_secret "$client_secret" \
-    --arg signing_key "$signing_key" \
-    --argjson property_mappings "$property_mappings" \
-    --argjson redirect_uris "$redirect_uris_json" \
-    '{
-      name: $name,
-      authorization_flow: $authorization_flow,
-      invalidation_flow: $invalidation_flow,
-      client_type: "confidential",
-      client_id: $client_id,
-      client_secret: $client_secret,
-      include_claims_in_id_token: true,
-      redirect_uris: ($redirect_uris | map({matching_mode: "strict", url: .})),
-      property_mappings: $property_mappings,
-      signing_key: $signing_key,
-      issuer_mode: "per_provider",
-      sub_mode: "hashed_user_id"
-    }'
-)"
-
-existing_provider="$(
-  api GET "/api/v3/providers/oauth2/?page_size=200" \
-    | jq -c \
-      --arg application_slug "$application_slug" \
-      --arg provider_name "$provider_name" \
-      '.results[]? | select(.assigned_application_slug == $application_slug or .name == $provider_name)' \
-    | head -n1
-)"
-
-if [[ -n "$existing_provider" ]]; then
-  provider_pk="$(printf '%s\n' "$existing_provider" | jq -r '.pk')"
-  api PATCH "/api/v3/providers/oauth2/${provider_pk}/" "$provider_payload" >/dev/null
-else
-  provider_pk="$(
-    api POST "/api/v3/providers/oauth2/" "$provider_payload" \
-      | jq -r '.pk // empty'
-  )"
-fi
-
-if [[ -z "${provider_pk:-}" ]]; then
-  echo "error: Forgejo OIDC provider did not return a primary key" >&2
-  exit 1
-fi
-
-application_payload="$(
-  jq -n \
-    --arg name "$application_name" \
-    --arg slug "$application_slug" \
-    --arg provider "$provider_pk" \
-    --arg launch_url "$launch_url" \
-    '{
-      name: $name,
-      slug: $slug,
-      provider: ($provider | tonumber),
-      meta_launch_url: $launch_url,
-      open_in_new_tab: false,
-      policy_engine_mode: "any"
-    }'
-)"
-
-existing_application="$(
-  api GET "/api/v3/core/applications/?page_size=200" \
-    | jq -c --arg slug "$application_slug" '.results[]? | select(.slug == $slug)' \
-    | head -n1
-)"
-
-if [[ -n "$existing_application" ]]; then
-  application_pk="$(printf '%s\n' "$existing_application" | jq -r '.pk')"
-else
-  create_application_result="$(
-    api_with_status POST "/api/v3/core/applications/" "$application_payload"
-  )"
-  create_application_status="$(printf '%s\n' "$create_application_result" | sed -n '1p')"
-  create_application_body="$(printf '%s\n' "$create_application_result" | sed '1d')"
-
-  if [[ "$create_application_status" =~ ^20[01]$ ]]; then
-    application_pk="$(printf '%s\n' "$create_application_body" | jq -r '.pk // empty')"
-  elif [[ "$create_application_status" == "400" ]] && printf '%s\n' "$create_application_body" | jq -e '
-      (.slug // [] | index("Application with this slug already exists.")) != null
-      or (.provider // [] | index("Application with this provider already exists.")) != null
-    ' >/dev/null; then
-    application_pk="existing-duplicate"
-  else
-    printf '%s\n' "$create_application_body" >&2
-    echo "error: could not reconcile Authentik application ${application_slug}" >&2
-    exit 1
-  fi
-fi
-
-if [[ -z "${application_pk:-}" ]]; then
-  echo "error: Forgejo OIDC application did not return a primary key" >&2
-  exit 1
-fi
-
-for _ in $(seq 1 30); do
-  if curl -fsS "${authentik_url}/application/o/${application_slug}/.well-known/openid-configuration" >/dev/null 2>&1; then
-    echo "Synced Authentik Forgejo OIDC application ${application_slug} (${application_name})."
-    exit 0
-  fi
-  sleep 2
-done
-
-echo "warning: Forgejo OIDC issuer document for ${application_slug} was not immediately readable; keeping reconciled config." >&2
-echo "Synced Authentik Forgejo OIDC application ${application_slug} (${application_name})."
diff --git a/Scripts/authentik-sync-google-source.sh b/Scripts/authentik-sync-google-source.sh
deleted file mode 100755
index a4c9edb..0000000
--- a/Scripts/authentik-sync-google-source.sh
+++ /dev/null
@@ -1,284 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-authentik_url="${AUTHENTIK_URL:-https://auth.burrow.net}"
-bootstrap_token="${AUTHENTIK_BOOTSTRAP_TOKEN:-}"
-google_client_id="${AUTHENTIK_GOOGLE_CLIENT_ID:-}"
-google_client_secret="${AUTHENTIK_GOOGLE_CLIENT_SECRET:-}"
-source_slug="${AUTHENTIK_GOOGLE_SOURCE_SLUG:-google}"
-source_name="${AUTHENTIK_GOOGLE_SOURCE_NAME:-Google}"
-identification_stage_name="${AUTHENTIK_GOOGLE_IDENTIFICATION_STAGE_NAME:-default-authentication-identification}"
-authentication_flow_slug="${AUTHENTIK_GOOGLE_AUTHENTICATION_FLOW_SLUG:-default-source-authentication}"
-enrollment_flow_slug="${AUTHENTIK_GOOGLE_ENROLLMENT_FLOW_SLUG:-default-source-enrollment}"
-login_mode="${AUTHENTIK_GOOGLE_LOGIN_MODE:-redirect}"
-user_matching_mode="${AUTHENTIK_GOOGLE_USER_MATCHING_MODE:-email_link}"
-policy_engine_mode="${AUTHENTIK_GOOGLE_POLICY_ENGINE_MODE:-any}"
-google_account_map_json="${AUTHENTIK_GOOGLE_ACCOUNT_MAP_JSON:-[]}"
-property_mapping_name="${AUTHENTIK_GOOGLE_PROPERTY_MAPPING_NAME:-Burrow Google Account Map}"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/authentik-sync-google-source.sh
-
-Required environment:
-  AUTHENTIK_BOOTSTRAP_TOKEN
-  AUTHENTIK_GOOGLE_CLIENT_ID
-  AUTHENTIK_GOOGLE_CLIENT_SECRET
-
-Optional environment:
-  AUTHENTIK_URL
-  AUTHENTIK_GOOGLE_SOURCE_SLUG
-  AUTHENTIK_GOOGLE_SOURCE_NAME
-  AUTHENTIK_GOOGLE_IDENTIFICATION_STAGE_NAME
-  AUTHENTIK_GOOGLE_AUTHENTICATION_FLOW_SLUG
-  AUTHENTIK_GOOGLE_ENROLLMENT_FLOW_SLUG
-  AUTHENTIK_GOOGLE_LOGIN_MODE          promoted|redirect
-  AUTHENTIK_GOOGLE_USER_MATCHING_MODE  identifier|email_link|email_deny|username_link|username_deny
-  AUTHENTIK_GOOGLE_POLICY_ENGINE_MODE  all|any
-  AUTHENTIK_GOOGLE_ACCOUNT_MAP_JSON    JSON array of alias mappings
-  AUTHENTIK_GOOGLE_PROPERTY_MAPPING_NAME
-EOF
-}
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-if [[ -z "$bootstrap_token" ]]; then
-  echo "error: AUTHENTIK_BOOTSTRAP_TOKEN is required" >&2
-  exit 1
-fi
-
-if [[ -z "$google_client_id" || -z "$google_client_secret" || "$google_client_id" == PENDING* || "$google_client_secret" == PENDING* ]]; then
-  echo "Google OAuth credentials are not configured; skipping Authentik Google source sync." >&2
-  echo "Set Authorized redirect URI in Google to ${authentik_url}/source/oauth/callback/${source_slug}/" >&2
-  exit 0
-fi
-
-if ! printf '%s' "$google_account_map_json" | jq -e 'type == "array"' >/dev/null; then
-  echo "error: AUTHENTIK_GOOGLE_ACCOUNT_MAP_JSON must be a JSON array" >&2
-  exit 1
-fi
-
-case "$login_mode" in
-  promoted|redirect) ;;
-  *)
-    echo "warning: unsupported AUTHENTIK_GOOGLE_LOGIN_MODE=$login_mode; falling back to redirect" >&2
-    login_mode="redirect"
-    ;;
-esac
-
-api() {
-  local method="$1"
-  local path="$2"
-  local data="${3:-}"
-
-  if [[ -n "$data" ]]; then
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      -H "Content-Type: application/json" \
-      -d "$data" \
-      "${authentik_url}${path}"
-  else
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      "${authentik_url}${path}"
-  fi
-}
-
-wait_for_authentik() {
-  for _ in $(seq 1 90); do
-    if curl -fsS "${authentik_url}/-/health/ready/" >/dev/null 2>&1; then
-      return 0
-    fi
-    sleep 2
-  done
-  echo "error: Authentik did not become ready at ${authentik_url}" >&2
-  exit 1
-}
-
-lookup_single_result() {
-  local path="$1"
-  local jq_filter="$2"
-
-  api GET "$path" | jq -r "$jq_filter" | head -n1
-}
-
-wait_for_authentik
-
-flow_pk="$(
-  lookup_single_result \
-    "/api/v3/flows/instances/?slug=${authentication_flow_slug}" \
-    '.results[] | select(.slug != null) | .pk // empty'
-)"
-if [[ -z "$flow_pk" ]]; then
-  echo "error: could not resolve Authentik authentication flow slug ${authentication_flow_slug}" >&2
-  exit 1
-fi
-
-enrollment_flow_pk="$(
-  lookup_single_result \
-    "/api/v3/flows/instances/?slug=${enrollment_flow_slug}" \
-    '.results[] | select(.slug != null) | .pk // empty'
-)"
-if [[ -z "$enrollment_flow_pk" ]]; then
-  echo "error: could not resolve Authentik enrollment flow slug ${enrollment_flow_slug}" >&2
-  exit 1
-fi
-
-identification_stage="$(
-  api GET "/api/v3/stages/identification/" \
-    | jq -c --arg name "$identification_stage_name" '.results[] | select(.name == $name)'
-)"
-if [[ -z "$identification_stage" ]]; then
-  echo "error: could not resolve Authentik identification stage ${identification_stage_name}" >&2
-  exit 1
-fi
-
-stage_pk="$(printf '%s\n' "$identification_stage" | jq -r '.pk')"
-
-property_mapping_payload='[]'
-if [[ "$(printf '%s' "$google_account_map_json" | jq 'length')" -gt 0 ]]; then
-  alias_map_python="$(
-    printf '%s' "$google_account_map_json" \
-      | jq -c '
-          map({
-            key: (.source_email | ascii_downcase),
-            value: {
-              username: .username,
-              email: .email,
-              name: .name
-            }
-          })
-          | from_entries
-        '
-  )"
-
-  oauth_property_mapping_expression="$(
-    cat <<EOF
-email = (info.get("email") or "").strip().lower()
-alias_map = ${alias_map_python}
-mapped = alias_map.get(email)
-if not mapped:
-    return {}
-result = {}
-for key in ("username", "email", "name"):
-    value = mapped.get(key)
-    if value:
-        result[key] = value
-return result
-EOF
-  )"
-
-  oauth_property_mapping_payload="$(
-    jq -n \
-      --arg name "$property_mapping_name" \
-      --arg expression "$oauth_property_mapping_expression" \
-      '{
-        name: $name,
-        expression: $expression
-      }'
-  )"
-
-  existing_property_mapping="$(
-    api GET "/api/v3/propertymappings/source/oauth/?page_size=200" \
-      | jq -c --arg name "$property_mapping_name" '.results[]? | select(.name == $name)'
-  )"
-
-  if [[ -n "$existing_property_mapping" ]]; then
-    property_mapping_pk="$(printf '%s\n' "$existing_property_mapping" | jq -r '.pk')"
-    api PATCH "/api/v3/propertymappings/source/oauth/${property_mapping_pk}/" "$oauth_property_mapping_payload" >/dev/null
-  else
-    property_mapping_pk="$(
-      api POST "/api/v3/propertymappings/source/oauth/" "$oauth_property_mapping_payload" \
-        | jq -r '.pk // empty'
-    )"
-  fi
-
-  if [[ -z "${property_mapping_pk:-}" ]]; then
-    echo "error: Google OAuth property mapping did not return a primary key" >&2
-    exit 1
-  fi
-
-  property_mapping_payload="$(jq -cn --arg property_mapping_pk "$property_mapping_pk" '[$property_mapping_pk]')"
-fi
-
-oauth_source_payload="$(
-  jq -n \
-    --arg name "$source_name" \
-    --arg slug "$source_slug" \
-    --arg authentication_flow "$flow_pk" \
-    --arg enrollment_flow "$enrollment_flow_pk" \
-    --arg user_matching_mode "$user_matching_mode" \
-    --arg policy_engine_mode "$policy_engine_mode" \
-    --argjson user_property_mappings "$property_mapping_payload" \
-    --arg consumer_key "$google_client_id" \
-    --arg consumer_secret "$google_client_secret" \
-    '{
-      name: $name,
-      slug: $slug,
-      enabled: true,
-      promoted: true,
-      authentication_flow: $authentication_flow,
-      enrollment_flow: $enrollment_flow,
-      user_property_mappings: $user_property_mappings,
-      group_property_mappings: [],
-      policy_engine_mode: $policy_engine_mode,
-      user_matching_mode: $user_matching_mode,
-      provider_type: "google",
-      consumer_key: $consumer_key,
-      consumer_secret: $consumer_secret
-    }'
-)"
-
-existing_source="$(
-  api GET "/api/v3/sources/oauth/?slug=${source_slug}" \
-    | jq -c '.results[]?'
-)"
-
-if [[ -n "$existing_source" ]]; then
-  source_pk="$(printf '%s\n' "$existing_source" | jq -r '.pk')"
-  api PATCH "/api/v3/sources/oauth/${source_slug}/" "$oauth_source_payload" >/dev/null
-else
-  source_pk="$(
-    api POST "/api/v3/sources/oauth/" "$oauth_source_payload" \
-      | jq -r '.pk // empty'
-  )"
-fi
-
-if [[ -z "$source_pk" ]]; then
-  echo "error: Google OAuth source did not return a primary key" >&2
-  exit 1
-fi
-
-stage_patch="$(
-  printf '%s\n' "$identification_stage" \
-    | jq -c \
-      --arg source_pk "$source_pk" \
-      --arg login_mode "$login_mode" '
-      .sources = (
-        if $login_mode == "redirect" then
-          [$source_pk]
-        else
-          ([ $source_pk ] + ((.sources // []) | map(select(. != $source_pk))))
-        end
-      )
-      | .show_source_labels = true
-      | if $login_mode == "redirect" then
-          .user_fields = []
-        else
-          .
-        end
-      | {
-          sources,
-          show_source_labels,
-          user_fields
-        }'
-)"
-
-api PATCH "/api/v3/stages/identification/${stage_pk}/" "$stage_patch" >/dev/null
-
-echo "Synced Authentik Google source ${source_slug} (${source_pk}) in ${login_mode} mode."
diff --git a/Scripts/authentik-sync-google-wif-oidc.sh b/Scripts/authentik-sync-google-wif-oidc.sh
deleted file mode 100755
index c8bae10..0000000
--- a/Scripts/authentik-sync-google-wif-oidc.sh
+++ /dev/null
@@ -1,347 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-authentik_url="${AUTHENTIK_URL:-https://auth.burrow.net}"
-bootstrap_token="${AUTHENTIK_BOOTSTRAP_TOKEN:-}"
-application_slug="${AUTHENTIK_GOOGLE_WIF_APPLICATION_SLUG:-google-cloud}"
-application_name="${AUTHENTIK_GOOGLE_WIF_APPLICATION_NAME:-Google Cloud WIF}"
-provider_name="${AUTHENTIK_GOOGLE_WIF_PROVIDER_NAME:-Google Cloud WIF}"
-template_slug="${AUTHENTIK_GOOGLE_WIF_TEMPLATE_SLUG:-ts}"
-client_id="${AUTHENTIK_GOOGLE_WIF_CLIENT_ID:-google-wif.burrow.net}"
-client_secret="${AUTHENTIK_GOOGLE_WIF_CLIENT_SECRET:-}"
-launch_url="${AUTHENTIK_GOOGLE_WIF_LAUNCH_URL:-https://console.cloud.google.com/}"
-redirect_uris_json="${AUTHENTIK_GOOGLE_WIF_REDIRECT_URIS_JSON:-[]}"
-access_group="${AUTHENTIK_GOOGLE_WIF_ACCESS_GROUP:-}"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/authentik-sync-google-wif-oidc.sh
-
-Reconciles the Authentik OIDC provider used as the Google Workload Identity
-Federation issuer for Burrow release runners.
-
-Required environment:
-  AUTHENTIK_BOOTSTRAP_TOKEN
-  AUTHENTIK_GOOGLE_WIF_CLIENT_SECRET
-
-Optional environment:
-  AUTHENTIK_URL
-  AUTHENTIK_GOOGLE_WIF_APPLICATION_SLUG
-  AUTHENTIK_GOOGLE_WIF_APPLICATION_NAME
-  AUTHENTIK_GOOGLE_WIF_PROVIDER_NAME
-  AUTHENTIK_GOOGLE_WIF_TEMPLATE_SLUG
-  AUTHENTIK_GOOGLE_WIF_CLIENT_ID
-  AUTHENTIK_GOOGLE_WIF_LAUNCH_URL
-  AUTHENTIK_GOOGLE_WIF_REDIRECT_URIS_JSON
-  AUTHENTIK_GOOGLE_WIF_ACCESS_GROUP (optional; leave empty for client credentials)
-
-AUTHENTIK_GOOGLE_WIF_CLIENT_SECRET is the Authentik client-credentials secret
-used by Forgejo runners. For service-account authentication, store
-base64("<service-account-username>:<app-password-token>").
-EOF
-}
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-if [[ -z "$bootstrap_token" ]]; then
-  echo "error: AUTHENTIK_BOOTSTRAP_TOKEN is required" >&2
-  exit 1
-fi
-
-if [[ -z "$client_secret" || "$client_secret" == PENDING* ]]; then
-  echo "Google WIF OIDC client secret is not configured; skipping Authentik Google WIF sync." >&2
-  exit 0
-fi
-
-if ! printf '%s' "$redirect_uris_json" | jq -e 'type == "array"' >/dev/null; then
-  echo "error: AUTHENTIK_GOOGLE_WIF_REDIRECT_URIS_JSON must be a JSON array" >&2
-  exit 1
-fi
-
-api() {
-  local method="$1"
-  local path="$2"
-  local data="${3:-}"
-
-  if [[ -n "$data" ]]; then
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      -H "Content-Type: application/json" \
-      -d "$data" \
-      "${authentik_url}${path}"
-  else
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      "${authentik_url}${path}"
-  fi
-}
-
-api_with_status() {
-  local method="$1"
-  local path="$2"
-  local data="${3:-}"
-  local response_file status
-
-  response_file="$(mktemp)"
-  trap 'rm -f "$response_file"' RETURN
-
-  if [[ -n "$data" ]]; then
-    status="$(
-      curl -sS \
-        -o "$response_file" \
-        -w '%{http_code}' \
-        -X "$method" \
-        -H "Authorization: Bearer ${bootstrap_token}" \
-        -H "Content-Type: application/json" \
-        -d "$data" \
-        "${authentik_url}${path}"
-    )"
-  else
-    status="$(
-      curl -sS \
-        -o "$response_file" \
-        -w '%{http_code}' \
-        -X "$method" \
-        -H "Authorization: Bearer ${bootstrap_token}" \
-        "${authentik_url}${path}"
-    )"
-  fi
-
-  printf '%s\n' "$status"
-  cat "$response_file"
-}
-
-wait_for_authentik() {
-  for _ in $(seq 1 90); do
-    if curl -fsS "${authentik_url}/-/health/ready/" >/dev/null 2>&1; then
-      return 0
-    fi
-    sleep 2
-  done
-  echo "error: Authentik did not become ready at ${authentik_url}" >&2
-  exit 1
-}
-
-wait_for_authentik
-
-template_provider="$(
-  api GET "/api/v3/providers/oauth2/?page_size=200" \
-    | jq -c --arg slug "$template_slug" '.results[]? | select(.assigned_application_slug == $slug)' \
-    | head -n1
-)"
-
-if [[ -z "$template_provider" ]]; then
-  echo "error: could not resolve Authentik OAuth provider template ${template_slug}" >&2
-  exit 1
-fi
-
-authorization_flow="$(printf '%s\n' "$template_provider" | jq -r '.authorization_flow')"
-invalidation_flow="$(printf '%s\n' "$template_provider" | jq -r '.invalidation_flow')"
-property_mappings="$(printf '%s\n' "$template_provider" | jq -c '.property_mappings')"
-signing_key="$(printf '%s\n' "$template_provider" | jq -r '.signing_key')"
-
-provider_payload="$(
-  jq -n \
-    --arg name "$provider_name" \
-    --arg authorization_flow "$authorization_flow" \
-    --arg invalidation_flow "$invalidation_flow" \
-    --arg client_id "$client_id" \
-    --arg client_secret "$client_secret" \
-    --arg signing_key "$signing_key" \
-    --argjson property_mappings "$property_mappings" \
-    --argjson redirect_uris "$redirect_uris_json" \
-    '{
-      name: $name,
-      authorization_flow: $authorization_flow,
-      invalidation_flow: $invalidation_flow,
-      client_type: "confidential",
-      grant_types: ["client_credentials"],
-      client_id: $client_id,
-      client_secret: $client_secret,
-      include_claims_in_id_token: true,
-      redirect_uris: ($redirect_uris | map({matching_mode: "strict", url: .})),
-      property_mappings: $property_mappings,
-      signing_key: $signing_key,
-      issuer_mode: "per_provider",
-      sub_mode: "hashed_user_id"
-    }'
-)"
-
-existing_provider="$(
-  api GET "/api/v3/providers/oauth2/?page_size=200" \
-    | jq -c \
-      --arg application_slug "$application_slug" \
-      --arg provider_name "$provider_name" \
-      '.results[]? | select(.assigned_application_slug == $application_slug or .name == $provider_name)' \
-    | head -n1
-)"
-
-if [[ -n "$existing_provider" ]]; then
-  provider_pk="$(printf '%s\n' "$existing_provider" | jq -r '.pk')"
-  api PATCH "/api/v3/providers/oauth2/${provider_pk}/" "$provider_payload" >/dev/null
-else
-  provider_pk="$(
-    api POST "/api/v3/providers/oauth2/" "$provider_payload" \
-      | jq -r '.pk // empty'
-  )"
-fi
-
-if [[ -z "${provider_pk:-}" ]]; then
-  echo "error: Google WIF OIDC provider did not return a primary key" >&2
-  exit 1
-fi
-
-application_payload="$(
-  jq -n \
-    --arg name "$application_name" \
-    --arg slug "$application_slug" \
-    --arg provider "$provider_pk" \
-    --arg launch_url "$launch_url" \
-    '{
-      name: $name,
-      slug: $slug,
-      provider: ($provider | tonumber),
-      meta_launch_url: $launch_url,
-      open_in_new_tab: false,
-      policy_engine_mode: "any"
-    }'
-)"
-
-existing_application="$(
-  api GET "/api/v3/core/applications/?page_size=200" \
-    | jq -c --arg slug "$application_slug" '.results[]? | select(.slug == $slug)' \
-    | head -n1
-)"
-
-if [[ -z "$existing_application" ]]; then
-  direct_application_result="$(api_with_status GET "/api/v3/core/applications/${application_slug}/")"
-  direct_application_status="$(printf '%s\n' "$direct_application_result" | sed -n '1p')"
-  direct_application_body="$(printf '%s\n' "$direct_application_result" | sed '1d')"
-  if [[ "$direct_application_status" == "200" ]]; then
-    existing_application="$direct_application_body"
-  fi
-fi
-
-if [[ -n "$existing_application" ]]; then
-  application_pk="$(printf '%s\n' "$existing_application" | jq -r '.pk')"
-  api PATCH "/api/v3/core/applications/${application_slug}/" "$application_payload" >/dev/null
-else
-  create_application_result="$(
-    api_with_status POST "/api/v3/core/applications/" "$application_payload"
-  )"
-  create_application_status="$(printf '%s\n' "$create_application_result" | sed -n '1p')"
-  create_application_body="$(printf '%s\n' "$create_application_result" | sed '1d')"
-
-  if [[ "$create_application_status" =~ ^20[01]$ ]]; then
-    application_pk="$(printf '%s\n' "$create_application_body" | jq -r '.pk // empty')"
-  elif [[ "$create_application_status" == "400" ]] && printf '%s\n' "$create_application_body" | jq -e '
-      (.slug // [] | index("Application with this slug already exists.")) != null
-      or (.provider // [] | index("Application with this provider already exists.")) != null
-    ' >/dev/null; then
-    application_pk="$(
-      api GET "/api/v3/core/applications/?page_size=200" \
-        | jq -r --arg slug "$application_slug" '.results[]? | select(.slug == $slug) | .pk // empty' \
-        | head -n1
-    )"
-    if [[ -z "$application_pk" ]]; then
-      direct_application_result="$(api_with_status GET "/api/v3/core/applications/${application_slug}/")"
-      direct_application_status="$(printf '%s\n' "$direct_application_result" | sed -n '1p')"
-      direct_application_body="$(printf '%s\n' "$direct_application_result" | sed '1d')"
-      if [[ "$direct_application_status" == "200" ]]; then
-        application_pk="$(printf '%s\n' "$direct_application_body" | jq -r '.pk // empty')"
-      fi
-    fi
-  else
-    printf '%s\n' "$create_application_body" >&2
-    echo "error: could not reconcile Authentik application ${application_slug}" >&2
-    exit 1
-  fi
-fi
-
-if [[ -z "${application_pk:-}" ]]; then
-  echo "error: Google WIF OIDC application did not return a primary key" >&2
-  exit 1
-fi
-
-delete_binding() {
-  local binding_pk="$1"
-  api DELETE "/api/v3/policies/bindings/${binding_pk}/" >/dev/null || true
-}
-
-delete_application_group_bindings_except() {
-  local keep_group_pk="${1:-}"
-  local binding_pks
-
-  binding_pks="$(
-    api GET "/api/v3/policies/bindings/?page_size=500" \
-      | jq -r \
-        --arg target "$application_pk" \
-        --arg keep_group "$keep_group_pk" \
-        '.results[]?
-          | select((.target | tostring) == $target and .group != null)
-          | select(($keep_group == "") or ((.group | tostring) != $keep_group))
-          | .pk'
-  )"
-
-  while IFS= read -r binding_pk; do
-    [[ -n "$binding_pk" ]] || continue
-    delete_binding "$binding_pk"
-  done <<< "$binding_pks"
-}
-
-if [[ -n "$access_group" ]]; then
-  group_pk="$(
-    api GET "/api/v3/core/groups/?page_size=200" \
-      | jq -r --arg name "$access_group" '.results[]? | select(.name == $name) | .pk' \
-      | head -n1
-  )"
-  if [[ -z "$group_pk" ]]; then
-    echo "warning: Authentik Google WIF access group ${access_group} was not found; application policy left unchanged." >&2
-  else
-    delete_application_group_bindings_except "$group_pk"
-    existing_binding="$(
-      api GET "/api/v3/policies/bindings/?page_size=500" \
-        | jq -r \
-          --arg target "$application_pk" \
-          --arg group "$group_pk" \
-          '.results[]?
-            | select((.target | tostring) == $target and (.group | tostring) == $group)
-            | .pk' \
-        | head -n1
-    )"
-    if [[ -z "$existing_binding" ]]; then
-      api POST "/api/v3/policies/bindings/" "$(
-        jq -n \
-          --arg target "$application_pk" \
-          --arg group "$group_pk" \
-          '{
-            target: $target,
-            group: $group,
-            negate: false,
-            order: 0,
-            enabled: true,
-            timeout: 30,
-            failure_result: false
-          }'
-      )" >/dev/null || true
-    fi
-  fi
-else
-  delete_application_group_bindings_except ""
-fi
-
-for _ in $(seq 1 30); do
-  if curl -fsS "${authentik_url}/application/o/${application_slug}/.well-known/openid-configuration" >/dev/null 2>&1; then
-    echo "Synced Authentik Google WIF OIDC application ${application_slug} (${application_name})."
-    exit 0
-  fi
-  sleep 2
-done
-
-echo "warning: Google WIF OIDC issuer document for ${application_slug} was not immediately readable; keeping reconciled config." >&2
-echo "Synced Authentik Google WIF OIDC application ${application_slug} (${application_name})."
diff --git a/Scripts/authentik-sync-grafana-oidc.sh b/Scripts/authentik-sync-grafana-oidc.sh
deleted file mode 100755
index 0d32c06..0000000
--- a/Scripts/authentik-sync-grafana-oidc.sh
+++ /dev/null
@@ -1,332 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-authentik_url="${AUTHENTIK_URL:-https://auth.burrow.net}"
-bootstrap_token="${AUTHENTIK_BOOTSTRAP_TOKEN:-}"
-application_slug="${AUTHENTIK_GRAFANA_APPLICATION_SLUG:-grafana}"
-application_name="${AUTHENTIK_GRAFANA_APPLICATION_NAME:-Burrow Grafana}"
-provider_name="${AUTHENTIK_GRAFANA_PROVIDER_NAME:-Burrow Grafana}"
-template_slug="${AUTHENTIK_GRAFANA_TEMPLATE_SLUG:-ts}"
-client_id="${AUTHENTIK_GRAFANA_CLIENT_ID:-graphs.burrow.net}"
-client_secret="${AUTHENTIK_GRAFANA_CLIENT_SECRET:-}"
-launch_url="${AUTHENTIK_GRAFANA_LAUNCH_URL:-https://graphs.burrow.net/}"
-access_group="${AUTHENTIK_GRAFANA_ACCESS_GROUP:-}"
-redirect_uris_json="${AUTHENTIK_GRAFANA_REDIRECT_URIS_JSON:-[
-  \"https://graphs.burrow.net/login/generic_oauth\"
-]}"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/authentik-sync-grafana-oidc.sh
-
-Required environment:
-  AUTHENTIK_BOOTSTRAP_TOKEN
-  AUTHENTIK_GRAFANA_CLIENT_SECRET
-
-Optional environment:
-  AUTHENTIK_URL
-  AUTHENTIK_GRAFANA_APPLICATION_SLUG
-  AUTHENTIK_GRAFANA_APPLICATION_NAME
-  AUTHENTIK_GRAFANA_PROVIDER_NAME
-  AUTHENTIK_GRAFANA_TEMPLATE_SLUG
-  AUTHENTIK_GRAFANA_CLIENT_ID
-  AUTHENTIK_GRAFANA_LAUNCH_URL
-  AUTHENTIK_GRAFANA_REDIRECT_URIS_JSON
-  AUTHENTIK_GRAFANA_ACCESS_GROUP
-EOF
-}
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-if [[ -z "$bootstrap_token" ]]; then
-  echo "error: AUTHENTIK_BOOTSTRAP_TOKEN is required" >&2
-  exit 1
-fi
-
-if [[ -z "$client_secret" || "$client_secret" == PENDING* ]]; then
-  echo "Grafana OIDC client secret is not configured; skipping Authentik Grafana sync." >&2
-  exit 0
-fi
-
-if ! printf '%s' "$redirect_uris_json" | jq -e 'type == "array" and length > 0' >/dev/null; then
-  echo "error: AUTHENTIK_GRAFANA_REDIRECT_URIS_JSON must be a non-empty JSON array" >&2
-  exit 1
-fi
-
-api() {
-  local method="$1"
-  local path="$2"
-  local data="${3:-}"
-
-  if [[ -n "$data" ]]; then
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      -H "Content-Type: application/json" \
-      -d "$data" \
-      "${authentik_url}${path}"
-  else
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      "${authentik_url}${path}"
-  fi
-}
-
-api_with_status() {
-  local method="$1"
-  local path="$2"
-  local data="${3:-}"
-  local response_file status
-
-  response_file="$(mktemp)"
-  trap 'rm -f "$response_file"' RETURN
-
-  if [[ -n "$data" ]]; then
-    status="$(
-      curl -sS \
-        -o "$response_file" \
-        -w '%{http_code}' \
-        -X "$method" \
-        -H "Authorization: Bearer ${bootstrap_token}" \
-        -H "Content-Type: application/json" \
-        -d "$data" \
-        "${authentik_url}${path}"
-    )"
-  else
-    status="$(
-      curl -sS \
-        -o "$response_file" \
-        -w '%{http_code}' \
-        -X "$method" \
-        -H "Authorization: Bearer ${bootstrap_token}" \
-        "${authentik_url}${path}"
-    )"
-  fi
-
-  printf '%s\n' "$status"
-  cat "$response_file"
-}
-
-wait_for_authentik() {
-  for _ in $(seq 1 90); do
-    if curl -fsS "${authentik_url}/-/health/ready/" >/dev/null 2>&1; then
-      return 0
-    fi
-    sleep 2
-  done
-  echo "error: Authentik did not become ready at ${authentik_url}" >&2
-  exit 1
-}
-
-lookup_group_pk() {
-  local group_name="$1"
-
-  api GET "/api/v3/core/groups/?page_size=200" \
-    | jq -r --arg group_name "$group_name" '.results[]? | select(.name == $group_name) | .pk // empty' \
-    | head -n1
-}
-
-lookup_application_pk() {
-  local slug="$1"
-  local application_pk lookup_result lookup_status
-
-  application_pk="$(
-    api GET "/api/v3/core/applications/?page_size=200" \
-    | jq -r --arg slug "$slug" '.results[]? | select(.slug == $slug) | .pk // empty' \
-    | head -n1
-  )"
-
-  if [[ -n "$application_pk" ]]; then
-    printf '%s\n' "$application_pk"
-    return 0
-  fi
-
-  lookup_result="$(api_with_status GET "/api/v3/core/applications/${slug}/")"
-  lookup_status="$(printf '%s\n' "$lookup_result" | sed -n '1p')"
-  if [[ "$lookup_status" =~ ^20[01]$ ]]; then
-    printf '%s\n' "$lookup_result" | sed '1d' | jq -r '.pk // empty'
-  fi
-}
-
-ensure_application_group_binding() {
-  local application_slug="$1"
-  local group_name="$2"
-  local application_pk group_pk existing payload binding_pk
-
-  application_pk="$(lookup_application_pk "$application_slug")"
-  if [[ -z "$application_pk" ]]; then
-    echo "warning: could not resolve Authentik application ${application_slug}; skipping application group binding" >&2
-    return 0
-  fi
-
-  group_pk="$(lookup_group_pk "$group_name")"
-  if [[ -z "$group_pk" ]]; then
-    echo "error: could not resolve Authentik group ${group_name}" >&2
-    exit 1
-  fi
-
-  existing="$(
-    api GET "/api/v3/policies/bindings/?page_size=200&target=${application_pk}" \
-      | jq -c --arg group_pk "$group_pk" '.results[]? | select(.group == $group_pk)' \
-      | head -n1
-  )"
-
-  payload="$(
-    jq -cn \
-      --arg target "$application_pk" \
-      --arg group "$group_pk" \
-      '{
-        group: $group,
-        target: $target,
-        negate: false,
-        enabled: true,
-        order: 100,
-        timeout: 30,
-        failure_result: false
-      }'
-  )"
-
-  if [[ -n "$existing" ]]; then
-    binding_pk="$(printf '%s\n' "$existing" | jq -r '.pk')"
-    api PATCH "/api/v3/policies/bindings/${binding_pk}/" "$payload" >/dev/null
-  else
-    api POST "/api/v3/policies/bindings/" "$payload" >/dev/null
-  fi
-}
-
-wait_for_authentik
-
-template_provider="$(
-  api GET "/api/v3/providers/oauth2/?page_size=200" \
-    | jq -c --arg template_slug "$template_slug" '.results[]? | select(.assigned_application_slug == $template_slug)' \
-    | head -n1
-)"
-
-if [[ -z "$template_provider" ]]; then
-  echo "error: could not resolve the Authentik OAuth provider template ${template_slug}" >&2
-  exit 1
-fi
-
-authorization_flow="$(printf '%s\n' "$template_provider" | jq -r '.authorization_flow')"
-invalidation_flow="$(printf '%s\n' "$template_provider" | jq -r '.invalidation_flow')"
-property_mappings="$(printf '%s\n' "$template_provider" | jq -c '.property_mappings')"
-signing_key="$(printf '%s\n' "$template_provider" | jq -r '.signing_key')"
-
-provider_payload="$(
-  jq -n \
-    --arg name "$provider_name" \
-    --arg authorization_flow "$authorization_flow" \
-    --arg invalidation_flow "$invalidation_flow" \
-    --arg client_id "$client_id" \
-    --arg client_secret "$client_secret" \
-    --arg signing_key "$signing_key" \
-    --argjson property_mappings "$property_mappings" \
-    --argjson redirect_uris "$redirect_uris_json" \
-    '{
-      name: $name,
-      authorization_flow: $authorization_flow,
-      invalidation_flow: $invalidation_flow,
-      client_type: "confidential",
-      client_id: $client_id,
-      client_secret: $client_secret,
-      include_claims_in_id_token: true,
-      redirect_uris: ($redirect_uris | map({matching_mode: "strict", url: .})),
-      property_mappings: $property_mappings,
-      signing_key: $signing_key,
-      issuer_mode: "per_provider",
-      sub_mode: "hashed_user_id"
-    }'
-)"
-
-existing_provider="$(
-  api GET "/api/v3/providers/oauth2/?page_size=200" \
-    | jq -c \
-      --arg application_slug "$application_slug" \
-      --arg provider_name "$provider_name" \
-      '.results[]? | select(.assigned_application_slug == $application_slug or .name == $provider_name)' \
-    | head -n1
-)"
-
-if [[ -n "$existing_provider" ]]; then
-  provider_pk="$(printf '%s\n' "$existing_provider" | jq -r '.pk')"
-  api PATCH "/api/v3/providers/oauth2/${provider_pk}/" "$provider_payload" >/dev/null
-else
-  provider_pk="$(
-    api POST "/api/v3/providers/oauth2/" "$provider_payload" \
-      | jq -r '.pk // empty'
-  )"
-fi
-
-if [[ -z "${provider_pk:-}" ]]; then
-  echo "error: Grafana OIDC provider did not return a primary key" >&2
-  exit 1
-fi
-
-application_payload="$(
-  jq -n \
-    --arg name "$application_name" \
-    --arg slug "$application_slug" \
-    --arg provider "$provider_pk" \
-    --arg launch_url "$launch_url" \
-    '{
-      name: $name,
-      slug: $slug,
-      provider: ($provider | tonumber),
-      meta_launch_url: $launch_url,
-      open_in_new_tab: false,
-      policy_engine_mode: "any"
-    }'
-)"
-
-existing_application="$(
-  api GET "/api/v3/core/applications/?page_size=200" \
-    | jq -c --arg slug "$application_slug" '.results[]? | select(.slug == $slug)' \
-    | head -n1
-)"
-
-if [[ -n "$existing_application" ]]; then
-  application_pk="$(printf '%s\n' "$existing_application" | jq -r '.pk')"
-else
-  create_application_result="$(
-    api_with_status POST "/api/v3/core/applications/" "$application_payload"
-  )"
-  create_application_status="$(printf '%s\n' "$create_application_result" | sed -n '1p')"
-  create_application_body="$(printf '%s\n' "$create_application_result" | sed '1d')"
-
-  if [[ "$create_application_status" =~ ^20[01]$ ]]; then
-    application_pk="$(printf '%s\n' "$create_application_body" | jq -r '.pk // empty')"
-  elif [[ "$create_application_status" == "400" ]] && printf '%s\n' "$create_application_body" | jq -e '
-      (.slug // [] | index("Application with this slug already exists.")) != null
-      or (.provider // [] | index("Application with this provider already exists.")) != null
-    ' >/dev/null; then
-    application_pk="existing-duplicate"
-  else
-    printf '%s\n' "$create_application_body" >&2
-    echo "error: could not reconcile Authentik application ${application_slug}" >&2
-    exit 1
-  fi
-fi
-
-if [[ -z "${application_pk:-}" ]]; then
-  echo "error: Grafana OIDC application did not return a primary key" >&2
-  exit 1
-fi
-
-if [[ -n "$access_group" ]]; then
-  ensure_application_group_binding "$application_slug" "$access_group"
-fi
-
-for _ in $(seq 1 30); do
-  if curl -fsS "${authentik_url}/application/o/${application_slug}/.well-known/openid-configuration" >/dev/null 2>&1; then
-    echo "Synced Authentik Grafana OIDC application ${application_slug} (${application_name})."
-    exit 0
-  fi
-  sleep 2
-done
-
-echo "warning: Grafana OIDC issuer document for ${application_slug} was not immediately readable; keeping reconciled config." >&2
-echo "Synced Authentik Grafana OIDC application ${application_slug} (${application_name})."
diff --git a/Scripts/authentik-sync-linear-saml.sh b/Scripts/authentik-sync-linear-saml.sh
deleted file mode 100755
index 5da64ad..0000000
--- a/Scripts/authentik-sync-linear-saml.sh
+++ /dev/null
@@ -1,344 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-authentik_url="${AUTHENTIK_URL:-https://auth.burrow.net}"
-bootstrap_token="${AUTHENTIK_BOOTSTRAP_TOKEN:-}"
-application_slug="${AUTHENTIK_LINEAR_APPLICATION_SLUG:-linear}"
-application_name="${AUTHENTIK_LINEAR_APPLICATION_NAME:-Linear}"
-provider_name="${AUTHENTIK_LINEAR_PROVIDER_NAME:-Linear}"
-launch_url="${AUTHENTIK_LINEAR_LAUNCH_URL:-https://linear.app/burrownet}"
-acs_url="${AUTHENTIK_LINEAR_ACS_URL:-}"
-audience="${AUTHENTIK_LINEAR_AUDIENCE:-}"
-issuer="${AUTHENTIK_LINEAR_ISSUER:-${authentik_url}/application/saml/${application_slug}/metadata/}"
-default_relay_state="${AUTHENTIK_LINEAR_DEFAULT_RELAY_STATE:-}"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/authentik-sync-linear-saml.sh
-
-Required environment:
-  AUTHENTIK_BOOTSTRAP_TOKEN
-  AUTHENTIK_LINEAR_ACS_URL
-  AUTHENTIK_LINEAR_AUDIENCE
-
-Optional environment:
-  AUTHENTIK_URL
-  AUTHENTIK_LINEAR_APPLICATION_SLUG
-  AUTHENTIK_LINEAR_APPLICATION_NAME
-  AUTHENTIK_LINEAR_PROVIDER_NAME
-  AUTHENTIK_LINEAR_LAUNCH_URL
-  AUTHENTIK_LINEAR_ISSUER
-  AUTHENTIK_LINEAR_DEFAULT_RELAY_STATE
-EOF
-}
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-if [[ -z "$bootstrap_token" ]]; then
-  echo "error: AUTHENTIK_BOOTSTRAP_TOKEN is required" >&2
-  exit 1
-fi
-
-if [[ -z "$acs_url" ]]; then
-  echo "error: AUTHENTIK_LINEAR_ACS_URL is required" >&2
-  exit 1
-fi
-
-if [[ -z "$audience" ]]; then
-  echo "error: AUTHENTIK_LINEAR_AUDIENCE is required" >&2
-  exit 1
-fi
-
-api() {
-  local method="$1"
-  local path="$2"
-  local data="${3:-}"
-
-  if [[ -n "$data" ]]; then
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      -H "Content-Type: application/json" \
-      -d "$data" \
-      "${authentik_url}${path}"
-  else
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      "${authentik_url}${path}"
-  fi
-}
-
-api_with_status() {
-  local method="$1"
-  local path="$2"
-  local data="${3:-}"
-  local response_file status
-
-  response_file="$(mktemp)"
-  trap 'rm -f "$response_file"' RETURN
-
-  if [[ -n "$data" ]]; then
-    status="$(
-      curl -sS \
-        -o "$response_file" \
-        -w '%{http_code}' \
-        -X "$method" \
-        -H "Authorization: Bearer ${bootstrap_token}" \
-        -H "Content-Type: application/json" \
-        -d "$data" \
-        "${authentik_url}${path}"
-    )"
-  else
-    status="$(
-      curl -sS \
-        -o "$response_file" \
-        -w '%{http_code}' \
-        -X "$method" \
-        -H "Authorization: Bearer ${bootstrap_token}" \
-        "${authentik_url}${path}"
-    )"
-  fi
-
-  printf '%s\n' "$status"
-  cat "$response_file"
-}
-
-wait_for_authentik() {
-  for _ in $(seq 1 90); do
-    if curl -fsS "${authentik_url}/-/health/ready/" >/dev/null 2>&1; then
-      return 0
-    fi
-    sleep 2
-  done
-
-  echo "error: Authentik did not become ready at ${authentik_url}" >&2
-  exit 1
-}
-
-lookup_oauth_template_field() {
-  local field="$1"
-
-  api GET "/api/v3/providers/oauth2/?page_size=200" \
-    | jq -r --arg field "$field" '.results[]? | select(.assigned_application_slug == "ts") | .[$field]' \
-    | head -n1
-}
-
-reconcile_property_mapping() {
-  local name="$1"
-  local saml_name="$2"
-  local friendly_name="$3"
-  local expression="$4"
-  local payload existing_pk
-
-  payload="$(
-    jq -n \
-      --arg name "$name" \
-      --arg saml_name "$saml_name" \
-      --arg friendly_name "$friendly_name" \
-      --arg expression "$expression" \
-      '{
-        name: $name,
-        saml_name: $saml_name,
-        friendly_name: $friendly_name,
-        expression: $expression
-      }'
-  )"
-
-  existing_pk="$(
-    api GET "/api/v3/propertymappings/provider/saml/?page_size=200" \
-      | jq -r --arg name "$name" '.results[]? | select(.name == $name) | .pk' \
-      | head -n1
-  )"
-
-  if [[ -n "$existing_pk" ]]; then
-    api PATCH "/api/v3/propertymappings/provider/saml/${existing_pk}/" "$payload" >/dev/null
-    printf '%s\n' "$existing_pk"
-  else
-    api POST "/api/v3/propertymappings/provider/saml/" "$payload" | jq -r '.pk // empty'
-  fi
-}
-
-wait_for_authentik
-
-authorization_flow="$(lookup_oauth_template_field authorization_flow)"
-invalidation_flow="$(lookup_oauth_template_field invalidation_flow)"
-signing_kp="$(lookup_oauth_template_field signing_key)"
-
-if [[ -z "$authorization_flow" || -z "$invalidation_flow" || -z "$signing_kp" ]]; then
-  echo "error: could not resolve Authentik provider defaults from Burrow Tailnet template" >&2
-  exit 1
-fi
-
-email_mapping_pk="$(
-  reconcile_property_mapping \
-    "Burrow Linear SAML Email" \
-    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" \
-    "email" \
-    'return request.user.email'
-)"
-
-name_mapping_pk="$(
-  reconcile_property_mapping \
-    "Burrow Linear SAML Name" \
-    "name" \
-    "name" \
-    'return request.user.name or request.user.username'
-)"
-
-first_name_mapping_pk="$(
-  reconcile_property_mapping \
-    "Burrow Linear SAML First Name" \
-    "firstName" \
-    "firstName" \
-    $'parts = (request.user.name or "").split(" ", 1)\nif len(parts) > 0 and parts[0]:\n    return parts[0]\nreturn request.user.username'
-)"
-
-last_name_mapping_pk="$(
-  reconcile_property_mapping \
-    "Burrow Linear SAML Last Name" \
-    "lastName" \
-    "lastName" \
-    $'parts = (request.user.name or "").rsplit(" ", 1)\nif len(parts) == 2 and parts[1]:\n    return parts[1]\nreturn request.user.username'
-)"
-
-if [[ -z "$email_mapping_pk" || -z "$name_mapping_pk" || -z "$first_name_mapping_pk" || -z "$last_name_mapping_pk" ]]; then
-  echo "error: failed to reconcile Linear SAML property mappings" >&2
-  exit 1
-fi
-
-provider_payload="$(
-  jq -n \
-    --arg name "$provider_name" \
-    --arg authorization_flow "$authorization_flow" \
-    --arg invalidation_flow "$invalidation_flow" \
-    --arg acs_url "$acs_url" \
-    --arg audience "$audience" \
-    --arg issuer "$issuer" \
-    --arg signing_kp "$signing_kp" \
-    --arg default_relay_state "$default_relay_state" \
-    --arg name_id_mapping "$email_mapping_pk" \
-    --arg email_mapping "$email_mapping_pk" \
-    --arg name_mapping "$name_mapping_pk" \
-    --arg first_name_mapping "$first_name_mapping_pk" \
-    --arg last_name_mapping "$last_name_mapping_pk" \
-    '{
-      name: $name,
-      authorization_flow: $authorization_flow,
-      invalidation_flow: $invalidation_flow,
-      acs_url: $acs_url,
-      audience: $audience,
-      issuer: $issuer,
-      signing_kp: $signing_kp,
-      sign_assertion: true,
-      sign_response: true,
-      sp_binding: "post",
-      name_id_mapping: $name_id_mapping,
-      property_mappings: [
-        $email_mapping,
-        $name_mapping,
-        $first_name_mapping,
-        $last_name_mapping
-      ]
-    }
-    + (if $default_relay_state == "" then {} else {default_relay_state: $default_relay_state} end)'
-)"
-
-existing_provider="$(
-  api GET "/api/v3/providers/saml/?page_size=200" \
-    | jq -c \
-      --arg application_slug "$application_slug" \
-      --arg provider_name "$provider_name" \
-      '.results[]? | select(.assigned_application_slug == $application_slug or .name == $provider_name)' \
-    | head -n1
-)"
-
-if [[ -n "$existing_provider" ]]; then
-  provider_pk="$(printf '%s\n' "$existing_provider" | jq -r '.pk')"
-  api PATCH "/api/v3/providers/saml/${provider_pk}/" "$provider_payload" >/dev/null
-else
-  provider_pk="$(
-    api POST "/api/v3/providers/saml/" "$provider_payload" \
-      | jq -r '.pk // empty'
-  )"
-fi
-
-if [[ -z "${provider_pk:-}" ]]; then
-  echo "error: Linear SAML provider did not return a primary key" >&2
-  exit 1
-fi
-
-application_payload="$(
-  jq -n \
-    --arg name "$application_name" \
-    --arg slug "$application_slug" \
-    --arg provider "$provider_pk" \
-    --arg launch_url "$launch_url" \
-    '{
-      name: $name,
-      slug: $slug,
-      provider: ($provider | tonumber),
-      meta_launch_url: $launch_url,
-      open_in_new_tab: true,
-      policy_engine_mode: "any"
-    }'
-)"
-
-existing_application="$(
-  api GET "/api/v3/core/applications/?page_size=200" \
-    | jq -c --arg slug "$application_slug" '.results[]? | select(.slug == $slug)' \
-    | head -n1
-)"
-
-if [[ -n "$existing_application" ]]; then
-  application_pk="existing"
-  api PATCH "/api/v3/core/applications/${application_slug}/" "$application_payload" >/dev/null
-else
-  create_application_result="$(
-    api_with_status POST "/api/v3/core/applications/" "$application_payload"
-  )"
-  create_application_status="$(printf '%s\n' "$create_application_result" | sed -n '1p')"
-  create_application_body="$(printf '%s\n' "$create_application_result" | sed '1d')"
-
-  if [[ "$create_application_status" =~ ^20[01]$ ]]; then
-    application_pk="$(printf '%s\n' "$create_application_body" | jq -r '.pk // empty')"
-  elif [[ "$create_application_status" == "400" ]] && printf '%s\n' "$create_application_body" | jq -e '
-      (.slug // [] | index("Application with this slug already exists.")) != null
-      or (.provider // [] | index("Application with this provider already exists.")) != null
-    ' >/dev/null; then
-    application_pk="existing-duplicate"
-  else
-    printf '%s\n' "$create_application_body" >&2
-    echo "error: could not reconcile Authentik application ${application_slug}" >&2
-    exit 1
-  fi
-fi
-
-if [[ -z "${application_pk:-}" ]]; then
-  echo "error: Linear SAML application did not return a primary key" >&2
-  exit 1
-fi
-
-for _ in $(seq 1 30); do
-  metadata_status="$(
-    curl -sS \
-      -o /dev/null \
-      -w '%{http_code}' \
-      --max-redirs 0 \
-      "${authentik_url}/application/saml/${application_slug}/metadata/" \
-      || true
-  )"
-  case "$metadata_status" in
-    200|301|302|307|308)
-      echo "Synced Authentik Linear SAML application ${application_slug} (${application_name})."
-      exit 0
-      ;;
-  esac
-  sleep 2
-done
-
-echo "warning: Linear SAML metadata for ${application_slug} was not immediately readable; keeping reconciled config." >&2
-echo "Synced Authentik Linear SAML application ${application_slug} (${application_name})."
diff --git a/Scripts/authentik-sync-linear-scim.sh b/Scripts/authentik-sync-linear-scim.sh
deleted file mode 100644
index 4ef83e4..0000000
--- a/Scripts/authentik-sync-linear-scim.sh
+++ /dev/null
@@ -1,311 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-authentik_url="${AUTHENTIK_URL:-https://auth.burrow.net}"
-bootstrap_token="${AUTHENTIK_BOOTSTRAP_TOKEN:-}"
-application_slug="${AUTHENTIK_LINEAR_APPLICATION_SLUG:-linear}"
-provider_name="${AUTHENTIK_LINEAR_SCIM_PROVIDER_NAME:-Linear SCIM}"
-scim_url="${AUTHENTIK_LINEAR_SCIM_URL:-}"
-scim_token_file="${AUTHENTIK_LINEAR_SCIM_TOKEN_FILE:-}"
-user_identifier="${AUTHENTIK_LINEAR_SCIM_USER_IDENTIFIER:-email}"
-owner_group="${AUTHENTIK_LINEAR_OWNER_GROUP:-linear-owners}"
-admin_group="${AUTHENTIK_LINEAR_ADMIN_GROUP:-linear-admins}"
-guest_group="${AUTHENTIK_LINEAR_GUEST_GROUP:-linear-guests}"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/authentik-sync-linear-scim.sh
-
-Required environment:
-  AUTHENTIK_BOOTSTRAP_TOKEN
-  AUTHENTIK_LINEAR_SCIM_URL
-  AUTHENTIK_LINEAR_SCIM_TOKEN_FILE
-
-Optional environment:
-  AUTHENTIK_URL
-  AUTHENTIK_LINEAR_APPLICATION_SLUG
-  AUTHENTIK_LINEAR_SCIM_PROVIDER_NAME
-  AUTHENTIK_LINEAR_SCIM_USER_IDENTIFIER
-  AUTHENTIK_LINEAR_OWNER_GROUP
-  AUTHENTIK_LINEAR_ADMIN_GROUP
-  AUTHENTIK_LINEAR_GUEST_GROUP
-EOF
-}
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-if [[ -z "$bootstrap_token" ]]; then
-  echo "error: AUTHENTIK_BOOTSTRAP_TOKEN is required" >&2
-  exit 1
-fi
-
-if [[ -z "$scim_url" ]]; then
-  echo "error: AUTHENTIK_LINEAR_SCIM_URL is required" >&2
-  exit 1
-fi
-
-if [[ -z "$scim_token_file" || ! -s "$scim_token_file" ]]; then
-  echo "error: AUTHENTIK_LINEAR_SCIM_TOKEN_FILE is required and must be readable" >&2
-  exit 1
-fi
-
-api() {
-  local method="$1"
-  local path="$2"
-  local data="${3:-}"
-
-  if [[ -n "$data" ]]; then
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      -H "Content-Type: application/json" \
-      -d "$data" \
-      "${authentik_url}${path}"
-  else
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      "${authentik_url}${path}"
-  fi
-}
-
-wait_for_authentik() {
-  for _ in $(seq 1 90); do
-    if curl -fsS "${authentik_url}/-/health/ready/" >/dev/null 2>&1; then
-      return 0
-    fi
-    sleep 2
-  done
-
-  echo "error: Authentik did not become ready at ${authentik_url}" >&2
-  exit 1
-}
-
-lookup_group_pk() {
-  local group_name="$1"
-
-  api GET "/api/v3/core/groups/?page_size=200&search=${group_name}" \
-    | jq -r --arg name "$group_name" '.results[]? | select(.name == $name) | .pk // empty' \
-    | head -n1
-}
-
-ensure_group() {
-  local group_name="$1"
-  local payload group_pk
-
-  payload="$(jq -cn --arg name "$group_name" '{name: $name}')"
-  group_pk="$(lookup_group_pk "$group_name")"
-
-  if [[ -n "$group_pk" ]]; then
-    api PATCH "/api/v3/core/groups/${group_pk}/" "$payload" >/dev/null
-  else
-    group_pk="$(
-      api POST "/api/v3/core/groups/" "$payload" \
-        | jq -r '.pk // empty'
-    )"
-  fi
-
-  if [[ -z "$group_pk" ]]; then
-    echo "error: could not reconcile Authentik group ${group_name}" >&2
-    exit 1
-  fi
-
-  printf '%s\n' "$group_pk"
-}
-
-lookup_application() {
-  api GET "/api/v3/core/applications/?page_size=200" \
-    | jq -c --arg slug "$application_slug" '.results[]? | select(.slug == $slug)' \
-    | head -n1
-}
-
-lookup_scim_provider() {
-  api GET "/api/v3/providers/scim/?page_size=200" \
-    | jq -c \
-      --arg application_slug "$application_slug" \
-      --arg provider_name "$provider_name" \
-      '.results[]? | select(.assigned_backchannel_application_slug == $application_slug or .name == $provider_name)' \
-    | head -n1
-}
-
-lookup_scim_mapping_pk() {
-  local managed_name="$1"
-
-  api GET "/api/v3/propertymappings/provider/scim/?page_size=200" \
-    | jq -r --arg managed "$managed_name" '.results[]? | select(.managed == $managed) | .pk // empty' \
-      | head -n1
-}
-
-reconcile_property_mapping() {
-  local name="$1"
-  local expression="$2"
-  local payload existing_pk
-
-  payload="$(
-    jq -n \
-      --arg name "$name" \
-      --arg expression "$expression" \
-      '{
-        name: $name,
-        expression: $expression
-      }'
-  )"
-
-  existing_pk="$(
-    api GET "/api/v3/propertymappings/provider/scim/?page_size=200" \
-      | jq -r --arg name "$name" '.results[]? | select(.name == $name) | .pk // empty' \
-      | head -n1
-  )"
-
-  if [[ -n "$existing_pk" ]]; then
-    api PATCH "/api/v3/propertymappings/provider/scim/${existing_pk}/" "$payload" >/dev/null
-    printf '%s\n' "$existing_pk"
-  else
-    api POST "/api/v3/propertymappings/provider/scim/" "$payload" \
-      | jq -r '.pk // empty'
-  fi
-}
-
-sync_object() {
-  local provider_pk="$1"
-  local model="$2"
-  local object_id="$3"
-
-  if ! api POST "/api/v3/providers/scim/${provider_pk}/sync/object/" "$(
-    jq -cn \
-      --arg model "$model" \
-      --arg object_id "$object_id" \
-      '{
-        sync_object_model: $model,
-        sync_object_id: $object_id,
-        override_dry_run: false
-      }'
-  )" >/dev/null; then
-    echo "warning: could not trigger immediate Linear SCIM sync for ${model} ${object_id}; provider will continue with its normal sync cycle." >&2
-  fi
-}
-
-wait_for_authentik
-
-group_mapping_pk="$(lookup_scim_mapping_pk "goauthentik.io/providers/scim/group")"
-case "$user_identifier" in
-  email)
-    user_mapping_expression=$'# Some implementations require givenName and familyName to be set\ngivenName, familyName = request.user.name, " "\nformatted = request.user.name + " "\nif " " in request.user.name:\n    givenName, _, familyName = request.user.name.partition(" ")\n    formatted = request.user.name\n\navatar = request.user.avatar\nphotos = None\nif "://" in avatar:\n    photos = [{"value": avatar, "type": "photo"}]\n\nlocale = request.user.locale()\nif locale == "":\n    locale = None\n\nemails = []\nif request.user.email != "":\n    emails = [{\n        "value": request.user.email,\n        "type": "other",\n        "primary": True,\n    }]\n\nidentifier = request.user.email\nif identifier == "":\n    identifier = request.user.username\n\nreturn {\n    "userName": identifier,\n    "name": {\n        "formatted": formatted,\n        "givenName": givenName,\n        "familyName": familyName,\n    },\n    "displayName": request.user.name,\n    "photos": photos,\n    "locale": locale,\n    "active": request.user.is_active,\n    "emails": emails,\n}'
-    ;;
-  username)
-    user_mapping_expression=$'# Some implementations require givenName and familyName to be set\ngivenName, familyName = request.user.name, " "\nformatted = request.user.name + " "\nif " " in request.user.name:\n    givenName, _, familyName = request.user.name.partition(" ")\n    formatted = request.user.name\n\navatar = request.user.avatar\nphotos = None\nif "://" in avatar:\n    photos = [{"value": avatar, "type": "photo"}]\n\nlocale = request.user.locale()\nif locale == "":\n    locale = None\n\nemails = []\nif request.user.email != "":\n    emails = [{\n        "value": request.user.email,\n        "type": "other",\n        "primary": True,\n    }]\nreturn {\n    "userName": request.user.username,\n    "name": {\n        "formatted": formatted,\n        "givenName": givenName,\n        "familyName": familyName,\n    },\n    "displayName": request.user.name,\n    "photos": photos,\n    "locale": locale,\n    "active": request.user.is_active,\n    "emails": emails,\n}'
-    ;;
-  *)
-    echo "error: unsupported AUTHENTIK_LINEAR_SCIM_USER_IDENTIFIER value: ${user_identifier}" >&2
-    exit 1
-    ;;
-esac
-user_mapping_pk="$(reconcile_property_mapping "Burrow Linear SCIM User" "$user_mapping_expression")"
-
-if [[ -z "$user_mapping_pk" || -z "$group_mapping_pk" ]]; then
-  echo "error: could not resolve managed Authentik SCIM property mappings" >&2
-  exit 1
-fi
-
-owner_group_pk="$(ensure_group "$owner_group")"
-admin_group_pk="$(ensure_group "$admin_group")"
-guest_group_pk="$(ensure_group "$guest_group")"
-
-provider_payload="$(
-  jq -n \
-    --arg name "$provider_name" \
-    --arg url "$scim_url" \
-    --arg token "$(tr -d '\r\n' < "$scim_token_file")" \
-    --arg user_mapping_pk "$user_mapping_pk" \
-    --arg group_mapping_pk "$group_mapping_pk" \
-    --arg owner_group_pk "$owner_group_pk" \
-    --arg admin_group_pk "$admin_group_pk" \
-    --arg guest_group_pk "$guest_group_pk" \
-    '{
-      name: $name,
-      url: $url,
-      token: $token,
-      auth_mode: "token",
-      verify_certificates: true,
-      compatibility_mode: "default",
-      property_mappings: [$user_mapping_pk],
-      property_mappings_group: [$group_mapping_pk],
-      group_filters: [
-        $owner_group_pk,
-        $admin_group_pk,
-        $guest_group_pk
-      ],
-      dry_run: false
-    }'
-)"
-
-existing_provider="$(lookup_scim_provider)"
-if [[ -n "$existing_provider" ]]; then
-  provider_pk="$(printf '%s\n' "$existing_provider" | jq -r '.pk')"
-  api PATCH "/api/v3/providers/scim/${provider_pk}/" "$provider_payload" >/dev/null
-else
-  provider_pk="$(
-    api POST "/api/v3/providers/scim/" "$provider_payload" \
-      | jq -r '.pk // empty'
-  )"
-fi
-
-if [[ -z "${provider_pk:-}" ]]; then
-  echo "error: Linear SCIM provider did not return a primary key" >&2
-  exit 1
-fi
-
-application="$(lookup_application)"
-if [[ -z "$application" ]]; then
-  echo "error: could not resolve Authentik application ${application_slug}" >&2
-  exit 1
-fi
-
-application_payload="$(
-  printf '%s\n' "$application" \
-    | jq \
-      --arg provider_pk "$provider_pk" \
-      '{
-        name: .name,
-        slug: .slug,
-        provider: .provider,
-        backchannel_providers: ((.backchannel_providers // []) + [($provider_pk | tonumber)] | unique),
-        open_in_new_tab: .open_in_new_tab,
-        meta_launch_url: .meta_launch_url,
-        policy_engine_mode: .policy_engine_mode
-      }'
-)"
-api PATCH "/api/v3/core/applications/${application_slug}/" "$application_payload" >/dev/null
-
-group_pks_json="$(jq -cn --arg owner "$owner_group_pk" --arg admin "$admin_group_pk" --arg guest "$guest_group_pk" '[$owner, $admin, $guest]')"
-user_pks_json="$(
-  api GET "/api/v3/core/users/?page_size=200" \
-    | jq -c \
-      --argjson group_pks "$group_pks_json" \
-      '[.results[]?
-        | select(
-            ([((.groups // [])[] | tostring)] as $user_groups
-            | ($group_pks | map(. as $wanted | ($user_groups | index($wanted)) != null) | any))
-          )
-        | .pk]'
-)"
-
-while IFS= read -r group_pk; do
-  [[ -z "$group_pk" ]] && continue
-  sync_object "$provider_pk" "authentik.core.models.Group" "$group_pk"
-done < <(printf '%s\n' "$group_pks_json" | jq -r '.[]')
-
-while IFS= read -r user_pk; do
-  [[ -z "$user_pk" ]] && continue
-  sync_object "$provider_pk" "authentik.core.models.User" "$user_pk"
-done < <(printf '%s\n' "$user_pks_json" | jq -r '.[]')
-
-status_json="$(api GET "/api/v3/providers/scim/${provider_pk}/sync/status/" || true)"
-if ! printf '%s\n' "$status_json" | jq -e 'has("last_sync_status")' >/dev/null 2>&1; then
-  echo "warning: could not read Linear SCIM sync status for provider ${provider_pk}; keeping reconciled configuration." >&2
-fi
-
-echo "Synced Authentik Linear SCIM provider ${provider_name} (${provider_pk}) with groups ${owner_group}, ${admin_group}, ${guest_group}."
diff --git a/Scripts/authentik-sync-tailnet-auth-flow.sh b/Scripts/authentik-sync-tailnet-auth-flow.sh
deleted file mode 100755
index 1c715cc..0000000
--- a/Scripts/authentik-sync-tailnet-auth-flow.sh
+++ /dev/null
@@ -1,309 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-authentik_url="${AUTHENTIK_URL:-https://auth.burrow.net}"
-bootstrap_token="${AUTHENTIK_BOOTSTRAP_TOKEN:-}"
-provider_slug="${AUTHENTIK_TAILNET_PROVIDER_SLUG:-ts}"
-provider_slugs_json="${AUTHENTIK_TAILNET_PROVIDER_SLUGS_JSON:-}"
-authentication_flow_name="${AUTHENTIK_TAILNET_AUTHENTICATION_FLOW_NAME:-Burrow Tailnet Authentication}"
-authentication_flow_slug="${AUTHENTIK_TAILNET_AUTHENTICATION_FLOW_SLUG:-burrow-tailnet-authentication}"
-identification_stage_name="${AUTHENTIK_TAILNET_IDENTIFICATION_STAGE_NAME:-burrow-tailnet-identification-stage}"
-password_stage_name="${AUTHENTIK_TAILNET_PASSWORD_STAGE_NAME:-burrow-tailnet-password-stage}"
-user_login_stage_name="${AUTHENTIK_TAILNET_USER_LOGIN_STAGE_NAME:-burrow-tailnet-user-login-stage}"
-google_source_slug="${AUTHENTIK_TAILNET_GOOGLE_SOURCE_SLUG:-google}"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/authentik-sync-tailnet-auth-flow.sh
-
-Required environment:
-  AUTHENTIK_BOOTSTRAP_TOKEN
-
-Optional environment:
-  AUTHENTIK_URL
-  AUTHENTIK_TAILNET_PROVIDER_SLUG
-  AUTHENTIK_TAILNET_PROVIDER_SLUGS_JSON
-  AUTHENTIK_TAILNET_AUTHENTICATION_FLOW_NAME
-  AUTHENTIK_TAILNET_AUTHENTICATION_FLOW_SLUG
-  AUTHENTIK_TAILNET_IDENTIFICATION_STAGE_NAME
-  AUTHENTIK_TAILNET_PASSWORD_STAGE_NAME
-  AUTHENTIK_TAILNET_USER_LOGIN_STAGE_NAME
-  AUTHENTIK_TAILNET_GOOGLE_SOURCE_SLUG
-EOF
-}
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-if [[ -z "$bootstrap_token" ]]; then
-  echo "error: AUTHENTIK_BOOTSTRAP_TOKEN is required" >&2
-  exit 1
-fi
-
-if [[ -n "$provider_slugs_json" ]]; then
-  if ! printf '%s' "$provider_slugs_json" | jq -e 'type == "array" and length > 0 and all(.[]; type == "string" and length > 0)' >/dev/null; then
-    echo "error: AUTHENTIK_TAILNET_PROVIDER_SLUGS_JSON must be a non-empty JSON array of strings" >&2
-    exit 1
-  fi
-else
-  provider_slugs_json="$(jq -cn --arg slug "$provider_slug" '[$slug]')"
-fi
-
-api() {
-  local method="$1"
-  local path="$2"
-  local data="${3:-}"
-
-  if [[ -n "$data" ]]; then
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      -H "Content-Type: application/json" \
-      -d "$data" \
-      "${authentik_url}${path}"
-  else
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      "${authentik_url}${path}"
-  fi
-}
-
-wait_for_authentik() {
-  for _ in $(seq 1 90); do
-    if curl -fsS "${authentik_url}/-/health/ready/" >/dev/null 2>&1; then
-      return 0
-    fi
-    sleep 2
-  done
-
-  echo "error: Authentik did not become ready at ${authentik_url}" >&2
-  exit 1
-}
-
-lookup_stage_by_name() {
-  local path="$1"
-  local name="$2"
-
-  api GET "${path}?page_size=200" \
-    | jq -c --arg name "$name" '.results[]? | select(.name == $name)' \
-    | head -n1
-}
-
-lookup_flow_pk() {
-  local slug="$1"
-
-  api GET "/api/v3/flows/instances/?slug=${slug}" \
-    | jq -r '.results[]? | select(.slug != null) | .pk // empty' \
-    | head -n1
-}
-
-lookup_source_pk() {
-  local slug="$1"
-
-  api GET "/api/v3/sources/oauth/?page_size=200&slug=${slug}" \
-    | jq -r --arg slug "$slug" '.results[]? | select(.slug == $slug) | .pk // empty' \
-    | head -n1
-}
-
-ensure_password_stage() {
-  local existing payload stage_pk
-
-  existing="$(lookup_stage_by_name "/api/v3/stages/password/" "$password_stage_name")"
-  payload="$(
-    jq -cn \
-      --arg name "$password_stage_name" \
-      '{
-        name: $name,
-        backends: [
-          "authentik.core.auth.InbuiltBackend",
-          "authentik.core.auth.TokenBackend"
-        ],
-        allow_show_password: false,
-        failed_attempts_before_cancel: 5
-      }'
-  )"
-
-  if [[ -n "$existing" ]]; then
-    stage_pk="$(printf '%s\n' "$existing" | jq -r '.pk')"
-    api PATCH "/api/v3/stages/password/${stage_pk}/" "$payload" >/dev/null
-  else
-    stage_pk="$(
-      api POST "/api/v3/stages/password/" "$payload" \
-        | jq -r '.pk // empty'
-    )"
-  fi
-
-  printf '%s\n' "$stage_pk"
-}
-
-ensure_identification_stage() {
-  local password_stage_pk="$1"
-  local google_source_pk="$2"
-  local existing payload stage_pk sources_json
-
-  existing="$(lookup_stage_by_name "/api/v3/stages/identification/" "$identification_stage_name")"
-  if [[ -n "$google_source_pk" ]]; then
-    sources_json="$(jq -cn --arg source "$google_source_pk" '[$source]')"
-  else
-    sources_json='[]'
-  fi
-
-  payload="$(
-    jq -cn \
-      --arg name "$identification_stage_name" \
-      --arg password_stage "$password_stage_pk" \
-      --argjson sources "$sources_json" \
-      '{
-        name: $name,
-        user_fields: ["username", "email"],
-        password_stage: $password_stage,
-        case_insensitive_matching: true,
-        show_matched_user: true,
-        sources: $sources,
-        show_source_labels: true,
-        pretend_user_exists: false,
-        enable_remember_me: false
-      }'
-  )"
-
-  if [[ -n "$existing" ]]; then
-    stage_pk="$(printf '%s\n' "$existing" | jq -r '.pk')"
-    api PATCH "/api/v3/stages/identification/${stage_pk}/" "$payload" >/dev/null
-  else
-    stage_pk="$(
-      api POST "/api/v3/stages/identification/" "$payload" \
-        | jq -r '.pk // empty'
-    )"
-  fi
-
-  printf '%s\n' "$stage_pk"
-}
-
-ensure_user_login_stage() {
-  local existing payload stage_pk
-
-  existing="$(lookup_stage_by_name "/api/v3/stages/user_login/" "$user_login_stage_name")"
-  payload="$(
-    jq -cn \
-      --arg name "$user_login_stage_name" \
-      '{
-        name: $name,
-        session_duration: "hours=12",
-        terminate_other_sessions: false,
-        remember_me_offset: "seconds=0",
-        network_binding: "no_binding",
-        geoip_binding: "no_binding"
-      }'
-  )"
-
-  if [[ -n "$existing" ]]; then
-    stage_pk="$(printf '%s\n' "$existing" | jq -r '.pk')"
-    api PATCH "/api/v3/stages/user_login/${stage_pk}/" "$payload" >/dev/null
-  else
-    stage_pk="$(
-      api POST "/api/v3/stages/user_login/" "$payload" \
-        | jq -r '.pk // empty'
-    )"
-  fi
-
-  printf '%s\n' "$stage_pk"
-}
-
-ensure_authentication_flow() {
-  local existing_pk payload
-
-  existing_pk="$(lookup_flow_pk "$authentication_flow_slug")"
-  payload="$(
-    jq -cn \
-      --arg name "$authentication_flow_name" \
-      --arg slug "$authentication_flow_slug" \
-      '{
-        name: $name,
-        title: $name,
-        slug: $slug,
-        designation: "authentication",
-        policy_engine_mode: "any",
-        layout: "stacked"
-      }'
-  )"
-
-  if [[ -n "$existing_pk" ]]; then
-    api PATCH "/api/v3/flows/instances/${authentication_flow_slug}/" "$payload" >/dev/null
-    printf '%s\n' "$existing_pk"
-  else
-    api POST "/api/v3/flows/instances/" "$payload" \
-      | jq -r '.pk // empty'
-  fi
-}
-
-ensure_flow_binding() {
-  local flow_pk="$1"
-  local stage_pk="$2"
-  local order="$3"
-  local existing payload binding_pk
-
-  existing="$(
-    api GET "/api/v3/flows/bindings/?target=${flow_pk}&stage=${stage_pk}&page_size=200" \
-      | jq -c '.results[]?' \
-      | head -n1
-  )"
-
-  payload="$(
-    jq -cn \
-      --arg target "$flow_pk" \
-      --arg stage "$stage_pk" \
-      --argjson order "$order" \
-      '{
-        target: $target,
-        stage: $stage,
-        order: $order,
-        policy_engine_mode: "any"
-      }'
-  )"
-
-  if [[ -n "$existing" ]]; then
-    binding_pk="$(printf '%s\n' "$existing" | jq -r '.pk')"
-    api PATCH "/api/v3/flows/bindings/${binding_pk}/" "$payload" >/dev/null
-  else
-    api POST "/api/v3/flows/bindings/" "$payload" >/dev/null
-  fi
-}
-
-wait_for_authentik
-
-mapfile -t provider_pks < <(
-  api GET "/api/v3/providers/oauth2/?page_size=200" \
-    | jq -r --argjson provider_slugs "$provider_slugs_json" '
-        .results[]?
-        | select(
-            ((.assigned_application_slug // empty) as $assigned | ($provider_slugs | index($assigned)) != null)
-            or ((.slug // empty) as $slug | ($provider_slugs | index($slug)) != null)
-          )
-        | .pk // empty
-      '
-)
-
-if [[ "${#provider_pks[@]}" -eq 0 ]]; then
-  echo "error: could not resolve any Authentik Tailnet OAuth providers from ${provider_slugs_json}" >&2
-  exit 1
-fi
-
-google_source_pk="$(lookup_source_pk "$google_source_slug" || true)"
-password_stage_pk="$(ensure_password_stage)"
-identification_stage_pk="$(ensure_identification_stage "$password_stage_pk" "$google_source_pk")"
-user_login_stage_pk="$(ensure_user_login_stage)"
-authentication_flow_pk="$(ensure_authentication_flow)"
-
-ensure_flow_binding "$authentication_flow_pk" "$identification_stage_pk" 10
-ensure_flow_binding "$authentication_flow_pk" "$user_login_stage_pk" 30
-
-for provider_pk in "${provider_pks[@]}"; do
-  api PATCH "/api/v3/providers/oauth2/${provider_pk}/" "$(
-    jq -cn --arg flow "$authentication_flow_pk" '{authentication_flow: $flow}'
-  )" >/dev/null
-done
-
-echo "Synced Burrow Tailnet authentication flow for providers ${provider_slugs_json}."
diff --git a/Scripts/authentik-sync-tailscale-oidc.sh b/Scripts/authentik-sync-tailscale-oidc.sh
deleted file mode 100755
index 58fe7e4..0000000
--- a/Scripts/authentik-sync-tailscale-oidc.sh
+++ /dev/null
@@ -1,369 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-authentik_url="${AUTHENTIK_URL:-https://auth.burrow.net}"
-bootstrap_token="${AUTHENTIK_BOOTSTRAP_TOKEN:-}"
-application_slug="${AUTHENTIK_TAILSCALE_APPLICATION_SLUG:-tailscale}"
-application_name="${AUTHENTIK_TAILSCALE_APPLICATION_NAME:-Tailscale}"
-provider_name="${AUTHENTIK_TAILSCALE_PROVIDER_NAME:-Tailscale}"
-template_slug="${AUTHENTIK_TAILSCALE_TEMPLATE_SLUG:-ts}"
-client_id="${AUTHENTIK_TAILSCALE_CLIENT_ID:-tailscale.burrow.net}"
-client_secret="${AUTHENTIK_TAILSCALE_CLIENT_SECRET:-}"
-launch_url="${AUTHENTIK_TAILSCALE_LAUNCH_URL:-https://login.tailscale.com/start/oidc}"
-access_group="${AUTHENTIK_TAILSCALE_ACCESS_GROUP:-}"
-default_external_application_slug="${AUTHENTIK_DEFAULT_EXTERNAL_APPLICATION_SLUG:-}"
-redirect_uris_json="${AUTHENTIK_TAILSCALE_REDIRECT_URIS_JSON:-[
-  \"https://login.tailscale.com/a/oauth_response\"
-]}"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/authentik-sync-tailscale-oidc.sh
-
-Required environment:
-  AUTHENTIK_BOOTSTRAP_TOKEN
-  AUTHENTIK_TAILSCALE_CLIENT_SECRET
-
-Optional environment:
-  AUTHENTIK_URL
-  AUTHENTIK_TAILSCALE_APPLICATION_SLUG
-  AUTHENTIK_TAILSCALE_APPLICATION_NAME
-  AUTHENTIK_TAILSCALE_PROVIDER_NAME
-  AUTHENTIK_TAILSCALE_TEMPLATE_SLUG
-  AUTHENTIK_TAILSCALE_CLIENT_ID
-  AUTHENTIK_TAILSCALE_LAUNCH_URL
-  AUTHENTIK_TAILSCALE_REDIRECT_URIS_JSON
-  AUTHENTIK_TAILSCALE_ACCESS_GROUP
-  AUTHENTIK_DEFAULT_EXTERNAL_APPLICATION_SLUG
-EOF
-}
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-if [[ -z "$bootstrap_token" ]]; then
-  echo "error: AUTHENTIK_BOOTSTRAP_TOKEN is required" >&2
-  exit 1
-fi
-
-if [[ -z "$client_secret" || "$client_secret" == PENDING* ]]; then
-  echo "Tailscale OIDC client secret is not configured; skipping Authentik Tailscale sync." >&2
-  exit 0
-fi
-
-if ! printf '%s' "$redirect_uris_json" | jq -e 'type == "array" and length > 0' >/dev/null; then
-  echo "error: AUTHENTIK_TAILSCALE_REDIRECT_URIS_JSON must be a non-empty JSON array" >&2
-  exit 1
-fi
-
-api() {
-  local method="$1"
-  local path="$2"
-  local data="${3:-}"
-
-  if [[ -n "$data" ]]; then
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      -H "Content-Type: application/json" \
-      -d "$data" \
-      "${authentik_url}${path}"
-  else
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      "${authentik_url}${path}"
-  fi
-}
-
-api_with_status() {
-  local method="$1"
-  local path="$2"
-  local data="${3:-}"
-  local response_file status
-
-  response_file="$(mktemp)"
-  trap 'rm -f "$response_file"' RETURN
-
-  if [[ -n "$data" ]]; then
-    status="$(
-      curl -sS \
-        -o "$response_file" \
-        -w '%{http_code}' \
-        -X "$method" \
-        -H "Authorization: Bearer ${bootstrap_token}" \
-        -H "Content-Type: application/json" \
-        -d "$data" \
-        "${authentik_url}${path}"
-    )"
-  else
-    status="$(
-      curl -sS \
-        -o "$response_file" \
-        -w '%{http_code}' \
-        -X "$method" \
-        -H "Authorization: Bearer ${bootstrap_token}" \
-        "${authentik_url}${path}"
-    )"
-  fi
-
-  printf '%s\n' "$status"
-  cat "$response_file"
-}
-
-wait_for_authentik() {
-  for _ in $(seq 1 90); do
-    if curl -fsS "${authentik_url}/-/health/ready/" >/dev/null 2>&1; then
-      return 0
-    fi
-    sleep 2
-  done
-
-  echo "error: Authentik did not become ready at ${authentik_url}" >&2
-  exit 1
-}
-
-wait_for_authentik
-
-lookup_group_pk() {
-  local group_name="$1"
-
-  api GET "/api/v3/core/groups/?page_size=200" \
-    | jq -r --arg group_name "$group_name" '.results[]? | select(.name == $group_name) | .pk // empty' \
-    | head -n1
-}
-
-lookup_application_pk() {
-  local slug="$1"
-  local application_pk lookup_result lookup_status
-
-  application_pk="$(
-    api GET "/api/v3/core/applications/?page_size=200" \
-    | jq -r --arg slug "$slug" '.results[]? | select(.slug == $slug) | .pk // empty' \
-    | head -n1
-  )"
-
-  if [[ -n "$application_pk" ]]; then
-    printf '%s\n' "$application_pk"
-    return 0
-  fi
-
-  lookup_result="$(api_with_status GET "/api/v3/core/applications/${slug}/")"
-  lookup_status="$(printf '%s\n' "$lookup_result" | sed -n '1p')"
-  if [[ "$lookup_status" =~ ^20[01]$ ]]; then
-    printf '%s\n' "$lookup_result" | sed '1d' | jq -r '.pk // empty'
-  fi
-}
-
-ensure_application_group_binding() {
-  local application_slug="$1"
-  local group_name="$2"
-  local application_pk group_pk existing payload binding_pk
-
-  application_pk="$(lookup_application_pk "$application_slug")"
-  if [[ -z "$application_pk" ]]; then
-    echo "warning: could not resolve Authentik application ${application_slug}; skipping application group binding" >&2
-    return 0
-  fi
-
-  group_pk="$(lookup_group_pk "$group_name")"
-  if [[ -z "$group_pk" ]]; then
-    echo "error: could not resolve Authentik group ${group_name}" >&2
-    exit 1
-  fi
-
-  existing="$(
-    api GET "/api/v3/policies/bindings/?page_size=200&target=${application_pk}" \
-      | jq -c --arg group_pk "$group_pk" '.results[]? | select(.group == $group_pk)' \
-      | head -n1
-  )"
-
-  payload="$(
-    jq -cn \
-      --arg target "$application_pk" \
-      --arg group "$group_pk" \
-      '{
-        group: $group,
-        target: $target,
-        negate: false,
-        enabled: true,
-        order: 100,
-        timeout: 30,
-        failure_result: false
-      }'
-  )"
-
-  if [[ -n "$existing" ]]; then
-    binding_pk="$(printf '%s\n' "$existing" | jq -r '.pk')"
-    api PATCH "/api/v3/policies/bindings/${binding_pk}/" "$payload" >/dev/null
-  else
-    api POST "/api/v3/policies/bindings/" "$payload" >/dev/null
-  fi
-}
-
-ensure_default_external_application() {
-  local application_slug="$1"
-  local application_pk default_brand brand_payload
-
-  application_pk="$(lookup_application_pk "$application_slug")"
-  if [[ -z "$application_pk" ]]; then
-    echo "error: could not resolve Authentik application ${application_slug} for brand default application" >&2
-    exit 1
-  fi
-
-  default_brand="$(
-    api GET "/api/v3/core/brands/?page_size=200" \
-      | jq -c '.results[]? | select(.default == true)' \
-      | head -n1
-  )"
-
-  if [[ -z "$default_brand" ]]; then
-    echo "warning: could not resolve the default Authentik brand; skipping external default application" >&2
-    return 0
-  fi
-
-  brand_payload="$(
-    printf '%s\n' "$default_brand" \
-      | jq --arg application_pk "$application_pk" '.default_application = $application_pk'
-  )"
-
-  api PUT "/api/v3/core/brands/$(printf '%s\n' "$default_brand" | jq -r '.brand_uuid')/" "$brand_payload" >/dev/null
-}
-
-template_provider="$(
-  api GET "/api/v3/providers/oauth2/?page_size=200" \
-    | jq -c --arg template_slug "$template_slug" '.results[]? | select(.assigned_application_slug == $template_slug)' \
-    | head -n1
-)"
-
-if [[ -z "$template_provider" ]]; then
-  echo "error: could not resolve the Authentik OAuth provider template ${template_slug}" >&2
-  exit 1
-fi
-
-authorization_flow="$(printf '%s\n' "$template_provider" | jq -r '.authorization_flow')"
-invalidation_flow="$(printf '%s\n' "$template_provider" | jq -r '.invalidation_flow')"
-property_mappings="$(printf '%s\n' "$template_provider" | jq -c '.property_mappings')"
-signing_key="$(printf '%s\n' "$template_provider" | jq -r '.signing_key')"
-
-provider_payload="$(
-  jq -n \
-    --arg name "$provider_name" \
-    --arg authorization_flow "$authorization_flow" \
-    --arg invalidation_flow "$invalidation_flow" \
-    --arg client_id "$client_id" \
-    --arg client_secret "$client_secret" \
-    --arg signing_key "$signing_key" \
-    --argjson property_mappings "$property_mappings" \
-    --argjson redirect_uris "$redirect_uris_json" \
-    '{
-      name: $name,
-      authorization_flow: $authorization_flow,
-      invalidation_flow: $invalidation_flow,
-      client_type: "confidential",
-      client_id: $client_id,
-      client_secret: $client_secret,
-      include_claims_in_id_token: true,
-      redirect_uris: ($redirect_uris | map({matching_mode: "strict", url: .})),
-      property_mappings: $property_mappings,
-      signing_key: $signing_key,
-      issuer_mode: "per_provider",
-      sub_mode: "hashed_user_id"
-    }'
-)"
-
-existing_provider="$(
-  api GET "/api/v3/providers/oauth2/?page_size=200" \
-    | jq -c \
-      --arg application_slug "$application_slug" \
-      --arg provider_name "$provider_name" \
-      '.results[]? | select(.assigned_application_slug == $application_slug or .name == $provider_name)' \
-    | head -n1
-)"
-
-if [[ -n "$existing_provider" ]]; then
-  provider_pk="$(printf '%s\n' "$existing_provider" | jq -r '.pk')"
-  api PATCH "/api/v3/providers/oauth2/${provider_pk}/" "$provider_payload" >/dev/null
-else
-  provider_pk="$(
-    api POST "/api/v3/providers/oauth2/" "$provider_payload" \
-      | jq -r '.pk // empty'
-  )"
-fi
-
-if [[ -z "${provider_pk:-}" ]]; then
-  echo "error: Tailscale OIDC provider did not return a primary key" >&2
-  exit 1
-fi
-
-application_payload="$(
-  jq -n \
-    --arg name "$application_name" \
-    --arg slug "$application_slug" \
-    --arg provider "$provider_pk" \
-    --arg launch_url "$launch_url" \
-    '{
-      name: $name,
-      slug: $slug,
-      provider: ($provider | tonumber),
-      meta_launch_url: $launch_url,
-      open_in_new_tab: true,
-      policy_engine_mode: "any"
-    }'
-)"
-
-existing_application="$(
-  api GET "/api/v3/core/applications/?page_size=200" \
-    | jq -c --arg slug "$application_slug" '.results[]? | select(.slug == $slug)' \
-    | head -n1
-)"
-
-if [[ -n "$existing_application" ]]; then
-  application_pk="$(printf '%s\n' "$existing_application" | jq -r '.pk')"
-  api PATCH "/api/v3/core/applications/${application_pk}/" "$application_payload" >/dev/null
-else
-  create_application_result="$(
-    api_with_status POST "/api/v3/core/applications/" "$application_payload"
-  )"
-  create_application_status="$(printf '%s\n' "$create_application_result" | sed -n '1p')"
-  create_application_body="$(printf '%s\n' "$create_application_result" | sed '1d')"
-
-  if [[ "$create_application_status" =~ ^20[01]$ ]]; then
-    application_pk="$(printf '%s\n' "$create_application_body" | jq -r '.pk // empty')"
-  elif [[ "$create_application_status" == "400" ]] && printf '%s\n' "$create_application_body" | jq -e '
-      (.slug // [] | index("Application with this slug already exists.")) != null
-      or (.provider // [] | index("Application with this provider already exists.")) != null
-    ' >/dev/null; then
-    application_pk="existing-duplicate"
-  else
-    printf '%s\n' "$create_application_body" >&2
-    echo "error: could not reconcile Authentik application ${application_slug}" >&2
-    exit 1
-  fi
-fi
-
-if [[ -z "${application_pk:-}" ]]; then
-  echo "error: Tailscale OIDC application did not return a primary key" >&2
-  exit 1
-fi
-
-if [[ -n "$access_group" ]]; then
-  ensure_application_group_binding "$application_slug" "$access_group"
-fi
-
-if [[ -n "$default_external_application_slug" ]]; then
-  ensure_default_external_application "$default_external_application_slug"
-fi
-
-for _ in $(seq 1 30); do
-  if curl -fsS "${authentik_url}/application/o/${application_slug}/.well-known/openid-configuration" >/dev/null 2>&1; then
-    echo "Synced Authentik Tailscale OIDC application ${application_slug} (${application_name})."
-    exit 0
-  fi
-  sleep 2
-done
-
-echo "warning: Tailscale OIDC issuer document for ${application_slug} was not immediately readable; keeping reconciled config." >&2
-echo "Synced Authentik Tailscale OIDC application ${application_slug} (${application_name})."
diff --git a/Scripts/authentik-sync-zulip-saml.sh b/Scripts/authentik-sync-zulip-saml.sh
deleted file mode 100644
index cd18752..0000000
--- a/Scripts/authentik-sync-zulip-saml.sh
+++ /dev/null
@@ -1,412 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-authentik_url="${AUTHENTIK_URL:-https://auth.burrow.net}"
-bootstrap_token="${AUTHENTIK_BOOTSTRAP_TOKEN:-}"
-application_slug="${AUTHENTIK_ZULIP_APPLICATION_SLUG:-zulip}"
-application_name="${AUTHENTIK_ZULIP_APPLICATION_NAME:-Zulip}"
-provider_name="${AUTHENTIK_ZULIP_PROVIDER_NAME:-Zulip}"
-acs_url="${AUTHENTIK_ZULIP_ACS_URL:-https://chat.burrow.net/complete/saml/}"
-audience="${AUTHENTIK_ZULIP_AUDIENCE:-https://chat.burrow.net}"
-launch_url="${AUTHENTIK_ZULIP_LAUNCH_URL:-https://chat.burrow.net/}"
-access_group="${AUTHENTIK_ZULIP_ACCESS_GROUP:-}"
-admin_group="${AUTHENTIK_ZULIP_ADMIN_GROUP:-}"
-issuer="${AUTHENTIK_ZULIP_ISSUER:-$authentik_url}"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/authentik-sync-zulip-saml.sh
-
-Required environment:
-  AUTHENTIK_BOOTSTRAP_TOKEN
-
-Optional environment:
-  AUTHENTIK_URL
-  AUTHENTIK_ZULIP_APPLICATION_SLUG
-  AUTHENTIK_ZULIP_APPLICATION_NAME
-  AUTHENTIK_ZULIP_PROVIDER_NAME
-  AUTHENTIK_ZULIP_ACS_URL
-  AUTHENTIK_ZULIP_AUDIENCE
-  AUTHENTIK_ZULIP_LAUNCH_URL
-  AUTHENTIK_ZULIP_ACCESS_GROUP
-  AUTHENTIK_ZULIP_ADMIN_GROUP
-  AUTHENTIK_ZULIP_ISSUER
-EOF
-}
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-if [[ -z "$bootstrap_token" ]]; then
-  echo "error: AUTHENTIK_BOOTSTRAP_TOKEN is required" >&2
-  exit 1
-fi
-
-api() {
-  local method="$1"
-  local path="$2"
-  local data="${3:-}"
-
-  if [[ -n "$data" ]]; then
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      -H "Content-Type: application/json" \
-      -d "$data" \
-      "${authentik_url}${path}"
-  else
-    curl -fsS \
-      -X "$method" \
-      -H "Authorization: Bearer ${bootstrap_token}" \
-      "${authentik_url}${path}"
-  fi
-}
-
-api_with_status() {
-  local method="$1"
-  local path="$2"
-  local data="${3:-}"
-  local response_file status
-
-  response_file="$(mktemp)"
-  trap 'rm -f "$response_file"' RETURN
-
-  if [[ -n "$data" ]]; then
-    status="$(
-      curl -sS \
-        -o "$response_file" \
-        -w '%{http_code}' \
-        -X "$method" \
-        -H "Authorization: Bearer ${bootstrap_token}" \
-        -H "Content-Type: application/json" \
-        -d "$data" \
-        "${authentik_url}${path}"
-    )"
-  else
-    status="$(
-      curl -sS \
-        -o "$response_file" \
-        -w '%{http_code}' \
-        -X "$method" \
-        -H "Authorization: Bearer ${bootstrap_token}" \
-        "${authentik_url}${path}"
-    )"
-  fi
-
-  printf '%s\n' "$status"
-  cat "$response_file"
-}
-
-wait_for_authentik() {
-  for _ in $(seq 1 90); do
-    if curl -fsS "${authentik_url}/-/health/ready/" >/dev/null 2>&1; then
-      return 0
-    fi
-    sleep 2
-  done
-
-  echo "error: Authentik did not become ready at ${authentik_url}" >&2
-  exit 1
-}
-
-lookup_oauth_template_field() {
-  local field="$1"
-
-  api GET "/api/v3/providers/oauth2/?page_size=200" \
-    | jq -r --arg field "$field" '.results[]? | select(.assigned_application_slug == "ts") | .[$field]' \
-    | head -n1
-}
-
-lookup_group_pk() {
-  local group_name="$1"
-
-  api GET "/api/v3/core/groups/?page_size=200" \
-    | jq -r --arg group_name "$group_name" '.results[]? | select(.name == $group_name) | .pk // empty' \
-    | head -n1
-}
-
-lookup_application_pk() {
-  local slug="$1"
-
-  api GET "/api/v3/core/applications/?page_size=200" \
-    | jq -r --arg slug "$slug" '.results[]? | select(.slug == $slug) | .pk // empty' \
-    | head -n1
-}
-
-ensure_application_group_binding() {
-  local application_slug="$1"
-  local group_name="$2"
-  local application_pk group_pk existing payload binding_pk
-
-  application_pk="$(lookup_application_pk "$application_slug")"
-  if [[ -z "$application_pk" ]]; then
-    echo "warning: could not resolve Authentik application ${application_slug}; skipping application group binding" >&2
-    return 0
-  fi
-
-  group_pk="$(lookup_group_pk "$group_name")"
-  if [[ -z "$group_pk" ]]; then
-    echo "error: could not resolve Authentik group ${group_name}" >&2
-    exit 1
-  fi
-
-  existing="$(
-    api GET "/api/v3/policies/bindings/?page_size=200&target=${application_pk}" \
-      | jq -c --arg group_pk "$group_pk" '.results[]? | select(.group == $group_pk)' \
-      | head -n1
-  )"
-
-  payload="$(
-    jq -cn \
-      --arg target "$application_pk" \
-      --arg group "$group_pk" \
-      '{
-        group: $group,
-        target: $target,
-        negate: false,
-        enabled: true,
-        order: 100,
-        timeout: 30,
-        failure_result: false
-      }'
-  )"
-
-  if [[ -n "$existing" ]]; then
-    binding_pk="$(printf '%s\n' "$existing" | jq -r '.pk')"
-    api PATCH "/api/v3/policies/bindings/${binding_pk}/" "$payload" >/dev/null
-  else
-    api POST "/api/v3/policies/bindings/" "$payload" >/dev/null
-  fi
-}
-
-reconcile_property_mapping() {
-  local name="$1"
-  local saml_name="$2"
-  local friendly_name="$3"
-  local expression="$4"
-  local payload existing_pk
-
-  payload="$(
-    jq -n \
-      --arg name "$name" \
-      --arg saml_name "$saml_name" \
-      --arg friendly_name "$friendly_name" \
-      --arg expression "$expression" \
-      '{
-        name: $name,
-        saml_name: $saml_name,
-        friendly_name: $friendly_name,
-        expression: $expression
-      }'
-  )"
-
-  existing_pk="$(
-    api GET "/api/v3/propertymappings/provider/saml/?page_size=200" \
-      | jq -r --arg name "$name" '.results[]? | select(.name == $name) | .pk' \
-      | head -n1
-  )"
-
-  if [[ -n "$existing_pk" ]]; then
-    api PATCH "/api/v3/propertymappings/provider/saml/${existing_pk}/" "$payload" >/dev/null
-    printf '%s\n' "$existing_pk"
-  else
-    api POST "/api/v3/propertymappings/provider/saml/" "$payload" | jq -r '.pk // empty'
-  fi
-}
-
-wait_for_authentik
-
-authorization_flow="$(lookup_oauth_template_field authorization_flow)"
-invalidation_flow="$(lookup_oauth_template_field invalidation_flow)"
-signing_kp="$(lookup_oauth_template_field signing_key)"
-
-if [[ -z "$authorization_flow" || -z "$invalidation_flow" || -z "$signing_kp" ]]; then
-  echo "error: could not resolve Authentik provider defaults from Burrow Tailnet template" >&2
-  exit 1
-fi
-
-email_mapping_pk="$(
-  reconcile_property_mapping \
-    "Burrow Zulip SAML Email" \
-    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" \
-    "email" \
-    'return request.user.email'
-)"
-
-name_mapping_pk="$(
-  reconcile_property_mapping \
-    "Burrow Zulip SAML Name" \
-    "name" \
-    "name" \
-    'return request.user.name or request.user.username'
-)"
-
-first_name_mapping_pk="$(
-  reconcile_property_mapping \
-    "Burrow Zulip SAML First Name" \
-    "firstName" \
-    "firstName" \
-    $'parts = (request.user.name or "").split(" ", 1)\nif len(parts) > 0 and parts[0]:\n    return parts[0]\nreturn request.user.username'
-)"
-
-last_name_mapping_pk="$(
-  reconcile_property_mapping \
-    "Burrow Zulip SAML Last Name" \
-    "lastName" \
-    "lastName" \
-    $'parts = (request.user.name or "").rsplit(" ", 1)\nif len(parts) == 2 and parts[1]:\n    return parts[1]\nreturn request.user.username'
-)"
-
-role_mapping_pk=""
-if [[ -n "$admin_group" ]]; then
-  role_mapping_pk="$(
-    reconcile_property_mapping \
-      "Burrow Zulip SAML Role" \
-      "zulip_role" \
-      "zulip_role" \
-      $'admin_group = "'$admin_group$'"\nif any(group.name == admin_group for group in request.user.ak_groups.all()):\n    return "owner"\nreturn None'
-  )"
-fi
-
-if [[ -z "$email_mapping_pk" || -z "$name_mapping_pk" || -z "$first_name_mapping_pk" || -z "$last_name_mapping_pk" ]]; then
-  echo "error: failed to reconcile Zulip SAML property mappings" >&2
-  exit 1
-fi
-
-provider_payload="$(
-  jq -n \
-    --arg name "$provider_name" \
-    --arg authorization_flow "$authorization_flow" \
-    --arg invalidation_flow "$invalidation_flow" \
-    --arg acs_url "$acs_url" \
-    --arg audience "$audience" \
-    --arg issuer "$issuer" \
-    --arg signing_kp "$signing_kp" \
-    --arg name_id_mapping "$email_mapping_pk" \
-    --arg email_mapping "$email_mapping_pk" \
-    --arg name_mapping "$name_mapping_pk" \
-    --arg first_name_mapping "$first_name_mapping_pk" \
-    --arg last_name_mapping "$last_name_mapping_pk" \
-    --arg role_mapping "$role_mapping_pk" \
-    '{
-      name: $name,
-      authorization_flow: $authorization_flow,
-      invalidation_flow: $invalidation_flow,
-      acs_url: $acs_url,
-      audience: $audience,
-      issuer: $issuer,
-      signing_kp: $signing_kp,
-      sign_assertion: true,
-      sign_response: true,
-      sp_binding: "post",
-      name_id_mapping: $name_id_mapping,
-      property_mappings: [
-        $email_mapping,
-        $name_mapping,
-        $first_name_mapping,
-        $last_name_mapping
-      ] + (if $role_mapping != "" then [$role_mapping] else [] end)
-    }'
-)"
-
-existing_provider="$(
-  api GET "/api/v3/providers/saml/?page_size=200" \
-    | jq -c \
-      --arg application_slug "$application_slug" \
-      --arg provider_name "$provider_name" \
-      '.results[]? | select(.assigned_application_slug == $application_slug or .name == $provider_name)' \
-    | head -n1
-)"
-
-if [[ -n "$existing_provider" ]]; then
-  provider_pk="$(printf '%s\n' "$existing_provider" | jq -r '.pk')"
-  api PATCH "/api/v3/providers/saml/${provider_pk}/" "$provider_payload" >/dev/null
-else
-  provider_pk="$(
-    api POST "/api/v3/providers/saml/" "$provider_payload" \
-      | jq -r '.pk // empty'
-  )"
-fi
-
-if [[ -z "${provider_pk:-}" ]]; then
-  echo "error: Zulip SAML provider did not return a primary key" >&2
-  exit 1
-fi
-
-application_payload="$(
-  jq -n \
-    --arg name "$application_name" \
-    --arg slug "$application_slug" \
-    --arg provider "$provider_pk" \
-    --arg launch_url "$launch_url" \
-    '{
-      name: $name,
-      slug: $slug,
-      provider: ($provider | tonumber),
-      meta_launch_url: $launch_url,
-      open_in_new_tab: true,
-      policy_engine_mode: "any"
-    }'
-)"
-
-existing_application="$(
-  api GET "/api/v3/core/applications/?page_size=200" \
-    | jq -c --arg slug "$application_slug" '.results[]? | select(.slug == $slug)' \
-    | head -n1
-)"
-
-if [[ -n "$existing_application" ]]; then
-  application_pk="$(printf '%s\n' "$existing_application" | jq -r '.pk')"
-  api PATCH "/api/v3/core/applications/${application_pk}/" "$application_payload" >/dev/null
-else
-  create_application_result="$(
-    api_with_status POST "/api/v3/core/applications/" "$application_payload"
-  )"
-  create_application_status="$(printf '%s\n' "$create_application_result" | sed -n '1p')"
-  create_application_body="$(printf '%s\n' "$create_application_result" | sed '1d')"
-
-  if [[ "$create_application_status" =~ ^20[01]$ ]]; then
-    application_pk="$(printf '%s\n' "$create_application_body" | jq -r '.pk // empty')"
-  elif [[ "$create_application_status" == "400" ]] && printf '%s\n' "$create_application_body" | jq -e '
-      (.slug // [] | index("Application with this slug already exists.")) != null
-      or (.provider // [] | index("Application with this provider already exists.")) != null
-    ' >/dev/null; then
-    application_pk="existing-duplicate"
-  else
-    printf '%s\n' "$create_application_body" >&2
-    echo "error: could not reconcile Authentik application ${application_slug}" >&2
-    exit 1
-  fi
-fi
-
-if [[ -z "${application_pk:-}" ]]; then
-  echo "error: Zulip SAML application did not return a primary key" >&2
-  exit 1
-fi
-
-if [[ -n "$access_group" ]]; then
-  ensure_application_group_binding "$application_slug" "$access_group"
-fi
-
-for _ in $(seq 1 30); do
-  metadata_status="$(
-    curl -sS \
-      -o /dev/null \
-      -w '%{http_code}' \
-      --max-redirs 0 \
-      "${authentik_url}/application/saml/${application_slug}/metadata/" \
-      || true
-  )"
-  case "$metadata_status" in
-    200|301|302|307|308)
-      echo "Synced Authentik Zulip SAML application ${application_slug} (${application_name})."
-      exit 0
-      ;;
-  esac
-  sleep 2
-done
-
-echo "warning: Zulip SAML metadata for ${application_slug} was not immediately readable; keeping reconciled config." >&2
-echo "Synced Authentik Zulip SAML application ${application_slug} (${application_name})."
diff --git a/Scripts/bep b/Scripts/bep
deleted file mode 100755
index 1c6bd64..0000000
--- a/Scripts/bep
+++ /dev/null
@@ -1,133 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-repo_root=$(git rev-parse --show-toplevel)
-proposals_dir="$repo_root/evolution/proposals"
-
-auto_browse() {
-  if command -v wisu >/dev/null 2>&1; then
-    exec wisu -i -g --icons "$repo_root/evolution"
-  fi
-  exec ls -la "$repo_root/evolution"
-}
-
-usage() {
-  cat <<'USAGE'
-Usage: bep [command]
-
-Commands:
-  list [--status <Status>]   List BEPs, optionally filtered by status.
-  open <BEP-XXXX|XXXX|X>     Open a BEP in $EDITOR.
-  help                       Show this help.
-
-If no command is provided, bep launches a simple browser for evolution/.
-USAGE
-}
-
-normalize_id() {
-  local raw="$1"
-  if [[ "$raw" =~ ^BEP-[0-9]+$ ]]; then
-    printf '%s' "$raw"
-    return 0
-  fi
-  if [[ "$raw" =~ ^[0-9]+$ ]]; then
-    printf 'BEP-%04d' "$raw"
-    return 0
-  fi
-  return 1
-}
-
-read_status() {
-  local file="$1"
-  awk -F ': ' '/^Status:/ {print $2; exit}' "$file"
-}
-
-read_title() {
-  local file="$1"
-  local line
-  line=$(head -n 1 "$file" || true)
-  printf '%s' "$line" | sed -E 's/^# `[^`]+`[[:space:]]+//; s/^[^A-Za-z0-9]+//'
-}
-
-list_bep() {
-  local filter="${1:-}"
-  local filter_lower=""
-  if [[ -n "$filter" ]]; then
-    filter_lower=$(printf '%s' "$filter" | tr '[:upper:]' '[:lower:]')
-  fi
-
-  printf '%-10s %-18s %s\n' "BEP" "Status" "Title"
-  local file
-  local entries=()
-  for file in "$proposals_dir"/BEP-*.md; do
-    [[ -e "$file" ]] || continue
-    local base
-    base=$(basename "$file")
-    local id
-    id=$(printf '%s' "$base" | cut -d- -f1-2)
-    local status
-    status=$(read_status "$file")
-    local status_lower
-    status_lower=$(printf '%s' "$status" | tr '[:upper:]' '[:lower:]')
-    if [[ -n "$filter_lower" && "$status_lower" != "$filter_lower" ]]; then
-      continue
-    fi
-    local title
-    title=$(read_title "$file")
-    entries+=("$(printf '%-10s %-18s %s' "$id" "$status" "$title")")
-  done
-  if [[ ${#entries[@]} -gt 0 ]]; then
-    printf '%s\n' "${entries[@]}" | sort
-  fi
-}
-
-open_bep() {
-  local raw="$1"
-  local id
-  if ! id=$(normalize_id "$raw"); then
-    echo "Unknown BEP id: $raw" >&2
-    exit 1
-  fi
-  local matches
-  matches=("$proposals_dir"/"$id"-*.md)
-  if [[ ${#matches[@]} -eq 0 || ! -e "${matches[0]}" ]]; then
-    echo "No proposal found for $id" >&2
-    exit 1
-  fi
-  if [[ ${#matches[@]} -gt 1 ]]; then
-    echo "Multiple proposals match $id:" >&2
-    printf '  %s\n' "${matches[@]}" >&2
-    exit 1
-  fi
-  local editor="${EDITOR:-vi}"
-  exec "$editor" "${matches[0]}"
-}
-
-command=${1:-}
-case "$command" in
-  "")
-    auto_browse
-    ;;
-  list)
-    if [[ ${2:-} == "--status" && -n ${3:-} ]]; then
-      list_bep "$3"
-    else
-      list_bep
-    fi
-    ;;
-  open)
-    if [[ -z ${2:-} ]]; then
-      echo "bep open requires an id" >&2
-      exit 1
-    fi
-    open_bep "$2"
-    ;;
-  help|-h|--help)
-    usage
-    ;;
-  *)
-    echo "Unknown command: $command" >&2
-    usage
-    exit 1
-    ;;
-esac
diff --git a/Scripts/bootstrap-forge-intake.sh b/Scripts/bootstrap-forge-intake.sh
deleted file mode 100644
index 0cc1d91..0000000
--- a/Scripts/bootstrap-forge-intake.sh
+++ /dev/null
@@ -1,113 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/bootstrap-forge-intake.sh [options]
-
-Copy the minimum Burrow forge bootstrap secrets onto the target host under
-/var/lib/burrow/intake with the ownership expected by the NixOS services.
-
-Options:
-  --host <user@host>          SSH target (default: root@git.burrow.net)
-  --ssh-key <path>            SSH private key used to reach the host
-                              (default: intake/agent_at_burrow_net_ed25519)
-  --password-file <path>      Forgejo admin bootstrap password file
-                              (default: intake/forgejo_pass_contact_at_burrow_net.txt)
-  --agent-key-file <path>     Agent SSH private key copied for runner bootstrap
-                              (default: intake/agent_at_burrow_net_ed25519)
-  --no-verify                 Skip remote ls/stat verification after install
-  -h, --help                  Show this help text
-EOF
-}
-
-HOST="${BURROW_FORGE_HOST:-root@git.burrow.net}"
-SSH_KEY="${BURROW_FORGE_SSH_KEY:-${REPO_ROOT}/intake/agent_at_burrow_net_ed25519}"
-PASSWORD_FILE="${BURROW_FORGE_PASSWORD_FILE:-${REPO_ROOT}/intake/forgejo_pass_contact_at_burrow_net.txt}"
-AGENT_KEY_FILE="${BURROW_FORGE_AGENT_KEY_FILE:-${REPO_ROOT}/intake/agent_at_burrow_net_ed25519}"
-KNOWN_HOSTS_FILE="${BURROW_FORGE_KNOWN_HOSTS_FILE:-${HOME}/.cache/burrow/forge-known_hosts}"
-VERIFY=1
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --host)
-      HOST="${2:?missing value for --host}"
-      shift 2
-      ;;
-    --ssh-key)
-      SSH_KEY="${2:?missing value for --ssh-key}"
-      shift 2
-      ;;
-    --password-file)
-      PASSWORD_FILE="${2:?missing value for --password-file}"
-      shift 2
-      ;;
-    --agent-key-file)
-      AGENT_KEY_FILE="${2:?missing value for --agent-key-file}"
-      shift 2
-      ;;
-    --no-verify)
-      VERIFY=0
-      shift
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "unknown option: $1" >&2
-      usage >&2
-      exit 64
-      ;;
-  esac
-done
-
-mkdir -p "$(dirname "${KNOWN_HOSTS_FILE}")"
-
-for path in "${SSH_KEY}" "${PASSWORD_FILE}" "${AGENT_KEY_FILE}"; do
-  if [[ ! -s "${path}" ]]; then
-    echo "required file missing or empty: ${path}" >&2
-    exit 1
-  fi
-done
-
-ssh_opts=(
-  -i "${SSH_KEY}"
-  -o IdentitiesOnly=yes
-  -o UserKnownHostsFile="${KNOWN_HOSTS_FILE}"
-  -o StrictHostKeyChecking=accept-new
-)
-
-remote_tmp="$(ssh "${ssh_opts[@]}" "${HOST}" "mktemp -d")"
-cleanup() {
-  if [[ -n "${remote_tmp:-}" ]]; then
-    ssh "${ssh_opts[@]}" "${HOST}" "rm -rf '${remote_tmp}'" >/dev/null 2>&1 || true
-  fi
-}
-trap cleanup EXIT
-
-scp "${ssh_opts[@]}" \
-  "${PASSWORD_FILE}" \
-  "${AGENT_KEY_FILE}" \
-  "${HOST}:${remote_tmp}/"
-
-ssh "${ssh_opts[@]}" "${HOST}" "
-  set -euo pipefail
-  install -d -m 0755 /var/lib/burrow/intake
-  install -m 0400 -o forgejo -g forgejo '${remote_tmp}/$(basename "${PASSWORD_FILE}")' /var/lib/burrow/intake/forgejo_pass_contact_at_burrow_net.txt
-  install -m 0400 -o root -g root '${remote_tmp}/$(basename "${AGENT_KEY_FILE}")' /var/lib/burrow/intake/agent_at_burrow_net_ed25519
-"
-
-if [[ "${VERIFY}" -eq 1 ]]; then
-  ssh "${ssh_opts[@]}" "${HOST}" "
-    set -euo pipefail
-    ls -l \
-      /var/lib/burrow/intake/forgejo_pass_contact_at_burrow_net.txt \
-      /var/lib/burrow/intake/agent_at_burrow_net_ed25519
-  "
-fi
-
-echo "Burrow forge bootstrap intake sync complete (host=${HOST})."
diff --git a/Scripts/check-bep-metadata.py b/Scripts/check-bep-metadata.py
deleted file mode 100755
index d054934..0000000
--- a/Scripts/check-bep-metadata.py
+++ /dev/null
@@ -1,94 +0,0 @@
-#!/usr/bin/env python3
-
-from __future__ import annotations
-
-import pathlib
-import re
-import sys
-
-
-REPO_ROOT = pathlib.Path(__file__).resolve().parent.parent
-PROPOSALS_DIR = REPO_ROOT / "evolution" / "proposals"
-ALLOWED_STATUSES = {
-    "Pitch",
-    "Draft",
-    "In Review",
-    "Accepted",
-    "Implemented",
-    "Rejected",
-    "Returned for Revision",
-    "Superseded",
-    "Archived",
-}
-REQUIRED_FIELDS = [
-    "Status",
-    "Proposal",
-    "Authors",
-    "Coordinator",
-    "Reviewers",
-    "Constitution Sections",
-    "Implementation PRs",
-    "Decision Date",
-]
-
-
-def text_block_lines(path: pathlib.Path) -> list[str]:
-    content = path.read_text(encoding="utf-8")
-    match = re.search(r"```text\n(.*?)\n```", content, re.DOTALL)
-    if not match:
-        raise ValueError("missing leading ```text metadata block")
-    return [line.rstrip() for line in match.group(1).splitlines() if line.strip()]
-
-
-def validate(path: pathlib.Path) -> list[str]:
-    errors: list[str] = []
-    proposal_id = path.name.split("-", 2)[:2]
-    expected_id = "-".join(proposal_id).removesuffix(".md")
-
-    try:
-        lines = text_block_lines(path)
-    except ValueError as exc:
-        return [f"{path}: {exc}"]
-
-    field_names = [line.split(":", 1)[0] for line in lines]
-    if field_names != REQUIRED_FIELDS:
-        errors.append(
-            f"{path}: metadata fields must appear in order {', '.join(REQUIRED_FIELDS)}"
-        )
-        return errors
-
-    fields = dict(line.split(":", 1) for line in lines)
-    fields = {key.strip(): value.strip() for key, value in fields.items()}
-
-    if fields["Status"] not in ALLOWED_STATUSES:
-        errors.append(f"{path}: invalid Status {fields['Status']!r}")
-
-    if fields["Proposal"] != expected_id:
-        errors.append(
-            f"{path}: Proposal field {fields['Proposal']!r} does not match filename id {expected_id!r}"
-        )
-
-    if fields["Status"] in {"Accepted", "Implemented", "Superseded", "Rejected", "Archived"} and fields["Decision Date"] == "Pending":
-        errors.append(
-            f"{path}: Decision Date must not be Pending once status is {fields['Status']}"
-        )
-
-    return errors
-
-
-def main() -> int:
-    errors: list[str] = []
-    for path in sorted(PROPOSALS_DIR.glob("BEP-*.md")):
-        errors.extend(validate(path))
-
-    if errors:
-        for error in errors:
-            print(error, file=sys.stderr)
-        return 1
-
-    print(f"checked {len(list(PROPOSALS_DIR.glob('BEP-*.md')))} BEPs")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
diff --git a/Scripts/check-brand-icon-lowres.sh b/Scripts/check-brand-icon-lowres.sh
deleted file mode 100755
index c9243a9..0000000
--- a/Scripts/check-brand-icon-lowres.sh
+++ /dev/null
@@ -1,92 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$repo_root"
-
-output_dir_arg="${1:-design/brand/low-res}"
-if [[ "$output_dir_arg" = /* ]]; then
-  output_dir="$output_dir_arg"
-else
-  output_dir="$repo_root/$output_dir_arg"
-fi
-master="$output_dir/burrow-icon-1024.png"
-checked_in_master="$repo_root/design/brand/burrow-owl-icon-master.png"
-source_master="$checked_in_master"
-sizes=(16 20 24 29 32 40 48 64 80 128 256)
-
-require_tool() {
-  if ! command -v "$1" >/dev/null 2>&1; then
-    echo "error: required tool not found: $1" >&2
-    exit 127
-  fi
-}
-
-require_tool magick
-require_tool awk
-
-mkdir -p "$output_dir"
-
-magick "$checked_in_master" -colorspace sRGB -strip "PNG32:$master"
-
-printf "size,colors,gray_stddev,status\n" >"$output_dir/report.csv"
-
-for size in "${sizes[@]}"; do
-  image="$output_dir/burrow-icon-${size}.png"
-  magick "$source_master" -colorspace sRGB -resize "${size}x${size}!" -strip "PNG32:$image"
-
-  actual="$(magick "$image" -format "%wx%h" info:)"
-  if [[ "$actual" != "${size}x${size}" ]]; then
-    echo "error: $image rendered as $actual, expected ${size}x${size}" >&2
-    exit 1
-  fi
-
-  colors="$(magick "$image" -format "%k" info:)"
-  stddev="$(magick "$image" -colorspace Gray -format "%[fx:standard_deviation]" info:)"
-  min_colors=$((size * 4))
-  if (( min_colors < 48 )); then
-    min_colors=48
-  fi
-  if (( min_colors > 900 )); then
-    min_colors=900
-  fi
-
-  awk -v size="$size" -v colors="$colors" -v min_colors="$min_colors" -v stddev="$stddev" '
-    BEGIN {
-      if (colors < min_colors) {
-        printf "error: %dpx icon has only %d colors; expected at least %d\n", size, colors, min_colors > "/dev/stderr";
-        exit 1;
-      }
-      if (stddev < 0.08) {
-        printf "error: %dpx icon grayscale stddev is %.6f; expected at least 0.08\n", size, stddev > "/dev/stderr";
-        exit 1;
-      }
-    }
-  '
-
-  printf "%s,%s,%s,ok\n" "$size" "$colors" "$stddev" >>"$output_dir/report.csv"
-done
-
-preview_inputs=()
-pixel_preview_inputs=()
-for size in 256 128 80 64 48 40 32 29 24 20 16; do
-  preview="$output_dir/preview-${size}.png"
-  if (( size <= 32 )); then
-    filter=Point
-  else
-    filter=Lanczos
-  fi
-  magick "$output_dir/burrow-icon-${size}.png" -filter "$filter" -resize 128x128 "$preview"
-  preview_inputs+=("$preview")
-
-  if (( size <= 32 )); then
-    pixel_preview="$output_dir/pixel-preview-${size}.png"
-    magick "$output_dir/burrow-icon-${size}.png" -filter Point -resize 128x128 "$pixel_preview"
-    pixel_preview_inputs+=("$pixel_preview")
-  fi
-done
-
-magick -background "#202020" -gravity center "${preview_inputs[@]}" +append "$output_dir/preview-strip.png"
-magick -background "#202020" -gravity center "${pixel_preview_inputs[@]}" +append "$output_dir/pixel-preview-strip.png"
-
-echo "low-res icon exports written to $output_dir"
diff --git a/Scripts/check-forge-host.sh b/Scripts/check-forge-host.sh
deleted file mode 100755
index e4ba995..0000000
--- a/Scripts/check-forge-host.sh
+++ /dev/null
@@ -1,190 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/check-forge-host.sh [options]
-
-Run a post-boot verification pass against the Burrow forge host.
-
-Options:
-  --host <user@host>    SSH target (default: root@git.burrow.net)
-  --ssh-key <path>      SSH private key (default: intake/agent_at_burrow_net_ed25519)
-  --expect-nsc          Fail if forgejo-nsc services are not active
-  --expect-tailnet      Fail if Authentik and Headscale services are not active
-  -h, --help            Show this help text
-EOF
-}
-
-HOST="${BURROW_FORGE_HOST:-root@git.burrow.net}"
-SSH_KEY="${BURROW_FORGE_SSH_KEY:-${REPO_ROOT}/intake/agent_at_burrow_net_ed25519}"
-KNOWN_HOSTS_FILE="${BURROW_FORGE_KNOWN_HOSTS_FILE:-${HOME}/.cache/burrow/forge-known_hosts}"
-EXPECT_NSC=0
-EXPECT_TAILNET=0
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --host)
-      HOST="${2:?missing value for --host}"
-      shift 2
-      ;;
-    --ssh-key)
-      SSH_KEY="${2:?missing value for --ssh-key}"
-      shift 2
-      ;;
-    --expect-nsc)
-      EXPECT_NSC=1
-      shift
-      ;;
-    --expect-tailnet)
-      EXPECT_TAILNET=1
-      shift
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "unknown option: $1" >&2
-      usage >&2
-      exit 64
-      ;;
-  esac
-done
-
-mkdir -p "$(dirname "${KNOWN_HOSTS_FILE}")"
-
-if [[ ! -f "${SSH_KEY}" ]]; then
-  echo "forge SSH key not found: ${SSH_KEY}" >&2
-  exit 1
-fi
-
-ssh \
-  -i "${SSH_KEY}" \
-  -o IdentitiesOnly=yes \
-  -o UserKnownHostsFile="${KNOWN_HOSTS_FILE}" \
-  -o StrictHostKeyChecking=accept-new \
-  "${HOST}" \
-  EXPECT_NSC="${EXPECT_NSC}" \
-  EXPECT_TAILNET="${EXPECT_TAILNET}" \
-  'bash -s' <<'EOF'
-set -euo pipefail
-
-base_services=(
-  forgejo.service
-  grafana.service
-  caddy.service
-  burrow-forgejo-bootstrap.service
-  burrow-forgejo-runner-bootstrap.service
-  burrow-forgejo-runner.service
-)
-
-nsc_services=(
-  forgejo-nsc-dispatcher.service
-  forgejo-nsc-autoscaler.service
-)
-
-tailnet_services=(
-  burrow-authentik-runtime.service
-  burrow-authentik-ready.service
-  burrow-authentik-grafana-oidc.service
-  headscale.service
-  headscale-bootstrap.service
-)
-
-show_service() {
-  local service="$1"
-  systemctl show \
-    --no-pager \
-    --property Id \
-    --property LoadState \
-    --property UnitFileState \
-    --property ActiveState \
-    --property SubState \
-    --property Result \
-    "${service}"
-}
-
-service_is_healthy() {
-  local service="$1"
-  local active_state
-  local result
-  local unit_type
-
-  active_state="$(systemctl show --property ActiveState --value "${service}")"
-  result="$(systemctl show --property Result --value "${service}")"
-  unit_type="$(systemctl show --property Type --value "${service}")"
-
-  if [[ "${active_state}" == "active" ]]; then
-    return 0
-  fi
-
-  if [[ "${unit_type}" == "oneshot" && "${active_state}" == "inactive" && "${result}" == "success" ]]; then
-    return 0
-  fi
-
-  return 1
-}
-
-for service in "${base_services[@]}"; do
-  echo "== ${service} =="
-  show_service "${service}"
-  if ! service_is_healthy "${service}"; then
-    echo "required service is not active: ${service}" >&2
-    exit 1
-  fi
-done
-
-for service in "${nsc_services[@]}"; do
-  echo "== ${service} =="
-  show_service "${service}" || true
-  if [[ "${EXPECT_NSC}" == "1" && "$(systemctl is-active "${service}" 2>/dev/null || true)" != "active" ]]; then
-    echo "required NSC service is not active: ${service}" >&2
-    exit 1
-  fi
-done
-
-for service in "${tailnet_services[@]}"; do
-  echo "== ${service} =="
-  show_service "${service}" || true
-  if [[ "${EXPECT_TAILNET}" == "1" ]] && ! service_is_healthy "${service}"; then
-    echo "required tailnet service is not active: ${service}" >&2
-    exit 1
-  fi
-done
-
-echo "== intake =="
-ls -l /var/lib/burrow/intake || true
-
-if [[ "${EXPECT_TAILNET}" == "1" ]]; then
-  echo "== agenix =="
-  ls -l /run/agenix || true
-  test -s /run/agenix/burrowAuthentikEnv
-  test -s /run/agenix/burrowGrafanaAdminPassword
-  test -s /run/agenix/burrowGrafanaOidcClientSecret
-  test -s /run/agenix/burrowHeadscaleOidcClientSecret
-fi
-
-if [[ "${EXPECT_NSC}" == "1" ]]; then
-  echo "== agenix-nsc =="
-  ls -l /run/agenix || true
-  test -s /run/agenix/burrowForgejoNscToken
-  test -s /run/agenix/burrowForgejoNscDispatcherConfig
-  test -s /run/agenix/burrowForgejoNscAutoscalerConfig
-fi
-
-if command -v curl >/dev/null 2>&1; then
-  echo "== http-local =="
-  curl -fsS -o /dev/null -w 'forgejo_login %{http_code}\n' http://127.0.0.1:3000/user/login
-  curl -fsS -o /dev/null -H 'Host: burrow.net' -w 'burrow_root %{http_code}\n' http://127.0.0.1/
-  curl -fsS -o /dev/null -H 'Host: git.burrow.net' -w 'git_login %{http_code}\n' http://127.0.0.1/user/login
-  curl -fsS -o /dev/null -H 'Host: graphs.burrow.net' -w 'grafana_login %{http_code}\n' http://127.0.0.1/login
-  if [[ "${EXPECT_TAILNET}" == "1" ]]; then
-    curl -fsS -o /dev/null -H 'Host: auth.burrow.net' -w 'authentik_ready %{http_code}\n' http://127.0.0.1/-/health/ready/
-    curl -sS -o /dev/null -H 'Host: ts.burrow.net' -w 'headscale_root %{http_code}\n' http://127.0.0.1/ || true
-  fi
-fi
-EOF
diff --git a/Scripts/ci/backup-garage-to-gcs.sh b/Scripts/ci/backup-garage-to-gcs.sh
deleted file mode 100755
index 9bd95e5..0000000
--- a/Scripts/ci/backup-garage-to-gcs.sh
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-: "${BURROW_GARAGE_ENDPOINT:?BURROW_GARAGE_ENDPOINT is required}"
-: "${AWS_ACCESS_KEY_ID:?AWS_ACCESS_KEY_ID is required for Garage backup}"
-: "${AWS_SECRET_ACCESS_KEY:?AWS_SECRET_ACCESS_KEY is required for Garage backup}"
-
-repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "${repo_root}"
-
-if ! command -v aws >/dev/null 2>&1; then
-  echo "aws CLI is required for Garage backup" >&2
-  exit 127
-fi
-
-if ! command -v gcloud >/dev/null 2>&1; then
-  echo "gcloud is required for GCS backup" >&2
-  exit 127
-fi
-
-if ! gcloud auth list --filter=status:ACTIVE --format='value(account)' | grep -q .; then
-  Scripts/ci/google-wif-auth.sh
-fi
-
-export AWS_DEFAULT_REGION="${BURROW_GARAGE_REGION:-garage}"
-export AWS_EC2_METADATA_DISABLED=true
-export AWS_REQUEST_CHECKSUM_CALCULATION="${AWS_REQUEST_CHECKSUM_CALCULATION:-when_required}"
-export AWS_RESPONSE_CHECKSUM_VALIDATION="${AWS_RESPONSE_CHECKSUM_VALIDATION:-when_required}"
-
-requested_releases=0
-requested_packages=0
-requested_nix_cache=0
-IFS=',' read -r -a requested_items <<< "${BURROW_GARAGE_BACKUP_SET:-all}"
-
-for raw_item in "${requested_items[@]}"; do
-  item="${raw_item//[[:space:]]/}"
-  case "$item" in
-    "" )
-      ;;
-    all )
-      requested_releases=1
-      requested_packages=1
-      requested_nix_cache=1
-      ;;
-    release|releases )
-      requested_releases=1
-      ;;
-    package|packages )
-      requested_packages=1
-      ;;
-    attic|nix|nix-cache|nix_cache )
-      requested_nix_cache=1
-      ;;
-    * )
-      echo "unknown Garage backup set item: $item" >&2
-      exit 64
-      ;;
-  esac
-done
-
-if [[ "$requested_releases" == "0" && "$requested_packages" == "0" && "$requested_nix_cache" == "0" ]]; then
-  echo "no Garage backup buckets selected" >&2
-  exit 1
-fi
-
-work_root="${RUNNER_TEMP:-${TMPDIR:-/tmp}}/burrow-garage-backup"
-rsync_flags=(--recursive)
-if [[ "${BURROW_GARAGE_BACKUP_DELETE:-false}" == "true" ]]; then
-  rsync_flags+=(--delete-unmatched-destination-objects)
-fi
-
-sync_bucket() {
-  local name="$1"
-  local garage_bucket="$2"
-  local gcs_bucket="$3"
-  local source_dir="${work_root}/${name}"
-
-  rm -rf "$source_dir"
-  mkdir -p "$source_dir"
-
-  aws --endpoint-url "$BURROW_GARAGE_ENDPOINT" s3 sync "s3://${garage_bucket}" "$source_dir" --no-progress
-  gcloud storage rsync "${rsync_flags[@]}" "$source_dir" "gs://${gcs_bucket}"
-}
-
-if [[ "$requested_releases" == "1" ]]; then
-  sync_bucket \
-    releases \
-    "${BURROW_RELEASE_GARAGE_BUCKET:-burrow-releases}" \
-    "${BURROW_RELEASE_GCS_BUCKET:-burrow-net-releases}"
-fi
-
-if [[ "$requested_packages" == "1" ]]; then
-  sync_bucket \
-    packages \
-    "${BURROW_PACKAGE_GARAGE_BUCKET:-burrow-packages}" \
-    "${BURROW_PACKAGE_GCS_BUCKET:-burrow-net-packages}"
-fi
-
-if [[ "$requested_nix_cache" == "1" ]]; then
-  sync_bucket \
-    nix-cache \
-    "${BURROW_NIX_CACHE_GARAGE_BUCKET:-attic}" \
-    "${BURROW_NIX_CACHE_GCS_BUCKET:-burrow-net-nix-cache}"
-fi
diff --git a/Scripts/ci/build-release-artifacts.sh b/Scripts/ci/build-release-artifacts.sh
deleted file mode 100755
index ca8bcb0..0000000
--- a/Scripts/ci/build-release-artifacts.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "${repo_root}"
-
-build_number="${BUILD_NUMBER:-${RELEASE_REF:-manual-${GITHUB_SHA:-unknown}}}"
-export BUILD_NUMBER="$build_number"
-export BURROW_RELEASE_OUT="${BURROW_RELEASE_OUT:-${repo_root}/dist/builds/${build_number}}"
-
-Scripts/ci/package-release-artifacts.sh "${1:-all}"
diff --git a/Scripts/ci/check-release-config.sh b/Scripts/ci/check-release-config.sh
deleted file mode 100755
index 17bc3e6..0000000
--- a/Scripts/ci/check-release-config.sh
+++ /dev/null
@@ -1,68 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-require_env() {
-  local name="$1"
-  if [[ -z "${!name:-}" ]]; then
-    echo "missing required environment variable: ${name}" >&2
-    return 1
-  fi
-}
-
-require_file_or_env() {
-  local file_name="$1"
-  local env_name="$2"
-  if [[ -n "${!file_name:-}" && -f "${!file_name:-}" ]]; then
-    return 0
-  fi
-  if [[ -n "${!env_name:-}" ]]; then
-    return 0
-  fi
-  echo "missing required ${file_name} file or ${env_name} environment value" >&2
-  return 1
-}
-
-case "${1:-all}" in
-  gcs)
-    require_env BURROW_GOOGLE_PROJECT_ID
-    require_env BURROW_GOOGLE_PROJECT_NUMBER
-    require_env BURROW_GOOGLE_WIF_POOL_ID
-    require_env BURROW_GOOGLE_WIF_PROVIDER_ID
-    require_env BURROW_GOOGLE_WIF_SERVICE_ACCOUNT
-    require_env BURROW_AUTHENTIK_WIF_ISSUER
-    require_env BURROW_AUTHENTIK_WIF_AUDIENCE
-    require_env BURROW_AUTHENTIK_WIF_CLIENT_ID
-    if [[ -z "${BURROW_AUTHENTIK_WIF_TOKEN:-}" && -z "${BURROW_AUTHENTIK_WIF_CLIENT_SECRET:-}" ]]; then
-      if [[ -z "${BURROW_AUTHENTIK_WIF_TOKEN_FILE:-}" || ! -f "${BURROW_AUTHENTIK_WIF_TOKEN_FILE:-}" ]]; then
-        echo "missing Authentik WIF token, token file, or client secret" >&2
-        exit 1
-      fi
-    fi
-    ;;
-  app-store)
-    require_env ASC_API_KEY_ID
-    require_env ASC_API_ISSUER_ID
-    require_file_or_env ASC_API_KEY_PATH ASC_API_KEY_BASE64
-    ;;
-  apple-signing)
-    require_file_or_env APPLE_SIGNING_CERTIFICATE_PATH APPLE_SIGNING_CERTIFICATE_BASE64
-    require_env APPLE_SIGNING_CERTIFICATE_PASSWORD
-    ;;
-  sparkle)
-    "$0" gcs
-    ;;
-  microsoft-store)
-    require_env MICROSOFT_TENANT_ID
-    require_env MICROSOFT_CLIENT_ID
-    require_env MICROSOFT_CLIENT_SECRET
-    ;;
-  all)
-    "$0" gcs
-    "$0" app-store
-    "$0" apple-signing
-    ;;
-  *)
-    echo "unknown release config group: $1" >&2
-    exit 64
-    ;;
-esac
diff --git a/Scripts/ci/distribute-testflight.sh b/Scripts/ci/distribute-testflight.sh
deleted file mode 100755
index 7c09ee1..0000000
--- a/Scripts/ci/distribute-testflight.sh
+++ /dev/null
@@ -1,85 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-Scripts/ci/check-release-config.sh app-store
-
-build_number="${BUILD_NUMBER:?BUILD_NUMBER is required}"
-distribute_external="${TESTFLIGHT_DISTRIBUTE_EXTERNAL:-false}"
-testflight_groups="${TESTFLIGHT_GROUPS:-}"
-uses_non_exempt="${IOS_USES_NON_EXEMPT_ENCRYPTION:-false}"
-wait_processing_timeout="${TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS:-7200}"
-
-if [[ -z "$distribute_external" ]]; then
-  distribute_external="false"
-fi
-case "$distribute_external" in
-  true|false)
-    ;;
-  *)
-    echo "::error ::TESTFLIGHT_DISTRIBUTE_EXTERNAL must be true or false." >&2
-    exit 1
-    ;;
-esac
-if [[ -z "$uses_non_exempt" ]]; then
-  uses_non_exempt="false"
-fi
-case "$uses_non_exempt" in
-  true|false)
-    ;;
-  *)
-    echo "::error ::IOS_USES_NON_EXEMPT_ENCRYPTION must be true or false." >&2
-    exit 1
-    ;;
-esac
-case "$wait_processing_timeout" in
-  ""|*[!0-9]*)
-    echo "::error ::TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS must be an integer number of seconds." >&2
-    exit 1
-    ;;
-esac
-
-api_key_json="$(mktemp "${RUNNER_TEMP:-/tmp}/burrow-appstore-api-key.XXXXXX.json")"
-key_file="$(mktemp "${RUNNER_TEMP:-/tmp}/burrow-appstore-key.XXXXXX.p8")"
-cleanup() {
-  rm -f "$api_key_json" "$key_file"
-}
-trap cleanup EXIT
-
-if [[ -n "${ASC_API_KEY_PATH:-}" && -f "${ASC_API_KEY_PATH:-}" ]]; then
-  cp "$ASC_API_KEY_PATH" "$key_file"
-else
-  printf '%s' "$ASC_API_KEY_BASE64" | base64 --decode > "$key_file"
-fi
-
-KEY_FILE="$key_file" nix develop .#ci -c python3 -c 'import json, os, pathlib; print(json.dumps({"key_id": os.environ["ASC_API_KEY_ID"], "issuer_id": os.environ["ASC_API_ISSUER_ID"], "key": pathlib.Path(os.environ["KEY_FILE"]).read_text(), "duration": 1200, "in_house": False}))' > "$api_key_json"
-
-args=(
-  run pilot
-  "api_key_path:${api_key_json}"
-  "app_identifier:${BURROW_APPLE_BUNDLE_ID:-net.burrow.app}"
-  "app_platform:ios"
-  "distribute_only:true"
-  "build_number:${build_number}"
-  "wait_processing_interval:30"
-  "wait_processing_timeout_duration:${wait_processing_timeout}"
-  "distribute_external:${distribute_external}"
-  "uses_non_exempt_encryption:${uses_non_exempt}"
-)
-
-if [[ "$distribute_external" == "true" ]]; then
-  if [[ -z "$testflight_groups" ]]; then
-    echo "::error ::TESTFLIGHT_GROUPS is required for external TestFlight distribution." >&2
-    exit 1
-  fi
-  args+=("groups:${testflight_groups}")
-else
-  args+=(
-    "skip_submission:true"
-    "notify_external_testers:false"
-  )
-  if [[ -n "$testflight_groups" ]]; then
-    echo "::warning ::Ignoring TESTFLIGHT_GROUPS for internal-only TestFlight distribution; App Store Connect manages internal tester group availability." >&2
-  fi
-fi
-
-nix run nixpkgs#fastlane -- "${args[@]}"
diff --git a/Scripts/ci/ensure-nix.sh b/Scripts/ci/ensure-nix.sh
deleted file mode 100755
index 05a56af..0000000
--- a/Scripts/ci/ensure-nix.sh
+++ /dev/null
@@ -1,170 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-source_nix_profile() {
-  local candidate
-  for candidate in \
-    "/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh" \
-    "${HOME}/.nix-profile/etc/profile.d/nix.sh"
-  do
-    if [[ -f "${candidate}" ]]; then
-      # shellcheck disable=SC1090
-      . "${candidate}"
-      return 0
-    fi
-  done
-  return 1
-}
-
-linux_cp_supports_preserve() {
-  cp --help 2>&1 | grep -q -- '--preserve'
-}
-
-ensure_root_owned_home() {
-  if [[ "$(id -u)" -ne 0 ]]; then
-    return 0
-  fi
-
-  if [[ ! -d "${HOME}" ]] || [[ ! -O "${HOME}" ]]; then
-    export HOME="/root"
-  fi
-
-  mkdir -p "${HOME}"
-}
-
-ensure_linux_nixbld_accounts() {
-  if [[ "$(id -u)" -ne 0 ]]; then
-    return 0
-  fi
-
-  if command -v getent >/dev/null 2>&1 && getent group nixbld >/dev/null 2>&1; then
-    return 0
-  fi
-
-  if command -v addgroup >/dev/null 2>&1 && ! command -v groupadd >/dev/null 2>&1; then
-    addgroup -S nixbld >/dev/null 2>&1 || true
-    for i in $(seq 1 10); do
-      adduser -S -D -H -h /var/empty -s /sbin/nologin -G nixbld "nixbld${i}" >/dev/null 2>&1 || true
-    done
-    return 0
-  fi
-
-  if command -v groupadd >/dev/null 2>&1; then
-    groupadd -r nixbld >/dev/null 2>&1 || true
-    for i in $(seq 1 10); do
-      useradd \
-        --system \
-        --no-create-home \
-        --home-dir /var/empty \
-        --shell /usr/sbin/nologin \
-        --gid nixbld \
-        "nixbld${i}" >/dev/null 2>&1 || true
-    done
-    return 0
-  fi
-
-  echo "linux nix bootstrap requires nixbld group creation support" >&2
-  exit 1
-}
-
-ensure_linux_nix_bootstrap_prereqs() {
-  if linux_cp_supports_preserve; then
-    ensure_root_owned_home
-    ensure_linux_nixbld_accounts
-    return 0
-  fi
-
-  if command -v apk >/dev/null 2>&1; then
-    apk add --no-cache coreutils xz >/dev/null
-  elif command -v apt-get >/dev/null 2>&1; then
-    export DEBIAN_FRONTEND=noninteractive
-    apt-get update -y >/dev/null
-    apt-get install -y coreutils xz-utils >/dev/null
-  elif command -v dnf >/dev/null 2>&1; then
-    dnf install -y coreutils xz >/dev/null
-  elif command -v yum >/dev/null 2>&1; then
-    yum install -y coreutils xz >/dev/null
-  else
-    echo "linux nix bootstrap requires GNU cp but no supported package manager was found" >&2
-    exit 1
-  fi
-
-  linux_cp_supports_preserve || {
-    echo "linux nix bootstrap still lacks GNU cp after installing prerequisites" >&2
-    exit 1
-  }
-
-  ensure_root_owned_home
-  ensure_linux_nixbld_accounts
-}
-
-if ! command -v nix >/dev/null 2>&1; then
-  if ! command -v curl >/dev/null 2>&1; then
-    echo "curl is required to install nix" >&2
-    exit 1
-  fi
-
-  case "$(uname -s)" in
-    Linux)
-      ensure_linux_nix_bootstrap_prereqs
-      curl -fsSL https://nixos.org/nix/install | sh -s -- --no-daemon
-      ;;
-    Darwin)
-      installer="$(mktemp -t burrow-nix.XXXXXX)"
-      trap 'rm -f "${installer}"' EXIT
-      curl -fsSL -o "${installer}" https://install.determinate.systems/nix
-      chmod +x "${installer}"
-      if command -v sudo >/dev/null 2>&1; then
-        if sudo -n true 2>/dev/null; then
-          sudo -n sh "${installer}" install --no-confirm
-        else
-          sudo sh "${installer}" install --no-confirm
-        fi
-      else
-        sh "${installer}" install --no-confirm
-      fi
-      ;;
-    *)
-      echo "unsupported platform for nix bootstrap: $(uname -s)" >&2
-      exit 1
-      ;;
-  esac
-fi
-
-source_nix_profile || true
-export PATH="${HOME}/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:${PATH}"
-
-if [[ -n "${GITHUB_PATH:-}" ]]; then
-  {
-    echo "${HOME}/.nix-profile/bin"
-    echo "/nix/var/nix/profiles/default/bin"
-    echo "/nix/var/nix/profiles/default/sbin"
-  } >> "${GITHUB_PATH}"
-fi
-
-config_root="${XDG_CONFIG_HOME:-$HOME/.config}"
-config_file="${config_root}/nix/nix.conf"
-if [[ -e "${config_file}" && ! -w "${config_file}" ]]; then
-  config_root="$(mktemp -d -t burrow-nix-config.XXXXXX)"
-  export XDG_CONFIG_HOME="${config_root}"
-  config_file="${XDG_CONFIG_HOME}/nix/nix.conf"
-fi
-
-mkdir -p "$(dirname -- "${config_file}")"
-{
-  echo "experimental-features = nix-command flakes"
-  echo "sandbox = true"
-  echo "fallback = true"
-  if [[ -n "${BURROW_NIX_CACHE_PUBLIC_KEY:-}" ]]; then
-    echo "substituters = ${BURROW_NIX_CACHE_URL:-https://nix.burrow.net/${BURROW_NIX_CACHE_NAME:-burrow}} https://cache.nixos.org"
-    echo "trusted-public-keys = ${BURROW_NIX_CACHE_PUBLIC_KEY} cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-  else
-    echo "substituters = https://cache.nixos.org"
-    echo "trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-  fi
-} > "${config_file}"
-
-command -v nix >/dev/null 2>&1 || {
-  echo "nix is still unavailable after bootstrap" >&2
-  exit 1
-}
diff --git a/Scripts/ci/ensure-nsc.sh b/Scripts/ci/ensure-nsc.sh
deleted file mode 100755
index 87cd9d9..0000000
--- a/Scripts/ci/ensure-nsc.sh
+++ /dev/null
@@ -1,73 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-if command -v nsc >/dev/null 2>&1; then
-  nsc version || true
-  exit 0
-fi
-
-if ! command -v curl >/dev/null 2>&1; then
-  echo "::error ::curl is required to install nsc" >&2
-  exit 1
-fi
-if ! command -v tar >/dev/null 2>&1; then
-  echo "::error ::tar is required to install nsc" >&2
-  exit 1
-fi
-
-os="$(uname -s | tr '[:upper:]' '[:lower:]')"
-arch="$(uname -m)"
-case "$arch" in
-  x86_64|amd64) arch="amd64" ;;
-  aarch64|arm64) arch="arm64" ;;
-  *)
-    echo "::error ::Unsupported arch for nsc: ${arch}" >&2
-    exit 1
-    ;;
-esac
-
-if [[ "$os" != "linux" ]]; then
-  echo "::warning ::nsc bootstrap is only supported on Linux; relying on the runner or Nix shell for ${os}."
-  exit 1
-fi
-
-version="${NSC_VERSION:-0.0.520}"
-expected_sha256=""
-case "${version}/${arch}" in
-  0.0.506/amd64) expected_sha256="4a093e0269878a9514e7c00d99b88a924f307ad15fb9d1595ee5f6582f99a0f0" ;;
-  0.0.506/arm64) expected_sha256="6acf074b67fcbaaf59a4437f6bd40da7e38438c427849c1b5fcf4621ce75aee2" ;;
-esac
-
-asset="nsc_${version}_linux_${arch}.tar.gz"
-url="https://get.namespace.so/packages/nsc/v${version}/${asset}"
-tmp_dir="${RUNNER_TEMP:-${TMPDIR:-/tmp}}/burrow-nsc.$$"
-install_dir="${RUNNER_TEMP:-${TMPDIR:-/tmp}}/nsc-bin"
-mkdir -p "$tmp_dir" "$install_dir"
-trap 'rm -rf "$tmp_dir"' EXIT
-
-curl -fsSL -o "${tmp_dir}/${asset}" "$url"
-if [[ -n "$expected_sha256" ]] && command -v sha256sum >/dev/null 2>&1; then
-  actual_sha256="$(sha256sum "${tmp_dir}/${asset}" | awk '{print $1}')"
-  if [[ "$actual_sha256" != "$expected_sha256" ]]; then
-    echo "::error ::nsc ${asset} sha256 mismatch: expected ${expected_sha256}, got ${actual_sha256}" >&2
-    exit 1
-  fi
-fi
-
-tar -xzf "${tmp_dir}/${asset}" -C "$tmp_dir"
-for bin in nsc bazel-credential-nsc docker-credential-nsc; do
-  if [[ -x "${tmp_dir}/${bin}" ]]; then
-    install -m 0755 "${tmp_dir}/${bin}" "${install_dir}/${bin}"
-  fi
-done
-
-if [[ ! -x "${install_dir}/nsc" || ! -x "${install_dir}/bazel-credential-nsc" ]]; then
-  echo "::error ::Failed to install nsc and bazel-credential-nsc from ${asset}" >&2
-  exit 1
-fi
-
-if [[ -n "${GITHUB_PATH:-}" ]]; then
-  echo "${install_dir}" >> "${GITHUB_PATH}"
-fi
-export PATH="${install_dir}:$PATH"
-nsc version || true
diff --git a/Scripts/ci/ensure-spacectl.sh b/Scripts/ci/ensure-spacectl.sh
deleted file mode 100755
index 8216a94..0000000
--- a/Scripts/ci/ensure-spacectl.sh
+++ /dev/null
@@ -1,60 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-if command -v spacectl >/dev/null 2>&1; then
-  spacectl version || true
-  exit 0
-fi
-
-if ! command -v curl >/dev/null 2>&1; then
-  echo "::error ::curl is required to install spacectl" >&2
-  exit 1
-fi
-if ! command -v tar >/dev/null 2>&1; then
-  echo "::error ::tar is required to install spacectl" >&2
-  exit 1
-fi
-
-os="$(uname -s | tr '[:upper:]' '[:lower:]')"
-arch="$(uname -m)"
-case "$arch" in
-  x86_64|amd64) arch="amd64" ;;
-  aarch64|arm64) arch="arm64" ;;
-  *)
-    echo "::error ::Unsupported arch for spacectl: ${arch}" >&2
-    exit 1
-    ;;
-esac
-
-if [[ "$os" != "linux" && "$os" != "darwin" ]]; then
-  echo "::error ::Unsupported OS for spacectl: ${os}" >&2
-  exit 1
-fi
-
-version="${SPACECTL_VERSION:-v0.5.0}"
-version_num="${version#v}"
-asset="spacectl_${version_num}_${os}_${arch}.tar.gz"
-url="https://github.com/namespacelabs/spacectl/releases/download/${version}/${asset}"
-tmp_dir="${RUNNER_TEMP:-${TMPDIR:-/tmp}}/burrow-spacectl.$$"
-install_dir="${RUNNER_TEMP:-${TMPDIR:-/tmp}}/spacectl-bin"
-mkdir -p "$tmp_dir" "$install_dir"
-trap 'rm -rf "$tmp_dir"' EXIT
-
-curl -fsSL -o "${tmp_dir}/${asset}" "$url"
-tar -xzf "${tmp_dir}/${asset}" -C "$tmp_dir"
-
-bin="${tmp_dir}/spacectl"
-if [[ ! -x "$bin" ]]; then
-  bin="$(find "$tmp_dir" -maxdepth 3 -type f -name spacectl -perm -111 | head -n1 || true)"
-fi
-if [[ -z "${bin}" || ! -x "${bin}" ]]; then
-  echo "::error ::Failed to locate spacectl binary in ${asset}" >&2
-  exit 1
-fi
-
-install -m 0755 "$bin" "${install_dir}/spacectl"
-if [[ -n "${GITHUB_PATH:-}" ]]; then
-  echo "${install_dir}" >> "${GITHUB_PATH}"
-fi
-export PATH="${install_dir}:$PATH"
-spacectl version || true
diff --git a/Scripts/ci/google-wif-auth.sh b/Scripts/ci/google-wif-auth.sh
deleted file mode 100755
index c3eda3c..0000000
--- a/Scripts/ci/google-wif-auth.sh
+++ /dev/null
@@ -1,156 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-project_id="${GOOGLE_CLOUD_PROJECT:-${BURROW_GOOGLE_PROJECT_ID:-project-88c23ce9-918a-470a-b33}}"
-project_number="${BURROW_GOOGLE_PROJECT_NUMBER:-416198671487}"
-pool_id="${BURROW_GOOGLE_WIF_POOL_ID:-burrow-authentik}"
-provider_id="${BURROW_GOOGLE_WIF_PROVIDER_ID:-forgejo-runners}"
-service_account="${BURROW_GOOGLE_WIF_SERVICE_ACCOUNT:-burrow-forgejo-runner@project-88c23ce9-918a-470a-b33.iam.gserviceaccount.com}"
-authentik_issuer="${BURROW_AUTHENTIK_WIF_ISSUER:-https://auth.burrow.net/application/o/google-cloud/}"
-authentik_token_endpoint="${BURROW_AUTHENTIK_WIF_TOKEN_ENDPOINT:-}"
-authentik_audience="${BURROW_AUTHENTIK_WIF_AUDIENCE:-google-wif.burrow.net}"
-authentik_client_id="${BURROW_AUTHENTIK_WIF_CLIENT_ID:-${AUTHENTIK_GOOGLE_WIF_CLIENT_ID:-google-wif.burrow.net}}"
-authentik_client_secret="${BURROW_AUTHENTIK_WIF_CLIENT_SECRET:-${AUTHENTIK_GOOGLE_WIF_CLIENT_SECRET:-}}"
-authentik_token_file="${BURROW_AUTHENTIK_WIF_TOKEN_FILE:-}"
-authentik_token="${BURROW_AUTHENTIK_WIF_TOKEN:-}"
-work_dir="${RUNNER_TEMP:-${TMPDIR:-/tmp}}/burrow-google-wif"
-emit_env=1
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/ci/google-wif-auth.sh [--no-emit-env]
-
-Authenticates gcloud to the Burrow Google project through Authentik-issued OIDC
-and Google Workload Identity Federation. No Google service-account JSON key is
-used or written.
-
-Inputs:
-  GOOGLE_CLOUD_PROJECT / BURROW_GOOGLE_PROJECT_ID
-  BURROW_GOOGLE_PROJECT_NUMBER
-  BURROW_GOOGLE_WIF_POOL_ID
-  BURROW_GOOGLE_WIF_PROVIDER_ID
-  BURROW_GOOGLE_WIF_SERVICE_ACCOUNT
-  BURROW_AUTHENTIK_WIF_ISSUER
-  BURROW_AUTHENTIK_WIF_TOKEN_ENDPOINT
-  BURROW_AUTHENTIK_WIF_AUDIENCE
-  BURROW_AUTHENTIK_WIF_TOKEN or BURROW_AUTHENTIK_WIF_TOKEN_FILE
-
-If no token is supplied, the script requests one from Authentik using
-BURROW_AUTHENTIK_WIF_CLIENT_ID and BURROW_AUTHENTIK_WIF_CLIENT_SECRET.
-EOF
-}
-
-while [[ "$#" -gt 0 ]]; do
-  case "$1" in
-    --no-emit-env)
-      emit_env=0
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "unknown argument: $1" >&2
-      exit 64
-      ;;
-  esac
-  shift
-done
-
-require_command() {
-  if ! command -v "$1" >/dev/null 2>&1; then
-    echo "$1 is required for Google WIF authentication" >&2
-    exit 127
-  fi
-}
-
-require_command gcloud
-require_command curl
-require_command jq
-
-resolve_token_endpoint() {
-  if [[ -n "$authentik_token_endpoint" ]]; then
-    printf '%s\n' "$authentik_token_endpoint"
-    return
-  fi
-
-  local issuer_no_slash="${authentik_issuer%/}"
-  local discovered=""
-  if discovered="$(
-    curl -fsS "${issuer_no_slash}/.well-known/openid-configuration" 2>/dev/null \
-      | jq -r '.token_endpoint // empty' 2>/dev/null
-  )" && [[ -n "$discovered" ]]; then
-    printf '%s\n' "$discovered"
-    return
-  fi
-
-  case "$issuer_no_slash" in
-    */application/o/*)
-      printf '%s/application/o/token/\n' "${issuer_no_slash%%/application/o/*}"
-      ;;
-    *)
-      printf '%s/token/\n' "$issuer_no_slash"
-      ;;
-  esac
-}
-
-mkdir -p "$work_dir"
-chmod 0700 "$work_dir"
-
-token_path="$work_dir/authentik-oidc-token.jwt"
-credential_config="$work_dir/google-wif-credentials.json"
-
-if [[ -n "$authentik_token_file" ]]; then
-  if [[ ! -s "$authentik_token_file" ]]; then
-    echo "Authentik WIF token file is empty or missing: $authentik_token_file" >&2
-    exit 1
-  fi
-  cp "$authentik_token_file" "$token_path"
-elif [[ -n "$authentik_token" ]]; then
-  printf '%s' "$authentik_token" > "$token_path"
-else
-  if [[ -z "$authentik_client_secret" ]]; then
-    echo "missing Authentik WIF token. Set BURROW_AUTHENTIK_WIF_TOKEN, BURROW_AUTHENTIK_WIF_TOKEN_FILE, or BURROW_AUTHENTIK_WIF_CLIENT_SECRET." >&2
-    exit 1
-  fi
-  token_endpoint="$(resolve_token_endpoint)"
-  curl -fsS \
-    -d grant_type=client_credentials \
-    -d client_id="$authentik_client_id" \
-    -d client_secret="$authentik_client_secret" \
-    -d scope="openid profile email groups" \
-    -d audience="$authentik_audience" \
-    "$token_endpoint" \
-    | jq -r '.id_token // .access_token // empty' > "$token_path"
-fi
-
-chmod 0600 "$token_path"
-if [[ ! -s "$token_path" ]]; then
-  echo "Authentik did not return an OIDC token for Google WIF" >&2
-  exit 1
-fi
-
-provider_resource="projects/${project_number}/locations/global/workloadIdentityPools/${pool_id}/providers/${provider_id}"
-gcloud iam workload-identity-pools create-cred-config "$provider_resource" \
-  --service-account "$service_account" \
-  --subject-token-type="urn:ietf:params:oauth:token-type:jwt" \
-  --credential-source-file "$token_path" \
-  --output-file "$credential_config"
-
-chmod 0600 "$credential_config"
-export CLOUDSDK_CORE_PROJECT="$project_id"
-export GOOGLE_CLOUD_PROJECT="$project_id"
-gcloud auth login --cred-file="$credential_config" --brief
-
-{
-  echo "GOOGLE_APPLICATION_CREDENTIALS=$credential_config"
-  echo "CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE=$credential_config"
-  echo "CLOUDSDK_CORE_PROJECT=$project_id"
-  echo "GOOGLE_CLOUD_PROJECT=$project_id"
-} > "$work_dir/google-wif.env"
-
-if [[ "$emit_env" == "1" && -n "${GITHUB_ENV:-}" ]]; then
-  cat "$work_dir/google-wif.env" >> "$GITHUB_ENV"
-fi
-
-echo "Authenticated gcloud through Authentik WIF as ${service_account} in ${project_id}."
diff --git a/Scripts/ci/install-apple-signing-assets.sh b/Scripts/ci/install-apple-signing-assets.sh
deleted file mode 100755
index c5dc0a9..0000000
--- a/Scripts/ci/install-apple-signing-assets.sh
+++ /dev/null
@@ -1,124 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "$repo_root"
-
-signing_ready=0
-keychain_path=""
-
-write_env() {
-  local key="$1"
-  local value="$2"
-  if [[ -n "${GITHUB_ENV:-}" ]]; then
-    echo "${key}=${value}" >> "$GITHUB_ENV"
-  fi
-}
-
-install_profile_file() {
-  local source="$1"
-  [[ -f "$source" ]] || return 0
-
-  local uuid
-  uuid="$(security cms -D -i "$source" 2>/dev/null | plutil -extract UUID raw -o - - 2>/dev/null || true)"
-  if [[ -z "$uuid" ]]; then
-    uuid="$(basename "$source")"
-  fi
-
-  local profiles_dir="$HOME/Library/MobileDevice/Provisioning Profiles"
-  mkdir -p "$profiles_dir"
-  cp "$source" "${profiles_dir}/${uuid}.provisionprofile"
-  echo "Installed provisioning profile ${uuid}."
-}
-
-install_profile_base64() {
-  local name="$1"
-  local value="${!name:-}"
-  [[ -n "$value" ]] || return 0
-
-  local out="${RUNNER_TEMP:-/tmp}/${name}.provisionprofile"
-  printf '%s' "$value" | base64 --decode > "$out"
-  install_profile_file "$out"
-}
-
-install_profile_env_path() {
-  local name="$1"
-  local path="${!name:-}"
-  [[ -n "$path" ]] || return 0
-  if [[ ! -f "$path" ]]; then
-    echo "::error ::${name} points to a missing provisioning profile: ${path}" >&2
-    exit 1
-  fi
-  install_profile_file "$path"
-}
-
-for profile in \
-  Apple/Profiles/*.provisionprofile \
-  Apple/Profiles/*.mobileprovision \
-  .forgejo/actions/export/*.provisionprofile \
-  .forgejo/actions/export/*.mobileprovision; do
-  [[ -e "$profile" ]] || continue
-  install_profile_file "$profile"
-done
-install_profile_env_path APPLE_PROVISIONING_PROFILE_PATH
-install_profile_env_path APPLE_NETWORK_EXTENSION_PROVISIONING_PROFILE_PATH
-install_profile_env_path APPLE_MACOS_PROVISIONING_PROFILE_PATH
-install_profile_base64 APPLE_PROVISIONING_PROFILE_BASE64
-install_profile_base64 APPLE_NETWORK_EXTENSION_PROVISIONING_PROFILE_BASE64
-install_profile_base64 APPLE_MACOS_PROVISIONING_PROFILE_BASE64
-
-cert_base64="${APPLE_SIGNING_CERTIFICATE_BASE64:-${APPLE_DISTRIBUTION_CERTIFICATE_BASE64:-}}"
-cert_path_env="${APPLE_SIGNING_CERTIFICATE_PATH:-${APPLE_DISTRIBUTION_CERTIFICATE_PATH:-}}"
-cert_password="${APPLE_SIGNING_CERTIFICATE_PASSWORD:-${APPLE_DISTRIBUTION_CERTIFICATE_PASSWORD:-}}"
-keychain_password="${APPLE_KEYCHAIN_PASSWORD:-${cert_password}}"
-
-if [[ -n "$cert_base64" || -n "$cert_path_env" ]]; then
-  if [[ -z "$cert_password" ]]; then
-    echo "::error ::APPLE_SIGNING_CERTIFICATE_PASSWORD is required when Apple signing certificate material is set." >&2
-    exit 1
-  fi
-
-  cert_path="${RUNNER_TEMP:-/tmp}/burrow-apple-signing.p12"
-  keychain_path="$HOME/Library/Keychains/BurrowRelease.keychain-db"
-  if [[ -n "$cert_path_env" ]]; then
-    if [[ ! -f "$cert_path_env" ]]; then
-      echo "::error ::APPLE_SIGNING_CERTIFICATE_PATH points to a missing file: ${cert_path_env}" >&2
-      exit 1
-    fi
-    cp "$cert_path_env" "$cert_path"
-  else
-    printf '%s' "$cert_base64" | base64 --decode > "$cert_path"
-  fi
-
-  security create-keychain -p "$keychain_password" "$keychain_path" || true
-  security set-keychain-settings -lut 21600 "$keychain_path"
-  security unlock-keychain -p "$keychain_password" "$keychain_path"
-  security import "$cert_path" \
-    -k "$keychain_path" \
-    -P "$cert_password" \
-    -T /usr/bin/codesign \
-    -T /usr/bin/security \
-    -T /usr/bin/productbuild \
-    -T /Applications/Xcode.app/Contents/Developer/usr/bin/xcodebuild
-  security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$keychain_password" "$keychain_path" >/dev/null
-
-  existing="$(security list-keychains -d user | sed 's/[ "]//g' || true)"
-  if ! printf '%s\n' "$existing" | grep -Fxq "$keychain_path"; then
-    security list-keychains -d user -s "$keychain_path" $existing
-  fi
-
-  signing_ready=1
-  write_env BURROW_APPLE_KEYCHAIN_PATH "$keychain_path"
-else
-  identities="$(security find-identity -v -p codesigning 2>/dev/null || true)"
-  if printf '%s\n' "$identities" | grep -Eq '"(Apple Distribution|Developer ID Application):'; then
-    signing_ready=1
-  fi
-fi
-
-write_env BURROW_APPLE_SIGNING_READY "$signing_ready"
-if [[ "$signing_ready" == "1" ]]; then
-  echo "Apple signing assets are available."
-else
-  echo "::notice ::Apple signing certificate is not configured; release lane will build unsigned validation artifacts only."
-fi
diff --git a/Scripts/ci/nscloud-cache.sh b/Scripts/ci/nscloud-cache.sh
deleted file mode 100755
index 1f9ce09..0000000
--- a/Scripts/ci/nscloud-cache.sh
+++ /dev/null
@@ -1,257 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-if [[ "$#" -eq 0 ]]; then
-  echo "No cache modes specified; skipping."
-  exit 0
-fi
-
-want_bazel_cache=0
-for mode in "$@"; do
-  if [[ "$mode" == "bazel" ]]; then
-    want_bazel_cache=1
-    break
-  fi
-done
-
-portable_mkdir() {
-  hash -r >/dev/null 2>&1 || true
-  command -p mkdir "$@"
-}
-
-optional_timeout() {
-  local duration="$1"
-  shift
-  if command -v timeout >/dev/null 2>&1; then
-    timeout "$duration" "$@"
-  else
-    "$@"
-  fi
-}
-
-append_bazel_storage_cache() {
-  local bazelrc_path="$1"
-  local cache_root="${BURROW_BAZEL_STORAGE_CACHE:-}"
-  if [[ -z "$cache_root" && -n "${NSC_CACHE_PATH:-}" ]]; then
-    cache_root="${NSC_CACHE_PATH}/bazel"
-  fi
-  if [[ -z "$cache_root" ]]; then
-    return 0
-  fi
-
-  portable_mkdir -p "${cache_root}/disk" "${cache_root}/repository"
-  {
-    echo "build --disk_cache=${cache_root}/disk"
-    echo "build --repository_cache=${cache_root}/repository"
-  } >> "$bazelrc_path"
-  echo "Namespace Bazel storage cache configured: ${cache_root}"
-}
-
-configure_bazel_remote_cache() {
-  if [[ "$want_bazel_cache" != "1" ]]; then
-    return 0
-  fi
-
-  local bazelrc_path
-  bazelrc_path="${NSC_BAZELRC_PATH:-${TMPDIR:-/tmp}/burrow-nsc-cache.bazelrc}"
-  portable_mkdir -p "$(dirname "$bazelrc_path")"
-
-  if [[ "$(uname -s 2>/dev/null || true)" == "Darwin" ]]; then
-    append_bazel_storage_cache "$bazelrc_path"
-    export BURROW_BAZEL_NSCCACHE_ACTIVE=0
-    export BURROW_BAZEL_NSCCACHE_BAZELRC="$bazelrc_path"
-    echo "::warning ::Namespace Bazel remote cache probe skipped on macOS; using local Bazel repository/disk cache."
-    if [[ -n "${GITHUB_ENV:-}" ]]; then
-      echo "BURROW_BAZEL_NSCCACHE_ACTIVE=0" >> "$GITHUB_ENV"
-      echo "BURROW_BAZEL_NSCCACHE_BAZELRC=$bazelrc_path" >> "$GITHUB_ENV"
-      echo "NSC_BAZELRC_PATH=$bazelrc_path" >> "$GITHUB_ENV"
-    fi
-    return 0
-  fi
-
-  export BURROW_BAZEL_NSCCACHE_ACTIVE=0
-  if ! command -v nsc >/dev/null 2>&1; then
-    if bash Scripts/ci/ensure-nsc.sh; then
-      nsc_bin_dir="${RUNNER_TEMP:-${TMPDIR:-/tmp}}/nsc-bin"
-      if [[ -x "${nsc_bin_dir}/nsc" ]]; then
-        export PATH="${nsc_bin_dir}:$PATH"
-      fi
-    else
-      echo "::warning ::nsc not found; using local Bazel disk cache only."
-      if [[ -n "${GITHUB_ENV:-}" ]]; then
-        echo "BURROW_BAZEL_NSCCACHE_ACTIVE=0" >> "$GITHUB_ENV"
-      fi
-      return 0
-    fi
-  fi
-
-  local probe_timeout="${BURROW_NSC_CACHE_PROBE_TIMEOUT:-30s}"
-  if optional_timeout "$probe_timeout" nsc auth check-login >/dev/null 2>&1 &&
-    optional_timeout "$probe_timeout" nsc cache bazel setup --bazelrc "$bazelrc_path" >/dev/null 2>&1; then
-    append_bazel_storage_cache "$bazelrc_path"
-    export BURROW_BAZEL_NSCCACHE_BAZELRC="$bazelrc_path"
-    export BURROW_BAZEL_NSCCACHE_ACTIVE=1
-    echo "Namespace Bazel cache configured: $bazelrc_path"
-    if [[ -n "${GITHUB_ENV:-}" ]]; then
-      {
-        echo "BURROW_BAZEL_NSCCACHE_ACTIVE=1"
-        echo "BURROW_BAZEL_NSCCACHE_BAZELRC=$bazelrc_path"
-        echo "NSC_BAZELRC_PATH=$bazelrc_path"
-      } >> "$GITHUB_ENV"
-    fi
-  else
-    append_bazel_storage_cache "$bazelrc_path"
-    echo "::warning ::Namespace Bazel remote cache unavailable; using local Bazel repository/disk cache."
-    if [[ -n "${GITHUB_ENV:-}" ]]; then
-      echo "BURROW_BAZEL_NSCCACHE_ACTIVE=0" >> "$GITHUB_ENV"
-      echo "BURROW_BAZEL_NSCCACHE_BAZELRC=$bazelrc_path" >> "$GITHUB_ENV"
-      echo "NSC_BAZELRC_PATH=$bazelrc_path" >> "$GITHUB_ENV"
-    fi
-  fi
-}
-
-cache_root="${NSC_CACHE_PATH:-}"
-if [[ -z "$cache_root" ]]; then
-  ensure_dir() {
-    local dir="$1"
-    if portable_mkdir -p "$dir" 2>/dev/null; then
-      return 0
-    fi
-    if [[ "$(id -u)" != "0" ]] && command -v sudo >/dev/null 2>&1 && sudo -n true >/dev/null 2>&1; then
-      sudo mkdir -p "$dir" >/dev/null 2>&1 || return 1
-      return 0
-    fi
-    return 1
-  }
-
-  if [[ "$(uname -s 2>/dev/null || true)" == "Linux" ]]; then
-    tmp_root="${RUNNER_TEMP:-${TMPDIR:-/tmp}}/burrow-nscloud-cache"
-    for candidate in "/cache/nscloud" "$tmp_root" "$PWD/.nscloud-cache"; do
-      if ensure_dir "$candidate"; then
-        cache_root="$candidate"
-        break
-      fi
-    done
-  else
-    tmp_root="${RUNNER_TEMP:-${TMPDIR:-/tmp}}/burrow-nscloud-cache"
-    for candidate in "$tmp_root" "$PWD/.nscloud-cache"; do
-      if ensure_dir "$candidate"; then
-        cache_root="$candidate"
-        break
-      fi
-    done
-  fi
-fi
-
-if [[ -z "$cache_root" ]]; then
-  echo "NSCloud cache volume not configured (NSC_CACHE_PATH missing); skipping."
-  configure_bazel_remote_cache
-  exit 0
-fi
-
-export NSC_CACHE_PATH="$cache_root"
-if [[ -n "${GITHUB_ENV:-}" ]]; then
-  echo "NSC_CACHE_PATH=$cache_root" >> "$GITHUB_ENV"
-fi
-
-mode_args=()
-for mode in "$@"; do
-  [[ -z "$mode" ]] && continue
-  if [[ "$mode" == "bazel" ]]; then
-    continue
-  fi
-  if [[ "$mode" == "nix" && "${BURROW_NSC_DIRECT_NIX_VOLUME:-0}" == "1" ]]; then
-    echo "Namespace Nix cache volume is mounted directly at /nix; skipping spacectl nix mount."
-    continue
-  fi
-  if [[ "$mode" == "nix" && "$(uname -s)" == "Darwin" ]]; then
-    echo "Skipping late Nix cache mount on macOS; using existing Nix profile and Bazel cache."
-    continue
-  fi
-  mode_args+=("--mode=${mode}")
-done
-
-if [[ "${#mode_args[@]}" -eq 0 ]]; then
-  echo "No filesystem cache modes require mounting; skipping spacectl cache mount."
-  configure_bazel_remote_cache
-  exit 0
-fi
-
-spacectl_bin_dir="${RUNNER_TEMP:-${TMPDIR:-/tmp}}/spacectl-bin"
-if ! command -v spacectl >/dev/null 2>&1; then
-  if ! bash Scripts/ci/ensure-spacectl.sh; then
-    echo "::warning ::Unable to install spacectl; skipping filesystem cache mount."
-    configure_bazel_remote_cache
-    exit 0
-  fi
-  if [[ -x "${spacectl_bin_dir}/spacectl" ]]; then
-    export PATH="${spacectl_bin_dir}:$PATH"
-  fi
-fi
-
-portable_mkdir -p "$cache_root" 2>/dev/null || true
-
-args=(-o json cache mount "--dry_run=false" "--cache_root=${cache_root}" "${mode_args[@]}")
-echo "Mounting NSCloud cache: spacectl ${args[*]//${cache_root}/<cache_root>}"
-
-spacectl_bin="$(command -v spacectl)"
-run_mount=("$spacectl_bin" "${args[@]}")
-if [[ "$(id -u)" != "0" ]]; then
-  if ! command -v sudo >/dev/null 2>&1 || ! sudo -n true >/dev/null 2>&1; then
-    echo "::warning ::spacectl cache mount requires passwordless sudo; skipping filesystem cache."
-    configure_bazel_remote_cache
-    exit 0
-  fi
-  run_mount=(sudo -n env "PATH=$PATH" "$spacectl_bin" "${args[@]}")
-fi
-
-tmp_err="$(mktemp "${TMPDIR:-/tmp}/spacectl.XXXXXX")"
-cleanup() {
-  rm -f "$tmp_err"
-}
-trap cleanup EXIT
-
-json=""
-if ! json="$("${run_mount[@]}" 2>"$tmp_err")"; then
-  echo "::warning ::spacectl cache mount failed; skipping filesystem cache."
-  if [[ -n "$json" ]]; then
-    printf '%s\n' "$json" || true
-  fi
-  if [[ -s "$tmp_err" ]]; then
-    sed -n '1,200p' "$tmp_err" || true
-  fi
-  configure_bazel_remote_cache
-  exit 0
-fi
-
-if command -v python3 >/dev/null 2>&1; then
-  NSC_MOUNT_JSON="$json" python3 - <<'PY'
-import json
-import os
-import sys
-
-raw = os.environ.get("NSC_MOUNT_JSON", "").strip()
-if not raw:
-    sys.exit(0)
-
-try:
-    payload = json.loads(raw)
-except Exception as exc:
-    print(f"::warning ::Unable to parse spacectl JSON output; skipping cache env export: {exc}")
-    sys.exit(0)
-
-if payload.get("error"):
-    print(f"::warning ::spacectl cache mount skipped: {payload.get('message') or 'error=true'}")
-    sys.exit(0)
-
-add_envs = (payload.get("output") or {}).get("add_envs") or {}
-gh_env = os.environ.get("GITHUB_ENV")
-if gh_env and isinstance(add_envs, dict):
-    with open(gh_env, "a", encoding="utf-8") as f:
-        for key, value in add_envs.items():
-            if key and value is not None:
-                f.write(f"{key}={value}\n")
-PY
-fi
-
-configure_bazel_remote_cache
diff --git a/Scripts/ci/package-apple-artifacts.sh b/Scripts/ci/package-apple-artifacts.sh
deleted file mode 100755
index c910f0d..0000000
--- a/Scripts/ci/package-apple-artifacts.sh
+++ /dev/null
@@ -1,592 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "$repo_root"
-
-platform="${1:-all}"
-build_number="${BUILD_NUMBER:-${RELEASE_BUILD_NUMBER:-${RELEASE_REF:-manual}}}"
-out_root="${BURROW_RELEASE_OUT:-${repo_root}/dist/builds/${build_number}}"
-apple_root="${out_root}/apple"
-archives_root="${apple_root}/archives"
-derived_data="${BURROW_DERIVED_DATA_PATH:-${repo_root}/.derived-data/apple}"
-source_packages="${BURROW_SWIFTPM_CACHE_PATH:-${XDG_CACHE_HOME:-${HOME}/.cache}/burrow/swiftpm}"
-project="Apple/Burrow.xcodeproj"
-scheme="${BURROW_APPLE_SCHEME:-App}"
-bundle_id="${BURROW_APPLE_BUNDLE_ID:-net.burrow.app}"
-network_extension_bundle_id="${BURROW_APPLE_NETWORK_EXTENSION_BUNDLE_ID:-${bundle_id}.network}"
-signing_ready="${BURROW_APPLE_SIGNING_READY:-0}"
-signing_mode="${BURROW_APPLE_SIGNING_MODE:-keychain}"
-require_signing="${BURROW_APPLE_REQUIRE_SIGNING:-false}"
-sparkle_feed_url="${BURROW_SPARKLE_FEED_URL:-https://releases.burrow.net/sparkle/appcast.xml}"
-sparkle_public_ed_key="${BURROW_SPARKLE_PUBLIC_ED_KEY:-uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=}"
-sparkle_sign_with_kms="${BURROW_SPARKLE_SIGN_WITH_KMS:-false}"
-notarize_macos="${BURROW_NOTARIZE_MACOS:-false}"
-
-mkdir -p "$apple_root" "$archives_root" "$derived_data" "$source_packages"
-
-truthy() {
-  case "${1:-}" in
-    1|true|TRUE|True|yes|YES|Yes|y|Y|on|ON|On) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-sha256_file() {
-  local file="$1"
-  if command -v shasum >/dev/null 2>&1; then
-    shasum -a 256 "$file" > "${file}.sha256"
-  else
-    sha256sum "$file" > "${file}.sha256"
-  fi
-}
-
-safe_profile_slug() {
-  python3 - "$1" <<'PY'
-import re
-import sys
-
-print(re.sub(r"[^A-Za-z0-9]", "", sys.argv[1]).lower())
-PY
-}
-
-profile_for() {
-  local identifier="$1"
-  local suffix="$2"
-  local slug path
-  slug="$(safe_profile_slug "$identifier")"
-  for path in \
-    ".forgejo/actions/export/${slug}${suffix}.provisionprofile" \
-    ".forgejo/actions/export/${slug}${suffix}.mobileprovision" \
-    "Apple/Profiles/${slug}${suffix}.provisionprofile" \
-    "Apple/Profiles/${slug}${suffix}.mobileprovision"; do
-    if [[ -s "$path" ]]; then
-      printf '%s\n' "$path"
-      return 0
-    fi
-  done
-  return 1
-}
-
-generate_entitlements_from_profile() {
-  local profile="$1"
-  local output="$2"
-  local template="${3:-}"
-  local args=("$profile" --output "$output")
-  if [[ -n "$template" ]]; then
-    args+=(--template "$template")
-  fi
-  Scripts/apple/profile-entitlements.py "${args[@]}"
-}
-
-apple_signing_available() {
-  if [[ "$signing_mode" == "google-kms" || "$signing_mode" == "google-kms-staged" || "$signing_mode" == "kms" ]]; then
-    return 0
-  fi
-  [[ "$signing_ready" == "1" ]]
-}
-
-kms_sign_bundle() {
-  local family="$1"
-  local bundle_path="$2"
-  local entitlements="$3"
-  local runtime_flag=()
-  if [[ "$family" == "developer-id" ]]; then
-    runtime_flag=(--runtime)
-  fi
-  Scripts/apple/sign-with-google-kms.sh \
-    --family "$family" \
-    --path "$bundle_path" \
-    --entitlements "$entitlements" \
-    "${runtime_flag[@]}"
-}
-
-kms_sign_file() {
-  local family="$1"
-  local file_path="$2"
-  local runtime_flag=()
-  if [[ "$family" == "developer-id" ]]; then
-    runtime_flag=(--runtime)
-  fi
-  Scripts/apple/sign-with-google-kms.sh \
-    --family "$family" \
-    --path "$file_path" \
-    "${runtime_flag[@]}"
-}
-
-write_version() {
-  mkdir -p Apple/Configuration
-  printf 'CURRENT_PROJECT_VERSION = %s\n' "$build_number" > Apple/Configuration/Version.xcconfig
-}
-
-xcode_common_args=(
-  -project "$project"
-  -scheme "$scheme"
-  -configuration Release
-  -derivedDataPath "$derived_data"
-  -clonedSourcePackagesDirPath "$source_packages"
-  CURRENT_PROJECT_VERSION="$build_number"
-  APP_BUNDLE_IDENTIFIER="$bundle_id"
-  NETWORK_EXTENSION_BUNDLE_IDENTIFIER="$network_extension_bundle_id"
-  BURROW_SPARKLE_FEED_URL="$sparkle_feed_url"
-  BURROW_SPARKLE_PUBLIC_ED_KEY="$sparkle_public_ed_key"
-)
-
-xcode_auth_args=()
-if [[ -n "${ASC_API_KEY_ID:-}" && -n "${ASC_API_ISSUER_ID:-}" && -n "${ASC_API_KEY_PATH:-}" && -f "${ASC_API_KEY_PATH:-}" ]]; then
-  xcode_auth_args+=(
-    -authenticationKeyID "$ASC_API_KEY_ID"
-    -authenticationKeyIssuerID "$ASC_API_ISSUER_ID"
-    -authenticationKeyPath "$ASC_API_KEY_PATH"
-  )
-fi
-
-if [[ -n "${BURROW_APPLE_KEYCHAIN_PATH:-}" ]]; then
-  xcode_common_args+=(OTHER_CODE_SIGN_FLAGS="--keychain ${BURROW_APPLE_KEYCHAIN_PATH}")
-fi
-
-require_xcodebuild() {
-  if ! command -v xcodebuild >/dev/null 2>&1; then
-    echo "xcodebuild is required for Apple release artifacts" >&2
-    exit 1
-  fi
-  xcodebuild -version
-  xcrun --find swiftc >/dev/null
-}
-
-unsigned_note() {
-  local platform_name="$1"
-  local artifact_name="$2"
-  {
-    echo "Burrow ${platform_name} signing assets were not available."
-    echo
-    echo "The lane built an unsigned validation artifact instead of an uploadable release artifact."
-    echo "Seal the Apple release credentials with agenix and let CI sync provisioning profiles from App Store Connect to produce ${artifact_name}."
-  } > "${apple_root}/README-${platform_name}-unsigned.txt"
-}
-
-ensure_signing_or_note() {
-  local platform_name="$1"
-  local artifact_name="$2"
-  if apple_signing_available; then
-    return 0
-  fi
-  if truthy "$require_signing"; then
-    echo "Apple signing is required for ${platform_name}, but signing assets are not configured." >&2
-    exit 1
-  fi
-  unsigned_note "$platform_name" "$artifact_name"
-  return 1
-}
-
-write_export_options() {
-  local method="$1"
-  local path="$2"
-  cat > "$path" <<EOF
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>method</key>
-  <string>${method}</string>
-  <key>destination</key>
-  <string>export</string>
-  <key>signingStyle</key>
-  <string>automatic</string>
-  <key>stripSwiftSymbols</key>
-  <true/>
-  <key>teamID</key>
-  <string>${DEVELOPMENT_TEAM:-P6PV2R9443}</string>
-</dict>
-</plist>
-EOF
-}
-
-build_ios_unsigned() {
-  local product_dir zip_path
-  xcodebuild build \
-    "${xcode_common_args[@]}" \
-    -destination "generic/platform=iOS Simulator" \
-    ARCHS=arm64 \
-    ONLY_ACTIVE_ARCH=YES \
-    CODE_SIGNING_ALLOWED=NO \
-    CODE_SIGNING_REQUIRED=NO
-
-  product_dir="${derived_data}/Build/Products/Release-iphonesimulator"
-  zip_path="${apple_root}/Burrow-iOS-simulator-${build_number}.unsigned.zip"
-  if [[ -d "${product_dir}/Burrow.app" ]]; then
-    (cd "$product_dir" && zip -qr "$zip_path" Burrow.app)
-    sha256_file "$zip_path"
-  fi
-}
-
-build_ios_release() {
-  local archive_path export_dir export_options ipa
-  if ! ensure_signing_or_note "iOS" "Burrow-iOS-${build_number}.ipa"; then
-    build_ios_unsigned
-    return 0
-  fi
-  if [[ "$signing_mode" == "google-kms-staged" ]]; then
-    build_ios_kms_staged
-    return 0
-  fi
-  if [[ "$signing_mode" == "google-kms" || "$signing_mode" == "kms" ]]; then
-    build_ios_kms_release
-    return 0
-  fi
-
-  archive_path="${archives_root}/Burrow-iOS-${build_number}.xcarchive"
-  export_dir="${apple_root}/ios-export"
-  export_options="${apple_root}/ExportOptions-iOS.plist"
-  write_export_options "app-store-connect" "$export_options"
-
-  xcodebuild archive \
-    "${xcode_common_args[@]}" \
-    -destination "generic/platform=iOS" \
-    -archivePath "$archive_path" \
-    ARCHS=arm64 \
-    -allowProvisioningUpdates \
-    "${xcode_auth_args[@]}"
-
-  xcodebuild -exportArchive \
-    -archivePath "$archive_path" \
-    -exportPath "$export_dir" \
-    -exportOptionsPlist "$export_options" \
-    -allowProvisioningUpdates \
-    "${xcode_auth_args[@]}"
-
-  ipa="$(find "$export_dir" -maxdepth 1 -type f -name '*.ipa' | sort | head -n 1 || true)"
-  if [[ -z "$ipa" ]]; then
-    echo "iOS export completed but did not produce an IPA" >&2
-    exit 1
-  fi
-  cp "$ipa" "${apple_root}/Burrow-iOS-${build_number}.ipa"
-  sha256_file "${apple_root}/Burrow-iOS-${build_number}.ipa"
-}
-
-build_ios_kms_staged() {
-  local product_dir source_app stage_dir ipa
-  xcodebuild build \
-    "${xcode_common_args[@]}" \
-    -destination "generic/platform=iOS" \
-    ARCHS=arm64 \
-    ONLY_ACTIVE_ARCH=YES \
-    SKIP_INSTALL=NO \
-    CODE_SIGNING_ALLOWED=NO \
-    CODE_SIGNING_REQUIRED=NO \
-    CODE_SIGN_IDENTITY=
-
-  product_dir="${derived_data}/Build/Products/Release-iphoneos"
-  source_app="${product_dir}/Burrow.app"
-  if [[ ! -d "$source_app" ]]; then
-    echo "iOS build completed but did not produce Burrow.app" >&2
-    exit 1
-  fi
-
-  stage_dir="${apple_root}/ios-unsigned/Payload"
-  rm -rf "$stage_dir"
-  mkdir -p "$stage_dir"
-  ditto "$source_app" "${stage_dir}/Burrow.app"
-  ipa="${apple_root}/Burrow-iOS-${build_number}.unsigned.ipa"
-  rm -f "$ipa"
-  (cd "${apple_root}/ios-unsigned" && zip -qry "$ipa" Payload)
-  sha256_file "$ipa"
-}
-
-build_ios_kms_release() {
-  local product_dir source_app stage_dir app ext app_profile ext_profile app_entitlements ext_entitlements ipa
-  xcodebuild build \
-    "${xcode_common_args[@]}" \
-    -destination "generic/platform=iOS" \
-    ARCHS=arm64 \
-    ONLY_ACTIVE_ARCH=YES \
-    SKIP_INSTALL=NO \
-    CODE_SIGNING_ALLOWED=NO \
-    CODE_SIGNING_REQUIRED=NO \
-    CODE_SIGN_IDENTITY=
-
-  product_dir="${derived_data}/Build/Products/Release-iphoneos"
-  source_app="${product_dir}/Burrow.app"
-  if [[ ! -d "$source_app" ]]; then
-    echo "iOS build completed but did not produce Burrow.app" >&2
-    exit 1
-  fi
-
-  stage_dir="${apple_root}/ios-kms/Payload"
-  rm -rf "$stage_dir"
-  mkdir -p "$stage_dir"
-  ditto "$source_app" "${stage_dir}/Burrow.app"
-  app="${stage_dir}/Burrow.app"
-  ext="${app}/PlugIns/BurrowNetworkExtension.appex"
-  if [[ ! -d "$ext" ]]; then
-    echo "iOS app is missing BurrowNetworkExtension.appex" >&2
-    exit 1
-  fi
-
-  app_profile="$(profile_for "$bundle_id" "appstore")" || {
-    echo "missing iOS App Store provisioning profile for ${bundle_id}" >&2
-    exit 1
-  }
-  ext_profile="$(profile_for "$network_extension_bundle_id" "appstore")" || {
-    echo "missing iOS App Store provisioning profile for ${network_extension_bundle_id}" >&2
-    exit 1
-  }
-  cp "$app_profile" "${app}/embedded.mobileprovision"
-  cp "$ext_profile" "${ext}/embedded.mobileprovision"
-
-  app_entitlements="${apple_root}/ios-kms/app-entitlements.plist"
-  ext_entitlements="${apple_root}/ios-kms/extension-entitlements.plist"
-  generate_entitlements_from_profile "$app_profile" "$app_entitlements" Apple/App/App-iOS.entitlements
-  generate_entitlements_from_profile "$ext_profile" "$ext_entitlements" Apple/NetworkExtension/NetworkExtension-iOS.entitlements
-
-  rm -rf "${app}/_CodeSignature" "${ext}/_CodeSignature"
-  kms_sign_bundle ios "$ext" "$ext_entitlements"
-  kms_sign_bundle ios "$app" "$app_entitlements"
-
-  ipa="${apple_root}/Burrow-iOS-${build_number}.ipa"
-  rm -f "$ipa"
-  (cd "${apple_root}/ios-kms" && zip -qry "$ipa" Payload)
-  sha256_file "$ipa"
-}
-
-build_macos_unsigned() {
-  local product_dir zip_path
-  xcodebuild build \
-    "${xcode_common_args[@]}" \
-    -destination "platform=macOS" \
-    CODE_SIGNING_ALLOWED=NO \
-    CODE_SIGNING_REQUIRED=NO
-
-  product_dir="${derived_data}/Build/Products/Release"
-  zip_path="${apple_root}/Burrow-macOS-${build_number}.unsigned.zip"
-  if [[ -d "${product_dir}/Burrow.app" ]]; then
-    ditto -c -k --keepParent "${product_dir}/Burrow.app" "$zip_path"
-    sha256_file "$zip_path"
-  fi
-}
-
-build_macos_release() {
-  local archive_path export_dir export_options app dmg channel sparkle_dir length pubdate url
-  if ! ensure_signing_or_note "macOS" "Burrow-macOS-${build_number}.dmg"; then
-    build_macos_unsigned
-    return 0
-  fi
-  if [[ "$signing_mode" == "google-kms-staged" ]]; then
-    build_macos_kms_staged
-    return 0
-  fi
-  if [[ "$signing_mode" == "google-kms" || "$signing_mode" == "kms" ]]; then
-    build_macos_kms_release
-    return 0
-  fi
-
-  archive_path="${archives_root}/Burrow-macOS-${build_number}.xcarchive"
-  export_dir="${apple_root}/macos-export"
-  export_options="${apple_root}/ExportOptions-macOS.plist"
-  write_export_options "${BURROW_MACOS_EXPORT_METHOD:-developer-id}" "$export_options"
-
-  xcodebuild archive \
-    "${xcode_common_args[@]}" \
-    -destination "generic/platform=macOS" \
-    -archivePath "$archive_path" \
-    -allowProvisioningUpdates \
-    "${xcode_auth_args[@]}"
-
-  xcodebuild -exportArchive \
-    -archivePath "$archive_path" \
-    -exportPath "$export_dir" \
-    -exportOptionsPlist "$export_options" \
-    -allowProvisioningUpdates \
-    "${xcode_auth_args[@]}"
-
-  app="$(find "$export_dir" -maxdepth 2 -type d -name 'Burrow.app' | sort | head -n 1 || true)"
-  if [[ -z "$app" ]]; then
-    echo "macOS export completed but did not produce Burrow.app" >&2
-    exit 1
-  fi
-
-  dmg="${apple_root}/Burrow-macOS-${build_number}.dmg"
-  rm -f "$dmg"
-  hdiutil create -volname "Burrow ${build_number}" -srcfolder "$app" -ov -format UDZO "$dmg"
-  sha256_file "$dmg"
-
-  channel="${SPARKLE_CHANNEL:-build-${build_number}}"
-  sparkle_dir="${out_root}/sparkle/${channel}"
-  mkdir -p "$sparkle_dir"
-  cp "$dmg" "$sparkle_dir/"
-  length="$(wc -c < "$dmg" | tr -d ' ')"
-  pubdate="$(LC_ALL=C date -u '+%a, %d %b %Y %H:%M:%S +0000')"
-  url="${SPARKLE_DOWNLOAD_PREFIX:-https://releases.burrow.net/sparkle}/${channel}/$(basename "$dmg")"
-  cat > "${sparkle_dir}/appcast.xml" <<EOF
-<?xml version="1.0" encoding="utf-8"?>
-<rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle">
-  <channel>
-    <title>Burrow ${channel}</title>
-    <item>
-      <title>Burrow ${build_number}</title>
-      <pubDate>${pubdate}</pubDate>
-      <sparkle:version>${build_number}</sparkle:version>
-      <sparkle:shortVersionString>0.1</sparkle:shortVersionString>
-      <enclosure url="${url}" sparkle:version="${build_number}" length="${length}" type="application/octet-stream" />
-    </item>
-  </channel>
-</rss>
-EOF
-
-  if truthy "$sparkle_sign_with_kms"; then
-    Scripts/sparkle/sign-appcast-kms.py \
-      --appcast "${sparkle_dir}/appcast.xml" \
-      --artifact-dir "$sparkle_dir"
-  fi
-}
-
-build_macos_kms_staged() {
-  local product_dir source_app zip_path
-  xcodebuild build \
-    "${xcode_common_args[@]}" \
-    -destination "platform=macOS" \
-    CODE_SIGNING_ALLOWED=NO \
-    CODE_SIGNING_REQUIRED=NO \
-    CODE_SIGN_IDENTITY=
-
-  product_dir="${derived_data}/Build/Products/Release"
-  source_app="${product_dir}/Burrow.app"
-  if [[ ! -d "$source_app" ]]; then
-    echo "macOS build completed but did not produce Burrow.app" >&2
-    exit 1
-  fi
-
-  zip_path="${apple_root}/Burrow-macOS-${build_number}.unsigned.zip"
-  rm -f "$zip_path"
-  ditto -c -k --keepParent "$source_app" "$zip_path"
-  sha256_file "$zip_path"
-}
-
-write_sparkle_appcast() {
-  local dmg="$1"
-  local channel sparkle_dir length pubdate url
-  channel="${SPARKLE_CHANNEL:-build-${build_number}}"
-  sparkle_dir="${out_root}/sparkle/${channel}"
-  mkdir -p "$sparkle_dir"
-  cp "$dmg" "$sparkle_dir/"
-  length="$(wc -c < "$dmg" | tr -d ' ')"
-  pubdate="$(LC_ALL=C date -u '+%a, %d %b %Y %H:%M:%S +0000')"
-  url="${SPARKLE_DOWNLOAD_PREFIX:-https://releases.burrow.net/sparkle}/${channel}/$(basename "$dmg")"
-  cat > "${sparkle_dir}/appcast.xml" <<EOF
-<?xml version="1.0" encoding="utf-8"?>
-<rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle">
-  <channel>
-    <title>Burrow ${channel}</title>
-    <item>
-      <title>Burrow ${build_number}</title>
-      <pubDate>${pubdate}</pubDate>
-      <sparkle:version>${build_number}</sparkle:version>
-      <sparkle:shortVersionString>0.1</sparkle:shortVersionString>
-      <enclosure url="${url}" sparkle:version="${build_number}" length="${length}" type="application/octet-stream" />
-    </item>
-  </channel>
-</rss>
-EOF
-
-  if truthy "$sparkle_sign_with_kms"; then
-    Scripts/sparkle/sign-appcast-kms.py \
-      --appcast "${sparkle_dir}/appcast.xml" \
-      --artifact-dir "$sparkle_dir"
-  fi
-}
-
-notarize_dmg_if_requested() {
-  local dmg="$1"
-  local key_json
-  if ! truthy "$notarize_macos"; then
-    return 0
-  fi
-  if [[ -z "${ASC_API_KEY_ID:-}" || -z "${ASC_API_ISSUER_ID:-}" || -z "${ASC_API_KEY_PATH:-}" ]]; then
-    echo "macOS notarization requires ASC_API_KEY_ID, ASC_API_ISSUER_ID, and ASC_API_KEY_PATH" >&2
-    exit 1
-  fi
-  key_json="${apple_root}/notary-api-key.json"
-  rcodesign encode-app-store-connect-api-key \
-    --output-path "$key_json" \
-    "$ASC_API_ISSUER_ID" \
-    "$ASC_API_KEY_ID" \
-    "$ASC_API_KEY_PATH"
-  rcodesign notary-submit --api-key-file "$key_json" --wait --staple "$dmg"
-  rm -f "$key_json"
-}
-
-build_macos_kms_release() {
-  local product_dir source_app app ext app_profile ext_profile app_entitlements ext_entitlements dmg
-  xcodebuild build \
-    "${xcode_common_args[@]}" \
-    -destination "platform=macOS" \
-    CODE_SIGNING_ALLOWED=NO \
-    CODE_SIGNING_REQUIRED=NO \
-    CODE_SIGN_IDENTITY=
-
-  product_dir="${derived_data}/Build/Products/Release"
-  source_app="${product_dir}/Burrow.app"
-  if [[ ! -d "$source_app" ]]; then
-    echo "macOS build completed but did not produce Burrow.app" >&2
-    exit 1
-  fi
-
-  app="${apple_root}/macos-kms/Burrow.app"
-  rm -rf "$app"
-  mkdir -p "$(dirname "$app")"
-  ditto "$source_app" "$app"
-  ext="${app}/Contents/PlugIns/BurrowNetworkExtension.appex"
-
-  app_profile="$(profile_for "$bundle_id" "developerid")" || {
-    echo "missing macOS Developer ID provisioning profile for ${bundle_id}" >&2
-    exit 1
-  }
-  cp "$app_profile" "${app}/Contents/embedded.provisionprofile"
-  app_entitlements="${apple_root}/macos-kms/app-entitlements.plist"
-  generate_entitlements_from_profile "$app_profile" "$app_entitlements"
-
-  if [[ -d "$ext" ]]; then
-    ext_profile="$(profile_for "$network_extension_bundle_id" "developerid")" || {
-      echo "missing macOS Developer ID provisioning profile for ${network_extension_bundle_id}" >&2
-      exit 1
-    }
-    cp "$ext_profile" "${ext}/Contents/embedded.provisionprofile"
-    ext_entitlements="${apple_root}/macos-kms/extension-entitlements.plist"
-    generate_entitlements_from_profile "$ext_profile" "$ext_entitlements"
-    rm -rf "${ext}/Contents/_CodeSignature"
-    kms_sign_bundle developer-id "$ext" "$ext_entitlements"
-  fi
-
-  rm -rf "${app}/Contents/_CodeSignature"
-  kms_sign_bundle developer-id "$app" "$app_entitlements"
-
-  dmg="${apple_root}/Burrow-macOS-${build_number}.dmg"
-  rm -f "$dmg"
-  hdiutil create -volname "Burrow ${build_number}" -srcfolder "$app" -ov -format UDZO "$dmg"
-  kms_sign_file developer-id "$dmg"
-  notarize_dmg_if_requested "$dmg"
-  sha256_file "$dmg"
-  write_sparkle_appcast "$dmg"
-}
-
-require_xcodebuild
-write_version
-
-case "$platform" in
-  all)
-    build_ios_release
-    build_macos_release
-    ;;
-  ios)
-    build_ios_release
-    ;;
-  macos)
-    build_macos_release
-    ;;
-  *)
-    echo "unknown Apple release platform: $platform" >&2
-    exit 64
-    ;;
-esac
-
-find "$out_root" -type f -print | sort
diff --git a/Scripts/ci/package-release-artifacts.sh b/Scripts/ci/package-release-artifacts.sh
deleted file mode 100755
index 4ee85ee..0000000
--- a/Scripts/ci/package-release-artifacts.sh
+++ /dev/null
@@ -1,332 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "${repo_root}"
-
-platform="${1:-all}"
-build_number="${BUILD_NUMBER:-${RELEASE_BUILD_NUMBER:-${RELEASE_REF:-manual}}}"
-out_root="${BURROW_RELEASE_OUT:-${repo_root}/dist/builds/${build_number}}"
-
-mkdir -p "${out_root}"
-
-sha256_file() {
-  local file="$1"
-  if command -v shasum >/dev/null 2>&1; then
-    shasum -a 256 "$file" > "${file}.sha256"
-  else
-    sha256sum "$file" > "${file}.sha256"
-  fi
-}
-
-burrow_crate_version() {
-  awk -F '"' '/^version = / { print $2; exit }' burrow/Cargo.toml
-}
-
-package_release_suffix() {
-  printf '%s' "$build_number" | tr -c 'A-Za-z0-9.+~' '.'
-}
-
-arch_package_suffix() {
-  printf '%s' "$build_number" | tr -c 'A-Za-z0-9.+_' '.'
-}
-
-deb_arch_for_target() {
-  case "$1" in
-    x86_64-unknown-linux-gnu) printf 'amd64' ;;
-    aarch64-unknown-linux-gnu) printf 'arm64' ;;
-    riscv64gc-unknown-linux-gnu) printf 'riscv64' ;;
-    *) return 1 ;;
-  esac
-}
-
-rpm_arch_for_target() {
-  case "$1" in
-    x86_64-unknown-linux-gnu) printf 'x86_64' ;;
-    aarch64-unknown-linux-gnu) printf 'aarch64' ;;
-    riscv64gc-unknown-linux-gnu) printf 'riscv64' ;;
-    *) return 1 ;;
-  esac
-}
-
-pacman_arch_for_target() {
-  case "$1" in
-    x86_64-unknown-linux-gnu) printf 'x86_64' ;;
-    aarch64-unknown-linux-gnu) printf 'aarch64' ;;
-    riscv64gc-unknown-linux-gnu) printf 'riscv64' ;;
-    *) return 1 ;;
-  esac
-}
-
-copy_license_readme() {
-  local dst="$1"
-  cp README.md "$dst/README.md"
-  if [[ -f LICENSE ]]; then
-    cp LICENSE "$dst/LICENSE"
-  elif [[ -f LICENSE.md ]]; then
-    cp LICENSE.md "$dst/LICENSE.md"
-  fi
-}
-
-package_deb() {
-  local target binary deb_arch pkg_version suffix staging deb_file installed_size
-  target="$1"
-  binary="$2"
-  if ! deb_arch="$(deb_arch_for_target "$target")"; then
-    echo "warning: no Debian architecture mapping for ${target}; skipping .deb package" >&2
-    return 0
-  fi
-  if ! command -v dpkg-deb >/dev/null 2>&1; then
-    echo "warning: dpkg-deb is not available; skipping .deb package" >&2
-    return 0
-  fi
-
-  suffix="$(package_release_suffix)"
-  pkg_version="${BURROW_PACKAGE_VERSION:-$(burrow_crate_version)+${suffix}}"
-  staging="${out_root}/linux/pkg-deb/burrow_${pkg_version}_${deb_arch}"
-  rm -rf "$staging"
-  mkdir -p \
-    "$staging/DEBIAN" \
-    "$staging/usr/bin" \
-    "$staging/usr/lib/systemd/system" \
-    "$staging/usr/share/doc/burrow" \
-    "$staging/usr/share/licenses/burrow"
-
-  install -m 0755 "$binary" "$staging/usr/bin/burrow"
-  install -m 0644 systemd/burrow.service "$staging/usr/lib/systemd/system/burrow.service"
-  install -m 0644 systemd/burrow.socket "$staging/usr/lib/systemd/system/burrow.socket"
-  install -m 0644 README.md "$staging/usr/share/doc/burrow/README.md"
-  install -m 0644 LICENSE.md "$staging/usr/share/licenses/burrow/LICENSE.md"
-  installed_size="$(du -sk "$staging/usr" | awk '{ print $1 }')"
-
-  cat > "$staging/DEBIAN/control" <<EOF
-Package: burrow
-Version: ${pkg_version}
-Section: net
-Priority: optional
-Architecture: ${deb_arch}
-Maintainer: Burrow Release Automation <packages@burrow.net>
-Installed-Size: ${installed_size}
-Depends: systemd
-Description: Burrow VPN daemon and CLI
- Burrow installs the daemon entrypoint and systemd socket used by the desktop UI.
-EOF
-
-  deb_file="${out_root}/linux/burrow_${pkg_version}_${deb_arch}.deb"
-  dpkg-deb --build --root-owner-group "$staging" "$deb_file"
-  sha256_file "$deb_file"
-}
-
-package_rpm() {
-  local target binary rpm_arch
-  target="$1"
-  binary="$2"
-  if ! rpm_arch="$(rpm_arch_for_target "$target")"; then
-    echo "warning: no RPM architecture mapping for ${target}; skipping .rpm package" >&2
-    return 0
-  fi
-  if ! command -v cargo-generate-rpm >/dev/null 2>&1; then
-    echo "warning: cargo-generate-rpm is not available; skipping .rpm package" >&2
-    return 0
-  fi
-
-  mkdir -p target/release
-  cp "$binary" target/release/burrow
-  if cargo generate-rpm -p burrow; then
-    find target/generate-rpm -type f -name '*.rpm' -exec cp {} "${out_root}/linux/" \; 2>/dev/null || true
-    find "${out_root}/linux" -maxdepth 1 -type f -name '*.rpm' -print | while read -r rpm; do
-      sha256_file "$rpm"
-    done
-  else
-    echo "warning: cargo-generate-rpm failed for ${rpm_arch}; skipping .rpm package" >&2
-  fi
-}
-
-package_pacman() {
-  local target binary pacman_arch pkg_version pkgrel work source_sum service_sum socket_sum readme_sum license_sum
-  target="$1"
-  binary="$2"
-  if ! pacman_arch="$(pacman_arch_for_target "$target")"; then
-    echo "warning: no pacman architecture mapping for ${target}; skipping Arch package" >&2
-    return 0
-  fi
-  if ! command -v makepkg >/dev/null 2>&1; then
-    echo "warning: makepkg is not available; skipping Arch package" >&2
-    return 0
-  fi
-
-  pkg_version="${BURROW_ARCH_PKGVER:-$(burrow_crate_version)_$(arch_package_suffix)}"
-  pkgrel="${BURROW_ARCH_PKGREL:-1}"
-  work="${out_root}/linux/pkg-arch/${pacman_arch}"
-  rm -rf "$work"
-  mkdir -p "$work"
-  install -m 0755 "$binary" "$work/burrow"
-  install -m 0644 systemd/burrow.service "$work/burrow.service"
-  install -m 0644 systemd/burrow.socket "$work/burrow.socket"
-  install -m 0644 README.md "$work/README.md"
-  install -m 0644 LICENSE.md "$work/LICENSE.md"
-
-  source_sum="$(sha256sum "$work/burrow" | awk '{ print $1 }')"
-  service_sum="$(sha256sum "$work/burrow.service" | awk '{ print $1 }')"
-  socket_sum="$(sha256sum "$work/burrow.socket" | awk '{ print $1 }')"
-  readme_sum="$(sha256sum "$work/README.md" | awk '{ print $1 }')"
-  license_sum="$(sha256sum "$work/LICENSE.md" | awk '{ print $1 }')"
-
-  cat > "$work/PKGBUILD" <<EOF
-# Maintainer: Burrow Release Automation <packages@burrow.net>
-pkgname=burrow
-pkgver=${pkg_version}
-pkgrel=${pkgrel}
-pkgdesc="Burrow VPN daemon and CLI"
-arch=("${pacman_arch}")
-url="https://git.burrow.net/hackclub/burrow"
-license=("GPL-3.0-or-later")
-depends=("systemd")
-source=("burrow" "burrow.service" "burrow.socket" "README.md" "LICENSE.md")
-sha256sums=("${source_sum}" "${service_sum}" "${socket_sum}" "${readme_sum}" "${license_sum}")
-
-package() {
-  install -Dm755 "\${srcdir}/burrow" "\${pkgdir}/usr/bin/burrow"
-  install -Dm644 "\${srcdir}/burrow.service" "\${pkgdir}/usr/lib/systemd/system/burrow.service"
-  install -Dm644 "\${srcdir}/burrow.socket" "\${pkgdir}/usr/lib/systemd/system/burrow.socket"
-  install -Dm644 "\${srcdir}/README.md" "\${pkgdir}/usr/share/doc/burrow/README.md"
-  install -Dm644 "\${srcdir}/LICENSE.md" "\${pkgdir}/usr/share/licenses/burrow/LICENSE.md"
-}
-EOF
-
-  (
-    cd "$work"
-    makepkg --force --nodeps --noconfirm
-  )
-  find "$work" -maxdepth 1 -type f -name '*.pkg.tar.*' -exec cp {} "${out_root}/linux/" \;
-  find "${out_root}/linux" -maxdepth 1 -type f -name '*.pkg.tar.*' -print | while read -r package; do
-    sha256_file "$package"
-  done
-}
-
-package_linux() {
-  local target host archive staging
-  host="$(rustc -vV | awk '/^host:/ { print $2 }')"
-  target="${BURROW_LINUX_TARGET:-$host}"
-  if [[ "$target" != *-linux-* && -z "${BURROW_LINUX_TARGET:-}" ]]; then
-    mkdir -p "${out_root}/linux"
-    echo "warning: host target ${target} is not Linux; skipping Linux artifact on this host" >&2
-    printf 'Linux build was skipped on host target %s. Run this lane on a Linux Namespace runner or set BURROW_LINUX_TARGET explicitly.\n' "$target" > "${out_root}/linux/README.txt"
-    return 0
-  fi
-  staging="${out_root}/linux/burrow-${build_number}-${target}"
-  mkdir -p "$staging"
-
-  cargo build --locked --release -p burrow --bin burrow --target "$target"
-  install -m 0755 "target/${target}/release/burrow" "$staging/burrow"
-  copy_license_readme "$staging"
-
-  archive="${out_root}/linux/burrow-${build_number}-${target}.tar.gz"
-  tar -C "${out_root}/linux" -czf "$archive" "$(basename "$staging")"
-  sha256_file "$archive"
-
-  package_deb "$target" "target/${target}/release/burrow"
-  package_rpm "$target" "target/${target}/release/burrow"
-  package_pacman "$target" "target/${target}/release/burrow"
-}
-
-package_windows_stub_unix() {
-  local target exe archive staging
-  target="${BURROW_WINDOWS_TARGET:-x86_64-pc-windows-gnu}"
-  staging="${out_root}/windows/burrow-${build_number}-${target}"
-  mkdir -p "$staging"
-
-  target_libdir="$(rustc --print target-libdir --target "$target" 2>/dev/null || true)"
-  if [[ -z "$target_libdir" || ! -d "$target_libdir" ]]; then
-    echo "warning: Rust target ${target} is not installed on this host" >&2
-    printf 'Windows stub build for %s was skipped on this host. Use the Namespace Windows lane for the native artifact.\n' "$target" > "${out_root}/windows/README.txt"
-    return 0
-  fi
-
-  if cargo build --locked --release -p burrow-windows-stub --target "$target"; then
-    exe="target/${target}/release/burrow.exe"
-  else
-    echo "warning: unable to build the Windows release stub on this host" >&2
-    printf 'Windows stub build for %s was skipped on this host. Use the Namespace Windows lane for the native artifact.\n' "$target" > "${out_root}/windows/README.txt"
-    return 0
-  fi
-
-  install -m 0755 "$exe" "$staging/burrow.exe"
-  copy_license_readme "$staging"
-  printf 'Burrow Windows stub build %s\n' "$build_number" > "$staging/README-Windows.txt"
-
-  archive="${out_root}/windows/burrow-${build_number}-${target}.zip"
-  (cd "${out_root}/windows" && zip -qr "$archive" "$(basename "$staging")")
-  sha256_file "$archive"
-}
-
-package_sparkle_unsigned() {
-  local macos_dir appcast channel dmg
-  channel="${SPARKLE_CHANNEL:-build-${build_number}}"
-  macos_dir="${out_root}/macos"
-  appcast="${out_root}/sparkle/${channel}/appcast.xml"
-  mkdir -p "$(dirname "$appcast")"
-
-  dmg="$(find "$macos_dir" -maxdepth 1 -type f -name '*.dmg' -print 2>/dev/null | sort | tail -n 1 || true)"
-  if [[ -z "$dmg" ]]; then
-    echo "No macOS DMG exists yet; Sparkle appcast generation is waiting on the macOS signed artifact." > "${out_root}/sparkle/${channel}/README.txt"
-    return 0
-  fi
-
-  local name length pubdate url
-  name="$(basename "$dmg")"
-  length="$(wc -c < "$dmg" | tr -d ' ')"
-  pubdate="$(LC_ALL=C date -u '+%a, %d %b %Y %H:%M:%S +0000')"
-  url="${SPARKLE_DOWNLOAD_PREFIX:-https://releases.burrow.net/sparkle}/${channel}/${name}"
-  cat > "$appcast" <<EOF
-<?xml version="1.0" encoding="utf-8"?>
-<rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle">
-  <channel>
-    <title>Burrow ${channel}</title>
-    <item>
-      <title>Burrow ${build_number}</title>
-      <pubDate>${pubdate}</pubDate>
-      <sparkle:version>${build_number}</sparkle:version>
-      <sparkle:shortVersionString>0.1</sparkle:shortVersionString>
-      <enclosure url="${url}" sparkle:version="${build_number}" length="${length}" type="application/octet-stream" />
-    </item>
-  </channel>
-</rss>
-EOF
-  cp "$dmg" "${out_root}/sparkle/${channel}/"
-}
-
-case "$platform" in
-  all)
-    package_linux
-    package_windows_stub_unix
-    if [[ "$(uname -s)" == "Darwin" ]] && command -v xcodebuild >/dev/null 2>&1; then
-      Scripts/ci/package-apple-artifacts.sh all
-    else
-      mkdir -p "${out_root}/apple"
-      printf 'Apple artifacts require a macOS runner with Xcode. The release workflow builds them in the dedicated Apple lane.\n' > "${out_root}/apple/README.txt"
-    fi
-    package_sparkle_unsigned
-    ;;
-  linux)
-    package_linux
-    ;;
-  windows-stub|windows)
-    package_windows_stub_unix
-    ;;
-  sparkle)
-    package_sparkle_unsigned
-    ;;
-  apple)
-    Scripts/ci/package-apple-artifacts.sh all
-    ;;
-  ios|macos)
-    Scripts/ci/package-apple-artifacts.sh "$platform"
-    ;;
-  *)
-    echo "unknown release platform: $platform" >&2
-    exit 64
-    ;;
-esac
-
-find "$out_root" -type f -print | sort
diff --git a/Scripts/ci/publish-forgejo-release.sh b/Scripts/ci/publish-forgejo-release.sh
deleted file mode 100755
index 5a976b8..0000000
--- a/Scripts/ci/publish-forgejo-release.sh
+++ /dev/null
@@ -1,69 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-: "${API_URL:?API_URL is required}"
-: "${REPOSITORY:?REPOSITORY is required}"
-: "${RELEASE_TAG:?RELEASE_TAG is required}"
-: "${TOKEN:?TOKEN is required}"
-
-release_api="${API_URL}/repos/${REPOSITORY}/releases"
-encoded_release_tag="$(python3 -c 'import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1], safe=""))' "${RELEASE_TAG}")"
-tag_api="${release_api}/tags/${encoded_release_tag}"
-release_json="$(mktemp)"
-create_json="$(mktemp)"
-trap 'rm -f "${release_json}" "${create_json}"' EXIT
-
-status="$(
-  curl -sS -o "${release_json}" -w '%{http_code}' \
-    -H "Authorization: token ${TOKEN}" \
-    "${tag_api}"
-)"
-
-if [[ "${status}" == "404" ]]; then
-  jq -n \
-    --arg tag "${RELEASE_TAG}" \
-    --arg name "Burrow ${RELEASE_TAG}" \
-    '{
-      tag_name: $tag,
-      target_commitish: $tag,
-      name: $name,
-      body: "Automated prerelease built on Forgejo Namespace runners.",
-      draft: false,
-      prerelease: true
-    }' > "${create_json}"
-
-  curl -fsS \
-    -H "Authorization: token ${TOKEN}" \
-    -H "Content-Type: application/json" \
-    -d @"${create_json}" \
-    "${release_api}" > "${release_json}"
-elif [[ "${status}" != "200" ]]; then
-  echo "failed to query Forgejo release for ${RELEASE_TAG} (HTTP ${status})" >&2
-  cat "${release_json}" >&2
-  exit 1
-fi
-
-release_id="$(jq -r '.id' "${release_json}")"
-if [[ -z "${release_id}" || "${release_id}" == "null" ]]; then
-  echo "Forgejo release payload is missing an id" >&2
-  cat "${release_json}" >&2
-  exit 1
-fi
-
-for file in dist/*; do
-  if [[ ! -f "${file}" ]]; then
-    continue
-  fi
-  name="$(basename "${file}")"
-  asset_id="$(jq -r --arg name "${name}" '.assets[]? | select(.name == $name) | .id' "${release_json}" | head -n1)"
-  if [[ -n "${asset_id}" ]]; then
-    curl -fsS -X DELETE \
-      -H "Authorization: token ${TOKEN}" \
-      "${release_api}/${release_id}/assets/${asset_id}" >/dev/null
-  fi
-
-  curl -fsS \
-    -H "Authorization: token ${TOKEN}" \
-    -F "attachment=@${file}" \
-    "${release_api}/${release_id}/assets?name=${name}" >/dev/null
-done
diff --git a/Scripts/ci/publish-nix-cache.sh b/Scripts/ci/publish-nix-cache.sh
deleted file mode 100755
index f8e55e3..0000000
--- a/Scripts/ci/publish-nix-cache.sh
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "${repo_root}"
-
-cache_server_name="${BURROW_NIX_CACHE_SERVER_NAME:-burrow}"
-cache_server_url="${BURROW_NIX_CACHE_SERVER_URL:-https://nix.burrow.net}"
-cache_name="${BURROW_NIX_CACHE_NAME:-burrow}"
-cache_ref="${cache_server_name}:${cache_name}"
-token="${BURROW_NIX_CACHE_PUSH_TOKEN:-}"
-
-if [[ -z "$token" ]]; then
-  if [[ "${BURROW_NIX_CACHE_REQUIRED:-false}" == "true" ]]; then
-    echo "BURROW_NIX_CACHE_PUSH_TOKEN is required to publish Nix cache paths" >&2
-    exit 1
-  fi
-  echo "::notice ::BURROW_NIX_CACHE_PUSH_TOKEN is not set; skipping Nix cache publish."
-  exit 0
-fi
-
-if ! command -v attic >/dev/null 2>&1; then
-  echo "attic is required to publish Nix cache paths" >&2
-  exit 127
-fi
-
-if ! command -v nix >/dev/null 2>&1; then
-  echo "nix is required to build paths for cache publishing" >&2
-  exit 127
-fi
-
-attic login "$cache_server_name" "$cache_server_url" "$token" --set-default
-
-push_inputs=("$@")
-if [[ "${#push_inputs[@]}" -eq 0 ]]; then
-  read -r -a attrs <<< "${BURROW_NIX_CACHE_ATTRS:-.#burrow .#forgejo-nsc-dispatcher .#forgejo-nsc-autoscaler}"
-  if [[ "${#attrs[@]}" -eq 0 ]]; then
-    echo "no Nix attrs were supplied for cache publishing" >&2
-    exit 1
-  fi
-  mapfile -t push_inputs < <(nix build --no-link --print-out-paths "${attrs[@]}")
-fi
-
-if [[ "${#push_inputs[@]}" -eq 0 ]]; then
-  echo "no Nix output paths were produced for cache publishing" >&2
-  exit 1
-fi
-
-attic push "$cache_ref" "${push_inputs[@]}"
diff --git a/Scripts/ci/resolve-nix-bin.sh b/Scripts/ci/resolve-nix-bin.sh
deleted file mode 100755
index 47f0cb0..0000000
--- a/Scripts/ci/resolve-nix-bin.sh
+++ /dev/null
@@ -1,56 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-find_nix_bin() {
-  local candidate
-  for candidate in \
-    "${NIX_BIN:-}" \
-    "$(command -v nix 2>/dev/null || true)" \
-    "${HOME:-}/.nix-profile/bin/nix" \
-    "${HOME:-}/.local/state/nix/profile/bin/nix" \
-    "/nix/var/nix/profiles/per-user/${USER:-runner}/profile/bin/nix" \
-    /nix/var/nix/profiles/default/bin/nix \
-    /run/current-system/sw/bin/nix \
-    /etc/profiles/per-user/runner/bin/nix \
-    /Users/runner/.nix-profile/bin/nix \
-    /Users/runner/.local/state/nix/profile/bin/nix \
-    /home/runner/.nix-profile/bin/nix \
-    /home/runner/.local/state/nix/profile/bin/nix \
-    /nix/profile/bin/nix; do
-    if [[ -n "$candidate" && -x "$candidate" ]]; then
-      printf '%s\n' "$candidate"
-      return 0
-    fi
-  done
-
-  candidate="$(
-    find \
-      "${HOME:-/nonexistent}" \
-      /Users/runner \
-      /home/runner \
-      /nix/var/nix/profiles \
-      /etc/profiles/per-user \
-      -path '*/bin/nix' -type f 2>/dev/null | head -n 1 || true
-  )"
-  if [[ -n "$candidate" && -x "$candidate" ]]; then
-    printf '%s\n' "$candidate"
-    return 0
-  fi
-
-  return 1
-}
-
-if nix_bin="$(find_nix_bin)"; then
-  printf '%s\n' "$nix_bin"
-  exit 0
-fi
-
-if bash Scripts/ci/ensure-nix.sh >/dev/null 2>&1; then
-  if nix_bin="$(find_nix_bin)"; then
-    printf '%s\n' "$nix_bin"
-    exit 0
-  fi
-fi
-
-echo "::error ::nix is required but is not on PATH and no standard install path exists" >&2
-exit 1
diff --git a/Scripts/ci/sync-apple-provisioning-profiles.sh b/Scripts/ci/sync-apple-provisioning-profiles.sh
deleted file mode 100755
index 72fe6d8..0000000
--- a/Scripts/ci/sync-apple-provisioning-profiles.sh
+++ /dev/null
@@ -1,72 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "$repo_root"
-
-platform="${1:-all}"
-out_dir="${BURROW_APPLE_PROFILES_OUT_DIR:-.forgejo/actions/export}"
-app_id="${BURROW_APPLE_BUNDLE_ID:-net.burrow.app}"
-network_id="${BURROW_APPLE_NETWORK_EXTENSION_BUNDLE_ID:-${app_id}.network}"
-replace_certificate_mismatch="${BURROW_APPLE_REPLACE_CERTIFICATE_MISMATCH:-false}"
-if [[ -n "${BURROW_IOS_DISTRIBUTION_CERTIFICATE_ID:-}" || -n "${BURROW_DEVELOPER_ID_CERTIFICATE_ID:-}" ]]; then
-  replace_certificate_mismatch="${BURROW_APPLE_REPLACE_CERTIFICATE_MISMATCH:-true}"
-fi
-
-key_id="${ASC_API_KEY_ID:-${APPSTORE_KEY_ID:-}}"
-issuer_id="${ASC_API_ISSUER_ID:-${APPSTORE_KEY_ISSUER_ID:-}}"
-key_path="${ASC_API_KEY_PATH:-${APPSTORE_KEY_PATH:-}}"
-key_base64="${ASC_API_KEY_BASE64:-}"
-
-if [[ -z "$key_id" || -z "$issuer_id" ]]; then
-  echo "::notice ::App Store Connect credentials are not available; provisioning profile sync skipped."
-  exit 0
-fi
-
-temp_key=""
-cleanup() {
-  [[ -z "$temp_key" ]] || rm -f "$temp_key"
-}
-trap cleanup EXIT
-
-if [[ -z "$key_path" ]]; then
-  if [[ -z "$key_base64" ]]; then
-    echo "::notice ::ASC_API_KEY_PATH/ASC_API_KEY_BASE64 is not available; provisioning profile sync skipped."
-    exit 0
-  fi
-  temp_key="$(mktemp "${RUNNER_TEMP:-/tmp}/burrow-asc-key.XXXXXX.p8")"
-  printf '%s' "$key_base64" | base64 --decode > "$temp_key"
-  chmod 600 "$temp_key"
-  key_path="$temp_key"
-fi
-
-if [[ ! -f "$key_path" ]]; then
-  echo "::error ::App Store Connect key path does not exist: ${key_path}" >&2
-  exit 1
-fi
-
-mkdir -p "$out_dir"
-profile_args=(
-  --platform "$platform"
-  --key-id "$key_id"
-  --issuer-id "$issuer_id"
-  --key-file "$key_path"
-  --out-dir "$out_dir"
-  --app-id "$app_id"
-  --network-id "$network_id"
-  --create-missing-bundle-ids "${BURROW_APPLE_CREATE_MISSING_BUNDLE_IDS:-false}"
-  --enable-capabilities "${BURROW_APPLE_ENABLE_CAPABILITIES:-false}"
-  --replace-certificate-mismatch "$replace_certificate_mismatch"
-  --bundle-platform "${BURROW_APPLE_BUNDLE_PLATFORM:-UNIVERSAL}"
-  --associated-domains "${BURROW_APPLE_ASSOCIATED_DOMAINS:-applinks:burrow.rs?mode=developer,webcredentials:burrow.rs?mode=developer}"
-)
-
-if [[ -n "${BURROW_IOS_DISTRIBUTION_CERTIFICATE_ID:-}" ]]; then
-  profile_args+=(--ios-certificate-id "$BURROW_IOS_DISTRIBUTION_CERTIFICATE_ID")
-fi
-
-if [[ -n "${BURROW_DEVELOPER_ID_CERTIFICATE_ID:-}" ]]; then
-  profile_args+=(--macos-certificate-id "$BURROW_DEVELOPER_ID_CERTIFICATE_ID")
-fi
-
-node Scripts/apple/sync-provisioning-profiles.mjs "${profile_args[@]}"
diff --git a/Scripts/ci/upload-package-garage.sh b/Scripts/ci/upload-package-garage.sh
deleted file mode 100755
index 5dd87ba..0000000
--- a/Scripts/ci/upload-package-garage.sh
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-: "${BURROW_GARAGE_ENDPOINT:?BURROW_GARAGE_ENDPOINT is required}"
-: "${AWS_ACCESS_KEY_ID:?AWS_ACCESS_KEY_ID is required for Garage upload}"
-: "${AWS_SECRET_ACCESS_KEY:?AWS_SECRET_ACCESS_KEY is required for Garage upload}"
-
-repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "${repo_root}"
-
-source_dir="${BURROW_PACKAGE_REPOSITORY_DIR:-${repo_root}/publish/repositories}"
-
-if [[ ! -d "$source_dir" ]]; then
-  echo "package repository directory not found: $source_dir" >&2
-  exit 1
-fi
-
-if ! command -v aws >/dev/null 2>&1; then
-  echo "aws CLI is required for Garage package repository upload" >&2
-  exit 127
-fi
-
-bucket="${BURROW_PACKAGE_GARAGE_BUCKET:-burrow-packages}"
-prefix="${BURROW_PACKAGE_GARAGE_PREFIX:-${BURROW_PACKAGE_GCS_PREFIX:-}}"
-region="${BURROW_GARAGE_REGION:-garage}"
-destination="s3://${bucket}"
-
-if [[ -n "$prefix" ]]; then
-  destination="${destination}/${prefix}"
-fi
-
-export AWS_DEFAULT_REGION="$region"
-export AWS_EC2_METADATA_DISABLED=true
-
-aws --endpoint-url "$BURROW_GARAGE_ENDPOINT" s3 sync "$source_dir" "$destination" --no-progress
diff --git a/Scripts/ci/upload-package-repositories.sh b/Scripts/ci/upload-package-repositories.sh
deleted file mode 100755
index f6f0b8c..0000000
--- a/Scripts/ci/upload-package-repositories.sh
+++ /dev/null
@@ -1,28 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "${repo_root}"
-
-prefix="${BURROW_PACKAGE_GCS_PREFIX:-}"
-source_dir="${BURROW_PACKAGE_REPOSITORY_DIR:-${repo_root}/publish/repositories}"
-
-if [[ ! -d "$source_dir" ]]; then
-  echo "package repository directory not found: $source_dir" >&2
-  exit 1
-fi
-
-bucket="${BURROW_PACKAGE_GCS_BUCKET:-burrow-net-packages}"
-if ! command -v gcloud >/dev/null 2>&1; then
-  echo "gcloud is required for GCS package repository upload" >&2
-  exit 127
-fi
-gcloud auth list --filter=status:ACTIVE --format='value(account)' | grep -q . || {
-  echo "gcloud has no active account; run Scripts/ci/google-wif-auth.sh first" >&2
-  exit 1
-}
-destination="gs://${bucket}"
-if [[ -n "$prefix" ]]; then
-  destination="${destination}/${prefix}"
-fi
-gcloud storage rsync --recursive "$source_dir" "$destination"
diff --git a/Scripts/ci/upload-package-storage.sh b/Scripts/ci/upload-package-storage.sh
deleted file mode 100755
index 7c4eb63..0000000
--- a/Scripts/ci/upload-package-storage.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "${repo_root}"
-
-uploaded=0
-garage_configured=0
-
-if [[ -n "${BURROW_GARAGE_ENDPOINT:-}" && -n "${AWS_ACCESS_KEY_ID:-}" && -n "${AWS_SECRET_ACCESS_KEY:-}" ]]; then
-  garage_configured=1
-fi
-
-if [[ "$garage_configured" == "1" ]]; then
-  Scripts/ci/upload-package-garage.sh
-  uploaded=1
-elif [[ "${BURROW_PACKAGE_REQUIRE_GARAGE:-false}" == "true" ]]; then
-  echo "Garage package repository upload is required, but BURROW_GARAGE_ENDPOINT or AWS credentials are missing" >&2
-  exit 1
-else
-  echo "::notice ::Garage package repository upload not configured; skipping primary S3-compatible target."
-fi
-
-if [[ "${BURROW_PACKAGE_GCS_BACKUP:-true}" != "false" ]]; then
-  if ! command -v gcloud >/dev/null 2>&1; then
-    echo "gcloud is required for GCS package repository backup" >&2
-    exit 127
-  fi
-  if ! gcloud auth list --filter=status:ACTIVE --format='value(account)' | grep -q .; then
-    Scripts/ci/google-wif-auth.sh
-  fi
-  Scripts/ci/upload-package-repositories.sh
-  uploaded=1
-fi
-
-if [[ "$uploaded" != "1" ]]; then
-  echo "no package repository storage targets were enabled" >&2
-  exit 1
-fi
diff --git a/Scripts/ci/upload-release-garage.sh b/Scripts/ci/upload-release-garage.sh
deleted file mode 100755
index f5019aa..0000000
--- a/Scripts/ci/upload-release-garage.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-: "${BUILD_NUMBER:?BUILD_NUMBER is required}"
-: "${BURROW_GARAGE_ENDPOINT:?BURROW_GARAGE_ENDPOINT is required}"
-: "${AWS_ACCESS_KEY_ID:?AWS_ACCESS_KEY_ID is required for Garage upload}"
-: "${AWS_SECRET_ACCESS_KEY:?AWS_SECRET_ACCESS_KEY is required for Garage upload}"
-
-repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "${repo_root}"
-
-source_dir="${BURROW_RELEASE_OUT:-${repo_root}/dist/builds/${BUILD_NUMBER}}"
-
-if [[ ! -d "$source_dir" ]]; then
-  echo "release artifact directory not found: $source_dir" >&2
-  exit 1
-fi
-
-if ! command -v aws >/dev/null 2>&1; then
-  echo "aws CLI is required for Garage release upload" >&2
-  exit 127
-fi
-
-bucket="${BURROW_RELEASE_GARAGE_BUCKET:-burrow-releases}"
-region="${BURROW_GARAGE_REGION:-garage}"
-destination="s3://${bucket}/builds/${BUILD_NUMBER}"
-
-export AWS_DEFAULT_REGION="$region"
-export AWS_EC2_METADATA_DISABLED=true
-export AWS_REQUEST_CHECKSUM_CALCULATION="${AWS_REQUEST_CHECKSUM_CALCULATION:-when_required}"
-export AWS_RESPONSE_CHECKSUM_VALIDATION="${AWS_RESPONSE_CHECKSUM_VALIDATION:-when_required}"
-
-aws --endpoint-url "$BURROW_GARAGE_ENDPOINT" s3 sync "$source_dir" "$destination" --no-progress
diff --git a/Scripts/ci/upload-release-gcs.sh b/Scripts/ci/upload-release-gcs.sh
deleted file mode 100755
index 14bbce4..0000000
--- a/Scripts/ci/upload-release-gcs.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-: "${BUILD_NUMBER:?BUILD_NUMBER is required}"
-
-repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "${repo_root}"
-
-source_dir="${BURROW_RELEASE_OUT:-${repo_root}/dist/builds/${BUILD_NUMBER}}"
-
-if [[ ! -d "$source_dir" ]]; then
-  echo "release artifact directory not found: $source_dir" >&2
-  exit 1
-fi
-
-bucket="${BURROW_RELEASE_GCS_BUCKET:-burrow-net-releases}"
-if ! command -v gcloud >/dev/null 2>&1; then
-  echo "gcloud is required for GCS release upload" >&2
-  exit 127
-fi
-gcloud auth list --filter=status:ACTIVE --format='value(account)' | grep -q . || {
-  echo "gcloud has no active account; run Scripts/ci/google-wif-auth.sh first" >&2
-  exit 1
-}
-gcloud storage rsync --recursive "$source_dir" "gs://${bucket}/builds/${BUILD_NUMBER}"
diff --git a/Scripts/ci/upload-release-storage.sh b/Scripts/ci/upload-release-storage.sh
deleted file mode 100755
index 3e6bd5f..0000000
--- a/Scripts/ci/upload-release-storage.sh
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-: "${BUILD_NUMBER:?BUILD_NUMBER is required}"
-
-repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "${repo_root}"
-
-uploaded=0
-garage_configured=0
-
-if [[ -n "${BURROW_GARAGE_ENDPOINT:-}" && -n "${AWS_ACCESS_KEY_ID:-}" && -n "${AWS_SECRET_ACCESS_KEY:-}" ]]; then
-  garage_configured=1
-fi
-
-if [[ "$garage_configured" == "1" ]]; then
-  Scripts/ci/upload-release-garage.sh
-  uploaded=1
-elif [[ "${BURROW_RELEASE_REQUIRE_GARAGE:-false}" == "true" ]]; then
-  echo "Garage release upload is required, but BURROW_GARAGE_ENDPOINT or AWS credentials are missing" >&2
-  exit 1
-else
-  echo "::notice ::Garage release upload not configured; skipping primary S3-compatible target."
-fi
-
-if [[ "${BURROW_RELEASE_GCS_BACKUP:-true}" != "false" ]]; then
-  if ! command -v gcloud >/dev/null 2>&1; then
-    echo "gcloud is required for GCS release backup" >&2
-    exit 127
-  fi
-  if ! gcloud auth list --filter=status:ACTIVE --format='value(account)' | grep -q .; then
-    Scripts/ci/google-wif-auth.sh
-  fi
-  Scripts/ci/upload-release-gcs.sh
-  uploaded=1
-fi
-
-if [[ "$uploaded" != "1" ]]; then
-  echo "no release storage targets were enabled" >&2
-  exit 1
-fi
diff --git a/Scripts/cloudflare-upsert-a-record.sh b/Scripts/cloudflare-upsert-a-record.sh
deleted file mode 100755
index 88745af..0000000
--- a/Scripts/cloudflare-upsert-a-record.sh
+++ /dev/null
@@ -1,165 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/cloudflare-upsert-a-record.sh --zone <zone> --name <fqdn> --ipv4 <address> [options]
-
-Upsert a DNS-only or proxied Cloudflare A record without putting the API token on
-the process list.
-
-Options:
-  --zone <zone>              Cloudflare zone name, for example burrow.net
-  --name <fqdn>              Fully-qualified DNS record name
-  --ipv4 <address>           IPv4 address for the A record
-  --token-file <path>        Cloudflare API token file
-                             default: intake/cloudflare-token.txt
-  --ttl <seconds|auto>       Record TTL, or auto
-                             default: auto
-  --proxied <true|false>     Whether to proxy through Cloudflare
-                             default: false
-  -h, --help                 Show this help
-EOF
-}
-
-ZONE_NAME=""
-RECORD_NAME=""
-IPV4=""
-TOKEN_FILE="intake/cloudflare-token.txt"
-TTL_VALUE="auto"
-PROXIED="false"
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --zone)
-      ZONE_NAME="${2:?missing value for --zone}"
-      shift 2
-      ;;
-    --name)
-      RECORD_NAME="${2:?missing value for --name}"
-      shift 2
-      ;;
-    --ipv4)
-      IPV4="${2:?missing value for --ipv4}"
-      shift 2
-      ;;
-    --token-file)
-      TOKEN_FILE="${2:?missing value for --token-file}"
-      shift 2
-      ;;
-    --ttl)
-      TTL_VALUE="${2:?missing value for --ttl}"
-      shift 2
-      ;;
-    --proxied)
-      PROXIED="${2:?missing value for --proxied}"
-      shift 2
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "Unknown argument: $1" >&2
-      usage >&2
-      exit 2
-      ;;
-  esac
-done
-
-if [[ -z "${ZONE_NAME}" || -z "${RECORD_NAME}" || -z "${IPV4}" ]]; then
-  usage >&2
-  exit 2
-fi
-
-if [[ ! -f "${TOKEN_FILE}" ]]; then
-  echo "Cloudflare token file not found: ${TOKEN_FILE}" >&2
-  exit 1
-fi
-
-if [[ ! "${IPV4}" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
-  echo "Invalid IPv4 address: ${IPV4}" >&2
-  exit 1
-fi
-
-case "${PROXIED}" in
-  true|false)
-    ;;
-  *)
-    echo "--proxied must be true or false" >&2
-    exit 1
-    ;;
-esac
-
-case "${TTL_VALUE}" in
-  auto)
-    TTL_JSON=1
-    ;;
-  ''|*[!0-9]*)
-    echo "--ttl must be a number of seconds or auto" >&2
-    exit 1
-    ;;
-  *)
-    TTL_JSON="${TTL_VALUE}"
-    ;;
-esac
-
-TOKEN="$(tr -d '\r\n' < "${TOKEN_FILE}")"
-if [[ -z "${TOKEN}" ]]; then
-  echo "Cloudflare token file is empty: ${TOKEN_FILE}" >&2
-  exit 1
-fi
-
-cf_api() {
-  local method="$1"
-  local path="$2"
-  local body="${3-}"
-  if [[ -n "${body}" ]]; then
-    curl -fsS -X "${method}" \
-      -H "Authorization: Bearer ${TOKEN}" \
-      -H "Content-Type: application/json" \
-      --data "${body}" \
-      "https://api.cloudflare.com/client/v4${path}"
-  else
-    curl -fsS -X "${method}" \
-      -H "Authorization: Bearer ${TOKEN}" \
-      -H "Content-Type: application/json" \
-      "https://api.cloudflare.com/client/v4${path}"
-  fi
-}
-
-zone_lookup="$(cf_api GET "/zones?name=${ZONE_NAME}&status=active")"
-zone_id="$(jq -r '.result[0].id // empty' <<<"${zone_lookup}")"
-
-if [[ -z "${zone_id}" ]]; then
-  echo "Active Cloudflare zone not found: ${ZONE_NAME}" >&2
-  exit 1
-fi
-
-payload="$(jq -cn \
-  --arg type "A" \
-  --arg name "${RECORD_NAME}" \
-  --arg content "${IPV4}" \
-  --argjson proxied "${PROXIED}" \
-  --argjson ttl "${TTL_JSON}" \
-  '{type: $type, name: $name, content: $content, proxied: $proxied, ttl: $ttl}')"
-
-record_lookup="$(cf_api GET "/zones/${zone_id}/dns_records?type=A&name=${RECORD_NAME}")"
-record_id="$(jq -r '.result[0].id // empty' <<<"${record_lookup}")"
-
-if [[ -n "${record_id}" ]]; then
-  result="$(cf_api PUT "/zones/${zone_id}/dns_records/${record_id}" "${payload}")"
-  action="updated"
-else
-  result="$(cf_api POST "/zones/${zone_id}/dns_records" "${payload}")"
-  action="created"
-fi
-
-jq -r --arg action "${action}" '
-  if .success != true then
-    .errors | tostring | halt_error(1)
-  else
-    "Cloudflare DNS " + $action + ": " + .result.name + " -> " + .result.content +
-    " (proxied=" + (.result.proxied | tostring) + ", ttl=" + (.result.ttl | tostring) + ")"
-  end
-' <<<"${result}"
diff --git a/Scripts/forge-deploy.sh b/Scripts/forge-deploy.sh
deleted file mode 100755
index 5c4b959..0000000
--- a/Scripts/forge-deploy.sh
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-
-# shellcheck source=Scripts/_burrow-flake.sh
-source "${SCRIPT_DIR}/_burrow-flake.sh"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/forge-deploy.sh [--test|--switch] [--flake-attr <attr>] [--allow-dirty]
-
-Standardized remote deploy path for the Burrow forge host.
-
-Defaults:
-  --switch
-  --flake-attr burrow-forge
-
-Environment:
-  BURROW_FORGE_HOST        root@git.burrow.net
-  BURROW_FORGE_SSH_KEY     intake/agent_at_burrow_net_ed25519
-EOF
-}
-
-MODE="switch"
-FLAKE_ATTR="burrow-forge"
-ALLOW_DIRTY=0
-BURROW_FLAKE_TMPDIRS=()
-
-cleanup() {
-  burrow_cleanup_flake_tmpdirs
-}
-trap cleanup EXIT
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --test)
-      MODE="test"
-      shift
-      ;;
-    --switch)
-      MODE="switch"
-      shift
-      ;;
-    --flake-attr)
-      FLAKE_ATTR="${2:?missing value for --flake-attr}"
-      shift 2
-      ;;
-    --allow-dirty)
-      ALLOW_DIRTY=1
-      shift
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "Unknown argument: $1" >&2
-      usage >&2
-      exit 2
-      ;;
-  esac
-done
-
-REPO_ROOT="$(git rev-parse --show-toplevel)"
-cd "${REPO_ROOT}"
-
-if [[ ${ALLOW_DIRTY} -ne 1 ]] && [[ -n "$(git status --short)" ]]; then
-  echo "Refusing to deploy from a dirty checkout. Commit first, or pass --allow-dirty for incident-only work." >&2
-  exit 1
-fi
-
-FORGE_HOST="${BURROW_FORGE_HOST:-root@git.burrow.net}"
-FORGE_SSH_KEY="${BURROW_FORGE_SSH_KEY:-}"
-
-if [[ -z "${FORGE_SSH_KEY}" ]]; then
-  if [[ -f "${REPO_ROOT}/intake/agent_at_burrow_net_ed25519" ]]; then
-    FORGE_SSH_KEY="${REPO_ROOT}/intake/agent_at_burrow_net_ed25519"
-  else
-    FORGE_SSH_KEY="${HOME}/.ssh/agent_at_burrow_net_ed25519"
-  fi
-fi
-
-if [[ ! -f "${FORGE_SSH_KEY}" ]]; then
-  echo "Forge SSH key not found at ${FORGE_SSH_KEY}." >&2
-  echo "Set BURROW_FORGE_SSH_KEY or place the agent key in intake/." >&2
-  exit 1
-fi
-
-FORGE_KNOWN_HOSTS_FILE="${BURROW_FORGE_KNOWN_HOSTS_FILE:-${HOME}/.cache/burrow/forge-known_hosts}"
-mkdir -p "$(dirname "${FORGE_KNOWN_HOSTS_FILE}")"
-
-export NIX_SSHOPTS="-i ${FORGE_SSH_KEY} -o IdentitiesOnly=yes -o UserKnownHostsFile=${FORGE_KNOWN_HOSTS_FILE} -o StrictHostKeyChecking=accept-new"
-flake_ref="$(burrow_prepare_flake_ref "${REPO_ROOT}")"
-
-nix --extra-experimental-features "nix-command flakes" shell nixpkgs#nixos-rebuild -c \
-  nixos-rebuild "${MODE}" \
-  --flake "${flake_ref}#${FLAKE_ATTR}" \
-  --build-host "${FORGE_HOST}" \
-  --target-host "${FORGE_HOST}"
diff --git a/Scripts/forgejo-dispatch-via-host.sh b/Scripts/forgejo-dispatch-via-host.sh
deleted file mode 100755
index eee0c3f..0000000
--- a/Scripts/forgejo-dispatch-via-host.sh
+++ /dev/null
@@ -1,205 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/forgejo-dispatch-via-host.sh <workflow> [--ref <ref>] [--inputs <json>] [--inputs-file <path>] [--return-run-info]
-
-Dispatch a Burrow Forgejo workflow by SSHing to the live forge host and using
-the managed dispatcher token from the host runtime.
-
-Environment:
-  FORGEJO_BASE_URL                         Default: https://git.burrow.net
-  FORGEJO_REPO                             Default: hackclub/burrow
-  BURROW_FORGE_HOST                        Default: root@git.burrow.net
-  BURROW_FORGE_HOST_ADDRESS                Optional SSH HostName override
-  BURROW_FORGE_SSH_KEY                     Optional explicit SSH private key
-  AGE_FORGE_SSH_KEY                        Optional injected SSH private key material
-  BURROW_FORGE_DISPATCHER_CONFIG_FILE      Default: /run/agenix/burrowForgejoNscDispatcherConfig
-EOF
-}
-
-base_url="${FORGEJO_BASE_URL:-https://git.burrow.net}"
-repo_slug="${FORGEJO_REPO:-hackclub/burrow}"
-forge_host="${BURROW_FORGE_HOST:-root@git.burrow.net}"
-forge_host_address="${BURROW_FORGE_HOST_ADDRESS:-}"
-dispatcher_config_file="${BURROW_FORGE_DISPATCHER_CONFIG_FILE:-/run/agenix/burrowForgejoNscDispatcherConfig}"
-workflow=""
-ref="main"
-inputs_json=""
-return_run_info="false"
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    --ref)
-      ref="${2:-}"
-      shift 2
-      ;;
-    --inputs)
-      inputs_json="${2:-}"
-      shift 2
-      ;;
-    --inputs-file)
-      inputs_json="$(cat "${2:-}")"
-      shift 2
-      ;;
-    --return-run-info)
-      return_run_info="true"
-      shift
-      ;;
-    *)
-      if [[ -z "$workflow" ]]; then
-        workflow="$1"
-        shift
-      else
-        echo "Unexpected argument: $1" >&2
-        usage >&2
-        exit 64
-      fi
-      ;;
-  esac
-done
-
-if [[ -z "$workflow" ]]; then
-  echo "Missing workflow name or file, for example build-release.yml." >&2
-  usage >&2
-  exit 64
-fi
-
-script_dir="$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-resolved_forge_ssh_key="$("${script_dir}/resolve-forge-ssh-key.sh")"
-eval "$resolved_forge_ssh_key"
-ssh_key="${BURROW_FORGE_SSH_KEY}"
-
-if [[ -n "$inputs_json" ]]; then
-  if ! python3 - "$inputs_json" <<'PY' >/dev/null
-import json
-import sys
-
-value = json.loads(sys.argv[1])
-if not isinstance(value, dict):
-    raise SystemExit(1)
-PY
-  then
-    echo "--inputs must be a JSON object." >&2
-    exit 64
-  fi
-fi
-
-workflow_path="$(python3 - "$workflow" <<'PY'
-import sys
-import urllib.parse
-
-print(urllib.parse.quote(sys.argv[1], safe=""))
-PY
-)"
-
-payload="$(python3 - "$ref" "$inputs_json" "$return_run_info" <<'PY'
-import json
-import sys
-
-ref = sys.argv[1]
-inputs_arg = sys.argv[2]
-return_run_info = sys.argv[3] == "true"
-
-payload = {"ref": ref}
-if inputs_arg:
-    inputs = json.loads(inputs_arg)
-    payload["inputs"] = {key: str(value) for key, value in inputs.items()}
-if return_run_info:
-    payload["return_run_info"] = True
-print(json.dumps(payload))
-PY
-)"
-
-payload_b64="$(python3 - "$payload" <<'PY'
-import base64
-import sys
-
-print(base64.b64encode(sys.argv[1].encode()).decode())
-PY
-)"
-
-ssh_opts=(
-  -i "$ssh_key"
-  -o IdentitiesOnly=yes
-  -o UserKnownHostsFile=/dev/null
-  -o GlobalKnownHostsFile=/dev/null
-  -o StrictHostKeyChecking=accept-new
-)
-if [[ -n "$forge_host_address" ]]; then
-  ssh_opts+=(-o "HostName=$forge_host_address")
-fi
-
-response="$(
-  ssh "${ssh_opts[@]}" "$forge_host" bash -s -- \
-    "$base_url" "$repo_slug" "$workflow_path" "$dispatcher_config_file" "$payload_b64" <<'EOF'
-set -euo pipefail
-
-base_url="$1"
-repo_slug="$2"
-workflow_path="$3"
-dispatcher_config_file="$4"
-payload_b64="$5"
-
-payload="$(python3 - "$payload_b64" <<'PY'
-import base64
-import sys
-
-print(base64.b64decode(sys.argv[1]).decode())
-PY
-)"
-
-if [[ ! -s "$dispatcher_config_file" ]]; then
-  echo "Forge dispatcher config is missing or empty: $dispatcher_config_file" >&2
-  exit 1
-fi
-
-runtime_token="$(
-  awk '
-    /^[A-Za-z0-9_-]+:/ { in_forgejo = ($0 ~ /^forgejo:/); next }
-    in_forgejo && /^[[:space:]]+token:/ {
-      sub(/^[[:space:]]+token:[[:space:]]*/, "")
-      gsub(/^"/, "")
-      gsub(/"$/, "")
-      gsub(/^\047/, "")
-      gsub(/\047$/, "")
-      print
-      exit
-    }
-  ' "$dispatcher_config_file" | tr -d "\r\n"
-)"
-
-if [[ -z "$runtime_token" ]]; then
-  echo "Forge dispatcher token not found in $dispatcher_config_file" >&2
-  exit 1
-fi
-
-url="${base_url%/}/api/v1/repos/${repo_slug}/actions/workflows/${workflow_path}/dispatches"
-response_file="$(mktemp)"
-http_code="$(
-  curl -sS -o "$response_file" -w '%{http_code}' -X POST \
-    -H "Authorization: token ${runtime_token}" \
-    -H "Content-Type: application/json" \
-    --data-binary "$payload" \
-    "$url"
-)"
-if [[ "$http_code" != 2* ]]; then
-  cat "$response_file" >&2
-  rm -f "$response_file"
-  exit 22
-fi
-cat "$response_file"
-rm -f "$response_file"
-EOF
-)"
-
-if [[ "$return_run_info" == "true" ]]; then
-  printf '%s\n' "$response"
-else
-  echo "Dispatched ${workflow} on ${ref} via ${forge_host}."
-fi
diff --git a/Scripts/forgejo-dispatch.sh b/Scripts/forgejo-dispatch.sh
deleted file mode 100755
index a9a7090..0000000
--- a/Scripts/forgejo-dispatch.sh
+++ /dev/null
@@ -1,240 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/forgejo-dispatch.sh <workflow> [--ref <ref>] [--inputs <json>] [--inputs-file <path>] [--return-run-info]
-
-Dispatch a Burrow Forgejo workflow through the Forgejo API.
-
-Environment:
-  FORGEJO_BASE_URL                  Default: https://git.burrow.net
-  FORGEJO_REPO                      Default: hackclub/burrow
-  FORGEJO_PAT                       Token string
-  FORGEJO_PAT_FILE                  Path to plaintext token
-  FORGEJO_DISPATCH_HOST_FALLBACK    auto, always, or never. Default: auto
-EOF
-}
-
-repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-base_url="${FORGEJO_BASE_URL:-https://git.burrow.net}"
-repo_slug="${FORGEJO_REPO:-hackclub/burrow}"
-host_fallback="${FORGEJO_DISPATCH_HOST_FALLBACK:-auto}"
-original_args=("$@")
-workflow=""
-ref="main"
-inputs_json=""
-return_run_info="false"
-
-case "$host_fallback" in
-  auto|always|never) ;;
-  *)
-    echo "FORGEJO_DISPATCH_HOST_FALLBACK must be auto, always, or never." >&2
-    exit 64
-    ;;
-esac
-
-host_dispatch() {
-  local reason="$1"
-  local fallback="${repo_root}/Scripts/forgejo-dispatch-via-host.sh"
-
-  if [[ ! -x "$fallback" ]]; then
-    return 1
-  fi
-
-  echo "Forgejo API dispatch ${reason}; retrying through the forge host." >&2
-  exec "$fallback" "${original_args[@]}"
-}
-
-if [[ "$host_fallback" == "always" ]]; then
-  if ! host_dispatch "forced by FORGEJO_DISPATCH_HOST_FALLBACK=always"; then
-    echo "Forge host dispatcher is not available." >&2
-    exit 1
-  fi
-fi
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    --ref)
-      ref="${2:-}"
-      shift 2
-      ;;
-    --inputs)
-      inputs_json="${2:-}"
-      shift 2
-      ;;
-    --inputs-file)
-      inputs_json="$(cat "${2:-}")"
-      shift 2
-      ;;
-    --return-run-info)
-      return_run_info="true"
-      shift
-      ;;
-    *)
-      if [[ -z "$workflow" ]]; then
-        workflow="$1"
-        shift
-      else
-        echo "Unexpected argument: $1" >&2
-        usage >&2
-        exit 64
-      fi
-      ;;
-  esac
-done
-
-if [[ -z "$workflow" ]]; then
-  echo "Missing workflow name or file, for example build-release.yml." >&2
-  usage >&2
-  exit 64
-fi
-
-extract_dispatcher_token() {
-  python3 - "$1" <<'PY'
-import re
-import sys
-from pathlib import Path
-
-path = Path(sys.argv[1])
-in_forgejo = False
-for line in path.read_text(encoding="utf-8").splitlines():
-    if re.match(r"^[A-Za-z0-9_-]+:", line):
-        in_forgejo = line.startswith("forgejo:")
-        continue
-    if not in_forgejo:
-        continue
-    match = re.match(r"\s+token:\s*['\"]?([^'\"]+)['\"]?\s*$", line)
-    if match:
-        print(match.group(1))
-        break
-PY
-}
-
-decrypt_age_secret() {
-  local path="$1"
-
-  if [[ ! -f "$path" ]]; then
-    return 1
-  fi
-
-  if command -v nix >/dev/null 2>&1; then
-    nix run "${repo_root}#agenix" -- -d "$path" 2>/dev/null && return 0
-  fi
-
-  if command -v agenix >/dev/null 2>&1; then
-    agenix -d "$path" 2>/dev/null && return 0
-  fi
-
-  return 1
-}
-
-pat="${FORGEJO_PAT:-}"
-pat_source="none"
-if [[ -n "$pat" ]]; then
-  pat_source="FORGEJO_PAT"
-fi
-
-if [[ -z "$pat" && -n "${FORGEJO_PAT_FILE:-}" && -f "$FORGEJO_PAT_FILE" ]]; then
-  pat="$(tr -d '\r\n' < "$FORGEJO_PAT_FILE")"
-  if [[ -n "$pat" ]]; then
-    pat_source="FORGEJO_PAT_FILE"
-  fi
-fi
-
-if [[ -z "$pat" ]]; then
-  for default_file in \
-    "${repo_root}/intake/forgejo_dispatch_pat.txt" \
-    "${repo_root}/intake/forgejo_nsc_dispatcher.yaml"
-  do
-    if [[ -s "$default_file" ]]; then
-      if [[ "$default_file" == *.yaml ]]; then
-        pat="$(extract_dispatcher_token "$default_file" | tr -d '\r\n')"
-      else
-        pat="$(tr -d '\r\n' < "$default_file")"
-      fi
-    fi
-    if [[ -n "$pat" ]]; then
-      pat_source="$default_file"
-      break
-    fi
-  done
-fi
-
-if [[ -z "$pat" ]]; then
-  decrypted_config="$(mktemp)"
-  trap 'rm -f "$decrypted_config"' EXIT
-  if decrypt_age_secret "${repo_root}/secrets/infra/forgejo-nsc-dispatcher-config.age" > "$decrypted_config"; then
-    pat="$(extract_dispatcher_token "$decrypted_config" | tr -d '\r\n')"
-    if [[ -n "$pat" ]]; then
-      pat_source="secrets/infra/forgejo-nsc-dispatcher-config.age"
-    fi
-  fi
-fi
-
-if [[ -z "$pat" ]]; then
-  if [[ "$host_fallback" == "auto" ]]; then
-    if host_dispatch "has no local token"; then
-      exit 0
-    fi
-  fi
-  echo "Forgejo token not found. Set FORGEJO_PAT or FORGEJO_PAT_FILE." >&2
-  exit 1
-fi
-
-if [[ -n "$inputs_json" ]]; then
-  if ! printf '%s\n' "$inputs_json" | jq -e 'type == "object"' >/dev/null 2>&1; then
-    echo "--inputs must be a JSON object." >&2
-    exit 64
-  fi
-  inputs_json="$(printf '%s\n' "$inputs_json" | jq -c 'with_entries(.value |= tostring)')"
-  payload="$(jq -n --arg ref "$ref" --argjson inputs "$inputs_json" --argjson return_run_info "$return_run_info" \
-    '{ref:$ref, inputs:$inputs} + (if $return_run_info then {return_run_info:true} else {} end)')"
-else
-  payload="$(jq -n --arg ref "$ref" --argjson return_run_info "$return_run_info" \
-    '{ref:$ref} + (if $return_run_info then {return_run_info:true} else {} end)')"
-fi
-
-workflow_path="$(python3 - "$workflow" <<'PY'
-import sys
-import urllib.parse
-
-print(urllib.parse.quote(sys.argv[1], safe=""))
-PY
-)"
-
-url="${base_url%/}/api/v1/repos/${repo_slug}/actions/workflows/${workflow_path}/dispatches"
-response_file="$(mktemp)"
-trap 'rm -f "$response_file" "${decrypted_config:-}"' EXIT
-
-curl_status=0
-http_code="$(
-  curl -sS -o "$response_file" -w '%{http_code}' -X POST \
-    -H "Authorization: token ${pat}" \
-    -H "Content-Type: application/json" \
-    --data-binary "$payload" \
-    "$url"
-)" || curl_status="$?"
-
-if [[ "$curl_status" != "0" || "$http_code" != 2* ]]; then
-  if [[ "$host_fallback" == "auto" && "$pat_source" != "FORGEJO_PAT" && ( "$http_code" == "401" || "$http_code" == "403" ) ]]; then
-    if host_dispatch "returned HTTP ${http_code} with ${pat_source}"; then
-      exit 0
-    fi
-  fi
-
-  cat "$response_file" >&2 || true
-  if [[ "$curl_status" != "0" ]]; then
-    exit "$curl_status"
-  fi
-  exit 22
-fi
-
-cat "$response_file"
-if [[ "$return_run_info" != "true" ]]; then
-  echo "Dispatched ${workflow} on ${ref}."
-fi
diff --git a/Scripts/generate-brand-icons.py b/Scripts/generate-brand-icons.py
deleted file mode 100755
index 02dd15d..0000000
--- a/Scripts/generate-brand-icons.py
+++ /dev/null
@@ -1,450 +0,0 @@
-#!/usr/bin/env python3
-"""Generate Burrow app icons from locked raster panel masters."""
-
-from __future__ import annotations
-
-import json
-import shutil
-import subprocess
-import sys
-from pathlib import Path
-
-
-ROOT = Path(__file__).resolve().parents[1]
-BRAND = ROOT / "design" / "brand"
-PANEL_DIR = BRAND / "panel-variants"
-APPLE_ASSETS = ROOT / "Apple" / "UI" / "Assets.xcassets"
-APPICON_SET = APPLE_ASSETS / "AppIcon.appiconset"
-WATCHOS_BRAND_APPICON_SET = BRAND / "watchos" / "AppIcon.appiconset"
-ANDROID_RES = ROOT / "Android" / "app" / "src" / "main" / "res"
-GTK_ICONS = ROOT / "burrow-gtk" / "data" / "icons" / "hicolor"
-
-VARIANTS = [
-    ("panel-01-guardian", "BurrowPanel01", "Guardian", "top-left panel"),
-    ("panel-02-field", "BurrowPanel02", "Field", "top-middle panel"),
-    ("panel-03-burrow", "BurrowPanel03", "Burrow", "top-right panel"),
-    ("panel-04-sentinel", "BurrowPanel04", "Sentinel", "bottom-left panel"),
-    ("panel-05-stride", "BurrowPanel05", "Stride", "bottom-middle panel"),
-    ("panel-06-post", "BurrowPanel06", "Post", "bottom-right panel"),
-]
-
-PRIMARY_IOS = "panel-01-guardian"
-PRIMARY_MACOS = "panel-05-stride"
-PRIMARY_WATCHOS = "panel-03-burrow"
-PRIMARY_ANDROID = PRIMARY_IOS
-PRIMARY_LINUX = PRIMARY_IOS
-
-# Rough cells in the supplied 2928x1896 panel screenshot. Extraction trims the
-# white sheet background, makes the crop square with transparent padding, then
-# normalizes to 1024px.
-EXTRACTION_CELLS = {
-    "panel-01-guardian": (40, 40, 900, 900),
-    "panel-02-field": (940, 40, 900, 900),
-    "panel-03-burrow": (1840, 40, 900, 900),
-    "panel-04-sentinel": (40, 980, 900, 900),
-    "panel-05-stride": (940, 980, 900, 900),
-    "panel-06-post": (1840, 980, 900, 900),
-}
-
-IOS_ROWS = [
-    ("iphone", "20x20", "2x", 40, {}),
-    ("iphone", "20x20", "3x", 60, {}),
-    ("iphone", "29x29", "1x", 29, {}),
-    ("iphone", "29x29", "2x", 58, {}),
-    ("iphone", "29x29", "3x", 87, {}),
-    ("iphone", "40x40", "2x", 80, {}),
-    ("iphone", "40x40", "3x", 120, {}),
-    ("iphone", "57x57", "1x", 57, {}),
-    ("iphone", "57x57", "2x", 114, {}),
-    ("iphone", "60x60", "2x", 120, {}),
-    ("iphone", "60x60", "3x", 180, {}),
-    ("ipad", "20x20", "1x", 20, {}),
-    ("ipad", "20x20", "2x", 40, {}),
-    ("ipad", "29x29", "1x", 29, {}),
-    ("ipad", "29x29", "2x", 58, {}),
-    ("ipad", "40x40", "1x", 40, {}),
-    ("ipad", "40x40", "2x", 80, {}),
-    ("ipad", "50x50", "1x", 50, {}),
-    ("ipad", "50x50", "2x", 100, {}),
-    ("ipad", "72x72", "1x", 72, {}),
-    ("ipad", "72x72", "2x", 144, {}),
-    ("ipad", "76x76", "1x", 76, {}),
-    ("ipad", "76x76", "2x", 152, {}),
-    ("ipad", "83.5x83.5", "2x", 167, {}),
-    ("ios-marketing", "1024x1024", "1x", 1024, {}),
-]
-
-MAC_ROWS = [
-    ("mac", "16x16", "1x", 16, {}),
-    ("mac", "16x16", "2x", 32, {}),
-    ("mac", "32x32", "1x", 32, {}),
-    ("mac", "32x32", "2x", 64, {}),
-    ("mac", "128x128", "1x", 128, {}),
-    ("mac", "128x128", "2x", 256, {}),
-    ("mac", "256x256", "1x", 256, {}),
-    ("mac", "256x256", "2x", 512, {}),
-    ("mac", "512x512", "1x", 512, {}),
-    ("mac", "512x512", "2x", 1024, {}),
-]
-
-WATCH_ROWS = [
-    ("watch", "24x24", "2x", 48, {"role": "notificationCenter", "subtype": "38mm"}),
-    ("watch", "27.5x27.5", "2x", 55, {"role": "notificationCenter", "subtype": "42mm"}),
-    ("watch", "33x33", "2x", 66, {"role": "notificationCenter", "subtype": "45mm"}),
-    ("watch", "29x29", "2x", 58, {"role": "companionSettings"}),
-    ("watch", "29x29", "3x", 87, {"role": "companionSettings"}),
-    ("watch", "40x40", "2x", 80, {"role": "appLauncher", "subtype": "38mm"}),
-    ("watch", "44x44", "2x", 88, {"role": "appLauncher", "subtype": "40mm"}),
-    ("watch", "46x46", "2x", 92, {"role": "appLauncher", "subtype": "41mm"}),
-    ("watch", "50x50", "2x", 100, {"role": "appLauncher", "subtype": "44mm"}),
-    ("watch", "51x51", "2x", 102, {"role": "appLauncher", "subtype": "45mm"}),
-    ("watch", "54x54", "2x", 108, {"role": "appLauncher", "subtype": "49mm"}),
-    ("watch", "86x86", "2x", 172, {"role": "quickLook", "subtype": "38mm"}),
-    ("watch", "98x98", "2x", 196, {"role": "quickLook", "subtype": "42mm"}),
-    ("watch", "108x108", "2x", 216, {"role": "quickLook", "subtype": "44mm"}),
-    ("watch", "117x117", "2x", 234, {"role": "quickLook", "subtype": "45mm"}),
-    ("watch", "129x129", "2x", 258, {"role": "quickLook", "subtype": "49mm"}),
-    ("watch-marketing", "1024x1024", "1x", 1024, {}),
-]
-
-ANDROID_MIPMAPS = {
-    "mipmap-mdpi": 48,
-    "mipmap-hdpi": 72,
-    "mipmap-xhdpi": 96,
-    "mipmap-xxhdpi": 144,
-    "mipmap-xxxhdpi": 192,
-}
-
-LINUX_SIZES = [16, 24, 32, 48, 64, 128, 256, 512]
-
-
-def run(args: list[str]) -> None:
-    subprocess.run(args, cwd=ROOT, check=True)
-
-
-def output(args: list[str]) -> str:
-    return subprocess.check_output(args, cwd=ROOT, text=True).strip()
-
-
-def write_text(path: Path, text: str) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    path.write_text(text, encoding="utf-8")
-
-
-def write_json(path: Path, value: object) -> None:
-    write_text(path, json.dumps(value, indent=2) + "\n")
-
-
-def variant(asset_id: str) -> tuple[str, str, str, str]:
-    for item in VARIANTS:
-        if item[0] == asset_id:
-            return item
-    raise KeyError(asset_id)
-
-
-def master_path(asset_id: str) -> Path:
-    return PANEL_DIR / f"{asset_id}.png"
-
-
-def extract_masters(sheet: Path) -> None:
-    PANEL_DIR.mkdir(parents=True, exist_ok=True)
-    shutil.copyfile(sheet, PANEL_DIR / "source-sheet.png")
-    for asset_id, (x, y, w, h) in EXTRACTION_CELLS.items():
-        tmp = PANEL_DIR / f".{asset_id}-trim.png"
-        dest = master_path(asset_id)
-        run(
-            [
-                "magick",
-                str(sheet),
-                "-crop",
-                f"{w}x{h}+{x}+{y}",
-                "-fuzz",
-                "8%",
-                "-trim",
-                "+repage",
-                str(tmp),
-            ]
-        )
-        geometry = output(["magick", str(tmp), "-format", "%w %h", "info:"])
-        width, height = [int(part) for part in geometry.split()]
-        extent = max(width, height)
-        run(
-            [
-                "magick",
-                str(tmp),
-                "-alpha",
-                "set",
-                "-fuzz",
-                "6%",
-                "-fill",
-                "none",
-                "-draw",
-                "color 0,0 floodfill",
-                "-draw",
-                f"color {width - 1},0 floodfill",
-                "-draw",
-                f"color 0,{height - 1} floodfill",
-                "-draw",
-                f"color {width - 1},{height - 1} floodfill",
-                "-background",
-                "none",
-                "-gravity",
-                "center",
-                "-extent",
-                f"{extent}x{extent}",
-                "-resize",
-                "1024x1024!",
-                "(",
-                "-size",
-                "1024x1024",
-                "xc:none",
-                "-fill",
-                "white",
-                "-draw",
-                "roundrectangle 10,10 1013,1013 166,166",
-                ")",
-                "-compose",
-                "DstIn",
-                "-composite",
-                "-strip",
-                f"PNG32:{dest}",
-            ]
-        )
-        tmp.unlink()
-
-
-def ensure_masters() -> None:
-    missing = [asset_id for asset_id, *_ in VARIANTS if not master_path(asset_id).exists()]
-    if missing:
-        raise SystemExit(f"missing panel masters: {', '.join(missing)}")
-
-
-def clean_generated() -> None:
-    APPICON_SET.mkdir(parents=True, exist_ok=True)
-    for path in APPICON_SET.glob("*.png"):
-        path.unlink()
-    for path in APPLE_ASSETS.glob("BurrowPanel*.appiconset"):
-        shutil.rmtree(path)
-    for path in APPLE_ASSETS.glob("BurrowPanel*Preview.imageset"):
-        shutil.rmtree(path)
-    shutil.rmtree(WATCHOS_BRAND_APPICON_SET, ignore_errors=True)
-
-    low_res = BRAND / "low-res"
-    low_res.mkdir(parents=True, exist_ok=True)
-    for path in low_res.glob("*.png"):
-        path.unlink()
-    report = low_res / "report.csv"
-    if report.exists():
-        report.unlink()
-
-    for folder in ANDROID_MIPMAPS:
-        shutil.rmtree(ANDROID_RES / folder, ignore_errors=True)
-
-    for size in LINUX_SIZES:
-        shutil.rmtree(GTK_ICONS / str(size), ignore_errors=True)
-
-    for path in PANEL_DIR.glob("*-preview.png"):
-        path.unlink()
-    preview = PANEL_DIR / "preview-strip.png"
-    if preview.exists():
-        preview.unlink()
-
-
-def render_png(source: Path, dest: Path, size: int, *, png32: bool = True) -> None:
-    dest.parent.mkdir(parents=True, exist_ok=True)
-    prefix = "PNG32:" if png32 else "PNG24:"
-    run(
-        [
-            "magick",
-            str(source),
-            "-resize",
-            f"{size}x{size}!",
-            "-strip",
-            f"{prefix}{dest}",
-        ]
-    )
-
-
-def image_entry(idiom: str, size: str, scale: str, filename: str, extra: dict[str, str]) -> dict[str, str]:
-    row = {"filename": filename, "idiom": idiom, "scale": scale, "size": size}
-    row.update(extra)
-    return row
-
-
-def write_appicon_contents(path: Path, rows: list[dict[str, str]]) -> None:
-    write_json(path / "Contents.json", {"images": rows, "info": {"author": "xcode", "version": 1}})
-
-
-def generate_appicon_set(
-    path: Path,
-    source: Path,
-    prefix: str,
-    rows_def: list[tuple[str, str, str, int, dict[str, str]]],
-) -> list[dict[str, str]]:
-    path.mkdir(parents=True, exist_ok=True)
-    rows = []
-    rendered: set[tuple[str, int]] = set()
-    for idiom, size_label, scale, pixels, extra in rows_def:
-        filename = f"{prefix}-{pixels}.png"
-        rows.append(image_entry(idiom, size_label, scale, filename, extra))
-        key = (filename, pixels)
-        if key not in rendered:
-            render_png(source, path / filename, pixels)
-            rendered.add(key)
-    return rows
-
-
-def generate_apple_assets() -> None:
-    primary_rows = []
-    primary_rows.extend(generate_appicon_set(APPICON_SET, master_path(PRIMARY_IOS), "ios-panel-01", IOS_ROWS))
-    primary_rows.extend(generate_appicon_set(APPICON_SET, master_path(PRIMARY_MACOS), "mac-panel-05", MAC_ROWS))
-    write_appicon_contents(APPICON_SET, primary_rows)
-
-    watch_rows = generate_appicon_set(
-        WATCHOS_BRAND_APPICON_SET,
-        master_path(PRIMARY_WATCHOS),
-        "watch-panel-03",
-        WATCH_ROWS,
-    )
-    write_appicon_contents(WATCHOS_BRAND_APPICON_SET, watch_rows)
-
-    for asset_id, asset_name, _, _ in VARIANTS[1:]:
-        set_path = APPLE_ASSETS / f"{asset_name}.appiconset"
-        rows = generate_appicon_set(set_path, master_path(asset_id), asset_name, IOS_ROWS)
-        write_appicon_contents(set_path, rows)
-
-    for asset_id, asset_name, _, _ in VARIANTS:
-        preview_dir = APPLE_ASSETS / f"{asset_name}Preview.imageset"
-        preview_dir.mkdir(parents=True, exist_ok=True)
-        render_png(master_path(asset_id), preview_dir / "preview.png", 256)
-        write_json(
-            preview_dir / "Contents.json",
-            {
-                "images": [{"filename": "preview.png", "idiom": "universal", "scale": "1x"}],
-                "info": {"author": "xcode", "version": 1},
-            },
-        )
-
-
-def generate_brand_outputs() -> None:
-    primary = master_path(PRIMARY_IOS)
-    render_png(primary, BRAND / "burrow-owl-icon-master.png", 1024)
-    render_png(primary, BRAND / "burrowing-owl-icon-flat.png", 1024)
-    render_png(primary, BRAND / "Burrow.icon" / "Assets" / "owl-figure.png", 1024)
-    render_png(primary, BRAND / "Burrow.icon" / "Assets" / "owl-body.png", 1024)
-    transparent = BRAND / "Burrow.icon" / "Assets" / "transparent.png"
-    run(["magick", "-size", "1024x1024", "xc:none", f"PNG32:{transparent}"])
-    for name in ["burrow-ground", "owl-face", "owl-legs", "owl-spots"]:
-        shutil.copyfile(transparent, BRAND / "Burrow.icon" / "Assets" / f"{name}.png")
-    transparent.unlink()
-    write_json(
-        BRAND / "Burrow.icon" / "icon.json",
-        {
-            "fill": {"type": "solid", "color": "#00000000"},
-            "layers": [
-                {
-                    "blend-mode": "normal",
-                    "image-name": "owl-figure.png",
-                    "name": "panel-raster",
-                    "position": {"scale": 1, "translation-in-points": [0, 0]},
-                }
-            ],
-        },
-    )
-
-    low_res = BRAND / "low-res"
-    report_rows = ["size,colors,gray_stddev,status"]
-    preview_inputs = []
-    pixel_inputs = []
-    for size in [16, 20, 24, 29, 32, 40, 48, 64, 80, 128, 256, 1024]:
-        icon = low_res / f"burrow-icon-{size}.png"
-        render_png(primary, icon, size)
-        if size <= 256:
-            colors = output(["magick", str(icon), "-format", "%k", "info:"])
-            stddev = output(["magick", str(icon), "-colorspace", "Gray", "-format", "%[fx:standard_deviation]", "info:"])
-            status = "ok" if int(colors) >= 8 and float(stddev) >= 0.025 else "check"
-            report_rows.append(f"{size},{colors},{stddev},{status}")
-            preview = low_res / f"preview-{size}.png"
-            filter_name = "Point" if size <= 32 else "Lanczos"
-            run(["magick", str(icon), "-filter", filter_name, "-resize", "128x128", str(preview)])
-            preview_inputs.append(preview)
-            if size <= 32:
-                pixel = low_res / f"pixel-preview-{size}.png"
-                run(["magick", str(icon), "-filter", "Point", "-resize", "128x128", str(pixel)])
-                pixel_inputs.append(pixel)
-
-    write_text(low_res / "report.csv", "\n".join(report_rows) + "\n")
-    preview_inputs.reverse()
-    pixel_inputs.reverse()
-    run(["magick", "-background", "#202020", "-gravity", "center", *map(str, preview_inputs), "+append", str(low_res / "preview-strip.png")])
-    run(["magick", "-background", "#202020", "-gravity", "center", *map(str, pixel_inputs), "+append", str(low_res / "pixel-preview-strip.png")])
-
-    variant_previews = []
-    for asset_id, _, _, _ in VARIANTS:
-        preview = PANEL_DIR / f"{asset_id}-preview.png"
-        render_png(master_path(asset_id), preview, 256)
-        variant_previews.append(preview)
-    run(["magick", "-background", "#fbfaf6", "-gravity", "center", *map(str, variant_previews), "+append", str(PANEL_DIR / "preview-strip.png")])
-
-    lines = [
-        "# Burrow Raster Panel Icon Variants",
-        "",
-        "The six PNG masters here are cropped from `source-sheet.png` and are the",
-        "locked app icon source. Do not redraw them; regenerate package assets from",
-        "these rasters.",
-        "",
-        "| Variant | Use | Source |",
-        "| --- | --- | --- |",
-    ]
-    for asset_id, _, title, source in VARIANTS:
-        uses = []
-        if asset_id == PRIMARY_IOS:
-            uses.append("iOS primary")
-        else:
-            uses.append("iOS alternate")
-        if asset_id == PRIMARY_MACOS:
-            uses.append("macOS primary")
-        if asset_id == PRIMARY_WATCHOS:
-            uses.append("watchOS primary")
-        if asset_id == PRIMARY_ANDROID:
-            uses.append("Android primary")
-        if asset_id == PRIMARY_LINUX:
-            uses.append("Linux primary")
-        use_text = ", ".join(uses)
-        lines.append(f"| `{asset_id}` | {use_text} | {title}, {source} |")
-    lines.append("")
-    lines.append("`preview-strip.png` shows the six raster masters side by side.")
-    write_text(PANEL_DIR / "README.md", "\n".join(lines) + "\n")
-
-
-def generate_android_assets() -> None:
-    primary = master_path(PRIMARY_ANDROID)
-    for folder, size in ANDROID_MIPMAPS.items():
-        out_dir = ANDROID_RES / folder
-        render_png(primary, out_dir / "ic_launcher.png", size)
-        render_png(primary, out_dir / "ic_launcher_round.png", size)
-    render_png(primary, ROOT / "store-metadata" / "android" / "icon.png", 512)
-
-
-def generate_linux_assets() -> None:
-    primary = master_path(PRIMARY_LINUX)
-    for size in LINUX_SIZES:
-        render_png(primary, GTK_ICONS / str(size) / "apps" / "burrow-gtk.png", size)
-
-
-def main(argv: list[str]) -> None:
-    if len(argv) == 3 and argv[1] == "--extract-from":
-        extract_masters(Path(argv[2]))
-    elif len(argv) != 1:
-        raise SystemExit("usage: generate-brand-icons.py [--extract-from /path/to/panel-sheet.png]")
-
-    ensure_masters()
-    clean_generated()
-    generate_apple_assets()
-    generate_brand_outputs()
-    generate_android_assets()
-    generate_linux_assets()
-
-
-if __name__ == "__main__":
-    main(sys.argv)
diff --git a/Scripts/grafana-tofu.sh b/Scripts/grafana-tofu.sh
deleted file mode 100755
index d1f6a91..0000000
--- a/Scripts/grafana-tofu.sh
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT="$(
-  git rev-parse --show-toplevel 2>/dev/null || {
-    cd "$(dirname "${BASH_SOURCE[0]}")/.."
-    pwd
-  }
-)"
-
-work_dir="${BURROW_GRAFANA_TOFU_DIR:-$ROOT/infra/grafana}"
-plugin_cache_dir="${BURROW_TOFU_PLUGIN_CACHE_DIR:-$ROOT/.cache/opentofu/plugins}"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/grafana-tofu.sh [tofu args...]
-
-Runs OpenTofu for Burrow Grafana API configuration. This stack creates folders
-and dashboards only; Nix owns the Grafana service, authentication, data sources,
-and boot-time provisioning files.
-
-Examples:
-  Scripts/grafana-tofu.sh init -backend-config=backend.hcl
-  Scripts/grafana-tofu.sh plan -var-file=terraform.tfvars
-
-Local syntax check:
-  Scripts/grafana-tofu.sh init -backend=false
-  Scripts/grafana-tofu.sh validate
-EOF
-}
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-mkdir -p "$plugin_cache_dir"
-export TF_PLUGIN_CACHE_DIR="$plugin_cache_dir"
-export TF_IN_AUTOMATION="${TF_IN_AUTOMATION:-true}"
-
-exec nix shell --inputs-from "$ROOT" nixpkgs#opentofu -c tofu -chdir="$work_dir" "$@"
diff --git a/Scripts/hcloud-upload-nixos-image.sh b/Scripts/hcloud-upload-nixos-image.sh
deleted file mode 100755
index 2590519..0000000
--- a/Scripts/hcloud-upload-nixos-image.sh
+++ /dev/null
@@ -1,327 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-
-# shellcheck source=Scripts/_burrow-flake.sh
-source "${SCRIPT_DIR}/_burrow-flake.sh"
-
-DEFAULT_CONFIG="burrow-forge"
-DEFAULT_FLAKE="."
-DEFAULT_LOCATION="hel1"
-DEFAULT_ARCHITECTURE="x86"
-DEFAULT_TOKEN_FILE="${REPO_ROOT}/intake/hetzner-api-token.txt"
-
-CONFIG="${HCLOUD_IMAGE_CONFIG:-${DEFAULT_CONFIG}}"
-FLAKE="${HCLOUD_IMAGE_FLAKE:-${DEFAULT_FLAKE}}"
-LOCATION="${HCLOUD_IMAGE_LOCATION:-${DEFAULT_LOCATION}}"
-ARCHITECTURE="${HCLOUD_IMAGE_ARCHITECTURE:-${DEFAULT_ARCHITECTURE}}"
-TOKEN_FILE="${HCLOUD_TOKEN_FILE:-${DEFAULT_TOKEN_FILE}}"
-DESCRIPTION="${HCLOUD_IMAGE_DESCRIPTION:-}"
-UPLOAD_SERVER_TYPE="${HCLOUD_IMAGE_UPLOAD_SERVER_TYPE:-}"
-UPLOAD_VERBOSE="${HCLOUD_IMAGE_UPLOAD_VERBOSE:-0}"
-ARTIFACT_PATH_INPUT=""
-OUTPUT_HASH=""
-NO_UPDATE=0
-BUILDER_SPEC="${HCLOUD_IMAGE_BUILDER_SPEC:-}"
-EXTRA_LABELS=()
-NIX_BUILD_FLAGS=()
-BURROW_FLAKE_TMPDIRS=()
-LOCAL_STORE_DIR=""
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/hcloud-upload-nixos-image.sh [options]
-
-Build a raw Burrow NixOS image and upload it into Hetzner Cloud as a snapshot.
-
-Options:
-  --config <name>           images.<name>-raw output to build (default: burrow-forge)
-  --flake <path>            Flake path to build from (default: .)
-  --location <code>         Hetzner location for the temporary upload server (default: hel1)
-  --architecture <x86|arm>  CPU architecture of the image (default: x86)
-  --server-type <name>      Hetzner server type for the temporary upload server
-  --token-file <path>       Hetzner API token file (default: intake/hetzner-api-token.txt)
-  --artifact-path <path>    Prebuilt raw image artifact to upload directly
-  --output-hash <hash>      Stable hash label for --artifact-path uploads
-  --builder-spec <string>   Complete builders string passed to nix build
-  --description <text>      Description for the resulting snapshot
-  --upload-verbose <n>      Pass -v N times to hcloud-upload-image
-  --label key=value         Extra Hetzner image label (repeatable)
-  --nix-flag <arg>          Extra argument passed to nix build (repeatable)
-  --no-update               Reuse an existing snapshot with the same config/output hash
-  -h, --help                Show this help text
-EOF
-}
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --config)
-      CONFIG="${2:?missing value for --config}"
-      shift 2
-      ;;
-    --flake)
-      FLAKE="${2:?missing value for --flake}"
-      shift 2
-      ;;
-    --location)
-      LOCATION="${2:?missing value for --location}"
-      shift 2
-      ;;
-    --architecture)
-      ARCHITECTURE="${2:?missing value for --architecture}"
-      shift 2
-      ;;
-    --server-type)
-      UPLOAD_SERVER_TYPE="${2:?missing value for --server-type}"
-      shift 2
-      ;;
-    --token-file)
-      TOKEN_FILE="${2:?missing value for --token-file}"
-      shift 2
-      ;;
-    --artifact-path)
-      ARTIFACT_PATH_INPUT="${2:?missing value for --artifact-path}"
-      shift 2
-      ;;
-    --output-hash)
-      OUTPUT_HASH="${2:?missing value for --output-hash}"
-      shift 2
-      ;;
-    --builder-spec)
-      BUILDER_SPEC="${2:?missing value for --builder-spec}"
-      shift 2
-      ;;
-    --description)
-      DESCRIPTION="${2:?missing value for --description}"
-      shift 2
-      ;;
-    --upload-verbose)
-      UPLOAD_VERBOSE="${2:?missing value for --upload-verbose}"
-      shift 2
-      ;;
-    --label)
-      EXTRA_LABELS+=("${2:?missing value for --label}")
-      shift 2
-      ;;
-    --nix-flag)
-      NIX_BUILD_FLAGS+=("${2:?missing value for --nix-flag}")
-      shift 2
-      ;;
-    --no-update)
-      NO_UPDATE=1
-      shift
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "unknown option: $1" >&2
-      usage >&2
-      exit 64
-      ;;
-  esac
-done
-
-cleanup() {
-  burrow_cleanup_flake_tmpdirs
-  if [[ -n "${LOCAL_STORE_DIR}" && -d "${LOCAL_STORE_DIR}" ]]; then
-    rm -rf "${LOCAL_STORE_DIR}" >/dev/null 2>&1 || true
-  fi
-}
-trap cleanup EXIT
-
-burrow_require_cmd nix
-burrow_require_cmd curl
-burrow_require_cmd python3
-burrow_require_cmd rsync
-
-if [[ ! -f "${TOKEN_FILE}" ]]; then
-  echo "Hetzner API token file not found: ${TOKEN_FILE}" >&2
-  exit 1
-fi
-
-HCLOUD_TOKEN="$(tr -d '\r\n' < "${TOKEN_FILE}")"
-if [[ -z "${HCLOUD_TOKEN}" ]]; then
-  echo "Hetzner API token file is empty: ${TOKEN_FILE}" >&2
-  exit 1
-fi
-
-flake_ref="$(burrow_prepare_flake_ref "${FLAKE}")"
-
-if [[ -z "${DESCRIPTION}" ]]; then
-  DESCRIPTION="Burrow ${CONFIG} $(date -u +%Y-%m-%dT%H:%M:%SZ)"
-fi
-
-printf 'Building raw image for %s from %s\n' "${CONFIG}" "${flake_ref}" >&2
-
-if [[ -z "${ARTIFACT_PATH_INPUT}" && -n "${BUILDER_SPEC}" && -z "${NIX_BUILD_STORE:-}" ]]; then
-  mkdir -p "${HOME}/.cache/burrow"
-  LOCAL_STORE_DIR="$(mktemp -d "${HOME}/.cache/burrow/local-store-XXXXXX")"
-fi
-
-artifact_path=""
-compression=""
-output_hash="${OUTPUT_HASH}"
-if [[ -n "${ARTIFACT_PATH_INPUT}" ]]; then
-  artifact_path="${ARTIFACT_PATH_INPUT}"
-  if [[ ! -f "${artifact_path}" ]]; then
-    echo "artifact path does not exist: ${artifact_path}" >&2
-    exit 1
-  fi
-  compression="$(burrow_detect_compression "${artifact_path}")"
-  if [[ -z "${output_hash}" ]]; then
-    if command -v sha256sum >/dev/null 2>&1; then
-      output_hash="$(sha256sum "${artifact_path}" | awk '{print $1}')"
-    else
-      output_hash="$(shasum -a 256 "${artifact_path}" | awk '{print $1}')"
-    fi
-  fi
-else
-  nix_build_cmd=(
-    nix
-    --extra-experimental-features
-    "nix-command flakes"
-    build
-    "${flake_ref}#images.${CONFIG}-raw"
-    --no-link
-    --print-out-paths
-  )
-
-  if [[ -n "${BUILDER_SPEC}" ]]; then
-    nix_build_cmd+=(--builders "${BUILDER_SPEC}")
-  fi
-  if [[ -n "${NIX_BUILD_STORE:-}" ]]; then
-    nix_build_cmd+=(--store "${NIX_BUILD_STORE}")
-  elif [[ -n "${LOCAL_STORE_DIR}" ]]; then
-    nix_build_cmd+=(--store "${LOCAL_STORE_DIR}")
-  fi
-
-  if [[ "${#NIX_BUILD_FLAGS[@]}" -gt 0 ]]; then
-    nix_build_cmd+=("${NIX_BUILD_FLAGS[@]}")
-  fi
-
-  build_output=""
-  if ! build_output="$("${nix_build_cmd[@]}" 2>&1)"; then
-    printf '%s\n' "${build_output}" >&2
-    exit 1
-  fi
-
-  store_path="$(printf '%s\n' "${build_output}" | tail -n1)"
-  if [[ -z "${store_path}" ]]; then
-    echo "nix build did not return a store path" >&2
-    printf '%s\n' "${build_output}" >&2
-    exit 1
-  fi
-
-  artifact_path="$(burrow_resolve_image_artifact "${store_path}")"
-  compression="$(burrow_detect_compression "${artifact_path}")"
-  output_hash="$(basename "${store_path}")"
-  output_hash="${output_hash%%-*}"
-fi
-
-label_args=(
-  "burrow.nixos-config=${CONFIG}"
-  "burrow.nixos-output-hash=${output_hash}"
-)
-if [[ "${#EXTRA_LABELS[@]}" -gt 0 ]]; then
-  label_args+=("${EXTRA_LABELS[@]}")
-fi
-label_csv="$(IFS=,; printf '%s' "${label_args[*]}")"
-
-find_existing_image() {
-  HCLOUD_TOKEN="${HCLOUD_TOKEN}" \
-  BURROW_LABEL_SELECTOR="burrow.nixos-config=${CONFIG},burrow.nixos-output-hash=${output_hash}" \
-  python3 - <<'PY'
-import json
-import os
-import sys
-import urllib.parse
-import urllib.request
-
-selector = urllib.parse.quote(os.environ["BURROW_LABEL_SELECTOR"], safe=",=")
-req = urllib.request.Request(
-    f"https://api.hetzner.cloud/v1/images?type=snapshot&label_selector={selector}",
-    headers={"Authorization": f"Bearer {os.environ['HCLOUD_TOKEN']}"},
-)
-with urllib.request.urlopen(req, timeout=30) as resp:
-    data = json.load(resp)
-
-images = sorted(data.get("images", []), key=lambda item: item.get("created") or "")
-if images:
-    print(images[-1]["id"])
-PY
-}
-
-if [[ "${NO_UPDATE}" -eq 1 ]]; then
-  existing_id="$(find_existing_image || true)"
-  if [[ -n "${existing_id}" ]]; then
-    printf 'Reusing existing Hetzner snapshot %s for %s\n' "${existing_id}" "${CONFIG}" >&2
-    printf '%s\n' "${existing_id}"
-    exit 0
-  fi
-fi
-
-uploader_bin="${HCLOUD_UPLOAD_IMAGE_BIN:-}"
-if [[ -z "${uploader_bin}" ]]; then
-  uploader_build_output="$(
-    nix --extra-experimental-features "nix-command flakes" build \
-      "${flake_ref}#hcloud-upload-image" \
-      --no-link \
-      --print-out-paths 2>&1
-  )" || {
-    printf '%s\n' "${uploader_build_output}" >&2
-    exit 1
-  }
-  uploader_bin="$(printf '%s\n' "${uploader_build_output}" | tail -n1)/bin/hcloud-upload-image"
-fi
-
-if [[ ! -x "${uploader_bin}" ]]; then
-  echo "unable to resolve an executable hcloud-upload-image binary; set HCLOUD_UPLOAD_IMAGE_BIN explicitly" >&2
-  exit 1
-fi
-
-upload_cmd=(
-  "${uploader_bin}"
-)
-if [[ "${UPLOAD_VERBOSE}" =~ ^[0-9]+$ ]] && [[ "${UPLOAD_VERBOSE}" -gt 0 ]]; then
-  for _ in $(seq 1 "${UPLOAD_VERBOSE}"); do
-    upload_cmd+=(-v)
-  done
-fi
-upload_cmd+=(
-  upload
-  --image-path "${artifact_path}"
-  --location "${LOCATION}"
-  --description "${DESCRIPTION}"
-  --labels "${label_csv}"
-)
-if [[ -n "${UPLOAD_SERVER_TYPE}" ]]; then
-  upload_cmd+=(--server-type "${UPLOAD_SERVER_TYPE}")
-else
-  upload_cmd+=(--architecture "${ARCHITECTURE}")
-fi
-if [[ -n "${compression}" ]]; then
-  upload_cmd+=(--compression "${compression}")
-fi
-
-printf 'Uploading %s to Hetzner Cloud via %s\n' "${artifact_path}" "${uploader_bin}" >&2
-HCLOUD_TOKEN="${HCLOUD_TOKEN}" "${upload_cmd[@]}" >&2
-
-image_id=""
-for _ in $(seq 1 24); do
-  image_id="$(find_existing_image || true)"
-  if [[ -n "${image_id}" ]]; then
-    break
-  fi
-  sleep 5
-done
-
-if [[ -z "${image_id}" ]]; then
-  echo "failed to locate uploaded Hetzner snapshot after upload completed" >&2
-  exit 1
-fi
-
-printf '%s\n' "${image_id}"
diff --git a/Scripts/hetzner-forge.sh b/Scripts/hetzner-forge.sh
deleted file mode 100755
index cfce7eb..0000000
--- a/Scripts/hetzner-forge.sh
+++ /dev/null
@@ -1,284 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/hetzner-forge.sh [show|create|delete|recreate|build-image|create-from-image|recreate-from-image] [options]
-
-Manage the Burrow forge server and its Hetzner snapshot lifecycle.
-
-Defaults:
-  action: show
-  server-name: burrow-forge
-  server-type: ccx23
-  location: hel1
-  image: ubuntu-24.04
-  ssh keys: contact@burrow.net,agent@burrow.net
-
-Options:
-  --server-name <name>     Server name to manage.
-  --server-type <type>     Hetzner server type.
-  --location <code>        Hetzner location.
-  --image <name|id>        Image used at create time.
-  --config <name>          Burrow image config name for snapshot lookup/build (default: burrow-forge).
-  --ssh-key <name>         SSH key name to attach. Repeatable.
-  --token-file <path>      Hetzner API token file.
-  --flake <path>           Flake path used by image-build actions (default: .)
-  --upload-location <code> Hetzner location used for image upload (default: same as --location)
-  --yes                    Required for delete and recreate.
-  -h, --help               Show this help text.
-
-Environment:
-  HCLOUD_TOKEN_FILE        Defaults to intake/hetzner-api-token.txt
-EOF
-}
-
-ACTION="show"
-SERVER_NAME="burrow-forge"
-SERVER_TYPE="ccx23"
-LOCATION="hel1"
-IMAGE="ubuntu-24.04"
-CONFIG="burrow-forge"
-FLAKE="."
-UPLOAD_LOCATION=""
-TOKEN_FILE="${HCLOUD_TOKEN_FILE:-intake/hetzner-api-token.txt}"
-YES=0
-SSH_KEYS=("contact@burrow.net" "agent@burrow.net")
-
-if [[ $# -gt 0 ]]; then
-  case "$1" in
-    show|create|delete|recreate|build-image|create-from-image|recreate-from-image)
-      ACTION="$1"
-      shift
-      ;;
-  esac
-fi
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --server-name)
-      SERVER_NAME="${2:?missing value for --server-name}"
-      shift 2
-      ;;
-    --server-type)
-      SERVER_TYPE="${2:?missing value for --server-type}"
-      shift 2
-      ;;
-    --location)
-      LOCATION="${2:?missing value for --location}"
-      shift 2
-      ;;
-    --image)
-      IMAGE="${2:?missing value for --image}"
-      shift 2
-      ;;
-    --config)
-      CONFIG="${2:?missing value for --config}"
-      shift 2
-      ;;
-    --ssh-key)
-      SSH_KEYS+=("${2:?missing value for --ssh-key}")
-      shift 2
-      ;;
-    --token-file)
-      TOKEN_FILE="${2:?missing value for --token-file}"
-      shift 2
-      ;;
-    --flake)
-      FLAKE="${2:?missing value for --flake}"
-      shift 2
-      ;;
-    --upload-location)
-      UPLOAD_LOCATION="${2:?missing value for --upload-location}"
-      shift 2
-      ;;
-    --yes)
-      YES=1
-      shift
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "Unknown argument: $1" >&2
-      usage >&2
-      exit 2
-      ;;
-  esac
-done
-
-if [[ ! -f "${TOKEN_FILE}" ]]; then
-  echo "Hetzner API token file not found: ${TOKEN_FILE}" >&2
-  exit 1
-fi
-
-if [[ -z "${UPLOAD_LOCATION}" ]]; then
-  UPLOAD_LOCATION="${LOCATION}"
-fi
-
-if [[ "${ACTION}" == "delete" || "${ACTION}" == "recreate" || "${ACTION}" == "recreate-from-image" ]] && [[ ${YES} -ne 1 ]]; then
-  echo "--yes is required for ${ACTION}" >&2
-  exit 1
-fi
-
-latest_snapshot_id() {
-  HCLOUD_TOKEN="$(tr -d '\r\n' < "${TOKEN_FILE}")" \
-  BURROW_CONFIG="${CONFIG}" \
-  python3 - <<'PY'
-import json
-import os
-import urllib.parse
-import urllib.request
-
-selector = urllib.parse.quote(f"burrow.nixos-config={os.environ['BURROW_CONFIG']}", safe=",=")
-req = urllib.request.Request(
-    f"https://api.hetzner.cloud/v1/images?type=snapshot&label_selector={selector}",
-    headers={"Authorization": f"Bearer {os.environ['HCLOUD_TOKEN']}"},
-)
-with urllib.request.urlopen(req, timeout=30) as resp:
-    data = json.load(resp)
-images = sorted(data.get("images", []), key=lambda item: item.get("created") or "")
-if images:
-    print(images[-1]["id"])
-PY
-}
-
-if [[ "${ACTION}" == "build-image" ]]; then
-  exec "${SCRIPT_DIR}/nsc-build-and-upload-image.sh" \
-    --config "${CONFIG}" \
-    --flake "${FLAKE}" \
-    --location "${UPLOAD_LOCATION}" \
-    --upload-server-type "${SERVER_TYPE}" \
-    --token-file "${TOKEN_FILE}"
-fi
-
-if [[ "${ACTION}" == "create-from-image" || "${ACTION}" == "recreate-from-image" ]]; then
-  if [[ "${IMAGE}" == "ubuntu-24.04" ]]; then
-    IMAGE="$(latest_snapshot_id)"
-  fi
-  if [[ -z "${IMAGE}" ]]; then
-    echo "No Burrow snapshot found for config ${CONFIG}. Run build-image first." >&2
-    exit 1
-  fi
-  if [[ "${ACTION}" == "create-from-image" ]]; then
-    ACTION="create"
-  else
-    ACTION="recreate"
-  fi
-fi
-
-ssh_keys_csv=""
-for key in "${SSH_KEYS[@]}"; do
-  if [[ -n "${ssh_keys_csv}" ]]; then
-    ssh_keys_csv+=","
-  fi
-  ssh_keys_csv+="${key}"
-done
-
-export BURROW_HCLOUD_ACTION="${ACTION}"
-export BURROW_HCLOUD_SERVER_NAME="${SERVER_NAME}"
-export BURROW_HCLOUD_SERVER_TYPE="${SERVER_TYPE}"
-export BURROW_HCLOUD_LOCATION="${LOCATION}"
-export BURROW_HCLOUD_IMAGE="${IMAGE}"
-export BURROW_HCLOUD_TOKEN_FILE="${TOKEN_FILE}"
-export BURROW_HCLOUD_SSH_KEYS="${ssh_keys_csv}"
-
-python3 - <<'PY'
-import json
-import os
-import sys
-from pathlib import Path
-
-import requests
-
-base = "https://api.hetzner.cloud/v1"
-action = os.environ["BURROW_HCLOUD_ACTION"]
-server_name = os.environ["BURROW_HCLOUD_SERVER_NAME"]
-server_type = os.environ["BURROW_HCLOUD_SERVER_TYPE"]
-location = os.environ["BURROW_HCLOUD_LOCATION"]
-image = os.environ["BURROW_HCLOUD_IMAGE"]
-token = Path(os.environ["BURROW_HCLOUD_TOKEN_FILE"]).read_text(encoding="utf-8").strip()
-ssh_keys = [key for key in os.environ["BURROW_HCLOUD_SSH_KEYS"].split(",") if key]
-
-session = requests.Session()
-session.headers.update({"Authorization": f"Bearer {token}", "Content-Type": "application/json"})
-
-
-def request(method: str, path: str, **kwargs) -> requests.Response:
-    response = session.request(method, f"{base}{path}", timeout=30, **kwargs)
-    response.raise_for_status()
-    return response
-
-
-def find_server():
-    response = request("GET", "/servers", params={"name": server_name})
-    data = response.json()
-    for server in data.get("servers", []):
-        if server.get("name") == server_name:
-            return server
-    return None
-
-
-def summarize(server):
-    ipv4 = (((server.get("public_net") or {}).get("ipv4")) or {}).get("ip")
-    image_name = ((server.get("image") or {}).get("name")) or ""
-    summary = {
-        "id": server.get("id"),
-        "name": server.get("name"),
-        "status": server.get("status"),
-        "server_type": ((server.get("server_type") or {}).get("name")),
-        "location": ((server.get("location") or {}).get("name")),
-        "image": image_name,
-        "ipv4": ipv4,
-        "created": server.get("created"),
-    }
-    print(json.dumps(summary, indent=2))
-
-
-server = find_server()
-
-if action == "show":
-    if server is None:
-        print(json.dumps({"name": server_name, "present": False}, indent=2))
-    else:
-        summarize(server)
-    sys.exit(0)
-
-if action == "delete":
-    if server is None:
-        print(json.dumps({"name": server_name, "deleted": False, "reason": "not found"}, indent=2))
-        sys.exit(0)
-    request("DELETE", f"/servers/{server['id']}")
-    print(json.dumps({"name": server_name, "deleted": True, "id": server["id"]}, indent=2))
-    sys.exit(0)
-
-if action == "recreate" and server is not None:
-    request("DELETE", f"/servers/{server['id']}")
-    server = None
-
-if action in {"create", "recreate"}:
-    if server is not None:
-      summarize(server)
-      sys.exit(0)
-
-    payload = {
-        "name": server_name,
-        "server_type": server_type,
-        "location": location,
-        "image": image,
-        "ssh_keys": ssh_keys,
-        "labels": {
-            "project": "burrow",
-            "role": "forge",
-        },
-    }
-    response = request("POST", "/servers", json=payload)
-    created = response.json()["server"]
-    summarize(created)
-    sys.exit(0)
-
-raise SystemExit(f"unsupported action: {action}")
-PY
diff --git a/Scripts/identity-tofu.sh b/Scripts/identity-tofu.sh
deleted file mode 100755
index 882717c..0000000
--- a/Scripts/identity-tofu.sh
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT="$(
-  git rev-parse --show-toplevel 2>/dev/null || {
-    cd "$(dirname "${BASH_SOURCE[0]}")/.."
-    pwd
-  }
-)"
-
-work_dir="${BURROW_IDENTITY_TOFU_DIR:-$ROOT/infra/identity}"
-plugin_cache_dir="${BURROW_TOFU_PLUGIN_CACHE_DIR:-$ROOT/.cache/opentofu/plugins}"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/identity-tofu.sh [tofu args...]
-
-Runs OpenTofu for Burrow Google KMS and Workload Identity Federation resources.
-Cloud provider credentials must come from the normal provider environment or a
-WIF flow; do not put credentials in backend config.
-
-Examples:
-  Scripts/identity-tofu.sh init -backend-config=backend.hcl
-  Scripts/identity-tofu.sh plan -var-file=terraform.tfvars
-
-Local syntax check:
-  Scripts/identity-tofu.sh init -backend=false
-  Scripts/identity-tofu.sh validate
-EOF
-}
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-mkdir -p "$plugin_cache_dir"
-export TF_PLUGIN_CACHE_DIR="$plugin_cache_dir"
-export TF_IN_AUTOMATION="${TF_IN_AUTOMATION:-true}"
-
-exec nix shell --inputs-from "$ROOT" nixpkgs#opentofu -c tofu -chdir="$work_dir" "$@"
diff --git a/Scripts/nsc-build-and-upload-image.sh b/Scripts/nsc-build-and-upload-image.sh
deleted file mode 100755
index 6fb99a9..0000000
--- a/Scripts/nsc-build-and-upload-image.sh
+++ /dev/null
@@ -1,542 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-
-# shellcheck source=Scripts/_burrow-flake.sh
-source "${SCRIPT_DIR}/_burrow-flake.sh"
-
-CONFIG="${HCLOUD_IMAGE_CONFIG:-burrow-forge}"
-FLAKE="${HCLOUD_IMAGE_FLAKE:-.}"
-LOCATION="${HCLOUD_IMAGE_LOCATION:-hel1}"
-TOKEN_FILE="${HCLOUD_TOKEN_FILE:-${REPO_ROOT}/intake/hetzner-api-token.txt}"
-NSC_SSH_HOST="${NSC_SSH_HOST:-ssh.ord2.namespace.so}"
-NSC_MACHINE_TYPE="${NSC_MACHINE_TYPE:-linux/amd64:32x64}"
-NSC_BUILDER_DURATION="${NSC_BUILDER_DURATION:-4h}"
-NSC_BUILDER_JOBS="${NSC_BUILDER_JOBS:-32}"
-NSC_BUILDER_FEATURES="${NSC_BUILDER_FEATURES:-kvm,big-parallel}"
-NSC_BIN="${NSC_BIN:-}"
-REMOTE_COMPRESSION="${HCLOUD_IMAGE_REMOTE_COMPRESSION:-auto}"
-UPLOAD_SERVER_TYPE="${HCLOUD_IMAGE_UPLOAD_SERVER_TYPE:-}"
-KEEP_TMPDIR="${HCLOUD_IMAGE_KEEP_TMPDIR:-0}"
-NO_UPDATE=0
-NIX_BUILD_FLAGS=()
-EXTRA_LABELS=()
-BURROW_FLAKE_TMPDIRS=()
-BUILDER_ID=""
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/nsc-build-and-upload-image.sh [options]
-
-Create a temporary Namespace Linux builder, build the Burrow raw image on it,
-and upload the resulting artifact to Hetzner Cloud.
-
-Options:
-  --config <name>         images.<name>-raw output to build (default: burrow-forge)
-  --flake <path>          Flake path to build from (default: .)
-  --location <code>       Hetzner upload location (default: hel1)
-  --token-file <path>     Hetzner API token file (default: intake/hetzner-api-token.txt)
-  --machine-type <type>   Namespace machine type (default: linux/amd64:32x64)
-  --ssh-host <host>       Namespace SSH endpoint (default: ssh.ord2.namespace.so)
-  --duration <ttl>        Namespace builder lifetime (default: 4h)
-  --builder-jobs <n>      Nix builder job count advertised to the local client
-  --builder-features <s>  Comma-separated Nix system features (default: "kvm,big-parallel")
-  --remote-compression <mode>
-                          Compress raw/image artifacts on the Namespace builder
-                          before copy-back. Modes: auto, none, xz, zstd
-                          (default: auto)
-  --upload-server-type <name>
-                          Hetzner server type for the temporary upload host
-  --label key=value       Extra Hetzner snapshot label (repeatable)
-  --nix-flag <arg>        Extra argument passed to nix build (repeatable)
-  --no-update             Reuse an existing snapshot with the same config/output hash
-  -h, --help              Show this help text
-EOF
-}
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --config)
-      CONFIG="${2:?missing value for --config}"
-      shift 2
-      ;;
-    --flake)
-      FLAKE="${2:?missing value for --flake}"
-      shift 2
-      ;;
-    --location)
-      LOCATION="${2:?missing value for --location}"
-      shift 2
-      ;;
-    --token-file)
-      TOKEN_FILE="${2:?missing value for --token-file}"
-      shift 2
-      ;;
-    --machine-type)
-      NSC_MACHINE_TYPE="${2:?missing value for --machine-type}"
-      shift 2
-      ;;
-    --ssh-host)
-      NSC_SSH_HOST="${2:?missing value for --ssh-host}"
-      shift 2
-      ;;
-    --duration)
-      NSC_BUILDER_DURATION="${2:?missing value for --duration}"
-      shift 2
-      ;;
-    --builder-jobs)
-      NSC_BUILDER_JOBS="${2:?missing value for --builder-jobs}"
-      shift 2
-      ;;
-    --builder-features)
-      NSC_BUILDER_FEATURES="${2:?missing value for --builder-features}"
-      shift 2
-      ;;
-    --remote-compression)
-      REMOTE_COMPRESSION="${2:?missing value for --remote-compression}"
-      shift 2
-      ;;
-    --upload-server-type)
-      UPLOAD_SERVER_TYPE="${2:?missing value for --upload-server-type}"
-      shift 2
-      ;;
-    --label)
-      EXTRA_LABELS+=("${2:?missing value for --label}")
-      shift 2
-      ;;
-    --nix-flag)
-      NIX_BUILD_FLAGS+=("${2:?missing value for --nix-flag}")
-      shift 2
-      ;;
-    --no-update)
-      NO_UPDATE=1
-      shift
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "unknown option: $1" >&2
-      usage >&2
-      exit 64
-      ;;
-  esac
-done
-
-cleanup() {
-  if [[ -n "${BUILDER_ID}" && -n "${NSC_BIN}" ]]; then
-    "${NSC_BIN}" destroy "${BUILDER_ID}" --force >/dev/null 2>&1 || true
-  fi
-  burrow_cleanup_flake_tmpdirs
-  if [[ "${KEEP_TMPDIR}" != "1" && -n "${TMPDIR_BURROW_NSC:-}" && -d "${TMPDIR_BURROW_NSC}" ]]; then
-    rm -rf "${TMPDIR_BURROW_NSC}"
-  fi
-}
-trap cleanup EXIT
-
-burrow_require_cmd nix
-burrow_require_cmd curl
-burrow_require_cmd python3
-burrow_require_cmd ssh
-burrow_require_cmd ssh-keygen
-burrow_require_cmd ssh-keyscan
-burrow_require_cmd tar
-
-flake_ref="$(burrow_prepare_flake_ref "${FLAKE}")"
-
-if [[ -z "${NSC_BIN}" ]]; then
-  nsc_build_output="$(
-    nix --extra-experimental-features "nix-command flakes" build \
-      "${flake_ref}#nsc" \
-      --no-link \
-      --print-out-paths 2>&1
-  )" || {
-    printf '%s\n' "${nsc_build_output}" >&2
-    exit 1
-  }
-  NSC_BIN="$(printf '%s\n' "${nsc_build_output}" | tail -n1)/bin/nsc"
-fi
-
-if [[ ! -x "${NSC_BIN}" ]]; then
-  echo "unable to resolve an executable nsc binary; set NSC_BIN explicitly" >&2
-  exit 1
-fi
-
-if [[ -n "${NSC_SESSION:-}" && ! -f "${HOME}/.ns/session" ]]; then
-  mkdir -p "${HOME}/.ns"
-  printf '%s\n' "${NSC_SESSION}" > "${HOME}/.ns/session"
-  chmod 600 "${HOME}/.ns/session"
-fi
-
-"${NSC_BIN}" auth check-login --duration 20m >/dev/null
-"${NSC_BIN}" version >/dev/null || true
-
-TMPDIR_BURROW_NSC="$(mktemp -d "${HOME}/.cache/burrow/nsc-XXXXXX")"
-ssh_key="${TMPDIR_BURROW_NSC}/builder"
-known_hosts="${TMPDIR_BURROW_NSC}/known_hosts"
-id_file="${TMPDIR_BURROW_NSC}/builder.id"
-
-ssh-keygen -q -t ed25519 -N "" -f "${ssh_key}"
-ssh-keyscan -H "${NSC_SSH_HOST}" > "${known_hosts}"
-
-ssh_base=(
-  ssh
-  -i "${ssh_key}"
-  -o UserKnownHostsFile="${known_hosts}"
-  -o StrictHostKeyChecking=yes
-)
-
-wait_for_ssh() {
-  local instance_id="$1"
-  for _ in $(seq 1 30); do
-    if "${ssh_base[@]}" -q "${instance_id}@${NSC_SSH_HOST}" true >/dev/null 2>&1; then
-      return 0
-    fi
-    sleep 5
-  done
-  return 1
-}
-
-configure_builder() {
-  local instance_id="$1"
-  "${ssh_base[@]}" "${instance_id}@${NSC_SSH_HOST}" <<'EOF'
-set -euo pipefail
-
-if ! command -v nix >/dev/null 2>&1; then
-  curl -fsSL https://install.determinate.systems/nix | sh -s -- install linux --determinate --init none --no-confirm
-fi
-
-if [ -e /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh ]; then
-  . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-fi
-
-mkdir -p /etc/nix
-cat <<CFG >/etc/nix/nix.conf
-build-users-group =
-trusted-users = root $USER
-auto-optimise-store = true
-substituters = https://cache.nixos.org
-builders-use-substitutes = true
-CFG
-
-mkdir -p /nix/var/nix/daemon-socket
-
-if ! pgrep -x nix-daemon >/dev/null 2>&1; then
-  nohup nix-daemon >/dev/null 2>&1 </dev/null &
-fi
-
-for _ in $(seq 1 120); do
-  if [ -S /nix/var/nix/daemon-socket/socket ]; then
-    exit 0
-  fi
-  if ! pgrep -x nix-daemon >/dev/null 2>&1; then
-    nohup nix-daemon >/dev/null 2>&1 </dev/null &
-  fi
-  sleep 1
-done
-
-echo "nix-daemon socket never appeared" >&2
-exit 1
-EOF
-}
-
-printf 'Creating temporary Namespace builder (%s)\n' "${NSC_MACHINE_TYPE}" >&2
-"${NSC_BIN}" create \
-  --bare \
-  --machine_type "${NSC_MACHINE_TYPE}" \
-  --ssh_key "${ssh_key}.pub" \
-  --duration "${NSC_BUILDER_DURATION}" \
-  --label "burrow=true" \
-  --label "purpose=hetzner-image-build" \
-  --output_to "${id_file}" \
-  >/dev/null
-
-BUILDER_ID="$(tr -d '\r\n' < "${id_file}")"
-if [[ -z "${BUILDER_ID}" ]]; then
-  echo "nsc create did not return a builder id" >&2
-  exit 1
-fi
-
-printf 'Waiting for Namespace builder %s\n' "${BUILDER_ID}" >&2
-wait_for_ssh "${BUILDER_ID}"
-configure_builder "${BUILDER_ID}" >&2
-
-remote_root="burrow-image-build-${BUILDER_ID}"
-remote_flake_path="./${remote_root}"
-local_flake_dir="${flake_ref#path:}"
-remote_build_stdout="/tmp/burrow-image-build-${BUILDER_ID}.stdout"
-remote_build_stderr="/tmp/burrow-image-build-${BUILDER_ID}.stderr"
-
-printf 'Syncing flake to Namespace builder %s\n' "${BUILDER_ID}" >&2
-tar -C "${local_flake_dir}" -cf - . \
-  | "${ssh_base[@]}" "${BUILDER_ID}@${NSC_SSH_HOST}" "rm -rf '${remote_root}' && mkdir -p '${remote_root}' && tar -C '${remote_root}' -xf -"
-
-run_remote_build() {
-  local remote_cmd=(
-    env
-    "CONFIG=${CONFIG}"
-    "REMOTE_FLAKE_PATH=${remote_flake_path}"
-    "REMOTE_BUILD_STDOUT=${remote_build_stdout}"
-    "REMOTE_BUILD_STDERR=${remote_build_stderr}"
-    bash
-    -s
-    --
-  )
-  if [[ "${#NIX_BUILD_FLAGS[@]}" -gt 0 ]]; then
-    remote_cmd+=("${NIX_BUILD_FLAGS[@]}")
-  fi
-
-  "${ssh_base[@]}" "${BUILDER_ID}@${NSC_SSH_HOST}" "${remote_cmd[@]}" <<'EOF'
-set -euo pipefail
-
-config="${CONFIG}"
-remote_flake_path="${REMOTE_FLAKE_PATH}"
-remote_build_stdout="${REMOTE_BUILD_STDOUT}"
-remote_build_stderr="${REMOTE_BUILD_STDERR}"
-nix_build_cmd=(
-  nix
-  --extra-experimental-features
-  "nix-command flakes"
-  build
-  "path:${remote_flake_path}#images.${config}-raw"
-  --no-link
-  --print-out-paths
-)
-if [[ "$#" -gt 0 ]]; then
-  nix_build_cmd+=("$@")
-fi
-
-rm -f "${remote_build_stdout}" "${remote_build_stderr}"
-if ! "${nix_build_cmd[@]}" >"${remote_build_stdout}" 2>"${remote_build_stderr}"; then
-  cat "${remote_build_stderr}" >&2
-  exit 1
-fi
-EOF
-}
-
-resolve_remote_store_path() {
-  "${ssh_base[@]}" "${BUILDER_ID}@${NSC_SSH_HOST}" \
-    env "REMOTE_BUILD_STDOUT=${remote_build_stdout}" "REMOTE_BUILD_STDERR=${remote_build_stderr}" bash -s <<'EOF'
-set -euo pipefail
-
-remote_build_stdout="${REMOTE_BUILD_STDOUT}"
-remote_build_stderr="${REMOTE_BUILD_STDERR}"
-
-if [[ ! -s "${remote_build_stdout}" ]]; then
-  echo "remote build stdout file is missing or empty: ${remote_build_stdout}" >&2
-  if [[ -s "${remote_build_stderr}" ]]; then
-    cat "${remote_build_stderr}" >&2
-  fi
-  exit 1
-fi
-
-tail -n1 "${remote_build_stdout}"
-EOF
-}
-
-resolve_remote_artifact_path() {
-  local store_path="$1"
-  "${ssh_base[@]}" "${BUILDER_ID}@${NSC_SSH_HOST}" \
-    env "REMOTE_STORE_PATH=${store_path}" bash -s <<'EOF'
-set -euo pipefail
-
-store_path="${REMOTE_STORE_PATH}"
-artifact_path="${store_path}"
-if [[ -d "${artifact_path}" ]]; then
-  artifact_path="$(find "${artifact_path}" -type f \( -name '*.raw' -o -name '*.raw.*' -o -name '*.img' -o -name '*.img.*' \) | sort | head -n1)"
-fi
-if [[ -z "${artifact_path}" || ! -f "${artifact_path}" ]]; then
-  echo "unable to locate image artifact under ${store_path}" >&2
-  exit 1
-fi
-
-printf '%s\n' "${artifact_path}"
-EOF
-}
-
-plan_remote_artifact_transfer() {
-  local artifact_path="$1"
-  local compression_mode="$2"
-
-  "${ssh_base[@]}" "${BUILDER_ID}@${NSC_SSH_HOST}" \
-    env "REMOTE_ARTIFACT_PATH=${artifact_path}" "REMOTE_COMPRESSION=${compression_mode}" bash -s <<'EOF'
-set -euo pipefail
-
-artifact_path="${REMOTE_ARTIFACT_PATH}"
-compression_mode="${REMOTE_COMPRESSION}"
-
-case "${artifact_path}" in
-  *.bz2)
-    printf '%s\tbz2\n' "$(basename "${artifact_path}")"
-    exit 0
-    ;;
-  *.xz)
-    printf '%s\txz\n' "$(basename "${artifact_path}")"
-    exit 0
-    ;;
-  *.zst|*.zstd)
-    printf '%s\tzstd\n' "$(basename "${artifact_path}")"
-    exit 0
-    ;;
-esac
-
-select_compression() {
-  case "${compression_mode}" in
-    auto)
-      if command -v zstd >/dev/null 2>&1; then
-        printf 'zstd\n'
-        return 0
-      fi
-      if command -v xz >/dev/null 2>&1; then
-        printf 'xz\n'
-        return 0
-      fi
-      printf 'none\n'
-      ;;
-    none|xz|zstd)
-      printf '%s\n' "${compression_mode}"
-      ;;
-    *)
-      echo "unsupported remote compression mode: ${compression_mode}" >&2
-      exit 1
-      ;;
-  esac
-}
-
-mode="$(select_compression)"
-case "${mode}" in
-  none)
-    printf '%s\tnone\n' "$(basename "${artifact_path}")"
-    ;;
-  zstd)
-    printf '%s.zst\tzstd\n' "$(basename "${artifact_path}")"
-    ;;
-  xz)
-    printf '%s.xz\txz\n' "$(basename "${artifact_path}")"
-    ;;
-esac
-EOF
-}
-
-stream_remote_artifact() {
-  local artifact_path="$1"
-  local compression_mode="$2"
-  local destination="$3"
-
-  "${ssh_base[@]}" "${BUILDER_ID}@${NSC_SSH_HOST}" \
-    env "REMOTE_ARTIFACT_PATH=${artifact_path}" "REMOTE_COMPRESSION=${compression_mode}" bash -s <<'EOF' > "${destination}"
-set -euo pipefail
-
-artifact_path="${REMOTE_ARTIFACT_PATH}"
-compression_mode="${REMOTE_COMPRESSION}"
-
-case "${artifact_path}" in
-  *.bz2|*.xz|*.zst|*.zstd)
-    cat "${artifact_path}"
-    exit 0
-    ;;
-esac
-
-select_compression() {
-  case "${compression_mode}" in
-    auto)
-      if command -v zstd >/dev/null 2>&1; then
-        printf 'zstd\n'
-        return 0
-      fi
-      if command -v xz >/dev/null 2>&1; then
-        printf 'xz\n'
-        return 0
-      fi
-      printf 'none\n'
-      ;;
-    none|xz|zstd)
-      printf '%s\n' "${compression_mode}"
-      ;;
-    *)
-      echo "unsupported remote compression mode: ${compression_mode}" >&2
-      exit 1
-      ;;
-  esac
-}
-
-mode="$(select_compression)"
-case "${mode}" in
-  none)
-    cat "${artifact_path}"
-    ;;
-  zstd)
-    if ! command -v zstd >/dev/null 2>&1; then
-      echo "zstd requested but not available on Namespace builder" >&2
-      exit 1
-    fi
-    zstd -T0 -19 -c "${artifact_path}"
-    ;;
-  xz)
-    if ! command -v xz >/dev/null 2>&1; then
-      echo "xz requested but not available on Namespace builder" >&2
-      exit 1
-    fi
-    xz -T0 -c "${artifact_path}"
-    ;;
-esac
-EOF
-}
-
-printf 'Building raw image on Namespace builder %s\n' "${BUILDER_ID}" >&2
-run_remote_build
-
-remote_store_path="$(resolve_remote_store_path)"
-if [[ -z "${remote_store_path}" ]]; then
-  echo "remote build did not return a store path" >&2
-  exit 1
-fi
-
-remote_artifact_path="$(resolve_remote_artifact_path "${remote_store_path}")"
-if [[ -z "${remote_artifact_path}" ]]; then
-  echo "remote build did not return an artifact path" >&2
-  exit 1
-fi
-
-transfer_plan="$(plan_remote_artifact_transfer "${remote_artifact_path}" "${REMOTE_COMPRESSION}")"
-local_artifact_name="$(printf '%s\n' "${transfer_plan}" | cut -f1)"
-transfer_compression="$(printf '%s\n' "${transfer_plan}" | cut -f2)"
-if [[ -z "${local_artifact_name}" || -z "${transfer_compression}" ]]; then
-  echo "unable to determine artifact transfer plan for ${remote_artifact_path}" >&2
-  exit 1
-fi
-
-output_hash="$(basename "${remote_store_path}")"
-output_hash="${output_hash%%-*}"
-local_artifact="${TMPDIR_BURROW_NSC}/${local_artifact_name}"
-
-printf 'Streaming built artifact back from Namespace builder %s (%s)\n' "${BUILDER_ID}" "${transfer_compression}" >&2
-stream_remote_artifact "${remote_artifact_path}" "${REMOTE_COMPRESSION}" "${local_artifact}"
-
-cmd=(
-  "${SCRIPT_DIR}/hcloud-upload-nixos-image.sh"
-  --config "${CONFIG}"
-  --flake "${FLAKE}"
-  --location "${LOCATION}"
-  --token-file "${TOKEN_FILE}"
-  --artifact-path "${local_artifact}"
-  --output-hash "${output_hash}"
-)
-
-if [[ -n "${UPLOAD_SERVER_TYPE}" ]]; then
-  cmd+=(--server-type "${UPLOAD_SERVER_TYPE}")
-fi
-
-if [[ "${NO_UPDATE}" -eq 1 ]]; then
-  cmd+=(--no-update)
-fi
-if [[ "${#EXTRA_LABELS[@]}" -gt 0 ]]; then
-  for label in "${EXTRA_LABELS[@]}"; do
-    cmd+=(--label "${label}")
-  done
-fi
-
-"${cmd[@]}"
diff --git a/Scripts/openbao-tofu.sh b/Scripts/openbao-tofu.sh
deleted file mode 100755
index 96f8d87..0000000
--- a/Scripts/openbao-tofu.sh
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT="$(
-  git rev-parse --show-toplevel 2>/dev/null || {
-    cd "$(dirname "${BASH_SOURCE[0]}")/.."
-    pwd
-  }
-)"
-
-work_dir="${BURROW_OPENBAO_TOFU_DIR:-$ROOT/infra/openbao}"
-plugin_cache_dir="${BURROW_TOFU_PLUGIN_CACHE_DIR:-$ROOT/.cache/opentofu/plugins}"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/openbao-tofu.sh [tofu args...]
-
-Runs OpenTofu for Burrow OpenBao cloud seal and OpenBao API configuration. The
-Vault/OpenBao provider reads VAULT_TOKEN from the environment when managing
-OpenBao mounts, policies, or auth backends.
-
-Examples:
-  Scripts/openbao-tofu.sh init -backend-config=backend.hcl
-  Scripts/openbao-tofu.sh plan -var-file=terraform.tfvars
-
-Local syntax check:
-  Scripts/openbao-tofu.sh init -backend=false
-  Scripts/openbao-tofu.sh validate
-EOF
-}
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-mkdir -p "$plugin_cache_dir"
-export TF_PLUGIN_CACHE_DIR="$plugin_cache_dir"
-export TF_IN_AUTOMATION="${TF_IN_AUTOMATION:-true}"
-
-exec nix shell --inputs-from "$ROOT" nixpkgs#opentofu -c tofu -chdir="$work_dir" "$@"
diff --git a/Scripts/package/bootstrap-native-daemon.sh b/Scripts/package/bootstrap-native-daemon.sh
deleted file mode 100755
index 2188e20..0000000
--- a/Scripts/package/bootstrap-native-daemon.sh
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-apply=0
-prefer_packagekit=1
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/package/bootstrap-native-daemon.sh [--apply] [--no-packagekit]
-
-Detects the host package manager and prints, or with --apply runs, the native
-install command for the Burrow daemon package. This is the host-side bootstrap
-equivalent the Flatpak GUI can point users at when PackageKit is unavailable.
-
-This assumes the Burrow native repository for the detected package manager is
-already configured. Repository setup should be explicit because it establishes
-package trust roots.
-EOF
-}
-
-while [[ "$#" -gt 0 ]]; do
-  case "$1" in
-    --apply)
-      apply=1
-      ;;
-    --no-packagekit)
-      prefer_packagekit=0
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "unknown argument: $1" >&2
-      exit 64
-      ;;
-  esac
-  shift
-done
-
-run_or_print() {
-  if [[ "$apply" == "1" ]]; then
-    "$@"
-  else
-    printf '%q ' "$@"
-    printf '\n'
-  fi
-}
-
-if [[ "$prefer_packagekit" == "1" ]] && command -v pkcon >/dev/null 2>&1; then
-  run_or_print pkcon install burrow
-  exit 0
-fi
-
-if command -v apt-get >/dev/null 2>&1; then
-  run_or_print sudo apt-get install burrow
-elif command -v dnf >/dev/null 2>&1; then
-  run_or_print sudo dnf install burrow
-elif command -v zypper >/dev/null 2>&1; then
-  run_or_print sudo zypper install burrow
-elif command -v pacman >/dev/null 2>&1; then
-  run_or_print sudo pacman -S burrow
-elif command -v apk >/dev/null 2>&1; then
-  run_or_print sudo apk add burrow
-elif command -v xbps-install >/dev/null 2>&1; then
-  run_or_print sudo xbps-install -S burrow
-elif command -v eopkg >/dev/null 2>&1; then
-  run_or_print sudo eopkg install burrow
-elif command -v emerge >/dev/null 2>&1; then
-  run_or_print sudo emerge --ask net-vpn/burrow
-elif command -v swupd >/dev/null 2>&1; then
-  run_or_print sudo swupd bundle-add burrow
-elif command -v nix >/dev/null 2>&1; then
-  run_or_print nix profile install git+https://git.burrow.net/hackclub/burrow
-else
-  echo "No supported native package manager found. Install Burrow through DEB, RPM, pacman, AUR, Flatpak GUI plus daemon package, or the NixOS flake." >&2
-  exit 69
-fi
diff --git a/Scripts/package/build-repositories.sh b/Scripts/package/build-repositories.sh
deleted file mode 100755
index 05f5656..0000000
--- a/Scripts/package/build-repositories.sh
+++ /dev/null
@@ -1,248 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-repo_root="$(
-  git rev-parse --show-toplevel 2>/dev/null || {
-    cd "$(dirname "${BASH_SOURCE[0]}")/../.."
-    pwd
-  }
-)"
-
-input_dir="${BURROW_PACKAGE_INPUT_DIR:-${repo_root}/dist/packages}"
-output_dir="${BURROW_PACKAGE_REPOSITORY_DIR:-${repo_root}/publish/repositories}"
-channel="${BURROW_PACKAGE_CHANNEL:-stable}"
-suite="${BURROW_APT_SUITE:-stable}"
-component="${BURROW_APT_COMPONENT:-main}"
-apt_arch="${BURROW_APT_ARCH:-${BURROW_PACKAGE_ARCH:-amd64}}"
-rpm_arch="${BURROW_RPM_ARCH:-x86_64}"
-pacman_arch="${BURROW_PACMAN_ARCH:-x86_64}"
-repo_name="${BURROW_ARCH_REPO_NAME:-burrow}"
-generic_kms_public_key_pem="${BURROW_PACKAGE_REPO_KMS_PUBLIC_KEY_PEM:-}"
-generic_kms_key="${BURROW_PACKAGE_REPO_KMS_KEY:-}"
-apt_kms_public_key_pem="${BURROW_APT_REPO_KMS_PUBLIC_KEY_PEM:-$generic_kms_public_key_pem}"
-apt_kms_key="${BURROW_APT_REPO_KMS_KEY:-${generic_kms_key:-package-apt-repository}}"
-rpm_kms_public_key_pem="${BURROW_RPM_REPO_KMS_PUBLIC_KEY_PEM:-$generic_kms_public_key_pem}"
-rpm_kms_key="${BURROW_RPM_REPO_KMS_KEY:-${generic_kms_key:-package-rpm-repository}}"
-pacman_kms_public_key_pem="${BURROW_PACMAN_REPO_KMS_PUBLIC_KEY_PEM:-$generic_kms_public_key_pem}"
-pacman_kms_key="${BURROW_PACMAN_REPO_KMS_KEY:-${generic_kms_key:-package-pacman-repository}}"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/package/build-repositories.sh [apt|rpm|arch|keys|all]
-
-Builds native Linux package repositories from existing package artifacts.
-
-Inputs:
-  BURROW_PACKAGE_INPUT_DIR                 directory containing .deb, .rpm, and .pkg.tar.* files
-  BURROW_PACKAGE_REPOSITORY_DIR            output directory, default publish/repositories
-  BURROW_APT_REPO_KMS_PUBLIC_KEY_PEM       Google KMS public key PEM for APT OpenPGP signatures
-  BURROW_APT_REPO_KMS_KEY                  Google KMS key name for APT signatures
-  BURROW_RPM_REPO_KMS_PUBLIC_KEY_PEM       Google KMS public key PEM for RPM repository signatures
-  BURROW_RPM_REPO_KMS_KEY                  Google KMS key name for RPM repository signatures
-  BURROW_PACMAN_REPO_KMS_PUBLIC_KEY_PEM    Google KMS public key PEM for pacman signatures
-  BURROW_PACMAN_REPO_KMS_KEY               Google KMS key name for pacman signatures
-  BURROW_PACKAGE_REPO_KMS_PUBLIC_KEY_PEM   fallback public key PEM for all formats
-  BURROW_PACKAGE_REPO_KMS_KEY              fallback KMS key name for all formats
-  BURROW_KMS_KEYRING/BURROW_KMS_LOCATION/BURROW_KMS_VERSION/GOOGLE_CLOUD_PROJECT
-
-The repository metadata is signed with Google KMS-backed OpenPGP detached
-signatures when each format's KMS public key and key name are configured.
-EOF
-}
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-mode="${1:-all}"
-
-sha256_file() {
-  local file="$1"
-  if command -v shasum >/dev/null 2>&1; then
-    shasum -a 256 "$file" > "${file}.sha256"
-  else
-    sha256sum "$file" > "${file}.sha256"
-  fi
-}
-
-sign_file() {
-  local file="$1"
-  local output="${2:-${file}.sig}"
-  local armor="${3:-0}"
-  local kms_key="$4"
-  local kms_public_key_pem="$5"
-  if [[ -z "$kms_public_key_pem" || -z "$kms_key" ]]; then
-    echo "warning: KMS OpenPGP signing disabled for ${file}; set the ${file} repository KMS public key and key name" >&2
-    return 0
-  fi
-  args=(
-    "${repo_root}/Scripts/package/google-kms-openpgp.py"
-    detach-sign
-    --public-key-pem "$kms_public_key_pem"
-    --kms-key "$kms_key"
-    --input "$file"
-    --output "$output"
-  )
-  if [[ "$armor" == "1" ]]; then
-    args+=(--armor)
-  fi
-  "${args[@]}"
-}
-
-write_public_key() {
-  local name="$1"
-  local kms_key="$2"
-  local kms_public_key_pem="$3"
-  local user_id="$4"
-  local output="${output_dir}/keys/${name}.asc"
-
-  if [[ -z "$kms_public_key_pem" || -z "$kms_key" ]]; then
-    echo "warning: KMS OpenPGP public key export disabled for ${name}; set the repository KMS public key and key name" >&2
-    return 0
-  fi
-
-  mkdir -p "$(dirname "$output")"
-  "${repo_root}/Scripts/package/google-kms-openpgp.py" \
-    public-key \
-    --public-key-pem "$kms_public_key_pem" \
-    --kms-key "$kms_key" \
-    --user-id "$user_id" \
-    --output "$output" \
-    --armor
-}
-
-write_release_file() {
-  local release_path="$1"
-  local dist_dir="$2"
-  local now
-  now="$(LC_ALL=C date -u '+%a, %d %b %Y %H:%M:%S +0000')"
-  {
-    printf 'Origin: Burrow\n'
-    printf 'Label: Burrow\n'
-    printf 'Suite: %s\n' "$suite"
-    printf 'Codename: %s\n' "$suite"
-    printf 'Date: %s\n' "$now"
-    printf 'Architectures: %s\n' "$apt_arch"
-    printf 'Components: %s\n' "$component"
-    printf 'Description: Burrow native package repository\n'
-    printf 'SHA256:\n'
-    (
-      cd "$dist_dir"
-      find . -type f ! -name Release -print | LC_ALL=C sort | while read -r file; do
-        clean="${file#./}"
-        sum="$(sha256sum "$clean" | awk '{print $1}')"
-        size="$(wc -c < "$clean" | tr -d ' ')"
-        printf ' %s %s %s\n' "$sum" "$size" "$clean"
-      done
-    )
-  } > "$release_path"
-}
-
-build_apt() {
-  local root binary_dir pool_dir release_dir release_file
-  root="${output_dir}/apt"
-  pool_dir="${root}/pool/${component}/b/burrow"
-  binary_dir="${root}/dists/${suite}/${component}/binary-${apt_arch}"
-  release_dir="${root}/dists/${suite}"
-  mkdir -p "$pool_dir" "$binary_dir" "$release_dir"
-
-  find "$input_dir" -type f -name '*.deb' -exec cp {} "$pool_dir/" \; 2>/dev/null || true
-  if ! find "$pool_dir" -type f -name '*.deb' -print -quit | grep -q .; then
-    echo "warning: no .deb packages found under ${input_dir}; apt repository contains README only" >&2
-    printf 'Place Burrow .deb artifacts in this repository pool before publishing.\n' > "${root}/README.txt"
-    return 0
-  fi
-  if ! command -v dpkg-scanpackages >/dev/null 2>&1; then
-    echo "error: dpkg-scanpackages is required to build the apt repository" >&2
-    exit 127
-  fi
-
-  (
-    cd "$root"
-    dpkg-scanpackages --arch "$apt_arch" "pool/${component}" /dev/null > "dists/${suite}/${component}/binary-${apt_arch}/Packages"
-    gzip -9cn "dists/${suite}/${component}/binary-${apt_arch}/Packages" > "dists/${suite}/${component}/binary-${apt_arch}/Packages.gz"
-  )
-  release_file="${release_dir}/Release"
-  write_release_file "$release_file" "$release_dir"
-  sign_file "$release_file" "${release_file}.gpg" 1 "$apt_kms_key" "$apt_kms_public_key_pem"
-  sha256_file "$release_file"
-}
-
-build_rpm() {
-  local root repomd
-  root="${output_dir}/rpm/${channel}/${rpm_arch}"
-  mkdir -p "$root"
-  find "$input_dir" -type f -name '*.rpm' -exec cp {} "$root/" \; 2>/dev/null || true
-  if ! find "$root" -maxdepth 1 -type f -name '*.rpm' -print -quit | grep -q .; then
-    echo "warning: no .rpm packages found under ${input_dir}; rpm repository contains README only" >&2
-    printf 'Place Burrow .rpm artifacts in this directory before publishing.\n' > "${root}/README.txt"
-    return 0
-  fi
-  if ! command -v createrepo_c >/dev/null 2>&1; then
-    echo "error: createrepo_c is required to build the rpm repository" >&2
-    exit 127
-  fi
-  createrepo_c "$root"
-  repomd="${root}/repodata/repomd.xml"
-  sign_file "$repomd" "${repomd}.asc" 1 "$rpm_kms_key" "$rpm_kms_public_key_pem"
-  sha256_file "$repomd"
-}
-
-build_arch() {
-  local root db
-  root="${output_dir}/arch/${repo_name}/${pacman_arch}"
-  mkdir -p "$root"
-  find "$input_dir" -type f \( -name '*.pkg.tar.zst' -o -name '*.pkg.tar.xz' -o -name '*.pkg.tar.gz' \) -exec cp {} "$root/" \; 2>/dev/null || true
-  if ! find "$root" -maxdepth 1 -type f -name '*.pkg.tar.*' -print -quit | grep -q .; then
-    echo "warning: no Arch packages found under ${input_dir}; pacman repository contains README only" >&2
-    printf 'Place Burrow .pkg.tar.* artifacts in this directory before publishing.\n' > "${root}/README.txt"
-    return 0
-  fi
-  if ! command -v repo-add >/dev/null 2>&1; then
-    echo "error: repo-add is required to build the Arch repository" >&2
-    exit 127
-  fi
-  (
-    cd "$root"
-    repo-add "${repo_name}.db.tar.gz" ./*.pkg.tar.*
-  )
-  db="${root}/${repo_name}.db.tar.gz"
-  sign_file "$db" "${db}.sig" 0 "$pacman_kms_key" "$pacman_kms_public_key_pem"
-  find "$root" -maxdepth 1 -type f -name '*.pkg.tar.*' ! -name '*.sig' -print | while read -r package; do
-    sign_file "$package" "${package}.sig" 0 "$pacman_kms_key" "$pacman_kms_public_key_pem"
-  done
-  sha256_file "$db"
-}
-
-build_keys() {
-  write_public_key "burrow-package-apt-repository" "$apt_kms_key" "$apt_kms_public_key_pem" "Burrow APT Package Repository <packages@burrow.net>"
-  write_public_key "burrow-package-rpm-repository" "$rpm_kms_key" "$rpm_kms_public_key_pem" "Burrow RPM Package Repository <packages@burrow.net>"
-  write_public_key "burrow-package-pacman-repository" "$pacman_kms_key" "$pacman_kms_public_key_pem" "Burrow pacman Package Repository <packages@burrow.net>"
-}
-
-mkdir -p "$output_dir"
-case "$mode" in
-  apt)
-    build_apt
-    ;;
-  rpm)
-    build_rpm
-    ;;
-  arch)
-    build_arch
-    ;;
-  keys)
-    build_keys
-    ;;
-  all)
-    build_keys
-    build_apt
-    build_rpm
-    build_arch
-    ;;
-  *)
-    echo "unknown repository mode: ${mode}" >&2
-    exit 64
-    ;;
-esac
diff --git a/Scripts/package/google-kms-openpgp.py b/Scripts/package/google-kms-openpgp.py
deleted file mode 100755
index c349069..0000000
--- a/Scripts/package/google-kms-openpgp.py
+++ /dev/null
@@ -1,313 +0,0 @@
-#!/usr/bin/env python3
-"""Create OpenPGP public keys and detached signatures backed by Google KMS.
-
-This intentionally implements only the narrow RSA/SHA-256 subset Burrow needs
-for Linux package repository metadata. The private key lives in Google Cloud KMS;
-this script builds OpenPGP packets locally and asks KMS to produce the RSA
-signature value.
-"""
-
-from __future__ import annotations
-
-import argparse
-import base64
-import binascii
-import hashlib
-import os
-import struct
-import subprocess
-import sys
-import tempfile
-import time
-from pathlib import Path
-
-
-RSA_PUBLIC_KEY_ALGO = 1
-SHA256_HASH_ALGO = 8
-
-
-def parse_der_length(data: bytes, offset: int) -> tuple[int, int]:
-    first = data[offset]
-    offset += 1
-    if first < 0x80:
-        return first, offset
-    count = first & 0x7F
-    if count == 0 or count > 4:
-        raise ValueError("unsupported DER length")
-    value = int.from_bytes(data[offset : offset + count], "big")
-    return value, offset + count
-
-
-def parse_der_tlv(data: bytes, offset: int, expected_tag: int | None = None) -> tuple[int, bytes, int]:
-    tag = data[offset]
-    offset += 1
-    length, offset = parse_der_length(data, offset)
-    value = data[offset : offset + length]
-    if len(value) != length:
-        raise ValueError("truncated DER value")
-    if expected_tag is not None and tag != expected_tag:
-        raise ValueError(f"expected DER tag {expected_tag:#x}, got {tag:#x}")
-    return tag, value, offset + length
-
-
-def pem_to_der(pem: bytes) -> bytes:
-    lines = [
-        line.strip()
-        for line in pem.splitlines()
-        if line and not line.startswith(b"-----")
-    ]
-    return base64.b64decode(b"".join(lines))
-
-
-def parse_rsa_public_key_from_pem(path: Path) -> tuple[int, int]:
-    der = pem_to_der(path.read_bytes())
-    _, spki, end = parse_der_tlv(der, 0, 0x30)
-    if end != len(der):
-        raise ValueError("trailing data after SubjectPublicKeyInfo")
-    _, _alg, offset = parse_der_tlv(spki, 0, 0x30)
-    _, bit_string, offset = parse_der_tlv(spki, offset, 0x03)
-    if offset != len(spki):
-        raise ValueError("trailing data after SPKI bit string")
-    if not bit_string or bit_string[0] != 0:
-        raise ValueError("unsupported SPKI bit string")
-    rsa_der = bit_string[1:]
-    _, rsa_seq, end = parse_der_tlv(rsa_der, 0, 0x30)
-    if end != len(rsa_der):
-        raise ValueError("trailing data after RSA public key")
-    _, n_bytes, offset = parse_der_tlv(rsa_seq, 0, 0x02)
-    _, e_bytes, offset = parse_der_tlv(rsa_seq, offset, 0x02)
-    if offset != len(rsa_seq):
-        raise ValueError("trailing data after RSA integers")
-    return int.from_bytes(n_bytes, "big"), int.from_bytes(e_bytes, "big")
-
-
-def packet_header(tag: int, length: int) -> bytes:
-    if length < 192:
-        return bytes([0xC0 | tag, length])
-    if length < 8384:
-        length -= 192
-        return bytes([0xC0 | tag, (length >> 8) + 192, length & 0xFF])
-    return bytes([0xC0 | tag, 0xFF]) + struct.pack(">I", length)
-
-
-def old_packet_header(tag: int, length: int) -> bytes:
-    if length > 0xFFFF:
-        raise ValueError("old-format two-octet packet length exceeded")
-    return bytes([(tag << 2) | 1]) + struct.pack(">H", length)
-
-
-def mpi(value: int) -> bytes:
-    if value < 0:
-        raise ValueError("MPI value must be non-negative")
-    raw = value.to_bytes(max(1, (value.bit_length() + 7) // 8), "big")
-    return struct.pack(">H", value.bit_length()) + raw.lstrip(b"\x00")
-
-
-def subpacket(kind: int, body: bytes) -> bytes:
-    payload = bytes([kind]) + body
-    length = len(payload)
-    if length < 192:
-        return bytes([length]) + payload
-    if length < 8384:
-        length -= 192
-        return bytes([(length >> 8) + 192, length & 0xFF]) + payload
-    return b"\xff" + struct.pack(">I", length) + payload
-
-
-def public_key_body(n: int, e: int, created_at: int) -> bytes:
-    return (
-        b"\x04"
-        + struct.pack(">I", created_at)
-        + bytes([RSA_PUBLIC_KEY_ALGO])
-        + mpi(n)
-        + mpi(e)
-    )
-
-
-def fingerprint(public_body: bytes) -> bytes:
-    return hashlib.sha1(old_packet_header(6, len(public_body)) + public_body).digest()
-
-
-def armor(kind: str, body: bytes) -> str:
-    b64 = base64.b64encode(body).decode("ascii")
-    crc = crc24(body)
-    checksum = base64.b64encode(crc.to_bytes(3, "big")).decode("ascii")
-    lines = [f"-----BEGIN PGP {kind}-----", ""]
-    lines.extend(b64[i : i + 64] for i in range(0, len(b64), 64))
-    lines.append(f"={checksum}")
-    lines.append(f"-----END PGP {kind}-----")
-    return "\n".join(lines) + "\n"
-
-
-def crc24(data: bytes) -> int:
-    crc = 0xB704CE
-    for octet in data:
-        crc ^= octet << 16
-        for _ in range(8):
-            crc <<= 1
-            if crc & 0x1000000:
-                crc ^= 0x1864CFB
-    return crc & 0xFFFFFF
-
-
-def kms_sign(payload: bytes, args: argparse.Namespace) -> bytes:
-    with tempfile.TemporaryDirectory(prefix="burrow-kms-openpgp.") as tmp:
-        input_path = Path(tmp) / "payload"
-        signature_path = Path(tmp) / "signature.b64"
-        input_path.write_bytes(payload)
-        command = [
-            "gcloud",
-            "kms",
-            "asymmetric-sign",
-            "--location",
-            args.kms_location,
-            "--keyring",
-            args.kms_keyring,
-            "--key",
-            args.kms_key,
-            "--version",
-            args.kms_version,
-            "--digest-algorithm",
-            "sha256",
-            "--input-file",
-            str(input_path),
-            "--signature-file",
-            str(signature_path),
-        ]
-        if args.gcloud_project:
-            command.extend(["--project", args.gcloud_project])
-        subprocess.run(command, check=True)
-        return base64.b64decode(signature_path.read_text(encoding="utf-8").strip())
-
-
-def signature_packet(
-    signed_payload: bytes,
-    public_body: bytes,
-    sig_type: int,
-    created_at: int,
-    args: argparse.Namespace,
-) -> bytes:
-    fpr = fingerprint(public_body)
-    key_id = fpr[-8:]
-    hashed = b"".join(
-        [
-            subpacket(2, struct.pack(">I", created_at)),
-            subpacket(33, b"\x04" + fpr),
-        ]
-    )
-    unhashed = subpacket(16, key_id)
-    sig_data = (
-        b"\x04"
-        + bytes([sig_type, RSA_PUBLIC_KEY_ALGO, SHA256_HASH_ALGO])
-        + struct.pack(">H", len(hashed))
-        + hashed
-    )
-    trailer = b"\x04\xff" + struct.pack(">I", len(sig_data))
-    to_hash = signed_payload + sig_data + trailer
-    digest = hashlib.sha256(to_hash).digest()
-    signature = kms_sign(to_hash, args)
-    body = (
-        sig_data
-        + struct.pack(">H", len(unhashed))
-        + unhashed
-        + digest[:2]
-        + mpi(int.from_bytes(signature, "big"))
-    )
-    return packet_header(2, len(body)) + body
-
-
-def public_key_command(args: argparse.Namespace) -> int:
-    created_at = args.created_at or int(time.time())
-    n, e = parse_rsa_public_key_from_pem(Path(args.public_key_pem))
-    public_body = public_key_body(n, e, created_at)
-    public_packet = packet_header(6, len(public_body)) + public_body
-    uid = args.user_id.encode("utf-8")
-    uid_packet = packet_header(13, len(uid)) + uid
-    uid_signed_payload = (
-        old_packet_header(6, len(public_body))
-        + public_body
-        + b"\xb4"
-        + struct.pack(">I", len(uid))
-        + uid
-    )
-    cert_packet = signature_packet(
-        uid_signed_payload,
-        public_body,
-        sig_type=0x13,
-        created_at=created_at,
-        args=args,
-    )
-    key = public_packet + uid_packet + cert_packet
-    output = Path(args.output)
-    if args.armor:
-        output.write_text(armor("PUBLIC KEY BLOCK", key), encoding="utf-8")
-    else:
-        output.write_bytes(key)
-    return 0
-
-
-def detach_sign_command(args: argparse.Namespace) -> int:
-    created_at = args.created_at or int(time.time())
-    n, e = parse_rsa_public_key_from_pem(Path(args.public_key_pem))
-    public_body = public_key_body(n, e, args.key_created_at)
-    payload = Path(args.input).read_bytes()
-    sig_type = 0x01 if args.text else 0x00
-    packet = signature_packet(payload, public_body, sig_type, created_at, args)
-    output = Path(args.output)
-    if args.armor:
-        output.write_text(armor("SIGNATURE", packet), encoding="utf-8")
-    else:
-        output.write_bytes(packet)
-    return 0
-
-
-def add_kms_args(parser: argparse.ArgumentParser) -> None:
-    parser.add_argument("--kms-location", default=os.environ.get("BURROW_KMS_LOCATION", "global"))
-    parser.add_argument("--kms-keyring", default=os.environ.get("BURROW_KMS_KEYRING", "burrow-identity"))
-    parser.add_argument("--kms-key", required=not os.environ.get("BURROW_KMS_KEY"), default=os.environ.get("BURROW_KMS_KEY"))
-    parser.add_argument("--kms-version", default=os.environ.get("BURROW_KMS_VERSION", "1"))
-    parser.add_argument("--gcloud-project", default=os.environ.get("GOOGLE_CLOUD_PROJECT"))
-
-
-def build_parser() -> argparse.ArgumentParser:
-    parser = argparse.ArgumentParser(description=__doc__)
-    subcommands = parser.add_subparsers(dest="command", required=True)
-
-    public_key = subcommands.add_parser("public-key")
-    public_key.add_argument("--public-key-pem", required=True)
-    public_key.add_argument("--user-id", default="Burrow Package Repository <packages@burrow.net>")
-    public_key.add_argument("--output", required=True)
-    public_key.add_argument("--armor", action="store_true")
-    public_key.add_argument("--created-at", type=int)
-    add_kms_args(public_key)
-    public_key.set_defaults(func=public_key_command)
-
-    detach = subcommands.add_parser("detach-sign")
-    detach.add_argument("--public-key-pem", required=True)
-    detach.add_argument("--key-created-at", type=int, default=1704067200)
-    detach.add_argument("--input", required=True)
-    detach.add_argument("--output", required=True)
-    detach.add_argument("--armor", action="store_true")
-    detach.add_argument("--text", action="store_true")
-    detach.add_argument("--created-at", type=int)
-    add_kms_args(detach)
-    detach.set_defaults(func=detach_sign_command)
-
-    return parser
-
-
-def main() -> int:
-    parser = build_parser()
-    args = parser.parse_args()
-    try:
-        return args.func(args)
-    except subprocess.CalledProcessError as exc:
-        print(f"gcloud signing failed: {exc}", file=sys.stderr)
-        return exc.returncode or 1
-    except Exception as exc:
-        print(f"error: {exc}", file=sys.stderr)
-        return 1
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
diff --git a/Scripts/provision-forgejo-nsc.sh b/Scripts/provision-forgejo-nsc.sh
deleted file mode 100755
index b82757c..0000000
--- a/Scripts/provision-forgejo-nsc.sh
+++ /dev/null
@@ -1,251 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-
-# shellcheck source=Scripts/_burrow-flake.sh
-source "${SCRIPT_DIR}/_burrow-flake.sh"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/provision-forgejo-nsc.sh [options]
-
-Generate Burrow forgejo-nsc runtime inputs in intake/ and optionally refresh the
-Namespace token from the currently logged-in namespace account.
-
-Options:
-  --host <user@host>       SSH target used to mint the Forgejo PAT.
-                           Default: root@git.burrow.net
-  --ssh-key <path>         SSH private key for the forge host.
-                           Default: intake/agent_at_burrow_net_ed25519
-  --nsc-bin <path>         Override the nsc binary.
-  --no-refresh-token       Reuse intake/forgejo_nsc_token.txt if it already exists.
-  --token-name <name>      Forgejo PAT name prefix (default: forgejo-nsc)
-  --contact-user <name>    Forgejo username used for PAT creation (default: contact)
-  --scope-owner <name>     Forgejo org/user owner for the default NSC scope (default: hackclub)
-  --scope-name <name>      Forgejo repository name for the default NSC scope (default: burrow)
-  -h, --help               Show this help text.
-EOF
-}
-
-HOST="${BURROW_FORGE_HOST:-root@git.burrow.net}"
-SSH_KEY="${BURROW_FORGE_SSH_KEY:-${REPO_ROOT}/intake/agent_at_burrow_net_ed25519}"
-NSC_BIN="${NSC_BIN:-}"
-KNOWN_HOSTS_FILE="${BURROW_FORGE_KNOWN_HOSTS_FILE:-${HOME}/.cache/burrow/forge-known_hosts}"
-REFRESH_TOKEN=1
-TOKEN_NAME_PREFIX="${FORGEJO_PAT_NAME:-forgejo-nsc}"
-CONTACT_USER="${FORGEJO_CONTACT_USER:-contact}"
-SCOPE_OWNER="${FORGEJO_SCOPE_OWNER:-hackclub}"
-SCOPE_NAME="${FORGEJO_SCOPE_NAME:-burrow}"
-BURROW_FLAKE_TMPDIRS=()
-
-cleanup() {
-  burrow_cleanup_flake_tmpdirs
-}
-trap cleanup EXIT
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --host)
-      HOST="${2:?missing value for --host}"
-      shift 2
-      ;;
-    --ssh-key)
-      SSH_KEY="${2:?missing value for --ssh-key}"
-      shift 2
-      ;;
-    --nsc-bin)
-      NSC_BIN="${2:?missing value for --nsc-bin}"
-      shift 2
-      ;;
-    --no-refresh-token)
-      REFRESH_TOKEN=0
-      shift
-      ;;
-    --token-name)
-      TOKEN_NAME_PREFIX="${2:?missing value for --token-name}"
-      shift 2
-      ;;
-    --contact-user)
-      CONTACT_USER="${2:?missing value for --contact-user}"
-      shift 2
-      ;;
-    --scope-owner)
-      SCOPE_OWNER="${2:?missing value for --scope-owner}"
-      shift 2
-      ;;
-    --scope-name)
-      SCOPE_NAME="${2:?missing value for --scope-name}"
-      shift 2
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "unknown option: $1" >&2
-      usage >&2
-      exit 64
-      ;;
-  esac
-done
-
-mkdir -p "$(dirname "${KNOWN_HOSTS_FILE}")"
-
-burrow_require_cmd nix
-burrow_require_cmd ssh
-burrow_require_cmd python3
-
-if [[ ! -f "${SSH_KEY}" ]]; then
-  echo "forge SSH key not found: ${SSH_KEY}" >&2
-  exit 1
-fi
-
-mkdir -p "${REPO_ROOT}/intake"
-chmod 700 "${REPO_ROOT}/intake"
-
-flake_ref="$(burrow_prepare_flake_ref "${REPO_ROOT}")"
-if [[ -z "${NSC_BIN}" ]]; then
-  if command -v nsc >/dev/null 2>&1; then
-    NSC_BIN="$(command -v nsc)"
-  else
-    nsc_build_output="$(
-      nix --extra-experimental-features "nix-command flakes" build \
-        "${flake_ref}#nsc" \
-        --no-link \
-        --print-out-paths 2>&1
-    )" || {
-      printf '%s\n' "${nsc_build_output}" >&2
-      exit 1
-    }
-    NSC_BIN="$(printf '%s\n' "${nsc_build_output}" | tail -n1)/bin/nsc"
-  fi
-fi
-
-if [[ ! -x "${NSC_BIN}" ]]; then
-  echo "unable to resolve an executable nsc binary; set NSC_BIN explicitly" >&2
-  exit 1
-fi
-
-token_file="${REPO_ROOT}/intake/forgejo_nsc_token.txt"
-dispatcher_out="${REPO_ROOT}/intake/forgejo_nsc_dispatcher.yaml"
-autoscaler_out="${REPO_ROOT}/intake/forgejo_nsc_autoscaler.yaml"
-dispatcher_src="${REPO_ROOT}/services/forgejo-nsc/deploy/dispatcher.yaml"
-autoscaler_src="${REPO_ROOT}/services/forgejo-nsc/deploy/autoscaler.yaml"
-
-if [[ "${REFRESH_TOKEN}" -eq 1 || ! -s "${token_file}" ]]; then
-  "${NSC_BIN}" auth check-login --duration 20m >/dev/null
-  token_name="${TOKEN_NAME_PREFIX}-namespace-$(date -u +%Y%m%dT%H%M%SZ)"
-  "${NSC_BIN}" token create \
-    --name "${token_name}" \
-    --description "Burrow Forgejo Namespace runner dispatcher" \
-    --expires_in "${NSC_TOKEN_EXPIRES_IN:-30d}" \
-    --grant '{"resource_type":"instance","resource_id":"*","actions":["create","destroy","dial_host","exec","get","list","refresh","ssh","wait"]}' \
-    --grant '{"resource_type":"instance/ingress","resource_id":"*","actions":["list","register"]}' \
-    --grant '{"resource_type":"instance/notification","resource_id":"*","actions":["list"]}' \
-    --grant '{"resource_type":"instance/o11y/logs","resource_id":"*","actions":["get"]}' \
-    --grant '{"resource_type":"cache/httpcache","resource_id":"*","actions":["ensure","read","write"]}' \
-    --grant '{"resource_type":"bazel/cache","resource_id":"*","actions":["ensure"]}' \
-    --grant '{"resource_type":"artifact","resource_id":"*","actions":["create","resolve","list"]}' \
-    --token_file "${token_file}" \
-    --output json >/dev/null
-  chmod 600 "${token_file}"
-fi
-
-webhook_secret="$(python3 - <<'PY'
-import secrets
-print(secrets.token_hex(32))
-PY
-)"
-
-token_name="${TOKEN_NAME_PREFIX}-$(date -u +%Y%m%dT%H%M%SZ)"
-forgejo_pat="$(
-  ssh \
-    -i "${SSH_KEY}" \
-    -o IdentitiesOnly=yes \
-    -o UserKnownHostsFile="${KNOWN_HOSTS_FILE}" \
-    -o StrictHostKeyChecking=accept-new \
-    "${HOST}" \
-    "set -euo pipefail; forgejo_bin=\$(systemctl show -p ExecStart forgejo.service --value | sed -E 's/^\\{ path=([^ ;]+).*/\\1/'); sudo -u forgejo \"\${forgejo_bin}\" --config /var/lib/forgejo/custom/conf/app.ini --custom-path /var/lib/forgejo/custom --work-path /var/lib/forgejo admin user generate-access-token --username '${CONTACT_USER}' --scopes all --raw --token-name '${token_name}'" \
-    | awk 'NF { line = $0 } END { print line }' \
-    | tr -d '\r\n'
-)"
-
-if [[ -z "${forgejo_pat}" ]]; then
-  echo "failed to mint Forgejo PAT on ${HOST}" >&2
-  exit 1
-fi
-
-ssh \
-  -i "${SSH_KEY}" \
-  -o IdentitiesOnly=yes \
-  -o UserKnownHostsFile="${KNOWN_HOSTS_FILE}" \
-  -o StrictHostKeyChecking=accept-new \
-  "${HOST}" \
-  'bash -s' <<EOF
-set -euo pipefail
-
-base_url='http://127.0.0.1:3000'
-token='${forgejo_pat}'
-scope_owner='${SCOPE_OWNER}'
-scope_name='${SCOPE_NAME}'
-
-api() {
-  curl -sS -o /tmp/forgejo-provision-response.json -w '%{http_code}' \
-    -H "Authorization: token \${token}" \
-    -H 'Content-Type: application/json' \
-    "\$@"
-}
-
-org_code="\$(api "\${base_url}/api/v1/orgs/\${scope_owner}")"
-if [[ "\${org_code}" == "404" ]]; then
-  cat >/tmp/forgejo-provision-org.json <<JSON
-{"username":"${SCOPE_OWNER}","full_name":"${SCOPE_OWNER}","visibility":"public"}
-JSON
-  org_code="\$(api -X POST --data @/tmp/forgejo-provision-org.json "\${base_url}/api/v1/orgs")"
-  if [[ "\${org_code}" != "201" ]]; then
-    echo "failed to create Forgejo org ${SCOPE_OWNER} (HTTP \${org_code})" >&2
-    cat /tmp/forgejo-provision-response.json >&2
-    exit 1
-  fi
-fi
-
-repo_code="\$(api "\${base_url}/api/v1/repos/\${scope_owner}/\${scope_name}")"
-if [[ "\${repo_code}" == "404" ]]; then
-  cat >/tmp/forgejo-provision-repo.json <<JSON
-{"name":"${SCOPE_NAME}","description":"Burrow forge bootstrap repository","private":false,"default_branch":"main","auto_init":false}
-JSON
-  repo_code="\$(api -X POST --data @/tmp/forgejo-provision-repo.json "\${base_url}/api/v1/orgs/\${scope_owner}/repos")"
-  if [[ "\${repo_code}" != "201" ]]; then
-    echo "failed to create Forgejo repo ${SCOPE_OWNER}/${SCOPE_NAME} (HTTP \${repo_code})" >&2
-    cat /tmp/forgejo-provision-response.json >&2
-    exit 1
-  fi
-fi
-EOF
-
-FORGEJO_PAT="${forgejo_pat}" \
-WEBHOOK_SECRET="${webhook_secret}" \
-DISPATCHER_SRC="${dispatcher_src}" \
-AUTOSCALER_SRC="${autoscaler_src}" \
-DISPATCHER_OUT="${dispatcher_out}" \
-AUTOSCALER_OUT="${autoscaler_out}" \
-python3 - <<'PY'
-import os
-from pathlib import Path
-
-def render(src: str, dst: str) -> None:
-    text = Path(src).read_text(encoding="utf-8")
-    text = text.replace("PENDING-FORGEJO-PAT", os.environ["FORGEJO_PAT"])
-    text = text.replace("PENDING-WEBHOOK-SECRET", os.environ["WEBHOOK_SECRET"])
-    Path(dst).write_text(text, encoding="utf-8")
-
-render(os.environ["DISPATCHER_SRC"], os.environ["DISPATCHER_OUT"])
-render(os.environ["AUTOSCALER_SRC"], os.environ["AUTOSCALER_OUT"])
-PY
-
-chmod 600 "${dispatcher_out}" "${autoscaler_out}"
-
-echo "Rendered intake/forgejo_nsc_token.txt, intake/forgejo_nsc_dispatcher.yaml, and intake/forgejo_nsc_autoscaler.yaml."
-echo "Minted Forgejo PAT ${token_name} for ${CONTACT_USER} on ${HOST}."
diff --git a/Scripts/release/google-kms-openssl-dgst-shim.sh b/Scripts/release/google-kms-openssl-dgst-shim.sh
deleted file mode 100755
index 4925386..0000000
--- a/Scripts/release/google-kms-openssl-dgst-shim.sh
+++ /dev/null
@@ -1,196 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-real_openssl="${BURROW_REAL_OPENSSL:-openssl}"
-gcloud_bin="${BURROW_GCLOUD_BIN:-gcloud}"
-original_args=("$@")
-
-exec_real_openssl() {
-  exec "$real_openssl" "$@"
-}
-
-truthy() {
-  case "${1:-}" in
-    1|true|TRUE|True|yes|YES|Yes|y|Y|on|ON|On) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-parse_pkcs11_key_name() {
-  local uri="$1"
-  local value
-  value="${uri#*;object=}"
-  if [[ "$value" != "$uri" ]]; then
-    printf '%s\n' "${value%%;*}"
-    return 0
-  fi
-  value="${uri#*;id=}"
-  if [[ "$value" != "$uri" ]]; then
-    printf '%s\n' "${value%%;*}"
-    return 0
-  fi
-  return 1
-}
-
-select_single_enabled_version() {
-  local project_id="$1"
-  local kms_location="$2"
-  local kms_keyring_name="$3"
-  local crypto_key_name="$4"
-  local versions=()
-  local version
-
-  while IFS= read -r version; do
-    [[ -n "$version" ]] && versions+=("$version")
-  done < <(
-    "$gcloud_bin" kms keys versions list \
-      --project="$project_id" \
-      --location="$kms_location" \
-      --keyring="$kms_keyring_name" \
-      --key="$crypto_key_name" \
-      --filter=state=ENABLED \
-      --format='value(name)'
-  )
-  if [[ "${#versions[@]}" -ne 1 || -z "${versions[0]:-}" ]]; then
-    echo "error: Google KMS crypto key ${crypto_key_name} has ${#versions[@]} ENABLED versions; set BURROW_GCP_KMS_ACTIVE_CRYPTO_KEY_VERSION" >&2
-    return 1
-  fi
-  printf '%s\n' "${versions[0]##*/}"
-}
-
-if [[ "${1:-}" != "dgst" ]]; then
-  exec_real_openssl "${original_args[@]}"
-fi
-
-if ! truthy "${BURROW_APPLE_PKCS11_SIGN_WITH_GCLOUD:-true}"; then
-  exec_real_openssl "${original_args[@]}"
-fi
-
-shift
-digest_algorithm=""
-signature_file=""
-input_file=""
-sign_uri=""
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    -sha256)
-      digest_algorithm="sha256"
-      shift
-      ;;
-    -sign)
-      [[ $# -ge 2 ]] || {
-        echo "error: openssl dgst shim received -sign without a key URI" >&2
-        exit 2
-      }
-      sign_uri="$2"
-      shift 2
-      ;;
-    -out)
-      [[ $# -ge 2 ]] || {
-        echo "error: openssl dgst shim received -out without a path" >&2
-        exit 2
-      }
-      signature_file="$2"
-      shift 2
-      ;;
-    -provider|-passin)
-      [[ $# -ge 2 ]] || {
-        echo "error: openssl dgst shim received $1 without a value" >&2
-        exit 2
-      }
-      shift 2
-      ;;
-    -*)
-      exec_real_openssl "${original_args[@]}"
-      ;;
-    *)
-      input_file="$1"
-      shift
-      ;;
-  esac
-done
-
-if [[ "$digest_algorithm" != "sha256" || "$sign_uri" != pkcs11:* ]]; then
-  exec_real_openssl "${original_args[@]}"
-fi
-if [[ -z "$signature_file" || -z "$input_file" ]]; then
-  echo "error: openssl dgst shim requires -out and an input file" >&2
-  exit 2
-fi
-if [[ ! -f "$input_file" ]]; then
-  echo "error: openssl dgst shim input file does not exist: $input_file" >&2
-  exit 1
-fi
-command -v "$gcloud_bin" >/dev/null 2>&1 || {
-  echo "error: gcloud is required for Google KMS direct signing; set BURROW_GCLOUD_BIN" >&2
-  exit 1
-}
-command -v python3 >/dev/null 2>&1 || {
-  echo "error: python3 is required to decode Google KMS signatures" >&2
-  exit 1
-}
-
-crypto_key="${BURROW_GCP_KMS_ACTIVE_CRYPTO_KEY:-}"
-if [[ -z "$crypto_key" ]]; then
-  crypto_key="$(parse_pkcs11_key_name "$sign_uri" || true)"
-fi
-if [[ -z "$crypto_key" ]]; then
-  echo "error: BURROW_GCP_KMS_ACTIVE_CRYPTO_KEY or a pkcs11 object selector is required" >&2
-  exit 1
-fi
-
-key_version="${BURROW_GCP_KMS_ACTIVE_CRYPTO_KEY_VERSION:-}"
-key_ring="${BURROW_GCP_KMS_KEY_RING:-${GOOGLE_KMS_KEY_RING:-projects/${GOOGLE_CLOUD_PROJECT:-project-88c23ce9-918a-470a-b33}/locations/${BURROW_KMS_LOCATION:-global}/keyRings/${BURROW_KMS_KEYRING:-burrow-identity}}}"
-project_id="${GOOGLE_CLOUD_PROJECT:-project-88c23ce9-918a-470a-b33}"
-kms_location=""
-kms_keyring_name=""
-crypto_key_name=""
-
-if [[ "$crypto_key" =~ ^projects/([^/]+)/locations/([^/]+)/keyRings/([^/]+)/cryptoKeys/([^/]+)/cryptoKeyVersions/([^/]+)$ ]]; then
-  project_id="${BASH_REMATCH[1]}"
-  kms_location="${BASH_REMATCH[2]}"
-  kms_keyring_name="${BASH_REMATCH[3]}"
-  crypto_key_name="${BASH_REMATCH[4]}"
-  key_version="${BASH_REMATCH[5]}"
-elif [[ "$crypto_key" =~ ^projects/([^/]+)/locations/([^/]+)/keyRings/([^/]+)/cryptoKeys/([^/]+)$ ]]; then
-  project_id="${BASH_REMATCH[1]}"
-  kms_location="${BASH_REMATCH[2]}"
-  kms_keyring_name="${BASH_REMATCH[3]}"
-  crypto_key_name="${BASH_REMATCH[4]}"
-else
-  if [[ ! "$key_ring" =~ ^projects/([^/]+)/locations/([^/]+)/keyRings/([^/]+)$ ]]; then
-    echo "error: BURROW_GCP_KMS_KEY_RING must be projects/<project>/locations/<location>/keyRings/<name>, got: ${key_ring}" >&2
-    exit 1
-  fi
-  project_id="${BASH_REMATCH[1]}"
-  kms_location="${BASH_REMATCH[2]}"
-  kms_keyring_name="${BASH_REMATCH[3]}"
-  crypto_key_name="$crypto_key"
-fi
-
-if [[ -z "$key_version" ]]; then
-  key_version="$(select_single_enabled_version "$project_id" "$kms_location" "$kms_keyring_name" "$crypto_key_name")"
-fi
-
-encoded_signature_file="$(mktemp "${TMPDIR:-/tmp}/burrow-google-kms-signature.XXXXXX")"
-trap 'rm -f "$encoded_signature_file"' EXIT
-"$gcloud_bin" kms asymmetric-sign \
-  --project="$project_id" \
-  --location="$kms_location" \
-  --keyring="$kms_keyring_name" \
-  --key="$crypto_key_name" \
-  --version="$key_version" \
-  --digest-algorithm="$digest_algorithm" \
-  --input-file="$input_file" \
-  --signature-file="$encoded_signature_file" \
-  --quiet >/dev/null
-
-python3 - "$encoded_signature_file" "$signature_file" <<'PY'
-import pathlib
-import sys
-
-encoded_path = pathlib.Path(sys.argv[1])
-signature_path = pathlib.Path(sys.argv[2])
-signature_path.write_bytes(encoded_path.read_bytes())
-PY
diff --git a/Scripts/release/google-kms-pkcs11-materialize.sh b/Scripts/release/google-kms-pkcs11-materialize.sh
deleted file mode 100755
index 2e0dde8..0000000
--- a/Scripts/release/google-kms-pkcs11-materialize.sh
+++ /dev/null
@@ -1,93 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-emit_env=false
-ROOT="$(
-  git rev-parse --show-toplevel 2>/dev/null || {
-    cd "$(dirname "${BASH_SOURCE[0]}")/../.."
-    pwd
-  }
-)"
-runtime_dir="${BURROW_GCP_KMS_PKCS11_RUNTIME_DIR:-${RUNNER_TEMP:-${TMPDIR:-/tmp}}/burrow-google-kms-pkcs11-runtime}"
-config_file="${BURROW_GCP_KMS_PKCS11_CONFIG:-${KMS_PKCS11_CONFIG:-}}"
-config_yaml="${BURROW_GCP_KMS_PKCS11_CONFIG_YAML:-}"
-key_ring="${BURROW_GCP_KMS_KEY_RING:-${GOOGLE_KMS_KEY_RING:-projects/${GOOGLE_CLOUD_PROJECT:-project-88c23ce9-918a-470a-b33}/locations/${BURROW_KMS_LOCATION:-global}/keyRings/${BURROW_KMS_KEYRING:-burrow-identity}}}"
-token_label="${BURROW_GCP_KMS_PKCS11_TOKEN_LABEL:-${BURROW_PKCS11_TOKEN_LABEL:-burrow-release}}"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/release/google-kms-pkcs11-materialize.sh [--emit-env]
-
-Materializes optional Google KMS PKCS#11 config YAML into a runner-local file
-and emits environment variables consumed by the Apple release signer.
-EOF
-}
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --emit-env)
-      emit_env=true
-      shift
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "error: unknown argument $1" >&2
-      usage >&2
-      exit 2
-      ;;
-  esac
-done
-
-write_config_file() {
-  local path="$1"
-  local value="$2"
-  mkdir -p "$(dirname "$path")"
-  printf '%s\n' "$value" >"$path"
-  chmod 600 "$path"
-}
-
-resolve_config_path() {
-  local path="$1"
-  if [[ -z "$path" ]]; then
-    return 1
-  fi
-  if [[ "$path" != /* ]]; then
-    path="$ROOT/$path"
-  fi
-  printf '%s\n' "$path"
-}
-
-env_lines=()
-if [[ -z "$config_file" && -n "$config_yaml" ]]; then
-  config_file="$runtime_dir/pkcs11-config.yaml"
-  write_config_file "$config_file" "$config_yaml"
-fi
-
-if [[ -z "$config_file" && -n "$key_ring" ]]; then
-  config_file="$runtime_dir/pkcs11-config.yaml"
-  write_config_file "$config_file" "---
-tokens:
-  - key_ring: \"${key_ring}\"
-    label: \"${token_label}\""
-fi
-
-if [[ -n "$config_file" ]]; then
-  config_file="$(resolve_config_path "$config_file")"
-  if [[ ! -s "$config_file" ]]; then
-    echo "error: Google KMS PKCS#11 config is missing or empty: $config_file" >&2
-    exit 1
-  fi
-  env_lines+=("BURROW_GCP_KMS_PKCS11_CONFIG=$config_file")
-  env_lines+=("KMS_PKCS11_CONFIG=$config_file")
-fi
-
-if [[ "${#env_lines[@]}" -gt 0 && -n "${GITHUB_ENV:-}" ]]; then
-  printf '%s\n' "${env_lines[@]}" >>"$GITHUB_ENV"
-fi
-
-if [[ "$emit_env" == "true" && "${#env_lines[@]}" -gt 0 ]]; then
-  printf 'export %q\n' "${env_lines[@]}"
-fi
diff --git a/Scripts/releases-tofu.sh b/Scripts/releases-tofu.sh
deleted file mode 100755
index 0168c5b..0000000
--- a/Scripts/releases-tofu.sh
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT="$(
-  git rev-parse --show-toplevel 2>/dev/null || {
-    cd "$(dirname "${BASH_SOURCE[0]}")/.."
-    pwd
-  }
-)"
-
-work_dir="${BURROW_RELEASES_TOFU_DIR:-$ROOT/infra/releases}"
-plugin_cache_dir="${BURROW_TOFU_PLUGIN_CACHE_DIR:-$ROOT/.cache/opentofu/plugins}"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/releases-tofu.sh [tofu args...]
-
-Runs OpenTofu for Burrow Google Cloud Storage release and package repository
-buckets. Cloud provider credentials must come from ADC or Workload Identity
-Federation; do not put service-account JSON in this repository.
-
-Examples:
-  Scripts/releases-tofu.sh init -backend-config=backend.hcl
-  Scripts/releases-tofu.sh plan -var-file=terraform.tfvars
-
-Local syntax check:
-  Scripts/releases-tofu.sh init -backend=false
-  Scripts/releases-tofu.sh validate
-EOF
-}
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-mkdir -p "$plugin_cache_dir"
-export TF_PLUGIN_CACHE_DIR="$plugin_cache_dir"
-export TF_IN_AUTOMATION="${TF_IN_AUTOMATION:-true}"
-
-exec nix shell --inputs-from "$ROOT" nixpkgs#opentofu -c tofu -chdir="$work_dir" "$@"
diff --git a/Scripts/resolve-age-identity.sh b/Scripts/resolve-age-identity.sh
deleted file mode 100755
index 321a0a1..0000000
--- a/Scripts/resolve-age-identity.sh
+++ /dev/null
@@ -1,172 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-identity_is_valid() {
-  local path="$1"
-  if [[ -z "$path" || ! -f "$path" || ! -s "$path" ]]; then
-    return 1
-  fi
-
-  chmod 600 "$path" 2>/dev/null || true
-  if command -v age-keygen >/dev/null 2>&1 && age-keygen -y "$path" >/dev/null 2>&1; then
-    return 0
-  fi
-  if openssh_private_identity_has_markers "$path"; then
-    return 0
-  fi
-  if command -v ssh-keygen >/dev/null 2>&1 && ssh-keygen -y -f "$path" >/dev/null 2>&1; then
-    return 0
-  fi
-
-  local header
-  header="$(LC_ALL=C head -c 80 "$path" 2>/dev/null || true)"
-  case "$header" in
-    AGE-SECRET-KEY-*) return 0 ;;
-  esac
-
-  echo "::warning ::Ignoring invalid age identity candidate at ${path}" >&2
-  return 1
-}
-
-openssh_private_identity_has_markers() {
-  local path="$1"
-  local first_line
-  first_line="$(LC_ALL=C sed -n '1p' "$path" 2>/dev/null || true)"
-  if [[ "$first_line" != "-----BEGIN OPENSSH PRIVATE KEY-----" ]]; then
-    return 1
-  fi
-  if LC_ALL=C grep -Fq '\n' "$path" 2>/dev/null; then
-    return 1
-  fi
-  LC_ALL=C grep -q '^-----END OPENSSH PRIVATE KEY-----$' "$path" 2>/dev/null
-}
-
-candidate_path() {
-  local path="$1"
-  if identity_is_valid "$path"; then
-    printf '%s\n' "$path"
-    return 0
-  fi
-  return 1
-}
-
-preferred_home() {
-  if [[ -n "${RUNNER_HOME:-}" ]]; then
-    printf '%s\n' "$RUNNER_HOME"
-  elif [[ -n "${FORGEJO_RUNNER_HOME:-}" ]]; then
-    printf '%s\n' "$FORGEJO_RUNNER_HOME"
-  elif [[ -n "${HOME:-}" ]]; then
-    printf '%s\n' "$HOME"
-  elif [[ -n "${FORGEJO_RUNNER_WORKDIR:-}" ]]; then
-    printf '%s\n' "${FORGEJO_RUNNER_WORKDIR}/home"
-  else
-    printf '%s\n' "/tmp/forgejo-runner/home"
-  fi
-}
-
-decode_base64() {
-  local value="$1"
-  local path="$2"
-  if command -v base64 >/dev/null 2>&1; then
-    if printf '%s' "$value" | base64 -d > "$path" 2>/dev/null; then
-      return 0
-    fi
-    if printf '%s' "$value" | base64 -D > "$path" 2>/dev/null; then
-      return 0
-    fi
-  fi
-  return 1
-}
-
-materialize_secret() {
-  local raw="$1"
-  local home="$2"
-  local path="${home}/.ssh/age_keystore"
-  install -d -m 700 "${home}/.ssh"
-  printf '%s\n' "$raw" > "$path"
-  perl -0pi -e 's/\r\n?/\n/g' "$path" 2>/dev/null || true
-  chmod 600 "$path"
-  if identity_is_valid "$path"; then
-    printf '%s\n' "$path"
-    return 0
-  fi
-
-  if [[ "$raw" == *"\\n"* ]]; then
-    printf '%b' "$raw" > "$path"
-    perl -0pi -e 's/\r\n?/\n/g' "$path" 2>/dev/null || true
-    chmod 600 "$path"
-    if identity_is_valid "$path"; then
-      printf '%s\n' "$path"
-      return 0
-    fi
-  fi
-
-  if decode_base64 "$raw" "$path"; then
-    perl -0pi -e 's/\r\n?/\n/g' "$path" 2>/dev/null || true
-    chmod 600 "$path"
-    if identity_is_valid "$path"; then
-      printf '%s\n' "$path"
-      return 0
-    fi
-  fi
-
-  rm -f "$path"
-  echo "::warning ::Injected age identity was present but not parseable; trying other candidates" >&2
-  return 1
-}
-
-resolve_from_existing_files() {
-  local home
-  home="$(preferred_home)"
-
-  local candidate
-  while IFS= read -r candidate; do
-    candidate_path "$candidate" && return 0
-  done <<EOF
-${AGE_IDENTITY_PATH:-}
-${BURROW_RUNNER_AGE_IDENTITY_PATH:-}
-/var/lib/forgejo-runner-agent/age_keystore
-EOF
-
-  if [[ -n "${BURROW_RUNNER_AGE_IDENTITY_B64:-}" ]]; then
-    local decoded_path
-    decoded_path="${home}/.ssh/age_keystore.from_b64"
-    if decode_base64 "$BURROW_RUNNER_AGE_IDENTITY_B64" "$decoded_path" && candidate_path "$decoded_path"; then
-      return 0
-    fi
-    rm -f "$decoded_path"
-    if materialize_secret "$BURROW_RUNNER_AGE_IDENTITY_B64" "$home"; then
-      return 0
-    fi
-  fi
-
-  if [[ -n "${BURROW_RUNNER_AGE_IDENTITY:-}" ]]; then
-    materialize_secret "$BURROW_RUNNER_AGE_IDENTITY" "$home" && return 0
-  fi
-
-  if [[ -n "${AGE_FORGE_SSH_KEY:-}" ]]; then
-    materialize_secret "$AGE_FORGE_SSH_KEY" "$home" && return 0
-  fi
-
-  while IFS= read -r candidate; do
-    candidate_path "$candidate" && return 0
-  done <<EOF
-${RUNNER_HOME:-}/.ssh/age_keystore
-${FORGEJO_RUNNER_HOME:-}/.ssh/age_keystore
-${HOME:-}/.ssh/age_keystore
-${FORGEJO_RUNNER_WORKDIR:-}/home/.ssh/age_keystore
-${FORGEJO_RUNNER_WORKDIR:-}/age_keystore
-/tmp/forgejo-runner/home/.ssh/age_keystore
-/tmp/forgejo-runner/age_keystore
-EOF
-
-  return 1
-}
-
-if resolved="$(resolve_from_existing_files)"; then
-  printf 'AGE_IDENTITY_PATH=%s\n' "$resolved"
-  exit 0
-fi
-
-echo "::error ::Missing age identity (checked explicit path, runner home, managed host path, and injected secrets)" >&2
-exit 1
diff --git a/Scripts/resolve-forge-ssh-key.sh b/Scripts/resolve-forge-ssh-key.sh
deleted file mode 100755
index 0ea566b..0000000
--- a/Scripts/resolve-forge-ssh-key.sh
+++ /dev/null
@@ -1,121 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-preferred_home() {
-  if [[ -n "${RUNNER_HOME:-}" ]]; then
-    printf '%s\n' "$RUNNER_HOME"
-  elif [[ -n "${FORGEJO_RUNNER_HOME:-}" ]]; then
-    printf '%s\n' "$FORGEJO_RUNNER_HOME"
-  elif [[ -n "${HOME:-}" ]]; then
-    printf '%s\n' "$HOME"
-  elif [[ -n "${FORGEJO_RUNNER_WORKDIR:-}" ]]; then
-    printf '%s\n' "${FORGEJO_RUNNER_WORKDIR}/home"
-  else
-    printf '%s\n' "/tmp/forgejo-runner/home"
-  fi
-}
-
-is_ssh_private_key() {
-  local candidate="$1"
-  [[ -n "$candidate" && -f "$candidate" && -s "$candidate" ]] || return 1
-  chmod 600 "$candidate" 2>/dev/null || true
-  ssh-keygen -y -f "$candidate" >/dev/null 2>&1
-}
-
-candidate_path() {
-  local path="$1"
-  if is_ssh_private_key "$path"; then
-    printf '%s\n' "$path"
-    return 0
-  fi
-  return 1
-}
-
-decode_base64() {
-  local value="$1"
-  local path="$2"
-  if command -v base64 >/dev/null 2>&1; then
-    if printf '%s' "$value" | base64 -d > "$path" 2>/dev/null; then
-      return 0
-    fi
-    if printf '%s' "$value" | base64 -D > "$path" 2>/dev/null; then
-      return 0
-    fi
-  fi
-  return 1
-}
-
-materialize_secret() {
-  local raw="$1"
-  local home="$2"
-  local path="${home}/.ssh/burrow_forge_ed25519"
-  install -d -m 700 "${home}/.ssh"
-
-  printf '%s\n' "$raw" > "$path"
-  if candidate_path "$path"; then
-    return 0
-  fi
-
-  if [[ "$raw" == *"\\n"* ]]; then
-    printf '%b' "$raw" > "$path"
-    if candidate_path "$path"; then
-      return 0
-    fi
-  fi
-
-  if decode_base64 "$raw" "$path" && candidate_path "$path"; then
-    return 0
-  fi
-
-  rm -f "$path"
-  echo "::warning ::Injected Forge SSH key was present but not parseable; trying file candidates" >&2
-  return 1
-}
-
-resolve_key() {
-  local home
-  home="$(preferred_home)"
-
-  if [[ -n "${BURROW_FORGE_SSH_KEY:-}" ]]; then
-    if candidate_path "$BURROW_FORGE_SSH_KEY"; then
-      return 0
-    fi
-    echo "::error ::BURROW_FORGE_SSH_KEY is set but is not an SSH private key: ${BURROW_FORGE_SSH_KEY}" >&2
-    return 1
-  fi
-
-  if [[ -n "${AGE_FORGE_SSH_KEY:-}" ]]; then
-    materialize_secret "$AGE_FORGE_SSH_KEY" "$home" && return 0
-  fi
-
-  local candidate
-  while IFS= read -r candidate; do
-    candidate_path "$candidate" && return 0
-  done <<EOF
-${AGE_IDENTITY_PATH:-}
-${BURROW_RUNNER_AGE_IDENTITY_PATH:-}
-${RUNNER_HOME:-}/.ssh/burrow_forge_ed25519
-${FORGEJO_RUNNER_HOME:-}/.ssh/burrow_forge_ed25519
-${HOME:-}/.ssh/burrow_forge_ed25519
-${HOME:-}/.ssh/agent_at_burrow_net_ed25519
-${HOME:-}/.ssh/burrow_forgejo_ed25519
-/var/lib/forgejo-runner-agent/age_keystore
-${RUNNER_HOME:-}/.ssh/age_keystore
-${FORGEJO_RUNNER_HOME:-}/.ssh/age_keystore
-${HOME:-}/.ssh/age_keystore
-${FORGEJO_RUNNER_WORKDIR:-}/home/.ssh/age_keystore
-${FORGEJO_RUNNER_WORKDIR:-}/age_keystore
-/tmp/forgejo-runner/home/.ssh/age_keystore
-/tmp/forgejo-runner/age_keystore
-EOF
-
-  return 1
-}
-
-if resolved="$(resolve_key)"; then
-  printf 'BURROW_FORGE_SSH_KEY=%s\n' "$resolved"
-  exit 0
-fi
-
-echo "::error ::Forge SSH key not found. Set BURROW_FORGE_SSH_KEY or AGE_FORGE_SSH_KEY." >&2
-exit 1
diff --git a/Scripts/run-ios-tailnet-ui-tests.sh b/Scripts/run-ios-tailnet-ui-tests.sh
deleted file mode 100755
index 2638c39..0000000
--- a/Scripts/run-ios-tailnet-ui-tests.sh
+++ /dev/null
@@ -1,163 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-bundle_id="${BURROW_UI_TEST_APP_BUNDLE_ID:-net.burrow.app}"
-simulator_name="${BURROW_UI_TEST_SIMULATOR_NAME:-iPhone 17 Pro}"
-simulator_os="${BURROW_UI_TEST_SIMULATOR_OS:-26.4}"
-simulator_id="${BURROW_UI_TEST_SIMULATOR_ID:-}"
-derived_data_path="${BURROW_UI_TEST_DERIVED_DATA_PATH:-/tmp/burrow-ui-tests-deriveddata}"
-source_packages_path="${BURROW_UI_TEST_SOURCE_PACKAGES_PATH:-/tmp/burrow-ui-tests-sourcepackages}"
-fallback_dir="/tmp/${bundle_id}/SimulatorFallback"
-socket_path="${fallback_dir}/burrow.sock"
-tailnet_state_root="/tmp/${bundle_id}/SimulatorTailnetState"
-daemon_log="${BURROW_UI_TEST_DAEMON_LOG:-/tmp/burrow-ui-test-daemon.log}"
-ui_test_config_path="${BURROW_UI_TEST_CONFIG_PATH:-/tmp/burrow-ui-test-config.json}"
-ui_test_runner_bundle_id="${bundle_id}.uitests.xctrunner"
-ui_test_email="${BURROW_UI_TEST_EMAIL:-ui-test@burrow.net}"
-ui_test_username="${BURROW_UI_TEST_USERNAME:-ui-test}"
-ui_test_tailnet_mode="${BURROW_UI_TEST_TAILNET_MODE:-tailscale}"
-password_secret="${repo_root}/secrets/infra/authentik-ui-test-password.age"
-age_identity="${BURROW_UI_TEST_AGE_IDENTITY:-${HOME}/.ssh/id_ed25519}"
-
-ui_test_password="${BURROW_UI_TEST_PASSWORD:-}"
-if [[ -z "$ui_test_password" ]]; then
-  if [[ -f "$password_secret" && -f "$age_identity" ]]; then
-    ui_test_password="$(age -d -i "$age_identity" "$password_secret" | tr -d '\r\n')"
-  else
-    echo "error: BURROW_UI_TEST_PASSWORD is unset and ${password_secret} could not be decrypted" >&2
-    exit 1
-  fi
-fi
-
-rm -rf "$fallback_dir" "$tailnet_state_root"
-mkdir -p "$fallback_dir" "$tailnet_state_root" "$derived_data_path" "$source_packages_path"
-rm -f "$socket_path"
-
-resolve_simulator_id() {
-  xcrun simctl list devices available -j | python3 -c '
-import json
-import os
-import sys
-
-target_name = sys.argv[1]
-target_os = sys.argv[2]
-target_runtime = "com.apple.CoreSimulator.SimRuntime.iOS-" + target_os.replace(".", "-")
-devices = json.load(sys.stdin).get("devices", {})
-healthy = []
-for runtime, entries in devices.items():
-    if runtime != target_runtime:
-        continue
-    for entry in entries:
-        if not entry.get("isAvailable", False):
-            continue
-        if not os.path.isdir(entry.get("dataPath", "")):
-            continue
-        healthy.append(entry)
-for entry in healthy:
-    if entry.get("name") == target_name:
-        print(entry["udid"])
-        raise SystemExit(0)
-for entry in healthy:
-    if target_name in entry.get("name", ""):
-        print(entry["udid"])
-        raise SystemExit(0)
-raise SystemExit(1)
-' "$simulator_name" "$simulator_os"
-}
-
-if [[ -z "$simulator_id" ]]; then
-  simulator_id="$(resolve_simulator_id || true)"
-fi
-
-if [[ -n "$simulator_id" ]]; then
-  xcrun simctl boot "$simulator_id" >/dev/null 2>&1 || true
-  xcrun simctl bootstatus "$simulator_id" -b
-  xcrun simctl terminate "$simulator_id" "$bundle_id" >/dev/null 2>&1 || true
-  xcrun simctl terminate "$simulator_id" "$ui_test_runner_bundle_id" >/dev/null 2>&1 || true
-  xcrun simctl uninstall "$simulator_id" "$bundle_id" >/dev/null 2>&1 || true
-  xcrun simctl uninstall "$simulator_id" "$ui_test_runner_bundle_id" >/dev/null 2>&1 || true
-  destination="id=${simulator_id}"
-else
-  destination="platform=iOS Simulator,name=${simulator_name},OS=${simulator_os}"
-fi
-
-cleanup() {
-  rm -f "$ui_test_config_path"
-  if [[ -n "${daemon_pid:-}" ]]; then
-    kill "$daemon_pid" >/dev/null 2>&1 || true
-    wait "$daemon_pid" >/dev/null 2>&1 || true
-  fi
-}
-trap cleanup EXIT
-
-umask 077
-python3 - <<'PY' "$ui_test_config_path" "$ui_test_email" "$ui_test_username" "$ui_test_password" "$ui_test_tailnet_mode"
-import json
-import pathlib
-import sys
-
-config_path = pathlib.Path(sys.argv[1])
-config_path.write_text(
-    json.dumps(
-        {
-            "email": sys.argv[2],
-            "username": sys.argv[3],
-            "password": sys.argv[4],
-            "mode": sys.argv[5],
-        }
-    ),
-    encoding="utf-8",
-)
-PY
-
-cargo build -p burrow --bin burrow
-
-(
-  cd "$fallback_dir"
-  RUST_LOG="${BURROW_UI_TEST_RUST_LOG:-info,burrow=debug}" \
-  BURROW_SOCKET_PATH="burrow.sock" \
-  BURROW_TAILSCALE_STATE_ROOT="$tailnet_state_root" \
-    "${repo_root}/target/debug/burrow" daemon >"$daemon_log" 2>&1
-) &
-daemon_pid=$!
-
-for _ in $(seq 1 50); do
-  [[ -S "$socket_path" ]] && break
-  sleep 0.2
-done
-
-if [[ ! -S "$socket_path" ]]; then
-  echo "error: Burrow daemon did not create ${socket_path}" >&2
-  [[ -f "$daemon_log" ]] && cat "$daemon_log" >&2
-  exit 1
-fi
-
-common_xcodebuild_args=(
-  -quiet
-  -skipPackagePluginValidation
-  -project "${repo_root}/Apple/Burrow.xcodeproj"
-  -scheme App
-  -configuration Debug
-  -destination "$destination"
-  -derivedDataPath "$derived_data_path"
-  -clonedSourcePackagesDirPath "$source_packages_path"
-  -only-testing:BurrowUITests
-  -parallel-testing-enabled NO
-  -maximum-concurrent-test-simulator-destinations 1
-  -maximum-parallel-testing-workers 1
-  CODE_SIGNING_ALLOWED=NO
-)
-
-xcodebuild \
-  "${common_xcodebuild_args[@]}" \
-  build-for-testing
-
-BURROW_UI_TEST_EMAIL="$ui_test_email" \
-BURROW_UI_TEST_USERNAME="$ui_test_username" \
-BURROW_UI_TEST_PASSWORD="$ui_test_password" \
-BURROW_UI_TEST_CONFIG_PATH="$ui_test_config_path" \
-BURROW_UI_TEST_EPHEMERAL_AUTH=1 \
-xcodebuild \
-  "${common_xcodebuild_args[@]}" \
-  test-without-building
diff --git a/Scripts/run-tailnet-connectivity-smoke.sh b/Scripts/run-tailnet-connectivity-smoke.sh
deleted file mode 100755
index dea2f68..0000000
--- a/Scripts/run-tailnet-connectivity-smoke.sh
+++ /dev/null
@@ -1,186 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-bundle_id="${BURROW_UI_TEST_APP_BUNDLE_ID:-net.burrow.app}"
-smoke_root="${BURROW_TAILNET_SMOKE_ROOT:-/tmp/burrow-tailnet-connectivity}"
-socket_path="${smoke_root}/burrow.sock"
-db_path="${smoke_root}/burrow.db"
-daemon_log="${BURROW_TAILNET_SMOKE_DAEMON_LOG:-${smoke_root}/daemon.log}"
-payload_path="${smoke_root}/tailnet.json"
-authority="${BURROW_TAILNET_SMOKE_AUTHORITY:-https://ts.burrow.net}"
-account_name="${BURROW_TAILNET_SMOKE_ACCOUNT:-ui-test}"
-identity_name="${BURROW_TAILNET_SMOKE_IDENTITY:-apple}"
-hostname="${BURROW_TAILNET_SMOKE_HOSTNAME:-burrow-apple}"
-message="${BURROW_TAILNET_SMOKE_MESSAGE:-burrow-tailnet-smoke}"
-timeout_ms="${BURROW_TAILNET_SMOKE_TIMEOUT_MS:-8000}"
-remote_ip="${BURROW_TAILNET_SMOKE_REMOTE_IP:-}"
-remote_port="${BURROW_TAILNET_SMOKE_REMOTE_PORT:-18081}"
-remote_hostname="${BURROW_TAILNET_SMOKE_REMOTE_HOSTNAME:-burrow-echo}"
-remote_authkey="${BURROW_TAILNET_SMOKE_REMOTE_AUTHKEY:-}"
-helper_bin="${BURROW_TAILNET_SMOKE_HELPER_BIN:-${smoke_root}/tailscale-login-bridge}"
-remote_state_root="${BURROW_TAILNET_SMOKE_REMOTE_STATE_ROOT:-${smoke_root}/remote-state}"
-remote_stdout="${smoke_root}/remote-helper.stdout"
-remote_stderr="${BURROW_TAILNET_SMOKE_REMOTE_LOG:-${smoke_root}/remote-helper.log}"
-
-if [[ -n "${TS_AUTHKEY:-}" ]]; then
-  default_tailnet_state_root="${smoke_root}/local-state"
-else
-  default_tailnet_state_root="/tmp/${bundle_id}/SimulatorTailnetState"
-fi
-tailnet_state_root="${BURROW_TAILNET_STATE_ROOT:-${default_tailnet_state_root}}"
-
-need_login=0
-if [[ -z "${TS_AUTHKEY:-}" ]] && { [[ ! -d "$tailnet_state_root" ]] || [[ -z "$(find "$tailnet_state_root" -mindepth 1 -maxdepth 2 -print -quit 2>/dev/null)" ]]; }; then
-  need_login=1
-fi
-
-if [[ "$need_login" -eq 1 ]]; then
-  echo "Tailnet state root is empty; running iOS login bootstrap first..."
-  "${repo_root}/Scripts/run-ios-tailnet-ui-tests.sh"
-fi
-
-rm -rf "$smoke_root"
-mkdir -p "$smoke_root"
-
-cleanup() {
-  rm -f "$payload_path"
-  if [[ -n "${daemon_pid:-}" ]]; then
-    kill "$daemon_pid" >/dev/null 2>&1 || true
-    wait "$daemon_pid" >/dev/null 2>&1 || true
-  fi
-  if [[ -n "${remote_pid:-}" ]]; then
-    kill "$remote_pid" >/dev/null 2>&1 || true
-    wait "$remote_pid" >/dev/null 2>&1 || true
-  fi
-}
-trap cleanup EXIT
-
-wait_for_helper_listen() {
-  python3 - <<'PY' "$1"
-import json
-import pathlib
-import sys
-import time
-
-path = pathlib.Path(sys.argv[1])
-deadline = time.time() + 20
-while time.time() < deadline:
-    if path.exists():
-        with path.open("r", encoding="utf-8") as handle:
-            line = handle.readline().strip()
-        if line:
-            hello = json.loads(line)
-            print(hello["listen_addr"])
-            raise SystemExit(0)
-    time.sleep(0.1)
-raise SystemExit("timed out waiting for helper startup line")
-PY
-}
-
-wait_for_helper_ip() {
-  python3 - <<'PY' "$1"
-import json
-import sys
-import time
-import urllib.request
-
-url = sys.argv[1]
-deadline = time.time() + 30
-while time.time() < deadline:
-    with urllib.request.urlopen(url, timeout=5) as response:
-        status = json.load(response)
-    if status.get("running") and status.get("tailscale_ips"):
-        print(status["tailscale_ips"][0])
-        raise SystemExit(0)
-    time.sleep(0.25)
-raise SystemExit("timed out waiting for helper to become ready")
-PY
-}
-
-python3 - <<'PY' "$payload_path" "$authority" "$account_name" "$identity_name" "$hostname"
-import json
-import pathlib
-import sys
-
-path = pathlib.Path(sys.argv[1])
-payload = {
-    "authority": sys.argv[2],
-    "account": sys.argv[3],
-    "identity": sys.argv[4],
-    "hostname": sys.argv[5],
-}
-path.write_text(json.dumps(payload, indent=2) + "\n", encoding="utf-8")
-PY
-
-cargo build -p burrow --bin burrow
-(
-  cd "${repo_root}/Tools/tailscale-login-bridge"
-  GOWORK=off go build -o "$helper_bin" .
-)
-
-if [[ -z "$remote_ip" ]]; then
-  if [[ -z "$remote_authkey" ]] && { [[ ! -d "$remote_state_root" ]] || [[ -z "$(find "$remote_state_root" -mindepth 1 -maxdepth 1 -print -quit 2>/dev/null)" ]]; }; then
-    echo "error: set BURROW_TAILNET_SMOKE_REMOTE_IP, BURROW_TAILNET_SMOKE_REMOTE_AUTHKEY, or BURROW_TAILNET_SMOKE_REMOTE_STATE_ROOT to an existing logged-in helper state" >&2
-    exit 1
-  fi
-
-  if [[ -n "$remote_authkey" ]]; then
-    rm -rf "$remote_state_root"
-    mkdir -p "$remote_state_root"
-  fi
-
-  (
-    cd "$repo_root"
-    if [[ -n "$remote_authkey" ]]; then
-      export TS_AUTHKEY="$remote_authkey"
-    fi
-    "$helper_bin" \
-      --listen 127.0.0.1:0 \
-      --state-dir "$remote_state_root" \
-      --hostname "$remote_hostname" \
-      --control-url "$authority" \
-      --udp-echo-port "$remote_port" \
-      >"$remote_stdout" 2>"$remote_stderr"
-  ) &
-  remote_pid=$!
-
-  remote_listen_addr="$(wait_for_helper_listen "$remote_stdout")"
-  remote_ip="$(wait_for_helper_ip "http://${remote_listen_addr}/status")"
-fi
-
-(
-  cd "$smoke_root"
-  RUST_LOG="${BURROW_TAILNET_SMOKE_RUST_LOG:-info,burrow=debug}" \
-  BURROW_SOCKET_PATH="$socket_path" \
-  BURROW_TAILSCALE_STATE_ROOT="$tailnet_state_root" \
-    "${repo_root}/target/debug/burrow" daemon >"$daemon_log" 2>&1
-) &
-daemon_pid=$!
-
-for _ in $(seq 1 50); do
-  [[ -S "$socket_path" ]] && break
-  sleep 0.2
-done
-
-if [[ ! -S "$socket_path" ]]; then
-  echo "error: Burrow daemon did not create ${socket_path}" >&2
-  [[ -f "$daemon_log" ]] && cat "$daemon_log" >&2
-  exit 1
-fi
-
-run_burrow() {
-  BURROW_SOCKET_PATH="$socket_path" \
-  BURROW_TAILSCALE_STATE_ROOT="$tailnet_state_root" \
-    "${repo_root}/target/debug/burrow" "$@"
-}
-
-run_burrow network-add 1 1 "$payload_path"
-run_burrow start
-run_burrow tunnel-config
-run_burrow tailnet-udp-echo "${remote_ip}:${remote_port}" --message "$message" --timeout-ms "$timeout_ms"
-
-echo
-echo "Tailnet connectivity smoke passed."
-echo "State root: $tailnet_state_root"
-echo "Remote: ${remote_ip}:${remote_port}"
diff --git a/Scripts/seal-forgejo-nsc-secrets.sh b/Scripts/seal-forgejo-nsc-secrets.sh
deleted file mode 100755
index a6b3918..0000000
--- a/Scripts/seal-forgejo-nsc-secrets.sh
+++ /dev/null
@@ -1,112 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/seal-forgejo-nsc-secrets.sh [options]
-
-Encrypt Burrow forgejo-nsc runtime inputs from intake/ into the agenix secrets
-consumed by burrow-forge.
-
-Options:
-  --provision            Re-render the local intake files before sealing.
-  --host <user@host>     SSH target forwarded to provision-forgejo-nsc.sh.
-  --ssh-key <path>       SSH private key forwarded to provision-forgejo-nsc.sh.
-  --nsc-bin <path>       Override the nsc binary for provisioning.
-  -h, --help             Show this help text.
-EOF
-}
-
-PROVISION=0
-HOST="${BURROW_FORGE_HOST:-root@git.burrow.net}"
-SSH_KEY="${BURROW_FORGE_SSH_KEY:-${REPO_ROOT}/intake/agent_at_burrow_net_ed25519}"
-NSC_BIN="${NSC_BIN:-}"
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --provision)
-      PROVISION=1
-      shift
-      ;;
-    --host)
-      HOST="${2:?missing value for --host}"
-      shift 2
-      ;;
-    --ssh-key)
-      SSH_KEY="${2:?missing value for --ssh-key}"
-      shift 2
-      ;;
-    --nsc-bin)
-      NSC_BIN="${2:?missing value for --nsc-bin}"
-      shift 2
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "unknown option: $1" >&2
-      usage >&2
-      exit 64
-      ;;
-  esac
-done
-
-require_cmd() {
-  if ! command -v "$1" >/dev/null 2>&1; then
-    echo "missing required command: $1" >&2
-    exit 1
-  fi
-}
-
-require_cmd age
-require_cmd nix
-require_cmd python3
-
-if [[ "${PROVISION}" -eq 1 ]]; then
-  provision_args=(--host "${HOST}" --ssh-key "${SSH_KEY}")
-  if [[ -n "${NSC_BIN}" ]]; then
-    provision_args+=(--nsc-bin "${NSC_BIN}")
-  fi
-  "${SCRIPT_DIR}/provision-forgejo-nsc.sh" "${provision_args[@]}"
-fi
-
-tmpdir="$(mktemp -d)"
-cleanup() {
-  rm -rf "${tmpdir}"
-}
-trap cleanup EXIT
-
-seal_secret() {
-  local target="$1"
-  local source_path="$2"
-  recipients_file="${tmpdir}/$(basename "${target}").recipients"
-  if [[ ! -s "${source_path}" ]]; then
-    echo "required runtime input missing or empty: ${source_path}" >&2
-    exit 1
-  fi
-  nix eval --impure --json --expr "let s = import ${REPO_ROOT}/secrets.nix; in s.\"${target}\".publicKeys" \
-    | python3 -c 'import json, sys; [print(item) for item in json.load(sys.stdin)]' \
-    > "${recipients_file}"
-
-  age -R "${recipients_file}" -o "${REPO_ROOT}/${target}" "${source_path}"
-}
-
-seal_secret "secrets/infra/forgejo-nsc-token.age" "${REPO_ROOT}/intake/forgejo_nsc_token.txt"
-seal_secret "secrets/infra/forgejo-nsc-dispatcher-config.age" "${REPO_ROOT}/intake/forgejo_nsc_dispatcher.yaml"
-seal_secret "secrets/infra/forgejo-nsc-autoscaler-config.age" "${REPO_ROOT}/intake/forgejo_nsc_autoscaler.yaml"
-
-chmod 600 \
-  "${REPO_ROOT}/secrets/infra/forgejo-nsc-token.age" \
-  "${REPO_ROOT}/secrets/infra/forgejo-nsc-dispatcher-config.age" \
-  "${REPO_ROOT}/secrets/infra/forgejo-nsc-autoscaler-config.age"
-
-echo "Sealed forgejo-nsc runtime inputs into:"
-printf '  %s\n' \
-  "${REPO_ROOT}/secrets/infra/forgejo-nsc-token.age" \
-  "${REPO_ROOT}/secrets/infra/forgejo-nsc-dispatcher-config.age" \
-  "${REPO_ROOT}/secrets/infra/forgejo-nsc-autoscaler-config.age"
-echo "Deploy burrow-forge to apply the new CI credentials."
diff --git a/Scripts/seal-release-secrets.sh b/Scripts/seal-release-secrets.sh
deleted file mode 100755
index 86281ee..0000000
--- a/Scripts/seal-release-secrets.sh
+++ /dev/null
@@ -1,261 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-
-usage() {
-  cat <<'EOF'
-Usage: Scripts/seal-release-secrets.sh [--source-dir <dir>] [--only <secret>]
-
-Encrypt Burrow release inputs into the agenix secrets consumed by CI.
-
-Expected files in --source-dir (default: intake/release):
-  appstore-key-id.txt
-  appstore-key-issuer-id.txt
-  appstore-key.p8
-  distribution-cert.p12
-  distribution-cert-password.txt
-  sparkle-eddsa.key
-
-Pre-composed appstore-connect.env, distribution-signing.env, and sparkle.env
-files are also accepted.
-
-Provisioning profiles are synced from App Store Connect credentials in CI.
-The temporary keychain password is always the distribution certificate password.
-
-Secrets:
-  all
-  appstore-connect
-  distribution-signing
-  sparkle
-EOF
-}
-
-SOURCE_DIR="${BURROW_RELEASE_SECRET_SOURCE_DIR:-${REPO_ROOT}/intake/release}"
-ONLY="all"
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --source-dir)
-      SOURCE_DIR="${2:?missing value for --source-dir}"
-      shift 2
-      ;;
-    --only)
-      ONLY="${2:?missing value for --only}"
-      shift 2
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "unknown option: $1" >&2
-      usage >&2
-      exit 64
-      ;;
-  esac
-done
-
-case "$ONLY" in
-  all|appstore-connect|app-store|appstore|distribution-signing|apple-signing|sparkle) ;;
-  *)
-    echo "unknown release secret selector: $ONLY" >&2
-    usage >&2
-    exit 64
-    ;;
-esac
-
-require_cmd() {
-  if ! command -v "$1" >/dev/null 2>&1; then
-    echo "missing required command: $1" >&2
-    exit 1
-  fi
-}
-
-require_cmd age
-require_cmd nix
-require_cmd python3
-
-if [[ ! -d "$SOURCE_DIR" ]]; then
-  echo "release secret source directory does not exist: $SOURCE_DIR" >&2
-  exit 1
-fi
-
-tmpdir="$(mktemp -d)"
-cleanup() {
-  rm -rf "$tmpdir"
-}
-trap cleanup EXIT
-
-seal_secret() {
-  local target="$1"
-  local source_path="$2"
-  local required="${3:-required}"
-  local recipients_file="${tmpdir}/$(basename "${target}").recipients"
-
-  if [[ ! -s "$source_path" ]]; then
-    if [[ "$required" == "optional" ]]; then
-      return 0
-    fi
-    echo "required release secret source missing or empty: $source_path" >&2
-    exit 1
-  fi
-
-  mkdir -p "${REPO_ROOT}/$(dirname "$target")"
-  nix eval --impure --json --expr "let s = import ${REPO_ROOT}/secrets.nix; in s.\"${target}\".publicKeys" \
-    | python3 -c 'import json, sys; [print(item) for item in json.load(sys.stdin)]' \
-    > "$recipients_file"
-
-  age -R "$recipients_file" -o "${REPO_ROOT}/${target}" "$source_path"
-  chmod 600 "${REPO_ROOT}/${target}"
-  echo "Sealed ${target}"
-}
-
-base64_file() {
-  python3 -c 'import base64, pathlib, sys; print(base64.b64encode(pathlib.Path(sys.argv[1]).read_bytes()).decode())' "$1"
-}
-
-read_secret_text() {
-  python3 -c 'import pathlib, sys; sys.stdout.write(pathlib.Path(sys.argv[1]).read_text().strip())' "$1"
-}
-
-base64_text() {
-  python3 -c 'import base64, sys; print(base64.b64encode(sys.stdin.buffer.read()).decode())'
-}
-
-reject_placeholder() {
-  local path="$1"
-  if grep -Eq '^(TODO|PASTE_|REPLACE_|#)' "$path"; then
-    echo "intake file still contains placeholder text: $path" >&2
-    exit 1
-  fi
-}
-
-reject_placeholder_text() {
-  local path="$1"
-  if grep -Iq . "$path"; then
-    reject_placeholder "$path"
-  fi
-}
-
-first_existing() {
-  local path
-  for path in "$@"; do
-    if [[ -s "$path" ]]; then
-      printf '%s\n' "$path"
-      return 0
-    fi
-  done
-  return 1
-}
-
-compose_appstore_connect_env() {
-  local direct="${SOURCE_DIR}/appstore-connect.env"
-  if [[ -s "$direct" ]]; then
-    printf '%s\n' "$direct"
-    return 0
-  fi
-
-  local key_id_file="${SOURCE_DIR}/appstore-key-id.txt"
-  local issuer_id_file="${SOURCE_DIR}/appstore-key-issuer-id.txt"
-  local key_file="${SOURCE_DIR}/appstore-key.p8"
-  if [[ ! -s "$key_file" ]]; then
-    echo "required App Store Connect source missing or empty: appstore-key.p8" >&2
-    exit 1
-  fi
-  for path in "$key_id_file" "$issuer_id_file" "$key_file"; do
-    if [[ ! -s "$path" ]]; then
-      echo "required App Store Connect source missing or empty: $path" >&2
-      exit 1
-    fi
-    reject_placeholder_text "$path"
-  done
-
-  local out="${tmpdir}/appstore-connect.env"
-  {
-    printf 'ASC_API_KEY_ID=%s\n' "$(read_secret_text "$key_id_file")"
-    printf 'ASC_API_ISSUER_ID=%s\n' "$(read_secret_text "$issuer_id_file")"
-    printf 'ASC_API_KEY_BASE64=%s\n' "$(base64_file "$key_file")"
-  } > "$out"
-  printf '%s\n' "$out"
-}
-
-compose_distribution_signing_env() {
-  local direct="${SOURCE_DIR}/distribution-signing.env"
-  if [[ -s "$direct" ]]; then
-    printf '%s\n' "$direct"
-    return 0
-  fi
-
-  local cert_file
-  cert_file="${SOURCE_DIR}/distribution-cert.p12"
-  local password_file="${SOURCE_DIR}/distribution-cert-password.txt"
-  if [[ ! -s "$cert_file" ]]; then
-    echo "required distribution signing source missing or empty: distribution-cert.p12" >&2
-    exit 1
-  fi
-  for path in "$password_file"; do
-    if [[ ! -s "$path" ]]; then
-      echo "required distribution signing source missing or empty: $path" >&2
-      exit 1
-    fi
-    reject_placeholder_text "$path"
-  done
-
-  local out="${tmpdir}/distribution-signing.env"
-  {
-    printf 'APPLE_SIGNING_CERTIFICATE_BASE64=%s\n' "$(base64_file "$cert_file")"
-    printf 'APPLE_SIGNING_CERTIFICATE_PASSWORD_BASE64=%s\n' "$(read_secret_text "$password_file" | base64_text)"
-  } > "$out"
-  printf '%s\n' "$out"
-}
-
-compose_sparkle_env() {
-  local direct="${SOURCE_DIR}/sparkle.env"
-  if [[ -s "$direct" ]]; then
-    printf '%s\n' "$direct"
-    return 0
-  fi
-
-  local key_file
-  key_file="${SOURCE_DIR}/sparkle-eddsa.key"
-  if [[ ! -s "$key_file" ]]; then
-    return 1
-  fi
-  reject_placeholder_text "$key_file"
-
-  local out="${tmpdir}/sparkle.env"
-  printf 'SPARKLE_EDDSA_KEY_BASE64=%s\n' "$(base64_file "$key_file")" > "$out"
-  printf '%s\n' "$out"
-}
-
-case "$ONLY" in
-  all)
-    appstore_env="$(compose_appstore_connect_env)"
-    seal_secret "secrets/apple/appstore-connect.env.age" "$appstore_env"
-    distribution_env="$(compose_distribution_signing_env)"
-    seal_secret "secrets/apple/distribution-signing.env.age" "$distribution_env"
-    if sparkle_env="$(compose_sparkle_env)"; then
-      seal_secret "secrets/apple/sparkle.env.age" "$sparkle_env"
-    fi
-    ;;
-  appstore-connect|app-store|appstore)
-    appstore_env="$(compose_appstore_connect_env)"
-    seal_secret "secrets/apple/appstore-connect.env.age" "$appstore_env"
-    ;;
-  distribution-signing|apple-signing)
-    distribution_env="$(compose_distribution_signing_env)"
-    seal_secret "secrets/apple/distribution-signing.env.age" "$distribution_env"
-    ;;
-  sparkle)
-    if sparkle_env="$(compose_sparkle_env)"; then
-      seal_secret "secrets/apple/sparkle.env.age" "$sparkle_env"
-    else
-      echo "required Sparkle source missing or empty: sparkle-eddsa.key" >&2
-      exit 1
-    fi
-    ;;
-esac
-
-echo "Release secrets are sealed. Commit the .age files and deploy/use CI with an authorized age identity."
diff --git a/Scripts/sparkle/sign-appcast-kms.py b/Scripts/sparkle/sign-appcast-kms.py
deleted file mode 100755
index 0e22c7c..0000000
--- a/Scripts/sparkle/sign-appcast-kms.py
+++ /dev/null
@@ -1,149 +0,0 @@
-#!/usr/bin/env python3
-"""Sign Sparkle appcast enclosures.
-
-Google Cloud KMS Ed25519 signing can only sign small payloads directly. Sparkle
-requires a standard EdDSA signature over the full update archive, so normal
-release artifacts sign directly from the decrypted release seed.
-"""
-
-from __future__ import annotations
-
-import argparse
-import base64
-import os
-import subprocess
-import sys
-import tempfile
-import urllib.parse
-import xml.etree.ElementTree as ET
-from pathlib import Path
-
-
-SPARKLE_NS = "http://www.andymatuschak.org/xml-namespaces/sparkle"
-DEFAULT_PROJECT = "project-88c23ce9-918a-470a-b33"
-DEFAULT_LOCATION = "global"
-DEFAULT_KEYRING = "burrow-identity"
-DEFAULT_KEY = "sparkle-ed25519"
-DEFAULT_VERSION = "1"
-DEFAULT_KMS_MAX_INPUT_BYTES = 65536
-
-
-def run(command: list[str]) -> subprocess.CompletedProcess[str]:
-    return subprocess.run(command, check=True, text=True, stdout=subprocess.PIPE)
-
-
-def kms_sign(args: argparse.Namespace, payload: Path) -> str:
-    with tempfile.TemporaryDirectory(prefix="burrow-sparkle-kms.") as tmp:
-        signature_path = Path(tmp) / "signature.bin"
-        command = [
-            args.gcloud,
-            "kms",
-            "asymmetric-sign",
-            "--location",
-            args.kms_location,
-            "--keyring",
-            args.kms_keyring,
-            "--key",
-            args.kms_key,
-            "--version",
-            args.kms_version,
-            "--input-file",
-            str(payload),
-            "--signature-file",
-            str(signature_path),
-        ]
-        if args.gcloud_project:
-            command.extend(["--project", args.gcloud_project])
-        run(command)
-        return base64.b64encode(signature_path.read_bytes()).decode("ascii")
-
-
-def read_sparkle_seed(key_path: Path) -> bytes:
-    key_data = key_path.read_bytes().strip()
-    if len(key_data) == 32:
-        return key_data
-    try:
-        decoded = base64.b64decode(key_data, validate=True)
-    except ValueError as exc:
-        raise ValueError(f"Sparkle key is not raw or base64 Ed25519 seed data: {key_path}") from exc
-    if len(decoded) != 32:
-        raise ValueError(f"Sparkle key must decode to a 32-byte Ed25519 seed: {key_path}")
-    return decoded
-
-
-def sign_with_release_seed(args: argparse.Namespace, payload: Path) -> str:
-    key_path = Path(args.ed_key_path) if args.ed_key_path else None
-    if key_path is None or not key_path.is_file():
-        raise FileNotFoundError(
-            "Sparkle artifact is too large for direct Google KMS Ed25519 signing "
-            "and SPARKLE_EDDSA_KEY_PATH does not point to a key file"
-        )
-    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
-
-    seed = read_sparkle_seed(key_path)
-    signature = Ed25519PrivateKey.from_private_bytes(seed).sign(payload.read_bytes())
-    return base64.b64encode(signature).decode("ascii")
-
-
-def sparkle_signature(args: argparse.Namespace, payload: Path) -> str:
-    if args.ed_key_path:
-        return sign_with_release_seed(args, payload)
-    if payload.stat().st_size <= args.kms_max_input_bytes:
-        return kms_sign(args, payload)
-    return sign_with_release_seed(args, payload)
-
-
-def enclosure_path(enclosure: ET.Element, artifact_dir: Path) -> Path:
-    url = enclosure.attrib.get("url")
-    if not url:
-        raise ValueError("Sparkle enclosure is missing a url attribute")
-    parsed = urllib.parse.urlparse(url)
-    name = Path(parsed.path).name
-    if not name:
-        raise ValueError(f"Sparkle enclosure URL has no file name: {url}")
-    path = artifact_dir / name
-    if not path.is_file():
-        raise FileNotFoundError(f"Sparkle enclosure artifact not found: {path}")
-    return path
-
-
-def sign_appcast(args: argparse.Namespace) -> None:
-    appcast = Path(args.appcast)
-    artifact_dir = Path(args.artifact_dir) if args.artifact_dir else appcast.parent
-    ET.register_namespace("sparkle", SPARKLE_NS)
-    tree = ET.parse(appcast)
-    root = tree.getroot()
-    enclosures = root.findall(".//enclosure")
-    if not enclosures:
-        raise ValueError(f"no Sparkle enclosures found in {appcast}")
-
-    for enclosure in enclosures:
-        artifact = enclosure_path(enclosure, artifact_dir)
-        enclosure.attrib[f"{{{SPARKLE_NS}}}edSignature"] = sparkle_signature(args, artifact)
-
-    tree.write(appcast, encoding="utf-8", xml_declaration=True)
-    print(f"signed {len(enclosures)} enclosure(s) in {appcast}")
-
-
-def parse_args(argv: list[str]) -> argparse.Namespace:
-    parser = argparse.ArgumentParser(description="Sign Sparkle appcast enclosures with Google Cloud KMS.")
-    parser.add_argument("--appcast", required=True)
-    parser.add_argument("--artifact-dir")
-    parser.add_argument("--gcloud-project", default=os.environ.get("GOOGLE_CLOUD_PROJECT") or os.environ.get("BURROW_GOOGLE_PROJECT_ID") or DEFAULT_PROJECT)
-    parser.add_argument("--kms-location", default=os.environ.get("BURROW_KMS_LOCATION", DEFAULT_LOCATION))
-    parser.add_argument("--kms-keyring", default=os.environ.get("BURROW_KMS_KEYRING", DEFAULT_KEYRING))
-    parser.add_argument("--kms-key", default=os.environ.get("BURROW_SPARKLE_KMS_KEY", DEFAULT_KEY))
-    parser.add_argument("--kms-version", default=os.environ.get("BURROW_SPARKLE_KMS_VERSION", DEFAULT_VERSION))
-    parser.add_argument("--kms-max-input-bytes", type=int, default=DEFAULT_KMS_MAX_INPUT_BYTES)
-    parser.add_argument("--gcloud", default=os.environ.get("GCLOUD", "gcloud"))
-    parser.add_argument("--ed-key-path", default=os.environ.get("SPARKLE_EDDSA_KEY_PATH"))
-    return parser.parse_args(argv)
-
-
-def main(argv: list[str]) -> int:
-    sign_appcast(parse_args(argv))
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main(sys.argv[1:]))
diff --git a/Scripts/sync-forgejo-nsc-config.sh b/Scripts/sync-forgejo-nsc-config.sh
deleted file mode 100755
index 2ce7114..0000000
--- a/Scripts/sync-forgejo-nsc-config.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-echo "Scripts/sync-forgejo-nsc-config.sh is obsolete." >&2
-echo "Burrow forgejo-nsc now consumes agenix-backed secrets instead of host-local intake files." >&2
-echo "Use Scripts/seal-forgejo-nsc-secrets.sh and deploy burrow-forge." >&2
-exit 1
diff --git a/Scripts/version.sh b/Scripts/version.sh
deleted file mode 100755
index 60b8544..0000000
--- a/Scripts/version.sh
+++ /dev/null
@@ -1,147 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-burrow_user="${USER:-${LOGNAME:-runner}}"
-export PATH="$PATH:/opt/homebrew/bin:/usr/local/bin:/etc/profiles/per-user/${burrow_user}/bin"
-
-cd "$(dirname "${BASH_SOURCE[0]}")/.."
-
-TAG_PREFIX="builds/"
-DEFAULT_VERSION_REMOTE="origin"
-if git remote get-url forgejo >/dev/null 2>&1; then
-  DEFAULT_VERSION_REMOTE="forgejo"
-fi
-VERSION_REMOTE="${BURROW_VERSION_REMOTE:-$DEFAULT_VERSION_REMOTE}"
-VERSION_REQUIRE_REMOTE="${BURROW_VERSION_REQUIRE_REMOTE:-false}"
-COMMAND="${1:-}"
-
-truthy() {
-  case "$1" in
-    1|true|TRUE|True|yes|YES|Yes|y|Y|on|ON|On) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-list_local_build_tags() {
-  git tag -l "${TAG_PREFIX}[0-9]*"
-}
-
-latest_local_build_tag() {
-  list_local_build_tags | sort -n -t'/' -k2 | tail -n 1
-}
-
-latest_remote_build_record() {
-  local raw rc=0
-  raw="$(git ls-remote --tags --refs "$VERSION_REMOTE" "refs/tags/${TAG_PREFIX}[0-9]*" 2>/dev/null)" || rc=$?
-  if [[ $rc -ne 0 ]]; then
-    return $rc
-  fi
-  if [[ -z "$raw" ]]; then
-    return 0
-  fi
-  printf '%s\n' "$raw" | awk -F'\t' -v prefix="refs/tags/${TAG_PREFIX}" '
-    $2 ~ ("^" prefix "[0-9]+$") {
-      build = $2
-      sub("^refs/tags/", "", build)
-      print build "\t" $1
-    }
-  ' | sort -n -t'/' -k2 | tail -n 1
-}
-
-resolve_build_state() {
-  local remote_record local_latest remote_status=0
-  BUILD_STATE_SOURCE="local"
-  LATEST_BUILD=""
-  LATEST_BUILD_COMMIT=""
-
-  remote_record="$(latest_remote_build_record)" || remote_status=$?
-  if [[ $remote_status -eq 0 ]]; then
-    BUILD_STATE_SOURCE="remote"
-    if [[ -n "$remote_record" ]]; then
-      LATEST_BUILD="$(printf '%s\n' "$remote_record" | cut -f1)"
-      LATEST_BUILD_COMMIT="$(printf '%s\n' "$remote_record" | cut -f2)"
-    fi
-  else
-    if truthy "$VERSION_REQUIRE_REMOTE"; then
-      echo "error: unable to resolve authoritative build tags from ${VERSION_REMOTE}" >&2
-      exit "$remote_status"
-    fi
-    echo "warning: unable to resolve authoritative build tags from ${VERSION_REMOTE}; falling back to local tags" >&2
-    local_latest="$(latest_local_build_tag)"
-    if [[ -n "$local_latest" ]]; then
-      LATEST_BUILD="$local_latest"
-      LATEST_BUILD_COMMIT="$(git rev-parse -q --verify "refs/tags/${LATEST_BUILD}^{commit}" 2>/dev/null || true)"
-    fi
-  fi
-
-  if [[ -z "$LATEST_BUILD" ]]; then
-    LATEST_BUILD_NUMBER="0"
-  else
-    LATEST_BUILD_NUMBER="${LATEST_BUILD#$TAG_PREFIX}"
-  fi
-}
-
-resolve_build_state
-
-HEAD_COMMIT="$(git rev-parse HEAD)"
-
-ANCESTRY_STATE="ok"
-if [[ -n "${LATEST_BUILD_NUMBER}" && "${LATEST_BUILD_NUMBER}" != "0" ]]; then
-  if [[ -n "${LATEST_BUILD_COMMIT}" ]] && git cat-file -e "${LATEST_BUILD_COMMIT}^{commit}" 2>/dev/null; then
-    if ! git merge-base --is-ancestor "${LATEST_BUILD_COMMIT}" HEAD; then
-      ANCESTRY_STATE="not-descended"
-      if [[ "$COMMAND" != "status" ]]; then
-        echo "error: HEAD is not descended from build ${LATEST_BUILD_NUMBER}" >&2
-        exit 1
-      fi
-    fi
-  else
-    ANCESTRY_STATE="missing-tag-commit"
-    echo "notice: skipping build ancestry check (missing ${LATEST_BUILD} commit, likely shallow checkout)" >&2
-  fi
-fi
-
-BUILD_NUMBER="$LATEST_BUILD_NUMBER"
-
-if [[ "$COMMAND" == "increment" || "$COMMAND" == "pre-increment" ]]; then
-  if [[ -n "${BURROW_BUILD_NUMBER_OVERRIDE:-}" ]]; then
-    if [[ ! "${BURROW_BUILD_NUMBER_OVERRIDE}" =~ ^[0-9]+$ ]]; then
-      echo "error: BURROW_BUILD_NUMBER_OVERRIDE must be an integer" >&2
-      exit 1
-    fi
-    if (( BURROW_BUILD_NUMBER_OVERRIDE <= LATEST_BUILD_NUMBER )); then
-      echo "error: BURROW_BUILD_NUMBER_OVERRIDE must be greater than ${LATEST_BUILD_NUMBER}" >&2
-      exit 1
-    fi
-    NEW_BUILD_NUMBER="${BURROW_BUILD_NUMBER_OVERRIDE}"
-  else
-    NEW_BUILD_NUMBER=$((LATEST_BUILD_NUMBER + 1))
-  fi
-  NEW_TAG="$TAG_PREFIX$NEW_BUILD_NUMBER"
-  BUILD_NUMBER="$NEW_BUILD_NUMBER"
-fi
-
-if [[ "$COMMAND" == "increment" ]]; then
-  git tag "$NEW_TAG"
-  git push --quiet "$VERSION_REMOTE" "$NEW_TAG"
-fi
-
-CONFIG_PATH="Apple/Configuration/Version.xcconfig"
-if [[ "$COMMAND" != "status" && -f "$CONFIG_PATH" ]]; then
-  current_config_version="$(sed -n 's/^[[:space:]]*CURRENT_PROJECT_VERSION[[:space:]]*=[[:space:]]*//p' "$CONFIG_PATH" 2>/dev/null | tail -n 1 || true)"
-  if [[ "$current_config_version" != "$BUILD_NUMBER" ]]; then
-    echo "CURRENT_PROJECT_VERSION = $BUILD_NUMBER" > "$CONFIG_PATH"
-  fi
-  git update-index --assume-unchanged "$CONFIG_PATH" 2>/dev/null || true
-fi
-
-if [[ "$COMMAND" == "status" ]]; then
-  if [[ "${ANCESTRY_STATE}" == "ok" && "${LATEST_BUILD_NUMBER}" != "0" && -n "${LATEST_BUILD_COMMIT}" && "${HEAD_COMMIT}" == "${LATEST_BUILD_COMMIT}" ]]; then
-    echo "clean"
-  else
-    echo "dirty"
-  fi
-  exit 0
-fi
-
-echo "$BUILD_NUMBER"
diff --git a/Tools/forwardemail-custom-s3.sh b/Tools/forwardemail-custom-s3.sh
deleted file mode 100755
index 5f39ddd..0000000
--- a/Tools/forwardemail-custom-s3.sh
+++ /dev/null
@@ -1,171 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-umask 077
-
-usage() {
-  cat <<'EOF'
-Usage:
-  Tools/forwardemail-custom-s3.sh \
-    --domain burrow.net \
-    --api-token-file intake/forwardemail_api_token.txt \
-    --s3-endpoint https://<endpoint> \
-    --s3-region <region> \
-    --s3-bucket <bucket> \
-    --s3-access-key-file intake/hetzner-s3-user.txt \
-    --s3-secret-key-file intake/hetzner-s3-secret.txt
-
-Options:
-  --domain <domain>                 Forward Email domain to update.
-  --api-token-file <path>           File containing the Forward Email API token.
-  --s3-endpoint <url>               S3-compatible endpoint URL.
-  --s3-region <region>              S3 region string expected by Forward Email.
-  --s3-bucket <name>                Bucket used for alias backup uploads.
-  --s3-access-key-file <path>       File containing the S3 access key id.
-  --s3-secret-key-file <path>       File containing the S3 secret access key.
-  --test-only                       Skip the update call and only test the saved connection.
-  --help                            Show this help text.
-
-Notes:
-  - Secrets are passed to curl through a temporary config file to avoid putting
-    them in the process list.
-  - By default the script updates the domain settings and then calls
-    /test-s3-connection.
-  - For Hetzner Object Storage, use the regional S3 endpoint such as
-    https://hel1.your-objectstorage.com, not an account alias endpoint.
-EOF
-}
-
-fail() {
-  printf 'error: %s\n' "$*" >&2
-  exit 1
-}
-
-require_file() {
-  local path="$1"
-  [[ -f "$path" ]] || fail "missing file: $path"
-}
-
-read_secret() {
-  local path="$1"
-  local value
-  value="$(tr -d '\r\n' < "$path")"
-  [[ -n "$value" ]] || fail "empty secret file: $path"
-  printf '%s' "$value"
-}
-
-domain=""
-api_token_file=""
-s3_endpoint=""
-s3_region=""
-s3_bucket=""
-s3_access_key_file=""
-s3_secret_key_file=""
-test_only=false
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --domain)
-      domain="${2:-}"
-      shift 2
-      ;;
-    --api-token-file)
-      api_token_file="${2:-}"
-      shift 2
-      ;;
-    --s3-endpoint)
-      s3_endpoint="${2:-}"
-      shift 2
-      ;;
-    --s3-region)
-      s3_region="${2:-}"
-      shift 2
-      ;;
-    --s3-bucket)
-      s3_bucket="${2:-}"
-      shift 2
-      ;;
-    --s3-access-key-file)
-      s3_access_key_file="${2:-}"
-      shift 2
-      ;;
-    --s3-secret-key-file)
-      s3_secret_key_file="${2:-}"
-      shift 2
-      ;;
-    --test-only)
-      test_only=true
-      shift
-      ;;
-    --help|-h)
-      usage
-      exit 0
-      ;;
-    *)
-      fail "unknown argument: $1"
-      ;;
-  esac
-done
-
-[[ -n "$domain" ]] || fail "--domain is required"
-[[ -n "$api_token_file" ]] || fail "--api-token-file is required"
-[[ -n "$s3_endpoint" || "$test_only" == true ]] || fail "--s3-endpoint is required unless --test-only is set"
-[[ -n "$s3_region" || "$test_only" == true ]] || fail "--s3-region is required unless --test-only is set"
-[[ -n "$s3_bucket" || "$test_only" == true ]] || fail "--s3-bucket is required unless --test-only is set"
-[[ -n "$s3_access_key_file" || "$test_only" == true ]] || fail "--s3-access-key-file is required unless --test-only is set"
-[[ -n "$s3_secret_key_file" || "$test_only" == true ]] || fail "--s3-secret-key-file is required unless --test-only is set"
-
-require_file "$api_token_file"
-api_token="$(read_secret "$api_token_file")"
-
-if [[ "$test_only" == false ]]; then
-  require_file "$s3_access_key_file"
-  require_file "$s3_secret_key_file"
-  s3_access_key_id="$(read_secret "$s3_access_key_file")"
-  s3_secret_access_key="$(read_secret "$s3_secret_key_file")"
-
-  case "$s3_endpoint" in
-    http://*|https://*)
-      ;;
-    *)
-      fail "--s3-endpoint must start with http:// or https://"
-      ;;
-  esac
-fi
-
-curl_config="$(mktemp)"
-trap 'rm -f "$curl_config"' EXIT
-
-if [[ "$test_only" == false ]]; then
-  cat >"$curl_config" <<EOF
-silent
-show-error
-fail-with-body
-url = "https://api.forwardemail.net/v1/domains/${domain}"
-request = "PUT"
-user = "${api_token}:"
-data = "has_custom_s3=true"
-data-urlencode = "s3_endpoint=${s3_endpoint}"
-data-urlencode = "s3_access_key_id=${s3_access_key_id}"
-data-urlencode = "s3_secret_access_key=${s3_secret_access_key}"
-data-urlencode = "s3_region=${s3_region}"
-data-urlencode = "s3_bucket=${s3_bucket}"
-EOF
-
-  printf 'Configuring Forward Email custom S3 for %s\n' "$domain" >&2
-  curl --config "$curl_config"
-  printf '\n' >&2
-fi
-
-cat >"$curl_config" <<EOF
-silent
-show-error
-fail-with-body
-url = "https://api.forwardemail.net/v1/domains/${domain}/test-s3-connection"
-request = "POST"
-user = "${api_token}:"
-EOF
-
-printf 'Testing Forward Email custom S3 for %s\n' "$domain" >&2
-curl --config "$curl_config"
-printf '\n' >&2
diff --git a/Tools/forwardemail-hetzner-storage.py b/Tools/forwardemail-hetzner-storage.py
deleted file mode 100755
index 3a2a941..0000000
--- a/Tools/forwardemail-hetzner-storage.py
+++ /dev/null
@@ -1,261 +0,0 @@
-#!/usr/bin/env python3
-
-from __future__ import annotations
-
-import argparse
-import datetime as dt
-import hashlib
-import hmac
-import sys
-import textwrap
-from pathlib import Path
-from urllib.parse import urlencode, urlparse
-
-import requests
-
-
-def read_secret(path: str) -> str:
-    value = Path(path).read_text(encoding="utf-8").strip()
-    if not value:
-        raise SystemExit(f"error: empty secret file: {path}")
-    return value
-
-
-def sign(key: bytes, msg: str) -> bytes:
-    return hmac.new(key, msg.encode("utf-8"), hashlib.sha256).digest()
-
-
-def request(
-    *,
-    method: str,
-    endpoint: str,
-    region: str,
-    access_key: str,
-    secret_key: str,
-    bucket: str,
-    query: dict[str, str] | None = None,
-    body: bytes = b"",
-    content_type: str | None = None,
-) -> requests.Response:
-    parsed = urlparse(endpoint)
-    if parsed.scheme != "https":
-        raise SystemExit("error: endpoint must use https")
-
-    host = parsed.netloc
-    canonical_uri = f"/{bucket}"
-    query = query or {}
-    canonical_querystring = urlencode(sorted(query.items()), doseq=True, safe="~")
-
-    now = dt.datetime.now(dt.timezone.utc)
-    amz_date = now.strftime("%Y%m%dT%H%M%SZ")
-    date_stamp = now.strftime("%Y%m%d")
-    payload_hash = hashlib.sha256(body).hexdigest()
-
-    headers = {
-        "host": host,
-        "x-amz-content-sha256": payload_hash,
-        "x-amz-date": amz_date,
-    }
-    if content_type:
-        headers["content-type"] = content_type
-
-    signed_headers = ";".join(sorted(headers.keys()))
-    canonical_headers = "".join(f"{name}:{headers[name]}\n" for name in sorted(headers.keys()))
-    canonical_request = "\n".join(
-        [
-            method,
-            canonical_uri,
-            canonical_querystring,
-            canonical_headers,
-            signed_headers,
-            payload_hash,
-        ]
-    )
-
-    algorithm = "AWS4-HMAC-SHA256"
-    credential_scope = f"{date_stamp}/{region}/s3/aws4_request"
-    string_to_sign = "\n".join(
-        [
-            algorithm,
-            amz_date,
-            credential_scope,
-            hashlib.sha256(canonical_request.encode("utf-8")).hexdigest(),
-        ]
-    )
-
-    k_date = sign(("AWS4" + secret_key).encode("utf-8"), date_stamp)
-    k_region = sign(k_date, region)
-    k_service = sign(k_region, "s3")
-    signing_key = sign(k_service, "aws4_request")
-    signature = hmac.new(signing_key, string_to_sign.encode("utf-8"), hashlib.sha256).hexdigest()
-
-    auth_header = (
-        f"{algorithm} Credential={access_key}/{credential_scope}, "
-        f"SignedHeaders={signed_headers}, Signature={signature}"
-    )
-
-    url = f"{parsed.scheme}://{host}{canonical_uri}"
-    if canonical_querystring:
-      url = f"{url}?{canonical_querystring}"
-
-    response = requests.request(
-        method,
-        url,
-        headers={**headers, "Authorization": auth_header},
-        data=body,
-        timeout=30,
-    )
-    return response
-
-
-def ensure_bucket(args: argparse.Namespace, bucket: str) -> None:
-    head = request(
-        method="HEAD",
-        endpoint=args.endpoint,
-        region=args.region,
-        access_key=args.access_key,
-        secret_key=args.secret_key,
-        bucket=bucket,
-    )
-    if head.status_code == 200:
-        print(f"{bucket}: exists")
-        return
-    if head.status_code != 404:
-        raise SystemExit(f"error: HEAD {bucket} returned {head.status_code}: {head.text[:200]}")
-
-    body = textwrap.dedent(
-        f"""\
-        <?xml version="1.0" encoding="UTF-8"?>
-        <CreateBucketConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-          <LocationConstraint>{args.region}</LocationConstraint>
-        </CreateBucketConfiguration>
-        """
-    ).encode("utf-8")
-    create = request(
-        method="PUT",
-        endpoint=args.endpoint,
-        region=args.region,
-        access_key=args.access_key,
-        secret_key=args.secret_key,
-        bucket=bucket,
-        body=body,
-        content_type="application/xml",
-    )
-    if create.status_code not in (200, 204):
-        raise SystemExit(f"error: PUT {bucket} returned {create.status_code}: {create.text[:200]}")
-    print(f"{bucket}: created")
-
-
-def put_lifecycle(args: argparse.Namespace, bucket: str) -> None:
-    body = textwrap.dedent(
-        f"""\
-        <?xml version="1.0" encoding="UTF-8"?>
-        <LifecycleConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-          <Rule>
-            <ID>expire-forwardemail-backups-after-{args.expire_days}-days</ID>
-            <Status>Enabled</Status>
-            <Filter>
-              <Prefix></Prefix>
-            </Filter>
-            <Expiration>
-              <Days>{args.expire_days}</Days>
-            </Expiration>
-          </Rule>
-        </LifecycleConfiguration>
-        """
-    ).encode("utf-8")
-    response = request(
-        method="PUT",
-        endpoint=args.endpoint,
-        region=args.region,
-        access_key=args.access_key,
-        secret_key=args.secret_key,
-        bucket=bucket,
-        query={"lifecycle": ""},
-        body=body,
-        content_type="application/xml",
-    )
-    if response.status_code not in (200, 204):
-        raise SystemExit(
-            f"error: PUT lifecycle for {bucket} returned {response.status_code}: {response.text[:200]}"
-        )
-    print(f"{bucket}: lifecycle set to {args.expire_days} days")
-
-
-def get_lifecycle(args: argparse.Namespace, bucket: str) -> None:
-    response = request(
-        method="GET",
-        endpoint=args.endpoint,
-        region=args.region,
-        access_key=args.access_key,
-        secret_key=args.secret_key,
-        bucket=bucket,
-        query={"lifecycle": ""},
-    )
-    if response.status_code != 200:
-        raise SystemExit(
-            f"error: GET lifecycle for {bucket} returned {response.status_code}: {response.text[:200]}"
-        )
-    print(f"=== {bucket} lifecycle ===")
-    print(response.text.strip())
-
-
-def parse_args() -> argparse.Namespace:
-    parser = argparse.ArgumentParser(
-        description="Provision Hetzner object-storage buckets for Forward Email backups."
-    )
-    parser.add_argument(
-        "--endpoint",
-        default="https://hel1.your-objectstorage.com",
-        help="Public S3-compatible endpoint URL. For Hetzner, use the regional endpoint, not the account alias.",
-    )
-    parser.add_argument("--region", default="hel1", help="S3 region.")
-    parser.add_argument(
-        "--access-key-file",
-        default="intake/hetzner-s3-user.txt",
-        help="File containing the S3 access key id.",
-    )
-    parser.add_argument(
-        "--secret-key-file",
-        default="intake/hetzner-s3-secret.txt",
-        help="File containing the S3 secret key.",
-    )
-    parser.add_argument(
-        "--bucket",
-        action="append",
-        required=True,
-        help="Bucket to provision. Repeat for multiple buckets.",
-    )
-    parser.add_argument(
-        "--expire-days",
-        type=int,
-        default=90,
-        help="Lifecycle expiry window in days.",
-    )
-    parser.add_argument(
-        "--verify-only",
-        action="store_true",
-        help="Skip create/update and only read the current lifecycle.",
-    )
-    return parser.parse_args()
-
-
-def main() -> None:
-    args = parse_args()
-    args.access_key = read_secret(args.access_key_file)
-    args.secret_key = read_secret(args.secret_key_file)
-
-    for bucket in args.bucket:
-        if args.verify_only:
-            get_lifecycle(args, bucket)
-            continue
-        ensure_bucket(args, bucket)
-        put_lifecycle(args, bucket)
-        get_lifecycle(args, bucket)
-
-
-if __name__ == "__main__":
-    try:
-        main()
-    except requests.RequestException as err:
-        raise SystemExit(f"error: request failed: {err}") from err
diff --git a/Tools/tailscale-login-bridge/go.mod b/Tools/tailscale-login-bridge/go.mod
deleted file mode 100644
index 0e19f33..0000000
--- a/Tools/tailscale-login-bridge/go.mod
+++ /dev/null
@@ -1,66 +0,0 @@
-module burrow.dev/tailscale-login-bridge
-
-go 1.26.1
-
-require tailscale.com v1.96.5
-
-require (
-	filippo.io/edwards25519 v1.2.0 // indirect
-	github.com/akutz/memconn v0.1.0 // indirect
-	github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa // indirect
-	github.com/aws/aws-sdk-go-v2 v1.41.0 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.29.5 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.58 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.27 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.24.14 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 // indirect
-	github.com/aws/smithy-go v1.24.0 // indirect
-	github.com/coder/websocket v1.8.12 // indirect
-	github.com/creachadair/msync v0.7.1 // indirect
-	github.com/dblohm7/wingoes v0.0.0-20240119213807-a09d6be7affa // indirect
-	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
-	github.com/gaissmai/bart v0.26.1 // indirect
-	github.com/go-json-experiment/json v0.0.0-20250813024750-ebf49471dced // indirect
-	github.com/godbus/dbus/v5 v5.1.1-0.20230522191255-76236955d466 // indirect
-	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
-	github.com/google/btree v1.1.3 // indirect
-	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/uuid v1.6.0 // indirect
-	github.com/hdevalence/ed25519consensus v0.2.0 // indirect
-	github.com/huin/goupnp v1.3.0 // indirect
-	github.com/jsimonetti/rtnetlink v1.4.0 // indirect
-	github.com/klauspost/compress v1.18.2 // indirect
-	github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42 // indirect
-	github.com/mdlayher/socket v0.5.0 // indirect
-	github.com/mitchellh/go-ps v1.0.0 // indirect
-	github.com/pires/go-proxyproto v0.8.1 // indirect
-	github.com/prometheus-community/pro-bing v0.4.0 // indirect
-	github.com/safchain/ethtool v0.3.0 // indirect
-	github.com/tailscale/certstore v0.1.1-0.20231202035212-d3fa0460f47e // indirect
-	github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55 // indirect
-	github.com/tailscale/hujson v0.0.0-20221223112325-20486734a56a // indirect
-	github.com/tailscale/peercred v0.0.0-20250107143737-35a0c7bd7edc // indirect
-	github.com/tailscale/web-client-prebuilt v0.0.0-20250124233751-d4cd19a26976 // indirect
-	github.com/tailscale/wireguard-go v0.0.0-20250716170648-1d0488a3d7da // indirect
-	github.com/x448/float16 v0.8.4 // indirect
-	go4.org/mem v0.0.0-20240501181205-ae6ca9944745 // indirect
-	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
-	golang.org/x/crypto v0.46.0 // indirect
-	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
-	golang.org/x/net v0.48.0 // indirect
-	golang.org/x/oauth2 v0.33.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.40.0 // indirect
-	golang.org/x/term v0.38.0 // indirect
-	golang.org/x/text v0.32.0 // indirect
-	golang.org/x/time v0.12.0 // indirect
-	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
-	golang.zx2c4.com/wireguard/windows v0.5.3 // indirect
-	gvisor.dev/gvisor v0.0.0-20260224225140-573d5e7127a8 // indirect
-)
diff --git a/Tools/tailscale-login-bridge/go.sum b/Tools/tailscale-login-bridge/go.sum
deleted file mode 100644
index 5393a62..0000000
--- a/Tools/tailscale-login-bridge/go.sum
+++ /dev/null
@@ -1,229 +0,0 @@
-9fans.net/go v0.0.8-0.20250307142834-96bdba94b63f h1:1C7nZuxUMNz7eiQALRfiqNOm04+m3edWlRff/BYHf0Q=
-9fans.net/go v0.0.8-0.20250307142834-96bdba94b63f/go.mod h1:hHyrZRryGqVdqrknjq5OWDLGCTJ2NeEvtrpR96mjraM=
-filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
-filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
-filippo.io/mkcert v1.4.4 h1:8eVbbwfVlaqUM7OwuftKc2nuYOoTDQWqsoXmzoXZdbc=
-filippo.io/mkcert v1.4.4/go.mod h1:VyvOchVuAye3BoUsPUOOofKygVwLV2KQMVFJNRq+1dA=
-github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
-github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
-github.com/akutz/memconn v0.1.0 h1:NawI0TORU4hcOMsMr11g7vwlCdkYeLKXBcxWu2W/P8A=
-github.com/akutz/memconn v0.1.0/go.mod h1:Jo8rI7m0NieZyLI5e2CDlRdRqRRB4S7Xp77ukDjH+Fw=
-github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI=
-github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
-github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
-github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
-github.com/aws/aws-sdk-go-v2 v1.41.0 h1:tNvqh1s+v0vFYdA1xq0aOJH+Y5cRyZ5upu6roPgPKd4=
-github.com/aws/aws-sdk-go-v2 v1.41.0/go.mod h1:MayyLB8y+buD9hZqkCW3kX1AKq07Y5pXxtgB+rRFhz0=
-github.com/aws/aws-sdk-go-v2/config v1.29.5 h1:4lS2IB+wwkj5J43Tq/AwvnscBerBJtQQ6YS7puzCI1k=
-github.com/aws/aws-sdk-go-v2/config v1.29.5/go.mod h1:SNzldMlDVbN6nWxM7XsUiNXPSa1LWlqiXtvh/1PrJGg=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.58 h1:/d7FUpAPU8Lf2KUdjniQvfNdlMID0Sd9pS23FJ3SS9Y=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.58/go.mod h1:aVYW33Ow10CyMQGFgC0ptMRIqJWvJ4nxZb0sUiuQT/A=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.27 h1:7lOW8NUwE9UZekS1DYoiPdVAqZ6A+LheHWb+mHbNOq8=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.27/go.mod h1:w1BASFIPOPUae7AgaH4SbjNbfdkxuggLyGfNFTn8ITY=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 h1:rgGwPzb82iBYSvHMHXc8h9mRoOUBZIGFgKb9qniaZZc=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16/go.mod h1:L/UxsGeKpGoIj6DxfhOWHWQ/kGKcd4I1VncE4++IyKA=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 h1:1jtGzuV7c82xnqOVfx2F0xmJcOw5374L7N6juGW6x6U=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16/go.mod h1:M2E5OQf+XLe+SZGmmpaI2yy+J326aFf6/+54PoxSANc=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.2 h1:Pg9URiobXy85kgFev3og2CuOZ8JZUBENF+dcgWBaYNk=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.2/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 h1:0ryTNEdJbzUCEWkVXEXoqlXV72J5keC1GvILMOuD00E=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4/go.mod h1:HQ4qwNZh32C3CBeO6iJLQlgtMzqeG17ziAA/3KDJFow=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 h1:oHjJHeUy0ImIV0bsrX0X91GkV5nJAyv1l1CC9lnO0TI=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16/go.mod h1:iRSNGgOYmiYwSCXxXaKb9HfOEj40+oTKn8pTxMlYkRM=
-github.com/aws/aws-sdk-go-v2/service/ssm v1.44.7 h1:a8HvP/+ew3tKwSXqL3BCSjiuicr+XTU2eFYeogV9GJE=
-github.com/aws/aws-sdk-go-v2/service/ssm v1.44.7/go.mod h1:Q7XIWsMo0JcMpI/6TGD6XXcXcV1DbTj6e9BKNntIMIM=
-github.com/aws/aws-sdk-go-v2/service/sso v1.24.14 h1:c5WJ3iHz7rLIgArznb3JCSQT3uUMiz9DLZhIX+1G8ok=
-github.com/aws/aws-sdk-go-v2/service/sso v1.24.14/go.mod h1:+JJQTxB6N4niArC14YNtxcQtwEqzS3o9Z32n7q33Rfs=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.13 h1:f1L/JtUkVODD+k1+IiSJUUv8A++2qVr+Xvb3xWXETMU=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.13/go.mod h1:tvqlFoja8/s0o+UruA1Nrezo/df0PzdunMDDurUfg6U=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 h1:SciGFVNZ4mHdm7gpD1dgZYnCuVdX1s+lFTg4+4DOy70=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.5/go.mod h1:iW40X4QBmUxdP+fZNOpfmkdMZqsovezbAeO+Ubiv2pk=
-github.com/aws/smithy-go v1.24.0 h1:LpilSUItNPFr1eY85RYgTIg5eIEPtvFbskaFcmmIUnk=
-github.com/aws/smithy-go v1.24.0/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
-github.com/axiomhq/hyperloglog v0.0.0-20240319100328-84253e514e02 h1:bXAPYSbdYbS5VTy92NIUbeDI1qyggi+JYh5op9IFlcQ=
-github.com/axiomhq/hyperloglog v0.0.0-20240319100328-84253e514e02/go.mod h1:k08r+Yj1PRAmuayFiRK6MYuR5Ve4IuZtTfxErMIh0+c=
-github.com/cilium/ebpf v0.16.0 h1:+BiEnHL6Z7lXnlGUsXQPPAE7+kenAd4ES8MQ5min0Ok=
-github.com/cilium/ebpf v0.16.0/go.mod h1:L7u2Blt2jMM/vLAVgjxluxtBKlz3/GWjB0dMOEngfwE=
-github.com/coder/websocket v1.8.12 h1:5bUXkEPPIbewrnkU8LTCLVaxi4N4J8ahufH2vlo4NAo=
-github.com/coder/websocket v1.8.12/go.mod h1:LNVeNrXQZfe5qhS9ALED3uA+l5pPqvwXg3CKoDBB2gs=
-github.com/coreos/go-iptables v0.7.1-0.20240112124308-65c67c9f46e6 h1:8h5+bWd7R6AYUslN6c6iuZWTKsKxUFDlpnmilO6R2n0=
-github.com/coreos/go-iptables v0.7.1-0.20240112124308-65c67c9f46e6/go.mod h1:Qe8Bv2Xik5FyTXwgIbLAnv2sWSBmvWdFETJConOQ//Q=
-github.com/creachadair/mds v0.25.9 h1:080Hr8laN2h+l3NeVCGMBpXtIPnl9mz8e4HLraGPqtA=
-github.com/creachadair/mds v0.25.9/go.mod h1:4hatI3hRM+qhzuAmqPRFvaBM8mONkS7nsLxkcuTYUIs=
-github.com/creachadair/msync v0.7.1 h1:SeZmuEBXQPe5GqV/C94ER7QIZPwtvFbeQiykzt/7uho=
-github.com/creachadair/msync v0.7.1/go.mod h1:8CcFlLsSujfHE5wWm19uUBLHIPDAUr6LXDwneVMO008=
-github.com/creachadair/taskgroup v0.13.2 h1:3KyqakBuFsm3KkXi/9XIb0QcA8tEzLHLgaoidf0MdVc=
-github.com/creachadair/taskgroup v0.13.2/go.mod h1:i3V1Zx7H8RjwljUEeUWYT30Lmb9poewSb2XI1yTwD0g=
-github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
-github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
-github.com/dblohm7/wingoes v0.0.0-20240119213807-a09d6be7affa h1:h8TfIT1xc8FWbwwpmHn1J5i43Y0uZP97GqasGCzSRJk=
-github.com/dblohm7/wingoes v0.0.0-20240119213807-a09d6be7affa/go.mod h1:Nx87SkVqTKd8UtT+xu7sM/l+LgXs6c0aHrlKusR+2EQ=
-github.com/dgryski/go-metro v0.0.0-20180109044635-280f6062b5bc h1:8WFBn63wegobsYAX0YjD+8suexZDga5CctH4CCTx2+8=
-github.com/dgryski/go-metro v0.0.0-20180109044635-280f6062b5bc/go.mod h1:c9O8+fpSOX1DM8cPNSkX/qsBWdkD4yd2dpciOWQjpBw=
-github.com/digitalocean/go-smbios v0.0.0-20180907143718-390a4f403a8e h1:vUmf0yezR0y7jJ5pceLHthLaYf4bA5T14B6q39S4q2Q=
-github.com/digitalocean/go-smbios v0.0.0-20180907143718-390a4f403a8e/go.mod h1:YTIHhz/QFSYnu/EhlF2SpU2Uk+32abacUYA5ZPljz1A=
-github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
-github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
-github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
-github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
-github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/gaissmai/bart v0.26.1 h1:+w4rnLGNlA2GDVn382Tfe3jOsK5vOr5n4KmigJ9lbTo=
-github.com/gaissmai/bart v0.26.1/go.mod h1:GREWQfTLRWz/c5FTOsIw+KkscuFkIV5t8Rp7Nd1Td5c=
-github.com/github/fakeca v0.1.0 h1:Km/MVOFvclqxPM9dZBC4+QE564nU4gz4iZ0D9pMw28I=
-github.com/github/fakeca v0.1.0/go.mod h1:+bormgoGMMuamOscx7N91aOuUST7wdaJ2rNjeohylyo=
-github.com/go-json-experiment/json v0.0.0-20250813024750-ebf49471dced h1:Q311OHjMh/u5E2TITc++WlTP5We0xNseRMkHDyvhW7I=
-github.com/go-json-experiment/json v0.0.0-20250813024750-ebf49471dced/go.mod h1:TiCD2a1pcmjd7YnhGH0f/zKNcCD06B029pHhzV23c2M=
-github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
-github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
-github.com/go4org/plan9netshell v0.0.0-20250324183649-788daa080737 h1:cf60tHxREO3g1nroKr2osU3JWZsJzkfi7rEg+oAB0Lo=
-github.com/go4org/plan9netshell v0.0.0-20250324183649-788daa080737/go.mod h1:MIS0jDzbU/vuM9MC4YnBITCv+RYuTRq8dJzmCrFsK9g=
-github.com/godbus/dbus/v5 v5.1.1-0.20230522191255-76236955d466 h1:sQspH8M4niEijh3PFscJRLDnkL547IeP7kpPe3uUhEg=
-github.com/godbus/dbus/v5 v5.1.1-0.20230522191255-76236955d466/go.mod h1:ZiQxhyQ+bbbfxUKVvjfO498oPYvtYhZzycal3G/NHmU=
-github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
-github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
-github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
-github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-tpm v0.9.4 h1:awZRf9FwOeTunQmHoDYSHJps3ie6f1UlhS1fOdPEt1I=
-github.com/google/go-tpm v0.9.4/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
-github.com/google/nftables v0.2.1-0.20240414091927-5e242ec57806 h1:wG8RYIyctLhdFk6Vl1yPGtSRtwGpVkWyZww1OCil2MI=
-github.com/google/nftables v0.2.1-0.20240414091927-5e242ec57806/go.mod h1:Beg6V6zZ3oEn0JuiUQ4wqwuyqqzasOltcoXPtgLbFp4=
-github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
-github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/hdevalence/ed25519consensus v0.2.0 h1:37ICyZqdyj0lAZ8P4D1d1id3HqbbG1N3iBb1Tb4rdcU=
-github.com/hdevalence/ed25519consensus v0.2.0/go.mod h1:w3BHWjwJbFU29IRHL1Iqkw3sus+7FctEyM4RqDxYNzo=
-github.com/huin/goupnp v1.3.0 h1:UvLUlWDNpoUdYzb2TCn+MuTWtcjXKSza2n6CBdQ0xXc=
-github.com/huin/goupnp v1.3.0/go.mod h1:gnGPsThkYa7bFi/KWmEysQRf48l2dvR5bxr2OFckNX8=
-github.com/illarion/gonotify/v3 v3.0.2 h1:O7S6vcopHexutmpObkeWsnzMJt/r1hONIEogeVNmJMk=
-github.com/illarion/gonotify/v3 v3.0.2/go.mod h1:HWGPdPe817GfvY3w7cx6zkbzNZfi3QjcBm/wgVvEL1U=
-github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2 h1:9K06NfxkBh25x56yVhWWlKFE8YpicaSfHwoV8SFbueA=
-github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2/go.mod h1:3A9PQ1cunSDF/1rbTq99Ts4pVnycWg+vlPkfeD2NLFI=
-github.com/jellydator/ttlcache/v3 v3.1.0 h1:0gPFG0IHHP6xyUyXq+JaD8fwkDCqgqwohXNJBcYE71g=
-github.com/jellydator/ttlcache/v3 v3.1.0/go.mod h1:hi7MGFdMAwZna5n2tuvh63DvFLzVKySzCVW6+0gA2n4=
-github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
-github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
-github.com/jsimonetti/rtnetlink v1.4.0 h1:Z1BF0fRgcETPEa0Kt0MRk3yV5+kF1FWTni6KUFKrq2I=
-github.com/jsimonetti/rtnetlink v1.4.0/go.mod h1:5W1jDvWdnthFJ7fxYX1GMK07BUpI4oskfOqvPteYS6E=
-github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk=
-github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
-github.com/kortschak/wol v0.0.0-20200729010619-da482cc4850a h1:+RR6SqnTkDLWyICxS1xpjCi/3dhyV+TgZwA6Ww3KncQ=
-github.com/kortschak/wol v0.0.0-20200729010619-da482cc4850a/go.mod h1:YTtCCM3ryyfiu4F7t8HQ1mxvp1UBdWM2r6Xa+nGWvDk=
-github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
-github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
-github.com/mdlayher/genetlink v1.3.2/go.mod h1:tcC3pkCrPUGIKKsCsp0B3AdaaKuHtaxoJRz3cc+528o=
-github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42 h1:A1Cq6Ysb0GM0tpKMbdCXCIfBclan4oHk1Jb+Hrejirg=
-github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42/go.mod h1:BB4YCPDOzfy7FniQ/lxuYQ3dgmM2cZumHbK8RpTjN2o=
-github.com/mdlayher/sdnotify v1.0.0 h1:Ma9XeLVN/l0qpyx1tNeMSeTjCPH6NtuD6/N9XdTlQ3c=
-github.com/mdlayher/sdnotify v1.0.0/go.mod h1:HQUmpM4XgYkhDLtd+Uad8ZFK1T9D5+pNxnXQjCeJlGE=
-github.com/mdlayher/socket v0.5.0 h1:ilICZmJcQz70vrWVes1MFera4jGiWNocSkykwwoy3XI=
-github.com/mdlayher/socket v0.5.0/go.mod h1:WkcBFfvyG8QENs5+hfQPl1X6Jpd2yeLIYgrGFmJiJxI=
-github.com/miekg/dns v1.1.58 h1:ca2Hdkz+cDg/7eNF6V56jjzuZ4aCAE+DbVkILdQWG/4=
-github.com/miekg/dns v1.1.58/go.mod h1:Ypv+3b/KadlvW9vJfXOTf300O4UqaHFzFCuHz+rPkBY=
-github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
-github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
-github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
-github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 h1:zYyBkD/k9seD2A7fsi6Oo2LfFZAehjjQMERAvZLEDnQ=
-github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646/go.mod h1:jpp1/29i3P1S/RLdc7JQKbRpFeM1dOBd8T9ki5s+AY8=
-github.com/pierrec/lz4/v4 v4.1.25 h1:kocOqRffaIbU5djlIBr7Wh+cx82C0vtFb0fOurZHqD0=
-github.com/pierrec/lz4/v4 v4.1.25/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
-github.com/pires/go-proxyproto v0.8.1 h1:9KEixbdJfhrbtjpz/ZwCdWDD2Xem0NZ38qMYaASJgp0=
-github.com/pires/go-proxyproto v0.8.1/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
-github.com/pkg/sftp v1.13.6 h1:JFZT4XbOU7l77xGSpOdW+pwIMqP044IyjXX6FGyEKFo=
-github.com/pkg/sftp v1.13.6/go.mod h1:tz1ryNURKu77RL+GuCzmoJYxQczL3wLNNpPWagdg4Qk=
-github.com/prometheus-community/pro-bing v0.4.0 h1:YMbv+i08gQz97OZZBwLyvmmQEEzyfyrrjEaAchdy3R4=
-github.com/prometheus-community/pro-bing v0.4.0/go.mod h1:b7wRYZtCcPmt4Sz319BykUU241rWLe1VFXyiyWK/dH4=
-github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
-github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
-github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
-github.com/safchain/ethtool v0.3.0 h1:gimQJpsI6sc1yIqP/y8GYgiXn/NjgvpM0RNoWLVVmP0=
-github.com/safchain/ethtool v0.3.0/go.mod h1:SA9BwrgyAqNo7M+uaL6IYbxpm5wk3L7Mm6ocLW+CJUs=
-github.com/tailscale/certstore v0.1.1-0.20231202035212-d3fa0460f47e h1:PtWT87weP5LWHEY//SWsYkSO3RWRZo4OSWagh3YD2vQ=
-github.com/tailscale/certstore v0.1.1-0.20231202035212-d3fa0460f47e/go.mod h1:XrBNfAFN+pwoWuksbFS9Ccxnopa15zJGgXRFN90l3K4=
-github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55 h1:Gzfnfk2TWrk8Jj4P4c1a3CtQyMaTVCznlkLZI++hok4=
-github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55/go.mod h1:4k4QO+dQ3R5FofL+SanAUZe+/QfeK0+OIuwDIRu2vSg=
-github.com/tailscale/golang-x-crypto v0.0.0-20250404221719-a5573b049869 h1:SRL6irQkKGQKKLzvQP/ke/2ZuB7Py5+XuqtOgSj+iMM=
-github.com/tailscale/golang-x-crypto v0.0.0-20250404221719-a5573b049869/go.mod h1:ikbF+YT089eInTp9f2vmvy4+ZVnW5hzX1q2WknxSprQ=
-github.com/tailscale/hujson v0.0.0-20221223112325-20486734a56a h1:SJy1Pu0eH1C29XwJucQo73FrleVK6t4kYz4NVhp34Yw=
-github.com/tailscale/hujson v0.0.0-20221223112325-20486734a56a/go.mod h1:DFSS3NAGHthKo1gTlmEcSBiZrRJXi28rLNd/1udP1c8=
-github.com/tailscale/netlink v1.1.1-0.20240822203006-4d49adab4de7 h1:uFsXVBE9Qr4ZoF094vE6iYTLDl0qCiKzYXlL6UeWObU=
-github.com/tailscale/netlink v1.1.1-0.20240822203006-4d49adab4de7/go.mod h1:NzVQi3Mleb+qzq8VmcWpSkcSYxXIg0DkI6XDzpVkhJ0=
-github.com/tailscale/peercred v0.0.0-20250107143737-35a0c7bd7edc h1:24heQPtnFR+yfntqhI3oAu9i27nEojcQ4NuBQOo5ZFA=
-github.com/tailscale/peercred v0.0.0-20250107143737-35a0c7bd7edc/go.mod h1:f93CXfllFsO9ZQVq+Zocb1Gp4G5Fz0b0rXHLOzt/Djc=
-github.com/tailscale/web-client-prebuilt v0.0.0-20250124233751-d4cd19a26976 h1:UBPHPtv8+nEAy2PD8RyAhOYvau1ek0HDJqLS/Pysi14=
-github.com/tailscale/web-client-prebuilt v0.0.0-20250124233751-d4cd19a26976/go.mod h1:agQPE6y6ldqCOui2gkIh7ZMztTkIQKH049tv8siLuNQ=
-github.com/tailscale/wf v0.0.0-20240214030419-6fbb0a674ee6 h1:l10Gi6w9jxvinoiq15g8OToDdASBni4CyJOdHY1Hr8M=
-github.com/tailscale/wf v0.0.0-20240214030419-6fbb0a674ee6/go.mod h1:ZXRML051h7o4OcI0d3AaILDIad/Xw0IkXaHM17dic1Y=
-github.com/tailscale/wireguard-go v0.0.0-20250716170648-1d0488a3d7da h1:jVRUZPRs9sqyKlYHHzHjAqKN+6e/Vog6NpHYeNPJqOw=
-github.com/tailscale/wireguard-go v0.0.0-20250716170648-1d0488a3d7da/go.mod h1:BOm5fXUBFM+m9woLNBoxI9TaBXXhGNP50LX/TGIvGb4=
-github.com/tailscale/xnet v0.0.0-20240729143630-8497ac4dab2e h1:zOGKqN5D5hHhiYUp091JqK7DPCqSARyUfduhGUY8Bek=
-github.com/tailscale/xnet v0.0.0-20240729143630-8497ac4dab2e/go.mod h1:orPd6JZXXRyuDusYilywte7k094d7dycXXU5YnWsrwg=
-github.com/tc-hib/winres v0.2.1 h1:YDE0FiP0VmtRaDn7+aaChp1KiF4owBiJa5l964l5ujA=
-github.com/tc-hib/winres v0.2.1/go.mod h1:C/JaNhH3KBvhNKVbvdlDWkbMDO9H4fKKDaN7/07SSuk=
-github.com/u-root/u-root v0.14.0 h1:Ka4T10EEML7dQ5XDvO9c3MBN8z4nuSnGjcd1jmU2ivg=
-github.com/u-root/u-root v0.14.0/go.mod h1:hAyZorapJe4qzbLWlAkmSVCJGbfoU9Pu4jpJ1WMluqE=
-github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 h1:pyC9PaHYZFgEKFdlp3G8RaCKgVpHZnecvArXvPXcFkM=
-github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701/go.mod h1:P3a5rG4X7tI17Nn3aOIAYr5HbIMukwXG0urG0WuL8OA=
-github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
-github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
-github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
-github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
-go4.org/mem v0.0.0-20240501181205-ae6ca9944745 h1:Tl++JLUCe4sxGu8cTpDzRLd3tN7US4hOxG5YpKCzkek=
-go4.org/mem v0.0.0-20240501181205-ae6ca9944745/go.mod h1:reUoABIJ9ikfM5sgtSF3Wushcza7+WeD01VB9Lirh3g=
-go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
-go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
-golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
-golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
-golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
-golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
-golang.org/x/exp/typeparams v0.0.0-20240314144324-c7f7c6466f7f h1:phY1HzDcf18Aq9A8KkmRtY9WvOFIxN8wgfvy6Zm1DV8=
-golang.org/x/exp/typeparams v0.0.0-20240314144324-c7f7c6466f7f/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
-golang.org/x/image v0.27.0 h1:C8gA4oWU/tKkdCfYT6T2u4faJu3MeNS5O8UPWlPF61w=
-golang.org/x/image v0.27.0/go.mod h1:xbdrClrAUway1MUTEZDq9mz/UpRwYAkFFNUslZtcB+g=
-golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk=
-golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
-golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
-golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
-golang.org/x/oauth2 v0.33.0 h1:4Q+qn+E5z8gPRJfmRy7C2gGG3T4jIprK6aSYgTXGRpo=
-golang.org/x/oauth2 v0.33.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
-golang.org/x/sys v0.0.0-20220817070843-5a390386f1f2/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
-golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
-golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
-golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
-golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
-golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
-golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
-golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ=
-golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
-golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
-golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
-golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus8eIuExIE=
-golang.zx2c4.com/wireguard/windows v0.5.3/go.mod h1:9TEe8TJmtwyQebdFwAkEWOPr3prrtqm+REGFifP60hI=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
-gvisor.dev/gvisor v0.0.0-20260224225140-573d5e7127a8 h1:Zy8IV/+FMLxy6j6p87vk/vQGKcdnbprwjTxc8UiUtsA=
-gvisor.dev/gvisor v0.0.0-20260224225140-573d5e7127a8/go.mod h1:QkHjoMIBaYtpVufgwv3keYAbln78mBoCuShZrPrer1Q=
-honnef.co/go/tools v0.7.0-0.dev.0.20251022135355-8273271481d0 h1:5SXjd4ET5dYijLaf0O3aOenC0Z4ZafIWSpjUzsQaNho=
-honnef.co/go/tools v0.7.0-0.dev.0.20251022135355-8273271481d0/go.mod h1:EPDDhEZqVHhWuPI5zPAsjU0U7v9xNIWjoOVyZ5ZcniQ=
-howett.net/plist v1.0.0 h1:7CrbWYbPPO/PyNy38b2EB/+gYbjCe2DXBxgtOOZbSQM=
-howett.net/plist v1.0.0/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
-software.sslmate.com/src/go-pkcs12 v0.4.0 h1:H2g08FrTvSFKUj+D309j1DPfk5APnIdAQAB8aEykJ5k=
-software.sslmate.com/src/go-pkcs12 v0.4.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
-tailscale.com v1.96.5 h1:gNkfA/KSZAl6jCH9cj8urq00HRWItDDTtGsyATI89jA=
-tailscale.com v1.96.5/go.mod h1:/3lnZBYb2UEwnN0MNu2SDXUtT06AGd5k0s+OWx3WmcY=
diff --git a/Tools/tailscale-login-bridge/main.go b/Tools/tailscale-login-bridge/main.go
deleted file mode 100644
index 877d0e4..0000000
--- a/Tools/tailscale-login-bridge/main.go
+++ /dev/null
@@ -1,523 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/binary"
-	"encoding/json"
-	"errors"
-	"flag"
-	"fmt"
-	"io"
-	"log"
-	"net"
-	"net/netip"
-	"net/http"
-	"os"
-	"strconv"
-	"sync"
-	"time"
-
-	"github.com/tailscale/wireguard-go/tun"
-	"tailscale.com/client/local"
-	"tailscale.com/ipn"
-	"tailscale.com/ipn/ipnstate"
-	"tailscale.com/tailcfg"
-	"tailscale.com/tsnet"
-)
-
-type statusResponse struct {
-	BackendState   string   `json:"backend_state"`
-	AuthURL        string   `json:"auth_url,omitempty"`
-	Running        bool     `json:"running"`
-	NeedsLogin     bool     `json:"needs_login"`
-	TailnetName    string   `json:"tailnet_name,omitempty"`
-	MagicDNSSuffix string   `json:"magic_dns_suffix,omitempty"`
-	SelfDNSName    string   `json:"self_dns_name,omitempty"`
-	TailscaleIPs   []string `json:"tailscale_ips,omitempty"`
-	Health         []string `json:"health,omitempty"`
-	Peers          []peerSummary `json:"peers,omitempty"`
-}
-
-type peerSummary struct {
-	Name         string   `json:"name,omitempty"`
-	DNSName      string   `json:"dns_name,omitempty"`
-	TailscaleIPs []string `json:"tailscale_ips,omitempty"`
-	Online       bool     `json:"online"`
-	Active       bool     `json:"active"`
-	Relay        string   `json:"relay,omitempty"`
-	CurAddr      string   `json:"cur_addr,omitempty"`
-	LastSeenUnix int64    `json:"last_seen_unix,omitempty"`
-}
-
-type pingResponse struct {
-	Result *ipnstate.PingResult `json:"result,omitempty"`
-}
-
-type helperHello struct {
-	ListenAddr   string `json:"listen_addr"`
-	PacketSocket string `json:"packet_socket,omitempty"`
-}
-
-type helperState struct {
-	mu      sync.RWMutex
-	authURL string
-}
-
-func (s *helperState) authURLSnapshot() string {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-	return s.authURL
-}
-
-func (s *helperState) setAuthURL(url string) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.authURL = url
-}
-
-func (s *helperState) clearAuthURL() {
-	s.setAuthURL("")
-}
-
-// chanTUN is a tun.Device backed by channels so another process can feed and
-// consume raw IP packets while tsnet handles the Tailnet control/data plane.
-type chanTUN struct {
-	Inbound  chan []byte
-	Outbound chan []byte
-	closed   chan struct{}
-	events   chan tun.Event
-}
-
-func newChanTUN() *chanTUN {
-	t := &chanTUN{
-		Inbound:  make(chan []byte, 1024),
-		Outbound: make(chan []byte, 1024),
-		closed:   make(chan struct{}),
-		events:   make(chan tun.Event, 1),
-	}
-	t.events <- tun.EventUp
-	return t
-}
-
-func (t *chanTUN) File() *os.File { return nil }
-
-func (t *chanTUN) Close() error {
-	select {
-	case <-t.closed:
-	default:
-		close(t.closed)
-		close(t.Inbound)
-	}
-	return nil
-}
-
-func (t *chanTUN) Read(bufs [][]byte, sizes []int, offset int) (int, error) {
-	select {
-	case <-t.closed:
-		return 0, io.EOF
-	case pkt, ok := <-t.Outbound:
-		if !ok {
-			return 0, io.EOF
-		}
-		sizes[0] = copy(bufs[0][offset:], pkt)
-		return 1, nil
-	}
-}
-
-func (t *chanTUN) Write(bufs [][]byte, offset int) (int, error) {
-	for _, buf := range bufs {
-		pkt := buf[offset:]
-		if len(pkt) == 0 {
-			continue
-		}
-		select {
-		case <-t.closed:
-			return 0, errors.New("closed")
-		case t.Inbound <- append([]byte(nil), pkt...):
-		default:
-		}
-	}
-	return len(bufs), nil
-}
-
-func (t *chanTUN) MTU() (int, error)        { return 1280, nil }
-func (t *chanTUN) Name() (string, error)    { return "burrow-tailnet", nil }
-func (t *chanTUN) Events() <-chan tun.Event { return t.events }
-func (t *chanTUN) BatchSize() int           { return 1 }
-
-func main() {
-	listen := flag.String("listen", "127.0.0.1:0", "local listen address")
-	stateDir := flag.String("state-dir", "", "persistent state directory")
-	hostname := flag.String("hostname", "burrow-apple", "tailnet hostname")
-	controlURL := flag.String("control-url", "", "optional control URL")
-	packetSocket := flag.String("packet-socket", "", "optional unix socket path for raw packet bridging")
-	udpEchoPort := flag.Int("udp-echo-port", 0, "optional tailnet UDP echo port")
-	flag.Parse()
-
-	if *stateDir == "" {
-		log.Fatal("--state-dir is required")
-	}
-
-	if err := os.MkdirAll(*stateDir, 0o755); err != nil {
-		log.Fatalf("create state dir: %v", err)
-	}
-
-	server := &tsnet.Server{
-		Dir:      *stateDir,
-		Hostname: *hostname,
-		UserLogf: log.Printf,
-	}
-
-	var tunDevice *chanTUN
-	var packetListener net.Listener
-	if *packetSocket != "" {
-		_ = os.Remove(*packetSocket)
-		ln, err := net.Listen("unix", *packetSocket)
-		if err != nil {
-			log.Fatalf("packet listen: %v", err)
-		}
-		packetListener = ln
-		defer func() {
-			packetListener.Close()
-			_ = os.Remove(*packetSocket)
-		}()
-
-		tunDevice = newChanTUN()
-		server.Tun = tunDevice
-	}
-	if *controlURL != "" {
-		server.ControlURL = *controlURL
-	}
-	defer server.Close()
-
-	if err := server.Start(); err != nil {
-		log.Fatalf("start tsnet: %v", err)
-	}
-
-	localClient, err := server.LocalClient()
-	if err != nil {
-		log.Fatalf("local client: %v", err)
-	}
-	state := &helperState{}
-
-	ln, err := net.Listen("tcp", *listen)
-	if err != nil {
-		log.Fatalf("listen: %v", err)
-	}
-	defer ln.Close()
-
-	if packetListener != nil {
-		go servePacketBridge(packetListener, tunDevice)
-	}
-	if *udpEchoPort > 0 {
-		go serveUDPEcho(context.Background(), server, localClient, *udpEchoPort)
-	}
-
-	hello := helperHello{
-		ListenAddr: ln.Addr().String(),
-	}
-	if *packetSocket != "" {
-		hello.PacketSocket = *packetSocket
-	}
-	if err := json.NewEncoder(os.Stdout).Encode(hello); err != nil {
-		log.Fatalf("write hello: %v", err)
-	}
-	_ = os.Stdout.Sync()
-
-	mux := http.NewServeMux()
-	mux.HandleFunc("/status", func(w http.ResponseWriter, r *http.Request) {
-		status, err := snapshot(r.Context(), localClient, state)
-		if err != nil {
-			http.Error(w, err.Error(), http.StatusBadGateway)
-			return
-		}
-		w.Header().Set("content-type", "application/json")
-		_ = json.NewEncoder(w).Encode(status)
-	})
-	mux.HandleFunc("/ping", func(w http.ResponseWriter, r *http.Request) {
-		ip := r.URL.Query().Get("ip")
-		if ip == "" {
-			http.Error(w, "missing ip", http.StatusBadRequest)
-			return
-		}
-		target, err := netip.ParseAddr(ip)
-		if err != nil {
-			http.Error(w, fmt.Sprintf("invalid ip: %v", err), http.StatusBadRequest)
-			return
-		}
-
-		pingType := tailcfg.PingTSMP
-		switch r.URL.Query().Get("type") {
-		case "", "tsmp", "TSMP":
-			pingType = tailcfg.PingTSMP
-		case "icmp", "ICMP":
-			pingType = tailcfg.PingICMP
-		case "peerapi":
-			pingType = tailcfg.PingPeerAPI
-		default:
-			http.Error(w, "unsupported ping type", http.StatusBadRequest)
-			return
-		}
-
-		result, err := localClient.Ping(r.Context(), target, pingType)
-		if err != nil {
-			http.Error(w, err.Error(), http.StatusBadGateway)
-			return
-		}
-
-		w.Header().Set("content-type", "application/json")
-		_ = json.NewEncoder(w).Encode(&pingResponse{Result: result})
-	})
-	mux.HandleFunc("/shutdown", func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusNoContent)
-		go func() {
-			_ = server.Close()
-			time.Sleep(100 * time.Millisecond)
-			os.Exit(0)
-		}()
-	})
-
-	httpServer := &http.Server{
-		Handler: mux,
-	}
-	log.Fatal(httpServer.Serve(ln))
-}
-
-func servePacketBridge(listener net.Listener, device *chanTUN) {
-	for {
-		conn, err := listener.Accept()
-		if err != nil {
-			if errors.Is(err, net.ErrClosed) {
-				return
-			}
-			log.Printf("packet accept: %v", err)
-			continue
-		}
-		log.Printf("packet bridge connected")
-		if err := bridgePacketConn(conn, device); err != nil && !errors.Is(err, io.EOF) {
-			log.Printf("packet bridge error: %v", err)
-		}
-		_ = conn.Close()
-		log.Printf("packet bridge disconnected")
-	}
-}
-
-func bridgePacketConn(conn net.Conn, device *chanTUN) error {
-	errCh := make(chan error, 2)
-
-	go func() {
-		for {
-			pkt, err := readFrame(conn)
-			if err != nil {
-				errCh <- err
-				return
-			}
-			select {
-			case <-device.closed:
-				errCh <- io.EOF
-				return
-			case device.Outbound <- pkt:
-			}
-		}
-	}()
-
-	go func() {
-		for {
-			select {
-			case <-device.closed:
-				errCh <- io.EOF
-				return
-			case pkt, ok := <-device.Inbound:
-				if !ok {
-					errCh <- io.EOF
-					return
-				}
-				if err := writeFrame(conn, pkt); err != nil {
-					errCh <- err
-					return
-				}
-			}
-		}
-	}()
-
-	return <-errCh
-}
-
-func readFrame(r io.Reader) ([]byte, error) {
-	var size [4]byte
-	if _, err := io.ReadFull(r, size[:]); err != nil {
-		return nil, err
-	}
-	length := binary.BigEndian.Uint32(size[:])
-	if length == 0 {
-		return []byte{}, nil
-	}
-	packet := make([]byte, length)
-	if _, err := io.ReadFull(r, packet); err != nil {
-		return nil, err
-	}
-	return packet, nil
-}
-
-func writeFrame(w io.Writer, packet []byte) error {
-	var size [4]byte
-	binary.BigEndian.PutUint32(size[:], uint32(len(packet)))
-	if _, err := w.Write(size[:]); err != nil {
-		return err
-	}
-	if len(packet) == 0 {
-		return nil
-	}
-	_, err := w.Write(packet)
-	return err
-}
-
-func snapshot(ctx context.Context, localClient *local.Client, state *helperState) (*statusResponse, error) {
-	status, err := localClient.Status(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	authURL := status.AuthURL
-	if authURL == "" {
-		authURL = state.authURLSnapshot()
-	}
-	if status.BackendState == ipn.Running.String() {
-		state.clearAuthURL()
-		authURL = ""
-	} else if (status.BackendState == ipn.NeedsLogin.String() || status.BackendState == ipn.NoState.String()) && authURL == "" {
-		authURL, err = awaitAuthURL(ctx, localClient, state)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	response := &statusResponse{
-		BackendState: status.BackendState,
-		AuthURL:      authURL,
-		Running:      status.BackendState == ipn.Running.String(),
-		NeedsLogin:   status.BackendState == ipn.NeedsLogin.String(),
-		Health:       append([]string(nil), status.Health...),
-	}
-
-	if status.CurrentTailnet != nil {
-		response.TailnetName = status.CurrentTailnet.Name
-		response.MagicDNSSuffix = status.CurrentTailnet.MagicDNSSuffix
-	}
-	if status.Self != nil {
-		response.SelfDNSName = status.Self.DNSName
-	}
-	for _, ip := range status.TailscaleIPs {
-		response.TailscaleIPs = append(response.TailscaleIPs, ip.String())
-	}
-	for _, key := range status.Peers() {
-		peer := status.Peer[key]
-		if peer == nil {
-			continue
-		}
-		summary := peerSummary{
-			Name:         peer.HostName,
-			DNSName:      peer.DNSName,
-			Online:       peer.Online,
-			Active:       peer.Active,
-			Relay:        peer.Relay,
-			CurAddr:      peer.CurAddr,
-			LastSeenUnix: peer.LastSeen.Unix(),
-		}
-		for _, ip := range peer.TailscaleIPs {
-			summary.TailscaleIPs = append(summary.TailscaleIPs, ip.String())
-		}
-		response.Peers = append(response.Peers, summary)
-	}
-	return response, nil
-}
-
-func serveUDPEcho(ctx context.Context, server *tsnet.Server, localClient *local.Client, port int) {
-	ip, err := awaitTailscaleIP(ctx, localClient)
-	if err != nil {
-		log.Printf("udp echo setup failed: %v", err)
-		return
-	}
-
-	listenAddr := net.JoinHostPort(ip.String(), strconv.Itoa(port))
-	pc, err := server.ListenPacket("udp", listenAddr)
-	if err != nil {
-		log.Printf("udp echo listen failed on %s: %v", listenAddr, err)
-		return
-	}
-	defer pc.Close()
-
-	log.Printf("udp echo listening on %s", pc.LocalAddr())
-	buf := make([]byte, 64<<10)
-	for {
-		n, addr, err := pc.ReadFrom(buf)
-		if err != nil {
-			if errors.Is(err, net.ErrClosed) || errors.Is(err, io.EOF) {
-				return
-			}
-			log.Printf("udp echo read failed: %v", err)
-			return
-		}
-		if _, err := pc.WriteTo(buf[:n], addr); err != nil {
-			log.Printf("udp echo write failed: %v", err)
-			return
-		}
-	}
-}
-
-func awaitTailscaleIP(ctx context.Context, localClient *local.Client) (netip.Addr, error) {
-	for range 60 {
-		status, err := localClient.StatusWithoutPeers(ctx)
-		if err == nil {
-			for _, ip := range status.TailscaleIPs {
-				if ip.Is4() {
-					return ip, nil
-				}
-			}
-			for _, ip := range status.TailscaleIPs {
-				if ip.Is6() {
-					return ip, nil
-				}
-			}
-		}
-		select {
-		case <-ctx.Done():
-			return netip.Addr{}, ctx.Err()
-		case <-time.After(250 * time.Millisecond):
-		}
-	}
-	return netip.Addr{}, errors.New("timed out waiting for tailscale IP")
-}
-
-func awaitAuthURL(ctx context.Context, localClient *local.Client, state *helperState) (string, error) {
-	watchCtx, cancel := context.WithTimeout(ctx, 8*time.Second)
-	defer cancel()
-
-	watcher, err := localClient.WatchIPNBus(watchCtx, ipn.NotifyInitialState)
-	if err != nil {
-		return "", err
-	}
-	defer watcher.Close()
-
-	if err := localClient.StartLoginInteractive(ctx); err != nil {
-		return "", err
-	}
-
-	for {
-		notify, err := watcher.Next()
-		if err != nil {
-			if errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) {
-				return state.authURLSnapshot(), nil
-			}
-			return "", err
-		}
-		if notify.BrowseToURL != nil && *notify.BrowseToURL != "" {
-			state.setAuthURL(*notify.BrowseToURL)
-			return *notify.BrowseToURL, nil
-		}
-		if notify.State != nil && *notify.State == ipn.Running {
-			state.clearAuthURL()
-			return "", nil
-		}
-	}
-}
diff --git a/Tools/version.sh b/Tools/version.sh
deleted file mode 100755
index fcb3f00..0000000
--- a/Tools/version.sh
+++ /dev/null
@@ -1,51 +0,0 @@
-#!/bin/bash
-
-export PATH="$PATH:/opt/homebrew/bin:/usr/local/bin:/etc/profiles/per-user/$USER/bin"
-
-set -euo pipefail
-
-cd "$(dirname "${BASH_SOURCE[0]}")"/..
-
-TAG_PREFIX="builds/"
-
-CURRENT_BUILD=$(git tag --points-at HEAD | tail -n 1)
-LATEST_BUILD="$TAG_PREFIX$(git tag -l "builds/[0-9]*" | cut -d'/' -f 2 | sort -n | tail -n 1)"
-
-CURRENT_BUILD_NUMBER=${CURRENT_BUILD#$TAG_PREFIX}
-LATEST_BUILD_NUMBER=${LATEST_BUILD#$TAG_PREFIX}
-if [[ -z $LATEST_BUILD_NUMBER ]]; then
-    LATEST_BUILD_NUMBER="0"
-fi
-
-if [[ ! -z $LATEST_BUILD && $(git merge-base --is-ancestor $LATEST_BUILD HEAD) -ne 0 ]]; then
-    echo "error: HEAD is not descended from build $LATEST_BUILD_NUMBER" >&2
-    exit 1
-fi
-
-BUILD_NUMBER=$LATEST_BUILD_NUMBER
-
-if [[ $# -gt 0 && "$1" == "increment" ]]; then
-    NEW_BUILD_NUMBER=$((LATEST_BUILD_NUMBER + 1))
-    NEW_TAG="$TAG_PREFIX$NEW_BUILD_NUMBER"
-    BUILD_NUMBER=$NEW_BUILD_NUMBER
-
-    git tag $NEW_TAG
-    git push --quiet origin $NEW_TAG
-    gh release create "$NEW_TAG" -t "Build $BUILD_NUMBER" --verify-tag --generate-notes >/dev/null
-fi
-
-if [[ -z $(grep $BUILD_NUMBER Apple/Configuration/Version.xcconfig 2>/dev/null) ]]; then
-    echo "CURRENT_PROJECT_VERSION = $BUILD_NUMBER" > Apple/Configuration/Version.xcconfig
-    git update-index --assume-unchanged Apple/Configuration/Version.xcconfig
-fi
-
-if [[ $# -gt 0 && "$1" == "status" ]]; then
-    if [[ $CURRENT_BUILD_NUMBER -eq $LATEST_BUILD_NUMBER ]]; then
-        echo "clean"
-    else
-        echo "dirty"
-    fi
-    exit 0
-fi
-
-echo $BUILD_NUMBER
diff --git a/bazel/android/BUILD.bazel b/bazel/android/BUILD.bazel
deleted file mode 100644
index 64b7cff..0000000
--- a/bazel/android/BUILD.bazel
+++ /dev/null
@@ -1,14 +0,0 @@
-load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
-load(":android_targets.bzl", "android_stub_stamp")
-
-package(default_visibility = ["//visibility:public"])
-
-sh_binary(
-    name = "runner",
-    srcs = ["runner.sh"],
-)
-
-android_stub_stamp(
-    name = "check_stub_stamp",
-    command = "check-stub",
-)
diff --git a/bazel/android/android_targets.bzl b/bazel/android/android_targets.bzl
deleted file mode 100644
index c6c67bd..0000000
--- a/bazel/android/android_targets.bzl
+++ /dev/null
@@ -1,12 +0,0 @@
-def android_stub_stamp(name, command):
-    native.genrule(
-        name = name,
-        outs = [name + ".stamp"],
-        cmd = "$(location :runner) %s && : > \"$@\"" % command,
-        srcs = [
-            "//:android_project_files",
-            "//:mobile_rust_core_files",
-        ],
-        tools = [":runner"],
-        tags = ["no-sandbox"],
-    )
diff --git a/bazel/android/runner.sh b/bazel/android/runner.sh
deleted file mode 100755
index c273218..0000000
--- a/bazel/android/runner.sh
+++ /dev/null
@@ -1,73 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-command="${1:-}"
-
-resolve_repo_root() {
-  if [[ -n "${BUILD_WORKSPACE_DIRECTORY:-}" && -f "${BUILD_WORKSPACE_DIRECTORY}/MODULE.bazel" ]]; then
-    printf '%s\n' "$BUILD_WORKSPACE_DIRECTORY"
-    return 0
-  fi
-
-  local dir="$PWD"
-  while [[ "$dir" != "/" ]]; do
-    if [[ -f "$dir/MODULE.bazel" && -d "$dir/Android" ]]; then
-      printf '%s\n' "$dir"
-      return 0
-    fi
-    dir="$(dirname "$dir")"
-  done
-
-  echo "unable to resolve Burrow repository root" >&2
-  return 1
-}
-
-repo_root="$(resolve_repo_root)"
-cd "$repo_root"
-
-cargo_check_locked() {
-  local -a cargo_path_prefixes
-  local home_dir user_name
-  cargo_path_prefixes=()
-  home_dir="${HOME:-}"
-  if [[ -n "$home_dir" ]]; then
-    cargo_path_prefixes+=("$home_dir/.cargo/bin")
-  fi
-  user_name="$(id -un 2>/dev/null || true)"
-  if [[ -n "$user_name" ]]; then
-    cargo_path_prefixes+=(
-      "/Users/${user_name}/.cargo/bin"
-      "/home/${user_name}/.cargo/bin"
-      "/etc/profiles/per-user/${user_name}/bin"
-    )
-  fi
-  cargo_path_prefixes+=("/opt/homebrew/bin" "/usr/local/bin" "/nix/var/nix/profiles/default/bin" "/run/current-system/sw/bin")
-  export PATH="$(IFS=:; printf '%s' "${cargo_path_prefixes[*]}"):$PATH"
-
-  if command -v cargo >/dev/null 2>&1; then
-    cargo check --locked -p burrow-mobile-ffi
-    return
-  fi
-
-  if [[ "${BURROW_ANDROID_BAZEL_USE_NIX:-0}" == "1" ]] && command -v nix >/dev/null 2>&1; then
-    nix develop .#ci -c cargo check --locked -p burrow-mobile-ffi
-    return
-  fi
-
-  echo "cargo or nix is required to check the Android Rust core stub" >&2
-  exit 127
-}
-
-case "$command" in
-  check-stub)
-    test -f Android/settings.gradle.kts
-    test -f Android/app/src/main/java/net/burrow/android/MainActivity.kt
-    test -f crates/burrow-core/src/lib.rs
-    test -f crates/burrow-mobile-ffi/src/lib.rs
-    cargo_check_locked
-    ;;
-  *)
-    echo "unknown Android runner command: ${command}" >&2
-    exit 64
-    ;;
-esac
diff --git a/bazel/apple/BUILD.bazel b/bazel/apple/BUILD.bazel
deleted file mode 100644
index f35ec71..0000000
--- a/bazel/apple/BUILD.bazel
+++ /dev/null
@@ -1,25 +0,0 @@
-load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
-load(":apple_targets.bzl", "apple_bazel_stamp")
-
-package(default_visibility = ["//visibility:public"])
-
-sh_binary(
-    name = "runner",
-    srcs = ["runner.sh"],
-    target_compatible_with = ["@platforms//os:macos"],
-)
-
-apple_bazel_stamp(
-    name = "release_ios_stamp",
-    command = "release-ios",
-)
-
-apple_bazel_stamp(
-    name = "release_macos_stamp",
-    command = "release-macos",
-)
-
-apple_bazel_stamp(
-    name = "release_all_stamp",
-    command = "release-all",
-)
diff --git a/bazel/apple/apple_targets.bzl b/bazel/apple/apple_targets.bzl
deleted file mode 100644
index cedaf47..0000000
--- a/bazel/apple/apple_targets.bzl
+++ /dev/null
@@ -1,13 +0,0 @@
-def apple_bazel_stamp(name, command):
-    native.genrule(
-        name = name,
-        outs = [name + ".stamp"],
-        cmd = "$(location :runner) %s && : > \"$@\"" % command,
-        srcs = ["//:apple_project_files"],
-        tools = [":runner"],
-        # The Xcode script stages release artifacts under dist/builds as a
-        # deliberate CI side effect; keep the wrapper uncached so the staging
-        # step always runs in fresh and reused workspaces.
-        tags = ["no-cache", "no-remote-cache", "no-sandbox"],
-        target_compatible_with = ["@platforms//os:macos"],
-    )
diff --git a/bazel/apple/runner.sh b/bazel/apple/runner.sh
deleted file mode 100755
index cdf272a..0000000
--- a/bazel/apple/runner.sh
+++ /dev/null
@@ -1,42 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-command="${1:-}"
-
-resolve_repo_root() {
-  if [[ -n "${BUILD_WORKSPACE_DIRECTORY:-}" && -f "${BUILD_WORKSPACE_DIRECTORY}/MODULE.bazel" ]]; then
-    printf '%s\n' "$BUILD_WORKSPACE_DIRECTORY"
-    return 0
-  fi
-
-  local dir="$PWD"
-  while [[ "$dir" != "/" ]]; do
-    if [[ -f "$dir/MODULE.bazel" && -d "$dir/Apple" ]]; then
-      printf '%s\n' "$dir"
-      return 0
-    fi
-    dir="$(dirname "$dir")"
-  done
-
-  echo "unable to resolve Burrow repository root" >&2
-  return 1
-}
-
-repo_root="$(resolve_repo_root)"
-cd "$repo_root"
-
-case "$command" in
-  release-ios)
-    Scripts/ci/package-apple-artifacts.sh ios
-    ;;
-  release-macos)
-    Scripts/ci/package-apple-artifacts.sh macos
-    ;;
-  release-all)
-    Scripts/ci/package-apple-artifacts.sh all
-    ;;
-  *)
-    echo "unknown apple runner command: ${command}" >&2
-    exit 64
-    ;;
-esac
diff --git a/burrow-gtk/Cargo.lock b/burrow-gtk/Cargo.lock
index a1a9ebd..d0b7009 100644
--- a/burrow-gtk/Cargo.lock
+++ b/burrow-gtk/Cargo.lock
@@ -1,6 +1,6 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 4
+version = 3
 
 [[package]]
 name = "addr2line"
@@ -38,18 +38,6 @@ dependencies = [
  "cpufeatures",
 ]
 
-[[package]]
-name = "ahash"
-version = "0.8.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
-dependencies = [
- "cfg-if",
- "once_cell",
- "version_check",
- "zerocopy",
-]
-
 [[package]]
 name = "aho-corasick"
 version = "1.1.2"
@@ -126,49 +114,6 @@ dependencies = [
  "pin-project-lite",
 ]
 
-[[package]]
-name = "async-stream"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22068c0c19514942eefcfd4daf8976ef1aad84e61539f95cd200c35202f80af5"
-dependencies = [
- "async-stream-impl 0.2.1",
- "futures-core",
-]
-
-[[package]]
-name = "async-stream"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b5a71a6f37880a80d1d7f19efd781e4b5de42c88f0722cc13bcb6cc2cfe8476"
-dependencies = [
- "async-stream-impl 0.3.6",
- "futures-core",
- "pin-project-lite",
-]
-
-[[package]]
-name = "async-stream-impl"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25f9db3b38af870bf7e5cc649167533b493928e50744e2c30ae350230b414670"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "async-stream-impl"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
 [[package]]
 name = "async-trait"
 version = "0.1.77"
@@ -177,76 +122,15 @@ checksum = "c980ee35e870bd1a4d2c8294d4c04d0499e67bca1e4b5cefcc693c2fa00caea9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
-[[package]]
-name = "atomic-waker"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
-
 [[package]]
 name = "autocfg"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
 
-[[package]]
-name = "axum"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a6c9af12842a67734c9a2e355436e5d03b22383ed60cf13cd0c18fbfe3dcbcf"
-dependencies = [
- "async-trait",
- "axum-core",
- "bytes",
- "futures-util",
- "http 1.3.1",
- "http-body 1.0.1",
- "http-body-util",
- "hyper 1.6.0",
- "hyper-util",
- "itoa",
- "matchit",
- "memchr",
- "mime",
- "percent-encoding",
- "pin-project-lite",
- "rustversion",
- "serde",
- "serde_json",
- "serde_path_to_error",
- "serde_urlencoded",
- "sync_wrapper",
- "tokio",
- "tower",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "axum-core"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
-dependencies = [
- "async-trait",
- "bytes",
- "futures-util",
- "http 1.3.1",
- "http-body 1.0.1",
- "http-body-util",
- "mime",
- "pin-project-lite",
- "rustversion",
- "sync_wrapper",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
 [[package]]
 name = "backtrace"
 version = "0.3.69"
@@ -268,12 +152,6 @@ version = "0.21.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
-[[package]]
-name = "base64"
-version = "0.22.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
-
 [[package]]
 name = "base64ct"
 version = "1.6.0"
@@ -296,7 +174,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "rustc-hash 1.1.0",
+ "rustc-hash",
  "shlex",
  "syn 1.0.109",
  "which",
@@ -319,9 +197,9 @@ dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "rustc-hash 1.1.0",
+ "rustc-hash",
  "shlex",
- "syn 2.0.106",
+ "syn 2.0.48",
  "which",
 ]
 
@@ -374,49 +252,36 @@ dependencies = [
  "aead",
  "anyhow",
  "async-channel",
- "async-stream 0.2.1",
- "axum",
- "base64 0.21.7",
+ "base64",
  "blake2",
  "caps",
  "chacha20poly1305",
  "clap",
- "console",
- "dotenv",
+ "env_logger",
  "fehler",
  "futures",
  "hmac",
- "hyper-util",
  "ip_network",
  "ip_network_table",
+ "ipnet",
  "libsystemd",
  "log",
- "nix 0.27.1",
- "once_cell",
+ "nix",
  "parking_lot",
- "prost",
- "prost-types",
- "rand 0.8.5",
- "rand_core 0.6.4",
- "reqwest 0.12.5",
+ "rand",
+ "rand_core",
  "ring",
- "rusqlite",
- "rust-ini",
  "schemars",
  "serde",
  "serde_json",
  "tokio",
- "tokio-stream",
- "toml",
- "tonic",
- "tonic-build",
- "tower",
  "tracing",
  "tracing-journald",
  "tracing-log 0.1.4",
  "tracing-oslog",
  "tracing-subscriber",
  "tun",
+ "uuid",
  "x25519-dalek",
 ]
 
@@ -440,9 +305,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.10.1"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
 
 [[package]]
 name = "bzip2"
@@ -467,23 +332,23 @@ dependencies = [
 
 [[package]]
 name = "cairo-rs"
-version = "0.17.10"
+version = "0.18.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab3603c4028a5e368d09b51c8b624b9a46edcd7c3778284077a6125af73c9f0a"
+checksum = "8ca26ef0159422fb77631dc9d17b102f253b876fe1586b03b803e63a309b4ee2"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.4.2",
  "cairo-sys-rs",
  "glib",
  "libc",
  "once_cell",
- "thiserror 1.0.56",
+ "thiserror",
 ]
 
 [[package]]
 name = "cairo-sys-rs"
-version = "0.17.10"
+version = "0.18.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "691d0c66b1fb4881be80a760cb8fe76ea97218312f9dfe2c9cc0f496ca279cb1"
+checksum = "685c9fa8e590b8b3d678873528d83411db17242a73fccaed827770ea0fedda51"
 dependencies = [
  "glib-sys",
  "libc",
@@ -497,7 +362,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "190baaad529bcfbde9e1a19022c42781bdb6ff9de25721abdb8fd98c0807730b"
 dependencies = [
  "libc",
- "thiserror 1.0.56",
+ "thiserror",
 ]
 
 [[package]]
@@ -535,12 +400,6 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
-[[package]]
-name = "cfg_aliases"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
-
 [[package]]
 name = "chacha20"
 version = "0.9.1"
@@ -618,7 +477,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
@@ -642,39 +501,6 @@ dependencies = [
  "crossbeam-utils",
 ]
 
-[[package]]
-name = "console"
-version = "0.15.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e1f83fc076bd6dd27517eacdf25fef6c4dfe5f1d7448bafaaf3a26f13b5e4eb"
-dependencies = [
- "encode_unicode",
- "lazy_static",
- "libc",
- "unicode-width",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "const-random"
-version = "0.1.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87e00182fe74b066627d63b85fd550ac2998d4b0bd86bfed477a0ae4c7c71359"
-dependencies = [
- "const-random-macro",
-]
-
-[[package]]
-name = "const-random-macro"
-version = "0.1.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9d839f2a20b0aee515dc581a6172f2321f96cab76c1a38a4c584a194955390e"
-dependencies = [
- "getrandom 0.2.12",
- "once_cell",
- "tiny-keccak",
-]
-
 [[package]]
 name = "constant_time_eq"
 version = "0.1.5"
@@ -721,12 +547,6 @@ version = "0.8.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"
 
-[[package]]
-name = "crunchy"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
-
 [[package]]
 name = "crypto-common"
 version = "0.1.6"
@@ -734,7 +554,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
 dependencies = [
  "generic-array",
- "rand_core 0.6.4",
+ "rand_core",
  "typenum",
 ]
 
@@ -762,7 +582,7 @@ checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
@@ -785,21 +605,6 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "dlv-list"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "442039f5147480ba31067cb00ada1adae6892028e40e45fc5de7b7df6dcc1b5f"
-dependencies = [
- "const-random",
-]
-
-[[package]]
-name = "dotenv"
-version = "0.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77c90badedccf4105eca100756a0b1289e191f6fcbdadd3cee1d2f614f97da8f"
-
 [[package]]
 name = "dyn-clone"
 version = "1.0.16"
@@ -812,12 +617,6 @@ version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
 
-[[package]]
-name = "encode_unicode"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f"
-
 [[package]]
 name = "encoding_rs"
 version = "0.8.33"
@@ -827,6 +626,19 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "env_logger"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd405aab171cb85d6735e5c8d9db038c17d3ca007a4d2c25f337935c3d90580"
+dependencies = [
+ "humantime",
+ "is-terminal",
+ "log",
+ "regex",
+ "termcolor",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.1"
@@ -864,18 +676,6 @@ dependencies = [
  "pin-project-lite",
 ]
 
-[[package]]
-name = "fallible-iterator"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
-
-[[package]]
-name = "fallible-streaming-iterator"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
-
 [[package]]
 name = "fastrand"
 version = "2.0.1"
@@ -918,12 +718,6 @@ dependencies = [
  "rustc_version",
 ]
 
-[[package]]
-name = "fixedbitset"
-version = "0.5.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
-
 [[package]]
 name = "flate2"
 version = "1.0.28"
@@ -936,14 +730,13 @@ dependencies = [
 
 [[package]]
 name = "flume"
-version = "0.10.14"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1657b4441c3403d9f7b3409e47575237dac27b1b5726df654a6ecbf92f0f7577"
+checksum = "55ac459de2512911e4b674ce33cf20befaba382d05b62b008afc1c8b57cbf181"
 dependencies = [
  "futures-core",
  "futures-sink",
  "nanorand",
- "pin-project",
  "spin",
 ]
 
@@ -1039,7 +832,7 @@ checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
@@ -1074,11 +867,10 @@ dependencies = [
 
 [[package]]
 name = "gdk-pixbuf"
-version = "0.17.10"
+version = "0.18.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "695d6bc846438c5708b07007537b9274d883373dd30858ca881d7d71b5540717"
+checksum = "50e1f5f1b0bfb830d6ccc8066d18db35c487b1b2b1e8589b5dfe9f07e8defaec"
 dependencies = [
- "bitflags 1.3.2",
  "gdk-pixbuf-sys",
  "gio",
  "glib",
@@ -1088,9 +880,9 @@ dependencies = [
 
 [[package]]
 name = "gdk-pixbuf-sys"
-version = "0.17.10"
+version = "0.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9285ec3c113c66d7d0ab5676599176f1f42f4944ca1b581852215bf5694870cb"
+checksum = "3f9839ea644ed9c97a34d129ad56d38a25e6756f99f3a88e15cd39c20629caf7"
 dependencies = [
  "gio-sys",
  "glib-sys",
@@ -1101,11 +893,10 @@ dependencies = [
 
 [[package]]
 name = "gdk4"
-version = "0.6.3"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3abf96408a26e3eddf881a7f893a1e111767137136e347745e8ea6ed12731ff"
+checksum = "7edb019ad581f8ecf8ea8e4baa6df7c483a95b5a59be3140be6a9c3b0c632af6"
 dependencies = [
- "bitflags 1.3.2",
  "cairo-rs",
  "gdk-pixbuf",
  "gdk4-sys",
@@ -1117,9 +908,9 @@ dependencies = [
 
 [[package]]
 name = "gdk4-sys"
-version = "0.6.3"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bc92aa1608c089c49393d014c38ac0390d01e4841e1fedaa75dbcef77aaed64"
+checksum = "dbab43f332a3cf1df9974da690b5bb0e26720ed09a228178ce52175372dcfef0"
 dependencies = [
  "cairo-sys-rs",
  "gdk-pixbuf-sys",
@@ -1151,21 +942,7 @@ dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
-dependencies = [
- "cfg-if",
- "js-sys",
- "libc",
- "r-efi",
- "wasi 0.14.7+wasi-0.2.4",
+ "wasi",
  "wasm-bindgen",
 ]
 
@@ -1197,11 +974,10 @@ checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
 
 [[package]]
 name = "gio"
-version = "0.17.10"
+version = "0.18.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6973e92937cf98689b6a054a9e56c657ed4ff76de925e36fc331a15f0c5d30a"
+checksum = "d4fc8f532f87b79cbc51a79748f16a6828fb784be93145a322fa14d06d354c73"
 dependencies = [
- "bitflags 1.3.2",
  "futures-channel",
  "futures-core",
  "futures-io",
@@ -1212,14 +988,14 @@ dependencies = [
  "once_cell",
  "pin-project-lite",
  "smallvec",
- "thiserror 1.0.56",
+ "thiserror",
 ]
 
 [[package]]
 name = "gio-sys"
-version = "0.17.10"
+version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ccf87c30a12c469b6d958950f6a9c09f2be20b7773f7e70d20b867fdf2628c3"
+checksum = "37566df850baf5e4cb0dfb78af2e4b9898d817ed9263d1090a2df958c64737d2"
 dependencies = [
  "glib-sys",
  "gobject-sys",
@@ -1230,11 +1006,11 @@ dependencies = [
 
 [[package]]
 name = "glib"
-version = "0.17.10"
+version = "0.18.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3fad45ba8d4d2cea612b432717e834f48031cd8853c8aaf43b2c79fec8d144b"
+checksum = "233daaf6e83ae6a12a52055f568f9d7cf4671dabb78ff9560ab6da230ce00ee5"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.4.2",
  "futures-channel",
  "futures-core",
  "futures-executor",
@@ -1248,7 +1024,7 @@ dependencies = [
  "memchr",
  "once_cell",
  "smallvec",
- "thiserror 1.0.56",
+ "thiserror",
 ]
 
 [[package]]
@@ -1259,24 +1035,23 @@ checksum = "3431c56f463443cba9bc3600248bc6d680cb614c2ee1cdd39dab5415bd12ac5c"
 
 [[package]]
 name = "glib-macros"
-version = "0.17.10"
+version = "0.18.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eca5c79337338391f1ab8058d6698125034ce8ef31b72a442437fa6c8580de26"
+checksum = "0bb0228f477c0900c880fd78c8759b95c7636dbd7842707f49e132378aa2acdc"
 dependencies = [
- "anyhow",
  "heck",
- "proc-macro-crate",
+ "proc-macro-crate 2.0.1",
  "proc-macro-error",
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn 2.0.48",
 ]
 
 [[package]]
 name = "glib-sys"
-version = "0.17.10"
+version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d80aa6ea7bba0baac79222204aa786a6293078c210abe69ef1336911d4bdc4f0"
+checksum = "063ce2eb6a8d0ea93d2bf8ba1957e78dbab6be1c2220dd3daca57d5a9d869898"
 dependencies = [
  "libc",
  "system-deps",
@@ -1290,9 +1065,9 @@ checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
 
 [[package]]
 name = "gobject-sys"
-version = "0.17.10"
+version = "0.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd34c3317740a6358ec04572c1bcfd3ac0b5b6529275fae255b237b314bb8062"
+checksum = "0850127b514d1c4a4654ead6dedadb18198999985908e6ffe4436f53c785ce44"
 dependencies = [
  "glib-sys",
  "libc",
@@ -1301,9 +1076,9 @@ dependencies = [
 
 [[package]]
 name = "graphene-rs"
-version = "0.17.10"
+version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "def4bb01265b59ed548b05455040d272d989b3012c42d4c1bbd39083cb9b40d9"
+checksum = "3b2228cda1505613a7a956cca69076892cfbda84fc2b7a62b94a41a272c0c401"
 dependencies = [
  "glib",
  "graphene-sys",
@@ -1312,9 +1087,9 @@ dependencies = [
 
 [[package]]
 name = "graphene-sys"
-version = "0.17.10"
+version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1856fc817e6a6675e36cea0bd9a3afe296f5d9709d1e2d3182803ac77f0ab21d"
+checksum = "cc4144cee8fc8788f2a9b73dc5f1d4e1189d1f95305c4cb7bd9c1af1cfa31f59"
 dependencies = [
  "glib-sys",
  "libc",
@@ -1324,11 +1099,10 @@ dependencies = [
 
 [[package]]
 name = "gsk4"
-version = "0.6.3"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f01ef44fa7cac15e2da9978529383e6bee03e570ba5bf7036b4c10a15cc3a3c"
+checksum = "0d958e351d2f210309b32d081c832d7de0aca0b077aa10d88336c6379bd01f7e"
 dependencies = [
- "bitflags 1.3.2",
  "cairo-rs",
  "gdk4",
  "glib",
@@ -1340,9 +1114,9 @@ dependencies = [
 
 [[package]]
 name = "gsk4-sys"
-version = "0.6.3"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c07a84fb4dcf1323d29435aa85e2f5f58bef564342bef06775ec7bd0da1f01b0"
+checksum = "12bd9e3effea989f020e8f1ff3fa3b8c63ba93d43b899c11a118868853a56d55"
 dependencies = [
  "cairo-sys-rs",
  "gdk4-sys",
@@ -1356,11 +1130,10 @@ dependencies = [
 
 [[package]]
 name = "gtk4"
-version = "0.6.6"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b28a32a04cd75cef14a0983f8b0c669e0fe152a0a7725accdeb594e2c764c88b"
+checksum = "5aeb51aa3e9728575a053e1f43543cd9992ac2477e1b186ad824fd4adfb70842"
 dependencies = [
- "bitflags 1.3.2",
  "cairo-rs",
  "field-offset",
  "futures-channel",
@@ -1373,18 +1146,17 @@ dependencies = [
  "gtk4-macros",
  "gtk4-sys",
  "libc",
- "once_cell",
  "pango",
 ]
 
 [[package]]
 name = "gtk4-macros"
-version = "0.6.6"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a4d6b61570f76d3ee542d984da443b1cd69b6105264c61afec3abed08c2500f"
+checksum = "d57ec49cf9b657f69a05bca8027cff0a8dfd0c49e812be026fc7311f2163832f"
 dependencies = [
  "anyhow",
- "proc-macro-crate",
+ "proc-macro-crate 1.3.1",
  "proc-macro-error",
  "proc-macro2",
  "quote",
@@ -1393,9 +1165,9 @@ dependencies = [
 
 [[package]]
 name = "gtk4-sys"
-version = "0.6.3"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f8283f707b07e019e76c7f2934bdd4180c277e08aa93f4c0d8dd07b7a34e22f"
+checksum = "54d8c4aa23638ce9faa2caf7e2a27d4a1295af2155c8e8d28c4d4eeca7a65eb8"
 dependencies = [
  "cairo-sys-rs",
  "gdk-pixbuf-sys",
@@ -1421,62 +1193,19 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "futures-util",
- "http 0.2.11",
- "indexmap 2.11.4",
+ "http",
+ "indexmap",
  "slab",
  "tokio",
  "tokio-util",
  "tracing",
 ]
 
-[[package]]
-name = "h2"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c0b69cfcb4e1b9f1bf2f53f95f766e4661169728ec61cd3fe5a0166f2d1386"
-dependencies = [
- "atomic-waker",
- "bytes",
- "fnv",
- "futures-core",
- "futures-sink",
- "http 1.3.1",
- "indexmap 2.11.4",
- "slab",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
-
 [[package]]
 name = "hashbrown"
 version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
-dependencies = [
- "ahash",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5419bdc4f6a9207fbeba6d11b604d481addf78ecd10c11ad51e76c2f6482748d"
-
-[[package]]
-name = "hashlink"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba4ff7128dee98c7dc9794b6a411377e1404dba1c97deb8d1a55297bd25d8af"
-dependencies = [
- "hashbrown 0.14.3",
-]
 
 [[package]]
 name = "heck"
@@ -1484,6 +1213,12 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
 
+[[package]]
+name = "hermit-abi"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d3d0e0f38255e7fa3cf31335b3a56f05febd18025f4db5ef7a0cfb4f8da651f"
+
 [[package]]
 name = "hex"
 version = "0.4.3"
@@ -1519,17 +1254,6 @@ dependencies = [
  "itoa",
 ]
 
-[[package]]
-name = "http"
-version = "1.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4a85d31aea989eead29a3aaf9e1115a180df8282431156e533de47660892565"
-dependencies = [
- "bytes",
- "fnv",
- "itoa",
-]
-
 [[package]]
 name = "http-body"
 version = "0.4.6"
@@ -1537,38 +1261,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
 dependencies = [
  "bytes",
- "http 0.2.11",
- "pin-project-lite",
-]
-
-[[package]]
-name = "http-body"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
-dependencies = [
- "bytes",
- "http 1.3.1",
-]
-
-[[package]]
-name = "http-body-util"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
-dependencies = [
- "bytes",
- "futures-core",
- "http 1.3.1",
- "http-body 1.0.1",
+ "http",
  "pin-project-lite",
 ]
 
 [[package]]
 name = "httparse"
-version = "1.10.1"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
 
 [[package]]
 name = "httpdate"
@@ -1576,6 +1277,12 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
+[[package]]
+name = "humantime"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+
 [[package]]
 name = "hyper"
 version = "0.14.28"
@@ -1586,71 +1293,20 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2 0.3.24",
- "http 0.2.11",
- "http-body 0.4.6",
+ "h2",
+ "http",
+ "http-body",
  "httparse",
  "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2 0.4.10",
+ "socket2 0.5.5",
  "tokio",
  "tower-service",
  "tracing",
  "want",
 ]
 
-[[package]]
-name = "hyper"
-version = "1.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc2b571658e38e0c01b1fdca3bbbe93c00d3d71693ff2770043f8c29bc7d6f80"
-dependencies = [
- "bytes",
- "futures-channel",
- "futures-util",
- "h2 0.4.12",
- "http 1.3.1",
- "http-body 1.0.1",
- "httparse",
- "httpdate",
- "itoa",
- "pin-project-lite",
- "smallvec",
- "tokio",
- "want",
-]
-
-[[package]]
-name = "hyper-rustls"
-version = "0.27.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
-dependencies = [
- "http 1.3.1",
- "hyper 1.6.0",
- "hyper-util",
- "rustls",
- "rustls-pki-types",
- "tokio",
- "tokio-rustls",
- "tower-service",
- "webpki-roots 1.0.2",
-]
-
-[[package]]
-name = "hyper-timeout"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
-dependencies = [
- "hyper 1.6.0",
- "hyper-util",
- "pin-project-lite",
- "tokio",
- "tower-service",
-]
-
 [[package]]
 name = "hyper-tls"
 version = "0.5.0"
@@ -1658,33 +1314,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
 dependencies = [
  "bytes",
- "hyper 0.14.28",
+ "hyper",
  "native-tls",
  "tokio",
  "tokio-native-tls",
 ]
 
-[[package]]
-name = "hyper-util"
-version = "0.1.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c6995591a8f1380fcb4ba966a252a4b29188d51d2b89e3a252f5305be65aea8"
-dependencies = [
- "bytes",
- "futures-channel",
- "futures-core",
- "futures-util",
- "http 1.3.1",
- "http-body 1.0.1",
- "hyper 1.6.0",
- "libc",
- "pin-project-lite",
- "socket2 0.5.10",
- "tokio",
- "tower-service",
- "tracing",
-]
-
 [[package]]
 name = "idna"
 version = "0.5.0"
@@ -1697,22 +1332,12 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "1.9.3"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
-dependencies = [
- "autocfg",
- "hashbrown 0.12.3",
-]
-
-[[package]]
-name = "indexmap"
-version = "2.11.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b0f83760fb341a774ed326568e19f5a863af4a952def8c39f9ab92fd95b88e5"
+checksum = "d530e1a18b1cb4c484e6e34556a0d948706958449fca0cab753d649f2bce3d1f"
 dependencies = [
  "equivalent",
- "hashbrown 0.16.0",
+ "hashbrown",
 ]
 
 [[package]]
@@ -1724,17 +1349,6 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "io-uring"
-version = "0.7.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "046fa2d4d00aea763528b4950358d0ead425372445dc8ff86312b3c69ff7727b"
-dependencies = [
- "bitflags 2.4.2",
- "cfg-if",
- "libc",
-]
-
 [[package]]
 name = "ip_network"
 version = "0.4.1"
@@ -1762,14 +1376,19 @@ name = "ipnet"
 version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f518f335dce6725a761382244631d86cf0ccb2863413590b31338feb467f9c3"
+dependencies = [
+ "serde",
+]
 
 [[package]]
-name = "itertools"
-version = "0.14.0"
+name = "is-terminal"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+checksum = "0bad00257d07be169d870ab665980b06cdb366d792ad690bf2e76876dc503455"
 dependencies = [
- "either",
+ "hermit-abi",
+ "rustix",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1789,11 +1408,10 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.80"
+version = "0.3.67"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "852f13bec5eba4ba9afbeb93fd7c13fe56147f055939ae21c43a29a0ecb2702e"
+checksum = "9a1d36f1235bc969acba30b7f5990b864423a6068a10f7c90ae8f0112e3a59d1"
 dependencies = [
- "once_cell",
  "wasm-bindgen",
 ]
 
@@ -1811,11 +1429,10 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libadwaita"
-version = "0.4.4"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ab9c0843f9f23ff25634df2743690c3a1faffe0a190e60c490878517eb81abf"
+checksum = "2fe7e70c06507ed10a16cda707f358fbe60fe0dc237498f78c686ade92fd979c"
 dependencies = [
- "bitflags 1.3.2",
  "gdk-pixbuf",
  "gdk4",
  "gio",
@@ -1828,9 +1445,9 @@ dependencies = [
 
 [[package]]
 name = "libadwaita-sys"
-version = "0.4.4"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4231cb2499a9f0c4cdfa4885414b33e39901ddcac61150bc0bb4ff8a57ede404"
+checksum = "5e10aaa38de1d53374f90deeb4535209adc40cc5dba37f9704724169bceec69a"
 dependencies = [
  "gdk4-sys",
  "gio-sys",
@@ -1844,9 +1461,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.176"
+version = "0.2.152"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58f929b4d672ea937a23a1ab494143d968337a5f47e56d0815df1e0890ddf174"
+checksum = "13e3bf6590cbc649f4d1a3eefc9d5d6eb746f5200ffb04e5e142700b8faa56e7"
 
 [[package]]
 name = "libloading"
@@ -1868,32 +1485,21 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "libsqlite3-sys"
-version = "0.28.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c10584274047cb335c23d3e61bcef8e323adae7c5c8c760540f73610177fc3f"
-dependencies = [
- "cc",
- "pkg-config",
- "vcpkg",
-]
-
 [[package]]
 name = "libsystemd"
-version = "0.7.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c592dc396b464005f78a5853555b9f240bc5378bf5221acc4e129910b2678869"
+checksum = "88b9597a67aa1c81a6624603e6bd0bcefb9e0f94c9c54970ec53771082104b4e"
 dependencies = [
  "hmac",
  "libc",
  "log",
- "nix 0.27.1",
+ "nix",
  "nom",
  "once_cell",
  "serde",
  "sha2",
- "thiserror 1.0.56",
+ "thiserror",
  "uuid",
 ]
 
@@ -1932,12 +1538,6 @@ version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
 
-[[package]]
-name = "lru-slab"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
-
 [[package]]
 name = "malloc_buf"
 version = "0.0.6"
@@ -1956,12 +1556,6 @@ dependencies = [
  "regex-automata 0.1.10",
 ]
 
-[[package]]
-name = "matchit"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
-
 [[package]]
 name = "memchr"
 version = "2.7.1"
@@ -1994,7 +1588,7 @@ checksum = "59bb584eaeeab6bd0226ccf3509a69d7936d148cf3d036ad350abe35e8c6856e"
 dependencies = [
  "miette-derive",
  "once_cell",
- "thiserror 1.0.56",
+ "thiserror",
  "unicode-width",
 ]
 
@@ -2006,7 +1600,7 @@ checksum = "49e7bc1560b95a3c4a25d03de42fe76ca718ab92d1a22a55b9b4cf67b3ae635c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
@@ -2032,28 +1626,22 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.0.3"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
+checksum = "8f3d0b296e374a4e6f3c7b0a1f5a51d748a0d34c85e7dc48fc3fa9a87657fe09"
 dependencies = [
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
- "windows-sys 0.52.0",
+ "wasi",
+ "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "multimap"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d87ecb2933e8aeadb3e3a02b828fed80a7528047e68b4f424523a0981a3a084"
-
 [[package]]
 name = "nanorand"
 version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a51313c5820b0b02bd422f4b44776fbf47961755c74ce64afc73bfad10226c3"
 dependencies = [
- "getrandom 0.2.12",
+ "getrandom",
 ]
 
 [[package]]
@@ -2087,18 +1675,6 @@ dependencies = [
  "pin-utils",
 ]
 
-[[package]]
-name = "nix"
-version = "0.27.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
-dependencies = [
- "bitflags 2.4.2",
- "cfg-if",
- "libc",
- "memoffset 0.9.0",
-]
-
 [[package]]
 name = "nom"
 version = "7.1.3"
@@ -2119,6 +1695,16 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "num_cpus"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
 [[package]]
 name = "objc"
 version = "0.2.7"
@@ -2192,7 +1778,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
@@ -2213,16 +1799,6 @@ dependencies = [
  "vcpkg",
 ]
 
-[[package]]
-name = "ordered-multimap"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49203cdcae0030493bad186b28da2fa25645fa276a51b6fec8010d281e02ef79"
-dependencies = [
- "dlv-list",
- "hashbrown 0.14.3",
-]
-
 [[package]]
 name = "overload"
 version = "0.1.1"
@@ -2231,11 +1807,10 @@ checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
 
 [[package]]
 name = "pango"
-version = "0.17.10"
+version = "0.18.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35be456fc620e61f62dff7ff70fbd54dcbaf0a4b920c0f16de1107c47d921d48"
+checksum = "7ca27ec1eb0457ab26f3036ea52229edbdb74dee1edd29063f5b9b010e7ebee4"
 dependencies = [
- "bitflags 1.3.2",
  "gio",
  "glib",
  "libc",
@@ -2245,9 +1820,9 @@ dependencies = [
 
 [[package]]
 name = "pango-sys"
-version = "0.17.10"
+version = "0.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3da69f9f3850b0d8990d462f8c709561975e95f689c1cdf0fecdebde78b35195"
+checksum = "436737e391a843e5933d6d9aa102cb126d501e815b83601365a948a518555dc5"
 dependencies = [
  "glib-sys",
  "gobject-sys",
@@ -2291,7 +1866,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7676374caaee8a325c9e7a2ae557f216c5563a171d6997b0ef8a65af35147700"
 dependencies = [
  "base64ct",
- "rand_core 0.6.4",
+ "rand_core",
  "subtle",
 ]
 
@@ -2319,36 +1894,6 @@ version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
-[[package]]
-name = "petgraph"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3672b37090dbd86368a4145bc067582552b29c27377cad4e0a306c97f9bd7772"
-dependencies = [
- "fixedbitset",
- "indexmap 2.11.4",
-]
-
-[[package]]
-name = "pin-project"
-version = "1.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0302c4a0442c456bd56f841aee5c3bfd17967563f6fadc9ceb9f9c23cf3807e0"
-dependencies = [
- "pin-project-internal",
-]
-
-[[package]]
-name = "pin-project-internal"
-version = "1.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "266c042b60c9c76b8d53061e52b2e0d1116abc57cefc8c5cd671619a56ac3690"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
 [[package]]
 name = "pin-project-lite"
 version = "0.2.13"
@@ -2403,7 +1948,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a41cf62165e97c7f814d2221421dbb9afcbcdb0a88068e5ea206e19951c2cbb5"
 dependencies = [
  "proc-macro2",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
@@ -2416,6 +1961,16 @@ dependencies = [
  "toml_edit 0.19.15",
 ]
 
+[[package]]
+name = "proc-macro-crate"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97dc5fea232fc28d2f597b37c4876b348a40e33f3b02cc975c8d006d78d94b1a"
+dependencies = [
+ "toml_datetime",
+ "toml_edit 0.20.2",
+]
+
 [[package]]
 name = "proc-macro-error"
 version = "1.0.4"
@@ -2442,120 +1997,13 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.101"
+version = "1.0.78"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89ae43fd86e4158d6db51ad8e2b80f313af9cc74f5c0e03ccb87de09998732de"
+checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
 dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "prost"
-version = "0.13.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2796faa41db3ec313a31f7624d9286acf277b52de526150b7e69f3debf891ee5"
-dependencies = [
- "bytes",
- "prost-derive",
-]
-
-[[package]]
-name = "prost-build"
-version = "0.13.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
-dependencies = [
- "heck",
- "itertools",
- "log",
- "multimap",
- "once_cell",
- "petgraph",
- "prettyplease",
- "prost",
- "prost-types",
- "regex",
- "syn 2.0.106",
- "tempfile",
-]
-
-[[package]]
-name = "prost-derive"
-version = "0.13.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
-dependencies = [
- "anyhow",
- "itertools",
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "prost-types"
-version = "0.13.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52c2c1bf36ddb1a1c396b3601a3cec27c2462e45f07c386894ec3ccf5332bd16"
-dependencies = [
- "prost",
-]
-
-[[package]]
-name = "quinn"
-version = "0.11.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
-dependencies = [
- "bytes",
- "cfg_aliases",
- "pin-project-lite",
- "quinn-proto",
- "quinn-udp",
- "rustc-hash 2.1.1",
- "rustls",
- "socket2 0.5.10",
- "thiserror 2.0.16",
- "tokio",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-proto"
-version = "0.11.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1906b49b0c3bc04b5fe5d86a77925ae6524a19b816ae38ce1e426255f1d8a31"
-dependencies = [
- "bytes",
- "getrandom 0.3.3",
- "lru-slab",
- "rand 0.9.2",
- "ring",
- "rustc-hash 2.1.1",
- "rustls",
- "rustls-pki-types",
- "slab",
- "thiserror 2.0.16",
- "tinyvec",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-udp"
-version = "0.5.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
-dependencies = [
- "cfg_aliases",
- "libc",
- "once_cell",
- "socket2 0.5.10",
- "tracing",
- "windows-sys 0.52.0",
-]
-
 [[package]]
 name = "quote"
 version = "1.0.35"
@@ -2565,12 +2013,6 @@ dependencies = [
  "proc-macro2",
 ]
 
-[[package]]
-name = "r-efi"
-version = "5.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
-
 [[package]]
 name = "rand"
 version = "0.8.5"
@@ -2578,18 +2020,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
- "rand_chacha 0.3.1",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand"
-version = "0.9.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
-dependencies = [
- "rand_chacha 0.9.0",
- "rand_core 0.9.3",
+ "rand_chacha",
+ "rand_core",
 ]
 
 [[package]]
@@ -2599,17 +2031,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.9.3",
+ "rand_core",
 ]
 
 [[package]]
@@ -2618,16 +2040,7 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom 0.2.12",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
-dependencies = [
- "getrandom 0.3.3",
+ "getrandom",
 ]
 
 [[package]]
@@ -2685,9 +2098,8 @@ checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
 [[package]]
 name = "relm4"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c16f3fad883034773b7f5af4d7e865532b8f3641e5a8bab2a34561a8d960d81"
+version = "0.7.0-beta.2"
+source = "git+https://github.com/Relm4/Relm4#e189eee06b887470e0fd65cbaf6d7c0161bed5ea"
 dependencies = [
  "async-trait",
  "flume",
@@ -2703,13 +2115,12 @@ dependencies = [
 
 [[package]]
 name = "relm4-macros"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9340e2553c0a184a80a0bfa1dcf73c47f3d48933aa6be90724b202f9fbd24735"
+version = "0.7.0-beta.2"
+source = "git+https://github.com/Relm4/Relm4#e189eee06b887470e0fd65cbaf6d7c0161bed5ea"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
@@ -2718,15 +2129,15 @@ version = "0.11.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37b1ae8d9ac08420c66222fb9096fc5de435c3c48542bc5336c51892cffafb41"
 dependencies = [
- "base64 0.21.7",
+ "base64",
  "bytes",
  "encoding_rs",
  "futures-core",
  "futures-util",
- "h2 0.3.24",
- "http 0.2.11",
- "http-body 0.4.6",
- "hyper 0.14.28",
+ "h2",
+ "http",
+ "http-body",
+ "hyper",
  "hyper-tls",
  "ipnet",
  "js-sys",
@@ -2747,49 +2158,7 @@ dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
- "winreg 0.50.0",
-]
-
-[[package]]
-name = "reqwest"
-version = "0.12.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7d6d2a27d57148378eb5e111173f4276ad26340ecc5c49a4a2152167a2d6a37"
-dependencies = [
- "base64 0.22.1",
- "bytes",
- "futures-core",
- "futures-util",
- "http 1.3.1",
- "http-body 1.0.1",
- "http-body-util",
- "hyper 1.6.0",
- "hyper-rustls",
- "hyper-util",
- "ipnet",
- "js-sys",
- "log",
- "mime",
- "once_cell",
- "percent-encoding",
- "pin-project-lite",
- "quinn",
- "rustls",
- "rustls-pemfile",
- "rustls-pki-types",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper",
- "tokio",
- "tokio-rustls",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
- "webpki-roots 0.26.11",
- "winreg 0.52.0",
+ "winreg",
 ]
 
 [[package]]
@@ -2799,37 +2168,13 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "688c63d65483050968b2a8937f7995f443e27041a0f7700aa59b0822aedebb74"
 dependencies = [
  "cc",
- "getrandom 0.2.12",
+ "getrandom",
  "libc",
  "spin",
  "untrusted",
  "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "rusqlite"
-version = "0.31.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b838eba278d213a8beaf485bd313fd580ca4505a00d5871caeb1457c55322cae"
-dependencies = [
- "bitflags 2.4.2",
- "fallible-iterator",
- "fallible-streaming-iterator",
- "hashlink",
- "libsqlite3-sys",
- "smallvec",
-]
-
-[[package]]
-name = "rust-ini"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "796e8d2b6696392a43bea58116b667fb4c29727dc5abd27d6acf338bb4f688c7"
-dependencies = [
- "cfg-if",
- "ordered-multimap",
-]
-
 [[package]]
 name = "rustc-demangle"
 version = "0.1.23"
@@ -2842,12 +2187,6 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
-[[package]]
-name = "rustc-hash"
-version = "2.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
-
 [[package]]
 name = "rustc_version"
 version = "0.4.0"
@@ -2870,56 +2209,6 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "rustls"
-version = "0.23.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0ebcbd2f03de0fc1122ad9bb24b127a5a6cd51d72604a3f3c50ac459762b6cc"
-dependencies = [
- "once_cell",
- "ring",
- "rustls-pki-types",
- "rustls-webpki",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "rustls-pemfile"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
-dependencies = [
- "rustls-pki-types",
-]
-
-[[package]]
-name = "rustls-pki-types"
-version = "1.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79"
-dependencies = [
- "web-time",
- "zeroize",
-]
-
-[[package]]
-name = "rustls-webpki"
-version = "0.103.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8572f3c2cb9934231157b45499fc41e1f58c589fdfb81a844ba873265e80f8eb"
-dependencies = [
- "ring",
- "rustls-pki-types",
- "untrusted",
-]
-
-[[package]]
-name = "rustversion"
-version = "1.0.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
-
 [[package]]
 name = "ryu"
 version = "1.0.16"
@@ -2996,32 +2285,22 @@ checksum = "b97ed7a9823b74f99c7742f5336af7be5ecd3eeafcb1507d1fa93347b1d589b0"
 
 [[package]]
 name = "serde"
-version = "1.0.226"
+version = "1.0.195"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0dca6411025b24b60bfa7ec1fe1f8e710ac09782dca409ee8237ba74b51295fd"
-dependencies = [
- "serde_core",
- "serde_derive",
-]
-
-[[package]]
-name = "serde_core"
-version = "1.0.226"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba2ba63999edb9dac981fb34b3e5c0d111a69b0924e253ed29d83f7c99e966a4"
+checksum = "63261df402c67811e9ac6def069e4786148c4563f4b50fd4bf30aa370d626b02"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.226"
+version = "1.0.195"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8db53ae22f34573731bafa1db20f04027b2d25e02d8205921b569171699cdb33"
+checksum = "46fe8f8603d81ba86327b23a2e9cdf49e1255fb94a4c5f297f6ee0547178ea2c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
@@ -3046,22 +2325,11 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "serde_path_to_error"
-version = "0.1.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
-dependencies = [
- "itoa",
- "serde",
- "serde_core",
-]
-
 [[package]]
 name = "serde_spanned"
-version = "0.6.9"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+checksum = "eb3622f419d1296904700073ea6cc23ad690adbd66f13ea683df73298736f0c1"
 dependencies = [
  "serde",
 ]
@@ -3126,15 +2394,6 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
-[[package]]
-name = "signal-hook-registry"
-version = "1.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2a4719bff48cee6b39d12c020eeb490953ad2443b7055bd0b21fca26bd8c28b"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "slab"
 version = "0.4.9"
@@ -3162,12 +2421,12 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.5.10"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
+checksum = "7b5fac59a5cb5dd637972e5fca70daf0523c9067fcdc4842f053dae04a18f8e9"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -3185,13 +2444,13 @@ version = "9.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "da7a2b3c2bc9693bcb40870c4e9b5bf0d79f9cb46273321bf855ec513e919082"
 dependencies = [
- "base64 0.21.7",
+ "base64",
  "digest",
  "hex",
  "miette",
  "sha-1",
  "sha2",
- "thiserror 1.0.56",
+ "thiserror",
  "xxhash-rust",
 ]
 
@@ -3220,21 +2479,15 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.106"
+version = "2.0.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ede7c438028d4436d71104916910f5bb611972c5cfd7f89b8300a8186e6fada6"
+checksum = "0f3531638e407dfc0814761abb7c00a5b54992b849452a0646b7f65c9f770f3f"
 dependencies = [
  "proc-macro2",
  "quote",
  "unicode-ident",
 ]
 
-[[package]]
-name = "sync_wrapper"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
-
 [[package]]
 name = "system-configuration"
 version = "0.5.1"
@@ -3294,22 +2547,22 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "termcolor"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
+dependencies = [
+ "winapi-util",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d54378c645627613241d077a3a79db965db602882668f9136ac42af9ecb730ad"
 dependencies = [
- "thiserror-impl 1.0.56",
-]
-
-[[package]]
-name = "thiserror"
-version = "2.0.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3467d614147380f2e4e374161426ff399c91084acd2363eaf549172b3d5e60c0"
-dependencies = [
- "thiserror-impl 2.0.16",
+ "thiserror-impl",
 ]
 
 [[package]]
@@ -3320,18 +2573,7 @@ checksum = "fa0faa943b50f3db30a20aa7e265dbc66076993efed8463e8de414e5d06d3471"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "2.0.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c5e1be1c48b9172ee610da68fd9cd2770e7a4056cb3fc98710ee6906f0c7960"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
@@ -3362,15 +2604,6 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
-[[package]]
-name = "tiny-keccak"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c9d3793400a45f954c52e73d068316d76b6f4e36977e3fcebb13a2721e80237"
-dependencies = [
- "crunchy",
-]
-
 [[package]]
 name = "tinyvec"
 version = "1.6.0"
@@ -3388,33 +2621,30 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.46.1"
+version = "1.35.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cc3a2344dafbe23a245241fe8b09735b521110d30fcefbbd5feb1797ca35d17"
+checksum = "c89b4efa943be685f629b149f53829423f8f5531ea21249408e8e2f8671ec104"
 dependencies = [
  "backtrace",
  "bytes",
- "io-uring",
  "libc",
  "mio",
+ "num_cpus",
  "pin-project-lite",
- "signal-hook-registry",
- "slab",
- "socket2 0.5.10",
+ "socket2 0.5.5",
  "tokio-macros",
- "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "2.5.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
+checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
@@ -3427,27 +2657,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "tokio-rustls"
-version = "0.26.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f63835928ca123f1bef57abbcd23bb2ba0ac9ae1235f1e65bda0d06e7786bd"
-dependencies = [
- "rustls",
- "tokio",
-]
-
-[[package]]
-name = "tokio-stream"
-version = "0.1.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eca58d7bba4a75707817a2c44174253f9236b2d5fbd055602e9d5c07c139a047"
-dependencies = [
- "futures-core",
- "pin-project-lite",
- "tokio",
-]
-
 [[package]]
 name = "tokio-util"
 version = "0.7.10"
@@ -3464,21 +2673,21 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.8.23"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
+checksum = "185d8ab0dfbb35cf1399a6344d8484209c088f75f8f68230da55d48d95d43e3d"
 dependencies = [
  "serde",
  "serde_spanned",
  "toml_datetime",
- "toml_edit 0.22.27",
+ "toml_edit 0.20.2",
 ]
 
 [[package]]
 name = "toml_datetime"
-version = "0.6.11"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
+checksum = "7cda73e2f1397b1262d6dfdcef8aafae14d1de7748d66822d3bfeeb6d03e5e4b"
 dependencies = [
  "serde",
 ]
@@ -3489,101 +2698,24 @@ version = "0.19.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
 dependencies = [
- "indexmap 2.11.4",
+ "indexmap",
  "toml_datetime",
- "winnow 0.5.34",
+ "winnow",
 ]
 
 [[package]]
 name = "toml_edit"
-version = "0.22.27"
+version = "0.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
+checksum = "396e4d48bbb2b7554c944bde63101b5ae446cff6ec4a24227428f15eb72ef338"
 dependencies = [
- "indexmap 2.11.4",
+ "indexmap",
  "serde",
  "serde_spanned",
  "toml_datetime",
- "toml_write",
- "winnow 0.7.13",
+ "winnow",
 ]
 
-[[package]]
-name = "toml_write"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
-
-[[package]]
-name = "tonic"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877c5b330756d856ffcc4553ab34a5684481ade925ecc54bcd1bf02b1d0d4d52"
-dependencies = [
- "async-stream 0.3.6",
- "async-trait",
- "axum",
- "base64 0.22.1",
- "bytes",
- "h2 0.4.12",
- "http 1.3.1",
- "http-body 1.0.1",
- "http-body-util",
- "hyper 1.6.0",
- "hyper-timeout",
- "hyper-util",
- "percent-encoding",
- "pin-project",
- "prost",
- "socket2 0.5.10",
- "tokio",
- "tokio-stream",
- "tower",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "tonic-build"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9557ce109ea773b399c9b9e5dca39294110b74f1f342cb347a80d1fce8c26a11"
-dependencies = [
- "prettyplease",
- "proc-macro2",
- "prost-build",
- "prost-types",
- "quote",
- "syn 2.0.106",
-]
-
-[[package]]
-name = "tower"
-version = "0.4.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
-dependencies = [
- "futures-core",
- "futures-util",
- "indexmap 1.9.3",
- "pin-project",
- "pin-project-lite",
- "rand 0.8.5",
- "slab",
- "tokio",
- "tokio-util",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "tower-layer"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
-
 [[package]]
 name = "tower-service"
 version = "0.3.2"
@@ -3596,7 +2728,6 @@ version = "0.1.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
 dependencies = [
- "log",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -3610,7 +2741,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
@@ -3708,11 +2839,11 @@ dependencies = [
  "libc",
  "libloading 0.7.4",
  "log",
- "nix 0.26.4",
- "reqwest 0.11.23",
+ "nix",
+ "reqwest",
  "schemars",
  "serde",
- "socket2 0.5.10",
+ "socket2 0.4.10",
  "ssri",
  "tempfile",
  "tokio",
@@ -3794,6 +2925,7 @@ version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f00cc9702ca12d3c81455259621e676d0f7251cec66a21e98fe2e9a37db93b2a"
 dependencies = [
+ "getrandom",
  "serde",
 ]
 
@@ -3836,48 +2968,28 @@ version = "0.11.0+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
-[[package]]
-name = "wasi"
-version = "0.14.7+wasi-0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "883478de20367e224c0090af9cf5f9fa85bed63a95c1abf3afc5c083ebc06e8c"
-dependencies = [
- "wasip2",
-]
-
-[[package]]
-name = "wasip2"
-version = "1.0.1+wasi-0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
-dependencies = [
- "wit-bindgen",
-]
-
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.103"
+version = "0.2.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab10a69fbd0a177f5f649ad4d8d3305499c42bab9aef2f7ff592d0ec8f833819"
+checksum = "b1223296a201415c7fad14792dbefaace9bd52b62d33453ade1c5b5f07555406"
 dependencies = [
  "cfg-if",
- "once_cell",
- "rustversion",
  "wasm-bindgen-macro",
- "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.103"
+version = "0.2.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bb702423545a6007bbc368fde243ba47ca275e549c8a28617f56f6ba53b1d1c"
+checksum = "fcdc935b63408d58a32f8cc9738a0bffd8f05cc7c002086c6ef20b7312ad9dcd"
 dependencies = [
  "bumpalo",
  "log",
+ "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
  "wasm-bindgen-shared",
 ]
 
@@ -3895,9 +3007,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.103"
+version = "0.2.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc65f4f411d91494355917b605e1480033152658d71f722a90647f56a70c88a0"
+checksum = "3e4c238561b2d428924c49815533a8b9121c664599558a5d9ec51f8a1740a999"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -3905,25 +3017,22 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.103"
+version = "0.2.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffc003a991398a8ee604a401e194b6b3a39677b3173d6e74495eb51b82e99a32"
+checksum = "bae1abb6806dc1ad9e560ed242107c0f6c84335f1749dd4e8ddb012ebd5e25a7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.103"
+version = "0.2.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "293c37f4efa430ca14db3721dfbe48d8c33308096bd44d80ebaa775ab71ba1cf"
-dependencies = [
- "unicode-ident",
-]
+checksum = "4d91413b1c31d7539ba5ef2451af3f0b833a005eb27a631cec32bc0635a8602b"
 
 [[package]]
 name = "web-sys"
@@ -3935,34 +3044,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "web-time"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "webpki-roots"
-version = "0.26.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
-dependencies = [
- "webpki-roots 1.0.2",
-]
-
-[[package]]
-name = "webpki-roots"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e8983c3ab33d6fb807cfcdad2491c4ea8cbc8ed839181c7dfd9c67c83e261b2"
-dependencies = [
- "rustls-pki-types",
-]
-
 [[package]]
 name = "which"
 version = "4.4.2"
@@ -3997,6 +3078,15 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
+[[package]]
+name = "winapi-util"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
+dependencies = [
+ "winapi",
+]
+
 [[package]]
 name = "winapi-x86_64-pc-windows-gnu"
 version = "0.4.0"
@@ -4153,15 +3243,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "winnow"
-version = "0.7.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21a0236b59786fed61e2a80582dd500fe61f18b5dca67a4a067d0bc9039339cf"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "winreg"
 version = "0.50.0"
@@ -4172,22 +3253,6 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "winreg"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a277a57398d4bfa075df44f501a17cfdf8542d224f0d36095a2adc7aee4ef0a5"
-dependencies = [
- "cfg-if",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "wit-bindgen"
-version = "0.46.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
-
 [[package]]
 name = "x25519-dalek"
 version = "2.0.0"
@@ -4195,7 +3260,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fb66477291e7e8d2b0ff1bcb900bf29489a9692816d79874bea351e7a8b6de96"
 dependencies = [
  "curve25519-dalek",
- "rand_core 0.6.4",
+ "rand_core",
  "serde",
  "zeroize",
 ]
@@ -4206,26 +3271,6 @@ version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53be06678ed9e83edb1745eb72efc0bbcd7b5c3c35711a860906aed827a13d61"
 
-[[package]]
-name = "zerocopy"
-version = "0.8.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0894878a5fa3edfd6da3f88c4805f4c8558e2b996227a3d864f47fe11e38282c"
-dependencies = [
- "zerocopy-derive",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.8.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88d2b8d9c68ad2b9e4340d7832716a4d21a22a1154777ad56ea55c51a9cf3831"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
 [[package]]
 name = "zeroize"
 version = "1.7.0"
@@ -4243,7 +3288,7 @@ checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 2.0.48",
 ]
 
 [[package]]
diff --git a/burrow-gtk/Cargo.toml b/burrow-gtk/Cargo.toml
index b12577a..244c161 100644
--- a/burrow-gtk/Cargo.toml
+++ b/burrow-gtk/Cargo.toml
@@ -7,12 +7,10 @@ edition = "2021"
 
 [dependencies]
 anyhow = "1.0"
-relm4 = { version = "0.6", features = ["libadwaita", "gnome_44"]}
+relm4 = { features = ["libadwaita", "gnome_45"], git = "https://github.com/Relm4/Relm4" }
 burrow = { version = "*", path = "../burrow/" }
 tokio = { version = "1.35.0", features = ["time", "sync"] }
 gettext-rs = { version = "0.7.0", features = ["gettext-system"] }
-serde = { version = "1.0", features = ["derive"] }
-serde_json = "1.0"
 
 [build-dependencies]
 anyhow = "1.0"
diff --git a/burrow-gtk/build-aux/Dockerfile b/burrow-gtk/build-aux/Dockerfile
deleted file mode 100644
index 834e450..0000000
--- a/burrow-gtk/build-aux/Dockerfile
+++ /dev/null
@@ -1,20 +0,0 @@
-FROM fedora:39
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN set -eux && \
-    dnf update -y && \
-    dnf install -y clang ninja-build cmake meson gtk4-devel glib2-devel libadwaita-devel desktop-file-utils libappstream-glib util-linux wget fuse fuse-libs file sqlite sqlite-devel protobuf-compiler protobuf-devel
-
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
-ENV PATH="/root/.cargo/bin:${PATH}"
-
-WORKDIR /app
-COPY . /app
-
-ENV SQLITE3_STATIC=1
-
-RUN cd /app/burrow-gtk/ && \
-    ./build-aux/build_appimage.sh
-
-
diff --git a/burrow-gtk/build-aux/build_appimage.sh b/burrow-gtk/build-aux/build_appimage.sh
deleted file mode 100755
index f054cd9..0000000
--- a/burrow-gtk/build-aux/build_appimage.sh
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/bin/bash
-
-set -ex
-
-BURROW_GTK_ROOT="$(readlink -f $(dirname -- "$(readlink -f -- "$BASH_SOURCE")")/..)"
-BURROW_GTK_BUILD="$BURROW_GTK_ROOT/build-appimage"
-LINUXDEPLOY_VERSION="${LINUXDEPLOY_VERSION:-"1-alpha-20240109-1"}"
-BURROW_BUILD_TYPE="${BURROW_BUILD_TYPE:-"release"}"
-
-if [ "$BURROW_GTK_ROOT" != $(pwd) ]; then
-    echo "Make sure to cd into burrow-gtk"
-    exit 1
-fi
-
-ARCHITECTURE=$(lscpu | grep Architecture | awk '{print $2}')
-
-if [ "$ARCHITECTURE" == "x86_64" ]; then
-    wget "https://github.com/linuxdeploy/linuxdeploy/releases/download/$LINUXDEPLOY_VERSION/linuxdeploy-x86_64.AppImage" -o /dev/null -O /tmp/linuxdeploy
-    chmod a+x /tmp/linuxdeploy
-elif [ "$ARCHITECTURE" == "aarch64" ]; then
-    wget "https://github.com/linuxdeploy/linuxdeploy/releases/download/$LINUXDEPLOY_VERSION/linuxdeploy-aarch64.AppImage" -o /dev/null -O /tmp/linuxdeploy
-    chmod a+x /tmp/linuxdeploy
-fi
-
-
-CFLAGS="-I/usr/local/include -I/usr/include/$MUSL_TARGET -fPIE"
-meson setup $BURROW_GTK_BUILD --bindir bin --prefix /usr --buildtype $BURROW_BUILD_TYPE
-meson compile -C $BURROW_GTK_BUILD
-DESTDIR=AppDir meson install -C $BURROW_GTK_BUILD
-cargo b --$BURROW_BUILD_TYPE --manifest-path=../Cargo.toml
-/tmp/linuxdeploy --appimage-extract-and-run --appdir $BURROW_GTK_BUILD/AppDir -e $BURROW_GTK_BUILD/../../target/$BURROW_BUILD_TYPE/burrow --output appimage
-mv *.AppImage $BURROW_GTK_BUILD
diff --git a/burrow-gtk/data/icons/hicolor/128/apps/burrow-gtk.png b/burrow-gtk/data/icons/hicolor/128/apps/burrow-gtk.png
deleted file mode 100644
index 54b67da..0000000
Binary files a/burrow-gtk/data/icons/hicolor/128/apps/burrow-gtk.png and /dev/null differ
diff --git a/burrow-gtk/data/icons/hicolor/16/apps/burrow-gtk.png b/burrow-gtk/data/icons/hicolor/16/apps/burrow-gtk.png
deleted file mode 100644
index cf418ae..0000000
Binary files a/burrow-gtk/data/icons/hicolor/16/apps/burrow-gtk.png and /dev/null differ
diff --git a/burrow-gtk/data/icons/hicolor/24/apps/burrow-gtk.png b/burrow-gtk/data/icons/hicolor/24/apps/burrow-gtk.png
deleted file mode 100644
index cfe8e33..0000000
Binary files a/burrow-gtk/data/icons/hicolor/24/apps/burrow-gtk.png and /dev/null differ
diff --git a/burrow-gtk/data/icons/hicolor/256/apps/burrow-gtk.png b/burrow-gtk/data/icons/hicolor/256/apps/burrow-gtk.png
deleted file mode 100644
index 561abcb..0000000
Binary files a/burrow-gtk/data/icons/hicolor/256/apps/burrow-gtk.png and /dev/null differ
diff --git a/burrow-gtk/data/icons/hicolor/32/apps/burrow-gtk.png b/burrow-gtk/data/icons/hicolor/32/apps/burrow-gtk.png
deleted file mode 100644
index 52e7a25..0000000
Binary files a/burrow-gtk/data/icons/hicolor/32/apps/burrow-gtk.png and /dev/null differ
diff --git a/burrow-gtk/data/icons/hicolor/48/apps/burrow-gtk.png b/burrow-gtk/data/icons/hicolor/48/apps/burrow-gtk.png
deleted file mode 100644
index 68cf88b..0000000
Binary files a/burrow-gtk/data/icons/hicolor/48/apps/burrow-gtk.png and /dev/null differ
diff --git a/burrow-gtk/data/icons/hicolor/512/apps/burrow-gtk.png b/burrow-gtk/data/icons/hicolor/512/apps/burrow-gtk.png
deleted file mode 100644
index c5997ae..0000000
Binary files a/burrow-gtk/data/icons/hicolor/512/apps/burrow-gtk.png and /dev/null differ
diff --git a/burrow-gtk/data/icons/hicolor/64/apps/burrow-gtk.png b/burrow-gtk/data/icons/hicolor/64/apps/burrow-gtk.png
deleted file mode 100644
index 46872b4..0000000
Binary files a/burrow-gtk/data/icons/hicolor/64/apps/burrow-gtk.png and /dev/null differ
diff --git a/burrow-gtk/data/icons/hicolor/scalable/apps/burrow-gtk.svg b/burrow-gtk/data/icons/hicolor/scalable/apps/burrow-gtk.svg
new file mode 100644
index 0000000..a74c4df
--- /dev/null
+++ b/burrow-gtk/data/icons/hicolor/scalable/apps/burrow-gtk.svg
@@ -0,0 +1,130 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   width="33.750061mm"
+   height="33.750061mm"
+   viewBox="0 0 33.750061 33.750061"
+   version="1.1"
+   id="svg974">
+  <defs
+     id="defs968">
+    <clipPath
+       clipPathUnits="userSpaceOnUse"
+       id="clipPath18689">
+      <rect
+         clip-path="none"
+         transform="rotate(45)"
+         ry="32.000008"
+         rx="32.000008"
+         y="123.9986"
+         x="486.03726"
+         height="362.94299"
+         width="362.94299"
+         id="rect18691"
+         style="display:inline;opacity:1;vector-effect:none;fill:#4a86cf;fill-opacity:1;stroke:none;stroke-width:26.0669;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;marker-start:none;marker-mid:none;marker-end:none;paint-order:normal;enable-background:new" />
+    </clipPath>
+    <clipPath
+       clipPathUnits="userSpaceOnUse"
+       id="clipPath18689-3">
+      <rect
+         clip-path="none"
+         transform="rotate(45)"
+         ry="32.000008"
+         rx="32.000008"
+         y="123.9986"
+         x="486.03726"
+         height="362.94299"
+         width="362.94299"
+         id="rect18691-6"
+         style="display:inline;opacity:1;vector-effect:none;fill:#4a86cf;fill-opacity:1;stroke:none;stroke-width:26.0669;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;marker-start:none;marker-mid:none;marker-end:none;paint-order:normal;enable-background:new" />
+    </clipPath>
+  </defs>
+  <metadata
+     id="metadata971">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     id="layer1"
+     transform="translate(-61.819823,-103.94395)">
+    <g
+       transform="matrix(0.26367235,0,0,0.26367235,61.819823,-529.39703)"
+       style="display:inline;stroke-width:0.25;enable-background:new"
+       id="g1836">
+      <title
+         id="title1838">application-x-executable</title>
+      <g
+         transform="matrix(0.25,0,0,0.25,0,2295)"
+         id="g18818"
+         style="stroke-width:0.25">
+        <g
+           style="stroke-width:0.269963"
+           transform="matrix(0.92605186,0,0,0.92605186,18.930729,50.876335)"
+           id="g18590">
+          <g
+             style="stroke-width:0.269963"
+             id="g18681"
+             clip-path="url(#clipPath18689-3)">
+            <rect
+               style="opacity:1;vector-effect:none;fill:#3584e4;fill-opacity:1;stroke:none;stroke-width:8.22095;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;marker-start:none;marker-mid:none;marker-end:none;paint-order:normal"
+               id="rect18571"
+               width="424"
+               height="424"
+               x="458.33722"
+               y="90.641701"
+               rx="10.092117"
+               ry="10.092117"
+               transform="matrix(0.60528171,0.60528171,-0.60528171,0.60528171,33.440632,99.073632)"
+               clip-path="none" />
+            <circle
+               style="opacity:1;vector-effect:none;fill:#f66151;fill-opacity:1;stroke:none;stroke-width:7.03712;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;marker-start:none;marker-mid:none;marker-end:none;paint-order:normal"
+               id="path18706"
+               cx="0"
+               cy="0"
+               r="0"
+               transform="translate(0,-212)" />
+            <circle
+               style="opacity:1;vector-effect:none;fill:#f66151;fill-opacity:1;stroke:none;stroke-width:7.03712;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;marker-start:none;marker-mid:none;marker-end:none;paint-order:normal"
+               id="path18708"
+               cx="0"
+               cy="0"
+               r="0"
+               transform="translate(0,-212)" />
+            <path
+               style="display:inline;opacity:1;vector-effect:none;fill:#98c1f1;fill-opacity:1;stroke:none;stroke-width:7.03712;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;marker-start:none;marker-mid:none;marker-end:none;paint-order:normal;enable-background:new"
+               d="m 408.91993,561.9183 -9.8861,29.82892 a 172.97099,172.97099 0 0 0 -1.42693,-0.0713 172.97099,172.97099 0 0 0 -23.92891,1.85189 l -13.80082,-28.50125 a 203.29325,203.29325 0 0 0 -29.40085,7.97217 l 2.28619,31.40474 a 172.97099,172.97099 0 0 0 -22.73152,11.31923 l -23.71796,-21.103 a 203.29325,203.29325 0 0 0 -24.05918,18.6741 l 14.09863,28.07319 a 172.97099,172.97099 0 0 0 -16.63608,19.21074 l -30.05845,-10.44758 a 203.29325,203.29325 0 0 0 -15.01683,26.48807 l 23.73035,20.50738 a 172.97099,172.97099 0 0 0 -7.98456,24.14293 l -31.73044,1.84879 a 203.29325,203.29325 0 0 0 -3.77825,30.21664 l 29.82892,9.8861 a 172.97099,172.97099 0 0 0 -0.0713,1.42693 172.97099,172.97099 0 0 0 1.85188,23.92889 l -28.50125,13.80084 a 203.29325,203.29325 0 0 0 7.97215,29.40084 l 31.40475,-2.28619 a 172.97099,172.97099 0 0 0 11.31922,22.73152 l -21.10296,23.71797 a 203.29325,203.29325 0 0 0 18.67409,24.05918 l 28.07319,-14.09863 a 172.97099,172.97099 0 0 0 19.21074,16.63606 l -10.44758,30.05847 a 203.29325,203.29325 0 0 0 26.48806,15.01683 l 20.50739,-23.73036 a 172.97099,172.97099 0 0 0 24.14293,7.98457 l 1.8488,31.73043 a 203.29325,203.29325 0 0 0 30.21666,3.77826 l 9.8861,-29.82892 a 172.97099,172.97099 0 0 0 1.42693,0.0713 172.97099,172.97099 0 0 0 23.9289,-1.85188 l 13.80084,28.50125 a 203.29325,203.29325 0 0 0 29.40084,-7.97217 l -2.2862,-31.40474 a 172.97099,172.97099 0 0 0 22.73153,-11.31922 l 23.71796,21.10297 A 203.29325,203.29325 0 0 0 532.96,916.00016 l -14.09864,-28.07319 a 172.97099,172.97099 0 0 0 16.63607,-19.21073 l 30.05846,10.44757 a 203.29325,203.29325 0 0 0 15.01683,-26.48807 l -23.73036,-20.50738 a 172.97099,172.97099 0 0 0 7.98457,-24.14293 l 31.73044,-1.84879 a 203.29325,203.29325 0 0 0 3.77825,-30.21667 l -29.82892,-9.8861 a 172.97099,172.97099 0 0 0 0.0713,-1.42692 172.97099,172.97099 0 0 0 -1.85189,-23.9289 l 28.50124,-13.80084 a 203.29325,203.29325 0 0 0 -7.97215,-29.40084 l -31.40474,2.2862 a 172.97099,172.97099 0 0 0 -11.31923,-22.73153 l 21.10297,-23.71797 a 203.29325,203.29325 0 0 0 -18.67409,-24.05918 l -28.07319,14.09863 a 172.97099,172.97099 0 0 0 -19.21074,-16.63606 l 10.44757,-30.05847 A 203.29325,203.29325 0 0 0 485.6357,581.68117 l -20.50738,23.73035 a 172.97099,172.97099 0 0 0 -24.14293,-7.98455 l -1.84879,-31.73044 a 203.29325,203.29325 0 0 0 -30.21667,-3.77826 z M 397.6069,637.72208 A 126.92605,126.92605 0 0 1 524.5318,764.64699 126.92605,126.92605 0 0 1 397.6069,891.57189 126.92605,126.92605 0 0 1 270.682,764.64699 126.92605,126.92605 0 0 1 397.6069,637.72208 Z"
+               id="path18717-4" />
+            <path
+               id="path18758"
+               d="m 51.748325,401.28402 -9.8861,29.82892 c -0.475543,-0.0257 -0.951191,-0.0495 -1.42693,-0.0713 -8.00956,0.0625 -16.005106,0.6813 -23.92891,1.85189 L 2.7055639,404.39228 c -9.9858697,1.91835 -19.8137359,4.58322 -29.4008489,7.97217 l 2.28619,31.40474 c -7.844275,3.21103 -15.441918,6.9943 -22.73152,11.31923 l -23.71796,-21.103 c -8.475372,5.61437 -16.517661,11.85658 -24.05918,18.6741 l 14.09863,28.07319 c -6.008901,5.98701 -11.569263,12.40791 -16.636077,19.21074 l -30.058438,-10.44758 c -5.66072,8.44155 -10.68041,17.29574 -15.01683,26.48807 l 23.73035,20.50738 c -3.25027,7.84084 -5.919,15.91028 -7.98456,24.14293 l -31.73044,1.84879 c -2.01308,9.96359 -3.27604,20.06413 -3.77825,30.21664 l 29.82892,9.8861 c -0.0257,0.47554 -0.0495,0.95119 -0.0713,1.42693 0.0625,8.00955 0.68129,16.00509 1.85188,23.92889 l -28.50125,13.80084 c 1.91835,9.98587 4.58321,19.81373 7.97215,29.40084 l 31.40475,-2.28619 c 3.21102,7.84427 6.99429,15.44192 11.31922,22.73152 l -21.10296,23.71797 c 5.61437,8.47537 11.85658,16.51766 18.67409,24.05918 l 28.073175,-14.09863 c 5.987006,6.00889 12.407911,11.56925 19.21074,16.63606 l -10.44758,30.05847 c 8.441549,5.66072 17.295731,10.68041 26.48806,15.01683 l 20.50739,-23.73036 c 7.840839,3.25027 15.910282,5.91901 24.142929,7.98457 l 1.8488,31.73043 c 9.9635962,2.01309 20.064147,3.27605 30.216661,3.77826 l 9.8861,-29.82892 c 0.475543,0.0257 0.951191,0.0495 1.42693,0.0713 8.009557,-0.0625 16.005099,-0.68129 23.9289,-1.85188 l 13.80084,28.50125 c 9.985867,-1.91835 19.813731,-4.58322 29.400855,-7.97217 l -2.2862,-31.40474 c 7.84428,-3.21102 15.44192,-6.99429 22.73153,-11.31922 l 23.71796,21.10297 c 8.47538,-5.61437 16.51767,-11.85658 24.05919,-18.6741 l -14.09864,-28.07319 c 6.0089,-5.987 11.56926,-12.4079 16.63607,-19.21073 l 30.05846,10.44757 c 5.66072,-8.44155 10.68041,-17.29574 15.01683,-26.48807 l -23.73036,-20.50738 c 3.25027,-7.84084 5.91901,-15.91028 7.98457,-24.14293 l 31.73044,-1.84879 c 2.01308,-9.9636 3.27604,-20.06415 3.77825,-30.21667 l -29.82892,-9.8861 c 0.0257,-0.47554 0.0495,-0.95118 0.0713,-1.42692 -0.0625,-8.00956 -0.6813,-16.0051 -1.85189,-23.9289 l 28.50124,-13.80084 c -1.91835,-9.98587 -4.58321,-19.81373 -7.97215,-29.40084 l -31.40474,2.2862 c -3.21103,-7.84428 -6.9943,-15.44192 -11.31923,-22.73153 l 21.10297,-23.71797 c -5.61437,-8.47537 -11.85658,-16.51766 -18.67409,-24.05918 l -28.07319,14.09863 c -5.98701,-6.00889 -12.40791,-11.56925 -19.21074,-16.63606 l 10.44757,-30.05847 c -8.44155,-5.66072 -17.29572,-10.6804 -26.48805,-15.01682 l -20.50738,23.73035 c -7.84085,-3.25027 -15.910298,-5.91899 -24.142945,-7.98455 l -1.84879,-31.73044 c -9.9636,-2.01309 -20.064152,-3.27605 -30.21667,-3.77826 z"
+               style="display:inline;opacity:1;vector-effect:none;fill:#1a5fb4;fill-opacity:1;stroke:none;stroke-width:7.03712;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;marker-start:none;marker-mid:none;marker-end:none;paint-order:normal;enable-background:new" />
+          </g>
+        </g>
+        <path
+           style="display:inline;opacity:0.534;vector-effect:none;fill:#1a5fb4;fill-opacity:1;stroke:none;stroke-width:1.62918;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;marker-start:none;marker-mid:none;marker-end:none;paint-order:normal;enable-background:new"
+           clip-path="none"
+           d="m 8.4765625,2676 c -1.1711695,2.8866 -0.5827763,6.3078 1.7656255,8.6562 l 48.101562,48.1016 c 3.133898,3.1339 8.178602,3.1339 11.3125,0 l 48.10156,-48.1016 c 2.3484,-2.3484 2.9368,-5.7696 1.76563,-8.6562 -0.39174,0.9655 -0.98013,1.8708 -1.76563,2.6562 l -48.10156,48.1016 c -3.133898,3.1339 -8.178602,3.1339 -11.3125,0 L 10.242188,2678.6562 C 9.4566904,2677.8708 8.8682972,2676.9655 8.4765625,2676 Z"
+           transform="matrix(4,0,0,4,0,-10028)"
+           id="rect18571-6" />
+      </g>
+      <rect
+         y="2402"
+         x="-1.5000001e-06"
+         height="128"
+         width="128"
+         id="rect9125-7-2"
+         style="display:inline;opacity:1;vector-effect:none;fill:none;fill-opacity:1;stroke:none;stroke-width:1.25;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;marker-start:none;marker-mid:none;marker-end:none;paint-order:normal;enable-background:new" />
+    </g>
+  </g>
+</svg>
diff --git a/burrow-gtk/data/icons/hicolor/symbolic/apps/burrow-gtk-symbolic.svg b/burrow-gtk/data/icons/hicolor/symbolic/apps/burrow-gtk-symbolic.svg
index 66ca58d..5352e0a 100644
--- a/burrow-gtk/data/icons/hicolor/symbolic/apps/burrow-gtk-symbolic.svg
+++ b/burrow-gtk/data/icons/hicolor/symbolic/apps/burrow-gtk-symbolic.svg
@@ -1,11 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16">
-  <g fill="#2e3436">
-    <path d="M4.3 7c0-2.5 1.5-4.3 3.7-4.3s3.7 1.8 3.7 4.3c0 2-1.4 3.3-3.7 3.9C5.7 10.3 4.3 9 4.3 7Z"/>
-    <path d="M5.1 4.8c.8-1 1.8-1.5 2.9-1.5s2.1.5 2.9 1.5C9.9 4.4 9 4.2 8 4.2s-1.9.2-2.9.6Z"/>
-    <path d="M5.8 5.7c.6-.5 1.2-.8 2-.7-.3.8-.9 1.2-1.7 1.3-.2-.1-.3-.3-.3-.6ZM10.2 5.7c-.6-.5-1.2-.8-2-.7.3.8.9 1.2 1.7 1.3.2-.1.3-.3.3-.6Z" fill="#fff"/>
-    <path d="M7.5 6.5 8 7l.5-.5L8 8.2Z"/>
-    <path d="M6.6 10.2h.6l-.1 2.6h-.5ZM8.8 10.2h.6l-.2 2.6h-.5Z"/>
-    <path d="M3.1 13c1-.6 2.6-.9 4.9-.9s3.9.3 4.9.9c-1.5-.2-3.1-.3-4.9-.3s-3.4.1-4.9.3Z"/>
-    <path d="M6.8 12.9c-.8.2-1.4.6-2 1.1 1-.2 1.7-.2 2.2 0 .3.1.6-.1.6-.4s-.3-.8-.8-.7ZM9.2 12.9c.8.2 1.4.6 2 1.1-1-.2-1.7-.2-2.2 0-.3.1-.6-.1-.6-.4s.3-.8.8-.7Z"/>
-  </g>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"><g color="#000" fill="#2e3436"><path d="M7.188 2.281c-.094.056-.192.125-.29.19L5.566 3.803a1.684 1.684 0 11-2.17 2.17L2.332 7.037c.506-.069 1.017-.136 1.2.026.242.214.139 1.031.155 1.656.213.088.427.171.657.219.04.008.085-.007.125 0 .337-.525.683-1.288 1-1.344.322-.057.905.562 1.406.937a3.67 3.67 0 00.656-.468c-.195-.595-.594-1.369-.437-1.657.158-.29 1.019-.37 1.625-.531.028-.183.062-.371.062-.562 0-.075-.027-.146-.031-.22-.587-.217-1.435-.385-1.562-.687-.128-.302.34-1.021.593-1.593a3.722 3.722 0 00-.593-.532zm3.875 3.25c-.165.475-.305 1.086-.47 1.563-.43.047-.84.14-1.218.312-.38-.322-.787-.773-1.156-1.093a5.562 5.562 0 00-.688.468c.177.46.453 1.001.625 1.469-.298.309-.531.67-.719 1.063-.494 0-1.102-.084-1.593-.094a5.68 5.68 0 00-.219.812c.435.24 1.006.468 1.438.72-.006.093-.032.185-.032.28 0 .333.049.66.125.97-.382.304-.898.63-1.28.937.015.044.04.083.058.127l.613.613c.417-.1.868-.223 1.266-.303.248.343.532.626.875.875-.027.135-.068.283-.104.428.174-.063.34-.155.482-.297l1.432-1.432a1.994 1.994 0 01.533-3.918c.919 0 1.684.623 1.918 1.467l1.338-1.338c.06-.06.11-.124.156-.191-.035-.062-.06-.13-.1-.188.096-.152.205-.31.315-.47.017-.348-.1-.7-.37-.971l-.177-.176c-.28.192-.561.387-.83.555-.345-.233-.746-.383-1.156-.5-.077-.507-.107-1.132-.187-1.625a5.44 5.44 0 00-.875-.063zm-9.247.608c-.087.068-.173.138-.254.205l.014.035z" style="marker:none" overflow="visible"/><path d="M8.707.293a1 1 0 00-1.415 0l-6.999 7a1 1 0 000 1.413l7 7.001a1 1 0 001.415 0l7-7a1 1 0 000-1.413zm-.708 2.121l5.587 5.587L8 13.586 2.414 7.999z" style="line-height:normal;font-variant-ligatures:normal;font-variant-position:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-alternates:normal;font-feature-settings:normal;text-indent:0;text-align:start;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000;text-transform:none;text-orientation:mixed;shape-padding:0;isolation:auto;mix-blend-mode:normal;marker:none" font-weight="400" font-family="sans-serif" overflow="visible"/></g></svg>
diff --git a/burrow-gtk/data/meson.build b/burrow-gtk/data/meson.build
index 4abb3c5..2c3ffd8 100644
--- a/burrow-gtk/data/meson.build
+++ b/burrow-gtk/data/meson.build
@@ -77,14 +77,11 @@ if appstream_util.found()
     )
 endif
 
-foreach size : ['16', '24', '32', '48', '64', '128', '256', '512']
-    size_dir = size + 'x' + size
-    install_data(
-        'icons/hicolor/' + size + '/apps/' + app_name + '.png',
-        install_dir: datadir / 'icons' / 'hicolor' / size_dir / 'apps',
-        rename: app_id + '.png',
-    )
-endforeach
+install_data(
+    'icons/hicolor/scalable/apps/' + app_name + '.svg',
+    install_dir: datadir / 'icons' / 'hicolor' / 'scalable' / 'apps',
+    rename: app_id + '.svg',
+)
 
 install_data(
     'icons/hicolor/symbolic/apps/' + app_name + '-symbolic.svg',
diff --git a/burrow-gtk/meson.build b/burrow-gtk/meson.build
index 8c2d5c1..70d8403 100644
--- a/burrow-gtk/meson.build
+++ b/burrow-gtk/meson.build
@@ -34,8 +34,8 @@ i18n = import('i18n')
 gnome = import('gnome')
 
 # External Dependencies
-dependency('gtk4', version: '>= 4.0')
-dependency('libadwaita-1', version: '>= 1.2')
+dependency('gtk4', version: '>= 4.12')
+dependency('libadwaita-1', version: '>= 1.4')
 
 glib_compile_resources = find_program('glib-compile-resources', required: true)
 glib_compile_schemas = find_program('glib-compile-schemas', required: true)
diff --git a/burrow-gtk/src/account_store.rs b/burrow-gtk/src/account_store.rs
deleted file mode 100644
index 6aee78b..0000000
--- a/burrow-gtk/src/account_store.rs
+++ /dev/null
@@ -1,139 +0,0 @@
-use anyhow::{Context, Result};
-use serde::{Deserialize, Serialize};
-use std::{
-    path::PathBuf,
-    time::{SystemTime, UNIX_EPOCH},
-};
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct AccountRecord {
-    pub id: String,
-    pub kind: AccountKind,
-    pub title: String,
-    pub authority: Option<String>,
-    pub account: String,
-    pub identity: String,
-    pub hostname: Option<String>,
-    pub tailnet: Option<String>,
-    pub note: Option<String>,
-    pub created_at: u64,
-    pub updated_at: u64,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "lowercase")]
-pub enum AccountKind {
-    WireGuard,
-    Tor,
-    Tailnet,
-}
-
-impl AccountKind {
-    pub fn title(self) -> &'static str {
-        match self {
-            Self::WireGuard => "WireGuard",
-            Self::Tor => "Tor",
-            Self::Tailnet => "Tailnet",
-        }
-    }
-
-    fn sort_rank(self) -> u8 {
-        match self {
-            Self::Tailnet => 0,
-            Self::Tor => 1,
-            Self::WireGuard => 2,
-        }
-    }
-}
-
-pub fn load() -> Result<Vec<AccountRecord>> {
-    let path = storage_path()?;
-    if !path.exists() {
-        return Ok(Vec::new());
-    }
-    let data =
-        std::fs::read(&path).with_context(|| format!("failed to read {}", path.display()))?;
-    serde_json::from_slice(&data).with_context(|| format!("failed to parse {}", path.display()))
-}
-
-pub fn upsert(mut record: AccountRecord) -> Result<Vec<AccountRecord>> {
-    let mut accounts = load()?;
-    let now = timestamp();
-    record.updated_at = now;
-    if record.created_at == 0 {
-        record.created_at = now;
-    }
-
-    if let Some(index) = accounts.iter().position(|account| account.id == record.id) {
-        accounts[index] = record;
-    } else {
-        accounts.push(record);
-    }
-    accounts.sort_by(|lhs, rhs| {
-        lhs.kind
-            .sort_rank()
-            .cmp(&rhs.kind.sort_rank())
-            .then_with(|| lhs.title.to_lowercase().cmp(&rhs.title.to_lowercase()))
-    });
-    persist(&accounts)?;
-    Ok(accounts)
-}
-
-pub fn new_record(
-    kind: AccountKind,
-    title: String,
-    authority: Option<String>,
-    account: String,
-    identity: String,
-    hostname: Option<String>,
-    tailnet: Option<String>,
-    note: Option<String>,
-) -> AccountRecord {
-    let now = timestamp();
-    AccountRecord {
-        id: format!("{}-{now}", kind.title().to_ascii_lowercase()),
-        kind,
-        title,
-        authority,
-        account,
-        identity,
-        hostname,
-        tailnet,
-        note,
-        created_at: now,
-        updated_at: now,
-    }
-}
-
-fn persist(accounts: &[AccountRecord]) -> Result<()> {
-    let path = storage_path()?;
-    if let Some(parent) = path.parent() {
-        std::fs::create_dir_all(parent)
-            .with_context(|| format!("failed to create {}", parent.display()))?;
-    }
-    let data = serde_json::to_vec_pretty(accounts).context("failed to encode account store")?;
-    std::fs::write(&path, data).with_context(|| format!("failed to write {}", path.display()))
-}
-
-fn storage_path() -> Result<PathBuf> {
-    if let Some(data_home) = std::env::var_os("XDG_DATA_HOME") {
-        return Ok(PathBuf::from(data_home)
-            .join("burrow")
-            .join("accounts.json"));
-    }
-    if let Some(home) = std::env::var_os("HOME") {
-        return Ok(PathBuf::from(home)
-            .join(".local")
-            .join("share")
-            .join("burrow")
-            .join("accounts.json"));
-    }
-    Ok(std::env::temp_dir().join("burrow-accounts.json"))
-}
-
-fn timestamp() -> u64 {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .map(|duration| duration.as_secs())
-        .unwrap_or_default()
-}
diff --git a/burrow-gtk/src/components/app.rs b/burrow-gtk/src/components/app.rs
index 7354825..b42b718 100644
--- a/burrow-gtk/src/components/app.rs
+++ b/burrow-gtk/src/components/app.rs
@@ -1,19 +1,24 @@
 use super::*;
 use anyhow::Context;
+use std::time::Duration;
+
+const RECONNECT_POLL_TIME: Duration = Duration::from_secs(5);
 
 pub struct App {
-    _home_screen: AsyncController<home_screen::HomeScreen>,
+    daemon_client: Arc<Mutex<Option<DaemonClient>>>,
+    _settings_screen: Controller<settings_screen::SettingsScreen>,
+    switch_screen: AsyncController<switch_screen::SwitchScreen>,
 }
 
 #[derive(Debug)]
 pub enum AppMsg {
     None,
+    PostInit,
 }
 
 impl App {
     pub fn run() {
         let app = RelmApp::new(config::ID);
-        relm4::set_global_css(APP_CSS);
         Self::setup_gresources().unwrap();
         Self::setup_i18n().unwrap();
 
@@ -44,7 +49,7 @@ impl AsyncComponent for App {
     view! {
         adw::Window {
             set_title: Some("Burrow"),
-            set_default_size: (900, 760),
+            set_default_size: (640, 480),
         }
     }
 
@@ -53,84 +58,79 @@ impl AsyncComponent for App {
         root: Self::Root,
         sender: AsyncComponentSender<Self>,
     ) -> AsyncComponentParts<Self> {
-        let home_screen = home_screen::HomeScreen::builder()
-            .launch(())
+        let daemon_client = Arc::new(Mutex::new(DaemonClient::new().await.ok()));
+
+        let switch_screen = switch_screen::SwitchScreen::builder()
+            .launch(switch_screen::SwitchScreenInit {
+                daemon_client: Arc::clone(&daemon_client),
+            })
+            .forward(sender.input_sender(), |_| AppMsg::None);
+
+        let settings_screen = settings_screen::SettingsScreen::builder()
+            .launch(settings_screen::SettingsScreenInit {
+                daemon_client: Arc::clone(&daemon_client),
+            })
             .forward(sender.input_sender(), |_| AppMsg::None);
 
         let widgets = view_output!();
 
-        let content = gtk::Box::new(gtk::Orientation::Vertical, 0);
-        content.append(
+        let view_stack = adw::ViewStack::new();
+        view_stack.add_titled(switch_screen.widget(), None, "Switch");
+        view_stack.add_titled(settings_screen.widget(), None, "Settings");
+
+        let view_switcher_bar = adw::ViewSwitcherBar::builder().stack(&view_stack).build();
+        view_switcher_bar.set_reveal(true);
+
+        let toolbar = adw::ToolbarView::new();
+        toolbar.add_top_bar(
             &adw::HeaderBar::builder()
                 .title_widget(&gtk::Label::new(Some("Burrow")))
                 .build(),
         );
-        content.append(home_screen.widget());
+        toolbar.add_bottom_bar(&view_switcher_bar);
+        toolbar.set_content(Some(&view_stack));
 
-        root.set_content(Some(&content));
+        root.set_content(Some(&toolbar));
 
-        let model = App { _home_screen: home_screen };
+        sender.input(AppMsg::PostInit);
+
+        let model = App {
+            daemon_client,
+            switch_screen,
+            _settings_screen: settings_screen,
+        };
 
         AsyncComponentParts { model, widgets }
     }
 
     async fn update(
         &mut self,
-        msg: Self::Input,
+        _msg: Self::Input,
         _sender: AsyncComponentSender<Self>,
         _root: &Self::Root,
     ) {
-        match msg {
-            AppMsg::None => {}
+        loop {
+            tokio::time::sleep(RECONNECT_POLL_TIME).await;
+            {
+                let mut daemon_client = self.daemon_client.lock().await;
+                let mut disconnected_daemon_client = false;
+
+                if let Some(daemon_client) = daemon_client.as_mut() {
+                    if let Err(_e) = daemon_client.send_command(DaemonCommand::ServerInfo).await {
+                        disconnected_daemon_client = true;
+                        self.switch_screen
+                            .emit(switch_screen::SwitchScreenMsg::DaemonDisconnect);
+                    }
+                }
+
+                if disconnected_daemon_client || daemon_client.is_none() {
+                    *daemon_client = DaemonClient::new().await.ok();
+                    if daemon_client.is_some() {
+                        self.switch_screen
+                            .emit(switch_screen::SwitchScreenMsg::DaemonReconnect);
+                    }
+                }
+            }
         }
     }
 }
-
-const APP_CSS: &str = r#"
-.empty-state {
-  border-radius: 18px;
-  padding: 22px;
-  background: alpha(@card_bg_color, 0.72);
-}
-
-.summary-card {
-  border-radius: 18px;
-  padding: 14px;
-  background: alpha(@card_bg_color, 0.72);
-}
-
-.network-card {
-  border-radius: 10px;
-  padding: 16px;
-  box-shadow: 0 2px 6px alpha(black, 0.14);
-}
-
-.wireguard-card {
-  background: linear-gradient(135deg, #3277d8, #174ea6);
-}
-
-.tailnet-card {
-  background: linear-gradient(135deg, #31b891, #147d69);
-}
-
-.network-card-kind,
-.network-card-title,
-.network-card-detail {
-  color: white;
-}
-
-.network-card-kind {
-  opacity: 0.86;
-  font-weight: 700;
-}
-
-.network-card-title {
-  font-size: 1.22em;
-  font-weight: 700;
-}
-
-.network-card-detail {
-  opacity: 0.92;
-  font-family: monospace;
-}
-"#;
diff --git a/burrow-gtk/src/components/home_screen.rs b/burrow-gtk/src/components/home_screen.rs
deleted file mode 100644
index 0bfdda2..0000000
--- a/burrow-gtk/src/components/home_screen.rs
+++ /dev/null
@@ -1,1178 +0,0 @@
-use super::*;
-use crate::account_store::{self, AccountKind, AccountRecord};
-use std::time::Duration;
-
-pub struct HomeScreen {
-    daemon_banner: adw::Banner,
-    network_status: gtk::Label,
-    network_cards: gtk::Box,
-    account_status: gtk::Label,
-    account_rows: gtk::Box,
-    tunnel_status: gtk::Label,
-    tunnel_button: gtk::Button,
-    tunnel_state: Option<daemon_api::TunnelState>,
-    tailnet_session_id: Option<String>,
-    tailnet_running: bool,
-}
-
-#[derive(Debug)]
-pub enum HomeScreenMsg {
-    EnsureDaemon,
-    Refresh,
-    TunnelAction,
-    OpenWireGuard,
-    OpenTor,
-    OpenTailnet,
-    AddWireGuard {
-        title: String,
-        account: String,
-        identity: String,
-        config: String,
-    },
-    SaveTor {
-        title: String,
-        account: String,
-        identity: String,
-        note: String,
-    },
-    DiscoverTailnet(String),
-    ProbeTailnet(String),
-    StartTailnetLogin {
-        authority: String,
-        account: String,
-        identity: String,
-        hostname: Option<String>,
-    },
-    PollTailnetLogin,
-    CancelTailnetLogin,
-    AddTailnet {
-        authority: String,
-        account: String,
-        identity: String,
-        hostname: Option<String>,
-        tailnet: Option<String>,
-    },
-}
-
-#[relm4::component(pub, async)]
-impl AsyncComponent for HomeScreen {
-    type Init = ();
-    type Input = HomeScreenMsg;
-    type Output = ();
-    type CommandOutput = ();
-
-    view! {
-        gtk::ScrolledWindow {
-            set_vexpand: true,
-
-            adw::Clamp {
-                set_maximum_size: 900,
-
-                gtk::Box {
-                    set_orientation: gtk::Orientation::Vertical,
-                    set_spacing: 24,
-                    set_margin_all: 24,
-
-                    gtk::Box {
-                        set_orientation: gtk::Orientation::Horizontal,
-                        set_spacing: 16,
-
-                        gtk::Box {
-                            set_orientation: gtk::Orientation::Vertical,
-                            set_spacing: 6,
-                            set_hexpand: true,
-
-                            gtk::Label {
-                                add_css_class: "title-1",
-                                set_xalign: 0.0,
-                                set_label: "Burrow",
-                            },
-
-                            gtk::Label {
-                                add_css_class: "heading",
-                                add_css_class: "dim-label",
-                                set_xalign: 0.0,
-                                set_label: "Networks and accounts",
-                            },
-                        },
-
-                        #[name(add_button)]
-                        gtk::MenuButton {
-                            add_css_class: "flat",
-                            set_icon_name: "list-add-symbolic",
-                            set_tooltip_text: Some("Add"),
-                            set_valign: Align::Start,
-                        },
-                    },
-
-                    #[name(daemon_banner)]
-                    adw::Banner {
-                        set_title: "Starting Burrow daemon",
-                        set_revealed: false,
-                    },
-
-                    gtk::Box {
-                        set_orientation: gtk::Orientation::Vertical,
-                        set_spacing: 12,
-
-                        gtk::Box {
-                            set_orientation: gtk::Orientation::Vertical,
-                            set_spacing: 4,
-
-                            gtk::Label {
-                                add_css_class: "title-2",
-                                set_xalign: 0.0,
-                                set_label: "Networks",
-                            },
-
-                            #[name(network_status)]
-                            gtk::Label {
-                                add_css_class: "dim-label",
-                                set_xalign: 0.0,
-                                set_wrap: true,
-                                set_label: "Stored daemon networks and their active account selectors",
-                            },
-                        },
-
-                        gtk::ScrolledWindow {
-                            set_policy: (gtk::PolicyType::Automatic, gtk::PolicyType::Never),
-                            set_min_content_height: 190,
-
-                            #[name(network_cards)]
-                            gtk::Box {
-                                set_orientation: gtk::Orientation::Horizontal,
-                                set_spacing: 14,
-                            },
-                        },
-                    },
-
-                    gtk::Box {
-                        set_orientation: gtk::Orientation::Vertical,
-                        set_spacing: 12,
-
-                        gtk::Box {
-                            set_orientation: gtk::Orientation::Vertical,
-                            set_spacing: 4,
-
-                            gtk::Label {
-                                add_css_class: "title-2",
-                                set_xalign: 0.0,
-                                set_label: "Accounts",
-                            },
-
-                            gtk::Label {
-                                add_css_class: "dim-label",
-                                set_xalign: 0.0,
-                                set_wrap: true,
-                                set_label: "Per-network identities and sign-in state",
-                            },
-                        },
-
-                        #[name(account_rows)]
-                        gtk::Box {
-                            set_orientation: gtk::Orientation::Vertical,
-                            set_spacing: 8,
-                            set_margin_all: 0,
-                            set_valign: Align::Center,
-                        },
-
-                        #[name(account_status)]
-                        gtk::Label {
-                            add_css_class: "dim-label",
-                            set_xalign: 0.0,
-                            set_wrap: true,
-                            set_label: "",
-                        },
-                    },
-
-                    gtk::Box {
-                        set_orientation: gtk::Orientation::Vertical,
-                        set_spacing: 8,
-
-                        gtk::Box {
-                            set_orientation: gtk::Orientation::Vertical,
-                            set_spacing: 4,
-
-                            gtk::Label {
-                                add_css_class: "title-2",
-                                set_xalign: 0.0,
-                                set_label: "Tunnel",
-                            },
-
-                            gtk::Label {
-                                add_css_class: "dim-label",
-                                set_xalign: 0.0,
-                                set_label: "Current daemon tunnel state",
-                            },
-                        },
-
-                        #[name(tunnel_status)]
-                        gtk::Label {
-                            set_xalign: 0.0,
-                            set_label: "Checking daemon status",
-                        },
-
-                        #[name(tunnel_button)]
-                        gtk::Button {
-                            add_css_class: "suggested-action",
-                            set_label: "Start",
-                            set_halign: Align::Start,
-                            connect_clicked => HomeScreenMsg::TunnelAction,
-                        },
-                    },
-                }
-            }
-        }
-    }
-
-    async fn init(
-        _: Self::Init,
-        _root: Self::Root,
-        sender: AsyncComponentSender<Self>,
-    ) -> AsyncComponentParts<Self> {
-        let widgets = view_output!();
-        configure_add_popover(&widgets.add_button, &sender);
-
-        let refresh_sender = sender.input_sender().clone();
-        relm4::spawn(async move {
-            loop {
-                tokio::time::sleep(Duration::from_secs(5)).await;
-                refresh_sender.emit(HomeScreenMsg::Refresh);
-            }
-        });
-
-        let model = HomeScreen {
-            daemon_banner: widgets.daemon_banner.clone(),
-            network_status: widgets.network_status.clone(),
-            network_cards: widgets.network_cards.clone(),
-            account_status: widgets.account_status.clone(),
-            account_rows: widgets.account_rows.clone(),
-            tunnel_status: widgets.tunnel_status.clone(),
-            tunnel_button: widgets.tunnel_button.clone(),
-            tunnel_state: None,
-            tailnet_session_id: None,
-            tailnet_running: false,
-        };
-
-        sender.input(HomeScreenMsg::EnsureDaemon);
-
-        AsyncComponentParts { model, widgets }
-    }
-
-    async fn update(
-        &mut self,
-        msg: Self::Input,
-        sender: AsyncComponentSender<Self>,
-        root: &Self::Root,
-    ) {
-        match msg {
-            HomeScreenMsg::EnsureDaemon => self.ensure_daemon().await,
-            HomeScreenMsg::Refresh => self.refresh().await,
-            HomeScreenMsg::TunnelAction => self.perform_tunnel_action().await,
-            HomeScreenMsg::OpenWireGuard => open_wireguard_window(root, &sender),
-            HomeScreenMsg::OpenTor => open_tor_window(root, &sender),
-            HomeScreenMsg::OpenTailnet => open_tailnet_window(root, &sender),
-            HomeScreenMsg::AddWireGuard {
-                title,
-                account,
-                identity,
-                config,
-            } => self.add_wireguard(title, account, identity, config).await,
-            HomeScreenMsg::SaveTor { title, account, identity, note } => {
-                self.save_tor(title, account, identity, note)
-            }
-            HomeScreenMsg::DiscoverTailnet(email) => self.discover_tailnet(email).await,
-            HomeScreenMsg::ProbeTailnet(authority) => self.probe_tailnet(authority).await,
-            HomeScreenMsg::StartTailnetLogin {
-                authority,
-                account,
-                identity,
-                hostname,
-            } => {
-                self.start_tailnet_login(authority, account, identity, hostname, sender)
-                    .await;
-            }
-            HomeScreenMsg::PollTailnetLogin => self.poll_tailnet_login(sender).await,
-            HomeScreenMsg::CancelTailnetLogin => self.cancel_tailnet_login().await,
-            HomeScreenMsg::AddTailnet {
-                authority,
-                account,
-                identity,
-                hostname,
-                tailnet,
-            } => {
-                self.add_tailnet(authority, account, identity, hostname, tailnet)
-                    .await;
-            }
-        }
-    }
-}
-
-impl HomeScreen {
-    async fn ensure_daemon(&mut self) {
-        self.daemon_banner.set_title("Starting Burrow daemon");
-        self.daemon_banner.set_revealed(true);
-        match daemon_api::ensure_daemon().await {
-            Ok(()) => {
-                self.daemon_banner.set_revealed(false);
-                self.refresh().await;
-            }
-            Err(error) => {
-                self.daemon_banner
-                    .set_title(&format!("Burrow daemon is not reachable: {error}"));
-                self.daemon_banner.set_revealed(true);
-                self.tunnel_state = None;
-                self.tunnel_status.set_label("Daemon unavailable");
-                self.tunnel_button.set_label("Enable");
-                self.tunnel_button.set_sensitive(true);
-                self.network_status
-                    .set_label("Stored daemon networks are unavailable until the daemon starts.");
-                self.render_networks(&[]);
-            }
-        }
-    }
-
-    async fn refresh(&mut self) {
-        match daemon_api::tunnel_state().await {
-            Ok(state) => {
-                self.daemon_banner.set_revealed(false);
-                self.tunnel_state = Some(state);
-                match state {
-                    daemon_api::TunnelState::Running => {
-                        self.tunnel_status.set_label("Connected");
-                        self.tunnel_button.set_label("Stop");
-                    }
-                    daemon_api::TunnelState::Stopped => {
-                        self.tunnel_status.set_label("Disconnected");
-                        self.tunnel_button.set_label("Start");
-                    }
-                }
-                self.tunnel_button.set_sensitive(true);
-            }
-            Err(error) => {
-                self.tunnel_state = None;
-                self.daemon_banner
-                    .set_title(&format!("Burrow daemon is not reachable: {error}"));
-                self.daemon_banner.set_revealed(true);
-                self.tunnel_status.set_label("Unknown");
-                self.tunnel_button.set_label("Enable");
-                self.tunnel_button.set_sensitive(true);
-            }
-        }
-
-        match daemon_api::list_networks().await {
-            Ok(networks) => {
-                self.render_networks(&networks);
-                self.network_status.set_label(if networks.is_empty() {
-                    "Stored daemon networks and their active account selectors"
-                } else {
-                    "Stored daemon networks and their active account selectors"
-                });
-            }
-            Err(error) => {
-                self.render_networks(&[]);
-                self.network_status
-                    .set_label(&format!("Unable to read daemon networks: {error}"));
-            }
-        }
-
-        match account_store::load() {
-            Ok(accounts) => {
-                self.account_status.set_label("");
-                self.render_accounts(&accounts);
-            }
-            Err(error) => {
-                self.render_accounts(&[]);
-                self.account_status
-                    .set_label(&format!("Unable to read account store: {error}"));
-            }
-        }
-    }
-
-    async fn perform_tunnel_action(&mut self) {
-        match self.tunnel_state {
-            Some(daemon_api::TunnelState::Running) => {
-                self.tunnel_button.set_sensitive(false);
-                self.tunnel_status.set_label("Disconnecting...");
-                if let Err(error) = daemon_api::stop_tunnel().await {
-                    self.tunnel_status
-                        .set_label(&format!("Stop failed: {error}"));
-                }
-                self.refresh().await;
-            }
-            Some(daemon_api::TunnelState::Stopped) => {
-                self.tunnel_button.set_sensitive(false);
-                self.tunnel_status.set_label("Connecting...");
-                if let Err(error) = daemon_api::start_tunnel().await {
-                    self.tunnel_status
-                        .set_label(&format!("Start failed: {error}"));
-                }
-                self.refresh().await;
-            }
-            None => self.ensure_daemon().await,
-        }
-    }
-
-    async fn add_wireguard(
-        &mut self,
-        title: String,
-        account: String,
-        identity: String,
-        config: String,
-    ) {
-        if config.trim().is_empty() {
-            self.network_status
-                .set_label("Paste a WireGuard configuration before adding a network.");
-            return;
-        }
-        match daemon_api::add_wireguard(config).await {
-            Ok(id) => {
-                let title = daemon_api::normalized(&title, &format!("WireGuard {id}"));
-                let record = account_store::new_record(
-                    AccountKind::WireGuard,
-                    title,
-                    None,
-                    daemon_api::normalized(&account, "default"),
-                    daemon_api::normalized(&identity, &format!("network-{id}")),
-                    None,
-                    None,
-                    Some(format!("Linked to daemon network #{id}.")),
-                );
-                match account_store::upsert(record) {
-                    Ok(accounts) => self.render_accounts(&accounts),
-                    Err(error) => self
-                        .account_status
-                        .set_label(&format!("WireGuard account save failed: {error}")),
-                }
-                self.network_status
-                    .set_label(&format!("Added WireGuard network #{id}."));
-                self.refresh().await;
-            }
-            Err(error) => self
-                .network_status
-                .set_label(&format!("Unable to add WireGuard network: {error}")),
-        }
-    }
-
-    fn save_tor(&mut self, title: String, account: String, identity: String, note: String) {
-        let record = account_store::new_record(
-            AccountKind::Tor,
-            daemon_api::normalized(
-                &title,
-                &format!("Tor {}", daemon_api::normalized(&identity, "linux")),
-            ),
-            Some("arti://local".to_owned()),
-            daemon_api::normalized(&account, "default"),
-            daemon_api::normalized(&identity, "linux"),
-            None,
-            None,
-            Some(note),
-        );
-        match account_store::upsert(record) {
-            Ok(accounts) => {
-                self.account_status.set_label("Saved Tor account.");
-                self.render_accounts(&accounts);
-            }
-            Err(error) => self
-                .account_status
-                .set_label(&format!("Unable to save Tor account: {error}")),
-        }
-    }
-
-    async fn discover_tailnet(&mut self, email: String) {
-        let Ok(email) = daemon_api::require_value(&email, "Email address") else {
-            self.account_status
-                .set_label("Enter an email address before Tailnet discovery.");
-            return;
-        };
-
-        self.account_status.set_label("Finding Tailnet server...");
-        match daemon_api::discover_tailnet(email).await {
-            Ok(discovery) => {
-                let kind = if discovery.managed {
-                    "managed authority"
-                } else {
-                    "custom authority"
-                };
-                let issuer = discovery
-                    .oidc_issuer
-                    .map(|issuer| format!(" OIDC: {issuer}."))
-                    .unwrap_or_default();
-                self.account_status.set_label(&format!(
-                    "Discovered {kind}: {}.{issuer}",
-                    discovery.authority
-                ));
-            }
-            Err(error) => self
-                .account_status
-                .set_label(&format!("Tailnet discovery failed: {error}")),
-        }
-    }
-
-    async fn probe_tailnet(&mut self, authority: String) {
-        let Ok(authority) = daemon_api::require_value(&authority, "Tailnet server URL") else {
-            self.account_status
-                .set_label("Enter a Tailnet server URL before checking it.");
-            return;
-        };
-
-        self.account_status.set_label("Checking Tailnet server...");
-        match daemon_api::probe_tailnet(authority).await {
-            Ok(probe) => {
-                let detail = probe
-                    .detail
-                    .unwrap_or_else(|| format!("HTTP {}", probe.status_code));
-                self.account_status
-                    .set_label(&format!("{}: {detail}", probe.summary));
-            }
-            Err(error) => self
-                .account_status
-                .set_label(&format!("Tailnet probe failed: {error}")),
-        }
-    }
-
-    async fn start_tailnet_login(
-        &mut self,
-        authority: String,
-        account: String,
-        identity: String,
-        hostname: Option<String>,
-        sender: AsyncComponentSender<Self>,
-    ) {
-        let Ok(authority) = daemon_api::require_value(&authority, "Tailnet server URL") else {
-            self.account_status
-                .set_label("Enter a Tailnet server URL before sign-in.");
-            return;
-        };
-
-        self.account_status.set_label("Starting Tailnet sign-in...");
-        match daemon_api::start_tailnet_login(authority, account, identity, hostname).await {
-            Ok(status) => {
-                self.apply_login_status(&status);
-                if let Some(auth_url) = status.auth_url.as_deref() {
-                    if let Err(error) = open_auth_url(auth_url) {
-                        self.account_status.set_label(&format!(
-                            "{} Open this URL manually: {auth_url}. Browser launch failed: {error}",
-                            self.account_status.text()
-                        ));
-                    }
-                }
-                if !status.running {
-                    sender.input(HomeScreenMsg::PollTailnetLogin);
-                }
-            }
-            Err(error) => self
-                .account_status
-                .set_label(&format!("Tailnet sign-in failed: {error}")),
-        }
-    }
-
-    async fn poll_tailnet_login(&mut self, sender: AsyncComponentSender<Self>) {
-        let Some(session_id) = self.tailnet_session_id.clone() else {
-            return;
-        };
-        if self.tailnet_running {
-            return;
-        }
-
-        tokio::time::sleep(Duration::from_secs(1)).await;
-        match daemon_api::tailnet_login_status(session_id).await {
-            Ok(status) => {
-                self.apply_login_status(&status);
-                if !status.running {
-                    sender.input(HomeScreenMsg::PollTailnetLogin);
-                }
-            }
-            Err(error) => {
-                self.account_status
-                    .set_label(&format!("Tailnet sign-in status failed: {error}"));
-                self.tailnet_session_id = None;
-            }
-        }
-    }
-
-    async fn cancel_tailnet_login(&mut self) {
-        let Some(session_id) = self.tailnet_session_id.clone() else {
-            self.account_status
-                .set_label("No Tailnet sign-in is active.");
-            return;
-        };
-        match daemon_api::cancel_tailnet_login(session_id).await {
-            Ok(()) => {
-                self.tailnet_session_id = None;
-                self.tailnet_running = false;
-                self.account_status.set_label("Tailnet sign-in cancelled.");
-            }
-            Err(error) => self
-                .account_status
-                .set_label(&format!("Unable to cancel Tailnet sign-in: {error}")),
-        }
-    }
-
-    async fn add_tailnet(
-        &mut self,
-        authority: String,
-        account: String,
-        identity: String,
-        hostname: Option<String>,
-        tailnet: Option<String>,
-    ) {
-        let Ok(authority) = daemon_api::require_value(&authority, "Tailnet server URL") else {
-            self.account_status
-                .set_label("Enter a Tailnet server URL before saving.");
-            return;
-        };
-        if self.tailnet_session_id.is_some() && !self.tailnet_running {
-            self.account_status
-                .set_label("Finish browser sign-in before saving this Tailnet account.");
-            return;
-        }
-
-        let stored_authority = daemon_api::normalized_optional(&authority)
-            .unwrap_or_else(|| daemon_api::default_tailnet_authority().to_owned());
-        let stored_account = daemon_api::normalized(&account, "default");
-        let stored_identity = daemon_api::normalized(&identity, "linux");
-        let stored_hostname = hostname.clone();
-        let stored_tailnet = tailnet.clone();
-
-        match daemon_api::add_tailnet(authority, account, identity, hostname, tailnet).await {
-            Ok(id) => {
-                let title = stored_tailnet
-                    .clone()
-                    .or(stored_hostname.clone())
-                    .unwrap_or_else(|| format!("Tailnet {id}"));
-                let record = account_store::new_record(
-                    AccountKind::Tailnet,
-                    title,
-                    Some(stored_authority),
-                    stored_account,
-                    stored_identity,
-                    stored_hostname,
-                    stored_tailnet,
-                    Some(format!("Linked to daemon network #{id}.")),
-                );
-                match account_store::upsert(record) {
-                    Ok(accounts) => self.render_accounts(&accounts),
-                    Err(error) => self
-                        .account_status
-                        .set_label(&format!("Tailnet account save failed: {error}")),
-                }
-                self.account_status
-                    .set_label(&format!("Saved Tailnet account and network #{id}."));
-                self.refresh().await;
-            }
-            Err(error) => self
-                .account_status
-                .set_label(&format!("Unable to save Tailnet account: {error}")),
-        }
-    }
-
-    fn apply_login_status(&mut self, status: &daemon_api::TailnetLoginStatus) {
-        self.tailnet_session_id = Some(status.session_id.clone());
-        self.tailnet_running = status.running;
-
-        let mut parts = Vec::new();
-        if status.running {
-            parts.push("Signed In".to_owned());
-        } else if status.needs_login {
-            parts.push("Browser Sign-In Required".to_owned());
-        } else {
-            parts.push("Checking Sign-In".to_owned());
-        }
-        if !status.backend_state.is_empty() {
-            parts.push(format!("State: {}", status.backend_state));
-        }
-        if let Some(tailnet_name) = &status.tailnet_name {
-            parts.push(format!("Tailnet: {tailnet_name}"));
-        }
-        if let Some(self_dns_name) = &status.self_dns_name {
-            parts.push(self_dns_name.clone());
-        }
-        if !status.tailnet_ips.is_empty() {
-            parts.push(status.tailnet_ips.join(", "));
-        }
-        if !status.health.is_empty() {
-            parts.push(status.health.join(" / "));
-        }
-        self.account_status.set_label(&parts.join("\n"));
-    }
-
-    fn render_networks(&self, networks: &[daemon_api::NetworkSummary]) {
-        while let Some(child) = self.network_cards.first_child() {
-            self.network_cards.remove(&child);
-        }
-
-        if networks.is_empty() {
-            self.network_cards.append(&empty_networks_view());
-            return;
-        }
-
-        for network in networks {
-            self.network_cards.append(&network_card(network));
-        }
-    }
-
-    fn render_accounts(&self, accounts: &[AccountRecord]) {
-        while let Some(child) = self.account_rows.first_child() {
-            self.account_rows.remove(&child);
-        }
-
-        if accounts.is_empty() {
-            self.account_rows.append(&empty_accounts_view());
-            return;
-        }
-
-        for account in accounts {
-            self.account_rows.append(&account_card(account));
-        }
-    }
-}
-
-fn configure_add_popover(button: &gtk::MenuButton, sender: &AsyncComponentSender<HomeScreen>) {
-    let popover = gtk::Popover::new();
-    let box_ = gtk::Box::new(gtk::Orientation::Vertical, 4);
-    box_.set_margin_all(6);
-
-    for (label, msg) in [
-        ("Add WireGuard Network", HomeScreenMsg::OpenWireGuard),
-        ("Save Tor Account", HomeScreenMsg::OpenTor),
-        ("Add Tailnet Account", HomeScreenMsg::OpenTailnet),
-    ] {
-        let item = gtk::Button::with_label(label);
-        item.add_css_class("flat");
-        item.set_halign(Align::Fill);
-        let input = sender.input_sender().clone();
-        item.connect_clicked(move |_| input.emit(msg_from_template(&msg)));
-        box_.append(&item);
-    }
-
-    popover.set_child(Some(&box_));
-    button.set_popover(Some(&popover));
-}
-
-fn msg_from_template(msg: &HomeScreenMsg) -> HomeScreenMsg {
-    match msg {
-        HomeScreenMsg::OpenWireGuard => HomeScreenMsg::OpenWireGuard,
-        HomeScreenMsg::OpenTor => HomeScreenMsg::OpenTor,
-        HomeScreenMsg::OpenTailnet => HomeScreenMsg::OpenTailnet,
-        _ => unreachable!(),
-    }
-}
-
-fn network_card(network: &daemon_api::NetworkSummary) -> gtk::Box {
-    let card = gtk::Box::new(gtk::Orientation::Vertical, 10);
-    card.add_css_class("network-card");
-    if network.title.to_ascii_lowercase().contains("wireguard") {
-        card.add_css_class("wireguard-card");
-    } else {
-        card.add_css_class("tailnet-card");
-    }
-    card.set_size_request(360, 175);
-    card.set_margin_bottom(8);
-
-    let kind = if network.title.to_ascii_lowercase().contains("wireguard") {
-        "WireGuard"
-    } else {
-        "Tailnet"
-    };
-    let kind_label = gtk::Label::new(Some(kind));
-    kind_label.add_css_class("network-card-kind");
-    kind_label.set_xalign(0.0);
-
-    let title = gtk::Label::new(Some(&network.title));
-    title.add_css_class("network-card-title");
-    title.set_xalign(0.0);
-    title.set_wrap(true);
-
-    let spacer = gtk::Box::new(gtk::Orientation::Vertical, 0);
-    spacer.set_vexpand(true);
-
-    let detail = gtk::Label::new(Some(&network.detail));
-    detail.add_css_class("network-card-detail");
-    detail.set_xalign(0.0);
-    detail.set_wrap(true);
-    detail.set_lines(4);
-
-    card.append(&kind_label);
-    card.append(&title);
-    card.append(&spacer);
-    card.append(&detail);
-    card
-}
-
-fn empty_networks_view() -> gtk::Box {
-    let box_ = gtk::Box::new(gtk::Orientation::Vertical, 6);
-    box_.add_css_class("empty-state");
-    box_.set_size_request(520, 175);
-    box_.set_hexpand(true);
-
-    let title = gtk::Label::new(Some("No Networks Yet"));
-    title.add_css_class("title-3");
-    title.set_xalign(0.0);
-    let detail = gtk::Label::new(Some(
-        "Add a WireGuard network, or save a Tailnet account so Burrow can store a managed network when the daemon is reachable.",
-    ));
-    detail.add_css_class("dim-label");
-    detail.set_wrap(true);
-    detail.set_xalign(0.0);
-
-    box_.append(&title);
-    box_.append(&detail);
-    box_
-}
-
-fn empty_accounts_view() -> gtk::Box {
-    let box_ = gtk::Box::new(gtk::Orientation::Vertical, 6);
-    box_.add_css_class("empty-state");
-    box_.set_hexpand(true);
-
-    let title = gtk::Label::new(Some("No Accounts Yet"));
-    title.add_css_class("title-3");
-    title.set_justify(gtk::Justification::Center);
-    let detail = gtk::Label::new(Some(
-        "Save a Tor account or sign in to Tailnet to keep network identities ready on this device.",
-    ));
-    detail.add_css_class("dim-label");
-    detail.set_wrap(true);
-    detail.set_justify(gtk::Justification::Center);
-
-    box_.append(&title);
-    box_.append(&detail);
-    box_
-}
-
-fn account_card(account: &AccountRecord) -> gtk::Box {
-    let card = gtk::Box::new(gtk::Orientation::Vertical, 8);
-    card.add_css_class("summary-card");
-    card.set_hexpand(true);
-
-    let header = gtk::Box::new(gtk::Orientation::Horizontal, 8);
-    let title = gtk::Label::new(Some(&account.title));
-    title.add_css_class("title-3");
-    title.set_xalign(0.0);
-    title.set_hexpand(true);
-    let kind = gtk::Label::new(Some(account.kind.title()));
-    kind.add_css_class("dim-label");
-    header.append(&title);
-    header.append(&kind);
-    card.append(&header);
-
-    append_account_value(&card, "Account", &account.account);
-    append_account_value(&card, "Identity", &account.identity);
-    if let Some(authority) = &account.authority {
-        append_account_value(&card, "Authority", authority);
-    }
-    if let Some(hostname) = &account.hostname {
-        append_account_value(&card, "Hostname", hostname);
-    }
-    if let Some(tailnet) = &account.tailnet {
-        append_account_value(&card, "Tailnet", tailnet);
-    }
-    if let Some(note) = &account.note {
-        let note_label = gtk::Label::new(Some(note));
-        note_label.add_css_class("dim-label");
-        note_label.set_wrap(true);
-        note_label.set_xalign(0.0);
-        card.append(&note_label);
-    }
-
-    card
-}
-
-fn append_account_value(card: &gtk::Box, label: &str, value: &str) {
-    let row = gtk::Box::new(gtk::Orientation::Horizontal, 8);
-    let key = gtk::Label::new(Some(label));
-    key.add_css_class("dim-label");
-    key.set_xalign(0.0);
-    key.set_width_chars(9);
-    let value = gtk::Label::new(Some(value));
-    value.set_xalign(0.0);
-    value.set_wrap(true);
-    value.set_hexpand(true);
-    row.append(&key);
-    row.append(&value);
-    card.append(&row);
-}
-
-fn open_wireguard_window(root: &gtk::ScrolledWindow, sender: &AsyncComponentSender<HomeScreen>) {
-    let window = sheet_window(root, "WireGuard", 560, 620);
-    let content = sheet_content(
-        &window,
-        "Import WireGuard",
-        "Import a tunnel and optional account metadata.",
-    );
-
-    let title = gtk::Entry::new();
-    title.set_placeholder_text(Some("Title"));
-    let account = gtk::Entry::new();
-    account.set_placeholder_text(Some("Account"));
-    let identity = gtk::Entry::new();
-    identity.set_placeholder_text(Some("Identity"));
-    let text = gtk::TextView::new();
-    text.set_monospace(true);
-    text.set_wrap_mode(gtk::WrapMode::WordChar);
-
-    let editor = gtk::ScrolledWindow::new();
-    editor.set_min_content_height(220);
-    editor.set_child(Some(&text));
-
-    content.append(&section_label("Identity"));
-    content.append(&title);
-    content.append(&account);
-    content.append(&identity);
-    content.append(&section_label("WireGuard Configuration"));
-    content.append(&editor);
-
-    let add = gtk::Button::with_label("Add Network");
-    add.add_css_class("suggested-action");
-    let input = sender.input_sender().clone();
-    let window_for_click = window.clone();
-    add.connect_clicked(move |_| {
-        input.emit(HomeScreenMsg::AddWireGuard {
-            title: title.text().to_string(),
-            account: account.text().to_string(),
-            identity: identity.text().to_string(),
-            config: text_view_text(&text),
-        });
-        window_for_click.close();
-    });
-    content.append(&add);
-
-    window.set_child(Some(&content));
-    window.present();
-}
-
-fn open_tor_window(root: &gtk::ScrolledWindow, sender: &AsyncComponentSender<HomeScreen>) {
-    let window = sheet_window(root, "Tor", 520, 540);
-    let content = sheet_content(
-        &window,
-        "Configure Tor",
-        "Store Arti account and identity preferences.",
-    );
-
-    let title = entry_with_text("Title", "Default Tor");
-    let account = entry_with_text("Account", "default");
-    let identity = entry_with_text("Identity", "linux");
-    let addresses = entry_with_text("Virtual Addresses", "100.64.0.2/32");
-    let dns = entry_with_text("DNS Resolvers", "1.1.1.1, 1.0.0.1");
-    let mtu = entry_with_text("MTU", "1400");
-    let listen = entry_with_text("Transparent Listener", "127.0.0.1:9040");
-
-    content.append(&section_label("Identity"));
-    content.append(&title);
-    content.append(&account);
-    content.append(&identity);
-    content.append(&section_label("Tor Preferences"));
-    content.append(&addresses);
-    content.append(&dns);
-    content.append(&mtu);
-    content.append(&listen);
-
-    let save = gtk::Button::with_label("Save Account");
-    save.add_css_class("suggested-action");
-    let input = sender.input_sender().clone();
-    let window_for_click = window.clone();
-    save.connect_clicked(move |_| {
-        let note = [
-            format!(
-                "Addresses: {}",
-                normalized_entry(&addresses, "100.64.0.2/32")
-            ),
-            format!("DNS: {}", normalized_entry(&dns, "1.1.1.1, 1.0.0.1")),
-            format!("MTU: {}", normalized_entry(&mtu, "1400")),
-            format!("Listen: {}", normalized_entry(&listen, "127.0.0.1:9040")),
-        ]
-        .join(" - ");
-        input.emit(HomeScreenMsg::SaveTor {
-            title: normalized_entry(&title, "Default Tor"),
-            account: normalized_entry(&account, "default"),
-            identity: normalized_entry(&identity, "linux"),
-            note,
-        });
-        window_for_click.close();
-    });
-    content.append(&save);
-
-    window.set_child(Some(&content));
-    window.present();
-}
-
-fn open_tailnet_window(root: &gtk::ScrolledWindow, sender: &AsyncComponentSender<HomeScreen>) {
-    let window = sheet_window(root, "Tailnet", 560, 680);
-    let content = sheet_content(
-        &window,
-        "Connect Tailnet",
-        "Save Tailnet authority, identity defaults, and login material.",
-    );
-
-    let email = gtk::Entry::new();
-    email.set_placeholder_text(Some("Email address"));
-    let authority = entry_with_text("Server URL", daemon_api::default_tailnet_authority());
-    let tailnet = gtk::Entry::new();
-    tailnet.set_placeholder_text(Some("Tailnet"));
-    let account = entry_with_text("Account", "default");
-    let identity = entry_with_text("Identity", "linux");
-    let hostname = entry_with_text("Hostname", &hostname_fallback());
-
-    content.append(&section_label("Connection"));
-    content.append(&email);
-    content.append(&authority);
-    content.append(&tailnet);
-    content.append(&section_label("Identity"));
-    content.append(&account);
-    content.append(&identity);
-    content.append(&hostname);
-
-    let actions = gtk::Box::new(gtk::Orientation::Horizontal, 8);
-    let discover = gtk::Button::with_label("Refresh Server Lookup");
-    let probe = gtk::Button::with_label("Check Server");
-    let sign_in = gtk::Button::with_label("Start Sign-In");
-    actions.append(&discover);
-    actions.append(&probe);
-    actions.append(&sign_in);
-    content.append(&section_label("Authentication"));
-    content.append(&actions);
-
-    let input = sender.input_sender().clone();
-    let email_for_click = email.clone();
-    discover.connect_clicked(move |_| {
-        input.emit(HomeScreenMsg::DiscoverTailnet(
-            email_for_click.text().to_string(),
-        ));
-    });
-
-    let input = sender.input_sender().clone();
-    let authority_for_probe = authority.clone();
-    probe.connect_clicked(move |_| {
-        input.emit(HomeScreenMsg::ProbeTailnet(
-            authority_for_probe.text().to_string(),
-        ));
-    });
-
-    let input = sender.input_sender().clone();
-    let authority_for_login = authority.clone();
-    let account_for_login = account.clone();
-    let identity_for_login = identity.clone();
-    let hostname_for_login = hostname.clone();
-    sign_in.connect_clicked(move |_| {
-        input.emit(HomeScreenMsg::StartTailnetLogin {
-            authority: authority_for_login.text().to_string(),
-            account: normalized_entry(&account_for_login, "default"),
-            identity: normalized_entry(&identity_for_login, "linux"),
-            hostname: daemon_api::normalized_optional(&hostname_for_login.text()),
-        });
-    });
-
-    let save = gtk::Button::with_label("Save Account");
-    save.add_css_class("suggested-action");
-    let input = sender.input_sender().clone();
-    let window_for_click = window.clone();
-    save.connect_clicked(move |_| {
-        input.emit(HomeScreenMsg::AddTailnet {
-            authority: authority.text().to_string(),
-            account: normalized_entry(&account, "default"),
-            identity: normalized_entry(&identity, "linux"),
-            hostname: daemon_api::normalized_optional(&hostname.text()),
-            tailnet: daemon_api::normalized_optional(&tailnet.text()),
-        });
-        window_for_click.close();
-    });
-
-    let cancel = gtk::Button::with_label("Cancel Sign-In");
-    let input = sender.input_sender().clone();
-    cancel.connect_clicked(move |_| {
-        input.emit(HomeScreenMsg::CancelTailnetLogin);
-    });
-
-    content.append(&save);
-    content.append(&cancel);
-
-    window.set_child(Some(&content));
-    window.present();
-}
-
-fn sheet_window(root: &gtk::ScrolledWindow, title: &str, width: i32, height: i32) -> gtk::Window {
-    let window = gtk::Window::builder()
-        .title(title)
-        .default_width(width)
-        .default_height(height)
-        .modal(true)
-        .build();
-    if let Some(root) = root.root() {
-        if let Ok(parent) = root.downcast::<gtk::Window>() {
-            window.set_transient_for(Some(&parent));
-        }
-    }
-    window
-}
-
-fn sheet_content(window: &gtk::Window, title: &str, detail: &str) -> gtk::Box {
-    let content = gtk::Box::new(gtk::Orientation::Vertical, 12);
-    content.set_margin_all(18);
-
-    let summary = gtk::Box::new(gtk::Orientation::Horizontal, 12);
-    summary.add_css_class("summary-card");
-
-    let copy = gtk::Box::new(gtk::Orientation::Vertical, 4);
-    copy.set_hexpand(true);
-
-    let title_label = gtk::Label::new(Some(title));
-    title_label.add_css_class("title-3");
-    title_label.set_xalign(0.0);
-
-    let detail_label = gtk::Label::new(Some(detail));
-    detail_label.add_css_class("dim-label");
-    detail_label.set_wrap(true);
-    detail_label.set_xalign(0.0);
-
-    copy.append(&title_label);
-    copy.append(&detail_label);
-    summary.append(&copy);
-
-    let close = gtk::Button::builder()
-        .icon_name("window-close-symbolic")
-        .tooltip_text("Close")
-        .valign(Align::Start)
-        .build();
-    close.add_css_class("flat");
-    let window_for_click = window.clone();
-    close.connect_clicked(move |_| window_for_click.close());
-    summary.append(&close);
-
-    content.append(&summary);
-    content
-}
-
-fn section_label(label: &str) -> gtk::Label {
-    let section = gtk::Label::new(Some(label));
-    section.add_css_class("heading");
-    section.set_xalign(0.0);
-    section
-}
-
-fn entry_with_text(placeholder: &str, value: &str) -> gtk::Entry {
-    let entry = gtk::Entry::new();
-    entry.set_placeholder_text(Some(placeholder));
-    entry.set_text(value);
-    entry
-}
-
-fn normalized_entry(entry: &gtk::Entry, fallback: &str) -> String {
-    daemon_api::normalized(&entry.text(), fallback)
-}
-
-fn hostname_fallback() -> String {
-    std::env::var("HOSTNAME").unwrap_or_else(|_| "linux".to_owned())
-}
-
-fn text_view_text(text_view: &gtk::TextView) -> String {
-    let buffer = text_view.buffer();
-    buffer
-        .text(&buffer.start_iter(), &buffer.end_iter(), true)
-        .to_string()
-}
-
-fn open_auth_url(url: &str) -> anyhow::Result<()> {
-    gtk::gio::AppInfo::launch_default_for_uri(url, None::<&gtk::gio::AppLaunchContext>)
-        .map_err(anyhow::Error::from)
-}
diff --git a/burrow-gtk/src/components/mod.rs b/burrow-gtk/src/components/mod.rs
index 8e60fa7..b1cc938 100644
--- a/burrow-gtk/src/components/mod.rs
+++ b/burrow-gtk/src/components/mod.rs
@@ -1,6 +1,6 @@
 use super::*;
-use crate::daemon_api;
 use adw::prelude::*;
+use burrow::{DaemonClient, DaemonCommand, DaemonResponseData};
 use gtk::Align;
 use relm4::{
     component::{
@@ -9,9 +9,12 @@ use relm4::{
     },
     prelude::*,
 };
+use std::sync::Arc;
+use tokio::sync::Mutex;
 
 mod app;
-mod home_screen;
+mod settings;
+mod settings_screen;
+mod switch_screen;
 
 pub use app::*;
-pub use home_screen::{HomeScreen, HomeScreenMsg};
diff --git a/burrow-gtk/src/components/networks_screen.rs b/burrow-gtk/src/components/networks_screen.rs
deleted file mode 100644
index 21df982..0000000
--- a/burrow-gtk/src/components/networks_screen.rs
+++ /dev/null
@@ -1,515 +0,0 @@
-use super::*;
-use anyhow::{Context, Result};
-use tokio::time::Duration;
-
-pub struct NetworksScreen {
-    list_box: gtk::ListBox,
-    network_status: gtk::Label,
-    wireguard_text: gtk::TextView,
-    tailnet_email_entry: gtk::Entry,
-    tailnet_authority_entry: gtk::Entry,
-    tailnet_account_entry: gtk::Entry,
-    tailnet_identity_entry: gtk::Entry,
-    tailnet_hostname_entry: gtk::Entry,
-    tailnet_name_entry: gtk::Entry,
-    custom_authority_switch: gtk::Switch,
-    tailnet_status: gtk::Label,
-    tailnet_session_id: Option<String>,
-    tailnet_running: bool,
-}
-
-#[derive(Debug)]
-pub enum NetworksScreenMsg {
-    Refresh,
-    AddWireGuard,
-    DiscoverTailnet,
-    ProbeTailnet,
-    StartTailnetLogin,
-    PollTailnetLogin,
-    CancelTailnetLogin,
-    AddTailnet,
-}
-
-#[relm4::component(pub, async)]
-impl AsyncComponent for NetworksScreen {
-    type Init = ();
-    type Input = NetworksScreenMsg;
-    type Output = ();
-    type CommandOutput = ();
-
-    view! {
-        gtk::ScrolledWindow {
-            set_vexpand: true,
-
-            adw::Clamp {
-                gtk::Box {
-                    set_orientation: gtk::Orientation::Vertical,
-                    set_spacing: 12,
-                    set_margin_all: 12,
-
-            adw::PreferencesGroup {
-                set_title: "Stored Networks",
-                set_description: Some("Networks saved in the Burrow daemon"),
-
-                #[name(network_status)]
-                gtk::Label {
-                    set_xalign: 0.0,
-                    set_wrap: true,
-                    set_label: "Loading networks",
-                },
-
-                #[name(list_box)]
-                gtk::ListBox {
-                    add_css_class: "boxed-list",
-                },
-
-                gtk::Button {
-                    set_label: "Refresh",
-                    connect_clicked => NetworksScreenMsg::Refresh
-                },
-            },
-
-            adw::PreferencesGroup {
-                set_title: "Add WireGuard",
-                set_description: Some("Import a WireGuard configuration into the daemon"),
-
-                gtk::ScrolledWindow {
-                    set_min_content_height: 150,
-                    set_vexpand: false,
-
-                    #[name(wireguard_text)]
-                    gtk::TextView {
-                        set_monospace: true,
-                        set_wrap_mode: gtk::WrapMode::WordChar,
-                    }
-                },
-
-                gtk::Button {
-                    set_label: "Add WireGuard Network",
-                    connect_clicked => NetworksScreenMsg::AddWireGuard
-                },
-            },
-
-            adw::PreferencesGroup {
-                set_title: "Tailnet",
-                set_description: Some("Discover, probe, sign in, and save Tailnet authorities through the daemon"),
-
-                #[name(tailnet_email_entry)]
-                gtk::Entry {
-                    set_placeholder_text: Some("Email address"),
-                },
-
-                #[name(custom_authority_switch)]
-                gtk::Switch {
-                    set_halign: Align::Start,
-                    set_active: false,
-                },
-
-                #[name(tailnet_authority_entry)]
-                gtk::Entry {
-                    set_placeholder_text: Some("Tailnet server URL"),
-                },
-
-                #[name(tailnet_account_entry)]
-                gtk::Entry {
-                    set_placeholder_text: Some("Account name"),
-                },
-
-                #[name(tailnet_identity_entry)]
-                gtk::Entry {
-                    set_placeholder_text: Some("Identity name"),
-                },
-
-                #[name(tailnet_hostname_entry)]
-                gtk::Entry {
-                    set_placeholder_text: Some("Device hostname"),
-                },
-
-                #[name(tailnet_name_entry)]
-                gtk::Entry {
-                    set_placeholder_text: Some("Tailnet name"),
-                },
-
-                #[name(tailnet_status)]
-                gtk::Label {
-                    set_xalign: 0.0,
-                    set_wrap: true,
-                    set_selectable: true,
-                    set_label: "Use discovery for the managed Tailscale authority or enter a custom Tailnet server.",
-                },
-
-                gtk::Box {
-                    set_orientation: gtk::Orientation::Horizontal,
-                    set_spacing: 8,
-
-                    gtk::Button {
-                        set_label: "Discover",
-                        connect_clicked => NetworksScreenMsg::DiscoverTailnet
-                    },
-
-                    gtk::Button {
-                        set_label: "Probe",
-                        connect_clicked => NetworksScreenMsg::ProbeTailnet
-                    },
-
-                    gtk::Button {
-                        set_label: "Sign In",
-                        connect_clicked => NetworksScreenMsg::StartTailnetLogin
-                    },
-
-                    gtk::Button {
-                        set_label: "Cancel",
-                        connect_clicked => NetworksScreenMsg::CancelTailnetLogin
-                    },
-                },
-
-                gtk::Button {
-                    set_label: "Save Tailnet Network",
-                    connect_clicked => NetworksScreenMsg::AddTailnet
-                },
-            },
-                }
-            }
-        }
-    }
-
-    async fn init(
-        _: Self::Init,
-        root: Self::Root,
-        sender: AsyncComponentSender<Self>,
-    ) -> AsyncComponentParts<Self> {
-        let widgets = view_output!();
-        widgets
-            .tailnet_authority_entry
-            .set_text(daemon_api::default_tailnet_authority());
-        widgets.tailnet_account_entry.set_text("default");
-        widgets.tailnet_identity_entry.set_text("linux");
-
-        let mut model = NetworksScreen {
-            list_box: widgets.list_box.clone(),
-            network_status: widgets.network_status.clone(),
-            wireguard_text: widgets.wireguard_text.clone(),
-            tailnet_email_entry: widgets.tailnet_email_entry.clone(),
-            tailnet_authority_entry: widgets.tailnet_authority_entry.clone(),
-            tailnet_account_entry: widgets.tailnet_account_entry.clone(),
-            tailnet_identity_entry: widgets.tailnet_identity_entry.clone(),
-            tailnet_hostname_entry: widgets.tailnet_hostname_entry.clone(),
-            tailnet_name_entry: widgets.tailnet_name_entry.clone(),
-            custom_authority_switch: widgets.custom_authority_switch.clone(),
-            tailnet_status: widgets.tailnet_status.clone(),
-            tailnet_session_id: None,
-            tailnet_running: false,
-        };
-
-        model.refresh_networks().await;
-
-        AsyncComponentParts { model, widgets }
-    }
-
-    async fn update(
-        &mut self,
-        msg: Self::Input,
-        sender: AsyncComponentSender<Self>,
-        _root: &Self::Root,
-    ) {
-        match msg {
-            NetworksScreenMsg::Refresh => self.refresh_networks().await,
-            NetworksScreenMsg::AddWireGuard => self.add_wireguard().await,
-            NetworksScreenMsg::DiscoverTailnet => self.discover_tailnet().await,
-            NetworksScreenMsg::ProbeTailnet => self.probe_tailnet().await,
-            NetworksScreenMsg::StartTailnetLogin => self.start_tailnet_login(sender).await,
-            NetworksScreenMsg::PollTailnetLogin => self.poll_tailnet_login(sender).await,
-            NetworksScreenMsg::CancelTailnetLogin => self.cancel_tailnet_login().await,
-            NetworksScreenMsg::AddTailnet => self.add_tailnet().await,
-        }
-    }
-}
-
-impl NetworksScreen {
-    async fn refresh_networks(&mut self) {
-        match daemon_api::list_networks().await {
-            Ok(networks) => {
-                self.render_networks(&networks);
-                self.network_status.set_label(if networks.is_empty() {
-                    "No daemon networks saved yet"
-                } else {
-                    "Daemon networks are up to date"
-                });
-            }
-            Err(error) => {
-                self.clear_networks();
-                self.network_status
-                    .set_label(&format!("Unable to read daemon networks: {error}"));
-            }
-        }
-    }
-
-    async fn add_wireguard(&mut self) {
-        let config = text_view_text(&self.wireguard_text);
-        if config.trim().is_empty() {
-            self.network_status
-                .set_label("Paste a WireGuard configuration before adding a network");
-            return;
-        }
-
-        match daemon_api::add_wireguard(config).await {
-            Ok(id) => {
-                self.network_status
-                    .set_label(&format!("Added WireGuard network #{id}"));
-                self.wireguard_text.buffer().set_text("");
-                self.refresh_networks().await;
-            }
-            Err(error) => self
-                .network_status
-                .set_label(&format!("Unable to add WireGuard network: {error}")),
-        }
-    }
-
-    async fn discover_tailnet(&mut self) {
-        let email = self.tailnet_email_entry.text().to_string();
-        let Ok(email) = daemon_api::require_value(&email, "Email address") else {
-            self.tailnet_status
-                .set_label("Enter an email address before discovery");
-            return;
-        };
-
-        self.tailnet_status.set_label("Discovering Tailnet server");
-        match daemon_api::discover_tailnet(email).await {
-            Ok(discovery) => {
-                self.tailnet_authority_entry.set_text(&discovery.authority);
-                self.custom_authority_switch.set_active(!discovery.managed);
-                let issuer = discovery
-                    .oidc_issuer
-                    .map(|issuer| format!(" OIDC issuer: {issuer}."))
-                    .unwrap_or_default();
-                let kind = if discovery.managed {
-                    "managed authority"
-                } else {
-                    "custom authority"
-                };
-                self.tailnet_status.set_label(&format!(
-                    "Discovered {kind}: {}.{issuer}",
-                    discovery.authority
-                ));
-            }
-            Err(error) => self
-                .tailnet_status
-                .set_label(&format!("Tailnet discovery failed: {error}")),
-        }
-    }
-
-    async fn probe_tailnet(&mut self) {
-        let authority = self.tailnet_authority();
-        let Ok(authority) = daemon_api::require_value(&authority, "Tailnet server URL") else {
-            self.tailnet_status
-                .set_label("Enter a Tailnet server URL before probing");
-            return;
-        };
-
-        self.tailnet_status.set_label("Checking Tailnet server");
-        match daemon_api::probe_tailnet(authority).await {
-            Ok(probe) => {
-                let detail = probe
-                    .detail
-                    .unwrap_or_else(|| format!("HTTP {}", probe.status_code));
-                self.tailnet_status
-                    .set_label(&format!("{}: {detail}", probe.summary));
-            }
-            Err(error) => self
-                .tailnet_status
-                .set_label(&format!("Tailnet probe failed: {error}")),
-        }
-    }
-
-    async fn start_tailnet_login(&mut self, sender: AsyncComponentSender<Self>) {
-        let authority = self.tailnet_authority();
-        let Ok(authority) = daemon_api::require_value(&authority, "Tailnet server URL") else {
-            self.tailnet_status
-                .set_label("Enter a Tailnet server URL before sign-in");
-            return;
-        };
-        let account = daemon_api::normalized(&self.tailnet_account_entry.text(), "default");
-        let identity = daemon_api::normalized(&self.tailnet_identity_entry.text(), "linux");
-        let hostname = daemon_api::normalized_optional(&self.tailnet_hostname_entry.text());
-
-        self.tailnet_status.set_label("Starting Tailnet sign-in");
-        match daemon_api::start_tailnet_login(authority, account, identity, hostname).await {
-            Ok(status) => {
-                self.apply_login_status(&status);
-                if let Some(auth_url) = status.auth_url.as_deref() {
-                    if let Err(error) = open_auth_url(auth_url) {
-                        self.tailnet_status.set_label(&format!(
-                            "{} Open this URL manually: {auth_url}. Browser launch failed: {error}",
-                            self.tailnet_status.text()
-                        ));
-                    }
-                }
-                if !status.running {
-                    sender.input(NetworksScreenMsg::PollTailnetLogin);
-                }
-            }
-            Err(error) => self
-                .tailnet_status
-                .set_label(&format!("Tailnet sign-in failed: {error}")),
-        }
-    }
-
-    async fn poll_tailnet_login(&mut self, sender: AsyncComponentSender<Self>) {
-        let Some(session_id) = self.tailnet_session_id.clone() else {
-            return;
-        };
-        if self.tailnet_running {
-            return;
-        }
-
-        tokio::time::sleep(Duration::from_secs(1)).await;
-        match daemon_api::tailnet_login_status(session_id).await {
-            Ok(status) => {
-                self.apply_login_status(&status);
-                if !status.running {
-                    sender.input(NetworksScreenMsg::PollTailnetLogin);
-                }
-            }
-            Err(error) => {
-                self.tailnet_status
-                    .set_label(&format!("Tailnet sign-in status failed: {error}"));
-                self.tailnet_session_id = None;
-            }
-        }
-    }
-
-    async fn cancel_tailnet_login(&mut self) {
-        let Some(session_id) = self.tailnet_session_id.clone() else {
-            self.tailnet_status
-                .set_label("No Tailnet sign-in is active");
-            return;
-        };
-
-        match daemon_api::cancel_tailnet_login(session_id).await {
-            Ok(()) => {
-                self.tailnet_session_id = None;
-                self.tailnet_running = false;
-                self.tailnet_status.set_label("Tailnet sign-in cancelled");
-            }
-            Err(error) => self
-                .tailnet_status
-                .set_label(&format!("Unable to cancel Tailnet sign-in: {error}")),
-        }
-    }
-
-    async fn add_tailnet(&mut self) {
-        let authority = self.tailnet_authority();
-        let Ok(authority) = daemon_api::require_value(&authority, "Tailnet server URL") else {
-            self.tailnet_status
-                .set_label("Enter a Tailnet server URL before saving");
-            return;
-        };
-        if self.tailnet_session_id.is_some() && !self.tailnet_running {
-            self.tailnet_status
-                .set_label("Finish browser sign-in before saving this Tailnet network");
-            return;
-        }
-
-        let account = daemon_api::normalized(&self.tailnet_account_entry.text(), "default");
-        let identity = daemon_api::normalized(&self.tailnet_identity_entry.text(), "linux");
-        let hostname = daemon_api::normalized_optional(&self.tailnet_hostname_entry.text());
-        let tailnet = daemon_api::normalized_optional(&self.tailnet_name_entry.text());
-
-        match daemon_api::add_tailnet(authority, account, identity, hostname, tailnet).await {
-            Ok(id) => {
-                self.tailnet_status
-                    .set_label(&format!("Saved Tailnet network #{id}"));
-                self.refresh_networks().await;
-            }
-            Err(error) => self
-                .tailnet_status
-                .set_label(&format!("Unable to save Tailnet network: {error}")),
-        }
-    }
-
-    fn apply_login_status(&mut self, status: &daemon_api::TailnetLoginStatus) {
-        self.tailnet_session_id = Some(status.session_id.clone());
-        self.tailnet_running = status.running;
-
-        let mut parts = Vec::new();
-        if status.running {
-            parts.push("Signed in".to_owned());
-        } else if status.needs_login {
-            parts.push("Browser sign-in required".to_owned());
-        } else {
-            parts.push("Checking sign-in".to_owned());
-        }
-        if !status.backend_state.is_empty() {
-            parts.push(format!("State: {}", status.backend_state));
-        }
-        if let Some(tailnet_name) = &status.tailnet_name {
-            parts.push(format!("Tailnet: {tailnet_name}"));
-        }
-        if let Some(self_dns_name) = &status.self_dns_name {
-            parts.push(self_dns_name.clone());
-        }
-        if !status.tailnet_ips.is_empty() {
-            parts.push(status.tailnet_ips.join(", "));
-        }
-        if !status.health.is_empty() {
-            parts.push(status.health.join(" / "));
-        }
-        if let Some(auth_url) = &status.auth_url {
-            parts.push(format!("Auth URL: {auth_url}"));
-        }
-
-        self.tailnet_status.set_label(&parts.join("\n"));
-    }
-
-    fn tailnet_authority(&self) -> String {
-        if self.custom_authority_switch.is_active() {
-            self.tailnet_authority_entry.text().to_string()
-        } else {
-            let authority = self.tailnet_authority_entry.text();
-            if authority.trim().is_empty() {
-                daemon_api::default_tailnet_authority().to_owned()
-            } else {
-                authority.to_string()
-            }
-        }
-    }
-
-    fn clear_networks(&self) {
-        while let Some(child) = self.list_box.first_child() {
-            self.list_box.remove(&child);
-        }
-    }
-
-    fn render_networks(&self, networks: &[daemon_api::NetworkSummary]) {
-        self.clear_networks();
-        if networks.is_empty() {
-            let row = adw::ActionRow::builder()
-                .title("No networks")
-                .subtitle("Save a WireGuard or Tailnet network to use it here.")
-                .build();
-            self.list_box.append(&row);
-            return;
-        }
-
-        for network in networks {
-            let title = format!("{} (#{})", network.title, network.id);
-            let row = adw::ActionRow::builder()
-                .title(&title)
-                .subtitle(&network.detail)
-                .build();
-            self.list_box.append(&row);
-        }
-    }
-}
-
-fn text_view_text(text_view: &gtk::TextView) -> String {
-    let buffer = text_view.buffer();
-    buffer
-        .text(&buffer.start_iter(), &buffer.end_iter(), true)
-        .to_string()
-}
-
-fn open_auth_url(url: &str) -> Result<()> {
-    gtk::gio::AppInfo::launch_default_for_uri(url, None::<&gtk::gio::AppLaunchContext>)
-        .with_context(|| format!("failed to open {url}"))
-}
diff --git a/burrow-gtk/src/components/settings/daemon_group.rs b/burrow-gtk/src/components/settings/daemon_group.rs
deleted file mode 100644
index d04e30f..0000000
--- a/burrow-gtk/src/components/settings/daemon_group.rs
+++ /dev/null
@@ -1,108 +0,0 @@
-use super::*;
-use std::process::Command;
-
-#[derive(Debug)]
-pub struct DaemonGroup {
-    system_setup: SystemSetup,
-    already_running: bool,
-}
-
-pub struct DaemonGroupInit {
-    pub system_setup: SystemSetup,
-}
-
-#[derive(Debug)]
-pub enum DaemonGroupMsg {
-    LaunchLocal,
-    DaemonStateChange,
-}
-
-#[relm4::component(pub, async)]
-impl AsyncComponent for DaemonGroup {
-    type Init = DaemonGroupInit;
-    type Input = DaemonGroupMsg;
-    type Output = ();
-    type CommandOutput = ();
-
-    view! {
-        #[name(group)]
-        adw::PreferencesGroup {
-            #[watch]
-            set_sensitive:
-                (model.system_setup == SystemSetup::AppImage || model.system_setup == SystemSetup::Other) &&
-                !model.already_running,
-            set_title: "Local Daemon",
-            set_description: Some("Run Local Daemon"),
-
-            gtk::Button {
-                set_label: "Launch",
-                connect_clicked => DaemonGroupMsg::LaunchLocal
-            }
-        }
-    }
-
-    async fn init(
-        init: Self::Init,
-        root: Self::Root,
-        sender: AsyncComponentSender<Self>,
-    ) -> AsyncComponentParts<Self> {
-        //  Should be impossible to panic here
-        let model = DaemonGroup {
-            system_setup: init.system_setup,
-            already_running: daemon_api::daemon_available().await,
-        };
-
-        let widgets = view_output!();
-
-        AsyncComponentParts { model, widgets }
-    }
-
-    async fn update(
-        &mut self,
-        msg: Self::Input,
-        _sender: AsyncComponentSender<Self>,
-        _root: &Self::Root,
-    ) {
-        match msg {
-            DaemonGroupMsg::LaunchLocal => {
-                let burrow_original_bin = std::env::vars()
-                    .find(|(k, _)| k == "APPDIR")
-                    .map(|(_, v)| v + "/usr/bin/burrow")
-                    .unwrap_or("/usr/bin/burrow".to_owned());
-
-                let mut burrow_bin =
-                    String::from_utf8(Command::new("mktemp").output().unwrap().stdout).unwrap();
-                burrow_bin.pop();
-
-                let privileged_spawn_script = format!(
-                    r#"TEMP=$(mktemp -p /root)
-cp {} $TEMP
-chmod +x $TEMP
-setcap CAP_NET_BIND_SERVICE,CAP_NET_ADMIN+eip $TEMP
-mv $TEMP /tmp/burrow-detached-daemon"#,
-                    burrow_original_bin
-                )
-                .replace('\n', "&&");
-
-                //  TODO: Handle error condition
-
-                Command::new("pkexec")
-                    .arg("sh")
-                    .arg("-c")
-                    .arg(privileged_spawn_script)
-                    .arg(&burrow_bin)
-                    .output()
-                    .unwrap();
-
-                Command::new("/tmp/burrow-detached-daemon")
-                    .env("RUST_LOG", "debug")
-                    .arg("daemon")
-                    .spawn()
-                    .unwrap();
-            }
-            DaemonGroupMsg::DaemonStateChange => {
-                self.already_running = daemon_api::daemon_available().await;
-            }
-        }
-    }
-}
diff --git a/burrow-gtk/src/components/settings/diag_group.rs b/burrow-gtk/src/components/settings/diag_group.rs
index e1e9b78..be542cd 100644
--- a/burrow-gtk/src/components/settings/diag_group.rs
+++ b/burrow-gtk/src/components/settings/diag_group.rs
@@ -1,8 +1,11 @@
 use super::*;
+use diag::{StatusTernary, SystemSetup};
 
 #[derive(Debug)]
 pub struct DiagGroup {
-    system_setup: SystemSetup,
+    daemon_client: Arc<Mutex<Option<DaemonClient>>>,
+
+    init_system: SystemSetup,
     service_installed: StatusTernary,
     socket_installed: StatusTernary,
     socket_enabled: StatusTernary,
@@ -10,20 +13,21 @@ pub struct DiagGroup {
 }
 
 pub struct DiagGroupInit {
-    pub system_setup: SystemSetup,
+    pub daemon_client: Arc<Mutex<Option<DaemonClient>>>,
 }
 
 impl DiagGroup {
-    async fn new() -> Result<Self> {
-        let system_setup = SystemSetup::new();
-        let daemon_running = daemon_api::daemon_available().await;
+    async fn new(daemon_client: Arc<Mutex<Option<DaemonClient>>>) -> Result<Self> {
+        let setup = SystemSetup::new();
+        let daemon_running = daemon_client.lock().await.is_some();
 
         Ok(Self {
-            service_installed: system_setup.is_service_installed()?,
-            socket_installed: system_setup.is_socket_installed()?,
-            socket_enabled: system_setup.is_socket_enabled()?,
+            service_installed: setup.is_service_installed()?,
+            socket_installed: setup.is_socket_installed()?,
+            socket_enabled: setup.is_socket_enabled()?,
             daemon_running,
-            system_setup,
+            init_system: setup,
+            daemon_client,
         })
     }
 }
@@ -48,7 +52,7 @@ impl AsyncComponent for DiagGroup {
 
             adw::ActionRow {
                 #[watch]
-                set_title: &format!("System Type: {}", model.system_setup)
+                set_title: &format!("Init System: {}", model.init_system)
             },
             adw::ActionRow {
                 #[watch]
@@ -91,8 +95,7 @@ impl AsyncComponent for DiagGroup {
         sender: AsyncComponentSender<Self>,
     ) -> AsyncComponentParts<Self> {
         //  Should be impossible to panic here
-        let mut model = DiagGroup::new().await.unwrap();
-        model.system_setup = init.system_setup;
+        let model = DiagGroup::new(init.daemon_client).await.unwrap();
 
         let widgets = view_output!();
 
@@ -108,7 +111,7 @@ impl AsyncComponent for DiagGroup {
         match msg {
             DiagGroupMsg::Refresh => {
                 //  Should be impossible to panic here
-                *self = Self::new().await.unwrap();
+                *self = Self::new(Arc::clone(&self.daemon_client)).await.unwrap();
             }
         }
     }
diff --git a/burrow-gtk/src/components/settings/mod.rs b/burrow-gtk/src/components/settings/mod.rs
index aa87db2..53f46d4 100644
--- a/burrow-gtk/src/components/settings/mod.rs
+++ b/burrow-gtk/src/components/settings/mod.rs
@@ -1,8 +1,5 @@
 use super::*;
-use diag::{StatusTernary, SystemSetup};
 
-mod daemon_group;
 mod diag_group;
 
-pub use daemon_group::{DaemonGroup, DaemonGroupInit, DaemonGroupMsg};
-pub use diag_group::{DiagGroup, DiagGroupInit, DiagGroupMsg};
+pub use diag_group::{DiagGroup, DiagGroupInit};
diff --git a/burrow-gtk/src/components/settings_screen.rs b/burrow-gtk/src/components/settings_screen.rs
index 9828c31..778eb84 100644
--- a/burrow-gtk/src/components/settings_screen.rs
+++ b/burrow-gtk/src/components/settings_screen.rs
@@ -1,20 +1,17 @@
 use super::*;
-use diag::SystemSetup;
 
 pub struct SettingsScreen {
-    diag_group: AsyncController<settings::DiagGroup>,
-    daemon_group: AsyncController<settings::DaemonGroup>,
+    _diag_group: AsyncController<settings::DiagGroup>,
 }
 
-#[derive(Debug, PartialEq, Eq)]
-pub enum SettingsScreenMsg {
-    DaemonStateChange,
+pub struct SettingsScreenInit {
+    pub daemon_client: Arc<Mutex<Option<DaemonClient>>>,
 }
 
 #[relm4::component(pub)]
 impl SimpleComponent for SettingsScreen {
-    type Init = ();
-    type Input = SettingsScreenMsg;
+    type Init = SettingsScreenInit;
+    type Input = ();
     type Output = ();
 
     view! {
@@ -23,39 +20,25 @@ impl SimpleComponent for SettingsScreen {
     }
 
     fn init(
-        _init: Self::Init,
-        root: &Self::Root,
+        init: Self::Init,
+        root: Self::Root,
         sender: ComponentSender<Self>,
     ) -> ComponentParts<Self> {
-        let system_setup = SystemSetup::new();
-
         let diag_group = settings::DiagGroup::builder()
-            .launch(settings::DiagGroupInit { system_setup })
-            .forward(sender.input_sender(), |_| {
-                SettingsScreenMsg::DaemonStateChange
-            });
-
-        let daemon_group = settings::DaemonGroup::builder()
-            .launch(settings::DaemonGroupInit { system_setup })
-            .forward(sender.input_sender(), |_| {
-                SettingsScreenMsg::DaemonStateChange
-            });
+            .launch(settings::DiagGroupInit {
+                daemon_client: Arc::clone(&init.daemon_client),
+            })
+            .forward(sender.input_sender(), |_| ());
 
         let widgets = view_output!();
         widgets.preferences.add(diag_group.widget());
-        widgets.preferences.add(daemon_group.widget());
 
-        let model = SettingsScreen { diag_group, daemon_group };
+        let model = SettingsScreen {
+            _diag_group: diag_group,
+        };
 
         ComponentParts { model, widgets }
     }
 
-    fn update(&mut self, _: Self::Input, _sender: ComponentSender<Self>) {
-        //  Currently, `SettingsScreenMsg` only has one variant, so the if is ambiguous.
-        //
-        // if let SettingsScreenMsg::DaemonStateChange = msg {
-        self.diag_group.emit(DiagGroupMsg::Refresh);
-        self.daemon_group.emit(DaemonGroupMsg::DaemonStateChange);
-        // }
-    }
+    fn update(&mut self, _: Self::Input, _sender: ComponentSender<Self>) {}
 }
diff --git a/burrow-gtk/src/components/switch_screen.rs b/burrow-gtk/src/components/switch_screen.rs
index bbc5f82..a296c09 100644
--- a/burrow-gtk/src/components/switch_screen.rs
+++ b/burrow-gtk/src/components/switch_screen.rs
@@ -1,22 +1,27 @@
 use super::*;
 
 pub struct SwitchScreen {
+    daemon_client: Arc<Mutex<Option<DaemonClient>>>,
     switch: gtk::Switch,
     switch_screen: gtk::Box,
     disconnected_banner: adw::Banner,
-    status_label: gtk::Label,
+}
+
+pub struct SwitchScreenInit {
+    pub daemon_client: Arc<Mutex<Option<DaemonClient>>>,
 }
 
 #[derive(Debug, PartialEq, Eq)]
 pub enum SwitchScreenMsg {
-    Refresh,
+    DaemonReconnect,
+    DaemonDisconnect,
     Start,
     Stop,
 }
 
 #[relm4::component(pub, async)]
 impl AsyncComponent for SwitchScreen {
-    type Init = ();
+    type Init = SwitchScreenInit;
     type Input = SwitchScreenMsg;
     type Output = ();
     type CommandOutput = ();
@@ -24,7 +29,7 @@ impl AsyncComponent for SwitchScreen {
     view! {
         gtk::Box {
             set_orientation: gtk::Orientation::Vertical,
-            set_valign: Align::Fill,
+            set_valign: Align::BaselineFill,
 
             gtk::Box {
                 set_orientation: gtk::Orientation::Vertical,
@@ -34,7 +39,7 @@ impl AsyncComponent for SwitchScreen {
 
                 #[name(setup_banner)]
                 adw::Banner {
-                    set_title: "Burrow daemon is not reachable",
+                    set_title: "Burrow is not running!",
                 },
             },
 
@@ -47,12 +52,7 @@ impl AsyncComponent for SwitchScreen {
                 set_vexpand: true,
 
                 gtk::Label {
-                    set_label: "Burrow Tunnel",
-                },
-
-                #[name(status_label)]
-                gtk::Label {
-                    set_label: "Checking daemon status",
+                    set_label: "Burrow Switch",
                 },
 
                 #[name(switch)]
@@ -68,76 +68,91 @@ impl AsyncComponent for SwitchScreen {
     }
 
     async fn init(
-        _: Self::Init,
+        init: Self::Init,
         root: Self::Root,
         sender: AsyncComponentSender<Self>,
     ) -> AsyncComponentParts<Self> {
+        let mut initial_switch_status = false;
+        let mut initial_daemon_server_down = false;
+
+        if let Some(daemon_client) = init.daemon_client.lock().await.as_mut() {
+            if let Ok(res) = daemon_client
+                .send_command(DaemonCommand::ServerInfo)
+                .await
+                .as_ref()
+            {
+                initial_switch_status = match res.result.as_ref() {
+                    Ok(DaemonResponseData::None) => false,
+                    Ok(DaemonResponseData::ServerInfo(_)) => true,
+                    _ => false,
+                };
+            } else {
+                initial_daemon_server_down = true;
+            }
+        } else {
+            initial_daemon_server_down = true;
+        }
+
         let widgets = view_output!();
 
-        let mut model = SwitchScreen {
+        widgets.switch.set_active(initial_switch_status);
+
+        if initial_daemon_server_down {
+            *init.daemon_client.lock().await = None;
+            widgets.switch.set_active(false);
+            widgets.switch_screen.set_sensitive(false);
+            widgets.setup_banner.set_revealed(true);
+        }
+
+        let model = SwitchScreen {
+            daemon_client: init.daemon_client,
             switch: widgets.switch.clone(),
             switch_screen: widgets.switch_screen.clone(),
             disconnected_banner: widgets.setup_banner.clone(),
-            status_label: widgets.status_label.clone(),
         };
 
-        model.refresh().await;
-
         AsyncComponentParts { model, widgets }
     }
 
     async fn update(
         &mut self,
         msg: Self::Input,
-        _sender: AsyncComponentSender<Self>,
+        _: AsyncComponentSender<Self>,
         _root: &Self::Root,
     ) {
-        match msg {
-            SwitchScreenMsg::Refresh => self.refresh().await,
-            SwitchScreenMsg::Start => {
-                match daemon_api::start_tunnel().await {
-                    Ok(()) => self.status_label.set_label("Tunnel running"),
-                    Err(error) => self
-                        .status_label
-                        .set_label(&format!("Start failed: {error}")),
-                }
-                self.refresh().await;
-            }
-            SwitchScreenMsg::Stop => {
-                match daemon_api::stop_tunnel().await {
-                    Ok(()) => self.status_label.set_label("Tunnel stopped"),
-                    Err(error) => self
-                        .status_label
-                        .set_label(&format!("Stop failed: {error}")),
-                }
-                self.refresh().await;
-            }
-        }
-    }
-}
+        let mut disconnected_daemon_client = false;
 
-impl SwitchScreen {
-    async fn refresh(&mut self) {
-        match daemon_api::tunnel_state().await {
-            Ok(daemon_api::TunnelState::Running) => {
-                self.disconnected_banner.set_revealed(false);
-                self.switch_screen.set_sensitive(true);
-                self.status_label.set_label("Tunnel running");
-                self.switch.set_active(true);
-            }
-            Ok(daemon_api::TunnelState::Stopped) => {
-                self.disconnected_banner.set_revealed(false);
-                self.switch_screen.set_sensitive(true);
-                self.status_label.set_label("Tunnel stopped");
-                self.switch.set_active(false);
-            }
-            Err(error) => {
-                self.disconnected_banner.set_revealed(true);
-                self.switch_screen.set_sensitive(false);
-                self.status_label
-                    .set_label(&format!("Daemon unavailable: {error}"));
-                self.switch.set_active(false);
+        if let Some(daemon_client) = self.daemon_client.lock().await.as_mut() {
+            match msg {
+                Self::Input::Start => {
+                    if let Err(_e) = daemon_client
+                        .send_command(DaemonCommand::Start(Default::default()))
+                        .await
+                    {
+                        disconnected_daemon_client = true;
+                    }
+                }
+                Self::Input::Stop => {
+                    if let Err(_e) = daemon_client.send_command(DaemonCommand::Stop).await {
+                        disconnected_daemon_client = true;
+                    }
+                }
+                _ => {}
             }
+        } else {
+            disconnected_daemon_client = true;
+        }
+
+        if msg == Self::Input::DaemonReconnect {
+            self.disconnected_banner.set_revealed(false);
+            self.switch_screen.set_sensitive(true);
+        }
+
+        if disconnected_daemon_client || msg == Self::Input::DaemonDisconnect {
+            *self.daemon_client.lock().await = None;
+            self.switch.set_active(false);
+            self.switch_screen.set_sensitive(false);
+            self.disconnected_banner.set_revealed(true);
         }
     }
 }
diff --git a/burrow-gtk/src/daemon_api.rs b/burrow-gtk/src/daemon_api.rs
deleted file mode 100644
index 4ff8bf5..0000000
--- a/burrow-gtk/src/daemon_api.rs
+++ /dev/null
@@ -1,420 +0,0 @@
-use anyhow::{anyhow, Context, Result};
-use burrow::{
-    control::{TailnetConfig, TailnetProvider},
-    grpc_defs::{
-        Empty, Network, NetworkType, State, TailnetDiscoverRequest, TailnetLoginCancelRequest,
-        TailnetLoginStartRequest, TailnetLoginStatusRequest, TailnetProbeRequest,
-    },
-    BurrowClient,
-};
-use std::{path::PathBuf, sync::OnceLock};
-use tokio::time::{timeout, Duration};
-
-const RPC_TIMEOUT: Duration = Duration::from_secs(3);
-const MANAGED_TAILSCALE_AUTHORITY: &str = "https://controlplane.tailscale.com";
-static EMBEDDED_DAEMON_STARTED: OnceLock<()> = OnceLock::new();
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum TunnelState {
-    Running,
-    Stopped,
-}
-
-#[derive(Debug, Clone)]
-pub struct NetworkSummary {
-    pub id: i32,
-    pub title: String,
-    pub detail: String,
-}
-
-#[derive(Debug, Clone)]
-pub struct TailnetDiscovery {
-    pub authority: String,
-    pub managed: bool,
-    pub oidc_issuer: Option<String>,
-}
-
-#[derive(Debug, Clone)]
-pub struct TailnetProbe {
-    pub summary: String,
-    pub detail: Option<String>,
-    pub status_code: i32,
-}
-
-#[derive(Debug, Clone)]
-pub struct TailnetLoginStatus {
-    pub session_id: String,
-    pub backend_state: String,
-    pub auth_url: Option<String>,
-    pub running: bool,
-    pub needs_login: bool,
-    pub tailnet_name: Option<String>,
-    pub self_dns_name: Option<String>,
-    pub tailnet_ips: Vec<String>,
-    pub health: Vec<String>,
-}
-
-pub fn default_tailnet_authority() -> &'static str {
-    MANAGED_TAILSCALE_AUTHORITY
-}
-
-pub fn configure_client_paths() -> Result<()> {
-    if std::env::var_os("BURROW_SOCKET_PATH").is_none() {
-        std::env::set_var("BURROW_SOCKET_PATH", default_socket_path()?);
-    }
-    Ok(())
-}
-
-pub async fn ensure_daemon() -> Result<()> {
-    configure_client_paths()?;
-    if daemon_available().await {
-        return Ok(());
-    }
-
-    let socket_path = socket_path()?;
-    let db_path = database_path()?;
-    ensure_parent(&socket_path)?;
-    ensure_parent(&db_path)?;
-
-    if EMBEDDED_DAEMON_STARTED.get().is_none() {
-        tokio::task::spawn_blocking(move || {
-            burrow::spawn_in_process_with_paths(Some(socket_path), Some(db_path));
-        })
-        .await
-        .context("failed to join embedded daemon startup")?;
-        let _ = EMBEDDED_DAEMON_STARTED.set(());
-    }
-
-    tunnel_state()
-        .await
-        .map(|_| ())
-        .context("Burrow daemon started but did not accept tunnel status RPCs")
-}
-
-pub fn infer_tailnet_provider(authority: &str) -> TailnetProvider {
-    let normalized = authority.trim().trim_end_matches('/').to_ascii_lowercase();
-    if normalized == "controlplane.tailscale.com"
-        || normalized == "http://controlplane.tailscale.com"
-        || normalized == MANAGED_TAILSCALE_AUTHORITY
-    {
-        TailnetProvider::Tailscale
-    } else {
-        TailnetProvider::Headscale
-    }
-}
-
-pub async fn daemon_available() -> bool {
-    tunnel_state().await.is_ok()
-}
-
-fn socket_path() -> Result<PathBuf> {
-    if let Some(path) = std::env::var_os("BURROW_SOCKET_PATH") {
-        return Ok(PathBuf::from(path));
-    }
-    default_socket_path()
-}
-
-fn default_socket_path() -> Result<PathBuf> {
-    if let Some(runtime_dir) = std::env::var_os("XDG_RUNTIME_DIR") {
-        return Ok(PathBuf::from(runtime_dir).join("burrow.sock"));
-    }
-    let uid = std::env::var("UID").unwrap_or_else(|_| "1000".to_owned());
-    Ok(PathBuf::from(format!("/tmp/burrow-{uid}.sock")))
-}
-
-fn database_path() -> Result<PathBuf> {
-    if let Some(path) = std::env::var_os("BURROW_DB_PATH") {
-        return Ok(PathBuf::from(path));
-    }
-    if let Some(data_home) = std::env::var_os("XDG_DATA_HOME") {
-        return Ok(PathBuf::from(data_home).join("burrow").join("burrow.db"));
-    }
-    if let Some(home) = std::env::var_os("HOME") {
-        return Ok(PathBuf::from(home)
-            .join(".local")
-            .join("share")
-            .join("burrow")
-            .join("burrow.db"));
-    }
-    Ok(std::env::temp_dir().join("burrow.db"))
-}
-
-fn ensure_parent(path: &PathBuf) -> Result<()> {
-    if let Some(parent) = path.parent() {
-        std::fs::create_dir_all(parent)
-            .with_context(|| format!("failed to create {}", parent.display()))?;
-    }
-    Ok(())
-}
-
-pub async fn tunnel_state() -> Result<TunnelState> {
-    let mut client = BurrowClient::from_uds().await?;
-    let mut stream = timeout(RPC_TIMEOUT, client.tunnel_client.tunnel_status(Empty {}))
-        .await
-        .context("timed out connecting to Burrow daemon")??
-        .into_inner();
-    let status = timeout(RPC_TIMEOUT, stream.message())
-        .await
-        .context("timed out reading Burrow tunnel status")??
-        .context("Burrow daemon ended the status stream without a state")?;
-    Ok(match status.state() {
-        State::Running => TunnelState::Running,
-        State::Stopped => TunnelState::Stopped,
-    })
-}
-
-pub async fn start_tunnel() -> Result<()> {
-    let mut client = BurrowClient::from_uds().await?;
-    timeout(RPC_TIMEOUT, client.tunnel_client.tunnel_start(Empty {}))
-        .await
-        .context("timed out starting Burrow tunnel")??;
-    Ok(())
-}
-
-pub async fn stop_tunnel() -> Result<()> {
-    let mut client = BurrowClient::from_uds().await?;
-    timeout(RPC_TIMEOUT, client.tunnel_client.tunnel_stop(Empty {}))
-        .await
-        .context("timed out stopping Burrow tunnel")??;
-    Ok(())
-}
-
-pub async fn list_networks() -> Result<Vec<NetworkSummary>> {
-    let mut client = BurrowClient::from_uds().await?;
-    let mut stream = timeout(RPC_TIMEOUT, client.networks_client.network_list(Empty {}))
-        .await
-        .context("timed out connecting to Burrow network list")??
-        .into_inner();
-    let response = timeout(RPC_TIMEOUT, stream.message())
-        .await
-        .context("timed out reading Burrow network list")??
-        .context("Burrow daemon ended the network stream without a snapshot")?;
-    Ok(response.network.iter().map(summarize_network).collect())
-}
-
-pub async fn add_wireguard(config: String) -> Result<i32> {
-    add_network(NetworkType::WireGuard, config.into_bytes()).await
-}
-
-pub async fn add_tailnet(
-    authority: String,
-    account: String,
-    identity: String,
-    hostname: Option<String>,
-    tailnet: Option<String>,
-) -> Result<i32> {
-    let provider = infer_tailnet_provider(&authority);
-    let config = TailnetConfig {
-        provider,
-        authority: Some(authority),
-        account: Some(account),
-        identity: Some(identity),
-        hostname,
-        tailnet,
-    };
-    let payload = serde_json::to_vec_pretty(&config)?;
-    add_network(NetworkType::Tailnet, payload).await
-}
-
-pub async fn discover_tailnet(email: String) -> Result<TailnetDiscovery> {
-    let mut client = BurrowClient::from_uds().await?;
-    let response = timeout(
-        RPC_TIMEOUT,
-        client
-            .tailnet_client
-            .discover(TailnetDiscoverRequest { email }),
-    )
-    .await
-    .context("timed out discovering Tailnet authority")??
-    .into_inner();
-
-    Ok(TailnetDiscovery {
-        authority: response.authority,
-        managed: response.managed,
-        oidc_issuer: optional(response.oidc_issuer),
-    })
-}
-
-pub async fn probe_tailnet(authority: String) -> Result<TailnetProbe> {
-    let mut client = BurrowClient::from_uds().await?;
-    let response = timeout(
-        RPC_TIMEOUT,
-        client
-            .tailnet_client
-            .probe(TailnetProbeRequest { authority }),
-    )
-    .await
-    .context("timed out probing Tailnet authority")??
-    .into_inner();
-
-    Ok(TailnetProbe {
-        summary: response.summary,
-        detail: optional(response.detail),
-        status_code: response.status_code,
-    })
-}
-
-pub async fn start_tailnet_login(
-    authority: String,
-    account_name: String,
-    identity_name: String,
-    hostname: Option<String>,
-) -> Result<TailnetLoginStatus> {
-    let mut client = BurrowClient::from_uds().await?;
-    let response = timeout(
-        RPC_TIMEOUT,
-        client.tailnet_client.login_start(TailnetLoginStartRequest {
-            account_name,
-            identity_name,
-            hostname: hostname.unwrap_or_default(),
-            authority,
-        }),
-    )
-    .await
-    .context("timed out starting Tailnet sign-in")??
-    .into_inner();
-    Ok(decode_tailnet_status(response))
-}
-
-pub async fn tailnet_login_status(session_id: String) -> Result<TailnetLoginStatus> {
-    let mut client = BurrowClient::from_uds().await?;
-    let response = timeout(
-        RPC_TIMEOUT,
-        client
-            .tailnet_client
-            .login_status(TailnetLoginStatusRequest { session_id }),
-    )
-    .await
-    .context("timed out reading Tailnet sign-in status")??
-    .into_inner();
-    Ok(decode_tailnet_status(response))
-}
-
-pub async fn cancel_tailnet_login(session_id: String) -> Result<()> {
-    let mut client = BurrowClient::from_uds().await?;
-    timeout(
-        RPC_TIMEOUT,
-        client
-            .tailnet_client
-            .login_cancel(TailnetLoginCancelRequest { session_id }),
-    )
-    .await
-    .context("timed out cancelling Tailnet sign-in")??;
-    Ok(())
-}
-
-async fn add_network(network_type: NetworkType, payload: Vec<u8>) -> Result<i32> {
-    let id = next_network_id().await?;
-    let mut client = BurrowClient::from_uds().await?;
-    timeout(
-        RPC_TIMEOUT,
-        client.networks_client.network_add(Network {
-            id,
-            r#type: network_type.into(),
-            payload,
-        }),
-    )
-    .await
-    .context("timed out saving network to Burrow daemon")??;
-    Ok(id)
-}
-
-async fn next_network_id() -> Result<i32> {
-    let networks = list_networks().await?;
-    Ok(networks.iter().map(|network| network.id).max().unwrap_or(0) + 1)
-}
-
-fn summarize_network(network: &Network) -> NetworkSummary {
-    match network.r#type() {
-        NetworkType::WireGuard => summarize_wireguard(network),
-        NetworkType::Tailnet => summarize_tailnet(network),
-    }
-}
-
-fn summarize_wireguard(network: &Network) -> NetworkSummary {
-    let payload = String::from_utf8_lossy(&network.payload);
-    let detail = payload
-        .lines()
-        .map(str::trim)
-        .find(|line| !line.is_empty() && !line.starts_with('['))
-        .unwrap_or("Stored WireGuard configuration")
-        .to_owned();
-    NetworkSummary {
-        id: network.id,
-        title: format!("WireGuard {}", network.id),
-        detail,
-    }
-}
-
-fn summarize_tailnet(network: &Network) -> NetworkSummary {
-    match TailnetConfig::from_slice(&network.payload) {
-        Ok(config) => {
-            let title = config
-                .tailnet
-                .clone()
-                .or(config.hostname.clone())
-                .unwrap_or_else(|| "Tailnet".to_owned());
-            let authority = config
-                .authority
-                .unwrap_or_else(|| "default authority".to_owned());
-            let account = config.account.unwrap_or_else(|| "default".to_owned());
-            NetworkSummary {
-                id: network.id,
-                title,
-                detail: format!("{authority} - account {account}"),
-            }
-        }
-        Err(error) => NetworkSummary {
-            id: network.id,
-            title: "Tailnet".to_owned(),
-            detail: format!("Unable to read Tailnet payload: {error}"),
-        },
-    }
-}
-
-fn decode_tailnet_status(
-    response: burrow::grpc_defs::TailnetLoginStatusResponse,
-) -> TailnetLoginStatus {
-    TailnetLoginStatus {
-        session_id: response.session_id,
-        backend_state: response.backend_state,
-        auth_url: optional(response.auth_url),
-        running: response.running,
-        needs_login: response.needs_login,
-        tailnet_name: optional(response.tailnet_name),
-        self_dns_name: optional(response.self_dns_name),
-        tailnet_ips: response.tailnet_ips,
-        health: response.health,
-    }
-}
-
-fn optional(value: String) -> Option<String> {
-    let trimmed = value.trim();
-    if trimmed.is_empty() {
-        None
-    } else {
-        Some(trimmed.to_owned())
-    }
-}
-
-pub fn normalized(value: &str, fallback: &str) -> String {
-    let trimmed = value.trim();
-    if trimmed.is_empty() {
-        fallback.to_owned()
-    } else {
-        trimmed.to_owned()
-    }
-}
-
-pub fn normalized_optional(value: &str) -> Option<String> {
-    let trimmed = value.trim();
-    if trimmed.is_empty() {
-        None
-    } else {
-        Some(trimmed.to_owned())
-    }
-}
-
-pub fn require_value(value: &str, label: &str) -> Result<String> {
-    normalized_optional(value).ok_or_else(|| anyhow!("{label} is required"))
-}
diff --git a/burrow-gtk/src/diag.rs b/burrow-gtk/src/diag.rs
index ab4757e..348293e 100644
--- a/burrow-gtk/src/diag.rs
+++ b/burrow-gtk/src/diag.rs
@@ -15,18 +15,15 @@ pub enum StatusTernary {
 //  Realistically, we may not explicitly "support" non-systemd platforms which would simply this
 //  code greatly.
 //  Along with replacing [`StatusTernary`] with good old [`bool`].
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy)]
 pub enum SystemSetup {
     Systemd,
-    AppImage,
     Other,
 }
 
 impl SystemSetup {
     pub fn new() -> Self {
-        if is_appimage() {
-            SystemSetup::AppImage
-        } else if Command::new("systemctl").arg("--version").output().is_ok() {
+        if Command::new("systemctl").arg("--version").output().is_ok() {
             SystemSetup::Systemd
         } else {
             SystemSetup::Other
@@ -36,7 +33,6 @@ impl SystemSetup {
     pub fn is_service_installed(&self) -> Result<StatusTernary> {
         match self {
             SystemSetup::Systemd => Ok(fs::metadata(SYSTEMD_SERVICE_LOC).is_ok().into()),
-            SystemSetup::AppImage => Ok(StatusTernary::NA),
             SystemSetup::Other => Ok(StatusTernary::NA),
         }
     }
@@ -44,7 +40,6 @@ impl SystemSetup {
     pub fn is_socket_installed(&self) -> Result<StatusTernary> {
         match self {
             SystemSetup::Systemd => Ok(fs::metadata(SYSTEMD_SOCKET_LOC).is_ok().into()),
-            SystemSetup::AppImage => Ok(StatusTernary::NA),
             SystemSetup::Other => Ok(StatusTernary::NA),
         }
     }
@@ -60,7 +55,6 @@ impl SystemSetup {
                 let output = String::from_utf8(output)?;
                 Ok((output == "enabled\n").into())
             }
-            SystemSetup::AppImage => Ok(StatusTernary::NA),
             SystemSetup::Other => Ok(StatusTernary::NA),
         }
     }
@@ -80,12 +74,7 @@ impl Display for SystemSetup {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         f.write_str(match self {
             SystemSetup::Systemd => "Systemd",
-            SystemSetup::AppImage => "AppImage",
             SystemSetup::Other => "Other",
         })
     }
 }
-
-pub fn is_appimage() -> bool {
-    std::env::vars().any(|(k, _)| k == "APPDIR")
-}
diff --git a/burrow-gtk/src/main.rs b/burrow-gtk/src/main.rs
index b47b63e..6f91e2a 100644
--- a/burrow-gtk/src/main.rs
+++ b/burrow-gtk/src/main.rs
@@ -1,15 +1,11 @@
 use anyhow::Result;
 
 pub mod components;
-mod account_store;
-mod daemon_api;
+mod diag;
 
 //  Generated using meson
 mod config;
 
 fn main() {
-    if let Err(error) = daemon_api::configure_client_paths() {
-        eprintln!("failed to configure Burrow daemon paths: {error}");
-    }
     components::App::run();
 }
diff --git a/burrow-server-compose.yml b/burrow-server-compose.yml
deleted file mode 100644
index 4ba31ee..0000000
--- a/burrow-server-compose.yml
+++ /dev/null
@@ -1,38 +0,0 @@
-version: "2.1"
-networks:
-  wg6:
-    enable_ipv6: true
-    ipam:
-      driver: default
-      config:
-        - subnet: "aa:bb:cc:de::/64"
-services:
-  burrow:
-    image: lscr.io/linuxserver/wireguard:latest
-    privileged: true
-    container_name: burrow_server
-    cap_add:
-      - NET_ADMIN
-      - SYS_MODULE
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=Asia/Calcutta
-      - SERVERURL=wg.burrow.rs
-      - SERVERPORT=51820
-      - PEERS=10
-      - PEERDNS=1.1.1.1
-      - INTERNAL_SUBNET=10.13.13.0
-      - ALLOWEDIPS=0.0.0.0/0, ::/0
-      - PERSISTENTKEEPALIVE_PEERS=all
-      - LOG_CONFS=true #optional
-    volumes:
-      - ./config:/config
-      - /lib/modules:/lib/modules
-    ports:
-      - 51820:51820/udp
-    sysctls:
-      - net.ipv4.conf.all.src_valid_mark=1
-      - net.ipv6.conf.all.disable_ipv6=0
-      - net.ipv6.conf.eth0.proxy_ndp=1
-    restart: unless-stopped
\ No newline at end of file
diff --git a/burrow/Cargo.toml b/burrow/Cargo.toml
index 22f3d25..4e7688b 100644
--- a/burrow/Cargo.toml
+++ b/burrow/Cargo.toml
@@ -10,37 +10,22 @@ crate-type = ["lib", "staticlib"]
 
 [dependencies]
 anyhow = "1.0"
-tokio = { version = "1.37", features = [
-    "rt",
-    "macros",
-    "sync",
-    "io-util",
-    "net",
-    "process",
-    "rt-multi-thread",
-    "signal",
-    "time",
-    "tracing",
-    "fs",
-] }
+tokio = { version = "1.21", features = ["rt", "macros", "sync", "io-util", "rt-multi-thread", "time", "tracing"] }
 tun = { version = "0.1", path = "../tun", features = ["serde", "tokio"] }
 clap = { version = "4.4", features = ["derive"] }
 tracing = "0.1"
 tracing-log = "0.1"
-tracing-subscriber = { version = "0.3", features = ["std", "env-filter"] }
+tracing-oslog = { git = "https://github.com/Stormshield-robinc/tracing-oslog" }
+tracing-subscriber = { version = "0.3" , features = ["std", "env-filter"] }
 log = "0.4"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1.0"
 blake2 = "0.10"
 chacha20poly1305 = "0.10"
 rand = "0.8"
-bytes = "1"
 rand_core = "0.6"
 aead = "0.5"
-x25519-dalek = { version = "2.0", features = [
-    "reusable_secrets",
-    "static_secrets",
-] }
+x25519-dalek = { version = "2.0", features = ["reusable_secrets", "static_secrets"] }
 ring = "0.17"
 parking_lot = "0.12"
 hmac = "0.12"
@@ -48,54 +33,23 @@ base64 = "0.21"
 fehler = "1.0"
 ip_network_table = "0.2"
 ip_network = "0.4"
-ipnetwork = { version = "0.21", features = ["serde"] }
 async-channel = "2.1"
 schemars = "0.8"
 futures = "0.3.28"
 once_cell = "1.19"
-arti-client = "0.40.0"
-hickory-proto = "0.25.2"
-netstack-smoltcp = "0.2.1"
-tokio-util = { version = "0.7.18", features = ["compat"] }
-tor-rtcompat = "0.40.0"
-console-subscriber = { version = "0.2.0", optional = true }
+console-subscriber = { version = "0.2.0" , optional = true }
 console = "0.15.8"
-axum = "0.7.4"
-argon2 = "0.5"
-reqwest = { version = "0.12", default-features = false, features = [
-    "json",
-    "rustls-tls",
-] }
-rusqlite = { version = "0.38.0", features = ["blob"] }
-dotenv = "0.15.0"
-tonic = "0.12.0"
-prost = "0.13.1"
-prost-types = "0.13.1"
-tokio-stream = "0.1"
-async-stream = "0.2"
-tower = { version = "0.4.13", features = ["util"] }
-hyper-util = "0.1.6"
-toml = "0.8.15"
-rust-ini = "0.21.0"
-subtle = "2.6"
 
 [target.'cfg(target_os = "linux")'.dependencies]
 caps = "0.5"
-libc = "0.2"
 libsystemd = "0.7"
-nix = { version = "0.27", features = ["fs", "socket", "uio"] }
 tracing-journald = "0.3"
 
 [target.'cfg(target_vendor = "apple")'.dependencies]
 nix = { version = "0.27" }
-rusqlite = { version = "0.38.0", features = ["bundled", "blob"] }
-
-[target.'cfg(target_os = "macos")'.dependencies]
-tracing-oslog = { git = "https://github.com/Stormshield-robinc/tracing-oslog" }
 
 [dev-dependencies]
 insta = { version = "1.32", features = ["yaml"] }
-tempfile = "3.13"
 
 [package.metadata.generate-rpm]
 assets = [
@@ -108,8 +62,3 @@ pre_uninstall_script = "../package/rpm/pre_uninstall"
 
 [features]
 tokio-console = ["dep:console-subscriber"]
-bundled = ["rusqlite/bundled"]
-
-
-[build-dependencies]
-tonic-build = "0.12.0"
diff --git a/burrow/build.rs b/burrow/build.rs
deleted file mode 100644
index 8eea5dc..0000000
--- a/burrow/build.rs
+++ /dev/null
@@ -1,4 +0,0 @@
-fn main() -> Result<(), Box<dyn std::error::Error>> {
-    tonic_build::compile_protos("../proto/burrow.proto")?;
-    Ok(())
-}
diff --git a/burrow/src/auth/mod.rs b/burrow/src/auth/mod.rs
deleted file mode 100644
index 74f47ad..0000000
--- a/burrow/src/auth/mod.rs
+++ /dev/null
@@ -1 +0,0 @@
-pub mod server;
diff --git a/burrow/src/auth/server/db.rs b/burrow/src/auth/server/db.rs
deleted file mode 100644
index c31c473..0000000
--- a/burrow/src/auth/server/db.rs
+++ /dev/null
@@ -1,627 +0,0 @@
-use anyhow::{anyhow, Context, Result};
-use argon2::{
-    password_hash::{PasswordHash, PasswordHasher, PasswordVerifier, SaltString},
-    Argon2,
-};
-use base64::{engine::general_purpose, Engine as _};
-use rand::RngCore;
-use rusqlite::{params, Connection, OptionalExtension};
-
-use crate::control::{
-    DnsConfig, Hostinfo, LocalAuthResponse, MapRequest, MapResponse, Node, NodeCapMap,
-    PacketFilter, PeerCapMap, RegisterRequest, UserProfile,
-};
-
-const CREATE_SCHEMA: &str = r#"
-CREATE TABLE IF NOT EXISTS auth_user (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    email TEXT NOT NULL UNIQUE,
-    display_name TEXT NOT NULL,
-    profile_pic_url TEXT,
-    groups_json TEXT NOT NULL DEFAULT '[]',
-    created_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS auth_local_credential (
-    user_id INTEGER PRIMARY KEY REFERENCES auth_user(id) ON DELETE CASCADE,
-    username TEXT NOT NULL UNIQUE,
-    password_hash TEXT NOT NULL,
-    rotated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS auth_session (
-    id TEXT PRIMARY KEY,
-    user_id INTEGER NOT NULL REFERENCES auth_user(id) ON DELETE CASCADE,
-    created_at TEXT NOT NULL DEFAULT (datetime('now')),
-    expires_at TEXT NOT NULL DEFAULT (datetime('now', '+7 days'))
-);
-
-CREATE TABLE IF NOT EXISTS control_node (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    stable_id TEXT NOT NULL UNIQUE,
-    user_id INTEGER NOT NULL REFERENCES auth_user(id) ON DELETE CASCADE,
-    name TEXT NOT NULL,
-    node_key TEXT NOT NULL UNIQUE,
-    machine_key TEXT,
-    disco_key TEXT,
-    addresses_json TEXT NOT NULL,
-    allowed_ips_json TEXT NOT NULL,
-    endpoints_json TEXT NOT NULL,
-    home_derp INTEGER,
-    hostinfo_json TEXT,
-    tags_json TEXT NOT NULL DEFAULT '[]',
-    primary_routes_json TEXT NOT NULL DEFAULT '[]',
-    cap_version INTEGER NOT NULL DEFAULT 1,
-    cap_map_json TEXT NOT NULL DEFAULT '{}',
-    peer_cap_map_json TEXT NOT NULL DEFAULT '{}',
-    machine_authorized INTEGER NOT NULL DEFAULT 1,
-    node_key_expired INTEGER NOT NULL DEFAULT 0,
-    created_at TEXT NOT NULL DEFAULT (datetime('now')),
-    updated_at TEXT NOT NULL DEFAULT (datetime('now')),
-    last_seen TEXT,
-    online INTEGER
-);
-"#;
-
-#[derive(Clone, Debug)]
-pub struct StoredUser {
-    pub profile: UserProfile,
-}
-
-pub fn init_db(path: &str) -> Result<()> {
-    let conn = Connection::open(path)?;
-    conn.execute_batch(CREATE_SCHEMA)?;
-    Ok(())
-}
-
-pub fn ensure_local_identity(
-    path: &str,
-    username: &str,
-    email: &str,
-    display_name: &str,
-    password: &str,
-) -> Result<UserProfile> {
-    let conn = Connection::open(path)?;
-    conn.execute(
-        "INSERT INTO auth_user (email, display_name) VALUES (?, ?)
-         ON CONFLICT(email) DO UPDATE SET display_name = excluded.display_name",
-        params![email, display_name],
-    )?;
-    let user_id: i64 =
-        conn.query_row("SELECT id FROM auth_user WHERE email = ?", [email], |row| {
-            row.get(0)
-        })?;
-
-    let existing_hash: Option<String> = conn
-        .query_row(
-            "SELECT password_hash FROM auth_local_credential WHERE user_id = ?",
-            [user_id],
-            |row| row.get(0),
-        )
-        .optional()?;
-
-    let password_hash = match existing_hash {
-        Some(hash) if verify_password(password, &hash) => hash,
-        _ => hash_password(password)?,
-    };
-
-    conn.execute(
-        "INSERT INTO auth_local_credential (user_id, username, password_hash)
-         VALUES (?, ?, ?)
-         ON CONFLICT(user_id) DO UPDATE SET username = excluded.username, password_hash = excluded.password_hash, rotated_at = datetime('now')",
-        params![user_id, username, password_hash],
-    )?;
-
-    load_user_profile(&conn, user_id)
-}
-
-pub fn authenticate_local(
-    path: &str,
-    identifier: &str,
-    password: &str,
-) -> Result<Option<LocalAuthResponse>> {
-    let conn = Connection::open(path)?;
-    let record = conn
-        .query_row(
-            "SELECT u.id, u.email, u.display_name, u.profile_pic_url, u.groups_json, c.password_hash
-             FROM auth_user u
-             JOIN auth_local_credential c ON c.user_id = u.id
-             WHERE c.username = ? OR u.email = ?",
-            params![identifier, identifier],
-            |row| {
-                Ok((
-                    row.get::<_, i64>(0)?,
-                    row.get::<_, String>(1)?,
-                    row.get::<_, String>(2)?,
-                    row.get::<_, Option<String>>(3)?,
-                    row.get::<_, String>(4)?,
-                    row.get::<_, String>(5)?,
-                ))
-            },
-        )
-        .optional()?;
-
-    let Some((user_id, email, display_name, profile_pic_url, groups_json, password_hash)) = record
-    else {
-        return Ok(None);
-    };
-
-    if !verify_password(password, &password_hash) {
-        return Ok(None);
-    }
-
-    let token = random_token();
-    conn.execute(
-        "INSERT INTO auth_session (id, user_id) VALUES (?, ?)",
-        params![token, user_id],
-    )?;
-
-    Ok(Some(LocalAuthResponse {
-        access_token: token,
-        user: UserProfile {
-            id: user_id,
-            login_name: email,
-            display_name,
-            profile_pic_url,
-            groups: parse_json(&groups_json)?,
-        },
-    }))
-}
-
-pub fn user_for_session(path: &str, token: &str) -> Result<Option<StoredUser>> {
-    let conn = Connection::open(path)?;
-    let user_id = conn
-        .query_row(
-            "SELECT user_id FROM auth_session WHERE id = ? AND expires_at > datetime('now')",
-            [token],
-            |row| row.get::<_, i64>(0),
-        )
-        .optional()?;
-    let Some(user_id) = user_id else {
-        return Ok(None);
-    };
-
-    Ok(Some(load_user(&conn, user_id)?))
-}
-
-pub fn upsert_node(path: &str, user: &StoredUser, request: &RegisterRequest) -> Result<Node> {
-    let conn = Connection::open(path)?;
-    let existing = find_existing_node(&conn, user.profile.id, request)?;
-    let name = Node::preferred_name(request);
-    let allowed_ips = Node::normalized_allowed_ips(request);
-
-    match existing {
-        Some((node_id, stable_id, created_at)) => {
-            conn.execute(
-                "UPDATE control_node
-                 SET name = ?, node_key = ?, machine_key = ?, disco_key = ?, addresses_json = ?, allowed_ips_json = ?,
-                     endpoints_json = ?, home_derp = ?, hostinfo_json = ?, tags_json = ?, primary_routes_json = ?,
-                     cap_version = ?, cap_map_json = ?, peer_cap_map_json = ?, updated_at = datetime('now'),
-                     last_seen = datetime('now'), online = 1
-                 WHERE id = ?",
-                params![
-                    name,
-                    request.node_key,
-                    request.machine_key,
-                    request.disco_key,
-                    to_json(&request.addresses)?,
-                    to_json(&allowed_ips)?,
-                    to_json(&request.endpoints)?,
-                    request.home_derp,
-                    optional_json(&request.hostinfo)?,
-                    to_json(&request.tags)?,
-                    to_json(&request.primary_routes)?,
-                    request.version.max(1),
-                    to_json(&request.cap_map)?,
-                    to_json(&request.peer_cap_map)?,
-                    node_id,
-                ],
-            )?;
-            load_node(&conn, node_id, stable_id, Some(created_at))
-        }
-        None => {
-            conn.execute(
-                "INSERT INTO control_node (
-                    stable_id, user_id, name, node_key, machine_key, disco_key, addresses_json, allowed_ips_json,
-                    endpoints_json, home_derp, hostinfo_json, tags_json, primary_routes_json, cap_version,
-                    cap_map_json, peer_cap_map_json, last_seen, online
-                 ) VALUES ('', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, datetime('now'), 1)",
-                params![
-                    user.profile.id,
-                    name,
-                    request.node_key,
-                    request.machine_key,
-                    request.disco_key,
-                    to_json(&request.addresses)?,
-                    to_json(&allowed_ips)?,
-                    to_json(&request.endpoints)?,
-                    request.home_derp,
-                    optional_json(&request.hostinfo)?,
-                    to_json(&request.tags)?,
-                    to_json(&request.primary_routes)?,
-                    request.version.max(1),
-                    to_json(&request.cap_map)?,
-                    to_json(&request.peer_cap_map)?,
-                ],
-            )?;
-            let node_id = conn.last_insert_rowid();
-            let stable_id = format!("bn-{node_id}");
-            conn.execute(
-                "UPDATE control_node SET stable_id = ? WHERE id = ?",
-                params![stable_id, node_id],
-            )?;
-            load_node(&conn, node_id, stable_id, None)
-        }
-    }
-}
-
-pub fn map_for_node(
-    path: &str,
-    user: &StoredUser,
-    request: &MapRequest,
-    domain: &str,
-) -> Result<MapResponse> {
-    let conn = Connection::open(path)?;
-    apply_map_request(&conn, user.profile.id, request)?;
-    let self_row = conn
-        .query_row(
-            "SELECT id, stable_id, created_at FROM control_node WHERE user_id = ? AND node_key = ?",
-            params![user.profile.id, request.node_key],
-            |row| {
-                Ok((
-                    row.get::<_, i64>(0)?,
-                    row.get::<_, String>(1)?,
-                    row.get::<_, String>(2)?,
-                ))
-            },
-        )
-        .optional()?
-        .ok_or_else(|| anyhow!("node not registered"))?;
-
-    let node = load_node(&conn, self_row.0, self_row.1, Some(self_row.2))?;
-    let peers = load_peers(&conn, node.id)?;
-    Ok(MapResponse {
-        map_session_handle: Some(format!("map-{}", node.stable_id)),
-        seq: Some(request.map_session_seq.unwrap_or(0) + 1),
-        node,
-        peers,
-        domain: domain.to_owned(),
-        dns: Some(DnsConfig {
-            resolvers: vec!["1.1.1.1".to_owned(), "1.0.0.1".to_owned()],
-            search_domains: vec![domain.to_owned()],
-            magic_dns: true,
-        }),
-        packet_filters: vec![PacketFilter::default()],
-    })
-}
-
-pub static PATH: &str = "./server.sqlite3";
-
-fn apply_map_request(conn: &Connection, user_id: i64, request: &MapRequest) -> Result<()> {
-    let current = conn
-        .query_row(
-            "SELECT id FROM control_node WHERE user_id = ? AND node_key = ?",
-            params![user_id, request.node_key],
-            |row| row.get::<_, i64>(0),
-        )
-        .optional()?;
-
-    let Some(node_id) = current else {
-        return Ok(());
-    };
-
-    let hostinfo_json = optional_json(&request.hostinfo)?;
-    let endpoints_json = to_json(&request.endpoints)?;
-    conn.execute(
-        "UPDATE control_node
-         SET disco_key = COALESCE(?, disco_key),
-             hostinfo_json = CASE WHEN ? IS NULL THEN hostinfo_json ELSE ? END,
-             endpoints_json = CASE WHEN ? = '[]' THEN endpoints_json ELSE ? END,
-             updated_at = datetime('now'),
-             last_seen = datetime('now'),
-             online = 1
-         WHERE id = ?",
-        params![
-            request.disco_key,
-            hostinfo_json,
-            hostinfo_json,
-            endpoints_json,
-            endpoints_json,
-            node_id,
-        ],
-    )?;
-    Ok(())
-}
-
-fn find_existing_node(
-    conn: &Connection,
-    user_id: i64,
-    request: &RegisterRequest,
-) -> Result<Option<(i64, String, String)>> {
-    let mut candidates = vec![request.node_key.as_str()];
-    if let Some(old) = request.old_node_key.as_deref() {
-        if old != request.node_key {
-            candidates.push(old);
-        }
-    }
-
-    for candidate in candidates {
-        let hit = conn
-            .query_row(
-                "SELECT id, stable_id, created_at FROM control_node WHERE user_id = ? AND node_key = ?",
-                params![user_id, candidate],
-                |row| {
-                    Ok((
-                        row.get::<_, i64>(0)?,
-                        row.get::<_, String>(1)?,
-                        row.get::<_, String>(2)?,
-                    ))
-                },
-            )
-            .optional()?;
-        if hit.is_some() {
-            return Ok(hit);
-        }
-    }
-    Ok(None)
-}
-
-fn load_peers(conn: &Connection, self_id: i64) -> Result<Vec<Node>> {
-    let mut stmt = conn.prepare(
-        "SELECT id, stable_id, created_at FROM control_node WHERE id != ? AND machine_authorized = 1 ORDER BY id",
-    )?;
-    let peers = stmt
-        .query_map([self_id], |row| {
-            Ok((
-                row.get::<_, i64>(0)?,
-                row.get::<_, String>(1)?,
-                row.get::<_, String>(2)?,
-            ))
-        })?
-        .collect::<rusqlite::Result<Vec<_>>>()?;
-    peers
-        .into_iter()
-        .map(|(id, stable_id, created_at)| load_node(conn, id, stable_id, Some(created_at)))
-        .collect()
-}
-
-fn load_node(
-    conn: &Connection,
-    id: i64,
-    stable_id: String,
-    created_at_hint: Option<String>,
-) -> Result<Node> {
-    let row = conn.query_row(
-        "SELECT user_id, name, node_key, machine_key, disco_key, addresses_json, allowed_ips_json,
-                endpoints_json, home_derp, hostinfo_json, tags_json, primary_routes_json, cap_version,
-                cap_map_json, peer_cap_map_json, machine_authorized, node_key_expired,
-                created_at, updated_at, last_seen, online
-         FROM control_node WHERE id = ?",
-        [id],
-        |row| {
-            Ok((
-                row.get::<_, i64>(0)?,
-                row.get::<_, String>(1)?,
-                row.get::<_, String>(2)?,
-                row.get::<_, Option<String>>(3)?,
-                row.get::<_, Option<String>>(4)?,
-                row.get::<_, String>(5)?,
-                row.get::<_, String>(6)?,
-                row.get::<_, String>(7)?,
-                row.get::<_, Option<i32>>(8)?,
-                row.get::<_, Option<String>>(9)?,
-                row.get::<_, String>(10)?,
-                row.get::<_, String>(11)?,
-                row.get::<_, i32>(12)?,
-                row.get::<_, String>(13)?,
-                row.get::<_, String>(14)?,
-                row.get::<_, i64>(15)?,
-                row.get::<_, i64>(16)?,
-                row.get::<_, String>(17)?,
-                row.get::<_, String>(18)?,
-                row.get::<_, Option<String>>(19)?,
-                row.get::<_, Option<i64>>(20)?,
-            ))
-        },
-    )?;
-    Ok(Node {
-        id,
-        stable_id,
-        user_id: row.0,
-        name: row.1,
-        node_key: row.2,
-        machine_key: row.3,
-        disco_key: row.4,
-        addresses: parse_json(&row.5)?,
-        allowed_ips: parse_json(&row.6)?,
-        endpoints: parse_json(&row.7)?,
-        home_derp: row.8,
-        hostinfo: row.9.map(|raw| parse_json::<Hostinfo>(&raw)).transpose()?,
-        tags: parse_json(&row.10)?,
-        primary_routes: parse_json(&row.11)?,
-        cap_version: row.12,
-        cap_map: parse_json::<NodeCapMap>(&row.13)?,
-        peer_cap_map: parse_json::<PeerCapMap>(&row.14)?,
-        machine_authorized: row.15 != 0,
-        node_key_expired: row.16 != 0,
-        created_at: Some(created_at_hint.unwrap_or(row.17)),
-        updated_at: Some(row.18),
-        last_seen: row.19,
-        online: row.20.map(|value| value != 0),
-    })
-}
-
-fn load_user(conn: &Connection, user_id: i64) -> Result<StoredUser> {
-    let profile = load_user_profile(conn, user_id)?;
-    Ok(StoredUser { profile })
-}
-
-fn load_user_profile(conn: &Connection, user_id: i64) -> Result<UserProfile> {
-    let row = conn.query_row(
-        "SELECT email, display_name, profile_pic_url, groups_json FROM auth_user WHERE id = ?",
-        [user_id],
-        |row| {
-            Ok((
-                row.get::<_, String>(0)?,
-                row.get::<_, String>(1)?,
-                row.get::<_, Option<String>>(2)?,
-                row.get::<_, String>(3)?,
-            ))
-        },
-    )?;
-    Ok(UserProfile {
-        id: user_id,
-        login_name: row.0,
-        display_name: row.1,
-        profile_pic_url: row.2,
-        groups: parse_json(&row.3)?,
-    })
-}
-
-fn hash_password(password: &str) -> Result<String> {
-    let salt = SaltString::generate(&mut argon2::password_hash::rand_core::OsRng);
-    let hash = Argon2::default()
-        .hash_password(password.as_bytes(), &salt)
-        .map_err(|err| anyhow!("failed to hash password: {err}"))?;
-    Ok(hash.to_string())
-}
-
-fn verify_password(password: &str, password_hash: &str) -> bool {
-    PasswordHash::new(password_hash)
-        .ok()
-        .and_then(|hash| {
-            Argon2::default()
-                .verify_password(password.as_bytes(), &hash)
-                .ok()
-        })
-        .is_some()
-}
-
-fn random_token() -> String {
-    let mut bytes = [0u8; 32];
-    rand::thread_rng().fill_bytes(&mut bytes);
-    general_purpose::URL_SAFE_NO_PAD.encode(bytes)
-}
-
-fn to_json<T: serde::Serialize>(value: &T) -> Result<String> {
-    serde_json::to_string(value).context("failed to serialize json")
-}
-
-fn optional_json<T: serde::Serialize>(value: &Option<T>) -> Result<Option<String>> {
-    value.as_ref().map(to_json).transpose()
-}
-
-fn parse_json<T: serde::de::DeserializeOwned>(value: &str) -> Result<T> {
-    serde_json::from_str(value)
-        .with_context(|| format!("failed to decode json payload from '{value}'"))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::control::{Hostinfo, RegisterRequest};
-    use tempfile::TempDir;
-
-    fn temp_db() -> Result<(TempDir, String)> {
-        let dir = tempfile::tempdir()?;
-        let db_path = dir.path().join("server.sqlite3");
-        Ok((dir, db_path.to_string_lossy().to_string()))
-    }
-
-    #[test]
-    fn local_auth_and_map_round_trip() -> Result<()> {
-        let (_dir, db_path) = temp_db()?;
-        init_db(&db_path)?;
-        ensure_local_identity(
-            &db_path,
-            "contact",
-            "contact@burrow.net",
-            "Burrow Contact",
-            "password-1",
-        )?;
-
-        let auth = authenticate_local(&db_path, "contact", "password-1")?
-            .expect("expected login to succeed");
-        let user =
-            user_for_session(&db_path, &auth.access_token)?.expect("expected session to resolve");
-
-        let node = upsert_node(
-            &db_path,
-            &user,
-            &RegisterRequest {
-                node_key: "nodekey:aaaa".to_owned(),
-                machine_key: Some("machinekey:aaaa".to_owned()),
-                disco_key: Some("discokey:aaaa".to_owned()),
-                addresses: vec!["100.64.0.1/32".to_owned()],
-                endpoints: vec!["203.0.113.10:41641".to_owned()],
-                hostinfo: Some(Hostinfo {
-                    hostname: Some("burrow-dev".to_owned()),
-                    os: Some("linux".to_owned()),
-                    os_version: Some("6.13".to_owned()),
-                    services: vec!["ssh".to_owned()],
-                    request_tags: vec!["tag:dev".to_owned()],
-                }),
-                ..RegisterRequest::default()
-            },
-        )?;
-        assert_eq!(node.name, "burrow-dev");
-        assert_eq!(node.allowed_ips, vec!["100.64.0.1/32"]);
-
-        let map = map_for_node(
-            &db_path,
-            &user,
-            &MapRequest {
-                node_key: "nodekey:aaaa".to_owned(),
-                stream: true,
-                endpoints: vec!["203.0.113.10:41641".to_owned()],
-                ..MapRequest::default()
-            },
-            "burrow.net",
-        )?;
-        assert_eq!(map.node.node_key, "nodekey:aaaa");
-        assert_eq!(map.domain, "burrow.net");
-        assert!(map.dns.expect("dns config").magic_dns);
-        Ok(())
-    }
-
-    #[test]
-    fn register_can_rotate_node_keys() -> Result<()> {
-        let (_dir, db_path) = temp_db()?;
-        init_db(&db_path)?;
-        ensure_local_identity(
-            &db_path,
-            "contact",
-            "contact@burrow.net",
-            "Burrow Contact",
-            "password-1",
-        )?;
-        let auth = authenticate_local(&db_path, "contact@burrow.net", "password-1")?
-            .expect("expected login to succeed");
-        let user =
-            user_for_session(&db_path, &auth.access_token)?.expect("expected session to resolve");
-
-        upsert_node(
-            &db_path,
-            &user,
-            &RegisterRequest {
-                node_key: "nodekey:old".to_owned(),
-                addresses: vec!["100.64.0.2/32".to_owned()],
-                ..RegisterRequest::default()
-            },
-        )?;
-
-        let rotated = upsert_node(
-            &db_path,
-            &user,
-            &RegisterRequest {
-                node_key: "nodekey:new".to_owned(),
-                old_node_key: Some("nodekey:old".to_owned()),
-                addresses: vec!["100.64.0.3/32".to_owned()],
-                ..RegisterRequest::default()
-            },
-        )?;
-        assert_eq!(rotated.node_key, "nodekey:new");
-        assert_eq!(rotated.addresses, vec!["100.64.0.3/32"]);
-        Ok(())
-    }
-}
diff --git a/burrow/src/auth/server/mod.rs b/burrow/src/auth/server/mod.rs
deleted file mode 100644
index fdffce3..0000000
--- a/burrow/src/auth/server/mod.rs
+++ /dev/null
@@ -1,430 +0,0 @@
-pub mod db;
-pub mod tailscale;
-
-use std::{env, path::Path};
-
-use anyhow::{Context, Result};
-use axum::{
-    extract::{Json, Path as AxumPath, Query, State},
-    http::{header::AUTHORIZATION, HeaderMap, StatusCode},
-    response::IntoResponse,
-    routing::{get, post},
-    Router,
-};
-use serde::Deserialize;
-use tokio::signal;
-
-use crate::control::{
-    discovery, LocalAuthRequest, LocalAuthResponse, MapRequest, MapResponse, RegisterRequest,
-    RegisterResponse, TailnetDiscovery, BURROW_TAILNET_DOMAIN,
-};
-
-#[derive(Clone, Debug)]
-pub struct BootstrapIdentity {
-    pub username: String,
-    pub email: String,
-    pub display_name: String,
-    pub password_file: String,
-}
-
-impl Default for BootstrapIdentity {
-    fn default() -> Self {
-        Self {
-            username: "contact".to_owned(),
-            email: "contact@burrow.net".to_owned(),
-            display_name: "Burrow Contact".to_owned(),
-            password_file: "intake/forgejo_pass_contact_at_burrow_net.txt".to_owned(),
-        }
-    }
-}
-
-#[derive(Clone, Debug)]
-pub struct AuthServerConfig {
-    pub listen: String,
-    pub db_path: String,
-    pub tailnet_domain: String,
-    pub bootstrap: BootstrapIdentity,
-}
-
-impl Default for AuthServerConfig {
-    fn default() -> Self {
-        Self {
-            listen: "0.0.0.0:8080".to_owned(),
-            db_path: db::PATH.to_owned(),
-            tailnet_domain: BURROW_TAILNET_DOMAIN.to_owned(),
-            bootstrap: BootstrapIdentity::default(),
-        }
-    }
-}
-
-impl AuthServerConfig {
-    pub fn from_env() -> Self {
-        let mut config = Self::default();
-        if let Ok(value) = env::var("BURROW_AUTH_LISTEN") {
-            config.listen = value;
-        }
-        if let Ok(value) = env::var("BURROW_AUTH_DB_PATH") {
-            config.db_path = value;
-        }
-        if let Ok(value) = env::var("BURROW_AUTH_TAILNET_DOMAIN") {
-            config.tailnet_domain = value;
-        }
-        if let Ok(value) = env::var("BURROW_BOOTSTRAP_USERNAME") {
-            config.bootstrap.username = value;
-        }
-        if let Ok(value) = env::var("BURROW_BOOTSTRAP_EMAIL") {
-            config.bootstrap.email = value;
-        }
-        if let Ok(value) = env::var("BURROW_BOOTSTRAP_DISPLAY_NAME") {
-            config.bootstrap.display_name = value;
-        }
-        if let Ok(value) = env::var("BURROW_BOOTSTRAP_PASSWORD_FILE") {
-            config.bootstrap.password_file = value;
-        }
-        config
-    }
-
-    fn bootstrap_password(&self) -> Result<Option<String>> {
-        let path = Path::new(&self.bootstrap.password_file);
-        if !path.exists() {
-            return Ok(None);
-        }
-        let password = std::fs::read_to_string(path).with_context(|| {
-            format!("failed to read bootstrap password from {}", path.display())
-        })?;
-        let password = password.trim().to_owned();
-        if password.is_empty() {
-            return Ok(None);
-        }
-        Ok(Some(password))
-    }
-}
-
-#[derive(Clone)]
-struct AppState {
-    config: AuthServerConfig,
-    tailscale: tailscale::TailscaleBridgeManager,
-}
-
-#[derive(Debug, Deserialize)]
-struct TailnetDiscoveryQuery {
-    email: String,
-}
-
-type AppResult<T> = Result<T, (StatusCode, String)>;
-
-pub async fn serve() -> Result<()> {
-    serve_with_config(AuthServerConfig::from_env()).await
-}
-
-pub async fn serve_with_config(config: AuthServerConfig) -> Result<()> {
-    db::init_db(&config.db_path)?;
-    if let Some(password) = config.bootstrap_password()? {
-        db::ensure_local_identity(
-            &config.db_path,
-            &config.bootstrap.username,
-            &config.bootstrap.email,
-            &config.bootstrap.display_name,
-            &password,
-        )?;
-    }
-
-    let app = build_router(config.clone());
-    let listener = tokio::net::TcpListener::bind(&config.listen).await?;
-    log::info!("Starting auth server on {}", config.listen);
-    axum::serve(listener, app)
-        .with_graceful_shutdown(shutdown_signal())
-        .await?;
-    Ok(())
-}
-
-pub fn build_router(config: AuthServerConfig) -> Router {
-    Router::new()
-        .route("/healthz", get(healthz))
-        .route("/device/new", post(device_new))
-        .route("/v1/auth/login", post(login_local))
-        .route("/v1/control/register", post(control_register))
-        .route("/v1/control/map", post(control_map))
-        .route("/v1/tailnet/discover", get(tailnet_discover))
-        .route("/v1/tailscale/login/start", post(tailscale_login_start))
-        .route("/v1/tailscale/login/:session_id", get(tailscale_login_status))
-        .with_state(AppState {
-            config,
-            tailscale: tailscale::TailscaleBridgeManager::default(),
-        })
-}
-
-async fn login_local(
-    State(state): State<AppState>,
-    Json(request): Json<LocalAuthRequest>,
-) -> AppResult<Json<LocalAuthResponse>> {
-    let db_path = state.config.db_path.clone();
-    blocking(move || db::authenticate_local(&db_path, &request.identifier, &request.password))
-        .await?
-        .map(Json)
-        .ok_or_else(|| (StatusCode::UNAUTHORIZED, "invalid credentials".to_owned()))
-}
-
-async fn control_register(
-    headers: HeaderMap,
-    State(state): State<AppState>,
-    Json(request): Json<RegisterRequest>,
-) -> AppResult<Json<RegisterResponse>> {
-    let token = bearer_token(&headers)?;
-    let db_path = state.config.db_path.clone();
-    let user = blocking({
-        let db_path = db_path.clone();
-        let token = token.clone();
-        move || db::user_for_session(&db_path, &token)
-    })
-    .await?
-    .ok_or_else(|| (StatusCode::UNAUTHORIZED, "unknown session".to_owned()))?;
-
-    let response_user = user.profile.clone();
-    let node = blocking(move || db::upsert_node(&db_path, &user, &request)).await?;
-    Ok(Json(RegisterResponse {
-        user: response_user,
-        machine_authorized: node.machine_authorized,
-        node_key_expired: node.node_key_expired,
-        auth_url: None,
-        error: None,
-        node,
-    }))
-}
-
-async fn control_map(
-    headers: HeaderMap,
-    State(state): State<AppState>,
-    Json(request): Json<MapRequest>,
-) -> AppResult<Json<MapResponse>> {
-    let token = bearer_token(&headers)?;
-    let db_path = state.config.db_path.clone();
-    let domain = state.config.tailnet_domain.clone();
-    let user = blocking({
-        let db_path = db_path.clone();
-        let token = token.clone();
-        move || db::user_for_session(&db_path, &token)
-    })
-    .await?
-    .ok_or_else(|| (StatusCode::UNAUTHORIZED, "unknown session".to_owned()))?;
-
-    let response = blocking(move || db::map_for_node(&db_path, &user, &request, &domain)).await?;
-    Ok(Json(response))
-}
-
-async fn tailnet_discover(
-    Query(query): Query<TailnetDiscoveryQuery>,
-) -> AppResult<Json<TailnetDiscovery>> {
-    if query.email.trim().is_empty() {
-        return Err((StatusCode::BAD_REQUEST, "email is required".to_owned()));
-    }
-
-    let discovery = discovery::discover_tailnet(&query.email)
-        .await
-        .map_err(|err| (StatusCode::BAD_GATEWAY, err.to_string()))?;
-    Ok(Json(discovery))
-}
-
-async fn tailscale_login_start(
-    State(state): State<AppState>,
-    Json(request): Json<tailscale::TailscaleLoginStartRequest>,
-) -> AppResult<Json<tailscale::TailscaleLoginStartResponse>> {
-    let response = state
-        .tailscale
-        .start_login(request)
-        .await
-        .map_err(internal_error)?;
-    Ok(Json(response))
-}
-
-async fn tailscale_login_status(
-    AxumPath(session_id): AxumPath<String>,
-    State(state): State<AppState>,
-) -> AppResult<Json<tailscale::TailscaleLoginStatus>> {
-    state
-        .tailscale
-        .status(&session_id)
-        .await
-        .map_err(internal_error)?
-        .map(Json)
-        .ok_or_else(|| (StatusCode::NOT_FOUND, "unknown tailscale login session".to_owned()))
-}
-
-async fn healthz() -> impl IntoResponse {
-    StatusCode::OK
-}
-
-async fn device_new() -> impl IntoResponse {
-    StatusCode::OK
-}
-
-async fn blocking<F, T>(work: F) -> AppResult<T>
-where
-    F: FnOnce() -> Result<T> + Send + 'static,
-    T: Send + 'static,
-{
-    tokio::task::spawn_blocking(work)
-        .await
-        .map_err(|err| (StatusCode::INTERNAL_SERVER_ERROR, err.to_string()))?
-        .map_err(internal_error)
-}
-
-fn internal_error(err: anyhow::Error) -> (StatusCode, String) {
-    (StatusCode::INTERNAL_SERVER_ERROR, err.to_string())
-}
-
-fn bearer_token(headers: &HeaderMap) -> AppResult<String> {
-    let value = headers.get(AUTHORIZATION).ok_or_else(|| {
-        (
-            StatusCode::UNAUTHORIZED,
-            "missing authorization header".to_owned(),
-        )
-    })?;
-    let value = value.to_str().map_err(|_| {
-        (
-            StatusCode::BAD_REQUEST,
-            "invalid authorization header".to_owned(),
-        )
-    })?;
-    value
-        .strip_prefix("Bearer ")
-        .map(ToOwned::to_owned)
-        .ok_or_else(|| (StatusCode::UNAUTHORIZED, "expected bearer token".to_owned()))
-}
-
-async fn shutdown_signal() {
-    let ctrl_c = async {
-        signal::ctrl_c()
-            .await
-            .expect("failed to install Ctrl+C handler");
-    };
-
-    #[cfg(unix)]
-    let terminate = async {
-        signal::unix::signal(signal::unix::SignalKind::terminate())
-            .expect("failed to install signal handler")
-            .recv()
-            .await;
-    };
-
-    #[cfg(not(unix))]
-    let terminate = std::future::pending::<()>();
-
-    tokio::select! {
-        _ = ctrl_c => {},
-        _ = terminate => {},
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use axum::{
-        body::{to_bytes, Body},
-        http::{Request, StatusCode},
-    };
-    use tempfile::tempdir;
-    use tower::ServiceExt;
-
-    #[tokio::test]
-    async fn login_register_and_map_round_trip() -> Result<()> {
-        let dir = tempdir()?;
-        let password_file = dir.path().join("bootstrap-password.txt");
-        std::fs::write(&password_file, "bootstrap-pass\n")?;
-        let db_path = dir.path().join("server.sqlite3");
-        let config = AuthServerConfig {
-            listen: "127.0.0.1:0".to_owned(),
-            db_path: db_path.to_string_lossy().to_string(),
-            tailnet_domain: "burrow.net".to_owned(),
-            bootstrap: BootstrapIdentity {
-                password_file: password_file.to_string_lossy().to_string(),
-                ..BootstrapIdentity::default()
-            },
-        };
-
-        db::init_db(&config.db_path)?;
-        let password = config.bootstrap_password()?.expect("bootstrap password");
-        db::ensure_local_identity(
-            &config.db_path,
-            &config.bootstrap.username,
-            &config.bootstrap.email,
-            &config.bootstrap.display_name,
-            &password,
-        )?;
-
-        let app = build_router(config);
-
-        let response = app
-            .clone()
-            .oneshot(
-                Request::post("/v1/auth/login")
-                    .header("content-type", "application/json")
-                    .body(Body::from(serde_json::to_vec(&LocalAuthRequest {
-                        identifier: "contact".to_owned(),
-                        password: "bootstrap-pass".to_owned(),
-                    })?))?,
-            )
-            .await?;
-        assert_eq!(response.status(), StatusCode::OK);
-        let login: LocalAuthResponse =
-            serde_json::from_slice(&to_bytes(response.into_body(), usize::MAX).await?)?;
-
-        let response = app
-            .clone()
-            .oneshot(
-                Request::post("/v1/control/register")
-                    .header("content-type", "application/json")
-                    .header("authorization", format!("Bearer {}", login.access_token))
-                    .body(Body::from(serde_json::to_vec(&RegisterRequest {
-                        node_key: "nodekey:1234".to_owned(),
-                        machine_key: Some("machinekey:1234".to_owned()),
-                        addresses: vec!["100.64.0.10/32".to_owned()],
-                        endpoints: vec!["198.51.100.10:41641".to_owned()],
-                        hostinfo: Some(crate::control::Hostinfo {
-                            hostname: Some("devbox".to_owned()),
-                            os: Some("linux".to_owned()),
-                            os_version: Some("6.13".to_owned()),
-                            services: vec!["ssh".to_owned()],
-                            request_tags: vec!["tag:dev".to_owned()],
-                        }),
-                        ..RegisterRequest::default()
-                    })?))?,
-            )
-            .await?;
-        assert_eq!(response.status(), StatusCode::OK);
-
-        let response = app
-            .oneshot(
-                Request::post("/v1/control/map")
-                    .header("content-type", "application/json")
-                    .header("authorization", format!("Bearer {}", login.access_token))
-                    .body(Body::from(serde_json::to_vec(&MapRequest {
-                        node_key: "nodekey:1234".to_owned(),
-                        stream: true,
-                        endpoints: vec!["198.51.100.10:41641".to_owned()],
-                        ..MapRequest::default()
-                    })?))?,
-            )
-            .await?;
-        assert_eq!(response.status(), StatusCode::OK);
-        let map: MapResponse =
-            serde_json::from_slice(&to_bytes(response.into_body(), usize::MAX).await?)?;
-        assert_eq!(map.domain, "burrow.net");
-        assert_eq!(map.node.name, "devbox");
-        assert!(map.dns.expect("dns").magic_dns);
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn tailnet_discover_requires_email() -> Result<()> {
-        let app = build_router(AuthServerConfig::default());
-        let response = app
-            .oneshot(
-                Request::get("/v1/tailnet/discover?email=")
-                    .body(Body::empty())?,
-            )
-            .await?;
-        assert_eq!(response.status(), StatusCode::BAD_REQUEST);
-        Ok(())
-    }
-}
diff --git a/burrow/src/auth/server/tailscale.rs b/burrow/src/auth/server/tailscale.rs
deleted file mode 100644
index d08c807..0000000
--- a/burrow/src/auth/server/tailscale.rs
+++ /dev/null
@@ -1,519 +0,0 @@
-use std::{
-    collections::HashMap,
-    env,
-    path::{Path, PathBuf},
-    process::Stdio,
-    sync::Arc,
-    time::Duration,
-};
-
-use anyhow::{anyhow, Context, Result};
-use rand::RngCore;
-use reqwest::Client;
-use serde::{Deserialize, Serialize};
-use tokio::{
-    io::{AsyncBufReadExt, BufReader},
-    process::{Child, Command},
-    sync::Mutex,
-    task::JoinHandle,
-};
-
-#[derive(Clone, Debug, Default, Deserialize)]
-pub struct TailscaleLoginStartRequest {
-    pub account_name: String,
-    pub identity_name: String,
-    #[serde(default)]
-    pub hostname: Option<String>,
-    #[serde(default)]
-    pub control_url: Option<String>,
-    #[serde(default)]
-    pub packet_socket: Option<String>,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, Default)]
-pub struct TailscaleLoginStatus {
-    pub backend_state: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub auth_url: Option<String>,
-    #[serde(default)]
-    pub running: bool,
-    #[serde(default)]
-    pub needs_login: bool,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub tailnet_name: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub magic_dns_suffix: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub self_dns_name: Option<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub tailscale_ips: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub health: Vec<String>,
-}
-
-#[derive(Clone, Debug, Serialize)]
-pub struct TailscaleLoginStartResponse {
-    pub session_id: String,
-    pub status: TailscaleLoginStatus,
-}
-
-pub struct TailscaleLoginSession {
-    pub session_id: String,
-    pub helper: Arc<TailscaleHelperProcess>,
-    pub status: TailscaleLoginStatus,
-}
-
-#[derive(Clone, Default)]
-pub struct TailscaleBridgeManager {
-    client: Client,
-    sessions: Arc<Mutex<HashMap<String, Arc<ManagedSession>>>>,
-}
-
-pub struct TailscaleHelperProcess {
-    session_id: String,
-    listen_url: String,
-    packet_socket: Option<PathBuf>,
-    control_url: Option<String>,
-    state_dir: PathBuf,
-    child: Arc<Mutex<Child>>,
-    _stderr_task: JoinHandle<()>,
-}
-
-type ManagedSession = TailscaleHelperProcess;
-
-#[derive(Debug, Deserialize)]
-struct HelperHello {
-    listen_addr: String,
-    #[serde(default)]
-    packet_socket: Option<String>,
-}
-
-impl TailscaleBridgeManager {
-    pub async fn start_login(
-        &self,
-        request: TailscaleLoginStartRequest,
-    ) -> Result<TailscaleLoginStartResponse> {
-        let session = self.ensure_session(request).await?;
-        Ok(TailscaleLoginStartResponse {
-            session_id: session.session_id,
-            status: session.status,
-        })
-    }
-
-    pub async fn ensure_session(
-        &self,
-        request: TailscaleLoginStartRequest,
-    ) -> Result<TailscaleLoginSession> {
-        let key = session_key_for_request(&request);
-        let requested_packet_socket = request
-            .packet_socket
-            .as_deref()
-            .map(str::trim)
-            .filter(|value| !value.is_empty());
-        let requested_control_url = request
-            .control_url
-            .as_deref()
-            .map(str::trim)
-            .filter(|value| !value.is_empty());
-
-        if let Some(existing) = self.sessions.lock().await.get(&key).cloned() {
-            let needs_restart_for_socket = match (requested_packet_socket, existing.packet_socket())
-            {
-                (Some(requested), Some(current)) => current != Path::new(requested),
-                (Some(_), None) => true,
-                _ => false,
-            };
-            let needs_restart_for_control_url =
-                requested_control_url != existing.control_url().map(|value| value.trim());
-
-            if !needs_restart_for_socket && !needs_restart_for_control_url {
-                match self.fetch_status(existing.as_ref()).await {
-                    Ok(status) => {
-                        return Ok(TailscaleLoginSession {
-                            session_id: existing.session_id.clone(),
-                            helper: existing,
-                            status,
-                        });
-                    }
-                    Err(err) => {
-                        log::warn!(
-                            "tailscale login session {} is stale, restarting: {err}",
-                            existing.session_id
-                        );
-                    }
-                }
-            } else {
-                log::info!(
-                    "tailscale login session {} no longer matches requested transport, restarting",
-                    existing.session_id
-                );
-            }
-
-            self.sessions.lock().await.remove(&key);
-            let _ = self.shutdown_session(existing.as_ref()).await;
-        }
-
-        let session = Arc::new(spawn_tailscale_helper(&request).await?);
-        let status = self.wait_for_status(session.as_ref()).await?;
-        let response = TailscaleLoginSession {
-            session_id: session.session_id.clone(),
-            helper: session.clone(),
-            status,
-        };
-
-        self.sessions.lock().await.insert(key, session);
-        Ok(response)
-    }
-
-    pub async fn status(&self, session_id: &str) -> Result<Option<TailscaleLoginStatus>> {
-        let session = {
-            let sessions = self.sessions.lock().await;
-            sessions
-                .values()
-                .find(|session| session.session_id == session_id)
-                .cloned()
-        };
-
-        match session {
-            Some(session) => match self.fetch_status(session.as_ref()).await {
-                Ok(status) => Ok(Some(status)),
-                Err(err) => {
-                    self.remove_session_by_id(session_id).await;
-                    Err(err)
-                }
-            },
-            None => Ok(None),
-        }
-    }
-
-    pub async fn cancel(&self, session_id: &str) -> Result<bool> {
-        let session = self.remove_session_by_id(session_id).await;
-        match session {
-            Some(session) => {
-                self.shutdown_session(session.as_ref()).await?;
-                Ok(true)
-            }
-            None => Ok(false),
-        }
-    }
-
-    async fn wait_for_status(&self, session: &ManagedSession) -> Result<TailscaleLoginStatus> {
-        let mut last_error = None;
-        let mut last_status = None;
-        for _ in 0..40 {
-            match session.status_with_client(&self.client).await {
-                Ok(status) if status.running || status.auth_url.is_some() => return Ok(status),
-                Ok(status) => last_status = Some(status),
-                Err(err) => last_error = Some(err),
-            }
-            tokio::time::sleep(Duration::from_millis(250)).await;
-        }
-        if let Some(status) = last_status {
-            return Ok(status);
-        }
-        Err(last_error.unwrap_or_else(|| anyhow!("tailscale helper did not become ready")))
-    }
-
-    async fn fetch_status(&self, session: &ManagedSession) -> Result<TailscaleLoginStatus> {
-        session.status_with_client(&self.client).await
-    }
-
-    async fn remove_session_by_id(&self, session_id: &str) -> Option<Arc<ManagedSession>> {
-        let mut sessions = self.sessions.lock().await;
-        let key = sessions
-            .iter()
-            .find_map(|(key, session)| (session.session_id == session_id).then(|| key.clone()))?;
-        sessions.remove(&key)
-    }
-
-    async fn shutdown_session(&self, session: &ManagedSession) -> Result<()> {
-        session.shutdown_with_client(&self.client).await
-    }
-}
-
-impl TailscaleHelperProcess {
-    pub fn session_id(&self) -> &str {
-        &self.session_id
-    }
-
-    pub fn packet_socket(&self) -> Option<&Path> {
-        self.packet_socket.as_deref()
-    }
-
-    pub fn control_url(&self) -> Option<&str> {
-        self.control_url.as_deref()
-    }
-
-    pub fn state_dir(&self) -> &Path {
-        &self.state_dir
-    }
-
-    pub async fn status(&self) -> Result<TailscaleLoginStatus> {
-        self.status_with_client(&Client::new()).await
-    }
-
-    pub async fn shutdown(&self) -> Result<()> {
-        self.shutdown_with_client(&Client::new()).await
-    }
-
-    async fn status_with_client(&self, client: &Client) -> Result<TailscaleLoginStatus> {
-        let mut child = self.child.lock().await;
-        if let Some(status) = child.try_wait()? {
-            return Err(anyhow!(
-                "tailscale helper exited with status {status} for {}",
-                self.state_dir.display()
-            ));
-        }
-        drop(child);
-
-        let response = client
-            .get(format!("{}/status", self.listen_url))
-            .send()
-            .await
-            .context("failed to query tailscale helper status")?
-            .error_for_status()
-            .context("tailscale helper status request failed")?;
-
-        let status = response
-            .json::<TailscaleLoginStatus>()
-            .await
-            .context("invalid tailscale helper status response")?;
-
-        log::info!(
-            "tailscale helper status session={} backend_state={} running={} needs_login={} auth_url={:?}",
-            self.session_id,
-            status.backend_state,
-            status.running,
-            status.needs_login,
-            status.auth_url
-        );
-        Ok(status)
-    }
-
-    async fn shutdown_with_client(&self, client: &Client) -> Result<()> {
-        let _ = client.post(format!("{}/shutdown", self.listen_url)).send().await;
-
-        for _ in 0..10 {
-            let mut child = self.child.lock().await;
-            if child.try_wait()?.is_some() {
-                return Ok(());
-            }
-            drop(child);
-            tokio::time::sleep(Duration::from_millis(100)).await;
-        }
-
-        let mut child = self.child.lock().await;
-        child
-            .start_kill()
-            .context("failed to kill tailscale helper")?;
-        let _ = child.wait().await;
-        Ok(())
-    }
-}
-
-pub async fn spawn_tailscale_helper(
-    request: &TailscaleLoginStartRequest,
-) -> Result<TailscaleHelperProcess> {
-    let state_dir = state_root().join(session_dir_name(request));
-    tokio::fs::create_dir_all(&state_dir)
-        .await
-        .with_context(|| format!("failed to create {}", state_dir.display()))?;
-
-    let mut child = helper_command(request, &state_dir)?
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped())
-        .spawn()
-        .context("failed to spawn tailscale login helper")?;
-
-    let stdout = child
-        .stdout
-        .take()
-        .context("tailscale helper stdout unavailable")?;
-    let stderr = child
-        .stderr
-        .take()
-        .context("tailscale helper stderr unavailable")?;
-
-    let hello_line = tokio::time::timeout(Duration::from_secs(20), async move {
-        let mut lines = BufReader::new(stdout).lines();
-        lines.next_line().await
-    })
-    .await
-    .context("timed out waiting for tailscale helper startup")??
-    .context("tailscale helper exited before reporting listen address")?;
-
-    let hello: HelperHello =
-        serde_json::from_str(&hello_line).context("invalid tailscale helper startup line")?;
-
-    let stderr_task = tokio::spawn(async move {
-        let mut lines = BufReader::new(stderr).lines();
-        while let Ok(Some(line)) = lines.next_line().await {
-            log::info!("tailscale-login-bridge: {line}");
-        }
-    });
-
-    Ok(TailscaleHelperProcess {
-        session_id: random_session_id(),
-        listen_url: format!("http://{}", hello.listen_addr),
-        packet_socket: hello.packet_socket.map(PathBuf::from),
-        control_url: request.control_url.clone(),
-        state_dir,
-        child: Arc::new(Mutex::new(child)),
-        _stderr_task: stderr_task,
-    })
-}
-
-fn helper_command(request: &TailscaleLoginStartRequest, state_dir: &Path) -> Result<Command> {
-    let mut command = if let Ok(path) = env::var("BURROW_TAILSCALE_HELPER") {
-        Command::new(path)
-    } else {
-        let helper_dir = Path::new(env!("CARGO_MANIFEST_DIR"))
-            .join("..")
-            .join("Tools/tailscale-login-bridge");
-        let mut command = Command::new("go");
-        command.current_dir(helper_dir).arg("run").arg(".");
-        command.env("GOWORK", "off");
-        command
-    };
-
-    command
-        .arg("--listen")
-        .arg("127.0.0.1:0")
-        .arg("--state-dir")
-        .arg(state_dir)
-        .arg("--hostname")
-        .arg(default_hostname(request));
-
-    if let Some(control_url) = request.control_url.as_deref() {
-        let trimmed = control_url.trim();
-        if !trimmed.is_empty() {
-            command.arg("--control-url").arg(trimmed);
-        }
-    }
-
-    if let Some(packet_socket) = request.packet_socket.as_deref() {
-        let trimmed = packet_socket.trim();
-        if !trimmed.is_empty() {
-            command.arg("--packet-socket").arg(trimmed);
-        }
-    }
-
-    Ok(command)
-}
-
-pub(crate) fn packet_socket_path(request: &TailscaleLoginStartRequest) -> PathBuf {
-    state_root().join(session_dir_name(request)).join("packet.sock")
-}
-
-pub(crate) fn state_root() -> PathBuf {
-    if let Ok(path) = env::var("BURROW_TAILSCALE_STATE_ROOT") {
-        return PathBuf::from(path);
-    }
-
-    let home = env::var_os("HOME")
-        .map(PathBuf::from)
-        .unwrap_or_else(|| PathBuf::from("."));
-    if cfg!(target_vendor = "apple") {
-        return home
-            .join("Library")
-            .join("Application Support")
-            .join("Burrow")
-            .join("tailscale");
-    }
-    home.join(".local")
-        .join("share")
-        .join("burrow")
-        .join("tailscale")
-}
-
-pub(crate) fn session_dir_name(request: &TailscaleLoginStartRequest) -> String {
-    format!(
-        "{}-{}-{}",
-        slug(&request.account_name),
-        slug(&request.identity_name),
-        slug(control_scope(request))
-    )
-}
-
-fn session_key_for_request(request: &TailscaleLoginStartRequest) -> String {
-    format!(
-        "{}:{}:{}",
-        request.account_name,
-        request.identity_name,
-        control_scope(request)
-    )
-}
-
-fn control_scope(request: &TailscaleLoginStartRequest) -> &str {
-    request
-        .control_url
-        .as_deref()
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-        .unwrap_or("tailscale-managed")
-}
-
-pub(crate) fn default_hostname(request: &TailscaleLoginStartRequest) -> String {
-    request
-        .hostname
-        .as_deref()
-        .filter(|value| !value.trim().is_empty())
-        .map(ToOwned::to_owned)
-        .unwrap_or_else(|| format!("burrow-{}", slug(&request.identity_name)))
-}
-
-fn random_session_id() -> String {
-    let mut bytes = [0_u8; 12];
-    rand::thread_rng().fill_bytes(&mut bytes);
-    bytes.iter().map(|byte| format!("{byte:02x}")).collect()
-}
-
-fn slug(input: &str) -> String {
-    let mut output = String::with_capacity(input.len());
-    for ch in input.chars() {
-        if ch.is_ascii_alphanumeric() {
-            output.push(ch.to_ascii_lowercase());
-        } else if ch == '-' || ch == '_' {
-            output.push('-');
-        }
-    }
-    if output.is_empty() {
-        "default".to_owned()
-    } else {
-        output
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn slug_sanitizes_input() {
-        assert_eq!(slug("Apple Phone"), "applephone");
-        assert_eq!(slug("default_identity"), "default-identity");
-        assert_eq!(slug(""), "default");
-    }
-
-    #[test]
-    fn state_dir_is_scoped_by_account_identity_and_control_plane() {
-        let request = TailscaleLoginStartRequest {
-            account_name: "default".to_owned(),
-            identity_name: "apple".to_owned(),
-            hostname: None,
-            control_url: None,
-            packet_socket: None,
-        };
-        assert_eq!(session_dir_name(&request), "default-apple-tailscale-managed");
-        assert_eq!(default_hostname(&request), "burrow-apple");
-
-        let custom_request = TailscaleLoginStartRequest {
-            control_url: Some("https://ts.burrow.net".to_owned()),
-            ..request
-        };
-        assert_eq!(
-            session_dir_name(&custom_request),
-            "default-apple-httpstsburrownet"
-        );
-    }
-}
diff --git a/burrow/src/control/config.rs b/burrow/src/control/config.rs
deleted file mode 100644
index 3862bcd..0000000
--- a/burrow/src/control/config.rs
+++ /dev/null
@@ -1,87 +0,0 @@
-use anyhow::{Context, Result};
-use serde::{Deserialize, Serialize};
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(rename_all = "snake_case")]
-pub enum TailnetProvider {
-    Tailscale,
-    Headscale,
-    Burrow,
-}
-
-impl Default for TailnetProvider {
-    fn default() -> Self {
-        Self::Tailscale
-    }
-}
-
-#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
-pub struct TailnetConfig {
-    #[serde(default)]
-    pub provider: TailnetProvider,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub authority: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub account: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub identity: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub tailnet: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub hostname: Option<String>,
-}
-
-impl TailnetConfig {
-    pub fn from_slice(bytes: &[u8]) -> Result<Self> {
-        let payload = std::str::from_utf8(bytes).context("tailnet payload must be valid UTF-8")?;
-        Self::from_str(payload)
-    }
-
-    pub fn from_str(payload: &str) -> Result<Self> {
-        let trimmed = payload.trim();
-        if trimmed.starts_with('{') {
-            return serde_json::from_str(trimmed).context("invalid tailnet JSON payload");
-        }
-        toml::from_str(trimmed).context("invalid tailnet TOML payload")
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn parses_json_payload() {
-        let config = TailnetConfig::from_str(
-            r#"{
-                "provider":"tailscale",
-                "account":"default",
-                "identity":"apple",
-                "tailnet":"example.ts.net",
-                "hostname":"burrow-phone"
-            }"#,
-        )
-        .unwrap();
-        assert_eq!(config.provider, TailnetProvider::Tailscale);
-        assert_eq!(config.account.as_deref(), Some("default"));
-        assert_eq!(config.identity.as_deref(), Some("apple"));
-    }
-
-    #[test]
-    fn parses_toml_payload() {
-        let config = TailnetConfig::from_str(
-            r#"
-provider = "headscale"
-authority = "https://headscale.example.com"
-account = "default"
-identity = "apple"
-"#,
-        )
-        .unwrap();
-        assert_eq!(config.provider, TailnetProvider::Headscale);
-        assert_eq!(
-            config.authority.as_deref(),
-            Some("https://headscale.example.com")
-        );
-    }
-}
diff --git a/burrow/src/control/discovery.rs b/burrow/src/control/discovery.rs
deleted file mode 100644
index d044a62..0000000
--- a/burrow/src/control/discovery.rs
+++ /dev/null
@@ -1,359 +0,0 @@
-use anyhow::{anyhow, Context, Result};
-use reqwest::{Client, StatusCode, Url};
-use serde::{Deserialize, Serialize};
-use tracing::{debug, info};
-
-use super::TailnetProvider;
-
-pub const TAILNET_DISCOVERY_REL: &str = "https://burrow.net/rel/tailnet-control-server";
-const TAILNET_DISCOVERY_PATH: &str = "/.well-known/burrow-tailnet";
-const WEBFINGER_PATH: &str = "/.well-known/webfinger";
-const MANAGED_TAILSCALE_AUTHORITY: &str = "controlplane.tailscale.com";
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
-pub struct TailnetDiscovery {
-    pub domain: String,
-    pub provider: TailnetProvider,
-    pub authority: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub oidc_issuer: Option<String>,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
-pub struct TailnetAuthorityProbe {
-    pub authority: String,
-    pub status_code: i32,
-    pub summary: String,
-    pub detail: String,
-    pub reachable: bool,
-}
-
-#[derive(Clone, Debug, Default, Deserialize)]
-struct WebFingerDocument {
-    #[serde(default)]
-    links: Vec<WebFingerLink>,
-}
-
-#[derive(Clone, Debug, Default, Deserialize)]
-struct WebFingerLink {
-    #[serde(default)]
-    rel: String,
-    #[serde(default)]
-    href: Option<String>,
-}
-
-pub async fn discover_tailnet(email: &str) -> Result<TailnetDiscovery> {
-    let domain = email_domain(email)?;
-    info!(%email, %domain, "tailnet discovery requested");
-    let base_url = Url::parse(&format!("https://{domain}"))
-        .with_context(|| format!("invalid discovery domain {domain}"))?;
-    let client = Client::builder()
-        .user_agent("burrow-tailnet-discovery")
-        .timeout(std::time::Duration::from_secs(10))
-        .build()
-        .context("failed to build tailnet discovery client")?;
-    discover_tailnet_at(&client, email, &base_url).await
-}
-
-pub fn normalize_authority(authority: &str) -> String {
-    let trimmed = authority.trim();
-    if trimmed.contains("://") {
-        trimmed.to_owned()
-    } else {
-        format!("https://{trimmed}")
-    }
-}
-
-pub fn is_managed_tailscale_authority(authority: &str) -> bool {
-    let normalized = normalize_authority(authority)
-        .trim_end_matches('/')
-        .to_ascii_lowercase();
-    normalized == format!("https://{MANAGED_TAILSCALE_AUTHORITY}")
-        || normalized == format!("http://{MANAGED_TAILSCALE_AUTHORITY}")
-}
-
-pub async fn probe_tailnet_authority(authority: &str) -> Result<TailnetAuthorityProbe> {
-    let authority = normalize_authority(authority);
-    if is_managed_tailscale_authority(&authority) {
-        return Ok(TailnetAuthorityProbe {
-            authority,
-            status_code: 200,
-            summary: "Tailscale-managed control plane".to_owned(),
-            detail: "Using Tailscale's default login server.".to_owned(),
-            reachable: true,
-        });
-    }
-
-    let base_url =
-        Url::parse(&authority).with_context(|| format!("invalid tailnet authority {authority}"))?;
-    let client = Client::builder()
-        .user_agent("burrow-tailnet-probe")
-        .timeout(std::time::Duration::from_secs(10))
-        .build()
-        .context("failed to build tailnet authority probe client")?;
-
-    if let Some(status) =
-        probe_url(&client, base_url.join("/health")?, &authority, "Tailnet server reachable").await?
-    {
-        return Ok(status);
-    }
-
-    if let Some(status) = probe_url(
-        &client,
-        base_url.clone(),
-        &authority,
-        "Tailnet server reachable",
-    )
-    .await?
-    {
-        return Ok(status);
-    }
-
-    Err(anyhow!("could not connect to the server"))
-}
-
-pub async fn discover_tailnet_at(
-    client: &Client,
-    email: &str,
-    base_url: &Url,
-) -> Result<TailnetDiscovery> {
-    let domain = email_domain(email)?;
-    debug!(%email, %domain, base_url = %base_url, "starting tailnet domain discovery");
-
-    if let Some(discovery) = discover_well_known(client, base_url).await? {
-        info!(
-            %email,
-            %domain,
-            authority = %discovery.authority,
-            provider = ?discovery.provider,
-            "resolved tailnet discovery from well-known document"
-        );
-        return Ok(TailnetDiscovery { domain, ..discovery });
-    }
-
-    if let Some(authority) = discover_webfinger(client, email, base_url).await? {
-        info!(%email, %domain, %authority, "resolved tailnet discovery from webfinger");
-        return Ok(TailnetDiscovery {
-            domain,
-            provider: inferred_provider(Some(&authority), None),
-            authority,
-            oidc_issuer: None,
-        });
-    }
-
-    Err(anyhow!("no tailnet discovery metadata found for {domain}"))
-}
-
-pub fn email_domain(email: &str) -> Result<String> {
-    let trimmed = email.trim();
-    let (_, domain) = trimmed
-        .rsplit_once('@')
-        .ok_or_else(|| anyhow!("email address must include a domain"))?;
-    let domain = domain.trim().trim_matches('.').to_ascii_lowercase();
-    if domain.is_empty() {
-        return Err(anyhow!("email address must include a domain"));
-    }
-    Ok(domain)
-}
-
-pub fn inferred_provider(
-    authority: Option<&str>,
-    explicit: Option<&TailnetProvider>,
-) -> TailnetProvider {
-    if matches!(explicit, Some(TailnetProvider::Burrow)) {
-        return TailnetProvider::Burrow;
-    }
-    if authority.is_some_and(is_managed_tailscale_authority) {
-        return TailnetProvider::Tailscale;
-    }
-    TailnetProvider::Headscale
-}
-
-async fn discover_well_known(client: &Client, base_url: &Url) -> Result<Option<TailnetDiscovery>> {
-    let url = base_url
-        .join(TAILNET_DISCOVERY_PATH)
-        .context("failed to build tailnet discovery URL")?;
-    debug!(%url, "requesting tailnet well-known document");
-    let response = client
-        .get(url)
-        .header("accept", "application/json")
-        .send()
-        .await
-        .context("tailnet well-known request failed")?;
-
-    match response.status() {
-        StatusCode::OK => response
-            .json::<TailnetDiscovery>()
-            .await
-            .context("invalid tailnet discovery document")
-            .map(Some),
-        StatusCode::NOT_FOUND => Ok(None),
-        status => Err(anyhow!("tailnet well-known lookup failed with HTTP {status}")),
-    }
-}
-
-async fn discover_webfinger(client: &Client, email: &str, base_url: &Url) -> Result<Option<String>> {
-    let mut url = base_url
-        .join(WEBFINGER_PATH)
-        .context("failed to build webfinger URL")?;
-    url.query_pairs_mut()
-        .append_pair("resource", &format!("acct:{email}"))
-        .append_pair("rel", TAILNET_DISCOVERY_REL);
-    debug!(%email, url = %url, "requesting tailnet webfinger document");
-
-    let response = client
-        .get(url)
-        .header("accept", "application/jrd+json, application/json")
-        .send()
-        .await
-        .context("tailnet webfinger request failed")?;
-
-    match response.status() {
-        StatusCode::OK => {
-            let document = response
-                .json::<WebFingerDocument>()
-                .await
-                .context("invalid webfinger document")?;
-            Ok(document
-                .links
-                .into_iter()
-                .find(|link| link.rel == TAILNET_DISCOVERY_REL)
-                .and_then(|link| link.href)
-                .filter(|href| !href.trim().is_empty()))
-        }
-        StatusCode::NOT_FOUND => Ok(None),
-        status => Err(anyhow!("tailnet webfinger lookup failed with HTTP {status}")),
-    }
-}
-
-async fn probe_url(
-    client: &Client,
-    url: Url,
-    authority: &str,
-    summary: &str,
-) -> Result<Option<TailnetAuthorityProbe>> {
-    let response = match client
-        .get(url)
-        .header("accept", "application/json")
-        .send()
-        .await
-    {
-        Ok(response) => response,
-        Err(_) => return Ok(None),
-    };
-
-    let status = response.status();
-    if !status.is_success() {
-        return Ok(None);
-    }
-
-    let detail = response.text().await.unwrap_or_default().trim().to_owned();
-    Ok(Some(TailnetAuthorityProbe {
-        authority: authority.to_owned(),
-        status_code: i32::from(status.as_u16()),
-        summary: summary.to_owned(),
-        detail,
-        reachable: true,
-    }))
-}
-
-#[cfg(test)]
-mod tests {
-    use axum::{routing::get, Router};
-    use serde_json::json;
-    use tokio::net::TcpListener;
-
-    use super::*;
-
-    #[test]
-    fn extracts_domain_from_email() {
-        assert_eq!(email_domain("Contact@Burrow.net").unwrap(), "burrow.net");
-        assert!(email_domain("contact").is_err());
-    }
-
-    #[test]
-    fn detects_managed_tailscale_authority() {
-        assert!(is_managed_tailscale_authority("controlplane.tailscale.com"));
-        assert!(is_managed_tailscale_authority("https://controlplane.tailscale.com/"));
-        assert!(!is_managed_tailscale_authority("https://ts.burrow.net"));
-    }
-
-    #[tokio::test]
-    async fn discovers_from_well_known_document() -> Result<()> {
-        let router = Router::new().route(
-            TAILNET_DISCOVERY_PATH,
-            get(|| async {
-                axum::Json(json!({
-                    "domain": "burrow.net",
-                    "provider": "headscale",
-                    "authority": "https://ts.burrow.net",
-                    "oidc_issuer": "https://auth.burrow.net/application/o/ts/"
-                }))
-            }),
-        );
-
-        let listener = TcpListener::bind("127.0.0.1:0").await?;
-        let base_url = Url::parse(&format!("http://{}", listener.local_addr()?))?;
-        let server = tokio::spawn(async move { axum::serve(listener, router).await });
-
-        let client = Client::builder().build()?;
-        let discovery = discover_tailnet_at(&client, "contact@burrow.net", &base_url).await?;
-        assert_eq!(discovery.provider, TailnetProvider::Headscale);
-        assert_eq!(discovery.authority, "https://ts.burrow.net");
-        assert_eq!(discovery.domain, "burrow.net");
-
-        server.abort();
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn falls_back_to_webfinger_authority() -> Result<()> {
-        let router = Router::new()
-            .route(
-                TAILNET_DISCOVERY_PATH,
-                get(|| async { (StatusCode::NOT_FOUND, "") }),
-            )
-            .route(
-                WEBFINGER_PATH,
-                get(|| async {
-                    axum::Json(json!({
-                        "subject": "acct:contact@burrow.net",
-                        "links": [
-                            {
-                                "rel": TAILNET_DISCOVERY_REL,
-                                "href": "https://ts.burrow.net"
-                            }
-                        ]
-                    }))
-                }),
-            );
-
-        let listener = TcpListener::bind("127.0.0.1:0").await?;
-        let base_url = Url::parse(&format!("http://{}", listener.local_addr()?))?;
-        let server = tokio::spawn(async move { axum::serve(listener, router).await });
-
-        let client = Client::builder().build()?;
-        let discovery = discover_tailnet_at(&client, "contact@burrow.net", &base_url).await?;
-        assert_eq!(discovery.provider, TailnetProvider::Headscale);
-        assert_eq!(discovery.authority, "https://ts.burrow.net");
-
-        server.abort();
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn probes_custom_authority() -> Result<()> {
-        let router = Router::new().route("/health", get(|| async { "ok" }));
-        let listener = TcpListener::bind("127.0.0.1:0").await?;
-        let authority = format!("http://{}", listener.local_addr()?);
-        let server = tokio::spawn(async move { axum::serve(listener, router).await });
-
-        let status = probe_tailnet_authority(&authority).await?;
-        assert_eq!(status.authority, authority);
-        assert_eq!(status.status_code, 200);
-        assert!(status.reachable);
-
-        server.abort();
-        Ok(())
-    }
-}
diff --git a/burrow/src/control/mod.rs b/burrow/src/control/mod.rs
deleted file mode 100644
index 472f673..0000000
--- a/burrow/src/control/mod.rs
+++ /dev/null
@@ -1,255 +0,0 @@
-pub mod config;
-pub mod discovery;
-
-use std::collections::BTreeMap;
-
-use serde::{Deserialize, Serialize};
-use serde_json::Value;
-
-pub use config::{TailnetConfig, TailnetProvider};
-pub use discovery::{TailnetDiscovery, TAILNET_DISCOVERY_REL};
-
-pub const BURROW_CAPABILITY_VERSION: i32 = 1;
-pub const BURROW_TAILNET_DOMAIN: &str = "burrow.net";
-
-pub type NodeCapMap = BTreeMap<String, Vec<Value>>;
-pub type PeerCapMap = BTreeMap<String, Vec<Value>>;
-
-#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
-pub struct Hostinfo {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub hostname: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub os: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub os_version: Option<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub services: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub request_tags: Vec<String>,
-}
-
-#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
-pub struct UserProfile {
-    pub id: i64,
-    pub login_name: String,
-    pub display_name: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub profile_pic_url: Option<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub groups: Vec<String>,
-}
-
-#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
-pub struct RegisterAuth {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub auth_key: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub oauth_access_token: Option<String>,
-}
-
-#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq)]
-pub struct Node {
-    pub id: i64,
-    pub stable_id: String,
-    pub name: String,
-    pub user_id: i64,
-    pub node_key: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub machine_key: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub disco_key: Option<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub addresses: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub allowed_ips: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub endpoints: Vec<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub home_derp: Option<i32>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub hostinfo: Option<Hostinfo>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub tags: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub primary_routes: Vec<String>,
-    #[serde(default = "default_capability_version")]
-    pub cap_version: i32,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub cap_map: NodeCapMap,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub peer_cap_map: PeerCapMap,
-    #[serde(default)]
-    pub machine_authorized: bool,
-    #[serde(default)]
-    pub node_key_expired: bool,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub created_at: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub updated_at: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub last_seen: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub online: Option<bool>,
-}
-
-impl Node {
-    pub fn preferred_name(request: &RegisterRequest) -> String {
-        if let Some(name) = request.name.as_deref() {
-            return name.to_owned();
-        }
-        if let Some(hostname) = request
-            .hostinfo
-            .as_ref()
-            .and_then(|hostinfo| hostinfo.hostname.as_deref())
-        {
-            return hostname.to_owned();
-        }
-        format!("node-{}", short_key(&request.node_key))
-    }
-
-    pub fn normalized_allowed_ips(request: &RegisterRequest) -> Vec<String> {
-        if request.allowed_ips.is_empty() {
-            return request.addresses.clone();
-        }
-        request.allowed_ips.clone()
-    }
-}
-
-#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
-pub struct RegisterRequest {
-    #[serde(default = "default_capability_version")]
-    pub version: i32,
-    pub node_key: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub old_node_key: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub machine_key: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub disco_key: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub auth: Option<RegisterAuth>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub expiry: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub followup: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub hostinfo: Option<Hostinfo>,
-    #[serde(default)]
-    pub ephemeral: bool,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub tailnet: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub addresses: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub allowed_ips: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub endpoints: Vec<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub home_derp: Option<i32>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub tags: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub primary_routes: Vec<String>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub cap_map: NodeCapMap,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub peer_cap_map: PeerCapMap,
-}
-
-#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq)]
-pub struct RegisterResponse {
-    pub user: UserProfile,
-    pub node: Node,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub auth_url: Option<String>,
-    pub machine_authorized: bool,
-    pub node_key_expired: bool,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-}
-
-#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
-pub struct MapRequest {
-    #[serde(default = "default_capability_version")]
-    pub version: i32,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub compress: Option<String>,
-    #[serde(default)]
-    pub keep_alive: bool,
-    pub node_key: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub disco_key: Option<String>,
-    #[serde(default)]
-    pub stream: bool,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub hostinfo: Option<Hostinfo>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub map_session_handle: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub map_session_seq: Option<i64>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub endpoints: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub debug_flags: Vec<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub connection_handle: Option<String>,
-}
-
-#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
-pub struct DnsConfig {
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub resolvers: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub search_domains: Vec<String>,
-    #[serde(default)]
-    pub magic_dns: bool,
-}
-
-#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
-pub struct PacketFilter {
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub sources: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub destinations: Vec<String>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub protocols: Vec<String>,
-}
-
-#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq)]
-pub struct MapResponse {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub map_session_handle: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub seq: Option<i64>,
-    pub node: Node,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub peers: Vec<Node>,
-    pub domain: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub dns: Option<DnsConfig>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub packet_filters: Vec<PacketFilter>,
-}
-
-#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
-pub struct LocalAuthRequest {
-    pub identifier: String,
-    pub password: String,
-}
-
-#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
-pub struct LocalAuthResponse {
-    pub access_token: String,
-    pub user: UserProfile,
-}
-
-fn default_capability_version() -> i32 {
-    BURROW_CAPABILITY_VERSION
-}
-
-fn short_key(key: &str) -> String {
-    key.chars().take(8).collect()
-}
diff --git a/burrow/src/daemon/apple.rs b/burrow/src/daemon/apple.rs
index f369ea9..9460613 100644
--- a/burrow/src/daemon/apple.rs
+++ b/burrow/src/daemon/apple.rs
@@ -1,11 +1,11 @@
 use std::{
     ffi::{c_char, CStr},
     path::PathBuf,
-    sync::{Arc, Mutex},
+    sync::Arc,
     thread,
 };
 
-use once_cell::sync::{Lazy, OnceCell};
+use once_cell::sync::OnceCell;
 use tokio::{
     runtime::{Builder, Handle},
     sync::Notify,
@@ -14,35 +14,20 @@ use tracing::error;
 
 use crate::daemon::daemon_main;
 
+static BURROW_NOTIFY: OnceCell<Arc<Notify>> = OnceCell::new();
 static BURROW_HANDLE: OnceCell<Handle> = OnceCell::new();
-static BURROW_READY: OnceCell<()> = OnceCell::new();
-static BURROW_SPAWN_LOCK: Lazy<Mutex<()>> = Lazy::new(|| Mutex::new(()));
 
 #[no_mangle]
-pub unsafe extern "C" fn spawn_in_process(path: *const c_char, db_path: *const c_char) {
-    let path_buf = if path.is_null() {
-        None
-    } else {
-        Some(PathBuf::from(CStr::from_ptr(path).to_str().unwrap()))
-    };
-    let db_path_buf = if db_path.is_null() {
-        None
-    } else {
-        Some(PathBuf::from(CStr::from_ptr(db_path).to_str().unwrap()))
-    };
-    spawn_in_process_with_paths(path_buf, db_path_buf);
-}
-
-pub fn spawn_in_process_with_paths(path_buf: Option<PathBuf>, db_path_buf: Option<PathBuf>) {
+pub unsafe extern "C" fn spawn_in_process(path: *const c_char) {
     crate::tracing::initialize();
 
-    let _guard = BURROW_SPAWN_LOCK.lock().unwrap();
-    if BURROW_READY.get().is_some() {
-        return;
-    }
-
-    let notify = Arc::new(Notify::new());
+    let notify = BURROW_NOTIFY.get_or_init(|| Arc::new(Notify::new()));
     let handle = BURROW_HANDLE.get_or_init(|| {
+        let path_buf = if path.is_null() {
+            None
+        } else {
+            Some(PathBuf::from(CStr::from_ptr(path).to_str().unwrap()))
+        };
         let sender = notify.clone();
 
         let (handle_tx, handle_rx) = tokio::sync::oneshot::channel();
@@ -55,12 +40,7 @@ pub fn spawn_in_process_with_paths(path_buf: Option<PathBuf>, db_path_buf: Optio
                 .unwrap();
             handle_tx.send(runtime.handle().clone()).unwrap();
             runtime.block_on(async {
-                let result = daemon_main(
-                    path_buf.as_deref(),
-                    db_path_buf.as_deref(),
-                    Some(sender.clone()),
-                )
-                .await;
+                let result = daemon_main(path_buf.as_deref(), Some(sender.clone())).await;
                 if let Err(error) = result.as_ref() {
                     error!("Burrow thread exited: {}", error);
                 }
@@ -72,5 +52,4 @@ pub fn spawn_in_process_with_paths(path_buf: Option<PathBuf>, db_path_buf: Optio
 
     let receiver = notify.clone();
     handle.block_on(async move { receiver.notified().await });
-    let _ = BURROW_READY.set(());
 }
diff --git a/burrow/src/daemon/rpc/request.rs b/burrow/src/daemon/command.rs
similarity index 82%
rename from burrow/src/daemon/rpc/request.rs
rename to burrow/src/daemon/command.rs
index 91562cc..53b4108 100644
--- a/burrow/src/daemon/rpc/request.rs
+++ b/burrow/src/daemon/command.rs
@@ -3,13 +3,11 @@ use serde::{Deserialize, Serialize};
 use tun::TunOptions;
 
 #[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
-#[serde(tag = "method", content = "params")]
 pub enum DaemonCommand {
     Start(DaemonStartOptions),
     ServerInfo,
     ServerConfig,
     Stop,
-    ReloadConfig(String),
 }
 
 #[derive(Debug, Clone, Default, Serialize, Deserialize, JsonSchema)]
@@ -17,13 +15,6 @@ pub struct DaemonStartOptions {
     pub tun: TunOptions,
 }
 
-#[derive(Clone, Serialize, Deserialize)]
-pub struct DaemonRequest {
-    pub id: u64,
-    #[serde(flatten)]
-    pub command: DaemonCommand,
-}
-
 #[test]
 fn test_daemoncommand_serialization() {
     insta::assert_snapshot!(serde_json::to_string(&DaemonCommand::Start(
diff --git a/burrow/src/daemon/instance.rs b/burrow/src/daemon/instance.rs
index 9b2e138..34e9878 100644
--- a/burrow/src/daemon/instance.rs
+++ b/burrow/src/daemon/instance.rs
@@ -1,540 +1,117 @@
-use std::{
-    path::{Path, PathBuf},
-    sync::Arc,
-};
+use std::sync::Arc;
 
 use anyhow::Result;
-use rusqlite::Connection;
-use tokio::sync::{mpsc, watch, RwLock};
-use tokio_stream::wrappers::ReceiverStream;
-use tonic::{Request, Response, Status as RspStatus};
+use tokio::{sync::RwLock, task::JoinHandle};
 use tracing::{debug, info, warn};
 use tun::tokio::TunInterface;
 
-use super::{
-    rpc::grpc_defs::{
-        networks_server::Networks, tailnet_control_server::TailnetControl, tunnel_server::Tunnel,
-        Empty, Network, NetworkDeleteRequest, NetworkListResponse, NetworkReorderRequest,
-        State as RPCTunnelState, TailnetDiscoverRequest, TailnetDiscoverResponse,
-        TailnetProbeRequest, TailnetProbeResponse, TunnelConfigurationResponse, TunnelPacket,
-        TunnelStatusResponse,
-    },
-    runtime::{tailnet_helper_request, ActiveTunnel, ResolvedTunnel},
-};
 use crate::{
-    auth::server::tailscale::{
-        packet_socket_path, TailscaleBridgeManager,
-        TailscaleLoginStartRequest as BridgeLoginStartRequest, TailscaleLoginStatus,
+    daemon::{
+        command::DaemonCommand,
+        response::{DaemonResponse, DaemonResponseData, ServerConfig, ServerInfo},
     },
-    control::discovery,
-    daemon::rpc::ServerConfig,
-    database::{add_network, delete_network, get_connection, list_networks, reorder_network},
+    wireguard::Interface,
 };
 
-#[derive(Debug, Clone)]
 enum RunState {
-    Running,
+    Running(JoinHandle<Result<()>>),
     Idle,
 }
 
-impl RunState {
-    fn to_rpc(&self) -> RPCTunnelState {
-        match self {
-            Self::Running => RPCTunnelState::Running,
-            Self::Idle => RPCTunnelState::Stopped,
+pub struct DaemonInstance {
+    rx: async_channel::Receiver<DaemonCommand>,
+    sx: async_channel::Sender<DaemonResponse>,
+    tun_interface: Option<Arc<RwLock<TunInterface>>>,
+    wg_interface: Arc<RwLock<Interface>>,
+    wg_state: RunState,
+}
+
+impl DaemonInstance {
+    pub fn new(
+        rx: async_channel::Receiver<DaemonCommand>,
+        sx: async_channel::Sender<DaemonResponse>,
+        wg_interface: Arc<RwLock<Interface>>,
+    ) -> Self {
+        Self {
+            rx,
+            sx,
+            wg_interface,
+            tun_interface: None,
+            wg_state: RunState::Idle,
         }
     }
-}
 
-#[derive(Clone)]
-pub struct DaemonRPCServer {
-    tun_interface: Arc<RwLock<Option<TunInterface>>>,
-    db_path: Option<PathBuf>,
-    wg_state_chan: (watch::Sender<RunState>, watch::Receiver<RunState>),
-    network_update_chan: (watch::Sender<()>, watch::Receiver<()>),
-    active_tunnel: Arc<RwLock<Option<ActiveTunnel>>>,
-    tailnet_login: TailscaleBridgeManager,
-}
+    async fn proc_command(&mut self, command: DaemonCommand) -> Result<DaemonResponseData> {
+        info!("Daemon got command: {:?}", command);
+        match command {
+            DaemonCommand::Start(st) => {
+                match self.wg_state {
+                    RunState::Running(_) => {
+                        warn!("Got start, but tun interface already up.");
+                    }
+                    RunState::Idle => {
+                        let tun_if = Arc::new(RwLock::new(st.tun.open()?));
 
-impl DaemonRPCServer {
-    pub fn new(db_path: Option<&Path>) -> Result<Self> {
-        Ok(Self {
-            tun_interface: Arc::new(RwLock::new(None)),
-            db_path: db_path.map(Path::to_owned),
-            wg_state_chan: watch::channel(RunState::Idle),
-            network_update_chan: watch::channel(()),
-            active_tunnel: Arc::new(RwLock::new(None)),
-            tailnet_login: TailscaleBridgeManager::default(),
-        })
+                        debug!("Setting tun_interface");
+                        self.tun_interface = Some(tun_if.clone());
+                        debug!("tun_interface set: {:?}", self.tun_interface);
+
+                        debug!("Setting tun on wg_interface");
+                        self.wg_interface.write().await.set_tun(tun_if);
+                        debug!("tun set on wg_interface");
+
+                        debug!("Cloning wg_interface");
+                        let tmp_wg = self.wg_interface.clone();
+                        debug!("wg_interface cloned");
+
+                        debug!("Spawning run task");
+                        let run_task = tokio::spawn(async move {
+                            debug!("Running wg_interface");
+                            let twlock = tmp_wg.read().await;
+                            debug!("wg_interface read lock acquired");
+                            twlock.run().await
+                        });
+                        debug!("Run task spawned: {:?}", run_task);
+
+                        debug!("Setting wg_state to Running");
+                        self.wg_state = RunState::Running(run_task);
+                        debug!("wg_state set to Running");
+
+                        info!("Daemon started tun interface");
+                    }
+                }
+                Ok(DaemonResponseData::None)
+            }
+            DaemonCommand::ServerInfo => match &self.tun_interface {
+                None => Ok(DaemonResponseData::None),
+                Some(ti) => {
+                    info!("{:?}", ti);
+                    Ok(DaemonResponseData::ServerInfo(ServerInfo::try_from(
+                        ti.read().await.inner.get_ref(),
+                    )?))
+                }
+            },
+            DaemonCommand::Stop => {
+                if self.tun_interface.is_some() {
+                    self.tun_interface = None;
+                    info!("Daemon stopping tun interface.");
+                } else {
+                    warn!("Got stop, but tun interface is not up.")
+                }
+                Ok(DaemonResponseData::None)
+            }
+            DaemonCommand::ServerConfig => {
+                Ok(DaemonResponseData::ServerConfig(ServerConfig::default()))
+            }
+        }
     }
 
-    fn get_connection(&self) -> Result<Connection, RspStatus> {
-        get_connection(self.db_path.as_deref()).map_err(proc_err)
-    }
-
-    async fn set_wg_state(&self, state: RunState) -> Result<(), RspStatus> {
-        self.wg_state_chan.0.send(state).map_err(proc_err)
-    }
-
-    async fn notify_network_update(&self) -> Result<(), RspStatus> {
-        self.network_update_chan.0.send(()).map_err(proc_err)
-    }
-
-    async fn resolve_tunnel(&self) -> Result<ResolvedTunnel, RspStatus> {
-        let conn = self.get_connection()?;
-        let networks = list_networks(&conn).map_err(proc_err)?;
-        ResolvedTunnel::from_networks(&networks).map_err(proc_err)
-    }
-
-    async fn current_tunnel_configuration(&self) -> Result<TunnelConfigurationResponse, RspStatus> {
-        let config = {
-            let active = self.active_tunnel.read().await;
-            active
-                .as_ref()
-                .map(|tunnel| tunnel.server_config().clone())
-        };
-        let config = match config {
-            Some(config) => config,
-            None => self
-                .resolve_tunnel()
-                .await?
-                .server_config()
-                .map_err(proc_err)?,
-        };
-        Ok(configuration_rsp(config))
-    }
-
-    async fn stop_active_tunnel(&self) -> Result<bool, RspStatus> {
-        let current = { self.active_tunnel.write().await.take() };
-        let Some(current) = current else {
-            return Ok(false);
-        };
-
-        current
-            .shutdown(&self.tun_interface)
-            .await
-            .map_err(proc_err)?;
-        self.set_wg_state(RunState::Idle).await?;
-        Ok(true)
-    }
-
-    async fn replace_active_tunnel(&self, desired: ResolvedTunnel) -> Result<(), RspStatus> {
-        let _ = self.stop_active_tunnel().await?;
-        let tailnet_helper = match &desired {
-            ResolvedTunnel::Tailnet { identity, config } => Some(
-                self.tailnet_login
-                    .ensure_session(tailnet_helper_request(identity, config))
-                    .await
-                    .map_err(proc_err)?
-                    .helper,
-            ),
-            _ => None,
-        };
-        let active = desired
-            .start(self.tun_interface.clone(), tailnet_helper)
-            .await
-            .map_err(proc_err)?;
-        self.active_tunnel.write().await.replace(active);
-        self.set_wg_state(RunState::Running).await?;
+    pub async fn run(&mut self) -> Result<()> {
+        while let Ok(command) = self.rx.recv().await {
+            let response = self.proc_command(command).await;
+            info!("Daemon response: {:?}", response);
+            self.sx.send(DaemonResponse::new(response)).await?;
+        }
         Ok(())
     }
-
-    async fn reconcile_runtime(&self) -> Result<(), RspStatus> {
-        let desired = self.resolve_tunnel().await?;
-        let needs_restart = {
-            let guard = self.active_tunnel.read().await;
-            guard
-                .as_ref()
-                .map(|active| active.identity() != desired.identity())
-                .unwrap_or(false)
-        };
-
-        if needs_restart {
-            self.replace_active_tunnel(desired).await?;
-        }
-
-        Ok(())
-    }
-
-    fn tailnet_bridge_request(
-        account_name: String,
-        identity_name: String,
-        hostname: String,
-        authority: String,
-    ) -> BridgeLoginStartRequest {
-        let mut request = BridgeLoginStartRequest {
-            account_name,
-            identity_name,
-            hostname: (!hostname.trim().is_empty()).then_some(hostname),
-            control_url: Self::tailnet_control_url(&authority),
-            packet_socket: None,
-        };
-        request.packet_socket = Some(packet_socket_path(&request).display().to_string());
-        request
-    }
-
-    fn tailnet_control_url(authority: &str) -> Option<String> {
-        let authority = discovery::normalize_authority(authority);
-        (!discovery::is_managed_tailscale_authority(&authority)).then_some(authority)
-    }
-}
-
-#[tonic::async_trait]
-impl Tunnel for DaemonRPCServer {
-    type TunnelConfigurationStream = ReceiverStream<Result<TunnelConfigurationResponse, RspStatus>>;
-    type TunnelPacketsStream = ReceiverStream<Result<TunnelPacket, RspStatus>>;
-    type TunnelStatusStream = ReceiverStream<Result<TunnelStatusResponse, RspStatus>>;
-
-    async fn tunnel_configuration(
-        &self,
-        _request: Request<Empty>,
-    ) -> Result<Response<Self::TunnelConfigurationStream>, RspStatus> {
-        let (tx, rx) = mpsc::channel(10);
-        let server = self.clone();
-        let mut sub = self.network_update_chan.1.clone();
-
-        tokio::spawn(async move {
-            loop {
-                let response = server.current_tunnel_configuration().await;
-                if tx.send(response).await.is_err() {
-                    break;
-                }
-                if sub.changed().await.is_err() {
-                    break;
-                }
-            }
-        });
-
-        Ok(Response::new(ReceiverStream::new(rx)))
-    }
-
-    async fn tunnel_packets(
-        &self,
-        request: Request<tonic::Streaming<TunnelPacket>>,
-    ) -> Result<Response<Self::TunnelPacketsStream>, RspStatus> {
-        let (packet_tx, mut packet_rx) = {
-            let guard = self.active_tunnel.read().await;
-            let Some(active) = guard.as_ref() else {
-                return Err(RspStatus::failed_precondition("no active tunnel"));
-            };
-            active.packet_stream().ok_or_else(|| {
-                RspStatus::failed_precondition(
-                    "active tunnel does not support packet streaming",
-                )
-            })?
-        };
-
-        let (tx, rx) = mpsc::channel(128);
-        tokio::spawn(async move {
-            loop {
-                match packet_rx.recv().await {
-                    Ok(payload) => {
-                        if tx.send(Ok(TunnelPacket { payload })).await.is_err() {
-                            break;
-                        }
-                    }
-                    Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => continue,
-                    Err(tokio::sync::broadcast::error::RecvError::Closed) => break,
-                }
-            }
-        });
-
-        let mut inbound = request.into_inner();
-        tokio::spawn(async move {
-            loop {
-                match inbound.message().await {
-                    Ok(Some(packet)) => {
-                        debug!(
-                            "daemon tunnel packet stream received {} bytes from client",
-                            packet.payload.len()
-                        );
-                        if packet_tx.send(packet.payload).await.is_err() {
-                            break;
-                        }
-                    }
-                    Ok(None) => break,
-                    Err(error) => {
-                        warn!("tailnet packet stream receive error: {error}");
-                        break;
-                    }
-                }
-            }
-        });
-
-        Ok(Response::new(ReceiverStream::new(rx)))
-    }
-
-    async fn tunnel_start(&self, _request: Request<Empty>) -> Result<Response<Empty>, RspStatus> {
-        let desired = self.resolve_tunnel().await?;
-        let already_running = {
-            let guard = self.active_tunnel.read().await;
-            guard
-                .as_ref()
-                .map(|active| active.identity() == desired.identity())
-                .unwrap_or(false)
-        };
-
-        if already_running {
-            warn!("Got start, but active tunnel already matches desired network.");
-            return Ok(Response::new(Empty {}));
-        }
-
-        self.replace_active_tunnel(desired).await?;
-        Ok(Response::new(Empty {}))
-    }
-
-    async fn tunnel_stop(&self, _request: Request<Empty>) -> Result<Response<Empty>, RspStatus> {
-        let _ = self.stop_active_tunnel().await?;
-        Ok(Response::new(Empty {}))
-    }
-
-    async fn tunnel_status(
-        &self,
-        _request: Request<Empty>,
-    ) -> Result<Response<Self::TunnelStatusStream>, RspStatus> {
-        let (tx, rx) = mpsc::channel(10);
-        let mut state_rx = self.wg_state_chan.1.clone();
-        tokio::spawn(async move {
-            let cur = state_rx.borrow_and_update().to_owned();
-            if tx.send(Ok(status_rsp(cur))).await.is_err() {
-                return;
-            }
-
-            loop {
-                if state_rx.changed().await.is_err() {
-                    break;
-                }
-                let cur = state_rx.borrow().to_owned();
-                if tx.send(Ok(status_rsp(cur))).await.is_err() {
-                    break;
-                }
-            }
-        });
-        Ok(Response::new(ReceiverStream::new(rx)))
-    }
-}
-
-#[tonic::async_trait]
-impl Networks for DaemonRPCServer {
-    type NetworkListStream = ReceiverStream<Result<NetworkListResponse, RspStatus>>;
-
-    async fn network_add(&self, request: Request<Network>) -> Result<Response<Empty>, RspStatus> {
-        let conn = self.get_connection()?;
-        let network = request.into_inner();
-        add_network(&conn, &network).map_err(proc_err)?;
-        self.notify_network_update().await?;
-        self.reconcile_runtime().await?;
-        Ok(Response::new(Empty {}))
-    }
-
-    async fn network_list(
-        &self,
-        _request: Request<Empty>,
-    ) -> Result<Response<Self::NetworkListStream>, RspStatus> {
-        let (tx, rx) = mpsc::channel(10);
-        let conn = self.get_connection()?;
-        let mut sub = self.network_update_chan.1.clone();
-        tokio::spawn(async move {
-            loop {
-                let networks = list_networks(&conn)
-                    .map(|res| NetworkListResponse { network: res })
-                    .map_err(proc_err);
-                if tx.send(networks).await.is_err() {
-                    break;
-                }
-                if sub.changed().await.is_err() {
-                    break;
-                }
-            }
-        });
-        Ok(Response::new(ReceiverStream::new(rx)))
-    }
-
-    async fn network_reorder(
-        &self,
-        request: Request<NetworkReorderRequest>,
-    ) -> Result<Response<Empty>, RspStatus> {
-        let conn = self.get_connection()?;
-        reorder_network(&conn, request.into_inner()).map_err(proc_err)?;
-        self.notify_network_update().await?;
-        self.reconcile_runtime().await?;
-        Ok(Response::new(Empty {}))
-    }
-
-    async fn network_delete(
-        &self,
-        request: Request<NetworkDeleteRequest>,
-    ) -> Result<Response<Empty>, RspStatus> {
-        let conn = self.get_connection()?;
-        delete_network(&conn, request.into_inner()).map_err(proc_err)?;
-        self.notify_network_update().await?;
-        self.reconcile_runtime().await?;
-        Ok(Response::new(Empty {}))
-    }
-}
-
-#[tonic::async_trait]
-impl TailnetControl for DaemonRPCServer {
-    async fn discover(
-        &self,
-        request: Request<TailnetDiscoverRequest>,
-    ) -> Result<Response<TailnetDiscoverResponse>, RspStatus> {
-        let request = request.into_inner();
-        info!(email = %request.email, "daemon tailnet discover RPC received");
-        let discovery = discovery::discover_tailnet(&request.email)
-            .await
-            .map_err(proc_err)?;
-        info!(
-            email = %request.email,
-            authority = %discovery.authority,
-            provider = ?discovery.provider,
-            "daemon tailnet discover RPC resolved"
-        );
-
-        Ok(Response::new(TailnetDiscoverResponse {
-            domain: discovery.domain,
-            authority: discovery.authority.clone(),
-            oidc_issuer: discovery.oidc_issuer.unwrap_or_default(),
-            managed: matches!(
-                discovery::inferred_provider(Some(&discovery.authority), Some(&discovery.provider)),
-                crate::control::TailnetProvider::Tailscale
-            ),
-        }))
-    }
-
-    async fn probe(
-        &self,
-        request: Request<TailnetProbeRequest>,
-    ) -> Result<Response<TailnetProbeResponse>, RspStatus> {
-        let request = request.into_inner();
-        let status = discovery::probe_tailnet_authority(&request.authority)
-            .await
-            .map_err(proc_err)?;
-
-        Ok(Response::new(TailnetProbeResponse {
-            authority: status.authority,
-            status_code: status.status_code,
-            summary: status.summary,
-            detail: status.detail,
-            reachable: status.reachable,
-        }))
-    }
-
-    async fn login_start(
-        &self,
-        request: Request<super::rpc::grpc_defs::TailnetLoginStartRequest>,
-    ) -> Result<Response<super::rpc::grpc_defs::TailnetLoginStatusResponse>, RspStatus> {
-        let request = request.into_inner();
-        info!(
-            account = %request.account_name,
-            identity = %request.identity_name,
-            authority = %request.authority,
-            "daemon tailnet login start RPC received"
-        );
-        let response = self
-            .tailnet_login
-            .start_login(Self::tailnet_bridge_request(
-                request.account_name,
-                request.identity_name,
-                request.hostname,
-                request.authority,
-            ))
-            .await
-            .map_err(proc_err)?;
-
-        info!(
-            session_id = %response.session_id,
-            backend_state = %response.status.backend_state,
-            running = response.status.running,
-            needs_login = response.status.needs_login,
-            auth_url = ?response.status.auth_url,
-            "daemon tailnet login start RPC resolved"
-        );
-
-        Ok(Response::new(tailnet_login_rsp(
-            response.session_id,
-            response.status,
-        )))
-    }
-
-    async fn login_status(
-        &self,
-        request: Request<super::rpc::grpc_defs::TailnetLoginStatusRequest>,
-    ) -> Result<Response<super::rpc::grpc_defs::TailnetLoginStatusResponse>, RspStatus> {
-        let request = request.into_inner();
-        info!(session_id = %request.session_id, "daemon tailnet login status RPC received");
-        let status = self
-            .tailnet_login
-            .status(&request.session_id)
-            .await
-            .map_err(proc_err)?;
-        let Some(status) = status else {
-            return Err(RspStatus::not_found("tailnet login session not found"));
-        };
-        info!(
-            session_id = %request.session_id,
-            backend_state = %status.backend_state,
-            running = status.running,
-            needs_login = status.needs_login,
-            auth_url = ?status.auth_url,
-            "daemon tailnet login status RPC resolved"
-        );
-        Ok(Response::new(tailnet_login_rsp(request.session_id, status)))
-    }
-
-    async fn login_cancel(
-        &self,
-        request: Request<super::rpc::grpc_defs::TailnetLoginCancelRequest>,
-    ) -> Result<Response<Empty>, RspStatus> {
-        let request = request.into_inner();
-        let canceled = self
-            .tailnet_login
-            .cancel(&request.session_id)
-            .await
-            .map_err(proc_err)?;
-        if !canceled {
-            return Err(RspStatus::not_found("tailnet login session not found"));
-        }
-        Ok(Response::new(Empty {}))
-    }
-}
-
-fn proc_err(err: impl ToString) -> RspStatus {
-    RspStatus::internal(err.to_string())
-}
-
-fn configuration_rsp(config: ServerConfig) -> TunnelConfigurationResponse {
-    TunnelConfigurationResponse {
-        addresses: config.address,
-        mtu: config.mtu.unwrap_or(1000),
-        routes: config.routes,
-        dns_servers: config.dns_servers,
-        search_domains: config.search_domains,
-        include_default_route: config.include_default_route,
-    }
-}
-
-fn status_rsp(state: RunState) -> TunnelStatusResponse {
-    TunnelStatusResponse {
-        state: state.to_rpc().into(),
-        start: None, // TODO: Add timestamp
-    }
-}
-
-fn tailnet_login_rsp(
-    session_id: String,
-    status: TailscaleLoginStatus,
-) -> super::rpc::grpc_defs::TailnetLoginStatusResponse {
-    super::rpc::grpc_defs::TailnetLoginStatusResponse {
-        session_id,
-        backend_state: status.backend_state,
-        auth_url: status.auth_url.unwrap_or_default(),
-        running: status.running,
-        needs_login: status.needs_login,
-        tailnet_name: status.tailnet_name.unwrap_or_default(),
-        magic_dns_suffix: status.magic_dns_suffix.unwrap_or_default(),
-        self_dns_name: status.self_dns_name.unwrap_or_default(),
-        tailnet_ips: status.tailscale_ips,
-        health: status.health,
-    }
 }
diff --git a/burrow/src/daemon/mod.rs b/burrow/src/daemon/mod.rs
index 724e3bb..2a971dd 100644
--- a/burrow/src/daemon/mod.rs
+++ b/burrow/src/daemon/mod.rs
@@ -1,281 +1,60 @@
 use std::{path::Path, sync::Arc};
 
 pub mod apple;
+mod command;
 mod instance;
 mod net;
-pub mod rpc;
-mod runtime;
+mod response;
 
-use anyhow::{Error as AhError, Result};
-use instance::DaemonRPCServer;
-pub use net::{get_socket_path, DaemonClient};
-pub use rpc::{DaemonCommand, DaemonResponseData, DaemonStartOptions};
-use tokio::{net::UnixListener, sync::Notify};
-use tokio_stream::wrappers::UnixListenerStream;
-use tonic::transport::Server;
-use tracing::info;
+use anyhow::Result;
+pub use command::{DaemonCommand, DaemonStartOptions};
+use instance::DaemonInstance;
+pub use net::{DaemonClient, Listener};
+pub use response::{DaemonResponse, DaemonResponseData, ServerInfo};
+use tokio::sync::{Notify, RwLock};
+use tracing::{error, info};
 
-use crate::{
-    daemon::rpc::grpc_defs::{
-        networks_server::NetworksServer, tailnet_control_server::TailnetControlServer,
-        tunnel_server::TunnelServer,
-    },
-    database::get_connection,
-};
+use crate::wireguard::{Config, Interface};
 
-pub async fn daemon_main(
-    socket_path: Option<&Path>,
-    db_path: Option<&Path>,
-    notify_ready: Option<Arc<Notify>>,
-) -> Result<()> {
-    let _conn = get_connection(db_path)?;
-    let burrow_server = DaemonRPCServer::new(db_path)?;
-    let spp = socket_path.clone();
-    let tmp = get_socket_path();
-    let sock_path = spp.unwrap_or(Path::new(tmp.as_str()));
-    if sock_path.exists() {
-        std::fs::remove_file(sock_path)?;
-    }
-    let uds = UnixListener::bind(sock_path)?;
-    let serve_job = tokio::spawn(async move {
-        let uds_stream = UnixListenerStream::new(uds);
-        let tailnet_server = burrow_server.clone();
-        let _srv = Server::builder()
-            .add_service(TunnelServer::new(burrow_server.clone()))
-            .add_service(NetworksServer::new(burrow_server))
-            .add_service(TailnetControlServer::new(tailnet_server))
-            .serve_with_incoming(uds_stream)
-            .await?;
-        Ok::<(), AhError>(())
-    });
+pub async fn daemon_main(path: Option<&Path>, notify_ready: Option<Arc<Notify>>) -> Result<()> {
+    let (commands_tx, commands_rx) = async_channel::unbounded();
+    let (response_tx, response_rx) = async_channel::unbounded();
 
+    let listener = if let Some(path) = path {
+        info!("Creating listener... {:?}", path);
+        Listener::new_with_path(commands_tx, response_rx, path)
+    } else {
+        info!("Creating listener...");
+        Listener::new(commands_tx, response_rx)
+    };
     if let Some(n) = notify_ready {
-        n.notify_one();
+        n.notify_one()
     }
+    let listener = listener?;
+
+    let config = Config::default();
+    let iface: Interface = config.try_into()?;
+    let mut instance = DaemonInstance::new(commands_rx, response_tx, Arc::new(RwLock::new(iface)));
 
     info!("Starting daemon...");
 
-    tokio::try_join!(serve_job)
+    let main_job = tokio::spawn(async move {
+        let result = instance.run().await;
+        if let Err(e) = result.as_ref() {
+            error!("Instance exited: {}", e);
+        }
+        result
+    });
+
+    let listener_job = tokio::spawn(async move {
+        let result = listener.run().await;
+        if let Err(e) = result.as_ref() {
+            error!("Listener exited: {}", e);
+        }
+        result
+    });
+
+    tokio::try_join!(main_job, listener_job)
         .map(|_| ())
         .map_err(|e| e.into())
 }
-
-#[cfg(test)]
-mod tests {
-    use std::{
-        path::PathBuf,
-        time::{SystemTime, UNIX_EPOCH},
-    };
-
-    use anyhow::{anyhow, Result};
-    use tokio::time::{timeout, Duration};
-
-    use super::*;
-    use crate::daemon::rpc::{
-        client::BurrowClient,
-        grpc_defs::{
-            Empty, Network, NetworkListResponse, NetworkReorderRequest, NetworkType,
-            TunnelConfigurationResponse, TunnelStatusResponse,
-        },
-    };
-
-    #[tokio::test]
-    async fn daemon_tracks_network_priority_via_grpc() -> Result<()> {
-        let socket_path = temp_path("sock");
-        let db_path = temp_path("sqlite3");
-        let ready = Arc::new(Notify::new());
-
-        let daemon_ready = ready.clone();
-        let daemon_socket_path = socket_path.clone();
-        let daemon_db_path = db_path.clone();
-        let daemon_task = tokio::spawn(async move {
-            daemon_main(
-                Some(daemon_socket_path.as_path()),
-                Some(daemon_db_path.as_path()),
-                Some(daemon_ready),
-            )
-            .await
-        });
-
-        timeout(Duration::from_secs(5), ready.notified()).await?;
-
-        let mut client = timeout(
-            Duration::from_secs(5),
-            BurrowClient::from_uds_path(&socket_path),
-        )
-        .await??;
-        let mut config_stream = client
-            .tunnel_client
-            .tunnel_configuration(Empty {})
-            .await?
-            .into_inner();
-        let mut network_stream = client
-            .networks_client
-            .network_list(Empty {})
-            .await?
-            .into_inner();
-        let mut status_stream = client
-            .tunnel_client
-            .tunnel_status(Empty {})
-            .await?
-            .into_inner();
-
-        let initial_config = next_configuration(&mut config_stream).await?;
-        assert!(initial_config.addresses.is_empty());
-        assert_eq!(initial_config.mtu, 1500);
-
-        let initial_networks = next_networks(&mut network_stream).await?;
-        assert!(initial_networks.network.is_empty());
-
-        let initial_status = next_status(&mut status_stream).await?;
-        assert_eq!(
-            initial_status.state(),
-            crate::daemon::rpc::grpc_defs::State::Stopped
-        );
-
-        client.tunnel_client.tunnel_start(Empty {}).await?;
-
-        let passthrough_status = next_status(&mut status_stream).await?;
-        assert_eq!(
-            passthrough_status.state(),
-            crate::daemon::rpc::grpc_defs::State::Running
-        );
-
-        client.tunnel_client.tunnel_stop(Empty {}).await?;
-
-        let stopped_status = next_status(&mut status_stream).await?;
-        assert_eq!(
-            stopped_status.state(),
-            crate::daemon::rpc::grpc_defs::State::Stopped
-        );
-
-        client
-            .networks_client
-            .network_add(Network {
-                id: 1,
-                r#type: NetworkType::WireGuard.into(),
-                payload: sample_wireguard_payload(),
-            })
-            .await?;
-
-        let networks_after_wg = next_networks(&mut network_stream).await?;
-        assert_eq!(
-            network_ids(&networks_after_wg),
-            vec![(1, NetworkType::WireGuard)]
-        );
-
-        let wireguard_config = next_configuration(&mut config_stream).await?;
-        assert_eq!(
-            wireguard_config.addresses,
-            vec!["10.8.0.2/32", "fd00::2/128"]
-        );
-        assert_eq!(wireguard_config.mtu, 1420);
-
-        client
-            .networks_client
-            .network_add(Network {
-                id: 2,
-                r#type: NetworkType::WireGuard.into(),
-                payload: sample_wireguard_payload_with("10.77.0.2/32", 1380),
-            })
-            .await?;
-
-        let networks_after_second_add = next_networks(&mut network_stream).await?;
-        assert_eq!(
-            network_ids(&networks_after_second_add),
-            vec![(1, NetworkType::WireGuard), (2, NetworkType::WireGuard)]
-        );
-
-        let still_wireguard = next_configuration(&mut config_stream).await?;
-        assert_eq!(still_wireguard.addresses, wireguard_config.addresses);
-
-        client
-            .networks_client
-            .network_reorder(NetworkReorderRequest { id: 2, index: 0 })
-            .await?;
-
-        let networks_after_reorder = next_networks(&mut network_stream).await?;
-        assert_eq!(
-            network_ids(&networks_after_reorder),
-            vec![(2, NetworkType::WireGuard), (1, NetworkType::WireGuard)]
-        );
-
-        let second_wireguard_config = next_configuration(&mut config_stream).await?;
-        assert_eq!(second_wireguard_config.addresses, vec!["10.77.0.2/32"]);
-        assert_eq!(second_wireguard_config.mtu, 1380);
-
-        daemon_task.abort();
-        let _ = daemon_task.await;
-        cleanup_path(&socket_path);
-        cleanup_path(&db_path);
-
-        Ok(())
-    }
-
-    fn temp_path(ext: &str) -> PathBuf {
-        let now = SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .expect("system time is after unix epoch")
-            .as_nanos();
-        std::env::temp_dir().join(format!("burrow-daemon-test-{now}.{ext}"))
-    }
-
-    fn cleanup_path(path: &Path) {
-        let _ = std::fs::remove_file(path);
-    }
-
-    fn sample_wireguard_payload() -> Vec<u8> {
-        br#"[Interface]
-PrivateKey = OEPVdomeLTxTIBvv3TYsJRge0Hp9NMiY0sIrhT8OWG8=
-Address = 10.8.0.2/32, fd00::2/128
-ListenPort = 51820
-MTU = 1420
-
-[Peer]
-PublicKey = 8GaFjVO6c4luCHG4ONO+1bFG8tO+Zz5/Gy+Geht1USM=
-PresharedKey = ha7j4BjD49sIzyF9SNlbueK0AMHghlj6+u0G3bzC698=
-AllowedIPs = 0.0.0.0/0, ::/0
-Endpoint = wg.burrow.rs:51820
-"#
-        .to_vec()
-    }
-
-    fn sample_wireguard_payload_with(address: &str, mtu: u16) -> Vec<u8> {
-        format!(
-            "[Interface]\nPrivateKey = OEPVdomeLTxTIBvv3TYsJRge0Hp9NMiY0sIrhT8OWG8=\nAddress = {address}\nListenPort = 51820\nMTU = {mtu}\n\n[Peer]\nPublicKey = 8GaFjVO6c4luCHG4ONO+1bFG8tO+Zz5/Gy+Geht1USM=\nPresharedKey = ha7j4BjD49sIzyF9SNlbueK0AMHghlj6+u0G3bzC698=\nAllowedIPs = 0.0.0.0/0, ::/0\nEndpoint = wg.burrow.rs:51820\n"
-        )
-        .into_bytes()
-    }
-
-    async fn next_configuration(
-        stream: &mut tonic::Streaming<TunnelConfigurationResponse>,
-    ) -> Result<TunnelConfigurationResponse> {
-        timeout(Duration::from_secs(5), stream.message())
-            .await??
-            .ok_or_else(|| anyhow!("configuration stream ended unexpectedly"))
-    }
-
-    async fn next_networks(
-        stream: &mut tonic::Streaming<NetworkListResponse>,
-    ) -> Result<NetworkListResponse> {
-        timeout(Duration::from_secs(5), stream.message())
-            .await??
-            .ok_or_else(|| anyhow!("network stream ended unexpectedly"))
-    }
-
-    async fn next_status(
-        stream: &mut tonic::Streaming<TunnelStatusResponse>,
-    ) -> Result<TunnelStatusResponse> {
-        timeout(Duration::from_secs(5), stream.message())
-            .await??
-            .ok_or_else(|| anyhow!("status stream ended unexpectedly"))
-    }
-
-    fn network_ids(response: &NetworkListResponse) -> Vec<(i32, NetworkType)> {
-        response
-            .network
-            .iter()
-            .map(|network| (network.id, network.r#type()))
-            .collect()
-    }
-}
diff --git a/burrow/src/daemon/net/mod.rs b/burrow/src/daemon/net/mod.rs
index eb45335..fe35bae 100644
--- a/burrow/src/daemon/net/mod.rs
+++ b/burrow/src/daemon/net/mod.rs
@@ -1,11 +1,21 @@
+use serde::{Deserialize, Serialize};
+
+use super::DaemonCommand;
+
 #[cfg(target_family = "unix")]
 mod unix;
 
 #[cfg(target_family = "unix")]
-pub use unix::{get_socket_path, DaemonClient, Listener};
+pub use unix::{DaemonClient, Listener};
 
 #[cfg(target_os = "windows")]
 mod windows;
 
 #[cfg(target_os = "windows")]
 pub use windows::{DaemonClient, Listener};
+
+#[derive(Clone, Serialize, Deserialize)]
+pub struct DaemonRequest {
+    pub id: u64,
+    pub command: DaemonCommand,
+}
diff --git a/burrow/src/daemon/net/unix.rs b/burrow/src/daemon/net/unix.rs
index f7f9433..26e901d 100644
--- a/burrow/src/daemon/net/unix.rs
+++ b/burrow/src/daemon/net/unix.rs
@@ -10,10 +10,8 @@ use tokio::{
 };
 use tracing::{debug, error, info};
 
-use crate::daemon::rpc::{
-    DaemonCommand, DaemonMessage, DaemonNotification, DaemonRequest, DaemonResponse,
-    DaemonResponseData,
-};
+use super::*;
+use crate::daemon::{DaemonCommand, DaemonResponse, DaemonResponseData};
 
 #[cfg(not(target_vendor = "apple"))]
 const UNIX_SOCKET_PATH: &str = "/run/burrow.sock";
@@ -21,18 +19,11 @@ const UNIX_SOCKET_PATH: &str = "/run/burrow.sock";
 #[cfg(target_vendor = "apple")]
 const UNIX_SOCKET_PATH: &str = "burrow.sock";
 
-pub fn get_socket_path() -> String {
-    if std::env::var("BURROW_SOCKET_PATH").is_ok() {
-        return std::env::var("BURROW_SOCKET_PATH").unwrap();
-    }
-    UNIX_SOCKET_PATH.to_string()
-}
-
+#[derive(Debug)]
 pub struct Listener {
     cmd_tx: async_channel::Sender<DaemonCommand>,
     rsp_rx: async_channel::Receiver<DaemonResponse>,
-    sub_chan: async_channel::Receiver<DaemonNotification>,
-    pub inner: UnixListener,
+    inner: UnixListener,
 }
 
 impl Listener {
@@ -40,11 +31,9 @@ impl Listener {
     pub fn new(
         cmd_tx: async_channel::Sender<DaemonCommand>,
         rsp_rx: async_channel::Receiver<DaemonResponse>,
-        sub_chan: async_channel::Receiver<DaemonNotification>,
     ) -> Self {
-        let socket_path = get_socket_path();
-        let path = Path::new(OsStr::new(&socket_path));
-        Self::new_with_path(cmd_tx, rsp_rx, sub_chan, path)?
+        let path = Path::new(OsStr::new(UNIX_SOCKET_PATH));
+        Self::new_with_path(cmd_tx, rsp_rx, path)?
     }
 
     #[throws]
@@ -52,16 +41,10 @@ impl Listener {
     pub fn new_with_path(
         cmd_tx: async_channel::Sender<DaemonCommand>,
         rsp_rx: async_channel::Receiver<DaemonResponse>,
-        sub_chan: async_channel::Receiver<DaemonNotification>,
         path: &Path,
     ) -> Self {
         let inner = listener_from_path_or_fd(&path, raw_fd())?;
-        Self {
-            cmd_tx,
-            rsp_rx,
-            sub_chan,
-            inner,
-        }
+        Self { cmd_tx, rsp_rx, inner }
     }
 
     #[throws]
@@ -69,16 +52,10 @@ impl Listener {
     pub fn new_with_path(
         cmd_tx: async_channel::Sender<DaemonCommand>,
         rsp_rx: async_channel::Receiver<DaemonResponse>,
-        sub_chan: async_channel::Receiver<DaemonNotification>,
         path: &Path,
     ) -> Self {
         let inner = listener_from_path(path)?;
-        Self {
-            cmd_tx,
-            rsp_rx,
-            inner,
-            sub_chan,
-        }
+        Self { cmd_tx, rsp_rx, inner }
     }
 
     pub async fn run(&self) -> Result<()> {
@@ -87,10 +64,9 @@ impl Listener {
             let (stream, _) = self.inner.accept().await?;
             let cmd_tx = self.cmd_tx.clone();
             let rsp_rxc = self.rsp_rx.clone();
-            let sub_chan = self.sub_chan.clone();
             tokio::task::spawn(async move {
                 info!("Got connection: {:?}", stream);
-                Self::stream(stream, cmd_tx, rsp_rxc, sub_chan).await;
+                Self::stream(stream, cmd_tx, rsp_rxc).await;
             });
         }
     }
@@ -99,46 +75,34 @@ impl Listener {
         stream: UnixStream,
         cmd_tx: async_channel::Sender<DaemonCommand>,
         rsp_rxc: async_channel::Receiver<DaemonResponse>,
-        sub_chan: async_channel::Receiver<DaemonNotification>,
     ) {
         let mut stream = stream;
         let (mut read_stream, mut write_stream) = stream.split();
         let buf_reader = BufReader::new(&mut read_stream);
         let mut lines = buf_reader.lines();
-        loop {
-            tokio::select! {
-                Ok(Some(line)) = lines.next_line() => {
-                    info!("Line: {}", line);
-                    let mut res: DaemonResponse = DaemonResponseData::None.into();
-                    let req = match serde_json::from_str::<DaemonRequest>(&line) {
-                        Ok(req) => Some(req),
-                        Err(e) => {
-                            res.result = Err(e.to_string());
-                            error!("Failed to parse request: {}", e);
-                            None
-                        }
-                    };
-
-                    let res = serde_json::to_string(&DaemonMessage::from(res)).unwrap();
-
-                    if let Some(req) = req {
-                        cmd_tx.send(req.command).await.unwrap();
-                        let res = rsp_rxc.recv().await.unwrap().with_id(req.id);
-                        let mut payload = serde_json::to_string(&DaemonMessage::from(res)).unwrap();
-                        payload.push('\n');
-                        info!("Sending response: {}", payload);
-                        write_stream.write_all(payload.as_bytes()).await.unwrap();
-                    } else {
-                        write_stream.write_all(res.as_bytes()).await.unwrap();
-                    }
-                }
-                Ok(cmd) = sub_chan.recv() => {
-                    info!("Got subscription command: {:?}", cmd);
-                    let msg = DaemonMessage::from(cmd);
-                    let mut payload = serde_json::to_string(&msg).unwrap();
-                    payload.push('\n');
-                    write_stream.write_all(payload.as_bytes()).await.unwrap();
+        while let Ok(Some(line)) = lines.next_line().await {
+            info!("Line: {}", line);
+            let mut res: DaemonResponse = DaemonResponseData::None.into();
+            let req = match serde_json::from_str::<DaemonRequest>(&line) {
+                Ok(req) => Some(req),
+                Err(e) => {
+                    res.result = Err(e.to_string());
+                    error!("Failed to parse request: {}", e);
+                    None
                 }
+            };
+            let mut res = serde_json::to_string(&res).unwrap();
+            res.push('\n');
+
+            if let Some(req) = req {
+                cmd_tx.send(req.command).await.unwrap();
+                let res = rsp_rxc.recv().await.unwrap().with_id(req.id);
+                let mut retres = serde_json::to_string(&res).unwrap();
+                retres.push('\n');
+                info!("Sending response: {}", retres);
+                write_stream.write_all(retres.as_bytes()).await.unwrap();
+            } else {
+                write_stream.write_all(res.as_bytes()).await.unwrap();
             }
         }
     }
@@ -212,8 +176,7 @@ pub struct DaemonClient {
 
 impl DaemonClient {
     pub async fn new() -> Result<Self> {
-        let socket_path = get_socket_path();
-        let path = Path::new(OsStr::new(&socket_path));
+        let path = Path::new(OsStr::new(UNIX_SOCKET_PATH));
         Self::new_with_path(path).await
     }
 
diff --git a/burrow/src/daemon/rpc/response.rs b/burrow/src/daemon/response.rs
similarity index 67%
rename from burrow/src/daemon/rpc/response.rs
rename to burrow/src/daemon/response.rs
index 6d03581..172d4c7 100644
--- a/burrow/src/daemon/rpc/response.rs
+++ b/burrow/src/daemon/response.rs
@@ -2,8 +2,6 @@ use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use tun::TunInterface;
 
-use crate::wireguard::Config;
-
 #[derive(Clone, Serialize, Deserialize, Debug, JsonSchema)]
 pub struct DaemonResponse {
     //  Error types can't be serialized, so this is the second best option.
@@ -36,8 +34,6 @@ impl DaemonResponse {
 pub struct ServerInfo {
     pub name: Option<String>,
     pub ip: Option<String>,
-    #[serde(default)]
-    pub ipv6: Vec<String>,
     pub mtu: Option<i32>,
 }
 
@@ -49,12 +45,6 @@ impl TryFrom<&TunInterface> for ServerInfo {
         Ok(ServerInfo {
             name: server.name().ok(),
             ip: server.ipv4_addr().ok().map(|ip| ip.to_string()),
-            ipv6: server
-                .ipv6_addrs()
-                .unwrap_or_default()
-                .into_iter()
-                .map(|ip| ip.to_string())
-                .collect(),
             mtu: server.mtu().ok(),
         })
     }
@@ -67,47 +57,15 @@ impl TryFrom<&TunInterface> for ServerInfo {
 
 #[derive(Clone, Debug, Serialize, Deserialize, JsonSchema)]
 pub struct ServerConfig {
-    pub address: Vec<String>,
-    #[serde(default)]
-    pub routes: Vec<String>,
-    #[serde(default)]
-    pub dns_servers: Vec<String>,
-    #[serde(default)]
-    pub search_domains: Vec<String>,
-    #[serde(default)]
-    pub include_default_route: bool,
+    pub address: Option<String>,
     pub name: Option<String>,
     pub mtu: Option<i32>,
 }
 
-impl TryFrom<&Config> for ServerConfig {
-    type Error = anyhow::Error;
-
-    fn try_from(config: &Config) -> anyhow::Result<Self> {
-        Ok(ServerConfig {
-            address: config.interface.address.clone(),
-            routes: config
-                .peers
-                .iter()
-                .flat_map(|peer| peer.allowed_ips.iter().cloned())
-                .collect(),
-            dns_servers: config.interface.dns.clone(),
-            search_domains: Vec::new(),
-            include_default_route: false,
-            name: None,
-            mtu: config.interface.mtu.map(|mtu| mtu as i32),
-        })
-    }
-}
-
 impl Default for ServerConfig {
     fn default() -> Self {
         Self {
-            address: vec!["10.13.13.2".to_string()], // Dummy remote address
-            routes: Vec::new(),
-            dns_servers: Vec::new(),
-            search_domains: Vec::new(),
-            include_default_route: false,
+            address: Some("10.13.13.2".to_string()), // Dummy remote address
             name: None,
             mtu: None,
         }
@@ -115,7 +73,6 @@ impl Default for ServerConfig {
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, JsonSchema)]
-#[serde(tag = "type")]
 pub enum DaemonResponseData {
     ServerInfo(ServerInfo),
     ServerConfig(ServerConfig),
@@ -137,7 +94,6 @@ fn test_response_serialization() -> anyhow::Result<()> {
         DaemonResponseData::ServerInfo(ServerInfo {
             name: Some("burrow".to_string()),
             ip: None,
-            ipv6: Vec::new(),
             mtu: Some(1500)
         })
     )))?);
diff --git a/burrow/src/daemon/rpc/client.rs b/burrow/src/daemon/rpc/client.rs
deleted file mode 100644
index aa84c64..0000000
--- a/burrow/src/daemon/rpc/client.rs
+++ /dev/null
@@ -1,46 +0,0 @@
-use anyhow::Result;
-use hyper_util::rt::TokioIo;
-use std::path::Path;
-use tokio::net::UnixStream;
-use tonic::transport::{Endpoint, Uri};
-use tower::service_fn;
-
-use super::grpc_defs::{
-    networks_client::NetworksClient, tailnet_control_client::TailnetControlClient,
-    tunnel_client::TunnelClient,
-};
-use crate::daemon::get_socket_path;
-
-pub struct BurrowClient<T> {
-    pub networks_client: NetworksClient<T>,
-    pub tailnet_client: TailnetControlClient<T>,
-    pub tunnel_client: TunnelClient<T>,
-}
-
-impl BurrowClient<tonic::transport::Channel> {
-    #[cfg(any(target_os = "linux", target_vendor = "apple"))]
-    pub async fn from_uds() -> Result<Self> {
-        Self::from_uds_path(get_socket_path()).await
-    }
-
-    #[cfg(any(target_os = "linux", target_vendor = "apple"))]
-    pub async fn from_uds_path(path: impl AsRef<Path>) -> Result<Self> {
-        let socket_path = path.as_ref().to_owned();
-        let channel = Endpoint::try_from("http://[::]:50051")? // NOTE: this is a hack(?)
-            .connect_with_connector(service_fn(move |_: Uri| {
-                let socket_path = socket_path.clone();
-                async move {
-                    Ok::<_, std::io::Error>(TokioIo::new(UnixStream::connect(&socket_path).await?))
-                }
-            }))
-            .await?;
-        let nw_client = NetworksClient::new(channel.clone());
-        let tailnet_client = TailnetControlClient::new(channel.clone());
-        let tun_client = TunnelClient::new(channel.clone());
-        Ok(BurrowClient {
-            networks_client: nw_client,
-            tailnet_client,
-            tunnel_client: tun_client,
-        })
-    }
-}
diff --git a/burrow/src/daemon/rpc/grpc_defs.rs b/burrow/src/daemon/rpc/grpc_defs.rs
deleted file mode 100644
index f3085ee..0000000
--- a/burrow/src/daemon/rpc/grpc_defs.rs
+++ /dev/null
@@ -1,5 +0,0 @@
-pub use burrowgrpc::*;
-
-mod burrowgrpc {
-    tonic::include_proto!("burrow");
-}
diff --git a/burrow/src/daemon/rpc/mod.rs b/burrow/src/daemon/rpc/mod.rs
deleted file mode 100644
index 512662c..0000000
--- a/burrow/src/daemon/rpc/mod.rs
+++ /dev/null
@@ -1,43 +0,0 @@
-pub mod client;
-pub mod grpc_defs;
-pub mod notification;
-pub mod request;
-pub mod response;
-
-pub use client::BurrowClient;
-pub use notification::DaemonNotification;
-pub use request::{DaemonCommand, DaemonRequest, DaemonStartOptions};
-pub use response::{DaemonResponse, DaemonResponseData, ServerConfig, ServerInfo};
-use serde::{Deserialize, Serialize};
-
-/// The `Message` object contains either a `DaemonRequest` or a `DaemonResponse` to be serialized / deserialized
-/// for our IPC communication. Our IPC protocol is based on jsonrpc (https://www.jsonrpc.org/specification#overview),
-/// but deviates from it in a few ways:
-/// - We differentiate Notifications from Requests explicitly.
-/// - We have a "type" field to differentiate between a request, a response, and a notification.
-/// - The params field may receive any json value(such as a string), not just an object or an array.
-#[derive(Serialize, Deserialize)]
-#[serde(tag = "type")]
-pub enum DaemonMessage {
-    Request(DaemonRequest),
-    Response(DaemonResponse),
-    Notification(DaemonNotification),
-}
-
-impl From<DaemonRequest> for DaemonMessage {
-    fn from(request: DaemonRequest) -> Self {
-        DaemonMessage::Request(request)
-    }
-}
-
-impl From<DaemonResponse> for DaemonMessage {
-    fn from(response: DaemonResponse) -> Self {
-        DaemonMessage::Response(response)
-    }
-}
-
-impl From<DaemonNotification> for DaemonMessage {
-    fn from(notification: DaemonNotification) -> Self {
-        DaemonMessage::Notification(notification)
-    }
-}
diff --git a/burrow/src/daemon/rpc/notification.rs b/burrow/src/daemon/rpc/notification.rs
deleted file mode 100644
index 135b0e4..0000000
--- a/burrow/src/daemon/rpc/notification.rs
+++ /dev/null
@@ -1,11 +0,0 @@
-use rpc::ServerConfig;
-use schemars::JsonSchema;
-use serde::{Deserialize, Serialize};
-
-use crate::daemon::rpc;
-
-#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
-#[serde(tag = "method", content = "params")]
-pub enum DaemonNotification {
-    ConfigChange(ServerConfig),
-}
diff --git a/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__request__daemoncommand_serialization-2.snap b/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__request__daemoncommand_serialization-2.snap
deleted file mode 100644
index 01ec8a7..0000000
--- a/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__request__daemoncommand_serialization-2.snap
+++ /dev/null
@@ -1,5 +0,0 @@
----
-source: burrow/src/daemon/rpc/request.rs
-expression: "serde_json::to_string(&DaemonCommand::Start(DaemonStartOptions {\n                    tun: TunOptions { ..TunOptions::default() },\n                })).unwrap()"
----
-{"method":"Start","params":{"tun":{"name":null,"no_pi":false,"tun_excl":false,"tun_retrieve":false,"address":[]}}}
diff --git a/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__request__daemoncommand_serialization-3.snap b/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__request__daemoncommand_serialization-3.snap
deleted file mode 100644
index a6a0466..0000000
--- a/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__request__daemoncommand_serialization-3.snap
+++ /dev/null
@@ -1,5 +0,0 @@
----
-source: burrow/src/daemon/rpc/request.rs
-expression: "serde_json::to_string(&DaemonCommand::ServerInfo).unwrap()"
----
-{"method":"ServerInfo"}
diff --git a/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__request__daemoncommand_serialization-4.snap b/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__request__daemoncommand_serialization-4.snap
deleted file mode 100644
index f930051..0000000
--- a/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__request__daemoncommand_serialization-4.snap
+++ /dev/null
@@ -1,5 +0,0 @@
----
-source: burrow/src/daemon/rpc/request.rs
-expression: "serde_json::to_string(&DaemonCommand::Stop).unwrap()"
----
-{"method":"Stop"}
diff --git a/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__request__daemoncommand_serialization-5.snap b/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__request__daemoncommand_serialization-5.snap
deleted file mode 100644
index 89dc42c..0000000
--- a/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__request__daemoncommand_serialization-5.snap
+++ /dev/null
@@ -1,5 +0,0 @@
----
-source: burrow/src/daemon/rpc/request.rs
-expression: "serde_json::to_string(&DaemonCommand::ServerConfig).unwrap()"
----
-{"method":"ServerConfig"}
diff --git a/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__request__daemoncommand_serialization.snap b/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__request__daemoncommand_serialization.snap
deleted file mode 100644
index aeca659..0000000
--- a/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__request__daemoncommand_serialization.snap
+++ /dev/null
@@ -1,5 +0,0 @@
----
-source: burrow/src/daemon/rpc/request.rs
-expression: "serde_json::to_string(&DaemonCommand::Start(DaemonStartOptions::default())).unwrap()"
----
-{"method":"Start","params":{"tun":{"name":null,"no_pi":false,"tun_excl":false,"tun_retrieve":false,"address":[]}}}
diff --git a/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__response__response_serialization-2.snap b/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__response__response_serialization-2.snap
deleted file mode 100644
index 76aa944..0000000
--- a/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__response__response_serialization-2.snap
+++ /dev/null
@@ -1,5 +0,0 @@
----
-source: burrow/src/daemon/rpc/response.rs
-expression: "serde_json::to_string(&DaemonResponse::new(Ok::<DaemonResponseData,\n                        String>(DaemonResponseData::ServerInfo(ServerInfo {\n                            name: Some(\"burrow\".to_string()),\n                            ip: None,\n                            ipv6: Vec::new(),\n                            mtu: Some(1500),\n                        }))))?"
----
-{"result":{"Ok":{"type":"ServerInfo","name":"burrow","ip":null,"ipv6":[],"mtu":1500}},"id":0}
diff --git a/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__response__response_serialization-3.snap b/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__response__response_serialization-3.snap
deleted file mode 100644
index 30068f3..0000000
--- a/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__response__response_serialization-3.snap
+++ /dev/null
@@ -1,5 +0,0 @@
----
-source: burrow/src/daemon/rpc/response.rs
-expression: "serde_json::to_string(&DaemonResponse::new(Err::<DaemonResponseData,\n                        String>(\"error\".to_string())))?"
----
-{"result":{"Err":"error"},"id":0}
diff --git a/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__response__response_serialization-4.snap b/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__response__response_serialization-4.snap
deleted file mode 100644
index 68b4195..0000000
--- a/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__response__response_serialization-4.snap
+++ /dev/null
@@ -1,5 +0,0 @@
----
-source: burrow/src/daemon/rpc/response.rs
-expression: "serde_json::to_string(&DaemonResponse::new(Ok::<DaemonResponseData,\n                        String>(DaemonResponseData::ServerConfig(ServerConfig::default()))))?"
----
-{"result":{"Ok":{"type":"ServerConfig","address":["10.13.13.2"],"routes":[],"dns_servers":[],"search_domains":[],"include_default_route":false,"name":null,"mtu":null}},"id":0}
diff --git a/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__response__response_serialization.snap b/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__response__response_serialization.snap
deleted file mode 100644
index 31bd84b..0000000
--- a/burrow/src/daemon/rpc/snapshots/burrow__daemon__rpc__response__response_serialization.snap
+++ /dev/null
@@ -1,5 +0,0 @@
----
-source: burrow/src/daemon/rpc/response.rs
-expression: "serde_json::to_string(&DaemonResponse::new(Ok::<DaemonResponseData,\n                        String>(DaemonResponseData::None)))?"
----
-{"result":{"Ok":{"type":"None"}},"id":0}
diff --git a/burrow/src/daemon/runtime.rs b/burrow/src/daemon/runtime.rs
deleted file mode 100644
index 31821a2..0000000
--- a/burrow/src/daemon/runtime.rs
+++ /dev/null
@@ -1,618 +0,0 @@
-use std::{path::PathBuf, sync::Arc};
-
-use anyhow::{bail, Context, Result};
-use tokio::{
-    io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt},
-    net::UnixStream,
-    sync::{broadcast, mpsc, RwLock},
-    task::JoinHandle,
-    time::{sleep, Duration},
-};
-use tun::{tokio::TunInterface, TunOptions};
-
-use super::rpc::{
-    grpc_defs::{Network, NetworkType},
-    ServerConfig,
-};
-use crate::{
-    auth::server::tailscale::{
-        default_hostname, packet_socket_path, spawn_tailscale_helper, TailscaleHelperProcess,
-        TailscaleLoginStartRequest, TailscaleLoginStatus,
-    },
-    control::{discovery, TailnetConfig},
-    wireguard::{Config, Interface as WireGuardInterface},
-};
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum RuntimeIdentity {
-    Passthrough,
-    Network {
-        id: i32,
-        network_type: NetworkType,
-        payload: Vec<u8>,
-    },
-}
-
-#[derive(Clone, Debug)]
-pub enum ResolvedTunnel {
-    Passthrough {
-        identity: RuntimeIdentity,
-    },
-    Tailnet {
-        identity: RuntimeIdentity,
-        config: TailnetConfig,
-    },
-    WireGuard {
-        identity: RuntimeIdentity,
-        config: Config,
-    },
-}
-
-impl ResolvedTunnel {
-    pub fn from_networks(networks: &[Network]) -> Result<Self> {
-        let Some(network) = networks.first() else {
-            return Ok(Self::Passthrough {
-                identity: RuntimeIdentity::Passthrough,
-            });
-        };
-
-        let identity = RuntimeIdentity::Network {
-            id: network.id,
-            network_type: network.r#type(),
-            payload: network.payload.clone(),
-        };
-
-        match network.r#type() {
-            NetworkType::Tailnet => {
-                let config = TailnetConfig::from_slice(&network.payload)?;
-                Ok(Self::Tailnet { identity, config })
-            }
-            NetworkType::WireGuard => {
-                let payload = String::from_utf8(network.payload.clone())
-                    .context("wireguard payload must be valid UTF-8")?;
-                let config = Config::from_content_fmt(&payload, "ini")?;
-                Ok(Self::WireGuard { identity, config })
-            }
-        }
-    }
-
-    pub fn identity(&self) -> &RuntimeIdentity {
-        match self {
-            Self::Passthrough { identity }
-            | Self::Tailnet { identity, .. }
-            | Self::WireGuard { identity, .. } => identity,
-        }
-    }
-
-    pub fn server_config(&self) -> Result<ServerConfig> {
-        match self {
-            Self::Passthrough { .. } => Ok(ServerConfig {
-                address: Vec::new(),
-                routes: Vec::new(),
-                dns_servers: Vec::new(),
-                search_domains: Vec::new(),
-                include_default_route: false,
-                name: None,
-                mtu: Some(1500),
-            }),
-            Self::Tailnet { .. } => Ok(ServerConfig {
-                address: Vec::new(),
-                routes: tailnet_routes(),
-                dns_servers: tailnet_dns_servers(),
-                search_domains: Vec::new(),
-                include_default_route: false,
-                name: None,
-                mtu: Some(1280),
-            }),
-            Self::WireGuard { config, .. } => ServerConfig::try_from(config),
-        }
-    }
-
-    pub async fn start(
-        self,
-        tun_interface: Arc<RwLock<Option<TunInterface>>>,
-        tailnet_helper: Option<Arc<TailscaleHelperProcess>>,
-    ) -> Result<ActiveTunnel> {
-        match self {
-            Self::Passthrough { identity } => Ok(ActiveTunnel::Passthrough {
-                identity,
-                server_config: ServerConfig {
-                    address: Vec::new(),
-                    routes: Vec::new(),
-                    dns_servers: Vec::new(),
-                    search_domains: Vec::new(),
-                    include_default_route: false,
-                    name: None,
-                    mtu: Some(1500),
-                },
-            }),
-            Self::Tailnet { identity, config } => {
-                let (helper, shutdown_helper_on_stop) = match tailnet_helper {
-                    Some(helper) => (helper, false),
-                    None => {
-                        let helper_request = tailnet_helper_request(&identity, &config);
-                        let helper = Arc::new(spawn_tailscale_helper(&helper_request).await?);
-                        (helper, true)
-                    }
-                };
-                let status = wait_for_tailnet_ready(helper.as_ref()).await?;
-                let server_config = tailnet_server_config(&status);
-                let packet_socket = helper
-                    .packet_socket()
-                    .map(PathBuf::from)
-                    .ok_or_else(|| anyhow::anyhow!("tailnet helper did not report a packet socket"))?;
-                let packet_bridge = connect_tailnet_packet_bridge(packet_socket).await?;
-                #[cfg(target_vendor = "apple")]
-                let tun_task = None;
-                #[cfg(not(target_vendor = "apple"))]
-                let tun_task = {
-                    let tun = TunOptions::new().open()?;
-                    tun_interface.write().await.replace(tun);
-                    Some(tokio::spawn(run_tailnet_tun_bridge(
-                        tun_interface.clone(),
-                        packet_bridge.outbound_sender(),
-                        packet_bridge.subscribe(),
-                    )))
-                };
-
-                Ok(ActiveTunnel::Tailnet {
-                    identity,
-                    server_config,
-                    helper,
-                    shutdown_helper_on_stop,
-                    packet_bridge,
-                    tun_task,
-                })
-            }
-            Self::WireGuard { identity, config } => {
-                let server_config = ServerConfig::try_from(&config)?;
-                let tun = TunOptions::new().open()?;
-                tun_interface.write().await.replace(tun);
-
-                match start_wireguard_runtime(config, tun_interface.clone()).await {
-                    Ok((interface, task)) => Ok(ActiveTunnel::WireGuard {
-                        identity,
-                        server_config,
-                        interface,
-                        task,
-                    }),
-                    Err(err) => {
-                        tun_interface.write().await.take();
-                        Err(err)
-                    }
-                }
-            }
-        }
-    }
-}
-
-pub enum ActiveTunnel {
-    Passthrough {
-        identity: RuntimeIdentity,
-        server_config: ServerConfig,
-    },
-    Tailnet {
-        identity: RuntimeIdentity,
-        server_config: ServerConfig,
-        helper: Arc<TailscaleHelperProcess>,
-        shutdown_helper_on_stop: bool,
-        packet_bridge: TailnetPacketBridge,
-        tun_task: Option<JoinHandle<Result<()>>>,
-    },
-    WireGuard {
-        identity: RuntimeIdentity,
-        server_config: ServerConfig,
-        interface: Arc<RwLock<WireGuardInterface>>,
-        task: JoinHandle<Result<()>>,
-    },
-}
-
-impl ActiveTunnel {
-    pub fn identity(&self) -> &RuntimeIdentity {
-        match self {
-            Self::Passthrough { identity, .. }
-            | Self::Tailnet { identity, .. }
-            | Self::WireGuard { identity, .. } => identity,
-        }
-    }
-
-    pub fn server_config(&self) -> &ServerConfig {
-        match self {
-            Self::Passthrough { server_config, .. }
-            | Self::Tailnet { server_config, .. }
-            | Self::WireGuard { server_config, .. } => server_config,
-        }
-    }
-
-    pub fn packet_stream(
-        &self,
-    ) -> Option<(mpsc::Sender<Vec<u8>>, broadcast::Receiver<Vec<u8>>)> {
-        match self {
-            Self::Tailnet { packet_bridge, .. } => Some((
-                packet_bridge.outbound_sender(),
-                packet_bridge.subscribe(),
-            )),
-            _ => None,
-        }
-    }
-
-    pub async fn shutdown(self, tun_interface: &Arc<RwLock<Option<TunInterface>>>) -> Result<()> {
-        match self {
-            Self::Passthrough { .. } => Ok(()),
-            Self::Tailnet {
-                helper,
-                shutdown_helper_on_stop,
-                packet_bridge,
-                tun_task,
-                ..
-            } => {
-                if let Some(tun_task) = tun_task {
-                    tun_task.abort();
-                    match tun_task.await {
-                        Ok(Ok(())) => {}
-                        Ok(Err(err)) => return Err(err),
-                        Err(err) if err.is_cancelled() => {}
-                        Err(err) => return Err(err.into()),
-                    }
-                }
-                packet_bridge.task.abort();
-                match packet_bridge.task.await {
-                    Ok(Ok(())) => {}
-                    Ok(Err(err)) => return Err(err),
-                    Err(err) if err.is_cancelled() => {}
-                    Err(err) => return Err(err.into()),
-                }
-                tun_interface.write().await.take();
-                if shutdown_helper_on_stop {
-                    helper.shutdown().await?;
-                }
-                Ok(())
-            }
-            Self::WireGuard {
-                interface,
-                task,
-                ..
-            } => {
-                interface.read().await.remove_tun().await;
-                let task_result = task.await;
-                tun_interface.write().await.take();
-                task_result??;
-                Ok(())
-            }
-        }
-    }
-}
-
-pub struct TailnetPacketBridge {
-    outbound: mpsc::Sender<Vec<u8>>,
-    inbound: broadcast::Sender<Vec<u8>>,
-    task: JoinHandle<Result<()>>,
-}
-
-impl TailnetPacketBridge {
-    fn outbound_sender(&self) -> mpsc::Sender<Vec<u8>> {
-        self.outbound.clone()
-    }
-
-    fn subscribe(&self) -> broadcast::Receiver<Vec<u8>> {
-        self.inbound.subscribe()
-    }
-}
-
-async fn start_wireguard_runtime(
-    config: Config,
-    tun_interface: Arc<RwLock<Option<TunInterface>>>,
-) -> Result<(Arc<RwLock<WireGuardInterface>>, JoinHandle<Result<()>>)> {
-    let mut interface: WireGuardInterface = config.try_into()?;
-    interface.set_tun_ref(tun_interface).await;
-    let interface = Arc::new(RwLock::new(interface));
-    let run_interface = interface.clone();
-    let task = tokio::spawn(async move {
-        let guard = run_interface.read().await;
-        guard.run().await
-    });
-    Ok((interface, task))
-}
-
-pub(crate) fn tailnet_helper_request(
-    identity: &RuntimeIdentity,
-    config: &TailnetConfig,
-) -> TailscaleLoginStartRequest {
-    let account_name = config
-        .account
-        .as_deref()
-        .filter(|value| !value.trim().is_empty())
-        .unwrap_or("default")
-        .to_owned();
-    let identity_name = config
-        .identity
-        .as_deref()
-        .filter(|value| !value.trim().is_empty())
-        .map(ToOwned::to_owned)
-        .unwrap_or_else(|| match identity {
-            RuntimeIdentity::Network { id, .. } => format!("network-{id}"),
-            RuntimeIdentity::Passthrough => "apple".to_owned(),
-        });
-    let control_url = config.authority.as_deref().and_then(|authority| {
-        let authority = discovery::normalize_authority(authority);
-        (!discovery::is_managed_tailscale_authority(&authority)).then_some(authority)
-    });
-
-    let mut request = TailscaleLoginStartRequest {
-        account_name,
-        identity_name,
-        hostname: config.hostname.clone(),
-        control_url,
-        packet_socket: None,
-    };
-    request.packet_socket = Some(packet_socket_path(&request).display().to_string());
-    if request
-        .hostname
-        .as_deref()
-        .map(|value| value.trim().is_empty())
-        .unwrap_or(true)
-    {
-        request.hostname = Some(default_hostname(&request));
-    }
-    request
-}
-
-async fn wait_for_tailnet_ready(helper: &TailscaleHelperProcess) -> Result<TailscaleLoginStatus> {
-    let mut last_status = None;
-    for _ in 0..120 {
-        let status = helper.status().await?;
-        if status.running && !status.tailscale_ips.is_empty() {
-            return Ok(status);
-        }
-        if status.needs_login || status.auth_url.is_some() {
-            bail!("tailnet runtime requires a completed login before the tunnel can start");
-        }
-        last_status = Some(status);
-        sleep(Duration::from_millis(250)).await;
-    }
-
-    if let Some(status) = last_status {
-        bail!(
-            "tailnet helper never became ready (backend_state={})",
-            status.backend_state
-        );
-    }
-    bail!("tailnet helper never produced a status update")
-}
-
-fn tailnet_server_config(status: &TailscaleLoginStatus) -> ServerConfig {
-    let mut search_domains = Vec::new();
-    if let Some(suffix) = status.magic_dns_suffix.as_deref() {
-        let suffix = suffix.trim().trim_end_matches('.');
-        if !suffix.is_empty() {
-            search_domains.push(suffix.to_owned());
-        }
-    }
-
-    ServerConfig {
-        address: status
-            .tailscale_ips
-            .iter()
-            .map(|ip| tailnet_cidr(ip))
-            .collect(),
-        routes: tailnet_routes(),
-        dns_servers: tailnet_dns_servers(),
-        search_domains,
-        include_default_route: false,
-        name: status.self_dns_name.clone(),
-        mtu: Some(1280),
-    }
-}
-
-fn tailnet_routes() -> Vec<String> {
-    vec!["100.64.0.0/10".to_owned(), "fd7a:115c:a1e0::/48".to_owned()]
-}
-
-fn tailnet_dns_servers() -> Vec<String> {
-    vec!["100.100.100.100".to_owned()]
-}
-
-fn tailnet_cidr(ip: &str) -> String {
-    if ip.contains('/') {
-        return ip.to_owned();
-    }
-    if ip.contains(':') {
-        format!("{ip}/128")
-    } else {
-        format!("{ip}/32")
-    }
-}
-
-async fn connect_tailnet_packet_bridge(packet_socket: PathBuf) -> Result<TailnetPacketBridge> {
-    let mut last_error = None;
-    let mut stream = None;
-    for _ in 0..50 {
-        match UnixStream::connect(&packet_socket).await {
-            Ok(connected) => {
-                stream = Some(connected);
-                break;
-            }
-            Err(err) => {
-                last_error = Some(err);
-                sleep(Duration::from_millis(100)).await;
-            }
-        }
-    }
-    let stream = if let Some(stream) = stream {
-        stream
-    } else {
-        return Err(last_error
-            .context("failed to connect to tailnet helper packet socket")?
-            .into());
-    };
-
-    let (outbound_tx, outbound_rx) = mpsc::channel(128);
-    let (inbound_tx, _) = broadcast::channel(128);
-    let task = tokio::spawn(run_tailnet_socket_bridge(
-        stream,
-        outbound_rx,
-        inbound_tx.clone(),
-    ));
-
-    Ok(TailnetPacketBridge {
-        outbound: outbound_tx,
-        inbound: inbound_tx,
-        task,
-    })
-}
-
-async fn run_tailnet_socket_bridge(
-    stream: UnixStream,
-    mut outbound_rx: mpsc::Receiver<Vec<u8>>,
-    inbound_tx: broadcast::Sender<Vec<u8>>,
-) -> Result<()> {
-    let (mut reader, mut writer) = stream.into_split();
-
-    let inbound = tokio::spawn(async move {
-        loop {
-            let packet = read_packet_frame(&mut reader).await?;
-            tracing::debug!(
-                "tailnet packet bridge received {} bytes from helper socket",
-                packet.len()
-            );
-            let _ = inbound_tx.send(packet);
-        }
-        #[allow(unreachable_code)]
-        Result::<()>::Ok(())
-    });
-
-    let outbound = tokio::spawn(async move {
-        while let Some(packet) = outbound_rx.recv().await {
-            tracing::debug!(
-                "tailnet packet bridge writing {} bytes to helper socket",
-                packet.len()
-            );
-            write_packet_frame(&mut writer, &packet).await?;
-        }
-        Result::<()>::Ok(())
-    });
-
-    let (inbound_result, outbound_result) = tokio::try_join!(inbound, outbound)?;
-    inbound_result?;
-    outbound_result?;
-    Ok(())
-}
-
-#[cfg(not(target_vendor = "apple"))]
-async fn run_tailnet_tun_bridge(
-    tun_interface: Arc<RwLock<Option<TunInterface>>>,
-    outbound_tx: mpsc::Sender<Vec<u8>>,
-    mut inbound_rx: broadcast::Receiver<Vec<u8>>,
-) -> Result<()> {
-    let inbound_tun = tun_interface.clone();
-    let inbound = tokio::spawn(async move {
-        loop {
-            let packet = match inbound_rx.recv().await {
-                Ok(packet) => packet,
-                Err(broadcast::error::RecvError::Lagged(_)) => continue,
-                Err(broadcast::error::RecvError::Closed) => break,
-            };
-            let guard = inbound_tun.read().await;
-            let Some(tun) = guard.as_ref() else {
-                bail!("tailnet tun interface unavailable");
-            };
-            tun.send(&packet)
-                .await
-                .context("failed to write tailnet packet to tun")?;
-        }
-        Result::<()>::Ok(())
-    });
-
-    let outbound_tun = tun_interface.clone();
-    let outbound = tokio::spawn(async move {
-        let mut buf = vec![0u8; 65_535];
-        loop {
-            let len = {
-                let guard = outbound_tun.read().await;
-                let Some(tun) = guard.as_ref() else {
-                    bail!("tailnet tun interface unavailable");
-                };
-                tun.recv(&mut buf)
-                    .await
-                    .context("failed to read packet from tailnet tun")?
-            };
-            outbound_tx
-                .send(buf[..len].to_vec())
-                .await
-                .context("failed to forward packet to tailnet helper")?;
-        }
-        #[allow(unreachable_code)]
-        Result::<()>::Ok(())
-    });
-
-    let (inbound_result, outbound_result) = tokio::try_join!(inbound, outbound)?;
-    inbound_result?;
-    outbound_result?;
-    Ok(())
-}
-
-async fn read_packet_frame<R>(reader: &mut R) -> Result<Vec<u8>>
-where
-    R: AsyncRead + Unpin,
-{
-    let mut len_buf = [0u8; 4];
-    reader
-        .read_exact(&mut len_buf)
-        .await
-        .context("failed to read tailnet packet frame length")?;
-    let len = u32::from_be_bytes(len_buf) as usize;
-    let mut packet = vec![0u8; len];
-    reader
-        .read_exact(&mut packet)
-        .await
-        .context("failed to read tailnet packet frame payload")?;
-    Ok(packet)
-}
-
-async fn write_packet_frame<W>(writer: &mut W, packet: &[u8]) -> Result<()>
-where
-    W: AsyncWrite + Unpin,
-{
-    writer
-        .write_all(&(packet.len() as u32).to_be_bytes())
-        .await
-        .context("failed to write tailnet packet frame length")?;
-    writer
-        .write_all(packet)
-        .await
-        .context("failed to write tailnet packet frame payload")?;
-    writer
-        .flush()
-        .await
-        .context("failed to flush tailnet packet frame")
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn no_networks_resolve_to_passthrough() {
-        let resolved = ResolvedTunnel::from_networks(&[]).unwrap();
-        assert_eq!(resolved.identity(), &RuntimeIdentity::Passthrough);
-        assert_eq!(
-            resolved.server_config().unwrap().address,
-            Vec::<String>::new()
-        );
-    }
-
-    #[test]
-    fn tailnet_server_config_uses_host_prefixes() {
-        let status = TailscaleLoginStatus {
-            running: true,
-            tailscale_ips: vec!["100.101.102.103".to_owned(), "fd7a:115c:a1e0::123".to_owned()],
-            ..Default::default()
-        };
-        let config = tailnet_server_config(&status);
-        assert_eq!(
-            config.address,
-            vec!["100.101.102.103/32", "fd7a:115c:a1e0::123/128"]
-        );
-        assert_eq!(config.mtu, Some(1280));
-    }
-}
diff --git a/burrow/src/daemon/snapshots/burrow__daemon__command__daemoncommand_serialization-2.snap b/burrow/src/daemon/snapshots/burrow__daemon__command__daemoncommand_serialization-2.snap
index f78eeaa..0eb9096 100644
--- a/burrow/src/daemon/snapshots/burrow__daemon__command__daemoncommand_serialization-2.snap
+++ b/burrow/src/daemon/snapshots/burrow__daemon__command__daemoncommand_serialization-2.snap
@@ -2,4 +2,4 @@
 source: burrow/src/daemon/command.rs
 expression: "serde_json::to_string(&DaemonCommand::Start(DaemonStartOptions {\n                    tun: TunOptions { ..TunOptions::default() },\n                })).unwrap()"
 ---
-{"Start":{"tun":{"name":null,"no_pi":false,"tun_excl":false,"tun_retrieve":false,"address":[]}}}
+{"Start":{"tun":{"name":null,"no_pi":false,"tun_excl":false,"tun_retrieve":false,"address":null}}}
diff --git a/burrow/src/daemon/snapshots/burrow__daemon__command__daemoncommand_serialization.snap b/burrow/src/daemon/snapshots/burrow__daemon__command__daemoncommand_serialization.snap
index eee563d..bfd5117 100644
--- a/burrow/src/daemon/snapshots/burrow__daemon__command__daemoncommand_serialization.snap
+++ b/burrow/src/daemon/snapshots/burrow__daemon__command__daemoncommand_serialization.snap
@@ -2,4 +2,4 @@
 source: burrow/src/daemon/command.rs
 expression: "serde_json::to_string(&DaemonCommand::Start(DaemonStartOptions::default())).unwrap()"
 ---
-{"Start":{"tun":{"name":null,"no_pi":false,"tun_excl":false,"tun_retrieve":false,"address":[]}}}
+{"Start":{"tun":{"name":null,"no_pi":false,"tun_excl":false,"tun_retrieve":false,"address":null}}}
diff --git a/burrow/src/daemon/snapshots/burrow__daemon__response__response_serialization-2.snap b/burrow/src/daemon/snapshots/burrow__daemon__response__response_serialization-2.snap
index 20988bf..3787cd1 100644
--- a/burrow/src/daemon/snapshots/burrow__daemon__response__response_serialization-2.snap
+++ b/burrow/src/daemon/snapshots/burrow__daemon__response__response_serialization-2.snap
@@ -1,5 +1,5 @@
 ---
 source: burrow/src/daemon/response.rs
-expression: "serde_json::to_string(&DaemonResponse::new(Ok::<DaemonResponseData,\n                        String>(DaemonResponseData::ServerInfo(ServerInfo {\n                            name: Some(\"burrow\".to_string()),\n                            ip: None,\n                            ipv6: Vec::new(),\n                            mtu: Some(1500),\n                        }))))?"
+expression: "serde_json::to_string(&DaemonResponse::new(Ok::<DaemonResponseData,\n                        String>(DaemonResponseData::ServerInfo(ServerInfo {\n                            name: Some(\"burrow\".to_string()),\n                            ip: None,\n                            mtu: Some(1500),\n                        }))))?"
 ---
-{"result":{"Ok":{"ServerInfo":{"name":"burrow","ip":null,"ipv6":[],"mtu":1500}}},"id":0}
+{"result":{"Ok":{"ServerInfo":{"name":"burrow","ip":null,"mtu":1500}}},"id":0}
diff --git a/burrow/src/daemon/snapshots/burrow__daemon__response__response_serialization-4.snap b/burrow/src/daemon/snapshots/burrow__daemon__response__response_serialization-4.snap
index 0b9385c..9752ebc 100644
--- a/burrow/src/daemon/snapshots/burrow__daemon__response__response_serialization-4.snap
+++ b/burrow/src/daemon/snapshots/burrow__daemon__response__response_serialization-4.snap
@@ -2,4 +2,4 @@
 source: burrow/src/daemon/response.rs
 expression: "serde_json::to_string(&DaemonResponse::new(Ok::<DaemonResponseData,\n                        String>(DaemonResponseData::ServerConfig(ServerConfig::default()))))?"
 ---
-{"result":{"Ok":{"ServerConfig":{"address":["10.13.13.2"],"name":null,"mtu":null}}},"id":0}
+{"result":{"Ok":{"ServerConfig":{"address":"10.13.13.2","name":null,"mtu":null}}},"id":0}
diff --git a/burrow/src/database.rs b/burrow/src/database.rs
deleted file mode 100644
index fe9a3c7..0000000
--- a/burrow/src/database.rs
+++ /dev/null
@@ -1,409 +0,0 @@
-use std::path::Path;
-
-use anyhow::Result;
-use rusqlite::{params, Connection};
-
-use crate::{
-    control::TailnetConfig,
-    daemon::rpc::grpc_defs::{
-        Network as RPCNetwork, NetworkDeleteRequest, NetworkReorderRequest, NetworkType,
-    },
-    wireguard::config::{Config, Interface, Peer},
-};
-
-#[cfg(target_vendor = "apple")]
-const DB_PATH: &str = "burrow.db";
-
-#[cfg(not(target_vendor = "apple"))]
-const DB_PATH: &str = "/var/lib/burrow/burrow.db";
-
-const CREATE_WG_INTERFACE_TABLE: &str = "CREATE TABLE IF NOT EXISTS wg_interface (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    name TEXT,
-    listen_port INTEGER,
-    mtu INTEGER,
-    private_key TEXT NOT NULL,
-    address TEXT NOT NULL,
-    dns TEXT NOT NULL
-)";
-
-const CREATE_WG_PEER_TABLE: &str = "CREATE TABLE IF NOT EXISTS wg_peer (
-    interface_id INT REFERENCES wg_interface(id) ON UPDATE CASCADE,
-    endpoint TEXT NOT NULL,
-    public_key TEXT NOT NULL,
-    allowed_ips TEXT NOT NULL,
-    preshared_key TEXT
-)";
-
-const CREATE_NETWORK_TABLE: &str = "CREATE TABLE IF NOT EXISTS network (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    type TEXT NOT NULL,
-    payload BLOB,
-    idx INTEGER,
-    interface_id INT REFERENCES wg_interface(id) ON UPDATE CASCADE
-);
-CREATE TRIGGER IF NOT EXISTS increment_network_idx
-AFTER INSERT ON network
-BEGIN
-    UPDATE network
-    SET idx = (SELECT COALESCE(MAX(idx), 0) + 1 FROM network)
-    WHERE id = NEW.id;
-END;
-";
-
-pub fn initialize_tables(conn: &Connection) -> Result<()> {
-    conn.execute(CREATE_WG_INTERFACE_TABLE, [])?;
-    conn.execute(CREATE_WG_PEER_TABLE, [])?;
-    conn.execute_batch(CREATE_NETWORK_TABLE)?;
-    Ok(())
-}
-
-pub fn load_interface(conn: &Connection, interface_id: &str) -> Result<Config> {
-    let iface = conn.query_row(
-        "SELECT private_key, dns, address, listen_port, mtu FROM wg_interface WHERE id = ?",
-        [&interface_id],
-        |row| {
-            let dns_rw: String = row.get(1)?;
-            let dns = parse_lst(&dns_rw);
-            let address_rw: String = row.get(2)?;
-            let address = parse_lst(&address_rw);
-            Ok(Interface {
-                private_key: row.get(0)?,
-                dns,
-                address,
-                mtu: row.get(4)?,
-                listen_port: row.get(3)?,
-            })
-        },
-    )?;
-    let mut peers_stmt = conn.prepare("SELECT public_key, preshared_key, allowed_ips, endpoint FROM wg_peer WHERE interface_id = ?")?;
-    let peers = peers_stmt
-        .query_map([&interface_id], |row| {
-            let preshared_key: Option<String> = row.get(1)?;
-            let allowed_ips_rw: String = row.get(2)?;
-            let allowed_ips: Vec<String> =
-                allowed_ips_rw.split(',').map(|s| s.to_string()).collect();
-            Ok(Peer {
-                public_key: row.get(0)?,
-                preshared_key,
-                allowed_ips,
-                endpoint: row.get(3)?,
-                persistent_keepalive: None,
-                name: None,
-            })
-        })?
-        .collect::<rusqlite::Result<Vec<Peer>>>()?;
-    Ok(Config { interface: iface, peers })
-}
-
-pub fn dump_interface(conn: &Connection, config: &Config) -> Result<()> {
-    let mut stmt = conn.prepare("INSERT INTO wg_interface (private_key, dns, address, listen_port, mtu) VALUES (?, ?, ?, ?, ?)")?;
-    let cif = &config.interface;
-    stmt.execute(params![
-        cif.private_key,
-        to_lst(&cif.dns),
-        to_lst(&cif.address),
-        cif.listen_port.unwrap_or(51820),
-        cif.mtu
-    ])?;
-    let interface_id = conn.last_insert_rowid();
-    let mut stmt = conn.prepare("INSERT INTO wg_peer (interface_id, public_key, preshared_key, allowed_ips, endpoint) VALUES (?, ?, ?, ?, ?)")?;
-    for peer in &config.peers {
-        stmt.execute(params![
-            &interface_id,
-            &peer.public_key,
-            &peer.preshared_key,
-            &peer.allowed_ips.join(","),
-            &peer.endpoint
-        ])?;
-    }
-    Ok(())
-}
-
-pub fn get_connection(path: Option<&Path>) -> Result<Connection> {
-    let p = path.unwrap_or_else(|| std::path::Path::new(DB_PATH));
-    let conn = Connection::open(p)?;
-    initialize_tables(&conn)?;
-    Ok(conn)
-}
-
-pub fn add_network(conn: &Connection, network: &RPCNetwork) -> Result<()> {
-    validate_network_payload(network)?;
-    let mut stmt = conn.prepare("INSERT INTO network (id, type, payload) VALUES (?, ?, ?)")?;
-    stmt.execute(params![
-        network.id,
-        network.r#type().as_str_name(),
-        &network.payload
-    ])?;
-    Ok(())
-}
-
-pub fn list_networks(conn: &Connection) -> Result<Vec<RPCNetwork>> {
-    let mut stmt = conn.prepare("SELECT id, type, payload FROM network ORDER BY idx, id")?;
-    let networks: Vec<RPCNetwork> = stmt
-        .query_map([], |row| {
-            let network_id: i32 = row.get(0)?;
-            let network_type: String = row.get(1)?;
-            let network_type = NetworkType::from_str_name(network_type.as_str())
-                .ok_or(rusqlite::Error::InvalidQuery)?;
-            let payload: Vec<u8> = row.get(2)?;
-            Ok(RPCNetwork {
-                id: network_id,
-                r#type: network_type.into(),
-                payload: payload.into(),
-            })
-        })?
-        .collect::<Result<Vec<RPCNetwork>, rusqlite::Error>>()?;
-    Ok(networks)
-}
-
-pub fn reorder_network(conn: &Connection, req: NetworkReorderRequest) -> Result<()> {
-    let mut ordered_ids = ordered_network_ids(conn)?;
-    let Some(current_idx) = ordered_ids.iter().position(|id| *id == req.id) else {
-        return Err(anyhow::anyhow!("No such network exists"));
-    };
-
-    let target_idx = usize::try_from(req.index)
-        .map_err(|_| anyhow::anyhow!("Network index must be non-negative"))?;
-
-    let moved_id = ordered_ids.remove(current_idx);
-    let target_idx = target_idx.min(ordered_ids.len());
-    ordered_ids.insert(target_idx, moved_id);
-
-    renumber_networks(conn, &ordered_ids)
-}
-
-pub fn delete_network(conn: &Connection, req: NetworkDeleteRequest) -> Result<()> {
-    let mut stmt = conn.prepare("DELETE FROM network WHERE id = ?")?;
-    let res = stmt.execute(params![req.id])?;
-    if res == 0 {
-        return Err(anyhow::anyhow!("No such network exists"));
-    }
-    let ordered_ids = ordered_network_ids(conn)?;
-    renumber_networks(conn, &ordered_ids)
-}
-
-fn parse_lst(s: &str) -> Vec<String> {
-    if s.is_empty() {
-        return vec![];
-    }
-    s.split(',').map(|s| s.to_string()).collect()
-}
-
-fn to_lst<T: ToString>(v: &Vec<T>) -> String {
-    v.iter()
-        .map(|s| s.to_string())
-        .collect::<Vec<String>>()
-        .join(",")
-}
-
-fn validate_network_payload(network: &RPCNetwork) -> Result<()> {
-    match network.r#type() {
-        NetworkType::WireGuard => {
-            let payload_str = String::from_utf8(network.payload.clone())?;
-            Config::from_content_fmt(&payload_str, "ini")?;
-        }
-        NetworkType::Tailnet => {
-            TailnetConfig::from_slice(&network.payload)?;
-        }
-    }
-    Ok(())
-}
-
-fn ordered_network_ids(conn: &Connection) -> Result<Vec<i32>> {
-    let mut stmt = conn.prepare("SELECT id FROM network ORDER BY idx, id")?;
-    let ids = stmt
-        .query_map([], |row| row.get::<_, i32>(0))?
-        .collect::<rusqlite::Result<Vec<i32>>>()?;
-    Ok(ids)
-}
-
-fn renumber_networks(conn: &Connection, ordered_ids: &[i32]) -> Result<()> {
-    conn.execute_batch("BEGIN IMMEDIATE")?;
-    let result = (|| -> Result<()> {
-        let mut stmt = conn.prepare("UPDATE network SET idx = ? WHERE id = ?")?;
-        for (idx, id) in ordered_ids.iter().enumerate() {
-            stmt.execute(params![idx as i32, id])?;
-        }
-        Ok(())
-    })();
-
-    match result {
-        Ok(()) => {
-            conn.execute_batch("COMMIT")?;
-            Ok(())
-        }
-        Err(err) => {
-            let _ = conn.execute_batch("ROLLBACK");
-            Err(err)
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tempfile::tempdir;
-
-    fn sample_wireguard_payload() -> Vec<u8> {
-        br#"[Interface]
-PrivateKey = OEPVdomeLTxTIBvv3TYsJRge0Hp9NMiY0sIrhT8OWG8=
-Address = 10.13.13.2/24
-ListenPort = 51820
-
-[Peer]
-PublicKey = 8GaFjVO6c4luCHG4ONO+1bFG8tO+Zz5/Gy+Geht1USM=
-PresharedKey = ha7j4BjD49sIzyF9SNlbueK0AMHghlj6+u0G3bzC698=
-AllowedIPs = 0.0.0.0/0, 8.8.8.8/32
-Endpoint = wg.burrow.rs:51820
-"#
-        .to_vec()
-    }
-
-    fn sample_wireguard_payload_with_address(address: &str, mtu: u16) -> Vec<u8> {
-        format!(
-            "[Interface]\nPrivateKey = OEPVdomeLTxTIBvv3TYsJRge0Hp9NMiY0sIrhT8OWG8=\nAddress = {address}\nListenPort = 51820\nMTU = {mtu}\n\n[Peer]\nPublicKey = 8GaFjVO6c4luCHG4ONO+1bFG8tO+Zz5/Gy+Geht1USM=\nPresharedKey = ha7j4BjD49sIzyF9SNlbueK0AMHghlj6+u0G3bzC698=\nAllowedIPs = 0.0.0.0/0\nEndpoint = wg.burrow.rs:51820\n"
-        )
-        .into_bytes()
-    }
-
-    fn sample_tailnet_payload() -> Vec<u8> {
-        br#"{
-  "provider":"tailscale",
-  "account":"default",
-  "identity":"apple",
-  "tailnet":"example.ts.net",
-  "hostname":"burrow-phone"
-}"#
-        .to_vec()
-    }
-
-    #[test]
-    fn test_db() {
-        let conn = Connection::open_in_memory().unwrap();
-        initialize_tables(&conn).unwrap();
-        let config = Config::default();
-        dump_interface(&conn, &config).unwrap();
-        let loaded = load_interface(&conn, "1").unwrap();
-        assert_eq!(config, loaded);
-    }
-
-    #[test]
-    fn add_network_validates_payloads() {
-        let conn = Connection::open_in_memory().unwrap();
-        initialize_tables(&conn).unwrap();
-
-        add_network(
-            &conn,
-            &RPCNetwork {
-                id: 1,
-                r#type: NetworkType::WireGuard.into(),
-                payload: sample_wireguard_payload(),
-            },
-        )
-        .unwrap();
-
-        add_network(
-            &conn,
-            &RPCNetwork {
-                id: 2,
-                r#type: NetworkType::Tailnet.into(),
-                payload: sample_tailnet_payload(),
-            },
-        )
-        .unwrap();
-
-        add_network(
-            &conn,
-            &RPCNetwork {
-                id: 3,
-                r#type: NetworkType::WireGuard.into(),
-                payload: sample_wireguard_payload_with_address("10.42.0.2/32", 1380),
-            },
-        )
-        .unwrap();
-
-        assert!(add_network(
-            &conn,
-            &RPCNetwork {
-                id: 4,
-                r#type: NetworkType::WireGuard.into(),
-                payload: b"not-a-config".to_vec(),
-            },
-        )
-        .is_err());
-
-        assert!(add_network(
-            &conn,
-            &RPCNetwork {
-                id: 5,
-                r#type: NetworkType::Tailnet.into(),
-                payload: b"not-a-tailnet-config".to_vec(),
-            },
-        )
-        .is_err());
-
-        let ids: Vec<i32> = list_networks(&conn)
-            .unwrap()
-            .into_iter()
-            .map(|n| n.id)
-            .collect();
-        assert_eq!(ids, vec![1, 2, 3]);
-    }
-
-    #[test]
-    fn reorder_and_delete_networks_keep_priority_stable() {
-        let conn = Connection::open_in_memory().unwrap();
-        initialize_tables(&conn).unwrap();
-
-        for (id, address, mtu) in [
-            (1, "10.42.0.2/32", 1380),
-            (2, "10.42.0.3/32", 1381),
-            (3, "10.42.0.4/32", 1382),
-        ] {
-            add_network(
-                &conn,
-                &RPCNetwork {
-                    id,
-                    r#type: NetworkType::WireGuard.into(),
-                    payload: sample_wireguard_payload_with_address(address, mtu),
-                },
-            )
-            .unwrap();
-        }
-
-        reorder_network(&conn, NetworkReorderRequest { id: 3, index: 0 }).unwrap();
-        let ids: Vec<i32> = list_networks(&conn)
-            .unwrap()
-            .into_iter()
-            .map(|n| n.id)
-            .collect();
-        assert_eq!(ids, vec![3, 1, 2]);
-
-        delete_network(&conn, NetworkDeleteRequest { id: 1 }).unwrap();
-        let ids: Vec<i32> = list_networks(&conn)
-            .unwrap()
-            .into_iter()
-            .map(|n| n.id)
-            .collect();
-        assert_eq!(ids, vec![3, 2]);
-    }
-
-    #[test]
-    fn get_connection_does_not_seed_a_default_interface() {
-        let dir = tempdir().unwrap();
-        let db_path = dir.path().join("burrow.sqlite3");
-
-        let conn = get_connection(Some(db_path.as_path())).unwrap();
-
-        let interface_count: i64 = conn
-            .query_row("SELECT COUNT(*) FROM wg_interface", [], |row| row.get(0))
-            .unwrap();
-        let network_count: i64 = conn
-            .query_row("SELECT COUNT(*) FROM network", [], |row| row.get(0))
-            .unwrap();
-
-        assert_eq!(interface_count, 0);
-        assert_eq!(network_count, 0);
-    }
-}
diff --git a/burrow/src/lib.rs b/burrow/src/lib.rs
index 7867d18..c5406b2 100644
--- a/burrow/src/lib.rs
+++ b/burrow/src/lib.rs
@@ -1,25 +1,18 @@
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-pub mod control;
-
 #[cfg(any(target_os = "linux", target_vendor = "apple"))]
 pub mod wireguard;
 
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-mod auth;
 #[cfg(any(target_os = "linux", target_vendor = "apple"))]
 mod daemon;
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-pub mod database;
-#[cfg(target_os = "linux")]
-pub mod tor;
 pub(crate) mod tracing;
-#[cfg(target_os = "linux")]
-pub mod usernet;
 
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-pub use daemon::apple::{spawn_in_process, spawn_in_process_with_paths};
+#[cfg(target_vendor = "apple")]
+pub use daemon::apple::spawn_in_process;
 #[cfg(any(target_os = "linux", target_vendor = "apple"))]
 pub use daemon::{
-    rpc::grpc_defs, rpc::BurrowClient, rpc::DaemonResponse, rpc::ServerInfo, DaemonClient,
-    DaemonCommand, DaemonResponseData, DaemonStartOptions,
+    DaemonClient,
+    DaemonCommand,
+    DaemonResponse,
+    DaemonResponseData,
+    DaemonStartOptions,
+    ServerInfo,
 };
diff --git a/burrow/src/main.rs b/burrow/src/main.rs
index 30c5960..79bb70b 100644
--- a/burrow/src/main.rs
+++ b/burrow/src/main.rs
@@ -1,8 +1,6 @@
 use anyhow::Result;
 use clap::{Args, Parser, Subcommand};
 
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-mod control;
 #[cfg(any(target_os = "linux", target_vendor = "apple"))]
 mod daemon;
 pub(crate) mod tracing;
@@ -10,24 +8,12 @@ pub(crate) mod tracing;
 mod wireguard;
 
 #[cfg(any(target_os = "linux", target_vendor = "apple"))]
-mod auth;
-#[cfg(target_os = "linux")]
-mod tor;
-#[cfg(target_os = "linux")]
-mod usernet;
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-use daemon::{DaemonClient, DaemonCommand};
+use daemon::{DaemonClient, DaemonCommand, DaemonStartOptions};
+use tun::TunOptions;
 
 #[cfg(any(target_os = "linux", target_vendor = "apple"))]
 use crate::daemon::DaemonResponseData;
 
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-pub mod database;
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-use crate::daemon::rpc::{grpc_defs::Empty, BurrowClient};
-
 #[derive(Parser)]
 #[command(name = "Burrow")]
 #[command(author = "Hack Club <team@hackclub.com>")]
@@ -35,8 +21,8 @@ use crate::daemon::rpc::{grpc_defs::Empty, BurrowClient};
 #[command(
     about = "Burrow is a tool for burrowing through firewalls, built by teenagers at Hack Club.",
     long_about = "Burrow is a 🚀 blazingly fast 🚀 tool designed to penetrate unnecessarily restrictive firewalls, providing teenagers worldwide with secure, less-filtered, and safe access to the internet!
-It's being built by teenagers from Hack Club, in public! Check it out: https://git.burrow.net/hackclub/burrow
-Spotted a bug? Please open an issue on the Burrow forge."
+It's being built by teenagers from Hack Club, in public! Check it out: https://github.com/hackclub/burrow
+Spotted a bug? Please open an issue! https://github.com/hackclub/burrow/issues/new"
 )]
 
 struct Cli {
@@ -56,42 +42,6 @@ enum Commands {
     ServerInfo,
     /// Server config
     ServerConfig,
-    /// Reload Config
-    ReloadConfig(ReloadConfigArgs),
-    /// Authentication server
-    AuthServer,
-    /// Server Status
-    ServerStatus,
-    /// Tunnel Config
-    TunnelConfig,
-    /// Add Network
-    NetworkAdd(NetworkAddArgs),
-    /// List Networks
-    NetworkList,
-    /// Reorder Network
-    NetworkReorder(NetworkReorderArgs),
-    /// Delete Network
-    NetworkDelete(NetworkDeleteArgs),
-    /// Discover a Tailnet authority through the daemon
-    TailnetDiscover(TailnetDiscoverArgs),
-    /// Probe a Tailnet authority through the daemon
-    TailnetProbe(TailnetProbeArgs),
-    /// Send an ICMP echo probe through the active Tailnet tunnel over daemon packet streaming
-    TailnetPing(TailnetPingArgs),
-    /// Send a UDP echo probe through the active Tailnet tunnel over daemon packet streaming
-    TailnetUdpEcho(TailnetUdpEchoArgs),
-    #[cfg(target_os = "linux")]
-    /// Run a command in an unshared Linux namespace using a Burrow backend
-    Exec(ExecArgs),
-    #[cfg(target_os = "linux")]
-    /// Run a command in a Linux user namespace with Tor-backed networking
-    TorExec(TorExecArgs),
-}
-
-#[derive(Args)]
-struct ReloadConfigArgs {
-    #[clap(long, short)]
-    interface_id: String,
 }
 
 #[derive(Args)]
@@ -100,600 +50,32 @@ struct StartArgs {}
 #[derive(Args)]
 struct DaemonArgs {}
 
-#[derive(Args)]
-struct NetworkAddArgs {
-    id: i32,
-    network_type: i32,
-    payload_path: String,
-}
-
-#[derive(Args)]
-struct NetworkReorderArgs {
-    id: i32,
-    index: i32,
-}
-
-#[derive(Args)]
-struct NetworkDeleteArgs {
-    id: i32,
-}
-
-#[derive(Args)]
-struct TailnetDiscoverArgs {
-    email: String,
-}
-
-#[derive(Args)]
-struct TailnetProbeArgs {
-    authority: String,
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-#[derive(Args)]
-struct TailnetPingArgs {
-    remote: String,
-    #[arg(long, default_value = "burrow-tailnet-smoke")]
-    payload: String,
-    #[arg(long, default_value_t = 5000)]
-    timeout_ms: u64,
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-#[derive(Args)]
-struct TailnetUdpEchoArgs {
-    remote: String,
-    #[arg(long, default_value = "burrow-tailnet-smoke")]
-    message: String,
-    #[arg(long, default_value_t = 5000)]
-    timeout_ms: u64,
-}
-
-#[cfg(target_os = "linux")]
-#[derive(Args)]
-struct TorExecArgs {
-    payload_path: String,
-    #[arg(required = true, num_args = 1.., trailing_var_arg = true)]
-    command: Vec<String>,
-}
-
-#[cfg(target_os = "linux")]
-#[derive(Args)]
-struct ExecArgs {
-    #[arg(long, value_enum)]
-    backend: usernet::ExecBackendKind,
-    #[arg(long)]
-    payload: Option<String>,
-    #[arg(required = true, num_args = 1.., trailing_var_arg = true)]
-    command: Vec<String>,
-}
-
 #[cfg(any(target_os = "linux", target_vendor = "apple"))]
 async fn try_start() -> Result<()> {
-    let mut client = BurrowClient::from_uds().await?;
-    let res = client.tunnel_client.tunnel_start(Empty {}).await?;
-    println!("Got results! {:?}", res);
-    Ok(())
+    let mut client = DaemonClient::new().await?;
+    client
+        .send_command(DaemonCommand::Start(DaemonStartOptions {
+            tun: TunOptions::new().address("10.13.13.2"),
+        }))
+        .await
+        .map(|_| ())
 }
 
 #[cfg(any(target_os = "linux", target_vendor = "apple"))]
 async fn try_stop() -> Result<()> {
-    let mut client = BurrowClient::from_uds().await?;
-    let res = client.tunnel_client.tunnel_stop(Empty {}).await?;
-    println!("Got results! {:?}", res);
+    let mut client = DaemonClient::new().await?;
+    client.send_command(DaemonCommand::Stop).await?;
     Ok(())
 }
 
 #[cfg(any(target_os = "linux", target_vendor = "apple"))]
-async fn try_serverstatus() -> Result<()> {
-    let mut client = BurrowClient::from_uds().await?;
-    let mut res = client
-        .tunnel_client
-        .tunnel_status(Empty {})
-        .await?
-        .into_inner();
-    if let Some(st) = res.message().await? {
-        println!("Server Status: {:?}", st);
-    } else {
-        println!("Server Status is None");
-    }
-    Ok(())
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-async fn try_tun_config() -> Result<()> {
-    let mut client = BurrowClient::from_uds().await?;
-    let mut res = client
-        .tunnel_client
-        .tunnel_configuration(Empty {})
-        .await?
-        .into_inner();
-    if let Some(config) = res.message().await? {
-        println!("Tunnel Config: {:?}", config);
-    } else {
-        println!("Tunnel Config is None");
-    }
-    Ok(())
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-async fn try_network_add(id: i32, network_type: i32, payload_path: &str) -> Result<()> {
-    use tokio::{fs::File, io::AsyncReadExt};
-
-    use crate::daemon::rpc::grpc_defs::Network;
-
-    let mut file = File::open(payload_path).await?;
-    let mut payload = Vec::new();
-    file.read_to_end(&mut payload).await?;
-
-    let mut client = BurrowClient::from_uds().await?;
-    let network = Network {
-        id,
-        r#type: network_type,
-        payload,
-    };
-    let res = client.networks_client.network_add(network).await?;
-    println!("Network Add Response: {:?}", res);
-    Ok(())
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-async fn try_network_list() -> Result<()> {
-    let mut client = BurrowClient::from_uds().await?;
-    let mut res = client
-        .networks_client
-        .network_list(Empty {})
-        .await?
-        .into_inner();
-    while let Some(network_list) = res.message().await? {
-        println!("Network List: {:?}", network_list);
-    }
-    Ok(())
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-async fn try_network_reorder(id: i32, index: i32) -> Result<()> {
-    use crate::daemon::rpc::grpc_defs::NetworkReorderRequest;
-
-    let mut client = BurrowClient::from_uds().await?;
-    let reorder_request = NetworkReorderRequest { id, index };
-    let res = client
-        .networks_client
-        .network_reorder(reorder_request)
-        .await?;
-    println!("Network Reorder Response: {:?}", res);
-    Ok(())
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-async fn try_network_delete(id: i32) -> Result<()> {
-    use crate::daemon::rpc::grpc_defs::NetworkDeleteRequest;
-
-    let mut client = BurrowClient::from_uds().await?;
-    let delete_request = NetworkDeleteRequest { id };
-    let res = client
-        .networks_client
-        .network_delete(delete_request)
-        .await?;
-    println!("Network Delete Response: {:?}", res);
-    Ok(())
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-async fn try_tailnet_discover(email: &str) -> Result<()> {
-    let mut client = BurrowClient::from_uds().await?;
-    let response = client
-        .tailnet_client
-        .discover(crate::daemon::rpc::grpc_defs::TailnetDiscoverRequest { email: email.to_owned() })
-        .await?
-        .into_inner();
-    println!("Tailnet Discover Response: {:?}", response);
-    Ok(())
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-async fn try_tailnet_probe(authority: &str) -> Result<()> {
-    let mut client = BurrowClient::from_uds().await?;
-    let response = client
-        .tailnet_client
-        .probe(crate::daemon::rpc::grpc_defs::TailnetProbeRequest {
-            authority: authority.to_owned(),
-        })
-        .await?
-        .into_inner();
-    println!("Tailnet Probe Response: {:?}", response);
-    Ok(())
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-async fn try_tailnet_ping(remote: &str, payload: &str, timeout_ms: u64) -> Result<()> {
-    use std::net::IpAddr;
-
-    use anyhow::Context;
-    use rand::Rng;
-    use tokio::{
-        sync::mpsc,
-        time::{timeout, Duration},
-    };
-    use tokio_stream::wrappers::ReceiverStream;
-
-    use crate::daemon::rpc::grpc_defs::{Empty, TunnelPacket};
-
-    let remote_ip: IpAddr = remote
-        .parse()
-        .with_context(|| format!("invalid remote IP address {remote}"))?;
-    let message = payload.as_bytes().to_vec();
-
-    let mut client = BurrowClient::from_uds().await?;
-    client.tunnel_client.tunnel_start(Empty {}).await?;
-
-    let mut config_stream = client
-        .tunnel_client
-        .tunnel_configuration(Empty {})
-        .await?
-        .into_inner();
-    let config = config_stream
-        .message()
-        .await?
-        .context("tunnel configuration stream ended before yielding a config")?;
-    let local_ip = select_tailnet_local_ip(&config.addresses, remote_ip)?;
-
-    let identifier = rand::thread_rng().gen::<u16>();
-    let sequence = 1_u16;
-    let packet = build_icmp_echo_request(local_ip, remote_ip, identifier, sequence, &message)?;
-
-    let (outbound_tx, outbound_rx) = mpsc::channel::<TunnelPacket>(128);
-    let mut tunnel_packets = client
-        .tunnel_client
-        .tunnel_packets(ReceiverStream::new(outbound_rx))
-        .await?
-        .into_inner();
-
-    outbound_tx
-        .send(TunnelPacket { payload: packet })
-        .await
-        .context("failed to send ICMP echo probe into daemon packet stream")?;
-    log::debug!(
-        "tailnet ping probe queued from {local_ip} to {remote_ip} identifier={identifier} sequence={sequence}"
-    );
-    drop(outbound_tx);
-
-    let reply = timeout(Duration::from_millis(timeout_ms), async {
-        loop {
-            let packet = tunnel_packets
-                .message()
-                .await
-                .context("failed to read packet from daemon packet stream")?
-                .context("daemon packet stream ended before returning a reply")?;
-            log::debug!(
-                "tailnet ping received {} bytes from daemon packet stream",
-                packet.payload.len()
-            );
-            if let Some(reply) =
-                parse_icmp_echo_reply(&packet.payload, local_ip, remote_ip, identifier, sequence)?
-            {
-                break Ok::<_, anyhow::Error>(reply);
-            }
+async fn try_serverinfo() -> Result<()> {
+    let mut client = DaemonClient::new().await?;
+    let res = client.send_command(DaemonCommand::ServerInfo).await?;
+    match res.result {
+        Ok(DaemonResponseData::ServerInfo(si)) => {
+            println!("Got Result! {:?}", si);
         }
-    })
-    .await
-    .with_context(|| format!("timed out waiting for ICMP echo reply from {remote_ip}"))??;
-
-    println!("Tailnet Ping Source: {}", reply.source);
-    println!("Tailnet Ping Destination: {}", reply.destination);
-    println!(
-        "Tailnet Ping Payload: {}",
-        String::from_utf8_lossy(&reply.payload)
-    );
-    Ok(())
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-async fn try_tailnet_udp_echo(remote: &str, message: &str, timeout_ms: u64) -> Result<()> {
-    use std::net::SocketAddr;
-
-    use anyhow::{bail, Context};
-    use futures::{SinkExt, StreamExt};
-    use netstack_smoltcp::StackBuilder;
-    use tokio::{
-        sync::mpsc,
-        time::{timeout, Duration},
-    };
-    use tokio_stream::wrappers::ReceiverStream;
-
-    use crate::daemon::rpc::grpc_defs::{Empty, TunnelPacket};
-
-    let remote_addr: SocketAddr = remote
-        .parse()
-        .with_context(|| format!("invalid remote socket address {remote}"))?;
-
-    let mut client = BurrowClient::from_uds().await?;
-    client.tunnel_client.tunnel_start(Empty {}).await?;
-
-    let mut config_stream = client
-        .tunnel_client
-        .tunnel_configuration(Empty {})
-        .await?
-        .into_inner();
-    let config = config_stream
-        .message()
-        .await?
-        .context("tunnel configuration stream ended before yielding a config")?;
-    let local_addr = select_tailnet_local_socket(&config.addresses, remote_addr.ip())?;
-
-    let (stack, runner, udp_socket, _) = StackBuilder::default()
-        .enable_udp(true)
-        .enable_tcp(true)
-        .build()
-        .context("failed to build userspace UDP stack")?;
-    let runner = runner.context("userspace UDP stack runner unavailable")?;
-    let udp_socket = udp_socket.context("userspace UDP stack socket unavailable")?;
-    let (mut stack_sink, mut stack_stream) = stack.split();
-    let (mut udp_reader, mut udp_writer) = udp_socket.split();
-
-    let (outbound_tx, outbound_rx) = mpsc::channel::<TunnelPacket>(128);
-    let mut tunnel_packets = client
-        .tunnel_client
-        .tunnel_packets(ReceiverStream::new(outbound_rx))
-        .await?
-        .into_inner();
-
-    let ingress_task = tokio::spawn(async move {
-        loop {
-            match tunnel_packets.message().await? {
-                Some(packet) => {
-                    log::debug!(
-                        "tailnet udp echo received {} bytes from daemon packet stream",
-                        packet.payload.len()
-                    );
-                    stack_sink
-                        .send(packet.payload)
-                        .await
-                        .context("failed to feed inbound tailnet packet into userspace stack")?;
-                }
-                None => break,
-            }
-        }
-        Result::<()>::Ok(())
-    });
-
-    let egress_task = tokio::spawn(async move {
-        while let Some(packet) = stack_stream.next().await {
-            let payload = packet.context("failed to read outbound packet from userspace stack")?;
-            log::debug!(
-                "tailnet udp echo sending {} bytes into daemon packet stream",
-                payload.len()
-            );
-            outbound_tx
-                .send(TunnelPacket { payload })
-                .await
-                .context("failed to forward outbound tailnet packet to daemon")?;
-        }
-        Result::<()>::Ok(())
-    });
-
-    let runner_task = tokio::spawn(async move { runner.await.map_err(anyhow::Error::from) });
-
-    udp_writer
-        .send((message.as_bytes().to_vec(), local_addr, remote_addr))
-        .await
-        .context("failed to send UDP echo probe into userspace stack")?;
-    log::debug!("tailnet udp echo probe queued from {local_addr} to {remote_addr}");
-
-    let response = timeout(Duration::from_millis(timeout_ms), udp_reader.next())
-        .await
-        .with_context(|| format!("timed out waiting for UDP echo from {remote_addr}"))?
-        .context("userspace UDP stack ended before returning a reply")?;
-    let (payload, reply_source, reply_destination) = response;
-    let response_text = String::from_utf8_lossy(&payload);
-
-    ingress_task.abort();
-    egress_task.abort();
-    runner_task.abort();
-
-    if reply_source != remote_addr {
-        bail!("received UDP reply from unexpected source {reply_source}");
-    }
-    if reply_destination != local_addr {
-        bail!("received UDP reply for unexpected local socket {reply_destination}");
-    }
-    if payload != message.as_bytes() {
-        bail!("UDP echo payload mismatch");
-    }
-
-    println!("Tailnet UDP Echo Source: {reply_source}");
-    println!("Tailnet UDP Echo Destination: {reply_destination}");
-    println!("Tailnet UDP Echo Payload: {response_text}");
-    Ok(())
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-fn select_tailnet_local_ip(
-    addresses: &[String],
-    remote_ip: std::net::IpAddr,
-) -> Result<std::net::IpAddr> {
-    use anyhow::Context;
-
-    let family_is_v4 = remote_ip.is_ipv4();
-    addresses
-        .iter()
-        .filter_map(|cidr| cidr.split('/').next())
-        .filter_map(|ip| ip.parse::<std::net::IpAddr>().ok())
-        .find(|ip| ip.is_ipv4() == family_is_v4)
-        .with_context(|| {
-            format!(
-                "no local {} tailnet address found in daemon config {:?}",
-                if family_is_v4 { "IPv4" } else { "IPv6" },
-                addresses
-            )
-        })
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-fn select_tailnet_local_socket(
-    addresses: &[String],
-    remote_ip: std::net::IpAddr,
-) -> Result<std::net::SocketAddr> {
-    use rand::Rng;
-
-    let local_ip = select_tailnet_local_ip(addresses, remote_ip)?;
-    let port = rand::thread_rng().gen_range(40000..50000);
-    Ok(std::net::SocketAddr::new(local_ip, port))
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-struct IcmpEchoReply {
-    source: std::net::IpAddr,
-    destination: std::net::IpAddr,
-    payload: Vec<u8>,
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-fn build_icmp_echo_request(
-    source: std::net::IpAddr,
-    destination: std::net::IpAddr,
-    identifier: u16,
-    sequence: u16,
-    payload: &[u8],
-) -> Result<Vec<u8>> {
-    use anyhow::bail;
-
-    let (source, destination) = match (source, destination) {
-        (std::net::IpAddr::V4(source), std::net::IpAddr::V4(destination)) => (source, destination),
-        _ => bail!("tailnet ping currently supports IPv4 only"),
-    };
-
-    let mut icmp = Vec::with_capacity(8 + payload.len());
-    icmp.push(8);
-    icmp.push(0);
-    icmp.extend_from_slice(&[0, 0]);
-    icmp.extend_from_slice(&identifier.to_be_bytes());
-    icmp.extend_from_slice(&sequence.to_be_bytes());
-    icmp.extend_from_slice(payload);
-    let icmp_checksum = internet_checksum(&icmp);
-    icmp[2..4].copy_from_slice(&icmp_checksum.to_be_bytes());
-
-    let total_len = 20 + icmp.len();
-    let mut packet = Vec::with_capacity(total_len);
-    packet.push(0x45);
-    packet.push(0);
-    packet.extend_from_slice(&(total_len as u16).to_be_bytes());
-    packet.extend_from_slice(&0u16.to_be_bytes());
-    packet.extend_from_slice(&0u16.to_be_bytes());
-    packet.push(64);
-    packet.push(1);
-    packet.extend_from_slice(&[0, 0]);
-    packet.extend_from_slice(&source.octets());
-    packet.extend_from_slice(&destination.octets());
-    let header_checksum = internet_checksum(&packet);
-    packet[10..12].copy_from_slice(&header_checksum.to_be_bytes());
-    packet.extend_from_slice(&icmp);
-    Ok(packet)
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-fn parse_icmp_echo_reply(
-    packet: &[u8],
-    local_ip: std::net::IpAddr,
-    remote_ip: std::net::IpAddr,
-    identifier: u16,
-    sequence: u16,
-) -> Result<Option<IcmpEchoReply>> {
-    use anyhow::bail;
-
-    let (local_ip, remote_ip) = match (local_ip, remote_ip) {
-        (std::net::IpAddr::V4(local_ip), std::net::IpAddr::V4(remote_ip)) => (local_ip, remote_ip),
-        _ => bail!("tailnet ping currently supports IPv4 only"),
-    };
-
-    if packet.len() < 20 {
-        return Ok(None);
-    }
-    let version = packet[0] >> 4;
-    if version != 4 {
-        return Ok(None);
-    }
-    let ihl = (packet[0] & 0x0f) as usize * 4;
-    if packet.len() < ihl + 8 {
-        return Ok(None);
-    }
-    if packet[9] != 1 {
-        return Ok(None);
-    }
-
-    let source = std::net::Ipv4Addr::new(packet[12], packet[13], packet[14], packet[15]);
-    let destination = std::net::Ipv4Addr::new(packet[16], packet[17], packet[18], packet[19]);
-    if source != remote_ip || destination != local_ip {
-        return Ok(None);
-    }
-
-    let icmp = &packet[ihl..];
-    if icmp[0] != 0 || icmp[1] != 0 {
-        return Ok(None);
-    }
-    let reply_identifier = u16::from_be_bytes([icmp[4], icmp[5]]);
-    let reply_sequence = u16::from_be_bytes([icmp[6], icmp[7]]);
-    if reply_identifier != identifier || reply_sequence != sequence {
-        return Ok(None);
-    }
-
-    Ok(Some(IcmpEchoReply {
-        source: std::net::IpAddr::V4(source),
-        destination: std::net::IpAddr::V4(destination),
-        payload: icmp[8..].to_vec(),
-    }))
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-fn internet_checksum(bytes: &[u8]) -> u16 {
-    let mut sum = 0u32;
-    let mut chunks = bytes.chunks_exact(2);
-    for chunk in &mut chunks {
-        sum += u16::from_be_bytes([chunk[0], chunk[1]]) as u32;
-    }
-    if let Some(&last) = chunks.remainder().first() {
-        sum += (last as u32) << 8;
-    }
-    while (sum >> 16) != 0 {
-        sum = (sum & 0xffff) + (sum >> 16);
-    }
-    !(sum as u16)
-}
-
-#[cfg(target_os = "linux")]
-async fn try_tor_exec(payload_path: &str, command: Vec<String>) -> Result<()> {
-    let exit_code = usernet::run_exec(usernet::ExecInvocation {
-        backend: usernet::ExecBackendKind::Tor,
-        payload_path: Some(payload_path.into()),
-        command,
-    })
-    .await?;
-    if exit_code != 0 {
-        std::process::exit(exit_code);
-    }
-    Ok(())
-}
-
-#[cfg(target_os = "linux")]
-async fn try_exec(
-    backend: usernet::ExecBackendKind,
-    payload: Option<String>,
-    command: Vec<String>,
-) -> Result<()> {
-    let exit_code = usernet::run_exec(usernet::ExecInvocation {
-        backend,
-        payload_path: payload.map(Into::into),
-        command,
-    })
-    .await?;
-    if exit_code != 0 {
-        std::process::exit(exit_code);
-    }
-    Ok(())
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-fn handle_unexpected(res: Result<DaemonResponseData, String>) {
-    match res {
         Ok(DaemonResponseData::None) => {
             println!("Server not started.")
         }
@@ -704,17 +86,6 @@ fn handle_unexpected(res: Result<DaemonResponseData, String>) {
             println!("Error when retrieving from server: {}", e)
         }
     }
-}
-
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-async fn try_serverinfo() -> Result<()> {
-    let mut client = DaemonClient::new().await?;
-    let res = client.send_command(DaemonCommand::ServerInfo).await?;
-    if let Ok(DaemonResponseData::ServerInfo(si)) = res.result {
-        println!("Got Result! {:?}", si);
-    } else {
-        handle_unexpected(res.result);
-    }
     Ok(())
 }
 
@@ -722,70 +93,55 @@ async fn try_serverinfo() -> Result<()> {
 async fn try_serverconfig() -> Result<()> {
     let mut client = DaemonClient::new().await?;
     let res = client.send_command(DaemonCommand::ServerConfig).await?;
-    if let Ok(DaemonResponseData::ServerConfig(cfig)) = res.result {
-        println!("Got Result! {:?}", cfig);
-    } else {
-        handle_unexpected(res.result);
+    match res.result {
+        Ok(DaemonResponseData::ServerConfig(cfig)) => {
+            println!("Got Result! {:?}", cfig);
+        }
+        Ok(DaemonResponseData::None) => {
+            println!("Server not started.")
+        }
+        Ok(res) => {
+            println!("Unexpected Response: {:?}", res)
+        }
+        Err(e) => {
+            println!("Error when retrieving from server: {}", e)
+        }
     }
     Ok(())
 }
 
-#[cfg(any(target_os = "linux", target_vendor = "apple"))]
-async fn try_reloadconfig(interface_id: String) -> Result<()> {
-    let mut client = DaemonClient::new().await?;
-    let res = client
-        .send_command(DaemonCommand::ReloadConfig(interface_id))
-        .await?;
-    if let Ok(DaemonResponseData::ServerConfig(cfig)) = res.result {
-        println!("Got Result! {:?}", cfig);
-    } else {
-        handle_unexpected(res.result);
-    }
+#[cfg(not(any(target_os = "linux", target_vendor = "apple")))]
+async fn try_start() -> Result<()> {
+    Ok(())
+}
+
+#[cfg(not(any(target_os = "linux", target_vendor = "apple")))]
+async fn try_stop() -> Result<()> {
+    Ok(())
+}
+
+#[cfg(not(any(target_os = "linux", target_vendor = "apple")))]
+async fn try_serverinfo() -> Result<()> {
+    Ok(())
+}
+
+#[cfg(not(any(target_os = "linux", target_vendor = "apple")))]
+async fn try_serverconfig() -> Result<()> {
     Ok(())
 }
 
 #[cfg(any(target_os = "linux", target_vendor = "apple"))]
-#[tokio::main]
+#[tokio::main(flavor = "current_thread")]
 async fn main() -> Result<()> {
     tracing::initialize();
-    dotenv::dotenv().ok();
 
     let cli = Cli::parse();
     match &cli.command {
         Commands::Start(..) => try_start().await?,
         Commands::Stop => try_stop().await?,
-        Commands::Daemon(_) => daemon::daemon_main(None, None, None).await?,
+        Commands::Daemon(_) => daemon::daemon_main(None, None).await?,
         Commands::ServerInfo => try_serverinfo().await?,
         Commands::ServerConfig => try_serverconfig().await?,
-        Commands::ReloadConfig(args) => try_reloadconfig(args.interface_id.clone()).await?,
-        Commands::AuthServer => crate::auth::server::serve().await?,
-        Commands::ServerStatus => try_serverstatus().await?,
-        Commands::TunnelConfig => try_tun_config().await?,
-        Commands::NetworkAdd(args) => {
-            try_network_add(args.id, args.network_type, &args.payload_path).await?
-        }
-        Commands::NetworkList => try_network_list().await?,
-        Commands::NetworkReorder(args) => try_network_reorder(args.id, args.index).await?,
-        Commands::NetworkDelete(args) => try_network_delete(args.id).await?,
-        Commands::TailnetDiscover(args) => try_tailnet_discover(&args.email).await?,
-        Commands::TailnetProbe(args) => try_tailnet_probe(&args.authority).await?,
-        Commands::TailnetPing(args) => {
-            try_tailnet_ping(&args.remote, &args.payload, args.timeout_ms).await?
-        }
-        Commands::TailnetUdpEcho(args) => {
-            try_tailnet_udp_echo(&args.remote, &args.message, args.timeout_ms).await?
-        }
-        #[cfg(target_os = "linux")]
-        Commands::Exec(args) => {
-            try_exec(
-                args.backend.clone(),
-                args.payload.clone(),
-                args.command.clone(),
-            )
-            .await?
-        }
-        #[cfg(target_os = "linux")]
-        Commands::TorExec(args) => try_tor_exec(&args.payload_path, args.command.clone()).await?,
     }
 
     Ok(())
@@ -793,5 +149,5 @@ async fn main() -> Result<()> {
 
 #[cfg(not(any(target_os = "linux", target_vendor = "apple")))]
 pub fn main() {
-    eprintln!("This platform is not supported")
+    eprintln!("This platform is not supported currently.")
 }
diff --git a/burrow/src/tor/config.rs b/burrow/src/tor/config.rs
deleted file mode 100644
index d3de9ec..0000000
--- a/burrow/src/tor/config.rs
+++ /dev/null
@@ -1,187 +0,0 @@
-use std::{net::SocketAddr, path::PathBuf, str};
-
-use anyhow::{Context, Result};
-use serde::{Deserialize, Serialize};
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct Config {
-    #[serde(default)]
-    pub account: Option<String>,
-    #[serde(default)]
-    pub identity: Option<String>,
-    #[serde(default)]
-    pub address: Vec<String>,
-    #[serde(default)]
-    pub dns: Vec<String>,
-    #[serde(default)]
-    pub mtu: Option<u32>,
-    #[serde(default)]
-    pub tun_name: Option<String>,
-    #[serde(default)]
-    pub arti: ArtiConfig,
-    #[serde(default)]
-    pub tcp_stack: TcpStackConfig,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct ArtiConfig {
-    pub state_dir: String,
-    pub cache_dir: String,
-}
-
-impl Default for ArtiConfig {
-    fn default() -> Self {
-        Self {
-            state_dir: "/var/lib/burrow/arti/state".to_string(),
-            cache_dir: "/var/cache/burrow/arti".to_string(),
-        }
-    }
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(tag = "kind", rename_all = "snake_case")]
-pub enum TcpStackConfig {
-    System(SystemTcpStackConfig),
-}
-
-impl Default for TcpStackConfig {
-    fn default() -> Self {
-        Self::System(SystemTcpStackConfig::default())
-    }
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct SystemTcpStackConfig {
-    #[serde(default = "default_system_listen")]
-    pub listen: String,
-}
-
-impl Default for SystemTcpStackConfig {
-    fn default() -> Self {
-        Self {
-            listen: default_system_listen(),
-        }
-    }
-}
-
-impl Config {
-    pub fn from_payload(payload: &[u8]) -> Result<Self> {
-        if let Ok(config) = serde_json::from_slice(payload) {
-            return Ok(config);
-        }
-
-        let payload = str::from_utf8(payload).context("tor payload must be valid UTF-8")?;
-        toml::from_str(payload).context("failed to parse tor payload as JSON or TOML")
-    }
-
-    pub fn listen_addr(&self) -> Result<SocketAddr> {
-        match &self.tcp_stack {
-            TcpStackConfig::System(config) => config
-                .listen
-                .parse()
-                .with_context(|| format!("invalid system tcp listen address '{}'", config.listen)),
-        }
-    }
-
-    pub fn authority(&self) -> String {
-        "arti://local".to_owned()
-    }
-
-    pub fn account_name(&self) -> String {
-        self.account
-            .clone()
-            .filter(|value| !value.trim().is_empty())
-            .unwrap_or_else(|| "default".to_owned())
-    }
-
-    pub fn identity_name(&self, network_id: i32) -> String {
-        self.identity
-            .clone()
-            .filter(|value| !value.trim().is_empty())
-            .or_else(|| self.tun_name.clone())
-            .unwrap_or_else(|| format!("tor-{network_id}"))
-    }
-
-    pub fn runtime_dirs(&self, network_id: i32) -> (String, String) {
-        let authority = sanitize_path_component(&self.authority());
-        let account = sanitize_path_component(&self.account_name());
-        let identity = sanitize_path_component(&self.identity_name(network_id));
-        (
-            append_runtime_path(&self.arti.state_dir, &[&authority, &account, &identity]),
-            append_runtime_path(&self.arti.cache_dir, &[&authority, &account, &identity]),
-        )
-    }
-}
-
-fn default_system_listen() -> String {
-    "127.0.0.1:9040".to_string()
-}
-
-fn append_runtime_path(base: &str, parts: &[&str]) -> String {
-    let mut path = PathBuf::from(base);
-    for part in parts {
-        path.push(part);
-    }
-    path.to_string_lossy().to_string()
-}
-
-fn sanitize_path_component(value: &str) -> String {
-    let sanitized: String = value
-        .chars()
-        .map(|ch| {
-            if ch.is_ascii_alphanumeric() || ch == '-' || ch == '_' {
-                ch
-            } else {
-                '_'
-            }
-        })
-        .collect();
-
-    if sanitized.is_empty() {
-        "default".to_owned()
-    } else {
-        sanitized
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn parses_json_payload() {
-        let payload = br#"{
-            "address":["100.64.0.2/32"],
-            "mtu":1400,
-            "arti":{"state_dir":"/tmp/state","cache_dir":"/tmp/cache"},
-            "tcp_stack":{"kind":"system","listen":"127.0.0.1:9150"}
-        }"#;
-
-        let config = Config::from_payload(payload).unwrap();
-        assert_eq!(config.address, vec!["100.64.0.2/32"]);
-        assert_eq!(config.listen_addr().unwrap().to_string(), "127.0.0.1:9150");
-        assert!(config.runtime_dirs(7).0.contains("arti___local"));
-    }
-
-    #[test]
-    fn parses_toml_payload() {
-        let payload = r#"
-address = ["100.64.0.3/32"]
-mtu = 1280
-tun_name = "burrow-tor"
-
-[arti]
-state_dir = "/tmp/state"
-cache_dir = "/tmp/cache"
-
-[tcp_stack]
-kind = "system"
-listen = "127.0.0.1:9140"
-"#;
-
-        let config = Config::from_payload(payload.as_bytes()).unwrap();
-        assert_eq!(config.tun_name.as_deref(), Some("burrow-tor"));
-        assert_eq!(config.listen_addr().unwrap().to_string(), "127.0.0.1:9140");
-        assert_eq!(config.identity_name(11), "burrow-tor");
-    }
-}
diff --git a/burrow/src/tor/dns.rs b/burrow/src/tor/dns.rs
deleted file mode 100644
index d918fc4..0000000
--- a/burrow/src/tor/dns.rs
+++ /dev/null
@@ -1,177 +0,0 @@
-use std::{
-    net::{IpAddr, SocketAddr},
-    sync::Arc,
-};
-
-use anyhow::{Context, Result};
-use arti_client::TorClient;
-use hickory_proto::{
-    op::{Message, MessageType, ResponseCode},
-    rr::{rdata::A, rdata::AAAA, RData, Record, RecordType},
-};
-use tokio::{net::UdpSocket, sync::watch, task::JoinError};
-use tor_rtcompat::PreferredRuntime;
-use tracing::{debug, warn};
-
-const DNS_TTL_SECS: u32 = 60;
-
-#[derive(Debug)]
-pub struct TorDnsHandle {
-    shutdown: watch::Sender<bool>,
-    task: tokio::task::JoinHandle<()>,
-}
-
-impl TorDnsHandle {
-    pub async fn shutdown(self) -> Result<()> {
-        let _ = self.shutdown.send(true);
-        match self.task.await {
-            Ok(()) => Ok(()),
-            Err(err) if err.is_cancelled() => Ok(()),
-            Err(err) => Err(join_error(err)),
-        }
-    }
-}
-
-pub async fn spawn(
-    bind_addr: SocketAddr,
-    tor_client: Arc<TorClient<PreferredRuntime>>,
-) -> Result<TorDnsHandle> {
-    let socket = UdpSocket::bind(bind_addr)
-        .await
-        .with_context(|| format!("failed to bind tor dns proxy on {bind_addr}"))?;
-    let (shutdown_tx, mut shutdown_rx) = watch::channel(false);
-    let task = tokio::spawn(async move {
-        let mut buffer = [0u8; 4096];
-        loop {
-            tokio::select! {
-                changed = shutdown_rx.changed() => {
-                    match changed {
-                        Ok(()) if *shutdown_rx.borrow() => break,
-                        Ok(()) => continue,
-                        Err(_) => break,
-                    }
-                }
-                received = socket.recv_from(&mut buffer) => {
-                    let (len, peer_addr) = match received {
-                        Ok(value) => value,
-                        Err(err) => {
-                            warn!(?err, "tor dns proxy recv failed");
-                            continue;
-                        }
-                    };
-
-                    let response = match build_response(&buffer[..len], tor_client.as_ref()).await {
-                        Ok(message) => message,
-                        Err(err) => {
-                            debug!(?err, "tor dns proxy failed to answer query");
-                            continue;
-                        }
-                    };
-
-                    if let Err(err) = socket.send_to(&response, peer_addr).await {
-                        warn!(?err, "tor dns proxy send failed");
-                    }
-                }
-            }
-        }
-    });
-
-    Ok(TorDnsHandle { shutdown: shutdown_tx, task })
-}
-
-pub(crate) async fn build_response(
-    packet: &[u8],
-    tor_client: &TorClient<PreferredRuntime>,
-) -> Result<Vec<u8>> {
-    let request = Message::from_vec(packet).context("failed to parse dns packet")?;
-    let mut response = Message::new();
-    response
-        .set_id(request.id())
-        .set_op_code(request.op_code())
-        .set_message_type(MessageType::Response)
-        .set_recursion_desired(request.recursion_desired())
-        .set_recursion_available(true)
-        .set_response_code(ResponseCode::NoError);
-
-    for query in request.queries().iter().cloned() {
-        response.add_query(query.clone());
-        match query.query_type() {
-            RecordType::A | RecordType::AAAA => {
-                let hostname = query.name().to_utf8();
-                let hostname = hostname.trim_end_matches('.');
-                match tor_client.resolve(hostname).await {
-                    Ok(addrs) => {
-                        for addr in addrs {
-                            if let Some(answer) =
-                                record_for_address(query.name().clone(), query.query_type(), addr)
-                            {
-                                response.add_answer(answer);
-                            }
-                        }
-                    }
-                    Err(err) => {
-                        debug!(hostname, ?err, "tor dns lookup failed");
-                        response.set_response_code(ResponseCode::ServFail);
-                    }
-                }
-            }
-            _ => {
-                response.set_response_code(ResponseCode::NotImp);
-            }
-        }
-    }
-
-    response.to_vec().context("failed to encode dns response")
-}
-
-fn record_for_address(
-    name: hickory_proto::rr::Name,
-    record_type: RecordType,
-    addr: IpAddr,
-) -> Option<Record> {
-    match (record_type, addr) {
-        (RecordType::A, IpAddr::V4(ip)) => Some(Record::from_rdata(
-            name,
-            DNS_TTL_SECS,
-            RData::A(A::from(ip)),
-        )),
-        (RecordType::AAAA, IpAddr::V6(ip)) => Some(Record::from_rdata(
-            name,
-            DNS_TTL_SECS,
-            RData::AAAA(AAAA::from(ip)),
-        )),
-        _ => None,
-    }
-}
-
-fn join_error(err: JoinError) -> anyhow::Error {
-    anyhow::anyhow!("tor dns task failed: {err}")
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use hickory_proto::rr::Name;
-    use std::net::{Ipv4Addr, Ipv6Addr};
-
-    #[test]
-    fn builds_a_record_for_ipv4_answer() {
-        let record = record_for_address(
-            Name::from_ascii("example.com.").unwrap(),
-            RecordType::A,
-            IpAddr::V4(Ipv4Addr::new(1, 2, 3, 4)),
-        )
-        .unwrap();
-        assert_eq!(record.record_type(), RecordType::A);
-    }
-
-    #[test]
-    fn skips_mismatched_record_type() {
-        let record = record_for_address(
-            Name::from_ascii("example.com.").unwrap(),
-            RecordType::A,
-            IpAddr::V6(Ipv6Addr::LOCALHOST),
-        );
-        assert!(record.is_none());
-    }
-}
diff --git a/burrow/src/tor/exec.rs b/burrow/src/tor/exec.rs
deleted file mode 100644
index 7f4317d..0000000
--- a/burrow/src/tor/exec.rs
+++ /dev/null
@@ -1,439 +0,0 @@
-use std::{
-    ffi::{OsStr, OsString},
-    fs,
-    net::{IpAddr, Ipv4Addr, SocketAddr},
-    os::unix::process::ExitStatusExt,
-    path::PathBuf,
-    process::{Command, ExitStatus, Stdio},
-    sync::Arc,
-    time::Duration,
-};
-
-use anyhow::{bail, Context, Result};
-use tokio::process::Command as TokioCommand;
-use tor_rtcompat::PreferredRuntime;
-use tracing::{debug, info};
-
-use super::{
-    bootstrap_client,
-    dns::{spawn as spawn_dns, TorDnsHandle},
-    runtime::{spawn_with_client, TorHandle},
-    Config, SystemTcpStackConfig, TcpStackConfig,
-};
-
-const CHILD_PREFIX_LEN: u8 = 30;
-const CHILD_DNS_PORT: u16 = 53;
-const LISTENER_READY_TIMEOUT: Duration = Duration::from_secs(10);
-const LISTENER_READY_POLL: Duration = Duration::from_millis(100);
-
-pub async fn run_exec(mut config: Config, command: Vec<String>) -> Result<i32> {
-    if command.is_empty() {
-        bail!("tor-exec requires a command to run");
-    }
-    ensure_root()?;
-    ensure_host_tool("ip")?;
-    ensure_host_tool("iptables")?;
-    ensure_host_tool("unshare")?;
-
-    let requested_listener = config.listen_addr()?;
-    if requested_listener.port() == 0 {
-        bail!("tor-exec requires a fixed listener port");
-    }
-
-    let plan = NamespacePlan::new(requested_listener.port());
-    let (state_dir, cache_dir) = config.runtime_dirs(std::process::id() as i32);
-    config.arti.state_dir = state_dir;
-    config.arti.cache_dir = cache_dir;
-    config.tcp_stack = TcpStackConfig::System(SystemTcpStackConfig {
-        listen: format!("{}:{}", plan.host_ip, plan.listener_port),
-    });
-
-    let namespace = NamespaceGuard::create(&plan)?;
-    let tor_client = bootstrap_client(&config).await?;
-    let tor_handle = spawn_with_client(config, tor_client.clone()).await?;
-    wait_for_listener(SocketAddr::new(
-        IpAddr::V4(plan.host_ip),
-        plan.listener_port,
-    ))
-    .await?;
-    let dns_handle = spawn_dns(
-        SocketAddr::new(IpAddr::V4(plan.host_ip), CHILD_DNS_PORT),
-        tor_client,
-    )
-    .await?;
-
-    let status = namespace.run_child(&command).await;
-    let dns_shutdown = dns_handle.shutdown().await;
-    let tor_shutdown = tor_handle.shutdown().await;
-
-    let status = status?;
-    dns_shutdown?;
-    tor_shutdown?;
-    child_exit_code(status)
-}
-
-fn ensure_root() -> Result<()> {
-    if unsafe { libc::geteuid() } != 0 {
-        bail!("tor-exec currently requires root on linux");
-    }
-    Ok(())
-}
-
-fn ensure_host_tool(tool: &str) -> Result<()> {
-    let status = Command::new("sh")
-        .args(["-lc", &format!("command -v {tool} >/dev/null")])
-        .status()
-        .with_context(|| format!("failed to probe required tool '{tool}'"))?;
-    if !status.success() {
-        bail!("required host tool '{tool}' is not available");
-    }
-    Ok(())
-}
-
-async fn wait_for_listener(addr: SocketAddr) -> Result<()> {
-    let deadline = tokio::time::Instant::now() + LISTENER_READY_TIMEOUT;
-    loop {
-        match tokio::net::TcpStream::connect(addr).await {
-            Ok(stream) => {
-                drop(stream);
-                return Ok(());
-            }
-            Err(err) if tokio::time::Instant::now() < deadline => {
-                debug!(%addr, ?err, "waiting for tor transparent listener");
-                tokio::time::sleep(LISTENER_READY_POLL).await;
-            }
-            Err(err) => return Err(err).with_context(|| format!("timed out waiting for {addr}")),
-        }
-    }
-}
-
-fn child_exit_code(status: ExitStatus) -> Result<i32> {
-    if let Some(code) = status.code() {
-        return Ok(code);
-    }
-    if let Some(signal) = status.signal() {
-        return Ok(128 + signal);
-    }
-    bail!("child process terminated without an exit code");
-}
-
-#[derive(Debug, Clone)]
-struct NamespacePlan {
-    netns_name: String,
-    host_if: String,
-    child_if: String,
-    host_ip: Ipv4Addr,
-    child_ip: Ipv4Addr,
-    listener_port: u16,
-}
-
-impl NamespacePlan {
-    fn new(listener_port: u16) -> Self {
-        let token = std::process::id() % 10_000;
-        let segment = ((std::process::id() % 200) as u8) + 20;
-        Self {
-            netns_name: format!("burrow-tor-{token}"),
-            host_if: format!("bth{token}"),
-            child_if: format!("btc{token}"),
-            host_ip: Ipv4Addr::new(100, 90, segment, 1),
-            child_ip: Ipv4Addr::new(100, 90, segment, 2),
-            listener_port,
-        }
-    }
-
-    fn host_cidr(&self) -> String {
-        format!("{}/{}", self.host_ip, CHILD_PREFIX_LEN)
-    }
-
-    fn child_cidr(&self) -> String {
-        format!("{}/{}", self.child_ip, CHILD_PREFIX_LEN)
-    }
-}
-
-struct NamespaceGuard {
-    plan: NamespacePlan,
-    resolv_conf: PathBuf,
-    nat_rule_installed: bool,
-    forward_rule_installed: bool,
-    netns_created: bool,
-    host_link_created: bool,
-}
-
-impl NamespaceGuard {
-    fn create(plan: &NamespacePlan) -> Result<Self> {
-        let mut guard = Self {
-            plan: plan.clone(),
-            resolv_conf: write_resolv_conf(plan.host_ip)?,
-            nat_rule_installed: false,
-            forward_rule_installed: false,
-            netns_created: false,
-            host_link_created: false,
-        };
-
-        let setup = (|| -> Result<()> {
-            run_host_command(["ip", "netns", "add", &guard.plan.netns_name])?;
-            guard.netns_created = true;
-
-            run_host_command([
-                "ip",
-                "link",
-                "add",
-                &guard.plan.host_if,
-                "type",
-                "veth",
-                "peer",
-                "name",
-                &guard.plan.child_if,
-            ])?;
-            guard.host_link_created = true;
-
-            run_host_command([
-                "ip",
-                "addr",
-                "add",
-                &guard.plan.host_cidr(),
-                "dev",
-                &guard.plan.host_if,
-            ])?;
-            run_host_command(["ip", "link", "set", &guard.plan.host_if, "up"])?;
-            run_host_command([
-                "ip",
-                "link",
-                "set",
-                &guard.plan.child_if,
-                "netns",
-                &guard.plan.netns_name,
-            ])?;
-            run_host_command([
-                "ip",
-                "netns",
-                "exec",
-                &guard.plan.netns_name,
-                "ip",
-                "link",
-                "set",
-                "lo",
-                "up",
-            ])?;
-            run_host_command([
-                "ip",
-                "netns",
-                "exec",
-                &guard.plan.netns_name,
-                "ip",
-                "addr",
-                "add",
-                &guard.plan.child_cidr(),
-                "dev",
-                &guard.plan.child_if,
-            ])?;
-            run_host_command([
-                "ip",
-                "netns",
-                "exec",
-                &guard.plan.netns_name,
-                "ip",
-                "link",
-                "set",
-                &guard.plan.child_if,
-                "up",
-            ])?;
-            run_host_command([
-                "ip",
-                "netns",
-                "exec",
-                &guard.plan.netns_name,
-                "ip",
-                "route",
-                "add",
-                "default",
-                "via",
-                &guard.plan.host_ip.to_string(),
-                "dev",
-                &guard.plan.child_if,
-            ])?;
-            run_host_command([
-                "iptables",
-                "-t",
-                "nat",
-                "-A",
-                "PREROUTING",
-                "-i",
-                &guard.plan.host_if,
-                "-p",
-                "tcp",
-                "-j",
-                "DNAT",
-                "--to-destination",
-                &format!("{}:{}", guard.plan.host_ip, guard.plan.listener_port),
-            ])?;
-            guard.nat_rule_installed = true;
-
-            run_host_command([
-                "iptables",
-                "-A",
-                "FORWARD",
-                "-i",
-                &guard.plan.host_if,
-                "-j",
-                "REJECT",
-            ])?;
-            guard.forward_rule_installed = true;
-            Ok(())
-        })();
-
-        if let Err(err) = setup {
-            guard.cleanup();
-            return Err(err);
-        }
-
-        Ok(guard)
-    }
-
-    async fn run_child(&self, command: &[String]) -> Result<ExitStatus> {
-        let mut args = vec![
-            OsString::from("netns"),
-            OsString::from("exec"),
-            OsString::from(&self.plan.netns_name),
-            OsString::from("unshare"),
-            OsString::from("--user"),
-            OsString::from("--map-root-user"),
-            OsString::from("--mount"),
-            OsString::from("--pid"),
-            OsString::from("--fork"),
-            OsString::from("--kill-child"),
-            OsString::from("sh"),
-            OsString::from("-ceu"),
-            OsString::from(CHILD_SCRIPT),
-            OsString::from("sh"),
-            self.resolv_conf.as_os_str().to_os_string(),
-        ];
-        args.extend(command.iter().map(OsString::from));
-
-        let status = TokioCommand::new("ip")
-            .args(args)
-            .stdin(Stdio::inherit())
-            .stdout(Stdio::inherit())
-            .stderr(Stdio::inherit())
-            .status()
-            .await
-            .context("failed to execute child in tor namespace")?;
-        Ok(status)
-    }
-
-    fn cleanup(&mut self) {
-        if self.forward_rule_installed {
-            let _ = run_host_command([
-                "iptables",
-                "-D",
-                "FORWARD",
-                "-i",
-                &self.plan.host_if,
-                "-j",
-                "REJECT",
-            ]);
-            self.forward_rule_installed = false;
-        }
-        if self.nat_rule_installed {
-            let _ = run_host_command([
-                "iptables",
-                "-t",
-                "nat",
-                "-D",
-                "PREROUTING",
-                "-i",
-                &self.plan.host_if,
-                "-p",
-                "tcp",
-                "-j",
-                "DNAT",
-                "--to-destination",
-                &format!("{}:{}", self.plan.host_ip, self.plan.listener_port),
-            ]);
-            self.nat_rule_installed = false;
-        }
-        if self.host_link_created {
-            let _ = run_host_command(["ip", "link", "delete", &self.plan.host_if]);
-            self.host_link_created = false;
-        }
-        if self.netns_created {
-            let _ = run_host_command(["ip", "netns", "delete", &self.plan.netns_name]);
-            self.netns_created = false;
-        }
-        let _ = fs::remove_file(&self.resolv_conf);
-    }
-}
-
-impl Drop for NamespaceGuard {
-    fn drop(&mut self) {
-        self.cleanup();
-    }
-}
-
-fn write_resolv_conf(nameserver: Ipv4Addr) -> Result<PathBuf> {
-    let path = std::env::temp_dir().join(format!("burrow-tor-resolv-{}.conf", std::process::id()));
-    fs::write(&path, format!("nameserver {nameserver}\noptions ndots:1\n"))
-        .with_context(|| format!("failed to write {}", path.display()))?;
-    Ok(path)
-}
-
-fn run_host_command<const N: usize>(args: [&str; N]) -> Result<()> {
-    let (program, rest) = args
-        .split_first()
-        .expect("run_host_command requires a program and arguments");
-    let status = Command::new(program)
-        .args(rest)
-        .stdin(Stdio::null())
-        .stdout(Stdio::null())
-        .stderr(Stdio::piped())
-        .status()
-        .with_context(|| format!("failed to start host command {}", shell_words(&args)))?;
-    if status.success() {
-        Ok(())
-    } else {
-        bail!("host command failed: {}", shell_words(&args));
-    }
-}
-
-fn shell_words(args: &[&str]) -> String {
-    args.iter()
-        .map(|arg| shlex_escape(arg))
-        .collect::<Vec<_>>()
-        .join(" ")
-}
-
-fn shlex_escape(value: &str) -> String {
-    if value
-        .chars()
-        .all(|ch| ch.is_ascii_alphanumeric() || "-_./:=+".contains(ch))
-    {
-        value.to_string()
-    } else {
-        format!("'{}'", value.replace('\'', "'\\''"))
-    }
-}
-
-const CHILD_SCRIPT: &str = r#"
-mount -t proc proc /proc
-mount --bind "$1" /etc/resolv.conf
-shift
-exec "$@"
-"#;
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn namespace_plan_uses_short_interface_names() {
-        let plan = NamespacePlan::new(9040);
-        assert!(plan.host_if.len() <= 15);
-        assert!(plan.child_if.len() <= 15);
-    }
-
-    #[test]
-    fn signal_exit_code_uses_shell_convention() {
-        let status = ExitStatus::from_raw(libc::SIGTERM);
-        assert_eq!(child_exit_code(status).unwrap(), 128 + libc::SIGTERM);
-    }
-}
diff --git a/burrow/src/tor/mod.rs b/burrow/src/tor/mod.rs
deleted file mode 100644
index 635c355..0000000
--- a/burrow/src/tor/mod.rs
+++ /dev/null
@@ -1,9 +0,0 @@
-mod config;
-pub(crate) mod dns;
-mod exec;
-mod runtime;
-mod system;
-
-pub use config::{ArtiConfig, Config, SystemTcpStackConfig, TcpStackConfig};
-pub use exec::run_exec;
-pub use runtime::{bootstrap_client, spawn, spawn_with_client, TorHandle};
diff --git a/burrow/src/tor/runtime.rs b/burrow/src/tor/runtime.rs
deleted file mode 100644
index 45690ee..0000000
--- a/burrow/src/tor/runtime.rs
+++ /dev/null
@@ -1,126 +0,0 @@
-use std::{sync::Arc, time::Duration};
-
-use anyhow::{Context, Result};
-use arti_client::{config::TorClientConfigBuilder, TorClient};
-use tokio::{
-    sync::watch,
-    task::{JoinError, JoinSet},
-};
-use tokio_util::compat::FuturesAsyncReadCompatExt;
-use tor_rtcompat::PreferredRuntime;
-use tracing::{debug, error, info, warn};
-
-use super::{system::SystemTcpStackRuntime, Config, TcpStackConfig};
-
-#[derive(Debug)]
-pub struct TorHandle {
-    shutdown: watch::Sender<bool>,
-    task: tokio::task::JoinHandle<()>,
-}
-
-impl TorHandle {
-    pub async fn shutdown(self) -> Result<()> {
-        let _ = self.shutdown.send(true);
-        match self.task.await {
-            Ok(()) => Ok(()),
-            Err(err) if err.is_cancelled() => Ok(()),
-            Err(err) => Err(join_error(err)),
-        }
-    }
-}
-
-pub async fn bootstrap_client(config: &Config) -> Result<Arc<TorClient<PreferredRuntime>>> {
-    let builder =
-        TorClientConfigBuilder::from_directories(&config.arti.state_dir, &config.arti.cache_dir);
-    let tor_config = builder.build().context("failed to build arti config")?;
-    let tor_client = TorClient::create_bootstrapped(tor_config)
-        .await
-        .context("failed to bootstrap arti client")?;
-    Ok(Arc::new(tor_client))
-}
-
-pub async fn spawn(config: Config) -> Result<TorHandle> {
-    let tor_client = bootstrap_client(&config).await?;
-    spawn_with_client(config, tor_client).await
-}
-
-pub async fn spawn_with_client(
-    config: Config,
-    tor_client: Arc<TorClient<PreferredRuntime>>,
-) -> Result<TorHandle> {
-    let (shutdown_tx, mut shutdown_rx) = watch::channel(false);
-    let task = match config.tcp_stack.clone() {
-        TcpStackConfig::System(system_config) => tokio::spawn(async move {
-            let stack = match SystemTcpStackRuntime::bind(&system_config).await {
-                Ok(stack) => stack,
-                Err(err) => {
-                    error!(?err, "failed to bind system tcp stack listener");
-                    return;
-                }
-            };
-            info!(
-                listen = %stack.local_addr(),
-                "system tcp stack listener bound for tor transparent proxy"
-            );
-
-            let mut connections = JoinSet::new();
-            loop {
-                tokio::select! {
-                    changed = shutdown_rx.changed() => {
-                        match changed {
-                            Ok(()) if *shutdown_rx.borrow() => break,
-                            Ok(()) => continue,
-                            Err(_) => break,
-                        }
-                    }
-                    Some(res) = connections.join_next(), if !connections.is_empty() => {
-                        match res {
-                            Ok(Ok(())) => {}
-                            Ok(Err(err)) => warn!(?err, "transparent proxy task failed"),
-                            Err(err) => warn!(?err, "transparent proxy task panicked"),
-                        }
-                    }
-                    accepted = stack.accept() => {
-                        let (mut inbound, original_dst) = match accepted {
-                            Ok(pair) => pair,
-                            Err(err) => {
-                                warn!(?err, "failed to accept transparent tcp connection");
-                                tokio::time::sleep(Duration::from_millis(50)).await;
-                                continue;
-                            }
-                        };
-
-                        let tor_client = tor_client.clone();
-                        connections.spawn(async move {
-                            debug!(%original_dst, "accepted transparent tcp connection");
-                            let tor_stream = tor_client
-                                .connect((original_dst.ip().to_string(), original_dst.port()))
-                                .await
-                                .with_context(|| format!("failed to connect to {original_dst} over tor"))?;
-                            let mut tor_stream = tor_stream.compat();
-                            tokio::io::copy_bidirectional(&mut inbound, &mut tor_stream)
-                                .await
-                                .with_context(|| format!("failed to bridge tor stream for {original_dst}"))?;
-                            Result::<()>::Ok(())
-                        });
-                    }
-                }
-            }
-
-            connections.abort_all();
-            while let Some(res) = connections.join_next().await {
-                match res {
-                    Ok(Ok(())) => {}
-                    Ok(Err(err)) => debug!(?err, "transparent proxy task failed during shutdown"),
-                    Err(err) => debug!(?err, "transparent proxy task exited during shutdown"),
-                }
-            }
-        }),
-    };
-
-    Ok(TorHandle { shutdown: shutdown_tx, task })
-}
-
-fn join_error(err: JoinError) -> anyhow::Error {
-    anyhow::anyhow!("tor runtime task failed: {err}")
-}
diff --git a/burrow/src/tor/system.rs b/burrow/src/tor/system.rs
deleted file mode 100644
index 74f8157..0000000
--- a/burrow/src/tor/system.rs
+++ /dev/null
@@ -1,143 +0,0 @@
-use std::net::SocketAddr;
-
-use anyhow::{Context, Result};
-use tokio::net::{TcpListener, TcpStream};
-
-use super::SystemTcpStackConfig;
-
-pub struct SystemTcpStackRuntime {
-    listener: TcpListener,
-}
-
-impl SystemTcpStackRuntime {
-    pub async fn bind(config: &SystemTcpStackConfig) -> Result<Self> {
-        let listener = TcpListener::bind(&config.listen)
-            .await
-            .with_context(|| format!("failed to bind transparent listener on {}", config.listen))?;
-        Ok(Self { listener })
-    }
-
-    pub fn local_addr(&self) -> SocketAddr {
-        self.listener
-            .local_addr()
-            .expect("listener should always have a local address")
-    }
-
-    pub async fn accept(&self) -> Result<(TcpStream, SocketAddr)> {
-        let (stream, _) = self
-            .listener
-            .accept()
-            .await
-            .context("failed to accept transparent listener connection")?;
-        let original_dst = original_destination(&stream)?;
-        Ok((stream, original_dst))
-    }
-}
-
-#[cfg(target_os = "linux")]
-fn original_destination(stream: &TcpStream) -> Result<SocketAddr> {
-    use std::{
-        mem::{size_of, MaybeUninit},
-        os::fd::AsRawFd,
-    };
-
-    let level = if stream.local_addr()?.is_ipv6() {
-        libc::SOL_IPV6
-    } else {
-        libc::SOL_IP
-    };
-
-    let mut addr = MaybeUninit::<libc::sockaddr_storage>::zeroed();
-    let mut len = size_of::<libc::sockaddr_storage>() as libc::socklen_t;
-    let rc = unsafe {
-        libc::getsockopt(
-            stream.as_raw_fd(),
-            level,
-            80,
-            addr.as_mut_ptr().cast(),
-            &mut len,
-        )
-    };
-    if rc != 0 {
-        return Err(std::io::Error::last_os_error()).context("SO_ORIGINAL_DST lookup failed");
-    }
-
-    socket_addr_from_storage(unsafe { &addr.assume_init() }, len as usize)
-}
-
-#[cfg(not(target_os = "linux"))]
-fn original_destination(_stream: &TcpStream) -> Result<SocketAddr> {
-    anyhow::bail!("system tcp stack transparent destination lookup is only implemented on linux")
-}
-
-fn socket_addr_from_storage(addr: &libc::sockaddr_storage, len: usize) -> Result<SocketAddr> {
-    use std::net::{Ipv4Addr, Ipv6Addr, SocketAddrV4, SocketAddrV6};
-
-    if len < std::mem::size_of::<libc::sa_family_t>() {
-        anyhow::bail!("socket address buffer was too short");
-    }
-
-    match addr.ss_family as i32 {
-        libc::AF_INET => {
-            let addr_in = unsafe { *(addr as *const _ as *const libc::sockaddr_in) };
-            let ip = Ipv4Addr::from(u32::from_be(addr_in.sin_addr.s_addr));
-            let port = u16::from_be(addr_in.sin_port);
-            Ok(SocketAddr::V4(SocketAddrV4::new(ip, port)))
-        }
-        libc::AF_INET6 => {
-            let addr_in = unsafe { *(addr as *const _ as *const libc::sockaddr_in6) };
-            let ip = Ipv6Addr::from(addr_in.sin6_addr.s6_addr);
-            let port = u16::from_be(addr_in.sin6_port);
-            Ok(SocketAddr::V6(SocketAddrV6::new(
-                ip,
-                port,
-                addr_in.sin6_flowinfo,
-                addr_in.sin6_scope_id,
-            )))
-        }
-        family => anyhow::bail!("unsupported socket address family {family}"),
-    }
-}
-
-#[cfg(all(test, target_os = "linux"))]
-mod tests {
-    use super::*;
-    use std::{
-        mem::size_of,
-        net::{Ipv4Addr, Ipv6Addr, SocketAddrV4, SocketAddrV6},
-    };
-
-    #[test]
-    fn parses_ipv4_socket_addr() {
-        let mut storage = unsafe { std::mem::zeroed::<libc::sockaddr_storage>() };
-        let addr_in = unsafe { &mut *(&mut storage as *mut _ as *mut libc::sockaddr_in) };
-        addr_in.sin_family = libc::AF_INET as libc::sa_family_t;
-        addr_in.sin_port = u16::to_be(9040);
-        addr_in.sin_addr = libc::in_addr {
-            s_addr: u32::to_be(u32::from(Ipv4Addr::new(127, 0, 0, 1))),
-        };
-
-        let parsed = socket_addr_from_storage(&storage, size_of::<libc::sockaddr_in>()).unwrap();
-        assert_eq!(
-            parsed,
-            SocketAddr::V4(SocketAddrV4::new(Ipv4Addr::LOCALHOST, 9040))
-        );
-    }
-
-    #[test]
-    fn parses_ipv6_socket_addr() {
-        let mut storage = unsafe { std::mem::zeroed::<libc::sockaddr_storage>() };
-        let addr_in = unsafe { &mut *(&mut storage as *mut _ as *mut libc::sockaddr_in6) };
-        addr_in.sin6_family = libc::AF_INET6 as libc::sa_family_t;
-        addr_in.sin6_port = u16::to_be(9150);
-        addr_in.sin6_addr = libc::in6_addr {
-            s6_addr: Ipv6Addr::LOCALHOST.octets(),
-        };
-
-        let parsed = socket_addr_from_storage(&storage, size_of::<libc::sockaddr_in6>()).unwrap();
-        assert_eq!(
-            parsed,
-            SocketAddr::V6(SocketAddrV6::new(Ipv6Addr::LOCALHOST, 9150, 0, 0))
-        );
-    }
-}
diff --git a/burrow/src/tracing.rs b/burrow/src/tracing.rs
index 8a245ef..279f45d 100644
--- a/burrow/src/tracing.rs
+++ b/burrow/src/tracing.rs
@@ -3,7 +3,8 @@ use std::sync::Once;
 use tracing::{error, info};
 use tracing_subscriber::{
     layer::{Layer, SubscriberExt},
-    EnvFilter, Registry,
+    EnvFilter,
+    Registry,
 };
 
 static TRACING: Once = Once::new();
@@ -14,55 +15,35 @@ pub fn initialize() {
             error!("Failed to initialize LogTracer: {}", e);
         }
 
-        let make_stderr = || {
+        #[cfg(target_os = "windows")]
+        let system_log = Some(tracing_subscriber::fmt::layer());
+
+        #[cfg(target_os = "linux")]
+        let system_log = match tracing_journald::layer() {
+            Ok(layer) => Some(layer),
+            Err(e) => {
+                if e.kind() != std::io::ErrorKind::NotFound {
+                    error!("Failed to initialize journald: {}", e);
+                }
+                None
+            }
+        };
+
+        #[cfg(target_vendor = "apple")]
+        let system_log = Some(tracing_oslog::OsLogger::new(
+            "com.hackclub.burrow",
+            "tracing",
+        ));
+
+        let stderr = (console::user_attended_stderr() || system_log.is_none()).then(|| {
             tracing_subscriber::fmt::layer()
                 .with_level(true)
                 .with_writer(std::io::stderr)
-                .with_line_number(true)
                 .compact()
                 .with_filter(EnvFilter::from_default_env())
-        };
+        });
 
-        #[cfg(target_os = "windows")]
-        let subscriber = {
-            let system_log = Some(tracing_subscriber::fmt::layer());
-            let stderr = (console::user_attended_stderr() || system_log.is_none()).then(make_stderr);
-            Registry::default().with(stderr).with(system_log)
-        };
-
-        #[cfg(target_os = "linux")]
-        let subscriber = {
-            let system_log = match tracing_journald::layer() {
-                Ok(layer) => Some(layer),
-                Err(e) => {
-                    if e.kind() != std::io::ErrorKind::NotFound {
-                        error!("Failed to initialize journald: {}", e);
-                    }
-                    None
-                }
-            };
-            let stderr = (console::user_attended_stderr() || system_log.is_none()).then(make_stderr);
-            Registry::default().with(stderr).with(system_log)
-        };
-
-        #[cfg(target_os = "macos")]
-        let subscriber = {
-            // `tracing_oslog` is crashing under Tokio/h2 span churn in the host daemon on
-            // current macOS. Keep logging on stderr by default and allow opt-in OSLog
-            // only when explicitly requested for local debugging.
-            let enable_oslog = matches!(
-                std::env::var("BURROW_ENABLE_OSLOG").as_deref(),
-                Ok("1" | "true" | "TRUE" | "yes" | "YES")
-            );
-            let system_log = enable_oslog.then(|| {
-                tracing_oslog::OsLogger::new("com.hackclub.burrow", "tracing")
-            });
-            let stderr = (console::user_attended_stderr() || system_log.is_none()).then(make_stderr);
-            Registry::default().with(stderr).with(system_log)
-        };
-
-        #[cfg(not(any(target_os = "windows", target_os = "linux", target_os = "macos")))]
-        let subscriber = Registry::default().with(Some(make_stderr()));
+        let subscriber = Registry::default().with(stderr).with(system_log);
 
         #[cfg(feature = "tokio-console")]
         let subscriber = subscriber.with(
diff --git a/burrow/src/usernet/mod.rs b/burrow/src/usernet/mod.rs
deleted file mode 100644
index 12de810..0000000
--- a/burrow/src/usernet/mod.rs
+++ /dev/null
@@ -1,935 +0,0 @@
-use std::{
-    collections::HashMap,
-    env,
-    net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr},
-    os::fd::{AsRawFd, FromRawFd, RawFd},
-    os::unix::net::UnixStream as StdUnixStream,
-    os::unix::process::ExitStatusExt,
-    path::{Path, PathBuf},
-    process::{Command as StdCommand, ExitStatus},
-    str,
-    sync::Arc,
-    time::Duration,
-};
-
-use anyhow::{anyhow, bail, Context, Result};
-use clap::ValueEnum;
-use futures::{SinkExt, StreamExt};
-use ipnetwork::IpNetwork;
-use netstack_smoltcp::{
-    StackBuilder, TcpListener as StackTcpListener, TcpStream as StackTcpStream,
-    UdpSocket as StackUdpSocket,
-};
-use nix::{
-    cmsg_space,
-    fcntl::{fcntl, FcntlArg, FdFlag},
-    sys::socket::{recvmsg, sendmsg, ControlMessage, ControlMessageOwned, MsgFlags},
-};
-use serde::{Deserialize, Serialize};
-use tokio::{
-    io::copy_bidirectional,
-    net::{TcpStream, UdpSocket},
-    process::{Child, Command},
-    sync::{mpsc, Mutex, RwLock},
-    task::JoinSet,
-};
-use tokio_util::compat::FuturesAsyncReadCompatExt;
-use tracing::{debug, warn};
-use tun::{tokio::TunInterface as TokioTunInterface, TunOptions};
-
-use crate::{
-    tor::{bootstrap_client, dns::build_response as build_tor_dns_response, Config as TorConfig},
-    wireguard::{Config as WireGuardConfig, Interface as WireGuardInterface},
-};
-
-const INNER_ENV: &str = "BURROW_USERNET_INNER";
-const INNER_CONTROL_FD_ENV: &str = "BURROW_USERNET_CONTROL_FD";
-const INNER_TUN_CONFIG_ENV: &str = "BURROW_USERNET_TUN_CONFIG";
-const DEFAULT_MTU: u32 = 1500;
-const DEFAULT_TUN_V4: &str = "100.64.0.2/24";
-const DEFAULT_TUN_V6: &str = "fd00:64::2/64";
-const UDP_IDLE_TIMEOUT: Duration = Duration::from_secs(30);
-const READY_ACK: &[u8; 1] = b"1";
-
-#[derive(Clone, Debug, Eq, PartialEq, ValueEnum)]
-pub enum ExecBackendKind {
-    Direct,
-    Tor,
-    Wireguard,
-}
-
-impl ExecBackendKind {
-    fn cli_name(&self) -> &'static str {
-        match self {
-            Self::Direct => "direct",
-            Self::Tor => "tor",
-            Self::Wireguard => "wireguard",
-        }
-    }
-}
-
-#[derive(Clone, Debug)]
-pub struct ExecInvocation {
-    pub backend: ExecBackendKind,
-    pub payload_path: Option<PathBuf>,
-    pub command: Vec<String>,
-}
-
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub struct DirectConfig {
-    #[serde(default)]
-    pub address: Vec<String>,
-    #[serde(default)]
-    pub dns: Vec<String>,
-    #[serde(default)]
-    pub mtu: Option<u32>,
-    #[serde(default)]
-    pub tun_name: Option<String>,
-}
-
-impl DirectConfig {
-    pub fn from_payload(payload: &[u8]) -> Result<Self> {
-        if payload.is_empty() {
-            return Ok(Self::default());
-        }
-
-        if let Ok(config) = serde_json::from_slice(payload) {
-            return Ok(config);
-        }
-
-        let payload = str::from_utf8(payload).context("direct payload must be valid UTF-8")?;
-        toml::from_str(payload).context("failed to parse direct payload as JSON or TOML")
-    }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct TunNetworkConfig {
-    tun_name: String,
-    addresses: Vec<IpNetwork>,
-    mtu: u32,
-}
-
-enum PreparedBackend {
-    Socket {
-        backend: SocketBackend,
-        tun_config: TunNetworkConfig,
-    },
-    Wireguard {
-        config: WireGuardConfig,
-        tun_config: TunNetworkConfig,
-    },
-}
-
-impl PreparedBackend {
-    fn tun_config(&self) -> &TunNetworkConfig {
-        match self {
-            Self::Socket { tun_config, .. } => tun_config,
-            Self::Wireguard { tun_config, .. } => tun_config,
-        }
-    }
-}
-
-struct NamespaceChild {
-    child: Child,
-    control: StdUnixStream,
-}
-
-#[derive(Clone)]
-enum SocketBackend {
-    Direct,
-    Tor(Arc<arti_client::TorClient<tor_rtcompat::PreferredRuntime>>),
-}
-
-#[derive(Debug)]
-struct UdpReply {
-    payload: Vec<u8>,
-    source: SocketAddr,
-    destination: SocketAddr,
-}
-
-#[derive(Debug, Clone, Eq, Hash, PartialEq)]
-struct UdpFlowKey {
-    local: SocketAddr,
-    remote: SocketAddr,
-}
-
-pub async fn run_exec(invocation: ExecInvocation) -> Result<i32> {
-    if invocation.command.is_empty() {
-        bail!("exec requires a command to run");
-    }
-
-    if env::var_os(INNER_ENV).is_some() {
-        run_inner(invocation.command).await
-    } else {
-        run_supervisor(invocation).await
-    }
-}
-
-async fn run_supervisor(invocation: ExecInvocation) -> Result<i32> {
-    let prepared = prepare_backend(&invocation).await?;
-    let mut child = spawn_namespaced_child(&invocation, prepared.tun_config())?;
-    let tun = child.receive_tun().await?;
-
-    match prepared {
-        PreparedBackend::Socket { backend, .. } => run_socket_backend(backend, tun, child).await,
-        PreparedBackend::Wireguard { config, .. } => {
-            run_wireguard_backend(config, tun, child).await
-        }
-    }
-}
-
-async fn prepare_backend(invocation: &ExecInvocation) -> Result<PreparedBackend> {
-    match invocation.backend {
-        ExecBackendKind::Direct => {
-            let payload = read_optional_payload(invocation.payload_path.as_deref()).await?;
-            let config = DirectConfig::from_payload(&payload)?;
-            let tun_config = socket_tun_config(
-                &config.address,
-                config.mtu,
-                config.tun_name.as_deref(),
-                "burrow-direct",
-            )?;
-            Ok(PreparedBackend::Socket {
-                backend: SocketBackend::Direct,
-                tun_config,
-            })
-        }
-        ExecBackendKind::Tor => {
-            let payload = read_required_payload(invocation.payload_path.as_deref(), "tor").await?;
-            let mut config = TorConfig::from_payload(&payload)?;
-            let (state_dir, cache_dir) = config.runtime_dirs(std::process::id() as i32);
-            config.arti.state_dir = state_dir;
-            config.arti.cache_dir = cache_dir;
-            let tun_config = socket_tun_config(
-                &config.address,
-                config.mtu,
-                config.tun_name.as_deref(),
-                "burrow-tor",
-            )?;
-            let tor_client = bootstrap_client(&config).await?;
-            Ok(PreparedBackend::Socket {
-                backend: SocketBackend::Tor(tor_client),
-                tun_config,
-            })
-        }
-        ExecBackendKind::Wireguard => {
-            let payload =
-                read_required_payload(invocation.payload_path.as_deref(), "wireguard").await?;
-            let config = parse_wireguard_payload(&payload, invocation.payload_path.as_deref())?;
-            let tun_config = wireguard_tun_config(&config)?;
-            Ok(PreparedBackend::Wireguard { config, tun_config })
-        }
-    }
-}
-
-fn spawn_namespaced_child(
-    invocation: &ExecInvocation,
-    tun_config: &TunNetworkConfig,
-) -> Result<NamespaceChild> {
-    ensure_tool("unshare")?;
-    ensure_tool("ip")?;
-
-    let (parent_control, child_control) =
-        StdUnixStream::pair().context("failed to create namespace control socket")?;
-    set_inheritable(child_control.as_raw_fd())?;
-
-    let current_exe = env::current_exe().context("failed to locate current burrow binary")?;
-    let mut cmd = Command::new("unshare");
-    cmd.args([
-        "--user",
-        "--map-root-user",
-        "--net",
-        "--mount",
-        "--pid",
-        "--fork",
-        "--kill-child",
-        "--mount-proc",
-    ]);
-    cmd.env(INNER_ENV, "1");
-    cmd.env(INNER_CONTROL_FD_ENV, child_control.as_raw_fd().to_string());
-    cmd.env(
-        INNER_TUN_CONFIG_ENV,
-        serde_json::to_string(tun_config).context("failed to encode namespace tun config")?,
-    );
-    cmd.arg(current_exe);
-    cmd.arg("exec");
-    cmd.args(["--backend", invocation.backend.cli_name()]);
-    if let Some(payload_path) = &invocation.payload_path {
-        cmd.arg("--payload");
-        cmd.arg(payload_path);
-    }
-    cmd.arg("--");
-    cmd.args(&invocation.command);
-
-    let child = cmd
-        .spawn()
-        .context("failed to enter unshared Linux namespace")?;
-    drop(child_control);
-
-    Ok(NamespaceChild { child, control: parent_control })
-}
-
-async fn run_inner(command: Vec<String>) -> Result<i32> {
-    run_ip(["link", "set", "lo", "up"])?;
-    let tun_config = read_inner_tun_config()?;
-    let tun = open_tun_device(&tun_config)?;
-    configure_tun_addresses(&tun, &tun_config.addresses, tun_config.mtu)?;
-    let name = tun.name().context("failed to retrieve tun device name")?;
-    run_ip(["link", "set", "dev", &name, "up"])?;
-    install_default_routes(&name, &tun_config.addresses)?;
-
-    let control_fd = env::var(INNER_CONTROL_FD_ENV)
-        .context("missing namespace control fd")?
-        .parse::<RawFd>()
-        .context("invalid namespace control fd")?;
-    send_tun_fd(control_fd, tun.as_raw_fd())?;
-    await_parent_ready(control_fd).await?;
-    drop(tun);
-
-    let status = spawn_child(&command).await?;
-    child_exit_code(status)
-}
-
-impl NamespaceChild {
-    async fn receive_tun(&mut self) -> Result<TokioTunInterface> {
-        let control = self
-            .control
-            .try_clone()
-            .context("failed to clone namespace control socket")?;
-        let fd = tokio::task::spawn_blocking(move || recv_tun_fd(&control))
-            .await
-            .context("failed to join namespace tun receive task")??;
-        tokio_tun_from_fd(fd)
-    }
-
-    async fn signal_ready(&self) -> Result<()> {
-        let mut control = self
-            .control
-            .try_clone()
-            .context("failed to clone namespace control socket")?;
-        tokio::task::spawn_blocking(move || -> Result<()> {
-            std::io::Write::write_all(&mut control, READY_ACK)
-                .context("failed to acknowledge namespace readiness")?;
-            Ok(())
-        })
-        .await
-        .context("failed to join namespace ready task")??;
-        Ok(())
-    }
-
-    async fn wait(mut self) -> Result<ExitStatus> {
-        self.child
-            .wait()
-            .await
-            .context("failed to wait for namespace child")
-    }
-}
-
-async fn run_socket_backend(
-    backend: SocketBackend,
-    tun: TokioTunInterface,
-    child: NamespaceChild,
-) -> Result<i32> {
-    let tun = Arc::new(tun);
-    let (stack, runner, udp_socket, tcp_listener) = StackBuilder::default()
-        .stack_buffer_size(1024)
-        .udp_buffer_size(1024)
-        .tcp_buffer_size(1024)
-        .enable_udp(true)
-        .enable_tcp(true)
-        .enable_icmp(true)
-        .build()
-        .context("failed to build userspace netstack")?;
-    let (mut stack_sink, mut stack_stream) = stack.split();
-
-    let mut tasks = JoinSet::new();
-    if let Some(runner) = runner {
-        tasks.spawn(async move { runner.await.map_err(anyhow::Error::from) });
-    }
-
-    {
-        let tun = tun.clone();
-        tasks.spawn(async move {
-            let mut buf = vec![0u8; 65_535];
-            loop {
-                let len = tun
-                    .recv(&mut buf)
-                    .await
-                    .context("failed to read packet from tun")?;
-                if len == 0 {
-                    continue;
-                }
-                stack_sink
-                    .send(buf[..len].to_vec())
-                    .await
-                    .context("failed to send tun packet into userspace stack")?;
-            }
-            #[allow(unreachable_code)]
-            Result::<()>::Ok(())
-        });
-    }
-
-    {
-        let tun = tun.clone();
-        tasks.spawn(async move {
-            while let Some(packet) = stack_stream.next().await {
-                let packet = packet.context("failed to receive packet from userspace stack")?;
-                tun.send(&packet)
-                    .await
-                    .context("failed to write userspace stack packet to tun")?;
-            }
-            Result::<()>::Ok(())
-        });
-    }
-
-    if let Some(tcp_listener) = tcp_listener {
-        let backend = backend.clone();
-        tasks.spawn(async move { tcp_dispatch_loop(tcp_listener, backend).await });
-    }
-
-    if let Some(udp_socket) = udp_socket {
-        tasks.spawn(async move { udp_dispatch_loop(udp_socket, backend).await });
-    }
-
-    child.signal_ready().await?;
-    let status = child.wait().await?;
-
-    tasks.abort_all();
-    while let Some(joined) = tasks.join_next().await {
-        match joined {
-            Ok(Ok(())) => {}
-            Ok(Err(err)) => debug!(?err, "usernet background task exited with error"),
-            Err(err) if err.is_cancelled() => {}
-            Err(err) => debug!(?err, "usernet background task panicked"),
-        }
-    }
-
-    child_exit_code(status)
-}
-
-async fn run_wireguard_backend(
-    config: WireGuardConfig,
-    tun: TokioTunInterface,
-    child: NamespaceChild,
-) -> Result<i32> {
-    let interface: WireGuardInterface = config.try_into()?;
-    interface.set_tun(tun).await;
-    let interface = Arc::new(interface);
-    let runner = {
-        let interface = interface.clone();
-        tokio::spawn(async move { interface.run().await })
-    };
-
-    child.signal_ready().await?;
-    let status = child.wait().await?;
-
-    interface.remove_tun().await;
-    match runner.await {
-        Ok(Ok(())) => {}
-        Ok(Err(err)) => debug!(?err, "wireguard exec runtime exited with error"),
-        Err(err) if err.is_cancelled() => {}
-        Err(err) => debug!(?err, "wireguard exec runtime panicked"),
-    }
-
-    child_exit_code(status)
-}
-
-async fn tcp_dispatch_loop(mut listener: StackTcpListener, backend: SocketBackend) -> Result<()> {
-    let mut tasks = JoinSet::new();
-    loop {
-        tokio::select! {
-            Some(result) = tasks.join_next(), if !tasks.is_empty() => {
-                match result {
-                    Ok(Ok(())) => {}
-                    Ok(Err(err)) => warn!(?err, "tcp bridge task failed"),
-                    Err(err) if err.is_cancelled() => {}
-                    Err(err) => warn!(?err, "tcp bridge task panicked"),
-                }
-            }
-            next = listener.next() => match next {
-                Some((stream, local_addr, remote_addr)) => {
-                    debug!(%local_addr, %remote_addr, "accepted userspace tcp stream");
-                    let backend = backend.clone();
-                    tasks.spawn(async move {
-                        bridge_tcp(backend, stream, local_addr, remote_addr).await
-                    });
-                }
-                None => break,
-            }
-        }
-    }
-
-    tasks.abort_all();
-    while let Some(result) = tasks.join_next().await {
-        match result {
-            Ok(Ok(())) => {}
-            Ok(Err(err)) => debug!(?err, "tcp bridge task exited during shutdown"),
-            Err(err) if err.is_cancelled() => {}
-            Err(err) => debug!(?err, "tcp bridge task panicked during shutdown"),
-        }
-    }
-    Ok(())
-}
-
-async fn bridge_tcp(
-    backend: SocketBackend,
-    mut inbound: StackTcpStream,
-    _local_addr: SocketAddr,
-    remote_addr: SocketAddr,
-) -> Result<()> {
-    match backend {
-        SocketBackend::Direct => {
-            debug!(%remote_addr, "dialing direct outbound tcp");
-            let mut outbound = TcpStream::connect(remote_addr)
-                .await
-                .with_context(|| format!("failed to connect to {remote_addr}"))?;
-            copy_bidirectional(&mut inbound, &mut outbound)
-                .await
-                .with_context(|| format!("failed to bridge tcp stream for {remote_addr}"))?;
-        }
-        SocketBackend::Tor(tor_client) => {
-            debug!(%remote_addr, "dialing tor outbound tcp");
-            let tor_stream = tor_client
-                .connect((remote_addr.ip().to_string(), remote_addr.port()))
-                .await
-                .with_context(|| format!("failed to connect to {remote_addr} over tor"))?;
-            let mut tor_stream = tor_stream.compat();
-            copy_bidirectional(&mut inbound, &mut tor_stream)
-                .await
-                .with_context(|| format!("failed to bridge tor stream for {remote_addr}"))?;
-        }
-    }
-    Ok(())
-}
-
-async fn udp_dispatch_loop(socket: StackUdpSocket, backend: SocketBackend) -> Result<()> {
-    let (mut udp_reader, mut udp_writer) = socket.split();
-    let (reply_tx, mut reply_rx) = mpsc::channel::<UdpReply>(128);
-    let direct_sessions = Arc::new(Mutex::new(
-        HashMap::<UdpFlowKey, mpsc::Sender<Vec<u8>>>::new(),
-    ));
-    let mut session_tasks = JoinSet::new();
-
-    loop {
-        tokio::select! {
-            Some(result) = session_tasks.join_next(), if !session_tasks.is_empty() => {
-                match result {
-                    Ok(Ok(())) => {}
-                    Ok(Err(err)) => warn!(?err, "udp session task failed"),
-                    Err(err) if err.is_cancelled() => {}
-                    Err(err) => warn!(?err, "udp session task panicked"),
-                }
-            }
-            maybe_reply = reply_rx.recv() => match maybe_reply {
-                Some(reply) => {
-                    udp_writer
-                        .send((reply.payload, reply.source, reply.destination))
-                        .await
-                        .context("failed to write udp reply into userspace stack")?;
-                }
-                None => break,
-            },
-            maybe_datagram = udp_reader.next() => match maybe_datagram {
-                Some((payload, local_addr, remote_addr)) => {
-                    match &backend {
-                        SocketBackend::Direct => {
-                            dispatch_direct_udp(
-                                payload,
-                                local_addr,
-                                remote_addr,
-                                reply_tx.clone(),
-                                direct_sessions.clone(),
-                                &mut session_tasks,
-                            ).await?;
-                        }
-                        SocketBackend::Tor(tor_client) => {
-                            if remote_addr.port() != 53 {
-                                debug!(%remote_addr, "dropping non-DNS UDP datagram for tor backend");
-                                continue;
-                            }
-                            let response = build_tor_dns_response(&payload, tor_client.as_ref()).await?;
-                            reply_tx
-                                .send(UdpReply {
-                                    payload: response,
-                                    source: remote_addr,
-                                    destination: local_addr,
-                                })
-                                .await
-                                .context("failed to enqueue tor dns response")?;
-                        }
-                    }
-                }
-                None => break,
-            }
-        }
-    }
-
-    session_tasks.abort_all();
-    while let Some(result) = session_tasks.join_next().await {
-        match result {
-            Ok(Ok(())) => {}
-            Ok(Err(err)) => debug!(?err, "udp session task exited during shutdown"),
-            Err(err) if err.is_cancelled() => {}
-            Err(err) => debug!(?err, "udp session task panicked during shutdown"),
-        }
-    }
-    Ok(())
-}
-
-async fn dispatch_direct_udp(
-    payload: Vec<u8>,
-    local_addr: SocketAddr,
-    remote_addr: SocketAddr,
-    reply_tx: mpsc::Sender<UdpReply>,
-    sessions: Arc<Mutex<HashMap<UdpFlowKey, mpsc::Sender<Vec<u8>>>>>,
-    session_tasks: &mut JoinSet<Result<()>>,
-) -> Result<()> {
-    let key = UdpFlowKey {
-        local: local_addr,
-        remote: remote_addr,
-    };
-    let existing = { sessions.lock().await.get(&key).cloned() };
-    if let Some(sender) = existing {
-        if sender.send(payload.clone()).await.is_ok() {
-            return Ok(());
-        }
-        sessions.lock().await.remove(&key);
-    }
-
-    let (tx, rx) = mpsc::channel::<Vec<u8>>(32);
-    tx.send(payload)
-        .await
-        .context("failed to enqueue outbound udp payload")?;
-    sessions.lock().await.insert(key.clone(), tx);
-
-    session_tasks.spawn(async move { run_direct_udp_session(key, rx, reply_tx, sessions).await });
-    Ok(())
-}
-
-async fn run_direct_udp_session(
-    key: UdpFlowKey,
-    mut outbound_rx: mpsc::Receiver<Vec<u8>>,
-    reply_tx: mpsc::Sender<UdpReply>,
-    sessions: Arc<Mutex<HashMap<UdpFlowKey, mpsc::Sender<Vec<u8>>>>>,
-) -> Result<()> {
-    let bind_addr = match key.remote {
-        SocketAddr::V4(_) => SocketAddr::new(IpAddr::V4(Ipv4Addr::UNSPECIFIED), 0),
-        SocketAddr::V6(_) => SocketAddr::new(IpAddr::V6(Ipv6Addr::UNSPECIFIED), 0),
-    };
-    let socket = UdpSocket::bind(bind_addr)
-        .await
-        .with_context(|| format!("failed to bind udp socket for {}", key.remote))?;
-    socket
-        .connect(key.remote)
-        .await
-        .with_context(|| format!("failed to connect udp socket to {}", key.remote))?;
-
-    let mut buf = vec![0u8; 65_535];
-    loop {
-        tokio::select! {
-            maybe_payload = outbound_rx.recv() => match maybe_payload {
-                Some(payload) => {
-                    socket
-                        .send(&payload)
-                        .await
-                        .with_context(|| format!("failed to send udp payload to {}", key.remote))?;
-                }
-                None => break,
-            },
-            recv = tokio::time::timeout(UDP_IDLE_TIMEOUT, socket.recv(&mut buf)) => match recv {
-                Ok(Ok(len)) => {
-                    reply_tx
-                        .send(UdpReply {
-                            payload: buf[..len].to_vec(),
-                            source: key.remote,
-                            destination: key.local,
-                        })
-                        .await
-                        .context("failed to enqueue inbound udp reply")?;
-                }
-                Ok(Err(err)) => return Err(err).with_context(|| format!("failed to receive udp response from {}", key.remote)),
-                Err(_) => break,
-            }
-        }
-    }
-
-    sessions.lock().await.remove(&key);
-    Ok(())
-}
-
-fn wireguard_tun_config(config: &WireGuardConfig) -> Result<TunNetworkConfig> {
-    parse_tun_config(
-        &config.interface.address,
-        config.interface.mtu,
-        Some("burrow-wireguard"),
-    )
-}
-
-fn socket_tun_config(
-    addresses: &[String],
-    mtu: Option<u32>,
-    tun_name: Option<&str>,
-    default_name: &str,
-) -> Result<TunNetworkConfig> {
-    let default_addresses;
-    let addresses = if addresses.is_empty() {
-        default_addresses = vec![DEFAULT_TUN_V4.to_string(), DEFAULT_TUN_V6.to_string()];
-        default_addresses.as_slice()
-    } else {
-        addresses
-    };
-    parse_tun_config(addresses, mtu, Some(tun_name.unwrap_or(default_name)))
-}
-
-fn parse_tun_config(
-    addresses: &[String],
-    mtu: Option<u32>,
-    tun_name: Option<&str>,
-) -> Result<TunNetworkConfig> {
-    let addresses = addresses
-        .iter()
-        .map(|addr| {
-            addr.parse::<IpNetwork>()
-                .with_context(|| format!("invalid tunnel address '{addr}'"))
-        })
-        .collect::<Result<Vec<_>>>()?;
-
-    Ok(TunNetworkConfig {
-        tun_name: tun_name.unwrap_or("burrow-exec").to_string(),
-        addresses,
-        mtu: mtu.unwrap_or(DEFAULT_MTU),
-    })
-}
-
-fn open_tun_device(config: &TunNetworkConfig) -> Result<tun::TunInterface> {
-    let tun = TunOptions::new()
-        .name(&config.tun_name)
-        .no_pi(true)
-        .tun_excl(true)
-        .open()
-        .context("failed to create tun device")?;
-    Ok(tun.inner.into_inner())
-}
-
-fn tokio_tun_from_fd(fd: RawFd) -> Result<TokioTunInterface> {
-    let tun = unsafe { tun::TunInterface::from_raw_fd(fd) };
-    TokioTunInterface::new(tun).context("failed to wrap tun fd in tokio interface")
-}
-
-fn read_inner_tun_config() -> Result<TunNetworkConfig> {
-    let raw = env::var(INNER_TUN_CONFIG_ENV).context("missing namespace tun config")?;
-    serde_json::from_str(&raw).context("invalid namespace tun config")
-}
-
-fn configure_tun_addresses(
-    iface: &tun::TunInterface,
-    networks: &[IpNetwork],
-    mtu: u32,
-) -> Result<()> {
-    for network in networks {
-        match network {
-            IpNetwork::V4(net) => {
-                iface.set_ipv4_addr(net.ip())?;
-                let netmask = prefix_to_netmask_v4(net.prefix());
-                iface.set_netmask(netmask)?;
-                iface.set_broadcast_addr(broadcast_v4(net.ip(), netmask))?;
-            }
-            IpNetwork::V6(net) => iface.add_ipv6_addr(net.ip(), net.prefix())?,
-        }
-    }
-    iface.set_mtu(mtu as i32)?;
-    Ok(())
-}
-
-fn install_default_routes(name: &str, networks: &[IpNetwork]) -> Result<()> {
-    if networks
-        .iter()
-        .any(|network| matches!(network, IpNetwork::V4(_)))
-    {
-        run_ip(["route", "replace", "default", "dev", name])?;
-    }
-    if networks
-        .iter()
-        .any(|network| matches!(network, IpNetwork::V6(_)))
-    {
-        run_ip(["-6", "route", "replace", "default", "dev", name])?;
-    }
-    Ok(())
-}
-
-fn run_ip<const N: usize>(args: [&str; N]) -> Result<()> {
-    let status = StdCommand::new("ip")
-        .args(args)
-        .status()
-        .context("failed to execute ip command")?;
-    if !status.success() {
-        bail!("ip {} failed with status {}", args.join(" "), status);
-    }
-    Ok(())
-}
-
-fn set_inheritable(fd: RawFd) -> Result<()> {
-    let flags = FdFlag::from_bits_truncate(
-        fcntl(fd, FcntlArg::F_GETFD).context("failed to query descriptor flags")?,
-    );
-    let flags = flags & !FdFlag::FD_CLOEXEC;
-    fcntl(fd, FcntlArg::F_SETFD(flags)).context("failed to clear close-on-exec")?;
-    Ok(())
-}
-
-async fn await_parent_ready(control_fd: RawFd) -> Result<()> {
-    tokio::task::spawn_blocking(move || -> Result<()> {
-        let mut control = unsafe { StdUnixStream::from_raw_fd(control_fd) };
-        let mut ack = [0u8; 1];
-        std::io::Read::read_exact(&mut control, &mut ack)
-            .context("failed to read namespace ready ack")?;
-        if ack != *READY_ACK {
-            bail!("unexpected namespace ready ack");
-        }
-        Ok(())
-    })
-    .await
-    .context("failed to join namespace ready wait task")??;
-    Ok(())
-}
-
-fn send_tun_fd(control_fd: RawFd, tun_fd: RawFd) -> Result<()> {
-    let buf = [0u8; 1];
-    let iov = [std::io::IoSlice::new(&buf)];
-    let fds = [tun_fd];
-    sendmsg::<()>(
-        control_fd,
-        &iov,
-        &[ControlMessage::ScmRights(&fds)],
-        MsgFlags::empty(),
-        None,
-    )
-    .context("failed to send tun fd to parent")?;
-    Ok(())
-}
-
-fn recv_tun_fd(control: &StdUnixStream) -> Result<RawFd> {
-    let mut buf = [0u8; 1];
-    let mut iov = [std::io::IoSliceMut::new(&mut buf)];
-    let mut cmsgspace = cmsg_space!([RawFd; 1]);
-    let msg = recvmsg::<()>(
-        control.as_raw_fd(),
-        &mut iov,
-        Some(&mut cmsgspace),
-        MsgFlags::empty(),
-    )
-    .context("failed to receive tun fd from namespace child")?;
-    for cmsg in msg.cmsgs() {
-        if let ControlMessageOwned::ScmRights(fds) = cmsg {
-            if let Some(fd) = fds.first() {
-                return Ok(*fd);
-            }
-        }
-    }
-    bail!("namespace child did not send a tun fd")
-}
-
-fn ensure_tool(tool: &str) -> Result<()> {
-    let status = StdCommand::new("sh")
-        .args(["-lc", &format!("command -v {tool} >/dev/null")])
-        .status()
-        .with_context(|| format!("failed to probe required tool '{tool}'"))?;
-    if !status.success() {
-        bail!("required host tool '{tool}' is not available");
-    }
-    Ok(())
-}
-
-async fn read_optional_payload(path: Option<&Path>) -> Result<Vec<u8>> {
-    match path {
-        Some(path) => tokio::fs::read(path)
-            .await
-            .with_context(|| format!("failed to read payload from {}", path.display())),
-        None => Ok(Vec::new()),
-    }
-}
-
-async fn read_required_payload(path: Option<&Path>, backend: &str) -> Result<Vec<u8>> {
-    let path = path.ok_or_else(|| anyhow!("{backend} exec requires --payload"))?;
-    tokio::fs::read(path)
-        .await
-        .with_context(|| format!("failed to read payload from {}", path.display()))
-}
-
-fn parse_wireguard_payload(payload: &[u8], path: Option<&Path>) -> Result<WireGuardConfig> {
-    let payload = str::from_utf8(payload).context("wireguard payload must be valid UTF-8")?;
-    if let Some(path) = path {
-        if let Some(ext) = path.extension().and_then(|ext| ext.to_str()) {
-            return WireGuardConfig::from_content_fmt(payload, ext);
-        }
-    }
-
-    WireGuardConfig::from_toml(payload).or_else(|_| WireGuardConfig::from_ini(payload))
-}
-
-async fn spawn_child(command: &[String]) -> Result<ExitStatus> {
-    let mut cmd = Command::new(&command[0]);
-    if command.len() > 1 {
-        cmd.args(&command[1..]);
-    }
-    cmd.stdin(std::process::Stdio::inherit());
-    cmd.stdout(std::process::Stdio::inherit());
-    cmd.stderr(std::process::Stdio::inherit());
-    cmd.kill_on_drop(true);
-    cmd.status()
-        .await
-        .with_context(|| format!("failed to spawn '{}'", command[0]))
-}
-
-fn child_exit_code(status: ExitStatus) -> Result<i32> {
-    if let Some(code) = status.code() {
-        return Ok(code);
-    }
-    if let Some(signal) = status.signal() {
-        return Ok(128 + signal);
-    }
-    bail!("child process terminated without an exit code");
-}
-
-fn prefix_to_netmask_v4(prefix: u8) -> Ipv4Addr {
-    if prefix == 0 {
-        Ipv4Addr::new(0, 0, 0, 0)
-    } else {
-        let mask = (!0u32) << (32 - prefix);
-        Ipv4Addr::from(mask)
-    }
-}
-
-fn broadcast_v4(ip: Ipv4Addr, netmask: Ipv4Addr) -> Ipv4Addr {
-    let ip_u32 = u32::from(ip);
-    let mask = u32::from(netmask);
-    Ipv4Addr::from(ip_u32 | !mask)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn parses_direct_json_payload() {
-        let payload = br#"{"address":["10.0.0.2/24"],"mtu":1400,"tun_name":"burrow0"}"#;
-        let config = DirectConfig::from_payload(payload).unwrap();
-        assert_eq!(config.address, vec!["10.0.0.2/24"]);
-        assert_eq!(config.mtu, Some(1400));
-        assert_eq!(config.tun_name.as_deref(), Some("burrow0"));
-    }
-
-    #[test]
-    fn socket_tun_config_uses_dual_stack_defaults() {
-        let config = socket_tun_config(&[], None, None, "burrow-test").unwrap();
-        assert_eq!(config.tun_name, "burrow-test");
-        assert!(config
-            .addresses
-            .iter()
-            .any(|network| matches!(network, IpNetwork::V4(_))));
-        assert!(config
-            .addresses
-            .iter()
-            .any(|network| matches!(network, IpNetwork::V6(_))));
-    }
-}
diff --git a/burrow/src/wireguard/config.rs b/burrow/src/wireguard/config.rs
index 5766675..afe7499 100644
--- a/burrow/src/wireguard/config.rs
+++ b/burrow/src/wireguard/config.rs
@@ -3,12 +3,9 @@ use std::{net::ToSocketAddrs, str::FromStr};
 use anyhow::{anyhow, Error, Result};
 use base64::{engine::general_purpose, Engine};
 use fehler::throws;
-use ini::{Ini, Properties};
 use ip_network::IpNetwork;
-use serde::{Deserialize, Serialize};
 use x25519_dalek::{PublicKey, StaticSecret};
 
-use super::inifield::IniField;
 use crate::wireguard::{Interface as WgInterface, Peer as WgPeer};
 
 #[throws]
@@ -34,7 +31,6 @@ fn parse_public_key(string: &str) -> PublicKey {
 /// A raw version of Peer Config that can be used later to reflect configuration files.
 /// This should be later converted to a `WgPeer`.
 /// Refers to https://github.com/pirate/wireguard-docs?tab=readme-ov-file#overview
-#[derive(Debug, Clone, Eq, PartialEq, Serialize, Deserialize)]
 pub struct Peer {
     pub public_key: String,
     pub preshared_key: Option<String>,
@@ -44,18 +40,15 @@ pub struct Peer {
     pub name: Option<String>,
 }
 
-#[derive(Debug, Clone, Eq, PartialEq, Serialize, Deserialize)]
 pub struct Interface {
     pub private_key: String,
-    pub address: Vec<String>,
-    pub listen_port: Option<u32>,
+    pub address: String,
+    pub listen_port: u32,
     pub dns: Vec<String>,
     pub mtu: Option<u32>,
 }
 
-#[derive(Debug, Clone, Eq, PartialEq, Serialize, Deserialize)]
 pub struct Config {
-    #[serde(rename = "Peer")]
     pub peers: Vec<Peer>,
     pub interface: Interface, // Support for multiple interfaces?
 }
@@ -100,100 +93,20 @@ impl Default for Config {
     fn default() -> Self {
         Self {
             interface: Interface {
-                private_key: "OEPVdomeLTxTIBvv3TYsJRge0Hp9NMiY0sIrhT8OWG8=".into(),
-                address: vec!["10.13.13.2/24".into()],
-                listen_port: Some(51820),
+                private_key: "GNqIAOCRxjl/cicZyvkvpTklgQuUmGUIEkH7IXF/sEE=".into(),
+                address: "10.13.13.2/24".into(),
+                listen_port: 51820,
                 dns: Default::default(),
                 mtu: Default::default(),
             },
             peers: vec![Peer {
                 endpoint: "wg.burrow.rs:51820".into(),
                 allowed_ips: vec!["8.8.8.8/32".into(), "0.0.0.0/0".into()],
-                public_key: "8GaFjVO6c4luCHG4ONO+1bFG8tO+Zz5/Gy+Geht1USM=".into(),
-                preshared_key: Some("ha7j4BjD49sIzyF9SNlbueK0AMHghlj6+u0G3bzC698=".into()),
+                public_key: "uy75leriJay0+oHLhRMpV+A5xAQ0hCJ+q7Ww81AOvT4=".into(),
+                preshared_key: Some("s7lx/mg+reVEMnGnqeyYOQkzD86n2+gYnx1M9ygi08k=".into()),
                 persistent_keepalive: Default::default(),
                 name: Default::default(),
             }],
         }
     }
 }
-
-fn props_get<T>(props: &Properties, key: &str) -> Result<T>
-where
-    T: TryFrom<IniField, Error = anyhow::Error>,
-{
-    IniField::try_from(props.get(key))?.try_into()
-}
-
-impl TryFrom<&Properties> for Interface {
-    type Error = anyhow::Error;
-
-    fn try_from(props: &Properties) -> Result<Self, Error> {
-        Ok(Self {
-            private_key: props_get(props, "PrivateKey")?,
-            address: props_get(props, "Address")?,
-            listen_port: props_get(props, "ListenPort")?,
-            dns: props_get(props, "DNS")?,
-            mtu: props_get(props, "MTU")?,
-        })
-    }
-}
-
-impl TryFrom<&Properties> for Peer {
-    type Error = anyhow::Error;
-
-    fn try_from(props: &Properties) -> Result<Self, Error> {
-        Ok(Self {
-            public_key: props_get(props, "PublicKey")?,
-            preshared_key: props_get(props, "PresharedKey")?,
-            allowed_ips: props_get(props, "AllowedIPs")?,
-            endpoint: props_get(props, "Endpoint")?,
-            persistent_keepalive: props_get(props, "PersistentKeepalive")?,
-            name: props_get(props, "Name")?,
-        })
-    }
-}
-
-impl Config {
-    pub fn from_toml(toml: &str) -> Result<Self> {
-        toml::from_str(toml).map_err(Into::into)
-    }
-
-    pub fn from_ini(ini: &str) -> Result<Self> {
-        let ini = Ini::load_from_str(ini)?;
-        let interface = ini
-            .section(Some("Interface"))
-            .ok_or(anyhow!("Interface section not found"))?;
-        let peers = ini.section_all(Some("Peer"));
-        Ok(Self {
-            interface: Interface::try_from(interface)?,
-            peers: peers
-                .into_iter()
-                .map(|v| Peer::try_from(v))
-                .collect::<Result<Vec<Peer>>>()?,
-        })
-    }
-
-    pub fn from_content_fmt(content: &str, fmt: &str) -> Result<Self> {
-        match fmt {
-            "toml" => Self::from_toml(content),
-            "ini" | "conf" => Self::from_ini(content),
-            _ => Err(anyhow::anyhow!("Unsupported format: {}", fmt)),
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn tst_config_toml() {
-        let cfig = Config::default();
-        let toml = toml::to_string(&cfig).unwrap();
-        println!("{}", &toml);
-        insta::assert_snapshot!(toml);
-        let cfig2: Config = toml::from_str(&toml).unwrap();
-        assert_eq!(cfig, cfig2);
-    }
-}
diff --git a/burrow/src/wireguard/iface.rs b/burrow/src/wireguard/iface.rs
index 5b61861..620c96c 100755
--- a/burrow/src/wireguard/iface.rs
+++ b/burrow/src/wireguard/iface.rs
@@ -1,26 +1,20 @@
-use std::{net::IpAddr, ops::Deref, sync::Arc};
+use std::{net::IpAddr, sync::Arc};
 
 use anyhow::Error;
 use fehler::throws;
 use futures::future::join_all;
 use ip_network_table::IpNetworkTable;
-use tokio::sync::{Notify, RwLock};
+use tokio::sync::RwLock;
 use tracing::{debug, error};
 use tun::tokio::TunInterface;
 
 use super::{noise::Tunnel, Peer, PeerPcb};
 
-pub struct IndexedPcbs {
+struct IndexedPcbs {
     pcbs: Vec<Arc<PeerPcb>>,
     allowed_ips: IpNetworkTable<usize>,
 }
 
-impl Default for IndexedPcbs {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
 impl IndexedPcbs {
     pub fn new() -> Self {
         Self {
@@ -52,21 +46,9 @@ impl FromIterator<PeerPcb> for IndexedPcbs {
     }
 }
 
-enum IfaceStatus {
-    Running,
-    Idle,
-}
-
 pub struct Interface {
-    pub tun: Arc<RwLock<Option<TunInterface>>>,
-    pub pcbs: Arc<IndexedPcbs>,
-    status: Arc<RwLock<IfaceStatus>>,
-    stop_notifier: Arc<Notify>,
-}
-
-async fn is_running(status: Arc<RwLock<IfaceStatus>>) -> bool {
-    let st = status.read().await;
-    matches!(st.deref(), IfaceStatus::Running)
+    tun: Option<Arc<RwLock<TunInterface>>>,
+    pcbs: Arc<IndexedPcbs>,
 }
 
 impl Interface {
@@ -78,77 +60,49 @@ impl Interface {
             .collect::<Result<_, _>>()?;
 
         let pcbs = Arc::new(pcbs);
-        Self {
-            pcbs,
-            tun: Arc::new(RwLock::new(None)),
-            status: Arc::new(RwLock::new(IfaceStatus::Idle)),
-            stop_notifier: Arc::new(Notify::new()),
-        }
+        Self { pcbs, tun: None }
     }
 
-    pub async fn set_tun(&self, tun: TunInterface) {
-        debug!("Setting tun interface");
-        self.tun.write().await.replace(tun);
-        let mut st = self.status.write().await;
-        *st = IfaceStatus::Running;
-    }
-
-    pub async fn set_tun_ref(&mut self, tun: Arc<RwLock<Option<TunInterface>>>) {
-        self.tun = tun;
-        let mut st = self.status.write().await;
-        *st = IfaceStatus::Running;
-    }
-
-    pub fn get_tun(&self) -> Arc<RwLock<Option<TunInterface>>> {
-        self.tun.clone()
-    }
-
-    pub async fn remove_tun(&self) {
-        let mut st = self.status.write().await;
-        self.stop_notifier.notify_waiters();
-        *st = IfaceStatus::Idle;
+    pub fn set_tun(&mut self, tun: Arc<RwLock<TunInterface>>) {
+        self.tun = Some(tun);
     }
 
     pub async fn run(&self) -> anyhow::Result<()> {
         let pcbs = self.pcbs.clone();
-        let tun = self.tun.clone();
-        let status = self.status.clone();
-        let stop_notifier = self.stop_notifier.clone();
+        let tun = self
+            .tun
+            .clone()
+            .ok_or(anyhow::anyhow!("tun interface does not exist"))?;
         log::info!("Starting interface");
 
         let outgoing = async move {
-            while is_running(status.clone()).await {
+            loop {
                 let mut buf = [0u8; 3000];
 
                 let src = {
-                    let t = tun.read().await;
-                    let Some(_tun) = t.as_ref() else {
-                        continue;
+                    let src = match tun.read().await.recv(&mut buf[..]).await {
+                        Ok(len) => &buf[..len],
+                        Err(e) => {
+                            error!("Failed to read from interface: {}", e);
+                            continue
+                        }
                     };
-                    tokio::select! {
-                        _ = stop_notifier.notified() => continue,
-                        pkg = _tun.recv(&mut buf[..]) => match pkg {
-                            Ok(len) => &buf[..len],
-                            Err(e) => {
-                                error!("Failed to read from interface: {}", e);
-                                continue
-                            }
-                        },
-                    }
+                    debug!("Read {} bytes from interface", src.len());
+                    src
                 };
 
                 let dst_addr = match Tunnel::dst_address(src) {
                     Some(addr) => addr,
                     None => {
                         debug!("No destination found");
-                        continue;
+                        continue
                     }
                 };
 
                 debug!("Routing packet to {}", dst_addr);
 
                 let Some(idx) = pcbs.find(dst_addr) else {
-                    continue;
+                    continue
                 };
 
                 debug!("Found peer:{}", idx);
@@ -160,14 +114,17 @@ impl Interface {
                     }
                     Err(e) => {
                         log::error!("Failed to send packet {}", e);
-                        continue;
+                        continue
                     }
                 };
             }
         };
 
         let mut tsks = vec![];
-        let tun = self.tun.clone();
+        let tun = self
+            .tun
+            .clone()
+            .ok_or(anyhow::anyhow!("tun interface does not exist"))?;
         let outgoing = tokio::task::spawn(outgoing);
         tsks.push(outgoing);
         debug!("preparing to spawn read tasks");
@@ -181,7 +138,7 @@ impl Interface {
                 let main_tsk = async move {
                     if let Err(e) = pcb.open_if_closed().await {
                         log::error!("failed to open pcb: {}", e);
-                        return;
+                        return
                     }
                     let r2 = pcb.run(tun).await;
                     if let Err(e) = r2 {
@@ -192,25 +149,23 @@ impl Interface {
                 };
 
                 let pcb = pcbs.pcbs[i].clone();
-                let status = self.status.clone();
                 let update_timers_tsk = async move {
                     let mut buf = [0u8; 65535];
-                    while is_running(status.clone()).await {
+                    loop {
                         tokio::time::sleep(tokio::time::Duration::from_millis(250)).await;
                         match pcb.update_timers(&mut buf).await {
                             Ok(..) => (),
                             Err(e) => {
                                 error!("Failed to update timers: {}", e);
-                                return;
+                                return
                             }
                         }
                     }
                 };
 
                 let pcb = pcbs.pcbs[i].clone();
-                let status = self.status.clone();
                 let reset_rate_limiter_tsk = async move {
-                    while is_running(status.clone()).await {
+                    loop {
                         tokio::time::sleep(tokio::time::Duration::from_secs(1)).await;
                         pcb.reset_rate_limiter().await;
                     }
diff --git a/burrow/src/wireguard/inifield.rs b/burrow/src/wireguard/inifield.rs
deleted file mode 100644
index 946868d..0000000
--- a/burrow/src/wireguard/inifield.rs
+++ /dev/null
@@ -1,81 +0,0 @@
-use std::str::FromStr;
-
-use anyhow::{Error, Result};
-
-pub struct IniField(String);
-
-impl FromStr for IniField {
-    type Err = Error;
-
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        Ok(Self(s.to_string()))
-    }
-}
-
-impl TryFrom<IniField> for Vec<String> {
-    type Error = Error;
-
-    fn try_from(field: IniField) -> Result<Self, Self::Error> {
-        Ok(field.0.split(',').map(|s| s.trim().to_string()).collect())
-    }
-}
-
-impl TryFrom<IniField> for u32 {
-    type Error = Error;
-
-    fn try_from(value: IniField) -> Result<Self, Self::Error> {
-        value.0.parse().map_err(Error::from)
-    }
-}
-
-impl TryFrom<IniField> for Option<u32> {
-    type Error = Error;
-
-    fn try_from(value: IniField) -> Result<Self, Self::Error> {
-        if value.0.is_empty() {
-            Ok(None)
-        } else {
-            value.0.parse().map(Some).map_err(Error::from)
-        }
-    }
-}
-
-impl TryFrom<IniField> for String {
-    type Error = Error;
-
-    fn try_from(value: IniField) -> Result<Self, Self::Error> {
-        Ok(value.0)
-    }
-}
-
-impl TryFrom<IniField> for Option<String> {
-    type Error = Error;
-
-    fn try_from(value: IniField) -> Result<Self, Self::Error> {
-        if value.0.is_empty() {
-            Ok(None)
-        } else {
-            Ok(Some(value.0))
-        }
-    }
-}
-
-impl<T> TryFrom<Option<T>> for IniField
-where
-    T: ToString,
-{
-    type Error = Error;
-
-    fn try_from(value: Option<T>) -> Result<Self, Self::Error> {
-        Ok(match value {
-            Some(v) => Self(v.to_string()),
-            None => Self(String::new()),
-        })
-    }
-}
-
-impl IniField {
-    fn new(value: &str) -> Self {
-        Self(value.to_string())
-    }
-}
diff --git a/burrow/src/wireguard/mod.rs b/burrow/src/wireguard/mod.rs
index cfb4585..15563fb 100755
--- a/burrow/src/wireguard/mod.rs
+++ b/burrow/src/wireguard/mod.rs
@@ -1,6 +1,5 @@
-pub mod config;
+mod config;
 mod iface;
-mod inifield;
 mod noise;
 mod pcb;
 mod peer;
diff --git a/burrow/src/wireguard/noise/handshake.rs b/burrow/src/wireguard/noise/handshake.rs
index 65136bc..2ec0c6a 100755
--- a/burrow/src/wireguard/noise/handshake.rs
+++ b/burrow/src/wireguard/noise/handshake.rs
@@ -9,15 +9,20 @@ use std::{
 use aead::{Aead, Payload};
 use blake2::{
     digest::{FixedOutput, KeyInit},
-    Blake2s256, Blake2sMac, Digest,
+    Blake2s256,
+    Blake2sMac,
+    Digest,
 };
 use chacha20poly1305::XChaCha20Poly1305;
 use rand_core::OsRng;
 use ring::aead::{Aad, LessSafeKey, Nonce, UnboundKey, CHACHA20_POLY1305};
-use subtle::ConstantTimeEq;
 
 use super::{
-    errors::WireGuardError, session::Session, x25519, HandshakeInit, HandshakeResponse,
+    errors::WireGuardError,
+    session::Session,
+    x25519,
+    HandshakeInit,
+    HandshakeResponse,
     PacketCookieReply,
 };
 
@@ -204,7 +209,7 @@ impl Tai64N {
     /// Parse a timestamp from a 12 byte u8 slice
     fn parse(buf: &[u8; 12]) -> Result<Tai64N, WireGuardError> {
         if buf.len() < 12 {
-            return Err(WireGuardError::InvalidTai64nTimestamp);
+            return Err(WireGuardError::InvalidTai64nTimestamp)
         }
 
         let (sec_bytes, nano_bytes) = buf.split_at(std::mem::size_of::<u64>());
@@ -529,14 +534,11 @@ impl Handshake {
             &hash,
         )?;
 
-        if !bool::from(
-            self.params
-                .peer_static_public
-                .as_bytes()
-                .ct_eq(&peer_static_public_decrypted),
-        ) {
-            return Err(WireGuardError::WrongKey);
-        }
+        ring::constant_time::verify_slices_are_equal(
+            self.params.peer_static_public.as_bytes(),
+            &peer_static_public_decrypted,
+        )
+        .map_err(|_| WireGuardError::WrongKey)?;
 
         // initiator.hash = HASH(initiator.hash || msg.encrypted_static)
         hash = b2s_hash(&hash, packet.encrypted_static);
@@ -554,22 +556,19 @@ impl Handshake {
         let timestamp = Tai64N::parse(&timestamp)?;
         if !timestamp.after(&self.last_handshake_timestamp) {
             // Possibly a replay
-            return Err(WireGuardError::WrongTai64nTimestamp);
+            return Err(WireGuardError::WrongTai64nTimestamp)
         }
         self.last_handshake_timestamp = timestamp;
 
         // initiator.hash = HASH(initiator.hash || msg.encrypted_timestamp)
         hash = b2s_hash(&hash, packet.encrypted_timestamp);
 
-        self.previous = std::mem::replace(
-            &mut self.state,
-            HandshakeState::InitReceived {
-                chaining_key,
-                hash,
-                peer_ephemeral_public,
-                peer_index,
-            },
-        );
+        self.previous = std::mem::replace(&mut self.state, HandshakeState::InitReceived {
+            chaining_key,
+            hash,
+            peer_ephemeral_public,
+            peer_index,
+        });
 
         self.format_handshake_response(dst)
     }
@@ -670,7 +669,7 @@ impl Handshake {
 
         let local_index = self.cookies.index;
         if packet.receiver_idx != local_index {
-            return Err(WireGuardError::WrongIndex);
+            return Err(WireGuardError::WrongIndex)
         }
         // msg.encrypted_cookie = XAEAD(HASH(LABEL_COOKIE || responder.static_public),
         // msg.nonce, cookie, last_received_msg.mac1)
@@ -726,7 +725,7 @@ impl Handshake {
         dst: &'a mut [u8],
     ) -> Result<&'a mut [u8], WireGuardError> {
         if dst.len() < super::HANDSHAKE_INIT_SZ {
-            return Err(WireGuardError::DestinationBufferTooSmall);
+            return Err(WireGuardError::DestinationBufferTooSmall)
         }
 
         let (message_type, rest) = dst.split_at_mut(4);
@@ -809,7 +808,7 @@ impl Handshake {
         dst: &'a mut [u8],
     ) -> Result<(&'a mut [u8], Session), WireGuardError> {
         if dst.len() < super::HANDSHAKE_RESP_SZ {
-            return Err(WireGuardError::DestinationBufferTooSmall);
+            return Err(WireGuardError::DestinationBufferTooSmall)
         }
 
         let state = std::mem::replace(&mut self.state, HandshakeState::None);
diff --git a/burrow/src/wireguard/noise/mod.rs b/burrow/src/wireguard/noise/mod.rs
index 86bcc73..aa06652 100755
--- a/burrow/src/wireguard/noise/mod.rs
+++ b/burrow/src/wireguard/noise/mod.rs
@@ -133,9 +133,9 @@ pub enum Packet<'a> {
 
 impl Tunnel {
     #[inline(always)]
-    pub fn parse_incoming_packet(src: &[u8]) -> Result<Packet<'_>, WireGuardError> {
+    pub fn parse_incoming_packet(src: &[u8]) -> Result<Packet, WireGuardError> {
         if src.len() < 4 {
-            return Err(WireGuardError::InvalidPacket);
+            return Err(WireGuardError::InvalidPacket)
         }
 
         // Checks the type, as well as the reserved zero fields
@@ -177,7 +177,7 @@ impl Tunnel {
 
     pub fn dst_address(packet: &[u8]) -> Option<IpAddr> {
         if packet.is_empty() {
-            return None;
+            return None
         }
 
         match packet[0] >> 4 {
@@ -201,7 +201,7 @@ impl Tunnel {
 
     pub fn src_address(packet: &[u8]) -> Option<IpAddr> {
         if packet.is_empty() {
-            return None;
+            return None
         }
 
         match packet[0] >> 4 {
@@ -296,7 +296,7 @@ impl Tunnel {
                 self.timer_tick(TimerName::TimeLastDataPacketSent);
             }
             self.tx_bytes += src.len();
-            return TunnResult::WriteToNetwork(packet);
+            return TunnResult::WriteToNetwork(packet)
         }
 
         // If there is no session, queue the packet for future retry
@@ -320,7 +320,7 @@ impl Tunnel {
     ) -> TunnResult<'a> {
         if datagram.is_empty() {
             // Indicates a repeated call
-            return self.send_queued_packet(dst);
+            return self.send_queued_packet(dst)
         }
 
         let mut cookie = [0u8; COOKIE_REPLY_SZ];
@@ -331,7 +331,7 @@ impl Tunnel {
             Ok(packet) => packet,
             Err(TunnResult::WriteToNetwork(cookie)) => {
                 dst[..cookie.len()].copy_from_slice(cookie);
-                return TunnResult::WriteToNetwork(&mut dst[..cookie.len()]);
+                return TunnResult::WriteToNetwork(&mut dst[..cookie.len()])
             }
             Err(TunnResult::Err(e)) => return TunnResult::Err(e),
             _ => unreachable!(),
@@ -435,7 +435,7 @@ impl Tunnel {
         let cur_idx = self.current;
         if cur_idx == new_idx {
             // There is nothing to do, already using this session, this is the common case
-            return;
+            return
         }
         if self.sessions[cur_idx % N_SESSIONS].is_none()
             || self.timers.session_timers[new_idx % N_SESSIONS]
@@ -481,7 +481,7 @@ impl Tunnel {
         force_resend: bool,
     ) -> TunnResult<'a> {
         if self.handshake.is_in_progress() && !force_resend {
-            return TunnResult::Done;
+            return TunnResult::Done
         }
 
         if self.handshake.is_expired() {
@@ -540,7 +540,7 @@ impl Tunnel {
         };
 
         if computed_len > packet.len() {
-            return TunnResult::Err(WireGuardError::InvalidPacket);
+            return TunnResult::Err(WireGuardError::InvalidPacket)
         }
 
         self.timer_tick(TimerName::TimeLastDataPacketReceived);
diff --git a/burrow/src/wireguard/noise/rate_limiter.rs b/burrow/src/wireguard/noise/rate_limiter.rs
index e4fde02..ff19efd 100755
--- a/burrow/src/wireguard/noise/rate_limiter.rs
+++ b/burrow/src/wireguard/noise/rate_limiter.rs
@@ -8,13 +8,23 @@ use aead::{generic_array::GenericArray, AeadInPlace, KeyInit};
 use chacha20poly1305::{Key, XChaCha20Poly1305};
 use parking_lot::Mutex;
 use rand_core::{OsRng, RngCore};
-use subtle::ConstantTimeEq;
+use ring::constant_time::verify_slices_are_equal;
 
 use super::{
     handshake::{
-        b2s_hash, b2s_keyed_mac_16, b2s_keyed_mac_16_2, b2s_mac_24, LABEL_COOKIE, LABEL_MAC1,
+        b2s_hash,
+        b2s_keyed_mac_16,
+        b2s_keyed_mac_16_2,
+        b2s_mac_24,
+        LABEL_COOKIE,
+        LABEL_MAC1,
     },
-    HandshakeInit, HandshakeResponse, Packet, TunnResult, Tunnel, WireGuardError,
+    HandshakeInit,
+    HandshakeResponse,
+    Packet,
+    TunnResult,
+    Tunnel,
+    WireGuardError,
 };
 
 const COOKIE_REFRESH: u64 = 128; // Use 128 and not 120 so the compiler can optimize out the division
@@ -126,7 +136,7 @@ impl RateLimiter {
         dst: &'a mut [u8],
     ) -> Result<&'a mut [u8], WireGuardError> {
         if dst.len() < super::COOKIE_REPLY_SZ {
-            return Err(WireGuardError::DestinationBufferTooSmall);
+            return Err(WireGuardError::DestinationBufferTooSmall)
         }
 
         let (message_type, rest) = dst.split_at_mut(4);
@@ -175,9 +185,8 @@ impl RateLimiter {
             let (mac1, mac2) = macs.split_at(16);
 
             let computed_mac1 = b2s_keyed_mac_16(&self.mac1_key, msg);
-            if !bool::from(computed_mac1[..16].ct_eq(mac1)) {
-                return Err(TunnResult::Err(WireGuardError::InvalidMac));
-            }
+            verify_slices_are_equal(&computed_mac1[..16], mac1)
+                .map_err(|_| TunnResult::Err(WireGuardError::InvalidMac))?;
 
             if self.is_under_load() {
                 let addr = match src_addr {
@@ -189,11 +198,11 @@ impl RateLimiter {
                 let cookie = self.current_cookie(addr);
                 let computed_mac2 = b2s_keyed_mac_16_2(&cookie, msg, mac1);
 
-                if !bool::from(computed_mac2[..16].ct_eq(mac2)) {
+                if verify_slices_are_equal(&computed_mac2[..16], mac2).is_err() {
                     let cookie_packet = self
                         .format_cookie_reply(sender_idx, cookie, mac1, dst)
                         .map_err(TunnResult::Err)?;
-                    return Err(TunnResult::WriteToNetwork(cookie_packet));
+                    return Err(TunnResult::WriteToNetwork(cookie_packet))
                 }
             }
         }
diff --git a/burrow/src/wireguard/noise/session.rs b/burrow/src/wireguard/noise/session.rs
index 14c191b..8988728 100755
--- a/burrow/src/wireguard/noise/session.rs
+++ b/burrow/src/wireguard/noise/session.rs
@@ -88,11 +88,11 @@ impl ReceivingKeyCounterValidator {
     fn will_accept(&self, counter: u64) -> Result<(), WireGuardError> {
         if counter >= self.next {
             // As long as the counter is growing no replay took place for sure
-            return Ok(());
+            return Ok(())
         }
         if counter + N_BITS < self.next {
             // Drop if too far back
-            return Err(WireGuardError::InvalidCounter);
+            return Err(WireGuardError::InvalidCounter)
         }
         if !self.check_bit(counter) {
             Ok(())
@@ -107,22 +107,22 @@ impl ReceivingKeyCounterValidator {
     fn mark_did_receive(&mut self, counter: u64) -> Result<(), WireGuardError> {
         if counter + N_BITS < self.next {
             // Drop if too far back
-            return Err(WireGuardError::InvalidCounter);
+            return Err(WireGuardError::InvalidCounter)
         }
         if counter == self.next {
             // Usually the packets arrive in order, in that case we simply mark the bit and
             // increment the counter
             self.set_bit(counter);
             self.next += 1;
-            return Ok(());
+            return Ok(())
         }
         if counter < self.next {
             // A packet arrived out of order, check if it is valid, and mark
             if self.check_bit(counter) {
-                return Err(WireGuardError::InvalidCounter);
+                return Err(WireGuardError::InvalidCounter)
             }
             self.set_bit(counter);
-            return Ok(());
+            return Ok(())
         }
         // Packets where dropped, or maybe reordered, skip them and mark unused
         if counter - self.next >= N_BITS {
@@ -247,7 +247,7 @@ impl Session {
             panic!("The destination buffer is too small");
         }
         if packet.receiver_idx != self.receiving_index {
-            return Err(WireGuardError::WrongIndex);
+            return Err(WireGuardError::WrongIndex)
         }
         // Don't reuse counters, in case this is a replay attack we want to quickly
         // check the counter without running expensive decryption
diff --git a/burrow/src/wireguard/noise/timers.rs b/burrow/src/wireguard/noise/timers.rs
index f713e6f..1d0cf1f 100755
--- a/burrow/src/wireguard/noise/timers.rs
+++ b/burrow/src/wireguard/noise/timers.rs
@@ -190,7 +190,7 @@ impl Tunnel {
 
         {
             if self.handshake.is_expired() {
-                return TunnResult::Err(WireGuardError::ConnectionExpired);
+                return TunnResult::Err(WireGuardError::ConnectionExpired)
             }
 
             // Clear cookie after COOKIE_EXPIRATION_TIME
@@ -206,7 +206,7 @@ impl Tunnel {
                 tracing::error!("CONNECTION_EXPIRED(REJECT_AFTER_TIME * 3)");
                 self.handshake.set_expired();
                 self.clear_all();
-                return TunnResult::Err(WireGuardError::ConnectionExpired);
+                return TunnResult::Err(WireGuardError::ConnectionExpired)
             }
 
             if let Some(time_init_sent) = self.handshake.timer() {
@@ -219,7 +219,7 @@ impl Tunnel {
                     tracing::error!("CONNECTION_EXPIRED(REKEY_ATTEMPT_TIME)");
                     self.handshake.set_expired();
                     self.clear_all();
-                    return TunnResult::Err(WireGuardError::ConnectionExpired);
+                    return TunnResult::Err(WireGuardError::ConnectionExpired)
                 }
 
                 if time_init_sent.elapsed() >= REKEY_TIMEOUT {
@@ -299,11 +299,11 @@ impl Tunnel {
         }
 
         if handshake_initiation_required {
-            return self.format_handshake_initiation(dst, true);
+            return self.format_handshake_initiation(dst, true)
         }
 
         if keepalive_required {
-            return self.encapsulate(&[], dst);
+            return self.encapsulate(&[], dst)
         }
 
         TunnResult::Done
diff --git a/burrow/src/wireguard/pcb.rs b/burrow/src/wireguard/pcb.rs
index 6e5e6c0..db57968 100755
--- a/burrow/src/wireguard/pcb.rs
+++ b/burrow/src/wireguard/pcb.rs
@@ -54,7 +54,7 @@ impl PeerPcb {
         Ok(())
     }
 
-    pub async fn run(&self, tun_interface: Arc<RwLock<Option<TunInterface>>>) -> Result<(), Error> {
+    pub async fn run(&self, tun_interface: Arc<RwLock<TunInterface>>) -> Result<(), Error> {
         tracing::debug!("starting read loop for pcb... for {:?}", &self);
         let rid: i32 = random();
         let mut buf: [u8; 3000] = [0u8; 3000];
@@ -64,7 +64,7 @@ impl PeerPcb {
             let guard = self.socket.read().await;
             let Some(socket) = guard.as_ref() else {
                 self.open_if_closed().await?;
-                continue;
+                continue
             };
             let mut res_buf = [0; 1500];
             // tracing::debug!("{} : waiting for readability on {:?}", rid, socket);
@@ -72,7 +72,7 @@ impl PeerPcb {
                 Ok(l) => l,
                 Err(e) => {
                     log::error!("{}: error reading from socket: {:?}", rid, e);
-                    continue;
+                    continue
                 }
             };
             let mut res_dat = &res_buf[..len];
@@ -88,7 +88,7 @@ impl PeerPcb {
                     TunnResult::Done => break,
                     TunnResult::Err(e) => {
                         tracing::error!(message = "Decapsulate error", error = ?e);
-                        break;
+                        break
                     }
                     TunnResult::WriteToNetwork(packet) => {
                         tracing::debug!("WriteToNetwork: {:?}", packet);
@@ -102,29 +102,17 @@ impl PeerPcb {
                             .await?;
                         tracing::debug!("WriteToNetwork done");
                         res_dat = &[];
-                        continue;
+                        continue
                     }
                     TunnResult::WriteToTunnelV4(packet, addr) => {
                         tracing::debug!("WriteToTunnelV4: {:?}, {:?}", packet, addr);
-                        tun_interface
-                            .read()
-                            .await
-                            .as_ref()
-                            .ok_or(anyhow::anyhow!("tun interface does not exist"))?
-                            .send(packet)
-                            .await?;
-                        break;
+                        tun_interface.read().await.send(packet).await?;
+                        break
                     }
                     TunnResult::WriteToTunnelV6(packet, addr) => {
                         tracing::debug!("WriteToTunnelV6: {:?}, {:?}", packet, addr);
-                        tun_interface
-                            .read()
-                            .await
-                            .as_ref()
-                            .ok_or(anyhow::anyhow!("tun interface does not exist"))?
-                            .send(packet)
-                            .await?;
-                        break;
+                        tun_interface.read().await.send(packet).await?;
+                        break
                     }
                 }
             }
@@ -146,7 +134,7 @@ impl PeerPcb {
                 let handle = self.socket.read().await;
                 let Some(socket) = handle.as_ref() else {
                     tracing::error!("No socket for peer");
-                    return Ok(());
+                    return Ok(())
                 };
                 tracing::debug!("Our Encapsulated packet: {:?}", packet);
                 socket.send(packet).await?;
@@ -169,7 +157,7 @@ impl PeerPcb {
                 let handle = self.socket.read().await;
                 let Some(socket) = handle.as_ref() else {
                     tracing::error!("No socket for peer");
-                    return Ok(());
+                    return Ok(())
                 };
                 socket.send(packet).await?;
                 tracing::debug!("Sent Packet for timer update");
diff --git a/burrow/src/wireguard/snapshots/burrow__wireguard__config__tests__tst_config_toml.snap b/burrow/src/wireguard/snapshots/burrow__wireguard__config__tests__tst_config_toml.snap
deleted file mode 100644
index 3800647..0000000
--- a/burrow/src/wireguard/snapshots/burrow__wireguard__config__tests__tst_config_toml.snap
+++ /dev/null
@@ -1,16 +0,0 @@
----
-source: burrow/src/wireguard/config.rs
-expression: toml
----
-[[Peer]]
-public_key = "8GaFjVO6c4luCHG4ONO+1bFG8tO+Zz5/Gy+Geht1USM="
-preshared_key = "ha7j4BjD49sIzyF9SNlbueK0AMHghlj6+u0G3bzC698="
-allowed_ips = ["8.8.8.8/32", "0.0.0.0/0"]
-endpoint = "wg.burrow.rs:51820"
-
-[interface]
-private_key = "OEPVdomeLTxTIBvv3TYsJRge0Hp9NMiY0sIrhT8OWG8="
-address = ["10.13.13.2/24"]
-listen_port = 51820
-dns = []
-
diff --git a/burrow/tmp/conrd.conf b/burrow/tmp/conrd.conf
deleted file mode 100644
index 52572d1..0000000
--- a/burrow/tmp/conrd.conf
+++ /dev/null
@@ -1,8 +0,0 @@
-[Interface]
-PrivateKey = gAaK0KFGOpxY7geGo59XXDufcxeoSNXXNC12mCQmlVs=
-Address = 10.1.11.2/32
-DNS = 10.1.11.1
-[Peer]
-PublicKey = Ab6V2mgPHiCXaAZfQrNts8ha8RkEzC49VnmMQfe5Yg4=
-AllowedIPs = 10.1.11.1/32,10.1.11.2/32,0.0.0.0/0
-Endpoint = 172.251.163.175:51820
\ No newline at end of file
diff --git a/contributors.nix b/contributors.nix
deleted file mode 100644
index e13da91..0000000
--- a/contributors.nix
+++ /dev/null
@@ -1,116 +0,0 @@
-{
-  groups = {
-    users = "burrow-users";
-    admins = "burrow-admins";
-    automation = "burrow-automation";
-    linear = {
-      owners = "linear-owners";
-      admins = "linear-admins";
-      guests = "linear-guests";
-    };
-  };
-
-  identities = {
-    contact = {
-      displayName = "Burrow";
-      canonicalEmail = "contact@burrow.net";
-      isAdmin = true;
-      forgeAuthorized = true;
-      bootstrapAuthentik = true;
-      sshPublicKeyPath = ./nixos/keys/contact_at_burrow_net.pub;
-      roles = [
-        "operator"
-        "forge-admin"
-      ];
-    };
-
-    conrad = {
-      displayName = "Conrad Kramer";
-      canonicalEmail = "conrad@burrow.net";
-      isAdmin = true;
-      forgeAuthorized = false;
-      bootstrapAuthentik = true;
-      roles = [
-        "operator"
-        "founder"
-      ];
-    };
-
-    jett = {
-      displayName = "Jett";
-      canonicalEmail = "jett@burrow.net";
-      isAdmin = true;
-      forgeAuthorized = false;
-      forgeUnixUser = true;
-      bootstrapAuthentik = true;
-      sshPublicKeyPath = ./nixos/keys/jett_at_burrow_net.pub;
-      roles = [
-        "member"
-        "operator"
-        "forge-admin"
-      ];
-    };
-
-    davnotdev = {
-      displayName = "David";
-      canonicalEmail = "davnotdev@burrow.net";
-      isAdmin = true;
-      forgeAuthorized = false;
-      bootstrapAuthentik = true;
-      roles = [
-        "member"
-        "operator"
-        "forge-admin"
-      ];
-    };
-
-    agent = {
-      displayName = "Burrow Agent";
-      canonicalEmail = "agent@burrow.net";
-      isAdmin = false;
-      forgeAuthorized = true;
-      bootstrapAuthentik = false;
-      sshPublicKeyPath = ./nixos/keys/agent_at_burrow_net.pub;
-      roles = [
-        "automation"
-      ];
-    };
-
-    release = {
-      displayName = "Burrow Release";
-      canonicalEmail = "release@burrow.net";
-      isAdmin = false;
-      forgeAuthorized = false;
-      bootstrapAuthentik = false;
-      roles = [
-        "automation"
-        "release"
-      ];
-    };
-
-    namespace = {
-      displayName = "Burrow Namespace";
-      canonicalEmail = "namespace@burrow.net";
-      isAdmin = false;
-      forgeAuthorized = false;
-      bootstrapAuthentik = false;
-      roles = [
-        "automation"
-        "namespace-runners"
-      ];
-    };
-
-    ui-test = {
-      displayName = "Burrow UI Test";
-      canonicalEmail = "ui-test@burrow.net";
-      isAdmin = false;
-      forgeAuthorized = false;
-      bootstrapAuthentik = true;
-      authentikPasswordSecret = "burrowAuthentikUiTestPassword";
-      roles = [
-        "testing"
-        "apple-ui"
-      ];
-    };
-  };
-}
diff --git a/crates/burrow-core/Cargo.toml b/crates/burrow-core/Cargo.toml
deleted file mode 100644
index b6bc9fd..0000000
--- a/crates/burrow-core/Cargo.toml
+++ /dev/null
@@ -1,9 +0,0 @@
-[package]
-name = "burrow-core"
-version = "0.1.0"
-edition = "2021"
-description = "Cross-platform Burrow protocol and application core."
-license = "GPL-3.0-or-later"
-
-[lib]
-crate-type = ["lib", "staticlib"]
diff --git a/crates/burrow-core/src/lib.rs b/crates/burrow-core/src/lib.rs
deleted file mode 100644
index 6cf84dd..0000000
--- a/crates/burrow-core/src/lib.rs
+++ /dev/null
@@ -1,61 +0,0 @@
-#![deny(missing_debug_implementations)]
-
-/// Version of the Rust core linked into platform shells.
-pub fn version() -> &'static str {
-    env!("CARGO_PKG_VERSION")
-}
-
-/// Platform family reported by the current Rust target.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum PlatformFamily {
-    Android,
-    Apple,
-    Linux,
-    Windows,
-    Other,
-}
-
-impl PlatformFamily {
-    pub fn current() -> Self {
-        if cfg!(target_os = "android") {
-            Self::Android
-        } else if cfg!(target_vendor = "apple") {
-            Self::Apple
-        } else if cfg!(target_os = "linux") {
-            Self::Linux
-        } else if cfg!(target_os = "windows") {
-            Self::Windows
-        } else {
-            Self::Other
-        }
-    }
-
-    pub fn as_str(self) -> &'static str {
-        match self {
-            Self::Android => "android",
-            Self::Apple => "apple",
-            Self::Linux => "linux",
-            Self::Windows => "windows",
-            Self::Other => "other",
-        }
-    }
-}
-
-/// Human-readable core identity for stubs and smoke tests.
-pub fn identity() -> String {
-    format!(
-        "burrow-core/{} ({})",
-        version(),
-        PlatformFamily::current().as_str()
-    )
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn identity_includes_project_name() {
-        assert!(identity().starts_with("burrow-core/"));
-    }
-}
diff --git a/crates/burrow-mobile-ffi/Cargo.toml b/crates/burrow-mobile-ffi/Cargo.toml
deleted file mode 100644
index 701c2b4..0000000
--- a/crates/burrow-mobile-ffi/Cargo.toml
+++ /dev/null
@@ -1,13 +0,0 @@
-[package]
-name = "burrow-mobile-ffi"
-version = "0.1.0"
-edition = "2021"
-description = "Mobile FFI boundary for the Burrow Rust core."
-license = "GPL-3.0-or-later"
-
-[lib]
-crate-type = ["cdylib", "staticlib"]
-
-[dependencies]
-burrow-core = { path = "../burrow-core" }
-jni = "0.21"
diff --git a/crates/burrow-mobile-ffi/src/lib.rs b/crates/burrow-mobile-ffi/src/lib.rs
deleted file mode 100644
index ff75ad8..0000000
--- a/crates/burrow-mobile-ffi/src/lib.rs
+++ /dev/null
@@ -1,27 +0,0 @@
-#![deny(missing_debug_implementations)]
-
-use std::ffi::c_char;
-
-use jni::objects::JClass;
-use jni::sys::jstring;
-use jni::JNIEnv;
-
-static CORE_VERSION: &[u8] = concat!(env!("CARGO_PKG_VERSION"), "\0").as_bytes();
-
-/// C ABI entrypoint for platform shells that do not use JNI.
-#[no_mangle]
-pub extern "C" fn burrow_core_version() -> *const c_char {
-    CORE_VERSION.as_ptr().cast()
-}
-
-/// JNI entrypoint used by the Android Kotlin stub.
-#[no_mangle]
-pub extern "system" fn Java_net_burrow_android_BurrowCore_version(
-    env: JNIEnv<'_>,
-    _class: JClass<'_>,
-) -> jstring {
-    match env.new_string(burrow_core::identity()) {
-        Ok(value) => value.into_raw(),
-        Err(_) => std::ptr::null_mut(),
-    }
-}
diff --git a/crates/burrow-windows-stub/Cargo.toml b/crates/burrow-windows-stub/Cargo.toml
deleted file mode 100644
index 4ef859a..0000000
--- a/crates/burrow-windows-stub/Cargo.toml
+++ /dev/null
@@ -1,10 +0,0 @@
-[package]
-name = "burrow-windows-stub"
-version = "0.1.0"
-edition = "2021"
-description = "Windows release placeholder for Burrow"
-license = "GPL-3.0-or-later"
-
-[[bin]]
-name = "burrow"
-path = "src/main.rs"
diff --git a/crates/burrow-windows-stub/src/main.rs b/crates/burrow-windows-stub/src/main.rs
deleted file mode 100644
index fddc637..0000000
--- a/crates/burrow-windows-stub/src/main.rs
+++ /dev/null
@@ -1,8 +0,0 @@
-use std::process::ExitCode;
-
-fn main() -> ExitCode {
-    println!("Burrow for Windows is not ready yet.");
-    println!("This release stub exists so the Windows lane can exercise signing, packaging, and upload plumbing before the native client lands.");
-    println!("Install a Linux or Apple build for a functional Burrow client today.");
-    ExitCode::from(64)
-}
diff --git a/design/brand/Burrow.icon/Assets/burrow-ground.png b/design/brand/Burrow.icon/Assets/burrow-ground.png
deleted file mode 100644
index a39c507..0000000
Binary files a/design/brand/Burrow.icon/Assets/burrow-ground.png and /dev/null differ
diff --git a/design/brand/Burrow.icon/Assets/owl-body.png b/design/brand/Burrow.icon/Assets/owl-body.png
deleted file mode 100644
index e335771..0000000
Binary files a/design/brand/Burrow.icon/Assets/owl-body.png and /dev/null differ
diff --git a/design/brand/Burrow.icon/Assets/owl-face.png b/design/brand/Burrow.icon/Assets/owl-face.png
deleted file mode 100644
index a39c507..0000000
Binary files a/design/brand/Burrow.icon/Assets/owl-face.png and /dev/null differ
diff --git a/design/brand/Burrow.icon/Assets/owl-figure.png b/design/brand/Burrow.icon/Assets/owl-figure.png
deleted file mode 100644
index e335771..0000000
Binary files a/design/brand/Burrow.icon/Assets/owl-figure.png and /dev/null differ
diff --git a/design/brand/Burrow.icon/Assets/owl-legs.png b/design/brand/Burrow.icon/Assets/owl-legs.png
deleted file mode 100644
index a39c507..0000000
Binary files a/design/brand/Burrow.icon/Assets/owl-legs.png and /dev/null differ
diff --git a/design/brand/Burrow.icon/Assets/owl-spots.png b/design/brand/Burrow.icon/Assets/owl-spots.png
deleted file mode 100644
index a39c507..0000000
Binary files a/design/brand/Burrow.icon/Assets/owl-spots.png and /dev/null differ
diff --git a/design/brand/Burrow.icon/icon.json b/design/brand/Burrow.icon/icon.json
deleted file mode 100644
index b1e196a..0000000
--- a/design/brand/Burrow.icon/icon.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  "fill": {
-    "type": "solid",
-    "color": "#00000000"
-  },
-  "layers": [
-    {
-      "blend-mode": "normal",
-      "image-name": "owl-figure.png",
-      "name": "panel-raster",
-      "position": {
-        "scale": 1,
-        "translation-in-points": [
-          0,
-          0
-        ]
-      }
-    }
-  ]
-}
diff --git a/design/brand/README.md b/design/brand/README.md
deleted file mode 100644
index 30094e3..0000000
--- a/design/brand/README.md
+++ /dev/null
@@ -1,57 +0,0 @@
-# Burrow Brand Source
-
-`design/brand/panel-variants/source-sheet.png` is the locked icon style sheet.
-The six cropped PNG masters in `design/brand/panel-variants/` are the canonical
-app icon source. Do not redraw these as SVG; regenerate platform outputs from
-the raster panel masters.
-
-`Scripts/generate-brand-icons.py` owns all generated outputs:
-
-- `Apple/UI/Assets.xcassets/AppIcon.appiconset`: primary iOS and macOS app
-  icons at exact asset-catalog dimensions.
-- `Apple/UI/Assets.xcassets/BurrowPanel*.appiconset`: iOS alternate app icons.
-- `Apple/UI/Assets.xcassets/BurrowPanel*Preview.imageset`: in-app selector
-  previews.
-- `design/brand/watchos/AppIcon.appiconset`: watchOS reference app icon catalog
-  using the selected watchOS panel.
-- `Android/app/src/main/res/mipmap-*`: Android launcher PNGs.
-- `store-metadata/android/icon.png`: Google Play icon.
-- `burrow-gtk/data/icons/hicolor/{16,24,32,48,64,128,256,512}/apps`: Linux
-  hicolor PNGs.
-- `design/brand/low-res`: low-resolution QA exports and preview strips.
-
-Platform picks:
-
-- iOS primary: `panel-01-guardian`
-- iOS alternates: `panel-02-field`, `panel-03-burrow`, `panel-04-sentinel`,
-  `panel-05-stride`, `panel-06-post`
-- macOS primary: `panel-05-stride`
-- watchOS primary: `panel-03-burrow`
-- Android primary: `panel-01-guardian`
-- Linux primary: `panel-01-guardian`
-
-Regenerate all package assets from existing masters with:
-
-```bash
-Scripts/generate-brand-icons.py
-```
-
-If the locked source sheet changes, extract fresh 1024px masters and regenerate
-with:
-
-```bash
-Scripts/generate-brand-icons.py --extract-from /path/to/source-sheet.png
-```
-
-Run low-resolution export QA with:
-
-```bash
-Scripts/check-brand-icon-lowres.sh
-```
-
-Review these after every icon change:
-
-- `design/brand/panel-variants/preview-strip.png`
-- `design/brand/low-res/preview-strip.png`
-- `design/brand/low-res/pixel-preview-strip.png`
-- `design/brand/low-res/report.csv`
diff --git a/design/brand/burrow-owl-icon-master.png b/design/brand/burrow-owl-icon-master.png
deleted file mode 100644
index e335771..0000000
Binary files a/design/brand/burrow-owl-icon-master.png and /dev/null differ
diff --git a/design/brand/burrowing-owl-concept-v2.png b/design/brand/burrowing-owl-concept-v2.png
deleted file mode 100644
index 629d4b5..0000000
Binary files a/design/brand/burrowing-owl-concept-v2.png and /dev/null differ
diff --git a/design/brand/burrowing-owl-icon-flat.png b/design/brand/burrowing-owl-icon-flat.png
deleted file mode 100644
index e335771..0000000
Binary files a/design/brand/burrowing-owl-icon-flat.png and /dev/null differ
diff --git a/design/brand/low-res/burrow-icon-1024.png b/design/brand/low-res/burrow-icon-1024.png
deleted file mode 100644
index e335771..0000000
Binary files a/design/brand/low-res/burrow-icon-1024.png and /dev/null differ
diff --git a/design/brand/low-res/burrow-icon-128.png b/design/brand/low-res/burrow-icon-128.png
deleted file mode 100644
index 54b67da..0000000
Binary files a/design/brand/low-res/burrow-icon-128.png and /dev/null differ
diff --git a/design/brand/low-res/burrow-icon-16.png b/design/brand/low-res/burrow-icon-16.png
deleted file mode 100644
index cf418ae..0000000
Binary files a/design/brand/low-res/burrow-icon-16.png and /dev/null differ
diff --git a/design/brand/low-res/burrow-icon-20.png b/design/brand/low-res/burrow-icon-20.png
deleted file mode 100644
index bd3cc95..0000000
Binary files a/design/brand/low-res/burrow-icon-20.png and /dev/null differ
diff --git a/design/brand/low-res/burrow-icon-24.png b/design/brand/low-res/burrow-icon-24.png
deleted file mode 100644
index cfe8e33..0000000
Binary files a/design/brand/low-res/burrow-icon-24.png and /dev/null differ
diff --git a/design/brand/low-res/burrow-icon-256.png b/design/brand/low-res/burrow-icon-256.png
deleted file mode 100644
index 561abcb..0000000
Binary files a/design/brand/low-res/burrow-icon-256.png and /dev/null differ
diff --git a/design/brand/low-res/burrow-icon-29.png b/design/brand/low-res/burrow-icon-29.png
deleted file mode 100644
index 227cb6c..0000000
Binary files a/design/brand/low-res/burrow-icon-29.png and /dev/null differ
diff --git a/design/brand/low-res/burrow-icon-32.png b/design/brand/low-res/burrow-icon-32.png
deleted file mode 100644
index 52e7a25..0000000
Binary files a/design/brand/low-res/burrow-icon-32.png and /dev/null differ
diff --git a/design/brand/low-res/burrow-icon-40.png b/design/brand/low-res/burrow-icon-40.png
deleted file mode 100644
index c0ef687..0000000
Binary files a/design/brand/low-res/burrow-icon-40.png and /dev/null differ
diff --git a/design/brand/low-res/burrow-icon-48.png b/design/brand/low-res/burrow-icon-48.png
deleted file mode 100644
index 68cf88b..0000000
Binary files a/design/brand/low-res/burrow-icon-48.png and /dev/null differ
diff --git a/design/brand/low-res/burrow-icon-64.png b/design/brand/low-res/burrow-icon-64.png
deleted file mode 100644
index 46872b4..0000000
Binary files a/design/brand/low-res/burrow-icon-64.png and /dev/null differ
diff --git a/design/brand/low-res/burrow-icon-80.png b/design/brand/low-res/burrow-icon-80.png
deleted file mode 100644
index ecf97e9..0000000
Binary files a/design/brand/low-res/burrow-icon-80.png and /dev/null differ
diff --git a/design/brand/low-res/pixel-preview-16.png b/design/brand/low-res/pixel-preview-16.png
deleted file mode 100644
index 54cb3a4..0000000
Binary files a/design/brand/low-res/pixel-preview-16.png and /dev/null differ
diff --git a/design/brand/low-res/pixel-preview-20.png b/design/brand/low-res/pixel-preview-20.png
deleted file mode 100644
index 3064ac7..0000000
Binary files a/design/brand/low-res/pixel-preview-20.png and /dev/null differ
diff --git a/design/brand/low-res/pixel-preview-24.png b/design/brand/low-res/pixel-preview-24.png
deleted file mode 100644
index 139a265..0000000
Binary files a/design/brand/low-res/pixel-preview-24.png and /dev/null differ
diff --git a/design/brand/low-res/pixel-preview-29.png b/design/brand/low-res/pixel-preview-29.png
deleted file mode 100644
index e25f0ad..0000000
Binary files a/design/brand/low-res/pixel-preview-29.png and /dev/null differ
diff --git a/design/brand/low-res/pixel-preview-32.png b/design/brand/low-res/pixel-preview-32.png
deleted file mode 100644
index e997e05..0000000
Binary files a/design/brand/low-res/pixel-preview-32.png and /dev/null differ
diff --git a/design/brand/low-res/pixel-preview-strip.png b/design/brand/low-res/pixel-preview-strip.png
deleted file mode 100644
index 83a7060..0000000
Binary files a/design/brand/low-res/pixel-preview-strip.png and /dev/null differ
diff --git a/design/brand/low-res/preview-128.png b/design/brand/low-res/preview-128.png
deleted file mode 100644
index 41d405f..0000000
Binary files a/design/brand/low-res/preview-128.png and /dev/null differ
diff --git a/design/brand/low-res/preview-16.png b/design/brand/low-res/preview-16.png
deleted file mode 100644
index 54cb3a4..0000000
Binary files a/design/brand/low-res/preview-16.png and /dev/null differ
diff --git a/design/brand/low-res/preview-20.png b/design/brand/low-res/preview-20.png
deleted file mode 100644
index 3064ac7..0000000
Binary files a/design/brand/low-res/preview-20.png and /dev/null differ
diff --git a/design/brand/low-res/preview-24.png b/design/brand/low-res/preview-24.png
deleted file mode 100644
index 139a265..0000000
Binary files a/design/brand/low-res/preview-24.png and /dev/null differ
diff --git a/design/brand/low-res/preview-256.png b/design/brand/low-res/preview-256.png
deleted file mode 100644
index 474fa4d..0000000
Binary files a/design/brand/low-res/preview-256.png and /dev/null differ
diff --git a/design/brand/low-res/preview-29.png b/design/brand/low-res/preview-29.png
deleted file mode 100644
index e25f0ad..0000000
Binary files a/design/brand/low-res/preview-29.png and /dev/null differ
diff --git a/design/brand/low-res/preview-32.png b/design/brand/low-res/preview-32.png
deleted file mode 100644
index e997e05..0000000
Binary files a/design/brand/low-res/preview-32.png and /dev/null differ
diff --git a/design/brand/low-res/preview-40.png b/design/brand/low-res/preview-40.png
deleted file mode 100644
index 5938193..0000000
Binary files a/design/brand/low-res/preview-40.png and /dev/null differ
diff --git a/design/brand/low-res/preview-48.png b/design/brand/low-res/preview-48.png
deleted file mode 100644
index 940f132..0000000
Binary files a/design/brand/low-res/preview-48.png and /dev/null differ
diff --git a/design/brand/low-res/preview-64.png b/design/brand/low-res/preview-64.png
deleted file mode 100644
index 4f563f0..0000000
Binary files a/design/brand/low-res/preview-64.png and /dev/null differ
diff --git a/design/brand/low-res/preview-80.png b/design/brand/low-res/preview-80.png
deleted file mode 100644
index 4524c81..0000000
Binary files a/design/brand/low-res/preview-80.png and /dev/null differ
diff --git a/design/brand/low-res/preview-strip.png b/design/brand/low-res/preview-strip.png
deleted file mode 100644
index ab83302..0000000
Binary files a/design/brand/low-res/preview-strip.png and /dev/null differ
diff --git a/design/brand/low-res/report.csv b/design/brand/low-res/report.csv
deleted file mode 100644
index 7205aeb..0000000
--- a/design/brand/low-res/report.csv
+++ /dev/null
@@ -1,12 +0,0 @@
-size,colors,gray_stddev,status
-16,182,0.135534,ok
-20,247,0.142914,ok
-24,325,0.157326,ok
-29,436,0.156951,ok
-32,504,0.164219,ok
-40,691,0.173161,ok
-48,868,0.179509,ok
-64,1287,0.190366,ok
-80,1701,0.198425,ok
-128,3115,0.210773,ok
-256,6728,0.212284,ok
diff --git a/design/brand/panel-variants/README.md b/design/brand/panel-variants/README.md
deleted file mode 100644
index ca368bf..0000000
--- a/design/brand/panel-variants/README.md
+++ /dev/null
@@ -1,16 +0,0 @@
-# Burrow Raster Panel Icon Variants
-
-The six PNG masters here are cropped from `source-sheet.png` and are the
-locked app icon source. Do not redraw them; regenerate package assets from
-these rasters.
-
-| Variant | Use | Source |
-| --- | --- | --- |
-| `panel-01-guardian` | iOS primary, Android primary, Linux primary | Guardian, top-left panel |
-| `panel-02-field` | iOS alternate | Field, top-middle panel |
-| `panel-03-burrow` | iOS alternate, watchOS primary | Burrow, top-right panel |
-| `panel-04-sentinel` | iOS alternate | Sentinel, bottom-left panel |
-| `panel-05-stride` | iOS alternate, macOS primary | Stride, bottom-middle panel |
-| `panel-06-post` | iOS alternate | Post, bottom-right panel |
-
-`preview-strip.png` shows the six raster masters side by side.
diff --git a/design/brand/panel-variants/panel-01-guardian-preview.png b/design/brand/panel-variants/panel-01-guardian-preview.png
deleted file mode 100644
index 561abcb..0000000
Binary files a/design/brand/panel-variants/panel-01-guardian-preview.png and /dev/null differ
diff --git a/design/brand/panel-variants/panel-01-guardian.png b/design/brand/panel-variants/panel-01-guardian.png
deleted file mode 100644
index e335771..0000000
Binary files a/design/brand/panel-variants/panel-01-guardian.png and /dev/null differ
diff --git a/design/brand/panel-variants/panel-02-field-preview.png b/design/brand/panel-variants/panel-02-field-preview.png
deleted file mode 100644
index f6d9feb..0000000
Binary files a/design/brand/panel-variants/panel-02-field-preview.png and /dev/null differ
diff --git a/design/brand/panel-variants/panel-02-field.png b/design/brand/panel-variants/panel-02-field.png
deleted file mode 100644
index 278575e..0000000
Binary files a/design/brand/panel-variants/panel-02-field.png and /dev/null differ
diff --git a/design/brand/panel-variants/panel-03-burrow-preview.png b/design/brand/panel-variants/panel-03-burrow-preview.png
deleted file mode 100644
index 76d432e..0000000
Binary files a/design/brand/panel-variants/panel-03-burrow-preview.png and /dev/null differ
diff --git a/design/brand/panel-variants/panel-03-burrow.png b/design/brand/panel-variants/panel-03-burrow.png
deleted file mode 100644
index 6f40b0a..0000000
Binary files a/design/brand/panel-variants/panel-03-burrow.png and /dev/null differ
diff --git a/design/brand/panel-variants/panel-04-sentinel-preview.png b/design/brand/panel-variants/panel-04-sentinel-preview.png
deleted file mode 100644
index 36b526c..0000000
Binary files a/design/brand/panel-variants/panel-04-sentinel-preview.png and /dev/null differ
diff --git a/design/brand/panel-variants/panel-04-sentinel.png b/design/brand/panel-variants/panel-04-sentinel.png
deleted file mode 100644
index 4925f9f..0000000
Binary files a/design/brand/panel-variants/panel-04-sentinel.png and /dev/null differ
diff --git a/design/brand/panel-variants/panel-05-stride-preview.png b/design/brand/panel-variants/panel-05-stride-preview.png
deleted file mode 100644
index d919e9c..0000000
Binary files a/design/brand/panel-variants/panel-05-stride-preview.png and /dev/null differ
diff --git a/design/brand/panel-variants/panel-05-stride.png b/design/brand/panel-variants/panel-05-stride.png
deleted file mode 100644
index 065e8b6..0000000
Binary files a/design/brand/panel-variants/panel-05-stride.png and /dev/null differ
diff --git a/design/brand/panel-variants/panel-06-post-preview.png b/design/brand/panel-variants/panel-06-post-preview.png
deleted file mode 100644
index 7c63df0..0000000
Binary files a/design/brand/panel-variants/panel-06-post-preview.png and /dev/null differ
diff --git a/design/brand/panel-variants/panel-06-post.png b/design/brand/panel-variants/panel-06-post.png
deleted file mode 100644
index 54336b2..0000000
Binary files a/design/brand/panel-variants/panel-06-post.png and /dev/null differ
diff --git a/design/brand/panel-variants/preview-strip.png b/design/brand/panel-variants/preview-strip.png
deleted file mode 100644
index 8ecc2ff..0000000
Binary files a/design/brand/panel-variants/preview-strip.png and /dev/null differ
diff --git a/design/brand/panel-variants/source-sheet.png b/design/brand/panel-variants/source-sheet.png
deleted file mode 100644
index a3b6f7f..0000000
Binary files a/design/brand/panel-variants/source-sheet.png and /dev/null differ
diff --git a/design/brand/watchos/AppIcon.appiconset/Contents.json b/design/brand/watchos/AppIcon.appiconset/Contents.json
deleted file mode 100644
index e3f5ccd..0000000
--- a/design/brand/watchos/AppIcon.appiconset/Contents.json
+++ /dev/null
@@ -1,140 +0,0 @@
-{
-  "images": [
-    {
-      "filename": "watch-panel-03-48.png",
-      "idiom": "watch",
-      "scale": "2x",
-      "size": "24x24",
-      "role": "notificationCenter",
-      "subtype": "38mm"
-    },
-    {
-      "filename": "watch-panel-03-55.png",
-      "idiom": "watch",
-      "scale": "2x",
-      "size": "27.5x27.5",
-      "role": "notificationCenter",
-      "subtype": "42mm"
-    },
-    {
-      "filename": "watch-panel-03-66.png",
-      "idiom": "watch",
-      "scale": "2x",
-      "size": "33x33",
-      "role": "notificationCenter",
-      "subtype": "45mm"
-    },
-    {
-      "filename": "watch-panel-03-58.png",
-      "idiom": "watch",
-      "scale": "2x",
-      "size": "29x29",
-      "role": "companionSettings"
-    },
-    {
-      "filename": "watch-panel-03-87.png",
-      "idiom": "watch",
-      "scale": "3x",
-      "size": "29x29",
-      "role": "companionSettings"
-    },
-    {
-      "filename": "watch-panel-03-80.png",
-      "idiom": "watch",
-      "scale": "2x",
-      "size": "40x40",
-      "role": "appLauncher",
-      "subtype": "38mm"
-    },
-    {
-      "filename": "watch-panel-03-88.png",
-      "idiom": "watch",
-      "scale": "2x",
-      "size": "44x44",
-      "role": "appLauncher",
-      "subtype": "40mm"
-    },
-    {
-      "filename": "watch-panel-03-92.png",
-      "idiom": "watch",
-      "scale": "2x",
-      "size": "46x46",
-      "role": "appLauncher",
-      "subtype": "41mm"
-    },
-    {
-      "filename": "watch-panel-03-100.png",
-      "idiom": "watch",
-      "scale": "2x",
-      "size": "50x50",
-      "role": "appLauncher",
-      "subtype": "44mm"
-    },
-    {
-      "filename": "watch-panel-03-102.png",
-      "idiom": "watch",
-      "scale": "2x",
-      "size": "51x51",
-      "role": "appLauncher",
-      "subtype": "45mm"
-    },
-    {
-      "filename": "watch-panel-03-108.png",
-      "idiom": "watch",
-      "scale": "2x",
-      "size": "54x54",
-      "role": "appLauncher",
-      "subtype": "49mm"
-    },
-    {
-      "filename": "watch-panel-03-172.png",
-      "idiom": "watch",
-      "scale": "2x",
-      "size": "86x86",
-      "role": "quickLook",
-      "subtype": "38mm"
-    },
-    {
-      "filename": "watch-panel-03-196.png",
-      "idiom": "watch",
-      "scale": "2x",
-      "size": "98x98",
-      "role": "quickLook",
-      "subtype": "42mm"
-    },
-    {
-      "filename": "watch-panel-03-216.png",
-      "idiom": "watch",
-      "scale": "2x",
-      "size": "108x108",
-      "role": "quickLook",
-      "subtype": "44mm"
-    },
-    {
-      "filename": "watch-panel-03-234.png",
-      "idiom": "watch",
-      "scale": "2x",
-      "size": "117x117",
-      "role": "quickLook",
-      "subtype": "45mm"
-    },
-    {
-      "filename": "watch-panel-03-258.png",
-      "idiom": "watch",
-      "scale": "2x",
-      "size": "129x129",
-      "role": "quickLook",
-      "subtype": "49mm"
-    },
-    {
-      "filename": "watch-panel-03-1024.png",
-      "idiom": "watch-marketing",
-      "scale": "1x",
-      "size": "1024x1024"
-    }
-  ],
-  "info": {
-    "author": "xcode",
-    "version": 1
-  }
-}
diff --git a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-100.png b/design/brand/watchos/AppIcon.appiconset/watch-panel-03-100.png
deleted file mode 100644
index 8d72c1b..0000000
Binary files a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-100.png and /dev/null differ
diff --git a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-102.png b/design/brand/watchos/AppIcon.appiconset/watch-panel-03-102.png
deleted file mode 100644
index d5ac27c..0000000
Binary files a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-102.png and /dev/null differ
diff --git a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-1024.png b/design/brand/watchos/AppIcon.appiconset/watch-panel-03-1024.png
deleted file mode 100644
index 6f40b0a..0000000
Binary files a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-1024.png and /dev/null differ
diff --git a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-108.png b/design/brand/watchos/AppIcon.appiconset/watch-panel-03-108.png
deleted file mode 100644
index c9613d1..0000000
Binary files a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-108.png and /dev/null differ
diff --git a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-172.png b/design/brand/watchos/AppIcon.appiconset/watch-panel-03-172.png
deleted file mode 100644
index 995ec8b..0000000
Binary files a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-172.png and /dev/null differ
diff --git a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-196.png b/design/brand/watchos/AppIcon.appiconset/watch-panel-03-196.png
deleted file mode 100644
index 676a117..0000000
Binary files a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-196.png and /dev/null differ
diff --git a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-216.png b/design/brand/watchos/AppIcon.appiconset/watch-panel-03-216.png
deleted file mode 100644
index 90e53cb..0000000
Binary files a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-216.png and /dev/null differ
diff --git a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-234.png b/design/brand/watchos/AppIcon.appiconset/watch-panel-03-234.png
deleted file mode 100644
index 9fb18c5..0000000
Binary files a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-234.png and /dev/null differ
diff --git a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-258.png b/design/brand/watchos/AppIcon.appiconset/watch-panel-03-258.png
deleted file mode 100644
index 9eca1be..0000000
Binary files a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-258.png and /dev/null differ
diff --git a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-48.png b/design/brand/watchos/AppIcon.appiconset/watch-panel-03-48.png
deleted file mode 100644
index 6eb1304..0000000
Binary files a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-48.png and /dev/null differ
diff --git a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-55.png b/design/brand/watchos/AppIcon.appiconset/watch-panel-03-55.png
deleted file mode 100644
index 147f62c..0000000
Binary files a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-55.png and /dev/null differ
diff --git a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-58.png b/design/brand/watchos/AppIcon.appiconset/watch-panel-03-58.png
deleted file mode 100644
index 1efe951..0000000
Binary files a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-58.png and /dev/null differ
diff --git a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-66.png b/design/brand/watchos/AppIcon.appiconset/watch-panel-03-66.png
deleted file mode 100644
index 32d7b01..0000000
Binary files a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-66.png and /dev/null differ
diff --git a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-80.png b/design/brand/watchos/AppIcon.appiconset/watch-panel-03-80.png
deleted file mode 100644
index 37337e7..0000000
Binary files a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-80.png and /dev/null differ
diff --git a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-87.png b/design/brand/watchos/AppIcon.appiconset/watch-panel-03-87.png
deleted file mode 100644
index e37171c..0000000
Binary files a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-87.png and /dev/null differ
diff --git a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-88.png b/design/brand/watchos/AppIcon.appiconset/watch-panel-03-88.png
deleted file mode 100644
index 5c8da72..0000000
Binary files a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-88.png and /dev/null differ
diff --git a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-92.png b/design/brand/watchos/AppIcon.appiconset/watch-panel-03-92.png
deleted file mode 100644
index 74b9a60..0000000
Binary files a/design/brand/watchos/AppIcon.appiconset/watch-panel-03-92.png and /dev/null differ
diff --git a/docs/DISTRIBUTION.md b/docs/DISTRIBUTION.md
deleted file mode 100644
index 7ef29f5..0000000
--- a/docs/DISTRIBUTION.md
+++ /dev/null
@@ -1,135 +0,0 @@
-# Distribution
-
-Burrow distribution is split by platform authority.
-
-## Apple
-
-macOS, iOS, and visionOS builds use the Apple app plus NetworkExtension packet
-tunnel provider. App Store and TestFlight upload lanes stay separate from build
-lanes so signing, export, metadata, and external distribution are visible.
-
-Developer ID signing is moving to a KMS-backed key path. The
-`apple-developer-id-application` key in the Burrow `burrow-identity` Google KMS
-key ring is non-exportable and can produce a standard Apple CSR through
-`Scripts/apple/google-kms-csr.py` or the manual Forgejo
-`apple-developer-id-kms-csr.yml` workflow. The active G2 Developer ID
-Application certificate is `9JKN6HXBHC`, stored as public material at
-`Apple/Certificates/developer-id-application-9JKN6HXBHC.cer`, and expires on
-`2031-06-08`.
-
-App Store iOS signing uses the same non-exportable model. The
-`apple-ios-distribution` key in the Burrow identity key ring produced the active
-`IOS_DISTRIBUTION` certificate `3G42677598`, stored as public material at
-`Apple/Certificates/ios-distribution-3G42677598.cer`, and expires on
-`2027-06-07`. App Store Connect certificate creation can be driven by
-`Scripts/apple/create-asc-certificate.mjs` once a KMS-backed CSR has been
-generated.
-
-When `BURROW_IOS_DISTRIBUTION_CERTIFICATE_ID` is set, provisioning-profile sync
-pins iOS App Store profiles to that certificate. Existing App Store profiles
-with the same name are deleted and recreated if Apple reports that they contain
-a different distribution certificate.
-
-Sparkle appcast signing keeps the `sparkle-ed25519` Google KMS key available
-for payloads small enough for direct KMS Ed25519 signing, but normal macOS
-release archives are larger than Google KMS accepts for direct Ed25519
-messages. Those archives are signed directly from the decrypted release
-`SPARKLE_EDDSA_KEY_PATH` seed so Sparkle receives the standard
-full-archive EdDSA signature it verifies at update time. macOS release builds
-embed public EdDSA key
-`uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=` and point Sparkle metadata at
-`https://releases.burrow.net/sparkle/appcast.xml`. The appcast signer runs only
-when `BURROW_SPARKLE_SIGN_WITH_KMS=true` so unsigned local validation artifacts
-do not require Google credentials.
-
-This is not equivalent to the existing `.p12` keychain import path. The current
-Xcode packaging lane can still use exportable signing assets, while the
-KMS-backed Apple certificates require a follow-up signer integration that can
-ask Google KMS to produce code signatures without exporting the private key.
-
-## Android
-
-Android starts with a Kotlin shell and Rust core FFI stub. Full VPN support must
-use Android `VpnService`, which means Play Store builds need the VPN service
-declaration, clear in-app disclosure, and data-safety review before upload.
-
-## Linux
-
-The GTK app is the desktop UI. For VPN operation, it should talk to a host
-daemon or privileged helper that owns TUN, routes, DNS, and firewall state.
-
-Flatpak can package the GUI, but it should not be treated as the privileged data
-plane. The preferred Linux shape is:
-
-- native packages install `burrowd`, the systemd unit/socket, D-Bus policy, and
-  polkit policy
-- the Flatpak GUI talks to the host service over a narrowly named D-Bus API or a
-  constrained local daemon socket
-- the daemon performs privileged operations only after polkit authorizes the
-  user action
-
-A Flatpak build can either:
-
-- connect to a system/user Burrow daemon over a constrained local API
-- ask a host-installed helper to start or configure the daemon through a
-  reviewed D-Bus policy
-- stay as a configuration/status UI when no helper is installed
-
-It should not silently install native packages. PackageKit can be an optional
-bootstrap path on distros where the native Burrow daemon package is available,
-PackageKit is installed, and the Flatpak has a narrow
-`org.freedesktop.PackageKit` system-bus permission. That path is a convenience,
-not the baseline, because it is distro-dependent and still requires native
-package trust and polkit authorization.
-
-The native repository plan is now:
-
-- `packages.burrow.net/apt` for Debian-family packages
-- `packages.burrow.net/rpm/<channel>/<basearch>` for RPM-family packages
-- `packages.burrow.net/arch/burrow/<arch>` for pacman binary packages
-- `aur.archlinux.org/burrow-git.git` for the Arch source-build package
-- a Flatpak repository descriptor for the GTK GUI, paired with the native daemon
-- the NixOS flake/module for declarative NixOS installs
-
-Package repository signing is split by repository format. Google Cloud KMS owns
-non-exportable RSA signing keys for APT, RPM, pacman, Flatpak, and AUR source
-surfaces. The current repository builder signs APT `Release`, RPM `repomd.xml`,
-and pacman database/package sidecar signatures through the KMS OpenPGP bridge.
-Embedded RPM package signatures and Flatpak OSTree summary signing still need a
-dedicated implementation pass before those channels are promoted beyond
-staging.
-
-Release artifacts and signed repository trees publish through repo-owned storage
-wrappers. Garage is the required S3-compatible primary target; GCS remains the
-first backup target through buckets owned by `infra/releases`:
-`burrow-net-releases` for build artifacts and `burrow-net-packages` for package
-repositories. CI authenticates with Authentik-backed Google Workload Identity
-Federation before using Google KMS or `gcloud storage`; no Google
-service-account JSON key or rclone transport is part of the release path.
-
-An AppImage may be useful as a portable GUI on distributions without current
-Flatpak support, but it has the same daemon boundary as Flatpak. NixOS should
-prefer the flake/module path so daemon, policy, and service activation are
-declarative.
-
-## F-Droid and Play Store
-
-F-Droid should build from source with reproducible metadata and no proprietary
-Play dependencies in the free flavor. Play Store can use the same Rust core but
-requires the Play policy path for `VpnService`.
-
-## Flatpak
-
-Flatpak distribution is useful for desktop reach, but the app sandbox does not
-grant route, DNS, or TUN authority by itself. Burrow should publish Flatpak only
-with clear daemon/helper requirements until a real desktop smoke test proves the
-full flow.
-
-Flatpak can start child processes inside its sandbox and can request background
-or autostart permission for the Flatpak app. That is not enough for the VPN data
-plane. Starting the host daemon belongs to one of these paths:
-
-- systemd socket or D-Bus activation installed by the native package
-- explicit D-Bus call to a host helper with narrow permissions and polkit
-- PackageKit-assisted native package install where supported
-- manual native package install instructions opened from the GUI
diff --git a/docs/FORWARDEMAIL.md b/docs/FORWARDEMAIL.md
deleted file mode 100644
index 798f3e5..0000000
--- a/docs/FORWARDEMAIL.md
+++ /dev/null
@@ -1,101 +0,0 @@
-# Forward Email Backups
-
-Burrow's mail direction is hosted mail on [Forward Email](https://forwardemail.net/), with domain-owned backup retention in our own S3-compatible object storage.
-
-This is the first mail path to operationalize for `burrow.net` and `burrow.rs`. It keeps SMTP/IMAP hosting off the first forge host while still giving Burrow control over backup retention and object ownership.
-
-## What Forward Email Requires
-
-Forward Email exposes custom backup storage per domain. The documented API shape is:
-
-- `PUT /v1/domains/{domain}` with:
-  - `has_custom_s3=true`
-  - `s3_endpoint`
-  - `s3_access_key_id`
-  - `s3_secret_access_key`
-  - `s3_region`
-  - `s3_bucket`
-- `POST /v1/domains/{domain}/test-s3-connection`
-
-Forward Email also documents these operational constraints:
-
-- the bucket must remain private
-- credentials are validated with `HeadBucket`
-- failed or public-bucket configurations fall back to Forward Email's default storage and notify domain administrators
-- custom S3 keeps every backup version, so lifecycle expiration is our responsibility
-
-## Burrow Secret Layout
-
-Present in `intake/` today:
-
-- `intake/forwardemail_api_token.txt`
-- `intake/hetzner-s3-user.txt`
-- `intake/hetzner-s3-secret.txt`
-- Hetzner public S3 endpoint for Forward Email: `https://hel1.your-objectstorage.com`
-- Hetzner object storage region: `hel1`
-- Hetzner bucket used for Forward Email backups: `burrow`
-
-## Verified Storage State
-
-As of March 15, 2026, Burrow's Forward Email custom S3 configuration is live:
-
-- endpoint: `https://hel1.your-objectstorage.com`
-- region: `hel1`
-- bucket: `burrow`
-- `burrow.net` has `has_custom_s3=true`
-- `burrow.rs` has `has_custom_s3=true`
-- Forward Email's `/test-s3-connection` succeeded for both domains
-- the `burrow` bucket enforces lifecycle expiration after `90` days
-
-Forward Email performs bucket validation with bucket-style addressing. For Hetzner Object Storage, this means the working endpoint is the regional S3 endpoint (`https://hel1.your-objectstorage.com`), not the account alias (`https://burrow.hel1.your-objectstorage.com`). Using the account alias causes TLS hostname mismatches when the vendor prepends the bucket name.
-
-## Helper
-
-Use [`Tools/forwardemail-custom-s3.sh`](../Tools/forwardemail-custom-s3.sh) to configure or retest the domain setting without putting secrets on the process list.
-
-Use [`Tools/forwardemail-hetzner-storage.py`](../Tools/forwardemail-hetzner-storage.py) to ensure the Hetzner backup bucket exists and to apply lifecycle expiry before enabling custom S3 on the Forward Email side.
-
-Bucket bootstrap example:
-
-```sh
-Tools/forwardemail-hetzner-storage.py \
-  --endpoint https://hel1.your-objectstorage.com \
-  --bucket burrow \
-  --expire-days 90
-```
-
-Example:
-
-```sh
-Tools/forwardemail-custom-s3.sh \
-  --domain burrow.net \
-  --api-token-file intake/forwardemail_api_token.txt \
-  --s3-endpoint https://hel1.your-objectstorage.com \
-  --s3-region hel1 \
-  --s3-bucket burrow \
-  --s3-access-key-file intake/hetzner-s3-user.txt \
-  --s3-secret-key-file intake/hetzner-s3-secret.txt
-```
-
-Retest an existing domain configuration without rewriting it:
-
-```sh
-Tools/forwardemail-custom-s3.sh \
-  --domain burrow.net \
-  --api-token-file intake/forwardemail_api_token.txt \
-  --test-only
-```
-
-## Retention
-
-Forward Email preserves every backup object when custom S3 is enabled. Configure lifecycle expiration on the bucket itself. A 30-day or 90-day expiry window is the baseline recommendation from the vendor docs; Burrow should choose explicitly per domain instead of letting the bucket grow without bound. The current Burrow bootstrap helper defaults to `90` days.
-
-## Identity Direction
-
-Hosted mail and SaaS identity are separate concerns:
-
-- mail hosting/backups: Forward Email + Burrow-owned S3-compatible storage
-- interactive identity: Authentik as the long-term IdP
-- future SaaS SSO target: Linear via SAML once the workspace and plan are ready
-
-This means the forge host does not need to become the first mail server just to give Burrow mailboxes or retention control.
diff --git a/docs/GETTING_STARTED.md b/docs/GETTING_STARTED.md
index e36bbad..764c219 100644
--- a/docs/GETTING_STARTED.md
+++ b/docs/GETTING_STARTED.md
@@ -75,7 +75,7 @@ rustup toolchain install stable-msvc
 1. Clone the repository:
 
 ```
-git clone https://git.burrow.net/hackclub/burrow.git
+git clone git@github.com:hackclub/burrow.git
 ```
 
 2. Open the `burrow` folder in Visual Studio Code:
@@ -98,14 +98,10 @@ code burrow
 You can run burrow on the command line with cargo:
 
 ```
-sudo -E cargo run -- start
+cargo run
 ```
 
-Creating the tunnel requires elevated privileges. Regular checks and tests can run without `sudo`:
-
-```
-cargo test --workspace --all-features
-```
+Cargo will ask for your password because burrow needs permission in order to create a tunnel.
 
 </details>
 
diff --git a/docs/GTK_APP.md b/docs/GTK_APP.md
index a22f8fc..9b103a3 100644
--- a/docs/GTK_APP.md
+++ b/docs/GTK_APP.md
@@ -1,82 +1,22 @@
 # Linux GTK App Getting Started
 
-Currently, the GTK App can be built as a binary or as an AppImage. The Flatpak
-lane is a GUI packaging target until Burrow has a verified host daemon/helper
-path for TUN, routes, DNS, and firewall state. The intended Flatpak behavior is
-to discover and talk to a native Burrow daemon installed by DEB, RPM, or the
-NixOS flake/module, not to own privileged routing itself.
-
 ## Dependencies
 
 ### Install Build Dependencies
 
-<details>
-  <summary>Debian</summary>
-
-  > Note: Burrow currently cannot compile on Debian Stable (Bookworm) due to its outdated dependencies
-
-  1. Install build dependencies
-
-  ```
-  sudo apt install -y clang meson cmake pkg-config libssl-dev libgtk-4-dev libadwaita-1-dev gettext desktop-file-utils
-  ```
-
-  2. Install flatpak builder (Optional)
-
-  ```
-  sudo apt install -y flatpak-builder
-  ```
-
-  3. Install AppImage build tools (Optional)
-  
-  ```
-  sudo apt install -y wget fuse file
-  ```
-
-</details>
-
 <details>
   <summary>Fedora</summary>
 
-  1. Install build dependencies
+  1. Install build dependencies 
 
   ```
-  sudo dnf install -y clang ninja-build cmake meson openssl-devel gtk4-devel glib2-devel libadwaita-devel desktop-file-utils libappstream-glib
+  sudo dnf install clang ninja cmake meson gtk4-devel glib2-devel libadwaita-devel desktop-file-utils libappstream-glib
   ```
 
   2. Install flatpak builder (Optional)
 
   ```
-  sudo dnf install -y flatpak-builder
-  ```
-
-  3. Install AppImage build tools (Optional)
-  
-  ```
-  sudo dnf install -y util-linux wget fuse fuse-libs file
-  ```
-
-</details>
-
-<details>
-  <summary>Void Linux (glibc)</summary>
-
-  1. Install build dependencies
-
-  ```
-  sudo xbps-install -Sy gcc clang meson cmake pkg-config openssl-devel gtk4-devel gettext desktop-file-utils gtk4-update-icon-cache appstream-glib
-  ```
-
-  2. Install flatpak builder (Optional)
-
-  ```
-  sudo xbps-install -Sy flatpak-builder
-  ```
-
-  3. Install AppImage build tools (Optional)
-  
-  ```
-  sudo xbps-install -Sy wget fuse file
+  sudo dnf install flatpak-builder
   ```
 
 </details>
@@ -91,12 +31,6 @@ flatpak install --user \
 
 ## Building
 
-With Nix, enter the focused GTK shell before running the Meson build:
-
-```bash
-nix develop .#gtk
-```
-
 <details>
   <summary>General</summary>
 
@@ -117,10 +51,10 @@ nix develop .#gtk
 <details>
   <summary>Flatpak</summary>
 
-  1. Compile and install the flatpak
+  1. Compile and install the flatpak 
 
   ```
-  flatpak-builder
+  flatpak-builder 
       --user --install --force-clean --disable-rofiles-fuse \
       flatpak_debug/ \
       burrow-gtk/build-aux/com.hackclub.burrow.devel.json
@@ -128,36 +62,9 @@ nix develop .#gtk
 
 </details>
 
-<details>
-  <summary>AppImage</summary>
-
-  1. Enter the `burrow-gtk`
-
-  ```bash
-  cd burrow-gtk
-  ```
-
-  2. Compile the AppImage
-  
-  ```
-  ./build-aux/build_appimage.sh
-  ```
-
-</details>
-
 
 ## Running
 
-The GTK app mirrors the Apple home surface: a Burrow header, Networks carousel,
-Accounts section, Tunnel action, and the same add flows for WireGuard, Tor, and
-Tailnet. It talks to the daemon over the same gRPC API used by Apple clients for
-network storage, tunnel state, Tailnet discovery, authority probing, browser
-sign-in, and Tailnet payloads.
-
-On Linux the GTK app first looks for a daemon on the configured gRPC socket. If
-none is reachable, it starts an embedded user-scoped daemon with a socket under
-`XDG_RUNTIME_DIR` and a database under `XDG_DATA_HOME` before refreshing the UI.
-
 <details>
   <summary>General</summary>
 
@@ -176,14 +83,3 @@ none is reachable, it starts an embedded user-scoped daemon with a socket under
   ```
 
 </details>
-
-<details>
-  <summary>AppImage</summary>
-
-  The compiled binary can be found in `build-appimage/Burrow-*.AppImage`.
-
-  ```
-  ./build-appimage/Burrow-*.AppImage
-  ```
-
-</details>
diff --git a/docs/NIX_CACHE.md b/docs/NIX_CACHE.md
deleted file mode 100644
index 96862c3..0000000
--- a/docs/NIX_CACHE.md
+++ /dev/null
@@ -1,88 +0,0 @@
-# Burrow Nix Cache
-
-`nix.burrow.net` is the Burrow Nix binary cache surface for forge jobs and
-workers.
-
-The host layout is:
-
-- Garage stores objects on the forge host's Garage data volume.
-- Attic serves the Nix binary cache API at `nix.burrow.net`.
-- Attic stores NAR chunks in the Garage `attic` bucket through the local S3 API.
-- Workers consume `https://nix.burrow.net/burrow` as a substituter once the
-  cache public key is configured.
-
-Garage is not a multi-backend object sync manager. It can replicate across
-Garage nodes, but it does not write the same object to GCS and another provider
-as independent storage backends. Multi-cloud backup should be a separate mirror
-or export job from Garage buckets to GCS and later to additional providers.
-
-## Host Bootstrap
-
-`services.burrow.garage` creates a host-local environment file at
-`/var/lib/burrow/garage/env`. The file is not stored in Git or the Nix store.
-It contains:
-
-- Garage RPC secret
-- Garage access keys for Attic, release artifacts, package repositories, and
-  read-only backups
-- Attic JWT signing secret
-- AWS-compatible variables used by Attic to talk to Garage
-
-`burrow-garage-bootstrap.service` creates the initial single-node Garage layout,
-imports the generated keys, and creates the `attic`, `burrow-releases`, and
-`burrow-packages` buckets. It grants the backup key read-only access to those
-three buckets so CI can mirror them without receiving owner/write access to
-Garage.
-
-`services.burrow.nixCache` enables Attic, points it at Garage, exposes it through
-Caddy, creates a public `burrow` cache, and writes two host-local tokens:
-
-- `/var/lib/burrow/nix-cache/admin-token`: bootstrap/admin recovery token
-- `/var/lib/burrow/nix-cache/ci-push-token`: scoped pull/push token for the
-  `burrow` cache
-
-## Worker Configuration
-
-`Scripts/ci/ensure-nix.sh` uses the Burrow cache only when
-`BURROW_NIX_CACHE_PUBLIC_KEY` is present:
-
-```sh
-BURROW_NIX_CACHE_URL=https://nix.burrow.net/burrow
-BURROW_NIX_CACHE_PUBLIC_KEY=<cache public key from attic cache info>
-```
-
-Without the public key, CI falls back to `cache.nixos.org` only. This avoids
-configuring an unsigned or untrusted substituter.
-
-After deployment, get the public key from the host:
-
-```sh
-attic cache info local:burrow
-```
-
-Then set `BURROW_NIX_CACHE_PUBLIC_KEY` in Forgejo variables.
-
-Seal the scoped push token from `/var/lib/burrow/nix-cache/ci-push-token` into
-Forgejo/OpenBao as `BURROW_NIX_CACHE_PUSH_TOKEN`. The
-`Cache: Publish Nix` workflow runs `Scripts/ci/publish-nix-cache.sh`, builds the
-selected flake outputs, and pushes their closures to Attic. It skips cleanly
-when the push token is absent unless `BURROW_NIX_CACHE_REQUIRED=true`.
-
-## Backups
-
-The Garage `attic` bucket is backed up to the private GCS bucket
-`burrow-net-nix-cache`. Release artifacts and package repositories are backed up
-to their public GCS buckets. The scheduled `Backup: Garage Storage` workflow
-runs `Scripts/ci/backup-garage-to-gcs.sh` with:
-
-```sh
-BURROW_GARAGE_ENDPOINT=https://objects.burrow.net
-AWS_ACCESS_KEY_ID=<GARAGE_BACKUP_ACCESS_KEY_ID from the host env>
-AWS_SECRET_ACCESS_KEY=<GARAGE_BACKUP_SECRET_ACCESS_KEY from the host env>
-BURROW_NIX_CACHE_GCS_BUCKET=burrow-net-nix-cache
-```
-
-The workflow authenticates to Google through Authentik-backed WIF and uses
-`gcloud storage rsync`. It does not use rclone or Google service-account JSON
-keys. Destination deletes are disabled by default; set
-`BURROW_GARAGE_BACKUP_DELETE=true` only for an intentional prune run.
diff --git a/docs/OBSERVABILITY.md b/docs/OBSERVABILITY.md
deleted file mode 100644
index 04a17b3..0000000
--- a/docs/OBSERVABILITY.md
+++ /dev/null
@@ -1,60 +0,0 @@
-# Burrow Observability
-
-The forge host imports `services.burrow.observability`, which wires the first
-production observability spine:
-
-- Prometheus on `127.0.0.1:9090`
-- OpenTelemetry collector OTLP gRPC on `127.0.0.1:4317`
-- OpenTelemetry collector OTLP HTTP on `127.0.0.1:4318`
-- collector Prometheus export on `127.0.0.1:9464`
-- Jaeger all-in-one on local ports only
-- Grafana at `graphs.burrow.net`, backed by Authentik SSO
-
-Grafana datasources are provisioned by NixOS:
-
-- `prometheus` points at local Prometheus
-- `jaeger` points at the local Jaeger query API
-
-OpenTofu owns checked-in dashboards under `services/grafana/dashboards/`:
-
-- `burrow-overview.json`
-- `headscale.json`
-- `observability.json`
-
-## Metrics
-
-Prometheus scrapes:
-
-- Prometheus self metrics
-- node exporter
-- systemd exporter
-- Grafana `/metrics`
-- Headscale `/metrics` on `127.0.0.1:9098`
-- OpenTelemetry collector metrics
-- Jaeger admin metrics
-- Garage admin metrics when `services.burrow.garage.enable = true`
-- the optional Tailscale exporter when its OAuth environment file is configured
-
-Headscale and Tailscale are treated as the same Tailnet family in dashboards.
-Headscale exposes a local Prometheus listener through
-`services.burrow.headscale.enableMetrics`. Tailscale SaaS metrics require the
-NixOS Tailscale exporter and an OAuth environment file; the module leaves that
-disabled until the credential is provisioned.
-
-## Traces
-
-Burrow services that emit OpenTelemetry traces should use:
-
-```sh
-OTEL_EXPORTER_OTLP_ENDPOINT=http://127.0.0.1:4317
-OTEL_EXPORTER_OTLP_PROTOCOL=grpc
-OTEL_SERVICE_NAME=burrow
-```
-
-The collector exports traces to Jaeger. Jaeger is intentionally local-only for
-now; Grafana can query it server-side through the provisioned datasource.
-
-Headscale and Tailscale currently enter the spine through Prometheus metrics and
-systemd state. If an upstream Tailnet component starts emitting OTLP, point it
-at the same local collector endpoint rather than exposing Jaeger or Prometheus
-directly.
diff --git a/docs/PLATFORM_SERVICES.md b/docs/PLATFORM_SERVICES.md
deleted file mode 100644
index b4d1304..0000000
--- a/docs/PLATFORM_SERVICES.md
+++ /dev/null
@@ -1,99 +0,0 @@
-# Platform Services
-
-Burrow's next platform layer is split into service boundaries that can be
-enabled independently after their security and rollback checks pass.
-
-## Identity and KMS
-
-`infra/identity` owns Google Cloud KMS and Workload Identity Federation
-resources for the Burrow Google project:
-
-- project id: `project-88c23ce9-918a-470a-b33`
-- project number: `416198671487`
-- key ring: `burrow-identity`
-- intended keys: Authentik signing, SAML CA signing, release signing
-
-The WIF path is for Authentik-backed Forgejo runners. Runners should exchange an
-OIDC token for a short-lived Google credential instead of carrying static
-service-account JSON.
-
-Release storage uses provider-neutral upload wrappers. Garage is the required
-S3-compatible primary target. GCS is the first backup target and remains the
-compatibility source for current
-Sparkle/store follow-on jobs:
-
-- release artifacts: `burrow-net-releases`
-- signed package repositories: `burrow-net-packages`
-- private Nix cache backup: `burrow-net-nix-cache`
-
-Forgejo jobs authenticate to the same Google project through Authentik-backed
-WIF, then use `gcloud storage` for upload/download and Google KMS for release
-and repository signatures. No rclone transport or Google service-account JSON
-key is part of the release path.
-
-`services.burrow.garage` is enabled by the forge host. It provides the host
-activation point for Garage API, static-web, and admin listeners, and
-bootstraps the initial single-node layout plus the `attic`, `burrow-releases`,
-and `burrow-packages` buckets. It creates separate owner/write keys for Attic,
-release artifacts, and package repositories, plus a read-only backup key for
-the scheduled Garage-to-GCS mirror.
-
-Garage is now the primary object-storage surface for release/package uploads and
-the Nix cache. It uses host-local storage for object data and metadata; it does
-not fan out writes to multiple object-store backends. Multi-cloud failover
-should be implemented as explicit Garage bucket mirrors/backups, with GCS as the
-first backup target.
-
-## Nix Cache
-
-`nix.burrow.net` is the Burrow Nix binary cache surface. The forge host runs
-Attic behind Caddy and stores cache chunks in the Garage `attic` bucket through
-Garage's local S3 API. Workers can use `https://nix.burrow.net/burrow` once the
-cache public key is published as `BURROW_NIX_CACHE_PUBLIC_KEY` in Forgejo. The
-host bootstrap also creates `/var/lib/burrow/nix-cache/ci-push-token`; seal it
-as `BURROW_NIX_CACHE_PUSH_TOKEN` before enabling broad cache publication.
-
-## Observability
-
-`graphs.burrow.net` is backed by Grafana with Authentik SSO. The forge host now
-imports `services.burrow.observability`, which starts local Prometheus,
-OpenTelemetry collector, and Jaeger services. NixOS provisions Grafana
-datasources; OpenTofu manages checked-in dashboards for the Burrow overview,
-Headscale, and the broader Prometheus/OpenTelemetry/Jaeger spine.
-
-Jaeger is local-only at first and is queried through Grafana. Headscale metrics
-are scraped locally. Tailscale SaaS metrics are optional until the OAuth
-credential file exists.
-
-## OpenBao
-
-`vault.burrow.net` is the planned OpenBao surface. The repository now has:
-
-- `infra/openbao` for KMS seal wrapping and OpenBao auth/policy resources
-- `services.burrow.openbao` as a disabled-by-default NixOS switch point
-- `Scripts/openbao-tofu.sh` for stack-local OpenTofu operations
-
-OpenBao should not be enabled until the KMS seal key, bootstrap token handling,
-backup/restore procedure, and Authentik roles are verified.
-
-## Jitsi Meet
-
-`meet.burrow.net` is the planned Jitsi Meet surface. The repository now has
-`services.burrow.jitsi` as a disabled-by-default NixOS switch point.
-
-Jitsi is not just an HTTP service. The rollout needs DNS, TLS, XMPP/prosody
-state, and an explicit UDP media-port decision before activation.
-
-## Mail and Webmail
-
-`inbox.burrow.net` is the intended webmail surface. Stalwart is the planned mail
-server, but this flake does not currently expose the expected Stalwart NixOS
-option. Forward Email remains the current production mail path until the
-Stalwart module name, ports, DKIM rotation, backup target, spam policy, and
-migration steps are pinned in a follow-up BEP update.
-
-## MCP Hub
-
-The MCP hub should be extracted to `compatible.systems/burrow/mcp-hub`. Until
-that repository exists, `services/mcp-hub/` records the extraction boundary and
-tool inventory.
diff --git a/docs/PROTOCOL_ROADMAP.md b/docs/PROTOCOL_ROADMAP.md
deleted file mode 100644
index 37c7228..0000000
--- a/docs/PROTOCOL_ROADMAP.md
+++ /dev/null
@@ -1,31 +0,0 @@
-# Protocol Roadmap
-
-Burrow currently has two tunnel paths in-tree:
-
-- a WireGuard data plane
-- a Tor-backed userspace TCP path
-
-What it does not have yet is a transport-neutral control plane that can honestly claim full MASQUE `CONNECT-IP` or full Tailscale-style negotiation parity. This repository now contains the beginnings of that layer:
-
-- control-plane data structures in `burrow/src/control/mod.rs`
-- local auth bootstrap and persistent node/session storage in `burrow/src/auth/server/`
-- governance documents under `evolution/` for the bigger protocol work
-
-## `CONNECT-IP`
-
-Full RFC 9484 support requires more than packet forwarding. It needs HTTP/3 session management, Capsule handling, HTTP Datagram context identifiers, address assignment, route advertisement, and request-scope enforcement. Burrow does not implement those end to end yet.
-
-## Tailscale-Style Negotiation
-
-Burrow now has register/map request and response types plus persistent node records, but it does not yet implement the full Tailscale capability surface, peer delta protocol, DERP coordination, or Noise-based control transport.
-
-## Current Direction
-
-The intended sequence is:
-
-1. Stabilize the control-plane data model and bootstrap auth.
-2. Introduce transport-neutral route and address abstractions.
-3. Add MASQUE framing and HTTP/3 transport support.
-4. Expand policy, relay, and interoperability testing.
-
-This keeps Burrow honest about what is running today while creating a clean path for the rest.
diff --git a/docs/WIREGUARD_LINEAGE.md b/docs/WIREGUARD_LINEAGE.md
deleted file mode 100644
index 63e8839..0000000
--- a/docs/WIREGUARD_LINEAGE.md
+++ /dev/null
@@ -1,30 +0,0 @@
-# WireGuard Rust Lineage
-
-Burrow's in-tree WireGuard engine is not a greenfield implementation. It was lifted from the Rust WireGuard lineage around Cloudflare's BoringTun, then cut down and reshaped to fit Burrow's own daemon and tunnel abstractions.
-
-## What Was Lifted
-
-- The repository history includes `1b39eca` (`boringtun wip`) and `28af9003` (`merge boringtun into burrow`).
-- The current `burrow/src/wireguard/noise/*` files still carry the original Cloudflare copyright and SPDX headers.
-- Core protocol machinery such as the Noise handshake, session state, rate limiter, and timer logic came from that imported body of work.
-
-## What Changed in Burrow
-
-Burrow does not embed BoringTun unchanged.
-
-- The original device layer was replaced with Burrow-specific interface and peer control blocks in `burrow/src/wireguard/iface.rs` and `burrow/src/wireguard/pcb.rs`.
-- Configuration handling was rewritten around Burrow's own INI parser and config model in `burrow/src/wireguard/config.rs`.
-- The daemon now resolves the active runtime from the database-backed network list rather than from a single static WireGuard payload.
-- Burrow added its own runtime switching path so WireGuard can share one daemon lifecycle with the rest of the managed runtime system.
-
-## What Was Improved
-
-The lifted code has been tightened further in-repo.
-
-- Deprecated constant-time comparisons were replaced with `subtle`.
-- Network ordering and runtime selection are now deterministic and test-covered.
-- The Burrow runtime can swap between WireGuard configurations without restarting the daemon process itself.
-
-## Why This Matters
-
-This project should be explicit about lineage. Burrow benefits from proven Rust WireGuard work, but it owns the integration surface, runtime behavior, and future maintenance burden. That is why the code should be documented as lifted, modified, and improved rather than described as wholly original.
diff --git a/evolution/README.md b/evolution/README.md
deleted file mode 100644
index 794b1fe..0000000
--- a/evolution/README.md
+++ /dev/null
@@ -1,74 +0,0 @@
-# Burrow Evolution
-
-Burrow Evolution Proposals (BEPs) are the repository's durable design record for protocol work, control-plane changes, forge infrastructure, and operational policy.
-
-## Goals
-
-1. Capture intent before implementation outruns the architecture.
-2. Give contributors and agents enough context to work safely without re-discovering prior decisions.
-3. Tie ambitious work to concrete validation, rollout, and rollback criteria.
-
-## When a BEP is required
-
-Open a BEP for:
-
-- new transports or protocol families
-- control-plane and identity changes
-- deployment, forge, runner, or secrets changes
-- data model migrations
-- user-visible behavior that changes security or routing semantics
-
-Small bug fixes and isolated refactors do not need a BEP unless they materially change one of the areas above.
-
-## Lifecycle
-
-1. Pitch
-   Capture the problem and why it matters now.
-2. Draft
-   Copy `evolution/proposals/0000-template.md` to `evolution/proposals/BEP-XXXX-short-slug.md`.
-3. Review
-   Collect feedback, tighten the design, and document unresolved concerns.
-4. Decision
-   Mark the proposal `Accepted`, `Rejected`, or `Returned for Revision`.
-5. Implementation
-   Link code changes, tests, and rollout evidence.
-6. Supersession
-   Keep historical proposals in-tree and point forward to the replacing BEP.
-
-## Status Values
-
-- `Pitch`
-- `Draft`
-- `In Review`
-- `Accepted`
-- `Implemented`
-- `Rejected`
-- `Returned for Revision`
-- `Superseded`
-- `Archived`
-
-## Layout
-
-```text
-evolution/
-  README.md
-  proposals/
-    0000-template.md
-    BEP-0001-...
-```
-
-Use ASCII Markdown. Keep metadata at the top of each proposal so tooling and future agents can parse it quickly.
-
-## BEP Helper
-
-Use the `bep` helper under `Scripts/` to browse or list proposals:
-
-- `Scripts/bep` opens a quick browser for `evolution/`.
-- `Scripts/bep list --status Draft` lists proposals by status.
-- `Scripts/bep open BEP-0005` opens a proposal in `$EDITOR`.
-
-Validate proposal metadata with:
-
-```bash
-python3 Scripts/check-bep-metadata.py
-```
diff --git a/evolution/proposals/0000-template.md b/evolution/proposals/0000-template.md
deleted file mode 100644
index 66954c6..0000000
--- a/evolution/proposals/0000-template.md
+++ /dev/null
@@ -1,57 +0,0 @@
-# `BEP-XXXX` - Title Case Summary
-
-```text
-Status: Draft | In Review | Accepted | Implemented | Rejected | Returned for Revision | Superseded | Archived
-Proposal: BEP-XXXX
-Authors: <name(s) or agent ids>
-Coordinator: <name>
-Reviewers: <people, bots, contributors>
-Constitution Sections: <II, III, IV, etc.>
-Implementation PRs: <link(s)> (optional while drafting)
-Decision Date: <YYYY-MM-DD or Pending>
-```
-
-## Summary
-
-One or two paragraphs that state the desired outcome and why it matters.
-
-## Motivation
-
-- What problem exists today?
-- Why should Burrow solve it now?
-- Which issues, incidents, or constraints support the change?
-
-## Detailed Design
-
-- Architecture and boundaries
-- Data model and migration plan
-- Protocol or API changes
-- Observability, testing, and failure handling
-
-## Security and Operational Considerations
-
-- Access and secret handling
-- Abuse, downgrade, or supply-chain risks
-- Rollback and kill-switch plans
-
-## Contributor Playbook
-
-Give the concrete steps, commands, checks, and evidence a contributor should produce while implementing or rolling out the change.
-
-## Alternatives Considered
-
-List alternatives and why they were rejected.
-
-## Impact on Other Work
-
-- follow-up tasks
-- dependencies
-- compatibility constraints
-
-## Decision
-
-Record the final call, who made it, and any conditions.
-
-## References
-
-Link relevant issues, specs, transcripts, and external research.
diff --git a/evolution/proposals/BEP-0001-sovereign-forge-and-governance.md b/evolution/proposals/BEP-0001-sovereign-forge-and-governance.md
deleted file mode 100644
index f48a7a9..0000000
--- a/evolution/proposals/BEP-0001-sovereign-forge-and-governance.md
+++ /dev/null
@@ -1,61 +0,0 @@
-# `BEP-0001` - Sovereign Forge and Governance Bootstrap
-
-```text
-Status: Draft
-Proposal: BEP-0001
-Authors: gpt-5.4
-Coordinator: gpt-5.4
-Reviewers: Pending
-Constitution Sections: II, III, V
-Implementation PRs: Pending
-Decision Date: Pending
-```
-
-## Summary
-
-Burrow should own its forge, deployment logic, and operational context under `burrow.net`. This proposal establishes the repository-local governance and forge bootstrap required to move build, release, and infrastructure control out of GitHub-centric assumptions and into a self-hosted operating model.
-
-## Motivation
-
-- The repository currently keeps CI definitions under `.github/workflows/` but has no first-class self-hosted forge layout.
-- Infrastructure changes and protocol work are already entangled; without a design record, the project risks landing irreversible operations without enough context.
-- A self-hosted forge is a prerequisite for durable autonomy over source, runners, and release pipelines.
-
-## Detailed Design
-
-- Add a project constitution and BEP process under `evolution/`.
-- Introduce a Nix flake and NixOS host/module layout for `burrow-forge`.
-- Add Forgejo-native workflows under `.forgejo/workflows/` for repository-local CI.
-- Bootstrap the initial forge identity around `contact@burrow.net` and an agent-owned SSH workflow.
-
-## Security and Operational Considerations
-
-- Initial bootstrap may read credentials from local intake, but production must converge on encrypted secret handling.
-- The first forge host replacement must preserve rollback information before deleting any existing VM.
-- DNS for `burrow.net` is currently pending activation; the forge rollout must not assume public reachability until nameserver cutover completes.
-
-## Contributor Playbook
-
-- Keep destructive host operations behind explicit verification of the current Hetzner state.
-- Build and test repository-local workflows before using them for deployment.
-- Record the active server id, image, IPs, and SSH path before replacement.
-
-## Alternatives Considered
-
-- Continue relying on GitHub Actions while separately hosting services. Rejected because it leaves source authority and CI policy split across systems.
-- Stand up Forgejo without a repository-local operating model. Rejected because the repo would still be missing deployment truth.
-
-## Impact on Other Work
-
-- Blocks long-term migration of workflows away from GitHub.
-- Provides the governance anchor for protocol and control-plane proposals.
-
-## Decision
-
-Pending.
-
-## References
-
-- `CONSTITUTION.md`
-- `.github/workflows/`
-- `.forgejo/workflows/`
diff --git a/evolution/proposals/BEP-0002-control-plane-bootstrap-and-local-auth.md b/evolution/proposals/BEP-0002-control-plane-bootstrap-and-local-auth.md
deleted file mode 100644
index 2558d09..0000000
--- a/evolution/proposals/BEP-0002-control-plane-bootstrap-and-local-auth.md
+++ /dev/null
@@ -1,60 +0,0 @@
-# `BEP-0002` - Control-Plane Bootstrap and Local Auth
-
-```text
-Status: Draft
-Proposal: BEP-0002
-Authors: gpt-5.4
-Coordinator: gpt-5.4
-Reviewers: Pending
-Constitution Sections: I, II, III, V
-Implementation PRs: Pending
-Decision Date: Pending
-```
-
-## Summary
-
-Burrow needs a repository-owned control-plane model instead of ad hoc network payload storage plus third-party-only auth. This proposal introduces a local username/password bootstrap for `contact@burrow.net`, plus a register/map data model shaped to support a Tailscale-style control server without claiming full parity yet.
-
-## Motivation
-
-- Current auth support is limited and does not provide a plain local bootstrap path for the project's own operator identity.
-- The existing database stores network payloads, but not a durable model for users, nodes, sessions, or control-plane negotiation state.
-- Future work on route policy, device coordination, and richer negotiation needs a real data model now.
-
-## Detailed Design
-
-- Add control-plane types for users, nodes, register requests, and map responses.
-- Extend the auth server schema with local credentials, sessions, provider logins, and control nodes.
-- Expose JSON endpoints for local login, node registration, and map retrieval.
-- Seed the initial operator account from intake-backed bootstrap credentials.
-
-## Security and Operational Considerations
-
-- Passwords are stored with Argon2id hashes only.
-- Session tokens are bearer credentials and must be treated as sensitive.
-- The bootstrap credential path is a short-term path; follow-up work should move it into encrypted secret management before public deployment.
-
-## Contributor Playbook
-
-- Verify bootstrap account creation in an isolated test database.
-- Exercise login, register, and map end to end with integration tests.
-- Do not advertise protocol parity beyond the implemented request/response contract.
-
-## Alternatives Considered
-
-- Wait for full external identity-provider integration first. Rejected because the forge needs an operator account now.
-- Keep control-plane state implicit in daemon-local configuration. Rejected because it cannot express multi-device coordination.
-
-## Impact on Other Work
-
-- Unblocks forge bootstrap and future device control-plane work.
-- Creates the storage model needed for richer policy and transport proposals.
-
-## Decision
-
-Pending.
-
-## References
-
-- `burrow/src/auth/server/`
-- `burrow/src/control/`
diff --git a/evolution/proposals/BEP-0003-connect-ip-and-negotiation-roadmap.md b/evolution/proposals/BEP-0003-connect-ip-and-negotiation-roadmap.md
deleted file mode 100644
index 99ddedf..0000000
--- a/evolution/proposals/BEP-0003-connect-ip-and-negotiation-roadmap.md
+++ /dev/null
@@ -1,61 +0,0 @@
-# `BEP-0003` - CONNECT-IP and Negotiation Roadmap
-
-```text
-Status: Draft
-Proposal: BEP-0003
-Authors: gpt-5.4
-Coordinator: gpt-5.4
-Reviewers: Pending
-Constitution Sections: I, II, V
-Implementation PRs: Pending
-Decision Date: Pending
-```
-
-## Summary
-
-Burrow should grow from a WireGuard-first tunnel runner into a transport stack that can support HTTP/3 MASQUE `CONNECT-IP` and a richer node negotiation model. This proposal stages that work so Burrow can adopt the right abstractions instead of stapling QUIC-era semantics onto a WireGuard-only daemon.
-
-## Motivation
-
-- `CONNECT-IP` introduces HTTP/3 sessions, context identifiers, address assignment, and route advertisements that do not fit the current daemon model.
-- A Tailscale-style control plane requires explicit node, endpoint, and session state rather than raw network blobs.
-- The project needs a roadmap that distinguishes data-model work, control-plane work, and actual transport implementation.
-
-## Detailed Design
-
-- Stage 1: land control-plane types and persistent auth/session/node storage.
-- Stage 2: add transport-agnostic route, address-assignment, and policy abstractions in Burrow.
-- Stage 3: implement MASQUE `CONNECT-IP` framing and HTTP Datagram handling.
-- Stage 4: connect the transport layer to real relay, policy, and observability paths.
-
-## Security and Operational Considerations
-
-- `CONNECT-IP` changes the trust boundary from WireGuard peers to HTTP/3 peers and relays; authentication, replay handling, and scope restriction must be explicit.
-- Route advertisements and delegated prefixes must be validated before touching the data plane.
-- Control-plane capability claims must not imply support that the transport layer does not yet implement.
-
-## Contributor Playbook
-
-- Keep protocol codecs independently testable before integrating them into live transports.
-- Add interoperability tests for every new capsule or datagram type.
-- Separate request parsing, policy validation, and packet forwarding so regressions stay localized.
-
-## Alternatives Considered
-
-- Implement MASQUE directly in the daemon without control-plane refactoring. Rejected because the current daemon has no transport-neutral contract for routes or prefixes.
-- Treat Tailscale negotiation as a one-off compatibility shim. Rejected because Burrow needs first-class control-plane concepts either way.
-
-## Impact on Other Work
-
-- Depends on BEP-0002.
-- Informs future relay, policy, and node coordination work.
-
-## Decision
-
-Pending.
-
-## References
-
-- RFC 9484
-- `burrow/src/daemon/`
-- `burrow/src/control/`
diff --git a/evolution/proposals/BEP-0004-hosted-mail-and-saas-identity.md b/evolution/proposals/BEP-0004-hosted-mail-and-saas-identity.md
deleted file mode 100644
index d633f37..0000000
--- a/evolution/proposals/BEP-0004-hosted-mail-and-saas-identity.md
+++ /dev/null
@@ -1,68 +0,0 @@
-# `BEP-0004` - Hosted Mail Backups and SaaS Identity
-
-```text
-Status: Draft
-Proposal: BEP-0004
-Authors: gpt-5.4
-Coordinator: gpt-5.4
-Reviewers: Pending
-Constitution Sections: II, III, V
-Implementation PRs: Pending
-Decision Date: Pending
-```
-
-## Summary
-
-Burrow should start with hosted mail on Forward Email instead of self-hosting SMTP and IMAP on the first forge machine. Backup retention should still be controlled by Burrow through custom S3-compatible storage backed by Burrow-owned object storage. In parallel, Burrow should treat SaaS identity as a separate track and converge on Authentik as the long-term IdP, with Linear SAML SSO as a planned downstream integration rather than an immediate bootstrap dependency.
-
-## Motivation
-
-- The first forge host already carries source control, CI, and deployment bootstrap risk. Adding a self-hosted mail stack increases operational scope before the forge is stable.
-- Forward Email already exposes SMTP and IMAP while allowing per-domain custom S3 backup storage, which preserves Burrow's data ownership over mailbox backups.
-- The repository needs a durable decision record that separates hosted mail operations from future SaaS SSO work.
-
-## Detailed Design
-
-- Use Forward Email as the operational mail provider for `burrow.net` and `burrow.rs`.
-- Configure custom S3-compatible storage per domain using Burrow-controlled object storage credentials.
-- Keep one backup bucket per domain and enforce lifecycle expiration at the bucket layer.
-- Add repository-owned tooling and documentation for applying and testing the Forward Email custom S3 configuration.
-- Treat Authentik as the future identity authority for SaaS applications, but keep Linear SAML as a later rollout once the workspace and vendor prerequisites are available. Linear's current docs place SAML and SCIM behind higher-tier workspace security settings, so Burrow should treat plan availability as an explicit precondition.
-
-## Security and Operational Considerations
-
-- Forward Email API tokens and S3 credentials must stay in secret files and must not be passed directly on the shell command line.
-- Buckets must remain private. Public bucket detection by the vendor should be treated as a hard failure, not a warning.
-- Backup growth is unbounded without lifecycle rules. Retention policy is part of the rollout, not optional cleanup.
-- Hosted mail reduces MTA attack surface on the forge host, but it adds third-party dependency risk; keeping backups in Burrow-owned storage limits that blast radius.
-
-## Contributor Playbook
-
-- Put the Forward Email API token in `intake/forwardemail_api_token.txt`.
-- Use `Tools/forwardemail-custom-s3.sh` to configure `burrow.net` and `burrow.rs`.
-- Run the helper again with `--test-only` after any credential rotation.
-- Record the chosen endpoint, region, bucket names, and lifecycle policy alongside rollout evidence.
-- Do not claim Linear SAML is live until the Authentik app, Linear workspace settings, workspace plan prerequisites, and end-to-end login flow are verified.
-
-## Alternatives Considered
-
-- Self-host Stalwart on the forge host immediately. Rejected for the first rollout because it expands host scope before source control and CI are stable.
-- Rely on Forward Email default backup storage only. Rejected because it gives Burrow less control over retention and data location.
-- Delay all SaaS identity planning until after forge cutover. Rejected because Linear and other SaaS integrations will otherwise accrete without an agreed authority.
-
-## Impact on Other Work
-
-- Narrows the first forge host scope.
-- Creates a clean mail path for `contact@burrow.net` without requiring self-hosted SMTP and IMAP.
-- Leaves Authentik and Linear SAML as explicit follow-up work instead of hidden assumptions.
-
-## Decision
-
-Pending.
-
-## References
-
-- `docs/FORWARDEMAIL.md`
-- `Tools/forwardemail-custom-s3.sh`
-- Forward Email FAQ: custom S3-compatible storage for backups
-- Linear docs: SAML SSO
diff --git a/evolution/proposals/BEP-0005-daemon-ipc-and-apple-boundary.md b/evolution/proposals/BEP-0005-daemon-ipc-and-apple-boundary.md
deleted file mode 100644
index a34a609..0000000
--- a/evolution/proposals/BEP-0005-daemon-ipc-and-apple-boundary.md
+++ /dev/null
@@ -1,81 +0,0 @@
-# `BEP-0005` - Daemon IPC and Apple Boundary
-
-```text
-Status: Draft
-Proposal: BEP-0005
-Authors: gpt-5.4
-Coordinator: gpt-5.4
-Reviewers: Pending
-Constitution Sections: II, III, IV, V
-Implementation PRs: Pending
-Decision Date: Pending
-```
-
-## Summary
-
-Burrow should formalize one Apple/runtime boundary: Apple clients speak only to the daemon over gRPC on the app-group Unix socket, and the daemon owns all external control-plane, helper-process, and runtime coordination work. This prevents UI code from accreting side HTTP paths or ad hoc control-plane integrations that bypass the system Burrow is supposed to own.
-
-## Motivation
-
-- The current Tailnet work already showed the failure mode: Swift UI code started reaching around the daemon boundary to talk to helper HTTP endpoints directly.
-- Apple-specific process ownership is easy to blur between the app, the network extension, and helper daemons unless the contract is explicit.
-- If Burrow wants a durable multi-runtime architecture, the daemon must remain the only orchestration boundary between clients and control/data-plane behavior.
-
-## Detailed Design
-
-- Apple UI and Apple support libraries may call only daemon gRPC methods over the declared Burrow Unix socket.
-- Direct Swift calls to external control-plane HTTP APIs, localhost helper HTTP servers, or runtime-specific subprocesses are forbidden.
-- The daemon is responsible for:
-  - discovery of Tailnet authorities and related metadata
-  - control-plane session setup and tracking
-  - login/session lifecycle brokering
-  - runtime start/stop/reconcile
-  - translating helper or bridge processes into stable daemon RPCs
-- `burrow/src/control/` owns transport-neutral control-plane semantics such as discovery, authority normalization, and request/response shaping.
-- Apple UI owns presentation only:
-  - forms
-  - local state
-  - presenting returned auth URLs or statuses
-  - surfacing daemon availability and errors
-- Any new Apple-facing runtime capability requires a daemon RPC first.
-
-## Security and Operational Considerations
-
-- Keeping control-plane I/O out of Swift UI reduces accidental secret, token, and callback sprawl across app code.
-- The daemon boundary makes testing and kill-switch behavior tractable because runtime integration is localized.
-- Apple daemon lifecycle ownership must be explicit: either the app ensures the daemon is running before RPC or the extension owns it and the UI surfaces daemon-unavailable state clearly.
-- Non-Apple presentation clients should follow the same daemon-first lifecycle pattern: connect to a managed daemon when present, or start a user-scoped embedded daemon before issuing RPCs, without adding platform-local control-plane paths.
-
-## Contributor Playbook
-
-- Before adding a new Apple-side workflow, identify the daemon RPC that should own it.
-- If the RPC does not exist, add the protocol shape in `proto/burrow.proto`, implement it in the daemon, and only then wire Swift UI.
-- Verify that no Swift UI or support code calls external control-plane HTTP endpoints directly.
-- For Tailnet and similar flows, test:
-  - daemon unavailable behavior
-  - successful RPC path
-  - error propagation through the UI
-- Keep Linux GTK and Apple clients visually and functionally aligned around the same daemon-backed home surface: Networks, Accounts, Tunnel, and add flows should remain corresponding views over the daemon API.
-
-## Alternatives Considered
-
-- Let Apple UI call control-plane endpoints directly for convenience. Rejected because it creates parallel orchestration paths and breaks the daemon contract.
-- Allow one-off exceptions for login helpers. Rejected because those exceptions become the architecture.
-
-## Impact on Other Work
-
-- Governs the Tailnet refactor and future Apple runtime work.
-- Governs Linux GTK daemon startup parity where the same daemon API is reused from a user-scoped presentation process.
-- Interacts with BEP-0002 control-plane bootstrap and BEP-0003 transport refactoring.
-
-## Decision
-
-Pending.
-
-## References
-
-- `Apple/UI/`
-- `Apple/Core/`
-- `Apple/NetworkExtension/`
-- `burrow/src/daemon/`
-- `burrow/src/control/`
diff --git a/evolution/proposals/BEP-0006-tailnet-authority-first-control-plane.md b/evolution/proposals/BEP-0006-tailnet-authority-first-control-plane.md
deleted file mode 100644
index 36458ef..0000000
--- a/evolution/proposals/BEP-0006-tailnet-authority-first-control-plane.md
+++ /dev/null
@@ -1,74 +0,0 @@
-# `BEP-0006` - Tailnet Authority-First Control Plane
-
-```text
-Status: Draft
-Proposal: BEP-0006
-Authors: gpt-5.4
-Coordinator: gpt-5.4
-Reviewers: Pending
-Constitution Sections: I, II, IV, V
-Implementation PRs: Pending
-Decision Date: Pending
-```
-
-## Summary
-
-Burrow should treat Tailnet as one protocol family. Tailscale-managed and self-hosted Headscale-style deployments differ by authority, policy, and auth details, not by a distinct user-facing protocol. Burrow’s config and UI should therefore be authority-first rather than provider-first.
-
-## Motivation
-
-- Splitting Tailscale and Headscale into separate user-facing providers causes fake architectural divergence.
-- Discovery already naturally returns an authority and optional issuer; that is the stable contract users actually need.
-- Future managed or enterprise deployments should fit the same model without requiring another protocol picker.
-
-## Detailed Design
-
-- Tailnet configuration is centered on:
-  - account
-  - identity
-  - authority/login server URL
-  - optional tailnet name
-  - optional hostname
-  - auth method/material
-- User-facing surfaces should not force a protocol choice between Tailscale and Headscale.
-- Provider inference may remain internal metadata for compatibility and diagnostics:
-  - default managed Tailscale authority
-  - custom self-hosted authority
-  - Burrow-owned authority when explicitly applicable
-- Discovery returns authority and related metadata; editing the authority is the mechanism that moves a configuration from managed default to custom control server.
-- The daemon and control layer own provider inference; the UI should primarily present “Tailnet” plus the selected authority.
-- Platform clients consume the same daemon gRPC surface for Tailnet discovery, authority probing, browser sign-in, and saved network payloads. macOS/iOS SwiftUI and Linux GTK may differ in presentation and local credential stores, but neither should introduce a second control-plane path.
-
-## Security and Operational Considerations
-
-- Authority-first config reduces UI complexity and makes misconfiguration easier to reason about.
-- Provider-specific assumptions must not leak into packet or control-plane semantics unless the authority actually requires them.
-- Auth material must remain authority-scoped and identity-scoped in daemon storage.
-
-## Contributor Playbook
-
-- Remove provider pickers from Tailnet UI unless a concrete protocol difference requires one.
-- Store the authority explicitly in payloads and infer provider internally only when needed.
-- Keep Linux GTK and Apple clients at functional parity by routing Tailnet add/discover/probe/login through `TailnetControl` and `Networks` RPCs instead of platform-local HTTP or legacy JSON daemon commands.
-- Prefer tests that validate authority normalization and discovery behavior over UI-provider branching.
-
-## Alternatives Considered
-
-- Keep separate user-facing providers for Tailscale and Headscale. Rejected because it models deployment shape as protocol shape.
-- Collapse all control planes into one opaque Burrow provider. Rejected because the authority still matters operationally and diagnostically.
-
-## Impact on Other Work
-
-- Refines BEP-0002’s Tailscale-shaped control-plane work.
-- Constrains the Tailnet Apple and Linux GTK refactors plus future daemon control-plane storage.
-
-## Decision
-
-Pending.
-
-## References
-
-- `burrow/src/control/`
-- `Apple/UI/Networks/`
-- `burrow-gtk/src/`
-- `proto/burrow.proto`
diff --git a/evolution/proposals/BEP-0007-identity-registry-and-operator-bootstrap.md b/evolution/proposals/BEP-0007-identity-registry-and-operator-bootstrap.md
deleted file mode 100644
index 1fde0fb..0000000
--- a/evolution/proposals/BEP-0007-identity-registry-and-operator-bootstrap.md
+++ /dev/null
@@ -1,73 +0,0 @@
-# `BEP-0007` - Identity Registry and Operator Bootstrap
-
-```text
-Status: Draft
-Proposal: BEP-0007
-Authors: gpt-5.4
-Coordinator: gpt-5.4
-Reviewers: Pending
-Constitution Sections: II, III, IV, V
-Implementation PRs: Pending
-Decision Date: Pending
-```
-
-## Summary
-
-Burrow should maintain one canonical registry for project identities, aliases, bootstrap users, SSH keys, and admin-group mappings. Forgejo, Authentik, and related bootstrap configuration should derive from that registry instead of hardcoding overlapping identity facts in multiple modules.
-
-## Motivation
-
-- Burrow currently hardcodes operator and admin/bootstrap user facts directly in host configuration.
-- Multi-account and self-hosted identity are becoming core architecture, not incidental infra details.
-- A single registry reduces drift across Forgejo, Authentik, Headscale, SSH authorization, and future control-plane bootstrap.
-
-## Detailed Design
-
-- Add a root-level identity registry (`contributors.nix`) as the canonical source of truth for:
-  - usernames
-  - display names
-  - canonical emails
-  - external source emails or aliases
-  - admin scope
-  - bootstrap eligibility
-  - forge authorized SSH keys
-  - named roles
-- Consume that registry from host configuration for:
-  - Forgejo authorized keys
-  - Forgejo bootstrap admin defaults
-  - Authentik bootstrap users
-  - Burrow user/admin group names
-- Future work may derive contributor docs, OIDC bootstrap, and additional runtime configuration from the same registry.
-
-## Security and Operational Considerations
-
-- Identity drift is a security bug when it affects admin groups, bootstrap accounts, or SSH authorization.
-- The registry stores metadata only; secrets remain in agenix or other declared secret paths.
-- Changes to the registry should receive explicit review because they affect access and governance.
-
-## Contributor Playbook
-
-- Edit `contributors.nix` first when changing operator, admin, alias, or bootstrap identity state.
-- Derive runtime configuration from the registry instead of duplicating the same facts elsewhere.
-- Keep secret references separate from identity metadata.
-
-## Alternatives Considered
-
-- Continue hardcoding users in module options. Rejected because drift is inevitable once Forgejo, Authentik, and Headscale all depend on the same identities.
-- Create separate per-service user lists. Rejected because it duplicates governance facts and weakens review.
-
-## Impact on Other Work
-
-- Supports forge auth, Authentik group sync, and future multi-account Burrow control-plane work.
-- Creates the basis for stronger contributor and operator provenance later.
-
-## Decision
-
-Pending.
-
-## References
-
-- `contributors.nix`
-- `nixos/hosts/burrow-forge/default.nix`
-- `nixos/modules/burrow-authentik.nix`
-- `nixos/modules/burrow-forge.nix`
diff --git a/evolution/proposals/BEP-0008-authentik-backed-team-chat-and-workspace-sso.md b/evolution/proposals/BEP-0008-authentik-backed-team-chat-and-workspace-sso.md
deleted file mode 100644
index 0ce03a6..0000000
--- a/evolution/proposals/BEP-0008-authentik-backed-team-chat-and-workspace-sso.md
+++ /dev/null
@@ -1,169 +0,0 @@
-# `BEP-0008` - Authentik-Backed Team Chat and Workspace Identity
-
-```text
-Status: Draft
-Proposal: BEP-0008
-Authors: gpt-5.4
-Coordinator: gpt-5.4
-Reviewers: Pending
-Constitution Sections: II, III, V
-Implementation PRs: Pending
-Decision Date: Pending
-```
-
-## Summary
-
-Burrow should add a self-hosted team chat surface at `chat.burrow.net` and
-continue the project-wide move toward Authentik as the identity authority for
-external work systems. The immediate targets are a self-hosted Zulip
-deployment rooted in Authentik SAML, a Linear SAML configuration when the
-workspace plan supports it, and a 1Password Unlock-with-SSO deployment rooted
-in the same Authentik-backed OIDC authority.
-
-This keeps Burrow's day-to-day coordination surfaces aligned with the same
-admin groups, canonical users, and secret-handling model already used for
-Forgejo, Headscale, and Tailscale. It also avoids fragmenting login state
-across vendor-native Google auth flows when Burrow already operates an IdP.
-
-## Motivation
-
-- Forge, Tailnet, operator identity, and Tailscale custom OIDC are already
-  rooted in Authentik. Team chat, work tracking, and password-manager access
-  should not become separate authority islands.
-- Zulip provides a self-hosted chat system under Burrow's control, which fits
-  the constitution better than adding another hosted chat dependency.
-- Linear remains a SaaS dependency, but its workspace access should still be
-  derived from Burrow-managed identities and domains when the vendor plan
-  exposes SAML configuration.
-- 1Password Business is another external work surface where Burrow-controlled
-  identities are preferable to vendor-native Google-only auth. Its current
-  vendor flow is OIDC-based Unlock with SSO rather than SAML, so the proposal
-  needs to preserve protocol accuracy instead of flattening everything into
-  one SAML bucket.
-- Burrow already has a canonical public identity registry and a secret-backed
-  external-email alias map. Reusing that structure is lower-risk than
-  inventing per-app user bootstrap logic.
-
-## Detailed Design
-
-- Add a Burrow-managed Zulip workload on the forge host at `chat.burrow.net`.
-  The deployment should be repo-owned and rebuildable from Nix, even if the
-  runtime uses vendor-supported container images internally.
-- Prefer host-managed NixOS services for Zulip's stateful dependencies
-  (PostgreSQL, Redis, RabbitMQ, memcached, backups) so Burrow owns the
-  operational surface directly rather than composing a container-side service
-  mesh.
-- Zulip should authenticate through Authentik SAML rather than local passwords
-  as the primary path. Initial bootstrap may still keep an operational escape
-  hatch while the deployment is being validated.
-- Add Authentik-managed SAML applications for:
-  - Zulip at `chat.burrow.net`
-  - Linear using Burrow's claimed domains and Authentik metadata
-- Add an Authentik-managed SCIM backchannel for Linear so Burrow can push
-  role groups declaratively instead of hand-maintaining workspace roles.
-- Add an Authentik-managed OIDC application for 1Password Business under the
-  Burrow team sign-in address.
-- Treat Zulip and Linear as downstream applications of the same identity
-  authority, and treat 1Password as part of that same authority even though
-  its vendor protocol is OIDC rather than SAML. The source of truth remains:
-  - public identities and admin intent in `contributors.nix`
-  - private alias mappings and external accounts in agenix-encrypted secrets
-- Keep app-specific configuration in dedicated reconciliation code or module
-  options instead of hand-edited UI state.
-- Prefer service-specific reconciliation over ad hoc manual setup so rebuilds
-  and host replacement converge automatically.
-- When Burrow wants an external-user launcher surface in Authentik, configure
-  the brand's `default_application` explicitly instead of relying on
-  `/if/user/`, which otherwise remains internal-user-only.
-- Derive Linear SCIM role groups from Burrow's canonical identity metadata.
-  If Burrow-wide admin intent says a user is an operator/admin, the repo-owned
-  configuration should map that intent onto the Linear push group without a
-  second manual roster.
-- Model 1Password according to the vendor's actual integration contract:
-  - OIDC Authorization Code Flow with PKCE
-  - public client rather than a confidential client
-  - no Burrow-side dependence on a stored client secret unless the vendor flow
-    changes
-
-## Security and Operational Considerations
-
-- Do not store external personal email mappings in public registry files.
-  Public tree data may include Burrow usernames and canonical `@burrow.net`
-  addresses, but external aliases must stay in encrypted secrets.
-- Zulip internal service credentials, Django secret material, and any mail
-  credentials must have explicit storage and rotation paths.
-- Linear SAML must not become Burrow's only admin recovery path. At least one
-  owner login path outside the enforced SAML flow should remain available until
-  rollout is proven.
-- Linear SCIM group push should be role-scoped and explicit. Burrow should
-  avoid blanket ownership mapping unless that intent is recorded in the repo.
-- 1Password Owners cannot be forced onto Unlock with SSO during initial setup.
-  Burrow should preserve the owner recovery path and treat OIDC rollout as a
-  scoped migration for non-owner users first.
-- If Zulip is deployed without production-grade outbound email at first, that
-  limitation must be documented and treated as an operational constraint, not a
-  hidden assumption.
-- Rollback should be straightforward:
-  - disable or stop the Zulip module
-  - remove the Authentik SAML apps
-  - remove the Authentik OIDC app used for 1Password if necessary
-  - leave the underlying Burrow identities unchanged
-
-## Contributor Playbook
-
-- Define the app and identity intent in the repository before modifying the
-  forge host.
-- Add or update Nix modules so `burrow-forge` can rebuild Zulip and the
-  corresponding Authentik SAML configuration from the tree.
-- Verify:
-  - `chat.burrow.net` serves a working Zulip login surface
-  - Authentik exposes working metadata for Zulip and Linear
-- Authentik exposes a working OIDC issuer for 1Password
-  - users in Burrow admin groups receive the expected access on first login
-  - external Burrow users landing on `auth.burrow.net` reach the intended
-    app launcher target instead of the internal-only Authentik user interface
-- Record concrete evidence for:
-  - host deployment generation
-  - Authentik reconciliation success
-  - Zulip login success
-  - Linear SAML configuration state
-  - 1Password Unlock with SSO configuration state
-
-## Alternatives Considered
-
-- Use Zulip Cloud instead of self-hosting. Rejected because the ask is to host
-  chat under `chat.burrow.net`, and Burrow already operates a forge host with a
-  self-managed identity plane.
-- Keep Linear on Google-native login. Rejected because it leaves Burrow work
-  access outside the project's operator and group model.
-- Treat 1Password as a SAML app for consistency. Rejected because the live
-  vendor flow is OIDC and Burrow should not pretend otherwise in repo-owned
-  infrastructure.
-- Add per-app manual Authentik configuration without repository automation.
-  Rejected because it violates Burrow's infrastructure-in-repo commitment.
-
-## Impact on Other Work
-
-- Extends Burrow's Authentik role from control-plane identity into team-work
-  surfaces.
-- Introduces a persistent chat workload on the forge host, with resource and
-  monitoring implications.
-- Creates a likely follow-up for SCIM or richer group synchronization if Linear
-  or Zulip role mapping needs to become fully declarative later.
-- Adds a second OIDC relying party beyond Forgejo, Headscale, and Tailscale,
-  which raises the importance of keeping Burrow's Authentik scope mappings and
-  redirect handling consistent across applications.
-
-## Decision
-
-Pending.
-
-## References
-
-- `CONSTITUTION.md`
-- `contributors.nix`
-- `evolution/proposals/BEP-0004-hosted-mail-and-saas-identity.md`
-- Authentik docs: SAML provider and metadata endpoints
-- Zulip docs: SAML authentication and docker deployment
-- Linear docs: SAML and access control
-- 1Password docs: Unlock with SSO using OpenID Connect
diff --git a/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md b/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md
deleted file mode 100644
index 4d8f5c9..0000000
--- a/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md
+++ /dev/null
@@ -1,374 +0,0 @@
-# `BEP-0009` - Release Infrastructure and Store Upload Pipeline
-
-```text
-Status: Draft
-Proposal: BEP-0009
-Authors: gpt-5.5
-Coordinator: gpt-5.5
-Reviewers: Pending
-Constitution Sections: II, III, IV, V
-Implementation PRs: Pending
-Decision Date: Pending
-```
-
-## Summary
-
-Burrow needs a release pipeline that behaves like the project infrastructure it is replacing: release eligibility is detected from forge build tags, build artifacts are produced per platform, upload lanes are separate from build lanes, and store credentials are explicit automation inputs rather than hidden local state.
-
-The first implementation creates the release spine now: `release-if-needed` dispatches a build when HEAD has not been tagged as released, `build-release` packages current artifacts on Namespace-backed runners, and `publish-store-uploads` performs guarded upload steps for App Store Connect, Sparkle, Microsoft Store, and storage-backed public channels after Authentik-backed Google WIF authentication.
-
-The same change also makes the forge itself the release authority: release tags prefer the Burrow Forgejo remote, dispatch helpers talk to Forgejo directly with a live-host fallback, runner identity is discoverable from persistent host state, repository mirror sync is disabled for the canonical Burrow repository, `nix.burrow.net` provides a Burrow-owned Nix cache for workers, and Grafana observability is bootstrapped with Nix-owned Prometheus/OpenTelemetry/Jaeger service state plus OpenTofu-owned dashboards.
-
-## Motivation
-
-- Burrow already controls its forge and runner infrastructure, but the release path only produced a Linux CLI tarball.
-- Apple, Linux, Sparkle, and future Windows outputs need the same build-number and artifact layout so release evidence is inspectable.
-- The Namespace account should be part of the live runner surface, including macOS and Windows lanes, instead of sitting idle behind unused configuration.
-- Authentication and store credentials should be named and checked at lane boundaries so dedicated accounts can be added without rewriting workflows.
-
-## Detailed Design
-
-- Use lightweight `builds/<number>` tags as the authoritative release watermark.
-- Keep `Scripts/version.sh status` as the release-needed check:
-  - `clean` means HEAD is exactly the latest authoritative build tag.
-  - `dirty` means the release workflow should create a new build number.
-- Split workflows:
-  - `.forgejo/workflows/release-if-needed.yml` checks release status on a
-    schedule and on pushes to `main`, then dispatches `build-release.yml` when
-    HEAD is unreleased.
-  - `.forgejo/workflows/build-release.yml` builds and stages artifacts, and
-    defaults App Store Connect upload handoff on unless the dispatch explicitly
-    disables it.
-  - `.forgejo/workflows/publish-store-uploads.yml` uploads staged artifacts to
-    external stores and public channels, with App Store Connect upload enabled
-    by default for manual dispatches and release handoffs.
-- Stage artifacts under `dist/builds/<build-number>/<platform>/`.
-- Publish generic release assets to a Forgejo release named `Build <number>`.
-- Upload release artifacts through `Scripts/ci/upload-release-storage.sh`. The wrapper requires Garage as the primary S3-compatible target by default, then mirrors to the `burrow-net-releases` GCS backup bucket unless `BURROW_RELEASE_GCS_BACKUP=false`.
-- Publish signed package repository trees through `Scripts/ci/upload-package-storage.sh`. The wrapper requires Garage as the primary S3-compatible target by default, then mirrors to the `burrow-net-packages` GCS backup bucket unless `BURROW_PACKAGE_GCS_BACKUP=false`.
-- Publish selected Nix closures through `.forgejo/workflows/publish-nix-cache.yml` and `Scripts/ci/publish-nix-cache.sh`. The workflow logs into `nix.burrow.net` with the scoped `BURROW_NIX_CACHE_PUSH_TOKEN` generated by host bootstrap and skips when the token is absent unless explicitly required.
-- Mirror Garage buckets through `.forgejo/workflows/backup-garage-storage.yml` and `Scripts/ci/backup-garage-to-gcs.sh`. The scheduled workflow uses the host-generated Garage read-only backup key, Authentik-backed Google WIF, and `gcloud storage rsync` to back up `burrow-releases`, `burrow-packages`, and `attic` to GCS.
-- Build Apple artifacts on `namespace-profile-macos-large` through Bazel wrapper targets:
-  - `//bazel/apple:release_ios_stamp`
-  - `//bazel/apple:release_macos_stamp`
-  These targets wrap the existing Xcode project and give the workflow one stable entrypoint that shares the same Bazel/Nix cache setup while Burrow decides whether deeper `rules_apple` targets are worth the migration.
-- Use Namespace cache setup before Bazel/Nix work. Prefer the Namespace Bazel remote cache when `nsc` is authenticated and fall back to a local disk/repository cache when remote setup is unavailable.
-  Cache setup is optional release acceleration: Bazel-only cache steps must not
-  install filesystem-cache helpers such as `spacectl`, and Namespace cache
-  probes must be timeout-bounded so Apple builds can continue without the
-  remote cache. Apple workflows should call the fail-open cache helper directly
-  instead of entering the full Nix development shell just to decide whether a
-  cache is available. macOS runners should use the local Bazel disk/repository
-  cache path and skip the `nsc` remote-cache auth probe, which is optional and
-  can block without GNU timeout support.
-- The Nix CI shell must not pin Apple builds to a Bazel major that disagrees
-  with `.bazelversion`. Prefer Bazelisk or a Bazel 9 package so the release
-  lane uses the repository-declared Bazel 9.1.0 toolchain.
-- Moving tarball URLs are not acceptable for release-critical Nix inputs. The
-  forge worker lockfile must resolve nixpkgs through a fixed Git revision so
-  fresh workers do not fail when a branch tarball no longer matches a stored
-  NAR hash.
-- The CI shell should prefer currently supported Node runtimes when nixpkgs
-  marks an older major insecure. Release workers must fail on product build
-  errors, not on avoidable toolchain end-of-life policy checks.
-- Bazel repository and disk caches must live outside the checked-out repository
-  on macOS runners. Bazel 9 rejects a repository contents cache inside the main
-  repo because it can create spurious build graph failures.
-- Bazel Apple genrules must explicitly pass the Nix CI shell tool path and
-  `PROTOC` into the action environment. Xcode build phases run with a reduced
-  path, and the Rust Network Extension build depends on `protoc`.
-- Forgejo release workflows must use the artifact action generation supported
-  by the deployed forge. The v4 artifact actions assume GitHub's newer artifact
-  service and fail on this Forgejo install before downstream signing/upload
-  jobs can consume the staged Apple artifacts.
-- The release secret decrypt action must be self-contained after the Nix
-  bootstrap step. Linux Namespace signing jobs install Nix at runtime, so the
-  bootstrap writes Nix profile directories to `GITHUB_PATH`, the decrypt action
-  resolves Nix from those profile paths, and the action builds `.#age` before
-  falling back to `.#agenix`. The decrypt step must not require Python before
-  the Nix CI shell is active.
-- Authentik-backed Google WIF must exchange tokens against Authentik's OAuth
-  token endpoint, not a provider-slug child path. The helper should prefer an
-  explicit `BURROW_AUTHENTIK_WIF_TOKEN_ENDPOINT`, then OIDC discovery, then the
-  Authentik `/application/o/token/` fallback derived from the configured issuer.
-- The Google WIF Authentik application is a machine-to-machine
-  client-credentials provider. It must not default to a human group policy
-  binding, because the token exchange has no interactive user and Authentik will
-  reject the grant before Google WIF can validate the issued JWT.
-- Forgejo should store the Authentik WIF credential as the client-credentials
-  `client_secret` form value. For service-account authentication, that value is
-  `base64("<service-account-username>:<app-password-token>")`; the helper must
-  send it as form data, not HTTP Basic auth.
-- Produce unsigned Apple validation artifacts when signing is absent, but require signing for an App Store requested iOS release and for a Sparkle tester release. Uploadable artifacts are produced only after provisioning profiles can be synced from App Store Connect credentials and the relevant Apple certificate is proven to match the selected Google KMS key.
-- Resolve release credentials through age/agenix before signed Apple lanes run. Forgejo secrets should carry only the runner age identity fallback and the Authentik WIF client secret until OpenBao can mint the runner token directly. App Store Connect keys and signing certificates live as sealed files under `secrets/`.
-- Persist the forge runner SSH key as `/var/lib/forgejo-runner-agent/age_keystore` and export `BURROW_RUNNER_AGE_IDENTITY_PATH` so jobs can resolve agenix identities without embedding long-lived material in every workflow.
-- Add `Scripts/forgejo-dispatch.sh` and `Scripts/forgejo-dispatch-via-host.sh`:
-  - local dispatch uses an explicit token, local intake token, or the sealed forgejo-nsc dispatcher config when available;
-  - host fallback SSHes to the live forge and reads the agenix-materialized dispatcher config there;
-  - neither path relies on a GitHub remote or GitHub workflow API.
-- Default build tag reads and pushes to the Burrow Forgejo remote when that remote exists. `BURROW_VERSION_REMOTE` remains the override for unusual migrations.
-- Keep the canonical Forgejo repo as an ordinary source repository, not a mirror. The host config disables new mirror creation and removes mirror/push-mirror rows for the canonical Burrow repository at activation time.
-- Add `.forgejo/workflows/infra-opentofu.yml` and `Scripts/grafana-tofu.sh` for Grafana API-managed folders and dashboards. NixOS owns the Grafana service, SSO, reverse proxy, datasources, Prometheus, OpenTelemetry collector, Jaeger, secrets, and boot-time configuration; OpenTofu owns API-created dashboard objects.
-- Sync provisioning profiles from App Store Connect in CI using the decrypted API key:
-  - iOS App Store profiles for `net.burrow.app` and `net.burrow.app.network`.
-  - macOS Developer ID profiles for the same bundle identifiers.
-  Provisioning profile `.age` files are not part of the normal release path.
-- Add a non-exportable Google KMS RSA-2048/SHA-256 key named
-  `apple-developer-id-application` in the Burrow identity key ring. The manual
-  `apple-developer-id-kms-csr.yml` workflow uses Authentik-backed Google WIF to
-  generate a standard Developer ID Application CSR without exporting private key
-  material.
-- Treat Developer ID certificate issuance as a Developer website or Xcode step
-  until Apple documents App Store Connect API creation for Developer ID
-  certificates. The returned `.cer` is public release material; the private key
-  remains in Google KMS and must not be converted into `.p12` form.
-- The first KMS-backed G2 Developer ID Application certificate is
-  `9JKN6HXBHC`, stored at
-  `Apple/Certificates/developer-id-application-9JKN6HXBHC.cer`, and expires on
-  `2031-06-08`.
-- Add a non-exportable Google KMS RSA-2048/SHA-256 key named
-  `apple-ios-distribution` in the Burrow identity key ring. The KMS-backed CSR
-  can be submitted through the App Store Connect API with
-  `Scripts/apple/create-asc-certificate.mjs`.
-- The first KMS-backed iOS Distribution certificate is `3G42677598`, stored at
-  `Apple/Certificates/ios-distribution-3G42677598.cer`, and expires on
-  `2027-06-07`.
-- When `BURROW_IOS_DISTRIBUTION_CERTIFICATE_ID` is set, provisioning-profile
-  sync must verify App Store profiles reference that certificate. Stale profiles
-  with the same name may be deleted and recreated so CI does not silently sign
-  against an older distribution identity.
-- Apple release signing uses a staged KMS flow because Google publishes the
-  Cloud KMS PKCS#11 library for Linux release runners, not macOS runners:
-  - macOS Namespace builders compile unsigned iOS device and macOS app bundles
-    with the existing Xcode project.
-  - Linux release runners download those staged artifacts, authenticate to
-    Google through Authentik WIF, verify the Apple `.cer` public key matches the
-    intended Google KMS key version, embed the synced provisioning profiles, and
-    sign the app/extension bundles with the patched `rcodesign` PKCS#11 path.
-  - The signed iOS IPA is uploaded to App Store Connect, and the signed macOS
-    ZIP is used as the Sparkle tester artifact.
-- Add a Google KMS key named `sparkle-ed25519` for small Sparkle signing probes
-  and future signing-service work. It uses `EC_SIGN_ED25519` with software
-  protection level because Google KMS rejects Ed25519 for HSM protection. Google
-  KMS also rejects normal macOS release archives as direct Ed25519 messages, so
-  the tester pipeline signs full-size Sparkle archives directly from the
-  decrypted `SPARKLE_EDDSA_KEY_PATH` release seed until a compatible KMS-backed
-  Sparkle signing service is introduced. macOS builds embed public EdDSA key
-  `uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=`.
-- Use Namespace labels for platform lanes:
-  - `namespace-profile-linux-medium`
-  - `namespace-profile-macos-large`
-  - `namespace-profile-windows-large`
-- Use dedicated Apple distribution labels for the focused tester-distribution
-  workflow so stale generic Namespace jobs cannot consume Apple release runners:
-  - `namespace-profile-linux-medium-apple-v2`
-  - `namespace-profile-macos-large-apple-v2`
-  Label revisions are allowed when earlier accepted workflows have stale
-  queued jobs; the autoscaler should serve only the current focused label set.
-- Configure macOS Namespace targets with the Compute API CPU-by-memory shape
-  format. `12x28` is the Burrow large macOS baseline; platform-prefixed values
-  such as `macos/arm64:8x16` are not accepted by the macOS launcher.
-- Treat macOS shape fallback as part of the release lane rather than as a
-  best-effort debug path. When large shapes are quota-constrained, the
-  dispatcher may try smaller accepted shapes, but every fallback must have a
-  bounded create timeout and additional shapes must reuse the final timeout
-  policy instead of crashing the dispatcher.
-- Keep the shared Linux runner work directory out of macOS bootstraps. The
-  dispatcher normalizes macOS runners to `/tmp/forgejo-runner` when the shared
-  config points at Linux state paths such as `/var/lib/forgejo-runner`.
-- Do not destroy Namespace Linux runners until `nsc describe` shows a real
-  terminal container state or tombstone. Empty describe payloads mean the
-  environment is still starting, not that the one-job runner has finished.
-- Keep the autoscaler-to-dispatcher HTTP timeout longer than the runner TTL.
-  Dispatch requests intentionally block until the one-job runner exits, so short
-  HTTP client timeouts cancel macOS provisioning mid-bootstrap.
-- Run forge Namespace services with the repo-owned `nsc` package and keep it
-  current with the token format expected by Namespace. `nsc 0.0.520` is the
-  first required baseline for revokable token-file auth. The dispatcher and
-  autoscaler systemd units must also use the repo-built packages so runner fixes
-  ship with Burrow deploys instead of staying pinned to the module input.
-- Render the sealed Namespace runner token with `nsc token create --token_file`
-  instead of `nsc auth generate-dev-token`. The dev-token output is for direct
-  API/registry access, while the dispatcher needs the JSON token-file format
-  consumed by `nsc run`.
-- Add a Rust `burrow-windows-stub` binary so the Windows lane can validate packaging and upload mechanics before native Windows networking support is implemented.
-- Treat Sparkle as a macOS public-channel upload lane:
-  - Generate staged appcast content from the signed macOS artifact when present.
-  - Publish `sparkle/<channel>/`, `sparkle/appcast.xml`, and `sparkle/default/` pointers from `publish-store-uploads`.
-  - The macOS app embeds Sparkle and consumes the `https://releases.burrow.net/sparkle/appcast.xml` feed.
-- Treat TestFlight distribution as a retryable post-upload step. Apple build
-  processing can exceed 30 minutes after a successful IPA upload, so
-  `apple-distribute-testers` and `publish-store-uploads` wait up to 7200
-  seconds by default and allow Forgejo variable
-  `TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS` to tune that ceiling without a
-  repo change. TestFlight wait jobs must use `namespace-profile-linux-testflight`
-  or `namespace-profile-macos-large-testflight`; the generic Linux and Apple
-  macOS profiles expire before the 7200-second processing window. The
-  autoscaler-to-dispatcher timeout must stay above those runner TTLs because
-  dispatch requests block until the one-job runner exits. `publish-store-uploads`
-  has a separate no-`needs` `distribute-ios-testflight` retry job for
-  `distribute_testflight=true` and `upload_app_store=false`, so skipped
-  upload/signing jobs cannot suppress distribution of an already-uploaded build.
-  `distribute-testflight` is the narrower one-job retry workflow when only App
-  Store Connect processing and tester assignment need to be retried.
-- Internal TestFlight distribution must not submit the build for external beta
-  review. The internal lane waits for processing, sets export-compliance
-  metadata, uses Fastlane `skip_submission:true`, and relies on App Store
-  Connect's configured internal tester group availability. External TestFlight
-  distribution requires explicit groups plus beta-review metadata before it can
-  be enabled.
-- Add `infra/releases` as the OpenTofu boundary for the GCS release and package repository backup buckets. Garage is the required S3-compatible primary distribution target after host bootstrap. `infra/identity` remains the boundary for Google KMS signing keys, the Authentik WIF pool/provider, and the runner service account.
-- Serve `releases.burrow.net` and `packages.burrow.net` from the forge Caddy
-  edge as stable Burrow domains backed by the GCS release and package buckets.
-  Appcast enclosure URLs and package repository metadata must use those Burrow
-  domains instead of provider-specific object-storage URLs.
-
-## Security and Operational Considerations
-
-- Store credentials are consumed only by signed build or upload jobs, not by ordinary build/test jobs.
-- GCS backup and Google KMS access must use Authentik-backed Workload Identity Federation against project `project-88c23ce9-918a-470a-b33`; workflows must not use Google service-account JSON keys.
-- Garage uploads use S3-compatible access keys scoped to release/package buckets. They are required by default; GCS is a backup mirror, not the success fallback.
-- Garage backup uses a separate read-only key spanning the release, package, and Attic buckets. That key may be sealed into Forgejo/OpenBao for backup jobs, but it must not be reused for release/package writes.
-- Attic cache publishing uses a scoped CI push token for the `burrow` cache instead of the bootstrap admin token.
-- rclone is not part of the release path. Multi-cloud failover should be added through provider-specific or S3-compatible wrappers with explicit credentials and evidence.
-- Required upload credentials are checked explicitly after `./.forgejo/actions/decrypt-release-secrets` materializes them from age:
-  - `secrets/apple/appstore-connect.env.age`: `ASC_API_KEY_ID`, `ASC_API_ISSUER_ID`, and base64-encoded `.p8` key material.
-  - KMS-backed Apple signing must not use `.p12` private-key material. The
-    legacy `secrets/apple/distribution-signing.env.age` path remains accepted
-    only for emergency keychain signing and should not be used for the normal
-    tester release lane.
-  - Sparkle appcasts are signed with Google KMS by default; the legacy
-    `secrets/apple/sparkle.env.age` path remains accepted only for emergency
-    local EdDSA signing.
-  - future Microsoft Partner Center credentials
-- The temporary CI keychain password is always the distribution certificate password; there is no separate keychain-password release secret.
-- KMS-backed Apple certificates do not satisfy the existing Xcode/keychain
-  import path. Shipping with these certificates requires a signer that can
-  delegate Apple code-signing operations to Google KMS.
-- iOS KMS signing must filter provisioning-profile entitlements through the
-  checked-in iOS entitlement templates before signing. App Store Connect
-  validates the bundle signature, not just the profile, and rejects profile-only
-  capabilities such as system extensions or unsupported NetworkExtension values
-  when they leak into an iOS app or extension signature.
-- The App target must keep `Assets.xcassets` in its Resources phase. Xcode
-  derives the `CFBundleIcons` metadata and standalone App Store icon PNGs from
-  that resource membership during iOS builds.
-- App Store Connect upload steps must fail on `altool` validation output as
-  well as non-zero process exits. Apple can emit a textual upload failure before
-  the workflow reaches TestFlight processing, and downstream tester waits must
-  not run unless the IPA upload was actually accepted.
-- If the first key ring or Developer ID key is bootstrapped before the
-  OpenTofu remote state backend is available locally, the live resources must be
-  imported into `infra/identity` before enabling managed identity applies.
-- Dedicated store accounts should be sealed with agenix before enabling always-on uploads. The runner only needs an age identity such as `/var/lib/forgejo-runner-agent/age_keystore`; `AGE_FORGE_SSH_KEY` is a fallback bootstrap secret, not a place for release material.
-- The canonical identity registry reserves `release@burrow.net` for release automation and `namespace@burrow.net` for Namespace runner capacity credentials; secrets stay outside `contributors.nix`.
-- Grafana starts with a sealed admin password and a pending OIDC client secret. Local admin login remains available until the real OIDC secret is rotated and the Authentik reconciliation service creates the Grafana provider.
-- OpenTofu apply/import modes require an explicit confirmation and remote state. Validation may run without remote state.
-- Build tags are pushed only after artifacts have been assembled for the build number.
-- App Store Connect upload and internal/private tester lanes may default on only
-  after dedicated credentials and export metadata are verified. This default
-  applies to `release-if-needed`, `build-release`, `publish-store-uploads`, and
-  `apple-distribute-testers`. External TestFlight distribution and public
-  app-store rollout must stay explicit.
-
-## Contributor Playbook
-
-1. Check whether a release is needed:
-   ```bash
-   Scripts/version.sh status
-   ```
-2. Build local artifacts:
-   ```bash
-   BUILD_NUMBER=local Scripts/ci/build-release-artifacts.sh all
-   ```
-3. Build Apple release validation artifacts on macOS:
-   ```bash
-   BUILD_NUMBER=local bazel build //bazel/apple:release_ios_stamp //bazel/apple:release_macos_stamp
-   ```
-4. Verify the Windows stub still builds:
-   ```bash
-   cargo test --locked -p burrow-windows-stub
-   ```
-5. Validate BEP metadata:
-   ```bash
-   python3 Scripts/check-bep-metadata.py
-   ```
-6. Before turning on an upload lane, seal the dedicated service-account secret and run:
-   ```bash
-   Scripts/seal-release-secrets.sh --source-dir intake/release
-   Scripts/ci/check-release-config.sh app-store
-   Scripts/ci/check-release-config.sh apple-signing
-   Scripts/ci/check-release-config.sh gcs
-   ```
-7. Treat successful Forgejo release asset publication and successful store upload jobs as separate evidence points.
-8. Validate Grafana OpenTofu syntax locally:
-   ```bash
-   Scripts/grafana-tofu.sh init -backend=false
-   Scripts/grafana-tofu.sh validate
-   ```
-9. Validate release storage OpenTofu syntax locally:
-   ```bash
-   Scripts/releases-tofu.sh init -backend=false
-   Scripts/releases-tofu.sh validate
-   ```
-10. Validate release storage wrapper syntax:
-   ```bash
-   bash -n Scripts/ci/upload-release-storage.sh Scripts/ci/upload-package-storage.sh Scripts/ci/backup-garage-to-gcs.sh Scripts/ci/publish-nix-cache.sh
-   ```
-11. Dispatch a Forgejo workflow without GitHub:
-   ```bash
-   Scripts/forgejo-dispatch.sh build-release.yml --ref main
-   ```
-12. After deploying the forge host, seal:
-    ```text
-    BURROW_NIX_CACHE_PUSH_TOKEN from /var/lib/burrow/nix-cache/ci-push-token
-    BURROW_GARAGE_BACKUP_ACCESS_KEY_ID from /var/lib/burrow/garage/env
-    BURROW_GARAGE_BACKUP_SECRET_ACCESS_KEY from /var/lib/burrow/garage/env
-    ```
-
-## Alternatives Considered
-
-- Keep one monolithic release workflow. Rejected because build failures, upload failures, and credential gaps become hard to distinguish.
-- Wait for native Windows support before adding a Windows lane. Rejected because packaging and Microsoft Store authentication can be validated with a Rust stub first.
-- Add Sparkle to the Apple app in the same change. Rejected because Sparkle changes the client update trust boundary and should be reviewed separately from release plumbing.
-
-## Impact on Other Work
-
-- Future Apple release work can fill in signed archive/export details without changing release numbering.
-- Future Windows work can replace the stub package with the native client while preserving upload shape.
-- Identity and credential follow-up should derive long-lived automation accounts from `contributors.nix` where they represent Burrow-operated identities.
-
-## Decision
-
-Pending.
-
-## References
-
-- `CONSTITUTION.md`
-- `contributors.nix`
-- `.forgejo/workflows/release-if-needed.yml`
-- `.forgejo/workflows/build-release.yml`
-- `.forgejo/workflows/publish-store-uploads.yml`
-- `Scripts/version.sh`
-- `Scripts/ci/nscloud-cache.sh`
-- `Scripts/ci/ensure-nix.sh`
-- `Scripts/ci/package-apple-artifacts.sh`
-- `Scripts/ci/upload-release-storage.sh`
-- `Scripts/ci/upload-package-storage.sh`
-- `Scripts/ci/publish-nix-cache.sh`
-- `Scripts/ci/backup-garage-to-gcs.sh`
-- `bazel/apple/BUILD.bazel`
-- `Scripts/forgejo-dispatch.sh`
-- `Scripts/forgejo-dispatch-via-host.sh`
-- `Scripts/grafana-tofu.sh`
-- `Scripts/releases-tofu.sh`
-- `.forgejo/workflows/infra-opentofu.yml`
-- `.forgejo/workflows/publish-nix-cache.yml`
-- `.forgejo/workflows/backup-garage-storage.yml`
-- `infra/grafana/`
-- `infra/releases/`
-- `nixos/modules/burrow-garage.nix`
-- `nixos/modules/burrow-observability.nix`
-- `services/grafana/dashboards/burrow-overview.json`
-- `services/grafana/dashboards/headscale.json`
-- `services/grafana/dashboards/observability.json`
diff --git a/evolution/proposals/BEP-0010-platform-services-core-and-distribution.md b/evolution/proposals/BEP-0010-platform-services-core-and-distribution.md
deleted file mode 100644
index 211554a..0000000
--- a/evolution/proposals/BEP-0010-platform-services-core-and-distribution.md
+++ /dev/null
@@ -1,332 +0,0 @@
-# `BEP-0010` - Platform Services, Core, and Distribution
-
-```text
-Status: Draft
-Proposal: BEP-0010
-Authors: gpt-5.5
-Coordinator: gpt-5.5
-Reviewers: Pending
-Constitution Sections: II, III, IV, V
-Implementation PRs: Pending
-Decision Date: Pending
-```
-
-## Summary
-
-Burrow should grow from a forge-hosted VPN project into a coherent platform: a
-KMS-backed identity and signing plane, OpenBao-backed secret distribution,
-private meeting and mail services, an extracted MCP hub for operator and agent
-workflows, and app builds for Apple, Linux, Android, and later store channels.
-
-The first implementation is deliberately scaffolding-heavy. It adds OpenTofu
-boundaries for Google KMS, Workload Identity Federation, GCS release backup
-storage, and OpenBao; enables Garage-backed object storage and a Burrow-owned
-Nix cache at `nix.burrow.net`; adds
-NixOS wiring for Grafana, Prometheus, OpenTelemetry, and Jaeger; adds
-disabled-by-default NixOS service switch points for `vault.burrow.net` and
-`meet.burrow.net`; introduces a small cross-platform Rust core and Android
-Kotlin stub; and records the distribution model before stores or public
-production services are enabled.
-
-## Motivation
-
-- The forge now controls source and release automation, but release signing,
-  SAML signing, and runner cloud access still need a stronger non-exportable key
-  story.
-- Secrets are still primarily age-managed files. That remains a good bootstrap
-  path, but long-running services and agents need short-lived, attributable
-  runtime access.
-- Burrow needs mobile and desktop clients that share protocol logic instead of
-  repeatedly embedding platform-local behavior.
-- The GTK Flatpak can be a useful desktop shell, but the actual VPN data plane
-  cannot be assumed to work inside an unprivileged Flatpak sandbox.
-- App store, F-Droid, Flatpak, and Play Store distribution should be designed as
-  separate release surfaces with explicit signing, policy, and metadata gates.
-
-## Detailed Design
-
-- Add `infra/identity` as the OpenTofu boundary for Google Cloud identity keys
-  and Authentik-backed Workload Identity Federation:
-  - Google project id: `project-88c23ce9-918a-470a-b33`.
-  - Google project number: `416198671487`.
-  - KMS key ring: `burrow-identity`.
-  - non-exportable signing keys for Authentik signing, SAML CA signing, and
-    release signing.
-  - a Forgejo runner service account that can be assumed only through the
-    configured Authentik WIF provider and IAM bindings. Machine-to-machine
-    runner tokens are scoped by the Authentik WIF client ID
-    `google-wif.burrow.net`, with `burrow-automation` kept as the human/group
-    policy boundary.
-- Add `infra/releases` as the OpenTofu boundary for Google Cloud
-  Storage-backed release backups:
-  - `burrow-net-releases` backs up build artifacts and Sparkle public channels.
-  - `burrow-net-packages` backs up signed APT, RPM, pacman, Flatpak, and Arch
-    repository trees.
-  - `burrow-net-nix-cache` backs up the Garage `attic` bucket and remains
-    private by default.
-  - Garage is the required S3-compatible primary target for release and package
-    uploads.
-  - `services.burrow.garage` is enabled by the forge host and bootstraps the
-    single-node layout, the `attic`, `burrow-releases`, and `burrow-packages`
-    buckets, scoped owner/write S3 access keys, and a read-only backup key from
-    a host-local environment file.
-  - Forgejo jobs authenticate with Authentik-backed WIF before using `gcloud
-    storage` for backup and Google KMS for signing; rclone and Google
-    service-account JSON keys are not part of the release path.
-- Add `services.burrow.nixCache` for `nix.burrow.net`:
-  - Attic serves `https://nix.burrow.net/burrow` as the public Burrow cache.
-  - Attic stores chunks in the Garage `attic` bucket through the local S3 API.
-  - Workers use the cache only after `BURROW_NIX_CACHE_PUBLIC_KEY` is published
-    in Forgejo variables.
-  - Push access uses `/var/lib/burrow/nix-cache/ci-push-token`, sealed into
-    Forgejo/OpenBao as `BURROW_NIX_CACHE_PUSH_TOKEN`, instead of the host-local
-    bootstrap admin token.
-  - `.forgejo/workflows/publish-nix-cache.yml` builds selected flake outputs and
-    publishes their closures to Attic.
-- Add `services.burrow.observability` as the forge host observability spine:
-  - Prometheus scrapes local system, Grafana, Headscale, OpenTelemetry
-    collector, and Jaeger metrics.
-  - Headscale exposes local metrics on `127.0.0.1:9098`.
-  - Tailscale SaaS metrics can be enabled later through the Prometheus
-    Tailscale exporter once the OAuth environment file is provisioned.
-  - Burrow backend/frontend processes emit OTLP to the local collector at
-    `127.0.0.1:4317` or `127.0.0.1:4318`.
-  - The collector exports traces to local Jaeger, while Grafana queries Jaeger
-    server-side through a provisioned datasource.
-- Add `infra/openbao` as the OpenTofu boundary for OpenBao:
-  - Google KMS seal wrapping.
-  - an `age/` KV v2 mount for migrated runtime secrets.
-  - Authentik OIDC roles for administrators and automation.
-  - AppRole policy scaffolding for machine consumers.
-- Add NixOS modules under `services.burrow.openbao` and
-  `services.burrow.jitsi`:
-  - both are imported by the forge host but disabled by default.
-  - DNS, reverse proxy, KMS seal, storage, and UDP/video bridge requirements are
-    visible in repo-owned options before activation.
-  - live enablement requires a separate deploy with secrets, DNS, and rollback
-    evidence.
-- Keep webmail as a second mail phase:
-  - `inbox.burrow.net` is the intended webmail surface.
-  - Stalwart is the planned mail server, but the current Nixpkgs module set in
-    this flake does not expose the expected `services.stalwart-mail` option.
-  - Forward Email remains the current production mail path until a Stalwart BEP
-    revision names the exact NixOS module, ports, spam policy, backup target,
-    DKIM rotation, and migration plan.
-- Extract an MCP hub to a dedicated compatible.systems repository:
-  - target repository: `compatible.systems/burrow/mcp-hub`.
-  - this repository keeps `services/mcp-hub/` as the extraction plan and
-    bootstrap manifest until the external repo exists.
-  - MCP tools should cover OpenBao, Authentik, KMS/WIF, Forgejo runners, Jitsi,
-    mail, release signing, and Burrow agent identity.
-- Create a `burrow-core` Rust crate as the cross-platform protocol/application
-  core boundary:
-  - no direct TUN, NetworkExtension, VpnService, GTK, SwiftUI, or desktop UI
-    dependencies.
-  - platform shells link it through a thin FFI crate or native Rust API.
-  - target platforms include Linux x86_64/aarch64/riscv64, Android, macOS, iOS,
-    visionOS, and future Windows.
-- Add an Android stub:
-  - Kotlin app shell in `Android/app`.
-  - Rust JNI/FFI crate in `crates/burrow-mobile-ffi`.
-  - the stub loads the Rust core and displays its version.
-  - full VPN support must use Android `VpnService`; it must not bypass platform
-    disclosure and consent flows.
-- Keep Bazel as the stable build orchestration entrypoint:
-  - platform lanes expose wrapper targets under `bazel/`.
-  - Bazel actions may call repo-owned scripts, Cargo, Gradle, Xcode, Meson, and
-    OpenTofu while the project migrates deeper native rules selectively.
-  - Namespace cache setup remains the fast path for remote Bazel and local disk
-    caches.
-- Use a shared Burrow owl identity across app shells:
-  - the mark uses a grounded Burrowing Owl silhouette: compact face, warm brown
-    body, small cream markings, and long pale legs visible in front of the
-    burrow rim.
-  - `design/brand/Burrow.icon` is the Icon Composer source and is intentionally
-    kept to three broad raster layers: burrow ground, owl figure, and front
-    legs.
-  - `design/brand/burrow-owl-icon-master.png` is the generated raster master for
-    Apple app icon outputs.
-  - Apple asset catalogs derive all `AppIcon` PNG sizes from that master and
-    use a restrained warm brown/gold accent color.
-  - GTK keeps a simple vector owl/burrow icon and symbolic icon so Linux
-    desktops do not inherit the old blue gear-style mark.
-  - Brown/black stays the core palette, with lighter brown, orange, or gold used
-    only as accents for eyes, beak, highlights, and platform tint.
-- For Linux distribution, split the GUI package from the privileged daemon:
-  - DEB, RPM, pacman, AUR, and the NixOS flake/module install `burrowd`,
-    systemd units, D-Bus policy, and polkit policy.
-  - APT, RPM, and pacman repository metadata is generated from release package
-    artifacts and signed through Google KMS-backed OpenPGP signatures.
-  - Repository trees publish through the storage wrapper: Garage first when
-    configured, then GCS backup after the runner obtains a short-lived Google
-    credential from Authentik-backed WIF.
-  - AUR is a source-build git repository, with `burrow-git` tracked in this
-    repo before publication to `aur.archlinux.org`.
-  - Flatpak and AppImage packages are GUI-first shells that connect to the host
-    daemon/helper.
-  - Flatpak may request background/autostart permission for the GUI, but it
-    must not be responsible for the privileged VPN data plane.
-  - PackageKit may be used only as an optional native-package bootstrap on
-    supported distros, with narrow D-Bus permission and polkit authorization.
-
-## Security and Operational Considerations
-
-- Google KMS keys are non-exportable and have `prevent_destroy` enabled.
-- Workload Identity Federation is scoped by issuer, audience, mapped
-  attributes, and service-account IAM bindings. Runners should not receive
-  static Google credentials.
-- OpenBao bootstrap tokens and AppRole SecretIDs must never enter OpenTofu
-  state. OpenTofu manages mounts, policies, roles, and cloud KMS objects only.
-- OpenBao should start behind `vault.burrow.net` only after:
-  - KMS seal key exists and decrypt permission is limited to the service
-    identity.
-  - root/admin token bootstrap is recorded out of band.
-  - backup/restore and seal/unseal drills are documented.
-- Jitsi should start behind `meet.burrow.net` only after:
-  - HTTPS and XMPP domains resolve.
-  - UDP media ports are intentionally opened.
-  - Authentik guest/member policy is decided.
-- Flatpak cannot be the privileged VPN backend by itself. A Flatpak GUI may talk
-  to a host daemon or privileged helper, but opening TUN devices, installing
-  routes, and owning system DNS/routing policy belong outside the sandbox.
-- Host service bootstrap should be auditable. A Flatpak may discover the daemon,
-  open native install instructions, or request a host helper through a narrow
-  D-Bus name. It must not require broad system-bus access, host filesystem
-  access, or `flatpak-spawn --host` as the normal production path.
-- Mobile VPN support uses platform VPN APIs:
-  - Android: `VpnService` with Play policy disclosure for Play Store builds.
-  - iOS and visionOS: NetworkExtension packet tunnel provider.
-- Release signing, SAML CA signing, and Authentik signing should remain separate
-  keys even when they share a KMS key ring.
-- Package repository signing should stay split by repository format. APT, RPM,
-  pacman, Flatpak, and AUR source surfaces each get a dedicated KMS key so a
-  compromised publisher path does not automatically sign every Linux channel.
-- Observability ingress is local-first. Prometheus, the OpenTelemetry collector,
-  and Jaeger bind to loopback; Grafana is the authenticated public surface.
-- Jaeger should not be exposed publicly until an Authentik-protected route or
-  equivalent access boundary is added.
-- GCS is a backup target, not the storage abstraction. Future multi-cloud
-  failover should add explicit provider mirrors or S3-compatible endpoints
-  behind the storage wrappers.
-- Garage needs real host storage for object data and metadata. It replicates
-  across Garage nodes, but it does not manage multiple external storage
-  backends. GCS and later providers should be explicit mirror/backup jobs.
-- `.forgejo/workflows/backup-garage-storage.yml` is the first explicit mirror.
-  It uses a read-only Garage key and Authentik-backed WIF to copy Garage bucket
-  contents to GCS without rclone or static Google service-account keys.
-
-## Contributor Playbook
-
-1. Validate BEP metadata:
-   ```bash
-   python3 Scripts/check-bep-metadata.py
-   ```
-2. Check the Android/Rust stub:
-   ```bash
-   cargo check --locked -p burrow-mobile-ffi
-   bazel build //bazel/android:check_stub_stamp
-   ```
-3. Validate identity OpenTofu syntax:
-   ```bash
-   Scripts/identity-tofu.sh init -backend=false
-   Scripts/identity-tofu.sh validate
-   ```
-4. Validate release storage OpenTofu syntax:
-   ```bash
-   Scripts/releases-tofu.sh init -backend=false
-   Scripts/releases-tofu.sh validate
-   ```
-5. Validate observability Nix wiring and dashboard JSON:
-   ```bash
-   nix eval .#nixosConfigurations.burrow-forge.config.services.prometheus.scrapeConfigs
-   jq empty services/grafana/dashboards/headscale.json services/grafana/dashboards/observability.json
-   ```
-6. Validate the Nix cache module wiring:
-   ```bash
-   nix eval .#nixosConfigurations.burrow-forge.config.services.atticd.settings.storage --json
-   ```
-7. Validate cache publishing and Garage backup wrapper syntax:
-   ```bash
-   bash -n Scripts/ci/publish-nix-cache.sh Scripts/ci/backup-garage-to-gcs.sh
-   ```
-8. Validate OpenBao OpenTofu syntax:
-   ```bash
-   Scripts/openbao-tofu.sh init -backend=false
-   Scripts/openbao-tofu.sh validate
-   ```
-9. Before enabling `vault.burrow.net`, create or import the Google KMS seal key,
-   configure OpenBao bootstrap access, and record a restore test.
-10. Before enabling `meet.burrow.net`, verify DNS, TLS, UDP reachability, and
-   Authentik access policy.
-11. Before distributing Flatpak as more than a GUI, prove the host daemon/helper
-   path on a real Linux desktop.
-12. Before Play Store distribution, complete the `VpnService` declaration and
-   data-safety review.
-13. Before relying on PackageKit bootstrap, test Fedora, Debian/Ubuntu, and an
-   immutable/atomic desktop separately. PackageKit support is not universal and
-   should degrade to native install instructions.
-14. Before promoting package repositories to stable, run the repository
-    publisher, import the generated public key on a clean VM for each package
-    family, and install Burrow from that repository rather than from the loose
-    artifact.
-
-## Alternatives Considered
-
-- Enable OpenBao and Jitsi immediately on the forge host. Rejected because both
-  change public ingress and security boundaries before secrets, DNS, and
-  rollback evidence are complete.
-- Store Google service-account JSON in Forgejo secrets. Rejected because WIF
-  gives the runner an attributable short-lived credential path without static
-  cloud keys.
-- Put Android directly on the existing daemon crate. Rejected for now because
-  the daemon carries OS-specific TUN and service assumptions. A small
-  cross-platform core gives mobile a safer first boundary.
-- Treat Flatpak as the complete Linux VPN package. Rejected because routing,
-  TUN, and DNS changes need host authority.
-- Use broad Flatpak host escape permissions to fork the daemon directly.
-  Rejected because that defeats the value of Flatpak and makes review harder
-  than shipping a small native daemon package with explicit polkit policy.
-- Use one package signing key for every Linux repository. Rejected because
-  format-specific keys give cleaner revocation and narrower IAM grants.
-
-## Impact on Other Work
-
-- BEP-0009 release work gains identity and app-distribution follow-up lanes.
-- BEP-0005 and BEP-0006 remain authoritative for daemon/client boundaries.
-- BEP-0004 remains authoritative for current hosted mail until a Stalwart
-  revision supersedes it.
-- MCP extraction should not move forge runner code until the external
-  compatible.systems repository exists and import paths are stable.
-
-## Decision
-
-Pending.
-
-## References
-
-- `CONSTITUTION.md`
-- `contributors.nix`
-- `evolution/proposals/BEP-0004-hosted-mail-and-saas-identity.md`
-- `evolution/proposals/BEP-0005-daemon-ipc-and-apple-boundary.md`
-- `evolution/proposals/BEP-0006-tailnet-authority-first-control-plane.md`
-- `evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md`
-- `infra/identity/`
-- `infra/releases/`
-- `infra/openbao/`
-- `docs/OBSERVABILITY.md`
-- `docs/NIX_CACHE.md`
-- `.forgejo/workflows/publish-nix-cache.yml`
-- `.forgejo/workflows/backup-garage-storage.yml`
-- `Scripts/ci/publish-nix-cache.sh`
-- `Scripts/ci/backup-garage-to-gcs.sh`
-- `package/repositories/`
-- `nixos/modules/burrow-garage.nix`
-- `nixos/modules/burrow-nix-cache.nix`
-- `nixos/modules/burrow-observability.nix`
-- `nixos/modules/burrow-openbao.nix`
-- `nixos/modules/burrow-jitsi.nix`
-- `crates/burrow-core/`
-- `crates/burrow-mobile-ffi/`
-- `Android/`
-- `bazel/android/`
-- `services/mcp-hub/`
diff --git a/evolution/proposals/BEP-0011-panel-icon-family-and-platform-assets.md b/evolution/proposals/BEP-0011-panel-icon-family-and-platform-assets.md
deleted file mode 100644
index a8ed094..0000000
--- a/evolution/proposals/BEP-0011-panel-icon-family-and-platform-assets.md
+++ /dev/null
@@ -1,87 +0,0 @@
-# `BEP-0011` - Panel Icon Family and Platform Assets
-
-```text
-Status: Implemented
-Proposal: BEP-0011
-Authors: gpt-5.4
-Coordinator: gpt-5.4
-Reviewers: Pending
-Constitution Sections: II, V
-Implementation PRs: Pending
-Decision Date: 2026-06-07
-```
-
-## Summary
-
-Burrow uses a locked six-panel burrowing owl icon family as the product icon
-language. The supplied panel sheet and its six cropped PNG masters are the
-canonical source; platform-specific PNGs are generated from those rasters.
-
-## Motivation
-
-- Burrow needs one recognizable icon language across iOS, macOS, watchOS,
-  Android, and Linux packaging.
-- The iOS app should expose the six panel variants as local alternate app icons.
-- Platform packages need exact launcher dimensions without hand-edited raster
-  drift.
-
-## Detailed Design
-
-- `Scripts/generate-brand-icons.py` owns the raster crop and platform exports.
-- `design/brand/panel-variants/source-sheet.png` stores the locked panel sheet.
-- The generator writes six 1024px PNG masters under
-  `design/brand/panel-variants/` when run with `--extract-from`.
-- iOS uses `panel-01-guardian` as the primary icon and exposes the other five
-  panel variants through native alternate app icon asset sets.
-- macOS uses `panel-05-stride` as the primary app icon.
-- watchOS uses `panel-03-burrow` as the primary app icon; exact watch icon
-  sizes live in `design/brand/watchos/AppIcon.appiconset` until a watch target
-  owns them directly.
-- Android launcher mipmaps and Linux hicolor PNGs are generated from the same
-  raster master as iOS primary.
-- The Apple UI calls only `UIApplication.setAlternateIconName`; no daemon,
-  control-plane, or network path is added for icon selection.
-
-## Security and Operational Considerations
-
-- Icon selection is local presentation state and does not touch auth, routing,
-  daemon IPC, or account material.
-- Generated rasters are deterministic from checked-in raster masters.
-- The rollback path is to revert the generator and regenerate assets.
-
-## Contributor Playbook
-
-- Keep icon geometry in the raster panel masters; do not redraw it as SVG.
-- Edit `Scripts/generate-brand-icons.py` only for crop boxes, package sizes, or
-  platform picks.
-- Run `Scripts/generate-brand-icons.py`.
-- Review `design/brand/panel-variants/preview-strip.png`.
-- Review `design/brand/low-res/preview-strip.png` and
-  `design/brand/low-res/pixel-preview-strip.png`.
-- Run `Scripts/check-brand-icon-lowres.sh`.
-- Build the Apple app and Android app after asset changes.
-
-## Alternatives Considered
-
-- Keep a single app icon. Rejected because the six panel variants are all valid
-  product directions and iOS has a native alternate icon API.
-- Redraw the sheet as SVG. Rejected because the supplied raster panel already
-  carries the desired style, texture, and proportions.
-- Let the daemon choose app icons. Rejected because icon selection is local
-  presentation behavior and should not cross the daemon boundary.
-
-## Impact on Other Work
-
-- Store metadata and packaging jobs should use generated platform assets.
-- Future design changes should preserve the raster panel source and generated
-  package outputs.
-
-## Decision
-
-Implemented on 2026-06-07.
-
-## References
-
-- `Scripts/generate-brand-icons.py`
-- `design/brand/panel-variants/`
-- `Apple/UI/BurrowView.swift`
diff --git a/flake.lock b/flake.lock
deleted file mode 100644
index e2ce1a1..0000000
--- a/flake.lock
+++ /dev/null
@@ -1,196 +0,0 @@
-{
-  "nodes": {
-    "agenix": {
-      "inputs": {
-        "darwin": "darwin",
-        "home-manager": "home-manager",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1770165109,
-        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
-        "owner": "ryantm",
-        "repo": "agenix",
-        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ryantm",
-        "repo": "agenix",
-        "type": "github"
-      }
-    },
-    "darwin": {
-      "inputs": {
-        "nixpkgs": [
-          "agenix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1744478979,
-        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
-        "owner": "lnl7",
-        "repo": "nix-darwin",
-        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "lnl7",
-        "ref": "master",
-        "repo": "nix-darwin",
-        "type": "github"
-      }
-    },
-    "disko": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1780290312,
-        "narHash": "sha256-eTAlX0CwgB84Ts3GaBd944A3DRXVMzgA0EqroZBISUo=",
-        "type": "tarball",
-        "url": "https://codeload.github.com/nix-community/disko/tar.gz/master"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://codeload.github.com/nix-community/disko/tar.gz/master"
-      }
-    },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems_2"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "type": "tarball",
-        "url": "https://codeload.github.com/numtide/flake-utils/tar.gz/main"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://codeload.github.com/numtide/flake-utils/tar.gz/main"
-      }
-    },
-    "hcloud-upload-image-src": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1766413232,
-        "narHash": "sha256-1u9tpzciYjB/EgBI81pg9w0kez7hHZON7+AHvfKW7k0=",
-        "type": "tarball",
-        "url": "https://codeload.github.com/apricote/hcloud-upload-image/tar.gz/v1.3.0"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://codeload.github.com/apricote/hcloud-upload-image/tar.gz/v1.3.0"
-      }
-    },
-    "home-manager": {
-      "inputs": {
-        "nixpkgs": [
-          "agenix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1745494811,
-        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1780243769,
-        "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nsc-autoscaler": {
-      "inputs": {
-        "flake-utils": [
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1775221037,
-        "narHash": "sha256-tv6Y3cqn76PEyZpSMMItVW96KKIboovBWTOv5Lt7PXg=",
-        "ref": "refs/heads/main",
-        "rev": "2c485752fde28ec3be2f228b571d1906f4bcf917",
-        "revCount": 10,
-        "type": "git",
-        "url": "https://compatible.systems/conrad/nsc-autoscaler.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://compatible.systems/conrad/nsc-autoscaler.git"
-      }
-    },
-    "root": {
-      "inputs": {
-        "agenix": "agenix",
-        "disko": "disko",
-        "flake-utils": "flake-utils",
-        "hcloud-upload-image-src": "hcloud-upload-image-src",
-        "nixpkgs": "nixpkgs",
-        "nsc-autoscaler": "nsc-autoscaler"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}
diff --git a/flake.nix b/flake.nix
deleted file mode 100644
index bdaa590..0000000
--- a/flake.nix
+++ /dev/null
@@ -1,386 +0,0 @@
-{
-  description = "Burrow development shell and forge host configuration";
-
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    flake-utils.url = "tarball+https://codeload.github.com/numtide/flake-utils/tar.gz/main";
-    agenix = {
-      url = "github:ryantm/agenix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    disko = {
-      url = "tarball+https://codeload.github.com/nix-community/disko/tar.gz/master";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    nsc-autoscaler = {
-      url = "git+https://compatible.systems/conrad/nsc-autoscaler.git";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.flake-utils.follows = "flake-utils";
-    };
-    hcloud-upload-image-src = {
-      url = "tarball+https://codeload.github.com/apricote/hcloud-upload-image/tar.gz/v1.3.0";
-      flake = false;
-    };
-  };
-
-  outputs = { self, nixpkgs, flake-utils, agenix, disko, nsc-autoscaler, hcloud-upload-image-src }:
-    let
-      supportedSystems = [
-        "x86_64-linux"
-        "aarch64-linux"
-        "x86_64-darwin"
-        "aarch64-darwin"
-      ];
-    in
-    (flake-utils.lib.eachSystem supportedSystems (system:
-      let
-        pkgs = import nixpkgs {
-          inherit system;
-        };
-        lib = pkgs.lib;
-        bazelPkg =
-          if lib.hasAttr "bazelisk" pkgs then
-            pkgs.bazelisk
-          else if lib.hasAttr "bazel_9" pkgs then
-            pkgs.bazel_9
-          else if lib.hasAttr "bazel" pkgs then
-            pkgs.bazel
-          else
-            pkgs.bazel_7;
-        buildifierPkg =
-          if lib.hasAttr "buildifier" pkgs then
-            pkgs.buildifier
-          else
-            pkgs.bazel-buildtools;
-        nodejsPkg =
-          if lib.hasAttr "nodejs_22" pkgs then
-            pkgs.nodejs_22
-          else if lib.hasAttr "nodejs_24" pkgs then
-            pkgs.nodejs_24
-          else if lib.hasAttr "nodejs" pkgs then
-            pkgs.nodejs
-          else
-            pkgs.nodejs_20;
-        python3WithCrypto = pkgs.python3.withPackages (pythonPackages: [
-          pythonPackages.cryptography
-        ]);
-        optionalPackage = name: lib.optional (lib.hasAttr name pkgs) (lib.getAttr name pkgs);
-        googleKmsPkcs11Package =
-          if pkgs.stdenv.hostPlatform.isx86_64 && pkgs.stdenv.isLinux then
-            let
-              version = "1.9";
-            in
-            pkgs.stdenv.mkDerivation {
-              pname = "google-kms-pkcs11";
-              inherit version;
-              src = pkgs.fetchurl {
-                url = "https://github.com/GoogleCloudPlatform/kms-integrations/releases/download/pkcs11-v${version}/libkmsp11-${version}-linux-amd64.tar.gz";
-                sha256 = "sha256-U5f5ZQc81dHixD5RSPEC8xp8g1kC+X60HHycDxuHakA=";
-              };
-              nativeBuildInputs = [ pkgs.autoPatchelfHook ];
-              buildInputs = [ pkgs.stdenv.cc.cc.lib ];
-              installPhase = ''
-                runHook preInstall
-                install -Dm755 libkmsp11.so "$out/lib/libkmsp11.so"
-                install -Dm644 kmsp11.h "$out/include/kmsp11.h"
-                install -Dm644 LICENSE "$out/share/licenses/google-kms-pkcs11/LICENSE"
-                mkdir -p "$out/bin"
-                cat > "$out/bin/google-kms-pkcs11-module" <<EOF
-#!/usr/bin/env sh
-printf '%s\n' "$out/lib/libkmsp11.so"
-EOF
-                chmod 755 "$out/bin/google-kms-pkcs11-module"
-                runHook postInstall
-              '';
-              meta = with lib; {
-                description = "Google Cloud KMS PKCS#11 library";
-                homepage = "https://github.com/GoogleCloudPlatform/kms-integrations";
-                license = licenses.asl20;
-                platforms = [ "x86_64-linux" ];
-              };
-            }
-          else
-            null;
-        rcodesignPkcs11Package =
-          if pkgs ? rcodesign then
-            pkgs.rcodesign.overrideAttrs (old: {
-              pname = "rcodesign-pkcs11";
-              patches = (old.patches or [ ]) ++ [
-                ./patches/rcodesign-pkcs11-tool.patch
-              ];
-              nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.makeWrapper ];
-              postInstall = (old.postInstall or "") + ''
-                wrapProgram "$out/bin/rcodesign" \
-                  --prefix PATH : ${lib.makeBinPath [ pkgs.opensc pkgs.openssl ]} \
-                  --set-default BURROW_OPENSSL_MODULES ${pkgs.pkcs11-provider}/lib/ossl-modules
-              '';
-              passthru = (old.passthru or { }) // {
-                isBurrowPkcs11Fork = true;
-              };
-              meta = (old.meta or { }) // {
-                description = "rcodesign with Burrow PKCS#11 signing support";
-              };
-            })
-          else
-            null;
-        commonPackages = with pkgs; [
-          cargo
-          rustc
-          rustfmt
-          clippy
-          bazelPkg
-          buildifierPkg
-          protobuf
-          pkg-config
-          sqlite
-          git
-          openssh
-          age
-          opentofu
-          curl
-          jq
-          nodejsPkg
-          python3WithCrypto
-          openssl
-          rsync
-          zip
-          unzip
-        ] ++ optionalPackage "google-cloud-sdk"
-          ++ optionalPackage "awscli2"
-          ++ optionalPackage "attic-client"
-          ++ optionalPackage "opensc"
-          ++ optionalPackage "pkcs11-provider"
-          ++ lib.optional (googleKmsPkcs11Package != null) googleKmsPkcs11Package
-          ++ lib.optional (rcodesignPkcs11Package != null) rcodesignPkcs11Package;
-        linuxRepositoryPackages = lib.optionals pkgs.stdenv.isLinux (
-          (with pkgs; [
-            dpkg
-            rpm
-            createrepo_c
-            pacman
-            fakeroot
-            zstd
-          ])
-          ++ optionalPackage "cargo-generate-rpm"
-        );
-        packageRepositoryPackages =
-          linuxRepositoryPackages;
-        linuxGtkNativePackages = lib.optionals pkgs.stdenv.isLinux (with pkgs; [
-          meson
-          ninja
-          cmake
-          clang
-          gettext
-          desktop-file-utils
-        ]);
-        linuxGtkBuildInputs = lib.optionals pkgs.stdenv.isLinux (with pkgs; [
-          gtk4
-          libadwaita
-          glib
-          openssl
-        ]);
-        gtkShellPackages = with pkgs; [
-          cargo
-          rustc
-          rustfmt
-          clippy
-          protobuf
-          pkg-config
-          sqlite
-          git
-        ];
-        nscPkg =
-          if pkgs.stdenv.isLinux || pkgs.stdenv.isDarwin then
-            let
-              version = "0.0.520";
-              osName =
-                if pkgs.stdenv.isLinux then
-                  "linux"
-                else if pkgs.stdenv.isDarwin then
-                  "darwin"
-                else
-                  throw "nsc: unsupported host OS ${pkgs.stdenv.hostPlatform.system}";
-              archInfo =
-                if pkgs.stdenv.hostPlatform.isx86_64 then
-                  {
-                    arch = "amd64";
-                    hash =
-                      if pkgs.stdenv.isLinux then
-                        "sha256-Fqy6baIGQOGwbMCYHECOy5GcJg23xSs8XaZRfia5aHE="
-                      else
-                        "sha256-dCOr3mjAAhaByXX4yUr0dXZan8Mx8nbfggUemK7psbM=";
-                  }
-                else if pkgs.stdenv.hostPlatform.isAarch64 then
-                  {
-                    arch = "arm64";
-                    hash =
-                      if pkgs.stdenv.isLinux then
-                        "sha256-Vv+UUd0BpcxwEg2dCsGJ/7lFOcXrl9yNwHDoHrgivKY="
-                      else
-                        "sha256-ASVXJhNwuWQ6T5nGTclZkv+5pPDPD/Q4i4nyAjVw2Gw=";
-                  }
-                else
-                  throw "nsc: unsupported host platform ${pkgs.stdenv.hostPlatform.system}";
-              src = pkgs.fetchurl {
-                url = "https://github.com/namespacelabs/foundation/releases/download/v${version}/nsc_${version}_${osName}_${archInfo.arch}.tar.gz";
-                sha256 = archInfo.hash;
-              };
-            in
-            pkgs.stdenvNoCC.mkDerivation {
-              pname = "nsc";
-              inherit version src;
-              meta.mainProgram = "nsc";
-              dontConfigure = true;
-              dontBuild = true;
-              unpackPhase = ''
-                tar -xzf "$src"
-              '';
-              installPhase = ''
-                install -d "$out/bin"
-                install -m 0555 nsc "$out/bin/nsc"
-                install -m 0555 docker-credential-nsc "$out/bin/docker-credential-nsc"
-                install -m 0555 bazel-credential-nsc "$out/bin/bazel-credential-nsc"
-              '';
-            }
-          else
-            null;
-        hcloudUploadImagePkg = pkgs.buildGoModule {
-          pname = "hcloud-upload-image";
-          version = "1.3.0";
-          src = hcloud-upload-image-src;
-          vendorHash = "sha256-IdOAUBPg0CEuHd2rdc7jOlw0XtnAhr3PVPJbnFs2+x4=";
-          subPackages = [ "." ];
-          env.GOWORK = "off";
-          ldflags = [
-            "-s"
-            "-w"
-          ];
-        };
-        forgejoNscSrc = lib.cleanSourceWith {
-          src = ./services/forgejo-nsc;
-          filter = path: type:
-            let
-              p = toString path;
-              name = builtins.baseNameOf path;
-              hasDir = dir: lib.hasInfix "/${dir}/" p || lib.hasSuffix "/${dir}" p;
-            in
-            !(hasDir ".git" || hasDir "vendor" || hasDir "node_modules" || name == "result");
-        };
-        forgejoNscDispatcher = pkgs.buildGoModule {
-          pname = "forgejo-nsc-dispatcher";
-          version = "0.1.0";
-          src = forgejoNscSrc;
-          subPackages = [ "./cmd/forgejo-nsc-dispatcher" ];
-          vendorHash = "sha256-Kpr+5Q7Dy4JiLuJVZbFeJAzLR7PLPYxhtJqfxMEytcs=";
-        };
-        forgejoNscAutoscaler = pkgs.buildGoModule {
-          pname = "forgejo-nsc-autoscaler";
-          version = "0.1.0";
-          src = forgejoNscSrc;
-          subPackages = [ "./cmd/forgejo-nsc-autoscaler" ];
-          vendorHash = "sha256-Kpr+5Q7Dy4JiLuJVZbFeJAzLR7PLPYxhtJqfxMEytcs=";
-        };
-        burrowSrc = lib.cleanSourceWith {
-          src = ./.;
-          filter = path: type:
-            let
-              p = toString path;
-              name = builtins.baseNameOf path;
-              hasDir = dir: lib.hasInfix "/${dir}/" p || lib.hasSuffix "/${dir}" p;
-            in
-            !(hasDir ".git" || hasDir "target" || hasDir "node_modules" || name == "result");
-        };
-        burrowPkg = pkgs.rustPlatform.buildRustPackage {
-          pname = "burrow";
-          version = "0.1.0";
-          src = burrowSrc;
-          cargoLock = {
-            lockFile = ./Cargo.lock;
-            outputHashes = {
-              "tracing-oslog-0.1.2" = "sha256-DjJDiPCTn43zJmmOfuRnyti8iQf9qoXICMKIx4bAG3I=";
-            };
-          };
-          cargoBuildFlags = [
-            "-p"
-            "burrow"
-            "--bin"
-            "burrow"
-          ];
-          nativeBuildInputs = [ pkgs.protobuf ];
-          meta.mainProgram = "burrow";
-        };
-        gtkDevShell = pkgs.mkShell {
-          packages = gtkShellPackages ++ linuxGtkNativePackages;
-          buildInputs = linuxGtkBuildInputs;
-        };
-      in
-      {
-        devShells.default = pkgs.mkShell {
-          packages =
-            commonPackages
-            ++ linuxGtkNativePackages
-            ++ [
-              hcloudUploadImagePkg
-              forgejoNscDispatcher
-              forgejoNscAutoscaler
-            ]
-            ++ lib.optionals (nscPkg != null) [ nscPkg ];
-          buildInputs = linuxGtkBuildInputs;
-        };
-
-        devShells.gtk = gtkDevShell;
-
-        devShells.ci = pkgs.mkShell {
-          packages =
-            commonPackages
-            ++ packageRepositoryPackages
-            ++ [
-              hcloudUploadImagePkg
-            ]
-            ++ lib.optionals (nscPkg != null) [ nscPkg ];
-        };
-
-        formatter = pkgs.nixpkgs-fmt;
-
-        packages =
-          {
-            age = pkgs.age;
-            agenix = agenix.packages.${system}.agenix;
-            burrow = burrowPkg;
-            hcloud-upload-image = hcloudUploadImagePkg;
-            forgejo-nsc-dispatcher = forgejoNscDispatcher;
-            forgejo-nsc-autoscaler = forgejoNscAutoscaler;
-          }
-          // lib.optionalAttrs (nscPkg != null) { nsc = nscPkg; }
-          // lib.optionalAttrs (googleKmsPkcs11Package != null) { google-kms-pkcs11 = googleKmsPkcs11Package; }
-          // lib.optionalAttrs (rcodesignPkcs11Package != null) { rcodesign-pkcs11 = rcodesignPkcs11Package; };
-      }))
-    // {
-      nixosModules.burrow-forge = import ./nixos/modules/burrow-forge.nix;
-      nixosModules.burrow-forge-runner = import ./nixos/modules/burrow-forge-runner.nix;
-      nixosModules.burrow-forgejo-nsc = nsc-autoscaler.nixosModules.default;
-      nixosModules.burrow-authentik = import ./nixos/modules/burrow-authentik.nix;
-      nixosModules.burrow-garage = import ./nixos/modules/burrow-garage.nix;
-      nixosModules.burrow-headscale = import ./nixos/modules/burrow-headscale.nix;
-      nixosModules.burrow-nix-cache = import ./nixos/modules/burrow-nix-cache.nix;
-      nixosModules.burrow-observability = import ./nixos/modules/burrow-observability.nix;
-      nixosModules.burrow-zulip = import ./nixos/modules/burrow-zulip.nix;
-      nixosModules.burrow-openbao = import ./nixos/modules/burrow-openbao.nix;
-      nixosModules.burrow-jitsi = import ./nixos/modules/burrow-jitsi.nix;
-      nixosConfigurations.burrow-forge = nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-        specialArgs = {
-          inherit self;
-        };
-        modules = [
-          agenix.nixosModules.default
-          disko.nixosModules.disko
-          ./nixos/hosts/burrow-forge/default.nix
-        ];
-      };
-
-      images = {
-        burrow-forge-raw = self.nixosConfigurations.burrow-forge.config.system.build.diskoImages;
-      };
-    };
-}
diff --git a/infra/grafana/.gitignore b/infra/grafana/.gitignore
deleted file mode 100644
index 13b99f9..0000000
--- a/infra/grafana/.gitignore
+++ /dev/null
@@ -1,4 +0,0 @@
-.terraform/
-backend.hcl
-terraform.tfvars
-*.tfplan
diff --git a/infra/grafana/.terraform.lock.hcl b/infra/grafana/.terraform.lock.hcl
deleted file mode 100644
index 7f9a196..0000000
--- a/infra/grafana/.terraform.lock.hcl
+++ /dev/null
@@ -1,29 +0,0 @@
-# This file is maintained automatically by "tofu init".
-# Manual edits may be lost in future updates.
-
-provider "registry.opentofu.org/grafana/grafana" {
-  version     = "4.37.0"
-  constraints = ">= 4.36.0, < 5.0.0"
-  hashes = [
-    "h1:EqimatXUHgE9jIko0ifoR+kOLVCQlLGvj13iH5GoCnE=",
-    "zh:02dcb17aae3e97a4b946e28267a80845b130e4a062ebd0f7dbf15ef1f65713e7",
-    "zh:07b57580fe411de152a3b29a5ac1e0ff2541f9a62904c5b9703cf7e3c63bbbfa",
-    "zh:089b7ce58b919732bedcb95e2a5d99553956a3637e89bb0b814de82050cca635",
-    "zh:08c15290aafeec6945cd5321b5cdc2adb5f077b26fb77225984e3acd055293f7",
-    "zh:0e0d0f89d8f2ca89541b5981c9388263af15c83c98f57d831a2dc162f1586af5",
-    "zh:3363c8c5a987951ec6bf69bfdd1293d2fb1e72aa94e272280b69ef2dd3988e34",
-    "zh:479e2f82ad2b7522851c828f33d6ab7a0cfce44304f25b5b1f5ddabed0fb879c",
-    "zh:4d9d619b6c6c619f58624a9fba8414201fe68403eb5e1588b95d8c31ecc9c71e",
-    "zh:545f24ef5b1d87d641a577556ada8b0ac67417e0bc51ac01238898fb6429d67a",
-    "zh:8b43993924d12d946e002acbf54c8bf7f05a269436ad085c45317c6020ba10df",
-    "zh:965cf4bf12a8a8e858d791743716433d71a17ed2a15e6cd183dc3d7349be24e3",
-    "zh:9a1205bc5cf01f143611afb97934f2cbc5c9225f6bc5c279f6424ea4da96151b",
-    "zh:b49d28a1a0226799a9421b50dcdc2c85de5858d42f92c8443745d80c9dd5e0cd",
-    "zh:b618aa9e7272447b2e1ce46bb399e39d21f605de48c756b6af0b42fddca50674",
-    "zh:b9dac24ca39fcc95575f0051390c71dabdd540ea2c365bb87b5621e5d6219594",
-    "zh:ba3b79a13ece3bd782a79afe590200940ce740eee809ed4cb9e1086253dba1d2",
-    "zh:ba3f77877ed139cbf0d9af9d1b84e827c49fc42c60e545c67c9d05d1e63e9b0c",
-    "zh:ba84824517ef8bb78122f7bdcbd49bbdf289df9b82040dfbee913a73f29fc158",
-    "zh:de116fd3a62a20f183793c760fa4d9521cee7d718165924cc9b0012e297636b5",
-  ]
-}
diff --git a/infra/grafana/README.md b/infra/grafana/README.md
deleted file mode 100644
index 8b4e746..0000000
--- a/infra/grafana/README.md
+++ /dev/null
@@ -1,46 +0,0 @@
-# Burrow Grafana API Control Plane
-
-This OpenTofu stack creates Grafana folders and dashboards through the official
-`grafana/grafana` provider.
-
-This is not a Grafana deployment mechanism. NixOS owns the Grafana service,
-authentication, data sources, and boot-time provisioning.
-
-## Run
-
-Use the repository wrapper so the OpenTofu runtime comes from Nix:
-
-```sh
-Scripts/grafana-tofu.sh init -backend-config=backend.hcl
-Scripts/grafana-tofu.sh plan -var-file=terraform.tfvars
-```
-
-For a local syntax check without remote state:
-
-```sh
-Scripts/grafana-tofu.sh init -backend=false
-Scripts/grafana-tofu.sh validate
-```
-
-Manual Forgejo runs use `.forgejo/workflows/infra-opentofu.yml`. Plan, apply,
-and import modes need `GRAFANA_AUTH` or a decrypted admin password so the
-Grafana provider can reach the API.
-
-## Adoption
-
-The default stack manages the checked-in dashboards:
-
-```text
-services/grafana/dashboards/burrow-overview.json
-services/grafana/dashboards/headscale.json
-services/grafana/dashboards/observability.json
-```
-
-Import existing production objects before enabling apply:
-
-```sh
-Scripts/grafana-tofu.sh import 'grafana_folder.folders["burrow"]' 'burrow'
-Scripts/grafana-tofu.sh import 'grafana_dashboard.dashboards["burrow-overview"]' 'burrow-overview'
-Scripts/grafana-tofu.sh import 'grafana_dashboard.dashboards["burrow-headscale"]' 'burrow-headscale'
-Scripts/grafana-tofu.sh import 'grafana_dashboard.dashboards["burrow-observability"]' 'burrow-observability'
-```
diff --git a/infra/grafana/backend.hcl.example b/infra/grafana/backend.hcl.example
deleted file mode 100644
index 5c21260..0000000
--- a/infra/grafana/backend.hcl.example
+++ /dev/null
@@ -1,5 +0,0 @@
-bucket         = "burrow-opentofu-state"
-key            = "grafana/grafana.tfstate"
-region         = "us-west-2"
-dynamodb_table = "burrow-opentofu-locks"
-encrypt        = true
diff --git a/infra/grafana/grafana.tf b/infra/grafana/grafana.tf
deleted file mode 100644
index eb725ae..0000000
--- a/infra/grafana/grafana.tf
+++ /dev/null
@@ -1,17 +0,0 @@
-resource "grafana_folder" "folders" {
-  for_each = var.manage_grafana_dashboards ? var.grafana_folders : {}
-
-  title = each.value.title
-  uid   = each.value.uid
-}
-
-resource "grafana_dashboard" "dashboards" {
-  for_each = var.manage_grafana_dashboards ? var.grafana_dashboards : {}
-
-  config_json = file(startswith(each.value.path, "/") ? each.value.path : "${path.module}/${each.value.path}")
-  folder      = each.value.folder
-  message     = each.value.message
-  overwrite   = each.value.overwrite
-
-  depends_on = [grafana_folder.folders]
-}
diff --git a/infra/grafana/outputs.tf b/infra/grafana/outputs.tf
deleted file mode 100644
index e378056..0000000
--- a/infra/grafana/outputs.tf
+++ /dev/null
@@ -1,9 +0,0 @@
-output "grafana_dashboard_urls" {
-  description = "Grafana dashboard URLs managed by this stack."
-  value       = { for name, dashboard in grafana_dashboard.dashboards : name => dashboard.url }
-}
-
-output "grafana_folder_uids" {
-  description = "Grafana folder UIDs managed by this stack."
-  value       = { for name, folder in grafana_folder.folders : name => folder.uid }
-}
diff --git a/infra/grafana/providers.tf b/infra/grafana/providers.tf
deleted file mode 100644
index 6dc01f6..0000000
--- a/infra/grafana/providers.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-provider "grafana" {
-  url  = var.grafana_url
-  auth = var.grafana_auth
-}
diff --git a/infra/grafana/terraform.tfvars.example b/infra/grafana/terraform.tfvars.example
deleted file mode 100644
index 27dbab5..0000000
--- a/infra/grafana/terraform.tfvars.example
+++ /dev/null
@@ -1,18 +0,0 @@
-grafana_url = "https://graphs.burrow.net"
-
-manage_grafana_dashboards = true
-
-grafana_folders = {
-  burrow = {
-    title = "Burrow"
-    uid   = "burrow"
-  }
-}
-
-grafana_dashboards = {
-  burrow-overview = {
-    path      = "../../services/grafana/dashboards/burrow-overview.json"
-    folder    = "burrow"
-    overwrite = true
-  }
-}
diff --git a/infra/grafana/variables.tf b/infra/grafana/variables.tf
deleted file mode 100644
index 585ad0e..0000000
--- a/infra/grafana/variables.tf
+++ /dev/null
@@ -1,56 +0,0 @@
-variable "grafana_url" {
-  description = "Grafana base URL."
-  type        = string
-  default     = "https://graphs.burrow.net"
-}
-
-variable "grafana_auth" {
-  description = "Grafana API token or basic auth in username:password form. Prefer GRAFANA_AUTH in CI."
-  type        = string
-  default     = null
-  sensitive   = true
-}
-
-variable "manage_grafana_dashboards" {
-  description = "Manage Grafana folders and dashboards through the Grafana API."
-  type        = bool
-  default     = false
-}
-
-variable "grafana_folders" {
-  description = "Grafana folders to create before dashboards."
-  type = map(object({
-    title = string
-    uid   = optional(string)
-  }))
-  default = {
-    burrow = {
-      title = "Burrow"
-      uid   = "burrow"
-    }
-  }
-}
-
-variable "grafana_dashboards" {
-  description = "Grafana dashboards to manage from checked-in JSON."
-  type = map(object({
-    path      = string
-    folder    = optional(string)
-    message   = optional(string, "Managed by Burrow OpenTofu")
-    overwrite = optional(bool, true)
-  }))
-  default = {
-    burrow-overview = {
-      path   = "../../services/grafana/dashboards/burrow-overview.json"
-      folder = "burrow"
-    }
-    burrow-headscale = {
-      path   = "../../services/grafana/dashboards/headscale.json"
-      folder = "burrow"
-    }
-    burrow-observability = {
-      path   = "../../services/grafana/dashboards/observability.json"
-      folder = "burrow"
-    }
-  }
-}
diff --git a/infra/grafana/versions.tf b/infra/grafana/versions.tf
deleted file mode 100644
index 1186143..0000000
--- a/infra/grafana/versions.tf
+++ /dev/null
@@ -1,12 +0,0 @@
-terraform {
-  required_version = ">= 1.8.0"
-
-  required_providers {
-    grafana = {
-      source  = "grafana/grafana"
-      version = ">= 4.36.0, < 5.0"
-    }
-  }
-
-  backend "s3" {}
-}
diff --git a/infra/identity/.gitignore b/infra/identity/.gitignore
deleted file mode 100644
index b12b9ed..0000000
--- a/infra/identity/.gitignore
+++ /dev/null
@@ -1,5 +0,0 @@
-.terraform/
-backend.hcl
-terraform.tfstate
-terraform.tfstate.backup
-*.tfplan
diff --git a/infra/identity/.terraform.lock.hcl b/infra/identity/.terraform.lock.hcl
deleted file mode 100644
index 0a51a6e..0000000
--- a/infra/identity/.terraform.lock.hcl
+++ /dev/null
@@ -1,20 +0,0 @@
-# This file is maintained automatically by "tofu init".
-# Manual edits may be lost in future updates.
-
-provider "registry.opentofu.org/hashicorp/google" {
-  version     = "6.50.0"
-  constraints = ">= 5.40.0, < 7.0.0"
-  hashes = [
-    "h1:MAAe4zFFdqS9M5rpmJK/vKgdb6ZMD/s/0Xd97yTDipA=",
-    "zh:1d4695f807d998f11fcdcfa174766287b82a8093513af857bcdad2d81c642480",
-    "zh:3173ac5df0294624d113812e49e2a55714aff7db617488168cecdf4168df9e29",
-    "zh:34d2b3d44c23bd6354fc4ab5917b302872ea1ab8de107034567f955b1717fa5b",
-    "zh:3a77f3cc2f3664cd5aaeeef4d044e6ec1695a079588fffec3ca03953664e5f04",
-    "zh:6b444e4b629ea8dc8cb112a39dde098dc5584d26d6de4177558f556a9a226696",
-    "zh:96545c8cd4d3a57069c5d1799eab5aedd887e16d98b5559a195f6d2c2d9bc674",
-    "zh:ba464caafde95ee16671d6b5ec90f053ed77a9d06c567456db6efd9160fa3165",
-    "zh:d876938e5b0d3f57a984d9be72467995f87fef6569968623415dc51d9f54d30b",
-    "zh:dfd908d873e314ab807d0abc9cfd42d2611cd06dc1b9ec719ebdbb738e8e68d6",
-    "zh:f9f16819a7738d564afd45fd169ba61004ec4e4e7089d2a4950cb8895be1fe1f",
-  ]
-}
diff --git a/infra/identity/README.md b/infra/identity/README.md
deleted file mode 100644
index b774578..0000000
--- a/infra/identity/README.md
+++ /dev/null
@@ -1,147 +0,0 @@
-# Burrow Identity KMS and WIF
-
-This OpenTofu stack owns Google Cloud KMS and Workload Identity Federation
-resources for Burrow identity and release automation.
-
-It may manage:
-
-- the `burrow-identity` Google KMS key ring
-- non-exportable KMS signing keys for Authentik, the SAML CA, and release
-  signing
-- dedicated non-exportable KMS signing keys for APT, RPM, pacman, Flatpak, and
-  AUR source release surfaces
-- a non-exportable KMS signing key for the Apple Developer ID Application CSR
-  path (`apple-developer-id-application`)
-- a non-exportable KMS signing key for the Apple iOS Distribution CSR path
-  (`apple-ios-distribution`)
-- a non-exportable software KMS signing key for Sparkle Ed25519 appcast
-  signatures (`sparkle-ed25519`)
-- an Authentik-backed WIF pool/provider for Forgejo runners
-- the runner service account and its narrow IAM binding for the Authentik WIF
-  audience/client value `google-wif.burrow.net`; human/group grants are opt-in
-
-It must not manage:
-
-- Authentik private signing key material
-- OpenBao bootstrap tokens
-- store credentials or service-account JSON keys
-
-Forgejo CI should authenticate with `Scripts/ci/google-wif-auth.sh`. That helper
-uses Authentik to obtain an OIDC token and lets Google WIF impersonate
-`burrow-forgejo-runner@project-88c23ce9-918a-470a-b33.iam.gserviceaccount.com`
-in project `project-88c23ce9-918a-470a-b33`.
-
-## Apple Developer ID CSR
-
-`Scripts/apple/google-kms-csr.py` builds a standard PKCS#10 CSR using the public
-key from `projects/project-88c23ce9-918a-470a-b33/locations/global/keyRings/burrow-identity/cryptoKeys/apple-developer-id-application`
-and asks Google KMS to sign the CSR payload. The private key remains
-non-exportable in KMS.
-
-Forgejo can generate the Apple-uploadable CSR with:
-
-```sh
-Scripts/forgejo-dispatch.sh apple-developer-id-kms-csr.yml --ref main
-```
-
-Apple currently documents Developer ID certificate creation through the
-Developer website or Xcode. After downloading the returned `.cer`, keep it with
-release artifacts; do not convert this key path into an exportable `.p12`.
-
-The active certificate created from this path is Apple certificate
-`9JKN6HXBHC`, stored at
-`Apple/Certificates/developer-id-application-9JKN6HXBHC.cer`. Its public key
-matches KMS key version `apple-developer-id-application/cryptoKeyVersions/1`.
-
-## Apple iOS Distribution CSR
-
-The iOS App Store distribution certificate uses the same CSR builder with the
-`apple-ios-distribution` KMS key:
-
-```sh
-Scripts/apple/google-kms-csr.py \
-  --kms-key apple-ios-distribution \
-  --common-name "Burrow iOS Distribution" \
-  --output ios-distribution.certSigningRequest
-```
-
-The App Store Connect API can create the certificate from that CSR:
-
-```sh
-Scripts/apple/create-asc-certificate.mjs \
-  --certificate-type IOS_DISTRIBUTION \
-  --csr-file ios-distribution.certSigningRequest \
-  --out-dir Apple/Certificates
-```
-
-The active certificate created from this path is Apple certificate
-`3G42677598`, stored at `Apple/Certificates/ios-distribution-3G42677598.cer`.
-Its public key matches KMS key version
-`apple-ios-distribution/cryptoKeyVersions/1`.
-
-## Sparkle Appcast Signing
-
-Sparkle appcasts keep `sparkle-ed25519`, a Google KMS key with algorithm
-`EC_SIGN_ED25519` and software protection level, for small signing probes and
-future signing-service work. Google KMS rejects Ed25519 at HSM protection level
-and also rejects full-size macOS release archives as direct Ed25519 messages.
-The tester pipeline therefore signs normal Sparkle archives directly from the
-decrypted `SPARKLE_EDDSA_KEY_PATH` release seed so the appcast contains the
-standard full-archive EdDSA signature Sparkle verifies.
-
-The public EdDSA key embedded in macOS release builds is:
-
-```text
-uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=
-```
-
-The appcast signer is:
-
-```sh
-Scripts/sparkle/sign-appcast-kms.py \
-  --appcast dist/builds/<build>/sparkle/<channel>/appcast.xml \
-  --artifact-dir dist/builds/<build>/sparkle/<channel>
-```
-
-## Run
-
-```sh
-Scripts/identity-tofu.sh init -backend-config=backend.hcl
-Scripts/identity-tofu.sh plan -var-file=terraform.tfvars
-```
-
-For local syntax work without remote state:
-
-```sh
-Scripts/identity-tofu.sh init -backend=false
-Scripts/identity-tofu.sh validate
-```
-
-Start with `manage_google = false`. Import existing resources before enabling
-management, then turn on one resource group at a time.
-
-## Bootstrap Imports
-
-The first live Apple Developer ID pass may need these resources imported before
-an `identity` apply can own them:
-
-```sh
-Scripts/identity-tofu.sh import 'google_kms_key_ring.identity[0]' \
-  projects/project-88c23ce9-918a-470a-b33/locations/global/keyRings/burrow-identity
-
-Scripts/identity-tofu.sh import 'google_kms_crypto_key.signing["apple_developer_id_application"]' \
-  projects/project-88c23ce9-918a-470a-b33/locations/global/keyRings/burrow-identity/cryptoKeys/apple-developer-id-application
-
-Scripts/identity-tofu.sh import 'google_kms_crypto_key.signing["apple_ios_distribution"]' \
-  projects/project-88c23ce9-918a-470a-b33/locations/global/keyRings/burrow-identity/cryptoKeys/apple-ios-distribution
-
-Scripts/identity-tofu.sh import 'google_kms_crypto_key.signing["sparkle_ed25519"]' \
-  projects/project-88c23ce9-918a-470a-b33/locations/global/keyRings/burrow-identity/cryptoKeys/sparkle-ed25519
-
-Scripts/identity-tofu.sh import 'google_service_account.runner[0]' \
-  projects/project-88c23ce9-918a-470a-b33/serviceAccounts/burrow-forgejo-runner@project-88c23ce9-918a-470a-b33.iam.gserviceaccount.com
-```
-
-Run imports with the same `manage_google`, key-ring, and service-account
-variables that will be used for apply. Key-level IAM bindings should be imported
-after the signing keys and service account exist.
diff --git a/infra/identity/backend.hcl.example b/infra/identity/backend.hcl.example
deleted file mode 100644
index 60350e3..0000000
--- a/infra/identity/backend.hcl.example
+++ /dev/null
@@ -1,4 +0,0 @@
-bucket = "burrow-opentofu-state"
-key    = "identity/identity.tfstate"
-region = "us-west-2"
-encrypt = true
diff --git a/infra/identity/google.tf b/infra/identity/google.tf
deleted file mode 100644
index a429401..0000000
--- a/infra/identity/google.tf
+++ /dev/null
@@ -1,172 +0,0 @@
-locals {
-  google_required_services = toset([
-    "cloudkms.googleapis.com",
-    "cloudresourcemanager.googleapis.com",
-    "iam.googleapis.com",
-    "iamcredentials.googleapis.com",
-    "sts.googleapis.com",
-  ])
-
-  google_existing_kms_key_ring_id = var.google_kms_key_ring_id != "" ? var.google_kms_key_ring_id : "projects/${var.google_project_id}/locations/${var.google_kms_key_ring_location}/keyRings/${var.google_kms_key_ring_name}"
-
-  google_kms_key_ring_id = var.manage_google_kms_key_ring ? (
-    google_kms_key_ring.identity[0].id
-  ) : local.google_existing_kms_key_ring_id
-
-  google_runner_service_account_email = var.manage_google_runner_service_account ? (
-    google_service_account.runner[0].email
-  ) : var.google_runner_service_account_email
-
-  google_runner_wif_group_members = var.google_wif_runner_group != "" ? (
-    toset([
-      "principalSet://iam.googleapis.com/projects/${var.google_project_number}/locations/global/workloadIdentityPools/${var.google_wif_pool_id}/group/${var.google_wif_runner_group}"
-    ])
-    ) : (
-    toset([])
-  )
-
-  google_runner_wif_client_members = var.google_wif_runner_client_id != "" ? (
-    toset([
-      "principalSet://iam.googleapis.com/projects/${var.google_project_number}/locations/global/workloadIdentityPools/${var.google_wif_pool_id}/attribute.burrow_client_id/${var.google_wif_runner_client_id}"
-    ])
-    ) : (
-    toset([])
-  )
-
-  google_runner_wif_members = setunion(
-    local.google_runner_wif_group_members,
-    local.google_runner_wif_client_members,
-    var.google_wif_runner_group == "" && var.google_wif_runner_client_id == "" ? toset([
-      "principalSet://iam.googleapis.com/projects/${var.google_project_number}/locations/global/workloadIdentityPools/${var.google_wif_pool_id}/*"
-    ]) : toset([])
-  )
-
-  google_signer_members = setunion(
-    var.google_release_signer_members,
-    toset(["serviceAccount:${local.google_runner_service_account_email}"]),
-  )
-
-  google_signer_grants = var.manage_google ? {
-    for grant in flatten([
-      for key_name in keys(google_kms_crypto_key.signing) : [
-        for member in local.google_signer_members : {
-          id       = "${key_name}|${member}"
-          key_name = key_name
-          member   = member
-        }
-      ]
-    ]) : grant.id => grant
-  } : {}
-}
-
-resource "google_project_service" "identity" {
-  for_each = var.manage_google ? local.google_required_services : toset([])
-
-  project            = var.google_project_id
-  service            = each.value
-  disable_on_destroy = false
-}
-
-resource "google_kms_key_ring" "identity" {
-  count = var.manage_google && var.manage_google_kms_key_ring ? 1 : 0
-
-  project  = var.google_project_id
-  location = var.google_kms_key_ring_location
-  name     = var.google_kms_key_ring_name
-
-  depends_on = [google_project_service.identity]
-}
-
-resource "google_kms_crypto_key" "signing" {
-  for_each = var.manage_google && local.google_kms_key_ring_id != "" ? var.google_signing_keys : {}
-
-  name     = each.value.name
-  key_ring = local.google_kms_key_ring_id
-  purpose  = "ASYMMETRIC_SIGN"
-  labels = merge(
-    {
-      project    = "burrow"
-      component  = "identity"
-      managed_by = "opentofu"
-    },
-    var.tags,
-    try(each.value.labels, {}),
-  )
-
-  version_template {
-    algorithm        = try(each.value.algorithm, "RSA_SIGN_PKCS1_2048_SHA256")
-    protection_level = try(each.value.protection_level, "HSM")
-  }
-
-  lifecycle {
-    prevent_destroy = true
-  }
-}
-
-resource "google_service_account" "runner" {
-  count = var.manage_google && var.manage_google_runner_service_account ? 1 : 0
-
-  project      = var.google_project_id
-  account_id   = var.google_runner_service_account_id
-  display_name = "Burrow Forgejo Runner"
-  description  = "Authentik-backed WIF service account for Burrow Forgejo runners."
-
-  depends_on = [google_project_service.identity]
-}
-
-resource "google_iam_workload_identity_pool" "burrow" {
-  count = var.manage_google ? 1 : 0
-
-  project                   = var.google_project_id
-  workload_identity_pool_id = var.google_wif_pool_id
-  display_name              = "Burrow Authentik"
-  description               = "Authentik-issued identities for Burrow automation."
-  disabled                  = false
-
-  depends_on = [google_project_service.identity]
-}
-
-resource "google_iam_workload_identity_pool_provider" "forgejo_runners" {
-  count = var.manage_google ? 1 : 0
-
-  project                            = var.google_project_id
-  workload_identity_pool_id          = google_iam_workload_identity_pool.burrow[0].workload_identity_pool_id
-  workload_identity_pool_provider_id = var.google_wif_provider_id
-  display_name                       = "Burrow Forgejo Runners"
-  description                        = "Authentik OIDC provider for Burrow Forgejo runner cloud access."
-  disabled                           = false
-
-  attribute_mapping = {
-    "google.subject"             = "assertion.sub"
-    "google.groups"              = "assertion.groups"
-    "attribute.burrow_subject"   = "assertion.sub"
-    "attribute.burrow_username"  = "assertion.preferred_username"
-    "attribute.burrow_email"     = "assertion.email"
-    "attribute.burrow_client_id" = "assertion.aud"
-  }
-
-  attribute_condition = var.google_wif_attribute_condition
-
-  oidc {
-    issuer_uri        = var.google_wif_issuer_uri
-    allowed_audiences = var.google_wif_allowed_audiences
-  }
-}
-
-resource "google_service_account_iam_member" "runner_wif" {
-  for_each = var.manage_google ? local.google_runner_wif_members : toset([])
-
-  service_account_id = var.manage_google_runner_service_account ? (
-    google_service_account.runner[0].name
-  ) : "projects/${var.google_project_id}/serviceAccounts/${local.google_runner_service_account_email}"
-  role   = "roles/iam.workloadIdentityUser"
-  member = each.value
-}
-
-resource "google_kms_crypto_key_iam_member" "signer" {
-  for_each = local.google_signer_grants
-
-  crypto_key_id = google_kms_crypto_key.signing[each.value.key_name].id
-  role          = "roles/cloudkms.signerVerifier"
-  member        = each.value.member
-}
diff --git a/infra/identity/outputs.tf b/infra/identity/outputs.tf
deleted file mode 100644
index 2a0b9a0..0000000
--- a/infra/identity/outputs.tf
+++ /dev/null
@@ -1,19 +0,0 @@
-output "google_kms_key_ring_id" {
-  description = "Google KMS key ring id used by the identity stack."
-  value       = local.google_kms_key_ring_id
-}
-
-output "google_runner_service_account_email" {
-  description = "Forgejo runner service account email."
-  value       = local.google_runner_service_account_email
-}
-
-output "google_wif_pool_name" {
-  description = "Google WIF pool resource name when managed."
-  value       = try(google_iam_workload_identity_pool.burrow[0].name, null)
-}
-
-output "google_signing_key_ids" {
-  description = "Managed Google KMS signing key ids."
-  value       = { for name, key in google_kms_crypto_key.signing : name => key.id }
-}
diff --git a/infra/identity/providers.tf b/infra/identity/providers.tf
deleted file mode 100644
index 5343c2e..0000000
--- a/infra/identity/providers.tf
+++ /dev/null
@@ -1,3 +0,0 @@
-provider "google" {
-  project = var.google_project_id
-}
diff --git a/infra/identity/terraform.tfvars.example b/infra/identity/terraform.tfvars.example
deleted file mode 100644
index 7411302..0000000
--- a/infra/identity/terraform.tfvars.example
+++ /dev/null
@@ -1,15 +0,0 @@
-manage_google = false
-
-google_project_id     = "project-88c23ce9-918a-470a-b33"
-google_project_number = "416198671487"
-
-# Import the key ring before setting this true if it already exists.
-manage_google_kms_key_ring = false
-
-# Create this only after the Authentik WIF provider design is final.
-manage_google_runner_service_account = false
-
-google_wif_issuer_uri        = "https://auth.burrow.net/application/o/google-cloud/"
-google_wif_allowed_audiences = ["google-wif.burrow.net"]
-google_wif_runner_group      = ""
-google_wif_runner_client_id  = "google-wif.burrow.net"
diff --git a/infra/identity/variables.tf b/infra/identity/variables.tf
deleted file mode 100644
index 68fad72..0000000
--- a/infra/identity/variables.tf
+++ /dev/null
@@ -1,201 +0,0 @@
-variable "manage_google" {
-  description = "Manage Google Cloud identity and WIF resources."
-  type        = bool
-  default     = false
-}
-
-variable "google_project_id" {
-  description = "Google Cloud project id for Burrow identity resources."
-  type        = string
-  default     = "project-88c23ce9-918a-470a-b33"
-}
-
-variable "google_project_number" {
-  description = "Google Cloud project number for IAM principal URIs."
-  type        = string
-  default     = "416198671487"
-}
-
-variable "google_kms_key_ring_name" {
-  description = "Google KMS key ring for identity and release signing keys."
-  type        = string
-  default     = "burrow-identity"
-}
-
-variable "google_kms_key_ring_location" {
-  description = "Google KMS key ring location."
-  type        = string
-  default     = "global"
-}
-
-variable "google_kms_key_ring_id" {
-  description = "Existing Google KMS key ring id. Leave blank to derive it from project, location, and name."
-  type        = string
-  default     = ""
-}
-
-variable "manage_google_kms_key_ring" {
-  description = "Create/manage the Google KMS key ring. Import existing rings before enabling this."
-  type        = bool
-  default     = false
-}
-
-variable "google_signing_keys" {
-  description = "Non-exportable Burrow signing keys to create in the identity key ring."
-  type = map(object({
-    name             = string
-    algorithm        = optional(string, "RSA_SIGN_PKCS1_2048_SHA256")
-    protection_level = optional(string, "HSM")
-    labels           = optional(map(string), {})
-  }))
-  default = {
-    authentik = {
-      name = "authentik-signing"
-      labels = {
-        key_target = "authentik"
-      }
-    }
-    saml_ca = {
-      name = "saml-ca"
-      labels = {
-        key_target = "saml-ca"
-      }
-    }
-    release = {
-      name = "release-signing"
-      labels = {
-        key_target = "release-signing"
-      }
-    }
-    package_apt_repository = {
-      name = "package-apt-repository"
-      labels = {
-        key_target  = "package-apt-repository"
-        repo_format = "apt"
-      }
-    }
-    package_rpm_repository = {
-      name = "package-rpm-repository"
-      labels = {
-        key_target  = "package-rpm-repository"
-        repo_format = "rpm"
-      }
-    }
-    package_pacman_repository = {
-      name = "package-pacman-repository"
-      labels = {
-        key_target  = "package-pacman-repository"
-        repo_format = "pacman"
-      }
-    }
-    package_flatpak_repository = {
-      name = "package-flatpak-repository"
-      labels = {
-        key_target  = "package-flatpak-repository"
-        repo_format = "flatpak"
-      }
-    }
-    package_aur_source = {
-      name = "package-aur-source"
-      labels = {
-        key_target  = "package-aur-source"
-        repo_format = "aur"
-      }
-    }
-    apple_developer_id_application = {
-      name = "apple-developer-id-application"
-      labels = {
-        key_target      = "apple-developer-id-application"
-        apple_cert_type = "developer-id-application"
-      }
-    }
-    apple_ios_distribution = {
-      name = "apple-ios-distribution"
-      labels = {
-        key_target      = "apple-ios-distribution"
-        apple_cert_type = "ios-distribution"
-      }
-    }
-    sparkle_ed25519 = {
-      name             = "sparkle-ed25519"
-      algorithm        = "EC_SIGN_ED25519"
-      protection_level = "SOFTWARE"
-      labels = {
-        key_target      = "sparkle-ed25519"
-        release_surface = "sparkle"
-      }
-    }
-  }
-}
-
-variable "google_release_signer_members" {
-  description = "Additional IAM members allowed to sign/verify with Burrow release and package repository keys."
-  type        = set(string)
-  default     = []
-}
-
-variable "manage_google_runner_service_account" {
-  description = "Create/manage the Forgejo runner service account for WIF."
-  type        = bool
-  default     = false
-}
-
-variable "google_runner_service_account_id" {
-  description = "Google service account id for Authentik-backed Forgejo runners."
-  type        = string
-  default     = "burrow-forgejo-runner"
-}
-
-variable "google_runner_service_account_email" {
-  description = "Existing runner service account email when not managed here."
-  type        = string
-  default     = "burrow-forgejo-runner@project-88c23ce9-918a-470a-b33.iam.gserviceaccount.com"
-}
-
-variable "google_wif_pool_id" {
-  description = "Workload Identity Federation pool id for Burrow automation."
-  type        = string
-  default     = "burrow-authentik"
-}
-
-variable "google_wif_provider_id" {
-  description = "Workload Identity Federation provider id for Authentik-issued OIDC tokens."
-  type        = string
-  default     = "forgejo-runners"
-}
-
-variable "google_wif_issuer_uri" {
-  description = "Authentik OIDC issuer used by Google WIF."
-  type        = string
-  default     = "https://auth.burrow.net/application/o/google-cloud/"
-}
-
-variable "google_wif_allowed_audiences" {
-  description = "Allowed audiences for Authentik-issued WIF tokens."
-  type        = list(string)
-  default     = ["google-wif.burrow.net"]
-}
-
-variable "google_wif_runner_group" {
-  description = "Google groups principal allowed to assume the runner service account. Leave empty for machine-to-machine client credentials."
-  type        = string
-  default     = ""
-}
-
-variable "google_wif_runner_client_id" {
-  description = "Mapped Authentik OIDC audience/client value allowed to assume the runner service account for machine-to-machine CI. Empty disables this grant."
-  type        = string
-  default     = "google-wif.burrow.net"
-}
-
-variable "google_wif_attribute_condition" {
-  description = "CEL condition applied to Authentik-issued WIF tokens."
-  type        = string
-  default     = "assertion.iss == 'https://auth.burrow.net/application/o/google-cloud/'"
-}
-
-variable "tags" {
-  description = "Additional labels applied to supported Google resources."
-  type        = map(string)
-  default     = {}
-}
diff --git a/infra/identity/versions.tf b/infra/identity/versions.tf
deleted file mode 100644
index 2b6a05d..0000000
--- a/infra/identity/versions.tf
+++ /dev/null
@@ -1,12 +0,0 @@
-terraform {
-  required_version = ">= 1.8.0"
-
-  required_providers {
-    google = {
-      source  = "hashicorp/google"
-      version = ">= 5.40.0, < 7.0"
-    }
-  }
-
-  backend "s3" {}
-}
diff --git a/infra/openbao/.gitignore b/infra/openbao/.gitignore
deleted file mode 100644
index b12b9ed..0000000
--- a/infra/openbao/.gitignore
+++ /dev/null
@@ -1,5 +0,0 @@
-.terraform/
-backend.hcl
-terraform.tfstate
-terraform.tfstate.backup
-*.tfplan
diff --git a/infra/openbao/.terraform.lock.hcl b/infra/openbao/.terraform.lock.hcl
deleted file mode 100644
index ded7beb..0000000
--- a/infra/openbao/.terraform.lock.hcl
+++ /dev/null
@@ -1,43 +0,0 @@
-# This file is maintained automatically by "tofu init".
-# Manual edits may be lost in future updates.
-
-provider "registry.opentofu.org/hashicorp/google" {
-  version     = "6.50.0"
-  constraints = ">= 5.40.0, < 7.0.0"
-  hashes = [
-    "h1:MAAe4zFFdqS9M5rpmJK/vKgdb6ZMD/s/0Xd97yTDipA=",
-    "zh:1d4695f807d998f11fcdcfa174766287b82a8093513af857bcdad2d81c642480",
-    "zh:3173ac5df0294624d113812e49e2a55714aff7db617488168cecdf4168df9e29",
-    "zh:34d2b3d44c23bd6354fc4ab5917b302872ea1ab8de107034567f955b1717fa5b",
-    "zh:3a77f3cc2f3664cd5aaeeef4d044e6ec1695a079588fffec3ca03953664e5f04",
-    "zh:6b444e4b629ea8dc8cb112a39dde098dc5584d26d6de4177558f556a9a226696",
-    "zh:96545c8cd4d3a57069c5d1799eab5aedd887e16d98b5559a195f6d2c2d9bc674",
-    "zh:ba464caafde95ee16671d6b5ec90f053ed77a9d06c567456db6efd9160fa3165",
-    "zh:d876938e5b0d3f57a984d9be72467995f87fef6569968623415dc51d9f54d30b",
-    "zh:dfd908d873e314ab807d0abc9cfd42d2611cd06dc1b9ec719ebdbb738e8e68d6",
-    "zh:f9f16819a7738d564afd45fd169ba61004ec4e4e7089d2a4950cb8895be1fe1f",
-  ]
-}
-
-provider "registry.opentofu.org/hashicorp/vault" {
-  version     = "5.9.0"
-  constraints = ">= 4.5.0, < 6.0.0"
-  hashes = [
-    "h1:9U4AT36IqNYXfQMR7nf+oywulVKYua473W4NmuwVb7M=",
-    "zh:03cb46fab606872e3fc06e27f8d14b911b7a9781d0f32af335c7287a9dbe4f4f",
-    "zh:1e69677b09329b009a8791f9cbb556790fb4dbddc1360f953345259892dc6c5b",
-    "zh:4e5a3dc82e70d88f5671968b7f2217163815be259d0b26dfcc9a897409c491fa",
-    "zh:51b82b358fe52099ef29cae62e2040ae0224ceea40a7dfdf0b69de90fb0233a8",
-    "zh:60ec3477fbe712b3269eec2e4d9d5921e2e68d0861d77e11e91bea088aab27bf",
-    "zh:64e58a3e3fd61005b54d71eee792b8576ab42ea4cd711515043a3ac0d8bc7919",
-    "zh:69142fb83aff31e27f5b3d9e7afb7594013b63e490cfcef8678fd0d724609359",
-    "zh:6f2e58ba6bd41c4d9e0e752e55eb7d86104f9d786cf57fa8dc960c61b574f9ce",
-    "zh:73390b7cb186310e5aaf4a1baaa639ab0302a8da4db130b4e28ebced3ba103fe",
-    "zh:a2214b3fda93cfed89ba1a7d714fe8b015176927605b215365978efdaae1c6db",
-    "zh:b275ee0f0a63765364d2e6979e3a11464d2c2ce6d3ce9bd15b3f503aea6f12b0",
-    "zh:bb2cd553b1c589a0f6f5b0575e1b176a9d91c1b20c6375d1afd63bb2a47fd014",
-    "zh:bc38e48ae5cdb8219fef326366f46e6a25e7f77f9bbcd9bdc80c7cb960de81ed",
-    "zh:e54af55cf667759a400af07b927b5034f1733e6527f9352b84001205561dcf9e",
-    "zh:f617688ef4568c0de8a28d5e1fa3714fb2eeab9f8cf7bcf20af42a1a511844be",
-  ]
-}
diff --git a/infra/openbao/README.md b/infra/openbao/README.md
deleted file mode 100644
index bca0089..0000000
--- a/infra/openbao/README.md
+++ /dev/null
@@ -1,36 +0,0 @@
-# Burrow OpenBao Control Plane
-
-This OpenTofu stack manages non-secret infrastructure around
-`vault.burrow.net`.
-
-It may manage:
-
-- Google KMS seal-wrapping keys for OpenBao
-- the OpenBao `age/` KV v2 mount used for migrated runtime secrets
-- OpenBao policies and Authentik OIDC roles
-- AppRole auth scaffolding for machine consumers
-
-It must not manage:
-
-- secret values
-- root tokens
-- AppRole SecretIDs
-- release-signing key material
-
-## Run
-
-```sh
-Scripts/openbao-tofu.sh init -backend-config=backend.hcl
-Scripts/openbao-tofu.sh plan -var-file=terraform.tfvars
-```
-
-For local syntax work:
-
-```sh
-Scripts/openbao-tofu.sh init -backend=false
-Scripts/openbao-tofu.sh validate
-```
-
-The Vault/OpenBao provider reads `VAULT_TOKEN` from the environment. Keep
-`manage_openbao_config = false` until `vault.burrow.net` is initialized and an
-operator token is available out of band.
diff --git a/infra/openbao/backend.hcl.example b/infra/openbao/backend.hcl.example
deleted file mode 100644
index 53c6b7d..0000000
--- a/infra/openbao/backend.hcl.example
+++ /dev/null
@@ -1,4 +0,0 @@
-bucket = "burrow-opentofu-state"
-key    = "openbao/openbao.tfstate"
-region = "us-west-2"
-encrypt = true
diff --git a/infra/openbao/google.tf b/infra/openbao/google.tf
deleted file mode 100644
index 0b34f7c..0000000
--- a/infra/openbao/google.tf
+++ /dev/null
@@ -1,65 +0,0 @@
-locals {
-  google_required_services = toset([
-    "cloudkms.googleapis.com",
-    "cloudresourcemanager.googleapis.com",
-    "iam.googleapis.com",
-  ])
-
-  google_existing_kms_key_ring_id = var.google_kms_key_ring_id != "" ? var.google_kms_key_ring_id : "projects/${var.google_project_id}/locations/${var.google_kms_key_ring_location}/keyRings/${var.google_kms_key_ring_name}"
-
-  google_kms_key_ring_id = var.manage_google_kms_key_ring ? (
-    google_kms_key_ring.openbao[0].id
-  ) : local.google_existing_kms_key_ring_id
-}
-
-resource "google_project_service" "openbao" {
-  for_each = var.manage_google ? local.google_required_services : toset([])
-
-  project            = var.google_project_id
-  service            = each.value
-  disable_on_destroy = false
-}
-
-resource "google_kms_key_ring" "openbao" {
-  count = var.manage_google && var.manage_google_kms_key_ring ? 1 : 0
-
-  project  = var.google_project_id
-  location = var.google_kms_key_ring_location
-  name     = var.google_kms_key_ring_name
-
-  depends_on = [google_project_service.openbao]
-}
-
-resource "google_kms_crypto_key" "openbao_seal" {
-  count = var.manage_google && local.google_kms_key_ring_id != "" ? 1 : 0
-
-  name     = var.google_openbao_seal_key_name
-  key_ring = local.google_kms_key_ring_id
-  purpose  = "ENCRYPT_DECRYPT"
-  labels = merge(
-    {
-      project    = "burrow"
-      component  = "openbao"
-      managed_by = "opentofu"
-      key_target = "seal"
-    },
-    var.tags,
-  )
-
-  version_template {
-    algorithm        = "GOOGLE_SYMMETRIC_ENCRYPTION"
-    protection_level = "HSM"
-  }
-
-  lifecycle {
-    prevent_destroy = true
-  }
-}
-
-resource "google_kms_crypto_key_iam_member" "openbao_seal" {
-  for_each = var.manage_google && local.google_kms_key_ring_id != "" ? var.google_openbao_seal_members : toset([])
-
-  crypto_key_id = google_kms_crypto_key.openbao_seal[0].id
-  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
-  member        = each.value
-}
diff --git a/infra/openbao/openbao.tf b/infra/openbao/openbao.tf
deleted file mode 100644
index 619f50e..0000000
--- a/infra/openbao/openbao.tf
+++ /dev/null
@@ -1,125 +0,0 @@
-resource "vault_mount" "age" {
-  count = var.manage_openbao_config ? 1 : 0
-
-  path        = var.age_mount_path
-  type        = "kv-v2"
-  description = "Migrated Burrow age-managed runtime secrets."
-
-  options = {
-    version = "2"
-  }
-}
-
-resource "vault_policy" "admin" {
-  count = var.manage_openbao_config ? 1 : 0
-
-  name = "burrow-openbao-admin"
-
-  policy = <<-EOT
-    path "*" {
-      capabilities = ["create", "read", "update", "delete", "list", "sudo"]
-    }
-  EOT
-}
-
-resource "vault_policy" "runtime_read" {
-  count = var.manage_openbao_config ? 1 : 0
-
-  name = "burrow-runtime-read"
-
-  policy = <<-EOT
-    path "${var.age_mount_path}/data/*" {
-      capabilities = ["read"]
-    }
-
-    path "${var.age_mount_path}/metadata/*" {
-      capabilities = ["list", "read"]
-    }
-  EOT
-}
-
-resource "vault_auth_backend" "approle" {
-  count = var.manage_openbao_config ? 1 : 0
-
-  path        = var.approle_auth_path
-  type        = "approle"
-  description = "Machine auth for Burrow runtime secret consumers."
-
-  tune {
-    token_type = "default-service"
-  }
-}
-
-resource "vault_approle_auth_backend_role" "runtime" {
-  count = var.manage_openbao_config ? 1 : 0
-
-  backend        = vault_auth_backend.approle[0].path
-  role_name      = var.runtime_approle_role_name
-  bind_secret_id = true
-
-  token_policies = [vault_policy.runtime_read[0].name]
-  token_ttl      = var.runtime_approle_token_ttl_seconds
-  token_max_ttl  = var.runtime_approle_token_max_ttl_seconds
-  token_num_uses = 0
-
-  secret_id_ttl      = var.runtime_approle_secret_id_ttl_seconds
-  secret_id_num_uses = var.runtime_approle_secret_id_num_uses
-}
-
-resource "vault_jwt_auth_backend" "authentik" {
-  count = var.manage_openbao_config ? 1 : 0
-
-  path               = "oidc"
-  type               = "oidc"
-  oidc_discovery_url = var.authentik_issuer
-  bound_issuer       = var.authentik_issuer
-  oidc_client_id     = var.authentik_client_id
-  default_role       = "burrow-admin"
-
-  tune {
-    listing_visibility = "unauth"
-    token_type         = "default-service"
-  }
-}
-
-resource "vault_jwt_auth_backend_role" "admin" {
-  count = var.manage_openbao_config ? 1 : 0
-
-  backend    = vault_jwt_auth_backend.authentik[0].path
-  role_name  = "burrow-admin"
-  role_type  = "oidc"
-  user_claim = "email"
-
-  allowed_redirect_uris = [
-    "https://vault.burrow.net/ui/vault/auth/oidc/oidc/callback",
-    "http://localhost:8250/oidc/callback",
-  ]
-
-  bound_audiences = [var.authentik_client_id]
-  bound_claims = {
-    groups = var.authentik_admin_group
-  }
-  oidc_scopes    = ["openid", "profile", "email", "groups"]
-  token_policies = [vault_policy.admin[0].name]
-}
-
-resource "vault_jwt_auth_backend_role" "runtime" {
-  count = var.manage_openbao_config ? 1 : 0
-
-  backend    = vault_jwt_auth_backend.authentik[0].path
-  role_name  = "burrow-runtime-read"
-  role_type  = "oidc"
-  user_claim = "email"
-
-  allowed_redirect_uris = [
-    "https://vault.burrow.net/ui/vault/auth/oidc/oidc/callback",
-    "http://localhost:8250/oidc/callback",
-  ]
-
-  bound_audiences = [var.authentik_client_id]
-  bound_claims = {
-    groups = var.authentik_runtime_group
-  }
-  oidc_scopes    = ["openid", "profile", "email", "groups"]
-  token_policies = [vault_policy.runtime_read[0].name]
-}
diff --git a/infra/openbao/outputs.tf b/infra/openbao/outputs.tf
deleted file mode 100644
index 8474957..0000000
--- a/infra/openbao/outputs.tf
+++ /dev/null
@@ -1,14 +0,0 @@
-output "google_kms_key_ring_id" {
-  description = "Google KMS key ring id used by the OpenBao stack."
-  value       = local.google_kms_key_ring_id
-}
-
-output "google_openbao_seal_key_id" {
-  description = "Google KMS seal key id when managed."
-  value       = try(google_kms_crypto_key.openbao_seal[0].id, null)
-}
-
-output "openbao_age_mount_path" {
-  description = "OpenBao KV v2 mount path for migrated age secrets."
-  value       = var.age_mount_path
-}
diff --git a/infra/openbao/providers.tf b/infra/openbao/providers.tf
deleted file mode 100644
index 7e485d4..0000000
--- a/infra/openbao/providers.tf
+++ /dev/null
@@ -1,8 +0,0 @@
-provider "google" {
-  project = var.google_project_id
-}
-
-provider "vault" {
-  address         = var.openbao_address
-  skip_tls_verify = var.openbao_skip_tls_verify
-}
diff --git a/infra/openbao/terraform.tfvars.example b/infra/openbao/terraform.tfvars.example
deleted file mode 100644
index ae1a4e1..0000000
--- a/infra/openbao/terraform.tfvars.example
+++ /dev/null
@@ -1,8 +0,0 @@
-manage_google          = false
-manage_openbao_config  = false
-google_project_id      = "project-88c23ce9-918a-470a-b33"
-openbao_address        = "https://vault.burrow.net"
-authentik_issuer       = "https://auth.burrow.net/application/o/openbao/"
-authentik_client_id    = "vault.burrow.net"
-authentik_admin_group  = "burrow-admins"
-authentik_runtime_group = "burrow-automation"
diff --git a/infra/openbao/variables.tf b/infra/openbao/variables.tf
deleted file mode 100644
index 011eaa7..0000000
--- a/infra/openbao/variables.tf
+++ /dev/null
@@ -1,137 +0,0 @@
-variable "openbao_address" {
-  description = "OpenBao API address. The Vault provider reads the token from VAULT_TOKEN."
-  type        = string
-  default     = "https://vault.burrow.net"
-}
-
-variable "openbao_skip_tls_verify" {
-  description = "Skip TLS verification for local bootstrap only."
-  type        = bool
-  default     = false
-}
-
-variable "age_mount_path" {
-  description = "KV v2 mount path for migrated age-managed runtime secrets."
-  type        = string
-  default     = "age"
-}
-
-variable "manage_openbao_config" {
-  description = "Manage OpenBao mounts, policies, and Authentik OIDC auth. Requires VAULT_TOKEN."
-  type        = bool
-  default     = false
-}
-
-variable "authentik_issuer" {
-  description = "Authentik OpenBao OIDC issuer."
-  type        = string
-  default     = "https://auth.burrow.net/application/o/openbao/"
-}
-
-variable "authentik_client_id" {
-  description = "Public Authentik OpenBao OIDC client id."
-  type        = string
-  default     = "vault.burrow.net"
-}
-
-variable "authentik_admin_group" {
-  description = "Authentik group allowed to administer OpenBao."
-  type        = string
-  default     = "burrow-admins"
-}
-
-variable "authentik_runtime_group" {
-  description = "Authentik group allowed to read runtime secrets."
-  type        = string
-  default     = "burrow-automation"
-}
-
-variable "approle_auth_path" {
-  description = "OpenBao AppRole auth mount path for machine consumers."
-  type        = string
-  default     = "approle"
-}
-
-variable "runtime_approle_role_name" {
-  description = "AppRole role name used by Burrow runtime secret consumers."
-  type        = string
-  default     = "burrow-runtime"
-}
-
-variable "runtime_approle_token_ttl_seconds" {
-  description = "Token TTL for runtime AppRole login."
-  type        = number
-  default     = 3600
-}
-
-variable "runtime_approle_token_max_ttl_seconds" {
-  description = "Maximum token TTL for runtime AppRole login."
-  type        = number
-  default     = 7200
-}
-
-variable "runtime_approle_secret_id_ttl_seconds" {
-  description = "SecretID TTL for runtime AppRole. Zero means no expiry; rotate manually."
-  type        = number
-  default     = 0
-}
-
-variable "runtime_approle_secret_id_num_uses" {
-  description = "SecretID use limit for runtime AppRole. Zero means unlimited uses; rotate manually."
-  type        = number
-  default     = 0
-}
-
-variable "manage_google" {
-  description = "Manage Google Cloud KMS resources for OpenBao seal wrapping."
-  type        = bool
-  default     = false
-}
-
-variable "google_project_id" {
-  description = "Google Cloud project id for OpenBao seal wrapping."
-  type        = string
-  default     = "project-88c23ce9-918a-470a-b33"
-}
-
-variable "manage_google_kms_key_ring" {
-  description = "Create/manage the Google KMS key ring. Existing rings should be imported before enabling this."
-  type        = bool
-  default     = false
-}
-
-variable "google_kms_key_ring_name" {
-  description = "Google KMS key ring for OpenBao seal wrapping."
-  type        = string
-  default     = "burrow-identity"
-}
-
-variable "google_kms_key_ring_location" {
-  description = "Google KMS key ring location."
-  type        = string
-  default     = "global"
-}
-
-variable "google_kms_key_ring_id" {
-  description = "Existing Google KMS key ring id."
-  type        = string
-  default     = ""
-}
-
-variable "google_openbao_seal_key_name" {
-  description = "Google KMS symmetric key used for OpenBao seal wrapping."
-  type        = string
-  default     = "openbao-seal"
-}
-
-variable "google_openbao_seal_members" {
-  description = "IAM members allowed to encrypt/decrypt with the OpenBao seal key."
-  type        = set(string)
-  default     = []
-}
-
-variable "tags" {
-  description = "Additional labels applied to supported Google resources."
-  type        = map(string)
-  default     = {}
-}
diff --git a/infra/openbao/versions.tf b/infra/openbao/versions.tf
deleted file mode 100644
index 9de0722..0000000
--- a/infra/openbao/versions.tf
+++ /dev/null
@@ -1,16 +0,0 @@
-terraform {
-  required_version = ">= 1.8.0"
-
-  required_providers {
-    google = {
-      source  = "hashicorp/google"
-      version = ">= 5.40.0, < 7.0"
-    }
-    vault = {
-      source  = "hashicorp/vault"
-      version = ">= 4.5.0, < 6.0"
-    }
-  }
-
-  backend "s3" {}
-}
diff --git a/infra/releases/.gitignore b/infra/releases/.gitignore
deleted file mode 100644
index 493f814..0000000
--- a/infra/releases/.gitignore
+++ /dev/null
@@ -1,5 +0,0 @@
-.terraform/
-*.tfstate
-*.tfstate.*
-backend.hcl
-terraform.tfvars
diff --git a/infra/releases/.terraform.lock.hcl b/infra/releases/.terraform.lock.hcl
deleted file mode 100644
index 0a51a6e..0000000
--- a/infra/releases/.terraform.lock.hcl
+++ /dev/null
@@ -1,20 +0,0 @@
-# This file is maintained automatically by "tofu init".
-# Manual edits may be lost in future updates.
-
-provider "registry.opentofu.org/hashicorp/google" {
-  version     = "6.50.0"
-  constraints = ">= 5.40.0, < 7.0.0"
-  hashes = [
-    "h1:MAAe4zFFdqS9M5rpmJK/vKgdb6ZMD/s/0Xd97yTDipA=",
-    "zh:1d4695f807d998f11fcdcfa174766287b82a8093513af857bcdad2d81c642480",
-    "zh:3173ac5df0294624d113812e49e2a55714aff7db617488168cecdf4168df9e29",
-    "zh:34d2b3d44c23bd6354fc4ab5917b302872ea1ab8de107034567f955b1717fa5b",
-    "zh:3a77f3cc2f3664cd5aaeeef4d044e6ec1695a079588fffec3ca03953664e5f04",
-    "zh:6b444e4b629ea8dc8cb112a39dde098dc5584d26d6de4177558f556a9a226696",
-    "zh:96545c8cd4d3a57069c5d1799eab5aedd887e16d98b5559a195f6d2c2d9bc674",
-    "zh:ba464caafde95ee16671d6b5ec90f053ed77a9d06c567456db6efd9160fa3165",
-    "zh:d876938e5b0d3f57a984d9be72467995f87fef6569968623415dc51d9f54d30b",
-    "zh:dfd908d873e314ab807d0abc9cfd42d2611cd06dc1b9ec719ebdbb738e8e68d6",
-    "zh:f9f16819a7738d564afd45fd169ba61004ec4e4e7089d2a4950cb8895be1fe1f",
-  ]
-}
diff --git a/infra/releases/README.md b/infra/releases/README.md
deleted file mode 100644
index 7d88b13..0000000
--- a/infra/releases/README.md
+++ /dev/null
@@ -1,54 +0,0 @@
-# Burrow Release Storage
-
-This OpenTofu stack owns Google Cloud Storage buckets used as Burrow's first
-release-storage backup target.
-
-Garage is the required S3-compatible primary target. CI uses repo-owned storage
-wrappers: they upload to Garage first, then mirror to GCS unless the backup is
-explicitly disabled.
-
-The host activation point is `services.burrow.garage`, enabled by the forge
-host. It creates the initial single-node Garage layout and buckets from
-host-local runtime secrets.
-
-It may manage:
-
-- the release artifact bucket served by `releases.burrow.net`
-- the signed package repository bucket served by `packages.burrow.net`
-- the private Nix cache backup bucket for `nix.burrow.net`
-- public object-read IAM for download buckets
-- object-admin IAM for the Burrow Forgejo runner service account
-
-It must not manage:
-
-- Google service-account JSON keys
-- release signing keys
-- package repository metadata
-- DNS or CDN cutover
-
-GCS access is keyless. Forgejo jobs run `Scripts/ci/google-wif-auth.sh` to
-trade an Authentik-issued OIDC token for the Google runner service account in
-project `project-88c23ce9-918a-470a-b33`, then use `gcloud storage` against the
-managed backup buckets. The normal release path does not use rclone or Google
-service-account JSON keys.
-
-The Nix cache backup bucket defaults to private. Attic remains the public cache
-surface at `nix.burrow.net`; GCS is only a backup target for the Garage `attic`
-bucket.
-
-## Run
-
-```sh
-Scripts/releases-tofu.sh init -backend-config=backend.hcl
-Scripts/releases-tofu.sh plan -var-file=terraform.tfvars
-```
-
-For local syntax work without remote state:
-
-```sh
-Scripts/releases-tofu.sh init -backend=false
-Scripts/releases-tofu.sh validate
-```
-
-Start with `manage_google = false`. Import existing buckets before enabling
-management if they already exist.
diff --git a/infra/releases/backend.hcl.example b/infra/releases/backend.hcl.example
deleted file mode 100644
index 6f144bd..0000000
--- a/infra/releases/backend.hcl.example
+++ /dev/null
@@ -1,3 +0,0 @@
-bucket = "burrow-opentofu-state"
-key    = "releases/releases.tfstate"
-region = "us-west-2"
diff --git a/infra/releases/outputs.tf b/infra/releases/outputs.tf
deleted file mode 100644
index ebb4611..0000000
--- a/infra/releases/outputs.tf
+++ /dev/null
@@ -1,29 +0,0 @@
-output "google_release_bucket_name" {
-  description = "GCS bucket used for release artifacts."
-  value       = try(google_storage_bucket.release_storage["releases"].name, var.google_release_bucket_name)
-}
-
-output "google_package_bucket_name" {
-  description = "GCS bucket used for signed package repositories."
-  value       = try(google_storage_bucket.release_storage["packages"].name, var.google_package_bucket_name)
-}
-
-output "google_nix_cache_bucket_name" {
-  description = "GCS bucket used for Nix cache backups."
-  value       = try(google_storage_bucket.release_storage["nix-cache"].name, var.google_nix_cache_bucket_name)
-}
-
-output "google_release_bucket_uri" {
-  description = "GCS URI for release artifacts."
-  value       = "gs://${try(google_storage_bucket.release_storage["releases"].name, var.google_release_bucket_name)}"
-}
-
-output "google_package_bucket_uri" {
-  description = "GCS URI for signed package repositories."
-  value       = "gs://${try(google_storage_bucket.release_storage["packages"].name, var.google_package_bucket_name)}"
-}
-
-output "google_nix_cache_bucket_uri" {
-  description = "GCS URI for Nix cache backups."
-  value       = "gs://${try(google_storage_bucket.release_storage["nix-cache"].name, var.google_nix_cache_bucket_name)}"
-}
diff --git a/infra/releases/providers.tf b/infra/releases/providers.tf
deleted file mode 100644
index 5343c2e..0000000
--- a/infra/releases/providers.tf
+++ /dev/null
@@ -1,3 +0,0 @@
-provider "google" {
-  project = var.google_project_id
-}
diff --git a/infra/releases/storage.tf b/infra/releases/storage.tf
deleted file mode 100644
index f31f84c..0000000
--- a/infra/releases/storage.tf
+++ /dev/null
@@ -1,116 +0,0 @@
-locals {
-  google_required_services = toset([
-    "storage.googleapis.com",
-  ])
-
-  release_storage_buckets = {
-    releases = {
-      name        = var.google_release_bucket_name
-      description = "Burrow release artifacts"
-      public      = var.google_release_public_read
-    }
-    packages = {
-      name        = var.google_package_bucket_name
-      description = "Burrow signed package repositories"
-      public      = var.google_package_public_read
-    }
-    nix-cache = {
-      name        = var.google_nix_cache_bucket_name
-      description = "Burrow Nix cache backups"
-      public      = var.google_nix_cache_public_read
-    }
-  }
-
-  release_storage_writer_members = setunion(
-    var.google_release_extra_writer_members,
-    toset(["serviceAccount:${var.google_runner_service_account_email}"]),
-  )
-
-  release_storage_writer_grants = var.manage_google ? {
-    for grant in flatten([
-      for bucket_key in keys(local.release_storage_buckets) : [
-        for member in local.release_storage_writer_members : {
-          id         = "${bucket_key}|${member}"
-          bucket_key = bucket_key
-          member     = member
-        }
-      ]
-    ]) : grant.id => grant
-  } : {}
-
-  release_storage_public_grants = var.manage_google ? {
-    for bucket_key, bucket in local.release_storage_buckets : bucket_key => bucket
-    if bucket.public
-  } : {}
-}
-
-resource "google_project_service" "release_storage" {
-  for_each = var.manage_google ? local.google_required_services : toset([])
-
-  project            = var.google_project_id
-  service            = each.value
-  disable_on_destroy = false
-}
-
-resource "google_storage_bucket" "release_storage" {
-  for_each = var.manage_google ? local.release_storage_buckets : {}
-
-  project                     = var.google_project_id
-  name                        = each.value.name
-  location                    = var.google_storage_location
-  uniform_bucket_level_access = true
-  public_access_prevention    = each.value.public ? "inherited" : "enforced"
-  force_destroy               = false
-
-  labels = merge(
-    {
-      project    = "burrow"
-      component  = "release-storage"
-      managed_by = "opentofu"
-      bucket     = each.key
-    },
-    var.tags,
-  )
-
-  versioning {
-    enabled = true
-  }
-
-  cors {
-    origin          = var.google_storage_cors_origins
-    method          = ["GET", "HEAD", "OPTIONS"]
-    response_header = ["Content-Type", "Content-Length", "ETag", "Cache-Control"]
-    max_age_seconds = 3600
-  }
-
-  lifecycle_rule {
-    condition {
-      age                   = 30
-      with_state            = "ARCHIVED"
-      num_newer_versions    = 5
-      matches_storage_class = ["STANDARD"]
-    }
-
-    action {
-      type = "Delete"
-    }
-  }
-
-  depends_on = [google_project_service.release_storage]
-}
-
-resource "google_storage_bucket_iam_member" "release_storage_public_viewer" {
-  for_each = local.release_storage_public_grants
-
-  bucket = google_storage_bucket.release_storage[each.key].name
-  role   = "roles/storage.objectViewer"
-  member = "allUsers"
-}
-
-resource "google_storage_bucket_iam_member" "release_storage_writer" {
-  for_each = local.release_storage_writer_grants
-
-  bucket = google_storage_bucket.release_storage[each.value.bucket_key].name
-  role   = "roles/storage.objectAdmin"
-  member = each.value.member
-}
diff --git a/infra/releases/terraform.tfvars.example b/infra/releases/terraform.tfvars.example
deleted file mode 100644
index 59bd1e3..0000000
--- a/infra/releases/terraform.tfvars.example
+++ /dev/null
@@ -1,12 +0,0 @@
-manage_google = false
-
-google_project_id                    = "project-88c23ce9-918a-470a-b33"
-google_storage_location              = "US"
-google_runner_service_account_email  = "burrow-forgejo-runner@project-88c23ce9-918a-470a-b33.iam.gserviceaccount.com"
-google_release_bucket_name           = "burrow-net-releases"
-google_package_bucket_name           = "burrow-net-packages"
-google_nix_cache_bucket_name         = "burrow-net-nix-cache"
-google_release_public_read           = true
-google_package_public_read           = true
-google_nix_cache_public_read         = false
-google_release_extra_writer_members  = []
diff --git a/infra/releases/variables.tf b/infra/releases/variables.tf
deleted file mode 100644
index c1c8d4a..0000000
--- a/infra/releases/variables.tf
+++ /dev/null
@@ -1,81 +0,0 @@
-variable "manage_google" {
-  description = "Manage Google Cloud release storage resources."
-  type        = bool
-  default     = false
-}
-
-variable "google_project_id" {
-  description = "Google Cloud project id for Burrow release storage."
-  type        = string
-  default     = "project-88c23ce9-918a-470a-b33"
-}
-
-variable "google_storage_location" {
-  description = "Google Cloud Storage bucket location for release, package, and cache backup buckets."
-  type        = string
-  default     = "US"
-}
-
-variable "google_runner_service_account_email" {
-  description = "Forgejo runner service account email allowed to publish release, package, and cache backup objects."
-  type        = string
-  default     = "burrow-forgejo-runner@project-88c23ce9-918a-470a-b33.iam.gserviceaccount.com"
-}
-
-variable "google_release_bucket_name" {
-  description = "GCS bucket for release artifacts served by releases.burrow.net."
-  type        = string
-  default     = "burrow-net-releases"
-}
-
-variable "google_package_bucket_name" {
-  description = "GCS bucket for signed package repositories served by packages.burrow.net."
-  type        = string
-  default     = "burrow-net-packages"
-}
-
-variable "google_nix_cache_bucket_name" {
-  description = "GCS backup bucket for the Garage-backed Burrow Nix cache."
-  type        = string
-  default     = "burrow-net-nix-cache"
-}
-
-variable "google_release_public_read" {
-  description = "Grant allUsers objectViewer on the release artifact bucket."
-  type        = bool
-  default     = true
-}
-
-variable "google_package_public_read" {
-  description = "Grant allUsers objectViewer on the package repository bucket."
-  type        = bool
-  default     = true
-}
-
-variable "google_nix_cache_public_read" {
-  description = "Grant allUsers objectViewer on the Nix cache backup bucket."
-  type        = bool
-  default     = false
-}
-
-variable "google_release_extra_writer_members" {
-  description = "Additional IAM members allowed to write release, repository, and cache backup objects."
-  type        = set(string)
-  default     = []
-}
-
-variable "google_storage_cors_origins" {
-  description = "Allowed origins for public release/package downloads."
-  type        = list(string)
-  default = [
-    "https://burrow.net",
-    "https://releases.burrow.net",
-    "https://packages.burrow.net",
-  ]
-}
-
-variable "tags" {
-  description = "Additional labels applied to supported Google resources."
-  type        = map(string)
-  default     = {}
-}
diff --git a/infra/releases/versions.tf b/infra/releases/versions.tf
deleted file mode 100644
index 2b6a05d..0000000
--- a/infra/releases/versions.tf
+++ /dev/null
@@ -1,12 +0,0 @@
-terraform {
-  required_version = ">= 1.8.0"
-
-  required_providers {
-    google = {
-      source  = "hashicorp/google"
-      version = ">= 5.40.0, < 7.0"
-    }
-  }
-
-  backend "s3" {}
-}
diff --git a/nixos/README.md b/nixos/README.md
deleted file mode 100644
index c37a75b..0000000
--- a/nixos/README.md
+++ /dev/null
@@ -1,64 +0,0 @@
-# Burrow Forge Runbook
-
-This directory contains the Burrow forge host definition and the Hetzner bootstrap shape for `burrow-forge`.
-
-Mail hosting is intentionally not part of this NixOS host in the current plan. Burrow's first mail path is Forward Email with Burrow-owned custom S3 backups; see [`docs/FORWARDEMAIL.md`](../docs/FORWARDEMAIL.md). `inbox.burrow.net` remains the planned webmail surface for the later Stalwart phase.
-
-## Files
-
-- `hosts/burrow-forge/default.nix`: host entrypoint
-- `modules/burrow-forge.nix`: Forgejo, Caddy, PostgreSQL, and admin bootstrap module
-- `modules/burrow-forge-runner.nix`: Forgejo Actions runner and agent identity bootstrap
-- upstream `compatible.systems/conrad/nsc-autoscaler`: Namespace-backed ephemeral Forgejo runner module consumed via the Burrow flake input
-- `modules/burrow-authentik.nix`: minimal Authentik IdP for Burrow control planes
-- `modules/burrow-headscale.nix`: Headscale control plane rooted in Authentik OIDC
-- `../secrets.nix`: agenix recipient map for tracked Burrow forge secrets
-- `hetzner-cloud-config.yaml`: desired Hetzner host shape
-- `keys/contact_at_burrow_net.pub`: initial operator SSH public key
-- `keys/agent_at_burrow_net.pub`: automation SSH public key
-- `../Scripts/hetzner-forge.sh`: Hetzner inventory and replace workflow
-- `../Scripts/nsc-build-and-upload-image.sh`: temporary Namespace builder -> raw image -> Hetzner snapshot
-- `../Scripts/bootstrap-forge-intake.sh`: copy the Forgejo bootstrap password and agent SSH key into `/var/lib/burrow/intake/`
-- `../Scripts/check-forge-host.sh`: verify Forgejo, Caddy, the local runner, optional NSC services, and optional Tailnet services after boot
-- `../Scripts/grafana-tofu.sh`: manage Grafana API-created folders and dashboards with OpenTofu
-- `../Scripts/cloudflare-upsert-a-record.sh`: upsert DNS-only Cloudflare `A` records for Burrow host cutovers
-- `../Scripts/forge-deploy.sh`: remote `nixos-rebuild` entrypoint for the forge host
-- `../Scripts/provision-forgejo-nsc.sh`: render Burrow Namespace dispatcher/autoscaler runtime inputs and ensure the default Forgejo scope exists
-- `../Scripts/seal-forgejo-nsc-secrets.sh`: encrypt forgejo-nsc runtime inputs into the agenix secrets consumed by `burrow-forge`
-
-## Intended Flow
-
-1. Build and upload the raw NixOS image with `Scripts/hetzner-forge.sh build-image` or `Scripts/nsc-build-and-upload-image.sh`.
-2. Recreate `burrow-forge` from the latest labeled snapshot with `Scripts/hetzner-forge.sh recreate-from-image --yes`.
-3. Run `Scripts/bootstrap-forge-intake.sh` to place the Forgejo bootstrap password file and automation SSH key under `/var/lib/burrow/intake/`.
-4. Let `burrow-forgejo-bootstrap.service` create or rotate the initial Forgejo admin account.
-5. Let `burrow-forgejo-runner-bootstrap.service` register the self-hosted Forgejo runner and seed Git identity as `agent <agent@burrow.net>`.
-6. Run `Scripts/provision-forgejo-nsc.sh` locally to refresh `intake/forgejo_nsc_token.txt`, `intake/forgejo_nsc_dispatcher.yaml`, and `intake/forgejo_nsc_autoscaler.yaml`.
-7. Run `Scripts/seal-forgejo-nsc-secrets.sh` to encrypt those runtime inputs into the agenix secrets used by `burrow-forge`.
-8. Ensure `/var/lib/agenix/agenix.key` exists on the host, encrypt `secrets/infra/authentik.env.age`, `secrets/infra/authentik-google-client-id.age`, `secrets/infra/authentik-google-client-secret.age`, `secrets/infra/forgejo-oidc-client-secret.age`, `secrets/infra/grafana-admin-password.age`, `secrets/infra/grafana-oidc-client-secret.age`, `secrets/infra/headscale-oidc-client-secret.age`, `secrets/infra/forgejo-nsc-token.age`, `secrets/infra/forgejo-nsc-dispatcher-config.age`, and `secrets/infra/forgejo-nsc-autoscaler-config.age`, and let agenix materialize them under `/run/agenix/`.
-9. Use `Scripts/cloudflare-upsert-a-record.sh` to point `git.burrow.net`, `burrow.net`, `auth.burrow.net`, `ts.burrow.net`, `graphs.burrow.net`, and `nsc-autoscaler.burrow.net` at the host with Cloudflare proxying disabled for ACME.
-10. Use `Scripts/forge-deploy.sh --allow-dirty` for subsequent remote `nixos-rebuild` runs from the live workspace.
-11. Rotate `secrets/infra/grafana-oidc-client-secret.age` from its pending placeholder, deploy, and let `burrow-authentik-grafana-oidc.service` reconcile the Authentik client.
-12. Validate Grafana API-managed dashboards with `Scripts/grafana-tofu.sh init -backend=false` and `Scripts/grafana-tofu.sh validate`; use `.forgejo/workflows/infra-opentofu.yml` for planned dashboard apply/import.
-13. Configure Forward Email custom S3 backups for `burrow.net` and `burrow.rs` out-of-band with `Tools/forwardemail-custom-s3.sh`.
-14. Keep `services.burrow.openbao` and `services.burrow.jitsi` disabled until their DNS, secret, rollback, and live-service checks in BEP-0010 are complete.
-
-## Current Constraints
-
-- `burrow-forge` is live on NixOS in `hel1` at `89.167.47.21`.
-- `services.forgejo-nsc` now expects agenix-backed runtime inputs at `/run/agenix/burrowForgejoNscToken`, `/run/agenix/burrowForgejoNscDispatcherConfig`, and `/run/agenix/burrowForgejoNscAutoscalerConfig`.
-- Authentik, Grafana, and Headscale secrets now live in tracked agenix blobs under `secrets/infra/` and decrypt to `/run/agenix/` on the forge host.
-- Public Burrow forge cutover completed on March 15, 2026:
-  - `burrow.net`, `git.burrow.net`, and `nsc-autoscaler.burrow.net` now publish public `A` records to `89.167.47.21`; `graphs.burrow.net` should be pointed there before Grafana public cutover
-  - HTTP redirects to HTTPS on all three names
-  - `https://burrow.net` returns the root forge landing response
-  - `https://git.burrow.net` returns the live Forgejo front door
-  - `https://nsc-autoscaler.burrow.net` terminates TLS on Caddy and returns the expected application-level `404` for `/`
-- The Cloudflare token currently in `intake/cloudflare-token.txt` is an account-scoped token: `POST /accounts/<account>/tokens/verify` succeeds, while `POST /user/tokens/verify` returns `Invalid API Token`.
-- `burrow.rs` still resolves publicly to a Vercel `DEPLOYMENT_NOT_FOUND` response.
-- Both domains publish Forward Email MX/TXT records.
-- Forward Email custom S3 is live on both domains against the Hetzner `burrow` bucket and the public regional endpoint `https://hel1.your-objectstorage.com`.
-- The current Hetzner account contains both:
-  - the older Ubuntu bootstrap server in `hil`
-  - the live `burrow-forge` NixOS server in `hel1`
-- The remaining forge work is follow-on product/integration work, not host bring-up, mail backup wiring, or public DNS cutover.
diff --git a/nixos/hetzner-cloud-config.yaml b/nixos/hetzner-cloud-config.yaml
deleted file mode 100644
index 7334b3a..0000000
--- a/nixos/hetzner-cloud-config.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-name: burrow-forge
-server_type: ccx23
-location: hel1
-image: ubuntu-24.04
-ssh_keys:
-  - contact@burrow.net
-  - agent@burrow.net
-labels:
-  project: burrow
-  role: forge
diff --git a/nixos/hosts/burrow-forge/default.nix b/nixos/hosts/burrow-forge/default.nix
deleted file mode 100644
index a4f71f8..0000000
--- a/nixos/hosts/burrow-forge/default.nix
+++ /dev/null
@@ -1,416 +0,0 @@
-{ config, lib, pkgs, self, ... }:
-
-let
-  contributors = import ../../../contributors.nix;
-  identities = contributors.identities;
-  linearGroups = contributors.groups.linear;
-  stripNewline = value: lib.replaceStrings [ "\n" ] [ "" ] value;
-  authentikPasswordSecretPath = identity:
-    if identity ? authentikPasswordSecret
-    then config.age.secrets.${identity.authentikPasswordSecret}.path
-    else null;
-  bootstrapUsers = lib.mapAttrsToList
-    (
-      username: identity: {
-        inherit username;
-        name = identity.displayName;
-        email = identity.canonicalEmail;
-        isAdmin = identity.isAdmin or false;
-        groups = lib.optionals (identity.isAdmin or false) [ linearGroups.owners ];
-        passwordFile = authentikPasswordSecretPath identity;
-      }
-    )
-    (lib.filterAttrs (_: identity: identity.bootstrapAuthentik or false) identities);
-  headscaleBootstrapUsers = lib.mapAttrsToList
-    (
-      username: identity: {
-        name = username;
-        displayName = identity.displayName;
-        email = identity.canonicalEmail;
-      }
-    )
-    (lib.filterAttrs (_: identity: identity.bootstrapAuthentik or false) identities);
-  forgeUnixUsernames =
-    builtins.attrNames (lib.filterAttrs (_: identity: identity.forgeUnixUser or false) identities);
-  forgeUnixUsers = lib.genAttrs forgeUnixUsernames (username:
-    let
-      identity = identities.${username};
-      sshKeys = lib.optional (identity ? sshPublicKeyPath) (stripNewline (builtins.readFile identity.sshPublicKeyPath));
-    in
-    {
-      isNormalUser = true;
-      createHome = true;
-      home = "/home/${username}";
-      shell = pkgs.bashInteractive;
-      extraGroups = lib.optional (identity.isAdmin or false) "wheel";
-      openssh.authorizedKeys.keys = sshKeys;
-    });
-  forgeUnixAdminUsernames =
-    builtins.attrNames (lib.filterAttrs (_: identity: (identity.forgeUnixUser or false) && (identity.isAdmin or false)) identities);
-  forgeAuthorizedKeys = map
-    (username: builtins.readFile identities.${username}.sshPublicKeyPath)
-    (builtins.attrNames (lib.filterAttrs (_: identity: identity.forgeAuthorized or false) identities));
-  forgejoNscMaterializeTokenCache = ''
-    install -d -m 700 -o forgejo-nsc -g forgejo-nsc /var/lib/forgejo-nsc/.config/ns
-    ${pkgs.python3}/bin/python3 - <<'PY'
-import json
-from pathlib import Path
-
-raw = Path("/var/lib/forgejo-nsc/nsc.token").read_text(encoding="utf-8").strip()
-if not raw:
-    raise SystemExit("empty Namespace token")
-if raw.startswith("{"):
-    data = json.loads(raw)
-    if "bearer_token" not in data and "session_token" not in data:
-        raise SystemExit("Namespace token JSON must contain bearer_token or session_token")
-else:
-    data = {"session_token": raw}
-Path("/var/lib/forgejo-nsc/.config/ns/token.json").write_text(
-    json.dumps(data) + "\n",
-    encoding="utf-8",
-)
-PY
-    chown forgejo-nsc:forgejo-nsc /var/lib/forgejo-nsc/.config/ns/token.json
-    chmod 600 /var/lib/forgejo-nsc/.config/ns/token.json
-  '';
-in
-
-{
-  imports = [
-    ./hardware-configuration.nix
-    ./disko-config.nix
-    self.nixosModules.burrow-forge
-    self.nixosModules.burrow-forge-runner
-    self.nixosModules.burrow-forgejo-nsc
-    self.nixosModules.burrow-authentik
-    self.nixosModules.burrow-garage
-    self.nixosModules.burrow-headscale
-    self.nixosModules.burrow-nix-cache
-    self.nixosModules.burrow-observability
-    self.nixosModules.burrow-zulip
-    self.nixosModules.burrow-openbao
-    self.nixosModules.burrow-jitsi
-  ];
-
-  system.stateVersion = "24.11";
-
-  time.timeZone = "America/Los_Angeles";
-
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
-
-  users.users = forgeUnixUsers;
-
-  security.sudo.extraRules = lib.map (username: {
-    users = [ username ];
-    commands = [
-      {
-        command = "ALL";
-        options = [ "NOPASSWD" ];
-      }
-    ];
-  }) forgeUnixAdminUsernames;
-
-  environment.systemPackages = lib.optionals config.services.forgejo-nsc.enable [
-    self.packages.${pkgs.stdenv.hostPlatform.system}.nsc
-  ];
-
-  age.identityPaths = [ "/var/lib/agenix/agenix.key" ];
-  age.secrets.burrowAuthentikEnv = {
-    file = ../../../secrets/infra/authentik.env.age;
-    owner = "root";
-    group = "root";
-    mode = "0400";
-  };
-  age.secrets.burrowHeadscaleOidcClientSecret = {
-    file = ../../../secrets/infra/headscale-oidc-client-secret.age;
-    owner = "root";
-    group = "root";
-    mode = "0400";
-  };
-  age.secrets.burrowForgejoOidcClientSecret = {
-    file = ../../../secrets/infra/forgejo-oidc-client-secret.age;
-    owner = "forgejo";
-    group = "forgejo";
-    mode = "0440";
-  };
-  age.secrets.burrowGrafanaAdminPassword = {
-    file = ../../../secrets/infra/grafana-admin-password.age;
-    owner = "grafana";
-    group = "grafana";
-    mode = "0400";
-  };
-  age.secrets.burrowGrafanaSecretKey = {
-    file = ../../../secrets/infra/grafana-secret-key.age;
-    owner = "grafana";
-    group = "grafana";
-    mode = "0400";
-  };
-  age.secrets.burrowGrafanaOidcClientSecret = {
-    file = ../../../secrets/infra/grafana-oidc-client-secret.age;
-    owner = "grafana";
-    group = "grafana";
-    mode = "0400";
-  };
-  age.secrets.burrowTailscaleOidcClientSecret = {
-    file = ../../../secrets/infra/tailscale-oidc-client-secret.age;
-    owner = "root";
-    group = "root";
-    mode = "0400";
-  };
-  age.secrets.burrowLinearScimToken = {
-    file = ../../../secrets/infra/linear-scim-token.age;
-    owner = "root";
-    group = "root";
-    mode = "0400";
-  };
-  age.secrets.burrowAuthentikGoogleClientId = {
-    file = ../../../secrets/infra/authentik-google-client-id.age;
-    owner = "root";
-    group = "root";
-    mode = "0400";
-  };
-  age.secrets.burrowAuthentikGoogleClientSecret = {
-    file = ../../../secrets/infra/authentik-google-client-secret.age;
-    owner = "root";
-    group = "root";
-    mode = "0400";
-  };
-  age.secrets.burrowAuthentikGoogleAccountMap = {
-    file = ../../../secrets/infra/authentik-google-account-map.json.age;
-    owner = "root";
-    group = "root";
-    mode = "0400";
-  };
-  age.secrets.burrowAuthentikGoogleWifClientSecret = {
-    file = ../../../secrets/infra/authentik-google-wif-client-secret.age;
-    owner = "root";
-    group = "root";
-    mode = "0400";
-  };
-  age.secrets.burrowAuthentikUiTestPassword = {
-    file = ../../../secrets/infra/authentik-ui-test-password.age;
-    owner = "root";
-    group = "root";
-    mode = "0400";
-  };
-  age.secrets.burrowForgejoNscToken = {
-    file = ../../../secrets/infra/forgejo-nsc-token.age;
-    owner = "forgejo-nsc";
-    group = "forgejo-nsc";
-    mode = "0400";
-  };
-  age.secrets.burrowForgejoNscDispatcherConfig = {
-    file = ../../../secrets/infra/forgejo-nsc-dispatcher-config.age;
-    owner = "forgejo-nsc";
-    group = "forgejo-nsc";
-    mode = "0400";
-  };
-  age.secrets.burrowForgejoNscAutoscalerConfig = {
-    file = ../../../secrets/infra/forgejo-nsc-autoscaler-config.age;
-    owner = "forgejo-nsc";
-    group = "forgejo-nsc";
-    mode = "0400";
-  };
-
-  age.secrets.burrowZulipPostgresPassword = {
-    file = ../../../secrets/infra/zulip-postgres-password.age;
-    owner = "root";
-    group = "root";
-    mode = "0400";
-  };
-
-  age.secrets.burrowZulipRabbitmqPassword = {
-    file = ../../../secrets/infra/zulip-rabbitmq-password.age;
-    owner = "root";
-    group = "root";
-    mode = "0400";
-  };
-
-  age.secrets.burrowZulipRedisPassword = {
-    file = ../../../secrets/infra/zulip-redis-password.age;
-    owner = "root";
-    group = "root";
-    mode = "0400";
-  };
-
-  age.secrets.burrowZulipSecretKey = {
-    file = ../../../secrets/infra/zulip-secret-key.age;
-    owner = "root";
-    group = "root";
-    mode = "0400";
-  };
-
-  networking.extraHosts = ''
-    127.0.0.1 burrow.net git.burrow.net auth.burrow.net ts.burrow.net chat.burrow.net graphs.burrow.net vault.burrow.net meet.burrow.net inbox.burrow.net nsc-autoscaler.burrow.net
-    ::1 burrow.net git.burrow.net auth.burrow.net ts.burrow.net chat.burrow.net graphs.burrow.net vault.burrow.net meet.burrow.net inbox.burrow.net nsc-autoscaler.burrow.net
-  '';
-
-  services.burrow.forge = {
-    enable = true;
-    contactEmail = identities.contact.canonicalEmail;
-    adminUsername = "contact";
-    adminEmail = identities.contact.canonicalEmail;
-    adminPasswordFile = "/var/lib/burrow/intake/forgejo_pass_contact_at_burrow_net.txt";
-    oidcAdminGroup = contributors.groups.admins;
-    oidcRestrictedGroup = contributors.groups.users;
-    oidcClientSecretFile = config.age.secrets.burrowForgejoOidcClientSecret.path;
-    authorizedKeys = forgeAuthorizedKeys;
-  };
-
-  services.burrow.forgeRunner = {
-    enable = true;
-    sshPrivateKeyFile = "/var/lib/burrow/intake/agent_at_burrow_net_ed25519";
-    labels = [
-      "self-hosted"
-      "linux"
-      "x86_64"
-      "burrow-forge"
-    ];
-  };
-
-  services.forgejo-nsc = {
-    enable = true;
-    nscPackage = self.packages.${pkgs.stdenv.hostPlatform.system}.nsc;
-    nscTokenFile = config.age.secrets.burrowForgejoNscToken.path;
-    dispatcher = {
-      package = self.packages.${pkgs.stdenv.hostPlatform.system}.forgejo-nsc-dispatcher;
-      configFile = config.age.secrets.burrowForgejoNscDispatcherConfig.path;
-    };
-    autoscaler = {
-      enable = true;
-      package = self.packages.${pkgs.stdenv.hostPlatform.system}.forgejo-nsc-autoscaler;
-      configFile = config.age.secrets.burrowForgejoNscAutoscalerConfig.path;
-    };
-  };
-
-  systemd.services.forgejo-nsc-dispatcher.preStart = lib.mkAfter forgejoNscMaterializeTokenCache;
-  systemd.services.forgejo-nsc-autoscaler.preStart = lib.mkAfter forgejoNscMaterializeTokenCache;
-
-  services.burrow.authentik = {
-    enable = true;
-    envFile = config.age.secrets.burrowAuthentikEnv.path;
-    forgejoClientSecretFile = config.age.secrets.burrowForgejoOidcClientSecret.path;
-    grafanaClientSecretFile = config.age.secrets.burrowGrafanaOidcClientSecret.path;
-    grafanaAccessGroupName = contributors.groups.users;
-    headscaleClientSecretFile = config.age.secrets.burrowHeadscaleOidcClientSecret.path;
-    tailscaleClientSecretFile = config.age.secrets.burrowTailscaleOidcClientSecret.path;
-    defaultExternalApplicationSlug = "tailscale";
-    googleClientIDFile = config.age.secrets.burrowAuthentikGoogleClientId.path;
-    googleClientSecretFile = config.age.secrets.burrowAuthentikGoogleClientSecret.path;
-    googleAccountMapFile = config.age.secrets.burrowAuthentikGoogleAccountMap.path;
-    googleWifClientSecretFile = config.age.secrets.burrowAuthentikGoogleWifClientSecret.path;
-    googleLoginMode = "redirect";
-    userGroupName = contributors.groups.users;
-    adminGroupName = contributors.groups.admins;
-    extraGroupNames = [ contributors.groups.automation ];
-    tailscaleAccessGroupName = contributors.groups.users;
-    bootstrapUsers = bootstrapUsers;
-    linearAcsUrl = "https://api.linear.app/auth/sso/d0ca13dc-ac41-4824-8aab-e0ca352fc3de/acs";
-    linearAudience = "https://auth.linear.app/sso/d0ca13dc-ac41-4824-8aab-e0ca352fc3de";
-    linearDefaultRelayState = "https://linear.app/auth/sso/d0ca13dc-ac41-4824-8aab-e0ca352fc3de";
-    linearScimUrl = "https://api.linear.app/auth/scim/d0ca13dc-ac41-4824-8aab-e0ca352fc3de";
-    linearScimTokenFile = config.age.secrets.burrowLinearScimToken.path;
-    linearScimUserIdentifier = "email";
-    linearOwnerGroupName = linearGroups.owners;
-    linearAdminGroupName = linearGroups.admins;
-    linearGuestGroupName = linearGroups.guests;
-    zulipAccessGroupName = contributors.groups.users;
-  };
-
-  services.grafana = {
-    enable = true;
-    settings = {
-      server = {
-        domain = "graphs.burrow.net";
-        root_url = "https://graphs.burrow.net/";
-        http_addr = "127.0.0.1";
-        http_port = 3001;
-        enforce_domain = true;
-      };
-      analytics = {
-        reporting_enabled = false;
-        check_for_updates = false;
-        check_for_plugin_updates = false;
-      };
-      security = {
-        admin_user = "admin";
-        admin_password = "$__file{${config.age.secrets.burrowGrafanaAdminPassword.path}}";
-        secret_key = "$__file{${config.age.secrets.burrowGrafanaSecretKey.path}}";
-        cookie_secure = true;
-        cookie_samesite = "strict";
-        disable_gravatar = true;
-      };
-      users = {
-        allow_sign_up = false;
-        auto_assign_org = true;
-        auto_assign_org_role = "Viewer";
-      };
-      auth = {
-        disable_login_form = false;
-        oauth_auto_login = false;
-      };
-      "auth.generic_oauth" = {
-        enabled = true;
-        name = "burrow.net";
-        allow_sign_up = true;
-        auto_login = true;
-        client_id = "graphs.burrow.net";
-        client_secret = "$__file{${config.age.secrets.burrowGrafanaOidcClientSecret.path}}";
-        scopes = "openid profile email groups";
-        auth_url = "https://auth.burrow.net/application/o/grafana/authorize/";
-        token_url = "https://auth.burrow.net/application/o/grafana/token/";
-        api_url = "https://auth.burrow.net/application/o/grafana/userinfo/";
-        role_attribute_path = "contains(groups[*], 'burrow-admins') && 'Admin' || 'Viewer'";
-      };
-    };
-  };
-
-  services.caddy.virtualHosts."graphs.burrow.net".extraConfig = ''
-    encode gzip zstd
-    reverse_proxy 127.0.0.1:3001
-  '';
-
-  services.caddy.virtualHosts."releases.burrow.net".extraConfig = ''
-    encode gzip zstd
-    rewrite * /burrow-net-releases{uri}
-    reverse_proxy https://storage.googleapis.com {
-      header_up Host storage.googleapis.com
-    }
-  '';
-
-  services.caddy.virtualHosts."packages.burrow.net".extraConfig = ''
-    encode gzip zstd
-    rewrite * /burrow-net-packages{uri}
-    reverse_proxy https://storage.googleapis.com {
-      header_up Host storage.googleapis.com
-    }
-  '';
-
-  services.burrow.headscale = {
-    enable = true;
-    oidcClientSecretFile = config.age.secrets.burrowHeadscaleOidcClientSecret.path;
-    bootstrapUsers = headscaleBootstrapUsers;
-  };
-
-  services.burrow.garage = {
-    enable = true;
-    enableApiProxy = true;
-    enableWebProxy = true;
-  };
-
-  services.burrow.nixCache.enable = true;
-
-  services.burrow.observability.enable = true;
-
-  services.burrow.zulip = {
-    enable = true;
-    administratorEmail = identities.contact.canonicalEmail;
-    postgresPasswordFile = config.age.secrets.burrowZulipPostgresPassword.path;
-    rabbitmqPasswordFile = config.age.secrets.burrowZulipRabbitmqPassword.path;
-    redisPasswordFile = config.age.secrets.burrowZulipRedisPassword.path;
-    secretKeyFile = config.age.secrets.burrowZulipSecretKey.path;
-  };
-}
diff --git a/nixos/hosts/burrow-forge/disko-config.nix b/nixos/hosts/burrow-forge/disko-config.nix
deleted file mode 100644
index d001422..0000000
--- a/nixos/hosts/burrow-forge/disko-config.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ lib, ... }:
-
-{
-  disko.devices = {
-    disk.main = {
-      type = "disk";
-      device = lib.mkDefault "/dev/sda";
-      imageName = "burrow-forge";
-      imageSize = "80G";
-      content = {
-        type = "gpt";
-        partitions = {
-          ESP = {
-            size = "512M";
-            type = "EF00";
-            content = {
-              type = "filesystem";
-              format = "vfat";
-              mountpoint = "/boot";
-              mountOptions = [ "umask=0077" ];
-            };
-          };
-
-          root = {
-            size = "100%";
-            content = {
-              type = "filesystem";
-              format = "ext4";
-              mountpoint = "/";
-            };
-          };
-        };
-      };
-    };
-  };
-}
diff --git a/nixos/hosts/burrow-forge/hardware-configuration.nix b/nixos/hosts/burrow-forge/hardware-configuration.nix
deleted file mode 100644
index 27490e4..0000000
--- a/nixos/hosts/burrow-forge/hardware-configuration.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ ... }:
-
-{
-  # Derived from Hetzner Cloud rescue-mode hardware inspection.
-  boot.initrd.availableKernelModules = [
-    "ahci"
-    "sd_mod"
-    "virtio_pci"
-    "virtio_scsi"
-  ];
-}
diff --git a/nixos/keys/agent_at_burrow_net.pub b/nixos/keys/agent_at_burrow_net.pub
deleted file mode 100644
index de447b8..0000000
--- a/nixos/keys/agent_at_burrow_net.pub
+++ /dev/null
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEN0+tRJy7Y2DW0uGYHb86N2t02WyU5lDNX6FaxBF/G8 agent@burrow.net
diff --git a/nixos/keys/contact_at_burrow_net.pub b/nixos/keys/contact_at_burrow_net.pub
deleted file mode 100644
index 0daa6a3..0000000
--- a/nixos/keys/contact_at_burrow_net.pub
+++ /dev/null
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO42guJ5QvNMw3k6YKWlQnjcTsc+X4XI9F2GBtl8aHOa
diff --git a/nixos/keys/jett_at_burrow_net.pub b/nixos/keys/jett_at_burrow_net.pub
deleted file mode 100644
index 36c85ee..0000000
--- a/nixos/keys/jett_at_burrow_net.pub
+++ /dev/null
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMe960j6TC869F6RvElpICxlBauIT3E0uLyy0m7n70ZC
diff --git a/nixos/modules/burrow-authentik.nix b/nixos/modules/burrow-authentik.nix
deleted file mode 100644
index a96ece8..0000000
--- a/nixos/modules/burrow-authentik.nix
+++ /dev/null
@@ -1,1243 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.services.burrow.authentik;
-  runtimeDir = "/run/burrow-authentik";
-  envFile = "${runtimeDir}/authentik.env";
-  blueprintDir = "${runtimeDir}/blueprints";
-  blueprintFile = "${blueprintDir}/burrow-authentik.yaml";
-  postgresVolume = "burrow-authentik-postgresql:/var/lib/postgresql/data";
-  dataVolume = "burrow-authentik-data:/data";
-  directorySyncScript = ../../Scripts/authentik-sync-burrow-directory.sh;
-  forgejoOidcSyncScript = ../../Scripts/authentik-sync-forgejo-oidc.sh;
-  grafanaOidcSyncScript = ../../Scripts/authentik-sync-grafana-oidc.sh;
-  googleWifOidcSyncScript = ../../Scripts/authentik-sync-google-wif-oidc.sh;
-  tailscaleOidcSyncScript = ../../Scripts/authentik-sync-tailscale-oidc.sh;
-  onePasswordOidcSyncScript = ../../Scripts/authentik-sync-1password-oidc.sh;
-  zulipSamlSyncScript = ../../Scripts/authentik-sync-zulip-saml.sh;
-  linearSamlSyncScript = ../../Scripts/authentik-sync-linear-saml.sh;
-  linearScimSyncScript = ../../Scripts/authentik-sync-linear-scim.sh;
-  googleSourceSyncScript = ../../Scripts/authentik-sync-google-source.sh;
-  tailnetAuthFlowSyncScript = ../../Scripts/authentik-sync-tailnet-auth-flow.sh;
-  authentikBlueprint = pkgs.writeText "burrow-authentik-blueprint.yaml" ''
-    version: 1
-    metadata:
-      name: Burrow Authentik
-      labels:
-        blueprints.goauthentik.io/description: Minimal Burrow Authentik applications
-    entries:
-      - model: authentik_providers_oauth2.scopemapping
-        id: burrow-oidc-email
-        identifiers:
-          name: Burrow OIDC Email
-        attrs:
-          name: Burrow OIDC Email
-          scope_name: email
-          description: Verified email mapping for Burrow
-          expression: |
-            return {
-                "email": request.user.email,
-                "email_verified": True,
-            }
-
-      - model: authentik_providers_oauth2.scopemapping
-        id: burrow-oidc-groups
-        identifiers:
-          name: Burrow OIDC Groups
-        attrs:
-          name: Burrow OIDC Groups
-          scope_name: groups
-          description: Group membership mapping for Burrow
-          expression: |
-            return {
-                "groups": [group.name for group in request.user.ak_groups.all()],
-            }
-
-      - model: authentik_providers_oauth2.oauth2provider
-        id: burrow-oidc-provider-ts
-        identifiers:
-          name: Burrow Tailnet
-        attrs:
-          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
-          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          issuer_mode: per_provider
-          slug: ${cfg.headscaleProviderSlug}
-          client_type: confidential
-          client_id: ${cfg.headscaleDomain}
-          client_secret: !Env [AUTHENTIK_BURROW_TS_CLIENT_SECRET, ""]
-          include_claims_in_id_token: true
-          redirect_uris:
-            - matching_mode: strict
-              url: https://${cfg.headscaleDomain}/oidc/callback
-          property_mappings:
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
-            - !KeyOf burrow-oidc-email
-            - !KeyOf burrow-oidc-groups
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
-          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
-
-      - model: authentik_core.application
-        identifiers:
-          slug: ${cfg.headscaleProviderSlug}
-        attrs:
-          name: Burrow Tailnet
-          slug: ${cfg.headscaleProviderSlug}
-          provider: !KeyOf burrow-oidc-provider-ts
-          meta_launch_url: https://${cfg.headscaleDomain}/
-  '';
-in
-{
-  options.services.burrow.authentik = {
-    enable = lib.mkEnableOption "the Burrow Authentik identity provider";
-
-    domain = lib.mkOption {
-      type = lib.types.str;
-      default = "auth.burrow.net";
-      description = "Public Authentik domain.";
-    };
-
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 9002;
-      description = "Local Authentik HTTP listen port.";
-    };
-
-    image = lib.mkOption {
-      type = lib.types.str;
-      default = "ghcr.io/goauthentik/server:2026.2.1";
-      description = "Authentik container image reference.";
-    };
-
-    envFile = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/burrow/intake/authentik.env";
-      description = "Host-local Authentik bootstrap environment file.";
-    };
-
-    headscaleDomain = lib.mkOption {
-      type = lib.types.str;
-      default = "ts.burrow.net";
-      description = "Headscale public domain used for the bundled OIDC client.";
-    };
-
-    headscaleProviderSlug = lib.mkOption {
-      type = lib.types.str;
-      default = "ts";
-      description = "Authentik provider slug for Headscale.";
-    };
-
-    forgejoDomain = lib.mkOption {
-      type = lib.types.str;
-      default = "git.burrow.net";
-      description = "Forgejo public domain used for the bundled OIDC client.";
-    };
-
-    forgejoProviderSlug = lib.mkOption {
-      type = lib.types.str;
-      default = "git";
-      description = "Authentik application slug for Forgejo.";
-    };
-
-    grafanaDomain = lib.mkOption {
-      type = lib.types.str;
-      default = "graphs.burrow.net";
-      description = "Grafana public domain used for the bundled OIDC client.";
-    };
-
-    grafanaProviderSlug = lib.mkOption {
-      type = lib.types.str;
-      default = "grafana";
-      description = "Authentik application slug for Grafana.";
-    };
-
-    grafanaClientId = lib.mkOption {
-      type = lib.types.str;
-      default = "graphs.burrow.net";
-      description = "Client ID Authentik should present to Grafana.";
-    };
-
-    grafanaClientSecretFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = "Host-local file containing the Authentik Grafana OIDC client secret.";
-    };
-
-    grafanaAccessGroupName = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = "Authentik group allowed to launch Grafana.";
-    };
-
-    googleWifProviderSlug = lib.mkOption {
-      type = lib.types.str;
-      default = "google-cloud";
-      description = "Authentik application slug for Google Cloud Workload Identity Federation.";
-    };
-
-    googleWifClientId = lib.mkOption {
-      type = lib.types.str;
-      default = "google-wif.burrow.net";
-      description = "Client ID Authentik should present to Google Cloud WIF consumers.";
-    };
-
-    googleWifClientSecretFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = "Host-local file containing the Authentik Google WIF client-credentials secret.";
-    };
-
-    googleWifAccessGroupName = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = "Optional Authentik group allowed to launch the Google WIF application. Leave null for client-credentials token exchange.";
-    };
-
-    tailscaleProviderSlug = lib.mkOption {
-      type = lib.types.str;
-      default = "tailscale";
-      description = "Authentik application slug for Tailscale custom OIDC sign-in.";
-    };
-
-    tailscaleClientId = lib.mkOption {
-      type = lib.types.str;
-      default = "tailscale.burrow.net";
-      description = "Client ID Authentik should present to Tailscale.";
-    };
-
-    tailscaleClientSecretFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = "Host-local file containing the Authentik Tailscale OIDC client secret.";
-    };
-
-    tailscaleAccessGroupName = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = "Authentik group that should be allowed to launch the Tailscale application.";
-    };
-
-    defaultExternalApplicationSlug = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = "Authentik application slug that external users should land on instead of /if/user/.";
-    };
-
-    onePasswordDomain = lib.mkOption {
-      type = lib.types.str;
-      default = "burrow-team.1password.com";
-      description = "1Password team sign-in domain used for Burrow Unlock with SSO.";
-    };
-
-    onePasswordProviderSlug = lib.mkOption {
-      type = lib.types.str;
-      default = "onepassword";
-      description = "Authentik application slug for 1Password Unlock with SSO.";
-    };
-
-    onePasswordClientId = lib.mkOption {
-      type = lib.types.str;
-      default = "1password.burrow.net";
-      description = "Public OIDC client ID Authentik should present to 1Password.";
-    };
-
-    onePasswordRedirectUris = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [
-        "https://burrow-team.1password.com/sso/oidc/redirect/"
-        "onepassword://sso/oidc/redirect"
-      ];
-      description = "Allowed 1Password OIDC redirect URIs.";
-    };
-
-    linearProviderSlug = lib.mkOption {
-      type = lib.types.str;
-      default = "linear";
-      description = "Authentik application slug for Linear SAML.";
-    };
-
-    zulipDomain = lib.mkOption {
-      type = lib.types.str;
-      default = "chat.burrow.net";
-      description = "Public Zulip domain exposed through Authentik SAML.";
-    };
-
-    zulipProviderSlug = lib.mkOption {
-      type = lib.types.str;
-      default = "zulip";
-      description = "Authentik application slug for Zulip SAML.";
-    };
-
-    zulipAcsUrl = lib.mkOption {
-      type = lib.types.str;
-      default = "https://${config.services.burrow.authentik.zulipDomain}/complete/saml/";
-      description = "Zulip SAML ACS URL.";
-    };
-
-    zulipAudience = lib.mkOption {
-      type = lib.types.str;
-      default = "https://${config.services.burrow.authentik.zulipDomain}";
-      description = "Zulip SAML audience/entity identifier.";
-    };
-
-    zulipLaunchUrl = lib.mkOption {
-      type = lib.types.str;
-      default = "https://${config.services.burrow.authentik.zulipDomain}/";
-      description = "Zulip URL exposed in Authentik.";
-    };
-
-    zulipAccessGroupName = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = "Authentik group allowed to launch Zulip from Burrow SSO surfaces.";
-    };
-
-    linearAcsUrl = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = "Linear SAML ACS URL.";
-    };
-
-    linearAudience = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = "Linear SAML audience/entity identifier.";
-    };
-
-    linearLaunchUrl = lib.mkOption {
-      type = lib.types.str;
-      default = "https://linear.app/burrownet";
-      description = "Linear workspace URL exposed in Authentik.";
-    };
-
-    linearDefaultRelayState = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = "Optional Linear relay state or login URL for IdP-initiated launches.";
-    };
-
-    linearScimUrl = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = "Linear SCIM base connector URL.";
-    };
-
-    linearScimTokenFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = "Host-local file containing the Linear SCIM bearer token.";
-    };
-
-    linearScimUserIdentifier = lib.mkOption {
-      type = lib.types.str;
-      default = "email";
-      description = "Linear SCIM unique identifier field for users.";
-    };
-
-    linearOwnerGroupName = lib.mkOption {
-      type = lib.types.str;
-      default = "linear-owners";
-      description = "Authentik group name that should map to Linear owners.";
-    };
-
-    linearAdminGroupName = lib.mkOption {
-      type = lib.types.str;
-      default = "linear-admins";
-      description = "Authentik group name that should map to Linear admins.";
-    };
-
-    linearGuestGroupName = lib.mkOption {
-      type = lib.types.str;
-      default = "linear-guests";
-      description = "Authentik group name that should map to Linear guests.";
-    };
-
-    forgejoClientId = lib.mkOption {
-      type = lib.types.str;
-      default = "git.burrow.net";
-      description = "Client ID Authentik should present to Forgejo.";
-    };
-
-    forgejoClientSecretFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = "Host-local file containing the Authentik Forgejo OIDC client secret.";
-    };
-
-    headscaleClientSecretFile = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/burrow/intake/authentik_headscale_client_secret.txt";
-      description = "Host-local file containing the Authentik Headscale OIDC client secret.";
-    };
-
-    googleClientIDFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = "Host-local file containing the Google OAuth client ID for the Authentik source.";
-    };
-
-    googleClientSecretFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = "Host-local file containing the Google OAuth client secret for the Authentik source.";
-    };
-
-    googleAccountMapFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = "Optional host-local JSON file mapping external Google accounts onto Burrow Authentik users.";
-    };
-
-    googleSourceSlug = lib.mkOption {
-      type = lib.types.str;
-      default = "google";
-      description = "Authentik OAuth source slug used for Google login.";
-    };
-
-    googleLoginMode = lib.mkOption {
-      type = lib.types.enum [
-        "promoted"
-        "redirect"
-      ];
-      default = "redirect";
-      description = "Identification-stage behavior for the Google Authentik source.";
-    };
-
-    headscaleAuthenticationFlowSlug = lib.mkOption {
-      type = lib.types.str;
-      default = "burrow-tailnet-authentication";
-      description = "Authentik authentication flow slug used for Burrow Tailnet sign-in.";
-    };
-
-    headscaleAuthenticationFlowName = lib.mkOption {
-      type = lib.types.str;
-      default = "Burrow Tailnet Authentication";
-      description = "Authentik authentication flow name used for Burrow Tailnet sign-in.";
-    };
-
-    headscaleIdentificationStageName = lib.mkOption {
-      type = lib.types.str;
-      default = "burrow-tailnet-identification-stage";
-      description = "Authentik identification stage used for Burrow Tailnet sign-in.";
-    };
-
-    headscalePasswordStageName = lib.mkOption {
-      type = lib.types.str;
-      default = "burrow-tailnet-password-stage";
-      description = "Authentik password stage used for Burrow Tailnet sign-in.";
-    };
-
-    headscaleUserLoginStageName = lib.mkOption {
-      type = lib.types.str;
-      default = "burrow-tailnet-user-login-stage";
-      description = "Authentik user-login stage used for Burrow Tailnet sign-in.";
-    };
-
-    userGroupName = lib.mkOption {
-      type = lib.types.str;
-      default = "burrow-users";
-      description = "Authentik group granted baseline Burrow access.";
-    };
-
-    adminGroupName = lib.mkOption {
-      type = lib.types.str;
-      default = "burrow-admins";
-      description = "Authentik group granted Burrow administrator access.";
-    };
-
-    extraGroupNames = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      description = "Additional Authentik groups that should exist even if no bootstrap user currently belongs to them.";
-    };
-
-    bootstrapUsers = lib.mkOption {
-      type = with lib.types; listOf (submodule {
-        options = {
-          username = lib.mkOption {
-            type = str;
-            description = "Authentik username.";
-          };
-          name = lib.mkOption {
-            type = str;
-            description = "Display name for the user.";
-          };
-          email = lib.mkOption {
-            type = str;
-            description = "Canonical email stored in Authentik.";
-          };
-          sourceEmail = lib.mkOption {
-            type = nullOr str;
-            default = null;
-            description = "External Google account email that should map onto this Authentik user.";
-          };
-          groups = lib.mkOption {
-            type = listOf str;
-            default = [ ];
-            description = "Additional Authentik groups for this user.";
-          };
-          isAdmin = lib.mkOption {
-            type = bool;
-            default = false;
-            description = "Whether this user should be in the Burrow admin group.";
-          };
-          passwordFile = lib.mkOption {
-            type = nullOr str;
-            default = null;
-            description = "Optional host-local file containing a bootstrap password for this user.";
-          };
-        };
-      });
-      default = [ ];
-      description = "Declarative Burrow users to create in Authentik.";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    virtualisation.podman.enable = true;
-
-    systemd.tmpfiles.rules = [
-      "d ${runtimeDir} 0750 root root -"
-      "d ${blueprintDir} 0750 root root -"
-    ];
-
-    systemd.services.burrow-authentik-runtime = {
-      description = "Render the Burrow Authentik runtime environment";
-      before = [
-        "podman-burrow-authentik-postgresql.service"
-        "podman-burrow-authentik-server.service"
-        "podman-burrow-authentik-worker.service"
-      ];
-      wantedBy = [
-        "podman-burrow-authentik-postgresql.service"
-        "podman-burrow-authentik-server.service"
-        "podman-burrow-authentik-worker.service"
-      ];
-      after = lib.optionals config.services.burrow.headscale.enable [
-        "burrow-headscale-client-secret.service"
-      ];
-      wants = lib.optionals config.services.burrow.headscale.enable [
-        "burrow-headscale-client-secret.service"
-      ];
-      path = [ pkgs.coreutils ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-        RemainAfterExit = true;
-      };
-      script = ''
-        set -euo pipefail
-
-        if [ ! -s ${lib.escapeShellArg cfg.envFile} ]; then
-          echo "Authentik env file missing: ${cfg.envFile}" >&2
-          exit 1
-        fi
-
-        if [ ! -s ${lib.escapeShellArg cfg.headscaleClientSecretFile} ]; then
-          echo "Headscale client secret missing: ${cfg.headscaleClientSecretFile}" >&2
-          exit 1
-        fi
-
-        ${lib.optionalString (cfg.forgejoClientSecretFile != null) ''
-          if [ ! -s ${lib.escapeShellArg cfg.forgejoClientSecretFile} ]; then
-            echo "Forgejo client secret missing: ${cfg.forgejoClientSecretFile}" >&2
-            exit 1
-          fi
-        ''}
-
-        ${lib.optionalString (cfg.tailscaleClientSecretFile != null) ''
-          if [ ! -s ${lib.escapeShellArg cfg.tailscaleClientSecretFile} ]; then
-            echo "Tailscale client secret missing: ${cfg.tailscaleClientSecretFile}" >&2
-            exit 1
-          fi
-        ''}
-
-        ${lib.optionalString (cfg.googleWifClientSecretFile != null) ''
-          if [ ! -s ${lib.escapeShellArg cfg.googleWifClientSecretFile} ]; then
-            echo "Google WIF client secret missing: ${cfg.googleWifClientSecretFile}" >&2
-            exit 1
-          fi
-        ''}
-
-        install -d -m 0750 -o root -g root ${runtimeDir} ${blueprintDir}
-        install -m 0644 -o root -g root ${authentikBlueprint} ${blueprintFile}
-
-        source ${lib.escapeShellArg cfg.envFile}
-
-        read_secret() {
-          tr -d '\r\n' < "$1"
-        }
-
-        cat > ${envFile} <<EOF
-PG_DB=authentik
-PG_USER=authentik
-PG_PASS=$PG_PASS
-POSTGRES_DB=authentik
-POSTGRES_USER=authentik
-POSTGRES_PASSWORD=$PG_PASS
-AUTHENTIK_POSTGRESQL__HOST=127.0.0.1
-AUTHENTIK_POSTGRESQL__PORT=5433
-AUTHENTIK_POSTGRESQL__NAME=authentik
-AUTHENTIK_POSTGRESQL__USER=authentik
-AUTHENTIK_POSTGRESQL__PASSWORD=$PG_PASS
-AUTHENTIK_LISTEN__HTTP=0.0.0.0:${toString cfg.port}
-AUTHENTIK_SECRET_KEY=$AUTHENTIK_SECRET_KEY
-AUTHENTIK_BOOTSTRAP_PASSWORD=$AUTHENTIK_BOOTSTRAP_PASSWORD
-AUTHENTIK_BOOTSTRAP_TOKEN=$AUTHENTIK_BOOTSTRAP_TOKEN
-AUTHENTIK_BURROW_TS_CLIENT_SECRET=$(read_secret ${lib.escapeShellArg cfg.headscaleClientSecretFile})
-${lib.optionalString (cfg.forgejoClientSecretFile != null) "AUTHENTIK_BURROW_FORGEJO_CLIENT_SECRET=$(read_secret ${lib.escapeShellArg cfg.forgejoClientSecretFile})"}
-${lib.optionalString (cfg.googleWifClientSecretFile != null) "AUTHENTIK_BURROW_GOOGLE_WIF_CLIENT_SECRET=$(read_secret ${lib.escapeShellArg cfg.googleWifClientSecretFile})"}
-EOF
-        chown root:root ${envFile}
-        chmod 0600 ${envFile}
-      '';
-    };
-
-    virtualisation.oci-containers.containers."burrow-authentik-postgresql" = {
-      image = "docker.io/library/postgres:16-alpine";
-      autoStart = true;
-      environmentFiles = [ envFile ];
-      cmd = [
-        "-c"
-        "port=5433"
-        "-c"
-        "listen_addresses=127.0.0.1"
-      ];
-      volumes = [ postgresVolume ];
-      extraOptions = [
-        "--network=host"
-        "--pull=always"
-      ];
-    };
-
-    virtualisation.oci-containers.containers."burrow-authentik-server" = {
-      image = cfg.image;
-      autoStart = true;
-      cmd = [ "server" ];
-      environmentFiles = [ envFile ];
-      volumes = [
-        dataVolume
-        "${blueprintFile}:/blueprints/burrow-authentik.yaml:ro"
-      ];
-      extraOptions = [
-        "--network=host"
-        "--pull=always"
-      ];
-    };
-
-    virtualisation.oci-containers.containers."burrow-authentik-worker" = {
-      image = cfg.image;
-      autoStart = true;
-      cmd = [ "worker" ];
-      environmentFiles = [ envFile ];
-      volumes = [
-        dataVolume
-        "${blueprintFile}:/blueprints/burrow-authentik.yaml:ro"
-      ];
-      extraOptions = [
-        "--network=host"
-        "--pull=always"
-        "--user=root"
-      ];
-    };
-
-    systemd.services.podman-burrow-authentik-server.restartTriggers = [
-      blueprintFile
-      envFile
-    ];
-
-    systemd.services.podman-burrow-authentik-worker.restartTriggers = [
-      blueprintFile
-      envFile
-    ];
-
-    systemd.services.burrow-authentik-ready = {
-      description = "Wait for Burrow Authentik to become ready";
-      after = [ "podman-burrow-authentik-server.service" ];
-      wants = [ "podman-burrow-authentik-server.service" ];
-      wantedBy = [ "multi-user.target" ];
-      path = [
-        pkgs.coreutils
-        pkgs.curl
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-
-        for _ in $(seq 1 90); do
-          if ${pkgs.curl}/bin/curl -fsS http://127.0.0.1:${toString cfg.port}/-/health/ready/ >/dev/null; then
-            exit 0
-          fi
-          sleep 2
-        done
-
-        echo "Authentik did not become ready on ${cfg.domain}" >&2
-        exit 1
-      '';
-    };
-
-    systemd.services.burrow-authentik-google-source = lib.mkIf (
-      cfg.googleClientIDFile != null && cfg.googleClientSecretFile != null
-    ) {
-      description = "Reconcile the Burrow Authentik Google OAuth source";
-      after = [
-        "burrow-authentik-ready.service"
-        "network-online.target"
-      ];
-      wants = [
-        "burrow-authentik-ready.service"
-        "network-online.target"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      restartTriggers = [
-        googleSourceSyncScript
-        cfg.envFile
-        cfg.googleClientIDFile
-        cfg.googleClientSecretFile
-      ] ++ lib.optional (cfg.googleAccountMapFile != null) cfg.googleAccountMapFile;
-      path = [
-        pkgs.bash
-        pkgs.coreutils
-        pkgs.curl
-        pkgs.jq
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-        set -a
-        source ${lib.escapeShellArg cfg.envFile}
-        set +a
-
-        export AUTHENTIK_URL=https://${cfg.domain}
-        export AUTHENTIK_GOOGLE_SOURCE_SLUG=${lib.escapeShellArg cfg.googleSourceSlug}
-        export AUTHENTIK_GOOGLE_LOGIN_MODE=${lib.escapeShellArg cfg.googleLoginMode}
-        export AUTHENTIK_GOOGLE_USER_MATCHING_MODE=email_link
-        export AUTHENTIK_GOOGLE_CLIENT_ID="$(tr -d '\r\n' < ${lib.escapeShellArg cfg.googleClientIDFile})"
-        export AUTHENTIK_GOOGLE_CLIENT_SECRET="$(tr -d '\r\n' < ${lib.escapeShellArg cfg.googleClientSecretFile})"
-        if [ -n ${lib.escapeShellArg (cfg.googleAccountMapFile or "")} ]; then
-          export AUTHENTIK_GOOGLE_ACCOUNT_MAP_JSON="$(tr -d '\n' < ${lib.escapeShellArg (cfg.googleAccountMapFile or "/dev/null")})"
-        else
-          export AUTHENTIK_GOOGLE_ACCOUNT_MAP_JSON='${builtins.toJSON (map (user: {
-            source_email = user.sourceEmail;
-            username = user.username;
-            email = user.email;
-            name = user.name;
-          }) (lib.filter (user: user.sourceEmail != null) cfg.bootstrapUsers))}'
-        fi
-
-        ${pkgs.bash}/bin/bash ${googleSourceSyncScript}
-      '';
-    };
-
-    systemd.services.burrow-authentik-directory = lib.mkIf (cfg.bootstrapUsers != [ ] || cfg.extraGroupNames != [ ]) {
-      description = "Reconcile Burrow Authentik users and groups";
-      after =
-        [
-          "burrow-authentik-ready.service"
-          "network-online.target"
-        ]
-        ++ lib.optionals (cfg.forgejoClientSecretFile != null) [ "burrow-authentik-forgejo-oidc.service" ];
-      wants =
-        [
-          "burrow-authentik-ready.service"
-          "network-online.target"
-        ]
-        ++ lib.optionals (cfg.forgejoClientSecretFile != null) [ "burrow-authentik-forgejo-oidc.service" ];
-      wantedBy = [ "multi-user.target" ];
-      restartTriggers = [
-        directorySyncScript
-        cfg.envFile
-      ] ++ lib.concatMap (user: lib.optional (user.passwordFile != null) user.passwordFile) cfg.bootstrapUsers;
-      path = [
-        pkgs.bash
-        pkgs.coreutils
-        pkgs.curl
-        pkgs.jq
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-        set -a
-        source ${lib.escapeShellArg cfg.envFile}
-        set +a
-
-        export AUTHENTIK_URL=https://${cfg.domain}
-        export AUTHENTIK_BURROW_USERS_GROUP=${lib.escapeShellArg cfg.userGroupName}
-        export AUTHENTIK_BURROW_ADMINS_GROUP=${lib.escapeShellArg cfg.adminGroupName}
-        export AUTHENTIK_BURROW_EXTRA_GROUPS_JSON='${builtins.toJSON cfg.extraGroupNames}'
-        export AUTHENTIK_FORGEJO_APPLICATION_SLUG=${lib.escapeShellArg cfg.forgejoProviderSlug}
-        export AUTHENTIK_BURROW_DIRECTORY_JSON='${builtins.toJSON (map (user: {
-          inherit (user) username name email isAdmin passwordFile;
-          groups = user.groups;
-        }) cfg.bootstrapUsers)}'
-
-        ${pkgs.bash}/bin/bash ${directorySyncScript}
-      '';
-    };
-
-    systemd.services.burrow-authentik-tailnet-auth-flow = {
-      description = "Reconcile the Burrow Tailnet authentication flow";
-      after =
-        [
-          "burrow-authentik-ready.service"
-          "network-online.target"
-        ]
-        ++ lib.optionals (
-          cfg.googleClientIDFile != null && cfg.googleClientSecretFile != null
-        ) [ "burrow-authentik-google-source.service" ];
-      wants =
-        [
-          "burrow-authentik-ready.service"
-          "network-online.target"
-        ]
-        ++ lib.optionals (
-          cfg.googleClientIDFile != null && cfg.googleClientSecretFile != null
-        ) [ "burrow-authentik-google-source.service" ];
-      wantedBy = [ "multi-user.target" ];
-      restartTriggers = [
-        tailnetAuthFlowSyncScript
-        cfg.envFile
-      ];
-      path = [
-        pkgs.bash
-        pkgs.coreutils
-        pkgs.curl
-        pkgs.jq
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-        set -a
-        source ${lib.escapeShellArg cfg.envFile}
-        set +a
-
-        export AUTHENTIK_URL=https://${cfg.domain}
-        export AUTHENTIK_TAILNET_PROVIDER_SLUG=${lib.escapeShellArg cfg.headscaleProviderSlug}
-        export AUTHENTIK_TAILNET_PROVIDER_SLUGS_JSON='["${cfg.headscaleProviderSlug}","${cfg.tailscaleProviderSlug}"]'
-        export AUTHENTIK_TAILNET_AUTHENTICATION_FLOW_NAME=${lib.escapeShellArg cfg.headscaleAuthenticationFlowName}
-        export AUTHENTIK_TAILNET_AUTHENTICATION_FLOW_SLUG=${lib.escapeShellArg cfg.headscaleAuthenticationFlowSlug}
-        export AUTHENTIK_TAILNET_IDENTIFICATION_STAGE_NAME=${lib.escapeShellArg cfg.headscaleIdentificationStageName}
-        export AUTHENTIK_TAILNET_PASSWORD_STAGE_NAME=${lib.escapeShellArg cfg.headscalePasswordStageName}
-        export AUTHENTIK_TAILNET_USER_LOGIN_STAGE_NAME=${lib.escapeShellArg cfg.headscaleUserLoginStageName}
-        export AUTHENTIK_TAILNET_GOOGLE_SOURCE_SLUG=${lib.escapeShellArg cfg.googleSourceSlug}
-
-        ${pkgs.bash}/bin/bash ${tailnetAuthFlowSyncScript}
-      '';
-    };
-
-    systemd.services.burrow-authentik-forgejo-oidc = lib.mkIf (cfg.forgejoClientSecretFile != null) {
-      description = "Reconcile the Burrow Authentik Forgejo OIDC application";
-      after = [
-        "burrow-authentik-ready.service"
-        "network-online.target"
-      ];
-      wants = [
-        "burrow-authentik-ready.service"
-        "network-online.target"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      restartTriggers = [
-        forgejoOidcSyncScript
-        cfg.envFile
-        cfg.forgejoClientSecretFile
-      ];
-      path = [
-        pkgs.bash
-        pkgs.coreutils
-        pkgs.curl
-        pkgs.jq
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-        set -a
-        source ${lib.escapeShellArg cfg.envFile}
-        set +a
-
-        export AUTHENTIK_URL=https://${cfg.domain}
-        export AUTHENTIK_FORGEJO_APPLICATION_SLUG=${lib.escapeShellArg cfg.forgejoProviderSlug}
-        export AUTHENTIK_FORGEJO_APPLICATION_NAME=burrow.net
-        export AUTHENTIK_FORGEJO_PROVIDER_NAME=burrow.net
-        export AUTHENTIK_FORGEJO_CLIENT_ID=${lib.escapeShellArg cfg.forgejoClientId}
-        export AUTHENTIK_FORGEJO_CLIENT_SECRET="$(tr -d '\r\n' < ${lib.escapeShellArg cfg.forgejoClientSecretFile})"
-        export AUTHENTIK_FORGEJO_LAUNCH_URL=https://${cfg.forgejoDomain}/
-        export AUTHENTIK_FORGEJO_REDIRECT_URIS_JSON='["https://${cfg.forgejoDomain}/user/oauth2/burrow.net/callback","https://${cfg.forgejoDomain}/user/oauth2/authentik/callback"]'
-
-        ${pkgs.bash}/bin/bash ${forgejoOidcSyncScript}
-      '';
-    };
-
-    systemd.services.burrow-authentik-grafana-oidc = lib.mkIf (cfg.grafanaClientSecretFile != null) {
-      description = "Reconcile the Burrow Authentik Grafana OIDC application";
-      after = [
-        "burrow-authentik-ready.service"
-        "network-online.target"
-      ];
-      wants = [
-        "burrow-authentik-ready.service"
-        "network-online.target"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      restartTriggers = [
-        grafanaOidcSyncScript
-        cfg.envFile
-        cfg.grafanaClientSecretFile
-      ];
-      path = [
-        pkgs.bash
-        pkgs.coreutils
-        pkgs.curl
-        pkgs.jq
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-        set -a
-        source ${lib.escapeShellArg cfg.envFile}
-        set +a
-
-        export AUTHENTIK_URL=https://${cfg.domain}
-        export AUTHENTIK_GRAFANA_APPLICATION_SLUG=${lib.escapeShellArg cfg.grafanaProviderSlug}
-        export AUTHENTIK_GRAFANA_APPLICATION_NAME="Burrow Grafana"
-        export AUTHENTIK_GRAFANA_PROVIDER_NAME="Burrow Grafana"
-        export AUTHENTIK_GRAFANA_TEMPLATE_SLUG=${lib.escapeShellArg cfg.headscaleProviderSlug}
-        export AUTHENTIK_GRAFANA_CLIENT_ID=${lib.escapeShellArg cfg.grafanaClientId}
-        export AUTHENTIK_GRAFANA_CLIENT_SECRET="$(tr -d '\r\n' < ${lib.escapeShellArg cfg.grafanaClientSecretFile})"
-        export AUTHENTIK_GRAFANA_LAUNCH_URL=https://${cfg.grafanaDomain}/
-        export AUTHENTIK_GRAFANA_REDIRECT_URIS_JSON='["https://${cfg.grafanaDomain}/login/generic_oauth"]'
-        ${lib.optionalString (cfg.grafanaAccessGroupName != null) ''
-          export AUTHENTIK_GRAFANA_ACCESS_GROUP=${lib.escapeShellArg cfg.grafanaAccessGroupName}
-        ''}
-
-        ${pkgs.bash}/bin/bash ${grafanaOidcSyncScript}
-      '';
-    };
-
-    systemd.services.burrow-authentik-google-wif-oidc = lib.mkIf (cfg.googleWifClientSecretFile != null) {
-      description = "Reconcile the Burrow Authentik Google WIF OIDC application";
-      after = [
-        "burrow-authentik-ready.service"
-        "network-online.target"
-      ];
-      wants = [
-        "burrow-authentik-ready.service"
-        "network-online.target"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      restartTriggers = [
-        googleWifOidcSyncScript
-        cfg.envFile
-        cfg.googleWifClientSecretFile
-      ];
-      path = [
-        pkgs.bash
-        pkgs.coreutils
-        pkgs.curl
-        pkgs.jq
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-        set -a
-        source ${lib.escapeShellArg cfg.envFile}
-        set +a
-
-        export AUTHENTIK_URL=https://${cfg.domain}
-        export AUTHENTIK_GOOGLE_WIF_APPLICATION_SLUG=${lib.escapeShellArg cfg.googleWifProviderSlug}
-        export AUTHENTIK_GOOGLE_WIF_APPLICATION_NAME="Google Cloud WIF"
-        export AUTHENTIK_GOOGLE_WIF_PROVIDER_NAME="Google Cloud WIF"
-        export AUTHENTIK_GOOGLE_WIF_TEMPLATE_SLUG=${lib.escapeShellArg cfg.headscaleProviderSlug}
-        export AUTHENTIK_GOOGLE_WIF_CLIENT_ID=${lib.escapeShellArg cfg.googleWifClientId}
-        export AUTHENTIK_GOOGLE_WIF_CLIENT_SECRET="$(tr -d '\r\n' < ${lib.escapeShellArg cfg.googleWifClientSecretFile})"
-        export AUTHENTIK_GOOGLE_WIF_LAUNCH_URL=https://console.cloud.google.com/
-        export AUTHENTIK_GOOGLE_WIF_REDIRECT_URIS_JSON='[]'
-        ${lib.optionalString (cfg.googleWifAccessGroupName != null) ''
-          export AUTHENTIK_GOOGLE_WIF_ACCESS_GROUP=${lib.escapeShellArg cfg.googleWifAccessGroupName}
-        ''}
-
-        ${pkgs.bash}/bin/bash ${googleWifOidcSyncScript}
-      '';
-    };
-
-    systemd.services.burrow-authentik-tailscale-oidc = lib.mkIf (cfg.tailscaleClientSecretFile != null) {
-      description = "Reconcile the Burrow Authentik Tailscale OIDC application";
-      after = [
-        "burrow-authentik-ready.service"
-        "network-online.target"
-      ];
-      wants = [
-        "burrow-authentik-ready.service"
-        "network-online.target"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      restartTriggers = [
-        tailscaleOidcSyncScript
-        cfg.envFile
-        cfg.tailscaleClientSecretFile
-      ];
-      path = [
-        pkgs.bash
-        pkgs.coreutils
-        pkgs.curl
-        pkgs.jq
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-        set -a
-        source ${lib.escapeShellArg cfg.envFile}
-        set +a
-
-        export AUTHENTIK_URL=https://${cfg.domain}
-        export AUTHENTIK_TAILSCALE_APPLICATION_SLUG=${lib.escapeShellArg cfg.tailscaleProviderSlug}
-        export AUTHENTIK_TAILSCALE_APPLICATION_NAME=Tailscale
-        export AUTHENTIK_TAILSCALE_PROVIDER_NAME=Tailscale
-        export AUTHENTIK_TAILSCALE_TEMPLATE_SLUG=${lib.escapeShellArg cfg.headscaleProviderSlug}
-        export AUTHENTIK_TAILSCALE_CLIENT_ID=${lib.escapeShellArg cfg.tailscaleClientId}
-        export AUTHENTIK_TAILSCALE_CLIENT_SECRET="$(tr -d '\r\n' < ${lib.escapeShellArg cfg.tailscaleClientSecretFile})"
-        export AUTHENTIK_TAILSCALE_LAUNCH_URL=https://login.tailscale.com/start/oidc
-        export AUTHENTIK_TAILSCALE_REDIRECT_URIS_JSON='["https://login.tailscale.com/a/oauth_response"]'
-        ${lib.optionalString (cfg.tailscaleAccessGroupName != null) ''
-          export AUTHENTIK_TAILSCALE_ACCESS_GROUP=${lib.escapeShellArg cfg.tailscaleAccessGroupName}
-        ''}
-        ${lib.optionalString (cfg.defaultExternalApplicationSlug != null) ''
-          export AUTHENTIK_DEFAULT_EXTERNAL_APPLICATION_SLUG=${lib.escapeShellArg cfg.defaultExternalApplicationSlug}
-        ''}
-
-        ${pkgs.bash}/bin/bash ${tailscaleOidcSyncScript}
-      '';
-    };
-
-    systemd.services.burrow-authentik-1password-oidc = {
-      description = "Reconcile the Burrow Authentik 1Password OIDC application";
-      after = [
-        "burrow-authentik-ready.service"
-        "network-online.target"
-      ];
-      wants = [
-        "burrow-authentik-ready.service"
-        "network-online.target"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      restartTriggers = [
-        onePasswordOidcSyncScript
-        cfg.envFile
-      ];
-      path = [
-        pkgs.bash
-        pkgs.coreutils
-        pkgs.curl
-        pkgs.jq
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-        set -a
-        source ${lib.escapeShellArg cfg.envFile}
-        set +a
-
-        export AUTHENTIK_URL=https://${cfg.domain}
-        export AUTHENTIK_ONEPASSWORD_APPLICATION_SLUG=${lib.escapeShellArg cfg.onePasswordProviderSlug}
-        export AUTHENTIK_ONEPASSWORD_APPLICATION_NAME=1Password
-        export AUTHENTIK_ONEPASSWORD_PROVIDER_NAME=1Password
-        export AUTHENTIK_ONEPASSWORD_TEMPLATE_SLUG=${lib.escapeShellArg cfg.headscaleProviderSlug}
-        export AUTHENTIK_ONEPASSWORD_CLIENT_ID=${lib.escapeShellArg cfg.onePasswordClientId}
-        export AUTHENTIK_ONEPASSWORD_LAUNCH_URL=https://${cfg.onePasswordDomain}/
-        export AUTHENTIK_ONEPASSWORD_REDIRECT_URIS_JSON='${builtins.toJSON cfg.onePasswordRedirectUris}'
-
-        ${pkgs.bash}/bin/bash ${onePasswordOidcSyncScript}
-      '';
-    };
-
-    systemd.services.burrow-authentik-zulip-saml = {
-      description = "Reconcile the Burrow Authentik Zulip SAML application";
-      after = [
-        "burrow-authentik-ready.service"
-        "network-online.target"
-      ];
-      wants = [
-        "burrow-authentik-ready.service"
-        "network-online.target"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      restartTriggers = [
-        zulipSamlSyncScript
-        cfg.envFile
-      ];
-      path = [
-        pkgs.bash
-        pkgs.coreutils
-        pkgs.curl
-        pkgs.jq
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-        set -a
-        source ${lib.escapeShellArg cfg.envFile}
-        set +a
-
-        export AUTHENTIK_URL=https://${cfg.domain}
-        export AUTHENTIK_ZULIP_APPLICATION_SLUG=${lib.escapeShellArg cfg.zulipProviderSlug}
-        export AUTHENTIK_ZULIP_APPLICATION_NAME=Zulip
-        export AUTHENTIK_ZULIP_PROVIDER_NAME=Zulip
-        export AUTHENTIK_ZULIP_ACS_URL=${lib.escapeShellArg cfg.zulipAcsUrl}
-        export AUTHENTIK_ZULIP_AUDIENCE=${lib.escapeShellArg cfg.zulipAudience}
-        export AUTHENTIK_ZULIP_LAUNCH_URL=${lib.escapeShellArg cfg.zulipLaunchUrl}
-        ${lib.optionalString (cfg.zulipAccessGroupName != null) ''
-          export AUTHENTIK_ZULIP_ACCESS_GROUP=${lib.escapeShellArg cfg.zulipAccessGroupName}
-        ''}
-        export AUTHENTIK_ZULIP_ADMIN_GROUP=${lib.escapeShellArg cfg.adminGroupName}
-
-        ${pkgs.bash}/bin/bash ${zulipSamlSyncScript}
-      '';
-    };
-
-    systemd.services.burrow-authentik-linear-saml = lib.mkIf (
-      cfg.linearAcsUrl != null && cfg.linearAudience != null
-    ) {
-      description = "Reconcile the Burrow Authentik Linear SAML application";
-      after = [
-        "burrow-authentik-ready.service"
-        "network-online.target"
-      ];
-      wants = [
-        "burrow-authentik-ready.service"
-        "network-online.target"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      restartTriggers = [
-        linearSamlSyncScript
-        cfg.envFile
-      ];
-      path = [
-        pkgs.bash
-        pkgs.coreutils
-        pkgs.curl
-        pkgs.jq
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-        set -a
-        source ${lib.escapeShellArg cfg.envFile}
-        set +a
-
-        export AUTHENTIK_URL=https://${cfg.domain}
-        export AUTHENTIK_LINEAR_APPLICATION_SLUG=${lib.escapeShellArg cfg.linearProviderSlug}
-        export AUTHENTIK_LINEAR_APPLICATION_NAME=Linear
-        export AUTHENTIK_LINEAR_PROVIDER_NAME=Linear
-        export AUTHENTIK_LINEAR_ACS_URL=${lib.escapeShellArg cfg.linearAcsUrl}
-        export AUTHENTIK_LINEAR_AUDIENCE=${lib.escapeShellArg cfg.linearAudience}
-        export AUTHENTIK_LINEAR_LAUNCH_URL=${lib.escapeShellArg cfg.linearLaunchUrl}
-        ${lib.optionalString (cfg.linearDefaultRelayState != null) ''
-          export AUTHENTIK_LINEAR_DEFAULT_RELAY_STATE=${lib.escapeShellArg cfg.linearDefaultRelayState}
-        ''}
-
-        ${pkgs.bash}/bin/bash ${linearSamlSyncScript}
-      '';
-    };
-
-    systemd.services.burrow-authentik-linear-scim = lib.mkIf (
-      cfg.linearScimUrl != null && cfg.linearScimTokenFile != null
-    ) {
-      description = "Reconcile the Burrow Authentik Linear SCIM provider";
-      after = [
-        "burrow-authentik-ready.service"
-        "burrow-authentik-directory.service"
-        "burrow-authentik-linear-saml.service"
-        "network-online.target"
-      ];
-      wants = [
-        "burrow-authentik-ready.service"
-        "burrow-authentik-directory.service"
-        "burrow-authentik-linear-saml.service"
-        "network-online.target"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      restartTriggers = [
-        linearScimSyncScript
-        cfg.envFile
-        cfg.linearScimTokenFile
-      ];
-      path = [
-        pkgs.bash
-        pkgs.coreutils
-        pkgs.curl
-        pkgs.jq
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-        set -a
-        source ${lib.escapeShellArg cfg.envFile}
-        set +a
-
-        export AUTHENTIK_URL=https://${cfg.domain}
-        export AUTHENTIK_LINEAR_APPLICATION_SLUG=${lib.escapeShellArg cfg.linearProviderSlug}
-        export AUTHENTIK_LINEAR_SCIM_PROVIDER_NAME="Linear SCIM"
-        export AUTHENTIK_LINEAR_SCIM_URL=${lib.escapeShellArg cfg.linearScimUrl}
-        export AUTHENTIK_LINEAR_SCIM_TOKEN_FILE=${lib.escapeShellArg cfg.linearScimTokenFile}
-        export AUTHENTIK_LINEAR_SCIM_USER_IDENTIFIER=${lib.escapeShellArg cfg.linearScimUserIdentifier}
-        export AUTHENTIK_LINEAR_OWNER_GROUP=${lib.escapeShellArg cfg.linearOwnerGroupName}
-        export AUTHENTIK_LINEAR_ADMIN_GROUP=${lib.escapeShellArg cfg.linearAdminGroupName}
-        export AUTHENTIK_LINEAR_GUEST_GROUP=${lib.escapeShellArg cfg.linearGuestGroupName}
-
-        ${pkgs.bash}/bin/bash ${linearScimSyncScript}
-      '';
-    };
-
-    services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
-      encode gzip zstd
-      reverse_proxy 127.0.0.1:${toString cfg.port}
-    '';
-  };
-}
diff --git a/nixos/modules/burrow-forge-runner.nix b/nixos/modules/burrow-forge-runner.nix
deleted file mode 100644
index b5e9d72..0000000
--- a/nixos/modules/burrow-forge-runner.nix
+++ /dev/null
@@ -1,241 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.services.burrow.forgeRunner;
-  runnerPkg = pkgs.forgejo-runner;
-  stateDir = cfg.stateDir;
-  runnerFile = "${stateDir}/.runner";
-  registrationFingerprintFile = "${stateDir}/.runner-registration-fingerprint";
-  configFile = "${stateDir}/runner.yaml";
-  ageIdentityFile = "${stateDir}/age_keystore";
-  labelsCsv = lib.concatStringsSep "," (map (label: "${label}:host") cfg.labels);
-  registrationFingerprint = builtins.hashString "sha256" "${cfg.instanceUrl}\n${cfg.name}\n${labelsCsv}";
-  sshPrivateKeyFile = cfg.sshPrivateKeyFile or "";
-in
-{
-  options.services.burrow.forgeRunner = {
-    enable = lib.mkEnableOption "the Burrow Forgejo Actions runner";
-
-    instanceUrl = lib.mkOption {
-      type = lib.types.str;
-      default = "http://127.0.0.1:3000";
-      description = "Forgejo base URL used by the local runner for registration and job polling.";
-    };
-
-    labels = lib.mkOption {
-      type = with lib.types; listOf str;
-      default = [ "burrow-forge" ];
-      description = "Runner labels exposed to Forgejo Actions.";
-    };
-
-    name = lib.mkOption {
-      type = lib.types.str;
-      default = "burrow-forge-agent";
-      description = "Runner name shown in Forgejo.";
-    };
-
-    capacity = lib.mkOption {
-      type = lib.types.int;
-      default = 1;
-      description = "Maximum concurrent jobs on this runner.";
-    };
-
-    stateDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/forgejo-runner-agent";
-      description = "Persistent runner state directory.";
-    };
-
-    user = lib.mkOption {
-      type = lib.types.str;
-      default = "forgejo-runner-agent";
-      description = "System user that runs the Forgejo runner.";
-    };
-
-    group = lib.mkOption {
-      type = lib.types.str;
-      default = "forgejo-runner-agent";
-      description = "System group that runs the Forgejo runner.";
-    };
-
-    forgejoConfigFile = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/forgejo/custom/conf/app.ini";
-      description = "Forgejo app.ini path used to generate runner tokens.";
-    };
-
-    gitUserName = lib.mkOption {
-      type = lib.types.str;
-      default = "agent";
-      description = "Git commit author name for automation on the forge host.";
-    };
-
-    gitUserEmail = lib.mkOption {
-      type = lib.types.str;
-      default = "agent@burrow.net";
-      description = "Git commit author email for automation on the forge host.";
-    };
-
-    sshPrivateKeyFile = lib.mkOption {
-      type = with lib.types; nullOr str;
-      default = null;
-      description = "Optional host-local path to the agent SSH private key copied into the runner home.";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    users.groups.${cfg.group} = { };
-
-    users.users.${cfg.user} = {
-      isSystemUser = true;
-      group = cfg.group;
-      description = "Burrow Forgejo Actions runner";
-      home = cfg.stateDir;
-      createHome = true;
-      shell = pkgs.bashInteractive;
-    };
-
-    environment.systemPackages = with pkgs; [
-      runnerPkg
-      bash
-      coreutils
-      findutils
-      git
-      git-lfs
-      openssh
-      python3
-      rsync
-    ];
-
-    systemd.tmpfiles.rules = [
-      "d ${stateDir} 0750 ${cfg.user} ${cfg.group} - -"
-    ];
-
-    systemd.services.burrow-forgejo-runner-bootstrap = {
-      description = "Bootstrap Burrow Forgejo runner registration";
-      after = [ "forgejo.service" "network-online.target" "systemd-tmpfiles-setup.service" ];
-      wants = [ "forgejo.service" "network-online.target" "systemd-tmpfiles-setup.service" ];
-      before = [ "burrow-forgejo-runner.service" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-        umask 077
-
-        install -d -m 0750 -o ${cfg.user} -g ${cfg.group} ${stateDir}
-        cat > ${configFile} <<EOF
-runner:
-  file: ${runnerFile}
-  capacity: ${toString cfg.capacity}
-  name: ${cfg.name}
-  labels:
-EOF
-        for label in ${lib.concatStringsSep " " cfg.labels}; do
-          echo "  - ${"$"}label:host" >> ${configFile}
-        done
-        cat >> ${configFile} <<'EOF'
-cache:
-  enabled: false
-EOF
-        chown ${cfg.user}:${cfg.group} ${configFile}
-        chmod 0640 ${configFile}
-
-        expected_fingerprint=${lib.escapeShellArg registrationFingerprint}
-        if [ -s ${runnerFile} ]; then
-          current_fingerprint=""
-          if [ -s ${registrationFingerprintFile} ]; then
-            current_fingerprint="$(tr -d '\r\n' < ${registrationFingerprintFile})"
-          fi
-          if [ "${"$"}current_fingerprint" != "${"$"}expected_fingerprint" ]; then
-            rm -f ${runnerFile} ${registrationFingerprintFile}
-          fi
-        fi
-
-        install -d -m 0700 -o ${cfg.user} -g ${cfg.group} ${stateDir}/.ssh
-        ${pkgs.util-linux}/bin/runuser -u ${cfg.user} -- \
-          ${pkgs.git}/bin/git config --global user.name ${lib.escapeShellArg cfg.gitUserName}
-        ${pkgs.util-linux}/bin/runuser -u ${cfg.user} -- \
-          ${pkgs.git}/bin/git config --global user.email ${lib.escapeShellArg cfg.gitUserEmail}
-
-        if [ -n ${lib.escapeShellArg sshPrivateKeyFile} ] && [ -s ${lib.escapeShellArg sshPrivateKeyFile} ]; then
-          install -m 0600 -o ${cfg.user} -g ${cfg.group} \
-            ${lib.escapeShellArg sshPrivateKeyFile} \
-            ${stateDir}/.ssh/id_ed25519
-          install -m 0600 -o ${cfg.user} -g ${cfg.group} \
-            ${lib.escapeShellArg sshPrivateKeyFile} \
-            ${ageIdentityFile}
-          cat > ${stateDir}/.ssh/config <<EOF
-Host *
-  IdentityFile ${stateDir}/.ssh/id_ed25519
-  IdentitiesOnly yes
-  StrictHostKeyChecking accept-new
-EOF
-          chown ${cfg.user}:${cfg.group} ${stateDir}/.ssh/config
-          chmod 0600 ${stateDir}/.ssh/config
-        fi
-
-        if [ ! -s ${runnerFile} ]; then
-          token="$(${pkgs.util-linux}/bin/runuser -u forgejo -- \
-            ${config.services.forgejo.package}/bin/forgejo actions generate-runner-token --config ${cfg.forgejoConfigFile} | tr -d '\r\n')"
-          if [ -z "${"$"}token" ]; then
-            echo "[burrow-forgejo-runner] failed to generate runner token" >&2
-            exit 1
-          fi
-
-          ${pkgs.util-linux}/bin/runuser -u ${cfg.user} -- \
-            ${runnerPkg}/bin/forgejo-runner register \
-              --no-interactive \
-              --instance ${lib.escapeShellArg cfg.instanceUrl} \
-              --token "${"$"}token" \
-              --name ${lib.escapeShellArg cfg.name} \
-              --labels ${lib.escapeShellArg labelsCsv} \
-              --config ${configFile}
-
-          printf '%s\n' "${"$"}expected_fingerprint" > ${registrationFingerprintFile}
-          chown ${cfg.user}:${cfg.group} ${registrationFingerprintFile}
-          chmod 0640 ${registrationFingerprintFile}
-        fi
-      '';
-    };
-
-    systemd.services.burrow-forgejo-runner = {
-      description = "Burrow Forgejo Actions runner";
-      after = [ "burrow-forgejo-runner-bootstrap.service" ];
-      wants = [ "burrow-forgejo-runner-bootstrap.service" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "simple";
-        User = cfg.user;
-        Group = cfg.group;
-        WorkingDirectory = stateDir;
-        Environment = [
-          "BURROW_RUNNER_REGISTRATION_FINGERPRINT=${registrationFingerprint}"
-          "BURROW_RUNNER_AGE_IDENTITY_PATH=${ageIdentityFile}"
-          "FORGEJO_RUNNER_HOME=${stateDir}"
-          "RUNNER_HOME=${stateDir}"
-          "HOME=${stateDir}"
-        ];
-        Restart = "on-failure";
-        RestartSec = 2;
-        ExecStart = pkgs.writeShellScript "burrow-forgejo-runner" ''
-          set -euo pipefail
-          export PATH="/run/wrappers/bin:/run/current-system/sw/bin:${"$"}{PATH:-}"
-          tmp="$(${pkgs.coreutils}/bin/mktemp)"
-          set +e
-          ${runnerPkg}/bin/forgejo-runner daemon --config ${configFile} 2>&1 | ${pkgs.coreutils}/bin/tee "${"$"}tmp"
-          rc="${"$"}{PIPESTATUS[0]}"
-          set -e
-          if ${pkgs.gnugrep}/bin/grep -qi "unregistered runner" "${"$"}tmp"; then
-            rm -f ${runnerFile}
-          fi
-          rm -f "${"$"}tmp"
-          exit "${"$"}rc"
-        '';
-      };
-    };
-  };
-}
diff --git a/nixos/modules/burrow-forge.nix b/nixos/modules/burrow-forge.nix
deleted file mode 100644
index 947e642..0000000
--- a/nixos/modules/burrow-forge.nix
+++ /dev/null
@@ -1,529 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.services.burrow.forge;
-  forgejoCfg = config.services.forgejo;
-  forgejoExe = lib.getExe forgejoCfg.package;
-  forgejoWorkPath = forgejoCfg.stateDir;
-  forgejoCustomPath = "${forgejoWorkPath}/custom";
-  forgejoConfigFile = "${forgejoCustomPath}/conf/app.ini";
-  forgejoAdminArgs = "--config ${lib.escapeShellArg forgejoConfigFile} --work-path ${lib.escapeShellArg forgejoWorkPath} --custom-path ${lib.escapeShellArg forgejoCustomPath}";
-  homeRepoPath = "/${cfg.homeOwner}/${cfg.homeRepo}";
-  homeRepoUrl = "https://${cfg.gitDomain}${homeRepoPath}";
-  sqlLiteral = value: "'${lib.replaceStrings [ "'" ] [ "''" ] value}'";
-in
-{
-  options.services.burrow.forge = {
-    enable = lib.mkEnableOption "the Burrow Forge host";
-
-    gitDomain = lib.mkOption {
-      type = lib.types.str;
-      default = "git.burrow.net";
-      description = "Public Forgejo domain.";
-    };
-
-    siteDomain = lib.mkOption {
-      type = lib.types.str;
-      default = "burrow.net";
-      description = "Root site domain.";
-    };
-
-    homeOwner = lib.mkOption {
-      type = lib.types.str;
-      default = "hackclub";
-      description = "Canonical Forgejo org/user for the Burrow home repository.";
-    };
-
-    homeRepo = lib.mkOption {
-      type = lib.types.str;
-      default = "burrow";
-      description = "Canonical Forgejo repository name for the Burrow home repository.";
-    };
-
-    contactEmail = lib.mkOption {
-      type = lib.types.str;
-      default = "contact@burrow.net";
-      description = "Operator contact email.";
-    };
-
-    nscAutoscalerDomain = lib.mkOption {
-      type = lib.types.str;
-      default = "nsc-autoscaler.burrow.net";
-      description = "Public webhook domain for the Forgejo Namespace autoscaler.";
-    };
-
-    adminUsername = lib.mkOption {
-      type = lib.types.str;
-      default = "contact";
-      description = "Initial Forgejo admin username.";
-    };
-
-    adminEmail = lib.mkOption {
-      type = lib.types.str;
-      default = "contact@burrow.net";
-      description = "Initial Forgejo admin email.";
-    };
-
-    adminPasswordFile = lib.mkOption {
-      type = lib.types.str;
-      description = "Host-local path to the plaintext bootstrap password file for the initial Forgejo admin.";
-    };
-
-    oidcDisplayName = lib.mkOption {
-      type = lib.types.str;
-      default = "burrow.net";
-      description = "Login button label for the Forgejo OIDC provider.";
-    };
-
-    oidcClientId = lib.mkOption {
-      type = lib.types.str;
-      default = "git.burrow.net";
-      description = "OIDC client ID that Forgejo should use against Authentik.";
-    };
-
-    oidcClientSecretFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = "Host-local path to the Forgejo OIDC client secret.";
-    };
-
-    oidcDiscoveryUrl = lib.mkOption {
-      type = lib.types.str;
-      default = "https://auth.burrow.net/application/o/git/.well-known/openid-configuration";
-      description = "OpenID Connect discovery URL for the Forgejo login source.";
-    };
-
-    oidcScopes = lib.mkOption {
-      type = with lib.types; listOf str;
-      default = [
-        "openid"
-        "profile"
-        "email"
-        "groups"
-      ];
-      description = "OIDC scopes requested from Authentik.";
-    };
-
-    oidcGroupClaimName = lib.mkOption {
-      type = lib.types.str;
-      default = "groups";
-      description = "OIDC claim name that carries group membership.";
-    };
-
-    oidcAdminGroup = lib.mkOption {
-      type = lib.types.str;
-      default = "burrow-admins";
-      description = "OIDC group that should grant Forgejo admin access.";
-    };
-
-    oidcRestrictedGroup = lib.mkOption {
-      type = lib.types.str;
-      default = "burrow-users";
-      description = "OIDC group that is required to log into Forgejo.";
-    };
-
-    oidcAutoRegistration = lib.mkOption {
-      type = lib.types.bool;
-      default = true;
-      description = "Whether Forgejo should automatically create users for new OIDC sign-ins.";
-    };
-
-    oidcAccountLinking = lib.mkOption {
-      type = lib.types.enum [ "disabled" "login" "auto" ];
-      default = "auto";
-      description = "How Forgejo should link existing local accounts for OIDC sign-ins.";
-    };
-
-    oidcUsernameSource = lib.mkOption {
-      type = lib.types.enum [ "userid" "nickname" "email" ];
-      default = "email";
-      description = "Which OIDC claim Forgejo should use to derive usernames for auto-registration.";
-    };
-
-    authorizedKeys = lib.mkOption {
-      type = with lib.types; listOf str;
-      default = [ ];
-      description = "SSH keys allowed for root login and operational bootstrap.";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    networking.hostName = "burrow-forge";
-    networking.useDHCP = lib.mkDefault true;
-
-    services.qemuGuest.enable = true;
-
-    boot.loader.grub = {
-      enable = true;
-      efiSupport = true;
-      efiInstallAsRemovable = true;
-      device = "nodev";
-    };
-
-    fileSystems."/boot".neededForBoot = true;
-
-    services.postgresql = {
-      enable = true;
-      package = pkgs.postgresql_16;
-    };
-
-    services.openssh = {
-      enable = true;
-      settings = {
-        PasswordAuthentication = false;
-        KbdInteractiveAuthentication = false;
-        PermitRootLogin = "prohibit-password";
-      };
-    };
-
-    users.users.root.openssh.authorizedKeys.keys = cfg.authorizedKeys;
-
-    networking.firewall.allowedTCPPorts = [
-      22
-      80
-      443
-      2222
-    ];
-
-    services.forgejo = {
-      enable = true;
-      database = {
-        type = "postgres";
-        createDatabase = true;
-      };
-      lfs.enable = true;
-      settings = {
-        server = {
-          DOMAIN = cfg.gitDomain;
-          ROOT_URL = "https://${cfg.gitDomain}/";
-          HTTP_PORT = 3000;
-          SSH_DOMAIN = cfg.gitDomain;
-          SSH_PORT = 2222;
-          START_SSH_SERVER = true;
-        };
-
-        service = {
-          DISABLE_REGISTRATION = true;
-          ENABLE_INTERNAL_SIGNIN = false;
-          ENABLE_BASIC_AUTHENTICATION = false;
-          SHOW_REGISTRATION_BUTTON = false;
-          REQUIRE_SIGNIN_VIEW = false;
-          DEFAULT_ALLOW_CREATE_ORGANIZATION = false;
-          ENABLE_NOTIFY_MAIL = false;
-          NO_REPLY_ADDRESS = cfg.adminEmail;
-        };
-
-        session = {
-          COOKIE_SECURE = true;
-          SAME_SITE = "strict";
-        };
-
-        openid = {
-          ENABLE_OPENID_SIGNIN = false;
-          ENABLE_OPENID_SIGNUP = false;
-        };
-
-        oauth2_client = {
-          OPENID_CONNECT_SCOPES = lib.concatStringsSep " " (lib.subtractLists [ "openid" ] cfg.oidcScopes);
-          ENABLE_AUTO_REGISTRATION = cfg.oidcAutoRegistration;
-          ACCOUNT_LINKING = cfg.oidcAccountLinking;
-          USERNAME = cfg.oidcUsernameSource;
-        };
-
-        actions = {
-          ENABLED = true;
-        };
-
-        repository = {
-          DEFAULT_BRANCH = "main";
-          ENABLE_PUSH_CREATE_USER = false;
-          DISABLE_MIRRORS = true;
-        };
-
-        ui = {
-          DEFAULT_THEME = "forgejo-auto";
-        };
-      };
-    };
-
-    services.caddy = {
-      enable = true;
-      email = cfg.contactEmail;
-      virtualHosts =
-        {
-          "${cfg.gitDomain}".extraConfig = ''
-            encode gzip zstd
-            @root path /
-            redir @root ${homeRepoPath} 308
-            reverse_proxy 127.0.0.1:${toString config.services.forgejo.settings.server.HTTP_PORT}
-          '';
-          "${cfg.siteDomain}".extraConfig = ''
-            encode gzip zstd
-            @oidcConfig path /.well-known/openid-configuration
-            redir @oidcConfig https://${config.services.burrow.authentik.domain}/application/o/${config.services.burrow.authentik.tailscaleProviderSlug}/.well-known/openid-configuration 308
-            @tailnetConfig path /.well-known/burrow-tailnet
-            header @tailnetConfig Content-Type application/json
-            respond @tailnetConfig "{\"domain\":\"${cfg.siteDomain}\",\"provider\":\"headscale\",\"authority\":\"https://${config.services.burrow.headscale.domain}\",\"oidc_issuer\":\"https://${config.services.burrow.authentik.domain}/application/o/${config.services.burrow.authentik.headscaleProviderSlug}/\"}" 200
-            @webfinger path /.well-known/webfinger
-            header @webfinger Content-Type application/jrd+json
-            respond @webfinger "{\"subject\":\"{query.resource}\",\"links\":[{\"rel\":\"http://openid.net/specs/connect/1.0/issuer\",\"href\":\"https://${config.services.burrow.authentik.domain}/application/o/${config.services.burrow.authentik.tailscaleProviderSlug}/\"},{\"rel\":\"https://burrow.net/rel/tailnet-control-server\",\"href\":\"https://${config.services.burrow.headscale.domain}\"}]}" 200
-            @root path /
-            redir @root ${homeRepoUrl} 308
-            respond 404
-          '';
-        }
-        // lib.optionalAttrs (
-          config.services.forgejo-nsc.enable && config.services.forgejo-nsc.autoscaler.enable
-        ) {
-          "${cfg.nscAutoscalerDomain}".extraConfig = ''
-            encode gzip zstd
-            reverse_proxy 127.0.0.1:8090
-          '';
-        };
-    };
-
-    systemd.services.burrow-forgejo-bootstrap = {
-      description = "Seed the initial Burrow Forgejo admin account";
-      after = [ "forgejo.service" ];
-      requires = [ "forgejo.service" ];
-      wantedBy = [ "multi-user.target" ];
-      path = [
-        forgejoCfg.package
-        pkgs.coreutils
-        pkgs.gnugrep
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = forgejoCfg.user;
-        Group = forgejoCfg.group;
-        WorkingDirectory = forgejoCfg.stateDir;
-      };
-      script = ''
-        set -euo pipefail
-
-        if [ ! -s ${lib.escapeShellArg cfg.adminPasswordFile} ]; then
-          echo "bootstrap password file is missing; skipping admin bootstrap" >&2
-          exit 0
-        fi
-
-        password="$(tr -d '\r\n' < ${lib.escapeShellArg cfg.adminPasswordFile})"
-        if [ -z "$password" ]; then
-          echo "bootstrap password file is empty; skipping admin bootstrap" >&2
-          exit 0
-        fi
-
-        log_file="$(mktemp)"
-        trap 'rm -f "$log_file"' EXIT
-
-        if ! ${forgejoExe} admin user create \
-          ${forgejoAdminArgs} \
-          --admin \
-          --username ${lib.escapeShellArg cfg.adminUsername} \
-          --email ${lib.escapeShellArg cfg.adminEmail} \
-          --password "$password" \
-          --must-change-password=false >"$log_file" 2>&1; then
-          if grep -qi "already exists" "$log_file"; then
-            ${forgejoExe} admin user change-password \
-              ${forgejoAdminArgs} \
-              --username ${lib.escapeShellArg cfg.adminUsername} \
-              --password "$password" \
-              --must-change-password=false
-          else
-            cat "$log_file" >&2
-            exit 1
-          fi
-        fi
-      '';
-    };
-
-    systemd.services.burrow-forgejo-repository-policy = {
-      description = "Apply Burrow Forgejo repository authority policy";
-      after = [
-        "forgejo.service"
-        "postgresql.service"
-      ];
-      requires = [
-        "forgejo.service"
-        "postgresql.service"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      path = [
-        pkgs.postgresql
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = forgejoCfg.user;
-        Group = forgejoCfg.group;
-        WorkingDirectory = forgejoCfg.stateDir;
-      };
-      script = ''
-        set -euo pipefail
-
-        ready=0
-        for attempt in $(seq 1 60); do
-          if ${pkgs.postgresql}/bin/psql -h /run/postgresql -U forgejo forgejo -tAc \
-            "SELECT 1 FROM pg_tables WHERE schemaname='public' AND tablename='repository';" \
-            | grep -q 1; then
-            ready=1
-            break
-          fi
-          sleep 1
-        done
-
-        if [ "$ready" -ne 1 ]; then
-          echo "Forgejo repository table did not become ready" >&2
-          exit 1
-        fi
-
-        ${pkgs.postgresql}/bin/psql -v ON_ERROR_STOP=1 \
-          -h /run/postgresql -U forgejo forgejo <<'SQL'
-        DO $$
-        DECLARE
-          repo_ids BIGINT[];
-        BEGIN
-          SELECT array_agg(r.id)
-            INTO repo_ids
-            FROM repository r
-            JOIN "user" u ON u.id = r.owner_id
-           WHERE u.lower_name = lower(${sqlLiteral cfg.homeOwner})
-             AND r.lower_name = lower(${sqlLiteral cfg.homeRepo});
-
-          IF repo_ids IS NULL THEN
-            RETURN;
-          END IF;
-
-          IF EXISTS (
-            SELECT 1
-              FROM information_schema.columns
-             WHERE table_schema = 'public'
-               AND table_name = 'repository'
-               AND column_name = 'is_mirror'
-          ) THEN
-            UPDATE repository SET is_mirror = FALSE WHERE id = ANY(repo_ids);
-          END IF;
-
-          IF to_regclass('public.mirror') IS NOT NULL THEN
-            DELETE FROM mirror WHERE repo_id = ANY(repo_ids);
-          END IF;
-
-          IF to_regclass('public.push_mirror') IS NOT NULL THEN
-            DELETE FROM push_mirror WHERE repo_id = ANY(repo_ids);
-          END IF;
-        END $$;
-        SQL
-      '';
-    };
-
-    systemd.services.burrow-forgejo-oidc-bootstrap = lib.mkIf (cfg.oidcClientSecretFile != null) {
-      description = "Seed the Burrow Forgejo OIDC login source";
-      after = [
-        "forgejo.service"
-        "postgresql.service"
-      ] ++ lib.optionals config.services.burrow.authentik.enable [
-        "burrow-authentik-ready.service"
-      ];
-      wants = lib.optionals config.services.burrow.authentik.enable [
-        "burrow-authentik-ready.service"
-      ];
-      requires = [
-        "forgejo.service"
-        "postgresql.service"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      restartTriggers = [
-        cfg.oidcClientSecretFile
-      ];
-      path = [
-        pkgs.coreutils
-        pkgs.gnugrep
-        pkgs.jq
-        pkgs.postgresql
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = forgejoCfg.user;
-        Group = forgejoCfg.group;
-        WorkingDirectory = forgejoCfg.stateDir;
-      };
-      script = ''
-        set -euo pipefail
-
-        if [ ! -s ${lib.escapeShellArg cfg.oidcClientSecretFile} ]; then
-          echo "Forgejo OIDC client secret missing: ${cfg.oidcClientSecretFile}" >&2
-          exit 1
-        fi
-
-        ready=0
-        for attempt in $(seq 1 60); do
-          if ${pkgs.postgresql}/bin/psql -h /run/postgresql -U forgejo forgejo -tAc \
-            "SELECT 1 FROM pg_tables WHERE schemaname='public' AND tablename='login_source';" \
-            | grep -q 1; then
-            ready=1
-            break
-          fi
-          sleep 1
-        done
-
-        if [ "$ready" -ne 1 ]; then
-          echo "Forgejo login_source table did not become ready" >&2
-          exit 1
-        fi
-
-        oidc_secret="$(${pkgs.coreutils}/bin/tr -d '\r\n' < ${lib.escapeShellArg cfg.oidcClientSecretFile})"
-        if [ -z "$oidc_secret" ]; then
-          echo "Forgejo OIDC client secret is empty" >&2
-          exit 1
-        fi
-
-        cfg_json="$(${pkgs.jq}/bin/jq -nc \
-          --arg client_id ${lib.escapeShellArg cfg.oidcClientId} \
-          --arg client_secret "$oidc_secret" \
-          --arg discovery_url ${lib.escapeShellArg cfg.oidcDiscoveryUrl} \
-          --argjson scopes '${builtins.toJSON cfg.oidcScopes}' \
-          --arg group_claim_name ${lib.escapeShellArg cfg.oidcGroupClaimName} \
-          --arg admin_group ${lib.escapeShellArg cfg.oidcAdminGroup} \
-          --arg restricted_group ${lib.escapeShellArg cfg.oidcRestrictedGroup} \
-          '{
-            Provider: "openidConnect",
-            ClientID: $client_id,
-            ClientSecret: $client_secret,
-            OpenIDConnectAutoDiscoveryURL: $discovery_url,
-            CustomURLMapping: null,
-            IconURL: "",
-            Scopes: $scopes,
-            AttributeSSHPublicKey: "",
-            RequiredClaimName: "",
-            RequiredClaimValue: "",
-            GroupClaimName: $group_claim_name,
-            AdminGroup: $admin_group,
-            GroupTeamMap: "",
-            GroupTeamMapRemoval: false,
-            RestrictedGroup: $restricted_group
-          }')"
-
-        ${pkgs.postgresql}/bin/psql -v ON_ERROR_STOP=1 \
-          -h /run/postgresql -U forgejo forgejo \
-          -v oidc_name=${lib.escapeShellArg cfg.oidcDisplayName} \
-          -v cfg_json="$cfg_json" <<'SQL'
-        INSERT INTO login_source (
-          type, name, is_active, is_sync_enabled, cfg, created_unix, updated_unix
-        ) VALUES (
-          6,
-          :'oidc_name',
-          TRUE,
-          FALSE,
-          :'cfg_json',
-          EXTRACT(EPOCH FROM NOW())::BIGINT,
-          EXTRACT(EPOCH FROM NOW())::BIGINT
-        )
-        ON CONFLICT (name) DO UPDATE SET
-          type = EXCLUDED.type,
-          is_active = TRUE,
-          is_sync_enabled = FALSE,
-          cfg = EXCLUDED.cfg,
-          updated_unix = EXCLUDED.updated_unix;
-        SQL
-      '';
-    };
-  };
-}
diff --git a/nixos/modules/burrow-garage.nix b/nixos/modules/burrow-garage.nix
deleted file mode 100644
index 993d5ba..0000000
--- a/nixos/modules/burrow-garage.nix
+++ /dev/null
@@ -1,284 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.services.burrow.garage;
-in
-{
-  options.services.burrow.garage = {
-    enable = lib.mkEnableOption "Burrow Garage S3-compatible object storage";
-
-    environmentFile = lib.mkOption {
-      type = lib.types.path;
-      default = "/var/lib/burrow/garage/env";
-      description = "Host-local environment file containing Garage and S3 bootstrap secrets.";
-    };
-
-    region = lib.mkOption {
-      type = lib.types.str;
-      default = "garage";
-      description = "S3 region name advertised by Garage.";
-    };
-
-    apiListenAddress = lib.mkOption {
-      type = lib.types.str;
-      default = "127.0.0.1";
-      description = "Address used by the Garage S3 API listener.";
-    };
-
-    apiPort = lib.mkOption {
-      type = lib.types.port;
-      default = 3900;
-      description = "Port used by the Garage S3 API listener.";
-    };
-
-    webListenAddress = lib.mkOption {
-      type = lib.types.str;
-      default = "127.0.0.1";
-      description = "Address used by the Garage static-web listener.";
-    };
-
-    webPort = lib.mkOption {
-      type = lib.types.port;
-      default = 3902;
-      description = "Port used by the Garage static-web listener.";
-    };
-
-    adminListenAddress = lib.mkOption {
-      type = lib.types.str;
-      default = "127.0.0.1";
-      description = "Address used by the Garage admin listener.";
-    };
-
-    adminPort = lib.mkOption {
-      type = lib.types.port;
-      default = 3903;
-      description = "Port used by the Garage admin listener.";
-    };
-
-    zone = lib.mkOption {
-      type = lib.types.str;
-      default = "burrow-forge";
-      description = "Garage layout zone assigned to the forge host.";
-    };
-
-    layoutCapacity = lib.mkOption {
-      type = lib.types.str;
-      default = "100GB";
-      description = "Initial Garage layout capacity assigned to the forge host.";
-    };
-
-    s3RootDomain = lib.mkOption {
-      type = lib.types.str;
-      default = "s3.burrow.net";
-      description = "Wildcard root domain used for bucket-style S3 API requests.";
-    };
-
-    webRootDomain = lib.mkOption {
-      type = lib.types.str;
-      default = "web.burrow.net";
-      description = "Wildcard root domain used for bucket static website requests.";
-    };
-
-    apiDomain = lib.mkOption {
-      type = lib.types.str;
-      default = "objects.burrow.net";
-      description = "Public S3 API reverse-proxy domain.";
-    };
-
-    enableApiProxy = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = "Expose the Garage S3 API through Caddy.";
-    };
-
-    enableWebProxy = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = "Expose the Garage static-web listener through Caddy wildcard routes.";
-    };
-
-    atticBucket = lib.mkOption {
-      type = lib.types.str;
-      default = "attic";
-      description = "Garage bucket used by the Burrow Nix cache.";
-    };
-
-    releaseBucket = lib.mkOption {
-      type = lib.types.str;
-      default = "burrow-releases";
-      description = "Garage bucket used for release artifacts.";
-    };
-
-    packageBucket = lib.mkOption {
-      type = lib.types.str;
-      default = "burrow-packages";
-      description = "Garage bucket used for signed package repositories.";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.garage = {
-      enable = true;
-      package = pkgs.garage;
-      environmentFile = cfg.environmentFile;
-      settings = {
-        metadata_dir = "/var/lib/garage/meta";
-        data_dir = "/var/lib/garage/data";
-        rpc_bind_addr = "127.0.0.1:3901";
-        rpc_public_addr = "127.0.0.1:3901";
-        replication_factor = 1;
-        s3_api = {
-          s3_region = cfg.region;
-          api_bind_addr = "${cfg.apiListenAddress}:${toString cfg.apiPort}";
-          root_domain = ".${cfg.s3RootDomain}";
-        };
-        s3_web = {
-          bind_addr = "${cfg.webListenAddress}:${toString cfg.webPort}";
-          root_domain = ".${cfg.webRootDomain}";
-          index = "index.html";
-        };
-        admin.api_bind_addr = "${cfg.adminListenAddress}:${toString cfg.adminPort}";
-      };
-    };
-
-    systemd.services.burrow-garage-env = {
-      description = "Create Burrow Garage bootstrap environment";
-      before = [ "garage.service" ];
-      wantedBy = [ "garage.service" ];
-      requiredBy = [ "garage.service" ];
-      path = [
-        pkgs.coreutils
-        pkgs.gnugrep
-        pkgs.openssl
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-        RemainAfterExit = true;
-      };
-      script = ''
-        set -euo pipefail
-
-        install -d -m 0700 "$(dirname ${lib.escapeShellArg cfg.environmentFile})"
-        touch ${lib.escapeShellArg cfg.environmentFile}
-        chmod 0600 ${lib.escapeShellArg cfg.environmentFile}
-        chown root:root ${lib.escapeShellArg cfg.environmentFile}
-
-        has_var() {
-          grep -q "^$1=" ${lib.escapeShellArg cfg.environmentFile}
-        }
-
-        add_var() {
-          local name="$1"
-          local value="$2"
-          if ! has_var "$name"; then
-            printf '%s=%s\n' "$name" "$value" >> ${lib.escapeShellArg cfg.environmentFile}
-          fi
-        }
-
-        add_var GARAGE_RPC_SECRET "$(${pkgs.openssl}/bin/openssl rand -hex 32)"
-        add_var GARAGE_ATTIC_ACCESS_KEY_ID "GK$(${pkgs.openssl}/bin/openssl rand -hex 12)"
-        add_var GARAGE_ATTIC_SECRET_ACCESS_KEY "$(${pkgs.openssl}/bin/openssl rand -hex 32)"
-        add_var GARAGE_RELEASE_ACCESS_KEY_ID "GK$(${pkgs.openssl}/bin/openssl rand -hex 12)"
-        add_var GARAGE_RELEASE_SECRET_ACCESS_KEY "$(${pkgs.openssl}/bin/openssl rand -hex 32)"
-        add_var GARAGE_PACKAGE_ACCESS_KEY_ID "GK$(${pkgs.openssl}/bin/openssl rand -hex 12)"
-        add_var GARAGE_PACKAGE_SECRET_ACCESS_KEY "$(${pkgs.openssl}/bin/openssl rand -hex 32)"
-        add_var GARAGE_BACKUP_ACCESS_KEY_ID "GK$(${pkgs.openssl}/bin/openssl rand -hex 12)"
-        add_var GARAGE_BACKUP_SECRET_ACCESS_KEY "$(${pkgs.openssl}/bin/openssl rand -hex 32)"
-        add_var ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64 "$(${pkgs.openssl}/bin/openssl genrsa -traditional 4096 | ${pkgs.coreutils}/bin/base64 -w0)"
-
-        . ${lib.escapeShellArg cfg.environmentFile}
-        add_var AWS_ACCESS_KEY_ID "$GARAGE_ATTIC_ACCESS_KEY_ID"
-        add_var AWS_SECRET_ACCESS_KEY "$GARAGE_ATTIC_SECRET_ACCESS_KEY"
-      '';
-    };
-
-    systemd.services.burrow-garage-bootstrap = {
-      description = "Bootstrap Burrow Garage layout, keys, and buckets";
-      after = [ "garage.service" ];
-      requires = [ "garage.service" ];
-      wantedBy = [ "multi-user.target" ];
-      path = [
-        config.services.garage.package
-        pkgs.coreutils
-        pkgs.gawk
-        pkgs.gnugrep
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-        set -a
-        . ${lib.escapeShellArg cfg.environmentFile}
-        set +a
-
-        for _ in $(seq 1 60); do
-          if garage status >/dev/null 2>&1; then
-            break
-          fi
-          sleep 1
-        done
-
-        node_id="$(garage status | tail -n1 | awk '{ print $1 }')"
-        if [ -n "$node_id" ]; then
-          garage layout assign -c ${lib.escapeShellArg cfg.layoutCapacity} -z ${lib.escapeShellArg cfg.zone} "$node_id" >/dev/null 2>&1 || true
-          garage layout apply --version 1 >/dev/null 2>&1 || true
-        fi
-
-        ensure_key() {
-          local key_id="$1"
-          local secret="$2"
-          if ! garage key info "$key_id" >/dev/null 2>&1; then
-            garage key import "$key_id" "$secret" --yes >/dev/null
-          fi
-        }
-
-        ensure_bucket() {
-          local bucket="$1"
-          local key_id="$2"
-          if ! garage bucket info "$bucket" >/dev/null 2>&1; then
-            garage bucket create "$bucket" >/dev/null
-          fi
-          garage bucket allow --read --write --owner "$bucket" --key "$key_id" >/dev/null
-        }
-
-        ensure_bucket_reader() {
-          local bucket="$1"
-          local key_id="$2"
-          garage bucket allow --read "$bucket" --key "$key_id" >/dev/null
-        }
-
-        ensure_key "$GARAGE_ATTIC_ACCESS_KEY_ID" "$GARAGE_ATTIC_SECRET_ACCESS_KEY"
-        ensure_key "$GARAGE_RELEASE_ACCESS_KEY_ID" "$GARAGE_RELEASE_SECRET_ACCESS_KEY"
-        ensure_key "$GARAGE_PACKAGE_ACCESS_KEY_ID" "$GARAGE_PACKAGE_SECRET_ACCESS_KEY"
-        ensure_key "$GARAGE_BACKUP_ACCESS_KEY_ID" "$GARAGE_BACKUP_SECRET_ACCESS_KEY"
-
-        ensure_bucket ${lib.escapeShellArg cfg.atticBucket} "$GARAGE_ATTIC_ACCESS_KEY_ID"
-        ensure_bucket ${lib.escapeShellArg cfg.releaseBucket} "$GARAGE_RELEASE_ACCESS_KEY_ID"
-        ensure_bucket ${lib.escapeShellArg cfg.packageBucket} "$GARAGE_PACKAGE_ACCESS_KEY_ID"
-        ensure_bucket_reader ${lib.escapeShellArg cfg.atticBucket} "$GARAGE_BACKUP_ACCESS_KEY_ID"
-        ensure_bucket_reader ${lib.escapeShellArg cfg.releaseBucket} "$GARAGE_BACKUP_ACCESS_KEY_ID"
-        ensure_bucket_reader ${lib.escapeShellArg cfg.packageBucket} "$GARAGE_BACKUP_ACCESS_KEY_ID"
-      '';
-    };
-
-    services.caddy.virtualHosts = lib.mkMerge [
-      (lib.mkIf cfg.enableApiProxy {
-        "${cfg.apiDomain}".extraConfig = ''
-          encode gzip zstd
-          reverse_proxy ${cfg.apiListenAddress}:${toString cfg.apiPort}
-        '';
-      })
-      (lib.mkIf cfg.enableWebProxy {
-        "*.${cfg.webRootDomain}".extraConfig = ''
-          encode gzip zstd
-          reverse_proxy ${cfg.webListenAddress}:${toString cfg.webPort}
-        '';
-      })
-    ];
-  };
-}
diff --git a/nixos/modules/burrow-headscale-policy.hujson b/nixos/modules/burrow-headscale-policy.hujson
deleted file mode 100644
index 8f0bcd2..0000000
--- a/nixos/modules/burrow-headscale-policy.hujson
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  // Bootstrap with a simple allow-all policy; Burrow-specific lane segmentation
-  // can be layered on once the control plane is live.
-  "acls": [
-    {
-      "action": "accept",
-      "src": ["*"],
-      "dst": ["*:*"],
-    },
-  ],
-}
diff --git a/nixos/modules/burrow-headscale.nix b/nixos/modules/burrow-headscale.nix
deleted file mode 100644
index b79fe48..0000000
--- a/nixos/modules/burrow-headscale.nix
+++ /dev/null
@@ -1,247 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.services.burrow.headscale;
-  policyFile = ./burrow-headscale-policy.hujson;
-in
-{
-  options.services.burrow.headscale = {
-    enable = lib.mkEnableOption "the Burrow Headscale control plane";
-
-    domain = lib.mkOption {
-      type = lib.types.str;
-      default = "ts.burrow.net";
-      description = "Public Headscale control-plane domain.";
-    };
-
-    tailDomain = lib.mkOption {
-      type = lib.types.str;
-      default = "tail.burrow.net";
-      description = "MagicDNS suffix served by Headscale.";
-    };
-
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 8413;
-      description = "Local Headscale listen port.";
-    };
-
-    enableMetrics = lib.mkOption {
-      type = lib.types.bool;
-      default = true;
-      description = "Expose Headscale Prometheus metrics on the local host.";
-    };
-
-    metricsListenAddress = lib.mkOption {
-      type = lib.types.str;
-      default = "127.0.0.1";
-      description = "Address used for the Headscale metrics listener.";
-    };
-
-    metricsPort = lib.mkOption {
-      type = lib.types.port;
-      default = 9098;
-      description = "Port used for the Headscale metrics listener.";
-    };
-
-    oidcIssuer = lib.mkOption {
-      type = lib.types.str;
-      default = "https://${config.services.burrow.authentik.domain}/application/o/${config.services.burrow.authentik.headscaleProviderSlug}/";
-      description = "OIDC issuer URL used by Headscale.";
-    };
-
-    oidcClientSecretFile = lib.mkOption {
-      type = lib.types.str;
-      default = config.services.burrow.authentik.headscaleClientSecretFile;
-      description = "Host-local file containing the OIDC client secret used by Headscale.";
-    };
-
-    bootstrapUsers = lib.mkOption {
-      type = with lib.types; listOf (submodule {
-        options = {
-          name = lib.mkOption {
-            type = str;
-            description = "Headscale username.";
-          };
-          displayName = lib.mkOption {
-            type = str;
-            description = "Friendly display name.";
-          };
-          email = lib.mkOption {
-            type = str;
-            description = "User email address.";
-          };
-        };
-      });
-      default = [
-        {
-          name = "contact";
-          displayName = "Burrow";
-          email = "contact@burrow.net";
-        }
-        {
-          name = "conrad";
-          displayName = "Conrad";
-          email = "conrad@burrow.net";
-        }
-        {
-          name = "agent";
-          displayName = "Agent";
-          email = "agent@burrow.net";
-        }
-        {
-          name = "infra";
-          displayName = "Infrastructure";
-          email = "infra@burrow.net";
-        }
-      ];
-      description = "Users to create or reconcile inside Headscale.";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.headscale ];
-
-    systemd.services.burrow-headscale-client-secret = {
-      description = "Ensure the Burrow Headscale OIDC client secret exists";
-      before =
-        [ "headscale.service" ]
-        ++ lib.optionals config.services.burrow.authentik.enable [ "burrow-authentik-runtime.service" ];
-      wantedBy =
-        [ "headscale.service" ]
-        ++ lib.optionals config.services.burrow.authentik.enable [ "burrow-authentik-runtime.service" ];
-      path = [
-        pkgs.coreutils
-        pkgs.openssl
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-        RemainAfterExit = true;
-      };
-      script = ''
-        set -euo pipefail
-
-        install -d -m 0755 /var/lib/burrow/intake
-
-        if [ ! -s ${lib.escapeShellArg cfg.oidcClientSecretFile} ]; then
-          umask 077
-          ${pkgs.openssl}/bin/openssl rand -base64 48 > ${lib.escapeShellArg cfg.oidcClientSecretFile}
-          chown root:root ${lib.escapeShellArg cfg.oidcClientSecretFile}
-          chmod 0400 ${lib.escapeShellArg cfg.oidcClientSecretFile}
-        fi
-      '';
-    };
-
-    services.headscale = {
-      enable = true;
-      address = "127.0.0.1";
-      port = cfg.port;
-      settings = {
-        server_url = "https://${cfg.domain}";
-        dns = {
-          magic_dns = true;
-          base_domain = cfg.tailDomain;
-          nameservers.global = [
-            "1.1.1.1"
-            "1.0.0.1"
-            "2606:4700:4700::1111"
-            "2606:4700:4700::1001"
-          ];
-          search_domains = [ cfg.tailDomain ];
-        };
-        database.sqlite.write_ahead_log = true;
-        log.level = "info";
-        policy = {
-          mode = "file";
-          path = policyFile;
-        };
-        oidc = {
-          only_start_if_oidc_is_available = true;
-          issuer = cfg.oidcIssuer;
-          client_id = cfg.domain;
-          client_secret_path = "\${CREDENTIALS_DIRECTORY}/oidc_client_secret";
-          scope = [
-            "openid"
-            "profile"
-            "email"
-          ];
-          pkce = {
-            enabled = true;
-            method = "S256";
-          };
-        };
-      } // lib.optionalAttrs cfg.enableMetrics {
-        metrics_listen_addr = "${cfg.metricsListenAddress}:${toString cfg.metricsPort}";
-      };
-    };
-
-    systemd.services.headscale = {
-      after =
-        [ "burrow-headscale-client-secret.service" ]
-        ++ lib.optionals config.services.burrow.authentik.enable [ "burrow-authentik-ready.service" ];
-      wants =
-        [ "burrow-headscale-client-secret.service" ]
-        ++ lib.optionals config.services.burrow.authentik.enable [ "burrow-authentik-ready.service" ];
-      requires =
-        [ "burrow-headscale-client-secret.service" ]
-        ++ lib.optionals config.services.burrow.authentik.enable [ "burrow-authentik-ready.service" ];
-      serviceConfig.LoadCredential = [
-        "oidc_client_secret:${cfg.oidcClientSecretFile}"
-      ];
-    };
-
-    systemd.services.headscale-bootstrap = {
-      description = "Bootstrap Burrow Headscale users";
-      after = [ "headscale.service" ];
-      requires = [ "headscale.service" ];
-      wantedBy = [ "multi-user.target" ];
-      path = [
-        pkgs.coreutils
-        pkgs.headscale
-        pkgs.jq
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-
-        list_users() {
-          local users_json
-          users_json="$(${pkgs.headscale}/bin/headscale users list -o json)"
-          printf '%s\n' "$users_json" | ${pkgs.jq}/bin/jq -c 'if type == "array" then . else [] end'
-        }
-
-        ensure_user() {
-          local name="$1"
-          local display_name="$2"
-          local email="$3"
-          if list_users | ${pkgs.jq}/bin/jq -e --arg name "$name" 'map(select(.name == $name)) | length > 0' >/dev/null; then
-            return 0
-          fi
-          ${pkgs.headscale}/bin/headscale users create "$name" --display-name "$display_name" --email "$email" >/dev/null
-        }
-
-        for _ in $(seq 1 60); do
-          if list_users >/dev/null 2>&1; then
-            break
-          fi
-          sleep 1
-        done
-
-        ${lib.concatMapStringsSep "\n" (user: ''
-          ensure_user ${lib.escapeShellArg user.name} ${lib.escapeShellArg user.displayName} ${lib.escapeShellArg user.email}
-        '') cfg.bootstrapUsers}
-      '';
-    };
-
-    services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
-      encode gzip zstd
-      reverse_proxy 127.0.0.1:${toString cfg.port}
-    '';
-  };
-}
diff --git a/nixos/modules/burrow-jitsi.nix b/nixos/modules/burrow-jitsi.nix
deleted file mode 100644
index 6041632..0000000
--- a/nixos/modules/burrow-jitsi.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-{ config, lib, ... }:
-
-let
-  cfg = config.services.burrow.jitsi;
-in
-{
-  options.services.burrow.jitsi = {
-    enable = lib.mkEnableOption "the Burrow Jitsi Meet deployment";
-
-    domain = lib.mkOption {
-      type = lib.types.str;
-      default = "meet.burrow.net";
-      description = "Public Jitsi Meet domain.";
-    };
-
-    videobridgeUdpPort = lib.mkOption {
-      type = lib.types.port;
-      default = 10000;
-      description = "Public UDP port used by Jitsi Videobridge media traffic.";
-    };
-
-    enableHttpProxy = lib.mkOption {
-      type = lib.types.bool;
-      default = true;
-      description = "Expose Jitsi through the repo-owned Caddy reverse proxy.";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.jitsi-meet = {
-      enable = true;
-      hostName = cfg.domain;
-      nginx.enable = false;
-    };
-
-    services.jitsi-videobridge.openFirewall = true;
-
-    networking.firewall.allowedUDPPorts = [ cfg.videobridgeUdpPort ];
-
-    services.caddy.virtualHosts."${cfg.domain}".extraConfig = lib.mkIf cfg.enableHttpProxy ''
-      encode gzip zstd
-      reverse_proxy 127.0.0.1:5280
-    '';
-  };
-}
diff --git a/nixos/modules/burrow-nix-cache.nix b/nixos/modules/burrow-nix-cache.nix
deleted file mode 100644
index 420d3b9..0000000
--- a/nixos/modules/burrow-nix-cache.nix
+++ /dev/null
@@ -1,163 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.services.burrow.nixCache;
-  garageCfg = config.services.burrow.garage;
-in
-{
-  options.services.burrow.nixCache = {
-    enable = lib.mkEnableOption "Burrow Nix binary cache";
-
-    domain = lib.mkOption {
-      type = lib.types.str;
-      default = "nix.burrow.net";
-      description = "Public domain for the Burrow Nix binary cache.";
-    };
-
-    listenAddress = lib.mkOption {
-      type = lib.types.str;
-      default = "127.0.0.1";
-      description = "Attic listen address.";
-    };
-
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 8080;
-      description = "Attic listen port.";
-    };
-
-    cacheName = lib.mkOption {
-      type = lib.types.str;
-      default = "burrow";
-      description = "Default public Attic cache name.";
-    };
-
-    environmentFile = lib.mkOption {
-      type = lib.types.path;
-      default = garageCfg.environmentFile;
-      description = "Environment file containing Attic JWT and Garage S3 credentials.";
-    };
-
-    adminTokenFile = lib.mkOption {
-      type = lib.types.path;
-      default = "/var/lib/burrow/nix-cache/admin-token";
-      description = "Host-local file containing the generated Attic admin token.";
-    };
-
-    ciPushTokenFile = lib.mkOption {
-      type = lib.types.path;
-      default = "/var/lib/burrow/nix-cache/ci-push-token";
-      description = "Host-local file containing the generated Attic CI push token.";
-    };
-
-    ciPushTokenValidity = lib.mkOption {
-      type = lib.types.str;
-      default = "1y";
-      description = "Validity duration for the generated Attic CI push token.";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = garageCfg.enable;
-        message = "services.burrow.nixCache requires services.burrow.garage.enable = true.";
-      }
-    ];
-
-    services.atticd = {
-      enable = true;
-      environmentFile = cfg.environmentFile;
-      settings = {
-        listen = "${cfg.listenAddress}:${toString cfg.port}";
-        allowed-hosts = [ cfg.domain ];
-        api-endpoint = "https://${cfg.domain}/";
-        require-proof-of-possession = true;
-        storage = {
-          type = "s3";
-          bucket = garageCfg.atticBucket;
-          region = garageCfg.region;
-          endpoint = "http://${garageCfg.apiListenAddress}:${toString garageCfg.apiPort}";
-        };
-      };
-    };
-
-    environment.systemPackages = [
-      pkgs.attic-client
-    ];
-
-    services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
-      encode gzip zstd
-      reverse_proxy ${cfg.listenAddress}:${toString cfg.port}
-    '';
-
-    systemd.services.atticd = {
-      after = [ "burrow-garage-bootstrap.service" ];
-      wants = [ "burrow-garage-bootstrap.service" ];
-      requires = [ "burrow-garage-bootstrap.service" ];
-    };
-
-    systemd.services.burrow-nix-cache-bootstrap = {
-      description = "Bootstrap Burrow Nix binary cache";
-      after = [ "atticd.service" ];
-      requires = [ "atticd.service" ];
-      wantedBy = [ "multi-user.target" ];
-      path = [
-        pkgs.attic-client
-        pkgs.attic-server
-        pkgs.coreutils
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-
-        install -d -m 0700 "$(dirname ${lib.escapeShellArg cfg.adminTokenFile})"
-        install -d -m 0700 "$(dirname ${lib.escapeShellArg cfg.ciPushTokenFile})"
-
-        for _ in $(seq 1 60); do
-          if (: > /dev/tcp/${cfg.listenAddress}/${toString cfg.port}) >/dev/null 2>&1; then
-            break
-          fi
-          sleep 1
-        done
-
-        if [ ! -s ${lib.escapeShellArg cfg.adminTokenFile} ]; then
-          umask 077
-          atticadm make-token \
-            --sub burrow-nix-cache-bootstrap \
-            --validity 10y \
-            --create-cache '*' \
-            --pull '*' \
-            --push '*' \
-            --delete '*' \
-            --configure-cache '*' \
-            --configure-cache-retention '*' \
-            > ${lib.escapeShellArg cfg.adminTokenFile}
-        fi
-
-        token="$(cat ${lib.escapeShellArg cfg.adminTokenFile})"
-        export HOME=/var/lib/burrow/nix-cache
-        install -d -m 0700 "$HOME"
-
-        attic login local http://${cfg.listenAddress}:${toString cfg.port} "$token" --set-default
-        if ! attic cache info ${lib.escapeShellArg "local:${cfg.cacheName}"} >/dev/null 2>&1; then
-          attic cache create --public --priority 39 ${lib.escapeShellArg "local:${cfg.cacheName}"}
-        fi
-
-        if [ ! -s ${lib.escapeShellArg cfg.ciPushTokenFile} ]; then
-          umask 077
-          atticadm make-token \
-            --sub burrow-ci-cache-publisher \
-            --validity ${lib.escapeShellArg cfg.ciPushTokenValidity} \
-            --pull ${lib.escapeShellArg cfg.cacheName} \
-            --push ${lib.escapeShellArg cfg.cacheName} \
-            > ${lib.escapeShellArg cfg.ciPushTokenFile}
-        fi
-      '';
-    };
-  };
-}
diff --git a/nixos/modules/burrow-observability.nix b/nixos/modules/burrow-observability.nix
deleted file mode 100644
index 090c2ee..0000000
--- a/nixos/modules/burrow-observability.nix
+++ /dev/null
@@ -1,302 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.services.burrow.observability;
-  otelCollectorPackage =
-    if builtins.hasAttr "opentelemetry-collector-contrib" pkgs then
-      pkgs."opentelemetry-collector-contrib"
-    else
-      pkgs.opentelemetry-collector;
-  garageCfg = config.services.burrow.garage;
-  headscaleCfg = config.services.burrow.headscale;
-  grafanaHttpPort = config.services.grafana.settings.server.http_port or 3000;
-  grafanaHttpAddress = config.services.grafana.settings.server.http_addr or "127.0.0.1";
-  tailscaleExporterEnabled = cfg.tailscaleExporterEnvironmentFile != null;
-in
-{
-  options.services.burrow.observability = {
-    enable = lib.mkEnableOption "Burrow Prometheus, OpenTelemetry, Jaeger, and Grafana wiring";
-
-    prometheusListenAddress = lib.mkOption {
-      type = lib.types.str;
-      default = "127.0.0.1";
-      description = "Address used by the local Prometheus server.";
-    };
-
-    prometheusPort = lib.mkOption {
-      type = lib.types.port;
-      default = 9090;
-      description = "Port used by the local Prometheus server.";
-    };
-
-    otelGrpcEndpoint = lib.mkOption {
-      type = lib.types.str;
-      default = "127.0.0.1:4317";
-      description = "Local OTLP gRPC endpoint accepted by the OpenTelemetry collector.";
-    };
-
-    otelHttpEndpoint = lib.mkOption {
-      type = lib.types.str;
-      default = "127.0.0.1:4318";
-      description = "Local OTLP HTTP endpoint accepted by the OpenTelemetry collector.";
-    };
-
-    otelPrometheusEndpoint = lib.mkOption {
-      type = lib.types.str;
-      default = "127.0.0.1:9464";
-      description = "Prometheus endpoint where the OpenTelemetry collector exports its own metrics.";
-    };
-
-    jaegerImage = lib.mkOption {
-      type = lib.types.str;
-      default = "docker.io/jaegertracing/all-in-one:1.57";
-      description = "OCI image used for the local Jaeger all-in-one service.";
-    };
-
-    jaegerUiPort = lib.mkOption {
-      type = lib.types.port;
-      default = 16686;
-      description = "Local Jaeger UI and query API port.";
-    };
-
-    jaegerOtlpGrpcPort = lib.mkOption {
-      type = lib.types.port;
-      default = 14317;
-      description = "Local remapped OTLP gRPC port forwarded to Jaeger.";
-    };
-
-    jaegerOtlpHttpPort = lib.mkOption {
-      type = lib.types.port;
-      default = 14318;
-      description = "Local remapped OTLP HTTP port forwarded to Jaeger.";
-    };
-
-    jaegerAdminPort = lib.mkOption {
-      type = lib.types.port;
-      default = 14269;
-      description = "Local Jaeger admin and metrics port.";
-    };
-
-    tailscaleExporterEnvironmentFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      default = null;
-      description = "Optional environment file for the Prometheus Tailscale exporter OAuth credentials.";
-    };
-  };
-
-  config = lib.mkIf cfg.enable (lib.mkMerge [
-    {
-      virtualisation.podman.enable = true;
-
-      services.grafana = {
-        settings = {
-          metrics = {
-            enabled = true;
-            disable_total_stats = true;
-          };
-        };
-        provision = {
-          enable = true;
-          datasources.settings = {
-            apiVersion = 1;
-            prune = true;
-            datasources = [
-              {
-                name = "Prometheus";
-                uid = "prometheus";
-                type = "prometheus";
-                access = "proxy";
-                url = "http://${cfg.prometheusListenAddress}:${toString cfg.prometheusPort}";
-                isDefault = true;
-                jsonData = {
-                  timeInterval = "15s";
-                  httpMethod = "POST";
-                };
-              }
-              {
-                name = "Jaeger";
-                uid = "jaeger";
-                type = "jaeger";
-                access = "proxy";
-                url = "http://127.0.0.1:${toString cfg.jaegerUiPort}";
-              }
-            ];
-          };
-        };
-      };
-
-      services.prometheus = {
-        enable = true;
-        listenAddress = cfg.prometheusListenAddress;
-        port = cfg.prometheusPort;
-        retentionTime = "30d";
-        checkConfig = "syntax-only";
-        exporters = {
-          node = {
-            enable = true;
-            listenAddress = "127.0.0.1";
-          };
-          systemd = {
-            enable = true;
-            listenAddress = "127.0.0.1";
-          };
-        };
-        scrapeConfigs = [
-          {
-            job_name = "prometheus";
-            static_configs = [
-              { targets = [ "${cfg.prometheusListenAddress}:${toString cfg.prometheusPort}" ]; }
-            ];
-          }
-          {
-            job_name = "node";
-            static_configs = [
-              { targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ]; }
-            ];
-          }
-          {
-            job_name = "systemd";
-            static_configs = [
-              { targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.systemd.port}" ]; }
-            ];
-          }
-          {
-            job_name = "grafana";
-            metrics_path = "/metrics";
-            static_configs = [
-              { targets = [ "${grafanaHttpAddress}:${toString grafanaHttpPort}" ]; }
-            ];
-          }
-          {
-            job_name = "headscale";
-            metrics_path = "/metrics";
-            static_configs = [
-              { targets = [ "${headscaleCfg.metricsListenAddress}:${toString headscaleCfg.metricsPort}" ]; }
-            ];
-          }
-          {
-            job_name = "otel-collector";
-            static_configs = [
-              { targets = [ cfg.otelPrometheusEndpoint ]; }
-            ];
-          }
-          {
-            job_name = "jaeger";
-            metrics_path = "/metrics";
-            static_configs = [
-              { targets = [ "127.0.0.1:${toString cfg.jaegerAdminPort}" ]; }
-            ];
-          }
-        ] ++ lib.optionals garageCfg.enable [
-          {
-            job_name = "garage";
-            metrics_path = "/metrics";
-            static_configs = [
-              { targets = [ "${garageCfg.adminListenAddress}:${toString garageCfg.adminPort}" ]; }
-            ];
-          }
-        ] ++ lib.optionals tailscaleExporterEnabled [
-          {
-            job_name = "tailscale";
-            static_configs = [
-              { targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.tailscale.port}" ]; }
-            ];
-          }
-        ];
-      };
-
-      services.opentelemetry-collector = {
-        enable = true;
-        package = otelCollectorPackage;
-        settings = {
-          receivers = {
-            otlp = {
-              protocols = {
-                grpc.endpoint = cfg.otelGrpcEndpoint;
-                http.endpoint = cfg.otelHttpEndpoint;
-              };
-            };
-          };
-          processors = {
-            resource.attributes = [
-              {
-                key = "service.namespace";
-                value = "burrow";
-                action = "upsert";
-              }
-              {
-                key = "deployment.environment";
-                value = config.networking.hostName;
-                action = "upsert";
-              }
-            ];
-            batch = { };
-          };
-          exporters = {
-            "otlp/jaeger" = {
-              endpoint = "127.0.0.1:${toString cfg.jaegerOtlpGrpcPort}";
-              tls.insecure = true;
-            };
-            prometheus.endpoint = cfg.otelPrometheusEndpoint;
-          };
-          service.pipelines = {
-            traces = {
-              receivers = [ "otlp" ];
-              processors = [
-                "resource"
-                "batch"
-              ];
-              exporters = [ "otlp/jaeger" ];
-            };
-            metrics = {
-              receivers = [ "otlp" ];
-              processors = [
-                "resource"
-                "batch"
-              ];
-              exporters = [ "prometheus" ];
-            };
-          };
-        };
-      };
-
-      virtualisation.oci-containers.containers.burrow-jaeger = {
-        image = cfg.jaegerImage;
-        autoStart = true;
-        environment = {
-          COLLECTOR_OTLP_ENABLED = "true";
-          SPAN_STORAGE_TYPE = "badger";
-          BADGER_EPHEMERAL = "false";
-          BADGER_DIRECTORY_VALUE = "/badger/data";
-          BADGER_DIRECTORY_KEY = "/badger/key";
-        };
-        volumes = [
-          "burrow-jaeger-badger:/badger"
-        ];
-        ports = [
-          "127.0.0.1:${toString cfg.jaegerUiPort}:16686"
-          "127.0.0.1:${toString cfg.jaegerOtlpGrpcPort}:4317"
-          "127.0.0.1:${toString cfg.jaegerOtlpHttpPort}:4318"
-          "127.0.0.1:${toString cfg.jaegerAdminPort}:14269"
-        ];
-        extraOptions = [ "--pull=always" ];
-      };
-
-      systemd.services.opentelemetry-collector.after = [ "podman-burrow-jaeger.service" ];
-      systemd.services.opentelemetry-collector.wants = [ "podman-burrow-jaeger.service" ];
-
-      environment.sessionVariables = {
-        OTEL_EXPORTER_OTLP_ENDPOINT = "http://${cfg.otelGrpcEndpoint}";
-        OTEL_EXPORTER_OTLP_PROTOCOL = "grpc";
-      };
-    }
-
-    (lib.mkIf tailscaleExporterEnabled {
-      services.prometheus.exporters.tailscale = {
-        enable = true;
-        listenAddress = "127.0.0.1";
-        environmentFile = cfg.tailscaleExporterEnvironmentFile;
-      };
-    })
-  ]);
-}
diff --git a/nixos/modules/burrow-openbao.nix b/nixos/modules/burrow-openbao.nix
deleted file mode 100644
index 82f7718..0000000
--- a/nixos/modules/burrow-openbao.nix
+++ /dev/null
@@ -1,101 +0,0 @@
-{ config, lib, ... }:
-
-let
-  cfg = config.services.burrow.openbao;
-in
-{
-  options.services.burrow.openbao = {
-    enable = lib.mkEnableOption "the Burrow OpenBao deployment";
-
-    domain = lib.mkOption {
-      type = lib.types.str;
-      default = "vault.burrow.net";
-      description = "Public OpenBao domain.";
-    };
-
-    listenAddress = lib.mkOption {
-      type = lib.types.str;
-      default = "127.0.0.1";
-      description = "Local OpenBao listener address.";
-    };
-
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 8200;
-      description = "Local OpenBao API port.";
-    };
-
-    clusterPort = lib.mkOption {
-      type = lib.types.port;
-      default = 8201;
-      description = "Local OpenBao cluster port.";
-    };
-
-    dataDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/burrow/openbao";
-      description = "Persistent OpenBao state directory.";
-    };
-
-    googleKmsSeal = {
-      enable = lib.mkEnableOption "Google Cloud KMS seal wrapping";
-
-      project = lib.mkOption {
-        type = lib.types.str;
-        default = "project-88c23ce9-918a-470a-b33";
-        description = "Google Cloud project containing the seal key.";
-      };
-
-      location = lib.mkOption {
-        type = lib.types.str;
-        default = "global";
-        description = "Google Cloud KMS key ring location.";
-      };
-
-      keyRing = lib.mkOption {
-        type = lib.types.str;
-        default = "burrow-identity";
-        description = "Google Cloud KMS key ring name.";
-      };
-
-      cryptoKey = lib.mkOption {
-        type = lib.types.str;
-        default = "openbao-seal";
-        description = "Google Cloud KMS crypto key name used for seal wrapping.";
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.tmpfiles.rules = [
-      "d ${cfg.dataDir} 0700 openbao openbao - -"
-      "d ${cfg.dataDir}/data 0700 openbao openbao - -"
-    ];
-
-    services.openbao = {
-      enable = true;
-      settings = {
-        ui = true;
-        api_addr = "https://${cfg.domain}";
-        cluster_addr = "http://${cfg.listenAddress}:${toString cfg.clusterPort}";
-        storage.file.path = "${cfg.dataDir}/data";
-        listener.tcp = {
-          address = "${cfg.listenAddress}:${toString cfg.port}";
-          tls_disable = true;
-        };
-      } // lib.optionalAttrs cfg.googleKmsSeal.enable {
-        seal.gcpckms = {
-          project = cfg.googleKmsSeal.project;
-          region = cfg.googleKmsSeal.location;
-          key_ring = cfg.googleKmsSeal.keyRing;
-          crypto_key = cfg.googleKmsSeal.cryptoKey;
-        };
-      };
-    };
-
-    services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
-      encode gzip zstd
-      reverse_proxy ${cfg.listenAddress}:${toString cfg.port}
-    '';
-  };
-}
diff --git a/nixos/modules/burrow-zulip.nix b/nixos/modules/burrow-zulip.nix
deleted file mode 100644
index 9670694..0000000
--- a/nixos/modules/burrow-zulip.nix
+++ /dev/null
@@ -1,587 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.services.burrow.zulip;
-  realmSignupDomain =
-    let
-      parts = lib.splitString "@" cfg.administratorEmail;
-    in
-    if builtins.length parts == 2 then builtins.elemAt parts 1 else cfg.domain;
-  yamlFormat = pkgs.formats.yaml { };
-  composeFile = yamlFormat.generate "burrow-zulip-compose.yaml" {
-    services = {
-      zulip = {
-        image = "ghcr.io/zulip/zulip-server:11.6-1";
-        restart = "unless-stopped";
-        network_mode = "host";
-        secrets = [
-          "zulip__postgres_password"
-          "zulip__rabbitmq_password"
-          "zulip__redis_password"
-          "zulip__secret_key"
-          "zulip__email_password"
-        ];
-        environment = {
-          SETTING_REMOTE_POSTGRES_HOST = "127.0.0.1";
-          SETTING_MEMCACHED_LOCATION = "127.0.0.1:11211";
-          SETTING_RABBITMQ_HOST = "127.0.0.1";
-          SETTING_REDIS_HOST = "127.0.0.1";
-        };
-        volumes = [ "${cfg.dataDir}/data:/data:rw" ];
-        ulimits.nofile = {
-          soft = 1000000;
-          hard = 1048576;
-        };
-      };
-    };
-  };
-in
-{
-  options.services.burrow.zulip = {
-    enable = lib.mkEnableOption "the Burrow Zulip deployment";
-
-    domain = lib.mkOption {
-      type = lib.types.str;
-      default = "chat.burrow.net";
-      description = "Public Zulip domain.";
-    };
-
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 18090;
-      description = "Local loopback port Caddy should proxy to.";
-    };
-
-    dataDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/burrow/zulip";
-      description = "Host directory storing Zulip compose state and generated runtime files.";
-    };
-
-    administratorEmail = lib.mkOption {
-      type = lib.types.str;
-      default = "contact@burrow.net";
-      description = "Operational Zulip administrator email.";
-    };
-
-    realmName = lib.mkOption {
-      type = lib.types.str;
-      default = "Burrow";
-      description = "Initial Zulip organization name for single-tenant bootstrap.";
-    };
-
-    realmOwnerName = lib.mkOption {
-      type = lib.types.str;
-      default = "Burrow";
-      description = "Display name used for the initial Zulip organization owner.";
-    };
-
-    authentikDomain = lib.mkOption {
-      type = lib.types.str;
-      default = config.services.burrow.authentik.domain;
-      description = "Authentik domain Zulip should trust as its SAML IdP.";
-    };
-
-    authentikProviderSlug = lib.mkOption {
-      type = lib.types.str;
-      default = config.services.burrow.authentik.zulipProviderSlug;
-      description = "Authentik SAML application slug used for Zulip.";
-    };
-
-    postgresPasswordFile = lib.mkOption {
-      type = lib.types.str;
-      description = "File containing the Zulip PostgreSQL password.";
-    };
-
-    rabbitmqPasswordFile = lib.mkOption {
-      type = lib.types.str;
-      description = "File containing the Zulip RabbitMQ password.";
-    };
-
-    redisPasswordFile = lib.mkOption {
-      type = lib.types.str;
-      description = "File containing the Zulip Redis password.";
-    };
-
-    secretKeyFile = lib.mkOption {
-      type = lib.types.str;
-      description = "File containing the Zulip Django secret key.";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    environment.systemPackages = [
-      pkgs.podman
-      pkgs.podman-compose
-    ];
-
-    services.postgresql = {
-      ensureDatabases = [ "zulip" ];
-      ensureUsers = [
-        {
-          name = "zulip";
-          ensureDBOwnership = true;
-        }
-      ];
-      settings = {
-        listen_addresses = lib.mkDefault "127.0.0.1";
-        password_encryption = lib.mkDefault "scram-sha-256";
-      };
-      authentication = lib.mkAfter ''
-        host zulip zulip 127.0.0.1/32 scram-sha-256
-      '';
-    };
-
-    services.postgresqlBackup = {
-      enable = true;
-      backupAll = false;
-      databases = [ "zulip" ];
-    };
-
-    services.memcached = {
-      enable = true;
-      listen = "127.0.0.1";
-      port = 11211;
-      extraOptions = [ "-U 0" ];
-    };
-
-    services.redis.servers.zulip = {
-      enable = true;
-      bind = "127.0.0.1";
-      port = 6379;
-      requirePassFile = cfg.redisPasswordFile;
-    };
-
-    services.rabbitmq = {
-      enable = true;
-      listenAddress = "127.0.0.1";
-      port = 5672;
-    };
-
-    services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
-      encode gzip zstd
-      reverse_proxy 127.0.0.1:${toString cfg.port}
-    '';
-
-    systemd.tmpfiles.rules = [
-      "d ${cfg.dataDir} 0755 root root - -"
-      "d ${cfg.dataDir}/data 0755 root root - -"
-      "d ${cfg.dataDir}/data/logs 0755 root root - -"
-      "d ${cfg.dataDir}/data/logs/emails 0755 root root - -"
-      "d ${cfg.dataDir}/data/secrets 0700 root root - -"
-      "d ${cfg.dataDir}/secrets 0700 root root - -"
-      "d ${cfg.dataDir}/logs 0755 root root - -"
-    ];
-
-    systemd.services.burrow-zulip-postgres-bootstrap = {
-      description = "Bootstrap PostgreSQL role for Burrow Zulip";
-      after = [ "postgresql.service" ];
-      wants = [ "postgresql.service" ];
-      requiredBy = [ "burrow-zulip.service" ];
-      before = [ "burrow-zulip.service" ];
-      path = [
-        config.services.postgresql.package
-        pkgs.bash
-        pkgs.coreutils
-        pkgs.python3
-        pkgs.util-linux
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-
-        db_password="$(tr -d '\r\n' < ${lib.escapeShellArg cfg.postgresPasswordFile})"
-        db_password_sql="$(printf '%s' "$db_password" | python3 -c "import sys; print(sys.stdin.read().replace(chr(39), chr(39) * 2), end=\"\")")"
-        setup_sql="$(mktemp)"
-        trap 'rm -f "$setup_sql"' EXIT
-
-        cat > "$setup_sql" <<SQL
-DO \$\$
-BEGIN
-  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'zulip') THEN
-    CREATE ROLE zulip LOGIN;
-  END IF;
-END
-\$\$;
-ALTER ROLE zulip WITH LOGIN PASSWORD '$db_password_sql';
-SQL
-        chmod 0644 "$setup_sql"
-
-        ${pkgs.util-linux}/bin/runuser -u postgres -- psql -v ON_ERROR_STOP=1 -f "$setup_sql"
-      '';
-    };
-
-    systemd.services.burrow-zulip-rabbitmq-bootstrap = {
-      description = "Bootstrap RabbitMQ user for Burrow Zulip";
-      after = [ "rabbitmq.service" ];
-      wants = [ "rabbitmq.service" ];
-      requiredBy = [ "burrow-zulip.service" ];
-      before = [ "burrow-zulip.service" ];
-      path = [
-        config.services.rabbitmq.package
-        pkgs.bash
-        pkgs.coreutils
-        pkgs.gawk
-        pkgs.gnugrep
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-
-        rabbit_password="$(tr -d '\r\n' < ${lib.escapeShellArg cfg.rabbitmqPasswordFile})"
-        export HOME=${config.services.rabbitmq.dataDir}
-
-        rabbitmqctl await_startup
-
-        if rabbitmqctl list_users -q | awk '{ print $1 }' | grep -qx zulip; then
-          rabbitmqctl change_password zulip "$rabbit_password"
-        else
-          rabbitmqctl add_user zulip "$rabbit_password"
-        fi
-
-        rabbitmqctl set_permissions -p / zulip '.*' '.*' '.*'
-
-        if rabbitmqctl list_users -q | awk '{ print $1 }' | grep -qx guest; then
-          rabbitmqctl delete_user guest
-        fi
-      '';
-    };
-
-    systemd.services.burrow-zulip-runtime = {
-      description = "Prepare Burrow Zulip compose and SAML runtime files";
-      after = [
-        "postgresql.service"
-        "redis-zulip.service"
-        "memcached.service"
-        "rabbitmq.service"
-        "burrow-zulip-postgres-bootstrap.service"
-        "burrow-zulip-rabbitmq-bootstrap.service"
-        "burrow-authentik-ready.service"
-        "burrow-authentik-zulip-saml.service"
-        "network-online.target"
-      ];
-      wants = [
-        "postgresql.service"
-        "redis-zulip.service"
-        "memcached.service"
-        "rabbitmq.service"
-        "burrow-zulip-postgres-bootstrap.service"
-        "burrow-zulip-rabbitmq-bootstrap.service"
-        "burrow-authentik-ready.service"
-        "burrow-authentik-zulip-saml.service"
-        "network-online.target"
-      ];
-      requiredBy = [ "burrow-zulip.service" ];
-      before = [ "burrow-zulip.service" ];
-      path = [
-        pkgs.bash
-        pkgs.coreutils
-        pkgs.curl
-        pkgs.python3
-      ];
-      restartTriggers = [
-        composeFile
-        cfg.postgresPasswordFile
-        cfg.rabbitmqPasswordFile
-        cfg.redisPasswordFile
-        cfg.secretKeyFile
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-      };
-      script = ''
-        set -euo pipefail
-
-        install -d -m 0755 ${lib.escapeShellArg cfg.dataDir}
-        install -d -m 0755 ${lib.escapeShellArg "${cfg.dataDir}/data"}
-        install -d -m 0755 ${lib.escapeShellArg "${cfg.dataDir}/data/logs"}
-        install -d -m 0755 ${lib.escapeShellArg "${cfg.dataDir}/data/logs/emails"}
-        install -d -m 0700 ${lib.escapeShellArg "${cfg.dataDir}/data/secrets"}
-        install -d -m 0700 ${lib.escapeShellArg "${cfg.dataDir}/secrets"}
-        install -d -m 0755 ${lib.escapeShellArg "${cfg.dataDir}/logs"}
-        install -m 0644 ${composeFile} ${lib.escapeShellArg "${cfg.dataDir}/compose.yaml"}
-        : > ${lib.escapeShellArg "${cfg.dataDir}/secrets/email-password"}
-        chmod 0600 ${lib.escapeShellArg "${cfg.dataDir}/secrets/email-password"}
-
-        metadata_xml="$(${pkgs.curl}/bin/curl -fsSL https://${cfg.authentikDomain}/application/saml/${cfg.authentikProviderSlug}/metadata/)"
-        saml_cert="$(printf '%s' "$metadata_xml" | ${pkgs.python3}/bin/python3 -c '
-import xml.etree.ElementTree as ET, sys
-xml = sys.stdin.read()
-root = ET.fromstring(xml)
-ns = {"ds": "http://www.w3.org/2000/09/xmldsig#"}
-node = root.find(".//ds:X509Certificate", ns)
-if node is None or not (node.text or "").strip():
-    raise SystemExit("missing X509 certificate in Authentik metadata")
-print((node.text or "").strip())
-')"
-
-        cat > ${lib.escapeShellArg "${cfg.dataDir}/compose.override.yaml"} <<EOF
-secrets:
-  zulip__postgres_password:
-    file: ${cfg.postgresPasswordFile}
-  zulip__rabbitmq_password:
-    file: ${cfg.rabbitmqPasswordFile}
-  zulip__redis_password:
-    file: ${cfg.redisPasswordFile}
-  zulip__secret_key:
-    file: ${cfg.secretKeyFile}
-  zulip__email_password:
-    file: ${cfg.dataDir}/secrets/email-password
-
-services:
-  zulip:
-    environment:
-      SETTING_EXTERNAL_HOST: "${cfg.domain}"
-      SETTING_ZULIP_ADMINISTRATOR: "${cfg.administratorEmail}"
-      TRUST_GATEWAY_IP: "True"
-      SETTING_SEND_LOGIN_EMAILS: "False"
-      ZULIP_AUTH_BACKENDS: "SAMLAuthBackend"
-      CONFIG_application_server__http_only: true
-      CONFIG_application_server__nginx_listen_port: ${toString cfg.port}
-      CONFIG_application_server__queue_workers_multiprocess: false
-      ZULIP_CUSTOM_SETTINGS: |
-        EMAIL_BACKEND = "django.core.mail.backends.filebased.EmailBackend"
-        EMAIL_FILE_PATH = "/data/logs/emails"
-        EXTERNAL_URI_SCHEME = "https://"
-        SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
-        USE_X_FORWARDED_HOST = True
-        SESSION_COOKIE_SECURE = True
-        CSRF_COOKIE_SECURE = True
-        CSRF_TRUSTED_ORIGINS = ["https://${cfg.domain}"]
-        SOCIAL_AUTH_REDIRECT_IS_HTTPS = True
-        SOCIAL_AUTH_SAML_REDIRECT_IS_HTTPS = True
-        SOCIAL_AUTH_SAML_SP_ENTITY_ID = "https://${cfg.domain}"
-        SOCIAL_AUTH_SAML_SP_EXTRA = {
-            "assertionConsumerService": {
-                "url": "https://${cfg.domain}/complete/saml/",
-                "binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
-            },
-        }
-        SOCIAL_AUTH_SAML_ORG_INFO = {
-            "en-US": {
-                "displayname": "Burrow Zulip",
-                "name": "zulip",
-                "url": "https://${cfg.domain}",
-            },
-        }
-        SOCIAL_AUTH_SAML_ENABLED_IDPS = {
-            "authentik": {
-                "entity_id": "https://${cfg.authentikDomain}",
-                "url": "https://${cfg.authentikDomain}/application/saml/${cfg.authentikProviderSlug}/sso/binding/redirect/",
-                "display_name": "burrow.net",
-                "auto_signup": True,
-                "extra_attrs": ["zulip_role"],
-                "x509cert": """$saml_cert""",
-                "attr_user_permanent_id": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
-                "attr_username": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
-                "attr_email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
-                "attr_first_name": "firstName",
-                "attr_last_name": "lastName",
-            },
-        }
-        SOCIAL_AUTH_SYNC_ATTRS_DICT = {
-            "": {
-                "saml": {
-                    "role": "zulip_role",
-                },
-            },
-        }
-EOF
-      '';
-    };
-
-    systemd.services.burrow-zulip = {
-      description = "Run Burrow Zulip with host-managed dependencies";
-      after = [
-        "burrow-zulip-runtime.service"
-        "network-online.target"
-      ];
-      wants = [
-        "burrow-zulip-runtime.service"
-        "network-online.target"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      path = [
-        pkgs.bash
-        pkgs.coreutils
-        pkgs.gawk
-        pkgs.gnugrep
-        pkgs.openssl
-        pkgs.podman
-        pkgs.podman-compose
-      ];
-      restartTriggers = [
-        composeFile
-        cfg.postgresPasswordFile
-        cfg.rabbitmqPasswordFile
-        cfg.redisPasswordFile
-        cfg.secretKeyFile
-      ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-        WorkingDirectory = cfg.dataDir;
-        RemainAfterExit = true;
-        TimeoutStopSec = "20s";
-        ExecStop = "${pkgs.bash}/bin/bash -lc 'set -euo pipefail; if ${pkgs.podman}/bin/podman container exists burrow-zulip_zulip_1; then ${pkgs.podman}/bin/podman stop --ignore --time 10 burrow-zulip_zulip_1 >/dev/null || true; ${pkgs.podman}/bin/podman rm -f --ignore burrow-zulip_zulip_1 >/dev/null || true; fi'";
-      };
-      script = ''
-        set -euo pipefail
-        cd ${lib.escapeShellArg cfg.dataDir}
-
-        compose() {
-          ${pkgs.podman-compose}/bin/podman-compose -p burrow-zulip "$@"
-        }
-
-        ensure_zulip_data_layout() {
-          local zulip_data_dir=${lib.escapeShellArg "${cfg.dataDir}/data"}
-
-          install -d -m 0755 "$zulip_data_dir/logs"
-          install -d -m 0755 "$zulip_data_dir/logs/emails"
-          install -d -m 0700 "$zulip_data_dir/secrets"
-          chown 1000:1000 "$zulip_data_dir/logs" "$zulip_data_dir/logs/emails" "$zulip_data_dir/secrets"
-
-          if [ ! -s "$zulip_data_dir/secrets/bootstrap-owner-password" ]; then
-            umask 077
-            openssl rand -base64 24 > "$zulip_data_dir/secrets/bootstrap-owner-password"
-          fi
-          chown 1000:1000 "$zulip_data_dir/secrets/bootstrap-owner-password"
-          chmod 0600 "$zulip_data_dir/secrets/bootstrap-owner-password"
-        }
-
-        wait_for_zulip_supervisor() {
-          local attempts=0
-          while ! podman exec burrow-zulip_zulip_1 supervisorctl status >/dev/null 2>&1; do
-            attempts=$((attempts + 1))
-            if [ "$attempts" -ge 90 ]; then
-              echo "error: Zulip supervisor did not become ready" >&2
-              exit 1
-            fi
-            sleep 2
-          done
-        }
-
-        patch_uwsgi_scheme_handling() {
-          wait_for_zulip_supervisor
-          podman exec burrow-zulip_zulip_1 bash -lc "cat > /etc/nginx/zulip-include/trusted-proto <<'EOF'
-map \$remote_addr \$trusted_x_forwarded_proto {
-    default \$scheme;
-    127.0.0.1 \$http_x_forwarded_proto;
-    ::1 \$http_x_forwarded_proto;
-    172.31.1.1 \$http_x_forwarded_proto;
-}
-map \$remote_addr \$trusted_x_forwarded_for {
-    default \"\";
-    127.0.0.1 \$http_x_forwarded_for;
-    ::1 \$http_x_forwarded_for;
-    172.31.1.1 \$http_x_forwarded_for;
-}
-map \$remote_addr \$x_proxy_misconfiguration {
-    default \"\";
-}
-EOF
-cat > /etc/nginx/uwsgi_params <<'EOF'
-uwsgi_param QUERY_STRING    \$query_string;
-uwsgi_param REQUEST_METHOD  \$request_method;
-uwsgi_param CONTENT_TYPE    \$content_type;
-uwsgi_param CONTENT_LENGTH  \$content_length;
-uwsgi_param REQUEST_URI     \$request_uri;
-uwsgi_param PATH_INFO       \$document_uri;
-uwsgi_param DOCUMENT_ROOT   \$document_root;
-uwsgi_param SERVER_PROTOCOL \$server_protocol;
-uwsgi_param REQUEST_SCHEME  \$trusted_x_forwarded_proto;
-uwsgi_param HTTPS           on;
-uwsgi_param REMOTE_ADDR     \$remote_addr;
-uwsgi_param REMOTE_PORT     \$remote_port;
-uwsgi_param SERVER_ADDR     \$server_addr;
-uwsgi_param SERVER_PORT     \$server_port;
-uwsgi_param SERVER_NAME     \$server_name;
-uwsgi_param HTTP_X_REAL_IP  \$remote_addr;
-uwsgi_param HTTP_X_FORWARDED_PROTO \$trusted_x_forwarded_proto;
-uwsgi_param HTTP_X_FORWARDED_SSL \"\";
-uwsgi_param HTTP_X_PROXY_MISCONFIGURATION \$x_proxy_misconfiguration;
-
-# This value is the default, and is provided for explicitness; it must
-# be longer than the configured 55s harakiri timeout in uwsgi
-uwsgi_read_timeout 60s;
-
-uwsgi_pass django;
-EOF
-supervisorctl restart nginx zulip-django >/dev/null"
-        }
-
-        bootstrap_realm_if_needed() {
-          wait_for_zulip_supervisor
-          local realm_exists
-
-          realm_exists="$(
-            podman exec burrow-zulip_zulip_1 bash -lc \
-              "su zulip -c '/home/zulip/deployments/current/manage.py list_realms'" \
-              | awk '$NF == "https://${cfg.domain}" { print "yes" }'
-          )"
-
-          if [ -n "$realm_exists" ]; then
-            return 0
-          fi
-
-          local realm_name=${lib.escapeShellArg cfg.realmName}
-          local admin_email=${lib.escapeShellArg cfg.administratorEmail}
-          local owner_name=${lib.escapeShellArg cfg.realmOwnerName}
-          local create_realm_cmd
-
-          printf -v create_realm_cmd '%q ' \
-            /home/zulip/deployments/current/manage.py \
-            create_realm \
-            --string-id= \
-            --password-file /data/secrets/bootstrap-owner-password \
-            --automated \
-            "$realm_name" \
-            "$admin_email" \
-            "$owner_name"
-
-          podman exec burrow-zulip_zulip_1 su zulip -c "$create_realm_cmd"
-        }
-
-        reconcile_realm_policy() {
-          wait_for_zulip_supervisor
-          local realm_id
-          realm_id="$(
-            podman exec burrow-zulip_zulip_1 bash -lc \
-              "su zulip -c '/home/zulip/deployments/current/manage.py list_realms'" \
-              | awk '$NF == "https://${cfg.domain}" { print $1 }'
-          )"
-
-          podman exec burrow-zulip_zulip_1 su zulip -c \
-            "/home/zulip/deployments/current/manage.py realm_domain --op add -r $realm_id ${realmSignupDomain} --allow-subdomains --automated" \
-            >/dev/null 2>&1 || true
-
-          podman exec burrow-zulip_zulip_1 su zulip -c \
-            "/home/zulip/deployments/current/manage.py shell -c 'from zerver.models import Realm; realm = Realm.objects.get(id=$realm_id); realm.invite_required = False; realm.save(update_fields=[\"invite_required\"])'"
-        }
-
-        if [ ! -e .initialized ]; then
-          compose pull
-          compose run --rm -T zulip app:init
-          touch .initialized
-        fi
-
-        ensure_zulip_data_layout
-        compose up -d zulip
-        bootstrap_realm_if_needed
-        reconcile_realm_policy
-        patch_uwsgi_scheme_handling
-      '';
-    };
-  };
-}
diff --git a/package/arch/README.md b/package/arch/README.md
deleted file mode 100644
index 71567cd..0000000
--- a/package/arch/README.md
+++ /dev/null
@@ -1,15 +0,0 @@
-# Arch and AUR
-
-Burrow has two Arch-family distribution surfaces:
-
-- `package/arch/aur/burrow-git` is the source-build AUR package repository.
-- `package/repositories/pacman/pacman.conf` describes the binary pacman
-  repository at `packages.burrow.net`.
-
-Publish `burrow-git` to the AUR as its own git repository. Regenerate
-`.SRCINFO` from the same `PKGBUILD` before pushing an AUR update.
-
-The binary pacman repository is built by
-`Scripts/package/build-repositories.sh arch` and signs both packages and the
-repository database sidecars through the `package-pacman-repository` Google KMS
-key.
diff --git a/package/arch/aur/burrow-git/.SRCINFO b/package/arch/aur/burrow-git/.SRCINFO
deleted file mode 100644
index 34cc320..0000000
--- a/package/arch/aur/burrow-git/.SRCINFO
+++ /dev/null
@@ -1,21 +0,0 @@
-pkgbase = burrow-git
-	pkgdesc = Burrow VPN daemon and CLI
-	pkgver = 0.1.r0.g0000000
-	pkgrel = 1
-	url = https://git.burrow.net/hackclub/burrow
-	install = burrow.install
-	arch = x86_64
-	arch = aarch64
-	license = GPL-3.0-or-later
-	makedepends = cargo
-	makedepends = git
-	makedepends = protobuf
-	depends = openssl
-	depends = sqlite
-	depends = systemd
-	provides = burrow
-	conflicts = burrow
-	source = git+https://git.burrow.net/hackclub/burrow.git
-	sha256sums = SKIP
-
-pkgname = burrow-git
diff --git a/package/arch/aur/burrow-git/PKGBUILD b/package/arch/aur/burrow-git/PKGBUILD
deleted file mode 100644
index 92a7555..0000000
--- a/package/arch/aur/burrow-git/PKGBUILD
+++ /dev/null
@@ -1,35 +0,0 @@
-# Maintainer: Burrow Release Automation <packages@burrow.net>
-
-pkgname=burrow-git
-pkgver=0.1.r0.g0000000
-pkgrel=1
-pkgdesc="Burrow VPN daemon and CLI"
-arch=("x86_64" "aarch64")
-url="https://git.burrow.net/hackclub/burrow"
-license=("GPL-3.0-or-later")
-depends=("openssl" "sqlite" "systemd")
-makedepends=("cargo" "git" "protobuf")
-provides=("burrow")
-conflicts=("burrow")
-source=("git+https://git.burrow.net/hackclub/burrow.git")
-sha256sums=("SKIP")
-install="burrow.install"
-
-pkgver() {
-  cd burrow
-  printf "0.1.r%s.g%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
-}
-
-build() {
-  cd burrow
-  cargo build --locked --release -p burrow --bin burrow
-}
-
-package() {
-  cd burrow
-  install -Dm755 target/release/burrow "${pkgdir}/usr/bin/burrow"
-  install -Dm644 systemd/burrow.service "${pkgdir}/usr/lib/systemd/system/burrow.service"
-  install -Dm644 systemd/burrow.socket "${pkgdir}/usr/lib/systemd/system/burrow.socket"
-  install -Dm644 README.md "${pkgdir}/usr/share/doc/burrow/README.md"
-  install -Dm644 LICENSE.md "${pkgdir}/usr/share/licenses/burrow/LICENSE.md"
-}
diff --git a/package/arch/aur/burrow-git/burrow.install b/package/arch/aur/burrow-git/burrow.install
deleted file mode 100644
index 355547d..0000000
--- a/package/arch/aur/burrow-git/burrow.install
+++ /dev/null
@@ -1,16 +0,0 @@
-post_install() {
-  systemctl daemon-reload
-  echo "Enable Burrow with: systemctl enable --now burrow.socket"
-}
-
-post_upgrade() {
-  systemctl daemon-reload
-}
-
-pre_remove() {
-  systemctl disable --now burrow.socket >/dev/null 2>&1 || true
-}
-
-post_remove() {
-  systemctl daemon-reload
-}
diff --git a/package/repositories/README.md b/package/repositories/README.md
deleted file mode 100644
index bc227fe..0000000
--- a/package/repositories/README.md
+++ /dev/null
@@ -1,52 +0,0 @@
-# Burrow Native Package Repositories
-
-Burrow publishes native daemon packages through repository formats that Linux
-desktops already understand:
-
-- APT repository for Debian and Ubuntu
-- RPM repository for Fedora, RHEL-family systems, and openSUSE-family systems
-- pacman repository for Arch-family systems
-- AUR source package repository for Arch users who prefer local builds
-- Flatpak repository descriptor for the GTK GUI, with the daemon still supplied
-  by a native package
-- NixOS flake/module for NixOS
-
-APT, RPM, and pacman repository metadata is signed with OpenPGP signatures
-produced by `Scripts/package/google-kms-openpgp.py`. The OpenPGP public keys are
-derived from the Google Cloud KMS public keys, while the private RSA signing
-operation happens inside Google Cloud KMS. Each repository format has its own
-KMS key:
-
-- `package-apt-repository`
-- `package-rpm-repository`
-- `package-pacman-repository`
-- `package-flatpak-repository`
-- `package-aur-source`
-
-Build repository metadata from package artifacts with:
-
-```sh
-BURROW_PACKAGE_INPUT_DIR=dist/packages \
-BURROW_APT_REPO_KMS_PUBLIC_KEY_PEM=.kms/apt.pem \
-BURROW_RPM_REPO_KMS_PUBLIC_KEY_PEM=.kms/rpm.pem \
-BURROW_PACMAN_REPO_KMS_PUBLIC_KEY_PEM=.kms/pacman.pem \
-Scripts/package/build-repositories.sh all
-```
-
-The builder writes repository trees under `publish/repositories` by default:
-
-- `apt/dists/<suite>/...`
-- `rpm/<channel>/<basearch>/...`
-- `arch/burrow/<arch>/...`
-- `keys/*.asc`
-
-The Forgejo workflow `.forgejo/workflows/publish-package-repositories.yml`
-builds Linux package artifacts, exports KMS public keys, signs repository
-metadata through Google KMS, uploads the repository tree as a workflow artifact,
-and publishes the tree to the package GCS bucket when `publish_gcs` is enabled.
-The workflow authenticates to the Burrow Google project through Authentik-backed
-Workload Identity Federation before it calls Google KMS or writes objects.
-
-PackageKit is an optional install frontend. It is not the repository format and
-it is not available everywhere. The Flatpak GUI should try PackageKit only as a
-convenience path, then degrade to native repository setup instructions.
diff --git a/package/repositories/apt/burrow.sources b/package/repositories/apt/burrow.sources
deleted file mode 100644
index 99da324..0000000
--- a/package/repositories/apt/burrow.sources
+++ /dev/null
@@ -1,6 +0,0 @@
-Types: deb
-URIs: https://packages.burrow.net/apt
-Suites: stable
-Components: main
-Architectures: amd64 arm64
-Signed-By: /usr/share/keyrings/burrow-package-apt-repository.gpg
diff --git a/package/repositories/flatpak/burrow.flatpakrepo.in b/package/repositories/flatpak/burrow.flatpakrepo.in
deleted file mode 100644
index a813194..0000000
--- a/package/repositories/flatpak/burrow.flatpakrepo.in
+++ /dev/null
@@ -1,8 +0,0 @@
-[Flatpak Repo]
-Title=Burrow
-Url=https://packages.burrow.net/flatpak
-Homepage=https://burrow.net
-Comment=Burrow GTK desktop UI
-Description=Burrow GTK desktop UI. VPN operation requires the native Burrow daemon package on the host.
-Icon=https://burrow.net/icon.png
-GPGKey=@BURROW_FLATPAK_GPG_KEY_BASE64@
diff --git a/package/repositories/packagekit/README.md b/package/repositories/packagekit/README.md
deleted file mode 100644
index aad13c5..0000000
--- a/package/repositories/packagekit/README.md
+++ /dev/null
@@ -1,16 +0,0 @@
-# PackageKit Bootstrap
-
-PackageKit is the closest cross-distro install prompt for mutable Linux
-desktops. Burrow treats it as an optional bootstrap path:
-
-```sh
-pkcon install burrow
-```
-
-This works only when the host distro has PackageKit, the Burrow native
-repository is configured, and polkit authorizes the action. The Flatpak GUI may
-offer this path through a narrow `org.freedesktop.PackageKit` permission, but it
-must also support direct native-repository instructions.
-
-The command fallback helper checks `apt-get`, `dnf`, `zypper`, `pacman`, `apk`,
-`xbps-install`, `eopkg`, `emerge`, `swupd`, and `nix` after PackageKit.
diff --git a/package/repositories/pacman/pacman.conf b/package/repositories/pacman/pacman.conf
deleted file mode 100644
index 4c206bc..0000000
--- a/package/repositories/pacman/pacman.conf
+++ /dev/null
@@ -1,3 +0,0 @@
-[burrow]
-Server = https://packages.burrow.net/arch/burrow/$arch
-SigLevel = Required DatabaseOptional
diff --git a/package/repositories/rpm/burrow.repo b/package/repositories/rpm/burrow.repo
deleted file mode 100644
index 481aa37..0000000
--- a/package/repositories/rpm/burrow.repo
+++ /dev/null
@@ -1,7 +0,0 @@
-[burrow]
-name=Burrow
-baseurl=https://packages.burrow.net/rpm/stable/$basearch
-enabled=1
-gpgcheck=1
-repo_gpgcheck=1
-gpgkey=https://packages.burrow.net/keys/burrow-package-rpm-repository.asc
diff --git a/patches/rcodesign-pkcs11-tool.patch b/patches/rcodesign-pkcs11-tool.patch
deleted file mode 100644
index c1fe36a..0000000
--- a/patches/rcodesign-pkcs11-tool.patch
+++ /dev/null
@@ -1,522 +0,0 @@
---- a/apple-codesign/src/cli/certificate_source.rs
-+++ b/apple-codesign/src/cli/certificate_source.rs
-@@ -16,0 +17 @@
-+    bytes::Bytes,
-@@ -19,0 +21 @@
-+    signature::Signer,
-@@ -21,2 +23,10 @@
--    std::path::PathBuf,
--    x509_certificate::CapturedX509Certificate,
-+    std::{
-+        path::PathBuf,
-+        process::Command,
-+        sync::atomic::{AtomicU64, Ordering},
-+    },
-+    x509_certificate::{
-+        CapturedX509Certificate, KeyAlgorithm, Sign, Signature, SignatureAlgorithm,
-+        X509CertificateError,
-+    },
-+    zeroize::Zeroizing,
-@@ -36,0 +47,2 @@
-+static PKCS11_SIGN_COUNTER: AtomicU64 = AtomicU64::new(0);
-+
-@@ -204,0 +214,262 @@
-+#[derive(Clone, Debug)]
-+struct Pkcs11PrivateKey {
-+    tool: String,
-+    module: PathBuf,
-+    slot_id: Option<String>,
-+    token_label: Option<String>,
-+    key_id: Option<String>,
-+    key_label: Option<String>,
-+    pin: String,
-+    cert: CapturedX509Certificate,
-+}
-+
-+impl signature::Signer<Signature> for Pkcs11PrivateKey {
-+    fn try_sign(&self, message: &[u8]) -> Result<Signature, signature::Error> {
-+        match self.cert.key_algorithm() {
-+            Some(KeyAlgorithm::Rsa) => {}
-+            Some(algorithm) => {
-+                return Err(signature::Error::from_source(format!(
-+                    "PKCS#11 signing currently supports RSA certificates, not {algorithm:?}"
-+                )));
-+            }
-+            None => {
-+                return Err(signature::Error::from_source(
-+                    "failed to resolve PKCS#11 certificate key algorithm",
-+                ));
-+            }
-+        }
-+
-+        let sequence = PKCS11_SIGN_COUNTER.fetch_add(1, Ordering::Relaxed);
-+        let base = std::env::temp_dir().join(format!(
-+            "rcodesign-pkcs11-{}-{sequence}",
-+            std::process::id()
-+        ));
-+        let input_path = base.with_extension("in");
-+        let output_path = base.with_extension("sig");
-+        let openssl_config_path = base.with_extension("openssl.cnf");
-+        let provider_debug_path = base.with_extension("pkcs11-provider.log");
-+
-+        std::fs::write(&input_path, message).map_err(signature::Error::from_source)?;
-+
-+        let provider_override =
-+            std::env::var("BURROW_APPLE_PKCS11_SIGN_WITH_OPENSSL_PROVIDER")
-+                .or_else(|_| std::env::var("BURROW_PKCS11_SIGN_WITH_OPENSSL_PROVIDER"))
-+                .ok()
-+                .and_then(|value| {
-+                    if value.trim().is_empty() {
-+                        None
-+                    } else {
-+                        Some(matches!(value.as_str(), "1" | "true" | "TRUE" | "yes" | "YES" | "on" | "ON"))
-+                    }
-+                });
-+        let use_openssl_provider = provider_override.unwrap_or_else(|| {
-+            std::env::var("BURROW_APPLE_PKCS11_BACKEND")
-+                .or_else(|_| std::env::var("BURROW_PKCS11_BACKEND"))
-+                .map(|value| value == "gcp-kms")
-+                .unwrap_or(false)
-+                || self.module.to_string_lossy().contains("kmsp11")
-+                || std::env::var("BURROW_GCP_KMS_PKCS11_CONFIG").is_ok()
-+                || std::env::var("KMS_PKCS11_CONFIG").is_ok()
-+        });
-+
-+        if use_openssl_provider {
-+            let token_label = self.token_label.as_ref().ok_or_else(|| {
-+                signature::Error::from_source(
-+                    "OpenSSL PKCS#11 provider signing requires --pkcs11-token-label",
-+                )
-+            })?;
-+            let mut key_uri = format!("pkcs11:token={token_label}");
-+            if let Some(label) = &self.key_label {
-+                key_uri.push_str(";object=");
-+                key_uri.push_str(label);
-+            } else if let Some(id) = &self.key_id {
-+                key_uri.push_str(";id=");
-+                key_uri.push_str(id);
-+            } else {
-+                return Err(signature::Error::from_source(
-+                    "OpenSSL PKCS#11 provider signing requires --pkcs11-key-label or --pkcs11-key-id",
-+                ));
-+            }
-+            key_uri.push_str(";type=private");
-+
-+            let pin_path = base.with_extension("pin");
-+            std::fs::write(&pin_path, &self.pin).map_err(signature::Error::from_source)?;
-+
-+            let module_path = self.module.to_string_lossy();
-+            let kms_config = std::env::var("KMS_PKCS11_CONFIG")
-+                .or_else(|_| std::env::var("BURROW_GCP_KMS_PKCS11_CONFIG"))
-+                .ok();
-+            let needs_kms_config = module_path.contains("kmsp11") || kms_config.is_some();
-+            if needs_kms_config {
-+                let config_path = kms_config.as_ref().ok_or_else(|| {
-+                    signature::Error::from_source(
-+                        "OpenSSL PKCS#11 provider signing with Google KMS requires KMS_PKCS11_CONFIG",
-+                    )
-+                })?;
-+                let metadata = std::fs::metadata(config_path).map_err(|err| {
-+                    signature::Error::from_source(format!(
-+                        "OpenSSL PKCS#11 provider signing could not read KMS_PKCS11_CONFIG at {config_path}: {err}"
-+                    ))
-+                })?;
-+                if !metadata.is_file() || metadata.len() == 0 {
-+                    return Err(signature::Error::from_source(format!(
-+                        "OpenSSL PKCS#11 provider signing requires a non-empty KMS_PKCS11_CONFIG file at {config_path}"
-+                    )));
-+                }
-+            }
-+
-+            let openssl_modules = std::env::var("BURROW_OPENSSL_MODULES")
-+                .or_else(|_| std::env::var("OPENSSL_MODULES"))
-+                .ok()
-+                .filter(|value| !value.trim().is_empty());
-+            if let Some(modules) = &openssl_modules {
-+                let provider_extension = if cfg!(target_os = "macos") {
-+                    "dylib"
-+                } else {
-+                    "so"
-+                };
-+                let provider_module = PathBuf::from(modules)
-+                    .join(format!("pkcs11.{provider_extension}"));
-+                if provider_module.is_file() {
-+                    let config = format!(
-+                        "HOME = .\nopenssl_conf = openssl_init\n\n[openssl_init]\nproviders = provider_sect\n\n[provider_sect]\ndefault = default_sect\npkcs11 = pkcs11_sect\n\n[default_sect]\nactivate = 1\n\n[pkcs11_sect]\nmodule = {}\npkcs11-module-path = {}\npkcs11-module-token-pin = file:{}\npkcs11-module-cache-pins = cache\npkcs11-module-quirks = no-operation-state no-allowed-mechanisms\nactivate = 1\n",
-+                        provider_module.display(),
-+                        self.module.display(),
-+                        pin_path.display(),
-+                    );
-+                    std::fs::write(&openssl_config_path, config)
-+                        .map_err(signature::Error::from_source)?;
-+                }
-+            }
-+
-+            let openssl = std::env::var("BURROW_OPENSSL").unwrap_or_else(|_| "openssl".into());
-+            let mut command = Command::new(openssl);
-+            command
-+                .env("PKCS11_PROVIDER_MODULE", &self.module)
-+                .arg("dgst")
-+                .arg("-provider")
-+                .arg("pkcs11")
-+                .arg("-provider")
-+                .arg("default")
-+                .arg("-sha256")
-+                .arg("-sign")
-+                .arg(&key_uri)
-+                .arg("-passin")
-+                .arg(format!("file:{}", pin_path.display()))
-+                .arg("-out")
-+                .arg(&output_path)
-+                .arg(&input_path);
-+            if let Some(config_path) = kms_config {
-+                command
-+                    .env("KMS_PKCS11_CONFIG", &config_path)
-+                    .env("BURROW_GCP_KMS_PKCS11_CONFIG", &config_path);
-+            }
-+            if let Ok(credentials_path) = std::env::var("GOOGLE_APPLICATION_CREDENTIALS") {
-+                command.env("GOOGLE_APPLICATION_CREDENTIALS", credentials_path);
-+            }
-+            if let Some(modules) = openssl_modules {
-+                command.env("OPENSSL_MODULES", modules);
-+            }
-+            if openssl_config_path.is_file() {
-+                command.env("OPENSSL_CONF", &openssl_config_path);
-+            }
-+            if let Ok(debug) = std::env::var("BURROW_PKCS11_PROVIDER_DEBUG")
-+                .or_else(|_| std::env::var("PKCS11_PROVIDER_DEBUG"))
-+            {
-+                command.env("PKCS11_PROVIDER_DEBUG", debug);
-+            } else {
-+                command.env(
-+                    "PKCS11_PROVIDER_DEBUG",
-+                    format!("file:{},level:1", provider_debug_path.display()),
-+                );
-+            }
-+
-+            let output = command.output().map_err(signature::Error::from_source)?;
-+            let _ = std::fs::remove_file(&input_path);
-+            let _ = std::fs::remove_file(&pin_path);
-+            let _ = std::fs::remove_file(&openssl_config_path);
-+
-+            if !output.status.success() {
-+                let _ = std::fs::remove_file(&output_path);
-+                let provider_debug = std::fs::read_to_string(&provider_debug_path)
-+                    .ok()
-+                    .filter(|value| !value.trim().is_empty())
-+                    .map(|value| {
-+                        let tail = value
-+                            .lines()
-+                            .rev()
-+                            .take(80)
-+                            .collect::<Vec<_>>()
-+                            .into_iter()
-+                            .rev()
-+                            .collect::<Vec<_>>()
-+                            .join("\n");
-+                        format!("\nPKCS#11 provider debug tail:\n{tail}\n")
-+                    })
-+                    .unwrap_or_default();
-+                let _ = std::fs::remove_file(&provider_debug_path);
-+                return Err(signature::Error::from_source(format!(
-+                    "OpenSSL PKCS#11 provider signing failed with status {}: {}{}{}",
-+                    output.status,
-+                    String::from_utf8_lossy(&output.stdout),
-+                    String::from_utf8_lossy(&output.stderr),
-+                    provider_debug
-+                )));
-+            }
-+            let _ = std::fs::remove_file(&provider_debug_path);
-+        } else {
-+            let mut command = Command::new(&self.tool);
-+            command
-+                .arg("--module")
-+                .arg(&self.module)
-+                .arg("--login")
-+                .arg("--pin")
-+                .arg(&self.pin)
-+                .arg("--sign")
-+                .arg("--mechanism")
-+                .arg("SHA256-RSA-PKCS")
-+                .arg("--input-file")
-+                .arg(&input_path)
-+                .arg("--output-file")
-+                .arg(&output_path);
-+
-+            if let Some(slot_id) = &self.slot_id {
-+                command.arg("--slot").arg(slot_id);
-+            }
-+            if let Some(token_label) = &self.token_label {
-+                command.arg("--token-label").arg(token_label);
-+            }
-+            if let Some(id) = &self.key_id {
-+                command.arg("--id").arg(id);
-+            }
-+            if let Some(label) = &self.key_label {
-+                command.arg("--label").arg(label);
-+            }
-+
-+            let output = command.output().map_err(signature::Error::from_source)?;
-+
-+            let _ = std::fs::remove_file(&input_path);
-+
-+            if !output.status.success() {
-+                let _ = std::fs::remove_file(&output_path);
-+                return Err(signature::Error::from_source(format!(
-+                    "pkcs11-tool signing failed with status {}: {}{}",
-+                    output.status,
-+                    String::from_utf8_lossy(&output.stdout),
-+                    String::from_utf8_lossy(&output.stderr)
-+                )));
-+            }
-+        }
-+
-+        let signature = std::fs::read(&output_path).map_err(signature::Error::from_source)?;
-+        let _ = std::fs::remove_file(&output_path);
-+
-+        if signature.is_empty() {
-+            return Err(signature::Error::from_source(
-+                "pkcs11-tool produced an empty signature",
-+            ));
-+        }
-+
-+        Ok(signature.into())
-+    }
-+}
-@@ -204,0 +384,214 @@
-+impl Sign for Pkcs11PrivateKey {
-+    fn sign(&self, message: &[u8]) -> Result<(Vec<u8>, SignatureAlgorithm), X509CertificateError> {
-+        let algorithm = self.signature_algorithm()?;
-+
-+        Ok((self.try_sign(message)?.into(), algorithm))
-+    }
-+
-+    fn key_algorithm(&self) -> Option<KeyAlgorithm> {
-+        self.cert.key_algorithm()
-+    }
-+
-+    fn public_key_data(&self) -> Bytes {
-+        self.cert.public_key_data()
-+    }
-+
-+    fn signature_algorithm(&self) -> Result<SignatureAlgorithm, X509CertificateError> {
-+        match self.cert.key_algorithm() {
-+            Some(KeyAlgorithm::Rsa) => Ok(SignatureAlgorithm::RsaSha256),
-+            Some(algorithm) => Err(X509CertificateError::UnknownSignatureAlgorithm(format!(
-+                "PKCS#11 signing currently supports RSA certificates, not {algorithm:?}"
-+            ))),
-+            None => Err(X509CertificateError::UnknownSignatureAlgorithm(
-+                "failed to resolve PKCS#11 certificate key algorithm".into(),
-+            )),
-+        }
-+    }
-+
-+    fn private_key_data(&self) -> Option<Zeroizing<Vec<u8>>> {
-+        None
-+    }
-+
-+    fn rsa_primes(
-+        &self,
-+    ) -> Result<Option<(Zeroizing<Vec<u8>>, Zeroizing<Vec<u8>>)>, X509CertificateError> {
-+        Ok(None)
-+    }
-+}
-+
-+impl x509_certificate::KeyInfoSigner for Pkcs11PrivateKey {}
-+
-+impl PrivateKey for Pkcs11PrivateKey {
-+    fn as_key_info_signer(&self) -> &dyn x509_certificate::KeyInfoSigner {
-+        self
-+    }
-+
-+    fn to_public_key_peer_decrypt(
-+        &self,
-+    ) -> Result<
-+        Box<dyn crate::remote_signing::session_negotiation::PublicKeyPeerDecrypt>,
-+        AppleCodesignError,
-+    > {
-+        Err(AppleCodesignError::CliGeneralError(
-+            "PKCS#11 keys cannot decrypt remote-signing peer setup data".into(),
-+        ))
-+    }
-+
-+    fn finish(&self) -> Result<(), AppleCodesignError> {
-+        Ok(())
-+    }
-+}
-+
-+#[derive(Args, Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
-+#[serde(deny_unknown_fields)]
-+pub struct Pkcs11SigningKey {
-+    /// Path to pkcs11-tool
-+    #[arg(id = "pkcs11_tool", long = "pkcs11-tool", default_value = "pkcs11-tool", value_name = "PATH")]
-+    pub tool: String,
-+
-+    /// Path to the PKCS#11 module to use for signing
-+    #[arg(
-+        long = "pkcs11-library",
-+        alias = "pkcs11-module",
-+        id = "pkcs11_library",
-+        value_name = "PATH"
-+    )]
-+    pub module: Option<PathBuf>,
-+
-+    /// PKCS#11 slot id containing the signing key
-+    #[arg(id = "pkcs11_slot_id", long = "pkcs11-slot-id", value_name = "SLOT")]
-+    pub slot_id: Option<String>,
-+
-+    /// PKCS#11 token label containing the signing key
-+    #[arg(id = "pkcs11_token_label", long = "pkcs11-token-label", value_name = "LABEL")]
-+    pub token_label: Option<String>,
-+
-+    /// PKCS#11 private-key object id, usually hex
-+    #[arg(id = "pkcs11_key_id", long = "pkcs11-key-id", value_name = "ID")]
-+    pub key_id: Option<String>,
-+
-+    /// PKCS#11 private-key object label
-+    #[arg(id = "pkcs11_key_label", long = "pkcs11-key-label", value_name = "LABEL")]
-+    pub key_label: Option<String>,
-+
-+    /// PIN used to unlock the PKCS#11 token
-+    #[arg(id = "pkcs11_pin", long = "pkcs11-pin", group = "pkcs11-pin-source", value_name = "PIN")]
-+    pub pin: Option<String>,
-+
-+    /// File containing the PIN used to unlock the PKCS#11 token
-+    #[arg(id = "pkcs11_pin_file", long = "pkcs11-pin-file", group = "pkcs11-pin-source", value_name = "PATH")]
-+    pub pin_path: Option<PathBuf>,
-+
-+    /// Environment variable holding the PIN used to unlock the PKCS#11 token
-+    #[arg(id = "pkcs11_pin_env", long = "pkcs11-pin-env", group = "pkcs11-pin-source", value_name = "ENV")]
-+    #[serde(skip)]
-+    pub pin_env: Option<String>,
-+
-+    /// DER certificate file corresponding to the PKCS#11 private key
-+    #[arg(
-+        long = "pkcs11-certificate-file",
-+        alias = "pkcs11-certificate-der-file",
-+        id = "pkcs11_certificate_file",
-+        value_name = "PATH"
-+    )]
-+    pub certificate_path: Option<PathBuf>,
-+}
-+
-+impl Pkcs11SigningKey {
-+    pub(crate) fn configured(&self) -> bool {
-+        self.module.is_some()
-+            || self.slot_id.is_some()
-+            || self.token_label.is_some()
-+            || self.key_id.is_some()
-+            || self.key_label.is_some()
-+            || self.pin.is_some()
-+            || self.pin_path.is_some()
-+            || self.pin_env.is_some()
-+            || self.certificate_path.is_some()
-+    }
-+
-+    fn not_configured(&self) -> bool {
-+        !self.configured()
-+    }
-+
-+    fn resolve_pin(&self) -> Result<String, AppleCodesignError> {
-+        if let Some(pin) = &self.pin {
-+            Ok(pin.clone())
-+        } else if let Some(path) = &self.pin_path {
-+            Ok(std::fs::read_to_string(path)?.trim().to_string())
-+        } else if let Some(env) = &self.pin_env {
-+            std::env::var(env).map_err(|_| {
-+                AppleCodesignError::CliGeneralError(format!(
-+                    "failed reading PKCS#11 PIN from {env} environment variable"
-+                ))
-+            })
-+        } else {
-+            Err(AppleCodesignError::CliGeneralError(
-+                "--pkcs11-pin, --pkcs11-pin-file, or --pkcs11-pin-env is required".into(),
-+            ))
-+        }
-+    }
-+}
-+
-+impl KeySource for Pkcs11SigningKey {
-+    fn resolve_certificates(&self) -> Result<SigningCertificates, AppleCodesignError> {
-+        if !self.configured() {
-+            return Ok(Default::default());
-+        }
-+
-+        let module = self.module.clone().ok_or_else(|| {
-+            AppleCodesignError::CliGeneralError("--pkcs11-library is required".into())
-+        })?;
-+        if self.slot_id.is_none() && self.token_label.is_none() {
-+            return Err(AppleCodesignError::CliGeneralError(
-+                "--pkcs11-slot-id or --pkcs11-token-label is required".into(),
-+            ));
-+        }
-+        if self.key_id.is_none() && self.key_label.is_none() {
-+            return Err(AppleCodesignError::CliGeneralError(
-+                "--pkcs11-key-id or --pkcs11-key-label is required".into(),
-+            ));
-+        }
-+        let certificate_path = self.certificate_path.clone().ok_or_else(|| {
-+            AppleCodesignError::CliGeneralError("--pkcs11-certificate-file is required".into())
-+        })?;
-+        let pin = self.resolve_pin()?;
-+
-+        warn!(
-+            "reading PKCS#11 certificate data from {}",
-+            certificate_path.display()
-+        );
-+        let cert = CapturedX509Certificate::from_der(std::fs::read(certificate_path)?)?;
-+
-+        match cert.key_algorithm() {
-+            Some(KeyAlgorithm::Rsa) => {}
-+            Some(algorithm) => {
-+                return Err(AppleCodesignError::CliGeneralError(format!(
-+                    "PKCS#11 signing currently supports RSA certificates, not {algorithm:?}"
-+                )));
-+            }
-+            None => {
-+                return Err(AppleCodesignError::CliGeneralError(
-+                    "failed to resolve PKCS#11 certificate key algorithm".into(),
-+                ));
-+            }
-+        }
-+
-+        let signer = Pkcs11PrivateKey {
-+            tool: self.tool.clone(),
-+            module,
-+            slot_id: self.slot_id.clone(),
-+            token_label: self.token_label.clone(),
-+            key_id: self.key_id.clone(),
-+            key_label: self.key_label.clone(),
-+            pin,
-+            cert: cert.clone(),
-+        };
-+
-+        Ok(SigningCertificates {
-+            keys: vec![Box::new(signer)],
-+            certs: vec![cert],
-+        })
-+    }
-+}
-+
-@@ -643,0 +1037,8 @@
-+        rename = "pkcs11",
-+        skip_serializing_if = "Pkcs11SigningKey::not_configured"
-+    )]
-+    pub pkcs11_key: Pkcs11SigningKey,
-+
-+    #[command(flatten)]
-+    #[serde(
-+        default,
-@@ -680,0 +1082,2 @@
-+        res.push(&self.pkcs11_key as &dyn KeySource);
-+
---- a/apple-codesign/src/cli/mod.rs
-+++ b/apple-codesign/src/cli/mod.rs
-@@ -1529 +1532,6 @@
--        let certs = c.signer.resolve_certificates(true)?;
-+        let signer = if self.certificate.pkcs11_key.configured() {
-+            &self.certificate
-+        } else {
-+            &c.signer
-+        };
-+        let certs = signer.resolve_certificates(true)?;
diff --git a/proto/burrow.proto b/proto/burrow.proto
deleted file mode 100644
index ed1f89e..0000000
--- a/proto/burrow.proto
+++ /dev/null
@@ -1,140 +0,0 @@
-syntax = "proto3";
-package burrow;
-
-import "google/protobuf/timestamp.proto";
-
-service Tunnel {
-    rpc TunnelConfiguration (Empty) returns (stream TunnelConfigurationResponse);
-    rpc TunnelPackets (stream TunnelPacket) returns (stream TunnelPacket);
-    rpc TunnelStart (Empty) returns (Empty);
-    rpc TunnelStop (Empty) returns (Empty);
-    rpc TunnelStatus (Empty) returns (stream TunnelStatusResponse);
-}
-
-service Networks {
-    rpc NetworkAdd (Network) returns (Empty);
-    rpc NetworkList (Empty) returns (stream NetworkListResponse);
-    rpc NetworkReorder (NetworkReorderRequest) returns (Empty);
-    rpc NetworkDelete (NetworkDeleteRequest) returns (Empty);
-}
-
-service TailnetControl {
-    rpc Discover (TailnetDiscoverRequest) returns (TailnetDiscoverResponse);
-    rpc Probe (TailnetProbeRequest) returns (TailnetProbeResponse);
-    rpc LoginStart (TailnetLoginStartRequest) returns (TailnetLoginStatusResponse);
-    rpc LoginStatus (TailnetLoginStatusRequest) returns (TailnetLoginStatusResponse);
-    rpc LoginCancel (TailnetLoginCancelRequest) returns (Empty);
-}
-
-message NetworkReorderRequest {
-    int32 id = 1;
-    int32 index = 2;
-}
-
-message WireGuardPeer {
-    string endpoint = 1;
-    repeated string subnet = 2;
-}
-
-message WireGuardNetwork {
-    string address = 1;
-    string dns = 2;
-    repeated WireGuardPeer peer = 3;
-}
-
-message NetworkDeleteRequest {
-    int32 id = 1;
-}
-
-message Network {
-    int32 id = 1;
-    NetworkType type = 2;
-    bytes payload = 3;
-}
-
-enum NetworkType {
-    WireGuard = 0;
-    Tailnet = 1;
-}
-
-message NetworkListResponse {
-    repeated Network network = 1;
-}
-
-message Empty {
-
-}
-
-message TailnetDiscoverRequest {
-    string email = 1;
-}
-
-message TailnetDiscoverResponse {
-    string domain = 1;
-    string authority = 2;
-    string oidc_issuer = 3;
-    bool managed = 4;
-}
-
-message TailnetProbeRequest {
-    string authority = 1;
-}
-
-message TailnetProbeResponse {
-    string authority = 1;
-    int32 status_code = 2;
-    string summary = 3;
-    string detail = 4;
-    bool reachable = 5;
-}
-
-message TailnetLoginStartRequest {
-    string account_name = 1;
-    string identity_name = 2;
-    string hostname = 3;
-    string authority = 4;
-}
-
-message TailnetLoginStatusRequest {
-    string session_id = 1;
-}
-
-message TailnetLoginCancelRequest {
-    string session_id = 1;
-}
-
-message TailnetLoginStatusResponse {
-    string session_id = 1;
-    string backend_state = 2;
-    string auth_url = 3;
-    bool running = 4;
-    bool needs_login = 5;
-    string tailnet_name = 6;
-    string magic_dns_suffix = 7;
-    string self_dns_name = 8;
-    repeated string tailnet_ips = 9;
-    repeated string health = 10;
-}
-
-enum State {
-    Stopped = 0;
-    Running = 1;
-}
-
-message TunnelStatusResponse {
-    State state = 1;
-    optional google.protobuf.Timestamp start = 2;
-}
-
-message TunnelConfigurationResponse {
-    repeated string addresses = 1;
-    int32 mtu = 2;
-    repeated string routes = 3;
-    repeated string dns_servers = 4;
-    repeated string search_domains = 5;
-    bool include_default_route = 6;
-}
-
-message TunnelPacket {
-    bytes payload = 1;
-}
diff --git a/proto/google/protobuf/duration.proto b/proto/google/protobuf/duration.proto
deleted file mode 100644
index 41f40c2..0000000
--- a/proto/google/protobuf/duration.proto
+++ /dev/null
@@ -1,115 +0,0 @@
-// Protocol Buffers - Google's data interchange format
-// Copyright 2008 Google Inc.  All rights reserved.
-// https://developers.google.com/protocol-buffers/
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//     * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived from
-// this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-syntax = "proto3";
-
-package google.protobuf;
-
-option cc_enable_arenas = true;
-option go_package = "google.golang.org/protobuf/types/known/durationpb";
-option java_package = "com.google.protobuf";
-option java_outer_classname = "DurationProto";
-option java_multiple_files = true;
-option objc_class_prefix = "GPB";
-option csharp_namespace = "Google.Protobuf.WellKnownTypes";
-
-// A Duration represents a signed, fixed-length span of time represented
-// as a count of seconds and fractions of seconds at nanosecond
-// resolution. It is independent of any calendar and concepts like "day"
-// or "month". It is related to Timestamp in that the difference between
-// two Timestamp values is a Duration and it can be added or subtracted
-// from a Timestamp. Range is approximately +-10,000 years.
-//
-// # Examples
-//
-// Example 1: Compute Duration from two Timestamps in pseudo code.
-//
-//     Timestamp start = ...;
-//     Timestamp end = ...;
-//     Duration duration = ...;
-//
-//     duration.seconds = end.seconds - start.seconds;
-//     duration.nanos = end.nanos - start.nanos;
-//
-//     if (duration.seconds < 0 && duration.nanos > 0) {
-//       duration.seconds += 1;
-//       duration.nanos -= 1000000000;
-//     } else if (duration.seconds > 0 && duration.nanos < 0) {
-//       duration.seconds -= 1;
-//       duration.nanos += 1000000000;
-//     }
-//
-// Example 2: Compute Timestamp from Timestamp + Duration in pseudo code.
-//
-//     Timestamp start = ...;
-//     Duration duration = ...;
-//     Timestamp end = ...;
-//
-//     end.seconds = start.seconds + duration.seconds;
-//     end.nanos = start.nanos + duration.nanos;
-//
-//     if (end.nanos < 0) {
-//       end.seconds -= 1;
-//       end.nanos += 1000000000;
-//     } else if (end.nanos >= 1000000000) {
-//       end.seconds += 1;
-//       end.nanos -= 1000000000;
-//     }
-//
-// Example 3: Compute Duration from datetime.timedelta in Python.
-//
-//     td = datetime.timedelta(days=3, minutes=10)
-//     duration = Duration()
-//     duration.FromTimedelta(td)
-//
-// # JSON Mapping
-//
-// In JSON format, the Duration type is encoded as a string rather than an
-// object, where the string ends in the suffix "s" (indicating seconds) and
-// is preceded by the number of seconds, with nanoseconds expressed as
-// fractional seconds. For example, 3 seconds with 0 nanoseconds should be
-// encoded in JSON format as "3s", while 3 seconds and 1 nanosecond should
-// be expressed in JSON format as "3.000000001s", and 3 seconds and 1
-// microsecond should be expressed in JSON format as "3.000001s".
-//
-message Duration {
-  // Signed seconds of the span of time. Must be from -315,576,000,000
-  // to +315,576,000,000 inclusive. Note: these bounds are computed from:
-  // 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
-  int64 seconds = 1;
-
-  // Signed fractions of a second at nanosecond resolution of the span
-  // of time. Durations less than one second are represented with a 0
-  // `seconds` field and a positive or negative `nanos` field. For durations
-  // of one second or more, a non-zero value for the `nanos` field must be
-  // of the same sign as the `seconds` field. Must be from -999,999,999
-  // to +999,999,999 inclusive.
-  int32 nanos = 2;
-}
diff --git a/proto/google/protobuf/timestamp.proto b/proto/google/protobuf/timestamp.proto
deleted file mode 100644
index fd0bc07..0000000
--- a/proto/google/protobuf/timestamp.proto
+++ /dev/null
@@ -1,144 +0,0 @@
-// Protocol Buffers - Google's data interchange format
-// Copyright 2008 Google Inc.  All rights reserved.
-// https://developers.google.com/protocol-buffers/
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//     * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived from
-// this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-syntax = "proto3";
-
-package google.protobuf;
-
-option cc_enable_arenas = true;
-option go_package = "google.golang.org/protobuf/types/known/timestamppb";
-option java_package = "com.google.protobuf";
-option java_outer_classname = "TimestampProto";
-option java_multiple_files = true;
-option objc_class_prefix = "GPB";
-option csharp_namespace = "Google.Protobuf.WellKnownTypes";
-
-// A Timestamp represents a point in time independent of any time zone or local
-// calendar, encoded as a count of seconds and fractions of seconds at
-// nanosecond resolution. The count is relative to an epoch at UTC midnight on
-// January 1, 1970, in the proleptic Gregorian calendar which extends the
-// Gregorian calendar backwards to year one.
-//
-// All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap
-// second table is needed for interpretation, using a [24-hour linear
-// smear](https://developers.google.com/time/smear).
-//
-// The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By
-// restricting to that range, we ensure that we can convert to and from [RFC
-// 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings.
-//
-// # Examples
-//
-// Example 1: Compute Timestamp from POSIX `time()`.
-//
-//     Timestamp timestamp;
-//     timestamp.set_seconds(time(NULL));
-//     timestamp.set_nanos(0);
-//
-// Example 2: Compute Timestamp from POSIX `gettimeofday()`.
-//
-//     struct timeval tv;
-//     gettimeofday(&tv, NULL);
-//
-//     Timestamp timestamp;
-//     timestamp.set_seconds(tv.tv_sec);
-//     timestamp.set_nanos(tv.tv_usec * 1000);
-//
-// Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`.
-//
-//     FILETIME ft;
-//     GetSystemTimeAsFileTime(&ft);
-//     UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;
-//
-//     // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
-//     // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
-//     Timestamp timestamp;
-//     timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
-//     timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));
-//
-// Example 4: Compute Timestamp from Java `System.currentTimeMillis()`.
-//
-//     long millis = System.currentTimeMillis();
-//
-//     Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
-//         .setNanos((int) ((millis % 1000) * 1000000)).build();
-//
-// Example 5: Compute Timestamp from Java `Instant.now()`.
-//
-//     Instant now = Instant.now();
-//
-//     Timestamp timestamp =
-//         Timestamp.newBuilder().setSeconds(now.getEpochSecond())
-//             .setNanos(now.getNano()).build();
-//
-// Example 6: Compute Timestamp from current time in Python.
-//
-//     timestamp = Timestamp()
-//     timestamp.GetCurrentTime()
-//
-// # JSON Mapping
-//
-// In JSON format, the Timestamp type is encoded as a string in the
-// [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the
-// format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z"
-// where {year} is always expressed using four digits while {month}, {day},
-// {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional
-// seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution),
-// are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone
-// is required. A proto3 JSON serializer should always use UTC (as indicated by
-// "Z") when printing the Timestamp type and a proto3 JSON parser should be
-// able to accept both UTC and other timezones (as indicated by an offset).
-//
-// For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past
-// 01:30 UTC on January 15, 2017.
-//
-// In JavaScript, one can convert a Date object to this format using the
-// standard
-// [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString)
-// method. In Python, a standard `datetime.datetime` object can be converted
-// to this format using
-// [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with
-// the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use
-// the Joda Time's [`ISODateTimeFormat.dateTime()`](
-// http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime()
-// ) to obtain a formatter capable of generating timestamps in this format.
-//
-message Timestamp {
-  // Represents seconds of UTC time since Unix epoch
-  // 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
-  // 9999-12-31T23:59:59Z inclusive.
-  int64 seconds = 1;
-
-  // Non-negative fractions of a second at nanosecond resolution. Negative
-  // second values with fractions must still have non-negative nanos values
-  // that count forward in time. Must be from 0 to 999,999,999
-  // inclusive.
-  int32 nanos = 2;
-}
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
deleted file mode 100644
index ff09ebf..0000000
--- a/rust-toolchain.toml
+++ /dev/null
@@ -1,4 +0,0 @@
-[toolchain]
-channel = "1.93.1"
-components = ["rustfmt"]
-profile = "minimal"
diff --git a/secrets.nix b/secrets.nix
deleted file mode 100644
index db95367..0000000
--- a/secrets.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-let
-  conradev = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBueQxNbP2246pxr/m7au4zNVm+ShC96xuOcfEcpIjWZ";
-  contact = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO42guJ5QvNMw3k6YKWlQnjcTsc+X4XI9F2GBtl8aHOa";
-  agent = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEN0+tRJy7Y2DW0uGYHb86N2t02WyU5lDNX6FaxBF/G8 agent@burrow.net";
-  jett = builtins.replaceStrings [ "\n" ] [ "" ] (builtins.readFile ./nixos/keys/jett_at_burrow_net.pub);
-  burrowForgeHost = "age1quxf27gnun0xghlnxf3jrmqr3h3a3fzd8qxpallsaztd2u74pdfq9e7w9l";
-  burrowForgeRecipients = [
-    contact
-    agent
-    jett
-    burrowForgeHost
-  ];
-  uiTestRecipients = burrowForgeRecipients ++ [ conradev ];
-  releaseRecipients = burrowForgeRecipients ++ [ conradev ];
-in
-{
-  "secrets/apple/appstore-connect.env.age".publicKeys = releaseRecipients;
-  "secrets/apple/distribution-signing.env.age".publicKeys = releaseRecipients;
-  "secrets/apple/sparkle.env.age".publicKeys = releaseRecipients;
-  "secrets/infra/authentik.env.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/authentik-google-client-id.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/authentik-google-client-secret.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/authentik-google-account-map.json.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/authentik-google-wif-client-secret.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/authentik-ui-test-password.age".publicKeys = uiTestRecipients;
-  "secrets/infra/forgejo-oidc-client-secret.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/grafana-admin-password.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/grafana-secret-key.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/grafana-oidc-client-secret.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/forgejo-nsc-autoscaler-config.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/forgejo-nsc-dispatcher-config.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/forgejo-nsc-token.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/headscale-oidc-client-secret.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/linear-scim-token.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/tailscale-oidc-client-secret.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/zulip-postgres-password.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/zulip-memcached-password.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/zulip-rabbitmq-password.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/zulip-redis-password.age".publicKeys = burrowForgeRecipients;
-  "secrets/infra/zulip-secret-key.age".publicKeys = burrowForgeRecipients;
-}
diff --git a/secrets/apple/appstore-connect.env.age b/secrets/apple/appstore-connect.env.age
deleted file mode 100644
index 5762560..0000000
Binary files a/secrets/apple/appstore-connect.env.age and /dev/null differ
diff --git a/secrets/apple/sparkle.env.age b/secrets/apple/sparkle.env.age
deleted file mode 100644
index 7a73864..0000000
--- a/secrets/apple/sparkle.env.age
+++ /dev/null
@@ -1,14 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 ux4N8Q 4lsJwrd+zftsXdTsQ3gHxHBPcj0vB4DI9rtV9tnNj34
-egBI8PYwaKvatPeSSz/IBBpsV/HSyYINcoVL1Z5+fMo
--> ssh-ed25519 IrZmAg UMLZxY6J5w1Nt3oCnkKCELS0fP8LhRQzBuata2m0/m0
-p0Nj6XUD3/Z/VgNX99POOv9d3kvMTXlCndh40uzZwuU
--> ssh-ed25519 0kWPgQ VqbeBJ9KELadFFhEUVQuXaayCw7m1XxBNoAhcavGYAs
-zrUKaHsxMNI+YfFMi6w0qJ0QsGTl6lBPkAMAT6Np4U8
--> X25519 P3EVVvgL1O/2N1tDVqdiNnwpnocO1dsT1MZEBqTk+HQ
-lEdIo0nWWIwWJ0gbt1X7H6do+lCjhMEyTv2dyDtEmNs
--> ssh-ed25519 tbm5Cw YjftkJadPiA1/vTWS53xK9EkyDWXiL2+WJpAx+ZM+HQ
-3b3CP3UA/TK3+2EuNDL8Vf22o+Mxgx6bsm5Ub7e7lNc
---- LKEHr9rQIZlVZQTW46XwDCDa5lsKrgIamb2ocpG5vHw
-P���
-��N��
�������D������5zyL"ED�0
�%o�Ԅ�|O�����c���!���]�#�(x���D��TG�X�x���؇��#+�XA���N�z���2bv��]
\ No newline at end of file
diff --git a/secrets/infra/authentik-google-account-map.json.age b/secrets/infra/authentik-google-account-map.json.age
deleted file mode 100644
index 158814a..0000000
Binary files a/secrets/infra/authentik-google-account-map.json.age and /dev/null differ
diff --git a/secrets/infra/authentik-google-client-id.age b/secrets/infra/authentik-google-client-id.age
deleted file mode 100644
index 344c73b..0000000
--- a/secrets/infra/authentik-google-client-id.age
+++ /dev/null
@@ -1,11 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 ux4N8Q Cmf/vgRBGrP8KGwpc9XCXKo5H23Gcgi6dN688oazITQ
-poYU28mmvkWFdciOiWLQ+powQcsHzof3Gyzq61V2olY
--> ssh-ed25519 IrZmAg mowUPV3BbYR1IupBoT1o3KB+Fo7Q3E3DT0wRx82f4ic
-TZ4r/L5EdHP9wwIbJWBjIITja2L2Pd4AX/U7JSfLm/Y
--> ssh-ed25519 0kWPgQ v9NoFxsRERSgK5cgCHSdtZpn4EcPhvj4JCRR1axGqUM
-ogDiLkSFr8i39b3y2WlnbTMprXiVJPG5KNHGKJIagLo
--> X25519 4xouhPGq8wCmbbjLQsfZeGabsXxc4f74e2gXd+13kB4
-UM7/P0RZyu3PoU5mMY0aoGCdoqrOTgDshGuVjagoaEc
---- r6gIEDysfaqsHMaFF/vuLVaJv85uShPlNNTktMdpUvw
-2��T�Xě�M��"�T뇵���S=_U.�=���w�-\Y�/���x��*�|�t���j��Z'#u��O�c�qL���_h�
A$������)ic�{��L @�F
\ No newline at end of file
diff --git a/secrets/infra/authentik-google-client-secret.age b/secrets/infra/authentik-google-client-secret.age
deleted file mode 100644
index 9a841c7..0000000
--- a/secrets/infra/authentik-google-client-secret.age
+++ /dev/null
@@ -1,11 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 ux4N8Q Q3rYrGroJXarMLdatYCHVERefWDyGwM0Ii/kOp5m3Fs
-W3tgHNXLSVfGU5p8MhBj0mX72SNgMl8nf8sQX29yvBw
--> ssh-ed25519 IrZmAg fyFQQkd51GthNZ4R+W5Al266LnlKbr4ZoMERlCM1OTQ
-rNjnHTGCfF8LkqU8mzTrHlL5G4az1k62gvH4gW8zmjc
--> ssh-ed25519 0kWPgQ OWokv9XAphqbkDi1cznb9V09VcM6Li1eIh0JpcIlVTY
-TnPVlqKB78y7NPYp02UJmuRXdBMKJKCngpvo8TjpFZ8
--> X25519 HWaWhyejjo4IjDrNsBYxU1JaGU0899FqiBYgstInuiU
-enbBGnhH+uJKY3NBD6mmy09Uos+in6ytRQ5BakvTUvI
---- gOBrh88hnvlUSmnRiowJiUIwgIz5zzVKH8YCRb8Ckdw
-�x���okP�����n8���v򵄙HR
ʏoM���Ë��9&T�b]ĉ���'|�<��Pbe�
\ No newline at end of file
diff --git a/secrets/infra/authentik-google-wif-client-secret.age b/secrets/infra/authentik-google-wif-client-secret.age
deleted file mode 100644
index 427dbba..0000000
--- a/secrets/infra/authentik-google-wif-client-secret.age
+++ /dev/null
@@ -1,11 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 ux4N8Q dmNzqS+jc7JGI31mzsRRxSr7vAxRw3uxkbs4vzG20gk
-sJWziiiMhKGzEiAeIxPfeqUYIu4CzZRw+eMXle5zMRs
--> ssh-ed25519 IrZmAg McLHhYu/3wDQYB1bJ/rXsoTv2UgpVTRm4AqsCTLkhCc
-Rrl0vy0mhdXR0pSHckRI39Eg0bxB/Km3lCXXxl9t9Io
--> ssh-ed25519 0kWPgQ UQoa9fP3OPYtesWmMiWL1q8MqPxsXy//hj6805JQBRg
-UKt/WM0t90OPDH9A+RVgrW60vlI2FmRewGsXGD5FCkU
--> X25519 48f0e9+P3ihg3mJIQxvHvq1P/4JEfS1t7DO73/TRGwg
-k70uLkBQt5F1ovKhemYRhyKuPQXfT5XSXMzaQczPC8Q
---- L9B029nBJvUvCKhU2Avmmdmw5sce7bvhFpiPm0p+TVE
-�n�G$��\�_$s&��ΪA��L��l��Z��ɪ�N���!����Z�A%LV�b$�(��`a�K�<�u���&Yj"�&cvC{1���|�N��������{k�9�@t��*U͙~2�/Ã��GB�F+��$���?;���v
\ No newline at end of file
diff --git a/secrets/infra/authentik-ui-test-password.age b/secrets/infra/authentik-ui-test-password.age
deleted file mode 100644
index 773833e..0000000
Binary files a/secrets/infra/authentik-ui-test-password.age and /dev/null differ
diff --git a/secrets/infra/authentik.env.age b/secrets/infra/authentik.env.age
deleted file mode 100644
index dbada85..0000000
Binary files a/secrets/infra/authentik.env.age and /dev/null differ
diff --git a/secrets/infra/forgejo-nsc-autoscaler-config.age b/secrets/infra/forgejo-nsc-autoscaler-config.age
deleted file mode 100644
index f1fad90..0000000
Binary files a/secrets/infra/forgejo-nsc-autoscaler-config.age and /dev/null differ
diff --git a/secrets/infra/forgejo-nsc-dispatcher-config.age b/secrets/infra/forgejo-nsc-dispatcher-config.age
deleted file mode 100644
index c45bdc7..0000000
Binary files a/secrets/infra/forgejo-nsc-dispatcher-config.age and /dev/null differ
diff --git a/secrets/infra/forgejo-nsc-token.age b/secrets/infra/forgejo-nsc-token.age
deleted file mode 100644
index 0a7a468..0000000
Binary files a/secrets/infra/forgejo-nsc-token.age and /dev/null differ
diff --git a/secrets/infra/forgejo-oidc-client-secret.age b/secrets/infra/forgejo-oidc-client-secret.age
deleted file mode 100644
index 68c35e9..0000000
Binary files a/secrets/infra/forgejo-oidc-client-secret.age and /dev/null differ
diff --git a/secrets/infra/grafana-admin-password.age b/secrets/infra/grafana-admin-password.age
deleted file mode 100644
index fb47583..0000000
Binary files a/secrets/infra/grafana-admin-password.age and /dev/null differ
diff --git a/secrets/infra/grafana-oidc-client-secret.age b/secrets/infra/grafana-oidc-client-secret.age
deleted file mode 100644
index f6961f4..0000000
--- a/secrets/infra/grafana-oidc-client-secret.age
+++ /dev/null
@@ -1,12 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 ux4N8Q m92EIjRqUnhjOm40jyn0JXujyj/P8rvZX4K5T0zLvG8
-VHseS9X67DiViTwzPnTFa19CuNZX+iUDKIyeN1DlXyA
--> ssh-ed25519 IrZmAg IK6wvWDy5HghH/KodWnb4X3PR12Ra0EKY6AVG2jvUU8
-Hu1GHi2C3tbL0WY5MDfZzm4CIbROh0l2exMNOEWmm3E
--> ssh-ed25519 0kWPgQ S4PIujnjsoc/R1NoitDp+4BwGNFMvKkQh4Dcweo92W4
-HY9xiDOXSxl14ZVlNkUWVbHlOh1pizLcKiotrTdecy0
--> X25519 n0O4uO3oVQb8d42GwI+2SjTxsXObpU0PQ4zC1l9WWSc
-WhOtVcYPF9xUsm2/jqutdWMPDaeRRITW3QsxGikPYm4
---- CT5DMaqNGPPzYUCay11loEixWG0MID4yuubYR9wDFxA
-��U���D�X!xr#S>�Vw��}׍�L4]�#f`;ɂ/3Z)���Q��V4�
-�d}���=��}-
\ No newline at end of file
diff --git a/secrets/infra/grafana-secret-key.age b/secrets/infra/grafana-secret-key.age
deleted file mode 100644
index 42af338..0000000
Binary files a/secrets/infra/grafana-secret-key.age and /dev/null differ
diff --git a/secrets/infra/headscale-oidc-client-secret.age b/secrets/infra/headscale-oidc-client-secret.age
deleted file mode 100644
index 81cff1c..0000000
--- a/secrets/infra/headscale-oidc-client-secret.age
+++ /dev/null
@@ -1,11 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 ux4N8Q 8QtHVR8defharS9ppAsLOnwX1A3T5CqNLhaLDG41q0E
-tQBUL3Wzh4lIwmIBGjLH5gjsvChWo6GJ4YxXc+cNddU
--> ssh-ed25519 IrZmAg TgL3trgA3+4ivxpIpv/rEegjmZakSEx7B6e2sc4xhRw
-NW4OgVJZhVJUXMBHaajk06CxEJjzrumqTNI2/6RDM4A
--> ssh-ed25519 0kWPgQ uBosFXj4NCXBw5X+h/zr2QLCHnkhtgVZEYOHEBBGoFY
-LTrparOr5iwAEEPM+rTZyDxJFJX/nQsTYpNdGSgKTes
--> X25519 zbO7ax9E3Fya7mvNP/ueB/XL2UN1sHe8Is+2g6hM8WA
-PnjKLk/ZQFrJ0mGIbX8fc9pqw3T2FTT0WSUaDjN1C+w
---- Aknf9dPdr3qD+tu5HyT74L2JMtg46ClYL0FBDhiLrxI
-����3_:޿r�b�A~��vn™G/��-�>��5����K\�닊�|iX~s�X��!�EF�����'��cv9>Ԧ�r�H�x���EP`>���
\ No newline at end of file
diff --git a/secrets/infra/linear-scim-token.age b/secrets/infra/linear-scim-token.age
deleted file mode 100644
index 5bed53e..0000000
--- a/secrets/infra/linear-scim-token.age
+++ /dev/null
@@ -1,11 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 ux4N8Q Tb3hxc6ZscCQpr7s8raup25FA8YAmq30jHZfOQp28Xs
-L9YhaX9IVinud0IOs5K55ldGx82wjXHxnVBHZnRjiTA
--> ssh-ed25519 IrZmAg etIe6hWDP9YkqDFCWybnvsOh7h8YO+z3tKc95pG64lU
-BT3rH5a+LJZWv2xtWPbMJGS2oM9v4mOI9WPmnHebiew
--> ssh-ed25519 0kWPgQ YpCf5m16VaKp7d+C3oF9MJQB/0xzCNtD7ODsTiV8t1o
-xG8G/kSM+7VrWHm299A7fG/kBFnoiWZPiDZuldvimLw
--> X25519 ETltnMPR7lWbBWJvJKmNZhS7wqX0WCa4aNu8UKzxMVE
-Ys57VNuclgvN1nJIrLjNrwekbosa7KK9lFt0PTpr/MQ
---- ZeUmSOf8+NycQAFRGCJHYcQvTJqSBIGKEOEdCnNfJbE
-�<�q�1.��O_���դ7�A۷_@%/�5�l�7J���ɵ�č�Ax������b
"B
\ No newline at end of file
diff --git a/secrets/infra/tailscale-oidc-client-secret.age b/secrets/infra/tailscale-oidc-client-secret.age
deleted file mode 100644
index 3c3c074..0000000
Binary files a/secrets/infra/tailscale-oidc-client-secret.age and /dev/null differ
diff --git a/secrets/infra/zulip-memcached-password.age b/secrets/infra/zulip-memcached-password.age
deleted file mode 100644
index 0769512..0000000
--- a/secrets/infra/zulip-memcached-password.age
+++ /dev/null
@@ -1,11 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 ux4N8Q x0r1UHgSibFIvKU34kP0+mnvQa5xXnac3P5fyqb7qFc
-MfKnr5N0DV2NIoo4MFVFV0ULMayy0zzZqIq4FDzgDGc
--> ssh-ed25519 IrZmAg rzoR8knGrsTGuh9Hqg/NB0NQKI1vx1WI0ZRyrLIPwVY
-7gV/d1slrIT+W0+iX5YK/uUWjHGJfee6vA+f9a35nEY
--> ssh-ed25519 0kWPgQ SyuEAfqmBAqLcuuQUHM5OzAv2hoquMMYtVdbKpBVhjI
-7QqXens2363ln0euoormMh9a3Csh+nS2eBkHuQJmOWc
--> X25519 qDjNNkYBUhWTYyBhrw9tYl8a7G6TCkVZbR4aPcP+J0c
-QF33V6hFUuYRj0B8Eo4jqyyvCpBbpD2ViVWoS8A8f3E
---- 1/Jb0nvWlcszMmxI0yVr6kfexDN0sSk1p+wsTUL4WvU
-����9a��5�I��ك��V[f����,D�b \�v&�L��Z7�!��?4=JxF��eV�
\ No newline at end of file
diff --git a/secrets/infra/zulip-postgres-password.age b/secrets/infra/zulip-postgres-password.age
deleted file mode 100644
index b03556c..0000000
Binary files a/secrets/infra/zulip-postgres-password.age and /dev/null differ
diff --git a/secrets/infra/zulip-rabbitmq-password.age b/secrets/infra/zulip-rabbitmq-password.age
deleted file mode 100644
index 9b1f6ec..0000000
--- a/secrets/infra/zulip-rabbitmq-password.age
+++ /dev/null
@@ -1,11 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 ux4N8Q s1hLIWvkXmlIv/VeHXpDSCe+dh09mE+iZd7xJiQccy0
-8WosTJQLGRPhTR06SIDjgtXNebcf+H/pFzY/lBCjXcs
--> ssh-ed25519 IrZmAg zBNlK+o/RCTCyp8BRkoAYqsDn//kIKtYk3SICkMu3BA
-EhBQy8QdSnCZKkdGzQho7zEMmAbJVoU5jZOMPN6tHG0
--> ssh-ed25519 0kWPgQ hv06idPXqAATkLeUC5vILdEO2NXNWPczlWnwMFvOdkA
-3EeajviunGlcfcF1QlRJrVA9bwPT+fJZFX0uneYVs0c
--> X25519 vm9rPYnQB16VSidi7+nr70lFaH0W/jIGY8zwUObZUV8
-jFgPy/w4j0/p1USKGjQY+coo1OUFXiIjJ5apIZCrZVI
---- Cf2c6WzLYOi8xE/sIn7ZtUqBy5AToASDUNpAxyjrI9M
-�:�,+!������ϨϬB4D��mH���|�(��9�l9�L�PZ^�zed=im���z��?��
\ No newline at end of file
diff --git a/secrets/infra/zulip-redis-password.age b/secrets/infra/zulip-redis-password.age
deleted file mode 100644
index 2aff8b6..0000000
--- a/secrets/infra/zulip-redis-password.age
+++ /dev/null
@@ -1,11 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 ux4N8Q DqDE3ZZlPUWUyyLA185xsOmfGi146SNk+hENMQXaiFY
-D6FhZgynbdccPJQiFRJ18EYvCyDLz3cak0YuQa4f5p4
--> ssh-ed25519 IrZmAg lXgVeADmgjeHeVOOIS5oHqrhkN59ZWDemMOBJo3ubH8
-AQ24P+DnxNoHEguNnLaROIW4/Sq96w/UxzzQwEOyGRc
--> ssh-ed25519 0kWPgQ 8x0pMohdACYueLY6jbNwg7MYVaZcjwBU4axthvDoFx4
-SgUVnd6MK1MccWVYOu9R3PtoMCBBNGKQ7jt5MSA+KkI
--> X25519 UaO5huJPx8d8eMUnGhbI77tZjsFlIPWEffT4fgoO22w
-DVz016ibRxJoa4TDmb2m0Qu9Dn8jpjWEBVtdm2TZx0c
---- 5+MHuvC26SjEBFSmRm0kXjiI27QnJGxvPl2w13EkMrw
-���F�oQ���]ȟ�����������eU�/���/��n�o�.X�G��J�Э�|���+�ž�
\ No newline at end of file
diff --git a/secrets/infra/zulip-secret-key.age b/secrets/infra/zulip-secret-key.age
deleted file mode 100644
index d903d66..0000000
--- a/secrets/infra/zulip-secret-key.age
+++ /dev/null
@@ -1,11 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 ux4N8Q ml+kmLmuRb2nMXJyhKigby2+lPddxM/U7tjhGGQ/JGk
-B3UCv/3+4GHeKR964o/m0CoicHwDgWQGEarPW94tb3I
--> ssh-ed25519 IrZmAg AO0ELOuGGj+WanDZFRkHKUEJyZqJYFdhWbqmUfwbpiM
-5RZMxVBvW5+TzCBFnn66ry3o5V5cJykweyoYMVBgczY
--> ssh-ed25519 0kWPgQ gqQ/S33Re2OYLz1D9LoSAoqOKxuL4aUes8r6+NyAoXw
-NHo2xFsxxJO1ZjnG9r3oxMuvjOUsCyyPvcar2ejZp9w
--> X25519 vUAjBCE197YsckVNM4SYVIPBEESTWnBPCWnUlEwYs1I
-L3l85DXFoAVm2ssHfjBeqRpWGlo1UGbmcNkEgoUB9fM
---- X/2O8ufjbTGrt2zCm4gSRqqoxT5v6a+13XjH4dpRsHs
-���M�k�f"���(q�x���F2Bd��MR�Yji	�����ܴ�<���ґ
�����b_.!r+�<��Us��s����u�?g��D��\����Va�����m��(Ȉ�&.�&�c/|�w���(W����H���4rѠ����+�j"���B	�
\ No newline at end of file
diff --git a/server_patch.txt b/server_patch.txt
deleted file mode 100644
index de8e14c..0000000
--- a/server_patch.txt
+++ /dev/null
@@ -1,21 +0,0 @@
-# Add this to ~/server/wg0.conf upon regeneration
-
-PostUp = iptables -A FORWARD -i %i -j ACCEPT
-
-PostUp = iptables -A FORWARD -o %i -j ACCEPT
-
-PostUp = iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE
-
-PostUp = ip6tables -A FORWARD -i %i -j ACCEPT
-
-PostUp = ip6tables -A FORWARD -o %i -j ACCEPT
-
-PostDown = iptables -D FORWARD -i %i -j ACCEPT
-
-PostDown = iptables -D FORWARD -o %i -j ACCEPT
-
-PostDown = iptables -t nat -D POSTROUTING -o eth+ -j MASQUERADE
-
-PostDown = ip6tables -D FORWARD -i %i -j ACCEPT
-
-PostDown = ip6tables -D FORWARD -o %i -j ACCEPT
\ No newline at end of file
diff --git a/services/forgejo-nsc/README.md b/services/forgejo-nsc/README.md
deleted file mode 100644
index e84a71b..0000000
--- a/services/forgejo-nsc/README.md
+++ /dev/null
@@ -1,180 +0,0 @@
-## forgejo-nsc-dispatcher
-
-This service exposes a simple HTTP API that tells Namespace Cloud to start
-ephemeral Forgejo Actions runners on demand. It glues together three pieces:
-
-1. **Forgejo Actions** – the service requests a scoped registration token
-   for the repository/organization/instance where you want to run jobs.
-2. **Namespace (`nsc`)** – the dispatcher shells out to the `nsc` CLI to create
-   a short‑lived environment, runs the `forgejo-runner` container inside it,
-   and exits after a single job (`forgejo-runner one-job`). The Namespace TTL is
-   the hard cap, not the typical lifetime.
-3. **Your automation** – you call the service via HTTP (directly, through Caddy,
-   via Forgejo webhooks, etc.) whenever a new runner is needed.
-
-### Directory layout
-
-```
-.
-├── cmd/forgejo-nsc-dispatcher   # main entry point
-├── internal/                    # service packages (config, forgejo client, nsc dispatcher, HTTP server)
-├── config.example.yaml          # starter config referenced by README
-├── flake.nix / flake.lock       # reproducible builds (Go binary + container image)
-└── .forgejo/workflows           # CI that runs go test/build and publishes manifests
-```
-
-### Configuration
-
-Copy `config.example.yaml` and update it for your Forgejo instance and Namespace
-profile. The important knobs are:
-
-- `forgejo.base_url` – HTTPS endpoint of your Forgejo server. A PAT with
-  `actions:runner` scope is required in `forgejo.token`.
-- `forgejo.instance_url` – URL that spawned runners use to register back to Forgejo.
-  This must be reachable from the runner (typically the public URL like
-  `https://git.burrow.net`). On the forge host it commonly differs from `base_url`
-  (which may be `http://127.0.0.1:3000`).
-- `forgejo.default_scope` – where new runners register
-  (`instance`, `organization`, or `repository`).
-- `forgejo.default_labels` – labels applied to every spawned runner. GateForge
-  workflows via `runs-on: ["namespace-profile-linux-medium"]` (or other
-  `namespace-profile-linux-*` labels).
-- `namespace.nsc_binary` – path to the `nsc` binary (the Nix container ships one
-  compiled from `namespacelabs/foundation` so `/app/bin/nsc` works out of the box).
-- `namespace.image` – OCI image containing `forgejo-runner`.
-- `namespace.machine_type` / `namespace.duration` – shape + TTL for the ephemeral
-  Namespace environment. The dispatcher destroys the instance after a job so the
-  TTL acts as a hard cap, not an idle timeout.
-
-### Running locally
-
-```shell
-# Ensure nsc is available (e.g. `go build ./foundation/cmd/nsc`)
-cp config.example.yaml config.yaml
-nix develop   # optional dev shell with Go toolchain
-go run ./cmd/forgejo-nsc-dispatcher --config config.yaml
-```
-
-API example:
-
-```shell
-curl -X POST http://localhost:8080/api/v1/dispatch \
-  -H 'Content-Type: application/json' \
-  -d '{
-    "count": 1,
-    "ttl": "20m",
-    "labels": ["namespace-profile-linux-medium"],
-    "scope": {"level": "repository", "owner": "example", "name": "app"}
-  }'
-```
-
-### Deploying with Nix + GHCR
-
-- `nix build .#packages.x86_64-linux.container-amd64` produces a deterministic
-  tarball containing the service, the `nsc` binary, BusyBox, and `forgejo-runner`.
-- The included `Build Container` workflow builds both `amd64` and `arm64` images
-  on Namespace runners and pushes them to `ghcr.io/<owner>/<repo>`.
-  No Fly.io manifests are emitted – the multi‑arch manifest points only at GHCR.
-
-### How this fits behind Caddy (last-mile networking)
-
-The dispatcher is just an HTTP server. You can:
-
-1. Run it anywhere that can reach Forgejo and Namespace: bare metal, Namespace
-   cluster, Kubernetes, Fly, etc.
-2. Put Caddy (or any reverse proxy) in front to terminate TLS, do auth, or
-   rewrite URLs. For example:
-
-   ```
-   forgejo-dispatcher.example.com {
-     reverse_proxy 127.0.0.1:8080
-     basicauth /api/* {
-       user JDJhJDE...
-     }
-   }
-   ```
-
-The service doesn’t assume Caddy, nor does it manipulate HTTP clients
-directly – it simply waits for POST requests. As long as the dispatcher can
-reach Forgejo’s REST API and run the `nsc` binary, you can drop it anywhere.
-
-### Autoscaling (webhook + poller)
-
-If you don’t want to call `/api/v1/dispatch` manually, there’s a companion
-autoscaler (`cmd/forgejo-nsc-autoscaler`) that watches Forgejo job queues and
-triggers the dispatcher for you. It operates in two modes simultaneously:
-
-1. **Polling** – every instance polls `GET /api/v1/.../actions/runners` to keep a
-   minimum number of idle Namespace runners per label. This continues until a
-   webhook is successfully processed, so the system is self-bootstrapping.
-2. **Webhooks** – once Forgejo reaches the autoscaler via the `/webhook/{name}`
-   endpoint, the autoscaler stops polling and reacts to `workflow_job` events in
-   real time. Each payload is mapped to a target label set and results in a
-   dispatch call.
-
-You can manage multiple Forgejo instances by listing them under `instances` in
-`autoscaler.example.yaml`:
-
-```
-listen: ":8090"
-dispatcher:
-  url: "http://dispatcher:8080"
-
-instances:
-  - name: burrow
-    forgejo:
-      base_url: "https://git.burrow.net"
-      token: "PENDING-FORGEJO-PAT"
-    scope:
-      level: "repository"
-      owner: "hackclub"
-      name: "burrow"
-    disable_polling: true   # webhook-only mode
-    poll_interval: "30s"
-    webhook_secret: "supersecret"
-    webhook:
-      url: "https://nsc-autoscaler.burrow.net/webhook/burrow"
-      content_type: "json"
-      events: ["workflow_job"]
-      active: true
-    targets:
-      - labels: ["namespace-profile-linux-medium"]
-        min_idle: 0  # set to 0 to scale-to-zero between jobs
-        ttl: "20m"
-      - labels: ["namespace-profile-windows-large"]
-        min_idle: 0
-        ttl: "45m"
-        machine_type: "windows/amd64:8x16"
-```
-
-For Burrow, use `Scripts/provision-forgejo-nsc.sh` to mint the Forgejo PAT,
-generate a Namespace token from the logged-in namespace account, and render the
-dispatcher/autoscaler configs into `intake/forgejo_nsc_{dispatcher,autoscaler}.yaml`
-plus `intake/forgejo_nsc_token.txt`.
-
-For ongoing operations, use `Scripts/seal-forgejo-nsc-secrets.sh`:
-
-- `Scripts/seal-forgejo-nsc-secrets.sh --provision` refreshes the local
-  Namespace token from the logged-in Namespace account, mints a Forgejo PAT,
-  renders the dispatcher/autoscaler configs, and seals those runtime inputs into
-  agenix secrets consumed by `burrow-forge`.
-- Deploy `burrow-forge` after sealing so the dispatcher and autoscaler consume
-  the new Namespace credentials.
-
-Run it next to the dispatcher:
-
-```bash
-go run ./cmd/forgejo-nsc-autoscaler --config autoscaler.yaml
-# or build the binary/container via `nix build .#forgejo-nsc-autoscaler`
-```
-
-If your Forgejo build doesn’t expose the runner listing API, set
-`disable_polling: true` and rely on `webhook` entries. The autoscaler will
-auto-create/update the webhook (using the PAT) so that new `workflow_job` events
-immediately call the dispatcher even if the service isn’t publicly reachable yet.
-
-In Forgejo add a webhook pointing to `https://nsc-autoscaler.burrow.net/webhook/burrow`
-with the shared secret (or let the autoscaler create it by specifying `webhook.url`
-in config). The autoscaler continues polling until it receives the first valid
-webhook (unless disabled), so you get capacity immediately even if outbound
-webhooks from Forgejo aren’t yet configured.
diff --git a/services/forgejo-nsc/autoscaler.example.yaml b/services/forgejo-nsc/autoscaler.example.yaml
deleted file mode 100644
index 35ba07a..0000000
--- a/services/forgejo-nsc/autoscaler.example.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-listen: ":8090"
-dispatcher:
-  url: "http://localhost:8080"
-  timeout: "2h"
-
-instances:
-  - name: burrow
-    forgejo:
-      base_url: "https://git.burrow.net"
-      token: "PENDING-FORGEJO-PAT"
-    scope:
-      level: "repository"
-      owner: "hackclub"
-      name: "burrow"
-    disable_polling: true
-    poll_interval: "30s"
-    webhook_secret: "supersecret"
-    webhook:
-      url: "https://nsc-autoscaler.burrow.net/webhook/burrow"
-      content_type: "json"
-      events: ["workflow_job"]
-      active: true
-    targets:
-      - labels: ["namespace-profile-linux-medium"]
-        min_idle: 1
-        ttl: "20m"
-        machine_type: "8x16"
-      - labels: ["namespace-profile-windows-large"]
-        min_idle: 0
-        ttl: "45m"
-        machine_type: "windows/amd64:8x16"
diff --git a/services/forgejo-nsc/cmd/forgejo-nsc-autoscaler/main.go b/services/forgejo-nsc/cmd/forgejo-nsc-autoscaler/main.go
deleted file mode 100644
index bdbb6f8..0000000
--- a/services/forgejo-nsc/cmd/forgejo-nsc-autoscaler/main.go
+++ /dev/null
@@ -1,46 +0,0 @@
-package main
-
-import (
-	"context"
-	"flag"
-	"log/slog"
-	"os"
-	"os/signal"
-	"syscall"
-
-	"namespacelabs.dev/foundation/std/tasks"
-	"namespacelabs.dev/foundation/std/tasks/simplelog"
-
-	"github.com/burrow/forgejo-nsc/internal/autoscaler"
-)
-
-func main() {
-	var configPath string
-	flag.StringVar(&configPath, "config", "autoscaler.yaml", "Path to the autoscaler config file")
-	flag.Parse()
-
-	logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelInfo}))
-
-	cfg, err := autoscaler.LoadConfig(configPath)
-	if err != nil {
-		logger.Error("failed to load config", "error", err)
-		os.Exit(1)
-	}
-
-	service, err := autoscaler.NewService(cfg)
-	if err != nil {
-		logger.Error("failed to initialize autoscaler", "error", err)
-		os.Exit(1)
-	}
-
-	ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
-	defer cancel()
-	ctx = tasks.WithSink(ctx, simplelog.NewSink(os.Stdout, 0))
-
-	if err := tasks.Action("autoscaler.run").Run(ctx, func(ctx context.Context) error {
-		return service.Start(ctx)
-	}); err != nil {
-		logger.Error("autoscaler exited", "error", err)
-		os.Exit(1)
-	}
-}
diff --git a/services/forgejo-nsc/cmd/forgejo-nsc-dispatcher/main.go b/services/forgejo-nsc/cmd/forgejo-nsc-dispatcher/main.go
deleted file mode 100644
index 9dcbfb1..0000000
--- a/services/forgejo-nsc/cmd/forgejo-nsc-dispatcher/main.go
+++ /dev/null
@@ -1,90 +0,0 @@
-package main
-
-import (
-	"context"
-	"flag"
-	"log/slog"
-	"net/http"
-	"os"
-	"os/signal"
-	"syscall"
-	"time"
-
-	"github.com/burrow/forgejo-nsc/internal/app"
-	"github.com/burrow/forgejo-nsc/internal/config"
-	"github.com/burrow/forgejo-nsc/internal/forgejo"
-	"github.com/burrow/forgejo-nsc/internal/nsc"
-	"github.com/burrow/forgejo-nsc/internal/server"
-)
-
-func main() {
-	var configPath string
-	flag.StringVar(&configPath, "config", "config.yaml", "Path to the dispatcher config file.")
-	flag.Parse()
-
-	logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelInfo}))
-
-	cfg, err := config.Load(configPath)
-	if err != nil {
-		logger.Error("failed to load config", "error", err)
-		os.Exit(1)
-	}
-
-	scope, err := cfg.Forgejo.DefaultScope.ToScope()
-	if err != nil {
-		logger.Error("invalid default scope", "error", err)
-		os.Exit(1)
-	}
-
-	forgejoClient, err := forgejo.NewClient(cfg.Forgejo.BaseURL, cfg.Forgejo.Token)
-	if err != nil {
-		logger.Error("failed to create forgejo client", "error", err)
-		os.Exit(1)
-	}
-
-	dispatcher, err := nsc.NewDispatcher(nsc.Options{
-		BinaryPath:       cfg.Namespace.NSCBinary,
-		ComputeBaseURL:   cfg.Namespace.ComputeBaseURL,
-		DefaultImage:     cfg.Namespace.Image,
-		DefaultMachine:   cfg.Namespace.MachineType,
-		MacosBaseImageID: cfg.Namespace.MacosBaseImageID,
-		MacosMachineArch: cfg.Namespace.MacosMachineArch,
-		DefaultDuration:  cfg.Namespace.Duration.Duration,
-		WorkDir:          cfg.Namespace.WorkDir,
-		MaxParallel:      cfg.Namespace.MaxParallel,
-		RunnerNamePrefix: cfg.Runner.NamePrefix,
-		Executor:         cfg.Runner.Executor,
-		Network:          cfg.Namespace.Network,
-		Logger:           logger,
-	})
-	if err != nil {
-		logger.Error("failed to create dispatcher", "error", err)
-		os.Exit(1)
-	}
-
-	service := app.NewService(app.Config{
-		DefaultScope:  scope,
-		DefaultLabels: cfg.Forgejo.DefaultLabels,
-		InstanceURL:   cfg.Forgejo.InstanceURL,
-		DefaultTTL:    cfg.Namespace.Duration.Duration,
-		AllowLabels:   cfg.Namespace.AllowLabels,
-		AllowScopes:   cfg.Namespace.AllowScopes,
-	}, forgejoClient, dispatcher, logger)
-
-	srv := server.New(cfg.Listen, service, logger)
-
-	go func() {
-		logger.Info("dispatcher listening", "addr", cfg.Listen)
-		if err := srv.ListenAndServe(); err != nil && err != context.Canceled && err != http.ErrServerClosed {
-			logger.Error("server terminated", "error", err)
-		}
-	}()
-
-	interrupt := make(chan os.Signal, 1)
-	signal.Notify(interrupt, syscall.SIGTERM, syscall.SIGINT)
-	<-interrupt
-
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
-	defer cancel()
-	_ = srv.Shutdown(ctx)
-}
diff --git a/services/forgejo-nsc/config.example.yaml b/services/forgejo-nsc/config.example.yaml
deleted file mode 100644
index 5dc7551..0000000
--- a/services/forgejo-nsc/config.example.yaml
+++ /dev/null
@@ -1,27 +0,0 @@
-listen: ":8080"
-
-forgejo:
-  base_url: "https://forgejo.example.com"
-  token: "${FORGEJO_PERSONAL_ACCESS_TOKEN}"
-  default_scope:
-    level: "organization"
-    owner: "example"
-  default_labels:
-    - namespace-profile-linux-medium
-  timeout: "30s"
-
-namespace:
-  nsc_binary: "/app/bin/nsc"
-  compute_base_url: "https://ord4.compute.namespaceapis.com"
-  image: "ghcr.io/forgejo/runner:3"
-  machine_type: "8x16"
-  macos_base_image_id: "tahoe"
-  macos_machine_arch: "arm64"
-  duration: "30m"
-  workdir: "/var/lib/forgejo-runner"
-  max_parallel: 4
-  network: ""
-
-runner:
-  name_prefix: "nscloud-"
-  executor: "shell"
diff --git a/services/forgejo-nsc/deploy/autoscaler.yaml b/services/forgejo-nsc/deploy/autoscaler.yaml
deleted file mode 100644
index 42ae6c7..0000000
--- a/services/forgejo-nsc/deploy/autoscaler.yaml
+++ /dev/null
@@ -1,52 +0,0 @@
-listen: "127.0.0.1:8090"
-
-dispatcher:
-  url: "http://127.0.0.1:8080"
-  timeout: "3h"
-
-instances:
-  - name: burrow
-    forgejo:
-      base_url: "http://127.0.0.1:3000"
-      token: "PENDING-FORGEJO-PAT"
-    scope:
-      level: "repository"
-      owner: "hackclub"
-      name: "burrow"
-    disable_polling: false
-    poll_interval: "30s"
-    webhook_secret: "PENDING-WEBHOOK-SECRET"
-    webhook:
-      url: "https://nsc-autoscaler.burrow.net/webhook/burrow"
-      content_type: "json"
-      events: ["workflow_job"]
-      active: true
-    targets:
-      - labels: ["namespace-profile-linux-medium"]
-        min_idle: 0
-        ttl: "20m"
-        machine_type: "8x16"
-      - labels: ["namespace-profile-linux-medium-apple-v2"]
-        min_idle: 0
-        ttl: "30m"
-        machine_type: "8x16"
-      - labels: ["namespace-profile-linux-testflight"]
-        min_idle: 0
-        ttl: "150m"
-        machine_type: "8x16"
-      - labels: ["namespace-profile-macos-large"]
-        min_idle: 0
-        ttl: "60m"
-        machine_type: "12x28"
-      - labels: ["namespace-profile-macos-large-apple-v2"]
-        min_idle: 0
-        ttl: "90m"
-        machine_type: "12x28"
-      - labels: ["namespace-profile-macos-large-testflight"]
-        min_idle: 0
-        ttl: "150m"
-        machine_type: "12x28"
-      - labels: ["namespace-profile-windows-large"]
-        min_idle: 0
-        ttl: "45m"
-        machine_type: "windows/amd64:8x16"
diff --git a/services/forgejo-nsc/deploy/dispatcher.yaml b/services/forgejo-nsc/deploy/dispatcher.yaml
deleted file mode 100644
index 28f55ac..0000000
--- a/services/forgejo-nsc/deploy/dispatcher.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-listen: "127.0.0.1:8080"
-
-forgejo:
-  base_url: "http://127.0.0.1:3000"
-  instance_url: "https://git.burrow.net"
-  token: "PENDING-FORGEJO-PAT"
-  default_scope:
-    level: "repository"
-    owner: "hackclub"
-    name: "burrow"
-  default_labels:
-    - namespace-profile-linux-medium
-  timeout: "30s"
-
-namespace:
-  nsc_binary: "/run/current-system/sw/bin/nsc"
-  compute_base_url: "https://ord4.compute.namespaceapis.com"
-  image: "code.forgejo.org/forgejo/runner:11"
-  machine_type: "8x16"
-  macos_base_image_id: "tahoe"
-  macos_machine_arch: "arm64"
-  duration: "30m"
-  workdir: "/var/lib/forgejo-runner"
-  max_parallel: 4
-  network: ""
-
-runner:
-  name_prefix: "nscloud-"
-  executor: "shell"
diff --git a/services/forgejo-nsc/go.mod b/services/forgejo-nsc/go.mod
deleted file mode 100644
index 215aac1..0000000
--- a/services/forgejo-nsc/go.mod
+++ /dev/null
@@ -1,65 +0,0 @@
-module github.com/burrow/forgejo-nsc
-
-go 1.24.4
-
-require (
-	buf.build/gen/go/namespace/cloud/connectrpc/go v1.19.1-20260212004106-290ae81f8d6d.2
-	buf.build/gen/go/namespace/cloud/protocolbuffers/go v1.36.11-20260212004106-290ae81f8d6d.1
-	connectrpc.com/connect v1.19.1
-	github.com/go-chi/chi/v5 v5.2.1
-	github.com/google/uuid v1.6.0
-	golang.org/x/crypto v0.48.0
-	golang.org/x/sync v0.19.0
-	google.golang.org/protobuf v1.36.11
-	gopkg.in/yaml.v3 v3.0.1
-	namespacelabs.dev/foundation v0.0.478
-)
-
-require (
-	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
-	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
-	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
-	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/jxskiss/base62 v1.1.0 // indirect
-	github.com/kr/text v0.2.0 // indirect
-	github.com/magiconair/properties v1.8.6 // indirect
-	github.com/mattn/go-runewidth v0.0.16 // indirect
-	github.com/mattn/go-zglob v0.0.3 // indirect
-	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/morikuni/aec v1.0.0 // indirect
-	github.com/muesli/reflow v0.3.0 // indirect
-	github.com/pelletier/go-toml v1.9.5 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
-	github.com/rivo/uniseg v0.4.2 // indirect
-	github.com/segmentio/ksuid v1.0.4 // indirect
-	github.com/spf13/afero v1.9.2 // indirect
-	github.com/spf13/cast v1.7.0 // indirect
-	github.com/spf13/jwalterweatherman v1.1.0 // indirect
-	github.com/spf13/pflag v1.0.7 // indirect
-	github.com/spf13/viper v1.14.0 // indirect
-	github.com/subosito/gotenv v1.4.1 // indirect
-	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/otel v1.38.0 // indirect
-	go.opentelemetry.io/otel/exporters/jaeger v1.17.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 // indirect
-	go.opentelemetry.io/otel/metric v1.38.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.38.0 // indirect
-	go.opentelemetry.io/otel/trace v1.38.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
-	golang.org/x/exp v0.0.0-20250911091902-df9299821621 // indirect
-	golang.org/x/net v0.49.0 // indirect
-	golang.org/x/sys v0.41.0 // indirect
-	golang.org/x/term v0.40.0 // indirect
-	golang.org/x/text v0.34.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250825161204-c5933d9347a5 // indirect
-	google.golang.org/grpc v1.76.0 // indirect
-	gopkg.in/ini.v1 v1.67.0 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
-	helm.sh/helm/v3 v3.18.4 // indirect
-	namespacelabs.dev/go-ids v0.0.0-20221124082625-9fc72ee06af7 // indirect
-)
diff --git a/services/forgejo-nsc/go.sum b/services/forgejo-nsc/go.sum
deleted file mode 100644
index 6e2a0a9..0000000
--- a/services/forgejo-nsc/go.sum
+++ /dev/null
@@ -1,575 +0,0 @@
-buf.build/gen/go/namespace/cloud/connectrpc/go v1.19.1-20260212004106-290ae81f8d6d.2 h1:XaeFtt6yN8G5q2uYoiTjyshOyai1Q+GzwfEKlxrTzVw=
-buf.build/gen/go/namespace/cloud/connectrpc/go v1.19.1-20260212004106-290ae81f8d6d.2/go.mod h1:QvCL7PUDMFotMXVUoWMeRClEEnCbh7S51xHy39mO+H4=
-buf.build/gen/go/namespace/cloud/protocolbuffers/go v1.36.11-20260212004106-290ae81f8d6d.1 h1:xTgPJaOj5QNRPAA3nxW3fTz01aAOLr/6SG7C4Iqxm54=
-buf.build/gen/go/namespace/cloud/protocolbuffers/go v1.36.11-20260212004106-290ae81f8d6d.1/go.mod h1:Il2wpJNQB40Yj3Rmuhg5xKJPSXaZVwij+Q30d1PNuNY=
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
-cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
-cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.44.3/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
-cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
-cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
-cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
-cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
-cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
-cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
-cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
-cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
-cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
-cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
-cloud.google.com/go v0.75.0/go.mod h1:VGuuCn7PG0dwsd5XPVm2Mm3wlh3EL55/79EKB6hlPTY=
-cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
-cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
-cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
-cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
-cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
-cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
-cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
-cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
-cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
-cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
-cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
-cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
-cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
-cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
-cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
-connectrpc.com/connect v1.19.1 h1:R5M57z05+90EfEvCY1b7hBxDVOUl45PrtXtAV2fOC14=
-connectrpc.com/connect v1.19.1/go.mod h1:tN20fjdGlewnSFeZxLKb0xwIZ6ozc3OQs2hTXy4du9w=
-dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
-github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
-github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
-github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
-github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/go-chi/chi/v5 v5.2.1 h1:KOIHODQj58PmL80G2Eak4WdvUzjSJSm0vG72crDCqb8=
-github.com/go-chi/chi/v5 v5.2.1/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
-github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
-github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
-github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
-github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
-github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
-github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
-github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 h1:8Tjv8EJ+pM1xP8mK6egEbD1OgnVTyacbefKhmbLhIhU=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2/go.mod h1:pkJQ2tZHJ0aFOVEEot6oZmaVEZcRme73eIFmhiVuRWs=
-github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
-github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
-github.com/jxskiss/base62 v1.1.0 h1:A5zbF8v8WXx2xixnAKD2w+abC+sIzYJX+nxmhA6HWFw=
-github.com/jxskiss/base62 v1.1.0/go.mod h1:HhWAlUXvxKThfOlZbcuFzsqwtF5TcqS9ru3y5GfjWAc=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/magiconair/properties v1.8.6 h1:5ibWZ6iY0NctNGWo87LalDlEZ6R41TqbbDamhfG/Qzo=
-github.com/magiconair/properties v1.8.6/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
-github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk=
-github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
-github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
-github.com/mattn/go-zglob v0.0.3 h1:6Ry4EYsScDyt5di4OI6xw1bYhOqfE5S33Z1OPy+d+To=
-github.com/mattn/go-zglob v0.0.3/go.mod h1:9fxibJccNxU2cnpIKLRRFA7zX7qhkJIQWBb449FYHOo=
-github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
-github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
-github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
-github.com/muesli/reflow v0.3.0 h1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s=
-github.com/muesli/reflow v0.3.0/go.mod h1:pbwTDkVPibjO2kyvBQRBxTWEEGDGq0FlB1BIKtnHY/8=
-github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
-github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
-github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
-github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
-github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
-github.com/rivo/uniseg v0.4.2 h1:YwD0ulJSJytLpiaWua0sBDusfsCZohxjxzVTYjwxfV8=
-github.com/rivo/uniseg v0.4.2/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
-github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
-github.com/segmentio/ksuid v1.0.4 h1:sBo2BdShXjmcugAMwjugoGUdUV0pcxY5mW4xKRn3v4c=
-github.com/segmentio/ksuid v1.0.4/go.mod h1:/XUiZBD3kVx5SmUOl55voK5yeAbBNNIed+2O73XgrPE=
-github.com/spf13/afero v1.9.2 h1:j49Hj62F0n+DaZ1dDCvhABaPNSGNkt32oRFxI33IEMw=
-github.com/spf13/afero v1.9.2/go.mod h1:iUV7ddyEEZPO5gA3zD4fJt6iStLlL+Lg4m2cihcDf8Y=
-github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
-github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
-github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
-github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
-github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
-github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.14.0 h1:Rg7d3Lo706X9tHsJMUjdiwMpHB7W8WnSVOssIY+JElU=
-github.com/spf13/viper v1.14.0/go.mod h1:WT//axPky3FdvXHzGw33dNdXXXfFQqmEalje+egj8As=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
-github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
-github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
-go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
-go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
-go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
-go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
-go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM=
-go.opentelemetry.io/otel/exporters/jaeger v1.17.0 h1:D7UpUy2Xc2wsi1Ras6V40q806WM07rqoCWzXu7Sqy+4=
-go.opentelemetry.io/otel/exporters/jaeger v1.17.0/go.mod h1:nPCqOnEH9rNLKqH/+rrUjiMzHJdV1BlpKcTwRTyKkKI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 h1:GqRJVj7UmLjCVyVJ3ZFLdPRmhDUp2zFmQe3RHIOsw24=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0/go.mod h1:ri3aaHSmCTVYu2AWv44YMauwAQc0aqI9gHKIcSbI1pU=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 h1:lwI4Dc5leUqENgGuQImwLo4WnuXFPetmPpkLi2IrX54=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0/go.mod h1:Kz/oCE7z5wuyhPxsXDuaPteSWqjSBD5YaSdbxZYGbGk=
-go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA=
-go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI=
-go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E=
-go.opentelemetry.io/otel/sdk v1.38.0/go.mod h1:ghmNdGlVemJI3+ZB5iDEuk4bWA3GkTpW+DOoZMYBVVg=
-go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6qT5wthqPoM=
-go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA=
-go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE=
-go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
-go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4=
-go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
-go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
-go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
-golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
-golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
-golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
-golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
-golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20250911091902-df9299821621 h1:2id6c1/gto0kaHYyrixvknJ8tUK/Qs5IsmBtrc+FtgU=
-golang.org/x/exp v0.0.0-20250911091902-df9299821621/go.mod h1:TwQYMMnGpvZyc+JpB/UAuTNIsVJifOlSkrZkhcvpVUk=
-golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
-golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
-golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
-golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
-golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
-golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210225134936-a50acf3fe073/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
-golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
-golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
-golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
-golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
-golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
-golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
-golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
-gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
-google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
-google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
-google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
-google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
-google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
-google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
-google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
-google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5 h1:BIRfGDEjiHRrk0QKZe3Xv2ieMhtgRGeLcZQ0mIVn4EY=
-google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5/go.mod h1:j3QtIyytwqGr1JUDtYXwtMXWPKsEa5LtzIFN1Wn5WvE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250825161204-c5933d9347a5 h1:eaY8u2EuxbRv7c3NiGK0/NedzVsCcV6hDuU5qPX5EGE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250825161204-c5933d9347a5/go.mod h1:M4/wBTSeyLxupu3W3tJtOgB14jILAS/XWPSSa3TAlJc=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
-google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
-google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
-google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A=
-google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
-gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-helm.sh/helm/v3 v3.18.4 h1:pNhnHM3nAmDrxz6/UC+hfjDY4yeDATQCka2/87hkZXQ=
-helm.sh/helm/v3 v3.18.4/go.mod h1:WVnwKARAw01iEdjpEkP7Ii1tT1pTPYfM1HsakFKM3LI=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-namespacelabs.dev/foundation v0.0.478 h1:3xFLZcrjih7Jjey2N7faSfr6EoBCg2LMTHipq/3Hlrg=
-namespacelabs.dev/foundation v0.0.478/go.mod h1:svBrTIfZK773sytmjudGkCzQWNisxcQtcWNCs+uLznI=
-namespacelabs.dev/go-ids v0.0.0-20221124082625-9fc72ee06af7 h1:8NlnfPlzDSJr8TYV/qarIWwhjLd1gOXf3Jme0M/oGBM=
-namespacelabs.dev/go-ids v0.0.0-20221124082625-9fc72ee06af7/go.mod h1:J+Sd+ngeffnCsaO/M7zgs2bR8Klq/ZBhS0+bbnDEH2M=
-rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
-rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
-rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/services/forgejo-nsc/internal/app/service.go b/services/forgejo-nsc/internal/app/service.go
deleted file mode 100644
index 45b66eb..0000000
--- a/services/forgejo-nsc/internal/app/service.go
+++ /dev/null
@@ -1,253 +0,0 @@
-package app
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"log/slog"
-	"strings"
-	"time"
-
-	"golang.org/x/sync/errgroup"
-
-	"github.com/burrow/forgejo-nsc/internal/forgejo"
-	"github.com/burrow/forgejo-nsc/internal/nsc"
-)
-
-type Dispatcher interface {
-	LaunchRunner(ctx context.Context, req nsc.LaunchRequest) (string, error)
-}
-
-type ForgejoClient interface {
-	RegistrationToken(ctx context.Context, scope forgejo.Scope) (string, error)
-}
-
-type Service struct {
-	forgejo    ForgejoClient
-	dispatcher Dispatcher
-	logger     *slog.Logger
-
-	defaultScope  forgejo.Scope
-	defaultLabels []string
-	instanceURL   string
-	defaultTTL    time.Duration
-
-	allowLabels map[string]struct{}
-	allowScopes map[string]struct{}
-}
-
-type Config struct {
-	DefaultScope  forgejo.Scope
-	DefaultLabels []string
-	InstanceURL   string
-	DefaultTTL    time.Duration
-	AllowLabels   []string
-	AllowScopes   []string
-}
-
-func NewService(cfg Config, forgejo ForgejoClient, dispatcher Dispatcher, logger *slog.Logger) *Service {
-	if logger == nil {
-		logger = slog.Default()
-	}
-	allowLabels := make(map[string]struct{}, len(cfg.AllowLabels))
-	for _, label := range cfg.AllowLabels {
-		allowLabels[normalizeLabel(label)] = struct{}{}
-	}
-	allowScopes := make(map[string]struct{}, len(cfg.AllowScopes))
-	for _, scope := range cfg.AllowScopes {
-		allowScopes[scope] = struct{}{}
-	}
-	return &Service{
-		defaultScope:  cfg.DefaultScope,
-		defaultLabels: cfg.DefaultLabels,
-		instanceURL:   cfg.InstanceURL,
-		defaultTTL:    cfg.DefaultTTL,
-		forgejo:       forgejo,
-		dispatcher:    dispatcher,
-		logger:        logger,
-		allowLabels:   allowLabels,
-		allowScopes:   allowScopes,
-	}
-}
-
-type DispatchRequest struct {
-	Count    int
-	Labels   []string
-	Scope    *Scope
-	TTL      time.Duration
-	Machine  string
-	Image    string
-	ExtraEnv map[string]string
-}
-
-type Scope struct {
-	Level string
-	Owner string
-	Name  string
-}
-
-type DispatchResponse struct {
-	Runners []RunnerHandle `json:"runners"`
-}
-
-type RunnerHandle struct {
-	Name string `json:"name"`
-}
-
-func (s *Service) Dispatch(ctx context.Context, req DispatchRequest) (DispatchResponse, error) {
-	count := req.Count
-	if count <= 0 {
-		count = 1
-	}
-
-	scope, err := s.mergeScope(req.Scope)
-	if err != nil {
-		return DispatchResponse{}, err
-	}
-
-	labels, err := s.mergeLabels(req.Labels)
-	if err != nil {
-		return DispatchResponse{}, err
-	}
-	if len(labels) == 0 {
-		return DispatchResponse{}, errors.New("no runner labels resolved")
-	}
-
-	ttl := req.TTL
-	if ttl == 0 {
-		ttl = s.defaultTTL
-	}
-
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
-
-	res := DispatchResponse{
-		Runners: make([]RunnerHandle, count),
-	}
-	eg, egCtx := errgroup.WithContext(ctx)
-
-	for i := 0; i < count; i++ {
-		index := i
-		eg.Go(func() error {
-			token, err := s.forgejo.RegistrationToken(egCtx, scope)
-			if err != nil {
-				return fmt.Errorf("fetching registration token: %w", err)
-			}
-
-			name, err := s.dispatcher.LaunchRunner(egCtx, nsc.LaunchRequest{
-				Token:       token,
-				InstanceURL: s.instanceURL,
-				Labels:      labels,
-				Duration:    ttl,
-				MachineType: req.Machine,
-				Image:       req.Image,
-				ExtraEnv:    req.ExtraEnv,
-			})
-			if err != nil {
-				return err
-			}
-
-			res.Runners[index] = RunnerHandle{Name: name}
-			return nil
-		})
-	}
-
-	if err := eg.Wait(); err != nil {
-		return DispatchResponse{}, err
-	}
-
-	return res, nil
-}
-
-func (s *Service) mergeScope(value *Scope) (forgejo.Scope, error) {
-	if value == nil {
-		return s.defaultScope, nil
-	}
-
-	scope := forgejo.Scope{
-		Level: forgejo.ScopeLevel(value.Level),
-		Owner: value.Owner,
-		Name:  value.Name,
-	}
-	if scope.Level == "" {
-		return forgejo.Scope{}, errors.New("scope level is required")
-	}
-	switch scope.Level {
-	case forgejo.ScopeInstance:
-		if !s.scopeAllowed(scope) {
-			return forgejo.Scope{}, fmt.Errorf("scope %q not allowed", scopeKey(scope))
-		}
-		return scope, nil
-	case forgejo.ScopeOrganization:
-		if scope.Owner == "" {
-			return forgejo.Scope{}, errors.New("organization scope requires owner")
-		}
-		if !s.scopeAllowed(scope) {
-			return forgejo.Scope{}, fmt.Errorf("scope %q not allowed", scopeKey(scope))
-		}
-		return scope, nil
-	case forgejo.ScopeRepository:
-		if scope.Owner == "" || scope.Name == "" {
-			return forgejo.Scope{}, errors.New("repository scope requires owner and name")
-		}
-		if !s.scopeAllowed(scope) {
-			return forgejo.Scope{}, fmt.Errorf("scope %q not allowed", scopeKey(scope))
-		}
-		return scope, nil
-	default:
-		return forgejo.Scope{}, fmt.Errorf("unsupported scope %q", scope.Level)
-	}
-}
-
-func (s *Service) mergeLabels(labels []string) ([]string, error) {
-	var resolved []string
-	if len(labels) == 0 {
-		resolved = append([]string{}, s.defaultLabels...)
-	} else {
-		resolved = labels
-	}
-	if len(s.allowLabels) == 0 {
-		return resolved, nil
-	}
-	for _, label := range resolved {
-		norm := normalizeLabel(label)
-		if _, ok := s.allowLabels[norm]; !ok {
-			return nil, fmt.Errorf("label %q not allowed", label)
-		}
-	}
-	return resolved, nil
-}
-
-func normalizeLabel(label string) string {
-	trimmed := strings.TrimSpace(label)
-	if trimmed == "" {
-		return ""
-	}
-	// Ignore any explicit executor suffix ("label:host"), since workflows
-	// and config allowlists typically deal in base label names.
-	if before, _, ok := strings.Cut(trimmed, ":"); ok {
-		return before
-	}
-	return trimmed
-}
-
-func scopeKey(scope forgejo.Scope) string {
-	switch scope.Level {
-	case forgejo.ScopeInstance:
-		return "instance"
-	case forgejo.ScopeOrganization:
-		return fmt.Sprintf("organization:%s", scope.Owner)
-	case forgejo.ScopeRepository:
-		return fmt.Sprintf("repository:%s/%s", scope.Owner, scope.Name)
-	default:
-		return string(scope.Level)
-	}
-}
-
-func (s *Service) scopeAllowed(scope forgejo.Scope) bool {
-	if len(s.allowScopes) == 0 {
-		return true
-	}
-	_, ok := s.allowScopes[scopeKey(scope)]
-	return ok
-}
diff --git a/services/forgejo-nsc/internal/app/service_test.go b/services/forgejo-nsc/internal/app/service_test.go
deleted file mode 100644
index 2be3d3c..0000000
--- a/services/forgejo-nsc/internal/app/service_test.go
+++ /dev/null
@@ -1,160 +0,0 @@
-package app
-
-import (
-	"context"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/burrow/forgejo-nsc/internal/forgejo"
-	"github.com/burrow/forgejo-nsc/internal/nsc"
-)
-
-type mockForgejo struct {
-	mu      sync.Mutex
-	tokens  []string
-	scopes  []forgejo.Scope
-	err     error
-	counter int
-}
-
-func (m *mockForgejo) RegistrationToken(ctx context.Context, scope forgejo.Scope) (string, error) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.scopes = append(m.scopes, scope)
-	if m.err != nil {
-		return "", m.err
-	}
-	if m.counter >= len(m.tokens) {
-		return "", context.Canceled
-	}
-	tok := m.tokens[m.counter]
-	m.counter++
-	return tok, nil
-}
-
-type mockDispatcher struct {
-	mu        sync.Mutex
-	requests  []nsc.LaunchRequest
-	responses []string
-	err       error
-}
-
-func (m *mockDispatcher) LaunchRunner(ctx context.Context, req nsc.LaunchRequest) (string, error) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	if m.err != nil {
-		return "", m.err
-	}
-	m.requests = append(m.requests, req)
-	idx := len(m.requests) - 1
-	if idx < len(m.responses) {
-		return m.responses[idx], nil
-	}
-	return "runner", nil
-}
-
-func TestServiceDispatchUsesDefaults(t *testing.T) {
-	forgejoMock := &mockForgejo{tokens: []string{"token"}}
-	dispatcherMock := &mockDispatcher{responses: []string{"runner-default"}}
-
-	cfg := Config{
-		DefaultScope:  forgejo.Scope{Level: forgejo.ScopeInstance},
-		DefaultLabels: []string{"nscloud"},
-		InstanceURL:   "https://forgejo.example.com",
-		DefaultTTL:    15 * time.Minute,
-	}
-
-	service := NewService(cfg, forgejoMock, dispatcherMock, nil)
-
-	resp, err := service.Dispatch(context.Background(), DispatchRequest{})
-	if err != nil {
-		t.Fatalf("Dispatch returned error: %v", err)
-	}
-	if len(resp.Runners) != 1 || resp.Runners[0].Name != "runner-default" {
-		t.Fatalf("unexpected dispatch response: %+v", resp)
-	}
-
-	if len(forgejoMock.scopes) != 1 || forgejoMock.scopes[0].Level != forgejo.ScopeInstance {
-		t.Fatalf("expected default scope, got %+v", forgejoMock.scopes)
-	}
-
-	if len(dispatcherMock.requests) != 1 {
-		t.Fatalf("expected one dispatcher call, got %d", len(dispatcherMock.requests))
-	}
-	req := dispatcherMock.requests[0]
-	if req.InstanceURL != cfg.InstanceURL {
-		t.Fatalf("expected instance URL %s, got %s", cfg.InstanceURL, req.InstanceURL)
-	}
-	if got := req.Labels; len(got) != 1 || got[0] != "nscloud" {
-		t.Fatalf("expected default labels, got %v", got)
-	}
-	if req.Duration != cfg.DefaultTTL {
-		t.Fatalf("expected duration %v, got %v", cfg.DefaultTTL, req.Duration)
-	}
-}
-
-func TestServiceDispatchCustomScopeAndCount(t *testing.T) {
-	forgejoMock := &mockForgejo{tokens: []string{"token-1", "token-2"}}
-	dispatcherMock := &mockDispatcher{responses: []string{"runner-1", "runner-2"}}
-
-	cfg := Config{
-		DefaultScope:  forgejo.Scope{Level: forgejo.ScopeInstance},
-		DefaultLabels: []string{"default"},
-		InstanceURL:   "https://forgejo.example.com",
-		DefaultTTL:    10 * time.Minute,
-	}
-
-	service := NewService(cfg, forgejoMock, dispatcherMock, nil)
-
-	reqScope := &Scope{Level: string(forgejo.ScopeRepository), Owner: "acme", Name: "repo"}
-	res, err := service.Dispatch(context.Background(), DispatchRequest{
-		Count:    2,
-		Labels:   []string{"custom"},
-		Scope:    reqScope,
-		TTL:      5 * time.Minute,
-		Machine:  "4x8",
-		Image:    "runner:latest",
-		ExtraEnv: map[string]string{"FOO": "bar"},
-	})
-	if err != nil {
-		t.Fatalf("Dispatch returned error: %v", err)
-	}
-	if len(res.Runners) != 2 {
-		t.Fatalf("expected two runners, got %+v", res)
-	}
-
-	if len(forgejoMock.scopes) != 2 {
-		t.Fatalf("expected two scope calls, got %d", len(forgejoMock.scopes))
-	}
-	for _, scope := range forgejoMock.scopes {
-		if scope.Level != forgejo.ScopeRepository || scope.Owner != "acme" || scope.Name != "repo" {
-			t.Fatalf("unexpected scope: %+v", scope)
-		}
-	}
-
-	if len(dispatcherMock.requests) != 2 {
-		t.Fatalf("expected two dispatcher calls, got %d", len(dispatcherMock.requests))
-	}
-	for _, call := range dispatcherMock.requests {
-		if call.MachineType != "4x8" || call.Image != "runner:latest" {
-			t.Fatalf("unexpected machine/image in %+v", call)
-		}
-		if call.Duration != 5*time.Minute {
-			t.Fatalf("expected TTL to override default, got %v", call.Duration)
-		}
-		if call.Labels[0] != "custom" {
-			t.Fatalf("expected custom labels, got %v", call.Labels)
-		}
-		if call.ExtraEnv["FOO"] != "bar" {
-			t.Fatalf("expected env passthrough, got %v", call.ExtraEnv)
-		}
-	}
-}
-
-func TestServiceDispatchErrorsWithoutLabels(t *testing.T) {
-	service := NewService(Config{DefaultScope: forgejo.Scope{Level: forgejo.ScopeInstance}}, &mockForgejo{}, &mockDispatcher{}, nil)
-	if _, err := service.Dispatch(context.Background(), DispatchRequest{}); err == nil {
-		t.Fatalf("expected error when no labels are available")
-	}
-}
diff --git a/services/forgejo-nsc/internal/autoscaler/config.go b/services/forgejo-nsc/internal/autoscaler/config.go
deleted file mode 100644
index d252664..0000000
--- a/services/forgejo-nsc/internal/autoscaler/config.go
+++ /dev/null
@@ -1,108 +0,0 @@
-package autoscaler
-
-import (
-	"fmt"
-	"os"
-	"time"
-
-	"gopkg.in/yaml.v3"
-
-	"github.com/burrow/forgejo-nsc/internal/config"
-)
-
-type Config struct {
-	Listen     string           `yaml:"listen"`
-	Dispatcher DispatcherConfig `yaml:"dispatcher"`
-	Instances  []InstanceConfig `yaml:"instances"`
-}
-
-type DispatcherConfig struct {
-	URL     string          `yaml:"url"`
-	Timeout config.Duration `yaml:"timeout"`
-}
-
-type InstanceConfig struct {
-	Name           string             `yaml:"name"`
-	Forgejo        ForgejoInstance    `yaml:"forgejo"`
-	Scope          config.ScopeConfig `yaml:"scope"`
-	PollInterval   config.Duration    `yaml:"poll_interval"`
-	DisablePolling bool               `yaml:"disable_polling"`
-	WebhookSecret  string             `yaml:"webhook_secret"`
-	Webhook        WebhookConfig      `yaml:"webhook"`
-	Dispatcher     *DispatcherConfig  `yaml:"dispatcher"`
-	Targets        []TargetConfig     `yaml:"targets"`
-}
-
-type ForgejoInstance struct {
-	BaseURL string `yaml:"base_url"`
-	Token   string `yaml:"token"`
-}
-
-type WebhookConfig struct {
-	URL         string   `yaml:"url"`
-	ContentType string   `yaml:"content_type"`
-	Events      []string `yaml:"events"`
-	Active      *bool    `yaml:"active"`
-}
-
-type TargetConfig struct {
-	Labels      []string          `yaml:"labels"`
-	MinIdle     int               `yaml:"min_idle"`
-	TTL         config.Duration   `yaml:"ttl"`
-	MachineType string            `yaml:"machine_type"`
-	Image       string            `yaml:"image"`
-	Env         map[string]string `yaml:"env"`
-}
-
-func LoadConfig(path string) (Config, error) {
-	data, err := os.ReadFile(path)
-	if err != nil {
-		return Config{}, err
-	}
-	var cfg Config
-	if err := yaml.Unmarshal(data, &cfg); err != nil {
-		return Config{}, err
-	}
-	if cfg.Listen == "" {
-		cfg.Listen = ":8090"
-	}
-	if cfg.Dispatcher.URL == "" {
-		return Config{}, fmt.Errorf("dispatcher.url is required")
-	}
-	if cfg.Dispatcher.Timeout.Duration == 0 {
-		cfg.Dispatcher.Timeout = config.Duration{Duration: 2 * time.Hour}
-	}
-	if len(cfg.Instances) == 0 {
-		return Config{}, fmt.Errorf("at least one instance must be configured")
-	}
-	for i := range cfg.Instances {
-		inst := &cfg.Instances[i]
-		if inst.Name == "" {
-			return Config{}, fmt.Errorf("instance[%d] missing name", i)
-		}
-		if inst.Forgejo.BaseURL == "" || inst.Forgejo.Token == "" {
-			return Config{}, fmt.Errorf("instance %s missing forgejo.base_url or token", inst.Name)
-		}
-		if inst.PollInterval.Duration == 0 {
-			inst.PollInterval = config.Duration{Duration: 30 * time.Second}
-		}
-		if len(inst.Webhook.Events) == 0 {
-			inst.Webhook.Events = []string{"workflow_job"}
-		}
-		if inst.Webhook.ContentType == "" {
-			inst.Webhook.ContentType = "json"
-		}
-		if len(inst.Targets) == 0 {
-			return Config{}, fmt.Errorf("instance %s requires at least one target", inst.Name)
-		}
-		for ti, tgt := range inst.Targets {
-			if len(tgt.Labels) == 0 {
-				return Config{}, fmt.Errorf("instance %s target[%d] missing labels", inst.Name, ti)
-			}
-			if tgt.MinIdle < 0 {
-				return Config{}, fmt.Errorf("instance %s target[%d] min_idle must be >= 0", inst.Name, ti)
-			}
-		}
-	}
-	return cfg, nil
-}
diff --git a/services/forgejo-nsc/internal/autoscaler/service.go b/services/forgejo-nsc/internal/autoscaler/service.go
deleted file mode 100644
index 08d4a42..0000000
--- a/services/forgejo-nsc/internal/autoscaler/service.go
+++ /dev/null
@@ -1,385 +0,0 @@
-package autoscaler
-
-import (
-	"bytes"
-	"context"
-	"crypto/hmac"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-
-	"namespacelabs.dev/foundation/std/tasks"
-
-	"github.com/burrow/forgejo-nsc/internal/forgejo"
-)
-
-type Service struct {
-	listen      string
-	controllers map[string]*InstanceController
-	router      chi.Router
-}
-
-func NewService(cfg Config) (*Service, error) {
-	controllers := make(map[string]*InstanceController)
-	for _, inst := range cfg.Instances {
-		scope, err := inst.Scope.ToScope()
-		if err != nil {
-			return nil, err
-		}
-		forgejoClient, err := forgejo.NewClient(inst.Forgejo.BaseURL, inst.Forgejo.Token)
-		if err != nil {
-			return nil, err
-		}
-		dispCfg := cfg.Dispatcher
-		if inst.Dispatcher != nil && inst.Dispatcher.URL != "" {
-			dispCfg = *inst.Dispatcher
-			if dispCfg.Timeout.Duration == 0 {
-				dispCfg.Timeout = cfg.Dispatcher.Timeout
-			}
-		}
-		dClient := newDispatcherClient(dispCfg.URL, dispCfg.Timeout.Duration)
-		webhookActive := true
-		if inst.Webhook.Active != nil {
-			webhookActive = *inst.Webhook.Active
-		}
-		controller := &InstanceController{
-			name:       inst.Name,
-			cfg:        inst,
-			scope:      scope,
-			forgejo:    forgejoClient,
-			dispatcher: dClient,
-			webhook: forgejo.WebhookConfig{
-				URL:         inst.Webhook.URL,
-				ContentType: inst.Webhook.ContentType,
-				Events:      inst.Webhook.Events,
-				Active:      webhookActive,
-			},
-			secret: inst.WebhookSecret,
-		}
-		controllers[inst.Name] = controller
-	}
-
-	router := chi.NewRouter()
-	service := &Service{
-		listen:      cfg.Listen,
-		controllers: controllers,
-		router:      router,
-	}
-
-	router.Get("/healthz", func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte("ok"))
-	})
-	router.Post("/webhook/{instance}", service.handleWebhook)
-
-	return service, nil
-}
-
-func (s *Service) Start(ctx context.Context) error {
-	for _, controller := range s.controllers {
-		if err := controller.EnsureWebhook(ctx); err != nil {
-			return err
-		}
-	}
-
-	var wg sync.WaitGroup
-	for _, controller := range s.controllers {
-		wg.Add(1)
-		go func(c *InstanceController) {
-			defer wg.Done()
-			c.Run(ctx)
-		}(controller)
-	}
-
-	srv := &http.Server{
-		Addr:    s.listen,
-		Handler: s.router,
-	}
-
-	go func() {
-		<-ctx.Done()
-		_ = srv.Shutdown(context.Background())
-	}()
-
-	if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
-		return err
-	}
-	wg.Wait()
-	return nil
-}
-
-func (s *Service) handleWebhook(w http.ResponseWriter, r *http.Request) {
-	name := chi.URLParam(r, "instance")
-	controller, ok := s.controllers[name]
-	if !ok {
-		http.Error(w, "unknown instance", http.StatusNotFound)
-		return
-	}
-	body, err := io.ReadAll(r.Body)
-	if err != nil {
-		http.Error(w, "invalid body", http.StatusBadRequest)
-		return
-	}
-	if controller.cfg.WebhookSecret != "" {
-		signature := r.Header.Get("X-Gitea-Signature")
-		if signature == "" {
-			http.Error(w, "missing signature", http.StatusUnauthorized)
-			return
-		}
-		if !verifySignature(controller.cfg.WebhookSecret, signature, body) {
-			http.Error(w, "invalid signature", http.StatusUnauthorized)
-			return
-		}
-	}
-
-	var payload workflowJobPayload
-	if err := json.Unmarshal(body, &payload); err != nil {
-		http.Error(w, "bad payload", http.StatusBadRequest)
-		return
-	}
-
-	controller.MarkWebhookSeen()
-	if payload.Action == "queued" {
-		controller.DispatchForJob(r.Context(), payload)
-	}
-
-	w.WriteHeader(http.StatusAccepted)
-}
-
-type workflowJobPayload struct {
-	Action      string `json:"action"`
-	WorkflowJob struct {
-		Labels []string `json:"labels"`
-	} `json:"workflow_job"`
-}
-
-type InstanceController struct {
-	name       string
-	cfg        InstanceConfig
-	scope      forgejo.Scope
-	forgejo    *forgejo.Client
-	dispatcher *dispatcherClient
-	ready      atomic.Bool
-	webhook    forgejo.WebhookConfig
-	secret     string
-}
-
-func (c *InstanceController) EnsureWebhook(ctx context.Context) error {
-	if c.webhook.URL == "" {
-		return nil
-	}
-	return tasks.Action("autoscaler.ensure-webhook").Arg("instance", c.name).Run(ctx, func(ctx context.Context) error {
-		return c.forgejo.EnsureWebhook(ctx, c.scope, c.webhook, c.secret)
-	})
-}
-
-func (c *InstanceController) Run(ctx context.Context) {
-	if c.cfg.DisablePolling {
-		<-ctx.Done()
-		return
-	}
-	ticker := time.NewTicker(c.cfg.PollInterval.Duration)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			_ = tasks.Action("autoscaler.poll").Arg("instance", c.name).Run(ctx, func(ctx context.Context) error {
-				return c.reconcile(ctx)
-			})
-		}
-	}
-}
-
-func (c *InstanceController) reconcile(ctx context.Context) error {
-	runners, err := c.forgejo.ListRunners(ctx, c.scope)
-	if err != nil {
-		// Keep polling even if runner listing fails; we can still dispatch based on queued jobs.
-		runners = nil
-	}
-
-	for _, target := range c.cfg.Targets {
-		idle := countIdle(runners, target.Labels)
-
-		need := 0
-		if idle < target.MinIdle {
-			need = target.MinIdle - idle
-		}
-
-		jobs, jobErr := c.forgejo.ListRunJobs(ctx, c.scope, target.Labels)
-		if jobErr != nil {
-			return jobErr
-		}
-		waiting := countWaitingJobs(jobs, target.Labels)
-		// Scale-to-zero friendly: if anything is waiting and there are no idle runners
-		// for that label set, dispatch exactly one runner to unblock the queue.
-		if waiting > 0 && idle == 0 && need < 1 {
-			need = 1
-		}
-
-		if need <= 0 {
-			continue
-		}
-		if err := c.dispatch(ctx, target, need, "poll"); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (c *InstanceController) dispatch(ctx context.Context, target TargetConfig, count int, reason string) error {
-	if count <= 0 {
-		return nil
-	}
-	req := dispatcherRequest{
-		Count:  count,
-		Labels: target.Labels,
-	}
-	if target.TTL.Duration > 0 {
-		req.TTL = target.TTL.Duration.String()
-	}
-	if target.MachineType != "" {
-		req.MachineType = target.MachineType
-	}
-	if target.Image != "" {
-		req.Image = target.Image
-	}
-	if len(target.Env) > 0 {
-		req.Env = target.Env
-	}
-	return tasks.Action("autoscaler.dispatch").Arg("instance", c.name).Arg("reason", reason).Arg("labels", strings.Join(target.Labels, ",")).Run(ctx, func(ctx context.Context) error {
-		return c.dispatcher.Dispatch(ctx, req)
-	})
-}
-
-func (c *InstanceController) DispatchForJob(ctx context.Context, payload workflowJobPayload) {
-	action := strings.ToLower(payload.Action)
-	if action != "queued" && action != "waiting" {
-		return
-	}
-	jobLabels := payload.WorkflowJob.Labels
-	for _, target := range c.cfg.Targets {
-		if labelsMatch(jobLabels, target.Labels) {
-			_ = c.dispatch(ctx, target, 1, "webhook")
-			return
-		}
-	}
-}
-
-func (c *InstanceController) MarkWebhookSeen() {
-	c.ready.Store(true)
-}
-
-func countIdle(runners []forgejo.Runner, labels []string) int {
-	count := 0
-	for _, runner := range runners {
-		if strings.ToLower(runner.Status) != "online" || runner.Busy {
-			continue
-		}
-		if labelsMatch(extractLabels(runner.Labels), labels) {
-			count++
-		}
-	}
-	return count
-}
-
-func countWaitingJobs(jobs []forgejo.RunJob, labels []string) int {
-	count := 0
-	for _, job := range jobs {
-		if status := strings.ToLower(job.Status); status != "waiting" && status != "queued" {
-			continue
-		}
-		if labelsMatch(job.RunsOn, labels) {
-			count++
-		}
-	}
-	return count
-}
-
-func extractLabels(src []forgejo.RunnerLabel) []string {
-	result := make([]string, 0, len(src))
-	for _, lbl := range src {
-		result = append(result, lbl.Name)
-	}
-	return result
-}
-
-func labelsMatch(have, want []string) bool {
-	set := make(map[string]struct{}, len(have))
-	for _, label := range have {
-		set[label] = struct{}{}
-	}
-	for _, label := range want {
-		if _, ok := set[label]; !ok {
-			return false
-		}
-	}
-	return true
-}
-
-func verifySignature(secret, signature string, body []byte) bool {
-	parts := strings.SplitN(signature, "=", 2)
-	if len(parts) == 2 {
-		signature = parts[1]
-	}
-	mac := hmac.New(sha256.New, []byte(secret))
-	mac.Write(body)
-	expected := hex.EncodeToString(mac.Sum(nil))
-	return hmac.Equal([]byte(expected), []byte(signature))
-}
-
-type dispatcherClient struct {
-	url    string
-	client *http.Client
-}
-
-type dispatcherRequest struct {
-	Count       int               `json:"count"`
-	Labels      []string          `json:"labels"`
-	TTL         string            `json:"ttl,omitempty"`
-	MachineType string            `json:"machine_type,omitempty"`
-	Image       string            `json:"image,omitempty"`
-	Env         map[string]string `json:"env,omitempty"`
-}
-
-func newDispatcherClient(url string, timeout time.Duration) *dispatcherClient {
-	if timeout == 0 {
-		timeout = 30 * time.Second
-	}
-	return &dispatcherClient{
-		url: url,
-		client: &http.Client{
-			Timeout: timeout,
-		},
-	}
-}
-
-func (d *dispatcherClient) Dispatch(ctx context.Context, req dispatcherRequest) error {
-	body, _ := json.Marshal(req)
-	endpoint := strings.TrimSuffix(d.url, "/") + "/api/v1/dispatch"
-	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
-	if err != nil {
-		return err
-	}
-	httpReq.Header.Set("Content-Type", "application/json")
-	resp, err := d.client.Do(httpReq)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode >= 300 {
-		return fmt.Errorf("dispatcher returned %s", resp.Status)
-	}
-	return nil
-}
diff --git a/services/forgejo-nsc/internal/config/config.go b/services/forgejo-nsc/internal/config/config.go
deleted file mode 100644
index 264cbd0..0000000
--- a/services/forgejo-nsc/internal/config/config.go
+++ /dev/null
@@ -1,185 +0,0 @@
-package config
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"strings"
-	"time"
-
-	"gopkg.in/yaml.v3"
-
-	"github.com/burrow/forgejo-nsc/internal/forgejo"
-)
-
-// Duration wraps time.Duration to support YAML unmarshalling from strings.
-type Duration struct {
-	time.Duration
-}
-
-// UnmarshalYAML implements yaml.v3 unmarshalling for Duration.
-func (d *Duration) UnmarshalYAML(value *yaml.Node) error {
-	switch value.Tag {
-	case "!!int":
-		var seconds int64
-		if err := value.Decode(&seconds); err != nil {
-			return err
-		}
-		d.Duration = time.Duration(seconds) * time.Second
-		return nil
-	default:
-		parsed, err := time.ParseDuration(value.Value)
-		if err != nil {
-			return err
-		}
-		d.Duration = parsed
-		return nil
-	}
-}
-
-// MarshalYAML implements yaml.v3 marshalling.
-func (d Duration) MarshalYAML() (any, error) {
-	return d.Duration.String(), nil
-}
-
-type Config struct {
-	Listen    string          `yaml:"listen"`
-	Forgejo   ForgejoConfig   `yaml:"forgejo"`
-	Namespace NamespaceConfig `yaml:"namespace"`
-	Runner    RunnerConfig    `yaml:"runner"`
-}
-
-type ForgejoConfig struct {
-	BaseURL       string      `yaml:"base_url"`
-	// InstanceURL is the URL runners should use when registering with Forgejo.
-	// This must be reachable from the spawned runner (e.g. the public URL like
-	// https://git.burrow.net), and may differ from BaseURL (which can be a local
-	// loopback URL on the forge host).
-	InstanceURL   string      `yaml:"instance_url"`
-	Token         string      `yaml:"token"`
-	DefaultScope  ScopeConfig `yaml:"default_scope"`
-	DefaultLabels []string    `yaml:"default_labels"`
-	Timeout       Duration    `yaml:"timeout"`
-	ExtraHeaders  yaml.Node   `yaml:"extra_headers"`
-}
-
-type ScopeConfig struct {
-	Level string `yaml:"level"`
-	Owner string `yaml:"owner,omitempty"`
-	Name  string `yaml:"name,omitempty"`
-}
-
-type NamespaceConfig struct {
-	NSCBinary string `yaml:"nsc_binary"`
-	// ComputeBaseURL is the Namespace Cloud Compute API endpoint (Connect RPC base URL).
-	// This is used for macOS runners, since NSC "run" is container-based (Linux-only).
-	// Example: "https://ord4.compute.namespaceapis.com"
-	ComputeBaseURL string `yaml:"compute_base_url"`
-	Image          string `yaml:"image"`
-	MachineType    string `yaml:"machine_type"`
-	// MacosBaseImageID selects which macOS base image to use (e.g. "tahoe").
-	MacosBaseImageID string `yaml:"macos_base_image_id"`
-	// MacosMachineArch is the architecture used for macOS instances (typically "arm64").
-	MacosMachineArch string   `yaml:"macos_machine_arch"`
-	Duration         Duration `yaml:"duration"`
-	WorkDir          string   `yaml:"workdir"`
-	MaxParallel      int64    `yaml:"max_parallel"`
-	Environment      []string `yaml:"environment"`
-	AllowLabels      []string `yaml:"allow_labels"`
-	AllowScopes      []string `yaml:"allow_scopes"`
-	Network          string   `yaml:"network"`
-	InstanceTags     []string `yaml:"instance_tags"`
-}
-
-type RunnerConfig struct {
-	NamePrefix string `yaml:"name_prefix"`
-	Executor   string `yaml:"executor"`
-}
-
-func Load(path string) (*Config, error) {
-	data, err := os.ReadFile(path)
-	if err != nil {
-		return nil, err
-	}
-
-	var cfg Config
-	if err := yaml.Unmarshal(data, &cfg); err != nil {
-		return nil, err
-	}
-
-	if err := cfg.Validate(); err != nil {
-		return nil, err
-	}
-
-	return &cfg, nil
-}
-
-func (c *Config) Validate() error {
-	if c.Listen == "" {
-		c.Listen = ":8080"
-	}
-	if c.Runner.NamePrefix == "" {
-		c.Runner.NamePrefix = "nscloud-"
-	}
-	if c.Runner.Executor == "" {
-		c.Runner.Executor = "shell"
-	}
-
-	if c.Forgejo.BaseURL == "" {
-		return errors.New("forgejo.base_url is required")
-	}
-	if c.Forgejo.InstanceURL == "" {
-		// Backwards-compatible default: assume runners can reach the same URL.
-		c.Forgejo.InstanceURL = c.Forgejo.BaseURL
-	}
-	if c.Forgejo.Token == "" {
-		return errors.New("forgejo.token is required")
-	}
-	if c.Forgejo.Timeout.Duration == 0 {
-		c.Forgejo.Timeout.Duration = 30 * time.Second
-	}
-	if _, err := c.Forgejo.DefaultScope.ToScope(); err != nil {
-		return err
-	}
-
-	if c.Namespace.NSCBinary == "" {
-		c.Namespace.NSCBinary = "nsc"
-	}
-	if c.Namespace.Image == "" {
-		c.Namespace.Image = "code.forgejo.org/forgejo/runner:11"
-	}
-	if c.Namespace.MacosBaseImageID == "" {
-		c.Namespace.MacosBaseImageID = "tahoe"
-	}
-	if c.Namespace.MacosMachineArch == "" {
-		c.Namespace.MacosMachineArch = "arm64"
-	}
-	if c.Namespace.Duration.Duration == 0 {
-		c.Namespace.Duration.Duration = 30 * time.Minute
-	}
-	if c.Namespace.MaxParallel <= 0 {
-		c.Namespace.MaxParallel = 4
-	}
-
-	return nil
-}
-
-func (s ScopeConfig) ToScope() (forgejo.Scope, error) {
-	level := forgejo.ScopeLevel(strings.ToLower(s.Level))
-	switch level {
-	case forgejo.ScopeInstance:
-		return forgejo.Scope{Level: level}, nil
-	case forgejo.ScopeOrganization:
-		if s.Owner == "" {
-			return forgejo.Scope{}, errors.New("forgejo default scope requires owner for organization level")
-		}
-		return forgejo.Scope{Level: level, Owner: s.Owner}, nil
-	case forgejo.ScopeRepository:
-		if s.Owner == "" || s.Name == "" {
-			return forgejo.Scope{}, errors.New("forgejo default scope requires owner and name for repository level")
-		}
-		return forgejo.Scope{Level: level, Owner: s.Owner, Name: s.Name}, nil
-	default:
-		return forgejo.Scope{}, fmt.Errorf("unknown scope level %q", s.Level)
-	}
-}
diff --git a/services/forgejo-nsc/internal/config/config_test.go b/services/forgejo-nsc/internal/config/config_test.go
deleted file mode 100644
index e42f3c9..0000000
--- a/services/forgejo-nsc/internal/config/config_test.go
+++ /dev/null
@@ -1,41 +0,0 @@
-package config
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-)
-
-func TestLoadConfig(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "config.yaml")
-	content := `
-listen: ":9090"
-forgejo:
-  base_url: https://forgejo.test
-  token: abc
-  default_scope:
-    level: instance
-namespace:
-  nsc_binary: /usr/bin/nsc
-  image: ghcr.io/forgejo/runner:3
-  duration: 15m
-runner:
-  name_prefix: custom-
-`
-	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	cfg, err := Load(path)
-	if err != nil {
-		t.Fatalf("Load() error = %v", err)
-	}
-	if cfg.Listen != ":9090" {
-		t.Fatalf("unexpected listen addr: %s", cfg.Listen)
-	}
-	if cfg.Namespace.Duration.Duration != 15*time.Minute {
-		t.Fatalf("duration parsing failed: %s", cfg.Namespace.Duration.Duration)
-	}
-}
diff --git a/services/forgejo-nsc/internal/forgejo/client.go b/services/forgejo-nsc/internal/forgejo/client.go
deleted file mode 100644
index 7f63e0c..0000000
--- a/services/forgejo-nsc/internal/forgejo/client.go
+++ /dev/null
@@ -1,454 +0,0 @@
-package forgejo
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-	"net/url"
-	"path"
-	"strings"
-	"time"
-)
-
-type ScopeLevel string
-
-const (
-	ScopeInstance     ScopeLevel = "instance"
-	ScopeOrganization ScopeLevel = "organization"
-	ScopeRepository   ScopeLevel = "repository"
-)
-
-type Scope struct {
-	Level ScopeLevel
-	Owner string
-	Name  string
-}
-
-type Client struct {
-	baseURL *url.URL
-	token   string
-	client  *http.Client
-}
-
-type Runner struct {
-	ID     int64         `json:"id"`
-	Name   string        `json:"name"`
-	Status string        `json:"status"`
-	Busy   bool          `json:"busy"`
-	Labels []RunnerLabel `json:"labels"`
-}
-
-type RunnerLabel struct {
-	Name string `json:"name"`
-}
-
-type RunJob struct {
-	ID     int64    `json:"id"`
-	Name   string   `json:"name"`
-	RunsOn []string `json:"runs_on"`
-	Status string   `json:"status"`
-	TaskID int64    `json:"task_id"`
-}
-
-type WebhookConfig struct {
-	URL         string
-	ContentType string
-	Events      []string
-	Active      bool
-}
-
-type Option func(*Client)
-
-func WithHTTPClient(httpClient *http.Client) Option {
-	return func(c *Client) {
-		if httpClient != nil {
-			c.client = httpClient
-		}
-	}
-}
-
-func NewClient(rawURL, token string, opts ...Option) (*Client, error) {
-	if rawURL == "" {
-		return nil, errors.New("forgejo base URL is required")
-	}
-
-	u, err := url.Parse(rawURL)
-	if err != nil {
-		return nil, err
-	}
-
-	client := &Client{
-		baseURL: u,
-		token:   strings.TrimSpace(token),
-		client: &http.Client{
-			Timeout: 30 * time.Second,
-		},
-	}
-
-	for _, opt := range opts {
-		opt(client)
-	}
-
-	if client.token == "" {
-		return nil, errors.New("forgejo token is required")
-	}
-
-	return client, nil
-}
-
-type registrationTokenResponse struct {
-	Token string    `json:"token"`
-	TTL   time.Time `json:"expires_at"`
-}
-
-func (c *Client) RegistrationToken(ctx context.Context, scope Scope) (string, error) {
-	endpoint, err := c.registrationEndpoint(scope)
-	if err != nil {
-		return "", err
-	}
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
-	if err != nil {
-		return "", err
-	}
-	req.Header.Set("Authorization", fmt.Sprintf("token %s", c.token))
-	req.Header.Set("Accept", "application/json")
-
-	resp, err := c.client.Do(req)
-	if err != nil {
-		return "", err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode >= 400 {
-		return "", fmt.Errorf("forgejo returned %s", resp.Status)
-	}
-
-	var decoded registrationTokenResponse
-	if err := json.NewDecoder(resp.Body).Decode(&decoded); err != nil {
-		return "", err
-	}
-	if decoded.Token == "" {
-		return "", errors.New("forgejo response missing token")
-	}
-
-	return decoded.Token, nil
-}
-
-func (c *Client) ListRunners(ctx context.Context, scope Scope) ([]Runner, error) {
-	endpoint, err := c.runnersEndpoint(scope)
-	if err != nil {
-		return nil, err
-	}
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Authorization", fmt.Sprintf("token %s", c.token))
-	req.Header.Set("Accept", "application/json")
-
-	resp, err := c.client.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode >= 400 {
-		return nil, fmt.Errorf("forgejo returned %s", resp.Status)
-	}
-
-	var decoded []Runner
-	if err := json.NewDecoder(resp.Body).Decode(&decoded); err != nil {
-		return nil, err
-	}
-
-	return decoded, nil
-}
-
-func (c *Client) ListRunJobs(ctx context.Context, scope Scope, labels []string) ([]RunJob, error) {
-	endpoint, err := c.runJobsEndpoint(scope)
-	if err != nil {
-		return nil, err
-	}
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
-	if err != nil {
-		return nil, err
-	}
-	if len(labels) > 0 {
-		query := req.URL.Query()
-		query.Set("labels", strings.Join(labels, ","))
-		req.URL.RawQuery = query.Encode()
-	}
-	req.Header.Set("Authorization", fmt.Sprintf("token %s", c.token))
-	req.Header.Set("Accept", "application/json")
-
-	resp, err := c.client.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode >= 400 {
-		return nil, fmt.Errorf("forgejo returned %s", resp.Status)
-	}
-
-	var decoded []RunJob
-	if err := json.NewDecoder(resp.Body).Decode(&decoded); err != nil {
-		return nil, err
-	}
-
-	if decoded == nil {
-		decoded = []RunJob{}
-	}
-	return decoded, nil
-}
-
-func (c *Client) EnsureWebhook(ctx context.Context, scope Scope, cfg WebhookConfig, secret string) error {
-	if cfg.URL == "" {
-		return nil
-	}
-
-	hooks, err := c.listWebhooks(ctx, scope)
-	if err != nil {
-		return err
-	}
-
-	for _, hook := range hooks {
-		if strings.EqualFold(hook.Config.URL, cfg.URL) {
-			return c.updateWebhook(ctx, scope, hook.ID, cfg, secret)
-		}
-	}
-
-	return c.createWebhook(ctx, scope, cfg, secret)
-}
-
-func (c *Client) registrationEndpoint(scope Scope) (string, error) {
-	var segments []string
-	switch scope.Level {
-	case ScopeRepository:
-		if scope.Owner == "" || scope.Name == "" {
-			return "", errors.New("repository scope requires owner and name")
-		}
-		segments = []string{"api", "v1", "repos", scope.Owner, scope.Name, "actions", "runners", "registration-token"}
-	case ScopeOrganization:
-		if scope.Owner == "" {
-			return "", errors.New("organization scope requires owner")
-		}
-		segments = []string{"api", "v1", "orgs", scope.Owner, "actions", "runners", "registration-token"}
-	case ScopeInstance:
-		segments = []string{"api", "v1", "admin", "actions", "runners", "registration-token"}
-	default:
-		return "", fmt.Errorf("unsupported scope level %q", scope.Level)
-	}
-
-	clone := *c.baseURL
-	clone.Path = path.Join(append([]string{clone.Path}, segments...)...)
-	return clone.String(), nil
-}
-
-type webhook struct {
-	ID     int64                `json:"id"`
-	Config webhookConfigPayload `json:"config"`
-}
-
-type webhookConfigPayload struct {
-	URL         string `json:"url"`
-	ContentType string `json:"content_type"`
-}
-
-func (c *Client) listWebhooks(ctx context.Context, scope Scope) ([]webhook, error) {
-	endpoint, err := c.webhooksEndpoint(scope)
-	if err != nil {
-		return nil, err
-	}
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Authorization", fmt.Sprintf("token %s", c.token))
-	req.Header.Set("Accept", "application/json")
-
-	resp, err := c.client.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode >= 400 {
-		return nil, fmt.Errorf("forgejo returned %s", resp.Status)
-	}
-
-	var hooks []webhook
-	if err := json.NewDecoder(resp.Body).Decode(&hooks); err != nil {
-		return nil, err
-	}
-
-	return hooks, nil
-}
-
-func (c *Client) createWebhook(ctx context.Context, scope Scope, cfg WebhookConfig, secret string) error {
-	payload := webhookRequestPayload{
-		Type: "gitea",
-		Config: map[string]string{
-			"url":          cfg.URL,
-			"content_type": cfg.ContentType,
-			"secret":       secret,
-			"insecure_ssl": "0",
-		},
-		Events: cfg.Events,
-		Active: cfg.Active,
-	}
-
-	body, err := json.Marshal(payload)
-	if err != nil {
-		return err
-	}
-
-	endpoint, err := c.webhooksEndpoint(scope)
-	if err != nil {
-		return err
-	}
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Authorization", fmt.Sprintf("token %s", c.token))
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err := c.client.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode >= 400 {
-		return fmt.Errorf("forgejo returned %s", resp.Status)
-	}
-
-	return nil
-}
-
-func (c *Client) updateWebhook(ctx context.Context, scope Scope, id int64, cfg WebhookConfig, secret string) error {
-	payload := webhookRequestPayload{
-		Type: "gitea",
-		Config: map[string]string{
-			"url":          cfg.URL,
-			"content_type": cfg.ContentType,
-			"secret":       secret,
-			"insecure_ssl": "0",
-		},
-		Events: cfg.Events,
-		Active: cfg.Active,
-	}
-
-	body, err := json.Marshal(payload)
-	if err != nil {
-		return err
-	}
-
-	endpoint, err := c.webhooksEndpoint(scope)
-	if err != nil {
-		return err
-	}
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodPatch, fmt.Sprintf("%s/%d", endpoint, id), bytes.NewReader(body))
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Authorization", fmt.Sprintf("token %s", c.token))
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err := c.client.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode >= 400 {
-		return fmt.Errorf("forgejo returned %s", resp.Status)
-	}
-
-	return nil
-}
-
-func (c *Client) webhooksEndpoint(scope Scope) (string, error) {
-	var segments []string
-	switch scope.Level {
-	case ScopeRepository:
-		if scope.Owner == "" || scope.Name == "" {
-			return "", errors.New("repository scope requires owner and name")
-		}
-		segments = []string{"api", "v1", "repos", scope.Owner, scope.Name, "hooks"}
-	case ScopeOrganization:
-		if scope.Owner == "" {
-			return "", errors.New("organization scope requires owner")
-		}
-		segments = []string{"api", "v1", "orgs", scope.Owner, "hooks"}
-	default:
-		return "", fmt.Errorf("webhook management not supported for scope level %q", scope.Level)
-	}
-
-	clone := *c.baseURL
-	clone.Path = path.Join(append([]string{clone.Path}, segments...)...)
-	return clone.String(), nil
-}
-
-type webhookRequestPayload struct {
-	Type   string            `json:"type"`
-	Config map[string]string `json:"config"`
-	Events []string          `json:"events"`
-	Active bool              `json:"active"`
-}
-
-func (c *Client) runnersEndpoint(scope Scope) (string, error) {
-	var segments []string
-	switch scope.Level {
-	case ScopeRepository:
-		if scope.Owner == "" || scope.Name == "" {
-			return "", errors.New("repository scope requires owner and name")
-		}
-		segments = []string{"api", "v1", "repos", scope.Owner, scope.Name, "actions", "runners"}
-	case ScopeOrganization:
-		if scope.Owner == "" {
-			return "", errors.New("organization scope requires owner")
-		}
-		segments = []string{"api", "v1", "orgs", scope.Owner, "actions", "runners"}
-	case ScopeInstance:
-		segments = []string{"api", "v1", "actions", "runners"}
-	default:
-		return "", fmt.Errorf("unsupported scope level %q", scope.Level)
-	}
-
-	clone := *c.baseURL
-	clone.Path = path.Join(append([]string{clone.Path}, segments...)...)
-	return clone.String(), nil
-}
-
-func (c *Client) runJobsEndpoint(scope Scope) (string, error) {
-	var segments []string
-	switch scope.Level {
-	case ScopeRepository:
-		if scope.Owner == "" || scope.Name == "" {
-			return "", errors.New("repository scope requires owner and name")
-		}
-		segments = []string{"api", "v1", "repos", scope.Owner, scope.Name, "actions", "runners", "jobs"}
-	case ScopeOrganization:
-		if scope.Owner == "" {
-			return "", errors.New("organization scope requires owner")
-		}
-		segments = []string{"api", "v1", "orgs", scope.Owner, "actions", "runners", "jobs"}
-	default:
-		return "", fmt.Errorf("run jobs not supported for scope level %q", scope.Level)
-	}
-
-	clone := *c.baseURL
-	clone.Path = path.Join(append([]string{clone.Path}, segments...)...)
-	return clone.String(), nil
-}
diff --git a/services/forgejo-nsc/internal/nsc/dispatcher.go b/services/forgejo-nsc/internal/nsc/dispatcher.go
deleted file mode 100644
index 33721b6..0000000
--- a/services/forgejo-nsc/internal/nsc/dispatcher.go
+++ /dev/null
@@ -1,466 +0,0 @@
-package nsc
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"log/slog"
-	"os/exec"
-	"strings"
-	"time"
-
-	"github.com/google/uuid"
-	"golang.org/x/sync/semaphore"
-)
-
-type Options struct {
-	BinaryPath       string
-	DefaultImage     string
-	DefaultMachine   string
-	DefaultDuration  time.Duration
-	WorkDir          string
-	MaxParallel      int64
-	RunnerNamePrefix string
-	Executor         string
-	Network          string
-	ComputeBaseURL   string
-	MacosBaseImageID string
-	MacosMachineArch string
-	Logger           *slog.Logger
-}
-
-type LaunchRequest struct {
-	Token       string
-	InstanceURL string
-	Labels      []string
-	Duration    time.Duration
-	MachineType string
-	Image       string
-	ExtraEnv    map[string]string
-}
-
-type Dispatcher struct {
-	opts Options
-	sem  *semaphore.Weighted
-	log  *slog.Logger
-}
-
-func NewDispatcher(opts Options) (*Dispatcher, error) {
-	if opts.BinaryPath == "" {
-		return nil, errors.New("nsc binary path is required")
-	}
-	if opts.DefaultImage == "" {
-		return nil, errors.New("default Namespace runner image is required")
-	}
-	if opts.RunnerNamePrefix == "" {
-		opts.RunnerNamePrefix = "nscloud-"
-	}
-	if opts.Executor == "" {
-		opts.Executor = "shell"
-	}
-	if opts.MacosBaseImageID == "" {
-		opts.MacosBaseImageID = "tahoe"
-	}
-	if opts.MacosMachineArch == "" {
-		opts.MacosMachineArch = "arm64"
-	}
-	if opts.MaxParallel <= 0 {
-		opts.MaxParallel = 4
-	}
-	if opts.DefaultDuration == 0 {
-		opts.DefaultDuration = 30 * time.Minute
-	}
-	logger := opts.Logger
-	if logger == nil {
-		logger = slog.New(slog.NewTextHandler(io.Discard, nil))
-	}
-
-	return &Dispatcher{
-		opts: opts,
-		sem:  semaphore.NewWeighted(opts.MaxParallel),
-		log:  logger,
-	}, nil
-}
-
-func (d *Dispatcher) LaunchRunner(ctx context.Context, req LaunchRequest) (string, error) {
-	if req.Token == "" {
-		return "", errors.New("registration token is required")
-	}
-	if req.InstanceURL == "" {
-		return "", errors.New("forgejo instance url is required")
-	}
-	if err := d.sem.Acquire(ctx, 1); err != nil {
-		return "", err
-	}
-	defer d.sem.Release(1)
-
-	runnerName := d.generateName()
-	duration := req.Duration
-	if duration == 0 {
-		duration = d.opts.DefaultDuration
-	}
-	machineType := choose(req.MachineType, d.opts.DefaultMachine)
-	image := choose(req.Image, d.opts.DefaultImage)
-
-	if hasWindowsLabel(req.Labels) {
-		if err := d.launchWindowsRunnerViaWinRM(ctx, runnerName, req, duration, machineType); err != nil {
-			return "", err
-		}
-		return runnerName, nil
-	}
-
-	if hasMacOSLabel(req.Labels) {
-		// Compute macOS shapes differ from the Linux "run" defaults. If the request
-		// didn't specify a machine type, ensure we pick a macOS-valid default.
-		if machineType == "" || machineType == d.opts.DefaultMachine {
-			machineType = "12x28"
-		}
-
-		// Prefer the Compute API path because it uses the service token (NSC_TOKEN_FILE)
-		// and does not require an interactive `nsc login` session.
-		if err := d.launchMacOSRunner(ctx, runnerName, req, duration, machineType); err != nil {
-			d.log.Warn("macos compute launch failed; falling back to nsc create+ssh", "runner", runnerName, "err", err)
-			if err := d.launchMacOSRunnerViaNSC(ctx, runnerName, req, duration, machineType); err != nil {
-				return "", err
-			}
-		}
-		return runnerName, nil
-	}
-
-	env := map[string]string{
-		"FORGEJO_INSTANCE_URL":  req.InstanceURL,
-		"FORGEJO_RUNNER_TOKEN":  req.Token,
-		"FORGEJO_RUNNER_NAME":   runnerName,
-		"FORGEJO_RUNNER_LABELS": strings.Join(req.Labels, ","),
-		"FORGEJO_RUNNER_EXEC":   d.opts.Executor,
-	}
-	for k, v := range req.ExtraEnv {
-		env[k] = v
-	}
-	if _, ok := env["NSC_CACHE_PATH"]; !ok {
-		env["NSC_CACHE_PATH"] = "/nix/store"
-	}
-
-	script := d.bootstrapScript()
-	args := []string{
-		"run",
-		"--wait",
-		"--output",
-		"json",
-		"--duration", duration.String(),
-		"--image", image,
-		"--name", runnerName,
-		"--user", "root",
-	}
-	if machineType != "" {
-		args = append(args, "--machine_type", machineType)
-	}
-	if d.opts.Network != "" {
-		args = append(args, "--network", d.opts.Network)
-	}
-	for key, value := range env {
-		if value == "" {
-			continue
-		}
-		args = append(args, "-e", fmt.Sprintf("%s=%s", key, value))
-	}
-	if d.opts.WorkDir != "" {
-		args = append(args, "-e", fmt.Sprintf("FORGEJO_RUNNER_WORKDIR=%s", d.opts.WorkDir))
-	}
-
-	args = append(args, "--", "/bin/sh", "-c", script)
-
-	cmd := exec.CommandContext(ctx, d.opts.BinaryPath, args...)
-	var buf bytes.Buffer
-	cmd.Stdout = &buf
-	cmd.Stderr = &buf
-
-	start := time.Now()
-	d.log.Info("launching Namespace runner",
-		"runner", runnerName,
-		"machine_type", machineType,
-		"image", image,
-	)
-	err := cmd.Run()
-	if err != nil {
-		return "", fmt.Errorf("nsc run failed: %w\n%s", err, buf.String())
-	}
-
-	if output := strings.TrimSpace(buf.String()); output != "" {
-		d.log.Info("runner output", "runner", runnerName, "output", output)
-	}
-
-	d.log.Info("runner completed",
-		"runner", runnerName,
-		"duration", time.Since(start),
-	)
-
-	if instanceID := parseInstanceID(buf.String()); instanceID != "" {
-		waitCtx, cancel := context.WithTimeout(context.Background(), duration)
-		defer cancel()
-		stopped := d.waitForInstanceStop(waitCtx, runnerName, instanceID, duration)
-		if !stopped {
-			d.log.Warn("runner did not stop before timeout", "runner", runnerName, "instance", instanceID)
-		}
-		d.destroyInstance(waitCtx, runnerName, instanceID)
-	}
-
-	return runnerName, nil
-}
-
-func (d *Dispatcher) generateName() string {
-	id := strings.ReplaceAll(uuid.NewString(), "-", "")
-	return d.opts.RunnerNamePrefix + id[:12]
-}
-
-func parseInstanceID(output string) string {
-	if jsonBlob := extractJSON(output); jsonBlob != "" {
-		var payload struct {
-			ClusterID string `json:"cluster_id"`
-		}
-		if err := json.Unmarshal([]byte(jsonBlob), &payload); err == nil && payload.ClusterID != "" {
-			return payload.ClusterID
-		}
-	}
-	const marker = "ID:"
-	idx := strings.Index(output, marker)
-	if idx == -1 {
-		return ""
-	}
-	rest := strings.TrimSpace(output[idx+len(marker):])
-	if rest == "" {
-		return ""
-	}
-	fields := strings.Fields(rest)
-	if len(fields) == 0 {
-		return ""
-	}
-	return fields[0]
-}
-
-func extractJSON(output string) string {
-	trimmed := strings.TrimSpace(output)
-	if trimmed == "" {
-		return ""
-	}
-	start := strings.IndexAny(trimmed, "[{")
-	if start == -1 {
-		return ""
-	}
-	end := strings.LastIndexAny(trimmed, "]}")
-	if end == -1 || end < start {
-		return ""
-	}
-	return trimmed[start : end+1]
-}
-
-type describeResponse struct {
-	Resource    string                    `json:"resource"`
-	PerResource map[string]describeTarget `json:"per_resource"`
-}
-
-type describeTarget struct {
-	Tombstone string              `json:"tombstone"`
-	Container []describeContainer `json:"container"`
-}
-
-type describeContainer struct {
-	Status       string `json:"status"`
-	TerminatedAt string `json:"terminated_at"`
-}
-
-func instanceStopped(output string) bool {
-	jsonBlob := extractJSON(output)
-	if jsonBlob == "" {
-		return false
-	}
-	var payload []describeResponse
-	if err := json.Unmarshal([]byte(jsonBlob), &payload); err != nil {
-		return false
-	}
-	if len(payload) == 0 {
-		return false
-	}
-	seenTerminalState := false
-	for _, entry := range payload {
-		if len(entry.PerResource) == 0 {
-			return false
-		}
-		for _, target := range entry.PerResource {
-			if target.Tombstone != "" {
-				seenTerminalState = true
-				return true
-			}
-			if len(target.Container) == 0 {
-				return false
-			}
-			for _, container := range target.Container {
-				if container.Status != "stopped" && container.TerminatedAt == "" {
-					return false
-				}
-				seenTerminalState = true
-			}
-		}
-	}
-	return seenTerminalState
-}
-
-func (d *Dispatcher) waitForInstanceStop(ctx context.Context, runnerName, instanceID string, timeout time.Duration) bool {
-	if timeout <= 0 {
-		timeout = d.opts.DefaultDuration
-	}
-	deadline := time.Now().Add(timeout)
-	ticker := time.NewTicker(10 * time.Second)
-	defer ticker.Stop()
-
-	for {
-		stopped, err := d.checkInstanceStopped(ctx, instanceID)
-		if err != nil {
-			d.log.Warn("runner stop check failed", "runner", runnerName, "instance", instanceID, "err", err)
-			return false
-		}
-		if stopped {
-			return true
-		}
-		if time.Now().After(deadline) {
-			return false
-		}
-		select {
-		case <-ctx.Done():
-			return false
-		case <-ticker.C:
-		}
-	}
-}
-
-func (d *Dispatcher) checkInstanceStopped(ctx context.Context, instanceID string) (bool, error) {
-	cmd := exec.CommandContext(ctx, d.opts.BinaryPath, "describe", "--output", "json", instanceID)
-	var buf bytes.Buffer
-	cmd.Stdout = &buf
-	cmd.Stderr = &buf
-	if err := cmd.Run(); err != nil {
-		output := strings.ToLower(buf.String())
-		if strings.Contains(output, "destroyed") || strings.Contains(output, "not found") {
-			return true, nil
-		}
-		return false, fmt.Errorf("nsc describe failed: %w\n%s", err, strings.TrimSpace(buf.String()))
-	}
-	return instanceStopped(buf.String()), nil
-}
-
-func (d *Dispatcher) destroyInstance(ctx context.Context, runnerName, instanceID string) {
-	cmd := exec.CommandContext(ctx, d.opts.BinaryPath, "destroy", "--force", instanceID)
-	var buf bytes.Buffer
-	cmd.Stdout = &buf
-	cmd.Stderr = &buf
-	if err := cmd.Run(); err != nil {
-		d.log.Warn("runner destroy failed", "runner", runnerName, "instance", instanceID, "err", err, "output", strings.TrimSpace(buf.String()))
-		return
-	}
-	if output := strings.TrimSpace(buf.String()); output != "" {
-		d.log.Info("runner destroyed", "runner", runnerName, "instance", instanceID, "output", output)
-	} else {
-		d.log.Info("runner destroyed", "runner", runnerName, "instance", instanceID)
-	}
-}
-
-func choose(values ...string) string {
-	for _, v := range values {
-		if strings.TrimSpace(v) != "" {
-			return v
-		}
-	}
-	return ""
-}
-
-func (d *Dispatcher) bootstrapScript() string {
-	var builder strings.Builder
-	builder.WriteString(`set -euo pipefail
-mkdir -p "${FORGEJO_RUNNER_WORKDIR:-/tmp/forgejo-runner}"
-cd "${FORGEJO_RUNNER_WORKDIR:-/tmp/forgejo-runner}"
-
-if ! command -v node >/dev/null 2>&1; then
-  apk add --no-cache nodejs npm >/dev/null
-fi
-if ! command -v sudo >/dev/null 2>&1; then
-  apk add --no-cache sudo bash >/dev/null
-fi
-if ! command -v curl >/dev/null 2>&1; then
-  apk add --no-cache curl >/dev/null
-fi
-if ! command -v xz >/dev/null 2>&1; then
-  apk add --no-cache xz >/dev/null
-fi
-export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
-node --version >/dev/null
-
-cat > runner.yaml <<'EOF'
-log:
-  level: info
-runner:
-  file: .runner
-  capacity: 1
-  name: ${FORGEJO_RUNNER_NAME}
-  labels:
-EOF
-`)
-	builder.WriteString(`runner_exec="${FORGEJO_RUNNER_EXEC:-host}"
-if [ "$runner_exec" = "shell" ]; then
-  runner_exec="host"
-fi
-
-resolved_labels=""
-for label in ${FORGEJO_RUNNER_LABELS//,/ } ; do
-  if [ -z "${label}" ]; then
-    continue
-  fi
-  case "${label}" in
-    *:*) resolved="${label}" ;;
-    *)
-      if [ "$runner_exec" = "host" ]; then
-        resolved="${label}:host"
-      else
-        resolved="${label}:${runner_exec}"
-      fi
-      ;;
-  esac
-  echo "  - ${resolved}" >> runner.yaml
-  if [ -z "${resolved_labels}" ]; then
-    resolved_labels="${resolved}"
-  else
-    resolved_labels="${resolved_labels},${resolved}"
-  fi
-done
-`)
-	builder.WriteString(`cat >> runner.yaml <<'EOF'
-cache:
-  enabled: false
-EOF
-
-forgejo-runner register \
-  --no-interactive \
-  --instance "${FORGEJO_INSTANCE_URL}" \
-  --token "${FORGEJO_RUNNER_TOKEN}" \
-  --name "${FORGEJO_RUNNER_NAME}" \
-  --labels "${resolved_labels}" \
-  --config runner.yaml
-
-runner_mode="${FORGEJO_RUNNER_MODE:-one-job}"
-case "$runner_mode" in
-  one-job)
-    forgejo-runner one-job --config runner.yaml
-    ;;
-  daemon)
-    forgejo-runner daemon --config runner.yaml
-    ;;
-  *)
-    echo "Unknown FORGEJO_RUNNER_MODE: ${runner_mode}" >&2
-    exit 1
-    ;;
-esac
-`)
-	return builder.String()
-}
diff --git a/services/forgejo-nsc/internal/nsc/dispatcher_test.go b/services/forgejo-nsc/internal/nsc/dispatcher_test.go
deleted file mode 100644
index bcf450e..0000000
--- a/services/forgejo-nsc/internal/nsc/dispatcher_test.go
+++ /dev/null
@@ -1,33 +0,0 @@
-package nsc
-
-import "testing"
-
-func TestInstanceStoppedRequiresObservedTerminalState(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name   string
-		output string
-		want   bool
-	}{
-		{name: "empty output", output: "", want: false},
-		{name: "empty response", output: "[]", want: false},
-		{name: "no resources yet", output: `[{"per_resource":{}}]`, want: false},
-		{name: "resource without containers", output: `[{"per_resource":{"runner":{}}}]`, want: false},
-		{name: "running container", output: `[{"per_resource":{"runner":{"container":[{"status":"running"}]}}}]`, want: false},
-		{name: "stopped container", output: `[{"per_resource":{"runner":{"container":[{"status":"stopped"}]}}}]`, want: true},
-		{name: "terminated container", output: `[{"per_resource":{"runner":{"container":[{"status":"running","terminated_at":"2026-06-07T15:00:00Z"}]}}}]`, want: true},
-		{name: "tombstone", output: `[{"per_resource":{"runner":{"tombstone":"destroyed"}}}]`, want: true},
-	}
-
-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			got := instanceStopped(tc.output)
-			if got != tc.want {
-				t.Fatalf("instanceStopped(%s) = %v, want %v", tc.output, got, tc.want)
-			}
-		})
-	}
-}
diff --git a/services/forgejo-nsc/internal/nsc/macos.go b/services/forgejo-nsc/internal/nsc/macos.go
deleted file mode 100644
index 05324eb..0000000
--- a/services/forgejo-nsc/internal/nsc/macos.go
+++ /dev/null
@@ -1,713 +0,0 @@
-package nsc
-
-import (
-	"bytes"
-	"context"
-	"encoding/base64"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"os"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	computev1betaconnect "buf.build/gen/go/namespace/cloud/connectrpc/go/proto/namespace/cloud/compute/v1beta/computev1betaconnect"
-	computev1beta "buf.build/gen/go/namespace/cloud/protocolbuffers/go/proto/namespace/cloud/compute/v1beta"
-	stdlib "buf.build/gen/go/namespace/cloud/protocolbuffers/go/proto/namespace/stdlib"
-	"connectrpc.com/connect"
-	"golang.org/x/crypto/ssh"
-	"google.golang.org/protobuf/types/known/timestamppb"
-)
-
-func hasMacOSLabel(labels []string) bool {
-	for _, label := range labels {
-		l := strings.TrimSpace(label)
-		if l == "" {
-			continue
-		}
-		if strings.HasPrefix(l, "namespace-profile-macos-") {
-			return true
-		}
-	}
-	return false
-}
-
-type lockedBuffer struct {
-	mu sync.Mutex
-	b  bytes.Buffer
-}
-
-func (lb *lockedBuffer) Write(p []byte) (int, error) {
-	lb.mu.Lock()
-	defer lb.mu.Unlock()
-	return lb.b.Write(p)
-}
-
-func (lb *lockedBuffer) Len() int {
-	lb.mu.Lock()
-	defer lb.mu.Unlock()
-	return lb.b.Len()
-}
-
-func (lb *lockedBuffer) String() string {
-	lb.mu.Lock()
-	defer lb.mu.Unlock()
-	return lb.b.String()
-}
-
-func macosSupportDiskSelectors(baseImageID string) []*stdlib.Label {
-	id := strings.TrimSpace(baseImageID)
-	if id == "" {
-		id = "tahoe"
-	}
-
-	// Allow specifying selectors directly, e.g. "macos.version=26.x,image.with=xcode-26".
-	if strings.Contains(id, "=") {
-		var out []*stdlib.Label
-		for _, part := range strings.Split(id, ",") {
-			part = strings.TrimSpace(part)
-			if part == "" {
-				continue
-			}
-			name, value, ok := strings.Cut(part, "=")
-			name = strings.TrimSpace(name)
-			value = strings.TrimSpace(value)
-			if !ok || name == "" || value == "" {
-				continue
-			}
-			out = append(out, &stdlib.Label{Name: name, Value: value})
-		}
-		if len(out) > 0 {
-			return out
-		}
-	}
-
-	// Human-friendly presets used by burrow config.
-	switch strings.ToLower(id) {
-	case "sonoma", "macos-14", "macos14", "14":
-		return []*stdlib.Label{{Name: "macos.version", Value: "14.x"}}
-	case "sequoia", "macos-15", "macos15", "15":
-		return []*stdlib.Label{{Name: "macos.version", Value: "15.x"}}
-	case "tahoe", "macos-26", "macos26", "26":
-		// Constrain to the Xcode 26 support disk explicitly, since Apple builds
-		// depend on Xcode being present and Compute currently errors if it can't
-		// resolve a support disk selection.
-		return []*stdlib.Label{{Name: "macos.version", Value: "26.x"}, {Name: "image.with", Value: "xcode-26"}}
-	default:
-		return []*stdlib.Label{{Name: "macos.version", Value: "26.x"}}
-	}
-}
-
-func macosComputeBaseImageID(baseImageID string) string {
-	id := strings.TrimSpace(baseImageID)
-	if id == "" {
-		return "tahoe"
-	}
-	// If selectors were provided directly, we cannot safely infer a canonical
-	// base image ID from them.
-	if strings.Contains(id, "=") {
-		return ""
-	}
-	switch strings.ToLower(id) {
-	case "sonoma", "macos-14", "macos14", "14":
-		return "sonoma"
-	case "sequoia", "macos-15", "macos15", "15":
-		return "sequoia"
-	case "tahoe", "macos-26", "macos26", "26":
-		return "tahoe"
-	default:
-		return id
-	}
-}
-
-type nscBearerTokenFile struct {
-	BearerToken string `json:"bearer_token"`
-}
-
-func readNSCBearerToken() (string, error) {
-	path := os.Getenv("NSC_TOKEN_FILE")
-	if path == "" {
-		return "", errors.New("NSC_TOKEN_FILE is required for macos runners")
-	}
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		return "", fmt.Errorf("read NSC_TOKEN_FILE: %w", err)
-	}
-	trimmed := strings.TrimSpace(string(raw))
-	if trimmed == "" {
-		return "", errors.New("NSC_TOKEN_FILE is empty")
-	}
-	// Support the on-host format used by burrow: {"bearer_token":"..."}.
-	var parsed nscBearerTokenFile
-	if err := json.Unmarshal([]byte(trimmed), &parsed); err == nil && parsed.BearerToken != "" {
-		return parsed.BearerToken, nil
-	}
-	// Fallback: allow a raw bearer token.
-	return trimmed, nil
-}
-
-func macosRunnerWorkDir(configured string) string {
-	workdir := strings.TrimSpace(configured)
-	if workdir == "" || strings.HasPrefix(workdir, "/var/lib/") {
-		return "/tmp/forgejo-runner"
-	}
-	return workdir
-}
-
-func parseMachineTypeCPUxMemGB(machineType string) (vcpu int32, memoryMB int32, err error) {
-	parts := strings.Split(machineType, "x")
-	if len(parts) != 2 {
-		return 0, 0, fmt.Errorf("invalid machine_type %q: expected CPUxMemoryGB (e.g. 12x28)", machineType)
-	}
-	cpu64, err := strconv.ParseInt(parts[0], 10, 32)
-	if err != nil {
-		return 0, 0, fmt.Errorf("invalid machine_type %q: cpu: %w", machineType, err)
-	}
-	memGB64, err := strconv.ParseInt(parts[1], 10, 32)
-	if err != nil {
-		return 0, 0, fmt.Errorf("invalid machine_type %q: memory: %w", machineType, err)
-	}
-	return int32(cpu64), int32(memGB64 * 1024), nil
-}
-
-func (d *Dispatcher) launchMacOSRunner(ctx context.Context, runnerName string, req LaunchRequest, ttl time.Duration, machineType string) error {
-	if machineType == "" {
-		return errors.New("machine_type is required for macos runners")
-	}
-	vcpu, memoryMB, err := parseMachineTypeCPUxMemGB(machineType)
-	if err != nil {
-		return err
-	}
-	bearer, err := readNSCBearerToken()
-	if err != nil {
-		return err
-	}
-
-	httpClient := &http.Client{Timeout: 60 * time.Second}
-	client := computev1betaconnect.NewComputeServiceClient(httpClient, d.opts.ComputeBaseURL)
-
-	workdir := macosRunnerWorkDir(d.opts.WorkDir)
-
-	env := map[string]string{
-		"FORGEJO_INSTANCE_URL":   req.InstanceURL,
-		"FORGEJO_RUNNER_TOKEN":   req.Token,
-		"FORGEJO_RUNNER_NAME":    runnerName,
-		"FORGEJO_RUNNER_LABELS":  strings.Join(req.Labels, ","),
-		"FORGEJO_RUNNER_EXEC":    d.opts.Executor,
-		"FORGEJO_RUNNER_WORKDIR": workdir,
-	}
-	for k, v := range req.ExtraEnv {
-		env[k] = v
-	}
-	// Best-effort caching: workflows call Scripts/nscloud-cache.sh, which is a
-	// no-op unless NSC_CACHE_PATH is set. This may still be skipped if spacectl
-	// lacks credentials, but setting the path is harmless and keeps behavior
-	// consistent across macOS / Linux runners.
-	if _, ok := env["NSC_CACHE_PATH"]; !ok {
-		env["NSC_CACHE_PATH"] = "/Users/runner/.cache/nscloud"
-	}
-
-	deadline := timestamppb.New(time.Now().Add(ttl))
-
-	createReq := &computev1beta.CreateInstanceRequest{
-		Shape: &computev1beta.InstanceShape{
-			VirtualCpu:      vcpu,
-			MemoryMegabytes: memoryMB,
-			MachineArch:     d.opts.MacosMachineArch,
-			Os:              "macos",
-			// Namespace macOS compute requires selectors to pick the base image
-			// ("support disk"), otherwise instance creation fails.
-			Selectors: macosSupportDiskSelectors(d.opts.MacosBaseImageID),
-		},
-		DocumentedPurpose: fmt.Sprintf("burrow forgejo runner %s", runnerName),
-		Deadline:          deadline,
-		Labels: []*stdlib.Label{
-			{Name: "nsc.source", Value: "forgejo-nsc"},
-			{Name: "burrow.service", Value: "forgejo-runner"},
-			{Name: "burrow.runner", Value: runnerName},
-		},
-		Applications: []*computev1beta.ApplicationRequest{
-			{
-				Name:         "forgejo-runner",
-				Command:      "/bin/bash",
-				Args:         []string{"-lc", macosBootstrapScript()},
-				Environment:  env,
-				WorkloadType: computev1beta.ApplicationRequest_JOB,
-			},
-		},
-	}
-	if imageID := macosComputeBaseImageID(d.opts.MacosBaseImageID); imageID != "" {
-		createReq.Experimental = &computev1beta.CreateInstanceRequest_ExperimentalFeatures{
-			MacosBaseImageId: imageID,
-		}
-	}
-
-	d.log.Info("launching Namespace macos runner",
-		"runner", runnerName,
-		"compute_base_url", d.opts.ComputeBaseURL,
-		"macos_base_image_id", d.opts.MacosBaseImageID,
-		"shape", fmt.Sprintf("%dx%d", vcpu, memoryMB/1024),
-		"arch", d.opts.MacosMachineArch,
-	)
-
-	reqCreate := connect.NewRequest(createReq)
-	reqCreate.Header().Set("Authorization", "Bearer "+bearer)
-	resp, err := client.CreateInstance(ctx, reqCreate)
-	if err != nil {
-		return fmt.Errorf("compute create instance failed: %w", err)
-	}
-	if resp.Msg == nil || resp.Msg.Metadata == nil {
-		return errors.New("compute create instance returned no metadata")
-	}
-	instanceID := resp.Msg.Metadata.InstanceId
-
-	waitErr := d.waitForMacOSRunnerStop(ctx, client, bearer, runnerName, instanceID, ttl)
-	d.destroyComputeInstance(context.Background(), client, bearer, runnerName, instanceID)
-	return waitErr
-}
-
-func (d *Dispatcher) runMacOSComputeSSHScript(ctx context.Context, runnerName, instanceID, script string) error {
-	bearer, err := readNSCBearerToken()
-	if err != nil {
-		return err
-	}
-
-	httpClient := &http.Client{Timeout: 60 * time.Second}
-	client := computev1betaconnect.NewComputeServiceClient(httpClient, d.opts.ComputeBaseURL)
-
-	getReq := connect.NewRequest(&computev1beta.GetSSHConfigRequest{
-		InstanceId: instanceID,
-		// TargetContainer is optional. Keep it empty to run commands in the default instance environment.
-	})
-	getReq.Header().Set("Authorization", "Bearer "+bearer)
-
-	resp, err := client.GetSSHConfig(ctx, getReq)
-	if err != nil {
-		return fmt.Errorf("compute get ssh config failed: %w", err)
-	}
-	if resp.Msg == nil {
-		return errors.New("compute get ssh config returned empty response")
-	}
-	if resp.Msg.Endpoint == "" {
-		return errors.New("compute get ssh config returned empty endpoint")
-	}
-	if len(resp.Msg.SshPrivateKey) == 0 {
-		return errors.New("compute get ssh config returned empty ssh private key")
-	}
-	if strings.TrimSpace(resp.Msg.Username) == "" {
-		return errors.New("compute get ssh config returned empty username")
-	}
-
-	signer, err := ssh.ParsePrivateKey(resp.Msg.SshPrivateKey)
-	if err != nil {
-		return fmt.Errorf("parse ssh private key: %w", err)
-	}
-
-	addr := fmt.Sprintf("%s:22", resp.Msg.Endpoint)
-	conn, err := net.Dial("tcp", addr)
-	if err != nil {
-		return fmt.Errorf("dial ssh endpoint: %w", err)
-	}
-	defer conn.Close()
-
-	sshCfg := &ssh.ClientConfig{
-		User:            resp.Msg.Username,
-		Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},
-		HostKeyCallback: ssh.InsecureIgnoreHostKey(), // Endpoint is short-lived and key is delivered out-of-band.
-		Timeout:         30 * time.Second,
-	}
-
-	c, chans, reqs, err := ssh.NewClientConn(conn, addr, sshCfg)
-	if err != nil {
-		return fmt.Errorf("ssh client conn: %w", err)
-	}
-	clientSSH := ssh.NewClient(c, chans, reqs)
-	defer clientSSH.Close()
-
-	session, err := clientSSH.NewSession()
-	if err != nil {
-		return fmt.Errorf("ssh new session: %w", err)
-	}
-	defer session.Close()
-
-	var buf bytes.Buffer
-	session.Stdout = &buf
-	session.Stderr = &buf
-	session.Stdin = strings.NewReader(script)
-
-	// Feed the bootstrap script via stdin so we don't need to quote/escape it.
-	//
-	// Note: Some SSH servers do not reliably parse exec strings with arguments.
-	// Running bare `/bin/bash` still reads from stdin and avoids argument parsing.
-	if err := session.Run("/bin/bash"); err != nil {
-		outRaw := buf.String()
-		out := strings.TrimSpace(outRaw)
-
-		// Some SSH servers reject exec requests and only allow interactive shells,
-		// and others will "succeed" but still interpret stdin under the default
-		// login shell (showing the zsh banner / prompts).
-		//
-		// In those cases, retry via Shell() with a PTY.
-		exitStatus := 0
-		exitErr, isExitErr := err.(*ssh.ExitError)
-		if isExitErr {
-			exitStatus = exitErr.ExitStatus()
-		}
-
-		looksInteractive := strings.Contains(outRaw, "The default interactive shell is now zsh") ||
-			strings.Contains(outRaw, " runner$ ") ||
-			strings.Contains(outRaw, "bash-3.2$")
-		shouldFallback := !isExitErr || looksInteractive
-
-		if shouldFallback {
-			d.log.Warn("compute ssh exec bootstrap failed; retrying via interactive shell",
-				"runner", runnerName,
-				"instance", instanceID,
-				"exit_status", exitStatus,
-			)
-
-			session2, err2 := clientSSH.NewSession()
-			if err2 != nil {
-				return fmt.Errorf("ssh new session (fallback): %w", err2)
-			}
-			defer session2.Close()
-
-			// bytes.Buffer isn't safe for concurrent writes + reads; the SSH session
-			// writes from background goroutines. Wrap it so we can poll for a prompt
-			// before sending commands.
-			lb := &lockedBuffer{}
-			session2.Stdout = lb
-			session2.Stderr = lb
-
-			in, err2 := session2.StdinPipe()
-			if err2 != nil {
-				return fmt.Errorf("ssh stdin pipe (fallback): %w", err2)
-			}
-
-			// Request a PTY to match interactive semantics even when the caller
-			// doesn't have a local terminal.
-			_ = session2.RequestPty("xterm", 24, 80, nil)
-
-			if err2 := session2.Shell(); err2 != nil {
-				return fmt.Errorf("ssh shell (fallback): %w", err2)
-			}
-
-			// Wait briefly for the prompt/banner so the first command isn't dropped.
-			// We also emit a sentinel `echo` to verify the TTY is live.
-			deadline := time.Now().Add(3 * time.Second)
-			for time.Now().Before(deadline) {
-				n := lb.Len()
-				if n > 0 {
-					break
-				}
-				time.Sleep(50 * time.Millisecond)
-			}
-
-			// Stream the script then exit. Prefer LF line endings; macOS shells and
-			// PTYs can treat CRLF as literal CR characters (breaking heredoc
-			// delimiters and quoting).
-			writeTTY := func(s string) {
-				if s == "" {
-					return
-				}
-				s = strings.ReplaceAll(s, "\r\n", "\n")
-				_, _ = io.WriteString(in, s)
-			}
-
-			scriptTTY := strings.ReplaceAll(script, "\r\n", "\n")
-
-			// Cut down noise in logs and reduce the chance of ZSH line-editing
-			// behavior corrupting long inputs.
-			writeTTY("stty -echo 2>/dev/null || true\n")
-			writeTTY("echo BURROW_BOOTSTRAP_TTY_OK\n")
-
-			// Avoid heredocs for the script itself (PTY newline handling is fragile).
-			// Instead, stream base64 in short chunks to a file, then decode and run it.
-			enc := base64.StdEncoding.EncodeToString([]byte(scriptTTY))
-			idSafe := strings.ReplaceAll(instanceID, "-", "_")
-			b64Path := "/tmp/burrow-bootstrap-" + idSafe + ".b64"
-			shPath := "/tmp/burrow-bootstrap-" + idSafe + ".sh"
-
-			writeTTY("rm -f " + b64Path + " " + shPath + "\n")
-			writeTTY(": > " + b64Path + "\n")
-
-			const chunkSize = 80
-			for i := 0; i < len(enc); i += chunkSize {
-				j := i + chunkSize
-				if j > len(enc) {
-					j = len(enc)
-				}
-				chunk := enc[i:j]
-				// Base64 chunks contain only [A-Za-z0-9+/=], which are safe to pass
-				// unquoted. Avoid quotes entirely so a truncated line can't leave
-				// the remote shell in a multi-line continuation state.
-				writeTTY("printf %s " + chunk + " >> " + b64Path + "\n")
-				time.Sleep(5 * time.Millisecond)
-			}
-
-			// macOS uses `base64 -D` (BSD), some environments use `-d` (GNU).
-			writeTTY("base64 -D " + b64Path + " > " + shPath + " 2>/dev/null || base64 -d " + b64Path + " > " + shPath + "\n")
-			writeTTY("/bin/bash " + shPath + "\n")
-			writeTTY("exit\n")
-			_ = in.Close()
-
-			if err2 := session2.Wait(); err2 != nil {
-				out2 := strings.TrimSpace(lb.String())
-				if len(out2) > 16*1024 {
-					out2 = out2[len(out2)-16*1024:]
-				}
-				return fmt.Errorf("compute ssh runner bootstrap failed (shell fallback): %w\n%s", err2, out2)
-			}
-
-			d.log.Info("macos runner bootstrap completed via compute ssh shell", "runner", runnerName, "instance", instanceID)
-			return nil
-		}
-
-		if len(out) > 16*1024 {
-			out = out[len(out)-16*1024:]
-		}
-		return fmt.Errorf("compute ssh runner bootstrap failed: %w\n%s", err, out)
-	}
-
-	d.log.Info("macos runner bootstrap completed via compute ssh", "runner", runnerName, "instance", instanceID)
-	return nil
-}
-
-func (d *Dispatcher) waitForMacOSRunnerStop(ctx context.Context, client computev1betaconnect.ComputeServiceClient, bearer, runnerName, instanceID string, ttl time.Duration) error {
-	if ttl <= 0 {
-		ttl = d.opts.DefaultDuration
-	}
-	deadline := time.Now().Add(ttl)
-	ticker := time.NewTicker(15 * time.Second)
-	defer ticker.Stop()
-
-	for {
-		stopped, err := d.checkComputeInstanceStopped(ctx, client, bearer, instanceID)
-		if err != nil {
-			d.log.Warn("macos runner stop check failed", "runner", runnerName, "instance", instanceID, "err", err)
-		} else if stopped {
-			return nil
-		}
-
-		if time.Now().After(deadline) {
-			return fmt.Errorf("macos runner exceeded ttl (%s) without stopping", ttl)
-		}
-		select {
-		case <-ctx.Done():
-			return ctx.Err()
-		case <-ticker.C:
-		}
-	}
-}
-
-func (d *Dispatcher) checkComputeInstanceStopped(ctx context.Context, client computev1betaconnect.ComputeServiceClient, bearer, instanceID string) (bool, error) {
-	describeReq := connect.NewRequest(&computev1beta.DescribeInstanceRequest{InstanceId: instanceID})
-	describeReq.Header().Set("Authorization", "Bearer "+bearer)
-	resp, err := client.DescribeInstance(ctx, describeReq)
-	if err != nil {
-		// NotFound means the instance is already gone.
-		if connect.CodeOf(err) == connect.CodeNotFound {
-			return true, nil
-		}
-		return false, err
-	}
-	if resp.Msg == nil || resp.Msg.Metadata == nil {
-		return false, errors.New("describe instance returned no metadata")
-	}
-	switch resp.Msg.Metadata.Status {
-	case computev1beta.InstanceMetadata_DESTROYED:
-		return true, nil
-	case computev1beta.InstanceMetadata_ERROR:
-		// Best-effort include shutdown reasons; do not include unbounded output.
-		var b strings.Builder
-		for _, reason := range resp.Msg.ShutdownReasons {
-			if reason == nil {
-				continue
-			}
-			if b.Len() > 0 {
-				b.WriteString("; ")
-			}
-			b.WriteString(reason.String())
-			if b.Len() > 1024 {
-				break
-			}
-		}
-		msg := strings.TrimSpace(b.String())
-		if msg == "" {
-			msg = "unknown shutdown reason"
-		}
-		return true, fmt.Errorf("instance entered error state: %s", msg)
-	default:
-		if resp.Msg.Metadata.DestroyedAt != nil {
-			return true, nil
-		}
-		return false, nil
-	}
-}
-
-func (d *Dispatcher) destroyComputeInstance(ctx context.Context, client computev1betaconnect.ComputeServiceClient, bearer, runnerName, instanceID string) {
-	if ctx == nil {
-		ctx = context.Background()
-	}
-	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
-	defer cancel()
-
-	destroyReq := connect.NewRequest(&computev1beta.DestroyInstanceRequest{InstanceId: instanceID})
-	destroyReq.Header().Set("Authorization", "Bearer "+bearer)
-	if _, err := client.DestroyInstance(ctx, destroyReq); err != nil {
-		if connect.CodeOf(err) == connect.CodeNotFound {
-			d.log.Info("macos runner destroyed", "runner", runnerName, "instance", instanceID, "status", "not_found")
-			return
-		}
-		d.log.Warn("macos runner destroy failed", "runner", runnerName, "instance", instanceID, "err", err)
-		return
-	}
-	d.log.Info("macos runner destroyed", "runner", runnerName, "instance", instanceID)
-}
-
-func macosBootstrapScript() string {
-	// Keep this script self-contained: it runs on a fresh macOS VM base image.
-	var b strings.Builder
-	b.WriteString(`set -euo pipefail
-
-workdir="${FORGEJO_RUNNER_WORKDIR:-/tmp/forgejo-runner}"
-mkdir -p "${workdir}"
-cd "${workdir}"
-
-export PATH="/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin:${PATH}"
-
-if ! command -v curl >/dev/null 2>&1; then
-  echo "curl is required" >&2
-  exit 1
-fi
-
-if ! command -v nix >/dev/null 2>&1; then
-  echo "Installing nix (Determinate Systems installer)..."
-  installer="/tmp/nix-installer.$$"
-  curl -fsSL -o "${installer}" https://install.determinate.systems/nix
-  chmod +x "${installer}"
-
-  if command -v sudo >/dev/null 2>&1; then
-    if sudo -n true 2>/dev/null; then
-      sudo -n sh "${installer}" install --no-confirm
-    else
-      sudo sh "${installer}" install --no-confirm
-    fi
-  else
-    sh "${installer}" install --no-confirm
-  fi
-
-  rm -f "${installer}"
-fi
-
-if [[ -f /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh ]]; then
-  # shellcheck disable=SC1091
-  . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-fi
-
-export PATH="/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:${PATH}"
-
-# Flake builds need nix-command + flakes enabled. Workflows may layer additional
-# config, but ensure a sane default exists.
-mkdir -p "${XDG_CONFIG_HOME:-$HOME/.config}/nix"
-cat > "${XDG_CONFIG_HOME:-$HOME/.config}/nix/nix.conf" <<'EOF'
-experimental-features = nix-command flakes
-sandbox = true
-fallback = true
-substituters = https://cache.nixos.org
-trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
-EOF
-
-mkdir -p bin
-export PATH="${PWD}/bin:${PATH}"
-
-runner_version="v12.6.4"
-runner_src_tgz="forgejo-runner-${runner_version}.tar.gz"
-runner_src_url="https://code.forgejo.org/forgejo/runner/archive/${runner_version}.tar.gz"
-runner_src_dir="forgejo-runner-src"
-
-if ! command -v forgejo-runner >/dev/null 2>&1; then
-  rm -rf "${runner_src_dir}"
-  mkdir -p "${runner_src_dir}"
-  curl -fsSL "${runner_src_url}" -o "${runner_src_tgz}"
-  tar -xzf "${runner_src_tgz}" -C "${runner_src_dir}" --strip-components=1
-
-  toolchain="$(grep -E '^toolchain ' "${runner_src_dir}/go.mod" | awk '{print $2}' | head -n 1 || true)"
-  if [ -z "${toolchain}" ]; then
-    toolchain="go1.25.7"
-  fi
-
-  if ! command -v go >/dev/null 2>&1; then
-    go_tgz="${toolchain}.darwin-arm64.tar.gz"
-    go_url="https://go.dev/dl/${go_tgz}"
-    curl -fsSL "${go_url}" -o "${go_tgz}"
-    tar -xzf "${go_tgz}"
-    export GOROOT="${PWD}/go"
-    export PATH="${GOROOT}/bin:${PATH}"
-  fi
-
-  export GOPATH="${PWD}/.gopath"
-  export GOMODCACHE="${PWD}/.gomodcache"
-  export GOCACHE="${PWD}/.gocache"
-  mkdir -p "${GOPATH}" "${GOMODCACHE}" "${GOCACHE}"
-
-  (cd "${runner_src_dir}" && go build -o "${workdir}/bin/forgejo-runner" .)
-  chmod +x "${workdir}/bin/forgejo-runner"
-fi
-
-cat > runner.yaml <<'EOF'
-log:
-  level: info
-runner:
-  file: .runner
-  capacity: 1
-  name: ${FORGEJO_RUNNER_NAME}
-  labels:
-EOF
-
-runner_exec="${FORGEJO_RUNNER_EXEC:-host}"
-if [ "$runner_exec" = "shell" ]; then
-  runner_exec="host"
-fi
-
-resolved_labels=""
-for label in ${FORGEJO_RUNNER_LABELS//,/ } ; do
-  if [ -z "${label}" ]; then
-    continue
-  fi
-  case "${label}" in
-    *:*) resolved="${label}" ;;
-    *)
-      resolved="${label}:host"
-      ;;
-  esac
-  echo "  - ${resolved}" >> runner.yaml
-  if [ -z "${resolved_labels}" ]; then
-    resolved_labels="${resolved}"
-  else
-    resolved_labels="${resolved_labels},${resolved}"
-  fi
-done
-
-cat >> runner.yaml <<'EOF'
-cache:
-  enabled: false
-EOF
-
-forgejo-runner register \
-  --no-interactive \
-  --instance "${FORGEJO_INSTANCE_URL}" \
-  --token "${FORGEJO_RUNNER_TOKEN}" \
-  --name "${FORGEJO_RUNNER_NAME}" \
-  --labels "${resolved_labels}" \
-  --config runner.yaml
-
-forgejo-runner one-job --config runner.yaml
-`)
-	return b.String()
-}
diff --git a/services/forgejo-nsc/internal/nsc/macos_nsc.go b/services/forgejo-nsc/internal/nsc/macos_nsc.go
deleted file mode 100644
index b9b9a1b..0000000
--- a/services/forgejo-nsc/internal/nsc/macos_nsc.go
+++ /dev/null
@@ -1,379 +0,0 @@
-package nsc
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/url"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"time"
-)
-
-func normalizeMacOSNSCMachineType(machineType string) (normalized string, changed bool, err error) {
-	vcpu, memoryMB, err := parseMachineTypeCPUxMemGB(machineType)
-	if err != nil {
-		return "", false, err
-	}
-	memGB := memoryMB / 1024
-	if memGB <= 0 || vcpu <= 0 {
-		return "", false, fmt.Errorf("invalid machine_type %q after parse: vcpu=%d memGB=%d", machineType, vcpu, memGB)
-	}
-
-	// NSC CLI (and the underlying InstanceService) enforce discrete cpu/mem sets
-	// for macOS. Normalize requested values by rounding up to the closest allowed
-	// values to keep provisioning stable even when configs drift.
-	//
-	// Observed allowed sets from Namespace API error output for macos/arm64:
-	// cpu: [4 6 8 12]
-	// mem: [7 14 28 56] (GB)
-	allowedCPU := []int32{4, 6, 8, 12}
-	allowedMemGB := []int32{7, 14, 28, 56}
-
-	roundUp := func(v int32, allowed []int32) (int32, bool) {
-		for _, a := range allowed {
-			if v <= a {
-				return a, a != v
-			}
-		}
-		// Clamp to max if above all allowed values.
-		return allowed[len(allowed)-1], true
-	}
-
-	newCPU, cpuChanged := roundUp(vcpu, allowedCPU)
-	newMemGB, memChanged := roundUp(memGB, allowedMemGB)
-
-	normalized = fmt.Sprintf("%dx%d", newCPU, newMemGB)
-	changed = cpuChanged || memChanged
-	return normalized, changed, nil
-}
-
-type macosNSCAttemptConfig struct {
-	waitTimeout   time.Duration
-	createTimeout time.Duration
-}
-
-func macosNSCAttemptConfigFor(index int, attempts []macosNSCAttemptConfig) macosNSCAttemptConfig {
-	if len(attempts) == 0 {
-		return macosNSCAttemptConfig{}
-	}
-	if index < len(attempts) {
-		return attempts[index]
-	}
-	return attempts[len(attempts)-1]
-}
-
-func (d *Dispatcher) launchMacOSRunnerViaNSC(ctx context.Context, runnerName string, req LaunchRequest, ttl time.Duration, machineType string) error {
-	if machineType == "" {
-		return errors.New("machine_type is required for macos runners")
-	}
-	if strings.TrimSpace(os.Getenv("NSC_TOKEN_FILE")) == "" {
-		// The Burrow forge host feeds NSC_TOKEN_FILE from the intake-backed runtime token.
-		return errors.New("NSC_TOKEN_FILE is required for macos runners")
-	}
-
-	selectors := macosSelectorsArg(d.opts.MacosBaseImageID)
-	if selectors == "" {
-		return errors.New("macos selectors resolved empty")
-	}
-
-	normalizedMachineType := machineType
-	if n, changed, err := normalizeMacOSNSCMachineType(machineType); err != nil {
-		return err
-	} else if changed {
-		normalizedMachineType = n
-	}
-
-	// If capacity is constrained for the requested (large) shape, try a small
-	// set of progressively smaller shapes before failing the dispatch request.
-	// This keeps macOS builds flowing even when large runners are scarce.
-	candidates := []string{normalizedMachineType, "8x28", "6x14", "4x7"}
-	seen := map[string]struct{}{}
-	var uniq []string
-	for _, c := range candidates {
-		c = strings.TrimSpace(c)
-		if c == "" {
-			continue
-		}
-		if _, ok := seen[c]; ok {
-			continue
-		}
-		seen[c] = struct{}{}
-		uniq = append(uniq, c)
-	}
-	candidates = uniq
-
-	attempts := []macosNSCAttemptConfig{
-		{waitTimeout: 6 * time.Minute, createTimeout: 8 * time.Minute},
-		{waitTimeout: 4 * time.Minute, createTimeout: 6 * time.Minute},
-		{waitTimeout: 3 * time.Minute, createTimeout: 5 * time.Minute},
-	}
-
-	createInstance := func(mt string, a macosNSCAttemptConfig) (instanceID string, out string, err error) {
-		tmpDir, err := os.MkdirTemp("", "forgejo-nsc-macos-*")
-		if err != nil {
-			return "", "", fmt.Errorf("mktemp: %w", err)
-		}
-		defer os.RemoveAll(tmpDir)
-
-		metaPath := filepath.Join(tmpDir, "create.json")
-		cidPath := filepath.Join(tmpDir, "create.cid")
-
-		arch := strings.TrimSpace(d.opts.MacosMachineArch)
-		if arch == "" {
-			arch = "arm64"
-		}
-		// Namespace CLI requires the "os/arch:" prefix to create a macOS instance.
-		// Without it, `nsc create` defaults to Linux even if selectors include macos.*.
-		machineType := fmt.Sprintf("macos/%s:%s", arch, mt)
-
-		args := []string{
-			"create",
-			"--duration", ttl.String(),
-			"--machine_type", machineType,
-			"--selectors", selectors,
-			"--bare",
-			"--cidfile", cidPath,
-			"--log_actions",
-			"--purpose", fmt.Sprintf("burrow forgejo runner %s", runnerName),
-			// Prefer plain output for debuggability (progress, capacity errors, etc).
-			"--output", "plain",
-			"--output_json_to", metaPath,
-			// macOS instances can take a while to become ready.
-			"--wait_timeout", a.waitTimeout.String(),
-		}
-		args = prependNSCRegionArgs(args, d.opts.ComputeBaseURL)
-
-		createCtx, cancel := context.WithTimeout(ctx, a.createTimeout)
-		defer cancel()
-
-		cmd := exec.CommandContext(createCtx, d.opts.BinaryPath, args...)
-		var buf bytes.Buffer
-		cmd.Stdout = &buf
-		cmd.Stderr = &buf
-
-		if err := cmd.Run(); err != nil {
-			// Best-effort cleanup: if the instance ID was written before the command failed
-			// (or before we timed it out), attempt to destroy it to avoid idling machines.
-			if instanceID := strings.TrimSpace(mustReadFile(cidPath)); instanceID != "" {
-				d.destroyNSCInstance(context.Background(), runnerName, instanceID)
-			}
-			if errors.Is(createCtx.Err(), context.DeadlineExceeded) {
-				return "", buf.String(), fmt.Errorf("nsc create timed out after %s", a.createTimeout)
-			}
-			return "", buf.String(), fmt.Errorf("nsc create failed: %w", err)
-		}
-
-		instanceID, err = readNSCCreateInstanceID(metaPath)
-		if err != nil {
-			return "", buf.String(), fmt.Errorf("nsc create output parse failed: %w", err)
-		}
-		if instanceID == "" {
-			return "", buf.String(), fmt.Errorf("nsc create returned empty instance id")
-		}
-		return instanceID, buf.String(), nil
-	}
-
-	var (
-		instanceID string
-		lastOut    string
-		lastErr    error
-	)
-	for i, mt := range candidates {
-		a := macosNSCAttemptConfigFor(i, attempts)
-
-		d.log.Info("launching Namespace macos runner via nsc",
-			"runner", runnerName,
-			"attempt", i+1,
-			"machine_type", mt,
-			"requested_machine_type", machineType,
-			"selectors", selectors,
-		)
-
-		id, out, err := createInstance(mt, a)
-		lastOut = out
-		lastErr = err
-		if err != nil {
-			// Timeouts are treated as retryable (capacity constrained).
-			if strings.Contains(err.Error(), "timed out") || strings.Contains(strings.ToLower(out), "capacity") {
-				continue
-			}
-			return fmt.Errorf("%w\n%s", err, out)
-		}
-		instanceID = id
-		break
-	}
-	if instanceID == "" {
-		if lastErr != nil {
-			return fmt.Errorf("%w\n%s", lastErr, lastOut)
-		}
-		return fmt.Errorf("nsc create failed without producing an instance id\n%s", lastOut)
-	}
-
-	// Always attempt cleanup even if the runner fails.
-	defer d.destroyNSCInstance(context.Background(), runnerName, instanceID)
-
-	script := macosBootstrapWrapperScript(runnerName, req, d.opts.Executor, d.opts.WorkDir)
-	// Use the Compute SSH config endpoint (direct TCP) instead of `nsc ssh`, which
-	// relies on a websocket-based SSH proxy that is not supported by the
-	// revokable tenant token we run the dispatcher with.
-	if err := d.runMacOSComputeSSHScript(ctx, runnerName, instanceID, script); err != nil {
-		return err
-	}
-	return nil
-}
-
-func mustReadFile(path string) string {
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		return ""
-	}
-	return string(raw)
-}
-
-func macosSelectorsArg(baseImageID string) string {
-	id := strings.TrimSpace(baseImageID)
-	if id == "" {
-		id = "tahoe"
-	}
-	// Allow passing selectors directly via config, e.g. "macos.version=26.x,image.with=xcode-26".
-	if strings.Contains(id, "=") {
-		return id
-	}
-	switch strings.ToLower(id) {
-	case "sonoma", "macos-14", "macos14", "14":
-		return "macos.version=14.x"
-	case "sequoia", "macos-15", "macos15", "15":
-		return "macos.version=15.x"
-	case "tahoe", "macos-26", "macos26", "26":
-		return "macos.version=26.x,image.with=xcode-26"
-	default:
-		return "macos.version=26.x"
-	}
-}
-
-type nscCreateMetadata struct {
-	InstanceID string `json:"instance_id"`
-	ClusterID  string `json:"cluster_id"`
-	ID         string `json:"id"`
-}
-
-func readNSCCreateInstanceID(path string) (string, error) {
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		return "", fmt.Errorf("read %s: %w", path, err)
-	}
-	var meta nscCreateMetadata
-	if err := json.Unmarshal(raw, &meta); err != nil {
-		return "", err
-	}
-	if meta.InstanceID != "" {
-		return meta.InstanceID, nil
-	}
-	if meta.ClusterID != "" {
-		return meta.ClusterID, nil
-	}
-	if meta.ID != "" {
-		return meta.ID, nil
-	}
-	return "", nil
-}
-
-func (d *Dispatcher) destroyNSCInstance(ctx context.Context, runnerName, instanceID string) {
-	if ctx == nil {
-		ctx = context.Background()
-	}
-	ctx, cancel := context.WithTimeout(ctx, 2*time.Minute)
-	defer cancel()
-
-	args := []string{"destroy", "--force", instanceID}
-	args = prependNSCRegionArgs(args, d.opts.ComputeBaseURL)
-	cmd := exec.CommandContext(ctx, d.opts.BinaryPath, args...)
-	var buf bytes.Buffer
-	cmd.Stdout = &buf
-	cmd.Stderr = &buf
-	if err := cmd.Run(); err != nil {
-		d.log.Warn("nsc destroy failed", "runner", runnerName, "instance", instanceID, "err", err, "output", strings.TrimSpace(buf.String()))
-		return
-	}
-	d.log.Info("nsc instance destroyed", "runner", runnerName, "instance", instanceID)
-}
-
-func macosBootstrapWrapperScript(runnerName string, req LaunchRequest, executor, workdir string) string {
-	workdir = macosRunnerWorkDir(workdir)
-
-	// Pass all values via stdin script so secrets do not appear in the nsc ssh argv.
-	env := map[string]string{
-		"FORGEJO_INSTANCE_URL":   req.InstanceURL,
-		"FORGEJO_RUNNER_TOKEN":   req.Token,
-		"FORGEJO_RUNNER_NAME":    runnerName,
-		"FORGEJO_RUNNER_LABELS":  strings.Join(req.Labels, ","),
-		"FORGEJO_RUNNER_EXEC":    executor,
-		"FORGEJO_RUNNER_WORKDIR": workdir,
-	}
-	for k, v := range req.ExtraEnv {
-		env[k] = v
-	}
-
-	var b strings.Builder
-	b.WriteString("set -euo pipefail\n")
-	for k, v := range env {
-		if strings.TrimSpace(k) == "" {
-			continue
-		}
-		// Single-quote shell escaping: safe for arbitrary tokens.
-		b.WriteString("export ")
-		b.WriteString(k)
-		b.WriteString("=")
-		b.WriteString(shellSingleQuote(v))
-		b.WriteString("\n")
-	}
-	b.WriteString("\n")
-	b.WriteString(macosBootstrapScript())
-	return b.String()
-}
-
-func shellSingleQuote(value string) string {
-	// 'foo' -> '\'' within single quotes: '"'"'
-	return "'" + strings.ReplaceAll(value, "'", `'\"'\"'`) + "'"
-}
-
-func prependNSCRegionArgs(args []string, computeBaseURL string) []string {
-	region := strings.TrimSpace(os.Getenv("NSC_REGION"))
-	if region == "" {
-		region = regionFromComputeBaseURL(computeBaseURL)
-	}
-	if region == "" {
-		// Default to the burrow region used for other Namespace integrations.
-		region = "ord4"
-	}
-	return append([]string{"--region", region}, args...)
-}
-
-func regionFromComputeBaseURL(raw string) string {
-	raw = strings.TrimSpace(raw)
-	if raw == "" {
-		return ""
-	}
-	u, err := url.Parse(raw)
-	if err != nil {
-		return ""
-	}
-	host := u.Hostname()
-	if host == "" {
-		return ""
-	}
-	parts := strings.Split(host, ".")
-	if len(parts) == 0 {
-		return ""
-	}
-	// ord4.compute.namespaceapis.com -> ord4
-	if strings.HasSuffix(host, ".compute.namespaceapis.com") || strings.Contains(host, ".compute.") {
-		return parts[0]
-	}
-	return ""
-}
diff --git a/services/forgejo-nsc/internal/nsc/macos_nsc_test.go b/services/forgejo-nsc/internal/nsc/macos_nsc_test.go
deleted file mode 100644
index 025b52c..0000000
--- a/services/forgejo-nsc/internal/nsc/macos_nsc_test.go
+++ /dev/null
@@ -1,26 +0,0 @@
-package nsc
-
-import (
-	"testing"
-	"time"
-)
-
-func TestMacOSNSCAttemptConfigForReusesLastFallback(t *testing.T) {
-	attempts := []macosNSCAttemptConfig{
-		{waitTimeout: time.Minute, createTimeout: 2 * time.Minute},
-		{waitTimeout: 30 * time.Second, createTimeout: time.Minute},
-	}
-
-	got := macosNSCAttemptConfigFor(3, attempts)
-	want := attempts[len(attempts)-1]
-	if got != want {
-		t.Fatalf("macosNSCAttemptConfigFor(3) = %+v, want %+v", got, want)
-	}
-}
-
-func TestMacOSNSCAttemptConfigForEmpty(t *testing.T) {
-	got := macosNSCAttemptConfigFor(0, nil)
-	if got != (macosNSCAttemptConfig{}) {
-		t.Fatalf("macosNSCAttemptConfigFor(0, nil) = %+v, want zero value", got)
-	}
-}
diff --git a/services/forgejo-nsc/internal/nsc/macos_test.go b/services/forgejo-nsc/internal/nsc/macos_test.go
deleted file mode 100644
index 28fe86b..0000000
--- a/services/forgejo-nsc/internal/nsc/macos_test.go
+++ /dev/null
@@ -1,25 +0,0 @@
-package nsc
-
-import "testing"
-
-func TestMacOSRunnerWorkDirUsesWritableEphemeralPath(t *testing.T) {
-	cases := []struct {
-		name       string
-		configured string
-		want       string
-	}{
-		{name: "empty", configured: "", want: "/tmp/forgejo-runner"},
-		{name: "linux var state", configured: "/var/lib/forgejo-runner", want: "/tmp/forgejo-runner"},
-		{name: "custom tmp", configured: "/tmp/custom-runner", want: "/tmp/custom-runner"},
-		{name: "home path", configured: "/Users/runner/forgejo-runner", want: "/Users/runner/forgejo-runner"},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			got := macosRunnerWorkDir(tc.configured)
-			if got != tc.want {
-				t.Fatalf("macosRunnerWorkDir(%q) = %q, want %q", tc.configured, got, tc.want)
-			}
-		})
-	}
-}
diff --git a/services/forgejo-nsc/internal/nsc/windows.go b/services/forgejo-nsc/internal/nsc/windows.go
deleted file mode 100644
index 5c82d29..0000000
--- a/services/forgejo-nsc/internal/nsc/windows.go
+++ /dev/null
@@ -1,59 +0,0 @@
-package nsc
-
-import (
-	"regexp"
-	"strings"
-)
-
-const windowsDefaultMachineType = "windows/amd64:8x16"
-
-var cpuMemShapePattern = regexp.MustCompile(`^\d+x\d+$`)
-
-func hasWindowsLabel(labels []string) bool {
-	for _, label := range labels {
-		l := strings.TrimSpace(label)
-		if l == "" {
-			continue
-		}
-		base := l
-		if before, _, ok := strings.Cut(l, ":"); ok {
-			base = before
-		}
-		if strings.HasPrefix(base, "namespace-profile-windows-") {
-			return true
-		}
-	}
-	return false
-}
-
-func normalizeWindowsMachineType(machineType string, labels []string) string {
-	mt := strings.TrimSpace(machineType)
-	if strings.HasPrefix(mt, "windows/") {
-		return mt
-	}
-	if cpuMemShapePattern.MatchString(mt) {
-		return "windows/amd64:" + mt
-	}
-
-	// Label-derived defaults: keep a simple shape ladder for explicit profile sizes.
-	for _, label := range labels {
-		base := strings.TrimSpace(label)
-		if before, _, ok := strings.Cut(base, ":"); ok {
-			base = before
-		}
-		switch {
-		case strings.HasPrefix(base, "namespace-profile-windows-small"):
-			return "windows/amd64:2x4"
-		case strings.HasPrefix(base, "namespace-profile-windows-medium"):
-			return "windows/amd64:4x8"
-		case strings.HasPrefix(base, "namespace-profile-windows-large"):
-			return windowsDefaultMachineType
-		}
-	}
-	return windowsDefaultMachineType
-}
-
-func powershellSingleQuote(value string) string {
-	// PowerShell single-quoted string escaping: ' -> ''
-	return "'" + strings.ReplaceAll(value, "'", "''") + "'"
-}
diff --git a/services/forgejo-nsc/internal/nsc/windows_test.go b/services/forgejo-nsc/internal/nsc/windows_test.go
deleted file mode 100644
index 2f1b5e6..0000000
--- a/services/forgejo-nsc/internal/nsc/windows_test.go
+++ /dev/null
@@ -1,98 +0,0 @@
-package nsc
-
-import "testing"
-
-func TestHasWindowsLabel(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name   string
-		labels []string
-		want   bool
-	}{
-		{
-			name:   "namespace windows label",
-			labels: []string{"namespace-profile-windows-large"},
-			want:   true,
-		},
-		{
-			name:   "namespace windows label with host suffix",
-			labels: []string{"namespace-profile-windows-large:host"},
-			want:   true,
-		},
-		{
-			name:   "non namespace windows-like label",
-			labels: []string{"burrow-winrunner:host"},
-			want:   false,
-		},
-		{
-			name:   "macos label",
-			labels: []string{"namespace-profile-macos-large"},
-			want:   false,
-		},
-	}
-
-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			got := hasWindowsLabel(tc.labels)
-			if got != tc.want {
-				t.Fatalf("hasWindowsLabel(%v) = %v, want %v", tc.labels, got, tc.want)
-			}
-		})
-	}
-}
-
-func TestNormalizeWindowsMachineType(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name       string
-		machine    string
-		labels     []string
-		wantPrefix string
-	}{
-		{
-			name:       "explicit windows machine type keeps value",
-			machine:    "windows/amd64:8x16",
-			labels:     []string{"namespace-profile-windows-large"},
-			wantPrefix: "windows/amd64:8x16",
-		},
-		{
-			name:       "shape only is normalized",
-			machine:    "4x8",
-			labels:     []string{"namespace-profile-windows-large"},
-			wantPrefix: "windows/amd64:4x8",
-		},
-		{
-			name:       "large label default",
-			machine:    "",
-			labels:     []string{"namespace-profile-windows-large"},
-			wantPrefix: "windows/amd64:8x16",
-		},
-		{
-			name:       "medium label default",
-			machine:    "",
-			labels:     []string{"namespace-profile-windows-medium"},
-			wantPrefix: "windows/amd64:4x8",
-		},
-		{
-			name:       "fallback default",
-			machine:    "",
-			labels:     []string{"namespace-profile-windows-custom"},
-			wantPrefix: "windows/amd64:8x16",
-		},
-	}
-
-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			got := normalizeWindowsMachineType(tc.machine, tc.labels)
-			if got != tc.wantPrefix {
-				t.Fatalf("normalizeWindowsMachineType(%q, %v) = %q, want %q", tc.machine, tc.labels, got, tc.wantPrefix)
-			}
-		})
-	}
-}
diff --git a/services/forgejo-nsc/internal/nsc/windows_winrm.go b/services/forgejo-nsc/internal/nsc/windows_winrm.go
deleted file mode 100644
index 22f13c9..0000000
--- a/services/forgejo-nsc/internal/nsc/windows_winrm.go
+++ /dev/null
@@ -1,499 +0,0 @@
-package nsc
-
-import (
-	"bufio"
-	"bytes"
-	"context"
-	"encoding/base64"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"time"
-)
-
-type windowsProxyOutput struct {
-	Endpoint string `json:"endpoint"`
-	RDP      struct {
-		Credentials struct {
-			Username string `json:"username"`
-			Password string `json:"password"`
-		} `json:"credentials"`
-	} `json:"rdp"`
-}
-
-func (d *Dispatcher) launchWindowsRunnerViaWinRM(ctx context.Context, runnerName string, req LaunchRequest, ttl time.Duration, machineType string) error {
-	script := windowsBootstrapScript(runnerName, req, d.opts.Executor, d.opts.WorkDir)
-	return d.launchWindowsScriptViaWinRM(ctx, runnerName, ttl, machineType, req.Labels, script)
-}
-
-func (d *Dispatcher) launchWindowsScriptViaWinRM(ctx context.Context, runnerName string, ttl time.Duration, machineType string, labels []string, script string) error {
-	if ttl <= 0 {
-		ttl = d.opts.DefaultDuration
-	}
-
-	mt := normalizeWindowsMachineType(machineType, labels)
-	instanceID, createOutput, err := d.createWindowsInstance(ctx, runnerName, ttl, mt)
-	if err != nil {
-		return fmt.Errorf("windows create failed: %w\n%s", err, createOutput)
-	}
-	defer d.destroyNSCInstance(context.Background(), runnerName, instanceID)
-
-	username, password, err := d.resolveWindowsCredentials(ctx, instanceID)
-	if err != nil {
-		return err
-	}
-
-	if err := d.probeWindowsWinRMService(ctx, instanceID); err != nil {
-		return err
-	}
-
-	endpoint, stopForward, err := d.startWindowsWinRMPortForward(ctx, instanceID)
-	if err != nil {
-		return err
-	}
-	defer stopForward()
-
-	if err := d.runWindowsWinRMPowerShell(ctx, endpoint, username, password, script); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (d *Dispatcher) createWindowsInstance(ctx context.Context, runnerName string, ttl time.Duration, machineType string) (instanceID string, output string, err error) {
-	tmpDir, err := os.MkdirTemp("", "forgejo-nsc-windows-*")
-	if err != nil {
-		return "", "", fmt.Errorf("mktemp: %w", err)
-	}
-	defer os.RemoveAll(tmpDir)
-
-	metaPath := filepath.Join(tmpDir, "create.json")
-	cidPath := filepath.Join(tmpDir, "create.cid")
-
-	args := []string{
-		"create",
-		"--duration", ttl.String(),
-		"--machine_type", machineType,
-		"--cidfile", cidPath,
-		"--purpose", fmt.Sprintf("burrow forgejo runner %s", runnerName),
-		"--output", "plain",
-		"--output_json_to", metaPath,
-		"--wait_timeout", "6m",
-	}
-	args = prependNSCRegionArgs(args, d.opts.ComputeBaseURL)
-
-	createCtx, cancel := context.WithTimeout(ctx, 8*time.Minute)
-	defer cancel()
-
-	cmd := exec.CommandContext(createCtx, d.opts.BinaryPath, args...)
-	var buf bytes.Buffer
-	cmd.Stdout = &buf
-	cmd.Stderr = &buf
-
-	if err := cmd.Run(); err != nil {
-		if created := strings.TrimSpace(mustReadFile(cidPath)); created != "" {
-			d.destroyNSCInstance(context.Background(), runnerName, created)
-		}
-		if errors.Is(createCtx.Err(), context.DeadlineExceeded) {
-			return "", buf.String(), fmt.Errorf("nsc create timed out after %s", 8*time.Minute)
-		}
-		return "", buf.String(), fmt.Errorf("nsc create failed: %w", err)
-	}
-
-	instanceID, err = readNSCCreateInstanceID(metaPath)
-	if err != nil {
-		return "", buf.String(), fmt.Errorf("nsc create output parse failed: %w", err)
-	}
-	if instanceID == "" {
-		return "", buf.String(), errors.New("nsc create returned empty instance id")
-	}
-	return instanceID, buf.String(), nil
-}
-
-func (d *Dispatcher) resolveWindowsCredentials(ctx context.Context, instanceID string) (username string, password string, err error) {
-	tmpDir, err := os.MkdirTemp("", "forgejo-nsc-winproxy-*")
-	if err != nil {
-		return "", "", fmt.Errorf("mktemp: %w", err)
-	}
-	defer os.RemoveAll(tmpDir)
-
-	outPath := filepath.Join(tmpDir, "proxy.json")
-	outFile, err := os.Create(outPath)
-	if err != nil {
-		return "", "", fmt.Errorf("create proxy output file: %w", err)
-	}
-	defer outFile.Close()
-
-	var stderr bytes.Buffer
-	args := []string{"instance", "proxy", instanceID, "-s", "rdp", "-o", "json"}
-	args = prependNSCRegionArgs(args, d.opts.ComputeBaseURL)
-
-	proxyCtx, cancel := context.WithTimeout(ctx, 90*time.Second)
-	defer cancel()
-
-	cmd := exec.CommandContext(proxyCtx, d.opts.BinaryPath, args...)
-	cmd.Stdout = outFile
-	cmd.Stderr = &stderr
-
-	if err := cmd.Start(); err != nil {
-		return "", "", fmt.Errorf("start nsc instance proxy: %w", err)
-	}
-
-	waitDone := make(chan struct{})
-	var waitErr error
-	go func() {
-		waitErr = cmd.Wait()
-		close(waitDone)
-	}()
-
-	var payload windowsProxyOutput
-	deadline := time.Now().Add(45 * time.Second)
-	for time.Now().Before(deadline) {
-		raw, _ := os.ReadFile(outPath)
-		jsonBlob := extractJSON(string(raw))
-		if jsonBlob != "" {
-			if err := json.Unmarshal([]byte(jsonBlob), &payload); err == nil {
-				username = strings.TrimSpace(payload.RDP.Credentials.Username)
-				password = strings.TrimSpace(payload.RDP.Credentials.Password)
-				if username != "" && password != "" {
-					break
-				}
-			}
-		}
-		select {
-		case <-waitDone:
-			if waitErr != nil {
-				return "", "", fmt.Errorf("nsc instance proxy exited before credentials were available: %w\n%s", waitErr, stderr.String())
-			}
-		default:
-		}
-		time.Sleep(1 * time.Second)
-	}
-
-	if cmd.Process != nil {
-		_ = cmd.Process.Kill()
-	}
-	<-waitDone
-
-	if username == "" || password == "" {
-		raw, _ := os.ReadFile(outPath)
-		return "", "", fmt.Errorf("failed to resolve windows credentials from nsc instance proxy output\nstdout=%s\nstderr=%s", strings.TrimSpace(string(raw)), strings.TrimSpace(stderr.String()))
-	}
-	return username, password, nil
-}
-
-func (d *Dispatcher) probeWindowsWinRMService(ctx context.Context, instanceID string) error {
-	args := []string{"instance", "proxy", instanceID, "-s", "winrm", "-o", "json", "--once"}
-	args = prependNSCRegionArgs(args, d.opts.ComputeBaseURL)
-
-	probeCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
-	defer cancel()
-
-	cmd := exec.CommandContext(probeCtx, d.opts.BinaryPath, args...)
-	var out bytes.Buffer
-	cmd.Stdout = &out
-	cmd.Stderr = &out
-
-	err := cmd.Run()
-	raw := strings.TrimSpace(out.String())
-	if endpoint, ok := parseProxyEndpoint(raw); ok && endpoint != "" {
-		return nil
-	}
-
-	if indicatesMissingProxyService(raw, "winrm") {
-		return fmt.Errorf("namespace windows non-interactive channel unavailable: instance does not expose winrm service (rdp-only)\n%s", raw)
-	}
-
-	if errors.Is(probeCtx.Err(), context.DeadlineExceeded) {
-		return fmt.Errorf("timed out probing Namespace winrm service before bootstrap\n%s", raw)
-	}
-
-	if err != nil {
-		return fmt.Errorf("nsc winrm service probe failed: %w\n%s", err, raw)
-	}
-	return fmt.Errorf("nsc winrm service probe did not yield endpoint output\n%s", raw)
-}
-
-func parseProxyEndpoint(raw string) (string, bool) {
-	jsonBlob := extractJSON(raw)
-	if jsonBlob == "" {
-		return "", false
-	}
-	var payload struct {
-		Endpoint string `json:"endpoint"`
-	}
-	if err := json.Unmarshal([]byte(jsonBlob), &payload); err != nil {
-		return "", false
-	}
-	endpoint := strings.TrimSpace(payload.Endpoint)
-	if endpoint == "" {
-		return "", false
-	}
-	return endpoint, true
-}
-
-func indicatesMissingProxyService(raw string, service string) bool {
-	service = strings.TrimSpace(service)
-	if service == "" {
-		return false
-	}
-	token := fmt.Sprintf("does not have service %q", service)
-	return strings.Contains(raw, token)
-}
-
-func (d *Dispatcher) startWindowsWinRMPortForward(ctx context.Context, instanceID string) (endpoint string, stop func(), err error) {
-	args := []string{"instance", "port-forward", instanceID, "--target_port", "5985"}
-	args = prependNSCRegionArgs(args, d.opts.ComputeBaseURL)
-
-	forwardCtx, cancel := context.WithCancel(ctx)
-	cmd := exec.CommandContext(forwardCtx, d.opts.BinaryPath, args...)
-	stdout, err := cmd.StdoutPipe()
-	if err != nil {
-		cancel()
-		return "", nil, fmt.Errorf("port-forward stdout pipe: %w", err)
-	}
-	var stderr bytes.Buffer
-	cmd.Stderr = &stderr
-
-	if err := cmd.Start(); err != nil {
-		cancel()
-		return "", nil, fmt.Errorf("start nsc port-forward: %w", err)
-	}
-
-	waitDone := make(chan struct{})
-	var waitErr error
-	go func() {
-		waitErr = cmd.Wait()
-		close(waitDone)
-	}()
-
-	endpointCh := make(chan string, 1)
-	scanErrCh := make(chan error, 1)
-	go func() {
-		scanner := bufio.NewScanner(stdout)
-		for scanner.Scan() {
-			line := strings.TrimSpace(scanner.Text())
-			if strings.HasPrefix(line, "Listening on ") {
-				endpointCh <- strings.TrimSpace(strings.TrimPrefix(line, "Listening on "))
-				return
-			}
-		}
-		if err := scanner.Err(); err != nil {
-			scanErrCh <- err
-		}
-	}()
-
-	select {
-	case endpoint = <-endpointCh:
-		stop = func() {
-			cancel()
-			if cmd.Process != nil {
-				_ = cmd.Process.Kill()
-			}
-			<-waitDone
-		}
-		return endpoint, stop, nil
-	case err := <-scanErrCh:
-		cancel()
-		if cmd.Process != nil {
-			_ = cmd.Process.Kill()
-		}
-		<-waitDone
-		return "", nil, fmt.Errorf("failed reading port-forward output: %w", err)
-	case <-waitDone:
-		cancel()
-		if waitErr != nil {
-			return "", nil, fmt.Errorf("nsc port-forward exited early: %w\n%s", waitErr, stderr.String())
-		}
-		return "", nil, fmt.Errorf("nsc port-forward exited without endpoint\n%s", stderr.String())
-	case <-time.After(45 * time.Second):
-		cancel()
-		if cmd.Process != nil {
-			_ = cmd.Process.Kill()
-		}
-		<-waitDone
-		return "", nil, fmt.Errorf("timed out waiting for WinRM port-forward endpoint\n%s", stderr.String())
-	case <-ctx.Done():
-		cancel()
-		if cmd.Process != nil {
-			_ = cmd.Process.Kill()
-		}
-		<-waitDone
-		return "", nil, ctx.Err()
-	}
-}
-
-func (d *Dispatcher) runWindowsWinRMPowerShell(ctx context.Context, endpoint, username, password, script string) error {
-	pythonPath, err := exec.LookPath("python3")
-	if err != nil {
-		return fmt.Errorf("python3 is required for windows WinRM bootstrap: %w", err)
-	}
-
-	workdir := strings.TrimSpace(d.opts.WorkDir)
-	if workdir == "" {
-		workdir = "/tmp/forgejo-runner"
-	}
-	if err := os.MkdirAll(workdir, 0o755); err != nil {
-		return fmt.Errorf("create workdir %s: %w", workdir, err)
-	}
-
-	venvPath := filepath.Join(workdir, ".winrm-venv")
-	venvPython := filepath.Join(venvPath, "bin", "python")
-	if _, err := os.Stat(venvPython); err != nil {
-		cmd := exec.CommandContext(ctx, pythonPath, "-m", "venv", venvPath)
-		var out bytes.Buffer
-		cmd.Stdout = &out
-		cmd.Stderr = &out
-		if err := cmd.Run(); err != nil {
-			return fmt.Errorf("create python venv for winrm failed: %w\n%s", err, out.String())
-		}
-	}
-
-	ensurePyWinRM := `
-import importlib.util, subprocess, sys
-if importlib.util.find_spec("winrm") is None:
-    subprocess.check_call([sys.executable, "-m", "pip", "install", "--quiet", "pywinrm"])
-`
-	ensureCmd := exec.CommandContext(ctx, venvPython, "-c", ensurePyWinRM)
-	var ensureOut bytes.Buffer
-	ensureCmd.Stdout = &ensureOut
-	ensureCmd.Stderr = &ensureOut
-	if err := ensureCmd.Run(); err != nil {
-		return fmt.Errorf("install pywinrm failed: %w\n%s", err, ensureOut.String())
-	}
-
-	runScript := `
-import base64, os, sys, time, traceback, winrm
-
-endpoint = os.environ["WINRM_ENDPOINT"]
-user = os.environ["WINRM_USER"]
-password = os.environ["WINRM_PASS"]
-script = base64.b64decode(os.environ["WINRM_SCRIPT_B64"]).decode("utf-8")
-
-deadline = time.time() + 300.0
-last_err = None
-
-while time.time() < deadline:
-    try:
-        session = winrm.Session(f"http://{endpoint}/wsman", auth=(user, password), transport="ntlm")
-        result = session.run_ps(script)
-        sys.stdout.write(result.std_out.decode("utf-8", errors="replace"))
-        sys.stderr.write(result.std_err.decode("utf-8", errors="replace"))
-        print(f"winrm_exit={result.status_code}")
-        sys.exit(result.status_code)
-    except Exception as err:
-        last_err = err
-        time.sleep(5.0)
-
-sys.stderr.write("timed out waiting for WinRM connectivity after 300s\\n")
-if last_err is not None:
-    traceback.print_exception(last_err, file=sys.stderr)
-sys.exit(111)
-`
-	runCmd := exec.CommandContext(ctx, venvPython, "-c", runScript)
-	runCmd.Env = append(os.Environ(),
-		"WINRM_ENDPOINT="+endpoint,
-		"WINRM_USER="+username,
-		"WINRM_PASS="+password,
-		"WINRM_SCRIPT_B64="+base64.StdEncoding.EncodeToString([]byte(script)),
-	)
-	var runOut bytes.Buffer
-	runCmd.Stdout = &runOut
-	runCmd.Stderr = &runOut
-	if err := runCmd.Run(); err != nil {
-		return fmt.Errorf("windows winrm bootstrap command failed: %w\n%s", err, runOut.String())
-	}
-	return nil
-}
-
-func windowsBootstrapScript(runnerName string, req LaunchRequest, executor, workdir string) string {
-	if strings.TrimSpace(workdir) == "" {
-		workdir = `C:\burrow\forgejo-runner`
-	}
-
-	runnerExec := strings.TrimSpace(executor)
-	if runnerExec == "" || runnerExec == "shell" {
-		runnerExec = "host"
-	}
-
-	safeName := strings.NewReplacer(`\`, "-", ":", "-", "/", "-", " ", "-").Replace(runnerName)
-	workRoot := strings.TrimRight(workdir, `\`) + `\` + safeName
-
-	var b strings.Builder
-	b.WriteString("$ErrorActionPreference = 'Stop'\n")
-	b.WriteString("$ProgressPreference = 'SilentlyContinue'\n")
-	b.WriteString("[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\n")
-	b.WriteString("$runnerName = " + powershellSingleQuote(runnerName) + "\n")
-	b.WriteString("$runnerToken = " + powershellSingleQuote(req.Token) + "\n")
-	b.WriteString("$instanceURL = " + powershellSingleQuote(req.InstanceURL) + "\n")
-	b.WriteString("$labelsCsv = " + powershellSingleQuote(strings.Join(req.Labels, ",")) + "\n")
-	b.WriteString("$runnerExec = " + powershellSingleQuote(runnerExec) + "\n")
-	b.WriteString("$workRoot = " + powershellSingleQuote(workRoot) + "\n")
-	b.WriteString(`
-New-Item -Path $workRoot -ItemType Directory -Force | Out-Null
-Set-Location $workRoot
-
-$runnerVersion = "12.6.4"
-$zipUrl = "https://code.forgejo.org/forgejo/runner/releases/download/v${runnerVersion}/forgejo-runner-${runnerVersion}-windows-amd64.zip"
-$zipPath = Join-Path $workRoot "forgejo-runner.zip"
-$extractDir = Join-Path $workRoot "forgejo-runner"
-
-if (Test-Path $extractDir) {
-  Remove-Item -Path $extractDir -Recurse -Force
-}
-
-Invoke-WebRequest -Uri $zipUrl -OutFile $zipPath
-Expand-Archive -Path $zipPath -DestinationPath $extractDir -Force
-
-$runnerExe = Join-Path $extractDir "forgejo-runner.exe"
-if (-not (Test-Path $runnerExe)) {
-  throw "Missing forgejo-runner.exe after extract: $runnerExe"
-}
-
-$labels = @()
-foreach ($label in ($labelsCsv -split ",")) {
-  $trimmed = $label.Trim()
-  if ([string]::IsNullOrWhiteSpace($trimmed)) { continue }
-  if ($trimmed.Contains(":")) {
-    $labels += $trimmed
-  } else {
-    $labels += ("{0}:{1}" -f $trimmed, $runnerExec)
-  }
-}
-if ($labels.Count -eq 0) {
-  throw "No runner labels resolved for windows bootstrap"
-}
-
-$labelLines = ($labels | ForEach-Object { "  - $_" }) -join [Environment]::NewLine
-$configPath = Join-Path $workRoot "runner.yaml"
-$runnerYaml = @"
-log:
-  level: info
-runner:
-  file: .runner
-  capacity: 1
-  name: $runnerName
-  labels:
-$labelLines
-cache:
-  enabled: false
-"@
-Set-Content -Path $configPath -Value $runnerYaml -Encoding UTF8
-
-$labelsArg = ($labels -join ",")
-& $runnerExe register --no-interactive --instance $instanceURL --token $runnerToken --name $runnerName --labels $labelsArg --config $configPath
-if ($LASTEXITCODE -ne 0) {
-  throw ("forgejo-runner register failed: {0}" -f $LASTEXITCODE)
-}
-
-& $runnerExe one-job --config $configPath
-if ($LASTEXITCODE -ne 0) {
-  throw ("forgejo-runner one-job failed: {0}" -f $LASTEXITCODE)
-}
-`)
-	return b.String()
-}
diff --git a/services/forgejo-nsc/internal/nsc/windows_winrm_integration_test.go b/services/forgejo-nsc/internal/nsc/windows_winrm_integration_test.go
deleted file mode 100644
index 407749b..0000000
--- a/services/forgejo-nsc/internal/nsc/windows_winrm_integration_test.go
+++ /dev/null
@@ -1,59 +0,0 @@
-package nsc
-
-import (
-	"context"
-	"io"
-	"log/slog"
-	"os"
-	"os/exec"
-	"strings"
-	"testing"
-	"time"
-)
-
-func TestWindowsWinRMScriptRoundTrip(t *testing.T) {
-	if os.Getenv("NSC_WINDOWS_E2E") != "1" {
-		t.Skip("set NSC_WINDOWS_E2E=1 to run Namespace Windows integration test")
-	}
-
-	nscBinary, err := exec.LookPath("nsc")
-	if err != nil {
-		t.Skipf("nsc not found in PATH: %v", err)
-	}
-
-	authCheck := exec.Command(nscBinary, "auth", "check-login")
-	if out, err := authCheck.CombinedOutput(); err != nil {
-		t.Skipf("nsc auth check-login failed: %v (%s)", err, strings.TrimSpace(string(out)))
-	}
-
-	machineType := strings.TrimSpace(os.Getenv("NSC_WINDOWS_E2E_MACHINE_TYPE"))
-	if machineType == "" {
-		machineType = "windows/amd64:4x8"
-	}
-
-	dispatcher, err := NewDispatcher(Options{
-		BinaryPath:      nscBinary,
-		DefaultImage:    "code.forgejo.org/forgejo/runner:11",
-		DefaultMachine:  machineType,
-		DefaultDuration: 20 * time.Minute,
-		MaxParallel:     1,
-		WorkDir:         t.TempDir(),
-		ComputeBaseURL:  strings.TrimSpace(os.Getenv("NSC_COMPUTE_BASE_URL")),
-		Logger:          slog.New(slog.NewTextHandler(io.Discard, nil)),
-	})
-	if err != nil {
-		t.Fatalf("NewDispatcher() error: %v", err)
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
-	defer cancel()
-
-	script := "Write-Output ('winrm-ok:' + $env:COMPUTERNAME)"
-	labels := []string{"namespace-profile-windows-medium"}
-	if err := dispatcher.launchWindowsScriptViaWinRM(ctx, "nsc-winrm-itest", 20*time.Minute, machineType, labels, script); err != nil {
-		if strings.Contains(err.Error(), "does not expose winrm service (rdp-only)") {
-			t.Skipf("namespace windows control channel is rdp-only: %v", err)
-		}
-		t.Fatalf("launchWindowsScriptViaWinRM() error: %v", err)
-	}
-}
diff --git a/services/forgejo-nsc/internal/nsc/windows_winrm_test.go b/services/forgejo-nsc/internal/nsc/windows_winrm_test.go
deleted file mode 100644
index 538d009..0000000
--- a/services/forgejo-nsc/internal/nsc/windows_winrm_test.go
+++ /dev/null
@@ -1,65 +0,0 @@
-package nsc
-
-import "testing"
-
-func TestParseProxyEndpoint(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name   string
-		raw    string
-		want   string
-		wantOK bool
-	}{
-		{
-			name:   "plain json payload",
-			raw:    `{"endpoint":"127.0.0.1:61234"}`,
-			want:   "127.0.0.1:61234",
-			wantOK: true,
-		},
-		{
-			name: "json wrapped with extra output",
-			raw: `Connected.
-{"endpoint":"127.0.0.1:61235","rdp":{"credentials":{"username":"runneradmin","password":"runneradmin"}}}`,
-			want:   "127.0.0.1:61235",
-			wantOK: true,
-		},
-		{
-			name:   "missing endpoint field",
-			raw:    `{"rdp":{"credentials":{"username":"runneradmin"}}}`,
-			wantOK: false,
-		},
-		{
-			name:   "non-json output",
-			raw:    `Failed: instance does not have service "winrm"`,
-			wantOK: false,
-		},
-	}
-
-	for _, tc := range tests {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			got, ok := parseProxyEndpoint(tc.raw)
-			if ok != tc.wantOK {
-				t.Fatalf("parseProxyEndpoint(%q) ok=%v, want %v", tc.raw, ok, tc.wantOK)
-			}
-			if got != tc.want {
-				t.Fatalf("parseProxyEndpoint(%q) endpoint=%q, want %q", tc.raw, got, tc.want)
-			}
-		})
-	}
-}
-
-func TestIndicatesMissingProxyService(t *testing.T) {
-	t.Parallel()
-
-	raw := `Failed: instance does not have service "winrm"`
-	if !indicatesMissingProxyService(raw, "winrm") {
-		t.Fatalf("indicatesMissingProxyService should return true for missing winrm message")
-	}
-	if indicatesMissingProxyService(raw, "ssh") {
-		t.Fatalf("indicatesMissingProxyService should be false when service name does not match")
-	}
-}
diff --git a/services/forgejo-nsc/internal/server/server.go b/services/forgejo-nsc/internal/server/server.go
deleted file mode 100644
index b4bb1d2..0000000
--- a/services/forgejo-nsc/internal/server/server.go
+++ /dev/null
@@ -1,151 +0,0 @@
-package server
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"log/slog"
-	"net/http"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/chi/v5/middleware"
-
-	"github.com/burrow/forgejo-nsc/internal/app"
-)
-
-type Server struct {
-	httpServer *http.Server
-	app        *app.Service
-	log        *slog.Logger
-}
-
-func New(listen string, svc *app.Service, logger *slog.Logger) *Server {
-	if logger == nil {
-		logger = slog.Default()
-	}
-
-	router := chi.NewRouter()
-	router.Use(middleware.RequestID)
-	router.Use(middleware.RealIP)
-	router.Use(middleware.Logger)
-	router.Use(middleware.Recoverer)
-
-	s := &Server{
-		app: svc,
-		log: logger,
-		httpServer: &http.Server{
-			Addr:        listen,
-			Handler:     router,
-			ReadTimeout: 30 * time.Second,
-			// Dispatch requests can legitimately run for the duration of a build.
-			// A short WriteTimeout will kill the request context mid-provisioning.
-			WriteTimeout: 2 * time.Hour,
-			IdleTimeout:  60 * time.Second,
-		},
-	}
-
-	router.Get("/healthz", s.handleHealthz)
-	router.Post("/api/v1/dispatch", s.handleDispatch)
-
-	return s
-}
-
-func (s *Server) ListenAndServe() error {
-	return s.httpServer.ListenAndServe()
-}
-
-func (s *Server) Shutdown(ctx context.Context) error {
-	return s.httpServer.Shutdown(ctx)
-}
-
-// Handler exposes the underlying HTTP handler for tests.
-func (s *Server) Handler() http.Handler {
-	return s.httpServer.Handler
-}
-
-type dispatchRequest struct {
-	Count   int               `json:"count"`
-	Labels  []string          `json:"labels"`
-	Scope   *dispatchScope    `json:"scope"`
-	TTL     string            `json:"ttl"`
-	Machine string            `json:"machine_type"`
-	Image   string            `json:"image"`
-	Env     map[string]string `json:"env"`
-}
-
-type dispatchScope struct {
-	Level string `json:"level"`
-	Owner string `json:"owner"`
-	Name  string `json:"name"`
-}
-
-func (s *Server) handleDispatch(w http.ResponseWriter, r *http.Request) {
-	var payload dispatchRequest
-	if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
-		s.writeError(w, http.StatusBadRequest, err)
-		return
-	}
-
-	duration, err := parseDuration(payload.TTL)
-	if err != nil {
-		s.writeError(w, http.StatusBadRequest, err)
-		return
-	}
-
-	var scope *app.Scope
-	if payload.Scope != nil {
-		scope = &app.Scope{
-			Level: payload.Scope.Level,
-			Owner: payload.Scope.Owner,
-			Name:  payload.Scope.Name,
-		}
-	}
-
-	resp, err := s.app.Dispatch(r.Context(), app.DispatchRequest{
-		Count:    payload.Count,
-		Labels:   payload.Labels,
-		Scope:    scope,
-		TTL:      duration,
-		Machine:  payload.Machine,
-		Image:    payload.Image,
-		ExtraEnv: payload.Env,
-	})
-	if err != nil {
-		s.writeError(w, http.StatusInternalServerError, err)
-		return
-	}
-
-	s.writeJSON(w, http.StatusOK, resp)
-}
-
-func parseDuration(value string) (time.Duration, error) {
-	if value == "" {
-		return 0, nil
-	}
-	dur, err := time.ParseDuration(value)
-	if err != nil {
-		return 0, err
-	}
-	if dur <= 0 {
-		return 0, errors.New("ttl must be positive")
-	}
-	return dur, nil
-}
-
-func (s *Server) handleHealthz(w http.ResponseWriter, _ *http.Request) {
-	s.writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
-}
-
-func (s *Server) writeError(w http.ResponseWriter, code int, err error) {
-	s.log.Error("request failed", "err", err, "status", code)
-	s.writeJSON(w, code, map[string]string{
-		"error": err.Error(),
-	})
-}
-
-func (s *Server) writeJSON(w http.ResponseWriter, code int, payload any) {
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(code)
-	_ = json.NewEncoder(w).Encode(payload)
-}
diff --git a/services/forgejo-nsc/internal/server/server_test.go b/services/forgejo-nsc/internal/server/server_test.go
deleted file mode 100644
index 09a9743..0000000
--- a/services/forgejo-nsc/internal/server/server_test.go
+++ /dev/null
@@ -1,111 +0,0 @@
-package server
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/burrow/forgejo-nsc/internal/app"
-	"github.com/burrow/forgejo-nsc/internal/forgejo"
-	"github.com/burrow/forgejo-nsc/internal/nsc"
-)
-
-type serverForgejoMock struct {
-	mu     sync.Mutex
-	token  string
-	scopes []forgejo.Scope
-}
-
-func (m *serverForgejoMock) RegistrationToken(ctx context.Context, scope forgejo.Scope) (string, error) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.scopes = append(m.scopes, scope)
-	return m.token, nil
-}
-
-type serverDispatcherMock struct {
-	mu       sync.Mutex
-	requests []nsc.LaunchRequest
-	result   string
-}
-
-func (m *serverDispatcherMock) LaunchRunner(ctx context.Context, req nsc.LaunchRequest) (string, error) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.requests = append(m.requests, req)
-	if m.result != "" {
-		return m.result, nil
-	}
-	return "runner", nil
-}
-
-func TestDispatchEndpoint(t *testing.T) {
-	forgejoMock := &serverForgejoMock{token: "token"}
-	dispatcherMock := &serverDispatcherMock{result: "runner-http"}
-
-	cfg := app.Config{
-		DefaultScope:  forgejo.Scope{Level: forgejo.ScopeInstance},
-		DefaultLabels: []string{"fallback"},
-		InstanceURL:   "https://forgejo.example.com",
-		DefaultTTL:    30 * time.Minute,
-	}
-
-	service := app.NewService(cfg, forgejoMock, dispatcherMock, nil)
-	srv := New(":0", service, nil)
-	ts := httptest.NewServer(srv.Handler())
-	defer ts.Close()
-
-	body := map[string]any{
-		"count":        1,
-		"ttl":          "45m",
-		"labels":       []string{"nscloud-arm"},
-		"scope":        map[string]string{"level": string(forgejo.ScopeOrganization), "owner": "acme"},
-		"machine_type": "8x16",
-		"image":        "runner:http",
-		"env":          map[string]string{"FOO": "bar"},
-	}
-
-	payload, _ := json.Marshal(body)
-
-	resp, err := http.Post(ts.URL+"/api/v1/dispatch", "application/json", bytes.NewReader(payload))
-	if err != nil {
-		t.Fatalf("POST failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		t.Fatalf("expected 200 OK, got %d", resp.StatusCode)
-	}
-
-	var decoded app.DispatchResponse
-	if err := json.NewDecoder(resp.Body).Decode(&decoded); err != nil {
-		t.Fatalf("failed to decode response: %v", err)
-	}
-
-	if len(decoded.Runners) != 1 || decoded.Runners[0].Name != "runner-http" {
-		t.Fatalf("unexpected response: %+v", decoded)
-	}
-
-	if len(forgejoMock.scopes) != 1 || forgejoMock.scopes[0].Level != forgejo.ScopeOrganization {
-		t.Fatalf("expected organization scope, got %+v", forgejoMock.scopes)
-	}
-
-	if len(dispatcherMock.requests) != 1 {
-		t.Fatalf("expected dispatcher call")
-	}
-	call := dispatcherMock.requests[0]
-	if call.Duration != 45*time.Minute {
-		t.Fatalf("expected ttl override, got %v", call.Duration)
-	}
-	if call.Labels[0] != "nscloud-arm" {
-		t.Fatalf("expected labels passthrough, got %v", call.Labels)
-	}
-	if call.ExtraEnv["FOO"] != "bar" {
-		t.Fatalf("expected env passthrough")
-	}
-}
diff --git a/services/grafana/dashboards/burrow-overview.json b/services/grafana/dashboards/burrow-overview.json
deleted file mode 100644
index 84b4c33..0000000
--- a/services/grafana/dashboards/burrow-overview.json
+++ /dev/null
@@ -1,139 +0,0 @@
-{
-  "annotations": {
-    "list": [
-      {
-        "builtIn": 1,
-        "datasource": {
-          "type": "grafana",
-          "uid": "-- Grafana --"
-        },
-        "enable": true,
-        "hide": true,
-        "iconColor": "rgba(0, 211, 255, 1)",
-        "name": "Annotations & Alerts",
-        "target": {
-          "limit": 100,
-          "matchAny": false,
-          "tags": [],
-          "type": "dashboard"
-        },
-        "type": "dashboard"
-      }
-    ]
-  },
-  "editable": true,
-  "fiscalYearStartMonth": 0,
-  "graphTooltip": 0,
-  "id": null,
-  "links": [],
-  "liveNow": false,
-  "panels": [
-    {
-      "datasource": {
-        "type": "grafana",
-        "uid": "-- Grafana --"
-      },
-      "fieldConfig": {
-        "defaults": {},
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 6,
-        "w": 24,
-        "x": 0,
-        "y": 0
-      },
-      "id": 1,
-      "options": {
-        "code": {
-          "language": "plaintext",
-          "showLineNumbers": false,
-          "showMiniMap": false
-        },
-        "content": "# Burrow Operations\n\nGrafana is managed by NixOS for service/auth and OpenTofu for API-owned folders and dashboards.\n\nStart here after deploys to add service-specific panels as data sources come online.",
-        "mode": "markdown"
-      },
-      "pluginVersion": "12.3.0",
-      "title": "Overview",
-      "type": "text"
-    },
-    {
-      "datasource": {
-        "type": "grafana",
-        "uid": "-- Grafana --"
-      },
-      "fieldConfig": {
-        "defaults": {},
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 6,
-        "w": 12,
-        "x": 0,
-        "y": 6
-      },
-      "id": 2,
-      "options": {
-        "code": {
-          "language": "plaintext",
-          "showLineNumbers": false,
-          "showMiniMap": false
-        },
-        "content": "## Runtime Checks\n\n- `grafana.service` active\n- `https://graphs.burrow.net/login` reachable\n- Authentik generic OAuth login returns to `/login/generic_oauth`\n- OpenTofu dashboard import or apply succeeds",
-        "mode": "markdown"
-      },
-      "pluginVersion": "12.3.0",
-      "title": "Readiness",
-      "type": "text"
-    },
-    {
-      "datasource": {
-        "type": "grafana",
-        "uid": "-- Grafana --"
-      },
-      "fieldConfig": {
-        "defaults": {},
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 6,
-        "w": 12,
-        "x": 12,
-        "y": 6
-      },
-      "id": 3,
-      "options": {
-        "code": {
-          "language": "plaintext",
-          "showLineNumbers": false,
-          "showMiniMap": false
-        },
-        "content": "## Ownership\n\nNix owns service startup, SSO, reverse proxy, and secrets.\n\nOpenTofu owns API-created folders and dashboards so visual iteration does not require a host switch.",
-        "mode": "markdown"
-      },
-      "pluginVersion": "12.3.0",
-      "title": "Control Plane",
-      "type": "text"
-    }
-  ],
-  "refresh": "",
-  "schemaVersion": 39,
-  "style": "dark",
-  "tags": [
-    "burrow",
-    "operations"
-  ],
-  "templating": {
-    "list": []
-  },
-  "time": {
-    "from": "now-6h",
-    "to": "now"
-  },
-  "timepicker": {},
-  "timezone": "browser",
-  "title": "Burrow Overview",
-  "uid": "burrow-overview",
-  "version": 1,
-  "weekStart": ""
-}
diff --git a/services/grafana/dashboards/headscale.json b/services/grafana/dashboards/headscale.json
deleted file mode 100644
index 12eb33e..0000000
--- a/services/grafana/dashboards/headscale.json
+++ /dev/null
@@ -1,423 +0,0 @@
-{
-  "annotations": {
-    "list": []
-  },
-  "editable": true,
-  "fiscalYearStartMonth": 0,
-  "graphTooltip": 0,
-  "id": null,
-  "links": [],
-  "panels": [
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prometheus"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "mappings": [
-            {
-              "options": {
-                "0": {
-                  "text": "down"
-                },
-                "1": {
-                  "text": "up"
-                }
-              },
-              "type": "value"
-            }
-          ],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "red",
-                "value": null
-              },
-              {
-                "color": "green",
-                "value": 1
-              }
-            ]
-          }
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 0,
-        "y": 0
-      },
-      "id": 1,
-      "options": {
-        "colorMode": "background",
-        "graphMode": "none",
-        "justifyMode": "center",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
-        "showPercentChange": false,
-        "textMode": "value_and_name",
-        "wideLayout": true
-      },
-      "pluginVersion": "11.0.0",
-      "targets": [
-        {
-          "expr": "up{job=\"$job\"}",
-          "legendFormat": "headscale scrape",
-          "refId": "A"
-        }
-      ],
-      "title": "Scrape",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prometheus"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "mappings": [
-            {
-              "options": {
-                "0": {
-                  "text": "inactive"
-                },
-                "1": {
-                  "text": "active"
-                }
-              },
-              "type": "value"
-            }
-          ],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "red",
-                "value": null
-              },
-              {
-                "color": "green",
-                "value": 1
-              }
-            ]
-          }
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 6,
-        "y": 0
-      },
-      "id": 2,
-      "options": {
-        "colorMode": "background",
-        "graphMode": "none",
-        "justifyMode": "center",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
-        "showPercentChange": false,
-        "textMode": "value_and_name",
-        "wideLayout": true
-      },
-      "pluginVersion": "11.0.0",
-      "targets": [
-        {
-          "expr": "max(node_systemd_unit_state{name=\"headscale.service\",state=\"active\"}) or vector(0)",
-          "legendFormat": "headscale service",
-          "refId": "A"
-        }
-      ],
-      "title": "Service",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prometheus"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 12,
-        "y": 0
-      },
-      "id": 3,
-      "options": {
-        "colorMode": "none",
-        "graphMode": "area",
-        "justifyMode": "center",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
-        "showPercentChange": false,
-        "textMode": "value_and_name",
-        "wideLayout": true
-      },
-      "pluginVersion": "11.0.0",
-      "targets": [
-        {
-          "expr": "headscale_nodes_total or headscale_machine_count or headscale_node_count or vector(0)",
-          "legendFormat": "nodes",
-          "refId": "A"
-        }
-      ],
-      "title": "Tailnet Nodes",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prometheus"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "reqps"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 18,
-        "y": 0
-      },
-      "id": 4,
-      "options": {
-        "colorMode": "none",
-        "graphMode": "area",
-        "justifyMode": "center",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
-        "showPercentChange": false,
-        "textMode": "value_and_name",
-        "wideLayout": true
-      },
-      "pluginVersion": "11.0.0",
-      "targets": [
-        {
-          "expr": "sum(rate(headscale_http_requests_total[5m])) or vector(0)",
-          "legendFormat": "http requests",
-          "refId": "A"
-        }
-      ],
-      "title": "HTTP Rate",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prometheus"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "custom": {
-            "drawStyle": "line",
-            "fillOpacity": 12,
-            "lineInterpolation": "linear",
-            "lineWidth": 2,
-            "pointSize": 5,
-            "showPoints": "never",
-            "spanNulls": false
-          },
-          "unit": "short"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 4
-      },
-      "id": 5,
-      "options": {
-        "legend": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": "desc"
-        }
-      },
-      "targets": [
-        {
-          "expr": "headscale_nodes_total or headscale_machine_count or headscale_node_count or vector(0)",
-          "legendFormat": "nodes",
-          "refId": "A"
-        }
-      ],
-      "title": "Tailnet Node Count",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prometheus"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "custom": {
-            "drawStyle": "line",
-            "fillOpacity": 12,
-            "lineInterpolation": "linear",
-            "lineWidth": 2,
-            "pointSize": 5,
-            "showPoints": "never",
-            "spanNulls": false
-          },
-          "unit": "reqps"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 4
-      },
-      "id": 6,
-      "options": {
-        "legend": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": "desc"
-        }
-      },
-      "targets": [
-        {
-          "expr": "sum by (code,method) (rate(headscale_http_requests_total[5m])) or vector(0)",
-          "legendFormat": "{{method}} {{code}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Headscale HTTP Requests",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prometheus"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "custom": {
-            "align": "auto",
-            "cellOptions": {
-              "type": "auto"
-            },
-            "inspect": false
-          }
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 24,
-        "x": 0,
-        "y": 12
-      },
-      "id": 7,
-      "options": {
-        "cellHeight": "sm",
-        "footer": {
-          "countRows": false,
-          "fields": "",
-          "reducer": [
-            "sum"
-          ],
-          "show": false
-        },
-        "showHeader": true
-      },
-      "targets": [
-        {
-          "expr": "max by (name,state) (node_systemd_unit_state{name=~\"headscale.service|tailscaled.service\",state=~\"active|failed|activating\"})",
-          "format": "table",
-          "instant": true,
-          "refId": "A"
-        }
-      ],
-      "title": "Tailnet Service Units",
-      "type": "table"
-    }
-  ],
-  "refresh": "30s",
-  "schemaVersion": 39,
-  "tags": [
-    "burrow",
-    "headscale",
-    "tailnet"
-  ],
-  "templating": {
-    "list": [
-      {
-        "current": {
-          "selected": false,
-          "text": "headscale",
-          "value": "headscale"
-        },
-        "hide": 2,
-        "name": "job",
-        "query": "headscale",
-        "type": "constant"
-      }
-    ]
-  },
-  "time": {
-    "from": "now-6h",
-    "to": "now"
-  },
-  "timepicker": {},
-  "timezone": "browser",
-  "title": "Burrow Headscale",
-  "uid": "burrow-headscale",
-  "version": 1,
-  "weekStart": ""
-}
diff --git a/services/grafana/dashboards/observability.json b/services/grafana/dashboards/observability.json
deleted file mode 100644
index 344f44d..0000000
--- a/services/grafana/dashboards/observability.json
+++ /dev/null
@@ -1,477 +0,0 @@
-{
-  "annotations": {
-    "list": []
-  },
-  "editable": true,
-  "fiscalYearStartMonth": 0,
-  "graphTooltip": 0,
-  "id": null,
-  "links": [],
-  "panels": [
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prometheus"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "mappings": [
-            {
-              "options": {
-                "0": {
-                  "text": "down"
-                },
-                "1": {
-                  "text": "up"
-                }
-              },
-              "type": "value"
-            }
-          ],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "red",
-                "value": null
-              },
-              {
-                "color": "green",
-                "value": 1
-              }
-            ]
-          }
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 6,
-        "w": 8,
-        "x": 0,
-        "y": 0
-      },
-      "id": 1,
-      "options": {
-        "displayMode": "gradient",
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "minVizHeight": 10,
-        "minVizWidth": 0,
-        "namePlacement": "auto",
-        "orientation": "horizontal",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
-        "showUnfilled": true,
-        "sizing": "auto",
-        "valueMode": "color"
-      },
-      "pluginVersion": "11.0.0",
-      "targets": [
-        {
-          "expr": "up{job=~\"prometheus|grafana|headscale|otel-collector|jaeger|node|systemd|tailscale|garage\"}",
-          "legendFormat": "{{job}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Scrape Health",
-      "type": "bargauge"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prometheus"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "mappings": [
-            {
-              "options": {
-                "0": {
-                  "text": "inactive"
-                },
-                "1": {
-                  "text": "active"
-                }
-              },
-              "type": "value"
-            }
-          ],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "red",
-                "value": null
-              },
-              {
-                "color": "green",
-                "value": 1
-              }
-            ]
-          }
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 6,
-        "w": 8,
-        "x": 8,
-        "y": 0
-      },
-      "id": 2,
-      "options": {
-        "displayMode": "gradient",
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "minVizHeight": 10,
-        "minVizWidth": 0,
-        "namePlacement": "auto",
-        "orientation": "horizontal",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
-        "showUnfilled": true,
-        "sizing": "auto",
-        "valueMode": "color"
-      },
-      "pluginVersion": "11.0.0",
-      "targets": [
-        {
-          "expr": "max by (name) (node_systemd_unit_state{name=~\"grafana.service|prometheus.service|opentelemetry-collector.service|podman-burrow-jaeger.service|headscale.service|tailscaled.service|forgejo.service\",state=\"active\"})",
-          "legendFormat": "{{name}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Service State",
-      "type": "bargauge"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prometheus"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 6,
-        "w": 8,
-        "x": 16,
-        "y": 0
-      },
-      "id": 3,
-      "options": {
-        "colorMode": "none",
-        "graphMode": "area",
-        "justifyMode": "center",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
-        "showPercentChange": false,
-        "textMode": "value_and_name",
-        "wideLayout": true
-      },
-      "pluginVersion": "11.0.0",
-      "targets": [
-        {
-          "expr": "sum(otelcol_receiver_accepted_spans) or sum(otelcol_receiver_refused_spans) or vector(0)",
-          "legendFormat": "collector spans",
-          "refId": "A"
-        }
-      ],
-      "title": "OTLP Spans",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prometheus"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "custom": {
-            "drawStyle": "line",
-            "fillOpacity": 12,
-            "lineInterpolation": "linear",
-            "lineWidth": 2,
-            "pointSize": 5,
-            "showPoints": "never",
-            "spanNulls": false
-          },
-          "unit": "short"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 6
-      },
-      "id": 4,
-      "options": {
-        "legend": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": "desc"
-        }
-      },
-      "targets": [
-        {
-          "expr": "sum by (receiver,transport) (rate(otelcol_receiver_accepted_spans[5m])) or vector(0)",
-          "legendFormat": "{{receiver}} {{transport}}",
-          "refId": "A"
-        },
-        {
-          "expr": "sum by (exporter) (rate(otelcol_exporter_sent_spans[5m])) or vector(0)",
-          "legendFormat": "exported {{exporter}}",
-          "refId": "B"
-        }
-      ],
-      "title": "OpenTelemetry Trace Flow",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prometheus"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "custom": {
-            "drawStyle": "line",
-            "fillOpacity": 12,
-            "lineInterpolation": "linear",
-            "lineWidth": 2,
-            "pointSize": 5,
-            "showPoints": "never",
-            "spanNulls": false
-          },
-          "unit": "short"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 6
-      },
-      "id": 5,
-      "options": {
-        "legend": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": "desc"
-        }
-      },
-      "targets": [
-        {
-          "expr": "sum(rate(jaeger_collector_spans_received_total[5m])) or sum(rate(jaeger_collector_traces_received_total[5m])) or vector(0)",
-          "legendFormat": "jaeger received",
-          "refId": "A"
-        },
-        {
-          "expr": "sum(rate(jaeger_query_requests_total[5m])) or vector(0)",
-          "legendFormat": "jaeger queries",
-          "refId": "B"
-        }
-      ],
-      "title": "Jaeger Activity",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prometheus"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "custom": {
-            "drawStyle": "line",
-            "fillOpacity": 12,
-            "lineInterpolation": "linear",
-            "lineWidth": 2,
-            "pointSize": 5,
-            "showPoints": "never",
-            "spanNulls": false
-          },
-          "unit": "percentunit"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 14
-      },
-      "id": 6,
-      "options": {
-        "legend": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": "desc"
-        }
-      },
-      "targets": [
-        {
-          "expr": "1 - avg by (instance) (rate(node_cpu_seconds_total{mode=\"idle\"}[5m]))",
-          "legendFormat": "{{instance}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Host CPU",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "prometheus"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "custom": {
-            "drawStyle": "line",
-            "fillOpacity": 12,
-            "lineInterpolation": "linear",
-            "lineWidth": 2,
-            "pointSize": 5,
-            "showPoints": "never",
-            "spanNulls": false
-          },
-          "unit": "percentunit"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 14
-      },
-      "id": 7,
-      "options": {
-        "legend": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": "desc"
-        }
-      },
-      "targets": [
-        {
-          "expr": "1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)",
-          "legendFormat": "{{instance}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Host Memory",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "jaeger",
-        "uid": "jaeger"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 24,
-        "x": 0,
-        "y": 22
-      },
-      "id": 8,
-      "options": {
-        "showHeader": true
-      },
-      "targets": [
-        {
-          "datasource": {
-            "type": "jaeger",
-            "uid": "jaeger"
-          },
-          "limit": 20,
-          "operation": "",
-          "queryType": "search",
-          "refId": "A",
-          "service": "burrow"
-        }
-      ],
-      "title": "Recent Burrow Traces",
-      "type": "traces"
-    }
-  ],
-  "refresh": "30s",
-  "schemaVersion": 39,
-  "tags": [
-    "burrow",
-    "observability",
-    "opentelemetry",
-    "jaeger"
-  ],
-  "templating": {
-    "list": []
-  },
-  "time": {
-    "from": "now-6h",
-    "to": "now"
-  },
-  "timepicker": {},
-  "timezone": "browser",
-  "title": "Burrow Observability",
-  "uid": "burrow-observability",
-  "version": 1,
-  "weekStart": ""
-}
diff --git a/services/mcp-hub/README.md b/services/mcp-hub/README.md
deleted file mode 100644
index 4b1c2a2..0000000
--- a/services/mcp-hub/README.md
+++ /dev/null
@@ -1,25 +0,0 @@
-# Burrow MCP Hub Extraction
-
-This directory is the in-repo extraction plan for a dedicated MCP hub repository.
-
-Target repository:
-
-```text
-compatible.systems/burrow/mcp-hub
-```
-
-The hub should expose Burrow-operated tools for:
-
-- Authentik users, groups, OIDC, SAML, SCIM, and WIF applications
-- OpenBao mounts, policies, AppRole, and secret-read workflows
-- Google KMS key catalog, public-key export, and signing readiness
-- Forgejo workflow dispatch, runner identity, and Namespace runner status
-- Grafana dashboard and alert checks
-- Jitsi meeting readiness and service health
-- mail and webmail readiness after the Stalwart phase starts
-- release signing, store upload readiness, and distribution metadata checks
-- agent identity inventory derived from `contributors.nix`
-
-The hub must keep identity and authorization explicit. Agent identities should be
-named, attributable, and backed by Authentik/WIF or OpenBao AppRole rather than
-static shared tokens.
diff --git a/site/.eslintrc.json b/site/.eslintrc.json
deleted file mode 100644
index bffb357..0000000
--- a/site/.eslintrc.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "extends": "next/core-web-vitals"
-}
diff --git a/site/.gitignore b/site/.gitignore
deleted file mode 100644
index 71b863e..0000000
--- a/site/.gitignore
+++ /dev/null
@@ -1,5 +0,0 @@
-/node_modules
-/out/
-
-/.next/
-next-env.d.ts
diff --git a/site/.prettierignore b/site/.prettierignore
deleted file mode 100644
index fcac576..0000000
--- a/site/.prettierignore
+++ /dev/null
@@ -1,6 +0,0 @@
-# Ignore artifacts:
-build
-coverage
-
-# Ignore all HTML files:
-**/*.html
\ No newline at end of file
diff --git a/site/assets/Bold.woff2 b/site/assets/Bold.woff2
deleted file mode 100644
index 8c00084..0000000
Binary files a/site/assets/Bold.woff2 and /dev/null differ
diff --git a/site/assets/Italic.woff2 b/site/assets/Italic.woff2
deleted file mode 100644
index 056909c..0000000
Binary files a/site/assets/Italic.woff2 and /dev/null differ
diff --git a/site/assets/Regular.woff2 b/site/assets/Regular.woff2
deleted file mode 100644
index d7c3d52..0000000
Binary files a/site/assets/Regular.woff2 and /dev/null differ
diff --git a/site/bun.lockb b/site/bun.lockb
deleted file mode 100755
index ea2d137..0000000
Binary files a/site/bun.lockb and /dev/null differ
diff --git a/site/layout/layout.tsx b/site/layout/layout.tsx
deleted file mode 100644
index 057aa68..0000000
--- a/site/layout/layout.tsx
+++ /dev/null
@@ -1,40 +0,0 @@
-import localFont from "next/font/local";
-
-const phantomSans = localFont({
-  src: [
-    {
-      path: "../assets/Regular.woff2",
-      weight: "400",
-      style: "normal",
-    },
-    {
-      path: "../assets/Italic.woff2",
-      weight: "400",
-      style: "italic",
-    },
-    {
-      path: "../assets/Bold.woff2",
-      weight: "700",
-      style: "normal",
-    },
-  ],
-  variable: "--font-phantom-sans",
-});
-
-const fallbackFontVariables = {
-  "--font-space-mono":
-    '"SFMono-Regular", "SF Mono", ui-monospace, Menlo, Monaco, "Cascadia Mono", "Segoe UI Mono", "Roboto Mono", monospace',
-  "--font-poppins":
-    'var(--font-phantom-sans), -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif',
-} as React.CSSProperties;
-
-export default function Layout({ children }: { children: React.ReactNode }) {
-  return (
-    <div
-      className={phantomSans.variable}
-      style={fallbackFontVariables}
-    >
-      {children}
-    </div>
-  );
-}
diff --git a/site/next.config.js b/site/next.config.js
deleted file mode 100644
index afbb70f..0000000
--- a/site/next.config.js
+++ /dev/null
@@ -1,13 +0,0 @@
-/** @type {import('next').NextConfig} */
-const nextConfig = {
-  headers() {
-    return [
-      {
-        source: "/.well-known/apple-app-site-association",
-        headers: [{ key: "Content-Type", value: "application/json" }],
-      }
-    ];
-  }
-};
-
-module.exports = nextConfig;
diff --git a/site/package-lock.json b/site/package-lock.json
deleted file mode 100644
index e1357f9..0000000
--- a/site/package-lock.json
+++ /dev/null
@@ -1,3907 +0,0 @@
-{
-  "name": "burrow",
-  "version": "0.1.0",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "burrow",
-      "version": "0.1.0",
-      "dependencies": {
-        "@fortawesome/fontawesome-free": "^6.4.2",
-        "@fortawesome/fontawesome-svg-core": "^6.4.2",
-        "@fortawesome/free-brands-svg-icons": "^6.4.2",
-        "@fortawesome/free-solid-svg-icons": "^6.4.2",
-        "@fortawesome/react-fontawesome": "^0.2.0",
-        "@headlessui/react": "^1.7.17",
-        "@headlessui/tailwindcss": "^0.2.0",
-        "@types/node": "20.5.8",
-        "@types/react": "18.2.21",
-        "@types/react-dom": "18.2.7",
-        "autoprefixer": "10.4.15",
-        "eslint": "8.48.0",
-        "eslint-config-next": "13.4.19",
-        "next": "13.4.19",
-        "postcss": "8.4.29",
-        "react": "18.2.0",
-        "react-dom": "18.2.0",
-        "tailwindcss": "3.3.3",
-        "typescript": "5.2.2"
-      },
-      "devDependencies": {
-        "prettier": "^3.0.3",
-        "prettier-plugin-tailwindcss": "^0.5.4"
-      }
-    },
-    "node_modules/@aashutoshrathi/word-wrap": {
-      "version": "1.2.6",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/@alloc/quick-lru": {
-      "version": "5.2.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@babel/runtime": {
-      "version": "7.22.11",
-      "license": "MIT",
-      "dependencies": {
-        "regenerator-runtime": "^0.14.0"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@eslint-community/eslint-utils": {
-      "version": "4.4.0",
-      "license": "MIT",
-      "dependencies": {
-        "eslint-visitor-keys": "^3.3.0"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "peerDependencies": {
-        "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0"
-      }
-    },
-    "node_modules/@eslint-community/regexpp": {
-      "version": "4.8.0",
-      "license": "MIT",
-      "engines": {
-        "node": "^12.0.0 || ^14.0.0 || >=16.0.0"
-      }
-    },
-    "node_modules/@eslint/eslintrc": {
-      "version": "2.1.2",
-      "license": "MIT",
-      "dependencies": {
-        "ajv": "^6.12.4",
-        "debug": "^4.3.2",
-        "espree": "^9.6.0",
-        "globals": "^13.19.0",
-        "ignore": "^5.2.0",
-        "import-fresh": "^3.2.1",
-        "js-yaml": "^4.1.0",
-        "minimatch": "^3.1.2",
-        "strip-json-comments": "^3.1.1"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
-      }
-    },
-    "node_modules/@eslint/js": {
-      "version": "8.48.0",
-      "license": "MIT",
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      }
-    },
-    "node_modules/@fortawesome/fontawesome-common-types": {
-      "version": "6.5.1",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/@fortawesome/fontawesome-free": {
-      "version": "6.5.1",
-      "hasInstallScript": true,
-      "license": "(CC-BY-4.0 AND OFL-1.1 AND MIT)",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/@fortawesome/fontawesome-svg-core": {
-      "version": "6.7.2",
-      "resolved": "https://registry.npmjs.org/@fortawesome/fontawesome-svg-core/-/fontawesome-svg-core-6.7.2.tgz",
-      "integrity": "sha512-yxtOBWDrdi5DD5o1pmVdq3WMCvnobT0LU6R8RyyVXPvFRd2o79/0NCuQoCjNTeZz9EzA9xS3JxNWfv54RIHFEA==",
-      "license": "MIT",
-      "dependencies": {
-        "@fortawesome/fontawesome-common-types": "6.7.2"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/@fortawesome/fontawesome-svg-core/node_modules/@fortawesome/fontawesome-common-types": {
-      "version": "6.7.2",
-      "resolved": "https://registry.npmjs.org/@fortawesome/fontawesome-common-types/-/fontawesome-common-types-6.7.2.tgz",
-      "integrity": "sha512-Zs+YeHUC5fkt7Mg1l6XTniei3k4bwG/yo3iFUtZWd/pMx9g3fdvkSK9E0FOC+++phXOka78uJcYb8JaFkW52Xg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/@fortawesome/free-brands-svg-icons": {
-      "version": "6.5.1",
-      "hasInstallScript": true,
-      "license": "(CC-BY-4.0 AND MIT)",
-      "dependencies": {
-        "@fortawesome/fontawesome-common-types": "6.5.1"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/@fortawesome/free-solid-svg-icons": {
-      "version": "6.5.1",
-      "hasInstallScript": true,
-      "license": "(CC-BY-4.0 AND MIT)",
-      "dependencies": {
-        "@fortawesome/fontawesome-common-types": "6.5.1"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/@fortawesome/react-fontawesome": {
-      "version": "0.2.0",
-      "license": "MIT",
-      "dependencies": {
-        "prop-types": "^15.8.1"
-      },
-      "peerDependencies": {
-        "@fortawesome/fontawesome-svg-core": "~1 || ~6",
-        "react": ">=16.3"
-      }
-    },
-    "node_modules/@headlessui/react": {
-      "version": "1.7.18",
-      "license": "MIT",
-      "dependencies": {
-        "@tanstack/react-virtual": "^3.0.0-beta.60",
-        "client-only": "^0.0.1"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "peerDependencies": {
-        "react": "^16 || ^17 || ^18",
-        "react-dom": "^16 || ^17 || ^18"
-      }
-    },
-    "node_modules/@headlessui/tailwindcss": {
-      "version": "0.2.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      },
-      "peerDependencies": {
-        "tailwindcss": "^3.0"
-      }
-    },
-    "node_modules/@humanwhocodes/config-array": {
-      "version": "0.11.11",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@humanwhocodes/object-schema": "^1.2.1",
-        "debug": "^4.1.1",
-        "minimatch": "^3.0.5"
-      },
-      "engines": {
-        "node": ">=10.10.0"
-      }
-    },
-    "node_modules/@humanwhocodes/module-importer": {
-      "version": "1.0.1",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=12.22"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/nzakas"
-      }
-    },
-    "node_modules/@humanwhocodes/object-schema": {
-      "version": "1.2.1",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@jridgewell/gen-mapping": {
-      "version": "0.3.3",
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/set-array": "^1.0.1",
-        "@jridgewell/sourcemap-codec": "^1.4.10",
-        "@jridgewell/trace-mapping": "^0.3.9"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@jridgewell/resolve-uri": {
-      "version": "3.1.1",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@jridgewell/set-array": {
-      "version": "1.1.2",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@jridgewell/sourcemap-codec": {
-      "version": "1.4.15",
-      "license": "MIT"
-    },
-    "node_modules/@jridgewell/trace-mapping": {
-      "version": "0.3.19",
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/resolve-uri": "^3.1.0",
-        "@jridgewell/sourcemap-codec": "^1.4.14"
-      }
-    },
-    "node_modules/@next/env": {
-      "version": "13.4.19",
-      "license": "MIT"
-    },
-    "node_modules/@next/eslint-plugin-next": {
-      "version": "13.4.19",
-      "license": "MIT",
-      "dependencies": {
-        "glob": "7.1.7"
-      }
-    },
-    "node_modules/@next/swc-darwin-arm64": {
-      "version": "13.4.19",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@next/swc-darwin-x64": {
-      "version": "13.4.19",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-13.4.19.tgz",
-      "integrity": "sha512-jyzO6wwYhx6F+7gD8ddZfuqO4TtpJdw3wyOduR4fxTUCm3aLw7YmHGYNjS0xRSYGAkLpBkH1E0RcelyId6lNsw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@next/swc-linux-arm64-gnu": {
-      "version": "13.4.19",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-13.4.19.tgz",
-      "integrity": "sha512-vdlnIlaAEh6H+G6HrKZB9c2zJKnpPVKnA6LBwjwT2BTjxI7e0Hx30+FoWCgi50e+YO49p6oPOtesP9mXDRiiUg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@next/swc-linux-arm64-musl": {
-      "version": "13.4.19",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-13.4.19.tgz",
-      "integrity": "sha512-aU0HkH2XPgxqrbNRBFb3si9Ahu/CpaR5RPmN2s9GiM9qJCiBBlZtRTiEca+DC+xRPyCThTtWYgxjWHgU7ZkyvA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@next/swc-linux-x64-gnu": {
-      "version": "13.4.19",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-13.4.19.tgz",
-      "integrity": "sha512-htwOEagMa/CXNykFFeAHHvMJeqZfNQEoQvHfsA4wgg5QqGNqD5soeCer4oGlCol6NGUxknrQO6VEustcv+Md+g==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@next/swc-linux-x64-musl": {
-      "version": "13.4.19",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-13.4.19.tgz",
-      "integrity": "sha512-4Gj4vvtbK1JH8ApWTT214b3GwUh9EKKQjY41hH/t+u55Knxi/0wesMzwQRhppK6Ddalhu0TEttbiJ+wRcoEj5Q==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@next/swc-win32-arm64-msvc": {
-      "version": "13.4.19",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-13.4.19.tgz",
-      "integrity": "sha512-bUfDevQK4NsIAHXs3/JNgnvEY+LRyneDN788W2NYiRIIzmILjba7LaQTfihuFawZDhRtkYCv3JDC3B4TwnmRJw==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@next/swc-win32-ia32-msvc": {
-      "version": "13.4.19",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-ia32-msvc/-/swc-win32-ia32-msvc-13.4.19.tgz",
-      "integrity": "sha512-Y5kikILFAr81LYIFaw6j/NrOtmiM4Sf3GtOc0pn50ez2GCkr+oejYuKGcwAwq3jiTKuzF6OF4iT2INPoxRycEA==",
-      "cpu": [
-        "ia32"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@next/swc-win32-x64-msvc": {
-      "version": "13.4.19",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-13.4.19.tgz",
-      "integrity": "sha512-YzA78jBDXMYiINdPdJJwGgPNT3YqBNNGhsthsDoWHL9p24tEJn9ViQf/ZqTbwSpX/RrkPupLfuuTH2sf73JBAw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@nodelib/fs.scandir": {
-      "version": "2.1.5",
-      "license": "MIT",
-      "dependencies": {
-        "@nodelib/fs.stat": "2.0.5",
-        "run-parallel": "^1.1.9"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/@nodelib/fs.stat": {
-      "version": "2.0.5",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/@nodelib/fs.walk": {
-      "version": "1.2.8",
-      "license": "MIT",
-      "dependencies": {
-        "@nodelib/fs.scandir": "2.1.5",
-        "fastq": "^1.6.0"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/@rushstack/eslint-patch": {
-      "version": "1.3.3",
-      "license": "MIT"
-    },
-    "node_modules/@swc/helpers": {
-      "version": "0.5.1",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@tanstack/react-virtual": {
-      "version": "3.2.0",
-      "license": "MIT",
-      "dependencies": {
-        "@tanstack/virtual-core": "3.2.0"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/tannerlinsley"
-      },
-      "peerDependencies": {
-        "react": "^16.8.0 || ^17.0.0 || ^18.0.0",
-        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0"
-      }
-    },
-    "node_modules/@tanstack/virtual-core": {
-      "version": "3.2.0",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/tannerlinsley"
-      }
-    },
-    "node_modules/@types/json5": {
-      "version": "0.0.29",
-      "license": "MIT"
-    },
-    "node_modules/@types/node": {
-      "version": "20.5.8",
-      "license": "MIT"
-    },
-    "node_modules/@types/prop-types": {
-      "version": "15.7.5",
-      "license": "MIT"
-    },
-    "node_modules/@types/react": {
-      "version": "18.2.21",
-      "license": "MIT",
-      "dependencies": {
-        "@types/prop-types": "*",
-        "@types/scheduler": "*",
-        "csstype": "^3.0.2"
-      }
-    },
-    "node_modules/@types/react-dom": {
-      "version": "18.2.7",
-      "license": "MIT",
-      "dependencies": {
-        "@types/react": "*"
-      }
-    },
-    "node_modules/@types/scheduler": {
-      "version": "0.16.3",
-      "license": "MIT"
-    },
-    "node_modules/@typescript-eslint/parser": {
-      "version": "6.5.0",
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "@typescript-eslint/scope-manager": "6.5.0",
-        "@typescript-eslint/types": "6.5.0",
-        "@typescript-eslint/typescript-estree": "6.5.0",
-        "@typescript-eslint/visitor-keys": "6.5.0",
-        "debug": "^4.3.4"
-      },
-      "engines": {
-        "node": "^16.0.0 || >=18.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "eslint": "^7.0.0 || ^8.0.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@typescript-eslint/scope-manager": {
-      "version": "6.5.0",
-      "license": "MIT",
-      "dependencies": {
-        "@typescript-eslint/types": "6.5.0",
-        "@typescript-eslint/visitor-keys": "6.5.0"
-      },
-      "engines": {
-        "node": "^16.0.0 || >=18.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      }
-    },
-    "node_modules/@typescript-eslint/types": {
-      "version": "6.5.0",
-      "license": "MIT",
-      "engines": {
-        "node": "^16.0.0 || >=18.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      }
-    },
-    "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "6.5.0",
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "@typescript-eslint/types": "6.5.0",
-        "@typescript-eslint/visitor-keys": "6.5.0",
-        "debug": "^4.3.4",
-        "globby": "^11.1.0",
-        "is-glob": "^4.0.3",
-        "semver": "^7.5.4",
-        "ts-api-utils": "^1.0.1"
-      },
-      "engines": {
-        "node": "^16.0.0 || >=18.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@typescript-eslint/typescript-estree/node_modules/semver": {
-      "version": "7.5.4",
-      "license": "ISC",
-      "dependencies": {
-        "lru-cache": "^6.0.0"
-      },
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "6.5.0",
-      "license": "MIT",
-      "dependencies": {
-        "@typescript-eslint/types": "6.5.0",
-        "eslint-visitor-keys": "^3.4.1"
-      },
-      "engines": {
-        "node": "^16.0.0 || >=18.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      }
-    },
-    "node_modules/acorn": {
-      "version": "8.10.0",
-      "license": "MIT",
-      "peer": true,
-      "bin": {
-        "acorn": "bin/acorn"
-      },
-      "engines": {
-        "node": ">=0.4.0"
-      }
-    },
-    "node_modules/acorn-jsx": {
-      "version": "5.3.2",
-      "license": "MIT",
-      "peerDependencies": {
-        "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
-      }
-    },
-    "node_modules/ajv": {
-      "version": "6.12.6",
-      "license": "MIT",
-      "dependencies": {
-        "fast-deep-equal": "^3.1.1",
-        "fast-json-stable-stringify": "^2.0.0",
-        "json-schema-traverse": "^0.4.1",
-        "uri-js": "^4.2.2"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
-      }
-    },
-    "node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "license": "MIT",
-      "dependencies": {
-        "color-convert": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/any-promise": {
-      "version": "1.3.0",
-      "license": "MIT"
-    },
-    "node_modules/anymatch": {
-      "version": "3.1.3",
-      "license": "ISC",
-      "dependencies": {
-        "normalize-path": "^3.0.0",
-        "picomatch": "^2.0.4"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/arg": {
-      "version": "5.0.2",
-      "license": "MIT"
-    },
-    "node_modules/argparse": {
-      "version": "2.0.1",
-      "license": "Python-2.0"
-    },
-    "node_modules/aria-query": {
-      "version": "5.3.0",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "dequal": "^2.0.3"
-      }
-    },
-    "node_modules/array-buffer-byte-length": {
-      "version": "1.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "is-array-buffer": "^3.0.1"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/array-includes": {
-      "version": "3.1.6",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
-        "get-intrinsic": "^1.1.3",
-        "is-string": "^1.0.7"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/array-union": {
-      "version": "2.1.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/array.prototype.findlastindex": {
-      "version": "1.2.3",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.2.0",
-        "es-abstract": "^1.22.1",
-        "es-shim-unscopables": "^1.0.0",
-        "get-intrinsic": "^1.2.1"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/array.prototype.flat": {
-      "version": "1.3.1",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
-        "es-shim-unscopables": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/array.prototype.flatmap": {
-      "version": "1.3.1",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
-        "es-shim-unscopables": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/array.prototype.tosorted": {
-      "version": "1.1.1",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
-        "es-shim-unscopables": "^1.0.0",
-        "get-intrinsic": "^1.1.3"
-      }
-    },
-    "node_modules/arraybuffer.prototype.slice": {
-      "version": "1.0.1",
-      "license": "MIT",
-      "dependencies": {
-        "array-buffer-byte-length": "^1.0.0",
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.2.0",
-        "get-intrinsic": "^1.2.1",
-        "is-array-buffer": "^3.0.2",
-        "is-shared-array-buffer": "^1.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/ast-types-flow": {
-      "version": "0.0.7",
-      "license": "ISC"
-    },
-    "node_modules/asynciterator.prototype": {
-      "version": "1.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "has-symbols": "^1.0.3"
-      }
-    },
-    "node_modules/autoprefixer": {
-      "version": "10.4.15",
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/postcss/"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/autoprefixer"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "browserslist": "^4.21.10",
-        "caniuse-lite": "^1.0.30001520",
-        "fraction.js": "^4.2.0",
-        "normalize-range": "^0.1.2",
-        "picocolors": "^1.0.0",
-        "postcss-value-parser": "^4.2.0"
-      },
-      "bin": {
-        "autoprefixer": "bin/autoprefixer"
-      },
-      "engines": {
-        "node": "^10 || ^12 || >=14"
-      },
-      "peerDependencies": {
-        "postcss": "^8.1.0"
-      }
-    },
-    "node_modules/available-typed-arrays": {
-      "version": "1.0.5",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/axe-core": {
-      "version": "4.7.2",
-      "license": "MPL-2.0",
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/axobject-query": {
-      "version": "3.2.1",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "dequal": "^2.0.3"
-      }
-    },
-    "node_modules/balanced-match": {
-      "version": "1.0.2",
-      "license": "MIT"
-    },
-    "node_modules/binary-extensions": {
-      "version": "2.2.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/brace-expansion": {
-      "version": "1.1.11",
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
-      }
-    },
-    "node_modules/braces": {
-      "version": "3.0.2",
-      "license": "MIT",
-      "dependencies": {
-        "fill-range": "^7.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/browserslist": {
-      "version": "4.21.10",
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/browserslist"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/browserslist"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "caniuse-lite": "^1.0.30001517",
-        "electron-to-chromium": "^1.4.477",
-        "node-releases": "^2.0.13",
-        "update-browserslist-db": "^1.0.11"
-      },
-      "bin": {
-        "browserslist": "cli.js"
-      },
-      "engines": {
-        "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
-      }
-    },
-    "node_modules/busboy": {
-      "version": "1.6.0",
-      "dependencies": {
-        "streamsearch": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=10.16.0"
-      }
-    },
-    "node_modules/call-bind": {
-      "version": "1.0.2",
-      "license": "MIT",
-      "dependencies": {
-        "function-bind": "^1.1.1",
-        "get-intrinsic": "^1.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/callsites": {
-      "version": "3.1.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/camelcase-css": {
-      "version": "2.0.1",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/caniuse-lite": {
-      "version": "1.0.30001525",
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/browserslist"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/caniuse-lite"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "CC-BY-4.0"
-    },
-    "node_modules/chalk": {
-      "version": "4.1.2",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
-      }
-    },
-    "node_modules/chokidar": {
-      "version": "3.5.3",
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://paulmillr.com/funding/"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "anymatch": "~3.1.2",
-        "braces": "~3.0.2",
-        "glob-parent": "~5.1.2",
-        "is-binary-path": "~2.1.0",
-        "is-glob": "~4.0.1",
-        "normalize-path": "~3.0.0",
-        "readdirp": "~3.6.0"
-      },
-      "engines": {
-        "node": ">= 8.10.0"
-      },
-      "optionalDependencies": {
-        "fsevents": "~2.3.2"
-      }
-    },
-    "node_modules/chokidar/node_modules/glob-parent": {
-      "version": "5.1.2",
-      "license": "ISC",
-      "dependencies": {
-        "is-glob": "^4.0.1"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/client-only": {
-      "version": "0.0.1",
-      "license": "MIT"
-    },
-    "node_modules/color-convert": {
-      "version": "2.0.1",
-      "license": "MIT",
-      "dependencies": {
-        "color-name": "~1.1.4"
-      },
-      "engines": {
-        "node": ">=7.0.0"
-      }
-    },
-    "node_modules/color-name": {
-      "version": "1.1.4",
-      "license": "MIT"
-    },
-    "node_modules/commander": {
-      "version": "4.1.1",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/concat-map": {
-      "version": "0.0.1",
-      "license": "MIT"
-    },
-    "node_modules/cross-spawn": {
-      "version": "7.0.3",
-      "license": "MIT",
-      "dependencies": {
-        "path-key": "^3.1.0",
-        "shebang-command": "^2.0.0",
-        "which": "^2.0.1"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/cssesc": {
-      "version": "3.0.0",
-      "license": "MIT",
-      "bin": {
-        "cssesc": "bin/cssesc"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/csstype": {
-      "version": "3.1.2",
-      "license": "MIT"
-    },
-    "node_modules/damerau-levenshtein": {
-      "version": "1.0.8",
-      "license": "BSD-2-Clause"
-    },
-    "node_modules/debug": {
-      "version": "4.3.4",
-      "license": "MIT",
-      "dependencies": {
-        "ms": "2.1.2"
-      },
-      "engines": {
-        "node": ">=6.0"
-      },
-      "peerDependenciesMeta": {
-        "supports-color": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/deep-is": {
-      "version": "0.1.4",
-      "license": "MIT"
-    },
-    "node_modules/define-properties": {
-      "version": "1.2.0",
-      "license": "MIT",
-      "dependencies": {
-        "has-property-descriptors": "^1.0.0",
-        "object-keys": "^1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/dequal": {
-      "version": "2.0.3",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/didyoumean": {
-      "version": "1.2.2",
-      "license": "Apache-2.0"
-    },
-    "node_modules/dir-glob": {
-      "version": "3.0.1",
-      "license": "MIT",
-      "dependencies": {
-        "path-type": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/dlv": {
-      "version": "1.1.3",
-      "license": "MIT"
-    },
-    "node_modules/doctrine": {
-      "version": "3.0.0",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "esutils": "^2.0.2"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/electron-to-chromium": {
-      "version": "1.4.508",
-      "license": "ISC"
-    },
-    "node_modules/emoji-regex": {
-      "version": "9.2.2",
-      "license": "MIT"
-    },
-    "node_modules/enhanced-resolve": {
-      "version": "5.15.0",
-      "license": "MIT",
-      "dependencies": {
-        "graceful-fs": "^4.2.4",
-        "tapable": "^2.2.0"
-      },
-      "engines": {
-        "node": ">=10.13.0"
-      }
-    },
-    "node_modules/es-abstract": {
-      "version": "1.22.1",
-      "license": "MIT",
-      "dependencies": {
-        "array-buffer-byte-length": "^1.0.0",
-        "arraybuffer.prototype.slice": "^1.0.1",
-        "available-typed-arrays": "^1.0.5",
-        "call-bind": "^1.0.2",
-        "es-set-tostringtag": "^2.0.1",
-        "es-to-primitive": "^1.2.1",
-        "function.prototype.name": "^1.1.5",
-        "get-intrinsic": "^1.2.1",
-        "get-symbol-description": "^1.0.0",
-        "globalthis": "^1.0.3",
-        "gopd": "^1.0.1",
-        "has": "^1.0.3",
-        "has-property-descriptors": "^1.0.0",
-        "has-proto": "^1.0.1",
-        "has-symbols": "^1.0.3",
-        "internal-slot": "^1.0.5",
-        "is-array-buffer": "^3.0.2",
-        "is-callable": "^1.2.7",
-        "is-negative-zero": "^2.0.2",
-        "is-regex": "^1.1.4",
-        "is-shared-array-buffer": "^1.0.2",
-        "is-string": "^1.0.7",
-        "is-typed-array": "^1.1.10",
-        "is-weakref": "^1.0.2",
-        "object-inspect": "^1.12.3",
-        "object-keys": "^1.1.1",
-        "object.assign": "^4.1.4",
-        "regexp.prototype.flags": "^1.5.0",
-        "safe-array-concat": "^1.0.0",
-        "safe-regex-test": "^1.0.0",
-        "string.prototype.trim": "^1.2.7",
-        "string.prototype.trimend": "^1.0.6",
-        "string.prototype.trimstart": "^1.0.6",
-        "typed-array-buffer": "^1.0.0",
-        "typed-array-byte-length": "^1.0.0",
-        "typed-array-byte-offset": "^1.0.0",
-        "typed-array-length": "^1.0.4",
-        "unbox-primitive": "^1.0.2",
-        "which-typed-array": "^1.1.10"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/es-iterator-helpers": {
-      "version": "1.0.14",
-      "license": "MIT",
-      "dependencies": {
-        "asynciterator.prototype": "^1.0.0",
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.2.0",
-        "es-abstract": "^1.22.1",
-        "es-set-tostringtag": "^2.0.1",
-        "function-bind": "^1.1.1",
-        "get-intrinsic": "^1.2.1",
-        "globalthis": "^1.0.3",
-        "has-property-descriptors": "^1.0.0",
-        "has-proto": "^1.0.1",
-        "has-symbols": "^1.0.3",
-        "internal-slot": "^1.0.5",
-        "iterator.prototype": "^1.1.0",
-        "safe-array-concat": "^1.0.0"
-      }
-    },
-    "node_modules/es-set-tostringtag": {
-      "version": "2.0.1",
-      "license": "MIT",
-      "dependencies": {
-        "get-intrinsic": "^1.1.3",
-        "has": "^1.0.3",
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/es-shim-unscopables": {
-      "version": "1.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "has": "^1.0.3"
-      }
-    },
-    "node_modules/es-to-primitive": {
-      "version": "1.2.1",
-      "license": "MIT",
-      "dependencies": {
-        "is-callable": "^1.1.4",
-        "is-date-object": "^1.0.1",
-        "is-symbol": "^1.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/escalade": {
-      "version": "3.1.1",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/escape-string-regexp": {
-      "version": "4.0.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/eslint": {
-      "version": "8.48.0",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@eslint-community/eslint-utils": "^4.2.0",
-        "@eslint-community/regexpp": "^4.6.1",
-        "@eslint/eslintrc": "^2.1.2",
-        "@eslint/js": "8.48.0",
-        "@humanwhocodes/config-array": "^0.11.10",
-        "@humanwhocodes/module-importer": "^1.0.1",
-        "@nodelib/fs.walk": "^1.2.8",
-        "ajv": "^6.12.4",
-        "chalk": "^4.0.0",
-        "cross-spawn": "^7.0.2",
-        "debug": "^4.3.2",
-        "doctrine": "^3.0.0",
-        "escape-string-regexp": "^4.0.0",
-        "eslint-scope": "^7.2.2",
-        "eslint-visitor-keys": "^3.4.3",
-        "espree": "^9.6.1",
-        "esquery": "^1.4.2",
-        "esutils": "^2.0.2",
-        "fast-deep-equal": "^3.1.3",
-        "file-entry-cache": "^6.0.1",
-        "find-up": "^5.0.0",
-        "glob-parent": "^6.0.2",
-        "globals": "^13.19.0",
-        "graphemer": "^1.4.0",
-        "ignore": "^5.2.0",
-        "imurmurhash": "^0.1.4",
-        "is-glob": "^4.0.0",
-        "is-path-inside": "^3.0.3",
-        "js-yaml": "^4.1.0",
-        "json-stable-stringify-without-jsonify": "^1.0.1",
-        "levn": "^0.4.1",
-        "lodash.merge": "^4.6.2",
-        "minimatch": "^3.1.2",
-        "natural-compare": "^1.4.0",
-        "optionator": "^0.9.3",
-        "strip-ansi": "^6.0.1",
-        "text-table": "^0.2.0"
-      },
-      "bin": {
-        "eslint": "bin/eslint.js"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
-      }
-    },
-    "node_modules/eslint-config-next": {
-      "version": "13.4.19",
-      "license": "MIT",
-      "dependencies": {
-        "@next/eslint-plugin-next": "13.4.19",
-        "@rushstack/eslint-patch": "^1.1.3",
-        "@typescript-eslint/parser": "^5.4.2 || ^6.0.0",
-        "eslint-import-resolver-node": "^0.3.6",
-        "eslint-import-resolver-typescript": "^3.5.2",
-        "eslint-plugin-import": "^2.26.0",
-        "eslint-plugin-jsx-a11y": "^6.5.1",
-        "eslint-plugin-react": "^7.31.7",
-        "eslint-plugin-react-hooks": "^4.5.0 || 5.0.0-canary-7118f5dd7-20230705"
-      },
-      "peerDependencies": {
-        "eslint": "^7.23.0 || ^8.0.0",
-        "typescript": ">=3.3.1"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/eslint-import-resolver-node": {
-      "version": "0.3.9",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^3.2.7",
-        "is-core-module": "^2.13.0",
-        "resolve": "^1.22.4"
-      }
-    },
-    "node_modules/eslint-import-resolver-node/node_modules/debug": {
-      "version": "3.2.7",
-      "license": "MIT",
-      "dependencies": {
-        "ms": "^2.1.1"
-      }
-    },
-    "node_modules/eslint-import-resolver-typescript": {
-      "version": "3.6.0",
-      "license": "ISC",
-      "dependencies": {
-        "debug": "^4.3.4",
-        "enhanced-resolve": "^5.12.0",
-        "eslint-module-utils": "^2.7.4",
-        "fast-glob": "^3.3.1",
-        "get-tsconfig": "^4.5.0",
-        "is-core-module": "^2.11.0",
-        "is-glob": "^4.0.3"
-      },
-      "engines": {
-        "node": "^14.18.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/unts/projects/eslint-import-resolver-ts"
-      },
-      "peerDependencies": {
-        "eslint": "*",
-        "eslint-plugin-import": "*"
-      }
-    },
-    "node_modules/eslint-module-utils": {
-      "version": "2.8.0",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^3.2.7"
-      },
-      "engines": {
-        "node": ">=4"
-      },
-      "peerDependenciesMeta": {
-        "eslint": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/eslint-module-utils/node_modules/debug": {
-      "version": "3.2.7",
-      "license": "MIT",
-      "dependencies": {
-        "ms": "^2.1.1"
-      }
-    },
-    "node_modules/eslint-plugin-import": {
-      "version": "2.28.1",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "array-includes": "^3.1.6",
-        "array.prototype.findlastindex": "^1.2.2",
-        "array.prototype.flat": "^1.3.1",
-        "array.prototype.flatmap": "^1.3.1",
-        "debug": "^3.2.7",
-        "doctrine": "^2.1.0",
-        "eslint-import-resolver-node": "^0.3.7",
-        "eslint-module-utils": "^2.8.0",
-        "has": "^1.0.3",
-        "is-core-module": "^2.13.0",
-        "is-glob": "^4.0.3",
-        "minimatch": "^3.1.2",
-        "object.fromentries": "^2.0.6",
-        "object.groupby": "^1.0.0",
-        "object.values": "^1.1.6",
-        "semver": "^6.3.1",
-        "tsconfig-paths": "^3.14.2"
-      },
-      "engines": {
-        "node": ">=4"
-      },
-      "peerDependencies": {
-        "eslint": "^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8"
-      }
-    },
-    "node_modules/eslint-plugin-import/node_modules/debug": {
-      "version": "3.2.7",
-      "license": "MIT",
-      "dependencies": {
-        "ms": "^2.1.1"
-      }
-    },
-    "node_modules/eslint-plugin-import/node_modules/doctrine": {
-      "version": "2.1.0",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "esutils": "^2.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/eslint-plugin-jsx-a11y": {
-      "version": "6.7.1",
-      "license": "MIT",
-      "dependencies": {
-        "@babel/runtime": "^7.20.7",
-        "aria-query": "^5.1.3",
-        "array-includes": "^3.1.6",
-        "array.prototype.flatmap": "^1.3.1",
-        "ast-types-flow": "^0.0.7",
-        "axe-core": "^4.6.2",
-        "axobject-query": "^3.1.1",
-        "damerau-levenshtein": "^1.0.8",
-        "emoji-regex": "^9.2.2",
-        "has": "^1.0.3",
-        "jsx-ast-utils": "^3.3.3",
-        "language-tags": "=1.0.5",
-        "minimatch": "^3.1.2",
-        "object.entries": "^1.1.6",
-        "object.fromentries": "^2.0.6",
-        "semver": "^6.3.0"
-      },
-      "engines": {
-        "node": ">=4.0"
-      },
-      "peerDependencies": {
-        "eslint": "^3 || ^4 || ^5 || ^6 || ^7 || ^8"
-      }
-    },
-    "node_modules/eslint-plugin-jsx-a11y/node_modules/semver": {
-      "version": "6.3.1",
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
-    "node_modules/eslint-plugin-react": {
-      "version": "7.33.2",
-      "license": "MIT",
-      "dependencies": {
-        "array-includes": "^3.1.6",
-        "array.prototype.flatmap": "^1.3.1",
-        "array.prototype.tosorted": "^1.1.1",
-        "doctrine": "^2.1.0",
-        "es-iterator-helpers": "^1.0.12",
-        "estraverse": "^5.3.0",
-        "jsx-ast-utils": "^2.4.1 || ^3.0.0",
-        "minimatch": "^3.1.2",
-        "object.entries": "^1.1.6",
-        "object.fromentries": "^2.0.6",
-        "object.hasown": "^1.1.2",
-        "object.values": "^1.1.6",
-        "prop-types": "^15.8.1",
-        "resolve": "^2.0.0-next.4",
-        "semver": "^6.3.1",
-        "string.prototype.matchall": "^4.0.8"
-      },
-      "engines": {
-        "node": ">=4"
-      },
-      "peerDependencies": {
-        "eslint": "^3 || ^4 || ^5 || ^6 || ^7 || ^8"
-      }
-    },
-    "node_modules/eslint-plugin-react-hooks": {
-      "version": "4.6.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      },
-      "peerDependencies": {
-        "eslint": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0"
-      }
-    },
-    "node_modules/eslint-plugin-react/node_modules/doctrine": {
-      "version": "2.1.0",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "esutils": "^2.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/eslint-plugin-react/node_modules/resolve": {
-      "version": "2.0.0-next.4",
-      "license": "MIT",
-      "dependencies": {
-        "is-core-module": "^2.9.0",
-        "path-parse": "^1.0.7",
-        "supports-preserve-symlinks-flag": "^1.0.0"
-      },
-      "bin": {
-        "resolve": "bin/resolve"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/eslint-plugin-react/node_modules/semver": {
-      "version": "6.3.1",
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
-    "node_modules/eslint-scope": {
-      "version": "7.2.2",
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "esrecurse": "^4.3.0",
-        "estraverse": "^5.2.0"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
-      }
-    },
-    "node_modules/eslint-visitor-keys": {
-      "version": "3.4.3",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
-      }
-    },
-    "node_modules/espree": {
-      "version": "9.6.1",
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "acorn": "^8.9.0",
-        "acorn-jsx": "^5.3.2",
-        "eslint-visitor-keys": "^3.4.1"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
-      }
-    },
-    "node_modules/esquery": {
-      "version": "1.5.0",
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "estraverse": "^5.1.0"
-      },
-      "engines": {
-        "node": ">=0.10"
-      }
-    },
-    "node_modules/esrecurse": {
-      "version": "4.3.0",
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "estraverse": "^5.2.0"
-      },
-      "engines": {
-        "node": ">=4.0"
-      }
-    },
-    "node_modules/estraverse": {
-      "version": "5.3.0",
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=4.0"
-      }
-    },
-    "node_modules/esutils": {
-      "version": "2.0.3",
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/fast-deep-equal": {
-      "version": "3.1.3",
-      "license": "MIT"
-    },
-    "node_modules/fast-glob": {
-      "version": "3.3.1",
-      "license": "MIT",
-      "dependencies": {
-        "@nodelib/fs.stat": "^2.0.2",
-        "@nodelib/fs.walk": "^1.2.3",
-        "glob-parent": "^5.1.2",
-        "merge2": "^1.3.0",
-        "micromatch": "^4.0.4"
-      },
-      "engines": {
-        "node": ">=8.6.0"
-      }
-    },
-    "node_modules/fast-glob/node_modules/glob-parent": {
-      "version": "5.1.2",
-      "license": "ISC",
-      "dependencies": {
-        "is-glob": "^4.0.1"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/fast-json-stable-stringify": {
-      "version": "2.1.0",
-      "license": "MIT"
-    },
-    "node_modules/fast-levenshtein": {
-      "version": "2.0.6",
-      "license": "MIT"
-    },
-    "node_modules/fastq": {
-      "version": "1.15.0",
-      "license": "ISC",
-      "dependencies": {
-        "reusify": "^1.0.4"
-      }
-    },
-    "node_modules/file-entry-cache": {
-      "version": "6.0.1",
-      "license": "MIT",
-      "dependencies": {
-        "flat-cache": "^3.0.4"
-      },
-      "engines": {
-        "node": "^10.12.0 || >=12.0.0"
-      }
-    },
-    "node_modules/fill-range": {
-      "version": "7.0.1",
-      "license": "MIT",
-      "dependencies": {
-        "to-regex-range": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/find-up": {
-      "version": "5.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "locate-path": "^6.0.0",
-        "path-exists": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/flat-cache": {
-      "version": "3.1.0",
-      "license": "MIT",
-      "dependencies": {
-        "flatted": "^3.2.7",
-        "keyv": "^4.5.3",
-        "rimraf": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=12.0.0"
-      }
-    },
-    "node_modules/flatted": {
-      "version": "3.2.7",
-      "license": "ISC"
-    },
-    "node_modules/for-each": {
-      "version": "0.3.3",
-      "license": "MIT",
-      "dependencies": {
-        "is-callable": "^1.1.3"
-      }
-    },
-    "node_modules/fraction.js": {
-      "version": "4.3.6",
-      "license": "MIT",
-      "engines": {
-        "node": "*"
-      },
-      "funding": {
-        "type": "patreon",
-        "url": "https://github.com/sponsors/rawify"
-      }
-    },
-    "node_modules/fs.realpath": {
-      "version": "1.0.0",
-      "license": "ISC"
-    },
-    "node_modules/fsevents": {
-      "version": "2.3.3",
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-      }
-    },
-    "node_modules/function-bind": {
-      "version": "1.1.1",
-      "license": "MIT"
-    },
-    "node_modules/function.prototype.name": {
-      "version": "1.1.6",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.2.0",
-        "es-abstract": "^1.22.1",
-        "functions-have-names": "^1.2.3"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/functions-have-names": {
-      "version": "1.2.3",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/get-intrinsic": {
-      "version": "1.2.1",
-      "license": "MIT",
-      "dependencies": {
-        "function-bind": "^1.1.1",
-        "has": "^1.0.3",
-        "has-proto": "^1.0.1",
-        "has-symbols": "^1.0.3"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/get-symbol-description": {
-      "version": "1.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/get-tsconfig": {
-      "version": "4.7.0",
-      "license": "MIT",
-      "dependencies": {
-        "resolve-pkg-maps": "^1.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
-      }
-    },
-    "node_modules/glob": {
-      "version": "7.1.7",
-      "license": "ISC",
-      "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.0.4",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      },
-      "engines": {
-        "node": "*"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/glob-parent": {
-      "version": "6.0.2",
-      "license": "ISC",
-      "dependencies": {
-        "is-glob": "^4.0.3"
-      },
-      "engines": {
-        "node": ">=10.13.0"
-      }
-    },
-    "node_modules/glob-to-regexp": {
-      "version": "0.4.1",
-      "license": "BSD-2-Clause"
-    },
-    "node_modules/globals": {
-      "version": "13.21.0",
-      "license": "MIT",
-      "dependencies": {
-        "type-fest": "^0.20.2"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/globalthis": {
-      "version": "1.0.3",
-      "license": "MIT",
-      "dependencies": {
-        "define-properties": "^1.1.3"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/globby": {
-      "version": "11.1.0",
-      "license": "MIT",
-      "dependencies": {
-        "array-union": "^2.1.0",
-        "dir-glob": "^3.0.1",
-        "fast-glob": "^3.2.9",
-        "ignore": "^5.2.0",
-        "merge2": "^1.4.1",
-        "slash": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/gopd": {
-      "version": "1.0.1",
-      "license": "MIT",
-      "dependencies": {
-        "get-intrinsic": "^1.1.3"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/graceful-fs": {
-      "version": "4.2.11",
-      "license": "ISC"
-    },
-    "node_modules/graphemer": {
-      "version": "1.4.0",
-      "license": "MIT"
-    },
-    "node_modules/has": {
-      "version": "1.0.3",
-      "license": "MIT",
-      "dependencies": {
-        "function-bind": "^1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.4.0"
-      }
-    },
-    "node_modules/has-bigints": {
-      "version": "1.0.2",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-flag": {
-      "version": "4.0.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/has-property-descriptors": {
-      "version": "1.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "get-intrinsic": "^1.1.1"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-proto": {
-      "version": "1.0.1",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-symbols": {
-      "version": "1.0.3",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-tostringtag": {
-      "version": "1.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "has-symbols": "^1.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/ignore": {
-      "version": "5.2.4",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 4"
-      }
-    },
-    "node_modules/import-fresh": {
-      "version": "3.3.0",
-      "license": "MIT",
-      "dependencies": {
-        "parent-module": "^1.0.0",
-        "resolve-from": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/imurmurhash": {
-      "version": "0.1.4",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.8.19"
-      }
-    },
-    "node_modules/inflight": {
-      "version": "1.0.6",
-      "license": "ISC",
-      "dependencies": {
-        "once": "^1.3.0",
-        "wrappy": "1"
-      }
-    },
-    "node_modules/inherits": {
-      "version": "2.0.4",
-      "license": "ISC"
-    },
-    "node_modules/internal-slot": {
-      "version": "1.0.5",
-      "license": "MIT",
-      "dependencies": {
-        "get-intrinsic": "^1.2.0",
-        "has": "^1.0.3",
-        "side-channel": "^1.0.4"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/is-array-buffer": {
-      "version": "3.0.2",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.2.0",
-        "is-typed-array": "^1.1.10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-async-function": {
-      "version": "2.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-bigint": {
-      "version": "1.0.4",
-      "license": "MIT",
-      "dependencies": {
-        "has-bigints": "^1.0.1"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-binary-path": {
-      "version": "2.1.0",
-      "license": "MIT",
-      "dependencies": {
-        "binary-extensions": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/is-boolean-object": {
-      "version": "1.1.2",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-callable": {
-      "version": "1.2.7",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-core-module": {
-      "version": "2.13.0",
-      "license": "MIT",
-      "dependencies": {
-        "has": "^1.0.3"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-date-object": {
-      "version": "1.0.5",
-      "license": "MIT",
-      "dependencies": {
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-extglob": {
-      "version": "2.1.1",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/is-finalizationregistry": {
-      "version": "1.0.2",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-generator-function": {
-      "version": "1.0.10",
-      "license": "MIT",
-      "dependencies": {
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-glob": {
-      "version": "4.0.3",
-      "license": "MIT",
-      "dependencies": {
-        "is-extglob": "^2.1.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/is-map": {
-      "version": "2.0.2",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-negative-zero": {
-      "version": "2.0.2",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-number": {
-      "version": "7.0.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.12.0"
-      }
-    },
-    "node_modules/is-number-object": {
-      "version": "1.0.7",
-      "license": "MIT",
-      "dependencies": {
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-path-inside": {
-      "version": "3.0.3",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/is-regex": {
-      "version": "1.1.4",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-set": {
-      "version": "2.0.2",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-shared-array-buffer": {
-      "version": "1.0.2",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-string": {
-      "version": "1.0.7",
-      "license": "MIT",
-      "dependencies": {
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-symbol": {
-      "version": "1.0.4",
-      "license": "MIT",
-      "dependencies": {
-        "has-symbols": "^1.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-typed-array": {
-      "version": "1.1.12",
-      "license": "MIT",
-      "dependencies": {
-        "which-typed-array": "^1.1.11"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-weakmap": {
-      "version": "2.0.1",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-weakref": {
-      "version": "1.0.2",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-weakset": {
-      "version": "2.0.2",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.1.1"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/isarray": {
-      "version": "2.0.5",
-      "license": "MIT"
-    },
-    "node_modules/isexe": {
-      "version": "2.0.0",
-      "license": "ISC"
-    },
-    "node_modules/iterator.prototype": {
-      "version": "1.1.1",
-      "license": "MIT",
-      "dependencies": {
-        "define-properties": "^1.2.0",
-        "get-intrinsic": "^1.2.1",
-        "has-symbols": "^1.0.3",
-        "reflect.getprototypeof": "^1.0.3"
-      }
-    },
-    "node_modules/jiti": {
-      "version": "1.19.3",
-      "license": "MIT",
-      "bin": {
-        "jiti": "bin/jiti.js"
-      }
-    },
-    "node_modules/js-tokens": {
-      "version": "4.0.0",
-      "license": "MIT"
-    },
-    "node_modules/js-yaml": {
-      "version": "4.1.0",
-      "license": "MIT",
-      "dependencies": {
-        "argparse": "^2.0.1"
-      },
-      "bin": {
-        "js-yaml": "bin/js-yaml.js"
-      }
-    },
-    "node_modules/json-buffer": {
-      "version": "3.0.1",
-      "license": "MIT"
-    },
-    "node_modules/json-schema-traverse": {
-      "version": "0.4.1",
-      "license": "MIT"
-    },
-    "node_modules/json-stable-stringify-without-jsonify": {
-      "version": "1.0.1",
-      "license": "MIT"
-    },
-    "node_modules/json5": {
-      "version": "1.0.2",
-      "license": "MIT",
-      "dependencies": {
-        "minimist": "^1.2.0"
-      },
-      "bin": {
-        "json5": "lib/cli.js"
-      }
-    },
-    "node_modules/jsx-ast-utils": {
-      "version": "3.3.5",
-      "license": "MIT",
-      "dependencies": {
-        "array-includes": "^3.1.6",
-        "array.prototype.flat": "^1.3.1",
-        "object.assign": "^4.1.4",
-        "object.values": "^1.1.6"
-      },
-      "engines": {
-        "node": ">=4.0"
-      }
-    },
-    "node_modules/keyv": {
-      "version": "4.5.3",
-      "license": "MIT",
-      "dependencies": {
-        "json-buffer": "3.0.1"
-      }
-    },
-    "node_modules/language-subtag-registry": {
-      "version": "0.3.22",
-      "license": "CC0-1.0"
-    },
-    "node_modules/language-tags": {
-      "version": "1.0.5",
-      "license": "MIT",
-      "dependencies": {
-        "language-subtag-registry": "~0.3.2"
-      }
-    },
-    "node_modules/levn": {
-      "version": "0.4.1",
-      "license": "MIT",
-      "dependencies": {
-        "prelude-ls": "^1.2.1",
-        "type-check": "~0.4.0"
-      },
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/lilconfig": {
-      "version": "2.1.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/lines-and-columns": {
-      "version": "1.2.4",
-      "license": "MIT"
-    },
-    "node_modules/locate-path": {
-      "version": "6.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "p-locate": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/lodash.merge": {
-      "version": "4.6.2",
-      "license": "MIT"
-    },
-    "node_modules/loose-envify": {
-      "version": "1.4.0",
-      "license": "MIT",
-      "dependencies": {
-        "js-tokens": "^3.0.0 || ^4.0.0"
-      },
-      "bin": {
-        "loose-envify": "cli.js"
-      }
-    },
-    "node_modules/lru-cache": {
-      "version": "6.0.0",
-      "license": "ISC",
-      "dependencies": {
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/merge2": {
-      "version": "1.4.1",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/micromatch": {
-      "version": "4.0.5",
-      "license": "MIT",
-      "dependencies": {
-        "braces": "^3.0.2",
-        "picomatch": "^2.3.1"
-      },
-      "engines": {
-        "node": ">=8.6"
-      }
-    },
-    "node_modules/minimatch": {
-      "version": "3.1.2",
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^1.1.7"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/minimist": {
-      "version": "1.2.8",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/ms": {
-      "version": "2.1.2",
-      "license": "MIT"
-    },
-    "node_modules/mz": {
-      "version": "2.7.0",
-      "license": "MIT",
-      "dependencies": {
-        "any-promise": "^1.0.0",
-        "object-assign": "^4.0.1",
-        "thenify-all": "^1.0.0"
-      }
-    },
-    "node_modules/nanoid": {
-      "version": "3.3.6",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "MIT",
-      "bin": {
-        "nanoid": "bin/nanoid.cjs"
-      },
-      "engines": {
-        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
-      }
-    },
-    "node_modules/natural-compare": {
-      "version": "1.4.0",
-      "license": "MIT"
-    },
-    "node_modules/next": {
-      "version": "13.4.19",
-      "license": "MIT",
-      "dependencies": {
-        "@next/env": "13.4.19",
-        "@swc/helpers": "0.5.1",
-        "busboy": "1.6.0",
-        "caniuse-lite": "^1.0.30001406",
-        "postcss": "8.4.14",
-        "styled-jsx": "5.1.1",
-        "watchpack": "2.4.0",
-        "zod": "3.21.4"
-      },
-      "bin": {
-        "next": "dist/bin/next"
-      },
-      "engines": {
-        "node": ">=16.8.0"
-      },
-      "optionalDependencies": {
-        "@next/swc-darwin-arm64": "13.4.19",
-        "@next/swc-darwin-x64": "13.4.19",
-        "@next/swc-linux-arm64-gnu": "13.4.19",
-        "@next/swc-linux-arm64-musl": "13.4.19",
-        "@next/swc-linux-x64-gnu": "13.4.19",
-        "@next/swc-linux-x64-musl": "13.4.19",
-        "@next/swc-win32-arm64-msvc": "13.4.19",
-        "@next/swc-win32-ia32-msvc": "13.4.19",
-        "@next/swc-win32-x64-msvc": "13.4.19"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.1.0",
-        "react": "^18.2.0",
-        "react-dom": "^18.2.0",
-        "sass": "^1.3.0"
-      },
-      "peerDependenciesMeta": {
-        "@opentelemetry/api": {
-          "optional": true
-        },
-        "sass": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/next/node_modules/postcss": {
-      "version": "8.4.14",
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/postcss/"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/postcss"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "nanoid": "^3.3.4",
-        "picocolors": "^1.0.0",
-        "source-map-js": "^1.0.2"
-      },
-      "engines": {
-        "node": "^10 || ^12 || >=14"
-      }
-    },
-    "node_modules/node-releases": {
-      "version": "2.0.13",
-      "license": "MIT"
-    },
-    "node_modules/normalize-path": {
-      "version": "3.0.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/normalize-range": {
-      "version": "0.1.2",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/object-assign": {
-      "version": "4.1.1",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/object-hash": {
-      "version": "3.0.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/object-inspect": {
-      "version": "1.12.3",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/object-keys": {
-      "version": "1.1.1",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/object.assign": {
-      "version": "4.1.4",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "has-symbols": "^1.0.3",
-        "object-keys": "^1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/object.entries": {
-      "version": "1.1.7",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.2.0",
-        "es-abstract": "^1.22.1"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/object.fromentries": {
-      "version": "2.0.7",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.2.0",
-        "es-abstract": "^1.22.1"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/object.groupby": {
-      "version": "1.0.1",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.2.0",
-        "es-abstract": "^1.22.1",
-        "get-intrinsic": "^1.2.1"
-      }
-    },
-    "node_modules/object.hasown": {
-      "version": "1.1.3",
-      "license": "MIT",
-      "dependencies": {
-        "define-properties": "^1.2.0",
-        "es-abstract": "^1.22.1"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/object.values": {
-      "version": "1.1.7",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.2.0",
-        "es-abstract": "^1.22.1"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/once": {
-      "version": "1.4.0",
-      "license": "ISC",
-      "dependencies": {
-        "wrappy": "1"
-      }
-    },
-    "node_modules/optionator": {
-      "version": "0.9.3",
-      "license": "MIT",
-      "dependencies": {
-        "@aashutoshrathi/word-wrap": "^1.2.3",
-        "deep-is": "^0.1.3",
-        "fast-levenshtein": "^2.0.6",
-        "levn": "^0.4.1",
-        "prelude-ls": "^1.2.1",
-        "type-check": "^0.4.0"
-      },
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/p-limit": {
-      "version": "3.1.0",
-      "license": "MIT",
-      "dependencies": {
-        "yocto-queue": "^0.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/p-locate": {
-      "version": "5.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "p-limit": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/parent-module": {
-      "version": "1.0.1",
-      "license": "MIT",
-      "dependencies": {
-        "callsites": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/path-exists": {
-      "version": "4.0.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/path-is-absolute": {
-      "version": "1.0.1",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/path-key": {
-      "version": "3.1.1",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/path-parse": {
-      "version": "1.0.7",
-      "license": "MIT"
-    },
-    "node_modules/path-type": {
-      "version": "4.0.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/picocolors": {
-      "version": "1.0.0",
-      "license": "ISC"
-    },
-    "node_modules/picomatch": {
-      "version": "2.3.1",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
-      }
-    },
-    "node_modules/pify": {
-      "version": "2.3.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/pirates": {
-      "version": "4.0.6",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/postcss": {
-      "version": "8.4.29",
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/postcss/"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/postcss"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "nanoid": "^3.3.6",
-        "picocolors": "^1.0.0",
-        "source-map-js": "^1.0.2"
-      },
-      "engines": {
-        "node": "^10 || ^12 || >=14"
-      }
-    },
-    "node_modules/postcss-import": {
-      "version": "15.1.0",
-      "license": "MIT",
-      "dependencies": {
-        "postcss-value-parser": "^4.0.0",
-        "read-cache": "^1.0.0",
-        "resolve": "^1.1.7"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      },
-      "peerDependencies": {
-        "postcss": "^8.0.0"
-      }
-    },
-    "node_modules/postcss-js": {
-      "version": "4.0.1",
-      "license": "MIT",
-      "dependencies": {
-        "camelcase-css": "^2.0.1"
-      },
-      "engines": {
-        "node": "^12 || ^14 || >= 16"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/postcss/"
-      },
-      "peerDependencies": {
-        "postcss": "^8.4.21"
-      }
-    },
-    "node_modules/postcss-load-config": {
-      "version": "4.0.1",
-      "license": "MIT",
-      "dependencies": {
-        "lilconfig": "^2.0.5",
-        "yaml": "^2.1.1"
-      },
-      "engines": {
-        "node": ">= 14"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/postcss/"
-      },
-      "peerDependencies": {
-        "postcss": ">=8.0.9",
-        "ts-node": ">=9.0.0"
-      },
-      "peerDependenciesMeta": {
-        "postcss": {
-          "optional": true
-        },
-        "ts-node": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/postcss-nested": {
-      "version": "6.0.1",
-      "license": "MIT",
-      "dependencies": {
-        "postcss-selector-parser": "^6.0.11"
-      },
-      "engines": {
-        "node": ">=12.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/postcss/"
-      },
-      "peerDependencies": {
-        "postcss": "^8.2.14"
-      }
-    },
-    "node_modules/postcss-selector-parser": {
-      "version": "6.0.13",
-      "license": "MIT",
-      "dependencies": {
-        "cssesc": "^3.0.0",
-        "util-deprecate": "^1.0.2"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/postcss-value-parser": {
-      "version": "4.2.0",
-      "license": "MIT"
-    },
-    "node_modules/prelude-ls": {
-      "version": "1.2.1",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/prettier": {
-      "version": "3.2.5",
-      "dev": true,
-      "license": "MIT",
-      "peer": true,
-      "bin": {
-        "prettier": "bin/prettier.cjs"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/prettier/prettier?sponsor=1"
-      }
-    },
-    "node_modules/prettier-plugin-tailwindcss": {
-      "version": "0.5.13",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=14.21.3"
-      },
-      "peerDependencies": {
-        "@ianvs/prettier-plugin-sort-imports": "*",
-        "@prettier/plugin-pug": "*",
-        "@shopify/prettier-plugin-liquid": "*",
-        "@trivago/prettier-plugin-sort-imports": "*",
-        "@zackad/prettier-plugin-twig-melody": "*",
-        "prettier": "^3.0",
-        "prettier-plugin-astro": "*",
-        "prettier-plugin-css-order": "*",
-        "prettier-plugin-import-sort": "*",
-        "prettier-plugin-jsdoc": "*",
-        "prettier-plugin-marko": "*",
-        "prettier-plugin-organize-attributes": "*",
-        "prettier-plugin-organize-imports": "*",
-        "prettier-plugin-sort-imports": "*",
-        "prettier-plugin-style-order": "*",
-        "prettier-plugin-svelte": "*"
-      },
-      "peerDependenciesMeta": {
-        "@ianvs/prettier-plugin-sort-imports": {
-          "optional": true
-        },
-        "@prettier/plugin-pug": {
-          "optional": true
-        },
-        "@shopify/prettier-plugin-liquid": {
-          "optional": true
-        },
-        "@trivago/prettier-plugin-sort-imports": {
-          "optional": true
-        },
-        "@zackad/prettier-plugin-twig-melody": {
-          "optional": true
-        },
-        "prettier-plugin-astro": {
-          "optional": true
-        },
-        "prettier-plugin-css-order": {
-          "optional": true
-        },
-        "prettier-plugin-import-sort": {
-          "optional": true
-        },
-        "prettier-plugin-jsdoc": {
-          "optional": true
-        },
-        "prettier-plugin-marko": {
-          "optional": true
-        },
-        "prettier-plugin-organize-attributes": {
-          "optional": true
-        },
-        "prettier-plugin-organize-imports": {
-          "optional": true
-        },
-        "prettier-plugin-sort-imports": {
-          "optional": true
-        },
-        "prettier-plugin-style-order": {
-          "optional": true
-        },
-        "prettier-plugin-svelte": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/prop-types": {
-      "version": "15.8.1",
-      "license": "MIT",
-      "dependencies": {
-        "loose-envify": "^1.4.0",
-        "object-assign": "^4.1.1",
-        "react-is": "^16.13.1"
-      }
-    },
-    "node_modules/punycode": {
-      "version": "2.3.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/queue-microtask": {
-      "version": "1.2.3",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/react": {
-      "version": "18.2.0",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "loose-envify": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/react-dom": {
-      "version": "18.2.0",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "loose-envify": "^1.1.0",
-        "scheduler": "^0.23.0"
-      },
-      "peerDependencies": {
-        "react": "^18.2.0"
-      }
-    },
-    "node_modules/react-is": {
-      "version": "16.13.1",
-      "license": "MIT"
-    },
-    "node_modules/read-cache": {
-      "version": "1.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "pify": "^2.3.0"
-      }
-    },
-    "node_modules/readdirp": {
-      "version": "3.6.0",
-      "license": "MIT",
-      "dependencies": {
-        "picomatch": "^2.2.1"
-      },
-      "engines": {
-        "node": ">=8.10.0"
-      }
-    },
-    "node_modules/reflect.getprototypeof": {
-      "version": "1.0.4",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.2.0",
-        "es-abstract": "^1.22.1",
-        "get-intrinsic": "^1.2.1",
-        "globalthis": "^1.0.3",
-        "which-builtin-type": "^1.1.3"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/regenerator-runtime": {
-      "version": "0.14.0",
-      "license": "MIT"
-    },
-    "node_modules/regexp.prototype.flags": {
-      "version": "1.5.0",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.2.0",
-        "functions-have-names": "^1.2.3"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/resolve": {
-      "version": "1.22.4",
-      "license": "MIT",
-      "dependencies": {
-        "is-core-module": "^2.13.0",
-        "path-parse": "^1.0.7",
-        "supports-preserve-symlinks-flag": "^1.0.0"
-      },
-      "bin": {
-        "resolve": "bin/resolve"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/resolve-from": {
-      "version": "4.0.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/resolve-pkg-maps": {
-      "version": "1.0.0",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/privatenumber/resolve-pkg-maps?sponsor=1"
-      }
-    },
-    "node_modules/reusify": {
-      "version": "1.0.4",
-      "license": "MIT",
-      "engines": {
-        "iojs": ">=1.0.0",
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/rimraf": {
-      "version": "3.0.2",
-      "license": "ISC",
-      "dependencies": {
-        "glob": "^7.1.3"
-      },
-      "bin": {
-        "rimraf": "bin.js"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/run-parallel": {
-      "version": "1.2.0",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "queue-microtask": "^1.2.2"
-      }
-    },
-    "node_modules/safe-array-concat": {
-      "version": "1.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.2.0",
-        "has-symbols": "^1.0.3",
-        "isarray": "^2.0.5"
-      },
-      "engines": {
-        "node": ">=0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/safe-regex-test": {
-      "version": "1.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.1.3",
-        "is-regex": "^1.1.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/scheduler": {
-      "version": "0.23.0",
-      "license": "MIT",
-      "dependencies": {
-        "loose-envify": "^1.1.0"
-      }
-    },
-    "node_modules/semver": {
-      "version": "6.3.1",
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
-    "node_modules/shebang-command": {
-      "version": "2.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "shebang-regex": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/shebang-regex": {
-      "version": "3.0.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/side-channel": {
-      "version": "1.0.4",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.0",
-        "get-intrinsic": "^1.0.2",
-        "object-inspect": "^1.9.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/slash": {
-      "version": "3.0.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/source-map-js": {
-      "version": "1.0.2",
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/streamsearch": {
-      "version": "1.1.0",
-      "engines": {
-        "node": ">=10.0.0"
-      }
-    },
-    "node_modules/string.prototype.matchall": {
-      "version": "4.0.9",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.2.0",
-        "es-abstract": "^1.22.1",
-        "get-intrinsic": "^1.2.1",
-        "has-symbols": "^1.0.3",
-        "internal-slot": "^1.0.5",
-        "regexp.prototype.flags": "^1.5.0",
-        "side-channel": "^1.0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/string.prototype.trim": {
-      "version": "1.2.7",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/string.prototype.trimend": {
-      "version": "1.0.6",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/string.prototype.trimstart": {
-      "version": "1.0.6",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/strip-bom": {
-      "version": "3.0.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/strip-json-comments": {
-      "version": "3.1.1",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/styled-jsx": {
-      "version": "5.1.1",
-      "license": "MIT",
-      "dependencies": {
-        "client-only": "0.0.1"
-      },
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "peerDependencies": {
-        "react": ">= 16.8.0 || 17.x.x || ^18.0.0-0"
-      },
-      "peerDependenciesMeta": {
-        "@babel/core": {
-          "optional": true
-        },
-        "babel-plugin-macros": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/sucrase": {
-      "version": "3.34.0",
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/gen-mapping": "^0.3.2",
-        "commander": "^4.0.0",
-        "glob": "7.1.6",
-        "lines-and-columns": "^1.1.6",
-        "mz": "^2.7.0",
-        "pirates": "^4.0.1",
-        "ts-interface-checker": "^0.1.9"
-      },
-      "bin": {
-        "sucrase": "bin/sucrase",
-        "sucrase-node": "bin/sucrase-node"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/sucrase/node_modules/glob": {
-      "version": "7.1.6",
-      "license": "ISC",
-      "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.0.4",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      },
-      "engines": {
-        "node": "*"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/supports-color": {
-      "version": "7.2.0",
-      "license": "MIT",
-      "dependencies": {
-        "has-flag": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/supports-preserve-symlinks-flag": {
-      "version": "1.0.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/tailwindcss": {
-      "version": "3.3.3",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@alloc/quick-lru": "^5.2.0",
-        "arg": "^5.0.2",
-        "chokidar": "^3.5.3",
-        "didyoumean": "^1.2.2",
-        "dlv": "^1.1.3",
-        "fast-glob": "^3.2.12",
-        "glob-parent": "^6.0.2",
-        "is-glob": "^4.0.3",
-        "jiti": "^1.18.2",
-        "lilconfig": "^2.1.0",
-        "micromatch": "^4.0.5",
-        "normalize-path": "^3.0.0",
-        "object-hash": "^3.0.0",
-        "picocolors": "^1.0.0",
-        "postcss": "^8.4.23",
-        "postcss-import": "^15.1.0",
-        "postcss-js": "^4.0.1",
-        "postcss-load-config": "^4.0.1",
-        "postcss-nested": "^6.0.1",
-        "postcss-selector-parser": "^6.0.11",
-        "resolve": "^1.22.2",
-        "sucrase": "^3.32.0"
-      },
-      "bin": {
-        "tailwind": "lib/cli.js",
-        "tailwindcss": "lib/cli.js"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
-    "node_modules/tapable": {
-      "version": "2.2.1",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/text-table": {
-      "version": "0.2.0",
-      "license": "MIT"
-    },
-    "node_modules/thenify": {
-      "version": "3.3.1",
-      "license": "MIT",
-      "dependencies": {
-        "any-promise": "^1.0.0"
-      }
-    },
-    "node_modules/thenify-all": {
-      "version": "1.6.0",
-      "license": "MIT",
-      "dependencies": {
-        "thenify": ">= 3.1.0 < 4"
-      },
-      "engines": {
-        "node": ">=0.8"
-      }
-    },
-    "node_modules/to-regex-range": {
-      "version": "5.0.1",
-      "license": "MIT",
-      "dependencies": {
-        "is-number": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=8.0"
-      }
-    },
-    "node_modules/ts-api-utils": {
-      "version": "1.0.2",
-      "license": "MIT",
-      "engines": {
-        "node": ">=16.13.0"
-      },
-      "peerDependencies": {
-        "typescript": ">=4.2.0"
-      }
-    },
-    "node_modules/ts-interface-checker": {
-      "version": "0.1.13",
-      "license": "Apache-2.0"
-    },
-    "node_modules/tsconfig-paths": {
-      "version": "3.14.2",
-      "license": "MIT",
-      "dependencies": {
-        "@types/json5": "^0.0.29",
-        "json5": "^1.0.2",
-        "minimist": "^1.2.6",
-        "strip-bom": "^3.0.0"
-      }
-    },
-    "node_modules/tslib": {
-      "version": "2.6.2",
-      "license": "0BSD"
-    },
-    "node_modules/type-check": {
-      "version": "0.4.0",
-      "license": "MIT",
-      "dependencies": {
-        "prelude-ls": "^1.2.1"
-      },
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/type-fest": {
-      "version": "0.20.2",
-      "license": "(MIT OR CC0-1.0)",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/typed-array-buffer": {
-      "version": "1.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.2.1",
-        "is-typed-array": "^1.1.10"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/typed-array-byte-length": {
-      "version": "1.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "for-each": "^0.3.3",
-        "has-proto": "^1.0.1",
-        "is-typed-array": "^1.1.10"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/typed-array-byte-offset": {
-      "version": "1.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "available-typed-arrays": "^1.0.5",
-        "call-bind": "^1.0.2",
-        "for-each": "^0.3.3",
-        "has-proto": "^1.0.1",
-        "is-typed-array": "^1.1.10"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/typed-array-length": {
-      "version": "1.0.4",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "for-each": "^0.3.3",
-        "is-typed-array": "^1.1.9"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/typescript": {
-      "version": "5.2.2",
-      "license": "Apache-2.0",
-      "peer": true,
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=14.17"
-      }
-    },
-    "node_modules/unbox-primitive": {
-      "version": "1.0.2",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "has-bigints": "^1.0.2",
-        "has-symbols": "^1.0.3",
-        "which-boxed-primitive": "^1.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/update-browserslist-db": {
-      "version": "1.0.11",
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/browserslist"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/browserslist"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "escalade": "^3.1.1",
-        "picocolors": "^1.0.0"
-      },
-      "bin": {
-        "update-browserslist-db": "cli.js"
-      },
-      "peerDependencies": {
-        "browserslist": ">= 4.21.0"
-      }
-    },
-    "node_modules/uri-js": {
-      "version": "4.4.1",
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "punycode": "^2.1.0"
-      }
-    },
-    "node_modules/util-deprecate": {
-      "version": "1.0.2",
-      "license": "MIT"
-    },
-    "node_modules/watchpack": {
-      "version": "2.4.0",
-      "license": "MIT",
-      "dependencies": {
-        "glob-to-regexp": "^0.4.1",
-        "graceful-fs": "^4.1.2"
-      },
-      "engines": {
-        "node": ">=10.13.0"
-      }
-    },
-    "node_modules/which": {
-      "version": "2.0.2",
-      "license": "ISC",
-      "dependencies": {
-        "isexe": "^2.0.0"
-      },
-      "bin": {
-        "node-which": "bin/node-which"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/which-boxed-primitive": {
-      "version": "1.0.2",
-      "license": "MIT",
-      "dependencies": {
-        "is-bigint": "^1.0.1",
-        "is-boolean-object": "^1.1.0",
-        "is-number-object": "^1.0.4",
-        "is-string": "^1.0.5",
-        "is-symbol": "^1.0.3"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/which-builtin-type": {
-      "version": "1.1.3",
-      "license": "MIT",
-      "dependencies": {
-        "function.prototype.name": "^1.1.5",
-        "has-tostringtag": "^1.0.0",
-        "is-async-function": "^2.0.0",
-        "is-date-object": "^1.0.5",
-        "is-finalizationregistry": "^1.0.2",
-        "is-generator-function": "^1.0.10",
-        "is-regex": "^1.1.4",
-        "is-weakref": "^1.0.2",
-        "isarray": "^2.0.5",
-        "which-boxed-primitive": "^1.0.2",
-        "which-collection": "^1.0.1",
-        "which-typed-array": "^1.1.9"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/which-collection": {
-      "version": "1.0.1",
-      "license": "MIT",
-      "dependencies": {
-        "is-map": "^2.0.1",
-        "is-set": "^2.0.1",
-        "is-weakmap": "^2.0.1",
-        "is-weakset": "^2.0.1"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/which-typed-array": {
-      "version": "1.1.11",
-      "license": "MIT",
-      "dependencies": {
-        "available-typed-arrays": "^1.0.5",
-        "call-bind": "^1.0.2",
-        "for-each": "^0.3.3",
-        "gopd": "^1.0.1",
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/wrappy": {
-      "version": "1.0.2",
-      "license": "ISC"
-    },
-    "node_modules/yallist": {
-      "version": "4.0.0",
-      "license": "ISC"
-    },
-    "node_modules/yaml": {
-      "version": "2.3.2",
-      "license": "ISC",
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/yocto-queue": {
-      "version": "0.1.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/zod": {
-      "version": "3.21.4",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
-    }
-  }
-}
diff --git a/site/package.json b/site/package.json
deleted file mode 100644
index 4fcacc8..0000000
--- a/site/package.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "name": "burrow",
-  "version": "0.1.0",
-  "private": true,
-  "scripts": {
-    "dev": "next dev",
-    "build": "next build",
-    "start": "next start",
-    "lint": "next lint"
-  },
-  "dependencies": {
-    "@fortawesome/fontawesome-free": "^6.4.2",
-    "@fortawesome/fontawesome-svg-core": "^6.4.2",
-    "@fortawesome/free-brands-svg-icons": "^6.4.2",
-    "@fortawesome/free-solid-svg-icons": "^6.4.2",
-    "@fortawesome/react-fontawesome": "^0.2.0",
-    "@headlessui/react": "^1.7.17",
-    "@headlessui/tailwindcss": "^0.2.0",
-    "@types/node": "20.5.8",
-    "@types/react": "18.2.21",
-    "@types/react-dom": "18.2.7",
-    "autoprefixer": "10.4.15",
-    "eslint": "8.48.0",
-    "eslint-config-next": "13.4.19",
-    "next": "13.4.19",
-    "postcss": "8.4.29",
-    "react": "18.2.0",
-    "react-dom": "18.2.0",
-    "tailwindcss": "3.3.3",
-    "typescript": "5.2.2"
-  },
-  "devDependencies": {
-    "prettier": "^3.0.3",
-    "prettier-plugin-tailwindcss": "^0.5.4"
-  }
-}
diff --git a/site/pages/_app.tsx b/site/pages/_app.tsx
deleted file mode 100644
index c0572f6..0000000
--- a/site/pages/_app.tsx
+++ /dev/null
@@ -1,14 +0,0 @@
-import Layout from "@/layout/layout";
-import type { AppProps } from "next/app";
-import { config } from "@fortawesome/fontawesome-svg-core";
-import "@fortawesome/fontawesome-svg-core/styles.css";
-config.autoAddCss = false;
-import "static/globals.css";
-
-export default function App({ Component, pageProps }: AppProps) {
-  return (
-    <Layout>
-      <Component {...pageProps} />
-    </Layout>
-  );
-}
diff --git a/site/pages/_document.tsx b/site/pages/_document.tsx
deleted file mode 100644
index ce4b5e1..0000000
--- a/site/pages/_document.tsx
+++ /dev/null
@@ -1,13 +0,0 @@
-import { Html, Head, Main, NextScript } from "next/document";
-
-export default function Document() {
-  return (
-    <Html>
-      <Head />
-      <body className="bg-backgroundBlack text-white">
-        <Main />
-        <NextScript />
-      </body>
-    </Html>
-  );
-}
diff --git a/site/pages/index.tsx b/site/pages/index.tsx
deleted file mode 100644
index 0356c17..0000000
--- a/site/pages/index.tsx
+++ /dev/null
@@ -1,151 +0,0 @@
-import Head from "next/head";
-import { Menu, Transition } from "@headlessui/react";
-import { useState, useRef, useEffect } from "react";
-
-function ChevronIcon({ open }: { open: boolean }) {
-  return (
-    <span aria-hidden="true" className="pl-1.5 text-lg">
-      {open ? "▴" : "▾"}
-    </span>
-  );
-}
-
-function ExternalLinkIcon() {
-  return (
-    <span aria-hidden="true" className="pl-3 text-lg">
-      ↗
-    </span>
-  );
-}
-
-export default function Page() {
-  const [chevron, setChevron] = useState(false);
-  const menuButtonRef = useRef<HTMLButtonElement | null>(null);
-  const toggleDropdown = () => {
-    setChevron(!chevron);
-  };
-  const handleClickOutside = (event: MouseEvent) => {
-    if (
-      menuButtonRef.current &&
-      !menuButtonRef.current.contains(event.target as Node)
-    ) {
-      setChevron(false);
-    }
-  };
-  useEffect(() => {
-    document.addEventListener("click", handleClickOutside);
-
-    return () => {
-      document.removeEventListener("click", handleClickOutside);
-    };
-  }, []);
-  return (
-    <>
-      <Head>
-        <title>Burrow</title>
-        <meta
-          name="description"
-          content="Burrow is an open-source tool for bypassing firewalls, built by teenagers at Hack Club."
-        />
-        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-      </Head>
-      <div className="flex min-h-screen items-center justify-center">
-        <div className="mb-48 text-center">
-          <h1 className="font-PhantomSans text-5xl md:text-6xl lg:text-7xl xl:text-8xl 2xl:text-9xl">
-            <span className="font-bold text-hackClubRed">Burrow</span> Through{" "}
-            Firewalls
-          </h1>
-          <div className="mx-auto my-2 w-11/12 font-PhantomSans text-lg md:my-10 md:w-3/4 lg:text-xl xl:text-2xl 2xl:text-3xl">
-            <p>
-              Burrow is an open source tool for burrowing through firewalls,
-              built by teenagers at{" "}
-              <span className="text-hackClubRed underline">
-                <a href="https://www.hackclub.com/" target="_blank">
-                  Hack Club.
-                </a>
-              </span>{" "}
-              <span className="rounded-md bg-burrowHover p-0.5 font-SpaceMono text-hackClubBlue">
-                burrow
-              </span>{" "}
-              is a Rust-based VPN for getting around restrictive Internet
-              censors.
-            </p>
-          </div>
-          <div className="flex flex-wrap justify-center">
-            <div className="flex w-full justify-center gap-x-4 md:w-auto">
-              <Menu as="div" className="relative inline-block text-left">
-                <div>
-                  <Menu.Button
-                    onClick={() => toggleDropdown()}
-                    ref={menuButtonRef}
-                    className="w-50 h-12 rounded-2xl bg-hackClubRed px-3 font-SpaceMono hover:scale-105 md:h-12 md:w-auto md:rounded-3xl md:text-xl 2xl:h-16 2xl:text-2xl "
-                  >
-                    Install for Linux
-                    <ChevronIcon open={chevron} />
-                  </Menu.Button>
-                </div>
-                <Transition
-                  enter="transition duration-100 ease-out"
-                  enterFrom="transform scale-95 opacity-0"
-                  enterTo="transform scale-100 opacity-100"
-                  leave="transition duration-75 ease-out"
-                  leaveFrom="transform scale-100 opacity-100"
-                  leaveTo="transform scale-95 opacity-0"
-                >
-                  <Menu.Items
-                    as="div"
-                    className="absolute right-0 z-10 mt-2 h-auto w-auto origin-top-right  divide-black rounded-md bg-hackClubBlueShade font-SpaceMono text-white shadow-lg ring-1 ring-black ring-opacity-5 focus:outline-none md:text-xl 2xl:text-2xl"
-                  >
-                    <div className="divide-y-2 divide-hackClubRed px-1 py-1">
-                      <Menu.Item>
-                        {({ active }) => (
-                          <a className="block px-4 py-2 hover:rounded-lg hover:bg-slate-600">
-                            Install for Windows
-                          </a>
-                        )}
-                      </Menu.Item>
-                      <Menu.Item>
-                        <a className="block px-4 py-2 hover:rounded-lg hover:bg-slate-600">
-                          Install for MacOS
-                        </a>
-                      </Menu.Item>
-                    </div>
-                  </Menu.Items>
-                </Transition>
-              </Menu>
-              <a>
-                <button className="h-12 rounded-2xl border-2 border-hackClubRed bg-transparent px-3 font-SpaceMono text-lg text-hackClubRed hover:scale-110 md:h-12 md:rounded-3xl md:text-xl 2xl:h-16 2xl:text-2xl">
-                  Docs
-                  <ExternalLinkIcon />
-                </button>
-              </a>
-            </div>
-            <div className="mt-4 flex w-full justify-center hover:scale-110 md:mt-0 md:w-auto md:pl-4">
-              <a href="https://git.burrow.net/hackclub/burrow" target="_blank">
-                <button className="h-12 w-40 rounded-xl border-2 border-hackClubRed bg-transparent px-3 font-SpaceMono text-hackClubRed md:h-12 md:w-auto md:rounded-3xl md:text-xl 2xl:h-16 2xl:text-2xl">
-                  Contribute
-                  <ExternalLinkIcon />
-                </button>
-              </a>
-            </div>
-          </div>
-          {/* Footer  */}
-          {/* <div className="fixed bottom-0 mb-20 left-[25vw] md:left-[40vw] lg:left-[44vw]">
-                        <a href="https://hackclub.com/" target="_blank">
-                            <button className="flex items-center bg-transparent border-2 border-burrowStroke text-hackClubRed font-SpaceMono text-lg md:text-2xl rounded-xl md:rounded-2xl h-12 md:h-16 px-3">
-                                <Image
-                                    src="/hackclub.svg"
-                                    width={35}
-                                    height={35}
-                                    className="mx-2"
-                                    alt="Hack Club's logo"
-                                />
-                                By Hack Club
-                            </button>
-                        </a>
-                    </div> */}
-        </div>
-      </div>
-    </>
-  );
-}
diff --git a/site/postcss.config.js b/site/postcss.config.js
deleted file mode 100644
index 12a703d..0000000
--- a/site/postcss.config.js
+++ /dev/null
@@ -1,6 +0,0 @@
-module.exports = {
-  plugins: {
-    tailwindcss: {},
-    autoprefixer: {},
-  },
-};
diff --git a/site/prettier.config.js b/site/prettier.config.js
deleted file mode 100644
index d573118..0000000
--- a/site/prettier.config.js
+++ /dev/null
@@ -1,3 +0,0 @@
-module.exports = {
-  plugins: ["prettier-plugin-tailwindcss"],
-};
diff --git a/site/public/.well-known/apple-app-site-association b/site/public/.well-known/apple-app-site-association
deleted file mode 100644
index 63262fb..0000000
--- a/site/public/.well-known/apple-app-site-association
+++ /dev/null
@@ -1,21 +0,0 @@
-{
-  "applinks": {
-    "details": [
-      {
-        "appIDs": [
-          "P6PV2R9443.com.hackclub.burrow"
-        ],
-        "components": [
-          {
-            "/": "/callback/*"
-          }
-        ]
-      }
-    ]
-  },
-  "webcredentials": {
-    "apps": [
-      "P6PV2R9443.com.hackclub.burrow"
-    ]
-  }
-}
diff --git a/site/public/hackclub.svg b/site/public/hackclub.svg
deleted file mode 100644
index 38c2a68..0000000
--- a/site/public/hackclub.svg
+++ /dev/null
@@ -1,66 +0,0 @@
-<svg width="256" height="256" viewBox="0 0 256 256" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0)">
-<mask id="mask0" mask-type="alpha" maskUnits="userSpaceOnUse" x="0" y="0" width="256" height="256">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M128 256C230.4 256 256 230.4 256 128C256 25.6 230.4 0 128 0C25.6 0 0 25.6 0 128C0 230.4 25.6 256 128 256Z" fill="black"/>
-</mask>
-<g mask="url(#mask0)">
-<g filter="url(#filter0_ii)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M128 256C230.4 256 256 230.4 256 128C256 25.6 230.4 0 128 0C25.6 0 0 25.6 0 128C0 230.4 25.6 256 128 256Z" fill="url(#paint0_radial)"/>
-</g>
-<g filter="url(#filter1_ddii)">
-<path d="M115.103 48.3682C115.103 47.1299 113.989 46.1892 112.769 46.3965L81.6652 51.6777C80.7036 51.8409 80 52.6741 80 53.6494V205.085C80 206.189 80.8954 207.085 82 207.085H113.103C114.208 207.085 115.103 206.189 115.103 205.085V148.397C115.103 131.127 124.261 120.429 131.892 120.429C138.76 120.429 140.744 127.307 140.744 137.699V205.085C140.744 206.189 141.639 207.085 142.744 207.085H174C175.105 207.085 176 206.189 176 205.085V132.656C176 109.12 167.148 93.9892 144.102 93.9892C134.852 93.9892 125.825 96.2163 118.633 101.146C117.205 102.125 115.103 101.161 115.103 99.4284V48.3682Z" fill="white"/>
-</g>
-</g>
-</g>
-<defs>
-<filter id="filter0_ii" x="-6" y="-6" width="268" height="268" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dx="6" dy="6"/>
-<feGaussianBlur stdDeviation="4"/>
-<feComposite in2="hardAlpha" operator="arithmetic" k2="-1" k3="1"/>
-<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.2 0"/>
-<feBlend mode="normal" in2="shape" result="effect1_innerShadow"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dx="-6" dy="-6"/>
-<feGaussianBlur stdDeviation="4"/>
-<feComposite in2="hardAlpha" operator="arithmetic" k2="-1" k3="1"/>
-<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.05 0"/>
-<feBlend mode="normal" in2="effect1_innerShadow" result="effect2_innerShadow"/>
-</filter>
-<filter id="filter1_ddii" x="64" y="42.3677" width="128" height="192.717" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/>
-<feOffset dy="12"/>
-<feGaussianBlur stdDeviation="8"/>
-<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.25 0"/>
-<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/>
-<feOffset dy="4"/>
-<feGaussianBlur stdDeviation="4"/>
-<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.125 0"/>
-<feBlend mode="normal" in2="effect1_dropShadow" result="effect2_dropShadow"/>
-<feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow" result="shape"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dy="-2"/>
-<feGaussianBlur stdDeviation="3"/>
-<feComposite in2="hardAlpha" operator="arithmetic" k2="-1" k3="1"/>
-<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.125 0"/>
-<feBlend mode="normal" in2="shape" result="effect3_innerShadow"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feOffset dy="-2"/>
-<feGaussianBlur stdDeviation="3"/>
-<feComposite in2="hardAlpha" operator="arithmetic" k2="-1" k3="1"/>
-<feColorMatrix type="matrix" values="0 0 0 0 0.92549 0 0 0 0 0.215686 0 0 0 0 0.313726 0 0 0 0.5 0"/>
-<feBlend mode="normal" in2="effect3_innerShadow" result="effect4_innerShadow"/>
-</filter>
-<radialGradient id="paint0_radial" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="rotate(58.6367) scale(245.935)">
-<stop stop-color="#FF8C37"/>
-<stop offset="1" stop-color="#EC3750"/>
-</radialGradient>
-<clipPath id="clip0">
-<rect width="256" height="256" fill="white" transform="translate(256) rotate(90)"/>
-</clipPath>
-</defs>
-</svg>
diff --git a/site/static/globals.css b/site/static/globals.css
deleted file mode 100644
index b5c61c9..0000000
--- a/site/static/globals.css
+++ /dev/null
@@ -1,3 +0,0 @@
-@tailwind base;
-@tailwind components;
-@tailwind utilities;
diff --git a/site/tailwind.config.ts b/site/tailwind.config.ts
deleted file mode 100644
index 3df6f5a..0000000
--- a/site/tailwind.config.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-import type { Config } from "tailwindcss";
-
-const config: Config = {
-  content: [
-    "./pages/**/*.{js,ts,jsx,tsx,mdx}",
-    "./components/**/*.{js,ts,jsx,tsx,mdx}",
-    "./app/**/*.{js,ts,jsx,tsx,mdx}",
-  ],
-  theme: {
-    extend: {
-      colors: {
-        backgroundBlack: "#17171D",
-        hackClubRed: "#EC3750",
-        hackClubBlueShade: "#32323D",
-        hackClubBlue: "#338EDA",
-        burrowStroke: "#595959",
-        burrowHover: "#3D3D3D",
-      },
-      fontFamily: {
-        SpaceMono: ["var(--font-space-mono)"],
-        Poppins: ["var(--font-poppins)"],
-        PhantomSans: ["var(--font-phantom-sans)"],
-      },
-    },
-  },
-  plugins: [require("@headlessui/tailwindcss")({ prefix: "ui" })],
-};
-export default config;
diff --git a/site/tsconfig.json b/site/tsconfig.json
deleted file mode 100644
index c714696..0000000
--- a/site/tsconfig.json
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "es5",
-    "lib": ["dom", "dom.iterable", "esnext"],
-    "allowJs": true,
-    "skipLibCheck": true,
-    "strict": true,
-    "noEmit": true,
-    "esModuleInterop": true,
-    "module": "esnext",
-    "moduleResolution": "bundler",
-    "resolveJsonModule": true,
-    "isolatedModules": true,
-    "jsx": "preserve",
-    "incremental": true,
-    "plugins": [
-      {
-        "name": "next"
-      }
-    ],
-    "paths": {
-      "@/*": ["./*"]
-    }
-  },
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
-  "exclude": ["node_modules"]
-}
diff --git a/store-metadata/android/README.md b/store-metadata/android/README.md
deleted file mode 100644
index 806d885..0000000
--- a/store-metadata/android/README.md
+++ /dev/null
@@ -1,22 +0,0 @@
-# Android Store Metadata
-
-This directory is the repo-owned home for Android distribution metadata.
-
-Current state:
-
-- Kotlin app shell exists under `Android/app`.
-- Rust core FFI exists under `crates/burrow-mobile-ffi`.
-- full VPN support is not enabled yet.
-
-Before Play Store upload:
-
-- implement Android `VpnService`
-- complete the Play VPN service declaration
-- complete data-safety review
-- wire signing through the release signing lane
-
-Before F-Droid upload:
-
-- add reproducible metadata
-- keep a source-built flavor without proprietary Play dependencies
-- document Rust core build inputs and target ABIs
diff --git a/store-metadata/android/icon.png b/store-metadata/android/icon.png
deleted file mode 100644
index c5997ae..0000000
Binary files a/store-metadata/android/icon.png and /dev/null differ
diff --git a/store-metadata/app-store-connect/README.md b/store-metadata/app-store-connect/README.md
deleted file mode 100644
index e565b9a..0000000
--- a/store-metadata/app-store-connect/README.md
+++ /dev/null
@@ -1,21 +0,0 @@
-# App Store Connect Metadata
-
-This directory is the repo-owned home for Burrow App Store Connect metadata.
-
-The release upload lane expects dedicated App Store Connect API credentials
-sealed with agenix:
-
-- `secrets/apple/appstore-connect.env.age`
-
-That single secret contains the key ID, issuer ID, and base64-encoded `.p8`.
-CI decrypts it into a temporary App Store Connect key file, syncs provisioning
-profiles from App Store Connect, and then uploads `.ipa`/`.pkg` artifacts.
-Forgejo secrets should only provide the runner age identity fallback, not the
-App Store key itself.
-
-The initial release pipeline can upload `.ipa` and `.pkg` artifacts once the
-Apple build lane produces signed outputs. Internal TestFlight distribution waits
-for processing and skips external beta-review submission; App Store Connect then
-exposes the valid build through the configured internal tester group. TestFlight
-external distribution must remain explicit until review metadata, groups, and
-tester policy are complete.
diff --git a/store-metadata/app-store-connect/testflight/en-US/beta_app_description.txt b/store-metadata/app-store-connect/testflight/en-US/beta_app_description.txt
deleted file mode 100644
index 82656b1..0000000
--- a/store-metadata/app-store-connect/testflight/en-US/beta_app_description.txt
+++ /dev/null
@@ -1 +0,0 @@
-Burrow is a VPN client for infrastructure operated by the Burrow project.
diff --git a/store-metadata/app-store-connect/testflight/en-US/feedback_email.txt b/store-metadata/app-store-connect/testflight/en-US/feedback_email.txt
deleted file mode 100644
index 2de2c1a..0000000
--- a/store-metadata/app-store-connect/testflight/en-US/feedback_email.txt
+++ /dev/null
@@ -1 +0,0 @@
-contact@burrow.net
diff --git a/store-metadata/app-store-connect/testflight/review/contact_email.txt b/store-metadata/app-store-connect/testflight/review/contact_email.txt
deleted file mode 100644
index 2de2c1a..0000000
--- a/store-metadata/app-store-connect/testflight/review/contact_email.txt
+++ /dev/null
@@ -1 +0,0 @@
-contact@burrow.net
diff --git a/store-metadata/app-store-connect/testflight/review/contact_first_name.txt b/store-metadata/app-store-connect/testflight/review/contact_first_name.txt
deleted file mode 100644
index d7bed7b..0000000
--- a/store-metadata/app-store-connect/testflight/review/contact_first_name.txt
+++ /dev/null
@@ -1 +0,0 @@
-Burrow
diff --git a/store-metadata/app-store-connect/testflight/review/contact_last_name.txt b/store-metadata/app-store-connect/testflight/review/contact_last_name.txt
deleted file mode 100644
index 9136ac3..0000000
--- a/store-metadata/app-store-connect/testflight/review/contact_last_name.txt
+++ /dev/null
@@ -1 +0,0 @@
-Operator
diff --git a/store-metadata/app-store-connect/testflight/review/demo_account_required.txt b/store-metadata/app-store-connect/testflight/review/demo_account_required.txt
deleted file mode 100644
index 27ba77d..0000000
--- a/store-metadata/app-store-connect/testflight/review/demo_account_required.txt
+++ /dev/null
@@ -1 +0,0 @@
-true
diff --git a/store-metadata/app-store-connect/testflight/review/notes.txt b/store-metadata/app-store-connect/testflight/review/notes.txt
deleted file mode 100644
index 2e500d1..0000000
--- a/store-metadata/app-store-connect/testflight/review/notes.txt
+++ /dev/null
@@ -1 +0,0 @@
-Use the dedicated Burrow test account supplied out of band for review. The app talks to the local Burrow daemon over its gRPC boundary.
diff --git a/store-metadata/flatpak/README.md b/store-metadata/flatpak/README.md
deleted file mode 100644
index 8733e31..0000000
--- a/store-metadata/flatpak/README.md
+++ /dev/null
@@ -1,8 +0,0 @@
-# Flatpak Metadata
-
-Flatpak is a desktop GUI distribution lane for Burrow.
-
-The Flatpak package should not be considered a complete VPN backend unless a
-host daemon or privileged helper is installed and verified. The GUI can manage
-configuration and status through a constrained local API, while TUN, routes,
-DNS, and firewall state remain outside the sandbox.
diff --git a/store-metadata/sparkle/README.md b/store-metadata/sparkle/README.md
deleted file mode 100644
index bc446ed..0000000
--- a/store-metadata/sparkle/README.md
+++ /dev/null
@@ -1,30 +0,0 @@
-# Sparkle Release Channel
-
-Burrow stages Sparkle files under `dist/builds/<build>/sparkle/<channel>/` and
-publishes them through `.forgejo/workflows/publish-store-uploads.yml`.
-
-The current implementation prepares the channel and public pointer layout:
-
-- `sparkle/<channel>/appcast.xml`
-- `sparkle/appcast.xml`
-- `sparkle/default/`
-- `sparkle/main-channel.txt`
-
-Sparkle enclosure signatures can be produced with the non-exportable
-`sparkle-ed25519` Google KMS key:
-
-```sh
-Scripts/sparkle/sign-appcast-kms.py \
-  --appcast dist/builds/<build>/sparkle/<channel>/appcast.xml \
-  --artifact-dir dist/builds/<build>/sparkle/<channel>
-```
-
-The public EdDSA key embedded in macOS release builds is:
-
-```text
-Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI=
-```
-
-The build lane only signs appcasts when `BURROW_SPARKLE_SIGN_WITH_KMS=true`.
-The live Google KMS key uses `EC_SIGN_ED25519` with software protection because
-Google KMS rejects Ed25519 for HSM protection level.
diff --git a/tun/Cargo.toml b/tun/Cargo.toml
index 1b07833..e67e45f 100644
--- a/tun/Cargo.toml
+++ b/tun/Cargo.toml
@@ -7,8 +7,8 @@ edition = "2021"
 libc = "0.2"
 fehler = "1.0"
 nix = { version = "0.26", features = ["ioctl"] }
-socket2 = "0.5"
-tokio = { version = "1.37", default-features = false, optional = true }
+socket2 = "0.4"
+tokio = { version = "1.28", features = [] }
 byteorder = "1.4"
 tracing = "0.1"
 log = "0.4"
@@ -19,7 +19,10 @@ futures = { version = "0.3.28", optional = true }
 
 [features]
 serde = ["dep:serde", "dep:schemars"]
-tokio = ["tokio/net", "dep:tokio", "dep:futures"]
+tokio = ["tokio/net", "dep:futures"]
+
+[target.'cfg(feature = "tokio")'.dev-dependencies]
+tokio = { features = ["rt", "macros"] }
 
 [target.'cfg(windows)'.dependencies]
 lazy_static = "1.4"
@@ -34,7 +37,7 @@ windows = { version = "0.48", features = [
 [target.'cfg(windows)'.build-dependencies]
 anyhow = "1.0"
 bindgen = "0.65"
-reqwest = { version = "0.11" }
+reqwest = { version = "0.11", features = ["native-tls"] }
 ssri = { version = "9.0", default-features = false }
 tokio = { version = "1.28", features = ["rt", "macros"] }
 zip = { version = "0.6", features = ["deflate"] }
diff --git a/tun/build.rs b/tun/build.rs
index 03ee131..8da8a40 100644
--- a/tun/build.rs
+++ b/tun/build.rs
@@ -26,7 +26,7 @@ async fn generate(out_dir: &std::path::Path) -> anyhow::Result<()> {
     println!("cargo:rerun-if-changed={}", binary_path.to_str().unwrap());
 
     if let (Ok(..), Ok(..)) = (File::open(&bindings_path), File::open(&binary_path)) {
-        return Ok(());
+        return Ok(())
     };
 
     let archive = download(out_dir)
diff --git a/tun/src/options.rs b/tun/src/options.rs
index bb364e5..339f71a 100644
--- a/tun/src/options.rs
+++ b/tun/src/options.rs
@@ -1,7 +1,5 @@
-#[cfg(all(any(target_os = "linux", target_vendor = "apple"), feature = "tokio"))]
 use std::io::Error;
 
-#[cfg(all(any(target_os = "linux", target_vendor = "apple"), feature = "tokio"))]
 use fehler::throws;
 
 #[cfg(any(target_os = "linux", target_vendor = "apple"))]
@@ -23,7 +21,7 @@ pub struct TunOptions {
     /// (Apple) Retrieve the tun interface
     pub tun_retrieve: bool,
     /// (Linux) The IP address of the tun interface.
-    pub address: Vec<String>,
+    pub address: Option<String>,
 }
 
 impl TunOptions {
@@ -46,8 +44,8 @@ impl TunOptions {
         self
     }
 
-    pub fn address(mut self, address: Vec<impl ToString>) -> Self {
-        self.address = address.iter().map(|x| x.to_string()).collect();
+    pub fn address(mut self, address: impl ToString) -> Self {
+        self.address = Some(address.to_string());
         self
     }
 
diff --git a/tun/src/tokio/mod.rs b/tun/src/tokio/mod.rs
index f56f3d2..bd27109 100644
--- a/tun/src/tokio/mod.rs
+++ b/tun/src/tokio/mod.rs
@@ -33,7 +33,7 @@ impl TunInterface {
                 Ok(result) => return result,
                 Err(_would_block) => {
                     tracing::debug!("WouldBlock");
-                    continue;
+                    continue
                 }
             }
         }
diff --git a/tun/src/unix/address.rs b/tun/src/unix/address.rs
deleted file mode 100644
index dc84e96..0000000
--- a/tun/src/unix/address.rs
+++ /dev/null
@@ -1,120 +0,0 @@
-use std::io::{Error, ErrorKind};
-use std::net::IpAddr;
-
-use fehler::throws;
-
-#[throws]
-pub(crate) fn ensure_valid_ipv6_prefix(prefix_len: u8) {
-    if prefix_len > 128 {
-        Err(Error::new(
-            ErrorKind::InvalidInput,
-            "IPv6 prefix length must be between 0 and 128",
-        ))?;
-    }
-}
-
-#[cfg_attr(not(any(test, target_vendor = "apple")), allow(dead_code))]
-#[throws]
-pub(crate) fn ipv6_prefix_octets(prefix_len: u8) -> [u8; 16] {
-    ensure_valid_ipv6_prefix(prefix_len)?;
-
-    let mut octets = [0u8; 16];
-    for bit in 0..prefix_len {
-        let idx = (bit / 8) as usize;
-        let offset = (bit % 8) as u8;
-        octets[idx] |= 0x80 >> offset;
-    }
-
-    octets
-}
-
-#[cfg_attr(not(any(test, target_vendor = "apple")), allow(dead_code))]
-pub(crate) fn parse_addr_spec(spec: &str) -> Result<Option<(IpAddr, Option<u8>)>, Error> {
-    let (addr_str, prefix) = match spec.split_once('/') {
-        Some((addr, prefix)) => (addr, Some(prefix)),
-        None => (spec, None),
-    };
-
-    let addr: IpAddr = match addr_str.parse() {
-        Ok(addr) => addr,
-        Err(_) => return Ok(None),
-    };
-
-    let prefix_len = if let Some(prefix) = prefix {
-        let parsed = prefix
-            .parse::<u8>()
-            .map_err(|_| Error::new(ErrorKind::InvalidInput, "Invalid prefix length"))?;
-        ensure_valid_ipv6_prefix(parsed)?;
-        Some(parsed)
-    } else {
-        None
-    };
-
-    Ok(Some((addr, prefix_len)))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
-
-    #[test]
-    fn parse_ipv4_without_prefix() {
-        let parsed = parse_addr_spec("192.0.2.1").expect("parse succeeds");
-        assert_eq!(
-            parsed,
-            Some((IpAddr::V4(Ipv4Addr::new(192, 0, 2, 1)), None))
-        );
-    }
-
-    #[test]
-    fn parse_ipv6_with_prefix() {
-        let parsed = parse_addr_spec("2001:db8::1/64").expect("parse succeeds");
-        assert_eq!(
-            parsed,
-            Some((
-                IpAddr::V6("2001:db8::1".parse::<Ipv6Addr>().unwrap()),
-                Some(64),
-            ))
-        );
-    }
-
-    #[test]
-    fn parse_invalid_addr_returns_none() {
-        assert_eq!(parse_addr_spec("not-an-ip").unwrap(), None);
-    }
-
-    #[test]
-    fn parse_invalid_prefix_string_errors() {
-        assert!(parse_addr_spec("::1/not-a-number").is_err());
-    }
-
-    #[test]
-    fn parse_prefix_out_of_range_errors() {
-        assert!(parse_addr_spec("::1/129").is_err());
-    }
-
-    #[test]
-    fn ensure_valid_ipv6_prefix_accepts_bounds() {
-        ensure_valid_ipv6_prefix(0).expect("zero prefix is allowed");
-        ensure_valid_ipv6_prefix(128).expect("max prefix is allowed");
-    }
-
-    #[test]
-    fn ensure_valid_ipv6_prefix_rejects_invalid() {
-        assert!(ensure_valid_ipv6_prefix(129).is_err());
-    }
-
-    #[test]
-    fn ipv6_prefix_octets_zero_prefix() {
-        assert_eq!(ipv6_prefix_octets(0).unwrap(), [0u8; 16]);
-    }
-
-    #[test]
-    fn ipv6_prefix_octets_sets_bits_correctly() {
-        let mask = ipv6_prefix_octets(65).unwrap();
-        assert_eq!(mask[0..8], [0xFF; 8]);
-        assert_eq!(mask[8], 0x80);
-        assert_eq!(mask[9..], [0u8; 7]);
-    }
-}
diff --git a/tun/src/unix/apple/kern_control.rs b/tun/src/unix/apple/kern_control.rs
index 6075233..76e576f 100644
--- a/tun/src/unix/apple/kern_control.rs
+++ b/tun/src/unix/apple/kern_control.rs
@@ -21,7 +21,7 @@ impl SysControlSocket for socket2::Socket {
         unsafe { sys::resolve_ctl_info(self.as_raw_fd(), &mut info as *mut sys::ctl_info)? };
 
         let (_, addr) = unsafe {
-            socket2::SockAddr::try_init(|addr_storage, len| {
+            socket2::SockAddr::init(|addr_storage, len| {
                 *len = size_of::<sys::sockaddr_ctl>() as u32;
 
                 let addr: &mut sys::sockaddr_ctl = &mut *addr_storage.cast();
diff --git a/tun/src/unix/apple/mod.rs b/tun/src/unix/apple/mod.rs
index 66a2f15..2787cde 100644
--- a/tun/src/unix/apple/mod.rs
+++ b/tun/src/unix/apple/mod.rs
@@ -1,8 +1,7 @@
 use std::{
-    ffi::CStr,
-    io::{Error, ErrorKind, IoSlice},
+    io::{Error, IoSlice},
     mem,
-    net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddrV4, SocketAddrV6},
+    net::{Ipv4Addr, SocketAddrV4},
     os::fd::{AsRawFd, FromRawFd, RawFd},
 };
 
@@ -17,7 +16,6 @@ pub mod sys;
 
 use kern_control::SysControlSocket;
 
-use super::address::{ensure_valid_ipv6_prefix, ipv6_prefix_octets, parse_addr_spec};
 use super::{ifname_to_string, string_to_ifname};
 use crate::TunOptions;
 
@@ -51,7 +49,7 @@ impl TunInterface {
     pub fn retrieve() -> Option<TunInterface> {
         (3..100)
             .filter_map(|fd| unsafe {
-                let peer_addr = socket2::SockAddr::try_init(|storage, len| {
+                let peer_addr = socket2::SockAddr::init(|storage, len| {
                     *len = mem::size_of::<sys::sockaddr_ctl>() as u32;
                     libc::getpeername(fd, storage as *mut _, len);
                     Ok(())
@@ -73,12 +71,9 @@ impl TunInterface {
 
     #[throws]
     fn configure(&self, options: TunOptions) {
-        for spec in options.address {
-            if let Some((addr, prefix_len)) = parse_addr_spec(&spec)? {
-                match addr {
-                    IpAddr::V4(addr) => self.set_ipv4_addr(addr)?,
-                    IpAddr::V6(addr) => self.add_ipv6_addr(addr, prefix_len.unwrap_or(128))?,
-                }
+        if let Some(addr) = options.address {
+            if let Ok(addr) = addr.parse() {
+                self.set_ipv4_addr(addr)?;
             }
         }
     }
@@ -114,10 +109,6 @@ impl TunInterface {
         ifname_to_string(buf)
     }
 
-    pub(crate) fn packet_information_size(&self) -> usize {
-        4
-    }
-
     #[throws]
     #[instrument]
     fn ifreq(&self) -> sys::ifreq {
@@ -126,14 +117,6 @@ impl TunInterface {
         iff
     }
 
-    #[throws]
-    #[instrument]
-    fn in6_ifreq(&self) -> sys::in6_ifreq {
-        let mut iff: sys::in6_ifreq = unsafe { mem::zeroed() };
-        iff.ifr_name = string_to_ifname(&self.name()?);
-        iff
-    }
-
     #[throws]
     #[instrument]
     pub fn set_ipv4_addr(&self, addr: Ipv4Addr) {
@@ -153,81 +136,6 @@ impl TunInterface {
         Ipv4Addr::from(u32::from_be(addr.sin_addr.s_addr))
     }
 
-    #[throws]
-    #[instrument]
-    pub fn add_ipv6_addr(&self, addr: Ipv6Addr, prefix_len: u8) {
-        ensure_valid_ipv6_prefix(prefix_len)?;
-
-        let mut req: sys::in6_aliasreq = unsafe { mem::zeroed() };
-        req.ifra_name = string_to_ifname(&self.name()?);
-        req.ifra_addr = ipv6_to_sockaddr(addr);
-        req.ifra_prefixmask = ipv6_prefix_mask(prefix_len)?;
-        self.perform6(|fd| unsafe { sys::if_add_addr6(fd, &req) })?;
-        tracing::info!(
-            "ipv6_addr_added: {:?}/{} (fd: {:?})",
-            addr,
-            prefix_len,
-            self.as_raw_fd()
-        );
-    }
-
-    #[throws]
-    #[instrument]
-    pub fn remove_ipv6_addr(&self, addr: Ipv6Addr, prefix_len: u8) {
-        ensure_valid_ipv6_prefix(prefix_len)?;
-
-        let mut iff = self.in6_ifreq()?;
-        iff.ifr_ifru.ifru_addr = ipv6_to_sockaddr(addr);
-        iff.ifr_ifru.ifru_prefixmask = ipv6_prefix_mask(prefix_len)?;
-        self.perform6(|fd| unsafe { sys::if_del_addr6(fd, &iff) })?;
-        tracing::info!(
-            "ipv6_addr_removed: {:?}/{} (fd: {:?})",
-            addr,
-            prefix_len,
-            self.as_raw_fd()
-        );
-    }
-
-    #[throws]
-    #[instrument]
-    pub fn ipv6_addrs(&self) -> Vec<Ipv6Addr> {
-        struct IfAddrs(*mut libc::ifaddrs);
-
-        impl Drop for IfAddrs {
-            fn drop(&mut self) {
-                if !self.0.is_null() {
-                    unsafe { libc::freeifaddrs(self.0) };
-                }
-            }
-        }
-
-        let mut ifaddrs = std::ptr::null_mut();
-        unsafe {
-            if libc::getifaddrs(&mut ifaddrs) != 0 {
-                Err(Error::last_os_error())?;
-            }
-        }
-
-        let guard = IfAddrs(ifaddrs);
-        let interface_name = self.name()?;
-        let mut cursor = guard.0;
-        let mut result = Vec::new();
-
-        while let Some(ifa) = unsafe { cursor.as_ref() } {
-            if !ifa.ifa_addr.is_null()
-                && unsafe { (*ifa.ifa_addr).sa_family as i32 } == AF_INET6
-                && unsafe { CStr::from_ptr(ifa.ifa_name) }.to_string_lossy() == interface_name
-            {
-                let sockaddr = unsafe { *(ifa.ifa_addr as *const libc::sockaddr_in6) };
-                result.push(Ipv6Addr::from(in6_addr_octets(sockaddr.sin6_addr)));
-            }
-
-            cursor = ifa.ifa_next;
-        }
-
-        result
-    }
-
     #[throws]
     fn perform<R>(&self, perform: impl FnOnce(RawFd) -> Result<R, nix::Error>) -> R {
         let span = tracing::info_span!("perform", fd = self.as_raw_fd());
@@ -237,15 +145,6 @@ impl TunInterface {
         perform(socket.as_raw_fd())?
     }
 
-    #[throws]
-    fn perform6<R>(&self, perform: impl FnOnce(RawFd) -> Result<R, nix::Error>) -> R {
-        let span = tracing::info_span!("perform6", fd = self.as_raw_fd());
-        let _enter = span.enter();
-
-        let socket = Socket::new(Domain::IPV6, Type::DGRAM, None)?;
-        perform(socket.as_raw_fd())?
-    }
-
     #[throws]
     #[instrument]
     pub fn mtu(&self) -> i32 {
@@ -294,6 +193,7 @@ impl TunInterface {
     #[throws]
     #[instrument]
     pub fn send(&self, buf: &[u8]) -> usize {
+        use std::io::ErrorKind;
         let proto = match buf[0] >> 4 {
             6 => Ok(AF_INET6),
             4 => Ok(AF_INET),
@@ -315,19 +215,3 @@ impl TunInterface {
             .map_err(|_| Error::new(ErrorKind::Other, "Conversion error"))?
     }
 }
-
-#[inline]
-fn in6_addr_octets(addr: libc::in6_addr) -> [u8; 16] {
-    addr.s6_addr
-}
-
-fn ipv6_to_sockaddr(addr: Ipv6Addr) -> libc::sockaddr_in6 {
-    let sockaddr = SockAddr::from(SocketAddrV6::new(addr, 0, 0, 0));
-    unsafe { *(sockaddr.as_ptr() as *const libc::sockaddr_in6) }
-}
-
-#[throws]
-fn ipv6_prefix_mask(prefix_len: u8) -> libc::sockaddr_in6 {
-    let octets = ipv6_prefix_octets(prefix_len)?;
-    ipv6_to_sockaddr(Ipv6Addr::from(octets))
-}
diff --git a/tun/src/unix/apple/sys.rs b/tun/src/unix/apple/sys.rs
index 282ee34..b4d4a6a 100644
--- a/tun/src/unix/apple/sys.rs
+++ b/tun/src/unix/apple/sys.rs
@@ -1,12 +1,21 @@
 use std::mem;
 
-use libc::{c_char, c_int, c_short, c_uint, c_ulong, sockaddr, sockaddr_in6, time_t};
+use libc::{c_char, c_int, c_short, c_uint, c_ulong, sockaddr};
 pub use libc::{
-    c_void, sockaddr_ctl, sockaddr_in, socklen_t, AF_SYSTEM, AF_SYS_CONTROL, IFNAMSIZ,
+    c_void,
+    sockaddr_ctl,
+    sockaddr_in,
+    socklen_t,
+    AF_SYSTEM,
+    AF_SYS_CONTROL,
+    IFNAMSIZ,
     SYSPROTO_CONTROL,
 };
 use nix::{
-    ioctl_read_bad, ioctl_readwrite, ioctl_write_ptr_bad, request_code_readwrite,
+    ioctl_read_bad,
+    ioctl_readwrite,
+    ioctl_write_ptr_bad,
+    request_code_readwrite,
     request_code_write,
 };
 
@@ -14,7 +23,6 @@ pub const UTUN_CONTROL_NAME: &str = "com.apple.net.utun_control";
 pub const UTUN_OPT_IFNAME: libc::c_int = 2;
 
 pub const MAX_KCTL_NAME: usize = 96;
-pub const SCOPE6_ID_MAX: usize = 16;
 
 #[repr(C)]
 #[derive(Copy, Clone, Debug)]
@@ -66,121 +74,7 @@ pub struct ifreq {
     pub ifr_ifru: ifr_ifru,
 }
 
-#[repr(C)]
-#[derive(Copy, Clone, Debug)]
-pub struct in6_addrlifetime {
-    pub ia6t_expire: time_t,
-    pub ia6t_preferred: time_t,
-    pub ia6t_vltime: u32,
-    pub ia6t_pltime: u32,
-}
-
-#[repr(C)]
-#[derive(Copy, Clone, Debug)]
-pub struct in6_ifstat {
-    pub ifs6_in_receive: u64,
-    pub ifs6_in_hdrerr: u64,
-    pub ifs6_in_toobig: u64,
-    pub ifs6_in_noroute: u64,
-    pub ifs6_in_addrerr: u64,
-    pub ifs6_in_protounknown: u64,
-    pub ifs6_in_truncated: u64,
-    pub ifs6_in_discard: u64,
-    pub ifs6_in_deliver: u64,
-    pub ifs6_out_forward: u64,
-    pub ifs6_out_request: u64,
-    pub ifs6_out_discard: u64,
-    pub ifs6_out_fragok: u64,
-    pub ifs6_out_fragfail: u64,
-    pub ifs6_out_fragcreat: u64,
-    pub ifs6_reass_reqd: u64,
-    pub ifs6_reass_ok: u64,
-    pub ifs6_atmfrag_rcvd: u64,
-    pub ifs6_reass_fail: u64,
-    pub ifs6_in_mcast: u64,
-    pub ifs6_out_mcast: u64,
-    pub ifs6_cantfoward_icmp6: u64,
-    pub ifs6_addr_expiry_cnt: u64,
-    pub ifs6_pfx_expiry_cnt: u64,
-    pub ifs6_defrtr_expiry_cnt: u64,
-}
-
-#[repr(C)]
-#[derive(Copy, Clone, Debug)]
-pub struct icmp6_ifstat {
-    pub ifs6_in_msg: u64,
-    pub ifs6_in_error: u64,
-    pub ifs6_in_dstunreach: u64,
-    pub ifs6_in_adminprohib: u64,
-    pub ifs6_in_timeexceed: u64,
-    pub ifs6_in_paramprob: u64,
-    pub ifs6_in_pkttoobig: u64,
-    pub ifs6_in_echo: u64,
-    pub ifs6_in_echoreply: u64,
-    pub ifs6_in_routersolicit: u64,
-    pub ifs6_in_routeradvert: u64,
-    pub ifs6_in_neighborsolicit: u64,
-    pub ifs6_in_neighboradvert: u64,
-    pub ifs6_in_redirect: u64,
-    pub ifs6_in_mldquery: u64,
-    pub ifs6_in_mldreport: u64,
-    pub ifs6_in_mlddone: u64,
-    pub ifs6_out_msg: u64,
-    pub ifs6_out_error: u64,
-    pub ifs6_out_dstunreach: u64,
-    pub ifs6_out_adminprohib: u64,
-    pub ifs6_out_timeexceed: u64,
-    pub ifs6_out_paramprob: u64,
-    pub ifs6_out_pkttoobig: u64,
-    pub ifs6_out_echo: u64,
-    pub ifs6_out_echoreply: u64,
-    pub ifs6_out_routersolicit: u64,
-    pub ifs6_out_routeradvert: u64,
-    pub ifs6_out_neighborsolicit: u64,
-    pub ifs6_out_neighboradvert: u64,
-    pub ifs6_out_redirect: u64,
-    pub ifs6_out_mldquery: u64,
-    pub ifs6_out_mldreport: u64,
-    pub ifs6_out_mlddone: u64,
-}
-
-#[repr(C)]
-pub union ifr_ifru6 {
-    pub ifru_addr: sockaddr_in6,
-    pub ifru_dstaddr: sockaddr_in6,
-    pub ifru_prefixmask: sockaddr_in6,
-    pub ifru_flags: c_int,
-    pub ifru_flags6: c_int,
-    pub ifru_metric: c_int,
-    pub ifru_intval: c_int,
-    pub ifru_data: *mut c_char,
-    pub ifru_lifetime: in6_addrlifetime, // ifru_lifetime
-    pub ifru_stat: in6_ifstat,
-    pub ifru_icmp6stat: icmp6_ifstat,
-    pub ifru_scope_id: [u32; SCOPE6_ID_MAX],
-}
-
-#[repr(C)]
-pub struct in6_ifreq {
-    pub ifr_name: [c_char; IFNAMSIZ],
-    pub ifr_ifru: ifr_ifru6,
-}
-
-#[repr(C)]
-#[derive(Copy, Clone, Debug)]
-pub struct in6_aliasreq {
-    pub ifra_name: [c_char; IFNAMSIZ],
-    pub ifra_addr: sockaddr_in6,
-    pub ifra_dstaddr: sockaddr_in6,
-    pub ifra_prefixmask: sockaddr_in6,
-    pub ifra_lifetime: in6_addrlifetime,
-    pub ifra_flags: c_int,
-}
-
 pub const SIOCSIFADDR: c_ulong = request_code_write!(b'i', 12, mem::size_of::<ifreq>());
-pub const SIOCSIFADDR_IN6: c_ulong = request_code_write!(b'i', 12, mem::size_of::<in6_ifreq>());
-pub const SIOCAIFADDR_IN6: c_ulong = request_code_write!(b'i', 30, mem::size_of::<in6_aliasreq>());
-pub const SIOCDIFADDR_IN6: c_ulong = request_code_write!(b'i', 25, mem::size_of::<in6_ifreq>());
 pub const SIOCGIFMTU: c_ulong = request_code_readwrite!(b'i', 51, mem::size_of::<ifreq>());
 pub const SIOCSIFMTU: c_ulong = request_code_write!(b'i', 52, mem::size_of::<ifreq>());
 pub const SIOCGIFNETMASK: c_ulong = request_code_readwrite!(b'i', 37, mem::size_of::<ifreq>());
@@ -203,7 +97,5 @@ ioctl_read_bad!(if_get_addr, libc::SIOCGIFADDR, ifreq);
 ioctl_read_bad!(if_get_mtu, SIOCGIFMTU, ifreq);
 ioctl_read_bad!(if_get_netmask, SIOCGIFNETMASK, ifreq);
 ioctl_write_ptr_bad!(if_set_addr, SIOCSIFADDR, ifreq);
-ioctl_write_ptr_bad!(if_add_addr6, SIOCAIFADDR_IN6, in6_aliasreq);
-ioctl_write_ptr_bad!(if_del_addr6, SIOCDIFADDR_IN6, in6_ifreq);
 ioctl_write_ptr_bad!(if_set_mtu, SIOCSIFMTU, ifreq);
 ioctl_write_ptr_bad!(if_set_netmask, SIOCSIFNETMASK, ifreq);
diff --git a/tun/src/unix/linux/mod.rs b/tun/src/unix/linux/mod.rs
index 9fc963a..60d6341 100644
--- a/tun/src/unix/linux/mod.rs
+++ b/tun/src/unix/linux/mod.rs
@@ -1,7 +1,6 @@
 use std::{
-    ffi::CStr,
     fs::OpenOptions,
-    io::Error,
+    io::{Error, Write},
     mem,
     net::{Ipv4Addr, Ipv6Addr, SocketAddrV4},
     os::{
@@ -11,11 +10,10 @@ use std::{
 };
 
 use fehler::throws;
-use libc::{in6_ifreq, AF_INET6};
+use libc::in6_ifreq;
 use socket2::{Domain, SockAddr, Socket, Type};
 use tracing::{info, instrument};
 
-use super::address::ensure_valid_ipv6_prefix;
 use super::{ifname_to_string, string_to_ifname};
 use crate::TunOptions;
 
@@ -73,21 +71,6 @@ impl TunInterface {
         ifname_to_string(iff.ifr_name)
     }
 
-    pub(crate) fn packet_information_size(&self) -> usize {
-        let mut iff = unsafe { mem::zeroed::<libc::ifreq>() };
-        match unsafe { sys::tun_get_iff(self.socket.as_raw_fd(), &mut iff) } {
-            Ok(_) => {
-                let flags = unsafe { iff.ifr_ifru.ifru_flags };
-                if flags & libc::IFF_NO_PI as i16 != 0 {
-                    0
-                } else {
-                    4
-                }
-            }
-            Err(_) => 4,
-        }
-    }
-
     #[throws]
     #[instrument]
     fn ifreq(&self) -> sys::ifreq {
@@ -157,76 +140,11 @@ impl TunInterface {
 
     #[throws]
     #[instrument]
-    pub fn add_ipv6_addr(&self, addr: Ipv6Addr, prefix_len: u8) {
-        ensure_valid_ipv6_prefix(prefix_len)?;
-
+    pub fn set_ipv6_addr(&self, addr: Ipv6Addr) {
         let mut iff = self.in6_ifreq()?;
         iff.ifr6_addr.s6_addr = addr.octets();
-        iff.ifr6_prefixlen = prefix_len.into();
-        self.perform6(|fd| unsafe { sys::if_add_addr6(fd, &iff) })?;
-        info!(
-            "ipv6_addr_added: {:?}/{} (fd: {:?})",
-            addr,
-            prefix_len,
-            self.as_raw_fd()
-        )
-    }
-
-    #[throws]
-    #[instrument]
-    pub fn remove_ipv6_addr(&self, addr: Ipv6Addr, prefix_len: u8) {
-        ensure_valid_ipv6_prefix(prefix_len)?;
-
-        let mut iff = self.in6_ifreq()?;
-        iff.ifr6_addr.s6_addr = addr.octets();
-        iff.ifr6_prefixlen = prefix_len.into();
-        self.perform6(|fd| unsafe { sys::if_del_addr6(fd, &iff) })?;
-        info!(
-            "ipv6_addr_removed: {:?}/{} (fd: {:?})",
-            addr,
-            prefix_len,
-            self.as_raw_fd()
-        )
-    }
-
-    #[throws]
-    #[instrument]
-    pub fn ipv6_addrs(&self) -> Vec<Ipv6Addr> {
-        struct IfAddrs(*mut libc::ifaddrs);
-
-        impl Drop for IfAddrs {
-            fn drop(&mut self) {
-                if !self.0.is_null() {
-                    unsafe { libc::freeifaddrs(self.0) };
-                }
-            }
-        }
-
-        let mut ifaddrs = std::ptr::null_mut();
-        unsafe {
-            if libc::getifaddrs(&mut ifaddrs) != 0 {
-                Err(Error::last_os_error())?;
-            }
-        }
-
-        let guard = IfAddrs(ifaddrs);
-        let interface_name = self.name()?;
-        let mut cursor = guard.0;
-        let mut result = Vec::new();
-
-        while let Some(ifa) = unsafe { cursor.as_ref() } {
-            if !ifa.ifa_addr.is_null()
-                && unsafe { (*ifa.ifa_addr).sa_family as i32 } == AF_INET6
-                && unsafe { CStr::from_ptr(ifa.ifa_name) }.to_string_lossy() == interface_name
-            {
-                let sockaddr = unsafe { *(ifa.ifa_addr as *const libc::sockaddr_in6) };
-                result.push(Ipv6Addr::from(sockaddr.sin6_addr.s6_addr));
-            }
-
-            cursor = ifa.ifa_next;
-        }
-
-        result
+        self.perform6(|fd| unsafe { sys::if_set_addr6(fd, &iff) })?;
+        info!("ipv6_addr_set: {:?} (fd: {:?})", addr, self.as_raw_fd())
     }
 
     #[throws]
@@ -298,16 +216,6 @@ impl TunInterface {
     #[throws]
     #[instrument]
     pub fn send(&self, buf: &[u8]) -> usize {
-        let len = unsafe {
-            libc::write(
-                self.as_raw_fd(),
-                buf.as_ptr().cast::<libc::c_void>(),
-                buf.len(),
-            )
-        };
-        if len < 0 {
-            Err(Error::last_os_error())?;
-        }
-        len as usize
+        self.socket.send(buf)?
     }
 }
diff --git a/tun/src/unix/linux/sys.rs b/tun/src/unix/linux/sys.rs
index cba5554..e12c8ec 100644
--- a/tun/src/unix/linux/sys.rs
+++ b/tun/src/unix/linux/sys.rs
@@ -1,6 +1,6 @@
 use std::mem::size_of;
 
-pub use libc::{ifreq, sockaddr_in};
+pub use libc::{ifreq, sockaddr, sockaddr_in, sockaddr_in6};
 use nix::{ioctl_read_bad, ioctl_write_ptr_bad, request_code_read, request_code_write};
 
 ioctl_write_ptr_bad!(
@@ -20,8 +20,7 @@ ioctl_read_bad!(if_get_mtu, libc::SIOCGIFMTU, libc::ifreq);
 ioctl_read_bad!(if_get_netmask, libc::SIOCGIFNETMASK, libc::ifreq);
 
 ioctl_write_ptr_bad!(if_set_addr, libc::SIOCSIFADDR, libc::ifreq);
-ioctl_write_ptr_bad!(if_add_addr6, libc::SIOCSIFADDR, libc::in6_ifreq);
-ioctl_write_ptr_bad!(if_del_addr6, libc::SIOCDIFADDR, libc::in6_ifreq);
+ioctl_write_ptr_bad!(if_set_addr6, libc::SIOCSIFADDR, libc::in6_ifreq);
 ioctl_write_ptr_bad!(if_set_brdaddr, libc::SIOCSIFBRDADDR, libc::ifreq);
 ioctl_write_ptr_bad!(if_set_mtu, libc::SIOCSIFMTU, libc::ifreq);
 ioctl_write_ptr_bad!(if_set_netmask, libc::SIOCSIFNETMASK, libc::ifreq);
diff --git a/tun/src/unix/mod.rs b/tun/src/unix/mod.rs
index ad25667..ae0b77a 100644
--- a/tun/src/unix/mod.rs
+++ b/tun/src/unix/mod.rs
@@ -6,7 +6,6 @@ use std::{
 
 use tracing::instrument;
 
-mod address;
 mod queue;
 
 #[cfg(target_vendor = "apple")]
@@ -48,26 +47,12 @@ impl TunInterface {
     #[throws]
     #[instrument]
     pub fn recv(&self, buf: &mut [u8]) -> usize {
-        let packet_information_size = self.packet_information_size();
-        let mut tmp_buf = [MaybeUninit::uninit(); 1504];
-        let len = unsafe {
-            libc::read(
-                self.as_raw_fd(),
-                tmp_buf.as_mut_ptr().cast::<libc::c_void>(),
-                tmp_buf.len(),
-            )
-        };
-        if len < 0 {
-            Err(Error::last_os_error())?;
-        }
-        let len = len as usize;
-        if len < packet_information_size {
-            return 0;
-        }
-
-        let result_buf = unsafe { assume_init(&tmp_buf[packet_information_size..len]) };
-        buf[..len - packet_information_size].copy_from_slice(result_buf);
-        len - packet_information_size
+        // Use IoVec to read directly into target buffer
+        let mut tmp_buf = [MaybeUninit::uninit(); 1500];
+        let len = self.socket.recv(&mut tmp_buf)?;
+        let result_buf = unsafe { assume_init(&tmp_buf[4..len]) };
+        buf[..len - 4].copy_from_slice(result_buf);
+        len - 4
     }
 
     #[throws]
diff --git a/tun/tests/configure.rs b/tun/tests/configure.rs
index bfa56ef..e7e2c6d 100644
--- a/tun/tests/configure.rs
+++ b/tun/tests/configure.rs
@@ -3,33 +3,17 @@ use std::{io::Error, net::Ipv4Addr};
 use fehler::throws;
 use tun::TunInterface;
 
-fn open_tun() -> Result<Option<TunInterface>, Error> {
-    match TunInterface::new() {
-        Ok(tun) => Ok(Some(tun)),
-        Err(err)
-            if err.kind() == std::io::ErrorKind::PermissionDenied
-                || matches!(err.raw_os_error(), Some(1 | 13)) =>
-        {
-            eprintln!("skipping tun test without tunnel privileges: {err}");
-            Ok(None)
-        }
-        Err(err) => Err(err),
-    }
-}
-
 #[test]
 #[throws]
 fn test_create() {
-    let _ = open_tun()?;
+    TunInterface::new()?;
 }
 
 #[test]
 #[throws]
 #[cfg(not(any(target_os = "windows", target_vendor = "apple")))]
 fn test_set_get_broadcast_addr() {
-    let Some(tun) = open_tun()? else {
-        return Ok(());
-    };
+    let tun = TunInterface::new()?;
     let addr = Ipv4Addr::new(10, 0, 0, 1);
     tun.set_ipv4_addr(addr)?;
 
@@ -44,9 +28,7 @@ fn test_set_get_broadcast_addr() {
 #[throws]
 #[cfg(not(target_os = "windows"))]
 fn test_set_get_ipv4() {
-    let Some(tun) = open_tun()? else {
-        return Ok(());
-    };
+    let tun = TunInterface::new()?;
 
     let addr = Ipv4Addr::new(10, 0, 0, 1);
     tun.set_ipv4_addr(addr)?;
@@ -61,12 +43,10 @@ fn test_set_get_ipv4() {
 fn test_set_get_ipv6() {
     use std::net::Ipv6Addr;
 
-    let Some(tun) = open_tun()? else {
-        return Ok(());
-    };
+    let tun = TunInterface::new()?;
 
     let addr = Ipv6Addr::new(1, 1, 1, 1, 1, 1, 1, 1);
-    tun.add_ipv6_addr(addr, 128)?;
+    tun.set_ipv6_addr(addr)?;
 
     // let result = tun.ipv6_addr()?;
     // assert_eq!(addr, result);
@@ -76,9 +56,7 @@ fn test_set_get_ipv6() {
 #[throws]
 #[cfg(not(target_os = "windows"))]
 fn test_set_get_mtu() {
-    let Some(interf) = open_tun()? else {
-        return Ok(());
-    };
+    let interf = TunInterface::new()?;
 
     interf.set_mtu(500)?;
 
@@ -89,9 +67,7 @@ fn test_set_get_mtu() {
 #[throws]
 #[cfg(not(target_os = "windows"))]
 fn test_set_get_netmask() {
-    let Some(interf) = open_tun()? else {
-        return Ok(());
-    };
+    let interf = TunInterface::new()?;
 
     let netmask = Ipv4Addr::new(255, 0, 0, 0);
     let addr = Ipv4Addr::new(192, 168, 1, 1);
diff --git a/tun/tests/packets.rs b/tun/tests/packets.rs
index b9607b3..28090a2 100644
--- a/tun/tests/packets.rs
+++ b/tun/tests/packets.rs
@@ -1,4 +1,3 @@
-use std::net::Ipv6Addr;
 use std::{io::Error, net::Ipv4Addr};
 
 use fehler::throws;
@@ -34,15 +33,3 @@ fn write_packets() {
     let bytes_written = tun.send(&buf)?;
     assert_eq!(bytes_written, 1504);
 }
-
-#[test]
-#[throws]
-#[ignore = "requires interactivity"]
-#[cfg(not(target_os = "windows"))]
-fn set_ipv6() {
-    let tun = TunInterface::new()?;
-    println!("tun name: {:?}", tun.name()?);
-    let targ_addr: Ipv6Addr = "::1".parse().unwrap();
-    println!("v6 addr: {:?}", targ_addr);
-    tun.add_ipv6_addr(targ_addr, 128)?;
-}
diff --git a/tun/tests/tokio.rs b/tun/tests/tokio.rs
index 3b89777..f7cb273 100644
--- a/tun/tests/tokio.rs
+++ b/tun/tests/tokio.rs
@@ -1,27 +1,9 @@
-#[cfg(all(feature = "tokio", not(target_os = "windows")))]
 use std::net::Ipv4Addr;
 
-#[cfg(all(feature = "tokio", not(target_os = "windows")))]
-fn open_tun() -> Option<tun::TunInterface> {
-    match tun::TunInterface::new() {
-        Ok(tun) => Some(tun),
-        Err(err)
-            if err.kind() == std::io::ErrorKind::PermissionDenied
-                || matches!(err.raw_os_error(), Some(1 | 13)) =>
-        {
-            eprintln!("skipping tokio tun test without tunnel privileges: {err}");
-            None
-        }
-        Err(err) => panic!("failed to create tun interface: {err}"),
-    }
-}
-
 #[tokio::test]
 #[cfg(all(feature = "tokio", not(target_os = "windows")))]
 async fn test_create() {
-    let Some(tun) = open_tun() else {
-        return;
-    };
+    let tun = tun::TunInterface::new().unwrap();
     let _ = tun::tokio::TunInterface::new(tun).unwrap();
 }
 
@@ -29,9 +11,7 @@ async fn test_create() {
 #[ignore = "requires interactivity"]
 #[cfg(all(feature = "tokio", not(target_os = "windows")))]
 async fn test_write() {
-    let Some(tun) = open_tun() else {
-        return;
-    };
+    let tun = tun::TunInterface::new().unwrap();
     tun.set_ipv4_addr(Ipv4Addr::from([192, 168, 1, 10]))
         .unwrap();
     let async_tun = tun::tokio::TunInterface::new(tun).unwrap();