diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 0000000..70cfb9f
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,4 @@
+reviews:
+  auto_review:
+    base_branches:
+      - develop
diff --git a/.gitignore b/.gitignore
index 5f31828..3d2e452 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,9 @@
 node_modules/
 dist/
 build/
+apps/desktop/src-tauri/binaries/*
+apps/desktop/src-tauri/gen/
+apps/desktop/src-tauri/target/
 .next/
 .expo/
 coverage/
diff --git a/README.md b/README.md
index 96ec82a..5735746 100644
--- a/README.md
+++ b/README.md
@@ -67,6 +67,12 @@ Start only the API sidecar in watch mode:
 pnpm --filter @edutrack/api run dev
 ```
 
+Start the desktop shell in development mode:
+
+```bash
+pnpm --filter @edutrack/desktop run dev
+```
+
 ## Quality Commands
 
 ```bash
@@ -97,7 +103,7 @@ Runs TypeScript project-reference checks across all active packages and apps.
 pnpm run test
 ```
 
-Runs the unit test suites for the API and web app.
+Runs the unit test suites for the database package, API and web app.
 
 ```bash
 pnpm run test:e2e
@@ -113,7 +119,19 @@ pnpm exec playwright install chromium
 pnpm run build
 ```
 
-Builds all active packages and apps.
+Builds the shared packages, database package, API and web app. Desktop packaging is handled separately through `pnpm run build:desktop`.
+
+```bash
+pnpm run check:desktop
+```
+
+Builds the Windows sidecar executable and runs the Tauri/Rust compile check.
+
+```bash
+pnpm run verify:sidecar
+```
+
+Starts the packaged Windows sidecar, calls `/health` with the local capability header, and confirms the SQLite probe database is created.
 
 ## Database Commands
 
@@ -123,12 +141,20 @@ Generate SQLite migrations from the Drizzle schema:
 pnpm run db:generate
 ```
 
-Push the SQLite schema to the configured local database:
+Apply committed SQLite migrations to the configured local database:
 
 ```bash
 pnpm run db:migrate
 ```
 
+For local schema prototyping only, `pnpm --filter @edutrack/db run db:push` can push the current Drizzle schema without using committed migrations.
+
+Seed deterministic Phase 1 foundation data:
+
+```bash
+pnpm run db:seed
+```
+
 By default, local SQLite uses:
 
 ```text
@@ -137,6 +163,34 @@ By default, local SQLite uses:
 
 Override it with `EDUTRACK_SQLITE_PATH` in `.env`.
 
+## Git Bash Convenience Scripts
+
+These scripts only group existing `pnpm` commands for local development convenience. The source of truth remains the `package.json` scripts above.
+
+```bash
+./scripts/db-setup.sh
+```
+
+Creates `.data`, runs migrations, seeds foundation data and prints the SQLite path for DBeaver.
+
+```bash
+./scripts/db-fresh.sh
+```
+
+Resets only the local development SQLite database after an explicit `RESET` confirmation, then migrates and seeds again.
+
+```bash
+./scripts/dev-verify.sh
+```
+
+Runs formatting check, lint, typecheck, unit tests and production build.
+
+```bash
+./scripts/phase-1-check.sh
+```
+
+Runs the current Phase 1 verification flow, including database setup, sidecar verification and desktop checks.
+
 ## Package-Specific Commands
 
 ```bash
@@ -151,11 +205,21 @@ Runs web-only development, build, tests, and preview.
 ```bash
 pnpm --filter @edutrack/api run dev
 pnpm --filter @edutrack/api run build
+pnpm --filter @edutrack/api run build:sidecar
+pnpm --filter @edutrack/api run verify:sidecar
 pnpm --filter @edutrack/api run start
 pnpm --filter @edutrack/api run test
 ```
 
-Runs API-only development, build, compiled start, and tests.
+Runs API-only development, build, packaged Windows sidecar build, packaged sidecar verification, compiled start, and tests.
+
+```bash
+pnpm --filter @edutrack/desktop run dev
+pnpm --filter @edutrack/desktop run check
+pnpm --filter @edutrack/desktop run build
+```
+
+Runs the Tauri desktop shell, sidecar-backed Rust/Tauri compile check, and Windows installer build.
 
 ```bash
 pnpm --filter @edutrack/domain run build
@@ -185,3 +249,5 @@ docs/
 ## Version 1 Scope Notes
 
 Version 1 is local and SQLite-only. Next.js, mobile apps, cloud sync, PostgreSQL runtime configuration, finance, attendance, parent/student portals, notifications, and remote web access are intentionally out of scope unless a later ADR approves them.
+
+The Phase 1 deployment spike is documented in `docs/deployment/phase-1-deployment-spike.md`.
diff --git a/apps/api/package.json b/apps/api/package.json
index 9bc7c9a..3191ba9 100644
--- a/apps/api/package.json
+++ b/apps/api/package.json
@@ -7,6 +7,8 @@
   "scripts": {
     "dev": "tsx watch src/index.ts",
     "build": "tsc",
+    "build:sidecar": "pnpm --filter @edutrack/shared run build && pnpm --filter @edutrack/db run build && pnpm run build && node scripts/build-sidecar.mjs",
+    "verify:sidecar": "node scripts/verify-sidecar.mjs",
     "start": "node dist/index.js",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run --config vitest.config.ts"
@@ -14,10 +16,13 @@
   "dependencies": {
     "@edutrack/db": "workspace:*",
     "@edutrack/shared": "workspace:*",
+    "better-sqlite3": "13.0.2",
     "fastify": "^4.26.0"
   },
   "devDependencies": {
     "@types/node": "^24.10.1",
+    "@yao-pkg/pkg": "6.22.0",
+    "esbuild": "0.28.2",
     "tsx": "^4.23.12",
     "typescript": "^5.9.3"
   }
diff --git a/apps/api/pkg.sidecar.config.cjs b/apps/api/pkg.sidecar.config.cjs
new file mode 100644
index 0000000..fe723f9
--- /dev/null
+++ b/apps/api/pkg.sidecar.config.cjs
@@ -0,0 +1,7 @@
+module.exports = {
+  assets: [
+    'node_modules/better-sqlite3/prebuilds/win32-x64.node',
+    '../../packages/db/migrations/sqlite/**/*',
+  ],
+  publicPackages: ['better-sqlite3'],
+};
diff --git a/apps/api/scripts/build-sidecar.mjs b/apps/api/scripts/build-sidecar.mjs
new file mode 100644
index 0000000..e6400ab
--- /dev/null
+++ b/apps/api/scripts/build-sidecar.mjs
@@ -0,0 +1,106 @@
+import { spawnSync } from 'node:child_process';
+import { mkdirSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { build } from 'esbuild';
+
+const require = createRequire(import.meta.url);
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+const packageRoot = resolve(scriptDir, '..');
+const workspaceRoot = resolve(packageRoot, '..', '..');
+const binariesDir = join(workspaceRoot, 'apps', 'desktop', 'src-tauri', 'binaries');
+const sidecarName = 'edutrack-api-sidecar';
+const pkgCliPath = require.resolve('@yao-pkg/pkg/lib-es5/bin.js');
+const bundledEntryPath = join(packageRoot, 'dist', 'sidecar.cjs');
+const pkgConfigPath = join(packageRoot, 'pkg.sidecar.config.cjs');
+
+const rustcVersion = commandOutput('rustc', ['-vV']);
+const targetTriple = parseRustHostTriple(rustcVersion);
+
+if (!targetTriple.endsWith('windows-msvc')) {
+  throw new Error(
+    `The Phase 1.2 sidecar spike currently targets Windows MSVC, got ${targetTriple}.`
+  );
+}
+
+mkdirSync(binariesDir, { recursive: true });
+
+const outputPath = join(binariesDir, `${sidecarName}-${targetTriple}.exe`);
+
+await build({
+  entryPoints: [join(packageRoot, 'dist', 'index.js')],
+  bundle: true,
+  platform: 'node',
+  target: 'node24',
+  format: 'cjs',
+  external: ['better-sqlite3'],
+  outfile: bundledEntryPath,
+  logLevel: 'info',
+  logOverride: {
+    'empty-import-meta': 'silent',
+  },
+});
+
+run(process.execPath, [
+  pkgCliPath,
+  bundledEntryPath,
+  '--config',
+  pkgConfigPath,
+  '--targets',
+  'node24-win-x64',
+  '--output',
+  outputPath,
+]);
+
+console.log(`Built ${outputPath}`);
+
+function commandOutput(command, args) {
+  const result = spawnSync(command, args, {
+    cwd: workspaceRoot,
+    encoding: 'utf8',
+  });
+
+  if (result.status !== 0) {
+    throw new Error(commandFailureMessage(command, args, result));
+  }
+
+  return result.stdout.trim();
+}
+
+function run(command, args) {
+  const result = spawnSync(command, args, {
+    cwd: packageRoot,
+    stdio: 'inherit',
+  });
+
+  if (result.status !== 0) {
+    throw new Error(commandFailureMessage(command, args, result));
+  }
+}
+
+function parseRustHostTriple(rustcVersion) {
+  const hostLine = rustcVersion.split(/\r?\n/).find((line) => line.startsWith('host:'));
+
+  if (!hostLine) {
+    throw new Error('Could not determine the Rust host triple from rustc -vV output.');
+  }
+
+  const hostTriple = hostLine.slice('host:'.length).trim();
+
+  if (!hostTriple) {
+    throw new Error('Rust host triple was empty in rustc -vV output.');
+  }
+
+  return hostTriple;
+}
+
+function commandFailureMessage(command, args, result) {
+  const invocation = `${command} ${args.join(' ')}`;
+
+  if (result.error) {
+    return `Command failed: ${invocation}\n${result.error.name}: ${result.error.message}`;
+  }
+
+  return result.stderr?.trim() || `Command failed: ${invocation}`;
+}
diff --git a/apps/api/scripts/verify-sidecar.mjs b/apps/api/scripts/verify-sidecar.mjs
new file mode 100644
index 0000000..b2eefbf
--- /dev/null
+++ b/apps/api/scripts/verify-sidecar.mjs
@@ -0,0 +1,280 @@
+import { spawn } from 'node:child_process';
+import { existsSync, mkdtempSync, readdirSync, rmSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { fileURLToPath } from 'node:url';
+import { CAPABILITY_HEADER } from '../dist/sidecar-contract.js';
+
+const require = createRequire(import.meta.url);
+const scriptDir = fileURLToPath(new URL('.', import.meta.url));
+const packageRoot = resolve(scriptDir, '..');
+const workspaceRoot = resolve(packageRoot, '..', '..');
+const binariesDir = join(workspaceRoot, 'apps', 'desktop', 'src-tauri', 'binaries');
+const sidecarPath = process.env.EDUTRACK_SIDECAR_PATH ?? resolveSidecarPath();
+const verificationToken = 'phase-1-sidecar-verification-token';
+const tempDir = mkdtempSync(join(tmpdir(), 'edutrack-sidecar-'));
+const sqlitePath = join(tempDir, 'edutrack.sqlite');
+
+let sidecar;
+let verificationError;
+let cleanupFailure;
+
+try {
+  sidecar = spawn(sidecarPath, [], {
+    cwd: packageRoot,
+    env: {
+      ...process.env,
+      EDUTRACK_API_HOST: '127.0.0.1',
+      EDUTRACK_API_PORT: '0',
+      EDUTRACK_ALLOWED_ORIGIN: 'tauri://localhost;http://127.0.0.1:5173',
+      EDUTRACK_SIDECAR_TOKEN: verificationToken,
+      EDUTRACK_SQLITE_PATH: sqlitePath,
+      LOG_LEVEL: 'error',
+      NODE_ENV: 'production',
+    },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+
+  const readyPayload = await waitForReadyPayload(sidecar);
+  const healthUrl = `http://${readyPayload.host}:${readyPayload.port}${readyPayload.healthPath}`;
+  const response = await fetch(healthUrl, {
+    headers: {
+      Origin: 'tauri://localhost',
+      [CAPABILITY_HEADER]: verificationToken,
+    },
+  });
+
+  if (!response.ok) {
+    throw new Error(`Health check failed with HTTP ${response.status}.`);
+  }
+
+  const body = await response.json();
+  const database = body?.data?.database;
+
+  if (!body?.success || database?.migrated !== true) {
+    throw new Error(`Health check returned an unhealthy payload: ${JSON.stringify(body)}`);
+  }
+
+  if (!existsSync(sqlitePath)) {
+    throw new Error(`Expected SQLite database was not created at ${sqlitePath}.`);
+  }
+
+  verifyApplicationTables(sqlitePath);
+
+  console.log(`Sidecar verified at ${healthUrl}`);
+  console.log(`SQLite probe database created at ${sqlitePath}`);
+} catch (error) {
+  verificationError = error;
+} finally {
+  const cleanupErrors = [];
+
+  if (sidecar) {
+    try {
+      await stopSidecar(sidecar);
+    } catch (error) {
+      cleanupErrors.push(error);
+    }
+  }
+
+  if (process.env.EDUTRACK_KEEP_VERIFY_DB !== '1') {
+    try {
+      await removeTempDir(tempDir);
+    } catch (error) {
+      cleanupErrors.push(error);
+    }
+  }
+
+  if (cleanupErrors.length > 0) {
+    const cleanupError = new AggregateError(cleanupErrors, 'Sidecar verification cleanup failed.');
+
+    if (verificationError) {
+      console.warn(cleanupError.message);
+      for (const error of cleanupErrors) {
+        console.warn(error);
+      }
+    } else {
+      cleanupFailure = cleanupError;
+    }
+  }
+}
+
+if (verificationError) {
+  throw verificationError;
+}
+
+if (cleanupFailure) {
+  throw cleanupFailure;
+}
+
+function resolveSidecarPath() {
+  if (!existsSync(binariesDir)) {
+    throw new Error('Sidecar binary directory is missing. Run build:sidecar first.');
+  }
+
+  const sidecar = readdirSync(binariesDir).find((file) =>
+    /^edutrack-api-sidecar-.+\.exe$/.test(file)
+  );
+
+  if (!sidecar) {
+    throw new Error('Sidecar executable is missing. Run build:sidecar first.');
+  }
+
+  return join(binariesDir, sidecar);
+}
+
+function waitForReadyPayload(child) {
+  return new Promise((resolveReady, rejectReady) => {
+    let settled = false;
+    let stdout = '';
+    let stderr = '';
+    let lineBuffer = '';
+
+    const timer = setTimeout(() => {
+      rejectOnce(
+        new Error(
+          `Timed out waiting for the sidecar ready payload.\nstdout:\n${stdout}\nstderr:\n${stderr}`
+        )
+      );
+    }, 15_000);
+
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+
+    child.stdout.on('data', (chunk) => {
+      stdout += chunk;
+      lineBuffer += chunk;
+
+      const lines = lineBuffer.split(/\r?\n/);
+      lineBuffer = lines.pop() ?? '';
+
+      for (const line of lines) {
+        const payload = parseReadyLine(line);
+
+        if (payload) {
+          resolveOnce(payload);
+          return;
+        }
+      }
+    });
+
+    child.stderr.on('data', (chunk) => {
+      stderr += chunk;
+    });
+
+    child.on('error', rejectOnce);
+    child.on('exit', (code, signal) => {
+      rejectOnce(
+        new Error(
+          `Sidecar exited before it became ready. code=${code} signal=${signal}\nstdout:\n${stdout}\nstderr:\n${stderr}`
+        )
+      );
+    });
+
+    function resolveOnce(payload) {
+      if (settled) {
+        return;
+      }
+
+      settled = true;
+      clearTimeout(timer);
+      resolveReady(payload);
+    }
+
+    function rejectOnce(error) {
+      if (settled) {
+        return;
+      }
+
+      settled = true;
+      clearTimeout(timer);
+      rejectReady(error);
+    }
+  });
+}
+
+function parseReadyLine(line) {
+  try {
+    const payload = JSON.parse(line);
+
+    if (payload?.type === 'edutrack-sidecar-ready') {
+      return payload;
+    }
+  } catch {
+    return null;
+  }
+
+  return null;
+}
+
+async function stopSidecar(child) {
+  if (child.exitCode !== null || child.signalCode !== null) {
+    return;
+  }
+
+  const exited = waitForExit(child);
+
+  if (!child.killed) {
+    child.kill();
+  }
+
+  await exited;
+}
+
+function waitForExit(child) {
+  return new Promise((resolveExit) => {
+    const timeout = setTimeout(resolveExit, 5_000);
+
+    child.once('exit', () => {
+      clearTimeout(timeout);
+      resolveExit();
+    });
+  });
+}
+
+async function removeTempDir(path) {
+  const attempts = 3;
+
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      rmSync(path, { recursive: true, force: true });
+      return;
+    } catch (error) {
+      if (attempt === attempts) {
+        throw error;
+      }
+
+      await sleep(100 * attempt);
+    }
+  }
+}
+
+function verifyApplicationTables(databasePath) {
+  const Database = require('better-sqlite3');
+  const sqlite = new Database(databasePath, { readonly: true });
+
+  try {
+    const expectedTables = ['school', 'user', 'audit_log', 'schema_metadata'];
+    const rows = sqlite
+      .prepare(
+        `
+          SELECT name
+          FROM sqlite_master
+          WHERE type = 'table'
+            AND name IN (${expectedTables.map(() => '?').join(', ')})
+        `
+      )
+      .all(...expectedTables);
+    const tableNames = new Set(rows.map((row) => row.name));
+    const missingTables = expectedTables.filter((tableName) => !tableNames.has(tableName));
+
+    if (missingTables.length > 0) {
+      throw new Error(
+        `Packaged sidecar did not apply application migrations. Missing tables: ${missingTables.join(', ')}`
+      );
+    }
+  } finally {
+    sqlite.close();
+  }
+}
diff --git a/apps/api/src/index.ts b/apps/api/src/index.ts
index 8ac8814..24becf0 100644
--- a/apps/api/src/index.ts
+++ b/apps/api/src/index.ts
@@ -1,12 +1,28 @@
-import { buildServer, getListenOptions } from './server.js';
+import { buildServer, createSidecarReadyPayload, getListenOptions } from './server.js';
 
 async function start() {
-  const server = buildServer();
+  let server: ReturnType<typeof buildServer> | undefined;
 
   try {
-    await server.listen(getListenOptions());
+    server = buildServer();
+    const listenOptions = getListenOptions();
+
+    await server.listen(listenOptions);
+    const address = server.server.address();
+    const port =
+      typeof address === 'object' && address !== null ? address.port : listenOptions.port;
+
+    process.stdout.write(
+      `${JSON.stringify(createSidecarReadyPayload(listenOptions.host, port))}\n`
+    );
   } catch (error) {
-    server.log.error({ err: error }, 'Failed to start EduTrack API sidecar');
+    if (server) {
+      server.log.error({ err: error }, 'Failed to start EduTrack API sidecar');
+    } else {
+      const message = error instanceof Error ? error.message : String(error);
+      process.stderr.write(`Failed to start EduTrack API sidecar: ${message}\n`);
+    }
+
     process.exit(1);
   }
 }
diff --git a/apps/api/src/server.test.ts b/apps/api/src/server.test.ts
index 21d941a..af1bd30 100644
--- a/apps/api/src/server.test.ts
+++ b/apps/api/src/server.test.ts
@@ -1,9 +1,43 @@
-import { describe, expect, it } from 'vitest';
-import { buildServer, createLoggerOptions, getListenOptions } from './server.js';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, describe, expect, it } from 'vitest';
+import {
+  buildServer,
+  CAPABILITY_HEADER,
+  createLoggerOptions,
+  createSidecarReadyPayload,
+  createSidecarSecurityOptions,
+  getListenOptions,
+} from './server.js';
+
+const databaseStatus = {
+  sqlitePath: 'C:\\Users\\Test\\AppData\\Roaming\\EduTrack\\edutrack.sqlite',
+  migrated: true,
+  migrationId: 'deployment-probe-0001',
+};
+
+interface HealthResponseBody {
+  data: {
+    database: {
+      sqlitePath: string;
+      migrated: boolean;
+    };
+  };
+}
 
 describe('api sidecar foundation', () => {
+  let tempDir: string | undefined;
+
+  afterEach(() => {
+    if (tempDir) {
+      rmSync(tempDir, { recursive: true, force: true });
+      tempDir = undefined;
+    }
+  });
+
   it('returns the health response envelope', async () => {
-    const server = buildServer({ logger: false });
+    const server = buildServer({ databaseStatus, logger: false });
 
     const response = await server.inject({
       method: 'GET',
@@ -16,11 +50,47 @@ describe('api sidecar foundation', () => {
       data: {
         service: 'EduTrack Africa',
         status: 'ok',
+        database: databaseStatus,
       },
       message: 'OK',
     });
   });
 
+  it('applies application migrations before reporting database readiness', async () => {
+    const migratedPaths: string[] = [];
+    const previousSqlitePath = process.env.EDUTRACK_SQLITE_PATH;
+    tempDir = mkdtempSync(join(tmpdir(), 'edutrack-api-test-'));
+    process.env.EDUTRACK_SQLITE_PATH = join(tempDir, 'edutrack.sqlite');
+
+    try {
+      const server = buildServer({
+        logger: false,
+        security: {
+          allowedOrigins: ['tauri://localhost'],
+        },
+        migrateApplicationDatabase: (sqlitePath) => {
+          migratedPaths.push(sqlitePath);
+        },
+      });
+
+      const response = await server.inject({
+        method: 'GET',
+        url: '/health',
+      });
+      const body = response.json<HealthResponseBody>();
+
+      expect(response.statusCode).toBe(200);
+      expect(migratedPaths).toEqual([body.data.database.sqlitePath]);
+      expect(body.data.database.migrated).toBe(true);
+    } finally {
+      if (previousSqlitePath === undefined) {
+        delete process.env.EDUTRACK_SQLITE_PATH;
+      } else {
+        process.env.EDUTRACK_SQLITE_PATH = previousSqlitePath;
+      }
+    }
+  });
+
   it('redacts sensitive fields from logs by default', () => {
     const loggerOptions = createLoggerOptions();
 
@@ -31,13 +101,146 @@ describe('api sidecar foundation', () => {
     });
     expect(loggerOptions.redact.paths).toContain('req.headers.authorization');
     expect(loggerOptions.redact.paths).toContain('req.headers.cookie');
+    expect(loggerOptions.redact.paths).toContain(`req.headers['${CAPABILITY_HEADER}']`);
     expect(loggerOptions.redact.paths).toContain('body.password');
   });
 
+  it('rejects unexpected origins', async () => {
+    const server = buildServer({
+      databaseStatus,
+      logger: false,
+      security: {
+        allowedOrigins: ['tauri://localhost'],
+      },
+    });
+
+    const response = await server.inject({
+      method: 'GET',
+      url: '/health',
+      headers: {
+        origin: 'https://example.com',
+      },
+    });
+
+    expect(response.statusCode).toBe(403);
+    expect(response.json()).toMatchObject({
+      success: false,
+      error: {
+        code: 'UNEXPECTED_ORIGIN',
+      },
+    });
+  });
+
+  it('rejects missing or invalid sidecar capability tokens', async () => {
+    const server = buildServer({
+      databaseStatus,
+      logger: false,
+      security: {
+        allowedOrigins: ['tauri://localhost'],
+        capabilityToken: 'expected-token',
+      },
+    });
+
+    const missingTokenResponse = await server.inject({
+      method: 'GET',
+      url: '/health',
+      headers: {
+        origin: 'tauri://localhost',
+      },
+    });
+
+    expect(missingTokenResponse.statusCode).toBe(403);
+    expect(missingTokenResponse.json()).toMatchObject({
+      success: false,
+      error: {
+        code: 'INVALID_CAPABILITY',
+      },
+    });
+
+    const invalidTokenResponse = await server.inject({
+      method: 'GET',
+      url: '/health',
+      headers: {
+        origin: 'tauri://localhost',
+        [CAPABILITY_HEADER]: 'wrong-token',
+      },
+    });
+
+    expect(invalidTokenResponse.statusCode).toBe(403);
+    expect(invalidTokenResponse.json()).toMatchObject({
+      success: false,
+      error: {
+        code: 'INVALID_CAPABILITY',
+      },
+    });
+  });
+
+  it('accepts expected origins and capability tokens', async () => {
+    const server = buildServer({
+      databaseStatus,
+      logger: false,
+      security: {
+        allowedOrigins: ['tauri://localhost'],
+        capabilityToken: 'expected-token',
+      },
+    });
+
+    const response = await server.inject({
+      method: 'GET',
+      url: '/health',
+      headers: {
+        origin: 'tauri://localhost',
+        [CAPABILITY_HEADER]: 'expected-token',
+      },
+    });
+
+    expect(response.statusCode).toBe(200);
+  });
+
   it('binds to loopback by default', () => {
     expect(getListenOptions()).toEqual({
       host: '127.0.0.1',
       port: 0,
     });
   });
+
+  it('parses allowed origins and capability token from environment', () => {
+    expect(
+      createSidecarSecurityOptions({
+        EDUTRACK_ALLOWED_ORIGIN: 'tauri://localhost;http://127.0.0.1:5173',
+        EDUTRACK_SIDECAR_TOKEN: 'local-token',
+      })
+    ).toEqual({
+      allowedOrigins: ['tauri://localhost', 'http://127.0.0.1:5173'],
+      capabilityToken: 'local-token',
+    });
+  });
+
+  it('fails production startup when the sidecar capability token is missing', () => {
+    expect(() =>
+      createSidecarSecurityOptions({
+        NODE_ENV: 'production',
+      })
+    ).toThrow('EDUTRACK_SIDECAR_TOKEN is required in production.');
+  });
+
+  it('warns when sidecar capability checks are disabled outside production', () => {
+    const warnings: string[] = [];
+
+    expect(createSidecarSecurityOptions({}, (message) => warnings.push(message))).toEqual({
+      allowedOrigins: ['http://127.0.0.1:5173', 'http://tauri.localhost', 'tauri://localhost'],
+    });
+    expect(warnings).toEqual([
+      'EDUTRACK_SIDECAR_TOKEN is not set; local API capability checks are disabled outside production.',
+    ]);
+  });
+
+  it('creates a sidecar ready payload for Tauri supervision', () => {
+    expect(createSidecarReadyPayload('127.0.0.1', 49152)).toEqual({
+      type: 'edutrack-sidecar-ready',
+      host: '127.0.0.1',
+      port: 49152,
+      healthPath: '/health',
+    });
+  });
 });
diff --git a/apps/api/src/server.ts b/apps/api/src/server.ts
index 9810a5c..440da3e 100644
--- a/apps/api/src/server.ts
+++ b/apps/api/src/server.ts
@@ -1,8 +1,20 @@
+import {
+  applyApplicationMigrations,
+  ensureDeploymentDatabase,
+  type DeploymentDatabaseStatus,
+} from '@edutrack/db';
 import { APP_NAME, REDACTED_LOG_VALUE, SENSITIVE_LOG_FIELDS } from '@edutrack/shared';
 import Fastify, { type FastifyServerOptions } from 'fastify';
+export { CAPABILITY_HEADER } from './sidecar-contract.js';
+import { CAPABILITY_HEADER } from './sidecar-contract.js';
 
 const DEFAULT_API_HOST = '127.0.0.1';
 const DEFAULT_API_PORT = 0;
+const DEFAULT_ALLOWED_ORIGINS = [
+  'http://127.0.0.1:5173',
+  'http://tauri.localhost',
+  'tauri://localhost',
+];
 
 export interface SafeLoggerOptions {
   level: string;
@@ -12,6 +24,19 @@ export interface SafeLoggerOptions {
   };
 }
 
+export interface SidecarSecurityOptions {
+  allowedOrigins: string[];
+  capabilityToken?: string;
+}
+
+export interface BuildServerOptions extends Pick<FastifyServerOptions, 'logger'> {
+  databaseStatus?: DeploymentDatabaseStatus;
+  migrateApplicationDatabase?: (sqlitePath: string) => void;
+  security?: SidecarSecurityOptions;
+}
+
+type SecurityDowngradeWarning = (message: string) => void;
+
 export function createLoggerOptions(): SafeLoggerOptions {
   return {
     level: process.env.LOG_LEVEL ?? 'info',
@@ -22,16 +47,84 @@ export function createLoggerOptions(): SafeLoggerOptions {
   };
 }
 
-export function buildServer(options: Pick<FastifyServerOptions, 'logger'> = {}) {
+export function createSidecarSecurityOptions(
+  env: NodeJS.ProcessEnv = process.env,
+  warn?: SecurityDowngradeWarning
+): SidecarSecurityOptions {
+  const allowedOrigins = parseAllowedOrigins(env.EDUTRACK_ALLOWED_ORIGIN);
+  const capabilityToken = env.EDUTRACK_SIDECAR_TOKEN?.trim();
+
+  if (!capabilityToken) {
+    if (env.NODE_ENV === 'production') {
+      throw new Error('EDUTRACK_SIDECAR_TOKEN is required in production.');
+    }
+
+    warn?.(
+      'EDUTRACK_SIDECAR_TOKEN is not set; local API capability checks are disabled outside production.'
+    );
+
+    return { allowedOrigins };
+  }
+
+  return {
+    allowedOrigins,
+    capabilityToken,
+  };
+}
+
+export function buildServer(options: BuildServerOptions = {}) {
   const server = Fastify({
     logger: options.logger ?? createLoggerOptions(),
   });
+  const security =
+    options.security ??
+    createSidecarSecurityOptions(process.env, (message) => {
+      server.log.warn({ code: 'SIDECAR_CAPABILITY_DISABLED' }, message);
+    });
+  const databaseStatus =
+    options.databaseStatus ??
+    (() => {
+      const deploymentStatus = ensureDeploymentDatabase();
+      const migrateApplicationDatabase =
+        options.migrateApplicationDatabase ?? applyApplicationMigrations;
+      migrateApplicationDatabase(deploymentStatus.sqlitePath);
+      return deploymentStatus;
+    })();
+
+  server.addHook('onRequest', async (request, reply) => {
+    const origin = request.headers.origin;
+
+    if (origin && !security.allowedOrigins.includes(origin)) {
+      return reply.code(403).send({
+        success: false,
+        error: {
+          code: 'UNEXPECTED_ORIGIN',
+          message: "L'origine de la requête locale est refusée.",
+        },
+      });
+    }
+
+    if (security.capabilityToken) {
+      const capability = request.headers[CAPABILITY_HEADER];
+
+      if (capability !== security.capabilityToken) {
+        return reply.code(403).send({
+          success: false,
+          error: {
+            code: 'INVALID_CAPABILITY',
+            message: "La capacité locale de l'application est invalide.",
+          },
+        });
+      }
+    }
+  });
 
   server.get('/health', () => ({
     success: true,
     data: {
       service: APP_NAME,
       status: 'ok',
+      database: databaseStatus,
     },
     message: 'OK',
   }));
@@ -52,6 +145,15 @@ export function getListenOptions() {
   };
 }
 
+export function createSidecarReadyPayload(host: string, port: number) {
+  return {
+    type: 'edutrack-sidecar-ready',
+    host,
+    port,
+    healthPath: '/health',
+  };
+}
+
 function parsePort(rawPort: string | undefined) {
   if (!rawPort) {
     return DEFAULT_API_PORT;
@@ -65,3 +167,14 @@ function parsePort(rawPort: string | undefined) {
 
   return port;
 }
+
+function parseAllowedOrigins(rawOrigins: string | undefined) {
+  if (!rawOrigins) {
+    return [...DEFAULT_ALLOWED_ORIGINS];
+  }
+
+  return rawOrigins
+    .split(/[;,]/)
+    .map((origin) => origin.trim())
+    .filter((origin) => origin.length > 0);
+}
diff --git a/apps/api/src/sidecar-contract.ts b/apps/api/src/sidecar-contract.ts
new file mode 100644
index 0000000..c2adc1c
--- /dev/null
+++ b/apps/api/src/sidecar-contract.ts
@@ -0,0 +1 @@
+export const CAPABILITY_HEADER = 'x-edutrack-capability';
diff --git a/apps/api/vitest.config.ts b/apps/api/vitest.config.ts
index 7eeb3f8..4d26619 100644
--- a/apps/api/vitest.config.ts
+++ b/apps/api/vitest.config.ts
@@ -1,6 +1,15 @@
 import { defineConfig } from 'vitest/config';
+import { fileURLToPath, URL } from 'node:url';
 
 export default defineConfig({
+  resolve: {
+    alias: {
+      '@edutrack/db': fileURLToPath(new URL('../../packages/db/src/index.ts', import.meta.url)),
+      '@edutrack/shared': fileURLToPath(
+        new URL('../../packages/shared/src/index.ts', import.meta.url)
+      ),
+    },
+  },
   test: {
     environment: 'node',
     include: ['src/**/*.test.ts'],
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index a49c6c2..90aa53f 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -4,7 +4,8 @@
   "private": true,
   "scripts": {
     "dev": "tauri dev",
-    "build": "tauri build"
+    "build": "tauri build",
+    "check": "pnpm --filter @edutrack/api run build:sidecar && cargo check --manifest-path src-tauri/Cargo.toml"
   },
   "devDependencies": {
     "@tauri-apps/cli": "^2.0.0"
diff --git a/apps/desktop/src-tauri/Cargo.lock b/apps/desktop/src-tauri/Cargo.lock
new file mode 100644
index 0000000..fed5d7a
--- /dev/null
+++ b/apps/desktop/src-tauri/Cargo.lock
@@ -0,0 +1,4495 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "alloc-no-stdlib"
+version = "2.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
+
+[[package]]
+name = "alloc-stdlib"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e76a019e91224d279006ff972f1e984179a6e9feb050adba6ce8274aef23195"
+dependencies = [
+ "alloc-no-stdlib",
+]
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
+[[package]]
+name = "atk"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "241b621213072e993be4f6f3a9e4b45f65b7e6faad43001be957184b7bb1824b"
+dependencies = [
+ "atk-sys",
+ "glib",
+ "libc",
+]
+
+[[package]]
+name = "atk-sys"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5e48b684b0ca77d2bbadeef17424c2ea3c897d44d566a1617e7e8f30614d086"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "base64"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bit-set"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
+dependencies = [
+ "bit-vec",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block2"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5"
+dependencies = [
+ "objc2",
+]
+
+[[package]]
+name = "brotli"
+version = "8.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cc91aac060a7a1e25823bdccbfb6af1875b88f17c6daac97894eed8207166b3"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+ "brotli-decompressor",
+]
+
+[[package]]
+name = "brotli-decompressor"
+version = "5.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a32acac15fe1967bc3986b2a6347dffc965602354ea6f450ad07e8bfd253583"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+]
+
+[[package]]
+name = "bs58"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "bytemuck"
+version = "1.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "cairo-rs"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ca26ef0159422fb77631dc9d17b102f253b876fe1586b03b803e63a309b4ee2"
+dependencies = [
+ "bitflags 2.13.1",
+ "cairo-sys-rs",
+ "glib",
+ "libc",
+ "once_cell",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "cairo-sys-rs"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "685c9fa8e590b8b3d678873528d83411db17242a73fccaed827770ea0fedda51"
+dependencies = [
+ "glib-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "camino"
+version = "1.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb1307f12aa967b5a58416e87b3653360e0fd614a016b6e970db08fecbb1b80d"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "cargo-platform"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e35af189006b9c0f00a064685c727031e3ed2d8020f7ba284d78cc2671bd36ea"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "cargo_metadata"
+version = "0.19.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd5eb614ed4c27c5d706420e4320fbe3216ab31fa1c33cd8246ac36dae4479ba"
+dependencies = [
+ "camino",
+ "cargo-platform",
+ "semver",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "cargo_toml"
+version = "0.22.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "374b7c592d9c00c1f4972ea58390ac6b18cbb6ab79011f3bdc90a0b82ca06b77"
+dependencies = [
+ "serde",
+ "toml 0.9.12+spec-1.1.0",
+]
+
+[[package]]
+name = "cc"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d262e149917187838d5b42777c8253bcb64500067342904e7d429499a6f277e"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cesu8"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
+
+[[package]]
+name = "cfb"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d38f2da7a0a2c4ccf0065be06397cc26a81f4e528be095826eee9d4adbb8c60f"
+dependencies = [
+ "byteorder",
+ "fnv",
+ "uuid",
+]
+
+[[package]]
+name = "cfg-expr"
+version = "0.15.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d067ad48b8650848b989a59a86c6c36a995d02d2bf778d45c3c5d57bc2718f02"
+dependencies = [
+ "smallvec",
+ "target-lexicon",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "iana-time-zone",
+ "num-traits",
+ "serde",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "combine"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "cookie"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a373e3602691c3cdea496d2f0ee5935151e6168fe87739483c463db1b2f2f87"
+dependencies = [
+ "time",
+ "version_check",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "core-graphics"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "064badf302c3194842cf2c5d61f56cc88e54a759313879cdf03abdd27d0c3b97"
+dependencies = [
+ "bitflags 2.13.1",
+ "core-foundation",
+ "core-graphics-types",
+ "foreign-types",
+ "libc",
+]
+
+[[package]]
+name = "core-graphics-types"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d44a101f213f6c4cdc1853d4b78aef6db6bdfa3468798cc1d9912f4735013eb"
+dependencies = [
+ "bitflags 2.13.1",
+ "core-foundation",
+ "libc",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d85363c37faeca707aef026efa9f3b34d077bce547e48f770770625c6013679e"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "cssparser"
+version = "0.36.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dae61cf9c0abb83bd659dab65b7e4e38d8236824c85f0f804f173567bda257d2"
+dependencies = [
+ "cssparser-macros",
+ "dtoa-short",
+ "itoa",
+ "phf",
+ "smallvec",
+]
+
+[[package]]
+name = "cssparser-macros"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331"
+dependencies = [
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "ctor"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "352d39c2f7bef1d6ad73db6f5160efcaed66d94ef8c6c573a8410c00bf909a98"
+dependencies = [
+ "ctor-proc-macro",
+ "dtor",
+]
+
+[[package]]
+name = "ctor-proc-macro"
+version = "0.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52560adf09603e58c9a7ee1fe1dcb95a16927b17c127f0ac02d6e768a0e25bc1"
+
+[[package]]
+name = "darling"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "dbus"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ab69f03cc8c4340c9c8e315114e1658e6775a9b16a04357973aa21cec22b32e"
+dependencies = [
+ "libc",
+ "libdbus-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "defmt"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1"
+dependencies = [
+ "bitflags 1.3.2",
+ "defmt-macros",
+]
+
+[[package]]
+name = "defmt-macros"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8"
+dependencies = [
+ "defmt-parser",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "defmt-parser"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
+dependencies = [
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "derive_more"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
+dependencies = [
+ "derive_more-impl",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "dirs"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
+dependencies = [
+ "libc",
+ "option-ext",
+ "redox_users",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "dispatch2"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2",
+ "libc",
+ "objc2",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "dlopen2"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e2c5bd4158e66d1e215c49b837e11d62f3267b30c92f1d171c4d3105e3dc4d4"
+dependencies = [
+ "dlopen2_derive",
+ "libc",
+ "once_cell",
+ "winapi",
+]
+
+[[package]]
+name = "dlopen2_derive"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fbbb781877580993a8707ec48672673ec7b81eeba04cfd2310bd28c08e47c8f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "dom_query"
+version = "0.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521e380c0c8afb8d9a1e83a1822ee03556fc3e3e7dbc1fd30be14e37f9cb3f89"
+dependencies = [
+ "bit-set",
+ "cssparser",
+ "foldhash",
+ "html5ever",
+ "precomputed-hash",
+ "selectors",
+ "tendril",
+]
+
+[[package]]
+name = "dpi"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "dtoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
+
+[[package]]
+name = "dtoa-short"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87"
+dependencies = [
+ "dtoa",
+]
+
+[[package]]
+name = "dtor"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1057d6c64987086ff8ed0fd3fbf377a6b7d205cc7715868cd401705f715cbe4"
+dependencies = [
+ "dtor-proc-macro",
+]
+
+[[package]]
+name = "dtor-proc-macro"
+version = "0.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f678cf4a922c215c63e0de95eb1ff08a958a81d47e485cf9da1e27bf6305cfa5"
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
+[[package]]
+name = "edutrack_desktop"
+version = "1.0.0"
+dependencies = [
+ "getrandom 0.2.17",
+ "serde",
+ "serde_json",
+ "tauri",
+ "tauri-build",
+]
+
+[[package]]
+name = "embed-resource"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fbfdaacccebec3b28e4866b8973543c7647797db5ada1bdab552e48fe665fbbd"
+dependencies = [
+ "cc",
+ "memchr",
+ "rustc_version",
+ "toml 1.1.4+spec-1.1.0",
+ "vswhom",
+ "winreg",
+]
+
+[[package]]
+name = "embed_plist"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ef6b89e5b37196644d8796de5268852ff179b44e96276cf4290264843743bb7"
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "erased-serde"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2add8a07dd6a8d93ff627029c51de145e12686fbc36ecb298ac22e74cf02dec"
+dependencies = [
+ "serde",
+ "serde_core",
+ "typeid",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
+[[package]]
+name = "fdeflate"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
+dependencies = [
+ "simd-adler32",
+]
+
+[[package]]
+name = "field-offset"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38e2275cc4e4fc009b0669731a1e5ab7ebf11f469eaede2bab9309a5b4d6057f"
+dependencies = [
+ "memoffset",
+ "rustc_version",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b73573e6edcd2af0cdf47bd6cb58f0b3839491263c314eaad1ccf24430e1de"
+
+[[package]]
+name = "flate2"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "foreign-types"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
+dependencies = [
+ "foreign-types-macros",
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-macros"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea5190182e6915eb873ddbc16e23b711b6eb1f9c00a0d0a3a91b5f6228475225"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa9a19cbb55df58761df49b23516a86d432839add4af60fc256da840f66ed35b"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "gdk"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9f245958c627ac99d8e529166f9823fb3b838d1d41fd2b297af3075093c2691"
+dependencies = [
+ "cairo-rs",
+ "gdk-pixbuf",
+ "gdk-sys",
+ "gio",
+ "glib",
+ "libc",
+ "pango",
+]
+
+[[package]]
+name = "gdk-pixbuf"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50e1f5f1b0bfb830d6ccc8066d18db35c487b1b2b1e8589b5dfe9f07e8defaec"
+dependencies = [
+ "gdk-pixbuf-sys",
+ "gio",
+ "glib",
+ "libc",
+ "once_cell",
+]
+
+[[package]]
+name = "gdk-pixbuf-sys"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9839ea644ed9c97a34d129ad56d38a25e6756f99f3a88e15cd39c20629caf7"
+dependencies = [
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "gdk-sys"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c2d13f38594ac1e66619e188c6d5a1adb98d11b2fcf7894fc416ad76aa2f3f7"
+dependencies = [
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "pango-sys",
+ "pkg-config",
+ "system-deps",
+]
+
+[[package]]
+name = "gdkwayland-sys"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "140071d506d223f7572b9f09b5e155afbd77428cd5cc7af8f2694c41d98dfe69"
+dependencies = [
+ "gdk-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "pkg-config",
+ "system-deps",
+]
+
+[[package]]
+name = "gdkx11"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3caa00e14351bebbc8183b3c36690327eb77c49abc2268dd4bd36b856db3fbfe"
+dependencies = [
+ "gdk",
+ "gdkx11-sys",
+ "gio",
+ "glib",
+ "libc",
+ "x11",
+]
+
+[[package]]
+name = "gdkx11-sys"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2e7445fe01ac26f11601db260dd8608fe172514eb63b3b5e261ea6b0f4428d"
+dependencies = [
+ "gdk-sys",
+ "glib-sys",
+ "libc",
+ "system-deps",
+ "x11",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+]
+
+[[package]]
+name = "gio"
+version = "0.18.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4fc8f532f87b79cbc51a79748f16a6828fb784be93145a322fa14d06d354c73"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "gio-sys",
+ "glib",
+ "libc",
+ "once_cell",
+ "pin-project-lite",
+ "smallvec",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "gio-sys"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37566df850baf5e4cb0dfb78af2e4b9898d817ed9263d1090a2df958c64737d2"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+ "winapi",
+]
+
+[[package]]
+name = "glib"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "233daaf6e83ae6a12a52055f568f9d7cf4671dabb78ff9560ab6da230ce00ee5"
+dependencies = [
+ "bitflags 2.13.1",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-task",
+ "futures-util",
+ "gio-sys",
+ "glib-macros",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "memchr",
+ "once_cell",
+ "smallvec",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "glib-macros"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bb0228f477c0900c880fd78c8759b95c7636dbd7842707f49e132378aa2acdc"
+dependencies = [
+ "heck 0.4.1",
+ "proc-macro-crate 2.0.2",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "glib-sys"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "063ce2eb6a8d0ea93d2bf8ba1957e78dbab6be1c2220dd3daca57d5a9d869898"
+dependencies = [
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "glob"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
+
+[[package]]
+name = "gobject-sys"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0850127b514d1c4a4654ead6dedadb18198999985908e6ffe4436f53c785ce44"
+dependencies = [
+ "glib-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "gtk"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd56fb197bfc42bd5d2751f4f017d44ff59fbb58140c6b49f9b3b2bdab08506a"
+dependencies = [
+ "atk",
+ "cairo-rs",
+ "field-offset",
+ "futures-channel",
+ "gdk",
+ "gdk-pixbuf",
+ "gio",
+ "glib",
+ "gtk-sys",
+ "gtk3-macros",
+ "libc",
+ "pango",
+ "pkg-config",
+]
+
+[[package]]
+name = "gtk-sys"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f29a1c21c59553eb7dd40e918be54dccd60c52b049b75119d5d96ce6b624414"
+dependencies = [
+ "atk-sys",
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gdk-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "pango-sys",
+ "system-deps",
+]
+
+[[package]]
+name = "gtk3-macros"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ff3c5b21f14f0736fed6dcfc0bfb4225ebf5725f3c0209edeec181e4d73e9d"
+dependencies = [
+ "proc-macro-crate 1.3.1",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "html5ever"
+version = "0.38.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1054432bae2f14e0061e33d23402fbaa67a921d319d56adc6bcf887ddad1cbc2"
+dependencies = [
+ "log",
+ "markup5ever",
+]
+
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "hyper"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core 0.62.2",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "ico"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e795dff5605e0f04bff85ca41b51a96b83e80b281e96231bcaaf1ac35103371"
+dependencies = [
+ "byteorder",
+ "png 0.17.16",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_properties"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+
+[[package]]
+name = "icu_provider"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "infer"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a588916bfdfd92e71cacef98a63d9b1f0d74d6599980d11894290e7ddefffcf7"
+dependencies = [
+ "cfb",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a756c3fac73139e83f14c2d742155dd2b78d3ee56597b419a0579b7bdd6dd78"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "javascriptcore-rs"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca5671e9ffce8ffba57afc24070e906da7fc4b1ba66f2cabebf61bf2ea257fcc"
+dependencies = [
+ "bitflags 1.3.2",
+ "glib",
+ "javascriptcore-rs-sys",
+]
+
+[[package]]
+name = "javascriptcore-rs-sys"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af1be78d14ffa4b75b66df31840478fef72b51f8c2465d4ca7c194da9f7a5124"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "jiff"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "668b7183bd07af9a4885f5c35b0cc5c83c4607a913c16b7e17291832910d2dcc"
+dependencies = [
+ "defmt",
+ "jiff-core",
+ "jiff-static",
+ "jiff-tzdb-platform",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "jiff-core"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7feca88439efe53da3754500c1851dedf3cb36c524dd5cf8225cc0794de95d09"
+dependencies = [
+ "defmt",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a69dcb3a21cfb32ce1cd056169337ca284af0766dd766e7878819b251a49204"
+dependencies = [
+ "jiff-core",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jiff-tzdb"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "142bd39932ad231f10513df9ab62661fead8719872150b7ad02a2df79f4e141e"
+
+[[package]]
+name = "jiff-tzdb-platform"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "875a5a69ac2bab1a891711cf5eccbec1ce0341ea805560dcd90b7a2e925132e8"
+dependencies = [
+ "jiff-tzdb",
+]
+
+[[package]]
+name = "jni"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97"
+dependencies = [
+ "cesu8",
+ "cfg-if",
+ "combine",
+ "jni-sys 0.3.1",
+ "log",
+ "thiserror 1.0.69",
+ "walkdir",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41a652e1f9b6e0275df1f15b32661cf0d4b78d4d87ddec5e0c3c20f097433258"
+dependencies = [
+ "jni-sys 0.4.1",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e0c1080212aad755ea003d18543e8768dd432c48819efd73a7bf1e39b7a5a3a"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "json-patch"
+version = "3.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "863726d7afb6bc2590eeff7135d923545e5e964f004c2ccf8716c25e70a86f08"
+dependencies = [
+ "jsonptr",
+ "serde",
+ "serde_json",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "jsonptr"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5dea2b27dd239b2556ed7a25ba842fe47fd602e7fc7433c2a8d6106d4d9edd70"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "keyboard-types"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b750dcadc39a09dbadd74e118f6dd6598df77fa01df0cfcdc52c28dece74528a"
+dependencies = [
+ "bitflags 2.13.1",
+ "serde",
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "libappindicator"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03589b9607c868cc7ae54c0b2a22c8dc03dd41692d48f2d7df73615c6a95dc0a"
+dependencies = [
+ "glib",
+ "gtk",
+ "gtk-sys",
+ "libappindicator-sys",
+ "log",
+]
+
+[[package]]
+name = "libappindicator-sys"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e9ec52138abedcc58dc17a7c6c0c00a2bdb4f3427c7f63fa97fd0d859155caf"
+dependencies = [
+ "gtk-sys",
+ "libloading",
+ "once_cell",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "libdbus-sys"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "328c4789d42200f1eeec05bd86c9c13c7f091d2ba9a6ea35acdf51f31bc0f043"
+dependencies = [
+ "pkg-config",
+]
+
+[[package]]
+name = "libloading"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67380fd3b2fbe7527a606e18729d21c6f3951633d0500574c4dc22d2d638b9f"
+dependencies = [
+ "cfg-if",
+ "winapi",
+]
+
+[[package]]
+name = "libredox"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2026a5056764a10b2bf5d56488cba40da507f5493a6a429340e2004d9ed085fa"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "litemap"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+
+[[package]]
+name = "markup5ever"
+version = "0.38.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8983d30f2915feeaaab2d6babdd6bc7e9ed1a00b66b5e6d74df19aa9c0e91862"
+dependencies = [
+ "log",
+ "tendril",
+ "web_atoms",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "mio"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "muda"
+version = "0.19.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1dd04e60bc0b07438a6771710ee1698f98f6ebbc7f89b61264af1563b8aeb878"
+dependencies = [
+ "crossbeam-channel",
+ "dpi",
+ "gtk",
+ "keyboard-types",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+ "once_cell",
+ "png 0.18.1",
+ "serde",
+ "thiserror 2.0.20",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "ndk"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3f42e7bbe13d351b6bead8286a43aac9534b82bd3cc43e47037f012ebfd62d4"
+dependencies = [
+ "bitflags 2.13.1",
+ "jni-sys 0.3.1",
+ "log",
+ "ndk-sys",
+ "num_enum",
+ "raw-window-handle",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "ndk-sys"
+version = "0.6.0+11769913"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee6cda3051665f1fb8d9e08fc35c96d5a244fb1be711a03b71118828afc9a873"
+dependencies = [
+ "jni-sys 0.3.1",
+]
+
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_enum"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0bca838442ec211fa11de3a8b0e0e8f3a4522575b5c4c06ed722e005036f26"
+dependencies = [
+ "num_enum_derive",
+ "rustversion",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8"
+dependencies = [
+ "proc-macro-crate 3.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "objc2"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a12a8ed07aefc768292f076dc3ac8c48f3781c8f2d5851dd3d98950e8c5a89f"
+dependencies = [
+ "objc2-encode",
+ "objc2-exception-helper",
+]
+
+[[package]]
+name = "objc2-app-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d49e936b501e5c5bf01fda3a9452ff86dc3ea98ad5f283e1455153142d97518c"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2",
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-cloud-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73ad74d880bb43877038da939b7427bba67e9dd42004a18b809ba7d87cee241c"
+dependencies = [
+ "bitflags 2.13.1",
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-core-data"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b402a653efbb5e82ce4df10683b6b28027616a2715e90009947d50b8dd298fa"
+dependencies = [
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-core-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
+dependencies = [
+ "bitflags 2.13.1",
+ "dispatch2",
+ "objc2",
+]
+
+[[package]]
+name = "objc2-core-graphics"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e022c9d066895efa1345f8e33e584b9f958da2fd4cd116792e15e07e4720a807"
+dependencies = [
+ "bitflags 2.13.1",
+ "dispatch2",
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-io-surface",
+]
+
+[[package]]
+name = "objc2-core-image"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5d563b38d2b97209f8e861173de434bd0214cf020e3423a52624cd1d989f006"
+dependencies = [
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-core-location"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca347214e24bc973fc025fd0d36ebb179ff30536ed1f80252706db19ee452009"
+dependencies = [
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-core-text"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cde0dfb48d25d2b4862161a4d5fcc0e3c24367869ad306b0c9ec0073bfed92d"
+dependencies = [
+ "bitflags 2.13.1",
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+]
+
+[[package]]
+name = "objc2-encode"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33"
+
+[[package]]
+name = "objc2-exception-helper"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7a1c5fbb72d7735b076bb47b578523aedc40f3c439bea6dfd595c089d79d98a"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "objc2-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2",
+ "objc2",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-io-surface"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d"
+dependencies = [
+ "bitflags 2.13.1",
+ "objc2",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-quartz-core"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96c1358452b371bf9f104e21ec536d37a650eb10f7ee379fff67d2e08d537f1f"
+dependencies = [
+ "bitflags 2.13.1",
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-ui-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d87d638e33c06f577498cbcc50491496a3ed4246998a7fbba7ccb98b1e7eab22"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2",
+ "objc2",
+ "objc2-cloud-kit",
+ "objc2-core-data",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-core-image",
+ "objc2-core-location",
+ "objc2-core-text",
+ "objc2-foundation",
+ "objc2-quartz-core",
+ "objc2-user-notifications",
+]
+
+[[package]]
+name = "objc2-user-notifications"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9df9128cbbfef73cda168416ccf7f837b62737d748333bfe9ab71c245d76613e"
+dependencies = [
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-web-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2e5aaab980c433cf470df9d7af96a7b46a9d892d521a2cbbb2f8a4c16751e7f"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "option-ext"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
+
+[[package]]
+name = "pango"
+version = "0.18.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ca27ec1eb0457ab26f3036ea52229edbdb74dee1edd29063f5b9b010e7ebee4"
+dependencies = [
+ "gio",
+ "glib",
+ "libc",
+ "once_cell",
+ "pango-sys",
+]
+
+[[package]]
+name = "pango-sys"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "436737e391a843e5933d6d9aa102cb126d501e815b83601365a948a518555dc5"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "phf"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+dependencies = [
+ "phf_macros",
+ "phf_shared",
+ "serde",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+dependencies = [
+ "fastrand",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "plist"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da1d65da6dd5d1e44199ac0f58712d241c0f439f80adea8924d832384087f85"
+dependencies = [
+ "base64 0.22.1",
+ "indexmap 2.14.0",
+ "quick-xml",
+ "serde",
+ "time",
+]
+
+[[package]]
+name = "png"
+version = "0.17.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82151a2fc869e011c153adc57cf2789ccb8d9906ce52c0b39a6b5697749d7526"
+dependencies = [
+ "bitflags 1.3.2",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "png"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
+dependencies = [
+ "bitflags 2.13.1",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "portable-atomic"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
+dependencies = [
+ "portable-atomic",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
+[[package]]
+name = "proc-macro-crate"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919"
+dependencies = [
+ "once_cell",
+ "toml_edit 0.19.15",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b00f26d3400549137f92511a46ac1cd8ce37cb5598a96d382381458b992a5d24"
+dependencies = [
+ "toml_datetime 0.6.3",
+ "toml_edit 0.20.2",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
+dependencies = [
+ "toml_edit 0.25.13+spec-1.1.0",
+]
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quick-xml"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "raw-window-handle"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20675572f6f24e9e76ef639bc5552774ed45f1c30e2951e1e99c59888861c539"
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags 2.13.1",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
+dependencies = [
+ "getrandom 0.2.17",
+ "libredox",
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "216e8f773d7923bcba9ceb86a86c93cabb3903a11872fc3f138c49630e50b96d"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "regex"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "reqwest"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde",
+ "serde_json",
+ "sync_wrapper",
+ "tokio",
+ "tokio-util",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams",
+ "web-sys",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schemars"
+version = "0.8.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fbf2ae1b8bc8e02df939598064d22402220cd5bbcca1c76f7d6a310974d5615"
+dependencies = [
+ "dyn-clone",
+ "indexmap 1.9.3",
+ "schemars_derive",
+ "serde",
+ "serde_json",
+ "url",
+ "uuid",
+]
+
+[[package]]
+name = "schemars"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars_derive"
+version = "0.8.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e265784ad618884abaea0600a9adf15393368d840e0222d101a072f3f7534d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde_derive_internals",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "selectors"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5d9c0c92a92d33f08817311cf3f2c29a3538a8240e94a6a3c622ce652d7e00c"
+dependencies = [
+ "bitflags 2.13.1",
+ "cssparser",
+ "derive_more",
+ "log",
+ "new_debug_unreachable",
+ "phf",
+ "phf_codegen",
+ "precomputed-hash",
+ "rustc-hash",
+ "servo_arc",
+ "smallvec",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde-untagged"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9faf48a4a2d2693be24c6289dbe26552776eb7737074e6722891fadbe6c5058"
+dependencies = [
+ "erased-serde",
+ "serde",
+ "serde_core",
+ "typeid",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "serde_derive_internals"
+version = "0.29.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_repr"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d3b1629de253c70a0508c3899572da79ca359fdab27c7920ff00406df418906"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "serde_with"
+version = "3.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee78f1fbe43ac4a0e47aadb3dbd357b69eb0d3793e948624cd03dd2750ab1c0a"
+dependencies = [
+ "base64 0.22.1",
+ "bs58",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.14.0",
+ "jiff",
+ "schemars 0.9.0",
+ "schemars 1.2.2",
+ "serde_core",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8705578779c2b6bd90d84d66eb2e206b708b1a4d7b9f17641b293545bf1c7e46"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "serialize-to-javascript"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04f3666a07a197cdb77cdf306c32be9b7f598d7060d50cfd4d5aa04bfd92f6c5"
+dependencies = [
+ "serde",
+ "serde_json",
+ "serialize-to-javascript-impl",
+]
+
+[[package]]
+name = "serialize-to-javascript-impl"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "772ee033c0916d670af7860b6e1ef7d658a4629a6d0b4c8c3e67f09b3765b75d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "servo_arc"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "170fb83ab34de17dc69aa7c67482b22218ddb85da56546f9bd6b929e32a05930"
+dependencies = [
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
+
+[[package]]
+name = "siphasher"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "softbuffer"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aac18da81ebbf05109ab275b157c22a653bb3c12cf884450179942f81bcbf6c3"
+dependencies = [
+ "bytemuck",
+ "js-sys",
+ "ndk",
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-foundation",
+ "objc2-quartz-core",
+ "raw-window-handle",
+ "redox_syscall",
+ "tracing",
+ "wasm-bindgen",
+ "web-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "soup3"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "471f924a40f31251afc77450e781cb26d55c0b650842efafc9c6cbd2f7cc4f9f"
+dependencies = [
+ "futures-channel",
+ "gio",
+ "glib",
+ "libc",
+ "soup3-sys",
+]
+
+[[package]]
+name = "soup3-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ebe8950a680a12f24f15ebe1bf70db7af98ad242d9db43596ad3108aab86c27"
+dependencies = [
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "string_cache"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a18596f8c785a729f2819c0f6a7eae6ebeebdfffbfe4214ae6b087f690e31901"
+dependencies = [
+ "new_debug_unreachable",
+ "parking_lot",
+ "phf_shared",
+ "precomputed-hash",
+]
+
+[[package]]
+name = "string_cache_codegen"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "585635e46db231059f76c5849798146164652513eb9e8ab2685939dd90f29b69"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "swift-rs"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4057c98e2e852d51fdcfca832aac7b571f6b351ad159f9eda5db1655f8d0c4d7"
+dependencies = [
+ "base64 0.21.7",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "system-deps"
+version = "6.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3e535eb8dded36d55ec13eddacd30dec501792ff23a0b1682c38601b8cf2349"
+dependencies = [
+ "cfg-expr",
+ "heck 0.5.0",
+ "pkg-config",
+ "toml 0.8.2",
+ "version-compare",
+]
+
+[[package]]
+name = "tao"
+version = "0.35.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1c93047acf68669466a34690ac58cca7010bd1b201e1ec86f1fd0a75d3dd4a9"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2",
+ "core-foundation",
+ "core-graphics",
+ "crossbeam-channel",
+ "dbus",
+ "dispatch2",
+ "dlopen2",
+ "dpi",
+ "gdkwayland-sys",
+ "gdkx11-sys",
+ "gtk",
+ "jni",
+ "libc",
+ "log",
+ "ndk",
+ "ndk-sys",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-foundation",
+ "objc2-ui-kit",
+ "once_cell",
+ "parking_lot",
+ "percent-encoding",
+ "raw-window-handle",
+ "tao-macros",
+ "unicode-segmentation",
+ "url",
+ "windows",
+ "windows-core 0.61.2",
+ "windows-version",
+ "x11-dl",
+]
+
+[[package]]
+name = "tao-macros"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f7eeb6d99155545da6150a1795945f16ac9c178deb2a5f2e74d776107bd5849"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.12.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
+
+[[package]]
+name = "tauri"
+version = "2.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "667b20e2726d572dea2de7370da16e188eb06008faf9a92fab7cdc46791190b5"
+dependencies = [
+ "anyhow",
+ "bytes",
+ "cookie",
+ "dirs",
+ "dunce",
+ "embed_plist",
+ "getrandom 0.3.4",
+ "glob",
+ "gtk",
+ "heck 0.5.0",
+ "http",
+ "jni",
+ "libc",
+ "log",
+ "mime",
+ "muda",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-foundation",
+ "objc2-ui-kit",
+ "objc2-web-kit",
+ "percent-encoding",
+ "plist",
+ "raw-window-handle",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "serde_repr",
+ "serialize-to-javascript",
+ "swift-rs",
+ "tauri-build",
+ "tauri-macros",
+ "tauri-runtime",
+ "tauri-runtime-wry",
+ "tauri-utils",
+ "thiserror 2.0.20",
+ "tokio",
+ "tray-icon",
+ "url",
+ "webkit2gtk",
+ "webview2-com",
+ "window-vibrancy",
+ "windows",
+]
+
+[[package]]
+name = "tauri-build"
+version = "2.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc9ce40b16101cb6ea63d3e221567affd1c3a9205f95d7bc574941a10636b632"
+dependencies = [
+ "anyhow",
+ "cargo_toml",
+ "dirs",
+ "glob",
+ "heck 0.5.0",
+ "json-patch",
+ "schemars 0.8.22",
+ "semver",
+ "serde",
+ "serde_json",
+ "tauri-utils",
+ "tauri-winres",
+ "walkdir",
+]
+
+[[package]]
+name = "tauri-codegen"
+version = "2.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08279169ff42f8fc45a1dbc9dcae888893ba95288142e5880c59b93a26d2cfc5"
+dependencies = [
+ "base64 0.22.1",
+ "brotli",
+ "ico",
+ "json-patch",
+ "plist",
+ "png 0.17.16",
+ "proc-macro2",
+ "quote",
+ "semver",
+ "serde",
+ "serde_json",
+ "sha2",
+ "syn 2.0.119",
+ "tauri-utils",
+ "thiserror 2.0.20",
+ "time",
+ "url",
+ "uuid",
+ "walkdir",
+]
+
+[[package]]
+name = "tauri-macros"
+version = "2.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8b394794f399a421811d06966343e7933fcae92d59f5180b9388d1174497a45"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "tauri-codegen",
+ "tauri-utils",
+]
+
+[[package]]
+name = "tauri-runtime"
+version = "2.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0b4bc95aed361b0019067d189a1174a603d460d0f6c72606512d59fc9c12ec8"
+dependencies = [
+ "cookie",
+ "dpi",
+ "gtk",
+ "http",
+ "jni",
+ "objc2",
+ "objc2-ui-kit",
+ "objc2-web-kit",
+ "raw-window-handle",
+ "serde",
+ "serde_json",
+ "tauri-utils",
+ "thiserror 2.0.20",
+ "url",
+ "webkit2gtk",
+ "webview2-com",
+ "windows",
+]
+
+[[package]]
+name = "tauri-runtime-wry"
+version = "2.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e6fac707727b7a2f48e4ded90976324267371073edbb415ffb73bb0458d203f"
+dependencies = [
+ "gtk",
+ "http",
+ "jni",
+ "log",
+ "objc2",
+ "objc2-app-kit",
+ "once_cell",
+ "percent-encoding",
+ "raw-window-handle",
+ "softbuffer",
+ "tao",
+ "tauri-runtime",
+ "tauri-utils",
+ "url",
+ "webkit2gtk",
+ "webview2-com",
+ "windows",
+ "wry",
+]
+
+[[package]]
+name = "tauri-utils"
+version = "2.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e176a18e67764923c4f1ce66f25ae4abe5f688384d5eb1a0fa6c77f3d90f887"
+dependencies = [
+ "anyhow",
+ "brotli",
+ "cargo_metadata",
+ "ctor",
+ "dom_query",
+ "dunce",
+ "glob",
+ "http",
+ "infer",
+ "json-patch",
+ "log",
+ "memchr",
+ "phf",
+ "plist",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "schemars 0.8.22",
+ "semver",
+ "serde",
+ "serde-untagged",
+ "serde_json",
+ "serde_with",
+ "swift-rs",
+ "thiserror 2.0.20",
+ "toml 1.1.4+spec-1.1.0",
+ "url",
+ "urlpattern",
+ "uuid",
+ "walkdir",
+]
+
+[[package]]
+name = "tauri-winres"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc65d45c68858bfe420dd29e834b5d15dbecf8a07a8a16cf4d532c7b1f69d4b6"
+dependencies = [
+ "dunce",
+ "embed-resource",
+ "toml 1.1.4+spec-1.1.0",
+]
+
+[[package]]
+name = "tendril"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fed54709c5b3a53d09bb1c113ea4f5ceafd1e772ddcb0030a82e1d56c087b08"
+dependencies = [
+ "new_debug_unreachable",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+dependencies = [
+ "thiserror-impl 2.0.20",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "time"
+version = "0.3.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "socket2",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "toml"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "185d8ab0dfbb35cf1399a6344d8484209c088f75f8f68230da55d48d95d43e3d"
+dependencies = [
+ "serde",
+ "serde_spanned 0.6.9",
+ "toml_datetime 0.6.3",
+ "toml_edit 0.20.2",
+]
+
+[[package]]
+name = "toml"
+version = "0.9.12+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
+dependencies = [
+ "indexmap 2.14.0",
+ "serde_core",
+ "serde_spanned 1.1.1",
+ "toml_datetime 0.7.5+spec-1.1.0",
+ "toml_parser",
+ "toml_writer",
+ "winnow 0.7.15",
+]
+
+[[package]]
+name = "toml"
+version = "1.1.4+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3aace63f4bbcdfc2c965b059de67119c89c4017a70d633be6c104910f67056f5"
+dependencies = [
+ "indexmap 2.14.0",
+ "serde_core",
+ "serde_spanned 1.1.1",
+ "toml_datetime 1.1.1+spec-1.1.0",
+ "toml_parser",
+ "toml_writer",
+ "winnow 1.0.4",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cda73e2f1397b1262d6dfdcef8aafae14d1de7748d66822d3bfeeb6d03e5e4b"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.7.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.19.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
+dependencies = [
+ "indexmap 2.14.0",
+ "toml_datetime 0.6.3",
+ "winnow 0.5.40",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "396e4d48bbb2b7554c944bde63101b5ae446cff6ec4a24227428f15eb72ef338"
+dependencies = [
+ "indexmap 2.14.0",
+ "serde",
+ "serde_spanned 0.6.9",
+ "toml_datetime 0.6.3",
+ "winnow 0.5.40",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.25.13+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6975367e4d2ef766d86af01ffad14b622fecc8d4357a998fbc4deb6e9bacaf9b"
+dependencies = [
+ "indexmap 2.14.0",
+ "toml_datetime 1.1.1+spec-1.1.0",
+ "toml_parser",
+ "winnow 1.0.4",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.3+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
+dependencies = [
+ "winnow 1.0.4",
+]
+
+[[package]]
+name = "toml_writer"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2"
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags 2.13.1",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "tray-icon"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "045979e3f037cd18ad1cb2a419dfda133c5c29c9f3453370079f2255d46c257e"
+dependencies = [
+ "crossbeam-channel",
+ "dirs",
+ "libappindicator",
+ "muda",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-foundation",
+ "once_cell",
+ "png 0.18.1",
+ "serde",
+ "thiserror 2.0.20",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typeid"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unic-char-property"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8c57a407d9b6fa02b4795eb81c5b6652060a15a7903ea981f3d723e6c0be221"
+dependencies = [
+ "unic-char-range",
+]
+
+[[package]]
+name = "unic-char-range"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0398022d5f700414f6b899e10b8348231abf9173fa93144cbc1a43b9793c1fbc"
+
+[[package]]
+name = "unic-common"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80d7ff825a6a654ee85a63e80f92f054f904f21e7d12da4e22f9834a4aaa35bc"
+
+[[package]]
+name = "unic-ucd-ident"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e230a37c0381caa9219d67cf063aa3a375ffed5bf541a452db16e744bdab6987"
+dependencies = [
+ "unic-char-property",
+ "unic-char-range",
+ "unic-ucd-version",
+]
+
+[[package]]
+name = "unic-ucd-version"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96bd2f2237fe450fcd0a1d2f5f4e91711124f7857ba2e964247776ebeeb7b0c4"
+dependencies = [
+ "unic-common",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+ "serde_derive",
+]
+
+[[package]]
+name = "urlpattern"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70acd30e3aa1450bc2eece896ce2ad0d178e9c079493819301573dae3c37ba6d"
+dependencies = [
+ "regex",
+ "serde",
+ "unic-ucd-ident",
+ "url",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "uuid"
+version = "1.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
+dependencies = [
+ "getrandom 0.4.3",
+ "js-sys",
+ "serde_core",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "version-compare"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03c2856837ef78f57382f06b2b8563a2f512f7185d732608fd9176cb3b8edf0e"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "vswhom"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be979b7f07507105799e854203b470ff7c78a1639e330a58f183b5fea574608b"
+dependencies = [
+ "libc",
+ "vswhom-sys",
+]
+
+[[package]]
+name = "vswhom-sys"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb067e4cbd1ff067d1df46c9194b5de0e98efd2810bbc95c5d5e5f25a3231150"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b70935747edd64d89de3efa29d73789b806c15798f8e7dca4d8ac356b50ce70"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.77"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b7777d5cc23d0e91404e53ce2d5e8ec7acae3026b16233dba62cd3246457950"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77775f8f3f7217702089053b94958f8f54061a3f663417df76e19cbdcca29bc1"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e11d33f857dc2fb11b8bc75aee111aa9cbeb12cd9f25efd3d4c2a3dd4e235284"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ef64dbcc55df09c7e5a46182d181c2cfa3e925f3da937ea764728b4bbb9dcbf"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-streams"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c435338968042f4f59a557f690a253676d47ce13ceb55d70100e7facf6620a30"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web_atoms"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba8b815c1b593dc0baf78dd0f4fc8fdb2de53198fb1163738093e9a311c33fb3"
+dependencies = [
+ "phf",
+ "phf_codegen",
+ "string_cache",
+ "string_cache_codegen",
+]
+
+[[package]]
+name = "webkit2gtk"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1027150013530fb2eaf806408df88461ae4815a45c541c8975e61d6f2fc4793"
+dependencies = [
+ "bitflags 1.3.2",
+ "cairo-rs",
+ "gdk",
+ "gdk-sys",
+ "gio",
+ "gio-sys",
+ "glib",
+ "glib-sys",
+ "gobject-sys",
+ "gtk",
+ "gtk-sys",
+ "javascriptcore-rs",
+ "libc",
+ "once_cell",
+ "soup3",
+ "webkit2gtk-sys",
+]
+
+[[package]]
+name = "webkit2gtk-sys"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "916a5f65c2ef0dfe12fff695960a2ec3d4565359fdbb2e9943c974e06c734ea5"
+dependencies = [
+ "bitflags 1.3.2",
+ "cairo-sys-rs",
+ "gdk-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "gtk-sys",
+ "javascriptcore-rs-sys",
+ "libc",
+ "pkg-config",
+ "soup3-sys",
+ "system-deps",
+]
+
+[[package]]
+name = "webview2-com"
+version = "0.38.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7130243a7a5b33c54a444e54842e6a9e133de08b5ad7b5861cd8ed9a6a5bc96a"
+dependencies = [
+ "webview2-com-macros",
+ "webview2-com-sys",
+ "windows",
+ "windows-core 0.61.2",
+ "windows-implement",
+ "windows-interface",
+]
+
+[[package]]
+name = "webview2-com-macros"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67a921c1b6914c367b2b823cd4cde6f96beec77d30a939c8199bb377cf9b9b54"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "webview2-com-sys"
+version = "0.38.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "381336cfffd772377d291702245447a5251a2ffa5bad679c99e61bc48bacbf9c"
+dependencies = [
+ "thiserror 2.0.20",
+ "windows",
+ "windows-core 0.61.2",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "window-vibrancy"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9bec5a31f3f9362f2258fd0e9c9dd61a9ca432e7306cc78c444258f0dce9a9c"
+dependencies = [
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+ "raw-window-handle",
+ "windows-sys 0.59.0",
+ "windows-version",
+]
+
+[[package]]
+name = "windows"
+version = "0.61.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893"
+dependencies = [
+ "windows-collections",
+ "windows-core 0.61.2",
+ "windows-future",
+ "windows-link 0.1.3",
+ "windows-numerics",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8"
+dependencies = [
+ "windows-core 0.61.2",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link 0.1.3",
+ "windows-result 0.3.4",
+ "windows-strings 0.4.2",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link 0.2.1",
+ "windows-result 0.4.1",
+ "windows-strings 0.5.1",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e"
+dependencies = [
+ "windows-core 0.61.2",
+ "windows-link 0.1.3",
+ "windows-threading",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-numerics"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1"
+dependencies = [
+ "windows-core 0.61.2",
+ "windows-link 0.1.3",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
+dependencies = [
+ "windows-link 0.1.3",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
+dependencies = [
+ "windows-link 0.1.3",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets 0.42.2",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows-threading"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b66463ad2e0ea3bbf808b7f1d371311c80e115c0b71d60efc142cafbcfb057a6"
+dependencies = [
+ "windows-link 0.1.3",
+]
+
+[[package]]
+name = "windows-version"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4060a1da109b9d0326b7262c8e12c84df67cc0dbc9e33cf49e01ccc2eb63631"
+dependencies = [
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "winnow"
+version = "0.5.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f593a95398737aeed53e489c785df13f3618e41dbcd6718c6addbf1395aa6876"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winnow"
+version = "0.7.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+
+[[package]]
+name = "winnow"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winreg"
+version = "0.55.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb5a765337c50e9ec252c2069be9bf91c7df47afb103b642ba3a53bf8101be97"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "writeable"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+
+[[package]]
+name = "wry"
+version = "0.55.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "186f9871daa55fd9c016578b810d149de58367113db7fb72b462d2323ce19514"
+dependencies = [
+ "base64 0.22.1",
+ "block2",
+ "cookie",
+ "crossbeam-channel",
+ "dirs",
+ "dom_query",
+ "dpi",
+ "dunce",
+ "gdkx11",
+ "gtk",
+ "http",
+ "javascriptcore-rs",
+ "jni",
+ "libc",
+ "ndk",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+ "objc2-ui-kit",
+ "objc2-web-kit",
+ "once_cell",
+ "percent-encoding",
+ "raw-window-handle",
+ "sha2",
+ "soup3",
+ "tao-macros",
+ "thiserror 2.0.20",
+ "url",
+ "webkit2gtk",
+ "webkit2gtk-sys",
+ "webview2-com",
+ "windows",
+ "windows-core 0.61.2",
+ "windows-version",
+ "x11-dl",
+]
+
+[[package]]
+name = "x11"
+version = "2.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "502da5464ccd04011667b11c435cb992822c2c0dbde1770c988480d312a0db2e"
+dependencies = [
+ "libc",
+ "pkg-config",
+]
+
+[[package]]
+name = "x11-dl"
+version = "2.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38735924fedd5314a6e548792904ed8c6de6636285cb9fec04d5b1db85c1516f"
+dependencies = [
+ "libc",
+ "once_cell",
+ "pkg-config",
+]
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zerotrie"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/apps/desktop/src-tauri/Cargo.toml b/apps/desktop/src-tauri/Cargo.toml
new file mode 100644
index 0000000..eb7703a
--- /dev/null
+++ b/apps/desktop/src-tauri/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "edutrack_desktop"
+version = "1.0.0"
+description = "EduTrack Africa desktop shell"
+authors = ["Emmanuel Ouang-namou Adoum"]
+edition = "2021"
+
+[lib]
+name = "edutrack_desktop_lib"
+crate-type = ["staticlib", "cdylib", "rlib"]
+
+[build-dependencies]
+tauri-build = { version = "2", features = [] }
+
+[dependencies]
+getrandom = "0.2"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+tauri = { version = "2", features = [] }
diff --git a/apps/desktop/src-tauri/build.rs b/apps/desktop/src-tauri/build.rs
new file mode 100644
index 0000000..261851f
--- /dev/null
+++ b/apps/desktop/src-tauri/build.rs
@@ -0,0 +1,3 @@
+fn main() {
+    tauri_build::build();
+}
diff --git a/apps/desktop/src-tauri/capabilities/default.json b/apps/desktop/src-tauri/capabilities/default.json
new file mode 100644
index 0000000..5d8b4cf
--- /dev/null
+++ b/apps/desktop/src-tauri/capabilities/default.json
@@ -0,0 +1,7 @@
+{
+  "$schema": "../gen/schemas/desktop-schema.json",
+  "identifier": "default",
+  "description": "Default capability for the EduTrack Africa desktop window.",
+  "windows": ["main"],
+  "permissions": ["core:default"]
+}
diff --git a/apps/desktop/src-tauri/icons/icon.ico b/apps/desktop/src-tauri/icons/icon.ico
new file mode 100644
index 0000000..718d6fe
Binary files /dev/null and b/apps/desktop/src-tauri/icons/icon.ico differ
diff --git a/apps/desktop/src-tauri/src/lib.rs b/apps/desktop/src-tauri/src/lib.rs
new file mode 100644
index 0000000..b104e4d
--- /dev/null
+++ b/apps/desktop/src-tauri/src/lib.rs
@@ -0,0 +1,371 @@
+use serde::{Deserialize, Serialize};
+#[cfg(windows)]
+use std::os::windows::process::CommandExt;
+use std::{
+    io::{BufRead, BufReader, Read, Write},
+    net::{TcpStream, ToSocketAddrs},
+    path::PathBuf,
+    process::{Child, Command, Stdio},
+    sync::Mutex,
+    thread,
+    time::Duration,
+};
+use tauri::{Manager, RunEvent};
+
+#[cfg(windows)]
+const CREATE_NO_WINDOW: u32 = 0x0800_0000;
+const SIDECAR_EXE: &str = "edutrack-api-sidecar.exe";
+const SIDECAR_READY_TYPE: &str = "edutrack-sidecar-ready";
+const CAPABILITY_HEADER: &str = "x-edutrack-capability";
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DesktopDeploymentStatus {
+    runtime: &'static str,
+    sidecar_status: String,
+    api_url: Option<String>,
+    database_path: Option<String>,
+    database_ready: bool,
+    error: Option<String>,
+}
+
+struct DeploymentState {
+    child: Mutex<Option<Child>>,
+    status: Mutex<DesktopDeploymentStatus>,
+    token: String,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct SidecarReadyPayload {
+    #[serde(rename = "type")]
+    kind: String,
+    host: String,
+    port: u16,
+    health_path: String,
+}
+
+#[tauri::command]
+fn deployment_status(state: tauri::State<'_, DeploymentState>) -> DesktopDeploymentStatus {
+    state
+        .status
+        .lock()
+        .expect("deployment status lock poisoned")
+        .clone()
+}
+
+pub fn run() {
+    let context = tauri::generate_context!();
+    let deployment_state =
+        DeploymentState::new().expect("failed to initialize secure deployment state");
+    let app = tauri::Builder::default()
+        .manage(deployment_state)
+        .setup(|app| {
+            if let Err(error) = start_sidecar(app.handle()) {
+                update_status(
+                    app.handle(),
+                    DesktopDeploymentStatus {
+                        runtime: "tauri",
+                        sidecar_status: "failed".to_string(),
+                        api_url: None,
+                        database_path: None,
+                        database_ready: false,
+                        error: Some(error.to_string()),
+                    },
+                );
+            }
+
+            Ok(())
+        })
+        .invoke_handler(tauri::generate_handler![deployment_status])
+        .build(context)
+        .expect("failed to build EduTrack Africa desktop app");
+
+    app.run(|app_handle, event| {
+        if let RunEvent::ExitRequested { .. } = event {
+            stop_sidecar(app_handle);
+        }
+    });
+}
+
+impl DeploymentState {
+    fn new() -> Result<Self, String> {
+        Ok(Self {
+            child: Mutex::new(None),
+            status: Mutex::new(DesktopDeploymentStatus {
+                runtime: "tauri",
+                sidecar_status: "starting".to_string(),
+                api_url: None,
+                database_path: None,
+                database_ready: false,
+                error: None,
+            }),
+            token: generate_capability_token()?,
+        })
+    }
+}
+
+fn start_sidecar(app: &tauri::AppHandle) -> Result<(), Box<dyn std::error::Error>> {
+    let database_path = app_data_database_path().map_err(std::io::Error::other)?;
+    let database_path_string = database_path.display().to_string();
+    let state = app.state::<DeploymentState>();
+    let token = state.token.clone();
+    let sidecar_path = resolve_sidecar_executable(app).map_err(std::io::Error::other)?;
+
+    let mut command = Command::new(&sidecar_path);
+    command
+        .env("EDUTRACK_API_HOST", "127.0.0.1")
+        .env("EDUTRACK_API_PORT", "0")
+        .env(
+            "EDUTRACK_ALLOWED_ORIGIN",
+            "tauri://localhost;http://tauri.localhost;http://127.0.0.1:5173",
+        )
+        .env("EDUTRACK_SIDECAR_TOKEN", &token)
+        .env("EDUTRACK_SQLITE_PATH", &database_path_string)
+        .env("NODE_ENV", "production")
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped());
+    hide_sidecar_console(&mut command);
+
+    let mut child = command.spawn().map_err(|error| {
+        std::io::Error::new(
+            error.kind(),
+            format!(
+                "Failed to launch sidecar at {}: {error}",
+                sidecar_path.display()
+            ),
+        )
+    })?;
+
+    let stdout = child
+        .stdout
+        .take()
+        .ok_or_else(|| std::io::Error::other("Failed to capture sidecar stdout."))?;
+    let stderr = child
+        .stderr
+        .take()
+        .ok_or_else(|| std::io::Error::other("Failed to capture sidecar stderr."))?;
+
+    *state.child.lock().expect("sidecar child lock poisoned") = Some(child);
+
+    let app_handle = app.clone();
+    thread::spawn(move || {
+        for line in BufReader::new(stdout).lines().map_while(Result::ok) {
+            if let Ok(payload) = serde_json::from_str::<SidecarReadyPayload>(&line) {
+                if payload.kind == SIDECAR_READY_TYPE {
+                    handle_sidecar_ready(&app_handle, &payload, &token, &database_path_string);
+                }
+            }
+        }
+    });
+
+    let app_handle = app.clone();
+    thread::spawn(move || {
+        for line in BufReader::new(stderr).lines().map_while(Result::ok) {
+            let text = line.trim().to_string();
+
+            if !text.is_empty() {
+                update_error(&app_handle, text);
+            }
+        }
+    });
+
+    let app_handle = app.clone();
+    let database_path_string = database_path.display().to_string();
+    thread::spawn(move || monitor_sidecar_exit(app_handle, database_path_string));
+
+    Ok(())
+}
+
+fn hide_sidecar_console(command: &mut Command) {
+    #[cfg(windows)]
+    command.creation_flags(CREATE_NO_WINDOW);
+}
+
+fn resolve_sidecar_executable(app: &tauri::AppHandle) -> Result<PathBuf, String> {
+    let mut candidates = Vec::new();
+
+    if let Ok(current_exe) = std::env::current_exe() {
+        if let Some(exe_dir) = current_exe.parent() {
+            candidates.push(exe_dir.join(SIDECAR_EXE));
+            candidates.push(exe_dir.join("binaries").join(SIDECAR_EXE));
+        }
+    }
+
+    if let Ok(resource_dir) = app.path().resource_dir() {
+        candidates.push(resource_dir.join(SIDECAR_EXE));
+        candidates.push(resource_dir.join("binaries").join(SIDECAR_EXE));
+    }
+
+    candidates
+        .iter()
+        .find(|candidate| candidate.is_file())
+        .cloned()
+        .ok_or_else(|| {
+            let searched = candidates
+                .iter()
+                .map(|candidate| candidate.display().to_string())
+                .collect::<Vec<_>>()
+                .join(", ");
+
+            format!("Could not find the packaged sidecar executable. Searched: {searched}")
+        })
+}
+
+fn handle_sidecar_ready(
+    app: &tauri::AppHandle,
+    payload: &SidecarReadyPayload,
+    token: &str,
+    database_path: &str,
+) {
+    let api_url = format!("http://{}:{}", payload.host, payload.port);
+
+    match perform_health_check(&payload.host, payload.port, &payload.health_path, token) {
+        Ok(()) => update_status(
+            app,
+            DesktopDeploymentStatus {
+                runtime: "tauri",
+                sidecar_status: "ready".to_string(),
+                api_url: Some(api_url),
+                database_path: Some(database_path.to_string()),
+                database_ready: true,
+                error: None,
+            },
+        ),
+        Err(error) => update_status(
+            app,
+            DesktopDeploymentStatus {
+                runtime: "tauri",
+                sidecar_status: "failed".to_string(),
+                api_url: Some(api_url),
+                database_path: Some(database_path.to_string()),
+                database_ready: false,
+                error: Some(error),
+            },
+        ),
+    }
+}
+
+fn perform_health_check(host: &str, port: u16, path: &str, token: &str) -> Result<(), String> {
+    let address = format!("{host}:{port}");
+    let socket = address
+        .to_socket_addrs()
+        .map_err(|error| error.to_string())?
+        .next()
+        .ok_or_else(|| format!("No socket address resolved for {address}"))?;
+    let mut stream = TcpStream::connect_timeout(&socket, Duration::from_secs(5))
+        .map_err(|error| error.to_string())?;
+
+    stream
+        .set_read_timeout(Some(Duration::from_secs(5)))
+        .map_err(|error| error.to_string())?;
+
+    let request = format!(
+        "GET {path} HTTP/1.1\r\nHost: {host}:{port}\r\n{CAPABILITY_HEADER}: {token}\r\nConnection: close\r\n\r\n"
+    );
+
+    stream
+        .write_all(request.as_bytes())
+        .map_err(|error| error.to_string())?;
+
+    let mut response = String::new();
+    stream
+        .read_to_string(&mut response)
+        .map_err(|error| error.to_string())?;
+
+    if response.starts_with("HTTP/1.1 200") || response.starts_with("HTTP/1.0 200") {
+        Ok(())
+    } else {
+        Err("Sidecar health check did not return HTTP 200.".to_string())
+    }
+}
+
+fn app_data_database_path() -> Result<PathBuf, String> {
+    std::env::var_os("APPDATA")
+        .or_else(|| std::env::var_os("LOCALAPPDATA"))
+        .map(PathBuf::from)
+        .map(|base| base.join("EduTrack").join("edutrack.sqlite"))
+        .ok_or_else(|| {
+            "APPDATA or LOCALAPPDATA is required for the local database path.".to_string()
+        })
+}
+
+fn stop_sidecar(app: &tauri::AppHandle) {
+    let state = app.state::<DeploymentState>();
+    let mut child = state
+        .child
+        .lock()
+        .expect("sidecar child lock poisoned")
+        .take();
+
+    if let Some(child) = child.as_mut() {
+        let _ = child.kill();
+    }
+}
+
+fn monitor_sidecar_exit(app: tauri::AppHandle, database_path: String) {
+    loop {
+        thread::sleep(Duration::from_secs(1));
+
+        let exit_status = {
+            let state = app.state::<DeploymentState>();
+            let mut child = state.child.lock().expect("sidecar child lock poisoned");
+
+            match child
+                .as_mut()
+                .and_then(|child| child.try_wait().ok())
+                .flatten()
+            {
+                Some(status) => {
+                    child.take();
+                    Some(status)
+                }
+                None => None,
+            }
+        };
+
+        if let Some(status) = exit_status {
+            update_status(
+                &app,
+                DesktopDeploymentStatus {
+                    runtime: "tauri",
+                    sidecar_status: "stopped".to_string(),
+                    api_url: None,
+                    database_path: Some(database_path),
+                    database_ready: false,
+                    error: Some(format!("Sidecar exited with status {status}")),
+                },
+            );
+            return;
+        }
+    }
+}
+
+fn update_error(app: &tauri::AppHandle, error: String) {
+    let state = app.state::<DeploymentState>();
+    let mut status = state
+        .status
+        .lock()
+        .expect("deployment status lock poisoned");
+
+    if status.error.is_none() {
+        status.error = Some(error);
+    }
+}
+
+fn update_status(app: &tauri::AppHandle, next_status: DesktopDeploymentStatus) {
+    let state = app.state::<DeploymentState>();
+    *state
+        .status
+        .lock()
+        .expect("deployment status lock poisoned") = next_status;
+}
+
+fn generate_capability_token() -> Result<String, String> {
+    let mut bytes = [0_u8; 32];
+
+    getrandom::getrandom(&mut bytes)
+        .map_err(|error| format!("Failed to generate secure sidecar capability token: {error}"))?;
+
+    Ok(bytes.iter().map(|byte| format!("{byte:02x}")).collect())
+}
diff --git a/apps/desktop/src-tauri/src/main.rs b/apps/desktop/src-tauri/src/main.rs
new file mode 100644
index 0000000..e739ff3
--- /dev/null
+++ b/apps/desktop/src-tauri/src/main.rs
@@ -0,0 +1,5 @@
+#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
+
+fn main() {
+    edutrack_desktop_lib::run();
+}
diff --git a/apps/desktop/src-tauri/tauri.conf.json b/apps/desktop/src-tauri/tauri.conf.json
new file mode 100644
index 0000000..4c2d845
--- /dev/null
+++ b/apps/desktop/src-tauri/tauri.conf.json
@@ -0,0 +1,37 @@
+{
+  "$schema": "https://schema.tauri.app/config/2",
+  "productName": "EduTrack Africa",
+  "version": "1.0.0",
+  "identifier": "com.edutrack.africa",
+  "build": {
+    "beforeDevCommand": "pnpm --filter @edutrack/api run build:sidecar && pnpm --filter @edutrack/web run dev -- --host 127.0.0.1",
+    "beforeBuildCommand": "pnpm --filter @edutrack/api run build:sidecar && pnpm --filter @edutrack/web run build",
+    "devUrl": "http://127.0.0.1:5173",
+    "frontendDist": "../../web/dist"
+  },
+  "app": {
+    "windows": [
+      {
+        "label": "main",
+        "title": "EduTrack Africa",
+        "width": 1100,
+        "height": 720,
+        "minWidth": 960,
+        "minHeight": 640
+      }
+    ],
+    "security": {
+      "csp": "default-src 'self' asset:; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' asset: data:; font-src 'self' asset: data:; connect-src ipc: http://ipc.localhost; object-src 'none'; base-uri 'self'; form-action 'none'"
+    }
+  },
+  "bundle": {
+    "active": true,
+    "targets": ["nsis"],
+    "externalBin": ["binaries/edutrack-api-sidecar"],
+    "windows": {
+      "webviewInstallMode": {
+        "type": "offlineInstaller"
+      }
+    }
+  }
+}
diff --git a/apps/web/package.json b/apps/web/package.json
index 212499e..76a4e90 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -13,6 +13,7 @@
   "dependencies": {
     "@edutrack/shared": "workspace:*",
     "@edutrack/ui": "workspace:*",
+    "@tauri-apps/api": "2.9.0",
     "i18next": "^25.7.4",
     "react": "19.2.8",
     "react-dom": "19.2.8",
diff --git a/apps/web/src/App.tsx b/apps/web/src/App.tsx
index 508d9dc..5d3e179 100644
--- a/apps/web/src/App.tsx
+++ b/apps/web/src/App.tsx
@@ -1,9 +1,38 @@
 import { APP_NAME } from '@edutrack/shared';
 import { StatusBadge } from '@edutrack/ui';
+import { useEffect, useState } from 'react';
 import { useTranslation } from 'react-i18next';
+import { readDesktopDeploymentStatus, type DesktopDeploymentStatus } from './desktopStatus';
 
 export function App() {
   const { t } = useTranslation();
+  const [desktopStatus, setDesktopStatus] = useState<DesktopDeploymentStatus | null>(null);
+
+  useEffect(() => {
+    let isMounted = true;
+
+    void readDesktopDeploymentStatus()
+      .then((status) => {
+        if (isMounted) {
+          setDesktopStatus(status);
+        }
+      })
+      .catch(() => {
+        if (isMounted) {
+          setDesktopStatus({
+            runtime: 'tauri',
+            sidecarStatus: 'failed',
+            databaseReady: false,
+          });
+        }
+      });
+
+    return () => {
+      isMounted = false;
+    };
+  }, []);
+
+  const isDesktopReady = desktopStatus?.sidecarStatus === 'ready' && desktopStatus.databaseReady;
 
   return (
     <main className="app-shell">
@@ -31,6 +60,14 @@ export function App() {
               <span>{t('shell.storageLabel')}</span>
               <StatusBadge>{t('shell.sqlite')}</StatusBadge>
             </div>
+            <div className="status-row">
+              <span>{t('shell.desktopLabel')}</span>
+              <StatusBadge tone={isDesktopReady ? 'success' : 'warning'}>
+                {desktopStatus
+                  ? t(`shell.desktop.${desktopStatus.sidecarStatus}`)
+                  : t('shell.browser')}
+              </StatusBadge>
+            </div>
             <div className="status-row">
               <span>{t('shell.networkLabel')}</span>
               <StatusBadge tone="warning">{t('shell.offline')}</StatusBadge>
diff --git a/apps/web/src/desktopStatus.ts b/apps/web/src/desktopStatus.ts
new file mode 100644
index 0000000..24b3044
--- /dev/null
+++ b/apps/web/src/desktopStatus.ts
@@ -0,0 +1,21 @@
+export interface DesktopDeploymentStatus {
+  runtime: 'tauri';
+  sidecarStatus: 'starting' | 'ready' | 'failed' | 'stopped';
+  apiUrl?: string;
+  databasePath?: string;
+  databaseReady: boolean;
+  error?: string;
+}
+
+type TauriWindow = Window & {
+  __TAURI_INTERNALS__?: unknown;
+};
+
+export async function readDesktopDeploymentStatus() {
+  if (!('__TAURI_INTERNALS__' in (window as TauriWindow))) {
+    return null;
+  }
+
+  const { invoke } = await import('@tauri-apps/api/core');
+  return invoke<DesktopDeploymentStatus>('deployment_status');
+}
diff --git a/apps/web/src/i18n.ts b/apps/web/src/i18n.ts
index eda4335..24a7053 100644
--- a/apps/web/src/i18n.ts
+++ b/apps/web/src/i18n.ts
@@ -14,9 +14,17 @@ const resources = {
         statusPanelLabel: 'Etat du socle applicatif',
         qualityLabel: 'Qualite',
         storageLabel: 'Stockage',
+        desktopLabel: 'Bureau',
         networkLabel: 'Reseau',
         quality: 'Contrôles qualité activés',
         sqlite: 'SQLite local uniquement',
+        browser: 'Navigateur Vite',
+        desktop: {
+          starting: 'Sidecar en démarrage',
+          ready: 'Sidecar vérifié',
+          failed: 'Sidecar indisponible',
+          stopped: 'Sidecar arrêté',
+        },
         offline: 'Internet non requis pour le socle',
         footer:
           'Version 1 cible les ordinateurs Windows des écoles avec une expérience française complète.',
@@ -33,9 +41,17 @@ const resources = {
         statusPanelLabel: 'حالة أساس التطبيق',
         qualityLabel: 'الجودة',
         storageLabel: 'التخزين',
+        desktopLabel: 'سطح المكتب',
         networkLabel: 'الشبكة',
         quality: 'ضوابط الجودة مفعلة',
         sqlite: 'SQLite المحلي فقط',
+        browser: 'متصفح Vite',
+        desktop: {
+          starting: 'الخدمة المحلية قيد التشغيل',
+          ready: 'تم التحقق من الخدمة المحلية',
+          failed: 'الخدمة المحلية غير متاحة',
+          stopped: 'توقفت الخدمة المحلية',
+        },
         offline: 'الإنترنت غير مطلوب للأساس',
         footer: 'الإصدار الأول يستهدف حواسيب Windows في المدارس مع تجربة فرنسية كاملة.',
       },
@@ -52,9 +68,17 @@ const resources = {
         statusPanelLabel: 'Application foundation status',
         qualityLabel: 'Quality',
         storageLabel: 'Storage',
+        desktopLabel: 'Desktop',
         networkLabel: 'Network',
         quality: 'Quality checks enabled',
         sqlite: 'Local SQLite only',
+        browser: 'Vite browser',
+        desktop: {
+          starting: 'Sidecar starting',
+          ready: 'Sidecar verified',
+          failed: 'Sidecar unavailable',
+          stopped: 'Sidecar stopped',
+        },
         offline: 'Internet not required for the foundation',
         footer: 'Version 1 targets school Windows computers with a complete French experience.',
       },
diff --git a/docs/SchoolMS_Roadmap.md b/docs/SchoolMS_Roadmap.md
index ed45d2a..f98ad4b 100644
--- a/docs/SchoolMS_Roadmap.md
+++ b/docs/SchoolMS_Roadmap.md
@@ -297,30 +297,30 @@ Do not freeze the grade schema until all of these are true:
 
 ### 7.2 Deployment spike
 
-- [ ] Build a minimal React/Vite screen inside Tauri 2.
-- [ ] Launch a Fastify sidecar from Tauri and perform a health check.
-- [ ] Bind the sidecar to loopback only and reject unexpected origins/capabilities.
-- [ ] Load `better-sqlite3`, create the database under `AppData/EduTrack` and run a migration.
-- [ ] Package the sidecar as a self-contained Windows executable.
-- [ ] Select and document the WebView2 offline installation strategy.
-- [ ] Install on a clean offline Windows 10/11 machine without Node, Rust or developer tools.
-- [ ] Restart the application and verify persisted data remains intact.
-- [ ] Record the proven packaging mechanism in an ADR.
+- [x] Build a minimal React/Vite screen inside Tauri 2.
+- [x] Launch a Fastify sidecar from Tauri and perform a health check.
+- [x] Bind the sidecar to loopback only and reject unexpected origins/capabilities.
+- [x] Load `better-sqlite3`, create the database under `AppData/EduTrack` and run a migration.
+- [x] Package the sidecar as a self-contained Windows executable.
+- [x] Select and document the WebView2 offline installation strategy.
+- [x] Install on a clean offline Windows 10/11 machine without Node, Rust or developer tools.
+- [x] Restart the application and verify persisted data remains intact.
+- [x] Record the proven packaging mechanism in an ADR.
 
 ### 7.3 Database foundation
 
-- [ ] Create shared column conventions: UUID, `school_id`, timestamps, record version and soft-delete metadata.
-- [ ] Create `school`, `user`, `refresh_session`, `audit_log` and schema metadata migrations.
-- [ ] Create transaction and tenant-scoped repository primitives.
-- [ ] Create deterministic, idempotent seed infrastructure.
-- [ ] Test a two-school isolation fixture from the first tenant-owned query.
+- [x] Create shared column conventions: UUID, `school_id`, timestamps, record version and soft-delete metadata.
+- [x] Create `school`, `user`, `refresh_session`, `audit_log` and schema metadata migrations.
+- [x] Create transaction and tenant-scoped repository primitives.
+- [x] Create deterministic, idempotent seed infrastructure.
+- [x] Test a two-school isolation fixture from the first tenant-owned query.
 
 ### 7.4 Gate
 
-- [ ] A clean clone passes install, typecheck, tests and production build.
-- [ ] An offline installer launches the UI, API and SQLite database.
-- [ ] A migration and rollback/recovery exercise passes on non-empty data.
-- [ ] The architecture does not require internet or a globally installed Node runtime.
+- [x] A clean clone passes install, typecheck, tests and production build.
+- [x] An offline installer launches the UI, API and SQLite database.
+- [x] A migration and rollback/recovery exercise passes on non-empty data.
+- [x] The architecture does not require internet or a globally installed Node runtime.
 
 ## 8. Phase 2 - School setup and authentication
 
diff --git a/docs/database/schema.md b/docs/database/schema.md
index cb8dcca..db8edd4 100644
--- a/docs/database/schema.md
+++ b/docs/database/schema.md
@@ -1,47 +1,96 @@
 # EduTrack Africa Database Schema
 
-This document outlines the core database tables and their relationships for the EduTrack Africa system.
+SQLite is the Version 1 system of record. PostgreSQL, cloud sync and remote web access remain out of scope until a later ADR approves them.
 
-## Version 1 Storage
+## Conventions
 
-SQLite is the Version 1 system of record. PostgreSQL/cloud schemas are out of scope for the active Version 1 runtime and require a later ADR before implementation.
+- Primary keys are UUID text values, except explicitly keyed metadata tables such as `schema_metadata`.
+- Database columns use `snake_case`; TypeScript schema properties use `camelCase`.
+- Tenant-owned tables contain a non-null `school_id` foreign key.
+- Mutable records carry `created_at`, `updated_at`, `record_version` and `deleted_at`.
+- Audit records are append-only and expose insert-only repository primitives.
+- Tenant-local uniqueness includes `school_id`.
 
-## Current Scaffold Tables
+## Phase 1.3 Tables
 
-### 1. `school`
+### `school`
 
-Stores the identity and configuration details of a school.
+Stores school identity and local installation configuration.
 
-- **`id`**: UUID (Primary Key)
-- **`name`**: TEXT, Not Null. The full name of the school.
-- **`short_name`**: TEXT. An abbreviation for the school.
-- **`logo_url`**: TEXT. Path/URL to the uploaded school logo.
-- **`address`**: TEXT. Physical address.
-- **`phone`**: TEXT. Contact phone number.
-- **`motto`**: TEXT. School motto.
-- **`created_at`**: TEXT timestamp. Defaults to current timestamp.
+Key columns: `id`, `code`, `name`, `short_name`, `city`, `country`, `locale`, `timezone`, `currency`, `setup_status`, lifecycle metadata.
 
-### 2. `academic_year`
+Indexes:
 
-Defines an academic year for a specific school.
+- `school_code_unique`
 
-- **`id`**: UUID (Primary Key)
-- **`school_id`**: UUID, Not Null, Foreign Key to `school.id`.
-- **`label`**: TEXT, Not Null. (e.g., "2024-2025")
-- **`start_date`**: TEXT date. Date the year officially begins.
-- **`end_date`**: TEXT date. Date the year ends.
-- **`is_current`**: INTEGER boolean. Defaults to false. Indicates the active year.
+### `academic_year`
 
-### 3. `user`
+Tracks academic years for one school. This is still foundation-level; term validation is Phase 2.
 
-Represents an authenticated user (School Master, Teacher, Student, etc.).
+Key columns: `id`, `school_id`, `label`, `start_date`, `end_date`, `is_current`, lifecycle metadata.
 
-- **`id`**: UUID (Primary Key)
-- **`school_id`**: UUID, Not Null, Foreign Key to `school.id`. Tenant isolation boundary.
-- **`username`**: TEXT, Not Null, Unique.
-- **`password_hash`**: TEXT, Not Null. Bcrypt hash of the password.
-- **`role`**: TEXT, Not Null. Allowed values: `school_master`, `teacher`, `student`.
-- **`is_active`**: INTEGER boolean. Defaults to true. Used for soft deletion/locking.
-- **`created_at`**: TEXT timestamp. Defaults to current timestamp.
+Indexes:
 
-Phase 1.7.3 must replace this scaffold documentation with the approved schema conventions, migrations, repository primitives and seed policy.
+- `academic_year_school_id_idx`
+- `academic_year_school_label_unique`
+
+### `user`
+
+Stores local authenticated users for Version 1 roles.
+
+Allowed application roles: `SCHOOL_MASTER`, `TEACHER`.
+
+Key columns: `id`, `school_id`, `username`, `password_hash`, `role`, `is_active`, `failed_login_attempts`, `locked_until`, lifecycle metadata.
+
+Indexes:
+
+- `user_school_id_idx`
+- `user_school_username_unique`
+
+### `refresh_session`
+
+Tracks hashed rotating refresh-token sessions and session families.
+
+Key columns: `id`, `school_id`, `user_id`, `token_hash`, `family_id`, `replaced_by_session_id`, `expires_at`, `revoked_at`, lifecycle metadata.
+
+Indexes:
+
+- `refresh_session_school_id_idx`
+- `refresh_session_user_id_idx`
+- `refresh_session_family_id_idx`
+- `refresh_session_token_hash_unique`
+- `refresh_session_replaced_by_idx`
+
+### `audit_log`
+
+Append-only tenant-scoped audit events.
+
+Key columns: `id`, `school_id`, `actor_user_id`, `action`, `target_type`, `target_id`, `correlation_id`, `metadata_json`, `outcome`, `occurred_at`.
+
+Indexes:
+
+- `audit_log_school_id_idx`
+- `audit_log_actor_user_id_idx`
+- `audit_log_target_idx`
+
+### `schema_metadata`
+
+Stores local schema/seed metadata that must persist with the SQLite database. Its `key` column is a deliberate non-UUID primary-key exception because metadata records are addressed by stable names.
+
+Key columns: `key`, `value`, `description`, `created_at`, `updated_at`, `record_version`.
+
+## Migrations
+
+SQLite migration files live in `packages/db/migrations/sqlite`.
+
+`0001_aspiring_fixer.sql` is intentionally a table-rebuild migration for existing scaffold tables because SQLite cannot safely add several non-null timestamp columns or foreign-key changes with plain `ALTER TABLE`.
+
+## Seed Policy
+
+Foundation seed data is deterministic and idempotent. It uses synthetic demo schools only; real school or student data is forbidden in seeds and tests.
+
+Run after applying the schema:
+
+```bash
+pnpm run db:seed
+```
diff --git a/docs/decisions/ADR-007-tauri-sidecar-packaging-and-loopback.md b/docs/decisions/ADR-007-tauri-sidecar-packaging-and-loopback.md
new file mode 100644
index 0000000..0e5097d
--- /dev/null
+++ b/docs/decisions/ADR-007-tauri-sidecar-packaging-and-loopback.md
@@ -0,0 +1,57 @@
+# ADR-007: Tauri Sidecar Packaging and Loopback Protection
+
+## Status
+
+Accepted
+
+## Context
+
+Phase 1.2 must prove that EduTrack Africa can run as a local Windows desktop skeleton without asking a school to install Node.js, Rust or developer tooling. The desktop shell must load the Vite UI, launch the local Fastify API, create the SQLite database under `AppData/EduTrack`, and reject unrelated local web pages or processes that try to call privileged routes.
+
+The product specification also requires the sidecar packaging mechanism and WebView2 offline strategy to be selected during the deployment spike.
+
+## Decision
+
+Use Tauri 2 with an embedded external sidecar binary:
+
+- the React/Vite UI is built from `apps/web` and loaded by the Tauri WebView;
+- the Fastify API is packaged as a Windows executable with `@yao-pkg/pkg`;
+- the packaged sidecar is bundled by Tauri through `bundle.externalBin`;
+- Tauri launches the resolved sidecar executable from Rust using `std::process::Command`;
+- the sidecar binds to `127.0.0.1` on a random available port;
+- Tauri passes a per-run capability token through `EDUTRACK_SIDECAR_TOKEN`;
+- protected sidecar routes require the `x-edutrack-capability` header when a token is configured;
+- the sidecar rejects unexpected `Origin` values;
+- Tauri passes `EDUTRACK_SQLITE_PATH` pointing to `%APPDATA%\EduTrack\edutrack.sqlite`;
+- the sidecar opens `better-sqlite3`, creates the database directory if needed and applies a minimal deployment-probe migration before serving health checks;
+- Tauri performs a loopback `/health` request with the capability token before reporting the sidecar as ready.
+
+For Windows installers, use Tauri's NSIS bundler with:
+
+```json
+{
+  "webviewInstallMode": {
+    "type": "offlineInstaller"
+  }
+}
+```
+
+This embeds the WebView2 offline installer so a supported school machine can install without internet when WebView2 is absent.
+
+## Alternatives Considered
+
+- **Require globally installed Node.js:** rejected because school machines must not need developer tooling.
+- **Run the API directly from the React UI:** rejected because authorization, validation, transactions and audit behavior need a local service boundary.
+- **Expose the sidecar on the LAN:** rejected for Version 1 because the product is a single-machine offline desktop installation.
+- **Use Tauri's default WebView2 bootstrapper download:** rejected for the offline pilot path because it requires internet when WebView2 is missing.
+- **Use a fixed WebView2 runtime:** deferred because it increases installer size and operational ownership more than the offline installer option.
+
+## Consequences
+
+The Version 1 desktop skeleton can be distributed as a Tauri installer that includes the UI and packaged API sidecar. The pilot build remains local and SQLite-only.
+
+`@yao-pkg/pkg` is a build-time dependency, not a product runtime dependency. Native addon packaging for `better-sqlite3` must remain part of release verification because it is the highest-risk part of the sidecar packaging path.
+
+The capability token mitigates ordinary browser access to loopback routes, but it is not a complete local privilege boundary. Later authentication work must still enforce user identity, role authorization and audit requirements in application services.
+
+Unsigned local installers may be acceptable for the Phase 1 spike, but release-candidate signing and update policy remain Phase 8 work.
diff --git a/docs/deployment/phase-1-deployment-spike.md b/docs/deployment/phase-1-deployment-spike.md
new file mode 100644
index 0000000..a56127b
--- /dev/null
+++ b/docs/deployment/phase-1-deployment-spike.md
@@ -0,0 +1,57 @@
+# Phase 1 Deployment Spike
+
+This runbook verifies roadmap section 7.2 for the local Windows desktop skeleton.
+
+## Build
+
+```bash
+pnpm --filter @edutrack/api run build:sidecar
+pnpm run verify:sidecar
+pnpm --filter @edutrack/desktop run build
+```
+
+The sidecar build creates:
+
+```text
+apps/desktop/src-tauri/binaries/edutrack-api-sidecar-x86_64-pc-windows-msvc.exe
+```
+
+Tauri bundles that executable through `bundle.externalBin`.
+
+The verification command starts the packaged sidecar directly, calls `/health` with the local capability header, confirms the deployment-probe SQLite database is created, then shuts the sidecar down.
+
+## Local AppData Database
+
+When launched by Tauri, the sidecar receives:
+
+```text
+EDUTRACK_SQLITE_PATH=%APPDATA%\EduTrack\edutrack.sqlite
+```
+
+The API creates the directory, opens SQLite through `better-sqlite3`, enables WAL mode and applies the deployment-probe migration.
+
+## Loopback Protection
+
+The desktop shell starts the API on `127.0.0.1` with port `0`, allowing the OS to choose a free local port. Tauri reads the sidecar ready message, calls `/health`, and includes the `x-edutrack-capability` header.
+
+Requests with an unexpected `Origin` or missing capability token are rejected when the sidecar token is configured.
+
+## WebView2 Strategy
+
+Use Tauri's Windows `offlineInstaller` WebView2 mode for the Version 1 pilot installer. It makes the installer larger, but it avoids requiring internet on target school machines when WebView2 is missing.
+
+## Clean-Machine Verification
+
+Use a Windows 10 or Windows 11 machine with no Node.js, Rust or developer tools installed.
+
+1. Copy only the generated installer to the machine.
+2. Disconnect the machine from the internet.
+3. Run the installer.
+4. Launch EduTrack Africa.
+5. Confirm the UI opens.
+6. Confirm the sidecar status displays as verified.
+7. Confirm `%APPDATA%\EduTrack\edutrack.sqlite` exists.
+8. Close and relaunch the app.
+9. Confirm the same SQLite file remains in place.
+
+Record the Windows version, installer path, timestamp and result before closing roadmap item 7.2.
diff --git a/docs/deployment/phase-1-gate-evidence.md b/docs/deployment/phase-1-gate-evidence.md
new file mode 100644
index 0000000..ba1ad1c
--- /dev/null
+++ b/docs/deployment/phase-1-gate-evidence.md
@@ -0,0 +1,78 @@
+# Phase 1 Gate Evidence
+
+This document records the evidence used to close roadmap section 7.4.
+
+## Clean Source Verification
+
+Date: 2026-08-13
+
+Verification was run from a temporary clean source tree created from the repository contents, without relying on existing `dist` outputs or local `node_modules`.
+
+Commands:
+
+```bash
+pnpm install --frozen-lockfile
+pnpm run typecheck
+pnpm run test
+pnpm run build
+```
+
+Result: passed.
+
+Notes:
+
+- A clean-clone test initially exposed that `apps/api` tests resolved workspace packages through package `dist` exports before those packages had been built.
+- `apps/api/vitest.config.ts` now aliases `@edutrack/db` and `@edutrack/shared` to source files for tests, matching the source-alias pattern already used by the web app.
+
+## Desktop And Sidecar Verification
+
+Date: 2026-08-13
+
+Commands:
+
+```bash
+pnpm run verify:sidecar
+pnpm run check:desktop
+```
+
+Result: passed.
+
+Evidence:
+
+- `verify:sidecar` started the packaged sidecar executable, called `/health` over `127.0.0.1`, and confirmed a SQLite probe database was created.
+- `check:desktop` rebuilt the self-contained Windows sidecar and ran `cargo check` against the Tauri desktop shell.
+- `apps/desktop/src-tauri/tauri.conf.json` bundles the sidecar through `bundle.externalBin`.
+- `docs/decisions/ADR-007-tauri-sidecar-packaging-and-loopback.md` records the accepted packaging strategy and WebView2 offline installer mode.
+
+## Migration And Recovery Verification
+
+Date: 2026-08-13
+
+Commands:
+
+```bash
+pnpm --filter @edutrack/db run test
+pnpm run db:migrate
+pnpm run db:seed
+```
+
+Result: passed.
+
+Evidence:
+
+- The database foundation test applies the committed `0000` and `0001` SQLite migration files to a non-empty scaffold database.
+- The same test proves transaction rollback by inserting a school inside a transaction, throwing an error, and verifying the inserted row is absent.
+- The temporary migrate-and-seed smoke test created and seeded a fresh SQLite database under `.data`.
+
+## Runtime Independence
+
+The installed Version 1 skeleton does not require a globally installed Node.js runtime on school machines.
+
+Evidence:
+
+- The Fastify API is packaged into a Windows executable with `@yao-pkg/pkg`.
+- Tauri bundles that executable as an external sidecar.
+- The desktop shell launches the bundled sidecar from Rust rather than invoking `node`.
+- Tauri is configured with WebView2 `offlineInstaller` mode for the Windows installer.
+
+Developer commands still require Node.js, pnpm, Rust and build tooling. That requirement applies only to development and packaging, not to running the installed school application.
diff --git a/eslint.config.mjs b/eslint.config.mjs
index 62391ed..b02e94b 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -18,6 +18,7 @@ export default defineConfig([
       '**/test-results/**',
       '**/.corepack/**',
       'docs/archive/**',
+      'apps/desktop/src-tauri/gen/**',
       'packages/db/migrations/**',
     ],
   },
@@ -41,6 +42,14 @@ export default defineConfig([
       'no-console': ['warn', { allow: ['warn', 'error'] }],
     },
   },
+  {
+    files: ['apps/api/scripts/**/*.mjs', 'apps/api/pkg.sidecar.config.cjs'],
+    ...tseslint.configs.disableTypeChecked,
+    rules: {
+      ...tseslint.configs.disableTypeChecked.rules,
+      'no-console': 'off',
+    },
+  },
   {
     files: ['apps/web/src/**/*.{ts,tsx}'],
     plugins: {
diff --git a/package.json b/package.json
index e56bdbd..d949d60 100644
--- a/package.json
+++ b/package.json
@@ -6,16 +6,21 @@
   "packageManager": "pnpm@10.33.2",
   "scripts": {
     "dev": "pnpm --filter @edutrack/web run dev",
+    "dev:desktop": "pnpm --filter @edutrack/desktop run dev",
     "build": "pnpm --filter @edutrack/domain run build && pnpm --filter @edutrack/shared run build && pnpm --filter @edutrack/ui run build && pnpm --filter @edutrack/db run build && pnpm --filter @edutrack/api run build && pnpm --filter @edutrack/web run build",
+    "build:desktop": "pnpm --filter @edutrack/desktop run build",
+    "check:desktop": "pnpm --filter @edutrack/desktop run check",
+    "verify:sidecar": "pnpm --filter @edutrack/api run verify:sidecar",
     "format": "prettier . --write",
     "format:check": "prettier . --check",
     "lint": "eslint . --max-warnings=0",
     "typecheck": "tsc -b --pretty false",
     "test": "pnpm run test:unit",
-    "test:unit": "pnpm --filter @edutrack/api run test && pnpm --filter @edutrack/web run test",
+    "test:unit": "pnpm --filter @edutrack/db run test && pnpm --filter @edutrack/api run test && pnpm --filter @edutrack/web run test",
     "test:e2e": "playwright test",
     "db:generate": "pnpm --filter @edutrack/db run db:generate",
-    "db:migrate": "pnpm --filter @edutrack/db run db:migrate"
+    "db:migrate": "pnpm --filter @edutrack/db run db:migrate",
+    "db:seed": "pnpm --filter @edutrack/db run db:seed"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.5",
diff --git a/packages/db/migrations/sqlite/0001_aspiring_fixer.sql b/packages/db/migrations/sqlite/0001_aspiring_fixer.sql
new file mode 100644
index 0000000..15b1588
--- /dev/null
+++ b/packages/db/migrations/sqlite/0001_aspiring_fixer.sql
@@ -0,0 +1,190 @@
+PRAGMA foreign_keys=OFF;--> statement-breakpoint
+CREATE TABLE `__new_school` (
+	`id` text PRIMARY KEY NOT NULL,
+	`code` text NOT NULL,
+	`name` text NOT NULL,
+	`short_name` text,
+	`logo_url` text,
+	`address` text,
+	`city` text,
+	`country` text DEFAULT 'TD' NOT NULL,
+	`phone` text,
+	`email` text,
+	`motto` text,
+	`ministry_code` text,
+	`locale` text DEFAULT 'fr' NOT NULL,
+	`timezone` text DEFAULT 'Africa/Ndjamena' NOT NULL,
+	`currency` text DEFAULT 'XAF' NOT NULL,
+	`setup_status` text DEFAULT 'PENDING' NOT NULL,
+	`created_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`updated_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`record_version` integer DEFAULT 1 NOT NULL,
+	`deleted_at` text
+);--> statement-breakpoint
+INSERT INTO `__new_school` (
+	`id`,
+	`code`,
+	`name`,
+	`short_name`,
+	`logo_url`,
+	`address`,
+	`phone`,
+	`motto`,
+	`created_at`,
+	`updated_at`,
+	`record_version`
+)
+SELECT
+	`id`,
+	lower(replace(`id`, '-', '')),
+	`name`,
+	`short_name`,
+	`logo_url`,
+	`address`,
+	`phone`,
+	`motto`,
+	coalesce(`created_at`, CURRENT_TIMESTAMP),
+	CURRENT_TIMESTAMP,
+	1
+FROM `school`;--> statement-breakpoint
+DROP TABLE `school`;--> statement-breakpoint
+ALTER TABLE `__new_school` RENAME TO `school`;--> statement-breakpoint
+CREATE TABLE `__new_academic_year` (
+	`id` text PRIMARY KEY NOT NULL,
+	`school_id` text NOT NULL,
+	`label` text NOT NULL,
+	`start_date` text,
+	`end_date` text,
+	`is_current` integer DEFAULT false NOT NULL,
+	`created_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`updated_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`record_version` integer DEFAULT 1 NOT NULL,
+	`deleted_at` text,
+	FOREIGN KEY (`school_id`) REFERENCES `school`(`id`) ON UPDATE cascade ON DELETE restrict
+);--> statement-breakpoint
+INSERT INTO `__new_academic_year` (
+	`id`,
+	`school_id`,
+	`label`,
+	`start_date`,
+	`end_date`,
+	`is_current`,
+	`created_at`,
+	`updated_at`,
+	`record_version`
+)
+SELECT
+	`id`,
+	`school_id`,
+	`label`,
+	`start_date`,
+	`end_date`,
+	coalesce(`is_current`, false),
+	CURRENT_TIMESTAMP,
+	CURRENT_TIMESTAMP,
+	1
+FROM `academic_year`;--> statement-breakpoint
+DROP TABLE `academic_year`;--> statement-breakpoint
+ALTER TABLE `__new_academic_year` RENAME TO `academic_year`;--> statement-breakpoint
+CREATE TABLE `__new_user` (
+	`id` text PRIMARY KEY NOT NULL,
+	`school_id` text NOT NULL,
+	`username` text NOT NULL,
+	`password_hash` text NOT NULL,
+	`role` text NOT NULL,
+	`is_active` integer DEFAULT true NOT NULL,
+	`failed_login_attempts` integer DEFAULT 0 NOT NULL,
+	`locked_until` text,
+	`last_login_at` text,
+	`created_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`updated_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`record_version` integer DEFAULT 1 NOT NULL,
+	`deleted_at` text,
+	CONSTRAINT `user_role_check` CHECK(`role` in ('SCHOOL_MASTER', 'TEACHER')),
+	FOREIGN KEY (`school_id`) REFERENCES `school`(`id`) ON UPDATE cascade ON DELETE restrict
+);--> statement-breakpoint
+INSERT INTO `__new_user` (
+	`id`,
+	`school_id`,
+	`username`,
+	`password_hash`,
+	`role`,
+	`is_active`,
+	`created_at`,
+	`updated_at`,
+	`record_version`
+)
+SELECT
+	`id`,
+	`school_id`,
+	`username`,
+	`password_hash`,
+	CASE `role`
+		WHEN 'school_master' THEN 'SCHOOL_MASTER'
+		WHEN 'teacher' THEN 'TEACHER'
+		ELSE NULL
+	END,
+	coalesce(`is_active`, true),
+	coalesce(`created_at`, CURRENT_TIMESTAMP),
+	CURRENT_TIMESTAMP,
+	1
+FROM `user`;--> statement-breakpoint
+DROP TABLE `user`;--> statement-breakpoint
+ALTER TABLE `__new_user` RENAME TO `user`;--> statement-breakpoint
+CREATE TABLE `audit_log` (
+	`id` text PRIMARY KEY NOT NULL,
+	`school_id` text NOT NULL,
+	`actor_user_id` text,
+	`action` text NOT NULL,
+	`target_type` text NOT NULL,
+	`target_id` text,
+	`correlation_id` text,
+	`metadata_json` text DEFAULT '{}' NOT NULL,
+	`outcome` text DEFAULT 'SUCCESS' NOT NULL,
+	`occurred_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	CONSTRAINT `audit_log_outcome_check` CHECK(`outcome` in ('SUCCESS', 'FAILURE')),
+	FOREIGN KEY (`school_id`) REFERENCES `school`(`id`) ON UPDATE cascade ON DELETE restrict,
+	FOREIGN KEY (`actor_user_id`) REFERENCES `user`(`id`) ON UPDATE cascade ON DELETE restrict
+);--> statement-breakpoint
+CREATE TABLE `refresh_session` (
+	`id` text PRIMARY KEY NOT NULL,
+	`school_id` text NOT NULL,
+	`user_id` text NOT NULL,
+	`token_hash` text NOT NULL,
+	`family_id` text NOT NULL,
+	`replaced_by_session_id` text,
+	`device_name` text,
+	`user_agent_hash` text,
+	`expires_at` text NOT NULL,
+	`revoked_at` text,
+	`created_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`updated_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`record_version` integer DEFAULT 1 NOT NULL,
+	`deleted_at` text,
+	FOREIGN KEY (`school_id`) REFERENCES `school`(`id`) ON UPDATE cascade ON DELETE restrict,
+	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE cascade ON DELETE restrict,
+	FOREIGN KEY (`replaced_by_session_id`) REFERENCES `refresh_session`(`id`) ON UPDATE cascade ON DELETE restrict
+);--> statement-breakpoint
+CREATE TABLE `schema_metadata` (
+	`key` text PRIMARY KEY NOT NULL,
+	`value` text NOT NULL,
+	`description` text,
+	`created_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`updated_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`record_version` integer DEFAULT 1 NOT NULL
+);--> statement-breakpoint
+CREATE INDEX `audit_log_school_id_idx` ON `audit_log` (`school_id`);--> statement-breakpoint
+CREATE INDEX `audit_log_actor_user_id_idx` ON `audit_log` (`actor_user_id`);--> statement-breakpoint
+CREATE INDEX `audit_log_target_idx` ON `audit_log` (`target_type`,`target_id`);--> statement-breakpoint
+CREATE INDEX `refresh_session_school_id_idx` ON `refresh_session` (`school_id`);--> statement-breakpoint
+CREATE INDEX `refresh_session_user_id_idx` ON `refresh_session` (`user_id`);--> statement-breakpoint
+CREATE INDEX `refresh_session_family_id_idx` ON `refresh_session` (`family_id`);--> statement-breakpoint
+CREATE UNIQUE INDEX `refresh_session_token_hash_unique` ON `refresh_session` (`token_hash`);--> statement-breakpoint
+CREATE INDEX `refresh_session_replaced_by_idx` ON `refresh_session` (`replaced_by_session_id`);--> statement-breakpoint
+CREATE INDEX `academic_year_school_id_idx` ON `academic_year` (`school_id`);--> statement-breakpoint
+CREATE UNIQUE INDEX `academic_year_school_label_unique` ON `academic_year` (`school_id`,`label`);--> statement-breakpoint
+CREATE UNIQUE INDEX `school_code_unique` ON `school` (`code`);--> statement-breakpoint
+CREATE INDEX `user_school_id_idx` ON `user` (`school_id`);--> statement-breakpoint
+CREATE UNIQUE INDEX `user_school_username_unique` ON `user` (`school_id`,`username`);--> statement-breakpoint
+PRAGMA foreign_keys=ON;--> statement-breakpoint
+PRAGMA foreign_key_check;
diff --git a/packages/db/migrations/sqlite/meta/0001_snapshot.json b/packages/db/migrations/sqlite/meta/0001_snapshot.json
new file mode 100644
index 0000000..c52b0ef
--- /dev/null
+++ b/packages/db/migrations/sqlite/meta/0001_snapshot.json
@@ -0,0 +1,799 @@
+{
+  "version": "5",
+  "dialect": "sqlite",
+  "id": "41853e09-5108-4f55-8db4-2d82cd6e7f08",
+  "prevId": "0333b55a-b5d5-45a6-b287-f2e44c2a0d96",
+  "tables": {
+    "academic_year": {
+      "name": "academic_year",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "school_id": {
+          "name": "school_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "start_date": {
+          "name": "start_date",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "end_date": {
+          "name": "end_date",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "is_current": {
+          "name": "is_current",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        },
+        "record_version": {
+          "name": "record_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "academic_year_school_id_idx": {
+          "name": "academic_year_school_id_idx",
+          "columns": [
+            "school_id"
+          ],
+          "isUnique": false
+        },
+        "academic_year_school_label_unique": {
+          "name": "academic_year_school_label_unique",
+          "columns": [
+            "school_id",
+            "label"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {
+        "academic_year_school_id_school_id_fk": {
+          "name": "academic_year_school_id_school_id_fk",
+          "tableFrom": "academic_year",
+          "tableTo": "school",
+          "columnsFrom": [
+            "school_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {}
+    },
+    "audit_log": {
+      "name": "audit_log",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "school_id": {
+          "name": "school_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "metadata_json": {
+          "name": "metadata_json",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'{}'"
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'SUCCESS'"
+        },
+        "occurred_at": {
+          "name": "occurred_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        }
+      },
+      "indexes": {
+        "audit_log_school_id_idx": {
+          "name": "audit_log_school_id_idx",
+          "columns": [
+            "school_id"
+          ],
+          "isUnique": false
+        },
+        "audit_log_actor_user_id_idx": {
+          "name": "audit_log_actor_user_id_idx",
+          "columns": [
+            "actor_user_id"
+          ],
+          "isUnique": false
+        },
+        "audit_log_target_idx": {
+          "name": "audit_log_target_idx",
+          "columns": [
+            "target_type",
+            "target_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {
+        "audit_log_school_id_school_id_fk": {
+          "name": "audit_log_school_id_school_id_fk",
+          "tableFrom": "audit_log",
+          "tableTo": "school",
+          "columnsFrom": [
+            "school_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "cascade"
+        },
+        "audit_log_actor_user_id_user_id_fk": {
+          "name": "audit_log_actor_user_id_user_id_fk",
+          "tableFrom": "audit_log",
+          "tableTo": "user",
+          "columnsFrom": [
+            "actor_user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {}
+    },
+    "refresh_session": {
+      "name": "refresh_session",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "school_id": {
+          "name": "school_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "family_id": {
+          "name": "family_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "replaced_by_session_id": {
+          "name": "replaced_by_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "device_name": {
+          "name": "device_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "user_agent_hash": {
+          "name": "user_agent_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        },
+        "record_version": {
+          "name": "record_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "refresh_session_school_id_idx": {
+          "name": "refresh_session_school_id_idx",
+          "columns": [
+            "school_id"
+          ],
+          "isUnique": false
+        },
+        "refresh_session_user_id_idx": {
+          "name": "refresh_session_user_id_idx",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        },
+        "refresh_session_family_id_idx": {
+          "name": "refresh_session_family_id_idx",
+          "columns": [
+            "family_id"
+          ],
+          "isUnique": false
+        },
+        "refresh_session_token_hash_unique": {
+          "name": "refresh_session_token_hash_unique",
+          "columns": [
+            "token_hash"
+          ],
+          "isUnique": true
+        },
+        "refresh_session_replaced_by_idx": {
+          "name": "refresh_session_replaced_by_idx",
+          "columns": [
+            "replaced_by_session_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {
+        "refresh_session_school_id_school_id_fk": {
+          "name": "refresh_session_school_id_school_id_fk",
+          "tableFrom": "refresh_session",
+          "tableTo": "school",
+          "columnsFrom": [
+            "school_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "cascade"
+        },
+        "refresh_session_user_id_user_id_fk": {
+          "name": "refresh_session_user_id_user_id_fk",
+          "tableFrom": "refresh_session",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "cascade"
+        },
+        "refresh_session_replaced_by_session_id_refresh_session_id_fk": {
+          "name": "refresh_session_replaced_by_session_id_refresh_session_id_fk",
+          "tableFrom": "refresh_session",
+          "tableTo": "refresh_session",
+          "columnsFrom": [
+            "replaced_by_session_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {}
+    },
+    "schema_metadata": {
+      "name": "schema_metadata",
+      "columns": {
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        },
+        "record_version": {
+          "name": "record_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {}
+    },
+    "school": {
+      "name": "school",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "code": {
+          "name": "code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "short_name": {
+          "name": "short_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "logo_url": {
+          "name": "logo_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "address": {
+          "name": "address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "city": {
+          "name": "city",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "country": {
+          "name": "country",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'TD'"
+        },
+        "phone": {
+          "name": "phone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "motto": {
+          "name": "motto",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "ministry_code": {
+          "name": "ministry_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "locale": {
+          "name": "locale",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'fr'"
+        },
+        "timezone": {
+          "name": "timezone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'Africa/Ndjamena'"
+        },
+        "currency": {
+          "name": "currency",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'XAF'"
+        },
+        "setup_status": {
+          "name": "setup_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'PENDING'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        },
+        "record_version": {
+          "name": "record_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "school_code_unique": {
+          "name": "school_code_unique",
+          "columns": [
+            "code"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {}
+    },
+    "user": {
+      "name": "user",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "school_id": {
+          "name": "school_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "username": {
+          "name": "username",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "password_hash": {
+          "name": "password_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": true
+        },
+        "failed_login_attempts": {
+          "name": "failed_login_attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "locked_until": {
+          "name": "locked_until",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_login_at": {
+          "name": "last_login_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        },
+        "record_version": {
+          "name": "record_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "user_school_id_idx": {
+          "name": "user_school_id_idx",
+          "columns": [
+            "school_id"
+          ],
+          "isUnique": false
+        },
+        "user_school_username_unique": {
+          "name": "user_school_username_unique",
+          "columns": [
+            "school_id",
+            "username"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {
+        "user_school_id_school_id_fk": {
+          "name": "user_school_id_school_id_fk",
+          "tableFrom": "user",
+          "tableTo": "school",
+          "columnsFrom": [
+            "school_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {}
+    }
+  },
+  "enums": {},
+  "_meta": {
+    "schemas": {},
+    "tables": {},
+    "columns": {}
+  }
+}
\ No newline at end of file
diff --git a/packages/db/migrations/sqlite/meta/_journal.json b/packages/db/migrations/sqlite/meta/_journal.json
index 255448d..0d4afc5 100644
--- a/packages/db/migrations/sqlite/meta/_journal.json
+++ b/packages/db/migrations/sqlite/meta/_journal.json
@@ -8,6 +8,13 @@
       "when": 1786530002529,
       "tag": "0000_public_mongu",
       "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "5",
+      "when": 1786577589858,
+      "tag": "0001_aspiring_fixer",
+      "breakpoints": true
     }
   ]
 }
\ No newline at end of file
diff --git a/packages/db/package.json b/packages/db/package.json
index 6d9736c..3517407 100644
--- a/packages/db/package.json
+++ b/packages/db/package.json
@@ -14,11 +14,14 @@
   "scripts": {
     "build": "tsc",
     "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run --config vitest.config.ts",
     "db:generate": "drizzle-kit generate:sqlite --config=drizzle.sqlite.config.ts",
-    "db:migrate": "drizzle-kit push:sqlite --config=drizzle.sqlite.config.ts"
+    "db:migrate": "tsx scripts/migrate-sqlite.ts",
+    "db:push": "drizzle-kit push:sqlite --config=drizzle.sqlite.config.ts",
+    "db:seed": "tsx scripts/seed-foundation.ts"
   },
   "dependencies": {
-    "better-sqlite3": "^9.0.0",
+    "better-sqlite3": "^13.0.2",
     "drizzle-orm": "^0.30.0"
   },
   "devDependencies": {
diff --git a/packages/db/scripts/migrate-sqlite.ts b/packages/db/scripts/migrate-sqlite.ts
new file mode 100644
index 0000000..c17807b
--- /dev/null
+++ b/packages/db/scripts/migrate-sqlite.ts
@@ -0,0 +1,14 @@
+import 'dotenv/config';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { applyApplicationMigrations } from '../src/index';
+
+const packageRoot = fileURLToPath(new URL('..', import.meta.url));
+const workspaceRoot = resolve(packageRoot, '..', '..');
+const sqlitePath = process.env.EDUTRACK_SQLITE_PATH
+  ? resolve(process.env.EDUTRACK_SQLITE_PATH)
+  : resolve(workspaceRoot, '.data', 'edutrack.sqlite');
+const migrationsFolder = resolve(packageRoot, 'migrations/sqlite');
+const status = applyApplicationMigrations(sqlitePath, migrationsFolder);
+
+process.stdout.write(`Applied SQLite migrations in ${status.sqlitePath}\n`);
diff --git a/packages/db/scripts/seed-foundation.ts b/packages/db/scripts/seed-foundation.ts
new file mode 100644
index 0000000..c68eae8
--- /dev/null
+++ b/packages/db/scripts/seed-foundation.ts
@@ -0,0 +1,13 @@
+import 'dotenv/config';
+import { resolve } from 'node:path';
+import { openEduTrackDatabase, seedFoundation } from '../src/index';
+
+const sqlitePath = resolve(process.env.EDUTRACK_SQLITE_PATH ?? './.data/edutrack.sqlite');
+const connection = openEduTrackDatabase(sqlitePath);
+
+try {
+  seedFoundation(connection.db);
+  process.stdout.write(`Seeded foundation data in ${sqlitePath}\n`);
+} finally {
+  connection.close();
+}
diff --git a/packages/db/src/application-migrations.ts b/packages/db/src/application-migrations.ts
new file mode 100644
index 0000000..60079dc
--- /dev/null
+++ b/packages/db/src/application-migrations.ts
@@ -0,0 +1,84 @@
+import { migrate } from 'drizzle-orm/better-sqlite3/migrator';
+import { existsSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { openEduTrackDatabase } from './client';
+
+const SQLITE_MIGRATIONS_FOLDER_ENV = 'EDUTRACK_SQLITE_MIGRATIONS_DIR';
+
+interface PkgProcess extends NodeJS.Process {
+  pkg?: {
+    entrypoint?: string;
+  };
+}
+
+export interface ApplicationMigrationStatus {
+  sqlitePath: string;
+  migrationsFolder: string;
+  migrated: true;
+}
+
+export function applyApplicationMigrations(
+  sqlitePath: string,
+  migrationsFolder = resolveSqliteMigrationsFolder()
+): ApplicationMigrationStatus {
+  const connection = openEduTrackDatabase(sqlitePath);
+
+  try {
+    migrate(connection.db, { migrationsFolder });
+
+    return {
+      sqlitePath,
+      migrationsFolder,
+      migrated: true,
+    };
+  } finally {
+    connection.close();
+  }
+}
+
+export function resolveSqliteMigrationsFolder(env: NodeJS.ProcessEnv = process.env) {
+  const configuredFolder = env[SQLITE_MIGRATIONS_FOLDER_ENV];
+
+  if (configuredFolder) {
+    return requireMigrationsFolder(resolve(configuredFolder));
+  }
+
+  for (const candidate of sqliteMigrationsFolderCandidates()) {
+    if (isMigrationsFolder(candidate)) {
+      return candidate;
+    }
+  }
+
+  throw new Error(
+    `Could not find SQLite migrations. Set ${SQLITE_MIGRATIONS_FOLDER_ENV} or include packages/db/migrations/sqlite in the sidecar package.`
+  );
+}
+
+function sqliteMigrationsFolderCandidates() {
+  const candidates = new Set<string>();
+  const packagedEntrypoint = (process as PkgProcess).pkg?.entrypoint;
+
+  if (packagedEntrypoint) {
+    candidates.add(
+      join(dirname(packagedEntrypoint), '..', '..', '..', 'packages', 'db', 'migrations', 'sqlite')
+    );
+  }
+
+  candidates.add(resolve(process.cwd(), 'packages', 'db', 'migrations', 'sqlite'));
+  candidates.add(resolve(process.cwd(), '..', '..', 'packages', 'db', 'migrations', 'sqlite'));
+  candidates.add(resolve(process.cwd(), 'migrations', 'sqlite'));
+
+  return [...candidates];
+}
+
+function requireMigrationsFolder(migrationsFolder: string) {
+  if (!isMigrationsFolder(migrationsFolder)) {
+    throw new Error(`SQLite migrations folder is missing meta/_journal.json: ${migrationsFolder}`);
+  }
+
+  return migrationsFolder;
+}
+
+function isMigrationsFolder(migrationsFolder: string) {
+  return existsSync(join(migrationsFolder, 'meta', '_journal.json'));
+}
diff --git a/packages/db/src/client.ts b/packages/db/src/client.ts
new file mode 100644
index 0000000..74c63a3
--- /dev/null
+++ b/packages/db/src/client.ts
@@ -0,0 +1,42 @@
+import Database from 'better-sqlite3';
+import { drizzle, type BetterSQLite3Database } from 'drizzle-orm/better-sqlite3';
+import { mkdirSync } from 'node:fs';
+import { dirname } from 'node:path';
+import * as schema from './schema.sqlite';
+
+export type EduTrackDatabase = BetterSQLite3Database<typeof schema>;
+export type EduTrackTransaction = Parameters<Parameters<EduTrackDatabase['transaction']>[0]>[0];
+type SyncTransactionOperation<T extends (transaction: EduTrackTransaction) => unknown> = [
+  ReturnType<T>,
+] extends [never]
+  ? T
+  : ReturnType<T> extends PromiseLike<unknown>
+    ? never
+    : T;
+
+export interface EduTrackDatabaseConnection {
+  db: EduTrackDatabase;
+  sqlite: Database.Database;
+  close: () => void;
+}
+
+export function openEduTrackDatabase(sqlitePath: string): EduTrackDatabaseConnection {
+  mkdirSync(dirname(sqlitePath), { recursive: true });
+
+  const sqlite = new Database(sqlitePath);
+  sqlite.pragma('foreign_keys = ON');
+  sqlite.pragma('journal_mode = WAL');
+
+  return {
+    db: drizzle(sqlite, { schema }),
+    sqlite,
+    close: () => sqlite.close(),
+  };
+}
+
+export function withTransaction<T extends (transaction: EduTrackTransaction) => unknown>(
+  db: EduTrackDatabase,
+  operation: SyncTransactionOperation<T>
+): ReturnType<T> {
+  return db.transaction(operation) as ReturnType<T>;
+}
diff --git a/packages/db/src/client.type-test.ts b/packages/db/src/client.type-test.ts
new file mode 100644
index 0000000..a396cd4
--- /dev/null
+++ b/packages/db/src/client.type-test.ts
@@ -0,0 +1,9 @@
+import type { EduTrackDatabase } from './client';
+import { withTransaction } from './client';
+
+export function assertWithTransactionCallbackTypes(db: EduTrackDatabase) {
+  withTransaction(db, () => 'committed');
+
+  // @ts-expect-error better-sqlite3 transactions are synchronous and must not accept async callbacks.
+  void withTransaction(db, () => Promise.resolve('committed-later'));
+}
diff --git a/packages/db/src/database-foundation.test.ts b/packages/db/src/database-foundation.test.ts
new file mode 100644
index 0000000..5ca78ac
--- /dev/null
+++ b/packages/db/src/database-foundation.test.ts
@@ -0,0 +1,345 @@
+import Database from 'better-sqlite3';
+import { count, eq } from 'drizzle-orm';
+import { drizzle } from 'drizzle-orm/better-sqlite3';
+import { readFileSync, readdirSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import {
+  applyApplicationMigrations,
+  resolveSqliteMigrationsFolder,
+} from './application-migrations';
+import type { EduTrackDatabase } from './client';
+import { withTransaction } from './client';
+import {
+  createAuditLogRepository,
+  createTenantContext,
+  createUserRepository,
+} from './repositories';
+import * as schema from './schema.sqlite';
+import { foundationSeed, seedFoundation } from './seeds';
+
+const migrationsDir = fileURLToPath(new URL('../migrations/sqlite/', import.meta.url));
+const legacySchoolId = '11111111-1111-4111-8111-111111111111';
+const legacyUserId = '22222222-2222-4222-8222-222222222222';
+
+describe('database foundation migrations', () => {
+  let sqlite: Database.Database;
+
+  afterEach(() => {
+    sqlite.close();
+  });
+
+  it('applies the 7.3 migration to a non-empty scaffold database', () => {
+    sqlite = new Database(':memory:');
+    sqlite.pragma('foreign_keys = ON');
+    applyMigration(sqlite, '0000_public_mongu.sql');
+
+    sqlite
+      .prepare(
+        `
+          INSERT INTO school (id, name, short_name, created_at)
+          VALUES (?, ?, ?, ?)
+        `
+      )
+      .run(legacySchoolId, 'Legacy School', 'Legacy', '2026-01-01 00:00:00');
+    sqlite
+      .prepare(
+        `
+          INSERT INTO academic_year (id, school_id, label, is_current)
+          VALUES (?, ?, ?, ?)
+        `
+      )
+      .run('33333333-3333-4333-8333-333333333333', legacySchoolId, '2026-2027', 1);
+    sqlite
+      .prepare(
+        `
+          INSERT INTO user (id, school_id, username, password_hash, role, is_active)
+          VALUES (?, ?, ?, ?, ?, ?)
+        `
+      )
+      .run(legacyUserId, legacySchoolId, 'directeur', 'legacy-hash', 'school_master', 1);
+
+    applyMigration(sqlite, '0001_aspiring_fixer.sql');
+
+    const migratedSchool = sqlite
+      .prepare(
+        `
+          SELECT code, country, timezone, record_version
+          FROM school
+          WHERE id = ?
+        `
+      )
+      .get(legacySchoolId) as {
+      code: string;
+      country: string;
+      timezone: string;
+      record_version: number;
+    };
+    const migratedUser = sqlite
+      .prepare(
+        `
+          SELECT role, failed_login_attempts, record_version
+          FROM user
+          WHERE id = ?
+        `
+      )
+      .get(legacyUserId) as {
+      role: string;
+      failed_login_attempts: number;
+      record_version: number;
+    };
+
+    expect(migratedSchool).toEqual({
+      code: legacySchoolId.replaceAll('-', ''),
+      country: 'TD',
+      timezone: 'Africa/Ndjamena',
+      record_version: 1,
+    });
+    expect(migratedUser).toEqual({
+      role: 'SCHOOL_MASTER',
+      failed_login_attempts: 0,
+      record_version: 1,
+    });
+    expect(() =>
+      sqlite
+        .prepare(
+          `
+            INSERT INTO user (id, school_id, username, password_hash, role)
+            VALUES (?, ?, ?, ?, ?)
+          `
+        )
+        .run(
+          '44444444-4444-4444-8444-444444444444',
+          legacySchoolId,
+          'invalid-role',
+          'hash',
+          'administrator'
+        )
+    ).toThrow();
+    expect(() =>
+      sqlite
+        .prepare(
+          `
+            INSERT INTO audit_log (id, school_id, action, target_type, outcome)
+            VALUES (?, ?, ?, ?, ?)
+          `
+        )
+        .run('55555555-5555-4555-8555-555555555555', legacySchoolId, 'TEST', 'user', 'UNKNOWN')
+    ).toThrow();
+  });
+
+  it('rejects unmapped legacy user roles during the 7.3 migration', () => {
+    sqlite = new Database(':memory:');
+    sqlite.pragma('foreign_keys = ON');
+    applyMigration(sqlite, '0000_public_mongu.sql');
+
+    sqlite
+      .prepare(
+        `
+          INSERT INTO school (id, name, short_name, created_at)
+          VALUES (?, ?, ?, ?)
+        `
+      )
+      .run(legacySchoolId, 'Legacy School', 'Legacy', '2026-01-01 00:00:00');
+    sqlite
+      .prepare(
+        `
+          INSERT INTO user (id, school_id, username, password_hash, role, is_active)
+          VALUES (?, ?, ?, ?, ?, ?)
+        `
+      )
+      .run(legacyUserId, legacySchoolId, 'admin', 'legacy-hash', 'administrator', 1);
+
+    expect(() => {
+      applyMigration(sqlite, '0001_aspiring_fixer.sql');
+    }).toThrow();
+  });
+});
+
+describe('application migration helper', () => {
+  let sqlite: Database.Database | undefined;
+
+  afterEach(() => {
+    sqlite?.close();
+    sqlite = undefined;
+  });
+
+  it('resolves the repository sqlite migration folder', () => {
+    expect(resolveSqliteMigrationsFolder()).toBe(resolve(migrationsDir));
+  });
+
+  it('applies committed application migrations to a sqlite database', () => {
+    sqlite = new Database(':memory:');
+    sqlite.close();
+    sqlite = undefined;
+
+    const status = applyApplicationMigrations(':memory:', migrationsDir);
+
+    expect(status).toEqual({
+      sqlitePath: ':memory:',
+      migrationsFolder: migrationsDir,
+      migrated: true,
+    });
+  });
+});
+
+describe('tenant-scoped database primitives', () => {
+  let sqlite: Database.Database;
+  let db: EduTrackDatabase;
+
+  beforeEach(() => {
+    sqlite = new Database(':memory:');
+    sqlite.pragma('foreign_keys = ON');
+    applyAllMigrations(sqlite);
+    db = drizzle(sqlite, { schema });
+    seedFoundation(db);
+    seedFoundation(db);
+  });
+
+  afterEach(() => {
+    sqlite.close();
+  });
+
+  it('seeds deterministic foundation data idempotently', () => {
+    const [schoolCount] = db.select({ value: count() }).from(schema.school).all();
+    const [userCount] = db.select({ value: count() }).from(schema.user).all();
+    const [seedVersion] = db
+      .select()
+      .from(schema.schemaMetadata)
+      .where(eq(schema.schemaMetadata.key, 'seed.foundation.version'))
+      .all();
+
+    expect(schoolCount?.value).toBe(2);
+    expect(userCount?.value).toBe(2);
+    expect(seedVersion?.value).toBe('phase-1.3-foundation-2026-08-12');
+  });
+
+  it('updates deterministic foundation rows when the seed version changes', () => {
+    const [firstSchool] = foundationSeed.schools;
+
+    db.update(schema.school)
+      .set({ name: 'Outdated demo name' })
+      .where(eq(schema.school.id, firstSchool.id))
+      .run();
+    db.update(schema.schemaMetadata)
+      .set({ value: 'older-foundation-version' })
+      .where(eq(schema.schemaMetadata.key, 'seed.foundation.version'))
+      .run();
+
+    seedFoundation(db);
+
+    const upgradedSchool = db
+      .select({ name: schema.school.name })
+      .from(schema.school)
+      .where(eq(schema.school.id, firstSchool.id))
+      .get();
+    const upgradedSeedVersion = db
+      .select({ value: schema.schemaMetadata.value })
+      .from(schema.schemaMetadata)
+      .where(eq(schema.schemaMetadata.key, 'seed.foundation.version'))
+      .get();
+
+    expect(upgradedSchool?.name).toBe(firstSchool.name);
+    expect(upgradedSeedVersion?.value).toBe('phase-1.3-foundation-2026-08-12');
+  });
+
+  it('isolates the first tenant-owned user query by school', () => {
+    const [firstSchool, secondSchool] = foundationSeed.schools;
+    const firstTenantUsers = createUserRepository(
+      db,
+      createTenantContext(` ${firstSchool.id} `)
+    ).listActiveUsers();
+    const secondTenantUser = createUserRepository(
+      db,
+      createTenantContext(secondSchool.id)
+    ).findActiveByUsername('directeur');
+
+    expect(firstTenantUsers).toHaveLength(1);
+    expect(firstTenantUsers[0]?.schoolId).toBe(firstSchool.id);
+    expect(firstTenantUsers[0]?.username).toBe('directeur');
+    expect(firstTenantUsers[0]).not.toHaveProperty('passwordHash');
+    expect(secondTenantUser?.schoolId).toBe(secondSchool.id);
+    expect(secondTenantUser?.username).toBe('directeur');
+    expect(secondTenantUser).not.toHaveProperty('passwordHash');
+  });
+
+  it('returns non-sensitive user columns when creating a user', () => {
+    const [firstSchool] = foundationSeed.schools;
+    const repository = createUserRepository(db, createTenantContext(firstSchool.id));
+
+    const createdUser = repository.createUser({
+      id: '66666666-6666-4666-8666-666666666666',
+      username: 'enseignant',
+      passwordHash: 'stored-hash',
+      role: 'TEACHER',
+    });
+
+    expect(createdUser).toMatchObject({
+      id: '66666666-6666-4666-8666-666666666666',
+      schoolId: firstSchool.id,
+      username: 'enseignant',
+      role: 'TEACHER',
+    });
+    expect(createdUser).not.toHaveProperty('passwordHash');
+  });
+
+  it('serializes audit metadata defensively', () => {
+    const [firstSchool] = foundationSeed.schools;
+    const repository = createAuditLogRepository(db, createTenantContext(firstSchool.id));
+    const metadata: Record<string, unknown> = { count: 1n };
+    metadata.self = metadata;
+
+    const event = repository.createEvent({
+      action: 'TEST',
+      targetType: 'school',
+      targetId: firstSchool.id,
+      metadata,
+    });
+
+    expect(JSON.parse(event.metadataJson)).toEqual({
+      count: '1',
+      self: '[Circular]',
+    });
+  });
+
+  it('rolls back transaction work when an operation fails', () => {
+    expect(() =>
+      withTransaction(db, (transaction) => {
+        transaction
+          .insert(schema.school)
+          .values({
+            id: '99999999-9999-4999-8999-999999999999',
+            code: 'ROLLBACK',
+            name: 'Rollback School',
+          })
+          .run();
+
+        throw new Error('abort transaction');
+      })
+    ).toThrow('abort transaction');
+
+    const rollbackSchool = db
+      .select()
+      .from(schema.school)
+      .where(eq(schema.school.code, 'ROLLBACK'))
+      .get();
+
+    expect(rollbackSchool).toBeUndefined();
+  });
+});
+
+function applyAllMigrations(sqlite: Database.Database) {
+  const migrationFiles = readdirSync(migrationsDir)
+    .filter((file) => file.endsWith('.sql'))
+    .sort();
+
+  for (const migrationFile of migrationFiles) {
+    applyMigration(sqlite, migrationFile);
+  }
+}
+
+function applyMigration(sqlite: Database.Database, fileName: string) {
+  const migrationSql = readFileSync(join(migrationsDir, fileName), 'utf8');
+  sqlite.exec(migrationSql.replaceAll('--> statement-breakpoint', '\n'));
+}
diff --git a/packages/db/src/deployment.ts b/packages/db/src/deployment.ts
new file mode 100644
index 0000000..973811d
--- /dev/null
+++ b/packages/db/src/deployment.ts
@@ -0,0 +1,88 @@
+import { mkdirSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+import type DatabaseConstructor from 'better-sqlite3';
+
+const APP_DATA_FOLDER = 'EduTrack';
+const DEFAULT_SQLITE_FILENAME = 'edutrack.sqlite';
+const DEPLOYMENT_MIGRATION_ID = 'deployment-probe-0001';
+const Database = loadDatabaseConstructor();
+
+type BetterSqlite3Constructor = typeof DatabaseConstructor;
+
+export interface DeploymentDatabaseStatus {
+  sqlitePath: string;
+  migrated: boolean;
+  migrationId: string;
+}
+
+export function resolveDefaultSqlitePath(env: NodeJS.ProcessEnv = process.env) {
+  const appDataRoot = env.APPDATA ?? env.LOCALAPPDATA;
+
+  if (appDataRoot) {
+    return join(appDataRoot, APP_DATA_FOLDER, DEFAULT_SQLITE_FILENAME);
+  }
+
+  return join(process.cwd(), '.data', DEFAULT_SQLITE_FILENAME);
+}
+
+export function resolveConfiguredSqlitePath(env: NodeJS.ProcessEnv = process.env) {
+  return env.EDUTRACK_SQLITE_PATH ?? resolveDefaultSqlitePath(env);
+}
+
+export function ensureDeploymentDatabase(sqlitePath = resolveConfiguredSqlitePath()) {
+  mkdirSync(dirname(sqlitePath), { recursive: true });
+
+  const database = new Database(sqlitePath);
+
+  try {
+    database.pragma('journal_mode = WAL');
+    database.exec(`
+      CREATE TABLE IF NOT EXISTS __edutrack_deployment_migrations (
+        id TEXT PRIMARY KEY NOT NULL,
+        applied_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+      );
+
+      CREATE TABLE IF NOT EXISTS __edutrack_deployment_probe (
+        id INTEGER PRIMARY KEY CHECK (id = 1),
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        last_verified_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+      );
+    `);
+
+    const transaction = database.transaction(() => {
+      database
+        .prepare('INSERT OR IGNORE INTO __edutrack_deployment_migrations (id) VALUES (?)')
+        .run(DEPLOYMENT_MIGRATION_ID);
+
+      database
+        .prepare(
+          `
+            INSERT INTO __edutrack_deployment_probe (id)
+            VALUES (1)
+            ON CONFLICT(id) DO UPDATE SET last_verified_at = CURRENT_TIMESTAMP
+          `
+        )
+        .run();
+    });
+
+    transaction();
+
+    return {
+      sqlitePath,
+      migrated: true,
+      migrationId: DEPLOYMENT_MIGRATION_ID,
+    } satisfies DeploymentDatabaseStatus;
+  } finally {
+    database.close();
+  }
+}
+
+function loadDatabaseConstructor(): BetterSqlite3Constructor {
+  if (typeof require === 'function') {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports -- pkg needs this literal require to include better-sqlite3's native binding.
+    return require('better-sqlite3') as BetterSqlite3Constructor;
+  }
+
+  return createRequire(import.meta.url)('better-sqlite3') as BetterSqlite3Constructor;
+}
diff --git a/packages/db/src/index.ts b/packages/db/src/index.ts
index 2efe8e4..786f52c 100644
--- a/packages/db/src/index.ts
+++ b/packages/db/src/index.ts
@@ -1 +1,6 @@
+export * from './application-migrations';
+export * from './client';
+export * from './deployment';
+export * from './repositories';
+export * from './seeds';
 export * from './schema.sqlite';
diff --git a/packages/db/src/repositories.ts b/packages/db/src/repositories.ts
new file mode 100644
index 0000000..a62d686
--- /dev/null
+++ b/packages/db/src/repositories.ts
@@ -0,0 +1,157 @@
+import { and, eq, isNull } from 'drizzle-orm';
+import { randomUUID } from 'node:crypto';
+import type { EduTrackDatabase } from './client';
+import { auditLog, type AuditOutcome, user, type UserRole } from './schema.sqlite';
+
+export interface TenantContext {
+  schoolId: string;
+}
+
+export interface CreateAuditLogInput {
+  id?: string;
+  actorUserId?: string | null;
+  action: string;
+  targetType: string;
+  targetId?: string | null;
+  correlationId?: string | null;
+  metadata?: Record<string, unknown>;
+  outcome?: AuditOutcome;
+}
+
+export interface CreateUserInput {
+  id?: string;
+  username: string;
+  passwordHash: string;
+  role: UserRole;
+}
+
+export function createTenantContext(schoolId: string): TenantContext {
+  const trimmedSchoolId = schoolId.trim();
+
+  if (!trimmedSchoolId) {
+    throw new Error('Tenant context requires a non-empty schoolId.');
+  }
+
+  return { schoolId: trimmedSchoolId };
+}
+
+export class TenantScopedRepository {
+  protected readonly schoolId: string;
+
+  constructor(
+    protected readonly db: EduTrackDatabase,
+    tenant: TenantContext
+  ) {
+    this.schoolId = createTenantContext(tenant.schoolId).schoolId;
+  }
+}
+
+export class UserRepository extends TenantScopedRepository {
+  listActiveUsers() {
+    return this.db
+      .select(safeUserColumns)
+      .from(user)
+      .where(and(eq(user.schoolId, this.schoolId), eq(user.isActive, true), isNull(user.deletedAt)))
+      .all();
+  }
+
+  findActiveByUsername(username: string) {
+    return this.db
+      .select(safeUserColumns)
+      .from(user)
+      .where(
+        and(
+          eq(user.schoolId, this.schoolId),
+          eq(user.username, username),
+          eq(user.isActive, true),
+          isNull(user.deletedAt)
+        )
+      )
+      .get();
+  }
+
+  createUser(input: CreateUserInput) {
+    const createdUser = this.db
+      .insert(user)
+      .values({
+        id: input.id ?? randomUUID(),
+        schoolId: this.schoolId,
+        username: input.username,
+        passwordHash: input.passwordHash,
+        role: input.role,
+      })
+      .returning(safeUserColumns)
+      .get();
+
+    return createdUser;
+  }
+}
+
+export class AuditLogRepository extends TenantScopedRepository {
+  createEvent(input: CreateAuditLogInput) {
+    const createdEvent = this.db
+      .insert(auditLog)
+      .values({
+        id: input.id ?? randomUUID(),
+        schoolId: this.schoolId,
+        actorUserId: input.actorUserId ?? null,
+        action: input.action,
+        targetType: input.targetType,
+        targetId: input.targetId ?? null,
+        correlationId: input.correlationId ?? null,
+        metadataJson: serializeAuditMetadata(input.metadata),
+        outcome: input.outcome ?? 'SUCCESS',
+      })
+      .returning()
+      .get();
+
+    return createdEvent;
+  }
+}
+
+export function createUserRepository(db: EduTrackDatabase, tenant: TenantContext) {
+  return new UserRepository(db, tenant);
+}
+
+export function createAuditLogRepository(db: EduTrackDatabase, tenant: TenantContext) {
+  return new AuditLogRepository(db, tenant);
+}
+
+const safeUserColumns = {
+  id: user.id,
+  schoolId: user.schoolId,
+  username: user.username,
+  role: user.role,
+  isActive: user.isActive,
+  failedLoginAttempts: user.failedLoginAttempts,
+  lockedUntil: user.lockedUntil,
+  lastLoginAt: user.lastLoginAt,
+  createdAt: user.createdAt,
+  updatedAt: user.updatedAt,
+  recordVersion: user.recordVersion,
+  deletedAt: user.deletedAt,
+};
+
+function serializeAuditMetadata(metadata: Record<string, unknown> | undefined) {
+  const seen = new WeakSet();
+
+  try {
+    return JSON.stringify(metadata ?? {}, (_key: string, value: unknown) => {
+      if (typeof value === 'bigint') {
+        return value.toString();
+      }
+
+      if (typeof value === 'object' && value !== null) {
+        if (seen.has(value)) {
+          return '[Circular]';
+        }
+
+        seen.add(value);
+      }
+
+      return value;
+    });
+  } catch {
+    return JSON.stringify({ serialization: 'failed' });
+  }
+}
diff --git a/packages/db/src/schema.sqlite.ts b/packages/db/src/schema.sqlite.ts
index 399fb2a..81529e8 100644
--- a/packages/db/src/schema.sqlite.ts
+++ b/packages/db/src/schema.sqlite.ts
@@ -1,36 +1,178 @@
-import { sqliteTable, text, integer } from 'drizzle-orm/sqlite-core';
 import { sql } from 'drizzle-orm';
+import {
+  check,
+  index,
+  integer,
+  sqliteTable,
+  text,
+  type AnySQLiteColumn,
+  uniqueIndex,
+} from 'drizzle-orm/sqlite-core';
 
-export const school = sqliteTable('school', {
-  id: text('id').primaryKey(),
-  name: text('name').notNull(),
-  short_name: text('short_name'),
-  logo_url: text('logo_url'),
-  address: text('address'),
-  phone: text('phone'),
-  motto: text('motto'),
-  created_at: text('created_at').default(sql`CURRENT_TIMESTAMP`),
-});
+const currentTimestamp = sql`CURRENT_TIMESTAMP`;
 
-export const academic_year = sqliteTable('academic_year', {
-  id: text('id').primaryKey(),
-  school_id: text('school_id')
-    .references(() => school.id)
-    .notNull(),
-  label: text('label').notNull(),
-  start_date: text('start_date'),
-  end_date: text('end_date'),
-  is_current: integer('is_current', { mode: 'boolean' }).default(false),
-});
+export const userRoles = ['SCHOOL_MASTER', 'TEACHER'] as const;
+export type UserRole = (typeof userRoles)[number];
+
+export const auditOutcomes = ['SUCCESS', 'FAILURE'] as const;
+export type AuditOutcome = (typeof auditOutcomes)[number];
+
+export const school = sqliteTable(
+  'school',
+  {
+    id: uuidPrimaryKey(),
+    code: text('code').notNull(),
+    name: text('name').notNull(),
+    shortName: text('short_name'),
+    logoUrl: text('logo_url'),
+    address: text('address'),
+    city: text('city'),
+    country: text('country').notNull().default('TD'),
+    phone: text('phone'),
+    email: text('email'),
+    motto: text('motto'),
+    ministryCode: text('ministry_code'),
+    locale: text('locale').notNull().default('fr'),
+    timezone: text('timezone').notNull().default('Africa/Ndjamena'),
+    currency: text('currency').notNull().default('XAF'),
+    setupStatus: text('setup_status').notNull().default('PENDING'),
+    ...recordLifecycleColumns(),
+  },
+  (table) => ({
+    codeUnique: uniqueIndex('school_code_unique').on(table.code),
+  })
+);
+
+export const academicYear = sqliteTable(
+  'academic_year',
+  {
+    id: uuidPrimaryKey(),
+    ...tenantColumns(),
+    label: text('label').notNull(),
+    startDate: text('start_date'),
+    endDate: text('end_date'),
+    isCurrent: integer('is_current', { mode: 'boolean' }).notNull().default(false),
+    ...recordLifecycleColumns(),
+  },
+  (table) => ({
+    schoolIdIdx: index('academic_year_school_id_idx').on(table.schoolId),
+    schoolLabelUnique: uniqueIndex('academic_year_school_label_unique').on(
+      table.schoolId,
+      table.label
+    ),
+  })
+);
+
+export const user = sqliteTable(
+  'user',
+  {
+    id: uuidPrimaryKey(),
+    ...tenantColumns(),
+    username: text('username').notNull(),
+    passwordHash: text('password_hash').notNull(),
+    role: text('role').$type<UserRole>().notNull(),
+    isActive: integer('is_active', { mode: 'boolean' }).notNull().default(true),
+    failedLoginAttempts: integer('failed_login_attempts').notNull().default(0),
+    lockedUntil: text('locked_until'),
+    lastLoginAt: text('last_login_at'),
+    ...recordLifecycleColumns(),
+  },
+  (table) => ({
+    schoolIdIdx: index('user_school_id_idx').on(table.schoolId),
+    schoolUsernameUnique: uniqueIndex('user_school_username_unique').on(
+      table.schoolId,
+      table.username
+    ),
+    roleCheck: check('user_role_check', sql`${table.role} in ('SCHOOL_MASTER', 'TEACHER')`),
+  })
+);
 
-export const user = sqliteTable('user', {
-  id: text('id').primaryKey(),
-  school_id: text('school_id')
-    .references(() => school.id)
-    .notNull(),
-  username: text('username').notNull().unique(),
-  password_hash: text('password_hash').notNull(),
-  role: text('role').notNull(), // school_master, teacher, student
-  is_active: integer('is_active', { mode: 'boolean' }).default(true),
-  created_at: text('created_at').default(sql`CURRENT_TIMESTAMP`),
+export const refreshSession = sqliteTable(
+  'refresh_session',
+  {
+    id: uuidPrimaryKey(),
+    ...tenantColumns(),
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'restrict', onUpdate: 'cascade' }),
+    tokenHash: text('token_hash').notNull(),
+    familyId: text('family_id').notNull(),
+    replacedBySessionId: text('replaced_by_session_id').references(
+      (): AnySQLiteColumn => refreshSession.id,
+      {
+        onDelete: 'restrict',
+        onUpdate: 'cascade',
+      }
+    ),
+    deviceName: text('device_name'),
+    userAgentHash: text('user_agent_hash'),
+    expiresAt: text('expires_at').notNull(),
+    revokedAt: text('revoked_at'),
+    ...recordLifecycleColumns(),
+  },
+  (table) => ({
+    schoolIdIdx: index('refresh_session_school_id_idx').on(table.schoolId),
+    userIdIdx: index('refresh_session_user_id_idx').on(table.userId),
+    familyIdIdx: index('refresh_session_family_id_idx').on(table.familyId),
+    tokenHashUnique: uniqueIndex('refresh_session_token_hash_unique').on(table.tokenHash),
+    replacedBySessionFk: index('refresh_session_replaced_by_idx').on(table.replacedBySessionId),
+  })
+);
+
+export const auditLog = sqliteTable(
+  'audit_log',
+  {
+    id: uuidPrimaryKey(),
+    ...tenantColumns(),
+    actorUserId: text('actor_user_id').references(() => user.id, {
+      onDelete: 'restrict',
+      onUpdate: 'cascade',
+    }),
+    action: text('action').notNull(),
+    targetType: text('target_type').notNull(),
+    targetId: text('target_id'),
+    correlationId: text('correlation_id'),
+    metadataJson: text('metadata_json').notNull().default('{}'),
+    outcome: text('outcome').$type<AuditOutcome>().notNull().default('SUCCESS'),
+    occurredAt: text('occurred_at').notNull().default(currentTimestamp),
+  },
+  (table) => ({
+    schoolIdIdx: index('audit_log_school_id_idx').on(table.schoolId),
+    actorUserIdIdx: index('audit_log_actor_user_id_idx').on(table.actorUserId),
+    targetIdx: index('audit_log_target_idx').on(table.targetType, table.targetId),
+    outcomeCheck: check('audit_log_outcome_check', sql`${table.outcome} in ('SUCCESS', 'FAILURE')`),
+  })
+);
+
+export const schemaMetadata = sqliteTable('schema_metadata', {
+  key: text('key').primaryKey().notNull(),
+  value: text('value').notNull(),
+  description: text('description'),
+  createdAt: text('created_at').notNull().default(currentTimestamp),
+  updatedAt: text('updated_at').notNull().default(currentTimestamp),
+  recordVersion: integer('record_version').notNull().default(1),
 });
+
+function uuidPrimaryKey() {
+  return text('id').primaryKey().notNull();
+}
+
+function tenantColumns() {
+  return {
+    schoolId: text('school_id')
+      .notNull()
+      .references(() => school.id, {
+        onDelete: 'restrict',
+        onUpdate: 'cascade',
+      }),
+  };
+}
+
+function recordLifecycleColumns() {
+  return {
+    createdAt: text('created_at').notNull().default(currentTimestamp),
+    updatedAt: text('updated_at').notNull().default(currentTimestamp),
+    recordVersion: integer('record_version').notNull().default(1),
+    deletedAt: text('deleted_at'),
+  };
+}
diff --git a/packages/db/src/seeds.ts b/packages/db/src/seeds.ts
new file mode 100644
index 0000000..072b05f
--- /dev/null
+++ b/packages/db/src/seeds.ts
@@ -0,0 +1,120 @@
+import { eq } from 'drizzle-orm';
+import type { EduTrackDatabase } from './client';
+import { schemaMetadata, school, user, type UserRole } from './schema.sqlite';
+
+const seedPasswordHash = '$2b$12$C6UzMDM.H6dfI/f/IKcEeOq8GmUiZ6ztp7Z8VsYzHf5fQK1x6ZVdW';
+
+export const foundationSeedVersion = 'phase-1.3-foundation-2026-08-12';
+
+export const foundationSeed = {
+  schools: [
+    {
+      id: '00000000-0000-4000-8000-000000000101',
+      code: 'NDS-DEMO',
+      name: 'Ecole Demo N Djamena',
+      shortName: 'Demo NDJ',
+      city: 'N Djamena',
+      country: 'TD',
+      phone: '+23500000001',
+      locale: 'fr',
+      timezone: 'Africa/Ndjamena',
+      currency: 'XAF',
+    },
+    {
+      id: '00000000-0000-4000-8000-000000000102',
+      code: 'MND-DEMO',
+      name: 'Ecole Demo Moundou',
+      shortName: 'Demo MND',
+      city: 'Moundou',
+      country: 'TD',
+      phone: '+23500000002',
+      locale: 'fr',
+      timezone: 'Africa/Ndjamena',
+      currency: 'XAF',
+    },
+  ],
+  users: [
+    {
+      id: '00000000-0000-4000-8000-000000000201',
+      schoolId: '00000000-0000-4000-8000-000000000101',
+      username: 'directeur',
+      passwordHash: seedPasswordHash,
+      role: 'SCHOOL_MASTER' satisfies UserRole,
+    },
+    {
+      id: '00000000-0000-4000-8000-000000000202',
+      schoolId: '00000000-0000-4000-8000-000000000102',
+      username: 'directeur',
+      passwordHash: seedPasswordHash,
+      role: 'SCHOOL_MASTER' satisfies UserRole,
+    },
+  ],
+} as const;
+
+export function seedFoundation(db: EduTrackDatabase) {
+  db.transaction((transaction) => {
+    const currentSeedVersion = transaction
+      .select({ value: schemaMetadata.value })
+      .from(schemaMetadata)
+      .where(eq(schemaMetadata.key, 'seed.foundation.version'))
+      .get();
+
+    if (currentSeedVersion?.value === foundationSeedVersion) {
+      return;
+    }
+
+    for (const schoolSeed of foundationSeed.schools) {
+      transaction
+        .insert(school)
+        .values(schoolSeed)
+        .onConflictDoUpdate({
+          target: school.id,
+          set: {
+            code: schoolSeed.code,
+            name: schoolSeed.name,
+            shortName: schoolSeed.shortName,
+            city: schoolSeed.city,
+            country: schoolSeed.country,
+            phone: schoolSeed.phone,
+            locale: schoolSeed.locale,
+            timezone: schoolSeed.timezone,
+            currency: schoolSeed.currency,
+          },
+        })
+        .run();
+    }
+
+    for (const userSeed of foundationSeed.users) {
+      transaction
+        .insert(user)
+        .values(userSeed)
+        .onConflictDoUpdate({
+          target: user.id,
+          set: {
+            schoolId: userSeed.schoolId,
+            username: userSeed.username,
+            passwordHash: userSeed.passwordHash,
+            role: userSeed.role,
+            isActive: true,
+          },
+        })
+        .run();
+    }
+
+    transaction
+      .insert(schemaMetadata)
+      .values({
+        key: 'seed.foundation.version',
+        value: foundationSeedVersion,
+        description: 'Deterministic Phase 1.3 foundation seed version.',
+      })
+      .onConflictDoUpdate({
+        target: schemaMetadata.key,
+        set: {
+          value: foundationSeedVersion,
+          description: 'Deterministic Phase 1.3 foundation seed version.',
+        },
+      })
+      .run();
+  });
+}
diff --git a/packages/db/vitest.config.ts b/packages/db/vitest.config.ts
new file mode 100644
index 0000000..7eeb3f8
--- /dev/null
+++ b/packages/db/vitest.config.ts
@@ -0,0 +1,8 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    include: ['src/**/*.test.ts'],
+  },
+});
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 0ba534f..1447478 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -68,6 +68,9 @@ importers:
       '@edutrack/shared':
         specifier: workspace:*
         version: link:../../packages/shared
+      better-sqlite3:
+        specifier: 13.0.2
+        version: 13.0.2
       fastify:
         specifier: ^4.26.0
         version: 4.29.1
@@ -75,6 +78,12 @@ importers:
       '@types/node':
         specifier: ^24.10.1
         version: 24.13.3
+      '@yao-pkg/pkg':
+        specifier: 6.22.0
+        version: 6.22.0
+      esbuild:
+        specifier: 0.28.2
+        version: 0.28.2
       tsx:
         specifier: ^4.23.12
         version: 4.23.12
@@ -96,6 +105,9 @@ importers:
       '@edutrack/ui':
         specifier: workspace:*
         version: link:../../packages/ui
+      '@tauri-apps/api':
+        specifier: 2.9.0
+        version: 2.9.0
       i18next:
         specifier: ^25.7.4
         version: 25.10.10(typescript@5.9.3)
@@ -131,11 +143,11 @@ importers:
   packages/db:
     dependencies:
       better-sqlite3:
-        specifier: ^9.0.0
-        version: 9.6.0
+        specifier: ^13.0.2
+        version: 13.0.2
       drizzle-orm:
         specifier: ^0.30.0
-        version: 0.30.10(@types/better-sqlite3@7.6.13)(@types/react@19.2.18)(better-sqlite3@9.6.0)(postgres@3.4.9)(react@19.2.8)
+        version: 0.30.10(@types/better-sqlite3@7.6.13)(@types/react@19.2.18)(better-sqlite3@13.0.2)(postgres@3.4.9)(react@19.2.8)
     devDependencies:
       '@types/better-sqlite3':
         specifier: ^7.6.9
@@ -838,6 +850,10 @@ packages:
     resolution: {integrity: sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==}
     engines: {node: '>=18.18'}
 
+  '@isaacs/fs-minipass@4.0.1':
+    resolution: {integrity: sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==}
+    engines: {node: '>=18.0.0'}
+
   '@jridgewell/gen-mapping@0.3.13':
     resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
 
@@ -872,6 +888,10 @@ packages:
     engines: {node: '>=20'}
     hasBin: true
 
+  '@roberts_lando/vfs@0.3.3':
+    resolution: {integrity: sha512-YjkxVSLw5WMZQoARaryRAjcxA+GbBzWMJdwYZX5oLUt9cC/gew9as4Dn7tcLzPp7BPoR221VpTZ+78TRPawnjg==}
+    engines: {node: '>= 22'}
+
   '@rolldown/pluginutils@1.0.0-rc.3':
     resolution: {integrity: sha512-eybk3TjzzzV97Dlj5c+XrBFW57eTNhzod66y9HrBlzJ6NsCrWCp/2kaPS3K9wJmurBC0Tdw4yPjXKZqlznim3Q==}
 
@@ -1110,6 +1130,9 @@ packages:
     peerDependencies:
       vite: ^5.2.0 || ^6 || ^7 || ^8
 
+  '@tauri-apps/api@2.9.0':
+    resolution: {integrity: sha512-qD5tMjh7utwBk9/5PrTA/aGr3i5QaJ/Mlt7p8NilQ45WgbifUNPyKWsA63iQ8YfQq6R8ajMapU+/Q8nMcPRLNw==}
+
   '@tauri-apps/cli-darwin-arm64@2.11.4':
     resolution: {integrity: sha512-1ryOF3ZhpZ/nemHV5zVwBQBz9jDGKmKPvWPADOhc83ig0P4bMc2iER4NbC6r9sjeIZ6RVQ4g3RZIYvezhcl4TQ==}
     engines: {node: '>= 10'}
@@ -1350,6 +1373,15 @@ packages:
   '@vitest/utils@4.1.10':
     resolution: {integrity: sha512-fy9am/HWxbaGt/Sawrp90vt6Y6jQwf1RX77cz3uwoJwJVMli/e1IEwRPnMNJ7vKfPTwo0diXifkpPvwH9v7nGA==}
 
+  '@yao-pkg/pkg-fetch@3.6.5':
+    resolution: {integrity: sha512-Sd1Hff7imsF2rcZ2GLQuIzVm2fc3Za+nE4KSWPTwIYegN/r90UFg3bq0MLSugbWQaVht72zzxV0MiKE0wvT1zA==}
+    hasBin: true
+
+  '@yao-pkg/pkg@6.22.0':
+    resolution: {integrity: sha512-u+ZgwLsvEFB+Q1rA+IGymgxnm+anl1qGJWsTH6hDHyy2cCiOvMteDNK7NgqFYxN/zdithtORIlCsYSyhAXAgQA==}
+    engines: {node: '>=22.0.0'}
+    hasBin: true
+
   abstract-logging@2.0.1:
     resolution: {integrity: sha512-2BjRTZxTPvheOvGbBslFSYOUkr+SjPtOnrLP33f+VIWLzezQpZcqVg7ja3L4dBXmzzgwT+a029jRx5PCi3JuiA==}
 
@@ -1422,6 +1454,14 @@ packages:
   avvio@8.4.0:
     resolution: {integrity: sha512-CDSwaxINFy59iNwhYnkvALBwZiTydGkOecZyPkqBpABYR1KqGEsET0VOOYDwtleZSUIdeY36DC2bSZ24CO1igA==}
 
+  b4a@1.8.1:
+    resolution: {integrity: sha512-aiqre1Nr0B/6DgE2N5vwTc+2/oQZ4Wh1t4NznYY4E00y8LCt6NqdRv81so00oo27D8MVKTpUa/MwUUtBLXCoDw==}
+    peerDependencies:
+      react-native-b4a: '*'
+    peerDependenciesMeta:
+      react-native-b4a:
+        optional: true
+
   balanced-match@1.0.2:
     resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
 
@@ -1429,6 +1469,43 @@ packages:
     resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==}
     engines: {node: 18 || 20 || >=22}
 
+  bare-events@2.9.1:
+    resolution: {integrity: sha512-Z0oHEHAFDZkffN8Qc39zNZjQlMDkPJRyyyZieU1VH7u8c5S+qHZ2S8ixdKIAxEjfHO7FJxXmJWgteOghVanIsg==}
+    peerDependencies:
+      bare-abort-controller: '*'
+    peerDependenciesMeta:
+      bare-abort-controller:
+        optional: true
+
+  bare-fs@4.8.0:
+    resolution: {integrity: sha512-fM+MhCvdQhZ7NV6S95a07gPSqjIYKn6mFaXfx266wN3ajZGl/+1AzH+ubkXQ0fFZvOe2nk9VHkzdYkQE5zMV3Q==}
+    engines: {bare: '>=1.28.0'}
+    peerDependencies:
+      bare-buffer: '*'
+    peerDependenciesMeta:
+      bare-buffer:
+        optional: true
+
+  bare-path@3.1.1:
+    resolution: {integrity: sha512-JprUlveX3QjApC1cTpsUOiscADftCGVWkzitbHsRqv84hzYwYHw2mbluddsq5TvI8mH/8Ov1f4BiMAdcB0oYnQ==}
+
+  bare-stream@2.13.3:
+    resolution: {integrity: sha512-Kc+brLqvEqGkjyfiwJmImAOqLZL7OsoLKuavx+hJjgVV3nLTOjloJyPMFxjUPerGGHrNH0fLU06jjykMLWrERQ==}
+    peerDependencies:
+      bare-abort-controller: '*'
+      bare-buffer: '*'
+      bare-events: '*'
+    peerDependenciesMeta:
+      bare-abort-controller:
+        optional: true
+      bare-buffer:
+        optional: true
+      bare-events:
+        optional: true
+
+  bare-url@2.5.2:
+    resolution: {integrity: sha512-L13PCJzKG8RGvx8V1/DdMi12ERhC3tprr7/8a94BxpmnRsFqxh5XZNdhtMxu5HPkRshYOOWRGY8lDP7ZhpG9Cg==}
+
   base64-js@1.5.1:
     resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
 
@@ -1437,18 +1514,19 @@ packages:
     engines: {node: '>=6.0.0'}
     hasBin: true
 
-  better-sqlite3@9.6.0:
-    resolution: {integrity: sha512-yR5HATnqeYNVnkaUTf4bOP2dJSnyhP4puJN/QPRyx4YkBEEUxib422n2XzPqDEHjQQqazoYoADdAm5vE15+dAQ==}
+  better-sqlite3@13.0.2:
+    resolution: {integrity: sha512-jW6oufeDhXZaiX9Lw5A+oerVClx4iFrI6uDj1zu7SqUAjak9vbJvA0NEcKLNxHiQHb6kYCoFzzXYV0YOauhV3g==}
+    engines: {node: '>=22'}
 
   bidi-js@1.0.3:
     resolution: {integrity: sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw==}
 
-  bindings@1.5.0:
-    resolution: {integrity: sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==}
-
   bl@4.1.0:
     resolution: {integrity: sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==}
 
+  bluebird@3.7.2:
+    resolution: {integrity: sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==}
+
   brace-expansion@1.1.18:
     resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==}
 
@@ -1496,10 +1574,17 @@ packages:
   chownr@1.1.4:
     resolution: {integrity: sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==}
 
+  chownr@3.0.0:
+    resolution: {integrity: sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==}
+    engines: {node: '>=18'}
+
   cli-color@2.0.4:
     resolution: {integrity: sha512-zlnpg0jNcibNrO7GG9IeHH7maWFeCz+Ja1wx/7tZNU5ASSSSZ+/qZciM0/LHCYxSdqv5h2sdbQ/PXYdOuetXvA==}
     engines: {node: '>=0.10'}
 
+  cliui@7.0.4:
+    resolution: {integrity: sha512-OcRE68cOsVMXp1Yvonl/fzkQOyjLSu/8bhPDfQt0e0/Eb283TKP20Fs2MqoPsr9SwA595rRCA+QMzYc9nBP+JQ==}
+
   color-convert@2.0.1:
     resolution: {integrity: sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==}
     engines: {node: '>=7.0.0'}
@@ -1528,6 +1613,9 @@ packages:
     resolution: {integrity: sha512-7Vv6asjS4gMOuILabD3l739tsaxFQmC+a7pLZm02zyvs8p977bL3zEgq3yDk5rn9B0PbYgIv++jmHcuUab4RhA==}
     engines: {node: '>=18'}
 
+  core-util-is@1.0.3:
+    resolution: {integrity: sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==}
+
   cross-spawn@7.0.6:
     resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
     engines: {node: '>= 8'}
@@ -1686,9 +1774,15 @@ packages:
       sqlite3:
         optional: true
 
+  duplexer2@0.1.4:
+    resolution: {integrity: sha512-asLFVfWWtJ90ZyOUHMqk7/S2w2guQKxUI2itj3d92ADHhxUSbCMGi1f1cBcJ7xM1To+pE/Khbwo1yuNbMEPKeA==}
+
   electron-to-chromium@1.5.405:
     resolution: {integrity: sha512-bNglH7lPH5l+yHOes7Zr4VqxhOy4BQ9ZBUX4VdoFgxMpzJk7W1ZoO3Vgd9Pxa9PyjQ76sfm2aKH/nzEcCNRlew==}
 
+  emoji-regex@8.0.0:
+    resolution: {integrity: sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==}
+
   end-of-stream@1.4.5:
     resolution: {integrity: sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==}
 
@@ -1704,6 +1798,10 @@ packages:
     resolution: {integrity: sha512-dtJUTepzMW3Lm/NPxRf3wP4642UWhjL2sQxc+ym2YMj1m/H2zDNQOlezafzkHwn6sMstjHTwG6iQQsctDW/b1A==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
 
+  es-errors@1.3.0:
+    resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
+    engines: {node: '>= 0.4'}
+
   es-module-lexer@2.3.1:
     resolution: {integrity: sha512-shc1dbU90Yl/xq1QrC7QRtfcwURZuVRfPhZbDoldJ1cn1gzDvBaBWlv0eFolj5+0znnPJz5TXLxsN77X/12KTA==}
 
@@ -1816,6 +1914,9 @@ packages:
   event-emitter@0.3.5:
     resolution: {integrity: sha512-D9rRn9y7kLPnJ+hMq7S/nhvoKwwvVJahBi2BPmx3bvbsEdK3W9ii8cBSGjP+72/LnM4n6fo3+dkCX5FeTQruXA==}
 
+  events-universal@1.0.1:
+    resolution: {integrity: sha512-LUd5euvbMLpwOF8m6ivPCbhQeSiYVNb8Vs0fQ8QjXo0JTkEHpz8pxdQf0gStltaPpw0Cca8b39KxvK9cfKRiAw==}
+
   expand-template@2.0.3:
     resolution: {integrity: sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==}
     engines: {node: '>=6'}
@@ -1836,6 +1937,9 @@ packages:
   fast-deep-equal@3.1.3:
     resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
 
+  fast-fifo@1.3.2:
+    resolution: {integrity: sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==}
+
   fast-json-stable-stringify@2.1.0:
     resolution: {integrity: sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==}
 
@@ -1873,9 +1977,6 @@ packages:
     resolution: {integrity: sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==}
     engines: {node: '>=16.0.0'}
 
-  file-uri-to-path@1.0.0:
-    resolution: {integrity: sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==}
-
   find-my-way@8.2.2:
     resolution: {integrity: sha512-Dobi7gcTEq8yszimcfp/R7+owiT4WncAJ7VTTgFH1jYJ5GaG1FbhjwDG820hptN0QDFvzVY3RfCzdInvGPGzjA==}
     engines: {node: '>=14'}
@@ -1898,6 +1999,10 @@ packages:
   fs-constants@1.0.0:
     resolution: {integrity: sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==}
 
+  fs-extra@11.3.1:
+    resolution: {integrity: sha512-eXvGGwZ5CL17ZSwHWd3bbgk7UUpF6IFHtP57NYYakPvHOs8GDgDe5KJI36jIJzDkJ6eJjuzRA8eBQb6SkKue0g==}
+    engines: {node: '>=14.14'}
+
   fs.realpath@1.0.0:
     resolution: {integrity: sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==}
 
@@ -1911,10 +2016,17 @@ packages:
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
     os: [darwin]
 
+  function-bind@1.1.2:
+    resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
+
   gensync@1.0.0-beta.2:
     resolution: {integrity: sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
     engines: {node: '>=6.9.0'}
 
+  get-caller-file@2.0.5:
+    resolution: {integrity: sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==}
+    engines: {node: 6.* || 8.* || >= 10.*}
+
   get-tsconfig@4.14.1:
     resolution: {integrity: sha512-Dz/6HxkrxgNehhxLVeyv8sad9UzF2xBVeaKBQNDfJ5XiSXmp2gTR0eO0RWiT2NCKS5aGP9jjkOMggTN90qU50A==}
 
@@ -1948,6 +2060,10 @@ packages:
     resolution: {integrity: sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
     engines: {node: '>=8'}
 
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
+    engines: {node: '>= 0.4'}
+
   heap@0.2.7:
     resolution: {integrity: sha512-2bsegYkkHO+h/9MGbn6KWcE45cHZgPANo5LXF7EvWdT0yT2EguSVO1nDgU5c8+ZOPwp2vMNa7YFsJhVcDR9Sdg==}
 
@@ -2017,14 +2133,26 @@ packages:
   ini@1.3.8:
     resolution: {integrity: sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==}
 
+  into-stream@9.1.0:
+    resolution: {integrity: sha512-DRsRnQrbzdFjaQ1oe4C6/EIUymIOEix1qROEJTF9dbMq+M4Zrm6VaLp6SD/B9IsiEjPZuBSnWWFN+udajugdWA==}
+    engines: {node: '>=20'}
+
   ipaddr.js@1.9.1:
     resolution: {integrity: sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==}
     engines: {node: '>= 0.10'}
 
+  is-core-module@2.16.2:
+    resolution: {integrity: sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA==}
+    engines: {node: '>= 0.4'}
+
   is-extglob@2.1.1:
     resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
     engines: {node: '>=0.10.0'}
 
+  is-fullwidth-code-point@3.0.0:
+    resolution: {integrity: sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==}
+    engines: {node: '>=8'}
+
   is-glob@4.0.3:
     resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
     engines: {node: '>=0.10.0'}
@@ -2039,6 +2167,9 @@ packages:
     resolution: {integrity: sha512-oG7cgbmg5kLYae2N5IVd3jm2s+vldjxJzK1pcu9LfpGuQ93MQSzo0okvRna+7y5ifrD+20FE8FvjusyGaz14fw==}
     engines: {node: '>=18'}
 
+  isarray@1.0.0:
+    resolution: {integrity: sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==}
+
   isexe@2.0.0:
     resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}
 
@@ -2091,6 +2222,9 @@ packages:
     engines: {node: '>=6'}
     hasBin: true
 
+  jsonfile@6.2.1:
+    resolution: {integrity: sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==}
+
   keyv@4.5.4:
     resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
 
@@ -2309,12 +2443,23 @@ packages:
   minimist@1.2.8:
     resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
 
+  minipass@7.1.3:
+    resolution: {integrity: sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==}
+    engines: {node: '>=16 || 14 >=14.17'}
+
+  minizlib@3.1.0:
+    resolution: {integrity: sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==}
+    engines: {node: '>= 18'}
+
   mkdirp-classic@0.5.3:
     resolution: {integrity: sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==}
 
   ms@2.1.3:
     resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
 
+  multistream@4.1.0:
+    resolution: {integrity: sha512-J1XDiAmmNpRCBfIWJv+n0ymC4ABcf/Pl+5YvC5B/D2f/2+8PtHvCNxMPKiQcZyi922Hq69J2YOpb1pTywfifyw==}
+
   nanoid@3.3.18:
     resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
@@ -2333,6 +2478,13 @@ packages:
     resolution: {integrity: sha512-W5ZNO5KRPB5TkYmGVD9F6YqhsglXJzE6etpbmT+f6EQElhiX/UTG551cnsRGvLG3fyZEg9HwaDmNmj5nwJ4z9g==}
     engines: {node: '>=10'}
 
+  node-addon-api@8.9.2:
+    resolution: {integrity: sha512-VijLXbi3UACN69I0JVXJsX4tjACjNoQDgv2gTF6sx2wWEi8tkSg2eX8p5gSIFi8z2+DL3oHmY6OyKce38SDolg==}
+    engines: {node: ^18 || ^20 || >= 21}
+
+  node-int64@0.4.0:
+    resolution: {integrity: sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==}
+
   node-releases@2.0.53:
     resolution: {integrity: sha512-D9UOmYG3UH1V+ENW56t5QXBwJw1YEY18ruVeus89Rw+SyIgjPkCO84bRzO3uNIYosJbNwiabWVn48o3uJLjxFQ==}
     engines: {node: '>=18'}
@@ -2375,6 +2527,9 @@ packages:
     resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
     engines: {node: '>=8'}
 
+  path-parse@1.0.7:
+    resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==}
+
   pathe@2.0.3:
     resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
 
@@ -2413,6 +2568,11 @@ packages:
     resolution: {integrity: sha512-GD3qdB0x1z9xgFI6cdRD6xu2Sp2WCOEoe3mtnyB5Ee0XrrL5Pe+e4CCnJrRMnL1zYtRDZmQQVbvOttLnKDLnaw==}
     engines: {node: '>=12'}
 
+  postject@1.0.0-alpha.6:
+    resolution: {integrity: sha512-b9Eb8h2eVqNE8edvKdwqkrY6O7kAwmI8kcnBv1NScolYJbo59XUF0noFq+lxbC1yN20bmC0WBEbDC5H/7ASb0A==}
+    engines: {node: '>=14.0.0'}
+    hasBin: true
+
   prebuild-install@7.1.3:
     resolution: {integrity: sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==}
     engines: {node: '>=10'}
@@ -2432,12 +2592,19 @@ packages:
     resolution: {integrity: sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==}
     engines: {node: ^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0}
 
+  process-nextick-args@2.0.1:
+    resolution: {integrity: sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==}
+
   process-warning@3.0.0:
     resolution: {integrity: sha512-mqn0kFRl0EoqhnL0GQ0veqFHyIN1yig9RHh/InzORTUiZHFRAur+aMtRkELNwGs9aNwKS6tg/An4NYBPGwvtzQ==}
 
   process-warning@5.1.0:
     resolution: {integrity: sha512-jQSaVHsPgtyw60e1rQ/A+/ArPEj/S8pS/vFnyGa/gYFXrKk/6RuDkoqVDQ5NI5MmS01698ltlAk0NoDBNLujRw==}
 
+  progress@2.0.3:
+    resolution: {integrity: sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA==}
+    engines: {node: '>=0.4.0'}
+
   proxy-addr@2.0.7:
     resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==}
     engines: {node: '>= 0.10'}
@@ -2488,6 +2655,9 @@ packages:
     resolution: {integrity: sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw==}
     engines: {node: '>=0.10.0'}
 
+  readable-stream@2.3.8:
+    resolution: {integrity: sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==}
+
   readable-stream@3.6.2:
     resolution: {integrity: sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==}
     engines: {node: '>= 6'}
@@ -2500,6 +2670,10 @@ packages:
     resolution: {integrity: sha512-6tDA8g98We0zd0GvVeMT9arEOnTw9qM03L9cJXaCjrip1OO764RDBLBfrB4cwzNGDj5OA5ioymC9GkizgWJDUg==}
     engines: {node: '>=8'}
 
+  require-directory@2.1.1:
+    resolution: {integrity: sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==}
+    engines: {node: '>=0.10.0'}
+
   require-from-string@2.0.2:
     resolution: {integrity: sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==}
     engines: {node: '>=0.10.0'}
@@ -2511,6 +2685,15 @@ packages:
   resolve-pkg-maps@1.0.0:
     resolution: {integrity: sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==}
 
+  resolve.exports@2.0.3:
+    resolution: {integrity: sha512-OcXjMsGdhL4XnbShKpAcSqPMzQoYkYyhbEaeSko47MjRP9NfEQMhZkXL1DoFlt9LWQn4YttrdnV6X2OiyzBi+A==}
+    engines: {node: '>=10'}
+
+  resolve@1.22.12:
+    resolution: {integrity: sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==}
+    engines: {node: '>= 0.4'}
+    hasBin: true
+
   ret@0.4.3:
     resolution: {integrity: sha512-0f4Memo5QP7WQyUEAYUO3esD/XjOc3Zjjg5CPsAq1p8sIu0XPeMbHJemKA0BO7tV0X7+A0FoEpbmHXWxPyD3wQ==}
     engines: {node: '>=10'}
@@ -2527,6 +2710,9 @@ packages:
     engines: {node: '>=18.0.0', npm: '>=8.0.0'}
     hasBin: true
 
+  safe-buffer@5.1.2:
+    resolution: {integrity: sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==}
+
   safe-buffer@5.2.1:
     resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
 
@@ -2603,9 +2789,26 @@ packages:
   std-env@4.2.0:
     resolution: {integrity: sha512-oCUKSupKTHX53EyjDtuZQ64pjLJ6yYCtpmEw0goYxtjG9KpbRe8KAsl2tBUGU9DyMcJ0RwJ8GqJAFzMXcXW1Rw==}
 
+  stream-meter@1.0.4:
+    resolution: {integrity: sha512-4sOEtrbgFotXwnEuzzsQBYEV1elAeFSO8rSGeTwabuX1RRn/kEq9JVH7I0MRBhKVRR0sJkr0M0QCH7yOLf9fhQ==}
+
+  streamx@2.28.0:
+    resolution: {integrity: sha512-1Yowhzjf0ivGMrTIkY9hav5TxobO9qIVqUE41fiCGMGgc3CLlf4MY+9AHmZqBWgDTue0fY9zWjYFVyf6Diuobw==}
+
+  string-width@4.2.3:
+    resolution: {integrity: sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==}
+    engines: {node: '>=8'}
+
+  string_decoder@1.1.1:
+    resolution: {integrity: sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==}
+
   string_decoder@1.3.0:
     resolution: {integrity: sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==}
 
+  strip-ansi@6.0.1:
+    resolution: {integrity: sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==}
+    engines: {node: '>=8'}
+
   strip-indent@3.0.0:
     resolution: {integrity: sha512-laJTa3Jb+VQpaC6DseHhF7dXVqHTfJPCRDaEbid/drOhgitgYku/letMUqOXFoWV0zIIUbjpdH2t+tYj4bQMRQ==}
     engines: {node: '>=8'}
@@ -2626,6 +2829,10 @@ packages:
     resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
     engines: {node: '>=8'}
 
+  supports-preserve-symlinks-flag@1.0.0:
+    resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==}
+    engines: {node: '>= 0.4'}
+
   symbol-tree@3.2.4:
     resolution: {integrity: sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==}
 
@@ -2639,15 +2846,31 @@ packages:
   tar-fs@2.1.5:
     resolution: {integrity: sha512-OboTd8mmMhZDNPV+UjQcK9yKAatXu2aJ+r1w4im1Otd4M4fl2hwvdoXUxIYHFTHWK/3y3FarBP70v3vwmGlOxw==}
 
+  tar-fs@3.1.3:
+    resolution: {integrity: sha512-/hU4AXnIdZu+Gvl1pk0oI5f5HxWsCJRtY2aFaJdk9VvyL48DWU6iU5WAIPG+wIi1YvWA6eTJvIviP/tMAZZNwQ==}
+
   tar-stream@2.2.0:
     resolution: {integrity: sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==}
     engines: {node: '>=6'}
 
+  tar-stream@3.2.0:
+    resolution: {integrity: sha512-ojzvCvVaNp6aOTFmG7jaRD0meowIAuPc3cMMhSgKiVWws1GyHbGd/xvnyuRKcKlMpt3qvxx6r0hreCNITP9hIg==}
+
+  tar@7.5.22:
+    resolution: {integrity: sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==}
+    engines: {node: '>=18'}
+
+  teex@1.0.1:
+    resolution: {integrity: sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg==}
+
   terser@5.50.0:
     resolution: {integrity: sha512-CN9BVxWhgS/hRxtUMjtC2uRWSTcSfQFHMDWma6sKKfIivCD91sM+FOPfvwoaRMqCSrUpe1nv3jDamd9eEQ4y+w==}
     engines: {node: '>=10'}
     hasBin: true
 
+  text-decoder@1.2.7:
+    resolution: {integrity: sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ==}
+
   thread-stream@3.2.0:
     resolution: {integrity: sha512-zLBvqpwr4Esa0kRjcrzGU6zL25lePWaCLMx0RQFrmteozIfeNdaMLpG5U7PeHzvlFkAWaRKA9/KVW4F60iB+qw==}
 
@@ -2725,6 +2948,17 @@ packages:
   undici-types@7.18.2:
     resolution: {integrity: sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==}
 
+  undici@7.29.0:
+    resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==}
+    engines: {node: '>=20.18.1'}
+
+  universalify@2.0.1:
+    resolution: {integrity: sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==}
+    engines: {node: '>= 10.0.0'}
+
+  unzipper@0.12.5:
+    resolution: {integrity: sha512-tXYOi9R57Uj/2Z25SOs5RRSzq886MBQj2gY8dPL+xl/kv6s6SvByoKfAtvfVeEuhntWDgjd2o9p2lb4TVPAz0A==}
+
   update-browserslist-db@1.3.1:
     resolution: {integrity: sha512-ZZ61DsRsOnakl74HAmp3oSN4aXUmEWXf+i/yv0h7tIBfICc3VdrFErQKUUKPgu3AMsTUMbcongALEN4l6GSUrQ==}
     hasBin: true
@@ -2864,6 +3098,10 @@ packages:
   wordwrap@1.0.0:
     resolution: {integrity: sha512-gvVzJFlPycKc5dZN4yPkP8w7Dc37BtP1yczEneOb4uq34pXZcvrtRTmWV8W+Ume+XCxKgbjM+nevkyFPMybd4Q==}
 
+  wrap-ansi@7.0.0:
+    resolution: {integrity: sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==}
+    engines: {node: '>=10'}
+
   wrappy@1.0.2:
     resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
 
@@ -2886,14 +3124,30 @@ packages:
   xmlchars@2.2.0:
     resolution: {integrity: sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==}
 
+  y18n@5.0.8:
+    resolution: {integrity: sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==}
+    engines: {node: '>=10'}
+
   yallist@3.1.1:
     resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}
 
+  yallist@5.0.0:
+    resolution: {integrity: sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==}
+    engines: {node: '>=18'}
+
   yaml@2.9.0:
     resolution: {integrity: sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==}
     engines: {node: '>= 14.6'}
     hasBin: true
 
+  yargs-parser@20.2.9:
+    resolution: {integrity: sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==}
+    engines: {node: '>=10'}
+
+  yargs@16.2.2:
+    resolution: {integrity: sha512-Nt9ZJjXTv5R8MHbqby/wXQ6Gi0Bb3TcYZkR1bzuL4yB2OxWPkXknz513gEF0GoA6tn00UpbPvERW8rzCuWCA6w==}
+    engines: {node: '>=10'}
+
   yocto-queue@0.1.0:
     resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
     engines: {node: '>=10'}
@@ -3384,6 +3638,10 @@ snapshots:
 
   '@humanwhocodes/retry@0.4.3': {}
 
+  '@isaacs/fs-minipass@4.0.1':
+    dependencies:
+      minipass: 7.1.3
+
   '@jridgewell/gen-mapping@0.3.13':
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.5
@@ -3418,6 +3676,8 @@ snapshots:
     dependencies:
       playwright: 1.62.1
 
+  '@roberts_lando/vfs@0.3.3': {}
+
   '@rolldown/pluginutils@1.0.0-rc.3': {}
 
   '@rollup/rollup-android-arm-eabi@4.62.4':
@@ -3565,6 +3825,8 @@ snapshots:
       tailwindcss: 4.3.3
       vite: 7.3.6(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.50.0)(tsx@4.23.12)(yaml@2.9.0)
 
+  '@tauri-apps/api@2.9.0': {}
+
   '@tauri-apps/cli-darwin-arm64@2.11.4':
     optional: true
 
@@ -3840,6 +4102,46 @@ snapshots:
       convert-source-map: 2.0.0
       tinyrainbow: 3.1.1
 
+  '@yao-pkg/pkg-fetch@3.6.5':
+    dependencies:
+      picocolors: 1.1.1
+      progress: 2.0.3
+      semver: 7.8.5
+      tar-fs: 3.1.3
+      undici: 7.29.0
+      yargs: 16.2.2
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - bare-buffer
+      - react-native-b4a
+
+  '@yao-pkg/pkg@6.22.0':
+    dependencies:
+      '@babel/generator': 7.29.8
+      '@babel/parser': 7.29.8
+      '@babel/traverse': 7.29.8
+      '@babel/types': 7.29.8
+      '@roberts_lando/vfs': 0.3.3
+      '@yao-pkg/pkg-fetch': 3.6.5
+      esbuild: 0.28.2
+      into-stream: 9.1.0
+      multistream: 4.1.0
+      picocolors: 1.1.1
+      picomatch: 4.0.5
+      postject: 1.0.0-alpha.6
+      prebuild-install: 7.1.3
+      resolve: 1.22.12
+      resolve.exports: 2.0.3
+      stream-meter: 1.0.4
+      tar: 7.5.22
+      tinyglobby: 0.2.17
+      unzipper: 0.12.5
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - bare-buffer
+      - react-native-b4a
+      - supports-color
+
   abstract-logging@2.0.1: {}
 
   acorn-jsx@5.3.2(acorn@8.18.0):
@@ -3897,33 +4199,61 @@ snapshots:
       '@fastify/error': 3.4.1
       fastq: 1.20.1
 
+  b4a@1.8.1: {}
+
   balanced-match@1.0.2: {}
 
   balanced-match@4.0.4: {}
 
+  bare-events@2.9.1: {}
+
+  bare-fs@4.8.0:
+    dependencies:
+      bare-events: 2.9.1
+      bare-path: 3.1.1
+      bare-stream: 2.13.3(bare-events@2.9.1)
+      bare-url: 2.5.2
+      fast-fifo: 1.3.2
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - react-native-b4a
+
+  bare-path@3.1.1: {}
+
+  bare-stream@2.13.3(bare-events@2.9.1):
+    dependencies:
+      b4a: 1.8.1
+      streamx: 2.28.0
+      teex: 1.0.1
+    optionalDependencies:
+      bare-events: 2.9.1
+    transitivePeerDependencies:
+      - react-native-b4a
+
+  bare-url@2.5.2:
+    dependencies:
+      bare-path: 3.1.1
+
   base64-js@1.5.1: {}
 
   baseline-browser-mapping@2.11.13: {}
 
-  better-sqlite3@9.6.0:
+  better-sqlite3@13.0.2:
     dependencies:
-      bindings: 1.5.0
-      prebuild-install: 7.1.3
+      node-addon-api: 8.9.2
 
   bidi-js@1.0.3:
     dependencies:
       require-from-string: 2.0.2
 
-  bindings@1.5.0:
-    dependencies:
-      file-uri-to-path: 1.0.0
-
   bl@4.1.0:
     dependencies:
       buffer: 5.7.1
       inherits: 2.0.4
       readable-stream: 3.6.2
 
+  bluebird@3.7.2: {}
+
   brace-expansion@1.1.18:
     dependencies:
       balanced-match: 1.0.2
@@ -3969,6 +4299,8 @@ snapshots:
 
   chownr@1.1.4: {}
 
+  chownr@3.0.0: {}
+
   cli-color@2.0.4:
     dependencies:
       d: 1.0.2
@@ -3977,6 +4309,12 @@ snapshots:
       memoizee: 0.4.17
       timers-ext: 0.1.8
 
+  cliui@7.0.4:
+    dependencies:
+      string-width: 4.2.3
+      strip-ansi: 6.0.1
+      wrap-ansi: 7.0.0
+
   color-convert@2.0.1:
     dependencies:
       color-name: 1.1.4
@@ -3998,6 +4336,8 @@ snapshots:
     dependencies:
       is-what: 5.5.0
 
+  core-util-is@1.0.3: {}
+
   cross-spawn@7.0.6:
     dependencies:
       path-key: 3.1.1
@@ -4084,16 +4424,22 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  drizzle-orm@0.30.10(@types/better-sqlite3@7.6.13)(@types/react@19.2.18)(better-sqlite3@9.6.0)(postgres@3.4.9)(react@19.2.8):
+  drizzle-orm@0.30.10(@types/better-sqlite3@7.6.13)(@types/react@19.2.18)(better-sqlite3@13.0.2)(postgres@3.4.9)(react@19.2.8):
     optionalDependencies:
       '@types/better-sqlite3': 7.6.13
       '@types/react': 19.2.18
-      better-sqlite3: 9.6.0
+      better-sqlite3: 13.0.2
       postgres: 3.4.9
       react: 19.2.8
 
+  duplexer2@0.1.4:
+    dependencies:
+      readable-stream: 2.3.8
+
   electron-to-chromium@1.5.405: {}
 
+  emoji-regex@8.0.0: {}
+
   end-of-stream@1.4.5:
     dependencies:
       once: 1.4.0
@@ -4107,6 +4453,8 @@ snapshots:
 
   env-paths@3.0.0: {}
 
+  es-errors@1.3.0: {}
+
   es-module-lexer@2.3.1: {}
 
   es5-ext@0.10.64:
@@ -4326,6 +4674,12 @@ snapshots:
       d: 1.0.2
       es5-ext: 0.10.64
 
+  events-universal@1.0.1:
+    dependencies:
+      bare-events: 2.9.1
+    transitivePeerDependencies:
+      - bare-abort-controller
+
   expand-template@2.0.3: {}
 
   expect-type@1.4.0: {}
@@ -4340,6 +4694,8 @@ snapshots:
 
   fast-deep-equal@3.1.3: {}
 
+  fast-fifo@1.3.2: {}
+
   fast-json-stable-stringify@2.1.0: {}
 
   fast-json-stringify@5.16.1:
@@ -4393,8 +4749,6 @@ snapshots:
     dependencies:
       flat-cache: 4.0.1
 
-  file-uri-to-path@1.0.0: {}
-
   find-my-way@8.2.2:
     dependencies:
       fast-deep-equal: 3.1.3
@@ -4417,6 +4771,12 @@ snapshots:
 
   fs-constants@1.0.0: {}
 
+  fs-extra@11.3.1:
+    dependencies:
+      graceful-fs: 4.2.11
+      jsonfile: 6.2.1
+      universalify: 2.0.1
+
   fs.realpath@1.0.0: {}
 
   fsevents@2.3.2:
@@ -4425,8 +4785,12 @@ snapshots:
   fsevents@2.3.3:
     optional: true
 
+  function-bind@1.1.2: {}
+
   gensync@1.0.0-beta.2: {}
 
+  get-caller-file@2.0.5: {}
+
   get-tsconfig@4.14.1:
     dependencies:
       resolve-pkg-maps: 1.0.0
@@ -4458,6 +4822,10 @@ snapshots:
 
   has-flag@4.0.0: {}
 
+  hasown@2.0.4:
+    dependencies:
+      function-bind: 1.1.2
+
   heap@0.2.7: {}
 
   hermes-estree@0.25.1: {}
@@ -4522,10 +4890,18 @@ snapshots:
 
   ini@1.3.8: {}
 
+  into-stream@9.1.0: {}
+
   ipaddr.js@1.9.1: {}
 
+  is-core-module@2.16.2:
+    dependencies:
+      hasown: 2.0.4
+
   is-extglob@2.1.1: {}
 
+  is-fullwidth-code-point@3.0.0: {}
+
   is-glob@4.0.3:
     dependencies:
       is-extglob: 2.1.1
@@ -4536,6 +4912,8 @@ snapshots:
 
   is-what@5.5.0: {}
 
+  isarray@1.0.0: {}
+
   isexe@2.0.0: {}
 
   jiti@2.7.0: {}
@@ -4596,6 +4974,12 @@ snapshots:
 
   json5@2.2.3: {}
 
+  jsonfile@6.2.1:
+    dependencies:
+      universalify: 2.0.1
+    optionalDependencies:
+      graceful-fs: 4.2.11
+
   keyv@4.5.4:
     dependencies:
       json-buffer: 3.0.1
@@ -4769,10 +5153,21 @@ snapshots:
 
   minimist@1.2.8: {}
 
+  minipass@7.1.3: {}
+
+  minizlib@3.1.0:
+    dependencies:
+      minipass: 7.1.3
+
   mkdirp-classic@0.5.3: {}
 
   ms@2.1.3: {}
 
+  multistream@4.1.0:
+    dependencies:
+      once: 1.4.0
+      readable-stream: 3.6.2
+
   nanoid@3.3.18: {}
 
   napi-build-utils@2.0.0: {}
@@ -4785,6 +5180,10 @@ snapshots:
     dependencies:
       semver: 7.8.5
 
+  node-addon-api@8.9.2: {}
+
+  node-int64@0.4.0: {}
+
   node-releases@2.0.53: {}
 
   obug@2.1.4: {}
@@ -4824,6 +5223,8 @@ snapshots:
 
   path-key@3.1.1: {}
 
+  path-parse@1.0.7: {}
+
   pathe@2.0.3: {}
 
   picocolors@1.1.1: {}
@@ -4867,6 +5268,10 @@ snapshots:
   postgres@3.4.9:
     optional: true
 
+  postject@1.0.0-alpha.6:
+    dependencies:
+      commander: 9.5.0
+
   prebuild-install@7.1.3:
     dependencies:
       detect-libc: 2.1.2
@@ -4892,10 +5297,14 @@ snapshots:
       ansi-styles: 5.2.0
       react-is: 17.0.2
 
+  process-nextick-args@2.0.1: {}
+
   process-warning@3.0.0: {}
 
   process-warning@5.1.0: {}
 
+  progress@2.0.3: {}
+
   proxy-addr@2.0.7:
     dependencies:
       forwarded: 0.2.0
@@ -4939,6 +5348,16 @@ snapshots:
 
   react@19.2.8: {}
 
+  readable-stream@2.3.8:
+    dependencies:
+      core-util-is: 1.0.3
+      inherits: 2.0.4
+      isarray: 1.0.0
+      process-nextick-args: 2.0.1
+      safe-buffer: 5.1.2
+      string_decoder: 1.1.1
+      util-deprecate: 1.0.2
+
   readable-stream@3.6.2:
     dependencies:
       inherits: 2.0.4
@@ -4952,12 +5371,23 @@ snapshots:
       indent-string: 4.0.0
       strip-indent: 3.0.0
 
+  require-directory@2.1.1: {}
+
   require-from-string@2.0.2: {}
 
   resolve-from@4.0.0: {}
 
   resolve-pkg-maps@1.0.0: {}
 
+  resolve.exports@2.0.3: {}
+
+  resolve@1.22.12:
+    dependencies:
+      es-errors: 1.3.0
+      is-core-module: 2.16.2
+      path-parse: 1.0.7
+      supports-preserve-symlinks-flag: 1.0.0
+
   ret@0.4.3: {}
 
   reusify@1.1.0: {}
@@ -4996,6 +5426,8 @@ snapshots:
       '@rollup/rollup-win32-x64-msvc': 4.62.4
       fsevents: 2.3.3
 
+  safe-buffer@5.1.2: {}
+
   safe-buffer@5.2.1: {}
 
   safe-regex2@3.1.0:
@@ -5055,10 +5487,37 @@ snapshots:
 
   std-env@4.2.0: {}
 
+  stream-meter@1.0.4:
+    dependencies:
+      readable-stream: 2.3.8
+
+  streamx@2.28.0:
+    dependencies:
+      events-universal: 1.0.1
+      fast-fifo: 1.3.2
+      text-decoder: 1.2.7
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - react-native-b4a
+
+  string-width@4.2.3:
+    dependencies:
+      emoji-regex: 8.0.0
+      is-fullwidth-code-point: 3.0.0
+      strip-ansi: 6.0.1
+
+  string_decoder@1.1.1:
+    dependencies:
+      safe-buffer: 5.1.2
+
   string_decoder@1.3.0:
     dependencies:
       safe-buffer: 5.2.1
 
+  strip-ansi@6.0.1:
+    dependencies:
+      ansi-regex: 5.0.1
+
   strip-indent@3.0.0:
     dependencies:
       min-indent: 1.0.1
@@ -5075,6 +5534,8 @@ snapshots:
     dependencies:
       has-flag: 4.0.0
 
+  supports-preserve-symlinks-flag@1.0.0: {}
+
   symbol-tree@3.2.4: {}
 
   tailwindcss@4.3.3: {}
@@ -5088,6 +5549,18 @@ snapshots:
       pump: 3.0.4
       tar-stream: 2.2.0
 
+  tar-fs@3.1.3:
+    dependencies:
+      pump: 3.0.4
+      tar-stream: 3.2.0
+    optionalDependencies:
+      bare-fs: 4.8.0
+      bare-path: 3.1.1
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - bare-buffer
+      - react-native-b4a
+
   tar-stream@2.2.0:
     dependencies:
       bl: 4.1.0
@@ -5096,6 +5569,32 @@ snapshots:
       inherits: 2.0.4
       readable-stream: 3.6.2
 
+  tar-stream@3.2.0:
+    dependencies:
+      b4a: 1.8.1
+      bare-fs: 4.8.0
+      fast-fifo: 1.3.2
+      streamx: 2.28.0
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - bare-buffer
+      - react-native-b4a
+
+  tar@7.5.22:
+    dependencies:
+      '@isaacs/fs-minipass': 4.0.1
+      chownr: 3.0.0
+      minipass: 7.1.3
+      minizlib: 3.1.0
+      yallist: 5.0.0
+
+  teex@1.0.1:
+    dependencies:
+      streamx: 2.28.0
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - react-native-b4a
+
   terser@5.50.0:
     dependencies:
       '@jridgewell/source-map': 0.3.11
@@ -5104,6 +5603,12 @@ snapshots:
       source-map-support: 0.5.21
     optional: true
 
+  text-decoder@1.2.7:
+    dependencies:
+      b4a: 1.8.1
+    transitivePeerDependencies:
+      - react-native-b4a
+
   thread-stream@3.2.0:
     dependencies:
       real-require: 0.2.0
@@ -5175,6 +5680,18 @@ snapshots:
 
   undici-types@7.18.2: {}
 
+  undici@7.29.0: {}
+
+  universalify@2.0.1: {}
+
+  unzipper@0.12.5:
+    dependencies:
+      bluebird: 3.7.2
+      duplexer2: 0.1.4
+      fs-extra: 11.3.1
+      graceful-fs: 4.2.11
+      node-int64: 0.4.0
+
   update-browserslist-db@1.3.1(browserslist@4.28.8):
     dependencies:
       browserslist: 4.28.8
@@ -5266,6 +5783,12 @@ snapshots:
 
   wordwrap@1.0.0: {}
 
+  wrap-ansi@7.0.0:
+    dependencies:
+      ansi-styles: 4.3.0
+      string-width: 4.2.3
+      strip-ansi: 6.0.1
+
   wrappy@1.0.2: {}
 
   ws@8.21.3: {}
@@ -5274,11 +5797,27 @@ snapshots:
 
   xmlchars@2.2.0: {}
 
+  y18n@5.0.8: {}
+
   yallist@3.1.1: {}
 
+  yallist@5.0.0: {}
+
   yaml@2.9.0:
     optional: true
 
+  yargs-parser@20.2.9: {}
+
+  yargs@16.2.2:
+    dependencies:
+      cliui: 7.0.4
+      escalade: 3.2.0
+      get-caller-file: 2.0.5
+      require-directory: 2.1.1
+      string-width: 4.2.3
+      y18n: 5.0.8
+      yargs-parser: 20.2.9
+
   yocto-queue@0.1.0: {}
 
   zod-validation-error@4.0.2(zod@4.4.3):
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index e9b0dad..08bcad5 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,3 +1,6 @@
 packages:
   - 'apps/*'
   - 'packages/*'
+
+onlyBuiltDependencies:
+  - better-sqlite3
diff --git a/scripts/db-fresh.sh b/scripts/db-fresh.sh
new file mode 100644
index 0000000..c4ad82f
--- /dev/null
+++ b/scripts/db-fresh.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+DB_DIR=".data"
+DB_FILE="$DB_DIR/edutrack.sqlite"
+DELETE_DB_FILE="$DB_FILE"
+
+mkdir -p "$DB_DIR"
+
+if [[ -z "${EDUTRACK_SQLITE_PATH:-}" ]]; then
+  export EDUTRACK_SQLITE_PATH
+  EDUTRACK_SQLITE_PATH="$(windows_path "$ROOT_DIR/$DB_FILE")"
+elif command -v cygpath >/dev/null 2>&1; then
+  DELETE_DB_FILE="$(cygpath -u "$EDUTRACK_SQLITE_PATH")"
+else
+  DELETE_DB_FILE="$EDUTRACK_SQLITE_PATH"
+fi
+
+print_header "EduTrack Africa fresh dev database"
+print_info "This deletes only the local development SQLite files."
+print_info "Target: $EDUTRACK_SQLITE_PATH"
+printf 'Type RESET to continue: '
+read -r confirmation
+
+if [[ "$confirmation" != "RESET" ]]; then
+  print_info "Cancelled."
+  exit 0
+fi
+
+rm -f "$DELETE_DB_FILE" "$DELETE_DB_FILE-shm" "$DELETE_DB_FILE-wal"
+
+run_pnpm_step "Run SQLite migrations" run db:migrate
+run_pnpm_step "Seed foundation data" run db:seed
+
+print_header "Fresh database ready"
+print_success "Open this file in DBeaver:"
+printf '%s\n' "$EDUTRACK_SQLITE_PATH"
diff --git a/scripts/db-setup.sh b/scripts/db-setup.sh
new file mode 100644
index 0000000..6c1dce8
--- /dev/null
+++ b/scripts/db-setup.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+DB_DIR=".data"
+DB_FILE="$DB_DIR/edutrack.sqlite"
+
+mkdir -p "$DB_DIR"
+
+if [[ -z "${EDUTRACK_SQLITE_PATH:-}" ]]; then
+  export EDUTRACK_SQLITE_PATH
+  EDUTRACK_SQLITE_PATH="$(windows_path "$ROOT_DIR/$DB_FILE")"
+fi
+
+print_header "EduTrack Africa database setup"
+print_info "This is a Git Bash convenience wrapper."
+print_info "Source of truth: pnpm run db:migrate && pnpm run db:seed"
+print_info "SQLite path: $EDUTRACK_SQLITE_PATH"
+sleep_between_steps
+
+run_pnpm_step "Run SQLite migrations" run db:migrate
+run_pnpm_step "Seed foundation data" run db:seed
+
+print_header "Database ready"
+print_success "Open this file in DBeaver:"
+printf '%s\n' "$EDUTRACK_SQLITE_PATH"
diff --git a/scripts/dev-verify.sh b/scripts/dev-verify.sh
new file mode 100644
index 0000000..6297722
--- /dev/null
+++ b/scripts/dev-verify.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+print_header "EduTrack Africa developer verification"
+print_info "This is a Git Bash convenience wrapper around existing pnpm scripts."
+print_info "Source of truth: package.json scripts."
+sleep_between_steps
+
+run_pnpm_step "Check formatting" run format:check
+run_pnpm_step "Run lint" run lint
+run_pnpm_step "Run typecheck" run typecheck
+run_pnpm_step "Run unit tests" run test
+run_pnpm_step "Run production build" run build
+
+print_header "Developer verification complete"
+print_success "All checks passed."
diff --git a/scripts/lib.sh b/scripts/lib.sh
new file mode 100644
index 0000000..e11d8e0
--- /dev/null
+++ b/scripts/lib.sh
@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+STEP_PAUSE_SECONDS="${STEP_PAUSE_SECONDS:-0.2}"
+PNPM_COMMAND=()
+
+print_header() {
+  local title="$1"
+  printf '\n'
+  printf '============================================================\n'
+  printf '%s\n' "$title"
+  printf '============================================================\n'
+}
+
+print_info() {
+  printf '[info] %s\n' "$1"
+}
+
+print_success() {
+  printf '[ok] %s\n' "$1"
+}
+
+print_failure() {
+  printf '[fail] %s\n' "$1" >&2
+}
+
+sleep_between_steps() {
+  sleep "$STEP_PAUSE_SECONDS"
+}
+
+run_step() {
+  local title="$1"
+  shift
+  local log_file
+
+  print_header "$title"
+  print_info "Running: $*"
+  sleep_between_steps
+
+  local started_at
+  started_at="$(date +%s)"
+  log_file="$(mktemp -t edutrack-step.XXXXXX)"
+
+  set +e
+  "$@" 2>&1 | tee "$log_file"
+  local status="${PIPESTATUS[0]}"
+  set -e
+
+  if [[ "$status" -ne 0 ]]; then
+    print_failure "$title failed with exit code $status"
+    rm -f "$log_file"
+    return "$status"
+  fi
+
+  rm -f "$log_file"
+
+  if [[ "$status" -eq 0 ]]; then
+    local finished_at
+    finished_at="$(date +%s)"
+    print_success "$title completed in $((finished_at - started_at))s"
+  fi
+}
+
+run_pnpm_step() {
+  local title="$1"
+  shift
+
+  if [[ "${#PNPM_COMMAND[@]}" -eq 0 ]]; then
+    print_failure "Neither pnpm nor corepack is available on PATH."
+    print_info "Install Node.js 24 and enable pnpm through corepack, then retry."
+    return 127
+  fi
+
+  run_step "$title" "${PNPM_COMMAND[@]}" "$@"
+}
+
+windows_path() {
+  local path="$1"
+
+  if command -v cygpath >/dev/null 2>&1; then
+    cygpath -w -a "$path"
+    return
+  fi
+
+  printf '%s\n' "$path"
+}
+
+cd "$ROOT_DIR"
+
+if command -v pnpm >/dev/null 2>&1; then
+  PNPM_COMMAND=(pnpm)
+elif command -v corepack >/dev/null 2>&1; then
+  PNPM_COMMAND=(corepack pnpm@10.33.2)
+fi
diff --git a/scripts/phase-1-check.sh b/scripts/phase-1-check.sh
new file mode 100644
index 0000000..deee263
--- /dev/null
+++ b/scripts/phase-1-check.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+DB_DIR=".data"
+DB_FILE="$DB_DIR/edutrack.sqlite"
+
+mkdir -p "$DB_DIR"
+
+if [[ -z "${EDUTRACK_SQLITE_PATH:-}" ]]; then
+  export EDUTRACK_SQLITE_PATH
+  EDUTRACK_SQLITE_PATH="$(windows_path "$ROOT_DIR/$DB_FILE")"
+fi
+
+print_header "EduTrack Africa Phase 1 check"
+print_info "This groups the current Phase 1 verification commands for convenience."
+print_info "SQLite path: $EDUTRACK_SQLITE_PATH"
+sleep_between_steps
+
+run_pnpm_step "Run SQLite migrations" run db:migrate
+run_pnpm_step "Seed foundation data" run db:seed
+run_pnpm_step "Run typecheck" run typecheck
+run_pnpm_step "Run lint" run lint
+run_pnpm_step "Run unit tests" run test
+run_pnpm_step "Run production build" run build
+run_pnpm_step "Verify packaged sidecar" run verify:sidecar
+run_pnpm_step "Check desktop package" run check:desktop
+
+print_header "Phase 1 check complete"
+print_success "All Phase 1 convenience checks passed."
diff --git a/tsconfig.eslint.json b/tsconfig.eslint.json
index 85a6ce3..ef66d9d 100644
--- a/tsconfig.eslint.json
+++ b/tsconfig.eslint.json
@@ -14,6 +14,7 @@
     "eslint.config.mjs",
     "apps/**/*.ts",
     "apps/**/*.tsx",
+    "apps/**/*.cjs",
     "apps/**/*.mjs",
     "packages/**/*.ts",
     "packages/**/*.tsx",