diff --git a/Cargo.lock b/Cargo.lock
index 9d44e32e1..5eee0eed5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -26,7 +26,7 @@ checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
  "cfg-if",
  "cipher",
- "cpufeatures",
+ "cpufeatures 0.2.17",
 ]
 
 [[package]]
@@ -57,9 +57,9 @@ dependencies = [
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.3"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
 dependencies = [
  "memchr",
 ]
@@ -79,21 +79,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "anstream"
-version = "0.6.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ae563653d1938f79b1ab1b5e668c87c76a9930414574a6583a7b7e11a8e6192"
-dependencies = [
- "anstyle",
- "anstyle-parse 0.2.7",
- "anstyle-query",
- "anstyle-wincon",
- "colorchoice",
- "is_terminal_polyfill",
- "utf8parse",
-]
-
 [[package]]
 name = "anstream"
 version = "1.0.0"
@@ -101,7 +86,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
 dependencies = [
  "anstyle",
- "anstyle-parse 1.0.0",
+ "anstyle-parse",
  "anstyle-query",
  "anstyle-wincon",
  "colorchoice",
@@ -115,15 +100,6 @@ version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
 
-[[package]]
-name = "anstyle-parse"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
-dependencies = [
- "utf8parse",
-]
-
 [[package]]
 name = "anstyle-parse"
 version = "1.0.0"
@@ -135,29 +111,29 @@ dependencies = [
 
 [[package]]
 name = "anstyle-query"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e231f6134f61b71076a3eab506c379d4f36122f2af15a9ff04415ea4c3339e2"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.10"
+version = "3.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e0633414522a32ffaac8ac6cc8f748e090c5717661fddeea04219e2344f5f2a"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.99"
+version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0674a1ddeecb70197781e945de4b3b8ffb61fa939a5597bcf48503737663100"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
 [[package]]
 name = "arbitrary"
@@ -301,7 +277,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "246a225cc6131e9ee4f24619af0f19d67761fff15d7ccc22e42b80846e69449a"
 dependencies = [
  "num-traits",
- "rand 0.8.5",
+ "rand 0.8.6",
 ]
 
 [[package]]
@@ -337,13 +313,12 @@ dependencies = [
 
 [[package]]
 name = "assert_cmd"
-version = "2.0.17"
+version = "2.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bd389a4b2970a01282ee455294913c0a43724daedcd1a24c3eb0ec1c1320b66"
+checksum = "2aa3a22042e45de04255c7bf3626e239f450200fd0493c1e382263544b20aea6"
 dependencies = [
  "anstyle",
  "bstr",
- "doc-comment",
  "libc",
  "predicates",
  "predicates-core",
@@ -353,12 +328,11 @@ dependencies = [
 
 [[package]]
 name = "assert_fs"
-version = "1.1.3"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a652f6cb1f516886fcfee5e7a5c078b9ade62cfcb889524efe5a64d682dd27a9"
+checksum = "6ecf5c70ca07b7f80220bce936f0556a960ca6fb00fc2bd4125b5e581b218137"
 dependencies = [
  "anstyle",
- "doc-comment",
  "globwalk",
  "predicates",
  "predicates-core",
@@ -376,7 +350,7 @@ dependencies = [
  "futures-core",
  "libc",
  "portable-atomic",
- "rustc-hash 2.1.1",
+ "rustc-hash 2.1.2",
  "tokio",
  "tokio-stream",
  "xattr",
@@ -429,22 +403,21 @@ dependencies = [
 
 [[package]]
 name = "async-compression"
-version = "0.4.30"
+version = "0.4.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "977eb15ea9efd848bb8a4a1a2500347ed7f0bf794edf0dc3ddcf439f43d36b23"
+checksum = "e79b3f8a79cccc2898f31920fc69f304859b3bd567490f75ebf51ae1c792a9ac"
 dependencies = [
  "compression-codecs",
  "compression-core",
- "futures-core",
  "pin-project-lite",
  "tokio",
 ]
 
 [[package]]
 name = "async-executor"
-version = "1.13.3"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "497c00e0fd83a72a79a39fcbd8e3e2f055d6f6c7e025f3b3d91f4f8e76527fb8"
+checksum = "c96bf972d85afc50bf5ab8fe2d54d1586b4e0b46c97c50a0c9e71e2f7bcd812a"
 dependencies = [
  "async-task",
  "concurrent-queue",
@@ -471,27 +444,27 @@ dependencies = [
 
 [[package]]
 name = "async-io"
-version = "2.5.0"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19634d6336019ef220f09fd31168ce5c184b295cbf80345437cc36094ef223ca"
+checksum = "456b8a8feb6f42d237746d4b3e9a178494627745c3c56c6ea55d92ba50d026fc"
 dependencies = [
- "async-lock",
+ "autocfg",
  "cfg-if",
  "concurrent-queue",
  "futures-io",
  "futures-lite",
  "parking",
  "polling",
- "rustix 1.0.8",
+ "rustix 1.1.4",
  "slab",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "async-lock"
-version = "3.4.1"
+version = "3.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fd03604047cee9b6ce9de9f70c6cd540a0520c813cbd49bae61f33ab80ed1dc"
+checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
 dependencies = [
  "event-listener 5.4.1",
  "event-listener-strategy",
@@ -509,9 +482,9 @@ dependencies = [
 
 [[package]]
 name = "async-process"
-version = "2.4.0"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65daa13722ad51e6ab1a1b9c01299142bc75135b337923cfa10e79bbbd669f00"
+checksum = "fc50921ec0055cdd8a16de48773bfeec5c972598674347252c0399676be7da75"
 dependencies = [
  "async-channel 2.5.0",
  "async-io",
@@ -522,7 +495,7 @@ dependencies = [
  "cfg-if",
  "event-listener 5.4.1",
  "futures-lite",
- "rustix 1.0.8",
+ "rustix 1.1.4",
 ]
 
 [[package]]
@@ -538,9 +511,9 @@ dependencies = [
 
 [[package]]
 name = "async-signal"
-version = "0.2.12"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f567af260ef69e1d52c2b560ce0ea230763e6fbb9214a85d768760a920e3e3c1"
+checksum = "52b5aaafa020cf5053a01f2a60e8ff5dccf550f0f77ec54a4e47285ac2bab485"
 dependencies = [
  "async-io",
  "async-lock",
@@ -548,10 +521,10 @@ dependencies = [
  "cfg-if",
  "futures-core",
  "futures-io",
- "rustix 1.0.8",
+ "rustix 1.1.4",
  "signal-hook-registry",
  "slab",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -629,15 +602,15 @@ checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
 name = "autocfg"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "axum"
-version = "0.8.7"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b098575ebe77cb6d14fc7f32749631a6e44edbef6b796f89b020e99ba20d425"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
 dependencies = [
  "axum-core",
  "bytes",
@@ -660,9 +633,9 @@ dependencies = [
 
 [[package]]
 name = "axum-core"
-version = "0.5.5"
+version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59446ce19cd142f8833f856eb31f3eb097812d1479ab224f54d72428ca21ea22"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
 dependencies = [
  "bytes",
  "futures-core",
@@ -696,9 +669,9 @@ checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
 name = "base64ct"
-version = "1.8.0"
+version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55248b47b0caf0546f7988906588779981c43bb1bc9d0c44087278f80cdb44ba"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
 name = "basic-cookies"
@@ -755,15 +728,15 @@ checksum = "349f9b6a179ed607305526ca489b34ad0a41aed5f7980fa90eb03160b69598fb"
 
 [[package]]
 name = "bitflags"
-version = "2.11.0"
+version = "2.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
+checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
 
 [[package]]
 name = "bitvec"
-version = "1.0.1"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bc2832c24239b0141d5674bb9174f9d68a8b5b3f2753311927c172ca46f7e9c"
+checksum = "ddcec3d12c579d40898fe0a9a358a803c23e9c52ca3c425707f81c9436211837"
 dependencies = [
  "funty",
  "radium",
@@ -838,7 +811,7 @@ dependencies = [
  "home",
  "http 1.4.2",
  "http-body-util",
- "hyper 1.7.0",
+ "hyper 1.10.1",
  "hyper-named-pipe",
  "hyper-rustls",
  "hyper-util",
@@ -846,7 +819,7 @@ dependencies = [
  "log",
  "num",
  "pin-project-lite",
- "rand 0.9.2",
+ "rand 0.9.4",
  "rustls",
  "rustls-native-certs",
  "rustls-pki-types",
@@ -906,9 +879,9 @@ dependencies = [
 
 [[package]]
 name = "bstr"
-version = "1.12.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "234113d19d0d7d613b40e86fb654acf958910802bcceab913a4f9e7cda03b1a4"
+checksum = "63044e1ae8e69f3b5a92c736ca6269b8d12fa7efe39bf34ddb06d102cf0e2cab"
 dependencies = [
  "memchr",
  "regex-automata",
@@ -917,9 +890,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.19.0"
+version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
 [[package]]
 name = "byteorder"
@@ -935,9 +908,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.11.1"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+checksum = "8ae3f5d315924270530207e2a68396c3cc547f6dca3fbdca317cfb1a51edb593"
 
 [[package]]
 name = "bytes-lit"
@@ -959,11 +932,11 @@ checksum = "2e93abca9e28e0a1b9877922aacb20576e05d4679ffa78c3d6dc22a26a216659"
 
 [[package]]
 name = "camino"
-version = "1.1.12"
+version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd0b03af37dad7a14518b7691d81acb0f8222604ad3d1b02f6b4bed5188c0cd5"
+checksum = "b4ce8d3bd5823c7504d3f579f13e7b2f3da252fcb938c594d5680ee508bf846f"
 dependencies = [
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -1000,14 +973,14 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.36"
+version = "1.2.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5252b3d2648e5eedbc1a6f501e3c795e07025c1e93bbf8bbdd6eef7f447a6d54"
+checksum = "dad887fd958be91b5098c0248def011f4523ab786cd411be668777e55063501f"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
  "libc",
- "shlex",
+ "shlex 2.0.1",
 ]
 
 [[package]]
@@ -1018,9 +991,9 @@ checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
 
 [[package]]
 name = "cfg-if"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fd1289c04a9ea8cb22300a459a72a385d7c73d3259e2ed7dcb2af674838cfa9"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "cfg_aliases"
@@ -1039,18 +1012,29 @@ dependencies = [
  "syn 2.0.118",
 ]
 
+[[package]]
+name = "chacha20"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "chrono"
-version = "0.4.42"
+version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "145052bdd345b87320e369255277e3fb5152762ad123a901ef5c262dd38fe8d2"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
 dependencies = [
  "iana-time-zone",
  "js-sys",
  "num-traits",
  "serde",
  "wasm-bindgen",
- "windows-link 0.2.0",
+ "windows-link",
 ]
 
 [[package]]
@@ -1087,7 +1071,7 @@ version = "4.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
 dependencies = [
- "anstream 1.0.0",
+ "anstream",
  "anstyle",
  "clap_lex",
  "strsim",
@@ -1095,9 +1079,9 @@ dependencies = [
 
 [[package]]
 name = "clap_complete"
-version = "4.5.57"
+version = "4.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d9501bd3f5f09f7bbee01da9a511073ed30a80cd7a509f1214bb74eadea71ad"
+checksum = "e0a7a9bfdb35811f9e59832f0f05975114d2251b415fb534108e6f34060fd772"
 dependencies = [
  "clap",
 ]
@@ -1122,9 +1106,9 @@ checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 
 [[package]]
 name = "codespan-reporting"
-version = "0.12.0"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe6d2e5af09e8c8ad56c969f2157a3d4238cebc7c55f0a517728c38f7b200f81"
+checksum = "af491d569909a7e4dee0ad7db7f5341fef5c614d5b8ec8cf765732aba3cff681"
 dependencies = [
  "serde",
  "termcolor",
@@ -1158,7 +1142,7 @@ dependencies = [
  "hmac",
  "once_cell",
  "pbkdf2",
- "rand 0.8.5",
+ "rand 0.8.6",
  "sha2 0.10.9",
  "thiserror 1.0.69",
 ]
@@ -1184,17 +1168,17 @@ dependencies = [
 
 [[package]]
 name = "colorchoice"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
 [[package]]
 name = "colored"
-version = "3.0.0"
+version = "3.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fde0e0ec90c9dfb3b4b1a0891a7dcd0e2bffde2f7efed5fe7c9bb00e5bfb915e"
+checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1209,9 +1193,9 @@ dependencies = [
 
 [[package]]
 name = "compression-codecs"
-version = "0.4.30"
+version = "0.4.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "485abf41ac0c8047c07c87c72c8fb3eb5197f6e9d7ded615dfd1a00ae00a0f64"
+checksum = "ce2548391e9c1929c21bf6aa2680af86fe4c1b33e6cea9ac1cfeec0bd11218cf"
 dependencies = [
  "compression-core",
  "flate2",
@@ -1220,9 +1204,9 @@ dependencies = [
 
 [[package]]
 name = "compression-core"
-version = "0.4.29"
+version = "0.4.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e47641d3deaf41fb1538ac1f54735925e275eaf3bf4d55c81b137fba797e5cbb"
+checksum = "cc14f565cf027a105f7a44ccf9e5b424348421a1d8952a8fc9d499d313107789"
 
 [[package]]
 name = "concurrent-queue"
@@ -1235,12 +1219,12 @@ dependencies = [
 
 [[package]]
 name = "const-hex"
-version = "1.18.1"
+version = "1.19.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "531185e432bb31db1ecda541e9e7ab21468d4d844ad7505e0546a49b4945d49b"
+checksum = "33e2a781ebdf4467d1428dc4593067825fb646f6871475098d8577421af73558"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "proptest",
  "serde_core",
 ]
@@ -1286,6 +1270,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "crate-git-revision"
 version = "0.0.6"
@@ -1377,9 +1370,9 @@ dependencies = [
 
 [[package]]
 name = "crypto-common"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array",
  "rand_core 0.6.4",
@@ -1388,21 +1381,21 @@ dependencies = [
 
 [[package]]
 name = "csv"
-version = "1.3.1"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acdc4883a9c96732e4733212c01447ebd805833b7275a73ca3ee080fd77afdaf"
+checksum = "52cd9d68cf7efc6ddfaaee42e7288d3a99d613d4b50f76ce9827ae0c6e14f938"
 dependencies = [
  "csv-core",
  "itoa",
  "ryu",
- "serde",
+ "serde_core",
 ]
 
 [[package]]
 name = "csv-core"
-version = "0.1.12"
+version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d02f3b0da4c6504f86e9cd789d8dbafab48c2321be74e9987593de5a894d93d"
+checksum = "704a3c26996a80471189265814dbc2c257598b96b8a7feae2d31ace646bb9782"
 dependencies = [
  "memchr",
 ]
@@ -1439,7 +1432,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "curve25519-dalek-derive",
  "digest 0.10.7",
  "fiat-crypto",
@@ -1461,11 +1454,12 @@ dependencies = [
 
 [[package]]
 name = "cxx"
-version = "1.0.179"
+version = "1.0.194"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85b04ade63e106c145cdcd3482932299c2dcd36b15f1d5c596c06edf365966fe"
+checksum = "747d8437319e3a2f43d93b341c137927ca70c0f5dabeea7a005a73665e247c7e"
 dependencies = [
  "cc",
+ "cxx-build",
  "cxxbridge-cmd",
  "cxxbridge-flags",
  "cxxbridge-macro",
@@ -1475,13 +1469,13 @@ dependencies = [
 
 [[package]]
 name = "cxx-build"
-version = "1.0.179"
+version = "1.0.194"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba16a03d510b0e52be1952831ae1656e3ac9f6ac0c293a7b261670a0c7ff3b54"
+checksum = "b0f4697d190a142477b16aef7da8a99bfdc41e7e8b1687583c0d23a79c7afc1e"
 dependencies = [
  "cc",
  "codespan-reporting",
- "indexmap 2.11.0",
+ "indexmap 2.14.0",
  "proc-macro2",
  "quote",
  "scratch",
@@ -1490,13 +1484,13 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-cmd"
-version = "1.0.179"
+version = "1.0.194"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c3aefd0d58a2df90cd67fe2eccdf7fb6e6905e9886ae5feb2258ce0dec23063"
+checksum = "d0956799fa8678d4c50eed028f2de1c0552ae183c76e976cf7ca8c4e36a7c328"
 dependencies = [
  "clap",
  "codespan-reporting",
- "indexmap 2.11.0",
+ "indexmap 2.14.0",
  "proc-macro2",
  "quote",
  "syn 2.0.118",
@@ -1504,20 +1498,19 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.179"
+version = "1.0.194"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b735d976ca632f9e94b9de9b0ab8283de65e2641e7ae9d5abc3e6b467ea6673"
+checksum = "23384a836ab4f0ad98ace7e3955ad2de39de42378ab487dc28d3990392cb283a"
 
 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.179"
+version = "1.0.194"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42fffb686dc0b7bab364ee41fcf5a04c295c7e7a5f07cd38155c1c3bda437666"
+checksum = "e6acc6b5822b9526adfb4fc377b67128fdd60aac757cc4a741a6278603f763cf"
 dependencies = [
- "indexmap 2.11.0",
+ "indexmap 2.14.0",
  "proc-macro2",
  "quote",
- "rustversion",
  "syn 2.0.118",
 ]
 
@@ -1592,19 +1585,19 @@ dependencies = [
 
 [[package]]
 name = "data-encoding"
-version = "2.9.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
+checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
 
 [[package]]
 name = "dbus"
-version = "0.9.9"
+version = "0.9.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "190b6255e8ab55a7b568df5a883e9497edc3e4821c06396612048b430e5ad1e9"
+checksum = "b942602992bb7acfd1f51c49811c58a610ef9181b6e66f3e519d79b540a3bf73"
 dependencies = [
  "libc",
  "libdbus-sys",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1637,12 +1630,11 @@ dependencies = [
 
 [[package]]
 name = "deranged"
-version = "0.5.3"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d630bccd429a5bb5a64b5e94f693bfc48c9f8566418fda4c494cc94f911f87cc"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 dependencies = [
- "powerfmt",
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -1744,9 +1736,9 @@ dependencies = [
 
 [[package]]
 name = "displaydoc"
-version = "0.2.5"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1755,9 +1747,9 @@ dependencies = [
 
 [[package]]
 name = "doc-comment"
-version = "0.3.3"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
+checksum = "780955b8b195a21ab8e4ac6b60dd1dbdcec1dc6c51c0617964b08c81785e12c9"
 
 [[package]]
 name = "doc-gen"
@@ -1769,11 +1761,11 @@ dependencies = [
 
 [[package]]
 name = "docker_credential"
-version = "1.3.2"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d89dfcba45b4afad7450a99b39e751590463e45c04728cf555d36bb66940de8"
+checksum = "29547a1dc60885a552306986316bc9701ba120c1a8db6769fa68691529ad373d"
 dependencies = [
- "base64 0.21.7",
+ "base64 0.22.1",
  "serde",
  "serde_json",
 ]
@@ -1864,9 +1856,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.15.0"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
 
 [[package]]
 name = "elliptic-curve"
@@ -1904,7 +1896,7 @@ dependencies = [
  "embedded-io-async",
  "futures-sink",
  "futures-util",
- "heapless",
+ "heapless 0.8.0",
 ]
 
 [[package]]
@@ -1924,9 +1916,9 @@ dependencies = [
 
 [[package]]
 name = "ena"
-version = "0.14.3"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d248bdd43ce613d87415282f69b9bb99d947d290b10962dd6c56233312c2ad5"
+checksum = "eabffdaee24bd1bf95c5ef7cec31260444317e72ea56c4c91750e8b7ee58d5f1"
 dependencies = [
  "log",
 ]
@@ -1942,9 +1934,9 @@ dependencies = [
 
 [[package]]
 name = "endi"
-version = "1.1.0"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3d8a32ae18130a3c84dd492d4215c3d913c3b07c6b63c2eb3eb7ff1101ab7bf"
+checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
 
 [[package]]
 name = "enum-ordinalize"
@@ -1989,9 +1981,9 @@ dependencies = [
 
 [[package]]
 name = "env_filter"
-version = "0.1.3"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "186e05a59d4c50738528153b83b0b0194d3a29507dfec16eccd4b342903397d0"
+checksum = "32e90c2accc4b07a8456ea0debdc2e7587bdd890680d71173a15d4ae604f6eef"
 dependencies = [
  "log",
  "regex",
@@ -1999,11 +1991,11 @@ dependencies = [
 
 [[package]]
 name = "env_logger"
-version = "0.11.8"
+version = "0.11.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13c863f0904021b108aa8b2f55046443e6b1ebde8fd4a15c399893aae4fa069f"
+checksum = "0621c04f2196ac3f488dd583365b9c09be011a4ab8b9f37248ffcc8f6198b56a"
 dependencies = [
- "anstream 0.6.20",
+ "anstream",
  "anstyle",
  "env_filter",
  "jiff",
@@ -2018,12 +2010,12 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "errno"
-version = "0.3.13"
+version = "0.3.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "778e2ac28f6c47af28e4907f13ffd1e1ddbd400980a9abd7c8df189bf578a5ad"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2039,7 +2031,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "de48cc4d1c1d97a20fd819def54b890cadde72ed3ad0c614822a0a433361be96"
 dependencies = [
  "cfg-if",
- "windows-sys 0.61.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2077,18 +2069,18 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.3.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 
 [[package]]
 name = "ferroid"
-version = "0.8.7"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0e9414a6ae93ef993ce40a1e02944f13d4508e2bf6f1ced1580ce6910f08253"
+checksum = "ee93edf3c501f0035bbeffeccfed0b79e14c311f12195ec0e661e114a0f60da4"
 dependencies = [
  "portable-atomic",
- "rand 0.9.2",
+ "rand 0.10.1",
  "web-time",
 ]
 
@@ -2110,21 +2102,19 @@ checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
 [[package]]
 name = "filetime"
-version = "0.2.26"
+version = "0.2.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc0505cd1b6fa6580283f6bdf70a73fcf4aba1184038c90902b92b3dd0df63ed"
+checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759"
 dependencies = [
  "cfg-if",
  "libc",
- "libredox",
- "windows-sys 0.60.2",
 ]
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.1"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fd99930f64d146689264c637b5af2f0233a933bef0d8570e2526bf9e083192d"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
 [[package]]
 name = "fixedbitset"
@@ -2134,9 +2124,9 @@ checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
 
 [[package]]
 name = "flate2"
-version = "1.1.2"
+version = "1.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a3d7db9596fecd151c5f638c0ee5d5bd487b6e0ea232e5dc96d5250f6f94b1d"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -2213,9 +2203,9 @@ checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
 
 [[package]]
 name = "futures"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
+checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -2228,9 +2218,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -2238,15 +2228,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -2255,9 +2245,9 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
 
 [[package]]
 name = "futures-lite"
@@ -2274,9 +2264,9 @@ dependencies = [
 
 [[package]]
 name = "futures-macro"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2285,21 +2275,21 @@ dependencies = [
 
 [[package]]
 name = "futures-sink"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
 
 [[package]]
 name = "futures-task"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
 
 [[package]]
 name = "futures-util"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -2309,7 +2299,6 @@ dependencies = [
  "futures-task",
  "memchr",
  "pin-project-lite",
- "pin-utils",
  "slab",
 ]
 
@@ -2326,42 +2315,41 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasi",
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "getrandom"
-version = "0.3.3"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
  "r-efi 5.3.0",
- "wasi 0.14.4+wasi-0.2.4",
+ "wasip2",
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "getrandom"
-version = "0.4.2"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
  "libc",
  "r-efi 6.0.0",
- "wasip2",
- "wasip3",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -2382,9 +2370,9 @@ checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
 [[package]]
 name = "globset"
-version = "0.4.16"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54a1028dfc5f5df5da8a56a73e6c153c9a9708ec57232470703592a3f18e49f5"
+checksum = "52dfc19153a48bde0cbd630453615c8151bce3a5adfac7a0aebfbf0a1e1f57e3"
 dependencies = [
  "aho-corasick",
  "bstr",
@@ -2429,9 +2417,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.12"
+version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c0b69cfcb4e1b9f1bf2f53f95f766e4661169728ec61cd3fe5a0166f2d1386"
+checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -2439,7 +2427,7 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "http 1.4.2",
- "indexmap 2.11.0",
+ "indexmap 2.14.0",
  "slab",
  "tokio",
  "tokio-util",
@@ -2473,6 +2461,12 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
 [[package]]
 name = "heapless"
 version = "0.8.0"
@@ -2483,6 +2477,17 @@ dependencies = [
  "stable_deref_trait",
 ]
 
+[[package]]
+name = "heapless"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25ba4bd83f9415b58b4ed8dc5714c76e626a105be4646c02630ad730ad3b5aa4"
+dependencies = [
+ "hash32",
+ "stable_deref_trait",
+ "zeroize",
+]
+
 [[package]]
 name = "heck"
 version = "0.3.3"
@@ -2557,11 +2562,11 @@ dependencies = [
 
 [[package]]
 name = "home"
-version = "0.5.11"
+version = "0.5.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2661,9 +2666,9 @@ dependencies = [
 
 [[package]]
 name = "humantime"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b112acc8b3adf4b107a8ec20977da0273a8c386765a3ec0229bd500a1443f9f"
+checksum = "135b12329e5e3ce057a9f972339ea52bc954fe1e9358ef27f95e89716fbc5424"
 
 [[package]]
 name = "hyper"
@@ -2690,9 +2695,9 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.7.0"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb3aa54a13a0dfe7fbe3a59e0c76093041720fdc77b110cc0fc260fafb4dc51e"
+checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -2705,7 +2710,6 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
- "pin-utils",
  "smallvec",
  "tokio",
  "want",
@@ -2718,7 +2722,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73b7d8abf35697b81a825e386fc151e0d503e8cb5fcb93cc8669c376dfd6f278"
 dependencies = [
  "hex",
- "hyper 1.7.0",
+ "hyper 1.10.1",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -2728,16 +2732,15 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.7"
+version = "0.27.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
  "http 1.4.2",
- "hyper 1.7.0",
+ "hyper 1.10.1",
  "hyper-util",
  "log",
  "rustls",
- "rustls-pki-types",
  "tokio",
  "tokio-rustls",
  "tower-service",
@@ -2750,7 +2753,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
 dependencies = [
- "hyper 1.7.0",
+ "hyper 1.10.1",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -2765,7 +2768,7 @@ checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
  "bytes",
  "http-body-util",
- "hyper 1.7.0",
+ "hyper 1.10.1",
  "hyper-util",
  "native-tls",
  "tokio",
@@ -2775,23 +2778,22 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.16"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d9b05277c7e8da2c93a568989bb6207bef0112e8d17df7a6eda4a3cf143bc5e"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
  "base64 0.22.1",
  "bytes",
  "futures-channel",
- "futures-core",
  "futures-util",
  "http 1.4.2",
  "http-body 1.0.1",
- "hyper 1.7.0",
+ "hyper 1.10.1",
  "ipnet",
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.5.10",
+ "socket2 0.6.4",
  "system-configuration",
  "tokio",
  "tower-service",
@@ -2807,7 +2809,7 @@ checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7"
 dependencies = [
  "hex",
  "http-body-util",
- "hyper 1.7.0",
+ "hyper 1.10.1",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -2816,9 +2818,9 @@ dependencies = [
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.63"
+version = "0.1.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0c919e5debc312ad217002b8048a17b7d83f80703865bbfcfebb0458b0b27d8"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
@@ -2840,12 +2842,13 @@ dependencies = [
 
 [[package]]
 name = "icu_collections"
-version = "2.0.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "200072f5d0e3614556f94a9930d5dc3e0662a652823904c3a75dc3b0af7fee47"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
 dependencies = [
  "displaydoc",
  "potential_utf",
+ "utf8_iter",
  "yoke",
  "zerofrom",
  "zerovec",
@@ -2853,9 +2856,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.0.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cde2700ccaed3872079a65fb1a78f6c0a36c91570f28755dda67bc8f7d9f00a"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -2866,11 +2869,10 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer"
-version = "2.0.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "436880e8e18df4d7bbc06d58432329d6458cc84531f7ac5f024e93deadb37979"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
 dependencies = [
- "displaydoc",
  "icu_collections",
  "icu_normalizer_data",
  "icu_properties",
@@ -2881,42 +2883,38 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.0.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00210d6893afc98edb752b664b8890f0ef174c8adbb8d0be9710fa66fbbf72d3"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
 
 [[package]]
 name = "icu_properties"
-version = "2.0.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "016c619c1eeb94efb86809b015c58f479963de65bdb6253345c1a1276f22e32b"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
 dependencies = [
- "displaydoc",
  "icu_collections",
  "icu_locale_core",
  "icu_properties_data",
  "icu_provider",
- "potential_utf",
  "zerotrie",
  "zerovec",
 ]
 
 [[package]]
 name = "icu_properties_data"
-version = "2.0.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "298459143998310acd25ffe6810ed544932242d3f07083eee1084d83a71bd632"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
 
 [[package]]
 name = "icu_provider"
-version = "2.0.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03c80da27b5f4187909049ee2d72f276f0d9f99a42c306bd0131ecfe04d8e5af"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
- "stable_deref_trait",
- "tinystr",
  "writeable",
  "yoke",
  "zerofrom",
@@ -2924,12 +2922,6 @@ dependencies = [
  "zerovec",
 ]
 
-[[package]]
-name = "id-arena"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
-
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -2949,9 +2941,9 @@ dependencies = [
 
 [[package]]
 name = "idna_adapter"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
 dependencies = [
  "icu_normalizer",
  "icu_properties",
@@ -2959,9 +2951,9 @@ dependencies = [
 
 [[package]]
 name = "ignore"
-version = "0.4.23"
+version = "0.4.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d89fd380afde86567dfba715db065673989d6253f42b88179abd3eae47bda4b"
+checksum = "b915661dd01db3f05050265b2477bcc6527b3792388e2749b41623cc592be67d"
 dependencies = [
  "crossbeam-deque",
  "globset",
@@ -3006,13 +2998,14 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.11.0"
+version = "2.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2481980430f9f78649238835720ddccc57e52df14ffce1c6f37391d61b563e9"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown 0.15.5",
+ "hashbrown 0.17.1",
  "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -3033,19 +3026,9 @@ dependencies = [
 
 [[package]]
 name = "ipnet"
-version = "2.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
-
-[[package]]
-name = "iri-string"
-version = "0.7.8"
+version = "2.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbc5ebe9c3a1a7a5127f920a418f7585e9e758e911d0466ed004f393b0e380b2"
-dependencies = [
- "memchr",
- "serde",
-]
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
 
 [[package]]
 name = "is-docker"
@@ -3068,9 +3051,9 @@ dependencies = [
 
 [[package]]
 name = "is_terminal_polyfill"
-version = "1.70.1"
+version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
 
 [[package]]
 name = "itertools"
@@ -3110,28 +3093,28 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.15"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "jiff"
-version = "0.2.15"
+version = "0.2.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be1f93b8b1eb69c77f24bbb0afdf66f54b632ee39af40ca21c4365a1d7347e49"
+checksum = "4603d3033e49e2b0e31229fcab20a5d40089c607d975cd9c80551dc69eed9102"
 dependencies = [
  "jiff-static",
  "log",
  "portable-atomic",
  "portable-atomic-util",
- "serde",
+ "serde_core",
 ]
 
 [[package]]
 name = "jiff-static"
-version = "0.2.15"
+version = "0.2.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03343451ff899767262ec32146f6d559dd759fdadf42ff0e227c7c48f72594b4"
+checksum = "782d32378dddf207193ac91cefb848ad41abb58195c95168e1291227a0832b47"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3188,17 +3171,18 @@ version = "0.1.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
 dependencies = [
- "getrandom 0.3.3",
+ "getrandom 0.3.4",
  "libc",
 ]
 
 [[package]]
 name = "js-sys"
-version = "0.3.78"
+version = "0.3.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c0b063578492ceec17683ef2f8c5e89121fbd0b172cbc280635ab7567db2738"
+checksum = "03d04c30968dffe80775bd4d7fb676131cd04a1fb46d2686dbffbaec2d9dfd31"
 dependencies = [
- "once_cell",
+ "cfg-if",
+ "futures-util",
  "wasm-bindgen",
 ]
 
@@ -3232,7 +3216,7 @@ checksum = "790bedefcec85321e007ff3af84b4e417540d5c87b3c9779b9e247d1bcc3dab8"
 dependencies = [
  "base64 0.22.1",
  "http-body 1.0.1",
- "hyper 1.7.0",
+ "hyper 1.10.1",
  "hyper-rustls",
  "hyper-util",
  "jsonrpsee-core",
@@ -3279,7 +3263,7 @@ version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
 dependencies = [
- "cpufeatures",
+ "cpufeatures 0.2.17",
 ]
 
 [[package]]
@@ -3293,7 +3277,7 @@ dependencies = [
  "log",
  "secret-service",
  "security-framework 2.11.1",
- "security-framework 3.4.0",
+ "security-framework 3.7.0",
  "windows-sys 0.60.2",
  "zeroize",
 ]
@@ -3346,9 +3330,9 @@ checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
 [[package]]
 name = "leb128"
-version = "0.2.5"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "884e2677b40cc8c339eaefcb701c32ef1fd2493d71118dc0ca4b6a736c93bd67"
+checksum = "c83bff1d572d6b9aeef67ddfc8448e4a3737909cb28e81f97c791b9018703e52"
 
 [[package]]
 name = "leb128fmt"
@@ -3407,28 +3391,29 @@ checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
 [[package]]
 name = "libdbus-sys"
-version = "0.2.6"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cbe856efeb50e4681f010e9aaa2bf0a644e10139e54cde10fc83a307c23bd9f"
+checksum = "328c4789d42200f1eeec05bd86c9c13c7f091d2ba9a6ea35acdf51f31bc0f043"
 dependencies = [
  "pkg-config",
 ]
 
 [[package]]
 name = "libm"
-version = "0.2.15"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9fbbcab51052fe104eb5e5d351cf728d30a5be1fe14d9be8a3b097481fb97de"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
 [[package]]
 name = "libredox"
-version = "0.1.9"
+version = "0.1.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "391290121bad3d37fbddad76d8f5d1c1c314cfc646d143d7e07a3086ddff0ce3"
+checksum = "f02ab6bace2054fb888a3c16f990117b579d14a3088e472d63c6011fa185c9d3"
 dependencies = [
  "bitflags",
  "libc",
- "redox_syscall",
+ "plain",
+ "redox_syscall 0.8.1",
 ]
 
 [[package]]
@@ -3448,31 +3433,30 @@ checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.9.4"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd945864f07fe9f5371a27ad7b52a172b4b499999f1d97574c9fa68373937e12"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "litemap"
-version = "0.8.0"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "241eaef5fd12c88705a01fc1066c48c4b36e0dd4377dcdc7ec3942cea7a69956"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
 
 [[package]]
 name = "lock_api"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96936507f153605bddfcda068dd804796c84324ed2510809e5b2a624c81da765"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
 dependencies = [
- "autocfg",
  "scopeguard",
 ]
 
 [[package]]
 name = "log"
-version = "0.4.28"
+version = "0.4.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
+checksum = "953f07c43838f8e6f9758cab68bf5bed85465e7587ebe0b823f1bcd81978ad3a"
 dependencies = [
  "value-bag",
 ]
@@ -3520,9 +3504,9 @@ checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
 
 [[package]]
 name = "memchr"
-version = "2.7.5"
+version = "2.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
+checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
 
 [[package]]
 name = "memoffset"
@@ -3546,6 +3530,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
 dependencies = [
  "adler2",
+ "simd-adler32",
 ]
 
 [[package]]
@@ -3555,27 +3540,28 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
 dependencies = [
  "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
- "windows-sys 0.61.0",
+ "wasi",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "mockito"
-version = "1.7.0"
+version = "1.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7760e0e418d9b7e5777c0374009ca4c93861b9066f18cb334a20ce50ab63aa48"
+checksum = "90820618712cab19cfc46b274c6c22546a82affcb3c3bdf0f29e3db8e1bb92c0"
 dependencies = [
  "assert-json-diff",
  "bytes",
  "colored",
- "futures-util",
+ "futures-core",
  "http 1.4.2",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.7.0",
+ "hyper 1.10.1",
  "hyper-util",
  "log",
- "rand 0.9.2",
+ "pin-project-lite",
+ "rand 0.9.4",
  "regex",
  "serde_json",
  "serde_urlencoded",
@@ -3585,9 +3571,9 @@ dependencies = [
 
 [[package]]
 name = "native-tls"
-version = "0.2.14"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87de3442987e9dbec73158d5c715e7ad9072fda936bb03d19d7fa10e00520f0e"
+checksum = "465500e14ea162429d264d44189adc38b199b62b1c21eea9f69e4b73cb03bbf2"
 dependencies = [
  "libc",
  "log",
@@ -3595,7 +3581,7 @@ dependencies = [
  "openssl-probe",
  "openssl-sys",
  "schannel",
- "security-framework 2.11.1",
+ "security-framework 3.7.0",
  "security-framework-sys",
  "tempfile",
 ]
@@ -3633,11 +3619,11 @@ checksum = "61807f77802ff30975e01f4f071c8ba10c022052f98b3294119f3e615d13e5be"
 
 [[package]]
 name = "nu-ansi-term"
-version = "0.50.1"
+version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4a28e057d01f97e61255210fcff094d74ed0466038633e95017f5beb68e4399"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3675,9 +3661,9 @@ dependencies = [
 
 [[package]]
 name = "num-conv"
-version = "0.2.0"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
 
 [[package]]
 name = "num-derive"
@@ -3732,15 +3718,15 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
 name = "once_cell_polyfill"
-version = "1.70.1"
+version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
 [[package]]
 name = "opaque-debug"
@@ -3750,9 +3736,9 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
 name = "open"
-version = "5.3.2"
+version = "5.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2483562e62ea94312f3576a7aca397306df7990b8d89033e18766744377ef95"
+checksum = "2fbaa89d2ddc8473c78a3adf69eea8cffa28c483b8e02a971ef31527cd0fc92c"
 dependencies = [
  "is-wsl",
  "libc",
@@ -3761,15 +3747,14 @@ dependencies = [
 
 [[package]]
 name = "openssl"
-version = "0.10.73"
+version = "0.10.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8505734d46c8ab1e19a1dce3aef597ad87dcb4c37e7188231769bd6bd51cebf8"
+checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
 dependencies = [
  "bitflags",
  "cfg-if",
  "foreign-types",
  "libc",
- "once_cell",
  "openssl-macros",
  "openssl-sys",
 ]
@@ -3787,15 +3772,15 @@ dependencies = [
 
 [[package]]
 name = "openssl-probe"
-version = "0.1.6"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.109"
+version = "0.9.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90096e2e47630d78b7d1c20952dc621f957103f8bc2c8359ec81290d75238571"
+checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
 dependencies = [
  "cc",
  "libc",
@@ -3862,7 +3847,7 @@ dependencies = [
  "k256",
  "libc",
  "ows-core",
- "rand 0.8.5",
+ "rand 0.8.6",
  "ripemd",
  "scrypt",
  "serde",
@@ -3895,9 +3880,9 @@ checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
 
 [[package]]
 name = "parking_lot"
-version = "0.12.4"
+version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70d58bf43669b5795d1576d0641cfb6fbb2057bf629506267a92807158584a13"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
 dependencies = [
  "lock_api",
  "parking_lot_core",
@@ -3905,15 +3890,15 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.11"
+version = "0.9.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc838d2a56b5b1a6c25f55575dfc605fabb63bb2365f6c2353ef9159aa69e4a5"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall",
+ "redox_syscall 0.5.18",
  "smallvec",
- "windows-targets 0.52.6",
+ "windows-link",
 ]
 
 [[package]]
@@ -3987,7 +3972,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4c5cc86750666a3ed20bdaf5ca2a0344f9c67674cae0515bec2da16fbaa47db"
 dependencies = [
  "fixedbitset",
- "indexmap 2.11.0",
+ "indexmap 2.14.0",
 ]
 
 [[package]]
@@ -4007,7 +3992,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
 dependencies = [
  "phf_shared",
- "rand 0.8.5",
+ "rand 0.8.6",
 ]
 
 [[package]]
@@ -4040,18 +4025,18 @@ checksum = "5be167a7af36ee22fe3115051bc51f6e6c7054c9348e28deb4f49bd6f705a315"
 
 [[package]]
 name = "pin-project"
-version = "1.1.10"
+version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677f1add503faace112b9f1373e43e9e054bfdd22ff1a63c1bc485eaec6a6a8a"
+checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.1.10"
+version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e918e4ff8c4549eb882f14b3a4bc8c8bc93de829416eacf579f1207a8fbf861"
+checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4060,9 +4045,9 @@ dependencies = [
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
 name = "pin-utils"
@@ -4072,9 +4057,9 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
 name = "piper"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96c8c490f422ef9a4efd2cb5b42b76c8613d7e7dfc1caf667b8a3350a5acc066"
+checksum = "c835479a4443ded371d6c535cbfd8d31ad92c5d23ae9770a61bc155e4992a3c1"
 dependencies = [
  "atomic-waker",
  "fastrand",
@@ -4093,22 +4078,28 @@ dependencies = [
 
 [[package]]
 name = "pkg-config"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
 [[package]]
 name = "polling"
-version = "3.10.0"
+version = "3.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5bd19146350fe804f7cb2669c851c03d69da628803dab0d98018142aaa5d829"
+checksum = "5d0e4f59085d47d8241c88ead0f274e8a0cb551f3625263c05eb8dd897c34218"
 dependencies = [
  "cfg-if",
  "concurrent-queue",
  "hermit-abi",
  "pin-project-lite",
- "rustix 1.0.8",
- "windows-sys 0.60.2",
+ "rustix 1.1.4",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4118,31 +4109,31 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "opaque-debug",
  "universal-hash",
 ]
 
 [[package]]
 name = "portable-atomic"
-version = "1.11.1"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
 
 [[package]]
 name = "portable-atomic-util"
-version = "0.2.4"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8a2f0d8d040d7848a709caf78912debcc3f33ee4b3cac47d73d1e1069e83507"
+checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
 dependencies = [
  "portable-atomic",
 ]
 
 [[package]]
 name = "potential_utf"
-version = "0.1.3"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84df19adbe5b5a0782edcab45899906947ab039ccf4573713735ee7de1e6b08a"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
 dependencies = [
  "zerovec",
 ]
@@ -4170,9 +4161,9 @@ checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
 
 [[package]]
 name = "predicates"
-version = "3.1.3"
+version = "3.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5d19ee57562043d37e82899fade9a22ebab7be9cef5026b07fda9cdd4293573"
+checksum = "ada8f2932f28a27ee7b70dd6c1c39ea0675c55a36879ab92f3a715eaa1e63cfe"
 dependencies = [
  "anstyle",
  "difflib",
@@ -4184,15 +4175,15 @@ dependencies = [
 
 [[package]]
 name = "predicates-core"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "727e462b119fe9c93fd0eb1429a5f7647394014cf3c04ab2c0350eeb09095ffa"
+checksum = "cad38746f3166b4031b1a0d39ad9f954dd291e7854fcc0eed52ee41a0b50d144"
 
 [[package]]
 name = "predicates-tree"
-version = "1.0.12"
+version = "1.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72dd2d6d381dfb73a193c7fca536518d7caee39fc8503f74e7dc0be0531b425c"
+checksum = "d0de1b847b39c8131db0467e9df1ff60e6d0562ab8e9a16e568ad0fdb372e2f2"
 dependencies = [
  "predicates-core",
  "termtree",
@@ -4229,11 +4220,11 @@ dependencies = [
 
 [[package]]
 name = "proc-macro-crate"
-version = "3.3.0"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edce586971a4dfaa28950c6f18ed55e0406c1ab88bbce2c6f6293a7aaba73d35"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
 dependencies = [
- "toml_edit",
+ "toml_edit 0.25.12+spec-1.1.0",
 ]
 
 [[package]]
@@ -4253,7 +4244,7 @@ checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
 dependencies = [
  "bitflags",
  "num-traits",
- "rand 0.9.2",
+ "rand 0.9.4",
  "rand_chacha 0.9.0",
  "rand_xorshift",
  "regex-syntax",
@@ -4262,9 +4253,9 @@ dependencies = [
 
 [[package]]
 name = "prost"
-version = "0.14.1"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7231bd9b3d3d33c86b58adbac74b5ec0ad9f496b19d22801d773636feaa95f3d"
+checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
 dependencies = [
  "bytes",
  "prost-derive",
@@ -4272,9 +4263,9 @@ dependencies = [
 
 [[package]]
 name = "prost-derive"
-version = "0.14.1"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9120690fafc389a67ba3803df527d0ec9cbbc9cc45e4cc20b332996dfb672425"
+checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -4285,9 +4276,9 @@ dependencies = [
 
 [[package]]
 name = "prost-types"
-version = "0.14.1"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9b4db3d6da204ed77bb26ba83b6122a73aeb2e87e25fbf7ad2e84c4ccbf8f72"
+checksum = "f94967dc7688f3054c7fac87473ffae4cc4c3904800e2d9f5b857246d8963b0a"
 dependencies = [
  "prost",
 ]
@@ -4303,9 +4294,9 @@ dependencies = [
  "pin-project-lite",
  "quinn-proto",
  "quinn-udp",
- "rustc-hash 2.1.1",
+ "rustc-hash 2.1.2",
  "rustls",
- "socket2 0.5.10",
+ "socket2 0.6.4",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -4314,16 +4305,16 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.13"
+version = "0.11.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1906b49b0c3bc04b5fe5d86a77925ae6524a19b816ae38ce1e426255f1d8a31"
+checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
 dependencies = [
  "bytes",
- "getrandom 0.3.3",
+ "getrandom 0.3.4",
  "lru-slab",
- "rand 0.9.2",
+ "rand 0.9.4",
  "ring",
- "rustc-hash 2.1.1",
+ "rustc-hash 2.1.2",
  "rustls",
  "rustls-pki-types",
  "slab",
@@ -4342,7 +4333,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.5.10",
+ "socket2 0.6.4",
  "tracing",
  "windows-sys 0.60.2",
 ]
@@ -4376,9 +4367,9 @@ checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
 
 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
 dependencies = [
  "libc",
  "rand_chacha 0.3.1",
@@ -4387,17 +4378,28 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.2"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
 dependencies = [
  "rand_chacha 0.9.0",
- "rand_core 0.9.3",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
-name = "rand_chacha"
-version = "0.3.1"
+name = "rand"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
@@ -4412,7 +4414,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.9.3",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
@@ -4421,18 +4423,24 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
 ]
 
 [[package]]
 name = "rand_core"
-version = "0.9.3"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
 dependencies = [
- "getrandom 0.3.3",
+ "getrandom 0.3.4",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
 [[package]]
 name = "rand_hc"
 version = "0.3.2"
@@ -4448,14 +4456,23 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
 dependencies = [
- "rand_core 0.9.3",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.17"
+version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5407465600fb0548f1442edf71dd20683c6ed326200ace4b1ef0763521bb3b77"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b44b894f2a6e36457d665d1e08c3866add6ed5e70050c1b4ba8a8ddedb02ce7"
 dependencies = [
  "bitflags",
 ]
@@ -4466,25 +4483,25 @@ version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
 dependencies = [
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "libredox",
  "thiserror 1.0.69",
 ]
 
 [[package]]
 name = "ref-cast"
-version = "1.0.24"
+version = "1.0.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a0ae411dbe946a674d89546582cea4ba2bb8defac896622d6496f14c23ba5cf"
+checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
 dependencies = [
  "ref-cast-impl",
 ]
 
 [[package]]
 name = "ref-cast-impl"
-version = "1.0.24"
+version = "1.0.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1165225c21bff1f3bbce98f5a1f889949bc902d3575308cc7b0de30b4f6d27c7"
+checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4493,9 +4510,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.11.2"
+version = "1.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23d7fd106d8c02486a8d64e778353d1cffe08ce79ac2e82f540c86d0facf6912"
+checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -4505,9 +4522,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.10"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b9458fa0bfeeac22b5ca447c63aaf45f28439a709ccd244698632f9aa6394d6"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -4516,15 +4533,15 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.6"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caf4aa5b0f434c91fe5c7f1ecb6a5ece2130b02ad2a590589dda5146df959001"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "reqwest"
-version = "0.12.23"
+version = "0.12.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d429f34c8092b2d42c7c93cec323bb4adeb7c67698f70839adec842ec10c7ceb"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -4536,7 +4553,7 @@ dependencies = [
  "http 1.4.2",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.7.0",
+ "hyper 1.10.1",
  "hyper-rustls",
  "hyper-tls",
  "hyper-util",
@@ -4586,7 +4603,7 @@ checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
 dependencies = [
  "cc",
  "cfg-if",
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "libc",
  "untrusted",
  "windows-sys 0.52.0",
@@ -4603,30 +4620,30 @@ dependencies = [
 
 [[package]]
 name = "rpassword"
-version = "7.4.0"
+version = "7.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66d4c8b64f049c6721ec8ccec37ddfc3d641c4a7fca57e8f2a89de509c73df39"
+checksum = "2da316a15f47e3d053de9cb2c439650bd8fa4aaeb9365f2e5f27f492ff73c196"
 dependencies = [
  "libc",
  "rtoolbox",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "rtoolbox"
-version = "0.0.3"
+version = "0.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7cc970b249fbe527d6e02e0a227762c9108b2f49d81094fe357ffc6d14d7f6f"
+checksum = "50a0e551c1e27e1731aba276dbeaeac73f53c7cd34d1bda485d02bd1e0f36844"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "rust-embed"
-version = "8.7.2"
+version = "8.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "025908b8682a26ba8d12f6f2d66b987584a4a87bc024abc5bbc12553a8cd178a"
+checksum = "04113cb9355a377d83f06ef1f0a45b8ab8cd7d8b1288160717d66df5c7988d27"
 dependencies = [
  "rust-embed-impl",
  "rust-embed-utils",
@@ -4635,9 +4652,9 @@ dependencies = [
 
 [[package]]
 name = "rust-embed-impl"
-version = "8.7.2"
+version = "8.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6065f1a4392b71819ec1ea1df1120673418bf386f50de1d6f54204d836d4349c"
+checksum = "da0902e4c7c8e997159ab384e6d0fc91c221375f6894346ae107f47dd0f3ccaa"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4648,9 +4665,9 @@ dependencies = [
 
 [[package]]
 name = "rust-embed-utils"
-version = "8.7.2"
+version = "8.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6cc0c81648b20b70c491ff8cce00c1c3b223bb8ed2b5d41f0e54c6c4c0a3594"
+checksum = "5bcdef0be6fe7f6fa333b1073c949729274b05f123a0ad7efcb8efd878e5c3b1"
 dependencies = [
  "sha2 0.10.9",
  "walkdir",
@@ -4658,9 +4675,9 @@ dependencies = [
 
 [[package]]
 name = "rust_decimal"
-version = "1.41.0"
+version = "1.42.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ce901f9a19d251159075a4c37af514c3b8ef99c22e02dd8c19161cf397ee94a"
+checksum = "be2a24f50780bc85f09cc6ac299bdf1424302742d77221106859c9d8b102126a"
 dependencies = [
  "arrayvec",
  "num-traits",
@@ -4676,9 +4693,9 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
 name = "rustc-hash"
-version = "2.1.1"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
 
 [[package]]
 name = "rustc_version"
@@ -4704,22 +4721,22 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "1.0.8"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11181fbabf243db407ef8df94a6ce0b2f9a733bd8be4ad02b4eda9602296cac8"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
  "bitflags",
  "errno",
  "libc",
- "linux-raw-sys 0.9.4",
- "windows-sys 0.60.2",
+ "linux-raw-sys 0.12.1",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "rustls"
-version = "0.23.31"
+version = "0.23.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0ebcbd2f03de0fc1122ad9bb24b127a5a6cd51d72604a3f3c50ac459762b6cc"
+checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
 dependencies = [
  "log",
  "once_cell",
@@ -4732,21 +4749,21 @@ dependencies = [
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.8.1"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcff2dd52b58a8d98a70243663a0d234c4e2b79235637849d15913394a247d3"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
 dependencies = [
  "openssl-probe",
  "rustls-pki-types",
  "schannel",
- "security-framework 3.4.0",
+ "security-framework 3.7.0",
 ]
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.12.0"
+version = "1.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79"
+checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
 dependencies = [
  "web-time",
  "zeroize",
@@ -4767,7 +4784,7 @@ dependencies = [
  "rustls-native-certs",
  "rustls-platform-verifier-android",
  "rustls-webpki",
- "security-framework 3.4.0",
+ "security-framework 3.7.0",
  "security-framework-sys",
  "webpki-root-certs 0.26.11",
  "windows-sys 0.59.0",
@@ -4798,9 +4815,9 @@ checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
 name = "ryu"
-version = "1.0.20"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "salsa20"
@@ -4820,22 +4837,13 @@ dependencies = [
  "winapi-util",
 ]
 
-[[package]]
-name = "scc"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46e6f046b7fef48e2660c57ed794263155d713de679057f2d0c169bfc6e756cc"
-dependencies = [
- "sdd",
-]
-
 [[package]]
 name = "schannel"
-version = "0.1.27"
+version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f29ebaa345f945cec9fbbc532eb307f0fdad8161f281b6369539c8d84876b3d"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4864,9 +4872,9 @@ dependencies = [
 
 [[package]]
 name = "schemars"
-version = "1.0.4"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82d20c4491bc164fa2f6c5d44565947a52ad80b9505d8e36f8d54c27c739fcd0"
+checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
 dependencies = [
  "dyn-clone",
  "ref-cast",
@@ -4910,12 +4918,6 @@ dependencies = [
  "sha2 0.10.9",
 ]
 
-[[package]]
-name = "sdd"
-version = "3.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca"
-
 [[package]]
 name = "sec1"
 version = "0.7.3"
@@ -4961,7 +4963,7 @@ dependencies = [
  "hkdf",
  "num",
  "once_cell",
- "rand 0.8.5",
+ "rand 0.8.6",
  "serde",
  "sha2 0.10.9",
  "zbus",
@@ -4982,9 +4984,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework"
-version = "3.4.0"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60b369d18893388b345804dc0007963c99b7d665ae71d275812d828c6f089640"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
  "bitflags",
  "core-foundation 0.10.1",
@@ -4995,9 +4997,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.15.0"
+version = "2.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc1f0cbffaac4852523ce30d8bd3c5cdc873501d96ff467ca09b6767bb8cd5c0"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -5005,11 +5007,12 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.26"
+version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
 dependencies = [
  "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -5020,7 +5023,7 @@ checksum = "35a5a225b0cc092f0c818c7e51faf9d63d07da8c3157d6250096ca4b8708cfe3"
 dependencies = [
  "ed25519-dalek",
  "ows-signer",
- "stellar-strkey 0.0.16",
+ "stellar-strkey 0.0.18",
  "thiserror 2.0.18",
  "tiny-bip39",
 ]
@@ -5094,7 +5097,7 @@ version = "1.0.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
 dependencies = [
- "indexmap 2.11.0",
+ "indexmap 2.14.0",
  "itoa",
  "memchr",
  "serde",
@@ -5104,9 +5107,9 @@ dependencies = [
 
 [[package]]
 name = "serde_regex"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8136f1a4ea815d7eac4101cfd0b16dc0cb5e1fe1b8609dfd728058656b7badf"
+checksum = "bafc8d0c5330cecff10f16b459b479fd9acaa5b4acd7167301414e21b0057012"
 dependencies = [
  "regex",
  "serde",
@@ -5155,10 +5158,10 @@ dependencies = [
  "chrono",
  "hex",
  "indexmap 1.9.3",
- "indexmap 2.11.0",
+ "indexmap 2.14.0",
  "schemars 0.8.22",
  "schemars 0.9.0",
- "schemars 1.0.4",
+ "schemars 1.2.1",
  "serde_core",
  "serde_json",
  "serde_with_macros",
@@ -5179,23 +5182,23 @@ dependencies = [
 
 [[package]]
 name = "serial_test"
-version = "3.2.0"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b258109f244e1d6891bf1053a55d63a5cd4f8f4c30cf9a1280989f80e7a1fa9"
+checksum = "699f4197115b8a7e7ff19c9a315a4bd6fffec26cc4626ef45ecaea389e081c6d"
 dependencies = [
- "futures",
+ "futures-executor",
+ "futures-util",
  "log",
  "once_cell",
  "parking_lot",
- "scc",
  "serial_test_derive",
 ]
 
 [[package]]
 name = "serial_test_derive"
-version = "3.2.0"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d69265a08751de7844521fd15003ae0a888e035773ba05695c5c759a6f89eef"
+checksum = "94e153fc76e1c6a068703d6d29c508a0b15c061c4b7e43da59cc097bc342673c"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5209,7 +5212,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "digest 0.10.7",
 ]
 
@@ -5221,7 +5224,7 @@ checksum = "4d58a1e1bf39749807d89cf2d98ac2dfa0ff1cb3faa38fbb64dd88ac8013d800"
 dependencies = [
  "block-buffer 0.9.0",
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "digest 0.9.0",
  "opaque-debug",
 ]
@@ -5233,15 +5236,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "digest 0.10.7",
 ]
 
 [[package]]
 name = "sha3"
-version = "0.10.8"
+version = "0.10.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75872d278a8f37ef87fa0ddbda7802605cb18344497949862c0d4dcb291eba60"
+checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
 dependencies = [
  "digest 0.10.7",
  "keccak",
@@ -5264,9 +5267,9 @@ checksum = "45bb67a18fa91266cc7807181f62f9178a6873bfad7dc788c42e6430db40184f"
 
 [[package]]
 name = "shell-words"
-version = "1.1.0"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24188a676b6ae68c3b2cb3a01be17fbf7240ce009799bb56d5b1409051e78fde"
+checksum = "dc6fe69c597f9c37bfeeeeeb33da3530379845f10be461a66d16d03eca2ded77"
 
 [[package]]
 name = "shlex"
@@ -5274,6 +5277,12 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
 [[package]]
 name = "signal-hook"
 version = "0.4.4"
@@ -5286,10 +5295,11 @@ dependencies = [
 
 [[package]]
 name = "signal-hook-registry"
-version = "1.4.6"
+version = "1.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2a4719bff48cee6b39d12c020eeb490953ad2443b7055bd0b21fca26bd8c28b"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
 dependencies = [
+ "errno",
  "libc",
 ]
 
@@ -5303,6 +5313,12 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
+[[package]]
+name = "simd-adler32"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
+
 [[package]]
 name = "similar"
 version = "2.7.0"
@@ -5311,21 +5327,21 @@ checksum = "bbbb5d9659141646ae647b42fe094daf6c6192d1620870b449d9557f748b2daa"
 
 [[package]]
 name = "siphasher"
-version = "1.0.1"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56199f7ddabf13fe5074ce809e7d3f42b42ae711800501b5b16ea82ad029c39d"
+checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
 
 [[package]]
 name = "slab"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
-version = "1.15.1"
+version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
 
 [[package]]
 name = "snafu"
@@ -5366,7 +5382,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
 dependencies = [
  "libc",
- "windows-sys 0.61.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5411,7 +5427,8 @@ dependencies = [
  "hex",
  "home",
  "humantime",
- "indexmap 2.11.0",
+ "ignore",
+ "indexmap 2.14.0",
  "itertools 0.10.5",
  "keyring",
  "mockito",
@@ -5420,7 +5437,7 @@ dependencies = [
  "pathdiff",
  "phf",
  "predicates",
- "rand 0.8.5",
+ "rand 0.8.6",
  "regex",
  "reqwest",
  "rpassword",
@@ -5435,7 +5452,7 @@ dependencies = [
  "serial_test",
  "sha2 0.10.9",
  "shell-escape",
- "shlex",
+ "shlex 1.3.0",
  "soroban-ledger-snapshot",
  "soroban-sdk",
  "soroban-spec",
@@ -5450,6 +5467,7 @@ dependencies = [
  "strsim",
  "strum 0.17.1",
  "strum_macros 0.17.1",
+ "tar",
  "tempfile",
  "termcolor",
  "termcolor_output",
@@ -5457,13 +5475,12 @@ dependencies = [
  "tokio",
  "tokio-util",
  "toml",
- "toml_edit",
+ "toml_edit 0.22.27",
  "tracing",
  "tracing-appender",
  "tracing-subscriber",
  "ulid",
  "url",
- "walkdir",
  "wasm-gen",
  "wasm-opt",
  "wasmparser 0.116.1",
@@ -5517,7 +5534,7 @@ dependencies = [
  "ed25519-dalek",
  "elliptic-curve",
  "generic-array",
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "hex-literal",
  "hmac",
  "k256",
@@ -5525,7 +5542,7 @@ dependencies = [
  "num-integer",
  "num-traits",
  "p256",
- "rand 0.8.5",
+ "rand 0.8.6",
  "rand_chacha 0.3.1",
  "sec1",
  "sha2 0.10.9",
@@ -5583,7 +5600,7 @@ dependencies = [
  "ctor",
  "derive_arbitrary",
  "ed25519-dalek",
- "rand 0.8.5",
+ "rand 0.8.6",
  "rustc_version",
  "serde",
  "serde_json",
@@ -5652,7 +5669,7 @@ dependencies = [
  "escape-bytes",
  "ethnum",
  "hex",
- "indexmap 2.11.0",
+ "indexmap 2.14.0",
  "itertools 0.10.5",
  "serde",
  "serde_json",
@@ -5661,7 +5678,7 @@ dependencies = [
  "stellar-xdr",
  "thiserror 1.0.69",
  "tokio",
- "wasm-encoder 0.235.0",
+ "wasm-encoder",
  "wasmparser 0.116.1",
  "which",
 ]
@@ -5722,7 +5739,7 @@ dependencies = [
  "tracing-subscriber",
  "ulid",
  "walkdir",
- "wasm-encoder 0.235.0",
+ "wasm-encoder",
  "wasmparser 0.116.1",
  "which",
 ]
@@ -5777,9 +5794,9 @@ dependencies = [
 
 [[package]]
 name = "stable_deref_trait"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "static_assertions"
@@ -5886,13 +5903,25 @@ dependencies = [
  "clap",
  "crate-git-revision 0.0.6",
  "data-encoding",
- "heapless",
+ "heapless 0.8.0",
  "serde",
  "serde_json",
  "serde_with",
  "thiserror 1.0.69",
 ]
 
+[[package]]
+name = "stellar-strkey"
+version = "0.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f34ff61c0ca6f1c2b4169e8d1633417bd9225f58b6175e4e317204565d16277"
+dependencies = [
+ "crate-git-revision 0.0.9",
+ "data-encoding",
+ "heapless 0.9.3",
+ "zeroize",
+]
+
 [[package]]
 name = "stellar-xdr"
 version = "27.0.0"
@@ -5907,7 +5936,7 @@ dependencies = [
  "escape-bytes",
  "ethnum",
  "hex",
- "rand 0.9.2",
+ "rand 0.9.4",
  "schemars 0.8.22",
  "serde",
  "serde_json",
@@ -6020,6 +6049,12 @@ version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
+[[package]]
+name = "symlink"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7973cce6668464ea31f176d85b13c7ab3bba2cb3b77a2ed26abd7801688010a"
+
 [[package]]
 name = "syn"
 version = "1.0.109"
@@ -6064,9 +6099,9 @@ dependencies = [
 
 [[package]]
 name = "system-configuration"
-version = "0.6.1"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
 dependencies = [
  "bitflags",
  "core-foundation 0.9.4",
@@ -6089,6 +6124,17 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
 
+[[package]]
+name = "tar"
+version = "0.4.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
+dependencies = [
+ "filetime",
+ "libc",
+ "xattr",
+]
+
 [[package]]
 name = "temp-dir"
 version = "0.1.16"
@@ -6097,15 +6143,15 @@ checksum = "83176759e9416cf81ee66cb6508dbfe9c96f20b8b56265a39917551c23c70964"
 
 [[package]]
 name = "tempfile"
-version = "3.21.0"
+version = "3.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15b61f8f20e3a6f7e0649d825294eaf317edce30f82cf6026e7e4cb9222a7d1e"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.3",
+ "getrandom 0.4.3",
  "once_cell",
- "rustix 1.0.8",
- "windows-sys 0.60.2",
+ "rustix 1.1.4",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6249,9 +6295,9 @@ dependencies = [
 
 [[package]]
 name = "testcontainers"
-version = "0.27.2"
+version = "0.27.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bd36b06a2a6c0c3c81a83be1ab05fe86460d054d4d51bf513bc56b3e15bdc22"
+checksum = "bfd5785b5483672915ed5fe3cddf9f546802779fc1eceff0a6fb7321fac81c1e"
 dependencies = [
  "astral-tokio-tar",
  "async-trait",
@@ -6349,12 +6395,11 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.47"
+version = "0.3.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+checksum = "711a53c2d47bbd818258c498c8dbfe186a2526c631495cfe7e078567f86b8469"
 dependencies = [
  "deranged",
- "itoa",
  "num-conv",
  "powerfmt",
  "serde_core",
@@ -6364,15 +6409,15 @@ dependencies = [
 
 [[package]]
 name = "time-core"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
 
 [[package]]
 name = "time-macros"
-version = "0.2.27"
+version = "0.2.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
+checksum = "71c652a3727a9cbb9a02f707f530b618ce00d0ccd762009c8c23bd191df3c17d"
 dependencies = [
  "num-conv",
  "time-core",
@@ -6386,7 +6431,7 @@ checksum = "a30fd743a02bf35236f6faf99adb03089bb77e91c998dac2c2ad76bb424f668c"
 dependencies = [
  "once_cell",
  "pbkdf2",
- "rand 0.8.5",
+ "rand 0.8.6",
  "rustc-hash 1.1.0",
  "sha2 0.10.9",
  "thiserror 1.0.69",
@@ -6406,9 +6451,9 @@ dependencies = [
 
 [[package]]
 name = "tinystr"
-version = "0.8.1"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d4f6d1145dcb577acf783d4e601bc1d76a13337bb54e6233add580b07344c8b"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
 dependencies = [
  "displaydoc",
  "zerovec",
@@ -6416,9 +6461,9 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa5fdc3bce6191a1dbc8c02d5c8bffcf557bafa17c124c5264a458f1b0613fa"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
 dependencies = [
  "tinyvec_macros",
 ]
@@ -6443,7 +6488,7 @@ dependencies = [
  "signal-hook-registry",
  "socket2 0.6.4",
  "tokio-macros",
- "windows-sys 0.61.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6469,9 +6514,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-rustls"
-version = "0.26.2"
+version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e727b36a1a0e8b74c376ac2211e40c2c8af09fb4013c60d910495810f008e9b"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
 dependencies = [
  "rustls",
  "tokio",
@@ -6479,9 +6524,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-stream"
-version = "0.1.17"
+version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eca58d7bba4a75707817a2c44174253f9236b2d5fbd055602e9d5c07c139a047"
+checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
 dependencies = [
  "futures-core",
  "pin-project-lite",
@@ -6490,9 +6535,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.16"
+version = "0.7.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14307c986784f72ef81c89db7d9e28d6ac26d16213b109ea501696195e6e3ce5"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
 dependencies = [
  "bytes",
  "futures-core",
@@ -6510,8 +6555,8 @@ checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
 dependencies = [
  "serde",
  "serde_spanned",
- "toml_datetime",
- "toml_edit",
+ "toml_datetime 0.6.11",
+ "toml_edit 0.22.27",
 ]
 
 [[package]]
@@ -6523,18 +6568,48 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+dependencies = [
+ "serde_core",
+]
+
 [[package]]
 name = "toml_edit"
 version = "0.22.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
 dependencies = [
- "indexmap 2.11.0",
+ "indexmap 2.14.0",
  "serde",
  "serde_spanned",
- "toml_datetime",
+ "toml_datetime 0.6.11",
  "toml_write",
- "winnow",
+ "winnow 0.7.15",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.25.12+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2153edc6955a6c354fad8f5efd38b6a8769bdccf9fe50f8e1329f81b0baa5d7"
+dependencies = [
+ "indexmap 2.14.0",
+ "toml_datetime 1.1.1+spec-1.1.0",
+ "toml_parser",
+ "winnow 1.0.3",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
+dependencies = [
+ "winnow 1.0.3",
 ]
 
 [[package]]
@@ -6545,9 +6620,9 @@ checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
 
 [[package]]
 name = "tonic"
-version = "0.14.2"
+version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb7613188ce9f7df5bfe185db26c5814347d110db17920415cf2fbcad85e7203"
+checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef"
 dependencies = [
  "async-trait",
  "axum",
@@ -6557,7 +6632,7 @@ dependencies = [
  "http 1.4.2",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.7.0",
+ "hyper 1.10.1",
  "hyper-timeout",
  "hyper-util",
  "percent-encoding",
@@ -6574,9 +6649,9 @@ dependencies = [
 
 [[package]]
 name = "tonic-prost"
-version = "0.14.2"
+version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66bd50ad6ce1252d87ef024b3d64fe4c3cf54a86fb9ef4c631fdd0ded7aeaa67"
+checksum = "50849f68853be452acf590cde0b146665b8d507b3b8af17261df47e02c209ea0"
 dependencies = [
  "bytes",
  "prost",
@@ -6585,13 +6660,13 @@ dependencies = [
 
 [[package]]
 name = "tower"
-version = "0.5.2"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
 dependencies = [
  "futures-core",
  "futures-util",
- "indexmap 2.11.0",
+ "indexmap 2.14.0",
  "pin-project-lite",
  "slab",
  "sync_wrapper",
@@ -6604,20 +6679,20 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.6.6"
+version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adc82fd73de2a9722ac5da747f12383d2bfdb93591ee6c58486e0097890f05f2"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
  "bitflags",
  "bytes",
  "futures-util",
  "http 1.4.2",
  "http-body 1.0.1",
- "iri-string",
  "pin-project-lite",
  "tower",
  "tower-layer",
  "tower-service",
+ "url",
 ]
 
 [[package]]
@@ -6634,9 +6709,9 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 
 [[package]]
 name = "tracing"
-version = "0.1.41"
+version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
 dependencies = [
  "pin-project-lite",
  "tracing-attributes",
@@ -6645,21 +6720,22 @@ dependencies = [
 
 [[package]]
 name = "tracing-appender"
-version = "0.2.3"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3566e8ce28cc0a3fe42519fc80e6b4c943cc4c8cef275620eb8dac2d3d4e06cf"
+checksum = "050686193eb999b4bb3bc2acfa891a13da00f79734704c4b8b4ef1a10b368a3c"
 dependencies = [
  "crossbeam-channel",
- "thiserror 1.0.69",
+ "symlink",
+ "thiserror 2.0.18",
  "time",
  "tracing-subscriber",
 ]
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.30"
+version = "0.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81383ab64e72a7a8b8e13130c49e3dab29def6d0c7d76a03087b3cf71c5c6903"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6668,9 +6744,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-core"
-version = "0.1.34"
+version = "0.1.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d12581f227e93f094d3af2ae690a574abb8a2b9b7a96e7cfe9647b2b617678"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
 dependencies = [
  "once_cell",
  "valuable",
@@ -6689,9 +6765,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-subscriber"
-version = "0.3.20"
+version = "0.3.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2054a14f5307d601f88daf0553e1cbf472acc4f2c51afab632431cdcd72124d5"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
 dependencies = [
  "matchers",
  "nu-ansi-term",
@@ -6713,19 +6789,19 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "typenum"
-version = "1.18.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
 [[package]]
 name = "uds_windows"
-version = "1.1.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89daebc3e6fd160ac4aa9fc8b3bf71e1f74fbf92367ae71fb83a037e8bf164b9"
+checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
 dependencies = [
  "memoffset",
  "tempfile",
- "winapi",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6734,7 +6810,7 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "470dbf6591da1b39d43c14523b2b469c86879a53e8b758c8e090a470fe7b1fbe"
 dependencies = [
- "rand 0.9.2",
+ "rand 0.9.4",
  "serde",
  "web-time",
 ]
@@ -6747,36 +6823,36 @@ checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
 
 [[package]]
 name = "unicode-id"
-version = "0.3.5"
+version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10103c57044730945224467c09f71a4db0071c123a0648cc3e818913bde6b561"
+checksum = "70ba288e709927c043cbe476718d37be306be53fb1fafecd0dbe36d072be2580"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.18"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "unicode-normalization"
-version = "0.1.24"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5033c97c4262335cded6d6fc3e5c18ab755e1a3dc96376350f3d8e9f009ad956"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
 dependencies = [
  "tinyvec",
 ]
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.12.0"
+version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
 
 [[package]]
 name = "unicode-width"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a1a07cc7db3810833284e8d372ccdc6da29741639ecc70c9ec107df0fa6154c"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
 
 [[package]]
 name = "unicode-xid"
@@ -6802,9 +6878,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "ureq"
-version = "3.1.4"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d39cb1dbab692d82a977c0392ffac19e188bd9186a9f32806f0aaa859d75585a"
+checksum = "dea7109cdcd5864d4eeb1b58a1648dc9bf520360d7af16ec26d0a9354bafcfc0"
 dependencies = [
  "base64 0.22.1",
  "log",
@@ -6812,15 +6888,14 @@ dependencies = [
  "rustls",
  "rustls-pki-types",
  "ureq-proto",
- "utf-8",
- "webpki-roots",
+ "utf8-zero",
 ]
 
 [[package]]
 name = "ureq-proto"
-version = "0.5.3"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d81f9efa9df032be5934a46a068815a10a042b494b6a58cb0a1a97bb5467ed6f"
+checksum = "e994ba84b0bd1b1b0cf92878b7ef898a5c1760108fe7b6010327e274917a808c"
 dependencies = [
  "base64 0.22.1",
  "http 1.4.2",
@@ -6830,21 +6905,22 @@ dependencies = [
 
 [[package]]
 name = "url"
-version = "2.5.7"
+version = "2.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08bc136a29a3d1758e07a9cca267be308aeebf5cfd5a10f3f67ab2097683ef5b"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
 dependencies = [
  "form_urlencoded",
  "idna",
  "percent-encoding",
  "serde",
+ "serde_derive",
 ]
 
 [[package]]
-name = "utf-8"
-version = "0.7.6"
+name = "utf8-zero"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
 
 [[package]]
 name = "utf8_iter"
@@ -6860,11 +6936,11 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.23.0"
+version = "1.23.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ac8b6f42ead25368cf5b098aeb3dc8a1a2c05a3eee8a9a1a68c640edbfc79d9"
+checksum = "144d6b123cef80b301b8f72a9e2ca4370ddec21950d0a103dd22c437006d2db7"
 dependencies = [
- "getrandom 0.4.2",
+ "getrandom 0.4.3",
  "js-sys",
  "wasm-bindgen",
 ]
@@ -6877,9 +6953,9 @@ checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
 [[package]]
 name = "value-bag"
-version = "1.11.1"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "943ce29a8a743eb10d6082545d861b24f9d1b160b7d741e0f2cdf726bec909c5"
+checksum = "7ba6f5989077681266825251a52748b8c1d8a4ad098cc37e440103d0ea717fc0"
 
 [[package]]
 name = "vcpkg"
@@ -6938,31 +7014,13 @@ version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
-[[package]]
-name = "wasi"
-version = "0.14.4+wasi-0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88a5f4a424faf49c3c2c344f166f0662341d470ea185e939657aaff130f0ec4a"
-dependencies = [
- "wit-bindgen 0.45.1",
-]
-
 [[package]]
 name = "wasip2"
-version = "1.0.2+wasi-0.2.9"
+version = "1.0.4+wasi-0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
 dependencies = [
- "wit-bindgen 0.51.0",
-]
-
-[[package]]
-name = "wasip3"
-version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
-dependencies = [
- "wit-bindgen 0.51.0",
+ "wit-bindgen",
 ]
 
 [[package]]
@@ -6973,9 +7031,9 @@ checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.101"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e14915cadd45b529bb8d1f343c4ed0ac1de926144b746e2710f9cd05df6603b"
+checksum = "8ddb3f79143bced6de84270411622a2699cee572fc0875aeaf1e7867cf9fca1a"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -6985,38 +7043,21 @@ dependencies = [
  "wasm-bindgen-shared",
 ]
 
-[[package]]
-name = "wasm-bindgen-backend"
-version = "0.2.101"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e28d1ba982ca7923fd01448d5c30c6864d0a14109560296a162f80f305fb93bb"
-dependencies = [
- "bumpalo",
- "log",
- "proc-macro2",
- "quote",
- "syn 2.0.118",
- "wasm-bindgen-shared",
-]
-
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.51"
+version = "0.4.75"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ca85039a9b469b38336411d6d6ced91f3fc87109a2a27b0c197663f5144dffe"
+checksum = "503b14d284f2c8dac03b819967e155ea753f573586193b2b2c95990cb5d69280"
 dependencies = [
- "cfg-if",
  "js-sys",
- "once_cell",
  "wasm-bindgen",
- "web-sys",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.101"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c3d463ae3eff775b0c45df9da45d68837702ac35af998361e2c84e7c5ec1b0d"
+checksum = "4e21a184b13fb19e157296e2c46056aec9092264fab83e4ba59e68c61b323c3d"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -7024,22 +7065,22 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.101"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7bb4ce89b08211f923caf51d527662b75bdc9c9c7aab40f86dcb9fb85ac552aa"
+checksum = "fecefd9c35bd935a20fc3fc344b5f29138961e4f47fb03297d88f2587afb5ebd"
 dependencies = [
+ "bumpalo",
  "proc-macro2",
  "quote",
  "syn 2.0.118",
- "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.101"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f143854a3b13752c6950862c906306adb27c7e839f7414cec8fea35beab624c1"
+checksum = "23939e44bb9a5d7576fa2b563dc2e136628f1224e88a8deed09e04858b77871f"
 dependencies = [
  "unicode-ident",
 ]
@@ -7054,16 +7095,6 @@ dependencies = [
  "wasmparser 0.235.0",
 ]
 
-[[package]]
-name = "wasm-encoder"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
-dependencies = [
- "leb128fmt",
- "wasmparser 0.244.0",
-]
-
 [[package]]
 name = "wasm-gen"
 version = "0.1.4"
@@ -7074,18 +7105,6 @@ dependencies = [
  "leb128",
 ]
 
-[[package]]
-name = "wasm-metadata"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
-dependencies = [
- "anyhow",
- "indexmap 2.11.0",
- "wasm-encoder 0.244.0",
- "wasmparser 0.244.0",
-]
-
 [[package]]
 name = "wasm-opt"
 version = "0.116.1"
@@ -7163,7 +7182,7 @@ version = "0.116.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a58e28b80dd8340cb07b8242ae654756161f6fc8d0038123d679b7b99964fa50"
 dependencies = [
- "indexmap 2.11.0",
+ "indexmap 2.14.0",
  "semver",
 ]
 
@@ -7174,19 +7193,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "161296c618fa2d63f6ed5fffd1112937e803cb9ec71b32b01a76321555660917"
 dependencies = [
  "bitflags",
- "indexmap 2.11.0",
- "semver",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
-dependencies = [
- "bitflags",
- "hashbrown 0.15.5",
- "indexmap 2.11.0",
+ "indexmap 2.14.0",
  "semver",
 ]
 
@@ -7201,9 +7208,9 @@ dependencies = [
 
 [[package]]
 name = "web-sys"
-version = "0.3.78"
+version = "0.3.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77e4b637749ff0d92b8fad63aa1f7cff3cbe125fd49c175cd6345e7272638b12"
+checksum = "a6430a72df5eb332242960fe84b3002a241163998241eb596d4f739b9757061d"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -7225,23 +7232,23 @@ version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75c7f0ef91146ebfb530314f5f1d24528d7f0767efbfd31dce919275413e393e"
 dependencies = [
- "webpki-root-certs 1.0.7",
+ "webpki-root-certs 1.0.8",
 ]
 
 [[package]]
 name = "webpki-root-certs"
-version = "1.0.7"
+version = "1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f31141ce3fc3e300ae89b78c0dd67f9708061d1d2eda54b8209346fd6be9a92c"
+checksum = "0d46a5a140e6f7afeccd8eae97eff335163939eac8b929834875168b29b3d267"
 dependencies = [
  "rustls-pki-types",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.2"
+version = "1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e8983c3ab33d6fb807cfcdad2491c4ea8cbc8ed839181c7dfd9c67c83e261b2"
+checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -7292,7 +7299,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -7303,22 +7310,22 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windows-core"
-version = "0.61.2"
+version = "0.62.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
 dependencies = [
  "windows-implement",
  "windows-interface",
- "windows-link 0.1.3",
+ "windows-link",
  "windows-result",
  "windows-strings",
 ]
 
 [[package]]
 name = "windows-implement"
-version = "0.60.0"
+version = "0.60.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a47fddd13af08290e67f4acabf4b459f647552718f683a7b415d290ac744a836"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -7327,9 +7334,9 @@ dependencies = [
 
 [[package]]
 name = "windows-interface"
-version = "0.59.1"
+version = "0.59.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd9211b69f8dcdfa817bfd14bf1c97c9188afa36f4750130fcdf3f400eca9fa8"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -7338,43 +7345,37 @@ dependencies = [
 
 [[package]]
 name = "windows-link"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
-
-[[package]]
-name = "windows-link"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45e46c0661abb7180e7b9c281db115305d49ca1709ab8242adf09666d2173c65"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
 [[package]]
 name = "windows-registry"
-version = "0.5.3"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b8a9ed28765efc97bbc954883f4e6796c33a06546ebafacbabee9696967499e"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
 dependencies = [
- "windows-link 0.1.3",
+ "windows-link",
  "windows-result",
  "windows-strings",
 ]
 
 [[package]]
 name = "windows-result"
-version = "0.3.4"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
 dependencies = [
- "windows-link 0.1.3",
+ "windows-link",
 ]
 
 [[package]]
 name = "windows-strings"
-version = "0.4.2"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
 dependencies = [
- "windows-link 0.1.3",
+ "windows-link",
 ]
 
 [[package]]
@@ -7419,16 +7420,16 @@ version = "0.60.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
 dependencies = [
- "windows-targets 0.53.3",
+ "windows-targets 0.53.5",
 ]
 
 [[package]]
 name = "windows-sys"
-version = "0.61.0"
+version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e201184e40b2ede64bc2ea34968b28e33622acdbbf37104f0e4a33f7abe657aa"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
 dependencies = [
- "windows-link 0.2.0",
+ "windows-link",
 ]
 
 [[package]]
@@ -7479,19 +7480,19 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.53.3"
+version = "0.53.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5fe6031c4041849d7c496a8ded650796e7b6ecc19df1a431c1a363342e5dc91"
+checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
 dependencies = [
- "windows-link 0.1.3",
- "windows_aarch64_gnullvm 0.53.0",
- "windows_aarch64_msvc 0.53.0",
- "windows_i686_gnu 0.53.0",
- "windows_i686_gnullvm 0.53.0",
- "windows_i686_msvc 0.53.0",
- "windows_x86_64_gnu 0.53.0",
- "windows_x86_64_gnullvm 0.53.0",
- "windows_x86_64_msvc 0.53.0",
+ "windows-link",
+ "windows_aarch64_gnullvm 0.53.1",
+ "windows_aarch64_msvc 0.53.1",
+ "windows_i686_gnu 0.53.1",
+ "windows_i686_gnullvm 0.53.1",
+ "windows_i686_msvc 0.53.1",
+ "windows_x86_64_gnu 0.53.1",
+ "windows_x86_64_gnullvm 0.53.1",
+ "windows_x86_64_msvc 0.53.1",
 ]
 
 [[package]]
@@ -7514,9 +7515,9 @@ checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86b8d5f90ddd19cb4a147a5fa63ca848db3df085e25fee3cc10b39b6eebae764"
+checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -7538,9 +7539,9 @@ checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7651a1f62a11b8cbd5e0d42526e55f2c99886c77e007179efff86c2b137e66c"
+checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -7562,9 +7563,9 @@ checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1dc67659d35f387f5f6c479dc4e28f1d4bb90ddd1a5d3da2e5d97b42d6272c3"
+checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
 
 [[package]]
 name = "windows_i686_gnullvm"
@@ -7574,9 +7575,9 @@ checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
 [[package]]
 name = "windows_i686_gnullvm"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ce6ccbdedbf6d6354471319e781c0dfef054c81fbc7cf83f338a4296c0cae11"
+checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -7598,9 +7599,9 @@ checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "581fee95406bb13382d2f65cd4a908ca7b1e4c2f1917f143ba16efe98a589b5d"
+checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -7622,9 +7623,9 @@ checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e55b5ac9ea33f2fc1716d1742db15574fd6fc8dadc51caab1c16a3d3b4190ba"
+checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -7646,9 +7647,9 @@ checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a6e035dd0599267ce1ee132e51c27dd29437f63325753051e71dd9e42406c57"
+checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
 
 [[package]]
 name = "windows_x86_64_msvc"
@@ -7670,118 +7671,39 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"
+checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
 
 [[package]]
 name = "winnow"
-version = "0.7.13"
+version = "0.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21a0236b59786fed61e2a80582dd500fe61f18b5dca67a4a067d0bc9039339cf"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
-name = "wit-bindgen"
-version = "0.45.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c573471f125075647d03df72e026074b7203790d41351cd6edc96f46bcccd36"
-
-[[package]]
-name = "wit-bindgen"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
-dependencies = [
- "wit-bindgen-rust-macro",
-]
-
-[[package]]
-name = "wit-bindgen-core"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
-dependencies = [
- "anyhow",
- "heck 0.5.0",
- "wit-parser",
-]
-
-[[package]]
-name = "wit-bindgen-rust"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
-dependencies = [
- "anyhow",
- "heck 0.5.0",
- "indexmap 2.11.0",
- "prettyplease",
- "syn 2.0.118",
- "wasm-metadata",
- "wit-bindgen-core",
- "wit-component",
-]
-
-[[package]]
-name = "wit-bindgen-rust-macro"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
-dependencies = [
- "anyhow",
- "prettyplease",
- "proc-macro2",
- "quote",
- "syn 2.0.118",
- "wit-bindgen-core",
- "wit-bindgen-rust",
-]
-
-[[package]]
-name = "wit-component"
-version = "0.244.0"
+name = "winnow"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
 dependencies = [
- "anyhow",
- "bitflags",
- "indexmap 2.11.0",
- "log",
- "serde",
- "serde_derive",
- "serde_json",
- "wasm-encoder 0.244.0",
- "wasm-metadata",
- "wasmparser 0.244.0",
- "wit-parser",
+ "memchr",
 ]
 
 [[package]]
-name = "wit-parser"
-version = "0.244.0"
+name = "wit-bindgen"
+version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
-dependencies = [
- "anyhow",
- "id-arena",
- "indexmap 2.11.0",
- "log",
- "semver",
- "serde",
- "serde_derive",
- "serde_json",
- "unicode-xid",
- "wasmparser 0.244.0",
-]
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
 [[package]]
 name = "writeable"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea2f10b9bb0928dfb1b42b65e1f9e36f7f54dbdf08457afefb38afcdec4fa2bb"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
 
 [[package]]
 name = "wyz"
@@ -7799,7 +7721,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
 dependencies = [
  "libc",
- "rustix 1.0.8",
+ "rustix 1.1.4",
 ]
 
 [[package]]
@@ -7829,9 +7751,9 @@ dependencies = [
  "fnv",
  "hashbrown 0.15.5",
  "hex",
- "indexmap 2.11.0",
+ "indexmap 2.14.0",
  "lazy_static",
- "rand 0.8.5",
+ "rand 0.8.6",
  "rand_hc",
  "regex",
  "ripemd",
@@ -7869,11 +7791,10 @@ checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
 
 [[package]]
 name = "yoke"
-version = "0.8.0"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f41bb01b8226ef4bfd589436a297c53d118f65921786300e427be8d487695cc"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
 dependencies = [
- "serde",
  "stable_deref_trait",
  "yoke-derive",
  "zerofrom",
@@ -7881,9 +7802,9 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.8.0"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38da3c9736e16c5d3c8c597a9aaa5d1fa565d0532ae05e27c24aa62fb32c0ab6"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -7909,7 +7830,7 @@ dependencies = [
  "hex",
  "nix",
  "ordered-stream",
- "rand 0.8.5",
+ "rand 0.8.6",
  "serde",
  "serde_repr",
  "sha1",
@@ -7949,18 +7870,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.27"
+version = "0.8.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0894878a5fa3edfd6da3f88c4805f4c8558e2b996227a3d864f47fe11e38282c"
+checksum = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.27"
+version = "0.8.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88d2b8d9c68ad2b9e4340d7832716a4d21a22a1154777ad56ea55c51a9cf3831"
+checksum = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -7969,18 +7890,18 @@ dependencies = [
 
 [[package]]
 name = "zerofrom"
-version = "0.1.6"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
 dependencies = [
  "zerofrom-derive",
 ]
 
 [[package]]
 name = "zerofrom-derive"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -7990,18 +7911,18 @@ dependencies = [
 
 [[package]]
 name = "zeroize"
-version = "1.8.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 dependencies = [
  "zeroize_derive",
 ]
 
 [[package]]
 name = "zeroize_derive"
-version = "1.4.2"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
+checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -8010,9 +7931,9 @@ dependencies = [
 
 [[package]]
 name = "zerotrie"
-version = "0.2.2"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36f0bbd478583f79edad978b407914f61b2972f5af6fa089686016be8f9af595"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
 dependencies = [
  "displaydoc",
  "yoke",
@@ -8021,9 +7942,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec"
-version = "0.11.4"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7aa2bd55086f1ab526693ecbe444205da57e25f4489879da80635a46d90e73b"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -8032,9 +7953,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.1"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b96237efa0c878c64bd89c436f661be4e46b2f3eff1ebb976f7ef2321d2f58f"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/FULL_HELP_DOCS.md b/FULL_HELP_DOCS.md
index fb58fc4f8..6f539f3ce 100644
--- a/FULL_HELP_DOCS.md
+++ b/FULL_HELP_DOCS.md
@@ -83,6 +83,7 @@ Tools for smart contract developers
 - `asset` — Utilities to deploy a Stellar Asset Contract or get its id
 - `alias` — Utilities to manage contract aliases
 - `bindings` — Generate code client bindings for a contract
+- `archive` — Generate the reproducible source archive used by verifiable builds
 - `build` — Build a contract from source
 - `extend` — Extend the time to live ledger of a contract-data ledger entry
 - `deploy` — Deploy a wasm contract
@@ -343,6 +344,17 @@ Generate PHP bindings
 
 **Usage:** `stellar contract bindings php`
 
+## `stellar contract archive`
+
+Generate the reproducible source archive used by verifiable builds
+
+**Usage:** `stellar contract archive [OPTIONS]`
+
+###### **Options:**
+
+- `-o`, `--out-file <OUT_FILE>` — Where to write the gzipped tarball. Required unless `--dry-run` is used
+- `--dry-run` — List the entries that would be archived and the computed source_sha256, without writing any file
+
 ## `stellar contract build`
 
 Build a contract from source
@@ -383,6 +395,7 @@ To view the commands that will be executed, without executing them, use the --pr
   If ommitted, wasm files are written only to the cargo target directory.
 
 - `--locked` — Assert that `Cargo.lock` will remain unchanged
+- `--env <ENV>` — Set an environment variable for the build (repeatable), e.g. `--env NAME=VALUE`. It's set on the build process; for a verifiable build it's passed to the container and recorded as a `bldopt`, so avoid secrets there
 - `--optimize <OPTIMIZE>` — Optimize the generated wasm. Enabled by default; pass `--optimize=false` to disable. Requires the `additional-libs` feature
 
   Default value: `true`
@@ -393,6 +406,14 @@ To view the commands that will be executed, without executing them, use the --pr
 
 - `--print-commands-only` — Print commands to build without executing them
 
+###### **Verifiable:**
+
+- `--verifiable` — Build inside a trusted Docker container and record SEP-58 metadata (`bldimg`, `source_uri`, `source_sha256`, `bldopt`) so the resulting WASM can be reproduced and verified by third parties. Implies `--locked`. Requires a clean git working tree
+- `--image <IMAGE>` — Override the auto-selected container image used by `--verifiable`. Must be digest-pinned, e.g. `docker.io/stellar/stellar-cli@sha256:...`. Tag-only refs are rejected because SEP-58 requires content addressing
+- `--source-sha256 <SOURCE_SHA256>` — SEP-58 source identification: SHA-256 of the source archive (recorded as the `source_sha256` meta entry). Optional with `--verifiable`: the archive is always generated and its SHA-256 computed for you. When supplied it's treated as a pin — the build fails if it doesn't match the generated archive
+- `--source-uri <SOURCE_URI>` — SEP-58 source identification: URI where the source can be obtained, e.g. `https://example.com/src.tar.gz` (recorded as the `source_uri` meta entry). Optional; when set it must accompany `--source-sha256`
+- `-d`, `--docker-host <DOCKER_HOST>` — Override the default docker host used by `--verifiable`
+
 ## `stellar contract extend`
 
 Extend the time to live ledger of a contract-data ledger entry.
@@ -480,6 +501,7 @@ Deploy a wasm contract
   Default value: `false`
 
 - `--alias <ALIAS>` — The alias that will be used to save the contract's id. Whenever used, `--alias` will always overwrite the existing contract id configuration without asking for confirmation
+- `--env <ENV>` — Set an environment variable for the build (repeatable), e.g. `--env NAME=VALUE`. It's set on the build process; for a verifiable build it's passed to the container and recorded as a `bldopt`, so avoid secrets there
 - `--optimize <OPTIMIZE>` — Optimize the generated wasm. Enabled by default; pass `--optimize=false` to disable. Requires the `additional-libs` feature
 
   Default value: `true`
@@ -854,6 +876,7 @@ Install a WASM file to the ledger without creating a contract instance
 
   Default value: `false`
 
+- `--env <ENV>` — Set an environment variable for the build (repeatable), e.g. `--env NAME=VALUE`. It's set on the build process; for a verifiable build it's passed to the container and recorded as a `bldopt`, so avoid secrets there
 - `--optimize <OPTIMIZE>` — Optimize the generated wasm. Enabled by default; pass `--optimize=false` to disable. Requires the `additional-libs` feature
 
   Default value: `true`
@@ -917,6 +940,7 @@ Install a WASM file to the ledger without creating a contract instance
 
   Default value: `false`
 
+- `--env <ENV>` — Set an environment variable for the build (repeatable), e.g. `--env NAME=VALUE`. It's set on the build process; for a verifiable build it's passed to the container and recorded as a `bldopt`, so avoid secrets there
 - `--optimize <OPTIMIZE>` — Optimize the generated wasm. Enabled by default; pass `--optimize=false` to disable. Requires the `additional-libs` feature
 
   Default value: `true`
@@ -4145,7 +4169,7 @@ Encode a transaction envelope from JSON to XDR
 
 Decode and encode XDR
 
-**Usage:** `stellar xdr [CHANNEL] <COMMAND>`
+**Usage:** `stellar xdr <COMMAND>`
 
 ###### **Subcommands:**
 
@@ -4158,14 +4182,6 @@ Decode and encode XDR
 - `xfile` — Preprocess XDR .x files
 - `version` — Print version information
 
-###### **Arguments:**
-
-- `<CHANNEL>` — Channel of XDR to operate on
-
-  Default value: `+curr`
-
-  Possible values: `+curr`, `+next`
-
 ## `stellar xdr types`
 
 View information about types
diff --git a/cmd/crates/soroban-test/tests/it/build.rs b/cmd/crates/soroban-test/tests/it/build.rs
index 82485cc8a..67d7ac33b 100644
--- a/cmd/crates/soroban-test/tests/it/build.rs
+++ b/cmd/crates/soroban-test/tests/it/build.rs
@@ -69,6 +69,47 @@ fn build_package_by_current_dir() {
         ));
 }
 
+// `--env` is repeatable and sets env vars on the local cargo process; they
+// surface in the printed command in --print-commands-only.
+#[test]
+fn build_with_env_vars() {
+    let sandbox = TestEnv::default();
+    let cargo_dir = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let fixture_path = cargo_dir.join("tests/fixtures/workspace/contracts/add");
+    sandbox
+        .new_assert_cmd("contract")
+        .current_dir(fixture_path)
+        .arg("build")
+        .arg("--print-commands-only")
+        .arg("--env")
+        .arg("FOO=bar")
+        .arg("--env")
+        .arg("BAZ=qux")
+        .assert()
+        .success()
+        .stdout(predicate::str::contains("FOO=bar").and(predicate::str::contains("BAZ=qux")));
+}
+
+// An invalid `--env` name is rejected before building.
+#[test]
+fn build_rejects_invalid_env_name() {
+    let sandbox = TestEnv::default();
+    let cargo_dir = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let fixture_path = cargo_dir.join("tests/fixtures/workspace/contracts/add");
+    sandbox
+        .new_assert_cmd("contract")
+        .current_dir(fixture_path)
+        .arg("build")
+        .arg("--print-commands-only")
+        .arg("--env")
+        .arg("1FOO=bar")
+        .assert()
+        .failure()
+        .stderr(predicate::str::contains(
+            "not a valid environment variable name",
+        ));
+}
+
 #[test]
 fn build_with_locked() {
     let sandbox = TestEnv::default();
@@ -993,3 +1034,322 @@ fn build_always_injects_cli_version() {
         "CLI version should not be empty"
     );
 }
+
+const ZERO_DIGEST: &str =
+    "docker.io/stellar/stellar-cli@sha256:0000000000000000000000000000000000000000000000000000000000000000";
+
+// Convenience: drive a git command in a fixture directory.
+fn git_in(dir: &Path, args: &[&str]) {
+    std::process::Command::new("git")
+        .args(args)
+        .current_dir(dir)
+        .env("GIT_AUTHOR_NAME", "Test")
+        .env("GIT_AUTHOR_EMAIL", "test@example.com")
+        .env("GIT_COMMITTER_NAME", "Test")
+        .env("GIT_COMMITTER_EMAIL", "test@example.com")
+        .status()
+        .unwrap();
+}
+
+// Init a tempdir copy of the workspace fixture and return the workspace path.
+fn fresh_workspace() -> (TempDir, PathBuf) {
+    let cargo_dir = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let fixture_path = cargo_dir.join("tests/fixtures/workspace");
+    let temp = TempDir::new().unwrap();
+    fs_extra::dir::copy(&fixture_path, temp.path(), &CopyOptions::new()).unwrap();
+    let workspace = temp.path().join("workspace");
+    (temp, workspace)
+}
+
+// `--verifiable` cannot accept reserved `--meta` keys that the cli writes itself.
+#[test]
+fn verifiable_meta_conflict_errors() {
+    let sandbox = TestEnv::default();
+    let cargo_dir = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let fixture_path = cargo_dir.join("tests/fixtures/workspace/contracts/add");
+
+    sandbox
+        .new_assert_cmd("contract")
+        .current_dir(fixture_path)
+        .arg("build")
+        .arg("--verifiable")
+        .arg("--image")
+        .arg(ZERO_DIGEST)
+        .arg("--source-sha256")
+        .arg("a".repeat(64))
+        .arg("--meta")
+        .arg("bldimg=not-allowed")
+        .assert()
+        .failure()
+        .stderr(predicate::str::contains("reserved key: bldimg"));
+}
+
+// `--image` is validated against the SEP-58 bldimg regex; tag-only refs fail.
+#[test]
+fn verifiable_image_must_be_digest_pinned() {
+    let sandbox = TestEnv::default();
+    let cargo_dir = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let fixture_path = cargo_dir.join("tests/fixtures/workspace/contracts/add");
+
+    sandbox
+        .new_assert_cmd("contract")
+        .current_dir(fixture_path)
+        .arg("build")
+        .arg("--verifiable")
+        .arg("--image")
+        .arg("docker.io/stellar/stellar-cli:latest")
+        .arg("--source-sha256")
+        .arg("a".repeat(64))
+        .assert()
+        .failure()
+        .stderr(predicate::str::contains("bldimg format"));
+}
+
+// SEP-58 bldimg requires an explicit registry host (e.g. `docker.io/...`).
+// Implicit Docker-Hub-style short refs are rejected.
+#[test]
+fn verifiable_image_requires_explicit_registry_host() {
+    let sandbox = TestEnv::default();
+    let cargo_dir = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let fixture_path = cargo_dir.join("tests/fixtures/workspace/contracts/add");
+
+    let short_ref = format!("stellar/stellar-cli@sha256:{}", "0".repeat(64));
+
+    sandbox
+        .new_assert_cmd("contract")
+        .current_dir(fixture_path)
+        .arg("build")
+        .arg("--verifiable")
+        .arg("--image")
+        .arg(short_ref)
+        .arg("--source-sha256")
+        .arg("a".repeat(64))
+        .assert()
+        .failure()
+        .stderr(predicate::str::contains("bldimg format"));
+}
+
+// `--verifiable` always generates the source archive (and computes
+// source_sha256) before the docker stage, so the "Wrote source archive" line
+// appears even though the build then fails to reach a real image.
+#[test]
+fn verifiable_always_writes_source_archive() {
+    let sandbox = TestEnv::default();
+    let (_temp, workspace) = fresh_workspace();
+    git_in(&workspace, &["init", "-q", "-b", "main"]);
+    git_in(&workspace, &["add", "-A"]);
+    git_in(&workspace, &["commit", "-q", "-m", "init"]);
+
+    sandbox
+        .new_assert_cmd("contract")
+        .current_dir(workspace.join("contracts").join("add"))
+        .arg("build")
+        .arg("--verifiable")
+        .arg("--image")
+        .arg(ZERO_DIGEST)
+        .assert()
+        .failure()
+        .stderr(
+            predicate::str::contains("Wrote source archive")
+                .and(predicate::str::contains("source_sha256")),
+        );
+}
+
+// `contract archive --out` writes the gzipped tarball and prints its
+// source_sha256.
+#[test]
+fn contract_archive_writes_out() {
+    let sandbox = TestEnv::default();
+    let (temp, workspace) = fresh_workspace();
+    git_in(&workspace, &["init", "-q", "-b", "main"]);
+    git_in(&workspace, &["add", "-A"]);
+    git_in(&workspace, &["commit", "-q", "-m", "init"]);
+
+    let out = temp.path().join("src.tar.gz");
+
+    sandbox
+        .new_assert_cmd("contract")
+        .current_dir(&workspace)
+        .arg("archive")
+        .arg("--out-file")
+        .arg(&out)
+        .assert()
+        .success()
+        .stderr(
+            predicate::str::contains("Wrote source archive")
+                .and(predicate::str::contains("source_sha256")),
+        );
+
+    assert!(out.exists(), "the archive should be written to --out");
+    assert!(
+        std::fs::metadata(&out).unwrap().len() > 0,
+        "the archive should not be empty"
+    );
+}
+
+// `contract archive --dry-run` lists the archived entries and the
+// source_sha256 without writing any file.
+#[test]
+fn contract_archive_dry_run_lists_entries() {
+    let sandbox = TestEnv::default();
+    let (temp, workspace) = fresh_workspace();
+    git_in(&workspace, &["init", "-q", "-b", "main"]);
+    git_in(&workspace, &["add", "-A"]);
+    git_in(&workspace, &["commit", "-q", "-m", "init"]);
+
+    let out = temp.path().join("should-not-exist.tar.gz");
+
+    sandbox
+        .new_assert_cmd("contract")
+        .current_dir(&workspace)
+        .arg("archive")
+        .arg("--dry-run")
+        .assert()
+        .success()
+        .stdout(predicate::str::contains("source/Cargo.toml"))
+        .stderr(predicate::str::contains("source_sha256"));
+
+    assert!(!out.exists(), "--dry-run must not write an archive");
+}
+
+// `--out-file` must name a gzipped tarball (.tar.gz / .tgz).
+#[test]
+fn contract_archive_rejects_bad_out_file_extension() {
+    let sandbox = TestEnv::default();
+    let (temp, workspace) = fresh_workspace();
+    git_in(&workspace, &["init", "-q", "-b", "main"]);
+    git_in(&workspace, &["add", "-A"]);
+    git_in(&workspace, &["commit", "-q", "-m", "init"]);
+
+    let out = temp.path().join("src.zip");
+
+    sandbox
+        .new_assert_cmd("contract")
+        .current_dir(&workspace)
+        .arg("archive")
+        .arg("--out-file")
+        .arg(&out)
+        .assert()
+        .failure()
+        .stderr(predicate::str::contains(".tar.gz or .tgz"));
+
+    assert!(
+        !out.exists(),
+        "no archive should be written on a bad extension"
+    );
+}
+
+// `--out-file` is required unless `--dry-run` is passed.
+#[test]
+fn contract_archive_requires_out_file_without_dry_run() {
+    let sandbox = TestEnv::default();
+    let (_temp, workspace) = fresh_workspace();
+
+    sandbox
+        .new_assert_cmd("contract")
+        .current_dir(&workspace)
+        .arg("archive")
+        .assert()
+        .failure()
+        .stderr(predicate::str::contains("--out-file"));
+}
+
+// A dirty git tree is a hard fail for `contract archive` too, matching
+// `--verifiable`: the source_sha256 must describe a committed state.
+#[test]
+fn contract_archive_dirty_tree_errors() {
+    let sandbox = TestEnv::default();
+    let (temp, workspace) = fresh_workspace();
+    git_in(&workspace, &["init", "-q", "-b", "main"]);
+    git_in(&workspace, &["add", "-A"]);
+    git_in(&workspace, &["commit", "-q", "-m", "init"]);
+    // Dirty the tree after committing so status is non-empty.
+    std::fs::write(workspace.join("dirty.txt"), b"uncommitted").unwrap();
+
+    let out = temp.path().join("src.tar.gz");
+
+    sandbox
+        .new_assert_cmd("contract")
+        .current_dir(&workspace)
+        .arg("archive")
+        .arg("--out-file")
+        .arg(&out)
+        .assert()
+        .failure()
+        .stderr(predicate::str::contains("dirty"));
+
+    assert!(
+        !out.exists(),
+        "no archive should be written for a dirty tree"
+    );
+}
+
+// `--source-sha256` value must match the 64-hex regex.
+#[test]
+fn verifiable_source_sha256_format_errors() {
+    let sandbox = TestEnv::default();
+    let cargo_dir = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let fixture_path = cargo_dir.join("tests/fixtures/workspace/contracts/add");
+
+    sandbox
+        .new_assert_cmd("contract")
+        .current_dir(fixture_path)
+        .arg("build")
+        .arg("--verifiable")
+        .arg("--image")
+        .arg(ZERO_DIGEST)
+        .arg("--source-sha256")
+        .arg("not-a-sha")
+        .assert()
+        .failure()
+        .stderr(predicate::str::contains("source_sha256 format"));
+}
+
+// `--source-uri` value must be a URI with a scheme.
+#[test]
+fn verifiable_source_uri_format_errors() {
+    let sandbox = TestEnv::default();
+    let cargo_dir = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let fixture_path = cargo_dir.join("tests/fixtures/workspace/contracts/add");
+
+    sandbox
+        .new_assert_cmd("contract")
+        .current_dir(fixture_path)
+        .arg("build")
+        .arg("--verifiable")
+        .arg("--image")
+        .arg(ZERO_DIGEST)
+        .arg("--source-sha256")
+        .arg("a".repeat(64))
+        .arg("--source-uri")
+        .arg("not a uri")
+        .assert()
+        .failure()
+        .stderr(predicate::str::contains("source_uri format"));
+}
+
+// A dirty git tree is a hard fail under `--verifiable` (the recorded
+// source_sha256 would not describe the bytes built).
+#[test]
+fn verifiable_dirty_tree_errors() {
+    let sandbox = TestEnv::default();
+    let (_temp, workspace) = fresh_workspace();
+    git_in(&workspace, &["init", "-q", "-b", "main"]);
+    git_in(&workspace, &["add", "-A"]);
+    git_in(&workspace, &["commit", "-q", "-m", "init"]);
+    // Dirty the tree after committing so status is non-empty.
+    std::fs::write(workspace.join("dirty.txt"), b"uncommitted").unwrap();
+
+    sandbox
+        .new_assert_cmd("contract")
+        .current_dir(workspace.join("contracts").join("add"))
+        .arg("build")
+        .arg("--verifiable")
+        .arg("--image")
+        .arg(ZERO_DIGEST)
+        .arg("--source-sha256")
+        .arg("a".repeat(64))
+        .assert()
+        .failure()
+        .stderr(predicate::str::contains("dirty").or(predicate::str::contains("clean tree")));
+}
diff --git a/cmd/soroban-cli/Cargo.toml b/cmd/soroban-cli/Cargo.toml
index 634cdc342..76ee33e61 100644
--- a/cmd/soroban-cli/Cargo.toml
+++ b/cmd/soroban-cli/Cargo.toml
@@ -126,6 +126,8 @@ keyring = { version = "3", features = ["apple-native", "windows-native", "sync-s
 whoami = "1.5.2"
 serde_with = "3.11.0"
 rustc_version = "0.4.1"
+tar = "0.4.40"
+ignore = "0.4.26"
 
 [build-dependencies]
 crate-git-revision = "0.0.9"
@@ -137,6 +139,5 @@ thiserror.workspace = true
 assert_cmd = "2.0.4"
 assert_fs = "1.0.7"
 predicates = { workspace = true }
-walkdir = "2.5.0"
 mockito = "1.5.0"
 serial_test = "3.0.0"
diff --git a/cmd/soroban-cli/src/commands/container/mod.rs b/cmd/soroban-cli/src/commands/container/mod.rs
index 08203095d..6d025cac4 100644
--- a/cmd/soroban-cli/src/commands/container/mod.rs
+++ b/cmd/soroban-cli/src/commands/container/mod.rs
@@ -1,7 +1,7 @@
 use crate::commands::global;
 
 pub(crate) mod logs;
-mod shared;
+pub(crate) mod shared;
 pub(crate) mod start;
 pub(crate) mod stop;
 
diff --git a/cmd/soroban-cli/src/commands/contract/archive.rs b/cmd/soroban-cli/src/commands/contract/archive.rs
new file mode 100644
index 000000000..34248fb5f
--- /dev/null
+++ b/cmd/soroban-cli/src/commands/contract/archive.rs
@@ -0,0 +1,115 @@
+use std::path::PathBuf;
+
+use clap::Parser;
+use sha2::{Digest, Sha256};
+
+use crate::{commands::global, print::Print};
+
+use super::build::source_archive;
+
+/// Accepted `--out-file` suffixes (lower-case). The archive is always a gzipped
+/// tarball, so the filename must say so.
+const ARCHIVE_EXTENSIONS: &[&str] = &[".tar.gz", ".tgz"];
+
+/// Generate (or inspect) the reproducible source archive for a contract.
+///
+/// Produces the same gzipped tarball that `stellar contract build --verifiable`
+/// builds from, and prints its SHA-256 (the SEP-58 `source_sha256`). Use
+/// `--dry-run` to list exactly what would be archived without writing anything —
+/// handy for confirming the contents before a verifiable build, or for
+/// producing the archive to host at a `--source-uri`.
+///
+/// The archive is the current working directory, honoring the project's
+/// `.gitignore` and `.ignore` files (the `.git` directory itself is always
+/// skipped). Run this from the project (or workspace) root you want archived.
+#[derive(Parser, Debug, Clone)]
+#[group(skip)]
+pub struct Cmd {
+    /// Where to write the gzipped tarball. Required unless `--dry-run` is used.
+    #[arg(long, short = 'o', required_unless_present = "dry_run")]
+    pub out_file: Option<PathBuf>,
+
+    /// List the entries that would be archived and the computed source_sha256,
+    /// without writing any file.
+    #[arg(long)]
+    pub dry_run: bool,
+}
+
+#[derive(thiserror::Error, Debug)]
+pub enum Error {
+    #[error(transparent)]
+    SourceArchive(#[from] source_archive::Error),
+
+    #[error(
+        "--out-file {0} must end in .tar.gz or .tgz (the archive is always a gzipped tarball)"
+    )]
+    OutFileExtension(String),
+}
+
+impl Cmd {
+    pub fn run(&self, global_args: &global::Args) -> Result<(), Error> {
+        let print = Print::new(global_args.quiet);
+
+        let source_root = source_archive::resolve_source_root();
+
+        // The archive is the working tree, so a dirty repo would bake uncommitted
+        // changes into the bytes and the printed source_sha256 — refuse it, so the
+        // hash always corresponds to a committed state (matching --verifiable).
+        source_archive::ensure_clean_tree(&source_root, &print)?;
+
+        // The dry-run listing itself reveals the contents, so skip the
+        // "not a git repository" warning there.
+        let bytes = source_archive::build_source_archive(&source_root, &print, !self.dry_run)?;
+        let sha = hex::encode(Sha256::digest(&bytes));
+
+        if self.dry_run {
+            let names = source_archive::entry_names(&bytes)?;
+            let prefix = print.compute_emoji("📄");
+
+            for name in &names {
+                println!("{prefix} {name}");
+            }
+            print.infoln(format!("{} files", names.len()));
+            print.infoln(format!("source_sha256 {sha}"));
+            return Ok(());
+        }
+
+        // `--out-file` is required when not `--dry-run`, so this is always set here.
+        let out = self
+            .out_file
+            .as_ref()
+            .expect("--out-file is required without --dry-run");
+
+        // The output is always a gzipped tarball, so require a matching
+        // extension to keep the filename honest.
+        let name = out
+            .file_name()
+            .unwrap_or_default()
+            .to_string_lossy()
+            .to_ascii_lowercase();
+        if !ARCHIVE_EXTENSIONS.iter().any(|ext| name.ends_with(ext)) {
+            return Err(Error::OutFileExtension(out.display().to_string()));
+        }
+
+        if let Some(parent) = out.parent() {
+            if !parent.as_os_str().is_empty() {
+                std::fs::create_dir_all(parent).map_err(|source| {
+                    source_archive::Error::ArchiveWrite {
+                        path: out.clone(),
+                        source,
+                    }
+                })?;
+            }
+        }
+        std::fs::write(out, &bytes).map_err(|source| source_archive::Error::ArchiveWrite {
+            path: out.clone(),
+            source,
+        })?;
+        print.checkln(format!(
+            "Wrote source archive {} (source_sha256 {sha})",
+            out.display()
+        ));
+
+        Ok(())
+    }
+}
diff --git a/cmd/soroban-cli/src/commands/contract/build.rs b/cmd/soroban-cli/src/commands/contract/build.rs
index ed3ce7e1b..56178b474 100644
--- a/cmd/soroban-cli/src/commands/contract/build.rs
+++ b/cmd/soroban-cli/src/commands/contract/build.rs
@@ -25,6 +25,9 @@ use crate::{
     wasm,
 };
 
+pub(crate) mod source_archive;
+pub mod verifiable;
+
 /// A built WASM artifact with its package name and file path.
 #[derive(Debug, Clone)]
 pub struct BuiltContract {
@@ -96,6 +99,42 @@ pub struct Cmd {
     #[arg(long, conflicts_with = "out_dir", help_heading = "Other")]
     pub print_commands_only: bool,
 
+    /// Build inside a trusted Docker container and record SEP-58 metadata
+    /// (`bldimg`, `source_uri`, `source_sha256`, `bldopt`) so the resulting
+    /// WASM can be reproduced and verified by third parties. Implies
+    /// `--locked`. Requires a clean git working tree.
+    #[arg(long, help_heading = "Verifiable")]
+    pub verifiable: bool,
+
+    /// Override the auto-selected container image used by `--verifiable`.
+    /// Must be digest-pinned, e.g. `docker.io/stellar/stellar-cli@sha256:...`.
+    /// Tag-only refs are rejected because SEP-58 requires content addressing.
+    #[arg(long, requires = "verifiable", help_heading = "Verifiable")]
+    pub image: Option<String>,
+
+    /// SEP-58 source identification: SHA-256 of the source archive
+    /// (recorded as the `source_sha256` meta entry). Optional with
+    /// `--verifiable`: the archive is always generated and its SHA-256 computed
+    /// for you. When supplied it's treated as a pin — the build fails if it
+    /// doesn't match the generated archive.
+    #[arg(long, requires = "verifiable", help_heading = "Verifiable")]
+    pub source_sha256: Option<String>,
+
+    /// SEP-58 source identification: URI where the source can be obtained, e.g.
+    /// `https://example.com/src.tar.gz` (recorded as the `source_uri` meta
+    /// entry). Optional; when set it must accompany `--source-sha256`.
+    #[arg(
+        long,
+        requires = "verifiable",
+        requires = "source_sha256",
+        help_heading = "Verifiable"
+    )]
+    pub source_uri: Option<String>,
+
+    /// Override the default docker host used by `--verifiable`.
+    #[arg(short = 'd', long, env = "DOCKER_HOST", help_heading = "Verifiable")]
+    pub docker_host: Option<String>,
+
     #[command(flatten)]
     pub build_args: BuildArgs,
 }
@@ -107,6 +146,18 @@ pub struct BuildArgs {
     #[arg(long, num_args=1, value_parser=parse_meta_arg, action=clap::ArgAction::Append, help_heading = "Metadata")]
     pub meta: Vec<(String, String)>,
 
+    /// Set an environment variable for the build (repeatable), e.g.
+    /// `--env NAME=VALUE`. It's set on the build process; for a verifiable build
+    /// it's passed to the container and recorded as a `bldopt`, so avoid secrets
+    /// there.
+    #[arg(
+        long = "env",
+        num_args = 1,
+        value_parser = parse_env_arg,
+        action = clap::ArgAction::Append
+    )]
+    pub env: Vec<(String, String)>,
+
     /// Optimize the generated wasm. Enabled by default; pass `--optimize=false` to disable. Requires the `additional-libs` feature.
     #[arg(
         long,
@@ -124,6 +175,7 @@ impl Default for BuildArgs {
     fn default() -> Self {
         Self {
             meta: Vec::new(),
+            env: Vec::new(),
             optimize: true,
         }
     }
@@ -140,6 +192,35 @@ pub fn parse_meta_arg(s: &str) -> Result<(String, String), Error> {
     Ok((key.to_string(), value.to_string()))
 }
 
+/// Parse a `--env NAME=VALUE` argument. The name must be a valid environment
+/// variable name (`[A-Za-z_][A-Za-z0-9_]*`, no surrounding whitespace); the
+/// value is kept verbatim, since the shell has already resolved any quoting and
+/// env values can carry significant whitespace.
+pub fn parse_env_arg(s: &str) -> Result<(String, String), Error> {
+    let (name, value) = s
+        .split_once('=')
+        .ok_or_else(|| Error::EnvArg(format!("{s:?} must be in the form 'NAME=VALUE'")))?;
+
+    if !is_valid_env_name(name) {
+        return Err(Error::EnvArg(format!(
+            "{name:?} is not a valid environment variable name (expected [A-Za-z_][A-Za-z0-9_]*)"
+        )));
+    }
+
+    Ok((name.to_string(), value.to_string()))
+}
+
+/// Whether `name` is a valid environment variable name: a leading letter or
+/// underscore followed by letters, digits, or underscores.
+fn is_valid_env_name(name: &str) -> bool {
+    let mut chars = name.chars();
+    match chars.next() {
+        Some(c) if c.is_ascii_alphabetic() || c == '_' => {}
+        _ => return false,
+    }
+    chars.all(|c| c.is_ascii_alphanumeric() || c == '_')
+}
+
 #[derive(thiserror::Error, Debug)]
 pub enum Error {
     #[error(transparent)]
@@ -181,6 +262,9 @@ pub enum Error {
     #[error("invalid meta entry: {0}")]
     MetaArg(String),
 
+    #[error("invalid env entry: {0}")]
+    EnvArg(String),
+
     #[error(
         "use a rust version other than 1.81, 1.82, 1.83 or 1.91.0 to build contracts (got {0})"
     )]
@@ -204,6 +288,9 @@ pub enum Error {
 
     #[error("wasm parsing error: {0}")]
     WasmParsing(String),
+
+    #[error(transparent)]
+    Verifiable(#[from] verifiable::Error),
 }
 
 const WASM_TARGET: &str = "wasm32v1-none";
@@ -222,6 +309,11 @@ impl Default for Cmd {
             out_dir: None,
             locked: false,
             print_commands_only: false,
+            verifiable: false,
+            image: None,
+            source_sha256: None,
+            source_uri: None,
+            docker_host: None,
             build_args: BuildArgs::default(),
         }
     }
@@ -230,8 +322,13 @@ impl Default for Cmd {
 impl Cmd {
     /// Builds the project and returns the built WASM artifacts.
     #[allow(clippy::too_many_lines)]
-    pub fn run(&self, global_args: &global::Args) -> Result<Vec<BuiltContract>, Error> {
+    pub async fn run(&self, global_args: &global::Args) -> Result<Vec<BuiltContract>, Error> {
         let print = Print::new(global_args.quiet);
+
+        if self.verifiable {
+            return verifiable::run(self, global_args, &print).await;
+        }
+
         let working_dir = env::current_dir().map_err(Error::GettingCurrentDir)?;
         let metadata = self.metadata()?;
         let packages = self.packages(&metadata)?;
@@ -296,6 +393,11 @@ impl Cmd {
             // optimization using markers.
             cmd.env("SOROBAN_SDK_BUILD_SYSTEM_SUPPORTS_SPEC_SHAKING_V2", "1");
 
+            // User-supplied build env vars (--env NAME=VALUE).
+            for (name, value) in &self.build_args.env {
+                cmd.env(name, value);
+            }
+
             let cmd_str = serialize_command(&cmd);
 
             if self.print_commands_only {
@@ -546,10 +648,7 @@ impl Cmd {
             &wasm_bytes
         };
 
-        print.blankln(format!(
-            "Wasm File: {path} ({size_description})",
-            path = rel_path.display()
-        ));
+        print.blankln(format!("Wasm File: {path}", path = rel_path.display()));
 
         print.blankln(format!("Wasm Hash: {}", hex::encode(Sha256::digest(bytes))));
         print.blankln(format!("Wasm Size: {size_description}"));
@@ -862,4 +961,49 @@ mod tests {
             "shlex round-trip failed: {raw_arg:?} not found as a single token in {tokens:?}"
         );
     }
+
+    #[test]
+    fn parse_env_arg_parses_name_value() {
+        assert_eq!(
+            parse_env_arg("FOO=bar").unwrap(),
+            ("FOO".to_string(), "bar".to_string())
+        );
+        assert_eq!(
+            parse_env_arg("_FOO_BAR2=bar").unwrap(),
+            ("_FOO_BAR2".to_string(), "bar".to_string())
+        );
+        // Only the first `=` splits; the value keeps the rest verbatim.
+        assert_eq!(
+            parse_env_arg("FOO=a=b=c").unwrap(),
+            ("FOO".to_string(), "a=b=c".to_string())
+        );
+        // An empty value is allowed.
+        assert_eq!(
+            parse_env_arg("FOO=").unwrap(),
+            ("FOO".to_string(), String::new())
+        );
+        // The value is kept verbatim (the shell already handled quoting), so
+        // significant whitespace survives.
+        assert_eq!(
+            parse_env_arg("FOO= 1 ").unwrap(),
+            ("FOO".to_string(), " 1 ".to_string())
+        );
+    }
+
+    #[test]
+    fn parse_env_arg_rejects_invalid() {
+        for bad in [
+            "FOO",         // no `=`
+            "=bar",        // empty name
+            "  FOO  = 1 ", // whitespace in name
+            "1FOO=x",      // leading digit
+            "FO-O=x",      // invalid char
+            "FOO BAR=x",   // space in name
+        ] {
+            assert!(
+                matches!(parse_env_arg(bad).unwrap_err(), Error::EnvArg(_)),
+                "expected {bad:?} to be rejected"
+            );
+        }
+    }
 }
diff --git a/cmd/soroban-cli/src/commands/contract/build/source_archive.rs b/cmd/soroban-cli/src/commands/contract/build/source_archive.rs
new file mode 100644
index 000000000..b266cc81c
--- /dev/null
+++ b/cmd/soroban-cli/src/commands/contract/build/source_archive.rs
@@ -0,0 +1,473 @@
+//! Reproducible source-archive generation for verifiable builds.
+//!
+//! Produces a gzipped tarball of a contract's source tree, rooted under a
+//! top-level `source/` prefix (so it extracts to a `source/` dir, mirroring the
+//! container's `/source` mount). The working directory is walked and tarred,
+//! honoring the project's own `.gitignore`/`.ignore` files (the `.git` directory
+//! itself is always skipped). The output is byte-reproducible, so the same tree
+//! always hashes to the same `source_sha256`.
+//!
+//! Shared by `contract build --verifiable` (which builds from the extracted
+//! archive) and the standalone `contract archive` command (which generates and
+//! inspects it).
+
+use std::{
+    io::Write,
+    path::{Path, PathBuf},
+    process::Command,
+};
+
+use ignore::WalkBuilder;
+
+use crate::print::Print;
+
+/// Names that usually shouldn't end up in a source archive — VCS metadata of
+/// other systems, secrets/local env, build/cache/transient dirs, and editor/OS/
+/// AI-assistant junk. These don't *exclude* anything (selection is driven
+/// entirely by `.gitignore`/`.ignore`); instead, if any of them slip into the
+/// archive because the project didn't ignore them, we warn the user so they can
+/// add an ignore rule. Matched against each path component.
+pub(crate) const ARCHIVE_WARN_LIST: &[&str] = &[
+    // version control (other systems)
+    ".svn",
+    ".hg",
+    // secrets / local environment
+    ".env",
+    // build output / dependencies
+    "target",
+    "node_modules",
+    // transient
+    "log",
+    "logs",
+    "tmp",
+    "temp",
+    // OS / editor junk
+    ".DS_Store",
+    "Thumbs.db",
+    ".idea",
+    ".vscode",
+    // AI assistant dirs
+    ".claude",
+    ".cursor",
+    ".windsurf",
+    ".aider",
+];
+
+#[derive(thiserror::Error, Debug)]
+pub enum Error {
+    #[error("could not read git state at {path}: {source}")]
+    GitInvoke {
+        path: PathBuf,
+        source: std::io::Error,
+    },
+
+    #[error(
+        "refusing to archive a dirty git working tree at {path}; commit or stash your changes and try again."
+    )]
+    GitDirty { path: PathBuf },
+
+    #[error("could not write source archive to {path}: {source}")]
+    ArchiveWrite {
+        path: PathBuf,
+        source: std::io::Error,
+    },
+
+    #[error("could not extract source archive: {0}")]
+    ArchiveExtract(std::io::Error),
+}
+
+/// The source tree's root: always the current working directory. The archive is
+/// rooted there as-is — we do NOT search upward for a git repository or anchor on
+/// `--manifest-path`'s directory, since for a workspace member the build needs
+/// the whole workspace (its root `Cargo.toml`/`Cargo.lock`), which lives at the
+/// cwd, not the member's directory. So run `contract archive`/`build
+/// --verifiable` from the project (or workspace) root you want archived;
+/// `--manifest-path`, when given, is interpreted relative to it.
+pub(crate) fn resolve_source_root() -> PathBuf {
+    std::env::current_dir().unwrap_or_else(|_| PathBuf::from("."))
+}
+
+/// Warn about and reject a dirty git working tree. Both `contract archive` and
+/// `build --verifiable` archive the working tree as-is, so uncommitted changes
+/// would be baked into the recorded `source_sha256`; refuse them (after
+/// explaining why) so an archive always corresponds to a committed state. A
+/// no-op when `source_root` isn't a git repo (we can't check, e.g. archive
+/// sources) — the user owns the bytes they produce there.
+pub(crate) fn ensure_clean_tree(source_root: &Path, print: &Print) -> Result<(), Error> {
+    if tree_is_dirty(source_root)? {
+        print.warnln(format!(
+            "git working tree at {} is dirty; the archive would include uncommitted changes.",
+            source_root.display(),
+        ));
+        return Err(Error::GitDirty {
+            path: source_root.to_path_buf(),
+        });
+    }
+    Ok(())
+}
+
+/// Whether `source_root` is a git work tree with uncommitted changes. Returns
+/// `Ok(false)` when it isn't a git repo (git ran but refused) — callers can't
+/// verify cleanliness there, so they proceed. Errors only when git can't be
+/// invoked at all.
+fn tree_is_dirty(source_root: &Path) -> Result<bool, Error> {
+    let status = Command::new("git")
+        .arg("-C")
+        .arg(source_root)
+        .arg("status")
+        .arg("--porcelain")
+        .output()
+        .map_err(|source| Error::GitInvoke {
+            path: source_root.to_path_buf(),
+            source,
+        })?;
+
+    // Not a git repo (or git refused): can't verify cleanliness, proceed.
+    if !status.status.success() {
+        return Ok(false);
+    }
+
+    Ok(!status.stdout.is_empty())
+}
+
+/// Produce the gzipped source tarball bytes. The working directory under
+/// `source_root` is walked and tarred, honoring the project's `.gitignore`/
+/// `.ignore` files; entries are rooted under a top-level `source/` prefix.
+///
+/// `warn` controls whether to warn about archived paths that usually shouldn't
+/// be shipped (see `ARCHIVE_WARN_LIST`). Callers that only inspect the result
+/// (e.g. `contract archive --dry-run`) pass `false`, since the listing itself
+/// reveals the contents.
+pub(crate) fn build_source_archive(
+    source_root: &Path,
+    print: &Print,
+    warn: bool,
+) -> Result<Vec<u8>, Error> {
+    let tar = walk_tar(source_root, print, warn)?;
+    gzip(&tar)
+}
+
+/// Tar entry paths inside the gzipped archive bytes, in archive order. Used by
+/// `contract archive --dry-run` to list exactly what the bytes that hash to
+/// `source_sha256` contain.
+pub(crate) fn entry_names(bytes: &[u8]) -> Result<Vec<String>, Error> {
+    let dec = flate2::read::GzDecoder::new(bytes);
+    let mut archive = tar::Archive::new(dec);
+    let mut names = Vec::new();
+    for entry in archive.entries().map_err(Error::ArchiveExtract)? {
+        let entry = entry.map_err(Error::ArchiveExtract)?;
+        let path = entry.path().map_err(Error::ArchiveExtract)?;
+        names.push(path.to_string_lossy().into_owned());
+    }
+    Ok(names)
+}
+
+/// Tar the working tree under `source_root`, honoring the project's `.gitignore`/
+/// `.ignore` files and always skipping the `.git` directory. Each entry is
+/// prefixed with `source/`. When `warn` is set, archived paths matching
+/// `ARCHIVE_WARN_LIST` (e.g. `.env`, `target/`) trigger a warning so the user can
+/// add an ignore rule.
+///
+/// Selection depends only on the in-tree files plus the `.gitignore`/`.ignore`
+/// files inside the archived tree — never on machine-specific state (the global
+/// gitignore, `.git/info/exclude`, or ignore files in parent directories are not
+/// consulted) — so the archive stays byte-reproducible across machines.
+///
+/// The output is reproducible, following GNU tar's reproducibility guidance
+/// (<https://www.gnu.org/software/tar/manual/html_section/Reproducibility.html>)
+/// with the portable equivalents available via the `tar` crate (the system
+/// `tar` can't be relied on — macOS ships bsdtar, which lacks `--sort`,
+/// `--mtime`, `--pax-option`, …): entries are sorted by name (`--sort=name`)
+/// using locale-independent path ordering (`LC_ALL=C`), and `HeaderMode::Deterministic`
+/// zeroes mtime (`--mtime`/`--clamp-mtime`), sets uid/gid to 0 with empty owner
+/// names (`--owner=0 --group=0 --numeric-owner`), and normalizes mode
+/// (`--mode=go+u,go-w`). ustar headers carry no atime/ctime or tar PID. The gzip
+/// wrapper (see `gzip`) is likewise deterministic.
+fn walk_tar(source_root: &Path, print: &Print, warn: bool) -> Result<Vec<u8>, Error> {
+    let walk = WalkBuilder::new(source_root)
+        .hidden(false) // include dotfiles; let .gitignore decide
+        .git_ignore(true) // honor in-tree .gitignore
+        .ignore(true) // honor .ignore
+        .git_global(false) // not the machine's global gitignore (not reproducible)
+        .git_exclude(false) // not .git/info/exclude (not in the archive)
+        .require_git(false) // apply .gitignore/.ignore even without a .git dir
+        .parents(false) // only ignore files inside the archived tree
+        .filter_entry(|e| e.file_name() != ".git") // never archive VCS internals
+        .build();
+
+    let mut files: Vec<PathBuf> = Vec::new();
+    for entry in walk {
+        let entry = entry.map_err(|source| Error::ArchiveWrite {
+            path: source_root.to_path_buf(),
+            source: std::io::Error::other(source),
+        })?;
+        if entry.file_type().is_some_and(|t| t.is_file()) {
+            files.push(entry.path().to_path_buf());
+        }
+    }
+    files.sort();
+
+    if warn {
+        warn_unexpected_paths(&files, source_root, print);
+    }
+
+    let mut builder = tar::Builder::new(Vec::new());
+    builder.mode(tar::HeaderMode::Deterministic);
+    for path in &files {
+        let rel = path.strip_prefix(source_root).unwrap_or(path);
+        let name = Path::new("source").join(rel);
+        let mut f = std::fs::File::open(path).map_err(|source| Error::ArchiveWrite {
+            path: path.clone(),
+            source,
+        })?;
+        builder
+            .append_file(&name, &mut f)
+            .map_err(|source| Error::ArchiveWrite {
+                path: path.clone(),
+                source,
+            })?;
+    }
+    builder.into_inner().map_err(|source| Error::ArchiveWrite {
+        path: source_root.to_path_buf(),
+        source,
+    })
+}
+
+/// Whether a path component matches the warn list: it equals an entry, or — for
+/// dotted entries, which double as extension filters (e.g. `.swp`, `.log`) — it
+/// ends with that entry. Plain names (`target`, `node_modules`) match exactly
+/// only, so `mytarget` is not flagged.
+fn is_warned(name: &std::ffi::OsStr) -> bool {
+    let name = name.to_string_lossy();
+    ARCHIVE_WARN_LIST
+        .iter()
+        .any(|d| name == *d || (d.starts_with('.') && name.ends_with(d)))
+}
+
+/// Warn about archived paths that usually shouldn't be shipped (secrets, build
+/// output, editor/OS junk; see `ARCHIVE_WARN_LIST`). Selection is driven by
+/// `.gitignore`/`.ignore`, so these slipped in only because the project didn't
+/// ignore them — point that out so the user can add a rule. Reports the path up
+/// to each matched component once (so a flagged directory is named once, not per
+/// file under it), each on its own line since paths can be long.
+fn warn_unexpected_paths(files: &[PathBuf], source_root: &Path, print: &Print) {
+    let mut hits: Vec<String> = Vec::new();
+    for path in files {
+        let rel = path.strip_prefix(source_root).unwrap_or(path);
+        let mut prefix = PathBuf::new();
+        for comp in rel.components() {
+            prefix.push(comp);
+            if is_warned(comp.as_os_str()) {
+                let hit = prefix.to_string_lossy().into_owned();
+                if !hits.contains(&hit) {
+                    hits.push(hit);
+                }
+                break;
+            }
+        }
+    }
+    if hits.is_empty() {
+        return;
+    }
+    hits.sort();
+    print.warnln(
+        "archive includes paths usually excluded; add them to .gitignore or .ignore if unintended:",
+    );
+    for hit in &hits {
+        print.blankln(hit);
+    }
+}
+
+/// Gzip with a default (mtime-zeroed) header so the same tar bytes always hash
+/// the same.
+fn gzip(bytes: &[u8]) -> Result<Vec<u8>, Error> {
+    let mut enc = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());
+    enc.write_all(bytes).map_err(|source| Error::ArchiveWrite {
+        path: PathBuf::new(),
+        source,
+    })?;
+    enc.finish().map_err(|source| Error::ArchiveWrite {
+        path: PathBuf::new(),
+        source,
+    })
+}
+
+/// Decompress gzip and unpack the tar into `dest`. Entries are `source/…`, so
+/// they land at `<dest>/source/…`.
+pub(crate) fn unpack_targz(bytes: &[u8], dest: &Path) -> Result<(), Error> {
+    let dec = flate2::read::GzDecoder::new(bytes);
+    tar::Archive::new(dec)
+        .unpack(dest)
+        .map_err(Error::ArchiveExtract)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::config::locator::enforce_hardened_tree;
+    use sha2::{Digest, Sha256};
+
+    #[test]
+    fn is_warned_matches_names_and_dotted_suffixes() {
+        use std::ffi::OsStr;
+        // exact name matches
+        assert!(is_warned(OsStr::new("target")));
+        assert!(is_warned(OsStr::new(".env")));
+        assert!(is_warned(OsStr::new(".DS_Store")));
+        // plain names match exactly only
+        assert!(!is_warned(OsStr::new("mytarget")));
+        assert!(!is_warned(OsStr::new("targets")));
+        // dotted entries also match as suffix (extension-style)
+        assert!(is_warned(OsStr::new("backup.svn")));
+        // `.git`/`.gitignore` are not warned: `.git` is skipped structurally and
+        // `.gitignore` is legitimately archived like any other tracked file.
+        assert!(!is_warned(OsStr::new(".git")));
+        assert!(!is_warned(OsStr::new(".gitignore")));
+        // unrelated files pass through
+        assert!(!is_warned(OsStr::new("Cargo.toml")));
+        assert!(!is_warned(OsStr::new("lib.rs")));
+    }
+
+    // Initialize a git repo at `root` with one commit of everything present.
+    #[cfg(unix)]
+    fn git_init_commit(root: &Path) {
+        for args in [
+            &["init", "-q", "-b", "main"][..],
+            &["add", "-A"][..],
+            &["commit", "-q", "-m", "init"][..],
+        ] {
+            let ok = Command::new("git")
+                .arg("-C")
+                .arg(root)
+                .args(args)
+                .env("GIT_AUTHOR_NAME", "T")
+                .env("GIT_AUTHOR_EMAIL", "t@e.x")
+                .env("GIT_COMMITTER_NAME", "T")
+                .env("GIT_COMMITTER_EMAIL", "t@e.x")
+                .status()
+                .unwrap()
+                .success();
+            assert!(ok);
+        }
+    }
+
+    #[test]
+    #[cfg(unix)]
+    fn build_source_archive_git_is_prefixed_and_deterministic() {
+        use std::os::unix::fs::PermissionsExt;
+        let print = Print::new(true);
+        let temp = tempfile::TempDir::new().unwrap();
+        let root = temp.path();
+        std::fs::write(root.join("Cargo.toml"), b"# crate").unwrap();
+        std::fs::create_dir_all(root.join("src")).unwrap();
+        std::fs::write(root.join("src/lib.rs"), b"// code").unwrap();
+        git_init_commit(root);
+
+        let a = build_source_archive(root, &print, true).unwrap();
+        let b = build_source_archive(root, &print, true).unwrap();
+        assert!(!a.is_empty());
+        assert_eq!(a, b, "same tree should produce identical bytes");
+
+        // The `.git` dir git_init_commit created is never archived.
+        assert!(entry_names(&a)
+            .unwrap()
+            .iter()
+            .all(|n| !n.starts_with("source/.git/")));
+
+        let sha = hex::encode(Sha256::digest(&a));
+        assert_eq!(sha.len(), 64);
+
+        // The listing reflects exactly the archived entries.
+        let names = entry_names(&a).unwrap();
+        assert!(names.iter().any(|n| n == "source/Cargo.toml"));
+        assert!(names.iter().any(|n| n == "source/src/lib.rs"));
+
+        // Unpack and confirm the `source/` prefix + hardened perms.
+        let dest = tempfile::TempDir::new().unwrap();
+        unpack_targz(&a, dest.path()).unwrap();
+        assert!(dest.path().join("source/Cargo.toml").exists());
+        assert!(dest.path().join("source/src/lib.rs").exists());
+
+        enforce_hardened_tree(dest.path()).unwrap();
+        let file_mode = std::fs::metadata(dest.path().join("source/Cargo.toml"))
+            .unwrap()
+            .permissions()
+            .mode()
+            & 0o777;
+        let dir_mode = std::fs::metadata(dest.path().join("source"))
+            .unwrap()
+            .permissions()
+            .mode()
+            & 0o777;
+        assert_eq!(file_mode, 0o600);
+        assert_eq!(dir_mode, 0o700);
+    }
+
+    #[test]
+    fn build_source_archive_skips_git_dir_and_is_reproducible() {
+        let print = Print::new(true);
+        let temp = tempfile::TempDir::new().unwrap();
+        let root = temp.path();
+        std::fs::write(root.join("Cargo.toml"), b"# crate").unwrap();
+        std::fs::create_dir_all(root.join("src")).unwrap();
+        std::fs::write(root.join("src/lib.rs"), b"// code").unwrap();
+        // A `.git` dir is always skipped, even without a real repo.
+        std::fs::create_dir_all(root.join(".git")).unwrap();
+        std::fs::write(root.join(".git/config"), b"junk").unwrap();
+        // No `.gitignore`, so `target/` is NOT excluded — selection is driven by
+        // ignore files only.
+        std::fs::create_dir_all(root.join("target/debug")).unwrap();
+        std::fs::write(root.join("target/debug/x"), b"junk").unwrap();
+
+        let bytes = build_source_archive(root, &print, true).unwrap();
+        let dest = tempfile::TempDir::new().unwrap();
+        unpack_targz(&bytes, dest.path()).unwrap();
+
+        assert!(dest.path().join("source/Cargo.toml").exists());
+        assert!(dest.path().join("source/src/lib.rs").exists());
+        assert!(!dest.path().join("source/.git").exists());
+        // Un-ignored `target/` is included (and would have triggered a warning).
+        assert!(dest.path().join("source/target/debug/x").exists());
+        assert_eq!(hex::encode(Sha256::digest(&bytes)).len(), 64);
+
+        // Reproducible: a second run over the same tree yields identical bytes
+        // (sorted entries + zeroed header fields + deterministic gzip).
+        let again = build_source_archive(root, &print, true).unwrap();
+        assert_eq!(bytes, again);
+    }
+
+    #[test]
+    fn build_source_archive_respects_gitignore_and_dot_ignore() {
+        let print = Print::new(true);
+        let temp = tempfile::TempDir::new().unwrap();
+        let root = temp.path();
+        std::fs::write(root.join("Cargo.toml"), b"# crate").unwrap();
+        std::fs::create_dir_all(root.join("src")).unwrap();
+        std::fs::write(root.join("src/lib.rs"), b"// code").unwrap();
+        // `.gitignore` and `.ignore` are honored even without a git repo.
+        std::fs::write(root.join(".gitignore"), b"target/\n").unwrap();
+        std::fs::write(root.join(".ignore"), b"secret.txt\n").unwrap();
+        std::fs::create_dir_all(root.join("target/debug")).unwrap();
+        std::fs::write(root.join("target/debug/x"), b"junk").unwrap();
+        std::fs::write(root.join("secret.txt"), b"shh").unwrap();
+
+        let bytes = build_source_archive(root, &print, true).unwrap();
+        let dest = tempfile::TempDir::new().unwrap();
+        unpack_targz(&bytes, dest.path()).unwrap();
+
+        assert!(dest.path().join("source/Cargo.toml").exists());
+        assert!(dest.path().join("source/src/lib.rs").exists());
+        // Excluded by the in-tree ignore files.
+        assert!(!dest.path().join("source/target").exists());
+        assert!(!dest.path().join("source/secret.txt").exists());
+        // The ignore files themselves are archived like any other tracked file.
+        assert!(dest.path().join("source/.gitignore").exists());
+    }
+
+    #[test]
+    fn resolve_source_root_is_cwd() {
+        // The root is always the current working directory — no upward search,
+        // no manifest anchoring.
+        assert_eq!(resolve_source_root(), std::env::current_dir().unwrap());
+    }
+}
diff --git a/cmd/soroban-cli/src/commands/contract/build/verifiable.rs b/cmd/soroban-cli/src/commands/contract/build/verifiable.rs
new file mode 100644
index 000000000..ecad61fc3
--- /dev/null
+++ b/cmd/soroban-cli/src/commands/contract/build/verifiable.rs
@@ -0,0 +1,1437 @@
+use std::path::{Path, PathBuf};
+
+use bollard::{
+    models::ContainerCreateBody,
+    query_parameters::{
+        AttachContainerOptions, CreateContainerOptions, CreateImageOptions, StartContainerOptions,
+        WaitContainerOptions,
+    },
+    service::HostConfig,
+    Docker,
+};
+use cargo_metadata::MetadataCommand;
+use futures_util::{StreamExt, TryStreamExt};
+use regex::Regex;
+use semver::Version;
+use serde::Deserialize;
+use sha2::{Digest, Sha256};
+
+use crate::{
+    commands::{container::shared::Error as ConnectionError, global},
+    config::{data, locator::enforce_hardened_tree},
+    print::Print,
+};
+
+use super::{source_archive, BuiltContract, Cmd, WASM_TARGET};
+
+const REGISTRY: &str = "docker.io/stellar/stellar-cli";
+const HUB_TAGS_URL: &str =
+    "https://hub.docker.com/v2/repositories/stellar/stellar-cli/tags/?page_size=100";
+const RESERVED_META_KEYS: &[&str] = &["bldimg", "source_uri", "source_sha256", "bldopt"];
+
+/// First cli release that accepts `--optimize=false` as an explicit value
+/// (added by commit `b17d3f0b`). Containers older than this only accept bare
+/// `--optimize`; we probe the container's `stellar version --only-version` to
+/// pick the right syntax for `--optimize=false`.
+const OPTIMIZE_NEW_SYNTAX_MIN: &str = "26.1.0";
+
+#[derive(thiserror::Error, Debug)]
+pub enum Error {
+    #[error("⛔ failed to connect to docker: {0}")]
+    DockerConnection(#[from] ConnectionError),
+
+    #[error(transparent)]
+    Bollard(#[from] bollard::errors::Error),
+
+    #[error("--image value {value:?} does not match the SEP-58 bldimg format `<registry-host>/<repo>@sha256:<64-hex>`. Examples: docker.io/stellar/stellar-cli@sha256:<64-hex>, localhost:5000/foo@sha256:<64-hex>. Tag-only refs and implicit Docker-Hub short refs are not accepted.")]
+    BldimgFormat { value: String },
+
+    #[error("could not determine the running rustc version: {0}")]
+    RustcVersion(String),
+
+    #[error("could not pull image {tag}: {source}\n\nAvailable tags for this CLI version: {available_for_cli}\nAll published cli/rust pairs: {all_grouped}\n\nFix: install a matching rustc, or pass --image docker.io/stellar/stellar-cli@sha256:<digest> with one of the listed tags resolved to a digest.")]
+    ImageNotFound {
+        tag: String,
+        available_for_cli: String,
+        all_grouped: String,
+        source: bollard::errors::Error,
+    },
+
+    #[error("could not list published images on docker hub: {0}")]
+    TagListUnavailable(String),
+
+    #[error("image {tag} has no repo digest after pull; cannot record a content-addressed bldimg")]
+    NoRepoDigest { tag: String },
+
+    #[error("cargo metadata failed: {0}")]
+    Metadata(#[from] cargo_metadata::Error),
+
+    #[error(transparent)]
+    SourceArchive(#[from] source_archive::Error),
+
+    #[error(
+        "the cli sets bldimg, source_uri, source_sha256, and bldopt automatically when --verifiable is used; remove them from --meta. Got reserved key: {key}"
+    )]
+    ReservedMetaKey { key: String },
+
+    #[error("--source-sha256 value {value:?} does not match the SEP-58 source_sha256 format `^[0-9a-f]{{64}}$` (64-char lower-case hex).")]
+    SourceSha256Format { value: String },
+
+    #[error("--source-uri value {value:?} does not match the SEP-58 source_uri format `^[a-zA-Z][a-zA-Z0-9+.-]*:\\S+$` (a URI with a scheme, e.g. https://example.com/src.tar.gz).")]
+    SourceUriFormat { value: String },
+
+    #[error("--source-sha256 {provided} does not match the SHA-256 of the generated archive {computed}. Omit --source-sha256 to record the computed value, or fix the value.")]
+    SourceSha256Mismatch { provided: String, computed: String },
+
+    #[error(transparent)]
+    Data(#[from] data::Error),
+
+    #[error("container build exited with status {status}. To reproduce manually:\n  {command}")]
+    ContainerExit { status: i64, command: String },
+}
+
+pub async fn run(
+    cmd: &Cmd,
+    global_args: &global::Args,
+    print: &Print,
+) -> Result<Vec<BuiltContract>, super::Error> {
+    // Stage 1: pure validation, no I/O.
+    for (k, _) in &cmd.build_args.meta {
+        if RESERVED_META_KEYS.iter().any(|r| r == k) {
+            return Err(Error::ReservedMetaKey { key: k.clone() }.into());
+        }
+    }
+    if let Some(img) = &cmd.image {
+        if !bldimg_regex().is_match(img) {
+            return Err(Error::BldimgFormat { value: img.clone() }.into());
+        }
+    }
+
+    // Stage 2: local filesystem + git, no network.
+    let workspace_root = resolve_workspace_root(cmd)?;
+    validate_source_formats(cmd)?;
+
+    // The source root is the current working directory: it's bind-mounted into
+    // the container and the `--manifest-path` bldopt is relativized against it.
+    // Run from the project/workspace root you want built. We do NOT validate that
+    // it matches source_uri — a wrong source produces different bytes, and verify
+    // catches that at byte-comparison time.
+    let source_root = source_archive::resolve_source_root();
+
+    // The archive is the working tree, so refuse a dirty repo: a verifiable build
+    // should be deliberate, off a committed state, not whatever happens to be on
+    // disk. Skipped when the source root isn't a git repo (we can't check, e.g.
+    // archive sources).
+    source_archive::ensure_clean_tree(&source_root, print).map_err(Error::from)?;
+
+    // Always build the source archive, record its hash, and build from the
+    // *extracted* archive (in a hardened tempdir) so the WASM is produced from
+    // exactly the bytes that were hashed. A `--source-sha256` passed by the user
+    // is treated as a pin and validated against the computed hash.
+    let resolved = {
+        let a = resolve_archive(cmd, &source_root, print)?;
+        // The extracted `source/` dir mirrors `source_root` exactly and is both
+        // the container mount and the tree the build writes `target/` into, so
+        // it's what `collect_built_contracts` resolves artifacts against.
+        let mount_root = a.extracted_root.join("source");
+        ResolvedSource {
+            source_sha256: a.source_sha256,
+            extracted_root: Some(mount_root.clone()),
+            mount_root,
+            _tmp: Some(a.tmp),
+        }
+    };
+
+    let source_ids = SourceIds {
+        source_uri: cmd.source_uri.clone(),
+        source_sha256: Some(resolved.source_sha256.clone()),
+    };
+
+    // Defer the info banner until every validation has passed, so it doesn't
+    // appear right before an error.
+    if !cmd.locked {
+        print.infoln("Implying --locked because --verifiable was passed");
+    }
+
+    // Stage 3: docker.
+    let docker_args = crate::commands::container::shared::Args {
+        docker_host: cmd.docker_host.clone(),
+    };
+    let docker = docker_args
+        .connect_to_docker(print)
+        .await
+        .map_err(Error::DockerConnection)?;
+    let image_ref = resolve_image(cmd, &docker, print).await?;
+
+    // Only probe the container's cli version when we need to pick between
+    // `--optimize=false` (new syntax) and not-forwarded-at-all (old default).
+    // Bare `--optimize` is universally accepted, so the true path skips this.
+    let supports_explicit_optimize_false = if cmd.build_args.optimize {
+        true
+    } else {
+        probe_supports_optimize_false_syntax(&image_ref, &docker, print).await
+    };
+
+    // Build once per package, each with its own `--package` forwarded and
+    // recorded as a `bldopt`, so every WASM is independently reproducible. With
+    // no explicit `--package` the targets are inferred like a regular build.
+    let packages = resolve_build_packages(cmd)?;
+    if cmd.package.is_none() && !packages.is_empty() {
+        print.infoln(format!("Inferred packages: {}", packages.join(", ")));
+    }
+    let targets: Vec<Option<&str>> = if packages.is_empty() {
+        vec![None]
+    } else {
+        packages.iter().map(|p| Some(p.as_str())).collect()
+    };
+    let container_cmds: Vec<Vec<String>> = targets
+        .iter()
+        .map(|target| {
+            let (forwarded_args, bldopts) =
+                build_forwarded_args(cmd, &source_root, *target, supports_explicit_optimize_false);
+            let metadata_args = build_metadata_args(&image_ref, &source_ids, &bldopts);
+            compose_container_args(&forwarded_args, &metadata_args)
+        })
+        .collect();
+
+    // Always stream the container's cargo output during `contract build
+    // --verifiable`, matching how a non-verifiable `contract build` shows
+    // cargo output by default. The verify-side caller gates this on
+    // `--verbose` because verifications are run as part of pipelines. All
+    // per-package builds run in one container so the crates download, compiled
+    // deps, and target/ are shared.
+    let env: Vec<String> = cmd
+        .build_args
+        .env
+        .iter()
+        .map(|(name, value)| format!("{name}={value}"))
+        .collect();
+
+    run_in_container(
+        &image_ref,
+        &resolved.mount_root,
+        &container_cmds,
+        &env,
+        &docker,
+        print,
+        true,
+    )
+    .await?;
+
+    let _ = global_args;
+    let _ = workspace_root;
+    collect_built_contracts(cmd, &source_root, resolved.extracted_root.as_deref(), print)
+}
+
+/// The recorded `source_sha256`, the directory bind-mounted at `/source`, the
+/// extracted-archive root, and its tempdir guard — held so the temp dir
+/// outlives the container build and artifact collection.
+struct ResolvedSource {
+    source_sha256: String,
+    mount_root: PathBuf,
+    extracted_root: Option<PathBuf>,
+    _tmp: Option<tempfile::TempDir>,
+}
+
+fn resolve_workspace_root(cmd: &Cmd) -> Result<PathBuf, Error> {
+    let mut mc = MetadataCommand::new();
+    mc.no_deps();
+    if let Some(p) = &cmd.manifest_path {
+        mc.manifest_path(p);
+    }
+    let md = mc.exec()?;
+    Ok(md.workspace_root.into_std_path_buf())
+}
+
+/// Source-identification fields recorded as SEP-58 meta. `source_sha256` is
+/// always `Some` by the time these are built in `run()` (resolved from
+/// `--source-sha256` or computed from the generated archive). `source_uri` is
+/// `Some` only when the user passed `--source-uri`.
+#[derive(Debug, Default, Clone)]
+struct SourceIds {
+    source_uri: Option<String>,
+    source_sha256: Option<String>,
+}
+
+/// Format-validate the user-supplied source flags. Both are optional under
+/// `--verifiable`; `--source-sha256`, when present, is validated as a pin in
+/// `resolve_archive`.
+fn validate_source_formats(cmd: &Cmd) -> Result<(), Error> {
+    if let Some(sha) = &cmd.source_sha256 {
+        if !source_sha256_regex().is_match(sha) {
+            return Err(Error::SourceSha256Format { value: sha.clone() });
+        }
+    }
+    if let Some(uri) = &cmd.source_uri {
+        if !source_uri_regex().is_match(uri) {
+            return Err(Error::SourceUriFormat { value: uri.clone() });
+        }
+    }
+    Ok(())
+}
+
+/// Outcome of archiving: the generated archive's SHA-256 and the directory it
+/// was extracted into (held alive by `tmp`).
+struct ArchiveResult {
+    source_sha256: String,
+    extracted_root: PathBuf,
+    tmp: tempfile::TempDir,
+}
+
+/// Build the source archive, record its hash, write it to the managed archives
+/// dir (content-addressed, so the bytes are available to upload for
+/// `--source-uri`), and extract it into a permission-hardened tempdir that the
+/// container then builds from.
+fn resolve_archive(cmd: &Cmd, source_root: &Path, print: &Print) -> Result<ArchiveResult, Error> {
+    let bytes = source_archive::build_source_archive(source_root, print, true)?;
+    let computed = hex::encode(Sha256::digest(&bytes));
+
+    // If the user pinned a hash, it must match what we produced.
+    if let Some(provided) = &cmd.source_sha256 {
+        if provided != &computed {
+            return Err(Error::SourceSha256Mismatch {
+                provided: provided.clone(),
+                computed,
+            });
+        }
+    }
+
+    // Content-addressed name under the managed archives dir.
+    let out_path = data::archives_dir()?.join(format!("{computed}.tar.gz"));
+    if let Some(parent) = out_path.parent() {
+        std::fs::create_dir_all(parent).map_err(|source| source_archive::Error::ArchiveWrite {
+            path: out_path.clone(),
+            source,
+        })?;
+    }
+    std::fs::write(&out_path, &bytes).map_err(|source| source_archive::Error::ArchiveWrite {
+        path: out_path.clone(),
+        source,
+    })?;
+    print.infoln(format!(
+        "Wrote source archive {} (source_sha256 {computed})",
+        out_path.display()
+    ));
+
+    // Extract and harden, then build from the extracted copy so the WASM is
+    // produced from exactly the archived bytes.
+    //
+    // Extract under the data dir, NOT the OS temp dir: on macOS `$TMPDIR` lives
+    // under /var/folders, which container VMs (Docker Desktop, Colima, …) don't
+    // share by default, so a bind mount of it would be empty inside the
+    // container. The data dir lives under the user's home, which is shared.
+    let base = data::data_local_dir()?;
+    std::fs::create_dir_all(&base).map_err(|source| source_archive::Error::ArchiveWrite {
+        path: base.clone(),
+        source,
+    })?;
+    let tmp = tempfile::Builder::new()
+        .prefix("verifiable-src-")
+        .tempdir_in(&base)
+        .map_err(source_archive::Error::ArchiveExtract)?;
+    source_archive::unpack_targz(&bytes, tmp.path())?;
+    enforce_hardened_tree(tmp.path()).map_err(source_archive::Error::ArchiveExtract)?;
+
+    let extracted_root = tmp.path().to_path_buf();
+    Ok(ArchiveResult {
+        source_sha256: computed,
+        extracted_root,
+        tmp,
+    })
+}
+
+fn bldimg_regex() -> Regex {
+    Regex::new(r"^(?:localhost(?::\d+)?|[^\s@/]*[.:][^\s@/]*)/[^\s@]+@sha256:[0-9a-f]{64}$")
+        .unwrap()
+}
+
+fn source_sha256_regex() -> Regex {
+    Regex::new(r"^[0-9a-f]{64}$").unwrap()
+}
+
+fn source_uri_regex() -> Regex {
+    Regex::new(r"^[a-zA-Z][a-zA-Z0-9+.-]*:\S+$").unwrap()
+}
+
+/// Resolve every package the build will produce, so each can be pinned with its
+/// own `--package` (and recorded as a `bldopt`) — making each WASM independently
+/// reproducible even if the workspace's default members change later. An
+/// explicit `--package` wins; otherwise infer the default-member cdylibs exactly
+/// like a regular `stellar contract build` does. May be empty (no cdylib default
+/// members), in which case the caller falls back to a single no-`--package`
+/// build.
+fn resolve_build_packages(cmd: &Cmd) -> Result<Vec<String>, Error> {
+    if let Some(pkg) = &cmd.package {
+        return Ok(vec![pkg.clone()]);
+    }
+    let mut mc = MetadataCommand::new();
+    mc.no_deps();
+    if let Some(p) = &cmd.manifest_path {
+        mc.manifest_path(p);
+    }
+    let md = mc.exec().map_err(Error::Metadata)?;
+    let mut names: Vec<String> = md
+        .packages
+        .iter()
+        .filter(|p| md.workspace_default_members.contains(&p.id))
+        .filter(|p| {
+            p.targets
+                .iter()
+                .any(|t| t.crate_types.iter().any(|c| c == "cdylib"))
+        })
+        .map(|p| p.name.clone())
+        .collect();
+    names.sort();
+    names.dedup();
+    Ok(names)
+}
+
+/// The flags forwarded to the container's `stellar contract build`, plus the
+/// bldopt strings recorded into SEP-58 metadata. Every build-affecting flag
+/// becomes one bldopt entry so a verifier can replay the same invocation.
+/// `--locked` is always present. `manifest_path` (when set) is recorded
+/// relative to the workspace root so it's valid inside `/source`.
+///
+/// `supports_explicit_optimize_false`: whether the container's cli accepts
+/// `--optimize=false`. When false, the optimize=false case records the flag
+/// in bldopt but does not forward it (the older container's cli default of
+/// `false` already produces the desired state).
+fn build_forwarded_args(
+    cmd: &Cmd,
+    workspace_root: &Path,
+    package: Option<&str>,
+    supports_explicit_optimize_false: bool,
+) -> (Vec<String>, Vec<String>) {
+    let mut forwarded: Vec<String> = Vec::new();
+    let mut bldopts: Vec<String> = Vec::new();
+
+    // Record a build option. `None` means a bare flag (`--locked`); `Some(v)`
+    // means `--flag=v`. The forwarded copy keeps the value raw (the container
+    // gets it as argv, and `compose_shell_command` re-escapes it for the
+    // multi-package `sh -c`); the bldopt copy shell-escapes the value once, here
+    // at the source, so every recorded option is valid shell on its own and no
+    // consumer has to split a flag from its value later. For `key=value`
+    // payloads (`--meta`, `--env`) the key goes in `key` (`--meta=home_domain`)
+    // and only the value is escaped, keeping `--env=B='nice value'` rather than
+    // `'--env=B=nice value'`.
+    let mut record = |key: &str, value: Option<&str>| {
+        if let Some(v) = value {
+            forwarded.push(format!("{key}={v}"));
+            bldopts.push(format!("{key}={}", shell_escape::escape(v.into())));
+        } else {
+            forwarded.push(key.to_string());
+            bldopts.push(key.to_string());
+        }
+    };
+
+    record("--locked", None);
+
+    if let Some(path) = &cmd.manifest_path {
+        let abs = std::path::absolute(path).unwrap_or_else(|_| path.clone());
+        let rel = abs
+            .strip_prefix(workspace_root)
+            .map(Path::to_path_buf)
+            .unwrap_or(abs);
+        record("--manifest-path", Some(rel.display().to_string().as_str()));
+    }
+    if cmd.profile != "release" {
+        record("--profile", Some(cmd.profile.as_str()));
+    }
+    if let Some(features) = &cmd.features {
+        record("--features", Some(features.as_str()));
+    }
+    if cmd.all_features {
+        record("--all-features", None);
+    }
+    if cmd.no_default_features {
+        record("--no-default-features", None);
+    }
+    // Always pin the package when it can be resolved (explicit `--package`, or
+    // a workspace that builds exactly one cdylib by default) so the recorded
+    // bldopt stays reproducible even if workspace default members change later.
+    if let Some(pkg) = package {
+        record("--package", Some(pkg));
+    }
+    for (k, v) in &cmd.build_args.meta {
+        record(&format!("--meta={k}"), Some(v.as_str()));
+    }
+
+    // `--optimize` true is recorded as a bare flag (universally accepted).
+    // `--optimize=false` is only emitted when the container's cli accepts it
+    // (added in `b17d3f0b`); on older containers, false is the default and
+    // we record/forward nothing — passing `--optimize=false` there would fail.
+    if cmd.build_args.optimize {
+        record("--optimize", None);
+    } else if supports_explicit_optimize_false {
+        record("--optimize", Some("false"));
+    }
+
+    // Build env vars are applied via docker `-e` (see run_in_container), not as
+    // arguments to the inner `stellar contract build`, so they're recorded as
+    // bldopts only — never forwarded. A verifier replays them with `--env`. The
+    // value is escaped (the name is a validated identifier) so the recorded
+    // option stays valid shell.
+    for (name, value) in &cmd.build_args.env {
+        bldopts.push(format!(
+            "--env={name}={}",
+            shell_escape::escape(value.as_str().into())
+        ));
+    }
+
+    (forwarded, bldopts)
+}
+
+fn build_metadata_args(image_ref: &str, ids: &SourceIds, bldopts: &[String]) -> Vec<String> {
+    let mut out = Vec::new();
+
+    let push = |out: &mut Vec<String>, key: &str, val: &str| {
+        out.push("--meta".to_string());
+        out.push(format!("{key}={val}"));
+    };
+
+    push(&mut out, "bldimg", image_ref);
+
+    if let Some(v) = &ids.source_uri {
+        push(&mut out, "source_uri", v);
+    }
+    if let Some(v) = &ids.source_sha256 {
+        push(&mut out, "source_sha256", v);
+    }
+
+    // bldopts already arrive as valid shell (escaped at the source in
+    // `build_forwarded_args`), so they're recorded verbatim: a verifier
+    // reconstructs the build by joining the recorded values and running them
+    // through a shell.
+    for o in bldopts {
+        push(&mut out, "bldopt", o);
+    }
+
+    out
+}
+
+fn compose_container_args(forwarded: &[String], metadata: &[String]) -> Vec<String> {
+    let mut args = vec!["contract".to_string(), "build".to_string()];
+    args.extend_from_slice(forwarded);
+    args.extend_from_slice(metadata);
+    args
+}
+
+pub async fn resolve_image(cmd: &Cmd, docker: &Docker, print: &Print) -> Result<String, Error> {
+    if let Some(s) = &cmd.image {
+        if !bldimg_regex().is_match(s) {
+            return Err(Error::BldimgFormat { value: s.clone() });
+        }
+        // Always pull, even when the digest is user-supplied. Docker requires
+        // the image to be locally present before `create_container` will
+        // accept it, and the user typically expects the cli to fetch
+        // whatever they asked for.
+        pull_image(docker, s, print).await?;
+        return Ok(s.clone());
+    }
+
+    let cli_v = env!("CARGO_PKG_VERSION");
+    let rust_v = rustc_version::version()
+        .map_err(|e| Error::RustcVersion(e.to_string()))?
+        .to_string();
+    let tag = format!("{REGISTRY}:{cli_v}-rust{rust_v}");
+
+    print.infoln(format!("Pulling verifiable build image {tag}"));
+    let pull = pull_image(docker, &tag, print).await;
+
+    match pull {
+        Ok(()) => {}
+        Err(e) => {
+            let (available_for_cli, all_grouped) = match list_published_tags().await {
+                Ok(tags) => format_available(&tags, cli_v),
+                Err(list_err) => (
+                    "<unavailable>".to_string(),
+                    format!("<unavailable: {list_err}>"),
+                ),
+            };
+            return Err(Error::ImageNotFound {
+                tag,
+                available_for_cli,
+                all_grouped,
+                source: e,
+            });
+        }
+    }
+
+    let inspect = docker.inspect_image(&tag).await?;
+    let digest = inspect
+        .repo_digests
+        .and_then(|v| v.into_iter().next())
+        .ok_or_else(|| Error::NoRepoDigest { tag: tag.clone() })?;
+    Ok(digest)
+}
+
+async fn pull_image(
+    docker: &Docker,
+    tag: &str,
+    print: &Print,
+) -> Result<(), bollard::errors::Error> {
+    let mut stream = docker.create_image(
+        Some(CreateImageOptions {
+            from_image: Some(tag.to_string()),
+            ..Default::default()
+        }),
+        None,
+        None,
+    );
+    while let Some(item) = stream.try_next().await? {
+        if let Some(status) = item.status {
+            // The docker daemon emits short status lines like:
+            //   "Pulling from <repo>"
+            //   "Digest: sha256:<hex>"
+            //   "Status: Image is up to date for <ref>"
+            // Stand-alone "Digest" reads as an orphan. Rewrite each line so
+            // it makes sense outside the docker-pull context.
+            if let Some(repo) = status.strip_prefix("Pulling from ") {
+                print.infoln(format!("Pulling image {repo}"));
+            } else if let Some(digest) = status.strip_prefix("Digest: ") {
+                print.infoln(format!("Image digest: {digest}"));
+            } else if let Some(rest) = status.strip_prefix("Status: ") {
+                // Docker's status text already starts with "Image …" or
+                // "Downloaded …", so we forward it verbatim instead of
+                // prepending another "Image:".
+                print.infoln(rest);
+            }
+        }
+    }
+    Ok(())
+}
+
+#[derive(Debug, Clone)]
+pub struct PublishedTag {
+    pub cli: Version,
+    pub rust: Version,
+    pub raw: String,
+}
+
+#[derive(Deserialize)]
+struct HubPage {
+    results: Vec<HubTag>,
+    next: Option<String>,
+}
+
+#[derive(Deserialize)]
+struct HubTag {
+    name: String,
+}
+
+pub async fn list_published_tags() -> Result<Vec<PublishedTag>, Error> {
+    let re = Regex::new(r"^(\d+\.\d+\.\d+)-rust(\d+\.\d+\.\d+)$").unwrap();
+    let mut out = Vec::new();
+    let mut next = Some(HUB_TAGS_URL.to_string());
+    let client = reqwest::Client::builder()
+        .user_agent("stellar-cli")
+        .build()
+        .map_err(|e| Error::TagListUnavailable(e.to_string()))?;
+    while let Some(url) = next {
+        let page: HubPage = client
+            .get(&url)
+            .send()
+            .await
+            .map_err(|e| Error::TagListUnavailable(e.to_string()))?
+            .error_for_status()
+            .map_err(|e| Error::TagListUnavailable(e.to_string()))?
+            .json()
+            .await
+            .map_err(|e| Error::TagListUnavailable(e.to_string()))?;
+        for t in page.results {
+            if let Some(c) = re.captures(&t.name) {
+                let cli = Version::parse(&c[1]);
+                let rust = Version::parse(&c[2]);
+                if let (Ok(cli), Ok(rust)) = (cli, rust) {
+                    out.push(PublishedTag {
+                        cli,
+                        rust,
+                        raw: t.name,
+                    });
+                }
+            }
+        }
+        next = page.next;
+    }
+    Ok(out)
+}
+
+fn format_available(tags: &[PublishedTag], current_cli: &str) -> (String, String) {
+    let current = Version::parse(current_cli).ok();
+    let mut for_this_cli: Vec<&PublishedTag> = tags
+        .iter()
+        .filter(|t| Some(&t.cli) == current.as_ref())
+        .collect();
+    for_this_cli.sort_by(|a, b| b.rust.cmp(&a.rust));
+    let available_for_cli = if for_this_cli.is_empty() {
+        "<none>".to_string()
+    } else {
+        for_this_cli
+            .iter()
+            .map(|t| t.raw.as_str())
+            .collect::<Vec<_>>()
+            .join(", ")
+    };
+
+    let mut by_cli: std::collections::BTreeMap<String, Vec<String>> =
+        std::collections::BTreeMap::new();
+    for t in tags {
+        by_cli
+            .entry(t.cli.to_string())
+            .or_default()
+            .push(t.rust.to_string());
+    }
+    let all_grouped = by_cli
+        .into_iter()
+        .map(|(cli, rusts)| format!("{cli}: [{}]", rusts.join(", ")))
+        .collect::<Vec<_>>()
+        .join("; ");
+
+    (available_for_cli, all_grouped)
+}
+
+/// Probe the container's `stellar` binary for its self-reported version with
+/// `stellar version --only-version`. Returns true if the parsed version is
+/// at or above the cutoff where `--optimize=false` was accepted. On any
+/// probe failure (network, unparseable output, missing subcommand), returns
+/// false — the conservative assumption that the container is old.
+async fn probe_supports_optimize_false_syntax(
+    image_ref: &str,
+    docker: &Docker,
+    print: &Print,
+) -> bool {
+    match probe_cli_version(image_ref, docker).await {
+        Ok(v) => {
+            let cutoff = Version::parse(OPTIMIZE_NEW_SYNTAX_MIN).unwrap();
+            v >= cutoff
+        }
+        Err(e) => {
+            print.warnln(format!(
+                "Could not probe container cli version ({e}); assuming pre-{OPTIMIZE_NEW_SYNTAX_MIN} syntax"
+            ));
+            false
+        }
+    }
+}
+
+async fn probe_cli_version(image_ref: &str, docker: &Docker) -> Result<Version, Error> {
+    let config = ContainerCreateBody {
+        image: Some(image_ref.to_string()),
+        cmd: Some(vec!["version".to_string(), "--only-version".to_string()]),
+        attach_stdout: Some(true),
+        attach_stderr: Some(true),
+        host_config: Some(HostConfig {
+            auto_remove: Some(true),
+            ..Default::default()
+        }),
+        ..Default::default()
+    };
+    let created = docker
+        .create_container(None::<CreateContainerOptions>, config)
+        .await?;
+    let attached = docker
+        .attach_container(
+            &created.id,
+            Some(AttachContainerOptions {
+                stdout: true,
+                stderr: true,
+                stream: true,
+                ..Default::default()
+            }),
+        )
+        .await?;
+    docker
+        .start_container(&created.id, None::<StartContainerOptions>)
+        .await?;
+
+    let mut stdout = String::new();
+    let mut output = attached.output;
+    while let Some(chunk) = output.next().await {
+        if let Ok(bollard::container::LogOutput::StdOut { message }) = chunk {
+            stdout.push_str(&String::from_utf8_lossy(&message));
+        }
+    }
+
+    let mut wait = docker.wait_container(&created.id, None::<WaitContainerOptions>);
+    while wait.next().await.is_some() {}
+
+    Version::parse(stdout.trim())
+        .map_err(|e| Error::TagListUnavailable(format!("unparseable version {stdout:?}: {e}")))
+}
+
+/// Probe the image for the toolchain rustup uses by default, so it can be
+/// pinned via `RUSTUP_TOOLCHAIN` (see `run_in_container`). Overrides the
+/// entrypoint to run `rustup show active-toolchain` and returns the toolchain
+/// name — the first whitespace-delimited token, dropping any trailing
+/// `(default)` marker (e.g. `1.93.0-x86_64-unknown-linux-gnu`). Returns `None`
+/// on any failure (e.g. an image without rustup), so the build proceeds without
+/// the pin rather than failing.
+async fn probe_active_toolchain(image_ref: &str, docker: &Docker) -> Option<String> {
+    let config = ContainerCreateBody {
+        image: Some(image_ref.to_string()),
+        entrypoint: Some(vec!["rustup".to_string()]),
+        cmd: Some(vec!["show".to_string(), "active-toolchain".to_string()]),
+        attach_stdout: Some(true),
+        attach_stderr: Some(true),
+        host_config: Some(HostConfig {
+            auto_remove: Some(true),
+            ..Default::default()
+        }),
+        ..Default::default()
+    };
+    let created = docker
+        .create_container(None::<CreateContainerOptions>, config)
+        .await
+        .ok()?;
+    let attached = docker
+        .attach_container(
+            &created.id,
+            Some(AttachContainerOptions {
+                stdout: true,
+                stderr: true,
+                stream: true,
+                ..Default::default()
+            }),
+        )
+        .await
+        .ok()?;
+    docker
+        .start_container(&created.id, None::<StartContainerOptions>)
+        .await
+        .ok()?;
+
+    let mut stdout = String::new();
+    let mut output = attached.output;
+    while let Some(chunk) = output.next().await {
+        if let Ok(bollard::container::LogOutput::StdOut { message }) = chunk {
+            stdout.push_str(&String::from_utf8_lossy(&message));
+        }
+    }
+
+    let mut wait = docker.wait_container(&created.id, None::<WaitContainerOptions>);
+    while wait.next().await.is_some() {}
+
+    stdout.split_whitespace().next().map(str::to_string)
+}
+
+/// Render the per-package `stellar contract build …` commands into a single
+/// `sh -c` script (`stellar … && stellar …`), shell-escaping every token so meta
+/// values with spaces survive. Used when more than one package is built so they
+/// share one container (and its crates download / compiled deps / `target/`).
+fn compose_shell_command(cmds: &[Vec<String>]) -> String {
+    cmds.iter()
+        .map(|cmd| {
+            std::iter::once("stellar")
+                .chain(cmd.iter().map(String::as_str))
+                .map(|tok| shell_escape::escape(tok.into()).into_owned())
+                .collect::<Vec<_>>()
+                .join(" ")
+        })
+        .collect::<Vec<_>>()
+        .join(" && ")
+}
+
+/// Shell-escape each token of a single-package container command so a value
+/// with spaces (a `--meta` value, or an `--env=` recorded as a `bldopt`)
+/// survives when the reproduce line is copy-pasted into a shell. The
+/// single-package path runs the image's default `stellar` entrypoint directly,
+/// so there's no `sh -c` wrapper as in `compose_shell_command`.
+fn escape_container_args(cmd: &[String]) -> String {
+    cmd.iter()
+        .map(|tok| shell_escape::escape(tok.into()).into_owned())
+        .collect::<Vec<_>>()
+        .join(" ")
+}
+
+async fn run_in_container(
+    image_ref: &str,
+    workspace_root: &Path,
+    container_cmds: &[Vec<String>],
+    env: &[String],
+    docker: &Docker,
+    print: &Print,
+    verbose: bool,
+) -> Result<(), Error> {
+    let bind = format!("{}:/source", workspace_root.display());
+
+    // Pin rustup to the image's own toolchain (per SEP-58): without this, a
+    // `rust-toolchain.toml` in the source could make rustup switch toolchains
+    // mid-build, defeating the digest-pinned image. Probe the image for its
+    // active toolchain and pass it through with `-e`, unless the caller already
+    // set RUSTUP_TOOLCHAIN. Skipped silently when the image has no rustup.
+    let mut env = env.to_vec();
+    if !env.iter().any(|e| e.starts_with("RUSTUP_TOOLCHAIN=")) {
+        if let Some(toolchain) = probe_active_toolchain(image_ref, docker).await {
+            env.push(format!("RUSTUP_TOOLCHAIN={toolchain}"));
+        }
+    }
+
+    // `-e KEY=VALUE` flags for the reproduce command, mirroring the env passed
+    // to the container below.
+    let mut env_flags = String::new();
+    for e in &env {
+        env_flags.push_str(" -e ");
+        env_flags.push_str(&shell_escape::escape(e.as_str().into()));
+    }
+
+    // One package → run the image's default `stellar` entrypoint directly.
+    // Several → override the entrypoint to a shell and chain the builds so they
+    // all run in this one container.
+    let (entrypoint, cmd, reproduce) = if container_cmds.len() > 1 {
+        let chain = compose_shell_command(container_cmds);
+        let reproduce = format!(
+            "docker run --rm -v {bind}{env_flags} --entrypoint /bin/sh {image_ref} -c {}",
+            shell_escape::escape(chain.clone().into())
+        );
+        (
+            Some(vec!["/bin/sh".to_string(), "-c".to_string()]),
+            vec![chain],
+            reproduce,
+        )
+    } else {
+        let cmd = container_cmds.first().cloned().unwrap_or_default();
+        let reproduce = format!(
+            "docker run --rm -v {bind}{env_flags} {image_ref} {}",
+            escape_container_args(&cmd)
+        );
+        (None, cmd, reproduce)
+    };
+
+    let config = ContainerCreateBody {
+        image: Some(image_ref.to_string()),
+        entrypoint,
+        cmd: Some(cmd),
+        env: (!env.is_empty()).then(|| env.clone()),
+        working_dir: Some("/source".to_string()),
+        attach_stdout: Some(true),
+        attach_stderr: Some(true),
+        host_config: Some(HostConfig {
+            auto_remove: Some(true),
+            binds: Some(vec![bind.clone()]),
+            ..Default::default()
+        }),
+        ..Default::default()
+    };
+
+    print.infoln(format!(
+        "Running verifiable build in {image_ref} (mount {bind})"
+    ));
+    if verbose {
+        print.infoln(format!("Running: {reproduce}"));
+    }
+
+    let created = docker
+        .create_container(None::<CreateContainerOptions>, config)
+        .await?;
+
+    let attached = docker
+        .attach_container(
+            &created.id,
+            Some(AttachContainerOptions {
+                stdout: true,
+                stderr: true,
+                stream: true,
+                ..Default::default()
+            }),
+        )
+        .await?;
+
+    docker
+        .start_container(&created.id, None::<StartContainerOptions>)
+        .await?;
+
+    let mut output = attached.output;
+    while let Some(chunk) = output.next().await {
+        match chunk {
+            Ok(
+                bollard::container::LogOutput::StdOut { message }
+                | bollard::container::LogOutput::StdErr { message },
+            ) => {
+                if verbose {
+                    let s = String::from_utf8_lossy(&message);
+                    print.blankln(s.trim_end());
+                }
+            }
+            Ok(_) => {}
+            Err(e) => return Err(e.into()),
+        }
+    }
+
+    wait_for_container_exit(docker, &created.id, &reproduce).await
+}
+
+/// Block until the container exits, mapping a non-zero exit code (whether
+/// reported as a successful wait or as a `DockerContainerWaitError`) to
+/// `ContainerExit` carrying the reproduce command.
+async fn wait_for_container_exit(docker: &Docker, id: &str, reproduce: &str) -> Result<(), Error> {
+    let mut wait = docker.wait_container(id, None::<WaitContainerOptions>);
+    while let Some(item) = wait.next().await {
+        // Both a successful wait and a `DockerContainerWaitError` carry an exit
+        // code; normalize to it (other errors are genuine failures).
+        let status = match item {
+            Ok(r) => r.status_code,
+            Err(bollard::errors::Error::DockerContainerWaitError { code, .. }) => code,
+            Err(e) => return Err(e.into()),
+        };
+        if status != 0 {
+            return Err(Error::ContainerExit {
+                status,
+                command: reproduce.to_string(),
+            });
+        }
+    }
+
+    Ok(())
+}
+
+/// Collect the built WASM artifacts. Package names and the host target dir come
+/// from host `cargo metadata`. `extracted_root` is set when the build ran
+/// against an extracted archive (step: `--archive`): the artifacts then live
+/// under that tree's target dir and must be copied out before its tempdir
+/// drops. `source_root` is the host source root the extracted tree mirrors, so
+/// the target dir's position relative to it carries over.
+fn collect_built_contracts(
+    cmd: &Cmd,
+    source_root: &Path,
+    extracted_root: Option<&Path>,
+    _print: &Print,
+) -> Result<Vec<BuiltContract>, super::Error> {
+    let mut mc = MetadataCommand::new();
+    mc.no_deps();
+    if let Some(p) = &cmd.manifest_path {
+        mc.manifest_path(p);
+    }
+    let md = mc.exec().map_err(Error::Metadata)?;
+    let host_target = md.target_directory.as_std_path();
+
+    // Where the build actually wrote artifacts. For an extracted-archive build
+    // that's `<extracted>/<host_target relative to source_root>`; otherwise the
+    // host target dir (the working tree was bind-mounted directly).
+    let src_target = match extracted_root {
+        Some(er) => er.join(host_target.strip_prefix(source_root).unwrap_or(host_target)),
+        None => host_target.to_path_buf(),
+    };
+
+    let mut out = Vec::new();
+    for p in &md.packages {
+        let is_cdylib = p
+            .targets
+            .iter()
+            .any(|t| t.crate_types.iter().any(|c| c == "cdylib"));
+        if !is_cdylib {
+            continue;
+        }
+        if let Some(name) = &cmd.package {
+            if &p.name != name {
+                continue;
+            }
+        } else if !md.workspace_default_members.contains(&p.id) {
+            continue;
+        }
+        let wasm_name = p.name.replace('-', "_");
+        let rel = Path::new(WASM_TARGET)
+            .join(&cmd.profile)
+            .join(format!("{wasm_name}.wasm"));
+        let src = src_target.join(&rel);
+
+        // Destination: --out-dir wins; else if the build ran in a tempdir, copy
+        // into the host target dir so the artifact survives; else leave in
+        // place (the working tree was mounted, so it's already on the host).
+        let dest = if let Some(out_dir) = &cmd.out_dir {
+            Some(out_dir.join(format!("{wasm_name}.wasm")))
+        } else if extracted_root.is_some() {
+            Some(host_target.join(&rel))
+        } else {
+            None
+        };
+
+        let path = match dest {
+            Some(dest) if src.exists() => {
+                if let Some(parent) = dest.parent() {
+                    std::fs::create_dir_all(parent).map_err(super::Error::CreatingOutDir)?;
+                }
+                std::fs::copy(&src, &dest).map_err(super::Error::CopyingWasmFile)?;
+                dest
+            }
+            // Source missing: report the intended dest (matches prior leniency).
+            Some(dest) => dest,
+            None => src,
+        };
+        out.push(BuiltContract {
+            name: p.name.clone(),
+            path,
+        });
+    }
+    Ok(out)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn ws() -> &'static Path {
+        Path::new("/tmp/ws")
+    }
+
+    #[test]
+    fn build_forwarded_args_defaults() {
+        let cmd = Cmd::default();
+        let (forwarded, bldopts) = build_forwarded_args(&cmd, ws(), cmd.package.as_deref(), true);
+        // Default optimize=true → bare `--optimize` recorded + forwarded.
+        assert_eq!(
+            forwarded,
+            vec!["--locked".to_string(), "--optimize".to_string()]
+        );
+        assert_eq!(
+            bldopts,
+            vec!["--locked".to_string(), "--optimize".to_string()]
+        );
+    }
+
+    #[test]
+    fn build_forwarded_args_features_and_package() {
+        let cmd = Cmd {
+            features: Some("a,b".to_string()),
+            package: Some("contract-a".to_string()),
+            ..Cmd::default()
+        };
+        let (forwarded, bldopts) = build_forwarded_args(&cmd, ws(), cmd.package.as_deref(), true);
+        assert!(forwarded.contains(&"--features=a,b".to_string()));
+        assert!(forwarded.contains(&"--package=contract-a".to_string()));
+        assert!(bldopts.contains(&"--features=a,b".to_string()));
+        assert!(bldopts.contains(&"--package=contract-a".to_string()));
+        assert!(bldopts.contains(&"--locked".to_string()));
+    }
+
+    #[test]
+    fn build_forwarded_args_records_resolved_package_when_unspecified() {
+        // No `--package` on the cmd, but the caller resolved one (single
+        // default cdylib); it must still be forwarded and recorded.
+        let cmd = Cmd::default();
+        assert!(cmd.package.is_none());
+        let (forwarded, bldopts) = build_forwarded_args(&cmd, ws(), Some("hello-world"), true);
+        assert!(forwarded.contains(&"--package=hello-world".to_string()));
+        assert!(bldopts.contains(&"--package=hello-world".to_string()));
+    }
+
+    #[test]
+    fn build_forwarded_args_omits_package_when_unresolved() {
+        let cmd = Cmd::default();
+        let (forwarded, bldopts) = build_forwarded_args(&cmd, ws(), None, true);
+        assert!(!forwarded.iter().any(|a| a.starts_with("--package")));
+        assert!(!bldopts.iter().any(|a| a.starts_with("--package")));
+    }
+
+    #[test]
+    fn build_forwarded_args_records_meta_and_manifest() {
+        let cmd = Cmd {
+            manifest_path: Some(PathBuf::from("/tmp/ws/contracts/add/Cargo.toml")),
+            build_args: super::super::BuildArgs {
+                meta: vec![
+                    ("home_domain".to_string(), "fnando.com".to_string()),
+                    ("author".to_string(), "alice".to_string()),
+                ],
+                env: vec![],
+                optimize: true,
+            },
+            ..Cmd::default()
+        };
+        let (forwarded, bldopts) = build_forwarded_args(&cmd, ws(), cmd.package.as_deref(), true);
+        assert!(forwarded.contains(&"--meta=home_domain=fnando.com".to_string()));
+        assert!(forwarded.contains(&"--meta=author=alice".to_string()));
+        assert!(forwarded.contains(&"--manifest-path=contracts/add/Cargo.toml".to_string()));
+        assert!(bldopts.contains(&"--meta=home_domain=fnando.com".to_string()));
+        assert!(bldopts.contains(&"--meta=author=alice".to_string()));
+        assert!(bldopts.contains(&"--manifest-path=contracts/add/Cargo.toml".to_string()));
+    }
+
+    #[test]
+    fn build_forwarded_args_records_env_as_bldopt_only() {
+        let cmd = Cmd {
+            build_args: super::super::BuildArgs {
+                env: vec![
+                    ("FOO".to_string(), "bar".to_string()),
+                    ("BAZ".to_string(), "qux".to_string()),
+                ],
+                ..super::super::BuildArgs::default()
+            },
+            ..Cmd::default()
+        };
+        let (forwarded, bldopts) = build_forwarded_args(&cmd, ws(), cmd.package.as_deref(), true);
+        // Env vars are applied via docker `-e`, so they're recorded as bldopts
+        // for the verifier but never forwarded as build arguments.
+        assert!(bldopts.contains(&"--env=FOO=bar".to_string()));
+        assert!(bldopts.contains(&"--env=BAZ=qux".to_string()));
+        assert!(!forwarded.iter().any(|a| a.starts_with("--env")));
+    }
+
+    #[test]
+    fn build_forwarded_args_optimize_false_new_container() {
+        let cmd = Cmd {
+            build_args: super::super::BuildArgs {
+                meta: vec![],
+                env: vec![],
+                optimize: false,
+            },
+            ..Cmd::default()
+        };
+        let (forwarded, bldopts) = build_forwarded_args(&cmd, ws(), cmd.package.as_deref(), true);
+        assert!(forwarded.contains(&"--optimize=false".to_string()));
+        assert!(bldopts.contains(&"--optimize=false".to_string()));
+    }
+
+    #[test]
+    fn build_forwarded_args_optimize_false_old_container() {
+        let cmd = Cmd {
+            build_args: super::super::BuildArgs {
+                meta: vec![],
+                env: vec![],
+                optimize: false,
+            },
+            ..Cmd::default()
+        };
+        let (forwarded, bldopts) = build_forwarded_args(&cmd, ws(), cmd.package.as_deref(), false);
+        // Old container's default is already false; record nothing.
+        // Passing `--optimize=false` to a pre-26.1.0 cli would fail.
+        assert!(!forwarded.iter().any(|a| a.starts_with("--optimize")));
+        assert!(!bldopts.iter().any(|a| a.starts_with("--optimize")));
+    }
+
+    fn pairs(args: &[String]) -> Vec<(&str, &str)> {
+        args.chunks(2)
+            .map(|c| (c[0].as_str(), c[1].as_str()))
+            .collect()
+    }
+
+    #[test]
+    fn build_metadata_args_uri_and_sha256() {
+        let ids = SourceIds {
+            source_uri: Some("https://example.com/src.tar.gz".to_string()),
+            source_sha256: Some("a".repeat(64)),
+        };
+        let m = build_metadata_args(
+            "docker.io/stellar/stellar-cli@sha256:abc",
+            &ids,
+            &["--locked".to_string(), "--features=a".to_string()],
+        );
+        let p = pairs(&m);
+        // bldimg first; source_uri then source_sha256; bldopts last.
+        assert_eq!(
+            p[0],
+            ("--meta", "bldimg=docker.io/stellar/stellar-cli@sha256:abc")
+        );
+        assert_eq!(
+            p[1],
+            ("--meta", "source_uri=https://example.com/src.tar.gz")
+        );
+        assert_eq!(p[2].0, "--meta");
+        assert!(p[2].1.starts_with("source_sha256="));
+        assert_eq!(p[3], ("--meta", "bldopt=--locked"));
+        assert_eq!(p[4], ("--meta", "bldopt=--features=a"));
+    }
+
+    #[test]
+    fn build_forwarded_args_escapes_bldopt_values_as_shell() {
+        // Values with shell metacharacters are escaped at the source so each
+        // recorded bldopt is valid shell on its own. Only the value side is
+        // quoted: `--env=B='this is very nice'`, never `'--env=B=this is very
+        // nice'` (which would quote the flag and key too).
+        let cmd = Cmd {
+            features: Some("a,b".to_string()),
+            build_args: super::super::BuildArgs {
+                meta: vec![("note".to_string(), "added on build".to_string())],
+                env: vec![
+                    ("B".to_string(), "this is very nice".to_string()),
+                    ("C".to_string(), "it's a \"trap\"".to_string()),
+                ],
+                optimize: true,
+            },
+            ..Cmd::default()
+        };
+        let (_forwarded, bldopts) = build_forwarded_args(&cmd, ws(), cmd.package.as_deref(), true);
+
+        // The flag and key stay outside the quotes; only the value is escaped.
+        assert!(bldopts.contains(&"--env=B='this is very nice'".to_string()));
+        assert!(bldopts.contains(&"--meta=note='added on build'".to_string()));
+        // No-metacharacter values stay verbatim.
+        assert!(bldopts.contains(&"--features=a,b".to_string()));
+
+        // Every recorded bldopt is valid shell that parses back to one argv token.
+        for o in &bldopts {
+            let tokens = shlex::split(o).expect("each bldopt must be valid shell");
+            assert_eq!(tokens.len(), 1, "{o} must be a single shell token");
+        }
+    }
+
+    #[test]
+    fn build_metadata_args_sha256_only_omits_uri() {
+        let ids = SourceIds {
+            source_sha256: Some("f".repeat(64)),
+            ..SourceIds::default()
+        };
+        let m = build_metadata_args("docker.io/stellar/stellar-cli@sha256:abc", &ids, &[]);
+        assert!(m
+            .iter()
+            .any(|s| s == &format!("source_sha256={}", "f".repeat(64))));
+        assert!(!m.iter().any(|s| s.starts_with("source_uri=")));
+    }
+
+    #[test]
+    fn validate_source_formats_rejects_bad_sha256() {
+        let cmd = Cmd {
+            source_sha256: Some("not-a-sha".to_string()),
+            ..Cmd::default()
+        };
+        let err = validate_source_formats(&cmd).unwrap_err();
+        assert!(matches!(err, Error::SourceSha256Format { .. }));
+    }
+
+    #[test]
+    fn validate_source_formats_rejects_bad_uri() {
+        let cmd = Cmd {
+            source_uri: Some("not a uri".to_string()), // no scheme
+            source_sha256: Some("a".repeat(64)),
+            ..Cmd::default()
+        };
+        let err = validate_source_formats(&cmd).unwrap_err();
+        assert!(matches!(err, Error::SourceUriFormat { .. }));
+    }
+
+    #[test]
+    fn validate_source_formats_accepts_valid_and_absent() {
+        // Both absent is fine here — requiredness is enforced in run().
+        validate_source_formats(&Cmd::default()).unwrap();
+        let cmd = Cmd {
+            source_uri: Some("https://example.com/src.tar.gz".to_string()),
+            source_sha256: Some("f".repeat(64)),
+            ..Cmd::default()
+        };
+        validate_source_formats(&cmd).unwrap();
+    }
+
+    #[test]
+    fn bldimg_regex_accepts_docker_hub_full_ref() {
+        assert!(bldimg_regex().is_match(&format!(
+            "docker.io/stellar/stellar-cli@sha256:{}",
+            "a".repeat(64)
+        )));
+    }
+
+    #[test]
+    fn bldimg_regex_accepts_localhost_registry() {
+        assert!(bldimg_regex().is_match(&format!("localhost:5000/foo@sha256:{}", "0".repeat(64))));
+    }
+
+    #[test]
+    fn bldimg_regex_rejects_implicit_hub_short_ref() {
+        // Implicit Docker Hub short ref: no registry host prefix.
+        assert!(!bldimg_regex().is_match(&format!("stellar/stellar-cli@sha256:{}", "a".repeat(64))));
+    }
+
+    #[test]
+    fn bldimg_regex_rejects_tag_only() {
+        assert!(!bldimg_regex().is_match("docker.io/stellar/stellar-cli:latest"));
+    }
+
+    #[test]
+    fn bldimg_regex_rejects_short_sha() {
+        assert!(!bldimg_regex().is_match("docker.io/stellar/stellar-cli@sha256:abc"));
+    }
+
+    #[test]
+    fn source_sha256_regex_matches_64_hex() {
+        assert!(source_sha256_regex().is_match(&"f".repeat(64)));
+        assert!(!source_sha256_regex().is_match(&"f".repeat(63)));
+        assert!(!source_sha256_regex().is_match(&"F".repeat(64))); // upper-case rejected
+    }
+
+    #[test]
+    fn source_uri_regex_accepts_any_scheme() {
+        assert!(source_uri_regex().is_match("https://example.com/src.tar.gz"));
+        assert!(source_uri_regex().is_match("http://example.com/foo.git"));
+        assert!(source_uri_regex().is_match("ipfs://Qm...abc"));
+        assert!(source_uri_regex().is_match("github:foo/bar"));
+        assert!(!source_uri_regex().is_match("foo/bar")); // no scheme
+        assert!(!source_uri_regex().is_match("https://has space")); // whitespace
+    }
+
+    #[test]
+    fn compose_container_args_prefixes_subcommand() {
+        let composed = compose_container_args(
+            &["--locked".to_string()],
+            &["--meta".to_string(), "bldimg=x".to_string()],
+        );
+        assert_eq!(composed[..2], ["contract".to_string(), "build".to_string()]);
+        assert!(composed.contains(&"--locked".to_string()));
+        assert!(composed.contains(&"bldimg=x".to_string()));
+    }
+
+    #[test]
+    fn reserved_meta_keys_list() {
+        for key in ["bldimg", "source_uri", "source_sha256", "bldopt"] {
+            assert!(RESERVED_META_KEYS.contains(&key));
+        }
+    }
+
+    #[test]
+    fn compose_shell_command_chains_and_escapes() {
+        let a = vec![
+            "contract".to_string(),
+            "build".to_string(),
+            "--package=another".to_string(),
+            "--meta".to_string(),
+            "home_domain=fnando.com".to_string(),
+        ];
+        let b = vec![
+            "contract".to_string(),
+            "build".to_string(),
+            "--package=hello-world".to_string(),
+        ];
+        let s = compose_shell_command(&[a, b]);
+        assert_eq!(
+            s,
+            "stellar contract build --package=another --meta home_domain=fnando.com \
+             && stellar contract build --package=hello-world"
+        );
+
+        // A meta value with a space must be quoted so it stays one token.
+        let c = vec![
+            "contract".to_string(),
+            "build".to_string(),
+            "--meta".to_string(),
+            "note=added on build".to_string(),
+        ];
+        let s = compose_shell_command(&[c]);
+        assert!(
+            s.contains("'note=added on build'") || s.contains("\"note=added on build\""),
+            "expected the spaced value to be quoted, got: {s}"
+        );
+    }
+
+    #[test]
+    fn escape_container_args_quotes_spaced_tokens() {
+        // An `--env=` recorded as a bldopt carries the env value verbatim, so a
+        // spaced value lands in a single `--meta bldopt=…` token. The reproduce
+        // line must quote it so a copy-paste round-trips back to one argv token.
+        let cmd = vec![
+            "contract".to_string(),
+            "build".to_string(),
+            "--package=hello-world".to_string(),
+            "--meta".to_string(),
+            "bldopt=--env=B=this is very nice".to_string(),
+        ];
+        let s = escape_container_args(&cmd);
+        let tokens = shlex::split(&s).expect("reproduce args must be valid shell");
+        assert_eq!(
+            tokens,
+            vec![
+                "contract",
+                "build",
+                "--package=hello-world",
+                "--meta",
+                "bldopt=--env=B=this is very nice",
+            ],
+            "spaced token must survive a shlex round-trip as one argument"
+        );
+    }
+}
diff --git a/cmd/soroban-cli/src/commands/contract/deploy/wasm.rs b/cmd/soroban-cli/src/commands/contract/deploy/wasm.rs
index 94ed1d0b5..9f67e4f9c 100644
--- a/cmd/soroban-cli/src/commands/contract/deploy/wasm.rs
+++ b/cmd/soroban-cli/src/commands/contract/deploy/wasm.rs
@@ -190,7 +190,7 @@ impl Cmd {
             return Err(Error::BuildOnlyNotSupported);
         }
 
-        let built_contracts = self.resolve_contracts(global_args)?;
+        let built_contracts = self.resolve_contracts(global_args).await?;
 
         // When --wasm-hash is used, no built contracts are returned.
         // Deploy directly with the hash.
@@ -267,7 +267,7 @@ impl Cmd {
         Ok(())
     }
 
-    fn resolve_contracts(
+    async fn resolve_contracts(
         &self,
         global_args: &global::Args,
     ) -> Result<Vec<build::BuiltContract>, Error> {
@@ -290,7 +290,7 @@ impl Cmd {
             build_args: self.build_args.clone(),
             ..build::Cmd::default()
         };
-        let contracts = build_cmd.run(global_args).map_err(|e| match e {
+        let contracts = build_cmd.run(global_args).await.map_err(|e| match e {
             build::Error::Metadata(_) => Error::NotInCargoProject,
             other => other.into(),
         })?;
diff --git a/cmd/soroban-cli/src/commands/contract/fetch.rs b/cmd/soroban-cli/src/commands/contract/fetch.rs
index a02bf9886..2905b8e37 100644
--- a/cmd/soroban-cli/src/commands/contract/fetch.rs
+++ b/cmd/soroban-cli/src/commands/contract/fetch.rs
@@ -22,14 +22,18 @@ pub struct Cmd {
     /// Contract ID to fetch
     #[arg(long = "id", env = "STELLAR_CONTRACT_ID")]
     pub contract_id: Option<config::UnresolvedContract>,
+
     /// Wasm to fetch
     #[arg(long = "wasm-hash", conflicts_with = "contract_id")]
     pub wasm_hash: Option<String>,
+
     /// Where to write output otherwise stdout is used
     #[arg(long, short = 'o')]
     pub out_file: Option<std::path::PathBuf>,
+
     #[command(flatten)]
     pub locator: locator::Args,
+
     #[command(flatten)]
     pub network: network::Args,
 }
diff --git a/cmd/soroban-cli/src/commands/contract/mod.rs b/cmd/soroban-cli/src/commands/contract/mod.rs
index a5e6ce181..ee140be93 100644
--- a/cmd/soroban-cli/src/commands/contract/mod.rs
+++ b/cmd/soroban-cli/src/commands/contract/mod.rs
@@ -1,4 +1,5 @@
 pub mod alias;
+pub mod archive;
 pub mod arg_parsing;
 pub mod asset;
 pub mod bindings;
@@ -33,6 +34,9 @@ pub enum Cmd {
     #[command(subcommand)]
     Bindings(bindings::Cmd),
 
+    /// Generate the reproducible source archive used by verifiable builds
+    Archive(archive::Cmd),
+
     Build(build::Cmd),
 
     /// Extend the time to live ledger of a contract-data ledger entry.
@@ -113,6 +117,9 @@ pub enum Error {
     #[error(transparent)]
     Bindings(#[from] bindings::Error),
 
+    #[error(transparent)]
+    Archive(#[from] archive::Error),
+
     #[error(transparent)]
     Build(#[from] build::Error),
 
@@ -163,8 +170,9 @@ impl Cmd {
         match &self {
             Cmd::Asset(asset) => asset.run(global_args).await?,
             Cmd::Bindings(bindings) => bindings.run().await?,
+            Cmd::Archive(archive) => archive.run(global_args)?,
             Cmd::Build(build) => {
-                build.run(global_args)?;
+                build.run(global_args).await?;
             }
             Cmd::Extend(extend) => extend.run(global_args).await?,
             Cmd::Alias(alias) => alias.run(global_args)?,
diff --git a/cmd/soroban-cli/src/commands/contract/upload.rs b/cmd/soroban-cli/src/commands/contract/upload.rs
index 55b8e308b..9a843880d 100644
--- a/cmd/soroban-cli/src/commands/contract/upload.rs
+++ b/cmd/soroban-cli/src/commands/contract/upload.rs
@@ -144,7 +144,7 @@ impl Cmd {
             return Err(Error::BuildOnlyNotSupported);
         }
 
-        let wasm_paths = self.resolve_wasm_paths(global_args)?;
+        let wasm_paths = self.resolve_wasm_paths(global_args).await?;
 
         for wasm_path in &wasm_paths {
             let res = self
@@ -181,7 +181,7 @@ impl Cmd {
         self.upload_wasm(&wasm_path, config, quiet, no_cache).await
     }
 
-    fn resolve_wasm_paths(&self, global_args: &global::Args) -> Result<Vec<PathBuf>, Error> {
+    async fn resolve_wasm_paths(&self, global_args: &global::Args) -> Result<Vec<PathBuf>, Error> {
         if let Some(wasm) = &self.wasm {
             Ok(vec![wasm.clone()])
         } else {
@@ -190,7 +190,7 @@ impl Cmd {
                 build_args: self.build_args.clone(),
                 ..build::Cmd::default()
             };
-            let contracts = build_cmd.run(global_args).map_err(|e| match e {
+            let contracts = build_cmd.run(global_args).await.map_err(|e| match e {
                 build::Error::Metadata(_) => Error::NotInCargoProject,
                 other => other.into(),
             })?;
diff --git a/cmd/soroban-cli/src/config/data.rs b/cmd/soroban-cli/src/config/data.rs
index e310ebf13..6e49f1926 100644
--- a/cmd/soroban-cli/src/config/data.rs
+++ b/cmd/soroban-cli/src/config/data.rs
@@ -58,6 +58,12 @@ pub fn bucket_dir() -> Result<std::path::PathBuf, Error> {
     Ok(dir)
 }
 
+pub fn archives_dir() -> Result<std::path::PathBuf, Error> {
+    let dir = data_local_dir()?.join("archives");
+    std::fs::create_dir_all(&dir)?;
+    Ok(dir)
+}
+
 pub fn write(action: Action, rpc_url: &Url) -> Result<ulid::Ulid, Error> {
     let data = Data {
         action,
@@ -211,6 +217,18 @@ mod test {
     use crate::test_utils::with_env_set;
     use serial_test::serial;
 
+    #[test]
+    #[serial]
+    fn archives_dir_under_data_home_and_created() {
+        let t = assert_fs::TempDir::new().unwrap();
+        with_env_set("STELLAR_DATA_HOME", t.path(), || {
+            let dir = archives_dir().unwrap();
+            assert!(dir.ends_with("archives"));
+            assert!(dir.starts_with(t.path()));
+            assert!(dir.is_dir(), "archives_dir() should create the directory");
+        });
+    }
+
     #[test]
     #[serial]
     fn test_write_read() {
diff --git a/cmd/soroban-cli/src/config/locator.rs b/cmd/soroban-cli/src/config/locator.rs
index 7a02091f5..93a3d6e83 100644
--- a/cmd/soroban-cli/src/config/locator.rs
+++ b/cmd/soroban-cli/src/config/locator.rs
@@ -574,52 +574,66 @@ impl Pwd for Args {
     }
 }
 
-#[cfg(unix)]
-fn fix_config_permissions(root: std::path::PathBuf) {
-    use std::os::unix::fs::PermissionsExt;
-
-    let mut bad_dirs = Vec::new();
-    let mut bad_files = Vec::new();
-    let mut stack = vec![root];
-
-    while let Some(dir) = stack.pop() {
-        if let Ok(meta) = std::fs::metadata(&dir) {
-            if meta.permissions().mode() & 0o777 != 0o700 {
-                bad_dirs.push(dir.clone());
+/// Walk `root` recursively. For every regular entry whose permissions don't
+/// already match the hardened mode (0o700 for dirs, 0o600 for files), set
+/// them. Returns the dirs and files that were changed so callers can decide
+/// whether to surface a warning. Symlinks are skipped — mode bits aren't
+/// meaningful for them and `set_permissions` would follow them.
+///
+/// On non-unix platforms this is a no-op; tempdirs / config dirs there rely
+/// on filesystem ACLs created by the higher-level APIs.
+#[allow(clippy::unnecessary_wraps)]
+pub(crate) fn enforce_hardened_tree(root: &Path) -> io::Result<(Vec<PathBuf>, Vec<PathBuf>)> {
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let mut changed_dirs = Vec::new();
+        let mut changed_files = Vec::new();
+        let mut stack = vec![root.to_path_buf()];
+        while let Some(p) = stack.pop() {
+            let Ok(meta) = std::fs::symlink_metadata(&p) else {
+                continue;
+            };
+            if meta.file_type().is_symlink() {
+                continue;
             }
-        }
-
-        if let Ok(entries) = std::fs::read_dir(&dir) {
-            for entry in entries.filter_map(Result::ok) {
-                let path = entry.path();
-
-                if path.is_dir() {
-                    stack.push(path);
-                } else if let Ok(meta) = std::fs::metadata(&path) {
-                    if meta.permissions().mode() & 0o777 != 0o600 {
-                        bad_files.push(path);
+            let current = meta.permissions().mode() & 0o777;
+            if meta.is_dir() {
+                if current != 0o700 {
+                    set_hardened_permissions(&p)?;
+                    changed_dirs.push(p.clone());
+                }
+                if let Ok(entries) = std::fs::read_dir(&p) {
+                    for entry in entries.filter_map(Result::ok) {
+                        stack.push(entry.path());
                     }
                 }
+            } else if current != 0o600 {
+                set_hardened_permissions(&p)?;
+                changed_files.push(p);
             }
         }
+        Ok((changed_dirs, changed_files))
     }
+    #[cfg(not(unix))]
+    {
+        let _ = root;
+        Ok((Vec::new(), Vec::new()))
+    }
+}
 
-    let print = Print::new(false);
+#[cfg(unix)]
+fn fix_config_permissions(root: std::path::PathBuf) {
+    let Ok((dirs, files)) = enforce_hardened_tree(&root) else {
+        return;
+    };
 
-    if !bad_dirs.is_empty() {
+    let print = Print::new(false);
+    if !dirs.is_empty() {
         print.warnln("Updated config directories permissions to 0700.");
-
-        for dir in bad_dirs {
-            let _ = set_hardened_permissions(&dir);
-        }
     }
-
-    if !bad_files.is_empty() {
+    if !files.is_empty() {
         print.warnln("Updated config files permissions to 0600.");
-
-        for file in bad_files {
-            let _ = set_hardened_permissions(&file);
-        }
     }
 }